@modesto_ma/dsh-guanxiang 0.2.0-beta.2 → 0.2.0-beta.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modesto_ma/dsh-guanxiang",
-  "version": "0.2.0-beta.2",
+  "version": "0.2.0-beta.4",
   "description": "观象 GuanXiang：DeepSeek Harness (DSH) 日志分析插件。/guanxiang 识别日志所属应用，把分析派发给工作目录为该应用代码仓库的子 Agent；Web 左侧栏提供「观象」设置面板",
   "repository": {
     "type": "git",
@@ -65,6 +65,7 @@
     "access": "public"
   },
   "dependencies": {
+    "diff": "^8.0.4",
     "yaml": "^2.9.1",
     "zod": "^4.6.7"
   },
@@ -90,6 +91,7 @@
     "@types/node": "^26.6.5",
     "@types/react": "~18.3.31",
     "conventional-changelog-conventionalcommits": "9.3.1",
+    "dsh-repo": "^0.1.0-beta.3",
     "react": "18.3.1",
     "semantic-release": "^25.0.9",
     "tsdown": "0.22.2",

package/src/client/api.ts

@@ -4,8 +4,8 @@
  * @module dsh-guanxiang/client/api
  */
 
-import { SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE, TOKEN_ROUTE } from '../settings/contract.ts'
-import type { EditableSettings, MutationError, MutationOk, StateWire } from '../settings/contract.ts'
+import { HOST_TOKEN_ROUTE, HOSTS_ROUTE, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE, TOKEN_ROUTE } from '../settings/contract.ts'
+import type { EditableSettings, HostAddRequest, MutationError, MutationOk, StateWire } from '../settings/contract.ts'
 
 /**
  * Error text of a value thrown by a request.
@@ -77,8 +77,8 @@ export async function syncRepos(url?: string): Promise<StateWire> {
 }
 
 /**
- * Store an access token in DSH's credential store.
- * @param tokenEnv - credential reference named by a saved access-token configuration.
+ * Store the analyze token in DSH's credential store.
+ * @param tokenEnv - the analyze token's credential reference.
  * @param value - token value.
  * @returns the new state, which reports only whether the token is set.
  */
@@ -87,10 +87,47 @@ export async function saveToken(tokenEnv: string, value: string): Promise<StateW
 }
 
 /**
- * Remove a stored access token.
- * @param tokenEnv - credential reference named by a saved access-token configuration.
+ * Remove the stored analyze token.
+ * @param tokenEnv - the analyze token's credential reference.
  * @returns the new state.
  */
 export async function clearToken(tokenEnv: string): Promise<StateWire> {
   return (await request<MutationOk>(TOKEN_ROUTE, { method: 'DELETE', body: JSON.stringify({ tokenEnv }) })).state
 }
+
+/**
+ * Add a dsh-repo host, with its token.
+ * @param host - kind, address, alias, and token.
+ * @returns the new state.
+ */
+export async function addHost(host: HostAddRequest): Promise<StateWire> {
+  return (await request<MutationOk>(HOSTS_ROUTE, { method: 'POST', body: JSON.stringify(host) })).state
+}
+
+/**
+ * Remove a host added from a panel.
+ * @param url - host address.
+ * @returns the new state.
+ */
+export async function removeHost(url: string): Promise<StateWire> {
+  return (await request<MutationOk>(HOSTS_ROUTE, { method: 'DELETE', body: JSON.stringify({ url }) })).state
+}
+
+/**
+ * Store a host's token.
+ * @param url - host address.
+ * @param value - token value.
+ * @returns the new state, which reports only whether the token is set.
+ */
+export async function saveHostToken(url: string, value: string): Promise<StateWire> {
+  return (await request<MutationOk>(HOST_TOKEN_ROUTE, { method: 'PUT', body: JSON.stringify({ url, value }) })).state
+}
+
+/**
+ * Remove a host's stored token.
+ * @param url - host address.
+ * @returns the new state.
+ */
+export async function clearHostToken(url: string): Promise<StateWire> {
+  return (await request<MutationOk>(HOST_TOKEN_ROUTE, { method: 'DELETE', body: JSON.stringify({ url }) })).state
+}

package/src/client/page.tsx

@@ -1,14 +1,15 @@
 /**
  * 左侧栏「观象」主区页面：应用仓库、访问令牌、日志下载、分析接口、高级（含 SKILL 改进）五个
- * 分页，共用一份草稿和底部保存条；令牌值不进草稿，单独存入 DSH 凭据库。
+ * 分页，共用一份草稿和底部保存条。访问令牌分页管理 dsh-repo 的主机，改动立即
+ * 生效，不进草稿；令牌值存入 DSH 凭据库。
  * 仓库拉取中时每 2 秒刷新状态。
  *
  * @module dsh-guanxiang/client/page
  */
 
 import { useCallback, useEffect, useMemo, useState } from 'react'
-import type { AnalyzeWire, EditableKey, EditableSettings, GitCredentialSpec, RepoSpec, RepoStatusWire, StateWire, TokenStatusWire } from '../settings/contract.ts'
-import { clearToken, fetchState, messageOf, resetSettings, saveSettings, saveToken, syncRepos } from './api.ts'
+import type { AnalyzeWire, EditableKey, EditableSettings, HostAddRequest, HostKind, RepoSpec, RepoStatusWire, StateWire, TokenStatusWire } from '../settings/contract.ts'
+import { addHost, clearHostToken, clearToken, fetchState, messageOf, removeHost, resetSettings, saveHostToken, saveSettings, saveToken, syncRepos } from './api.ts'
 
 /** Sidebar label and page title. */
 export const PANEL_TITLE = '观象'
@@ -29,9 +30,7 @@ const TABS: readonly { id: TabId; label: string }[] = [
 
 /** Editable text form of the settings. */
 interface Draft {
-  reposDir: string
   repos: RepoSpec[]
-  gitCredentials: GitCredentialSpec[]
   fetchIntervalMin: string
   maxAppsPerRequest: string
   dispatchTimeoutMin: string
@@ -50,9 +49,7 @@ function trimNumber(value: number): string {
 
 function toDraft(settings: EditableSettings): Draft {
   return {
-    reposDir: settings.reposDir,
     repos: settings.repos.map(repo => ({ ...repo })),
-    gitCredentials: settings.gitCredentials.map(credential => ({ ...credential })),
     fetchIntervalMin: trimNumber(settings.fetchIntervalMs / MINUTE),
     maxAppsPerRequest: String(settings.maxAppsPerRequest),
     dispatchTimeoutMin: trimNumber(settings.dispatchTimeoutMs / MINUTE),
@@ -78,14 +75,7 @@ function fromDraft(draft: Draft): EditableSettings {
   const maxFiles = positive(draft.skillMaxFiles, '提议文件数上限')
   if (!Number.isInteger(maxFiles)) throw new Error('提议文件数上限必须是整数')
   return {
-    reposDir: draft.reposDir.trim(),
     repos: draft.repos.map(repo => repo.branch === undefined || repo.branch.trim() === '' ? { url: repo.url.trim() } : { url: repo.url.trim(), branch: repo.branch.trim() }),
-    gitCredentials: draft.gitCredentials.map(credential => ({
-      url: credential.url.trim(),
-      ...credential.alias === undefined || credential.alias.trim() === '' ? {} : { alias: credential.alias.trim() },
-      username: credential.username.trim(),
-      tokenEnv: credential.tokenEnv.trim(),
-    })),
     fetchIntervalMs: Math.round(positive(draft.fetchIntervalMin, '更新间隔', true) * MINUTE),
     maxAppsPerRequest: maxApps,
     dispatchTimeoutMs: Math.round(positive(draft.dispatchTimeoutMin, '派发超时') * MINUTE),
@@ -242,19 +232,12 @@ export function GuanxiangPanel(): JSX.Element {
         {tab === 'repos' ? <ReposTab draft={draft} setDraft={setDraft} state={state} busy={busy || dirty} onSync={(url) => { void run(() => syncRepos(url), url === undefined ? '已开始重新拉取全部仓库' : '已开始重新拉取', false) }} /> : null}
         {tab === 'tokens'
           ? <TokensTab
-              draft={draft}
-              setDraft={setDraft}
               state={state}
               busy={busy}
-              onAdd={async (credential, token) => {
-                const saved = await run(() => saveSettings({ ...state.settings, gitCredentials: [...state.settings.gitCredentials, credential] }), token === '' ? `已添加 ${credential.url}，请填入令牌` : `已添加 ${credential.url}`, false)
-                const added = saved?.settings.gitCredentials[state.settings.gitCredentials.length]
-                if (added === undefined) return false
-                setDraft(current => current === undefined || current.gitCredentials.some(item => item.url === added.url) ? current : { ...current, gitCredentials: [...current.gitCredentials, added] })
-                return token === '' || await run(() => saveToken(added.tokenEnv, token), `已添加 ${added.url} 并保存令牌，使用它的仓库会重新拉取`, false) !== undefined
-              }}
-              onSave={async (tokenEnv, value) => await run(() => saveToken(tokenEnv, value), `已保存 ${tokenEnv}，使用它的仓库会重新拉取`, false) !== undefined}
-              onClear={(tokenEnv) => { void run(() => clearToken(tokenEnv), `已清除面板保存的 ${tokenEnv}`, false) }}
+              onAdd={async host => await run(() => addHost(host), `已添加 ${host.url}，仓库会重新拉取`, false) !== undefined}
+              onSave={async (url, value) => await run(() => saveHostToken(url, value), `已保存 ${url} 的令牌，仓库会重新拉取`, false) !== undefined}
+              onClear={(url) => { void run(() => clearHostToken(url), `已清除面板保存的 ${url} 令牌`, false) }}
+              onRemove={(url) => { void run(() => removeHost(url), `已删除 ${url}`, false) }}
             />
           : null}
         {tab === 'download' ? <DownloadTab draft={draft} setDraft={setDraft} overridden={state.overridden} /> : null}
@@ -263,7 +246,7 @@ export function GuanxiangPanel(): JSX.Element {
               draft={draft}
               setDraft={setDraft}
               analyze={state.analyze}
-              credentialsAvailable={state.credentials.available}
+              credentialsAvailable={state.credentialsAvailable}
               overridden={state.overridden}
               busy={busy}
               onSave={async value => await run(() => saveToken(state.analyze.tokenEnv, value), '已保存分析接口令牌，下一个请求起生效', false) !== undefined}
@@ -319,7 +302,7 @@ function ReposTab({ draft, setDraft, state, busy, onSync }: TabProps & { state:
                   : null}
                 {saved && current.app !== undefined ? <div className="gx__rowSummary">{current.app.description}</div> : null}
                 {saved && current.commit !== undefined
-                  ? <div className="gx__rowSummary">提交 <span className="gx__mono">{current.commit.slice(0, 8)}</span>（{formatTime(current.commitTime)}）· 拉取于 {formatTime(current.syncedAt)} · <span className="gx__mono">{current.dir}</span></div>
+                  ? <div className="gx__rowSummary">提交 <span className="gx__mono">{current.commit.slice(0, 8)}</span>（{formatTime(current.commitTime)}）· 拉取于 {formatTime(current.syncedAt)}{current.dir === undefined ? null : <> · <span className="gx__mono">{current.dir}</span></>}</div>
                   : null}
                 {saved && current.error !== undefined ? <div className="gx__rowError">{current.error}</div> : null}
               </div>
@@ -336,19 +319,21 @@ function ReposTab({ draft, setDraft, state, busy, onSync }: TabProps & { state:
           <button type="button" className="gx__btn" disabled={url.trim() === ''} onClick={add}>添加</button>
         </div>
       </div>
-      <p className="gx__secFoot">使用本机已有的 git 凭据（SSH key 或 credential helper）拉取；https 地址可在「访问令牌」中配置个人访问令牌。不留分支时跟随远端默认分支。每个仓库需包含 <span className="gx__mono">.dsh/guanxiang.yaml</span> 与其中声明的日志分析 SKILL。删除地址不会删除本地目录。</p>
+      {state.hosts.availability === 'ready' ? null : <div className="gx__notice gx__notice--error">{state.hosts.availability === 'missing' ? '没有加载 dsh-repo 插件，仓库无法拉取。请安装 dsh-repo。' : 'dsh-repo 版本过旧，仓库无法拉取。请升级 dsh-repo。'}</div>}
+      <p className="gx__secFoot">由 dsh-repo 拉取到它的镜像目录{state.hosts.mirrorDir === undefined ? '' : `（${state.hosts.mirrorDir}）`}。https 地址使用「访问令牌」中对应主机的令牌，ssh 地址和其他主机使用本机已有的 git 凭据（SSH key 或 credential helper）。不留分支时跟随远端默认分支。每个仓库需包含 <span className="gx__mono">.dsh/guanxiang.yaml</span> 与其中声明的日志分析 SKILL。删除地址不会删除本地镜像。</p>
       {state.repos.length > 0 ? <div><button type="button" className="gx__btn" disabled={busy} onClick={() => { onSync() }}>重新拉取全部</button></div> : null}
     </section>
   )
 }
 
-const DEFAULT_USERNAME = 'oauth2'
-/** Prefix of the credential keys the panel allocates; namespaced so an unrelated `GITLAB_TOKEN` in the environment is not picked up. */
-const DEFAULT_TOKEN_ENV = 'GUANXIANG_GITLAB_TOKEN'
-
 /** Credential store layers of `@deepseek-ai/dsh-credentials-local` other than its own file. */
 const TOKEN_SOURCES: Readonly<Record<string, string>> = { 'env': '启动环境变量', 'project-env': '项目 .env', 'user-env': '$DSH_HOME/.env' }
 
+const HOST_KINDS: readonly { id: HostKind; label: string }[] = [
+  { id: 'gitlab', label: 'GitLab' },
+  { id: 'github', label: 'GitHub' },
+]
+
 function tokenPill(token: TokenStatusWire | undefined): JSX.Element {
   if (token === undefined) return <span className="gx__pill"><span className="gx__dot" />保存后设置令牌</span>
   if (token.error !== undefined) return <span className="gx__pill gx__pill--bad"><span className="gx__dot" />无法读取</span>
@@ -357,105 +342,92 @@ function tokenPill(token: TokenStatusWire | undefined): JSX.Element {
   return <span className="gx__pill gx__pill--ok"><span className="gx__dot" />已设置{source === undefined ? '' : `（来自${source}）`}</span>
 }
 
-/**
- * First of `GUANXIANG_GITLAB_TOKEN`, `GUANXIANG_GITLAB_TOKEN_2`, … that no
- * saved or drafted entry uses.
- * @param used - keys already in use.
- * @returns a free key.
- */
-function freeTokenEnv(used: ReadonlySet<string>): string {
-  if (!used.has(DEFAULT_TOKEN_ENV)) return DEFAULT_TOKEN_ENV
-  let index = 2
-  while (used.has(`${DEFAULT_TOKEN_ENV}_${index}`)) index += 1
-  return `${DEFAULT_TOKEN_ENV}_${index}`
-}
-
-function TokensTab({ draft, setDraft, state, busy, onAdd, onSave, onClear }: TabProps & {
+function TokensTab({ state, busy, onAdd, onSave, onClear, onRemove }: {
   state: StateWire
   busy: boolean
-  /** Saves the entry, then its token; resolves whether both succeeded. */
-  onAdd: (credential: GitCredentialSpec, token: string) => Promise<boolean>
-  onSave: (tokenEnv: string, value: string) => Promise<boolean>
-  onClear: (tokenEnv: string) => void
+  /** Adds the host with its token; resolves whether it succeeded. */
+  onAdd: (host: HostAddRequest) => Promise<boolean>
+  onSave: (url: string, value: string) => Promise<boolean>
+  onClear: (url: string) => void
+  onRemove: (url: string) => void
 }): JSX.Element {
+  const [kind, setKind] = useState<HostKind>('gitlab')
   const [url, setUrl] = useState('')
   const [alias, setAlias] = useState('')
   const [token, setToken] = useState('')
-  const [addError, setAddError] = useState<string | undefined>()
-  // Spans both requests of one addition; `busy` drops between them.
-  const [adding, setAdding] = useState(false)
   const [values, setValues] = useState<Record<string, string>>({})
-  const tokens = useMemo(() => new Map(state.credentials.tokens.map(item => [item.tokenEnv, item])), [state.credentials.tokens])
-  const saved = useMemo(() => new Set(state.settings.gitCredentials.map(credential => credential.tokenEnv)), [state.settings.gitCredentials])
+  const { availability, hosts, error } = state.hosts
   const complete = url.trim() !== '' && alias.trim() !== '' && token.trim() !== ''
   const add = (): void => {
-    if (!complete || busy || adding) return
-    const address = url.trim()
-    if (state.settings.gitCredentials.some(credential => credential.url === address)) {
-      setAddError('这个地址已经添加过了，请在上面的列表里更新它的令牌。')
-      return
-    }
-    setAddError(undefined)
-    setAdding(true)
-    const tokenEnv = freeTokenEnv(new Set([...saved, ...draft.gitCredentials.map(credential => credential.tokenEnv)]))
-    void onAdd({ url: address, alias: alias.trim(), username: DEFAULT_USERNAME, tokenEnv }, token.trim()).then((ok) => {
+    if (!complete || busy) return
+    void onAdd({ kind, url: url.trim(), alias: alias.trim(), token: token.trim() }).then((ok) => {
       if (!ok) return
       setUrl('')
       setAlias('')
       setToken('')
-    }).finally(() => { setAdding(false) })
+    })
   }
-  const save = (name: string): void => {
-    const value = values[name]?.trim() ?? ''
-    if (value === '' || busy || adding) return
-    void onSave(name, value).then((ok) => { if (ok) setValues(current => ({ ...current, [name]: '' })) })
+  const save = (address: string): void => {
+    const value = values[address]?.trim() ?? ''
+    if (value === '' || busy) return
+    void onSave(address, value).then((ok) => { if (ok) setValues(current => ({ ...current, [address]: '' })) })
   }
   const submitOnEnter = (event: { key: string }): void => { if (event.key === 'Enter') add() }
+  if (availability !== 'ready') {
+    return (
+      <section className="gx__sec">
+        <h2 className="gx__secTitle">访问令牌</h2>
+        <div className="gx__notice gx__notice--error">{availability === 'missing' ? '访问令牌由 dsh-repo 插件管理，当前没有加载 dsh-repo。请安装 dsh-repo。' : 'dsh-repo 版本过旧，不能在这里管理访问令牌。请升级 dsh-repo。'}</div>
+      </section>
+    )
+  }
   return (
     <section className="gx__sec">
-      <h2 className="gx__secTitle">GitLab 访问令牌 <Overridden keys={state.overridden} name="gitCredentials" /></h2>
-      {state.credentials.available ? null : <div className="gx__notice gx__notice--error">当前 DSH 组合没有加载凭据服务（@deepseek-ai/dsh-credentials-local），无法保存或读取令牌。</div>}
+      <h2 className="gx__secTitle">访问令牌</h2>
+      {state.credentialsAvailable ? null : <div className="gx__notice gx__notice--error">当前 DSH 组合没有加载凭据服务（@deepseek-ai/dsh-credentials-local），无法保存或读取令牌。</div>}
+      {error === undefined ? null : <div className="gx__notice gx__notice--error">无法读取 dsh-repo 的主机：{error}</div>}
       <div className="gx__list">
-        {draft.gitCredentials.length === 0 ? <div className="gx__emptyRow">还没有访问令牌。用 https 地址拉取 GitLab 私有仓库时，在下面填入 GitLab 地址、令牌别名和令牌。</div> : null}
-        {draft.gitCredentials.map((credential, index) => {
-          const status = saved.has(credential.tokenEnv) ? tokens.get(credential.tokenEnv) : undefined
-          const value = values[credential.tokenEnv] ?? ''
+        {hosts.length === 0 ? <div className="gx__emptyRow">还没有主机。用 https 地址拉取私有仓库时，在下面填入 GitLab 或 GitHub 地址、别名和令牌。</div> : null}
+        {hosts.map((host) => {
+          const value = values[host.url] ?? ''
           return (
-            <div key={credential.url} className="gx__row gx__row--top">
+            <div key={host.url} className="gx__row gx__row--top">
               <div className="gx__rowText">
                 <div className="gx__rowLabel">
-                  <span>{credential.alias ?? credential.url}</span>
-                  {tokenPill(status)}
+                  <span>{host.alias ?? host.url}</span>
+                  <span className="gx__tag">{host.kind === 'github' ? 'GitHub' : 'GitLab'}</span>
+                  {host.origin === 'config' ? <span className="gx__tag">cordis.yml</span> : null}
+                  {tokenPill(host.token)}
                 </div>
-                {credential.alias === undefined ? null : <div className="gx__rowSummary gx__mono">{credential.url}</div>}
-                {status?.error === undefined ? null : <div className="gx__rowError">{status.error}</div>}
-                {status !== undefined && status.writable
+                {host.alias === undefined ? null : <div className="gx__rowSummary gx__mono">{host.url}</div>}
+                {host.token.error === undefined ? null : <div className="gx__rowError">{host.token.error}</div>}
+                {host.token.writable
                   ? (
                       <div className="gx__addRow gx__addRow--flush">
-                        <input className="gx__input gx__mono" type="password" autoComplete="new-password" spellCheck={false} placeholder={status.configured ? '输入新令牌以替换' : '粘贴令牌'} value={value} onChange={(event) => { setValues({ ...values, [credential.tokenEnv]: event.target.value }) }} onKeyDown={(event) => { if (event.key === 'Enter') save(credential.tokenEnv) }} />
-                        <button type="button" className="gx__btn" disabled={busy || adding || value.trim() === ''} onClick={() => { save(credential.tokenEnv) }}>保存令牌</button>
-                        {status.configured && status.source === 'file' ? <button type="button" className="gx__btn gx__btn--ghost" disabled={busy} onClick={() => { onClear(credential.tokenEnv) }}>清除</button> : null}
+                        <input className="gx__input gx__mono" type="password" autoComplete="new-password" spellCheck={false} placeholder={host.token.configured ? '输入新令牌以替换' : '粘贴令牌'} value={value} onChange={(event) => { setValues({ ...values, [host.url]: event.target.value }) }} onKeyDown={(event) => { if (event.key === 'Enter') save(host.url) }} />
+                        <button type="button" className="gx__btn" disabled={busy || value.trim() === ''} onClick={() => { save(host.url) }}>保存令牌</button>
+                        {host.token.configured && host.token.source === 'file' ? <button type="button" className="gx__btn gx__btn--ghost" disabled={busy} onClick={() => { onClear(host.url) }}>清除</button> : null}
                       </div>
                     )
                   : null}
               </div>
               <div className="gx__rowCtl">
-                <button type="button" className="gx__btn gx__btn--danger" onClick={() => { setDraft({ ...draft, gitCredentials: draft.gitCredentials.filter((_, position) => position !== index) }) }}>删除</button>
+                {host.origin === 'added' ? <button type="button" className="gx__btn gx__btn--danger" disabled={busy} onClick={() => { onRemove(host.url) }}>删除</button> : null}
               </div>
             </div>
           )
         })}
         <div className="gx__addForm">
           <div className="gx__addRow gx__addRow--flush">
-            <label className="gx__field">GitLab 地址<input className="gx__input" placeholder="https://gitlab.example.com" value={url} onChange={(event) => { setUrl(event.target.value) }} onKeyDown={submitOnEnter} /></label>
-            <label className="gx__field">令牌别名<input className="gx__input" placeholder="例如 guanxiang" value={alias} onChange={(event) => { setAlias(event.target.value) }} onKeyDown={submitOnEnter} /></label>
+            <label className="gx__field">类型<select className="gx__input" value={kind} onChange={(event) => { setKind(event.target.value as HostKind) }}>{HOST_KINDS.map(item => <option key={item.id} value={item.id}>{item.label}</option>)}</select></label>
+            <label className="gx__field">地址<input className="gx__input" placeholder={kind === 'github' ? 'https://github.com' : 'https://gitlab.example.com'} value={url} onChange={(event) => { setUrl(event.target.value) }} onKeyDown={submitOnEnter} /></label>
+            <label className="gx__field">别名<input className="gx__input" placeholder="例如 公司 GitLab" value={alias} onChange={(event) => { setAlias(event.target.value) }} onKeyDown={submitOnEnter} /></label>
             <label className="gx__field">令牌<input className="gx__input gx__mono" type="password" autoComplete="new-password" spellCheck={false} placeholder="粘贴个人访问令牌" value={token} onChange={(event) => { setToken(event.target.value) }} onKeyDown={submitOnEnter} /></label>
-            <button type="button" className="gx__btn gx__btn--end" disabled={busy || adding || !complete} onClick={add}>添加</button>
+            <button type="button" className="gx__btn gx__btn--end" disabled={busy || !complete} onClick={add}>添加</button>
           </div>
-          {addError === undefined ? null : <div className="gx__rowError">{addError}</div>}
         </div>
       </div>
-      <p className="gx__secFoot">地址在这个前缀下的 https 仓库使用对应令牌（多个匹配时取路径最长的），ssh 地址不受影响。拉取需要 read_repository 权限，开启 SKILL 改进时还需要 write_repository。令牌保存在 DSH 凭据库（默认 $DSH_HOME/.credentials.yaml，仅本机用户可读），面板只显示是否已设置；令牌只经环境变量交给 git，不写入设置文件、仓库配置、日志或模型上下文。</p>
+      <p className="gx__secFoot">主机和令牌由 dsh-repo 管理，添加、删除和保存令牌立即生效，不需要点保存。该主机下的 https 仓库使用对应令牌，ssh 地址不受影响。GitLab 拉取需要 read_repository 权限，开启 SKILL 改进时需要 api 权限；GitHub 需要 Contents 与 Pull requests 读写权限。令牌保存在 DSH 凭据库（默认 $DSH_HOME/.credentials.yaml，仅本机用户可读），面板只显示是否已设置。cordis.yml 中配置的主机只能在这里更新令牌。</p>
     </section>
   )
 }
@@ -572,13 +544,6 @@ function AdvancedTab({ draft, setDraft, overridden, busy, onReset }: TabProps &
       <section className="gx__sec">
         <h2 className="gx__secTitle">仓库</h2>
         <div className="gx__list">
-          <div className="gx__row">
-            <div className="gx__rowText">
-              <div className="gx__rowLabel">拉取目录 <Overridden keys={overridden} name="reposDir" /></div>
-              <div className="gx__rowSummary">每个仓库拉取到该目录下的同名子目录，观象只读使用。</div>
-            </div>
-            <div className="gx__rowCtl"><input className="gx__input gx__input--wide gx__mono" value={draft.reposDir} onChange={(event) => { setDraft({ ...draft, reposDir: event.target.value }) }} /></div>
-          </div>
           <NumberRow label="更新间隔" summary="输入 /guanxiang 时，距上次拉取超过该时间的仓库会先更新；0 表示每次都更新。" unit="分钟" value={draft.fetchIntervalMin} overridden={overridden.includes('fetchIntervalMs')} onChange={(value) => { setDraft({ ...draft, fetchIntervalMin: value }) }} />
         </div>
       </section>
@@ -595,7 +560,7 @@ function AdvancedTab({ draft, setDraft, overridden, busy, onReset }: TabProps &
           <div className="gx__row">
             <div className="gx__rowText">
               <div className="gx__rowLabel">允许提出 SKILL 修改 <Overridden keys={overridden} name="skillUpdates" /></div>
-              <div className="gx__rowSummary">子 Agent 发现应用的日志分析 SKILL 有欠缺时可以写出修改提议；经用户授权后，观象用访问令牌把它推送到新分支并创建合并请求（GitLab，令牌需要 write_repository 权限）。</div>
+              <div className="gx__rowSummary">子 Agent 发现应用的日志分析 SKILL 有欠缺时可以写出修改提议；经用户授权后，观象经 dsh-repo 把它提交到新分支并创建合并请求（GitLab 或 GitHub，需要安装 dsh-repo 并配置该仓库主机的令牌）。</div>
             </div>
             <div className="gx__rowCtl"><input type="checkbox" className="gx__check" aria-label="允许提出 SKILL 修改" checked={draft.skillUpdatesEnabled} onChange={(event) => { setDraft({ ...draft, skillUpdatesEnabled: event.target.checked }) }} /></div>
           </div>

package/src/config.ts

@@ -8,9 +8,8 @@
 import { homedir } from 'node:os'
 import { isAbsolute, join, resolve } from 'node:path'
 import { z } from 'zod'
-import { normalizeCredentialUrl } from './repos/credentials.ts'
 import { TOKEN_ENV_PATTERN } from './settings/contract.ts'
-import type { EditableSettings, GitCredentialSpec, RepoSpec } from './settings/contract.ts'
+import type { EditableSettings, RepoSpec } from './settings/contract.ts'
 
 /** Largest delay Node's `setTimeout` honors (2^31 − 1 ms). */
 export const MAX_TIMER_DELAY_MS = 2_147_483_647
@@ -58,15 +57,19 @@ const repoSchema = z.object({
     .refine(value => value === undefined || isAcceptedBranch(value), '分支名不合法'),
 }).strict()
 
-const credentialSchema = z.object({
-  url: z.string().trim()
-    .refine(value => normalizeCredentialUrl(value) !== undefined, '令牌地址不合法：填 https://主机[:端口][/路径]，不含用户名、查询参数或片段')
-    .transform(value => normalizeCredentialUrl(value) as string),
-  alias: z.string().trim().max(64, '令牌别名不能超过 64 个字符').regex(/^[^\u0000-\u001f\u007f]*$/, '令牌别名不能包含控制字符').optional()
-    .transform(value => value === '' ? undefined : value),
-  username: z.string().trim().regex(/^\S+$/, '用户名不能为空或包含空白').default('oauth2'),
-  tokenEnv: z.string().trim().regex(TOKEN_ENV_PATTERN, '令牌名称只能包含字母、数字和下划线，且不能以数字开头（它是凭据库中的键名，不是令牌本身）'),
-}).strict()
+/**
+ * An access token of earlier versions, which kept HTTPS tokens by address
+ * prefix. Read only to move each one to a dsh-repo host once; never written.
+ */
+const legacyCredentialSchema = z.object({
+  url: z.string().trim().min(1),
+  alias: z.string().trim().optional(),
+  username: z.string().optional(),
+  tokenEnv: z.string().trim().regex(TOKEN_ENV_PATTERN),
+}).strip()
+
+/** A legacy access token; see {@link legacyCredentialSchema}. */
+export type LegacyCredential = z.output<typeof legacyCredentialSchema>
 
 const hostSchema = z.string().trim().toLowerCase()
   .transform(value => value.replace(/^\*\./, ''))
@@ -97,7 +100,6 @@ const authorSchema = z.object({
 
 /** Field validators shared by the cordis config and the panel overlay. */
 export const editableFields = {
-  reposDir: z.string().trim().min(1, '拉取目录不能为空'),
   repos: z.array(repoSchema).superRefine((repos, issues) => {
     const seen = new Set<string>()
     for (const [index, repo] of repos.entries()) {
@@ -105,13 +107,6 @@ export const editableFields = {
       seen.add(repo.url)
     }
   }),
-  gitCredentials: z.array(credentialSchema).superRefine((credentials, issues) => {
-    const seen = new Set<string>()
-    for (const [index, credential] of credentials.entries()) {
-      if (seen.has(credential.url)) issues.addIssue({ code: 'custom', path: [index, 'url'], message: `重复的令牌地址：${credential.url}` })
-      seen.add(credential.url)
-    }
-  }),
   fetchIntervalMs: durationMs(0),
   maxAppsPerRequest: z.number().int().min(1).max(32),
   dispatchTimeoutMs: durationMs(1000),
@@ -121,10 +116,11 @@ export const editableFields = {
 }
 
 const configSchema = z.object({
-  reposDir: editableFields.reposDir.optional(),
+  /** Ignored: dsh-repo's `mirror.dir` decides where repositories are mirrored. Accepted so older compositions still load. */
+  reposDir: z.string().optional(),
   repos: editableFields.repos.default([]),
-  /** HTTPS access tokens by address prefix; each names a credential reference, never a token value. */
-  gitCredentials: editableFields.gitCredentials.default([]),
+  /** Moved once to dsh-repo hosts at start; see {@link legacyCredentialSchema}. */
+  gitCredentials: z.array(legacyCredentialSchema).default([]),
   fetchIntervalMs: editableFields.fetchIntervalMs.default(0),
   maxAppsPerRequest: editableFields.maxAppsPerRequest.default(4),
   dispatchTimeoutMs: editableFields.dispatchTimeoutMs.default(30 * 60 * 1000),
@@ -137,14 +133,14 @@ const configSchema = z.object({
    */
   analyzeTokenRef: z.string().trim().regex(TOKEN_ENV_PATTERN, '令牌名称只能包含字母、数字和下划线，且不能以数字开头').default('GUANXIANG_ANALYZE_TOKEN'),
   /**
-   * Author and committer of SKILL improvement commits; omitted uses the git
-   * identity configured on the host (`user.name` / `user.email`).
+   * Author of SKILL improvement commits; omitted uses the user of the token
+   * dsh-repo holds for the repository's host, who is always the committer.
    */
   skillUpdateAuthor: authorSchema.optional(),
   /** Registered `ctx.subagents` provider the children start on. */
   subagentProvider: z.string().trim().min(1).default('spawn'),
-  /** Timeout of one git command (clone, fetch, worktree), in milliseconds. */
-  gitTimeoutMs: durationMs(1000).default(10 * 60 * 1000),
+  /** Ignored: dsh-repo's `mirror.gitTimeoutMs` bounds git commands. Accepted so older compositions still load. */
+  gitTimeoutMs: z.number().optional(),
   /**
    * How long loading `/guanxiang` waits for the repository refresh before it
    * renders the catalog it already has, in milliseconds; the refresh keeps
@@ -166,9 +162,11 @@ export const pluginConfigSchema = configSchema.prefault({})
 
 /** Panel overlay: any subset of the editable settings. */
 export const overlaySchema = z.object({
-  reposDir: editableFields.reposDir.optional(),
+  /** Ignored legacy key; the next panel save drops it. */
+  reposDir: z.string().optional(),
   repos: editableFields.repos.optional(),
-  gitCredentials: editableFields.gitCredentials.optional(),
+  /** Legacy access tokens, moved once to dsh-repo hosts; the next panel save drops them. */
+  gitCredentials: z.array(legacyCredentialSchema).optional(),
   fetchIntervalMs: editableFields.fetchIntervalMs.optional(),
   maxAppsPerRequest: editableFields.maxAppsPerRequest.optional(),
   dispatchTimeoutMs: editableFields.dispatchTimeoutMs.optional(),
@@ -233,27 +231,14 @@ function copyRepos(repos: readonly RepoSpec[]): RepoSpec[] {
   return repos.map(repo => repo.branch === undefined ? { url: repo.url } : { url: repo.url, branch: repo.branch })
 }
 
-function copyCredentials(credentials: readonly GitCredentialSpec[]): GitCredentialSpec[] {
-  return credentials.map(credential => ({
-    url: credential.url,
-    ...credential.alias === undefined ? {} : { alias: credential.alias },
-    username: credential.username,
-    tokenEnv: credential.tokenEnv,
-  }))
-}
-
 /**
- * The editable settings a configuration implies, with `reposDir` defaulted to
- * `$DSH_HOME/guanxiang/repos`.
+ * The editable settings a configuration implies.
  * @param config - validated plugin configuration.
- * @param env - process environment.
  * @returns complete editable settings.
  */
-export function defaultsOf(config: GuanxiangConfig, env: NodeJS.ProcessEnv = process.env): EditableSettings {
+export function defaultsOf(config: GuanxiangConfig): EditableSettings {
   return {
-    reposDir: config.reposDir ?? join(resolveDshHome(env), 'guanxiang', 'repos'),
     repos: copyRepos(config.repos),
-    gitCredentials: copyCredentials(config.gitCredentials),
     fetchIntervalMs: config.fetchIntervalMs,
     maxAppsPerRequest: config.maxAppsPerRequest,
     dispatchTimeoutMs: config.dispatchTimeoutMs,
@@ -272,9 +257,7 @@ export function defaultsOf(config: GuanxiangConfig, env: NodeJS.ProcessEnv = pro
  */
 export function applyOverlay(defaults: EditableSettings, overlay: SettingsOverlay): EditableSettings {
   return {
-    reposDir: overlay.reposDir ?? defaults.reposDir,
     repos: overlay.repos === undefined ? defaults.repos : copyRepos(overlay.repos),
-    gitCredentials: overlay.gitCredentials === undefined ? defaults.gitCredentials : copyCredentials(overlay.gitCredentials),
     fetchIntervalMs: overlay.fetchIntervalMs ?? defaults.fetchIntervalMs,
     maxAppsPerRequest: overlay.maxAppsPerRequest ?? defaults.maxAppsPerRequest,
     dispatchTimeoutMs: overlay.dispatchTimeoutMs ?? defaults.dispatchTimeoutMs,

package/src/index.ts

@@ -5,8 +5,8 @@
  * 任务匹配已注册应用时由顶层 Agent 自行加载）和
  * `guanxiang_dispatch` 工具（按应用派发子 Agent，工作目录为该应用的代码
  * 仓库，首条消息用 `/<skill>` 加载仓库里的日志分析 SKILL），以及开启 SKILL
- * 改进时的 `guanxiang_propose_skill` 工具（经用户授权后把子 Agent 的 SKILL
- * 修改提议推送到新分支并创建合并请求）。应用仓库在设置
+ * 改进时的 `guanxiang_propose_skill` 工具（经用户授权后经 dsh-repo 把子 Agent
+ * 的 SKILL 修改提议提交到新分支并创建合并请求）。应用仓库在设置
  * 面板中只填 git 地址，由插件拉取；应用描述来自各仓库的
  * `.dsh/guanxiang.yaml`。另提供日志平台分析接口 `POST /open-api/logalyze`，
  * 经 dsh-channels 的 `feishuTopics` 服务在飞书群话题中开始分析。
@@ -17,6 +17,7 @@
 import { mountAnalyzeRoute } from './analyze/server.ts'
 import { resolveConfig } from './config.ts'
 import type { HostContext } from './host.ts'
+import { DSH_REPOS_SERVICE } from './repos/lookup.ts'
 import { GuanxiangService } from './service.ts'
 import type { ServiceOptions } from './service.ts'
 import { defaultOverlayPath, OverlayStore } from './settings/overlay.ts'
@@ -34,7 +35,7 @@ export { ENTRY_SKILL_NAME, renderEntrySkill } from './skill/entry.ts'
 export { RepoRegistry } from './repos/registry.ts'
 export { readAppManifest, MANIFEST_PATH } from './repos/manifest.ts'
 export { GuanxiangService } from './service.ts'
-export { ANALYZE_ROUTE, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE } from './settings/contract.ts'
+export { ANALYZE_ROUTE, HOST_TOKEN_ROUTE, HOSTS_ROUTE, SETTINGS_ROUTE, STATE_ROUTE, SYNC_ROUTE } from './settings/contract.ts'
 export { analyzeRequestHash, parseAnalyzeRequest } from './analyze/contract.ts'
 export type { AnalyzeAccepted, AnalyzeRefused, AnalyzeRequest } from './analyze/contract.ts'
 
@@ -55,7 +56,7 @@ export interface GuanxiangPluginOptions extends ServiceOptions {
 
 /**
  * Install the entry skill, the dispatch and SKILL proposal tools, the settings
- * routes, and the analyze route, then clone or update the configured
+ * routes, and the analyze route, then mirror or update the configured
  * repositories in the background.
  * @param ctx - plugin context.
  * @param config - loader-validated configuration.
@@ -73,4 +74,10 @@ export function apply(ctx: HostContext, config?: unknown, options: GuanxiangPlug
     })
     return () => { service.shutdown() }
   }, 'guanxiang: repositories')
+  // Sync again whenever dsh-repo's service appears, including after it reloads.
+  ctx.inject?.([DSH_REPOS_SERVICE], () => {
+    void service.reposAvailable().catch((error: unknown) => {
+      ctx.logger?.error?.('guanxiang: 同步仓库失败：%s', error instanceof Error ? error.message : String(error))
+    })
+  })
 }