@ai-workbench/network 0.4.7 → 0.4.9

package/lib/api.d.ts

@@ -43,17 +43,6 @@ export interface EnrollmentTarget {
     port: number;
     knownHostsFile: string;
 }
-export interface ProxyCredentials {
-    apiVersion: 1;
-    id: string;
-    url: string;
-    username: string;
-    password: string;
-}
-export interface LoginProxyLease {
-    credentials: ProxyCredentials;
-    release(): Promise<void>;
-}
 export interface EnrollmentReceipt {
     apiVersion: 1;
     session: 'key' | 'identity';
@@ -118,8 +107,6 @@ export interface NetworkChannels {
         proxyCommand: string;
     }>>;
     onState(listener: (event: NetworkEvent) => void): () => void;
-    openLoginProxy(signal: AbortSignal): Promise<Result<LoginProxyLease>>;
-    download(source: string, signal: AbortSignal): Promise<Result<Response>>;
     dispose(): Promise<void>;
 }
 export interface PluginSettings {
@@ -128,7 +115,6 @@ export interface PluginSettings {
     startupObservationSeconds?: number;
     shutdownObservationSeconds?: number;
     controlResponseMaxBytes?: number;
-    downloadMaxRedirects?: number;
     helperRecoveryMaxAttempts?: number;
     helperRecoveryDelaySeconds?: number;
     helperRecoveryStableSeconds?: number;
@@ -137,7 +123,6 @@ export interface PluginSettings {
     headerTimeoutSeconds?: number;
     enrollmentObservationSeconds?: number;
     httpMaxHeaderBytes?: number;
-    httpMaxResponseHeaderBytes?: number;
 }
 export interface HelperConfig {
     apiVersion: 1;
@@ -151,13 +136,11 @@ export interface HelperConfig {
         employee: string;
         knownHostsFile?: string;
     };
-    proxyListen: string;
     statusRefreshIntervalSeconds: number;
     dialTimeoutSeconds: number;
     headerTimeoutSeconds: number;
     enrollmentObservationSeconds: number;
     httpMaxHeaderBytes: number;
-    httpMaxResponseHeaderBytes: number;
     logUpload: false;
 }
 export declare const ok: <T>(value: T) => Result<T>;

package/lib/control.d.ts

@@ -1,4 +1,3 @@
 import type { IncomingMessage } from 'node:http';
 export declare function control(socket: string, method: string, path: string, signal: AbortSignal, seconds: number, maxHeaderBytes: number, body?: unknown): Promise<IncomingMessage>;
 export declare function jsonResponse(response: IncomingMessage, maxBytes: number): Promise<unknown>;
-export declare function firstFrame(response: IncomingMessage, maxBytes: number): Promise<unknown>;

package/lib/control.js

@@ -32,35 +32,3 @@ export async function jsonResponse(response, maxBytes) {
     }
     return JSON.parse(Buffer.concat(chunks).toString('utf8'));
 }
-export async function firstFrame(response, maxBytes) {
-    return new Promise((resolve, reject) => {
-        let data = Buffer.alloc(0);
-        const cleanup = () => { response.off('data', read); response.off('error', error); response.off('end', end); };
-        const error = () => { cleanup(); reject(new Error('CONTROL_STREAM_INVALID')); };
-        const end = () => error();
-        const read = (chunk) => {
-            data = Buffer.concat([data, chunk]);
-            if (data.length > maxBytes) {
-                cleanup();
-                response.destroy();
-                reject(new Error('CONTROL_RESPONSE_LIMIT'));
-                return;
-            }
-            const nl = data.indexOf(10);
-            if (nl < 0)
-                return;
-            cleanup();
-            response.pause();
-            try {
-                resolve(JSON.parse(data.subarray(0, nl).toString('utf8')));
-            }
-            catch {
-                response.destroy();
-                reject(new Error('CONTROL_FRAME_INVALID'));
-            }
-        };
-        response.on('data', read);
-        response.once('error', error);
-        response.once('end', end);
-    });
-}

package/lib/employee-endpoint.js

@@ -50,7 +50,7 @@ export function bindEmployeeSourceLifecycle(ctx, controller) {
 }
 export function createEmployeeEndpointController(d) {
     let source, disposed = false, revision = 0, held;
-    let unsubscribers = [], lifetime = new AbortController(), closing = Promise.resolve(), closeFailed = false;
+    let unsubscribers = [], lifetime = new AbortController(), closing = Promise.resolve();
     let pending;
     const detached = () => { for (const off of unsubscribers)
         off(); unsubscribers = []; };
@@ -62,7 +62,7 @@ export function createEmployeeEndpointController(d) {
         const old = held;
         held = undefined;
         if (old)
-            closing = closing.then(() => old.closeEmployeeEndpoint()).catch(() => { closeFailed = true; console.error('EMPLOYEE_ENDPOINT_CLOSE_FAILED'); });
+            closing = closing.then(() => old.closeEmployeeEndpoint()).catch(() => { console.error('EMPLOYEE_ENDPOINT_CLOSE_FAILED'); });
     }
     function localRemains() {
         const s = source?.getWorkspaceLocationState?.();
@@ -188,9 +188,9 @@ export function createEmployeeEndpointController(d) {
         if (disposed || owner.aborted || revision !== token || d.getConnect() !== s)
             return fail('EMPLOYEE_CONTEXT_CHANGED', '工作区连接已变化。', '重新核验后派发');
         await closing;
-        if (closeFailed)
-            return fail('EMPLOYEE_ENDPOINT_UNAVAILABLE', '旧员工端点关闭未能确认。', '检查组件私有日志，正常停止旧实例后再继续；不要重放旧操作');
-        if (disposed || owner.aborted || revision !== token || d.getRuntime() !== runtime)
+        if (signal.aborted)
+            return cancelled();
+        if (disposed || owner.aborted || revision !== token || d.getConnect() !== s || d.getRuntime() !== runtime)
             return fail('EMPLOYEE_CONTEXT_CHANGED', '员工端点上下文已变化。', '重新核验后派发');
         // One shared preparation per actual device context, never per workspace. Each caller revalidates its own L CAS.
         let work = pending;

package/lib/index.js

@@ -10,18 +10,16 @@ export const Config = z.object({
     helperLogFile: z.string().description('远程主机连接诊断日志文件（无默认值）'),
     startupObservationSeconds: positive().description('启动观察 startupObservationSeconds（秒）：默认未设，沿开通值（现值35）；等待组件ready仅为可观测性；增大等更久，减小可能提前报未知；无关闭值，超时给等待事项、已等时长和排查步骤'),
     shutdownObservationSeconds: positive().description('退出观察 shutdownObservationSeconds（秒）：默认未设，沿开通值（现值10）；等待自有组件正常退出，仅为可观测性；增大清理等更久，减小可能强制结束并报告；无关闭值，不终止未知进程'),
-    controlResponseMaxBytes: bytes().description('控制响应上限 controlResponseMaxBytes（字节）：默认未设，沿开通值（现值65536）；控制JSON、ready及代理首帧，也约束员工端点私有控制请求/响应和主机桥首帧；增大增加内存，减小可能拒绝合法帧；无关闭或无限值，不限制下载或SFTP正文'),
-    downloadMaxRedirects: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER).description('下载重定向上限 downloadMaxRedirects：默认未设，沿开通值（现值3）；增大允许更多HTTPS跳转，减小可能拒绝下载，0关闭跳转；不自动换源'),
-    helperRecoveryMaxAttempts: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER).description('组件自动恢复次数 helperRecoveryMaxAttempts：默认3；仅复用已有身份恢复意外退出的自有helper，不重放SSH或模型请求。增大允许更多连续恢复，减小更早停止；0关闭自动恢复。次数耗尽停止并显示退出原因，需要管理员排查后正常重载插件；不重交密钥'),
+    controlResponseMaxBytes: bytes().description('控制响应上限 controlResponseMaxBytes（字节）：默认未设，沿开通值（现值65536）；控制JSON、ready帧，也约束员工端点私有控制请求/响应和主机桥首帧；增大增加内存，减小可能拒绝合法帧；无关闭或无限值，不限制SFTP正文'),
+    helperRecoveryMaxAttempts: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER).description('组件自动恢复次数 helperRecoveryMaxAttempts：默认3；仅复用已有身份恢复自有网络组件退出或控制通道中断，不重放SSH或模型请求。增大允许更多连续恢复，减小更早停止；0关闭自动恢复。次数耗尽停止并显示原因；网络恢复后可关闭再启用网络组件，正常重载后发送下一轮；不重交密钥'),
     helperRecoveryDelaySeconds: positive().description('组件恢复间隔 helperRecoveryDelaySeconds（秒）：默认1；增大减少频繁拉起但恢复更慢，减小恢复更快且增加连续启动开销；无关闭值，关闭自动恢复请将helperRecoveryMaxAttempts设为0'),
     helperRecoveryStableSeconds: positive().description('组件恢复计数清零 helperRecoveryStableSeconds（秒）：默认60；连续在线达到此时长才清零。增大更严格识别反复崩溃，减小更快清零但可能把短暂在线当成稳定；无关闭值，不以刚收到ready立即清零'),
     statusRefreshIntervalSeconds: positive().description('状态刷新间隔 statusRefreshIntervalSeconds（秒）：默认沿已开通配置（现值2）；影响组件状态查询及插件轮询；增大提示更迟，减小增加查询开销；无关闭值，不代表失败重试已修复'),
-    dialTimeoutSeconds: positive().description('拨号观察 dialTimeoutSeconds（秒）：默认沿已开通配置（现值20）；远端TCP/SSH、控制响应头、下载CONNECT/响应头；Node请求采用阶段空闲观察，仅为可观测性，增大等更久，减小可能提前中止；无关闭值，超时说明等待事项、已等时长、下一步检查，不是修复'),
-    headerTimeoutSeconds: z.number().min(1e-9).max(9223372036.854774).description('请求头观察 headerTimeoutSeconds（秒）：默认沿已开通配置（现值10）；本机控制与登录代理请求头；仅为可观测性，增大保留连接更久，减小可能拒绝慢请求头；无关闭值，超时在私有日志说明等待事项、已等时长、下一步检查'),
-    enrollmentObservationSeconds: z.number().min(1e-9).max(9223372036.854774).description('首次入网观察 enrollmentObservationSeconds（秒）：默认沿已开通配置（现值30）；仅观察首次开通结果，不用于删除已有身份；增大等更久，减小可能更早报未知；无关闭值，超时说明等待事项、已等时长、下一步检查，不重交开通材料'),
-    httpMaxHeaderBytes: bytes().description('本机HTTP头上限 httpMaxHeaderBytes（字节）：默认沿已开通配置（现值1048576）；控制/登录代理请求头及控制响应头；增大增加解析内存，减小可能拒绝合法头；无关闭或无限值，不是正文上限'),
-    httpMaxResponseHeaderBytes: bytes().description('下载HTTP响应头上限 httpMaxResponseHeaderBytes（字节）：默认沿已开通配置（现值1048576）；主机代理及下载响应头/CONNECT头；增大增加解析内存，减小可能拒绝合法头；无关闭或无限值，不是正文上限'),
-}).description('运行策略优先级：本插件显式值 > 开通方传入值 > 原私有配置；既有策略未设置沿用原值。新增组件恢复策略未设时分别为3次/1秒/连续在线60秒，均在本页可改；不写回私有配置。活动连接改策略须正常重载插件，不重交开通材料。固定正确性约束不可关闭：macOS控制socket路径≤103字节、端口1–65535、计时器/整数可表示范围、私有700/600权限、当前用户与单身份隔离、SHA256及加密随机凭据强度。');
+    dialTimeoutSeconds: positive().description('拨号观察 dialTimeoutSeconds（秒）：默认沿已开通配置（现值20）；远端TCP/SSH、控制响应头；Node请求采用阶段空闲观察，仅为可观测性，增大等更久，减小可能提前中止；无关闭值，超时说明等待事项、已等时长、下一步检查，不是修复'),
+    headerTimeoutSeconds: z.number().min(1e-9).max(9223372036.854774).description('请求头观察 headerTimeoutSeconds（秒）：默认沿已开通配置（现值10）；本机控制请求头；仅为可观测性，增大保留连接更久，减小可能拒绝慢请求头；无关闭值，超时在私有日志说明等待事项、已等时长、下一步检查'),
+    enrollmentObservationSeconds: z.number().min(1e-9).max(9223372036.854774).description('首次入网观察 enrollmentObservationSeconds（秒）：默认沿已开通配置（现值30）；仅观察首次开通结果，不用于删除已有身份；增大等更久，减小可能更早报未知；无关闭值，超时说明等待事项、已等时长、下一步检查；未知结果先查持久身份，无身份时仅用原材料补救一次'),
+    httpMaxHeaderBytes: bytes().description('本机HTTP头上限 httpMaxHeaderBytes（字节）：默认沿已开通配置（现值1048576）；控制请求头及控制响应头；增大增加解析内存，减小可能拒绝合法头；无关闭或无限值，不是正文上限'),
+}).description('运行策略优先级：本插件显式值 > 开通方传入值 > 原私有配置；既有策略未设置沿用原值。新增组件恢复策略未设时分别为3次/1秒/连续在线60秒，均在本页可改；不写回私有配置。活动连接改策略须正常重载插件，不重交开通材料。固定正确性约束不可关闭：macOS控制socket路径≤103字节、端口1–65535、计时器/整数可表示范围、私有700/600权限、当前用户与单身份隔离、SHA256。');
 export function register(ctx, api) {
     ctx.provide('aiWorkbenchNetwork', api);
     ctx.effect(() => { void api.start(); return () => api.dispose(); });
@@ -31,7 +29,7 @@ export function apply(ctx, config = {}) {
     if (!executable.ok) {
         const error = executable;
         const state = { phase: 'blocked', ...!error.ok ? { error: error.error } : {} };
-        register(ctx, { async prepareEmployeeEndpoint() { return error; }, async activate() { return error; }, getActivationState: () => ({ instanceId: 'unpackaged', revision: 0, phase: 'blocked', receipt: null, error: !error.ok ? error.error : null }), onActivationState: () => () => { }, async start() { ctx.emit('ai-workbench/network-state', state); }, getState: () => structuredClone(state), async connect() { return error; }, onState: () => () => { }, async openLoginProxy() { return error; }, async download() { return error; }, async dispose() { } });
+        register(ctx, { async prepareEmployeeEndpoint() { return error; }, async activate() { return error; }, getActivationState: () => ({ instanceId: 'unpackaged', revision: 0, phase: 'blocked', receipt: null, error: !error.ok ? error.error : null }), onActivationState: () => () => { }, async start() { ctx.emit('ai-workbench/network-state', state); }, getState: () => structuredClone(state), async connect() { return error; }, onState: () => () => { }, async dispose() { } });
         return;
     }
     const api = createActivationService(config, executable.value, state => ctx.emit('ai-workbench/network-state', state), undefined, () => ctx.get('aiWorkbenchConnect', false));

package/lib/network.d.ts

@@ -1,5 +1,5 @@
 import { control } from './control.ts';
-import type { PluginSettings, NetworkChannels, NetworkState } from './api.ts';
+import type { HelperConfig, PluginSettings, NetworkChannels, NetworkState } from './api.ts';
 import type { EmployeeRuntime } from './employee-endpoint.ts';
 export interface Executable {
     path: string;
@@ -7,7 +7,9 @@ export interface Executable {
     platform: string;
     arch: string;
 }
-export declare function createNetwork(settings: PluginSettings, executable: Executable, emit?: (state: NetworkState) => void, controlIO?: typeof control, resumeIdentityOnly?: boolean, expectedConfigSHA256?: string): NetworkChannels & EmployeeRuntime & {
+export declare function createNetwork(settings: PluginSettings, executable: Executable, emit?: (state: NetworkState) => void, controlIO?: typeof control, resumeIdentityOnly?: boolean, expectedConfigSHA256?: string, expectedConfigSnapshot?: HelperConfig): NetworkChannels & EmployeeRuntime & {
     start(): Promise<void>;
     getRecoveryConfigSHA256?(): string | undefined;
+    getRecoveryConfigSnapshot?(): HelperConfig | undefined;
+    isRunning?(): boolean;
 };

package/lib/network.js

@@ -1,12 +1,12 @@
 import { spawn } from 'node:child_process';
 import { writeSync } from 'node:fs';
+import { isDeepStrictEqual } from 'node:util';
 import { randomUUID, createHash } from 'node:crypto';
 import { join, isAbsolute, normalize, dirname, basename, relative, sep } from 'node:path';
 import { realpath, lstat } from 'node:fs/promises';
 import { privateFile, verifyExecutable } from "./private.js";
-import { control, jsonResponse, firstFrame } from "./control.js";
+import { control, jsonResponse } from "./control.js";
 import { fail, ok } from "./api.js";
-import { downloadThroughProxy } from "./download.js";
 import { effectiveConfig, helperPolicyArgs, validHelperPolicy } from "./settings.js";
 import { ObservationExpired, observationNeed } from "./observation.js";
 import { readEmployeeProcess, employeeReady } from "./employee-endpoint.js";
@@ -40,16 +40,36 @@ function statusFrame(v) {
     const receipt = receiptFrame(v.receipt);
     return { ...receipt ? { receipt } : {}, apiVersion: 1, enrollment: v.enrollment, node: { name: v.node.name, ips: v.node.ips }, host: { name: v.host.name, online: v.host.online, lastSeenAt: v.host.lastSeenAt, observedAt: v.host.observedAt }, error };
 }
-export function createNetwork(settings, executable, emit = () => { }, controlIO = control, resumeIdentityOnly = false, expectedConfigSHA256) {
+// Only the enrollment key reference may disappear. Go also omits these empty
+// optional fields when rewriting the same Config; their values cannot change.
+function clearedEnrollmentConfig(before, after) {
+    if (!before || typeof before.authKeyFile !== 'string' || !before.authKeyFile || Object.hasOwn(after, 'authKeyFile'))
+        return false;
+    const expected = structuredClone(before);
+    delete expected.authKeyFile;
+    if (isDeepStrictEqual(expected, after))
+        return true;
+    if (expected.httpMaxResponseHeaderBytes === 0)
+        delete expected.httpMaxResponseHeaderBytes;
+    if (expected.proxyListen === '')
+        delete expected.proxyListen;
+    if (expected.host?.knownHostsFile === '')
+        delete expected.host.knownHostsFile;
+    return isDeepStrictEqual(expected, after);
+}
+export function createNetwork(settings, executable, emit = () => { }, controlIO = control, resumeIdentityOnly = false, expectedConfigSHA256, expectedConfigSnapshot) {
     let state = { phase: 'starting' }, cfg, child;
     let starting, disposing, disposed = false, online = false;
     let poll;
     let processFailed = false, startupReceipt, terminalNeed, stoppingChild, shutdownNeed;
-    let logClosed, lifecycleNeed;
-    let configSHA256;
+    let journalWarned = false;
+    const journalFailed = () => { if (!journalWarned) {
+        journalWarned = true;
+        console.error('网络连接诊断记录未完整写入。');
+    } };
+    let configSHA256, configSnapshot;
     const childGone = new AbortController();
     const lifetime = new AbortController(), listeners = new Set(), updates = new Set();
-    const leases = new Set();
     let employeeParent, employeeUmask;
     const snapshot = () => structuredClone(state);
     const publish = (next) => {
@@ -75,10 +95,6 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
     const terminal = (need) => {
         processFailed = true;
         terminalNeed ??= need;
-        if (lifecycleNeed) {
-            lifecycleNeed.cause ??= [terminalNeed.code, terminalNeed.message, terminalNeed.cause].filter(Boolean).join('；');
-            terminalNeed = lifecycleNeed;
-        }
         childGone.abort();
         if (poll)
             clearTimeout(poll);
@@ -129,12 +145,10 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
     const start = () => starting ??= (async () => {
         let startupNeed, handshakeComplete = false;
         try {
-            if (!settings.configFile || !settings.helperLogFile || !seconds(settings.startupObservationSeconds) || !seconds(settings.shutdownObservationSeconds) || !integer(settings.controlResponseMaxBytes) || !Number.isSafeInteger(settings.downloadMaxRedirects) || settings.downloadMaxRedirects < 0) {
-                block('SETTINGS_REQUIRED', '我需要管理员提供网络安装配置和具名设置', '安装期交付N私有config、日志路径、观察期限、响应上限和重定向次数');
+            if (!settings.configFile || !seconds(settings.startupObservationSeconds) || !seconds(settings.shutdownObservationSeconds) || !integer(settings.controlResponseMaxBytes)) {
+                block('SETTINGS_REQUIRED', '我需要管理员提供网络安装配置和具名设置', '安装期交付N私有config、日志路径、观察期限及响应上限');
                 return;
             }
-            if (!isAbsolute(settings.helperLogFile) || settings.helperLogFile === settings.configFile)
-                throw new Error('CONFIG_INVALID');
             const file = await privateFile(settings.configFile);
             let configStat;
             try {
@@ -142,22 +156,21 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 const bytes = await file.readFile();
                 configSHA256 = createHash('sha256').update(bytes).digest('hex');
                 cfg = JSON.parse(bytes.toString('utf8'));
+                configSnapshot = structuredClone(cfg);
             }
             finally {
                 await file.close();
             }
-            if (resumeIdentityOnly && Object.hasOwn(cfg, 'authKeyFile')) {
-                startupNeed = needs('HELPER_RECOVERY_IDENTITY_REQUIRED', '无法安全恢复既有身份，连接配置仍含首次开通材料。', '管理员核对原身份与消费记录；不会读取或重新提交旧密钥');
-                throw new Error(startupNeed.code);
-            }
-            if (expectedConfigSHA256 !== undefined && configSHA256 !== expectedConfigSHA256) {
+            if (expectedConfigSHA256 !== undefined && configSHA256 !== expectedConfigSHA256 && !clearedEnrollmentConfig(expectedConfigSnapshot, cfg)) {
                 startupNeed = needs('HELPER_RECOVERY_CONFIG_CHANGED', '网络配置在组件运行后发生变化，已停止自动恢复。', '管理员核对原连接配置与身份；不启动其他身份、不重交密钥');
                 throw new Error(startupNeed.code);
             }
+            if (expectedConfigSHA256 !== undefined)
+                expectedConfigSHA256 = configSHA256;
             if (!validHelperPolicy(settings))
                 throw new Error('CONFIG_INVALID');
             cfg = effectiveConfig(cfg, settings);
-            if (normalize(settings.helperLogFile) !== settings.helperLogFile || normalize(settings.configFile) !== settings.configFile)
+            if (normalize(settings.configFile) !== settings.configFile)
                 throw new Error('CONFIG_INVALID');
             const canonical = async (p) => { try {
                 return await realpath(p);
@@ -170,23 +183,27 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                     throw error;
                 return join(await canonical(parent), basename(p));
             } };
-            const logPath = await canonical(settings.helperLogFile);
-            if (logPath === await canonical(settings.configFile) || (cfg?.authKeyFile && logPath === await canonical(cfg.authKeyFile)) || (cfg?.host?.knownHostsFile && logPath === await canonical(cfg.host.knownHostsFile)))
-                throw new Error('CONFIG_INVALID');
-            for (const dir of [cfg?.stateDir, cfg?.runtimeDir]) {
-                if (typeof dir !== 'string' || !isAbsolute(dir))
-                    throw new Error('CONFIG_INVALID');
-                const rel = relative(await canonical(dir), logPath);
-                if (rel === '' || (rel !== '..' && !rel.startsWith('..' + sep) && !isAbsolute(rel)))
-                    throw new Error('CONFIG_INVALID');
-            }
-            if (cfg?.apiVersion !== 1 || !isAbsolute(cfg.runtimeDir) || !cfg.host || !seconds(cfg.statusRefreshIntervalSeconds) || !seconds(cfg.dialTimeoutSeconds) || !integer(cfg.httpMaxHeaderBytes) || !integer(cfg.httpMaxResponseHeaderBytes))
+            if (cfg?.apiVersion !== 1 || !isAbsolute(cfg.runtimeDir) || !cfg.host || !seconds(cfg.statusRefreshIntervalSeconds) || !seconds(cfg.dialTimeoutSeconds) || !integer(cfg.httpMaxHeaderBytes))
                 throw new Error('CONFIG_INVALID');
             if (executable.platform !== process.platform || executable.arch !== process.arch)
                 throw new Error('HELPER_PLATFORM_UNSUPPORTED');
             await verifyExecutable(executable.path, executable.sha256);
-            const log = await privateFile(settings.helperLogFile, true);
+            let log;
             try {
+                const logFile = settings.helperLogFile;
+                if (typeof logFile !== 'string' || !isAbsolute(logFile) || normalize(logFile) !== logFile)
+                    throw new Error('CONFIG_INVALID');
+                const logPath = await canonical(logFile);
+                if (logPath === await canonical(settings.configFile) || (cfg?.authKeyFile && logPath === await canonical(cfg.authKeyFile)) || (cfg?.host?.knownHostsFile && logPath === await canonical(cfg.host.knownHostsFile)))
+                    throw new Error('CONFIG_INVALID');
+                for (const dir of [cfg?.stateDir, cfg?.runtimeDir]) {
+                    if (typeof dir !== 'string' || !isAbsolute(dir))
+                        throw new Error('CONFIG_INVALID');
+                    const rel = relative(await canonical(dir), logPath);
+                    if (rel === '' || (rel !== '..' && !rel.startsWith('..' + sep) && !isAbsolute(rel)))
+                        throw new Error('CONFIG_INVALID');
+                }
+                log = await privateFile(logFile, true, journalFailed);
                 const st = await log.stat();
                 if (st.nlink !== 1)
                     throw new Error('CONFIG_INVALID');
@@ -204,12 +221,15 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                     }
                 }
             }
-            catch (error) {
-                await log.close();
-                throw error;
+            catch {
+                if (log)
+                    void log.close().catch(journalFailed);
+                log = undefined;
+                journalFailed();
             }
             if (disposed) {
-                await log.close();
+                if (log)
+                    void log.close().catch(journalFailed);
                 return;
             }
             const parent = readEmployeeProcess();
@@ -225,19 +245,20 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 environment.AW_NET_PARENT_UMASK = String(employeeUmask);
             }
             try {
-                child = spawn(executable.path, ['serve', '--config', settings.configFile, ...resumeIdentityOnly ? ['--resumeIdentityOnly'] : [], ...expectedConfigSHA256 ? ['--resumeConfigSHA256', expectedConfigSHA256] : [], ...helperPolicyArgs(settings), '--controlResponseMaxBytes', String(settings.controlResponseMaxBytes)], { stdio: ['ignore', 'pipe', log.fd], env: environment });
+                child = spawn(executable.path, ['serve', '--config', settings.configFile, ...resumeIdentityOnly ? ['--resumeIdentityOnly'] : [], ...expectedConfigSHA256 ? ['--resumeConfigSHA256', expectedConfigSHA256] : [], ...helperPolicyArgs(settings), '--controlResponseMaxBytes', String(settings.controlResponseMaxBytes)], { stdio: ['ignore', 'pipe', log?.fd ?? 'ignore'], env: environment });
             }
             catch (error) {
-                await log.close();
+                if (log)
+                    void log.close().catch(journalFailed);
                 throw error;
             }
             // Install process handlers before yielding: spawn errors can arrive on nextTick.
             const processChild = child;
             const runtimeId = randomUUID(), processStarted = performance.now();
-            let journalClosing = false, journalDone;
-            logClosed = new Promise(resolve => journalDone = resolve);
-            const journalFailed = () => { lifecycleNeed ??= needs('HELPER_LIFECYCLE_LOG_FAILED', '网络组件进程诊断无法完整写入，已停止自动恢复。', '管理员检查诊断日志权限、磁盘及退出记录；不重交密钥'); };
+            let journalClosing = false;
             const record = (operation, exitCode = null, signal = null) => {
+                if (!log)
+                    return;
                 try {
                     const line = Buffer.from(JSON.stringify({ event: 'HELPER_PROCESS', operation, runtimeId, at: new Date().toISOString(), pid: processChild.pid ?? null, parentPid: process.pid, expected: disposed || !!stoppingChild, exitCode, signal, elapsedMs: performance.now() - processStarted }) + '\n');
                     if (writeSync(log.fd, line) !== line.length)
@@ -248,10 +269,10 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 }
             };
             const closeJournal = () => { if (journalClosing)
-                return; journalClosing = true; void log.close().catch(() => { journalFailed(); terminal(lifecycleNeed); }).finally(journalDone); };
-            processChild.once('spawn', () => { record('spawn'); if (lifecycleNeed)
-                terminal(lifecycleNeed); });
+                return; journalClosing = true; if (log)
+                void log.close().catch(journalFailed); };
             processChild.on('error', () => { record('spawn-error'); terminal(needs('HELPER_PROCESS_FAILED', '网络组件进程启动或运行失败，根因未查明', '管理员检查helper完整性和进程诊断；不重交密钥')); });
+            processChild.once('spawn', () => record('spawn'));
             const exited = (exitCode, signal) => {
                 record('exit', exitCode, signal);
                 processFailed = true;
@@ -333,7 +354,7 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
         }
     })();
     const api = {
-        start, getState: snapshot, getRecoveryConfigSHA256: () => configSHA256,
+        start, getState: snapshot, getRecoveryConfigSHA256: () => configSHA256, getRecoveryConfigSnapshot: () => configSnapshot ? structuredClone(configSnapshot) : undefined, isRunning: alive,
         onState(listener) { listeners.add(listener); return () => listeners.delete(listener); },
         async connect(target, signal) {
             await start();
@@ -350,60 +371,6 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 return { ok: false, error: state.error ?? needs('NETWORK_NOT_READY', '远程主机：未连接', '等待网络在线') };
             return ok({ proxyCommand: [executable.path, 'ssh-proxy', '--runtime-dir', cfg.runtimeDir].map(quote).join(' ') + ' %h %p' });
         },
-        async openLoginProxy(signal) {
-            await start();
-            if (disposed || signal.aborted)
-                return fail('DISPOSED', '登录代理已取消', '重新发起登录');
-            if (state.phase !== 'online' || !alive())
-                return { ok: false, error: state.error ?? needs('NETWORK_NOT_READY', '远程主机：未连接', '等待网络在线') };
-            const owner = new AbortController();
-            const cancel = () => owner.abort();
-            signal.addEventListener('abort', cancel, { once: true });
-            lifetime.signal.addEventListener('abort', cancel, { once: true });
-            childGone.signal.addEventListener('abort', cancel, { once: true });
-            let lease, diagnostic;
-            try {
-                const res = await request('POST', '/v1/login-proxy', owner.signal);
-                if (res.statusCode !== 201) {
-                    const value = await jsonResponse(res, settings.controlResponseMaxBytes);
-                    if (value?.apiVersion === 1 && value.error && ['code', 'message', 'needs', 'actor'].every(k => typeof value.error[k] === 'string'))
-                        diagnostic = { code: value.error.code, message: value.error.message, needs: value.error.needs, actor: value.error.actor, cause: typeof value.error.cause === 'string' ? value.error.cause : null };
-                    throw new Error('PROXY_UNAVAILABLE');
-                }
-                if (res.headers['content-type'] !== 'application/x-ndjson' || res.headers['cache-control'] !== 'no-store') {
-                    res.destroy();
-                    throw new Error('CONTROL_PROTOCOL_INVALID');
-                }
-                const frame = await firstFrame(res, settings.controlResponseMaxBytes);
-                const url = new URL(frame.url);
-                if (frame.apiVersion !== 1 || url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || url.username || url.password || !['id', 'username', 'password'].every(k => typeof frame[k] === 'string' && frame[k]))
-                    throw new Error('CONTROL_PROTOCOL_INVALID');
-                const credentials = { apiVersion: 1, id: frame.id, url: url.origin, username: frame.username, password: frame.password };
-                let released = false;
-                lease = { credentials, async release() { if (released)
-                        return; released = true; owner.abort(); res.destroy(); signal.removeEventListener('abort', cancel); lifetime.signal.removeEventListener('abort', cancel); childGone.signal.removeEventListener('abort', cancel); leases.delete(lease); credentials.username = ''; credentials.password = ''; } };
-                const current = lease;
-                owner.signal.addEventListener('abort', () => void current.release(), { once: true });
-                res.on('error', () => void current.release());
-                res.on('close', () => void current.release());
-                leases.add(current);
-                if (owner.signal.aborted)
-                    await current.release();
-                if (owner.signal.aborted)
-                    return fail('DISPOSED', '登录代理已取消', '重新发起登录');
-                return ok(current);
-            }
-            catch (error) {
-                owner.abort();
-                signal.removeEventListener('abort', cancel);
-                lifetime.signal.removeEventListener('abort', cancel);
-                childGone.signal.removeEventListener('abort', cancel);
-                diagnostic ??= observationNeed(error);
-                return diagnostic ? { ok: false, error: diagnostic } : fail('PROXY_UNAVAILABLE', '登录代理未能建立，根因未查明', '查看主机网络与信任材料');
-            }
-        },
-        async download(source, signal) { const lease = await api.openLoginProxy(signal); if (!lease.ok)
-            return lease; return downloadThroughProxy(source, lease.value, signal, settings.downloadMaxRedirects, cfg.dialTimeoutSeconds, cfg.httpMaxResponseHeaderBytes); },
         async prepareEmployeeEndpoint(settingsPath, signal) {
             if (disposed)
                 return fail('DISPOSED', '网络服务已停止。', '重新加载插件');
@@ -453,10 +420,8 @@ export function createNetwork(settings, executable, emit = () => { }, controlIO
                 for (const update of updates)
                     update();
                 await starting;
-                await Promise.all([...leases].map(x => x.release()));
                 const forced = await stopOwned();
-                await logClosed;
-                publish(forced ? { phase: 'blocked', error: shutdownNeed } : lifecycleNeed ? { phase: 'blocked', error: lifecycleNeed } : { phase: 'stopped' });
+                publish(forced ? { phase: 'blocked', error: shutdownNeed } : { phase: 'stopped' });
                 listeners.clear();
                 updates.clear();
             })();

package/lib/policy-management.d.ts

@@ -17,7 +17,6 @@ export interface PolicyConfigEditor {
         inherited: Raw;
         override: Raw;
     }[];
-    edit(entry: Entry, change: (current: Raw, inherited: Raw) => Raw): Promise<void>;
 }
 interface PolicyObservation {
     network?: Pick<NetworkState, 'phase' | 'error'>;
@@ -37,7 +36,6 @@ export declare function createPolicyEditor(editor: PolicyConfigEditor, observe?:
     } | {
         ok: true;
         value: {
-            revision: string;
             runtime: {
                 observedAt: string;
                 phase: string;
@@ -63,41 +61,6 @@ export declare function createPolicyEditor(editor: PolicyConfigEditor, observe?:
             }>;
         };
     };
-    save: (params: URLSearchParams) => Promise<{
-        ok: false;
-        error: {
-            code: string;
-            message: string;
-        };
-    } | {
-        ok: true;
-        value: {
-            revision: string;
-            runtime: {
-                observedAt: string;
-                phase: string;
-                need: {
-                    code: string;
-                    message: string;
-                    needs: string;
-                    exit: {
-                        exitCode: number | null;
-                        signal: string | null;
-                    } | null;
-                } | null;
-                connection: {
-                    instanceId: string;
-                    epoch: number;
-                    phase: string;
-                } | null;
-            };
-            fields: Record<Key, {
-                value: number | null;
-                explicit: boolean;
-                defaultValue: number;
-            }>;
-        };
-    }>;
 };
 interface Web {
     register(route: {

package/lib/policy-management.js

@@ -1,10 +1,7 @@
-import { createHash } from 'node:crypto';
 import { helperRecoveryDefaults, recoveryPolicyFields, validRecoveryPolicy } from "./settings.js";
-const fields = (value) => Object.fromEntries(recoveryPolicyFields.filter(k => Object.hasOwn(value, k)).map(k => [k, value[k]]));
-const revision = (current, inherited) => createHash('sha256').update(JSON.stringify([fields(current), fields(inherited)])).digest('hex');
 const failure = (code, message) => ({ ok: false, error: { code, message } });
-const unavailable = () => failure('RECOVERY_SETTINGS_UNAVAILABLE', '我需要官方配置编辑服务和唯一且已启用的网络组件，才能读取或保存恢复设置。');
-const recoveryNeeds = new Set(['HELPER_RECOVERING', 'HELPER_RECOVERY_EXHAUSTED', 'HELPER_RECOVERY_DISABLED', 'HELPER_RECOVERY_FAILED', 'HELPER_RECOVERY_IDENTITY_REQUIRED', 'HELPER_RECOVERY_CONFIG_CHANGED', 'HELPER_LIFECYCLE_LOG_FAILED', 'HELPER_EXITED', 'HELPER_PROCESS_FAILED', 'HELPER_START_FAILED', 'HELPER_STARTUP_EXPIRED', 'HELPER_SHUTDOWN_FORCED', 'HELPER_HANDOFF_FAILED']);
+const unavailable = () => failure('RECOVERY_SETTINGS_UNAVAILABLE', '我需要官方配置编辑服务和唯一且已启用的网络组件，才能读取恢复设置。');
+const recoveryNeeds = new Set(['CONTROL_UNAVAILABLE', 'ENROLLMENT_KEY_REJECTED', 'ENROLLMENT_REJECTED', 'HELPER_RECOVERING', 'HELPER_RECOVERY_EXHAUSTED', 'HELPER_RECOVERY_DISABLED', 'HELPER_RECOVERY_FAILED', 'HELPER_RECOVERY_IDENTITY_REQUIRED', 'HELPER_RECOVERY_CONFIG_CHANGED', 'HELPER_EXITED', 'HELPER_PROCESS_FAILED', 'HELPER_START_FAILED', 'HELPER_STARTUP_EXPIRED', 'HELPER_SHUTDOWN_FORCED', 'HELPER_HANDOFF_FAILED']);
 function runtimeObservation(observe) {
     const observedAt = new Date().toISOString();
     try {
@@ -36,58 +33,13 @@ export function createPolicyEditor(editor, observe = () => ({})) {
             const current = found.entry.options.config ?? {};
             if (!validRecoveryPolicy(current))
                 return failure('RECOVERY_SETTINGS_INVALID', '恢复设置包含非法值，请通过官方配置编辑流程修正。');
-            return { ok: true, value: { revision: revision(current, found.inherited), runtime: runtimeObservation(observe), fields: Object.fromEntries(recoveryPolicyFields.map(key => [key, { value: current[key] ?? null, explicit: Object.hasOwn(current, key), defaultValue: helperRecoveryDefaults[key] }])) } };
+            return { ok: true, value: { runtime: runtimeObservation(observe), fields: Object.fromEntries(recoveryPolicyFields.map(key => [key, { value: current[key] ?? null, explicit: Object.hasOwn(current, key), defaultValue: helperRecoveryDefaults[key] }])) } };
         }
         catch {
             return unavailable();
         }
     }
-    async function save(params) {
-        const allowed = ['revision', ...recoveryPolicyFields];
-        if ([...params.keys()].some(k => !allowed.includes(k)) || allowed.some(k => params.getAll(k).length !== 1) || !/^[a-f0-9]{64}$/.test(params.get('revision') ?? ''))
-            return failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：请只提交当前页面中的三项恢复设置。');
-        const values = {};
-        for (const key of recoveryPolicyFields) {
-            const raw = params.get(key);
-            if (raw === 'unset') {
-                values[key] = 'unset';
-                continue;
-            }
-            if (!/^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$/.test(raw))
-                return failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：次数须为非负安全整数；秒数须在0.001到2147483.647之间。');
-            const value = Number(raw);
-            if (!validRecoveryPolicy({ [key]: value }))
-                return failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：次数须为非负安全整数；秒数须在0.001到2147483.647之间。');
-            values[key] = value;
-        }
-        try {
-            const found = target();
-            if (!found)
-                return unavailable();
-            await editor.edit(found.entry, (current, inherited) => {
-                if (revision(current, inherited) !== params.get('revision'))
-                    throw new PolicyConflict();
-                const next = { ...current };
-                for (const key of recoveryPolicyFields) {
-                    if (values[key] === 'unset') {
-                        delete next[key];
-                    }
-                    else
-                        next[key] = values[key];
-                }
-                if (!validRecoveryPolicy(next))
-                    throw new Error('invalid-policy');
-                return next;
-            });
-            return describe();
-        }
-        catch (error) {
-            return error instanceof PolicyConflict ? failure('RECOVERY_SETTINGS_CONFLICT', '设置未保存：配置已被其他操作修改，请重新打开本页核对后保存。') : failure('RECOVERY_SETTINGS_SAVE_FAILED', '官方配置保存或重载失败，请检查插件管理中的错误；本页未确认修改生效。');
-        }
-    }
-    return { describe, save };
-}
-class PolicyConflict extends Error {
+    return { describe };
 }
 export function registerPolicyRoutes(web, connection, service) {
     return web.register({ kind: 'prefix', path: '/ai-workbench-network/policy', async handler(req, res) {
@@ -109,13 +61,9 @@ export function registerPolicyRoutes(web, connection, service) {
                 reply(result.ok ? 200 : 503, result);
                 return;
             }
-            if (req.method === 'POST') {
-                if (req.headers['transfer-encoding'] || req.headers['content-length'] !== undefined && req.headers['content-length'] !== '0') {
-                    reply(400, failure('RECOVERY_SETTINGS_INPUT_INVALID', '设置未保存：本操作不接受请求正文。'));
-                    return;
-                }
-                const result = await service.save(url.searchParams);
-                reply(result.ok ? 200 : result.error.code === 'RECOVERY_SETTINGS_INPUT_INVALID' ? 400 : 409, result);
+            if (req.method !== 'GET') {
+                res.setHeader('Allow', 'GET');
+                reply(405, failure('RECOVERY_SETTINGS_READ_ONLY', '恢复参数只读，请经官方 Config 修改。'));
                 return;
             }
             reply(400, failure('RECOVERY_SETTINGS_INPUT_INVALID', '不支持此设置操作。'));