@modesto_ma/dsh-guanxiang 0.1.0 → 0.2.0-beta.2

package/lib/index.js

@@ -1,21 +1,413 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { z } from "zod";
-import { createHash, randomBytes } from "node:crypto";
 import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { parse } from "yaml";
 import { createWriteStream } from "node:fs";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { execFile } from "node:child_process";
+//#region src/settings/contract.ts
+/**
+* 设置面板与 Host 路由共用的路由常量和 JSON 结构。浏览器端 bundle 也会
+* 编译本文件，因此这里只放类型和常量，不 import 任何 Node 模块。
+*
+* @module dsh-guanxiang/settings/contract
+*/
+/** GET：面板所需的全部状态（生效设置、默认值、仓库与应用）。 */
+const STATE_ROUTE = "/guanxiang/state";
+/** PUT：保存可编辑设置；DELETE：清除面板覆盖、恢复 cordis.yml 默认值。 */
+const SETTINGS_ROUTE = "/guanxiang/settings";
+/** POST：立即重新拉取全部仓库，或 body `{ url }` 指定的一个仓库。 */
+const SYNC_ROUTE = "/guanxiang/sync";
+/** PUT：body `{ tokenEnv, value }` 把令牌存入 DSH 凭据库；DELETE：body `{ tokenEnv }` 删除已存的值。只接受已保存的访问令牌配置引用的名称和分析接口令牌的名称。 */
+const TOKEN_ROUTE = "/guanxiang/token";
+/**
+* POST：日志平台分析接口（Bearer 令牌鉴权，不走 DSH 登录）。它在 DSH 的
+* `/api` 命名空间之外，网关可以把它和需要登录的 DSH 接口分开暴露。
+*/
+const ANALYZE_ROUTE = "/open-api/logalyze";
+/** Credential reference grammar of `@deepseek-ai/dsh-credentials` (a POSIX shell identifier), which {@link GitCredentialSpec.tokenEnv} follows. */
+const TOKEN_ENV_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Keys of {@link EditableSettings}, in panel order. */
+const EDITABLE_KEYS = [
+	"reposDir",
+	"repos",
+	"gitCredentials",
+	"fetchIntervalMs",
+	"maxAppsPerRequest",
+	"dispatchTimeoutMs",
+	"download",
+	"skillUpdates",
+	"analyze"
+];
+//#endregion
+//#region src/analyze/contract.ts
+/**
+* 日志平台分析接口的请求与响应。
+*
+* `POST /open-api/logalyze`（DSH Web 服务器上），带
+* `Authorization: Bearer <令牌>`、`Idempotency-Key` 请求头和 JSON 请求体：
+* 发起人、触发时间、应用与错误码、日志详情页、目标群和提示词。合法请求把
+* 分析根卡片发进群并回 `202`，分析随后在卡片下的话题里流式进行。日志包由
+* 提示词调用的分析 SKILL 自行获取，详情页只列在卡片上。
+*
+* 接口原由 dsh-channels 0.7 提供；迁到观象后请求、响应和错误文本不变。
+*
+* @module dsh-guanxiang/analyze/contract
+*/
+/** Largest accepted request body (the prompt dominates it). */
+const ANALYZE_MAX_BODY_BYTES = 1024 * 1024;
+/** Largest accepted prompt, in characters. */
+const ANALYZE_MAX_PROMPT_CHARS = 1e5;
+/**
+* `Idempotency-Key` format: 1–200 visible ASCII characters without spaces, so
+* a platform can use a UUID or its own `type:id` token.
+*/
+const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,200}$/u;
+/** Feishu `user_id`: not an `open_id` (`ou_`), `union_id` (`on_`), or chat id (`oc_`). */
+const FEISHU_USER_ID = /^(?!ou_|on_|oc_)[A-Za-z0-9_-]+$/u;
+/**
+* Application / error-code segment: it names a workspace directory
+* (`<baseDir>/analyze/<app>/<errorCode>` below the Feishu channel's
+* `baseDir`), so only path-safe characters pass.
+*/
+const SUBJECT_SEGMENT = /^(?!\.{1,2}$)[A-Za-z0-9._-]{1,128}$/u;
+/** JSON body of one analyze request. */
+const analyzeRequestSchema = z.object({
+	/** Feishu user_id of the person who started the analysis on the platform. */
+	requesterUserId: z.string().regex(FEISHU_USER_ID, "must be a Feishu user_id").max(128),
+	/** When the analysis was started on the platform, shown verbatim on the root card. */
+	triggeredAt: z.string().min(1).max(64).refine((value) => value.trim() !== "", "must not be blank"),
+	/** Application the logs belong to (workspace directory segment). */
+	app: z.string().regex(SUBJECT_SEGMENT, "must be 1-128 of A-Z a-z 0-9 . _ -"),
+	/** Error code of the logs (workspace directory segment). */
+	errorCode: z.string().regex(SUBJECT_SEGMENT, "must be 1-128 of A-Z a-z 0-9 . _ -"),
+	/** Log-platform detail pages of the logs that triggered the analysis (listed on the root card). */
+	logDetails: z.array(z.object({
+		/** Row label. */
+		name: z.string().min(1).max(200).refine((value) => value.trim() !== "", "must not be blank"),
+		/** Detail page address. */
+		url: z.url({
+			protocol: /^https?$/u,
+			error: "must be an http(s) URL"
+		}).max(2048)
+	}).strict()).min(1).max(50),
+	/** Target group chat (`oc_…`); must be an authorized group. */
+	chatId: z.string().regex(/^oc_[A-Za-z0-9_-]{1,128}$/u, "must be a Feishu group chat_id (oc_...)"),
+	/** Prompt forwarded verbatim as the analysis Session's first user message. */
+	prompt: z.string().min(1).max(ANALYZE_MAX_PROMPT_CHARS).refine((value) => value.trim() !== "", "must not be blank")
+}).strict();
+/**
+* Fingerprint of one validated request, used to tell a retry of the same
+* request from a reused `Idempotency-Key`. Field order is fixed: dsh-channels
+* 0.7 stored the same digest, so its accepted keys keep replaying.
+* @param request - the validated request.
+* @returns SHA-256 hex digest.
+*/
+function analyzeRequestHash(request) {
+	const canonical = JSON.stringify([
+		request.requesterUserId,
+		request.triggeredAt,
+		request.app,
+		request.errorCode,
+		request.logDetails.map((detail) => [detail.name, detail.url]),
+		request.chatId,
+		request.prompt
+	]);
+	return createHash("sha256").update(canonical).digest("hex");
+}
+/**
+* Validate one decoded JSON body.
+* @param raw - the decoded body.
+* @returns the request, or a readable list of field errors.
+*/
+function parseAnalyzeRequest(raw) {
+	const parsed = analyzeRequestSchema.safeParse(raw);
+	if (parsed.success) return {
+		ok: true,
+		value: parsed.data
+	};
+	return {
+		ok: false,
+		error: `请求参数不合法：${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(body)"}: ${issue.message}`).join("; ")}`
+	};
+}
+//#endregion
+//#region src/analyze/topics.ts
+/** Name dsh-channels provides the service under. */
+const FEISHU_TOPICS_SERVICE = "feishuTopics";
+/**
+* Classify the value `ctx.get('feishuTopics')` returned. The provider is
+* another package that may be older or newer than this one, so its version
+* is checked at run time.
+* @param value - the looked-up service, or undefined.
+* @returns the usable service, or why there is none.
+*/
+function lookupTopics(value) {
+	if (value === void 0 || value === null) return { availability: "missing" };
+	const service = value;
+	if (service.version !== 1 || typeof service.launch !== "function") return { availability: "incompatible" };
+	return {
+		availability: "ready",
+		service: value
+	};
+}
+/**
+* The topic one analyze request starts.
+* @param request - the validated request.
+* @param idempotencyKey - the request's `Idempotency-Key`, used unchanged as the launch key.
+* @returns the launch spec.
+*/
+function analyzeTopicSpec(request, idempotencyKey) {
+	return {
+		key: idempotencyKey,
+		fingerprint: analyzeRequestHash(request),
+		chatId: request.chatId,
+		requesterUserId: request.requesterUserId,
+		card: {
+			title: "日志分析",
+			taskName: "分析",
+			lead: [
+				{ text: `于 ${request.triggeredAt} 发起了对 ` },
+				{
+					text: request.app,
+					bold: true
+				},
+				{ text: " 应用 " },
+				{
+					text: request.errorCode,
+					bold: true
+				},
+				{ text: " 错误码不良日志的分析。" }
+			],
+			links: {
+				nameHeader: "日志",
+				linkHeader: "详情页",
+				rows: request.logDetails
+			}
+		},
+		workspace: {
+			segments: [
+				"analyze",
+				request.app,
+				request.errorCode
+			],
+			title: `日志分析 · ${request.app} · ${request.errorCode}`
+		},
+		prompt: request.prompt
+	};
+}
+/**
+* HTTP answer of one launch result.
+* @param result - what the service answered.
+* @returns status and body.
+*/
+function analyzeResponseOf(result) {
+	if (result.ok) return {
+		status: 202,
+		body: {
+			ok: true,
+			chatId: result.chatId,
+			messageId: result.messageId
+		}
+	};
+	switch (result.code) {
+		case "not-connected": return refused(503, result.message);
+		case "forbidden-chat": return refused(403, result.message);
+		case "key-conflict": return refused(409, "Idempotency-Key 已被内容不同的请求使用");
+		case "send-failed": return refused(502, result.message);
+		case "invalid": return refused(500, `分析请求处理失败：${result.message}`);
+		default: return refused(500, `分析请求处理失败：${String(result.message)}`);
+	}
+}
+/**
+* Start the analysis topic of one validated request.
+* @param topics - the `feishuTopics` service.
+* @param request - the validated request.
+* @param idempotencyKey - the request's `Idempotency-Key`.
+* @returns the HTTP answer.
+*/
+async function launchAnalysis(topics, request, idempotencyKey) {
+	return analyzeResponseOf(await topics.launch(analyzeTopicSpec(request, idempotencyKey)));
+}
+function refused(status, error) {
+	return {
+		status,
+		body: {
+			ok: false,
+			error
+		}
+	};
+}
+//#endregion
+//#region src/analyze/server.ts
+/**
+* 日志平台分析接口在 DSH Web 服务器上的路由。
+*
+* 只在宿主同时提供 `webServer` 和版本兼容的 dsh-channels `feishuTopics`
+* 服务时注册精确路由 `POST /open-api/logalyze`；dsh-channels 未加载、重载
+* 中、版本不兼容或为 0.7 及更早版本（自己注册该路由）时观象不注册，两者
+* 不会争用同一路径。
+* 本模块按顺序做传输层检查：路径、开关、方法、Bearer 令牌、
+* `Idempotency-Key`、媒体类型、请求体大小和 JSON 校验；通过后交给
+* `feishuTopics`。请求体、令牌和提示词都不写日志。
+*
+* @module dsh-guanxiang/analyze/server
+*/
+var HttpError$1 = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+function send(res, response) {
+	const body = JSON.stringify(response.body);
+	res.writeHead(response.status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"content-length": Buffer.byteLength(body)
+	});
+	res.end(body);
+}
+function refuse(res, status, error, headers = {}) {
+	for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
+	send(res, {
+		status,
+		body: {
+			ok: false,
+			error
+		}
+	});
+}
+/** Constant-time token comparison over fixed-length digests. */
+function tokenMatches(presented, expected) {
+	return timingSafeEqual(createHash("sha256").update(presented).digest(), createHash("sha256").update(expected).digest());
+}
+/** The bearer credential of one request, or undefined. */
+function bearerOf(req) {
+	const header = req.headers.authorization;
+	if (header === void 0) return void 0;
+	return /^Bearer[ \t]+(\S+)[ \t]*$/iu.exec(header)?.[1];
+}
+/** Read the body up to {@link ANALYZE_MAX_BODY_BYTES}; larger bodies fail with 413. */
+async function readBody(req) {
+	const declared = Number(req.headers["content-length"]);
+	if (Number.isFinite(declared) && declared > 1048576) throw new HttpError$1(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+		size += buffer.length;
+		if (size > 1048576) throw new HttpError$1(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+/**
+* Handle one HTTP request against the analyze API.
+* @param req - the incoming request.
+* @param res - its response.
+* @param gate - switch and token.
+* @param launch - starts the analysis of a validated request.
+*/
+async function handleAnalyzeHttp(req, res, gate, launch) {
+	if (new URL(req.url ?? "/", "http://analyze.invalid").pathname !== "/open-api/logalyze") {
+		refuse(res, 404, "未知路径");
+		return;
+	}
+	if (!gate.enabled()) {
+		refuse(res, 404, "日志分析接口未开启，请在观象设置面板「分析接口」打开开关");
+		return;
+	}
+	if ((req.method ?? "GET").toUpperCase() !== "POST") {
+		refuse(res, 405, "只接受 POST", { allow: "POST" });
+		return;
+	}
+	const expected = await gate.token();
+	if (expected === void 0 || expected === "") {
+		refuse(res, 503, `分析接口未配置访问令牌，请在观象设置面板「分析接口」保存令牌（凭据名 ${gate.tokenEnv()}）`);
+		return;
+	}
+	const presented = bearerOf(req);
+	if (presented === void 0 || !tokenMatches(presented, expected)) {
+		refuse(res, 401, "访问令牌无效", { "www-authenticate": "Bearer" });
+		return;
+	}
+	const idempotencyKey = req.headers["idempotency-key"];
+	if (typeof idempotencyKey !== "string" || !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
+		refuse(res, 400, "缺少或不合法的 Idempotency-Key 请求头（1-200 个可见 ASCII 字符）");
+		return;
+	}
+	if ((req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase() !== "application/json") {
+		refuse(res, 415, "Content-Type 必须是 application/json");
+		return;
+	}
+	let raw;
+	try {
+		raw = JSON.parse(await readBody(req));
+	} catch (error) {
+		if (error instanceof HttpError$1) {
+			refuse(res, error.status, error.message);
+			return;
+		}
+		refuse(res, 400, "请求体不是合法的 JSON");
+		return;
+	}
+	const parsed = parseAnalyzeRequest(raw);
+	if (!parsed.ok) {
+		refuse(res, 400, parsed.error);
+		return;
+	}
+	send(res, await launch(parsed.value, idempotencyKey));
+}
+/**
+* Register the route while the host provides both `webServer` and a
+* compatible `feishuTopics`; it is removed when either goes away. Requests skip the DSH
+* login gate on purpose: the bearer token is this API's only credential.
+* @param ctx - the plugin context.
+* @param gate - switch and token.
+*/
+function mountAnalyzeRoute(ctx, gate) {
+	const attach = (scope) => {
+		const server = scope.get?.("webServer");
+		if (server === void 0) return;
+		const topics = lookupTopics(scope.get?.(FEISHU_TOPICS_SERVICE));
+		if (topics.availability !== "ready") {
+			if (topics.availability === "incompatible") ctx.logger?.warn?.("guanxiang: dsh-channels 的 feishuTopics 服务版本与观象不兼容，分析接口未注册；请把两者升级到相互兼容的版本");
+			return;
+		}
+		const { service } = topics;
+		const launch = (request, key) => launchAnalysis(service, request, key);
+		scope.effect(() => server.register({
+			kind: "exact",
+			path: ANALYZE_ROUTE,
+			handler: async (req, res) => {
+				try {
+					await handleAnalyzeHttp(req, res, gate, launch);
+				} catch (error) {
+					ctx.logger?.warn?.("guanxiang: 分析请求处理失败：%s", String(error));
+					if (!res.headersSent) refuse(res, 500, `分析请求处理失败：${String(error)}`);
+					else res.destroy();
+				}
+			}
+		}), "guanxiang: analyze route");
+	};
+	if (typeof ctx.inject === "function") {
+		ctx.inject(["webServer", FEISHU_TOPICS_SERVICE], attach);
+		return;
+	}
+	attach(ctx);
+}
+//#endregion
 //#region src/repos/credentials.ts
 /** Environment variables the helper reads; set only on git child processes. */
 const USERNAME_VARIABLE = "GUANXIANG_GIT_USERNAME";
 const TOKEN_VARIABLE = "GUANXIANG_GIT_TOKEN";
 /** Answers git's `get` request from the two variables and ignores `store` and `erase`. */
 const HELPER = `!f() { test "$1" = get || exit 0; printf 'username=%s\\npassword=%s\\n' "$${USERNAME_VARIABLE}" "$${TOKEN_VARIABLE}"; }; f`;
-/** Credential reference grammar of `@deepseek-ai/dsh-credentials` (a POSIX shell identifier). */
-const TOKEN_ENV_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** Longest accepted token; personal access tokens are far shorter. */
 const MAX_TOKEN_LENGTH = 4096;
 /**
@@ -147,8 +539,9 @@ const repoSchema = z.object({
 }).strict();
 const credentialSchema = z.object({
 	url: z.string().trim().refine((value) => normalizeCredentialUrl(value) !== void 0, "令牌地址不合法：填 https://主机[:端口][/路径]，不含用户名、查询参数或片段").transform((value) => normalizeCredentialUrl(value)),
+	alias: z.string().trim().max(64, "令牌别名不能超过 64 个字符").regex(/^[^\u0000-\u001f\u007f]*$/, "令牌别名不能包含控制字符").optional().transform((value) => value === "" ? void 0 : value),
 	username: z.string().trim().regex(/^\S+$/, "用户名不能为空或包含空白").default("oauth2"),
-	tokenEnv: z.string().trim().regex(TOKEN_ENV_PATTERN, "令牌名称只能包含字母、数字和下划线，且不能以数字开头")
+	tokenEnv: z.string().trim().regex(TOKEN_ENV_PATTERN, "令牌名称只能包含字母、数字和下划线，且不能以数字开头（它是凭据库中的键名，不是令牌本身）")
 }).strict();
 const hostSchema = z.string().trim().toLowerCase().transform((value) => value.replace(/^\*\./, "")).refine((value) => HOST_NAME.test(value), "域名不合法：只填主机名，例如 oss.example.com");
 const durationMs = (min) => z.number().int().min(min).max(MAX_TIMER_DELAY_MS);
@@ -162,6 +555,7 @@ const skillUpdatesSchema = z.object({
 	maxFiles: z.number().int().min(1).max(256).default(16),
 	maxFileBytes: z.number().int().min(1).max(16 * 1024 * 1024).default(256 * 1024)
 }).strict();
+const analyzeSchema = z.object({ enabled: z.boolean().default(false) }).strict();
 const authorSchema = z.object({
 	name: z.string().trim().min(1, "提交作者名不能为空").refine((value) => !/[<>\n]/.test(value), "提交作者名不能包含 < > 或换行"),
 	email: z.string().trim().min(1, "提交作者邮箱不能为空").refine((value) => !/[<>\s]/.test(value), "提交作者邮箱不能包含 < > 或空白")
@@ -195,7 +589,8 @@ const editableFields = {
 	maxAppsPerRequest: z.number().int().min(1).max(32),
 	dispatchTimeoutMs: durationMs(1e3),
 	download: downloadSchema,
-	skillUpdates: skillUpdatesSchema
+	skillUpdates: skillUpdatesSchema,
+	analyze: analyzeSchema
 };
 /** Standard Schema the Cordis loader validates `config` with before `apply()`. */
 const pluginConfigSchema = z.object({
@@ -208,6 +603,12 @@ const pluginConfigSchema = z.object({
 	dispatchTimeoutMs: editableFields.dispatchTimeoutMs.default(1800 * 1e3),
 	download: downloadSchema.prefault({}),
 	skillUpdates: skillUpdatesSchema.prefault({}),
+	analyze: analyzeSchema.prefault({}),
+	/**
+	* Credential reference (environment-variable name) whose value is the
+	* analyze API's bearer token.
+	*/
+	analyzeTokenRef: z.string().trim().regex(TOKEN_ENV_PATTERN, "令牌名称只能包含字母、数字和下划线，且不能以数字开头").default("GUANXIANG_ANALYZE_TOKEN"),
 	/**
 	* Author and committer of SKILL improvement commits; omitted uses the git
 	* identity configured on the host (`user.name` / `user.email`).
@@ -238,7 +639,8 @@ const overlaySchema = z.object({
 	maxAppsPerRequest: editableFields.maxAppsPerRequest.optional(),
 	dispatchTimeoutMs: editableFields.dispatchTimeoutMs.optional(),
 	download: downloadSchema.optional(),
-	skillUpdates: skillUpdatesSchema.optional()
+	skillUpdates: skillUpdatesSchema.optional(),
+	analyze: analyzeSchema.optional()
 }).strict();
 /** A complete editable settings payload, as the panel saves it. */
 const editableSettingsSchema = z.object(editableFields).strict();
@@ -292,6 +694,7 @@ function copyRepos(repos) {
 function copyCredentials(credentials) {
 	return credentials.map((credential) => ({
 		url: credential.url,
+		...credential.alias === void 0 ? {} : { alias: credential.alias },
 		username: credential.username,
 		tokenEnv: credential.tokenEnv
 	}));
@@ -315,7 +718,8 @@ function defaultsOf(config, env = process.env) {
 			...config.download,
 			allowedHosts: [...config.download.allowedHosts]
 		},
-		skillUpdates: { ...config.skillUpdates }
+		skillUpdates: { ...config.skillUpdates },
+		analyze: { ...config.analyze }
 	};
 }
 /**
@@ -334,7 +738,8 @@ function applyOverlay(defaults, overlay) {
 		maxAppsPerRequest: overlay.maxAppsPerRequest ?? defaults.maxAppsPerRequest,
 		dispatchTimeoutMs: overlay.dispatchTimeoutMs ?? defaults.dispatchTimeoutMs,
 		download: overlay.download ?? defaults.download,
-		skillUpdates: overlay.skillUpdates ?? defaults.skillUpdates
+		skillUpdates: overlay.skillUpdates ?? defaults.skillUpdates,
+		analyze: overlay.analyze ?? defaults.analyze
 	};
 }
 //#endregion
@@ -2319,33 +2724,6 @@ var RepoRegistry = class {
 	}
 };
 //#endregion
-//#region src/settings/contract.ts
-/**
-* 设置面板与 Host 路由共用的路由常量和 JSON 结构。浏览器端 bundle 也会
-* 编译本文件，因此这里只放类型和常量，不 import 任何 Node 模块。
-*
-* @module dsh-guanxiang/settings/contract
-*/
-/** GET：面板所需的全部状态（生效设置、默认值、仓库与应用）。 */
-const STATE_ROUTE = "/guanxiang/state";
-/** PUT：保存可编辑设置；DELETE：清除面板覆盖、恢复 cordis.yml 默认值。 */
-const SETTINGS_ROUTE = "/guanxiang/settings";
-/** POST：立即重新拉取全部仓库，或 body `{ url }` 指定的一个仓库。 */
-const SYNC_ROUTE = "/guanxiang/sync";
-/** PUT：body `{ tokenEnv, value }` 把令牌存入 DSH 凭据库；DELETE：body `{ tokenEnv }` 删除已存的值。只接受已保存的访问令牌配置引用的名称。 */
-const TOKEN_ROUTE = "/guanxiang/token";
-/** Keys of {@link EditableSettings}, in panel order. */
-const EDITABLE_KEYS = [
-	"reposDir",
-	"repos",
-	"gitCredentials",
-	"fetchIntervalMs",
-	"maxAppsPerRequest",
-	"dispatchTimeoutMs",
-	"download",
-	"skillUpdates"
-];
-//#endregion
 //#region src/settings/overlay.ts
 /**
 * 面板覆盖文件 `$DSH_HOME/guanxiang/settings.json` 的读写。文件只保存与
@@ -2625,6 +3003,7 @@ var GuanxiangService = class {
 	skill;
 	active = true;
 	refreshWaitMs;
+	analyzeTokenRef;
 	booted = Promise.withResolvers();
 	/**
 	* @param ctx - plugin context.
@@ -2637,6 +3016,7 @@ var GuanxiangService = class {
 		this.store = store;
 		this.defaults = defaultsOf(config);
 		this.refreshWaitMs = config.refreshWaitMs;
+		this.analyzeTokenRef = config.analyzeTokenRef;
 		this.current = this.defaults;
 		const git = options.git ?? runGit;
 		this.registry = new RepoRegistry({
@@ -2753,7 +3133,32 @@ var GuanxiangService = class {
 			overridden: overriddenKeys(this.overlay),
 			...this.overlayError === void 0 ? {} : { overlayError: this.overlayError },
 			repos: this.registry.status(),
-			credentials: await this.credentialsState()
+			credentials: await this.credentialsState(),
+			analyze: await this.analyzeState()
+		};
+	}
+	/** @returns the analyze route's switch and bearer token, read per request. */
+	analyzeGate() {
+		return {
+			enabled: () => this.current.analyze.enabled,
+			tokenEnv: () => this.analyzeTokenRef,
+			token: async () => {
+				try {
+					return (await this.credentialStore()?.resolve(this.analyzeTokenRef))?.value;
+				} catch (error) {
+					this.ctx.logger?.warn?.("guanxiang: 读取分析接口令牌 %s 失败：%s", this.analyzeTokenRef, error instanceof Error ? error.message : String(error));
+					return;
+				}
+			}
+		};
+	}
+	async analyzeState() {
+		const store = this.credentialStore();
+		return {
+			route: ANALYZE_ROUTE,
+			tokenEnv: this.analyzeTokenRef,
+			...store === void 0 ? {} : { token: await describeToken(store, this.analyzeTokenRef) },
+			topics: lookupTopics(this.ctx.get?.(FEISHU_TOPICS_SERVICE)).availability
 		};
 	}
 	credentialStore() {
@@ -2768,24 +3173,7 @@ var GuanxiangService = class {
 		const names = [...new Set(this.current.gitCredentials.map((credential) => credential.tokenEnv))];
 		return {
 			available: true,
-			tokens: await Promise.all(names.map(async (tokenEnv) => {
-				try {
-					const info = await store.describe(tokenEnv);
-					return {
-						tokenEnv,
-						configured: info.configured,
-						...info.source === void 0 ? {} : { source: info.source },
-						writable: info.writable
-					};
-				} catch (error) {
-					return {
-						tokenEnv,
-						configured: false,
-						writable: false,
-						error: error instanceof Error ? error.message : String(error)
-					};
-				}
-			}))
+			tokens: await Promise.all(names.map((tokenEnv) => describeToken(store, tokenEnv)))
 		};
 	}
 	/**
@@ -2807,10 +3195,11 @@ var GuanxiangService = class {
 	}
 	/**
 	* Store the token of one access-token configuration in DSH's credential
-	* store, then re-sync the repositories that use it.
+	* store, then re-sync the repositories that use it; or store the analyze
+	* API's bearer token (`analyzeTokenRef`), which applies from the next request.
 	* @param raw - request body `{ tokenEnv, value }`.
 	* @returns the new panel state.
-	* @throws SettingsError when the body is invalid, the name is not referenced by the saved settings, or no credential store is loaded.
+	* @throws SettingsError when the body is invalid, the name is neither referenced by the saved settings nor `analyzeTokenRef`, or no credential store is loaded.
 	*/
 	async setToken(raw) {
 		const parsed = tokenSetSchema.safeParse(raw);
@@ -2830,7 +3219,7 @@ var GuanxiangService = class {
 		return await this.writeToken(parsed.data.tokenEnv, void 0);
 	}
 	async writeToken(tokenEnv, value) {
-		if (!this.current.gitCredentials.some((credential) => credential.tokenEnv === tokenEnv)) throw new SettingsError(`${tokenEnv} 不是已保存的访问令牌配置引用的名称`);
+		if (tokenEnv !== this.analyzeTokenRef && !this.current.gitCredentials.some((credential) => credential.tokenEnv === tokenEnv)) throw new SettingsError(`${tokenEnv} 不是已保存的访问令牌配置引用的名称`);
 		const store = this.credentialStore();
 		if (store === void 0) throw new SettingsError("当前 DSH 组合没有凭据服务（@deepseek-ai/dsh-credentials-local），无法保存令牌");
 		if (value === void 0) await store.unset(tokenEnv);
@@ -2891,6 +3280,24 @@ var GuanxiangService = class {
 		this.skill.invalidate();
 	}
 };
+async function describeToken(store, tokenEnv) {
+	try {
+		const info = await store.describe(tokenEnv);
+		return {
+			tokenEnv,
+			configured: info.configured,
+			...info.source === void 0 ? {} : { source: info.source },
+			writable: info.writable
+		};
+	} catch (error) {
+		return {
+			tokenEnv,
+			configured: false,
+			writable: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
 //#endregion
 //#region src/settings/routes.ts
 /** Request body cap: the settings payload is small. */
@@ -3081,7 +3488,8 @@ function mountSettingsRoutes(ctx, service) {
 * 改进时的 `guanxiang_propose_skill` 工具（经用户授权后把子 Agent 的 SKILL
 * 修改提议推送到新分支并创建合并请求）。应用仓库在设置
 * 面板中只填 git 地址，由插件拉取；应用描述来自各仓库的
-* `.dsh/guanxiang.yaml`。
+* `.dsh/guanxiang.yaml`。另提供日志平台分析接口 `POST /open-api/logalyze`，
+* 经 dsh-channels 的 `feishuTopics` 服务在飞书群话题中开始分析。
 *
 * @module dsh-guanxiang
 */
@@ -3094,8 +3502,9 @@ const inject = [
 	"subagents"
 ];
 /**
-* Install the entry skill, the dispatch and SKILL proposal tools, and the settings routes, then
-* clone or update the configured repositories in the background.
+* Install the entry skill, the dispatch and SKILL proposal tools, the settings
+* routes, and the analyze route, then clone or update the configured
+* repositories in the background.
 * @param ctx - plugin context.
 * @param config - loader-validated configuration.
 * @param options - test seams.
@@ -3105,6 +3514,7 @@ function apply(ctx, config, options = {}) {
 	service.registerSkill();
 	service.registerTool();
 	mountSettingsRoutes(ctx, service);
+	mountAnalyzeRoute(ctx, service.analyzeGate());
 	ctx.effect(() => {
 		service.boot().catch((error) => {
 			ctx.logger?.error?.("guanxiang: 启动失败：%s", error instanceof Error ? error.message : String(error));
@@ -3115,6 +3525,6 @@ function apply(ctx, config, options = {}) {
 	}, "guanxiang: repositories");
 }
 //#endregion
-export { pluginConfigSchema as Config, pluginConfigSchema, DISPATCH_TOOL_NAME, Dispatcher, ENTRY_SKILL_NAME, GuanxiangService, MANIFEST_PATH, PROPOSE_TOOL_NAME, RepoRegistry, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE, SkillUpdater, apply, inject, name, readAppManifest, renderChildPrompt, renderEntrySkill, resolveConfig };
+export { ANALYZE_ROUTE, pluginConfigSchema as Config, pluginConfigSchema, DISPATCH_TOOL_NAME, Dispatcher, ENTRY_SKILL_NAME, GuanxiangService, MANIFEST_PATH, PROPOSE_TOOL_NAME, RepoRegistry, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE, SkillUpdater, analyzeRequestHash, apply, inject, name, parseAnalyzeRequest, readAppManifest, renderChildPrompt, renderEntrySkill, resolveConfig };
 
 //# sourceMappingURL=index.js.map