fix: 调试发布run

platform/api/resource_handlers.go

@@ -1285,8 +1285,8 @@ func (h *coreHandlers) serverInstances(w http.ResponseWriter, r *http.Request) {
 }
 
 // serverInstanceDetail godoc
-// @Summary Get, update, or archive server instance
-// @Description Returns one server instance by ID, updates safe metadata, or archives it by marking the instance deleted after safety validation.
+// @Summary Get, update, or delete server instance
+// @Description Returns one server instance by ID, updates safe metadata, or deletes it by marking the instance deleted after safety validation and password confirmation. Delete requests send a JSON body with the current password.
 // @Tags server-instances
 // @Accept json
 // @Produce json
@@ -1323,7 +1323,12 @@ func (h *coreHandlers) serverInstanceDetail(w http.ResponseWriter, r *http.Reque
 		}
 		writeJSON(w, http.StatusOK, dto.ServerInstanceFromDomain(instance))
 	case http.MethodDelete:
-		_, err := h.core.ArchiveServerInstanceForSession(bearerToken(r), r.PathValue("id"))
+		request, err := decodeJSON[dto.ServerDeletionRequest](r)
+		if err != nil {
+			writeDecodeError(w, err)
+			return
+		}
+		_, err = h.core.DeleteServerInstanceForSession(bearerToken(r), r.PathValue("id"), request.Password)
 		if err != nil {
 			writeServiceError(w, err)
 			return

platform/api/resource_handlers_test.go

@@ -740,30 +740,30 @@ func TestServerInstanceManagementAPI(t *testing.T) {
 	}
 
 	running := postJSONWithAuth[dto.ServerInstanceResponse](t, router, "/api/v1/server-instances", dto.ServerInstanceCreateRequest{
-		ID:            "server-running-archive",
+		ID:            "server-running-delete",
 		PluginID:      "server.scum",
 		RunEndpointID: "run-local",
-		Name:          "SCUM Running Archive",
+		Name:          "SCUM Running Delete",
 		State:         domain.ServerInstanceStateRunning,
 	}, adminSession)
-	unsafeArchive := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+running.ID, "", adminSession)
-	assertErrorResponse(t, unsafeArchive, http.StatusBadRequest, errorCodeValidation)
+	unsafeDelete := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+running.ID, mustJSON(t, dto.ServerDeletionRequest{Password: "operator-local"}), adminSession)
+	assertErrorResponse(t, unsafeDelete, http.StatusBadRequest, errorCodeValidation)
 
-	archived := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/server-management", "", adminSession)
-	assertStatus(t, archived, http.StatusNoContent)
+	deleted := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/server-management", mustJSON(t, dto.ServerDeletionRequest{Password: "operator-local"}), adminSession)
+	assertStatus(t, deleted, http.StatusNoContent)
 	activeList := getJSONWithAuth[dto.ServerInstanceListResponse](t, router, "/api/v1/server-instances", adminSession)
 	for _, item := range activeList.Items {
 		if item.ID == "server-management" {
-			t.Fatalf("archived server should be hidden from normal list: %+v", activeList)
+			t.Fatalf("deleted server should be hidden from normal list: %+v", activeList)
 		}
 	}
 	deletedList := getJSONWithAuth[dto.ServerInstanceListResponse](t, router, "/api/v1/server-instances?state=deleted", adminSession)
 	if deletedList.Count != 1 || deletedList.Items[0].ID != "server-management" || deletedList.Items[0].State != domain.ServerInstanceStateDeleted {
-		t.Fatalf("expected explicit deleted filter to return archived server, got %+v", deletedList)
+		t.Fatalf("expected explicit deleted filter to return deleted server, got %+v", deletedList)
 	}
 
 	blank := ""
-	invalidUpdate := requestJSONWithAuth(t, router, http.MethodPut, "/api/v1/server-instances/server-running-archive", dto.ServerInstanceUpdateRequest{Name: &blank}, adminSession)
+	invalidUpdate := requestJSONWithAuth(t, router, http.MethodPut, "/api/v1/server-instances/server-running-delete", dto.ServerInstanceUpdateRequest{Name: &blank}, adminSession)
 	assertErrorResponse(t, invalidUpdate, http.StatusBadRequest, errorCodeValidation)
 }
 
@@ -849,6 +849,59 @@ func TestServerAccessAPIScopesOwnersAndAdministrators(t *testing.T) {
 	assertErrorResponse(t, forbiddenDetail, http.StatusForbidden, errorCodeForbidden)
 }
 
+func TestServerInstanceDeleteRequiresOwnershipAndPasswordConfirmation(t *testing.T) {
+	router := newTestRouter()
+	adminSession := createAdminSession(t, router)
+	postJSONWithAuth[dto.UserResponse](t, router, "/api/v1/users", dto.UserCreateRequest{
+		ID:          "user-delete-owner-api",
+		DisplayName: "Delete Owner API",
+		Email:       "delete-owner-api@example.test",
+		Roles:       []string{"server-owner"},
+		Password:    "secret-password",
+	}, adminSession)
+	postJSONWithAuth[dto.UserResponse](t, router, "/api/v1/users", dto.UserCreateRequest{
+		ID:          "user-delete-other-api",
+		DisplayName: "Delete Other API",
+		Email:       "delete-other-api@example.test",
+		Roles:       []string{"server-admin"},
+		Password:    "secret-password",
+	}, adminSession)
+	ownerSession := postOKJSON[dto.AuthSessionResponse](t, router, "/api/v1/auth/login", dto.LoginRequest{Account: "delete-owner-api@example.test", Password: "secret-password"}).SessionID
+	otherSession := postOKJSON[dto.AuthSessionResponse](t, router, "/api/v1/auth/login", dto.LoginRequest{Account: "delete-other-api@example.test", Password: "secret-password"}).SessionID
+
+	postJSON[dto.GamePluginResponse](t, router, "/api/v1/game-plugins", validGamePluginRequest())
+	postJSON[dto.RunEndpointResponse](t, router, "/api/v1/run/endpoints", validRunEndpointRequest())
+	instance := postJSONWithAuth[dto.ServerInstanceResponse](t, router, "/api/v1/server-instances", dto.ServerInstanceCreateRequest{
+		ID:            "server-delete-api",
+		PluginID:      "server.scum",
+		RunEndpointID: "run-local",
+		Name:          "Delete API Server",
+		State:         domain.ServerInstanceStateReady,
+	}, ownerSession)
+	adminTarget := postJSONWithAuth[dto.ServerInstanceResponse](t, router, "/api/v1/server-instances", dto.ServerInstanceCreateRequest{
+		ID:            "server-delete-admin-api",
+		PluginID:      "server.scum",
+		RunEndpointID: "run-local",
+		Name:          "Delete Admin API Server",
+		State:         domain.ServerInstanceStateReady,
+	}, ownerSession)
+
+	missingPassword := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+instance.ID, mustJSON(t, dto.ServerDeletionRequest{}), ownerSession)
+	assertErrorResponse(t, missingPassword, http.StatusBadRequest, errorCodeValidation)
+
+	wrongPassword := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+instance.ID, mustJSON(t, dto.ServerDeletionRequest{Password: "wrong-password"}), ownerSession)
+	assertErrorResponse(t, wrongPassword, http.StatusForbidden, errorCodeForbidden)
+
+	forbiddenDelete := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+instance.ID, mustJSON(t, dto.ServerDeletionRequest{Password: "secret-password"}), otherSession)
+	assertErrorResponse(t, forbiddenDelete, http.StatusForbidden, errorCodeForbidden)
+
+	adminDeleted := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+adminTarget.ID, mustJSON(t, dto.ServerDeletionRequest{Password: "operator-local"}), adminSession)
+	assertStatus(t, adminDeleted, http.StatusNoContent)
+
+	deleted := requestWithAuth(t, router, http.MethodDelete, "/api/v1/server-instances/"+instance.ID, mustJSON(t, dto.ServerDeletionRequest{Password: "secret-password"}), ownerSession)
+	assertStatus(t, deleted, http.StatusNoContent)
+}
+
 func TestAIProviderAPIResponseDoesNotExposeRawSecretFields(t *testing.T) {
 	router := newTestRouter()
 	adminSession := createAdminSession(t, router)