@marsken/dsh-studio 0.0.0-stage → 0.1.1

package/src/host/quality.js

@@ -0,0 +1,106 @@
+// 相 ai 的质量度量：一次通过率、返工率、耗时。纯函数，口径写在 README「AI 质量的口径」一节。
+//
+// 三个信号都来自台账本身，不猜：
+//   派单次数 / 平均耗时 —— dispatcher 的 RUN_LOG（内存里最近 300 条，重启就清零，见 README 已知限制）
+//   卡数 / 完成数     —— task.expert（换列时会被列负责人覆盖，所以只有「当前负责」的卡能算）
+//   返工              —— 列往回退过、AI 失败过、缺陷重开过，任一命中就算这张卡返工了
+
+import { STATUS_IDS } from './domain.js'
+
+const order = new Map(STATUS_IDS.map((id, index) => [id, index]))
+
+/** 这张卡有没有返工，以及为什么。 */
+export function taskRework(task) {
+  const reasons = []
+  const history = Array.isArray(task?.history) ? task.history : []
+  let backwards = 0
+  for (let index = 1; index < history.length; index += 1) {
+    const from = order.get(String(history[index - 1]?.status ?? ''))
+    const to = order.get(String(history[index]?.status ?? ''))
+    if (from === undefined || to === undefined) continue
+    if (to < from) backwards += 1
+  }
+  // 返工只认「列往回退」——和效能页那个「一次通过率」KPI 用同一条定义（index.js 的 taskTimeline.backward），
+  // 两处数字必须能对上。AI 失败与缺陷重开单独给出来，但不进返工率。
+  if (backwards > 0) reasons.push(`被打回 ${backwards} 次`)
+  return {
+    rework: backwards > 0,
+    backwards,
+    failures: Number(task?.agentFailures) || 0,
+    reopens: Number(task?.reopenCount) || 0,
+    reasons,
+  }
+}
+
+const rate = (part, total) => (total > 0 ? Math.round((part / total) * 100) : null)
+
+/**
+ * 按专家汇总质量。runs 传 runSummary() 的结果（含 byExpert）。
+ * 只统计「有专家」的卡；没派过的卡不进分母。
+ */
+export function buildQuality(state, runs) {
+  const tasks = Array.isArray(state?.tasks) ? state.tasks : []
+  const perExpert = new Map()
+  const touch = key => {
+    if (!perExpert.has(key)) perExpert.set(key, { key, cards: 0, done: 0, rework: 0, firstPass: 0 })
+    return perExpert.get(key)
+  }
+  for (const task of tasks) {
+    const expertId = String(task.expert ?? task.dispatch?.expert ?? '')
+    if (expertId === '') continue
+    const row = touch(expertId)
+    row.cards += 1
+    const done = String(task.status) === 'done'
+    const { rework } = taskRework(task)
+    if (done) row.done += 1
+    if (rework) row.rework += 1
+    if (done && !rework) row.firstPass += 1
+  }
+  const runRows = (runs?.byExpert ?? []).map(item => ({ name: String(item.key ?? ''), runs: Number(item.runs) || 0, ms: Number(item.ms) || 0 }))
+  const runByName = new Map(runRows.map(item => [item.name.toLowerCase(), item]))
+  const experts = [...perExpert.values()].map(row => {
+    const info = (state?.config?.experts ?? []).find(item => item.id === row.key)
+    const label = info === undefined ? row.key : `${info.emoji ?? ''} ${info.name}`.trim()
+    const run = runByName.get(String(info?.name ?? row.key).toLowerCase())
+    return {
+      expert: row.key,
+      label,
+      dispatched: run?.runs ?? 0,
+      avgMs: run !== undefined && run.runs > 0 ? Math.round(run.ms / run.runs) : 0,
+      cards: row.cards,
+      done: row.done,
+      rework: row.rework,
+      firstPass: row.firstPass,
+      firstPassRate: rate(row.firstPass, row.done),
+      reworkRate: rate(row.rework, row.cards),
+    }
+  }).sort((a, b) => (b.dispatched - a.dispatched) || (b.cards - a.cards))
+
+  const sum = key => experts.reduce((total, item) => total + (item[key] ?? 0), 0)
+  const done = sum('done')
+  const firstPass = sum('firstPass')
+  const cards = sum('cards')
+  return {
+    experts,
+    totals: {
+      dispatched: sum('dispatched'),
+      cards,
+      done,
+      rework: sum('rework'),
+      firstPass,
+      firstPassRate: rate(firstPass, done),
+      reworkRate: rate(sum('rework'), cards),
+      failures: tasks.reduce((total, task) => total + (Number(task.agentFailures) || 0), 0),
+      reopens: tasks.reduce((total, task) => total + (Number(task.reopenCount) || 0), 0),
+      avgMs: (() => {
+        const totalMs = runRows.reduce((total, item) => total + item.ms, 0)
+        const totalRuns = runRows.reduce((total, item) => total + item.runs, 0)
+        return totalRuns > 0 ? Math.round(totalMs / totalRuns) : 0
+      })(),
+    },
+    cost: {
+      wired: false,
+      note: '成本还没接真实 token usage：平台目前只记录派单次数与耗时，没有按卡/按项目记账。接上 usage 之后这里才会有数字。',
+    },
+  }
+}

package/src/host/routes/admin.js

@@ -0,0 +1,100 @@
+import { sanitizeAccess } from '../domain.js'
+const INJECTED = ["applyConfig","checkToolAccess","operatorFromSessionId","operatorOf","publicState","readJsonBody","sendJson"]
+let host = {
+  applyConfig: () => {},
+  checkToolAccess: () => {},
+  operatorFromSessionId: () => {},
+  operatorOf: () => {},
+  publicState: () => {},
+  readJsonBody: () => {},
+  sendJson: () => {},
+}
+/** 配置、权限成员、审计与快照。宿主能力由 configureAdminRoutes() 注入。 */
+export function configureAdminRoutes(services) {
+  host = { ...host, ...(services ?? {}) }
+}
+
+export async function handleAdminRoute({ method, route, req, res, store, url }) {
+if (method === 'POST' && route === '/config') {
+  await host.applyConfig(store, await host.readJsonBody(req))
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/access/save') {
+  const body = await host.readJsonBody(req)
+  const member = body.member !== null && typeof body.member === 'object' ? body.member : null
+  await store.mutate(state => {
+    const access = state.config.access ?? { enabled: false, agents: 'inherit', members: [] }
+    const wasEnabled = access.enabled === true
+    if (typeof body.enabled === 'boolean') access.enabled = body.enabled
+    if (body.agents === 'inherit' || body.agents === 'bypass') access.agents = body.agents
+    if (member !== null) {
+      const name = String(member.name ?? '').trim()
+      if (name !== '') {
+        const key = name.toLowerCase()
+        const rest = access.members.filter(item => item.name.toLowerCase() !== key)
+        access.members = sanitizeAccess({ members: [...rest, member] }).members
+      }
+    }
+    // 刚打开权限时，把现有专家按「成员」自动登记：否则所有 AI 会在下一张卡上被自己人拦死。
+    if (wasEnabled !== true && access.enabled === true) {
+      const known = new Set(access.members.map(item => item.name.toLowerCase()))
+      for (const expert of state.config.experts ?? []) {
+        if (expert.enabled === false) continue
+        const name = String(expert.name ?? '').trim()
+        if (name === '' || known.has(name.toLowerCase())) continue
+        known.add(name.toLowerCase())
+        access.members.push({ name, role: 'member' })
+      }
+    }
+    state.config.access = access
+  })
+  host.sendJson(res, 200, { ok: true, access: store.snapshot().config.access, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/access/delete') {
+  const body = await host.readJsonBody(req)
+  const name = String(body.name ?? '').trim().toLowerCase()
+  await store.mutate(state => {
+    state.config.access.members = state.config.access.members.filter(item => item.name.toLowerCase() !== name)
+  })
+  host.sendJson(res, 200, { ok: true, access: store.snapshot().config.access, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/audit/clear') {
+  await store.mutate(state => { state.audit = [] })
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/access/explain') {
+  const body = await host.readJsonBody(req)
+  const config = store.snapshot().config
+  const sessionId = String(body.sessionId ?? '')
+  const tool = String(body.tool ?? '')
+  const resolved = host.operatorFromSessionId(sessionId, config)
+  const who = host.operatorOf(req)
+  const operator = resolved ?? { id: who, name: who }
+  const verdict = host.checkToolAccess(config, operator, tool)
+  host.sendJson(res, 200, {
+    ok: true,
+    operator,
+    tool,
+    level: verdict.level,
+    allowed: verdict.denial === null,
+    reason: verdict.denial ?? '',
+    mode: config?.access?.enabled === true ? (config.access.agents ?? 'inherit') : 'off',
+  })
+  return true
+}
+if (method === 'GET' && route === '/snapshots') {
+  host.sendJson(res, 200, { ok: true, storage: store.describe(), snapshots: store.snapshots() })
+  return true
+}
+if (method === 'POST' && route === '/snapshot/restore') {
+  const body = await host.readJsonBody(req)
+  await store.restoreSnapshot(String(body.id ?? ''))
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+  return true
+}
+  return false
+}

package/src/host/routes/agents.js

@@ -0,0 +1,71 @@
+import { ISOLATION_MODES, SANDBOX_MODES } from '../domain.js'
+const INJECTED = ["getDispatcher","publicState","readJsonBody","sendJson"]
+let host = {
+  getDispatcher: () => undefined,
+  publicState: () => {},
+  readJsonBody: () => {},
+  sendJson: () => {},
+}
+/** 派单运行态、策略与手动起停。宿主能力由 configureAgentsRoutes() 注入。 */
+export function configureAgentsRoutes(services) {
+  host = { ...host, ...(services ?? {}) }
+}
+
+export async function handleAgentsRoute({ method, route, req, res, store, url }) {
+if (method === 'GET' && route === '/agents') {
+  const dispatcher = host.getDispatcher()
+  host.sendJson(res, 200, dispatcher === undefined
+    ? { ok: false, error: 'dispatcher not available yet' }
+    : { ok: true, ...dispatcher.status() })
+  return true
+}
+if (method === 'GET' && route === '/agents/policy') {
+  const dispatcher = host.getDispatcher()
+  if (dispatcher === undefined) {
+    host.sendJson(res, 200, { ok: false, error: 'dispatcher not available yet' })
+    return true
+  }
+  const cfg = store.snapshot().config.agents
+  const live = []
+  for (const info of dispatcher.running.values()) {
+    let current = ''
+    try {
+      const agent = dispatcher.ctx.agents.get(info.sessionId)
+      current = String(dispatcher.ctx.permissionPresets.current(agent?.session))
+    } catch (error) {
+      current = `unknown: ${error?.message ?? error}`
+    }
+    live.push({ sessionId: info.sessionId, expert: info.expert, taskId: info.taskId, preset: current })
+  }
+  host.sendJson(res, 200, {
+    ok: true,
+    configured: {
+      sandbox: SANDBOX_MODES.includes(String(cfg.sandbox ?? '')) ? cfg.sandbox : 'workspace-write',
+      isolation: ISOLATION_MODES.includes(String(cfg.isolation ?? '')) ? cfg.isolation : 'none',
+      worktreeRoot: String(cfg.worktreeRoot ?? ''),
+      cleanupWorktree: String(cfg.cleanupWorktree ?? 'manual'),
+    },
+    isolation: cfg.isolation ?? 'none',
+    live,
+  })
+  return true
+}
+if (method === 'POST' && route === '/agents/run') {
+  const dispatcher = host.getDispatcher()
+  if (dispatcher === undefined) throw new Error('dispatcher not available yet')
+  const body = await host.readJsonBody(req)
+  await dispatcher.launchNow(String(body.id ?? ''), String(body.expert ?? ''))
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store), agents: dispatcher.status() })
+  return true
+}
+if (method === 'POST' && route === '/agents/stop') {
+  const dispatcher = host.getDispatcher()
+  if (dispatcher === undefined) throw new Error('dispatcher not available yet')
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  dispatcher.abortTask(id, body.expert === undefined ? undefined : String(body.expert))
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+  return true
+}
+  return false
+}

package/src/host/routes/auth.js

@@ -0,0 +1,155 @@
+import { hashLocalPassword, sanitizeLdap, sanitizeLocalAuth, verifyLocalPassword } from '../domain.js'
+
+let host = {
+  sendJson: () => {},
+  readJsonBody: async () => ({}),
+  recordAudit: async () => {},
+  recordLogin: async () => {},
+  issueSession: () => ({ token: '', expiresAt: 0 }),
+  sessionOf: () => null,
+  operatorOf: () => '',
+  ldapAuthenticate: async () => ({ ok: false }),
+  ldapLookup: async () => ({ ok: false, entries: [] }),
+  ldapAttr: () => '',
+  sessions: new Map(),
+  dropSession: () => {},
+  hasSessionStore: () => false,
+  publicState: () => ({}),
+}
+
+/** 统一登录相关路由。宿主能力由 configureAuthRoutes() 注入。 */
+export function configureAuthRoutes(services) {
+  host = { ...host, ...(services ?? {}) }
+}
+
+export async function handleAuthRoute({ method, route, req, res, store, url }) {
+  if (method === 'POST' && route === '/auth/login') {
+    const body = await host.readJsonBody(req)
+    const ip = String(req.socket?.remoteAddress ?? '')
+    const config = store.snapshot().config
+    const settings = sanitizeLdap(config.ldap ?? {})
+    /* 中文输入法会把 admin 打成全角 ａｄｍｉｎ，NFKC 归一后再比对，免得
+       用户明明敲对了却被告知口令不对（典型：口令框里混进全角字母/空格）。 */
+    const username = String(body.username ?? body.user ?? '').trim().normalize('NFKC')
+    const password = String(body.password ?? '').normalize('NFKC')
+    const wideChar = /[\uFF01-\uFF5E\u3000]/.test(String(body.password ?? ''))
+    // mode: local = 只试本地账号；ldap = 只试目录；'' = 先本地后目录（老调用方兼容）
+    const mode = String(body.mode ?? '').trim().toLowerCase()
+
+    /* 先试本地超管：没配 LDAP 时它是唯一账号，配了也能在目录故障时兜底。 */
+    const local = mode === 'ldap' ? { ok: false, reason: 'skipped' } : verifyLocalPassword(config.localAuth, username, password)
+    if (local.ok === true) {
+      const localUser = sanitizeLocalAuth(config.localAuth)
+      const user = { id: localUser.username, name: '超级管理员', role: 'admin', source: 'local', mail: '', dept: '' }
+      const session = host.issueSession(user, ip)
+      await host.recordAudit(store, { by: user.name, route, level: 'read', status: 200, ok: true, summary: `本地超管登录成功：${user.id}` })
+      host.sendJson(res, 200, { ok: true, token: session.token, expiresAt: session.expiresAt, user, state: host.publicState(store) })
+      return true
+    }
+
+    if (mode === 'local') {
+      const localUser = sanitizeLocalAuth(config.localAuth)
+      const hint =
+        local.reason === 'nouser'
+          ? `没有这个本地账号（本地超管是 ${localUser.username}）`
+          : local.reason === 'form'
+            ? '账号和密码都要填'
+            : wideChar
+              ? `口令里有全角字符（中文输入法打出来的），切到英文输入法再输一次；账号 ${localUser.username}${localUser.password === null ? '，默认口令是 admin' : ''}`
+              : `本地超管的账号或口令不对（账号 ${localUser.username}${localUser.password === null ? '，还没改过口令就是默认的 admin' : ''}）`
+      await host.recordAudit(store, { by: username === '' ? '匿名' : username.slice(0, 40), route, level: 'read', status: 401, ok: false, summary: `本地登录失败：${hint}` })
+      host.sendJson(res, 401, { ok: false, code: 'local', error: hint })
+      return true
+    }
+
+    const result = await host.ldapAuthenticate(settings, username, password)
+    if (result.ok !== true) {
+      const hint =
+        result.code === 'disabled' && local.reason === 'badpass'
+          ? `用户名或密码不对（本地超管账号是 ${sanitizeLocalAuth(config.localAuth).username}；LDAP 登录还没启用）`
+          : result.message
+      await host.recordAudit(store, { by: username === '' ? '匿名' : username.slice(0, 40), route, level: 'read', status: 401, ok: false, summary: `登录失败：${hint}` })
+      host.sendJson(res, 401, { ok: false, code: result.code, error: hint })
+      return true
+    }
+    await host.recordLogin(store, result.user, ip)
+    const session = host.issueSession(result.user, ip)
+    await host.recordAudit(store, { by: result.user.name, route, level: 'read', status: 200, ok: true, summary: `LDAP 登录成功：${result.user.id}` })
+    const saved = (store.snapshot().config.users ?? []).find(item => item.id === result.user.id) ?? {}
+    host.sendJson(res, 200, { ok: true, token: session.token, expiresAt: session.expiresAt, user: { ...result.user, ...saved }, state: host.publicState(store) })
+    return true
+  }
+  if (method === 'POST' && route === '/auth/password') {
+    const body = await host.readJsonBody(req)
+    const config = store.snapshot().config
+    const local = sanitizeLocalAuth(config.localAuth)
+    const username = String(body.username ?? local.username).trim().toLowerCase().normalize('NFKC')
+    const currentPassword = String(body.currentPassword ?? '').normalize('NFKC')
+    const check = verifyLocalPassword(local, username, currentPassword)
+    if (check.ok !== true) {
+      host.sendJson(res, 401, { ok: false, code: check.reason, error: check.reason === 'nouser' ? '没有这个本地账号' : '当前密码不对' })
+      return true
+    }
+    const next = String(body.newPassword ?? '').normalize('NFKC')
+    if (body.reset !== true && next.length < 8) {
+      host.sendJson(res, 400, { ok: false, error: '新密码至少 8 位' })
+      return true
+    }
+    if (body.reset !== true && next === currentPassword) {
+      host.sendJson(res, 400, { ok: false, error: '新密码和当前密码一样' })
+      return true
+    }
+    await store.mutate(state => {
+      const current = sanitizeLocalAuth(state.config.localAuth)
+      state.config.localAuth =
+        body.reset === true
+          ? { ...current, password: null, mustChange: true, updatedAt: Date.now() }
+          : { ...current, password: hashLocalPassword(next), mustChange: false, updatedAt: Date.now() }
+    })
+    await host.recordAudit(store, { by: host.operatorOf(req), route, level: 'admin', status: 200, ok: true, summary: body.reset === true ? '重置本地超管密码为默认' : '修改本地超管密码' })
+    host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+    return true
+  }
+  if (method === 'GET' && route === '/auth/me') {
+    const found = host.sessionOf(req, store.snapshot().config)
+    if (found === null) {
+      host.sendJson(res, 401, { ok: false, error: '没有登录或会话已过期' })
+      return true
+    }
+    host.sendJson(res, 200, { ok: true, user: found.user, expiresAt: found.session.expiresAt })
+    return true
+  }
+  if (method === 'POST' && route === '/auth/logout') {
+    const rawToken = req.headers['x-studio-session']
+    const token = String((Array.isArray(rawToken) ? rawToken[0] : rawToken) ?? '').trim()
+    if (token !== '') {
+      host.sessions.delete(token)
+      if (host.hasSessionStore()) host.dropSession(token)
+    }
+    host.sendJson(res, 200, { ok: true })
+    return true
+  }
+  if (method === 'POST' && route === '/auth/ldap/test') {
+    const body = await host.readJsonBody(req)
+    const config = store.snapshot().config
+    const settings = sanitizeLdap({ ...(config.ldap ?? {}), ...(body.ldap !== null && typeof body.ldap === 'object' ? body.ldap : {}) })
+    if (String(body.bindPassword ?? '') !== '') settings.bindPassword = String(body.bindPassword)
+    const steps = []
+    const started = Date.now()
+    const lookup = await host.ldapLookup(settings, String(body.username ?? '').trim() || '*')
+    steps.push({ name: '服务账号绑定并查询', ok: lookup.ok === true, message: lookup.ok === true ? `查到 ${lookup.entries.length} 条` : lookup.message, ms: Date.now() - started })
+    if (lookup.ok === true && lookup.entries.length > 0) {
+      const entry = lookup.entries[0]
+      steps.push({
+        name: '第一个命中的账号',
+        ok: true,
+        message: `${host.ldapAttr(entry, 'sAMAccountName') || host.ldapAttr(entry, 'uid') || '(无 sAMAccountName)'} · ${host.ldapAttr(entry, settings.nameAttr) || host.ldapAttr(entry, 'cn') || '(无显示名)'} · ${entry.dn}`,
+        ms: 0,
+      })
+    }
+    const ok = steps.every(step => step.ok === true)
+    host.sendJson(res, ok ? 200 : 400, { ok, steps, message: ok ? '连接正常，可以保存' : steps.find(step => step.ok !== true)?.message ?? '测试没通过' })
+    return true
+  }
+  return false
+}

package/src/host/routes/coding.js

@@ -0,0 +1,203 @@
+import { CODING_REVIEW_STATUS, cleanId, mergeCoding, sanitizeCoding } from '../domain.js'
+import { clearAgentFailure, noteAgentFailure } from '../dispatcher.js'
+import { codingVerifyLine, runCommand, taskExitGate, verifyCodingRecord } from '../executor.js'
+import { compareCodingFacts } from '../gitlab-facts.js'
+const INJECTED = ["applyConfig","ensureWorktree","publicState","readJsonBody","removeWorktree","sendJson","serviceOf","upsertById","workProjectOf"]
+let host = {
+  applyConfig: () => {},
+  ensureWorktree: () => {},
+  publicState: () => {},
+  readJsonBody: () => {},
+  removeWorktree: () => {},
+  sendJson: () => {},
+  serviceOf: () => {},
+  upsertById: () => {},
+  workProjectOf: () => {},
+}
+/** 执行记录核对、Agent 失败重试、worktree 与项目配置。宿主能力由 configureCodingRoutes() 注入。 */
+export function configureCodingRoutes(services) {
+  host = { ...host, ...(services ?? {}) }
+}
+
+export async function handleCodingRoute({ method, route, req, res, store, url }) {
+if (method === 'POST' && route === '/coding/gitlab') {
+  // 从 GitLab 核对：拉 MR + changes，和卡上自报的文件数/提交数比一遍，结果记进 coding.gitlab。
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  const snapshot = store.snapshot()
+  const task = snapshot.tasks.find(t => t.id === id)
+  if (task === undefined) throw new Error(`no task ${id}`)
+  const iid = Number(task.gitlabMR?.iid ?? 0)
+  if (iid <= 0) throw new Error('这张卡还没关联 MR：先提 MR，把 !iid 填进卡片的 GitLab 区块')
+  const config = snapshot.config
+  const projects = config.gitlab?.projects ?? []
+  const project = projects.find(item => item.id === task.gitlabProject) ?? projects[0]
+  if (project === undefined) throw new Error('还没配 GitLab 项目（设置 → 代码仓库）')
+  const mr = await host.gitlabRequest(config, project, `/merge_requests/${iid}`)
+  const detail = await host.gitlabMergeRequestDetail(config, project, iid)
+  const facts = compareCodingFacts(task.coding, mr, detail)
+  await store.mutate(state => {
+    const target = state.tasks.find(t => t.id === id)
+    if (target === undefined) return
+    target.coding = { ...(target.coding ?? {}), gitlab: facts }
+    target.updatedAt = Date.now()
+  })
+  host.sendJson(res, 200, { ok: true, facts, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/task/coding') {
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  const action = String(body.action ?? 'update')
+  const by = String(body.by ?? '人').slice(0, 40)
+  const snapshot = await store.mutate(state => {
+    const task = state.tasks.find(t => t.id === id)
+    if (task === undefined) throw new Error(`no task ${id}`)
+    if (action === 'clear') {
+      task.coding = null
+    } else if (action === 'review') {
+      const base = sanitizeCoding(task.coding ?? {})
+      const status = CODING_REVIEW_STATUS.includes(String(body.status)) ? String(body.status) : 'approved'
+      task.coding = sanitizeCoding({
+        ...base,
+        review: { status, by, at: Date.now(), note: String(body.note ?? '').slice(0, 600) },
+      })
+    } else if (action === 'merge') {
+      const base = sanitizeCoding(task.coding ?? {})
+      task.coding = sanitizeCoding({ ...base, mergedBy: by, mergedAt: Date.now() })
+    } else {
+      const patch = body.coding ?? body.patch ?? body
+      task.coding = mergeCoding(task.coding ?? null, patch)
+    }
+    task.updatedAt = Date.now()
+    return task
+  })
+  const task = snapshot.tasks.find(entry => entry.id === id)
+  host.sendJson(res, 200, { ok: true, task, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/task/coding/verify') {
+  // 拿 worktree 里的 git 事实核对执行记录：agent 说改了哪些提交/文件，真的在分支上吗。
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  const current = store.snapshot().tasks.find(entry => entry.id === id)
+  if (current === undefined) throw new Error(`no task ${id}`)
+  const report = await verifyCodingRecord(store.snapshot(), current)
+  if (report.skipped === undefined) {
+    await store.mutate(state => {
+      const task = state.tasks.find(entry => entry.id === id)
+      if (task !== undefined && task.coding !== null && task.coding !== undefined) {
+        task.coding = sanitizeCoding({ ...task.coding, verified: report })
+      }
+      return task
+    })
+  }
+  const state = store.snapshot()
+  const task = state.tasks.find(entry => entry.id === id)
+  host.sendJson(res, 200, {
+    ok: true,
+    report,
+    line: codingVerifyLine(report),
+    gate: taskExitGate(state, task),
+    task,
+    state: host.publicState(store),
+  })
+  return true
+}
+if (method === 'POST' && route === '/task/agent/fail') {
+  // 记一次 AI 失败（真失败时由派单器调用；也可由 agent 自己上报）。
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  const plan = await noteAgentFailure(store, id, String(body.error ?? 'AI 没有完成这一轮'), String(body.by ?? '系统').slice(0, 60))
+  if (plan === undefined) throw new Error(`no task ${id}`)
+  const state = store.snapshot()
+  const task = state.tasks.find(entry => entry.id === id)
+  host.sendJson(res, 200, { ok: true, plan, task, gate: taskExitGate(state, task), state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/task/agent/retry') {
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  const changed = await clearAgentFailure(store, id, String(body.by ?? '人').slice(0, 60))
+  if (!changed) throw new Error(`no task ${id}`)
+  const state = store.snapshot()
+  const task = state.tasks.find(entry => entry.id === id)
+  host.sendJson(res, 200, { ok: true, task, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/task/worktree') {
+  const body = await host.readJsonBody(req)
+  const id = String(body.id ?? '')
+  const action = String(body.action ?? 'create')
+  const snapshotNow = store.snapshot()
+  const task = snapshotNow.tasks.find(entry => entry.id === id)
+  if (task === undefined) throw new Error(`no task ${id}`)
+  if (action === 'remove') {
+    const result = await host.removeWorktree(store, task, snapshotNow.config)
+    host.sendJson(res, 200, { ok: result.ok, result, state: host.publicState(store) })
+    return true
+  }
+  if (action === 'list') {
+    const service = host.serviceOf(snapshotNow.config, task)
+    const project = host.workProjectOf(snapshotNow.config, task)
+    const repo = String(service?.repoPath ?? project?.repoPath ?? '').trim()
+    const listed = repo.length === 0
+      ? { ok: false, stdout: '', stderr: '项目没配本机代码目录' }
+      : await runCommand('git', ['-C', repo, 'worktree', 'list', '--porcelain'], 20000)
+    host.sendJson(res, 200, { ok: listed.ok, output: String(listed.stdout ?? ''), error: String(listed.stderr ?? ''), state: host.publicState(store) })
+    return true
+  }
+  const info = await host.ensureWorktree(store, task, snapshotNow.config)
+  host.sendJson(res, 200, {
+    ok: info?.path !== undefined,
+    worktree: info ?? null,
+    skipped: info?.skipped ?? '',
+    state: host.publicState(store),
+  })
+  return true
+}
+if (method === 'POST' && route === '/projects/save') {
+  const body = await host.readJsonBody(req)
+  const incoming = body.project ?? body
+  const existing = store.snapshot().config.projects
+  const wantedId = cleanId(incoming.id ?? incoming.name ?? incoming.key, 'proj')
+  const saved = existing.find(item => item.id === wantedId)
+  const merged = { ...incoming, id: wantedId, iterations: incoming.iterations ?? saved?.iterations ?? [] }
+  await host.applyConfig(store, { projects: host.upsertById(existing, merged) })
+  host.sendJson(res, 200, { ok: true, projects: store.snapshot().config.projects, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/projects/delete') {
+  const body = await host.readJsonBody(req)
+  const id = cleanId(body.id, 'proj')
+  await host.applyConfig(store, { projects: store.snapshot().config.projects.filter(entry => entry.id !== id) })
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+  return true
+}
+if (method === 'POST' && route === '/projects/iteration') {
+  const body = await host.readJsonBody(req)
+  const action = String(body.action ?? 'save')
+  const projectId = cleanId(body.project, 'proj')
+  const projects = store.snapshot().config.projects.map(project => {
+    if (project.id !== projectId) return project
+    if (action === 'remove') {
+      return { ...project, iterations: project.iterations.filter(item => item.id !== cleanId(body.iteration, 'iter')) }
+    }
+    const wantedId = cleanId(body.iteration ?? body.name, 'iter')
+    const saved = project.iterations.find(item => item.id === wantedId)
+    const merged = {
+      ...saved,
+      id: wantedId,
+      name: String(body.name ?? saved?.name ?? wantedId).slice(0, 60),
+      start: Number(body.start ?? saved?.start) || 0,
+      due: Number(body.due ?? saved?.due) || 0,
+      status: ['planned', 'active', 'closed'].includes(String(body.status)) ? String(body.status) : (saved?.status ?? 'planned'),
+    }
+    return { ...project, iterations: host.upsertById(project.iterations, merged) }
+  })
+  await host.applyConfig(store, { projects })
+  host.sendJson(res, 200, { ok: true, state: host.publicState(store) })
+  return true
+}
+  return false
+}