@ai-workbench/network 0.4.5 → 0.4.7

package/lib/network.js

@@ -1,4 +1,6 @@
 import { spawn } from 'node:child_process';
+import { writeSync } from 'node:fs';
+import { randomUUID, createHash } from 'node:crypto';
 import { join, isAbsolute, normalize, dirname, basename, relative, sep } from 'node:path';
 import { realpath, lstat } from 'node:fs/promises';
 import { privateFile, verifyExecutable } from "./private.js";
@@ -38,11 +40,13 @@ function statusFrame(v) {
     const receipt = receiptFrame(v.receipt);
     return { ...receipt ? { receipt } : {}, apiVersion: 1, enrollment: v.enrollment, node: { name: v.node.name, ips: v.node.ips }, host: { name: v.host.name, online: v.host.online, lastSeenAt: v.host.lastSeenAt, observedAt: v.host.observedAt }, error };
 }
-export function createNetwork(settings, executable, emit = () => { }, controlIO = control) {
+export function createNetwork(settings, executable, emit = () => { }, controlIO = control, resumeIdentityOnly = false, expectedConfigSHA256) {
     let state = { phase: 'starting' }, cfg, child;
     let starting, disposing, disposed = false, online = false;
     let poll;
     let processFailed = false, startupReceipt, terminalNeed, stoppingChild, shutdownNeed;
+    let logClosed, lifecycleNeed;
+    let configSHA256;
     const childGone = new AbortController();
     const lifetime = new AbortController(), listeners = new Set(), updates = new Set();
     const leases = new Set();
@@ -68,9 +72,20 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
     const block = (code, message, requires) => publish({ phase: 'blocked', error: needs(code, message, requires) });
     const socket = () => join(cfg.runtimeDir, 'control.sock');
     const alive = () => !!child?.pid && !processFailed && child.exitCode === null && child.signalCode === null;
-    const terminal = (need) => { processFailed = true; terminalNeed ??= need; childGone.abort(); if (poll)
-        clearTimeout(poll); if (!disposed)
-        publish({ phase: 'blocked', error: terminalNeed, ...state.status ? { status: state.status } : startupReceipt ? { status: { apiVersion: 1, enrollment: 'error', node: { name: null, ips: [] }, host: { name: null, online: null, lastSeenAt: null, observedAt: null }, error: terminalNeed, receipt: startupReceipt } } : {} }); };
+    const terminal = (need) => {
+        processFailed = true;
+        terminalNeed ??= need;
+        if (lifecycleNeed) {
+            lifecycleNeed.cause ??= [terminalNeed.code, terminalNeed.message, terminalNeed.cause].filter(Boolean).join('；');
+            terminalNeed = lifecycleNeed;
+        }
+        childGone.abort();
+        if (poll)
+            clearTimeout(poll);
+        const previous = state.status, status = previous ? { ...previous, enrollment: 'error', host: { ...previous.host, online: null, observedAt: null }, error: terminalNeed } : startupReceipt ? { apiVersion: 1, enrollment: 'error', node: { name: null, ips: [] }, host: { name: null, online: null, lastSeenAt: null, observedAt: null }, error: terminalNeed, receipt: startupReceipt } : undefined;
+        if (!disposed)
+            publish({ phase: 'blocked', error: terminalNeed, ...status ? { status } : {} });
+    };
     const stopOwned = () => stoppingChild ??= (async () => {
         const owned = child;
         if (!owned?.pid || owned.exitCode !== null || owned.signalCode !== null)
@@ -124,11 +139,21 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
             let configStat;
             try {
                 configStat = await file.stat();
-                cfg = JSON.parse(await file.readFile('utf8'));
+                const bytes = await file.readFile();
+                configSHA256 = createHash('sha256').update(bytes).digest('hex');
+                cfg = JSON.parse(bytes.toString('utf8'));
             }
             finally {
                 await file.close();
             }
+            if (resumeIdentityOnly && Object.hasOwn(cfg, 'authKeyFile')) {
+                startupNeed = needs('HELPER_RECOVERY_IDENTITY_REQUIRED', '无法安全恢复既有身份，连接配置仍含首次开通材料。', '管理员核对原身份与消费记录；不会读取或重新提交旧密钥');
+                throw new Error(startupNeed.code);
+            }
+            if (expectedConfigSHA256 !== undefined && configSHA256 !== expectedConfigSHA256) {
+                startupNeed = needs('HELPER_RECOVERY_CONFIG_CHANGED', '网络配置在组件运行后发生变化，已停止自动恢复。', '管理员核对原连接配置与身份；不启动其他身份、不重交密钥');
+                throw new Error(startupNeed.code);
+            }
             if (!validHelperPolicy(settings))
                 throw new Error('CONFIG_INVALID');
             cfg = effectiveConfig(cfg, settings);
@@ -200,25 +225,45 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 environment.AW_NET_PARENT_UMASK = String(employeeUmask);
             }
             try {
-                child = spawn(executable.path, ['serve', '--config', settings.configFile, ...helperPolicyArgs(settings), '--controlResponseMaxBytes', String(settings.controlResponseMaxBytes)], { stdio: ['ignore', 'pipe', log.fd], env: environment });
+                child = spawn(executable.path, ['serve', '--config', settings.configFile, ...resumeIdentityOnly ? ['--resumeIdentityOnly'] : [], ...expectedConfigSHA256 ? ['--resumeConfigSHA256', expectedConfigSHA256] : [], ...helperPolicyArgs(settings), '--controlResponseMaxBytes', String(settings.controlResponseMaxBytes)], { stdio: ['ignore', 'pipe', log.fd], env: environment });
             }
             catch (error) {
                 await log.close();
                 throw error;
             }
             // Install process handlers before yielding: spawn errors can arrive on nextTick.
-            const logClosed = log.close();
             const processChild = child;
-            processChild.on('error', () => terminal(needs('HELPER_PROCESS_FAILED', '网络组件进程失败，根因未查明', '管理员检查helper诊断日志')));
-            const exited = () => {
+            const runtimeId = randomUUID(), processStarted = performance.now();
+            let journalClosing = false, journalDone;
+            logClosed = new Promise(resolve => journalDone = resolve);
+            const journalFailed = () => { lifecycleNeed ??= needs('HELPER_LIFECYCLE_LOG_FAILED', '网络组件进程诊断无法完整写入，已停止自动恢复。', '管理员检查诊断日志权限、磁盘及退出记录；不重交密钥'); };
+            const record = (operation, exitCode = null, signal = null) => {
+                try {
+                    const line = Buffer.from(JSON.stringify({ event: 'HELPER_PROCESS', operation, runtimeId, at: new Date().toISOString(), pid: processChild.pid ?? null, parentPid: process.pid, expected: disposed || !!stoppingChild, exitCode, signal, elapsedMs: performance.now() - processStarted }) + '\n');
+                    if (writeSync(log.fd, line) !== line.length)
+                        journalFailed();
+                }
+                catch {
+                    journalFailed();
+                }
+            };
+            const closeJournal = () => { if (journalClosing)
+                return; journalClosing = true; void log.close().catch(() => { journalFailed(); terminal(lifecycleNeed); }).finally(journalDone); };
+            processChild.once('spawn', () => { record('spawn'); if (lifecycleNeed)
+                terminal(lifecycleNeed); });
+            processChild.on('error', () => { record('spawn-error'); terminal(needs('HELPER_PROCESS_FAILED', '网络组件进程启动或运行失败，根因未查明', '管理员检查helper完整性和进程诊断；不重交密钥')); });
+            const exited = (exitCode, signal) => {
+                record('exit', exitCode, signal);
                 processFailed = true;
                 childGone.abort();
                 if (poll)
                     clearTimeout(poll);
                 if (handshakeComplete)
-                    terminal(startupNeed ?? needs('HELPER_EXITED', '网络组件已退出，根因未查明', '管理员查看网络组件日志；不自动重启或重交密钥'));
+                    terminal(startupNeed ?? { ...needs('HELPER_EXITED', '网络组件已退出，当前连接不可用。', '由网络服务按既有身份及恢复策略监督；旧操作不重放，不重交密钥'), cause: `exitCode=${exitCode ?? 'null'}；signal=${signal ?? 'null'}` });
+                void closeJournal();
             };
             processChild.once('exit', exited);
+            processChild.once('close', () => void closeJournal());
             const ready = new Promise((resolve, reject) => {
                 let data = Buffer.alloc(0), settled = false;
                 const started = performance.now();
@@ -270,12 +315,7 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 processChild.stdout.on('data', read);
                 lifetime.signal.addEventListener('abort', aborted, { once: true });
             });
-            try {
-                await ready;
-            }
-            finally {
-                await logClosed;
-            }
+            await ready;
             processChild.stdout.resume();
             if (!disposed)
                 await observe();
@@ -293,7 +333,7 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
         }
     })();
     const api = {
-        start, getState: snapshot,
+        start, getState: snapshot, getRecoveryConfigSHA256: () => configSHA256,
         onState(listener) { listeners.add(listener); return () => listeners.delete(listener); },
         async connect(target, signal) {
             await start();
@@ -415,7 +455,8 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 await starting;
                 await Promise.all([...leases].map(x => x.release()));
                 const forced = await stopOwned();
-                publish(forced ? { phase: 'blocked', error: shutdownNeed } : { phase: 'stopped' });
+                await logClosed;
+                publish(forced ? { phase: 'blocked', error: shutdownNeed } : lifecycleNeed ? { phase: 'blocked', error: lifecycleNeed } : { phase: 'stopped' });
                 listeners.clear();
                 updates.clear();
             })();

package/lib/policy-management.d.ts

@@ -0,0 +1,113 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { recoveryPolicyFields } from './settings.ts';
+import type { NetworkState } from './api.ts';
+type Key = typeof recoveryPolicyFields[number];
+type Raw = Record<string, unknown>;
+interface Entry {
+    options: {
+        id?: string;
+        name?: string;
+        config?: Raw;
+    };
+}
+export interface PolicyConfigEditor {
+    entries(): Entry[];
+    configuration(): {
+        entry: Entry;
+        inherited: Raw;
+        override: Raw;
+    }[];
+    edit(entry: Entry, change: (current: Raw, inherited: Raw) => Raw): Promise<void>;
+}
+interface PolicyObservation {
+    network?: Pick<NetworkState, 'phase' | 'error'>;
+    connection?: {
+        instanceId: string;
+        epoch: number;
+        phase: string;
+    };
+}
+export declare function createPolicyEditor(editor: PolicyConfigEditor, observe?: () => PolicyObservation): {
+    describe: () => {
+        ok: false;
+        error: {
+            code: string;
+            message: string;
+        };
+    } | {
+        ok: true;
+        value: {
+            revision: string;
+            runtime: {
+                observedAt: string;
+                phase: string;
+                need: {
+                    code: string;
+                    message: string;
+                    needs: string;
+                    exit: {
+                        exitCode: number | null;
+                        signal: string | null;
+                    } | null;
+                } | null;
+                connection: {
+                    instanceId: string;
+                    epoch: number;
+                    phase: string;
+                } | null;
+            };
+            fields: Record<Key, {
+                value: number | null;
+                explicit: boolean;
+                defaultValue: number;
+            }>;
+        };
+    };
+    save: (params: URLSearchParams) => Promise<{
+        ok: false;
+        error: {
+            code: string;
+            message: string;
+        };
+    } | {
+        ok: true;
+        value: {
+            revision: string;
+            runtime: {
+                observedAt: string;
+                phase: string;
+                need: {
+                    code: string;
+                    message: string;
+                    needs: string;
+                    exit: {
+                        exitCode: number | null;
+                        signal: string | null;
+                    } | null;
+                } | null;
+                connection: {
+                    instanceId: string;
+                    epoch: number;
+                    phase: string;
+                } | null;
+            };
+            fields: Record<Key, {
+                value: number | null;
+                explicit: boolean;
+                defaultValue: number;
+            }>;
+        };
+    }>;
+};
+interface Web {
+    register(route: {
+        kind: 'prefix';
+        path: string;
+        handler(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    }): () => void;
+}
+interface Connection {
+    requestRejection(req: IncomingMessage): number | undefined;
+}
+export declare function registerPolicyRoutes(web: Web, connection: Connection, service: ReturnType<typeof createPolicyEditor>): () => void;
+export {};

package/lib/policy-management.js

@@ -0,0 +1,123 @@
+import { createHash } from 'node:crypto';
+import { helperRecoveryDefaults, recoveryPolicyFields, validRecoveryPolicy } from "./settings.js";
+const fields = (value) => Object.fromEntries(recoveryPolicyFields.filter(k => Object.hasOwn(value, k)).map(k => [k, value[k]]));
+const revision = (current, inherited) => createHash('sha256').update(JSON.stringify([fields(current), fields(inherited)])).digest('hex');
+const failure = (code, message) => ({ ok: false, error: { code, message } });
+const unavailable = () => failure('RECOVERY_SETTINGS_UNAVAILABLE', '我需要官方配置编辑服务和唯一且已启用的网络组件，才能读取或保存恢复设置。');
+const recoveryNeeds = new Set(['HELPER_RECOVERING', 'HELPER_RECOVERY_EXHAUSTED', 'HELPER_RECOVERY_DISABLED', 'HELPER_RECOVERY_FAILED', 'HELPER_RECOVERY_IDENTITY_REQUIRED', 'HELPER_RECOVERY_CONFIG_CHANGED', 'HELPER_LIFECYCLE_LOG_FAILED', 'HELPER_EXITED', 'HELPER_PROCESS_FAILED', 'HELPER_START_FAILED', 'HELPER_STARTUP_EXPIRED', 'HELPER_SHUTDOWN_FORCED', 'HELPER_HANDOFF_FAILED']);
+function runtimeObservation(observe) {
+    const observedAt = new Date().toISOString();
+    try {
+        const { network, connection } = observe(), error = network?.error;
+        const match = typeof error?.cause === 'string' ? error.cause.match(/(?:^|；)exitCode=(null|-?[0-9]+)；signal=(null|SIG[A-Z0-9]+)(?:；|$)/) : null;
+        const exit = match && (match[1] === 'null' || Number.isSafeInteger(Number(match[1]))) ? { exitCode: match[1] === 'null' ? null : Number(match[1]), signal: match[2] === 'null' ? null : match[2] } : null;
+        const need = error && recoveryNeeds.has(error.code) ? { code: error.code, message: error.message, needs: error.needs, exit } : error ? { code: /^[A-Z][A-Z0-9_]+$/.test(error.code) ? error.code : 'NETWORK_STATUS_UNKNOWN', message: '网络组件当前不可用；请在远程主机连接设置中查看对应诊断。', needs: '我需要管理员核对组件状态；不会重新提交入网密钥。', exit: null } : network ? null : { code: 'NETWORK_SERVICE_REQUIRED', message: '我需要已启用的网络组件才能读取状态。', needs: '请在官方插件管理中查看网络组件是否启用。', exit: null };
+        return { observedAt, phase: network?.phase ?? 'missing', need, connection: connection && typeof connection.instanceId === 'string' && Number.isSafeInteger(connection.epoch) && connection.epoch >= 0 ? { instanceId: connection.instanceId, epoch: connection.epoch, phase: connection.phase } : null };
+    }
+    catch {
+        return { observedAt, phase: 'unknown', need: { code: 'NETWORK_STATUS_UNKNOWN', message: '组件状态读取失败，根因未查明。', needs: '我需要管理员查看组件诊断；本页不猜测当前连接状态。', exit: null }, connection: null };
+    }
+}
+export function createPolicyEditor(editor, observe = () => ({})) {
+    function target() {
+        const entries = editor.entries().filter(e => e.options.id === 'ai-workbench-network' && e.options.name === '@ai-workbench/network');
+        if (entries.length !== 1)
+            return null;
+        const entry = entries[0], layers = editor.configuration().filter(v => v.entry === entry);
+        if (layers.length !== 1)
+            return null;
+        return layers[0];
+    }
+    function describe() {
+        try {
+            const found = target();
+            if (!found)
+                return unavailable();
+            const current = found.entry.options.config ?? {};
+            if (!validRecoveryPolicy(current))
+                return failure('RECOVERY_SETTINGS_INVALID', '恢复设置包含非法值，请通过官方配置编辑流程修正。');
+            return { ok: true, value: { revision: revision(current, found.inherited), runtime: runtimeObservation(observe), fields: Object.fromEntries(recoveryPolicyFields.map(key => [key, { value: current[key] ?? null, explicit: Object.hasOwn(current, key), defaultValue: helperRecoveryDefaults[key] }])) } };
+        }
+        catch {
+            return unavailable();
+        }
+    }
+    async function save(params) {
+        const allowed = ['revision', ...recoveryPolicyFields];
+        if ([...params.keys()].some(k => !allowed.includes(k)) || allowed.some(k => params.getAll(k).length !== 1) || !/^[a-f0-9]{64}$/.test(params.get('revision') ?? ''))
+            return failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：请只提交当前页面中的三项恢复设置。');
+        const values = {};
+        for (const key of recoveryPolicyFields) {
+            const raw = params.get(key);
+            if (raw === 'unset') {
+                values[key] = 'unset';
+                continue;
+            }
+            if (!/^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$/.test(raw))
+                return failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：次数须为非负安全整数；秒数须在0.001到2147483.647之间。');
+            const value = Number(raw);
+            if (!validRecoveryPolicy({ [key]: value }))
+                return failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：次数须为非负安全整数；秒数须在0.001到2147483.647之间。');
+            values[key] = value;
+        }
+        try {
+            const found = target();
+            if (!found)
+                return unavailable();
+            await editor.edit(found.entry, (current, inherited) => {
+                if (revision(current, inherited) !== params.get('revision'))
+                    throw new PolicyConflict();
+                const next = { ...current };
+                for (const key of recoveryPolicyFields) {
+                    if (values[key] === 'unset') {
+                        delete next[key];
+                    }
+                    else
+                        next[key] = values[key];
+                }
+                if (!validRecoveryPolicy(next))
+                    throw new Error('invalid-policy');
+                return next;
+            });
+            return describe();
+        }
+        catch (error) {
+            return error instanceof PolicyConflict ? failure('RECOVERY_SETTINGS_CONFLICT', '设置未保存：配置已被其他操作修改，请重新打开本页核对后保存。') : failure('RECOVERY_SETTINGS_SAVE_FAILED', '官方配置保存或重载失败，请检查插件管理中的错误；本页未确认修改生效。');
+        }
+    }
+    return { describe, save };
+}
+class PolicyConflict extends Error {
+}
+export function registerPolicyRoutes(web, connection, service) {
+    return web.register({ kind: 'prefix', path: '/ai-workbench-network/policy', async handler(req, res) {
+            res.setHeader('Cache-Control', 'no-store');
+            res.setHeader('Content-Type', 'application/json; charset=utf-8');
+            const reply = (status, result) => { res.statusCode = status; res.end(JSON.stringify(result)); };
+            const rejected = connection.requestRejection(req);
+            if (rejected !== undefined) {
+                reply(rejected, failure('RECOVERY_SETTINGS_FORBIDDEN', '需要当前官方客户端的有效连接。'));
+                return;
+            }
+            const url = new URL(req.url ?? '/', 'http://dsh');
+            if (url.pathname !== '/ai-workbench-network/policy') {
+                reply(404, failure('RECOVERY_SETTINGS_NOT_FOUND', '没有此设置操作。'));
+                return;
+            }
+            if (req.method === 'GET' && !url.search) {
+                const result = service.describe();
+                reply(result.ok ? 200 : 503, result);
+                return;
+            }
+            if (req.method === 'POST') {
+                if (req.headers['transfer-encoding'] || req.headers['content-length'] !== undefined && req.headers['content-length'] !== '0') {
+                    reply(400, failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：本操作不接受请求正文。'));
+                    return;
+                }
+                const result = await service.save(url.searchParams);
+                reply(result.ok ? 200 : result.error.code === 'RECOVERY_SETTINGS_INPUT_INVALID' ? 400 : 409, result);
+                return;
+            }
+            reply(400, failure('RECOVERY_SETTINGS_INPUT_INVALID', '不支持此设置操作。'));
+        } });
+}

package/lib/settings-host.d.ts

@@ -0,0 +1,3 @@
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "ai-workbench-network-settings";
+export declare function apply(ctx: Context): void;

package/lib/settings-host.js

@@ -0,0 +1,12 @@
+import { createPolicyEditor, registerPolicyRoutes } from "./policy-management.js";
+export const name = 'ai-workbench-network-settings';
+// 伴生行不持有入网身份，目标 runtime 正常重载时保留保存应答路径。
+export function apply(ctx) {
+    ctx.inject(['webServer', 'connection', 'configEditor'], host => {
+        host.effect(() => registerPolicyRoutes(host.get('webServer'), host.get('connection'), createPolicyEditor(host.get('configEditor'), () => {
+            const network = host.get('aiWorkbenchNetwork', false);
+            const connect = host.get('aiWorkbenchConnect', false);
+            return { network: network?.getState(), connection: connect?.getConnectionState?.() };
+        })));
+    });
+}

package/lib/settings.d.ts

@@ -1,9 +1,21 @@
 import type { PluginSettings, HelperConfig } from './api.ts';
 export declare const helperPolicyFields: readonly ["statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes", "httpMaxResponseHeaderBytes"];
-export declare const pluginPolicyFields: readonly ["startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "downloadMaxRedirects"];
-export declare const settingsFields: readonly ["configFile", "helperLogFile", "startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "downloadMaxRedirects", "statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes", "httpMaxResponseHeaderBytes"];
+export declare const recoveryPolicyFields: readonly ["helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds"];
+export declare const helperRecoveryDefaults: Readonly<{
+    helperRecoveryMaxAttempts: 3;
+    helperRecoveryDelaySeconds: 1;
+    helperRecoveryStableSeconds: 60;
+}>;
+export declare const pluginPolicyFields: readonly ["startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "downloadMaxRedirects", "helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds"];
+export declare const settingsFields: readonly ["configFile", "helperLogFile", "startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "downloadMaxRedirects", "helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds", "statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes", "httpMaxResponseHeaderBytes"];
 export declare const timerSeconds: (v: unknown) => v is number;
 export declare const positiveInteger: (v: unknown) => v is number;
+export declare function validRecoveryPolicy(settings: PluginSettings): boolean;
+export declare function recoveryPolicy(settings: PluginSettings): {
+    helperRecoveryMaxAttempts: number;
+    helperRecoveryDelaySeconds: number;
+    helperRecoveryStableSeconds: number;
+};
 export declare function validHelperPolicy(settings: PluginSettings): boolean;
 export declare function mergedSettings(initial: PluginSettings, provided: PluginSettings): PluginSettings;
 export declare function effectiveConfig(config: HelperConfig, settings: PluginSettings): HelperConfig;

package/lib/settings.js

@@ -1,8 +1,17 @@
 export const helperPolicyFields = ['statusRefreshIntervalSeconds', 'dialTimeoutSeconds', 'headerTimeoutSeconds', 'enrollmentObservationSeconds', 'httpMaxHeaderBytes', 'httpMaxResponseHeaderBytes'];
-export const pluginPolicyFields = ['startupObservationSeconds', 'shutdownObservationSeconds', 'controlResponseMaxBytes', 'downloadMaxRedirects'];
+export const recoveryPolicyFields = ['helperRecoveryMaxAttempts', 'helperRecoveryDelaySeconds', 'helperRecoveryStableSeconds'];
+export const helperRecoveryDefaults = Object.freeze({ helperRecoveryMaxAttempts: 3, helperRecoveryDelaySeconds: 1, helperRecoveryStableSeconds: 60 });
+export const pluginPolicyFields = ['startupObservationSeconds', 'shutdownObservationSeconds', 'controlResponseMaxBytes', 'downloadMaxRedirects', ...recoveryPolicyFields];
 export const settingsFields = ['configFile', 'helperLogFile', ...pluginPolicyFields, ...helperPolicyFields];
 export const timerSeconds = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0.001 && v * 1000 <= 2147483647;
 export const positiveInteger = (v) => Number.isSafeInteger(v) && Number(v) > 0;
+export function validRecoveryPolicy(settings) {
+    const max = settings.helperRecoveryMaxAttempts;
+    return (max === undefined || (Number.isSafeInteger(max) && max >= 0)) && recoveryPolicyFields.slice(1).every(key => settings[key] === undefined || timerSeconds(settings[key]));
+}
+export function recoveryPolicy(settings) {
+    return { helperRecoveryMaxAttempts: settings.helperRecoveryMaxAttempts ?? helperRecoveryDefaults.helperRecoveryMaxAttempts, helperRecoveryDelaySeconds: settings.helperRecoveryDelaySeconds ?? helperRecoveryDefaults.helperRecoveryDelaySeconds, helperRecoveryStableSeconds: settings.helperRecoveryStableSeconds ?? helperRecoveryDefaults.helperRecoveryStableSeconds };
+}
 export function validHelperPolicy(settings) {
     return helperPolicyFields.every(key => {
         const v = settings[key];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/network",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "type": "module",
   "engines": {
     "node": ">=24.13.1"
@@ -19,6 +19,11 @@
       "default": "./lib/cordis.js"
     },
     "./package.json": "./package.json",
+    "./settings": {
+      "types": "./lib/settings-host.d.ts",
+      "default": "./lib/settings-host.js"
+    },
+    "./client": "./client/index.cjs",
     "./locale/*.json": "./locale/*.json"
   },
   "files": [
@@ -26,9 +31,17 @@
     "NOTICE.md",
     "cordis.patch.yml",
     "locale",
-    "helpers"
+    "helpers",
+    "client"
   ],
   "dsh": {
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ]
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     }
@@ -46,6 +59,8 @@
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/schemastery": "3.18.4",
     "@types/node": "24.0.0",
+    "react": "18.3.1",
+    "react-test-renderer": "18.3.1",
     "typescript": "5.9.3"
   },
   "publishConfig": {