autosnippet 3.3.0 → 3.3.3

package/dist/lib/external/mcp/tools.js

@@ -1,268 +1,241 @@
 /**
- * MCP 工具定义 — V3 整合版 (18 agent + 4 admin = 22 工具)
+ * MCP Tool Definitions — V3 Consolidated (14 agent + 2 admin = 16 tools)
  *
- * 每个工具声明包含 name、tier（agent/admin）、description 和 inputSchema。
- * description 是 Agent 选择工具的关键 — 使用 bullet list 列出所有 operation 及其用途。
- * inputSchema 由 Zod Schema 自动生成（zodToMcpSchema），参数的 .describe() 会转为 JSON Schema description。
+ * Each tool declaration contains name, tier (agent/admin), description, and inputSchema.
+ * description is the key for Agent tool selection — use bullet list to enumerate all operations and their purposes.
+ * inputSchema is auto-generated from Zod Schema (zodToMcpSchema); parameter .describe() translates to JSON Schema description.
  *
- * Agent 工具 (18):
- *   1-7:   查询工具 (health/search/knowledge/structure/graph/call_context/guard)
- *   8-10:  写入工具 (submit_knowledge/submit_knowledge_batch/save_document)
- *   11:    Skill 管理 (skill)
- *   12-15: 冷启动 (bootstrap/dimension_complete/wiki_plan/wiki_finalize)
- *   16:    自发现 (capabilities)
- *   17:    任务管理 (task)
+ * Agent tools (14):
+ *   1-7:   Query tools (health/search/knowledge/structure/graph/call_context/guard)
+ *   8:     Write tool (submit_knowledge — unified pipeline, single/batch)
+ *   9:     Skill management (skill)
+ *   10-12: Cold-start (bootstrap/dimension_complete/wiki)
+ *   13:    Project panorama (panorama)
+ *   14:    Task management (task — 5 ops: prime/create/close/fail/record_decision)
  *
- * Admin 工具 (4):
- *   18-21: enrich_candidates/knowledge_lifecycle/validate_candidate/check_duplicate
+ * Admin tools (2):
+ *   15-16: enrich_candidates/knowledge_lifecycle
  */
-import { BootstrapInput, CallContextInput, CapabilitiesInput, CheckDuplicateInput, DimensionCompleteInput, EnrichCandidatesInput, GraphInput, GuardInput, HealthInput, KnowledgeInput, KnowledgeLifecycleInput, SaveDocumentInput, SearchInput, SkillInput, StructureInput, SubmitKnowledgeBatchInput, SubmitKnowledgeInput, TaskInput, ValidateCandidateInput, WikiFinalizeInput, WikiPlanInput, } from '#shared/schemas/mcp-tools.js';
+import { BootstrapInput, CallContextInput, DimensionCompleteInput, EnrichCandidatesInput, GraphInput, GuardInput, HealthInput, KnowledgeInput, KnowledgeLifecycleInput, PanoramaInput, SearchInput, SkillInput, StructureInput, SubmitKnowledgeInput, TaskInput, WikiInput, } from '#shared/schemas/mcp-tools.js';
 import { zodToMcpSchema } from './zodToMcpSchema.js';
-// ─── Tier 定义 ──────────────────────────────────────────────
+// ─── Tier Definitions ────────────────────────────────────────
 export const TIER_ORDER = { agent: 0, admin: 1 };
-// ─── Gateway 映射（仅写操作需要 gating） ────────────────────
+// ─── Gateway Mapping (only write operations require gating) ─
 export const TOOL_GATEWAY_MAP = {
-    // bootstrap — 无参数化 Mission Briefing（只读分析，无需 gating）
+    // bootstrap — parameterless Mission Briefing (read-only analysis, no gating needed)
     // autosnippet_bootstrap: null,
-    // dimension_complete — 写操作（recipe tagging + skill creation + checkpoint）
+    // dimension_complete — write operation (recipe tagging + skill creation + checkpoint)
     autosnippet_dimension_complete: { action: 'knowledge:bootstrap', resource: 'knowledge' },
-    // wiki_finalize — 写操作（meta.json）
-    autosnippet_wiki_finalize: { action: 'knowledge:create', resource: 'knowledge' },
-    // guard 写操作（仅 files 模式）
+    // wiki — finalize is a write operation (meta.json)
+    autosnippet_wiki: {
+        resolver: (args) => args?.operation === 'finalize' ? { action: 'knowledge:create', resource: 'knowledge' } : null, // plan is read-only
+    },
+    // guard write operation (files mode only)
     autosnippet_guard: {
         resolver: (args) => args?.files && Array.isArray(args.files)
             ? { action: 'guard_rule:check_code', resource: 'guard_rules' }
-            : null, // code 模式只读，跳过 Gateway
+            : null, // code mode is read-only, skip Gateway
     },
-    // skill 写操作（create/update/delete）
+    // skill write operations (create/update/delete)
     autosnippet_skill: {
         resolver: (args) => ({
             create: { action: 'create:skills', resource: 'skills' },
             update: { action: 'update:skills', resource: 'skills' },
             delete: { action: 'delete:skills', resource: 'skills' },
-        })[args?.operation] || null, // list/load/suggest 只读
+        })[args?.operation] || null, // list/load/suggest are read-only
     },
-    // 知识提交
+    // knowledge submission (unified pipeline)
     autosnippet_submit_knowledge: { action: 'knowledge:create', resource: 'knowledge' },
-    autosnippet_submit_knowledge_batch: { action: 'knowledge:create', resource: 'knowledge' },
-    autosnippet_save_document: { action: 'knowledge:create', resource: 'knowledge' },
-    // task 写操作（create/claim/close/fail/defer/decompose/dep_add + decision 写操作）
+    // task write operations (create/close/fail + record_decision)
     autosnippet_task: {
         resolver: (args) => ({
-            create: { action: 'task:create', resource: 'tasks' },
-            claim: { action: 'task:update', resource: 'tasks' },
-            close: { action: 'task:update', resource: 'tasks' },
-            fail: { action: 'task:update', resource: 'tasks' },
-            defer: { action: 'task:update', resource: 'tasks' },
-            progress: { action: 'task:update', resource: 'tasks' },
-            decompose: { action: 'task:create', resource: 'tasks' },
-            dep_add: { action: 'task:update', resource: 'tasks' },
-            record_decision: { action: 'task:create', resource: 'tasks' },
-            revise_decision: { action: 'task:update', resource: 'tasks' },
-            unpin_decision: { action: 'task:update', resource: 'tasks' },
-        })[args?.operation] || null, // prime/ready/show/list/blocked/dep_tree/stats/list_decisions 只读
+            create: { action: 'task:create', resource: 'intent' },
+            close: { action: 'task:update', resource: 'intent' },
+            fail: { action: 'task:update', resource: 'intent' },
+            record_decision: { action: 'task:create', resource: 'intent' },
+        })[args?.operation] || null, // prime is read-only
     },
-    // admin 工具
+    // admin tools
     autosnippet_enrich_candidates: { action: 'knowledge:update', resource: 'knowledge' },
     autosnippet_knowledge_lifecycle: { action: 'knowledge:update', resource: 'knowledge' },
 };
-// ─── 工具声明 ────────────────────────────────────────────────
+// ─── Tool Declarations ───────────────────────────────────────
 export const TOOLS = [
     // ══════════════════════════════════════════════════════
-    //  Tier: agent — Agent 核心工具集 (18 个)
+    //  Tier: agent — Core Agent Toolset (14)
     // ══════════════════════════════════════════════════════
-    // 1. 健康检查
+    // 1. Health Check
     {
         name: 'autosnippet_health',
         tier: 'agent',
-        description: '检查服务状态与知识库统计。返回 total（知识总数）和各 kind/lifecycle 分布。total=0 时需要冷启动（调用 autosnippet_bootstrap）。',
+        description: 'Check service status and knowledge base stats. Returns total (entry count) and kind/lifecycle distribution. When total=0, cold-start is needed (call autosnippet_bootstrap).',
         inputSchema: zodToMcpSchema(HealthInput),
     },
-    // 2. 统合搜索
+    // 2. Unified Search
     {
         name: 'autosnippet_search',
         tier: 'agent',
-        description: '搜索知识库。5 种模式：\n' +
-            '• auto（默认）— 自动选最优策略\n' +
-            '• keyword — 精确关键词匹配，适合 trigger/title 查找\n' +
-            '• bm25 — 全文检索，适合自然语言描述\n' +
-            '• semantic — 向量语义搜索，适合模糊概念匹配\n' +
-            '• context — 综合搜索 + 上下文关联，适合编码辅助\n' +
-            '返回按 kind（rule/pattern/fact）分组的结果。',
+        description: 'Search the knowledge base. 5 modes:\n' +
+            '• auto (default) — automatically selects optimal strategy\n' +
+            '• keyword — exact keyword matching, best for trigger/title lookup\n' +
+            '• bm25 — full-text search, best for natural language descriptions\n' +
+            '• semantic — vector semantic search, best for fuzzy concept matching\n' +
+            '• context — combined search + context association, best for coding assistance\n' +
+            'Returns results grouped by kind (rule/pattern/fact).',
         inputSchema: zodToMcpSchema(SearchInput),
     },
-    // 3. 知识浏览
+    // 3. Knowledge Browser
     {
         name: 'autosnippet_knowledge',
         tier: 'agent',
-        description: '知识条目管理。\n' +
-            '• list — 按 kind/category/status 过滤列表\n' +
-            '• get — 获取单条完整内容（需 id）\n' +
-            '• insights — 条目质量分析与改进建议（需 id）\n' +
-            '• confirm_usage — 记录知识被实际采纳（需 id）',
+        description: 'Knowledge entry management.\n' +
+            '• list — filter entries by kind/category/status\n' +
+            '• get — retrieve full content of a single entry (requires id)\n' +
+            '• insights — quality analysis and improvement suggestions (requires id)\n' +
+            '• confirm_usage — record that knowledge was actually adopted (requires id)',
         inputSchema: zodToMcpSchema(KnowledgeInput),
     },
-    // 4. 项目结构
+    // 4. Project Structure
     {
         name: 'autosnippet_structure',
         tier: 'agent',
-        description: '探查项目结构。\n' +
-            '• targets — 构建目标列表（模块/Target/Package）\n' +
-            '• files — 指定 Target 的文件列表\n' +
-            '• metadata — 项目元数据（语言、依赖、配置）',
+        description: 'Explore project structure.\n' +
+            '• targets — list build targets (modules/Targets/Packages)\n' +
+            '• files — list files for a specific Target\n' +
+            '• metadata — project metadata (language, dependencies, configuration)',
         inputSchema: zodToMcpSchema(StructureInput),
     },
-    // 5. 知识图谱
+    // 5. Knowledge Graph
     {
         name: 'autosnippet_graph',
         tier: 'agent',
-        description: '知识关系图谱查询。\n' +
-            '• query — 查询节点的关联关系\n' +
-            '• impact — 修改某知识的影响范围分析\n' +
-            '• path — 两个知识节点间的关联路径\n' +
-            '• stats — 图谱全局统计（节点/边/密度）',
+        description: 'Knowledge relationship graph queries.\n' +
+            '• query — query relationships of a node\n' +
+            '• impact — analyze impact scope of modifying a knowledge entry\n' +
+            '• path — find relationship path between two knowledge nodes\n' +
+            '• stats — global graph statistics (nodes/edges/density)',
         inputSchema: zodToMcpSchema(GraphInput),
     },
-    // 6. 调用链上下文
+    // 6. Call Context
     {
         name: 'autosnippet_call_context',
         tier: 'agent',
-        description: '查询函数/方法的调用链。\n' +
-            '• callers — 谁调用了它（上游调用链）\n' +
-            '• callees — 它调用了谁（下游依赖链）\n' +
-            '• impact — 修改它的影响半径（上+下游+受影响文件数）\n' +
-            '• both — 同时获取 callers + callees',
+        description: 'Query function/method call chains.\n' +
+            '• callers — who calls it (upstream call chain)\n' +
+            '• callees — what it calls (downstream dependency chain)\n' +
+            '• impact — modification impact radius (upstream + downstream + affected file count)\n' +
+            '• both — retrieve callers + callees simultaneously',
         inputSchema: zodToMcpSchema(CallContextInput),
     },
-    // 7. Guard 代码检查
+    // 7. Guard Code Check
     {
         name: 'autosnippet_guard',
         tier: 'agent',
-        description: '代码规范检查。\n' +
-            '• 无参数 → 自动检查 git diff 增量文件（编码后首选用法）\n' +
-            '• files → 检查指定文件列表\n' +
-            '• code → 内联检查代码片段\n' +
-            '每个 violation 附带修复指南（doClause + coreCode），按指示修复后可再次检查。',
+        description: 'Code compliance check and Guard immune system.\n' +
+            '• no params → auto-check git diff incremental files (preferred after coding)\n' +
+            '• files → check specified file list\n' +
+            '• code → inline check code snippet\n' +
+            '• operation: "reverse_audit" → Recipe→Code reverse validation (check if knowledge is outdated)\n' +
+            '• operation: "coverage_matrix" → module-level Guard rule coverage matrix\n' +
+            'Each violation includes a fix guide (doClause + coreCode). Fix accordingly and re-check.',
         inputSchema: zodToMcpSchema(GuardInput),
     },
-    // 8. 提交单条知识
+    // 8. Submit Knowledge (Unified Pipeline)
     {
         name: 'autosnippet_submit_knowledge',
         tier: 'agent',
-        description: '提交单条知识。所有字段须一次性提供。提交后进入 pending 状态，用户在 Dashboard 审核。\n' +
-            '校验未通过的条目仍会入库，返回 recipeReadyHints 提示缺失字段。\n' +
-            'content 和 reasoning 必须是对象（非字符串）。详见各参数 description。',
+        description: 'Submit knowledge entries (single/batch unified pipeline). Pass 1~N items via the items array.\n' +
+            '• All entries undergo strict validation; all V3 fields must be provided at once\n' +
+            '• Unified consolidation analysis: detects overlap with existing Recipes and batch candidates\n' +
+            '• Handle CONSOLIDATION_MERGE / CONSOLIDATION_REORGANIZE / CONSOLIDATION_INSUFFICIENT responses\n' +
+            '• Set skipConsolidation: true to skip consolidation check. content and reasoning must be objects.\n' +
+            '⚠️ Batch rule: items in the array must NOT be cross-redundant — no highly overlapping doClause/coreCode/trigger within the same batch. ' +
+            'If two entries share 80%+ content, merge into one or split into primary + extends supplementary entries.',
         inputSchema: zodToMcpSchema(SubmitKnowledgeInput),
     },
-    // 9. 批量知识提交
-    {
-        name: 'autosnippet_submit_knowledge_batch',
-        tier: 'agent',
-        description: '批量提交知识条目。每条字段要求同 submit_knowledge，支持自动去重。\n' +
-            '校验更严格：不通过的条目会被拒绝（不入库），返回 rejectedSummary。\n' +
-            '适用于冷启动维度分析、模块批量扫描等场景。',
-        inputSchema: zodToMcpSchema(SubmitKnowledgeBatchInput),
-    },
-    // 10. 保存开发文档
-    {
-        name: 'autosnippet_save_document',
-        tier: 'agent',
-        description: '保存开发文档（设计文档、排查报告、ADR 等）到知识库。仅需 title + markdown，无需完整 V3 字段。',
-        inputSchema: zodToMcpSchema(SaveDocumentInput),
-    },
-    // 11. Skill 管理
+    // 9. Skill Management
     {
         name: 'autosnippet_skill',
         tier: 'agent',
-        description: 'Skill 管理。\n' +
-            '• list — 列出所有可用 Skill（内置 + 项目级）\n' +
-            '• load — 加载 Skill 完整内容，获取详细指引（需 name）\n' +
-            '• create — 创建项目级 Skill（需 name + description + content）\n' +
-            '• update — 更新项目级 Skill 内容\n' +
-            '• delete — 删除项目级 Skill（内置不可删）\n' +
-            '• suggest — 基于项目分析推荐应创建的 Skill',
+        description: 'Skill management.\n' +
+            '• list — list all available Skills (built-in + project-level)\n' +
+            '• load — load full Skill content for detailed guidance (requires name)\n' +
+            '• create — create project-level Skill (requires name + description + content)\n' +
+            '• update — update project-level Skill content\n' +
+            '• delete — delete project-level Skill (built-in cannot be deleted)\n' +
+            '• suggest — recommend Skills to create based on project analysis',
         inputSchema: zodToMcpSchema(SkillInput),
     },
-    // 12. 冷启动
+    // 10. Cold-Start Bootstrap
     {
         name: 'autosnippet_bootstrap',
         tier: 'agent',
-        description: '冷启动 — 无需参数，自动分析项目（AST、依赖图、Guard 审计），返回 Mission Briefing：\n' +
-            '• 项目元数据与语言统计\n' +
-            '• 维度任务清单（8 维度 × 3 Tier）\n' +
-            '• 执行计划与提交示例\n' +
-            '收到 Briefing 后按 executionPlan 完成所有维度分析。',
+        description: 'Cold-start — no parameters needed. Auto-analyzes the project (AST, dependency graph, Guard audit) and returns a Mission Briefing:\n' +
+            '• Project metadata and language statistics\n' +
+            '• Dimension task list (8 dimensions × 3 Tiers)\n' +
+            '• Execution plan and submission examples\n' +
+            'After receiving the Briefing, complete all dimension analyses per the executionPlan.',
         inputSchema: zodToMcpSchema(BootstrapInput),
     },
-    // 13. 维度完成通知
+    // 11. Dimension Complete Notification
     {
         name: 'autosnippet_dimension_complete',
         tier: 'agent',
-        description: '维度分析完成通知。负责：Recipe 关联、Skill 生成（从已提交候选自动合成）、Checkpoint 保存、跨维度 Hints 分发。\n' +
-            'analysisText 可简写，系统会自动从已提交的候选知识中合成详细内容用于 Skill 生成。',
+        description: 'Dimension analysis completion notification. Handles: Recipe linking, Skill generation (auto-synthesized from submitted candidates), Checkpoint saving, cross-dimension Hints distribution.\n' +
+            'analysisText can be brief — the system auto-synthesizes detailed content from submitted candidates for Skill generation.',
         inputSchema: zodToMcpSchema(DimensionCompleteInput),
     },
-    // 14. Wiki 规划
-    {
-        name: 'autosnippet_wiki_plan',
-        tier: 'agent',
-        description: '规划 Wiki 文档生成 — 整合项目结构与知识库，返回文档主题列表及每个主题的数据包。Agent 根据规划自行撰写文章。',
-        inputSchema: zodToMcpSchema(WikiPlanInput),
-    },
-    // 15. Wiki 完成
+    // 12. Wiki Documentation Generation
     {
-        name: 'autosnippet_wiki_finalize',
+        name: 'autosnippet_wiki',
         tier: 'agent',
-        description: '完成 Wiki 生成 — 写入 meta.json、去重检查、验证完整性。所有文章写入后调用。',
-        inputSchema: zodToMcpSchema(WikiFinalizeInput),
+        description: 'Wiki documentation generation.\n' +
+            '• plan — plan topics + data packages (integrates project structure and knowledge base; returns topic list + per-topic data package for Agent to write)\n' +
+            '• finalize — complete generation (write meta.json, dedup check, validate completeness; call after all articles are written)',
+        inputSchema: zodToMcpSchema(WikiInput),
     },
-    // 16. 能力自发现
+    // 13. Project Panorama
     {
-        name: 'autosnippet_capabilities',
+        name: 'autosnippet_panorama',
         tier: 'agent',
-        description: '列出所有可用 MCP 工具及其用途概览。适合 Agent 初次接触时了解服务能力。',
-        inputSchema: zodToMcpSchema(CapabilitiesInput),
+        description: 'Project panorama queries. Auto-triggers structure scan when no data exists — no manual cold-start needed.\n' +
+            '• overview (default) — project skeleton + architecture layers + module roles + knowledge coverage\n' +
+            '• module — single module details + neighbor relationships (requires module param)\n' +
+            '• gaps — knowledge gaps (modules with code but no Recipes)\n' +
+            '• health — panorama health score (coverage + coupling + circular deps + health score)\n' +
+            '• governance_cycle — full knowledge metabolism cycle (contradiction detection + redundancy analysis + decay assessment)\n' +
+            '• decay_report — decay assessment report (5 strategy detection + decayScore)\n' +
+            '• staging_check — staging entry check + auto-publish on expiry\n' +
+            '• enhancement_suggestions — Recipe enhancement suggestions based on usage data',
+        inputSchema: zodToMcpSchema(PanoramaInput),
     },
-    // 17. 任务与决策管理
+    // 14. Task & Decision Management
     {
         name: 'autosnippet_task',
         tier: 'agent',
-        description: '任务与决策管理。每次对话开始时先调用 prime 加载上下文。\n' +
-            '会话: prime（加载决策+任务+知识上下文）| ready（就绪确认）\n' +
-            '任务: create | claim | close | fail | defer | progress | show | list | stats | blocked\n' +
-            '分解: decompose（拆子任务）| dep_add（添加依赖）| dep_tree（依赖树）\n' +
-            '决策: record_decision | revise_decision | unpin_decision | list_decisions',
+        description: 'Task and decision management (5 operations). Call prime first at the start of each conversation to load knowledge context.\n' +
+            '• prime — load knowledge context + initialize intent lifecycle\n' +
+            '• create — create task anchor (for non-trivial work: ≥2 files or ≥10 lines)\n' +
+            '• close — complete task + trigger Guard compliance review\n' +
+            '• fail — abandon task\n' +
+            '• record_decision — record user preference decision',
         inputSchema: zodToMcpSchema(TaskInput),
     },
     // ══════════════════════════════════════════════════════
-    //  Tier: admin — 管理员/CI 工具 (额外 +4)
+    //  Tier: admin — Admin/CI Tools (+2)
     // ══════════════════════════════════════════════════════
-    // 18. 候选字段诊断
+    // 15. Candidate Field Diagnosis
     {
         name: 'autosnippet_enrich_candidates',
         tier: 'admin',
-        description: '诊断候选条目的字段完整性（无 AI）。返回每条候选的 missingFields 列表，Agent 据此补全后重新提交。',
+        description: 'Diagnose field completeness of candidate entries (no AI). Returns missingFields list per candidate for Agent to fill in and resubmit.',
         inputSchema: zodToMcpSchema(EnrichCandidatesInput),
     },
-    // 19. 知识生命周期
+    // 16. Knowledge Lifecycle
     {
         name: 'autosnippet_knowledge_lifecycle',
         tier: 'admin',
-        description: '知识条目生命周期操作。approve/fast_track → 发布知识；reject → 拒绝；deprecate → 废弃；reactivate → 恢复。',
+        description: 'Knowledge entry lifecycle operations. approve/fast_track → publish; reject → reject; deprecate → deprecate; reactivate → restore.',
         inputSchema: zodToMcpSchema(KnowledgeLifecycleInput),
     },
-    // 20. 候选预校验（调试）
-    {
-        name: 'autosnippet_validate_candidate',
-        tier: 'admin',
-        description: '独立候选校验（5 层结构化检查）。调试用，submit_knowledge 已内置校验。',
-        inputSchema: zodToMcpSchema(ValidateCandidateInput),
-    },
-    // 21. 去重检测（调试）
-    {
-        name: 'autosnippet_check_duplicate',
-        tier: 'admin',
-        description: '独立相似度检测。调试用，submit_knowledge 已内置去重。',
-        inputSchema: zodToMcpSchema(CheckDuplicateInput),
-    },
 ];

package/dist/lib/http/HttpServer.js

@@ -21,19 +21,23 @@ import { gatewayMiddleware } from './middleware/gatewayMiddleware.js';
 import { requestLogger } from './middleware/requestLogger.js';
 import { roleResolverMiddleware } from './middleware/roleResolver.js';
 import aiRouter from './routes/ai.js';
+import auditRouter from './routes/audit.js';
 import authRouter from './routes/auth.js';
 import candidatesRouter from './routes/candidates.js';
 import commandsRouter from './routes/commands.js';
 import extractRouter from './routes/extract.js';
 import guardRouter from './routes/guard.js';
+import guardReportRouter from './routes/guardReport.js';
 import guardRuleRouter from './routes/guardRules.js';
 import healthRouter from './routes/health.js';
 import knowledgeRouter from './routes/knowledge.js';
 import modulesRouter from './routes/modules.js';
 import monitoringRouter from './routes/monitoring.js';
+import panoramaRouter from './routes/panorama.js';
 import recipesRouter from './routes/recipes.js';
 import remoteRouter from './routes/remote.js';
 import searchRouter from './routes/search.js';
+import signalsRouter from './routes/signals.js';
 import skillsRouter from './routes/skills.js';
 import taskRouter from './routes/task.js';
 import violationsRouter from './routes/violations.js';
@@ -223,6 +227,8 @@ export class HttpServer {
         }
         // Guard 实时检查路由（Extension DiagnosticCollection 调用）
         this.app.use(`${apiPrefix}/guard`, guardRouter);
+        // Guard 合规报告路由
+        this.app.use(`${apiPrefix}/guard/report`, guardReportRouter);
         // 守护规则路由
         this.app.use(`${apiPrefix}/rules`, guardRuleRouter);
         // TaskGraph 路由（Extension taskTool.ts 转发调用）
@@ -251,6 +257,12 @@ export class HttpServer {
         this.app.use(`${apiPrefix}/wiki`, wikiRouter);
         // Remote 路由（飞书 Bot → IDE 远程指令桥接）
         this.app.use(`${apiPrefix}/remote`, remoteRouter);
+        // Panorama 全景路由（项目结构 + 覆盖率 + 健康度）
+        this.app.use(`${apiPrefix}/panorama`, panoramaRouter);
+        // 信号留痕 & 报告路由
+        this.app.use(`${apiPrefix}/signals`, signalsRouter);
+        // 审计日志路由
+        this.app.use(`${apiPrefix}/audit`, auditRouter);
         // 根路径 — 返回 API 元信息（避免外部探测产生无意义 404）
         this.app.all('/', (_req, res) => {
             res.json({
@@ -297,6 +309,46 @@ export class HttpServer {
                 try {
                     this.realtimeService = initRealtimeService(this.server);
                     this.logger.info('Realtime service initialized');
+                    // 桥接 EventBus / SignalBus → RealtimeService
+                    try {
+                        const container = getServiceContainer();
+                        const rs = this.realtimeService;
+                        if (typeof rs?.broadcastEvent !== 'function') {
+                            throw new Error('broadcastEvent not available');
+                        }
+                        // EventBus → lifecycle:transition
+                        const eventBus = container.services.eventBus ? container.get('eventBus') : null;
+                        if (eventBus) {
+                            eventBus.on('lifecycle:transition', (data) => {
+                                rs.broadcastEvent('lifecycle:transition', data);
+                            });
+                        }
+                        // SignalBridge 已将信号转发到 EventBus，HttpServer 只听 EventBus
+                        if (eventBus) {
+                            eventBus.on('signal:event', (signal) => {
+                                rs.broadcastEvent('signal:event', signal);
+                            });
+                            eventBus.on('guard:updated', (signal) => {
+                                rs.broadcastEvent('guard:updated', signal);
+                            });
+                        }
+                        // 确保 SignalBridge 已初始化（触发 lazy singleton）
+                        try {
+                            container.get('signalBridge');
+                        }
+                        catch {
+                            // SignalBridge 未注册时静默跳过
+                        }
+                        // EventBus → audit:entry
+                        if (eventBus) {
+                            eventBus.on('audit:entry', (data) => {
+                                rs.broadcastEvent('audit:entry', data);
+                            });
+                        }
+                    }
+                    catch {
+                        // EventBus/SignalBus 不可用时静默跳过
+                    }
                 }
                 catch (error) {
                     this.logger.warn('Failed to initialize realtime service', {

package/dist/lib/http/middleware/validate.js

@@ -60,8 +60,8 @@ export function validateQuery(schema) {
             });
             return;
         }
-        // 替换为 parsed + defaulted + coerced 数据
-        req.query = result.data;
+        // Express 5: req.query is a read-only getter, use defineProperty to override
+        Object.defineProperty(req, 'query', { value: result.data, writable: true, configurable: true });
         next();
     };
 }
@@ -85,7 +85,11 @@ export function validateParams(schema) {
             });
             return;
         }
-        req.params = result.data;
+        Object.defineProperty(req, 'params', {
+            value: result.data,
+            writable: true,
+            configurable: true,
+        });
         next();
     };
 }

package/dist/lib/http/routes/audit.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Audit Log API 路由
+ *
+ * 端点:
+ *   GET /api/v1/audit — 查询审计日志
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/dist/lib/http/routes/audit.js

@@ -0,0 +1,51 @@
+/**
+ * Audit Log API 路由
+ *
+ * 端点:
+ *   GET /api/v1/audit — 查询审计日志
+ */
+import express from 'express';
+import { getServiceContainer } from '../../injection/ServiceContainer.js';
+const router = express.Router();
+/**
+ * GET /api/v1/audit
+ * 查询审计日志，支持按 actor/action/result/时间范围过滤
+ *
+ * Query params:
+ *   actor     — 操作人过滤
+ *   action    — 操作类型过滤
+ *   result    — 结果过滤 (success|failure)
+ *   startDate — 起始时间戳 (毫秒)
+ *   endDate   — 结束时间戳 (毫秒)
+ *   limit     — 返回条数上限 (默认 100, 最大 500)
+ */
+router.get('/', async (req, res) => {
+    try {
+        const container = getServiceContainer();
+        const auditStore = container.get('auditStore');
+        if (!auditStore) {
+            res.status(503).json({
+                success: false,
+                error: { code: 'SERVICE_UNAVAILABLE', message: 'AuditStore not available' },
+            });
+            return;
+        }
+        const limit = Math.min(Number(req.query.limit) || 100, 500);
+        const logs = auditStore.query({
+            actor: req.query.actor,
+            action: req.query.action,
+            result: req.query.result,
+            startDate: req.query.startDate ? Number(req.query.startDate) : undefined,
+            endDate: req.query.endDate ? Number(req.query.endDate) : undefined,
+            limit,
+        });
+        res.json({ success: true, data: { logs, total: logs.length } });
+    }
+    catch (err) {
+        res.status(500).json({
+            success: false,
+            error: { code: 'AUDIT_ERROR', message: err.message },
+        });
+    }
+});
+export default router;

package/dist/lib/http/routes/guardReport.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Guard Report API 路由
+ *
+ * 端点:
+ *   GET /api/v1/guard/report           — 项目合规性报告（ComplianceReporter + Uncertainty）
+ *   GET /api/v1/guard/report/reverse   — ReverseGuard 反向验证
+ *   GET /api/v1/guard/report/coverage  — CoverageAnalyzer 覆盖率矩阵
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;