dsh-agentone 0.5.37 → 0.5.39

package/README.md

@@ -1,20 +1,21 @@
 # dsh-agentone
 
 AgentOne 平台集成插件（dsh web 版 / 桌面版通用）。安装后让独立 dsh 接入公司
-AgentOne 平台：飞书登录、平台模型、SkillHub 技能、套餐申请、dsh 插件管理、
+AgentOne 平台：IDOne 登录、平台模型、SkillHub 技能、套餐申请、dsh 插件管理、
 lark-cli / ccpg-cli 状态探测。
 
 ## 能力总览（M1–M4 已全部交付）
 
-- **飞书登录（M1）**：设备登录流（一次性授权码），凭据保存在本机
-  `$DSH_HOME/agentone/credentials.json`（0600）。access 令牌临期自动轮换
-  （single-flight），refresh 失效自动回到未登录态。
+- **平台登录（M1）**：设备登录流（一次性授权码），入口按平台能力面自动
+  路由——平台开启邮箱锚点模式（IDOne 统一登录）时走 IDOne，否则回退
+  飞书；凭据保存在本机 `$DSH_HOME/agentone/credentials.json`（0600）。
+  access 令牌临期自动轮换（single-flight），refresh 失效自动回到未登录态。
 - **平台模型（M2）**：登录后自动把 dsh 的 llm provider 指向 AgentOne
   OpenAI 兼容代理（`/api/plugin/v1`），模型密钥不下发到本机；对话经平台
   走 TokenHub 按用户计量。平台 403 的 `plan_required` 错误码原样透传，
   前端据此引导申请套餐（不依赖中文文案匹配）。
-- **SkillHub 技能（M3）**：套餐技能自动装齐（启动/登录时，且常驻期间
-  套餐生效、套餐新配技能时由前端触发器与手动「同步套餐技能」按钮补装）；
+- **SkillHub 技能（M3）**：套餐技能与管理员默认技能在启动/登录和常驻后台同步，
+  支持 `611/c611-ops-workbench`、`611--c611-ops-workbench` 与全局技能名；
   技能市场搜索、手动安装/卸载，装/卸载后技能列表即时刷新（失效 45s
   status 缓存）；已装技能平台侧对比 latest 版本/指纹，有更新时展示
   「v旧 → v新」并支持一键升级（覆盖式重装，原子替换旧目录）；技能包
@@ -26,11 +27,17 @@ lark-cli / ccpg-cli 状态探测。
   登出时全部清理。会话内使用：`source $DSH_HOME/agentone/skillhub.env`。
 - **套餐申请（M3+）**：状态页「套餐」tab 展示当前套餐/审批中/可申请列表，
   一键提交申请；审批通过后前端轮询检测到 active 自动同步模型。
-- **dsh 插件管理（M3+）**：列出镜像内置与用户自装插件（版本/升级/激活态），
-  内置插件缺失时启动自动重装（自身也在常驻保证清单内，防误删导致平台集成
-  失效）；desktop 受管 pnpm 通道操作串行排队，宿主并发锁占用时自动退避
-  重试（不把「another desktop pnpm operation is already running」抛给用户）；
-  自身随平台镜像升级（列表中不提供按钮）。
+- **平台默认能力（#479）**：管理员在「集成开关 → dsh 插件」单独保存默认
+  技能、npm 插件、用途说明和安装期构建授权。技能和插件始终安装最新发布版本，
+  受管内容有新版时自动升级；客户端启动、登录及约每 5 分钟后台检查。
+  本机状态由目录、版本和归属记录共同确认，用户级台账作为参考。
+  目录已有用户文件、账号/registry 不同时等待用户确认应用；停用只停止管理，
+  不删除本机内容。平台暂时不可用时缓存仅展示，不用于安装。
+- **dsh 插件管理（M3+）**：列出当前 profile 的包、版本、bundle 注册状态；
+  安装成功需物理版本、插件声明和 profile 注册同时成立。注册不证明运行时加载，
+  页面提示重启生效。Web 必须配置实际 `profileName`，Desktop 使用宿主当前 profile
+  和受管 pnpm 通道；安装/卸载串行排队、支持生命周期取消。自身与 DSH 基础组件
+  不属于平台默认清单，自身只在独立安装模式允许手动升级。
 - **CLI 探测、安装与授权（M4）**：`lark-cli` / `ccpg-cli` 安装与授权态三态探测；
   未安装时「安装」一键自助安装（lark 走 `npm install -g @larksuite/cli@latest`，
   ccpg 走公司 `auto-install.sh`，口径与平台 cli-deployd 一致）；
@@ -46,7 +53,7 @@ lark-cli / ccpg-cli 状态探测。
   每个会话基线加载，project 级指令优先）；幂等不重复注入，用户已有语言
   偏好或删除标记块后不再介入（本机只做一次决策，记录于
   `$DSH_HOME/agentone/language-default.json`）。
-- **首启引导**：dsh 首次启动弹出飞书登录引导（order -50，早于官方
+- **首启引导**：dsh 首次启动弹出平台登录引导（order -50，早于官方
   「添加 API Key」），登录一次即跳过官方密钥引导；暗色主题适配。
 
 所有平台请求统一走 `lib/http.js`（默认 10s 超时、技能包下载 60s），
@@ -63,8 +70,9 @@ dsh plugin --profile web add dsh-agentone
 
 ## 使用
 
-打开 dsh web 的 `/agentone/` 页面（或 dsh 设置 → AgentOne）→「飞书登录」→
-浏览器完成平台飞书 OAuth → 自动跳回并显示已登录账号。授权完成页会等待
+打开 dsh web 的 `/agentone/` 页面（或 dsh 设置 → AgentOne）→「IDOne 登录」
+（平台未开启统一登录时为「飞书登录」）→ 浏览器完成平台 OAuth → 自动跳回
+并显示已登录账号。授权完成页会等待
 模型配置就绪后自动关闭；配置失败时展示原因并提供「重试同步」。
 
 登录成功后插件自动完成模型配置（也可点「重新同步模型」手动触发）：
@@ -88,8 +96,8 @@ dsh plugin --profile web add dsh-agentone
 
 ```
 插件页 ──POST /agentone/api/login──▶ 本插件后端
-       ◀─ {login_url} ──
-浏览器 ──login_url──▶ 平台飞书 OAuth ──▶ /api/auth/plugin/landing
+       ◀─ {login_url, provider} ──
+浏览器 ──login_url──▶ 平台 OAuth（IDOne 优先，飞书兜底）──▶ /api/auth/plugin/landing
        landing(JS, Bearer) ──POST /api/auth/plugin/grant──▶ {redirect_url(一次性 code)}
 浏览器 ──redirect_url──▶ 本插件 /agentone/callback?code
        插件后端 ──POST /api/auth/plugin/exchange──▶ {access_token}
@@ -105,6 +113,7 @@ dsh plugin --profile web add dsh-agentone
 | --- | --- | --- |
 | `platformUrl` | `https://ccpg.one.agentone.work` | AgentOne 平台地址（本地开发用 profile `cordis.patch.yml` 覆盖为 `http://127.0.0.1:8558`） |
 | `storeDir` | `$DSH_HOME/agentone` | 凭据目录 |
+| `profileName` | 空 | Web 模式填写实际启动 profile（例如 web 或自定义名）；无法确定时暂停插件写入。Desktop 自动读取当前 profile |
 
 密钥类值一律不进 settings，仅落 `credentials.json`（0600）。
 

package/lib/auth.js

@@ -1,10 +1,12 @@
 // AgentOne 设备登录流（一次性授权码）。
 //
 // 流程（与平台 app/api/plugin_auth.py 契约对应）：
-//   1. buildLoginUrl：拼平台飞书 OAuth 入口，redirect 指向平台 landing 页并
-//      携带 callback_url/state（经飞书 OAuth state 往返透传）；
-//   2. 浏览器完成飞书登录 → landing 页用平台令牌换一次性 code → 跳转
-//      callback_url（即本插件的 /agentone/callback 路由）；
+//   1. buildLoginUrl：拼平台 OAuth 入口（IDOne 优先、飞书兜底，见
+//      pickLoginProvider），redirect 指向平台 landing 页并携带
+//      callback_url/state（经 OAuth state 往返透传）；
+//   2. 浏览器完成登录 → 平台回调页写 hermeshub_token → landing 页用平台
+//      令牌换一次性 code → 跳转 callback_url（即本插件的 /agentone/callback
+//      路由）；
 //   3. exchangeCode：code 换新签发的平台访问令牌。
 import { randomBytes } from 'node:crypto';
 
@@ -14,10 +16,37 @@ export function newLoginState() {
   return randomBytes(16).toString('hex');
 }
 
-export function buildLoginUrl(platformUrl, callbackUrl, state) {
+export function buildLoginUrl(platformUrl, callbackUrl, state, provider = 'feishu') {
   const landing = `/api/auth/plugin/landing?callback_url=${encodeURIComponent(callbackUrl)}&state=${encodeURIComponent(state)}`;
   const redirect = encodeURIComponent(landing);
-  return `${platformUrl.replace(/\/+$/, '')}/api/auth/feishu/login?redirect=${redirect}`;
+  const entry = provider === 'idone' ? '/api/auth/casdoor/login' : '/api/auth/feishu/login';
+  return `${platformUrl.replace(/\/+$/, '')}${entry}?redirect=${redirect}`;
+}
+
+/**
+ * 匿名拉取平台能力面（登录入口开关）。登录前无令牌，走公开的
+ * /api/auth/capabilities（门户登录页同源依赖）。任何失败（超时/非 2xx/
+ * 解析错）返回 null，调用方按能力未知处理。
+ */
+export async function fetchAuthCapabilities(platformUrl) {
+  try {
+    const response = await platformFetch(`${platformUrl.replace(/\/+$/, '')}/api/auth/capabilities`, {}, 3000);
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 按 capabilities 选登录入口：仅当 IDOne 已启用且邮箱锚点模式开启
+ * （平台统一登录语义，未绑定用户由后端按邮箱自动认人）才走 IDOne；
+ * 其余情况（未启用 / 非锚点 / 查询失败）一律回退飞书。
+ */
+export function pickLoginProvider(caps) {
+  return caps?.casdoor_oauth_enabled === true && caps?.casdoor_email_anchor_enabled === true
+    ? 'idone'
+    : 'feishu';
 }
 
 export async function exchangeCode(platformUrl, code) {

package/lib/client.js

@@ -176,6 +176,8 @@ window.__ModuleLoader__.load({
       const { complete } = props;
       const [phase, setPhase] = React.useState('checking'); // checking | idle | waiting
       const [error, setError] = React.useState('');
+      // 登录入口名（服务端按平台能力面路由：IDOne 优先、飞书兜底）
+      const [providerName, setProviderName] = React.useState('飞书');
 
       React.useEffect(() => {
         let cancelled = false;
@@ -183,8 +185,10 @@ window.__ModuleLoader__.load({
           try {
             const response = await fetch('/agentone/api/status');
             const status = await response.json();
-            if (!cancelled && status?.logged_in) complete();
-            else if (!cancelled) setPhase('idle');
+            if (cancelled) return;
+            if (status?.login_provider === 'idone') setProviderName('IDOne');
+            if (status?.logged_in) complete();
+            else setPhase('idle');
           } catch {
             if (!cancelled) setPhase('idle');
           }
@@ -245,8 +249,8 @@ window.__ModuleLoader__.load({
             'p',
             { style: bodyStyle },
             phase === 'waiting'
-              ? '已打开授权窗口，完成飞书授权后这里会自动继续…'
-              : '使用公司飞书账号登录，公司托管的模型与技能会自动配置，无需任何 API Key。',
+              ? `已打开授权窗口，完成${providerName}授权后这里会自动继续…`
+              : `使用公司${providerName}账号登录，公司托管的模型与技能会自动配置，无需任何 API Key。`,
           ),
           error
             ? React.createElement('p', { style: { ...bodyStyle, color: '#c0392b' } }, error)
@@ -261,7 +265,7 @@ window.__ModuleLoader__.load({
                 onClick: startLogin,
                 disabled: phase === 'waiting',
               },
-              phase === 'waiting' ? '等待授权…' : '飞书登录',
+              phase === 'waiting' ? '等待授权…' : `${providerName}登录`,
             ),
             React.createElement(
               'button',

package/lib/defaults-sync.js

@@ -0,0 +1,257 @@
+// apply 范围内的默认能力协调器：后台检查、single-flight、身份隔离和可取消生命周期。
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { platformError, platformFetch } from './http.js';
+import { fetchPlatformConfig, validatePlatformConfig } from './platform-config.js';
+import { installPlatformSkill, listPlatformSkills } from './skill.js';
+import { localSkillState } from './skill-state.js';
+import { resolveDshHome } from './store.js';
+
+export function createDefaultsSync({ config, profiles, credentials, log, intervalMs = 300_000,
+  readConfig = fetchPlatformConfig, readSkills = listPlatformSkills, installSkill = installPlatformSkill,
+  now = () => new Date().toISOString(), setTimer = setTimeout, clearTimer = clearTimeout }) {
+  let disposed = false;
+  let generation = 0;
+  let inFlight = null;
+  let flightGeneration = null;
+  let timer = null;
+  let abort = null;
+  const manualOperations = new Map();
+  let state = { source: null, revision: null, checked_at: null, user_id: null, error: null,
+    running: false, skills: [], plugins: [] };
+  const active = (value) => !disposed && generation === value;
+  function stop() {
+    generation += 1; abort?.abort(); abort = null;
+    for (const controller of manualOperations.values()) controller.abort();
+    if (timer !== null) clearTimer(timer);
+    timer = null;
+  }
+  function schedule() {
+    if (disposed || timer !== null) return;
+    timer = setTimer(() => { timer = null; void sync().catch(() => {}); }, intervalMs + Math.floor(Math.random() * intervalMs * 0.1));
+    timer?.unref?.();
+  }
+  async function context(controller) {
+    const current = await credentials();
+    if (!current?.access_token) throw new Error('请先登录 AgentOne 平台');
+    const platform = (current.platform_url || config.platformUrl).replace(/\/+$/, '');
+    // 实例凭据仅能访问 plugin API；旧后端缺少身份字段时暂停新同步。
+    const instance = current.source === 'instance';
+    const response = await platformFetch(`${platform}${instance ? '/api/plugin/v1/config' : '/api/me'}`, {
+      signal: controller.signal, headers: { Authorization: `Bearer ${current.access_token}` },
+    });
+    if (!response.ok) throw await platformError(response, '登录身份暂时无法确认，请重新登录');
+    const identity = await response.json();
+    const userId = instance ? identity.user_id : identity.id;
+    if (typeof userId !== 'string' || !userId) throw new Error('平台未返回有效身份，请检查平台地址');
+    const verifiedConfig = instance ? { document: validatePlatformConfig(identity, userId), source: 'platform' } : null;
+    let target = null;
+    let profileError = null;
+    try { target = profiles.target(); } catch (error) { profileError = error.message; }
+    const home = resolve(target?.home || config.dshHome || resolveDshHome());
+    return { platform, token: current.access_token, userId, verifiedConfig, home,
+      profile: target?.name || 'unknown', profileDir: target?.dir || null, profileError };
+  }
+  function cachePath(owner) {
+    const hash = createHash('sha256').update(JSON.stringify([owner.platform, owner.userId, owner.home, owner.profile])).digest('hex');
+    return join(owner.home, 'agentone', 'defaults-state', `${hash}.json`);
+  }
+  async function writeCache(owner, document, source) {
+    const file = cachePath(owner); await mkdir(join(file, '..'), { recursive: true, mode: 0o700 });
+    const temp = `${file}.${randomUUID()}.tmp`;
+    await writeFile(temp, JSON.stringify({ document, source, checked_at: state.checked_at }) + '\n', { mode: 0o600 });
+    await rename(temp, file);
+  }
+  async function readCache(owner) {
+    try {
+      const cached = JSON.parse(await readFile(cachePath(owner), 'utf8'));
+      return { ...cached, document: validatePlatformConfig(cached.document, owner.userId) };
+    } catch { return null; }
+  }
+  async function run(manual, selected) {
+    const currentGeneration = generation;
+    const controller = new AbortController(); abort = controller;
+    state = { ...state, running: true, error: null };
+    let owner;
+    try {
+      owner = await context(controller);
+      if (!active(currentGeneration)) return;
+      if (state.user_id !== owner.userId || state.platform !== owner.platform || state.profile !== owner.profile) {
+        profiles.setPolicy([]);
+        state = { source: null, revision: null, checked_at: null,
+          user_id: owner.userId, platform: owner.platform, profile: owner.profile,
+          error: null, running: true, skills: [], plugins: [] };
+      }
+      let result;
+      try { result = owner.verifiedConfig || await readConfig(owner.platform, owner.token, owner.userId, controller.signal); }
+      catch (error) {
+        if (error.status !== 401 && error.status !== 403) {
+          const cached = await readCache(owner);
+          if (cached && active(currentGeneration)) {
+            const local = owner.profileError ? { plugins: [] } : await profiles.list();
+            state = { ...state, source: 'cache', revision: cached.document.revision,
+              checked_at: cached.checked_at, user_id: owner.userId, home: owner.home,
+              registry: cached.document.skill_registry, auto_sync: cached.document.auto_sync,
+              plugins: cached.document.plugins.map((item) => ({ kind: 'plugin', name: item.name,
+                description: item.description, target_version: item.version,
+                version: local.plugins.find((entry) => entry.name === item.name)?.version || null,
+                state: 'pending', error: '平台暂时不可用，此项为缓存参考' })),
+              skills: await Promise.all(cached.document.skills.map(async (item) => {
+                const local = await localSkillState(owner.platform, item.canonical_slug, {
+                  config: { ...config, dshHome: owner.home }, userId: owner.userId, registry: cached.document.skill_registry });
+                return { kind: 'skill', name: item.canonical_slug, description: item.description,
+                  state: local.state, version: local.record?.version || null, sources: ['builtin'] };
+              })) };
+          }
+        } else {
+          profiles.setPolicy([]);
+          state = { source: null, revision: null, checked_at: null, user_id: null,
+            error: null, running: true, skills: [], plugins: [] };
+        }
+        // 缓存只展示；本轮失败不进行任何新安装。
+        throw error;
+      }
+      if (!active(currentGeneration)) return;
+      const document = result.document;
+      profiles.setPolicy(document.plugins);
+      state = { ...state, source: result.source, revision: document.revision, user_id: owner.userId,
+        checked_at: now(), profile: owner.profile, home: owner.home, registry: document.skill_registry,
+        auto_sync: document.auto_sync, profile_error: owner.profileError, skills: [], plugins: [] };
+      await writeCache(owner, document, result.source);
+      const beforeCommit = async () => {
+        const identity = await context(controller);
+        if (!active(currentGeneration) || identity.userId !== owner.userId || identity.platform !== owner.platform
+          || identity.home !== owner.home || identity.profile !== owner.profile) throw new Error('登录身份或当前 profile 已改变，请重新同步');
+        const fresh = identity.verifiedConfig || await readConfig(owner.platform, owner.token, owner.userId, controller.signal);
+        if (JSON.stringify(fresh.document) !== JSON.stringify(document)) throw new Error('平台清单已更新，请重新检查后应用');
+      };
+      const options = { config: { ...config, dshHome: owner.home }, userId: owner.userId,
+        registry: document.skill_registry, signal: controller.signal, beforeCommit,
+        isCurrent: () => active(currentGeneration), missingOnly: !(selected && selected.apply) };
+      const enabled = manual || document.auto_sync;
+      if (!owner.profileError) {
+        const local = await profiles.list();
+        for (const item of document.plugins) {
+          if (!active(currentGeneration)) return;
+          const selectedItem = !selected || (selected.kind === 'plugin' && selected.name === item.name);
+          const installed = local.plugins.find((entry) => entry.name === item.name);
+          let entry = { kind: 'plugin', name: item.name, description: item.description,
+            target_version: item.version, version: installed?.version || null, loaded: null,
+            state: installed?.registered ? (item.version !== 'latest' && installed.version !== item.version ? 'pending' : 'current') : 'pending' };
+          state.plugins.push(entry);
+          if (!enabled && !installed?.registered) continue;
+          try {
+            const exact = await profiles.resolveVersion?.(item.name, 'latest') || 'latest';
+            entry.target_version = exact;
+            if (installed?.registered && installed.version !== exact && (!enabled || !selectedItem)) {
+              entry.state = 'pending';
+              continue;
+            }
+            if (!enabled || !selectedItem) continue;
+            entry.state = 'running';
+            const after = await profiles.install(item.name, exact, { ...options, updateLatest: true, allowBuild: item.allow_build });
+            if (!active(currentGeneration)) return;
+            Object.assign(entry, { version: after.version, state: after.state, registered: after.registered, loaded: null });
+          } catch (error) {
+            if (!active(currentGeneration)) return;
+            Object.assign(entry, { state: /本地链接/.test(error.message) ? 'conflict' : 'failed', error: error.message });
+          }
+        }
+      }
+      // 套餐语义独立于默认能力 auto_sync；sources 为空的纯台账项不补装。
+      const listing = await readSkills(owner.platform, owner.token, { signal: controller.signal });
+      if (!active(currentGeneration)) return;
+      if (listing.enabled === false || document.skills_enabled === false) return;
+      if (!Array.isArray(listing.skills)) throw new Error('平台技能清单格式异常');
+      for (const item of listing.skills) {
+        if (!active(currentGeneration)) return;
+        const sources = Array.isArray(item.sources) ? item.sources
+          : item.source === 'plan' ? ['plan'] : [];
+        if (!sources.includes('plan') && !sources.includes('builtin')) continue;
+        const selectedItem = !selected || (selected.kind === 'skill' && selected.name === item.canonical_slug);
+        let entry = { kind: 'skill', name: item.canonical_slug, sources,
+          description: document.skills.find((skill) => skill.canonical_slug === item.canonical_slug)?.description || '', state: 'pending' };
+        state.skills.push(entry);
+        try {
+          const local = await localSkillState(owner.platform, item.canonical_slug, options);
+          if (!active(currentGeneration)) return;
+          Object.assign(entry, { state: local.state, version: local.record?.version || null });
+          if (local.state === 'conflict' && (options.missingOnly || !selectedItem)) { entry.error = '本机技能已有用户内容或来源不一致，请确认后手动应用'; continue; }
+          if (local.state === 'current' && (!item.latest_version || !item.latest_fingerprint) && options.missingOnly) {
+            entry.state = 'failed'; entry.error = '暂时无法确认技能最新版本，请稍后重试'; continue;
+          }
+          if (local.record && ['current', 'report_pending'].includes(local.state) && (options.missingOnly || !selectedItem)
+            && item.latest_version && item.latest_fingerprint
+            && (local.record.fingerprint !== item.latest_fingerprint || local.record.version !== item.latest_version)) {
+            entry.target_version = item.latest_version;
+            if ((!enabled && !sources.includes('plan')) || !selectedItem) { entry.state = 'pending'; continue; }
+          }
+          if ((!enabled && !sources.includes('plan')) || !selectedItem) continue;
+          entry.state = 'running';
+          const installed = await installSkill(owner.platform, owner.token, item.canonical_slug,
+            { ...options, updateLatest: true, latestVersion: item.latest_version, latestFingerprint: item.latest_fingerprint,
+              source: sources.includes('plan') ? 'plan' : 'builtin' });
+          if (!active(currentGeneration)) return;
+          Object.assign(entry, installed);
+        } catch (error) {
+          if (!active(currentGeneration)) return;
+          Object.assign(entry, { state: 'failed', error: error.message });
+        }
+      }
+    } catch (error) {
+      if (active(currentGeneration)) {
+        if (error.status === 401 || error.status === 403) {
+          profiles.setPolicy([]);
+          state = { source: null, revision: null, checked_at: null, user_id: null,
+            skills: [], plugins: [], running: true };
+        }
+        state.error = error.message; log?.warn(`[dsh-agentone] defaults sync: ${error.message}`);
+      }
+    } finally {
+      if (active(currentGeneration)) { state.running = false; abort = null; schedule(); }
+    }
+    return structuredClone(state);
+  }
+  function sync({ manual = false, item = null } = {}) {
+    if (disposed) return Promise.resolve(structuredClone(state));
+    if (inFlight) {
+      if (flightGeneration === generation && !item) return inFlight;
+      const queuedGeneration = generation;
+      return inFlight.then(() => active(queuedGeneration) ? sync({ manual, item }) : structuredClone(state));
+    }
+    const promise = run(manual, item);
+    flightGeneration = generation;
+    inFlight = promise;
+    promise.finally(() => { if (inFlight === promise) inFlight = null; }).catch(() => {});
+    return promise;
+  }
+  function manualOperation(operation) {
+    const controller = new AbortController();
+    const currentGeneration = generation;
+    const promise = (async () => {
+      const owner = await context(controller);
+      const result = owner.verifiedConfig || await readConfig(owner.platform, owner.token, owner.userId, controller.signal);
+      const beforeCommit = async () => {
+        const freshOwner = await context(controller);
+        if (!active(currentGeneration) || freshOwner.userId !== owner.userId || freshOwner.platform !== owner.platform
+          || freshOwner.home !== owner.home || freshOwner.profile !== owner.profile) throw new Error('登录身份或当前 profile 已改变，请重新操作');
+        const fresh = freshOwner.verifiedConfig || await readConfig(owner.platform, freshOwner.token, freshOwner.userId, controller.signal);
+        if (JSON.stringify(fresh.document) !== JSON.stringify(result.document)) throw new Error('平台清单已更新，请重新检查后操作');
+      };
+      await beforeCommit();
+      profiles.setPolicy(result.document.plugins);
+      return operation(owner, { document: result.document, config: { ...config, dshHome: owner.home }, userId: owner.userId,
+        registry: result.document.skill_registry, signal: controller.signal, beforeCommit,
+        isCurrent: () => active(currentGeneration) });
+    })();
+    manualOperations.set(promise, controller);
+    promise.finally(() => manualOperations.delete(promise)).catch(() => {});
+    return promise;
+  }
+  return { sync, manualOperation, snapshot: () => structuredClone(state),
+    reset() { stop(); profiles.setPolicy([]); state = { source: null, revision: null,
+      checked_at: null, user_id: null, error: null, running: false, skills: [], plugins: [] }; },
+    dispose() { disposed = true; stop(); return Promise.allSettled([inFlight, ...manualOperations.keys()]); },
+  };
+}

package/lib/http.js

@@ -20,7 +20,8 @@ export class PlatformError extends Error {
  */
 export async function platformError(response, fallbackMessage) {
   const data = await response.json().catch(() => ({}));
-  return new PlatformError(data?.detail || data?.error?.message || fallbackMessage, {
+  const message = data?.detail || data?.error?.message;
+  return new PlatformError(typeof message === 'string' && /[\u3400-\u9fff]/.test(message) ? message : fallbackMessage, {
     status: response.status,
     code: data?.error?.code || data?.code || null,
   });
@@ -30,12 +31,14 @@ export async function platformError(response, fallbackMessage) {
 export async function platformFetch(url, options = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
   let response;
   try {
-    response = await fetch(url, { ...options, signal: AbortSignal.timeout(timeoutMs) });
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    response = await fetch(url, { ...options, signal });
   } catch (error) {
     if (error?.name === 'TimeoutError' || error?.name === 'AbortError') {
       throw new PlatformError('连接 AgentOne 平台超时，请稍后重试');
     }
-    throw error;
+    throw new PlatformError('无法连接 AgentOne 平台，请检查平台地址和网络后重试');
   }
   return response;
 }