qlogicagent 2.13.5 → 2.13.6

package/dist/cli/handlers/workflow-handler.multiroot.test.js

@@ -1,745 +0,0 @@
-/**
- * IT-1 multi-root + portable-bundle coverage (spec D21/D23):
- * - workflow.* routes by projectId to that project's root; aggregate list spans
- *   the active root + every automation project, tagging records with projectId.
- * - workflow.export sanitizes credential-shaped params and derives requires.
- * - workflow.import / workflow.duplicate land a copy (graph + trigger) in a target project.
- * - createProject(type:"automation") seeds the primary workflow without stealing the
- *   active project (项目名=工作流名, spec D21).
- *
- * Real stores on a temp QLOGICAGENT_HOME — no mocks of the engine itself (§1.5).
- */
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import * as projectStore from "../../runtime/infra/project-store.js";
-import { createProject as createProjectCommand } from "../project-command-service.js";
-import { STRIPPED_CREDENTIAL_PLACEHOLDER } from "../../orchestration/workflow/workflow-bundle.js";
-import { handleWorkflowApprovals, handleWorkflowApprove, handleWorkflowAudit, handleWorkflowCapabilities, handleWorkflowCreate, handleWorkflowDuplicate, handleWorkflowExport, handleWorkflowImport, handleWorkflowIntentIndex, handleWorkflowList, handleWorkflowOnForm, handleWorkflowOnIntent, handleWorkflowOnWebhook, handleWorkflowPatch, handleWorkflowPublishHub, handleWorkflowRun, handleWorkflowSetPermissionScope, } from "./workflow-handler.js";
-const tmpDirs = [];
-function makeTempDir(prefix) {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-    tmpDirs.push(dir);
-    return dir;
-}
-afterEach(() => {
-    vi.unstubAllEnvs();
-    for (const dir of tmpDirs.splice(0)) {
-        fs.rmSync(dir, { recursive: true, force: true });
-    }
-});
-function request(method, params, id) {
-    return { jsonrpc: "2.0", id, method, params };
-}
-function createHost(activeCwd) {
-    return {
-        notifications: [],
-        responses: [],
-        acpDetector: { buildExternalDescriptor: () => undefined, list: () => [] },
-        getActiveProjectRoot: () => activeCwd,
-        handleMcpToolCall: async () => ({}),
-        toolCatalog: {
-            findTool: () => undefined,
-            getToolManifest: () => [],
-            getToolNames: () => [],
-            setTools: () => { },
-            addTool: () => { },
-            addTools: () => { },
-            removeTool: () => false,
-            activateTool: () => false,
-            clearActivatedTools: () => { },
-        },
-        sendNotification(method, params) {
-            this.notifications.push({ method, params });
-        },
-        sendResponse(id, result, error) {
-            this.responses.push({ id, result, error });
-        },
-        workflowRoots: null,
-    };
-}
-function stopAllSchedulers(host) {
-    for (const bundle of host.workflowRoots?.values() ?? [])
-        bundle.scheduler.stop();
-}
-function isolateHome() {
-    const home = makeTempDir("wf-multiroot-home-");
-    vi.stubEnv("QLOGICAGENT_HOME", home);
-    vi.stubEnv("QLOGIC_LLMROUTER_USER_ID", "user/tester");
-    return home;
-}
-const SIMPLE_DEF = (id) => ({
-    id,
-    nodes: [{ id: "n1", kind: "set", params: { json: { ok: true } } }],
-    edges: [],
-});
-describe("workflow multi-root routing (D21)", () => {
-    it("routes create/list by projectId and aggregates across automation projects", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-active-");
-        const autoCwd = makeTempDir("wf-auto-");
-        const autoProject = projectStore.createProject({
-            name: "晨报",
-            workspaceDir: autoCwd,
-            type: "automation",
-            skipAutoSwitch: true,
-        });
-        const host = createHost(activeCwd);
-        // One workflow in the active root, one in the automation project's root.
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-active", name: "active-flow", def: SIMPLE_DEF("wf-active") }, 1));
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-auto", name: "auto-flow", def: SIMPLE_DEF("wf-auto"), projectId: autoProject.id }, 2));
-        // Physically project-scoped on disk.
-        expect(fs.existsSync(path.join(autoCwd, ".qlogicagent", "workflows", "wf-auto", "workflow.json"))).toBe(true);
-        expect(fs.existsSync(path.join(activeCwd, ".qlogicagent", "workflows", "wf-active", "workflow.json"))).toBe(true);
-        // Scoped list: only that project's workflows.
-        await handleWorkflowList.call(host, request("workflow.list", { projectId: autoProject.id }, 3));
-        const scoped = host.responses.at(-1).result;
-        expect(scoped.workflows.map(w => w.id)).toEqual(["wf-auto"]);
-        expect(scoped.workflows[0].projectId).toBe(autoProject.id);
-        // Aggregate list: spans the active root AND the automation project, each tagged.
-        await handleWorkflowList.call(host, request("workflow.list", {}, 4));
-        const aggregate = host.responses.at(-1).result;
-        const ids = aggregate.workflows.map(w => w.id);
-        expect(ids).toContain("wf-active");
-        expect(ids).toContain("wf-auto");
-        expect(aggregate.workflows.find(w => w.id === "wf-auto")?.projectId).toBe(autoProject.id);
-        // Unknown projectId fails loud (INVALID_PARAMS), not silently against the active root.
-        await handleWorkflowList.call(host, request("workflow.list", { projectId: "nope" }, 5));
-        expect(host.responses.at(-1).error?.message).toContain("unknown projectId");
-        stopAllSchedulers(host);
-    });
-});
-describe("portable bundle export/import/duplicate (D23)", () => {
-    it("export strips credential-shaped params and derives requires", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-export-");
-        const host = createHost(activeCwd);
-        const def = {
-            id: "wf-exp",
-            nodes: [
-                { id: "t", kind: "trigger" },
-                { id: "h", kind: "http", name: "拉数据", params: { url: "https://api.example.com", headers: { Authorization: "Bearer s3cret" } } },
-                { id: "c", kind: "channel", name: "发飞书", params: { channel: "feishu", payload: "hi", token: "abc123" } },
-            ],
-            edges: [
-                { from: "t", to: "h" },
-                { from: "h", to: "c" },
-            ],
-        };
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-exp", name: "出口流", def }, 1));
-        await handleWorkflowExport.call(host, request("workflow.export", { id: "wf-exp" }, 2));
-        const { bundle } = host.responses.at(-1).result;
-        expect(bundle.schemaVersion).toBe(2);
-        expect(bundle.name).toBe("出口流");
-        const httpNode = bundle.def.nodes.find(n => n.id === "h");
-        expect(httpNode.params.headers.Authorization).toBe(STRIPPED_CREDENTIAL_PLACEHOLDER);
-        const channelNode = bundle.def.nodes.find(n => n.id === "c");
-        expect(channelNode.params.token).toBe(STRIPPED_CREDENTIAL_PLACEHOLDER);
-        // No secret value survives anywhere in the serialized bundle (§1.5 hard guarantee).
-        expect(JSON.stringify(bundle)).not.toContain("s3cret");
-        expect(JSON.stringify(bundle)).not.toContain("abc123");
-        expect(bundle.credentialsRequired.length).toBe(2);
-        expect(bundle.requires).toEqual(expect.arrayContaining([
-            expect.objectContaining({ category: "channel", ref: "feishu", nodeIds: ["c"] }),
-        ]));
-        stopAllSchedulers(host);
-    });
-    it("import lands a bundle (graph + trigger) into a target project; duplicate copies across roots", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-imp-active-");
-        const targetCwd = makeTempDir("wf-imp-target-");
-        const target = projectStore.createProject({
-            name: "目标",
-            workspaceDir: targetCwd,
-            type: "automation",
-            skipAutoSwitch: true,
-        });
-        const host = createHost(activeCwd);
-        const def = {
-            id: "wf-src",
-            nodes: [
-                { id: "t", kind: "trigger" },
-                { id: "s", kind: "set", params: { json: { v: 1 } } },
-            ],
-            edges: [{ from: "t", to: "s" }],
-        };
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-src", name: "源流", def }, 1));
-        // Give the source a schedule trigger so import/duplicate must carry it.
-        const bundlePayload = {
-            schemaVersion: 2,
-            name: "进口流",
-            def: { ...def, id: "ignored" },
-            trigger: { type: "schedule", cron: "0 9 * * *" },
-            concurrency: "queue",
-            requires: [],
-            credentialsRequired: [],
-        };
-        await handleWorkflowImport.call(host, request("workflow.import", { projectId: target.id, payload: bundlePayload }, 2));
-        const imported = host.responses.at(-1).result;
-        expect(imported.projectId).toBe(target.id);
-        expect(imported.trigger?.type).toBe("schedule");
-        expect(fs.existsSync(path.join(targetCwd, ".qlogicagent", "workflows", imported.id, "workflow.json"))).toBe(true);
-        // Duplicate the active-root workflow into the automation project (另存为).
-        await handleWorkflowDuplicate.call(host, request("workflow.duplicate", { id: "wf-src", targetProjectId: target.id, name: "副本流" }, 3));
-        const dup = host.responses.at(-1).result;
-        expect(dup.name).toBe("副本流");
-        expect(dup.projectId).toBe(target.id);
-        expect(dup.id).not.toBe("wf-src");
-        expect(fs.existsSync(path.join(targetCwd, ".qlogicagent", "workflows", dup.id, "workflow.json"))).toBe(true);
-        // Malformed bundle fails loud.
-        await handleWorkflowImport.call(host, request("workflow.import", { projectId: target.id, payload: { schemaVersion: 99 } }, 4));
-        expect(host.responses.at(-1).error?.message).toContain("schemaVersion");
-        stopAllSchedulers(host);
-    });
-});
-describe("workflow.capabilities + memory nodes (IT-3, D24/D25)", () => {
-    it("capabilities enumerates real tool manifest + agents + memory ops (channels stay gateway-side)", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-cap-");
-        const host = createHost(activeCwd);
-        host.toolCatalog.getToolManifest = () => [
-            { type: "function", function: { name: "web_search", description: "搜网页", parameters: {} } },
-            { type: "function", function: { name: "mcp__gh__issues", description: "", parameters: {} } },
-        ];
-        await handleWorkflowCapabilities.call(host, request("workflow.capabilities", {}, 1));
-        const { capabilities } = host.responses.at(-1).result;
-        const ids = (c) => capabilities.filter((e) => e.category === c).map((e) => e.id);
-        expect(ids("agent")).toContain("qlogicagent");
-        expect(ids("tool")).toEqual(["web_search"]);
-        expect(ids("mcp")).toEqual(["gh.issues"]);
-        expect(ids("memory")).toEqual(["memory.read", "memory.write", "memory.search"]);
-        expect(ids("channel")).toEqual([]);
-        stopAllSchedulers(host);
-    });
-    it("memory write → read round-trips through a REAL run on the project's memdir", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-mem-");
-        const host = createHost(activeCwd);
-        const def = {
-            id: "wf-mem",
-            nodes: [
-                { id: "t", kind: "trigger" },
-                { id: "w", kind: "memory", name: "写记忆", params: { op: "write", key: "probe", value: "记住这句话:多根已通" } },
-                { id: "r", kind: "memory", name: "读记忆", params: { op: "read", key: "probe" } },
-            ],
-            edges: [
-                { from: "t", to: "w" },
-                { from: "w", to: "r" },
-            ],
-        };
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-mem", name: "记忆流", def }, 1));
-        await handleWorkflowRun.call(host, request("workflow.run", { id: "wf-mem" }, 2));
-        const outcome = host.responses.at(-1).result;
-        expect(outcome.status).toBe("completed");
-        // The topic file physically exists in the project's memdir and the content survived.
-        const memFile = path.join(activeCwd, ".qlogicagent", "memory", "probe.md");
-        expect(fs.existsSync(memFile)).toBe(true);
-        expect(fs.readFileSync(memFile, "utf-8")).toContain("多根已通");
-        stopAllSchedulers(host);
-    });
-});
-describe("intent trigger (IT-2, D22)", () => {
-    it("intentIndex lists active intent workflows across roots; onIntent runs with the utterance as $trigger", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-intent-");
-        const autoCwd = makeTempDir("wf-intent-auto-");
-        const autoProject = projectStore.createProject({ name: "晨报", workspaceDir: autoCwd, type: "automation", skipAutoSwitch: true });
-        const host = createHost(activeCwd);
-        const def = {
-            id: "wf-int",
-            nodes: [
-                { id: "t", kind: "trigger" },
-                { id: "s", kind: "set", params: { json: { said: "{{ $trigger.text }}" } } },
-            ],
-            edges: [{ from: "t", to: "s" }],
-        };
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-int", name: "口令流", def, projectId: autoProject.id }, 1));
-        await handleWorkflowPatch.call(host, request("workflow.patch", {
-            id: "wf-int", projectId: autoProject.id, baseRev: 1,
-            patch: [{ op: "set_trigger", trigger: { type: "intent", phrases: ["启动晨报"], confirm: true } }],
-        }, 2));
-        // 未激活 → index 空、onIntent 拒(fail-loud)
-        await handleWorkflowIntentIndex.call(host, request("workflow.intentIndex", {}, 3));
-        expect(host.responses.at(-1).result.intents).toEqual([]);
-        await handleWorkflowOnIntent.call(host, request("workflow.onIntent", { workflowId: "wf-int", projectId: autoProject.id, text: "启动晨报" }, 4));
-        expect(host.responses.at(-1).error?.message).toContain("no active intent trigger");
-        // 激活 → index 出现(带短语与归属);onIntent 真跑,载荷可被表达式引用
-        // (D31:激活前须发布——触发面只跑已发布快照;intent 属 attended 跑草稿,但激活仍是注册门)
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "noise", name: "无关", def: { id: "noise", nodes: [{ id: "n", kind: "set", params: { json: {} } }], edges: [] } }, 5));
-        const { handleWorkflowSetActive, handleWorkflowPublish } = await import("./workflow-handler.js");
-        await handleWorkflowPublish.call(host, request("workflow.publish", { id: "wf-int", projectId: autoProject.id }, 60));
-        await handleWorkflowSetActive.call(host, request("workflow.setActive", { id: "wf-int", projectId: autoProject.id, active: true }, 6));
-        await handleWorkflowIntentIndex.call(host, request("workflow.intentIndex", {}, 7));
-        const { intents } = host.responses.at(-1).result;
-        expect(intents.length).toBe(1);
-        expect(intents[0]).toMatchObject({ workflowId: "wf-int", projectId: autoProject.id });
-        expect(intents[0].trigger.phrases).toEqual(["启动晨报"]);
-        await handleWorkflowOnIntent.call(host, request("workflow.onIntent", { workflowId: "wf-int", projectId: autoProject.id, text: "启动晨报", surface: "welcome", matchedPhrase: "启动晨报" }, 8));
-        const outcome = host.responses.at(-1).result;
-        expect(outcome.status).toBe("completed");
-        // runStarted 通知带 intent triggerType
-        expect(host.notifications.some((n) => n.method === "workflow.runStarted" && n.params.triggerType === "intent")).toBe(true);
-        stopAllSchedulers(host);
-    });
-    it("set_trigger rejects malformed intent configs (validation throws loud at the single mutation channel)", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-intent-bad-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-bad", name: "坏意图", def: SIMPLE_DEF("wf-bad") }, 1));
-        await expect(handleWorkflowPatch.call(host, request("workflow.patch", {
-            id: "wf-bad", baseRev: 1,
-            patch: [{ op: "set_trigger", trigger: { type: "intent", phrases: [] } }],
-        }, 2))).rejects.toThrow(/intent\.phrases/);
-        stopAllSchedulers(host);
-    });
-});
-describe("versioning draft/published (IT-8, D31)", () => {
-    it("publish snapshots the draft; unattended runs use the snapshot while manual runs the draft; unpublished cannot activate", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-ver-");
-        const host = createHost(activeCwd);
-        const { handleWorkflowSetActive, handleWorkflowPublish, handleWorkflowUpdate, handleWorkflowArchive } = await import("./workflow-handler.js");
-        const defV1 = {
-            id: "wf-ver",
-            nodes: [
-                { id: "t", kind: "trigger" },
-                { id: "s", kind: "set", params: { json: { version: "v1" } } },
-            ],
-            edges: [{ from: "t", to: "s" }],
-        };
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-ver", name: "版本流", def: defV1 }, 1));
-        // 未发布:激活拒、无人值守 run 拒
-        await handleWorkflowSetActive.call(host, request("workflow.setActive", { id: "wf-ver", active: true }, 2));
-        expect(host.responses.at(-1).error?.message).toContain("no published version");
-        await expect(handleWorkflowRun.call(host, request("workflow.run", { id: "wf-ver", trigger: { type: "schedule" } }, 3))).rejects.toThrow(/no published version/);
-        // 发布 v1 → 改草稿成 v2 → schedule 跑 v1,manual 跑 v2
-        await handleWorkflowPublish.call(host, request("workflow.publish", { id: "wf-ver" }, 4));
-        const pub = host.responses.at(-1).result;
-        expect(pub.status).toBe("paused");
-        expect(pub.draftAhead).toBe(false);
-        await handleWorkflowUpdate.call(host, request("workflow.update", {
-            id: "wf-ver",
-            def: { ...defV1, nodes: [defV1.nodes[0], { id: "s", kind: "set", params: { json: { version: "v2" } } }] },
-        }, 5));
-        await handleWorkflowRun.call(host, request("workflow.run", { id: "wf-ver", trigger: { type: "schedule" } }, 6));
-        const schedOut = host.responses.at(-1).result;
-        expect(schedOut.result.outputs.s.default[0].json.version).toBe("v1");
-        await handleWorkflowRun.call(host, request("workflow.run", { id: "wf-ver" }, 7));
-        const manualOut = host.responses.at(-1).result;
-        expect(manualOut.result.outputs.s.default[0].json.version).toBe("v2");
-        // 归档:run 拒 + 激活拒;恢复后可继续
-        await handleWorkflowArchive.call(host, request("workflow.archive", { id: "wf-ver", archived: true }, 8));
-        expect(host.responses.at(-1).result.status).toBe("archived");
-        await expect(handleWorkflowRun.call(host, request("workflow.run", { id: "wf-ver" }, 9))).rejects.toThrow(/archived/);
-        await handleWorkflowArchive.call(host, request("workflow.archive", { id: "wf-ver", archived: false }, 10));
-        await handleWorkflowSetActive.call(host, request("workflow.setActive", { id: "wf-ver", active: true }, 11));
-        expect(host.responses.at(-1).result.status).toBe("active");
-        stopAllSchedulers(host);
-    });
-});
-describe("observability (IT-9, D33/D36)", () => {
-    it("run history carries the per-node trace (seq/duration/attempts); metrics aggregate; dryRun stays out of history", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-obs-");
-        const host = createHost(activeCwd);
-        const { handleWorkflowRuns, handleWorkflowRunDetail, handleWorkflowMetrics, handleWorkflowDryRun } = await import("./workflow-handler.js");
-        const def = {
-            id: "wf-obs",
-            nodes: [
-                { id: "t", kind: "trigger" },
-                { id: "a", kind: "set", params: { json: { step: 1 } } },
-                { id: "b", kind: "set", params: { json: { step: 2 } } },
-            ],
-            edges: [{ from: "t", to: "a" }, { from: "a", to: "b" }],
-        };
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "wf-obs", name: "观测流", def }, 1));
-        await handleWorkflowRun.call(host, request("workflow.run", { id: "wf-obs" }, 2));
-        await handleWorkflowRuns.call(host, request("workflow.runs", { id: "wf-obs" }, 3));
-        const { runs } = host.responses.at(-1).result;
-        expect(runs).toHaveLength(1);
-        expect(typeof runs[0].durationMs).toBe("number");
-        await handleWorkflowRunDetail.call(host, request("workflow.runDetail", { id: "wf-obs", runId: runs[0].runId }, 4));
-        const { run } = host.responses.at(-1).result;
-        // Trace: ordered seq, timing, attempts on every executed node (D33).
-        expect(run.nodes.t.seq).toBe(1);
-        expect(run.nodes.a.seq).toBe(2);
-        expect(run.nodes.b.seq).toBe(3);
-        expect(run.nodes.a.attempts).toBe(1);
-        expect(typeof run.nodes.a.durationMs).toBe("number");
-        expect(run.nodes.b.nodeStatus).toBe("completed");
-        // Metrics aggregate the settled history (D33).
-        await handleWorkflowMetrics.call(host, request("workflow.metrics", { id: "wf-obs" }, 5));
-        const { metrics } = host.responses.at(-1).result;
-        expect(metrics.totalRuns).toBe(1);
-        expect(metrics.successRate).toBe(1);
-        expect(typeof metrics.avgDurationMs).toBe("number");
-        expect(metrics.consecutiveFailures).toBe(0);
-        // dryRun: full outcome incl. trace, but the history window is untouched (D36).
-        await handleWorkflowDryRun.call(host, request("workflow.dryRun", { id: "wf-obs", payload: { simulated: true } }, 6));
-        const dry = host.responses.at(-1).result;
-        expect(dry.dryRun).toBe(true);
-        expect(dry.status).toBe("completed");
-        expect(Object.keys(dry.result?.nodeStats ?? {}).length).toBeGreaterThan(0);
-        await handleWorkflowRuns.call(host, request("workflow.runs", { id: "wf-obs" }, 7));
-        expect(host.responses.at(-1).result.runs).toHaveLength(1);
-        stopAllSchedulers(host);
-    });
-});
-describe("createProject(type: automation) (D21)", () => {
-    it("seeds the primary workflow, records primaryWorkflowId, and never steals the active project", async () => {
-        const home = isolateHome();
-        // A pre-existing personal project holds the active slot.
-        const personal = projectStore.createProject({ name: "日常", workspaceDir: path.join(home, "daily") });
-        expect(projectStore.getActiveProject()?.id).toBe(personal.id);
-        const commandHost = {
-            memdir: null,
-            projectMemoryStoreFactory: { create: () => ({ ensureInitialized: () => { } }) },
-            mediaPersistence: { setProjectDir: () => { } },
-            setActiveWorkdir: vi.fn(),
-        };
-        const result = await createProjectCommand(commandHost, { name: "晨报自动化", type: "automation" });
-        expect(result.autoSwitched).toBe(false);
-        expect(result.isAgentTeamProject).toBe(false);
-        expect(result.project.type).toBe("automation");
-        expect(result.project.primaryWorkflowId).toBeTruthy();
-        // The active project is untouched; the registry persisted primaryWorkflowId.
-        expect(projectStore.getActiveProject()?.id).toBe(personal.id);
-        const persisted = projectStore.getProjectById(result.project.id);
-        expect(persisted?.primaryWorkflowId).toBe(result.project.primaryWorkflowId);
-        // The primary workflow exists on disk, named after the project (项目名=工作流名).
-        const wfPath = path.join(result.project.workspaceDir, ".qlogicagent", "workflows", result.project.primaryWorkflowId, "workflow.json");
-        expect(fs.existsSync(wfPath)).toBe(true);
-        const record = JSON.parse(fs.readFileSync(wfPath, "utf-8"));
-        expect(record.name).toBe("晨报自动化");
-        expect(record.def.nodes).toEqual([]);
-    });
-});
-describe("advanced nodes via handler host (IT-10, D34)", () => {
-    it("subworkflow runs another workflow as a step and guards cycles", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-sub-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "child", name: "child",
-            def: { id: "child", nodes: [{ id: "t", kind: "trigger" }, { id: "s", kind: "set", params: { json: { from: "child" } } }], edges: [{ from: "t", to: "s" }] },
-        }, 1));
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "parent", name: "parent",
-            def: { id: "parent", nodes: [{ id: "t", kind: "trigger" }, { id: "sub", kind: "subworkflow", params: { workflowId: "child" } }], edges: [{ from: "t", to: "sub" }] },
-        }, 2));
-        await handleWorkflowRun.call(host, request("workflow.run", { id: "parent" }, 3));
-        const outcome = host.responses.at(-1).result;
-        expect(outcome.status).toBe("completed");
-        const subOut = outcome.result?.outputs?.sub?.default?.[0]?.json;
-        expect(subOut?.status).toBe("completed");
-        expect(JSON.stringify(subOut?.outputs)).toContain("child");
-        // Cycle: A↔B must fail loud, not recurse.
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "a", name: "a",
-            def: { id: "a", nodes: [{ id: "t", kind: "trigger" }, { id: "sub", kind: "subworkflow", params: { workflowId: "b" } }], edges: [{ from: "t", to: "sub" }] },
-        }, 4));
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "b", name: "b",
-            def: { id: "b", nodes: [{ id: "t", kind: "trigger" }, { id: "sub", kind: "subworkflow", params: { workflowId: "a" } }], edges: [{ from: "t", to: "sub" }] },
-        }, 5));
-        await expect(handleWorkflowRun.call(host, request("workflow.run", { id: "a" }, 6))).rejects.toThrow(/cycle/i);
-        stopAllSchedulers(host);
-    });
-    it("approval pauses the run, lists pending, approve releases it", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-approve-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "appr", name: "appr",
-            def: { id: "appr", nodes: [{ id: "t", kind: "trigger" }, { id: "gate", kind: "approval", params: { prompt: "继续?" } }], edges: [{ from: "t", to: "gate" }] },
-        }, 1));
-        const running = handleWorkflowRun.call(host, request("workflow.run", { id: "appr" }, 2));
-        await vi.waitFor(() => {
-            expect(host.notifications.some((n) => n.method === "workflow.approvalRequested")).toBe(true);
-        });
-        const reqNote = host.notifications.find((n) => n.method === "workflow.approvalRequested").params;
-        expect(reqNote.workflowId).toBe("appr");
-        expect(reqNote.prompt).toBe("继续?");
-        // Pull-path recovery: pending approvals are listable.
-        await handleWorkflowApprovals.call(host, request("workflow.approvals", {}, 3));
-        const listed = host.responses.at(-1).result;
-        expect(listed.approvals.map((a) => a.approvalId)).toContain(reqNote.approvalId);
-        await handleWorkflowApprove.call(host, request("workflow.approve", { approvalId: reqNote.approvalId, approved: true }, 4));
-        await running;
-        const outcome = host.responses.find((r) => r.id === 2).result;
-        expect(outcome.status).toBe("completed");
-        // The pending entry is consumed; deciding twice fails loud.
-        await handleWorkflowApprove.call(host, request("workflow.approve", { approvalId: reqNote.approvalId, approved: true }, 5));
-        expect(host.responses.at(-1).error?.message).toContain("not found");
-        stopAllSchedulers(host);
-    });
-    it("denied approval fails the run (default onError=stop)", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-deny-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "deny", name: "deny",
-            def: { id: "deny", nodes: [{ id: "t", kind: "trigger" }, { id: "gate", kind: "approval" }], edges: [{ from: "t", to: "gate" }] },
-        }, 1));
-        const running = handleWorkflowRun.call(host, request("workflow.run", { id: "deny" }, 2));
-        await vi.waitFor(() => {
-            expect(host.notifications.some((n) => n.method === "workflow.approvalRequested")).toBe(true);
-        });
-        const { approvalId } = host.notifications.find((n) => n.method === "workflow.approvalRequested").params;
-        await handleWorkflowApprove.call(host, request("workflow.approve", { approvalId, approved: false, note: "不行" }, 3));
-        await expect(running).rejects.toThrow(/denied|不行/);
-        stopAllSchedulers(host);
-    });
-    it("workflow.onForm validates required fields then runs with $trigger values", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-form-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "form", name: "form",
-            def: { id: "form", nodes: [{ id: "t", kind: "trigger" }, { id: "s", kind: "set", params: { json: { city: "{{ $trigger.city }}" } } }], edges: [{ from: "t", to: "s" }] },
-        }, 1));
-        await handleWorkflowPatch.call(host, request("workflow.patch", {
-            id: "form",
-            patch: [{ op: "set_trigger", trigger: { type: "form", fields: [{ key: "city", label: "城市", required: true }] } }],
-        }, 2));
-        // Missing required field → caller-fixable INVALID_PARAMS, no run started.
-        await handleWorkflowOnForm.call(host, request("workflow.onForm", { workflowId: "form", values: {} }, 3));
-        expect(host.responses.at(-1).error?.message).toContain("城市");
-        await handleWorkflowOnForm.call(host, request("workflow.onForm", { workflowId: "form", values: { city: "上海" } }, 4));
-        const outcome = host.responses.at(-1).result;
-        expect(outcome.status).toBe("completed");
-        expect(outcome.result?.outputs?.s?.default?.[0]?.json).toEqual({ city: "上海" });
-        stopAllSchedulers(host);
-    });
-});
-describe("workflow.publishHub + community workflow install (IT-5, D35)", () => {
-    it("derives the manifest from the record, gzips the sanitized bundle, honors consent", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-hub-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "pub", name: "晨报推送",
-            def: {
-                id: "pub",
-                nodes: [
-                    { id: "t", kind: "trigger" },
-                    { id: "h", kind: "http", params: { url: "https://api.example.com", headers: { Authorization: "Bearer sek-123" } } },
-                    { id: "a", kind: "agent", params: { prompt: "总结" } },
-                ],
-                edges: [{ from: "t", to: "h" }, { from: "h", to: "a" }],
-            },
-        }, 1));
-        await handleWorkflowPatch.call(host, request("workflow.patch", {
-            id: "pub", patch: [{ op: "set_trigger", trigger: { type: "schedule", cron: "0 9 * * *" } }],
-        }, 2));
-        // No consent → refused with the standard message, nothing published.
-        host.resolveCommunityConsentStore = () => ({ read: async () => ({ enabled: false, methodSharingEnabled: false, signalsEnabled: false, encounterEnabled: false, remoteSynced: false }), write: async () => { } });
-        await handleWorkflowPublishHub.call(host, request("workflow.publishHub", { id: "pub", slug: "morning-news", summary: "每天早报" }, 3));
-        expect(host.responses.at(-1).error?.message).toContain("consent");
-        // Consent on + mock client → captures the publish input for manifest assertions.
-        const published = [];
-        host.resolveCommunityConsentStore = () => ({ read: async () => ({ enabled: true, methodSharingEnabled: true, signalsEnabled: true, encounterEnabled: true, remoteSynced: true }), write: async () => { } });
-        host.resolveCommunityConsentClient = (() => ({
-            publishWorkflow: async (input) => {
-                published.push(input);
-                return { resource: { id: input.id, type: "workflow", title: input.title, summary: input.summary, visibility: "public", latestVersion: "1.0.0", withdrawn: false, withdrawnAt: null }, version: { version: "1.0.0", checksum: "x", sizeBytes: 1 } };
-            },
-        }));
-        await handleWorkflowPublishHub.call(host, request("workflow.publishHub", {
-            id: "pub", slug: "morning-news", summary: "每天早报", category: "automation", tags: ["news"],
-        }, 4));
-        const ok = host.responses.at(-1).result;
-        expect(ok.ok).toBe(true);
-        const input = published[0];
-        expect(input.id).toBe("morning-news");
-        expect(input.category).toBe("automation");
-        const manifest = input.manifest;
-        expect(manifest.name).toBe("晨报推送");
-        expect(manifest.entry).toBe("bundle.json");
-        expect(manifest.nodeCount).toBe(3);
-        expect(manifest.declaredPermissions).toEqual(["agent", "http"]);
-        expect(manifest.triggerSummary).toContain("0 9 * * *");
-        expect(manifest.credentialsRequired?.length).toBe(1);
-        // The gzip payload IS the sanitized bundle: secret stripped, requirement derived.
-        const { gunzipSync } = await import("node:zlib");
-        const bundle = JSON.parse(gunzipSync(Buffer.from(input.packageGzipBase64, "base64")).toString("utf8"));
-        expect(JSON.stringify(bundle)).not.toContain("sek-123");
-        expect(bundle.credentialsRequired.length).toBe(1);
-        stopAllSchedulers(host);
-    });
-    it("installCommunityWorkflowResource downloads, verifies and parses the bundle (never writes disk)", async () => {
-        const { createServer } = await import("node:http");
-        const { gzipSync } = await import("node:zlib");
-        const { createHash } = await import("node:crypto");
-        const { installCommunityWorkflowResource } = await import("../community-workflow-installer.js");
-        const bundle = { schemaVersion: 2, name: "模板", def: { id: "x", nodes: [{ id: "t", kind: "trigger" }], edges: [] }, requires: [], credentialsRequired: [] };
-        const pkg = gzipSync(Buffer.from(JSON.stringify(bundle), "utf8"));
-        const server = createServer((_req, res) => { res.writeHead(200); res.end(pkg); });
-        await new Promise((r) => server.listen(0, "127.0.0.1", r));
-        const port = server.address().port;
-        try {
-            const result = await installCommunityWorkflowResource({
-                id: "tpl", type: "workflow", kind: "executable",
-                sourceTier: "community", trustStage: "fresh", reviewStatus: "approved",
-                resourceRiskTier: "R1", effectiveRiskTier: "R1",
-                requires: [], dependencies: [], version: "1.0.0",
-                checksum: createHash("sha256").update(pkg).digest("hex"),
-                sizeBytes: pkg.length,
-                downloadUrl: `http://127.0.0.1:${port}/pkg`,
-                manifest: { name: "模板" },
-            });
-            expect(result.kind).toBe("workflow");
-            expect(result.bundle.name).toBe("模板");
-            // checksum mismatch fails loud
-            await expect(installCommunityWorkflowResource({
-                id: "tpl", type: "workflow", kind: "executable",
-                sourceTier: "community", trustStage: "fresh", reviewStatus: "approved",
-                resourceRiskTier: "R1", effectiveRiskTier: "R1",
-                requires: [], dependencies: [], version: "1.0.0",
-                checksum: "0".repeat(64), sizeBytes: pkg.length,
-                downloadUrl: `http://127.0.0.1:${port}/pkg`,
-                manifest: {},
-            })).rejects.toThrow(/checksum/);
-        }
-        finally {
-            server.close();
-        }
-    });
-});
-describe("owner + audit trail (IT-12, D38)", () => {
-    it("stamps the active owner on create and records every lifecycle action", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-audit-");
-        const host = createHost(activeCwd);
-        const { handleWorkflowSetActive, handleWorkflowPublish } = await import("./workflow-handler.js");
-        await handleWorkflowCreate.call(host, request("workflow.create", { id: "au", name: "审计流", def: SIMPLE_DEF("au") }, 1));
-        const created = host.responses.at(-1).result;
-        expect(created.owner).toBe("user/tester"); // QLOGIC_LLMROUTER_USER_ID via resolveActiveOwnerUserId
-        await handleWorkflowPatch.call(host, request("workflow.patch", {
-            id: "au", patch: [{ op: "set_trigger", trigger: { type: "manual" } }],
-        }, 2));
-        await handleWorkflowPublish.call(host, request("workflow.publish", { id: "au" }, 3));
-        await handleWorkflowSetActive.call(host, request("workflow.setActive", { id: "au", active: true }, 4));
-        await handleWorkflowSetActive.call(host, request("workflow.setActive", { id: "au", active: false }, 5));
-        await handleWorkflowAudit.call(host, request("workflow.audit", { id: "au" }, 6));
-        const { entries } = host.responses.at(-1).result;
-        const actions = entries.map((e) => e.action);
-        // newest-first
-        expect(actions).toEqual(["deactivated", "activated", "published", "patched", "created"]);
-        expect(entries.every((e) => e.actor === "user/tester" && e.workflowId === "au")).toBe(true);
-        // Unfiltered project-level listing also carries them.
-        await handleWorkflowAudit.call(host, request("workflow.audit", {}, 7));
-        const all = host.responses.at(-1).result;
-        expect(all.entries.length).toBeGreaterThanOrEqual(5);
-        stopAllSchedulers(host);
-    });
-});
-describe("R2: fine-grained unattended audit + webhook wait + durable suspensions", () => {
-    it("IT-7b: unattended runs refuse destructive tool calls; attended runs execute them", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-audit7b-");
-        const host = createHost(activeCwd);
-        const { handleWorkflowPublish, handleWorkflowSetActive } = await import("./workflow-handler.js");
-        let executed = 0;
-        host.toolCatalog.findTool = ((name) => name === "execute_command" ? {
-            function: { name: "execute_command" },
-            execute: async () => { executed++; return { content: [{ type: "text", text: "ok" }] }; },
-        } : undefined);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "danger", name: "危险工具",
-            def: {
-                id: "danger",
-                nodes: [
-                    { id: "t", kind: "trigger" },
-                    { id: "x", kind: "tool", params: { tool: "execute_command", args: { command: "rm -rf /tmp/probe-target" } } },
-                ],
-                edges: [{ from: "t", to: "x" }],
-            },
-        }, 1));
-        await handleWorkflowPatch.call(host, request("workflow.patch", {
-            id: "danger", patch: [{ op: "set_trigger", trigger: { type: "webhook", path: "/danger" } }],
-        }, 2));
-        await handleWorkflowPublish.call(host, request("workflow.publish", { id: "danger" }, 3));
-        await handleWorkflowSetActive.call(host, request("workflow.setActive", { id: "danger", active: true }, 4));
-        // grant the KIND (tool) — the fine-grained audit must still refuse the destructive specific.
-        await handleWorkflowSetPermissionScope.call(host, request("workflow.setPermissionScope", { id: "danger", allowUnattendedKinds: ["tool"] }, 5));
-        // Unattended (webhook) → refused by the operation classifier (surfaces as a loud error
-        // or a non-completed outcome depending on the scheduler's propagation); the tool NEVER runs.
-        const hookErr = await handleWorkflowOnWebhook.call(host, request("workflow.onWebhook", { path: "/danger" }, 6))
-            .then(() => null, (e) => e);
-        if (hookErr) {
-            expect(String(hookErr)).toContain("破坏性");
-        }
-        else {
-            const hookRes = host.responses.at(-1).result;
-            expect(hookRes.outcomes[0]?.status).not.toBe("completed");
-        }
-        expect(executed).toBe(0);
-        // Attended (manual) → same graph runs the tool.
-        await handleWorkflowRun.call(host, request("workflow.run", { id: "danger" }, 7));
-        const manual = host.responses.at(-1).result;
-        expect(manual.status).toBe("completed");
-        expect(executed).toBe(1);
-        stopAllSchedulers(host);
-    });
-    it("D34: wait(until=webhook) suspends until the path fires, payload flows downstream", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-hookwait-");
-        const host = createHost(activeCwd);
-        await handleWorkflowCreate.call(host, request("workflow.create", {
-            id: "hw", name: "等回调",
-            def: {
-                id: "hw",
-                nodes: [
-                    { id: "t", kind: "trigger" },
-                    { id: "w", kind: "wait", params: { until: "webhook", path: "/callback-probe" } },
-                ],
-                edges: [{ from: "t", to: "w" }],
-            },
-        }, 1));
-        const running = handleWorkflowRun.call(host, request("workflow.run", { id: "hw" }, 2));
-        // 等待者登记后再打 webhook(轮询挂起持久文件作为登记完成信号)。
-        const { readFileSync } = await import("node:fs");
-        const suspFile = (await import("node:path")).default.join(activeCwd, ".qlogicagent", "workflows", "pending-suspensions.json");
-        await vi.waitFor(() => {
-            const list = JSON.parse(readFileSync(suspFile, "utf8"));
-            expect(list.some((r) => r.kind === "webhook-wait")).toBe(true);
-        });
-        await handleWorkflowOnWebhook.call(host, request("workflow.onWebhook", { path: "/callback-probe", payload: { orderId: 42 } }, 3));
-        const hookRes = host.responses.at(-1).result;
-        expect(hookRes.wokenWaits).toBe(1);
-        await running;
-        const outcome = host.responses.find((r) => r.id === 2).result;
-        expect(outcome.status).toBe("completed");
-        expect(outcome.result?.outputs?.w?.default?.at(-1)?.json.webhook?.orderId).toBe(42);
-        // settled → the durable registry is empty again
-        const after = JSON.parse(readFileSync(suspFile, "utf8"));
-        expect(after.length).toBe(0);
-        stopAllSchedulers(host);
-    });
-    it("R2-E: leftover suspensions from a dead process alert the owner and audit, then clear", async () => {
-        isolateHome();
-        const activeCwd = makeTempDir("wf-lost-");
-        // 模拟上个进程的遗留:先在磁盘上放一条挂起记录,再首次构根。
-        const { mkdirSync, writeFileSync, readFileSync } = await import("node:fs");
-        const path2 = (await import("node:path")).default;
-        const wfDir = path2.join(activeCwd, ".qlogicagent", "workflows");
-        mkdirSync(wfDir, { recursive: true });
-        writeFileSync(path2.join(wfDir, "pending-suspensions.json"), JSON.stringify([{
-                kind: "approval", approvalId: "ghost-1", workflowId: "wf-dead", nodeId: "gate",
-                prompt: "继续?", requestedAt: new Date().toISOString(),
-            }]), "utf8");
-        const host = createHost(activeCwd);
-        await handleWorkflowList.call(host, request("workflow.list", {}, 1)); // 触发 ensureWorkflowRoot
-        const alert = host.notifications.find((n) => n.method === "workflow.alert" && n.params.kind === "suspension-lost-on-restart");
-        expect(alert?.params.workflowId).toBe("wf-dead");
-        const after = JSON.parse(readFileSync(path2.join(wfDir, "pending-suspensions.json"), "utf8"));
-        expect(after.length).toBe(0);
-        // 审计留痕
-        await handleWorkflowAudit.call(host, request("workflow.audit", {}, 2));
-        const { entries } = host.responses.at(-1).result;
-        expect(entries.some((e) => e.action === "suspensionLostOnRestart")).toBe(true);
-        stopAllSchedulers(host);
-    });
-});