import fs from "node:fs";
import { execFileSync } from "node:child_process";
import { createHash } from "node:crypto";
import http from "node:http";
import path from "node:path";
import { fileURLToPath, pathToFileURL } from "node:url";

import { gateSummary } from "../../web/hwlab-cloud-web/gate-summary.mjs";
import { runtime } from "../../web/hwlab-cloud-web/runtime.mjs";
import {
  classifyCodeAgentBrowserJourney,
  classifyCodeAgentBrowserFailure,
  summarizeCodeAgentPayload
} from "./code-agent-response-contract.mjs";

export { classifyCodeAgentBrowserJourney };

const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
const webRoot = path.join(repoRoot, "web/hwlab-cloud-web");
const defaultLiveUrl = "http://74.48.78.17:16666/";
const helpOwner = "codex_1779444232735_1";
const legacyFailureWindowMs = 4500;
const codeAgentLongTimeoutMs = 150000;
const localAgentFixtureDelayMs = 5200;
const codeAgentE2ePrompts = Object.freeze([
  {
    id: "simple-chinese",
    label: "简单中文提示",
    text: "请用一句话说明当前 HWLAB 工作台可以做什么。"
  },
  {
    id: "list-skills",
    label: "列出技能提示",
    text: "列出你能使用的所有skill"
  }
]);

const readOnlyRpcMethods = Object.freeze([
  "system.health",
  "cloud.adapter.describe",
  "audit.event.query",
  "evidence.record.query"
]);

const requiredWebAssets = Object.freeze([
  "index.html",
  "styles.css",
  "app.mjs",
  "runtime.mjs",
  "gate-summary.mjs",
  "workbench-hardware-panel.mjs",
  "help.md",
  "third_party/marked/marked.esm.js",
  "third_party/marked/LICENSE"
]);

const liveIdentityWebAssets = Object.freeze(["index.html", "styles.css", "app.mjs"]);

const chineseWorkbenchLabels = Object.freeze([
  "HWLAB 云工作台",
  "硬件资源",
  "Agent 对话",
  "工作清单",
  "可信记录",
  "内部复核",
  "使用说明"
]);

const defaultHomepageForbiddenTerms = Object.freeze([
  "Gate",
  "诊断",
  "验收",
  "M0-M5",
  "BLOCKED",
  "SOURCE",
  "DRY-RUN",
  "DEV-LIVE",
  "db-live",
  "m3-hardware-loop-runtime",
  "执行轨迹",
  "runtime_durable_adapter_query_blocked",
  "OPENAI_API_KEY",
  "Secret",
  "secretRef",
  "hwlab-code-agent-provider",
  "m3-route-required",
  "waiting-for-dev-live"
]);

const diagnosticsRequiredTerms = Object.freeze([
  "Gate / 诊断 / 验收",
  "M0-M5",
  "BLOCKED",
  "DB live readiness",
  "patch-panel DO1 -> DI1"
]);

const gateRouteAliases = Object.freeze(["/gate", "/diagnostics/gate"]);
const helpRouteAliases = Object.freeze(["/help"]);

const incompletePrimaryNavLabels = Object.freeze(["台", "证", "诊", "帮"]);

const requiredWiringColumns = Object.freeze([
  "源设备",
  "源端口",
  "接线盘",
  "目标设备",
  "目标端口",
  "状态",
  "证据来源",
  "trace/evidence"
]);

const requiredTrustedRecordTerms = Object.freeze([
  "Code Agent 对话记录",
  "接线/operation",
  "audit 记录",
  "evidence 证据",
  "trace/messageId",
  "audit.event.query + SOURCE 回退",
  "evidence.record.query + SOURCE 回退",
  "conversationId、traceId 和 messageId",
  "provider/model/trace/conversation",
  "失败原因=",
  "只读 audit 缺少 M3 patch-panel live report / operation / trace / evidence 绑定",
  "只读 evidence 缺少 M3 patch-panel live report / operation / trace / audit 绑定",
  "当前显示 SOURCE 回退，不能冒充 DEV-LIVE"
]);

const requiredHardwareStatusTerms = Object.freeze([
  "hardware-source-status",
  "hardwareGroup",
  "hardwareRow",
  "Gateway/Box 在线",
  "BOX-SIMU 端口",
  "Patch Panel 连线",
  "DO1 -> patch-panel -> DI1",
  "AI/AO/FREQ",
  "后续能力",
  "SOURCE",
  "DEV-LIVE",
  "BLOCKED"
]);

const workbenchMarkers = Object.freeze([
  "data-app-shell",
  "workbench-shell",
  "activity-rail",
  "explorer",
  "resource-tree",
  "center-workspace",
  "conversation-list",
  "agent-chat-status",
  "task-list",
  "right-sidebar",
  "hardware-list",
  "command-form"
]);

const requiredCodeAgentEvidenceTerms = Object.freeze([
  "provider",
  "model",
  "backend",
  "conversation",
  "trace",
  "message",
  "providerTrace",
  "openai-responses",
  "codex-cli",
  "echo/mock/stub",
  "untrusted_completion",
  "SOURCE fixture",
  "Code Agent SOURCE 回复",
  "message-evidence-chip"
]);

const blockedCodeAgentUiLabels = Object.freeze(["服务受阻", "BLOCKED 凭证缺口"]);

const forbiddenWritePatterns = Object.freeze([
  /callRpc\(\s*["']hardware\./u,
  /hardware\.operation\.request/u,
  /hardware\.invoke\.shell/u,
  /audit\.event\.write/u,
  /evidence\.record\.write/u,
  /\/v1\/rpc\//u,
  /\/wiring\/apply/u,
  /\/wiring\/reload/u,
  /--live --confirm-dev --confirmed-non-production/u
]);

const markdownRendererPackages = Object.freeze([
  "marked",
  "markdown-it",
  "micromark",
  "remark",
  "remark-parse",
  "unified",
  "commonmark"
]);

const playwrightDependencyCommand = "npm install";
const playwrightDependencySummary =
  "Install repository dependencies before running browser smokes: npm install provides the declared playwright package; the Code Queue image may also provide the same package globally.";

export function runDevCloudWorkbenchStaticSmoke() {
  return runStaticSmoke();
}

export async function runDevCloudWorkbenchTimeoutFixtureSmoke(options = {}) {
  return runLocalAgentFixtureSmoke({
    mode: "local-agent-timeout-fixture-browser",
    responseDelayMs: options.responseDelayMs ?? 120,
    timeoutConfigMs: options.timeoutConfigMs ?? 50,
    expectTimeout: true
  });
}

export async function runDevCloudWorkbenchSmoke(argv = []) {
  const args = parseSmokeArgs(argv);
  if (args.mode === "live") return runLiveSmoke(args);
  if (args.mode === "local-agent-timeout-fixture") return runDevCloudWorkbenchTimeoutFixtureSmoke();
  if (args.mode === "local-agent-fixture") return runDevCloudWorkbenchLocalAgentFixtureSmoke();
  if (args.mode === "mobile") return runDevCloudWorkbenchMobileSmoke();
  return runStaticSmoke();
}

async function importPlaywright() {
  try {
    return normalizePlaywrightModule(await import("playwright"));
  } catch (localError) {
    const globalRoot = npmGlobalRoot();
    if (globalRoot) {
      try {
        return normalizePlaywrightModule(await import(pathToFileURL(path.join(globalRoot, "playwright/index.js")).href));
      } catch {
        // Fall through to the original local resolution error so the remediation points at package.json.
      }
    }
    throw localError;
  }
}

function normalizePlaywrightModule(module) {
  if (module?.chromium) return module;
  if (module?.default?.chromium) return module.default;
  return module;
}

function npmGlobalRoot() {
  try {
    return execFileSync("npm", ["root", "-g"], {
      encoding: "utf8",
      stdio: ["ignore", "pipe", "ignore"],
      timeout: 5000
    }).trim();
  } catch {
    return "";
  }
}

export function parseSmokeArgs(argv) {
  const args = { mode: "source", url: defaultLiveUrl, confirmDevLive: false };
  for (let index = 0; index < argv.length; index += 1) {
    const arg = argv[index];
    if (arg === "--source" || arg === "--static") {
      args.mode = "source";
    } else if (arg === "--live") {
      args.mode = "live";
    } else if (arg === "--confirm-dev-live") {
      args.confirmDevLive = true;
    } else if (arg === "--mobile") {
      args.mode = "mobile";
      args.mobile = true;
    } else if (arg === "--local-agent-fixture") {
      args.mode = "local-agent-fixture";
    } else if (arg === "--local-agent-timeout-fixture") {
      args.mode = "local-agent-timeout-fixture";
    } else if (arg === "--url") {
      index += 1;
      if (!argv[index]) throw new Error("--url requires a value");
      args.url = argv[index];
    } else if (arg === "--report") {
      index += 1;
      if (!argv[index]) throw new Error("--report requires a value");
      args.reportPath = argv[index];
    } else if (arg === "--help") {
      args.help = true;
    } else {
      throw new Error(`unknown argument ${arg}`);
    }
  }
  if (args.mode === "live" && !args.confirmDevLive) {
    throw new Error("DEV-LIVE mode requires explicit --live --confirm-dev-live; default/source mode never calls the live provider.");
  }
  return args;
}

function runStaticSmoke() {
  const checks = [];
  const blockers = [];
  const files = readStaticFiles();
  const source = Object.values(files).join("\n");
  const artifactPublisher = readText("scripts/dev-artifact-publish.mjs");
  const buildScript = readText("web/hwlab-cloud-web/scripts/build.mjs");
  const distContractScript = readText("web/hwlab-cloud-web/scripts/dist-contract.mjs");

  addCheck(checks, blockers, "static-web-assets", assetsExist(), "Cloud Web source assets are present.", {
    evidence: requiredWebAssets.map((file) => `web/hwlab-cloud-web/${file}`)
  });

  addCheck(checks, blockers, "default-workbench-shell", hasDefaultWorkbench(files), "Default route is the VS Code-style Cloud Workbench.", {
    blocker: "runtime_blocker",
    evidence: ["workspace view is visible by default", "Gate view is hidden by default", ...workbenchMarkers]
  });

  addCheck(checks, blockers, "secondary-gate-status-help", secondaryViewsAreNotDefault(files), "Gate/status/diagnostics/help surfaces are not accepted as the default homepage.", {
    blocker: "runtime_blocker",
    evidence: ["routeFromLocation final fallback is workspace", "non-workspace data-view sections must be hidden"]
  });

  addCheck(checks, blockers, "chinese-workbench-labels", labelsPresent(source, chineseWorkbenchLabels), "Current Chinese workbench labels are present.", {
    blocker: "contract_blocker",
    evidence: chineseWorkbenchLabels
  });

  addCheck(checks, blockers, "feedback-117-default-no-backstage", defaultHomepageHidesBackstage(files), "Default workbench hides Gate, diagnostics, acceptance, BLOCKED, and M0-M5 backstage information.", {
    blocker: "runtime_blocker",
    evidence: defaultHomepageForbiddenTerms
  });

  addCheck(checks, blockers, "feedback-118-complete-nav", hasCompletePrimaryNavigation(files.html), "Primary navigation uses complete Chinese labels and removes the left-rail trusted-records shortcut.", {
    blocker: "contract_blocker",
    evidence: ["工作台", "内部复核", "使用说明", "资源树"]
  });

  addCheck(checks, blockers, "feedback-119-gate-retains-diagnostics", gateRetainsDiagnostics(files.html, files.app), "Internal Gate page retains BLOCKED/M0-M5 diagnostics and the DB live plus patch-panel DO1 -> DI1 unblock path.", {
    blocker: "contract_blocker",
    evidence: diagnosticsRequiredTerms
  });

  addCheck(checks, blockers, "internal-gate-route-aliases", gateRouteAliasesAreServed(files.app, artifactPublisher, buildScript, distContractScript), "/gate and /diagnostics/gate are direct internal diagnostic aliases, not default routes.", {
    blocker: "runtime_blocker",
    evidence: gateRouteAliases
  });

  addCheck(checks, blockers, "direct-help-route-alias", helpRouteAliasesAreServed(files.app, artifactPublisher, buildScript, distContractScript), "/help is a direct user-facing help alias and does not become the default route.", {
    blocker: "runtime_blocker",
    evidence: [...helpRouteAliases, "routeFromLocation final fallback is workspace"]
  });

  addCheck(checks, blockers, "feedback-120-wiring-table", wiringTableContract(files.html), "Patch-panel wiring panel is a table with source, target, status, evidence source, and trace/evidence columns.", {
    blocker: "contract_blocker",
    evidence: requiredWiringColumns
  });

  addCheck(checks, blockers, "trusted-record-groups", trustedRecordGroups(files), "Trusted Records panel groups Code Agent, wiring/operation, audit, and evidence summaries with source labels and live-failure fallback.", {
    blocker: "observability_blocker",
    evidence: requiredTrustedRecordTerms
  });

  addCheck(checks, blockers, "hardware-status-rich-structure", hardwareStatusStructureContract(files), "Right hardware status renders Gateway/Box, DI/DO/AI/AO/FREQ, patch-panel, and DO1 -> DI1 source-labeled link state.", {
    blocker: "contract_blocker",
    evidence: requiredHardwareStatusTerms
  });

  addCheck(checks, blockers, "m3-default-wiring-source", defaultTopologyIsM3Only(), "Default 16666 workbench topology exposes only the M3 res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1 wiring.", {
    blocker: "runtime_blocker",
    evidence: ["res_boxsimu_1:DO1", "hwlab-patch-panel", "res_boxsimu_2:DI1"]
  });

  addCheck(checks, blockers, "outer-scroll-contract", hasScrollLockContract(files.styles), "Outer page scrolling is locked and internal workbench panes own scrolling.", {
    blocker: "contract_blocker",
    evidence: ["html/body overflow hidden", "workbench-shell 100vh/100dvh overflow hidden", ".view overflow auto"]
  });

  addCheck(checks, blockers, "mobile-workbench-layout-contract", hasMobileWorkbenchLayoutContract(files), "390x844 mobile layout keeps the default workbench reachable and moves the resource tree into a controlled drawer.", {
    blocker: "runtime_blocker",
    evidence: [
      "syncMobileExplorer collapses resource tree at <=860px",
      "mobile rail spans full height",
      "center workspace and right sidebar share the content column",
      "resource explorer opens as a full-height drawer"
    ]
  });

  addCheck(checks, blockers, "same-origin-readonly-boundary", hasSameOriginReadOnlyBoundary(files.app), "Workbench data access stays same-origin and JSON-RPC diagnostics stay read-only.", {
    blocker: "safety_blocker",
    evidence: ["/health/live", "/v1", "/v1/agent/chat", "/json-rpc", ...readOnlyRpcMethods]
  });

  addCheck(checks, blockers, "api-degraded-default-status", hasApiDegradedDefaultStatus(files), "Default workbench status distinguishes reachable degraded API from fully OK without exposing backend blocker details.", {
    blocker: "observability_blocker",
    evidence: ["healthLive.data.status === degraded", "ready false", "runtime_durable_adapter_query_blocked", "API 降级 / 只读模式", "可信记录受阻 / 只读模式", "no Gate/diagnostics/blocker copy in default status classifier"]
  });

  addCheck(checks, blockers, "code-agent-chat-primary-flow", hasCodeAgentChatContract(files), "Center Agent conversation sends to the controlled Code Agent chat endpoint and no longer uses 添加草稿 as the primary flow.", {
    blocker: "runtime_blocker",
    evidence: ["command-send", "agent-chat-status", "/v1/agent/chat", "conversationId/messageId/status/timestamps/error.message"]
  });

  addCheck(checks, blockers, "code-agent-long-timeout-contract", hasCodeAgentLongTimeoutContract(files.app), "Code Agent chat uses a dedicated long timeout and does not reuse the old 4500ms API timeout.", {
    blocker: "runtime_blocker",
    evidence: ["DEFAULT_API_TIMEOUT_MS=4500 for light probes", `DEFAULT_CODE_AGENT_TIMEOUT_MS=${codeAgentLongTimeoutMs}`, "sendAgentMessage passes timeoutMs"]
  });

  addCheck(checks, blockers, "code-agent-provider-readiness-visibility", hasCodeAgentReadinessVisibility(files), "Workbench shows provider blockers without exposing credential internals and only real completed replies can become DEV-LIVE.", {
    blocker: "observability_blocker",
    evidence: ["服务受阻 or legacy BLOCKED 凭证缺口", "provider_unavailable classifier", "completed -> dev-live guard", "default workspace hides credential internals"]
  });

  addCheck(checks, blockers, "default-workspace-sanitized", defaultWorkspaceIsSanitized(files), "Default user workspace hides raw blocker codes, internal route markers, and credential reference material.", {
    blocker: "observability_blocker",
    evidence: defaultHomepageForbiddenTerms
  });

  addCheck(checks, blockers, "route-control-stable-dimensions", hasStableRouteControls(files), "Route controls and status tags have stable dimensions, readable wrapping, and usable labels on small screens.", {
    blocker: "runtime_blocker",
    evidence: ["rail-button min-width/min-height", "state-tag wrapping", "side-tab stable labels", "mobile message evidence column"]
  });

  addCheck(checks, blockers, "code-agent-completed-evidence-visible", hasCodeAgentCompletedEvidenceVisibility(files), "Completed Code Agent replies expose provider/model/trace/conversation evidence and reject echo/mock/stub completions.", {
    blocker: "observability_blocker",
    evidence: requiredCodeAgentEvidenceTerms
  });

  addCheck(checks, blockers, "code-agent-conversation-ux-states", hasCodeAgentConversationUxStates(files), "Code Agent thread renders trusted completed, SOURCE fixture, failed, and blocked provider states as distinct conversation replies with bounded evidence.", {
    blocker: "observability_blocker",
    evidence: [
      "DEV-LIVE 回复",
      "SOURCE 回复",
      "发送失败",
      "服务受阻 or legacy BLOCKED 凭证缺口",
      "message-evidence/details/chips"
    ]
  });

  addCheck(checks, blockers, "no-hardware-write-api", noForbiddenWriteSurface(source), "Workbench source does not expose hardware write APIs or live mutation commands.", {
    blocker: "safety_blocker",
    evidence: forbiddenWritePatterns.map(String)
  });

  addCheck(checks, blockers, "source-not-dev-live", sourceEvidenceNotDevLive(source), "SOURCE/LOCAL/DRY-RUN/fixture evidence is not promoted to DEV-LIVE.", {
    blocker: "observability_blocker",
    evidence: ["M3 remains blocked without live loop evidence", "checked-in evidence records remain dry-run"]
  });

  addCheck(checks, blockers, "m3-fixture-counts-not-dev-live", m3FixtureCountsNotDevLive(files.app), "Fixture/source patch-panel wiring plus generic runtime counts cannot render M3 DEV-LIVE.", {
    blocker: "observability_blocker",
    evidence: [
      "hasTrustedM3LiveEvidence requires patchPanelLiveReport",
      "operationId/traceId/auditId/evidenceId required",
      "runtime counts are SOURCE-only"
    ]
  });

  addCheck(checks, blockers, "m3-rendered-workbench-not-m5-fixture", m3RenderedWorkbenchNotM5Fixture(files.app), "Right workbench hardware status and wiring table render the M3 chain, not M5 fixture rows or undefined DOM-node rows.", {
    blocker: "runtime_blocker",
    evidence: [
      "renderHardwareStatus passes data objects into hardwareGroup",
      "renderWiringList uses M3_TRUSTED_ROUTE",
      "M5 activeConnections are not mapped into the workbench wiring table"
    ]
  });

  const help = inspectHelpContract(files);
  addCheck(checks, blockers, "help-md-contract", help.status, help.summary, {
    blocker: help.blocker,
    owner: helpOwner,
    observations: help.observations
  });

  return baseReport({
    mode: "source",
    status: blockers.length === 0 ? "pass" : "blocked",
    checks,
    blockers,
    evidenceLevel: "SOURCE",
    devLive: false,
    help: {
      status: help.status,
      ...help.observations
    },
    safety: staticSafety()
  });
}

async function runLiveSmoke(args) {
  const checks = [];
  const blockers = [];
  const sourceIdentity = observeSourceIdentity();
  const runtimeIdentity = await observeLiveRuntimeIdentity(runtime.endpoints.api);
  const apiRuntimeReadiness = classifyLiveApiRuntimeReadiness(runtimeIdentity);
  addCheck(checks, blockers, "live-api-runtime-readiness", apiRuntimeReadiness.status, apiRuntimeReadiness.summary, {
    blocker: "runtime_blocker",
    evidence: apiRuntimeReadiness.evidence,
    observations: apiRuntimeReadiness
  });

  const expectedRuntimeIdentity = observeExpectedRuntimeIdentity("hwlab-cloud-api");
  const deploymentIdentity = classifyLiveDeploymentIdentity(sourceIdentity, runtimeIdentity, expectedRuntimeIdentity);
  addCheck(checks, blockers, "live-runtime-current-main", deploymentIdentity.status, deploymentIdentity.summary, {
    blocker: "observability_blocker",
    evidence: deploymentIdentity.evidence,
    observations: deploymentIdentity
  });

  const http = await fetchText(args.url);
  addCheck(checks, blockers, "live-http-html", http.ok && http.status === 200 && /text\/html/u.test(http.contentType) && liveHtmlLooksLikeWorkbench(http.body), "Live URL serves the Cloud Workbench HTML.", {
    blocker: "runtime_blocker",
    evidence: [args.url, `HTTP ${http.status ?? "none"}`, http.contentType ?? "no content-type"]
  });

  const webAssetIdentity = http.ok
    ? await inspectLiveWebAssetIdentity(args.url, http.body)
    : {
        status: "blocked",
        summary: "Live web asset identity could not be checked because the 16666 HTML fetch failed.",
        assets: []
      };
  addCheck(checks, blockers, "live-web-assets-current-main", webAssetIdentity.status, webAssetIdentity.summary, {
    blocker: "observability_blocker",
    evidence: webAssetIdentity.assets.map((asset) => `${asset.path}: ${asset.status}`),
    observations: webAssetIdentity
  });

  const identityBlocked = deploymentIdentity.status !== "pass" || webAssetIdentity.status !== "pass";
  if (identityBlocked) {
    addCheck(
      checks,
      blockers,
      "live-code-agent-browser-journey",
      "blocked",
      "Browser Code Agent journey was not posted because deployed runtime/assets do not match current source identity.",
      {
        blocker: "observability_blocker",
        evidence: [
          "POST /v1/agent/chat not sent",
          `runtimeIdentity=${deploymentIdentity.status}`,
          `webAssetIdentity=${webAssetIdentity.status}`
        ],
        observations: {
          request: {
            method: "POST",
            status: "not_sent",
            urlPath: "/v1/agent/chat"
          },
          response: blockedAgentChatResponse("deployment_identity_preflight"),
          classification: {
            status: "blocked",
            reason: "deployment_identity_preflight",
            codeAgentBrowserJourneySkipped: true
          }
        }
      }
    );
    return baseReport({
      mode: "live",
      url: args.url,
      status: "blocked",
      checks,
      blockers,
      evidenceLevel: "BLOCKED",
      devLive: false,
      runtimeIdentity,
      sourceIdentity,
      deploymentIdentity,
      expectedRuntimeIdentity,
      webAssetIdentity,
      safety: {
        prodTouched: false,
        servicesRestarted: false,
        heavyE2E: false,
        hardwareWriteApis: false,
        sourceIsDevLive: false,
        liveMode: "deployment-identity-preflight",
        liveConfirmed: args.confirmDevLive === true,
        codeAgentBrowserJourneySkipped: true,
        prompts: codeAgentE2ePrompts.map((prompt) => ({ id: prompt.id, label: prompt.label })),
        legacyFailureWindowMs,
        codeAgentTimeoutMs: codeAgentLongTimeoutMs,
        retainedApiFields: ["runtime.commitId", "runtime.imageTag", "web asset hash/status"],
        statement: "Live smoke blocked before the browser chat journey because deployed runtime/assets do not match the current source identity; it did not post Code Agent chat, call hardware write APIs, restart services, or read secret values."
      }
    });
  }

  const dom = http.ok ? await inspectLiveDom(args.url) : { status: "skip", summary: "Browser DOM check skipped because HTTP fetch failed.", evidence: [] };
  addCheck(checks, blockers, "live-browser-dom", dom.status, dom.summary, {
    blocker: dom.status === "pass" ? null : "observability_blocker",
    evidence: dom.evidence,
    observations: dom.observations
  });

  if (dom.status === "skip") {
    blockers.push({
      type: "observability_blocker",
      scope: "live-browser-dom",
      status: "open",
      summary: dom.summary
    });
  }

  const help = http.ok ? await inspectLiveHelpRoute(args.url) : { status: "skip", summary: "Browser Markdown help check skipped because HTTP fetch failed.", evidence: [] };
  addCheck(checks, blockers, "live-help-markdown-route", help.status, help.summary, {
    blocker: help.status === "pass" ? null : "runtime_blocker",
    evidence: help.evidence,
    observations: help.observations
  });

  if (help.status === "skip") {
    blockers.push({
      type: "observability_blocker",
      scope: "live-help-markdown-route",
      status: "open",
      summary: help.summary
    });
  }

  const journey = http.ok ? await inspectLiveCodeAgentE2e(args.url) : { status: "skip", summary: "浏览器 Code Agent E2E 因 HTTP fetch 失败而跳过。", evidence: [] };
  addCheck(checks, blockers, "live-code-agent-browser-journey", journey.status, journey.summary, {
    blocker: ["pass", "degraded"].includes(journey.status) ? null : "runtime_blocker",
    evidence: journey.evidence,
    observations: journey.observations
  });

  if (journey.status === "skip") {
    blockers.push({
      type: "observability_blocker",
      scope: "live-code-agent-browser-journey",
      status: "open",
      summary: journey.summary
    });
  }

  const hasDegradedCheck = checks.some((check) => check.status === "degraded");
  const status = blockers.length === 0
    ? apiRuntimeReadiness.status === "degraded" || hasDegradedCheck ? "degraded" : "pass"
    : "blocked";
  return baseReport({
    mode: "live",
    url: args.url,
    status,
    checks,
    blockers,
    evidenceLevel: status === "pass"
      ? "DEV-LIVE-BROWSER"
      : status === "degraded" ? "DEV-LIVE-BROWSER-DEGRADED" : "BLOCKED",
    devLive: status === "pass",
    runtimeIdentity,
    sourceIdentity,
    deploymentIdentity,
    expectedRuntimeIdentity,
    webAssetIdentity,
    safety: {
      prodTouched: false,
      servicesRestarted: false,
      heavyE2E: false,
      hardwareWriteApis: false,
      sourceIsDevLive: false,
      liveMode: "browser-user-journey-with-code-agent-post",
      liveConfirmed: args.confirmDevLive === true,
      prompts: codeAgentE2ePrompts.map((prompt) => ({ id: prompt.id, label: prompt.label })),
      legacyFailureWindowMs,
      codeAgentTimeoutMs: codeAgentLongTimeoutMs,
      retainedApiFields: ["status", "provider", "model", "backend", "traceId", "hasReply", "error.code", "error.missingEnv", "error.providerStatus"],
      statement: status === "degraded"
        ? "Live smoke records deployed UI usable in degraded/read-only mode only; API health/runtime durability is degraded, so this is not full DEV-LIVE acceptance and must not be used to infer M3/M4/M5 acceptance."
        : "Live smoke opens the deployed workbench and sends two controlled Code Agent messages; it does not call hardware write APIs and must not be used to infer M3 DEV-LIVE hardware-loop acceptance."
    }
  });
}

function baseReport({
  mode,
  status,
  checks,
  blockers,
  evidenceLevel,
  devLive,
  help = undefined,
  safety,
  url = null,
  runtimeIdentity = null,
  sourceIdentity = observeSourceIdentity(),
  deploymentIdentity = null,
  expectedRuntimeIdentity = null,
  webAssetIdentity = null
}) {
  const liveJourneyPassed = mode === "live" && status === "pass";
  const liveJourneyDegraded = mode === "live" && status === "degraded";
  const sourceOnlyMode = mode !== "live";
  return {
    $schema: "https://hwlab.pikastech.local/schemas/dev-gate-report.schema.json",
    $id: "https://hwlab.pikastech.local/reports/dev-gate/dev-cloud-workbench-live.json",
    reportVersion: "v1",
    status,
    issue: "pikasTech/HWLAB#7",
    taskId: "dev-cloud-workbench-live",
    commitId: sourceIdentity.reportCommitId,
    acceptanceLevel: sourceOnlyMode ? "dev_cloud_workbench_source" : "dev_cloud_workbench_live",
    devOnly: true,
    prodDisabled: true,
    reportLifecycle: {
      version: "v1",
      state: "active",
      activeEndpoint: runtime.endpoints.api,
      activeBrowserEndpoint: runtime.endpoints.frontend,
      deprecatedEndpoint: null,
      summary: sourceOnlyMode
        ? "SOURCE-only Workbench contract report; it does not call the live provider and cannot be used as DEV-LIVE evidence."
        : liveJourneyDegraded
          ? "Current deployed browser user journey report for the 16666 Cloud Workbench; deployed UI usable in degraded/read-only mode and does not substitute for M3/M4/M5 DEV-LIVE acceptance."
          : "Current deployed browser user journey report for the 16666 Cloud Workbench; it does not substitute for M3/M4/M5 hardware acceptance."
    },
    task: "DC-DCSN-P0-2026-003",
    refs: [
      "pikasTech/HWLAB#7",
      "pikasTech/HWLAB#108",
      "pikasTech/HWLAB#99",
      "pikasTech/HWLAB#78",
      "pikasTech/HWLAB#117",
      "pikasTech/HWLAB#118",
      "pikasTech/HWLAB#119",
      "pikasTech/HWLAB#120",
      "pikasTech/HWLAB#131",
      "pikasTech/HWLAB#143",
      "pikasTech/HWLAB#164",
      "pikasTech/HWLAB#224"
    ],
    mode,
    url,
    generatedAt: new Date().toISOString(),
    evidenceLevel,
    devLive,
    sourceIdentity,
    runtimeIdentity: runtimeIdentity ?? notObservedRuntimeIdentity("live runtime identity was not observed in this smoke mode"),
    ...(expectedRuntimeIdentity ? { expectedRuntimeIdentity } : {}),
    ...(deploymentIdentity ? { deploymentIdentity } : {}),
    ...(webAssetIdentity ? { webAssetIdentity } : {}),
    sourceContract: {
      status: "pass",
      documents: [
        "docs/cloud-web-workbench.md",
        "docs/reference/cloud-workbench.md",
        "docs/reference/code-agent-chat-readiness.md"
      ],
      summary: sourceOnlyMode
        ? "SOURCE mode verifies repository Workbench and Code Agent readiness contracts without calling the live provider."
        : "The deployed browser journey is anchored to the Cloud Workbench and Code Agent readiness contracts."
    },
    validationCommands: [
      "node --check scripts/dev-cloud-workbench-smoke.mjs",
      "node --check scripts/src/dev-cloud-workbench-smoke-lib.mjs",
      "node scripts/dev-cloud-workbench-smoke.mjs --source",
      "node scripts/dev-cloud-workbench-smoke.mjs --mobile",
      "node scripts/dev-cloud-workbench-smoke.mjs --local-agent-fixture",
      "node scripts/dev-cloud-workbench-smoke.mjs --local-agent-timeout-fixture",
      "node scripts/dev-cloud-workbench-smoke.mjs --live --confirm-dev-live --url http://74.48.78.17:16666/ --report reports/dev-gate/dev-cloud-workbench-live.json",
      "node scripts/validate-dev-gate-report.mjs reports/dev-gate/dev-cloud-workbench-live.json",
      "node scripts/validate-dev-gate-report.mjs"
    ],
    localSmoke: {
      status: mode === "source" ? status : "not_run",
      commands: [
        "node scripts/dev-cloud-workbench-smoke.mjs --source",
        "node scripts/dev-cloud-workbench-smoke.mjs --mobile",
        "node scripts/dev-cloud-workbench-smoke.mjs --local-agent-fixture",
        "node scripts/dev-cloud-workbench-smoke.mjs --local-agent-timeout-fixture"
      ],
      evidence: ["Source mode verifies the source contract and same-origin Code Agent wiring only.", "Mobile browser mode verifies the 390x844 outer-scroll lock and help route at SOURCE level.", "Local fixture browser mode verifies both Code Agent prompts past the old 4500ms window at SOURCE level.", "Local timeout fixture verifies bounded timeout UI classification without live acceptance."],
      summary: "Source, mobile, and local fixture workbench smokes are SOURCE-level evidence and do not prove the deployed browser journey."
    },
    dryRun: {
      status: "not_applicable",
      commands: ["node scripts/dev-cloud-workbench-smoke.mjs --source"],
      evidence: ["No dry-run substitute is accepted for the deployed browser journey."],
      summary: "The journey evidence is collected from the real DEV browser endpoint, not a dry-run fixture."
    },
    devPreconditions: {
      status: liveJourneyPassed ? "pass" : liveJourneyDegraded ? "degraded" : "blocked",
      requirements: [
        "GET http://74.48.78.17:16666/ serves the Cloud Workbench HTML.",
        "Browser DOM exposes the default workbench and core controls.",
        "A controlled same-origin POST /v1/agent/chat returns completed UI-visible evidence or reports a blocker.",
        "No hardware write API, service restart, PROD access, or secret read is performed."
      ],
      commands: [
        "node scripts/dev-cloud-workbench-smoke.mjs --live --confirm-dev-live --url http://74.48.78.17:16666/ --report reports/dev-gate/dev-cloud-workbench-live.json"
      ],
      summary: liveJourneyPassed
        ? "Deployed 16666 browser journey and same-origin Code Agent chat completed."
        : liveJourneyDegraded
          ? "Deployed UI usable in degraded/read-only mode; API health/runtime durability is degraded, so this is not full DEV-LIVE acceptance."
        : mode === "live"
          ? "Deployed browser journey is blocked; see checks and blockers."
          : "Static/local fixture evidence does not establish the deployed 16666 browser journey."
    },
    endpoints: {
      frontend: runtime.endpoints.frontend,
      api: runtime.endpoints.api,
      edge: runtime.endpoints.edge
    },
    checks,
    blockers,
    help,
    safety
  };
}

function addCheck(checks, blockers, id, result, summary, options = {}) {
  const status = result === true ? "pass" : result === false ? "blocked" : result;
  const check = {
    id,
    status,
    summary,
    ...(options.owner ? { owner: options.owner } : {}),
    ...(options.evidence ? { evidence: options.evidence } : {}),
    ...(options.observations ? { observations: options.observations } : {})
  };
  checks.push(check);
  if (status === "blocked" && options.blocker) {
    blockers.push({
      type: options.blocker,
      scope: id,
      status: "open",
      summary
    });
  }
  return check;
}

function readStaticFiles() {
  return {
    html: readText("web/hwlab-cloud-web/index.html"),
    styles: readText("web/hwlab-cloud-web/styles.css"),
    app: readText("web/hwlab-cloud-web/app.mjs"),
    runtime: readText("web/hwlab-cloud-web/runtime.mjs"),
    panel: readText("web/hwlab-cloud-web/workbench-hardware-panel.mjs")
  };
}

function readText(relativePath) {
  return fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
}

function observeSourceIdentity() {
  const head = runGit(["rev-parse", "--verify", "HEAD"]);
  const shortHead = head ? runGit(["rev-parse", "--short=12", "HEAD"]) : null;
  const ref = runGit(["rev-parse", "--abbrev-ref", "HEAD"]) ?? process.env.GITHUB_HEAD_REF ?? process.env.GITHUB_REF_NAME ?? "unknown";
  const statusOutput = runGit(["status", "--porcelain"]);
  const envIdentity = head ? null : environmentCommitIdentity();
  const commitId = head ?? envIdentity?.commitId ?? "unknown";
  const shortCommitId = shortHead ?? envIdentity?.commitId.slice(0, 12) ?? "unknown";
  const dirty = statusOutput === null ? null : statusOutput.length > 0;
  const worktreeState = dirty === null ? "unknown" : dirty ? "dirty" : "clean";
  const source = head ? "git-head" : envIdentity ? "environment" : "unknown";
  const reportCommitId = commitId !== "unknown" && worktreeState === "clean" ? shortCommitId : "unknown";

  return {
    status: commitId === "unknown" ? "unknown" : "observed",
    source,
    ...(envIdentity ? { environmentKey: envIdentity.key } : {}),
    commitId,
    shortCommitId,
    ref,
    worktreeState,
    dirty,
    reportCommitId,
    summary: worktreeState !== "clean"
      ? "Source HEAD was observed, but the worktree was not cleanly attributable when the report was generated; top-level commitId is unknown rather than pretending to identify uncommitted source."
      : "Source identity was derived from the current worktree or source environment and is separate from the live runtime identity."
  };
}

function environmentCommitIdentity() {
  for (const key of [
    "GITHUB_SHA",
    "CI_COMMIT_SHA",
    "BUILDKITE_COMMIT",
    "CODEBUILD_RESOLVED_SOURCE_VERSION",
    "SOURCE_COMMIT",
    "HWLAB_SOURCE_COMMIT_ID"
  ]) {
    const value = process.env[key];
    if (typeof value === "string" && /^[a-f0-9]{7,40}$/iu.test(value.trim())) {
      return { key, commitId: value.trim().toLowerCase() };
    }
  }
  return null;
}

function runGit(args) {
  try {
    return execFileSync("git", args, {
      cwd: repoRoot,
      encoding: "utf8",
      stdio: ["ignore", "pipe", "ignore"],
      timeout: 5000
    }).trim();
  } catch {
    return null;
  }
}

export function classifyLiveDeploymentIdentity(sourceIdentity, runtimeIdentity, expectedRuntimeIdentity = null) {
  const expectedCommit = sanitizeRevision(expectedRuntimeIdentity?.commitId ?? sourceIdentity?.commitId);
  const expectedShort = expectedCommit === "unknown" ? "unknown" : expectedCommit.slice(0, 7);
  const expectedReport = sourceIdentity?.reportCommitId ?? "unknown";
  const expectedImageTag = sanitizeRuntimeString(expectedRuntimeIdentity?.imageTag ?? expectedShort).toLowerCase();
  const observedRuntimeCommit = sanitizeRevision(runtimeIdentity?.commitId);
  const observedImageTag = sanitizeRuntimeString(runtimeIdentity?.imageTag).toLowerCase();
  const runtimeObserved = runtimeIdentity?.status === "observed";
  const expectedObserved = expectedRuntimeIdentity === null || expectedRuntimeIdentity?.status === "observed";
  const sourceClean =
    sourceIdentity?.status === "observed" &&
    sourceIdentity?.worktreeState === "clean" &&
    expectedReport !== "unknown";
  const accepted = new Set([...commitIdentityVariants(expectedCommit), ...commitIdentityVariants(expectedImageTag)]);
  const runtimeMatches =
    runtimeObserved &&
    sourceClean &&
    expectedObserved &&
    expectedCommit !== "unknown" &&
    (identityVariantMatches(accepted, observedRuntimeCommit) || identityVariantMatches(accepted, observedImageTag));

  if (runtimeMatches) {
    return {
      status: "pass",
      expectedCommit,
      expectedReportCommitId: expectedReport,
      expectedImageTag,
      expectedSource: expectedRuntimeIdentity?.source ?? "source-git-head",
      observedRuntimeCommit,
      observedImageTag,
      evidence: [
        `expected=${expectedShort}`,
        `expectedImageTag=${expectedImageTag}`,
        `runtimeCommit=${observedRuntimeCommit}`,
        `imageTag=${observedImageTag}`
      ],
      summary: "Live API runtime identity matches the current source desired runtime identity."
    };
  }

  const reason = !sourceClean
    ? "current source identity is not cleanly attributable"
    : !expectedObserved || expectedCommit === "unknown"
      ? "source desired runtime identity was not observed"
    : !runtimeObserved
      ? "live API runtime identity was not observed"
      : "live API runtime commit/image tag does not match current source desired runtime identity";
  return {
    status: "blocked",
    expectedCommit,
    expectedReportCommitId: expectedReport,
    expectedImageTag,
    expectedSource: expectedRuntimeIdentity?.source ?? "source-git-head",
    observedRuntimeCommit,
    observedImageTag,
    reason,
    evidence: [
      `expected=${expectedShort}`,
      `expectedImageTag=${expectedImageTag}`,
      `runtimeCommit=${observedRuntimeCommit}`,
      `imageTag=${observedImageTag}`
    ],
    summary: `Deployment drift: ${reason}.`
  };
}

function observeExpectedRuntimeIdentity(serviceId) {
  const deploy = readJsonOrNull("deploy/deploy.json");
  const catalog = readJsonOrNull("deploy/artifact-catalog.dev.json");
  const deployService = Array.isArray(deploy?.services)
    ? deploy.services.find((service) => service?.serviceId === serviceId)
    : null;
  const catalogService = Array.isArray(catalog?.services)
    ? catalog.services.find((service) => service?.serviceId === serviceId)
    : null;
  const image = sanitizeRuntimeString(catalogService?.image ?? deployService?.image);
  const imageTag = sanitizeRuntimeString(catalogService?.imageTag ?? deployService?.env?.HWLAB_IMAGE_TAG ?? imageTagFromImage(image));
  const commitId = sanitizeRevision(catalogService?.commitId ?? deployService?.env?.HWLAB_COMMIT_ID ?? deploy?.commitId ?? catalog?.commitId ?? imageTag);
  const sources = [];
  if (catalogService) sources.push("deploy/artifact-catalog.dev.json");
  if (deployService || deploy?.commitId) sources.push("deploy/deploy.json");
  const observed = commitId !== "unknown" || imageTag !== "unknown";
  return {
    status: observed ? "observed" : "not_observed",
    serviceId,
    source: sources.length > 0 ? sources.join("+") : "not_observed",
    commitId,
    imageTag,
    image,
    summary: observed
      ? "Expected DEV runtime identity was derived from current source deploy desired state, not from live health."
      : "Expected DEV runtime identity was not found in current source deploy desired state."
  };
}

function readJsonOrNull(relativePath) {
  try {
    return JSON.parse(readText(relativePath));
  } catch {
    return null;
  }
}

function imageTagFromImage(image) {
  if (typeof image !== "string") return "unknown";
  const match = image.match(/:([^:/]+)$/u);
  return match?.[1] ?? "unknown";
}

function commitIdentityVariants(commitId) {
  if (typeof commitId !== "string" || !/^[a-f0-9]{7,40}$/u.test(commitId)) return new Set();
  return new Set([commitId, commitId.slice(0, 12), commitId.slice(0, 7)]);
}

function identityVariantMatches(accepted, observed) {
  if (typeof observed !== "string" || observed === "unknown" || observed === "not_observed") return false;
  if (accepted.has(observed)) return true;
  return [...accepted].some((expected) => expected.length >= 7 && observed.startsWith(expected));
}

async function inspectLiveWebAssetIdentity(baseUrl, fetchedIndexHtml) {
  const assets = [];
  for (const assetPath of liveIdentityWebAssets) {
    const sourceText = readText(`web/hwlab-cloud-web/${assetPath}`);
    const live = assetPath === "index.html"
      ? { ok: true, status: 200, contentType: "text/html; charset=utf-8", body: fetchedIndexHtml }
      : await fetchText(new URL(assetPath, baseUrl).toString());
    assets.push(compareLiveAsset(assetPath, live, sourceText));
  }
  return classifyLiveWebAssetIdentity(assets);
}

export function classifyLiveWebAssetIdentity(assets) {
  const mismatches = assets.filter((asset) => asset.status !== "match");
  return {
    status: mismatches.length === 0 ? "pass" : "blocked",
    assets,
    mismatches: mismatches.map((asset) => asset.path),
    summary: mismatches.length === 0
      ? "Live 16666 primary web assets match the current clean source files."
      : `Deployment drift: live 16666 primary web assets differ from current source (${mismatches.map((asset) => asset.path).join(", ")}).`
  };
}

function compareLiveAsset(assetPath, live, sourceText) {
  const liveText = typeof live?.body === "string" ? live.body : "";
  const sourceHash = hashText(sourceText);
  const liveHash = hashText(liveText);
  const fetched = live?.ok === true && live?.status === 200;
  const matches = fetched && liveText === sourceText;
  return {
    path: assetPath,
    status: matches ? "match" : fetched ? "mismatch" : "fetch_failed",
    httpStatus: live?.status ?? null,
    contentType: live?.contentType ?? "",
    sourceHash,
    liveHash,
    sourceLength: sourceText.length,
    liveLength: liveText.length
  };
}

function hashText(value) {
  return createHash("sha256").update(value).digest("hex").slice(0, 16);
}

function assetsExist() {
  return requiredWebAssets.every((file) => fs.existsSync(path.join(webRoot, file)));
}

function hasDefaultWorkbench({ html, app }) {
  const workspaceTag = firstTagForDataView(html, "workspace");
  const gateTag = firstTagForDataView(html, "gate");
  return (
    labelsPresent(html, workbenchMarkers) &&
    /<title>\s*HWLAB 云工作台\s*<\/title>/u.test(html) &&
    /data-route=["']workspace["']/u.test(html) &&
    workspaceTag !== null &&
    !/\bhidden\b/u.test(workspaceTag) &&
    gateTag !== null &&
    /\bhidden\b/u.test(gateTag) &&
    finalRouteFallback(app) === "workspace"
  );
}

function secondaryViewsAreNotDefault({ html, app }) {
  const finalFallback = finalRouteFallback(app);
  const unhiddenSecondaryViews = [...html.matchAll(/<section\b[^>]*\bdata-view=["']([^"']+)["'][^>]*>/gu)]
    .filter((match) => match[1] !== "workspace")
    .filter((match) => !/\bhidden\b/u.test(match[0]));
  return finalFallback === "workspace" && unhiddenSecondaryViews.length === 0;
}

function firstTagForDataView(html, view) {
  return html.match(new RegExp(`<section\\b[^>]*\\bdata-view=["']${escapeRegExp(view)}["'][^>]*>`, "u"))?.[0] ?? null;
}

function sectionSource(source, viewId) {
  const start = source.search(new RegExp(`<section\\b[^>]*\\bdata-view=["']${escapeRegExp(viewId)}["'][^>]*>`, "u"));
  if (start === -1) return "";
  const next = source.slice(start + 1).search(/<section\b[^>]*\bdata-view=["'][^"']+["'][^>]*>/u);
  return next === -1 ? source.slice(start) : source.slice(start, start + 1 + next);
}

function beforeSection(source, viewId) {
  const index = source.search(new RegExp(`<section\\b[^>]*\\bdata-view=["']${escapeRegExp(viewId)}["'][^>]*>`, "u"));
  return index === -1 ? source : source.slice(0, index);
}

function defaultHomepageHidesBackstage({ html }) {
  const firstViewportText = visibleTextFromHtml(defaultFirstViewportHtml(html));
  return defaultHomepageForbiddenTerms.every((term) => !textHasForbiddenTerm(firstViewportText, term));
}

function defaultWorkspaceIsSanitized({ html, app }) {
  const defaultShellText = visibleTextFromHtml(defaultFirstViewportHtml(html));
  const userFacingBodies = [
    functionBody(app, "codeAgentStatusMessage"),
    functionBody(app, "codeAgentPromptText"),
    functionBody(app, "codeAgentControlSummary"),
    functionBody(app, "codeAgentBlockedSummary"),
    functionBody(app, "codeAgentAvailabilitySummary"),
    functionBody(app, "failureMessage"),
    functionBody(app, "renderWiringList")
  ].join("\n");
  return (
    defaultHomepageForbiddenTerms.every((term) => !textHasForbiddenTerm(defaultShellText, term)) &&
    !/OPENAI_API_KEY|hwlab-code-agent-provider|Secret|secretRef|m3-route-required|waiting-for-dev-live|BLOCKED 凭证缺口|SOURCE fixture|DEV-LIVE/u.test(userFacingBodies) &&
    /服务受阻/u.test(functionBody(app, "renderAgentChatStatus")) &&
    /Code Agent 服务暂不可用/u.test(functionBody(app, "codeAgentBlockedSummary")) &&
    /等待可信记录/u.test(functionBody(app, "renderWiringList"))
  );
}

function defaultFirstViewportHtml(html) {
  return `${beforeSection(html, "help")}\n${rightSidebarDefaultHtml(html)}`;
}

function rightSidebarDefaultHtml(html) {
  const start = html.search(/<aside\b[^>]*\bclass=["'][^"']*\bright-sidebar\b[^"']*["'][^>]*>/u);
  if (start === -1) return "";
  const wiringStart = html.slice(start).search(/<section\b[^>]*\bid=["']panel-wiring["'][^>]*>/u);
  if (wiringStart !== -1) return html.slice(start, start + wiringStart);
  const end = html.slice(start).search(/<\/aside>/u);
  return end === -1 ? html.slice(start) : html.slice(start, start + end);
}

function visibleTextFromHtml(fragment) {
  return fragment
    .replace(/<script\b[\s\S]*?<\/script>/giu, " ")
    .replace(/<style\b[\s\S]*?<\/style>/giu, " ")
    .replace(/<[^>]+>/gu, " ")
    .replace(/&nbsp;/gu, " ")
    .replace(/&gt;/gu, ">")
    .replace(/&lt;/gu, "<")
    .replace(/&amp;/gu, "&")
    .replace(/\s+/gu, " ")
    .trim();
}

function textHasForbiddenTerm(text, term) {
  if (/^[A-Za-z][A-Za-z0-9-]*$/u.test(term)) {
    return new RegExp(`\\b${escapeRegExp(term)}\\b`, "u").test(text);
  }
  return text.includes(term);
}

function hasCompletePrimaryNavigation(html) {
  const navLabelsPresent = ["工作台", "内部复核", "使用说明", "资源树"].every((label) => html.includes(`>${label}<`));
  const legacyLabelsAbsent = incompletePrimaryNavLabels.every((label) => !html.includes(`>${label}<`));
  const noLeftSideRecordsShortcut = !/data-side-tab-jump=["']records["']/u.test(html);
  return navLabelsPresent && legacyLabelsAbsent && noLeftSideRecordsShortcut;
}

function gateRetainsDiagnostics(html, app) {
  const gateHtml = sectionSource(html, "gate");
  const gateSource = `${gateHtml}\n${app}`;
  return diagnosticsRequiredTerms.every((term) => gateSource.includes(term));
}

function gateRouteAliasesAreServed(app, artifactPublisher, buildScript, distContractScript) {
  const buildCopiesAliases =
    /\["gate", "diagnostics\/gate"\]/u.test(buildScript) ||
    (/gate\/index\.html/u.test(distContractScript) && /diagnostics\/gate\/index\.html/u.test(distContractScript));
  return (
    /internalGatePathnames\(\)\.has/u.test(app) &&
    gateRouteAliases.every((route) => app.includes(`"${route}"`)) &&
    gateRouteAliases.every((route) => artifactPublisher.includes(`routePath === "${route}"`)) &&
    buildCopiesAliases
  );
}

function helpRouteAliasesAreServed(app, artifactPublisher, buildScript, distContractScript) {
  const routeBody = functionBody(app, "routeFromLocation");
  return (
    /helpPathnames\(\)\.has/u.test(routeBody) &&
    helpRouteAliases.every((route) => app.includes(`"${route}"`)) &&
    helpRouteAliases.every((route) => artifactPublisher.includes(`routePath === "${route}"`)) &&
    /buildCloudWebDist/u.test(buildScript) &&
    /help\/index\.html/u.test(distContractScript) &&
    /return "help"/u.test(routeBody) &&
    finalRouteFallback(app) === "workspace"
  );
}

function wiringTableContract(html) {
  const wiringPanel = html.match(/<section\b[^>]*\bdata-side-panel=["']wiring["'][\s\S]*?<\/section>/u)?.[0] ?? "";
  return requiredWiringColumns.every((column) => wiringPanel.includes(`<th>${column}</th>`));
}

function hardwareStatusStructureContract({ html, app, styles }) {
  const source = `${html}\n${app}\n${styles}`;
  return (
    requiredHardwareStatusTerms.every((term) => source.includes(term)) &&
    /id=["']hardware-source-status["']/u.test(html) &&
    /function\s+renderHardwareStatus\s*\(/u.test(app) &&
    /function\s+hardwareGroup\s*\(/u.test(app) &&
    /function\s+hardwareRow\s*\(/u.test(app) &&
    /function\s+trustedM3Link\s*\(/u.test(app) &&
    /function\s+hasTrustedM3LiveEvidence\s*\(/u.test(app) &&
    /function\s+linkStatusLabel\s*\(/u.test(app) &&
    /function\s+normalizePort\s*\(/u.test(app) &&
    /页面不直连模拟器，也不伪造硬件状态。/u.test(app) &&
    /\.hardware-section\s*\{/u.test(styles) &&
    /\.hardware-row\s*\{/u.test(styles)
  );
}

function defaultTopologyIsM3Only() {
  const activeConnections = gateSummary.topology.patchPanel.activeConnections ?? [];
  return (
    gateSummary.topology.projectId === "prj_m3_hardware_loop" &&
    JSON.stringify(gateSummary.topology.gateways.map((gateway) => gateway.gatewayId)) === JSON.stringify(["gwsimu_1", "gwsimu_2"]) &&
    JSON.stringify(gateSummary.topology.boxResources.map((resource) => resource.resourceId)) === JSON.stringify(["res_boxsimu_1", "res_boxsimu_2"]) &&
    activeConnections.length === 1 &&
    activeConnections[0].fromResourceId === "res_boxsimu_1" &&
    activeConnections[0].fromPort === "DO1" &&
    activeConnections[0].toResourceId === "res_boxsimu_2" &&
    activeConnections[0].toPort === "DI1" &&
    !/res_m5-control-relay|res_m5-target-board|out1|reset/u.test(JSON.stringify(gateSummary.topology))
  );
}

function trustedRecordGroups({ html, app, styles }) {
  const source = `${html}\n${app}\n${styles}`;
  return (
    /id=["']records-list["']/u.test(html) &&
    /function\s+renderRecords\s*\(/u.test(app) &&
    /function\s+codeAgentRecordCards\s*\(/u.test(app) &&
    /function\s+operationRecordCards\s*\(/u.test(app) &&
    /function\s+auditRecordCards\s*\(/u.test(app) &&
    /function\s+evidenceRecordCards\s*\(/u.test(app) &&
    /function\s+auditCard\s*\(/u.test(app) &&
    /function\s+evidenceCard\s*\(/u.test(app) &&
    /function\s+recordGroup\s*\(/u.test(app) &&
    /function\s+recordField\s*\(/u.test(app) &&
    /function\s+safeFailureReason\s*\(/u.test(app) &&
    /function\s+sourceKindLabel\s*\(/u.test(app) &&
    /function\s+liveFailureCard\s*\(/u.test(app) &&
    /state\.liveSurface/u.test(app) &&
    /renderRecords\(state\.liveSurface\)/u.test(app) &&
    /traceId: error\.traceId \|\| traceId/u.test(app) &&
    /error\.traceId = traceId/u.test(app) &&
    requiredTrustedRecordTerms.every((term) => source.includes(term)) &&
    /\.record-group\s*\{/u.test(styles) &&
    /\.record-group-title\s*\{/u.test(styles) &&
    /\.record-group-list\s*\{/u.test(styles) &&
    /replaceChildren\(el\.recordsList, \.\.\.groups\)/u.test(app) &&
    /gateSummary\.operations\.map/u.test(app) &&
    /gateSummary\.auditEvents\.slice\(0,\s*4\)\.map/u.test(app) &&
    /gateSummary\.evidenceRecords\.map/u.test(app) &&
    /safeFailureReason\(message\.error\.message\)/u.test(app) &&
    /message\.status === "failed" \? "blocked" : "source"/u.test(app) &&
    !/message\.status === "completed"\s*\?\s*"dev-live"/u.test(app)
  );
}

function finalRouteFallback(app) {
  const body = app.match(/function\s+routeFromLocation\s*\(\)\s*\{([\s\S]*?)\n\}/u)?.[1] ?? "";
  const returns = [...body.matchAll(/return\s+["']([^"']+)["']\s*;/gu)].map((match) => match[1]);
  return returns.at(-1) ?? null;
}

function labelsPresent(source, labels) {
  return labels.every((label) => source.includes(label));
}

function hasScrollLockContract(styles) {
  return (
    /html,\s*\nbody\s*\{[^\}]*height:\s*100%;[^\}]*overflow:\s*hidden;/su.test(styles) &&
    /body\s*>\s*\[data-app-shell\]\s*\{[^\}]*min-height:\s*0;/su.test(styles) &&
    /\.workbench-shell\s*\{[^\}]*height:\s*100(?:d)?vh;[^\}]*overflow:\s*hidden;/su.test(styles) &&
    /\.view\s*\{[^\}]*min-height:\s*0;[^\}]*overflow:\s*auto;/su.test(styles) &&
    /\.(?:resource-tree|compact-list|conversation-list|trace-list|task-list|hardware-list)[^\{]*\{[^\}]*min-height:\s*0;[^\}]*overflow:\s*auto;/su.test(styles)
  );
}

function hasMobileWorkbenchLayoutContract({ html, app, styles }) {
  return (
    /id=["']resource-explorer["']/u.test(html) &&
    /aria-controls=["']resource-explorer["']/u.test(html) &&
    /aria-expanded=["']true["']/u.test(html) &&
    /function\s+syncMobileExplorer\s*\(/u.test(app) &&
    /window\.matchMedia\(["']\(max-width:\s*860px\)["']\)/u.test(app) &&
    /setExplorerCollapsed\(true\)/u.test(app) &&
    /setExplorerCollapsed\(false\)/u.test(app) &&
    /function\s+collapseExplorerAfterMobileAction\s*\(/u.test(app) &&
    /aria-expanded/u.test(functionBody(app, "setExplorerCollapsed")) &&
    /\.explorer-collapsed\s+\.explorer\s*\{[^\}]*pointer-events:\s*none;/su.test(styles) &&
    /@media\s*\(max-width:\s*860px\)[\s\S]*?\.activity-rail\s*\{[\s\S]*?grid-row:\s*1\s*\/\s*3;/u.test(styles) &&
    /@media\s*\(max-width:\s*860px\)[\s\S]*?\.explorer\s*\{[\s\S]*?grid-row:\s*1\s*\/\s*3;[\s\S]*?z-index:\s*4;/u.test(styles) &&
    /@media\s*\(max-width:\s*860px\)[\s\S]*?\.center-workspace\s*\{[\s\S]*?grid-row:\s*1;/u.test(styles) &&
    /@media\s*\(max-width:\s*860px\)[\s\S]*?\.right-sidebar\s*\{[\s\S]*?grid-row:\s*2;/u.test(styles) &&
    /@media\s*\(max-width:\s*520px\)[\s\S]*?\.command-bar\s*\{[\s\S]*?grid-template-columns:\s*minmax\(0,\s*1fr\)\s+auto\s+auto;/u.test(styles)
  );
}

function hasStableRouteControls({ html, styles }) {
  return (
    ["工作台", "内部复核", "使用说明", "资源树", "控制", "接线", "可信记录"].every((label) => html.includes(`>${label}<`)) &&
    /\.rail-button\s*\{[^}]*min-width:\s*0;[^}]*min-height:\s*36px;[^}]*text-align:\s*center;[^}]*word-break:\s*keep-all;/su.test(styles) &&
    /@media\s*\(max-width:\s*860px\)[\s\S]*?\.rail-button\s*\{[\s\S]*?min-height:\s*42px;/u.test(styles) &&
    /\.side-tab\s*\{[^}]*min-width:\s*0;[^}]*min-height:\s*34px;[^}]*overflow-wrap:\s*anywhere;[^}]*word-break:\s*keep-all;/su.test(styles) &&
    /\.(?:status-dot|state-tag|badge)[^{]*\{[^}]*max-width:\s*100%;[^}]*line-height:\s*1\.25;[^}]*white-space:\s*normal;[^}]*overflow-wrap:\s*anywhere;/su.test(styles) &&
    /\.probe-card\s*\{[^}]*min-width:\s*0;/su.test(styles) &&
    /\.probe-card strong\s*\{[^}]*line-height:\s*1\.2;[^}]*overflow-wrap:\s*anywhere;/su.test(styles) &&
    /@media\s*\(max-width:\s*860px\)[\s\S]*?\.message-evidence\s*\{[\s\S]*?grid-column:\s*1;/u.test(styles)
  );
}

function hasSameOriginReadOnlyBoundary(app) {
  const rpcCalls = [...app.matchAll(/callRpc\(\s*["']([^"']+)["']/gu)].map((match) => match[1]).sort();
  return (
    /fetchJson\("\/health\/live"\)/u.test(app) &&
    /fetchJson\("\/v1"\)/u.test(app) &&
    /fetchJson\("\/v1\/agent\/chat"/u.test(app) &&
    /fetchJson\("\/json-rpc"/u.test(app) &&
    JSON.stringify(rpcCalls) === JSON.stringify([...readOnlyRpcMethods].sort()) &&
    !/fetchJson\(\s*["']https?:\/\//u.test(app)
  );
}

function hasApiDegradedDefaultStatus({ app }) {
  const statusBody = functionBody(app, "workbenchApiSurfaceStatus");
  const readinessBody = functionBody(app, "workbenchSurfaceReadiness");
  const durableBlockBody = functionBody(app, "hasDurableRuntimeQueryBlock");
  return (
    /function\s+workbenchApiSurfaceStatus\s*\(/u.test(app) &&
    /function\s+workbenchSurfaceReadiness\s*\(/u.test(app) &&
    /function\s+hasDurableRuntimeQueryBlock\s*\(/u.test(app) &&
    /surface\.durableQueryBlocked/u.test(statusBody) &&
    /surface\.degraded/u.test(statusBody) &&
    /function\s+readinessBooleanValues\s*\(/u.test(app) &&
    /payload\.ready/u.test(functionBody(app, "readinessBooleanValues")) &&
    /payload\.readiness\?\.ready/u.test(functionBody(app, "readinessBooleanValues")) &&
    /readyValues\.includes\(false\)/u.test(readinessBody) &&
    /runtime_durable_adapter_query_blocked/u.test(durableBlockBody) &&
    /payload\.runtime\?\.blocker/u.test(durableBlockBody) &&
    /payload\.readiness\?\.durability\?\.blocker/u.test(durableBlockBody) &&
    /blockedLayer === "durability_query"/u.test(durableBlockBody) &&
    /可信记录受阻 \/ 只读模式/u.test(statusBody) &&
    /API 降级 \/ 只读模式/u.test(statusBody) &&
    /同源 API 可响应但处于降级状态；当前保持只读查看和本地任务整理。/u.test(statusBody) &&
    /同源 API 可响应，但可信记录持久化尚未就绪；当前只保留只读查看和本地任务整理。/u.test(statusBody) &&
    !/runtime_durable_adapter_query_blocked|DB live readiness|Gate|诊断|验收|M0-M5|执行轨迹/u.test(statusBody)
  );
}

function hasCodeAgentChatContract({ html, app }) {
  return (
    /id=["']agent-chat-status["']/u.test(html) &&
    /id=["']command-send["']/u.test(html) &&
    />发送<\/button>/u.test(html) &&
    !/>添加草稿<\/button>/u.test(html) &&
    /placeholder=["']输入要发送给 Code Agent 的消息；不会直接触发硬件变更。["']/u.test(html) &&
    /fetchJson\("\/v1\/agent\/chat"/u.test(app) &&
    /conversationId/u.test(app) &&
    /messageId/u.test(app) &&
    /updatedAt/u.test(app) &&
    /error\?\.message/u.test(app) &&
    /Code Agent 调用失败/u.test(app)
  );
}

function hasCodeAgentReadinessVisibility({ html, app }) {
  const source = `${html}\n${app}`;
  const userFacingBodies = [
    functionBody(app, "codeAgentStatusMessage"),
    functionBody(app, "codeAgentPromptText"),
    functionBody(app, "codeAgentControlSummary"),
    functionBody(app, "codeAgentBlockedSummary"),
    functionBody(app, "codeAgentAvailabilitySummary"),
    functionBody(app, "failureMessage")
  ].join("\n");
  return (
    /codeAgentAvailability/u.test(app) &&
    /codeAgentAvailabilityFrom/u.test(app) &&
    /sanitizeCodeAgentAvailability/u.test(app) &&
    /latestCompletedAgentMessage/u.test(app) &&
    blockedCodeAgentUiLabels.some((label) => app.includes(label)) &&
    /provider_unavailable/u.test(app) &&
    /OPENAI_API_KEY/u.test(app) &&
    /只有真实完成回复才显示为完成/u.test(app) &&
    /不能因为只有会话编号就当成实况完成/u.test(app) &&
    /isTrustedCodeAgentProvider/u.test(app) &&
    /Boolean\(value\?\.model\)/u.test(app) &&
    /Boolean\(value\?\.backend\)/u.test(app) &&
    /Boolean\(value\?\.traceId\)/u.test(app) &&
    /Boolean\(value\?\.conversationId \|\| value\?\.sessionId\)/u.test(app) &&
    /isRealCompletedChatMessage/u.test(app) &&
    /isRealCompletedChatResult/u.test(app) &&
    /hasRealCodeAgentEvidence/u.test(app) &&
    !/status === "failed" \? "dev-live"/u.test(app) &&
    !/tone:\s*state\.conversationId\s*\?\s*"dev-live"/u.test(app) &&
    !/provider_unavailable[\s\S]{0,120}tone-[\w-]*dev-live/iu.test(source) &&
    !/OPENAI_API_KEY|hwlab-code-agent-provider|Secret|secretRef/u.test(userFacingBodies) &&
    !/sk-[A-Za-z0-9._-]{8,}/u.test(source)
  );
}

function hasCodeAgentCompletedEvidenceVisibility({ app }) {
  const messageEvidenceBody = functionBody(app, "messageEvidenceFields");
  const realEvidenceBody = functionBody(app, "hasRealCodeAgentEvidence");
  return (
    requiredCodeAgentEvidenceTerms.every((term) => app.includes(term)) &&
    /conversationId:\s*result\.conversationId \|\| result\.sessionId \|\| state\.conversationId/u.test(app) &&
    /providerTrace:\s*result\.providerTrace/u.test(app) &&
    /function\s+providerTraceSummary\s*\(/u.test(app) &&
    /recordField\("provider",\s*message\.provider\)/u.test(messageEvidenceBody) &&
    /recordField\("model",\s*message\.model\)/u.test(messageEvidenceBody) &&
    /recordField\("backend",\s*message\.backend\)/u.test(messageEvidenceBody) &&
    /recordField\("conversation",\s*message\.conversationId\)/u.test(messageEvidenceBody) &&
    /recordField\("trace",\s*message\.traceId\)/u.test(messageEvidenceBody) &&
    /recordField\("message",\s*message\.messageId\)/u.test(messageEvidenceBody) &&
    /providerTraceSummary\(message\.providerTrace\)/u.test(messageEvidenceBody) &&
    /isTrustedCodeAgentProvider\(value\?\.provider\)/u.test(realEvidenceBody) &&
    /TRUSTED_CODE_AGENT_PROVIDERS/u.test(app) &&
    /UNTRUSTED_CODE_AGENT_PROVIDER_PATTERN/u.test(realEvidenceBody) &&
    /value\?\.conversationId \|\| value\?\.sessionId/u.test(realEvidenceBody) &&
    /isRealCompletedChatResult\(result\)/u.test(app) &&
    /classifyCodeAgentCompletion\(result\)/u.test(app) &&
    /status:\s*"completed"/u.test(functionBody(app, "classifyCodeAgentCompletion")) &&
    /sourceKind:\s*"DEV-LIVE"/u.test(functionBody(app, "classifyCodeAgentCompletion")) &&
    /Code Agent 完成证据不足/u.test(app) &&
    /本次不会标记为真实完成/u.test(app)
  );
}

function hasCodeAgentLongTimeoutContract(app) {
  return (
    /DEFAULT_API_TIMEOUT_MS\s*=\s*4500/u.test(app) &&
    /DEFAULT_CODE_AGENT_TIMEOUT_MS\s*=\s*150000/u.test(app) &&
    /async function sendAgentMessage[\s\S]*?fetchJson\("\/v1\/agent\/chat"[\s\S]*?timeoutMs:\s*CODE_AGENT_TIMEOUT_MS/u.test(app) &&
    /timeoutMs\s*=\s*API_TIMEOUT_MS/u.test(functionBody(app, "fetchJson")) &&
    /timeoutName\s*=\s*path/u.test(functionBody(app, "fetchJson")) &&
    /HWLAB_CLOUD_WEB_CONFIG/u.test(app) &&
    /codeAgentTimeoutMs/u.test(app)
  );
}

function hasCodeAgentConversationUxStates({ app, styles }) {
  const submitBody = functionBody(app, "initCommandBar");
  return (
    /function\s+classifyCodeAgentCompletion\s*\(/u.test(app) &&
    /function\s+isSourceFixtureChatResult\s*\(/u.test(app) &&
    /function\s+isSourceFixtureCompletion\s*\(/u.test(app) &&
    /function\s+isSourceFixtureCompletedChatMessage\s*\(/u.test(app) &&
    /function\s+messageEvidencePanel\s*\(/u.test(app) &&
    /function\s+messageEvidenceSummary\s*\(/u.test(app) &&
    /function\s+boundedEvidenceField\s*\(/u.test(app) &&
    /DEFAULT_API_TIMEOUT_MS\s*=\s*4500/u.test(app) &&
    /DEFAULT_CODE_AGENT_TIMEOUT_MS\s*=\s*150000/u.test(app) &&
    /timeoutMs:\s*CODE_AGENT_TIMEOUT_MS/u.test(app) &&
    /HWLAB_CLOUD_WEB_CONFIG/u.test(app) &&
    /失败时会保留输入供重试/u.test(app) &&
    /Code Agent 请求超过/u.test(app) &&
    /Code Agent SOURCE 回复/u.test(app) &&
    /SOURCE fixture 只可显示为 SOURCE 回复，不能冒充 DEV-LIVE/u.test(app) &&
    /sourceKind:\s*completion\.sourceKind/u.test(submitBody) &&
    /completion\.replied/u.test(submitBody) &&
    /status-source/u.test(styles) &&
    /message-user/u.test(styles) &&
    /message-agent/u.test(styles) &&
    /message-evidence\s*\{/u.test(styles) &&
    /message-evidence-chip/u.test(styles) &&
    /width:\s*min\(100%,\s*780px\)/u.test(styles) &&
    /status === "completed" \? "dev-live" : status === "failed" \|\| status === "blocked" \? "blocked" : "source"/u.test(app) &&
    !/sourceKind:\s*"SOURCE"[\s\S]{0,160}status:\s*"completed"/u.test(app)
  );
}

function noForbiddenWriteSurface(source) {
  return forbiddenWritePatterns.every((pattern) => !pattern.test(source));
}

function sourceEvidenceNotDevLive(source) {
  const m3 = gateSummary.milestones.find((item) => item.id === "M3");
  return (
    m3?.status === "blocked" &&
    gateSummary.operations.every((operation) => operation.dryRun === true) &&
    gateSummary.auditEvents.every((event) => event.dryRun === true) &&
    gateSummary.evidenceRecords.every((record) => record.dryRun === true) &&
    gateSummary.safety.allowNetwork === false &&
    ["来源 SOURCE", "演练 DRY-RUN", "开发实况 DEV-LIVE", "阻塞 BLOCKED"].every((label) => source.includes(label))
  );
}

function m3FixtureCountsNotDevLive(app) {
  const hardwareBody = functionBody(app, "renderHardwareStatus");
  const linkDetailBody = functionBody(app, "m3LinkDetail");
  const liveEvidenceBody = functionBody(app, "hasTrustedM3LiveEvidence");
  const patchPanelReportBody = functionBody(app, "hasTrustedPatchPanelLiveReport");
  const sourceOnlyRuntimeCounts =
    /runtimeCountsSourceKind\s*=\s*["']SOURCE["']/u.test(hardwareBody) &&
    !/sourceKind:\s*counts\s*\?\s*["']DEV-LIVE["']/u.test(hardwareBody) &&
    !/counts\s*&&\s*(?:liveLink|sourceLink|m3Link)[\s\S]{0,80}\?\s*["']DEV-LIVE["']/u.test(hardwareBody);
  return (
    sourceOnlyRuntimeCounts &&
    /hasTrustedM3LiveEvidence\(liveM3Evidence\)/u.test(hardwareBody) &&
    /patchPanelLiveReport/u.test(liveEvidenceBody) &&
    /LIVE_M3_ID_FIELDS\.every/u.test(liveEvidenceBody) &&
    /hasTrustedPatchPanelLiveReport/u.test(liveEvidenceBody) &&
    /serviceId\s*!==\s*M3_TRUSTED_ROUTE\.patchPanelServiceId/u.test(patchPanelReportBody) &&
    /trustedM3Link\(\[link\]\)/u.test(patchPanelReportBody) &&
    /只读运行计数已返回，但还不能证明接线盘闭环/u.test(linkDetailBody) &&
    /来源拓扑包含目标接线/u.test(linkDetailBody)
  );
}

function m3RenderedWorkbenchNotM5Fixture(app) {
  const hardwareBody = functionBody(app, "renderHardwareStatus");
  const hardwareGroupBody = functionBody(app, "hardwareGroup");
  const wiringBody = functionBody(app, "renderWiringList");
  return (
    /group\.rows\.map\(hardwareRow\)/u.test(hardwareGroupBody) &&
    !/hardwareRow\(\s*\{/u.test(hardwareBody) &&
    /M3_TRUSTED_ROUTE\.fromResourceId/u.test(wiringBody) &&
    /M3_TRUSTED_ROUTE\.patchPanelServiceId/u.test(wiringBody) &&
    /M3_TRUSTED_ROUTE\.toResourceId/u.test(wiringBody) &&
    !/activeConnections\.map/u.test(wiringBody) &&
    !/link\.fromResourceId/u.test(wiringBody)
  );
}

function functionBody(source, functionName) {
  const match = source.match(new RegExp(`function\\s+${escapeRegExp(functionName)}\\s*\\([^)]*\\)\\s*\\{`, "u"));
  if (!match) return "";
  let depth = 0;
  for (let index = match.index + match[0].length - 1; index < source.length; index += 1) {
    const char = source[index];
    if (char === "{") depth += 1;
    if (char === "}") {
      depth -= 1;
      if (depth === 0) return source.slice(match.index, index + 1);
    }
  }
  return "";
}

function inspectHelpContract({ html, app }) {
  const markdownFiles = findHelpMarkdownFiles();
  const rendererPackages = findMarkdownRenderers();
  const route = inspectHelpRoute(html, app);
  const implemented = markdownFiles.includes("web/hwlab-cloud-web/help.md") && rendererPackages.length > 0 && route.nonDefaultRoute;
  const status = route.defaultRouteRisk ? "blocked" : implemented ? "pass" : "pending";
  return {
    status,
    blocker: route.defaultRouteRisk ? "runtime_blocker" : null,
    summary: implemented ? "Markdown help route from PR #114 is present and remains non-default." : `Markdown help page contract is pending; owner=${helpOwner}.`,
    observations: {
      owner: helpOwner,
      markdownHelpFilesPresent: markdownFiles.length > 0,
      markdownHelpFiles: markdownFiles,
      matureMarkdownRendererPresent: rendererPackages.length > 0,
      markdownRenderers: rendererPackages,
      nonDefaultRoute: route.nonDefaultRoute,
      implemented,
      route
    }
  };
}

function findHelpMarkdownFiles() {
  const files = [
    "web/hwlab-cloud-web/help.md",
    "web/hwlab-cloud-web/help/README.md",
    "web/hwlab-cloud-web/help/index.md",
    "docs/dev-cloud-workbench-help.md",
    "docs/cloud-web-workbench.md"
  ];
  return files.filter((relativePath) => fs.existsSync(path.join(repoRoot, relativePath)));
}

function findMarkdownRenderers() {
  const packages = ["package.json", "web/hwlab-cloud-web/package.json"]
    .filter((file) => fs.existsSync(path.join(repoRoot, file)))
    .flatMap((file) => {
      const json = JSON.parse(readText(file));
      return Object.keys({ ...(json.dependencies ?? {}), ...(json.devDependencies ?? {}) });
    });
  const source = `${readText("web/hwlab-cloud-web/app.mjs")}\n${readText("web/hwlab-cloud-web/index.html")}`;
  const imported = markdownRendererPackages.filter((name) => new RegExp(`from\\s+["']${escapeRegExp(name)}["']|import\\(["']${escapeRegExp(name)}["']\\)`, "u").test(source));
  const vendoredMarked = /from\s+["']\.\/third_party\/marked\/marked\.esm\.js["']/u.test(source) &&
    fs.existsSync(path.join(repoRoot, "web/hwlab-cloud-web/third_party/marked/marked.esm.js")) &&
    fs.existsSync(path.join(repoRoot, "web/hwlab-cloud-web/third_party/marked/LICENSE"));
  const renderers = [...packages, ...imported].filter((name) => markdownRendererPackages.includes(name));
  if (vendoredMarked) renderers.push("marked:vendored");
  return [...new Set(renderers)].sort();
}

function inspectHelpRoute(html, app) {
  const helpViewTag = firstTagForDataView(html, "help");
  const explicitRoutePresent =
    /data-route=["']help["']/u.test(html) ||
    /data-view=["']help["']/u.test(html) ||
    /#help\b/u.test(html + app) ||
    /pathname[\s\S]{0,220}\/help/u.test(app);
  const finalFallback = finalRouteFallback(app);
  const helpViewHidden = helpViewTag ? /\bhidden\b/u.test(helpViewTag) : false;
  return {
    explicitRoutePresent,
    finalFallback,
    helpViewHidden,
    routePolicy: html.match(/\bdata-help-route-policy=["']([^"']+)["']/u)?.[1] ?? null,
    nonDefaultRoute:
      explicitRoutePresent &&
      finalFallback === "workspace" &&
      (helpViewTag ? helpViewHidden : true) &&
      /data-help-route-policy=["']non-default-internal-help["']/u.test(html),
    defaultRouteRisk: finalFallback === "help" || (helpViewTag !== null && !helpViewHidden)
  };
}

function staticSafety() {
  return {
    prodTouched: false,
    servicesRestarted: false,
    heavyE2E: false,
    hardwareWriteApis: false,
    devLive: false,
    sourceIsDevLive: false,
    statement: "Static repository/source evidence is not DEV-LIVE and cannot promote SOURCE, LOCAL, DRY-RUN, or fixture observations."
  };
}

export function classifyLiveApiRuntimeReadiness(runtimeIdentity) {
  const healthStatus = sanitizeRuntimeString(runtimeIdentity?.healthStatus);
  const runtime = runtimeIdentity?.runtime ?? {};
  const readiness = runtimeIdentity?.readiness ?? {};
  const durability = readiness?.durability ?? {};
  const blockerCodes = Array.isArray(runtimeIdentity?.blockerCodes)
    ? runtimeIdentity.blockerCodes.map((item) => sanitizeRuntimeString(item))
    : [];
  const ready = runtimeIdentity?.ready === true || readiness?.ready === true;
  const runtimeReady = runtime?.ready === true;
  const durabilityReady = durability?.ready === true;
  const runtimeDurable = runtime?.durable === true;
  const durableBlocked = runtime?.blocker === "runtime_durable_adapter_query_blocked" ||
    durability?.blocker === "runtime_durable_adapter_query_blocked" ||
    blockerCodes.includes("runtime_durable_adapter_query_blocked") ||
    durability?.blockedLayer === "durability_query" ||
    runtime?.connection?.queryResult === "query_blocked" ||
    durability?.queryResult === "query_blocked";
  const degraded = healthStatus === "degraded" ||
    ready === false ||
    runtimeReady === false ||
    durabilityReady === false ||
    runtimeDurable === false ||
    durableBlocked;

  if (!degraded) {
    return {
      status: "pass",
      healthStatus,
      ready,
      runtimeDurable,
      runtimeReady,
      durabilityReady,
      durableBlocked,
      blockerCodes,
      evidence: [
        `api.status=${healthStatus}`,
        `ready=${ready}`,
        `runtime.durable=${runtimeDurable}`,
        `runtime.ready=${runtimeReady}`,
        `durability.ready=${durabilityReady}`
      ],
      summary: "Live API health and runtime durability are ready for browser journey evidence."
    };
  }

  const blockedEvidence = [
    `api.status=${healthStatus}`,
    `ready=${ready}`,
    `runtime.durable=${runtimeDurable}`,
    `runtime.ready=${runtimeReady}`,
    `durability.ready=${durabilityReady}`,
    durableBlocked ? "runtime_durable_adapter_query_blocked" : null,
    ...blockerCodes.map((code) => `blocker=${code}`)
  ].filter(Boolean);
  return {
    status: "degraded",
    healthStatus,
    ready,
    runtimeDurable,
    runtimeReady,
    durabilityReady,
    durableBlocked,
    blockerCodes,
    evidence: blockedEvidence,
    summary: "Live API is reachable but degraded/read-only; runtime durability is not ready, so this cannot be full DEV-LIVE acceptance."
  };
}

async function observeLiveRuntimeIdentity(apiEndpoint) {
  const endpoint = new URL("/health/live", apiEndpoint).toString();
  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), 6000);
  try {
    const response = await fetch(endpoint, {
      signal: controller.signal,
      headers: { Accept: "application/json" }
    });
    let body = null;
    try {
      body = await response.json();
    } catch {
      body = null;
    }
    if (!response.ok || !body || typeof body !== "object") {
      return notObservedRuntimeIdentity(`health-live returned HTTP ${response.status}`, endpoint);
    }
    return {
      status: "observed",
      source: "health-live",
      endpoint,
      serviceId: sanitizeRuntimeString(body.serviceId),
      environment: sanitizeRuntimeString(body.environment),
      healthStatus: sanitizeRuntimeString(body.status),
      ready: body.ready === true,
      commitId: sanitizeRevision(body.commit?.id ?? body.commitId),
      commitSource: sanitizeRuntimeString(body.commit?.source),
      imageTag: sanitizeRuntimeString(body.image?.tag),
      observedAt: sanitizeTimestamp(body.observedAt),
      runtime: summarizeRuntimeHealth(body.runtime),
      readiness: summarizeReadinessHealth(body.readiness),
      blockerCodes: sanitizeStringList(body.blockerCodes),
      summary: "Live runtime identity was observed through the existing read-only health endpoint and is not inferred from source git HEAD."
    };
  } catch (error) {
    return notObservedRuntimeIdentity(
      error.name === "AbortError" ? "health-live request timed out" : `health-live request failed: ${oneLine(error.message)}`,
      endpoint
    );
  } finally {
    clearTimeout(timer);
  }
}

function notObservedRuntimeIdentity(reason, endpoint = new URL("/health/live", runtime.endpoints.api).toString()) {
  return {
    status: "not_observed",
    source: "health-live",
    endpoint,
    serviceId: "not_observed",
    environment: "not_observed",
    healthStatus: "not_observed",
    ready: false,
    commitId: "not_observed",
    commitSource: "not_observed",
    imageTag: "not_observed",
    observedAt: new Date().toISOString(),
    runtime: {
      durable: false,
      ready: false,
      status: "not_observed",
      blocker: "not_observed"
    },
    readiness: {
      ready: false,
      status: "not_observed",
      durability: {
        ready: false,
        status: "not_observed",
        blocker: "not_observed",
        blockedLayer: "not_observed",
        queryResult: "not_observed"
      }
    },
    blockerCodes: [],
    reason: oneLine(reason),
    summary: "Live runtime identity is recorded as not_observed; source identity must not be treated as the deployed runtime revision."
  };
}

function summarizeRuntimeHealth(runtimeHealth) {
  return {
    durable: runtimeHealth?.durable === true,
    ready: runtimeHealth?.ready === true,
    status: sanitizeRuntimeString(runtimeHealth?.status),
    blocker: sanitizeRuntimeString(runtimeHealth?.blocker),
    connection: {
      queryAttempted: runtimeHealth?.connection?.queryAttempted === true,
      queryResult: sanitizeRuntimeString(runtimeHealth?.connection?.queryResult)
    }
  };
}

function summarizeReadinessHealth(readiness) {
  return {
    ready: readiness?.ready === true,
    status: sanitizeRuntimeString(readiness?.status),
    durability: {
      ready: readiness?.durability?.ready === true,
      status: sanitizeRuntimeString(readiness?.durability?.status),
      blocker: sanitizeRuntimeString(readiness?.durability?.blocker),
      blockedLayer: sanitizeRuntimeString(readiness?.durability?.blockedLayer),
      queryResult: sanitizeRuntimeString(readiness?.durability?.queryResult)
    }
  };
}

function sanitizeStringList(value) {
  return Array.isArray(value) ? value.map((item) => sanitizeRuntimeString(item)) : [];
}

function sanitizeRevision(value) {
  if (typeof value !== "string") return "unknown";
  const trimmed = value.trim().toLowerCase();
  return /^[a-f0-9]{7,40}$/u.test(trimmed) ? trimmed : "unknown";
}

function sanitizeTimestamp(value) {
  return typeof value === "string" && !Number.isNaN(Date.parse(value)) ? value : new Date().toISOString();
}

function sanitizeRuntimeString(value) {
  return typeof value === "string" && value.trim().length > 0 ? oneLine(value) : "unknown";
}

function oneLine(value) {
  return String(value ?? "unknown").replace(/\s+/gu, " ").trim().slice(0, 240) || "unknown";
}

async function fetchText(url) {
  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), 6000);
  try {
    const response = await fetch(url, { signal: controller.signal, headers: { Accept: "text/html" } });
    const body = await response.text();
    return {
      ok: response.ok,
      status: response.status,
      contentType: response.headers.get("content-type") ?? "",
      body
    };
  } catch (error) {
    return {
      ok: false,
      status: null,
      contentType: "",
      body: "",
      error: error.name === "AbortError" ? "timeout" : error.message
    };
  } finally {
    clearTimeout(timer);
  }
}

function liveHtmlLooksLikeWorkbench(html) {
  const workspaceTag = firstTagForDataView(html, "workspace");
  const gateTag = firstTagForDataView(html, "gate");
  const helpTag = firstTagForDataView(html, "help");
  return (
    /HWLAB 云工作台/u.test(html) &&
    labelsPresent(html, workbenchMarkers) &&
    workspaceTag !== null &&
    !/\bhidden\b/u.test(workspaceTag) &&
    gateTag !== null &&
    /\bhidden\b/u.test(gateTag) &&
    (helpTag === null || /\bhidden\b/u.test(helpTag))
  );
}

async function inspectLiveDom(url) {
  let chromium;
  try {
    ({ chromium } = await importPlaywright());
  } catch (error) {
    return {
      status: "skip",
      summary: `Browser DOM check skipped because Playwright is unavailable: ${error.message}`,
      evidence: ["playwright import failed"]
    };
  }

  let browser;
  try {
    browser = await chromium.launch({ headless: true });
    const page = await browser.newPage({ viewport: { width: 1366, height: 768 } });
    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 8000 });
    const dom = await page.evaluate(async (forbiddenTerms) => {
      const workspace = document.querySelector('[data-view="workspace"]');
      const gate = document.querySelector('[data-view="gate"]');
      const help = document.querySelector('[data-view="help"]');
      const diagnostics = document.querySelector('[data-side-panel="diagnostics"]');
      const bodyStyle = getComputedStyle(document.body);
      const htmlStyle = getComputedStyle(document.documentElement);
      const text = document.body.textContent ?? "";
      const visible = (selector) => {
        const element = document.querySelector(selector);
        if (!element) return false;
        const style = getComputedStyle(element);
        const box = element.getBoundingClientRect();
        return style.visibility !== "hidden" && style.display !== "none" && box.width > 0 && box.height > 0;
      };
      const visibleTextInFirstViewport = () => {
        const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
        const chunks = [];
        for (let node = walker.nextNode(); node; node = walker.nextNode()) {
          const textContent = node.textContent?.replace(/\s+/gu, " ").trim();
          if (!textContent) continue;
          const parent = node.parentElement;
          if (!parent) continue;
          const style = getComputedStyle(parent);
          if (style.visibility === "hidden" || style.display === "none") continue;
          const box = parent.getBoundingClientRect();
          const inViewport = box.width > 0 && box.height > 0 && box.bottom > 0 && box.right > 0 && box.top < window.innerHeight && box.left < window.innerWidth;
          if (inViewport) chunks.push(textContent);
        }
        return chunks.join(" ").replace(/\s+/gu, " ").trim();
      };
      const textHasForbiddenTerm = (candidateText, term) => {
        if (/^[A-Za-z][A-Za-z0-9-]*$/u.test(term)) {
          const escaped = term.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
          return new RegExp(`\\b${escaped}\\b`, "u").test(candidateText);
        }
        return candidateText.includes(term);
      };
      window.scrollTo(0, 240);
      document.documentElement.scrollTop = 240;
      document.body.scrollTop = 240;
      await new Promise((resolve) => requestAnimationFrame(resolve));
      const firstViewportText = visibleTextInFirstViewport();
      const rootAfterScrollAttempt = {
        windowScrollY: window.scrollY,
        htmlScrollTop: document.documentElement.scrollTop,
        bodyScrollTop: document.body.scrollTop
      };
      return {
        title: document.title,
        bodyOverflow: bodyStyle.overflow,
        htmlOverflow: htmlStyle.overflow,
        workspaceHidden: workspace ? workspace.hidden : null,
        gateHidden: gate ? gate.hidden : null,
        helpHidden: help ? help.hidden : null,
        diagnosticsHidden: diagnostics ? diagnostics.hidden : null,
        outerScrollLocked: document.documentElement.scrollHeight <= document.documentElement.clientHeight + 2,
        rootAfterScrollAttempt,
        firstViewportForbiddenPresent: forbiddenTerms.filter((term) => textHasForbiddenTerm(firstViewportText, term)),
        firstViewportTextSample: firstViewportText.slice(0, 400),
        labelsPresent: ["硬件资源", "Agent 对话", "工作清单", "可信记录", "使用说明"].every((label) => text.includes(label)),
        coreControlsVisible: {
          commandInput: visible("#command-input"),
          commandSend: visible("#command-send"),
          agentChatStatus: visible("#agent-chat-status"),
          conversationList: visible("#conversation-list"),
          hardwareList: visible("#hardware-list"),
          wiringTab: visible("#tab-wiring"),
          recordsTab: visible("#tab-records")
        }
      };
    }, [...defaultHomepageForbiddenTerms]);
    const pass =
      dom.title === "HWLAB 云工作台" &&
      dom.bodyOverflow === "hidden" &&
      dom.htmlOverflow === "hidden" &&
      dom.workspaceHidden === false &&
      dom.gateHidden === true &&
      (dom.helpHidden === true || dom.helpHidden === null) &&
      (dom.diagnosticsHidden === true || dom.diagnosticsHidden === null) &&
      dom.outerScrollLocked &&
      dom.rootAfterScrollAttempt.windowScrollY === 0 &&
      dom.rootAfterScrollAttempt.htmlScrollTop === 0 &&
      dom.rootAfterScrollAttempt.bodyScrollTop === 0 &&
      dom.firstViewportForbiddenPresent.length === 0 &&
      dom.labelsPresent &&
      Object.values(dom.coreControlsVisible).every(Boolean);
    return {
      status: pass ? "pass" : "blocked",
      summary: pass ? "Browser DOM confirms the default workbench, core controls, and outer scroll lock." : "Browser DOM did not satisfy the workbench contract.",
      evidence: [
        `title=${dom.title}`,
        `bodyOverflow=${dom.bodyOverflow}`,
        `htmlOverflow=${dom.htmlOverflow}`,
        `firstViewportForbidden=${dom.firstViewportForbiddenPresent.join(",") || "none"}`
      ],
      observations: dom
    };
  } catch (error) {
    return {
      status: "skip",
      summary: `Browser DOM check skipped because the browser could not run: ${error.message}`,
      evidence: ["browser launch or navigation failed"]
    };
  } finally {
    if (browser) await browser.close();
  }
}

async function inspectLiveHelpRoute(url) {
  let chromium;
  try {
    ({ chromium } = await importPlaywright());
  } catch (error) {
    return {
      status: "skip",
      summary: `Browser Markdown help check skipped because Playwright is unavailable: ${error.message}`,
      evidence: ["playwright import failed"]
    };
  }

  let browser;
  try {
    browser = await chromium.launch({ headless: true });
    const page = await browser.newPage({ viewport: { width: 1366, height: 768 } });
    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 12000 });
    await page.locator('[data-route="help"]').click();
    await page.waitForFunction(() => document.querySelector("#help-content")?.dataset.helpState === "ready", null, { timeout: 8000 });
    const help = await inspectHelpMarkdownRoute(page);
    const pass = help.nonDefaultMarkdownHelp && help.termsPresent;
    return {
      status: pass ? "pass" : "blocked",
      summary: pass
        ? "Desktop browser help route remains non-default, markdown-rendered, and scrollable."
        : "Desktop browser help route did not satisfy the markdown workbench contract.",
      evidence: [
        `hash=${help.hash ?? "unknown"}`,
        `heading=${help.heading ?? "unknown"}`,
        `rootStillLocked=${help.rootStillLocked}`,
        `helpPanelScrolls=${help.helpPanelScrolls}`
      ],
      observations: help
    };
  } catch (error) {
    return {
      status: "blocked",
      summary: `Desktop browser help route failed: ${error.message}`,
      evidence: ["browser navigation or markdown render failed"]
    };
  } finally {
    if (browser) await browser.close();
  }
}

async function inspectLiveCodeAgentE2e(url) {
  let chromium;
  try {
    ({ chromium } = await importPlaywright());
  } catch (error) {
    return {
      status: "skip",
      summary: `浏览器 Code Agent E2E 跳过：Playwright 不可用：${error.message}`,
      evidence: ["playwright import failed"]
    };
  }

  let browser;
  try {
    browser = await chromium.launch({ headless: true });
    const page = await browser.newPage({ viewport: { width: 1366, height: 768 } });
    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 12000 });
    await page.locator("#command-input").waitFor({ state: "visible", timeout: 12000 });
    const controls = await inspectJourneyControls(page);
    if (!Object.values(controls).every(Boolean)) {
      return {
        status: "blocked",
        summary: "浏览器故障：无法可靠定位 Workbench Code Agent 控件。",
        evidence: ["selectors=#command-input,#command-send,#agent-chat-status,#conversation-list,#hardware-list"],
        observations: { controls }
      };
    }

    const promptResults = [];
    for (const prompt of codeAgentE2ePrompts) {
      promptResults.push(await runCodeAgentPromptJourney(page, prompt));
    }

    const firstBlocked = promptResults.find((result) => result.status === "blocked");
    const degraded = promptResults.some((result) => result.status === "degraded");
    const status = firstBlocked ? "blocked" : degraded ? "degraded" : "pass";

    return {
      status,
      summary: status === "pass"
        ? "DEV-LIVE 浏览器 E2E 已发送两个 Code Agent 提示，并确认旧 4500ms 窗口未形成永久失败。"
        : status === "degraded"
          ? "DEV-LIVE 浏览器 E2E 未命中旧 4500ms 永久失败路径；至少一个提示在配置的长时间边界后返回清晰后端超时。"
          : firstBlocked.classification?.chineseSummary ?? firstBlocked.summary,
      evidence: [
        `prompts=${promptResults.length}`,
        `legacyFailureWindowMs=${legacyFailureWindowMs}`,
        `codeAgentTimeoutMs=${codeAgentLongTimeoutMs}`,
        ...promptResults.map((result) => `${result.promptId}: status=${result.status}; blocker=${result.classification?.blocker ?? "none"}; traceId=${result.response?.traceId ?? result.traceId ?? "unknown"}`)
      ],
      observations: {
        controls,
        request: promptResults.length === 1 ? promptResults[0].request : {
          method: "POST",
          status: promptResults.every((result) => result.request?.status === 200) ? 200 : "mixed",
          urlPath: "/v1/agent/chat",
          count: promptResults.length
        },
        response: promptResults[0]?.response ?? blockedAgentChatResponse("not_observed"),
        classification: firstBlocked?.classification ?? promptResults.find((result) => result.status === "degraded")?.classification ?? {
          status: "pass",
          blocker: null,
          reason: "both configured Code Agent browser prompts completed without a permanent 4500ms UI failure"
        },
        prompts: promptResults,
        ui: promptResults.at(-1)?.ui ?? null,
        networkEvents: promptResults.flatMap((result) => result.networkEvents ?? []),
        legacyFailureWindowMs,
        codeAgentTimeoutMs: codeAgentLongTimeoutMs
      }
    };
  } catch (error) {
    const classification = classifyCodeAgentBrowserFailure(error);
    return {
      status: "blocked",
      summary: classification.chineseSummary,
      evidence: ["browser navigation, selector, or POST failed", `category=${classification.category}`],
      observations: { classification }
    };
  } finally {
    if (browser) await browser.close();
  }
}

async function runCodeAgentPromptJourney(page, prompt, options = {}) {
  const agentRequests = [];
  const agentResponses = [];
  const requestListener = (request) => {
    if (!request.url().includes("/v1/agent/chat")) return;
    const body = parseJsonOrNull(request.postData() ?? "");
    agentRequests.push({
      method: request.method(),
      urlPath: new URL(request.url()).pathname,
      traceId: stringOrFallback(body?.traceId, request.headers()["x-trace-id"] ?? "unknown"),
      messageLength: typeof body?.message === "string" ? body.message.length : 0
    });
  };
  const responseListener = async (response) => {
    if (!response.url().includes("/v1/agent/chat")) return;
    let body = null;
    try {
      body = await response.json();
    } catch {
      body = null;
    }
    agentResponses.push({
      method: response.request().method(),
      status: response.status(),
      urlPath: new URL(response.url()).pathname,
      body: sanitizeAgentChatBody(body, { httpStatus: response.status() })
    });
  };
  page.on("request", requestListener);
  page.on("response", responseListener);
  try {
    const beforeMessageCount = await page.locator(".message-card").count();
    await page.locator("#command-input").fill(prompt.text);
    let responseSeenBeforeLegacyWindow = false;
    const responsePromise = page.waitForResponse(
      (response) => response.url().includes("/v1/agent/chat") && response.request().method() === "POST",
      { timeout: codeAgentLongTimeoutMs + 5000 }
    ).then((response) => {
      responseSeenBeforeLegacyWindow = true;
      return response;
    });
    await page.locator("#command-send").click();
    await page.waitForTimeout(legacyFailureWindowMs + 350);
    const legacyWindow = await inspectLegacyFailureWindow(page, { beforeMessageCount });
    legacyWindow.responseSeenBeforeLegacyWindow = responseSeenBeforeLegacyWindow;
    if (legacyWindow.permanentFailureAround4500ms && !responseSeenBeforeLegacyWindow) {
      responsePromise.catch(() => null);
      const ui = await inspectJourneyUi(page).catch(() => null);
      const traceId = agentResponses.at(-1)?.body?.traceId ?? agentRequests.at(-1)?.traceId ?? "unknown";
      return {
        promptId: prompt.id,
        promptLabel: prompt.label,
        status: "blocked",
        summary: `浏览器故障：前端在 ${legacyFailureWindowMs}ms 附近把 Code Agent 请求标为永久失败；traceId=${traceId}。`,
        traceId,
        request: {
          method: "POST",
          status: "not_observed",
          urlPath: "/v1/agent/chat"
        },
        response: blockedAgentChatResponse("frontend-legacy-timeout"),
        classification: {
          status: "blocked",
          blocker: "frontend-legacy-timeout",
          category: "browser",
          chineseSummary: `浏览器故障：前端在 ${legacyFailureWindowMs}ms 附近把 Code Agent 请求标为永久失败；traceId=${traceId}。`,
          reason: "frontend marked Code Agent request as permanent failure around the old 4500ms timeout path"
        },
        ui,
        legacyWindow,
        requestEvents: agentRequests,
        networkEvents: agentResponses
      };
    }
    const response = await responsePromise;
    let responseBody = null;
    try {
      responseBody = await response.json();
    } catch {
      responseBody = null;
    }
    if (options.sourceFixture === true) {
      await page.waitForFunction(
        () => document.querySelector("#agent-chat-status")?.textContent?.trim() === "SOURCE 回复",
        null,
        { timeout: 8000 }
      ).catch(() => null);
    } else {
      await page.waitForTimeout(500);
    }
    const ui = await inspectJourneyUi(page);
    const responseSummary = sanitizeAgentChatBody(responseBody, { httpStatus: response.status() });
    let classification = classifyCodeAgentBrowserJourney({
      responseSummary,
      httpOk: response.ok(),
      httpStatus: response.status(),
      ui
    });
    if (
      options.sourceFixture === true &&
      response.ok() &&
      responseSummary?.status === "completed" &&
      responseSummary?.sourceKind === "SOURCE" &&
      responseSummary?.hasReply === true &&
      ui.agentChatStatus === "SOURCE 回复"
    ) {
      classification = {
        status: "pass",
        blocker: null,
        sourceOnly: true,
        reason: "SOURCE fixture completed through the browser path; this is not DEV-LIVE evidence",
        chineseSummary: "SOURCE fixture 完成：浏览器链路通过，但该证据不能标为 DEV-LIVE。"
      };
    }
    const legacyWindowPass = !legacyWindow.permanentFailureAround4500ms;
    const traceId = responseSummary?.traceId ?? agentResponses.at(-1)?.body?.traceId ?? agentRequests.at(-1)?.traceId ?? "unknown";
    const backendTimeoutMs = backendTimeoutMsFromPayload(responseBody);
    if (
      legacyWindowPass &&
      response.ok() &&
      responseSummary?.status === "failed" &&
      responseSummary?.error?.code === "provider_unavailable" &&
      backendTimeoutMs !== null &&
      backendTimeoutMs >= legacyFailureWindowMs
    ) {
      classification = {
        status: "degraded",
        blocker: null,
        terminalState: "backend-timeout",
        backendTimeoutMs,
        traceId,
        chineseSummary: `后端超时：Code Agent 在配置的长时间边界后返回清晰超时，不是旧 ${legacyFailureWindowMs}ms 前端永久失败；traceId=${traceId}。`,
        reason: "clear backend timeout after the configured longer bound"
      };
    }
    const accepted = ["pass", "degraded"].includes(classification.status) && legacyWindowPass;
    const returnedClassification = accepted ? classification : legacyWindowPass ? classification : {
      status: "blocked",
      blocker: "frontend-legacy-timeout",
      category: "browser",
      chineseSummary: `浏览器故障：前端在 ${legacyFailureWindowMs}ms 附近把 Code Agent 请求标为永久失败；traceId=${traceId}。`,
      reason: "frontend marked heavy Code Agent request as permanent failure around the old 4500ms timeout path"
    };
    return {
      promptId: prompt.id,
      promptLabel: prompt.label,
      status: accepted ? classification.status : "blocked",
      summary: accepted
        ? classification.terminalState === "backend-timeout"
          ? `${prompt.label}返回清晰后端超时，且 ${legacyFailureWindowMs}ms 窗口没有永久失败。`
          : `${prompt.label}完成，且 ${legacyFailureWindowMs}ms 窗口没有永久失败。`
        : returnedClassification.chineseSummary ?? returnedClassification.reason,
      traceId,
      request: {
        method: response.request().method(),
        status: response.status(),
        urlPath: new URL(response.url()).pathname
      },
      response: responseSummary,
      classification: returnedClassification,
      ui,
      legacyWindow,
      requestEvents: agentRequests,
      networkEvents: agentResponses
    };
  } catch (error) {
    const traceId = agentResponses.at(-1)?.body?.traceId ?? agentRequests.at(-1)?.traceId ?? null;
    const classification = classifyCodeAgentBrowserFailure(error, { traceId });
    return {
      promptId: prompt.id,
      promptLabel: prompt.label,
      status: "blocked",
      summary: classification.chineseSummary,
      traceId: traceId ?? "unknown",
      request: {
        method: "POST",
        status: "not_observed",
        urlPath: "/v1/agent/chat"
      },
      response: blockedAgentChatResponse(classification.blocker),
      classification,
      ui: await inspectJourneyUi(page).catch(() => null),
      legacyWindow: null,
      requestEvents: agentRequests,
      networkEvents: agentResponses
    };
  } finally {
    page.off("request", requestListener);
    page.off("response", responseListener);
  }
}

async function inspectJourneyControls(page) {
  return page.evaluate(() => {
    const visible = (selector) => {
      const element = document.querySelector(selector);
      if (!element) return false;
      const style = getComputedStyle(element);
      const box = element.getBoundingClientRect();
      return style.display !== "none" && style.visibility !== "hidden" && box.width > 0 && box.height > 0;
    };
    return {
      appShell: visible("[data-app-shell]"),
      workspace: document.querySelector('[data-view="workspace"]')?.hidden === false,
      commandInput: visible("#command-input"),
      commandSend: visible("#command-send"),
      agentChatStatus: visible("#agent-chat-status"),
      conversationList: visible("#conversation-list"),
      hardwareList: visible("#hardware-list"),
      wiringTab: visible("#tab-wiring"),
      recordsTab: visible("#tab-records")
    };
  });
}

async function inspectJourneyUi(page) {
  return page.evaluate(() => {
    const failedText = [...document.querySelectorAll(".message-card.status-failed")]
      .map((element) => element.textContent ?? "")
      .join("\n");
    const commandValue = document.querySelector("#command-input")?.value ?? "";
    return {
      title: document.title,
      workspaceHidden: document.querySelector('[data-view="workspace"]')?.hidden ?? null,
      gateHidden: document.querySelector('[data-view="gate"]')?.hidden ?? null,
      helpHidden: document.querySelector('[data-view="help"]')?.hidden ?? null,
      agentChatStatus: document.querySelector("#agent-chat-status")?.textContent?.trim() ?? null,
      inputCleared: commandValue === "",
      retryInputPreserved: commandValue === "请用一句话说明当前 HWLAB 工作台可以做什么。",
      completedMessageVisible: Boolean(document.querySelector(".message-card.status-completed")),
      sourceMessageVisible: Boolean(document.querySelector(".message-card.status-source")),
      failedMessageVisible: Boolean(document.querySelector(".message-card.status-failed")),
      failedMessageHasTrace: /trace=trc_/u.test(failedText),
      failedMessageHasChineseTimeout: /请求超过|请求超时|保留输入|重试/u.test(failedText),
      messageCount: document.querySelectorAll(".message-card").length,
      completedMessageHasNonSensitiveMeta: Boolean(
        [...document.querySelectorAll(".message-card.status-completed .message-meta")]
          .some((element) => /openai-responses|gpt-5\.5|trc_/u.test(element.textContent ?? ""))
      ),
      sourceMessageHasNonSensitiveMeta: Boolean(
        [...document.querySelectorAll(".message-card.status-source .message-meta")]
          .some((element) => /SOURCE|source-fixture|trc_/u.test(element.textContent ?? ""))
      )
    };
  });
}

async function inspectLegacyFailureWindow(page, { beforeMessageCount }) {
  return page.evaluate(({ beforeMessageCount, legacyFailureWindowMs }) => {
    const messages = [...document.querySelectorAll(".message-card")];
    const newMessages = messages.slice(beforeMessageCount);
    const failed = newMessages.filter((element) => element.classList.contains("status-failed"));
    const latestAgent = [...newMessages].reverse().find((element) => element.classList.contains("message-agent"));
    const agentChatStatus = document.querySelector("#agent-chat-status")?.textContent?.trim() ?? null;
    const pendingStillRunning =
      latestAgent?.classList.contains("status-running") === true ||
      agentChatStatus === "处理中" ||
      agentChatStatus === "运行中";
    return {
      checkedAtMs: legacyFailureWindowMs,
      beforeMessageCount,
      messageCount: messages.length,
      newMessageCount: newMessages.length,
      agentChatStatus,
      failedMessageVisible: failed.length > 0,
      runningMessageVisible: Boolean(latestAgent?.classList.contains("status-running")),
      permanentFailureAround4500ms: failed.length > 0 && !pendingStillRunning
    };
  }, { beforeMessageCount, legacyFailureWindowMs });
}

function backendTimeoutMsFromPayload(payload) {
  const message = String(payload?.error?.message ?? "");
  const match = message.match(/(?:timed out after|timeout after|请求超时|请求超过)\s*(\d+)\s*ms/iu);
  if (!match) return null;
  const value = Number.parseInt(match[1], 10);
  return Number.isInteger(value) && value > 0 ? value : null;
}

async function inspectDefaultApiStatus(page) {
  return page.evaluate(() => {
    const liveStatus = document.querySelector("#live-status")?.textContent?.trim() ?? "";
    const liveDetail = document.querySelector("#live-detail")?.textContent?.trim() ?? "";
    const methodText = [...document.querySelectorAll("#method-list .badge")].map((element) => element.textContent?.trim() ?? "");
    const firstScreenText = document.querySelector(".topbar")?.textContent?.replace(/\s+/gu, " ").trim() ?? "";
    const forbidden = /Gate|诊断|验收|BLOCKED|M0-M5|执行轨迹|runtime_durable_adapter_query_blocked|DB live readiness/u;
    return {
      liveStatus,
      liveDetail,
      methodText,
      firstScreenText,
      degradedStatusVisible:
        liveStatus === "可信记录受阻 / 只读模式" &&
        liveDetail === "同源 API 可响应，但可信记录持久化尚未就绪；当前只保留只读查看和本地任务整理。" &&
        methodText.includes("system.health"),
      defaultCopyIsWorkbenchSafe: !forbidden.test(`${liveStatus} ${liveDetail} ${firstScreenText}`)
    };
  });
}

export function sanitizeAgentChatBody(body, options = {}) {
  return summarizeCodeAgentPayload(body, options);
}

function blockedAgentChatResponse(code) {
  return {
    status: "failed",
    provider: "not_observed",
    model: "not_observed",
    backend: "not_observed",
    traceId: "not_observed",
    hasReply: false,
    error: {
      code,
      missingEnv: []
    }
  };
}

export async function runDevCloudWorkbenchLocalAgentFixtureSmoke() {
  return runLocalAgentFixtureSmoke({
    mode: "local-agent-fixture-browser",
    responseDelayMs: localAgentFixtureDelayMs,
    expectTimeout: false
  });
}

async function runLocalAgentFixtureSmoke({
  mode,
  responseDelayMs = 0,
  timeoutConfigMs = null,
  expectTimeout = false
} = {}) {
  let chromium;
  try {
    ({ chromium } = await importPlaywright());
  } catch (error) {
    const summary = `Local Code Agent browser fixture smoke skipped because Playwright is unavailable: ${error.message}`;
    return {
      status: "skip",
      task: "DC-DCSN-P0-2026-003",
      mode,
      evidenceLevel: "SOURCE",
      devLive: false,
      summary,
      checks: [
        {
          id: "local-agent-fixture-browser-dependency",
          status: "skip",
          summary: playwrightDependencySummary,
          evidence: [playwrightDependencyCommand, "package.json dependencies.playwright"]
        }
      ],
      blockers: [
        {
          type: "environment_blocker",
          scope: "local-agent-fixture-browser-dependency",
          status: "open",
          summary
        }
      ],
      safety: staticSafety(),
      dependency: {
        package: "playwright",
        declaredIn: "package.json",
        installCommand: playwrightDependencyCommand
      }
    };
  }

  const server = await startStaticWebServer({ agentFixture: true, agentDelayMs: responseDelayMs });
  let browser;
  try {
    browser = await chromium.launch({ headless: true });
    const page = await browser.newPage({ viewport: { width: 1366, height: 768 } });
    if (timeoutConfigMs !== null) {
      await page.addInitScript((timeoutMs) => {
        globalThis.HWLAB_CLOUD_WEB_CONFIG = {
          ...(globalThis.HWLAB_CLOUD_WEB_CONFIG ?? {}),
          timeouts: {
            ...(globalThis.HWLAB_CLOUD_WEB_CONFIG?.timeouts ?? {}),
            codeAgentTimeoutMs: timeoutMs
          }
        };
      }, timeoutConfigMs);
    }
    const agentResponses = [];
    page.on("response", async (response) => {
      if (!response.url().includes("/v1/agent/chat")) return;
      let body = null;
      try {
        body = await response.json();
      } catch {
        body = null;
      }
      agentResponses.push({
        method: response.request().method(),
        status: response.status(),
        urlPath: new URL(response.url()).pathname,
        body: sanitizeAgentChatBody(body, { httpStatus: response.status() })
      });
    });

    await page.goto(server.url, { waitUntil: "networkidle", timeout: 15000 });
    await page.locator("#command-input").waitFor({ state: "visible", timeout: 12000 });
    await page.waitForFunction(
      () => document.querySelector("#live-status")?.textContent?.trim() === "可信记录受阻 / 只读模式",
      null,
      { timeout: 8000 }
    );
    const controls = await inspectJourneyControls(page);
    const apiStatus = await inspectDefaultApiStatus(page);
    let response = null;
    let responseBody = null;
    let responseSummary = null;
    const promptResults = [];
    if (expectTimeout) {
      await page.locator("#command-input").fill(codeAgentE2ePrompts[0].text);
      await page.locator("#command-send").click();
      await page.waitForFunction(
        () => document.querySelector("#agent-chat-status")?.textContent?.trim() === "发送失败",
        null,
        { timeout: 8000 }
      );
    } else {
      for (const prompt of codeAgentE2ePrompts) {
        promptResults.push(await runCodeAgentPromptJourney(page, prompt, { sourceFixture: true }));
        await page.waitForFunction(
          () => document.querySelector("#agent-chat-status")?.textContent?.trim() === "SOURCE 回复",
          null,
          { timeout: 8000 }
        );
      }
    }
    const ui = await inspectJourneyUi(page);
    responseSummary = response ? sanitizeAgentChatBody(responseBody, { httpStatus: response.status() }) : null;
    const pass = expectTimeout
      ? (
          ui.agentChatStatus === "发送失败" &&
          ui.failedMessageVisible &&
          ui.retryInputPreserved &&
          ui.failedMessageHasTrace &&
          ui.failedMessageHasChineseTimeout &&
          !ui.completedMessageVisible
        )
      : (
          promptResults.every((result) =>
            result.status === "pass" &&
            result.response?.status === "completed" &&
            result.response?.sourceKind === "SOURCE" &&
            result.response?.hasReply === true &&
            result.classification?.sourceOnly === true &&
            result.legacyWindow?.permanentFailureAround4500ms === false
          ) &&
          ui.agentChatStatus === "SOURCE 回复" &&
          ui.sourceMessageVisible &&
          ui.sourceMessageHasNonSensitiveMeta &&
          !ui.completedMessageVisible &&
          !ui.failedMessageVisible
        );
    const checks = [
      {
        id: "local-agent-fixture-controls",
        status: Object.values(controls).every(Boolean) ? "pass" : "blocked",
        summary: "Local SOURCE fixture browser smoke can locate the Code Agent input, send button, thread, and right-side evidence panels.",
        observations: controls
      },
      {
        id: "local-api-degraded-default-status",
        status: apiStatus.degradedStatusVisible && apiStatus.defaultCopyIsWorkbenchSafe ? "pass" : "blocked",
        summary: "Default workbench status renders reachable degraded /health/live as API degraded read-only without first-screen backend blocker details.",
        observations: apiStatus
      },
      {
        id: expectTimeout ? "local-agent-timeout-fixture-failed-state" : "local-agent-fixture-replied-state",
        status: pass ? "pass" : "blocked",
        summary: expectTimeout
          ? "Local SOURCE fixture proves a bounded Code Agent timeout stays failed/BLOCKED in the UI, preserves trace evidence, and keeps the user's input for retry."
          : "Local SOURCE fixture sends input and reaches a user-visible replied state without marking the fixture as DEV-LIVE.",
        observations: expectTimeout ? {
          response: responseSummary,
          ui,
          networkEvents: agentResponses
        } : {
          prompts: promptResults,
          ui,
          networkEvents: agentResponses
        }
      }
    ];
    if (!expectTimeout) {
      checks.push({
        id: "local-agent-fixture-no-4500ms-permanent-failure",
        status: promptResults.every((result) => result.legacyWindow?.permanentFailureAround4500ms === false) ? "pass" : "blocked",
        summary: "Local SOURCE fixture delays each Code Agent response beyond 4500ms and the frontend keeps the request pending instead of marking permanent failure.",
        observations: {
          legacyFailureWindowMs,
          fixtureDelayMs: responseDelayMs,
          prompts: promptResults.map((result) => ({
            promptId: result.promptId,
            status: result.status,
            legacyWindow: result.legacyWindow,
            traceId: result.traceId
          }))
        }
      });
    }
    const blockers = checks
      .filter((check) => check.status !== "pass")
      .map((check) => ({
        type: "observability_blocker",
        scope: check.id,
        status: "open",
        summary: check.summary
      }));
    return {
      status: blockers.length === 0 ? "pass" : "blocked",
      task: "DC-DCSN-P0-2026-003",
      mode,
      url: server.url,
      generatedAt: new Date().toISOString(),
      evidenceLevel: "SOURCE",
      devLive: false,
      summary: expectTimeout
        ? "Local browser smoke uses a sanitized slow SOURCE fixture for /v1/agent/chat; it proves timeout UI classification only and does not claim DEV-LIVE."
        : "Local browser smoke uses a sanitized SOURCE fixture for /v1/agent/chat; it proves the UI conversation path only and does not claim DEV-LIVE.",
      checks,
      blockers,
      safety: {
        ...staticSafety(),
        localFixtureOnly: true,
        fixtureTrustBoundary: "SOURCE fixture replies render as SOURCE 回复 and never as DEV-LIVE 回复.",
        legacyFailureWindowMs,
        fixtureDelayMs: responseDelayMs,
        prompts: codeAgentE2ePrompts.map((prompt) => ({ id: prompt.id, label: prompt.label })),
        preservedLiveFields: ["provider", "model", "backend", "conversationId", "traceId", "messageId", "providerTrace"]
      }
    };
  } catch (error) {
    return {
      status: "blocked",
      task: "DC-DCSN-P0-2026-003",
      mode,
      url: server.url,
      generatedAt: new Date().toISOString(),
      evidenceLevel: "SOURCE",
      devLive: false,
      summary: `Local Code Agent browser fixture smoke failed: ${error.message}`,
      checks: [],
      blockers: [
        {
          type: "observability_blocker",
          scope: mode,
          status: "open",
          summary: error.message
        }
      ],
      safety: staticSafety()
    };
  } finally {
    if (browser) await browser.close();
    await server.close();
  }
}

export async function runDevCloudWorkbenchMobileSmoke() {
  let chromium;
  try {
    ({ chromium } = await importPlaywright());
  } catch (error) {
    const summary = `Mobile browser smoke skipped because Playwright is unavailable: ${error.message}`;
    return {
      status: "skip",
      task: "DC-DCSN-P0-2026-003",
      mode: "static-mobile-browser",
      viewport: { width: 390, height: 844 },
      evidenceLevel: "SOURCE",
      devLive: false,
      summary,
      checks: [
        {
          id: "mobile-browser-dependency",
          status: "skip",
          summary: playwrightDependencySummary,
          evidence: [playwrightDependencyCommand, "package.json dependencies.playwright"]
        }
      ],
      blockers: [
        {
          type: "environment_blocker",
          scope: "mobile-browser-dependency",
          status: "open",
          summary
        }
      ],
      safety: staticSafety(),
      dependency: {
        package: "playwright",
        declaredIn: "package.json",
        installCommand: playwrightDependencyCommand
      }
    };
  }

  const server = await startStaticWebServer();
  let browser;
  try {
    browser = await chromium.launch({ headless: true });
    const page = await browser.newPage({
      viewport: { width: 390, height: 844 },
      deviceScaleFactor: 1,
      isMobile: true
    });
    await page.goto(server.url, { waitUntil: "networkidle", timeout: 15000 });
    const closed = await inspectMobileWorkbench(page, { explorerOpen: false });
    const workspaceScroll = await inspectWorkbenchScrollContract(page, { panelSelector: "#conversation-list" });
    await page.click('[data-route="help"]');
    await page.waitForFunction(() => document.querySelector("#help-content")?.dataset.helpState === "ready", null, { timeout: 8000 });
    const help = await inspectHelpMarkdownRoute(page);
    await page.goto(new URL("/#/help", server.url).toString(), { waitUntil: "networkidle", timeout: 15000 });
    await page.waitForFunction(() => document.querySelector("#help-content")?.dataset.helpState === "ready", null, { timeout: 8000 });
    const slashHashHelp = await inspectHelpMarkdownRoute(page);
    await page.goto(new URL("/help", server.url).toString(), { waitUntil: "networkidle", timeout: 15000 });
    await page.waitForFunction(() => document.querySelector("#help-content")?.dataset.helpState === "ready", null, { timeout: 8000 });
    const directHelp = await inspectHelpMarkdownRoute(page);
    await page.click('[data-route="workspace"]');
    await page.waitForFunction(() => document.querySelector('[data-view="workspace"]')?.hidden === false, null, { timeout: 8000 });
    await page.click("#explorer-toggle");
    const open = await inspectMobileWorkbench(page, { explorerOpen: true });
    await page.click('[data-side-tab-jump="wiring"]');
    const afterQuickAction = await inspectMobileWorkbench(page, { explorerOpen: false });
    const checks = [
      {
        id: "mobile-default-workbench",
        status: closed.defaultWorkbenchReachable ? "pass" : "blocked",
        summary: "390x844 default route remains the user workbench with Gate/help as secondary entries.",
        observations: {
          title: closed.title,
          workspaceHidden: closed.workspaceHidden,
          gateHidden: closed.gateHidden,
          helpHidden: closed.helpHidden,
          explorerCollapsed: closed.explorerCollapsed,
          visibleText: closed.visibleText
        }
      },
      {
        id: "mobile-outer-scroll-lock",
        status: workspaceScroll.outerScrollLocked && help.rootStillLocked && help.helpPanelScrolls ? "pass" : "blocked",
        summary: "390x844 page locks outer scrolling while the internal Markdown help pane owns overflow scrolling.",
        observations: {
          workspace: workspaceScroll,
          help: {
            rootStillLocked: help.rootStillLocked,
            helpPanelScrolls: help.helpPanelScrolls,
            helpScroll: help.helpScroll
          }
        }
      },
      {
        id: "mobile-help-markdown-route",
        status: help.nonDefaultMarkdownHelp && help.routeIsHashHelp && help.termsPresent ? "pass" : "blocked",
        summary: "Help opens from the rail as a non-default hash route rendered from help.md by the vendored Markdown renderer.",
        observations: help
      },
      {
        id: "mobile-slash-hash-help-route",
        status: slashHashHelp.nonDefaultMarkdownHelp && slashHashHelp.routeIsSlashHashHelp && slashHashHelp.termsPresent ? "pass" : "blocked",
        summary: "Direct #/help opens the user-facing help view.",
        observations: slashHashHelp
      },
      {
        id: "mobile-direct-help-route",
        status: directHelp.nonDefaultMarkdownHelp && directHelp.routeIsDirectHelp && directHelp.termsPresent ? "pass" : "blocked",
        summary: "Direct /help opens the user-facing help view instead of raw API 404 JSON.",
        observations: directHelp
      },
      {
        id: "mobile-default-hit-test",
        status: closed.primaryControlsReachable ? "pass" : "blocked",
        summary: "Primary workbench controls are center-click reachable with the resource tree closed.",
        observations: {
          reachable: closed.reachable,
          blocked: closed.blocked
        }
      },
      {
        id: "mobile-resource-drawer-hit-test",
        status: open.resourceControlsReachable ? "pass" : "blocked",
        summary: "Opened resource drawer keeps quick actions and resource rows center-click reachable.",
        observations: {
          drawer: open.drawer,
          reachable: open.reachable,
          blocked: open.blocked
        }
      },
      {
        id: "mobile-resource-action-collapse",
        status: afterQuickAction.resourceActionCollapsed ? "pass" : "blocked",
        summary: "Mobile resource quick actions collapse the drawer so the target workspace panel remains reachable.",
        observations: {
          explorerCollapsed: afterQuickAction.explorerCollapsed,
          wiringSelected: afterQuickAction.wiringSelected,
          tabHit: afterQuickAction.reachable.find((target) => target.label === "接线")
        }
      }
    ];
    const blockers = checks
      .filter((check) => check.status !== "pass")
      .map((check) => ({
        type: "runtime_blocker",
        scope: check.id,
        status: "open",
        summary: check.summary
      }));
    return {
      status: blockers.length === 0 ? "pass" : "blocked",
      task: "DC-DCSN-P0-2026-003",
      mode: "static-mobile-browser",
      viewport: { width: 390, height: 844 },
      url: server.url,
      generatedAt: new Date().toISOString(),
      evidenceLevel: "SOURCE",
      devLive: false,
      summary: "Static local browser smoke only; deployment still requires post-deploy live smoke.",
      checks,
      blockers,
      safety: staticSafety()
    };
  } catch (error) {
    return {
      status: "blocked",
      task: "DC-DCSN-P0-2026-003",
      mode: "static-mobile-browser",
      viewport: { width: 390, height: 844 },
      url: server.url,
      generatedAt: new Date().toISOString(),
      evidenceLevel: "SOURCE",
      devLive: false,
      summary: `Mobile browser smoke failed: ${error.message}`,
      checks: [],
      blockers: [
        {
          type: "runtime_blocker",
          scope: "mobile-browser-smoke",
          status: "open",
          summary: error.message
        }
      ],
      safety: staticSafety()
    };
  } finally {
    if (browser) await browser.close();
    await server.close();
  }
}

async function startStaticWebServer(options = {}) {
  const server = http.createServer(async (request, response) => {
    const url = new URL(request.url ?? "/", "http://127.0.0.1");
    if (options.agentFixture && await handleLocalAgentFixtureApi({ request, response, url, options })) {
      return;
    }
    let pathname = decodeURIComponent(url.pathname);
    if (pathname === "/" || pathname === "/workbench" || pathname === "/gate" || pathname === "/diagnostics/gate" || pathname === "/help") {
      pathname = "/index.html";
    }
    const filePath = path.resolve(webRoot, pathname.replace(/^\/+/, ""));
    if (!filePath.startsWith(webRoot)) {
      response.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
      response.end("forbidden");
      return;
    }
    try {
      const body = await fs.promises.readFile(filePath);
      response.writeHead(200, { "content-type": contentTypeFor(filePath) });
      response.end(body);
    } catch {
      response.writeHead(404, { "content-type": "application/json; charset=utf-8" });
      response.end(JSON.stringify({ ok: false, error: "not_found" }));
    }
  });
  await new Promise((resolve, reject) => {
    server.once("error", reject);
    server.listen(0, "127.0.0.1", resolve);
  });
  const address = server.address();
  return {
    url: `http://127.0.0.1:${address.port}/`,
    close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
  };
}

async function handleLocalAgentFixtureApi({ request, response, url, options = {} }) {
  if (request.method === "GET" && (url.pathname === "/health/live" || url.pathname === "/v1")) {
    jsonResponse(response, 200, {
      serviceId: "hwlab-cloud-api",
      status: "degraded",
      ready: false,
      sourceKind: "SOURCE",
      codeAgent: localSourceFixtureAvailability(),
      methods: [...readOnlyRpcMethods],
      runtime: {
        durable: false,
        ready: false,
        status: "degraded",
        blocker: "runtime_durable_adapter_query_blocked",
        connection: {
          queryAttempted: true,
          queryResult: "query_blocked"
        },
        counts: {
          gatewaySessions: gateSummary.gatewaySessionCount,
          boxResources: gateSummary.boxResourceCount
        }
      },
      readiness: {
        status: "degraded",
        ready: false,
        durability: {
          status: "blocked",
          ready: false,
          blocker: "runtime_durable_adapter_query_blocked",
          blockedLayer: "durability_query",
          queryResult: "query_blocked"
        }
      },
      blockerCodes: ["runtime_durable_adapter_query_blocked"]
    });
    return true;
  }
  if (request.method === "POST" && url.pathname === "/json-rpc") {
    const body = await readJsonBody(request);
    jsonResponse(response, 200, {
      jsonrpc: "2.0",
      id: body?.id ?? "req_source_fixture",
      result: localRpcFixtureResult(body?.method)
    });
    return true;
  }
  if (request.method === "POST" && url.pathname === "/v1/agent/chat") {
    const body = await readJsonBody(request);
    await delay(options.agentDelayMs ?? 0);
    const timestamp = "2026-05-22T00:00:00.000Z";
    const conversationId = stringOrFallback(body?.conversationId, "cnv_source_fixture_browser");
    const normalizedMessage = String(body?.message ?? "");
    const isSkillListPrompt = /列出你能使用的所有skill/u.test(normalizedMessage);
    const messageId = isSkillListPrompt ? "msg_source_fixture_browser_skills" : "msg_source_fixture_browser_simple";
    jsonResponse(response, 200, {
      conversationId,
      sessionId: conversationId,
      messageId,
      status: "completed",
      sourceKind: "SOURCE",
      evidenceLevel: "SOURCE",
      createdAt: timestamp,
      updatedAt: timestamp,
      traceId: stringOrFallback(body?.traceId, "trc_source_fixture_browser"),
      provider: "source-fixture",
      model: "gpt-source-fixture",
      backend: "local-source-fixture",
      projectId: stringOrFallback(body?.projectId, gateSummary.topology.projectId),
      reply: {
        messageId,
        role: "assistant",
        content: isSkillListPrompt
          ? "SOURCE fixture 回复：可用 skill 列表需要由真实运行时返回；本地只验证浏览器长请求链路。"
          : "SOURCE fixture 回复：HWLAB 工作台可以整理任务、查看资源，并保持硬件变更受控。",
        createdAt: timestamp
      },
      usage: null,
      providerTrace: {
        source: "SOURCE-local-browser-fixture",
        sourceKind: "SOURCE",
        responseId: "rsp_source_fixture_sanitized",
        redacted: true
      }
    });
    return true;
  }
  return false;
}

function delay(ms) {
  const normalized = Number.isFinite(Number(ms)) && Number(ms) > 0 ? Number(ms) : 0;
  return new Promise((resolve) => setTimeout(resolve, normalized));
}

function localSourceFixtureAvailability() {
  return {
    endpoint: "POST /v1/agent/chat",
    provider: "source-fixture",
    model: "gpt-source-fixture",
    backend: "local-source-fixture",
    mode: "local-source-fixture",
    status: "available",
    sourceKind: "SOURCE",
    evidenceLevel: "SOURCE",
    ready: true,
    summary: "Local browser smoke SOURCE fixture; it is not DEV-LIVE provider evidence.",
    missingEnv: [],
    secretRefs: [],
    safety: {
      localFixtureOnly: true,
      secretsRead: false,
      valuesRedacted: true
    }
  };
}

function localRpcFixtureResult(method) {
  if (method === "system.health" || method === "cloud.adapter.describe") {
    return {
      status: "degraded",
      sourceKind: "SOURCE",
      methods: [...readOnlyRpcMethods],
      runtime: {
        durable: false,
        counts: {
          gatewaySessions: gateSummary.gatewaySessionCount,
          boxResources: gateSummary.boxResourceCount
        }
      }
    };
  }
  if (method === "audit.event.query") {
    return { count: 0, events: [] };
  }
  if (method === "evidence.record.query") {
    return { count: 0, records: [] };
  }
  return { status: "not_implemented", sourceKind: "SOURCE" };
}

async function readJsonBody(request) {
  const chunks = [];
  for await (const chunk of request) {
    chunks.push(chunk);
  }
  const text = Buffer.concat(chunks).toString("utf8");
  if (!text.trim()) return null;
  try {
    return JSON.parse(text);
  } catch {
    return null;
  }
}

function parseJsonOrNull(text) {
  try {
    return JSON.parse(text);
  } catch {
    return null;
  }
}

function jsonResponse(response, status, body) {
  response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
  response.end(JSON.stringify(body));
}

function stringOrFallback(value, fallback) {
  return typeof value === "string" && value.trim() ? value.trim() : fallback;
}

function contentTypeFor(filePath) {
  if (filePath.endsWith(".html")) return "text/html; charset=utf-8";
  if (filePath.endsWith(".css")) return "text/css; charset=utf-8";
  if (filePath.endsWith(".mjs") || filePath.endsWith(".js")) return "text/javascript; charset=utf-8";
  if (filePath.endsWith(".md")) return "text/markdown; charset=utf-8";
  return "application/octet-stream";
}

async function inspectMobileWorkbench(page, { explorerOpen }) {
  return page.evaluate(async ({ explorerOpen }) => {
    function visibleTextFor(selector) {
      const element = document.querySelector(selector);
      return element?.textContent?.replace(/\s+/gu, " ").trim() ?? "";
    }
    function boxFor(selector) {
      const element = document.querySelector(selector);
      if (!element) return null;
      const box = element.getBoundingClientRect();
      return {
        left: box.left,
        top: box.top,
        right: box.right,
        bottom: box.bottom,
        width: box.width,
        height: box.height,
        display: getComputedStyle(element).display
      };
    }
    function ownsHit(element, hit) {
      return hit === element || element.contains(hit);
    }
    function inspectTarget(element, label = element.id || element.textContent?.trim() || element.tagName) {
      const box = element.getBoundingClientRect();
      const cx = box.left + box.width / 2;
      const cy = box.top + box.height / 2;
      const hit = document.elementFromPoint(cx, cy);
      const hitLabel = hit ? `${hit.tagName.toLowerCase()}${hit.id ? `#${hit.id}` : ""}${hit.className ? `.${String(hit.className).trim().replace(/\s+/gu, ".")}` : ""}` : "none";
      return {
        label: label.replace(/\s+/gu, " ").trim(),
        ok: box.width > 0 && box.height > 0 && cx >= 0 && cx <= window.innerWidth && cy >= 0 && cy <= window.innerHeight && ownsHit(element, hit),
        center: { x: cx, y: cy },
        box: { left: box.left, top: box.top, right: box.right, bottom: box.bottom, width: box.width, height: box.height },
        hit: hitLabel
      };
    }
    function inspectSelector(selector, label) {
      const element = document.querySelector(selector);
      if (!element) {
        return { label, ok: false, missing: true };
      }
      return inspectTarget(element, label);
    }
    async function inspectScrollableTargets(selector) {
      const targets = [...document.querySelectorAll(selector)];
      const results = [];
      for (const target of targets) {
        target.scrollIntoView({ block: "center", inline: "nearest" });
        await new Promise((resolve) => requestAnimationFrame(resolve));
        results.push(inspectTarget(target));
      }
      return results;
    }

    const defaultTargets = [
      inspectSelector('[data-route="workspace"]', "工作台"),
      inspectSelector('[data-route="gate"]', "内部复核"),
      inspectSelector('[data-route="help"]', "使用说明"),
      inspectSelector("#explorer-toggle", "资源树"),
      inspectSelector("#command-input", "Agent 输入"),
      inspectSelector("#command-send", "发送"),
      inspectSelector("#command-clear", "清空"),
      inspectSelector("#tab-control", "控制"),
      inspectSelector("#tab-wiring", "接线"),
      inspectSelector("#tab-records", "可信记录")
    ];
    const drawerTargets = explorerOpen
      ? [
          ...[...document.querySelectorAll(".quick-actions button")].map((element) => inspectTarget(element)),
          ...(await inspectScrollableTargets("#resource-tree summary, #resource-tree .tree-row"))
        ]
      : [];
    const reachable = explorerOpen ? drawerTargets : defaultTargets;
    const blocked = reachable.filter((target) => !target.ok);
    const text = document.body.textContent ?? "";
    const workspace = document.querySelector('[data-view="workspace"]');
    const gate = document.querySelector('[data-view="gate"]');
    const help = document.querySelector('[data-view="help"]');
    const shell = document.querySelector("[data-app-shell]");
    const drawer = boxFor("#resource-explorer");
    return {
      title: document.title,
      workspaceHidden: workspace ? workspace.hidden : null,
      gateHidden: gate ? gate.hidden : null,
      helpHidden: help ? help.hidden : null,
      explorerCollapsed: shell?.classList.contains("explorer-collapsed") ?? null,
      visibleText: {
        bodyHasWorkbench: text.includes("用户工作台") && text.includes("Agent 对话"),
        gateIsSecondaryLabel: text.includes("内部复核"),
        helpIsSecondaryLabel: text.includes("使用说明"),
        visibleWorkspaceText: visibleTextFor(".center-workspace").slice(0, 160)
      },
      drawer,
      defaultWorkbenchReachable:
        document.title === "HWLAB 云工作台" &&
        workspace?.hidden === false &&
        gate?.hidden === true &&
        help?.hidden === true &&
        text.includes("用户工作台") &&
        text.includes("Agent 对话") &&
        text.includes("内部复核") &&
        text.includes("使用说明"),
      primaryControlsReachable: defaultTargets.every((target) => target.ok),
      resourceControlsReachable: drawerTargets.length >= 8 && drawerTargets.every((target) => target.ok),
      resourceActionCollapsed:
        !explorerOpen &&
        shell?.classList.contains("explorer-collapsed") === true &&
        document.querySelector("#tab-wiring")?.getAttribute("aria-selected") === "true",
      wiringSelected: document.querySelector("#tab-wiring")?.getAttribute("aria-selected") === "true",
      reachable,
      blocked
    };
  }, { explorerOpen });
}

async function inspectWorkbenchScrollContract(page, { panelSelector }) {
  return page.evaluate(async ({ panelSelector }) => {
    function metrics(selector) {
      const element = selector === "html" ? document.documentElement : selector === "body" ? document.body : document.querySelector(selector);
      if (!element) return null;
      const style = getComputedStyle(element);
      return {
        selector,
        overflow: style.overflow,
        overflowY: style.overflowY,
        height: element.getBoundingClientRect().height,
        clientHeight: element.clientHeight,
        scrollHeight: element.scrollHeight,
        scrollTop: element.scrollTop
      };
    }

    window.scrollTo(0, 240);
    document.documentElement.scrollTop = 240;
    document.body.scrollTop = 240;
    await new Promise((resolve) => requestAnimationFrame(resolve));
    const rootAfterScrollAttempt = {
      windowScrollY: window.scrollY,
      htmlScrollTop: document.documentElement.scrollTop,
      bodyScrollTop: document.body.scrollTop
    };

    const panel = document.querySelector(panelSelector);
    const beforePanelScroll = panel?.scrollTop ?? null;
    if (panel) {
      panel.scrollTop = 0;
      await new Promise((resolve) => requestAnimationFrame(resolve));
      panel.scrollTop = panel.scrollHeight;
      await new Promise((resolve) => requestAnimationFrame(resolve));
    }
    const afterPanelScroll = panel?.scrollTop ?? null;
    const html = metrics("html");
    const body = metrics("body");
    const shell = metrics("[data-app-shell]");
    const panelMetrics = metrics(panelSelector);
    const rootScrollLocked =
      html?.overflow === "hidden" &&
      body?.overflow === "hidden" &&
      Math.abs((shell?.height ?? 0) - window.innerHeight) <= 2 &&
      document.documentElement.scrollHeight <= document.documentElement.clientHeight + 2 &&
      document.body.scrollHeight <= document.body.clientHeight + 2 &&
      window.scrollY === 0 &&
      document.documentElement.scrollTop === 0 &&
      document.body.scrollTop === 0;
    return {
      viewport: { width: window.innerWidth, height: window.innerHeight },
      outerScrollLocked: rootScrollLocked,
      panelScrolls: Boolean(panelMetrics && panelMetrics.scrollHeight > panelMetrics.clientHeight && afterPanelScroll > beforePanelScroll),
      rootAfterScrollAttempt,
      html,
      body,
      shell,
      panel: panelMetrics
    };
  }, { panelSelector });
}

async function inspectHelpMarkdownRoute(page) {
  return page.evaluate(async () => {
    const workspace = document.querySelector('[data-view="workspace"]');
    const gate = document.querySelector('[data-view="gate"]');
    const help = document.querySelector('[data-view="help"]');
    const helpContent = document.querySelector("#help-content");
    const heading = helpContent?.querySelector("h1");
    const renderedLists = helpContent?.querySelectorAll("li").length ?? 0;
    const codeCount = helpContent?.querySelectorAll("code").length ?? 0;
    const text = helpContent?.textContent ?? "";
    const helpScroll = await (async () => {
      if (!helpContent) return null;
      helpContent.scrollTop = 0;
      await new Promise((resolve) => requestAnimationFrame(resolve));
      const before = helpContent.scrollTop;
      helpContent.scrollTop = helpContent.scrollHeight;
      await new Promise((resolve) => requestAnimationFrame(resolve));
      return {
        before,
        after: helpContent.scrollTop,
        clientHeight: helpContent.clientHeight,
        scrollHeight: helpContent.scrollHeight,
        overflowY: getComputedStyle(helpContent).overflowY
      };
    })();
    const rootStillLocked =
      getComputedStyle(document.documentElement).overflow === "hidden" &&
      getComputedStyle(document.body).overflow === "hidden" &&
      document.documentElement.scrollHeight <= document.documentElement.clientHeight + 2 &&
      document.body.scrollHeight <= document.body.clientHeight + 2;
    return {
      hash: window.location.hash,
      pathname: window.location.pathname,
      helpState: helpContent?.dataset.helpState ?? null,
      workspaceHidden: workspace ? workspace.hidden : null,
      gateHidden: gate ? gate.hidden : null,
      helpHidden: help ? help.hidden : null,
      heading: heading?.textContent?.trim() ?? null,
      renderedLists,
      codeCount,
      hasRawMarkdownHeading: Boolean(helpContent?.textContent?.includes("# 云工作台内部使用说明")),
      termsPresent:
        ["左侧资源与功能导航", "Agent 对话与工作清单", "same-origin", "/v1", ":16666"].every((term) => text.includes(term)) &&
        codeCount >= 8,
      helpPanelScrolls: Boolean(helpScroll && helpScroll.scrollHeight > helpScroll.clientHeight && helpScroll.after > helpScroll.before),
      rootStillLocked,
      helpScroll,
      routeIsHashHelp: window.location.hash === "#help",
      routeIsSlashHashHelp: window.location.hash === "#/help",
      routeIsDirectHelp: (window.location.pathname.replace(/\/+$/, "") || "/") === "/help",
      nonDefaultMarkdownHelp:
        (window.location.hash === "#help" || window.location.hash === "#/help" || (window.location.pathname.replace(/\/+$/, "") || "/") === "/help") &&
        workspace?.hidden === true &&
        gate?.hidden === true &&
        help?.hidden === false &&
        helpContent?.dataset.helpState === "ready" &&
        heading?.textContent?.trim() === "云工作台内部使用说明" &&
        renderedLists >= 8 &&
        codeCount >= 8 &&
        !helpContent?.textContent?.includes("# 云工作台内部使用说明") &&
        rootStillLocked &&
        Boolean(helpScroll && helpScroll.scrollHeight > helpScroll.clientHeight && helpScroll.after > helpScroll.before)
    };
  });
}

function escapeRegExp(value) {
  return String(value).replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
}

export function printSmokeHelp() {
  return {
    status: "usage",
    command: "node scripts/dev-cloud-workbench-smoke.mjs --source | --mobile | --local-agent-fixture | --local-agent-timeout-fixture | --live --confirm-dev-live --url http://74.48.78.17:16666/ [--report reports/dev-gate/dev-cloud-workbench-live.json]",
    notes: [
      "Default/source mode reads repository files and emits SOURCE-level evidence only; it never calls the live provider and must not claim DEV-LIVE.",
      "--mobile runs a local static 390x844 browser hit-test and still emits SOURCE-level evidence only.",
      "--local-agent-fixture runs two local browser send/reply paths with a sanitized SOURCE fixture delayed beyond 4500ms and does not claim DEV-LIVE.",
      "--local-agent-timeout-fixture runs a local slow SOURCE fixture to verify bounded timeout UI classification and retry preservation without live acceptance.",
      "DEV-LIVE mode requires --live --confirm-dev-live, opens the deployed workbench in a browser, sends the simple Chinese prompt and 列出你能使用的所有skill, and retains only non-sensitive response fields."
    ]
  };
}