@zhin.js/host-http 1.0.2 → 1.0.3

package/README.md

@@ -45,5 +45,6 @@ http:
   base: /api                    # auth prefix
 ```
 
-Still deferred to later host migration: full `@zhin.js/host-api` management-plane REST/RPC/SSE
-and retiring the legacy Koa `@zhin.js/host-router` stack.
+The legacy Koa `@zhin.js/host-router` stack and the `@zhin.js/host-api` management-plane plugin have
+been removed; the management-plane REST/RPC/SSE is now assembled by `@zhin.js/cli` (Console Host) on
+top of this package — no Host plugins need to be installed or enabled.

package/lib/console-rest-pages.js

@@ -99,12 +99,19 @@ function registerLogsRoutes(route, base, ctx) {
             });
             return;
         }
-        const total = await LogModel.select();
+        // 计数走 DB 侧聚合（count）；模型未实现 count 时降级为 select('id') 只取主键列
+        const countRows = async (where) => {
+            if (typeof LogModel.count === 'function')
+                return LogModel.count(where);
+            const selection = LogModel.select('id');
+            const rows = await (where ? selection.where(where) : selection);
+            return rows.length;
+        };
+        const total = await countRows();
         const levels = ['info', 'warn', 'error'];
         const levelCounts = {};
         for (const level of levels) {
-            const count = await LogModel.select().where({ level });
-            levelCounts[level] = count.length;
+            levelCounts[level] = await countRows({ level });
         }
         const oldestLog = await LogModel.select('timestamp')
             .orderBy('timestamp', 'ASC')
@@ -116,7 +123,7 @@ function registerLogsRoutes(route, base, ctx) {
             : null;
         writeJson(response, 200, {
             success: true,
-            data: { total: total.length, byLevel: levelCounts, oldestTimestamp },
+            data: { total, byLevel: levelCounts, oldestTimestamp },
         });
     }, { summary: 'System log stats', tags: ['console', 'logs'] });
     route('POST', `${base}/logs/cleanup`, async (request, response, _url, authScope) => {

package/lib/console-rpc-extended.d.ts

@@ -47,12 +47,12 @@ export type ExtendedRpcResult = {
 };
 interface EndpointManagementPort {
     listFriends?(): Promise<readonly {
-        user_id: number;
+        user_id: number | string;
         nickname: string;
         remark: string;
     }[]>;
     listGroups?(): Promise<readonly {
-        group_id: number;
+        group_id: number | string;
         name: string;
     }[]>;
     listChannels?(): Promise<readonly {

package/lib/console-rpc-extended.js

@@ -203,12 +203,19 @@ function getInboxModel(ctx, table) {
         return undefined;
     return model;
 }
-async function readInboxRows(ctx, table, where) {
+async function readInboxRows(ctx, table, where, options) {
     const model = getInboxModel(ctx, table);
     if (!model)
         return { rows: [], enabled: false };
     try {
-        const rows = await model.select().where(where);
+        let selection = model.select().where(where);
+        if (options?.orderBy && typeof selection.orderBy === 'function') {
+            selection = selection.orderBy(options.orderBy.field, options.orderBy.direction ?? 'DESC');
+        }
+        if (options?.limit != null && typeof selection.limit === 'function') {
+            selection = selection.limit(options.limit);
+        }
+        const rows = await selection;
         return { rows: Array.isArray(rows) ? rows : [], enabled: true };
     }
     catch {
@@ -226,6 +233,10 @@ async function listInbox(d, ctx, table, key, mapRow) {
     const { rows, enabled } = await readInboxRows(ctx, table, {
         adapter,
         endpoint_id: endpointId,
+    }, {
+        // sort/limit 下推到 DB 侧（内存 sort/slice 保留，作为无下推能力模型的兜底）
+        orderBy: { field: 'created_at', direction: 'DESC' },
+        limit: offset + limit,
     });
     const sorted = rows
         .slice()
@@ -243,6 +254,8 @@ async function listPendingRequests(d, ctx) {
     const { rows, enabled } = await readInboxRows(ctx, TABLE_REQUEST, {
         adapter,
         endpoint_id: endpointId,
+    }, {
+        orderBy: { field: 'created_at', direction: 'ASC' },
     });
     const requests = rows
         .filter((row) => Number(row.resolved ?? 0) === 0)
@@ -272,7 +285,10 @@ async function listInboxMessages(d, ctx) {
         where.channel_parent_type = parent.type;
         where.channel_parent_id = parent.id;
     }
-    const { rows, enabled } = await readInboxRows(ctx, TABLE_MESSAGE, where);
+    const { rows, enabled } = await readInboxRows(ctx, TABLE_MESSAGE, where, {
+        // before_ts/before_id 过滤保留在内存（涉及双字段比较），排序下推 DB 侧
+        orderBy: { field: 'created_at', direction: 'DESC' },
+    });
     const messages = rows
         .filter((row) => (beforeTs == null || Number(row.created_at ?? 0) < beforeTs)
         && (beforeId == null || Number(row.id ?? 0) < beforeId))

package/lib/http-host.js

@@ -5,6 +5,7 @@ import { createToken } from '@zhin.js/plugin-runtime';
 import { TokenRegistry, extractBearerToken, isDemoWebSocketPath, } from './token-registry.js';
 import { buildOpenApiDocument, } from './openapi.js';
 import { isDemoHttpAllowed } from './console-rpc.js';
+import { HttpBodyError } from './json-body.js';
 const logger = getLogger('HttpHost');
 export const REMOTE_CONSOLE_ORIGIN = 'https://console.zhin.dev';
 const DEFAULT_CORS_ORIGINS = Object.freeze([REMOTE_CONSOLE_ORIGIN]);
@@ -180,6 +181,14 @@ export function createHttpHost(options = {}) {
             await route.handler(request, response, url, auth.scope);
         }
         catch (err) {
+            // 统一把请求体错误（400/413）映射回对应状态码，
+            // 避免个别端点未捕获时退化成 500 空响应。
+            if (err instanceof HttpBodyError) {
+                if (!response.headersSent) {
+                    writeJson(response, err.statusCode, { success: false, error: err.message });
+                }
+                return;
+            }
             logger.warn(formatCompact({
                 op: 'http_handler_failed',
                 path: pathname,

package/lib/json-body.js

@@ -14,15 +14,23 @@ export async function readJsonBody(request, options = {}) {
     const limit = options.limit ?? 1_048_576;
     const chunks = [];
     let size = 0;
+    let exceeded = false;
     for await (const chunk of request) {
+        // 超限后继续 drain 到 end：提前 break 会 destroy 底层 socket，
+        // 客户端将永远收不到后面的 413 响应。
+        if (exceeded)
+            continue;
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         size += buffer.length;
         if (size > limit) {
-            request.destroy();
-            throw new HttpBodyError(`Request body exceeds ${limit} bytes`, 413);
+            exceeded = true;
+            chunks.length = 0;
+            continue;
         }
         chunks.push(buffer);
     }
+    if (exceeded)
+        throw new HttpBodyError(`Request body exceeds ${limit} bytes`, 413);
     if (chunks.length === 0)
         return undefined;
     const raw = Buffer.concat(chunks).toString('utf8').trim();

package/lib/project-files.js

@@ -5,6 +5,16 @@ export const FILE_MANAGER_ALLOWED = Object.freeze([
     'src',
     'plugins',
     'client',
+    // Plugin Runtime convention directories (file-based discovery)
+    'commands',
+    'adapters',
+    'components',
+    'middlewares',
+    'tools',
+    'mcp',
+    'pages',
+    'skills',
+    'agents',
     'package.json',
     'tsconfig.json',
     'zhin.config.yml',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/host-http",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Minimal HTTP and WebSocket host for Plugin Runtime (no Koa)",
   "type": "module",
   "main": "./lib/index.js",
@@ -20,7 +20,7 @@
     "ws": "^8.21.0",
     "@zhin.js/console-protocol": "1.1.0",
     "@zhin.js/logger": "1.0.75",
-    "@zhin.js/plugin-runtime": "1.1.0"
+    "@zhin.js/plugin-runtime": "1.1.1"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",

package/src/console-rest-pages.ts

@@ -85,6 +85,8 @@ export interface ConsoleRestPagesOptions {
 type LogModelLike = {
   select(...fields: string[]): LogSelectionLike;
   delete(where: Record<string, unknown>): Promise<unknown>;
+  /** DB 侧 count 聚合（可选；缺失时降级为 select('id') 计数）。 */
+  count?(where?: Record<string, unknown>): Promise<number>;
 };
 
 type LogSelectionLike = PromiseLike<LogRow[]> & {
@@ -223,13 +225,20 @@ function registerLogsRoutes(
       return;
     }
 
-    const total = await LogModel.select();
+    // 计数走 DB 侧聚合（count）；模型未实现 count 时降级为 select('id') 只取主键列
+    const countRows = async (where?: Record<string, unknown>): Promise<number> => {
+      if (typeof LogModel.count === 'function') return LogModel.count(where);
+      const selection = LogModel.select('id');
+      const rows = await (where ? selection.where(where) : selection);
+      return rows.length;
+    };
+
+    const total = await countRows();
     const levels = ['info', 'warn', 'error'];
     const levelCounts: Record<string, number> = {};
 
     for (const level of levels) {
-      const count = await LogModel.select().where({ level });
-      levelCounts[level] = count.length;
+      levelCounts[level] = await countRows({ level });
     }
 
     const oldestLog = await LogModel.select('timestamp')
@@ -244,7 +253,7 @@ function registerLogsRoutes(
 
     writeJson(response, 200, {
       success: true,
-      data: { total: total.length, byLevel: levelCounts, oldestTimestamp },
+      data: { total, byLevel: levelCounts, oldestTimestamp },
     });
   }, { summary: 'System log stats', tags: ['console', 'logs'] });
 

package/src/console-rpc-extended.ts

@@ -67,18 +67,28 @@ interface ScheduleJobRow {
   description?: string;
 }
 
+interface InboxSelection {
+  where(query: Record<string, unknown>): InboxSelection;
+  /** 可选：DB 侧排序下推（wrapModel 链具备该能力，轻量 fake 可缺失）。 */
+  orderBy?(field: string, direction?: 'ASC' | 'DESC'): InboxSelection;
+  /** 可选：DB 侧 limit 下推。 */
+  limit?(count: number): InboxSelection;
+  then<TResult1 = Record<string, unknown>[], TResult2 = never>(
+    onfulfilled?: ((value: Record<string, unknown>[]) => TResult1 | PromiseLike<TResult1>) | null,
+    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,
+  ): Promise<TResult1 | TResult2>;
+}
+
 interface InboxModel {
-  select(): {
-    where(query: Record<string, unknown>): Promise<Record<string, unknown>[]> | Record<string, unknown>[];
-  };
+  select(): InboxSelection;
   update?(patch: Record<string, unknown>): {
     where(query: Record<string, unknown>): Promise<unknown> | unknown;
   };
 }
 
 interface EndpointManagementPort {
-  listFriends?(): Promise<readonly { user_id: number; nickname: string; remark: string }[]>;
-  listGroups?(): Promise<readonly { group_id: number; name: string }[]>;
+  listFriends?(): Promise<readonly { user_id: number | string; nickname: string; remark: string }[]>;
+  listGroups?(): Promise<readonly { group_id: number | string; name: string }[]>;
   listChannels?(): Promise<readonly {
     id: string;
     name?: string;
@@ -297,11 +307,24 @@ async function readInboxRows(
   ctx: ConsoleRpcExtendedCtx,
   table: string,
   where: Record<string, unknown>,
+  options?: {
+    /** DB 侧排序下推（模型不支持时由调用方内存排序兜底）。 */
+    orderBy?: { field: string; direction?: 'ASC' | 'DESC' };
+    /** DB 侧 limit 下推（模型不支持时由调用方内存分页兜底）。 */
+    limit?: number;
+  },
 ): Promise<{ rows: Record<string, unknown>[]; enabled: boolean }> {
   const model = getInboxModel(ctx, table);
   if (!model) return { rows: [], enabled: false };
   try {
-    const rows = await model.select().where(where);
+    let selection: InboxSelection = model.select().where(where);
+    if (options?.orderBy && typeof selection.orderBy === 'function') {
+      selection = selection.orderBy(options.orderBy.field, options.orderBy.direction ?? 'DESC');
+    }
+    if (options?.limit != null && typeof selection.limit === 'function') {
+      selection = selection.limit(options.limit);
+    }
+    const rows = await selection;
     return { rows: Array.isArray(rows) ? rows : [], enabled: true };
   } catch {
     // 表未创建 / 方言未启动等场景降级为空，不向上抛。
@@ -324,6 +347,10 @@ async function listInbox(
   const { rows, enabled } = await readInboxRows(ctx, table, {
     adapter,
     endpoint_id: endpointId,
+  }, {
+    // sort/limit 下推到 DB 侧（内存 sort/slice 保留，作为无下推能力模型的兜底）
+    orderBy: { field: 'created_at', direction: 'DESC' },
+    limit: offset + limit,
   });
   const sorted = rows
     .slice()
@@ -344,6 +371,8 @@ async function listPendingRequests(
   const { rows, enabled } = await readInboxRows(ctx, TABLE_REQUEST, {
     adapter,
     endpoint_id: endpointId,
+  }, {
+    orderBy: { field: 'created_at', direction: 'ASC' },
   });
   const requests = rows
     .filter((row) => Number(row.resolved ?? 0) === 0)
@@ -378,7 +407,10 @@ async function listInboxMessages(
     where.channel_parent_type = parent.type;
     where.channel_parent_id = parent.id;
   }
-  const { rows, enabled } = await readInboxRows(ctx, TABLE_MESSAGE, where);
+  const { rows, enabled } = await readInboxRows(ctx, TABLE_MESSAGE, where, {
+    // before_ts/before_id 过滤保留在内存（涉及双字段比较），排序下推 DB 侧
+    orderBy: { field: 'created_at', direction: 'DESC' },
+  });
   const messages = rows
     .filter((row) => (beforeTs == null || Number(row.created_at ?? 0) < beforeTs)
       && (beforeId == null || Number(row.id ?? 0) < beforeId))

package/src/http-host.ts

@@ -22,6 +22,7 @@ import {
   type RouteMeta,
 } from './openapi.js';
 import { isDemoHttpAllowed } from './console-rpc.js';
+import { HttpBodyError } from './json-body.js';
 
 const logger = getLogger('HttpHost');
 
@@ -276,6 +277,14 @@ export function createHttpHost(options: HttpHostOptions = {}): HttpHost {
       response.setHeader('X-Frame-Options', 'SAMEORIGIN');
       await route.handler(request, response, url, auth.scope);
     } catch (err) {
+      // 统一把请求体错误（400/413）映射回对应状态码，
+      // 避免个别端点未捕获时退化成 500 空响应。
+      if (err instanceof HttpBodyError) {
+        if (!response.headersSent) {
+          writeJson(response, err.statusCode, { success: false, error: err.message });
+        }
+        return;
+      }
       logger.warn(formatCompact({
         op: 'http_handler_failed',
         path: pathname,

package/src/json-body.ts

@@ -21,15 +21,21 @@ export async function readJsonBody<T = unknown>(
   const limit = options.limit ?? 1_048_576;
   const chunks: Buffer[] = [];
   let size = 0;
+  let exceeded = false;
   for await (const chunk of request) {
+    // 超限后继续 drain 到 end：提前 break 会 destroy 底层 socket，
+    // 客户端将永远收不到后面的 413 响应。
+    if (exceeded) continue;
     const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
     size += buffer.length;
     if (size > limit) {
-      request.destroy();
-      throw new HttpBodyError(`Request body exceeds ${limit} bytes`, 413);
+      exceeded = true;
+      chunks.length = 0;
+      continue;
     }
     chunks.push(buffer);
   }
+  if (exceeded) throw new HttpBodyError(`Request body exceeds ${limit} bytes`, 413);
   if (chunks.length === 0) return undefined;
   const raw = Buffer.concat(chunks).toString('utf8').trim();
   if (!raw) return undefined;

package/src/project-files.ts

@@ -6,6 +6,16 @@ export const FILE_MANAGER_ALLOWED = Object.freeze([
   'src',
   'plugins',
   'client',
+  // Plugin Runtime convention directories (file-based discovery)
+  'commands',
+  'adapters',
+  'components',
+  'middlewares',
+  'tools',
+  'mcp',
+  'pages',
+  'skills',
+  'agents',
   'package.json',
   'tsconfig.json',
   'zhin.config.yml',