@noob-stupid/dsh-plugin-console 0.3.21 → 0.3.24

package/lib/index.js

@@ -14,7 +14,7 @@
  */
 import { readFile, writeFile } from 'node:fs/promises'
 import { readFileSync, writeFileSync, existsSync, statSync, rmSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
-import { execFile } from 'node:child_process'
+import { execFile, spawn } from 'node:child_process'
 import { promisify } from 'node:util'
 import { dirname, join, basename } from 'node:path'
 import { tmpdir, homedir } from 'node:os'
@@ -236,6 +236,11 @@ async function readExtraBundleRows(profileDir) {
 
 /** 从加载器读取 webserver 监听端口（默认 3080）。 */
 function webPort(ctx) {
+  // 优先取运行时真实监听端口（自定义 --port / 系统分配端口也能正确校验 Host）
+  try {
+    const ws = ctx.webServer
+    if (ws && typeof ws.port === 'number' && ws.port > 0) return ws.port
+  } catch {}
   for (const entry of ctx.loader.entries()) {
     if (entry.options?.name === '@deepseek-ai/dsh-host-webserver') {
       const port = entry.options?.config?.port
@@ -1828,6 +1833,11 @@ async function ensureBundlePatchIntegrity(profileDir, pkgName, userPatchPath) {
  */
 const installJobs = new Map()
 let installJobSeq = 0
+/** AI 赋能任务注册表（规划/执行均常驻服务端，面板轮询进度）。 */
+const aiJobs = new Map()
+let aiJobSeq = 0
+/** 组件注册表（服务型组件：启动/停止/状态控制按钮的数据源）。 */
+const COMPONENTS_FILE = join(homedir(), '.dsh', 'plugin-console', 'components.json')
 /** 静态插件索引内存缓存（/market-index 用）。 */
 let marketIndexCache = null
 
@@ -2413,7 +2423,626 @@ async function aiRepair(job, ctx, profileDir, candidates, lastError) {
   }
 }
 
-/** 聚合包更新后的子包版本对齐：按新版聚合包声明的依赖版本，逐个对齐已存在的子包。 */
+// ============================================================
+// AI 赋能：文档驱动的通用组件部署（读文档 → 出计划 → 确认 → 执行 → 组件控制）
+// ============================================================
+
+/** AI 赋能计划/执行任务视图（content 一律剥离，防密钥经轮询泄露）。 */
+function aiJobView(job) {
+  return {
+    jobId: job.id,
+    source: job.source,
+    status: job.status,
+    stage: job.stage,
+    error: job.error ?? null,
+    type: job.plan?.type ?? null,
+    displayName: job.plan?.displayName ?? null,
+    summary: job.plan?.summary ?? null,
+    servers: (job.plan?.servers ?? []).map((s) => ({ name: s.name, healthUrl: s.healthUrl ?? null, port: s.port ?? null })),
+    steps: (job.plan?.steps ?? []).map((s, i) => ({
+      index: i,
+      action: s.action,
+      description: s.description ?? '',
+      path: typeof s.path === 'string' ? resolvePlaceholders(s.path, job) : null,
+      package: s.package ?? null,
+      url: typeof s.url === 'string' ? maskUrl(s.url) : null,
+      name: s.name ?? null,
+    })),
+    stepStates: job.stepStates ?? [],
+    progress: job.progress ?? { done: 0, total: (job.plan?.steps ?? []).length },
+    logText: (job.logText ?? '').slice(-6000),
+    createdAt: job.createdAt,
+    finishedAt: job.finishedAt ?? null,
+  }
+}
+
+function maskUrl(url) {
+  try {
+    const u = new URL(url)
+    if (u.password !== '') u.password = '***'
+    if (u.username !== '') u.username = '***'
+    if (u.search !== '') u.search = ''
+    return u.toString()
+  } catch {
+    return String(url).split(/[?#]/u)[0]
+  }
+}
+
+/** 占位符：${home} 家目录 / ${profile} DSH profile 目录 / ${python} Python 解释器 / ${scripts} Python Scripts / ${node} node 可执行 / ${deepseekKey} DSH 凭据中的 DeepSeek 密钥。 */
+let deepseekKeyCache = null
+function readDeepSeekKey() {
+  if (deepseekKeyCache !== null) return deepseekKeyCache
+  try {
+    const credFile = join(homedir(), '.dsh', '.credentials.yaml')
+    if (existsSync(credFile)) {
+      const m = /^\s*DEEPSEEK_API_KEY\s*:\s*(\S+)\s*$/mu.exec(readFileSync(credFile, 'utf8'))
+      if (m) {
+        deepseekKeyCache = m[1]
+        return deepseekKeyCache
+      }
+    }
+  } catch {}
+  deepseekKeyCache = ''
+  return deepseekKeyCache
+}
+
+/**
+ * AI 赋能模型配置（OpenViking VLM 用）：
+ * 1) 优先 ~/.dsh/plugin-console/ai-empower.json（独立区块，显式覆盖）
+ *    格式：{ "vlm": { "provider": "...", "api_base": "...", "model": "..." }, "api_key": "sk-..." }
+ *    api_key 缺省时继承 DSH 凭据；vlm 缺省时整体回退 DSH 当前设置。
+ * 2) 未配置区块 → 跟随 DSH：settings.yaml 的 agent-default-model + .credentials.yaml 的 DEEPSEEK_API_KEY。
+ */
+function readAiEmpowerConfig() {
+  try {
+    const cfgFile = join(homedir(), '.dsh', 'plugin-console', 'ai-empower.json')
+    if (existsSync(cfgFile)) return JSON.parse(readFileSync(cfgFile, 'utf8'))
+  } catch {}
+  return null
+}
+
+function resolveVlmForOpenViking() {
+  const custom = readAiEmpowerConfig()
+  let base = null
+  try {
+    const settings = readFileSync(join(homedir(), '.dsh', 'settings.yaml'), 'utf8')
+    const m = /agent-default-model:\s*[\s\S]*?provider:\s*(\S+)\s*\n\s*model:\s*(\S+)/u.exec(settings)
+    const p = m?.[1] ?? ''
+    if (p === 'deepseek-official' || p === 'deepseek') {
+      base = { provider: 'openai', api_base: 'https://api.deepseek.com', model: m[2] ?? 'deepseek-v4-flash-vision-exp' }
+    }
+  } catch {}
+  if (base === null) base = { provider: 'openai', api_base: 'https://api.deepseek.com', model: 'deepseek-v4-flash-vision-exp' }
+  const vlm = custom?.vlm ?? base
+  const apiKey = typeof custom?.api_key === 'string' && custom.api_key !== '' ? custom.api_key : readDeepSeekKey()
+  return { provider: vlm.provider ?? 'openai', api_base: vlm.api_base ?? 'https://api.deepseek.com', model: vlm.model ?? 'deepseek-v4-flash-vision-exp', api_key: apiKey }
+}
+
+function resolvePlaceholders(value, jobOrEnv) {
+  const env = jobOrEnv ?? {}
+  const profile = env.profileDir ?? ''
+  const python = resolvePythonPath()
+  const home = homedir()
+  return String(value)
+    .replaceAll('${home}', home)
+    .replaceAll('${profile}', profile)
+    .replaceAll('${python}', python)
+    .replaceAll('${scripts}', join(dirname(python), 'Scripts'))
+    .replaceAll('${node}', process.execPath)
+    .replaceAll('${deepseekKey}', readDeepSeekKey())
+}
+
+function resolvePythonPath() {
+  const candidates = [join('E:', 'python314', 'python.exe'), join(homedir(), 'AppData', 'Local', 'Programs', 'Python', 'Python314', 'python.exe'), 'python.exe']
+  for (const c of candidates) {
+    if (existsSync(c)) return c
+  }
+  return 'python.exe'
+}
+
+function findComponents() {
+  try {
+    const parsed = JSON.parse(readFileSync(COMPONENTS_FILE, 'utf8'))
+    return Array.isArray(parsed) ? parsed : (Array.isArray(parsed?.components) ? parsed.components : [])
+  } catch {
+    return []
+  }
+}
+
+function saveComponents(list) {
+  mkdirSync(dirname(COMPONENTS_FILE), { recursive: true })
+  writeFileSync(COMPONENTS_FILE, JSON.stringify(list, null, 2), 'utf8')
+}
+
+function compFind(id) {
+  return findComponents().find((c) => c.id === id) ?? null
+}
+
+/** 组件 UI 地址：显式 uiUrl 优先，否则从 healthUrl 去 /health 或按端口推断。 */
+function compUiUrl(c) {
+  if (typeof c?.uiUrl === 'string' && c.uiUrl !== '') return c.uiUrl
+  if (typeof c?.healthUrl === 'string' && c.healthUrl !== '') return String(c.healthUrl).replace(/\/health$/u, '')
+  if (c?.port) return `http://127.0.0.1:${c.port}/`
+  return null
+}
+
+function compUpsert(record) {
+  const list = findComponents()
+  const idx = list.findIndex((c) => c.id === record.id)
+  if (idx >= 0) list[idx] = { ...list[idx], ...record }
+  else list.push(record)
+  saveComponents(list)
+  return record.id
+}
+
+function compRemove(id) {
+  saveComponents(findComponents().filter((c) => c.id !== id))
+}
+
+/** 写入路径白名单：只允许 DSH profile、~/.dsh、~/.openviking、~/.cache/openviking、ASCII 数据根。 */
+function isAllowedWritePath(p, profileDir) {
+  const norm = (s) => s.replace(/[\\/]+/gu, '/').replace(/\/+$/u, '')
+  const target = norm(resolvePlaceholders(p, { profileDir }))
+  const roots = [
+    norm(homedir()) + '/.dsh',
+    norm(homedir()) + '/.openviking',
+    norm(homedir()) + '/.cache/openviking',
+    norm(homedir()) + '/.local/share/openviking',
+    norm(profileDir),
+    'D:/OpenVikingData',
+  ]
+  return roots.some((root) => target === root || target.startsWith(root + '/'))
+}
+
+/** run-cmd 可执行文件白名单（按 basename）。 */
+const ALLOWED_RUN_FILES = new Set(['curl.exe', 'curl', 'git.exe', 'git', 'node.exe', 'node', 'python.exe', 'python', 'py.exe', 'py', 'gh.exe', 'gh', 'npm.cmd', 'npm', 'ov.cmd', 'ov'])
+const DESTRUCTIVE_RE = /(^|\s)(rm\s+(-[a-zA-Z]*r)|rmdir\s+\/s|del\s+\/s|format\s+[a-zA-Z]:|Remove-Item\b|taskkill\s+\/im|reg\s+delete|schtasks\s+\/delete|shutdown|cipher\s+\/w)/iu
+
+function isSafeRunCmd(file, args) {
+  const base = basename(String(file)).toLowerCase()
+  if (!ALLOWED_RUN_FILES.has(base)) return false
+  const joined = [file, ...(args ?? [])].join(' ')
+  return !DESTRUCTIVE_RE.test(joined) && !/[&|;`$<>]/u.test(joined)
+}
+
+function jobLog(job, line) {
+  job.logText = `${job.logText ?? ''}${line}\n`
+}
+
+/** 已知组件内置模板：跳过 AI 调研，直接产出经过验证的部署计划（当前仅 OpenViking）。 */
+function builtinPlanFor(source) {
+  if (!/openviking/i.test(source)) return null
+  const home = homedir()
+  const storage = /^[\x00-\x7F]+$/u.test(home) ? `${home}/.openviking/data` : 'D:/OpenVikingData'
+  const vlm = resolveVlmForOpenViking()
+  // 注意：路径必须在此处（JSON.stringify 之前）使用真实值，由 stringify 统一转义；
+  // 不能在 content 中保留 ${home} 占位符——写文件时替换会把反斜杠路径变成非法 JSON 转义。
+  const ovConf = {
+    server: { host: '127.0.0.1', port: 1933, cors_origins: ['*'] },
+    vlm: { provider: vlm.provider, api_base: vlm.api_base, api_key: vlm.api_key, model: vlm.model },
+    embedding: { dense: { provider: 'local', model: 'bge-small-zh-v1.5-f16', model_path: join(home, '.cache', 'openviking', 'models', 'bge-small-zh-v1.5-f16.gguf') } },
+    storage: { workspace: storage },
+  }
+  const server = { name: 'openviking-server', file: '${python}', args: ['-m', 'openviking_cli.server_bootstrap'], cwd: '${home}/.openviking', healthUrl: 'http://127.0.0.1:1933/health', uiUrl: 'http://127.0.0.1:1933/studio', port: 1933 }
+  return {
+    type: 'service',
+    displayName: 'OpenViking（本地记忆服务器）',
+    summary: '安装 OpenViking 服务器（Python 3.14 + llama-cpp-python）、下载中文嵌入模型、写入 ov.conf（复用 DSH 的 DeepSeek 凭据、ASCII 存储路径）、启动并健康检查；完成后重启 DSH 会话即可出现 mcp__openviking__* 工具，pending 积压自动回放。',
+    servers: [server],
+    steps: [
+      { action: 'install-pip', package: 'openviking[local-embed]', description: '安装 OpenViking 服务器（含本地嵌入 llama-cpp-python）' },
+      { action: 'download', url: 'https://huggingface.co/CompendiumLabs/bge-small-zh-v1.5-gguf/resolve/main/bge-small-zh-v1.5-f16.gguf?download=true', path: '${home}/.cache/openviking/models/bge-small-zh-v1.5-f16.gguf', description: '下载中文本地嵌入模型 bge-small-zh-v1.5-f16（47MB，走 hf-mirror）' },
+      { action: 'write-file', path: '${home}/.openviking/ov.conf', content: JSON.stringify(ovConf, null, 2), description: '写入 ov.conf（DeepSeek VLM + 本地嵌入 + dev 免鉴权 + ASCII 存储路径）' },
+      { action: 'start-service', ...server, description: '启动 openviking-server（127.0.0.1:1933）' },
+      { action: 'wait-health', url: 'http://127.0.0.1:1933/health', timeoutMs: 90000, description: '等待健康检查通过' },
+    ],
+  }
+}
+
+/** AI 赋能预案：把已知环境事实与踩坑点固化为提示，避免子代理每次重新踩坑。 */
+function aiEmpowerPresetFor(source) {
+  const common = [
+    '## 本机环境事实（务必遵守）',
+    '- 网络：pypi.org 不通、清华镜像 403；pip 必须用 `--index-url https://mirrors.aliyun.com/pypi/simple/`。npm registry.npmjs.org 可能黑洞，pnpm 用 `--registry https://registry.npmmirror.com`。huggingface.co 被墙，模型文件一律用 `https://hf-mirror.com/<同一路径>`（执行器会自动把 huggingface.co 换成 hf-mirror.com，计划里也可直接写 hf-mirror）。',
+    '- 用户名含中文（花火）：任何写盘路径若含中文，各语言的 Rust/原生向量库会报 UnicodeDecodeError——服务数据目录必须纯 ASCII（如 `D:/OpenVikingData`）。',
+    '- 凭据复用：DSH 的 DeepSeek 密钥在 `${home}/.dsh/.credentials.yaml`（YAML 行 `DEEPSEEK_API_KEY: sk-...`）；模型选择在 `${home}/.dsh/settings.yaml` 的 `agent-default-model`（provider deepseek-official）。对外 OpenAI 兼容接口：api_base `https://api.deepseek.com`，模型名 `deepseek-v4-flash-vision-exp`。',
+    '- 步骤解释用中文；每个动作一个步骤；步骤数尽量少；不得包含任何破坏性命令；服务类组件必须配 start-service + wait-health。',
+  ]
+  if (/openviking/i.test(source)) {
+    return [
+      ...common,
+      '## OpenViking 已验证的部署事实（v0.4.17，Python 3.14）',
+      '- 安装：`pip install openviking[local-embed]`（含 llama-cpp-python 0.3.35，cp310-abi3 轮子可用；无需加 --force-reinstall）。',
+      '- 嵌入模型：`bge-small-zh-v1.5-f16.gguf`（47MB，512 维中文）下载到 `${home}/.cache/openviking/models/`（写 download 步骤；URL 写 huggingface.co 会被执行器自动换 hf-mirror.com）。',
+      '- ov.conf 路径 `${home}/.openviking/ov.conf`，内容：vlm = { provider: openai, api_base: https://api.deepseek.com, model: deepseek-v4-flash-vision-exp, api_key: 从 `${home}/.dsh/.credentials.yaml` 读取并内联 }；embedding.dense = { provider: local, model: bge-small-zh-v1.5-f16, model_path: <上面的 gguf 路径> }；server = { host: 127.0.0.1, port: 1933 }（不要写 root_api_key，dev 免鉴权模式自动启用）；storage.workspace = `${home}` 含非 ASCII 时写 `D:/OpenVikingData`，否则 `${home}/.openviking/data`。',
+      '- 启动：start-service，file=`${python}`，args=`["-m","openviking_cli.server_bootstrap"]`，cwd=`${home}/.openviking`，healthUrl=`http://127.0.0.1:1933/health`，port=1933。服务器启动首次会建 `D:/OpenVikingData` 数据目录。',
+      '- 部署完成后惯例：重启 DSH 会话后 mcp__openviking__* 工具出现，`${home}/.openviking/pending` 的积压消息会在新会话启动时自动回放——把这写进总结。',
+    ].join('\n')
+  }
+  return common.join('\n')
+}
+
+/** AI 赋能：规划阶段——子代理只读调研文档，产出结构化部署计划（JSON）。 */
+async function aiEmpowerPlan(job, ctx, profileDir) {
+  job.profileDir = profileDir
+  job.status = 'running'
+  job.stage = 'planning'
+  let subagents = null
+  try { subagents = ctx.get('subagents') } catch {}
+  const startFn = subagents?.start
+  if (typeof startFn !== 'function') {
+    job.status = 'failed'
+    job.error = 'AI 赋能需要 DSH 子代理服务（subagents），当前不可用'
+    job.finishedAt = Date.now()
+    return
+  }
+  let provider = 'spawn'
+  try {
+    const list = subagents.list?.() ?? []
+    if (!list.includes(provider)) provider = list[0]
+    if (provider === undefined) throw new Error('no provider')
+  } catch (error) {
+    job.status = 'failed'
+    job.error = `没有可用的子代理提供方：${String(error)}`
+    job.finishedAt = Date.now()
+    return
+  }
+  const prompt = [
+    '你是 DSH 插件控制台挂载的「AI 赋能」部署规划器。用户想把下面的组件完整部署到本机。',
+    `目标来源：${job.source}`,
+    '',
+    '【任务】只做只读调研与规划，禁止执行任何安装/写文件/启动服务/杀进程命令（curl 的 GET 抓取、gh api 查询、读取文件是允许的）。',
+    '调研材料：npm README / GitHub README / docs/ 目录 / package.json / install 说明。',
+    '全部调研完成后，输出且只输出一个 ```json ... ``` 代码块，内容为部署计划；代码块之外不要输出任何文字。',
+    '',
+    '计划 schema（严格遵循）',
+    '{',
+    '  "type": "pure-plugin" | "service" | "config-only",',
+    '  "displayName": "简短中文名",',
+    '  "summary": "一句话：这是什么、为何这样部署",',
+    '  "servers": [ { "name": "进程名", "file": "启动文件/命令", "args": ["参数..."], "cwd": "工作目录", "healthUrl": "http://127.0.0.1:端口/health", "port": 1933 } ],',
+    '  "steps": [ { "action": "...", "description": "中文说明", "...": "动作参数" } ]',
+    '}',
+    '',
+    '动作与参数（每个动作一个步骤，按依赖顺序）',
+    '- install-pip: {"package":"<包名[extras]>"}',
+    '- install-npm: {"package":"<npm 包名>","directory":"${profile}"}',
+    '- write-file: {"path":"<目标文件>","content":"<完整文件内容原文>"}',
+    '- download: {"url":"https://...","path":"<保存路径>"}',
+    '- run-cmd: {"file":"可执行文件","args":["..."]}（file 仅限 curl/git/node/python/py/gh/npm/ov）',
+    '- start-service: {"name":"<唯一名>","file":"...","args":["..."],"cwd":"...","healthUrl":"...","port":数字}',
+    '- wait-health: {"url":"http://127.0.0.1:端口/health","timeoutMs":60000}',
+    '',
+    '约束',
+    '- 占位符只能用 ${home} ${profile} ${python} ${scripts} ${node}；write-file 的 content 会被原样落盘',
+    '- 纯 npm 插件：type=pure-plugin，只写 install-npm 步骤，不要 servers',
+    '- 若用户提供的来源带 @tag（如 pkg@beta），install-npm 的 package 必须原样保留该 @tag，不得丢弃',
+    '- 危险命令（rm -rf、del /s、format、Remove-Item 等）出现在计划里会被拒绝执行',
+    '',
+    '## 调研纪律（必须遵守）',
+    '- 禁止递归扫描目录（Get-ChildItem -Recurse、find /、rg 全盘搜索）；只允许：读 ~/.openviking/、~/.dsh 顶层文件（.credentials.yaml、settings.yaml）、文档缓存目录，以及 curl 单次直连抓取',
+    '- 每条命令必须带超时：curl 用 --max-time 30；PowerShell 单命令控制在 15 秒内；抓取失败就跳过，不要反复重试同一 URL',
+    '- 总调研时间预算 8 分钟；剩余时间必须全部用于生成 JSON 计划，禁止重复验证已经确定的事实',
+    '',
+    aiEmpowerPresetFor(job.source),
+  ].join('\n')
+
+  try {
+    let parent = null
+    try {
+      const agents = ctx.get('agents')
+      const list = typeof agents?.roots === 'function' ? agents.roots() : (typeof agents?.list === 'function' ? agents.list() : [])
+      parent = list[0] ?? null
+    } catch {}
+    if (parent === null) {
+      job.status = 'failed'
+      job.error = 'AI 赋能无法借用活动会话（agents 注册表为空），请先开启一个会话再试'
+      job.finishedAt = Date.now()
+      return
+    }
+    const controller = new AbortController()
+    job.abort = controller
+    const run = await startFn.call(subagents, provider, {
+      label: `ai-empower-plan-${String(job.source).split('/')[0]?.slice(0, 20) ?? 'component'}`,
+      prompt: [{ type: 'text', text: prompt }],
+      maxDepth: 1,
+      signal: controller.signal,
+      parent,
+    })
+    let settleFn = null
+    try {
+      const requireLocal = createRequire(join(profileDir, 'package.json'))
+      ;({ settleRun: settleFn } = requireLocal('@deepseek-ai/dsh-subagent'))
+    } catch {}
+    const settle = settleFn ?? (async (runHandle) => {
+      try {
+        const result = await runHandle.result
+        return { status: result?.stopReason === 'completed' ? 'completed' : 'failed', detail: String(result?.stopReason ?? 'unknown') }
+      } catch (error) {
+        return { status: 'failed', detail: String(error) }
+      }
+    })
+    const outcome = await Promise.race([
+      settle(run),
+      new Promise((resolve) => setTimeout(() => {
+        controller.abort()
+        resolve({ status: 'failed', detail: 'AI 赋能规划超时（15 分钟）' })
+      }, 900000)),
+    ])
+    if (outcome.status === 'completed') {
+      const plan = parsePlanJson(String(outcome.output ?? outcome.detail ?? ''))
+      if (plan === null) {
+        job.status = 'failed'
+        job.error = '子代理完成调研但未产出可解析的部署计划 JSON，请重试或手动部署'
+      } else {
+        job.plan = plan
+        job.status = 'plan-ready'
+      }
+    } else {
+      job.status = 'failed'
+      job.error = `AI 赋能规划未成功（${outcome.detail ?? outcome.status}）`
+    }
+  } catch (error) {
+    job.status = 'failed'
+    job.error = `AI 赋能规划异常：${error instanceof Error ? error.message : String(error)}`
+  }
+  job.finishedAt = Date.now()
+}
+
+/** 从子代理输出中提取 ```json ... ``` 计划。 */
+function parsePlanJson(text) {
+  const m = /```json\s*([\s\S]*?)```/u.exec(text)
+  const raw = m ? m[1] : text
+  try {
+    const plan = JSON.parse(raw)
+    if (!plan || typeof plan !== 'object' || !Array.isArray(plan.steps)) return null
+    for (const s of plan.steps) {
+      if (typeof s.action !== 'string' || !['install-pip', 'install-npm', 'write-file', 'download', 'run-cmd', 'start-service', 'wait-health', 'register-component'].includes(s.action)) return null
+    }
+    return plan
+  } catch {
+    return null
+  }
+}
+
+/** AI 赋能：执行阶段——按用户勾选的步骤顺序执行，逐步回显日志。 */
+async function aiEmpowerExecute(job, ctx, profileDir, selected) {
+  job.status = 'running'
+  job.stage = 'executing'
+  job.stepStates = (job.plan?.steps ?? []).map((_, i) => ({ index: i, status: 'skipped' }))
+  if (job.abort) job.abort = null
+  const controller = new AbortController()
+  job.abort = controller
+  const steps = job.plan?.steps ?? []
+  const chosen = new Set((selected ?? steps.map((_, i) => i)).map((n) => Number(n)).filter((n) => Number.isInteger(n) && n >= 0 && n < steps.length))
+  const chosenList = steps.map((s, i) => ({ s, i })).filter((x) => chosen.has(x.i))
+  let done = 0
+  for (const { s, i } of chosenList) {
+    if (controller.signal.aborted) {
+      job.status = 'failed'
+      job.error = '已取消执行（用户中断）'
+      break
+    }
+    job.stepStates[i].status = 'running'
+    job.progress = { done, total: chosenList.length }
+    jobLog(job, `▶ 步骤 ${i + 1}/${steps.length} [${s.action}] ${s.description ?? ''}`)
+    try {
+      await runAiStep(job, s, ctx, profileDir, controller.signal)
+      job.stepStates[i].status = 'ok'
+      done += 1
+      jobLog(job, `✔ 步骤 ${i + 1} 完成`)
+    } catch (error) {
+      job.stepStates[i].status = 'fail'
+      job.status = 'failed'
+      job.error = `步骤 ${i + 1}（${s.action}）失败：${error instanceof Error ? error.message : String(error)}`
+      jobLog(job, `✘ 步骤 ${i + 1} 失败：${job.error}`)
+      break
+    }
+  }
+  if (job.status !== 'failed') {
+    job.status = 'done'
+    job.stage = 'done'
+  }
+  job.progress = { done, total: chosenList.length }
+  job.finishedAt = Date.now()
+  jobLog(job, job.status === 'done' ? '🎉 AI 赋能部署完成' : '⛔ AI 赋能部署中止')
+}
+
+/** 单步执行器：动作白名单 + 路径白名单 + 破坏性命令拦截。 */
+async function runAiStep(job, step, ctx, profileDir, signal) {
+  const profile = profileDir
+  switch (step.action) {
+    case 'install-pip': {
+      const pkg = String(step.package ?? '')
+      if (!/^[A-Za-z0-9_\-\.\[\]=\s]+$/u.test(pkg) || pkg === '') throw new Error(`包名不合法：${pkg}`)
+      const python = resolvePythonPath()
+      const params = ['-m', 'pip', 'install', pkg, '--index-url', 'https://mirrors.aliyun.com/pypi/simple/', '--disable-pip-version-check']
+      jobLog(job, `  运行: ${python} ${params.join(' ')}`)
+      await execFileAsync(python, params, { timeout: 900000, windowsHide: true, maxBuffer: 4 * 1024 * 1024, signal })
+      return
+    }
+    case 'install-npm': {
+      const pkg = String(step.package ?? '')
+      if (!/^(@[A-Za-z0-9_\-\.]+\/)?[A-Za-z0-9_\-\.]+(@[A-Za-z0-9_\-\.]+)?$/u.test(pkg)) throw new Error(`包名不合法：${pkg}`)
+      const dir = resolvePlaceholders(String(step.directory ?? profile), { profileDir: profile })
+      const corepackJs = join(dirname(process.execPath), 'node_modules', 'corepack', 'dist', 'corepack.js')
+      const params = [corepackJs, 'pnpm', 'add', pkg, '--dir', dir, '--registry', 'https://registry.npmmirror.com']
+      jobLog(job, `  运行: node ${params.join(' ')}`)
+      await execFileAsync(process.execPath, params, { timeout: 900000, windowsHide: true, maxBuffer: 4 * 1024 * 1024, signal })
+      return
+    }
+    case 'write-file': {
+      const target = resolvePlaceholders(String(step.path ?? ''), { profileDir: profile })
+      if (!isAllowedWritePath(target, profile)) throw new Error(`写入路径不在白名单内：${target}`)
+      mkdirSync(dirname(target), { recursive: true })
+      let content = resolvePlaceholders(String(step.content ?? ''), { profileDir: profile })
+      // JSON 内容防御：若计划生成方用了占位符导致非法转义（路径反斜杠未转义），在这里拦住并给出明确报错
+      const trimmed = content.trim()
+      if ((trimmed.startsWith('{') || trimmed.startsWith('[')) && content.length < 1024 * 1024) {
+        try {
+          JSON.parse(trimmed)
+        } catch {
+          throw new Error('write-file 的内容不是合法 JSON（占位符替换后可能残留未转义的反斜杠路径）：请让计划以 JSON.stringify 后的原文提供 content')
+        }
+      }
+      writeFileSync(target, content, 'utf8')
+      jobLog(job, `  已写入 ${target}（${content.length} 字节）`)
+      return
+    }
+    case 'download': {
+      const url = maskUrl(String(step.url ?? ''))
+      if (!/^https?:\/\//u.test(url)) throw new Error(`下载地址不合法：${url}`)
+      const target = resolvePlaceholders(String(step.path ?? ''), { profileDir: profile })
+      if (!isAllowedWritePath(target, profile)) throw new Error(`下载路径不在白名单内：${target}`)
+      mkdirSync(dirname(target), { recursive: true })
+      if (existsSync(target) && statSync(target).size > 1024 * 1024) {
+        jobLog(job, `  已存在，跳过下载：${target}（${statSync(target).size} 字节）`)
+        return
+      }
+      const realUrl = String(step.url).replaceAll('https://huggingface.co', 'https://hf-mirror.com')
+      jobLog(job, `  下载 ${maskUrl(realUrl)} → ${target}`)
+      await execFileAsync('curl.exe', ['-fSL', '-o', target, realUrl], { timeout: 900000, windowsHide: true, maxBuffer: 1024 * 1024, signal })
+      jobLog(job, `  下载完成（${statSync(target).size} 字节）`)
+      return
+    }
+    case 'run-cmd': {
+      const file = resolvePlaceholders(String(step.file ?? ''), { profileDir: profile })
+      const args = (step.args ?? []).map((a) => resolvePlaceholders(String(a), { profileDir: profile }))
+      if (!isSafeRunCmd(file, args)) throw new Error('run-cmd 未通过安全白名单校验（不允许的可执行文件或破坏性参数）')
+      jobLog(job, `  运行: ${[file, ...args].join(' ')}`)
+      const { stdout, stderr } = await execFileAsync(file, args, { timeout: 600000, windowsHide: true, maxBuffer: 4 * 1024 * 1024, signal })
+      jobLog(job, `  输出: ${String(stdout ?? '').slice(-1500)}${stderr ? `（stderr: ${String(stderr).slice(-500)}）` : ''}`)
+      return
+    }
+    case 'start-service': {
+      const name = String(step.name ?? 'service')
+      const file = resolvePlaceholders(String(step.file ?? ''), { profileDir: profile })
+      const args = (step.args ?? []).map((a) => resolvePlaceholders(String(a), { profileDir: profile }))
+      const cwd = resolvePlaceholders(String(step.cwd ?? homedir()), { profileDir: profile })
+      const healthUrl = typeof step.healthUrl === 'string' ? resolvePlaceholders(step.healthUrl, { profileDir: profile }) : null
+      const uiUrl = typeof step.uiUrl === 'string' ? resolvePlaceholders(step.uiUrl, { profileDir: profile }) : null
+      const port = Number(step.port ?? 0)
+      if (!isSafeRunCmd(file, args)) throw new Error('start-service 未通过安全白名单校验')
+      if (healthUrl !== null) {
+        try {
+          const probe = await fetch(healthUrl, { signal: AbortSignal.timeout(2500) })
+          if (probe.ok) {
+            const slugPre = name.toLowerCase().replace(/[^a-z0-9]+/gu, '-').replace(/^-|-$/gu, '')
+            compUpsert({ id: slugPre || `svc-${Date.now()}`, name, kind: 'server', pid: null, file, args, cwd, healthUrl, uiUrl, port, repo: job.source, installedAt: Date.now() })
+            jobLog(job, `  服务健康已就绪，跳过启动（复用现有进程）：${healthUrl}`)
+            return
+          }
+        } catch {}
+      }
+      const child = spawn(file, args, { detached: true, stdio: 'ignore', windowsHide: true, cwd, shell: false })
+      child.unref()
+      const pid = child.pid
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/gu, '-').replace(/^-|-$/gu, '')
+      const id = slug || `svc-${Date.now()}`
+      if (healthUrl) {
+        const alive = await waitHealth(healthUrl, 60000, job, signal).catch(() => false)
+        if (!alive) jobLog(job, `  ⚠ healthUrl ${healthUrl} 在 60s 内未就绪（进程 pid=${pid} 已启动，待手工排查）`)
+      }
+      compUpsert({ id, name, kind: 'server', pid, file, args, cwd, healthUrl, uiUrl, port, repo: job.source, installedAt: Date.now() })
+      jobLog(job, `  服务已启动：${name}（pid=${pid}${healthUrl ? `，healthUrl=${healthUrl}` : ''}）`)
+      return
+    }
+    case 'stop-service': {
+      const id = String(step.id ?? '')
+      const record = compFind(id)
+      if (!record || !record.pid) throw new Error(`组件不存在或未记录 pid：${id || '(空)'}`)
+      await execFileAsync('taskkill.exe', ['/PID', String(record.pid), '/F'], { timeout: 30000, windowsHide: true })
+      compUpsert({ id, pid: null })
+      jobLog(job, `  服务已停止：${record.name}`)
+      return
+    }
+    case 'wait-health': {
+      const url = resolvePlaceholders(String(step.url ?? ''), { profileDir: profile })
+      const timeoutMs = Number(step.timeoutMs ?? 60000)
+      const ok = await waitHealth(url, timeoutMs, job, signal)
+      if (!ok) throw new Error(`健康检查未通过：${url}（${timeoutMs}ms）`)
+      return
+    }
+    case 'register-component': {
+      const id = String(step.id ?? '')
+      if (!id) throw new Error('register-component 缺少 id')
+      compUpsert({ id, name: String(step.name ?? id), kind: String(step.kind ?? 'server'), pid: null, file: step.file ? resolvePlaceholders(String(step.file), { profileDir: profile }) : undefined, args: (step.args ?? []).map((a) => resolvePlaceholders(String(a), { profileDir: profile })), healthUrl: step.healthUrl ? resolvePlaceholders(String(step.healthUrl), { profileDir: profile }) : undefined, uiUrl: step.uiUrl ? resolvePlaceholders(String(step.uiUrl), { profileDir: profile }) : undefined, port: Number(step.port ?? 0), repo: job.source, installedAt: Date.now() })
+      return
+    }
+    default:
+      throw new Error(`未知动作：${step.action}`)
+  }
+}
+
+async function waitHealth(url, timeoutMs, job, signal) {
+  const deadline = Date.now() + timeoutMs
+  let last = ''
+  while (Date.now() < deadline) {
+    if (signal?.aborted) return false
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3000) })
+      if (res.ok) return true
+      last = `HTTP ${res.status}`
+    } catch (error) {
+      last = error instanceof Error ? error.message : String(error)
+    }
+    jobLog(job, `  ⏳ 健康检查 ${url} … ${last}`)
+    await new Promise((r) => setTimeout(r, 2000))
+  }
+  jobLog(job, `  ✘ 健康检查超时：${url}（最后状态 ${last}）`)
+  return false
+}
+
+/** 组件控制：启动。 */
+async function compStart(id) {
+  const record = compFind(id)
+  if (!record) throw new Error('组件不存在')
+  if (record.pid && processAlive(record.pid)) return { started: false, note: '已在运行' }
+  if (!record.file || !Array.isArray(record.args)) throw new Error('该组件没有记录启动命令')
+  const child = spawn(record.file, record.args, { detached: true, stdio: 'ignore', windowsHide: true, cwd: record.cwd ?? homedir(), shell: false })
+  child.unref()
+  compUpsert({ id, pid: child.pid })
+  return { started: true, pid: child.pid }
+}
+
+/** 组件控制：停止。 */
+async function compStop(id) {
+  const record = compFind(id)
+  if (!record) throw new Error('组件不存在')
+  if (record.pid) {
+    try {
+      await execFileAsync('taskkill.exe', ['/PID', String(record.pid), '/F'], { timeout: 30000, windowsHide: true })
+    } catch {}
+  }
+  compUpsert({ id, pid: null })
+  return { stopped: true }
+}
+
+/** 组件控制：状态（进程存活 + 健康探测；无 pid 但健康通过按运行中处理）。 */
+async function compStatus(id) {
+  const record = compFind(id)
+  if (!record) throw new Error('组件不存在')
+  let healthy = null
+  if (record.healthUrl) {
+    try {
+      const res = await fetch(record.healthUrl, { signal: AbortSignal.timeout(2500) })
+      healthy = res.ok
+    } catch {
+      healthy = false
+    }
+  }
+  const running = Boolean(record.pid && processAlive(record.pid)) || healthy === true
+  return { id, name: record.name, running, healthy, pid: record.pid ?? null, port: record.port ?? null }
+}
+
+function processAlive(pid) {
+  try {
+    process.kill(Number(pid), 0)
+    return true
+  } catch {
+    return false
+  }
+}
 async function syncAggregateSubpackageVersions(profileDir, packageName, registries) {
   const pkgPath = join(profileDir, 'node_modules', packageName, 'package.json')
   if (!existsSync(pkgPath)) return []
@@ -2797,11 +3426,10 @@ async function handle(ctx, req, res) {
     try { framework = detectFrameworkUpgrade(ctx) } catch {}
     let selfVersion = null
     try {
-      const selfRequire = createRequire(import.meta.url)
-      const selfPkg = JSON.parse(readFileSync(selfRequire.resolve('../package.json'), 'utf8'))
+      const selfPkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, selfVersion })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c) })) })
     return
   }
 
@@ -2930,8 +3558,22 @@ async function handle(ctx, req, res) {
   }
 
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/skills-installed`) {
-    // 已安装技能清单（~/.dsh/skills 用户根），前端用于标记「已安装」与展示
-    sendJson(res, 200, { ok: true, skills: listInstalledSkills() })
+    // 已安装技能清单（~/.dsh/skills 用户根）+ 插件自带技能（ctx.skills 聚合，只读展示）
+    const skills = listInstalledSkills()
+    let pluginSkills = []
+    try {
+      const skillsSvc = ctx.get('skills')
+      const extra = await Promise.race([
+        (async () => (typeof skillsSvc?.list === 'function' ? await skillsSvc.list({}) : []))(),
+        new Promise((resolve) => setTimeout(() => resolve([]), 1500)),
+      ])
+      for (const s of extra ?? []) {
+        if (s && typeof s.name === 'string' && !skills.some((x) => x.name === s.name)) {
+          pluginSkills.push({ name: s.name, description: s.description ?? null, provider: s.provider ?? null, system: true })
+        }
+      }
+    } catch {}
+    sendJson(res, 200, { ok: true, skills, pluginSkills })
     return
   }
 
@@ -3476,6 +4118,7 @@ async function handle(ctx, req, res) {
     }
     let latest = null
     let next = null
+    let beta = null
     let depsOutdated = []
     let error = null
     let source = 'npm'
@@ -3486,6 +4129,7 @@ async function handle(ctx, req, res) {
       const data = await fetchJsonUrl(`https://registry.npmmirror.com/${encoded}`)
       latest = data?.['dist-tags']?.latest ?? null
       next = data?.['dist-tags']?.next ?? null
+      beta = data?.['dist-tags']?.beta ?? null
       if (latest === null) throw new Error(`registry 无 dist-tags.latest（${packageName}）`)
       // 子包配套检查：最新版声明依赖 vs 本地实际版本
       const patchPath = findPatchPath(ctx)
@@ -3563,7 +4207,7 @@ async function handle(ctx, req, res) {
         error = `npm registry 查询失败且 GitHub 回退不可用（${fallbackError}；${fbErr instanceof Error ? fbErr.message : String(fbErr)}）`
       }
     }
-    sendJson(res, 200, { ok: true, packageName, latest, next, depsOutdated, error, source })
+    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source })
     return
   }
 
@@ -4204,6 +4848,141 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/ai-empower/plan`) {
+    const source = typeof body.source === 'string' ? body.source.trim() : ''
+    if (source === '' || source.length > 200) {
+      sendError(res, 400, '请提供要部署的组件来源（npm 包名或 GitHub 仓库）')
+      return
+    }
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    const jobId = `ai-${Date.now()}-${++aiJobSeq}`
+    const job = { id: jobId, source, status: 'running', stage: 'planning', createdAt: Date.now(), logText: '', stepStates: [] }
+    aiJobs.set(jobId, job)
+    const builtin = builtinPlanFor(source)
+    if (builtin !== null) {
+      job.plan = builtin
+      job.status = 'plan-ready'
+      job.stage = 'builtin'
+      job.finishedAt = Date.now()
+      sendJson(res, 200, { ok: true, jobId })
+      return
+    }
+    aiEmpowerPlan(job, ctx, profileDir).catch((error) => {
+      job.status = 'failed'
+      job.error = `规划任务异常：${error instanceof Error ? error.message : String(error)}`
+      job.finishedAt = Date.now()
+    })
+    sendJson(res, 200, { ok: true, jobId })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/ai-empower/status`) {
+    const jobId = typeof body.jobId === 'string' ? body.jobId : ''
+    const job = aiJobs.get(jobId)
+    if (!job) {
+      sendError(res, 404, '没有这个 AI 赋能任务')
+      return
+    }
+    sendJson(res, 200, { ok: true, ...aiJobView(job) })
+    return
+  }
+  if (pathname === `${ROUTE_PREFIX}/ai-empower/run`) {
+    const jobId = typeof body.jobId === 'string' ? body.jobId : ''
+    const selected = Array.isArray(body.steps) ? body.steps : null
+    const job = aiJobs.get(jobId)
+    if (!job) {
+      sendError(res, 404, '没有这个 AI 赋能任务')
+      return
+    }
+    if (job.status !== 'plan-ready') {
+      sendError(res, 400, '任务状态不是 plan-ready，无法执行')
+      return
+    }
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    aiEmpowerExecute(job, ctx, profileDir, selected).catch((error) => {
+      job.status = 'failed'
+      job.error = `执行任务异常：${error instanceof Error ? error.message : String(error)}`
+      job.finishedAt = Date.now()
+    })
+    sendJson(res, 200, { ok: true, jobId })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/ai-empower/cancel`) {
+    const jobId = typeof body.jobId === 'string' ? body.jobId : ''
+    const job = aiJobs.get(jobId)
+    if (!job) {
+      sendError(res, 404, '没有这个 AI 赋能任务')
+      return
+    }
+    try { job.abort?.abort() } catch {}
+    if (job.status === 'running' && job.stage === 'executing') {
+      job.status = 'failed'
+      job.error = '已取消执行（用户中断）'
+      job.finishedAt = Date.now()
+    }
+    sendJson(res, 200, { ok: true, jobId })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/components`) {
+    const list = findComponents()
+    const enriched = []
+    for (const c of list) {
+      try {
+        enriched.push(await compStatus(c.id))
+      } catch {
+        enriched.push({ id: c.id, name: c.name, running: false, healthy: null, pid: null, port: c.port ?? null })
+      }
+    }
+    sendJson(res, 200, { ok: true, components: enriched.map((x) => ({ ...x, uiUrl: compUiUrl(compFind(x.id) ?? {}) })) })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/component/start`) {
+    const id = typeof body.id === 'string' ? body.id : ''
+    if (id === '') {
+      sendError(res, 400, '缺少组件 id')
+      return
+    }
+    try {
+      sendJson(res, 200, { ok: true, ...(await compStart(id)) })
+    } catch (error) {
+      sendError(res, 500, error instanceof Error ? error.message : String(error))
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/component/stop`) {
+    const id = typeof body.id === 'string' ? body.id : ''
+    if (id === '') {
+      sendError(res, 400, '缺少组件 id')
+      return
+    }
+    try {
+      sendJson(res, 200, { ok: true, ...(await compStop(id)) })
+    } catch (error) {
+      sendError(res, 500, error instanceof Error ? error.message : String(error))
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/component/status`) {
+    const id = typeof body.id === 'string' ? body.id : ''
+    if (id === '') {
+      sendError(res, 400, '缺少组件 id')
+      return
+    }
+    try {
+      sendJson(res, 200, { ok: true, ...(await compStatus(id)) })
+    } catch (error) {
+      sendError(res, 500, error instanceof Error ? error.message : String(error))
+    }
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/restart`) {
     // 自带守护的自杀式重启：分离脚本杀掉本进程后，若端口无人监听则自动拉起服务。
     // 不再依赖桌面端监督器（它并不总是会重启服务，曾导致用户需要重启电脑）。