Harden auth/vault path sanitization and clean WeKnora docs

scripts/task-pi-lab-real-extension-mcp-matrix-smoke.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
+const { loginViaAuthForm, withAdminBrowserSession } = require('./lib/browser-auth-login');
 const assert = require("node:assert");
 const fs = require("node:fs");
 const os = require("node:os");
@@ -108,13 +109,30 @@ function mkdirp(dir) {
 }
 
 async function quickLogin(page) {
-  await page.goto(`${BASE}/auth`, { waitUntil: "commit", timeout: TIMEOUT });
-  const quickLoginButton = page.getByRole("button", { name: "测试账号快速登录" });
-  await quickLoginButton.waitFor({ state: "visible", timeout: TIMEOUT });
-  await Promise.all([
-    page.waitForURL((url) => !url.toString().includes("/auth"), { timeout: TIMEOUT }).catch(() => null),
-    quickLoginButton.click(),
-  ]);
+  // 7-76 P0: 标准表单登录（无测试快速登录按钮）
+  const base =
+    (typeof BASE_URL !== "undefined" && BASE_URL) ||
+    (typeof baseUrl !== "undefined" && baseUrl) ||
+    process.env.MNOTE_UI_BASE_URL ||
+    "http://127.0.0.1:3000";
+  const timeout =
+    (typeof UI_TIMEOUT_MS !== "undefined" && UI_TIMEOUT_MS) ||
+    (typeof TIMEOUT !== "undefined" && TIMEOUT) ||
+    30_000;
+  if (!String(page.url() || "").includes("/auth")) {
+    await page.goto(String(base).replace(/\/+$/, "") + "/auth", {
+      waitUntil: "commit",
+      timeout,
+    });
+  }
+  await loginViaAuthForm(page, {
+    baseUrl: base,
+    timeoutMs: timeout,
+    gotoAuth: false,
+  });
+  await page
+    .waitForURL((url) => !String(url).includes("/auth"), { timeout })
+    .catch(() => {});
 }
 
 async function requestJson(page, url, options = {}) {
@@ -259,48 +277,51 @@ function policyForMatrix() {
   };
 }
 
-async function seedWorkspace(page) {
+async function seedWorkspace(browser, page) {
   mkdirp(ROOT_PATH);
   fs.writeFileSync(
     path.join(ROOT_PATH, "pi-extension-mcp-matrix.md"),
     "# Pi extension and MCP matrix smoke\n",
     "utf8",
   );
-  const grantResponse = await page.request.fetch(`${BASE}/api/admin/access-policy/grants`, {
-    method: "POST",
-    headers: {
-      accept: "application/json",
-      "content-type": "application/json",
-    },
-    data: {
-      userId: ACTOR_ID,
-      rootUri: ROOT_URI,
-      rootPath: ROOT_PATH,
-      permission: "write",
-      recursive: true,
-      capabilities: ["ai"],
-    },
-    timeout: TIMEOUT,
-  });
-  const grantText = await grantResponse.text();
-  let grantBody = {};
-  try {
-    grantBody = grantText ? JSON.parse(grantText) : {};
-  } catch {
-    grantBody = { raw: grantText };
-  }
-  if (!grantResponse.ok() && grantBody.code !== "local_access_policy_grant_duplicate") {
-    throw new Error(
-      `POST /api/admin/access-policy/grants failed: ${grantResponse.status()} ${grantText.slice(0, 1000)}`,
-    );
-  }
-  await requestJson(page, "/api/ai-admin/settings", {
-    method: "PUT",
-    data: {
-      ...policyForMatrix(),
-      quota: { daily: 200 },
-    },
-  });
+  // 方案 A：admin 能力仅 mnote-admin
+  await withAdminBrowserSession(browser, async (adminPage) => {
+    const grantResponse = await adminPage.request.fetch(`${BASE}/api/admin/access-policy/grants`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json",
+      },
+      data: {
+        userId: ACTOR_ID,
+        rootUri: ROOT_URI,
+        rootPath: ROOT_PATH,
+        permission: "write",
+        recursive: true,
+        capabilities: ["ai"],
+      },
+      timeout: TIMEOUT,
+    });
+    const grantText = await grantResponse.text();
+    let grantBody = {};
+    try {
+      grantBody = grantText ? JSON.parse(grantText) : {};
+    } catch {
+      grantBody = { raw: grantText };
+    }
+    if (!grantResponse.ok() && grantBody.code !== "local_access_policy_grant_duplicate") {
+      throw new Error(
+        `POST /api/admin/access-policy/grants failed: ${grantResponse.status()} ${grantText.slice(0, 1000)}`,
+      );
+    }
+    await requestJson(adminPage, "/api/ai-admin/settings", {
+      method: "PUT",
+      data: {
+        ...policyForMatrix(),
+        quota: { daily: 200 },
+      },
+    });
+  }, { baseUrl: BASE, timeoutMs: TIMEOUT });
   return requestJson(page, `/api/ai-settings/effective?workspaceId=${encodeURIComponent(WORKSPACE_ID)}`);
 }
 
@@ -576,7 +597,7 @@ async function main() {
 
   try {
     await quickLogin(page);
-    result.seededEffective = await seedWorkspace(page);
+    result.seededEffective = await seedWorkspace(browser, page);
     result.checks.policy = {
       mcpServers: ["CodeGraph", "SearXNG", "Chrome Bridge"].every(
         (name) => (result.seededEffective.mcpServers || []).some(