@zhin.js/host-http 1.0.1 → 1.0.3

package/lib/console-rpc.js

@@ -1,42 +1,5 @@
+import { assertDemoConsoleRpcAllowed, endpointSendResult, normalizeConsoleRpcMessage, } from '@zhin.js/console-protocol';
 import { dispatchExtendedConsoleRpc } from './console-rpc-extended.js';
-/**
- * Frontend SDK (@zhin.js/client) calls colon-named aliases; normalize to the
- * canonical dot names before scope checks and dispatch. Alias parameter shapes
- * (`data.{adapter, endpointId, id, type, content, parent}`) are mapped onto the
- * `$`-prefixed fields inside each endpoint case.
- */
-const RPC_TYPE_ALIASES = Object.freeze({
-    'endpoint:list': 'endpoint.list',
-    'endpoint:info': 'endpoint.info',
-    'endpoint:sendMessage': 'endpoint.send_message',
-});
-/** ADR 0016 demo allowlist subset available on Plugin Runtime Host. */
-const DEMO_RPC_ALLOWLIST = new Set([
-    'ping',
-    'entries:get',
-    'pages:list',
-    'config:get',
-    'config:get-all',
-    'config:get-yaml',
-    'schema:get',
-    'schema:get-all',
-    'endpoint.list',
-    'endpoint.info',
-    'endpoint.send_message',
-]);
-const DEMO_RPC_WRITE_BLOCKLIST = new Set([
-    'config:set',
-    'config:save-yaml',
-    'files:save',
-    'env:save',
-    'db:insert',
-    'db:update',
-    'db:delete',
-    'db:drop-table',
-    'db:kv:set',
-    'db:kv:delete',
-    'system:restart',
-]);
 export function pickRpcReply(message, payloads) {
     const requestId = message.requestId;
     return ((requestId != null ? payloads.find((payload) => payload.requestId === requestId) : undefined)
@@ -48,11 +11,19 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
     const emit = (payload) => {
         payloads.push(payload);
     };
-    const type = RPC_TYPE_ALIASES[String(message.type ?? '')] ?? String(message.type ?? '');
+    message = normalizeConsoleRpcMessage(message);
+    const type = String(message.type ?? '');
     const requestId = message.requestId;
-    // Extended RPC surface (cron/schedule、endpoint 社交/inbox) — 自带 scope 矩阵
+    if (ctx.authScope === 'demo') {
+        const denied = assertDemoConsoleRpcAllowed(type);
+        if (denied) {
+            emit({ requestId, error: denied });
+            return payloads;
+        }
+    }
+    // Extended RPC surface (cron/schedule、endpoint 社交/inbox)
     if (ctx.extended) {
-        const extended = await dispatchExtendedConsoleRpc(type, message.data, { ...ctx.extended, fullScope: ctx.authScope === 'full' });
+        const extended = await dispatchExtendedConsoleRpc(type, message, { ...ctx.extended, fullScope: ctx.authScope === 'full' });
         if (extended !== undefined) {
             emit('error' in extended
                 ? { requestId, error: extended.error }
@@ -60,10 +31,6 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
             return payloads;
         }
     }
-    if (ctx.authScope === 'demo' && (DEMO_RPC_WRITE_BLOCKLIST.has(type) || !DEMO_RPC_ALLOWLIST.has(type))) {
-        emit({ requestId, error: `Demo scope: RPC "${type}" is forbidden` });
-        return payloads;
-    }
     switch (type) {
         case 'ping':
             emit({ type: 'pong', requestId });
@@ -118,7 +85,9 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'config:get': {
             try {
-                const key = String(message.key ?? message.pluginName ?? '');
+                // 兼容 console UI 的 data:{plugin} / data:{key} 形状
+                const data = (message.data ?? {});
+                const key = String(message.key ?? message.pluginName ?? data.pluginName ?? data.plugin ?? data.key ?? '');
                 const document = ctx.readConfigDocument ? await ctx.readConfigDocument() : {};
                 emit({ requestId, data: key ? document[key] : document });
             }
@@ -142,6 +111,7 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     return payloads;
                 }
                 await ctx.writeConfigYaml(yaml);
+                ctx.publishEvent?.('config:updated', { pluginName: null, keys: [] });
                 emit({
                     requestId,
                     data: { success: true, message: '配置已保存，需重启生效' },
@@ -167,6 +137,12 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     return payloads;
                 }
                 const result = await ctx.setConfigKey(pluginName, message.data);
+                ctx.publishEvent?.('config:updated', {
+                    pluginName,
+                    keys: message.data && typeof message.data === 'object' && !Array.isArray(message.data)
+                        ? Object.keys(message.data)
+                        : [],
+                });
                 emit({
                     requestId,
                     data: {
@@ -312,7 +288,10 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'schema:get': {
             try {
-                const pluginName = typeof message.pluginName === 'string' ? message.pluginName : undefined;
+                // 兼容 console UI 的 data:{plugin} / data:{pluginName} 形状（SDK 发顶层 pluginName）
+                const data = (message.data ?? {});
+                const candidate = message.pluginName ?? data.pluginName ?? data.plugin;
+                const pluginName = typeof candidate === 'string' ? candidate : undefined;
                 const schema = ctx.getSchema ? await ctx.getSchema(pluginName) : null;
                 emit({ requestId, data: schema });
             }
@@ -544,10 +523,9 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'endpoint.info': {
             try {
-                const data = (message.data ?? {});
-                // Accept both canonical `$`-fields and the SDK colon-alias shape.
-                const adapter = String(data.$adapter ?? data.adapter ?? '');
-                const endpointId = String(data.$endpoint ?? data.endpointId ?? '');
+                const data = message;
+                const adapter = String(data.$adapter ?? '');
+                const endpointId = String(data.$endpoint ?? '');
                 if (!adapter || !endpointId) {
                     emit({ requestId, error: '$adapter and $endpoint required' });
                     return payloads;
@@ -573,14 +551,12 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
         }
         case 'endpoint.send_message': {
             try {
-                const data = (message.data ?? {});
-                // Accept both canonical `$`-fields and the SDK colon-alias shape
-                // (`endpoint:sendMessage` → data.{adapter, endpointId, id, type, content, parent}).
-                const adapter = String(data.$adapter ?? data.adapter ?? '');
-                const endpointId = String(data.$endpoint ?? data.endpointId ?? '');
-                const channelId = String(data.$channel_id ?? data.id ?? '');
-                const channelType = String(data.$channel_type ?? data.type ?? '');
-                const content = data.$content !== undefined ? data.$content : data.content;
+                const data = message;
+                const adapter = String(data.$adapter ?? '');
+                const endpointId = String(data.$endpoint ?? '');
+                const channelId = String(data.$channel_id ?? '');
+                const channelType = String(data.$channel_type ?? '');
+                const content = data.$content;
                 // channelType is optional: ImRuntime tolerates an empty value and
                 // targets the bare channel id (parity with the legacy RPC handler).
                 if (!adapter || !endpointId || !channelId || content === undefined) {
@@ -600,10 +576,10 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     channelId,
                     channelType,
                     content,
-                    parent: (data.$parent ?? data.parent),
+                    parent: data.$parent,
                 });
                 // Legacy contract: { message_id }. Keep messageId for new callers.
-                emit({ requestId, data: { message_id: result.messageId, messageId: result.messageId } });
+                emit({ requestId, data: endpointSendResult(result.messageId) });
             }
             catch (error) {
                 emit({
@@ -619,6 +595,7 @@ export async function dispatchRuntimeConsoleRpc(message, ctx) {
                     emit({ requestId, error: 'Process restart is not configured' });
                     return payloads;
                 }
+                ctx.publishEvent?.('system:restarting', { timestamp: Date.now() });
                 emit({ requestId, data: { success: true, message: '正在重启...' } });
                 // Delay so the HTTP response can flush (parity with legacy host-api).
                 setTimeout(() => {

package/lib/http-host.js

@@ -5,6 +5,7 @@ import { createToken } from '@zhin.js/plugin-runtime';
 import { TokenRegistry, extractBearerToken, isDemoWebSocketPath, } from './token-registry.js';
 import { buildOpenApiDocument, } from './openapi.js';
 import { isDemoHttpAllowed } from './console-rpc.js';
+import { HttpBodyError } from './json-body.js';
 const logger = getLogger('HttpHost');
 export const REMOTE_CONSOLE_ORIGIN = 'https://console.zhin.dev';
 const DEFAULT_CORS_ORIGINS = Object.freeze([REMOTE_CONSOLE_ORIGIN]);
@@ -180,6 +181,14 @@ export function createHttpHost(options = {}) {
             await route.handler(request, response, url, auth.scope);
         }
         catch (err) {
+            // 统一把请求体错误（400/413）映射回对应状态码，
+            // 避免个别端点未捕获时退化成 500 空响应。
+            if (err instanceof HttpBodyError) {
+                if (!response.headersSent) {
+                    writeJson(response, err.statusCode, { success: false, error: err.message });
+                }
+                return;
+            }
             logger.warn(formatCompact({
                 op: 'http_handler_failed',
                 path: pathname,

package/lib/index.d.ts

@@ -1,8 +1,10 @@
 export { createHttpHost, httpHostToken, REMOTE_CONSOLE_ORIGIN, type HttpHandler, type HttpHost, type HttpHostAddress, type HttpHostOptions, type HttpRouteRegistration, type WsConnection, type WsHandle, } from './http-host.js';
 export { TokenRegistry, extractBearerToken, isDemoWebSocketPath, type AuthScope, type ScopedTokenConfig, type TokenRegistryConfig, } from './token-registry.js';
 export { timingSafeEqualString } from './timing-safe-equal.js';
+export { createConsoleEventHub, type ConsoleEventHub, } from './console-events.js';
 export { buildOpenApiDocument, patternToOpenApiPath, routeRequiresBearerAuth, type BuildOpenApiOptions, type ListedRoute, type OpenApiParameter, type RouteMeta, } from './openapi.js';
 export { HttpBodyError, readJsonBody, } from './json-body.js';
 export { dispatchRuntimeConsoleRpc, isDemoHttpAllowed, pickRpcReply, type RuntimeConsolePage, type RuntimeConsoleRpcContext, type RuntimeConsoleRpcMessage, type RuntimeConsoleRpcReply, type RuntimeEndpointSendInput, type RuntimeEndpointSummary, } from './console-rpc.js';
 export { buildProjectFileTree, FILE_MANAGER_ALLOWED, FILE_MANAGER_BLOCKED, isProjectPathAllowed, listEnvFiles, readProjectFile, saveProjectFile, type FileTreeNode, } from './project-files.js';
 export { registerConsoleRestPages, type ConsoleAgentIntrospection, type ConsoleAgentRuntime, type ConsoleAgentSessionTree, type ConsoleRestCtx, type ConsoleRestPagesOptions, } from './console-rest-pages.js';
+export { dispatchExtendedConsoleRpc, type ConsoleRpcExtendedCtx, type ConsoleScheduleEngine, type ExtendedRpcResult, } from './console-rpc-extended.js';

package/lib/index.js

@@ -1,8 +1,10 @@
 export { createHttpHost, httpHostToken, REMOTE_CONSOLE_ORIGIN, } from './http-host.js';
 export { TokenRegistry, extractBearerToken, isDemoWebSocketPath, } from './token-registry.js';
 export { timingSafeEqualString } from './timing-safe-equal.js';
+export { createConsoleEventHub, } from './console-events.js';
 export { buildOpenApiDocument, patternToOpenApiPath, routeRequiresBearerAuth, } from './openapi.js';
 export { HttpBodyError, readJsonBody, } from './json-body.js';
 export { dispatchRuntimeConsoleRpc, isDemoHttpAllowed, pickRpcReply, } from './console-rpc.js';
 export { buildProjectFileTree, FILE_MANAGER_ALLOWED, FILE_MANAGER_BLOCKED, isProjectPathAllowed, listEnvFiles, readProjectFile, saveProjectFile, } from './project-files.js';
 export { registerConsoleRestPages, } from './console-rest-pages.js';
+export { dispatchExtendedConsoleRpc, } from './console-rpc-extended.js';

package/lib/json-body.js

@@ -14,15 +14,23 @@ export async function readJsonBody(request, options = {}) {
     const limit = options.limit ?? 1_048_576;
     const chunks = [];
     let size = 0;
+    let exceeded = false;
     for await (const chunk of request) {
+        // 超限后继续 drain 到 end：提前 break 会 destroy 底层 socket，
+        // 客户端将永远收不到后面的 413 响应。
+        if (exceeded)
+            continue;
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         size += buffer.length;
         if (size > limit) {
-            request.destroy();
-            throw new HttpBodyError(`Request body exceeds ${limit} bytes`, 413);
+            exceeded = true;
+            chunks.length = 0;
+            continue;
         }
         chunks.push(buffer);
     }
+    if (exceeded)
+        throw new HttpBodyError(`Request body exceeds ${limit} bytes`, 413);
     if (chunks.length === 0)
         return undefined;
     const raw = Buffer.concat(chunks).toString('utf8').trim();

package/lib/project-files.js

@@ -5,6 +5,16 @@ export const FILE_MANAGER_ALLOWED = Object.freeze([
     'src',
     'plugins',
     'client',
+    // Plugin Runtime convention directories (file-based discovery)
+    'commands',
+    'adapters',
+    'components',
+    'middlewares',
+    'tools',
+    'mcp',
+    'pages',
+    'skills',
+    'agents',
     'package.json',
     'tsconfig.json',
     'zhin.config.yml',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/host-http",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Minimal HTTP and WebSocket host for Plugin Runtime (no Koa)",
   "type": "module",
   "main": "./lib/index.js",
@@ -18,8 +18,9 @@
   ],
   "dependencies": {
     "ws": "^8.21.0",
+    "@zhin.js/console-protocol": "1.1.0",
     "@zhin.js/logger": "1.0.75",
-    "@zhin.js/plugin-runtime": "1.0.1"
+    "@zhin.js/plugin-runtime": "1.1.1"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",

package/src/console-events.ts

@@ -0,0 +1,47 @@
+import type { ServerResponse } from 'node:http';
+
+/**
+ * Console 实时事件枢纽（Plugin Runtime Host 的 `/api/events` SSE 事件源）。
+ * 单进程内 fan-out：`publish` 向所有已订阅的 SSE response 写帧；
+ * write 失败或连接断开自动摘除订阅。
+ */
+export interface ConsoleEventHub {
+  publish(type: string, data: unknown): void;
+  /** 订阅事件流；返回 unsubscribe。连接断开时也会自动摘除。 */
+  subscribe(response: ServerResponse): () => void;
+  readonly subscriberCount: number;
+}
+
+export function createConsoleEventHub(): ConsoleEventHub {
+  let nextId = 0;
+  const subscribers = new Set<ServerResponse>();
+
+  const remove = (response: ServerResponse): void => {
+    subscribers.delete(response);
+  };
+
+  return {
+    get subscriberCount() {
+      return subscribers.size;
+    },
+    publish(type, data) {
+      nextId += 1;
+      const frame = `id: ${nextId}\nevent: ${type}\ndata: ${JSON.stringify(data)}\n\n`;
+      for (const response of [...subscribers]) {
+        try {
+          response.write(frame, (error) => {
+            if (error) remove(response);
+          });
+        } catch {
+          remove(response);
+        }
+      }
+    },
+    subscribe(response) {
+      subscribers.add(response);
+      response.once('close', () => remove(response));
+      response.once('error', () => remove(response));
+      return () => remove(response);
+    },
+  };
+}

package/src/console-rest-pages.ts

@@ -85,6 +85,8 @@ export interface ConsoleRestPagesOptions {
 type LogModelLike = {
   select(...fields: string[]): LogSelectionLike;
   delete(where: Record<string, unknown>): Promise<unknown>;
+  /** DB 侧 count 聚合（可选；缺失时降级为 select('id') 计数）。 */
+  count?(where?: Record<string, unknown>): Promise<number>;
 };
 
 type LogSelectionLike = PromiseLike<LogRow[]> & {
@@ -223,13 +225,20 @@ function registerLogsRoutes(
       return;
     }
 
-    const total = await LogModel.select();
+    // 计数走 DB 侧聚合（count）；模型未实现 count 时降级为 select('id') 只取主键列
+    const countRows = async (where?: Record<string, unknown>): Promise<number> => {
+      if (typeof LogModel.count === 'function') return LogModel.count(where);
+      const selection = LogModel.select('id');
+      const rows = await (where ? selection.where(where) : selection);
+      return rows.length;
+    };
+
+    const total = await countRows();
     const levels = ['info', 'warn', 'error'];
     const levelCounts: Record<string, number> = {};
 
     for (const level of levels) {
-      const count = await LogModel.select().where({ level });
-      levelCounts[level] = count.length;
+      levelCounts[level] = await countRows({ level });
     }
 
     const oldestLog = await LogModel.select('timestamp')
@@ -244,7 +253,7 @@ function registerLogsRoutes(
 
     writeJson(response, 200, {
       success: true,
-      data: { total: total.length, byLevel: levelCounts, oldestTimestamp },
+      data: { total, byLevel: levelCounts, oldestTimestamp },
     });
   }, { summary: 'System log stats', tags: ['console', 'logs'] });