@zhin.js/host-http 1.0.10 → 1.0.11

package/src/console-rest-pages.ts

@@ -47,19 +47,23 @@ export interface ConsoleRestCtx {
 /** 内省数据门面 — 由 basic/cli 用 agent 包 collectIntrospection* 装配。 */
 export interface ConsoleAgentIntrospection {
   commands?(): readonly unknown[];
+  middlewares?(): readonly unknown[];
+  components?(): readonly unknown[];
   bindings?(): readonly unknown[];
   tools?(): readonly unknown[];
   mcp?(): { rows: readonly unknown[]; note?: string } | readonly unknown[];
+  renderComponent?(input: Readonly<{
+    requester: string;
+    name: string;
+    props: unknown;
+    signal: AbortSignal;
+  }>): Promise<unknown>;
 }
 
 /** Session tree 门面 — 形状对齐 agent 包 SessionTreeRuntimeHandle。 */
 export interface ConsoleAgentSessionTree {
   resolveActiveSessionId(sessionKey: string): Promise<string | null>;
-  agentSessionStore: {
-    getBySessionId(sessionId: string): Promise<
-      { active_leaf_message_id?: number | null } | null | undefined
-    >;
-  };
+  getActiveLeafMessageId(sessionId: string): Promise<number | null>;
   listBranchPoints(sessionId: string): Promise<readonly unknown[]>;
   switchActiveLeaf(sessionId: string, messageId: number): Promise<boolean>;
   jumpToBranchIndex(
@@ -83,6 +87,12 @@ export interface ConsoleRestPagesOptions {
   readonly pluginRegistryUrl?: string;
   /** 默认 `https://registry.npmmirror.com`（legacy 同源）。 */
   readonly npmRegistryUrl?: string;
+  /** Component preview deadline; default 5 seconds. */
+  readonly componentPreviewTimeoutMs?: number;
+  /** Maximum serialized Component preview; default 256 KiB. */
+  readonly componentPreviewMaxBytes?: number;
+  /** Maximum in-flight Component previews per Console route set; default 2. */
+  readonly componentPreviewMaxConcurrent?: number;
 }
 
 type LogModelLike = {
@@ -109,6 +119,8 @@ type LogRow = {
 
 const INTROSPECTION_PAGE_SIZES = {
   commands: 25,
+  middlewares: 30,
+  components: 30,
   tools: 15,
   endpoints: 30,
   bindings: 30,
@@ -143,7 +155,7 @@ export function registerConsoleRestPages(
 
   registerLogsRoutes(route, base, ctx);
   registerMarketplaceRoutes(route, base, ctx, fetchFn, pluginRegistryUrl, npmRegistryUrl);
-  registerIntrospectionRoutes(route, base, ctx);
+  registerIntrospectionRoutes(route, base, ctx, options);
   registerAgentSessionRoutes(route, base, ctx);
 
   return () => {
@@ -551,6 +563,7 @@ function registerIntrospectionRoutes(
   route: HttpHost['route'],
   base: string,
   ctx: ConsoleRestCtx,
+  options: ConsoleRestPagesOptions,
 ): void {
   const collectors: Array<{
     kind: IntrospectionKind;
@@ -559,13 +572,33 @@ function registerIntrospectionRoutes(
   }> = [
     {
       kind: 'commands',
-      collect: () => ({ rows: agentIntrospection(ctx)?.commands?.() ?? [] }),
+      collect: () => ({ rows: withAgentIntrospection(ctx, (value) => value?.commands?.() ?? []) }),
       fields: [
         (c) => stringProp(c, 'pattern'),
         (c) => stringProp(c, 'desc'),
         (c) => stringProp(c, 'plugin'),
       ],
     },
+    {
+      kind: 'middlewares',
+      collect: () => ({ rows: withAgentIntrospection(ctx, (value) => value?.middlewares?.() ?? []) }),
+      fields: [
+        (m) => stringProp(m, 'name'),
+        (m) => stringProp(m, 'owner'),
+        (m) => stringProp(m, 'phase'),
+        (m) => stringProp(m, 'target'),
+        (m) => stringProp(m, 'source'),
+      ],
+    },
+    {
+      kind: 'components',
+      collect: () => ({ rows: withAgentIntrospection(ctx, (value) => value?.components?.() ?? []) }),
+      fields: [
+        (c) => stringProp(c, 'name'),
+        (c) => stringProp(c, 'owner'),
+        (c) => stringProp(c, 'source'),
+      ],
+    },
     {
       kind: 'endpoints',
       collect: () => ({
@@ -580,7 +613,7 @@ function registerIntrospectionRoutes(
     },
     {
       kind: 'bindings',
-      collect: () => ({ rows: agentIntrospection(ctx)?.bindings?.() ?? [] }),
+      collect: () => ({ rows: withAgentIntrospection(ctx, (value) => value?.bindings?.() ?? []) }),
       fields: [
         (a) => stringProp(a, 'name'),
         (a) => stringProp(a, 'provider'),
@@ -589,7 +622,7 @@ function registerIntrospectionRoutes(
     },
     {
       kind: 'tools',
-      collect: () => ({ rows: agentIntrospection(ctx)?.tools?.() ?? [] }),
+      collect: () => ({ rows: withAgentIntrospection(ctx, (value) => value?.tools?.() ?? []) }),
       fields: [
         (t) => stringProp(t, 'name'),
         (t) => stringProp(t, 'source'),
@@ -599,7 +632,7 @@ function registerIntrospectionRoutes(
     {
       kind: 'mcp',
       collect: () => {
-        const result = agentIntrospection(ctx)?.mcp?.();
+        const result = withAgentIntrospection(ctx, (value) => value?.mcp?.());
         if (result == null) return { rows: [] as readonly unknown[] };
         // readonly 数组不能用 Array.isArray 收窄，按对象形状判断
         if (typeof result === 'object' && 'rows' in result) {
@@ -625,7 +658,7 @@ function registerIntrospectionRoutes(
         );
         const missing = kind === 'endpoints'
           ? !ctx.getEndpoints
-          : !agentIntrospection(ctx);
+          : !hasAgentIntrospection(ctx);
         const degradedNote = note ?? (missing
           ? kind === 'endpoints'
             ? 'Endpoints 数据源未接线（ctx.getEndpoints 缺失）'
@@ -644,18 +677,146 @@ function registerIntrospectionRoutes(
       }
     }, { summary: `Introspection: ${kind}`, tags: ['console', 'introspection'] });
   }
+
+  let activeComponentPreviews = 0;
+  route('POST', `${base}/introspection/components/render`, async (request, response, _url, authScope) => {
+    if (!requireWriteScope(response, ctx, authScope)) return;
+    const body = (await readJsonBody<Record<string, unknown>>(request)) ?? {};
+    const requester = typeof body.requester === 'string' ? body.requester.trim() : '';
+    const name = typeof body.name === 'string' ? body.name.trim() : '';
+    if (!requester || !name || requester.length > 256 || name.length > 160) {
+      writeJson(response, 400, { success: false, error: '请提供有效的 requester 与 component name' });
+      return;
+    }
+    const maxConcurrent = clampPositiveInt(options.componentPreviewMaxConcurrent, 2, 8);
+    if (activeComponentPreviews >= maxConcurrent) {
+      writeJson(response, 503, { success: false, error: 'Component preview 正忙，请稍后重试' });
+      return;
+    }
+    const lease = ctx.acquireAgentRuntime?.();
+    const render = lease?.value.introspection?.renderComponent;
+    if (!lease || !render) {
+      lease?.release();
+      writeJson(response, 503, { success: false, error: 'Component Runtime 未就绪' });
+      return;
+    }
+    const controller = new AbortController();
+    const timeoutMs = clampPositiveInt(options.componentPreviewTimeoutMs, 5_000, 30_000);
+    const timeout = setTimeout(() => controller.abort(
+      new ComponentPreviewTimeoutError(`Component preview 超过 ${timeoutMs}ms`),
+    ), timeoutMs);
+    activeComponentPreviews += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      activeComponentPreviews -= 1;
+      lease.release();
+    };
+    const renderPromise = Promise.resolve().then(() =>
+      render({ requester, name, props: body.props ?? {}, signal: controller.signal }));
+    // A timed-out implementation may ignore AbortSignal. Keep its generation
+    // lease until the real operation settles; the bounded concurrency gate
+    // prevents non-cooperative previews from pinning unbounded generations.
+    void renderPromise.then(release, release);
+    try {
+      const output = await raceWithAbort(
+        renderPromise,
+        controller.signal,
+      );
+      assertPreviewOutput(output, options.componentPreviewMaxBytes ?? 256 * 1024);
+      writeJson(response, 200, { success: true, data: { requester, name, output } });
+    } catch (error) {
+      const status = error instanceof ComponentPreviewTimeoutError
+        ? 408
+        : error instanceof ComponentPreviewLimitError ? 413 : 422;
+      writeJson(response, status, {
+        success: false,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    } finally {
+      clearTimeout(timeout);
+      if (!controller.signal.aborted) controller.abort();
+    }
+  }, { summary: 'Render a Component preview', tags: ['console', 'introspection', 'component'] });
+}
+
+class ComponentPreviewTimeoutError extends Error {
+  override readonly name = 'ComponentPreviewTimeoutError';
+}
+
+class ComponentPreviewLimitError extends Error {
+  override readonly name = 'ComponentPreviewLimitError';
+}
+
+function clampPositiveInt(value: number | undefined, fallback: number, ceiling: number): number {
+  if (!Number.isFinite(value) || !value || value < 1) return fallback;
+  return Math.min(Math.floor(value), ceiling);
+}
+
+async function raceWithAbort<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  if (signal.aborted) throw abortReason(signal);
+  return await new Promise<T>((resolve, reject) => {
+    const onAbort = () => reject(abortReason(signal));
+    signal.addEventListener('abort', onAbort, { once: true });
+    promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+  });
+}
+
+function abortReason(signal: AbortSignal): Error {
+  return signal.reason instanceof Error
+    ? signal.reason
+    : new DOMException('Component preview aborted', 'AbortError');
+}
+
+function assertPreviewOutput(output: unknown, maxBytes: number): void {
+  const byteLimit = clampPositiveInt(maxBytes, 256 * 1024, 1024 * 1024);
+  const seen = new WeakSet<object>();
+  let nodes = 0;
+  const visit = (value: unknown, depth: number): void => {
+    nodes += 1;
+    if (nodes > 10_000) throw new ComponentPreviewLimitError('Component preview 节点数超过 10000');
+    if (depth > 24) throw new ComponentPreviewLimitError('Component preview 嵌套深度超过 24');
+    if (!value || typeof value !== 'object') return;
+    if (seen.has(value)) throw new ComponentPreviewLimitError('Component preview 不能包含循环引用');
+    seen.add(value);
+    if (Array.isArray(value)) {
+      for (const item of value) visit(item, depth + 1);
+    } else {
+      for (const item of Object.values(value as Record<string, unknown>)) visit(item, depth + 1);
+    }
+  };
+  visit(output, 0);
+  let serialized: string;
+  try {
+    serialized = JSON.stringify(output);
+  } catch (error) {
+    throw new ComponentPreviewLimitError(
+      `Component preview 无法序列化: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (Buffer.byteLength(serialized ?? '') > byteLimit) {
+    throw new ComponentPreviewLimitError(`Component preview 超过 ${byteLimit} bytes`);
+  }
 }
 
-function agentIntrospection(ctx: ConsoleRestCtx): ConsoleAgentIntrospection | undefined {
+function withAgentIntrospection<T>(
+  ctx: ConsoleRestCtx,
+  operation: (value: ConsoleAgentIntrospection | undefined) => T,
+): T {
   const lease = ctx.acquireAgentRuntime?.();
-  if (!lease) return undefined;
+  if (!lease) return operation(undefined);
   try {
-    return lease.value.introspection;
+    return operation(lease.value.introspection);
   } finally {
     lease.release();
   }
 }
 
+function hasAgentIntrospection(ctx: ConsoleRestCtx): boolean {
+  return withAgentIntrospection(ctx, (value) => value !== undefined);
+}
+
 // ---------------------------------------------------------------------------
 // agent sessions（legacy agent-sessions-rest-api.ts；ADR 0010 D3）
 // ---------------------------------------------------------------------------
@@ -708,14 +869,14 @@ function registerAgentSessionRoutes(
         return;
       }
 
-      const session = await runtime.agentSessionStore.getBySessionId(sessionId);
+      const activeLeafMessageId = await runtime.getActiveLeafMessageId(sessionId);
       const points = await runtime.listBranchPoints(sessionId);
       writeJson(response, 200, {
         success: true,
         data: {
           sessionKey: parsed.sessionKey,
           sessionId,
-          activeLeafMessageId: session?.active_leaf_message_id ?? null,
+          activeLeafMessageId,
           points,
         },
       });
@@ -782,28 +943,28 @@ function registerAgentSessionRoutes(
 
       if (branchIndex !== undefined) {
         const result = await runtime.jumpToBranchIndex(sessionId, branchIndex);
-        const session = await runtime.agentSessionStore.getBySessionId(sessionId);
+        const activeLeafMessageId = await runtime.getActiveLeafMessageId(sessionId);
         writeJson(response, result.ok ? 200 : 400, {
           success: result.ok,
           message: result.message,
           data: {
             sessionKey: parsed.sessionKey,
             sessionId,
-            activeLeafMessageId: session?.active_leaf_message_id ?? null,
+            activeLeafMessageId,
           },
         });
         return;
       }
 
       const ok = await runtime.switchActiveLeaf(sessionId, messageId!);
-      const session = await runtime.agentSessionStore.getBySessionId(sessionId);
+      const activeLeafMessageId = await runtime.getActiveLeafMessageId(sessionId);
       writeJson(response, ok ? 200 : 400, {
         success: ok,
         message: ok ? `已切换 active leaf 至消息 #${messageId}` : '切换失败',
         data: {
           sessionKey: parsed.sessionKey,
           sessionId,
-          activeLeafMessageId: session?.active_leaf_message_id ?? null,
+          activeLeafMessageId,
         },
       });
     } finally {

package/src/console-rpc-extended.ts

@@ -8,7 +8,9 @@
  * 数据源约定（只读真实数据源，不做内存假数据）：
  * - cron：`ctx.scheduleHost`（Plugin Runtime ScheduleHost，仅 register/list，
  *   无持久化引擎，故 cron:add/remove/pause/resume 报"未接线"）。
- * - inbox：`ctx.databaseHost.models`（unified_inbox_message/request/notice 三张表，
+ * - request.list：优先 `management.listRequests()`（live endpoint）；否则回退
+ *   unified_inbox_request。审批始终走 approveRequest/rejectRequest。
+ * - inbox（历史）：`ctx.databaseHost.models`（unified_inbox_message/request/notice，
  *   表不存在或查询失败 → 空数组 + inboxEnabled:false；requestConsumed/noticeConsumed
  *   按行 id update consumed=1，表/model 缺失时报"未接线"）。
  * - 社交/群管：`ctx.withEndpointManagement` 在固定 generation lease 内
@@ -39,8 +41,65 @@ export interface ConsoleRpcExtendedCtx {
   ) => Promise<T | null>;
   /** Plugin Runtime DatabaseHost 的 models 视图。 */
   databaseHost?: { models: { get(name: string): unknown } };
-  /** Agent Host 持久化调度引擎（@zhin.js/agent getAssistantRuntime().engine），未 init 时返回 null。 */
+  /** Narrow generation-bound persistent-job port; null when Assistant is disabled. */
   resolveScheduleEngine?: () => ConsoleScheduleEngine | null | undefined;
+  /** LoginAssist list/submit/cancel（刷新后仍可消费扫码/滑块待办）。 */
+  loginAssist?: {
+    listPending(): readonly {
+      id: string;
+      adapter: string;
+      endpointKey: string;
+      type: string;
+      payload: Record<string, unknown>;
+      createdAt: number;
+      expiresAt?: number;
+    }[];
+    submit(id: string, value: string | Record<string, unknown>): boolean;
+    cancel(id: string, reason?: string): boolean;
+  };
+  /** Authenticated Root adapter; mutation DTOs deliberately contain no principal/decision fields. */
+  workroomProfileControl?: ConsoleWorkroomProfileControlPort;
+  /** Authenticated HTTP principal; never accepted from the RPC body. */
+  authenticatedPrincipal?: Readonly<{ principalId: string }>;
+  workroomKnowledgeControl?: ConsoleWorkroomKnowledgeControlPort;
+}
+
+export interface ConsoleWorkroomProfileControlPort {
+  publishPack(command: Readonly<{ operationId: string; pack: unknown }>,
+    authenticatedPrincipal: Readonly<{ principalId: string }>): Promise<unknown>;
+  publishProfile(command: Readonly<{
+    operationId: string;
+    projectId: string;
+    expectedRegistryRevision: number;
+    overlay: unknown;
+    activate: boolean;
+  }>, authenticatedPrincipal: Readonly<{ principalId: string }>): Promise<unknown>;
+  publishRollback(command: Readonly<{
+    operationId: string;
+    projectId: string;
+    expectedRegistryRevision: number;
+    restoredFromRevisionId: string;
+    overlay: unknown;
+    activate: boolean;
+  }>, authenticatedPrincipal: Readonly<{ principalId: string }>): Promise<unknown>;
+  publishPlanningPolicy(command: Readonly<{
+    operationId: string;
+    projectId: string;
+    profileRevisionId: string;
+    revision: number;
+    expectedPreviousDigest?: string;
+    policy: unknown;
+  }>, authenticatedPrincipal: Readonly<{ principalId: string }>): Promise<unknown>;
+}
+
+export interface ConsoleWorkroomKnowledgeControlPort {
+  read(projectId: string): Promise<unknown>;
+  publish(command: Readonly<{
+    operationId: string; projectId: string; expectedRevision: number; entries: readonly unknown[];
+  }>, authenticatedPrincipal: Readonly<{ principalId: string }>): Promise<unknown>;
+  rollback(command: Readonly<{
+    operationId: string; projectId: string; expectedRevision: number; restoreRevision: number;
+  }>, authenticatedPrincipal: Readonly<{ principalId: string }>): Promise<unknown>;
 }
 
 export interface ConsoleScheduleEngine {
@@ -94,6 +153,17 @@ interface EndpointManagementPort {
     parent?: { type: string; id: string; name?: string };
   }[]>;
   listGroupMembers?(groupId: string): Promise<readonly unknown[]>;
+  listRequests?(): Promise<readonly {
+    platform_request_id: string;
+    type: string;
+    scene_type?: string | null;
+    scene_id: string;
+    sub_type?: string | null;
+    actor_id: string;
+    actor_name?: string | null;
+    comment?: string | null;
+    created_at: number;
+  }[]>;
   approveRequest?(requestId: string, remark?: string): Promise<void>;
   rejectRequest?(requestId: string, reason?: string): Promise<void>;
   kickGroupMember?(groupId: string, userId: string): Promise<void>;
@@ -140,6 +210,13 @@ export async function dispatchExtendedConsoleRpc(
     case 'request.reject':
       return actOnRequest(type, d, ctx);
 
+    case 'login.list':
+      return listLoginPending(ctx);
+    case 'login.submit':
+      return submitLogin(d, ctx);
+    case 'login.cancel':
+      return cancelLogin(d, ctx);
+
     case 'request.consumed':
       return markInboxConsumed(d, ctx, TABLE_REQUEST);
     case 'notice.consumed':
@@ -178,11 +255,132 @@ export async function dispatchExtendedConsoleRpc(
     case 'endpoint.delete_friend':
       return deleteFriend(d, ctx);
 
+    case 'workroom.profile.pack.publish':
+    case 'workroom.profile.publish':
+    case 'workroom.profile.rollback':
+    case 'workroom.profile.policy.publish':
+      return mutateWorkroomProfile(type, d, ctx);
+
+    case 'workroom.knowledge.get':
+    case 'workroom.knowledge.publish':
+    case 'workroom.knowledge.rollback':
+      return mutateWorkroomKnowledge(type, d, ctx);
+
     default:
       return undefined;
   }
 }
 
+async function mutateWorkroomProfile(
+  type: 'workroom.profile.pack.publish' | 'workroom.profile.publish'
+    | 'workroom.profile.rollback' | 'workroom.profile.policy.publish',
+  data: Record<string, unknown>,
+  ctx: ConsoleRpcExtendedCtx,
+): Promise<ExtendedRpcResult> {
+  const control = ctx.workroomProfileControl;
+  if (!control) return { error: 'Workroom Profile authority control is unavailable' };
+  for (const forbidden of [
+    'authenticatedPrincipalId', 'principalId', 'decision', 'governance', 'approval', 'authority',
+  ]) {
+    if (forbidden in data) return { error: `Console Workroom Profile request cannot carry ${forbidden}` };
+  }
+  const principal = ctx.authenticatedPrincipal;
+  if (!principal) return { error: 'Workroom Profile control requires an authenticated principal' };
+  try {
+    const operationId = requiredRpcText(data.operationId, 'operationId');
+    if (type === 'workroom.profile.pack.publish') {
+      return { data: await control.publishPack(Object.freeze({ operationId, pack: requiredRpcValue(data.pack, 'pack') }), principal) };
+    }
+    const projectId = requiredRpcText(data.projectId, 'projectId');
+    if (type === 'workroom.profile.policy.publish') {
+      const expectedPreviousDigest = optionalRpcText(data.expectedPreviousDigest, 'expectedPreviousDigest');
+      return { data: await control.publishPlanningPolicy(Object.freeze({
+        operationId,
+        projectId,
+        profileRevisionId: requiredRpcText(data.profileRevisionId, 'profileRevisionId'),
+        revision: requiredRpcInteger(data.revision, 'revision'),
+        ...(expectedPreviousDigest ? { expectedPreviousDigest } : {}),
+        policy: requiredRpcValue(data.policy, 'policy'),
+      }), principal) };
+    }
+    const common = {
+      operationId,
+      projectId,
+      expectedRegistryRevision: requiredRpcInteger(data.expectedRegistryRevision, 'expectedRegistryRevision', -1),
+      overlay: requiredRpcValue(data.overlay, 'overlay'),
+      activate: requiredRpcBoolean(data.activate, 'activate'),
+    };
+    return type === 'workroom.profile.rollback'
+      ? { data: await control.publishRollback(Object.freeze({
+          ...common,
+          restoredFromRevisionId: requiredRpcText(data.restoredFromRevisionId, 'restoredFromRevisionId'),
+        }), principal) }
+      : { data: await control.publishProfile(Object.freeze(common), principal) };
+  } catch (error) {
+    return { error: errorMessage(error) };
+  }
+}
+
+async function mutateWorkroomKnowledge(
+  type: 'workroom.knowledge.get' | 'workroom.knowledge.publish' | 'workroom.knowledge.rollback',
+  data: Record<string, unknown>,
+  ctx: ConsoleRpcExtendedCtx,
+): Promise<ExtendedRpcResult> {
+  const control = ctx.workroomKnowledgeControl;
+  if (!control) return { error: 'Workroom Knowledge control is unavailable' };
+  for (const forbidden of [
+    'authenticatedPrincipalId', 'principalId', 'ownerPrincipalId', 'source', 'decision',
+    'governance', 'approval', 'authority', 'body', 'content',
+  ]) {
+    if (forbidden in data) return { error: `Console Workroom Knowledge request cannot carry ${forbidden}` };
+  }
+  try {
+    const projectId = requiredRpcText(data.projectId, 'projectId');
+    if (type === 'workroom.knowledge.get') return { data: await control.read(projectId) };
+    const principal = ctx.authenticatedPrincipal;
+    if (!principal) return { error: 'Workroom Knowledge mutation requires an authenticated principal' };
+    const common = {
+      operationId: requiredRpcText(data.operationId, 'operationId'), projectId,
+      expectedRevision: requiredRpcInteger(data.expectedRevision, 'expectedRevision', -1),
+    };
+    if (type === 'workroom.knowledge.rollback') {
+      return { data: await control.rollback(Object.freeze({
+        ...common, restoreRevision: requiredRpcInteger(data.restoreRevision, 'restoreRevision', 0),
+      }), principal) };
+    }
+    if (!Array.isArray(data.entries)) throw new Error('entries is invalid');
+    return { data: await control.publish(Object.freeze({ ...common, entries: structuredClone(data.entries) }), principal) };
+  } catch (error) {
+    return { error: errorMessage(error) };
+  }
+}
+
+function requiredRpcValue(value: unknown, name: string): unknown {
+  if (value === undefined || value === null) throw new Error(`${name} is required`);
+  return structuredClone(value);
+}
+
+function requiredRpcText(value: unknown, name: string): string {
+  if (typeof value !== 'string' || !value.trim() || value !== value.trim()) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+
+function optionalRpcText(value: unknown, name: string): string | undefined {
+  return value === undefined ? undefined : requiredRpcText(value, name);
+}
+
+function requiredRpcInteger(value: unknown, name: string, minimum = 1): number {
+  if (!Number.isSafeInteger(value) || Number(value) < minimum) throw new Error(`${name} is invalid`);
+  return Number(value);
+}
+
+function requiredRpcBoolean(value: unknown, name: string): boolean {
+  if (typeof value !== 'boolean') throw new Error(`${name} is invalid`);
+  return value;
+}
+
 // ---------------------------------------------------------------- cron
 
 function listSchedule(ctx: ConsoleScheduleListCtx): Promise<ExtendedRpcResult> | ExtendedRpcResult {
@@ -359,7 +557,7 @@ async function listInbox(
   return { data: { [key]: sorted, inboxEnabled: enabled } };
 }
 
-/** request.list —— 未处理的好友/群请求（unified_inbox_request 中 resolved=0）。 */
+/** request.list —— 优先 live EndpointManagement.listRequests；否则回退 unified_inbox_request。 */
 async function listPendingRequests(
   d: Record<string, unknown>,
   ctx: ConsoleRpcExtendedCtx,
@@ -367,6 +565,32 @@ async function listPendingRequests(
   const adapter = strField(d, '$adapter', 'adapter');
   const endpointKey = strField(d, '$endpoint', 'endpointKey', 'endpoint');
   if (!adapter || !endpointKey) return { error: '$adapter and $endpoint required' };
+
+  if (ctx.withEndpointManagement) {
+    try {
+      const live = await ctx.withEndpointManagement(adapter, endpointKey, async (management) => {
+        if (!management.listRequests) return undefined;
+        const pending = await management.listRequests();
+        const requests = pending.map((row) => mapRequestRow({
+          platform_request_id: row.platform_request_id,
+          type: row.type,
+          scene_type: row.scene_type ?? null,
+          scene_id: row.scene_id,
+          sub_type: row.sub_type ?? null,
+          actor_id: row.actor_id,
+          actor_name: row.actor_name ?? null,
+          comment: row.comment ?? null,
+          created_at: row.created_at,
+          resolved: 0,
+        }));
+        return { data: { requests, inboxEnabled: false, source: 'endpoint' } };
+      });
+      if (live) return live;
+    } catch (error) {
+      return { error: errorMessage(error) };
+    }
+  }
+
   const { rows, enabled } = await readInboxRows(ctx, TABLE_REQUEST, {
     adapter,
     endpoint_id: endpointKey,
@@ -377,7 +601,7 @@ async function listPendingRequests(
     .filter((row) => Number(row.resolved ?? 0) === 0)
     .sort((a, b) => Number(a.created_at ?? 0) - Number(b.created_at ?? 0))
     .map(mapRequestRow);
-  return { data: { requests, inboxEnabled: enabled } };
+  return { data: { requests, inboxEnabled: enabled, source: 'inbox' } };
 }
 
 async function listInboxMessages(
@@ -546,6 +770,52 @@ async function actOnRequest(
   });
 }
 
+function listLoginPending(ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult {
+  const assist = ctx.loginAssist;
+  if (!assist) return { error: '登录辅助未接线（LoginAssist 未挂载）' };
+  const tasks = assist.listPending().map((task) => ({
+    id: task.id,
+    adapter: task.adapter,
+    endpointKey: task.endpointKey,
+    type: task.type,
+    payload: task.payload,
+    createdAt: task.createdAt,
+    expiresAt: task.expiresAt,
+  }));
+  return { data: { tasks, count: tasks.length } };
+}
+
+function submitLogin(
+  d: Record<string, unknown>,
+  ctx: ConsoleRpcExtendedCtx,
+): ExtendedRpcResult {
+  const assist = ctx.loginAssist;
+  if (!assist) return { error: '登录辅助未接线（LoginAssist 未挂载）' };
+  const id = strField(d, '$id', 'id', 'taskId');
+  if (!id) return { error: '$id required' };
+  const raw = d.$value ?? d.value ?? d.ticket ?? d.code ?? '';
+  const value = typeof raw === 'string' || (raw && typeof raw === 'object')
+    ? raw as string | Record<string, unknown>
+    : String(raw ?? '');
+  const ok = assist.submit(id, value);
+  if (!ok) return { error: `login task not found: ${id}` };
+  return { data: { success: true } };
+}
+
+function cancelLogin(
+  d: Record<string, unknown>,
+  ctx: ConsoleRpcExtendedCtx,
+): ExtendedRpcResult {
+  const assist = ctx.loginAssist;
+  if (!assist) return { error: '登录辅助未接线（LoginAssist 未挂载）' };
+  const id = strField(d, '$id', 'id', 'taskId');
+  if (!id) return { error: '$id required' };
+  const reason = strField(d, '$reason', 'reason') || 'cancelled';
+  const ok = assist.cancel(id, reason);
+  if (!ok) return { error: `login task not found: ${id}` };
+  return { data: { success: true } };
+}
+
 // ---------------------------------------------------------------- 社交读取
 
 async function listFriends(