@dnalec/dsh-auto-approve 0.1.3 → 0.2.1

package/src/index.mjs

@@ -1,11 +1,11 @@
 /**
  * dsh-auto-approve — Host 半。
  *
- * 职责：在 `approval/request` 瀑布上做自动审批门控；人工请求同时走网页框和 QQ。
- * 不注入 agent 会话；QQ 入站只进票据经纪。
- *
+ * 职责：在 `approval/request` 瀑布上做自动审批门控。
+ * 允许 / 拒绝直接返回 outcome；转人工则 `await next()` 交给原网页审批框。
+ * 不改 req，不 abort req.signal，不平行结算。
  * 管道（仅当会话预设为「自动审批」）：
- *   1. 关键词：拒绝 > 人工 > 允许（只匹配工具名 + command + 路径）
+ *   1. 关键词：拒绝 > 人工 > 允许（只匹配工具名 + command + 路径 + workdir）
  *   2. 审核表：模型只输出类别 id，程序按表执行允许 / 拒绝 / 人工
  * 缺工具参数、解析失败、超时、插件异常 → 转人工，禁止在空卡片上自动放行。
  *
@@ -17,17 +17,14 @@
 import {
   NAME,
   pathsFor,
+  resolveProfilePatchPath,
   tryLoadJson,
   saveJson,
-  saveSecretJson,
   audit as appendAudit,
   readEventsSince,
   maxEventId,
   appendEvent,
-  maskSecret,
   ensureDir,
-  forkAbortSignal,
-  replaceRequestSignal,
 } from './util.mjs'
 import {
   DEFAULT_DENY_KEYWORDS,
@@ -37,15 +34,19 @@ import {
   normalizeJudgePromptLang,
   normalizeAllowlist,
   mergePluginConfig,
+  pickMigratablePluginConfig,
   parseReason,
   matchKeywordBuckets,
   buildJudgePrompt,
+  resolveJudgePromptTemplate,
+  shippedJudgePromptTemplate,
   parseJudgeClassify,
   pickToolArgs,
   toolArgsTruncated,
   clipToolArgsForEvent,
   formatKeywordHay,
   formatAllowKeywordHay,
+  formatPathKeywordHay,
   formatJudgeCard,
   hasToolPayload,
   rememberCachedCall,
@@ -54,18 +55,40 @@ import {
   cloneAllowlist,
   copyAllowlistInto,
   mutateAllowlistOp,
+  fail,
   effectiveJudgeTimeoutMs,
+  judgeMaxTokens,
 } from './rules.mjs'
-import { getSetupState, migratePresetCopy, setAutoApproveSandbox } from './preset-patch.mjs'
-import { createTicketBroker, parseApprovalReply, isBindConfirmText, formatPendingList, formatApprovalPush, formatApprovalKeyboard, formatOutcomeLabel } from './tickets.mjs'
-import { createQQBot } from './qqbot.mjs'
-import { startQqProvisioning } from './provisioning.mjs'
+import { dirname } from 'node:path'
+import {
+  getSetupState,
+  migratePresetCopy,
+  presetDrift,
+  readBasePresetKeys,
+  setAutoApproveSandbox,
+} from './preset-patch.mjs'
 
 export const name = NAME
-/** webServer 本身不用，只为等 web 起来再注册 RPC。 */
-export const inject = ['approval', 'permissionPresets', 'llm', 'timer', 'webServer']
+/**
+ * 只列门控真正需要的服务。**不要**放 `webServer`：cordis 把插件 `inject` 当必需服务，
+ * 缺一个就停在 PENDING、apply 完全不执行（`vendor/cordis/src/fiber.ts`），
+ * 而 `webserver` 行只在 web-app bundle 里 —— headless / acp / sdk 组合下会连审批门控一起失踪。
+ * RPC 侧自己用 `ctx.inject(['connection'], …)`，`connection.fetch.register` 不需要 webServer。
+ */
+export const inject = ['approval', 'permissionPresets', 'llm', 'timer']
+
+/** Host Session 的工作目录在 header.cwd，没有 session.cwd。 */
+export function readSessionCwd(session) {
+  const cwd = session && session.header && typeof session.header.cwd === 'string' ? session.header.cwd : ''
+  return cwd
+}
 
-/** 设置页 rule-op：改草稿再写盘，失败不碰内存中的活对象。`other` 不能删。 */
+/** Connection RPC 失败必须带 message，否则 client parseConnectionResponse 会 TypeError。 */
+export function rpcFail(code, details) {
+  const c = String(code || 'err.internal')
+  const d = details && typeof details === 'object' && !Array.isArray(details) ? details : {}
+  return { ok: false, error: { code: c, message: c, details: d } }
+}
 
 /**
  * 插件入口。热更新规则文件；权限预设写入 profile patch 后需重启才进会话下拉。
@@ -74,8 +97,9 @@ export const inject = ['approval', 'permissionPresets', 'llm', 'timer', 'webServ
  */
 export function apply(ctx, rawConfig = {}) {
   const paths = pathsFor()
+  // 真实 profile 目录从 ctx.baseUrl 推导；拿不到才回落到 profiles/web。
+  paths.profilePatch = resolveProfilePatchPath(ctx, rawConfig, paths.profilePatch)
   ensureDir(paths.auto)
-  ensureDir(paths.bridge)
   migratePresetCopy(paths.profilePatch)
 
   // 损坏的 allowlist 只用内存默认，绝不写盘，避免把用户规则清掉。
@@ -93,12 +117,21 @@ export function apply(ctx, rawConfig = {}) {
   const loadedPlugin = tryLoadJson(paths.pluginConfig)
   let pluginCfgCorrupt = false
   let pluginCfg
+  let migratedPlugin = false
   if (!loadedPlugin.ok) {
     console.error(`[${NAME}] 插件配置无法读取，本进程用默认且不覆盖磁盘`, loadedPlugin.error)
     pluginCfgCorrupt = true
     pluginCfg = mergePluginConfig(rawConfig, null)
+  } else if (loadedPlugin.missing) {
+    const legacy = tryLoadJson(paths.legacyPluginConfig)
+    const picked = (legacy.ok && !legacy.missing) ? pickMigratablePluginConfig(legacy.value) : null
+    pluginCfg = mergePluginConfig(rawConfig, picked)
+    if (picked && saveJson(paths.pluginConfig, pluginCfg)) {
+      migratedPlugin = true
+      console.log(`[${NAME}] 已从 approval-bridge/config.json 迁移判定配置到 auto-approve/config.json`)
+    }
   } else {
-    pluginCfg = mergePluginConfig(rawConfig, loadedPlugin.missing ? null : loadedPlugin.value)
+    pluginCfg = mergePluginConfig(rawConfig, loadedPlugin.value)
   }
   if (loadedAllowlist.ok && loadedAllowlist.missing && Number(pluginCfg.judge.timeoutMs) > 0) {
     allowlist.judgeTimeoutMs = Number(pluginCfg.judge.timeoutMs)
@@ -109,14 +142,34 @@ export function apply(ctx, rawConfig = {}) {
   if (loadedAllowlist.ok && (loadedAllowlist.missing || diskVersion < allowlist.version)) {
     saveJson(paths.allowlist, allowlist)
   }
-  const presetSetup = setAutoApproveSandbox(paths.profilePatch, pluginCfg.presetSandbox)
-  if (presetSetup.ok && presetSetup.needRestart) {
-    console.log(`[${NAME}] 已写入 auto-approve 权限预设（sandbox=${pluginCfg.presetSandbox}）；live patch 重载后会话权限会出现「自动审批」`)
-  } else if (!presetSetup.ok) {
-    console.error(`[${NAME}] 写入 auto-approve 预设失败`, presetSetup.error)
+  // 损坏配置不写沙箱。缺失配置若 patch 里已有 auto-approve，也不用默认 workspace-write 去加宽。
+  if (!pluginCfgCorrupt) {
+    const already = getSetupState(paths.profilePatch).configured
+    const writeSandbox = (loadedPlugin.ok && !loadedPlugin.missing) || migratedPlugin || !already
+    if (writeSandbox) {
+      const presetSetup = setAutoApproveSandbox(paths.profilePatch, pluginCfg.presetSandbox)
+      if (presetSetup.ok && presetSetup.needRestart) {
+        console.log(`[${NAME}] 已写入 auto-approve 权限预设（sandbox=${pluginCfg.presetSandbox}）；live patch 重载后会话权限会出现「自动审批」`)
+      } else if (!presetSetup.ok) {
+        console.error(
+          `[${NAME}] 写入 auto-approve 预设失败（${presetSetup.code || presetSetup.error || 'err.preset'}）：${paths.profilePatch}`,
+          presetSetup.details || '',
+        )
+      }
+    }
+  }
+  {
+    // 出厂预设表比本 profile 那份新：只警告，不自动改写用户文件（patch 里 config 是整块替换）。
+    const drift = presetSetupState().drift
+    if (drift.baseKnown && drift.missing.length) {
+      console.warn(
+        `[${NAME}] DSH 出厂权限预设表多了 ${drift.missing.join(', ')}，`
+        + `但 profile 的 permission 行是本插件写入的副本（patch 整块替换 config），不会自动包含；`
+        + `请更新插件或手工合并 ${paths.profilePatch}`,
+      )
+    }
   }
   let eventSeq = maxEventId(paths.events)
-  const tickets = createTicketBroker()
   let rpcTail = Promise.resolve()
   function enqueueRpc(fn) {
     const run = rpcTail.then(fn, fn)
@@ -129,14 +182,24 @@ export function apply(ctx, rawConfig = {}) {
    * key 为 sessionId:callId，避免多会话共用 call-0 互相覆盖。
    */
   const pendingCalls = new Map()
-  /** @type {{ chatId: string, userId: string, username?: string, isGroup: boolean, ts: string, preview: string }[]} */
-  const recentChats = []
-  let qq = null
-  let bindHintAt = 0
-
   const log = (line) => console.log(`[${NAME}] ${line}`)
   const audit = (line) => appendAudit(paths.audit, line)
 
+  /**
+   * setup 状态 + 预设表漂移。
+   * 插件写进 profile patch 的 `permission` 行会整块替换 base 的 config（patch 语义不做深合并），
+   * 所以 DSH 出厂表新增预设时本 profile 不会有：读 base 的 patch 比一比，只提示、不自动改写。
+   */
+  function presetSetupState() {
+    const setup = getSetupState(paths.profilePatch)
+    const base = readBasePresetKeys(dirname(paths.profilePatch))
+    if (!base.ok) return { ...setup, drift: { baseKnown: false, missing: [], extra: [] } }
+    return { ...setup, drift: { baseKnown: true, baseKeys: base.keys, ...presetDrift(base.keys, setup.presets) } }
+  }
+  const llm = ctx.llm
+  const permissionPresets = ctx.permissionPresets
+  const agentDefaultModel = ctx.get('agentDefaultModel')
+
   function reloadAllowlist() {
     const loaded = tryLoadJson(paths.allowlist)
     if (!loaded.ok) {
@@ -170,12 +233,12 @@ export function apply(ctx, rawConfig = {}) {
 
   function applyRuleOp(op, kind, value) {
     if (allowlistCorrupt && op !== 'reset') {
-      return { ok: false, error: '规则文件损坏，拒绝覆盖。请先「恢复默认」写回出厂规则，或修好磁盘上的 allowlist.json' }
+      return fail('err.allowlistCorrupt')
     }
     const draft = cloneAllowlist(allowlist)
     const result = mutateAllowlistOp(draft, op, kind, value)
     if (!result.ok) return result
-    if (!saveJson(paths.allowlist, draft)) return { ok: false, error: '写入 allowlist 失败' }
+    if (!saveJson(paths.allowlist, draft)) return fail('err.allowlistWrite')
     copyAllowlistInto(allowlist, draft)
     allowlistCorrupt = false
     if (result.auditLine) audit(result.auditLine)
@@ -202,6 +265,10 @@ export function apply(ctx, rawConfig = {}) {
     put('reason', 600)
     put('raw', 800)
     put('error', 400)
+    put('errorCode', 80)
+    put('errorMs', 20)
+    put('errorDetail', 400)
+    put('errorEffort', 40)
     put('failed', 0, true)
     put('timedOut', 0, true)
     return Object.keys(out).length ? out : undefined
@@ -224,7 +291,6 @@ export function apply(ctx, rawConfig = {}) {
     if (o.category) ev.category = o.category
     if (o.judgeReason) ev.judgeReason = String(o.judgeReason).slice(0, 600)
     if (o.path) ev.path = o.path
-    if (o.ticket !== undefined) ev.ticket = o.ticket
     if (o.source) ev.source = o.source
     if (o.cwd) ev.cwd = String(o.cwd).slice(0, 400)
     if (o.keyword) ev.keyword = String(o.keyword).slice(0, 120)
@@ -240,260 +306,28 @@ export function apply(ctx, rawConfig = {}) {
     return ev
   }
 
-  let qqbotCorrupt = false
-  function loadQqCreds() {
-    const loaded = tryLoadJson(paths.qqbot)
-    if (!loaded.ok) {
-      qqbotCorrupt = true
-      return { appId: '', appSecret: '', ownerUserOpenid: '' }
-    }
-    qqbotCorrupt = false
-    const data = loaded.value || {}
-    return {
-      appId: String(data.appId || ''),
-      appSecret: String(data.appSecret || ''),
-      ownerUserOpenid: String(data.ownerUserOpenid || ''),
-    }
-  }
-
-  function persistQqCreds(next) {
-    saveSecretJson(paths.qqbot, next)
-    qqbotCorrupt = false
-  }
-
-  function rememberChat(msg) {
-    const preview = String(msg.text || '').slice(0, 80)
-    const ts = new Date().toISOString()
-    const idx = recentChats.findIndex((c) => c.chatId === msg.chatId && c.userId === msg.userId)
-    const row = {
-      chatId: msg.chatId,
-      userId: msg.userId,
-      username: msg.username,
-      isGroup: Boolean(msg.isGroup),
-      ts,
-      preview,
-    }
-    if (idx >= 0) recentChats.splice(idx, 1)
-    recentChats.unshift(row)
-    if (recentChats.length > 20) recentChats.length = 20
-  }
-
-  async function qqSend(chatId, text, extra) {
-    if (!qq || !chatId) return false
-    try {
-      await qq.send(chatId, text, extra)
-      return true
-    } catch (error) {
-      console.error(`[${NAME}] QQ 发送失败`, error)
-      return false
-    }
-  }
-
-  function inboundAllowed(msg) {
-    reloadPluginCfg()
-    const { chatId, userId } = pluginCfg.notify
-    if (!chatId) return { kind: 'unbound' }
-    if (msg.chatId !== chatId) return { kind: 'ignore' }
-    if (String(chatId).startsWith('g:')) {
-      if (!userId || msg.userId !== userId) return { kind: 'ignore' }
-    }
-    return { kind: 'ok' }
-  }
-
-  async function handleInbound(msg) {
-    rememberChat(msg)
-    const gate = inboundAllowed(msg)
-    if (gate.kind === 'ignore') return
-
-    if (gate.kind === 'unbound') {
-      // 私人 bot：未绑定 chatId 时，任意 C2C「是」绑定该聊天。文档已标明。
-      if (msg.isGroup) return
-      const yes = isBindConfirmText(msg.text)
-      if (yes) {
-        pluginCfg.notify.chatId = msg.chatId
-        if (!persistPluginCfg()) {
-          await qqSend(msg.chatId, '绑定失败：无法写入配置文件。')
-          return
-        }
-        await qqSend(msg.chatId, '已将本聊天设为审批通知目标。之后人工审批会推到这里。')
-        audit(`QQBIND  chatId=${msg.chatId}`)
-        return
-      }
-      const now = Date.now()
-      if (now - bindHintAt > 60_000) {
-        bindHintAt = now
-        await qqSend(msg.chatId, '是否将本聊天用作审批通知？回复「是」确认。')
-      }
-      return
-    }
-
-    const parsed = parseApprovalReply(msg.text, tickets.pendingCount())
-    if (!parsed) return
-
-    const reply = async (text) => { await qqSend(msg.chatId, text) }
-
-    if (parsed.kind === 'need-number') {
-      await reply('有多条待处理审批，请带短号。' + formatPendingList(tickets.listPending()))
-      return
-    }
-
-    let n = parsed.n
-    if (parsed.kind === 'allow-bare' || parsed.kind === 'reject-bare') {
-      const sole = tickets.solePending()
-      if (!sole) {
-        await reply('当前没有待处理审批')
-        return
-      }
-      n = sole.n
-    }
-
-    const recent = tickets.recentOutcome(n)
-    if (recent) {
-      await reply(`#${n} 已处理`)
-      return
-    }
-    const ticket = tickets.get(n)
-    if (!ticket) {
-      await reply(`没有待处理的 #${n}，${formatPendingList(tickets.listPending())}`)
-      return
-    }
-
-    const allow = parsed.kind === 'allow' || parsed.kind === 'allow-bare'
-    const ok = tickets.answer(n, {
-      outcome: allow ? 'allowed-once' : 'rejected',
-    })
-    if (!ok) await reply(`没有待处理的 #${n}`)
-  }
-
-  let qqGen = 0
-  /** @type {{ controller: AbortController, handle?: { cancel: () => void }, status: string, qrDataUrl: string, expiresAt: number, error: string } | null} */
-  let provisionAttempt = null
-
-  function provisionSnapshot() {
-    const a = provisionAttempt
-    if (!a) return { status: '', qrDataUrl: '', expiresAt: 0, error: '' }
-    return {
-      status: a.status || '',
-      qrDataUrl: a.qrDataUrl || '',
-      expiresAt: a.expiresAt || 0,
-      error: a.error || '',
-    }
-  }
-
-  async function cancelProvisioning() {
-    const attempt = provisionAttempt
-    provisionAttempt = null
-    if (!attempt) return
-    try { attempt.controller.abort() } catch { /* ignore */ }
-    try { await Promise.resolve(attempt.handle && attempt.handle.cancel()) } catch { /* ignore */ }
-  }
-
-  async function startProvisioning() {
-    await cancelProvisioning()
-    const controller = new AbortController()
-    const attempt = {
-      controller,
-      status: '登录中',
-      qrDataUrl: '',
-      expiresAt: 0,
-      error: '',
-    }
-    provisionAttempt = attempt
+  function emitDecision(leaf) {
     try {
-      const handle = await startQqProvisioning({
-        onQr(qr) {
-          if (provisionAttempt !== attempt) return
-          attempt.qrDataUrl = qr.dataUrl
-          attempt.expiresAt = qr.expiresAt
-          attempt.status = '等待扫码'
-        },
-        onStatus(status) {
-          if (provisionAttempt === attempt) attempt.status = status
-        },
-        async onCredentials(credentials) {
-          if (provisionAttempt !== attempt) return
-          attempt.status = '保存凭据'
-          const appId = String(credentials.appId || '')
-          const appSecret = String(credentials.appSecret || '')
-          const owner = String(credentials.ownerUserOpenid || '')
-          const prev = loadQqCreds()
-          persistQqCreds({
-            appId,
-            appSecret,
-            ownerUserOpenid: owner || prev.ownerUserOpenid || '',
-          })
-          reloadPluginCfg()
-          if (owner && !pluginCfg.notify.chatId) {
-            pluginCfg.notify.chatId = owner
-            persistPluginCfg()
-            audit(`QQBIND  chatId=${owner} (扫码者)`)
-          }
-          audit('CONFIG  qqbot 扫码凭据已保存并重连')
-          await startQq()
-          if (provisionAttempt !== attempt) return
-          attempt.status = '已连接'
-          attempt.qrDataUrl = ''
-          attempt.expiresAt = 0
-        },
-        onFailure(error) {
-          if (provisionAttempt !== attempt) return
-          const aborted = controller.signal.aborted
-          const detail = error instanceof Error ? error.message : String(error)
-          log(`扫码失败: ${detail}`)
-          attempt.status = aborted ? '已取消' : '扫码失败'
-          attempt.error = aborted ? '' : '平台扫码服务暂时不可用或二维码已过期，请重新扫码。'
-        },
-      }, controller.signal)
-      if (provisionAttempt === attempt) attempt.handle = handle
-      return { ok: true }
+      ctx.emit('auto-approve/decision', leaf)
     } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error)
-      log(`扫码启动失败: ${detail}`)
-      const missing = /未安装|ERR_MODULE_NOT_FOUND|Cannot find/i.test(detail)
-      const message = missing
-        ? '未安装扫码依赖。请在插件目录执行 npm install 后重试。'
-        : '无法启动扫码流程，请检查网络后重试。'
-      if (provisionAttempt === attempt) {
-        attempt.status = '扫码启动失败'
-        attempt.error = message
-      }
-      return { ok: false, error: message }
+      console.error(`[${NAME}] auto-approve/decision 失败`, error)
     }
   }
 
-  async function startQq() {
-    const gen = ++qqGen
-    const prev = qq
-    qq = null
-    if (prev) {
-      try { await prev.stop() } catch (error) {
-        console.error(`[${NAME}] 停止旧 QQ 连接失败`, error)
-      }
-    }
-    if (gen !== qqGen) return
-    const creds = loadQqCreds()
-    const bot = createQQBot(creds, log)
-    bot.setMessageHandler((m) => { void handleInbound(m).catch((e) => console.error(`[${NAME}] inbound`, e)) })
-    if (gen !== qqGen) {
-      try { await bot.stop() } catch { /* superseded */ }
-      return
-    }
-    qq = bot
-    if (creds.appId && creds.appSecret) void bot.start()
+  function decisionLeaf(info, extra) {
+    const e = extra || {}
+    const leaf = {
+      sessionId: String(info.sessionId || ''),
+      tool: String(info.toolName || ''),
+      path: String(e.path || info.path || ''),
+      verdict: String(e.verdict || ''),
+    }
+    if (e.outcome) leaf.outcome = String(e.outcome)
+    if (e.category || info.category) leaf.category = String(e.category || info.category || '')
+    if (e.judgeReason || info.judgeReason) leaf.judgeReason = String(e.judgeReason || info.judgeReason || '').slice(0, 600)
+    return leaf
   }
 
-  void startQq()
-  ctx.effect(() => () => {
-    qqGen += 1
-    tickets.dispose()
-    void cancelProvisioning()
-    void qq?.stop()
-  })
-
-  const llm = ctx.llm
-  const permissionPresets = ctx.permissionPresets
-  const agentDefaultModel = ctx.get('agentDefaultModel')
-
   function fallbackSelection() {
     try {
       const sel = agentDefaultModel && typeof agentDefaultModel.currentSelection === 'function'
@@ -518,7 +352,7 @@ export function apply(ctx, rawConfig = {}) {
   async function resolveJudgeRoute() {
     const route = configuredRoute()
     if (!route.provider || !route.model) {
-      return { ok: false, error: '未配置审核模型', ...route }
+      return { ok: false, code: 'err.judgeUnconfigured', ...route }
     }
     try {
       const info = await llm.resolveModelInfo(route.provider, route.model)
@@ -526,20 +360,20 @@ export function apply(ctx, rawConfig = {}) {
         ? info.reasoning.efforts.map((e) => e.id)
         : []
       if (route.reasoningEffort && efforts.length > 0 && !efforts.includes(route.reasoningEffort)) {
-        return { ok: false, error: `reasoningEffort ${route.reasoningEffort} 不受支持`, ...route }
+        return { ok: false, code: 'err.judgeEffort', details: { effort: route.reasoningEffort }, ...route }
       }
       return { ok: true, ...route, info }
     } catch (error) {
-      return { ok: false, error: String((error && error.message) || error), ...route }
+      return { ok: false, code: 'err.judgeUpstream', details: { error: String((error && error.message) || error) }, ...route }
     }
   }
 
   /**
-   * 调用审核模型。不要传 messages.system：newapi 会映射成 developer 角色导致 400。
-   * 分类提示全部折进 user 文本。
+   * 调用审核模型。不要传 messages.system：部分 OpenAI 兼容网关会把 system 映射成 developer 导致 400。
+   * 分类提示全部折进 user 文本。带推理档位时输出预算要留出推理 token，否则空文本会被当成解析失败。
    */
   async function callJudge(userText, signal, route, system) {
-    const prompt = system || buildJudgePrompt(allowlist.criteria, pluginCfg.judgePromptLang)
+    const prompt = system || buildJudgePrompt(allowlist.criteria, pluginCfg.judgePromptLang, resolveJudgePromptTemplate(pluginCfg, pluginCfg.judgePromptLang))
     const opts = {
       provider: route.provider,
       model: route.model,
@@ -548,7 +382,7 @@ export function apply(ctx, rawConfig = {}) {
         content: [{ type: 'text', text: prompt + '\n\n' + userText }],
       }],
       temperature: 0,
-      maxTokens: 256,
+      maxTokens: judgeMaxTokens(route.reasoningEffort),
       signal,
     }
     if (route.reasoningEffort) opts.reasoningEffort = route.reasoningEffort
@@ -557,7 +391,10 @@ export function apply(ctx, rawConfig = {}) {
       if (chunk.type === 'text-delta') text += chunk.text
       else if (chunk.type === 'finish' && (chunk.reason.kind === 'error' || chunk.reason.kind === 'aborted')) {
         const failure = chunk.reason.failure && chunk.reason.failure.message ? chunk.reason.failure.message : chunk.reason.kind
-        throw new Error('审核模型调用失败: ' + failure)
+        const err = new Error('err.judgeCall')
+        err.code = 'err.judgeCall'
+        err.details = { error: String(failure) }
+        throw err
       }
     }
     return text
@@ -567,7 +404,7 @@ export function apply(ctx, rawConfig = {}) {
     const criteria = allowlist.criteria || DEFAULT_CRITERIA
     const lang = normalizeJudgePromptLang(pluginCfg.judgePromptLang)
     const user = formatJudgeCard(toolName, mode, justification, args, cwd, lang)
-    const text = await callJudge(user, signal, route, buildJudgePrompt(criteria, lang))
+    const text = await callJudge(user, signal, route, buildJudgePrompt(criteria, lang, resolveJudgePromptTemplate(pluginCfg, lang)))
     try {
       return { ...parseJudgeClassify(text, criteria), raw: String(text || '').slice(0, 800) }
     } catch (error) {
@@ -576,10 +413,24 @@ export function apply(ctx, rawConfig = {}) {
     }
   }
 
-  async function withRetry(runFn, label, timeoutMs) {
+  /**
+   * 单次判定 + 超时 + 重试。
+   * `outerSignal` 是审批请求自己的取消信号：请求被取消后不该继续烧模型调用。
+   * 注意**不要**去 abort `req.signal`，这里只观察它。
+   */
+  async function withRetry(runFn, label, timeoutMs, outerSignal) {
+    const cancelled = () => Boolean(outerSignal && outerSignal.aborted)
     const runOnce = async () => {
+      if (cancelled()) return { aborted: true }
       const controller = new AbortController()
       let cancelTimer
+      const onOuterAbort = () => controller.abort(`${NAME}: ${label} 请求已取消`)
+      const linkable = outerSignal && typeof outerSignal.addEventListener === 'function'
+      if (linkable) {
+        outerSignal.addEventListener('abort', onOuterAbort, { once: true })
+        // 竞态窗口：cancelled() 之后、addEventListener 之前就 abort 了，事件不会再触发。
+        if (outerSignal.aborted) onOuterAbort()
+      }
       const timed = new Promise((resolve) => {
         cancelTimer = ctx.timeout(() => resolve({ timedOut: true }), timeoutMs)
       })
@@ -588,40 +439,56 @@ export function apply(ctx, rawConfig = {}) {
           .then((r) => ({ ...r, timedOut: false }))
           .catch((error) => ({ judgeError: error }))
         const result = await Promise.race([call, timed])
+        if (cancelled()) return { aborted: true }
         if (result.judgeError) throw result.judgeError
         return result
       } finally {
         if (typeof cancelTimer === 'function') {
           try { cancelTimer() } catch { /* disposer */ }
         }
+        if (linkable && typeof outerSignal.removeEventListener === 'function') {
+          outerSignal.removeEventListener('abort', onOuterAbort)
+        }
         controller.abort(`${NAME}: ${label} 结束`)
       }
     }
     let last = { failed: true }
     try {
       const first = await runOnce()
+      if (first.aborted) return first
       if (!first.timedOut) return first
-      last = { failed: true, timedOut: true, error: `超时(${timeoutMs}ms)` }
+      last = { failed: true, timedOut: true, errorCode: 'err.judgeTimeout', error: 'err.judgeTimeout', errorMs: String(timeoutMs) }
       console.warn(`[${NAME}] ${label} 超时(${timeoutMs}ms)，转人工`)
       return last
     } catch (error) {
       last = {
         failed: true,
-        error: String((error && error.message) || error),
+        errorCode: error && error.code ? error.code : 'err.judgeFailed',
+        error: error && error.code ? error.code : 'err.judgeFailed',
+        errorDetail: error && error.details && error.details.error ? String(error.details.error) : '',
         raw: error && error.raw ? String(error.raw).slice(0, 800) : '',
       }
+      const code = error && error.code
+      if (code === 'err.judgeParse' || code === 'err.judgeEmpty') {
+        console.error(`[${NAME}] ${label} 输出无法解析，转人工`, error)
+        return last
+      }
       console.error(`[${NAME}] ${label} 异常，重试 1 次`, error)
     }
     try {
       const second = await runOnce()
+      if (second.aborted) return second
       if (!second.timedOut) return second
-      last = { failed: true, timedOut: true, error: `重试超时(${timeoutMs}ms)` }
+      last = { failed: true, timedOut: true, errorCode: 'err.judgeRetryTimeout', error: 'err.judgeRetryTimeout', errorMs: String(timeoutMs) }
       console.warn(`[${NAME}] ${label} 重试超时(${timeoutMs}ms)`)
       return last
     } catch (error) {
       last = {
         failed: true,
-        error: String((error && error.message) || error),
+        errorCode: error && error.code ? error.code : 'err.judgeFailed',
+        error: error && error.code ? error.code : 'err.judgeFailed',
+        errorDetail: error && error.details && error.details.error ? String(error.details.error) : '',
+        errorMs: last.errorMs,
         raw: error && error.raw ? String(error.raw).slice(0, 800) : last.raw,
       }
       console.error(`[${NAME}] ${label} 重试仍异常`, error)
@@ -629,7 +496,7 @@ export function apply(ctx, rawConfig = {}) {
     }
   }
 
-  async function judgeOperation(toolName, mode, justification, args, cwd) {
+  async function judgeOperation(toolName, mode, justification, args, cwd, requestSignal) {
     const route = await resolveJudgeRoute()
     const meta = {
       provider: route.provider || '',
@@ -637,15 +504,19 @@ export function apply(ctx, rawConfig = {}) {
       effort: route.reasoningEffort || '',
     }
     if (!route.ok) {
-      audit(`FAILED  judge route: ${route.error}`)
-      return { action: 'human', criterion: 'other', reason: '', failed: true, error: route.error, ...meta }
+      audit(`FAILED  judge route: ${route.code || route.error || ''}`)
+      return { action: 'human', criterion: 'other', reason: '', failed: true, errorCode: route.code || 'err.judgeUnconfigured', error: route.code || 'err.judgeUnconfigured', errorDetail: route.details && route.details.error ? String(route.details.error) : '', errorEffort: route.details && route.details.effort ? String(route.details.effort) : '', ...meta }
     }
     const timeoutMs = effectiveJudgeTimeoutMs(allowlist, pluginCfg)
     const result = await withRetry(
       (signal) => judgeOnce(toolName, mode, justification, args, signal, route, cwd),
       '审核模型',
       timeoutMs,
+      requestSignal,
     )
+    if (result.aborted) {
+      return { aborted: true, criterion: 'other', reason: '', ...meta }
+    }
     if (result.failed) {
       return {
         action: 'human',
@@ -653,7 +524,10 @@ export function apply(ctx, rawConfig = {}) {
         reason: '',
         failed: true,
         timedOut: Boolean(result.timedOut),
-        error: result.error || '审核失败',
+        errorCode: result.errorCode || result.error || 'err.judgeFailed',
+        error: result.errorCode || result.error || 'err.judgeFailed',
+        errorMs: result.errorMs || '',
+        errorDetail: result.errorDetail || '',
         raw: result.raw || '',
         ...meta,
       }
@@ -662,12 +536,10 @@ export function apply(ctx, rawConfig = {}) {
     return { ...result, action: row.action, label: row.label, ...meta }
   }
 
-  async function applyHumanOutcome(ctxInfo, outcome, extra) {
-    const { sessionId, toolName, mode, reason, justification, category, path, ticket, args, cwd, judgeReason, judge } = ctxInfo
-    const source = (extra && extra.source) || 'web'
-    audit(`OUTCOME ${toolName} outcome=${outcome} source=${source} ticket=${ticket || '-'} | ${reason.slice(0, 80)}`)
-    const detail = { category, path, ticket, source, args, cwd, judgeReason, judge }
-
+  function applyHumanOutcome(ctxInfo, outcome) {
+    const { sessionId, toolName, mode, reason, justification, category, path, args, cwd, judgeReason, judge } = ctxInfo
+    audit(`OUTCOME ${toolName} outcome=${outcome} source=web | ${reason.slice(0, 80)}`)
+    const detail = { category, path, source: 'web', args, cwd, judgeReason, judge }
     if (outcome === 'allowed-once') {
       recordEvent(sessionId, toolName, mode, reason, justification, 'manual-approved', {
         kind: 'manual-approved', ...detail,
@@ -685,108 +557,38 @@ export function apply(ctx, rawConfig = {}) {
   }
 
   /**
-   * 网页 next() 与 QQ 票据竞速，谁先答谁赢。
-   * 120s 只是 QQ 提醒，不是全局超时；网页框一直等到有人答或会话取消。
+   * 转人工：记 pending，再把同一条请求交给瀑布里的下一个 answerer（网页框）。
+   * 必须 await next() 并把 outcome 原样返回，观察者才能看到人工结果。
    */
-  async function forwardToHuman(info, next, req) {
-    reloadPluginCfg()
-    const ticket = tickets.allocate(info)
+  async function forwardToHuman(info, next) {
     recordEvent(info.sessionId, info.toolName, info.mode, info.reason, info.justification, 'manual-pending', {
       kind: 'manual-pending',
       category: info.category || '',
       path: info.path,
-      ticket: ticket.n,
       args: info.args,
       cwd: info.cwd,
       judgeReason: info.judgeReason,
       judge: info.judge,
     })
-
-    const notify = pluginCfg.notify
-    const timeoutSecs = Number(notify.timeoutSecs) > 0 ? Number(notify.timeoutSecs) : 120
-    let pushed = false
-    if (notify.enabled && qq && qq.connected() && notify.chatId) {
-      const ok = await qqSend(notify.chatId, formatApprovalPush(ticket, timeoutSecs), {
-        keyboard: formatApprovalKeyboard(
-          ticket.n,
-          String(notify.chatId).startsWith('g:') ? notify.userId : '',
-        ),
-      })
-      if (ok) {
-        pushed = true
-        audit(`PUSH    #${ticket.n} chat=${notify.chatId} ${info.toolName}`)
-      } else {
-        audit(`PUSH_FAIL #${ticket.n} ${info.toolName}`)
-      }
-    } else {
-      audit(`PUSH_SKIP #${ticket.n} enabled=${notify.enabled} connected=${Boolean(qq && qq.connected())} chat=${notify.chatId || ''} ${info.toolName}`)
-    }
-
-    const onAbort = () => {
-      const live = tickets.get(ticket.n)
-      if (!live || live.settled) return
-      tickets.discard(ticket.n, 'abort')
-      if (pushed) void qqSend(notify.chatId, `#${ticket.n} 已取消`)
-    }
-    const requestSignal = req.signal
-    // 网页框听这个 fork：QQ 先答时 abort 它即可关框，不能 abort 原始 req.signal（整单会 cancelled）。
-    const webSignal = forkAbortSignal(requestSignal)
-    replaceRequestSignal(req, webSignal.signal)
-    if (requestSignal) {
-      if (requestSignal.aborted) {
-        onAbort()
-        webSignal.abort()
-        await applyHumanOutcome({ ...info, ticket: ticket.n }, 'cancelled', { source: 'abort' })
-        return 'cancelled'
-      }
-      requestSignal.addEventListener('abort', onAbort, { once: true })
-    }
-
-    let timeoutHandle
-    if (pushed) {
-      timeoutHandle = ctx.timeout(() => {
-        if (ticket.settled) return
-        void qqSend(notify.chatId, `#${ticket.n} 请在网页继续`)
-      }, timeoutSecs * 1000)
-    }
-
+    emitDecision(decisionLeaf(info, { verdict: 'human', path: info.path }))
     try {
-      const webP = Promise.resolve()
-        .then(() => next())
-        .then((outcome) => ({ source: 'web', outcome }))
-        .catch((error) => {
-          console.error(`[${NAME}] web next() 失败`, error)
-          return { source: 'web', outcome: 'unavailable' }
-        })
-      const imP = ticket.wait.then((result) => result)
-
-      const first = await Promise.race([webP, imP])
-      if (first.source === 'qq' && first.outcome) {
-        await applyHumanOutcome({ ...info, ticket: ticket.n }, first.outcome, {
-          source: 'qq',
-        })
-        if (pushed) {
-          void qqSend(notify.chatId, first.outcome === 'allowed-once'
-            ? `#${ticket.n} 已批准`
-            : `#${ticket.n} 已拒绝`)
-        }
-        return first.outcome
-      }
-      if (first.source === 'web') {
-        tickets.discard(ticket.n, 'web')
-        await applyHumanOutcome({ ...info, ticket: ticket.n }, first.outcome, { source: 'web' })
-        if (pushed) void qqSend(notify.chatId, `#${ticket.n} 已在网页${formatOutcomeLabel(first.outcome)}`)
-        return first.outcome
+      const outcome = await next()
+      try {
+        applyHumanOutcome(info, outcome)
+        emitDecision(decisionLeaf(info, { verdict: 'human', path: info.path, outcome }))
+      } catch (error) {
+        console.error(`[${NAME}] 记录人工结果失败`, error)
       }
-      const outcome = first.outcome || 'cancelled'
-      await applyHumanOutcome({ ...info, ticket: ticket.n }, outcome, { source: first.source || 'abort' })
       return outcome
-    } finally {
-      webSignal.abort()
-      if (timeoutHandle && typeof timeoutHandle === 'function') {
-        try { timeoutHandle() } catch { /* disposer */ }
+    } catch (error) {
+      console.error(`[${NAME}] 网页审批框失败`, error)
+      try {
+        applyHumanOutcome(info, 'unavailable')
+        emitDecision(decisionLeaf(info, { verdict: 'human', path: info.path, outcome: 'unavailable' }))
+      } catch (again) {
+        console.error(`[${NAME}] 记录 unavailable 失败`, again)
       }
-      if (requestSignal) requestSignal.removeEventListener('abort', onAbort)
+      return 'unavailable'
     }
   }
 
@@ -807,6 +609,7 @@ export function apply(ctx, rawConfig = {}) {
 
   ctx.on('approval/request', async (req, next) => {
     let humanFallback = null
+    let forwarded = false
     try {
       // 非「自动审批」预设交给系统默认 ask，本插件不管。
       reloadAllowlist()
@@ -827,7 +630,8 @@ export function apply(ctx, rawConfig = {}) {
       const reason = String(req.reason || '')
       const { mode, justification } = parseReason(reason)
       const sessionId = typeof session.id === 'string' ? session.id : ''
-      const sessionCwd = (typeof session.cwd === 'string' && session.cwd) ? session.cwd : ''
+      const sessionCwd = readSessionCwd(session)
+
       const cached = takeCachedCall(pendingCalls, sessionId, req.callId)
       const toolArgs = pickToolArgs(cached.args || {})
       const baseInfo = {
@@ -835,35 +639,38 @@ export function apply(ctx, rawConfig = {}) {
         args: toolArgs,
       }
 
-      const toHuman = (path, category, extra) => forwardToHuman({
-        ...baseInfo,
-        path,
-        category: category || '',
-        key: extra && extra.key,
-        confirmed: extra && extra.confirmed,
-        threshold: extra && extra.threshold,
-        judgeReason: extra && extra.judgeReason,
-        judge: extra && extra.judge,
-      }, next, req)
+      const toHuman = (path, category, extra) => {
+        forwarded = true
+        return forwardToHuman({
+          ...baseInfo,
+          path,
+          category: category || '',
+          judgeReason: extra && extra.judgeReason,
+          judge: extra && extra.judge,
+        }, next)
+      }
       humanFallback = toHuman
       // 没看见命令/路径就转人工，禁止关键词允许或模型标 safe。
       if (!cached.found || !hasToolPayload(toolArgs)) {
-        const why = cached.found ? '工具参数不完整，转人工' : '未捕获工具参数，转人工'
+        const why = cached.found ? 'err.missingPayload' : 'err.missingPayloadUncaptured'
         audit(`HUMAN   ${toolName} mode=${mode || 'none'} missing-payload | ${why}`)
         return toHuman('missing-payload', 'other', { judgeReason: why })
       }
-      const hay = formatKeywordHay(toolName, reason, toolArgs)
-      const kw = matchKeywordBuckets(hay, allowlist, formatAllowKeywordHay(toolArgs))
+      const hay = formatKeywordHay(toolName, reason, toolArgs, sessionCwd)
+      const pathHay = formatPathKeywordHay(toolArgs, sessionCwd)
+      const kw = matchKeywordBuckets(hay, allowlist, formatAllowKeywordHay(toolArgs), pathHay)
+
       const eventDetail = { args: toolArgs, cwd: sessionCwd }
       if (kw && kw.action === 'reject') {
         audit(`REJECT  ${toolName} mode=${mode || 'none'} keyword | ${reason.slice(0, 160)}`)
         recordEvent(sessionId, toolName, mode, reason, justification, 'keyword-reject', {
           kind: 'auto', path: 'keyword-reject', ...eventDetail,
         })
+        emitDecision(decisionLeaf(baseInfo, { verdict: 'keyword-reject', path: 'keyword-reject', outcome: 'rejected' }))
         return 'rejected'
       }
       if (toolArgsTruncated(toolArgs)) {
-        const why = '工具参数过长已截断，转人工（禁止按前缀自动放行）'
+        const why = 'err.truncatedPayload'
         audit(`HUMAN   ${toolName} mode=${mode || 'none'} truncated-payload | ${why}`)
         return toHuman('truncated-payload', 'other', { judgeReason: why })
       }
@@ -873,15 +680,22 @@ export function apply(ctx, rawConfig = {}) {
           recordEvent(sessionId, toolName, mode, reason, justification, 'keyword-allow', {
             kind: 'auto', path: 'keyword-allow', ...eventDetail,
           })
+          emitDecision(decisionLeaf(baseInfo, { verdict: 'keyword-allow', path: 'keyword-allow', outcome: 'allowed-once' }))
           return 'allowed-once'
         }
         audit(`HUMAN   ${toolName} mode=${mode || 'none'} keyword | ${reason.slice(0, 160)}`)
         return toHuman('keyword-human', '')
       }
 
-      const judged = await judgeOperation(toolName, mode, justification, toolArgs, sessionCwd)
+      const judged = await judgeOperation(toolName, mode, justification, toolArgs, sessionCwd, req.signal)
       const criterion = judged.criterion || 'other'
       const judgeReason = judged.reason || ''
+      if (judged.aborted) {
+        // 请求已被取消（工具执行 signal abort）。审批服务会以 cancelled 结算并丢弃迟到结果，
+        // 这里不再占坑、也不再调 next()，避免取消后还弹人工框。
+        audit(`CANCEL  ${toolName} mode=${mode || 'none'} judge aborted`)
+        return 'cancelled'
+      }
       if (judged.failed) {
         audit(`FAILED  ${toolName} mode=${mode || 'none'} → 人工 | ${judged.error || reason.slice(0, 120)}`)
         return toHuman('judge-failed', criterion, {
@@ -894,6 +708,9 @@ export function apply(ctx, rawConfig = {}) {
         recordEvent(sessionId, toolName, mode, reason, justification, 'criteria-reject', {
           kind: 'auto', category: criterion, path: 'criteria-reject', judgeReason, judge: judged, ...eventDetail,
         })
+        emitDecision(decisionLeaf(baseInfo, {
+          verdict: 'criteria-reject', path: 'criteria-reject', outcome: 'rejected', category: criterion, judgeReason,
+        }))
         return 'rejected'
       }
       if (judged.action === 'allow') {
@@ -901,16 +718,24 @@ export function apply(ctx, rawConfig = {}) {
         recordEvent(sessionId, toolName, mode, reason, justification, 'criteria-allow', {
           kind: 'auto', category: criterion, path: 'criteria-allow', judgeReason, judge: judged, ...eventDetail,
         })
+        emitDecision(decisionLeaf(baseInfo, {
+          verdict: 'criteria-allow', path: 'criteria-allow', outcome: 'allowed-once', category: criterion, judgeReason,
+        }))
         return 'allowed-once'
       }
       audit(`HUMAN   ${toolName} mode=${mode || 'none'} criteria=${criterion} | ${judgeReason || reason.slice(0, 120)}`)
       return toHuman('criteria-human', criterion, { judgeReason, judge: judged })
     } catch (error) {
       console.error(`[${NAME}] 判断过程出错，回退人工`, error)
+      if (forwarded) return 'unavailable'
       if (humanFallback) {
         try {
           return await humanFallback('plugin-error', 'other', {
-            judgeReason: String((error && error.message) || error),
+            judgeReason: (error && error.code) || 'err.pluginError',
+            judge: {
+              errorCode: (error && error.code) || 'err.pluginError',
+              errorDetail: String((error && error.message) || error),
+            },
           })
         } catch (again) {
           console.error(`[${NAME}] 转人工仍失败，交回系统默认`, again)
@@ -926,7 +751,7 @@ export function apply(ctx, rawConfig = {}) {
   ctx.inject(['connection'], (c) => {
     const connection = c.connection
     if (!connection || !connection.fetch || typeof connection.fetch.register !== 'function') {
-      console.warn(`[${NAME}] connection.fetch 不可用，设置页/提示条 RPC 未注册（门控与 QQ 仍工作）`)
+      console.warn(`[${NAME}] connection.fetch 不可用，设置页/提示条 RPC 未注册（门控仍工作）`)
       return
     }
 
@@ -936,12 +761,11 @@ export function apply(ctx, rawConfig = {}) {
         reloadPluginCfg()
         const body = payload && typeof payload === 'object' ? payload : {}
         if (endpoint === 'snapshot') {
-          const creds = loadQqCreds()
           return {
             ok: true,
             value: {
               config: {
-                version: allowlist.version || 17,
+                version: allowlist.version || 18,
                 corrupt: allowlistCorrupt,
                 rejectKeywords: allowlist.rejectKeywords || [],
                 humanKeywords: allowlist.humanKeywords || [],
@@ -955,19 +779,14 @@ export function apply(ctx, rawConfig = {}) {
                 rejectKeywords: shippedRejectKeywords(),
                 humanKeywords: [],
                 criteria: shippedCriteria(pluginCfg.judgePromptLang),
+                judgePrompts: {
+                  zh: shippedJudgePromptTemplate('zh'),
+                  en: shippedJudgePromptTemplate('en'),
+                },
               },
-              setup: getSetupState(paths.profilePatch),
+              setup: presetSetupState(),
               plugin: pluginCfg,
               pluginCorrupt: pluginCfgCorrupt,
-              qq: {
-                status: qq ? qq.status() : '未启动',
-                connected: Boolean(qq && qq.connected()),
-                hasSecret: Boolean(creds.appId && creds.appSecret),
-                credsCorrupt: qqbotCorrupt,
-                appIdMasked: maskSecret(creds.appId),
-                recentChats,
-                provisioning: provisionSnapshot(),
-              },
               providers: (() => {
                 try {
                   return (llm.listProviders() || []).map((p) => ({ id: p.id, name: p.name || p.id }))
@@ -980,7 +799,8 @@ export function apply(ctx, rawConfig = {}) {
         if (endpoint === 'events') {
           const sessionId = String(body.sessionId || '')
           if (!sessionId) {
-            return { ok: false, error: { code: 'events', message: '需要 sessionId', details: {} } }
+            return rpcFail('err.needSessionId')
+
           }
           const since = Number.parseInt(String(body.since || '0'), 10) || 0
           return { ok: true, value: { events: readEventsSince(paths.events, sessionId, since) } }
@@ -998,74 +818,52 @@ export function apply(ctx, rawConfig = {}) {
             pluginCfg.judge.timeoutMs = allowlist.judgeTimeoutMs
             persistPluginCfg()
           }
-          return result.ok ? { ok: true, value: result } : { ok: false, error: { code: 'rule', message: result.error || '失败', details: {} } }
+          return result.ok ? { ok: true, value: result } : rpcFail(result.code || 'err.allowlistWrite', result.details || {})
+
         }
         if (endpoint === 'setup') {
-          return { ok: true, value: setAutoApproveSandbox(paths.profilePatch, pluginCfg.presetSandbox) }
+          const setupResult = setAutoApproveSandbox(paths.profilePatch, pluginCfg.presetSandbox)
+          if (!setupResult.ok) {
+            return rpcFail(setupResult.code || 'err.preset', setupResult.details || { error: String(setupResult.error || '') })
+
+          }
+          return { ok: true, value: setupResult }
         }
         if (endpoint === 'save-plugin') {
           if (pluginCfgCorrupt && !body.overwriteCorrupt) {
-            return { ok: false, error: { code: 'save', message: '插件配置损坏，拒绝覆盖。请修好磁盘文件，或点「覆盖损坏配置」', details: {} } }
+            return rpcFail('err.pluginCorrupt')
+
           }
           const next = mergePluginConfig(pluginCfg, body)
           const prev = pluginCfg
           pluginCfg = next
           if (!persistPluginCfg({ overwriteCorrupt: Boolean(body.overwriteCorrupt) })) {
             pluginCfg = prev
-            return { ok: false, error: { code: 'save', message: '写入配置失败', details: {} } }
+            return rpcFail('err.pluginWrite')
+
           }
           let preset = null
           if (body && Object.prototype.hasOwnProperty.call(body, 'presetSandbox')) {
             preset = setAutoApproveSandbox(paths.profilePatch, pluginCfg.presetSandbox)
+            if (preset && !preset.ok) {
+              // 沙箱没写进 patch 就整个回滚：不能让 config.json 说 read-only、patch 还是全权限。
+              pluginCfg = prev
+              persistPluginCfg({ overwriteCorrupt: Boolean(body.overwriteCorrupt) })
+              return rpcFail(preset.code || 'err.preset', preset.details || { error: String(preset.error || '') })
+
+            }
           }
           if (typeof body.judgeTimeoutMs === 'number') {
             const timeoutResult = applyRuleOp('set', 'judgeTimeoutMs', body.judgeTimeoutMs)
             if (!timeoutResult.ok) {
-              return { ok: false, error: { code: 'rule', message: timeoutResult.error || '写入超时失败', details: {} } }
+              return rpcFail(timeoutResult.code || 'err.allowlistWrite', timeoutResult.details || {})
+
             }
             pluginCfg.judge.timeoutMs = allowlist.judgeTimeoutMs
             persistPluginCfg()
           }
           audit('CONFIG  plugin 已更新')
-          return { ok: true, value: { ok: true, plugin: pluginCfg, preset, setup: getSetupState(paths.profilePatch) } }
-        }
-        if (endpoint === 'save-qq-creds') {
-          await cancelProvisioning()
-          const appId = String(body.appId || '').trim()
-          const appSecret = String(body.appSecret || '').trim()
-          const prev = loadQqCreds()
-          const next = {
-            appId: appId || prev.appId,
-            appSecret: appSecret || prev.appSecret,
-            ownerUserOpenid: prev.ownerUserOpenid || '',
-          }
-          persistQqCreds(next)
-          await startQq()
-          audit('CONFIG  qqbot 凭据已更新并重连')
-          return { ok: true, value: { ok: true, status: qq ? qq.status() : '未启动' } }
-        }
-        if (endpoint === 'qq-provision') {
-          const result = await startProvisioning()
-          return result.ok
-            ? { ok: true, value: { ok: true, status: provisionAttempt ? provisionAttempt.status : '' } }
-            : { ok: false, error: { code: 'provision', message: result.error || '扫码启动失败', details: {} } }
-        }
-        if (endpoint === 'qq-cancel-provision') {
-          await cancelProvisioning()
-          return { ok: true, value: { ok: true } }
-        }
-        if (endpoint === 'set-chat') {
-          pluginCfg.notify.chatId = String(body.chatId || '')
-          pluginCfg.notify.userId = String(body.userId || '')
-          if (!persistPluginCfg()) {
-            return { ok: false, error: { code: 'save', message: '写入配置失败', details: {} } }
-          }
-          audit(`CONFIG  notify chatId=${pluginCfg.notify.chatId}`)
-          return { ok: true, value: { ok: true, notify: pluginCfg.notify } }
-        }
-        if (endpoint === 'reconnect-qq') {
-          await startQq()
-          return { ok: true, value: { ok: true, status: qq ? qq.status() : '未启动' } }
+          return { ok: true, value: { ok: true, plugin: pluginCfg, preset, setup: presetSetupState() } }
         }
         if (endpoint === 'judge-catalog') {
           const provider = String(body.provider || configuredRoute().provider)
@@ -1073,7 +871,8 @@ export function apply(ctx, rawConfig = {}) {
           try {
             models = (await llm.listModels(provider)).map((m) => ({ id: m.id, name: m.name || m.id }))
           } catch (error) {
-            return { ok: false, error: { code: 'catalog', message: String((error && error.message) || error), details: {} } }
+            return rpcFail('err.catalog', { error: String((error && error.message) || error) })
+
           }
           return { ok: true, value: { provider, models } }
         }
@@ -1094,12 +893,15 @@ export function apply(ctx, rawConfig = {}) {
               },
             }
           } catch (error) {
-            return { ok: false, error: { code: 'info', message: String((error && error.message) || error), details: {} } }
+            return rpcFail('err.info', { error: String((error && error.message) || error) })
+
           }
         }
-        return { ok: false, error: { code: 'unknown', message: `unknown endpoint ${endpoint}`, details: {} } }
+        return rpcFail('err.unknownEndpoint', { endpoint: String(endpoint || '') })
+
       } catch (error) {
-        return { ok: false, error: { code: 'internal', message: String((error && error.message) || error), details: {} } }
+        return rpcFail('err.internal', { error: String((error && error.message) || error) })
+
       }
     }
 
@@ -1109,7 +911,8 @@ export function apply(ctx, rawConfig = {}) {
       try {
         body = await request.json()
       } catch {
-        return new Response('body is not JSON', { status: 400 })
+        return Response.json({ type: 'server-response', rpcId: 'invalid-request', result: rpcFail('err.badBody') })
+
       }
       const rpcId = body && typeof body.rpcId === 'string' ? body.rpcId : 'invalid-request'
       const packed = body && body.payload && typeof body.payload === 'object' ? body.payload : {}
@@ -1119,7 +922,8 @@ export function apply(ctx, rawConfig = {}) {
         const result = await enqueueRpc(() => dispatch(endpoint, payload))
         return Response.json({ type: 'server-response', rpcId: rpcId, result: result })
       } catch (error) {
-        return new Response('handler failure: ' + String(error), { status: 500 })
+        return Response.json({ type: 'server-response', rpcId: rpcId, result: rpcFail('err.internal', { error: String(error) }) })
+
       }
     }
 
@@ -1139,5 +943,5 @@ export function apply(ctx, rawConfig = {}) {
     }
   })
 
-  log(`已挂载：关键词→审核表 sandbox=${pluginCfg.presetSandbox}；QQ=${qq ? qq.status() : '无'}`)
+  log(`已挂载：关键词→审核表 sandbox=${pluginCfg.presetSandbox} profilePatch=${paths.profilePatch}`)
 }