@twinsearth/dsh-master 3.3.3 → 3.3.5

package/dist-host/engine/safe-update.js

@@ -0,0 +1,150 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 dsh-Master contributors — see LICENSE-CORE.
+// @ts-nocheck
+/**
+ * 快照 → 更新 → 冒烟 → 失败回滚（PluginSafeUpdater 的可编译实现）。
+ *
+ * 关键设计：**不假装有 VM**。执行能力由调用方注入一个 `executor`：
+ *
+ *   executor.snapshot(name)            → 建快照
+ *   executor.restore(name)             → 回滚到快照
+ *   executor.run(argv, options)        → 跑一条命令，返回 { ok, stdout, stderr, code }
+ *
+ * 房主本身没有 vm-sandbox；真实接入要么由瓮城的 VM 层提供 executor，
+ * 要么由宿主进程管理器提供。这里只保证**顺序、门禁与回滚语义**正确。
+ */
+function asString(value) { return String(value ?? '').trim(); }
+function executorOf(input) {
+    const executor = input && typeof input === 'object' ? input.executor : null;
+    if (!executor || typeof executor.snapshot !== 'function' || typeof executor.restore !== 'function' || typeof executor.run !== 'function') {
+        return null;
+    }
+    return executor;
+}
+/**
+ * @param {{
+ *   executor?: {snapshot:Function, restore:Function, run:Function},
+ *   snapshotName?: string,
+ *   update?: string[],        // 更新命令 argv
+ *   smoke?: string[],         // 冒烟命令 argv（可选）
+ *   restart?: string[],       // 回滚后重启命令 argv（可选）
+ *   now?: () => number,
+ * }} input
+ */
+export async function runSafeUpdate(input = {}) {
+    const executor = executorOf(input);
+    if (!executor) {
+        return { ok: false, code: 'executor-required', error: 'an executor with snapshot/restore/run is required; no VM is assumed' };
+    }
+    const now = typeof input.now === 'function' ? input.now : () => Date.now();
+    const snapshotName = asString(input.snapshotName) || `pre-update-${now()}`;
+    const steps = [];
+    const record = (step, detail) => { steps.push({ step, at: now(), ...detail }); };
+    // 1. 快照是硬前置：拿不到快照就不允许更新，否则失败时无法回滚。
+    try {
+        const snapshot = await executor.snapshot(snapshotName);
+        if (snapshot && snapshot.ok === false) {
+            record('snapshot', { ok: false, detail: snapshot });
+            return { ok: false, code: 'snapshot-failed', error: 'snapshot failed; refusing to update', snapshotName, steps };
+        }
+        record('snapshot', { ok: true });
+    }
+    catch (error) {
+        record('snapshot', { ok: false, error: String(error?.message ?? error) });
+        return { ok: false, code: 'snapshot-threw', error: String(error?.message ?? error), snapshotName, steps };
+    }
+    const rollback = async (reason, detail) => {
+        record('rollback-start', { reason });
+        let restored = null;
+        try {
+            restored = await executor.restore(snapshotName);
+        }
+        catch (error) {
+            restored = { ok: false, error: String(error?.message ?? error) };
+        }
+        record('restore', { ok: restored?.ok !== false, detail: restored });
+        if (Array.isArray(input.restart) && input.restart.length > 0) {
+            try {
+                const restarted = await executor.run(input.restart, { phase: 'restart' });
+                record('restart', { ok: restarted?.ok !== false, detail: restarted });
+            }
+            catch (error) {
+                record('restart', { ok: false, error: String(error?.message ?? error) });
+            }
+        }
+        return { ok: false, code: reason, error: detail, snapshotName, steps, rolledBack: restored?.ok !== false };
+    };
+    // 2. 更新
+    const update = Array.isArray(input.update) && input.update.length > 0 ? input.update : null;
+    if (!update)
+        return await rollback('update-command-required', 'update argv is required');
+    try {
+        const updated = await executor.run(update, { phase: 'update' });
+        if (updated && updated.ok === false) {
+            record('update', { ok: false, detail: updated });
+            return await rollback('update-failed', 'update command failed');
+        }
+        record('update', { ok: true });
+    }
+    catch (error) {
+        record('update', { ok: false, error: String(error?.message ?? error) });
+        return await rollback('update-threw', String(error?.message ?? error));
+    }
+    // 3. 冒烟（可选但推荐）：不通过同样回滚，绝不“更新成功但起不来”。
+    if (Array.isArray(input.smoke) && input.smoke.length > 0) {
+        try {
+            const smoke = await executor.run(input.smoke, { phase: 'smoke' });
+            if (smoke && smoke.ok === false) {
+                record('smoke', { ok: false, detail: smoke });
+                return await rollback('smoke-failed', 'smoke test failed after update');
+            }
+            record('smoke', { ok: true });
+        }
+        catch (error) {
+            record('smoke', { ok: false, error: String(error?.message ?? error) });
+            return await rollback('smoke-threw', String(error?.message ?? error));
+        }
+    }
+    return { ok: true, code: 'updated', snapshotName, steps, rolledBack: false };
+}
+/**
+ * 组合使用：切指针 + 健康检查 + 失败回滚。适合蓝绿切换后的验证。
+ * 指针切换成功但健康检查失败时，把指针切回旧目标。
+ */
+export async function switchAndVerify(input = {}) {
+    const { readPointer, switchWithRollback } = await import("./atomic-switch.js");
+    const { probeHealth } = await import("./health-probe.js");
+    // 先记住旧目标：健康检查失败时要切回它，而不是切到“刚切过去的新目标”。
+    const previous = await readPointer({ linkPath: input.linkPath, fs: input.fs });
+    const switched = await switchWithRollback({
+        linkPath: input.linkPath,
+        targetDir: input.targetDir,
+        fs: input.fs,
+        platform: input.platform,
+        now: input.now,
+    });
+    if (!switched.ok)
+        return { ok: false, code: switched.code, error: switched.error, switch: switched, health: null, previous };
+    const health = await probeHealth({
+        url: input.healthUrl,
+        fetchImpl: input.fetchImpl,
+        timeoutMs: input.timeoutMs,
+        intervalMs: input.intervalMs,
+        maxAttempts: input.maxAttempts,
+        now: input.now,
+        sleepImpl: input.sleepImpl,
+    });
+    if (health.ok)
+        return { ok: true, code: 'switched-and-healthy', switch: switched, health, previous };
+    if (!previous.ok || !previous.resolved) {
+        return { ok: false, code: 'health-failed-after-switch', switch: switched, health, previous, rollback: null };
+    }
+    const back = await switchWithRollback({
+        linkPath: input.linkPath,
+        targetDir: previous.resolved,
+        fs: input.fs,
+        platform: input.platform,
+        now: input.now,
+    }).catch((error) => ({ ok: false, error: String(error?.message ?? error) }));
+    return { ok: false, code: 'health-failed-after-switch', switch: switched, health, previous, rollback: back };
+}

package/dist-host/index.js

@@ -17,13 +17,17 @@
  * 协作只走服务键（见 kernel.mjs FANG_SERVICE）：房主不 import 瓮城代码；瓮城服务
  * 不可用时子插件必须 fail-closed，绝不本地降级执行。
  */
-import { FANG_CONTRACT_MIN, FANG_SERVICE, MASTER_VERSION, ROLE_MATRIX, ROW, SERVICE, SUBPLUGIN_CATALOG, bearerOf, detectRole, enabledOf, jsonResponse, masterError, readJsonBody, roleAllowed, safeGet, } from "./kernel.js";
+import { AGENT_CATALOG, FANG_CONTRACT_MIN, FANG_SERVICE, MASTER_VERSION, ROLE_MATRIX, ROW, SERVICE, SUBPLUGIN_CATALOG, bearerOf, detectRole, enabledOf, jsonResponse, masterError, readJsonBody, roleAllowed, safeGet, } from "./kernel.js";
+import { randomBytes } from 'node:crypto';
 import { BRIDGE_PATH, filterEnv } from "./superagent/dispatch.js";
 import { createBridgeTokenManager } from "./superagent/bridge-tokens.js";
+import { attachCommandCenterChannel, CHANNEL_PATH } from "./channel/server.js";
 export const name = 'dsh-master';
 export const inject = [];
 /** 状态路由（Client UI 读取；只读、非敏感、loopback-only 由宿主 webServer 保证）。 */
 export const STATUS_ROUTE = '/dsh-master/api/status';
+/** 3.3.5：智囊团只读快照（交接/计划/反馈/复核）。 */
+export const DUAL_ROUTE = '/dsh-master/api/dual';
 /**
  * 房主核心 apply。
  * @param {object} ctx Cordis context
@@ -88,8 +92,104 @@ export function apply(ctx, config = {}) {
             blockedReason: active || allowed ? null : `role-not-allowed:${role}`,
         };
     });
-    const service = {
-        id: SERVICE.master,
+    /**
+     * 3.3.4：两个智能体的**可选择性**（不是“已激活”）。
+     * preset 的激活由 agentPresets 服务在会话创建时决定，这里只如实报告宿主是否有该服务。
+     */
+    const agentCards = () => {
+        const presets = safeGet(ctx, 'agentPresets');
+        const available = Boolean(presets) && typeof presets?.list === 'function';
+        return AGENT_CATALOG.map((entry) => ({
+            ...entry,
+            presetServiceAvailable: available,
+            selectable: available,
+            hint: available
+                ? '新会话创建时选择该 preset；已有会话不会被改变。'
+                : '宿主缺少 agentPresets 服务（DSH web bundle 才有），本 Host 无法选择该 preset。',
+        }));
+    };
+    /**
+     * 3.3.5：智囊团只读快照（面板数据源）。
+     * 只暴露“谁在等什么”，不暴露 token、不提供写入口；dual 未装配时给 available:false。
+     */
+    const dualSnapshot = () => {
+        const dual = safeGet(ctx, SERVICE.dual);
+        if (!dual || typeof dual.status !== 'function') {
+            return { ok: true, available: false, reason: 'dual-service-unavailable', updatedAt: Date.now(), handoffs: [], plans: [], feedbacks: [], reviews: [], loop: null };
+        }
+        const safe = (fn, fallback) => { try {
+            return fn();
+        }
+        catch {
+            return fallback;
+        } };
+        const handoffs = safe(() => dual.pm.listHandoffs().items, []);
+        const plans = safe(() => dual.pjm.listPlans().items, []);
+        const feedbacks = safe(() => dual.pjm.listFeedback().items, []);
+        const reviews = safe(() => dual.pm.listReviews().items, []);
+        return {
+            ok: true,
+            available: true,
+            updatedAt: Date.now(),
+            agents: { pm: 'master-pm', pjm: 'master-pjm' },
+            loop: safe(() => dual.status().loop, null),
+            handoffs: handoffs.map((item) => ({
+                id: item.id,
+                prdId: item.prdId,
+                title: item.title,
+                status: item.status,
+                reason: item.reason ?? null,
+                openQuestions: (item.openQuestions ?? []).slice(0, 10),
+                acceptance: (item.acceptance ?? []).slice(0, 10),
+                planId: item.planId ?? null,
+                preparedAt: item.preparedAt ?? null,
+            })),
+            plans: plans.map((plan) => {
+                const progress = safe(() => dual.pjm.progress(plan.id).progress, null);
+                const lastReport = Array.isArray(plan.reports) && plan.reports.length > 0 ? plan.reports.at(-1) : null;
+                return {
+                    id: plan.id,
+                    prdId: plan.prdId,
+                    title: plan.title,
+                    status: plan.status,
+                    handoffId: plan.handoffId ?? null,
+                    progress,
+                    lastReport: lastReport ? { status: lastReport.status, summary: lastReport.summary, blocker: lastReport.blocker ?? null, at: lastReport.at } : null,
+                    pmReview: plan.pmReview ?? null,
+                    feedbackId: plan.feedbackId ?? null,
+                };
+            }),
+            feedbacks: feedbacks.map((item) => ({
+                id: item.id,
+                planId: item.planId,
+                prdId: item.prdId ?? null,
+                createdAt: item.createdAt ?? null,
+                summary: String(item.summary ?? '').slice(0, 500),
+                metrics: item.metrics ?? null,
+                openIssues: (item.openIssues ?? []).slice(0, 10),
+            })),
+            reviews: reviews.map((review) => ({
+                id: review.id,
+                feedbackId: review.feedbackId,
+                planId: review.planId,
+                verdict: review.verdict,
+                createdAt: review.createdAt ?? null,
+                failed: (review.acceptanceChecks ?? []).filter((check) => check.met !== true).map((check) => check.criterion),
+            })),
+        };
+    };
+    /**
+     * 智能体通道 token（3.3.5）：每次加载随机生成；只读 status 暴露给同源面板。
+     * 跨站页面由 Origin 校验挡住；token 只是纵深防御，不是唯一门槛。
+     */
+    const channelToken = String(config.channelToken ?? '').trim() || randomBytes(24).toString('hex');
+    const safeOrigin = (fn) => { try {
+        return String(fn() ?? '');
+    }
+    catch {
+        return '';
+    } };
+    const service = { id: SERVICE.master,
         name: 'dsh-master',
         version: MASTER_VERSION,
         role,
@@ -135,6 +235,31 @@ export function apply(ctx, config = {}) {
                 uptimeMs: Date.now() - startedAt,
                 cooperation: cooperation(),
                 subplugins: catalog(),
+                /** 3.3.4：PM / PJM 智能体（Agent preset）清单；与子插件行分开报告。 */
+                agents: agentCards(),
+                /**
+                 * 3.3.4：智囊团只读摘要。dual-manager 未装配时给 null —— 不构造空壳假装成功。
+                 */
+                dual: (() => {
+                    const dual = safeGet(ctx, SERVICE.dual);
+                    if (!dual || typeof dual.status !== 'function')
+                        return null;
+                    try {
+                        const snapshot = dual.status();
+                        return {
+                            ok: snapshot.ok === true,
+                            agents: snapshot.agents ?? null,
+                            pm: snapshot.pm ?? null,
+                            pjm: snapshot.pjm ?? null,
+                            cooperation: snapshot.cooperation ?? null,
+                        };
+                    }
+                    catch {
+                        return null;
+                    }
+                })(),
+                /** 3.3.5：智囊团 WebSocket 通道（同源面板用；chat 目前返回具名缺口）。 */
+                channel: { path: CHANNEL_PATH, token: channelToken },
                 roleMatrix: ROLE_MATRIX,
                 bridge: {
                     enabled: Boolean(String(config.bridgeToken ?? '').trim()) || bridgeTokens.describe().tokens.length > 0,
@@ -192,6 +317,32 @@ export function apply(ctx, config = {}) {
                 catch (error) {
                     logWarn(`[dsh-master] status route registration failed: ${String(error?.message ?? error)}`);
                 }
+                // v3.3.5：智囊团只读数据源（交接 / 计划 / 反馈 / 复核）。无写口、无 token。
+                try {
+                    webServer.register({
+                        kind: 'exact',
+                        path: DUAL_ROUTE,
+                        method: 'GET',
+                        handler: async (req, res) => jsonResponse(res, 200, dualSnapshot()),
+                    });
+                }
+                catch (error) {
+                    logWarn(`[dsh-master] dual route registration failed: ${String(error?.message ?? error)}`);
+                }
+                // v3.3.5：智囊团 WebSocket 通道（双向；当前只推快照，chat 返回具名缺口）。
+                try {
+                    const channel = attachCommandCenterChannel({
+                        webServer,
+                        token: channelToken,
+                        dualSnapshot,
+                        allowedOrigin: safeOrigin(() => webServer.getOrigin?.()),
+                        logger: { info: logWarn, warn: logWarn, error: logWarn },
+                    });
+                    logWarn(`[dsh-master] command-center channel: ${channel.attached ? channel.path : `not attached (${channel.reason})`}`);
+                }
+                catch (error) {
+                    logWarn(`[dsh-master] command-center channel failed: ${String(error?.message ?? error)}`);
+                }
                 // v3.2.3：原身 Router → 母体 forker 的跨进程派发桥。
                 try {
                     webServer.register({

package/dist-host/kernel.js

@@ -7,7 +7,7 @@
  * 与瓮城 dsh-Fang 的协作只走 DSH 服务键，不 import fang 代码。
  */
 import crypto from 'node:crypto';
-export const MASTER_VERSION = '3.3.3';
+export const MASTER_VERSION = '3.3.5';
 export const FANG_CONTRACT_MIN = '3.1.14';
 export const SERVICE = Object.freeze({
     master: 'dshMaster',
@@ -57,6 +57,32 @@ export const ROW = Object.freeze({
     cost: 'master-cost-optimizer',
     dual: 'master-dual-manager',
 });
+/**
+ * 3.3.4：两个可被新会话选择的智能体（Agent preset，不是子插件行）。
+ *
+ * 与 ROLE_MATRIX 的区别：preset 决定“这个会话是谁”，角色矩阵决定“这一行在哪个角色里装配”。
+ * 两者都不改变对方；智能体自身不授予任何执行权限，工具边界写在 cordis.patch.yml 的 preset 里。
+ */
+export const AGENT_CATALOG = Object.freeze([
+    Object.freeze({
+        id: 'master-pm',
+        preset: 'master-pm',
+        name: '产品经理（PM）',
+        nameEn: 'Product Manager',
+        responsibilities: ['需求澄清与选择题请示', 'WHY/WHAT 与 PRD', '六类现状盘点（证据驱动）', '交接给 PJM', '复核/复盘/总结'],
+        tools: ['pm_create_prd', 'pm_create_assessment', 'pm_write_prd', 'pm_list_prds', 'pm_handoff_to_pjm', 'pm_review_feedback', 'pm_pipeline', 'pm_next_action'],
+        boundary: '只读代码与文档 + 向用户提问 + 写 PRD/盘点/复核；不执行、不派发、不发布。',
+    }),
+    Object.freeze({
+        id: 'master-pjm',
+        preset: 'master-pjm',
+        name: '项目经理（PJM）',
+        nameEn: 'Project Manager',
+        responsibilities: ['WBS 与七类项目管理', '接单与隔离派发', '节点自反馈', '测试/交付/验收与结案'],
+        tools: ['pjm_create_plan', 'pjm_take_handoff', 'pjm_dispatch_step', 'pjm_complete_step', 'pjm_project_status', 'pjm_check_step', 'pjm_report', 'pjm_submit_feedback', 'pjm_write_project', 'pjm_close_project', 'pjm_next_action'],
+        boundary: '只读代码 + 计划/派发/反馈；派发必须经 fangForker.spawn，无 forker 即 fail-closed；不替 PM 决定需求。',
+    }),
+]);
 export const ROLE = Object.freeze({ mother: 'mother', essence: 'essence', fork: 'fork' });
 /**
  * 角色矩阵：

package/dist-host/plugins/cost-optimizer.js

@@ -108,7 +108,7 @@ export function apply(ctx, config = {}) {
     };
     const service = {
         id: SERVICE.cost,
-        version: '3.3.3',
+        version: '3.3.5',
         role,
         get mode() {
             return system.policy.describe().mode;
@@ -354,7 +354,7 @@ export function apply(ctx, config = {}) {
             return {
                 ok: true,
                 id: 'cost-optimizer',
-                version: '3.3.3',
+                version: '3.3.5',
                 role,
                 mode: current.mode,
                 requestedMode: current.requestedMode,
@@ -396,7 +396,7 @@ export function apply(ctx, config = {}) {
                         doubleCountGuard: report.doubleCountGuard,
                     };
                 })(),
-                note: '3.3.3：系统层记账/预算/灰度/审计 + A1 工具输出紧凑化（默认 shadow）+ 瓮城回流出口（contract 1.1.1 真实投递，回执计数修复）；工具面 A2–A3 与决策复用 B1–B4 已接入（shadow 默认）；3.3.3 起角色矩阵母体全开、分身挂双主管。',
+                note: '3.3.5：系统层记账/预算/灰度/审计 + A1 工具输出紧凑化（默认 shadow）+ 瓮城回流出口（contract 1.1.1 真实投递，回执计数修复）；工具面 A2–A3 与决策复用 B1–B4 已接入（shadow 默认）；3.3.3 起角色矩阵母体全开、分身挂双主管；3.3.4 起内置 PM/PJM 两个智能体 preset；3.3.5 起补齐引擎原语、可中断 LLM 流、WS 通道与流式管线。',
             };
         },
     };