@zhin.js/host-http 1.2.1 → 1.3.0

package/src/console-rest-pages-helpers.ts

@@ -25,10 +25,17 @@ const INTROSPECTION_PAGE_SIZES = {
   endpoints: 30,
   bindings: 30,
   mcp: 30,
+  'recent-turns': 20,
 } as const;
 
 type IntrospectionKind = keyof typeof INTROSPECTION_PAGE_SIZES;
 
+/** Owning plugin of a capability row (`ConsoleIntrospectionOwner`, #1250): searchable by `q`. */
+const OWNER_FIELDS: ReadonlyArray<(item: unknown) => string | undefined> = [
+  (item) => stringProp(item, 'pluginInstance'),
+  (item) => stringProp(item, 'pluginPackage'),
+];
+
 // ---------------------------------------------------------------------------
 // Runtime snapshot introspection
 // ---------------------------------------------------------------------------
@@ -41,7 +48,8 @@ export function registerIntrospectionRoutes(
 ): void {
   const collectors: Array<{
     kind: IntrospectionKind;
-    collect: (introspection: ConsoleAgentIntrospection | undefined) => { rows: readonly unknown[]; note?: string };
+    collect: (introspection: ConsoleAgentIntrospection | undefined) =>
+      { rows: readonly unknown[]; note?: string } | Promise<{ rows: readonly unknown[]; note?: string }>;
     fields: Array<(item: unknown) => string | undefined>;
   }> = [
     {
@@ -51,6 +59,7 @@ export function registerIntrospectionRoutes(
         (c) => stringProp(c, 'pattern'),
         (c) => stringProp(c, 'desc'),
         (c) => stringProp(c, 'plugin'),
+        ...OWNER_FIELDS,
       ],
     },
     {
@@ -62,6 +71,7 @@ export function registerIntrospectionRoutes(
         (m) => stringProp(m, 'phase'),
         (m) => stringProp(m, 'target'),
         (m) => stringProp(m, 'source'),
+        ...OWNER_FIELDS,
       ],
     },
     {
@@ -71,6 +81,7 @@ export function registerIntrospectionRoutes(
         (c) => stringProp(c, 'name'),
         (c) => stringProp(c, 'owner'),
         (c) => stringProp(c, 'source'),
+        ...OWNER_FIELDS,
       ],
     },
     {
@@ -87,11 +98,22 @@ export function registerIntrospectionRoutes(
     },
     {
       kind: 'bindings',
-      collect: (value) => ({ rows: value?.bindings?.() ?? [] }),
+      collect: async (value) => ({ rows: await value?.bindings?.() ?? [] }),
       fields: [
         (a) => stringProp(a, 'name'),
         (a) => stringProp(a, 'provider'),
         (a) => stringProp(a, 'model'),
+        (a) => stringProp(a, 'displayName'),
+      ],
+    },
+    {
+      // #1250: the Agent workbench's recent conversations come from the turn trace archive, newest first.
+      kind: 'recent-turns',
+      collect: async (value) => ({ rows: await value?.recentTurns?.() ?? [] }),
+      fields: [
+        (t) => stringProp(t, 'sessionDisplayName'),
+        (t) => stringProp(t, 'sessionKey'),
+        (t) => stringProp(t, 'status'),
       ],
     },
     {
@@ -101,6 +123,7 @@ export function registerIntrospectionRoutes(
         (t) => stringProp(t, 'name'),
         (t) => stringProp(t, 'source'),
         (t) => stringProp(t, 'description'),
+        ...OWNER_FIELDS,
       ],
     },
     {
@@ -114,6 +137,7 @@ export function registerIntrospectionRoutes(
         (section) => stringProp(section, 'layer'),
         (section) => stringProp(section, 'retention'),
         (section) => stringProp(section, 'source'),
+        ...OWNER_FIELDS,
       ],
     },
     {
@@ -136,7 +160,7 @@ export function registerIntrospectionRoutes(
       const lease = kind === 'endpoints' ? null : ctx.acquireAgentRuntime?.() ?? null;
       try {
         const introspection = lease?.value.introspection;
-        const { rows, note } = collect(introspection);
+        const { rows, note } = await collect(introspection);
         const query = url.searchParams;
         const filter = query.get('filter')?.trim() || undefined;
         const filtered = filterByFields([...rows], filter, fields);

package/src/console-rest-pages.ts

@@ -17,6 +17,15 @@ import {
   isValidNpmPackageName,
 } from './marketplace-registry.js';
 import type { ConsoleMessageEventData } from '@zhin.js/console-protocol';
+import {
+  informativeKeywords,
+  isLocale,
+  normalizePluginCategory,
+  packageAuthorName,
+  pickLocalizedText,
+  readPluginMarketplaceMetadata,
+  type PluginLocalizedText,
+} from '@zhin.js/plugin-runtime';
 import {
   clampPositiveInt,
   decodePathParam,
@@ -65,7 +74,10 @@ export interface ConsoleAgentIntrospection {
   commands?(): readonly unknown[];
   middlewares?(): readonly unknown[];
   components?(): readonly unknown[];
-  bindings?(): readonly unknown[];
+  /** Agent bindings with the provider / model they actually run on (may read the provider graph). */
+  bindings?(): readonly unknown[] | Promise<readonly unknown[]>;
+  /** Recent Agent turns from the trace archive, newest first (#1250). */
+  recentTurns?(): readonly unknown[] | Promise<readonly unknown[]>;
   tools?(): readonly unknown[];
   promptSections?(): readonly unknown[];
   mcp?(): { rows: readonly unknown[]; note?: string } | readonly unknown[];
@@ -356,6 +368,11 @@ function registerLogsRoutes(
   }, { summary: 'Cleanup old system logs', tags: ['console', 'logs'] });
 }
 
+/** Locale-keyed texts from an untrusted registry entry (reuses the published-manifest reader). */
+function localizedTextOf(value: unknown): PluginLocalizedText | undefined {
+  return readPluginMarketplaceMetadata({ metadata: { displayNameI18n: value } }).displayNameI18n;
+}
+
 // ---------------------------------------------------------------------------
 // marketplace（legacy marketplace-rest-api.ts；plugins.json + npmmirror）
 // ---------------------------------------------------------------------------
@@ -390,10 +407,17 @@ function registerMarketplaceRoutes(
       const versions = meta.versions as Record<string, Record<string, unknown>> | undefined;
       const latestInfo = latest && versions ? versions[latest] : undefined;
       const time = meta.time as Record<string, string> | undefined;
+      // Marketplace fields come from the published manifest (`zhin.metadata`); the author is the
+      // package's author / maintainers, never the publishing account (`_npmUser`, a release bot).
+      const market = readPluginMarketplaceMetadata(latestInfo?.zhin);
       return {
         name: meta.name,
         version: latest,
-        description: meta.description || '',
+        ...(market.displayName ? { displayName: market.displayName } : {}),
+        ...(market.displayNameI18n ? { displayNameI18n: market.displayNameI18n } : {}),
+        ...(market.descriptionI18n ? { descriptionI18n: market.descriptionI18n } : {}),
+        ...(market.category ? { category: market.category } : {}),
+        description: (latestInfo?.description as string | undefined) || meta.description || '',
         readme: meta.readme || '',
         license: meta.license || latestInfo?.license || '',
         homepage: meta.homepage || latestInfo?.homepage || '',
@@ -401,11 +425,8 @@ function registerMarketplaceRoutes(
           (meta.repository as { url?: string } | undefined)?.url ||
           (latestInfo?.repository as { url?: string } | undefined)?.url ||
           '',
-        author:
-          typeof meta.author === 'string'
-            ? meta.author
-            : (meta.author as { name?: string } | undefined)?.name || '',
-        keywords: (latestInfo?.keywords as string[]) || [],
+        author: packageAuthorName(latestInfo ?? {}) ?? packageAuthorName(meta) ?? '',
+        keywords: informativeKeywords(latestInfo?.keywords),
         engines: latestInfo?.engines || {},
         peerDependencies: latestInfo?.peerDependencies || {},
         versions: Object.keys(versions || {}),
@@ -421,32 +442,48 @@ function registerMarketplaceRoutes(
       100,
       Math.max(1, parseInt(url.searchParams.get('size') ?? url.searchParams.get('limit') ?? '20', 10) || 20),
     );
-    const category = url.searchParams.get('category') ?? undefined;
+    const rawCategory = url.searchParams.get('category') || undefined;
+    const category = rawCategory === undefined ? undefined : normalizePluginCategory(rawCategory) ?? rawCategory;
     const official = url.searchParams.get('official') ?? undefined;
+    const rawLocale = url.searchParams.get('locale');
+    const locale = isLocale(rawLocale) ? rawLocale : undefined;
     const searchKeyword = q.trim().toLowerCase();
 
     try {
       const allPlugins = (await registry.list()) as readonly Record<string, unknown>[];
-      let plugins = allPlugins.map((p) => ({
+      let plugins = allPlugins.map((p) => {
+        const displayNameI18n = localizedTextOf(p.displayNameI18n);
+        const descriptionI18n = localizedTextOf(p.descriptionI18n);
+        const displayName = typeof p.displayName === 'string' ? p.displayName : '';
+        const description = typeof p.description === 'string' ? p.description : '';
+        return {
         name: p.name,
-        displayName: p.displayName || '',
+        // `locale` resolves the display texts for the caller; translations stay available either way.
+        displayName: locale ? pickLocalizedText(displayNameI18n, locale, displayName) ?? '' : displayName,
+        ...(displayNameI18n ? { displayNameI18n } : {}),
         version: p.version || '',
-        description: p.description || '',
+        description: locale ? pickLocalizedText(descriptionI18n, locale, description) ?? '' : description,
+        ...(descriptionI18n ? { descriptionI18n } : {}),
         author: p.author || '',
         isOfficial: typeof p.name === 'string' && /^@zhin\.js\/[a-z0-9][a-z0-9._-]*$/.test(p.name),
         official: typeof p.name === 'string' && /^@zhin\.js\/[a-z0-9][a-z0-9._-]*$/.test(p.name),
-        category: p.category || 'util',
-        keywords: (p.tags as string[]) || [],
+        category: normalizePluginCategory(p.category) ?? 'utility',
+        keywords: informativeKeywords(p.tags),
         npm: p.npm || `https://www.npmjs.com/package/${p.name}`,
         date: p.lastUpdate || '',
         downloads: p.downloads || { weekly: 0, monthly: 0 },
         readme: p.readme || '',
         license: p.license || '',
-      }));
+        };
+      });
 
       if (searchKeyword) {
         plugins = plugins.filter((p) => {
-          const haystack = [p.name, p.displayName, p.description, ...(p.keywords || [])]
+          const haystack = [
+            p.name, p.displayName, p.description,
+            ...Object.values(p.displayNameI18n ?? {}), ...Object.values(p.descriptionI18n ?? {}),
+            ...p.keywords,
+          ]
             .join(' ')
             .toLowerCase();
           return haystack.includes(searchKeyword);

package/src/console-rpc-extended/contracts.ts

@@ -1,3 +1,4 @@
+import type { ConsoleAdapterLoginDeclaration, ConsoleLoginFlow, ConsoleLoginOutcome } from '@zhin.js/console-protocol';
 interface LoginEndpointIdentity {
   readonly canonicalId: string;
   readonly instanceId: string;
@@ -21,25 +22,36 @@ export interface ConsoleRpcExtendedCtx {
   databaseHost?: { models: { get(name: string): unknown } };
   /** Narrow generation-bound persistent-job port; null when Assistant is disabled. */
   resolveScheduleEngine?: () => ConsoleScheduleEngine | null | undefined;
-  /** LoginAssist list/submit/cancel（刷新后仍可消费扫码/滑块待办）。 */
-  loginAssist?: {
-    listPending(): readonly {
-      id: string;
-      adapter: string;
-      endpointKey: string;
-      endpointIdentity?: LoginEndpointIdentity;
-      type: string;
-      payload: Record<string, unknown>;
-      createdAt: number;
-      expiresAt?: number;
-    }[];
-    submit(id: string, value: string | Record<string, unknown>, endpointIdentity?: LoginEndpointIdentity): boolean;
-    cancel(id: string, reason?: string, endpointIdentity?: LoginEndpointIdentity): boolean;
-  };
+  /**
+   * Resolves a persistent job's delivery target (#1250): `{ resolved, display?, reason? }`, where
+   * `resolved: false` means the job's results cannot be delivered (no target / unknown account).
+   */
+  describeScheduleTarget?: (notify: unknown) => ConsoleScheduleTarget;
+  /** LoginAssist list/submit/cancel（刷新后仍可消费扫码/滑块待办）；ADR 0058 flow methods are optional. */
+  loginAssist?: ConsoleLoginAssistPort;
+  /** ADR 0058: the Endpoint's login declaration and lease-scoped login control (`null` = unknown Endpoint). */
+  withEndpointLogin?: <T>(
+    adapter: string,
+    endpointKey: string,
+    run: (login: ConsoleEndpointLoginAccess) => T | Promise<T>,
+  ) => Promise<T | null>;
   /** Authenticated Root adapter; mutation DTOs deliberately contain no principal/decision fields. */
   workroomProfileControl?: ConsoleWorkroomProfileControlPort;
   /** Authenticated HTTP principal; never accepted from the RPC body. */
   authenticatedPrincipal?: Readonly<{ principalId: string }>;
+  /**
+   * The Endpoint the caller was authorized for when its grant covers this call only at an adapter /
+   * endpoint scope (never set for global grants, owners or in-process callers). Handlers that act on
+   * login tasks or flows restrict themselves to it; set by the dispatcher, never read from the body.
+   */
+  authorizedEndpoint?: Readonly<{ adapter: string; endpointKey: string }>;
+  /**
+   * Whether the caller holds `endpoint.operate` on one Endpoint (set by the dispatcher from the
+   * authenticated principal, never read from the body). Login read RPCs return live challenge
+   * material (QR image, sensitive blocks, verification links, legacy `payload.image` / `url`) only
+   * when it says yes; absent (in-process callers without a principal) = trusted.
+   */
+  canOperateEndpoint?: (adapter: string, endpointKey: string) => boolean;
   workroomKnowledgeControl?: ConsoleWorkroomKnowledgeControlPort;
 }
 
@@ -98,7 +110,49 @@ export interface ConsoleScheduleEngine {
   listJobs(): Promise<Record<string, unknown>[]>;
 }
 
-export type ExtendedRpcResult = { data: unknown } | { error: string };
+/** `data` next to `error` carries a machine-readable code (e.g. `{ code: 'unsupported' }`). */
+export type ExtendedRpcResult = { data: unknown } | { error: string; data?: unknown };
+
+/** Structural LoginAssist port (host/http must not import `@zhin.js/core`). */
+export interface ConsoleLoginAssistPort {
+  listPending(): readonly {
+    id: string;
+    adapter: string;
+    endpointKey: string;
+    endpointIdentity?: LoginEndpointIdentity;
+    type: string;
+    payload: Record<string, unknown>;
+    createdAt: number;
+    expiresAt?: number;
+    flowId?: string;
+    challengeId?: string;
+  }[];
+  submit(id: string, value: string | Record<string, unknown>, endpointIdentity?: LoginEndpointIdentity): boolean;
+  cancel(id: string, reason?: string, endpointIdentity?: LoginEndpointIdentity): boolean;
+  /** ADR 0058 */
+  listFlows?(): readonly ConsoleLoginFlow[];
+  getFlow?(adapter: string, endpointKey: string): ConsoleLoginFlow | undefined;
+  getFlowById?(id: string): ConsoleLoginFlow | undefined;
+  /**
+   * Event-safe copy of a flow (core `withoutLoginMedia`): no QR image, sensitive blocks redacted,
+   * verification links dropped. Returned to readers without `endpoint.operate` on the flow's
+   * Endpoint; without it the host strips every challenge's media and blocks.
+   */
+  eventSafeFlow?(flow: ConsoleLoginFlow): ConsoleLoginFlow;
+  submitAndWait?(
+    id: string,
+    value: string | Record<string, unknown>,
+    options?: { endpointIdentity?: LoginEndpointIdentity; timeoutMs?: number },
+  ): Promise<{ accepted: boolean; outcome?: ConsoleLoginOutcome; pending?: boolean; flow?: ConsoleLoginFlow }>;
+}
+
+export interface ConsoleEndpointLoginAccess {
+  readonly declaration?: ConsoleAdapterLoginDeclaration;
+  readonly control?: {
+    relogin?(request: { signal?: AbortSignal }): Promise<void>;
+    refreshChallenge?(request: { signal?: AbortSignal }): Promise<void>;
+  };
+}
 
 const CRON_NOT_WIRED =
   '持久化调度未接线：当前 Plugin Runtime ScheduleHost 仅支持插件注册的内存任务（list），' +
@@ -111,6 +165,11 @@ export interface ScheduleJobRow {
   id: string;
   cron: string;
   description?: string;
+  /** Host display metadata (`ScheduleJobDisplay` in `@zhin.js/plugin-runtime`). */
+  title?: string;
+  titleI18n?: Readonly<Partial<Record<string, string>>>;
+  kind?: 'plugin-internal' | 'user-task';
+  lastRun?: { startedAt: number; finishedAt: number; status: 'succeeded' | 'failed'; error?: string };
 }
 
 export interface InboxSelection {
@@ -170,3 +229,11 @@ export interface EndpointManagementPort {
   setGroupAdmin?(request: EndpointAdminCommand): Promise<void>;
   deleteFriend?(request: EndpointUserCommand): Promise<void>;
 }
+
+/** `target` of a `schedule:list` persistent row (#1250). */
+export interface ConsoleScheduleTarget {
+  readonly resolved: boolean;
+  readonly display?: string;
+  /** `missing_target` | `incomplete_target` | `endpoint_not_found` */
+  readonly reason?: string;
+}

package/src/console-rpc-extended/dispatcher.ts

@@ -4,7 +4,7 @@ import {
   actOnRequest, listInbox, listInboxMessages, listPendingRequests, listRecentInboxMessages,
   mapNoticeRow, mapRequestRow, markInboxConsumed, TABLE_NOTICE, TABLE_REQUEST,
 } from './inbox-rpc.js';
-import { cancelLogin, listLoginPending, submitLogin } from './login-rpc.js';
+import { cancelLogin, controlLogin, getLoginFlow, listLoginFlows, listLoginPending, submitLogin } from './login-rpc.js';
 import {
   deleteFriend, groupWriteOp, listChannels, listFriends, listGroupMembers, listGroups,
 } from './endpoint-rpc.js';
@@ -21,7 +21,7 @@ export async function dispatchExtendedConsoleRpc(
   switch (type) {
     case 'schedule:list':
     case 'cron:list':
-      return listSchedule(ctx);
+      return listSchedule(ctx, d);
 
     case 'cron:validate':
       return validateCron(d);
@@ -49,11 +49,18 @@ export async function dispatchExtendedConsoleRpc(
       return actOnRequest(type, d, ctx);
 
     case 'login.list':
-      return listLoginPending(ctx);
+      return listLoginPending(d, ctx);
     case 'login.submit':
       return submitLogin(d, ctx);
     case 'login.cancel':
       return cancelLogin(d, ctx);
+    case 'login.flow.list':
+      return listLoginFlows(d, ctx);
+    case 'login.flow.get':
+      return getLoginFlow(d, ctx);
+    case 'login.relogin':
+    case 'login.refresh':
+      return controlLogin(type, d, ctx);
 
     case 'request.consumed':
       return markInboxConsumed(d, ctx, TABLE_REQUEST);

package/src/console-rpc-extended/endpoint-rpc.ts

@@ -1,4 +1,5 @@
 import type { ConsoleRpcExtendedCtx, EndpointManagementPort, ExtendedRpcResult } from './contracts.js';
+import type { EndpointManagementCapability } from '@zhin.js/console-protocol';
 import { boolField, numField, strField, withLiveEndpoint } from './rpc-values.js';
 
 export async function listFriends(
@@ -12,7 +13,7 @@ export async function listFriends(
       const friends = [...await management.listFriends()];
       return { data: { friends, count: friends.length } };
     }
-    return { error: `当前适配器（${endpoint.adapter}）不支持好友列表` };
+    return unsupportedList('friends', 'listFriends', endpoint.adapter, '好友列表');
   });
 }
 
@@ -27,7 +28,7 @@ export async function listGroups(
       const groups = [...await management.listGroups()];
       return { data: { groups, count: groups.length } };
     }
-    return { error: `当前适配器（${endpoint.adapter}）不支持群列表` };
+    return unsupportedList('groups', 'listGroups', endpoint.adapter, '群列表');
   });
 }
 
@@ -42,7 +43,7 @@ export async function listChannels(
       const channels = [...await management.listChannels()];
       return { data: { channels, count: channels.length } };
     }
-    return { error: `当前适配器（${endpoint.adapter}）不支持频道列表` };
+    return unsupportedList('channels', 'listChannels', endpoint.adapter, '频道列表');
   });
 }
 
@@ -59,13 +60,36 @@ export async function listGroupMembers(
   return withLiveEndpoint(ctx, adapter, endpointKey, async (management) => {
     const method = management.listGroupMembers;
     if (!method) {
-      return { error: `当前适配器（${adapter}）不支持群成员列表` };
+      return unsupportedList('members', 'listGroupMembers', adapter, '群成员列表');
     }
     const members = [...await method.call(management, { groupId })];
     return { data: { members, count: members.length } };
   });
 }
 
+/**
+ * A read the Adapter does not declare is not a failure (#1250): reply with an empty list plus
+ * `status: 'unsupported'` (`ConsoleEndpointCapabilityUnsupported`) instead of `{ error }`, so the
+ * Console can render "该平台不提供" rather than a red read error. Older clients still see an empty
+ * list with `count: 0`.
+ */
+function unsupportedList(
+  key: 'friends' | 'groups' | 'channels' | 'members',
+  capability: EndpointManagementCapability,
+  adapter: string,
+  label: string,
+): ExtendedRpcResult {
+  return {
+    data: {
+      [key]: [],
+      count: 0,
+      status: 'unsupported',
+      capability,
+      message: `当前适配器（${adapter}）不支持${label}`,
+    },
+  };
+}
+
 // ---------------------------------------------------------------- 群管/好友写操作
 
 interface GroupWriteSpec {

package/src/console-rpc-extended/index.ts

@@ -1,8 +1,12 @@
 export type {
   ConsoleRpcExtendedCtx,
   ConsoleScheduleEngine,
+  ConsoleScheduleTarget,
   ConsoleWorkroomKnowledgeControlPort,
   ConsoleWorkroomProfileControlPort,
   ExtendedRpcResult,
+  ConsoleLoginAssistPort,
+  ConsoleEndpointLoginAccess,
 } from './contracts.js';
+export { loginAuditDetail, LOGIN_SUBMIT_WAIT_MS } from './login-rpc.js';
 export { dispatchExtendedConsoleRpc } from './dispatcher.js';