@modusensus/dsh-mneme 0.8.16 → 0.9.1

package/lib/api.js

@@ -1,16 +1,23 @@
 import { URL } from "node:url";
+import { isAbsolute } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { FEATURE_FLAG_SPEC } from "./settings.js";
 import { TYPES } from "./store.js";
 import { TYPE_FILE, renderMirrorText, renderFileHeader, parseHumanEdits, MIRROR_READONLY_TYPES } from "./mirror.js";
 import { langOf } from "./lang.js";
 import { computeHeat } from "./heat.js";
-import { describeStreamFailure, resolveRoute } from "./dream.js";
+import { EFFORT_REJECT_RE, describeStreamFailure, resolveRoute, withEffortFallback } from "./dream.js";
 import { getInjectionSnapshot } from "./inject.js";
 import { describeLocalRuntime, publicRuntimeStatus } from "./runtime/loader.js";
 import { hostModulesDir, provisionRuntime } from "./runtime/provision.js";
 import { classify, fetchLatestVersion, PACKAGE_VERSION } from "./version-check.js";
 import { parseReclaimQuery, parseReclaimJson, readReclaimFields, reclaimReply, RECLAIM_UNAVAILABLE } from "./reclaim-http.js";
+import { readPipelineDoc, loadPipelines, projectPipelineDir } from "./pipeline.js";
+import { loadRunsById, runsDir, RUNS_SUFFIX } from "./pipeline-runs.js";
+import { observationDir, loadObservationsById } from "./pipeline-observations.js";
+import { projectKey } from "./candidates.js";
+import { readCandidateDoc } from "./candidates.js";
 
 // headers：少数端点（/export 附件下载）需要追加 Content-Disposition 等响应头。
 function sendJson(res, status, payload, headers = {}) {
@@ -34,6 +41,16 @@ function sendAttachment(res, status, contentType, filename, body) {
 // defaults in config.js (externalApiPort / externalApiHost).
 const EXTERNAL_API_DEFAULTS = { enabled: false, port: 8790, host: "127.0.0.1" };
 
+// 请求体上限（防御，不是功能）：readBody 只累加字符串，不设上限时一个超大 body
+// 就能把进程内存拉到 Content-Length 那个量级。4 MiB 远高于任何真实写入（记忆
+// 正文、导入的 markdown、面板 patch 都远小于它）。
+const MAX_REQUEST_BODY_BYTES = 4 * 1024 * 1024;
+// 分页上界（防御）：list/search 的参数直接进 SQL LIMIT，无上界时
+// ?limit=100000 会让一次免鉴权 GET 把全库序列化出来（2026-10 审计：免鉴权读面
+// + 浏览器简单请求 = 廉价 DoS）。1000/200 远高于面板与 CLI 的任何真实用法。
+const MAX_PAGE_LIMIT = 1000;
+const MAX_SEARCH_TOP_K = 200;
+
 /** Merge persisted external-api kv over the defaults for client display. */
 function fullExternalConfig(kv = {}) {
   return {
@@ -67,22 +84,82 @@ function isAuthorized(req, apiToken) {
 }
 
 /**
- * Reject a request with 401 when auth is enabled and the token is missing or
- * wrong. Returns true when the request may proceed.
+ * 路由鉴权策略（2026-10 审计的结构性修法）。三条：
+ *   open        永不鉴权——「公开读面」，必须写进 SECURITY.md 的安全模型表
+ *   token       配置了 apiToken 就整条要带（写路由 + 敏感读）
+ *   token-write 只有非 GET/HEAD 才要 token（面板要读、只有写才有副作用）
+ *
+ * 少声明不是「默认开放」：register 直接抛错，插件起不来。这是本方案的要点——
+ * 「新增路由忘了加鉴权」从运行期静默漏洞变成装配期硬失败，不依赖谁记得写、也
+ * 不依赖测试有没有覆盖到（/export 就是这么漏的，见 2026-10 审计 P0）。
+ */
+export const ROUTE_POLICIES = Object.freeze(["open", "token", "token-write"]);
+
+/** True when this request must present the apiToken under the route's policy. */
+function needsToken(req, policy, apiToken) {
+  if (policy === "open") return false;
+  const method = String(req.method || "GET").toUpperCase();
+  if (policy === "token-write" && (method === "GET" || method === "HEAD")) return false;
+  return !isAuthorized(req, apiToken);
+}
+
+/**
+ * 唯一的登记入口：校验 policy、拒绝重复路径、把 handler 包上鉴权。
+ * 返回的 count() 供 createApi 汇报真实路由数（此前的字面量 36 已经和现实脱节）。
  */
-function requireAuth(req, res, apiToken) {
-  if (isAuthorized(req, apiToken)) return true;
-  sendJson(res, 401, { error: "unauthorized" });
-  return false;
+export function createRouteRegistrar(webServer, apiToken, disposers) {
+  const seen = new Set();
+  const register = (route) => {
+    if (!ROUTE_POLICIES.includes(route.policy)) {
+      throw new Error(
+        `[dsh-mneme] 路由 ${route.path} 必须声明 policy（${ROUTE_POLICIES.join(" / ")}），` +
+        `实际是 ${JSON.stringify(route.policy)}。先想清楚它属于哪一类，再同步 SECURITY.md 的安全模型表。`
+      );
+    }
+    const key = `${route.kind}:${route.path}`;
+    if (seen.has(key)) throw new Error(`[dsh-mneme] 路由 ${key} 被重复登记`);
+    seen.add(key);
+    const inner = route.handler;
+    const handler = (req, res) => {
+      if (!needsToken(req, route.policy, apiToken)) return inner(req, res);
+      sendJson(res, 401, { error: "unauthorized" });
+      return undefined;
+    };
+    disposers.push(webServer.register({ ...route, handler }));
+  };
+  return { register, count: () => seen.size };
 }
 
-/** Collect the request body as text (tolerant of empty/invalid bodies). */
-function readBody(req) {
+
+/**
+ * Collect the request body as text, or null when it exceeds the cap.
+ *
+ * 超限时**必须回 null 而不是空串**：空串经 parseBody 变成 {}，而 /profile、
+ * /rules、/persona 的 PUT 会把「字段缺失」当成「用户要清空」——一个 5 MiB 的
+ * 请求就能把画像/规则/人格静默清掉。返回 null 让调用点在碰任何 store 之前
+ * 直接 413（2026-10 评审指出的数据损坏路径）。
+ * 连接不 destroy：调用方要能收到明确的 413，而不是被掐断。
+ */
+function readBody(req, res) {
   return new Promise((resolve) => {
     let body = "";
-    req.on("data", (chunk) => { body += chunk; });
-    req.on("end", () => resolve(body));
-    req.on("error", () => resolve(""));
+    let bytes = 0;
+    let overflow = false;
+    req.on("data", (chunk) => {
+      if (overflow) return;
+      bytes += chunk.length;
+      if (bytes > MAX_REQUEST_BODY_BYTES) {
+        overflow = true;
+        body = "";
+        sendJson(res, 413, { error: "payload-too-large", limit: MAX_REQUEST_BODY_BYTES });
+        return;
+      }
+      body += chunk;
+    });
+    req.on("end", () => resolve(overflow ? null : body));
+    // 超限后再来 transport error 也必须保留超限状态：否则调用点会拿着空串
+    // 继续往 store 写（PUT /persona 把 "" 解析成 {}，覆盖既有设置）。
+    req.on("error", () => resolve(overflow ? null : ""));
   });
 }
 
@@ -184,14 +261,14 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
     service.setEmbedder(embedder);
   }
 
-  const register = (route) => {
-    disposers.push(webServer.register(route));
-  };
+  // 所有路由都经这一处登记：policy 必填、鉴权在这里统一判定（见 createRouteRegistrar）。
+  const { register, count: countRoutes } = createRouteRegistrar(webServer, apiToken, disposers);
 
   // /api/dsh-mneme prefix fallback → 404 JSON for unknown sub-paths
   register({
     kind: "prefix",
     path: "/api/dsh-mneme",
+    policy: "open",
     handler(req, res) {
       sendJson(res, 404, { error: "not-found" });
     }
@@ -202,6 +279,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/info",
+    policy: "open",
     handler(req, res) {
       sendJson(res, 200, { version: PACKAGE_VERSION });
     }
@@ -214,6 +292,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/version-check",
+    policy: "open",
     handler(req, res) {
       if (req.method !== "GET") {
         sendJson(res, 404, { error: "not-found" });
@@ -233,11 +312,13 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/list",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
         const type = url.searchParams.get("type") ?? undefined;
-        const limit = Number(url.searchParams.get("limit") ?? 50);
+        // 上界是防御：参数直接进 SQL LIMIT（见 MAX_PAGE_LIMIT 注释）。
+        const limit = Math.min(Number(url.searchParams.get("limit") ?? 50), MAX_PAGE_LIMIT);
         const offset = Number(url.searchParams.get("offset") ?? 0);
         // order=chrono: pure newest-first for paged browsing; default keeps
         // the importance-ranked order other callers rely on.
@@ -289,6 +370,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/recall-stats",
+    policy: "open",
     handler(req, res) {
       if (req.method !== "GET") {
         sendJson(res, 404, { error: "not-found" });
@@ -308,11 +390,13 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/search",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
         const q = url.searchParams.get("q") ?? "";
-        const limit = Number(url.searchParams.get("topK") ?? url.searchParams.get("limit") ?? 20);
+        // 上界是防御：topK 直接进召回（见 MAX_SEARCH_TOP_K 注释）。
+        const limit = Math.min(Number(url.searchParams.get("topK") ?? url.searchParams.get("limit") ?? 20), MAX_SEARCH_TOP_K);
         // mode selects the recall strategy (defaults to auto):
         //   auto    (default) keyword first, vector fills remaining slots
         //   hybrid  vector first, keyword fills remaining slots; scores of
@@ -352,11 +436,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/profile",
+    policy: "token-write",
     handler(req, res) {
       try {
         if (req.method === "PUT" || req.method === "POST") {
-          if (!requireAuth(req, res, apiToken)) return;
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             settings.setProfile(typeof body.profile === "string" ? body.profile : "");
             sendJson(res, 200, { profile: settings.getProfile() });
@@ -369,6 +454,44 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
     }
   });
 
+  // --- agent persona（人格定义页，beta） -------------------------------------
+  // 形状照抄 /profile 路由（设计稿②）：写方法走 requireAuth + readBody + parseBody。
+  // v1.2 多卡：GET 回全量 { default, byAgent }；PUT 双形——单对象形（旧面板）只更新
+  // default 且 byAgent 保留（合并语义，settings.setPersona 内判形状），多卡形全量
+  // 替换。坏体守卫：jsonOk=false 时保值回显，不清空库内现值。
+  register({
+    kind: "exact",
+    path: "/api/dsh-mneme/persona",
+    policy: "token-write",
+    handler(req, res) {
+      try {
+        if (req.method === "PUT" || req.method === "POST") {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
+            // parseBody 对坏 JSON 回 {}（容错不抛），所以这里的守卫必须把
+            // 「坏体解析成的 {}」与「真的传了 {persona:{}}」区分开：文本解析
+            // 失败的体不该把人格清空。jsonOk=false 时保持库内现值原样回显。
+            let body;
+            let jsonOk = true;
+            try {
+              body = JSON.parse(text || "{}");
+            } catch {
+              body = {};
+              jsonOk = false;
+            }
+            if (jsonOk && body && typeof body === "object") {
+              settings.setPersona(body.persona && typeof body.persona === "object" ? body.persona : body);
+            }
+            sendJson(res, 200, { persona: settings.getPersona() });
+          });
+        }
+        sendJson(res, 200, { persona: settings.getPersona() });
+      } catch {
+        sendJson(res, 500, { error: "internal" });
+      }
+    }
+  });
+
   // --- dream/sleep 模型连通性 + 模型发现（settings 面板）----------------------
   // Connectivity probe for a dream/sleep model route: runs one minimal LLM call
   // through the same harness path the consolidation uses and reports success /
@@ -376,13 +499,30 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   // the same error wording the audit rows carry. Optional reasoningEffort
   // mirrors what the consolidation would send — the panel can verify a model
   // actually accepts the configured effort without tripping a full run.
+  //
+  // 档位被拒时探针必须和真实 run 一样降级：这里是全仓唯一「接受并转发调用方档位、
+  // 却此前没有兜底」的调用面——巩固/睡眠/蒸馏/总览/实体抽取都包在 withEffortFallback
+  // 里，档位被拒就丢掉字段重试一次（issue #9/#109/#135）。直调 llm.stream 的其余各面
+  // 要么本来就在兜底之内（dream.js/summarize.js/sleep.js 的共用辅助），要么是
+  // src/index.js 的手写版兜底，要么像 pre-inject-gate 的判定池那样根本不转发档位。
+  // 探针原先没有这层，于是同一份配置「后台真的跑得通、点一下测试就报红」，把用户
+  // 引向「换哪家 Provider 都失败」的错误诊断（issue #215 的后续）。降级跑通后响应带
+  // effortDropped:true，面板据此说明「档位不被接受、已按无档位连通」，而不是与「真的
+  // 连不上」同色。
   async function testLlmConnectivity(llm, provider, model, reasoningEffort) {
     const startedAt = Date.now();
     const elapsed = () => Date.now() - startedAt;
     const modelId = `${provider}:${model}`;
-    try {
+    // 流级失败原因：withEffortFallback 只用它做拒收甄别，回给面板的仍是同一条
+    // describeStreamFailure 文案（与审计行同口径，不制造第二套措辞）。
+    let streamError = "";
+    // 降级标记刻意放在 attempt 之外：fallback 里置位、attempt 里读出，结果对象
+    // 据此带上 effortDropped——降级是「换个姿势跑通了」，不是失败。
+    let droppedEffort = false;
+
+    const attempt = async (effort) => {
+      streamError = "";
       let reply = "";
-      let error = "";
       for await (const chunk of llm.stream({
         provider,
         model,
@@ -391,7 +531,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
         // reply 恒为空，「真的答了 ok」对思考模型不成立。按实际用量计费，手动
         // 按钮无放大风险。
         maxTokens: 1024,
-        ...(reasoningEffort && reasoningEffort !== "none" ? { reasoningEffort } : {}),
+        ...(effort && effort !== "none" ? { reasoningEffort: effort } : {}),
         // role 用 user 而非 system（#189 后续）：0.1.6-alpha.1 起适配器把 system
         // 抽成顶层参数，system-only 对话会被官方 API 以
         // 「messages: at least one message is required」整单拒绝——探测按钮 502。
@@ -406,12 +546,39 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
       })) {
         if (chunk.type === "text-delta" && typeof chunk.text === "string") reply += chunk.text;
         if (chunk.type === "finish" && (chunk.reason?.kind === "error" || chunk.reason?.kind === "aborted")) {
-          error = describeStreamFailure(chunk.reason);
+          streamError = describeStreamFailure(chunk.reason);
           break;
         }
       }
-      if (error) return { ok: false, durationMs: elapsed(), error, modelId };
-      return { ok: true, durationMs: elapsed(), modelId, reply: reply.trim().slice(0, 100) };
+      const dropped = droppedEffort ? { effortDropped: true } : {};
+      if (streamError) {
+        // 只在「确实带了档位」时把流级拒收交回给 withEffortFallback 的 undefined
+        // 分支——rc.1 的适配器不抛错，把 provider 的拒收折叠成终止 finish chunk，
+        // 不看这里那次重试就是死代码。不带档位时原样上报：探针不该因为一句文案
+        // 没匹配上正则就退化成 500。
+        if (effort && effort !== "none" && EFFORT_REJECT_RE.test(streamError)) return undefined;
+        // 失败行不带 effortDropped：该字段只有一个含义——「连通了，但不是用你配的
+        // 档位连通的」（见下方成功分支的注释），失败时它只是噪音。
+        return { ok: false, durationMs: elapsed(), error: streamError, modelId };
+      }
+      return { ok: true, durationMs: elapsed(), modelId, reply: reply.trim().slice(0, 100), ...dropped };
+    };
+
+    try {
+      const result = await withEffortFallback(
+        ctx,
+        reasoningEffort,
+        () => attempt(reasoningEffort),
+        () => { droppedEffort = true; return attempt(""); },
+        () => streamError
+      );
+      // result === undefined 只可能来自上面那次「判据一致」的主动交还（两边用同
+      // 一份 EFFORT_REJECT_RE，走到这里等于假设被推翻）：退回已捕获的流失败原
+      // 因，绝不让探针 500。
+      if (result === undefined) {
+        return { ok: false, durationMs: elapsed(), error: streamError || "no stream result", modelId };
+      }
+      return result;
     } catch (error) {
       return { ok: false, durationMs: elapsed(), error: String(error?.message ?? error), modelId };
     }
@@ -424,6 +591,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/llm-providers",
+    policy: "open",
     handler(req, res) {
       try {
         const llm = ctx.llm;
@@ -452,11 +620,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/test-model",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") return sendJson(res, 404, { error: "not-found" });
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then(async (text) => {
+        return readBody(req, res).then(async (text) => {
+          if (text === null) return;
           const body = parseBody(text);
           let provider = typeof body.provider === "string" ? body.provider.trim() : "";
           let model = typeof body.model === "string" ? body.model.trim() : "";
@@ -487,14 +656,15 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/delete",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") {
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then((text) => {
+        return readBody(req, res).then((text) => {
+          if (text === null) return;
           const body = parseBody(text);
           const id = typeof body.id === "string" ? body.id.trim() : "";
           if (!id) {
@@ -524,14 +694,15 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/update",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") {
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then((text) => {
+        return readBody(req, res).then((text) => {
+          if (text === null) return;
           const body = parseBody(text);
           const id = typeof body.id === "string" ? body.id.trim() : "";
           if (!id) {
@@ -630,14 +801,15 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/create",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") {
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then((text) => {
+        return readBody(req, res).then((text) => {
+          if (text === null) return;
           const body = parseBody(text);
           if (!TYPES.has(body.type)) {
             sendJson(res, 400, { error: "invalid-type" });
@@ -712,10 +884,10 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/maintenance/reclaim",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method === "GET") {
-          if (!requireAuth(req, res, apiToken)) return;
           if (!maintenance) {
             sendJson(res, 503, { error: RECLAIM_UNAVAILABLE });
             return;
@@ -738,8 +910,8 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then((text) => {
+        return readBody(req, res).then((text) => {
+          if (text === null) return;
           const parsed = parseReclaimJson(text);
           if (!parsed.ok) {
             sendJson(res, 400, { error: parsed.error });
@@ -774,11 +946,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/rules",
+    policy: "token-write",
     handler(req, res) {
       try {
         if (req.method === "PUT" || req.method === "POST") {
-          if (!requireAuth(req, res, apiToken)) return;
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             settings.setRules(Array.isArray(body.rules) ? body.rules : []);
             sendJson(res, 200, { rules: settings.getRules() });
@@ -795,12 +968,13 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/vector-config",
+    policy: "token",
     handler(req, res) {
       try {
         // Secret-bearing endpoint: fully protected when apiToken is set.
-        if (!requireAuth(req, res, apiToken)) return;
         if (req.method === "PUT" || req.method === "POST") {
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             // An empty apiKey, or one that already looks masked (round-trips
             // through maskApiKey unchanged), means "keep the existing key".
@@ -832,9 +1006,9 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/vector-reindex",
+    policy: "token",
     handler(req, res) {
       try {
-        if (!requireAuth(req, res, apiToken)) return;
         if (!embedder) {
           sendJson(res, 200, { indexed: 0, skipped: 0, error: "vector-unavailable" });
           return;
@@ -864,6 +1038,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/semantic",
+    policy: "open",
     handler(req, res) {
       try {
         const stats = semantic?.vectorIndex?.getStats?.() ?? null;
@@ -924,14 +1099,15 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/runtime/provision",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") {
           sendJson(res, 405, { error: "method-not-allowed" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then(async (text) => {
+        return readBody(req, res).then(async (text) => {
+          if (text === null) return;
           const body = parseBody(text);
           const runtimeDir = config?.runtimeDir ?? "";
           // 三档来源依次尝试（收编本机 node_modules → 本地 .tgz 目录 → registry）。
@@ -961,6 +1137,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/semantic/llm-audit",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
@@ -983,6 +1160,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/semantic/llm-audit/stats",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
@@ -1006,6 +1184,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/semantic/graph/ego",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
@@ -1083,6 +1262,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/semantic/graph/entity-attrs",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
@@ -1121,6 +1301,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/entities",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
@@ -1140,6 +1321,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/memories/entities",
+    policy: "open",
     handler(req, res) {
       try {
         const url = new URL(req.url, "http://localhost");
@@ -1170,8 +1352,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/export",
+    policy: "token",
     handler(req, res) {
       try {
+        // 导出是「全库 + 含 archived/forgotten 的全字段」的一次读，敏感度不低于
+        // 写面：它必须与写路由同门。历史漏项——这条路由长期没有鉴权分支，配了
+        // apiToken 也照旧对任何调用方开放（2026-10 审计 P0）。
         const url = new URL(req.url, "http://localhost");
         const format = url.searchParams.get("format") ?? "json";
         if (format !== "json" && format !== "markdown") {
@@ -1220,14 +1406,15 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/import",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") {
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then((text) => {
+        return readBody(req, res).then((text) => {
+          if (text === null) return;
           const body = parseBody(text);
           if (typeof body.type !== "string" || !Object.hasOwn(TYPE_FILE, body.type)) {
             sendJson(res, 400, { error: "invalid-type" });
@@ -1261,6 +1448,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/dream-status",
+    policy: "open",
     handler(req, res) {
       try {
         const runs = (service.listDreamRuns?.({ limit: 5 }) ?? []).map((r) => ({
@@ -1305,13 +1493,13 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/conflicts",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "GET") {
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
         const url = new URL(req.url, "http://localhost");
         const limit = Math.min(200, Math.max(1, Number(url.searchParams.get("limit") ?? 50) || 50));
         const offset = Math.max(0, Number(url.searchParams.get("offset") ?? 0) || 0);
@@ -1326,14 +1514,15 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/conflicts/resolve",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method !== "POST") {
           sendJson(res, 404, { error: "not-found" });
           return;
         }
-        if (!requireAuth(req, res, apiToken)) return;
-        return readBody(req).then((text) => {
+        return readBody(req, res).then((text) => {
+          if (text === null) return;
           let body = {};
           try { body = JSON.parse(text || "{}"); } catch { /* 坏 JSON → 走缺参分支 */ }
           const id = typeof body.id === "string" ? body.id.trim() : "";
@@ -1363,8 +1552,8 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/health",
+    policy: "token",
     handler(req, res) {
-      if (!requireAuth(req, res, apiToken)) return;
       let state = null;
       try {
         state = service.getMirrorHealth?.() ?? null;
@@ -1412,11 +1601,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/mode",
+    policy: "token-write",
     handler(req, res) {
       try {
         if (req.method === "PUT" || req.method === "POST") {
-          if (!requireAuth(req, res, apiToken)) return;
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             if (body.mode !== "light" && body.mode !== "standard") {
               sendJson(res, 400, { error: "invalid-mode" });
@@ -1437,11 +1627,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/external-api",
+    policy: "token",
     handler(req, res) {
       try {
         if (req.method === "PUT" || req.method === "POST") {
-          if (!requireAuth(req, res, apiToken)) return;
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             const patch = {};
             if (body.enabled !== undefined) patch.enabled = body.enabled === true;
@@ -1464,9 +1655,13 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
             sendJson(res, 200, { config: fullExternalConfig(settings.setExternalApi(patch)) });
           });
         }
-        // GET: always hand back a token — the standalone server generates its
-        // own on first enabled boot, but the panel displays it before that,
-        // so materialize and persist one here.
+        // GET 回的是能解锁整个 8790 数据面的 Bearer，敏感度等同写面：必须与
+        // PUT 同门。未配置 apiToken 时 isAuthorized 恒真（既有的 fail-open 模型，
+        // 见 SECURITY.md「安全模型」一节），所以默认配置下面板仍旧即装即用。
+        // GET: hand back a token — the standalone server generates its own on
+        // first enabled boot, but the panel displays it before that, so
+        // materialize and persist one here. 只有通过上面那道门才会走到这里，
+        // 否则「未鉴权的 GET 顺手写库」就是一条不需要凭证的写路径。
         const kv = settings.getExternalApi() ?? {};
         if (!kv.token) {
           kv.token = randomBytes(24).toString("base64url");
@@ -1488,11 +1683,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/features",
+    policy: "token-write",
     handler(req, res) {
       try {
         if (req.method === "PUT" || req.method === "POST") {
-          if (!requireAuth(req, res, apiToken)) return;
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             if (typeof body !== "object" || body === null || Array.isArray(body) || Object.keys(body).length === 0) {
               sendJson(res, 400, { error: "invalid-patch" });
@@ -1522,6 +1718,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/inject-status",
+    policy: "open",
     handler(req, res) {
       try {
         if (req.method !== "GET") {
@@ -1546,6 +1743,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/inject-preview",
+    policy: "open",
     handler(req, res) {
       try {
         if (req.method !== "GET") {
@@ -1563,11 +1761,12 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   register({
     kind: "exact",
     path: "/api/dsh-mneme/commands",
+    policy: "token-write",
     handler(req, res) {
       try {
         if (req.method === "POST") {
-          if (!requireAuth(req, res, apiToken)) return;
-          return readBody(req).then((text) => {
+          return readBody(req, res).then((text) => {
+            if (text === null) return;
             const body = parseBody(text);
             try {
               const command = commands.add({
@@ -1582,7 +1781,6 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
           });
         }
         if (req.method === "DELETE") {
-          if (!requireAuth(req, res, apiToken)) return;
           const url = new URL(req.url, "http://localhost");
           const id = url.searchParams.get("id");
           const removed = id ? commands.remove(id) : false;
@@ -1596,8 +1794,151 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
     }
   });
 
+  // --- M.O.（Modus Operandi · 手法）工作流 ---
+  // 只读端点，读的是**项目里**的 `<项目>/.mneme/pipelines/*.json`（文件头在
+  // src/pipeline.js），项目层优先、插件包里那份降级成全局层；投影成
+  // mneme.pipeline/v1 交给面板与 agent——两边读同一份，画面只是它的投影。
+  // 运行账（`<id>.runs.jsonl`，文件头在 src/pipeline-runs.js）也在这里读：**没有账，
+  // 读侧算不出任何状态**（`tallyRuns` 拿空数组时全体节点恒为 candidate），所以喂不喂
+  // runs 决定的是「面板上有没有一句实话」，不是多一个可选装饰。
+  // 刻意不做旗标闸门：旗标管的是**客户端座位**（关=一个座位都不注册），不是数据面；
+  // 多一个只读端点不会让任何人看见它，而给它加闸门只会让「为什么面板打不开」多一种成因。
+  register({
+    kind: "exact",
+    path: "/api/dsh-mneme/pipeline",
+    policy: "open",
+    handler(req, res) {
+      try {
+        const url = new URL(req.url, "http://localhost");
+        const id = url.searchParams.get("id") || null;
+        const project = url.searchParams.get("project");
+        // project 是**会话工作目录**，由面板侧解析后带过来——工作目录只有客户端拿得到
+        // （宿主会话头里的 header.cwd），服务端没有「当前项目」这个概念。
+        // 不是绝对路径就**拒掉**，不能忽略：忽略了会静默退成「全局」，而全局看起来
+        // 一切正常——那正是这版要修掉的那类错。
+        if (project !== null && !isAbsolute(project)) {
+          sendJson(res, 400, { error: "project-not-absolute", detail: project });
+          return;
+        }
+
+        // 只读**账本目录**来定「哪些 id 有账」：最新一条 run 可能属于一条刚被删掉或
+        // 还没写完的 .json，这时工作流目录里问不到它的 id，而账本还在盘上。
+        // runIds 必须在 handler 级声明：下面观察旁挂块（同函数的另一个 if 分支）也按
+        // 这份 id 列表取观察——之前声明在账本分支的块级作用域里，旁挂块一引用就
+        // ReferenceError，被 catch 静默吞成「没有观察」（CodeRabbit #458 F1，
+        // 复盘注释见下方旁挂块）。
+        let runIds = [];
+        let runsResult = { runsById: {}, errors: [], statesById: {} };
+        if (project !== null) {
+          const where = runsDir(project);
+          runIds = existsSync(where)
+            ? readdirSync(where)
+                .filter((f) => f.endsWith(RUNS_SUFFIX))
+                .sort()
+                .map((f) => f.slice(0, -RUNS_SUFFIX.length))
+            : [];
+          if (runIds.length) {
+            // step id 闸门：账本里出现「图上没有的 step id」时，credit 会落在一个没有节点的
+            // 地方——**记了、数得出来、面板上永远看不见**，症状与「从没跑过」同形。
+            // 这里把每条工作流的步骤表读出来当白名单，让那种行变成看得见的噪音。
+            let stepIdsById = null;
+            try {
+              stepIdsById = Object.create(null);
+              for (const p of loadPipelines(projectPipelineDir(project), { scope: "project" })) {
+                stepIdsById[p.id] = p.steps.map((s) => s.id);
+              }
+            } catch {
+              // 项目层有坏 .json 时 readPipelineDoc 会把它记进 `unreadable`；这里不重复报，
+              // 也绝不因此让整个面板打不开——闸门退化成「没有白名单」，账本照读。
+              stepIdsById = null;
+            }
+            runsResult = loadRunsById(project, runIds, { expectedStepIdsById: stepIdsById });
+          }
+        }
+        const { runsById, errors: runsErrors, statesById } = runsResult;
+
+        // P3 投影的燃料：观察旁挂（与 /candidates 的 memoryDir 同源同默认）。
+        // 失败不连累图——旁挂是可再生的辅助数据，读不到就当没有，提议少一类而已。
+        let observationsById = {};
+        if (project !== null) {
+          try {
+            const memoryDir = (config && typeof config.memoryDir === "string" && config.memoryDir.trim() !== "")
+              ? config.memoryDir
+              : "~/.dsh/memory";
+            const odir = observationDir({ memoryDir, projectKey: projectKey(project) });
+            if (odir) {
+              observationsById = loadObservationsById(odir, runIds.filter(Boolean));
+            }
+          } catch {
+            // 读旁挂失败不算账本问题：如实降级成「没有观察」，fix-step-tool 少发而已
+          }
+        }
+
+        const doc = readPipelineDoc({ projectRoot: project, id, runsById, observationsById });
+
+        // 「读不出来」与「还没跑过」在节点状态上完全同形（都是全体 candidate），而且
+        // **不带 id 的默认视图没有兜底**——那正是用户打开时看到的那一屏。所以状态按
+        // pipeline 逐条显式带出去（清单行的 `runsState` 与选中那条的顶层 `runsState`），
+        // 客户端不必靠顶层噪音猜。也刻意**不再**对坏账本回 500：那会让客户端把它当成
+        // 「离线」，还顺手吞掉本来读得出来的那张图（账本坏了，工作流本身没坏）。
+        // 没有项目根时账本层无从读起，如实给 null，而不是谎称「没有账本文件」。
+        const chosenId = doc.pipeline ? doc.pipeline.id : null;
+        const runsState = project !== null && chosenId !== null ? statesById[chosenId] || "absent" : null;
+        const available =
+          project === null
+            ? doc.available
+            : doc.available.map((row) => ({ ...row, runsState: statesById[row.id] || "absent" }));
+
+        sendJson(res, 200, { ...doc, available, runsState, runsErrors });
+      } catch (error) {
+        // 工作流是人手写的 JSON，报错本身就是给人看的：说清哪一条、坏在哪，
+        // 而不是回一句 internal 让人去翻日志。
+        sendJson(res, 500, {
+          error: "pipeline-unreadable",
+          detail: String((error && error.message) || error)
+        });
+      }
+    }
+  });
+
+  // --- M.O. 候选层（绕行走出来、还没进仓库的那些路） ---
+  // 和 /pipeline 读的是两处不同的东西，别混：
+  //   /pipeline    定稿，住**仓库**（<项目>/.mneme/pipelines/），可提交、可 review
+  //   /candidates  候选，住**本地**（<memoryDir>/candidates/<项目键>/），随时长、随时扔
+  // 分开是刻意的：候选是草稿，一天可能长十条死九条，进仓库就是垃圾；
+  // 而定稿只放人亲手批过的东西——候选是定稿的唯一入口。
+  //
+  // 这一刀只给**读**：提议与批准的动作还没有落点（那要等执行侧）。
+  // 契约里显式写着 boundaries.autoPromote/autoApprove/injectIntoMemory 三个 false，
+  // 免得以后有人以为忘了做。
+  register({
+    kind: "exact",
+    path: "/api/dsh-mneme/candidates",
+    policy: "open",
+    handler(req, res) {
+      try {
+        const url = new URL(req.url, "http://localhost");
+        const project = url.searchParams.get("project");
+        if (project !== null && !isAbsolute(project)) {
+          sendJson(res, 400, { error: "project-not-absolute", detail: project });
+          return;
+        }
+        // memoryDir 从 config 拿（与 store 同源）；取不到就退回默认，与 config.js 的默认值一致。
+        const memoryDir = (config && typeof config.memoryDir === "string" && config.memoryDir.trim())
+          ? config.memoryDir
+          : "~/.dsh/memory";
+        sendJson(res, 200, readCandidateDoc({ memoryDir, projectRoot: project }));
+      } catch (error) {
+        sendJson(res, 500, {
+          error: "candidates-unreadable",
+          detail: String((error && error.message) || error)
+        });
+      }
+    }
+  });
+
   return {
-    routes: 34,
+    routes: countRoutes(),
     dispose: () => {
       for (const dispose of disposers) dispose();
     }