@sanqianx/ai-coding-event-bridge-console 0.6.0 → 0.7.0

package/README.md

@@ -48,6 +48,15 @@ otherwise.
 | `GET /api/turns?project&date&cursor&limit` | Merged turns + `annotations` (commit shas per turn) |
 | `GET /api/sessions?project=` | Session index |
 | `GET /api/search?q&project&limit` | Substring search over conversation bodies |
+| `GET /api/journals` | Global and registered project journal identities |
+| `POST /api/internal/workbench-event` | Private native Workbench capture; runtime token, loopback, no browser Origin |
+
+The private capture route uses `KB_EVENT_BRIDGE_RUNTIME_TOKEN`. It resolves the
+Git identity and requires an already registered code directory. Stable event
+keys deduplicate retries; only original prompts, successful final answers and
+turn endings enter the same bridge journal used by hooks. Credentials and
+injected knowledge are not accepted as event metadata. Shell proxies must not
+expose this route to browser callers.
 
 Turn merging: for a registered project, the project journal and the global
 journal (legacy pre-import events) are both read, filtered by repo identity,
@@ -57,7 +66,9 @@ one journal's sequence space; `openTurnIdsAtCommit` binding works across both.
 ## Notes
 
 - Node >= 18, CommonJS, zero runtime dependencies beyond the core package.
-- The console never writes journals; it only reads them and mutates
-  `projects.json` on import/unregister.
-- Consumer-cursor compaction applies to the global journal only — project
-  journals are archival stores and are not auto-compacted.
+- Public query APIs read journals; project import/unregister changes registration.
+  The authenticated Workbench endpoint delegates capture to the core bridge,
+  not a second conversation database.
+- Consumer cursors and ACKs are journal-specific. Compaction may retire sealed
+  evidence only after every applicable consumer has acknowledged that journal;
+  creating a commit archive is not proof that the engine consumed it.

package/console/index.html

@@ -185,6 +185,10 @@
   .btn-upg { height: 26px; padding: 0 12px; border-radius: 7px; background: var(--text); color: #16171a; font-size: 12px; font-weight: 600; flex-shrink: 0; }
   .btn-upg:hover { background: #fff; }
   .btn-upg:disabled { opacity: .45; cursor: not-allowed; }
+  body.kb-embedded[data-kb-theme="light"] { --bg-side:#f8f9fb; --bg-main:#fff; --bg-card:#f8f9fb; --bg-input:#edf1f4; --bg-hover:#edf1f4; --bg-active:#e6edf3; --line:#dce2e8; --line-soft:#dce2e8; --text:#202733; --text-2:#687587; --text-3:#8e99a7; --label:#687587; --blue:#516f89; --green:#397761; --red:#a05252; color-scheme:light; }
+  body.kb-embedded[data-kb-theme="dark"] { --bg-side:#1b2028; --bg-main:#20252d; --bg-card:#252b34; --bg-input:#2c333e; --bg-hover:#2c333e; --bg-active:#293748; --line:#39424f; --line-soft:#39424f; --text:#e6ebf0; --text-2:#a0aaba; --text-3:#788393; --label:#a0aaba; --blue:#8aa8cf; --green:#81b29a; --red:#d88b8b; color-scheme:dark; }
+  body.kb-embedded .topbar h1 { display:none; }
+  body.kb-embedded .topbar { padding:8px 24px; }
 </style>
 </head>
 <body>
@@ -226,7 +230,7 @@
         <span class="svg-i" data-i="gear"></span>
       </button>
       <div class="hist-wrap">
-        <button class="hist-btn" id="hist-btn">🕘 历史</button>
+        <button class="hist-btn" id="hist-btn">历史</button>
         <div class="hist-pop" id="hist-pop">
           <div class="ph">历史对话</div>
           <div id="hist-list"></div>
@@ -333,8 +337,14 @@ function toast(ok, text) {
   }, 3200);
 }
 
+var embedQuery = new URLSearchParams(location.search);
+var embedded = embedQuery.get('embed') === '1';
+var moduleApiBase = /^\/api\/[a-z0-9/-]+$/i.test(embedQuery.get('apiBase') || '') ? embedQuery.get('apiBase').replace(/\/$/, '') : '/api';
+var projectEpoch = 0;
+var selectionEpoch = 0;
+var embedVisible = true;
 function api(path, options) {
-  return fetch(path, options).then(function (res) {
+  return fetch(path.replace(/^\/api(?=\/|$)/, moduleApiBase), options).then(function (res) {
     return res.text().then(function (body) {
       var payload = null;
       try { payload = body ? JSON.parse(body) : null; } catch (_) { payload = null; }
@@ -376,7 +386,7 @@ function timeOf(iso) {
   return String(d.getHours()).padStart(2, '0') + ':' + String(d.getMinutes()).padStart(2, '0');
 }
 
-var SOURCE_LABELS = { 'claude-code': 'Claude', claude: 'Claude', codex: 'Codex', opencode: 'OpenCode' };
+var SOURCE_LABELS = { 'claude-code': 'Claude', claude: 'Claude', codex: 'Codex', opencode: 'OpenCode', zcode: 'ZCode' };
 
 /* ---------- 状态 ---------- */
 
@@ -490,6 +500,7 @@ function loadMoreTurns() {
 
 function fetchTurns(options) {
   if (!state.project) return Promise.resolve();
+  var epoch = projectEpoch;
   var append = options && options.append;
   state.loadingTurns = true;
   if (!append) { state.turns = []; state.cursor = null; }
@@ -498,13 +509,14 @@ function fetchTurns(options) {
     + '&order=desc'
     + (state.cursor ? '&cursor=' + encodeURIComponent(state.cursor) : '');
   return api(query).then(function (payload) {
-    if (!state.project || payload.project !== state.project.id) return; // 切换已发生，丢弃过期响应
+    if (epoch !== projectEpoch || !state.project || payload.project !== state.project.id) return;
     state.turns = state.turns.concat(payload.turns || []);
     state.cursor = payload.nextCursor || null;
     state.totalTurns = payload.totalTurns || state.turns.length;
     state.loadingTurns = false;
     renderLive();
   }).catch(function (err) {
+    if (epoch !== projectEpoch) return;
     state.loadingTurns = false;
     renderLive();
     toast(false, '加载对话失败：' + err.message);
@@ -514,6 +526,7 @@ function fetchTurns(options) {
 function selectProject(id, options) {
   var project = state.projects.find(function (p) { return p.id === id; });
   if (!project) return;
+  projectEpoch++;
   state.project = project;
   state.turns = [];
   state.cursor = null;
@@ -688,13 +701,14 @@ document.getElementById('hist-list').addEventListener('click', function (ev) {
   document.getElementById('back-btn').classList.add('show');
   showDocLoading(true);
   // 懒加载：此刻才请求这一份文档，其余历史永不加载
-  fetch('/api/commits/' + encodeURIComponent(file) + '?project=' + encodeURIComponent(state.project.id))
+  var epoch = projectEpoch;
+  fetch(moduleApiBase + '/commits/' + encodeURIComponent(file) + '?project=' + encodeURIComponent(state.project.id))
     .then(function (res) {
       if (!res.ok) throw new Error('HTTP ' + res.status);
       return res.text();
     })
     .then(function (text) {
-      if (state.currentDocFile !== file) return; // 已切换到别的文档/项目
+      if (epoch !== projectEpoch || state.currentDocFile !== file) return;
       var parsed = parseSealedDoc(text);
       var title = doc.subject || parsed.fm.subject || (parsed.fm.commitSha || file).slice(0, 12);
       var subParts = [];
@@ -901,20 +915,32 @@ setInterval(loadHealth, 30000);
  * URL 参数：?embed=1 进入嵌入态（默认折叠，sidebar=1 保持展开）。
  * 就绪后回发 {type:'kb:ready', app:'event-bridge'}；独立打开时不受控、侧栏恒显。 */
 function embedAllowedOrigin(origin) {
-  if (origin === 'null') return true; // file:// 壳
-  try { const u = new URL(origin); return u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]'; }
+  try { return origin === (document.referrer ? new URL(document.referrer).origin : location.origin); }
   catch { return false; }
 }
 function setEmbedSideVisible(visible) { document.body.classList.toggle('embed-collapse', !visible); }
-window.addEventListener('message', function (ev) {
-  if (!embedAllowedOrigin(ev.origin)) return;
+window.addEventListener('message', async function (ev) {
+  if (ev.source !== window.parent || !embedAllowedOrigin(ev.origin)) return;
   const d = ev.data;
   if (!d || typeof d !== 'object') return;
+  if (d.type === 'kb:theme') { document.body.dataset.kbTheme = d.theme === 'dark' ? 'dark' : 'light'; return; }
+  if (d.type === 'kb:visibility') { embedVisible = d.visible === true; return; }
+  if (d.type === 'kb:refresh' && embedVisible && state.project) { fetchTurns(); refreshHist(); return; }
+  if (d.type === 'kb:select-project') {
+    var requestEpoch = ++selectionEpoch;
+    var find = function () { return state.projects.find(function (p) { return p.id === d.project || p.path === d.project; }); };
+    if (!find()) await loadProjects();
+    if (requestEpoch !== selectionEpoch) return;
+    var p = find();
+    if (p) selectProject(p.id);
+    ev.source.postMessage({ type: 'kb:projects', app: 'event-bridge', ok: !!p, projectId: p && p.id, requestId: d.requestId }, ev.origin);
+    return;
+  }
   if (d.type === 'kb:sidebar') setEmbedSideVisible(!!d.visible);
 });
 (function () {
   const q = new URLSearchParams(location.search);
-  if (q.get('embed') === '1') setEmbedSideVisible(q.get('sidebar') !== '1');
+  if (q.get('embed') === '1') { document.body.classList.add('kb-embedded'); document.body.dataset.kbTheme = q.get('theme') === 'dark' ? 'dark' : 'light'; setEmbedSideVisible(q.get('sidebar') === '1'); }
   if (window.parent !== window) window.parent.postMessage({ type: 'kb:ready', app: 'event-bridge' }, '*');
 })();
 </script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanqianx/ai-coding-event-bridge-console",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Durable AI coding event bridge, all in one: capture connectors and installers (Claude Code, Codex, OpenCode, ZCode), journal with commit boundaries and per-commit conversation sealing, headless query, and a local conversation explorer console.",
   "license": "MIT",
   "private": false,

package/src/bin.js

@@ -52,8 +52,12 @@ async function main(argv = process.argv.slice(2)) {
   const home = bridgeHome(get('home'));
   const port = Number(get('port') || 8790);
   const host = get('host') || '127.0.0.1';
-  const server = http.createServer(createConsoleServer({ home }));
+  const server = http.createServer(createConsoleServer({ home, runtimeToken: process.env.KB_EVENT_BRIDGE_RUNTIME_TOKEN }));
   await new Promise((resolve) => server.listen(port, host, resolve));
+  let stopping = false;
+  const stop = () => { if (stopping) return; stopping = true; server.closeAllConnections?.(); server.close(() => process.exit(0)); };
+  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, stop);
+  process.on('message', message => { if (message?.type === 'kb:shutdown') stop(); });
   console.log(`ai-coding-event-bridge console serving on http://${host}:${port}`);
   console.log(`  home: ${home}`);
   console.log(`  import projects from the sidebar; conversations of imported`);

package/src/bridge/core/bridge.js

@@ -9,6 +9,9 @@ const { compactJournal } = require('./compaction');
 const { journalFor, globalJournalDir } = require('./journal-router');
 const projectRegistry = require('./project-registry');
 const { sealCommitConversations, sealDirFor } = require('./commit-projection');
+const { resolveRepoContext } = require('./repo-context');
+const { validateAndNormalizeEvent } = require('./event-schema');
+const { notifyConsumers } = require('../connectors/claude-code/notify');
 
 /**
  * Stable host-facing facade over the Bridge runtime. Hosts (Project-Knowledge,
@@ -32,18 +35,28 @@ function createBridge({ homeDir } = {}) {
   // Pure reads on a machine where no Bridge home exists yet must not
   // materialize one: status queries stay side-effect free.
   const homeExists = () => fs.existsSync(home);
+  const selectJournal = (journalId = 'global') => {
+    if (journalId === 'global') return getJournal();
+    const project = projectRegistry.listProjects(home).find(p => p.id === journalId);
+    if (!project) throw Object.assign(new Error('journal is not registered'), { code: 'JOURNAL_NOT_FOUND' });
+    return journalFor(home, project.id);
+  };
 
   return {
     homeDir: home,
 
-    async getHighWatermark() {
+    async listJournals() {
+      return [{ journalId: 'global', projectId: null }, ...projectRegistry.listProjects(home).map(p => ({ journalId: p.id, projectId: p.id, repoPath: p.path }))];
+    },
+
+    async getHighWatermark({ journalId = 'global' } = {}) {
       if (!homeExists()) return 0;
-      const bounds = await getJournal().getBounds();
+      const bounds = await selectJournal(journalId).getBounds();
       return bounds.lastSequence;
     },
 
     async readEvents(options = {}) {
-      return getJournal().readEvents(options);
+      return selectJournal(options.journalId).readEvents(options);
     },
 
     // Host-side injection for tests and explicit workflows; automatic capture
@@ -52,6 +65,30 @@ function createBridge({ homeDir } = {}) {
       return getJournal().appendConversationEvent(event);
     },
 
+    async captureWorkbenchEvent(input) {
+      if (!['user_prompt', 'assistant_response', 'session_end'].includes(input?.eventType)
+        || typeof input.projectPath !== 'string' || !path.isAbsolute(input.projectPath)
+        || typeof input.eventKey !== 'string' || !input.eventKey.startsWith('workbench:')
+        || !input.sessionId || !input.turnId || input.content && (typeof input.content !== 'string' || input.content.length > 200000)) {
+        throw Object.assign(new Error('Invalid native workbench event'), { code: 'CAPTURE_INVALID' });
+      }
+      const repo = await resolveRepoContext(input.projectPath);
+      const project = projectRegistry.findProject(home, repo.repoIdentity);
+      if (!project || fs.realpathSync(project.path) !== fs.realpathSync(input.projectPath)) {
+        throw Object.assign(new Error('Workbench project is not registered'), { code: 'PROJECT_NOT_REGISTERED' });
+      }
+      const event = validateAndNormalizeEvent({
+        source: input.source, eventType: input.eventType, role: input.eventType === 'user_prompt' ? 'user' : input.eventType === 'assistant_response' ? 'assistant' : null,
+        content: input.eventType === 'session_end' ? undefined : input.content, sessionId: input.sessionId, turnId: input.turnId, eventKey: input.eventKey,
+        repoIdentity: repo.repoIdentity, projectPath: repo.projectPath, branch: repo.branch, headAtCapture: repo.headAtCapture,
+        capturedAt: typeof input.capturedAt === 'string' && !Number.isNaN(Date.parse(input.capturedAt)) ? input.capturedAt : new Date().toISOString(),
+        identityConfidence: 'exact', captureStatus: 'complete', meta: { origin: 'claude-ai-workbench', outcome: input.outcome === 'failed' ? 'failed' : 'completed' },
+      });
+      const appended = await journalFor(home, repo.repoIdentity).appendConversationEvent(event);
+      await notifyConsumers(home, { sequence: appended.sequence, eventId: appended.eventId });
+      return { status: 'captured', ...appended };
+    },
+
     async appendCommitBoundary({ projectId, repoIdentity, commitSha, parentShas, parents, branch, subject, committedAt, operationId, meta } = {}) {
       if (!repoIdentity) {
         throw new Error('appendCommitBoundary requires repoIdentity');
@@ -105,7 +142,8 @@ function createBridge({ homeDir } = {}) {
             // exists on disk, drop the sealed prefix. On any miss the prefix
             // stays and the next boundary's seal window covers it (self-heal).
             if (projection.sealed || (projection.reason === 'already-sealed' && fs.existsSync(projection.path))) {
-              const trim = await journal.trimThrough(result.sequence);
+              const minAck = await getRegistry().getMinAck({ journalId: project.id });
+              const trim = await journal.trimThrough(minAck === null ? result.sequence : Math.min(result.sequence, minAck));
               projection.trimmedThrough = trim.trimmedThrough;
             }
           }
@@ -115,6 +153,7 @@ function createBridge({ homeDir } = {}) {
       }
       return {
         sequence: result.sequence,
+        journalId: routed ? projectRegistry.findProject(home, repoIdentity).id : 'global',
         bridgeCursorAtCommit,
         openTurnIdsAtCommit: result.openTurnIdsAtCommit,
         previousRepoBoundarySequence: result.previousRepoBoundarySequence,
@@ -138,16 +177,18 @@ function createBridge({ homeDir } = {}) {
       return getRegistry().getConsumers();
     },
 
-    async ackConsumerCursor(name, sequence) {
-      return getRegistry().ackConsumerCursor(name, sequence);
+    async ackConsumerCursor(name, sequence, options = {}) {
+      const high = await this.getHighWatermark(options);
+      if (sequence > high) throw Object.assign(new Error('ack exceeds journal high watermark'), { code: 'ACK_OUT_OF_RANGE' });
+      return getRegistry().ackConsumerCursor(name, sequence, options);
     },
 
     async unregisterConsumer(name) {
       return getRegistry().unregisterConsumer(name);
     },
 
-    async compact({ throughSequence } = {}) {
-      return compactJournal(getJournal(), getRegistry(), { throughSequence });
+    async compact({ throughSequence, journalId = 'global' } = {}) {
+      return compactJournal(selectJournal(journalId), getRegistry(), { throughSequence, journalId });
     },
 
     async getHealth() {

package/src/bridge/core/commit-projection.js

@@ -206,7 +206,7 @@ async function sealCommitConversations({ journal, sealDir, boundary } = {}) {
  * commits/<day>-uncommitted-<seq>.md, then trim the journal. Idempotent per
  * run: nothing happens while no new events arrived after the last boundary.
  */
-async function sealUncommittedTail({ journal, sealDir, maxAgeDays = 14, now = Date.now() } = {}) {
+async function sealUncommittedTail({ journal, sealDir, maxAgeDays = 14, now = Date.now(), throughSequence = Infinity } = {}) {
   if (!journal) throw new Error('sealUncommittedTail requires journal');
   if (typeof sealDir !== 'string' || !sealDir) throw new Error('sealUncommittedTail requires sealDir');
   const records = await journal.readEvents({});
@@ -236,7 +236,7 @@ async function sealUncommittedTail({ journal, sealDir, maxAgeDays = 14, now = Da
   };
   const result = await sealCommitConversations({ journal, sealDir, boundary });
   if (result.sealed || (result.reason === 'already-sealed' && fs.existsSync(result.path))) {
-    const trim = await journal.trimThrough(appended.sequence);
+    const trim = await journal.trimThrough(Math.min(appended.sequence, throughSequence));
     return { ...result, trimmedThrough: trim.trimmedThrough };
   }
   return result;
@@ -248,7 +248,7 @@ async function sealUncommittedTail({ journal, sealDir, maxAgeDays = 14, now = Da
  * successful seal and a crashed trim, and adopts pre-upgrade journals that
  * already carry sealed commits.
  */
-async function reconcileTrim({ journal, sealDir } = {}) {
+async function reconcileTrim({ journal, sealDir, throughSequence = Infinity } = {}) {
   if (!journal) throw new Error('reconcileTrim requires journal');
   if (typeof sealDir !== 'string' || !sealDir) throw new Error('reconcileTrim requires sealDir');
   const records = await journal.readEvents({});
@@ -258,7 +258,7 @@ async function reconcileTrim({ journal, sealDir } = {}) {
     .sort((a, b) => b.sequence - a.sequence);
   for (const boundary of boundaries) {
     if (fs.existsSync(path.join(sealDir, `${String(boundary.commitSha).toLowerCase()}.md`))) {
-      const trim = await journal.trimThrough(boundary.sequence);
+      const trim = await journal.trimThrough(Math.min(boundary.sequence, throughSequence));
       return { trimmedThrough: trim.trimmedThrough, commitSha: boundary.commitSha, reason: trim.reason };
     }
   }

package/src/bridge/core/compaction.js

@@ -5,8 +5,8 @@
  * Never removes data beyond minAck; requires at least one registered consumer;
  * runs under the same journal lock as appendEvent/appendCommitBoundary.
  */
-async function compactJournal(journal, consumerRegistry, { throughSequence } = {}) {
-  const minAck = await consumerRegistry.getMinAck();
+async function compactJournal(journal, consumerRegistry, { throughSequence, journalId = 'global' } = {}) {
+  const minAck = await consumerRegistry.getMinAck({ journalId });
   if (minAck === null || minAck === undefined) {
     return { compactedThrough: null, removedCount: 0, reason: 'no-consumers' };
   }

package/src/bridge/core/consumer-registry.js

@@ -59,7 +59,7 @@ class ConsumerRegistry {
     });
   }
 
-  async ackConsumerCursor(name, sequence) {
+  async ackConsumerCursor(name, sequence, { journalId = 'global' } = {}) {
     if (!Number.isInteger(sequence) || sequence < 0) {
       throw new TypeError('ack sequence must be a non-negative integer');
     }
@@ -71,12 +71,14 @@ class ConsumerRegistry {
         err.code = 'CONSUMER_NOT_REGISTERED';
         throw err;
       }
-      if (sequence > entry.ack) {
-        entry.ack = sequence;
+      if (journalId === 'global') entry.ack = Math.max(entry.ack || 0, sequence);
+      else {
+        if (!consumesJournal(entry, journalId)) throw new Error(`consumer ${name} is not registered for journal ${journalId}`);
+        entry.cursors = { ...(entry.cursors || {}), [journalId]: Math.max((entry.cursors || {})[journalId] || 0, sequence) };
       }
       entry.lastSeenAt = new Date().toISOString();
       this._write(state);
-      return { name, ack: entry.ack };
+      return { name, journalId, ack: journalId === 'global' ? entry.ack : entry.cursors[journalId] };
     });
   }
 
@@ -88,14 +90,22 @@ class ConsumerRegistry {
     });
   }
 
-  async getMinAck() {
+  async getMinAck({ journalId = 'global' } = {}) {
     if (!fs.existsSync(this.consumersFile)) return null;
     return this._withLock(async () => {
       const state = this._read();
-      if (state.consumers.length === 0) return null;
-      return state.consumers.reduce((min, c) => Math.min(min, c.ack), Number.POSITIVE_INFINITY);
+      const consumers = state.consumers.filter(c => consumesJournal(c, journalId));
+      if (consumers.length === 0) return null;
+      return consumers.reduce((min, c) => Math.min(min, journalId === 'global' ? c.ack || 0 : (c.cursors || {})[journalId] || 0), Number.POSITIVE_INFINITY);
     });
   }
 }
 
-module.exports = { ConsumerRegistry };
+// Legacy consumers are global-only. An explicit wildcard protects journals
+// created after registration too; an offline consumer is never expired.
+function consumesJournal(consumer, journalId) {
+  const journals = consumer.meta && consumer.meta.journals;
+  return Array.isArray(journals) ? journals.includes('*') || journals.includes(journalId) : journalId === 'global';
+}
+
+module.exports = { ConsumerRegistry, consumesJournal };

package/src/bridge/core/event-schema.js

@@ -2,7 +2,7 @@
 
 const { isValidRepoIdentityV1 } = require('./repo-context');
 
-const SOURCES = ['claude-code', 'codex', 'opencode'];
+const SOURCES = ['claude-code', 'codex', 'opencode', 'zcode'];
 const IDENTITY_CONFIDENCE_LEVELS = ['exact', 'partial', 'unavailable'];
 const CAPTURE_STATUSES = ['complete', 'partial', 'gap'];
 const ROLES = ['user', 'assistant'];

package/src/bridge/core/lock.js

@@ -47,7 +47,7 @@ class CrossProcessLock {
       try {
         const st = fs.statSync(this.lockFile);
         if (Date.now() - st.mtimeMs > this.staleMs) {
-          fs.rmSync(this.lockFile, { force: true });
+          fs.unlinkSync(this.lockFile);
           continue;
         }
       } catch (_) {
@@ -64,9 +64,11 @@ class CrossProcessLock {
     if (!this._held) return;
     this._held = false;
     try {
-      fs.rmSync(this.lockFile, { force: true });
-    } catch (_) {
-      // Already removed (stale takeover by another process).
+      // A lock is one file, never a directory. unlink also avoids Node 24's
+      // Windows rm(force) no-op on some non-ASCII filenames.
+      fs.unlinkSync(this.lockFile);
+    } catch (error) {
+      if (!error || error.code !== 'ENOENT') throw error;
     }
   }
 

package/src/server.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const {
   Journal,
   ConversationQuery,
@@ -14,6 +15,7 @@ const {
   projectJournalDir,
   repoIdentityKey
 } = require('./bridge');
+const { createBridge } = require('./bridge');
 const { pickFolder } = require('./pick-folder');
 const { detectAgents } = require('./agent-detect');
 const corePackage = require('../package.json');
@@ -74,11 +76,12 @@ function pickFolderEnabled() {
   return process.env.BRIDGE_CONSOLE_PICK_FOLDER !== '0';
 }
 
-function createConsoleServer({ home }) {
+function createConsoleServer({ home, runtimeToken }) {
   if (typeof home !== 'string' || !home) {
     throw new Error('createConsoleServer requires an explicit home directory');
   }
   const globalDir = globalJournalDir(home);
+  const bridge = createBridge({ homeDir: home });
   const consolePageFile = path.join(__dirname, '..', 'console', 'index.html');
 
   const journals = new Map();
@@ -283,13 +286,15 @@ function createConsoleServer({ home }) {
     const journal = existingJournal(projectJournalDir(project));
     if (!journal) return;
     const sealDir = sealDirOf(project);
+    const minAck = await new ConsumerRegistry(home).getMinAck({ journalId: project.id });
+    const throughSequence = minAck === null ? Infinity : minAck;
     try {
-      await commitProjection.reconcileTrim({ journal, sealDir });
+      await commitProjection.reconcileTrim({ journal, sealDir, throughSequence });
     } catch (_) {
       // best-effort: the next maintenance pass retries
     }
     try {
-      await commitProjection.sealUncommittedTail({ journal, sealDir });
+      await commitProjection.sealUncommittedTail({ journal, sealDir, throughSequence });
     } catch (_) {
       // best-effort
     }
@@ -441,6 +446,50 @@ function createConsoleServer({ home }) {
 
   async function handleApi(req, res, url) {
     const route = `${req.method} ${url.pathname}`;
+    const journalId = url.searchParams.get('journalId') || 'global';
+
+    if (url.pathname.startsWith('/api/internal/')) {
+      const supplied = String(req.headers.authorization || '').replace(/^Bearer /, '');
+      const local = ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(req.socket.remoteAddress);
+      if (!local || req.headers.origin || !runtimeToken || Buffer.byteLength(runtimeToken) !== Buffer.byteLength(supplied) || !crypto.timingSafeEqual(Buffer.from(runtimeToken), Buffer.from(supplied))) {
+        sendJson(res, 403, { error: { code: 'TRUSTED_SERVICE_REQUIRED', message: 'Trusted local service required' } }); return;
+      }
+      if (route !== 'POST /api/internal/workbench-event') { sendJson(res, 404, { error: { code: 'NOT_FOUND' } }); return; }
+      try { sendJson(res, 200, await bridge.captureWorkbenchEvent(JSON.parse(await readBody(req)))); }
+      catch (error) { sendJson(res, 409, { error: { code: error.code || 'CAPTURE_INVALID', message: '工作台会话尚未写入，请检查项目接线。' } }); }
+      return;
+    }
+
+    if (route === 'GET /api/journals') {
+      sendJson(res, 200, { journals: await bridge.listJournals() });
+      return;
+    }
+    if (route === 'GET /api/journal/high-watermark') {
+      sendJson(res, 200, { journalId, sequence: await bridge.getHighWatermark({ journalId }) });
+      return;
+    }
+    if (route === 'GET /api/journal/events') {
+      const from = Number(url.searchParams.get('fromSequence') || 1);
+      const limit = Number(url.searchParams.get('limit') || 100);
+      if (!Number.isSafeInteger(from) || from < 1 || !Number.isSafeInteger(limit) || limit < 1 || limit > 1000) {
+        sendJson(res, 400, { error: { code: 'INVALID_ARGUMENT', message: 'invalid journal range' } });
+        return;
+      }
+      sendJson(res, 200, { journalId, events: await bridge.readEvents({ journalId, fromSequence: from, limit }) });
+      return;
+    }
+    if (route === 'GET /api/consumers') {
+      sendJson(res, 200, { consumers: await bridge.listConsumers() });
+      return;
+    }
+    if (route === 'POST /api/consumers/register' || route === 'POST /api/consumers/ack') {
+      const body = JSON.parse(await readBody(req));
+      const result = route.endsWith('/register')
+        ? await bridge.registerConsumer(body.name, body.meta || {})
+        : await bridge.ackConsumerCursor(body.name, body.sequence, { journalId: body.journalId || 'global' });
+      sendJson(res, 200, result);
+      return;
+    }
 
     if (route === 'GET /api/health') {
       const journal = existingJournal(globalDir);