dsh-agentone 0.5.0

package/lib/index.js

@@ -0,0 +1,895 @@
+// dsh-agentone 主入口：挂 /agentone/* 路由（dsh webServer 原生 Node handler）。
+//
+// M1（飞书登录）页面与 API：
+//   GET  /agentone/                      状态页（登录/登出/模型同步状态）
+//   GET  /agentone/api/status            {platform_url, logged_in, user_email, model}
+//   POST /agentone/api/login             {callback_url} → {login_url}（浏览器打开）
+//   GET  /agentone/callback?code&state   平台 landing 跳回：换令牌后自动配置模型
+//   POST /agentone/api/logout            清除本地凭据并移除平台模型配置
+//   POST /agentone/api/model/sync        重新拉取平台模型并写入 settings.yaml
+//
+// M2（平台模型）：登录成功与每次启动时自动执行 applyPlatformModel——拉平台
+// /api/plugin/v1/models，写入 $DSH_HOME/settings.yaml（llm-pi-ai.providers.platform
+// + agent-default-model）与 .credentials.yaml（refs.AGENTONE_API_KEY，0600）。
+// dsh 侧模型选择器随即出现「平台模型」，对话走平台代理，真实密钥不出平台。
+import z from '@deepseek-ai/schemastery';
+import { createRequire } from 'node:module';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import {
+  applyPlatformPlan,
+  buildLoginUrl,
+  exchangeCode,
+  fetchPlatformCapabilities,
+  fetchPlatformPlan,
+  fetchPlatformProfile,
+  newLoginState,
+  refreshPlatformToken,
+  revokePlatformToken,
+} from './auth.js';
+import { applyPlatformModel, removePlatformModel } from './model.js';
+import { installPlatformSkill, listPlatformSkills, removePlatformSkill } from './skill.js';
+import { platformFetch } from './http.js';
+import { donePageHtml, statusPageHtml } from './page.js';
+import { dshPluginCli, probeCliTool, pnpmCli } from './proc.js';
+
+import { clearCredentials, loadCredentials, resolveDshHome, saveCredentials, updateCredentials } from './store.js';
+
+const require = createRequire(import.meta.url);
+
+/** 插件自身版本（关于页展示）。 */
+const PLUGIN_VERSION = require('../package.json').version;
+/** 插件自身的 npm 包名（插件管理里禁止卸载/升级自己）。 */
+const PLUGIN_PACKAGE_NAME = require('../package.json').name;
+
+export const name = 'agentone';
+export const inject = ['webServer'];
+
+export const Config = z.object({
+  platformUrl: z
+    .string()
+    .default('https://ccpg.one.agentone.work')
+    .description('AgentOne 平台地址（本地开发在 profile cordis.patch.yml 覆盖为 http://127.0.0.1:8558）'),
+  storeDir: z.string().default('').description('凭据存储目录，空则用 $DSH_HOME/agentone'),
+});
+
+/** 本次进程内的登录 CSRF state（/callback 比对后即失效）。 */
+const pendingStates = new Set();
+
+function sendJson(response, status, data) {
+  response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
+  response.end(JSON.stringify(data));
+}
+
+async function readJsonBody(request, limitBytes = 8192) {
+  // 只认 application/json：恶意页面可用 <form enctype="text/plain"> 跨站提交
+  // 完全可控的 JSON body（fetch 跨源 JSON 会被预检拦住，表单不会），
+  // 借此驱动登出/装包等写操作。浏览器同源 fetch 一定带本类型。
+  const contentType = String(request.headers?.['content-type'] || '').toLowerCase();
+  if (!contentType.includes('application/json')) {
+    throw new Error('请求类型不正确');
+  }
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > limitBytes) throw new Error('请求体过大');
+    chunks.push(chunk);
+  }
+  if (chunks.length === 0) return {};
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+
+/** 应用平台模型配置并把结果落盘（成功清 model_error，失败记录原因与错误码）。 */
+async function syncPlatformModel(config, log) {
+  try {
+    const result = await applyPlatformModel(config);
+    await updateCredentials(config, {
+      models_count: result.models.length,
+      default_model: result.defaultModel,
+      model_synced_at: new Date().toISOString(),
+      model_error: null,
+      model_error_code: null,
+    });
+    log.info(`[dsh-agentone] platform model applied: ${result.defaultModel}（共 ${result.models.length} 个可用模型）`);
+    return result;
+  } catch (error) {
+    const message = error?.message || String(error);
+    await updateCredentials(config, {
+      model_error: message,
+      model_error_code: error?.code || null,
+    }).catch(() => {});
+    log.warn(`[dsh-agentone] platform model sync failed: ${message}`);
+    throw error;
+  }
+}
+
+/** 进行中的令牌轮换：临期窗口内多个请求共享同一次 refresh（轮换是
+ * 一次性的，并发各刷一次会 401 把用户登出）。 */
+let tokenRefreshInFlight = null;
+
+/**
+ * 令牌保鲜：access 临期（5 分钟内）/过期且有 refresh_token 时轮换，并把新
+ * access 重新写入 dsh 凭据库（.credentials.yaml 的 AGENTONE_API_KEY 引用）。
+ * - 轮换失败且 401（refresh 已吊销）→ 清本地凭据，状态回到未登录；
+ * - 网络错误 → 保留凭据下次再试（返回旧凭据）。
+ */
+async function ensureFreshToken(config, log) {
+  const credentials = await loadCredentials(config);
+  if (!credentials || !credentials.refresh_token) return credentials;
+  const expiresAt = credentials.expires_at ? Date.parse(credentials.expires_at) : 0;
+  if (!expiresAt || expiresAt - Date.now() > 5 * 60 * 1000) return credentials;
+  if (!tokenRefreshInFlight) {
+    tokenRefreshInFlight = (async () => {
+      try {
+        const refreshed = await refreshPlatformToken(config.platformUrl, credentials.refresh_token);
+        const expiresIn = Number(refreshed.expires_in) || 0;
+        const updated = {
+          ...credentials,
+          access_token: refreshed.access_token,
+          refresh_token: refreshed.refresh_token,
+          saved_at: new Date().toISOString(),
+          expires_at: expiresIn ? new Date(Date.now() + expiresIn * 1000).toISOString() : null,
+        };
+        await saveCredentials(config, updated);
+        // 凭据库引用指向旧 access，必须随轮换重写
+        await applyPlatformModel(config).catch(() => {});
+        log.info('[dsh-agentone] platform token refreshed');
+        return updated;
+      } catch (error) {
+        if (error?.status === 401) {
+          log.warn('[dsh-agentone] refresh rejected, clearing local credentials');
+          await clearCredentials(config);
+          return null;
+        }
+        log.warn(`[dsh-agentone] token refresh failed: ${error?.message || error}`);
+        return credentials;
+      } finally {
+        tokenRefreshInFlight = null;
+      }
+    })();
+  }
+  return tokenRefreshInFlight;
+}
+
+/** web profile 固定名（dsh 控制台只跑 web profile）。 */
+const PLUGIN_PROFILE = 'web';
+
+/**
+ * npm 包名白名单（scoped 与非 scoped）。用户输入会进入 CLI 参数，必须先
+ * 收敛到 npm 官方命名规则，杜绝以 `-` 开头的值被 dsh/pnpm 当成 flag。
+ */
+const NPM_NAME_RE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+/** 版本白名单：语义化版本、^ ~ 前缀与 latest 标签。 */
+const VERSION_RE = /^(?:\^|~)?\d+(?:\.\d+){0,3}(?:[-+][a-z0-9._-]+)?$|^latest$/;
+
+function pluginProfileDir(config) {
+  return join(resolveDshHome(config), 'profiles', PLUGIN_PROFILE);
+}
+
+/** 校验用户输入的包名/版本；非法值直接拒绝（中文报错）。 */
+function assertValidPackage(name, version) {
+  if (!NPM_NAME_RE.test(name)) {
+    throw new Error('插件名不合法：仅允许小写字母、数字和 . _ -（scoped 名如 @scope/pkg）');
+  }
+  if (version !== undefined && version !== '' && !VERSION_RE.test(version)) {
+    throw new Error('版本号不合法：仅允许语义化版本（如 1.2.3、^1.2.0）或 latest');
+  }
+}
+
+async function readJsonFile(path) {
+  try {
+    return JSON.parse(await readFile(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** 从 node_modules 里读一个包的已装版本（读不到返回 null）。 */
+async function installedVersion(profile, name) {
+  const manifest = await readJsonFile(join(profile, 'node_modules', name, 'package.json'));
+  return typeof manifest?.version === 'string' ? manifest.version : null;
+}
+
+/** 包是否带 dsh.bundle 声明（决定它在层列表里是否被激活）。 */
+async function isBundlePackage(profile, name) {
+  const manifest = await readJsonFile(join(profile, 'node_modules', name, 'package.json'));
+  return Boolean(manifest?.dsh?.bundle);
+}
+
+/** link:/file: 等本地路径依赖展示短标签（没有版本号可读）。 */
+function specLabel(spec) {
+  if (typeof spec !== 'string') return '';
+  if (spec.startsWith('link:') || spec.startsWith('file:')) return '本地链接';
+  return '';
+}
+
+/** dsh 官方 in-box bundle：profile 模板自带，不是用户可管理的插件。 */
+const INBOX_BUNDLES = new Set([
+  '@deepseek-ai/dsh-base',
+  '@deepseek-ai/dsh-web-app',
+  '@deepseek-ai/dsh-headless',
+]);
+
+/**
+ * 镜像预装插件（docker/dsh/Dockerfile.default 构建期通过 dsh plugin add
+ * 装入 /opt/prebuilt/dsh-home，init.sh 首启物化到持久卷）。用户可以卸载，
+ * 但它们承载控制台核心体验（侧栏宿主/Workflow One/插件市场/IM 桥），所以
+ * 每次 dsh 启动时检测：缺失则静默重装（常驻保证），已装则不碰（尊重用户
+ * 的版本选择）。
+ */
+const BUILTIN_PLUGINS = ['dsh-better-sidebar', 'dsh-harness-one', 'dshmarket', 'dsh-im'];
+
+/**
+ * 解析 pnpm outdated 输出：两行一组，包名行 + "current => latest" 行。
+ * 输出格式随 pnpm 版本变化：解析出的条目必须满足「上一行是已知的插件
+ * 包名」才采纳，格式不认识时返回空表（所有 latest 为 null，「升级」按钮
+ * 整体不出现），而不是错配出假版本号。
+ */
+function parseOutdatedList(stdout, knownNames = []) {
+  const result = {};
+  const known = new Set(knownNames);
+  const rows = String(stdout).split('\n').map((line) => line.trim()).filter(Boolean);
+  rows.forEach((line, i) => {
+    const match = i > 0 ? /^(\S+)\s+=>\s+(\S+)$/.exec(line) : null;
+    if (match && (!known.size || known.has(rows[i - 1]))) {
+      result[rows[i - 1]] = { current: match[1], latest: match[2] };
+    }
+  });
+  return result;
+}
+
+/**
+ * 内置插件的用途说明（以各自官方 README 为准）：用户视角讲清楚装了能
+ * 干什么、在哪里用到。
+ */
+const BUILTIN_PLUGIN_DESCRIPTIONS = {
+  'dsh-better-sidebar':
+    '侧边工作台：文件管理/编辑预览、内嵌浏览器、真实终端、Git 文件变动，聊天里的文件点开即看',
+  'dsh-harness-one':
+    'Workflow One：可视化编排 AI 工作流，像画流程图一样串联任务，支持推送结果到飞书',
+  dshmarket:
+    '插件市场：在 dsh 设置里逛社区插件，像应用商店一样点一下就装好',
+  'dsh-im':
+    'IM 桥核心：让 dsh 接入飞书等聊天工具——群内 @机器人 干活、收通知与审批卡片',
+};
+
+/** 汇总 profile 插件状态：dependencies（去掉 in-box）+ 已装版本 + 激活态。 */
+async function listProfilePlugins(config) {
+  const dir = pluginProfileDir(config);
+  const manifest = await readJsonFile(join(dir, 'package.json'));
+  const dependencies = manifest?.dependencies ?? {};
+  const bundles = Array.isArray(manifest?.dsh?.profile?.bundles)
+    ? manifest.dsh.profile.bundles
+    : [];
+  const plugins = [];
+  const seen = new Set();
+  for (const [name, spec] of Object.entries(dependencies)) {
+    if (INBOX_BUNDLES.has(name)) continue;
+    seen.add(name);
+    const version = await installedVersion(dir, name);
+    const bundle = version !== null && (await isBundlePackage(dir, name));
+    plugins.push({
+      name,
+      spec,
+      version,
+      source: specLabel(spec) || 'npm',
+      bundled: bundle,
+      // 激活 = 已装 + 带 bundle 声明 + 出现在 dsh.profile.bundles
+      active: bundle && bundles.includes(name),
+      builtin: BUILTIN_PLUGINS.includes(name),
+      // 自身随平台镜像升级：前端据此隐藏卸载/升级按钮（与后端拒绝逻辑同源）
+      self_managed: name === PLUGIN_PACKAGE_NAME,
+      description: BUILTIN_PLUGIN_DESCRIPTIONS[name] || null,
+    });
+  }
+  // 内置插件被卸载后不在 dependencies 里，但仍要出现在列表中
+  // （状态「未安装」+「安装」按钮），否则用户无从感知与恢复。
+  for (const name of BUILTIN_PLUGINS) {
+    if (seen.has(name)) continue;
+    plugins.push({
+      name,
+      spec: null,
+      version: null,
+      source: 'npm',
+      bundled: false,
+      active: false,
+      builtin: true,
+      self_managed: false,
+      description: BUILTIN_PLUGIN_DESCRIPTIONS[name] || null,
+    });
+  }
+  return {
+    profile: PLUGIN_PROFILE,
+    bundles: bundles.filter((name) => !INBOX_BUNDLES.has(name)),
+    plugins,
+  };
+}
+
+/** dsh plugin add 的构建脚本放行参数（与镜像 Dockerfile 预装命令同源）。
+ * pnpm 11 默认拦截依赖构建脚本，node-pty（sidebar/harness-one 的终端依赖）
+ * 被拦会导致 add 非零退出、bundles reconcile 不执行——包装上了却永远
+ * 「未激活」。用 = 连接形式，避免空格分隔被 pnpm 拆成两个参数。
+ */
+const BUILTIN_PLUGIN_ALLOW_BUILD = {
+  'dsh-better-sidebar': ['--allow-build=node-pty'],
+  'dsh-harness-one': ['--allow-build=node-pty'],
+  dshmarket: ['--allow-build=node-pty'],
+  'dsh-im': [],
+};
+
+/** 安装：白名单校验后转发官方 CLI（参数数组，无 shell）。 */
+async function installProfilePlugin(config, name, version) {
+  assertValidPackage(name, version);
+  const target = version ? `${name}@${version}` : name;
+  await dshPluginCli(['add', target, ...(BUILTIN_PLUGIN_ALLOW_BUILD[name] || [])]);
+  return listProfilePlugins(config);
+}
+
+/** 卸载：自身与内置插件拒绝（无卸载按钮 + 后端兜底）；白名单校验后转发官方 CLI。 */
+async function removeProfilePlugin(config, name) {
+  assertValidPackage(name);
+  if (INBOX_BUNDLES.has(name)) {
+    throw new Error('dsh 内置组件不可卸载');
+  }
+  if (BUILTIN_PLUGINS.includes(name)) {
+    throw new Error('内置插件承载 dsh 核心体验，不可卸载');
+  }
+  if (name === PLUGIN_PACKAGE_NAME) {
+    throw new Error('AgentOne 插件是登录与模型配置的载体，不能卸载自己');
+  }
+  await dshPluginCli(['remove', name]);
+  return listProfilePlugins(config);
+}
+
+/** 升级到 manifest 区间内最新版：dsh plugin update；in-box 随 dsh 本体升级。 */
+async function upgradeProfilePlugin(config, name) {
+  assertValidPackage(name);
+  if (INBOX_BUNDLES.has(name)) {
+    throw new Error('dsh 内置组件随 dsh 一同升级，请等待平台更新 dsh');
+  }
+  if (name === PLUGIN_PACKAGE_NAME) {
+    throw new Error('AgentOne 插件随平台镜像一同升级，无需手动操作');
+  }
+  await dshPluginCli(['update', name]);
+  return listProfilePlugins(config);
+}
+
+/**
+ * 内置插件常驻检测：镜像预装插件缺失时逐个静默重装。单个失败不阻断
+ * （网络抖动等），下一个启动周期再试；全部已装时零开销。
+ */
+async function ensureBuiltinPlugins(config, log) {
+  const state = await listProfilePlugins(config);
+  const installed = new Set(state.plugins.map((plugin) => plugin.name));
+  const missing = BUILTIN_PLUGINS.filter((name) => !installed.has(name));
+  if (!missing.length) return [];
+  const reinstalled = [];
+  for (const name of missing) {
+    try {
+      await installProfilePlugin(config, name);
+      reinstalled.push(name);
+      log.info(`[dsh-agentone] builtin plugin reinstalled: ${name}`);
+    } catch (error) {
+      log.warn(`[dsh-agentone] builtin plugin reinstall failed (${name}): ${error?.message || error}`);
+    }
+  }
+  return reinstalled;
+}
+
+/**
+ * 套餐技能自动同步：平台上 source=plan 且未安装的技能静默装齐（与平台托管
+ * 实例的套餐技能预装语义对齐）；单个失败不阻断其余，结果记 credentials。
+ */
+async function syncPlanSkills(config, log, credentials) {
+  const token = credentials?.access_token;
+  if (!token) return null;
+  let listing;
+  try {
+    listing = await listPlatformSkills(config.platformUrl, token);
+  } catch (error) {
+    log.warn(`[dsh-agentone] skills list failed: ${error?.message || error}`);
+    await updateCredentials(config, { skills_error: String(error?.message || error) }).catch(
+      () => {},
+    );
+    return null;
+  }
+  const pending = (listing.skills || []).filter((skill) => skill.source === 'plan' && !skill.installed);
+  let installed = 0;
+  const failures = [];
+  for (const skill of pending) {
+    try {
+      await installPlatformSkill(config.platformUrl, token, skill.canonical_slug, {
+        config,
+        source: 'plan',
+      });
+      installed += 1;
+      log.info(`[dsh-agentone] plan skill installed: ${skill.canonical_slug}`);
+    } catch (error) {
+      failures.push(`${skill.canonical_slug}: ${error?.message || error}`);
+    }
+  }
+  await updateCredentials(config, {
+    skills_synced_at: new Date().toISOString(),
+    skills_error: failures.length ? failures.join('；') : null,
+  }).catch(() => {});
+  if (failures.length) log.warn(`[dsh-agentone] plan skill failures: ${failures.join('；')}`);
+  return { installed, failed: failures.length };
+}
+
+
+/**
+ * status 内缓存：skills/catalog 内容几乎不变，却被 5s 轮询每次全量重拉。
+ * 缓存 45s；模型同步结果本就落盘在 credentials，不受缓存影响。
+ * capabilities（含 plan_state）不缓存：前端靠轮询它感知「套餐审批通过」，
+ * 缓存会把自动同步模型的延迟从 5s 拖到 50s。缓存命中时只省 skills/catalog
+ * 两个请求，capabilities 仍每次实时拉。
+ */
+const STATUS_CACHE_TTL_MS = 45_000;
+let statusCache = { at: 0, key: null, skills: null, displayNames: null };
+
+async function cachedPlatformStatus(config, credentials) {
+  const capabilities = await fetchPlatformCapabilities(config.platformUrl, credentials.access_token);
+  const key = `${config.platformUrl}|${credentials.access_token}`;
+  if (statusCache.key === key && Date.now() - statusCache.at < STATUS_CACHE_TTL_MS) {
+    return { ...statusCache, capabilities };
+  }
+  const skills = capabilities?.channels?.skillhub?.enabled
+    ? await listPlatformSkills(config.platformUrl, credentials.access_token).catch(() => null)
+    : null;
+  // canonical slug → 市场名称（前端用友好名展示，slug 仅作操作标识）
+  let displayNames = {};
+  if (skills?.skills?.length) {
+    const catalog = await platformFetch(
+      `${config.platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills/catalog`,
+      { headers: { Authorization: `Bearer ${credentials.access_token}` } },
+    )
+      .then((r) => (r.ok ? r.json() : null))
+      .catch(() => null);
+    if (catalog?.items) {
+      for (const item of catalog.items) {
+        if (item.slug && item.display_name) displayNames[item.slug] = item.display_name;
+      }
+    }
+  }
+  statusCache = { at: Date.now(), key, skills, displayNames };
+  return { ...statusCache, capabilities };
+}
+
+export function apply(ctx, config) {
+  const log = ctx.logger || console;
+  ctx.effect(() => {
+    const register = (path, handler) => ctx.webServer.register({ kind: 'exact', path, handler });
+
+    register('/agentone/', (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      response.end(statusPageHtml());
+    });
+
+    register('/agentone/done', (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      const ok = new URL(request.url, 'http://localhost').searchParams.get('ok') !== '0';
+      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      response.end(donePageHtml(ok));
+    });
+
+    register('/agentone/api/status', async (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      try {
+        // 顺手做令牌保鲜：临期自动轮换，refresh 失效则清凭据回到未登录
+        const credentials = await ensureFreshToken(config, log);
+        let userEmail = null;
+        let capabilities = null;
+        let skills = null;
+        let displayNames = {};
+        if (credentials) {
+          const profile = await fetchPlatformProfile(config.platformUrl, credentials.access_token);
+          userEmail = profile?.email ?? null;
+          if (userEmail) {
+            ({ capabilities, skills, displayNames } = await cachedPlatformStatus(config, credentials));
+          }
+        }
+        sendJson(response, 200, {
+          platform_url: config.platformUrl,
+          logged_in: Boolean(userEmail),
+          user_email: userEmail,
+          token_expires_at: credentials?.expires_at ?? null,
+          plugin_version: PLUGIN_VERSION,
+          capabilities,
+          skills,
+          skill_display_names: displayNames,
+          skills_synced_at: credentials?.skills_synced_at ?? null,
+          skills_error: credentials?.skills_error ?? null,
+          model: credentials
+            ? {
+                default_model: credentials.default_model ?? null,
+                models_count: credentials.models_count ?? 0,
+                synced_at: credentials.model_synced_at ?? null,
+                error: credentials.model_error ?? null,
+                error_code: credentials.model_error_code ?? null,
+              }
+            : null,
+        });
+      } catch (error) {
+        log.warn(`[dsh-agentone] status failed: ${error?.message || error}`);
+        sendJson(response, 500, { error: '读取登录状态失败' });
+      }
+    });
+
+    register('/agentone/api/login', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const body = await readJsonBody(request);
+        const callbackUrl = String(body.callback_url || '');
+        if (!/^https?:\/\/|^\/portal\//.test(callbackUrl)) {
+          sendJson(response, 400, { error: '回调地址不合法' });
+          return;
+        }
+        const state = newLoginState();
+        pendingStates.add(state);
+        sendJson(response, 200, { login_url: buildLoginUrl(config.platformUrl, callbackUrl, state) });
+      } catch (error) {
+        log.warn(`[dsh-agentone] login failed: ${error?.message || error}`);
+        sendJson(response, 500, { error: '发起登录失败' });
+      }
+    });
+
+    register('/agentone/callback', async (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      const params = new URL(request.url, 'http://localhost').searchParams;
+      const code = params.get('code') || '';
+      // 相对跳转完成页：独立版落在 /agentone/done，托管版落在控制台代理路径下
+      const redirect = (ok) => {
+        response.writeHead(302, { location: `done?ok=${ok ? 1 : 0}` });
+        response.end();
+      };
+      // 平台 grant 的 redirect_url 只携带 code；state 存在平台侧、由 exchange
+      // 响应回传（见 app/api/plugin_auth.py）。因此先换令牌，再用响应中的
+      // state 与本进程 pendingStates 比对防 CSRF，不认识则丢弃令牌。
+      if (!code) {
+        log.warn('[dsh-agentone] callback rejected: missing code');
+        redirect(false);
+        return;
+      }
+      try {
+        const result = await exchangeCode(config.platformUrl, code);
+        if (!pendingStates.delete(String(result.state || ''))) {
+          log.warn('[dsh-agentone] callback rejected: unknown state from exchange');
+          redirect(false);
+          return;
+        }
+        const expiresIn = Number(result.expires_in) || 0;
+        await saveCredentials(config, {
+          schema_version: 2,
+          access_token: result.access_token,
+          refresh_token: result.refresh_token || null,
+          platform_url: config.platformUrl,
+          saved_at: new Date().toISOString(),
+          expires_at: expiresIn ? new Date(Date.now() + expiresIn * 1000).toISOString() : null,
+        });
+        log.info('[dsh-agentone] platform login stored');
+        // 登录即配置模型 + 同步套餐技能：失败不阻断登录，状态页展示原因
+        await syncPlatformModel(config, log).catch(() => {});
+        await syncPlanSkills(config, log, {
+          ...(await loadCredentials(config)),
+          access_token: result.access_token,
+        }).catch(() => {});
+        redirect(true);
+      } catch (error) {
+        log.warn(`[dsh-agentone] exchange failed: ${error?.message || error}`);
+        redirect(false);
+      }
+    });
+
+    register('/agentone/api/model/sync', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const result = await syncPlatformModel(config, log);
+        sendJson(response, 200, {
+          ok: true,
+          default_model: result.defaultModel,
+          models_count: result.models.length,
+        });
+      } catch (error) {
+        sendJson(response, 502, { error: error?.message || '同步平台模型失败' });
+      }
+    });
+
+    register('/agentone/api/skill/install', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const credentials = await ensureFreshToken(config, log);
+        if (!credentials) {
+          sendJson(response, 401, { error: '请先完成飞书登录' });
+          return;
+        }
+        const body = await readJsonBody(request);
+        const slug = String(body.slug || '');
+        if (!/^[a-z0-9][a-z0-9-]*(--[a-z0-9][a-z0-9-]*)?$/i.test(slug)) {
+          sendJson(response, 400, { error: '技能标识格式不正确' });
+          return;
+        }
+        const result = await installPlatformSkill(
+          config.platformUrl,
+          credentials.access_token,
+          slug,
+          { config },
+        );
+        sendJson(response, 200, { ok: true, ...result });
+      } catch (error) {
+        sendJson(response, 502, { error: error?.message || '技能安装失败' });
+      }
+    });
+
+    register('/agentone/api/skill/catalog', async (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      try {
+        const credentials = await ensureFreshToken(config, log);
+        if (!credentials) {
+          sendJson(response, 401, { error: '请先完成飞书登录' });
+          return;
+        }
+        const query = new URL(request.url, 'http://localhost').searchParams.get('q') || '';
+        const resp = await platformFetch(
+          `${config.platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills/catalog?q=${encodeURIComponent(query)}`,
+          { headers: { Authorization: `Bearer ${credentials.access_token}` } },
+        );
+        const data = await resp.json().catch(() => ({}));
+        if (!resp.ok) {
+          sendJson(response, resp.status, { error: data?.detail || '技能市场暂时不可用' });
+          return;
+        }
+        // 附带已装清单，前端好标「已安装」
+        const listing = await listPlatformSkills(
+          config.platformUrl,
+          credentials.access_token,
+        ).catch(() => null);
+        const installed = (listing?.skills || []).filter((skill) => skill.installed);
+        sendJson(response, 200, { ...data, installed });
+      } catch (error) {
+        sendJson(response, 502, { error: '技能市场暂时不可用，请稍后再试' });
+      }
+    });
+
+    register('/agentone/api/skill/uninstall', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const credentials = await loadCredentials(config);
+        if (!credentials) {
+          sendJson(response, 401, { error: '请先完成飞书登录' });
+          return;
+        }
+        const body = await readJsonBody(request);
+        const slug = String(body.slug || '');
+        if (!/^[a-z0-9][a-z0-9-]*(--[a-z0-9][a-z0-9-]*)?$/i.test(slug)) {
+          sendJson(response, 400, { error: '技能标识格式不正确' });
+          return;
+        }
+        await removePlatformSkill(config.platformUrl, credentials.access_token, slug, { config });
+        sendJson(response, 200, { ok: true, canonical_slug: slug });
+      } catch (error) {
+        sendJson(response, 502, { error: error?.message || '技能卸载失败' });
+      }
+    });
+
+    register('/agentone/api/plugin/list', async (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      try {
+        const [state, outdatedStdout] = await Promise.all([
+          listProfilePlugins(config),
+          pnpmCli(['outdated', '--format', 'list'], 60000)
+            .then((r) => r.stdout)
+            .catch(() => ''),
+        ]);
+        const outdated = parseOutdatedList(
+          outdatedStdout,
+          state.plugins.map((plugin) => plugin.name),
+        );
+        for (const plugin of state.plugins) {
+          const spread = outdated[plugin.name];
+          plugin.latest = spread ? spread.latest : null;
+        }
+        sendJson(response, 200, state);
+      } catch (error) {
+        sendJson(response, 500, { error: error?.message || '读取插件列表失败' });
+      }
+    });
+
+    register('/agentone/api/plugin/install', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const body = await readJsonBody(request);
+        const state = await installProfilePlugin(
+          config,
+          String(body.name || ''),
+          body.version === undefined ? undefined : String(body.version),
+        );
+        sendJson(response, 200, { ok: true, ...state });
+      } catch (error) {
+        sendJson(response, 400, { error: error?.message || '插件安装失败' });
+      }
+    });
+
+    register('/agentone/api/plugin/remove', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const body = await readJsonBody(request);
+        const state = await removeProfilePlugin(config, String(body.name || ''));
+        sendJson(response, 200, { ok: true, ...state });
+      } catch (error) {
+        sendJson(response, 400, { error: error?.message || '插件卸载失败' });
+      }
+    });
+
+    register('/agentone/api/plugin/upgrade', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const body = await readJsonBody(request);
+        const state = await upgradeProfilePlugin(config, String(body.name || ''));
+        sendJson(response, 200, { ok: true, ...state });
+      } catch (error) {
+        sendJson(response, 400, { error: error?.message || '插件升级失败' });
+      }
+    });
+
+    register('/agentone/api/cli/status', async (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      // 真实探测本机 CLI：与平台 cli-deployd 的判定口径一致（tokenStatus
+      // valid/needs_refresh = 已授权）。并发探测，单个失败不影响另一个。
+      const [lark, ccpg] = await Promise.all([
+        probeCliTool('lark-cli').catch(() => 'missing'),
+        probeCliTool('ccpg-cli').catch(() => 'missing'),
+      ]);
+      sendJson(response, 200, { tools: { 'lark-cli': lark, 'ccpg-cli': ccpg } });
+    });
+
+    register('/agentone/api/plan', async (request, response) => {
+      if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET' });
+        response.end();
+        return;
+      }
+      try {
+        const credentials = await loadCredentials(config);
+        if (!credentials) {
+          sendJson(response, 401, { error: '请先完成飞书登录' });
+          return;
+        }
+        const plan = await fetchPlatformPlan(config.platformUrl, credentials.access_token);
+        sendJson(response, 200, plan);
+      } catch (error) {
+        sendJson(response, 502, { error: error?.message || '获取套餐状态失败' });
+      }
+    });
+
+    register('/agentone/api/plan/apply', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        const credentials = await loadCredentials(config);
+        if (!credentials) {
+          sendJson(response, 401, { error: '请先完成飞书登录' });
+          return;
+        }
+        const body = await readJsonBody(request);
+        const planId = String(body.plan_id || '');
+        const message = String(body.message || '').slice(0, 500);
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9-]{0,63}$/.test(planId)) {
+          sendJson(response, 400, { error: '套餐标识格式不正确' });
+          return;
+        }
+        const result = await applyPlatformPlan(
+          config.platformUrl,
+          credentials.access_token,
+          planId,
+          message,
+        );
+        sendJson(response, 200, result);
+      } catch (error) {
+        sendJson(response, 400, { error: error?.message || '套餐申请提交失败' });
+      }
+    });
+
+    register('/agentone/api/logout', async (request, response) => {
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'POST' });
+        response.end();
+        return;
+      }
+      try {
+        // 先吊销平台侧 refresh token（尽力而为），再清本地；凭据读取失败
+        // （文件损坏等）也要走到清凭据，不能把用户卡在登录态。
+        const credentials = await loadCredentials(config);
+        if (credentials?.refresh_token) {
+          await revokePlatformToken(config.platformUrl, credentials.refresh_token);
+        }
+        await clearCredentials(config);
+        await removePlatformModel(config).catch((error) => {
+          log.warn(`[dsh-agentone] remove platform model failed: ${error?.message || error}`);
+        });
+        sendJson(response, 200, { ok: true });
+      } catch (error) {
+        // 本地清理任何一步失败都明确报错（中文），不再静默挂起连接
+        log.warn(`[dsh-agentone] logout failed: ${error?.message || error}`);
+        sendJson(response, 500, { error: '退出登录失败，请稍后重试' });
+      }
+    });
+
+    // 启动时若已有登录态：先保鲜令牌（临期轮换），再后台刷新模型配置与套餐技能。
+    // 内置插件常驻检测与登录无关，独立先行。
+    ensureBuiltinPlugins(config, log).catch((error) => {
+      log.warn(`[dsh-agentone] builtin plugin check failed: ${error?.message || error}`);
+    });
+    (async () => {
+      const credentials = await ensureFreshToken(config, log);
+      if (!credentials) return;
+      await syncPlatformModel(config, log).catch(() => {});
+      await syncPlanSkills(config, log, credentials).catch(() => {});
+    })();
+
+    return () => {
+      pendingStates.clear();
+      log.info('[dsh-agentone] routes unmounted');
+    };
+  }, 'dsh-agentone: http routes');
+}