From 7cf0235ac7680e34612603bbf2fb63148386dae3 Mon Sep 17 00:00:00 2001
From: OoO <ooo@MacBook-Pro.local>
Date: Sun, 31 May 2026 20:43:02 +0800
Subject: [PATCH] =?UTF-8?q?V10.511=20=E6=94=B6=E6=96=82=20Webcrumbs=20plug?=
 =?UTF-8?q?in=20=E8=A8=BA=E6=96=B7=E7=A9=BA=E7=8B=80=E6=85=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 TODO_NEXT_STEPS.txt                     |  1 +
 config.py                               |  2 +-
 docs/guides/webcrumbs_shared_runtime.md |  2 +-
 docs/memory/history_logs.md             |  1 +
 routes/system_public_routes.py          | 21 +++++++++++++++++++++
 templates/external_tool_status.html     |  3 +++
 tests/test_external_tool_entrypoints.py |  5 +++++
 7 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/TODO_NEXT_STEPS.txt b/TODO_NEXT_STEPS.txt
index 52c88cd..592e834 100644
--- a/TODO_NEXT_STEPS.txt
+++ b/TODO_NEXT_STEPS.txt
@@ -4,6 +4,7 @@
 ================================================================================
 
 【已完成】
+   - V10.511 Webcrumbs live plugin 補 host data 安全空狀態：`/webcrumbs` 會注入 `StockPlatformSharedUI.marketSnapshot` / `aiCandidate` 的診斷空資料，避免 plugin fallback demo 數字被誤認成真實市場或 AI 建議。
    - V10.510 Webcrumbs 從 runtime 接線推進到專案內 live plugin 試點：`/webcrumbs` 會設定 `StockPlatformSharedUI.allowedPluginUris` 並嵌入同源 `/webcrumbs-assets/plugins/finance.market-ticker-strip/0.1.0`、`finance.ai-candidate-card/0.1.0`，用同一頁同時驗 runtime、plugin proxy 與共享 UI loader 初始化。
    - V10.509 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval Writer Preflight 安全預覽 gate：只審核 human approval 通過後由操作員貼回的 writer preflight 摘要，確認 approval identity、writer_preflight_id、row count、dedupe keys、approved decision 到 target review_state 的逐列映射、decision/approval/preflight evidence refs、exact identity / variant / overwrite guard 與 operator boundary；API 不讀 token、不執行 CLI、不開 DB、不寫 preflight/approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續 CLI review / run package 設計。
    - V10.508 Webcrumbs 轉為 momo-pro 同源 asset proxy：`WEBCRUMBS_RUNTIME_URL` 預設改為 `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js`，新增 allowlist proxy 只代理 188 Shared UI Hub 的 `loader/`、`plugins/`、`demo/`，避免 `webcrumbs.wooo.work` 公網 TLS / Basic Auth 尚未收斂時影響正式頁面載入；`/webcrumbs` 診斷頁同步顯示 asset upstream。
diff --git a/config.py b/config.py
index 0f547f1..a97d5c6 100644
--- a/config.py
+++ b/config.py
@@ -402,7 +402,7 @@ YOUTUBE_API_KEY = os.getenv('YOUTUBE_API_KEY', '')
 # ==========================================
 # 系統版本與路徑
 # ==========================================
-SYSTEM_VERSION = "V10.510"
+SYSTEM_VERSION = "V10.511"
 LOG_FILE_PATH = os.path.join(BASE_DIR, 'logs/system.log')
 public_url = PUBLIC_URL  # 用於模板顯示
 
diff --git a/docs/guides/webcrumbs_shared_runtime.md b/docs/guides/webcrumbs_shared_runtime.md
index 8973d61..687c3db 100644
--- a/docs/guides/webcrumbs_shared_runtime.md
+++ b/docs/guides/webcrumbs_shared_runtime.md
@@ -63,7 +63,7 @@ style.css
 ## 驗收
 
 - `/webcrumbs` 顯示 runtime URL、版本與 plugin base。
-- `/webcrumbs` 會嵌入同源 `/webcrumbs-assets/plugins/...` 的 live plugin preview，作為 shared runtime 的第一個專案內試點。
+- `/webcrumbs` 會嵌入同源 `/webcrumbs-assets/plugins/...` 的 live plugin preview，並由 momo-pro 注入診斷空狀態資料，避免 plugin fallback demo 數字在正式頁面被誤認成真實市場或 AI 建議。
 - `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js` 回 200 且 content type 是 JavaScript。
 - `ewoooc_base.html` 在 `WEBCRUMBS_ENABLED=true` 且 runtime URL 有效時輸出 `<script data-webcrumbs-runtime=...>`。
 - 任一試點頁嵌入 plugin 後，瀏覽器 console 不應有 `MISSING_URI`、`STYLE_LOAD_ERROR`、`SCRIPT_LOAD_ERROR`。
diff --git a/docs/memory/history_logs.md b/docs/memory/history_logs.md
index dcd5eac..2ad181b 100644
--- a/docs/memory/history_logs.md
+++ b/docs/memory/history_logs.md
@@ -13,6 +13,7 @@
 ## 📅 詳細更新日誌 (考古存檔)
 
 ### 2026-05-31：Webcrumbs 共用 UI Runtime 與市場情報 writer approval
+- **V10.511 Webcrumbs host data 安全空狀態**: `/webcrumbs` 會注入 `StockPlatformSharedUI.marketSnapshot` / `aiCandidate` 的診斷空資料，避免 Shared UI Hub plugin 因資料源未接入而 fallback 顯示假市場數字、假 AI 候選或假信心分數。
 - **V10.510 Webcrumbs live plugin 試點**: `/webcrumbs` 診斷頁不再只顯示 runtime 設定，新增 `StockPlatformSharedUI.allowedPluginUris` 與同源 `/webcrumbs-assets/plugins/finance.market-ticker-strip/0.1.0`、`finance.ai-candidate-card/0.1.0` live plugin embed，讓 shared-ui loader、plugin asset proxy 與頁面初始化時序能在 momo-pro 內直接驗收。
 - **V10.509 市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval Writer Preflight gate**: 新增 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight` 與 UI preview，只審核 human approval 通過後的 operator writer preflight 摘要；要求 approval linkage、writer_preflight_id、target operation、row count、dedupe keys、approved decision 到 target review_state 的逐列映射、decision/approval/preflight evidence refs、artifact paths、matched row exact-identity/variant/overwrite guard 與 operator confirmation 對齊，且 API 不讀 token、不執行 CLI、不開 DB、不寫 preflight/approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續 CLI review / run package 設計。
 - **V10.508 Webcrumbs 同源 asset proxy 收斂**: 正式頁面 runtime 預設改走 `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js`，由 momo-pro 代理 188 Shared UI Hub 的 allowlist asset path（`loader/`、`plugins/`、`demo/`），避免 `webcrumbs.wooo.work` 公網 TLS、Basic Auth 或入口轉發尚未完成時造成頁面 script 載入失敗；`/webcrumbs` 診斷頁同步顯示 asset upstream，`WEBCRUMBS_PLUGIN_BASE_URL` 預設改為同源 `/webcrumbs-assets/plugins`。
diff --git a/routes/system_public_routes.py b/routes/system_public_routes.py
index e0fa6c0..b380326 100644
--- a/routes/system_public_routes.py
+++ b/routes/system_public_routes.py
@@ -122,6 +122,26 @@ def _external_tool_payload(kind):
                     'uri': f'{plugin_base}/finance.ai-candidate-card/0.1.0',
                 },
             ]
+        plugin_seed_data = {
+            'marketSnapshot': [
+                {
+                    'name': 'market data source not connected',
+                    'price': 'not_available',
+                    'change_pct': 'not_available',
+                    'freshness_status': 'diagnostic_empty',
+                },
+            ],
+            'aiCandidate': {
+                'ticker': '-',
+                'name': 'AI candidate data source not connected',
+                'thesis': '此頁僅驗證 Webcrumbs loader、同源 plugin proxy 與初始化時序；尚未接入正式市場資料或投資研究資料，因此不顯示假候選或假信心分數。',
+                'confidence_score': 'not_available',
+                'risk_level': 'source_not_connected',
+                'release_status': 'blocked',
+                'evidence_refs': ['formal_data_source_required'],
+                'updated_at': SYSTEM_VERSION,
+            },
+        }
         return {
             'key': 'webcrumbs',
             'eyebrow': 'Shared UI Runtime',
@@ -146,6 +166,7 @@ def _external_tool_payload(kind):
             ],
             'plugin_previews': plugin_previews,
             'plugin_preview_uris': [preview['uri'] for preview in plugin_previews],
+            'plugin_seed_data': plugin_seed_data,
         }
 
     launch_url = _safe_launch_url(GRIST_URL, '/grist')
diff --git a/templates/external_tool_status.html b/templates/external_tool_status.html
index 18c2c34..fff9b6d 100644
--- a/templates/external_tool_status.html
+++ b/templates/external_tool_status.html
@@ -64,6 +64,9 @@
   <script>
     window.StockPlatformSharedUI = window.StockPlatformSharedUI || {};
     window.StockPlatformSharedUI.allowedPluginUris = {{ tool.plugin_preview_uris | tojson }};
+    window.StockPlatformSharedUI.pluginSeedData = {{ tool.plugin_seed_data | tojson }};
+    window.StockPlatformSharedUI.marketSnapshot = window.StockPlatformSharedUI.pluginSeedData.marketSnapshot || [];
+    window.StockPlatformSharedUI.aiCandidate = window.StockPlatformSharedUI.pluginSeedData.aiCandidate || {};
   </script>
   <section class="external-tool-webcrumbs-preview" aria-label="Webcrumbs live preview">
     <div class="external-tool-section-title">
diff --git a/tests/test_external_tool_entrypoints.py b/tests/test_external_tool_entrypoints.py
index 15545d7..777b9d1 100644
--- a/tests/test_external_tool_entrypoints.py
+++ b/tests/test_external_tool_entrypoints.py
@@ -43,7 +43,12 @@ def test_external_tool_bridge_pages_are_diagnostic_not_blank():
     assert "plugin_previews" in route_source
     assert "finance.market-ticker-strip/0.1.0" in route_source
     assert "finance.ai-candidate-card/0.1.0" in route_source
+    assert "plugin_seed_data" in route_source
+    assert "diagnostic_empty" in route_source
+    assert "source_not_connected" in route_source
     assert "StockPlatformSharedUI.allowedPluginUris" in template
+    assert "StockPlatformSharedUI.marketSnapshot" in template
+    assert "StockPlatformSharedUI.aiCandidate" in template
     assert "stock-platform-plugin" in template
     assert "external-tool-webcrumbs-grid" in css
     assert "尚未接入 proxy" in route_source