@mushinjs/plugin-console 0.0.0-stage → 0.2.0-next.20261113103537

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Setobox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth.d.ts

@@ -0,0 +1,3 @@
+/** Replaces the admin token in a data directory and returns it. A running instance picks it up on the next sign-in. */
+export declare function resetAdminToken(dataDir: string): Promise<string>;
+export declare function readAdminToken(dataDir: string): Promise<string | undefined>;

package/dist/auth.js

@@ -0,0 +1,35 @@
+import { readJson, writeJsonAtomic } from "@mushinjs/core";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { join } from "node:path";
+// src/auth.ts
+/** Storage key of the auth record: `data/auth.json`. */
+const AUTH_KEY = "auth";
+function generateToken() {
+	return randomBytes(24).toString("base64url");
+}
+/** Older builds stored only a hash, which cannot be shown again; those records are replaced. */
+function isAuthRecord(value) {
+	return typeof value?.token === "string" && value.token.length >= 16;
+}
+function tokensEqual(supplied, expected) {
+	if (!supplied || !expected) return false;
+	const a = Buffer.from(supplied);
+	const b = Buffer.from(expected);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Replaces the admin token in a data directory and returns it. A running instance picks it up on the next sign-in. */
+async function resetAdminToken(dataDir) {
+	const token = generateToken();
+	await writeJsonAtomic(join(dataDir, `${AUTH_KEY}.json`), {
+		token,
+		createdAt: Date.now()
+	});
+	return token;
+}
+async function readAdminToken(dataDir) {
+	const record = await readJson(join(dataDir, `${AUTH_KEY}.json`));
+	return isAuthRecord(record) ? record.token : void 0;
+}
+export { AUTH_KEY, generateToken, isAuthRecord, readAdminToken, resetAdminToken, tokensEqual };
+
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import { randomBytes, timingSafeEqual } from 'node:crypto'\nimport { join } from 'node:path'\nimport { readJson, writeJsonAtomic } from '@mushinjs/core'\n\n/**\n * The admin token, stored in plain text next to the provider keys it protects, so it can be\n * shown again on every start. Anyone who can read the data directory already holds those keys.\n */\nexport interface AuthRecord {\n  token: string\n  createdAt: number\n}\n\n/** Storage key of the auth record: `data/auth.json`. */\nexport const AUTH_KEY = 'auth'\n\nexport function generateToken() {\n  return randomBytes(24).toString('base64url')\n}\n\n/** Older builds stored only a hash, which cannot be shown again; those records are replaced. */\nexport function isAuthRecord(value: unknown): value is AuthRecord {\n  return typeof (value as AuthRecord | undefined)?.token === 'string' && (value as AuthRecord).token.length >= 16\n}\n\nexport function tokensEqual(supplied: string | null | undefined, expected: string | undefined) {\n  if (!supplied || !expected) return false\n  const a = Buffer.from(supplied)\n  const b = Buffer.from(expected)\n  return a.length === b.length && timingSafeEqual(a, b)\n}\n\n/** Replaces the admin token in a data directory and returns it. A running instance picks it up on the next sign-in. */\nexport async function resetAdminToken(dataDir: string) {\n  const token = generateToken()\n  await writeJsonAtomic(join(dataDir, `${AUTH_KEY}.json`), { token, createdAt: Date.now() } satisfies AuthRecord)\n  return token\n}\n\nexport async function readAdminToken(dataDir: string) {\n  const record = await readJson<unknown>(join(dataDir, `${AUTH_KEY}.json`))\n  return isAuthRecord(record) ? record.token : undefined\n}\n"],"mappings":";;;;;AAcA,MAAa,WAAW;AAExB,SAAgB,gBAAgB;CAC9B,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC7C;;AAGA,SAAgB,aAAa,OAAqC;CAChE,OAAO,OAAQ,OAAkC,UAAU,YAAa,MAAqB,MAAM,UAAU;AAC/G;AAEA,SAAgB,YAAY,UAAqC,UAA8B;CAC7F,IAAI,CAAC,YAAY,CAAC,UAAU,OAAO;CACnC,MAAM,IAAI,OAAO,KAAK,QAAQ;CAC9B,MAAM,IAAI,OAAO,KAAK,QAAQ;CAC9B,OAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;;AAGA,eAAsB,gBAAgB,SAAiB;CACrD,MAAM,QAAQ,cAAc;CAC5B,MAAM,gBAAgB,KAAK,SAAS,GAAG,SAAS,MAAM,GAAG;EAAE;EAAO,WAAW,KAAK,IAAI;CAAE,CAAsB;CAC9G,OAAO;AACT;AAEA,eAAsB,eAAe,SAAiB;CACpD,MAAM,SAAS,MAAM,SAAkB,KAAK,SAAS,GAAG,SAAS,MAAM,CAAC;CACxE,OAAO,aAAa,MAAM,IAAI,OAAO,QAAQ,KAAA;AAC/C"}

package/dist/index.d.ts

@@ -0,0 +1,62 @@
+import { readAdminToken, resetAdminToken } from "./auth.js";
+import { Context, LogTag, Service, z } from "@mushinjs/core";
+declare module '@mushinjs/core' {
+  interface Context {
+    console: Console;
+  }
+  interface Events {
+    'console/ready'(info: SignInInfo): void;
+  }
+}
+/** What the launcher prints so the user can sign in. Never sent through the logger. */
+export interface SignInInfo {
+  url: string;
+  token: string;
+  fromEnv: boolean;
+}
+export declare const name = "console";
+export interface LogLine {
+  sn: number;
+  ts: number;
+  type: string;
+  name: string;
+  /** Source category from the logger name, for the dashboard's quick filters. */
+  tag: LogTag;
+  text: string;
+}
+/**
+ * Serves the dashboard, its HTTP API (one generic action endpoint) and a WebSocket for live events.
+ * Every request needs the admin token.
+ */
+export declare class Console extends Service {
+  config: {
+    path: string;
+  };
+  static inject: string[];
+  static Config: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+  }, z.core.$strip>;
+  private home;
+  private clients;
+  private auth?;
+  private reloadedAt;
+  private envToken;
+  /** Set once the dashboard is being served. */
+  ready?: SignInInfo;
+  constructor(ctx: Context, config: {
+    path: string;
+  });
+  [Service.init](): AsyncGenerator<() => void, void, unknown>;
+  private ensureToken;
+  private verify;
+  /** Verifies a token; on a miss, re-reads data/auth.json so `mushin token reset` works without a restart. */
+  private authenticate;
+  private authorize;
+  private isBotLog;
+  broadcast(name: string, data: unknown): void;
+  private attach;
+  /** Runs a client action in the caller's dashboard tab, or the most recently active one. */
+  private relay;
+  private defineActions;
+}
+export { Console as default, readAdminToken, resetAdminToken };

package/dist/index.js

@@ -0,0 +1,409 @@
+import { AUTH_KEY, generateToken, isAuthRecord, readAdminToken, resetAdminToken, tokensEqual } from "./auth.js";
+import { MISSING_BUILD_PAGE, dashboardRoot, readStatic } from "./static.js";
+import { LOG_TAGS, Logger, MushinError, Service, field, logTag, randomId, toErrorPayload, z } from "@mushinjs/core";
+// src/index.ts
+const name = "console";
+const CLIENT_CALL_TIMEOUT = 15e3;
+/** Client actions that wait for the user get longer. */
+const CLIENT_CALL_TIMEOUTS = { "ui.ask": 9e5 };
+/** Events forwarded to every signed-in dashboard. */
+const FORWARDED_EVENTS = [
+	"actions/changed",
+	"manager/changed",
+	"providers/changed",
+	"bots/changed",
+	"bots/status",
+	"bots/message",
+	"bots/log",
+	"agent/event",
+	"agent/changed",
+	"flows/changed",
+	"flows/run",
+	"flows/step",
+	"flows/tests",
+	"flows/activity",
+	"flows/paused",
+	"stats/sample",
+	"permissions/changed",
+	"personas/changed",
+	"knowledge/changed",
+	"knowledge/progress"
+];
+const plainExporter = {
+	colors: false,
+	export() {}
+};
+function formatLog(message) {
+	return {
+		sn: message.sn,
+		ts: message.ts,
+		type: message.type,
+		name: message.name,
+		tag: logTag(message.name),
+		text: Logger.format(plainExporter, message)
+	};
+}
+/**
+* Serves the dashboard, its HTTP API (one generic action endpoint) and a WebSocket for live events.
+* Every request needs the admin token.
+*/
+var Console = class extends Service {
+	config;
+	static inject = [
+		"server",
+		"actions",
+		"storage"
+	];
+	static Config = z.object({ path: z.string().default("/api").meta(field("API path", "Base path of the HTTP API", { "zh-CN": {
+		title: "API 路径",
+		description: "HTTP API 的基础路径"
+	} })) });
+	home;
+	clients = /* @__PURE__ */ new Map();
+	auth;
+	reloadedAt = 0;
+	envToken = process.env.MUSHIN_ADMIN_TOKEN;
+	/** Set once the dashboard is being served. */
+	ready;
+	constructor(ctx, config) {
+		super(ctx, "console");
+		this.config = config;
+		this.home = ctx;
+	}
+	async *[Service.init]() {
+		const devDashboard = process.env.MUSHIN_DEV_DASHBOARD;
+		await this.ensureToken();
+		const { server, actions } = this.home;
+		const base = this.config.path;
+		yield actions.setClientRelay((name, input, caller) => this.relay(name, input, caller));
+		yield* this.defineActions();
+		server.get(`${base}/health`, async (_req, res) => {
+			res.json({ ok: true });
+		});
+		server.post(`${base}/login`, async (req, res) => {
+			const body = await readBody(req).catch(() => void 0);
+			if (!await this.authenticate(typeof body?.token === "string" ? body.token.trim() : void 0)) {
+				res.status = 401;
+				res.json({
+					ok: false,
+					error: {
+						code: "unauthorized",
+						message: "Wrong admin token"
+					}
+				});
+				return;
+			}
+			res.json({ ok: true });
+		});
+		server.get(`${base}/actions`, async (req, res) => {
+			if (!await this.authorize(req, res)) return;
+			res.json({
+				ok: true,
+				result: actions.list()
+			});
+		});
+		server.post(`${base}/actions/:name`, async (req, res) => {
+			if (!await this.authorize(req, res)) return;
+			try {
+				const body = await readBody(req);
+				const result = await actions.call(req.params.name, body ?? {}, { kind: "api" });
+				res.json({
+					ok: true,
+					result: result ?? null
+				});
+			} catch (error) {
+				res.status = error instanceof MushinError ? error.status : 500;
+				if (!(error instanceof MushinError)) this.home.logger("console").warn(error);
+				res.json({
+					ok: false,
+					error: toErrorPayload(error)
+				});
+			}
+		});
+		server.ws(`${base}/ws`, async (_req, accept) => {
+			this.attach(await accept());
+		});
+		const root = dashboardRoot();
+		server.get(/^(?!\/api(?:\/|$)).*/, async (req, res) => {
+			if (devDashboard) {
+				res.status = 302;
+				res.headers.set("location", `${devDashboard}${req.url}`);
+				res.headers.set("cache-control", "no-store");
+				res.text("");
+				return;
+			}
+			const file = root ? await readStatic(root, req.path) : void 0;
+			if (!file) {
+				res.headers.set("content-type", "text/html; charset=utf-8");
+				res.status = root ? 404 : 200;
+				res.text(root ? "Not found" : MISSING_BUILD_PAGE);
+				return;
+			}
+			res.status = 200;
+			res.headers.set("content-type", file.type);
+			res.headers.set("cache-control", file.immutable ? "public, max-age=31536000, immutable" : "no-cache");
+			res.bytes(new Uint8Array(file.body));
+		});
+		for (const name of FORWARDED_EVENTS) yield this.home.on(name, (data) => this.broadcast(name, data));
+		this.ready = {
+			url: devDashboard ?? server.baseUrl,
+			token: this.envToken ?? this.auth.token,
+			fromEnv: !!this.envToken
+		};
+		this.home.emit("console/ready", this.ready);
+		this.home.logger("console").info("dashboard at %s", this.ready.url);
+		yield this.home.logger.exporter({
+			colors: false,
+			export: (message) => {
+				if (!this.isBotLog(message)) this.broadcast("log", formatLog(message));
+			}
+		});
+		yield () => {
+			for (const client of this.clients.values()) client.socket.close(1001, "console stopped");
+		};
+	}
+	async ensureToken() {
+		if (this.envToken) {
+			this.home.logger("console").info("using the admin token from MUSHIN_ADMIN_TOKEN");
+			return;
+		}
+		const stored = await this.home.storage.get(AUTH_KEY);
+		if (isAuthRecord(stored)) {
+			this.auth = stored;
+			return;
+		}
+		this.auth = {
+			token: generateToken(),
+			createdAt: Date.now()
+		};
+		await this.home.storage.set(AUTH_KEY, this.auth);
+		this.home.logger("console").info(stored ? "replaced an unreadable admin token record" : "created the admin token");
+	}
+	verify(token) {
+		return tokensEqual(token, this.envToken ?? this.auth?.token);
+	}
+	/** Verifies a token; on a miss, re-reads data/auth.json so `mushin token reset` works without a restart. */
+	async authenticate(token) {
+		if (this.verify(token)) return true;
+		if (this.envToken || !token || Date.now() - this.reloadedAt < 1e3) return false;
+		this.reloadedAt = Date.now();
+		const stored = await this.home.storage.get(AUTH_KEY).catch(() => void 0);
+		if (!isAuthRecord(stored) || stored.token === this.auth?.token) return false;
+		this.auth = stored;
+		if (this.ready) this.ready = {
+			...this.ready,
+			token: stored.token
+		};
+		return this.verify(token);
+	}
+	async authorize(req, res) {
+		const token = (req.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+		if (await this.authenticate(token)) return true;
+		res.status = 401;
+		res.json({
+			ok: false,
+			error: {
+				code: "unauthorized",
+				message: "Sign in with the admin token"
+			}
+		});
+		return false;
+	}
+	isBotLog(message) {
+		return this.home.get("bots")?.isBotLog(message) ?? false;
+	}
+	broadcast(name, data) {
+		const frame = JSON.stringify({
+			type: "event",
+			name,
+			data
+		});
+		for (const client of this.clients.values()) if (client.authed && client.socket.readyState === 1) client.socket.send(frame);
+	}
+	attach(socket) {
+		const client = {
+			id: randomId(),
+			socket,
+			authed: false,
+			lastActive: Date.now(),
+			calls: /* @__PURE__ */ new Map()
+		};
+		this.clients.set(client.id, client);
+		const send = (data) => socket.readyState === 1 && socket.send(JSON.stringify(data));
+		const authTimer = setTimeout(() => {
+			if (!client.authed) socket.close(4401, "authentication timeout");
+		}, 1e4);
+		socket.on("close", () => {
+			clearTimeout(authTimer);
+			this.clients.delete(client.id);
+			for (const call of client.calls.values()) {
+				clearTimeout(call.timer);
+				call.reject(new MushinError("unavailable", "The dashboard tab was closed"));
+			}
+		});
+		let authenticating;
+		socket.on("message", async (raw) => {
+			let message;
+			try {
+				message = JSON.parse(raw.toString());
+			} catch {
+				return;
+			}
+			client.lastActive = Date.now();
+			if (!client.authed) {
+				if (message.type === "auth" && !authenticating) {
+					authenticating = this.authenticate(message.token);
+					if (await authenticating) {
+						client.authed = true;
+						client.page = message.page;
+						clearTimeout(authTimer);
+						send({
+							type: "ready",
+							client: client.id
+						});
+					} else socket.close(4401, "wrong admin token");
+					return;
+				}
+				if (!authenticating) {
+					socket.close(4401, "authenticate first");
+					return;
+				}
+				if (!await authenticating) return;
+			}
+			switch (message.type) {
+				case "page":
+					client.page = typeof message.path === "string" ? message.path : void 0;
+					return;
+				case "call": {
+					const caller = {
+						kind: "api",
+						client: client.id
+					};
+					try {
+						const input = message.action === "agent.send" ? {
+							page: client.page,
+							...message.input
+						} : message.input;
+						const result = await this.home.actions.call(String(message.action), input ?? {}, caller);
+						send({
+							type: "result",
+							id: message.id,
+							ok: true,
+							result: result ?? null
+						});
+					} catch (error) {
+						send({
+							type: "result",
+							id: message.id,
+							ok: false,
+							error: toErrorPayload(error)
+						});
+					}
+					return;
+				}
+				case "client-result": {
+					const call = client.calls.get(String(message.id));
+					if (!call) return;
+					client.calls.delete(String(message.id));
+					clearTimeout(call.timer);
+					if (message.ok) call.resolve(message.result ?? { ok: true });
+					else call.reject(new MushinError("failed", message.error?.message ?? "The dashboard could not run this action"));
+				}
+			}
+		});
+	}
+	/** Runs a client action in the caller's dashboard tab, or the most recently active one. */
+	relay(name, input, caller) {
+		let client = caller.client ? this.clients.get(caller.client) : void 0;
+		if (!client?.authed) client = [...this.clients.values()].filter((item) => item.authed).sort((a, b) => b.lastActive - a.lastActive)[0];
+		if (!client) return Promise.reject(new MushinError("unavailable", "No dashboard is open"));
+		const target = client;
+		const id = randomId();
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				target.calls.delete(id);
+				reject(new MushinError("unavailable", "The dashboard did not answer"));
+			}, CLIENT_CALL_TIMEOUTS[name] ?? CLIENT_CALL_TIMEOUT);
+			target.calls.set(id, {
+				resolve,
+				reject,
+				timer
+			});
+			target.socket.send(JSON.stringify({
+				type: "client-call",
+				id,
+				action: name,
+				input
+			}));
+		});
+	}
+	*defineActions() {
+		const actions = this.home.actions;
+		yield actions.define({
+			name: "ui.navigate",
+			description: "Open a dashboard page in the user's browser, e.g. /bots/<bot id>, /flows/<flow id> or /providers.",
+			risk: "read",
+			client: true,
+			input: z.object({ path: z.string().regex(/^\//).describe("Dashboard path starting with /") })
+		});
+		yield actions.define({
+			name: "ui.highlight",
+			description: "Point at a control on the current dashboard page. Targets: providers.add, bots.add, bot.connection, bot.plugins, bot.runs, bot.live, bot.logs, flows.add, flows.bots, flows.save, flows.test, agent.input.",
+			risk: "read",
+			client: true,
+			input: z.object({
+				target: z.string().describe("Highlight target id"),
+				message: z.string().optional().describe("Short hint shown next to the control")
+			})
+		});
+		yield actions.define({
+			name: "ui.ask",
+			description: "Ask the user a multiple-choice question in the Agent panel and wait for the answer. Use it when a choice is theirs to make (which bot, which provider, whether to overwrite). Returns { choice, label } or { other } when they type their own answer.",
+			risk: "read",
+			client: true,
+			input: z.object({
+				question: z.string().min(1).max(300),
+				options: z.array(z.object({
+					label: z.string().min(1).max(80),
+					description: z.string().max(200).optional()
+				})).min(2).max(6),
+				recommended: z.number().int().min(0).optional().describe("Index of the option you recommend"),
+				allowOther: z.boolean().optional().describe("Let the user type their own answer")
+			})
+		});
+		yield actions.define({
+			name: "system.info",
+			description: "Server address and runtime versions. The address is what NapCat should use in reverse mode.",
+			risk: "read",
+			input: z.object({}),
+			handler: () => ({
+				baseUrl: this.home.server.baseUrl,
+				node: process.version,
+				platform: process.platform,
+				uptime: Math.round(process.uptime())
+			})
+		});
+		yield actions.define({
+			name: "logs.recent",
+			description: "Recent log lines of Mushin.js itself, oldest first, each with a source tag. Lines written inside a bot are in bots.logs instead.",
+			risk: "read",
+			input: z.object({
+				limit: z.number().int().min(1).max(1e3).optional(),
+				tag: z.enum(LOG_TAGS).optional().describe("Only lines from this source: plugin, bot, adapter, flow, provider, agent, system or other")
+			}),
+			handler: ({ limit, tag }) => this.home.logger.buffer.filter((message) => !this.isBotLog(message) && (!tag || logTag(message.name) === tag)).slice(-(limit ?? 200)).map(formatLog)
+		});
+	}
+};
+async function readBody(req) {
+	const text = await req.text();
+	if (!text) return void 0;
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new MushinError("invalid_input", "Request body must be JSON");
+	}
+}
+export { Console, Console as default, name, readAdminToken, resetAdminToken };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { WebSocket } from 'ws'\nimport {\n  type ActionCaller, Context, type Exporter, field, Logger, LOG_TAGS, type LogTag, logTag, type Message, MushinError, randomId, Service, toErrorPayload, z,\n} from '@mushinjs/core'\nimport type {} from '@cordisjs/plugin-server'\nimport type {} from '@mushinjs/plugin-agent'\nimport type {} from '@mushinjs/plugin-bots'\nimport type {} from '@mushinjs/plugin-flows'\nimport type {} from '@mushinjs/plugin-providers'\nimport type {} from '@mushinjs/plugin-stats'\nimport type {} from '@mushinjs/plugin-storage'\nimport { AUTH_KEY, type AuthRecord, generateToken, isAuthRecord, tokensEqual } from './auth'\nimport { dashboardRoot, MISSING_BUILD_PAGE, readStatic } from './static'\n\nexport { readAdminToken, resetAdminToken } from './auth'\n\ndeclare module '@mushinjs/core' {\n  interface Context {\n    console: Console\n  }\n\n  interface Events {\n    'console/ready'(info: SignInInfo): void\n  }\n}\n\n/** What the launcher prints so the user can sign in. Never sent through the logger. */\nexport interface SignInInfo {\n  url: string\n  token: string\n  fromEnv: boolean\n}\n\nexport const name = 'console'\n\ninterface Client {\n  id: string\n  socket: WebSocket\n  authed: boolean\n  page?: string\n  lastActive: number\n  calls: Map<string, { resolve: (value: unknown) => void; reject: (error: Error) => void; timer: NodeJS.Timeout }>\n}\n\nexport interface LogLine {\n  sn: number\n  ts: number\n  type: string\n  name: string\n  /** Source category from the logger name, for the dashboard's quick filters. */\n  tag: LogTag\n  text: string\n}\n\nconst CLIENT_CALL_TIMEOUT = 15_000\n/** Client actions that wait for the user get longer. */\nconst CLIENT_CALL_TIMEOUTS: Record<string, number> = { 'ui.ask': 15 * 60_000 }\n\n/** Events forwarded to every signed-in dashboard. */\nconst FORWARDED_EVENTS = [\n  'actions/changed', 'manager/changed', 'providers/changed',\n  'bots/changed', 'bots/status', 'bots/message', 'bots/log', 'agent/event', 'agent/changed',\n  'flows/changed', 'flows/run', 'flows/step', 'flows/tests', 'flows/activity', 'flows/paused', 'stats/sample', 'permissions/changed', 'personas/changed',\n  'knowledge/changed', 'knowledge/progress',\n] as const\n\nconst plainExporter: Exporter = { colors: false, export() {} }\n\nfunction formatLog(message: Message): LogLine {\n  return {\n    sn: message.sn,\n    ts: message.ts,\n    type: message.type,\n    name: message.name,\n    tag: logTag(message.name),\n    text: Logger.format(plainExporter, message),\n  }\n}\n\n/**\n * Serves the dashboard, its HTTP API (one generic action endpoint) and a WebSocket for live events.\n * Every request needs the admin token.\n */\nexport class Console extends Service {\n  static inject = ['server', 'actions', 'storage']\n  static Config = z.object({\n    path: z.string().default('/api').meta(field('API path', 'Base path of the HTTP API', {\n      'zh-CN': { title: 'API 路径', description: 'HTTP API 的基础路径' },\n    })),\n  })\n\n  private home: Context\n  private clients = new Map<string, Client>()\n  private auth?: AuthRecord\n  private reloadedAt = 0\n  private envToken = process.env.MUSHIN_ADMIN_TOKEN\n  /** Set once the dashboard is being served. */\n  ready?: SignInInfo\n\n  constructor(ctx: Context, public config: { path: string }) {\n    super(ctx, 'console')\n    this.home = ctx\n  }\n\n  async *[Service.init]() {\n    const devDashboard = process.env.MUSHIN_DEV_DASHBOARD\n    await this.ensureToken()\n    const { server, actions } = this.home\n    const base = this.config.path\n\n    yield actions.setClientRelay((name, input, caller) => this.relay(name, input, caller))\n    yield* this.defineActions()\n\n    // Health and login are the only routes that work without a token.\n    server.get(`${base}/health`, async (_req, res) => {\n      res.json({ ok: true })\n    })\n\n    server.post(`${base}/login`, async (req, res) => {\n      const body = await readBody(req).catch(() => undefined)\n      if (!(await this.authenticate(typeof body?.token === 'string' ? body.token.trim() : undefined))) {\n        res.status = 401\n        res.json({ ok: false, error: { code: 'unauthorized', message: 'Wrong admin token' } })\n        return\n      }\n      res.json({ ok: true })\n    })\n\n    server.get(`${base}/actions`, async (req, res) => {\n      if (!(await this.authorize(req, res))) return\n      res.json({ ok: true, result: actions.list() })\n    })\n\n    server.post(`${base}/actions/:name`, async (req, res) => {\n      if (!(await this.authorize(req, res))) return\n      try {\n        const body = await readBody(req)\n        const result = await actions.call(req.params.name, body ?? {}, { kind: 'api' })\n        res.json({ ok: true, result: result ?? null })\n      } catch (error) {\n        res.status = error instanceof MushinError ? error.status : 500\n        if (!(error instanceof MushinError)) this.home.logger('console').warn(error)\n        res.json({ ok: false, error: toErrorPayload(error) })\n      }\n    })\n\n    server.ws(`${base}/ws`, async (_req, accept) => {\n      this.attach(await accept())\n    })\n\n    // Everything outside the API is the dashboard (with SPA fallback).\n    const root = dashboardRoot()\n    server.get(/^(?!\\/api(?:\\/|$)).*/, async (req, res) => {\n      if (devDashboard) {\n        res.status = 302\n        res.headers.set('location', `${devDashboard}${req.url}`)\n        res.headers.set('cache-control', 'no-store')\n        res.text('')\n        return\n      }\n      const file = root ? await readStatic(root, req.path) : undefined\n      if (!file) {\n        res.headers.set('content-type', 'text/html; charset=utf-8')\n        res.status = root ? 404 : 200\n        res.text(root ? 'Not found' : MISSING_BUILD_PAGE)\n        return\n      }\n      res.status = 200\n      res.headers.set('content-type', file.type)\n      res.headers.set('cache-control', file.immutable ? 'public, max-age=31536000, immutable' : 'no-cache')\n      res.bytes(new Uint8Array(file.body))\n    })\n\n    for (const name of FORWARDED_EVENTS) {\n      yield this.home.on(name, (data: unknown) => this.broadcast(name, data))\n    }\n\n    // The launcher prints the sign-in link from this event; the token never goes to the log buffer,\n    // which the dashboard and the Agent can read.\n    this.ready = { url: devDashboard ?? server.baseUrl, token: this.envToken ?? this.auth!.token, fromEnv: !!this.envToken }\n    this.home.emit('console/ready', this.ready)\n    this.home.logger('console').info('dashboard at %s', this.ready.url)\n    yield this.home.logger.exporter({\n      colors: false,\n      // Lines written inside a bot go to that bot's own log (`bots/log`), not the global one.\n      export: (message) => {\n        if (!this.isBotLog(message)) this.broadcast('log', formatLog(message))\n      },\n    })\n    yield () => {\n      for (const client of this.clients.values()) client.socket.close(1001, 'console stopped')\n    }\n  }\n\n  private async ensureToken() {\n    if (this.envToken) {\n      this.home.logger('console').info('using the admin token from MUSHIN_ADMIN_TOKEN')\n      return\n    }\n    const stored = await this.home.storage.get<unknown>(AUTH_KEY)\n    if (isAuthRecord(stored)) {\n      this.auth = stored\n      return\n    }\n    // No record yet, or one from an older build that kept only a hash: make a token that can be shown.\n    this.auth = { token: generateToken(), createdAt: Date.now() }\n    await this.home.storage.set(AUTH_KEY, this.auth)\n    this.home.logger('console').info(stored ? 'replaced an unreadable admin token record' : 'created the admin token')\n  }\n\n  private verify(token: string | null | undefined) {\n    return tokensEqual(token, this.envToken ?? this.auth?.token)\n  }\n\n  /** Verifies a token; on a miss, re-reads data/auth.json so `mushin token reset` works without a restart. */\n  private async authenticate(token: string | null | undefined) {\n    if (this.verify(token)) return true\n    if (this.envToken || !token || Date.now() - this.reloadedAt < 1000) return false\n    this.reloadedAt = Date.now()\n    const stored = await this.home.storage.get<unknown>(AUTH_KEY).catch(() => undefined)\n    if (!isAuthRecord(stored) || stored.token === this.auth?.token) return false\n    this.auth = stored\n    if (this.ready) this.ready = { ...this.ready, token: stored.token }\n    return this.verify(token)\n  }\n\n  private async authorize(req: { headers: Headers }, res: { status: number; json(data: unknown): unknown }) {\n    const header = req.headers.get('authorization') ?? ''\n    const token = header.replace(/^Bearer\\s+/i, '')\n    if (await this.authenticate(token)) return true\n    res.status = 401\n    res.json({ ok: false, error: { code: 'unauthorized', message: 'Sign in with the admin token' } })\n    return false\n  }\n\n  private isBotLog(message: Message) {\n    return this.home.get('bots')?.isBotLog(message) ?? false\n  }\n\n  broadcast(name: string, data: unknown) {\n    const frame = JSON.stringify({ type: 'event', name, data })\n    for (const client of this.clients.values()) {\n      if (client.authed && client.socket.readyState === 1) client.socket.send(frame)\n    }\n  }\n\n  private attach(socket: WebSocket) {\n    const client: Client = { id: randomId(), socket, authed: false, lastActive: Date.now(), calls: new Map() }\n    this.clients.set(client.id, client)\n    const send = (data: unknown) => socket.readyState === 1 && socket.send(JSON.stringify(data))\n    const authTimer = setTimeout(() => {\n      if (!client.authed) socket.close(4401, 'authentication timeout')\n    }, 10_000)\n\n    socket.on('close', () => {\n      clearTimeout(authTimer)\n      this.clients.delete(client.id)\n      for (const call of client.calls.values()) {\n        clearTimeout(call.timer)\n        call.reject(new MushinError('unavailable', 'The dashboard tab was closed'))\n      }\n    })\n\n    // Messages can arrive while the token is still being checked (the tab reports its page as soon\n    // as the socket opens); they wait for the check instead of failing it.\n    let authenticating: Promise<boolean> | undefined\n    socket.on('message', async (raw) => {\n      let message: any\n      try {\n        message = JSON.parse(raw.toString())\n      } catch {\n        return\n      }\n      client.lastActive = Date.now()\n      if (!client.authed) {\n        if (message.type === 'auth' && !authenticating) {\n          authenticating = this.authenticate(message.token)\n          if (await authenticating) {\n            client.authed = true\n            client.page = message.page\n            clearTimeout(authTimer)\n            send({ type: 'ready', client: client.id })\n          } else {\n            socket.close(4401, 'wrong admin token')\n          }\n          return\n        }\n        if (!authenticating) {\n          socket.close(4401, 'authenticate first')\n          return\n        }\n        if (!await authenticating) return\n      }\n      switch (message.type) {\n        case 'page':\n          client.page = typeof message.path === 'string' ? message.path : undefined\n          return\n        case 'call': {\n          const caller: ActionCaller = { kind: 'api', client: client.id }\n          try {\n            const input = message.action === 'agent.send' ? { page: client.page, ...message.input } : message.input\n            const result = await this.home.actions.call(String(message.action), input ?? {}, caller)\n            send({ type: 'result', id: message.id, ok: true, result: result ?? null })\n          } catch (error) {\n            send({ type: 'result', id: message.id, ok: false, error: toErrorPayload(error) })\n          }\n          return\n        }\n        case 'client-result': {\n          const call = client.calls.get(String(message.id))\n          if (!call) return\n          client.calls.delete(String(message.id))\n          clearTimeout(call.timer)\n          if (message.ok) call.resolve(message.result ?? { ok: true })\n          else call.reject(new MushinError('failed', message.error?.message ?? 'The dashboard could not run this action'))\n        }\n      }\n    })\n  }\n\n  /** Runs a client action in the caller's dashboard tab, or the most recently active one. */\n  private relay(name: string, input: unknown, caller: ActionCaller) {\n    let client = caller.client ? this.clients.get(caller.client) : undefined\n    if (!client?.authed) {\n      client = [...this.clients.values()].filter((item) => item.authed).sort((a, b) => b.lastActive - a.lastActive)[0]\n    }\n    if (!client) return Promise.reject(new MushinError('unavailable', 'No dashboard is open'))\n    const target = client\n    const id = randomId()\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        target.calls.delete(id)\n        reject(new MushinError('unavailable', 'The dashboard did not answer'))\n      }, CLIENT_CALL_TIMEOUTS[name] ?? CLIENT_CALL_TIMEOUT)\n      target.calls.set(id, { resolve, reject, timer })\n      target.socket.send(JSON.stringify({ type: 'client-call', id, action: name, input }))\n    })\n  }\n\n  private *defineActions() {\n    const actions = this.home.actions\n\n    yield actions.define({\n      name: 'ui.navigate',\n      description: 'Open a dashboard page in the user\\'s browser, e.g. /bots/<bot id>, /flows/<flow id> or /providers.',\n      risk: 'read',\n      client: true,\n      input: z.object({ path: z.string().regex(/^\\//).describe('Dashboard path starting with /') }),\n    })\n\n    yield actions.define({\n      name: 'ui.highlight',\n      description: 'Point at a control on the current dashboard page. Targets: providers.add, bots.add, bot.connection, bot.plugins, bot.runs, bot.live, bot.logs, flows.add, flows.bots, flows.save, flows.test, agent.input.',\n      risk: 'read',\n      client: true,\n      input: z.object({\n        target: z.string().describe('Highlight target id'),\n        message: z.string().optional().describe('Short hint shown next to the control'),\n      }),\n    })\n\n    yield actions.define({\n      name: 'ui.ask',\n      description: 'Ask the user a multiple-choice question in the Agent panel and wait for the answer. Use it when a choice is theirs to make (which bot, which provider, whether to overwrite). Returns { choice, label } or { other } when they type their own answer.',\n      risk: 'read',\n      client: true,\n      input: z.object({\n        question: z.string().min(1).max(300),\n        options: z.array(z.object({\n          label: z.string().min(1).max(80),\n          description: z.string().max(200).optional(),\n        })).min(2).max(6),\n        recommended: z.number().int().min(0).optional().describe('Index of the option you recommend'),\n        allowOther: z.boolean().optional().describe('Let the user type their own answer'),\n      }),\n    })\n\n    yield actions.define({\n      name: 'system.info',\n      description: 'Server address and runtime versions. The address is what NapCat should use in reverse mode.',\n      risk: 'read',\n      input: z.object({}),\n      handler: () => ({\n        baseUrl: this.home.server.baseUrl,\n        node: process.version,\n        platform: process.platform,\n        uptime: Math.round(process.uptime()),\n      }),\n    })\n\n    yield actions.define({\n      name: 'logs.recent',\n      description: 'Recent log lines of Mushin.js itself, oldest first, each with a source tag. Lines written inside a bot are in bots.logs instead.',\n      risk: 'read',\n      input: z.object({\n        limit: z.number().int().min(1).max(1000).optional(),\n        tag: z.enum(LOG_TAGS).optional().describe('Only lines from this source: plugin, bot, adapter, flow, provider, agent, system or other'),\n      }),\n      handler: ({ limit, tag }) => this.home.logger.buffer\n        .filter((message) => !this.isBotLog(message) && (!tag || logTag(message.name) === tag))\n        .slice(-(limit ?? 200))\n        .map(formatLog),\n    })\n  }\n}\n\nasync function readBody(req: { text(): Promise<string> }) {\n  const text = await req.text()\n  if (!text) return undefined\n  try {\n    return JSON.parse(text)\n  } catch {\n    throw new MushinError('invalid_input', 'Request body must be JSON')\n  }\n}\n\nexport default Console\n"],"mappings":";;;;AAiCA,MAAa,OAAO;AAqBpB,MAAM,sBAAsB;;AAE5B,MAAM,uBAA+C,EAAE,UAAU,IAAY;;AAG7E,MAAM,mBAAmB;CACvB;CAAmB;CAAmB;CACtC;CAAgB;CAAe;CAAgB;CAAY;CAAe;CAC1E;CAAiB;CAAa;CAAc;CAAe;CAAkB;CAAgB;CAAgB;CAAuB;CACpI;CAAqB;AACvB;AAEA,MAAM,gBAA0B;CAAE,QAAQ;CAAO,SAAS,CAAC;AAAE;AAE7D,SAAS,UAAU,SAA2B;CAC5C,OAAO;EACL,IAAI,QAAQ;EACZ,IAAI,QAAQ;EACZ,MAAM,QAAQ;EACd,MAAM,QAAQ;EACd,KAAK,OAAO,QAAQ,IAAI;EACxB,MAAM,OAAO,OAAO,eAAe,OAAO;CAC5C;AACF;;;;;AAMA,IAAa,UAAb,cAA6B,QAAQ;CAgBF;CAfjC,OAAO,SAAS;EAAC;EAAU;EAAW;CAAS;CAC/C,OAAO,SAAS,EAAE,OAAO,EACvB,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,KAAK,MAAM,YAAY,6BAA6B,EACnF,SAAS;EAAE,OAAO;EAAU,aAAa;CAAiB,EAC5D,CAAC,CAAC,EACJ,CAAC;CAED;CACA,0BAAkB,IAAI,IAAoB;CAC1C;CACA,aAAqB;CACrB,WAAmB,QAAQ,IAAI;;CAE/B;CAEA,YAAY,KAAc,QAAiC;EACzD,MAAM,KAAK,SAAS;EADW,KAAA,SAAA;EAE/B,KAAK,OAAO;CACd;CAEA,QAAQ,QAAQ,QAAQ;EACtB,MAAM,eAAe,QAAQ,IAAI;EACjC,MAAM,KAAK,YAAY;EACvB,MAAM,EAAE,QAAQ,YAAY,KAAK;EACjC,MAAM,OAAO,KAAK,OAAO;EAEzB,MAAM,QAAQ,gBAAgB,MAAM,OAAO,WAAW,KAAK,MAAM,MAAM,OAAO,MAAM,CAAC;EACrF,OAAO,KAAK,cAAc;EAG1B,OAAO,IAAI,GAAG,KAAK,UAAU,OAAO,MAAM,QAAQ;GAChD,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC;EACvB,CAAC;EAED,OAAO,KAAK,GAAG,KAAK,SAAS,OAAO,KAAK,QAAQ;GAC/C,MAAM,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;GACtD,IAAI,CAAE,MAAM,KAAK,aAAa,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI,KAAA,CAAS,GAAI;IAC/F,IAAI,SAAS;IACb,IAAI,KAAK;KAAE,IAAI;KAAO,OAAO;MAAE,MAAM;MAAgB,SAAS;KAAoB;IAAE,CAAC;IACrF;GACF;GACA,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC;EACvB,CAAC;EAED,OAAO,IAAI,GAAG,KAAK,WAAW,OAAO,KAAK,QAAQ;GAChD,IAAI,CAAE,MAAM,KAAK,UAAU,KAAK,GAAG,GAAI;GACvC,IAAI,KAAK;IAAE,IAAI;IAAM,QAAQ,QAAQ,KAAK;GAAE,CAAC;EAC/C,CAAC;EAED,OAAO,KAAK,GAAG,KAAK,iBAAiB,OAAO,KAAK,QAAQ;GACvD,IAAI,CAAE,MAAM,KAAK,UAAU,KAAK,GAAG,GAAI;GACvC,IAAI;IACF,MAAM,OAAO,MAAM,SAAS,GAAG;IAC/B,MAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC9E,IAAI,KAAK;KAAE,IAAI;KAAM,QAAQ,UAAU;IAAK,CAAC;GAC/C,SAAS,OAAO;IACd,IAAI,SAAS,iBAAiB,cAAc,MAAM,SAAS;IAC3D,IAAI,EAAE,iBAAiB,cAAc,KAAK,KAAK,OAAO,SAAS,CAAC,CAAC,KAAK,KAAK;IAC3E,IAAI,KAAK;KAAE,IAAI;KAAO,OAAO,eAAe,KAAK;IAAE,CAAC;GACtD;EACF,CAAC;EAED,OAAO,GAAG,GAAG,KAAK,MAAM,OAAO,MAAM,WAAW;GAC9C,KAAK,OAAO,MAAM,OAAO,CAAC;EAC5B,CAAC;EAGD,MAAM,OAAO,cAAc;EAC3B,OAAO,IAAI,wBAAwB,OAAO,KAAK,QAAQ;GACrD,IAAI,cAAc;IAChB,IAAI,SAAS;IACb,IAAI,QAAQ,IAAI,YAAY,GAAG,eAAe,IAAI,KAAK;IACvD,IAAI,QAAQ,IAAI,iBAAiB,UAAU;IAC3C,IAAI,KAAK,EAAE;IACX;GACF;GACA,MAAM,OAAO,OAAO,MAAM,WAAW,MAAM,IAAI,IAAI,IAAI,KAAA;GACvD,IAAI,CAAC,MAAM;IACT,IAAI,QAAQ,IAAI,gBAAgB,0BAA0B;IAC1D,IAAI,SAAS,OAAO,MAAM;IAC1B,IAAI,KAAK,OAAO,cAAc,kBAAkB;IAChD;GACF;GACA,IAAI,SAAS;GACb,IAAI,QAAQ,IAAI,gBAAgB,KAAK,IAAI;GACzC,IAAI,QAAQ,IAAI,iBAAiB,KAAK,YAAY,wCAAwC,UAAU;GACpG,IAAI,MAAM,IAAI,WAAW,KAAK,IAAI,CAAC;EACrC,CAAC;EAED,KAAK,MAAM,QAAQ,kBACjB,MAAM,KAAK,KAAK,GAAG,OAAO,SAAkB,KAAK,UAAU,MAAM,IAAI,CAAC;EAKxE,KAAK,QAAQ;GAAE,KAAK,gBAAgB,OAAO;GAAS,OAAO,KAAK,YAAY,KAAK,KAAM;GAAO,SAAS,CAAC,CAAC,KAAK;EAAS;EACvH,KAAK,KAAK,KAAK,iBAAiB,KAAK,KAAK;EAC1C,KAAK,KAAK,OAAO,SAAS,CAAC,CAAC,KAAK,mBAAmB,KAAK,MAAM,GAAG;EAClE,MAAM,KAAK,KAAK,OAAO,SAAS;GAC9B,QAAQ;GAER,SAAS,YAAY;IACnB,IAAI,CAAC,KAAK,SAAS,OAAO,GAAG,KAAK,UAAU,OAAO,UAAU,OAAO,CAAC;GACvE;EACF,CAAC;EACD,YAAY;GACV,KAAK,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG,OAAO,OAAO,MAAM,MAAM,iBAAiB;EACzF;CACF;CAEA,MAAc,cAAc;EAC1B,IAAI,KAAK,UAAU;GACjB,KAAK,KAAK,OAAO,SAAS,CAAC,CAAC,KAAK,+CAA+C;GAChF;EACF;EACA,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,IAAa,QAAQ;EAC5D,IAAI,aAAa,MAAM,GAAG;GACxB,KAAK,OAAO;GACZ;EACF;EAEA,KAAK,OAAO;GAAE,OAAO,cAAc;GAAG,WAAW,KAAK,IAAI;EAAE;EAC5D,MAAM,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;EAC/C,KAAK,KAAK,OAAO,SAAS,CAAC,CAAC,KAAK,SAAS,8CAA8C,yBAAyB;CACnH;CAEA,OAAe,OAAkC;EAC/C,OAAO,YAAY,OAAO,KAAK,YAAY,KAAK,MAAM,KAAK;CAC7D;;CAGA,MAAc,aAAa,OAAkC;EAC3D,IAAI,KAAK,OAAO,KAAK,GAAG,OAAO;EAC/B,IAAI,KAAK,YAAY,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,KAAM,OAAO;EAC3E,KAAK,aAAa,KAAK,IAAI;EAC3B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,IAAa,QAAQ,CAAC,CAAC,YAAY,KAAA,CAAS;EACnF,IAAI,CAAC,aAAa,MAAM,KAAK,OAAO,UAAU,KAAK,MAAM,OAAO,OAAO;EACvE,KAAK,OAAO;EACZ,IAAI,KAAK,OAAO,KAAK,QAAQ;GAAE,GAAG,KAAK;GAAO,OAAO,OAAO;EAAM;EAClE,OAAO,KAAK,OAAO,KAAK;CAC1B;CAEA,MAAc,UAAU,KAA2B,KAAuD;EAExG,MAAM,SADS,IAAI,QAAQ,IAAI,eAAe,KAAK,GAAA,CAC9B,QAAQ,eAAe,EAAE;EAC9C,IAAI,MAAM,KAAK,aAAa,KAAK,GAAG,OAAO;EAC3C,IAAI,SAAS;EACb,IAAI,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAgB,SAAS;GAA+B;EAAE,CAAC;EAChG,OAAO;CACT;CAEA,SAAiB,SAAkB;EACjC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,EAAE,SAAS,OAAO,KAAK;CACrD;CAEA,UAAU,MAAc,MAAe;EACrC,MAAM,QAAQ,KAAK,UAAU;GAAE,MAAM;GAAS;GAAM;EAAK,CAAC;EAC1D,KAAK,MAAM,UAAU,KAAK,QAAQ,OAAO,GACvC,IAAI,OAAO,UAAU,OAAO,OAAO,eAAe,GAAG,OAAO,OAAO,KAAK,KAAK;CAEjF;CAEA,OAAe,QAAmB;EAChC,MAAM,SAAiB;GAAE,IAAI,SAAS;GAAG;GAAQ,QAAQ;GAAO,YAAY,KAAK,IAAI;GAAG,uBAAO,IAAI,IAAI;EAAE;EACzG,KAAK,QAAQ,IAAI,OAAO,IAAI,MAAM;EAClC,MAAM,QAAQ,SAAkB,OAAO,eAAe,KAAK,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC;EAC3F,MAAM,YAAY,iBAAiB;GACjC,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,MAAM,wBAAwB;EACjE,GAAG,GAAM;EAET,OAAO,GAAG,eAAe;GACvB,aAAa,SAAS;GACtB,KAAK,QAAQ,OAAO,OAAO,EAAE;GAC7B,KAAK,MAAM,QAAQ,OAAO,MAAM,OAAO,GAAG;IACxC,aAAa,KAAK,KAAK;IACvB,KAAK,OAAO,IAAI,YAAY,eAAe,8BAA8B,CAAC;GAC5E;EACF,CAAC;EAID,IAAI;EACJ,OAAO,GAAG,WAAW,OAAO,QAAQ;GAClC,IAAI;GACJ,IAAI;IACF,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC;GACrC,QAAQ;IACN;GACF;GACA,OAAO,aAAa,KAAK,IAAI;GAC7B,IAAI,CAAC,OAAO,QAAQ;IAClB,IAAI,QAAQ,SAAS,UAAU,CAAC,gBAAgB;KAC9C,iBAAiB,KAAK,aAAa,QAAQ,KAAK;KAChD,IAAI,MAAM,gBAAgB;MACxB,OAAO,SAAS;MAChB,OAAO,OAAO,QAAQ;MACtB,aAAa,SAAS;MACtB,KAAK;OAAE,MAAM;OAAS,QAAQ,OAAO;MAAG,CAAC;KAC3C,OACE,OAAO,MAAM,MAAM,mBAAmB;KAExC;IACF;IACA,IAAI,CAAC,gBAAgB;KACnB,OAAO,MAAM,MAAM,oBAAoB;KACvC;IACF;IACA,IAAI,CAAC,MAAM,gBAAgB;GAC7B;GACA,QAAQ,QAAQ,MAAhB;IACE,KAAK;KACH,OAAO,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO,KAAA;KAChE;IACF,KAAK,QAAQ;KACX,MAAM,SAAuB;MAAE,MAAM;MAAO,QAAQ,OAAO;KAAG;KAC9D,IAAI;MACF,MAAM,QAAQ,QAAQ,WAAW,eAAe;OAAE,MAAM,OAAO;OAAM,GAAG,QAAQ;MAAM,IAAI,QAAQ;MAClG,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;MACvF,KAAK;OAAE,MAAM;OAAU,IAAI,QAAQ;OAAI,IAAI;OAAM,QAAQ,UAAU;MAAK,CAAC;KAC3E,SAAS,OAAO;MACd,KAAK;OAAE,MAAM;OAAU,IAAI,QAAQ;OAAI,IAAI;OAAO,OAAO,eAAe,KAAK;MAAE,CAAC;KAClF;KACA;IACF;IACA,KAAK,iBAAiB;KACpB,MAAM,OAAO,OAAO,MAAM,IAAI,OAAO,QAAQ,EAAE,CAAC;KAChD,IAAI,CAAC,MAAM;KACX,OAAO,MAAM,OAAO,OAAO,QAAQ,EAAE,CAAC;KACtC,aAAa,KAAK,KAAK;KACvB,IAAI,QAAQ,IAAI,KAAK,QAAQ,QAAQ,UAAU,EAAE,IAAI,KAAK,CAAC;UACtD,KAAK,OAAO,IAAI,YAAY,UAAU,QAAQ,OAAO,WAAW,yCAAyC,CAAC;IACjH;GACF;EACF,CAAC;CACH;;CAGA,MAAc,MAAc,OAAgB,QAAsB;EAChE,IAAI,SAAS,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;EAC/D,IAAI,CAAC,QAAQ,QACX,SAAS,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,CAAC,CAAC,QAAQ,SAAS,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;EAEhH,IAAI,CAAC,QAAQ,OAAO,QAAQ,OAAO,IAAI,YAAY,eAAe,sBAAsB,CAAC;EACzF,MAAM,SAAS;EACf,MAAM,KAAK,SAAS;EACpB,OAAO,IAAI,SAAkB,SAAS,WAAW;GAC/C,MAAM,QAAQ,iBAAiB;IAC7B,OAAO,MAAM,OAAO,EAAE;IACtB,OAAO,IAAI,YAAY,eAAe,8BAA8B,CAAC;GACvE,GAAG,qBAAqB,SAAS,mBAAmB;GACpD,OAAO,MAAM,IAAI,IAAI;IAAE;IAAS;IAAQ;GAAM,CAAC;GAC/C,OAAO,OAAO,KAAK,KAAK,UAAU;IAAE,MAAM;IAAe;IAAI,QAAQ;IAAM;GAAM,CAAC,CAAC;EACrF,CAAC;CACH;CAEA,CAAS,gBAAgB;EACvB,MAAM,UAAU,KAAK,KAAK;EAE1B,MAAM,QAAQ,OAAO;GACnB,MAAM;GACN,aAAa;GACb,MAAM;GACN,QAAQ;GACR,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,gCAAgC,EAAE,CAAC;EAC9F,CAAC;EAED,MAAM,QAAQ,OAAO;GACnB,MAAM;GACN,aAAa;GACb,MAAM;GACN,QAAQ;GACR,OAAO,EAAE,OAAO;IACd,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,qBAAqB;IACjD,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sCAAsC;GAChF,CAAC;EACH,CAAC;EAED,MAAM,QAAQ,OAAO;GACnB,MAAM;GACN,aAAa;GACb,MAAM;GACN,QAAQ;GACR,OAAO,EAAE,OAAO;IACd,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;IACnC,SAAS,EAAE,MAAM,EAAE,OAAO;KACxB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KAC/B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;IAC5C,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;IAC5F,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oCAAoC;GAClF,CAAC;EACH,CAAC;EAED,MAAM,QAAQ,OAAO;GACnB,MAAM;GACN,aAAa;GACb,MAAM;GACN,OAAO,EAAE,OAAO,CAAC,CAAC;GAClB,gBAAgB;IACd,SAAS,KAAK,KAAK,OAAO;IAC1B,MAAM,QAAQ;IACd,UAAU,QAAQ;IAClB,QAAQ,KAAK,MAAM,QAAQ,OAAO,CAAC;GACrC;EACF,CAAC;EAED,MAAM,QAAQ,OAAO;GACnB,MAAM;GACN,aAAa;GACb,MAAM;GACN,OAAO,EAAE,OAAO;IACd,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS;IAClD,KAAK,EAAE,KAAK,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2FAA2F;GACvI,CAAC;GACD,UAAU,EAAE,OAAO,UAAU,KAAK,KAAK,OAAO,OAC3C,QAAQ,YAAY,CAAC,KAAK,SAAS,OAAO,MAAM,CAAC,OAAO,OAAO,QAAQ,IAAI,MAAM,IAAI,CAAC,CACtF,MAAM,EAAE,SAAS,IAAI,CAAC,CACtB,IAAI,SAAS;EAClB,CAAC;CACH;AACF;AAEA,eAAe,SAAS,KAAkC;CACxD,MAAM,OAAO,MAAM,IAAI,KAAK;CAC5B,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN,MAAM,IAAI,YAAY,iBAAiB,2BAA2B;CACpE;AACF"}

package/dist/static.js

@@ -0,0 +1,64 @@
+import { createRequire } from "node:module";
+import { dirname, extname, join, normalize, sep } from "node:path";
+import { readFile, stat } from "node:fs/promises";
+// src/static.ts
+const types = {
+	".html": "text/html; charset=utf-8",
+	".js": "text/javascript; charset=utf-8",
+	".mjs": "text/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".webp": "image/webp",
+	".ico": "image/x-icon",
+	".woff2": "font/woff2",
+	".woff": "font/woff",
+	".txt": "text/plain; charset=utf-8",
+	".map": "application/json"
+};
+function dashboardRoot() {
+	try {
+		const require = createRequire(import.meta.url);
+		return join(dirname(require.resolve("@mushinjs/dashboard/package.json")), "dist");
+	} catch {
+		return;
+	}
+}
+/** Resolves a request path to a file under `root`; unknown paths fall back to index.html for the SPA router. */
+async function readStatic(root, path) {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(path);
+	} catch {
+		return;
+	}
+	const relative = normalize(decoded).replace(/^([/\\])+/, "");
+	const file = join(root, relative);
+	if (file !== root && !file.startsWith(root + sep)) return;
+	try {
+		if ((await stat(file)).isFile()) return {
+			body: await readFile(file),
+			type: types[extname(file)] ?? "application/octet-stream",
+			immutable: relative.startsWith("assets" + sep) || relative.startsWith("assets/")
+		};
+	} catch {}
+	if (extname(relative)) return;
+	try {
+		return {
+			body: await readFile(join(root, "index.html")),
+			type: types[".html"],
+			immutable: false
+		};
+	} catch {}
+}
+const MISSING_BUILD_PAGE = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Mushin.js</title>
+<style>body{font-family:system-ui,sans-serif;max-width:560px;margin:80px auto;padding:0 16px;line-height:1.6;color:#222}code{background:#f2f2f2;padding:2px 6px;border-radius:4px}</style>
+</head><body><h1>Mushin.js is running</h1>
+<p>The dashboard has not been built yet. Run <code>pnpm build</code> in the Mushin.js folder, or start the dev server with <code>pnpm dev</code>.</p>
+</body></html>`;
+export { MISSING_BUILD_PAGE, dashboardRoot, readStatic };
+
+//# sourceMappingURL=static.js.map

package/dist/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","names":[],"sources":["../src/static.ts"],"sourcesContent":["import { readFile, stat } from 'node:fs/promises'\nimport { createRequire } from 'node:module'\nimport { dirname, extname, join, normalize, sep } from 'node:path'\n\nconst types: Record<string, string> = {\n  '.html': 'text/html; charset=utf-8',\n  '.js': 'text/javascript; charset=utf-8',\n  '.mjs': 'text/javascript; charset=utf-8',\n  '.css': 'text/css; charset=utf-8',\n  '.json': 'application/json',\n  '.svg': 'image/svg+xml',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.webp': 'image/webp',\n  '.ico': 'image/x-icon',\n  '.woff2': 'font/woff2',\n  '.woff': 'font/woff',\n  '.txt': 'text/plain; charset=utf-8',\n  '.map': 'application/json',\n}\n\nexport function dashboardRoot() {\n  try {\n    const require = createRequire(import.meta.url)\n    return join(dirname(require.resolve('@mushinjs/dashboard/package.json')), 'dist')\n  } catch {\n    return undefined\n  }\n}\n\nexport interface StaticFile {\n  body: Buffer\n  type: string\n  immutable: boolean\n}\n\n/** Resolves a request path to a file under `root`; unknown paths fall back to index.html for the SPA router. */\nexport async function readStatic(root: string, path: string): Promise<StaticFile | undefined> {\n  let decoded: string\n  try {\n    decoded = decodeURIComponent(path)\n  } catch {\n    return\n  }\n  const relative = normalize(decoded).replace(/^([/\\\\])+/, '')\n  const file = join(root, relative)\n  if (file !== root && !file.startsWith(root + sep)) return\n  try {\n    if ((await stat(file)).isFile()) {\n      return {\n        body: await readFile(file),\n        type: types[extname(file)] ?? 'application/octet-stream',\n        immutable: relative.startsWith('assets' + sep) || relative.startsWith('assets/'),\n      }\n    }\n  } catch {}\n  if (extname(relative)) return\n  try {\n    return { body: await readFile(join(root, 'index.html')), type: types['.html'], immutable: false }\n  } catch {}\n}\n\nexport const MISSING_BUILD_PAGE = `<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Mushin.js</title>\n<style>body{font-family:system-ui,sans-serif;max-width:560px;margin:80px auto;padding:0 16px;line-height:1.6;color:#222}code{background:#f2f2f2;padding:2px 6px;border-radius:4px}</style>\n</head><body><h1>Mushin.js is running</h1>\n<p>The dashboard has not been built yet. Run <code>pnpm build</code> in the Mushin.js folder, or start the dev server with <code>pnpm dev</code>.</p>\n</body></html>`\n"],"mappings":";;;;AAIA,MAAM,QAAgC;CACpC,SAAS;CACT,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,UAAU;CACV,SAAS;CACT,QAAQ;CACR,QAAQ;AACV;AAEA,SAAgB,gBAAgB;CAC9B,IAAI;EACF,MAAM,UAAU,cAAc,YAAY,GAAG;EAC7C,OAAO,KAAK,QAAQ,QAAQ,QAAQ,kCAAkC,CAAC,GAAG,MAAM;CAClF,QAAQ;EACN;CACF;AACF;;AASA,eAAsB,WAAW,MAAc,MAA+C;CAC5F,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,IAAI;CACnC,QAAQ;EACN;CACF;CACA,MAAM,WAAW,UAAU,OAAO,CAAC,CAAC,QAAQ,aAAa,EAAE;CAC3D,MAAM,OAAO,KAAK,MAAM,QAAQ;CAChC,IAAI,SAAS,QAAQ,CAAC,KAAK,WAAW,OAAO,GAAG,GAAG;CACnD,IAAI;EACF,KAAK,MAAM,KAAK,IAAI,EAAA,CAAG,OAAO,GAC5B,OAAO;GACL,MAAM,MAAM,SAAS,IAAI;GACzB,MAAM,MAAM,QAAQ,IAAI,MAAM;GAC9B,WAAW,SAAS,WAAW,WAAW,GAAG,KAAK,SAAS,WAAW,SAAS;EACjF;CAEJ,QAAQ,CAAC;CACT,IAAI,QAAQ,QAAQ,GAAG;CACvB,IAAI;EACF,OAAO;GAAE,MAAM,MAAM,SAAS,KAAK,MAAM,YAAY,CAAC;GAAG,MAAM,MAAM;GAAU,WAAW;EAAM;CAClG,QAAQ,CAAC;AACX;AAEA,MAAa,qBAAqB"}

package/package.json

@@ -1,6 +1,70 @@
 {
   "name": "@mushinjs/plugin-console",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0-next.20261113103537",
+  "description": "HTTP API, WebSocket and dashboard hosting",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mushinjs/mushin.git",
+    "directory": "packages/plugin-console"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mushin-plugin"
+  ],
+  "mushin": {
+    "kind": "app",
+    "essential": true,
+    "displayName": {
+      "en": "Console",
+      "zh-CN": "控制台"
+    },
+    "description": {
+      "en": "Serves the dashboard and its API",
+      "zh-CN": "提供控制台页面及其 API"
+    },
+    "provides": [
+      "console"
+    ],
+    "requires": {
+      "plugins": {
+        "@cordisjs/plugin-server": "*",
+        "@mushinjs/plugin-storage": "*"
+      }
+    },
+    "optional": {
+      "plugins": {
+        "@mushinjs/plugin-bots": "*",
+        "@mushinjs/plugin-agent": "*",
+        "@mushinjs/plugin-providers": "*",
+        "@mushinjs/plugin-flows": "*",
+        "@mushinjs/plugin-stats": "*"
+      }
+    }
+  },
+  "dependencies": {
+    "@mushinjs/core": "0.2.0-next.20261113103537",
+    "@mushinjs/plugin-storage": "0.2.0-next.20261113103537",
+    "@mushinjs/plugin-bots": "0.2.0-next.20261113103537",
+    "@mushinjs/plugin-agent": "0.2.0-next.20261113103537",
+    "@cordisjs/plugin-server": "1.7.0",
+    "ws": "^8.22.0",
+    "@mushinjs/dashboard": "0.2.0-next.20261113103537",
+    "@mushinjs/plugin-providers": "0.2.0-next.20261113103537",
+    "@mushinjs/plugin-flows": "0.2.0-next.20261113103537",
+    "@mushinjs/plugin-stats": "0.2.0-next.20261113103537"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.