吸收数字员工管理端审计诊断预览

qimingclaw/crates/agent-electron-client/scripts/check-digital-employee.js

@@ -1770,6 +1770,75 @@ function checkDigitalAdminArtifactLifecycleWorkbench() {
   console.log("[DigitalEmployeeCheck] admin artifact lifecycle workbench hooks OK");
 }
 
+function checkDigitalAdminAuditDiagnosticsWorkbench() {
+  console.log("\n[DigitalEmployeeCheck] Verify admin audit diagnostics workbench hooks");
+  const backendRoot = path.resolve(packageRoot, "..", "..", "..", "qiming-backend");
+  const qimingRoot = path.resolve(packageRoot, "..", "..", "..", "qiming");
+  const servicePath = path.join(
+    backendRoot,
+    "app-platform-modules",
+    "app-platform-agent",
+    "app-platform-agent-core-application",
+    "src",
+    "main",
+    "java",
+    "com",
+    "xspaceagi",
+    "agent",
+    "core",
+    "application",
+    "service",
+    "DigitalEmployeeSyncApplicationServiceImpl.java",
+  );
+  const testPath = path.join(
+    backendRoot,
+    "app-platform-modules",
+    "app-platform-agent",
+    "app-platform-agent-core-application",
+    "src",
+    "test",
+    "java",
+    "com",
+    "xspaceagi",
+    "agent",
+    "core",
+    "application",
+    "service",
+    "DigitalEmployeeSyncApplicationServiceImplTest.java",
+  );
+  const qimingOpsPath = path.join(qimingRoot, "src", "pages", "SystemManagement", "Content", "DigitalEmployeeOps", "index.tsx");
+  const qimingTypesPath = path.join(qimingRoot, "src", "types", "interfaces", "systemManage.ts");
+  const docsPath = path.resolve(packageRoot, "..", "..", "docs", "digital-employee-frontend-integration-plan.md");
+  const service = fs.readFileSync(servicePath, "utf8");
+  const test = fs.readFileSync(testPath, "utf8");
+  const qimingOps = fs.readFileSync(qimingOpsPath, "utf8");
+  const qimingTypes = fs.readFileSync(qimingTypesPath, "utf8");
+  const docs = fs.readFileSync(docsPath, "utf8");
+  const requiredSnippets = [
+    [service, "audits", "backend audits view"],
+    [service, "isAuditRow", "backend audit matcher"],
+    [service, "sandbox_audit", "backend sandbox audit category"],
+    [service, "token_cost", "backend token cost category"],
+    [service, "tool_call_audit", "backend tool call audit category"],
+    [service, "sync_failure", "backend sync failure audit category"],
+    [test, "queryAdminWorkbenchAuditsReturnsAuditRowsOnly", "backend audit diagnostics test"],
+    [test, "doesNotContainKeys(\"token\", \"authorization\", \"raw_input\", \"command\", \"prompt\")", "backend audit redaction assertion"],
+    [qimingTypes, "audits", "qiming audits view type"],
+    [qimingOps, "审计诊断", "qiming audit diagnostics tab"],
+    [qimingOps, "标记复核", "qiming audit reviewed action"],
+    [qimingOps, "忽略", "qiming audit dismiss action"],
+    [qimingOps, "标记归档", "qiming audit archive action"],
+    [docs, "正式管理端审计诊断预览", "docs audit diagnostics absorption"],
+  ];
+  const missing = requiredSnippets
+    .filter(([content, snippet]) => !content.includes(snippet))
+    .map(([, , label]) => label);
+  if (missing.length > 0) {
+    throw new Error(`Missing admin audit diagnostics workbench hooks: ${missing.join(", ")}`);
+  }
+  console.log("[DigitalEmployeeCheck] admin audit diagnostics workbench hooks OK");
+}
+
 function checkLocalDatabaseSchema() {
   console.log("\n[DigitalEmployeeCheck] Verify local SQLite digital schema");
   const dbPath = path.join(os.homedir(), ".qimingclaw", "qimingclaw.db");
@@ -1837,6 +1906,7 @@ function main() {
     checkDigitalAdminRouteGovernanceWorkbench();
     checkDigitalAdminNotificationWorkbench();
     checkDigitalAdminArtifactLifecycleWorkbench();
+    checkDigitalAdminAuditDiagnosticsWorkbench();
     checkLocalDatabaseSchema();
     console.log("\n[DigitalEmployeeCheck] All checks passed");
   } catch (error) {

qimingclaw/docs/digital-employee-frontend-integration-plan.md

@@ -604,7 +604,7 @@ GET /api/digital-employee/approvals
     - 建议：下一轮围绕管理端正式路由 UI 和跨设备冲突可视化，把 embedded 批量干预入口推进到管理端运营台。
 
 11. **诊断 / 成本 / 审计视图**
-    - 已吸收：同步失败诊断较完整，部分 sandbox / memory / service 日志在 qimingclaw 其他模块中存在；embedded adapter 已接管 `/api/doctor`、`/api/cost`、`/api/audit`，从 snapshot、runtime records、sync status、managed services 和 artifact delivery facts 生成诊断、估算成本和审计投影；sandbox audit、token/cost 和 CLI/tool 调用事件已开始通过 `digital_events` 与 outbox `business_view` 提炼为 `sandbox_audit`、`token_cost`、`tool_call_audit` 分类，并只同步 session、tool、server、operation、status、exit code、duration、model、token 计数和估算成本等安全字段；数字员工首页已展示诊断/审计/Token/估算成本摘要，`/api/digital-employee/audits` 已提供本地审计业务视图，诊断与审计风险通知联动已开始闭环。管理端正式审计视图预览已开始吸收，embedded “技能审计”会消费 sandbox/tool/cost 风险来源并保留安全 payload preview。诊断修复动作预览已开始吸收，“处置台”可把 doctor/audit/service/policy 风险转为可筛选、可标记和可安全重试的运营事项。发送账单审计外壳已开始吸收，后端提供估算账单查询和审计归档记录接口，qiming 运营台可显示 Token/估算成本并标记脱敏归档；归档记录会剔除 token、authorization、raw_input、prompt 和 command 等敏感字段。
+    - 已吸收：同步失败诊断较完整，部分 sandbox / memory / service 日志在 qimingclaw 其他模块中存在；embedded adapter 已接管 `/api/doctor`、`/api/cost`、`/api/audit`，从 snapshot、runtime records、sync status、managed services 和 artifact delivery facts 生成诊断、估算成本和审计投影；sandbox audit、token/cost 和 CLI/tool 调用事件已开始通过 `digital_events` 与 outbox `business_view` 提炼为 `sandbox_audit`、`token_cost`、`tool_call_audit` 分类，并只同步 session、tool、server、operation、status、exit code、duration、model、token 计数和估算成本等安全字段；数字员工首页已展示诊断/审计/Token/估算成本摘要，`/api/digital-employee/audits` 已提供本地审计业务视图，诊断与审计风险通知联动已开始闭环。管理端正式审计视图预览和正式管理端审计诊断预览已开始吸收，qiming-backend 的 `audits` 运营台视图会聚合 sandbox / token cost / tool call / sync failure / governance 审计业务视图，qiming“数字员工运营台”的“审计诊断”tab 可标记复核、忽略和脱敏归档。诊断修复动作预览已开始吸收，“处置台”可把 doctor/audit/service/policy 风险转为可筛选、可标记和可安全重试的运营事项。发送账单审计外壳已开始吸收，后端提供估算账单查询和审计归档记录接口，qiming 运营台可显示 Token/估算成本并标记脱敏归档；归档记录会剔除 token、authorization、raw_input、prompt 和 command 等敏感字段。
     - 缺口：真实计费账单、独立 sandbox audit 文件归档、自动诊断修复动作和正式外部管理端审计视图尚未统一吸收；当前账单仍是估算，审计归档只记录脱敏摘要和归档位置。
     - 建议：下一轮围绕管理端正式审计视图和诊断修复动作，把本地可追溯审计继续推进到可运营处置。