@winspan/claude-forge 8.54.3 → 9.2.0

package/dist/web/routes/insights.js

@@ -1,9 +1,114 @@
 import { AntiPatternDetector, } from '../analytics/anti-pattern-detector.js';
+import { getUserPrompt, getSubagentType } from '../../core/event-fields.js';
+import { FeedbackAggregator } from '../../daemon/services/feedback-aggregator.js';
+import { logger } from '../../core/utils/logger.js';
+/** Phase 8 feature flag — must match config-store.ts DEFAULT_FLAGS. */
+const FEEDBACK_LOOP_FLAG = 'feedback_loop.enabled';
+/** Whitelisted `apply_action.type` values — anything outside this set is rejected. */
+const APPLY_ACTION_WHITELIST = new Set([
+    // Rule actions
+    'disable_rule',
+    'tighten_threshold',
+    'loosen_threshold',
+    // Skill actions
+    'update_keywords',
+    'disable_skill',
+    'enable_skill',
+    // KB actions
+    'regenerate_module',
+    'archive_page',
+    'lower_priority',
+]);
 /**
- * /api/insights — 工作流反模式检测 API
+ * Build the forge_config key for a given action. All apply_action writes go
+ * through this helper so callers can't smuggle path traversal or arbitrary
+ * keys into the KV table.
+ */
+function buildConfigKey(actionType, targetKind, targetName) {
+    // Reject non-alphanumeric chars in target name to keep the key clean. KB
+    // page names contain '/', so we allow '/', '-', '_', '.' too. Explicitly
+    // disallow '..' anywhere in the target (path traversal guard).
+    if (!targetName || !/^[A-Za-z0-9_./-]+$/.test(targetName))
+        return null;
+    if (targetName.includes('..'))
+        return null;
+    if (targetName.startsWith('/') || targetName.startsWith('-'))
+        return null;
+    // Rule actions go under rule.<rule_id>.<setting>
+    if (actionType === 'disable_rule') {
+        return `rule.${targetName}.enabled`;
+    }
+    if (actionType === 'tighten_threshold' || actionType === 'loosen_threshold') {
+        return `rule.${targetName}.threshold_mode`;
+    }
+    // Skill actions go under skill.<skill_id>.<setting>
+    if (actionType === 'disable_skill') {
+        return `skill.${targetName}.enabled`;
+    }
+    if (actionType === 'enable_skill') {
+        return `skill.${targetName}.enabled`;
+    }
+    if (actionType === 'update_keywords') {
+        return `skill.${targetName}.keywords_pending`;
+    }
+    // KB actions go under kb.<page_name>.<setting>
+    if (actionType === 'archive_page') {
+        return `kb.${targetName}.archived`;
+    }
+    if (actionType === 'lower_priority') {
+        return `kb.${targetName}.priority`;
+    }
+    if (actionType === 'regenerate_module') {
+        return `kb.${targetName}.regenerate_pending`;
+    }
+    void targetKind;
+    return null;
+}
+/**
+ * /api/insights — 工作流反模式检测 API + 单会话全链路时间线 + Phase 8 tuning
  *
- * 扫描事件流，识别可操作的反模式（编辑循环 / 工具失败 / 无 commit / 事件爆量）。
+ * - GET /api/insights              : 扫事件流，识别反模式
+ * - GET /api/insights/timeline     : 单 session 的 prompt → injection → tool intercept →
+ *                                    tool event → skill → routing → outcome 时间线
+ * - GET /api/insights/agent-board  : routa 风格 Kanban (lanes: prompted / recommended /
+ *                                    spawned / done) 聚合 workflow_recommendations 行
+ * - GET /api/insights/tuning       : Phase 8 feedback aggregator report (flag-gated)
+ * - POST /api/insights/tuning/apply: whitelisted tuning action → forge_config row
+ */
+/**
+ * Parse the GROUP_CONCAT(metadata_json, '||') blob produced by
+ * queryAgentBoardSessions. Each chunk is a JSON array of `{name, score, refs}`
+ * objects (MVP1 KB injection shape). De-dup names, preserve insertion order,
+ * cap at 5 to keep cards compact. Result is `{name, cited}` so the UI can
+ * render "modules/daemon.md (cited 3)" style chips.
  */
+function extractKbCitedPages(concat) {
+    if (!concat)
+        return [];
+    const counts = new Map();
+    for (const chunk of concat.split('||')) {
+        if (!chunk)
+            continue;
+        try {
+            const arr = JSON.parse(chunk);
+            if (!Array.isArray(arr))
+                continue;
+            for (const hit of arr) {
+                const name = typeof hit?.name === 'string' ? hit.name : null;
+                if (!name)
+                    continue;
+                counts.set(name, (counts.get(name) ?? 0) + 1);
+            }
+        }
+        catch {
+            // ignore malformed chunks
+        }
+    }
+    return Array.from(counts.entries())
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 5)
+        .map(([name, cited]) => ({ name, cited }));
+}
 export function registerInsightsRoutes(app, ctx) {
     const { storage } = ctx;
     app.get('/api/insights', (req, res) => {
@@ -30,5 +135,681 @@ export function registerInsightsRoutes(app, ctx) {
             patterns: patterns,
         });
     });
+    // ── perf P0.4 (2026-05-25): lightweight badge endpoint ────────────────
+    //
+    // Layout.tsx polls a notification badge every 60s; the existing
+    // /api/insights endpoint runs full AntiPatternDetector (~420ms / call) and
+    // returns a fat patterns[] payload. The Layout only reads
+    // `summary.critical + summary.warn > 0`, so we offer a tiny endpoint that:
+    //   1. Caches by (days) for 30s in process memory.
+    //   2. Returns only the counts the badge actually needs.
+    //
+    // The cache is intentionally module-local (single daemon, single worker) —
+    // no need for shared cache infra. 30s ≪ user perception of "new alert".
+    const badgeCache = new Map();
+    const BADGE_TTL_MS = 30_000;
+    app.get('/api/insights/badge', (req, res) => {
+        const raw = req.query.days;
+        const days = parseInt(typeof raw === 'string' ? raw : '7', 10);
+        if (Number.isNaN(days) || days < 1 || days > 90) {
+            res.status(400).json({ error: 'days must be between 1 and 90' });
+            return;
+        }
+        const now = Date.now();
+        const hit = badgeCache.get(days);
+        if (hit && now - hit.ts < BADGE_TTL_MS) {
+            res.json({ ...hit.data, cached: true });
+            return;
+        }
+        try {
+            const detector = new AntiPatternDetector(storage);
+            const patterns = detector.detectAll(days);
+            let critical = 0;
+            let warn = 0;
+            let info = 0;
+            for (const p of patterns) {
+                if (p.severity === 'critical')
+                    critical += 1;
+                else if (p.severity === 'warn')
+                    warn += 1;
+                else
+                    info += 1;
+            }
+            // v6 Batch 1: 3 daemon-observer counters. Each is a single COUNT(*) so
+            // the badge endpoint stays cheap (and is still 30s-cached). If any one
+            // throws we surface 0 rather than fail the whole badge — the chip group
+            // is informational.
+            const sinceIso = new Date(now - days * 86400_000).toISOString();
+            let denied_7d = 0;
+            let hinted_7d = 0;
+            let trivial_passed_7d = 0;
+            try {
+                denied_7d = storage.queryInterceptDecisionCounts(sinceIso).denied;
+            }
+            catch (e) {
+                logger.warn(`[Insights] badge denied_7d failed: ${e}`);
+            }
+            try {
+                hinted_7d = storage.countDecisionsSince(sinceIso);
+            }
+            catch (e) {
+                logger.warn(`[Insights] badge hinted_7d failed: ${e}`);
+            }
+            try {
+                trivial_passed_7d = storage.countTrivialTasksSince(sinceIso);
+            }
+            catch (e) {
+                logger.warn(`[Insights] badge trivial_passed_7d failed: ${e}`);
+            }
+            const data = {
+                hasUnread: critical + warn > 0,
+                criticalCount: critical,
+                warnCount: warn,
+                infoCount: info,
+                total: patterns.length,
+                windowDays: days,
+                cached: false,
+                generatedAt: new Date(now).toISOString(),
+                denied_7d,
+                hinted_7d,
+                trivial_passed_7d,
+            };
+            badgeCache.set(days, { ts: now, data });
+            res.json(data);
+        }
+        catch (err) {
+            logger.warn(`[Insights] badge query failed: ${err}`);
+            res.status(500).json({ error: 'BADGE_FAILED', message: String(err) });
+        }
+    });
+    /**
+     * GET /api/insights/timeline?session_id=<id>[&limit=N]
+     *
+     * 一条 session 的全链路：prompt → injection → tool intercept → tool event →
+     * skill → routing → outcome。每条流默认取最近 500 行（per-stream cap），
+     * 真正分页留给 Phase 8。
+     *
+     * 不预聚合 — 前端组件自行 merge & sort by ts。
+     */
+    app.get('/api/insights/timeline', (req, res) => {
+        const sessionIdRaw = typeof req.query.session_id === 'string' ? req.query.session_id.trim() : '';
+        if (!sessionIdRaw) {
+            res.status(400).json({ error: 'session_id required' });
+            return;
+        }
+        // Phase 3: per-stream cap (default 500). Hard ceiling 2000 to keep response
+        // memory bounded; cursor-style pagination is Phase 8 work.
+        const requestedLimit = parseInt(typeof req.query.limit === 'string' ? req.query.limit : '500', 10);
+        const limit = Math.min(Math.max(Number.isFinite(requestedLimit) ? requestedLimit : 500, 1), 2000);
+        // Accept short prefixes (>=8 chars) the same way SessionDetail does.
+        const session = storage.getSessionWithMetrics(sessionIdRaw);
+        if (!session) {
+            res.status(404).json({ error: 'session not found' });
+            return;
+        }
+        const fullId = session.session_id;
+        // audit F5: switch to queryEventsTimeline (drops tool_output / ai_response
+        // from SELECT). PostToolUse rows on tool-heavy sessions can carry MB of
+        // tool_output that the timeline UI never reads — pulling them through
+        // JSON.parse + serialising back over the wire was the dominant cost.
+        const promptEvents = storage.queryEventsTimeline({
+            session_id: fullId,
+            hook_type: 'UserPromptSubmit',
+            limit,
+        });
+        const postToolEvents = storage.queryEventsTimeline({
+            session_id: fullId,
+            hook_type: 'PostToolUse',
+            limit,
+        });
+        const injections = storage.queryInjections({ session_id: fullId, limit });
+        const toolIntercepts = storage.queryToolIntercepts({ session_id: fullId, limit });
+        const skillInvocations = storage.querySkillInvocations({ session_id: fullId, limit });
+        const routingEvents = storage.queryRoutingEvents({ session_id: fullId, limit });
+        // ── Shape the response: each stream is its own array; let the UI merge ──
+        const prompts = promptEvents.map(e => ({
+            event_id: e.event_id ?? null,
+            timestamp: e.timestamp,
+            prompt: (getUserPrompt(e) ?? '').slice(0, 1000),
+        }));
+        const injectionRows = injections.map(inj => ({
+            id: inj.id ?? null,
+            event_id: inj.event_id ?? null,
+            timestamp: inj.timestamp,
+            source_handler: inj.source_handler,
+            injection_type: inj.injection_type,
+            content_preview: inj.content.slice(0, 400),
+            content_length: inj.content.length,
+            metadata_json: inj.metadata_json ?? null,
+        }));
+        const interceptRows = toolIntercepts.map(t => ({
+            id: t.id,
+            event_id: t.event_id,
+            timestamp: t.timestamp,
+            tool_name: t.tool_name,
+            tool_input_summary: t.tool_input_summary,
+            rule_id: t.rule_id,
+            decision: t.decision,
+            hint: t.hint,
+            outcome: t.outcome,
+        }));
+        // Tool events: surface PostToolUse with a small summary. Agent spawns are
+        // worth highlighting (subagent_type) so the UI can colour them differently.
+        const toolEventRows = postToolEvents
+            .filter(e => !!e.tool_name)
+            .map(e => {
+            const subagent = getSubagentType(e);
+            // Keep tool_input small for transport. Anything > 300 char gets a
+            // {truncated:true} marker so the UI knows the preview is partial.
+            let summary = null;
+            try {
+                const json = JSON.stringify(e.tool_input ?? {});
+                summary = json.length > 300 ? { truncated: true, preview: json.slice(0, 300) } : e.tool_input ?? null;
+            }
+            catch {
+                summary = null;
+            }
+            return {
+                event_id: e.event_id ?? null,
+                timestamp: e.timestamp,
+                tool_name: e.tool_name,
+                subagent_type: subagent ?? null,
+                tool_input_summary: summary,
+            };
+        });
+        const skillRows = skillInvocations.map(s => ({
+            id: s.id,
+            // skill_invocations.timestamp is unix ms — convert to ISO for the UI to
+            // sort alongside the string-based timestamps from other streams.
+            timestamp: new Date(s.timestamp).toISOString(),
+            skill_id: s.skill_id,
+            invocation_type: s.invocation_type,
+            workflow: s.workflow,
+            phase: s.phase,
+            success: s.success === 1,
+            reason: s.reason,
+        }));
+        const routingRows = routingEvents.map(r => ({
+            id: r.id,
+            timestamp: new Date(r.ts).toISOString(),
+            routed_to_type: r.routed_to_type ?? null,
+            routed_to_name: r.routed_to_name ?? null,
+            obeyed: r.obeyed,
+            refusal_reason: r.refusal_reason ?? null,
+            first_tool_name: r.first_tool_name ?? null,
+        }));
+        res.json({
+            session: {
+                session_id: session.session_id,
+                project_path: session.project_path,
+                first_prompt: session.first_prompt,
+                start_time: session.start_time,
+                end_time: session.end_time,
+                event_count: session.event_count,
+                outcome: session.outcome,
+                outcome_reason: session.outcome_reason,
+                intercept_count: session.intercept_count,
+                kb_inject_count: session.kb_inject_count,
+                skill_match_count: session.skill_match_count,
+            },
+            prompts,
+            injections: injectionRows,
+            tool_intercepts: interceptRows,
+            tool_events: toolEventRows,
+            skills: skillRows,
+            routing: routingRows,
+            meta: {
+                limit,
+                capped: {
+                    prompts: prompts.length === limit,
+                    injections: injectionRows.length === limit,
+                    tool_intercepts: interceptRows.length === limit,
+                    tool_events: toolEventRows.length === limit,
+                    skills: skillRows.length === limit,
+                    routing: routingRows.length === limit,
+                },
+            },
+        });
+    });
+    // ── Task-centric Kanban: GET /api/insights/agent-board (v3, 2026-05-22) ───
+    //
+    // v1 (workflow_recommendation lifecycle) — too abstract.
+    // v2 (session-centric) — sessions are execution traces, not work items;
+    //                        synthetic / test sessions cluttered the board.
+    // v3 (task-centric)   — each card = one `tasks` row (TaskSegmenter auto-
+    //                        splits sessions on user prompts). This is the real
+    //                        "what was the user trying to do" unit of work.
+    //
+    // Lanes (priority by status + event_count):
+    //   - status='completed'  → 完成 (border colour by outcome)
+    //   - status='abandoned'  → 中断
+    //   - status='active' AND event_count < 3  → 待处理 (just kicked off, no动作)
+    //   - status='active' AND event_count >= 3 → 进行中
+    //
+    // Noise filter (server-side via SQL): drop title=='<task-notification>%',
+    // length<8, pure 应答 ('yes','ok','好',...), and single-word slash commands.
+    app.get('/api/insights/agent-board', (req, res) => {
+        const windowRaw = typeof req.query.window === 'string' ? parseInt(req.query.window, 10) : 7;
+        const windowDays = Number.isFinite(windowRaw) ? Math.min(Math.max(windowRaw, 1), 90) : 7;
+        const projectRaw = typeof req.query.project === 'string' ? req.query.project.trim() : '';
+        const projectPath = projectRaw && /^[A-Za-z0-9_./\\:-]+$/.test(projectRaw) ? projectRaw : '';
+        // Default lowered 120 → 40 (2026-05-25) — user feedback: "Task Lane 那么卡"。
+        // Each card runs 5 sub-queries server-side and ~7 chip renders client-side,
+        // so 120 cards × 7 chips × 4 lanes ~ 3.4k DOM nodes on first paint. 40
+        // covers ≥1 day of typical activity with a 7-day window; UI shows "已展示
+        // 前 30 / 共 N 张" so users still see the total. Hard cap stays 300.
+        const limitRaw = typeof req.query.limit === 'string' ? parseInt(req.query.limit, 10) : 40;
+        const limit = Number.isFinite(limitRaw) ? Math.min(Math.max(limitRaw, 1), 300) : 40;
+        // 2026-05-26: server-side pagination for the list view. The lanes payload
+        // is still capped at `limit` per request, but `offset` lets the frontend
+        // page through the unbounded set. Kanban view always passes offset=0 (or
+        // omits it) so its semantics stay unchanged. List view paginator drives
+        // offset = (page - 1) * pageSize.
+        const offsetRaw = typeof req.query.offset === 'string' ? parseInt(req.query.offset, 10) : 0;
+        const offset = Number.isFinite(offsetRaw) ? Math.max(offsetRaw, 0) : 0;
+        // Task-tracking overhaul (2026-05-27 spec §3.2 / §5.E): audit param to
+        // surface is_noise=1 rows. Q2 (user-approved): NO UI toggle ships in
+        // this overhaul — the param is for SQL audit / curl. Defaults false so
+        // the production dashboard stays clean.
+        const includeNoise = req.query.include_noise === '1' || req.query.include_noise === 'true';
+        // spec b1480935 (2026-06-01 Option A): ?include_kinds=user,agent-callback,...
+        // — granular per-kind opt-in for the TasksHubPage "含系统任务" chip. Falls
+        // back to includeNoise (legacy ?include_noise=1 maps to all 4 kinds) and
+        // finally defaults to user-only. Whitelist enforced so an attacker can't
+        // pass a SQL fragment.
+        const KIND_WHITELIST = [
+            'user', 'agent-callback', 'image', 'system',
+        ];
+        const includeKindsRaw = typeof req.query.include_kinds === 'string'
+            ? req.query.include_kinds
+            : '';
+        let includeKinds;
+        if (includeKindsRaw) {
+            const parsed = includeKindsRaw.split(',')
+                .map(s => s.trim())
+                .filter((s) => KIND_WHITELIST.includes(s));
+            if (parsed.length > 0)
+                includeKinds = parsed;
+        }
+        // ── decision b509fd91 (2026-06-08): ?rows=prompt mode ────────────────
+        //
+        // P1 方案 B (zero schema): "一行 = 一条 user prompt + 按 task 分组". The
+        // default (no ?rows= or ?rows=task) keeps the legacy task-lane shape so
+        // kanban / other callers are unaffected (backward compatible). When
+        // ?rows=prompt, we return逐条 prompt 行 + a group-metadata map keyed by
+        // task_id. Reuses the SAME window / project / limit / offset / kind parsing
+        // above so query semantics stay aligned with the task-row path.
+        const rowsMode = req.query.rows === 'prompt' ? 'prompt' : 'task';
+        if (rowsMode === 'prompt') {
+            let promptRows;
+            let totalPromptRows = 0;
+            try {
+                promptRows = storage.queryAgentBoardPromptRows({
+                    windowDays,
+                    projectPath: projectPath || undefined,
+                    limit,
+                    offset,
+                    includeNoise,
+                    includeKinds,
+                });
+                totalPromptRows = storage.countAgentBoardPromptRows({
+                    windowDays,
+                    projectPath: projectPath || undefined,
+                    includeNoise,
+                    includeKinds,
+                });
+            }
+            catch (err) {
+                logger.warn(`[Insights] agent-board (rows=prompt) query failed: ${err}`);
+                res.status(500).json({ error: 'AGENT_BOARD_QUERY_FAILED', message: String(err) });
+                return;
+            }
+            function classifyGroupLane(status, eventCount) {
+                if (status === 'completed')
+                    return 'completed';
+                if (status === 'abandoned')
+                    return 'abandoned';
+                if (eventCount < 3)
+                    return 'pending';
+                return 'active';
+            }
+            const outRows = [];
+            const groups = {};
+            for (const r of promptRows) {
+                outRows.push({
+                    event_id: r.event_id,
+                    prompt_text: r.prompt_text.slice(0, 300),
+                    prompt_ts: r.prompt_ts,
+                    session_id: r.session_id,
+                    project_path: r.project_path,
+                    group_id: r.group_id,
+                });
+                const existing = groups[r.group_id];
+                if (existing) {
+                    existing.prompt_count += 1;
+                }
+                else {
+                    groups[r.group_id] = {
+                        title: (r.group_title ?? '').slice(0, 200),
+                        status: r.group_status,
+                        outcome: r.group_outcome,
+                        lane: classifyGroupLane(r.group_status, r.group_event_count),
+                        task_kind: r.group_task_kind,
+                        start_time: r.group_start_time,
+                        end_time: r.group_end_time,
+                        duration_sec: r.group_duration_sec,
+                        prompt_count: 1,
+                    };
+                }
+            }
+            // KPI counts deduped by group (OQ3): a task with N prompts must not
+            // inflate "总任务数". by_outcome / by_lane count distinct groups.
+            const byOutcome = {};
+            const byLane = {
+                pending: 0, active: 0, abandoned: 0, completed: 0,
+            };
+            for (const g of Object.values(groups)) {
+                byLane[g.lane] += 1;
+                if (g.outcome)
+                    byOutcome[g.outcome] = (byOutcome[g.outcome] ?? 0) + 1;
+            }
+            res.json({
+                generated_at: new Date().toISOString(),
+                window_days: windowDays,
+                project: projectPath || null,
+                mode: 'prompt',
+                // total_in_window = total PROMPT rows in window (paginator denominator).
+                total_in_window: totalPromptRows,
+                limit,
+                offset,
+                rows: outRows,
+                groups,
+                summary: {
+                    // group-deduped counts so KPIs keep "总任务数" semantics stable.
+                    total_groups: Object.keys(groups).length,
+                    total_rows: outRows.length,
+                    by_lane: byLane,
+                    by_outcome: byOutcome,
+                },
+            });
+            return;
+        }
+        let rows;
+        let totalInWindow = 0;
+        try {
+            rows = storage.queryAgentBoardTasks({
+                windowDays,
+                projectPath: projectPath || undefined,
+                limit,
+                offset,
+                includeNoise,
+                includeKinds,
+            });
+            // Unbounded count for the "总任务数 (7d)" KPI. Same WHERE filter as the
+            // lane query so the number is consistent with "what could appear in
+            // the board if you removed the perf cap". Added 2026-05-26 — fixes
+            // KPI stuck at 40 (=limit) regardless of true task volume.
+            // 2026-05-27: includeNoise param propagated so audit callers
+            // (?include_noise=1) see a count matching the lane rows.
+            // 2026-06-01 (spec b1480935): includeKinds added.
+            totalInWindow = storage.countAgentBoardTasks({
+                windowDays,
+                projectPath: projectPath || undefined,
+                includeNoise,
+                includeKinds,
+            });
+        }
+        catch (err) {
+            logger.warn(`[Insights] agent-board (v3) query failed: ${err}`);
+            res.status(500).json({ error: 'AGENT_BOARD_QUERY_FAILED', message: String(err) });
+            return;
+        }
+        function parseJsonArray(s) {
+            if (!s)
+                return [];
+            try {
+                const v = JSON.parse(s);
+                return Array.isArray(v) ? v : [];
+            }
+            catch {
+                return [];
+            }
+        }
+        function classifyLane(status, eventCount) {
+            if (status === 'completed')
+                return 'completed';
+            if (status === 'abandoned')
+                return 'abandoned';
+            if (eventCount < 3)
+                return 'pending';
+            return 'active';
+        }
+        const cards = rows.map(r => ({
+            task_id: r.id,
+            session_id: r.session_id,
+            project_path: r.project_path ?? null,
+            title: (r.title ?? '').slice(0, 200),
+            start_time: r.start_time,
+            end_time: r.end_time,
+            status: r.status,
+            duration_sec: r.duration_sec ?? null,
+            event_count: r.event_count ?? 0,
+            outcome: r.outcome,
+            outcome_reason: r.outcome_reason,
+            top_tools: parseJsonArray(r.top_tools_json),
+            spawned_agents: parseJsonArray(r.spawned_json),
+            kb_pages: extractKbCitedPages(r.kb_meta_concat),
+            files_changed: r.files_changed ?? 0,
+            last_file: r.last_file ?? null,
+            intercepts: {
+                deny: r.deny_count ?? 0,
+                warn: r.warn_count ?? 0,
+            },
+            commit_count: r.commit_count ?? 0,
+            reverted_commits: r.reverted_commits ?? 0,
+            user_violation_count: r.user_violation_count ?? 0,
+            task_kind: r.task_kind ?? 'user',
+        }));
+        const lanes = {
+            pending: [],
+            active: [],
+            abandoned: [],
+            completed: [],
+        };
+        const byOutcome = {};
+        for (const c of cards) {
+            const lane = classifyLane(c.status, c.event_count);
+            lanes[lane].push(c);
+            if (c.outcome)
+                byOutcome[c.outcome] = (byOutcome[c.outcome] ?? 0) + 1;
+        }
+        res.json({
+            generated_at: new Date().toISOString(),
+            window_days: windowDays,
+            project: projectPath || null,
+            // Unbounded count for KPI "总任务数 (7d)". summary.total only reflects
+            // returned cards (capped at limit). Frontend should prefer this field.
+            total_in_window: totalInWindow,
+            // Echo pagination params so the client can compute total pages without
+            // re-parsing its own URL state. limit/offset added 2026-05-26.
+            limit,
+            offset,
+            lanes,
+            summary: {
+                total: cards.length,
+                by_lane: {
+                    pending: lanes.pending.length,
+                    active: lanes.active.length,
+                    abandoned: lanes.abandoned.length,
+                    completed: lanes.completed.length,
+                },
+                by_outcome: byOutcome,
+            },
+        });
+    });
+    // ── /api/insights/commit-activity — daily commit + task activity (2026-05-26)
+    //
+    // Returns unbounded daily buckets straight off `tasks` table (DATE(start_time)
+    // GROUP BY). Drives HealthHomePage 30d Commit calendar without the lane LIMIT
+    // undercount that the agent-board path suffered for high-volume days.
+    //
+    // Response shape:
+    //   { generated_at, days, project,
+    //     daily: [{ date: 'YYYY-MM-DD', total, succeeded, failed, commits }, ...],
+    //     total_tasks, total_commits }
+    //
+    // Implemented for the 30d calendar but the `?days=N` knob accepts [1,365] for
+    // future use. No `limit` — the data is small (<= 365 rows of 5 ints each).
+    app.get('/api/insights/commit-activity', (req, res) => {
+        const daysRaw = typeof req.query.days === 'string' ? parseInt(req.query.days, 10) : 30;
+        const days = Number.isFinite(daysRaw) ? Math.min(Math.max(daysRaw, 1), 365) : 30;
+        const projectRaw = typeof req.query.project === 'string' ? req.query.project.trim() : '';
+        const projectPath = projectRaw && /^[A-Za-z0-9_./\\:-]+$/.test(projectRaw) ? projectRaw : '';
+        let daily;
+        try {
+            daily = storage.queryCommitActivityDaily({
+                days,
+                projectPath: projectPath || undefined,
+            });
+        }
+        catch (err) {
+            logger.warn(`[Insights] commit-activity query failed: ${err}`);
+            res.status(500).json({ error: 'COMMIT_ACTIVITY_QUERY_FAILED', message: String(err) });
+            return;
+        }
+        const totalTasks = daily.reduce((s, d) => s + d.total, 0);
+        const totalCommits = daily.reduce((s, d) => s + d.commits, 0);
+        res.json({
+            generated_at: new Date().toISOString(),
+            days,
+            project: projectPath || null,
+            daily,
+            total_tasks: totalTasks,
+            total_commits: totalCommits,
+        });
+    });
+    // ── Phase 8: GET /api/insights/tuning ─────────────────────────────────
+    //
+    // Returns {generated_at, window_days, suggestions[], summary{...}}. Flag
+    // `feedback_loop.enabled` gates access — 410 Gone when off so the front-end
+    // can show the "enable me" hint without erroring out the SPA fetch.
+    app.get('/api/insights/tuning', (req, res) => {
+        const enabled = storage.readConfig(FEEDBACK_LOOP_FLAG) === 'true';
+        if (!enabled) {
+            // F17: include `reason` + `enable_cmd` so the SPA can render a copy-able
+            // hint instead of a bare error code. `error` kept as FEATURE_DISABLED for
+            // backward-compat with InsightsTuning.tsx's discriminator.
+            res.status(410).json({
+                error: 'FEATURE_DISABLED',
+                reason: 'flag_off',
+                flag: FEEDBACK_LOOP_FLAG,
+                enable_cmd: `cf config set ${FEEDBACK_LOOP_FLAG} true && cf daemon restart`,
+                message: 'Enable with `cf config set feedback_loop.enabled true` and restart the daemon.',
+            });
+            return;
+        }
+        const windowRaw = typeof req.query.window === 'string' ? parseInt(req.query.window, 10) : 7;
+        const windowDays = windowRaw === 30 ? 30 : 7;
+        try {
+            const aggregator = new FeedbackAggregator(storage);
+            const report = aggregator.generateReport({ windowDays });
+            res.json(report);
+        }
+        catch (err) {
+            logger.warn(`[Insights] tuning report failed: ${err}`);
+            res.status(500).json({ error: 'TUNING_REPORT_FAILED', message: String(err) });
+        }
+    });
+    // ── Phase 8: POST /api/insights/tuning/apply ─────────────────────────
+    //
+    // Whitelisted action types only. Each action becomes a single forge_config
+    // row write — NEVER a CLAUDE.md / skill .md / KB .md mutation. The CLI /
+    // future hook layer reads these keys back to actually act on them.
+    //
+    // Body shape:
+    //   {
+    //     kind: 'rule_tuning' | 'skill_tuning' | 'kb_tuning',
+    //     target: '<rule_id|skill_id|page_name>',
+    //     action_type: '<one of APPLY_ACTION_WHITELIST>',
+    //     payload?: {...}                  // currently ignored by writer
+    //   }
+    app.post('/api/insights/tuning/apply', (req, res) => {
+        const enabled = storage.readConfig(FEEDBACK_LOOP_FLAG) === 'true';
+        if (!enabled) {
+            // F17: mirror the structure used by GET /tuning so the mutation onError
+            // handler can surface a copy-able enable command.
+            res.status(410).json({
+                error: 'FEATURE_DISABLED',
+                reason: 'flag_off',
+                flag: FEEDBACK_LOOP_FLAG,
+                enable_cmd: `cf config set ${FEEDBACK_LOOP_FLAG} true && cf daemon restart`,
+                message: 'Tuning apply requires the feedback loop flag to be ON.',
+            });
+            return;
+        }
+        const body = (req.body ?? {});
+        const kind = typeof body.kind === 'string' ? body.kind : '';
+        const target = typeof body.target === 'string' ? body.target.trim() : '';
+        const actionType = typeof body.action_type === 'string' ? body.action_type : '';
+        if (!kind || !target || !actionType) {
+            res.status(400).json({ error: 'kind, target and action_type are required' });
+            return;
+        }
+        if (!APPLY_ACTION_WHITELIST.has(actionType)) {
+            res.status(400).json({
+                error: 'INVALID_ACTION',
+                message: `action_type '${actionType}' is not whitelisted`,
+                allowed: Array.from(APPLY_ACTION_WHITELIST),
+            });
+            return;
+        }
+        const key = buildConfigKey(actionType, kind, target);
+        if (!key) {
+            res.status(400).json({
+                error: 'INVALID_TARGET',
+                message: 'target name failed validation (must match [A-Za-z0-9_./-]+)',
+            });
+            return;
+        }
+        // Choose the value to persist based on action semantics. We keep this
+        // hard-coded (no body-driven values) so a malicious caller can't write
+        // anything but the canonical disable/enable/queue markers.
+        let value;
+        if (actionType === 'disable_rule' || actionType === 'disable_skill' || actionType === 'archive_page') {
+            value = 'false';
+        }
+        else if (actionType === 'enable_skill') {
+            value = 'true';
+        }
+        else if (actionType === 'tighten_threshold') {
+            value = 'tight';
+        }
+        else if (actionType === 'loosen_threshold') {
+            value = 'loose';
+        }
+        else if (actionType === 'lower_priority') {
+            value = 'low';
+        }
+        else if (actionType === 'regenerate_module' || actionType === 'update_keywords') {
+            // These are deferred: writing the marker key here just queues the work
+            // for a later `cf knowledge build --module=<name>` invocation.
+            value = new Date().toISOString();
+        }
+        else {
+            // Unreachable thanks to the whitelist check above, but TypeScript wants
+            // a definite assignment.
+            res.status(500).json({ error: 'UNHANDLED_ACTION' });
+            return;
+        }
+        try {
+            storage.writeConfig(key, value);
+            logger.info(`[Insights] Applied tuning: ${actionType} on ${target} → ${key}=${value}`);
+            res.json({ ok: true, applied: { key, value, action_type: actionType, target, kind } });
+        }
+        catch (err) {
+            logger.warn(`[Insights] tuning apply failed: ${err}`);
+            res.status(500).json({ error: 'APPLY_FAILED', message: String(err) });
+        }
+    });
 }
 //# sourceMappingURL=insights.js.map