@modesto_ma/dsh-channels 0.5.0-beta.7 → 0.6.0

package/lib/index.js

@@ -7,7 +7,6 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { LoggerLevel, createLarkChannel } from "@larksuiteoapi/node-sdk";
 import { homedir } from "node:os";
-import { createServer } from "node:http";
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
 //#region src/access/policy.ts
@@ -7461,6 +7460,28 @@ var InboundRouter = class {
 		live.agent.followup(message);
 	}
 };
+//#endregion
+//#region src/analyze/contract.ts
+/**
+* Wire contract of the log-platform analyze API.
+*
+* `POST /api/dsh-channels.logalyze` on the DSH Web server, with
+* `Authorization: Bearer <token>`, an `Idempotency-Key` header, and a JSON
+* body naming the requester, the trigger time, the subject (application +
+* error code), the log-platform detail pages, the target group, and the
+* prompt. A valid request posts the analysis root card into the group and
+* answers `202`; the analysis then streams in a topic below that card. Log
+* packages are the prompt's business: the analysis skill fetches whatever the
+* prompt names, and the detail pages are only listed on the card.
+*
+* @module dsh-channels/analyze/contract
+*/
+/**
+* Exact DSH Web route of the analyze API. It follows the host's plain-HTTP
+* `/api/<name>.<method>` naming; an exact route wins over the `/api` RPC prefix
+* route, so the request carries this API's bearer token, not a DSH login.
+*/
+const ANALYZE_ROUTE = "/api/dsh-channels.logalyze";
 /** Largest accepted request body (the prompt dominates it). */
 const ANALYZE_MAX_BODY_BYTES = 1024 * 1024;
 /** Largest accepted prompt, in characters. */
@@ -7571,9 +7592,25 @@ var AnalyzeLauncher = class {
 	accepting = /* @__PURE__ */ new Map();
 	/** Background analyses still starting (drained on shutdown). */
 	running = /* @__PURE__ */ new Set();
+	/** Whether requests are admitted: from {@link open} after start until {@link close}. */
+	admitting = false;
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/**
+	* Start admitting requests. Called at channel start after
+	* {@link markInterrupted}, so a new request is never marked interrupted.
+	*/
+	open() {
+		this.admitting = true;
+	}
+	/** Stop admitting requests (503) ahead of shutdown. */
+	close() {
+		this.admitting = false;
+	}
+	enabled() {
+		return this.deps.config.analyzeEnabled;
+	}
 	async token() {
 		return await this.deps.resolveToken();
 	}
@@ -7596,16 +7633,18 @@ var AnalyzeLauncher = class {
 		}
 	}
 	/**
-	* Wait for every background analysis that is still starting. Called after
-	* `started` turns false, so each one ends on its failure card or, when its
-	* first prompt was already sent, as an ordinary topic.
+	* Wait for every acceptance in flight, then every background analysis that
+	* is still starting. Called after `started` turns false, so each one ends on
+	* its failure card or, when its first prompt was already sent, as an
+	* ordinary topic.
 	*/
 	async drain() {
+		await Promise.allSettled([...this.accepting.values()].map((pending) => pending.response));
 		await Promise.allSettled([...this.running]);
 	}
 	/**
 	* Mark every analysis still `running` as interrupted, on its card and in
-	* its record. Called at channel start before the listener opens, so each
+	* its record. Called at channel start before admission opens, so each
 	* such record belongs to a previous instance whose first turn never
 	* settled. A card that cannot be updated (deleted, recalled) is logged and
 	* still recorded as interrupted, so it is not retried on every start.
@@ -7625,7 +7664,7 @@ var AnalyzeLauncher = class {
 	async accept(request, key, bodyHash) {
 		const channel = this.deps.channel();
 		const domain = this.deps.domain();
-		if (!this.deps.started() || channel === void 0 || domain === void 0) return refused(503, "飞书渠道尚未连接，请稍后重试");
+		if (!this.admitting || !this.deps.started() || channel === void 0 || domain === void 0) return refused(503, "飞书渠道尚未连接，请稍后重试");
 		const stored = domain.analyzeRequests.get(key);
 		if (stored !== void 0) {
 			if (stored.bodyHash !== bodyHash) return reusedKey();
@@ -7852,168 +7891,6 @@ function reusedKey() {
 	return refused(409, "Idempotency-Key 已被内容不同的请求使用");
 }
 //#endregion
-//#region src/analyze/server.ts
-/**
-* The analyze API's dedicated HTTP listener.
-*
-* Serves exactly `POST /dsh-channels/analyze` (see `./contract.ts`) on the
-* `analyzeListen` address. This module owns the transport-level checks, in
-* order: path, method, bearer token, `Idempotency-Key`, media type, body size,
-* and JSON validation; everything after validation belongs to the
-* {@link AnalyzeHandler}. Bodies, tokens, and prompts are never logged.
-*
-* @module dsh-channels/analyze/server
-*/
-var HttpError$1 = class extends Error {
-	status;
-	constructor(status, message) {
-		super(message);
-		this.status = status;
-	}
-};
-function send(res, response) {
-	const body = JSON.stringify(response.body);
-	res.writeHead(response.status, {
-		"content-type": "application/json; charset=utf-8",
-		"cache-control": "no-store",
-		"content-length": Buffer.byteLength(body)
-	});
-	res.end(body);
-}
-function refuse(res, status, error, headers = {}) {
-	for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
-	send(res, {
-		status,
-		body: {
-			ok: false,
-			error
-		}
-	});
-}
-/** Constant-time token comparison over fixed-length digests. */
-function tokenMatches(presented, expected) {
-	return timingSafeEqual(createHash("sha256").update(presented).digest(), createHash("sha256").update(expected).digest());
-}
-/** The bearer credential of one request, or undefined. */
-function bearerOf(req) {
-	const header = req.headers.authorization;
-	if (header === void 0) return void 0;
-	return /^Bearer[ \t]+(\S+)[ \t]*$/iu.exec(header)?.[1];
-}
-/** Read the body up to {@link ANALYZE_MAX_BODY_BYTES}; larger bodies fail with 413. */
-async function readBody(req) {
-	const declared = Number(req.headers["content-length"]);
-	if (Number.isFinite(declared) && declared > 1048576) throw new HttpError$1(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = chunk;
-		size += buffer.length;
-		if (size > 1048576) throw new HttpError$1(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
-		chunks.push(buffer);
-	}
-	return Buffer.concat(chunks).toString("utf8");
-}
-/**
-* Handle one HTTP request against the analyze contract.
-* @param req - the incoming request.
-* @param res - its response.
-* @param handler - the business side.
-*/
-async function handleAnalyzeHttp(req, res, handler) {
-	if (new URL(req.url ?? "/", "http://analyze.invalid").pathname !== "/dsh-channels/analyze") {
-		refuse(res, 404, "未知路径");
-		return;
-	}
-	if ((req.method ?? "GET").toUpperCase() !== "POST") {
-		refuse(res, 405, "只接受 POST", { allow: "POST" });
-		return;
-	}
-	const expected = await handler.token();
-	if (expected === void 0 || expected === "") {
-		refuse(res, 503, "分析接口未配置访问令牌，请联系部署者配置 analyzeToken 引用的凭据");
-		return;
-	}
-	const presented = bearerOf(req);
-	if (presented === void 0 || !tokenMatches(presented, expected)) {
-		refuse(res, 401, "访问令牌无效", { "www-authenticate": "Bearer" });
-		return;
-	}
-	const idempotencyKey = req.headers["idempotency-key"];
-	if (typeof idempotencyKey !== "string" || !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
-		refuse(res, 400, "缺少或不合法的 Idempotency-Key 请求头（1-200 个可见 ASCII 字符）");
-		return;
-	}
-	if ((req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase() !== "application/json") {
-		refuse(res, 415, "Content-Type 必须是 application/json");
-		return;
-	}
-	let raw;
-	try {
-		raw = JSON.parse(await readBody(req));
-	} catch (error) {
-		if (error instanceof HttpError$1) {
-			refuse(res, error.status, error.message);
-			return;
-		}
-		refuse(res, 400, "请求体不是合法的 JSON");
-		return;
-	}
-	const parsed = parseAnalyzeRequest(raw);
-	if (!parsed.ok) {
-		refuse(res, 400, parsed.error);
-		return;
-	}
-	send(res, await handler.analyze(parsed.value, idempotencyKey));
-}
-/** Split `host:port` (`[v6]:port` allowed) into listen arguments. */
-function parseListenAddress(listen) {
-	const separator = listen.lastIndexOf(":");
-	return {
-		host: listen.slice(0, separator).replace(/^\[(.*)\]$/u, "$1"),
-		port: Number(listen.slice(separator + 1))
-	};
-}
-/**
-* Bind the analyze listener.
-* @param listen - `host:port` address (`analyzeListen`).
-* @param handler - the business side.
-* @param warn - diagnostics sink for unexpected handler failures.
-* @returns the bound server; rejects when the address cannot be bound.
-*/
-async function startAnalyzeServer(listen, handler, warn) {
-	const server = createServer((req, res) => {
-		handleAnalyzeHttp(req, res, handler).catch((error) => {
-			warn("dsh-channels: analyze request failed: %s", String(error));
-			if (!res.headersSent) refuse(res, 500, `分析请求处理失败：${String(error)}`);
-			else res.destroy();
-		});
-	});
-	const { host, port } = parseListenAddress(listen);
-	await new Promise((resolve, reject) => {
-		const onError = (error) => {
-			reject(error);
-		};
-		server.once("error", onError);
-		server.listen(port, host, () => {
-			server.off("error", onError);
-			resolve();
-		});
-	});
-	server.on("error", (error) => {
-		warn("dsh-channels: analyze listener error: %s", String(error));
-	});
-	return {
-		address: server.address(),
-		close: () => new Promise((resolve) => {
-			server.close(() => {
-				resolve();
-			});
-			server.closeIdleConnections();
-		})
-	};
-}
-//#endregion
 //#region src/session/repair.ts
 /**
 * In-flight turn snapshots and the startup repair pass.
@@ -8271,17 +8148,44 @@ function foldRequestPolicy(events) {
 		model
 	};
 }
+function sameModel(left, right) {
+	return left?.provider === right?.provider && left?.model === right?.model;
+}
+/**
+* Record one effective policy as the Agent's next-step selection. A policy
+* without a model keeps the current route, except right after a model
+* override is cleared, when the Agent's live options (deployment default)
+* supply it again. Without a resolvable provider and model nothing is recorded.
+*/
+function selectPolicy(model, agent, effort, target, modelCleared) {
+	const current = model.current();
+	const base = modelCleared && agent.options.provider !== void 0 && agent.options.model !== void 0 ? {
+		provider: agent.options.provider,
+		model: agent.options.model
+	} : current;
+	const provider = target?.provider ?? base?.provider;
+	const modelId = target?.model ?? base?.model;
+	if (provider === void 0 || provider === "" || modelId === void 0 || modelId === "") return;
+	model.select({
+		provider,
+		model: modelId,
+		...effort === void 0 ? {} : { reasoningEffort: effort }
+	});
+}
 /** Install the mutable request policy outside every other request wrapper. */
 function installRequestPolicy(agentCtx, config = {}) {
 	let effortOverride;
 	let modelOverride;
 	let disposed = false;
+	/** Last policy recorded through `agent.model`; undefined until the first selecting sync. */
+	let applied;
 	const configuredModel = config.provider !== void 0 && config.model !== void 0 ? {
 		provider: config.provider,
 		model: config.model
 	} : void 0;
-	const disposeListener = agentCtx.on("agent/request", async (_payload, next) => {
+	const disposeListener = agentCtx.on("agent/request", async (payload, next) => {
 		const request = await next();
+		if (payload.agent?.model !== void 0) return request;
 		const effort = effortOverride ?? config.effort;
 		const model = modelOverride ?? configuredModel;
 		if (effort === void 0 && model === void 0) return request;
@@ -8307,10 +8211,24 @@ function installRequestPolicy(agentCtx, config = {}) {
 				modelSource: modelOverride !== void 0 ? "session" : configuredModel !== void 0 ? "config" : "deployment-default"
 			};
 		},
-		sync(events) {
+		sync(events, agent, reconcile) {
 			const folded = foldRequestPolicy(events);
 			effortOverride = folded.effort;
 			modelOverride = folded.model;
+			const model = agent?.model;
+			if (agent === void 0 || model === void 0 || disposed) return;
+			const next = {
+				effort: effortOverride ?? config.effort,
+				model: modelOverride ?? configuredModel
+			};
+			const previous = applied ?? {
+				effort: void 0,
+				model: void 0
+			};
+			applied = next;
+			if (reconcile === void 0 && previous.effort === next.effort && sameModel(previous.model, next.model)) return;
+			const modelCleared = next.model === void 0 && (reconcile === "model" || previous.model !== void 0);
+			selectPolicy(model, agent, next.effort, next.model, modelCleared);
 		},
 		dispose() {
 			if (disposed) return;
@@ -8456,7 +8374,7 @@ var SessionManager = class {
 	}
 	/** Borrow one foreign live agent and mount this channel's scoped policy. */
 	async borrow(sessionId, agent) {
-		const borrowed = borrowLiveAgent(agent, this.mountRequestPolicy(agent.ctx, agent.session));
+		const borrowed = borrowLiveAgent(agent, this.mountRequestPolicy(agent.ctx, agent));
 		this.live.set(sessionId, borrowed);
 		await this.mountToolsFor(agent.ctx, sessionId);
 		return borrowed;
@@ -8490,13 +8408,13 @@ var SessionManager = class {
 		}
 	}
 	/** Mount one mutable Session-aware request policy outside every other wrapper. */
-	mountRequestPolicy(agentCtx, session) {
+	mountRequestPolicy(agentCtx, agent) {
 		const controller = installRequestPolicy(agentCtx, {
 			effort: this.deps.config.reasoningEffort,
 			provider: this.deps.config.provider,
 			model: this.deps.config.model
 		});
-		if (session !== void 0) controller.sync(session.snapshotEvents());
+		if (agent !== void 0) controller.sync(agent.session.snapshotEvents(), agent);
 		this.policies.set(agentCtx, controller);
 		return () => {
 			controller.dispose();
@@ -8507,7 +8425,7 @@ var SessionManager = class {
 	requestPolicy(agent) {
 		const controller = this.policies.get(agent.ctx);
 		if (controller === void 0) throw new Error("dsh-channels: request policy is not mounted for this Agent");
-		controller.sync(agent.session.snapshotEvents());
+		controller.sync(agent.session.snapshotEvents(), agent);
 		return controller;
 	}
 	/**
@@ -12638,7 +12556,7 @@ async function read$1(kit, sessionId, rawArgs, signal) {
 		};
 	});
 }
-function json(value) {
+function json$1(value) {
 	return preview(JSON.stringify(value) ?? "null", 120);
 }
 function cardLines$1(operations, tableName) {
@@ -12646,7 +12564,7 @@ function cardLines$1(operations, tableName) {
 		const n = `${index + 1}.`;
 		switch (operation.command) {
 			case "create": {
-				const sample = operation.records.slice(0, CARD_PREVIEW_RECORDS).map((record) => `　${json(record)}`);
+				const sample = operation.records.slice(0, CARD_PREVIEW_RECORDS).map((record) => `　${json$1(record)}`);
 				const more = operation.records.length > CARD_PREVIEW_RECORDS ? [`　…（共 ${operation.records.length} 条）`] : [];
 				return [
 					`${n} 新增 ${operation.records.length} 条记录`,
@@ -12655,7 +12573,7 @@ function cardLines$1(operations, tableName) {
 				].join("\n");
 			}
 			case "update": {
-				const sample = operation.records.slice(0, CARD_PREVIEW_RECORDS).map((record) => `　${preview(record.record_id, 40)}：${json(record.fields)}`);
+				const sample = operation.records.slice(0, CARD_PREVIEW_RECORDS).map((record) => `　${preview(record.record_id, 40)}：${json$1(record.fields)}`);
 				const more = operation.records.length > CARD_PREVIEW_RECORDS ? [`　…（共 ${operation.records.length} 条）`] : [];
 				return [
 					`${n} 修改 ${operation.records.length} 条记录`,
@@ -14241,7 +14159,7 @@ function foldHealthSnapshot(input) {
 	const connectionState = input.connection?.state;
 	let level;
 	if (!input.started || dependencyMissing || connectionState === "failed" || fibers.failed > 0) level = "unhealthy";
-	else if (connectionState !== "connected" || fibers.pending > 0 || fibers.loading > 0 || fibers.unloading > 0 || input.analyzeListenError !== void 0) level = "degraded";
+	else if (connectionState !== "connected" || fibers.pending > 0 || fibers.loading > 0 || fibers.unloading > 0) level = "degraded";
 	else level = "healthy";
 	const reasons = [];
 	if (!input.started) reasons.push("飞书通道尚未启动");
@@ -14256,7 +14174,6 @@ function foldHealthSnapshot(input) {
 		const stalledLabels = inactive.filter((issue) => issue.state === "pending" || issue.state === "loading" || issue.state === "unloading").map((issue) => issue.label);
 		reasons.push(`宿主其它插件仍有 ${stalled} 个入口在等待依赖或加载/卸载（与飞书通道无关）` + (stalledLabels.length === 0 ? "" : `：${labelList(stalledLabels, stalled)}`));
 	}
-	if (input.analyzeListenError !== void 0) reasons.push(`日志分析接口监听失败：${input.analyzeListenError}`);
 	return {
 		level,
 		fibers,
@@ -14267,7 +14184,6 @@ function foldHealthSnapshot(input) {
 		routeCount: input.routeCount,
 		liveAgentCount: input.liveAgentCount,
 		inflightTurnCount: input.inflightTurnCount,
-		...input.analyzeListenError === void 0 ? {} : { analyzeListenError: input.analyzeListenError },
 		inactiveFibers: inactive,
 		inactiveTotal,
 		reasons
@@ -14319,11 +14235,7 @@ function buildHealthCard(snapshot) {
 		{
 			tag: "markdown",
 			content: `**dsh-channels**\n${snapshot.started ? "started" : "stopped"} · 持久化路由 ${snapshot.routeCount} · live Agent ${snapshot.liveAgentCount} · in-flight turn ${snapshot.inflightTurnCount}`
-		},
-		...snapshot.analyzeListenError === void 0 ? [] : [{
-			tag: "markdown",
-			content: `**日志分析接口**\n❌ 监听失败：${snapshot.analyzeListenError}`
-		}]
+		}
 	]);
 }
 //#endregion
@@ -15238,7 +15150,7 @@ var TurnStreamer = class {
 		const fold = this.folds.get(session.id);
 		if (fold !== void 0) foldEvent(fold, event);
 		this.sessions.set(session.id, session);
-		const parentId = session.header.parentSession;
+		const parentId = session.header.origin === "subagent" ? session.header.parentSession : void 0;
 		if (parentId !== void 0) {
 			const parentState = this.front(parentId);
 			if (parentState !== void 0) {
@@ -15985,8 +15897,6 @@ const DEFAULT_TOPIC_MESSAGES_TIMEOUT_MS = 2e4;
 const DEFAULT_PROMPT_CONTEXT_TIMEOUT_MS = 3e3;
 /** Conventional credential reference holding the log-platform analyze API bearer token. */
 const DEFAULT_ANALYZE_TOKEN_REF = "DSH_CHANNELS_ANALYZE_TOKEN";
-/** `host:port` listen address of the analyze API (`[v6]:port` for IPv6 literals). */
-const ANALYZE_LISTEN_PATTERN = /^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9.-]+):(?:[1-9][0-9]{0,4})$/u;
 /** A credential reference: `FEISHU_APP_ID`-style name resolved through ctx.credentials. */
 const credentialRefSchema = z.string().regex(CREDENTIAL_REF_PATTERN, "must be a credential reference name such as FEISHU_APP_ID (resolved through the dsh credentials seam, e.g. $DSH_HOME/.credentials.yaml) — plaintext secrets are not accepted");
 const configSchema = z.object({
@@ -16318,13 +16228,11 @@ const configSchema = z.object({
 	*/
 	questionTimeoutMs: z.number().int().min(1e4).max(36e5).default(DEFAULT_QUESTION_TIMEOUT_MS),
 	/**
-	* Listen address (`host:port`, e.g. `0.0.0.0:3090`) of the log-platform
-	* analyze API: a dedicated HTTP listener serving only
-	* `POST /dsh-channels/analyze`, separate from the DSH Web port. Unset
-	* (default) keeps the API off. The listener runs while the Feishu connection
-	* is up and is rebound on reconnect.
+	* Switch for the log-platform analyze API (`POST /api/dsh-channels.logalyze`
+	* on the DSH Web server). Off (default) answers 404; read per request, so
+	* toggling it needs no reconnect. Needs a host with a Web server.
 	*/
-	analyzeListen: z.string().trim().regex(ANALYZE_LISTEN_PATTERN, "must be host:port, e.g. 0.0.0.0:3090 or 127.0.0.1:3090").refine((value) => Number(value.slice(value.lastIndexOf(":") + 1)) <= 65535, "port must be 1-65535").optional(),
+	analyzeEnabled: z.boolean().default(false),
 	/**
 	* Credential reference holding the analyze API bearer token (defaults to
 	* `DSH_CHANNELS_ANALYZE_TOKEN`). Resolved per request, so rotating the value
@@ -16364,29 +16272,45 @@ function resolveConfig(raw) {
 *
 * @module dsh-channels/settings/contract
 */
-/** Same-origin routes the settings panel talks to. */
-const STATUS_ROUTE = "/dsh-channels/status";
-const PANEL_ROUTE = "/dsh-channels/panel";
-const CONFIG_ROUTE = "/dsh-channels/config";
-const CREDENTIALS_ROUTE = "/dsh-channels/credentials";
+/**
+* Settings panel routes: exact DSH `/api` Fetch routes named
+* `/api/dsh-channels.<method>`. Reads are GET; every write is POST, because
+* DSH exact `/api` routes accept only GET, HEAD, and POST.
+*/
+const STATUS_ROUTE = "/api/dsh-channels.status";
+const PANEL_ROUTE = "/api/dsh-channels.panel";
+/** Persist a partial config edit (POST, body `{ values }`). */
+const SAVE_CONFIG_ROUTE = "/api/dsh-channels.saveConfig";
+/** Drop every Web override (POST, no body). */
+const CLEAR_CONFIG_ROUTE = "/api/dsh-channels.clearConfig";
+/** Store credential values (POST, body `SaveCredentialsRequest`). */
+const SAVE_CREDENTIALS_ROUTE = "/api/dsh-channels.saveCredentials";
+/** Remove one stored credential (POST, body `{ field }`). */
+const CLEAR_CREDENTIAL_ROUTE = "/api/dsh-channels.clearCredential";
 /**
 * Connection lifecycle action (POST). While the channel runs it restarts the
 * long connection; while it is stopped it opens one — so the panel has exactly
 * one "connect / reconnect" button. Credentials are resolved again either way.
 */
-const RECONNECT_ROUTE = "/dsh-channels/reconnect";
+const RECONNECT_ROUTE = "/api/dsh-channels.reconnect";
 /** 模型/推理档位/预设选择器的宿主目录（provider → model → effort 级联刷新）。 */
-const CATALOG_ROUTE = "/dsh-channels/catalog";
-/** 访问与授权只读快照（GET/HEAD）：准入模式、管理员、群/用户/知识库白名单、待处理申请。 */
-const ACCESS_ROUTE = "/dsh-channels/access";
-/** 群白名单增删（POST/DELETE，body `{ chatId, name? }` / `{ chatId }`）。 */
-const ACCESS_GROUPS_ROUTE = "/dsh-channels/access/groups";
-/** 用户白名单增删（POST/DELETE，body `{ userId, name? }` / `{ userId }`）。 */
-const ACCESS_USERS_ROUTE = "/dsh-channels/access/users";
-/** 知识库白名单增删（POST/DELETE，body `{ userId, name? }` / `{ userId }`）。 */
-const ACCESS_WIKI_USERS_ROUTE = "/dsh-channels/access/wiki-users";
+const CATALOG_ROUTE = "/api/dsh-channels.catalog";
+/** 访问与授权只读快照（GET）：准入模式、管理员、群/用户/知识库白名单、待处理申请。 */
+const ACCESS_ROUTE = "/api/dsh-channels.access";
+/** 授权一个群（POST，body `{ chatId, name? }`）。 */
+const ADD_ACCESS_GROUP_ROUTE = "/api/dsh-channels.addAccessGroup";
+/** 撤销一个群（POST，body `{ chatId }`）。 */
+const REMOVE_ACCESS_GROUP_ROUTE = "/api/dsh-channels.removeAccessGroup";
+/** 用户白名单添加（POST，body `{ userId, name? }`）。 */
+const ADD_ACCESS_USER_ROUTE = "/api/dsh-channels.addAccessUser";
+/** 用户白名单移除（POST，body `{ userId }`）。 */
+const REMOVE_ACCESS_USER_ROUTE = "/api/dsh-channels.removeAccessUser";
+/** 知识库白名单添加（POST，body `{ userId, name? }`）。 */
+const ADD_WIKI_USER_ROUTE = "/api/dsh-channels.addWikiUser";
+/** 知识库白名单移除（POST，body `{ userId }`）。 */
+const REMOVE_WIKI_USER_ROUTE = "/api/dsh-channels.removeWikiUser";
 /** 结算一条待处理授权申请（POST，body `{ token, decision }`）。 */
-const ACCESS_REQUESTS_ROUTE = "/dsh-channels/access/requests";
+const RESOLVE_ACCESS_REQUEST_ROUTE = "/api/dsh-channels.resolveAccessRequest";
 /**
 * 打开宿主机的系统目录选择框（POST，无请求体），返回绝对路径。
 *
@@ -16394,15 +16318,15 @@ const ACCESS_REQUESTS_ROUTE = "/dsh-channels/access/requests";
 * 会注册实际选择逻辑；远程/无头会话的 browse 后端不可用，面板不下发
 * [`EditableFieldWire.browse`]，保留手写输入。
 */
-const PICK_DIRECTORY_ROUTE = "/dsh-channels/pick-directory";
-/** 会话的飞书来源（GET/HEAD，`?sessionId=`）：对话右侧栏「飞书来源」标签与会话头部入口使用。 */
-const SESSION_ORIGIN_ROUTE = "/dsh-channels/session-origin";
+const PICK_DIRECTORY_ROUTE = "/api/dsh-channels.pickDirectory";
+/** 会话的飞书来源（GET，`?sessionId=`）：对话右侧栏「飞书来源」标签与会话头部入口使用。 */
+const SESSION_ORIGIN_ROUTE = "/api/dsh-channels.sessionOrigin";
 /**
 * `GET PROFILES_ROUTE?users=<user_id,...>&chats=<chat_id,...>`: live Feishu
 * names and avatars for the users and chats the panel shows. At most
 * {@link PROFILES_MAX_IDS} ids per list.
 */
-const PROFILES_ROUTE = "/dsh-channels/profiles";
+const PROFILES_ROUTE = "/api/dsh-channels.profiles";
 /**
 * 可由 Web 面板覆盖的配置项。顶层键对应 `src/config.ts` 的字段；`feishuTools.*`
 * 是嵌套字段（覆盖层里仍写成 `{ "feishuTools": { ... } }` 对象）。覆盖值写进
@@ -16410,7 +16334,7 @@ const PROFILES_ROUTE = "/dsh-channels/profiles";
 * `cordis.patch.yml`（见 README「Web 设置面板」）。
 *
 * 刻意不包含 `appId` / `appSecret`：它们是**凭据引用名**，面板改为直接
-* 编辑引用背后的值（`PUT /dsh-channels/credentials`，经 DSH 凭据服务写入），
+* 编辑引用背后的值（`POST /api/dsh-channels.saveCredentials`，经 DSH 凭据服务写入），
 * 因此不会落进覆盖层文件。
 *
 * `baseDir`（工作区根目录 = 模型/工具产生文件的落点）可覆盖，但面板只接受
@@ -16460,7 +16384,7 @@ const EDITABLE_KEYS = [
 	"feishuTools.wikiRead",
 	"feishuTools.wikiWrite",
 	"wikiRoots",
-	"analyzeListen",
+	"analyzeEnabled",
 	"loggerLevel"
 ];
 /**
@@ -16471,7 +16395,6 @@ const RESTART_KEYS = [
 	"dmMode",
 	"requireMention",
 	"slashCommandPanel",
-	"analyzeListen",
 	"refreshMs",
 	"statusRefreshMs",
 	"loggerLevel"
@@ -17076,10 +16999,6 @@ var FeishuService = class {
 	inbound;
 	/** Log-platform analyze API business side (requests → shared analysis topics). */
 	analyzeLauncher;
-	/** Bound analyze listener while connected with `analyzeListen` set. */
-	analyzeServer;
-	/** Why the analyze listener could not bind at the last connect. */
-	analyzeListenError;
 	/** Agent/session lifecycle: live registry, resume, presets, renew. */
 	sessions;
 	/**
@@ -17628,6 +17547,10 @@ var FeishuService = class {
 			this.restarting = false;
 		}
 	}
+	/** The analyze API's business side, for the Web route. */
+	analyzeHandler() {
+		return this.analyzeLauncher;
+	}
 	isRunning() {
 		return this.started;
 	}
@@ -18316,7 +18239,7 @@ var FeishuService = class {
 		this.runScopeCheck(channel, appId, ownerLookup);
 		if (this.config.slashCommandPanel) this.runSlashCommandSync(channel);
 		await this.analyzeLauncher.markInterrupted();
-		await this.openAnalyzeListener();
+		this.analyzeLauncher.open();
 		this.repair.repairAll().catch((error) => {
 			this.ctx.logger?.warn?.("dsh-channels: inflight repair failed: %s", String(error));
 		});
@@ -18348,29 +18271,10 @@ var FeishuService = class {
 		const questionsMounted = this.ctx.get?.("userQuestions") !== void 0;
 		console.info(questionsMounted ? `[dsh-channels] ask_user_question 应答已就绪（提问卡片超时 ${this.config.questionTimeoutMs} ms）` : "[dsh-channels] 主机未挂载 userQuestions 服务，结构化提问应答关闭");
 	}
-	/**
-	* Bind the analyze listener when `analyzeListen` is set. A bind failure is
-	* logged and folded into the health snapshot (panel reasons, `/health`); the Feishu connection stays up.
-	*/
-	async openAnalyzeListener() {
-		this.analyzeListenError = void 0;
-		const listen = this.config.analyzeListen;
-		if (listen === void 0) return;
-		try {
-			this.analyzeServer = await startAnalyzeServer(listen, this.analyzeLauncher, (message, ...args) => this.ctx.logger?.warn?.(message, ...args));
-			console.info("[dsh-channels] 日志分析接口已监听", listen);
-		} catch (error) {
-			this.analyzeListenError = messageOf$3(error);
-			this.ctx.logger?.error?.("dsh-channels: analyze listener on %s failed: %s", listen, this.analyzeListenError);
-			console.error("[dsh-channels] 日志分析接口监听失败:", listen, error);
-		}
-	}
 	/** Tear down: close the connection and dispose all live agents. */
 	async shutdown() {
 		this.started = false;
-		const analyzeServer = this.analyzeServer;
-		this.analyzeServer = void 0;
-		await analyzeServer?.close();
+		this.analyzeLauncher.close();
 		await this.analyzeLauncher.drain();
 		for (const controller of this.commandControllers) controller.abort();
 		await Promise.allSettled([...this.commandOperations]);
@@ -19053,8 +18957,9 @@ var FeishuService = class {
 	/** Render one settled agent-plane command result. */
 	async renderCommandResult(input) {
 		const { spec, msg, current, live, result, compactBefore, renewAdmission, effortAdmission, modelAdmission } = input;
-		if (spec.name === "effort") effortAdmission?.controller.sync(live.agent.session.snapshotEvents());
-		if (spec.name === "model") modelAdmission?.controller.sync(live.agent.session.snapshotEvents());
+		const reconcile = !input.bare && result.kind === "success" ? spec.name : void 0;
+		if (spec.name === "effort") effortAdmission?.controller.sync(live.agent.session.snapshotEvents(), live.agent, reconcile === "effort" ? "effort" : void 0);
+		if (spec.name === "model") modelAdmission?.controller.sync(live.agent.session.snapshotEvents(), live.agent, reconcile === "model" ? "model" : void 0);
 		if (input.bare && result.kind === "success") {
 			const picker = spec.name === "model" && modelAdmission !== void 0 ? await this.modelPicker(current, live, modelAdmission) : spec.name === "effort" && effortAdmission !== void 0 ? await this.effortPicker(current, live, effortAdmission, result.text ?? "") : void 0;
 			if (picker !== void 0) {
@@ -19251,8 +19156,7 @@ var FeishuService = class {
 			started: this.started,
 			routeCount: this.routes.size(),
 			liveAgentCount: this.sessions.liveCount(),
-			inflightTurnCount,
-			...this.analyzeListenError === void 0 ? {} : { analyzeListenError: this.analyzeListenError }
+			inflightTurnCount
 		});
 	}
 	/**
@@ -19565,10 +19469,11 @@ var FeishuService = class {
 /** The model route the next request of a Session uses, as far as it is known. */
 function currentModelRoute(live, controller) {
 	const state = controller.state;
+	const selected = live.agent.model?.current();
 	const header = live.agent.session.requestHeader?.()?.config;
 	return {
-		provider: state.effectiveModel?.provider ?? (typeof header?.provider === "string" && header.provider !== "" ? header.provider : void 0),
-		model: state.effectiveModel?.model ?? (typeof header?.model === "string" && header.model !== "" ? header.model : void 0)
+		provider: state.effectiveModel?.provider ?? selected?.provider ?? (typeof header?.provider === "string" && header.provider !== "" ? header.provider : void 0),
+		model: state.effectiveModel?.model ?? selected?.model ?? (typeof header?.model === "string" && header.model !== "" ? header.model : void 0)
 	};
 }
 /** `**当前模型**：…` line shared by the `/model` text answer and its picker. */
@@ -19584,463 +19489,338 @@ const MAX_BODY_BYTES = 64 * 1024;
 function messageOf$2(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-var HttpError = class extends Error {
+var HttpError$1 = class extends Error {
 	status;
 	constructor(status, message) {
 		super(message);
 		this.status = status;
 	}
 };
-function methodOf(req) {
-	return (req.method ?? "GET").toUpperCase();
-}
-function sendJson(res, status, payload) {
-	const body = JSON.stringify(payload);
-	res.writeHead(status, {
-		"content-type": "application/json; charset=utf-8",
-		"cache-control": "no-store",
-		"content-length": Buffer.byteLength(body)
-	});
-	res.end(body);
-}
-/** Reject non-allowed methods with 405 + Allow, returning false. */
-function allowOnly(req, res, allowed) {
-	const method = methodOf(req);
-	if (allowed.includes(method)) return true;
-	const body = JSON.stringify({
-		ok: false,
-		error: `方法 ${method} 不受支持`
-	});
-	res.writeHead(405, {
-		allow: allowed.join(", "),
-		"content-type": "application/json; charset=utf-8",
-		"cache-control": "no-store",
-		"content-length": Buffer.byteLength(body)
+function json(status, payload) {
+	return new Response(JSON.stringify(payload), {
+		status,
+		headers: {
+			"content-type": "application/json; charset=utf-8",
+			"cache-control": "no-store"
+		}
 	});
-	res.end(body);
-	return false;
 }
-/**
-* Mutating requests must come from this same origin. Missing Origin is allowed
-* (non-browser local clients, e.g. curl); a present-but-mismatched Origin is
-* a cross-site write and is refused.
-*/
-function isSameOriginRequest(req) {
-	const origin = req.headers.origin;
-	if (origin === void 0 || origin === "") return true;
-	const host = req.headers.host;
-	if (host === void 0) return false;
-	try {
-		return new URL(origin).host === host;
-	} catch {
-		return false;
-	}
-}
-async function readJsonBody(req) {
-	if ((req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase() !== "application/json") throw new HttpError(415, "请求体必须是 application/json");
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
-		size += buffer.length;
-		if (size > MAX_BODY_BYTES) throw new HttpError(413, "请求体过大");
-		chunks.push(buffer);
-	}
-	if (size === 0) throw new HttpError(400, "请求体为空");
+/** Parse a JSON-object body; malformed bodies throw {@link HttpError} (415/413/400). */
+async function readJsonObject(request) {
+	if ((request.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase() !== "application/json") throw new HttpError$1(415, "请求体必须是 application/json");
+	const text = await request.text();
+	if (Buffer.byteLength(text) > MAX_BODY_BYTES) throw new HttpError$1(413, "请求体过大");
+	if (text === "") throw new HttpError$1(400, "请求体为空");
+	let body;
 	try {
-		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		body = JSON.parse(text);
 	} catch {
-		throw new HttpError(400, "请求体不是合法 JSON");
+		throw new HttpError$1(400, "请求体不是合法 JSON");
 	}
+	if (typeof body !== "object" || body === null || Array.isArray(body)) throw new HttpError$1(400, "请求体必须是 JSON 对象");
+	return body;
 }
 /** Distinct non-empty entries of one comma-separated id query parameter. */
 function idList(raw) {
 	if (raw === null) return [];
 	return [...new Set(raw.split(",").map((id) => id.trim()).filter((id) => id !== ""))];
 }
-/**
-* Parse one JSON-object body for an access write. HttpErrors are answered
-* here (415/413/400); `undefined` means "already responded, stop".
-*/
-async function readAccessBody(req, res) {
-	let body;
-	try {
-		body = await readJsonBody(req);
-	} catch (error) {
-		if (error instanceof HttpError) {
-			sendJson(res, error.status, {
-				ok: false,
-				error: error.message
-			});
-			return;
-		}
-		throw error;
-	}
-	if (typeof body !== "object" || body === null || Array.isArray(body)) {
-		sendJson(res, 400, {
-			ok: false,
-			error: "请求体必须是 JSON 对象"
-		});
-		return;
-	}
-	return body;
+/** A write's answer: 200 on success, 400 for a refusal the body explains. */
+function result(outcome) {
+	return json(outcome.ok ? 200 : 400, outcome);
 }
-/**
-* Wrap a handler so the host gate runs before anything else and thrown
-* errors become JSON instead of a dropped socket.
-*/
-function guardedBy(gate, handler) {
-	return async (req, res) => {
-		const rejection = gate.requestRejection(req);
-		if (rejection !== void 0) {
-			sendJson(res, rejection, {
-				ok: false,
-				error: rejection === 401 ? "未登录 DSH，请从 DSH 启动链接打开页面" : "请求来源不受信任"
-			});
-			return;
-		}
+/** Turn thrown errors into JSON answers instead of a dropped request. */
+function answered(handler) {
+	return async (request) => {
 		try {
-			await handler(req, res);
+			return await handler(request);
 		} catch (error) {
-			if (res.headersSent) {
-				res.end();
-				return;
-			}
-			sendJson(res, error instanceof HttpError ? error.status : 500, {
+			if (error instanceof HttpError$1) return json(error.status, {
 				ok: false,
-				error: error instanceof HttpError ? error.message : `内部错误：${messageOf$2(error)}`
+				error: error.message
+			});
+			return json(500, {
+				ok: false,
+				error: `内部错误：${messageOf$2(error)}`
 			});
 		}
 	};
 }
-function forbiddenWrite(res) {
-	sendJson(res, 403, {
-		ok: false,
-		error: "跨站写入被拒绝（Origin 与 Host 不一致）"
+/**
+* Register the panel routes.
+* @param connection - the host `connection` service.
+* @param surface - the panel's business side.
+* @returns disposer removing every route.
+*/
+function registerSettingsRoutes(connection, surface) {
+	const get = (path, handler) => ({
+		path,
+		methods: ["GET"],
+		requestBody: "buffered",
+		fetch: answered((request) => handler(new URL(request.url)))
+	});
+	const post = (path, handler) => ({
+		path,
+		methods: ["POST"],
+		requestBody: "buffered",
+		fetch: answered(handler)
 	});
-}
-/** Register the panel routes; the returned disposer removes all of them. */
-function registerSettingsRoutes(server, gate, surface) {
-	const guarded = (handler) => guardedBy(gate, handler);
 	const disposers = [
-		server.register({
-			kind: "exact",
-			path: STATUS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
-				if (methodOf(req) === "HEAD") {
-					res.writeHead(200, { "cache-control": "no-store" });
-					res.end();
-					return;
-				}
-				sendJson(res, 200, await surface.status());
-			})
-		}),
-		server.register({
-			kind: "exact",
-			path: PANEL_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
-				if (methodOf(req) === "HEAD") {
-					res.writeHead(200, { "cache-control": "no-store" });
-					res.end();
-					return;
-				}
-				sendJson(res, 200, await surface.panel());
-			})
-		}),
-		server.register({
-			kind: "exact",
-			path: CATALOG_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
-				if (methodOf(req) === "HEAD") {
-					res.writeHead(200, { "cache-control": "no-store" });
-					res.end();
-					return;
-				}
-				const url = new URL(req.url ?? "/", "http://dsh.local");
-				sendJson(res, 200, await surface.catalogFor(url.searchParams.get("provider") ?? void 0, url.searchParams.get("model") ?? void 0));
-			})
+		get(STATUS_ROUTE, async () => json(200, await surface.status())),
+		get(PANEL_ROUTE, async () => json(200, await surface.panel())),
+		get(CATALOG_ROUTE, async (url) => json(200, await surface.catalogFor(url.searchParams.get("provider") ?? void 0, url.searchParams.get("model") ?? void 0))),
+		get(SESSION_ORIGIN_ROUTE, async (url) => {
+			const sessionId = url.searchParams.get("sessionId")?.trim();
+			if (sessionId === void 0 || sessionId === "") return json(400, {
+				ok: false,
+				error: "缺少 sessionId 参数"
+			});
+			return json(200, await surface.sessionOrigin(sessionId));
 		}),
-		server.register({
-			kind: "exact",
-			path: SESSION_ORIGIN_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
-				if (methodOf(req) === "HEAD") {
-					res.writeHead(200, { "cache-control": "no-store" });
-					res.end();
-					return;
-				}
-				const sessionId = new URL(req.url ?? "/", "http://dsh.local").searchParams.get("sessionId")?.trim();
-				if (sessionId === void 0 || sessionId === "") {
-					sendJson(res, 400, {
-						ok: false,
-						error: "缺少 sessionId 参数"
-					});
-					return;
-				}
-				sendJson(res, 200, await surface.sessionOrigin(sessionId));
-			})
+		get(PROFILES_ROUTE, async (url) => {
+			const userIds = idList(url.searchParams.get("users"));
+			const chatIds = idList(url.searchParams.get("chats"));
+			if (userIds.length > 200 || chatIds.length > 200) return json(400, {
+				ok: false,
+				error: `每次最多查询 200 个用户和 200 个群`
+			});
+			return json(200, await surface.feishuProfiles(userIds, chatIds));
 		}),
-		server.register({
-			kind: "exact",
-			path: PROFILES_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
-				if (methodOf(req) === "HEAD") {
-					res.writeHead(200, { "cache-control": "no-store" });
-					res.end();
-					return;
-				}
-				const params = new URL(req.url ?? "/", "http://dsh.local").searchParams;
-				const userIds = idList(params.get("users"));
-				const chatIds = idList(params.get("chats"));
-				if (userIds.length > 200 || chatIds.length > 200) {
-					sendJson(res, 400, {
-						ok: false,
-						error: `每次最多查询 200 个用户和 200 个群`
-					});
-					return;
-				}
-				sendJson(res, 200, await surface.feishuProfiles(userIds, chatIds));
-			})
+		get(ACCESS_ROUTE, async () => json(200, await surface.access())),
+		post(SAVE_CONFIG_ROUTE, async (request) => {
+			const values = (await readJsonObject(request)).values;
+			if (typeof values !== "object" || values === null || Array.isArray(values)) return json(400, {
+				ok: false,
+				error: "请求体缺少 values 对象"
+			});
+			return result(await surface.save(values));
 		}),
-		server.register({
-			kind: "exact",
-			path: CONFIG_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["PUT", "DELETE"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				if (methodOf(req) === "DELETE") {
-					const result = await surface.clear();
-					sendJson(res, result.ok ? 200 : 400, result);
-					return;
-				}
-				let body;
-				try {
-					body = await readJsonBody(req);
-				} catch (error) {
-					if (error instanceof HttpError) {
-						sendJson(res, error.status, {
-							ok: false,
-							error: error.message
-						});
-						return;
-					}
-					throw error;
-				}
-				const values = body?.values;
-				if (typeof values !== "object" || values === null || Array.isArray(values)) {
-					sendJson(res, 400, {
-						ok: false,
-						error: "请求体缺少 values 对象"
-					});
-					return;
-				}
-				const result = await surface.save(values);
-				sendJson(res, result.ok ? 200 : 400, result);
-			})
+		post(CLEAR_CONFIG_ROUTE, async () => result(await surface.clear())),
+		post(SAVE_CREDENTIALS_ROUTE, async (request) => {
+			const payload = await readJsonObject(request);
+			const values = {};
+			if (payload.appId !== void 0) values.appId = payload.appId;
+			if (payload.appSecret !== void 0) values.appSecret = payload.appSecret;
+			if (payload.analyzeToken !== void 0) values.analyzeToken = payload.analyzeToken;
+			return result(await surface.saveCredentials(values));
 		}),
-		server.register({
-			kind: "exact",
-			path: CREDENTIALS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["PUT", "DELETE"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				let body;
-				try {
-					body = await readJsonBody(req);
-				} catch (error) {
-					if (error instanceof HttpError) {
-						sendJson(res, error.status, {
-							ok: false,
-							error: error.message
-						});
-						return;
-					}
-					throw error;
-				}
-				const payload = body;
-				if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
-					sendJson(res, 400, {
-						ok: false,
-						error: "请求体必须是 JSON 对象"
-					});
-					return;
-				}
-				if (methodOf(req) === "DELETE") {
-					const field = payload.field;
-					if (field !== "appId" && field !== "appSecret" && field !== "analyzeToken") {
-						sendJson(res, 400, {
-							ok: false,
-							error: "field 必须是 appId、appSecret 或 analyzeToken"
-						});
-						return;
-					}
-					const result = await surface.clearCredential(field);
-					sendJson(res, result.ok ? 200 : 400, result);
-					return;
-				}
-				const values = {};
-				if (payload.appId !== void 0) values.appId = payload.appId;
-				if (payload.appSecret !== void 0) values.appSecret = payload.appSecret;
-				if (payload.analyzeToken !== void 0) values.analyzeToken = payload.analyzeToken;
-				const result = await surface.saveCredentials(values);
-				sendJson(res, result.ok ? 200 : 400, result);
-			})
+		post(CLEAR_CREDENTIAL_ROUTE, async (request) => {
+			const field = (await readJsonObject(request)).field;
+			if (field !== "appId" && field !== "appSecret" && field !== "analyzeToken") return json(400, {
+				ok: false,
+				error: "field 必须是 appId、appSecret 或 analyzeToken"
+			});
+			return result(await surface.clearCredential(field));
 		}),
-		server.register({
-			kind: "exact",
-			path: RECONNECT_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["POST"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				const result = await surface.reconnect();
-				sendJson(res, result.ok ? 200 : result.unconfigured === true ? 400 : 500, result);
-			})
+		post(RECONNECT_ROUTE, async () => {
+			const outcome = await surface.reconnect();
+			return json(outcome.ok ? 200 : outcome.unconfigured === true ? 400 : 500, outcome);
 		}),
-		server.register({
-			kind: "exact",
-			path: PICK_DIRECTORY_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["POST"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				const controller = new AbortController();
-				let answered = false;
-				if (typeof res.on === "function") res.on("close", () => {
-					if (!answered) controller.abort();
-				});
-				let path;
-				try {
-					path = await surface.pickDirectory(controller.signal);
-				} catch (error) {
-					answered = true;
-					if (controller.signal.aborted) {
-						res.end();
-						return;
-					}
-					throw error;
-				}
-				answered = true;
-				sendJson(res, 200, path === null ? {
-					ok: true,
-					canceled: true
-				} : {
-					ok: true,
-					path
-				});
-			})
+		post(PICK_DIRECTORY_ROUTE, async (request) => {
+			const path = await surface.pickDirectory(request.signal);
+			return json(200, path === null ? {
+				ok: true,
+				canceled: true
+			} : {
+				ok: true,
+				path
+			});
 		}),
-		server.register({
-			kind: "exact",
-			path: ACCESS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["GET", "HEAD"])) return;
-				if (methodOf(req) === "HEAD") {
-					res.writeHead(200, { "cache-control": "no-store" });
-					res.end();
-					return;
-				}
-				sendJson(res, 200, await surface.access());
-			})
+		post(ADD_ACCESS_GROUP_ROUTE, async (request) => {
+			const payload = await readJsonObject(request);
+			return result(await surface.saveAccessGroup(payload.chatId, payload.name));
 		}),
-		server.register({
-			kind: "exact",
-			path: ACCESS_GROUPS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["POST", "DELETE"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				const payload = await readAccessBody(req, res);
-				if (payload === void 0) return;
-				const result = methodOf(req) === "DELETE" ? await surface.removeAccessGroup(payload.chatId) : await surface.saveAccessGroup(payload.chatId, payload.name);
-				sendJson(res, result.ok ? 200 : 400, result);
-			})
-		}),
-		server.register({
-			kind: "exact",
-			path: ACCESS_USERS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["POST", "DELETE"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				const payload = await readAccessBody(req, res);
-				if (payload === void 0) return;
-				const result = methodOf(req) === "DELETE" ? await surface.removeAccessUser(payload.userId) : await surface.saveAccessUser(payload.userId, payload.name);
-				sendJson(res, result.ok ? 200 : 400, result);
-			})
+		post(REMOVE_ACCESS_GROUP_ROUTE, async (request) => result(await surface.removeAccessGroup((await readJsonObject(request)).chatId))),
+		post(ADD_ACCESS_USER_ROUTE, async (request) => {
+			const payload = await readJsonObject(request);
+			return result(await surface.saveAccessUser(payload.userId, payload.name));
 		}),
-		server.register({
-			kind: "exact",
-			path: ACCESS_WIKI_USERS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["POST", "DELETE"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				const payload = await readAccessBody(req, res);
-				if (payload === void 0) return;
-				const result = methodOf(req) === "DELETE" ? await surface.removeWikiUser(payload.userId) : await surface.saveWikiUser(payload.userId, payload.name);
-				sendJson(res, result.ok ? 200 : 400, result);
-			})
+		post(REMOVE_ACCESS_USER_ROUTE, async (request) => result(await surface.removeAccessUser((await readJsonObject(request)).userId))),
+		post(ADD_WIKI_USER_ROUTE, async (request) => {
+			const payload = await readJsonObject(request);
+			return result(await surface.saveWikiUser(payload.userId, payload.name));
 		}),
-		server.register({
-			kind: "exact",
-			path: ACCESS_REQUESTS_ROUTE,
-			handler: guarded(async (req, res) => {
-				if (!allowOnly(req, res, ["POST"])) return;
-				if (!isSameOriginRequest(req)) {
-					forbiddenWrite(res);
-					return;
-				}
-				const payload = await readAccessBody(req, res);
-				if (payload === void 0) return;
-				const result = await surface.resolveAccessRequest(payload.token, payload.decision);
-				sendJson(res, result.ok ? 200 : 400, result);
-			})
+		post(REMOVE_WIKI_USER_ROUTE, async (request) => result(await surface.removeWikiUser((await readJsonObject(request)).userId))),
+		post(RESOLVE_ACCESS_REQUEST_ROUTE, async (request) => {
+			const payload = await readJsonObject(request);
+			return result(await surface.resolveAccessRequest(payload.token, payload.decision));
 		})
-	];
+	].map((route) => connection.fetch.register(route));
 	return () => {
-		for (const dispose of disposers) dispose();
+		for (const dispose of disposers) dispose().catch(() => {});
 	};
 }
 /**
-* Mount the routes once the host carries both a Web server and the
-* `connection` service that authenticates its browser requests. The optional
-* `ctx.inject` keeps headless profiles from waiting on services they will
-* never have; embedded/test hosts that resolve services synchronously fall
-* back to the direct attach path. Without `connection` nothing is mounted, so
-* the panel never serves unauthenticated requests.
+* Mount the routes once the host carries the `connection` service. The
+* optional `ctx.inject` keeps headless profiles from waiting on a service
+* they will never have; embedded/test hosts that resolve services
+* synchronously fall back to the direct attach path.
+* @param ctx - the plugin context.
+* @param surface - the panel's business side.
 */
 function mountSettingsRoutes(ctx, surface) {
+	const attach = (connectionCtx) => {
+		const connection = connectionCtx.get?.("connection");
+		if (connection?.fetch === void 0) return;
+		connectionCtx.effect(() => registerSettingsRoutes(connection, surface), "dsh-channels: settings panel routes");
+	};
+	const inject = ctx.inject;
+	if (typeof inject === "function") {
+		inject.call(ctx, ["connection"], attach);
+		return;
+	}
+	attach(ctx);
+}
+//#endregion
+//#region src/analyze/server.ts
+/**
+* The analyze API's HTTP route on the DSH Web server.
+*
+* Registers the exact route `POST /api/dsh-channels.logalyze` (see
+* `./contract.ts`) on the host `webServer`; hosts without one (headless) have
+* no analyze API. This module owns the transport-level checks, in order:
+* path, the `analyzeEnabled` switch, method, bearer token, `Idempotency-Key`,
+* media type, body size, and JSON validation; everything after validation
+* belongs to the {@link AnalyzeHandler}. Bodies, tokens, and prompts are never
+* logged.
+*
+* @module dsh-channels/analyze/server
+*/
+var HttpError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+function send(res, response) {
+	const body = JSON.stringify(response.body);
+	res.writeHead(response.status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"content-length": Buffer.byteLength(body)
+	});
+	res.end(body);
+}
+function refuse(res, status, error, headers = {}) {
+	for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
+	send(res, {
+		status,
+		body: {
+			ok: false,
+			error
+		}
+	});
+}
+/** Constant-time token comparison over fixed-length digests. */
+function tokenMatches(presented, expected) {
+	return timingSafeEqual(createHash("sha256").update(presented).digest(), createHash("sha256").update(expected).digest());
+}
+/** The bearer credential of one request, or undefined. */
+function bearerOf(req) {
+	const header = req.headers.authorization;
+	if (header === void 0) return void 0;
+	return /^Bearer[ \t]+(\S+)[ \t]*$/iu.exec(header)?.[1];
+}
+/** Read the body up to {@link ANALYZE_MAX_BODY_BYTES}; larger bodies fail with 413. */
+async function readBody(req) {
+	const declared = Number(req.headers["content-length"]);
+	if (Number.isFinite(declared) && declared > 1048576) throw new HttpError(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.length;
+		if (size > 1048576) throw new HttpError(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+/**
+* Handle one HTTP request against the analyze contract.
+* @param req - the incoming request.
+* @param res - its response.
+* @param handler - the business side.
+*/
+async function handleAnalyzeHttp(req, res, handler) {
+	if (new URL(req.url ?? "/", "http://analyze.invalid").pathname !== "/api/dsh-channels.logalyze") {
+		refuse(res, 404, "未知路径");
+		return;
+	}
+	if (!handler.enabled()) {
+		refuse(res, 404, "日志分析接口未开启，请在设置面板「高级 → 日志分析接口」打开开关");
+		return;
+	}
+	if ((req.method ?? "GET").toUpperCase() !== "POST") {
+		refuse(res, 405, "只接受 POST", { allow: "POST" });
+		return;
+	}
+	const expected = await handler.token();
+	if (expected === void 0 || expected === "") {
+		refuse(res, 503, "分析接口未配置访问令牌，请联系部署者配置 analyzeToken 引用的凭据");
+		return;
+	}
+	const presented = bearerOf(req);
+	if (presented === void 0 || !tokenMatches(presented, expected)) {
+		refuse(res, 401, "访问令牌无效", { "www-authenticate": "Bearer" });
+		return;
+	}
+	const idempotencyKey = req.headers["idempotency-key"];
+	if (typeof idempotencyKey !== "string" || !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
+		refuse(res, 400, "缺少或不合法的 Idempotency-Key 请求头（1-200 个可见 ASCII 字符）");
+		return;
+	}
+	if ((req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase() !== "application/json") {
+		refuse(res, 415, "Content-Type 必须是 application/json");
+		return;
+	}
+	let raw;
+	try {
+		raw = JSON.parse(await readBody(req));
+	} catch (error) {
+		if (error instanceof HttpError) {
+			refuse(res, error.status, error.message);
+			return;
+		}
+		refuse(res, 400, "请求体不是合法的 JSON");
+		return;
+	}
+	const parsed = parseAnalyzeRequest(raw);
+	if (!parsed.ok) {
+		refuse(res, 400, parsed.error);
+		return;
+	}
+	send(res, await handler.analyze(parsed.value, idempotencyKey));
+}
+/**
+* Register the analyze route on the host Web server once it is available.
+* Requests skip the DSH login gate on purpose: the bearer token is this API's
+* only credential.
+* @param ctx - the plugin context.
+* @param handler - the business side.
+* @param warn - diagnostics sink for unexpected handler failures.
+*/
+function mountAnalyzeRoute(ctx, handler, warn) {
 	const attach = (webCtx) => {
 		const server = webCtx.get?.("webServer");
-		const gate = webCtx.get?.("connection");
-		if (server === void 0 || gate === void 0) return;
-		webCtx.effect(() => registerSettingsRoutes(server, gate, surface), "dsh-channels: settings panel routes");
+		if (server === void 0) return;
+		webCtx.effect(() => server.register({
+			kind: "exact",
+			path: ANALYZE_ROUTE,
+			handler: async (req, res) => {
+				try {
+					await handleAnalyzeHttp(req, res, handler);
+				} catch (error) {
+					warn("dsh-channels: analyze request failed: %s", String(error));
+					if (!res.headersSent) refuse(res, 500, `分析请求处理失败：${String(error)}`);
+					else res.destroy();
+				}
+			}
+		}), "dsh-channels: analyze route");
 	};
 	const inject = ctx.inject;
 	if (typeof inject === "function") {
-		inject.call(ctx, ["webServer", "connection"], attach);
+		inject.call(ctx, ["webServer"], attach);
 		return;
 	}
 	attach(ctx);
@@ -20072,8 +19852,7 @@ const OPTIONAL_TEXT_KEYS = /* @__PURE__ */ new Set([
 	"reasoningEffort",
 	"agentPreset",
 	"maxTokens",
-	"adminUserId",
-	"analyzeListen"
+	"adminUserId"
 ]);
 const BOOLEAN_KEYS = /* @__PURE__ */ new Set([
 	"requireMention",
@@ -20087,7 +19866,8 @@ const BOOLEAN_KEYS = /* @__PURE__ */ new Set([
 	"feishuTools.topicMessages",
 	"feishuTools.sendFile",
 	"feishuTools.wikiRead",
-	"feishuTools.wikiWrite"
+	"feishuTools.wikiWrite",
+	"analyzeEnabled"
 ]);
 /** Editable keys rendered as `string-list` (one input per entry). */
 const STRING_LIST_FIELDS = { wikiRoots: {
@@ -20528,12 +20308,11 @@ const FIELD_META = {
 		placeholder: "https://<租户>.feishu.cn/wiki/space/<space_id>",
 		wide: true
 	},
-	analyzeListen: {
-		label: "监听地址",
+	analyzeEnabled: {
+		label: "日志分析接口",
 		group: "analyze",
-		summary: "日志平台调用分析接口的 host:port，留空关闭",
-		help: "接口路径 POST /dsh-channels/analyze，请求需带 Authorization: Bearer <访问令牌>。",
-		placeholder: "例如 0.0.0.0:3090"
+		summary: "关闭时接口返回 404",
+		help: "接口挂在 DSH Web 端口上：POST /api/dsh-channels.logalyze，请求需带 Authorization: Bearer <访问令牌>。只有带 Web 的 profile 才有这个接口。改后立即生效，不需要重连。"
 	},
 	loggerLevel: {
 		label: "SDK 日志级别",
@@ -21635,6 +21414,7 @@ function apply(ctx, config) {
 		ctx.logger?.warn?.(message, ...args);
 	};
 	mountSettingsRoutes(ctx, new SettingsSurface(service, overlay, { warn }, createHostCatalog(ctx, warn), createSettingsDirectoryPicker(ctx)));
+	mountAnalyzeRoute(ctx, service.analyzeHandler(), warn);
 	ctx.effect(() => {
 		service.boot().catch((error) => {
 			ctx.logger?.error?.("dsh-channels failed to boot: %s", String(error));
@@ -21644,6 +21424,6 @@ function apply(ctx, config) {
 	}, "dsh-channels");
 }
 //#endregion
-export { AUTH_USER_TARGET_ERRORS, AccessController, AccessRequests, AccessStore, ApprovalAnswerer, CARD_MAX_BYTES, CARD_TARGET_BYTES, CATALOG_ROUTE, CHANNEL_COMMAND_NAMES, CONFIG_ROUTE, CREDENTIALS_ROUTE, Config, DM_DENY_TEXT, DM_DENY_WHITELIST_TEXT, DM_UNCONFIGURED_TEXT, DSH_CHANNELS_VERSION, EDITABLE_KEYS, EMPTY_TOTALS, FIELD_DESCRIPTORS, FeishuService, HEALTH_DEPENDENCY_NAMES, INTERRUPTION_NOTICE, LOGICAL_EXPORT_FORMAT, LOGICAL_EXPORT_FORMAT_VERSION, MAX_QUESTION_OPTIONS, MAX_TABLES_PER_CARD, OverlayStore, PANEL_CHEVRON_TOKEN, PANEL_COPY, PANEL_ROUTE, PANEL_TITLES, PICK_DIRECTORY_ROUTE, QuestionAnswerer, REASONING_MAX_BYTES, RECONNECT_ROUTE, RESTART_KEYS, RouteOperationQueue, SESSION_HISTORY_DISPLAY_LIMIT, STATUS_ROUTE, SUPPORTED_COMMAND_NAMES, SettingsSurface, TRUNCATION_SUFFIX, TurnStreamer, accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, addUsage, appendSessionHistory, apply, applyCatalog, applyProjectionViews, armModelCommand, averageDecodeTokensPerSecond, averageTtftMs, buildApprovalCard, buildApprovalSettledCard, buildCard, buildCommandResultCard, buildCompactComparisonCard, buildGroupInfoCard, buildHealthCard, buildInterruptionCard, buildQuestionCard, buildQuestionSettledCard, buildRenewCard, buildRequestSettledCard, buildSessionHistoryCard, buildSessionStatusCard, buildUserRequestCard, buildWorkDirCard, cacheHitPct, cardJsonBytes, chatRouteKey, commandResultCardKind, compactFailureContext, countFiberStates, createHostCatalog, createLogicalSessionExport, createSettingsDirectoryPicker, decideAccess, defaultOverlayPath, emptyCatalog, ensureWorkspace, expiredRouteRecordSchema, feishuDomain, foldAll, foldEvent, foldHealthSnapshot, foldSessionStats, inflightSnapshotSchema, inject, isAdminUserId, isSameOriginRequest, isSupportedCommand, maskOpenIdTail, measureSessionContext, mergeOverlay, mountSettingsRoutes, name, normalizeCredentialValue, normalizeOverlay, normalizeRouteRecord, normalizeSessionHistory, parseOverlay, parseSlashCommand, pickEditable, processedRecordSchema, querySessionHistory, readProjectionViews, registerChannelCommands, registerModelCommand, registerSettingsRoutes, resolveAuthUserTarget, resolveDshHome, resolveWorkDir, routeRecordSchema, segmentCardContent, serializeLogicalSession, sessionDirOf, sessionHistoryEntrySchema, splitBodyForCard, stagingPathFor, stagingRoot, stripTables, supportedCommandHelp, supportedCommandList, tableBlocks, topicDirFor, topicTokenFor, usageFromBuckets, withDirectoryBrowse, workspacePathFor, workspaceTitleFor, worktreeBranchFor };
+export { AUTH_USER_TARGET_ERRORS, AccessController, AccessRequests, AccessStore, ApprovalAnswerer, CARD_MAX_BYTES, CARD_TARGET_BYTES, CATALOG_ROUTE, CHANNEL_COMMAND_NAMES, CLEAR_CONFIG_ROUTE, CLEAR_CREDENTIAL_ROUTE, Config, DM_DENY_TEXT, DM_DENY_WHITELIST_TEXT, DM_UNCONFIGURED_TEXT, DSH_CHANNELS_VERSION, EDITABLE_KEYS, EMPTY_TOTALS, FIELD_DESCRIPTORS, FeishuService, HEALTH_DEPENDENCY_NAMES, INTERRUPTION_NOTICE, LOGICAL_EXPORT_FORMAT, LOGICAL_EXPORT_FORMAT_VERSION, MAX_QUESTION_OPTIONS, MAX_TABLES_PER_CARD, OverlayStore, PANEL_CHEVRON_TOKEN, PANEL_COPY, PANEL_ROUTE, PANEL_TITLES, PICK_DIRECTORY_ROUTE, QuestionAnswerer, REASONING_MAX_BYTES, RECONNECT_ROUTE, RESTART_KEYS, RouteOperationQueue, SAVE_CONFIG_ROUTE, SAVE_CREDENTIALS_ROUTE, SESSION_HISTORY_DISPLAY_LIMIT, STATUS_ROUTE, SUPPORTED_COMMAND_NAMES, SettingsSurface, TRUNCATION_SUFFIX, TurnStreamer, accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, addUsage, appendSessionHistory, apply, applyCatalog, applyProjectionViews, armModelCommand, averageDecodeTokensPerSecond, averageTtftMs, buildApprovalCard, buildApprovalSettledCard, buildCard, buildCommandResultCard, buildCompactComparisonCard, buildGroupInfoCard, buildHealthCard, buildInterruptionCard, buildQuestionCard, buildQuestionSettledCard, buildRenewCard, buildRequestSettledCard, buildSessionHistoryCard, buildSessionStatusCard, buildUserRequestCard, buildWorkDirCard, cacheHitPct, cardJsonBytes, chatRouteKey, commandResultCardKind, compactFailureContext, countFiberStates, createHostCatalog, createLogicalSessionExport, createSettingsDirectoryPicker, decideAccess, defaultOverlayPath, emptyCatalog, ensureWorkspace, expiredRouteRecordSchema, feishuDomain, foldAll, foldEvent, foldHealthSnapshot, foldSessionStats, inflightSnapshotSchema, inject, isAdminUserId, isSupportedCommand, maskOpenIdTail, measureSessionContext, mergeOverlay, mountSettingsRoutes, name, normalizeCredentialValue, normalizeOverlay, normalizeRouteRecord, normalizeSessionHistory, parseOverlay, parseSlashCommand, pickEditable, processedRecordSchema, querySessionHistory, readProjectionViews, registerChannelCommands, registerModelCommand, registerSettingsRoutes, resolveAuthUserTarget, resolveDshHome, resolveWorkDir, routeRecordSchema, segmentCardContent, serializeLogicalSession, sessionDirOf, sessionHistoryEntrySchema, splitBodyForCard, stagingPathFor, stagingRoot, stripTables, supportedCommandHelp, supportedCommandList, tableBlocks, topicDirFor, topicTokenFor, usageFromBuckets, withDirectoryBrowse, workspacePathFor, workspaceTitleFor, worktreeBranchFor };
 
 //# sourceMappingURL=index.js.map