@coralai/sps-cli 0.68.0 → 0.69.1

package/dist/seams/credentials/index.js

@@ -0,0 +1,33 @@
+/**
+ * @module        seams/credentials
+ * @description   **凭据引用 seam** —— 配置里存**引用**(名字),真值由 provider 持有。
+ *
+ * @layer         seam
+ *
+ * 类型:**甲 · 工厂型**(进程里一个实现)。
+ *
+ * 🔴 **这个我们本来就该有,和兼容 dsh 无关。** 两个收益:
+ *    ① **装配档里永远没有密文** —— 插件配置里现在是可以直接塞 key 的,
+ *       而装配档会被每个进程在启动时读、也显示在插件页上。
+ *    ② **换密钥不用重挂插件** —— `apply(ctx, config)` 只在挂载那一刻读一次,
+ *       而引用是**每次操作现解**的。
+ *
+ * 形状抄 dsh(`ctx.credentials`):`resolve / describe / set / unset`。
+ * dsh 的原话:"configuration surfaces describe a reference without ever seeing its value."
+ */
+import { Service } from '@deepseek-ai/cordis';
+export const CREDENTIALS = 'sps.credentials';
+/** 引用必须是 POSIX 标识符(= 环境变量名的形状)。 */
+const REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function credentialRef(value) {
+    if (!REF_PATTERN.test(value)) {
+        throw new TypeError(`凭据引用 "${value}" 必须匹配 ${String(REF_PATTERN)}`);
+    }
+    return value;
+}
+export default class CredentialsSeam extends Service {
+    constructor(ctx) {
+        super(ctx, CREDENTIALS);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/seams/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/seams/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAgB,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE7C,mCAAmC;AACnC,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAI/C,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,SAAS,KAAK,UAAU,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAkBD,MAAM,CAAC,OAAO,OAAgB,eAAgB,SAAQ,OAAO;IAC3D,YAAY,GAAY;QACtB,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1B,CAAC;CAWF"}

package/dist/seams/credentials-local/index.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from '@deepseek-ai/cordis';
+import CredentialsSeam, { type CredentialInfo, type CredentialRef, type ResolvedCredential } from '../credentials/index.js';
+export declare const category = "\u51ED\u636E";
+export declare const description = "\u672C\u5730\u51ED\u636E:\u5148\u8BFB\u8FDB\u7A0B\u73AF\u5883\u53D8\u91CF(\u8FD0\u7EF4\u6CE8\u5165\u7684,\u53EA\u8BFB),\u518D\u8BFB ~/.coral/env(\u53EF\u5199,0600)\u3002";
+export default class LocalCredentials extends CredentialsSeam {
+    constructor(ctx: Context);
+    resolve(ref: CredentialRef): Promise<ResolvedCredential | undefined>;
+    describe(ref: CredentialRef): Promise<CredentialInfo>;
+    set(ref: CredentialRef, value: string): Promise<void>;
+    unset(ref: CredentialRef): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/seams/credentials-local/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/seams/credentials-local/index.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,eAAe,EAAE,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,eAAO,MAAM,QAAQ,iBAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,8KAC6B,CAAC;AAwBtD,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,eAAe;gBAC/C,GAAG,EAAE,OAAO;IAIlB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAOpE,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAWrD,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrD,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAS/C"}

package/dist/seams/credentials-local/index.js

@@ -0,0 +1,93 @@
+/**
+ * @module        seams/credentials-local
+ * @description   本地凭据 provider:`process.env` → `~/.coral/env`。
+ *
+ * @layer         seam
+ *
+ * 解析顺序(与 dsh 的 credentials-local 同构):
+ * ```
+ * 继承的 process.env    只读,**优先**   —— 运维用 systemd/pm2 注进来的那层
+ * ~/.coral/env          可读可写         —— 我们持久化的那层
+ * ```
+ *
+ * 🔴 **process.env 优先且只读**:它是拉起方(systemd / 运维)给的,
+ *    在这里写一份同名的会造成"页面上改了、进程里没变"——
+ *    那是最难查的一类不一致。所以 describe 会把 `writable:false` 说出来。
+ *
+ * 🔴 **写走 `writeSecretFile`**(tmp 0600 → rename → chmod,顺序不能反)。
+ *    直接 writeFileSync 会先按 umask 落一个可被同组读的文件,再改权限 ——
+ *    中间那一瞬是真实敞口。
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { hardenSecretFile, writeSecretFile } from '../../infra/secretFile.js';
+import CredentialsSeam from '../credentials/index.js';
+export const category = '凭据';
+export const description = '本地凭据:先读进程环境变量(运维注入的,只读),再读 ~/.coral/env(可写,0600)。';
+function envFile() {
+    return resolve(process.env.SPS_CREDENTIALS_FILE ?? resolve(homedir(), '.coral', 'env'));
+}
+/** 读 `~/.coral/env`。它是 shell 风格(`export K=v` / `K=v`),不是 dotenv 规范。 */
+function readEnvFile() {
+    const out = new Map();
+    const p = envFile();
+    if (!existsSync(p))
+        return out;
+    for (const line of readFileSync(p, 'utf8').split('\n')) {
+        const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+        if (!m)
+            continue;
+        let v = (m[2] ?? '').trim();
+        // 去掉成对的引号;内容里的引号原样留着
+        if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+            v = v.slice(1, -1);
+        }
+        out.set(m[1], v);
+    }
+    return out;
+}
+export default class LocalCredentials extends CredentialsSeam {
+    constructor(ctx) {
+        super(ctx);
+    }
+    async resolve(ref) {
+        const fromEnv = process.env[ref];
+        if (fromEnv)
+            return { value: fromEnv, source: 'process.env' };
+        const v = readEnvFile().get(ref);
+        return v ? { value: v, source: envFile() } : undefined;
+    }
+    async describe(ref) {
+        // 🔴 绝不回值。这一层存在的全部理由就是"描述一个引用而不看见它"。
+        if (process.env[ref]) {
+            return { ref, configured: true, source: 'process.env', writable: false };
+        }
+        const v = readEnvFile().get(ref);
+        return v
+            ? { ref, configured: true, source: envFile(), writable: true }
+            : { ref, configured: false, writable: true };
+    }
+    async set(ref, value) {
+        if (process.env[ref]) {
+            throw new Error(`${ref} 由进程环境变量提供(拉起方注入的),这里改不了 —— 改了也会被它盖住`);
+        }
+        const p = envFile();
+        const lines = existsSync(p) ? readFileSync(p, 'utf8').split('\n') : [];
+        const re = new RegExp(`^\\s*(?:export\\s+)?${ref}\\s*=`);
+        const next = lines.filter((l) => !re.test(l));
+        next.push(`${ref}=${value}`);
+        writeSecretFile(p, `${next.filter((l, i) => l !== '' || i < next.length - 1).join('\n')}\n`);
+    }
+    async unset(ref) {
+        const p = envFile();
+        if (!existsSync(p))
+            return;
+        const re = new RegExp(`^\\s*(?:export\\s+)?${ref}\\s*=`);
+        const kept = readFileSync(p, 'utf8').split('\n').filter((l) => !re.test(l));
+        writeSecretFile(p, `${kept.join('\n').replace(/\n+$/, '')}\n`);
+        // 存量文件可能是 664:任一次写后顺手收紧(同 channels 那条既有判据)
+        hardenSecretFile(p);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/seams/credentials-local/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/seams/credentials-local/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,eAIN,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC;AAC7B,MAAM,CAAC,MAAM,WAAW,GACtB,mDAAmD,CAAC;AAEtD,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,qBAAqB;QACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,eAAe;IAC3D,YAAY,GAAY;QACtB,KAAK,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAkB;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAkB;QAC/B,qCAAqC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,CAAC;YACN,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9D,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAkB,EAAE,KAAa;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,sCAAsC,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,uBAAuB,GAAG,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QAC7B,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAkB;QAC5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO;QAC3B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,uBAAuB,GAAG,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/D,2CAA2C;QAC3C,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;CACF"}

package/dist/seams/subprocess/index.d.ts

@@ -0,0 +1,34 @@
+import { type Context, Service } from '@deepseek-ai/cordis';
+export declare const SUBPROCESS = "sps.subprocess";
+export interface SpawnSpec {
+    argv: readonly string[];
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    /** 收到取消后,等它自己退出多久才 SIGKILL。默认 5000。 */
+    graceMs?: number;
+}
+export interface SpawnResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+export default class SubprocessSeam extends Service {
+    constructor(ctx: Context);
+    /** 把命令名解析成可执行路径(`which`)。找不到返回 `undefined`。 */
+    resolveExecutable(cmd: string): Promise<string | undefined>;
+    /**
+     * 跑一个命令,收全输出。
+     *
+     * 🔴 **取消是两段的**:先 SIGTERM,`graceMs` 之后才 SIGKILL。
+     *    直接 SIGKILL 会让子进程来不及收拾(临时文件、锁),
+     *    而那些残留没人记得是谁留下的。
+     */
+    spawn(spec: SpawnSpec): Promise<SpawnResult>;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        'sps.subprocess': SubprocessSeam;
+    }
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/seams/subprocess/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/seams/subprocess/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE5D,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAE3C,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,OAAO;gBACrC,GAAG,EAAE,OAAO;IAIxB,+CAA+C;IACzC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAQjE;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;CAmC7C;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,gBAAgB,EAAE,cAAc,CAAC;KAClC;CACF"}

package/dist/seams/subprocess/index.js

@@ -0,0 +1,77 @@
+/**
+ * @module        seams/subprocess
+ * @description   **子进程 seam** —— 插件起外部命令的口子。
+ *
+ * @layer         seam
+ *
+ * 🔴 **不迁移我们自己的 47 个文件。** 它们直用 `node:child_process`,
+ *    照旧能跑;这个 seam 是给**插件**用的门。
+ *    "提供服务" ≠ "把宿主代码搬过来" —— 混为一谈会把一个低成本的口子
+ *    估成一次全仓重构。
+ *
+ * 形状按 dsh(`ctx.subprocess`):`resolveExecutable / spawn`。
+ * ⚠️ `spawnTerminal`(分配 PTY)**不做** —— 我们没有终端复用那套,
+ *    给一个假的比没有更坏。
+ */
+import { execFile, spawn as nodeSpawn } from 'node:child_process';
+import { Service } from '@deepseek-ai/cordis';
+export const SUBPROCESS = 'sps.subprocess';
+export default class SubprocessSeam extends Service {
+    constructor(ctx) {
+        super(ctx, SUBPROCESS);
+    }
+    /** 把命令名解析成可执行路径(`which`)。找不到返回 `undefined`。 */
+    async resolveExecutable(cmd) {
+        return await new Promise((res) => {
+            execFile('which', [cmd], (err, stdout) => {
+                res(err ? undefined : stdout.trim() || undefined);
+            });
+        });
+    }
+    /**
+     * 跑一个命令,收全输出。
+     *
+     * 🔴 **取消是两段的**:先 SIGTERM,`graceMs` 之后才 SIGKILL。
+     *    直接 SIGKILL 会让子进程来不及收拾(临时文件、锁),
+     *    而那些残留没人记得是谁留下的。
+     */
+    spawn(spec) {
+        const [cmd, ...args] = spec.argv;
+        if (!cmd)
+            return Promise.reject(new Error('spawn: argv 为空'));
+        return new Promise((resolve, reject) => {
+            const child = nodeSpawn(cmd, args, {
+                cwd: spec.cwd,
+                ...(spec.env ? { env: spec.env } : {}),
+            });
+            let stdout = '';
+            let stderr = '';
+            let killer;
+            child.stdout?.on('data', (d) => {
+                stdout += String(d);
+            });
+            child.stderr?.on('data', (d) => {
+                stderr += String(d);
+            });
+            const onAbort = () => {
+                child.kill('SIGTERM');
+                killer = setTimeout(() => child.kill('SIGKILL'), spec.graceMs ?? 5000);
+                // 别让这个定时器把进程钉住 —— 命令已经在退了
+                killer.unref?.();
+            };
+            spec.signal?.addEventListener('abort', onAbort, { once: true });
+            child.on('error', (e) => {
+                if (killer)
+                    clearTimeout(killer);
+                reject(e);
+            });
+            child.on('close', (code) => {
+                if (killer)
+                    clearTimeout(killer);
+                spec.signal?.removeEventListener('abort', onAbort);
+                resolve({ code, stdout, stderr });
+            });
+        });
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/seams/subprocess/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/seams/subprocess/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAgB,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAiB3C,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,OAAO;IACjD,YAAY,GAAY;QACtB,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACjC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBACvC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAe;QACnB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;gBACjC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAkC,CAAC;YACvC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;gBACvE,0BAA0B;gBAC1B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACtB,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACnD,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/seams/tools/jsonSchemaToZod.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @module        seams/tools/jsonSchemaToZod
+ * @description   JSON Schema → Zod raw shape,给 MCP 的 `registerTool` 用。
+ *
+ * @layer         seam
+ *
+ * 🔴 **为什么需要它**:`sps.tools` 存的是 JSON Schema(插件世界的通用形状,
+ *    dsh 的 `defineTool` 也规范成这个),而 MCP SDK 的 `registerTool` 只收
+ *    **Zod raw shape** —— 直接把 JSON Schema 递过去会抛
+ *    `inputSchema must be a Zod schema or raw shape`。
+ *
+ *    ⚠️ 这条从 0.67 加 `sps.tools` 起就一直断着,而且**没有任何测试红过** ——
+ *    因为在这之前注册表里从来没有过真插件的工具(内建工具走的是另一条路,
+ *    它们本来就写 `z.object({...})`)。是"真装一个 dsh 插件"才把它撞出来的。
+ *
+ * 支持的子集按**真插件用到的**来(dsh-map-tools 等):
+ * string / number / integer / boolean / array / object / enum,加 required 与 description。
+ * 认不出的类型落到 `z.unknown()` —— **不抛**:一个字段描述不了不该让整个工具用不了。
+ */
+import { z } from 'zod';
+/** 顶层入口:JSON Schema 的 object → Zod raw shape。 */
+export declare function jsonSchemaToZodShape(schema: unknown): Record<string, z.ZodTypeAny>;
+//# sourceMappingURL=jsonSchemaToZod.d.ts.map

package/dist/seams/tools/jsonSchemaToZod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonSchemaToZod.d.ts","sourceRoot":"","sources":["../../../src/seams/tools/jsonSchemaToZod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoDxB,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAGlF"}

package/dist/seams/tools/jsonSchemaToZod.js

@@ -0,0 +1,67 @@
+/**
+ * @module        seams/tools/jsonSchemaToZod
+ * @description   JSON Schema → Zod raw shape,给 MCP 的 `registerTool` 用。
+ *
+ * @layer         seam
+ *
+ * 🔴 **为什么需要它**:`sps.tools` 存的是 JSON Schema(插件世界的通用形状,
+ *    dsh 的 `defineTool` 也规范成这个),而 MCP SDK 的 `registerTool` 只收
+ *    **Zod raw shape** —— 直接把 JSON Schema 递过去会抛
+ *    `inputSchema must be a Zod schema or raw shape`。
+ *
+ *    ⚠️ 这条从 0.67 加 `sps.tools` 起就一直断着,而且**没有任何测试红过** ——
+ *    因为在这之前注册表里从来没有过真插件的工具(内建工具走的是另一条路,
+ *    它们本来就写 `z.object({...})`)。是"真装一个 dsh 插件"才把它撞出来的。
+ *
+ * 支持的子集按**真插件用到的**来(dsh-map-tools 等):
+ * string / number / integer / boolean / array / object / enum,加 required 与 description。
+ * 认不出的类型落到 `z.unknown()` —— **不抛**:一个字段描述不了不该让整个工具用不了。
+ */
+import { z } from 'zod';
+function nodeToZod(node) {
+    if (Array.isArray(node.enum) && node.enum.length > 0) {
+        const vals = node.enum.filter((v) => typeof v === 'string');
+        // 非字符串枚举(数字等)交给下面按 type 处理 —— z.enum 只吃字符串
+        if (vals.length === node.enum.length) {
+            return z.enum(vals);
+        }
+    }
+    switch (node.type) {
+        case 'string':
+            return z.string();
+        case 'number':
+        case 'integer':
+            return z.number();
+        case 'boolean':
+            return z.boolean();
+        case 'array':
+            return z.array(node.items ? nodeToZod(node.items) : z.unknown());
+        case 'object':
+            return z.object(shapeOf(node));
+        default:
+            return z.unknown();
+    }
+}
+function shapeOf(schema) {
+    const props = schema.properties ?? {};
+    // 🔴 `required` 有两种写法:标准 JSON Schema 是**数组**,
+    //    但也见过字段级的 `required: true`(dsh 的 defineTool 产出里就有)。
+    //    只认数组的话,那类工具的必填会全部变成可选 —— 不报错,但模型会漏传参。
+    const requiredList = new Set(Array.isArray(schema.required) ? schema.required : []);
+    const out = {};
+    for (const [key, raw] of Object.entries(props)) {
+        let t = nodeToZod(raw);
+        if (raw.description)
+            t = t.describe(raw.description);
+        const isRequired = requiredList.has(key) || raw.required === true;
+        out[key] = isRequired ? t : t.optional();
+    }
+    return out;
+}
+/** 顶层入口:JSON Schema 的 object → Zod raw shape。 */
+export function jsonSchemaToZodShape(schema) {
+    if (!schema || typeof schema !== 'object')
+        return {};
+    return shapeOf(schema);
+}
+//# sourceMappingURL=jsonSchemaToZod.js.map

package/dist/seams/tools/jsonSchemaToZod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonSchemaToZod.js","sourceRoot":"","sources":["../../../src/seams/tools/jsonSchemaToZod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,IAA6B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC;YACE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAsB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,8CAA8C;IAC9C,wDAAwD;IACxD,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,CAAC,WAAW;YAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,OAAO,OAAO,CAAC,MAAwB,CAAC,CAAC;AAC3C,CAAC"}

package/dist/seams/webserver/index.d.ts

@@ -0,0 +1,92 @@
+/**
+ * @module        seams/webserver
+ * @description   **HTTP 路由 seam** —— 让插件往 console 的 HTTP 面注册自己的路由。
+ *
+ * @layer         seam
+ *
+ * 类型:**甲 · 工厂型**(进程里一个)。dsh 抽样里第二高频(22/77)。
+ *
+ * ⚠️ **方向别搞混**:插件自己 `fetch` 外部服务(出方向)不需要任何服务,
+ *    也拦不住 —— 插件本来就是进程内受信任代码。这里管的是**入方向**:
+ *    插件在**我们 console 的鉴权面**上开一条路由,那条路由天然带 `sps_token` cookie。
+ *
+ * 🔴 **护栏形状(Eddy 2026-08-21 拍板)——防意外,不防故意:**
+ * ```
+ * 默认      路由自动落 /plugins/<插件id>/*      零配置零摩擦
+ * 接管宿主  显式声明 takeover: true             允许(sps-cli 是用户自己的工具)
+ * 可见      listTakeovers() 供插件页展示        ← 关键在这一格
+ * ```
+ * 真正的失败模式不是恶意,是**遗忘**:半年后某个接口行为不对,
+ * 没人记得有插件接管了它,排查会一路查进宿主代码 —— 而宿主代码是对的。
+ * **能接管 ≠ 接管了却没人知道。**
+ *
+ * 🔴 **为什么是"可变路由表 + 一条 catch-all",而不是往 Hono 上加路由:**
+ *    Hono 注册后**删不掉**。而插件要能热卸载(停用/卸载当场下线)——
+ *    往 Hono 上加的话,停用之后那条路由还在,只是处理函数变成了幽灵。
+ */
+import { type Context, Service } from '@deepseek-ai/cordis';
+export declare const WEBSERVER = "sps.webserver";
+export type RouteKind = 'exact' | 'prefix';
+export interface WebRoute {
+    kind: RouteKind;
+    /** 相对路径。默认会被前缀成 `/plugins/<owner>/<path>`;`takeover` 时按原样。 */
+    path: string;
+    /**
+     * 原生 Node 处理函数 —— **与 dsh 的 `WebRoute.handler` 同形**,
+     * 这样 dsh 插件不用改。
+     */
+    handler: (req: unknown, res: unknown) => void | Promise<void>;
+    /**
+     * 接管宿主已有路径。**允许,但必须显式写出来**,而且会出现在插件页上。
+     */
+    takeover?: boolean;
+}
+interface Entry extends WebRoute {
+    owner: string;
+    /** 真正生效的绝对路径(前缀过的,或 takeover 的原样)。 */
+    full: string;
+}
+export declare class RouteConflictError extends Error {
+}
+/** 插件路由的默认前缀。 */
+export declare function pluginPrefix(owner: string): string;
+export default class WebServerSeam extends Service {
+    /** full path → entry。**可变表**,热卸载靠删这里的项。 */
+    private readonly routes;
+    constructor(ctx: Context);
+    /**
+     * 注册一条路由。`owner` = 插件 id,决定默认前缀,也是"谁接管了什么"的归属。
+     *
+     * 🔴 **重复路径抛冲突,不是后注册的静默赢** ——
+     *    静默赢会让两个插件里"没生效的那个"完全无法解释。
+     */
+    register(owner: string, route: WebRoute): () => void;
+    /**
+     * 找一条能处理该路径的路由。exact 优先于 prefix;prefix 里**最长的赢**
+     * (否则 `/a` 会抢走 `/a/b` 的请求,而后者显然更具体)。
+     */
+    match(path: string): Entry | undefined;
+    /**
+     * 谁接管了哪些宿主路径 —— **插件页要摆出来的就是它**。
+     * 这是整套护栏里最关键的一格:能接管不可怕,接管了没人知道才可怕。
+     */
+    listTakeovers(): {
+        owner: string;
+        path: string;
+        kind: RouteKind;
+    }[];
+    /** 全部路由(诊断用)。 */
+    list(): {
+        owner: string;
+        path: string;
+        kind: RouteKind;
+        takeover: boolean;
+    }[];
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        'sps.webserver': WebServerSeam;
+    }
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/seams/webserver/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/seams/webserver/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE5D,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,KAAM,SAAQ,QAAQ;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,iBAAiB;AACjB,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;gBAEvC,GAAG,EAAE,OAAO;IAIxB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,IAAI;IAiBpD;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAatC;;;OAGG;IACH,aAAa,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,EAAE;IAMnE,iBAAiB;IACjB,IAAI,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,EAAE;CAQ9E;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,aAAa,CAAC;KAChC;CACF"}

package/dist/seams/webserver/index.js

@@ -0,0 +1,100 @@
+/**
+ * @module        seams/webserver
+ * @description   **HTTP 路由 seam** —— 让插件往 console 的 HTTP 面注册自己的路由。
+ *
+ * @layer         seam
+ *
+ * 类型:**甲 · 工厂型**(进程里一个)。dsh 抽样里第二高频(22/77)。
+ *
+ * ⚠️ **方向别搞混**:插件自己 `fetch` 外部服务(出方向)不需要任何服务,
+ *    也拦不住 —— 插件本来就是进程内受信任代码。这里管的是**入方向**:
+ *    插件在**我们 console 的鉴权面**上开一条路由,那条路由天然带 `sps_token` cookie。
+ *
+ * 🔴 **护栏形状(Eddy 2026-08-21 拍板)——防意外,不防故意:**
+ * ```
+ * 默认      路由自动落 /plugins/<插件id>/*      零配置零摩擦
+ * 接管宿主  显式声明 takeover: true             允许(sps-cli 是用户自己的工具)
+ * 可见      listTakeovers() 供插件页展示        ← 关键在这一格
+ * ```
+ * 真正的失败模式不是恶意,是**遗忘**:半年后某个接口行为不对,
+ * 没人记得有插件接管了它,排查会一路查进宿主代码 —— 而宿主代码是对的。
+ * **能接管 ≠ 接管了却没人知道。**
+ *
+ * 🔴 **为什么是"可变路由表 + 一条 catch-all",而不是往 Hono 上加路由:**
+ *    Hono 注册后**删不掉**。而插件要能热卸载(停用/卸载当场下线)——
+ *    往 Hono 上加的话,停用之后那条路由还在,只是处理函数变成了幽灵。
+ */
+import { Service } from '@deepseek-ai/cordis';
+export const WEBSERVER = 'sps.webserver';
+export class RouteConflictError extends Error {
+}
+/** 插件路由的默认前缀。 */
+export function pluginPrefix(owner) {
+    return `/plugins/${owner}`;
+}
+export default class WebServerSeam extends Service {
+    /** full path → entry。**可变表**,热卸载靠删这里的项。 */
+    routes = new Map();
+    constructor(ctx) {
+        super(ctx, WEBSERVER);
+    }
+    /**
+     * 注册一条路由。`owner` = 插件 id,决定默认前缀,也是"谁接管了什么"的归属。
+     *
+     * 🔴 **重复路径抛冲突,不是后注册的静默赢** ——
+     *    静默赢会让两个插件里"没生效的那个"完全无法解释。
+     */
+    register(owner, route) {
+        const rel = route.path.startsWith('/') ? route.path : `/${route.path}`;
+        const full = route.takeover ? rel : `${pluginPrefix(owner)}${rel}`;
+        const key = `${route.kind}:${full}`;
+        const existing = this.routes.get(key);
+        if (existing) {
+            throw new RouteConflictError(`路由 ${full} 已被插件 ${existing.owner} 占用(${route.kind});同一路径不能注册两次`);
+        }
+        this.routes.set(key, { ...route, owner, full });
+        return () => {
+            const cur = this.routes.get(key);
+            if (cur && cur.owner === owner)
+                this.routes.delete(key);
+        };
+    }
+    /**
+     * 找一条能处理该路径的路由。exact 优先于 prefix;prefix 里**最长的赢**
+     * (否则 `/a` 会抢走 `/a/b` 的请求,而后者显然更具体)。
+     */
+    match(path) {
+        const exact = this.routes.get(`exact:${path}`);
+        if (exact)
+            return exact;
+        let best;
+        for (const e of this.routes.values()) {
+            if (e.kind !== 'prefix')
+                continue;
+            if (path === e.full || path.startsWith(`${e.full}/`)) {
+                if (!best || e.full.length > best.full.length)
+                    best = e;
+            }
+        }
+        return best;
+    }
+    /**
+     * 谁接管了哪些宿主路径 —— **插件页要摆出来的就是它**。
+     * 这是整套护栏里最关键的一格:能接管不可怕,接管了没人知道才可怕。
+     */
+    listTakeovers() {
+        return [...this.routes.values()]
+            .filter((e) => e.takeover)
+            .map((e) => ({ owner: e.owner, path: e.full, kind: e.kind }));
+    }
+    /** 全部路由(诊断用)。 */
+    list() {
+        return [...this.routes.values()].map((e) => ({
+            owner: e.owner,
+            path: e.full,
+            kind: e.kind,
+            takeover: e.takeover === true,
+        }));
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/seams/webserver/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/seams/webserver/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAgB,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAyBzC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,iBAAiB;AACjB,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,YAAY,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,2CAA2C;IAC1B,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEnD,YAAY,GAAY;QACtB,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,KAAa,EAAE,KAAe;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAC1B,MAAM,IAAI,SAAS,QAAQ,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,cAAc,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,GAAG,EAAE;YACV,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAY;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAuB,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAClC,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,IAAI,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,iBAAiB;IACjB,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coralai/sps-cli",
-  "version": "0.68.0",
+  "version": "0.69.1",
   "description": "SPS CLI — AI-driven development pipeline orchestrator",
   "type": "module",
   "main": "dist/main.js",