feat: register Fitbit workbench panel

.github/workflows/plugin-api-v3.yml

@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: kachofugetsu09/akashic-agent
-          ref: 39cbdcefc155aaf6c41deafd7754a37e6126c23c
+          ref: 69a9616f6f48f19dc109a6b3eef8fc1000825829
           path: .akashic-core
       - uses: actions/setup-python@v5
         with:

dashboard.py

@@ -2,10 +2,10 @@
 
 from collections.abc import Mapping, Sequence
 from typing import Any
+from urllib.parse import urlsplit
 
 import requests
 from fastapi import FastAPI, HTTPException
-from fastapi.responses import RedirectResponse
 
 from agent.plugin_composition import DashboardContext
 
@@ -32,8 +32,8 @@ def refresh() -> dict[str, str]:
         return {"status": "refreshing"}
 
     @app.get("/api/dashboard/fitbit/auth/start")
-    def auth_start() -> RedirectResponse:
-        return RedirectResponse(f"{_MONITOR_URL}/auth/start")
+    def auth_start() -> dict[str, str]:
+        return {"url": _monitor_authorization_url()}
 
 
 def _monitor_json(path: str) -> Mapping[str, object]:
@@ -56,6 +56,32 @@ def _monitor_payload(path: str) -> object:
     return payload
 
 
+def _monitor_authorization_url() -> str:
+    """Read the monitor-generated Fitbit authorization redirect as a DTO."""
+
+    try:
+        response = requests.get(
+            f"{_MONITOR_URL}/auth/start",
+            timeout=8,
+            allow_redirects=False,
+        )
+        response.raise_for_status()
+    except requests.RequestException as error:
+        raise HTTPException(status_code=502, detail="Fitbit monitor 不可用: /auth/start") from error
+
+    authorization_url = response.headers.get("location")
+    parsed = urlsplit(authorization_url or "")
+    if (
+        not response.is_redirect
+        or not isinstance(authorization_url, str)
+        or parsed.scheme != "https"
+        or parsed.netloc != "www.fitbit.com"
+        or parsed.path != "/oauth2/authorize"
+    ):
+        raise HTTPException(status_code=502, detail="Fitbit monitor 返回无效授权地址")
+    return authorization_url
+
+
 def _project_dashboard_snapshot(payload: Mapping[str, object]) -> dict[str, object]:
     """Validate and project the monitor-owned compact snapshot."""
 

package.json

@@ -4,8 +4,8 @@
   "type": "module",
   "scripts": {
     "test:mobile": "node --test tests/test_mobile_panel.mjs",
-    "test:dashboard": "node --test tests/test_dashboard_panel.mjs",
-    "test": "node --test tests/test_mobile_panel.mjs tests/test_dashboard_panel.mjs"
+    "test:dashboard": "node --test tests/test_web_module.mjs",
+    "test": "node --test tests/test_mobile_panel.mjs tests/test_web_module.mjs"
   },
   "devDependencies": {
     "linkedom": "^0.18.13"

plugin.py

@@ -51,6 +51,12 @@ class FitbitConfig(BaseModel):
     UI_SLOTS,
 )
 dashboard_module = "dashboard.py"
+web_module = "web_module.js"
+web_requires = ("workbench.panels.v1",)
+web_provides = ()
+web_contract_digests = {
+    "workbench.panels.v1": "724b282c22c4b3f3a36967ab664c4dfd8bce4257665f99459000306938caf527",
+}
 
 
 async def apply(ctx: Context, config: FitbitConfig) -> None:

scripts/preview_dashboard.py

@@ -34,8 +34,8 @@ def run_preview(agent_root: Path, plugin_root: Path, host: str, port: int) -> No
     plugin_root = plugin_root.resolve(strict=True)
     if not (agent_root / "bootstrap" / "dashboard_api.py").is_file():
         raise FileNotFoundError(f"Akashic Agent Dashboard 不存在: {agent_root}")
-    if not (plugin_root / "dashboard_panel.js").is_file():
-        raise FileNotFoundError(f"Fitbit Dashboard 面板不存在: {plugin_root}")
+    if not (plugin_root / "web_module.js").is_file():
+        raise FileNotFoundError(f"Fitbit Workbench 面板不存在: {plugin_root}")
 
     # 2. Project the plugin into an isolated HOME and reuse the real Dashboard host.
     with tempfile.TemporaryDirectory(prefix="fitbit-dashboard-preview-") as temp:

tests/test_dashboard.py

@@ -125,6 +125,28 @@ def monitor_json(path: str):
     assert calls == ["/api/dashboard/snapshot"]
 
 
+def test_monitor_authorization_redirect_becomes_a_plugin_owned_dto(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    authorization_url = "https://www.fitbit.com/oauth2/authorize?client_id=fitbit"
+    calls: list[tuple[str, int, bool]] = []
+
+    class Response:
+        is_redirect = True
+        headers = {"location": authorization_url}
+
+        def raise_for_status(self) -> None:
+            return None
+
+    def get(url: str, *, timeout: int, allow_redirects: bool) -> Response:
+        calls.append((url, timeout, allow_redirects))
+        return Response()
+
+    monkeypatch.setattr(dashboard.requests, "get", get)
+    assert dashboard._monitor_authorization_url() == authorization_url
+    assert calls == [("http://127.0.0.1:18765/auth/start", 8, False)]
+
+
 def test_compact_snapshot_boundary_rejects_missing_prediction_events() -> None:
     with pytest.raises(HTTPException, match="prediction_events 必须是数组"):
         dashboard._project_dashboard_snapshot(