@sleep2agi/agent-network-dashboard 0.6.3-preview.56 → 0.6.3-preview.57

package/app/api/anet/node-config/route.ts

@@ -1,37 +1,20 @@
 import { requireDashboardAuth } from '@/app/lib/dashboard-auth';
 import { hubFetch } from '@/app/lib/hub';
+import { callMcp, parseMcpEnvelope, resolveDefaultNetworkId } from '@/app/lib/hub-mcp';
 
 /**
- * Per-node config read/write proxy (#260 / #262 — make node settings actually
- * take effect). Thin proxy to the hub, using the browser session's V3 user
- * token (hubFetch forwards `Authorization: Bearer utok_…`). Endpoint contract =
- * RFC-024 (通信工程马, #287/#294/#290, e2e verified):
+ * Per-node config proxy for #1316:
+ *   GET  ?node_id=... -> hub REST config snapshot (node-side applied fact)
+ *   POST              -> update_node_config MCP doorbell
  *
- *   GET  ?node_id=…|alias=…  → REST GET /api/nodes/{id}/config — masked snapshot
- *        { ok, node_id, alias, network_id, config_revision, model, flags{6},
- *          config_update_capable }. Network scope auto-filtered hub-side.
- *   POST { node_id|alias, base_revision, model?, flags? }
- *        → MCP tools/call `update_node_config` at /mcp.
- *        → { ok, update_id, apply_mode } or { ok:false, error, … }.
- *
- * apply-status has NO endpoint: the client polls GET and compares the returned
- * `config_revision` against the `base_revision` it sent — a bump (> base) means
- * applied (snapshot is ground truth; hub atomically finalizes the row + bumps
- * nodes.config_revision). See NodeSettingsPanel.
- *
- * If the hub is unreachable the GET mock-falls back with `mock:true` (panel then
- * shows the "后端未接入" note); in normal live operation no mock flag is set.
+ * get_config_update and ack_config_update are node-side MCP tools: the node
+ * calls them after the dashboard doorbell. The dashboard verifies success by
+ * polling the snapshot until config_revision advances. There is no mock success
+ * fallback.
  */
 
-const HUB_GET_PATH = (nodeId: string) => `/api/nodes/${encodeURIComponent(nodeId)}/config`;
-const HUB_MCP_PATH = '/mcp'; // MCP Streamable HTTP endpoint (tools/call)
 const MCP_TOOL_UPDATE = 'update_node_config';
-const MCP_PROTOCOL_VERSION = '2025-03-26';
 
-// Editable flags whitelist (RFC-024 — confirmed with 工程马). Anything outside
-// this set is dropped before forwarding so the UI can't smuggle unexpected keys
-// into the patch. (`teammateMode` is NOT in the hub allowlist — update would
-// return invalid_patch — so it's excluded here and from the form.)
 const EDITABLE_FLAGS = [
   'permissionMode',
   'dangerouslySkipPermissions',
@@ -40,99 +23,96 @@ const EDITABLE_FLAGS = [
   'timeout',
 ] as const;
 
-// #260 channel edit — the panel toggles enable/disable for these keys only.
-// Per-channel secrets (bot token / app secret / allowFrom) stay in the node's
-// local config.json, never on the wire from the UI. WeChat is roadmap-only in
-// the panel and intentionally not listed here.
 const EDITABLE_CHANNELS = ['telegram', 'feishu', 'commhub'] as const;
 
-function isJson(res: Response): boolean {
-  return (res.headers.get('content-type') || '').includes('application/json');
+type ConfigBody = {
+  node_id?: string;
+  alias?: string;
+  base_revision?: number;
+  network_id?: string;
+  model?: unknown;
+  flags?: Record<string, unknown>;
+  channels?: unknown;
+};
+
+function errText(e: unknown): string {
+  return e instanceof Error ? e.message : String(e);
 }
 
-/**
- * Parse an MCP Streamable-HTTP response (either application/json or an SSE
- * text/event-stream frame) into the JSON-RPC envelope object.
- */
-async function parseMcpEnvelope(res: Response): Promise<Record<string, unknown> | null> {
-  const text = await res.text();
-  const ct = res.headers.get('content-type') || '';
-  if (ct.includes('text/event-stream')) {
-    for (const line of text.split(/\r?\n/)) {
-      if (!line.startsWith('data:')) continue;
-      const payload = line.slice(5).trim();
-      if (!payload) continue;
-      try {
-        const o = JSON.parse(payload);
-        if (o && (o.jsonrpc || o.result || o.error)) return o;
-      } catch { /* keep scanning frames */ }
-    }
-    return null;
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    return null;
-  }
+function normalizeResult(result: unknown): Record<string, unknown> {
+  return result && typeof result === 'object' ? result as Record<string, unknown> : {};
 }
 
-export async function GET(req: Request) {
-  const authFailure = await requireDashboardAuth();
-  if (authFailure) return authFailure;
-
-  const { searchParams } = new URL(req.url);
-  // hub only resolves node_id — an alias would silently 404, so don't accept it.
-  const nodeId = searchParams.get('node_id') || '';
-  if (!nodeId) return Response.json({ error: 'node_id required' }, { status: 400 });
-
-  try {
-    const res = await hubFetch(HUB_GET_PATH(nodeId));
-    if (res.ok && isJson(res)) return Response.json(await res.json());
-    // Pass a real hub error (e.g. 404 node_not_found) straight through.
-    if (isJson(res)) return Response.json(await res.json(), { status: res.status });
-    // Hub unreachable / non-JSON → flagged fallback so the panel still renders.
-    // (channels kept in the shape for the #31 channel toggles.)
-    return Response.json({ ok: true, mock: true, node_id: nodeId, model: null, flags: {}, channels: [] });
-  } catch (e: unknown) {
-    return Response.json({
-      ok: true,
-      mock: true,
-      node_id: nodeId,
-      model: null,
-      flags: {},
-      channels: [],
-      _hubError: e instanceof Error ? e.message : String(e),
-    });
+function numberField(obj: Record<string, unknown>, key: string): number | undefined {
+  const value = obj[key];
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string' && value.trim() !== '') {
+    const n = Number(value);
+    if (Number.isFinite(n)) return n;
   }
+  return undefined;
 }
 
-export async function POST(req: Request) {
-  const authFailure = await requireDashboardAuth();
-  if (authFailure) return authFailure;
-
-  let body: {
-    node_id?: string;
-    base_revision?: number;
-    network_id?: string;
-    model?: unknown;
-    flags?: Record<string, unknown>;
-    channels?: unknown;
+function exposeConfigSnapshot(result: Record<string, unknown>) {
+  const config = normalizeResult(result.config);
+  return {
+    ...result,
+    ...(result.model === undefined && config.model !== undefined ? { model: config.model } : {}),
+    ...(result.flags === undefined && config.flags !== undefined ? { flags: config.flags } : {}),
+    ...(result.channels === undefined && config.channels !== undefined ? { channels: config.channels } : {}),
+    ...(result.config_revision === undefined && config.config_revision !== undefined ? { config_revision: config.config_revision } : {}),
+    ...(result.config_update_capable === undefined && config.config_update_capable !== undefined ? { config_update_capable: config.config_update_capable } : {}),
   };
-  try {
-    body = await req.json();
-  } catch {
-    return Response.json({ error: 'invalid JSON body' }, { status: 400 });
+}
+
+async function callConfigTool(tool: string, args: Record<string, unknown>) {
+  const res = await callMcp(tool, args);
+  if (res.status === 404 || res.status === 501) {
+    return {
+      response: Response.json(
+        { ok: false, unconfirmed: true, error: `hub tool '${tool}' not available (${res.status})` },
+        { status: 501 },
+      ),
+    };
+  }
+  if (!res.ok) {
+    return { response: Response.json({ ok: false, error: `hub ${res.status}`, status: res.status }, { status: 502 }) };
   }
+  const result = normalizeResult(await parseMcpEnvelope(res));
+  if (result.ok === false) {
+    return { response: Response.json({ ...result, ok: false, error: String(result.error || `${tool}_failed`) }, { status: 502 }) };
+  }
+  return { result };
+}
 
-  // hub only resolves node_id (no alias fallback — it would silently 404).
-  const nodeId = body.node_id;
-  if (!nodeId) return Response.json({ error: 'node_id required' }, { status: 400 });
-  if (typeof body.base_revision !== 'number') {
-    return Response.json({ error: 'base_revision (number) required' }, { status: 400 });
+async function getMaskedConfigSnapshot(nodeId: string, networkId?: string | null) {
+  const params = new URLSearchParams();
+  if (networkId) params.set('network_id', networkId);
+  const res = await hubFetch(`/api/nodes/${encodeURIComponent(nodeId)}/config${params.toString() ? `?${params}` : ''}`, {
+    headers: { Accept: 'application/json' },
+  });
+  const contentType = res.headers.get('content-type') || '';
+  if (!contentType.includes('application/json')) {
+    return {
+      response: Response.json(
+        { ok: false, node_id: nodeId, error: 'node_config_snapshot_unavailable' },
+        { status: 502 },
+      ),
+    };
   }
+  const data = normalizeResult(await res.json().catch(() => ({})));
+  if (data.ok !== true) {
+    return {
+      response: Response.json(
+        { ...data, ok: false, node_id: nodeId, error: String(data.error || 'node_config_snapshot_failed') },
+        { status: res.ok ? 502 : res.status },
+      ),
+    };
+  }
+  return { result: data };
+}
 
-  // Build the partial patch — only the fields the client sends. Flags and
-  // channels are whitelisted to the editable contract.
+function buildPatch(body: ConfigBody) {
   const patch: { model?: unknown; flags?: Record<string, unknown>; channels?: string[] } = {};
   if (body.model !== undefined) patch.model = body.model;
   if (body.flags && typeof body.flags === 'object') {
@@ -142,10 +122,6 @@ export async function POST(req: Request) {
     }
     if (Object.keys(flags).length > 0) patch.flags = flags;
   }
-  // Whitelist channels (#31) — accept string[] of EDITABLE_CHANNELS keys only.
-  // Any other shape or key is dropped, so the panel can never smuggle a secret
-  // payload or an unknown channel name to the hub. Channels ride INSIDE the
-  // RFC-024 patch — update_node_config's schema is { model?, flags?, channels? }.
   if (Array.isArray(body.channels)) {
     const allow = new Set<string>(EDITABLE_CHANNELS);
     const seen = new Set<string>();
@@ -159,73 +135,74 @@ export async function POST(req: Request) {
     }
     patch.channels = channels;
   }
-  if (patch.model === undefined && !patch.flags && !patch.channels) {
-    return Response.json({ ok: false, error: 'empty_patch' }, { status: 400 });
-  }
+  return patch;
+}
 
-  // Resolve network_id — REQUIRED by update_node_config when the token's
-  // current_network is null (dry-run verified: omitting it → permission_denied).
-  // Prefer the node's own network (sent by the client, who knows which network
-  // the node is in) — re-deriving from /api/auth/me networks[0] picks the wrong
-  // network for multi-network users (regression-test caught a false
-  // cross_network_node). The hub still authorizes (SEC-1), so trusting the
-  // client's network_id is safe. Fall back to the me-derivation.
-  let networkId: string | undefined = body.network_id;
-  if (!networkId) {
-    try {
-      const meRes = await hubFetch('/api/auth/me');
-      if (meRes.ok) {
-        const me = await meRes.json();
-        networkId = me?.current_network || me?.networks?.[0]?.network_id;
-      }
-    } catch { /* fall through — hub may still infer if current_network is set */ }
+export async function GET(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { searchParams } = new URL(req.url);
+  const networkId = searchParams.get('network_id') || (await resolveDefaultNetworkId());
+  const nodeId = searchParams.get('node_id') || searchParams.get('alias') || '';
+  if (!nodeId) return Response.json({ error: 'node_id or alias required' }, { status: 400 });
+  try {
+    const out = await getMaskedConfigSnapshot(nodeId, networkId);
+    if (out.response) return out.response;
+    const result = exposeConfigSnapshot(out.result);
+    const currentRevision = numberField(result, 'config_revision') ?? 0;
+    const baseRevision = numberField(Object.fromEntries(searchParams), 'base_revision');
+    if (baseRevision !== undefined) {
+      return Response.json({
+        ok: true,
+        node_id: nodeId,
+        ...result,
+        status: currentRevision > baseRevision ? 'applied' : 'pending',
+        base_revision: baseRevision,
+      });
+    }
+    return Response.json({ ok: true, node_id: nodeId, ...result });
+  } catch (e: unknown) {
+    return Response.json({ ok: false, node_id: nodeId, error: errText(e) }, { status: 502 });
   }
+}
 
-  const rpcBody = {
-    jsonrpc: '2.0',
-    id: 1,
-    method: 'tools/call',
-    params: {
-      name: MCP_TOOL_UPDATE,
-      arguments: { node_id: nodeId, base_revision: body.base_revision, patch, ...(networkId ? { network_id: networkId } : {}) },
-    },
-  };
+export async function POST(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
 
+  let body: ConfigBody;
   try {
-    const res = await hubFetch(HUB_MCP_PATH, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Accept: 'application/json, text/event-stream',
-        'MCP-Protocol-Version': MCP_PROTOCOL_VERSION,
-      },
-      body: JSON.stringify(rpcBody),
-    });
-
-    if (!res.ok && res.status >= 500) {
-      return Response.json({ ok: false, error: `hub ${res.status}` }, { status: 502 });
-    }
+    body = await req.json();
+  } catch {
+    return Response.json({ error: 'invalid JSON body' }, { status: 400 });
+  }
 
-    const rpc = await parseMcpEnvelope(res);
-    if (!rpc) return Response.json({ ok: false, error: 'mcp_unparseable' }, { status: 502 });
-    if (rpc.error) {
-      const err = rpc.error as { message?: string };
-      return Response.json({ ok: false, error: 'mcp_error', detail: err?.message }, { status: 502 });
-    }
+  const nodeId = body.node_id || body.alias;
+  if (!nodeId) return Response.json({ error: 'node_id or alias required' }, { status: 400 });
+  if (typeof body.base_revision !== 'number') {
+    return Response.json({ error: 'base_revision (number) required' }, { status: 400 });
+  }
 
-    // tools/call wraps the tool's JSON in result.content[0].text.
-    const result = rpc.result as { content?: Array<{ text?: string }> } | undefined;
-    const textContent = result?.content?.[0]?.text;
-    let inner: Record<string, unknown> = {};
-    if (typeof textContent === 'string') {
-      try { inner = JSON.parse(textContent); } catch { inner = {}; }
-    } else if (rpc.result && typeof rpc.result === 'object') {
-      inner = rpc.result as Record<string, unknown>;
-    }
-    // inner = { ok:true, update_id, apply_mode } | { ok:false, error, … }
-    // App-level errors come back HTTP 200 (ok:false) so the client maps them.
-    return Response.json(inner);
+  const patch = buildPatch(body);
+  if (patch.model === undefined && !patch.flags && !patch.channels) {
+    return Response.json({ ok: false, error: 'empty_patch' }, { status: 400 });
+  }
+
+  const networkId = body.network_id || (await resolveDefaultNetworkId());
+  const args = {
+    node_id: nodeId,
+    base_revision: body.base_revision,
+    patch,
+    ...(networkId ? { network_id: networkId } : {}),
+  };
+
+  try {
+    const out = await callConfigTool(MCP_TOOL_UPDATE, args);
+    if (out.response) return out.response;
+    const result = out.result;
+    return Response.json({ ok: true, node_id: nodeId, base_revision: body.base_revision, status: 'pending', ...exposeConfigSnapshot(result) });
   } catch (e: unknown) {
-    return Response.json({ ok: false, error: 'hub_unreachable', detail: e instanceof Error ? e.message : String(e) }, { status: 502 });
+    return Response.json({ ok: false, node_id: nodeId, error: errText(e) }, { status: 502 });
   }
 }

package/app/api/hub/people/route.ts

@@ -0,0 +1,48 @@
+import { requireDashboardAuth, getV3UserToken } from '@/app/lib/dashboard-auth';
+
+const HUB_URL = process.env.COMMHUB_URL || 'http://127.0.0.1:9200';
+
+async function hubHeaders(): Promise<Record<string, string>> {
+  const userToken = await getV3UserToken();
+  const h: Record<string, string> = {};
+  if (userToken) h['Authorization'] = `Bearer ${userToken}`;
+  return h;
+}
+
+/**
+ * Org directory — #1635.
+ *
+ * The Hub already builds this projection for MCP `requirements_people`
+ * (people + department + the Agents each person owns). Its REST twin is
+ * `/api/requirements/people/directory`; there is no `/api/people`. Proxying
+ * the existing one keeps a single source of truth instead of a second query.
+ */
+export async function GET(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { searchParams } = new URL(req.url);
+  const params = new URLSearchParams();
+  for (const key of ['q', 'limit', 'offset']) {
+    const value = searchParams.get(key);
+    if (value) params.set(key, value);
+  }
+  if (!params.has('limit')) params.set('limit', '100');
+
+  try {
+    const res = await fetch(`${HUB_URL}/api/requirements/people/directory?${params.toString()}`, {
+      headers: await hubHeaders(),
+      next: { revalidate: 0 },
+    });
+    const contentType = res.headers.get('content-type') || '';
+    if (!contentType.includes('application/json')) {
+      return Response.json({ ok: false, error: 'hub_not_json', status: res.status }, { status: 502 });
+    }
+    return Response.json(await res.json(), { status: res.status });
+  } catch (e: unknown) {
+    return Response.json(
+      { ok: false, error: 'CommHub unreachable', detail: e instanceof Error ? e.message : String(e) },
+      { status: 502 },
+    );
+  }
+}

package/app/api/hub/requirements/[id]/checklist/[itemId]/route.ts

@@ -0,0 +1,54 @@
+import { requireDashboardAuth, getV3UserToken } from '@/app/lib/dashboard-auth';
+
+const HUB_URL = process.env.COMMHUB_URL || 'http://127.0.0.1:9200';
+
+async function hubHeaders(): Promise<Record<string, string>> {
+  const userToken = await getV3UserToken();
+  const h: Record<string, string> = {};
+  if (userToken) h['Authorization'] = `Bearer ${userToken}`;
+  return h;
+}
+
+/**
+ * Checklist toggle — #1634. Only that one item is written (Hub patches a
+ * single entry), so two people editing different items do not clobber
+ * each other.
+ */
+export async function PATCH(req: Request, ctx: { params: Promise<{ id: string; itemId: string }> }) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { id, itemId } = await ctx.params;
+  if (!/^req_[A-Za-z0-9_-]+$/.test(id || '') || !/^[A-Za-z0-9_-]{1,40}$/.test(itemId || '')) {
+    return Response.json({ ok: false, error: 'invalid_checklist_target' }, { status: 400 });
+  }
+
+  let body: { done?: unknown };
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ ok: false, error: 'invalid_json' }, { status: 400 });
+  }
+  if (typeof body.done !== 'boolean') {
+    return Response.json({ ok: false, error: 'done_must_be_boolean' }, { status: 400 });
+  }
+
+  try {
+    const res = await fetch(
+      `${HUB_URL}/api/requirements/${encodeURIComponent(id)}/checklist/${encodeURIComponent(itemId)}`,
+      {
+        method: 'PATCH',
+        headers: { ...(await hubHeaders()), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ done: body.done }),
+        next: { revalidate: 0 },
+      },
+    );
+    const data = await res.json().catch(() => ({}));
+    return Response.json(data, { status: res.status });
+  } catch (e: unknown) {
+    return Response.json(
+      { ok: false, error: 'CommHub unreachable', detail: e instanceof Error ? e.message : String(e) },
+      { status: 502 },
+    );
+  }
+}

package/app/api/hub/requirements/[id]/comments/route.ts

@@ -0,0 +1,51 @@
+import { requireDashboardAuth, getV3UserToken } from '@/app/lib/dashboard-auth';
+
+const HUB_URL = process.env.COMMHUB_URL || 'http://127.0.0.1:9200';
+
+async function hubHeaders(): Promise<Record<string, string>> {
+  const userToken = await getV3UserToken();
+  const h: Record<string, string> = {};
+  if (userToken) h['Authorization'] = `Bearer ${userToken}`;
+  return h;
+}
+
+/**
+ * Comments — #1634. Hub's path is the plural `/comments` (a singular
+ * `/comment` route 404s); it requires non-empty `text` and appends to the
+ * timeline without touching the description.
+ */
+export async function POST(req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { id } = await ctx.params;
+  if (!/^req_[A-Za-z0-9_-]+$/.test(id || '')) {
+    return Response.json({ ok: false, error: 'invalid_requirement_id' }, { status: 400 });
+  }
+
+  let body: { text?: unknown };
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ ok: false, error: 'invalid_json' }, { status: 400 });
+  }
+  const text = typeof body.text === 'string' ? body.text.trim() : '';
+  if (!text) return Response.json({ ok: false, error: 'invalid_comment', field: 'text' }, { status: 400 });
+  if (text.length > 4000) return Response.json({ ok: false, error: 'comment_too_long' }, { status: 400 });
+
+  try {
+    const res = await fetch(`${HUB_URL}/api/requirements/${encodeURIComponent(id)}/comments`, {
+      method: 'POST',
+      headers: { ...(await hubHeaders()), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text }),
+      next: { revalidate: 0 },
+    });
+    const data = await res.json().catch(() => ({}));
+    return Response.json(data, { status: res.status });
+  } catch (e: unknown) {
+    return Response.json(
+      { ok: false, error: 'CommHub unreachable', detail: e instanceof Error ? e.message : String(e) },
+      { status: 502 },
+    );
+  }
+}

package/app/api/hub/requirements/[id]/route.ts

@@ -0,0 +1,89 @@
+import { requireDashboardAuth, getV3UserToken } from '@/app/lib/dashboard-auth';
+
+const HUB_URL = process.env.COMMHUB_URL || 'http://127.0.0.1:9200';
+
+async function hubHeaders(): Promise<Record<string, string>> {
+  const userToken = await getV3UserToken();
+  const h: Record<string, string> = {};
+  if (userToken) h['Authorization'] = `Bearer ${userToken}`;
+  return h;
+}
+
+/**
+ * One requirement — #1633. Hub only resolves `req_…` ids on this path;
+ * a short number (#N) 404s, so the page always links by id.
+ */
+export async function GET(_req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { id } = await ctx.params;
+  if (!id || !/^req_[A-Za-z0-9_-]+$/.test(id)) {
+    return Response.json({ ok: false, error: 'invalid_requirement_id' }, { status: 400 });
+  }
+
+  try {
+    const res = await fetch(`${HUB_URL}/api/requirements/${encodeURIComponent(id)}`, {
+      headers: await hubHeaders(),
+      next: { revalidate: 0 },
+    });
+    const contentType = res.headers.get('content-type') || '';
+    if (!contentType.includes('application/json')) {
+      return Response.json({ ok: false, error: 'hub_not_json', status: res.status }, { status: 502 });
+    }
+    return Response.json(await res.json(), { status: res.status });
+  } catch (e: unknown) {
+    return Response.json(
+      { ok: false, error: 'CommHub unreachable', detail: e instanceof Error ? e.message : String(e) },
+      { status: 502 },
+    );
+  }
+}
+
+/**
+ * Writes — #1634. Hub owns every rule (owner must be human, node tokens may
+ * not delete, checklist ids are server-side); this proxy only forwards the
+ * whitelisted fields and passes Hub's error code through untouched so the UI
+ * can say *why* instead of failing silently.
+ */
+const WRITABLE = ['column', 'priority', 'due', 'start', 'tags', 'name'] as const;
+
+export async function PATCH(req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { id } = await ctx.params;
+  if (!id || !/^req_[A-Za-z0-9_-]+$/.test(id)) {
+    return Response.json({ ok: false, error: 'invalid_requirement_id' }, { status: 400 });
+  }
+
+  let body: Record<string, unknown>;
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ ok: false, error: 'invalid_json' }, { status: 400 });
+  }
+  const patch: Record<string, unknown> = {};
+  for (const key of WRITABLE) {
+    if (Object.prototype.hasOwnProperty.call(body, key)) patch[key] = body[key];
+  }
+  if (Object.keys(patch).length === 0) {
+    return Response.json({ ok: false, error: 'empty_patch' }, { status: 400 });
+  }
+
+  try {
+    const res = await fetch(`${HUB_URL}/api/requirements/${encodeURIComponent(id)}`, {
+      method: 'PATCH',
+      headers: { ...(await hubHeaders()), 'Content-Type': 'application/json' },
+      body: JSON.stringify(patch),
+      next: { revalidate: 0 },
+    });
+    const data = await res.json().catch(() => ({}));
+    return Response.json(data, { status: res.status });
+  } catch (e: unknown) {
+    return Response.json(
+      { ok: false, error: 'CommHub unreachable', detail: e instanceof Error ? e.message : String(e) },
+      { status: 502 },
+    );
+  }
+}

package/app/api/hub/requirements/events/route.ts

@@ -0,0 +1,45 @@
+import { requireDashboardAuth, getV3UserToken } from '@/app/lib/dashboard-auth';
+
+const HUB_URL = process.env.COMMHUB_URL || 'http://127.0.0.1:9200';
+
+async function hubHeaders(): Promise<Record<string, string>> {
+  const userToken = await getV3UserToken();
+  const h: Record<string, string> = {};
+  if (userToken) h['Authorization'] = `Bearer ${userToken}`;
+  return h;
+}
+
+/**
+ * Requirement activity timeline (动态) — #1633.
+ *
+ * Hub's shape here is NOT /api/requirements/<id>/events (that 404s).
+ * The working endpoint is a query param on the collection route.
+ */
+export async function GET(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  const { searchParams } = new URL(req.url);
+  const requirementId = searchParams.get('requirement_id') || '';
+  if (!/^req_[A-Za-z0-9_-]+$/.test(requirementId)) {
+    return Response.json({ ok: false, error: 'invalid_requirement_id' }, { status: 400 });
+  }
+  const limit = searchParams.get('limit') || '100';
+
+  try {
+    const res = await fetch(
+      `${HUB_URL}/api/requirements/events?requirement_id=${encodeURIComponent(requirementId)}&limit=${encodeURIComponent(limit)}`,
+      { headers: await hubHeaders(), next: { revalidate: 0 } },
+    );
+    const contentType = res.headers.get('content-type') || '';
+    if (!contentType.includes('application/json')) {
+      return Response.json({ ok: false, error: 'hub_not_json', status: res.status }, { status: 502 });
+    }
+    return Response.json(await res.json(), { status: res.status });
+  } catch (e: unknown) {
+    return Response.json(
+      { ok: false, error: 'CommHub unreachable', detail: e instanceof Error ? e.message : String(e) },
+      { status: 502 },
+    );
+  }
+}