吸收数字员工管理端服务恢复安全壳预览

qimingclaw/crates/agent-electron-client/scripts/check-digital-employee.js

@@ -2231,20 +2231,33 @@ function checkDigitalAdminServiceOperationsWorkbench() {
     [dto, "restart_record_id", "backend service restart record row field"],
     [dto, "recovery_policy_id", "backend service recovery policy row field"],
     [dto, "auto_recovery_status", "backend auto recovery status row field"],
+    [dto, "service_start_disabled", "backend service start disabled row field"],
+    [dto, "service_stop_disabled", "backend service stop disabled row field"],
+    [dto, "lease_takeover_disabled", "backend lease takeover disabled row field"],
+    [dto, "auto_recovery_disabled", "backend auto recovery disabled row field"],
+    [dto, "recovery_action_request_id", "backend recovery action request row field"],
     [test, "queryAdminWorkbenchServiceOperationsReturnsServiceHealthAndRestartRowsOnly", "backend service operations test"],
     [test, "queryAdminWorkbenchServiceOperationsReturnsLeaseRestartAndRecoveryRowsOnly", "backend service recovery operations test"],
+    [test, "queryAdminWorkbenchServiceOperationsReturnsSafetyShellFields", "backend service recovery safety shell test"],
     [qimingTypes, "service_operations", "qiming service operations view type"],
     [qimingTypes, "service_id", "qiming service id field"],
     [qimingTypes, "service_lease_id", "qiming service lease id field"],
     [qimingTypes, "restart_record_id", "qiming restart record id field"],
     [qimingTypes, "recovery_policy_id", "qiming recovery policy id field"],
     [qimingTypes, "auto_recovery_status", "qiming auto recovery status field"],
+    [qimingTypes, "service_start_disabled", "qiming service start disabled field"],
+    [qimingTypes, "service_stop_disabled", "qiming service stop disabled field"],
+    [qimingTypes, "lease_takeover_disabled", "qiming lease takeover disabled field"],
+    [qimingTypes, "auto_recovery_disabled", "qiming auto recovery disabled field"],
+    [qimingTypes, "recovery_action_request_id", "qiming recovery action request field"],
     [qimingOps, "服务运营", "qiming service operations tab"],
     [qimingOps, "只记录复核/忽略意图", "qiming service operations safety copy"],
     [qimingOps, "不开放 start/stop", "qiming service start stop guard copy"],
     [qimingOps, "不接管 lease", "qiming service lease takeover guard copy"],
     [qimingOps, "不自动恢复服务", "qiming service auto recovery guard copy"],
+    [qimingOps, "恢复请求", "qiming service recovery request copy"],
     [docs, "正式管理端服务恢复运营预览", "docs service recovery absorption"],
+    [docs, "恢复请求状态", "docs service recovery request absorption"],
   ];
   const missing = requiredSnippets
     .filter(([content, snippet]) => !content.includes(snippet))

qimingclaw/docs/digital-employee-frontend-integration-plan.md

@@ -573,7 +573,7 @@ GET /api/digital-employee/approvals
    - 建议：下一轮围绕正式管理端治理策略和 ACP 硬中断安全设计，把本地治理审计推进到完整跨端裁决与执行控制。
 
 5. **ManagedService 控制面**
-   - 已吸收：Agent、MCP、Computer Server、Lanproxy、File Server、GUI Server 状态已进入 snapshot / projection；File Server 与 GUI Server 已开放白名单式 restart bridge，并会写入 `managed_service_restart` / `managed_service_restart_rejected` 事件，安全服务 restart bridge 已开始闭环。完整人机介入入口已开始吸收，embedded 新增“处置台”聚合服务异常、诊断风险、审计风险和策略拉取错误，支持批量标记已看、忽略、策略重拉和白名单服务安全重启。正式外部管理端服务运营台预览已开始吸收，qiming-backend 新增 `service_operations` 运营台视图聚合 managed service 快照、服务诊断和重启审计，qiming“数字员工运营台”新增“服务运营” tab，并只开放复核/忽略等低风险动作意图，不开放 start/stop。正式管理端服务恢复运营预览已开始吸收，`service_operations` 继续聚合 service lease、restart record、recovery policy 和 doctor service issue，qiming 详情可展示 lease holder/到期时间、重启次数/最近重启、恢复策略和自动恢复状态，并明确不接管 lease、不自动恢复服务。
+   - 已吸收：Agent、MCP、Computer Server、Lanproxy、File Server、GUI Server 状态已进入 snapshot / projection；File Server 与 GUI Server 已开放白名单式 restart bridge，并会写入 `managed_service_restart` / `managed_service_restart_rejected` 事件，安全服务 restart bridge 已开始闭环。完整人机介入入口已开始吸收，embedded 新增“处置台”聚合服务异常、诊断风险、审计风险和策略拉取错误，支持批量标记已看、忽略、策略重拉和白名单服务安全重启。正式外部管理端服务运营台预览已开始吸收，qiming-backend 新增 `service_operations` 运营台视图聚合 managed service 快照、服务诊断和重启审计，qiming“数字员工运营台”新增“服务运营” tab，并只开放复核/忽略等低风险动作意图，不开放 start/stop。正式管理端服务恢复运营预览已开始吸收，`service_operations` 继续聚合 service lease、restart record、recovery policy 和 doctor service issue，qiming 详情可展示 lease holder/到期时间、重启次数/最近重启、恢复策略和自动恢复状态，并明确不接管 lease、不自动恢复服务。服务恢复安全壳预览已开始吸收，`service_operations` 会展示服务启动/停止禁用、lease 接管禁用、自动恢复执行禁用和恢复请求状态，管理端动作记录会对 `start_service`、`stop_service`、`lease_takeover` 和 `execute_auto_recovery` 返回明确禁用 reason，不进入客户端待执行队列。
    - 缺口：仍缺少真实 start / stop、lease 接管执行、自动恢复执行和完整外部管理端服务运营台；Agent、MCP、Computer Server、Lanproxy 等高风险服务不暴露数字员工重启动作。
    - 建议：先沉淀安全重启审计和人工确认体验，再评估更细粒度的服务恢复策略。