hyreal-gen-pic/scripts/smoke.js

#!/usr/bin/env node
'use strict';

// 零依赖冒烟测试：拉起真实服务（随机端口），全量核对端点行为后关停。
// 安全边界：只做只读请求 + 无副作用 POST（校验失败类、空操作）；
// 绝不触碰 DELETE /api/reports/data、/api/crawl/start、/api/open-folder、
// /api/image/test、/api/chat/test，也不在数据湖有主体时调用 /api/reports/ask。
// 用法：node scripts/smoke.js

const { spawn, spawnSync } = require('child_process');
const net = require('net');
const http = require('http');
const os = require('os');
const path = require('path');

const ROOT = path.resolve(__dirname, '..');

function pickPort() {
  return new Promise((resolve, reject) => {
    const srv = net.createServer();
    srv.unref();
    srv.on('error', reject);
    srv.listen(0, '127.0.0.1', () => {
      const port = srv.address().port;
      srv.close(() => resolve(port));
    });
  });
}

function request(port, method, urlPath, body, host = '127.0.0.1', extraHeaders = {}) {
  return new Promise((resolve, reject) => {
    const req = http.request({
      host, port, method, path: urlPath, timeout: 15000,
      headers: {
        ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
        ...extraHeaders,
      },
    }, (res) => {
      const chunks = [];
      res.on('data', (c) => chunks.push(c));
      res.on('end', () => resolve({
        status: res.statusCode,
        headers: res.headers,
        text: Buffer.concat(chunks).toString('utf8'),
        json: () => JSON.parse(Buffer.concat(chunks).toString('utf8')),
      }));
    });
    req.on('error', reject);
    req.on('timeout', () => req.destroy(new Error('timeout')));
    if (body !== undefined) req.write(JSON.stringify(body));
    req.end();
  });
}

/** 取本机第一个非内部 IPv4 局域网地址（用于访问口令测试；回环地址在服务端直接放行） */
function getLanIpv4() {
  for (const list of Object.values(os.networkInterfaces())) {
    for (const ni of list || []) {
      if (ni.family === 'IPv4' && !ni.internal) return ni.address;
    }
  }
  return '';
}

const results = [];
async function check(name, fn) {
  try {
    await fn();
    results.push({ name, ok: true });
  } catch (e) {
    results.push({ name, ok: false, error: e.message });
  }
}

function expect(cond, msg) {
  if (!cond) throw new Error(msg);
}

async function waitForHealth(port, timeoutMs = 20000) {
  const start = Date.now();
  for (;;) {
    try {
      const res = await request(port, 'GET', '/healthz');
      if (res.status === 200) return;
    } catch { /* not up yet */ }
    if (Date.now() - start > timeoutMs) throw new Error('服务未在超时内启动');
    await new Promise((r) => setTimeout(r, 300));
  }
}

function waitForHealthLan(lanIp, port, timeoutMs = 20000) {
  return new Promise((resolve, reject) => {
    const start = Date.now();
    const probe = () => {
      const req = http.request({ host: lanIp, port, path: '/healthz', timeout: 3000 }, (res) => {
        res.resume();
        if (res.statusCode === 200) return resolve();
        retry();
      });
      req.on('error', retry);
      req.on('timeout', () => { req.destroy(); retry(); });
      req.end();
    };
    const retry = () => {
      if (Date.now() - start > timeoutMs) return reject(new Error('服务未在超时内启动（LAN）'));
      setTimeout(probe, 300);
    };
    probe();
  });
}

function enc(s) { return encodeURIComponent(s); }

async function main() {
  const port = await pickPort();
  const child = spawn(process.execPath, [path.join(ROOT, 'server.js')], {
    env: { ...process.env, PORT: String(port), HOST: '127.0.0.1' },
    stdio: ['ignore', 'pipe', 'pipe'],
  });
  let bootLog = '';
  child.stdout.on('data', (c) => { bootLog += c; });
  child.stderr.on('data', (c) => { bootLog += c; });

  try {
    await waitForHealth(port);
    let workspaceRoot = '';
    {
      const res = await request(port, 'GET', '/api/default-root');
      workspaceRoot = res.json().root;
    }
    const encRoot = enc(workspaceRoot);
    const b64Root = Buffer.from(workspaceRoot, 'utf8').toString('base64url');

    // ---- 基础与健康 ----
    await check('GET /healthz', async () => {
      const r = await request(port, 'GET', '/healthz');
      expect(r.status === 200 && r.json().ok === true, `status=${r.status}`);
    });
    await check('GET /readyz', async () => {
      const r = await request(port, 'GET', '/readyz');
      const j = r.json();
      expect(r.status === 200 && typeof j.ok === 'boolean' && typeof j.workspaceReady === 'boolean', `status=${r.status}`);
    });
    await check('GET /api/default-root', async () => {
      const r = await request(port, 'GET', '/api/default-root');
      expect(r.status === 200 && !!r.json().root, `status=${r.status}`);
    });

    // ---- 设置域 ----
    await check('GET /api/models', async () => {
      const r = await request(port, 'GET', '/api/models');
      const j = r.json();
      expect(r.status === 200 && Array.isArray(j.models) && j.models.length >= 5 && !!j.default, `status=${r.status}`);
    });
    await check('GET /api/settings（脱敏）', async () => {
      const r = await request(port, 'GET', '/api/settings');
      const j = r.json();
      expect(r.status === 200 && typeof j.rootDir === 'string' && typeof j.port === 'number', `status=${r.status}`);
      expect(!j.apiKey || j.apiKey.includes('••••'), 'apiKey 未脱敏');
    });
    await check('POST /api/settings 非法 pageSize → 400', async () => {
      const r = await request(port, 'POST', '/api/settings', { pageSize: 9999 });
      expect(r.status === 400, `status=${r.status}`);
    });
    await check('POST /api/settings 非法 delayMs → 400', async () => {
      const r = await request(port, 'POST', '/api/settings', { delayMs: -5 });
      expect(r.status === 400, `status=${r.status}`);
    });
    await check('POST /api/settings 非法 autoSyncTime → 400', async () => {
      const r = await request(port, 'POST', '/api/settings', { autoSyncTime: '99:99' });
      expect(r.status === 400, `status=${r.status}`);
    });
    await check('GET /api/settings 含 autoSync 字段', async () => {
      const r = await request(port, 'GET', '/api/settings');
      const j = r.json();
      expect(typeof j.autoSyncEnabled === 'boolean' && /^\d{1,2}:\d{2}$/.test(j.autoSyncTime || ''), 'autoSync 字段缺失');
    });

    // ---- 采集域 ----
    await check('GET /api/session', async () => {
      const r = await request(port, 'GET', '/api/session');
      expect(r.status === 200 && typeof r.json().cookieConfigured === 'boolean', `status=${r.status}`);
    });
    await check('GET /api/shops（base64url root）', async () => {
      const r = await request(port, 'GET', `/api/shops?root=${b64Root}`);
      expect(r.status === 200 && Array.isArray(r.json().shops), `status=${r.status}`);
    });
    await check('GET /api/shops 非法 root → 403', async () => {
      const bad = Buffer.from('/tmp/elsewhere', 'utf8').toString('base64url');
      const r = await request(port, 'GET', `/api/shops?root=${bad}`);
      expect(r.status === 403, `status=${r.status}`);
    });
    await check('GET /api/scan', async () => {
      const r = await request(port, 'GET', `/api/scan?root=${encRoot}`);
      const j = r.json();
      expect(r.status === 200 && Array.isArray(j.shops), `status=${r.status}`);
    });
    await check('GET /api/crawl/status', async () => {
      const r = await request(port, 'GET', '/api/crawl/status');
      expect(r.status === 200 && typeof r.json().status === 'string', `status=${r.status}`);
    });
    await check('POST /api/crawl/stop（空操作）', async () => {
      const r = await request(port, 'POST', '/api/crawl/stop');
      expect(r.status === 200 && r.json().ok === true, `status=${r.status}`);
    });
    await check('Origin 防护：跨站写请求 → 403', async () => {
      const r = await request(port, 'POST', '/api/crawl/stop', undefined, '127.0.0.1', { Origin: 'http://evil.example' });
      expect(r.status === 403, `status=${r.status}`);
    });
    await check('Origin 防护：同源写请求放行', async () => {
      const r = await request(port, 'POST', '/api/crawl/stop', undefined, '127.0.0.1', { Origin: `http://127.0.0.1:${port}` });
      expect(r.status === 200, `status=${r.status}`);
    });

    // ---- 生成/任务/历史域 ----
    await check('GET /api/tasks', async () => {
      const r = await request(port, 'GET', '/api/tasks');
      const j = r.json();
      expect(r.status === 200 && j.summary && Array.isArray(j.tasks), `status=${r.status}`);
    });
    await check('GET /api/job/未知ID → 404', async () => {
      const r = await request(port, 'GET', '/api/job/00000000-0000-0000-0000-000000000000');
      expect(r.status === 404, `status=${r.status}`);
    });
    await check('GET /api/creations', async () => {
      const r = await request(port, 'GET', `/api/creations?root=${encRoot}&limit=5`);
      const j = r.json();
      expect(r.status === 200 && typeof j.total === 'number' && Array.isArray(j.items), `status=${r.status}`);
    });
    await check('GET /files 越界 → 403', async () => {
      const r = await request(port, 'GET', `/files?path=${enc('/etc/passwd')}`);
      expect(r.status === 403, `status=${r.status}`);
    });
    await check('GET /files 缺参 → 400', async () => {
      const r = await request(port, 'GET', '/files');
      expect(r.status === 400, `status=${r.status}`);
    });

    // ---- 日志 ----
    await check('GET /api/logs', async () => {
      const r = await request(port, 'GET', '/api/logs');
      expect(r.status === 200 && Array.isArray(r.json().logs), `status=${r.status}`);
    });
    await check('POST /api/logs/clear', async () => {
      const r = await request(port, 'POST', '/api/logs/clear');
      expect(r.status === 200 && r.json().ok === true, `status=${r.status}`);
    });

    // ---- 数据报表域 ----
    await check('GET /api/reports/status（不限方法 GET）', async () => {
      const r = await request(port, 'GET', '/api/reports/status');
      expect(r.status === 200 && r.json().napos, `status=${r.status}`);
    });
    await check('POST /api/reports/status（不限方法 POST）', async () => {
      const r = await request(port, 'POST', '/api/reports/status');
      expect(r.status === 200, `status=${r.status}`);
    });
    await check('GET /api/reports/columns', async () => {
      const r = await request(port, 'GET', '/api/reports/columns');
      expect(r.status === 200 && Array.isArray(r.json().columns) && r.json().columns.length >= 10, `status=${r.status}`);
    });
    await check('GET /api/reports/entities', async () => {
      const r = await request(port, 'GET', '/api/reports/entities');
      expect(r.status === 200 && Array.isArray(r.json().entities), `status=${r.status}`);
    });
    await check('GET /api/reports/sync/status', async () => {
      const r = await request(port, 'GET', '/api/reports/sync/status');
      expect(r.status === 200 && typeof r.json().running === 'boolean', `status=${r.status}`);
    });
    await check('GET /api/reports/syncs', async () => {
      const r = await request(port, 'GET', '/api/reports/syncs');
      expect(r.status === 200 && Array.isArray(r.json().runs), `status=${r.status}`);
    });
    await check('GET /api/reports/daily', async () => {
      const r = await request(port, 'GET', '/api/reports/daily');
      expect(r.status === 200, `status=${r.status}`);
    });
    await check('GET /api/reports/aggregate', async () => {
      const r = await request(port, 'GET', '/api/reports/aggregate');
      expect(r.status === 200, `status=${r.status}`);
    });
    await check('GET /api/reports/export → CSV', async () => {
      const r = await request(port, 'GET', '/api/reports/export');
      expect(r.status === 200 && /text\/csv/.test(r.headers['content-type'] || ''), `status=${r.status}`);
    });
    await check('GET /api/reports/report-html → HTML', async () => {
      const r = await request(port, 'GET', '/api/reports/report-html');
      expect(r.status === 200 && /text\/html/.test(r.headers['content-type'] || ''), `status=${r.status}`);
    });
    await check('POST /api/reports/ask（有主体时跳过）', async () => {
      const ent = await request(port, 'GET', '/api/reports/entities');
      if (ent.json().entities.length > 0) return; // 有主体会真调对话模型，跳过
      const r = await request(port, 'POST', '/api/reports/ask', { q: 'test' });
      expect(r.status === 400 && r.json().code === 'ASK_NO_ENTITY', `status=${r.status}`);
    });
    await check('GET /api/reports/lake → 湖全景', async () => {
      const r = await request(port, 'GET', '/api/reports/lake');
      const d = r.json();
      expect(r.status === 200 && Array.isArray(d.entities) && typeof d.totalRows === 'number' && d.aitable && 'enabled' in d.aitable, `status=${r.status}`);
    });
    await check('GET /api/reports/daily → 分页字段', async () => {
      const r = await request(port, 'GET', '/api/reports/daily');
      const d = r.json();
      expect(r.status === 200 && typeof d.total === 'number' && d.page >= 1 && d.pageSize >= 50 && d.pages >= 1 && 'summary' in d, `status=${r.status}`);
    });
    await check('GET /api/reports/syncs → 同步历史', async () => {
      const r = await request(port, 'GET', '/api/reports/syncs');
      expect(r.status === 200 && Array.isArray(r.json().runs), `status=${r.status}`);
    });
    await check('POST /api/reports/aitable/push（无主体 → 400）', async () => {
      const r = await request(port, 'POST', '/api/reports/aitable/push', {});
      expect(r.status === 400 && r.json().code === 'AITABLE_NO_ENTITY', `status=${r.status} code=${r.json().code}`);
    });

    // ---- 钉钉三表拆分与行键（纯函数回归，不打真实钉钉 API） ----
    const aitableLib = require('../server/services/aitable.js');
    const { rowKey } = require('../reports-store.js');
    await check('splitRowsBySheet → 按维度分流且 summary 不上云', async () => {
      const s = aitableLib.splitRowsBySheet([
        { scope: 'shop', shopId: '1', chainId: 'c1' },
        { scope: 'shop', shopId: '2', chainId: 'c1' },
        { scope: 'chain', shopId: '', chainId: 'c1' },
        { scope: 'chain', shopId: '', chainId: 'c2' },
        { scope: 'company', shopId: '', chainId: '-1' },
        { scope: 'summary', shopId: '', chainId: '' },
      ]);
      expect(s.detail.length === 2 && s.chain.length === 2 && s.company.length === 1 && s.skippedSummary === 1,
        `detail=${s.detail.length} chain=${s.chain.length} company=${s.company.length} skipped=${s.skippedSummary}`);
    });
    await check('recordKey / rowKey → 同日多连锁不碰撞', async () => {
      const cloud = (chainId) => aitableLib.recordKey({ 日期: '20261017', 账号名: 'A', 维度: '连锁', 连锁ID: chainId, 门店ID: '' });
      expect(cloud('c1') !== cloud('c2'), '连锁行云端业务键仍碰撞');
      const local = (row) => rowKey(row);
      expect(local({ date: '20261017', scope: 'chain', chainId: 'c1', shopId: '' }) !== local({ date: '20261017', scope: 'chain', chainId: 'c2', shopId: '' }), '连锁行本地行键仍碰撞');
      expect(local({ date: '20261017', scope: 'summary', chainId: '', shopId: '' }) !== local({ date: '20261017', scope: 'summary', chainId: 'c1', shopId: '' }), '汇总行本地行键仍碰撞');
    });
    await check('resolveSheets → 缺省兜底三表名', async () => {
      const { sheets, fingerprint } = aitableLib.resolveSheets({});
      expect(sheets.detail === '门店明细' && sheets.chain === '连锁汇总' && sheets.company === '公司汇总' && fingerprint.split('|').length === 3,
        JSON.stringify(sheets));
    });

    // ---- 问数两段式：结果摘要与兜底话术（纯函数，不调对话模型） ----
    const nlQueryLib = require('../nl-query.js');
    await check('buildResultDigest → 口径/Top行/合计齐全且按列类型格式化', async () => {
      const digest = nlQueryLib.buildResultDigest(
        { mode: 'shop', from: '20260918', to: '20261017', metrics: ['grossAmt', 'clkExpRate'], shopIds: [] },
        {
          rows: [
            { shopName: '一食堂', grossAmt: 12345.6, clkExpRate: 0.0521 },
            { shopName: '二食堂', grossAmt: 0, clkExpRate: 0 },
          ],
          summary: { grossAmt: 12345.6, clkExpRate: 0.0521 },
        }
      );
      expect(digest.includes('按门店汇总') && digest.includes('2026-09-18') && digest.includes('2026-10-17'), digest);
      expect(digest.includes('12,345.60元') && digest.includes('5.21%'), digest); // money 两位小数 / pct 小数×100
      expect(digest.includes('区间合计') && digest.includes('均值'), digest);     // 金额=合计、比率=均值
    });
    await check('buildResultDigest → 空结果有明确说明', async () => {
      const digest = nlQueryLib.buildResultDigest(
        { mode: 'date', from: '20260918', to: '20261017', metrics: ['grossAmt'], shopIds: [] },
        { rows: [], summary: {} }
      );
      expect(digest.includes('结果为空'), digest);
    });
    await check('fallbackReply → 模板句含区间与指标名', async () => {
      const t = nlQueryLib.fallbackReply({ mode: 'date', from: '20260918', to: '20261017', metrics: ['grossAmt'] });
      expect(t.includes('2026-09-18') && t.includes('营业额'), t);
    });

    // ---- 问数智能体：动作解析/图表钳制/循环侦测（纯函数，不调对话模型） ----
    const agentLlm = require('../server/agent/llm.js');
    const agentGuard = require('../server/agent/guard.js');
    const naposServiceLib = require('../napos-service.js');
    await check('parseAgentAction → 工具动作/终答/围栏解析', async () => {
      const a = agentLlm.parseAgentAction('{"thought":"查","action":{"tool":"query_report","args":{"mode":"shop"}}}');
      expect(a.type === 'tool' && a.tool === 'query_report' && a.args.mode === 'shop', JSON.stringify(a));
      const f = agentLlm.parseAgentAction('前言```json\n{"thought":"完","final":{"answer":"结论"}}\n```后记');
      expect(f.type === 'final' && f.final.answer === '结论', JSON.stringify(f));
    });
    await check('parseAgentAction → 非法输出全部给出可读拒绝', async () => {
      const bads = ['不是json', '{"thought":"只有thought"}', '{"final":{"answer":"  "}}', '{"final":"字符串"}'];
      for (const bad of bads) {
        let rejected = false;
        try { agentLlm.parseAgentAction(bad); } catch { rejected = true; }
        expect(rejected, `未拒绝非法输出：${bad}`);
      }
    });
    await check('clampChart → 指标白名单与非法类型兜底', async () => {
      expect(agentGuard.clampChart({ type: 'pie', x: 'date', y: ['grossAmt'] }, naposServiceLib) === null, 'pie 应被拒绝');
      const c = agentGuard.clampChart({ type: 'line', x: 'date', y: ['grossAmt', 'hacked', 'validOrderCnt'] }, naposServiceLib);
      expect(c && c.type === 'line' && c.x === 'date' && c.y.length === 2 && !c.y.includes('hacked'), JSON.stringify(c));
    });
    await check('LoopDetector → 重复先提醒、三犯强制收敛、换参重置', async () => {
      const d = new agentGuard.LoopDetector();
      expect(d.record('t', { a: 1 }) === 'ok', '首次应为 ok');
      expect(d.record('t', { a: 1 }) === 'repeat', '第二次应为 repeat');
      expect(d.record('t', { a: 1 }) === 'loop', '第三次应为 loop');
      expect(d.record('t', { a: 2 }) === 'ok', '换参数应重置');
    });
    await check('技能 → 清单注入 prompt，点名技能有专属指令', async () => {
      const skillsLib = require('../server/agent/skills.js');
      const agentPrompt = require('../server/agent/prompt.js');
      const base = {
        svc: naposServiceLib, entityName: '测试主体', shops: [], dateRange: { from: '20260101', to: '20260201' },
        today: '20260201', toolsText: '- t：测试工具',
      };
      const p1 = agentPrompt.buildSystemPrompt({ ...base, skillsText: skillsLib.manifestText() });
      expect(p1.includes('内置技能') && p1.includes('周期对比分析') && p1.includes('数据体检'), '技能清单未注入');
      const p2 = agentPrompt.buildSystemPrompt({ ...base, skillsText: skillsLib.manifestText(), pointedSkill: skillsLib.get('data-checkup') });
      expect(p2.includes('点名技能【数据体检】') && p2.includes('严格按其打法'), '点名技能指令缺失');
    });
    await check('数字溯源 → 换算形态可溯源，无中生有被标记', async () => {
      const prov = require('../server/agent/provenance.js');
      const steps = [{
        type: 'tool', ok: true,
        summary: '本期营业额 10500 元，环比 25%。',
        data: { deltas: [{ cur: 10500, deltaPct: 0.25 }], curByDate: [{ date: '20261001', grossAmt: 1500 }] },
      }];
      const good = prov.checkProvenance('本期营业额 10500 元，环比 +25%；2026-10-01 当天 1,500 元。', steps);
      expect(good.total > 0 && good.untraced.length === 0, `应全部溯源：${JSON.stringify(good)}`);
      const bad = prov.checkProvenance('本期营业额 99999 元，环比 +25%。', steps);
      expect(bad.untraced.length === 1 && bad.untraced[0] === 99999, `编造数字未被标记：${JSON.stringify(bad)}`);
    });
    await check('指标层 → 清单注入 prompt；未知指标给出可用清单', async () => {
      const metricsLib = require('../server/agent/metrics.js');
      const agentPrompt = require('../server/agent/prompt.js');
      const base = {
        svc: naposServiceLib, entityName: '测试主体', shops: [], dateRange: { from: '20260101', to: '20260201' },
        today: '20260201', toolsText: '- t：测试工具', skillsText: '', metricsText: metricsLib.manifestText(),
      };
      const p = agentPrompt.buildSystemPrompt(base);
      expect(p.includes('指标聚合口径') && p.includes('gross_mov7') && p.includes('移动平均'), '派生指标清单未注入');
      const tool = require('../server/agent/tools/metric.js');
      let listed = false;
      try { tool.metricSanitize({ metric: 'nope' }, { shops: [], dateRange: base.dateRange }); } catch (e) { listed = /可用指标/.test(e.message); }
      expect(listed, '未知指标未给可用清单');
    });
    await check('Schema linking → 门店 ≤40 内嵌清单、多了改为按需查询', async () => {
      const agentPrompt = require('../server/agent/prompt.js');
      const mk = (n) => Array.from({ length: n }, (_, i) => ({ shopId: String(i), shopName: `测试门店${i}` }));
      const base = {
        svc: naposServiceLib, entityName: '测试主体', dateRange: { from: '20260101', to: '20260201' },
        today: '20260201', toolsText: '- t', skillsText: '', metricsText: '',
      };
      const small = agentPrompt.buildSystemPrompt({ ...base, shops: mk(3) });
      expect(small.includes('测试门店2'), '小主体未内嵌门店清单');
      const big = agentPrompt.buildSystemPrompt({ ...base, shops: mk(60) });
      expect(big.includes('门店较多') && !big.includes('测试门店2'), '大主体未改为按需查询');
    });
    await check('模型路由 → chatModelAgent 缺省回落主模型、JSON mode 默认关', async () => {
      const { makeChatCfg } = require('../server/context.js');
      const cfg1 = makeChatCfg({ config: { chatModel: 'm1', chatModelAgent: 'm2', chatJsonMode: true, apiBase: 'http://x', apiKey: 'k' } });
      expect(cfg1.chatModel === 'm1' && cfg1.chatModelAgent === 'm2' && cfg1.chatJsonMode === true, JSON.stringify(cfg1));
      const cfg2 = makeChatCfg({ config: { chatModel: 'm1', apiBase: 'http://x', apiKey: 'k' } });
      expect(cfg2.chatModelAgent === 'm1' && cfg2.chatJsonMode === false, JSON.stringify(cfg2));
    });

    // ---- 安全加固回归（纯函数，不落盘、不打外部 API） ----
    const { createContext } = require('../server/context.js');
    const { createGenerationService } = require('../server/services/generation.js');
    await check('buildImagesAndPrompt → 参考图越界被钳制', async () => {
      const gen = createGenerationService(createContext());
      const out = gen.buildImagesAndPrompt(os.tmpdir(), '测试提示词', [
        '../../config.json',       // 相对路径越界
        '/etc/passwd',             // 绝对路径注入
        'sub/../ok.png',           // 归一化后仍在目录内的合法形态（文件不存在也会被读取失败跳过）
      ], {});
      expect(out.images.length === 0, `越界参考图未被拦截：images=${out.images.length}`);
    });
    await check('jsonForScript → </script> 不再原样进入脚本体', async () => {
      const { jsonForScript } = require('../report-html.js');
      const out = jsonForScript(['一食堂</script><img src=x onerror=alert(1)>']);
      expect(!out.includes('</script>') && out.includes('\\u003c'), out);
    });
    await check('mergeDefaults → 嵌套默认值不被 config.json 局部对象清掉', async () => {
      const { mergeDefaults, CONFIG_DEFAULTS } = require('../server/context.js');
      const merged = mergeDefaults(CONFIG_DEFAULTS, { aitable: { enabled: true, appSecret: 'sec' } });
      expect(merged.aitable.enabled === true && merged.aitable.appSecret === 'sec', '保存值未生效');
      expect(merged.aitable.appKey === CONFIG_DEFAULTS.aitable.appKey && !!merged.aitable.baseId && !!merged.aitable.operatorId,
        `组织级默认被清掉：appKey=${merged.aitable.appKey}`);
      expect(merged.autoSync.time === CONFIG_DEFAULTS.autoSync.time, 'autoSync 默认被清掉');
    });

    // ---- 静态与路由行为 ----
    for (const p of ['/', '/index.html', '/app.js', '/crawl.js', '/gen.js', '/history.js', '/tasks.js', '/reports.js', '/analysis-templates.js', '/lake.js', '/ask.js', '/style.css', '/vendor/echarts.min.js']) {
      await check(`静态 ${p}`, async () => {
        const r = await request(port, 'GET', p);
        expect(r.status === 200, `status=${r.status}`);
      });
    }
    await check('GET /api/reports/bench（合法字段）', async () => {
      const r = await request(port, 'GET', '/api/reports/bench?field=gross_amt&from=20260101&to=20260102');
      expect(r.status === 200, `status=${r.status}`);
      const body = r.json();
      expect(Array.isArray(body.rows), 'rows 应为数组');
    });
    await check('GET /api/reports/bench（非法字段 → 400）', async () => {
      const r = await request(port, 'GET', '/api/reports/bench?field=no_such');
      expect(r.status === 400, `status=${r.status}`);
    });
    await check('GET /no-such-path → 404', async () => {
      const r = await request(port, 'GET', '/no-such-path');
      expect(r.status === 404, `status=${r.status}`);
    });
    await check('DELETE /api/settings → 405', async () => {
      const r = await request(port, 'DELETE', '/api/settings');
      expect(r.status === 405, `status=${r.status}`);
    });

    // ---- 问数智能体：主服务上只测只读会话接口（绝不在有主体/真模型时发起运行） ----
    await check('GET /api/agent/sessions（无主体 → 400；有主体 → 200）', async () => {
      const ent = await request(port, 'GET', '/api/reports/entities');
      const r = await request(port, 'GET', '/api/agent/sessions');
      if (ent.json().entities.length > 0) {
        expect(r.status === 200 && Array.isArray(r.json().sessions), `status=${r.status}`);
      } else {
        expect(r.status === 400 && r.json().code === 'ASK_NO_ENTITY', `status=${r.status} code=${r.json().code}`);
      }
    });

    // ---- 问数智能体端到端（隔离湖 + NAPOS_AGENT_MOCK 确定性假模型，零网络零真实数据） ----
    {
      const fs = require('fs');
      const tmpLake = fs.mkdtempSync(path.join(os.tmpdir(), 'genpic-lake-'));
      const tmpAgent = fs.mkdtempSync(path.join(os.tmpdir(), 'genpic-agent-'));
      const mkRow = (date, scope, ids, m) => ({
        date, scope,
        shopId: ids.shopId || '', shopName: ids.shopName || '',
        chainId: ids.chainId || '', chainName: ids.chainName || '',
        bizHours: null, abnormalCloseHours: null, goodsSaleAmt: null,
        syncedAt: new Date().toISOString(),
        validOrderCnt: m.orders || 0, incomeAmt: m.income || 0, grossAmt: m.gross || 0,
        expenseAmt: m.expense || 0, expUv: m.uv || 0, orderUserCnt: m.buyers || 0,
        clkExpRate: m.clk || 0, ordClkRate: 0, perActualPay: 0,
        actOrdCnt: 0, actSubsidyAmt: 0, shopRoi: 0, rebuyRate30d: 0,
        // 全字段落库模拟：同行均值/排名与环比差值（peer_benchmark / raw_inspect 用）
        raw: {
          gross_amt: m.gross || 0, valid_order_cnt: m.orders || 0,
          gross_amt_mall_avg: m.peerAvg != null ? m.peerAvg : 800,
          gross_amt_mall_avg_rank: m.rank != null ? m.rank : 2,
          valid_order_cnt_diff: m.orders || 0,
        },
      });
      // 健康主体：0924~0930（缺 0927）+ 1001~1007，两店；本期日营业额 1500 / 上期 1400（环比 +25%）
      const prevDays = ['20260924', '20260925', '20260926', '20260928', '20260929', '20260930'];
      const curDays = ['20261001', '20261002', '20261003', '20261004', '20261005', '20261006', '20261007'];
      const healthyRows = [];
      for (const d of prevDays) {
        healthyRows.push(mkRow(d, 'shop', { shopId: '101', shopName: '一店', chainId: '9', chainName: '第一连锁' }, { gross: 900, income: 720, expense: 180, orders: 90, uv: 1800, buyers: 100, clk: 0.08 }));
        healthyRows.push(mkRow(d, 'shop', { shopId: '102', shopName: '二店', chainId: '9', chainName: '第一连锁' }, { gross: 500, income: 400, expense: 100, orders: 40, uv: 900, buyers: 45, clk: 0.08 }));
        healthyRows.push(mkRow(d, 'chain', { chainId: '9', chainName: '第一连锁' }, { gross: 1400, income: 1120, expense: 280, orders: 130, uv: 2700, buyers: 145, clk: 0.08 }));
        healthyRows.push(mkRow(d, 'company', { chainId: '-1' }, { gross: 1400, income: 1120, expense: 280, orders: 130, uv: 2700, buyers: 145, clk: 0.08 }));
      }
      for (const d of curDays) {
        healthyRows.push(mkRow(d, 'shop', { shopId: '101', shopName: '一店', chainId: '9', chainName: '第一连锁' }, { gross: 1000, income: 800, expense: 200, orders: 100, uv: 2000, buyers: 110, clk: 0.08 }));
        healthyRows.push(mkRow(d, 'shop', { shopId: '102', shopName: '二店', chainId: '9', chainName: '第一连锁' }, { gross: 500, income: 400, expense: 100, orders: 40, uv: 900, buyers: 45, clk: 0.08 }));
        healthyRows.push(mkRow(d, 'chain', { chainId: '9', chainName: '第一连锁' }, { gross: 1500, income: 1200, expense: 300, orders: 140, uv: 2900, buyers: 155, clk: 0.08 }));
        healthyRows.push(mkRow(d, 'company', { chainId: '-1' }, { gross: 1500, income: 1200, expense: 300, orders: 140, uv: 2900, buyers: 155, clk: 0.08 }));
      }
      // 全零主体：门店行全零而连锁/公司有数（已知 bug 形态，体检必须 fail）
      const badRows = [];
      for (const d of ['20261001', '20261002', '20261003']) {
        badRows.push(mkRow(d, 'shop', { shopId: '201', shopName: '全零店', chainId: '9', chainName: '第一连锁' }, {}));
        badRows.push(mkRow(d, 'chain', { chainId: '9', chainName: '第一连锁' }, { gross: 1000, income: 800, expense: 200, orders: 100 }));
        badRows.push(mkRow(d, 'company', { chainId: '-1' }, { gross: 1000, income: 800, expense: 200, orders: 100 }));
      }
      const nowIso = new Date().toISOString();
      fs.writeFileSync(path.join(tmpLake, 'entities.json'), JSON.stringify({ entities: [
        { key: 'smokeask', firstSeen: nowIso, lastSeen: nowIso, merchantId: 'smokeask', name: '冒烟主体A', chainCount: 1, shopCount: 2,
          chains: [{ chainId: '9', chainName: '第一连锁' }],
          shops: [
            { shopId: '101', shopName: '一店', chainId: '9', chainName: '第一连锁' },
            { shopId: '102', shopName: '二店', chainId: '9', chainName: '第一连锁' },
          ] },
        { key: 'smokebad', firstSeen: nowIso, lastSeen: nowIso, merchantId: 'smokebad', name: '冒烟主体B', chainCount: 1, shopCount: 1,
          chains: [{ chainId: '9', chainName: '第一连锁' }],
          shops: [{ shopId: '201', shopName: '全零店', chainId: '9', chainName: '第一连锁' }] },
      ] }));
      fs.mkdirSync(path.join(tmpLake, 'smokeask'), { recursive: true });
      fs.writeFileSync(path.join(tmpLake, 'smokeask', 'daily-202609.json'), JSON.stringify({ version: 2, updated: nowIso, rows: healthyRows.filter((r) => r.date < '20261000') }));
      fs.writeFileSync(path.join(tmpLake, 'smokeask', 'daily-202610.json'), JSON.stringify({ version: 2, updated: nowIso, rows: healthyRows.filter((r) => r.date >= '20261000') }));
      fs.mkdirSync(path.join(tmpLake, 'smokebad'), { recursive: true });
      fs.writeFileSync(path.join(tmpLake, 'smokebad', 'daily-202610.json'), JSON.stringify({ version: 2, updated: nowIso, rows: badRows }));

      const aport = await pickPort();
      const achild = spawn(process.execPath, [path.join(ROOT, 'server.js')], {
        env: {
          ...process.env, PORT: String(aport), HOST: '127.0.0.1',
          GENPIC_LAKE_DIR: tmpLake, GENPIC_AGENT_DIR: tmpAgent, NAPOS_AGENT_MOCK: '1',
        },
        stdio: ['ignore', 'pipe', 'pipe'],
      });
      let alog = '';
      achild.stdout.on('data', (c) => { alog += c; });
      achild.stderr.on('data', (c) => { alog += c; });
      try {
        await waitForHealth(aport);
        const waitRunDone = async (runId, entity, timeoutMs = 10000) => {
          const start = Date.now();
          for (;;) {
            const r = await request(aport, 'GET', `/api/agent/runs/${enc(runId)}?entity=${enc(entity)}`);
            const run = r.json().run;
            if (run && run.status !== 'running') return run;
            if (Date.now() - start > timeoutMs) throw new Error(`运行未在超时内结束 status=${run && run.status}`);
            await new Promise((res) => setTimeout(res, 200));
          }
        };
        const stepByTool = (run, tool) => (run.steps || []).find((s) => s.type === 'tool' && s.tool === tool);
        let askSessionId = null;
        let askRunId = null;
        const fetchAskRun = async () => {
          const r = await request(aport, 'GET', `/api/agent/runs/${enc(askRunId)}?entity=${enc('smokeask')}`);
          return r.json().run;
        };

        await check('智能体 mock 运行 → 四工具全成 + final + 用量', async () => {
          const r = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokeask', question: '最近营业额趋势如何？', mode: 'agent' });
          expect(r.status === 200 && r.json().run && r.json().run.runId, `status=${r.status}`);
          const run = await waitRunDone(r.json().run.runId, 'smokeask');
          expect(run.status === 'done', `status=${run.status} error=${run.error}`);
          const tools = (run.steps || []).filter((s) => s.type === 'tool');
          expect(JSON.stringify(tools.map((s) => s.tool)) === JSON.stringify(['lake_overview', 'query_report', 'compare_periods', 'data_quality', 'build_report']),
            `工具序列异常：${tools.map((s) => s.tool).join(',')}`);
          expect(tools.every((s) => s.ok), '存在失败的工具步骤');
          expect(run.usage.llmCalls === 6 && run.usage.toolCalls === 5, `用量异常 llm=${run.usage.llmCalls} tool=${run.usage.toolCalls}`);
          expect(run.result && run.result.answer.includes('mock'), JSON.stringify(run.result));
          expect(run.result.chart && run.result.chart.type === 'line', 'final 缺图表规格');
          expect(run.result.reportUrl && run.result.reportUrl.includes('/api/reports/report-html'), `缺报告链接：${run.result.reportUrl}`);
          askSessionId = run.sessionId;
          askRunId = run.runId;
        });
        await check('智能体 mock → compare_periods 环比数字正确（门店对齐 + +25%）', async () => {
          const run = await fetchAskRun();
          const cmp = stepByTool(run, 'compare_periods');
          expect(cmp && cmp.ok && cmp.data, 'compare_periods 步骤缺失');
          const gross = cmp.data.deltas.find((d) => d.key === 'grossAmt');
          expect(gross && gross.cur === 10500 && gross.prev === 8400, `环比数字异常 ${JSON.stringify(gross)}`);
          expect(Math.abs(gross.deltaPct - 0.25) < 1e-9, `变化率异常 ${gross.deltaPct}`);
          expect(cmp.data.comparableShopCount === 2, `可比门店数异常 ${cmp.data.comparableShopCount}`);
        });
        await check('智能体 mock → query_report 按日聚合 13 天', async () => {
          const run = await fetchAskRun();
          const q = stepByTool(run, 'query_report');
          expect(q && q.ok && q.data && q.data.rows.length === 13, `按日行数异常 ${q && q.data && q.data.rows.length}`);
        });
        await check('智能体 mock → data_quality 健康主体无 fail 且报缺 1 天', async () => {
          const run = await fetchAskRun();
          const dq = stepByTool(run, 'data_quality');
          expect(dq && dq.ok, 'data_quality 步骤缺失');
          expect(dq.summary.includes('缺 1/14'), `缺日未识别：${dq.summary}`);
          expect(!dq.summary.includes('[fail]'), `健康主体误报 fail：${dq.summary}`);
        });
        await check('智能体 mock → 全零主体体检必须 fail', async () => {
          const r = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokebad', question: '体检一下', mode: 'agent' });
          expect(r.status === 200, `status=${r.status}`);
          const run = await waitRunDone(r.json().run.runId, 'smokebad');
          expect(run.status === 'done', `status=${run.status} error=${run.error}`);
          const dq = stepByTool(run, 'data_quality');
          expect(dq && dq.summary.includes('[fail]') && dq.summary.includes('全零'), dq.summary);
        });
        await check('智能体 mock 快问 → 直接终答（同一会话追问）', async () => {
          const r = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokeask', question: '昨天营业额', mode: 'quick', sessionId: askSessionId });
          expect(r.status === 200, `status=${r.status}`);
          const run = await waitRunDone(r.json().run.runId, 'smokeask');
          expect(run.status === 'done' && run.mode === 'quick' && run.result.answer.includes('快问'), JSON.stringify(run.result));
          expect(run.sessionId === askSessionId, '快问未落入同一会话');
        });
        await check('智能体 会话索引 → 标题=首问、运行入册、带最近一问', async () => {
          const s = await request(aport, 'GET', `/api/agent/sessions?entity=${enc('smokeask')}`);
          const sessions = s.json().sessions;
          expect(sessions.length === 1 && sessions[0].title === '最近营业额趋势如何？' && sessions[0].runCount === 2,
            JSON.stringify(sessions));
          expect(sessions[0].lastQuestion === '昨天营业额', `lastQuestion 异常：${sessions[0].lastQuestion}`);
          const runs = await request(aport, 'GET', `/api/agent/runs?entity=${enc('smokeask')}&sessionId=${enc(sessions[0].sessionId)}`);
          expect(runs.json().runs.length === 2, '会话运行列表数量异常');
        });
        await check('智能体 删除会话 → 索引与运行文件清零、再删 404', async () => {
          const s = await request(aport, 'GET', `/api/agent/sessions?entity=${enc('smokeask')}`);
          const sid = s.json().sessions[0].sessionId;
          const del = await request(aport, 'DELETE', `/api/agent/sessions/${enc(sid)}?entity=${enc('smokeask')}`);
          expect(del.status === 200 && del.json().ok === true, `status=${del.status}`);
          const after = await request(aport, 'GET', `/api/agent/sessions?entity=${enc('smokeask')}`);
          expect(after.json().sessions.length === 0, '删除后索引未清空');
          const del2 = await request(aport, 'DELETE', `/api/agent/sessions/${enc(sid)}?entity=${enc('smokeask')}`);
          expect(del2.status === 404, `重复删除应 404，实际 ${del2.status}`);
        });
        await check('GET /api/agent/skills → 四个内置技能', async () => {
          const r = await request(aport, 'GET', '/api/agent/skills');
          const skills = r.json().skills || [];
          expect(r.status === 200 && skills.length === 4 && skills.every((s) => s.key && s.name), JSON.stringify(skills));
        });
        await check('智能体 技能点名 → run.skill 落档且运行完成', async () => {
          const r = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokeask', question: '对比本期与上期', mode: 'agent', skill: 'period-compare' });
          expect(r.status === 200, `status=${r.status}`);
          const run = await waitRunDone(r.json().run.runId, 'smokeask');
          expect(run.status === 'done' && run.skill === 'period-compare', `skill=${run.skill} status=${run.status} error=${run.error}`);
        });
        await check('智能体 verdicts 归档 → 校验工具结论入运行记录', async () => {
          const run = await fetchAskRun();
          const vs = run.verdicts || [];
          expect(vs.length >= 5, `verdicts 过少：${vs.length}`);
          expect(vs.some((v) => v.kind === 'identity') && vs.some((v) => v.kind === 'quality'), `缺 identity/quality verdict：${JSON.stringify(vs.map((v) => v.kind))}`);
          expect(vs.every((v) => v.id && ['ok', 'warn', 'fail'].includes(v.status)), `verdict 形状异常：${JSON.stringify(vs[0])}`);
        });
        await check('智能体 自动分流 → 短问走快问、分析问走深度', async () => {
          const r1 = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokeask', question: '昨天营业额多少', mode: 'auto' });
          const run1 = await waitRunDone(r1.json().run.runId, 'smokeask');
          expect(run1.status === 'done' && run1.mode === 'quick' && run1.autoPicked === true, `短问未分流快问：mode=${run1.mode}`);
          const r2 = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokeask', question: '最近30天比上一个30天营业额变化多少，主要受哪些门店影响', mode: 'auto' });
          const run2 = await waitRunDone(r2.json().run.runId, 'smokeask');
          expect(run2.status === 'done' && run2.mode === 'agent' && run2.autoPicked === true, `分析问未分流深度：mode=${run2.mode}`);
        });
        await check('晨报：确定性生成（环比头条 + verdicts）并可读取', async () => {
          const b = await request(aport, 'POST', '/api/agent/digests/build', { entity: 'smokeask' });
          expect(b.status === 200 && b.json().digest, `status=${b.status}`);
          const d = b.json().digest;
          expect(d.headline.includes('10,500'), `头条数字异常：${d.headline}`);
          expect((d.verdicts || []).length >= 5 && (d.sections || []).length === 3, `晨报构成异常：sections=${(d.sections || []).length}`);
          const list = await request(aport, 'GET', `/api/agent/digests?entity=${enc('smokeask')}`);
          expect(list.json().digests.length === 1 && list.json().digests[0].id === d.id, '晨报列表读取异常');
        });
        await check('反馈闭环：采纳入语料、纠错入日志', async () => {
          const up = await request(aport, 'POST', '/api/agent/feedback', { entity: 'smokeask', runId: askRunId, kind: 'up' });
          expect(up.status === 200 && up.json().run.feedback.kind === 'up', `status=${up.status}`);
          expect(fs.existsSync(path.join(tmpAgent, 'smokeask', 'corpus.json')), '采纳未入打法语料');
          const down = await request(aport, 'POST', '/api/agent/feedback', { entity: 'smokeask', runId: askRunId, kind: 'down', note: '数字不对' });
          expect(down.status === 200 && down.json().run.feedback.note === '数字不对', '纠错未落 run');
          expect(fs.existsSync(path.join(tmpAgent, 'smokeask', 'feedback.json')), '纠错未入反馈日志');
        });
        await check('深度分析报告端点 → 自包含 HTML（体检/异常章节）', async () => {
          const r = await request(aport, 'GET', `/api/agent/report-deep?entity=${enc('smokeask')}&from=20260924&to=20261007`);
          expect(r.status === 200 && /text\/html/.test(r.headers['content-type'] || ''), `status=${r.status}`);
          expect(r.text.includes('数据体检') && r.text.includes('统计异常') && r.text.includes('归因'), '深度报告章节缺失');
        });
        await check('智能体 工具直测（隔离子进程）→ cross_check/peer_benchmark/raw_inspect', async () => {
          const toolProbe = [
            `const ROOT = ${JSON.stringify(ROOT)};`,
            'const svc = require(ROOT + "/napos-service.js");',
            'const nlq = require(ROOT + "/nl-query.js");',
            'const cross = require(ROOT + "/server/agent/tools/cross.js");',
            'const peer = require(ROOT + "/server/agent/tools/peer.js");',
            'function ctxOf(entity) { const meta = svc.store.getEntity(entity); return { svc, entityKey: entity, meta, shops: meta.shops || [], dateRange: nlq.lakeDateRange(entity, svc) }; }',
            'const out = {};',
            'const healthy = ctxOf("smokeask");',
            'const c1 = cross.crossHandler(healthy, cross.crossSanitize({}, healthy));',
            'out.healthy = { checked: c1.data.checked, mismatch: c1.data.mismatchCount, severe: c1.data.severe };',
            'const bad = ctxOf("smokebad");',
            'const c2 = cross.crossHandler(bad, cross.crossSanitize({}, bad));',
            'out.bad = { mismatch: c2.data.mismatchCount, severe: c2.data.severe };',
            'const b1 = peer.benchHandler(healthy, peer.benchSanitize({ field: "gross_amt" }, healthy));',
            'const bs = b1.data.shops || [];',
            'out.bench = { shops: bs.length, firstPeer: bs[0] && bs[0].peerAvg, firstRank: bs[0] && bs[0].rankAvg };',
            'const r1 = peer.rawHandler(healthy, peer.rawSanitize({ date: "20261001", shops: ["一店"] }, healthy));',
            'out.raw = { found: r1.data.found, matched: (r1.data.matched || []).length, hasRaw: r1.data.hasRaw };',
            'const entityTool = require(ROOT + "/server/agent/tools/entity.js");',
            'const e1 = entityTool.entityHandler(healthy, entityTool.entitySanitize({}, healthy));',
            'out.entity = { entities: (e1.data.entities || []).length, first: (e1.data.entities || [])[0] && (e1.data.entities || [])[0].name, skipped: (e1.data.skipped || []).length };',
            'const cloudTool = require(ROOT + "/server/agent/tools/cloud.js");',
            'cloudTool.cloudHandler(healthy, cloudTool.cloudSanitize({}, healthy)).then((c3) => {',
            '  out.cloud = { available: c3.data.available, hasVerdict: Array.isArray(c3.data.verdicts) && c3.data.verdicts.length === 1 };',
            '  const replay = require(ROOT + "/server/agent/replay.js");',
            '  const cfile = require("os").tmpdir() + "/genpic-replay-probe-" + process.pid + ".json";',
            '  replay.record(cfile, { question: "最近7天营业额和单量趋势", steps: [{ tool: "query_report", args: { mode: "date" } }, { tool: "data_quality", args: {} }] });',
            '  replay.record(cfile, { question: "上月营业额Top5门店", steps: [{ tool: "query_report", args: { mode: "shop", limit: 5 } }] });',
            '  const plan = replay.findPlan(cfile, "最近7天营业额和单量的趋势");',
            '  out.replay = {',
            '    hit: !!plan && plan.steps.length === 1 && plan.steps[0].tool === "query_report",',
            '    few: replay.fewShot(cfile, "最近7天营业额怎么样").length,',
            '    miss: !!replay.findPlan(cfile, "帮我做个数据体检"),',
            '  };',
            '  require("fs").unlinkSync(cfile);',
            '  console.log(JSON.stringify(out));',
            '});',
          ].join('\n');
          const probe = spawnSync(process.execPath, ['-e', toolProbe], {
            encoding: 'utf8', timeout: 20000,
            env: { ...process.env, GENPIC_LAKE_DIR: tmpLake },
          });
          expect(probe.status === 0, `探针失败：${(probe.stderr || probe.stdout || '').slice(-300)}`);
          const out = JSON.parse(probe.stdout.trim().split('\n').pop());
          expect(out.healthy.checked > 0 && out.healthy.mismatch === 0 && out.healthy.severe === false,
            `健康主体层间核对异常：${JSON.stringify(out.healthy)}`);
          expect(out.bad.severe === true && out.bad.mismatch > 0, `全零主体未检出层间不一致：${JSON.stringify(out.bad)}`);
          expect(out.bench.shops === 2 && out.bench.firstPeer === 800 && out.bench.firstRank === 2,
            `同行对标异常：${JSON.stringify(out.bench)}`);
          expect(out.raw.found === true && out.raw.hasRaw === true && out.raw.matched >= 3,
            `raw 检视异常：${JSON.stringify(out.raw)}`);
          expect(out.entity.entities === 2 && out.entity.first === '冒烟主体A' && out.entity.skipped === 0,
            `跨主体对比异常：${JSON.stringify(out.entity)}`);
          expect(out.cloud.available === false && out.cloud.hasVerdict === true,
            `云端未启用未优雅降级：${JSON.stringify(out.cloud)}`);
          expect(out.replay.hit === true && out.replay.few >= 1 && out.replay.miss === false,
            `打法缓存异常：${JSON.stringify(out.replay)}`);
        });
        await check('智能体 空问题 → 400 ASK_EMPTY', async () => {
          const r = await request(aport, 'POST', '/api/agent/runs', { entity: 'smokeask', question: '   ' });
          expect(r.status === 400 && r.json().code === 'ASK_EMPTY', `status=${r.status} code=${r.json().code}`);
        });
        await check('智能体 取消不存在的运行 → 404', async () => {
          const r = await request(aport, 'POST', '/api/agent/runs/no-such-run/cancel', {});
          expect(r.status === 404, `status=${r.status}`);
        });
      } catch (e) {
        results.push({ name: '（智能体隔离测试执行中断）', ok: false, error: e.message + (alog ? ` | 服务日志：${alog.slice(-300)}` : '') });
      } finally {
        try { achild.kill('SIGKILL'); } catch { /* ignore */ }
        try { fs.rmSync(tmpLake, { recursive: true, force: true }); fs.rmSync(tmpAgent, { recursive: true, force: true }); } catch { /* ignore */ }
      }
    }

    // ---- 优雅停机（SIGTERM 后应自行退出） ----
    await check('SIGTERM 优雅停机', async () => {
      process.kill(child.pid, 'SIGTERM');
      const exited = await new Promise((resolve) => {
        const t = setTimeout(() => resolve(false), 8000);
        child.on('exit', () => { clearTimeout(t); resolve(true); });
      });
      expect(exited, 'SIGTERM 后 8 秒内未退出');
    });

    // ---- 访问口令（需局域网 IP：本机回环地址在守卫中直接放行，测不到 401） ----
    const lanIp = getLanIpv4();
    if (!lanIp) {
      results.push({ name: '访问口令（无局域网 IP，跳过）', ok: true });
    } else {
      const tport = await pickPort();
      const tchild = spawn(process.execPath, [path.join(ROOT, 'server.js')], {
        env: { ...process.env, PORT: String(tport), HOST: '0.0.0.0', ACCESS_TOKEN: 'smoke-token' },
        stdio: ['ignore', 'ignore', 'ignore'],
      });
      try {
        await waitForHealthLan(lanIp, tport);
        await check('口令开启：无口令访问 API → 401', async () => {
          const r = await request(tport, 'GET', '/api/models', undefined, lanIp);
          expect(r.status === 401, `status=${r.status}`);
        });
        await check('口令开启：?token= 通过', async () => {
          const r = await request(tport, 'GET', `/api/models?token=smoke-token`, undefined, lanIp);
          expect(r.status === 200, `status=${r.status}`);
        });
        await check('口令开启：X-Access-Token 头通过', async () => {
          const r = await request(tport, 'GET', '/api/models', undefined, lanIp, { 'X-Access-Token': 'smoke-token' });
          expect(r.status === 200, `status=${r.status}`);
        });
        await check('口令开启：cookie 通过', async () => {
          const r = await request(tport, 'GET', '/api/models', undefined, lanIp, { Cookie: 'accessToken=smoke-token' });
          expect(r.status === 200, `status=${r.status}`);
        });
        await check('口令开启：/healthz 与静态页放行', async () => {
          const h = await request(tport, 'GET', '/healthz', undefined, lanIp);
          const s = await request(tport, 'GET', '/', undefined, lanIp);
          expect(h.status === 200 && s.status === 200, `healthz=${h.status} static=${s.status}`);
        });
        await check('口令开启：错误口令 → 401', async () => {
          const r = await request(tport, 'GET', '/api/models?token=wrong', undefined, lanIp);
          expect(r.status === 401, `status=${r.status}`);
        });
      } finally {
        try { tchild.kill('SIGKILL'); } catch { /* ignore */ }
      }
    }
  } catch (e) {
    results.push({ name: '（测试执行中断）', ok: false, error: e.message });
  } finally {
    try { child.kill('SIGKILL'); } catch { /* already dead */ }
  }

  const failed = results.filter((r) => !r.ok);
  console.log('\n========== 冒烟测试结果 ==========');
  for (const r of results) {
    console.log(`${r.ok ? '✓' : '✗'} ${r.name}${r.ok ? '' : '  ← ' + r.error}`);
  }
  console.log(`\n通过 ${results.length - failed.length}/${results.length}`);
  if (failed.length) {
    console.log('\n服务启动日志（末尾 500 字）：');
    console.log(bootLog.slice(-500));
    process.exit(1);
  }
}

main().catch((e) => {
  console.error('冒烟脚本自身异常:', e);
  process.exit(1);
});