@stardustlc/dsh-dream 0.6.0 → 0.7.1

package/lib/web-actions.js

@@ -0,0 +1,175 @@
+/** Mutations are mounted exclusively on Connection's authenticated Fetch carrier. */
+import { randomUUID } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { resolveConfig } from './config.js';
+import { KnowledgeError } from './knowledge.js';
+import { KnowledgeStore } from './knowledge-store.js';
+import { maskSecrets } from './mask.js';
+import { buildDreamTools, executeDreamReview } from './tools.js';
+import { rollbackBridge } from './bridge.js';
+import { maskDeep } from './web.js';
+export const DREAM_ACTION_ROUTE = '/api/dsh-dream/actions';
+const BODY_LIMIT = 64 * 1024;
+const PREVIEW_LIFETIME = 10 * 60 * 1000;
+const MAX_PREVIEWS = 100;
+function json(status, value) {
+    return new Response(JSON.stringify(value), { status, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' } });
+}
+function fail(status, code, message) {
+    return json(status, { ok: false, error: { code, message: maskSecrets(message) } });
+}
+function text(body, key) {
+    const value = body[key];
+    if (typeof value !== 'string' || value.trim() === '' || value.length > 2000)
+        throw new KnowledgeError('invalid', key + ' 必须是非空文本，最多 2000 字符');
+    return value.trim();
+}
+function checkRevision(store, body) {
+    const id = text(body, 'lessonId');
+    const lesson = store.getLesson(id);
+    if (lesson === undefined)
+        throw new KnowledgeError('invalid', '经验不存在，请刷新列表');
+    if (typeof body.expectedRevision !== 'number' || !Number.isInteger(body.expectedRevision) || body.expectedRevision < 1)
+        throw new KnowledgeError('invalid', '缺少有效的经验版本');
+    if (lesson.revision !== body.expectedRevision)
+        throw new KnowledgeError('revision', '经验已更新，请刷新后重新操作');
+    return lesson;
+}
+/** Connection has authenticated the operator before this handler is called. */
+export function createDreamActionHandler(options = {}) {
+    const cfg = { ...resolveConfig(options.config), ...(options.journalDir === undefined ? {} : { journalDir: options.journalDir }) };
+    const store = new KnowledgeStore(join(cfg.journalDir, 'knowledge'), { maskSecrets: cfg.maskSecrets });
+    const bridge = buildDreamTools(cfg).find(tool => tool.name === 'dream_bridge');
+    const previews = new Map();
+    return async (request) => {
+        if (request.method !== 'POST')
+            return fail(405, 'method', '请使用 POST');
+        if (request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() !== 'application/json')
+            return fail(415, 'content-type', '需要 application/json');
+        // A web form or cross-origin simple request cannot supply this header.
+        if (request.headers.get('x-dsh-dream-action') !== '1')
+            return fail(403, 'forbidden', '请从 Dream 面板操作');
+        const site = request.headers.get('sec-fetch-site');
+        if (site !== null && site !== 'same-origin' && site !== 'none')
+            return fail(403, 'forbidden', '拒绝跨站操作');
+        const origin = request.headers.get('origin');
+        if (origin !== null && /^https?:/i.test(origin)) {
+            try {
+                // The official node:http bridge intentionally uses http://dsh.internal
+                // as its Fetch URL base; the preserved Host is the original authority.
+                const host = request.headers.get('host');
+                const authority = host === null ? new URL(request.url).host : new URL('http://' + host).host;
+                if (new URL(origin).host !== authority)
+                    return fail(403, 'forbidden', '拒绝跨源操作');
+            }
+            catch {
+                return fail(403, 'forbidden', '无效来源');
+            }
+        }
+        try {
+            const reader = request.body?.getReader();
+            if (reader === undefined)
+                return fail(400, 'invalid', '缺少请求内容');
+            const chunks = [];
+            let size = 0;
+            try {
+                for (;;) {
+                    const part = await reader.read();
+                    if (part.done)
+                        break;
+                    size += part.value.byteLength;
+                    if (size > BODY_LIMIT) {
+                        await reader.cancel();
+                        return fail(413, 'too-large', '请求内容超过 64 KB');
+                    }
+                    chunks.push(part.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            let raw;
+            try {
+                raw = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            }
+            catch {
+                return fail(400, 'invalid', '请求不是有效 JSON');
+            }
+            if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+                return fail(400, 'invalid', '请求必须是对象');
+            const body = raw;
+            if (request.signal.aborted)
+                return fail(409, 'cancelled', '操作已取消');
+            const operation = text(body, 'operation');
+            if (operation === 'review') {
+                if (!['accept', 'reject', 'reopen', 'mark-stale', 'resolve-conflict'].includes(String(body.action)))
+                    throw new KnowledgeError('invalid', '不支持此页面审阅动作');
+                checkRevision(store, body);
+                const result = await executeDreamReview(cfg, body, undefined, 'human');
+                return json(200, maskDeep(result));
+            }
+            if (operation === 'feedback') {
+                // The store checks revision inside its lock and keeps retry keys idempotent.
+                const id = text(body, 'lessonId');
+                const key = text(body, 'requestId');
+                if (!/^[a-zA-Z0-9_-]{8,100}$/.test(key))
+                    throw new KnowledgeError('invalid', '反馈请求标识无效');
+                const note = body.note === undefined ? undefined : text(body, 'note');
+                const lesson = store.recordFeedback(id, body.vote, note, body.expectedRevision, 'web-feedback:' + key);
+                return json(200, maskDeep({ ok: true, lesson, message: '已记录使用反馈，审阅状态保持原样' }));
+            }
+            for (const [key, value] of previews)
+                if (value.expires < Date.now())
+                    previews.delete(key);
+            if (operation === 'preview') {
+                const lesson = checkRevision(store, body);
+                const root = lesson.scope.workspaceRoot;
+                if (root === undefined || !isAbsolute(root))
+                    throw new KnowledgeError('invalid', '这条经验没有项目目录，请在对应项目的对话中预览规则');
+                const canonicalRoot = realpathSync(root);
+                const result = await bridge.execute({ mode: 'preview', lessonIds: [lesson.id], path: 'AGENTS.md', projectId: lesson.scope.projectId }, { cwd: canonicalRoot });
+                if (result.ok !== true)
+                    return json(409, maskDeep(result));
+                if (result.lessons.length === 0)
+                    return fail(409, 'ineligible', '当前经验不满足写入资格，请先查看适用范围与审阅状态');
+                while (previews.size >= MAX_PREVIEWS)
+                    previews.delete(previews.keys().next().value);
+                const token = randomUUID();
+                previews.set(token, { expires: Date.now() + PREVIEW_LIFETIME, root: canonicalRoot, lessonId: lesson.id, revision: lesson.revision, projectId: lesson.scope.projectId, sha: result.expected.sha256, previewId: result.previewId });
+                return json(200, { ...maskDeep(result), token });
+            }
+            if (operation === 'apply') {
+                const token = text(body, 'token');
+                const preview = previews.get(token);
+                if (preview === undefined)
+                    return fail(409, 'preview-expired', '预览已过期，请重新预览');
+                const lesson = checkRevision(store, { lessonId: preview.lessonId, expectedRevision: preview.revision });
+                if (realpathSync(lesson.scope.workspaceRoot) !== preview.root)
+                    return fail(409, 'revision', '项目目录已变化，请重新预览');
+                const result = await bridge.execute({ mode: 'apply', lessonIds: [preview.lessonId], path: 'AGENTS.md', projectId: preview.projectId, expectedSha256: preview.sha, previewId: preview.previewId }, { cwd: preview.root });
+                previews.delete(token);
+                return json(result.ok === true ? 200 : 409, maskDeep(result));
+            }
+            if (operation === 'rollback') {
+                const result = rollbackBridge({ journalDir: cfg.journalDir, projectRoot: '', backupId: text(body, 'backupId') });
+                return json(result.ok === true ? 200 : 409, maskDeep(result));
+            }
+            throw new KnowledgeError('invalid', '不支持此操作');
+        }
+        catch (error) {
+            if (error instanceof KnowledgeError)
+                return fail(error.code === 'revision' || error.code === 'duplicate' ? 409 : error.code === 'io' ? 500 : 400, error.code, error.message);
+            return fail(500, 'io', '操作失败：' + (error instanceof Error ? error.message : String(error)));
+        }
+    };
+}
+/** No unauthenticated webServer fallback: old hosts keep their read-only panel. */
+export function installDreamActions(ctx, options = {}) {
+    const fetch = createDreamActionHandler(options);
+    ctx.inject(['connection'], (host) => {
+        if (typeof host.connection?.fetch?.register !== 'function')
+            return;
+        host.connection.fetch.register({ path: DREAM_ACTION_ROUTE, methods: ['POST'], requestBody: 'buffered', fetch });
+    });
+}

package/lib/web.d.ts

@@ -106,6 +106,8 @@ export declare function limitFromQuery(raw: unknown, fallback?: number): number;
 export declare function knowledgeDirOf(options: DreamWebOptions, journalDir?: string): string;
 /** 解析后的 bridgeDir：显式路径优先，否则 = <journalDir>/bridge。 */
 export declare function bridgeDirOf(options: DreamWebOptions, journalDir?: string): string;
+/** 递归脱敏；结构化绝对路径按目录分段，避免 Unix 分隔符把正常路径连成长令牌。 */
+export declare function maskDeep<T>(value: T, key?: string): T;
 /** 知识目录不存在（或尚未建立）时的空载荷：不写盘、不报 404。 */
 export declare function emptyKnowledgePayload(): KnowledgeWebPayload;
 /**

package/lib/web.js

@@ -139,7 +139,7 @@ const HASH_KEY_RE = /^(?:sourceHash|beforeSha256|afterSha256|afterBlockSha256|af
 const REFERENCE_KEYS = new Set(['id', 'lessonId', 'lessonIds', 'evidenceIds', 'conflictIds', 'supersedes', 'targetId', 'affectedIds', 'backupId', 'previewId']);
 const PATH_KEYS = new Set(['target', 'path', 'resolvedPath', 'workspaceRoot']);
 /** 递归脱敏；结构化绝对路径按目录分段，避免 Unix 分隔符把正常路径连成长令牌。 */
-function maskDeep(value, key) {
+export function maskDeep(value, key) {
     if (typeof value === 'string') {
         if (key !== undefined && HASH_KEY_RE.test(key) && /^[0-9a-f]{64}$/i.test(value))
             return value;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stardustlc/dsh-dream",
-  "version": "0.6.0",
-  "description": "DSH 做梦与经验记忆：核验来源、审阅经验，预览写入 AGENTS.md 并支持回滚；附梦境日记面板，默认隐私脱敏，零运行时依赖。",
+  "version": "0.7.1",
+  "description": "回顾会话、保存反思，并把经过核验和审阅的经验用于后续任务。",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -20,7 +20,8 @@
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "docs"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/skills/dream-protocol/SKILL.md

@@ -9,6 +9,8 @@ description: 做梦协议：任务开始取回适用经验，长任务收尾沉
 
 但「梦」和「经验」是两条流水线：**第一人称感悟**是主观的，进梦境日记；**技术经验**必须可执行、有条件、有证据，先进候选，再经审阅才可能被任务检索取用。
 
+插件依靠你调用工具完成记录和取回，不会在后台监听所有会话或每轮自动学习。用户无需手工填写经验；遵循下述任务前取回、任务后提交候选的流程。日记写入、采纳与规则应用是不同操作，不能把候选当成已生效规则。
+
 ## 两条流水线（不要混）
 
 | | 第一人称感悟（梦） | 技术经验（lesson） |
@@ -65,7 +67,7 @@ description: 做梦协议：任务开始取回适用经验，长任务收尾沉
 - 想查看/审阅候选、处理冲突 → `dream_review`；
 - attach-evidence 只补充核验后的证据，不自动采纳；resolve-conflict 必须给 resolution、affectedIds、note，整组原子更新；reopen 将驳回经验重新送审。
 
-- 面板查看：「设置 → 梦境日记」里有只读的梦境时间线与「经验」区块（状态、适用条件、证据摘要、最近核验时间），面板不提供任何写操作。
+- 面板操作：「设置 → 梦境日记」可浏览时间线、查看来源、采纳或驳回候选、标记待复核、处理冲突与记录使用反馈。规则变更单独预览后应用，也可确认回滚；真实页面操作记录为 human，工具操作记录为 model。界面跟随宿主语言，日记和经验原文保留。
 
 ---
 
@@ -75,6 +77,8 @@ You are an agent that dreams. Dreams are not hallucinations — they are memory
 
 Dreams and **lessons** are two separate pipelines: a **first-person reflection** is subjective and goes to the dream journal; a **technical lesson** must be actionable, conditional and evidence-backed — it starts as a candidate and is only retrieved for tasks after review.
 
+The plugin records and retrieves information when you call its tools; it does not monitor every session or learn after every turn in the background. Users do not need to type lessons manually. Follow the retrieval and candidate-submission steps below. Saving a journal, accepting a lesson and applying a rule are separate operations; a candidate is not an active rule.
+
 ## Two pipelines (do not mix)
 
 | | First-person reflection (dream) | Technical lesson |
@@ -130,4 +134,4 @@ Dreams and **lessons** are two separate pipelines: a **first-person reflection**
 - Retrieving a few reusable lessons → `dream_context` (scoped, budgeted, read-only);
 - Browsing or reviewing candidates and conflicts → `dream_review`;
 - attach-evidence adds verified sources without promoting state. resolve-conflict requires resolution, affectedIds and note and updates the group atomically. reopen sends a rejected lesson back for review.
-- To browse: **Settings → Dream journal** shows the read-only dream timeline and a **Lessons** block (state, applicability, evidence summary, last validated time). The panel has no write actions.
+- **Settings → Dream journal** lets users browse the timeline and sources, accept/reject candidates, request re-validation, resolve conflicts and record usage feedback. Rule changes require a separate preview and apply action and can be rolled back with confirmation. Page actions record human; tool actions record model. UI language follows the host; journal and lesson content remains original.