@zhin.js/host-http 1.0.0 → 1.0.2

package/lib/console-rpc.js

@@ -1,42 +1,5 @@
+import { assertDemoConsoleRpcAllowed, endpointSendResult, normalizeConsoleRpcMessage, } from '@zhin.js/console-protocol';
 import { dispatchExtendedConsoleRpc } from './console-rpc-extended.js';
-/**
- * Frontend SDK (@zhin.js/client) calls colon-named aliases; normalize to the
- * canonical dot names before scope checks and dispatch. Alias parameter shapes
- * (`data.{adapter, endpointId, id, type, content, parent}`) are mapped onto the
- * `$`-prefixed fields inside each endpoint case.
- */
-const RPC_TYPE_ALIASES = Object.freeze({
-    'endpoint:list': 'endpoint.list',
-    'endpoint:info': 'endpoint.info',
-    'endpoint:sendMessage': 'endpoint.send_message',
-});
-/** ADR 0016 demo allowlist subset available on Plugin Runtime Host. */
-const DEMO_RPC_ALLOWLIST = new Set([
-    'ping',
-    'entries:get',
-    'pages:list',
-    'config:get',
-    'config:get-all',
-    'config:get-yaml',
-    'schema:get',
-    'schema:get-all',
-    'endpoint.list',
-    'endpoint.info',
-    'endpoint.send_message',
-]);
-const DEMO_RPC_WRITE_BLOCKLIST = new Set([
-    'config:set',
-    'config:save-yaml',
-    'files:save',
-    'env:save',
-    'db:insert',
-    'db:update',
-    'db:delete',
-    'db:drop-table',
-    'db:kv:set',
-    'db:kv:delete',
-    'system:restart',
-]);
 export function pickRpcReply(message, payloads) {
     const requestId = message.requestId;
     return ((requestId != null ? payloads.find((payload) => payload.requestId === requestId) : undefined)
@@ -48,11 +11,19 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
     const emit = (payload) => {
         payloads.push(payload);
     };
-    const type = RPC_TYPE_ALIASES[String(message.type ?? '')] ?? String(message.type ?? '');
+    message = normalizeConsoleRpcMessage(message);
+    const type = String(message.type ?? '');
     const requestId = message.requestId;
-    // Extended RPC surface (cron/schedule、endpoint 社交/inbox) — 自带 scope 矩阵
+    if (ctx.authScope === 'demo') {
+        const denied = assertDemoConsoleRpcAllowed(type);
+        if (denied) {
+            emit({ requestId, error: denied });
+            return payloads;
+        }
+    }
+    // Extended RPC surface (cron/schedule、endpoint 社交/inbox)
     if (ctx.extended) {
-        const extended = await dispatchExtendedConsoleRpc(type, message.data, { ...ctx.extended, fullScope: ctx.authScope === 'full' });
+        const extended = await dispatchExtendedConsoleRpc(type, message, { ...ctx.extended, fullScope: ctx.authScope === 'full' });
         if (extended !== undefined) {
             emit('error' in extended
                 ? { requestId, error: extended.error }
@@ -60,10 +31,6 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
             return payloads;
         }
     }
-    if (ctx.authScope === 'demo' && (DEMO_RPC_WRITE_BLOCKLIST.has(type) || !DEMO_RPC_ALLOWLIST.has(type))) {
-        emit({ requestId, error: `Demo scope: RPC "${type}" is forbidden` });
-        return payloads;
-    }
     switch (type) {
         case 'ping':
             emit({ type: 'pong', requestId });
@@ -118,7 +85,9 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'config:get': {
             try {
-                const key = String(message.key ?? message.pluginName ?? '');
+                // 兼容 console UI 的 data:{plugin} / data:{key} 形状
+                const data = (message.data ?? {});
+                const key = String(message.key ?? message.pluginName ?? data.pluginName ?? data.plugin ?? data.key ?? '');
                 const document = ctx.readConfigDocument ? await ctx.readConfigDocument() : {};
                 emit({ requestId, data: key ? document[key] : document });
             }
@@ -142,6 +111,7 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     return payloads;
                 }
                 await ctx.writeConfigYaml(yaml);
+                ctx.publishEvent?.('config:updated', { pluginName: null, keys: [] });
                 emit({
                     requestId,
                     data: { success: true, message: '配置已保存，需重启生效' },
@@ -167,6 +137,12 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     return payloads;
                 }
                 const result = await ctx.setConfigKey(pluginName, message.data);
+                ctx.publishEvent?.('config:updated', {
+                    pluginName,
+                    keys: message.data && typeof message.data === 'object' && !Array.isArray(message.data)
+                        ? Object.keys(message.data)
+                        : [],
+                });
                 emit({
                     requestId,
                     data: {
@@ -312,7 +288,10 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'schema:get': {
             try {
-                const pluginName = typeof message.pluginName === 'string' ? message.pluginName : undefined;
+                // 兼容 console UI 的 data:{plugin} / data:{pluginName} 形状（SDK 发顶层 pluginName）
+                const data = (message.data ?? {});
+                const candidate = message.pluginName ?? data.pluginName ?? data.plugin;
+                const pluginName = typeof candidate === 'string' ? candidate : undefined;
                 const schema = ctx.getSchema ? await ctx.getSchema(pluginName) : null;
                 emit({ requestId, data: schema });
             }
@@ -544,10 +523,9 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'endpoint.info': {
             try {
-                const data = (message.data ?? {});
-                // Accept both canonical `$`-fields and the SDK colon-alias shape.
-                const adapter = String(data.$adapter ?? data.adapter ?? '');
-                const endpointId = String(data.$endpoint ?? data.endpointId ?? '');
+                const data = message;
+                const adapter = String(data.$adapter ?? '');
+                const endpointId = String(data.$endpoint ?? '');
                 if (!adapter || !endpointId) {
                     emit({ requestId, error: '$adapter and $endpoint required' });
                     return payloads;
@@ -573,14 +551,12 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'endpoint.send_message': {
             try {
-                const data = (message.data ?? {});
-                // Accept both canonical `$`-fields and the SDK colon-alias shape
-                // (`endpoint:sendMessage` → data.{adapter, endpointId, id, type, content, parent}).
-                const adapter = String(data.$adapter ?? data.adapter ?? '');
-                const endpointId = String(data.$endpoint ?? data.endpointId ?? '');
-                const channelId = String(data.$channel_id ?? data.id ?? '');
-                const channelType = String(data.$channel_type ?? data.type ?? '');
-                const content = data.$content !== undefined ? data.$content : data.content;
+                const data = message;
+                const adapter = String(data.$adapter ?? '');
+                const endpointId = String(data.$endpoint ?? '');
+                const channelId = String(data.$channel_id ?? '');
+                const channelType = String(data.$channel_type ?? '');
+                const content = data.$content;
                 // channelType is optional: ImRuntime tolerates an empty value and
                 // targets the bare channel id (parity with the legacy RPC handler).
                 if (!adapter || !endpointId || !channelId || content === undefined) {
@@ -600,10 +576,10 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     channelId,
                     channelType,
                     content,
-                    parent: (data.$parent ?? data.parent),
+                    parent: data.$parent,
                 });
                 // Legacy contract: { message_id }. Keep messageId for new callers.
-                emit({ requestId, data: { message_id: result.messageId, messageId: result.messageId } });
+                emit({ requestId, data: endpointSendResult(result.messageId) });
             }
             catch (error) {
                 emit({
@@ -619,6 +595,7 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     emit({ requestId, error: 'Process restart is not configured' });
                     return payloads;
                 }
+                ctx.publishEvent?.('system:restarting', { timestamp: Date.now() });
                 emit({ requestId, data: { success: true, message: '正在重启...' } });
                 // Delay so the HTTP response can flush (parity with legacy host-api).
                 setTimeout(() => {

package/lib/index.d.ts

@@ -1,8 +1,10 @@
 export { createHttpHost, httpHostToken, REMOTE_CONSOLE_ORIGIN, type HttpHandler, type HttpHost, type HttpHostAddress, type HttpHostOptions, type HttpRouteRegistration, type WsConnection, type WsHandle, } from './http-host.js';
 export { TokenRegistry, extractBearerToken, isDemoWebSocketPath, type AuthScope, type ScopedTokenConfig, type TokenRegistryConfig, } from './token-registry.js';
 export { timingSafeEqualString } from './timing-safe-equal.js';
+export { createConsoleEventHub, type ConsoleEventHub, } from './console-events.js';
 export { buildOpenApiDocument, patternToOpenApiPath, routeRequiresBearerAuth, type BuildOpenApiOptions, type ListedRoute, type OpenApiParameter, type RouteMeta, } from './openapi.js';
 export { HttpBodyError, readJsonBody, } from './json-body.js';
 export { dispatchRuntimeConsoleRpc, isDemoHttpAllowed, pickRpcReply, type RuntimeConsolePage, type RuntimeConsoleRpcContext, type RuntimeConsoleRpcMessage, type RuntimeConsoleRpcReply, type RuntimeEndpointSendInput, type RuntimeEndpointSummary, } from './console-rpc.js';
 export { buildProjectFileTree, FILE_MANAGER_ALLOWED, FILE_MANAGER_BLOCKED, isProjectPathAllowed, listEnvFiles, readProjectFile, saveProjectFile, type FileTreeNode, } from './project-files.js';
 export { registerConsoleRestPages, type ConsoleAgentIntrospection, type ConsoleAgentRuntime, type ConsoleAgentSessionTree, type ConsoleRestCtx, type ConsoleRestPagesOptions, } from './console-rest-pages.js';
+export { dispatchExtendedConsoleRpc, type ConsoleRpcExtendedCtx, type ConsoleScheduleEngine, type ExtendedRpcResult, } from './console-rpc-extended.js';

package/lib/index.js

@@ -1,8 +1,10 @@
 export { createHttpHost, httpHostToken, REMOTE_CONSOLE_ORIGIN, } from './http-host.js';
 export { TokenRegistry, extractBearerToken, isDemoWebSocketPath, } from './token-registry.js';
 export { timingSafeEqualString } from './timing-safe-equal.js';
+export { createConsoleEventHub, } from './console-events.js';
 export { buildOpenApiDocument, patternToOpenApiPath, routeRequiresBearerAuth, } from './openapi.js';
 export { HttpBodyError, readJsonBody, } from './json-body.js';
 export { dispatchRuntimeConsoleRpc, isDemoHttpAllowed, pickRpcReply, } from './console-rpc.js';
 export { buildProjectFileTree, FILE_MANAGER_ALLOWED, FILE_MANAGER_BLOCKED, isProjectPathAllowed, listEnvFiles, readProjectFile, saveProjectFile, } from './project-files.js';
 export { registerConsoleRestPages, } from './console-rest-pages.js';
+export { dispatchExtendedConsoleRpc, } from './console-rpc-extended.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/host-http",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Minimal HTTP and WebSocket host for Plugin Runtime (no Koa)",
   "type": "module",
   "main": "./lib/index.js",
@@ -18,8 +18,9 @@
   ],
   "dependencies": {
     "ws": "^8.21.0",
-    "@zhin.js/logger": "1.0.74",
-    "@zhin.js/plugin-runtime": "1.0.0"
+    "@zhin.js/console-protocol": "1.1.0",
+    "@zhin.js/logger": "1.0.75",
+    "@zhin.js/plugin-runtime": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",

package/src/console-events.ts

@@ -0,0 +1,47 @@
+import type { ServerResponse } from 'node:http';
+
+/**
+ * Console 实时事件枢纽（Plugin Runtime Host 的 `/api/events` SSE 事件源）。
+ * 单进程内 fan-out：`publish` 向所有已订阅的 SSE response 写帧；
+ * write 失败或连接断开自动摘除订阅。
+ */
+export interface ConsoleEventHub {
+  publish(type: string, data: unknown): void;
+  /** 订阅事件流；返回 unsubscribe。连接断开时也会自动摘除。 */
+  subscribe(response: ServerResponse): () => void;
+  readonly subscriberCount: number;
+}
+
+export function createConsoleEventHub(): ConsoleEventHub {
+  let nextId = 0;
+  const subscribers = new Set<ServerResponse>();
+
+  const remove = (response: ServerResponse): void => {
+    subscribers.delete(response);
+  };
+
+  return {
+    get subscriberCount() {
+      return subscribers.size;
+    },
+    publish(type, data) {
+      nextId += 1;
+      const frame = `id: ${nextId}\nevent: ${type}\ndata: ${JSON.stringify(data)}\n\n`;
+      for (const response of [...subscribers]) {
+        try {
+          response.write(frame, (error) => {
+            if (error) remove(response);
+          });
+        } catch {
+          remove(response);
+        }
+      }
+    },
+    subscribe(response) {
+      subscribers.add(response);
+      response.once('close', () => remove(response));
+      response.once('error', () => remove(response));
+      return () => remove(response);
+    },
+  };
+}