@zhin.js/host-http 1.1.4 → 1.1.6

package/lib/console-plugin-rpc.js

@@ -30,6 +30,39 @@ export async function dispatchPluginConsoleRpc(type, message, ctx) {
                     },
                 };
             }
+            case PLUGIN_RPC.INSPECT:
+            case PLUGIN_RPC.APPLY:
+            case PLUGIN_RPC.PLAN_VERIFICATION:
+            case PLUGIN_RPC.VERIFY: {
+                const name = stringField(message, 'instanceKey') || stringField(message, 'packageName');
+                if (!name)
+                    return { requestId, error: 'instanceKey or packageName is required' };
+                const port = ctx.pluginManagement;
+                if (!port)
+                    return { requestId, error: 'Plugin management is not configured' };
+                if (type === PLUGIN_RPC.APPLY || type === PLUGIN_RPC.PLAN_VERIFICATION || type === PLUGIN_RPC.VERIFY) {
+                    if (ctx.authScope !== 'full')
+                        return { requestId, error: 'Full scope required' };
+                }
+                if (type === PLUGIN_RPC.INSPECT && port.inspect)
+                    return { requestId, data: await port.inspect(name) };
+                if (type === PLUGIN_RPC.APPLY && port.apply)
+                    return { requestId, data: await port.apply(name, optionalString(message.expectedProjectRevision)) };
+                if (type === PLUGIN_RPC.PLAN_VERIFICATION && port.verificationPlan)
+                    return { requestId, data: await port.verificationPlan(name) };
+                if (type === PLUGIN_RPC.VERIFY && port.verify) {
+                    const checkId = stringField(message, 'checkId');
+                    if (!checkId)
+                        return { requestId, error: 'checkId is required' };
+                    const expectedGeneration = message.expectedGeneration;
+                    const projectRevision = stringField(message, 'expectedProjectRevision');
+                    const checkRevision = stringField(message, 'expectedCheckRevision');
+                    if (!(expectedGeneration === null || typeof expectedGeneration === 'number' && Number.isSafeInteger(expectedGeneration) && expectedGeneration >= 0) || !projectRevision || !checkRevision)
+                        return { requestId, error: 'expectedGeneration, expectedProjectRevision and expectedCheckRevision are required' };
+                    return { requestId, data: await port.verify(name, checkId, expectedGeneration, projectRevision, checkRevision) };
+                }
+                return { requestId, error: 'Plugin workflow operation is not configured' };
+            }
             case PLUGIN_RPC.PLAN_INSTALL: {
                 const packageName = stringField(message, 'packageName');
                 if (!packageName)
@@ -45,7 +78,7 @@ export async function dispatchPluginConsoleRpc(type, message, ctx) {
                 if (!ctx.pluginManagement?.install) {
                     return { requestId, error: 'Plugin installation is not configured' };
                 }
-                const result = await ctx.pluginManagement.install(packageName, optionalString(message.expectedRevision));
+                const result = await ctx.pluginManagement.install(packageName, optionalString(message.expectedRevision), optionalString(message.expectedProjectRevision));
                 ctx.publishEvent?.('plugin:installed', { packageName, restartRequired: result.restartRequired });
                 return { requestId, data: { success: true, ...result } };
             }
@@ -66,7 +99,7 @@ export async function dispatchPluginConsoleRpc(type, message, ctx) {
                 if (!ctx.pluginManagement?.uninstall) {
                     return { requestId, error: 'Plugin uninstall is not configured' };
                 }
-                const result = await ctx.pluginManagement.uninstall(packageName, optionalString(message.expectedRevision));
+                const result = await ctx.pluginManagement.uninstall(packageName, optionalString(message.expectedRevision), optionalString(message.expectedProjectRevision));
                 ctx.publishEvent?.('plugin:uninstalled', { packageName, restartRequired: result.restartRequired });
                 return { requestId, data: { success: true, ...result } };
             }
@@ -89,7 +122,7 @@ export async function dispatchPluginConsoleRpc(type, message, ctx) {
                 }
                 if (!ctx.pluginManagement?.update)
                     return { requestId, error: 'Plugin update is not configured' };
-                const result = await ctx.pluginManagement.update(packageName, targetVersion, optionalString(message.expectedRevision));
+                const result = await ctx.pluginManagement.update(packageName, targetVersion, optionalString(message.expectedRevision), optionalString(message.expectedProjectRevision));
                 ctx.publishEvent?.('plugin:updated', {
                     packageName,
                     version: result.installedVersion,
@@ -118,7 +151,7 @@ export async function dispatchPluginConsoleRpc(type, message, ctx) {
         }
     }
     catch (error) {
-        return { requestId, error: error instanceof Error ? error.message : String(error) };
+        return { requestId, error: error instanceof Error ? error.message : String(error), ...(error instanceof Error && 'completedStages' in error ? { data: { completedStages: error.completedStages, ...('state' in error ? { state: error.state } : {}) } } : {}) };
     }
 }
 function stringField(message, key) {

package/lib/console-rest-pages.d.ts

@@ -1,4 +1,5 @@
 import type { HttpHost } from './http-host.js';
+import type { ConsoleMessageEventData } from '@zhin.js/console-protocol';
 /** 与 basic/cli 接线方对齐的上下文约定。 */
 export interface ConsoleRestCtx {
     /** false = demo 部署：只读 GET 放行，写操作一律 403。 */
@@ -47,6 +48,18 @@ export interface ConsoleAgentIntrospection {
         props: unknown;
         signal: AbortSignal;
     }>): Promise<unknown>;
+    previewComponentDelivery?(input: Readonly<{
+        requester: string;
+        name: string;
+        props: unknown;
+        target: unknown;
+        signal: AbortSignal;
+    }>): Promise<Readonly<{
+        output: unknown;
+        rendering: NonNullable<ConsoleMessageEventData['rendering']>;
+        generation: number;
+        note: string;
+    }>>;
 }
 /** Session tree 门面 — 形状对齐 agent 包 SessionTreeRuntimeHandle。 */
 export interface ConsoleAgentSessionTree {

package/lib/console-rest-pages.js

@@ -544,6 +544,7 @@ function registerIntrospectionRoutes(route, base, ctx, options) {
         }
         const lease = ctx.acquireAgentRuntime?.();
         const render = lease?.value.introspection?.renderComponent;
+        const previewDelivery = lease?.value.introspection?.previewComponentDelivery;
         if (!lease || !render) {
             lease?.release();
             writeJson(response, 503, { success: false, error: 'Component Runtime 未就绪' });
@@ -561,15 +562,22 @@ function registerIntrospectionRoutes(route, base, ctx, options) {
             activeComponentPreviews -= 1;
             lease.release();
         };
-        const renderPromise = Promise.resolve().then(() => render({ requester, name, props: body.props ?? {}, signal: controller.signal }));
+        const renderPromise = Promise.resolve().then(() => {
+            const input = { requester, name, props: body.props ?? {}, signal: controller.signal };
+            if (body.target === undefined)
+                return render(input).then(output => ({ output }));
+            if (!previewDelivery)
+                throw new Error('Target-aware Component preview 未就绪');
+            return previewDelivery({ ...input, target: body.target });
+        });
         // A timed-out implementation may ignore AbortSignal. Keep its generation
         // lease until the real operation settles; the bounded concurrency gate
         // prevents non-cooperative previews from pinning unbounded generations.
         void renderPromise.then(release, release);
         try {
-            const output = await raceWithAbort(renderPromise, controller.signal);
-            assertPreviewOutput(output, options.componentPreviewMaxBytes ?? 256 * 1024);
-            writeJson(response, 200, { success: true, data: { requester, name, output } });
+            const preview = await raceWithAbort(renderPromise, controller.signal);
+            assertPreviewOutput(preview, options.componentPreviewMaxBytes ?? 256 * 1024);
+            writeJson(response, 200, { success: true, data: { requester, name, ...preview } });
         }
         catch (error) {
             const status = error instanceof ComponentPreviewTimeoutError

package/lib/console-rpc-extended/inbox-rpc.js

@@ -222,6 +222,7 @@ export function mapNoticeRow(row) {
     };
 }
 function mapMessageRow(row) {
+    const observation = readMessageObservation(row.raw);
     return {
         id: row.id,
         platformMessageId: row.platform_message_id,
@@ -230,8 +231,49 @@ function mapMessageRow(row) {
         raw: row.raw,
         timestamp: row.created_at,
         channel: channelFromStoredRow(row),
+        ...observation,
     };
 }
+function isStoredConversation(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const conversation = value;
+    const endpoint = conversation.endpoint;
+    if (!endpoint || typeof endpoint !== 'object'
+        || typeof endpoint.id !== 'string' || typeof endpoint.adapter !== 'string'
+        || typeof conversation.kind !== 'string' || typeof conversation.id !== 'string')
+        return false;
+    if (conversation.threadId !== undefined && typeof conversation.threadId !== 'string')
+        return false;
+    if (conversation.parent !== undefined) {
+        const parent = conversation.parent;
+        if (!parent || typeof parent !== 'object' || typeof parent.kind !== 'string' || typeof parent.id !== 'string')
+            return false;
+    }
+    return true;
+}
+/** Older rows have no observation; do not invent their direction or diagnostics. */
+function readMessageObservation(raw) {
+    if (typeof raw !== 'string')
+        return {};
+    try {
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== 'object')
+            return {};
+        const entry = value;
+        if (entry.$console !== 'zhin.message-observation/1'
+            || (entry.direction !== 'inbound' && entry.direction !== 'outbound'))
+            return {};
+        return { direction: entry.direction,
+            ...(isStoredConversation(entry.conversation) ? { conversation: entry.conversation } : {}),
+            ...(entry.direction === 'outbound' && entry.rendering && typeof entry.rendering === 'object'
+                ? { rendering: entry.rendering } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
 function actorFromStoredRow(row, field) {
     const id = String(row[`${field}_id`] ?? '');
     const name = row[`${field}_name`];

package/lib/console-rpc.d.ts

@@ -23,6 +23,8 @@ export type RuntimeConsoleRpcMessage = {
 };
 export type RuntimeConsoleRpcReply = Record<string, unknown>;
 export interface PluginInstallPlan {
+    readonly projectRevision?: string;
+    readonly configurationRevision?: string | null;
     readonly packageName: string;
     readonly instanceKey: string;
     readonly alreadyDeclared: boolean;
@@ -35,6 +37,8 @@ export interface PluginInstallPlan {
     readonly warnings: readonly string[];
 }
 export interface PluginUninstallPlan {
+    readonly projectRevision?: string;
+    readonly configurationRevision?: string | null;
     readonly packageName: string;
     readonly instanceKey: string;
     readonly installed: boolean;
@@ -43,6 +47,8 @@ export interface PluginUninstallPlan {
     readonly restartRequired: boolean;
 }
 export interface PluginUpdatePlan {
+    readonly projectRevision?: string;
+    readonly configurationRevision?: string | null;
     readonly packageName: string;
     readonly instanceKey: string;
     readonly currentVersion: string | null;
@@ -52,25 +58,74 @@ export interface PluginUpdatePlan {
     readonly alreadyCurrent: boolean;
     readonly restartRequired: boolean;
 }
+export interface PluginManagementState {
+    readonly packageName: string;
+    readonly instanceKey: string;
+    readonly installed: boolean;
+    readonly plugin: boolean;
+    readonly declared: boolean;
+    readonly version: string | null;
+    readonly revision: string | null;
+    readonly projectRevision: string;
+    readonly status: 'not-installed' | 'installed' | 'declared' | 'missing-config' | 'pending-restart' | 'enabled' | 'degraded';
+    readonly dependencies: 'unchecked' | 'passed' | 'failed';
+    readonly validation: PluginConfigValidation | null;
+    readonly generation: number | null;
+    readonly published: boolean;
+    readonly readiness: 'unknown' | 'ready' | 'pending' | 'degraded';
+    readonly restartRequired: boolean;
+    readonly disabled: boolean;
+    readonly issues: readonly string[];
+    /** Publication is never proof of a successful business action. */
+    readonly verification: 'not-configured' | 'available';
+}
+export interface PluginVerificationPlan {
+    readonly packageName: string;
+    readonly instanceKey: string;
+    readonly generation: number | null;
+    readonly projectRevision: string;
+    readonly checkRevision: string;
+    readonly checks: readonly import('@zhin.js/plugin-runtime').PluginVerificationCheck[];
+}
+export interface PluginVerificationResult {
+    readonly packageName: string;
+    readonly instanceKey: string;
+    readonly checkId: string;
+    readonly generation: number | null;
+    readonly current: boolean;
+    readonly status: 'passed' | 'failed' | 'not-configured';
+    readonly scope: 'local' | 'platform' | null;
+    readonly summary: string;
+    readonly evidence: readonly string[];
+}
 export interface PluginManagementPort {
+    inspect?(packageName: string): Promise<PluginManagementState>;
+    apply?(packageName: string, expectedProjectRevision?: string): Promise<{
+        readonly requested: boolean;
+        readonly state: PluginManagementState;
+    }>;
+    verificationPlan?(packageName: string): Promise<PluginVerificationPlan>;
+    verify?(packageName: string, checkId: string, expectedGeneration: number | null, expectedProjectRevision: string, expectedCheckRevision: string): Promise<PluginVerificationResult>;
     planInstall(packageName: string): Promise<PluginInstallPlan>;
-    install?(packageName: string, expectedRevision?: string): Promise<Readonly<{
+    install?(packageName: string, expectedRevision?: string, expectedProjectRevision?: string): Promise<Readonly<{
         readonly plan: PluginInstallPlan;
         readonly restartRequired: boolean;
     }>>;
     planUninstall?(packageName: string): Promise<PluginUninstallPlan>;
-    uninstall?(packageName: string, expectedRevision?: string): Promise<Readonly<{
+    uninstall?(packageName: string, expectedRevision?: string, expectedProjectRevision?: string): Promise<Readonly<{
         readonly plan: PluginUninstallPlan;
         readonly restartRequired: boolean;
     }>>;
     planUpdate?(packageName: string, targetVersion: string): Promise<PluginUpdatePlan>;
-    update?(packageName: string, targetVersion: string, expectedRevision?: string): Promise<Readonly<{
+    update?(packageName: string, targetVersion: string, expectedRevision?: string, expectedProjectRevision?: string): Promise<Readonly<{
         readonly plan: PluginUpdatePlan;
         readonly installedVersion: string;
         readonly restartRequired: boolean;
     }>>;
 }
 export interface PluginConfigValidation {
+    /** False means only environment-reference checks ran; Runtime must validate TS-only declarations. */
+    readonly schemaAvailable?: boolean;
     readonly valid: boolean;
     readonly errors: readonly {
         readonly path: string;

package/lib/index.d.ts

@@ -5,7 +5,7 @@ export { timingSafeEqualString } from './timing-safe-equal.js';
 export { createConsoleEventHub, consoleEventHubToken, type ConsoleEventHub, } from './console-events.js';
 export { buildOpenApiDocument, patternToOpenApiPath, routeRequiresBearerAuth, type BuildOpenApiOptions, type ListedRoute, type OpenApiParameter, type RouteMeta, } from './openapi.js';
 export { HttpBodyError, readJsonBody, } from './json-body.js';
-export { dispatchRuntimeConsoleRpc, isDemoHttpAllowed, pickRpcReply, type RuntimeConsolePage, type RuntimeConsoleRpcContext, type RuntimeConsoleRpcMessage, type RuntimeConsoleRpcReply, type RuntimeEndpointSendInput, type PluginInstallPlan, type PluginUninstallPlan, type PluginUpdatePlan, type PluginManagementPort, type PluginConfigValidation, } from './console-rpc.js';
+export { dispatchRuntimeConsoleRpc, isDemoHttpAllowed, pickRpcReply, type RuntimeConsolePage, type RuntimeConsoleRpcContext, type RuntimeConsoleRpcMessage, type RuntimeConsoleRpcReply, type RuntimeEndpointSendInput, type PluginInstallPlan, type PluginUninstallPlan, type PluginUpdatePlan, type PluginManagementPort, type PluginManagementState, type PluginVerificationResult, type PluginVerificationPlan, type PluginConfigValidation, } from './console-rpc.js';
 export { dispatchPluginConsoleRpc } from './console-plugin-rpc.js';
 export { buildProjectFileTree, FILE_MANAGER_ALLOWED, FILE_MANAGER_BLOCKED, isProjectPathAllowed, listEnvFiles, readProjectFile, saveProjectFile, type FileTreeNode, } from './project-files.js';
 export { registerConsoleRestPages, type ConsoleAgentIntrospection, type ConsoleAgentRuntime, type ConsoleAgentSessionTree, type ConsoleRestCtx, type ConsoleRestPagesOptions, } from './console-rest-pages.js';

package/lib/project-files.js

@@ -10,14 +10,27 @@ export const FILE_MANAGER_ALLOWED = Object.freeze([
     'adapters',
     'components',
     'middlewares',
+    'handlers',
+    'schedules',
+    'hooks',
+    'prompt-sections',
     'tools',
-    'mcp',
+    'mcps',
     'pages',
     'skills',
     'agents',
     'package.json',
+    'plugin.ts',
+    'plugin.tsx',
+    'plugin.js',
+    'plugin.mjs',
+    'plugin.cjs',
+    'schema.json',
+    'AGENTS.md',
     'tsconfig.json',
     'zhin.config.yml',
+    'zhin.config.yaml',
+    'zhin.config.json',
     'config.yml',
     'config.yaml',
     'config.json',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/host-http",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "Minimal HTTP and WebSocket host for Plugin Runtime (no Koa)",
   "type": "module",
   "main": "./lib/index.js",
@@ -8,7 +8,6 @@
   "exports": {
     ".": {
       "types": "./lib/index.d.ts",
-      "development": "./src/index.ts",
       "import": "./lib/index.js"
     }
   },
@@ -18,11 +17,11 @@
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@zhin.js/console-protocol": "1.1.7",
-    "@zhin.js/host-http-contract": "1.1.0",
-    "@zhin.js/logger": "1.1.1",
-    "@zhin.js/schedule": "1.1.2",
-    "@zhin.js/plugin-runtime": "1.1.12"
+    "@zhin.js/console-protocol": "1.1.9",
+    "@zhin.js/host-http-contract": "1.1.1",
+    "@zhin.js/logger": "1.1.2",
+    "@zhin.js/schedule": "1.1.3",
+    "@zhin.js/plugin-runtime": "1.1.14"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
@@ -30,7 +29,7 @@
     "typescript": "^6.0.3"
   },
   "engines": {
-    "node": "^20.19.0 || >=22.12.0"
+    "node": ">=22.19.0"
   },
   "repository": {
     "type": "git",

package/src/console-plugin-rpc.ts

@@ -40,6 +40,31 @@ export async function dispatchPluginConsoleRpc(
           },
         };
       }
+      case PLUGIN_RPC.INSPECT:
+      case PLUGIN_RPC.APPLY:
+      case PLUGIN_RPC.PLAN_VERIFICATION:
+      case PLUGIN_RPC.VERIFY: {
+        const name = stringField(message, 'instanceKey') || stringField(message, 'packageName');
+        if (!name) return { requestId, error: 'instanceKey or packageName is required' };
+        const port = ctx.pluginManagement;
+        if (!port) return { requestId, error: 'Plugin management is not configured' };
+        if (type === PLUGIN_RPC.APPLY || type === PLUGIN_RPC.PLAN_VERIFICATION || type === PLUGIN_RPC.VERIFY) {
+          if (ctx.authScope !== 'full') return { requestId, error: 'Full scope required' };
+        }
+        if (type === PLUGIN_RPC.INSPECT && port.inspect) return { requestId, data: await port.inspect(name) };
+        if (type === PLUGIN_RPC.APPLY && port.apply) return { requestId, data: await port.apply(name, optionalString(message.expectedProjectRevision)) };
+        if (type === PLUGIN_RPC.PLAN_VERIFICATION && port.verificationPlan) return { requestId, data: await port.verificationPlan(name) };
+        if (type === PLUGIN_RPC.VERIFY && port.verify) {
+          const checkId = stringField(message, 'checkId');
+          if (!checkId) return { requestId, error: 'checkId is required' };
+          const expectedGeneration = message.expectedGeneration;
+          const projectRevision = stringField(message, 'expectedProjectRevision');
+          const checkRevision = stringField(message, 'expectedCheckRevision');
+          if (!(expectedGeneration === null || typeof expectedGeneration === 'number' && Number.isSafeInteger(expectedGeneration) && expectedGeneration >= 0) || !projectRevision || !checkRevision) return { requestId, error: 'expectedGeneration, expectedProjectRevision and expectedCheckRevision are required' };
+          return { requestId, data: await port.verify(name, checkId, expectedGeneration, projectRevision, checkRevision) };
+        }
+        return { requestId, error: 'Plugin workflow operation is not configured' };
+      }
       case PLUGIN_RPC.PLAN_INSTALL: {
         const packageName = stringField(message, 'packageName');
         if (!packageName) return { requestId, error: 'packageName is required' };
@@ -55,6 +80,7 @@ export async function dispatchPluginConsoleRpc(
         const result = await ctx.pluginManagement.install(
           packageName,
           optionalString(message.expectedRevision),
+          optionalString(message.expectedProjectRevision),
         );
         ctx.publishEvent?.('plugin:installed', { packageName, restartRequired: result.restartRequired });
         return { requestId, data: { success: true, ...result } };
@@ -78,6 +104,7 @@ export async function dispatchPluginConsoleRpc(
         const result = await ctx.pluginManagement.uninstall(
           packageName,
           optionalString(message.expectedRevision),
+          optionalString(message.expectedProjectRevision),
         );
         ctx.publishEvent?.('plugin:uninstalled', { packageName, restartRequired: result.restartRequired });
         return { requestId, data: { success: true, ...result } };
@@ -104,6 +131,7 @@ export async function dispatchPluginConsoleRpc(
           packageName,
           targetVersion,
           optionalString(message.expectedRevision),
+          optionalString(message.expectedProjectRevision),
         );
         ctx.publishEvent?.('plugin:updated', {
           packageName,
@@ -128,7 +156,7 @@ export async function dispatchPluginConsoleRpc(
         return undefined;
     }
   } catch (error) {
-    return { requestId, error: error instanceof Error ? error.message : String(error) };
+    return { requestId, error: error instanceof Error ? error.message : String(error), ...(error instanceof Error && 'completedStages' in error ? { data: { completedStages: error.completedStages, ...('state' in error ? { state: error.state } : {}) } } : {}) };
   }
 }
 

package/src/console-rest-pages.ts

@@ -13,6 +13,7 @@ import type { HttpHost } from './http-host.js';
 import { HttpBodyError, readJsonBody } from './json-body.js';
 import { MarketplaceRegistry } from './marketplace-registry.js';
 import type { AuthScope } from './token-registry.js';
+import type { ConsoleMessageEventData } from '@zhin.js/console-protocol';
 
 /** 与 basic/cli 接线方对齐的上下文约定。 */
 export interface ConsoleRestCtx {
@@ -60,6 +61,9 @@ export interface ConsoleAgentIntrospection {
     props: unknown;
     signal: AbortSignal;
   }>): Promise<unknown>;
+  previewComponentDelivery?(input: Readonly<{
+    requester: string; name: string; props: unknown; target: unknown; signal: AbortSignal;
+  }>): Promise<Readonly<{ output: unknown; rendering: NonNullable<ConsoleMessageEventData['rendering']>; generation: number; note: string }>>;
 }
 
 /** Session tree 门面 — 形状对齐 agent 包 SessionTreeRuntimeHandle。 */
@@ -729,6 +733,7 @@ function registerIntrospectionRoutes(
     }
     const lease = ctx.acquireAgentRuntime?.();
     const render = lease?.value.introspection?.renderComponent;
+    const previewDelivery = lease?.value.introspection?.previewComponentDelivery;
     if (!lease || !render) {
       lease?.release();
       writeJson(response, 503, { success: false, error: 'Component Runtime 未就绪' });
@@ -747,19 +752,23 @@ function registerIntrospectionRoutes(
       activeComponentPreviews -= 1;
       lease.release();
     };
-    const renderPromise = Promise.resolve().then(() =>
-      render({ requester, name, props: body.props ?? {}, signal: controller.signal }));
+    const renderPromise = Promise.resolve().then(() => {
+      const input = { requester, name, props: body.props ?? {}, signal: controller.signal };
+      if (body.target === undefined) return render(input).then(output => ({ output }));
+      if (!previewDelivery) throw new Error('Target-aware Component preview 未就绪');
+      return previewDelivery({ ...input, target: body.target });
+    });
     // A timed-out implementation may ignore AbortSignal. Keep its generation
     // lease until the real operation settles; the bounded concurrency gate
     // prevents non-cooperative previews from pinning unbounded generations.
     void renderPromise.then(release, release);
     try {
-      const output = await raceWithAbort(
+      const preview = await raceWithAbort(
         renderPromise,
         controller.signal,
       );
-      assertPreviewOutput(output, options.componentPreviewMaxBytes ?? 256 * 1024);
-      writeJson(response, 200, { success: true, data: { requester, name, output } });
+      assertPreviewOutput(preview, options.componentPreviewMaxBytes ?? 256 * 1024);
+      writeJson(response, 200, { success: true, data: { requester, name, ...preview } });
     } catch (error) {
       const status = error instanceof ComponentPreviewTimeoutError
         ? 408

package/src/console-rpc-extended/inbox-rpc.ts

@@ -259,6 +259,7 @@ export function mapNoticeRow(row: Record<string, unknown>): Record<string, unkno
 }
 
 function mapMessageRow(row: Record<string, unknown>): Record<string, unknown> {
+  const observation = readMessageObservation(row.raw);
   return {
     id: row.id,
     platformMessageId: row.platform_message_id,
@@ -267,9 +268,42 @@ function mapMessageRow(row: Record<string, unknown>): Record<string, unknown> {
     raw: row.raw,
     timestamp: row.created_at,
     channel: channelFromStoredRow(row),
+    ...observation,
   };
 }
 
+function isStoredConversation(value: unknown): boolean {
+  if (!value || typeof value !== 'object') return false;
+  const conversation = value as Record<string, unknown>;
+  const endpoint = conversation.endpoint as Record<string, unknown> | null | undefined;
+  if (!endpoint || typeof endpoint !== 'object'
+    || typeof endpoint.id !== 'string' || typeof endpoint.adapter !== 'string'
+    || typeof conversation.kind !== 'string' || typeof conversation.id !== 'string') return false;
+  if (conversation.threadId !== undefined && typeof conversation.threadId !== 'string') return false;
+  if (conversation.parent !== undefined) {
+    const parent = conversation.parent as Record<string, unknown> | null;
+    if (!parent || typeof parent !== 'object' || typeof parent.kind !== 'string' || typeof parent.id !== 'string') return false;
+  }
+  return true;
+}
+
+/** Older rows have no observation; do not invent their direction or diagnostics. */
+function readMessageObservation(raw: unknown): Record<string, unknown> {
+  if (typeof raw !== 'string') return {};
+  try {
+    const value: unknown = JSON.parse(raw);
+    if (!value || typeof value !== 'object') return {};
+    const entry = value as Record<string, unknown>;
+    if (entry.$console !== 'zhin.message-observation/1'
+      || (entry.direction !== 'inbound' && entry.direction !== 'outbound')) return {};
+    return { direction: entry.direction,
+      ...(isStoredConversation(entry.conversation) ? { conversation: entry.conversation } : {}),
+      ...(entry.direction === 'outbound' && entry.rendering && typeof entry.rendering === 'object'
+        ? { rendering: entry.rendering } : {}),
+    };
+  } catch { return {}; }
+}
+
 function actorFromStoredRow(
   row: Record<string, unknown>,
   field: 'actor' | 'sender',

package/src/console-rpc.ts

@@ -54,6 +54,8 @@ export type RuntimeConsoleRpcMessage = {
 export type RuntimeConsoleRpcReply = Record<string, unknown>;
 
 export interface PluginInstallPlan {
+  readonly projectRevision?: string;
+  readonly configurationRevision?: string | null;
   readonly packageName: string;
   readonly instanceKey: string;
   readonly alreadyDeclared: boolean;
@@ -67,6 +69,8 @@ export interface PluginInstallPlan {
 }
 
 export interface PluginUninstallPlan {
+  readonly projectRevision?: string;
+  readonly configurationRevision?: string | null;
   readonly packageName: string;
   readonly instanceKey: string;
   readonly installed: boolean;
@@ -76,6 +80,8 @@ export interface PluginUninstallPlan {
 }
 
 export interface PluginUpdatePlan {
+  readonly projectRevision?: string;
+  readonly configurationRevision?: string | null;
   readonly packageName: string;
   readonly instanceKey: string;
   readonly currentVersion: string | null;
@@ -86,19 +92,66 @@ export interface PluginUpdatePlan {
   readonly restartRequired: boolean;
 }
 
+export interface PluginManagementState {
+  readonly packageName: string;
+  readonly instanceKey: string;
+  readonly installed: boolean;
+  readonly plugin: boolean;
+  readonly declared: boolean;
+  readonly version: string | null;
+  readonly revision: string | null;
+  readonly projectRevision: string;
+  readonly status: 'not-installed' | 'installed' | 'declared' | 'missing-config' | 'pending-restart' | 'enabled' | 'degraded';
+  readonly dependencies: 'unchecked' | 'passed' | 'failed';
+  readonly validation: PluginConfigValidation | null;
+  readonly generation: number | null;
+  readonly published: boolean;
+  readonly readiness: 'unknown' | 'ready' | 'pending' | 'degraded';
+  readonly restartRequired: boolean;
+  readonly disabled: boolean;
+  readonly issues: readonly string[];
+  /** Publication is never proof of a successful business action. */
+  readonly verification: 'not-configured' | 'available';
+}
+
+export interface PluginVerificationPlan {
+  readonly packageName: string;
+  readonly instanceKey: string;
+  readonly generation: number | null;
+  readonly projectRevision: string;
+  readonly checkRevision: string;
+  readonly checks: readonly import('@zhin.js/plugin-runtime').PluginVerificationCheck[];
+}
+
+export interface PluginVerificationResult {
+  readonly packageName: string;
+  readonly instanceKey: string;
+  readonly checkId: string;
+  readonly generation: number | null;
+  readonly current: boolean;
+  readonly status: 'passed' | 'failed' | 'not-configured';
+  readonly scope: 'local' | 'platform' | null;
+  readonly summary: string;
+  readonly evidence: readonly string[];
+}
+
 export interface PluginManagementPort {
+  inspect?(packageName: string): Promise<PluginManagementState>;
+  apply?(packageName: string, expectedProjectRevision?: string): Promise<{ readonly requested: boolean; readonly state: PluginManagementState }>;
+  verificationPlan?(packageName: string): Promise<PluginVerificationPlan>;
+  verify?(packageName: string, checkId: string, expectedGeneration: number | null, expectedProjectRevision: string, expectedCheckRevision: string): Promise<PluginVerificationResult>;
   planInstall(packageName: string): Promise<PluginInstallPlan>;
-  install?(packageName: string, expectedRevision?: string): Promise<Readonly<{
+  install?(packageName: string, expectedRevision?: string, expectedProjectRevision?: string): Promise<Readonly<{
     readonly plan: PluginInstallPlan;
     readonly restartRequired: boolean;
   }>>;
   planUninstall?(packageName: string): Promise<PluginUninstallPlan>;
-  uninstall?(packageName: string, expectedRevision?: string): Promise<Readonly<{
+  uninstall?(packageName: string, expectedRevision?: string, expectedProjectRevision?: string): Promise<Readonly<{
     readonly plan: PluginUninstallPlan;
     readonly restartRequired: boolean;
   }>>;
   planUpdate?(packageName: string, targetVersion: string): Promise<PluginUpdatePlan>;
-  update?(packageName: string, targetVersion: string, expectedRevision?: string): Promise<Readonly<{
+  update?(packageName: string, targetVersion: string, expectedRevision?: string, expectedProjectRevision?: string): Promise<Readonly<{
     readonly plan: PluginUpdatePlan;
     readonly installedVersion: string;
     readonly restartRequired: boolean;
@@ -106,6 +159,8 @@ export interface PluginManagementPort {
 }
 
 export interface PluginConfigValidation {
+  /** False means only environment-reference checks ran; Runtime must validate TS-only declarations. */
+  readonly schemaAvailable?: boolean;
   readonly valid: boolean;
   readonly errors: readonly { readonly path: string; readonly message: string }[];
   readonly missingEnv: readonly string[];

package/src/index.ts

@@ -59,6 +59,9 @@ export {
   type PluginUninstallPlan,
   type PluginUpdatePlan,
   type PluginManagementPort,
+  type PluginManagementState,
+  type PluginVerificationResult,
+  type PluginVerificationPlan,
   type PluginConfigValidation,
 } from './console-rpc.js';
 export { dispatchPluginConsoleRpc } from './console-plugin-rpc.js';

package/src/project-files.ts

@@ -11,14 +11,27 @@ export const FILE_MANAGER_ALLOWED = Object.freeze([
   'adapters',
   'components',
   'middlewares',
+  'handlers',
+  'schedules',
+  'hooks',
+  'prompt-sections',
   'tools',
-  'mcp',
+  'mcps',
   'pages',
   'skills',
   'agents',
   'package.json',
+  'plugin.ts',
+  'plugin.tsx',
+  'plugin.js',
+  'plugin.mjs',
+  'plugin.cjs',
+  'schema.json',
+  'AGENTS.md',
   'tsconfig.json',
   'zhin.config.yml',
+  'zhin.config.yaml',
+  'zhin.config.json',
   'config.yml',
   'config.yaml',
   'config.json',