@dsh-enhanced/owner-console 0.0.0-stage → 0.1.67

package/lib/service.js

@@ -0,0 +1,683 @@
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { boundedConfig, configFacts, findEntry, isAppId, isEntryId, isEnvName, isProjectBundle, isProjectPackage, isSecretRef, } from './settings.js';
+import { INTAKE_AGREEMENT_LEVELS, INTAKE_AGREEMENT_OUTCOMES, LARK_CONNECTIONS, LARK_ERROR_CODES, OwnerConsoleIntakeAgreementSchema, OwnerConsoleTrendSnapshotsSchema, TREND_SNAPSHOT_PAGE_MAX, } from './typert.js';
+import { componentState, missingRemedy, repairPatch } from './state.js';
+import { persistAllowedBuilds } from './build-approvals.js';
+/** Companions worth surfacing; a missing one is a setup hint, never a hard failure. */
+const DEPENDENCIES = ['assistantPolicy', 'assistantDelivery', 'assistantSkills'];
+const LARK = /(^|[-_/])lark(-channel)?($|[-_/])/u;
+const TRAEX = /traex/iu;
+const APP_ID_ENV = ['LARK_APP_ID', 'FEISHU_APP_ID'];
+const ACCOUNT = /^[A-Za-z0-9][A-Za-z0-9._@/-]{0,255}$/u;
+/** Read-only status plus owner-clicked, one-step writes through the Host settings service.
+ * Only `.volatile()` config fields are editable by that service; every write addresses one
+ * entry, uses CAS on its revision, and returns a business reason instead of throwing. */
+export class OwnerConsoleService extends TypertRemoteService {
+    config;
+    host;
+    constructor(ctx, config) {
+        super(ctx, 'ownerConsole');
+        this.config = config;
+        this.host = ctx;
+    }
+    settings() {
+        const settings = this.host.get('settings');
+        if (settings === undefined)
+            throw new Error('Host settings service is unavailable; this console cannot edit configuration');
+        return settings;
+    }
+    /** Host-supplied profile directory; only the `allowBuilds` fallback writes there. */
+    profileDirectory() {
+        const profile = this.host.get('profileContext');
+        return typeof profile?.dir === 'string' && profile.dir !== '' ? profile.dir : undefined;
+    }
+    descriptors() {
+        const settings = this.host.get('settings');
+        return settings?.describe({ redactSecrets: true }) ?? [];
+    }
+    /** Volatile edits update the running fiber references but never re-run apply.
+     * A one-step write therefore restarts just this entry with its persisted raw
+     * config. `fiber.update()` is synchronous while the restart is not, so the note
+     * only claims a reload when the entry is active again in a fresh `describe()`;
+     * anything else says a restart is needed. This never throws. */
+    async reload(entryId) {
+        const loader = this.host.get('loader');
+        if (loader === undefined)
+            return '；已保存，但 loader 不可用，重启 profile 后生效';
+        try {
+            const entry = [...loader.entries()].find(candidate => candidate.options.id === entryId || candidate.id === entryId);
+            if (entry === undefined)
+                return '；已保存，但未找到该 profile 条目，重启 profile 后生效';
+            if (entry.fiber === undefined)
+                await entry.refresh();
+            else
+                entry.fiber.update(entry.options.config, true);
+            return this.descriptors().some(descriptor => descriptor.ns === entryId)
+                ? '；条目已重新加载'
+                : '；已保存，但未能确认条目已恢复加载；如未生效请重启 profile';
+        }
+        catch {
+            return '；已保存，但自动重载失败，请重启 profile 后生效';
+        }
+    }
+    /** Why a card's write target is not active, in the panel's own terms. It reports the observed
+     * fiber phase/diagnostic, the missing companion services and a minimal patch repair instead of
+     * the generic "not installed" refusal that hides a failed or pending load. */
+    async targetRefusal(entry, packageName, label) {
+        const state = componentState(await this.status(), packageName);
+        const diagnostic = state.entry?.diagnostic === undefined ? '' : `：${boundedText(state.entry.diagnostic, 300)}`;
+        const bundleError = state.error === undefined ? '' : `；Host 记录错误 ${state.error.code}`;
+        const missing = missingRemedy(state);
+        const repair = state.stalled
+            ? ` 可用以下最小 patch 临时停用该行：${repairPatch(state, packageName)}` : '';
+        const note = state.kind === 'absent'
+            ? `${label} 未安装；请先在面板安装 ${packageName}，再配置`
+            : state.kind === 'active'
+                ? `${label} 已加载，但没有声明任何可实时修改的配置字段`
+                : state.kind === 'disabled'
+                    ? `${label} 已安装但未启用；请先点“启用”，等条目加载后再配置`
+                    : state.kind === 'unavailable' || state.kind === 'unreadable'
+                        ? `${label} 状态不可读：${state.label}${diagnostic}`
+                        : `${label} 已启用但未加载（${state.entry?.fiberPhase ?? '无 Loader 条目'}${bundleError}）${diagnostic}。`
+                            + `${missing === '' ? '' : `${missing}。`}修复后重启 profile 再配置。${repair}`;
+        return refuse(entry, note);
+    }
+    /** Read the keychain handles only when the provider exposes them; a provider that cannot list
+     * (or throws) fails soft, and the write proceeds with a note that existence was not verified. */
+    keychainHandles() {
+        const keychain = this.host.get('credentialsKeychain');
+        try {
+            if (typeof keychain?.listHandles !== 'function')
+                return undefined;
+            const handles = keychain.listHandles();
+            return Array.isArray(handles)
+                ? handles.flatMap(handle => typeof handle?.id === 'string' ? [handle.id] : [])
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    manager() {
+        const manager = this.host.get('pluginManager');
+        if (manager === undefined)
+            throw new Error('Host plugin manager is unavailable; this console cannot manage bundles');
+        return manager;
+    }
+    /** One inventory read, with each list isolated: a rejecting list is reported instead of making the
+     * whole status (or the other list) fail, and an absent service is not the same fact as "nothing installed". */
+    async inventory() {
+        const manager = this.host.get('pluginManager');
+        if (manager === undefined) {
+            return Object.freeze({ bundles: Object.freeze([]), plugins: Object.freeze([]),
+                phases: Object.freeze({ bundles: 'unavailable', plugins: 'unavailable' }) });
+        }
+        const [listedBundles, listedPlugins] = await Promise.allSettled([manager.listBundles(), manager.listPlugins()]);
+        const phases = Object.freeze({
+            bundles: listedBundles.status === 'fulfilled' ? 'ok' : 'failed',
+            plugins: listedPlugins.status === 'fulfilled' ? 'ok' : 'failed',
+        });
+        const rejected = [listedBundles, listedPlugins].find(result => result.status === 'rejected');
+        return Object.freeze({
+            // A dependency row without a bundle patch (`not-bundle`) is not manageable here; every other
+            // ManagementError stays visible so an incompatible installed bundle is never reported as absent.
+            bundles: Object.freeze(listedBundles.status === 'fulfilled'
+                ? listedBundles.value.filter(bundle => isProjectPackage(bundle.name) && bundle.error?.code !== 'not-bundle')
+                : []),
+            plugins: Object.freeze(listedPlugins.status === 'fulfilled'
+                ? listedPlugins.value.filter(plugin => isProjectPackage(plugin.moduleName))
+                : []),
+            phases,
+            ...(rejected === undefined
+                ? {}
+                : { diagnostic: boundedText(rejected.reason instanceof Error ? rejected.reason.message : String(rejected.reason), 1_024) }),
+        });
+    }
+    async status() {
+        const settings = this.host.get('settings');
+        const entries = settings?.describe({ redactSecrets: true }) ?? [];
+        const inventory = await this.inventory();
+        const lark = findEntry(entries, ns => LARK.test(ns));
+        const traex = findEntry(entries, ns => TRAEX.test(ns));
+        const larkValue = configFacts(lark?.value);
+        const traexValue = configFacts(traex?.value);
+        const installed = (name) => inventory.phases.bundles === 'ok'
+            && inventory.bundles.some(bundle => bundle.name === name && bundle.installed);
+        const larkHealth = readLarkHealth(this.host.get('larkChannel'));
+        return Object.freeze({
+            feishu: Object.freeze({
+                ...(lark === undefined ? {} : { entry: lark.ns }),
+                mode: larkValue['secretSource'] === 'handle' || (larkValue['secretSource'] === undefined && typeof larkValue['credentialHandle'] === 'string') ? 'handle' : 'env',
+                installed: installed('@dsh-enhanced/lark-channel'),
+                enabled: larkValue['enabled'] === true,
+                appIdConfigured: isAppId(larkValue['appId']),
+                ...larkHealth,
+            }),
+            traex: Object.freeze({
+                ...(traex === undefined ? {} : { entry: traex.ns }),
+                installed: installed('@dsh-enhanced/traex-acp-provider'),
+                enabled: traexValue['enabled'] === true,
+                command: typeof traexValue['command'] === 'string' ? traexValue['command'] : '',
+            }),
+            host: Object.freeze({
+                settings: settings !== undefined,
+                pluginManager: this.host.get('pluginManager') !== undefined,
+                bundles: inventory.phases.bundles,
+                plugins: inventory.phases.plugins,
+                ...(inventory.diagnostic === undefined ? {} : { diagnostic: inventory.diagnostic }),
+            }),
+            dependencies: Object.freeze(DEPENDENCIES.map(name => Object.freeze({
+                name, available: this.host.get(name) !== undefined,
+            }))),
+            evaluation: Object.freeze({
+                intakeAgreement: readIntakeAgreementAvailability(this.host.get('assistantEvaluation'), this.host.get('loader')),
+            }),
+            bundles: Object.freeze(inventory.bundles.map(bundle => Object.freeze({
+                name: bundle.name,
+                ...(bundle.version === undefined ? {} : { version: bundle.version }),
+                enabled: bundle.enabled,
+                installed: bundle.installed,
+                removable: bundle.removable,
+                ...(bundle.error === undefined ? {} : { error: Object.freeze({
+                        code: bundle.error.code ?? 'operation-error',
+                        ...(bundle.error.diagnostic === undefined ? {} : { diagnostic: boundedText(bundle.error.diagnostic, 2_048) }),
+                    }) }),
+                rows: Object.freeze((bundle.rows ?? []).slice(0, 32).map(row => Object.freeze({
+                    rowId: row.rowId,
+                    moduleName: row.moduleName,
+                    ...(row.entryId === undefined ? {} : { entryId: row.entryId }),
+                }))),
+            }))),
+            plugins: Object.freeze(inventory.plugins.map(plugin => Object.freeze({
+                entryId: plugin.entryId,
+                moduleName: plugin.moduleName,
+                enabled: plugin.enabled,
+                fiberPhase: plugin.fiberPhase,
+                ...(plugin.diagnostic === undefined ? {} : { diagnostic: boundedText(plugin.diagnostic, 4_096) }),
+            }))),
+        });
+    }
+    /** Read-only page of sealed ordinary-use trend snapshots from the control plane. It never seals,
+     * so viewing cannot change the ledger; `planId: ''` lists every plan and `beforeSequence: 0` starts
+     * at the newest row. Any refusal or tampered row is reported as `unverifiable`, never repaired. */
+    async trendSnapshots(planId, beforeSequence, limit) {
+        return readTrendSnapshots(this.host.get('pluginControlPlane'), planId, beforeSequence, limit);
+    }
+    /** Read-only agreement between intake judgments and owner notification outcomes for one exact
+     * Evaluation scope (workspace + preset), over Evaluation's default window. It never writes, adopts
+     * or sends; a disabled switch is reported as `disabled`, any refusal or odd shape as `unverifiable`. */
+    async intakeAgreement(workspace, preset) {
+        return readIntakeAgreement(this.host.get('assistantEvaluation'), workspace, preset);
+    }
+    /** Select or remove one installed project bundle layer; dependencies stay installed. */
+    async setBundleEnabled(name, enabled) {
+        if (!isProjectPackage(name))
+            return refuse('', '只允许管理本项目的 @dsh-enhanced/* bundle');
+        const manager = this.manager();
+        return applyChange(await manager.setBundleEnabled(name, enabled));
+    }
+    /** Enable or disable one loaded entry of a project bundle. */
+    async setPluginEnabled(entryId, enabled) {
+        const manager = this.manager();
+        if (entryId.trim() === '')
+            return refuse('', 'entryId 不能为空');
+        const inventory = await this.inventory();
+        const entry = inventory.plugins.find(plugin => plugin.entryId === entryId);
+        if (entry === undefined)
+            return refuse(entryId, '该条目不属于本项目的插件，或尚未安装');
+        return applyChange(await manager.setPluginEnabled(entryId, enabled));
+    }
+    /** Remove one project bundle layer after the owner confirms the destructive step. */
+    async removeProjectBundle(name) {
+        if (!isProjectPackage(name))
+            return refuse('', '只允许移除本项目的 @dsh-enhanced/* bundle');
+        const manager = this.manager();
+        return applyChange(await manager.removeBundle(name));
+    }
+    /** Install one project bundle with its declared dependencies, then activate it.
+     * The Host's pnpm run can stop at its dependency build-script policy. The names the console
+     * parsed from that failure are written to the profile's `allowBuilds` before the retry, then
+     * the install runs once more without an approval flag. Writing first works even when the
+     * Host's own ANSI parsing lost the names: pnpm sees a real allow decision instead of a
+     * pending placeholder, so the Host never has to record or re-approve them. */
+    async installProjectBundle(spec, approvedBuilds = []) {
+        const trimmed = spec.trim();
+        if (!isProjectPackage(trimmed)) {
+            return refuse('', '只允许安装本项目的 @dsh-enhanced/<name> 包；本地路径和 git 地址不在此面板处理');
+        }
+        const approvals = [...new Set(approvedBuilds.map(name => name.trim()))];
+        if (approvedBuilds.length > MAX_BUILD_NAMES
+            || approvals.some(name => name === '' || name.length > 200 || /[*?\r\n]/u.test(name))) {
+            return refuse(trimmed, '批准的构建脚本名称无效');
+        }
+        const manager = this.manager();
+        if (approvals.length === 0) {
+            return applyInstall(await manager.installBundle(trimmed, { enabled: true, saveExact: true }));
+        }
+        const dir = this.profileDirectory();
+        if (dir === undefined)
+            return rejectStaleApproval(trimmed, approvals);
+        try {
+            await persistAllowedBuilds(dir, approvals);
+        }
+        catch (cause) {
+            return refuse(trimmed, `写入 allowBuilds 失败：${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+        return applyInstall(await manager.installBundle(trimmed, { enabled: true, saveExact: true }));
+    }
+    /** Feishu: one owner click, two ways to pair the bot. No plaintext secret is ever accepted. */
+    async configureFeishu(appId, appSecretEnv, credentialHandle, account, tenant, discoverAppId) {
+        const settings = this.settings();
+        const lark = findEntry(this.descriptors(), ns => LARK.test(ns));
+        if (lark === undefined) {
+            return await this.targetRefusal('dsh-enhanced-lark-channel', '@dsh-enhanced/lark-channel', 'lark-channel');
+        }
+        const current = configFacts(lark.value);
+        const configured = isAppId(this.config.feishuAppId) ? this.config.feishuAppId : undefined;
+        const discovered = appId.trim() === '' && discoverAppId
+            ? APP_ID_ENV.map(name => process.env[name]).find(value => isAppId(value)) ?? configured
+            : undefined;
+        const resolvedAppId = appId.trim() === '' ? discovered : appId.trim();
+        if (!isAppId(resolvedAppId)) {
+            return refuse(lark.ns, discoverAppId
+                ? '一键模式需要 Host 环境中的 LARK_APP_ID 或 FEISHU_APP_ID；否则请填写 appId'
+                : 'appId 必须形如 cli_0123456789abcdef');
+        }
+        const envName = appSecretEnv.trim();
+        const handle = credentialHandle.trim();
+        if ((envName === '') === (handle === '')) {
+            return refuse(lark.ns, 'secret 引用必须二选一：环境变量名或 keychain handle');
+        }
+        if (envName !== '' && !isEnvName(envName))
+            return refuse(lark.ns, 'appSecretEnv 必须是环境变量名');
+        if (handle !== '' && !isSecretRef(handle))
+            return refuse(lark.ns, 'credentialHandle 格式无效');
+        if (envName !== '' && process.env[envName] === undefined) {
+            return refuse(lark.ns, `Host 进程中不存在环境变量 ${envName}；请先设置它，或改用 keychain handle`);
+        }
+        let keychainVerified = true;
+        if (handle !== '') {
+            if (this.host.get('credentialsKeychain') === undefined) {
+                return refuse(lark.ns, 'credentials-keychain 未加载；无法引用 keychain secret');
+            }
+            const handles = this.keychainHandles();
+            keychainVerified = handles !== undefined;
+            if (handles !== undefined && !handles.includes(handle)) {
+                const known = handles.length === 0 ? '当前没有任何 handle' : `现有：${handles.slice(0, 8).join('、')}`;
+                return refuse(lark.ns, `credentials keychain 中没有 handle "${handle}"（${known}）；请先在 keychain 创建它，或改用环境变量引用`);
+            }
+        }
+        const resolvedAccount = account.trim() === '' ? current['account'] : account.trim();
+        const resolvedTenant = tenant.trim() === '' ? current['tenant'] : tenant.trim();
+        if (typeof resolvedAccount !== 'string' || !ACCOUNT.test(resolvedAccount)) {
+            return refuse(lark.ns, 'account 缺失或格式无效；请填写当前 owner 的 account，避免更换身份');
+        }
+        if (typeof resolvedTenant !== 'string' || !ACCOUNT.test(resolvedTenant)) {
+            return refuse(lark.ns, 'tenant 缺失或格式无效；请填写当前 owner 的 tenant，避免更换身份');
+        }
+        try {
+            await settings.mutate(lark.ns, [
+                { op: 'set', path: ['enabled'], value: true },
+                { op: 'set', path: ['appId'], value: resolvedAppId },
+                { op: 'set', path: ['account'], value: resolvedAccount },
+                { op: 'set', path: ['tenant'], value: resolvedTenant },
+                envName === '' ? { op: 'unset', path: ['appSecretEnv'] } : { op: 'set', path: ['appSecretEnv'], value: envName },
+                { op: 'set', path: ['secretSource'], value: handle === '' ? 'env' : 'handle' },
+                handle === '' ? { op: 'unset', path: ['credentialHandle'] } : { op: 'set', path: ['credentialHandle'], value: handle },
+            ], lark.revision);
+        }
+        catch (cause) {
+            return writeFailure(lark.ns, cause);
+        }
+        const reloaded = await this.reload(lark.ns);
+        const unchecked = handle !== '' && !keychainVerified ? '（未能校验 keychain handle 是否存在）' : '';
+        return Object.freeze({ applied: true, entry: lark.ns,
+            note: (handle === '' ? `secret 来自环境变量 ${envName}` : 'secret 保留在 credentials keychain') + unchecked + reloaded });
+    }
+    /** TraeX: one owner click toggles the local provider row; command is optional. */
+    async configureTraex(enabled, command) {
+        const settings = this.settings();
+        const traex = findEntry(this.descriptors(), ns => TRAEX.test(ns));
+        if (traex === undefined) {
+            return await this.targetRefusal('dsh-enhanced-traex-acp-provider', '@dsh-enhanced/traex-acp-provider', 'traex-acp-provider');
+        }
+        const value = command.trim();
+        if (value !== '' && (value.length > 1_024 || /[\r\n]/u.test(value))) {
+            return refuse(traex.ns, 'command 必须是单行且不超过 1024 字符');
+        }
+        const ops = [{ op: 'set', path: ['enabled'], value: enabled }];
+        if (value !== '')
+            ops.push({ op: 'set', path: ['command'], value });
+        try {
+            await settings.mutate(traex.ns, ops, traex.revision);
+        }
+        catch (cause) {
+            return writeFailure(traex.ns, cause);
+        }
+        const reloaded = await this.reload(traex.ns);
+        return Object.freeze({ applied: true, entry: traex.ns, note: (enabled ? 'TraeX 行已启用' : 'TraeX 行已停用') + reloaded });
+    }
+    /** Project bundles only: merge one bounded JSON object into fields the entry exposes live. */
+    async configureBundle(entry, config) {
+        const settings = this.settings();
+        if (!isEntryId(entry) || !isProjectBundle(entry)) {
+            return refuse('', '只允许修改本项目的 dsh-enhanced 条目');
+        }
+        const target = findEntry(this.descriptors(), ns => ns === entry);
+        if (target === undefined) {
+            const status = await this.status();
+            const packageName = status.bundles.find(bundle => bundle.rows.some(row => row.rowId === entry))?.name
+                ?? entry.replace(/^dsh-enhanced-/u, '@dsh-enhanced/');
+            return await this.targetRefusal(entry, packageName, entry);
+        }
+        let patch;
+        try {
+            patch = boundedConfig(config);
+        }
+        catch (cause) {
+            return refuse(entry, cause instanceof Error ? cause.message : '配置无效');
+        }
+        const ops = Object.entries(patch).map(([key, value]) => ({ op: 'set', path: [key], value }));
+        if (ops.length === 0)
+            return refuse(entry, '配置为空，没有可写入的字段');
+        try {
+            await settings.mutate(entry, ops, target.revision);
+        }
+        catch (cause) {
+            return writeFailure(entry, cause);
+        }
+        const reloaded = await this.reload(entry);
+        return Object.freeze({ applied: true, entry, note: '已合并写入' + reloaded });
+    }
+}
+const ANSI_ESCAPE = String.fromCodePoint(0x1b);
+const ANSI_SEQUENCE = new RegExp(`${ANSI_ESCAPE}\\[[0-9;]*m`, 'gu');
+/** pnpm names the scripts it skipped on one line, coloured by default (pnpm 11 makes that a failure). */
+const IGNORED_BUILDS = /\bIgnored build scripts: ([^\n]+)/u;
+const MAX_BUILD_NAMES = 64;
+const MAX_DIAGNOSTIC_CHARS = 600;
+/** Read the build-script names pnpm reported from a raw run: ANSI escapes are stripped first, since
+ * pnpm 11 decorates the line and the Host's own parser (`dsh-plugin-manager`) can miss the boundary. */
+export function blockedBuildNames(output) {
+    const line = IGNORED_BUILDS.exec(output.replace(ANSI_SEQUENCE, ''))?.[1];
+    if (line === undefined)
+        return Object.freeze([]);
+    const names = new Set();
+    for (const raw of line.split(',')) {
+        const name = raw.trim().replace(/\.$/u, '');
+        if (name === '' || name.length > 200 || /[*?]/u.test(name))
+            continue;
+        names.add(name);
+        if (names.size >= MAX_BUILD_NAMES)
+            break;
+    }
+    return Object.freeze([...names]);
+}
+/** A failure diagnostic is shown as one bounded line; the full pnpm log stays in the Host's log file. */
+function diagnosticTail(output) {
+    const text = (output ?? '').replace(ANSI_SEQUENCE, '').replace(/\s+/gu, ' ').trim();
+    return text.length > MAX_DIAGNOSTIC_CHARS ? `…${text.slice(-MAX_DIAGNOSTIC_CHARS)}` : text;
+}
+function requirementsLabel(requirements) {
+    const entries = Object.entries(requirements);
+    return entries.length === 0 ? '未知要求' : entries.map(([name, version]) => `${name} ${version}`).join('、');
+}
+/** Only names the write-result wire schema accepts reach the client; a longer Host list is
+ * approved in bounded retries instead of failing the whole result validation. */
+function normalizeBuildNames(names) {
+    return Object.freeze((names ?? [])
+        .filter(name => name !== '' && name.length <= 200 && !/[\r\n]/u.test(name))
+        .slice(0, MAX_BUILD_NAMES));
+}
+/** Install-specific refusal mapping: surface every build name pnpm reported (the Host's own record
+ * may be empty when its parser misses pnpm's coloured line), and turn a raw error box or a
+ * compatibility denial into the concrete owner-facing next step. */
+export function applyInstall(result) {
+    const pending = normalizeBuildNames(result.pendingBuilds);
+    const log = result.packageResult?.logPath === undefined
+        ? '' : `；pnpm 日志：${boundedText(result.packageResult.logPath, 300)}`;
+    const error = result.error;
+    if (error === undefined)
+        return applyChange(result);
+    const incompatible = error.incompatible ?? [];
+    if (incompatible.length > 0) {
+        const packages = incompatible.map(plugin => `${plugin.name}@${plugin.version}（要求 ${requirementsLabel(plugin.requirements)}，当前 DSH ${plugin.runtimeVersion}）`);
+        return Object.freeze({
+            applied: false,
+            entry: result.target,
+            ...(pending.length === 0 ? {} : { pendingBuilds: pending }),
+            note: `Host 拒绝了不兼容的插件版本：${packages.join('；')}。请安装兼容版本，或由主人为这个精确版本授予兼容豁免后重试。${log}`,
+        });
+    }
+    const buildBlocked = result.packageResult?.kind === 'build-blocked'
+        || /ERR_PNPM_IGNORED_BUILDS/u.test(error.diagnostic ?? '');
+    if (buildBlocked) {
+        const names = pending.length > 0 ? pending
+            : normalizeBuildNames(blockedBuildNames(error.diagnostic ?? result.packageResult?.output ?? ''));
+        const listed = names.length === 0 ? 'Host 未给出名称（完整输出在 profile 的 pnpm 日志中）' : names.join('、');
+        const next = names.length === 0
+            ? 'Host 未能自动记录这次拒绝；请在 profile 的 pnpm-workspace.yaml 中写入 allowBuilds（依赖名: true），或运行 pnpm approve-builds 后重试。'
+            : pending.length > 0
+                ? '确认允许这些依赖运行构建脚本后重试。'
+                : '确认允许后，面板会把这些名称写入 profile 的 allowBuilds 并重试一次。';
+        return Object.freeze({
+            applied: false,
+            entry: result.target,
+            ...(names.length === 0 ? {} : { pendingBuilds: names }),
+            note: `安装被 pnpm 的依赖构建脚本策略拒绝：${listed}。${next}${log}`,
+        });
+    }
+    const tail = diagnosticTail(error.diagnostic ?? result.packageResult?.output);
+    return Object.freeze({
+        applied: false,
+        entry: result.target,
+        ...(pending.length === 0 ? {} : { pendingBuilds: pending }),
+        note: `${error.code}（${result.application}）${tail === '' ? '' : `：${tail}`}${log}`,
+    });
+}
+function applyChange(result) {
+    const reason = result.error === undefined
+        ? result.application === 'restart-required'
+            ? '需要重启 profile 后生效'
+            : result.application === 'overridden' ? '被更高优先级的覆盖项接管' : ''
+        : `${result.error.code}${result.error.diagnostic === undefined ? '' : `：${diagnosticTail(result.error.diagnostic)}`}`;
+    const warnings = (result.warnings ?? []).length === 0 ? '' : `；警告：${(result.warnings ?? []).join('；')}`;
+    const builds = (result.pendingBuilds ?? []).length === 0 ? ''
+        : `；需要在面板确认允许构建脚本：${normalizeBuildNames(result.pendingBuilds).join('、')}`;
+    return Object.freeze({
+        // A persisted change that only needs a profile restart is still applied;
+        // failed/cancelled results and validation refusals stay not applied.
+        applied: result.application === 'applied' || result.application === 'restart-required',
+        entry: result.target,
+        note: `${result.changed ? '已变更' : '无变化'}（${result.application}）${reason === '' ? '' : `；${reason}`}${warnings}${builds}`,
+    });
+}
+/** Keep a Host message or diagnostic short enough for a panel banner. */
+function boundedText(text, limit) {
+    const normalized = text.replace(/\s+/gu, ' ').trim();
+    return normalized.length > limit ? `${normalized.slice(0, limit)}…` : normalized;
+}
+/** Map a rejected `settings.mutate` to a business note instead of throwing through the RPC. */
+function writeFailure(entry, cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    const note = /not volatile/iu.test(message)
+        ? `字段不能实时修改：${boundedText(message, 300)}`
+        : /changed since it was read|conflict/iu.test(message)
+            ? '配置已被其他操作修改（CAS 冲突）；请刷新面板后重试'
+            : /No configurable plugin entry|no volatile fields/iu.test(message)
+                ? `该条目当前不可配置（未加载或没有 live 字段）：${boundedText(message, 300)}。条目未加载时请重启 profile 或用 profile patch 修复`
+                : `写入失败：${boundedText(message, 400)}`;
+    return refuse(entry, note);
+}
+/** The Host holds no pending record for a name the owner approved, so no retry is possible. */
+function rejectStaleApproval(entry, names) {
+    return refuse(entry, `Host 未记录这些待批准的构建脚本：${names.join('、')}；且未提供 profile 目录，`
+        + '无法写入 allowBuilds。请在 profile 的 pnpm-workspace.yaml 中写入对应条目后重试。');
+}
+function refuse(entry, note) {
+    return Object.freeze({ applied: false, entry, note });
+}
+const includes = (values, value) => typeof value === 'string' && values.includes(value);
+/** Read-only: `larkChannel.health()` is a synchronous snapshot with no I/O. Only the
+ * enumerated state and error code pass through; anything else becomes `unknown`. */
+function readLarkHealth(provider) {
+    if (provider === undefined || provider === null)
+        return { connected: false, connection: 'absent' };
+    let state;
+    let code;
+    try {
+        const read = provider.health;
+        const health = typeof read === 'function' ? read.call(provider) : undefined;
+        state = health?.state;
+        code = health?.lastErrorCode;
+    }
+    catch {
+        // An inactive or failing provider is reported, never thrown into the panel.
+        state = undefined;
+    }
+    if (!includes(LARK_CONNECTIONS, state) || state === 'absent' || state === 'unknown') {
+        return { connected: false, connection: 'unknown' };
+    }
+    return {
+        connected: state === 'connected' || state === 'connected-with-gap',
+        connection: state,
+        ...(includes(LARK_ERROR_CODES, code) ? { lastErrorCode: code } : {}),
+    };
+}
+const UNVERIFIABLE = Object.freeze({ state: 'unverifiable', causal: false, items: Object.freeze([]) });
+const record = (value) => typeof value === 'object' && value !== null && !Array.isArray(value) ? value : {};
+const list = (value) => Array.isArray(value) ? value : [];
+/** Project one control-plane snapshot page onto the bounded panel summary; content-free digests and counts only. */
+export function readTrendSnapshots(provider, planId, beforeSequence, limit) {
+    if (provider === undefined || provider === null)
+        return Object.freeze({ state: 'absent', causal: false, items: Object.freeze([]) });
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > TREND_SNAPSHOT_PAGE_MAX
+        || !Number.isSafeInteger(beforeSequence) || beforeSequence < 0)
+        return UNVERIFIABLE;
+    try {
+        const read = provider.inspectCreatedCapabilityOrdinaryUseTrendSnapshots;
+        if (typeof read !== 'function')
+            return UNVERIFIABLE;
+        const page = record(read.call(provider, {
+            ...(planId.trim() === '' ? {} : { planId: planId.trim() }),
+            ...(beforeSequence === 0 ? {} : { beforeSequence }),
+            limit,
+        }));
+        if (page['causal'] !== false || !Array.isArray(page['items']))
+            return UNVERIFIABLE;
+        const items = page['items'].map(item => {
+            const row = record(item);
+            const snapshot = record(row['snapshot']);
+            const trend = record(snapshot['trend']);
+            if (snapshot['causal'] !== false || trend['causal'] !== false)
+                throw new Error('causal snapshot');
+            return {
+                sequence: row['sequence'], sealedAt: row['sealedAt'], planId: snapshot['planId'], digest: snapshot['digest'],
+                inputsDigest: snapshot['inputsDigest'], trendDigest: snapshot['trendDigest'], window: snapshot['window'],
+                cohorts: trend['cohorts'], flags: snapshot['flags'],
+                strata: list(trend['strata']).map(value => {
+                    const stratum = record(value);
+                    const did = record(stratum['differenceInDifferences']);
+                    const interval = record(did['interval95']);
+                    return {
+                        model: stratum['model'],
+                        differenceInDifferences: did['status'] === 'estimated'
+                            ? { status: 'estimated', estimate: did['estimate'], low: interval['low'], high: interval['high'] }
+                            : { status: 'insufficient' },
+                        parallelTrend: record(stratum['parallelTrend'])['status'],
+                    };
+                }),
+            };
+        });
+        const parsed = OwnerConsoleTrendSnapshotsSchema.safeParse({ state: 'ok', causal: false, items,
+            ...(page['nextBeforeSequence'] === undefined ? {} : { nextBeforeSequence: page['nextBeforeSequence'] }) });
+        return parsed.success ? Object.freeze(parsed.data) : UNVERIFIABLE;
+    }
+    catch {
+        return UNVERIFIABLE;
+    }
+}
+const INTAKE_UNVERIFIABLE = Object.freeze({ state: 'unverifiable', causal: false });
+function intakeAgreementCell(value) {
+    const cell = record(value);
+    const outcomes = record(cell['outcomes']);
+    return {
+        notifications: cell['notifications'], items: cell['items'], agreed: cell['agreed'], disagreed: cell['disagreed'],
+        agreementPpm: cell['agreementPpm'],
+        outcomes: Object.fromEntries(INTAKE_AGREEMENT_OUTCOMES.map(outcome => [outcome, outcomes[outcome]])),
+    };
+}
+/** Project Evaluation's intake attention agreement onto the panel summary; counts only, no ids or content. */
+export function readIntakeAgreement(provider, workspace, preset) {
+    if (provider === undefined || provider === null)
+        return Object.freeze({ state: 'absent', causal: false });
+    const scope = { workspace: workspace.trim(), preset: preset.trim() };
+    if (scope.workspace === '' || scope.preset === '')
+        return INTAKE_UNVERIFIABLE;
+    try {
+        const read = provider.inspectIntakeAttentionAgreement;
+        if (typeof read !== 'function')
+            return INTAKE_UNVERIFIABLE;
+        const result = read.call(provider, { scope });
+        if (result === undefined)
+            return Object.freeze({ state: 'disabled', causal: false });
+        const agreement = record(result);
+        if (agreement['protocol'] !== 'assistant-evaluation/intake-attention-agreement/v1' || agreement['causal'] !== false)
+            return INTAKE_UNVERIFIABLE;
+        const byLevel = record(agreement['byLevel']);
+        const parsed = OwnerConsoleIntakeAgreementSchema.safeParse({ state: 'ok', causal: false, summary: {
+                fromNotifiedAt: agreement['fromNotifiedAt'], toNotifiedAt: agreement['toNotifiedAt'], scanned: agreement['scanned'],
+                truncated: agreement['truncated'], provenanceAvailable: agreement['provenanceAvailable'], notIntake: agreement['notIntake'],
+                unresolved: agreement['unresolved'], foreign: agreement['foreign'], intake: intakeAgreementCell(agreement['intake']),
+                byLevel: INTAKE_AGREEMENT_LEVELS.filter(level => byLevel[level] !== undefined)
+                    .map(level => ({ level, cell: intakeAgreementCell(byLevel[level]) })),
+            } });
+        return parsed.success && intakeAgreementConsistent(parsed.data.summary) ? Object.freeze(parsed.data) : INTAKE_UNVERIFIABLE;
+    }
+    catch {
+        return INTAKE_UNVERIFIABLE;
+    }
+}
+const EVALUATION_MODULE = '@dsh-enhanced/assistant-evaluation';
+/** Scope-free and read-only: whether `intakeAgreement` can answer at all. Nothing on Evaluation is
+ * called, so no notification is scanned; the switch comes from the one enabled Evaluation loader
+ * entry's persisted config (Evaluation defaults it off). No scope, count or other config passes through. */
+export function readIntakeAgreementAvailability(provider, loader) {
+    if (provider === undefined || provider === null)
+        return 'absent';
+    try {
+        if (typeof provider.inspectIntakeAttentionAgreement !== 'function')
+            return 'unknown';
+        const read = loader?.entries;
+        if (typeof read !== 'function')
+            return 'unknown';
+        const entries = [...read.call(loader)].filter(entry => entry.options.name === EVALUATION_MODULE && entry.options.disabled !== true);
+        // Zero or several candidates: the panel cannot tell which one provides the service.
+        if (entries.length !== 1)
+            return 'unknown';
+        const enabled = record(entries[0].options.config)['intakeAttentionAgreementEnabled'];
+        if (enabled === true)
+            return 'available';
+        return enabled === undefined || enabled === false ? 'disabled' : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** Evaluation's own arithmetic, re-checked so a self-contradicting answer is never shown as `ok`. */
+function intakeAgreementConsistent(summary) {
+    const cellConsistent = (cell) => {
+        const o = cell.outcomes;
+        const total = INTAKE_AGREEMENT_OUTCOMES.reduce((sum, outcome) => sum + o[outcome], 0);
+        const decided = cell.agreed + cell.disagreed;
+        return total === cell.notifications && cell.items <= cell.notifications
+            && cell.agreed === o.accepted + o.reacted && cell.disagreed === o.rejected + o['expired-unhandled']
+            && cell.agreementPpm === (decided === 0 ? null : Math.round(cell.agreed * 1_000_000 / decided));
+    };
+    const levels = summary.byLevel.map(entry => entry.cell);
+    return summary.fromNotifiedAt < summary.toNotifiedAt
+        && summary.intake.notifications + summary.notIntake + summary.unresolved + summary.foreign <= summary.scanned
+        && cellConsistent(summary.intake) && levels.every(cellConsistent)
+        && levels.reduce((sum, cell) => sum + cell.notifications, 0) === summary.intake.notifications;
+}
+//# sourceMappingURL=service.js.map