feat: 支持受控外部表单工作流

scripts/src/hwlab-node-help.ts

@@ -97,6 +97,7 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "bun scripts/cli.ts web-probe product-smoke --product apistate --target NC01 --profile operations",
       "bun scripts/cli.ts web-probe product-smoke --product apistate --target NC01 --profile operations --runtime native",
       "bun scripts/cli.ts web-probe product-smoke --product temporal --target NC01 --profile admin-readonly",
+      "bun scripts/cli.ts web-probe external-form --help",
       "bun scripts/cli.ts web-probe script --node <node> --lane <lane> --origin internal --script-file .state/probes/workbench.mjs",
       "bun scripts/cli.ts web-probe screenshot --node <node> --lane <lane> --origin internal --path /workbench --viewport 1440x900",
       "bun scripts/cli.ts web-probe observe start --node <node> --lane <lane> --origin internal --target-path /workbench --sample-interval-ms 5000",
@@ -108,8 +109,6 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "bun scripts/cli.ts web-probe observe status webobs-xxxx",
       "bun scripts/cli.ts web-probe observe collect webobs-xxxx --view turn-summary",
       "bun scripts/cli.ts web-probe observe collect webobs-xxxx --view workbench-triad --trace-id trc_xxxx",
-      "bun scripts/cli.ts web-probe observe collect webobs-xxxx --view performance-summary",
-      "bun scripts/cli.ts web-probe observe collect webobs-xxxx --view timeline --command-id cmd-xxxx",
       "bun scripts/cli.ts web-probe observe collect webobs-xxxx --view project-mdtodo-summary",
       "bun scripts/cli.ts web-probe observe analyze webobs-xxxx",
       "bun scripts/cli.ts web-probe observe gc --node JD01 --lane v03 --dry-run",
@@ -123,8 +122,6 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "bun scripts/cli.ts web-probe sentinel dashboard trigger --node JD01 --lane v03 --sentinel jd01-web-probe-sentinel",
       "bun scripts/cli.ts web-probe sentinel inspect-url 'https://monitor.pikapython.com/?run=sentinel-run-xxxx'",
       "bun scripts/cli.ts web-probe sentinel inspect-id webobs-xxxx --node JD01 --lane v03 --sentinel jd01-web-probe-sentinel",
-      "bun scripts/cli.ts web-probe sentinel report --node <node> --lane <lane> --sentinel workbench-dsflash-go-tool-call-10x --latest --view summary --raw",
-      "bun scripts/cli.ts web-probe sentinel report --node <node> --lane <lane> --sentinel workbench-dsflash-go-tool-call-10x --latest --view summary --full",
       "bun scripts/cli.ts web-probe sentinel maintenance stop --node <node> --lane <lane> --sentinel workbench-dsflash-go-tool-call-10x --confirm --wait --release-id <id>",
     ],
     actions: {
@@ -133,6 +130,7 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "console-verify": "Run a YAML-profiled Cloud Console route and viewport matrix with optional Projects, HWPOD, MDTODO and AgentRun interaction contracts.",
       "native-readiness": "从 owning YAML 解析 L1 公网 IP 和端口，并单次完成 DOM、交互、浏览器错误、关键失败响应与截图验收。",
       "product-smoke": "按产品 owning YAML 执行受控登录和页面验证，支持 API、表单及 Basic Auth 认证合同。",
+      "external-form": "执行声明式外部表单，支持 Secret 注入、验证码暂停续填和默认禁止不可逆提交。",
       script: "Run caller-provided Playwright JS after CLI-managed /auth/login; scripts must not handle secrets themselves.",
       screenshot: "Capture a page through the selected YAML semantic origin and node/lane remote browser, then download PNG artifacts to the caller /tmp by default.",
       observe: "Start, inspect, control, stop, collect, analyze, and garbage-collect raw artifacts for long-running observers.",
@@ -147,7 +145,7 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "`web-probe opencode-smoke` is the repo-owned OpenCode smoke; prefer it over repeating one-off OpenCode Playwright snippets.",
       "`web-probe console-verify` reads route, viewport, selector, workflow, wait and evidence bounds from the selected owning YAML profile and reuses the existing authenticated script runner.",
       "`web-probe native-readiness` 只接受 node、lane 和 YAML profile；公网 IP、端口、路径、selector、交互与失败判据禁止由 URL 参数覆盖。",
-      "`web-probe product-smoke` 从产品 YAML 和 Secret sourceRef 读取运行目标、认证合同与凭据，仅输出 presence、fingerprint、DOM/网络摘要及工件哈希。",
+      "`web-probe product-smoke` 从产品 YAML 和 Secret sourceRef 读取目标、认证合同与凭据，仅输出 presence、fingerprint、DOM/网络摘要及工件哈希。",
       "observe is passive by default; user actions must be explicit observe command entries in control.jsonl.",
       "observe gc keeps manifest, heartbeat, control/error logs and analysis reports, and only removes dead-run raw samples/browser/network/screenshot artifacts after YAML-configured retention.",
       "After observe start, prefer observe status|command|stop|collect|analyze <id> instead of repeating --node/--lane/--state-dir.",
@@ -160,7 +158,6 @@ export function hwlabNodeWebProbeHelp(): Record<string, unknown> {
       "collect views render bounded summaries from existing artifacts and do not create a second source of truth.",
       "performanceCapture records an explicit bounded Chrome CPU profile and drains LongTask/LoAF/event-loop-gap artifacts; performance-summary reads existing artifacts only.",
       "analyze is offline-only: it reads artifact JSONL and writes analysis/report.md plus analysis/report.json.",
-      "For monitor-web links or page evidence ids, start with `web-probe sentinel inspect-url` or `inspect-id`; default evidence must be controlled report/observe CLI output, not direct public API curl.",
       "`web-probe sentinel report --raw` returns bounded issue evidence JSON, including report/artifact SHA and root-cause signal summaries when available; use `--full` for the full indexed service payload.",
       "When multiple web-probe sentinels are declared, sentinel image/control-plane/validate/maintenance/dashboard/report require `--sentinel <id>`; plan/status without it show the registry drill-down.",
       "Issue evidence should cite observer id, stateDir, report SHA, screenshot SHA, command ids and concise summaries, not prompt/provider/secret payloads.",