feat(ql3): observe package installations in console

scripts/ql3-cluster-copilot-console-audit.cjs

@@ -15,6 +15,7 @@ const REQUIRED_FILES = Object.freeze([
   CONSOLE_ROOT + '/evidenceVerifierCli.ts',
   CONSOLE_ROOT + '/server.ts',
   'packages/ql3-cluster-admin/src/run-management/runCancellationInspection.ts',
+  'packages/ql3-cluster-admin/src/plugin-package/management/pluginPackageInstallationProduct.ts',
   CLIENT_FILE,
   ASSET_ROOT + '/index.html',
   ASSET_ROOT + '/app.css',
@@ -24,6 +25,7 @@ const REQUIRED_FILES = Object.freeze([
   DEPLOYMENT_ROOT + '/client-config.example.json',
   DEPLOYMENT_ROOT + '/run-management-client-config.example.json',
   DEPLOYMENT_ROOT + '/worker-management-client-config.example.json',
+  DEPLOYMENT_ROOT + '/package-management-client-config.example.json',
   'deploy/containers/ql3-cluster-admin/Dockerfile',
   'scripts/ql3-cluster-admin-product-live-contract.cjs',
 ]);
@@ -111,6 +113,8 @@ function auditClusterCopilotConsole(options = {}) {
     "'run_cancellation_inspect'",
     "'worker_list'",
     "'worker_inspect'",
+    "'package_list'",
+    "'package_inspect'",
     "'task_read'",
     "'workflow_step_list'",
   ]);
@@ -140,6 +144,7 @@ function auditClusterCopilotConsole(options = {}) {
     "'/api/v1/copilot/inspect': 'inspect'",
     "'/api/v1/run-management/cancellation-status': 'run_cancellation_status'",
     "'/api/v1/worker-management/workers': 'worker_list'",
+    "'/api/v1/package-management/installations': 'package_list'",
     "'/api/v1/observe/run-list': 'run_list'",
     "'/api/v1/observe/task-list': 'task_list'",
     "'/api/v1/observe/workflow-list': 'workflow_list'",
@@ -165,6 +170,8 @@ function auditClusterCopilotConsole(options = {}) {
     '--run-management-assertion /absolute/assertion.jwt',
     '--worker-management-config /absolute/worker-client.json',
     '--worker-management-assertion /absolute/assertion.jwt',
+    '--package-management-config /absolute/package-client.json',
+    '--package-management-assertion /absolute/assertion.jwt',
     'readCanonicalFile(',
     "'private'",
     'validateClusterCopilotClientCredentialFile',
@@ -173,6 +180,7 @@ function auditClusterCopilotConsole(options = {}) {
     "publishedHostAddress: '127.0.0.1'",
     'runManagementAuthority: runManagementAuthority',
     'workerManagementAuthority: workerManagementAuthority',
+    'packageManagementAuthority: packageManagementAuthority',
     'mutation: false',
   ]);
   rejectFragments(CONSOLE_ROOT + '/cli.ts', [
@@ -233,6 +241,8 @@ function auditClusterCopilotConsole(options = {}) {
     '读取首屏 Blocked Runs',
     '读取首屏 Workers',
     '读取 Worker 详情',
+    '读取首屏 Installations',
+    '读取 Package 安装详情',
     '该只读面没有 rearm',
     '模型文本是不可信内容',
     '导出脱敏包',
@@ -301,8 +311,10 @@ function auditClusterCopilotConsole(options = {}) {
     'Run, Task, Workflow',
     'thirteen exact operations',
     'available vocabulary to sixteen',
+    'maximum vocabulary of twenty operations',
     'QL3_COPILOT_CONSOLE_RUN_MANAGEMENT=enabled',
     'QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT=enabled',
+    'QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT=enabled',
     '--port=0',
     'TLS 1.3 `GET /readyz`',
     'excluded from small router Edge/Standalone artifacts',
@@ -451,6 +463,8 @@ function auditClusterCopilotConsole(options = {}) {
       'run_cancellation_inspect',
       'worker_list',
       'worker_inspect',
+      'package_list',
+      'package_inspect',
       'run_list',
       'run_read',
       'run_event_list',

scripts/ql3-cluster-copilot-console-distribution-audit.cjs

@@ -15,6 +15,8 @@ const FILES = Object.freeze({
     'deploy/console/ql3-cluster-copilot/run-management-client-config.example.json',
   workerManagementExample:
     'deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json',
+  packageManagementExample:
+    'deploy/console/ql3-cluster-copilot/package-management-client-config.example.json',
   image: 'deploy/containers/ql3-cluster-admin/Dockerfile',
   workflow: '.github/workflows/ql3-image-release.yml',
   candidate: 'scripts/ql3-release-candidate-contract.cjs',
@@ -92,6 +94,9 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
       'QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT-disabled',
       '--worker-management-config /var/run/secrets/qinglong3/copilot-console/worker-management-client.json',
       '--worker-management-assertion /var/run/secrets/qinglong3/copilot-console/worker-management-assertion.jwt',
+      'QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT-disabled',
+      '--package-management-config /var/run/secrets/qinglong3/copilot-console/package-management-client.json',
+      '--package-management-assertion /var/run/secrets/qinglong3/copilot-console/package-management-assertion.jwt',
     ],
     'QL3_COPILOT_CONSOLE_LAUNCHER_CONTRACT_DRIFT',
   );
@@ -105,6 +110,15 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
     ],
     'QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT_EXAMPLE_DRIFT',
   );
+  requireFragments(
+    'packageManagementExample',
+    [
+      '"schemaVersion": 1',
+      '/api/v3/plugin-packages/management',
+      'package-management-ca.pem',
+    ],
+    'QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT_EXAMPLE_DRIFT',
+  );
   rejectFragments(
     'launcher',
     ['--privileged', '--network host', '/var/run/docker.sock', '--pull always'],
@@ -222,6 +236,7 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
     QL3_COPILOT_CONSOLE_RESOURCE_CLASS: 'compact',
     QL3_COPILOT_CONSOLE_RUN_MANAGEMENT: 'disabled',
     QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT: 'disabled',
+    QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT: 'disabled',
   };
   if (
     environment &&
@@ -249,6 +264,8 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
       'share/ql3-copilot-console/run-management-client-config.example.json',
       'COPY --chmod=0444 deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json',
       'share/ql3-copilot-console/worker-management-client-config.example.json',
+      'COPY --chmod=0444 deploy/console/ql3-cluster-copilot/package-management-client-config.example.json',
+      'share/ql3-copilot-console/package-management-client-config.example.json',
     ],
     'QL3_COPILOT_CONSOLE_IMAGE_DISTRIBUTION_DRIFT',
   );
@@ -343,6 +360,7 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
     additionalWorkspacePackages: 0,
     runManagementAuthorityDefault: 'disabled',
     workerManagementAuthorityDefault: 'disabled',
+    packageManagementAuthorityDefault: 'disabled',
     externalWorkstationCeremony: 'source-tag-private-report',
     ceremonyStatus: 'implementation-ready-public-release-pending',
     findings: Object.freeze(findings),