dsh-agentone 0.5.38 → 0.5.39

package/README.md

@@ -14,8 +14,8 @@ lark-cli / ccpg-cli 状态探测。
   OpenAI 兼容代理（`/api/plugin/v1`），模型密钥不下发到本机；对话经平台
   走 TokenHub 按用户计量。平台 403 的 `plan_required` 错误码原样透传，
   前端据此引导申请套餐（不依赖中文文案匹配）。
-- **SkillHub 技能（M3）**：套餐技能自动装齐（启动/登录时，且常驻期间
-  套餐生效、套餐新配技能时由前端触发器与手动「同步套餐技能」按钮补装）；
+- **SkillHub 技能（M3）**：套餐技能与管理员默认技能在启动/登录和常驻后台同步，
+  支持 `611/c611-ops-workbench`、`611--c611-ops-workbench` 与全局技能名；
   技能市场搜索、手动安装/卸载，装/卸载后技能列表即时刷新（失效 45s
   status 缓存）；已装技能平台侧对比 latest 版本/指纹，有更新时展示
   「v旧 → v新」并支持一键升级（覆盖式重装，原子替换旧目录）；技能包
@@ -27,11 +27,17 @@ lark-cli / ccpg-cli 状态探测。
   登出时全部清理。会话内使用：`source $DSH_HOME/agentone/skillhub.env`。
 - **套餐申请（M3+）**：状态页「套餐」tab 展示当前套餐/审批中/可申请列表，
   一键提交申请；审批通过后前端轮询检测到 active 自动同步模型。
-- **dsh 插件管理（M3+）**：列出镜像内置与用户自装插件（版本/升级/激活态），
-  内置插件缺失时启动自动重装（自身也在常驻保证清单内，防误删导致平台集成
-  失效）；desktop 受管 pnpm 通道操作串行排队，宿主并发锁占用时自动退避
-  重试（不把「another desktop pnpm operation is already running」抛给用户）；
-  自身随平台镜像升级（列表中不提供按钮）。
+- **平台默认能力（#479）**：管理员在「集成开关 → dsh 插件」单独保存默认
+  技能、npm 插件、用途说明和安装期构建授权。技能和插件始终安装最新发布版本，
+  受管内容有新版时自动升级；客户端启动、登录及约每 5 分钟后台检查。
+  本机状态由目录、版本和归属记录共同确认，用户级台账作为参考。
+  目录已有用户文件、账号/registry 不同时等待用户确认应用；停用只停止管理，
+  不删除本机内容。平台暂时不可用时缓存仅展示，不用于安装。
+- **dsh 插件管理（M3+）**：列出当前 profile 的包、版本、bundle 注册状态；
+  安装成功需物理版本、插件声明和 profile 注册同时成立。注册不证明运行时加载，
+  页面提示重启生效。Web 必须配置实际 `profileName`，Desktop 使用宿主当前 profile
+  和受管 pnpm 通道；安装/卸载串行排队、支持生命周期取消。自身与 DSH 基础组件
+  不属于平台默认清单，自身只在独立安装模式允许手动升级。
 - **CLI 探测、安装与授权（M4）**：`lark-cli` / `ccpg-cli` 安装与授权态三态探测；
   未安装时「安装」一键自助安装（lark 走 `npm install -g @larksuite/cli@latest`，
   ccpg 走公司 `auto-install.sh`，口径与平台 cli-deployd 一致）；
@@ -107,6 +113,7 @@ dsh plugin --profile web add dsh-agentone
 | --- | --- | --- |
 | `platformUrl` | `https://ccpg.one.agentone.work` | AgentOne 平台地址（本地开发用 profile `cordis.patch.yml` 覆盖为 `http://127.0.0.1:8558`） |
 | `storeDir` | `$DSH_HOME/agentone` | 凭据目录 |
+| `profileName` | 空 | Web 模式填写实际启动 profile（例如 web 或自定义名）；无法确定时暂停插件写入。Desktop 自动读取当前 profile |
 
 密钥类值一律不进 settings，仅落 `credentials.json`（0600）。
 

package/lib/defaults-sync.js

@@ -0,0 +1,257 @@
+// apply 范围内的默认能力协调器：后台检查、single-flight、身份隔离和可取消生命周期。
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { platformError, platformFetch } from './http.js';
+import { fetchPlatformConfig, validatePlatformConfig } from './platform-config.js';
+import { installPlatformSkill, listPlatformSkills } from './skill.js';
+import { localSkillState } from './skill-state.js';
+import { resolveDshHome } from './store.js';
+
+export function createDefaultsSync({ config, profiles, credentials, log, intervalMs = 300_000,
+  readConfig = fetchPlatformConfig, readSkills = listPlatformSkills, installSkill = installPlatformSkill,
+  now = () => new Date().toISOString(), setTimer = setTimeout, clearTimer = clearTimeout }) {
+  let disposed = false;
+  let generation = 0;
+  let inFlight = null;
+  let flightGeneration = null;
+  let timer = null;
+  let abort = null;
+  const manualOperations = new Map();
+  let state = { source: null, revision: null, checked_at: null, user_id: null, error: null,
+    running: false, skills: [], plugins: [] };
+  const active = (value) => !disposed && generation === value;
+  function stop() {
+    generation += 1; abort?.abort(); abort = null;
+    for (const controller of manualOperations.values()) controller.abort();
+    if (timer !== null) clearTimer(timer);
+    timer = null;
+  }
+  function schedule() {
+    if (disposed || timer !== null) return;
+    timer = setTimer(() => { timer = null; void sync().catch(() => {}); }, intervalMs + Math.floor(Math.random() * intervalMs * 0.1));
+    timer?.unref?.();
+  }
+  async function context(controller) {
+    const current = await credentials();
+    if (!current?.access_token) throw new Error('请先登录 AgentOne 平台');
+    const platform = (current.platform_url || config.platformUrl).replace(/\/+$/, '');
+    // 实例凭据仅能访问 plugin API；旧后端缺少身份字段时暂停新同步。
+    const instance = current.source === 'instance';
+    const response = await platformFetch(`${platform}${instance ? '/api/plugin/v1/config' : '/api/me'}`, {
+      signal: controller.signal, headers: { Authorization: `Bearer ${current.access_token}` },
+    });
+    if (!response.ok) throw await platformError(response, '登录身份暂时无法确认，请重新登录');
+    const identity = await response.json();
+    const userId = instance ? identity.user_id : identity.id;
+    if (typeof userId !== 'string' || !userId) throw new Error('平台未返回有效身份，请检查平台地址');
+    const verifiedConfig = instance ? { document: validatePlatformConfig(identity, userId), source: 'platform' } : null;
+    let target = null;
+    let profileError = null;
+    try { target = profiles.target(); } catch (error) { profileError = error.message; }
+    const home = resolve(target?.home || config.dshHome || resolveDshHome());
+    return { platform, token: current.access_token, userId, verifiedConfig, home,
+      profile: target?.name || 'unknown', profileDir: target?.dir || null, profileError };
+  }
+  function cachePath(owner) {
+    const hash = createHash('sha256').update(JSON.stringify([owner.platform, owner.userId, owner.home, owner.profile])).digest('hex');
+    return join(owner.home, 'agentone', 'defaults-state', `${hash}.json`);
+  }
+  async function writeCache(owner, document, source) {
+    const file = cachePath(owner); await mkdir(join(file, '..'), { recursive: true, mode: 0o700 });
+    const temp = `${file}.${randomUUID()}.tmp`;
+    await writeFile(temp, JSON.stringify({ document, source, checked_at: state.checked_at }) + '\n', { mode: 0o600 });
+    await rename(temp, file);
+  }
+  async function readCache(owner) {
+    try {
+      const cached = JSON.parse(await readFile(cachePath(owner), 'utf8'));
+      return { ...cached, document: validatePlatformConfig(cached.document, owner.userId) };
+    } catch { return null; }
+  }
+  async function run(manual, selected) {
+    const currentGeneration = generation;
+    const controller = new AbortController(); abort = controller;
+    state = { ...state, running: true, error: null };
+    let owner;
+    try {
+      owner = await context(controller);
+      if (!active(currentGeneration)) return;
+      if (state.user_id !== owner.userId || state.platform !== owner.platform || state.profile !== owner.profile) {
+        profiles.setPolicy([]);
+        state = { source: null, revision: null, checked_at: null,
+          user_id: owner.userId, platform: owner.platform, profile: owner.profile,
+          error: null, running: true, skills: [], plugins: [] };
+      }
+      let result;
+      try { result = owner.verifiedConfig || await readConfig(owner.platform, owner.token, owner.userId, controller.signal); }
+      catch (error) {
+        if (error.status !== 401 && error.status !== 403) {
+          const cached = await readCache(owner);
+          if (cached && active(currentGeneration)) {
+            const local = owner.profileError ? { plugins: [] } : await profiles.list();
+            state = { ...state, source: 'cache', revision: cached.document.revision,
+              checked_at: cached.checked_at, user_id: owner.userId, home: owner.home,
+              registry: cached.document.skill_registry, auto_sync: cached.document.auto_sync,
+              plugins: cached.document.plugins.map((item) => ({ kind: 'plugin', name: item.name,
+                description: item.description, target_version: item.version,
+                version: local.plugins.find((entry) => entry.name === item.name)?.version || null,
+                state: 'pending', error: '平台暂时不可用，此项为缓存参考' })),
+              skills: await Promise.all(cached.document.skills.map(async (item) => {
+                const local = await localSkillState(owner.platform, item.canonical_slug, {
+                  config: { ...config, dshHome: owner.home }, userId: owner.userId, registry: cached.document.skill_registry });
+                return { kind: 'skill', name: item.canonical_slug, description: item.description,
+                  state: local.state, version: local.record?.version || null, sources: ['builtin'] };
+              })) };
+          }
+        } else {
+          profiles.setPolicy([]);
+          state = { source: null, revision: null, checked_at: null, user_id: null,
+            error: null, running: true, skills: [], plugins: [] };
+        }
+        // 缓存只展示；本轮失败不进行任何新安装。
+        throw error;
+      }
+      if (!active(currentGeneration)) return;
+      const document = result.document;
+      profiles.setPolicy(document.plugins);
+      state = { ...state, source: result.source, revision: document.revision, user_id: owner.userId,
+        checked_at: now(), profile: owner.profile, home: owner.home, registry: document.skill_registry,
+        auto_sync: document.auto_sync, profile_error: owner.profileError, skills: [], plugins: [] };
+      await writeCache(owner, document, result.source);
+      const beforeCommit = async () => {
+        const identity = await context(controller);
+        if (!active(currentGeneration) || identity.userId !== owner.userId || identity.platform !== owner.platform
+          || identity.home !== owner.home || identity.profile !== owner.profile) throw new Error('登录身份或当前 profile 已改变，请重新同步');
+        const fresh = identity.verifiedConfig || await readConfig(owner.platform, owner.token, owner.userId, controller.signal);
+        if (JSON.stringify(fresh.document) !== JSON.stringify(document)) throw new Error('平台清单已更新，请重新检查后应用');
+      };
+      const options = { config: { ...config, dshHome: owner.home }, userId: owner.userId,
+        registry: document.skill_registry, signal: controller.signal, beforeCommit,
+        isCurrent: () => active(currentGeneration), missingOnly: !(selected && selected.apply) };
+      const enabled = manual || document.auto_sync;
+      if (!owner.profileError) {
+        const local = await profiles.list();
+        for (const item of document.plugins) {
+          if (!active(currentGeneration)) return;
+          const selectedItem = !selected || (selected.kind === 'plugin' && selected.name === item.name);
+          const installed = local.plugins.find((entry) => entry.name === item.name);
+          let entry = { kind: 'plugin', name: item.name, description: item.description,
+            target_version: item.version, version: installed?.version || null, loaded: null,
+            state: installed?.registered ? (item.version !== 'latest' && installed.version !== item.version ? 'pending' : 'current') : 'pending' };
+          state.plugins.push(entry);
+          if (!enabled && !installed?.registered) continue;
+          try {
+            const exact = await profiles.resolveVersion?.(item.name, 'latest') || 'latest';
+            entry.target_version = exact;
+            if (installed?.registered && installed.version !== exact && (!enabled || !selectedItem)) {
+              entry.state = 'pending';
+              continue;
+            }
+            if (!enabled || !selectedItem) continue;
+            entry.state = 'running';
+            const after = await profiles.install(item.name, exact, { ...options, updateLatest: true, allowBuild: item.allow_build });
+            if (!active(currentGeneration)) return;
+            Object.assign(entry, { version: after.version, state: after.state, registered: after.registered, loaded: null });
+          } catch (error) {
+            if (!active(currentGeneration)) return;
+            Object.assign(entry, { state: /本地链接/.test(error.message) ? 'conflict' : 'failed', error: error.message });
+          }
+        }
+      }
+      // 套餐语义独立于默认能力 auto_sync；sources 为空的纯台账项不补装。
+      const listing = await readSkills(owner.platform, owner.token, { signal: controller.signal });
+      if (!active(currentGeneration)) return;
+      if (listing.enabled === false || document.skills_enabled === false) return;
+      if (!Array.isArray(listing.skills)) throw new Error('平台技能清单格式异常');
+      for (const item of listing.skills) {
+        if (!active(currentGeneration)) return;
+        const sources = Array.isArray(item.sources) ? item.sources
+          : item.source === 'plan' ? ['plan'] : [];
+        if (!sources.includes('plan') && !sources.includes('builtin')) continue;
+        const selectedItem = !selected || (selected.kind === 'skill' && selected.name === item.canonical_slug);
+        let entry = { kind: 'skill', name: item.canonical_slug, sources,
+          description: document.skills.find((skill) => skill.canonical_slug === item.canonical_slug)?.description || '', state: 'pending' };
+        state.skills.push(entry);
+        try {
+          const local = await localSkillState(owner.platform, item.canonical_slug, options);
+          if (!active(currentGeneration)) return;
+          Object.assign(entry, { state: local.state, version: local.record?.version || null });
+          if (local.state === 'conflict' && (options.missingOnly || !selectedItem)) { entry.error = '本机技能已有用户内容或来源不一致，请确认后手动应用'; continue; }
+          if (local.state === 'current' && (!item.latest_version || !item.latest_fingerprint) && options.missingOnly) {
+            entry.state = 'failed'; entry.error = '暂时无法确认技能最新版本，请稍后重试'; continue;
+          }
+          if (local.record && ['current', 'report_pending'].includes(local.state) && (options.missingOnly || !selectedItem)
+            && item.latest_version && item.latest_fingerprint
+            && (local.record.fingerprint !== item.latest_fingerprint || local.record.version !== item.latest_version)) {
+            entry.target_version = item.latest_version;
+            if ((!enabled && !sources.includes('plan')) || !selectedItem) { entry.state = 'pending'; continue; }
+          }
+          if ((!enabled && !sources.includes('plan')) || !selectedItem) continue;
+          entry.state = 'running';
+          const installed = await installSkill(owner.platform, owner.token, item.canonical_slug,
+            { ...options, updateLatest: true, latestVersion: item.latest_version, latestFingerprint: item.latest_fingerprint,
+              source: sources.includes('plan') ? 'plan' : 'builtin' });
+          if (!active(currentGeneration)) return;
+          Object.assign(entry, installed);
+        } catch (error) {
+          if (!active(currentGeneration)) return;
+          Object.assign(entry, { state: 'failed', error: error.message });
+        }
+      }
+    } catch (error) {
+      if (active(currentGeneration)) {
+        if (error.status === 401 || error.status === 403) {
+          profiles.setPolicy([]);
+          state = { source: null, revision: null, checked_at: null, user_id: null,
+            skills: [], plugins: [], running: true };
+        }
+        state.error = error.message; log?.warn(`[dsh-agentone] defaults sync: ${error.message}`);
+      }
+    } finally {
+      if (active(currentGeneration)) { state.running = false; abort = null; schedule(); }
+    }
+    return structuredClone(state);
+  }
+  function sync({ manual = false, item = null } = {}) {
+    if (disposed) return Promise.resolve(structuredClone(state));
+    if (inFlight) {
+      if (flightGeneration === generation && !item) return inFlight;
+      const queuedGeneration = generation;
+      return inFlight.then(() => active(queuedGeneration) ? sync({ manual, item }) : structuredClone(state));
+    }
+    const promise = run(manual, item);
+    flightGeneration = generation;
+    inFlight = promise;
+    promise.finally(() => { if (inFlight === promise) inFlight = null; }).catch(() => {});
+    return promise;
+  }
+  function manualOperation(operation) {
+    const controller = new AbortController();
+    const currentGeneration = generation;
+    const promise = (async () => {
+      const owner = await context(controller);
+      const result = owner.verifiedConfig || await readConfig(owner.platform, owner.token, owner.userId, controller.signal);
+      const beforeCommit = async () => {
+        const freshOwner = await context(controller);
+        if (!active(currentGeneration) || freshOwner.userId !== owner.userId || freshOwner.platform !== owner.platform
+          || freshOwner.home !== owner.home || freshOwner.profile !== owner.profile) throw new Error('登录身份或当前 profile 已改变，请重新操作');
+        const fresh = freshOwner.verifiedConfig || await readConfig(owner.platform, freshOwner.token, freshOwner.userId, controller.signal);
+        if (JSON.stringify(fresh.document) !== JSON.stringify(result.document)) throw new Error('平台清单已更新，请重新检查后操作');
+      };
+      await beforeCommit();
+      profiles.setPolicy(result.document.plugins);
+      return operation(owner, { document: result.document, config: { ...config, dshHome: owner.home }, userId: owner.userId,
+        registry: result.document.skill_registry, signal: controller.signal, beforeCommit,
+        isCurrent: () => active(currentGeneration) });
+    })();
+    manualOperations.set(promise, controller);
+    promise.finally(() => manualOperations.delete(promise)).catch(() => {});
+    return promise;
+  }
+  return { sync, manualOperation, snapshot: () => structuredClone(state),
+    reset() { stop(); profiles.setPolicy([]); state = { source: null, revision: null,
+      checked_at: null, user_id: null, error: null, running: false, skills: [], plugins: [] }; },
+    dispose() { disposed = true; stop(); return Promise.allSettled([inFlight, ...manualOperations.keys()]); },
+  };
+}

package/lib/http.js

@@ -20,7 +20,8 @@ export class PlatformError extends Error {
  */
 export async function platformError(response, fallbackMessage) {
   const data = await response.json().catch(() => ({}));
-  return new PlatformError(data?.detail || data?.error?.message || fallbackMessage, {
+  const message = data?.detail || data?.error?.message;
+  return new PlatformError(typeof message === 'string' && /[\u3400-\u9fff]/.test(message) ? message : fallbackMessage, {
     status: response.status,
     code: data?.error?.code || data?.code || null,
   });
@@ -30,12 +31,14 @@ export async function platformError(response, fallbackMessage) {
 export async function platformFetch(url, options = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
   let response;
   try {
-    response = await fetch(url, { ...options, signal: AbortSignal.timeout(timeoutMs) });
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    response = await fetch(url, { ...options, signal });
   } catch (error) {
     if (error?.name === 'TimeoutError' || error?.name === 'AbortError') {
       throw new PlatformError('连接 AgentOne 平台超时，请稍后重试');
     }
-    throw error;
+    throw new PlatformError('无法连接 AgentOne 平台，请检查平台地址和网络后重试');
   }
   return response;
 }