新账号一键创建fix

frontend/src/i18n/resources/en-US/ui.json

@@ -1654,6 +1654,12 @@
       "cancelDescription": "Cancellation stops subsequent steps. Created databases, Skill Spaces, gateways and other registered resources are retained. Retry using the same agent ID.",
       "background": "Creation continues after closing this window. Open it again to view progress.",
       "pollFailed": "Progress is temporarily unavailable. Reconnecting; avoid creating another agent.",
+      "iamPermissionDenied": "The deployment service lacks IAM permissions to prepare the runtime role. Ask an administrator to grant access, then retry.",
+      "iamTrustConflict": "The runtime role trust is incompatible. Ask an administrator to check VeFaaS and APIG access, then retry.",
+      "iamPolicyConflict": "An existing runtime policy with the required name has conflicting contents. Ask an administrator to check it, then retry.",
+      "iamOwnershipConflict": "The runtime role does not belong to the deployment account. Ask an administrator to check it, then retry.",
+      "iamVerificationFailed": "Runtime role permissions could not be confirmed. Check IAM availability and policies, then retry.",
+      "iamConfigurationConflict": "Automatic runtime role preparation requires the default MPA role. Check the server creation configuration.",
       "creationFailed": "This step failed. Check its resources, server configuration and permissions, then retry the same agent ID.",
       "cancelFailed": "Cancellation failed. Check the current progress and retry.",
       "cancelled": "Creation cancelled. Registered resources are retained for retry.",
@@ -1669,6 +1675,7 @@
       },
       "stages": {
         "queued": "Queued",
+        "iam_role": "Prepare runtime role",
         "checking": "Checking account and configuration",
         "network": "Preparing VPC and subnets",
         "gateway": "Preparing APIG and IM Gateway",

frontend/src/i18n/resources/zh-CN/ui.json

@@ -1654,6 +1654,12 @@
       "cancelDescription": "取消后会停止后续步骤。已创建的数据库、技能空间、网关和其他已登记资源会保留，可使用同一智能体 ID 重试。",
       "background": "关闭窗口后创建会继续。再次打开可查看进度。",
       "pollFailed": "暂时无法获取进度，正在重新连接。请勿重复创建其他智能体。",
+      "iamPermissionDenied": "部署服务没有准备运行角色所需的 IAM 权限，请联系管理员授权后重试。",
+      "iamTrustConflict": "运行角色的信任关系不符合要求，请管理员检查对 VeFaaS 和 APIG 的授权后重试。",
+      "iamPolicyConflict": "运行角色所需的同名权限策略内容冲突，请管理员检查后重试。",
+      "iamOwnershipConflict": "运行角色与当前部署账号不匹配，请管理员检查后重试。",
+      "iamVerificationFailed": "尚未确认运行角色的权限已就绪，请检查 IAM 服务及策略可用性后重试。",
+      "iamConfigurationConflict": "自动准备运行角色仅支持默认 MPA 角色，请检查服务端创建配置。",
       "creationFailed": "当前步骤未完成，请检查对应资源、服务端配置及权限后，用同一智能体 ID 重试。",
       "cancelFailed": "取消请求失败，请重新查询进度后重试。",
       "cancelled": "创建已取消，已登记资源保留供重试。",
@@ -1669,6 +1675,7 @@
       },
       "stages": {
         "queued": "等待开始",
+        "iam_role": "准备运行角色",
         "checking": "检查账号与配置",
         "network": "准备 VPC 和子网",
         "gateway": "准备 APIG 和 IM Gateway",

frontend/tests/mpaCreation.test.tsx

@@ -922,3 +922,38 @@ it("keeps disabled and loading appearance consistent across shared Button varian
     css.remove();
   }
 });
+
+it("preserves the runtime role stage and actionable IAM error for retry", async () => {
+  const input = {
+    region: "cn-beijing",
+    requestId: "12345678-90ab-4cde-8f01-23456789abcd",
+    agentId: "mi-1234567890ab4cde8f012345",
+    description: "",
+  };
+  sessionStorage.setItem(
+    "mpa-create:cn-beijing",
+    JSON.stringify({ input, submitted: true, step: 2, taskId: "iam-task" }),
+  );
+  vi.mocked(api.getMpaCreationConfig).mockResolvedValue({
+    configured: true,
+    region: "cn-beijing",
+  });
+  vi.mocked(api.getMpaCreation).mockResolvedValue({
+    ...input,
+    taskId: "iam-task",
+    state: "failed",
+    stage: "iam_role",
+    error: "iamPermissionDenied",
+  });
+  await mount();
+  expect(document.body.textContent).toContain(
+    "myAgents.mpaCreate.stages.iam_role",
+  );
+  expect(document.body.textContent).toContain(
+    "myAgents.mpaCreate.iamPermissionDenied",
+  );
+  expect(button("retry").disabled).toBe(false);
+  expect(
+    JSON.parse(sessionStorage.getItem("mpa-create:cn-beijing")!).input.agentId,
+  ).toBe(input.agentId);
+});

prd-spec/bugfixes/frontend-lockfile-sync/2026-10-09-restore-esbuild-lock-entries.md

@@ -0,0 +1,84 @@
+# Restore Frontend esbuild Lock Entries
+
+[中文版](2026-10-09-restore-esbuild-lock-entries.zh.md)
+
+## Metadata
+
+- Change ID: `frontend-lockfile-sync`
+- Created: 2026-10-09
+- Revised: 2026-10-09
+- Status: implemented
+- Related component specs: none; this change restores generated dependency metadata without changing component contracts
+
+## Background and Evidence
+
+Pull request #23 fails the Harness Sidecar Release Gate during `npm ci --ignore-scripts`. The CI log reports that `esbuild@0.28.2` and its platform packages are missing from `frontend/package-lock.json`.
+
+`frontend/package.json` is identical to `origin/main`. Commit `3f134207` removed 512 lock-file lines, including Vitest's nested esbuild package and platform-specific optional packages, without changing dependency declarations. The confirmed root cause is an incomplete generated lock file.
+
+## Goals and Non-goals
+
+### Goals
+
+- Restore a lock file that is complete for supported CI platforms.
+- Make `npm ci --ignore-scripts` and the affected frontend release gate pass.
+- Preserve all declared dependency versions and product behavior.
+
+### Non-goals
+
+- Change frontend dependencies or version ranges.
+- Change Studio UI, runtime behavior, or harness-sidecar contracts.
+- Modify unrelated PR #23 implementation files.
+
+## Scenarios and Requirements
+
+### Scenario
+
+Given the unchanged `frontend/package.json`, when CI runs `npm ci --ignore-scripts` on Linux, then npm must resolve the exact lock-file graph without reporting missing esbuild packages.
+
+- `FR-1`: `frontend/package-lock.json` must contain the dependency graph generated for the current `frontend/package.json`.
+- `FR-2`: The fix must not change `frontend/package.json` or component behavior.
+- `FR-3`: The affected frontend gate, normal frontend tests, and production build must pass locally.
+
+## Design and Contract Impact
+
+Restore `frontend/package-lock.json` to the complete `origin/main` version because `frontend/package.json` is unchanged and the branch-only lock diff consists solely of accidental deletions.
+
+- Interfaces and state: not applicable; no source contract changes.
+- Concurrency and permissions: not applicable.
+- Security: no credentials or external inputs are added.
+- Compatibility: restores Linux CI compatibility while preserving dependency declarations.
+- Component specs: no impact; the change corrects generated package metadata only.
+- User documentation: no impact.
+
+Alternative rejected: running a broad dependency upgrade. It would create unrelated version churn and does not address the confirmed accidental deletion narrowly.
+
+## Implementation Tasks
+
+- `T-1` (`FR-1`, `FR-2`): restore `frontend/package-lock.json` from `origin/main`.
+- `T-2` (`FR-3`): run the affected installation, coverage, test, and build commands.
+- `T-3`: review the final diff for unrelated changes and record verification evidence.
+
+## Verification and Acceptance
+
+| Requirement | Task | Acceptance criterion | Verification | Result |
+| --- | --- | --- | --- | --- |
+| `FR-1` | `T-1` | `AC-1`: npm accepts the lock file | `npm --prefix frontend ci --ignore-scripts` | pass: 695 packages installed |
+| `FR-2` | `T-1`, `T-3` | `AC-2`: dependency declarations and component contracts are unchanged | `git diff origin/main -- frontend/package.json` and diff review | pass: no package declaration or contract diff |
+| `FR-3` | `T-2` | `AC-3`: affected coverage gate passes | `npm --prefix frontend run test:harness-sidecar-coverage` | pass: 22 tests |
+| `FR-3` | `T-2` | `AC-4`: frontend tests pass | `npm --prefix frontend test` | pass: 1,377 Node tests and 65 Vitest tests |
+| `FR-3` | `T-2` | `AC-5`: production build passes | `npm --prefix frontend run build` | pass |
+
+## Risks and Open Questions
+
+- `npm run build` may regenerate tracked web assets. Any generated diff must be reviewed and retained only if it is required by the current source.
+- No open design questions remain.
+
+## Review and Delivery Record
+
+- 2026-10-09: Root cause confirmed from PR #23 CI logs and the branch diff.
+- 2026-10-09: Design review found no contract, security, compatibility, or testability blocker.
+- 2026-10-09: The user approved restoring the complete lock file and running the frontend gates.
+- 2026-10-09: Restored the 512 deleted lock-file lines from `origin/main`; installation, affected coverage, complete frontend tests, and production build passed on diff scope `d3370fd1` plus this working-tree fix.
+- 2026-10-09: `npm ci` reported existing dependency audit findings (6 low, 3 moderate, 6 high, 1 critical); dependency remediation is outside this lock restoration.
+- Commit, push, and PR updates remain separately authorized operations.

prd-spec/bugfixes/frontend-lockfile-sync/2026-10-09-restore-esbuild-lock-entries.zh.md

@@ -0,0 +1,84 @@
+# 恢复前端 esbuild 锁文件条目
+
+[English](2026-10-09-restore-esbuild-lock-entries.md)
+
+## 元数据
+
+- 变更 ID：`frontend-lockfile-sync`
+- 创建日期：2026-10-09
+- 修订日期：2026-10-09
+- 状态：implemented
+- 相关组件规格：无；本变更仅恢复生成的依赖元数据，不改变组件契约
+
+## 背景与证据
+
+PR #23 在 Harness Sidecar Release Gate 的 `npm ci --ignore-scripts` 阶段失败。CI 日志报告 `frontend/package-lock.json` 缺少 `esbuild@0.28.2` 及其平台包。
+
+`frontend/package.json` 与 `origin/main` 完全一致。提交 `3f134207` 在未修改依赖声明的情况下删除了 512 行锁文件内容，其中包括 Vitest 嵌套的 esbuild 包和平台专属可选包。已确认的根因是生成的锁文件不完整。
+
+## 目标与非目标
+
+### 目标
+
+- 恢复对受支持 CI 平台完整的锁文件。
+- 使 `npm ci --ignore-scripts` 和受影响的前端发布 gate 通过。
+- 保持所有声明的依赖版本和产品行为不变。
+
+### 非目标
+
+- 修改前端依赖或版本范围。
+- 修改 Studio UI、运行时行为或 harness-sidecar 契约。
+- 修改 PR #23 中无关的实现文件。
+
+## 场景与需求
+
+### 场景
+
+给定未变化的 `frontend/package.json`，当 CI 在 Linux 上运行 `npm ci --ignore-scripts` 时，npm 必须能够解析精确的锁文件依赖图，并且不报告缺少 esbuild 包。
+
+- `FR-1`：`frontend/package-lock.json` 必须包含当前 `frontend/package.json` 对应的完整依赖图。
+- `FR-2`：修复不得改变 `frontend/package.json` 或组件行为。
+- `FR-3`：受影响的前端 gate、常规前端测试和生产构建必须在本地通过。
+
+## 设计与契约影响
+
+将 `frontend/package-lock.json` 恢复为完整的 `origin/main` 版本，因为 `frontend/package.json` 未变化，且分支独有的锁文件差异仅包含意外删除。
+
+- 接口与状态：不适用；没有源码契约变更。
+- 并发与权限：不适用。
+- 安全：不新增凭据或外部输入。
+- 兼容性：恢复 Linux CI 兼容性，同时保持依赖声明不变。
+- 组件规格：无影响；本变更只修正生成的包元数据。
+- 用户文档：无影响。
+
+已拒绝的替代方案：执行广泛的依赖升级。该方案会产生无关的版本变动，且不能精确解决已确认的意外删除。
+
+## 实施任务
+
+- `T-1`（`FR-1`、`FR-2`）：从 `origin/main` 恢复 `frontend/package-lock.json`。
+- `T-2`（`FR-3`）：运行受影响的安装、覆盖率、测试和构建命令。
+- `T-3`：检查最终差异是否存在无关变更，并记录验证证据。
+
+## 验证与验收
+
+| 需求 | 任务 | 验收标准 | 验证命令 | 结果 |
+| --- | --- | --- | --- | --- |
+| `FR-1` | `T-1` | `AC-1`：npm 接受锁文件 | `npm --prefix frontend ci --ignore-scripts` | pass：安装 695 个包 |
+| `FR-2` | `T-1`、`T-3` | `AC-2`：依赖声明和组件契约未变化 | `git diff origin/main -- frontend/package.json` 和差异审查 | pass：无依赖声明或契约差异 |
+| `FR-3` | `T-2` | `AC-3`：受影响的覆盖率 gate 通过 | `npm --prefix frontend run test:harness-sidecar-coverage` | pass：22 项测试 |
+| `FR-3` | `T-2` | `AC-4`：前端测试通过 | `npm --prefix frontend test` | pass：1,377 项 Node 测试和 65 项 Vitest 测试 |
+| `FR-3` | `T-2` | `AC-5`：生产构建通过 | `npm --prefix frontend run build` | pass |
+
+## 风险与待决问题
+
+- `npm run build` 可能重新生成已跟踪的 Web 资产。必须审查所有生成差异，只保留当前源码确实需要的内容。
+- 没有待决设计问题。
+
+## 审查与交付记录
+
+- 2026-10-09：根据 PR #23 CI 日志和分支差异确认根因。
+- 2026-10-09：设计审查未发现契约、安全、兼容性或可测试性阻塞项。
+- 2026-10-09：用户批准恢复完整锁文件并运行前端 gate。
+- 2026-10-09：从 `origin/main` 恢复被删除的 512 行锁文件内容；在 `d3370fd1` 加本工作区修复的差异范围内，依赖安装、受影响的覆盖率、完整前端测试和生产构建均通过。
+- 2026-10-09：`npm ci` 报告既有依赖审计问题（6 个 low、3 个 moderate、6 个 high、1 个 critical）；依赖修复不属于本次锁文件恢复范围。
+- 提交、推送和更新 PR 仍需单独授权。