fix: Wave 0 独立 AI 评审闭环(有条件通过→闭环, 273 绿)——P2-1 python-jose>=3.5.0(防 CVE-2024-33663/33664) P2-2 audit 降级+OPTIONS 测试 P2-3 JWT 通道 chat 3 例 P2-4 debug 兜底双闸门(dev+无 RS256 公钥) P2-5 留痕失败降级显式化(401/403 拒绝语义不漂移, _safe_unauth_audit 保护 repo 构造); P3 顺手: 401 归 platform/值域外 400 补留痕/Bearer 大小写不敏感/jti 加 uuid/CLI permissions+exp 上限/dev 默认密钥 warning/LLM 单例加锁/chat 主角色优先序+message strip+guard 日志脱敏/必填 claims 参数化+none 算法固化; P3 登记项(会话枚举/seq_no 锁/trace_id 口径/文档同步)归 M4 文档

scripts/dev/issue_dev_token.py

@@ -28,14 +28,21 @@ def main() -> int:
     parser.add_argument("--roles", required=True, help="逗号分隔角色，如 risk_officer / customer")
     parser.add_argument("--token-type", default="staff", choices=["customer", "staff", "service"])
     parser.add_argument("--customer-id", default=None, help="token_type=customer 时必填且须等于 sub")
-    parser.add_argument("--exp-minutes", type=int, default=60)
+    parser.add_argument("--exp-minutes", type=int, default=60, help="有效期（分钟），上限 480（手册 §11 员工 ≤8h）")
     parser.add_argument("--tenant-id", default="TENANT-001")
+    parser.add_argument("--permissions", default=None, help="逗号分隔细粒度权限，如 risk:alert:write,audit:write")
     args = parser.parse_args()
 
     if settings.app_env != "development":
         print("refused: issue_dev_token only runs with APP_ENV=development", file=sys.stderr)
         return 1
+    if args.exp_minutes < 1 or args.exp_minutes > 480:
+        print("refused: --exp-minutes must be in [1, 480]", file=sys.stderr)
+        return 1
     roles = [r.strip() for r in args.roles.split(",") if r.strip()]
+    permissions = (
+        [p.strip() for p in args.permissions.split(",") if p.strip()] if args.permissions else None
+    )
     if args.token_type == "customer" and args.customer_id != args.sub:
         print("refused: customer token requires --customer-id equal to --sub (手册 §4.2)", file=sys.stderr)
         return 1
@@ -46,6 +53,7 @@ def main() -> int:
         exp_minutes=args.exp_minutes,
         tenant_id=args.tenant_id,
         customer_id=args.customer_id,
+        permissions=permissions,
     )
     print(token)
     return 0