@modesto_ma/dsh-guanxiang 0.2.0-beta.1 → 0.2.0-beta.3

package/lib/index.js

@@ -1,7 +1,7 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { z } from "zod";
-import { createHash, randomBytes } from "node:crypto";
 import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { parse } from "yaml";
 import { createWriteStream } from "node:fs";
@@ -21,8 +21,13 @@ const STATE_ROUTE = "/guanxiang/state";
 const SETTINGS_ROUTE = "/guanxiang/settings";
 /** POST：立即重新拉取全部仓库，或 body `{ url }` 指定的一个仓库。 */
 const SYNC_ROUTE = "/guanxiang/sync";
-/** PUT：body `{ tokenEnv, value }` 把令牌存入 DSH 凭据库；DELETE：body `{ tokenEnv }` 删除已存的值。只接受已保存的访问令牌配置引用的名称。 */
+/** PUT：body `{ tokenEnv, value }` 把令牌存入 DSH 凭据库；DELETE：body `{ tokenEnv }` 删除已存的值。只接受已保存的访问令牌配置引用的名称和分析接口令牌的名称。 */
 const TOKEN_ROUTE = "/guanxiang/token";
+/**
+* POST：日志平台分析接口（Bearer 令牌鉴权，不走 DSH 登录）。它在 DSH 的
+* `/api` 命名空间之外，网关可以把它和需要登录的 DSH 接口分开暴露。
+*/
+const ANALYZE_ROUTE = "/open-api/logalyze";
 /** Credential reference grammar of `@deepseek-ai/dsh-credentials` (a POSIX shell identifier), which {@link GitCredentialSpec.tokenEnv} follows. */
 const TOKEN_ENV_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** Keys of {@link EditableSettings}, in panel order. */
@@ -34,9 +39,369 @@ const EDITABLE_KEYS = [
 	"maxAppsPerRequest",
 	"dispatchTimeoutMs",
 	"download",
-	"skillUpdates"
+	"skillUpdates",
+	"analyze"
 ];
 //#endregion
+//#region src/analyze/contract.ts
+/**
+* 日志平台分析接口的请求与响应。
+*
+* `POST /open-api/logalyze`（DSH Web 服务器上），带
+* `Authorization: Bearer <令牌>`、`Idempotency-Key` 请求头和 JSON 请求体：
+* 发起人、触发时间、应用与错误码、日志详情页、目标群和提示词。合法请求把
+* 分析根卡片发进群并回 `202`，分析随后在卡片下的话题里流式进行。日志包由
+* 提示词调用的分析 SKILL 自行获取，详情页只列在卡片上。
+*
+* 接口原由 dsh-channels 0.7 提供；迁到观象后请求、响应和错误文本不变。
+*
+* @module dsh-guanxiang/analyze/contract
+*/
+/** Largest accepted request body (the prompt dominates it). */
+const ANALYZE_MAX_BODY_BYTES = 1024 * 1024;
+/** Largest accepted prompt, in characters. */
+const ANALYZE_MAX_PROMPT_CHARS = 1e5;
+/**
+* `Idempotency-Key` format: 1–200 visible ASCII characters without spaces, so
+* a platform can use a UUID or its own `type:id` token.
+*/
+const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,200}$/u;
+/** Feishu `user_id`: not an `open_id` (`ou_`), `union_id` (`on_`), or chat id (`oc_`). */
+const FEISHU_USER_ID = /^(?!ou_|on_|oc_)[A-Za-z0-9_-]+$/u;
+/**
+* Application / error-code segment: it names a workspace directory
+* (`<baseDir>/analyze/<app>/<errorCode>` below the Feishu channel's
+* `baseDir`), so only path-safe characters pass.
+*/
+const SUBJECT_SEGMENT = /^(?!\.{1,2}$)[A-Za-z0-9._-]{1,128}$/u;
+/** JSON body of one analyze request. */
+const analyzeRequestSchema = z.object({
+	/** Feishu user_id of the person who started the analysis on the platform. */
+	requesterUserId: z.string().regex(FEISHU_USER_ID, "must be a Feishu user_id").max(128),
+	/** When the analysis was started on the platform, shown verbatim on the root card. */
+	triggeredAt: z.string().min(1).max(64).refine((value) => value.trim() !== "", "must not be blank"),
+	/** Application the logs belong to (workspace directory segment). */
+	app: z.string().regex(SUBJECT_SEGMENT, "must be 1-128 of A-Z a-z 0-9 . _ -"),
+	/** Error code of the logs (workspace directory segment). */
+	errorCode: z.string().regex(SUBJECT_SEGMENT, "must be 1-128 of A-Z a-z 0-9 . _ -"),
+	/** Log-platform detail pages of the logs that triggered the analysis (listed on the root card). */
+	logDetails: z.array(z.object({
+		/** Row label. */
+		name: z.string().min(1).max(200).refine((value) => value.trim() !== "", "must not be blank"),
+		/** Detail page address. */
+		url: z.url({
+			protocol: /^https?$/u,
+			error: "must be an http(s) URL"
+		}).max(2048)
+	}).strict()).min(1).max(50),
+	/** Target group chat (`oc_…`); must be an authorized group. */
+	chatId: z.string().regex(/^oc_[A-Za-z0-9_-]{1,128}$/u, "must be a Feishu group chat_id (oc_...)"),
+	/** Prompt forwarded verbatim as the analysis Session's first user message. */
+	prompt: z.string().min(1).max(ANALYZE_MAX_PROMPT_CHARS).refine((value) => value.trim() !== "", "must not be blank")
+}).strict();
+/**
+* Fingerprint of one validated request, used to tell a retry of the same
+* request from a reused `Idempotency-Key`. Field order is fixed: dsh-channels
+* 0.7 stored the same digest, so its accepted keys keep replaying.
+* @param request - the validated request.
+* @returns SHA-256 hex digest.
+*/
+function analyzeRequestHash(request) {
+	const canonical = JSON.stringify([
+		request.requesterUserId,
+		request.triggeredAt,
+		request.app,
+		request.errorCode,
+		request.logDetails.map((detail) => [detail.name, detail.url]),
+		request.chatId,
+		request.prompt
+	]);
+	return createHash("sha256").update(canonical).digest("hex");
+}
+/**
+* Validate one decoded JSON body.
+* @param raw - the decoded body.
+* @returns the request, or a readable list of field errors.
+*/
+function parseAnalyzeRequest(raw) {
+	const parsed = analyzeRequestSchema.safeParse(raw);
+	if (parsed.success) return {
+		ok: true,
+		value: parsed.data
+	};
+	return {
+		ok: false,
+		error: `请求参数不合法：${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(body)"}: ${issue.message}`).join("; ")}`
+	};
+}
+//#endregion
+//#region src/analyze/topics.ts
+/** Name dsh-channels provides the service under. */
+const FEISHU_TOPICS_SERVICE = "feishuTopics";
+/**
+* Classify the value `ctx.get('feishuTopics')` returned. The provider is
+* another package that may be older or newer than this one, so its version
+* is checked at run time.
+* @param value - the looked-up service, or undefined.
+* @returns the usable service, or why there is none.
+*/
+function lookupTopics(value) {
+	if (value === void 0 || value === null) return { availability: "missing" };
+	const service = value;
+	if (service.version !== 1 || typeof service.launch !== "function") return { availability: "incompatible" };
+	return {
+		availability: "ready",
+		service: value
+	};
+}
+/**
+* The topic one analyze request starts.
+* @param request - the validated request.
+* @param idempotencyKey - the request's `Idempotency-Key`, used unchanged as the launch key.
+* @returns the launch spec.
+*/
+function analyzeTopicSpec(request, idempotencyKey) {
+	return {
+		key: idempotencyKey,
+		fingerprint: analyzeRequestHash(request),
+		chatId: request.chatId,
+		requesterUserId: request.requesterUserId,
+		card: {
+			title: "日志分析",
+			taskName: "分析",
+			lead: [
+				{ text: `于 ${request.triggeredAt} 发起了对 ` },
+				{
+					text: request.app,
+					bold: true
+				},
+				{ text: " 应用 " },
+				{
+					text: request.errorCode,
+					bold: true
+				},
+				{ text: " 错误码不良日志的分析。" }
+			],
+			links: {
+				nameHeader: "日志",
+				linkHeader: "详情页",
+				rows: request.logDetails
+			}
+		},
+		workspace: {
+			segments: [
+				"analyze",
+				request.app,
+				request.errorCode
+			],
+			title: `日志分析 · ${request.app} · ${request.errorCode}`
+		},
+		prompt: request.prompt
+	};
+}
+/**
+* HTTP answer of one launch result.
+* @param result - what the service answered.
+* @returns status and body.
+*/
+function analyzeResponseOf(result) {
+	if (result.ok) return {
+		status: 202,
+		body: {
+			ok: true,
+			chatId: result.chatId,
+			messageId: result.messageId
+		}
+	};
+	switch (result.code) {
+		case "not-connected": return refused(503, result.message);
+		case "forbidden-chat": return refused(403, result.message);
+		case "key-conflict": return refused(409, "Idempotency-Key 已被内容不同的请求使用");
+		case "send-failed": return refused(502, result.message);
+		case "invalid": return refused(500, `分析请求处理失败：${result.message}`);
+		default: return refused(500, `分析请求处理失败：${String(result.message)}`);
+	}
+}
+/**
+* Start the analysis topic of one validated request.
+* @param topics - the `feishuTopics` service.
+* @param request - the validated request.
+* @param idempotencyKey - the request's `Idempotency-Key`.
+* @returns the HTTP answer.
+*/
+async function launchAnalysis(topics, request, idempotencyKey) {
+	return analyzeResponseOf(await topics.launch(analyzeTopicSpec(request, idempotencyKey)));
+}
+function refused(status, error) {
+	return {
+		status,
+		body: {
+			ok: false,
+			error
+		}
+	};
+}
+//#endregion
+//#region src/analyze/server.ts
+/**
+* 日志平台分析接口在 DSH Web 服务器上的路由。
+*
+* 只在宿主同时提供 `webServer` 和版本兼容的 dsh-channels `feishuTopics`
+* 服务时注册精确路由 `POST /open-api/logalyze`；dsh-channels 未加载、重载
+* 中、版本不兼容或为 0.7 及更早版本（自己注册该路由）时观象不注册，两者
+* 不会争用同一路径。
+* 本模块按顺序做传输层检查：路径、开关、方法、Bearer 令牌、
+* `Idempotency-Key`、媒体类型、请求体大小和 JSON 校验；通过后交给
+* `feishuTopics`。请求体、令牌和提示词都不写日志。
+*
+* @module dsh-guanxiang/analyze/server
+*/
+var HttpError$1 = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+function send(res, response) {
+	const body = JSON.stringify(response.body);
+	res.writeHead(response.status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"content-length": Buffer.byteLength(body)
+	});
+	res.end(body);
+}
+function refuse(res, status, error, headers = {}) {
+	for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
+	send(res, {
+		status,
+		body: {
+			ok: false,
+			error
+		}
+	});
+}
+/** Constant-time token comparison over fixed-length digests. */
+function tokenMatches(presented, expected) {
+	return timingSafeEqual(createHash("sha256").update(presented).digest(), createHash("sha256").update(expected).digest());
+}
+/** The bearer credential of one request, or undefined. */
+function bearerOf(req) {
+	const header = req.headers.authorization;
+	if (header === void 0) return void 0;
+	return /^Bearer[ \t]+(\S+)[ \t]*$/iu.exec(header)?.[1];
+}
+/** Read the body up to {@link ANALYZE_MAX_BODY_BYTES}; larger bodies fail with 413. */
+async function readBody(req) {
+	const declared = Number(req.headers["content-length"]);
+	if (Number.isFinite(declared) && declared > 1048576) throw new HttpError$1(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+		size += buffer.length;
+		if (size > 1048576) throw new HttpError$1(413, `请求体超过 ${ANALYZE_MAX_BODY_BYTES} 字节`);
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+/**
+* Handle one HTTP request against the analyze API.
+* @param req - the incoming request.
+* @param res - its response.
+* @param gate - switch and token.
+* @param launch - starts the analysis of a validated request.
+*/
+async function handleAnalyzeHttp(req, res, gate, launch) {
+	if (new URL(req.url ?? "/", "http://analyze.invalid").pathname !== "/open-api/logalyze") {
+		refuse(res, 404, "未知路径");
+		return;
+	}
+	if (!gate.enabled()) {
+		refuse(res, 404, "日志分析接口未开启，请在观象设置面板「分析接口」打开开关");
+		return;
+	}
+	if ((req.method ?? "GET").toUpperCase() !== "POST") {
+		refuse(res, 405, "只接受 POST", { allow: "POST" });
+		return;
+	}
+	const expected = await gate.token();
+	if (expected === void 0 || expected === "") {
+		refuse(res, 503, `分析接口未配置访问令牌，请在观象设置面板「分析接口」保存令牌（凭据名 ${gate.tokenEnv()}）`);
+		return;
+	}
+	const presented = bearerOf(req);
+	if (presented === void 0 || !tokenMatches(presented, expected)) {
+		refuse(res, 401, "访问令牌无效", { "www-authenticate": "Bearer" });
+		return;
+	}
+	const idempotencyKey = req.headers["idempotency-key"];
+	if (typeof idempotencyKey !== "string" || !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
+		refuse(res, 400, "缺少或不合法的 Idempotency-Key 请求头（1-200 个可见 ASCII 字符）");
+		return;
+	}
+	if ((req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase() !== "application/json") {
+		refuse(res, 415, "Content-Type 必须是 application/json");
+		return;
+	}
+	let raw;
+	try {
+		raw = JSON.parse(await readBody(req));
+	} catch (error) {
+		if (error instanceof HttpError$1) {
+			refuse(res, error.status, error.message);
+			return;
+		}
+		refuse(res, 400, "请求体不是合法的 JSON");
+		return;
+	}
+	const parsed = parseAnalyzeRequest(raw);
+	if (!parsed.ok) {
+		refuse(res, 400, parsed.error);
+		return;
+	}
+	send(res, await launch(parsed.value, idempotencyKey));
+}
+/**
+* Register the route while the host provides both `webServer` and a
+* compatible `feishuTopics`; it is removed when either goes away. Requests skip the DSH
+* login gate on purpose: the bearer token is this API's only credential.
+* @param ctx - the plugin context.
+* @param gate - switch and token.
+*/
+function mountAnalyzeRoute(ctx, gate) {
+	const attach = (scope) => {
+		const server = scope.get?.("webServer");
+		if (server === void 0) return;
+		const topics = lookupTopics(scope.get?.(FEISHU_TOPICS_SERVICE));
+		if (topics.availability !== "ready") {
+			if (topics.availability === "incompatible") ctx.logger?.warn?.("guanxiang: dsh-channels 的 feishuTopics 服务版本与观象不兼容，分析接口未注册；请把两者升级到相互兼容的版本");
+			return;
+		}
+		const { service } = topics;
+		const launch = (request, key) => launchAnalysis(service, request, key);
+		scope.effect(() => server.register({
+			kind: "exact",
+			path: ANALYZE_ROUTE,
+			handler: async (req, res) => {
+				try {
+					await handleAnalyzeHttp(req, res, gate, launch);
+				} catch (error) {
+					ctx.logger?.warn?.("guanxiang: 分析请求处理失败：%s", String(error));
+					if (!res.headersSent) refuse(res, 500, `分析请求处理失败：${String(error)}`);
+					else res.destroy();
+				}
+			}
+		}), "guanxiang: analyze route");
+	};
+	if (typeof ctx.inject === "function") {
+		ctx.inject(["webServer", FEISHU_TOPICS_SERVICE], attach);
+		return;
+	}
+	attach(ctx);
+}
+//#endregion
 //#region src/repos/credentials.ts
 /** Environment variables the helper reads; set only on git child processes. */
 const USERNAME_VARIABLE = "GUANXIANG_GIT_USERNAME";
@@ -190,6 +555,7 @@ const skillUpdatesSchema = z.object({
 	maxFiles: z.number().int().min(1).max(256).default(16),
 	maxFileBytes: z.number().int().min(1).max(16 * 1024 * 1024).default(256 * 1024)
 }).strict();
+const analyzeSchema = z.object({ enabled: z.boolean().default(false) }).strict();
 const authorSchema = z.object({
 	name: z.string().trim().min(1, "提交作者名不能为空").refine((value) => !/[<>\n]/.test(value), "提交作者名不能包含 < > 或换行"),
 	email: z.string().trim().min(1, "提交作者邮箱不能为空").refine((value) => !/[<>\s]/.test(value), "提交作者邮箱不能包含 < > 或空白")
@@ -223,7 +589,8 @@ const editableFields = {
 	maxAppsPerRequest: z.number().int().min(1).max(32),
 	dispatchTimeoutMs: durationMs(1e3),
 	download: downloadSchema,
-	skillUpdates: skillUpdatesSchema
+	skillUpdates: skillUpdatesSchema,
+	analyze: analyzeSchema
 };
 /** Standard Schema the Cordis loader validates `config` with before `apply()`. */
 const pluginConfigSchema = z.object({
@@ -236,9 +603,15 @@ const pluginConfigSchema = z.object({
 	dispatchTimeoutMs: editableFields.dispatchTimeoutMs.default(1800 * 1e3),
 	download: downloadSchema.prefault({}),
 	skillUpdates: skillUpdatesSchema.prefault({}),
+	analyze: analyzeSchema.prefault({}),
+	/**
+	* Credential reference (environment-variable name) whose value is the
+	* analyze API's bearer token.
+	*/
+	analyzeTokenRef: z.string().trim().regex(TOKEN_ENV_PATTERN, "令牌名称只能包含字母、数字和下划线，且不能以数字开头").default("GUANXIANG_ANALYZE_TOKEN"),
 	/**
-	* Author and committer of SKILL improvement commits; omitted uses the git
-	* identity configured on the host (`user.name` / `user.email`).
+	* Author of SKILL improvement commits; omitted uses the user of the token
+	* dsh-repo holds for the repository's host, who is always the committer.
 	*/
 	skillUpdateAuthor: authorSchema.optional(),
 	/** Registered `ctx.subagents` provider the children start on. */
@@ -266,7 +639,8 @@ const overlaySchema = z.object({
 	maxAppsPerRequest: editableFields.maxAppsPerRequest.optional(),
 	dispatchTimeoutMs: editableFields.dispatchTimeoutMs.optional(),
 	download: downloadSchema.optional(),
-	skillUpdates: skillUpdatesSchema.optional()
+	skillUpdates: skillUpdatesSchema.optional(),
+	analyze: analyzeSchema.optional()
 }).strict();
 /** A complete editable settings payload, as the panel saves it. */
 const editableSettingsSchema = z.object(editableFields).strict();
@@ -344,7 +718,8 @@ function defaultsOf(config, env = process.env) {
 			...config.download,
 			allowedHosts: [...config.download.allowedHosts]
 		},
-		skillUpdates: { ...config.skillUpdates }
+		skillUpdates: { ...config.skillUpdates },
+		analyze: { ...config.analyze }
 	};
 }
 /**
@@ -363,7 +738,8 @@ function applyOverlay(defaults, overlay) {
 		maxAppsPerRequest: overlay.maxAppsPerRequest ?? defaults.maxAppsPerRequest,
 		dispatchTimeoutMs: overlay.dispatchTimeoutMs ?? defaults.dispatchTimeoutMs,
 		download: overlay.download ?? defaults.download,
-		skillUpdates: overlay.skillUpdates ?? defaults.skillUpdates
+		skillUpdates: overlay.skillUpdates ?? defaults.skillUpdates,
+		analyze: overlay.analyze ?? defaults.analyze
 	};
 }
 //#endregion
@@ -398,9 +774,9 @@ async function abortable(promise, signal) {
 //#endregion
 //#region src/skill-update/git.ts
 /**
-* 在拉取仓库中用 git 底层命令生成 SKILL 修改的提交并推送：用临时索引文件
-* 在分析时的提交上替换文件、写出树对象，不改动任何检出、快照或本地分支；
-* 推送时用 GitLab push options 顺带创建合并请求。
+* 在拉取仓库中用 git 底层命令检查 SKILL 修改：用临时索引文件在分析时的提交上
+* 替换文件、写出树对象，算出逐文件行数和 diff，不改动任何检出、快照或本地
+* 分支。树对象的前缀用作新分支名，提交本身经 dsh-repo 完成。
 *
 * @module dsh-guanxiang/skill-update/git
 */
@@ -519,96 +895,6 @@ async function prepareChange(commands, dir, base, skillDir, files) {
 		});
 	}
 }
-/**
-* Whether the remote already has a branch.
-* @param commands - git runner and timeout.
-* @param dir - clone directory.
-* @param branch - branch name.
-* @param env - network environment of the clone's address.
-* @returns whether `refs/heads/<branch>` exists on `origin`.
-*/
-async function remoteBranchExists(commands, dir, branch, env) {
-	return (await commands.git([
-		"ls-remote",
-		"--heads",
-		"origin",
-		`refs/heads/${branch}`
-	], {
-		cwd: dir,
-		timeoutMs: commands.timeoutMs,
-		env
-	})).trim() !== "";
-}
-/**
-* Commit a prepared tree on its base commit without touching any ref.
-* @param commands - git runner and timeout.
-* @param dir - clone directory.
-* @param change - prepared tree and its base.
-* @param message - full commit message.
-* @param author - explicit identity; omitted uses the host's git configuration.
-* @returns the new commit id.
-*/
-async function commitChange(commands, dir, change, message, author) {
-	const env = author === void 0 ? void 0 : {
-		GIT_AUTHOR_NAME: author.name,
-		GIT_AUTHOR_EMAIL: author.email,
-		GIT_COMMITTER_NAME: author.name,
-		GIT_COMMITTER_EMAIL: author.email
-	};
-	return (await commands.git([
-		"commit-tree",
-		change.tree,
-		"-p",
-		change.base,
-		"-F",
-		"-"
-	], {
-		cwd: dir,
-		timeoutMs: commands.timeoutMs,
-		input: message,
-		...env === void 0 ? {} : { env }
-	})).trim();
-}
-/** Push options cannot carry line breaks; collapse every whitespace run. */
-function oneLine(text) {
-	return text.replace(/\s+/g, " ").trim();
-}
-/**
-* Push a commit to a new remote branch and ask GitLab to open a merge request
-* for it (`merge_request.*` push options). The push carries an empty lease on
-* the branch, so it fails instead of updating a branch that appeared after
-* {@link remoteBranchExists} was checked. A server that does not support push
-* options rejects the push.
-* @param commands - git runner and timeout.
-* @param dir - clone directory.
-* @param commit - commit to push.
-* @param branch - new branch name.
-* @param request - merge request target and text.
-* @param env - network environment of the clone's address.
-* @returns the merge request URL the server printed, if any.
-*/
-async function pushForMergeRequest(commands, dir, commit, branch, request, env) {
-	const options = [
-		"merge_request.create",
-		`merge_request.target=${request.target}`,
-		`merge_request.title=${oneLine(request.title)}`,
-		`merge_request.description=${oneLine(request.description)}`
-	].flatMap((option) => ["-o", option]);
-	const output = await commands.git([
-		"push",
-		"--porcelain",
-		`--force-with-lease=refs/heads/${branch}:`,
-		...options,
-		"origin",
-		`${commit}:refs/heads/${branch}`
-	], {
-		cwd: dir,
-		timeoutMs: commands.timeoutMs,
-		env,
-		output: "all"
-	});
-	return /https?:\/\/\S+\/-\/merge_requests\/\d+/.exec(output)?.[0];
-}
 //#endregion
 //#region src/repos/manifest.ts
 /**
@@ -830,6 +1116,37 @@ async function readProposal(workDir, limits) {
 	};
 }
 //#endregion
+//#region src/skill-update/repos.ts
+/** Name dsh-repo provides the service under. */
+const DSH_REPOS_SERVICE = "dshRepos";
+/**
+* Classify the value `ctx.get('dshRepos')` returned. The provider is another
+* package that may be older or newer than this one, so its version is checked
+* at run time; `getBranch` marks a provider that also honors `baseSha` and
+* `newBranch` on commits.
+* @param value - the looked-up service, or undefined.
+* @returns the usable service, or why there is none.
+*/
+function lookupRepos(value) {
+	if (value === void 0 || value === null) return { availability: "missing" };
+	const service = value;
+	if (service.version !== 1 || typeof service.getBranch !== "function" || typeof service.commitFiles !== "function" || typeof service.createChange !== "function") return { availability: "incompatible" };
+	return {
+		availability: "ready",
+		service: value
+	};
+}
+/**
+* The failure class of a `dshRepos` rejection.
+* @param error - the rejection.
+* @returns its `code` when it is a `RepoError`.
+*/
+function repoErrorCode(error) {
+	if (!(error instanceof Error) || error.name !== "RepoError") return void 0;
+	const code = error.code;
+	return typeof code === "string" ? code : void 0;
+}
+//#endregion
 //#region src/skill-update/tool.ts
 /**
 * `guanxiang_propose_skill`：把某个派发任务的 SKILL 修改提议提交为合并请求。
@@ -837,11 +1154,13 @@ async function readProposal(workDir, limits) {
 * - 只接受本进程中由同一会话派发过的任务运行目录；应用、仓库和分析时的提交
 *   取自派发记录，不取自运行目录里可被 Agent 改写的内容。
 * - 只改应用 SKILL 目录 `.dsh/skills/<skill>/` 下的文件，提交以分析时的提交为
-*   父提交，推送到新分支 `guanxiang/skill-<应用 id>-<树对象前缀>`，从不推送已有
-*   分支或默认分支。
-* - 推送前经 DSH 审批服务（`ctx.approval`）请求一次性授权；dsh_channels 把它
-*   显示为飞书决策卡片，DSH Web 显示为审批提示。只有 `allowed-once` 才推送；
-*   没有审批服务时工具报错，不推送。
+*   父提交，提交到新分支 `guanxiang/skill-<应用 id>-<树对象前缀>`，从不提交到
+*   已有分支或默认分支。
+* - 提交和创建合并请求经 dsh-repo 的 `dshRepos` 服务完成，支持 GitLab 与
+*   GitHub；令牌由 dsh-repo 按主机配置。没有该服务或版本不符时工具报错。
+* - 提交前经 DSH 审批服务（`ctx.approval`）请求一次性授权；dsh_channels 把它
+*   显示为飞书决策卡片，DSH Web 显示为审批提示。只有 `allowed-once` 才提交；
+*   没有审批服务时工具报错，不提交。
 * - 子会话中不提供本工具。
 *
 * @module dsh-guanxiang/skill-update/tool
@@ -915,7 +1234,8 @@ const OUTPUT_SCHEMA$1 = {
 			}
 		},
 		diffPath: { type: "string" },
-		mergeRequestUrl: { type: "string" }
+		mergeRequestUrl: { type: "string" },
+		mergeRequestError: { type: "string" }
 	}
 };
 /**
@@ -936,12 +1256,12 @@ function renderProposeValue(value) {
 	return [{
 		type: "text",
 		text: `${{
-			opened: `已推送到 ${where} 并创建合并请求：${value.mergeRequestUrl ?? ""}`,
-			pushed: `已推送到 ${where}，但服务器没有返回合并请求链接；请在 GitLab 上确认合并请求是否已创建。`,
-			exists: `${where} 已存在，同一改动可能已经提交过，本次没有推送。`,
-			rejected: "授权被拒绝，没有推送：用户拒绝了这次修改，或会话的审批策略为 never（例如「完全访问」权限模式）。",
-			cancelled: "授权请求被撤回，没有推送。",
-			unavailable: "当前没有可以回答授权请求的界面，没有推送。"
+			opened: `已提交到 ${where} 并创建合并请求：${value.mergeRequestUrl ?? ""}`,
+			pushed: `已提交到 ${where}，但创建合并请求失败（${value.mergeRequestError ?? "未知原因"}）；请在代码托管平台上从该分支手动创建。`,
+			exists: `${where} 已存在，同一改动可能已经提交过，本次没有提交。`,
+			rejected: "授权被拒绝，没有提交：用户拒绝了这次修改，或会话的审批策略为 never（例如「完全访问」权限模式）。",
+			cancelled: "授权请求被撤回，没有提交。",
+			unavailable: "当前没有可以回答授权请求的界面，没有提交。"
 		}[value.status]}\n改动：${describeFiles(value.files)}\ndiff：${value.diffPath}`
 	}];
 }
@@ -1030,6 +1350,7 @@ var SkillUpdater = class {
 		await replaceFile(diffPath, change.diff);
 		return {
 			reason: proposal.reason,
+			files: proposal.files,
 			change,
 			target,
 			diffPath
@@ -1042,7 +1363,7 @@ var SkillUpdater = class {
 	definition() {
 		return {
 			name: PROPOSE_TOOL_NAME,
-			description: "观象：把派发结果中某个应用的 SKILL 修改提议提交为合并请求。工具先请求用户授权，批准后推送新分支并创建合并请求，不会直接改动默认分支。仅在派发结果标出了 SKILL 修改提议时使用；不要自己用 git 推送。",
+			description: "观象：把派发结果中某个应用的 SKILL 修改提议提交为合并请求。工具先请求用户授权，批准后提交到新分支并创建合并请求，不会直接改动默认分支。仅在派发结果标出了 SKILL 修改提议时使用；不要自己用 git 推送。",
 			parameters: PARAMETERS,
 			output: {
 				schema: OUTPUT_SCHEMA$1,
@@ -1057,7 +1378,7 @@ var SkillUpdater = class {
 	* @param rawArgs - model arguments.
 	* @param exec - execution context of the calling agent.
 	* @returns how the submission ended.
-	* @throws when the arguments, task, proposal, or approval service are unusable, or git fails; nothing is pushed then.
+	* @throws when the arguments, task, proposal, approval service, or `dshRepos` service are unusable, or the commit fails; nothing is committed then.
 	*/
 	async execute(rawArgs, exec) {
 		const parsed = argsSchema$1.safeParse(rawArgs);
@@ -1071,7 +1392,10 @@ var SkillUpdater = class {
 		if (task === void 0) throw new Error(`${parsed.data.workDir} 不是本次 DSH 运行中观象派发任务的运行目录；DSH 重启后需要重新分析`);
 		if (task.sessionId !== agent.session.header.id) throw new Error(`${parsed.data.workDir} 不是当前会话派发的任务`);
 		const approval = this.deps.approval();
-		if (approval === void 0) throw new Error("当前 DSH 组合没有审批服务（@deepseek-ai/dsh-user-approval），观象不会在未经授权时推送");
+		if (approval === void 0) throw new Error("当前 DSH 组合没有审批服务（@deepseek-ai/dsh-user-approval），观象不会在未经授权时提交");
+		const lookup = lookupRepos(this.deps.repos());
+		if (lookup.availability !== "ready") throw new Error(lookup.availability === "missing" ? `提交 SKILL 修改需要 dsh-repo 插件提供的 ${DSH_REPOS_SERVICE} 服务；请安装 dsh-repo，并在它的 hosts 中配置该应用仓库所在的主机和令牌` : `dsh-repo 的 ${DSH_REPOS_SERVICE} 服务与观象不兼容（观象需要服务版本 1 且提供 getBranch，即 dsh-repo 0.1.0-beta.2 及以上）；请升级 dsh-repo`);
+		const repos = lookup.service;
 		const prepared = await this.prepare(task);
 		if (prepared === void 0) throw new Error(`${task.workDir} 中没有 SKILL 修改提议（${PROPOSAL_DIR}/${REASON_FILE} 与 ${PROPOSAL_DIR}/${FILES_DIR}/）`);
 		const { change, target, diffPath, reason } = prepared;
@@ -1084,17 +1408,13 @@ var SkillUpdater = class {
 			files: [...change.files],
 			diffPath
 		};
-		const commands = {
-			git: this.deps.git,
-			timeoutMs: this.deps.gitTimeoutMs
-		};
-		if (await this.deps.registry.withClone(task.url, (clone) => remoteBranchExists(commands, clone.dir, branch, clone.env))) return {
+		if (await repos.getBranch(task.url, branch, { signal: exec.signal }) !== void 0) return {
 			...base,
 			status: "exists"
 		};
 		const preview = reason.replace(/\s+/g, " ").slice(0, REASON_PREVIEW_CHARS);
-		const zh = `观象将向 ${task.url} 推送新分支 ${branch}，并创建合并请求合入 ${target}。改动：${describeFiles(change.files)}。摘要：${summary}。理由：${preview}`;
-		const en = `GuanXiang will push branch ${branch} to ${task.url} and open a merge request into ${target}. Files: ${change.files.map((file) => file.path).join(", ")}. Summary: ${summary}`;
+		const zh = `观象将在 ${task.url} 提交新分支 ${branch}，并创建合并请求合入 ${target}。改动：${describeFiles(change.files)}。摘要：${summary}。理由：${preview}`;
+		const en = `GuanXiang will commit branch ${branch} to ${task.url} and open a merge request into ${target}. Files: ${change.files.map((file) => file.path).join(", ")}. Summary: ${summary}`;
 		const outcome = await approval.request({
 			agent,
 			toolName: PROPOSE_TOOL_NAME,
@@ -1113,23 +1433,50 @@ var SkillUpdater = class {
 		};
 		const message = `${summary}\n\n${reason}\n\nProposed-by: 观象 GuanXiang\nAnalyzed-commit: ${task.commit}\nSession: ${task.sessionId}\n`;
 		const description = `由观象在日志分析中提出（应用 ${task.app.id}，分析提交 ${task.commit.slice(0, 12)}，会话 ${task.sessionId}）。理由：${reason.slice(0, REASON_DESCRIPTION_CHARS)}`;
-		const url = await this.deps.registry.withClone(task.url, async (clone) => {
-			exec.signal.throwIfAborted();
-			const commit = await commitChange(commands, clone.dir, change, message, this.deps.author);
-			return await pushForMergeRequest(commands, clone.dir, commit, branch, {
-				target,
+		const changed = new Set(change.files.map((file) => file.path));
+		const files = prepared.files.map((file) => ({
+			action: "write",
+			path: `${skillDirOf(task.app)}/${file.path}`,
+			content: file.content
+		})).filter((file) => changed.has(file.path));
+		exec.signal.throwIfAborted();
+		try {
+			await repos.commitFiles(task.url, {
+				branch,
+				baseSha: task.commit,
+				newBranch: true,
+				message,
+				files,
+				...this.deps.author === void 0 ? {} : { author: this.deps.author },
+				signal: exec.signal
+			});
+		} catch (error) {
+			if (repoErrorCode(error) === "conflict") return {
+				...base,
+				status: "exists"
+			};
+			throw error;
+		}
+		try {
+			const opened = await repos.createChange(task.url, {
 				title: summary,
-				description
-			}, clone.env);
-		});
-		return url === void 0 ? {
-			...base,
-			status: "pushed"
-		} : {
-			...base,
-			status: "opened",
-			mergeRequestUrl: url
-		};
+				body: description,
+				sourceBranch: branch,
+				targetBranch: target,
+				signal: exec.signal
+			});
+			return {
+				...base,
+				status: "opened",
+				mergeRequestUrl: opened.webUrl
+			};
+		} catch (error) {
+			return {
+				...base,
+				status: "pushed",
+				mergeRequestError: messageOf$2(error)
+			};
+		}
 	}
 };
 //#endregion
@@ -2096,8 +2443,7 @@ var RepoRegistry = class {
 			const branch = entry.spec.branch ?? (await this.remoteHead(entry.dir, env)).replace(/^refs\/remotes\/origin\//, "");
 			return await task({
 				dir: entry.dir,
-				branch,
-				env
+				branch
 			});
 		});
 	}
@@ -2627,6 +2973,7 @@ var GuanxiangService = class {
 	skill;
 	active = true;
 	refreshWaitMs;
+	analyzeTokenRef;
 	booted = Promise.withResolvers();
 	/**
 	* @param ctx - plugin context.
@@ -2639,6 +2986,7 @@ var GuanxiangService = class {
 		this.store = store;
 		this.defaults = defaultsOf(config);
 		this.refreshWaitMs = config.refreshWaitMs;
+		this.analyzeTokenRef = config.analyzeTokenRef;
 		this.current = this.defaults;
 		const git = options.git ?? runGit;
 		this.registry = new RepoRegistry({
@@ -2655,7 +3003,8 @@ var GuanxiangService = class {
 			git,
 			gitTimeoutMs: config.gitTimeoutMs,
 			...config.skillUpdateAuthor === void 0 ? {} : { author: config.skillUpdateAuthor },
-			approval: () => ctx.get?.("approval")
+			approval: () => ctx.get?.("approval"),
+			repos: () => ctx.get?.(DSH_REPOS_SERVICE)
 		});
 		this.dispatcher = new Dispatcher({
 			registry: this.registry,
@@ -2755,7 +3104,32 @@ var GuanxiangService = class {
 			overridden: overriddenKeys(this.overlay),
 			...this.overlayError === void 0 ? {} : { overlayError: this.overlayError },
 			repos: this.registry.status(),
-			credentials: await this.credentialsState()
+			credentials: await this.credentialsState(),
+			analyze: await this.analyzeState()
+		};
+	}
+	/** @returns the analyze route's switch and bearer token, read per request. */
+	analyzeGate() {
+		return {
+			enabled: () => this.current.analyze.enabled,
+			tokenEnv: () => this.analyzeTokenRef,
+			token: async () => {
+				try {
+					return (await this.credentialStore()?.resolve(this.analyzeTokenRef))?.value;
+				} catch (error) {
+					this.ctx.logger?.warn?.("guanxiang: 读取分析接口令牌 %s 失败：%s", this.analyzeTokenRef, error instanceof Error ? error.message : String(error));
+					return;
+				}
+			}
+		};
+	}
+	async analyzeState() {
+		const store = this.credentialStore();
+		return {
+			route: ANALYZE_ROUTE,
+			tokenEnv: this.analyzeTokenRef,
+			...store === void 0 ? {} : { token: await describeToken(store, this.analyzeTokenRef) },
+			topics: lookupTopics(this.ctx.get?.(FEISHU_TOPICS_SERVICE)).availability
 		};
 	}
 	credentialStore() {
@@ -2770,24 +3144,7 @@ var GuanxiangService = class {
 		const names = [...new Set(this.current.gitCredentials.map((credential) => credential.tokenEnv))];
 		return {
 			available: true,
-			tokens: await Promise.all(names.map(async (tokenEnv) => {
-				try {
-					const info = await store.describe(tokenEnv);
-					return {
-						tokenEnv,
-						configured: info.configured,
-						...info.source === void 0 ? {} : { source: info.source },
-						writable: info.writable
-					};
-				} catch (error) {
-					return {
-						tokenEnv,
-						configured: false,
-						writable: false,
-						error: error instanceof Error ? error.message : String(error)
-					};
-				}
-			}))
+			tokens: await Promise.all(names.map((tokenEnv) => describeToken(store, tokenEnv)))
 		};
 	}
 	/**
@@ -2809,10 +3166,11 @@ var GuanxiangService = class {
 	}
 	/**
 	* Store the token of one access-token configuration in DSH's credential
-	* store, then re-sync the repositories that use it.
+	* store, then re-sync the repositories that use it; or store the analyze
+	* API's bearer token (`analyzeTokenRef`), which applies from the next request.
 	* @param raw - request body `{ tokenEnv, value }`.
 	* @returns the new panel state.
-	* @throws SettingsError when the body is invalid, the name is not referenced by the saved settings, or no credential store is loaded.
+	* @throws SettingsError when the body is invalid, the name is neither referenced by the saved settings nor `analyzeTokenRef`, or no credential store is loaded.
 	*/
 	async setToken(raw) {
 		const parsed = tokenSetSchema.safeParse(raw);
@@ -2832,7 +3190,7 @@ var GuanxiangService = class {
 		return await this.writeToken(parsed.data.tokenEnv, void 0);
 	}
 	async writeToken(tokenEnv, value) {
-		if (!this.current.gitCredentials.some((credential) => credential.tokenEnv === tokenEnv)) throw new SettingsError(`${tokenEnv} 不是已保存的访问令牌配置引用的名称`);
+		if (tokenEnv !== this.analyzeTokenRef && !this.current.gitCredentials.some((credential) => credential.tokenEnv === tokenEnv)) throw new SettingsError(`${tokenEnv} 不是已保存的访问令牌配置引用的名称`);
 		const store = this.credentialStore();
 		if (store === void 0) throw new SettingsError("当前 DSH 组合没有凭据服务（@deepseek-ai/dsh-credentials-local），无法保存令牌");
 		if (value === void 0) await store.unset(tokenEnv);
@@ -2893,6 +3251,24 @@ var GuanxiangService = class {
 		this.skill.invalidate();
 	}
 };
+async function describeToken(store, tokenEnv) {
+	try {
+		const info = await store.describe(tokenEnv);
+		return {
+			tokenEnv,
+			configured: info.configured,
+			...info.source === void 0 ? {} : { source: info.source },
+			writable: info.writable
+		};
+	} catch (error) {
+		return {
+			tokenEnv,
+			configured: false,
+			writable: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
 //#endregion
 //#region src/settings/routes.ts
 /** Request body cap: the settings payload is small. */
@@ -3080,10 +3456,11 @@ function mountSettingsRoutes(ctx, service) {
 * 任务匹配已注册应用时由顶层 Agent 自行加载）和
 * `guanxiang_dispatch` 工具（按应用派发子 Agent，工作目录为该应用的代码
 * 仓库，首条消息用 `/<skill>` 加载仓库里的日志分析 SKILL），以及开启 SKILL
-* 改进时的 `guanxiang_propose_skill` 工具（经用户授权后把子 Agent 的 SKILL
-* 修改提议推送到新分支并创建合并请求）。应用仓库在设置
+* 改进时的 `guanxiang_propose_skill` 工具（经用户授权后经 dsh-repo 把子 Agent
+* 的 SKILL 修改提议提交到新分支并创建合并请求）。应用仓库在设置
 * 面板中只填 git 地址，由插件拉取；应用描述来自各仓库的
-* `.dsh/guanxiang.yaml`。
+* `.dsh/guanxiang.yaml`。另提供日志平台分析接口 `POST /open-api/logalyze`，
+* 经 dsh-channels 的 `feishuTopics` 服务在飞书群话题中开始分析。
 *
 * @module dsh-guanxiang
 */
@@ -3096,8 +3473,9 @@ const inject = [
 	"subagents"
 ];
 /**
-* Install the entry skill, the dispatch and SKILL proposal tools, and the settings routes, then
-* clone or update the configured repositories in the background.
+* Install the entry skill, the dispatch and SKILL proposal tools, the settings
+* routes, and the analyze route, then clone or update the configured
+* repositories in the background.
 * @param ctx - plugin context.
 * @param config - loader-validated configuration.
 * @param options - test seams.
@@ -3107,6 +3485,7 @@ function apply(ctx, config, options = {}) {
 	service.registerSkill();
 	service.registerTool();
 	mountSettingsRoutes(ctx, service);
+	mountAnalyzeRoute(ctx, service.analyzeGate());
 	ctx.effect(() => {
 		service.boot().catch((error) => {
 			ctx.logger?.error?.("guanxiang: 启动失败：%s", error instanceof Error ? error.message : String(error));
@@ -3117,6 +3496,6 @@ function apply(ctx, config, options = {}) {
 	}, "guanxiang: repositories");
 }
 //#endregion
-export { pluginConfigSchema as Config, pluginConfigSchema, DISPATCH_TOOL_NAME, Dispatcher, ENTRY_SKILL_NAME, GuanxiangService, MANIFEST_PATH, PROPOSE_TOOL_NAME, RepoRegistry, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE, SkillUpdater, apply, inject, name, readAppManifest, renderChildPrompt, renderEntrySkill, resolveConfig };
+export { ANALYZE_ROUTE, pluginConfigSchema as Config, pluginConfigSchema, DISPATCH_TOOL_NAME, Dispatcher, ENTRY_SKILL_NAME, GuanxiangService, MANIFEST_PATH, PROPOSE_TOOL_NAME, RepoRegistry, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE, SkillUpdater, analyzeRequestHash, apply, inject, name, parseAnalyzeRequest, readAppManifest, renderChildPrompt, renderEntrySkill, resolveConfig };
 
 //# sourceMappingURL=index.js.map