SNAPSHOT W7 已部署稳定态 — 凯迪ERP+OA一体化平台 (MET 73.3%)

恢复点(restore point)。别人改崩后可 git reset --hard 回到此提交。

== 此快照内容 ==
- 后端 oa-backend: 734 控制器 / 711 实体 (Spring Boot 3.2.5 + SQLite, 端口8091)
- 前端 modern-ui/app: Vue3+Vite, 约700页 (构建产物已在 oa-backend/src/main/resources/static)
- 数据库 oa-backend/data/oa.db: 含全部演示数据 (强制入库, 6.6MB)
- 交接文档 go.md + go-code-reference/endpoints/entities/database.md
- 多代理建设脚本 .claude/wf-*.js

== 状态 ==
- 对 凯迪科技ERP_20260507.xlsx 合规 MET ~73.3% (PARTIAL 75: 34可建+6种子/bug+35外部硬天花板)
- 安全: 5轮红队+5轮复检, default-deny分级鉴权, 连续零可利用
- W3~W7 累计补完436缺口; W8末轮(40缺口)为半成品(源码树可编译但未集成)
- 运行: cd oa-backend; java -jar build/libs/oa-backend-0.1.0.jar --server.port=8091; admin/123456

== 排除(gitignore, 可再生) ==
node_modules / oa-backend/build / .jdks / *.log / Backup-ERP-* / 弃用的OFBiz核心(只保留modern-ui)
完整文件夹备份见同目录 Backup-ERP-20260615-191517/ (含上述全部, 仅缺 node_modules)

时间戳: 20260615-191517

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ofbiz-framework/plugins/modern-ui/app/scripts/lib/verify-browser-runtime-policy.mjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { readFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const scriptPath = fileURLToPath(import.meta.url)
+const scriptsRoot = path.resolve(path.dirname(scriptPath), '..')
+
+const files = {
+  browserRuntime: path.join(scriptsRoot, 'verify-browser-runtime.mjs'),
+  adminRuntime: path.join(scriptsRoot, 'verify-admin-runtime.mjs'),
+  screenshots: path.join(scriptsRoot, 'capture-admin-screenshots.mjs'),
+  chromeCdp: path.join(scriptsRoot, 'lib/chrome-cdp.mjs'),
+  network: path.join(scriptsRoot, 'lib/runtime-network.mjs')
+}
+
+const sources = Object.fromEntries(await Promise.all(
+  Object.entries(files).map(async ([id, file]) => [id, await readFile(file, 'utf8')])
+))
+
+const checks = [
+  {
+    id: 'browser-runtime-defaults-to-one-cdp-setup-attempt',
+    passed: sources.browserRuntime.includes("positiveIntegerEnv('MODERN_UI_BROWSER_SETUP_ATTEMPTS', 1)")
+  },
+  {
+    id: 'admin-runtime-defaults-to-one-cdp-setup-attempt',
+    passed: sources.adminRuntime.includes("positiveIntegerEnv('MODERN_UI_BROWSER_SETUP_ATTEMPTS', 1)")
+      && !sources.adminRuntime.includes('attempt <= 3')
+  },
+  {
+    id: 'screenshots-default-to-one-base-url-and-browser-attempt',
+    passed: sources.screenshots.includes("positiveIntegerEnv('MODERN_UI_BASE_URL_ATTEMPTS', 1)")
+      && sources.screenshots.includes("positiveIntegerEnv('MODERN_UI_BROWSER_ATTEMPTS', 1)")
+  },
+  {
+    id: 'runtime-scripts-route-unavailable-iab-to-chrome-cdp',
+    passed: [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('local Chrome/CDP'))
+      && sources.network.includes('Do not switch to Codex in-app Browser (iab).')
+      && sources.chromeCdp.includes('codexInAppBrowser')
+      && sources.chromeCdp.includes('localChromeCdp')
+      && sources.chromeCdp.includes('boundedAttempts')
+      && sources.chromeCdp.includes('agent.browsers.list()')
+      && [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('summarizeBrowserSetupFailure'))
+  },
+  {
+    id: 'browser-setup-failures-are-classified-and-bounded',
+    passed: sources.chromeCdp.includes('createBrowserSetupTracker')
+      && sources.chromeCdp.includes('summarizeBrowserSetupFailure')
+      && sources.chromeCdp.includes('classifyBrowserSetupError')
+      && [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('createBrowserSetupTracker'))
+      && [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('summarizeBrowserSetupFailure'))
+      && [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('browserSetup'))
+  },
+  {
+    id: 'targeted-single-page-selection-remains-supported',
+    passed: sources.adminRuntime.includes('MODERN_UI_ADMIN_RUNTIME_CASES')
+      && sources.adminRuntime.includes('selectedRuntimeCases()')
+      && sources.screenshots.includes('MODERN_UI_SCREENSHOT_IDS')
+      && sources.screenshots.includes('selectedScreenshots()')
+  },
+  {
+    id: 'screenshots-report-console-errors',
+    passed: sources.screenshots.includes('actionableConsoleErrors')
+      && sources.screenshots.includes('consoleErrors:')
+      && sources.screenshots.includes('ignoredConsoleErrors:')
+  },
+  {
+    id: 'localhost-blocker-messages-include-rerun-command',
+    passed: [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('npm --prefix plugins/modern-ui/app'))
+      && [sources.browserRuntime, sources.adminRuntime, sources.screenshots].every((source) => source.includes('MODERN_UI_BASE_URL'))
+      && sources.network.includes('EPERM')
+  }
+]
+
+const failed = checks.filter((check) => !check.passed)
+console.log(JSON.stringify({
+  status: failed.length ? 'failed' : 'passed',
+  checkedFiles: files,
+  checks
+}, null, 2))
+
+if (failed.length) {
+  process.exitCode = 1
+}