@antglobal/developer-harness 0.0.0 → 0.0.1791614784-dev.5

package/server.mjs

@@ -0,0 +1,3694 @@
+// server/index.ts
+import express from "express";
+
+// shared/interactionTypes.ts
+var INTERACTION_TYPES = [
+  "form",
+  "confirm",
+  "input",
+  "app_info",
+  "api_confirm",
+  "api_summary",
+  "webhook_confirm",
+  "stage_complete",
+  "pubkey_input",
+  "security_result",
+  "webhook_result",
+  "webhook_manage",
+  "webhook_subscriptions",
+  "case_plan",
+  "file_changes",
+  "git_check",
+  "system_action",
+  "release_confirm",
+  "approval_status",
+  "prod_env_info"
+];
+var TYPE_SET = new Set(INTERACTION_TYPES);
+function isInteractionPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const type = value.type;
+  return typeof type === "string" && TYPE_SET.has(type);
+}
+
+// server/chat/parseOutput.ts
+function summarizeToolInput(name, input) {
+  if (!input || typeof input !== "object") return "";
+  const first = (keys) => {
+    for (const k of keys) {
+      const v = input[k];
+      if (typeof v === "string" && v) return v;
+    }
+    return "";
+  };
+  let out = "";
+  switch (name) {
+    case "Read":
+    case "Write":
+    case "Edit":
+    case "SearchReplace":
+    case "NotebookEdit":
+      out = first(["file_path", "notebook_path", "path"]);
+      break;
+    case "Bash":
+      out = first(["command"]);
+      break;
+    case "Glob":
+      out = first(["query", "pattern"]);
+      break;
+    case "Grep":
+      out = first(["regex", "pattern"]);
+      break;
+    case "WebFetch":
+      out = first(["url"]);
+      break;
+    case "WebSearch":
+      out = first(["query"]);
+      break;
+    default:
+      out = first(["file_path", "path", "command", "query", "url"]);
+  }
+  return out.length > 200 ? out.slice(0, 200) + "\u2026" : out;
+}
+function extractToolResultText(block) {
+  const c = block?.content;
+  let out = "";
+  if (typeof c === "string") out = c;
+  else if (Array.isArray(c)) out = c.map((b) => typeof b === "string" ? b : b?.text || "").filter(Boolean).join("\n");
+  out = out.trim();
+  return out.length > 300 ? out.slice(0, 300) + "\u2026" : out;
+}
+function extractInteractionBlock(text) {
+  const primary = /```interaction\n([\s\S]*?)```/;
+  const m = text.match(primary);
+  if (m) {
+    try {
+      return { textBefore: text.substring(0, m.index).trim(), interaction: JSON.parse(m[1].trim()) };
+    } catch {
+    }
+  }
+  const fenceRe = /```[a-zA-Z]*\n([\s\S]*?)```/g;
+  let fm;
+  while (fm = fenceRe.exec(text)) {
+    const body = fm[1].trim();
+    if (!body.startsWith("{")) continue;
+    try {
+      const obj = JSON.parse(body);
+      if (isInteractionPayload(obj)) {
+        return { textBefore: text.substring(0, fm.index).trim(), interaction: obj };
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function isFinalOutput(interaction, textBefore) {
+  return interaction.type === "final" || textBefore.includes("\u96C6\u6210\u65B9\u6848") && textBefore.includes("API \u63A5\u53E3\u6E05\u5355");
+}
+function parseAIOutput(rawOutput, sessionId) {
+  const lines = rawOutput.trim().split("\n").filter((l) => l.trim());
+  let thinking = "";
+  let textContent = "";
+  let sawStreamJson = false;
+  const segments = [];
+  const toolSegIdxById = /* @__PURE__ */ new Map();
+  for (const line of lines) {
+    try {
+      const obj = JSON.parse(line);
+      if (typeof obj?.type === "string") sawStreamJson = true;
+      if (obj.type === "system") continue;
+      if (obj.type === "assistant" && obj.message?.content) {
+        for (const block of obj.message.content) {
+          if (block.type === "thinking" && block.thinking) {
+            thinking += block.thinking;
+            segments.push({ type: "thinking", content: block.thinking });
+          } else if (block.type === "text" && block.text) {
+            textContent += block.text;
+            segments.push({ type: "text", content: block.text });
+          } else if (block.type === "tool_use" && block.name) {
+            const idx = segments.length;
+            segments.push({ type: "tool", content: block.name, detail: summarizeToolInput(block.name, block.input) || void 0 });
+            if (block.id) toolSegIdxById.set(block.id, idx);
+          }
+        }
+      } else if (obj.type === "user" && obj.message?.content) {
+        for (const block of obj.message.content) {
+          if (block.type === "tool_result") {
+            const idx = block.tool_use_id ? toolSegIdxById.get(block.tool_use_id) : void 0;
+            if (idx !== void 0) {
+              const preview = extractToolResultText(block);
+              if (preview) segments[idx].result = preview;
+            }
+          }
+        }
+      } else if (obj.type === "result" && obj.result) {
+        if (!textContent) textContent = obj.result;
+      }
+    } catch {
+    }
+  }
+  if (sawStreamJson && !textContent && !thinking) {
+    return { type: "text", text: "", sessionId, error: "empty_output" };
+  }
+  if (!textContent && !thinking) {
+    const output = rawOutput.trim();
+    const extracted2 = extractInteractionBlock(output);
+    if (extracted2) {
+      const type = isFinalOutput(extracted2.interaction, extracted2.textBefore) ? "final" : "interaction";
+      return { type, text: extracted2.textBefore, interaction: extracted2.interaction, sessionId };
+    }
+    return { type: "text", text: output, sessionId };
+  }
+  const segs = segments.length ? segments : void 0;
+  const extracted = extractInteractionBlock(textContent);
+  if (extracted) {
+    const type = isFinalOutput(extracted.interaction, extracted.textBefore) ? "final" : "interaction";
+    return { type, text: extracted.textBefore, thinking: thinking || void 0, interaction: extracted.interaction, sessionId, segments: segs };
+  }
+  if (textContent.includes("\u96C6\u6210\u65B9\u6848") && textContent.includes("| # |")) {
+    return { type: "final", text: textContent, thinking: thinking || void 0, sessionId, segments: segs };
+  }
+  return { type: "text", text: textContent, thinking: thinking || void 0, sessionId, segments: segs };
+}
+
+// server/chat/skills.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { fileURLToPath } from "node:url";
+
+// shared/steps.ts
+var STEP_IDS = [
+  "basic_info",
+  "webhook",
+  "security_setting",
+  "dev_settings",
+  "sys_analysis",
+  "coding",
+  "integration_case",
+  "case_execution",
+  "release_submit",
+  "prod_config"
+];
+var STAGE_GROUP_IDS = ["create", "integrate", "accept", "release"];
+var INTENT_SKILLS = ["wf-api-intent-recognition", "wf-webhook-setting"];
+var STEPS = {
+  basic_info: { id: "basic_info", order: 1, group: "create", skills: INTENT_SKILLS, comparable: true },
+  webhook: { id: "webhook", order: 2, group: "create", skills: INTENT_SKILLS, comparable: true },
+  security_setting: { id: "security_setting", order: 3, group: "create", skills: ["wf-security-setting"], comparable: true },
+  dev_settings: { id: "dev_settings", order: 4, group: "integrate", skills: ["wf-dev-setting"], comparable: false },
+  sys_analysis: { id: "sys_analysis", order: 5, group: "integrate", skills: ["wf-sys-analysis", "wf-api-integration-upgrade"], comparable: false },
+  coding: { id: "coding", order: 6, group: "integrate", skills: ["wf-coding", "wf-api-integration-upgrade"], comparable: false },
+  integration_case: { id: "integration_case", order: 7, group: "accept", skills: ["wf-integration-case"], comparable: false },
+  case_execution: { id: "case_execution", order: 8, group: "accept", skills: [], comparable: false },
+  release_submit: { id: "release_submit", order: 9, group: "release", skills: ["wf-release-submit"], comparable: false },
+  prod_config: { id: "prod_config", order: 10, group: "release", skills: ["wf-prod-config"], comparable: false }
+};
+var STEP_ORDER = [...STEP_IDS].sort((a, b) => STEPS[a].order - STEPS[b].order);
+var COMPARABLE_STEPS = STEP_ORDER.filter((id) => STEPS[id].comparable);
+var STAGE_GROUPS = STAGE_GROUP_IDS.map((group) => ({
+  group,
+  steps: STEP_ORDER.filter((id) => STEPS[id].group === group)
+}));
+function isStepId(value) {
+  return typeof value === "string" && value in STEPS;
+}
+
+// server/chat/skills.ts
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var PROJECT_SKILLS_DIR = join(__dirname, "..", "..", "skills");
+var QODER_SKILLS_DIR = join(process.env.HOME || "", ".qoder", "skills");
+var SKILL_EXTRAS = {
+  "wf-api-intent-recognition": { liveCatalog: true },
+  "wf-integration-case": {
+    dataFile: join("data", "case-scenario-catalog.json"),
+    dataLabel: "Case Scenario Catalog Data (case-scenario-catalog.json)"
+  }
+};
+function resolveSkillFile(skillName, relative) {
+  for (const base of [PROJECT_SKILLS_DIR, QODER_SKILLS_DIR]) {
+    const p = join(base, skillName, relative);
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+function skillBody(raw) {
+  return raw.match(/^---\n[\s\S]*?\n---\n([\s\S]*)$/)?.[1].trim() ?? raw;
+}
+var LANGUAGE_REQUIREMENT = {
+  en: "# Language Requirement\n\nCommunicate entirely in English throughout this conversation. ALL user-visible text \u2014 including interaction card fields (title/description/options/labels) \u2014 must be in English. When a skill instructs you to output a fixed Chinese text verbatim, output the natural English equivalent instead. Protocol fields in interaction JSON (type, options[].value, ids) must remain unchanged.\n\n",
+  zh: "# \u8BED\u8A00\u8981\u6C42\n\n\u5168\u7A0B\u4F7F\u7528\u7B80\u4F53\u4E2D\u6587\u4E0E\u7528\u6237\u4EA4\u6D41\uFF08\u542B\u6240\u6709 interaction \u5361\u7247\u7684 title/description/options/label \u7B49\u7528\u6237\u53EF\u89C1\u5B57\u6BB5\uFF09\u3002\n\n"
+};
+var SYS_ANALYSIS_DOC = "docs/wf-system-analysis.md";
+function runtimeBlock(rt) {
+  if (!rt) return "";
+  const lines = ["# \u8FD0\u884C\u73AF\u5883\uFF08\u8C03\u7528 CLI \u4E0E\u5B9A\u4F4D\u5E94\u7528\u65F6\u5FC5\u987B\u9075\u5FAA\uFF09", ""];
+  if (rt.cliPath) {
+    lines.push(`- wf-developer CLI \u53EF\u6267\u884C\u6587\u4EF6\u8DEF\u5F84\uFF1A\`${rt.cliPath}\``);
+    lines.push(`- \u6280\u80FD\u6587\u6863\u4E2D\u51E1\u51FA\u73B0 \`bin/wf-developer\` \u6216\u88F8 \`wf-developer\` \u547D\u4EE4\uFF0C\u4E00\u5F8B\u7528\u4E0A\u8FF0\u7EDD\u5BF9\u8DEF\u5F84\u66FF\u6362\u540E\u518D\u6267\u884C\uFF08\u4F8B\u5982 Bash \u8C03\u7528\uFF1A\`"${rt.cliPath}" apps overview --app-id <ClientId> --json\`\uFF09\u3002\u8DEF\u5F84\u542B\u7A7A\u683C\u65F6\u8BB0\u5F97\u52A0\u5F15\u53F7\u3002`);
+  } else {
+    lines.push("- wf-developer CLI \u8DEF\u5F84\uFF1A\u672A\u6307\u5B9A\u3002\u53EF\u5148\u5C1D\u8BD5 PATH \u4E2D\u7684 `wf-developer`\uFF1B\u82E5\u8C03\u7528\u5931\u8D25\uFF0C\u8BF7\u63D0\u793A\u7528\u6237\u5230\u542F\u52A8\u68C0\u67E5\u9875\u6307\u5B9A CLI \u5B89\u88C5\u8DEF\u5F84\uFF0C\u4E25\u7981\u7F16\u9020\u8DEF\u5F84\u3002");
+  }
+  if (rt.baseUrl) lines.push(`- \u6388\u6743\u7F51\u5173\u5730\u5740\uFF08\u5982\u9700\u663E\u5F0F\u4F20 --base-url\uFF09\uFF1A${rt.baseUrl}`);
+  lines.push(
+    "- \u65AD\u8A00\u4E0E\u9884\u671F\u63CF\u8FF0\u4E25\u7981\u51FA\u73B0\u5185\u90E8\u7ED3\u679C\u7801\uFF08\u5982 IPAY_RS_* \u7B49 resultCodeId\uFF09\uFF1A\u4E00\u5F8B\u4F7F\u7528\u63A5\u53E3\u6587\u6863\u7684\u7528\u6237\u53EF\u89C1\u6210\u529F\u8BED\u4E49\uFF08resultStatus=S\u3001\u4E1A\u52A1\u5B57\u6BB5/\u72B6\u6001\u503C\u5339\u914D\uFF09\uFF1B\u4E5F\u4E0D\u5F97\u590D\u7528\u4F1A\u8BDD\u5386\u53F2\u4E2D\u7684\u65E7\u65AD\u8A00\u6587\u672C\u3002"
+  );
+  if (rt.clientId) {
+    lines.push(`- \u5F53\u524D\u5E94\u7528 ClientId\uFF1A${rt.clientId}\uFF08\u8C03\u7528 apps/webhooks \u7B49\u547D\u4EE4\u65F6 --app-id \u7528\u5B83\uFF0C\u4E25\u7981\u7F16\u9020\u6216\u81C6\u6D4B\uFF09`);
+  } else {
+    lines.push("- \u5F53\u524D\u5E94\u7528 ClientId\uFF1A\u5C1A\u672A\u521B\u5EFA\uFF08\u57FA\u7840\u4FE1\u606F\u8282\u70B9\u521B\u5EFA\u6210\u529F\u540E\u624D\u6709\uFF09\u3002\u521B\u5EFA\u524D\u4E0D\u8981\u8C03\u7528\u9700\u8981 --app-id \u7684\u547D\u4EE4\u3002");
+  }
+  if (rt.appFacts && rt.appFacts.trim()) {
+    lines.push("", "# \u5F53\u524D\u5E94\u7528\u670D\u52A1\u7AEF\u4E8B\u5B9E\uFF08\u6253\u5F00\u5E94\u7528\u65F6\u7F13\u5B58\uFF0C\u4EE5\u6B64\u4E3A\u51C6\uFF0C\u52FF\u91CD\u590D\u8C03\u7528 apps overview\uFF09", "", rt.appFacts.trim());
+  }
+  if (rt.dataUpdated && rt.dataUpdated.trim()) {
+    lines.push("", "# \u670D\u52A1\u7AEF\u6570\u636E\u5DF2\u66F4\u65B0\uFF08\u672C\u5730\u8BB0\u5F55\u4E0E\u6700\u65B0\u670D\u52A1\u7AEF\u4E8B\u5B9E\u4E0D\u4E00\u81F4\uFF0C\u9010\u9879\u5DEE\u5F02\u5982\u4E0B\uFF09", "", rt.dataUpdated.trim());
+  }
+  if (rt.projectDir && rt.projectDir.trim()) {
+    lines.push(
+      "",
+      "# \u5BA2\u6237\u5DE5\u7A0B\u6839\u76EE\u5F55\uFF08\u96C6\u6210\u9636\u6BB5\u4EE3\u7801/\u6587\u6863\u8BFB\u5199\u7684\u7EDD\u5BF9\u8DEF\u5F84\u57FA\u51C6\uFF09",
+      "",
+      `- \u9879\u76EE\u6839\u76EE\u5F55\uFF1A${rt.projectDir.trim()}`,
+      `- \u7CFB\u5206\u8BBE\u8BA1\u6587\u6863\u8DEF\u5F84\uFF1A${rt.projectDir.trim()}/${SYS_ANALYSIS_DOC}`,
+      "- \u8BFB\u5199\u4EE3\u7801\u3001\u6267\u884C git \u65F6\u4E00\u5F8B\u4F7F\u7528\u4E0A\u8FF0\u7EDD\u5BF9\u8DEF\u5F84\uFF08\u5982 `git -C <\u9879\u76EE\u6839\u76EE\u5F55> status`\uFF09\uFF1B\u4E25\u7981\u5728\u63A7\u5236\u53F0\u81EA\u8EAB\u76EE\u5F55\u91CC\u64CD\u4F5C\u3002"
+    );
+  }
+  return lines.join("\n") + "\n\n";
+}
+var NODE_LABELS = {
+  basic_info: "\u57FA\u7840\u4FE1\u606F",
+  webhook: "Webhook \u8BBE\u7F6E",
+  security_setting: "\u5B89\u5168\u8BBE\u7F6E",
+  dev_settings: "\u5DE5\u7A0B\u8BBE\u7F6E",
+  sys_analysis: "\u7CFB\u5206\u8BBE\u8BA1",
+  coding: "\u7F16\u7801",
+  integration_case: "\u96C6\u6210\u7528\u4F8B\u89C4\u5212",
+  case_execution: "\u6267\u884C\u96C6\u6210\u7528\u4F8B",
+  release_submit: "\u63D0\u4EA4\u53D1\u5E03",
+  prod_config: "\u751F\u4EA7\u914D\u7F6E"
+};
+function nodeGuardBlock(stage) {
+  const current = isStepId(stage) ? stage : "basic_info";
+  const total = STEP_ORDER.length;
+  const currentIdx = STEP_ORDER.indexOf(current);
+  const currentLabel = NODE_LABELS[current];
+  const list = STEP_ORDER.map((id, i) => {
+    const mark = id === current ? "  \u2190 \u5F53\u524D\u8282\u70B9" : "";
+    return `${i + 1}. ${NODE_LABELS[id]}${mark}`;
+  }).join("\n");
+  return [
+    "# \u8282\u70B9\u8FB9\u754C\u5B88\u536B\uFF08\u94C1\u5F8B\uFF0C\u4F18\u5148\u7EA7\u9AD8\u4E8E\u4E0B\u65B9\u6240\u6709 skill \u6D41\u7A0B\uFF09",
+    "",
+    `\u4F60\u5F53\u524D\u53EA\u8D1F\u8D23\u3010${currentLabel}\u3011\u8282\u70B9\uFF08\u7B2C ${currentIdx + 1} \u6B65 / \u5171 ${total} \u6B65\uFF09\u3002\u96C6\u6210\u6D41\u6C34\u7EBF\u7684\u8282\u70B9\u987A\u5E8F\u5982\u4E0B\uFF1A`,
+    "",
+    list,
+    "",
+    "## \u4E00\u3001\u53EA\u505A\u672C\u8282\u70B9\u7684\u4E8B",
+    "",
+    "\u5F53\u7528\u6237\u5728\u672C\u8282\u70B9\u7684\u5BF9\u8BDD\u91CC\u8981\u6C42\u53BB\u505A**\u5176\u5B83\u8282\u70B9**\u7684\u4E8B\u60C5\u65F6\uFF0C\u4F60\u5FC5\u987B\u5148\u963B\u6B62\u3001\u4E0D\u5F97\u76F4\u63A5\u6267\u884C\uFF0C\u5E76\u6309\u4EE5\u4E0B\u60C5\u51B5\u5F15\u5BFC\uFF08\u5F15\u5BFC\u7528\u4E00\u6BB5\u81EA\u7136\u3001\u7B80\u77ED\u7684\u6587\u672C\u8BF4\u660E\uFF0C\u9664\u975E\u662F\u7B2C\u4E8C\u8282\u8981\u6C42\u8F93\u51FA\u7684\u63A8\u8FDB\u5361\u7247\uFF0C\u5426\u5219\u4E0D\u8981\u8F93\u51FA interaction \u5361\u7247\uFF09\uFF1A",
+    "",
+    `A. \u7528\u6237\u60F3\u505A**\u6392\u5728\u3010${currentLabel}\u3011\u4E4B\u540E**\u7684\u8282\u70B9\uFF08\u4F8B\uFF1A\u4F60\u5728\u7CFB\u5206\u8BBE\u8BA1\u8282\u70B9\uFF0C\u7528\u6237\u8BF4\u201C\u6211\u8981\u7F16\u7801\u201D\uFF09\uFF1A`,
+    `   - \u82E5\u3010${currentLabel}\u3011\u7684\u5DE5\u4F5C**\u5C1A\u672A\u5B8C\u6210**\uFF1A\u53EA\u9700\u544A\u8BC9\u7528\u6237\u300C\u8BF7\u5148\u5B8C\u6210\u5F53\u524D\u7684\u300E${currentLabel}\u300F\u9636\u6BB5\u300D\uFF0C\u5E76\u7EE7\u7EED\u63A8\u8FDB\u672C\u8282\u70B9\uFF0C\u5207\u52FF\u5F00\u59CB\u540E\u7EED\u8282\u70B9\u7684\u5DE5\u4F5C\u3002`,
+    `   - \u82E5\u3010${currentLabel}\u3011\u7684\u5DE5\u4F5C**\u5DF2\u7ECF\u5B8C\u6210**\uFF08\u672C\u8F6E\u6216\u6B64\u524D\u5DF2\u4EA7\u51FA\u672C\u8282\u70B9\u5E94\u4EA4\u4ED8\u7684\u4EA7\u7269 / \u5DF2\u5177\u5907\u63A8\u8FDB\u6761\u4EF6\uFF09\uFF1A**\u4E0D\u8981\u7528\u7EAF\u6587\u5B57\u8BE2\u95EE\u300C\u662F\u5426\u63A8\u8FDB\u300D\uFF0C\u4E5F\u4E0D\u8981\u76F4\u63A5\u8DF3\u5230\u76EE\u6807\u8282\u70B9\u6267\u884C**\uFF0C\u800C\u662F\u6309\u4E0B\u65B9\u300C\u4E8C\u3001\u63A8\u8FDB\u5FC5\u987B\u7528\u5361\u7247\u300D\u8F93\u51FA\u672C\u8282\u70B9\u7684\u300C\u8FDB\u5165\u4E0B\u4E00\u9636\u6BB5\u300D\u63A8\u8FDB\u5361\u7247\uFF0C\u7531\u7528\u6237\u70B9\u51FB\u5361\u7247\u540E\u624D\u63A8\u8FDB\u5230\u4E0B\u4E00\u8282\u70B9\uFF1B\u7528\u6237\u70B9\u51FB\u4E4B\u524D\u4E0D\u5F97\u6267\u884C\u76EE\u6807\u8282\u70B9\u7684\u5DE5\u4F5C\u3002`,
+    "",
+    `B. \u7528\u6237\u60F3\u505A**\u6392\u5728\u3010${currentLabel}\u3011\u4E4B\u524D**\u3001\u901A\u5E38\u5DF2\u5B8C\u6210\u8FC7\u7684\u8282\u70B9\uFF08\u4F8B\uFF1A\u5B89\u5168\u8BBE\u7F6E\u3001Webhook \u8BBE\u7F6E\u7B49\uFF09\uFF1A\u544A\u8BC9\u7528\u6237\u300C\u8BE5\u4E8B\u9879\u5C5E\u4E8E\u300E\uFF08\u5BF9\u5E94\u8282\u70B9\u540D\uFF09\u300F\u8282\u70B9\uFF0C\u8BF7\u56DE\u5230\u5DE6\u4FA7\u6D41\u6C34\u7EBF\u7684\u300E\uFF08\u5BF9\u5E94\u8282\u70B9\u540D\uFF09\u300F\u8282\u70B9\u53BB\u5B8C\u6210\u300D\uFF0C\u4E0D\u8981\u5728\u672C\u8282\u70B9\u4EE3\u505A\u3002`,
+    "",
+    "C. \u65E0\u6CD5\u5224\u65AD\u7528\u6237\u60F3\u505A\u54EA\u4E2A\u8282\u70B9\u3001\u6216\u7528\u6237\u53EA\u662F\u666E\u901A\u63D0\u95EE / \u9700\u6C42\u672C\u5C31\u4E0E\u672C\u8282\u70B9\u76F8\u5173\uFF1A\u6B63\u5E38\u6309\u4E0B\u65B9 skill \u6D41\u7A0B\u5904\u7406\uFF0C\u4E0D\u8981\u8BEF\u62E6\u3002",
+    "",
+    "## \u4E8C\u3001\u63A8\u8FDB\u5FC5\u987B\u7528\u5361\u7247\uFF08\u94C1\u5F8B\uFF09",
+    "",
+    `\u53EA\u8981\u3010${currentLabel}\u3011\u7684\u5DE5\u4F5C\u5DF2\u5B8C\u6210\u3001\u53EF\u4EE5\u8FDB\u5165\u4E0B\u4E00\u8282\u70B9\u2014\u2014\u65E0\u8BBA\u662F\u7528\u6237\u4E3B\u52A8\u8981\u6C42\u8FDB\u5165\u4E0B\u4E00\u6B65\uFF0C\u8FD8\u662F\u672C\u8282\u70B9\u6D41\u7A0B\u81EA\u7136\u8D70\u5230\u6536\u5C3E\u2014\u2014\u4F60**\u5FC5\u987B\u8F93\u51FA\u672C\u8282\u70B9 skill \u6D41\u7A0B\u4E2D\u5B9A\u4E49\u7684\u300C\u8FDB\u5165\u4E0B\u4E00\u9636\u6BB5\u300D\u63A8\u8FDB\u5361\u7247**\uFF0C\u5373\u5E26\u300C\u4E0B\u4E00\u6B65 / \u8FDB\u5165\u4E0B\u4E00\u9636\u6BB5 / \u5B8C\u6210\u300D\u52A8\u4F5C\uFF08action \u4E3A next \u6216 finish\uFF09\u7684 interaction \u5361\u7247\uFF08\u5982 stage_complete / security_result / webhook_result / app_info / webhook_manage \u7B49\uFF0C\u5177\u4F53\u4EE5\u672C\u8282\u70B9 skill \u5B9A\u4E49\u4E3A\u51C6\uFF09\u3002`,
+    "",
+    "- **\u4E25\u7981\u53EA\u7528\u6587\u5B57\u8BF4\u300C\u5DF2\u5B8C\u6210\uFF0C\u53EF\u4EE5\u8FDB\u5165\u4E0B\u4E00\u6B65 / \u4F60\u53EF\u4EE5\u8FDB\u5165\u4E0B\u4E00\u4E2A\u8282\u70B9\u4E86\u300D\u800C\u4E0D\u7ED9\u51FA\u8BE5\u63A8\u8FDB\u5361\u7247**\uFF1B\u7528\u6237\u53EA\u6709\u70B9\u51FB\u8BE5\u5361\u7247\u624D\u80FD\u63A8\u8FDB\u5230\u4E0B\u4E00\u8282\u70B9\u3002",
+    "- \u5361\u7247\u524D\u53EF\u9644\u4E00\u53E5\u7B80\u77ED\u8BF4\u660E\uFF0C\u4F46\u63A8\u8FDB\u52A8\u4F5C\u53EA\u80FD\u7531\u5361\u7247\u627F\u8F7D\uFF0C\u4E0D\u5F97\u7528\u7EAF\u6587\u5B57\u66FF\u4EE3\u3002",
+    "",
+    `\u5224\u65AD\u300C\u3010${currentLabel}\u3011\u662F\u5426\u5DF2\u5B8C\u6210\u300D\u4EE5\u672C\u8282\u70B9 skill \u5B9A\u4E49\u7684\u5B8C\u6210\u6807\u5FD7\u4E3A\u51C6\uFF08\u5982\u5DF2\u4EA7\u51FA\u8BE5\u8282\u70B9\u5E94\u4EA4\u4ED8\u7684\u4EA7\u7269\u3001\u5DF2\u5177\u5907\u8F93\u51FA\u4E0A\u8FF0\u63A8\u8FDB\u5361\u7247\u7684\u6761\u4EF6\uFF09\u3002`,
+    ""
+  ].join("\n") + "\n";
+}
+async function createSkillPromptFile(stage, lang, fetchLiveCatalog, runtime) {
+  const skills = STEPS[isStepId(stage) ? stage : "basic_info"].skills;
+  let prompt = runtimeBlock(runtime) + nodeGuardBlock(stage);
+  for (const name of skills) {
+    const skillPath = resolveSkillFile(name, "SKILL.md");
+    if (skillPath) prompt += `# Skill: ${name}
+
+${skillBody(readFileSync(skillPath, "utf-8"))}
+
+`;
+    const extra = SKILL_EXTRAS[name];
+    if (!extra) continue;
+    if (extra.liveCatalog) {
+      const live = await fetchLiveCatalog();
+      if (live.ok) prompt += `# Live API Catalog (wf-developer apps catalog \u5B9E\u65F6\u63A5\u53E3\u76EE\u5F55)
+
+${JSON.stringify(live.data, null, 2)}
+
+`;
+      continue;
+    }
+    if (extra.dataFile) {
+      const dataPath = resolveSkillFile(name, extra.dataFile);
+      const content = dataPath ? readFileSync(dataPath, "utf-8") : "";
+      if (content) prompt += `# ${extra.dataLabel}
+
+${content}
+
+`;
+    }
+  }
+  prompt += lang === "en" ? LANGUAGE_REQUIREMENT.en : LANGUAGE_REQUIREMENT.zh;
+  const projectDir = runtime?.projectDir?.trim();
+  const docPath = projectDir ? `${projectDir}/${SYS_ANALYSIS_DOC}` : SYS_ANALYSIS_DOC;
+  prompt = prompt.replace(/\{\{\s*projectDir\s*\}\}/g, projectDir || "\uFF08\u5BA2\u6237\u5DE5\u7A0B\u6839\u76EE\u5F55\uFF0C\u4EE5\u7528\u6237\u5728\u5DE5\u7A0B\u8BBE\u7F6E\u8282\u70B9\u63D0\u4F9B\u7684\u76EE\u5F55\u4E3A\u51C6\uFF09").replace(/\{\{\s*docPath\s*\}\}/g, docPath);
+  const tempFile = join(tmpdir(), `qoder-skill-${randomUUID()}.md`);
+  writeFileSync(tempFile, prompt, "utf-8");
+  return tempFile;
+}
+
+// server/cli/wfDeveloper.ts
+import { execSync, spawn, spawnSync } from "node:child_process";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2, unlinkSync } from "node:fs";
+import { join as join3, dirname as dirname3 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// server/store.ts
+import { DatabaseSync } from "node:sqlite";
+
+// shared/keyData.ts
+var FLOW_NODES = STEP_IDS;
+function overviewKeyData(overview) {
+  const info = overview?.appInfo;
+  const interfaces = (overview?.integratedInterfaces || []).map((i) => ({ interfaceId: Number(i.interfaceId), funcName: i.funcName || "" })).sort((a, b) => a.interfaceId - b.interfaceId);
+  const configs = (overview?.webhookConfigs || []).map((c) => ({
+    id: Number(c.id),
+    name: c.name || "",
+    url: c.url || "",
+    events: [...(c.eventGroups || []).flatMap((g) => (g.events || []).map((e) => e.eventCode || ""))].sort()
+  })).sort((a, b) => a.id - b.id);
+  const partner = (info?.publicKeyInfoList || []).find((k) => k.issuer === "partner");
+  return {
+    basic_info: {
+      appName: info?.name || info?.appName || "",
+      appState: info?.state || info?.status || "",
+      interfaces
+    },
+    webhook: { configs },
+    security_setting: {
+      partnerKeySet: !!partner,
+      partnerKeyModified: partner?.gmtModified ? String(partner.gmtModified) : ""
+    }
+  };
+}
+var LIVE_STATES = ["LIVE", "LIVE_EDITING", "EDIT_TESTING", "EDIT_GO_LIVE_SUBMITTED", "ONLINE", "RELEASED"];
+var PASSED_CASE_STATES = ["PASSED", "PASS", "SUCCESS"];
+function caseStatus(c) {
+  return String(c?.status || c?.caseStatus || c?.state || "").toUpperCase();
+}
+function deriveInitialNodes(appStateRaw, overview, cases) {
+  const state = (appStateRaw || "").toUpperCase();
+  const S = {};
+  const done = (...ns) => ns.forEach((n) => S[n] = "DONE");
+  done("basic_info");
+  if (LIVE_STATES.includes(state)) {
+    for (const n of FLOW_NODES) S[n] = "DONE";
+    return { statuses: S, current: "prod_config" };
+  }
+  const wh = overviewKeyData(overview).webhook?.configs || [];
+  if (state === "GO_LIVE_SUBMITTED") {
+    done("webhook", "security_setting", "dev_settings", "sys_analysis", "coding", "integration_case", "case_execution");
+    S["release_submit"] = "IN_PROGRESS";
+    return { statuses: S, current: "release_submit" };
+  }
+  if (state === "TESTING") {
+    done("webhook", "security_setting");
+    const list = Array.isArray(cases) ? cases : [];
+    if (list.length === 0) {
+      S["dev_settings"] = "IN_PROGRESS";
+      return { statuses: S, current: "dev_settings" };
+    }
+    done("dev_settings", "sys_analysis", "coding", "integration_case");
+    const allPassed = list.every((c) => PASSED_CASE_STATES.includes(caseStatus(c)));
+    if (!allPassed) {
+      S["case_execution"] = "IN_PROGRESS";
+      return { statuses: S, current: "case_execution" };
+    }
+    done("case_execution");
+    S["release_submit"] = "IN_PROGRESS";
+    return { statuses: S, current: "release_submit" };
+  }
+  if (wh.length === 0) {
+    S["webhook"] = "IN_PROGRESS";
+    return { statuses: S, current: "webhook" };
+  }
+  done("webhook");
+  S["security_setting"] = "IN_PROGRESS";
+  return { statuses: S, current: "security_setting" };
+}
+
+// server/store.ts
+import { join as join2, dirname as dirname2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { mkdirSync } from "node:fs";
+var now = () => Date.now();
+var __filename = fileURLToPath2(import.meta.url);
+var __dirname2 = dirname2(__filename);
+var DATA_DIR = join2(__dirname2, "..", "data");
+mkdirSync(DATA_DIR, { recursive: true });
+var db = new DatabaseSync(join2(DATA_DIR, "wf-developer-console.db"));
+db.exec(`
+  CREATE TABLE IF NOT EXISTS dc_users (
+    user_id TEXT PRIMARY KEY,
+    email TEXT DEFAULT '',
+    active_client_id TEXT DEFAULT '',
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS dc_apps (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    app_name TEXT DEFAULT '',
+    app_state TEXT DEFAULT '',
+    ui_state TEXT DEFAULT '{}',
+    overview_snapshot TEXT DEFAULT '',
+    overview_synced_at INTEGER DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE(user_id, client_id)
+  );
+  CREATE TABLE IF NOT EXISTS dc_pipeline_nodes (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    flow_node TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'INIT',
+    session_id TEXT DEFAULT '',
+    key_data TEXT DEFAULT '{}',
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE(user_id, client_id, flow_node)
+  );
+  CREATE TABLE IF NOT EXISTS dc_node_messages (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    flow_node TEXT NOT NULL,
+    item_id TEXT NOT NULL,
+    seq INTEGER NOT NULL,
+    payload TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    UNIQUE(user_id, client_id, flow_node, item_id)
+  );
+  CREATE TABLE IF NOT EXISTS dc_settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL DEFAULT '',
+    updated_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_msgs_scope ON dc_node_messages(user_id, client_id, flow_node);
+  CREATE INDEX IF NOT EXISTS idx_nodes_scope ON dc_pipeline_nodes(user_id, client_id);
+`);
+function ensureColumn(table, column, ddl) {
+  const cols = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (!cols.some((c) => c.name === column)) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
+  }
+}
+function migrateSettingsTable() {
+  const cols = db.prepare("PRAGMA table_info(dc_settings)").all();
+  const names = cols.map((c) => c.name);
+  if (names.includes("key") && names.includes("value")) return;
+  if (cols.length === 0) {
+    db.exec("CREATE TABLE dc_settings (key TEXT PRIMARY KEY, value TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL);");
+    return;
+  }
+  const ts = now();
+  const oldRow = db.prepare("SELECT * FROM dc_settings WHERE id = 1").get();
+  db.exec("BEGIN");
+  try {
+    db.exec("ALTER TABLE dc_settings RENAME TO dc_settings_legacy");
+    db.exec("CREATE TABLE dc_settings (key TEXT PRIMARY KEY, value TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL);");
+    if (oldRow) {
+      const ins = db.prepare("INSERT OR IGNORE INTO dc_settings (key, value, updated_at) VALUES (?, ?, ?)");
+      for (const name of names) {
+        if (name === "id" || name === "updated_at") continue;
+        const v = oldRow[name];
+        if (v === null || v === void 0) continue;
+        ins.run(name, String(v), ts);
+      }
+    }
+    db.exec("DROP TABLE dc_settings_legacy");
+    db.exec("COMMIT");
+  } catch (e) {
+    db.exec("ROLLBACK");
+    throw e;
+  }
+}
+ensureColumn("dc_apps", "current_node", "TEXT DEFAULT ''");
+ensureColumn("dc_apps", "executor", "TEXT DEFAULT ''");
+ensureColumn("dc_apps", "project_dir", "TEXT DEFAULT ''");
+migrateSettingsTable();
+for (const droppedCol of ["server_changed", "server_change_desc", "baseline_at", "key_data_hash"]) {
+  try {
+    const nodeCols = db.prepare("PRAGMA table_info(dc_pipeline_nodes)").all();
+    if (nodeCols.some((c) => c.name === droppedCol)) db.exec(`ALTER TABLE dc_pipeline_nodes DROP COLUMN ${droppedCol}`);
+  } catch {
+  }
+}
+try {
+  const appCols = db.prepare("PRAGMA table_info(dc_apps)").all();
+  if (appCols.some((c) => c.name === "app_context")) db.exec("ALTER TABLE dc_apps DROP COLUMN app_context");
+} catch {
+}
+function mapNodeRow(r) {
+  let keyData = {};
+  try {
+    keyData = JSON.parse(r.key_data || "{}");
+  } catch {
+  }
+  return {
+    flowNode: r.flow_node,
+    status: r.status,
+    sessionId: r.session_id,
+    keyData
+  };
+}
+function mapAppRow(r) {
+  let uiState = {};
+  try {
+    uiState = JSON.parse(r.ui_state || "{}");
+  } catch {
+  }
+  return {
+    clientId: r.client_id,
+    appName: r.app_name || "",
+    appState: r.app_state || "",
+    uiState,
+    currentNode: r.current_node || "",
+    executor: r.executor || "",
+    projectDir: r.project_dir || "",
+    overviewSyncedAt: r.overview_synced_at || 0,
+    updatedAt: r.updated_at || 0
+  };
+}
+function getUser(uid) {
+  const u = db.prepare("SELECT * FROM dc_users WHERE user_id = ?").get(uid);
+  const apps = db.prepare("SELECT client_id, app_name, current_node, updated_at FROM dc_apps WHERE user_id = ? ORDER BY updated_at DESC").all(uid);
+  return {
+    serverUserId: uid,
+    email: u?.email || "",
+    activeClientId: u?.active_client_id || "",
+    apps: apps.map((a) => ({ clientId: a.client_id, appName: a.app_name || "", currentNode: a.current_node || "", executor: a.executor || "", updatedAt: a.updated_at || 0 }))
+  };
+}
+function upsertUser(uid, opts) {
+  const ts = now();
+  const existing = db.prepare("SELECT * FROM dc_users WHERE user_id = ?").get(uid);
+  if (!existing) {
+    db.prepare("INSERT INTO dc_users (user_id, email, active_client_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(uid, opts.email || "", opts.activeClientId || "", ts, ts);
+  } else {
+    const email = opts.email !== void 0 ? opts.email : existing.email;
+    const active = opts.activeClientId !== void 0 ? opts.activeClientId : existing.active_client_id;
+    db.prepare("UPDATE dc_users SET email = ?, active_client_id = ?, updated_at = ? WHERE user_id = ?").run(email, active, ts, uid);
+  }
+  return getUser(uid);
+}
+function getApp(uid, clientId) {
+  const a = db.prepare("SELECT * FROM dc_apps WHERE user_id = ? AND client_id = ?").get(uid, clientId);
+  if (!a) return null;
+  return mapAppRow(a);
+}
+function touchApp(uid, clientId) {
+  db.prepare("UPDATE dc_apps SET updated_at = ? WHERE user_id = ? AND client_id = ?").run(now(), uid, clientId);
+}
+function upsertApp(uid, clientId, fields) {
+  const ts = now();
+  const existing = db.prepare("SELECT * FROM dc_apps WHERE user_id = ? AND client_id = ?").get(uid, clientId);
+  if (!existing) {
+    db.prepare("INSERT INTO dc_apps (user_id, client_id, app_name, app_state, ui_state, overview_snapshot, overview_synced_at, executor, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)").run(uid, clientId, fields.appName || "", fields.appState || "", JSON.stringify(fields.uiState || {}), fields.overviewSnapshot ? JSON.stringify(fields.overviewSnapshot) : "", fields.executor || "", ts, ts);
+  } else {
+    db.prepare("UPDATE dc_apps SET app_name = ?, app_state = ?, ui_state = ?, updated_at = ? WHERE user_id = ? AND client_id = ?").run(
+      fields.appName !== void 0 ? fields.appName : existing.app_name,
+      fields.appState !== void 0 ? fields.appState : existing.app_state,
+      fields.uiState !== void 0 ? JSON.stringify(fields.uiState) : existing.ui_state,
+      ts,
+      uid,
+      clientId
+    );
+    if (fields.executor !== void 0) {
+      db.prepare("UPDATE dc_apps SET executor = ?, updated_at = ? WHERE user_id = ? AND client_id = ?").run(fields.executor, ts, uid, clientId);
+    }
+    if (fields.overviewSnapshot !== void 0) {
+      db.prepare("UPDATE dc_apps SET overview_snapshot = ?, overview_synced_at = ? WHERE user_id = ? AND client_id = ?").run(JSON.stringify(fields.overviewSnapshot), ts, uid, clientId);
+    }
+  }
+  return getApp(uid, clientId);
+}
+function setAppExecutor(uid, clientId, executor) {
+  upsertApp(uid, clientId, { executor });
+  return getApp(uid, clientId);
+}
+function setAppProjectDir(uid, clientId, projectDir) {
+  const existing = db.prepare("SELECT id FROM dc_apps WHERE user_id = ? AND client_id = ?").get(uid, clientId);
+  if (!existing) return;
+  db.prepare("UPDATE dc_apps SET project_dir = ?, updated_at = ? WHERE user_id = ? AND client_id = ?").run(projectDir || "", now(), uid, clientId);
+}
+function setUiState(uid, clientId, uiState) {
+  const existing = db.prepare("SELECT id FROM dc_apps WHERE user_id = ? AND client_id = ?").get(uid, clientId);
+  if (!existing) return;
+  db.prepare("UPDATE dc_apps SET ui_state = ?, updated_at = ? WHERE user_id = ? AND client_id = ?").run(JSON.stringify(uiState || {}), now(), uid, clientId);
+}
+function setCurrentNode(uid, clientId, node) {
+  const existing = db.prepare("SELECT id FROM dc_apps WHERE user_id = ? AND client_id = ?").get(uid, clientId);
+  if (!existing) return;
+  db.prepare("UPDATE dc_apps SET current_node = ?, updated_at = ? WHERE user_id = ? AND client_id = ?").run(node || "", now(), uid, clientId);
+}
+function deleteApp(uid, clientId) {
+  db.prepare("DELETE FROM dc_node_messages WHERE user_id = ? AND client_id = ?").run(uid, clientId);
+  db.prepare("DELETE FROM dc_pipeline_nodes WHERE user_id = ? AND client_id = ?").run(uid, clientId);
+  db.prepare("DELETE FROM dc_apps WHERE user_id = ? AND client_id = ?").run(uid, clientId);
+  const u = db.prepare("SELECT active_client_id FROM dc_users WHERE user_id = ?").get(uid);
+  if (u?.active_client_id === clientId) {
+    db.prepare("UPDATE dc_users SET active_client_id = '', updated_at = ? WHERE user_id = ?").run(now(), uid);
+  }
+}
+function ensureNodes(uid, clientId) {
+  const ts = now();
+  const stmt = db.prepare("INSERT OR IGNORE INTO dc_pipeline_nodes (user_id, client_id, flow_node, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)");
+  for (const node of FLOW_NODES) stmt.run(uid, clientId, node, "INIT", ts, ts);
+}
+function getNodes(uid, clientId) {
+  const rows = db.prepare("SELECT * FROM dc_pipeline_nodes WHERE user_id = ? AND client_id = ?").all(uid, clientId);
+  const counts = db.prepare(
+    "SELECT flow_node, COUNT(*) AS c FROM dc_node_messages WHERE user_id = ? AND client_id = ? GROUP BY flow_node"
+  ).all(uid, clientId);
+  const countMap = new Map(counts.map((c) => [c.flow_node, c.c]));
+  return rows.map((r) => ({ ...mapNodeRow(r), messageCount: countMap.get(r.flow_node) || 0 }));
+}
+function getNode(uid, clientId, node) {
+  const r = db.prepare("SELECT * FROM dc_pipeline_nodes WHERE user_id = ? AND client_id = ? AND flow_node = ?").get(uid, clientId, node);
+  return r ? mapNodeRow(r) : null;
+}
+function updateNode(uid, clientId, node, patch) {
+  const ts = now();
+  const existing = db.prepare("SELECT * FROM dc_pipeline_nodes WHERE user_id = ? AND client_id = ? AND flow_node = ?").get(uid, clientId, node);
+  if (!existing) return;
+  let keyData = existing.key_data;
+  if (patch.keyDataReplace !== void 0) {
+    keyData = JSON.stringify(patch.keyDataReplace);
+  } else if (patch.keyDataPatch) {
+    let parsed = {};
+    try {
+      parsed = JSON.parse(existing.key_data || "{}");
+    } catch {
+    }
+    const merged = { ...parsed, ...patch.keyDataPatch };
+    keyData = JSON.stringify(merged);
+  }
+  db.prepare(`UPDATE dc_pipeline_nodes SET
+    status = ?, session_id = ?, key_data = ?, updated_at = ?
+    WHERE user_id = ? AND client_id = ? AND flow_node = ?`).run(
+    patch.status !== void 0 ? patch.status : existing.status,
+    patch.sessionId !== void 0 ? patch.sessionId : existing.session_id,
+    keyData,
+    ts,
+    uid,
+    clientId,
+    node
+  );
+}
+function setNodesStatus(uid, clientId, statusMap) {
+  for (const [node, status] of Object.entries(statusMap)) {
+    if (!FLOW_NODES.includes(node)) continue;
+    db.prepare("UPDATE dc_pipeline_nodes SET status = ?, updated_at = ? WHERE user_id = ? AND client_id = ? AND flow_node = ?").run(status, now(), uid, clientId, node);
+  }
+}
+function loadMessages(uid, clientId, node) {
+  const rows = db.prepare("SELECT payload FROM dc_node_messages WHERE user_id = ? AND client_id = ? AND flow_node = ? ORDER BY seq ASC").all(uid, clientId, node);
+  const out = [];
+  for (const r of rows) {
+    try {
+      out.push(JSON.parse(r.payload));
+    } catch {
+    }
+  }
+  return out;
+}
+function upsertMessages(uid, clientId, node, items) {
+  const ts = now();
+  const valid = items.filter((it) => it && it.id);
+  const ids = valid.map((it) => String(it.id));
+  const delSql = ids.length ? `DELETE FROM dc_node_messages WHERE user_id = ? AND client_id = ? AND flow_node = ? AND item_id NOT IN (${ids.map(() => "?").join(",")})` : "DELETE FROM dc_node_messages WHERE user_id = ? AND client_id = ? AND flow_node = ?";
+  const ins = db.prepare(`INSERT INTO dc_node_messages (user_id, client_id, flow_node, item_id, seq, payload, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(user_id, client_id, flow_node, item_id) DO UPDATE SET seq = excluded.seq, payload = excluded.payload`);
+  const run = () => {
+    db.prepare(delSql).run(uid, clientId, node, ...ids);
+    valid.forEach((it, idx) => ins.run(uid, clientId, node, String(it.id), idx, JSON.stringify(it), ts));
+  };
+  db.exec("BEGIN");
+  try {
+    run();
+    db.exec("COMMIT");
+  } catch (e) {
+    db.exec("ROLLBACK");
+    throw e;
+  }
+  touchApp(uid, clientId);
+}
+function syncApp(uid, clientId, overview, opts) {
+  const info = overview?.appInfo;
+  const appName = info?.name || info?.appName || "";
+  const appState = info?.state || info?.status || "";
+  upsertUser(uid, {});
+  const existed = getApp(uid, clientId);
+  upsertApp(uid, clientId, { appName: appName || existed?.appName, appState });
+  ensureNodes(uid, clientId);
+  const prevNodes = getNodes(uid, clientId);
+  const hasLocal = prevNodes.some((n) => n.sessionId !== "" || (n.messageCount || 0) > 0);
+  if (!hasLocal) {
+    const { statuses, current } = deriveInitialNodes(appState, overview, opts?.cases);
+    setNodesStatus(uid, clientId, statuses);
+    const kd = overviewKeyData(overview);
+    for (const node of COMPARABLE_STEPS) updateNode(uid, clientId, node, { keyDataReplace: kd[node] });
+    setCurrentNode(uid, clientId, current);
+    return { firstOpen: true, currentNode: current, app: getApp(uid, clientId), nodes: getNodes(uid, clientId) };
+  }
+  return { firstOpen: false, app: getApp(uid, clientId), nodes: getNodes(uid, clientId) };
+}
+function migrateDraft(uid, clientId, appName, steps, executor) {
+  upsertUser(uid, {});
+  upsertApp(uid, clientId, { appName, ...executor ? { executor } : {} });
+  ensureNodes(uid, clientId);
+  for (const [node, data] of Object.entries(steps || {})) {
+    if (!FLOW_NODES.includes(node)) continue;
+    const items = Array.isArray(data.items) ? data.items : [];
+    if (items.length > 0) upsertMessages(uid, clientId, node, items);
+    const created = node === "basic_info" && items.some((it) => it?.interaction?.type === "app_info" && it?.interaction?.clientId);
+    const existing = getNode(uid, clientId, node)?.status || "INIT";
+    let status = existing;
+    if (created) status = "DONE";
+    else if (existing === "INIT" && (items.length > 0 || data.sessionId)) {
+      const busy = db.prepare("SELECT COUNT(*) AS c FROM dc_pipeline_nodes WHERE user_id = ? AND client_id = ? AND status = 'IN_PROGRESS'").get(uid, clientId);
+      if ((busy?.c || 0) === 0) status = "IN_PROGRESS";
+    }
+    updateNode(uid, clientId, node, {
+      sessionId: data.sessionId || "",
+      status
+    });
+  }
+  upsertUser(uid, { activeClientId: clientId });
+  return getUser(uid);
+}
+var SETTING_CLI_PATH = "cli_path";
+var SETTING_VERSION = "version";
+var SETTING_EXECUTOR_PATHS = "executor_paths";
+var SETTING_GIT_PATH = "git_path";
+function getSetting(key) {
+  const r = db.prepare("SELECT value FROM dc_settings WHERE key = ?").get(key);
+  return r ? r.value ?? "" : void 0;
+}
+function setSetting(key, value) {
+  db.prepare(
+    `INSERT INTO dc_settings (key, value, updated_at) VALUES (?, ?, ?)
+     ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
+  ).run(key, value, now());
+}
+function getSettings() {
+  return {
+    cliPath: getSetting(SETTING_CLI_PATH) ?? "",
+    version: getSetting(SETTING_VERSION) ?? "v0.01"
+  };
+}
+function setSettings(patch) {
+  if (patch.cliPath !== void 0) setSetting(SETTING_CLI_PATH, patch.cliPath);
+  if (patch.version !== void 0) setSetting(SETTING_VERSION, patch.version);
+  return getSettings();
+}
+function getExecutorPaths() {
+  try {
+    const parsed = JSON.parse(getSetting(SETTING_EXECUTOR_PATHS) ?? "{}");
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function setExecutorPath(key, path) {
+  const cur = getExecutorPaths();
+  if (path) cur[key] = path;
+  else delete cur[key];
+  setSetting(SETTING_EXECUTOR_PATHS, JSON.stringify(cur));
+  return cur;
+}
+function getGitPath() {
+  return getSetting(SETTING_GIT_PATH) ?? "";
+}
+function setGitPath(path) {
+  setSetting(SETTING_GIT_PATH, path || "");
+}
+
+// server/cli/wfDeveloper.ts
+var __dirname3 = dirname3(fileURLToPath3(import.meta.url));
+function findCommandPath(commands) {
+  for (const cmd of commands) {
+    try {
+      const path = execSync(`which ${cmd} 2>/dev/null`, { encoding: "utf-8", timeout: 3e3 }).trim();
+      if (path && existsSync2(path)) return path;
+    } catch {
+    }
+  }
+  return null;
+}
+var WF_DEVELOPER_COMMANDS = ["wf-developer"];
+var LEGACY_CLI_PATH_FILE = join3(__dirname3, "..", "..", "data", "wf-developer-path.txt");
+function loadPersistedCliPath() {
+  const fromDb = getSettings().cliPath;
+  if (fromDb) return existsSync2(fromDb) ? fromDb : "";
+  try {
+    const legacy = readFileSync2(LEGACY_CLI_PATH_FILE, "utf-8").trim();
+    if (legacy && existsSync2(legacy)) {
+      setSettings({ cliPath: legacy });
+      return legacy;
+    }
+  } catch {
+  }
+  return "";
+}
+var wfDeveloperUserPath = process.env.WF_DEVELOPER_BIN || loadPersistedCliPath();
+function getWfDeveloperPath() {
+  return wfDeveloperUserPath;
+}
+function setWfDeveloperPath(p) {
+  const trimmed = (p || "").trim();
+  if (!trimmed) {
+    wfDeveloperUserPath = "";
+    try {
+      setSettings({ cliPath: "" });
+    } catch {
+    }
+    return { ok: true, path: "" };
+  }
+  if (!existsSync2(trimmed)) return { ok: false, error: `\u8DEF\u5F84\u4E0D\u5B58\u5728: ${trimmed}` };
+  try {
+    if (!statSync(trimmed).isFile()) return { ok: false, error: `\u4E0D\u662F\u53EF\u6267\u884C\u6587\u4EF6: ${trimmed}` };
+  } catch (e) {
+    return { ok: false, error: `\u65E0\u6CD5\u8BBF\u95EE\u8BE5\u8DEF\u5F84: ${String(e)}` };
+  }
+  wfDeveloperUserPath = trimmed;
+  try {
+    setSettings({ cliPath: trimmed });
+  } catch (e) {
+    return { ok: false, error: `\u8DEF\u5F84\u6301\u4E45\u5316\u5931\u8D25: ${String(e)}` };
+  }
+  return { ok: true, path: trimmed };
+}
+var WF_BASE_URL_FILE = join3(__dirname3, "..", "..", "data", "wf-developer-base-url.txt");
+function loadPersistedBaseUrl() {
+  try {
+    const v = readFileSync2(WF_BASE_URL_FILE, "utf-8").trim();
+    return /^https?:\/\//.test(v) ? v : "";
+  } catch {
+    return "";
+  }
+}
+var wfDeveloperBaseUrl = process.env.WF_DEVELOPER_BASE_URL || loadPersistedBaseUrl() || "https://developers.worldfirst.com";
+function baseUrlArgs() {
+  return wfDeveloperBaseUrl ? ["--base-url", wfDeveloperBaseUrl] : [];
+}
+function getBaseUrl() {
+  return wfDeveloperBaseUrl;
+}
+function setBaseUrl(baseUrl) {
+  wfDeveloperBaseUrl = baseUrl.trim();
+  activeAppCache = null;
+  try {
+    mkdirSync2(dirname3(WF_BASE_URL_FILE), { recursive: true });
+    writeFileSync2(WF_BASE_URL_FILE, wfDeveloperBaseUrl, "utf-8");
+  } catch (e) {
+    console.warn("[wf-developer] base-url \u6301\u4E45\u5316\u5931\u8D25:", e);
+  }
+  return wfDeveloperBaseUrl;
+}
+function findWfDeveloper() {
+  if (wfDeveloperUserPath && existsSync2(wfDeveloperUserPath)) return wfDeveloperUserPath;
+  return findCommandPath(WF_DEVELOPER_COMMANDS);
+}
+var WF_IDENTITY_FILE = join3(__dirname3, "..", "..", "data", "wf-developer-identity.json");
+function loadCachedIdentity(tokenExpiresAt) {
+  try {
+    const parsed = JSON.parse(readFileSync2(WF_IDENTITY_FILE, "utf-8"));
+    if (parsed && typeof parsed.serverUserId === "string" && parsed.serverUserId && parsed.tokenExpiresAt === tokenExpiresAt) {
+      return { serverUserId: parsed.serverUserId, email: typeof parsed.email === "string" ? parsed.email : "", tokenExpiresAt };
+    }
+  } catch {
+  }
+  return null;
+}
+function saveCachedIdentity(identity) {
+  try {
+    mkdirSync2(dirname3(WF_IDENTITY_FILE), { recursive: true });
+    writeFileSync2(WF_IDENTITY_FILE, JSON.stringify(identity), "utf-8");
+  } catch (e) {
+    console.warn("[wf-developer] \u7528\u6237\u8EAB\u4EFD\u7F13\u5B58\u5199\u5165\u5931\u8D25:", e);
+  }
+}
+function clearCachedIdentity() {
+  try {
+    if (existsSync2(WF_IDENTITY_FILE)) unlinkSync(WF_IDENTITY_FILE);
+  } catch {
+  }
+}
+function parseWhoamiOutput(out) {
+  try {
+    const parsed = JSON.parse(out.trim());
+    if (!parsed.ok || !parsed.data) return null;
+    const expired = parsed.data.expired === true;
+    const authed = parsed.data.authenticated === true && !expired;
+    const type = parsed.data.type || (authed ? "OAuth" : "unknown");
+    const email = parsed.data.server_user_email || parsed.data.user_email || parsed.data.email || "";
+    const serverUserId = parsed.data.server_user_id || "";
+    const expiresAt = parsed.data.expires_at || "";
+    const serverVerified = parsed.data.server_verified === true;
+    return { authed, type, email, serverUserId, expired, expiresAt, serverVerified };
+  } catch {
+    return null;
+  }
+}
+function tryRefreshViaVerify(bin) {
+  try {
+    const v = spawnSync(bin, [...baseUrlArgs(), "whoami", "--verify", "--json"], { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] });
+    const server = parseWhoamiOutput(v.stdout || "");
+    if (!server?.serverVerified) return null;
+    const r2 = spawnSync(bin, [...baseUrlArgs(), "whoami", "--json"], { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] });
+    const fresh = parseWhoamiOutput(r2.stdout || "");
+    if (!fresh?.authed) return null;
+    fresh.email = server.email || fresh.email;
+    fresh.serverUserId = server.serverUserId || fresh.serverUserId;
+    return fresh;
+  } catch {
+    return null;
+  }
+}
+var WHOAMI_CACHE_TTL_MS = 60 * 1e3;
+var whoamiCache = null;
+var refreshFlight = null;
+function whoamiNow(bin) {
+  const r = spawnSync(bin, [...baseUrlArgs(), "whoami", "--json"], { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] });
+  return parseWhoamiOutput(r.stdout || "");
+}
+function ensureFreshCredentials(bin) {
+  if (whoamiCache && !whoamiCache.expired && Date.now() - whoamiCache.at < WHOAMI_CACHE_TTL_MS) return Promise.resolve();
+  if (!refreshFlight) {
+    refreshFlight = Promise.resolve().then(() => {
+      const local = whoamiNow(bin);
+      if (local?.expired) {
+        if (tryRefreshViaVerify(bin)) console.log("[wf-developer] \u4E1A\u52A1\u8C03\u7528\u9884\u68C0\uFF1Aaccess token \u5DF2\u8FC7\u671F\uFF0C\u5DF2\u7528 refresh token \u9759\u9ED8\u5237\u65B0");
+      }
+      const fresh = whoamiNow(bin);
+      whoamiCache = { at: Date.now(), expired: !!fresh?.expired };
+    }).finally(() => {
+      refreshFlight = null;
+    });
+  }
+  return refreshFlight;
+}
+function invalidateWhoamiCacheIfCredentialError(error) {
+  if (error && /no saved credentials|expired|refresh/i.test(error)) whoamiCache = null;
+}
+function detectWfDeveloperSync() {
+  const bin = findWfDeveloper();
+  if (!bin) {
+    return { installed: false, loggedIn: false, baseUrl: wfDeveloperBaseUrl, detail: "\u672A\u5728 PATH \u4E2D\u68C0\u6D4B\u5230 wf-developer CLI\uFF0C\u8BF7\u5728\u542F\u52A8\u68C0\u67E5\u9875\u624B\u52A8\u6307\u5B9A\u5176\u5B89\u88C5\u8DEF\u5F84" };
+  }
+  try {
+    const r = spawnSync(bin, [...baseUrlArgs(), "whoami", "--json"], { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] });
+    let local = parseWhoamiOutput(r.stdout || "");
+    if (!local || !local.authed) console.log("[wf-developer] whoami \u539F\u59CB\u8F93\u51FA:", JSON.stringify({ status: r.status, error: String(r.error || ""), stdout: (r.stdout || "").slice(0, 400), stderr: (r.stderr || "").slice(0, 200) }));
+    if (!local) return { installed: true, loggedIn: false, baseUrl: wfDeveloperBaseUrl, detail: "\u6388\u6743\u72B6\u6001\u672A\u77E5" };
+    if (local.expired) {
+      const refreshed = tryRefreshViaVerify(bin);
+      if (refreshed) {
+        local = refreshed;
+        console.log("[wf-developer] access token \u5DF2\u8FC7\u671F\uFF0C\u5DF2\u7528 refresh token \u9759\u9ED8\u5237\u65B0");
+      }
+    }
+    if (!local.authed) {
+      clearCachedIdentity();
+      return {
+        installed: true,
+        loggedIn: false,
+        authType: local.type,
+        baseUrl: wfDeveloperBaseUrl,
+        detail: local.expired ? "\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u70B9\u51FB\u6388\u6743\u6309\u94AE\u91CD\u65B0\u6388\u6743" : "\u672A\u6388\u6743\uFF0C\u8BF7\u70B9\u51FB\u6388\u6743\u6309\u94AE\u5B8C\u6210\u6388\u6743"
+      };
+    }
+    let identity = loadCachedIdentity(local.expiresAt);
+    if (!identity && local.serverUserId) {
+      identity = { serverUserId: local.serverUserId, email: local.email, tokenExpiresAt: local.expiresAt };
+    }
+    if (!identity) {
+      try {
+        const v = spawnSync(bin, [...baseUrlArgs(), "whoami", "--verify", "--json"], { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] });
+        const server = parseWhoamiOutput(v.stdout || "");
+        if (server?.authed && (server.serverUserId || server.email)) {
+          identity = { serverUserId: server.serverUserId, email: server.email, tokenExpiresAt: local.expiresAt };
+        }
+      } catch {
+      }
+    }
+    if (identity?.serverUserId) saveCachedIdentity(identity);
+    if (identity) {
+      if (!local.email) local.email = identity.email;
+      local.serverUserId = identity.serverUserId;
+    }
+    return {
+      installed: true,
+      loggedIn: true,
+      authType: local.type,
+      email: local.email || void 0,
+      serverUserId: local.serverUserId || void 0,
+      baseUrl: wfDeveloperBaseUrl,
+      detail: `\u5DF2\u6388\u6743 (${local.email || local.type})`
+    };
+  } catch {
+    return { installed: true, loggedIn: false, baseUrl: wfDeveloperBaseUrl, detail: "\u68C0\u6D4B\u6388\u6743\u72B6\u6001\u5931\u8D25" };
+  }
+}
+function runWfDeveloper(args, timeoutMs = 6e4) {
+  const bin = findWfDeveloper();
+  if (!bin) {
+    return Promise.resolve({ ok: false, error: `\u672A\u627E\u5230 wf-developer CLI\uFF08PATH: ${WF_DEVELOPER_COMMANDS.join("/")}\uFF1B\u53EF\u5728\u542F\u52A8\u68C0\u67E5\u9875\u624B\u52A8\u6307\u5B9A\u5B89\u88C5\u8DEF\u5F84\uFF09` });
+  }
+  return ensureFreshCredentials(bin).then(() => new Promise((resolve3) => {
+    const fullArgs = [...baseUrlArgs(), ...args, "--json"];
+    const cmdStr = `wf-developer ${fullArgs.join(" ")}`;
+    console.log(`[CLI] ${cmdStr}`);
+    const child = spawn(bin, fullArgs, { env: { ...process.env, WF_HTTP_DEBUG: "1" }, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", settled = false;
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    }, timeoutMs);
+    timer.unref?.();
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const raw = stdout.trim();
+      const httpDebug = [];
+      const keptErr = [];
+      for (const line of stderr.split("\n")) {
+        const t = line.trim();
+        if (t.startsWith("{") && t.includes('"wf_http_debug"')) {
+          try {
+            const o = JSON.parse(t);
+            if (o && o.type === "wf_http_debug") {
+              httpDebug.push(o);
+              continue;
+            }
+          } catch {
+          }
+        }
+        keptErr.push(line);
+      }
+      const errRaw = keptErr.join("\n").trim();
+      const candidates = [];
+      for (const text of [raw, errRaw]) {
+        if (!text) continue;
+        candidates.push(text);
+        const firstBrace = text.indexOf("{");
+        if (firstBrace > 0) candidates.push(text.slice(firstBrace));
+      }
+      for (const candidate of candidates) {
+        try {
+          const parsed = JSON.parse(candidate);
+          const traceId = parsed.sofaTraceId || parsed.sofa_trace_id || void 0;
+          if (parsed.ok) {
+            resolve3({ ok: true, data: parsed.data, cmd: cmdStr, traceId, httpDebug });
+            return;
+          }
+          const err = parsed.error?.message || parsed.error?.code || errRaw || "wf-developer \u6267\u884C\u5931\u8D25";
+          invalidateWhoamiCacheIfCredentialError(err);
+          resolve3({ ok: false, error: err, cmd: cmdStr, traceId, httpDebug });
+          return;
+        } catch {
+        }
+      }
+      resolve3({ ok: false, error: `wf-developer \u8F93\u51FA\u89E3\u6790\u5931\u8D25: ${(errRaw || raw).slice(0, 500)}`, cmd: cmdStr });
+    };
+    child.stdout.on("data", (c) => {
+      stdout = `${stdout}${c.toString()}`.slice(-512 * 1024);
+    });
+    child.stderr.on("data", (c) => {
+      stderr = `${stderr}${c.toString()}`.slice(-64 * 1024);
+    });
+    child.on("error", (e) => {
+      if (!settled) resolve3({ ok: false, error: String(e), cmd: cmdStr });
+      settled = true;
+      clearTimeout(timer);
+    });
+    child.on("close", () => finish());
+  }));
+}
+function sendWfResult(res, r) {
+  if (r.cmd) {
+    const traceSuffix = r.traceId ? ` | sofaTraceId: ${r.traceId}` : "";
+    res.setHeader("X-Wf-Cli", encodeURIComponent(r.cmd + traceSuffix));
+  }
+  const debug = r.httpDebug?.length ? { httpDebug: r.httpDebug } : {};
+  if (r.ok) res.json({ success: true, data: r.data ?? {}, ...debug });
+  else res.status(502).json({ success: false, error: r.error || "wf-developer \u8C03\u7528\u5931\u8D25", ...debug });
+}
+var activeAppCache = null;
+function ensureActiveApp(bin, appId) {
+  if (activeAppCache && activeAppCache.appId === appId && activeAppCache.baseUrl === wfDeveloperBaseUrl) return { ok: true };
+  const useArgs = [...baseUrlArgs(), "app", "use", appId, "--json"];
+  let r = spawnSync(bin, useArgs, { encoding: "utf-8", timeout: 15e3, stdio: ["ignore", "pipe", "pipe"] });
+  if (r.status !== 0 && /not synchronized/i.test(`${r.stdout || ""}${r.stderr || ""}`)) {
+    const sync = spawnSync(bin, [...baseUrlArgs(), "login", "--json"], { encoding: "utf-8", timeout: 6e4, stdio: ["ignore", "pipe", "pipe"] });
+    if (sync.status === 0) {
+      r = spawnSync(bin, useArgs, { encoding: "utf-8", timeout: 15e3, stdio: ["ignore", "pipe", "pipe"] });
+    }
+  }
+  if (r.status !== 0) {
+    return { ok: false, error: (r.stdout || r.stderr || "").trim().slice(0, 300) };
+  }
+  activeAppCache = { appId, baseUrl: wfDeveloperBaseUrl };
+  return { ok: true };
+}
+async function runWfDeveloperForApp(args, appId, timeoutMs = 6e4) {
+  const bin = findWfDeveloper();
+  if (!bin) {
+    return { ok: false, error: `\u672A\u627E\u5230 wf-developer CLI\uFF08PATH: ${WF_DEVELOPER_COMMANDS.join("/")}\uFF1B\u53EF\u5728\u542F\u52A8\u68C0\u67E5\u9875\u624B\u52A8\u6307\u5B9A\u5B89\u88C5\u8DEF\u5F84\uFF09` };
+  }
+  await ensureFreshCredentials(bin);
+  const sel = ensureActiveApp(bin, appId);
+  if (!sel.ok) {
+    return { ok: false, error: `\u9009\u62E9\u5E94\u7528\u5931\u8D25 (wf-developer app use ${appId}): ${sel.error}` };
+  }
+  let result = await runWfDeveloper(args, timeoutMs);
+  if (!result.ok && /not synchronized/i.test(result.error || "")) {
+    const sync = spawnSync(bin, [...baseUrlArgs(), "login", "--json"], {
+      encoding: "utf-8",
+      timeout: 6e4,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (sync.status === 0) {
+      whoamiCache = null;
+      activeAppCache = null;
+      const reselect = ensureActiveApp(bin, appId);
+      result = reselect.ok ? await runWfDeveloper(args, timeoutMs) : { ok: false, error: `\u9009\u62E9\u5E94\u7528\u5931\u8D25 (wf-developer app use ${appId}): ${reselect.error}` };
+    }
+  }
+  return result;
+}
+
+// server/routes/testcase.ts
+import { writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// server/cli/routeFactory.ts
+function defineCliRoute(app2, spec) {
+  const source = spec.method === "get" ? "query" : "body";
+  app2[spec.method](spec.path, async (req, res) => {
+    const raw = source === "query" ? req.query : req.body;
+    const values = {};
+    const missing = [];
+    for (const [name, opt] of Object.entries(spec.params || {})) {
+      const v = raw?.[name];
+      const str = v == null ? "" : String(v).trim();
+      if (!str) {
+        if (opt.required) missing.push(name);
+        continue;
+      }
+      if (opt.numeric && !Number.isFinite(Number(str))) {
+        res.status(400).json({ success: false, error: `${name} \u5FC5\u987B\u662F\u6570\u5B57` });
+        return;
+      }
+      values[name] = str;
+    }
+    if (missing.length > 0) {
+      res.status(400).json({ success: false, error: `${missing.join("\u3001")} \u4E3A\u5FC5\u586B` });
+      return;
+    }
+    const args = spec.args(values);
+    const result = spec.run ? await spec.run(args, values, spec.timeoutMs) : await runWfDeveloper(args, spec.timeoutMs);
+    sendWfResult(res, result);
+  });
+}
+
+// server/routes/testcase.ts
+async function withTempJson(prefix, payload, run) {
+  const file = join4(tmpdir2(), `${prefix}-${randomUUID2()}.json`);
+  try {
+    writeFileSync3(file, JSON.stringify(payload), "utf-8");
+    await run(file);
+  } finally {
+    try {
+      unlinkSync2(file);
+    } catch {
+    }
+  }
+}
+function registerTestcaseRoutes(app2) {
+  app2.post("/api/testcase/init", async (req, res) => {
+    const { clientId, cases } = req.body;
+    if (!clientId || !Array.isArray(cases) || cases.length === 0) {
+      res.status(400).json({ success: false, error: "clientId \u548C cases\uFF08\u975E\u7A7A\u6570\u7EC4\uFF09\u4E3A\u5FC5\u586B" });
+      return;
+    }
+    try {
+      await withTempJson("wf-testcase-init", { clientId, cases }, async (file) => {
+        sendWfResult(res, await runWfDeveloperForApp(["app", "testcase", "init", "--file", file, "--client-id", clientId], clientId));
+      });
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+  app2.post("/api/testcase/add", async (req, res) => {
+    const { clientId, case: c } = req.body;
+    if (!clientId || !c?.caseKey || !c?.caseName) {
+      res.status(400).json({ success: false, error: "clientId \u548C case\uFF08\u542B caseKey/caseName\uFF09\u4E3A\u5FC5\u586B" });
+      return;
+    }
+    try {
+      await withTempJson("wf-testcase-steps", c.steps || [], async (file) => {
+        const args = [
+          "app",
+          "testcase",
+          "add",
+          "--case-key",
+          c.caseKey,
+          "--name",
+          c.caseName,
+          "--type",
+          c.caseType || "happy",
+          "--desc",
+          c.description || "",
+          "--steps",
+          file,
+          "--client-id",
+          clientId
+        ];
+        if (c.required) args.push("--required");
+        sendWfResult(res, await runWfDeveloperForApp(args, clientId));
+      });
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+  defineCliRoute(app2, {
+    method: "post",
+    path: "/api/testcase/skip",
+    params: { clientId: { required: true }, caseKey: { required: true } },
+    args: (p) => ["app", "testcase", "skip", "--case-key", p.caseKey, "--client-id", p.clientId],
+    run: (args, p, t) => runWfDeveloperForApp(args, p.clientId, t)
+  });
+  defineCliRoute(app2, {
+    method: "post",
+    path: "/api/testcase/start",
+    params: { clientId: { required: true }, caseKey: { required: true } },
+    args: (p) => ["app", "testcase", "start", "--case-key", p.caseKey, "--client-id", p.clientId],
+    run: (args, p, t) => runWfDeveloperForApp(args, p.clientId, t)
+  });
+  defineCliRoute(app2, {
+    method: "get",
+    path: "/api/testcase/list",
+    params: { clientId: { required: true }, status: {} },
+    args: (p) => ["app", "testcase", "list", "--client-id", p.clientId, ...p.status ? ["--status", p.status] : []],
+    run: (args, p, t) => runWfDeveloperForApp(args, p.clientId, t)
+  });
+  app2.post("/api/testcase/progress/update", async (req, res) => {
+    const { clientId, caseKey, stepSeq, status, logId, logTime, failReason, request, response, traceId, logType } = req.body || {};
+    if (!clientId || !caseKey || stepSeq == null || !status) {
+      res.status(400).json({ success: false, error: "clientId\u3001caseKey\u3001stepSeq\u3001status \u4E3A\u5FC5\u586B" });
+      return;
+    }
+    const baseArgs = [
+      "app",
+      "testcase",
+      "update_progress",
+      "--case-key",
+      caseKey,
+      "--client-id",
+      clientId,
+      "--step-seq",
+      String(stepSeq),
+      "--status",
+      status,
+      ...logId ? ["--log-id", logId] : [],
+      ...logTime ? ["--log-time", logTime] : [],
+      ...failReason ? ["--fail-reason", failReason] : []
+    ];
+    const hasPayload = typeof request === "string" && request.length > 0;
+    try {
+      if (hasPayload) {
+        await withTempJson("wf-testcase-payload", { request, response: response || "", traceId: traceId || "", logType: logType || "", logTime: logTime || "" }, async (file) => {
+          sendWfResult(res, await runWfDeveloperForApp([...baseArgs, "--payload-file", file], clientId));
+        });
+      } else {
+        sendWfResult(res, await runWfDeveloperForApp(baseArgs, clientId));
+      }
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+}
+
+// server/routes/files.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4, readdirSync, statSync as statSync2, realpathSync } from "node:fs";
+import { join as join5, dirname as dirname4, isAbsolute, resolve } from "node:path";
+function registerFileRoutes(app2) {
+  const FILE_TREE_EXCLUDES = /* @__PURE__ */ new Set([
+    "node_modules",
+    ".git",
+    "target",
+    "dist",
+    "build",
+    "out",
+    "bin",
+    ".idea",
+    ".vscode",
+    ".qoder",
+    ".gradle",
+    ".settings",
+    ".classpath",
+    ".project",
+    "__pycache__",
+    ".DS_Store",
+    "coverage",
+    ".next",
+    ".nuxt",
+    "logs"
+  ]);
+  function resolveWithinRoot(root, target) {
+    const resolvedRoot = resolve(root);
+    const resolvedTarget = isAbsolute(target) ? resolve(target) : resolve(resolvedRoot, target);
+    const within = (r, t) => t === r || t.startsWith(r + "/");
+    if (within(resolvedRoot, resolvedTarget)) return resolvedTarget;
+    try {
+      const realRoot = realpathSync(resolvedRoot);
+      let existing = resolvedTarget;
+      while (!existsSync3(existing)) {
+        const parent = dirname4(existing);
+        if (parent === existing) return null;
+        existing = parent;
+      }
+      const realTarget = realpathSync(existing) + resolvedTarget.slice(existing.length);
+      if (within(realRoot, realTarget)) return resolvedTarget;
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  function validateRoot(raw) {
+    if (typeof raw !== "string" || !raw.trim() || !isAbsolute(raw.trim())) return null;
+    const root = resolve(raw.trim());
+    try {
+      if (!existsSync3(root) || !statSync2(root).isDirectory()) return null;
+    } catch {
+      return null;
+    }
+    return root;
+  }
+  app2.get("/api/files/tree", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const dir = typeof req.query.dir === "string" && req.query.dir ? req.query.dir : root;
+    const safeDir = resolveWithinRoot(root, dir);
+    if (!safeDir) {
+      res.status(403).json({ success: false, error: "\u8DEF\u5F84\u8D8A\u754C\uFF1A\u4EC5\u5141\u8BB8\u8BBF\u95EE\u9879\u76EE\u76EE\u5F55\u5185\u7684\u6587\u4EF6" });
+      return;
+    }
+    try {
+      const entries = readdirSync(safeDir, { withFileTypes: true }).filter((ent) => !FILE_TREE_EXCLUDES.has(ent.name) && !ent.name.startsWith(".git")).slice(0, 500).map((ent) => {
+        const full = join5(safeDir, ent.name);
+        if (ent.isDirectory()) return { name: ent.name, path: full, type: "dir" };
+        let size;
+        let mtime;
+        try {
+          const st = statSync2(full);
+          size = st.size;
+          mtime = st.mtimeMs;
+        } catch {
+        }
+        return { name: ent.name, path: full, type: "file", size, mtime };
+      }).sort((a, b) => a.type === b.type ? a.name.localeCompare(b.name) : a.type === "dir" ? -1 : 1);
+      res.json({ success: true, data: { root, dir: safeDir, items: entries } });
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+  const FILE_READ_LIMIT = 2 * 1024 * 1024;
+  app2.get("/api/files/content", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const filePath = typeof req.query.path === "string" ? req.query.path : "";
+    const safePath = resolveWithinRoot(root, filePath);
+    if (!safePath) {
+      res.status(403).json({ success: false, error: "\u8DEF\u5F84\u8D8A\u754C\uFF1A\u4EC5\u5141\u8BB8\u8BBF\u95EE\u9879\u76EE\u76EE\u5F55\u5185\u7684\u6587\u4EF6" });
+      return;
+    }
+    try {
+      const st = statSync2(safePath);
+      if (!st.isFile()) {
+        res.status(400).json({ success: false, error: "\u76EE\u6807\u4E0D\u662F\u6587\u4EF6" });
+        return;
+      }
+      if (st.size > FILE_READ_LIMIT) {
+        res.status(413).json({ success: false, error: `\u6587\u4EF6\u8FC7\u5927\uFF08${(st.size / 1024 / 1024).toFixed(1)}MB\uFF09\uFF0C\u8D85\u8FC7 2MB \u9650\u5236` });
+        return;
+      }
+      const buf = readFileSync3(safePath);
+      if (buf.includes(0)) {
+        res.status(415).json({ success: false, error: "\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E0D\u652F\u6301\u5728\u7EBF\u67E5\u770B/\u7F16\u8F91" });
+        return;
+      }
+      res.json({ success: true, data: { path: safePath, content: buf.toString("utf-8"), size: st.size, mtime: st.mtimeMs, exists: true } });
+    } catch (err) {
+      if (err?.code === "ENOENT") {
+        res.json({ success: true, data: { path: safePath, content: "", size: 0, exists: false } });
+        return;
+      }
+      res.status(404).json({ success: false, error: `\u8BFB\u53D6\u5931\u8D25: ${String(err)}` });
+    }
+  });
+  app2.put("/api/files/content", (req, res) => {
+    const { root: rawRoot, path: rawPath, content } = req.body;
+    const root = validateRoot(rawRoot);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const safePath = resolveWithinRoot(root, rawPath || "");
+    if (!safePath) {
+      res.status(403).json({ success: false, error: "\u8DEF\u5F84\u8D8A\u754C\uFF1A\u4EC5\u5141\u8BB8\u4FDD\u5B58\u9879\u76EE\u76EE\u5F55\u5185\u7684\u6587\u4EF6" });
+      return;
+    }
+    if (typeof content !== "string") {
+      res.status(400).json({ success: false, error: "content \u5FC5\u987B\u4E3A\u5B57\u7B26\u4E32" });
+      return;
+    }
+    if (Buffer.byteLength(content, "utf-8") > FILE_READ_LIMIT) {
+      res.status(413).json({ success: false, error: "\u5185\u5BB9\u8D85\u8FC7 2MB \u9650\u5236" });
+      return;
+    }
+    try {
+      if (!existsSync3(dirname4(safePath))) {
+        res.status(400).json({ success: false, error: "\u7236\u76EE\u5F55\u4E0D\u5B58\u5728" });
+        return;
+      }
+      writeFileSync4(safePath, content, "utf-8");
+      const st = statSync2(safePath);
+      res.json({ success: true, data: { path: safePath, size: st.size, mtime: st.mtimeMs } });
+    } catch (err) {
+      res.status(500).json({ success: false, error: `\u4FDD\u5B58\u5931\u8D25: ${String(err)}` });
+    }
+  });
+  function gitRead(root, args) {
+    try {
+      const r = spawnSync2("git", ["-C", root, ...args], { encoding: "utf-8", timeout: 1e4, maxBuffer: 16 * 1024 * 1024 });
+      if (r.status !== 0) return null;
+      return r.stdout || "";
+    } catch {
+      return null;
+    }
+  }
+  function relToGitRepo(root, absPath) {
+    const top = gitRead(root, ["rev-parse", "--show-toplevel"])?.trim();
+    if (!top) return null;
+    let realTop = top;
+    try {
+      realTop = realpathSync(top);
+    } catch {
+    }
+    let realAbs = absPath;
+    try {
+      realAbs = realpathSync(absPath);
+    } catch {
+      try {
+        const realRoot = realpathSync(root);
+        if (absPath.startsWith(root + "/")) realAbs = realRoot + absPath.slice(root.length);
+      } catch {
+      }
+    }
+    if (realAbs.startsWith(realTop + "/")) return realAbs.slice(realTop.length + 1);
+    return null;
+  }
+  function countLines(content) {
+    if (!content) return 0;
+    const n = content.split("\n").length;
+    return content.endsWith("\n") ? n - 1 : n;
+  }
+  function parsePorcelainStatus(xy) {
+    if (xy === "??" || xy.includes("A")) return "added";
+    if (xy.includes("D")) return "deleted";
+    return "modified";
+  }
+  app2.get("/api/files/changes", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const rawPaths = typeof req.query.paths === "string" ? req.query.paths : "";
+    const paths = [...new Set(
+      rawPaths.split(",").map((p) => p.trim()).filter(Boolean).map((p) => resolveWithinRoot(root, p)).filter((p) => !!p)
+    )];
+    const isGit = gitRead(root, ["rev-parse", "--is-inside-work-tree"])?.trim() === "true";
+    if (!isGit || paths.length === 0) {
+      res.json({ success: true, data: { git: false, files: [] } });
+      return;
+    }
+    const files = paths.map((abs) => {
+      const status = parsePorcelainStatus((gitRead(root, ["status", "--porcelain", "--", abs]) || "").slice(0, 2));
+      let additions = 0, deletions = 0;
+      const numstat = gitRead(root, ["diff", "--numstat", "HEAD", "--", abs]);
+      if (numstat && numstat.trim()) {
+        const [a, d] = numstat.trim().split("\n")[0].split("	");
+        additions = a === "-" ? 0 : parseInt(a, 10) || 0;
+        deletions = d === "-" ? 0 : parseInt(d, 10) || 0;
+      } else if (status === "added") {
+        try {
+          const buf = readFileSync3(abs);
+          if (!buf.includes(0)) additions = countLines(buf.toString("utf-8"));
+        } catch {
+        }
+      }
+      return { path: abs, status, additions, deletions };
+    });
+    res.json({ success: true, data: { git: true, files } });
+  });
+  app2.post("/api/files/content", (req, res) => {
+    const { root: rawRoot, path: rawPath, content } = req.body;
+    const root = validateRoot(rawRoot);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    if (typeof content !== "string") {
+      res.status(400).json({ success: false, error: "\u7F3A\u5C11 content" });
+      return;
+    }
+    const safePath = resolveWithinRoot(root, typeof rawPath === "string" ? rawPath : "");
+    if (!safePath) {
+      res.status(403).json({ success: false, error: "\u8DEF\u5F84\u8D8A\u754C\uFF1A\u4EC5\u5141\u8BB8\u8BBF\u95EE\u9879\u76EE\u76EE\u5F55\u5185\u7684\u6587\u4EF6" });
+      return;
+    }
+    try {
+      writeFileSync4(safePath, content, "utf-8");
+      res.json({ success: true, data: { path: safePath } });
+    } catch (err) {
+      res.status(500).json({ success: false, error: `\u4FDD\u5B58\u5931\u8D25: ${String(err)}` });
+    }
+  });
+  app2.get("/api/files/snapshot", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const files = [];
+    const walk = (dir, depth) => {
+      if (depth > 6 || files.length > 8e3) return;
+      let entries;
+      try {
+        entries = readdirSync(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const ent of entries) {
+        if (FILE_TREE_EXCLUDES.has(ent.name) || ent.name.startsWith(".")) continue;
+        const full = join5(dir, ent.name);
+        if (ent.isDirectory()) walk(full, depth + 1);
+        else if (ent.isFile()) {
+          try {
+            const st = statSync2(full);
+            files.push({ path: full, mtime: st.mtimeMs, size: st.size });
+          } catch {
+          }
+        }
+      }
+    };
+    walk(root, 0);
+    res.json({ success: true, data: { files } });
+  });
+  app2.get("/api/files/git-changes", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const isGit = gitRead(root, ["rev-parse", "--is-inside-work-tree"])?.trim() === "true";
+    if (!isGit) {
+      res.json({ success: true, data: { git: false, files: [] } });
+      return;
+    }
+    const prefix = (gitRead(root, ["rev-parse", "--show-prefix"]) || "").trim().replace(/\/$/, "");
+    const porcelain = gitRead(root, ["status", "--porcelain"]) || "";
+    const numstatOut = gitRead(root, ["diff", "--numstat", "HEAD"]) || "";
+    const numstat = /* @__PURE__ */ new Map();
+    for (const line of numstatOut.split("\n")) {
+      if (!line.trim()) continue;
+      const [a, d, ...rest] = line.split("	");
+      numstat.set(rest.join("	"), { additions: a === "-" ? 0 : parseInt(a, 10) || 0, deletions: d === "-" ? 0 : parseInt(d, 10) || 0 });
+    }
+    const files = [];
+    for (const line of porcelain.split("\n")) {
+      if (!line.trim()) continue;
+      const xy = line.slice(0, 2);
+      let rel = line.slice(3).trim();
+      if (rel.includes(" -> ")) rel = rel.split(" -> ").pop().trim();
+      if (rel.startsWith('"') && rel.endsWith('"')) {
+        try {
+          rel = JSON.parse(rel);
+        } catch {
+          rel = rel.slice(1, -1);
+        }
+      }
+      let displayPath = rel;
+      if (prefix) {
+        if (!rel.startsWith(prefix + "/")) continue;
+        displayPath = rel.slice(prefix.length + 1);
+      }
+      const status = parsePorcelainStatus(xy);
+      const ns = numstat.get(rel);
+      let additions = ns?.additions ?? 0;
+      const deletions = ns?.deletions ?? 0;
+      if (!ns && status === "added") {
+        try {
+          const buf = readFileSync3(join5(root, displayPath));
+          if (!buf.includes(0)) additions = countLines(buf.toString("utf-8"));
+        } catch {
+        }
+      }
+      files.push({ path: join5(root, displayPath), displayPath, status, additions, deletions });
+    }
+    res.json({ success: true, data: { git: true, files } });
+  });
+  app2.get("/api/files/diff", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const filePath = typeof req.query.path === "string" ? req.query.path : "";
+    const safePath = resolveWithinRoot(root, filePath);
+    if (!safePath) {
+      res.status(403).json({ success: false, error: "\u8DEF\u5F84\u8D8A\u754C\uFF1A\u4EC5\u5141\u8BB8\u8BBF\u95EE\u9879\u76EE\u76EE\u5F55\u5185\u7684\u6587\u4EF6" });
+      return;
+    }
+    let modified = "";
+    try {
+      const st = statSync2(safePath);
+      if (st.isFile() && st.size <= FILE_READ_LIMIT) {
+        const buf = readFileSync3(safePath);
+        if (!buf.includes(0)) modified = buf.toString("utf-8");
+      }
+    } catch {
+    }
+    let original = "";
+    let status = "added";
+    const rel = relToGitRepo(root, safePath);
+    if (rel) {
+      status = parsePorcelainStatus((gitRead(root, ["status", "--porcelain", "--", safePath]) || "").slice(0, 2));
+      if (status !== "added") {
+        const head = gitRead(root, ["show", `HEAD:${rel}`]);
+        if (head !== null) original = head;
+      }
+    }
+    res.json({ success: true, data: { path: safePath, original, modified, status } });
+  });
+  function isValidBranchName(root, branch) {
+    if (!branch || branch.length > 120) return false;
+    return gitRead(root, ["check-ref-format", "--branch", branch]) !== null;
+  }
+  app2.get("/api/files/git-info", (req, res) => {
+    const root = validateRoot(req.query.root);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    const isGit = gitRead(root, ["rev-parse", "--is-inside-work-tree"])?.trim() === "true";
+    if (!isGit) {
+      res.json({ success: true, data: { isGit: false } });
+      return;
+    }
+    const branch = (gitRead(root, ["rev-parse", "--abbrev-ref", "HEAD"]) || "").trim();
+    const statusOut = gitRead(root, ["status", "--porcelain"]) || "";
+    const changes = statusOut.split("\n").map((l) => l.trimEnd()).filter(Boolean).map((l) => l.slice(3).trim());
+    res.json({
+      success: true,
+      data: {
+        isGit: true,
+        branch: branch || "(\u672A\u77E5)",
+        hasChanges: changes.length > 0,
+        changeCount: changes.length,
+        // 最多返回前 50 个变更文件（卡片展示用），完整数量以 changeCount 为准
+        changes: changes.slice(0, 50)
+      }
+    });
+  });
+  app2.post("/api/files/git-checkout", (req, res) => {
+    const { root: rawRoot, branch } = req.body;
+    const root = validateRoot(rawRoot);
+    if (!root) {
+      res.status(400).json({ success: false, error: "root \u5FC5\u987B\u4E3A\u5B58\u5728\u7684\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55" });
+      return;
+    }
+    if (typeof branch !== "string" || !isValidBranchName(root, branch.trim())) {
+      res.status(400).json({ success: false, error: `\u5206\u652F\u540D\u4E0D\u5408\u6CD5: ${branch || ""}` });
+      return;
+    }
+    const name = branch.trim();
+    const isGit = gitRead(root, ["rev-parse", "--is-inside-work-tree"])?.trim() === "true";
+    if (!isGit) {
+      res.status(400).json({ success: false, error: "\u76EE\u6807\u76EE\u5F55\u4E0D\u662F Git \u4ED3\u5E93" });
+      return;
+    }
+    const exists = gitRead(root, ["rev-parse", "--verify", `refs/heads/${name}`]) !== null;
+    const out = gitRead(root, exists ? ["checkout", name] : ["checkout", "-b", name]);
+    if (out === null) {
+      res.status(500).json({ success: false, error: `\u5207\u6362/\u521B\u5EFA\u5206\u652F\u5931\u8D25: ${name}` });
+      return;
+    }
+    const current = (gitRead(root, ["rev-parse", "--abbrev-ref", "HEAD"]) || "").trim();
+    res.json({ success: true, data: { branch: current, created: !exists } });
+  });
+}
+
+// server/routes/store.ts
+function registerStoreRoutes(app2) {
+  function storeScope(req, res) {
+    const src = { ...req.query || {}, ...req.body || {} };
+    const uid = typeof src.uid === "string" ? src.uid.trim() : "";
+    const clientId = typeof src.clientId === "string" ? src.clientId.trim() : "";
+    if (!uid || !clientId) {
+      res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+      return null;
+    }
+    return { uid, clientId };
+  }
+  app2.get("/api/store/user", (req, res) => {
+    const uid = typeof req.query.uid === "string" ? req.query.uid.trim() : "";
+    if (!uid) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid" });
+    res.json({ success: true, data: getUser(uid) });
+  });
+  app2.put("/api/store/user", (req, res) => {
+    const { uid, email, activeClientId } = req.body || {};
+    if (!uid || typeof uid !== "string") return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid" });
+    res.json({ success: true, data: upsertUser(uid, { email, activeClientId }) });
+  });
+  app2.get("/api/store/app", (req, res) => {
+    const scope = storeScope(req, res);
+    if (!scope) return;
+    ensureNodes(scope.uid, scope.clientId);
+    res.json({ success: true, data: { app: getApp(scope.uid, scope.clientId), nodes: getNodes(scope.uid, scope.clientId) } });
+  });
+  app2.put("/api/store/app/ui-state", (req, res) => {
+    const { uid, clientId, uiState } = req.body || {};
+    if (!uid || !clientId) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+    setUiState(uid, clientId, uiState || {});
+    res.json({ success: true });
+  });
+  app2.delete("/api/store/app", (req, res) => {
+    const scope = storeScope(req, res);
+    if (!scope) return;
+    deleteApp(scope.uid, scope.clientId);
+    res.json({ success: true, data: getUser(scope.uid) });
+  });
+  app2.post("/api/store/apps/sync", async (req, res) => {
+    const { uid, clientId, overview } = req.body || {};
+    if (!uid || !clientId) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+    const ov = overview || {};
+    const state = String(ov?.appInfo?.state || ov?.appInfo?.status || "").toUpperCase();
+    let cases;
+    if (state === "TESTING") {
+      try {
+        const r = await runWfDeveloperForApp(["app", "testcase", "list", "--client-id", clientId], clientId);
+        const d = r?.data;
+        cases = Array.isArray(d) ? d : Array.isArray(d?.cases) ? d.cases : Array.isArray(d?.list) ? d.list : [];
+      } catch {
+        cases = [];
+      }
+    }
+    res.json({ success: true, data: syncApp(uid, clientId, ov, { cases }) });
+  });
+  app2.post("/api/store/apps/migrate", (req, res) => {
+    const { uid, clientId, appName, steps, executor } = req.body || {};
+    if (!uid || !clientId) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+    res.json({ success: true, data: migrateDraft(uid, clientId, appName || "", steps || {}, typeof executor === "string" ? executor : void 0) });
+  });
+  app2.get("/api/store/node", (req, res) => {
+    const scope = storeScope(req, res);
+    if (!scope) return;
+    const node = typeof req.query.node === "string" ? req.query.node : "";
+    if (!node) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 node" });
+    ensureNodes(scope.uid, scope.clientId);
+    res.json({ success: true, data: { node: getNode(scope.uid, scope.clientId, node), items: loadMessages(scope.uid, scope.clientId, node) } });
+  });
+  app2.put("/api/store/node", (req, res) => {
+    const { uid, clientId, node, status, sessionId, keyDataPatch, keyDataReplace } = req.body || {};
+    if (!uid || !clientId || !node) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId / node" });
+    ensureNodes(uid, clientId);
+    updateNode(uid, clientId, node, { status, sessionId, keyDataPatch, keyDataReplace });
+    res.json({ success: true, data: getNode(uid, clientId, node) });
+  });
+  app2.put("/api/store/node/messages", (req, res) => {
+    const { uid, clientId, node, items } = req.body || {};
+    if (!uid || !clientId || !node) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId / node" });
+    ensureNodes(uid, clientId);
+    upsertMessages(uid, clientId, node, Array.isArray(items) ? items : []);
+    res.json({ success: true });
+  });
+  app2.put("/api/store/nodes/status", (req, res) => {
+    const { uid, clientId, statusMap } = req.body || {};
+    if (!uid || !clientId || !statusMap || typeof statusMap !== "object") return res.status(400).json({ success: false, error: "\u7F3A\u5C11\u53C2\u6570" });
+    ensureNodes(uid, clientId);
+    setNodesStatus(uid, clientId, statusMap);
+    res.json({ success: true });
+  });
+  app2.get("/api/store/settings", (_req, res) => {
+    res.json({ success: true, data: getSettings() });
+  });
+  app2.put("/api/store/settings", (req, res) => {
+    const { cliPath, version } = req.body || {};
+    res.json({ success: true, data: setSettings({ cliPath, version }) });
+  });
+  app2.put("/api/store/app/executor", (req, res) => {
+    const { uid, clientId, executor } = req.body || {};
+    if (!uid || !clientId) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+    res.json({ success: true, data: setAppExecutor(uid, clientId, executor || "") });
+  });
+  app2.put("/api/store/app/project-dir", (req, res) => {
+    const { uid, clientId, projectDir } = req.body || {};
+    if (!uid || !clientId) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+    setAppProjectDir(uid, clientId, typeof projectDir === "string" ? projectDir : "");
+    res.json({ success: true });
+  });
+  app2.put("/api/store/app/current-node", (req, res) => {
+    const { uid, clientId, node } = req.body || {};
+    if (!uid || !clientId) return res.status(400).json({ success: false, error: "\u7F3A\u5C11 uid / clientId" });
+    setCurrentNode(uid, clientId, node || "");
+    res.json({ success: true });
+  });
+}
+
+// server/routes/webhookProxy.ts
+import { spawn as spawn2 } from "node:child_process";
+
+// server/routes/webhookVerify.ts
+function verifyForward(status, responseBody) {
+  if (status !== 200) return { verified: false, detail: `HTTP ${status}\uFF08\u9700 200\uFF09` };
+  const trimmed = (responseBody || "").trim();
+  if (!trimmed) return { verified: false, detail: "\u54CD\u5E94\u4F53\u4E3A\u7A7A\uFF08\u9700 result.resultStatus=S\uFF09" };
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return { verified: false, detail: "\u54CD\u5E94\u4F53\u975E\u5408\u6CD5 JSON" };
+  }
+  const result = parsed && typeof parsed === "object" ? parsed.result : void 0;
+  if (!result || typeof result !== "object") return { verified: false, detail: "\u54CD\u5E94\u4F53\u7F3A\u5C11 result \u5B57\u6BB5" };
+  const rs = result.resultStatus;
+  const rc = result.resultCode;
+  if (rs !== "S") return { verified: false, detail: `resultStatus=${rs ?? "(\u7A7A)"}\uFF08\u9700 S\uFF09` };
+  if (rc !== "SUCCESS") return { verified: false, detail: `resultCode=${rc ?? "(\u7A7A)"}\uFF08\u9700 SUCCESS\uFF09` };
+  return { verified: true, detail: "resultStatus=S \xB7 resultCode=SUCCESS \xB7 HTTP 200" };
+}
+
+// server/routes/webhookProxy.ts
+var MAX_RECORDS = 200;
+function registerWebhookProxyRoutes(app2) {
+  let state = { child: null, running: false, config: null, startedAt: 0, records: [] };
+  let seq = 0;
+  const sseClients = /* @__PURE__ */ new Set();
+  function broadcast(event, data) {
+    const payload = `event: ${event}
+data: ${JSON.stringify(data)}
+
+`;
+    for (const client of sseClients) {
+      try {
+        client.write(payload);
+      } catch {
+        sseClients.delete(client);
+      }
+    }
+  }
+  function killChild() {
+    if (state.child) {
+      try {
+        state.child.kill("SIGTERM");
+      } catch {
+      }
+    }
+  }
+  process.on("exit", killChild);
+  const onSignal = (sig) => {
+    killChild();
+    process.removeListener(sig, onSignal);
+    process.kill(process.pid, sig);
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  function handleStdoutLine(line) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      broadcast("log", { text: line, time: Date.now() });
+      return;
+    }
+    if (parsed && parsed.ok === false && parsed.error) {
+      const msg = parsed.error?.message || parsed.error?.code || "CLI \u9519\u8BEF";
+      broadcast("log", { text: `\u2717 ${msg}`, level: "err", time: Date.now() });
+      return;
+    }
+    if (!parsed || parsed.type !== "forward") {
+      broadcast("log", { text: line, time: Date.now() });
+      return;
+    }
+    if (parsed.skipped) return;
+    const status = Number(parsed.status) || 0;
+    const responseBody = typeof parsed.responseBody === "string" ? parsed.responseBody : "";
+    const { verified, detail } = verifyForward(status, responseBody);
+    const rec = {
+      id: `rec-${++seq}`,
+      requestId: String(parsed.requestId || ""),
+      eventType: String(parsed.eventType || ""),
+      method: String(parsed.method || ""),
+      uri: String(parsed.uri || ""),
+      target: String(parsed.target || ""),
+      status,
+      elapsedMs: Number(parsed.elapsedMs) || 0,
+      requestBody: typeof parsed.requestBody === "string" ? parsed.requestBody : "",
+      responseBody,
+      error: String(parsed.error || ""),
+      verified,
+      verifyDetail: parsed.error ? String(parsed.error) : detail,
+      time: Number(parsed.time) || Date.now()
+    };
+    state.records.push(rec);
+    if (state.records.length > MAX_RECORDS) state.records.splice(0, state.records.length - MAX_RECORDS);
+    broadcast("record", { record: rec, time: Date.now() });
+  }
+  app2.get("/api/webhooks/proxy/status", (_req, res) => {
+    res.json({
+      success: true,
+      data: {
+        running: state.running,
+        config: state.config,
+        startedAt: state.startedAt || null,
+        records: state.records
+      }
+    });
+  });
+  app2.get("/api/webhooks/proxy/records", (_req, res) => {
+    res.json({ success: true, data: { records: state.records } });
+  });
+  app2.post("/api/webhooks/proxy/start", async (req, res) => {
+    const body = req.body || {};
+    if (state.running) {
+      res.json({
+        success: true,
+        message: "\u8F6C\u53D1\u5DF2\u5728\u8FD0\u884C\u4E2D",
+        data: { running: true, config: state.config, records: state.records }
+      });
+      return;
+    }
+    const appId = typeof body.appId === "string" ? body.appId.trim() : "";
+    const forwardTo = typeof body.forwardTo === "string" ? body.forwardTo.trim() : "";
+    if (!appId) {
+      res.status(400).json({ success: false, error: "\u7F3A\u5C11 appId" });
+      return;
+    }
+    if (!forwardTo) {
+      res.status(400).json({ success: false, error: "\u7F3A\u5C11 forwardTo\uFF08\u672C\u5730\u63A5\u6536\u7AEF\u70B9 URL\uFF09" });
+      return;
+    }
+    if (!/^https?:\/\//i.test(forwardTo)) {
+      res.status(400).json({ success: false, error: "forwardTo \u5FC5\u987B\u4E3A http/https URL" });
+      return;
+    }
+    const events = Array.isArray(body.events) ? body.events.map((e) => String(e).trim()).filter(Boolean) : [];
+    const headers = [];
+    if (Array.isArray(body.headers)) {
+      for (const h of body.headers) {
+        if (h && typeof h === "object") {
+          const key = String(h.key ?? "").trim();
+          const value = String(h.value ?? "");
+          if (key) headers.push({ key, value });
+        }
+      }
+    } else if (body.headers && typeof body.headers === "object") {
+      for (const [key, value] of Object.entries(body.headers)) {
+        if (key.trim()) headers.push({ key: key.trim(), value: String(value ?? "") });
+      }
+    }
+    const bin = findWfDeveloper();
+    if (!bin) {
+      res.status(503).json({ success: false, error: "\u672A\u627E\u5230 wf-developer CLI" });
+      return;
+    }
+    try {
+      await ensureFreshCredentials(bin);
+    } catch (err) {
+      res.status(401).json({ success: false, error: `\u6388\u6743\u5DF2\u5931\u6548: ${err instanceof Error ? err.message : String(err)}` });
+      return;
+    }
+    const sel = ensureActiveApp(bin, appId);
+    if (!sel.ok) {
+      res.status(503).json({ success: false, error: `\u9009\u62E9\u5E94\u7528\u5931\u8D25 (wf-developer app use ${appId}): ${sel.error}` });
+      return;
+    }
+    const args = [...baseUrlArgs(), "app", "listen", "--app-id", appId, "--forward-to", forwardTo, "--json"];
+    if (events.length) args.push("--events", events.join(","));
+    for (const h of headers) args.push("--headers", `${h.key}:${h.value}`);
+    const config = { appId, forwardTo, events, headers };
+    console.log(`[webhook-proxy] Starting: wf-developer ${args.join(" ")}`);
+    const child = spawn2(bin, args, { env: { ...process.env }, stdio: ["ignore", "pipe", "pipe"] });
+    state = { child, running: true, config, startedAt: Date.now(), records: [] };
+    seq = 0;
+    let buffer = "";
+    child.stdout?.on("data", (chunk) => {
+      buffer += chunk.toString();
+      let nl;
+      while ((nl = buffer.indexOf("\n")) !== -1) {
+        const line = buffer.slice(0, nl).trim();
+        buffer = buffer.slice(nl + 1);
+        if (line) handleStdoutLine(line);
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      broadcast("log", { text: chunk.toString(), time: Date.now(), level: "stderr" });
+    });
+    child.on("close", (code) => {
+      console.log(`[webhook-proxy] Process exited with code ${code}`);
+      broadcast("status", { running: false, exitCode: code, time: Date.now() });
+      state.child = null;
+      state.running = false;
+    });
+    child.on("error", (err) => {
+      console.error(`[webhook-proxy] Process error: ${err.message}`);
+      broadcast("error", { message: err.message, time: Date.now() });
+      state.child = null;
+      state.running = false;
+    });
+    broadcast("status", { running: true, config, time: Date.now() });
+    res.json({
+      success: true,
+      message: "\u8F6C\u53D1\u5DF2\u542F\u52A8",
+      data: { running: true, config, startedAt: state.startedAt, records: state.records }
+    });
+  });
+  app2.post("/api/webhooks/proxy/stop", (_req, res) => {
+    if (!state.running || !state.child) {
+      res.json({ success: true, message: "\u8F6C\u53D1\u672A\u5728\u8FD0\u884C" });
+      return;
+    }
+    const child = state.child;
+    try {
+      child.kill("SIGTERM");
+      setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, 3e3);
+    } catch (err) {
+      console.error(`[webhook-proxy] Failed to kill process: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    state.child = null;
+    state.running = false;
+    broadcast("status", { running: false, stopped: true, config: state.config, time: Date.now() });
+    res.json({ success: true, message: "\u8F6C\u53D1\u5DF2\u505C\u6B62" });
+  });
+  app2.post("/api/webhooks/proxy/records/clear", (_req, res) => {
+    state.records = [];
+    broadcast("records_cleared", { time: Date.now() });
+    res.json({ success: true });
+  });
+  app2.get("/api/webhooks/proxy/stream", (req, res) => {
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+    res.flushHeaders?.();
+    res.write(`event: status
+data: ${JSON.stringify({
+      running: state.running,
+      config: state.config,
+      startedAt: state.startedAt || null,
+      time: Date.now()
+    })}
+
+`);
+    res.write(`event: snapshot
+data: ${JSON.stringify({ records: state.records, time: Date.now() })}
+
+`);
+    sseClients.add(res);
+    const heartbeat = setInterval(() => {
+      try {
+        res.write(`:heartbeat
+
+`);
+      } catch {
+        clearInterval(heartbeat);
+      }
+    }, 3e4);
+    req.on("close", () => {
+      clearInterval(heartbeat);
+      sseClients.delete(res);
+    });
+  });
+}
+
+// server/routes/logsTail.ts
+import { spawn as spawn3 } from "node:child_process";
+function normalizeRecord(raw) {
+  let obj = raw;
+  if (!obj || typeof obj !== "object") return null;
+  for (let i = 0; i < 4; i++) {
+    if (Array.isArray(obj)) {
+      obj = obj[0];
+      continue;
+    }
+    if (obj.requestPath !== void 0 || obj.path !== void 0 || obj.requestMethod !== void 0 || obj.method !== void 0) break;
+    const nest = obj.data ?? obj.result ?? obj.record ?? obj.payload;
+    if (nest && typeof nest === "object") {
+      obj = nest;
+      continue;
+    }
+    break;
+  }
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) return null;
+  const str = (v) => v === void 0 || v === null ? void 0 : typeof v === "string" ? v : JSON.stringify(v);
+  let requestPath = str(obj.requestPath ?? obj.path ?? obj.uri ?? obj.url);
+  let queryString = str(obj.queryString ?? obj.query ?? obj.params);
+  if (requestPath) {
+    const hm = requestPath.match(/^[a-z][a-z0-9+.-]*:\/\/[^/]+(.*?)$/i);
+    if (hm) requestPath = hm[1] || "/";
+    const q = requestPath.indexOf("?");
+    if (q !== -1 && !queryString) {
+      queryString = requestPath.slice(q + 1);
+      requestPath = requestPath.slice(0, q);
+    }
+  }
+  const rec = {
+    type: "tail",
+    requestMethod: str(obj.requestMethod ?? obj.method ?? obj.httpMethod),
+    requestPath,
+    queryString,
+    requestBody: str(obj.requestBody ?? obj.reqBody ?? obj.request ?? obj.body),
+    requestHeaders: formatHeaders(obj.requestHeaders ?? obj.reqHeaders),
+    responseHeaders: formatHeaders(obj.responseHeaders ?? obj.respHeaders),
+    httpStatus: obj.httpStatus ?? obj.status ?? obj.statusCode ?? obj.responseCode,
+    responseBody: str(obj.responseBody ?? obj.respBody ?? obj.response),
+    traceId: str(obj.traceId ?? obj.trace_id ?? obj.requestId),
+    timestamp: obj.timestamp ?? obj.time,
+    logTime: str(obj.logTime),
+    clientId: str(obj.clientId ?? obj.appId)
+  };
+  if (!rec.requestPath && !rec.requestBody && !rec.responseBody) return null;
+  return rec;
+}
+function formatHeaders(v) {
+  if (v === void 0 || v === null) return void 0;
+  if (typeof v === "string") return v;
+  if (Array.isArray(v)) {
+    const lines = v.map((it) => {
+      if (it && typeof it === "object") return `${it.name ?? it.key ?? ""}: ${it.value ?? ""}`;
+      return String(it);
+    });
+    return lines.join("\n");
+  }
+  if (typeof v === "object") {
+    return Object.entries(v).map(([k, val]) => `${k}: ${val}`).join("\n");
+  }
+  return String(v);
+}
+function describeCliJson(obj) {
+  if (!obj || typeof obj !== "object") return null;
+  if (obj.type === "status") {
+    switch (obj.event) {
+      case "connected":
+        return { level: "info", code: "connected", text: `\u5DF2\u8FDE\u63A5\u65E5\u5FD7\u6D41${obj.app ? `\uFF08app=${obj.app}\uFF09` : ""}` };
+      case "connection_lost":
+        return { level: "warn", code: "connection_lost", text: `\u8FDE\u63A5\u65AD\u5F00\uFF1A${obj.error || "\u672A\u77E5\u9519\u8BEF"}${obj.retryInSeconds ? `\uFF0C${obj.retryInSeconds}s \u540E\u91CD\u8BD5` : ""}` };
+      case "token_rejected":
+        return { level: "warn", code: "token_rejected", text: "\u8BBF\u95EE token \u88AB\u62D2\u7EDD\uFF0C\u6B63\u5728\u5C1D\u8BD5\u5237\u65B0\u2026" };
+      case "heartbeat_failed":
+        return { level: "warn", code: "heartbeat_failed", text: `\u5FC3\u8DF3\u5931\u8D25\uFF1A${obj.error || "\u672A\u77E5\u9519\u8BEF"}` };
+      case "interrupted":
+        return { level: "info", code: "interrupted", text: "\u76D1\u542C\u88AB\u4E2D\u65AD" };
+      default:
+        return { level: "info", code: "status", text: `status: ${obj.event || "unknown"}` };
+    }
+  }
+  if (obj.ok === false && obj.error) {
+    const code = obj.error.code || "INTERNAL_ERROR";
+    const msg = obj.error.message || "";
+    if (code === "AUTH_REQUIRED") return { level: "err", code, text: `\u672A\u767B\u5F55\uFF1A\u8BF7\u5148\u6267\u884C wf-developer login\uFF08${msg}\uFF09` };
+    return { level: "err", code, text: `${code}: ${msg}` };
+  }
+  return null;
+}
+function registerLogsTailRoutes(app2) {
+  let tail = { child: null, running: false, appId: "", startedAt: 0, argsKey: "" };
+  const sseClients = /* @__PURE__ */ new Set();
+  function killChild() {
+    if (tail.child) {
+      try {
+        tail.child.kill("SIGTERM");
+      } catch {
+      }
+    }
+  }
+  let cleanupRegistered = false;
+  if (!cleanupRegistered) {
+    cleanupRegistered = true;
+    process.on("exit", killChild);
+    const onSignal = (sig) => {
+      killChild();
+      process.removeListener(sig, onSignal);
+      process.kill(process.pid, sig);
+    };
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+  }
+  function broadcast(event, data) {
+    const payload = `event: ${event}
+data: ${JSON.stringify(data)}
+
+`;
+    for (const client of sseClients) {
+      try {
+        client.write(payload);
+      } catch {
+        sseClients.delete(client);
+      }
+    }
+  }
+  function resetState() {
+    tail = { child: null, running: false, appId: "", startedAt: 0, argsKey: "" };
+  }
+  app2.get("/api/logs/tail/status", (_req, res) => {
+    res.json({
+      success: true,
+      data: { running: tail.running, appId: tail.appId || null, startedAt: tail.startedAt || null }
+    });
+  });
+  app2.post("/api/logs/tail/start", async (req, res) => {
+    const { appId } = req.body || {};
+    if (!appId || typeof appId !== "string") {
+      res.status(400).json({ success: false, error: "\u7F3A\u5C11 appId" });
+      return;
+    }
+    const args = [...baseUrlArgs(), "app", "logs", "tail", "--json", "--app-id", appId];
+    const argsKey = args.join(" ");
+    if (tail.running && tail.appId === appId && tail.argsKey === argsKey) {
+      res.json({ success: true, message: "tail \u5DF2\u5728\u8FD0\u884C\u4E2D", data: { running: true, appId: tail.appId } });
+      return;
+    }
+    if (tail.running && tail.child) {
+      try {
+        tail.child.kill("SIGTERM");
+      } catch {
+      }
+      resetState();
+    }
+    const bin = findWfDeveloper();
+    if (!bin) {
+      res.status(503).json({ success: false, error: "\u672A\u627E\u5230 wf-developer CLI" });
+      return;
+    }
+    try {
+      await ensureFreshCredentials(bin);
+    } catch (err) {
+      res.status(401).json({ success: false, error: `\u6388\u6743\u5DF2\u5931\u6548: ${err instanceof Error ? err.message : String(err)}` });
+      return;
+    }
+    const sel = ensureActiveApp(bin, appId);
+    if (!sel.ok) {
+      res.status(503).json({ success: false, error: `\u9009\u62E9\u5E94\u7528\u5931\u8D25 (wf-developer app use ${appId}): ${sel.error}` });
+      return;
+    }
+    console.log(`[logs-tail] Starting: wf-developer ${argsKey}`);
+    const child = spawn3(bin, args, { env: { ...process.env }, stdio: ["ignore", "pipe", "pipe"] });
+    tail = { child, running: true, appId, startedAt: Date.now(), argsKey };
+    let buffer = "";
+    let dbg = 0;
+    child.stdout?.on("data", (chunk) => {
+      buffer += chunk.toString();
+      let nl;
+      while ((nl = buffer.indexOf("\n")) !== -1) {
+        const line = buffer.slice(0, nl).trim();
+        buffer = buffer.slice(nl + 1);
+        if (!line) continue;
+        if (dbg < 5) {
+          dbg++;
+          console.log(`[logs-tail] raw line: ${line.slice(0, 400)}`);
+        }
+        try {
+          const parsed = JSON.parse(line);
+          const rec = normalizeRecord(parsed);
+          if (rec) {
+            broadcast("record", { record: rec, time: Date.now() });
+          } else {
+            const desc = describeCliJson(parsed);
+            if (desc) broadcast("log", { text: desc.text, level: desc.level, code: desc.code, time: Date.now() });
+          }
+        } catch {
+          broadcast("log", { text: line, time: Date.now() });
+        }
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      broadcast("log", { text: chunk.toString(), time: Date.now(), level: "stderr" });
+    });
+    child.on("close", (code) => {
+      console.log(`[logs-tail] Process exited with code ${code}`);
+      broadcast("status", { running: false, exitCode: code, time: Date.now() });
+      resetState();
+    });
+    child.on("error", (err) => {
+      console.error(`[logs-tail] Process error: ${err.message}`);
+      broadcast("error", { message: err.message, time: Date.now() });
+      resetState();
+    });
+    broadcast("status", { running: true, appId, time: Date.now() });
+    res.json({ success: true, message: "tail \u5DF2\u542F\u52A8", data: { running: true, appId, startedAt: tail.startedAt } });
+  });
+  app2.post("/api/logs/tail/stop", (_req, res) => {
+    if (!tail.running || !tail.child) {
+      res.json({ success: true, message: "tail \u672A\u5728\u8FD0\u884C" });
+      return;
+    }
+    const child = tail.child;
+    try {
+      child.kill("SIGTERM");
+      setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, 3e3);
+    } catch (err) {
+      console.error(`[logs-tail] Failed to kill process: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    resetState();
+    broadcast("status", { running: false, stopped: true, time: Date.now() });
+    res.json({ success: true, message: "tail \u5DF2\u505C\u6B62" });
+  });
+  app2.get("/api/logs/tail/stream", (req, res) => {
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+    res.flushHeaders?.();
+    res.write(`event: status
+data: ${JSON.stringify({
+      running: tail.running,
+      appId: tail.appId || null,
+      startedAt: tail.startedAt || null,
+      time: Date.now()
+    })}
+
+`);
+    sseClients.add(res);
+    const heartbeat = setInterval(() => {
+      try {
+        res.write(`:heartbeat
+
+`);
+      } catch {
+        clearInterval(heartbeat);
+      }
+    }, 3e4);
+    req.on("close", () => {
+      clearInterval(heartbeat);
+      sseClients.delete(res);
+    });
+  });
+}
+
+// server/routes/logsQuery.ts
+function registerLogsQueryRoutes(app2) {
+  const logQueryArgs = (kind) => (p) => [
+    "app",
+    "logs",
+    kind,
+    "--app-id",
+    p.clientId,
+    ...p.status ? ["--status", p.status] : [],
+    ...p.env ? ["--env", p.env] : [],
+    ...p.codes ? ["--codes", p.codes] : [],
+    ...p.traceId ? ["--trace-id", p.traceId] : [],
+    ...p.start ? ["--start", p.start] : [],
+    ...p.end ? ["--end", p.end] : [],
+    ...p.page ? ["--page", p.page] : [],
+    ...p.size ? ["--size", p.size] : []
+  ];
+  defineCliRoute(app2, {
+    method: "get",
+    path: "/api/logs/api",
+    params: {
+      clientId: { required: true },
+      status: {},
+      env: {},
+      codes: {},
+      traceId: {},
+      start: { numeric: true },
+      end: { numeric: true },
+      page: { numeric: true },
+      size: { numeric: true }
+    },
+    args: logQueryArgs("api"),
+    run: (args, p, t) => runWfDeveloperForApp(args, p.clientId, t)
+  });
+  defineCliRoute(app2, {
+    method: "get",
+    path: "/api/logs/notify",
+    params: {
+      clientId: { required: true },
+      status: {},
+      env: {},
+      codes: {},
+      traceId: {},
+      start: { numeric: true },
+      end: { numeric: true },
+      page: { numeric: true },
+      size: { numeric: true }
+    },
+    args: logQueryArgs("notify"),
+    run: (args, p, t) => runWfDeveloperForApp(args, p.clientId, t)
+  });
+  defineCliRoute(app2, {
+    method: "get",
+    path: "/api/logs/notify/enrich",
+    params: { clientId: { required: true }, traceId: { required: true } },
+    args: (p) => ["app", "logs", "enrich", "--app-id", p.clientId, "--trace-id", p.traceId],
+    run: (args, p, t) => runWfDeveloperForApp(args, p.clientId, t)
+  });
+}
+
+// server/cli/localTools.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { accessSync, constants, existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join6, resolve as resolve2 } from "node:path";
+
+// server/cli/executors.ts
+import { execSync as execSync2 } from "node:child_process";
+import { existsSync as existsSync4, statSync as statSync3 } from "node:fs";
+function parseVersion(output) {
+  return output.match(/(\d+\.\d+\.\d+)/)?.[1];
+}
+function parseQoderAuth(output) {
+  const l = output.toLowerCase();
+  if (l.includes("logged in") || l.includes("authenticated") || l.includes("\u5DF2\u767B\u5F55")) return "authenticated";
+  if (l.includes("not logged") || l.includes("login required") || l.includes("\u672A\u767B\u5F55") || l.includes("login")) return "required";
+  return "unknown";
+}
+function parseQoderModels(output) {
+  return output.split("\n").map((l) => l.trim()).filter(
+    (l) => l && !l.startsWith("#") && !l.startsWith("Available") && l.toUpperCase() !== "MODEL" && !/^-+$/.test(l) && l.length > 2
+  );
+}
+var EXECUTOR_SPECS = [
+  {
+    key: "qoder",
+    label: "Qoder CLI",
+    commands: ["qodercli", "qoder", "qoder-cli"],
+    subtitle: "\u9A71\u52A8\u96C6\u6210\u6D41\u6C34\u7EBF\u7684 AI \u4F1A\u8BDD\u5F15\u64CE",
+    qa: "\u5DF2\u63A5\u5165\uFF1A\u9A71\u52A8\u96C6\u6210\u6D41\u6C34\u7EBF\u7684 AI \u4F1A\u8BDD\u5F15\u64CE",
+    versionArgs: ["--version"],
+    authArgs: ["--bare", "status"],
+    parseAuth: parseQoderAuth,
+    modelArgs: ["--list-models"],
+    parseModels: parseQoderModels
+  },
+  {
+    key: "codex",
+    label: "Codex CLI",
+    commands: ["codex"],
+    subtitle: "OpenAI Codex \u547D\u4EE4\u884C\u6267\u884C\u8005",
+    qa: "CLI \u901A\u9053\u95EE\u7B54\u56DE\u4F20\u534F\u8BAE\u5BF9\u63A5\u4E2D",
+    versionArgs: ["--version"]
+  },
+  {
+    key: "claude-code",
+    label: "Claude Code CLI",
+    commands: ["claude", "claude-code"],
+    subtitle: "Anthropic Claude Code \u547D\u4EE4\u884C\u6267\u884C\u8005",
+    qa: "CLI \u901A\u9053\u95EE\u7B54\u56DE\u4F20\u534F\u8BAE\u5BF9\u63A5\u4E2D",
+    versionArgs: ["--version"]
+  }
+];
+var SPEC_BY_KEY = new Map(EXECUTOR_SPECS.map((s) => [s.key, s]));
+function isExecutorKey(key) {
+  return SPEC_BY_KEY.has(key);
+}
+function resolveCommand(spec, manualPath) {
+  if (manualPath && existsSync4(manualPath)) {
+    try {
+      if (statSync3(manualPath).isFile()) return { command: manualPath, source: "manual" };
+    } catch {
+    }
+  }
+  const fromPath = findCommandPath(spec.commands);
+  if (fromPath) return { command: fromPath, source: "path" };
+  return null;
+}
+function detectExecutor(key) {
+  const spec = SPEC_BY_KEY.get(key);
+  const manualPath = getExecutorPaths()[key] || "";
+  const base = {
+    key: spec.key,
+    label: spec.label,
+    subtitle: spec.subtitle,
+    qa: spec.qa,
+    installed: false,
+    manualPath,
+    status: "missing",
+    detail: "",
+    lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const resolved = resolveCommand(spec, manualPath);
+  if (!resolved) {
+    if (manualPath) {
+      base.detail = `\u624B\u52A8\u6307\u5B9A\u7684\u8DEF\u5F84\u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u7528\uFF1A${manualPath}\uFF1B\u4E5F\u672A\u5728 PATH \u4E2D\u68C0\u6D4B\u5230 ${spec.commands.join(" / ")}`;
+    } else {
+      base.detail = `\u672A\u5728 PATH \u4E2D\u68C0\u6D4B\u5230 ${spec.commands.join(" / ")}\uFF0C\u53EF\u624B\u52A8\u6307\u5B9A\u5176\u5B89\u88C5\u8DEF\u5F84`;
+    }
+    return base;
+  }
+  base.installed = true;
+  base.command = resolved.command;
+  base.source = resolved.source;
+  try {
+    const vOut = execSync2(`"${resolved.command}" ${spec.versionArgs.join(" ")}`, { encoding: "utf-8", timeout: 5e3 });
+    base.version = parseVersion(vOut);
+  } catch {
+  }
+  if (spec.authArgs && spec.parseAuth) {
+    try {
+      const sOut = execSync2(`"${resolved.command}" ${spec.authArgs.join(" ")}`, { encoding: "utf-8", timeout: 5e3 });
+      base.authentication = spec.parseAuth(sOut);
+    } catch {
+      base.authentication = "unknown";
+    }
+  }
+  if (spec.modelArgs && spec.parseModels) {
+    try {
+      const mOut = execSync2(`"${resolved.command}" ${spec.modelArgs.join(" ")}`, {
+        encoding: "utf-8",
+        timeout: 1e4,
+        maxBuffer: 2 * 1024 * 1024
+      });
+      base.models = spec.parseModels(mOut);
+    } catch {
+    }
+  }
+  const srcTip = resolved.source === "manual" ? "\uFF08\u624B\u52A8\u6307\u5B9A\uFF09" : "";
+  if (spec.parseAuth) {
+    if (base.authentication === "authenticated") {
+      base.status = "available";
+      base.detail = `\u5DF2\u68C0\u6D4B\u5230 ${spec.label}${srcTip}\uFF1A${resolved.command}\uFF1BCLI \u5DF2\u767B\u5F55`;
+    } else if (base.authentication === "required") {
+      base.status = "auth-required";
+      base.detail = `\u5DF2\u68C0\u6D4B\u5230 ${spec.label}${srcTip}\uFF1A${resolved.command}\uFF1BCLI \u672A\u767B\u5F55`;
+    } else {
+      base.status = "unknown";
+      base.detail = `\u5DF2\u68C0\u6D4B\u5230 ${spec.label}${srcTip}\uFF1A${resolved.command}\uFF1B\u767B\u5F55\u72B6\u6001\u672A\u77E5`;
+    }
+  } else {
+    base.status = "available";
+    base.detail = `\u5DF2\u68C0\u6D4B\u5230 ${spec.label}${srcTip}\uFF1A${resolved.command}${base.version ? `\uFF08v${base.version}\uFF09` : ""}`;
+  }
+  return base;
+}
+function detectAllExecutors() {
+  return EXECUTOR_SPECS.map((s) => detectExecutor(s.key));
+}
+function resolveExecutorCommand(key) {
+  const spec = SPEC_BY_KEY.get(key);
+  if (!spec) return null;
+  const manualPath = getExecutorPaths()[key] || "";
+  return resolveCommand(spec, manualPath)?.command ?? null;
+}
+function setExecutorManualPath(key, path) {
+  const trimmed = (path || "").trim();
+  if (trimmed) {
+    if (!existsSync4(trimmed)) return { ok: false, error: `\u8DEF\u5F84\u4E0D\u5B58\u5728\uFF1A${trimmed}` };
+    try {
+      if (!statSync3(trimmed).isFile()) return { ok: false, error: `\u4E0D\u662F\u53EF\u6267\u884C\u6587\u4EF6\uFF1A${trimmed}` };
+    } catch (e) {
+      return { ok: false, error: `\u65E0\u6CD5\u8BBF\u95EE\u8BE5\u8DEF\u5F84\uFF1A${String(e)}` };
+    }
+  }
+  try {
+    setExecutorPath(key, trimmed);
+  } catch (e) {
+    return { ok: false, error: `\u8DEF\u5F84\u6301\u4E45\u5316\u5931\u8D25\uFF1A${String(e)}` };
+  }
+  return { ok: true, executor: detectExecutor(key) };
+}
+
+// server/cli/localTools.ts
+function isExecutableFile(p) {
+  try {
+    return statSync4(p).isFile() && (accessSync(p, constants.X_OK), true);
+  } catch {
+    return false;
+  }
+}
+var SEARCH_SKIPS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function parseVersionJson(out) {
+  const text = (out || "").trim();
+  if (!text) return { ok: false };
+  const start = text.indexOf("{");
+  if (start < 0) return { ok: false };
+  try {
+    const parsed = JSON.parse(text.slice(start));
+    if (parsed && parsed.ok === true) {
+      return { ok: true, version: typeof parsed.data?.version === "string" ? parsed.data.version : void 0 };
+    }
+  } catch {
+  }
+  return { ok: false };
+}
+function searchWfDeveloperUpward(startDir) {
+  let level = resolve2(startDir);
+  for (let depth = 0; depth < 12; depth++) {
+    for (const candidate of [join6(level, "wf-developer"), join6(level, "bin", "wf-developer")]) {
+      if (isExecutableFile(candidate)) return candidate;
+    }
+    try {
+      const entries = readdirSync2(level, { withFileTypes: true }).slice(0, 200);
+      for (const ent of entries) {
+        if (!ent.isDirectory() || ent.name.startsWith(".") || SEARCH_SKIPS.has(ent.name)) continue;
+        for (const candidate of [join6(level, ent.name, "bin", "wf-developer"), join6(level, ent.name, "wf-developer")]) {
+          if (isExecutableFile(candidate)) return candidate;
+        }
+      }
+    } catch {
+    }
+    const parent = dirname5(level);
+    if (parent === level) break;
+    level = parent;
+  }
+  return null;
+}
+function verifyWfDeveloper(bin) {
+  try {
+    const r = spawnSync3(bin, ["version", "--json"], {
+      encoding: "utf-8",
+      timeout: 1e4,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return parseVersionJson(r.stdout || "");
+  } catch {
+    return { ok: false };
+  }
+}
+function detectWfDeveloperTool() {
+  const base = {
+    key: "wf-developer",
+    label: "wf-developer CLI",
+    installed: false,
+    detail: "",
+    lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const configured = getSettings().cliPath;
+  if (configured) {
+    if (!existsSync5(configured)) {
+      base.detail = `dc_settings.cli_path \u6307\u5411\u7684\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${configured}\uFF1B\u8BF7\u5728\u542F\u52A8\u68C0\u67E5\u9875\u91CD\u65B0\u6307\u5B9A`;
+      return base;
+    }
+    const v2 = verifyWfDeveloper(configured);
+    base.command = configured;
+    base.source = "settings";
+    if (!v2.ok) {
+      base.detail = `\u5DF2\u914D\u7F6E\u8DEF\u5F84 ${configured}\uFF0C\u4F46 version --json \u6821\u9A8C\u672A\u901A\u8FC7\uFF08\u9700\u8F93\u51FA ok=true \u7684 JSON\uFF09`;
+      return base;
+    }
+    base.installed = true;
+    base.version = v2.version;
+    base.detail = `\u68C0\u6D4B\u6210\u529F\uFF08dc_settings.cli_path\uFF09\uFF1A${configured}`;
+    return base;
+  }
+  const found = searchWfDeveloperUpward(process.cwd());
+  if (!found) {
+    base.detail = "dc_settings.cli_path \u672A\u914D\u7F6E\uFF0C\u4E14\u7236\u7EA7\u76EE\u5F55\u4E2D\u672A\u641C\u7D22\u5230 wf-developer \u53EF\u6267\u884C\u6587\u4EF6\uFF1B\u8BF7\u5728\u542F\u52A8\u68C0\u67E5\u9875\u624B\u52A8\u6307\u5B9A\u5B89\u88C5\u8DEF\u5F84";
+    return base;
+  }
+  const v = verifyWfDeveloper(found);
+  base.command = found;
+  base.source = "searched";
+  if (!v.ok) {
+    base.detail = `\u7236\u7EA7\u76EE\u5F55\u641C\u7D22\u547D\u4E2D ${found}\uFF0C\u4F46 version --json \u6821\u9A8C\u672A\u901A\u8FC7\uFF08\u9700\u8F93\u51FA ok=true \u7684 JSON\uFF09`;
+    return base;
+  }
+  setWfDeveloperPath(found);
+  base.installed = true;
+  base.version = v.version;
+  base.detail = `\u68C0\u6D4B\u6210\u529F\uFF08\u7236\u7EA7\u76EE\u5F55\u641C\u7D22\u547D\u4E2D\uFF0C\u5DF2\u5199\u56DE cli_path\uFF09\uFF1A${found}`;
+  return base;
+}
+function readGitVersion(bin) {
+  try {
+    const r = spawnSync3(bin, ["--version"], { encoding: "utf-8", timeout: 5e3, stdio: ["ignore", "pipe", "pipe"] });
+    return parseVersion(r.stdout || "");
+  } catch {
+    return void 0;
+  }
+}
+function detectGitTool() {
+  const base = {
+    key: "git",
+    label: "Git",
+    installed: false,
+    detail: "",
+    lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const manual = getGitPath();
+  if (manual) {
+    if (isExecutableFile(manual)) {
+      base.installed = true;
+      base.command = manual;
+      base.source = "manual";
+      base.version = readGitVersion(manual);
+      base.detail = `\u68C0\u6D4B\u6210\u529F\uFF08\u624B\u52A8\u6307\u5B9A\u76EE\u5F55\uFF09\uFF1A${manual}`;
+      return base;
+    }
+    base.detail = `\u624B\u52A8\u6307\u5B9A\u7684 git \u5DF2\u5931\u6548\uFF1A${manual}\uFF1B\u56DE\u9000\u73AF\u5883\u53D8\u91CF PATH \u68C0\u6D4B`;
+  }
+  const fromPath = findCommandPath(["git"]);
+  if (fromPath) {
+    base.installed = true;
+    base.command = fromPath;
+    base.source = "path";
+    base.version = readGitVersion(fromPath);
+    base.detail = base.detail ? `${base.detail}\uFF1BPATH \u547D\u4E2D\uFF1A${fromPath}` : `\u68C0\u6D4B\u6210\u529F\uFF08\u73AF\u5883\u53D8\u91CF PATH\uFF09\uFF1A${fromPath}`;
+    return base;
+  }
+  base.detail = base.detail ? `${base.detail}\uFF1BPATH \u4E2D\u4E5F\u672A\u68C0\u6D4B\u5230 git\uFF0C\u8BF7\u9009\u62E9 git \u6240\u5728\u76EE\u5F55` : "\u672A\u5728\u73AF\u5883\u53D8\u91CF PATH \u4E2D\u68C0\u6D4B\u5230 git\uFF0C\u8BF7\u9009\u62E9 git \u6240\u5728\u76EE\u5F55\u540E\u91CD\u65B0\u68C0\u6D4B";
+  return base;
+}
+function detectLocalTools() {
+  return [detectWfDeveloperTool(), detectGitTool()];
+}
+function setGitDir(dir) {
+  const trimmed = (dir || "").trim();
+  if (!trimmed) {
+    setGitPath("");
+    return { ok: true, tools: detectLocalTools() };
+  }
+  if (!isAbsolute2(trimmed)) return { ok: false, error: `\u8BF7\u9009\u62E9\u7EDD\u5BF9\u8DEF\u5F84\u76EE\u5F55\uFF1A${trimmed}` };
+  const resolved = resolve2(trimmed);
+  try {
+    if (!existsSync5(resolved) || !statSync4(resolved).isDirectory()) {
+      return { ok: false, error: `\u76EE\u5F55\u4E0D\u5B58\u5728\uFF1A${resolved}` };
+    }
+  } catch (e) {
+    return { ok: false, error: `\u65E0\u6CD5\u8BBF\u95EE\u8BE5\u76EE\u5F55\uFF1A${String(e)}` };
+  }
+  const bin = join6(resolved, "git");
+  if (!isExecutableFile(bin)) return { ok: false, error: `\u8BE5\u76EE\u5F55\u4E0B\u6CA1\u6709\u53EF\u6267\u884C\u7684 git\uFF1A${bin}` };
+  setGitPath(bin);
+  return { ok: true, tools: detectLocalTools() };
+}
+
+// server/routes/localTools.ts
+function registerLocalToolRoutes(app2) {
+  app2.get("/api/local-tools", (_req, res) => {
+    try {
+      res.json({ success: true, data: detectLocalTools() });
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+  app2.post("/api/local-tools/refresh", (_req, res) => {
+    try {
+      res.json({ success: true, data: detectLocalTools() });
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+  app2.post("/api/local-tools/git-dir", (req, res) => {
+    const { dir } = req.body;
+    const result = setGitDir(typeof dir === "string" ? dir : "");
+    if (!result.ok) {
+      res.status(400).json({ success: false, error: result.error });
+      return;
+    }
+    res.json({ success: true, data: result.tools });
+  });
+}
+
+// server/routes/release.ts
+function registerReleaseRoutes(app2) {
+  app2.get("/api/release/approval-status", async (req, res) => {
+    const clientId = String(req.query.clientId || "").trim();
+    const processId = String(req.query.processId || "").trim();
+    const actionType = String(req.query.actionType || "GO_LIVE").trim();
+    if (!clientId) {
+      res.status(400).json({ success: false, error: "clientId \u4E3A\u5FC5\u586B" });
+      return;
+    }
+    const args = ["app", "approval", "detail", "--app-id", clientId, "--action-type", actionType];
+    if (processId) {
+      args.push("--process-id", processId);
+    }
+    try {
+      const result = await runWfDeveloperForApp(args, clientId, 3e4);
+      sendWfResult(res, result);
+    } catch (err) {
+      res.status(500).json({ success: false, error: String(err) });
+    }
+  });
+}
+
+// server/index.ts
+import cors from "cors";
+import { spawn as spawn4, exec } from "node:child_process";
+import { existsSync as existsSync6, unlinkSync as unlinkSync3, mkdirSync as mkdirSync3, copyFileSync, readdirSync as readdirSync3, readFileSync as readFileSync4, realpathSync as realpathSync2 } from "node:fs";
+import { join as join7, dirname as dirname6 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { homedir } from "node:os";
+import { randomUUID as randomUUID3 } from "node:crypto";
+var __dirname4 = dirname6(fileURLToPath4(import.meta.url));
+var app = express();
+var PORT = Number(process.env.PORT || 51689);
+app.use(cors());
+app.use(express.json({ limit: "30mb" }));
+function detectQoderSync() {
+  const e = detectExecutor("qoder");
+  return {
+    id: "qoder",
+    label: "Qoder",
+    installed: e.installed,
+    command: e.command,
+    status: e.status,
+    authentication: e.authentication,
+    version: e.version,
+    models: e.models,
+    detail: e.detail,
+    lastSeen: e.lastSeen
+  };
+}
+function checkSkills() {
+  const skillDefs = [
+    { name: "wf-api-intent-recognition", label: "API \u96C6\u6210\u610F\u56FE\u8BC6\u522B" },
+    { name: "wf-webhook-setting", label: "Webhook \u4E8B\u4EF6\u8BA2\u9605\u914D\u7F6E" },
+    { name: "wf-security-setting", label: "\u5B89\u5168\u8BBE\u7F6E\uFF08RSA \u516C\u94A5\u914D\u7F6E\uFF09" },
+    { name: "wf-integration-case", label: "\u96C6\u6210\u7528\u4F8B\u751F\u6210" }
+  ];
+  return skillDefs.map((def) => {
+    const qoderPath = join7(QODER_SKILLS_DIR, def.name, "SKILL.md");
+    const projectPath = join7(PROJECT_SKILLS_DIR, def.name, "SKILL.md");
+    return { name: def.name, label: def.label, installed: existsSync6(qoderPath), projectPath, qoderPath };
+  });
+}
+function installSkill(name) {
+  const projectSkillDir = join7(PROJECT_SKILLS_DIR, name);
+  const qoderSkillDir = join7(QODER_SKILLS_DIR, name);
+  if (!existsSync6(join7(projectSkillDir, "SKILL.md"))) return { success: false, message: `\u5DE5\u7A0B\u5185\u672A\u627E\u5230 Skill: ${name}` };
+  try {
+    copySkillDir(projectSkillDir, qoderSkillDir);
+    return { success: true, message: `Skill ${name} \u5B89\u88C5\u6210\u529F` };
+  } catch (err) {
+    return { success: false, message: `\u5B89\u88C5\u5931\u8D25: ${String(err)}` };
+  }
+}
+function copySkillDir(srcDir, destDir) {
+  mkdirSync3(destDir, { recursive: true });
+  for (const entry of readdirSync3(srcDir, { withFileTypes: true })) {
+    const src = join7(srcDir, entry.name);
+    const dest = join7(destDir, entry.name);
+    if (entry.isDirectory()) copySkillDir(src, dest);
+    else if (entry.isFile()) copyFileSync(src, dest);
+  }
+}
+function skillDirInSync(srcDir, destDir) {
+  if (!existsSync6(destDir)) return false;
+  for (const entry of readdirSync3(srcDir, { withFileTypes: true })) {
+    const src = join7(srcDir, entry.name);
+    const dest = join7(destDir, entry.name);
+    if (entry.isDirectory()) {
+      if (!skillDirInSync(src, dest)) return false;
+    } else if (entry.isFile()) {
+      if (!existsSync6(dest) || !readFileSync4(src).equals(readFileSync4(dest))) return false;
+    }
+  }
+  return true;
+}
+function syncSkillsToQoder() {
+  const results = [];
+  if (!existsSync6(PROJECT_SKILLS_DIR)) return results;
+  for (const name of readdirSync3(PROJECT_SKILLS_DIR)) {
+    const srcDir = join7(PROJECT_SKILLS_DIR, name);
+    if (!existsSync6(join7(srcDir, "SKILL.md"))) continue;
+    const destDir = join7(QODER_SKILLS_DIR, name);
+    if (skillDirInSync(srcDir, destDir)) continue;
+    try {
+      copySkillDir(srcDir, destDir);
+      results.push({ name, success: true, message: `Skill ${name} \u5DF2\u540C\u6B65\u5B89\u88C5` });
+      console.log(`[developer-console] skill auto-installed to Qoder: ${name}`);
+    } catch (err) {
+      results.push({ name, success: false, message: `\u5B89\u88C5\u5931\u8D25: ${String(err)}` });
+      console.warn(`[developer-console] skill auto-install failed: ${name}: ${String(err)}`);
+    }
+  }
+  return results;
+}
+function checkMcps() {
+  return [];
+}
+var APPS_CATALOG_TTL_MS = 10 * 60 * 1e3;
+var appsCatalogCache = null;
+async function fetchAppsCatalog(force = false) {
+  if (!force && appsCatalogCache && Date.now() - appsCatalogCache.at < APPS_CATALOG_TTL_MS) {
+    return { ok: true, data: appsCatalogCache.data };
+  }
+  const r = await runWfDeveloper(["app", "catalog"], 9e4);
+  if (r.ok) appsCatalogCache = { at: Date.now(), data: r.data };
+  return r;
+}
+var APP_NAME_PATTERN = /^[A-Za-z0-9_\u4e00-\u9fa5 ]+$/;
+function countBoundInterfaces(catalog, requestedIds) {
+  const requested = new Set(requestedIds.map(Number));
+  let bound = 0;
+  const walkModules = (mods) => {
+    for (const mod of mods || []) {
+      for (const itf of mod?.interfaceList || []) {
+        if (itf?.integrated && requested.has(Number(itf.interfaceId))) bound++;
+      }
+    }
+  };
+  for (const cat of catalog?.categoryList || []) walkModules(cat?.moduleList || []);
+  walkModules(catalog?.moduleList || []);
+  return bound;
+}
+app.get("/api/apps/catalog", async (req, res) => {
+  sendWfResult(res, await fetchAppsCatalog(req.query.refresh === "1"));
+});
+app.get("/api/apps/list", async (_req, res) => {
+  sendWfResult(res, await runWfDeveloper(["app", "list"], 9e4));
+});
+app.get("/api/apps/overview", async (req, res) => {
+  const clientId = String(req.query.clientId || "").trim();
+  if (!clientId) {
+    res.status(400).json({ success: false, error: "clientId \u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  sendWfResult(res, await runAppScopedCli(["app", "overview", "--app-id", clientId], clientId, 9e4));
+});
+app.post("/api/apps/create", async (req, res) => {
+  const { name, interfaceIds } = req.body;
+  const appName = (name || "").trim();
+  if (!appName || appName.length < 3 || appName.length > 20 || !APP_NAME_PATTERN.test(appName)) {
+    res.status(400).json({ success: false, error: "\u5E94\u7528\u540D\u4EC5\u652F\u6301\u4E2D\u6587\u3001\u82F1\u6587\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u7A7A\u683C\uFF0C\u957F\u5EA6 3-20 \u5B57\u7B26" });
+    return;
+  }
+  const ids = Array.isArray(interfaceIds) ? [...new Set(interfaceIds.map((v) => Number(v)).filter((n) => Number.isInteger(n) && n > 0))] : [];
+  if (ids.length === 0) {
+    res.status(400).json({ success: false, error: "interfaceIds \u81F3\u5C11\u9700\u8981\u4E00\u4E2A\u63A5\u53E3 ID\uFF08\u6765\u81EA apps catalog\uFF09" });
+    return;
+  }
+  const r = await runWfDeveloper(["app", "create", "--name", appName, "--interface-ids", ids.join(","), "--consent"], 12e4);
+  if (!r.ok) {
+    sendWfResult(res, r);
+    return;
+  }
+  const createdAppId = String(r.data?.appId || "");
+  if (createdAppId) {
+    const verify = await runAppScopedCli(["app", "catalog", "--app-id", createdAppId], createdAppId, 9e4);
+    if (verify.ok) {
+      const bound = countBoundInterfaces(verify.data, ids);
+      if (bound < ids.length) {
+        sendWfResult(res, {
+          ok: false,
+          cmd: r.cmd,
+          traceId: r.traceId,
+          error: `\u5E94\u7528\u5DF2\u521B\u5EFA\uFF08appId: ${createdAppId}\uFF09\uFF0C\u4F46\u63A5\u53E3\u7ED1\u5B9A\u4E0D\u5B8C\u6574\uFF1A\u8BF7\u6C42 ${ids.length} \u4E2A\uFF0C\u5B9E\u9645\u7ED1\u5B9A ${bound} \u4E2A\u3002\u63A5\u53E3 ID \u53EF\u80FD\u5DF2\u5931\u6548\uFF08\u5982\u73AF\u5883\u5207\u6362\u6216\u76EE\u5F55\u66F4\u65B0\uFF09\uFF0C\u8BF7\u56DE\u5230\u300C\u786E\u8BA4\u65B9\u6848\u300D\u91CD\u65B0\u9009\u62E9\u63A5\u53E3\u540E\u91CD\u8BD5\uFF1B\u5DF2\u521B\u5EFA\u7684\u5E94\u7528\u53EF\u7528 wf-developer apps update-interfaces --app-id ${createdAppId} \u8865\u9F50\u63A5\u53E3\u3002`
+        });
+        return;
+      }
+    }
+  }
+  sendWfResult(res, r);
+});
+async function runAppScopedCli(args, appId, timeoutMs = 9e4) {
+  const r = await runWfDeveloperForApp(args, appId, timeoutMs);
+  if (!r.ok && !appId.startsWith("SANDBOX_") && /app not publish/i.test(r.error || "")) {
+    const sandboxId = `SANDBOX_${appId}`;
+    const retryArgs = args.map((a) => a === appId ? sandboxId : a);
+    return runWfDeveloperForApp(retryArgs, sandboxId, timeoutMs);
+  }
+  return r;
+}
+var WEBHOOK_EVENTS_TTL_MS = 5 * 60 * 1e3;
+var webhookEventsCache = /* @__PURE__ */ new Map();
+async function fetchWebhookEvents(clientId, force = false) {
+  const cached = webhookEventsCache.get(clientId);
+  if (!force && cached && Date.now() - cached.at < WEBHOOK_EVENTS_TTL_MS) {
+    return { ok: true, data: cached.data };
+  }
+  const r = await runAppScopedCli(["app", "webhooks", "events", "--app-id", clientId], clientId, 9e4);
+  if (r.ok) webhookEventsCache.set(clientId, { at: Date.now(), data: r.data });
+  return r;
+}
+app.get("/api/webhooks/events", async (req, res) => {
+  const clientId = String(req.query.clientId || "").trim();
+  if (!clientId) {
+    res.status(400).json({ success: false, error: "clientId \u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  const configId = Number(req.query.configId || 0);
+  if (Number.isInteger(configId) && configId > 0) {
+    sendWfResult(res, await runAppScopedCli(["app", "webhooks", "events", "--app-id", clientId, "--config-id", String(configId)], clientId, 9e4));
+    return;
+  }
+  sendWfResult(res, await fetchWebhookEvents(clientId, req.query.refresh === "1"));
+});
+app.get("/api/webhooks/list", async (req, res) => {
+  const clientId = String(req.query.clientId || "").trim();
+  if (!clientId) {
+    res.status(400).json({ success: false, error: "clientId \u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  sendWfResult(res, await runAppScopedCli(["app", "webhooks", "list", "--app-id", clientId], clientId, 9e4));
+});
+var MAX_WEBHOOK_CONFIGS_PER_APP = 5;
+var MAX_WEBHOOK_EVENTS_PER_CONFIG = 100;
+app.post("/api/webhooks/subscribe", async (req, res) => {
+  const { clientId: rawClientId, name: rawName, events, webhookIds, url: rawUrl, configId: rawConfigId } = req.body;
+  const clientId = (rawClientId || "").trim();
+  if (!clientId) {
+    res.status(400).json({ success: false, error: "clientId \u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  const configId = Number(rawConfigId || 0);
+  const updating = Number.isInteger(configId) && configId > 0;
+  const hookName = (rawName || "").trim();
+  if (hookName && (hookName.length > 30 || !APP_NAME_PATTERN.test(hookName))) {
+    res.status(400).json({ success: false, error: "Webhook \u540D\u79F0\u4EC5\u652F\u6301\u4E2D\u6587\u3001\u82F1\u6587\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u7A7A\u683C\uFF0C\u957F\u5EA6 1-30 \u5B57\u7B26\uFF08\u540C\u5E94\u7528\u5185\u552F\u4E00\uFF09" });
+    return;
+  }
+  if (!updating && !hookName) {
+    res.status(400).json({ success: false, error: "Webhook \u540D\u79F0\u4E0D\u80FD\u4E3A\u7A7A\uFF08\u521B\u5EFA\u65F6\u5FC5\u586B\uFF0C\u540C\u5E94\u7528\u5185\u552F\u4E00\uFF09" });
+    return;
+  }
+  const hookUrl = (rawUrl || "").trim();
+  if (hookUrl && !/^https?:\/\/.+/.test(hookUrl)) {
+    res.status(400).json({ success: false, error: "url \u5E94\u4E3A\u5408\u6CD5\u7684 http/https \u5730\u5740" });
+    return;
+  }
+  if (!updating && !hookUrl) {
+    res.status(400).json({ success: false, error: "url \u4E0D\u80FD\u4E3A\u7A7A\uFF08\u521B\u5EFA\u65F6\u5FC5\u586B\uFF09" });
+    return;
+  }
+  let ids = Array.isArray(webhookIds) ? [...new Set(webhookIds.map((v) => Number(v)).filter((n) => Number.isInteger(n) && n > 0))] : [];
+  if (ids.length === 0 && Array.isArray(events) && events.length > 0) {
+    const catalog = await fetchWebhookEvents(clientId);
+    if (!catalog.ok) {
+      sendWfResult(res, catalog);
+      return;
+    }
+    const nameToId = /* @__PURE__ */ new Map();
+    for (const g of catalog.data || []) {
+      for (const it of g?.webhookList || []) {
+        const key = String(it?.funcName || it?.url || "");
+        const id = Number(it?.interfaceId);
+        if (key && Number.isInteger(id) && id > 0) nameToId.set(key, id);
+      }
+    }
+    const names = events.map(String).map((s) => s.trim()).filter(Boolean);
+    const unknown = names.filter((n) => !nameToId.has(n));
+    if (unknown.length > 0) {
+      res.status(400).json({ success: false, error: `\u4E8B\u4EF6\u4E0D\u5728\u53EF\u8BA2\u9605\u76EE\u5F55\u4E2D: ${unknown.join(", ")}` });
+      return;
+    }
+    ids = [...new Set(names.map((n) => nameToId.get(n)))];
+  }
+  if (!updating && ids.length === 0) {
+    res.status(400).json({ success: false, error: "events/webhookIds \u81F3\u5C11\u9700\u8981\u4E00\u4E2A\u4E8B\u4EF6\uFF08\u89C1 webhooks events \u76EE\u5F55\uFF09" });
+    return;
+  }
+  if (ids.length > MAX_WEBHOOK_EVENTS_PER_CONFIG) {
+    res.status(400).json({ success: false, error: `\u6BCF\u4E2A Webhook \u914D\u7F6E\u6700\u591A\u8BA2\u9605 ${MAX_WEBHOOK_EVENTS_PER_CONFIG} \u4E2A\u4E8B\u4EF6\uFF0C\u672C\u6B21\u4F20\u5165\u4E86 ${ids.length} \u4E2A` });
+    return;
+  }
+  if (!updating) {
+    const list = await runAppScopedCli(["app", "webhooks", "list", "--app-id", clientId], clientId, 9e4);
+    if (list.ok && Number(list.data?.total || 0) >= MAX_WEBHOOK_CONFIGS_PER_APP) {
+      res.status(400).json({ success: false, error: `\u4E00\u4E2A\u5E94\u7528\u6700\u591A\u521B\u5EFA ${MAX_WEBHOOK_CONFIGS_PER_APP} \u4E2A Webhook \u8BA2\u9605\u914D\u7F6E\uFF0C\u5F53\u524D\u5DF2\u8FBE\u4E0A\u9650\u3002\u8BF7\u5220\u9664\u6216\u4FEE\u6539\u5DF2\u6709\u914D\u7F6E\u3002` });
+      return;
+    }
+  }
+  const cliArgs = ["app", "webhooks", "subscribe", "--app-id", clientId];
+  if (updating) cliArgs.push("--config-id", String(configId));
+  if (hookName) cliArgs.push("--name", hookName);
+  if (ids.length > 0) cliArgs.push("--webhook-id", ids.join(","));
+  if (hookUrl) cliArgs.push("--url", hookUrl);
+  const r = await runAppScopedCli(cliArgs, clientId, 12e4);
+  webhookEventsCache.delete(clientId);
+  if (!r.ok) {
+    sendWfResult(res, r);
+    return;
+  }
+  const cfg = r.data?.config || {};
+  res.json({ success: true, data: {
+    subscribed: true,
+    updated: updating,
+    configId: cfg.id || (updating ? configId : void 0),
+    name: cfg.name || hookName,
+    webhookUrl: cfg.url || hookUrl,
+    // subscribe 响应的 eventCount 可能未填充（为 0），回退为本次请求的事件数
+    count: cfg.eventCount || ids.length,
+    config: cfg
+  } });
+});
+app.post("/api/webhooks/delete", async (req, res) => {
+  const { clientId: rawClientId, id } = req.body;
+  const recordId = Number(id);
+  if (!Number.isInteger(recordId) || recordId <= 0) {
+    res.status(400).json({ success: false, error: "id\uFF08Webhook \u914D\u7F6E ID\uFF0C\u6B63\u6574\u6570\uFF09\u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  const clientId = (rawClientId || "").trim();
+  const r = clientId ? await runWfDeveloperForApp(["app", "webhooks", "delete", "--id", String(recordId), "--yes"], clientId, 9e4) : await runWfDeveloper(["app", "webhooks", "delete", "--id", String(recordId), "--yes"], 9e4);
+  if (r.ok && clientId) webhookEventsCache.delete(clientId);
+  sendWfResult(res, r);
+});
+var PUBLIC_KEY_PATTERN = /-----BEGIN PUBLIC KEY-----[\s\S]+-----END PUBLIC KEY-----/;
+app.post("/api/security/set-key", async (req, res) => {
+  const { clientId: rawClientId, publicKey: rawKey } = req.body;
+  const clientId = (rawClientId || "").trim();
+  if (!clientId) {
+    res.status(400).json({ success: false, error: "clientId \u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  const publicKey = (rawKey || "").trim();
+  if (!PUBLIC_KEY_PATTERN.test(publicKey)) {
+    res.status(400).json({ success: false, error: "\u516C\u94A5\u5E94\u4E3A PEM \u683C\u5F0F\uFF08-----BEGIN PUBLIC KEY----- \u5305\u88F9\uFF09" });
+    return;
+  }
+  if (/PRIVATE KEY/.test(publicKey)) {
+    res.status(400).json({ success: false, error: "\u68C0\u6D4B\u5230\u79C1\u94A5\u5185\u5BB9\uFF0C\u8BF7\u4EC5\u63D0\u4EA4\u516C\u94A5" });
+    return;
+  }
+  const r = await runAppScopedCli(
+    ["app", "set-key", "--app-id", clientId, "--key", publicKey],
+    clientId,
+    12e4
+  );
+  sendWfResult(res, r);
+});
+app.get("/api/security/platform-key", async (req, res) => {
+  const clientId = String(req.query.clientId || "").trim();
+  if (!clientId) {
+    res.status(400).json({ success: false, error: "clientId \u4E0D\u80FD\u4E3A\u7A7A" });
+    return;
+  }
+  const r = await runAppScopedCli(["app", "platform-key", "--app-id", clientId], clientId, 9e4);
+  sendWfResult(res, r);
+});
+registerFileRoutes(app);
+app.get("/api/health", async (_req, res) => {
+  try {
+    const runtime = detectQoderSync();
+    const skills = checkSkills();
+    const mcps = checkMcps();
+    const wfDeveloper = detectWfDeveloperSync();
+    res.json({ server: { status: "ok", host: "127.0.0.1", port: PORT }, runtime, skills, mcps, wfDeveloper });
+  } catch (err) {
+    res.status(500).json({ server: { status: "error", host: "127.0.0.1", port: PORT }, error: String(err), runtime: { id: "qoder", label: "Qoder", installed: false, status: "unknown", detail: `\u68C0\u6D4B\u5931\u8D25: ${String(err)}` }, skills: [], mcps: [], wfDeveloper: { installed: false, loggedIn: false, detail: "\u68C0\u6D4B\u5931\u8D25" } });
+  }
+});
+app.post("/api/runtime/qoder/refresh", async (_req, res) => {
+  try {
+    res.json({ runtime: detectQoderSync() });
+  } catch (err) {
+    res.status(500).json({ error: String(err) });
+  }
+});
+app.get("/api/executors", (_req, res) => {
+  try {
+    res.json({ success: true, data: detectAllExecutors() });
+  } catch (err) {
+    res.status(500).json({ success: false, error: String(err) });
+  }
+});
+app.post("/api/executors/refresh", (_req, res) => {
+  try {
+    res.json({ success: true, data: detectAllExecutors() });
+  } catch (err) {
+    res.status(500).json({ success: false, error: String(err) });
+  }
+});
+app.post("/api/executors/set-path", (req, res) => {
+  const { key, path } = req.body;
+  if (!key || !isExecutorKey(key)) {
+    res.status(400).json({ success: false, error: "key \u5FC5\u987B\u4E3A qoder / codex / claude-code" });
+    return;
+  }
+  const result = setExecutorManualPath(key, typeof path === "string" ? path : "");
+  if (!result.ok) {
+    res.status(400).json({ success: false, error: result.error });
+    return;
+  }
+  res.json({ success: true, data: result.executor });
+});
+app.post("/api/wf-developer/base-url", (req, res) => {
+  const { baseUrl } = req.body;
+  if (baseUrl && !/^https?:\/\//.test(baseUrl)) {
+    res.status(400).json({ success: false, error: "base_url \u5FC5\u987B\u4EE5 http://  \u6216 https:// \u5F00\u5934" });
+    return;
+  }
+  res.json({ success: true, baseUrl: setBaseUrl(baseUrl || "") });
+});
+app.get("/api/wf-developer/base-url", (_req, res) => {
+  res.json({ baseUrl: getBaseUrl() });
+});
+app.get("/api/wf-developer/status", (_req, res) => {
+  try {
+    res.json({ wfDeveloper: detectWfDeveloperSync() });
+  } catch (err) {
+    res.status(500).json({ error: String(err) });
+  }
+});
+app.get("/api/cli/set-path", (_req, res) => {
+  res.json({ success: true, path: getWfDeveloperPath() });
+});
+app.post("/api/cli/set-path", (req, res) => {
+  const { path: rawPath } = req.body;
+  const result = setWfDeveloperPath(rawPath || "");
+  if (!result.ok) {
+    res.status(400).json({ success: false, error: result.error });
+    return;
+  }
+  res.json({ success: true, path: result.path, wfDeveloper: detectWfDeveloperSync() });
+});
+var wfLoginSession = null;
+function cleanupWfLoginSession() {
+  if (wfLoginSession) {
+    try {
+      wfLoginSession.child.kill("SIGKILL");
+    } catch {
+    }
+    wfLoginSession = null;
+  }
+}
+app.post("/api/wf-developer/login", async (_req, res) => {
+  const bin = findWfDeveloper();
+  if (!bin) {
+    res.status(503).json({ success: false, error: "\u672A\u627E\u5230 wf-developer CLI" });
+    return;
+  }
+  if (wfLoginSession && !wfLoginSession.finished && wfLoginSession.userCode) {
+    res.json({ success: true, userCode: wfLoginSession.userCode, verificationUrl: wfLoginSession.verificationUrl });
+    return;
+  }
+  cleanupWfLoginSession();
+  const child = spawn4(bin, [...baseUrlArgs(), "login", "--no-browser"], { env: { ...process.env }, stdio: ["pipe", "pipe", "pipe"] });
+  const session = { child, startedAt: Date.now(), finished: false, stderrTail: "" };
+  wfLoginSession = session;
+  let stderrBuf = "";
+  const timer = setTimeout(() => {
+    try {
+      child.kill("SIGKILL");
+    } catch {
+    }
+  }, 3e5);
+  timer.unref?.();
+  child.stdout.on("data", () => {
+  });
+  child.stderr.on("data", (c) => {
+    stderrBuf += c.toString();
+    session.stderrTail = stderrBuf.slice(-500);
+    if (!session.verificationUrl) {
+      const m = stderrBuf.match(/(?:地\s*址|URL)\s*[:：]\s*(\S+)/i);
+      if (m) session.verificationUrl = m[1];
+    }
+    if (!session.userCode) {
+      const m = stderrBuf.match(/(?:验证码|Code)\s*[:：]\s*([A-Za-z0-9-]+)/i);
+      if (m) session.userCode = m[1];
+    }
+    if (!session.browserUrl && session.userCode && session.verificationUrl) {
+      session.browserUrl = `${session.verificationUrl}?user_code=${encodeURIComponent(session.userCode)}`;
+    }
+  });
+  child.on("error", () => {
+    session.finished = true;
+  });
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    session.finished = true;
+    session.exitCode = code;
+  });
+  const deadline = Date.now() + 2e4;
+  while (!session.userCode && !session.finished && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  if (session.userCode) {
+    res.json({ success: true, userCode: session.userCode, verificationUrl: session.verificationUrl });
+  } else {
+    const error = session.finished ? session.exitCode === 0 ? "\u5F53\u524D\u5DF2\u662F\u6388\u6743\u72B6\u6001\uFF0C\u65E0\u9700\u91CD\u590D\u6388\u6743" : `\u6388\u6743\u8FDB\u7A0B\u5F02\u5E38\u9000\u51FA (exit ${session.exitCode})\uFF0C${session.stderrTail.trim()}` : "\u83B7\u53D6\u6388\u6743\u7801\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u70B9\u51FB\u6388\u6743";
+    cleanupWfLoginSession();
+    res.json({ success: false, error });
+  }
+});
+app.post("/api/wf-developer/login/open-browser", (_req, res) => {
+  const session = wfLoginSession && !wfLoginSession.finished ? wfLoginSession : void 0;
+  const url = session?.browserUrl || session?.verificationUrl;
+  if (!url) {
+    res.status(404).json({ success: false, error: "\u6CA1\u6709\u8FDB\u884C\u4E2D\u7684\u6388\u6743\u4F1A\u8BDD\uFF0C\u8BF7\u5148\u70B9\u51FB\u6388\u6743" });
+    return;
+  }
+  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn4(opener, args, { stdio: "ignore" });
+  child.on("error", (err) => res.status(500).json({ success: false, error: `\u6253\u5F00\u6D4F\u89C8\u5668\u5931\u8D25: ${String(err)}` }));
+  child.on("close", (code) => {
+    if (code === 0) res.json({ success: true });
+    else res.status(500).json({ success: false, error: `\u6253\u5F00\u6D4F\u89C8\u5668\u5931\u8D25 (exit ${code})` });
+  });
+});
+app.post("/api/wf-developer/login/cancel", (_req, res) => {
+  cleanupWfLoginSession();
+  res.json({ success: true });
+});
+app.get("/api/skills/check", (_req, res) => {
+  res.json({ skills: checkSkills() });
+});
+app.post("/api/skills/install", (req, res) => {
+  const { name } = req.body;
+  if (!name) {
+    res.status(400).json({ error: "name is required" });
+    return;
+  }
+  res.json(installSkill(name));
+});
+app.post("/api/skills/install-all", (_req, res) => {
+  const results = syncSkillsToQoder();
+  res.json({ results, allInstalled: checkSkills().every((s) => s.installed) });
+});
+app.post("/api/system/browse", (req, res) => {
+  const { kind } = req.body;
+  const isDir = kind !== "file";
+  const prompt = isDir ? "\u9009\u62E9\u9879\u76EE\u6839\u76EE\u5F55" : "\u9009\u62E9\u6587\u4EF6";
+  if (process.platform !== "darwin") {
+    res.status(501).json({ success: false, error: "\u5F53\u524D\u7CFB\u7EDF\u6682\u4E0D\u652F\u6301\u539F\u751F\u9009\u62E9\u7A97\u53E3\uFF0C\u8BF7\u624B\u52A8\u8F93\u5165\u8DEF\u5F84" });
+    return;
+  }
+  const script = isDir ? `POSIX path of (choose folder with prompt "${prompt}")` : `POSIX path of (choose file with prompt "${prompt}")`;
+  const cmd = `osascript -e 'tell application "System Events" to activate' -e '${script}'`;
+  exec(cmd, { timeout: 3e5 }, (err, stdout) => {
+    if (err) {
+      if (String(err).includes("User canceled") || String(err.stderr || "").includes("User canceled")) {
+        res.json({ success: false, cancelled: true });
+        return;
+      }
+      res.status(500).json({ success: false, error: String(err) });
+      return;
+    }
+    let p = stdout.trim();
+    if (isDir && p.endsWith("/")) p = p.slice(0, -1);
+    res.json({ success: true, path: p });
+  });
+});
+var sessions = /* @__PURE__ */ new Map();
+var MAX_EMPTY_OUTPUT_RETRIES = 1;
+var activeChildren = /* @__PURE__ */ new Set();
+registerTestcaseRoutes(app);
+app.post("/api/chat/abort-all", (_req, res) => {
+  let killed = 0;
+  for (const child of activeChildren) {
+    try {
+      child.kill("SIGKILL");
+      killed++;
+    } catch {
+    }
+  }
+  res.json({ success: true, killed });
+});
+app.post("/api/chat", async (req, res) => {
+  const { message, sessionId: existingSessionId, cwd, addDir, stage, clientId, appFacts, dataUpdated, config } = req.body;
+  if (!message || typeof message !== "string") {
+    res.status(400).json({ error: "message is required" });
+    return;
+  }
+  const qoderPath = resolveExecutorCommand("qoder");
+  if (!qoderPath) {
+    res.status(503).json({ error: "Qoder CLI not installed" });
+    return;
+  }
+  let sessionId = existingSessionId || randomUUID3();
+  const workDir = cwd || sessions.get(sessionId)?.cwd || process.cwd();
+  sessions.set(sessionId, { cwd: workDir });
+  const isFirstTurn = !existingSessionId;
+  const cliPath = findWfDeveloper() || getWfDeveloperPath() || "";
+  const promptFile = await createSkillPromptFile(stage, config?.lang, fetchAppsCatalog, {
+    cliPath,
+    clientId: typeof clientId === "string" && clientId.trim() ? clientId.trim() : void 0,
+    baseUrl: getBaseUrl(),
+    appFacts: typeof appFacts === "string" && appFacts.trim() ? appFacts : void 0,
+    dataUpdated: typeof dataUpdated === "string" && dataUpdated.trim() ? dataUpdated : void 0,
+    // 工程根目录：优先本轮显式传入的 cwd（集成阶段前端透传 activeApp.cwd），用于替换 skill 占位符
+    projectDir: typeof cwd === "string" && cwd.trim() ? cwd.trim() : void 0
+  });
+  res.setHeader("Content-Type", "text/event-stream");
+  res.setHeader("Cache-Control", "no-cache");
+  res.setHeader("Connection", "keep-alive");
+  res.flushHeaders?.();
+  const sendSSE = (event, data) => {
+    res.write(`event: ${event}
+`);
+    res.write(`data: ${JSON.stringify(data)}
+
+`);
+  };
+  sendSSE("meta", { cwd: workDir });
+  let settled = false;
+  let currentChild = null;
+  const startAttempt = (attempt) => {
+    let fullOutput = "";
+    let lineBuffer = "";
+    const segments = [];
+    const toolSegById = /* @__PURE__ */ new Map();
+    let sawStreamContent = false;
+    const openSegment = (kind, initial = "") => {
+      segments.push({ type: kind, content: initial });
+      sendSSE("segment", { kind, index: segments.length - 1, name: kind === "tool" ? initial : void 0 });
+      return segments.length - 1;
+    };
+    const appendToSegment = (kind, chunk) => {
+      let index = segments.length - 1;
+      if (index < 0 || segments[index].type !== kind) index = openSegment(kind);
+      segments[index].content += chunk;
+      sendSSE(kind, { chunk, index });
+    };
+    const args = ["--bare", "--setting-sources", "", "--print", "--output-format", "stream-json", "--input-format", "text", "--include-partial-messages", "--permission-mode", "bypass_permissions", isFirstTurn ? "--session-id" : "--resume", sessionId, "--cwd", workDir, "--append-system-prompt-file", promptFile];
+    if (config?.model) args.push("--model", config.model);
+    if (config?.reasoningEffort) args.push("--reasoning-effort", config.reasoningEffort);
+    if (config?.contextWindow && Number.isInteger(config.contextWindow) && config.contextWindow > 0) args.push("--context-window", String(config.contextWindow));
+    if (addDir) args.push("--add-dir", addDir);
+    const child = spawn4(qoderPath, args, { cwd: workDir, env: { ...process.env }, stdio: ["pipe", "pipe", "pipe"] });
+    currentChild = child;
+    activeChildren.add(child);
+    const processLine = (line) => {
+      line = line.trim();
+      if (!line) return;
+      fullOutput += line + "\n";
+      try {
+        const obj = JSON.parse(line);
+        if (obj.type === "stream_event") {
+          const evt = obj.event || obj;
+          if (evt.type === "content_block_start") {
+            const blockType = evt.content_block?.type;
+            if (blockType === "tool_use") {
+              const toolName = evt.content_block.name || "unknown";
+              sendSSE("tool", { tool: toolName });
+              const idx = openSegment("tool", toolName);
+              if (evt.content_block.id) toolSegById.set(evt.content_block.id, idx);
+            } else if (blockType === "thinking" || blockType === "text") {
+              openSegment(blockType);
+            }
+          } else if (evt.type === "content_block_delta" && evt.delta) {
+            if (evt.delta.type === "thinking_delta" && evt.delta.thinking) {
+              sawStreamContent = true;
+              appendToSegment("thinking", evt.delta.thinking);
+            } else if (evt.delta.type === "text_delta" && evt.delta.text) {
+              sawStreamContent = true;
+              appendToSegment("text", evt.delta.text);
+            }
+          }
+          return;
+        }
+        if (obj.type === "assistant" && obj.message?.content) {
+          for (const block of obj.message.content) {
+            if (block.type === "tool_use" && block.name) {
+              let idx = block.id ? toolSegById.get(block.id) : void 0;
+              if (idx === void 0) {
+                idx = openSegment("tool", block.name);
+                if (block.id) toolSegById.set(block.id, idx);
+                sendSSE("tool", { tool: block.name });
+              }
+              const detail = summarizeToolInput(block.name, block.input);
+              if (detail && detail !== segments[idx].detail) {
+                segments[idx].detail = detail;
+                sendSSE("tool_detail", { index: idx, detail });
+              }
+            } else if (!sawStreamContent) {
+              if (block.type === "thinking" && block.thinking) {
+                appendToSegment("thinking", block.thinking);
+              } else if (block.type === "text" && block.text) {
+                appendToSegment("text", block.text);
+              }
+            }
+          }
+          return;
+        }
+        if (obj.type === "user" && obj.message?.content) {
+          for (const block of obj.message.content) {
+            if (block.type === "tool_result") {
+              const idx = block.tool_use_id ? toolSegById.get(block.tool_use_id) : void 0;
+              if (idx !== void 0) {
+                const preview = extractToolResultText(block);
+                if (preview && preview !== segments[idx].result) {
+                  segments[idx].result = preview;
+                  sendSSE("tool_detail", { index: idx, result: preview });
+                }
+              }
+            }
+          }
+        }
+      } catch {
+      }
+    };
+    child.stdout.on("data", (chunk) => {
+      lineBuffer += chunk.toString();
+      const lines = lineBuffer.split("\n");
+      lineBuffer = lines.pop() || "";
+      for (const line of lines) processLine(line);
+    });
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString();
+      lineBuffer += text;
+      const lines = lineBuffer.split("\n");
+      lineBuffer = lines.pop() || "";
+      for (const line of lines) processLine(line);
+    });
+    child.stdin.write(message);
+    child.stdin.end();
+    const finish = (_code) => {
+      if (settled) return;
+      settled = true;
+      activeChildren.delete(child);
+      if (lineBuffer.trim()) processLine(lineBuffer);
+      const parsed = parseAIOutput(fullOutput, sessionId);
+      if (parsed.error === "empty_output" && attempt <= MAX_EMPTY_OUTPUT_RETRIES) {
+        settled = false;
+        if (isFirstTurn) {
+          sessionId = randomUUID3();
+          sessions.set(sessionId, { cwd: workDir });
+        }
+        startAttempt(attempt + 1);
+        return;
+      }
+      if (parsed.error === "empty_output") {
+        parsed.text = "\u26A0\uFE0F AI \u672C\u6B21\u672A\u8FD4\u56DE\u5185\u5BB9\uFF08\u4F1A\u8BDD\u521D\u59CB\u5316\u5F02\u5E38\uFF09\uFF0C\u8BF7\u91CD\u65B0\u53D1\u9001\u6D88\u606F\u91CD\u8BD5\u3002";
+        parsed.error = void 0;
+      }
+      if (segments.length > 0) parsed.segments = segments;
+      sendSSE("done", parsed);
+      res.end();
+      try {
+        unlinkSync3(promptFile);
+      } catch {
+      }
+    };
+    child.on("error", () => {
+      sendSSE("error", { message: "Process error" });
+      finish(null);
+    });
+    child.on("close", (code) => finish(code));
+  };
+  startAttempt(1);
+  res.on("close", () => {
+    if (!settled && currentChild) {
+      currentChild.kill("SIGKILL");
+    }
+  });
+});
+app.get("/api/session/check", (req, res) => {
+  const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId.trim() : "";
+  const cwd = typeof req.query.cwd === "string" ? req.query.cwd.trim() : "";
+  if (!sessionId) {
+    res.json({ success: true, data: { valid: false } });
+    return;
+  }
+  const workDir = cwd || sessions.get(sessionId)?.cwd || process.cwd();
+  let real = workDir;
+  try {
+    real = realpathSync2(workDir);
+  } catch {
+  }
+  const slug = real.replace(/[\\/]+/g, "-");
+  const base = join7(homedir(), ".qoder", "projects", slug);
+  const valid = existsSync6(join7(base, `${sessionId}.jsonl`)) || existsSync6(join7(base, sessionId));
+  res.json({ success: true, data: { valid } });
+});
+registerStoreRoutes(app);
+registerWebhookProxyRoutes(app);
+registerReleaseRoutes(app);
+registerLogsTailRoutes(app);
+registerLogsQueryRoutes(app);
+registerLocalToolRoutes(app);
+syncSkillsToQoder();
+function resolveDistDir() {
+  for (const cand of [join7(__dirname4, "dist"), join7(__dirname4, "..", "dist")]) {
+    if (existsSync6(join7(cand, "index.html"))) return cand;
+  }
+  return null;
+}
+var DIST = resolveDistDir();
+if (DIST) {
+  app.use(
+    express.static(DIST, {
+      setHeaders: (res, filePath) => {
+        if (filePath.endsWith("index.html")) res.setHeader("Cache-Control", "no-store");
+        else if (/[\\/]assets[\\/]/.test(filePath)) res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+      }
+    })
+  );
+  app.use((req, res, next) => {
+    if (req.method === "GET" && !req.path.startsWith("/api") && !req.path.startsWith("/assets/")) {
+      res.sendFile(join7(DIST, "index.html"));
+      return;
+    }
+    next();
+  });
+  console.log(`[developer-console] serving frontend from ${DIST}`);
+} else {
+  console.warn("[developer-console] dist/ \u672A\u627E\u5230\uFF0C\u524D\u7AEF\u9759\u6001\u6258\u7BA1\u672A\u542F\u7528\uFF08\u5F00\u53D1\u6A21\u5F0F\u8BF7\u7528 npm run dev \u7684 Vite \u524D\u7AEF\uFF09");
+}
+app.listen(PORT, "127.0.0.1", () => {
+  console.log(`[developer-console] API server running at http://127.0.0.1:${PORT}`);
+});