dsh-cloudq 0.1.0

package/lib/index.js

@@ -0,0 +1,910 @@
+import { createRequire } from "node:module";
+import { existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import Schema from "@deepseek-ai/schemastery";
+import { Buffer as Buffer$1 } from "node:buffer";
+import yaml from "js-yaml";
+import { spawn } from "node:child_process";
+//#region src/http.js
+/** Maximum accepted JSON request body size. */
+const MAX_JSON_BODY_BYTES = 65536;
+/** HTTP failure with a stable client-facing code. */
+var HttpError = class extends Error {
+	/**
+	* @param {number} statusCode HTTP status code.
+	* @param {string} code Stable machine-readable code.
+	* @param {string} message Safe client-facing message.
+	*/
+	constructor(statusCode, code, message) {
+		super(message);
+		this.name = "HttpError";
+		this.statusCode = statusCode;
+		this.code = code;
+	}
+};
+/** Return whether a request originated from the local machine. */
+function isLoopbackRequest(request) {
+	const address = request.socket?.remoteAddress;
+	return address === "::1" || address === "127.0.0.1" || address === "::ffff:127.0.0.1" || typeof address === "string" && /^::ffff:127\./.test(address);
+}
+/** Reject cross-site, non-loopback, or unexpected-method requests. */
+function assertSafeRequest(request, expectedMethod) {
+	if (!isLoopbackRequest(request)) throw new HttpError(403, "forbidden", "CloudQ is available only from the local DSH page.");
+	if ((request.method ?? "GET").toUpperCase() !== expectedMethod) throw new HttpError(405, "method-not-allowed", "The request method is not supported.");
+	const fetchSite = request.headers["sec-fetch-site"];
+	if (typeof fetchSite === "string" && fetchSite !== "same-origin" && fetchSite !== "same-site" && fetchSite !== "none") throw new HttpError(403, "forbidden-origin", "Cross-site requests are not allowed.");
+	const origin = request.headers.origin;
+	if (origin !== void 0) {
+		const host = request.headers.host;
+		if (host === void 0) throw new HttpError(403, "forbidden-origin", "The request origin is invalid.");
+		let originHost;
+		try {
+			originHost = new URL(origin).host.toLowerCase();
+		} catch {
+			throw new HttpError(403, "forbidden-origin", "The request origin is invalid.");
+		}
+		if (originHost !== host.toLowerCase()) throw new HttpError(403, "forbidden-origin", "Cross-site requests are not allowed.");
+	}
+}
+/** Send a JSON response with security and caching headers. */
+function sendJson(response, statusCode, body) {
+	response.statusCode = statusCode;
+	response.setHeader("Content-Type", "application/json; charset=utf-8");
+	response.setHeader("Cache-Control", "no-store");
+	response.setHeader("X-Content-Type-Options", "nosniff");
+	response.end(JSON.stringify(body));
+}
+/** Send only stable, client-safe error details. */
+function sendError(response, error) {
+	if (error instanceof HttpError) {
+		sendJson(response, error.statusCode, {
+			ok: false,
+			error: {
+				code: error.code,
+				message: error.message
+			}
+		});
+		return;
+	}
+	sendJson(response, 500, {
+		ok: false,
+		error: {
+			code: "internal",
+			message: "The CloudQ request failed."
+		}
+	});
+}
+function contentLength(request) {
+	const value = request.headers["content-length"];
+	const raw = Array.isArray(value) ? value[0] : value;
+	if (raw === void 0) return void 0;
+	if (!/^\d+$/.test(raw)) throw new HttpError(400, "invalid-content-length", "The Content-Length header is invalid.");
+	const length = Number(raw);
+	if (!Number.isSafeInteger(length)) throw new HttpError(400, "invalid-content-length", "The Content-Length header is invalid.");
+	return length;
+}
+/** Read and parse a bounded application/json request body. */
+function readJsonBody(request, { maxBytes = MAX_JSON_BODY_BYTES } = {}) {
+	const contentType = request.headers["content-type"];
+	if (typeof contentType !== "string" || contentType.split(";", 1)[0].trim().toLowerCase() !== "application/json") {
+		request.resume?.();
+		return Promise.reject(new HttpError(415, "unsupported-media-type", "Content-Type must be application/json."));
+	}
+	let declaredLength;
+	try {
+		declaredLength = contentLength(request);
+	} catch (error) {
+		request.resume?.();
+		return Promise.reject(error);
+	}
+	if (declaredLength !== void 0 && declaredLength > maxBytes) {
+		request.resume?.();
+		return Promise.reject(new HttpError(413, "payload-too-large", "The JSON request body is too large."));
+	}
+	return new Promise((resolveBody, rejectBody) => {
+		const chunks = [];
+		let bytes = 0;
+		let settled = false;
+		const rejectOnce = (error) => {
+			if (settled) return;
+			settled = true;
+			chunks.length = 0;
+			rejectBody(error);
+		};
+		request.on("data", (chunk) => {
+			if (settled) return;
+			const buffer = Buffer$1.isBuffer(chunk) ? chunk : Buffer$1.from(chunk);
+			bytes += buffer.byteLength;
+			if (bytes > maxBytes) {
+				rejectOnce(new HttpError(413, "payload-too-large", "The JSON request body is too large."));
+				return;
+			}
+			chunks.push(buffer);
+		});
+		request.on("end", () => {
+			if (settled) return;
+			settled = true;
+			if (chunks.length === 0) {
+				rejectBody(new HttpError(400, "invalid-json", "The request body must contain JSON."));
+				return;
+			}
+			try {
+				resolveBody(JSON.parse(Buffer$1.concat(chunks).toString("utf8")));
+			} catch {
+				rejectBody(new HttpError(400, "invalid-json", "The request body is not valid JSON."));
+			}
+		});
+		request.on("aborted", () => {
+			rejectOnce(new HttpError(400, "request-aborted", "The request body was interrupted."));
+		});
+		request.on("error", () => {
+			rejectOnce(new HttpError(400, "request-read-failed", "The request body could not be read."));
+		});
+	});
+}
+//#endregion
+//#region src/plugin-manager.js
+/** Host-side management of optional profile bundle entries. */
+const PROTECTED_BUNDLES = /* @__PURE__ */ new Set(["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"]);
+function profileDirectory(baseUrl) {
+	const url = new URL(".", baseUrl);
+	if (url.protocol !== "file:") throw new Error("The active DSH profile URL must use the file protocol.");
+	return fileURLToPath(url);
+}
+function patchPath(baseUrl) {
+	return resolve(profileDirectory(baseUrl), "cordis.patch.yml");
+}
+function parsePatchList(content) {
+	if (!content.trim()) return [];
+	const parsed = yaml.load(content);
+	if (parsed === null || parsed === void 0) return [];
+	if (!Array.isArray(parsed)) throw new Error("The DSH profile patch must contain a top-level array.");
+	return parsed;
+}
+function leadingComments(content) {
+	return (content.match(/^(#[^\n]*\n)+/) ?? [""])[0];
+}
+function serializePatchList(entries, originalContent) {
+	return `${leadingComments(originalContent)}${yaml.dump(entries, {
+		noRefs: true,
+		lineWidth: 120
+	})}`;
+}
+function packageDirectory(profileDir, packageName) {
+	const anchor = join(profileDir, "package.json");
+	for (const searchPath of createRequire(anchor).resolve.paths(packageName) ?? []) {
+		const candidate = join(searchPath, packageName);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+	}
+}
+function bundleInsertRows(profileDir, packageName) {
+	const packageDir = packageDirectory(profileDir, packageName);
+	if (packageDir === void 0) return [];
+	const declaredPatch = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"))?.dsh?.bundle?.patch;
+	if (typeof declaredPatch !== "string" || !declaredPatch) return [];
+	const bundlePatchPath = join(packageDir, declaredPatch);
+	if (!existsSync(bundlePatchPath)) return [];
+	const rows = [];
+	for (const block of parsePatchList(readFileSync(bundlePatchPath, "utf8"))) if (block && typeof block === "object" && Array.isArray(block.insert)) rows.push(...block.insert);
+	return rows;
+}
+function readProfileBundles(profileDir) {
+	const bundles = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8"))?.dsh?.profile?.bundles;
+	return Array.isArray(bundles) ? bundles.filter((bundle) => typeof bundle === "string") : [];
+}
+function fileSnapshot(path) {
+	if (!existsSync(path)) return void 0;
+	const stat = statSync(path);
+	return {
+		size: stat.size,
+		mtimeMs: stat.mtimeMs,
+		mode: stat.mode
+	};
+}
+function sameSnapshot(left, right) {
+	if (left === void 0 || right === void 0) return left === right;
+	return left.size === right.size && left.mtimeMs === right.mtimeMs;
+}
+function writePatchAtomically(path, content, originalSnapshot) {
+	const temporary = join(dirname(path), `.${process.pid}.${Date.now()}.dsh-cloudq.tmp`);
+	try {
+		writeFileSync(temporary, content, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: originalSnapshot?.mode ?? 384
+		});
+		if (!sameSnapshot(originalSnapshot, fileSnapshot(path))) throw new Error("The DSH profile patch changed while it was being updated. Retry the operation.");
+		renameSync(temporary, path);
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+}
+/**
+* List third-party bundle entries mounted by the active profile.
+* @param {string | URL} baseUrl Loader base URL from `ctx.baseUrl`.
+* @returns {Array<{id: string, name: string, bundle: string, disabled: boolean, self: boolean}>}
+*/
+function listPlugins(baseUrl) {
+	const profileDir = profileDirectory(baseUrl);
+	const userPatchPath = patchPath(baseUrl);
+	const overrides = (existsSync(userPatchPath) ? parsePatchList(readFileSync(userPatchPath, "utf8")) : []).filter((entry) => entry && typeof entry === "object" && typeof entry.id === "string");
+	const plugins = [];
+	for (const bundle of readProfileBundles(profileDir)) {
+		if (PROTECTED_BUNDLES.has(bundle)) continue;
+		for (const row of bundleInsertRows(profileDir, bundle)) {
+			if (!row || typeof row !== "object" || typeof row.id !== "string") continue;
+			const override = overrides.find((entry) => entry.id === row.id);
+			plugins.push({
+				id: row.id,
+				name: typeof row.name === "string" ? row.name : row.id,
+				bundle,
+				disabled: override?.disabled === true,
+				self: bundle === "dsh-cloudq"
+			});
+		}
+	}
+	return plugins;
+}
+/**
+* Atomically update one mounted plugin's disabled override.
+* @param {string | URL} baseUrl Loader base URL from `ctx.baseUrl`.
+* @param {string} id Mounted plugin entry id.
+* @param {boolean} disabled Desired disabled state.
+* @returns {{ok: true, id: string, disabled: boolean}}
+*/
+function setPluginDisabled(baseUrl, id, disabled) {
+	const userPatchPath = patchPath(baseUrl);
+	if (!listPlugins(baseUrl).some((plugin) => plugin.id === id)) {
+		const error = /* @__PURE__ */ new Error(`Unknown plugin entry: ${id}`);
+		error.code = "unknown-plugin";
+		throw error;
+	}
+	const originalSnapshot = fileSnapshot(userPatchPath);
+	const original = originalSnapshot === void 0 ? "" : readFileSync(userPatchPath, "utf8");
+	let patches = parsePatchList(original);
+	const target = patches.find((entry) => entry && typeof entry === "object" && entry.id === id);
+	if (target) {
+		if (disabled) target.disabled = true;
+		else {
+			delete target.disabled;
+			if (Object.keys(target).length === 1) patches = patches.filter((entry) => entry !== target);
+		}
+	} else if (disabled) patches.push({
+		id,
+		disabled: true
+	});
+	else return {
+		ok: true,
+		id,
+		disabled: false
+	};
+	writePatchAtomically(userPatchPath, serializePatchList(patches, original), originalSnapshot);
+	return {
+		ok: true,
+		id,
+		disabled
+	};
+}
+//#endregion
+//#region src/script-runner.js
+const MAX_SCRIPT_OUTPUT_BYTES = 1048576;
+function safeCode(value) {
+	return typeof value === "string" && /^[a-zA-Z0-9._-]{1,80}$/.test(value) ? value : "script-failed";
+}
+function redact(value, sensitiveValues) {
+	let text = String(value ?? "");
+	for (const sensitive of sensitiveValues) if (sensitive) text = text.replaceAll(sensitive, "[redacted]");
+	return text.replace(/[\r\n\t]+/g, " ").slice(0, 300);
+}
+/**
+* Run one bundled Python helper with bounded output and optional stdin.
+* @param {string} scriptsDirectory Absolute scripts directory.
+* @param {string} scriptName Bundled script filename.
+* @param {string[]} args Non-sensitive command-line arguments.
+* @param {object} options Execution options.
+* @returns {Promise<Record<string, unknown>>} Parsed helper response.
+*/
+function runScript$1(scriptsDirectory, scriptName, args, { timeoutMs = 3e4, jsonOnly = true, stdin, sensitiveValues = [], spawnProcess = spawn } = {}) {
+	return new Promise((resolveRun, rejectRun) => {
+		const child = spawnProcess("python3", [resolve(scriptsDirectory, scriptName), ...args], {
+			stdio: [
+				stdin === void 0 ? "ignore" : "pipe",
+				"pipe",
+				"pipe"
+			],
+			timeout: timeoutMs
+		});
+		let stdout = "";
+		let stderr = "";
+		let outputBytes = 0;
+		let settled = false;
+		const rejectOnce = (error) => {
+			if (settled) return;
+			settled = true;
+			rejectRun(error);
+		};
+		const resolveOnce = (value) => {
+			if (settled) return;
+			settled = true;
+			resolveRun(value);
+		};
+		const collect = (current, chunk) => {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			outputBytes += buffer.byteLength;
+			if (outputBytes > MAX_SCRIPT_OUTPUT_BYTES) {
+				child.kill();
+				rejectOnce(new HttpError(502, "script-output-too-large", "The CloudQ helper returned too much data."));
+				return current;
+			}
+			return current + buffer.toString("utf8");
+		};
+		child.stdout.on("data", (chunk) => {
+			stdout = collect(stdout, chunk);
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr = collect(stderr, chunk);
+		});
+		child.on("error", () => {
+			rejectOnce(new HttpError(502, "script-launch-failed", "The CloudQ helper could not be started."));
+		});
+		child.on("close", (code) => {
+			if (settled) return;
+			const trimmed = stdout.trim();
+			if (!jsonOnly) {
+				if (code !== 0) rejectOnce(new HttpError(502, "script-failed", "The CloudQ helper failed."));
+				else resolveOnce({
+					success: true,
+					message: redact(trimmed, sensitiveValues)
+				});
+				return;
+			}
+			let parsed;
+			try {
+				parsed = trimmed ? JSON.parse(trimmed) : {};
+			} catch {
+				rejectOnce(new HttpError(502, "script-invalid-output", "The CloudQ helper returned an invalid response."));
+				return;
+			}
+			if (code !== 0 || parsed?.ok === false || parsed?.success === false) {
+				const codeValue = safeCode(parsed?.error?.code ?? parsed?.code);
+				rejectOnce(new HttpError(502, codeValue, "The CloudQ helper failed."));
+				return;
+			}
+			resolveOnce(parsed);
+		});
+		if (stdin !== void 0) {
+			child.stdin.on("error", () => {
+				rejectOnce(new HttpError(502, "script-input-failed", "The CloudQ helper could not receive its input."));
+			});
+			child.stdin.end(stdin);
+		}
+	});
+}
+//#endregion
+//#region src/index.js
+/**
+* dsh-cloudq host half.
+*
+* Registers the CloudQ skill (a multi-cloud AIOps expert driven by the Tencent
+* Cloud SSE conversation API) so that entering "CloudQ mode" routes the model
+* through the bundled skill. The skill body is shipped under `skills/cloudq/`
+* and referenced through a directory `resourceBase`, so every `{baseDir}`
+* placeholder in the body resolves against the installed package directory.
+*
+* It also exposes a small credential-management API (status / authorize-url /
+* save-code / logout) that the client half renders in the settings panel, so
+* the CloudQ login flow no longer requires touching a terminal.
+*
+* @module dsh-cloudq
+*/
+const LOGO_PATH = resolve(dirname(fileURLToPath(import.meta.url)), "../assets/cloudq.png");
+const LOGO_BUFFER = readFileSync(LOGO_PATH);
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/** Installed skill directory (SKILL.md + scripts/ + references/). */
+function skillDirectory() {
+	return resolve(__dirname, "../skills/cloudq");
+}
+/** Raw SKILL.md body. */
+function rawSkillContent() {
+	return readFileSync(resolve(skillDirectory(), "SKILL.md"), "utf8");
+}
+/**
+* Render the skill body with `{baseDir}` substituted by the installed skill
+* directory. The model then runs `python3 <absolute path>/scripts/...`
+* directly, without having to infer the base directory from the rendered
+* `<skill_resources>` block.
+*/
+function renderedSkillContent() {
+	const baseDir = skillDirectory();
+	return rawSkillContent().replace(/\{baseDir\}/g, baseDir);
+}
+/** Run one helper from the bundled CloudQ skill. */
+function runScript(scriptName, args, options) {
+	return runScript$1(resolve(skillDirectory(), "scripts"), scriptName, args, options);
+}
+/** Remove host filesystem details before returning credential state to the browser. */
+function publicCredentialStatus(status) {
+	if (!status || typeof status !== "object" || Array.isArray(status)) return status;
+	const safeStatus = { ...status };
+	delete safeStatus.credential_file;
+	return safeStatus;
+}
+/** Wrap runScript so failures keep a stable envelope for the client. */
+async function credentialStatus() {
+	return publicCredentialStatus(await runScript("login.py", ["--status"]));
+}
+function authorizeUrl() {
+	return runScript("login.py", ["--authorize-url"]);
+}
+async function saveAuthCode(code) {
+	return publicCredentialStatus(await runScript("login.py", ["--save", "--stdin"], {
+		stdin: JSON.stringify({ code }),
+		sensitiveValues: [code]
+	}));
+}
+function logout() {
+	return runScript("logout.py", [], { jsonOnly: false });
+}
+/**
+* Validate a long-lived Tencent Cloud AK/SK pair without persisting it.
+* The script performs one read-only CloudQ call to prove the key works.
+*/
+function testAccessKey(secretId, secretKey) {
+	return runScript("save_ak.py", ["--test", "--stdin"], {
+		stdin: JSON.stringify({
+			secretId,
+			secretKey
+		}),
+		sensitiveValues: [secretId, secretKey]
+	});
+}
+/** Validate then persist a long-lived AK/SK pair as `type:"ak"`. */
+async function saveAccessKey(secretId, secretKey) {
+	return publicCredentialStatus(await runScript("save_ak.py", ["--save", "--stdin"], {
+		stdin: JSON.stringify({
+			secretId,
+			secretKey
+		}),
+		sensitiveValues: [secretId, secretKey]
+	}));
+}
+function cloudqUsageOverview() {
+	return runScript("tcloud_api.py", [
+		"advisor",
+		"advisor.tencentcloudapi.com",
+		"DescribeCloudQUsageOverview",
+		"2020-07-21",
+		"{}"
+	]);
+}
+function cloudqUsageDetail({ startTime, endTime, limit = 20, offset = 0 }) {
+	return runScript("tcloud_api.py", [
+		"advisor",
+		"advisor.tencentcloudapi.com",
+		"DescribeCloudQUsageDetail",
+		"2020-07-21",
+		JSON.stringify({
+			StartTime: startTime,
+			EndTime: endTime,
+			Limit: limit,
+			Offset: offset
+		})
+	]);
+}
+function cloudqInspirationList() {
+	return runScript("tcloud_api.py", [
+		"advisor",
+		"advisor.tencentcloudapi.com",
+		"DescribeCloudQInspirationList",
+		"2020-07-21",
+		"{\"Category\":0}"
+	]);
+}
+/** Fetch all CloudQ artifact sessions and their archived files. */
+function cloudqArtifactLibrary() {
+	return runScript("tcloud_api.py", [
+		"advisor",
+		"advisor.tencentcloudapi.com",
+		"DescribeCloudQArtifactLibrary",
+		"2020-07-21",
+		"{}"
+	]);
+}
+/** Fetch the architecture directory tree available to the current account. */
+function cloudqArchitectureDirectories() {
+	return runScript("tcloud_api.py", [
+		"advisor",
+		"advisor.tencentcloudapi.com",
+		"ListDirectoryV2",
+		"2020-07-21",
+		JSON.stringify({
+			Tags: [],
+			TagKeys: []
+		})
+	]);
+}
+/** Fetch one page of diagrams in a CloudQ architecture directory. */
+function cloudqArchitectureList({ folderId, pageNumber = 1, pageSize = 30 }) {
+	return runScript("tcloud_api.py", [
+		"advisor",
+		"advisor.tencentcloudapi.com",
+		"DescribeArchList",
+		"2020-07-21",
+		JSON.stringify({
+			PageNumber: pageNumber,
+			PageSize: pageSize,
+			SearchKey: "",
+			FolderId: folderId,
+			WithSvgURL: true,
+			Tags: [],
+			TagKeys: []
+		})
+	]);
+}
+/**
+* Extract and validate an AK/SK pair from a request body.
+* Both routes (test / save) share the same contract, so the shape check and
+* the error messages live in one place.
+*/
+function readAccessKeyBody(body) {
+	const secretId = typeof body?.secretId === "string" ? body.secretId.trim() : "";
+	const secretKey = typeof body?.secretKey === "string" ? body.secretKey.trim() : "";
+	if (!secretId || !secretKey) throw new HttpError(400, "missing-credential", "SecretId 与 SecretKey 均为必填。");
+	return {
+		secretId,
+		secretKey
+	};
+}
+/** Join the plain-text blocks carried by one DSH message. */
+function messageText(content) {
+	if (!Array.isArray(content)) return "";
+	return content.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n");
+}
+/** A durable log proves CloudQ mode through an explicit claim or skill call. */
+function hasCloudqEvidence(events) {
+	if (!Array.isArray(events)) return false;
+	for (const event of events) {
+		if (event?.type === "user/message" && event?.data?.source?.kind === "user") {
+			if (/^\s*\/cloudq(?:\s|$)/i.test(messageText(event?.data?.content))) return true;
+		}
+		if (event?.type !== "tool/call" || event?.data?.name !== "skill") continue;
+		let args = event?.data?.arguments;
+		if (typeof args === "string") try {
+			args = JSON.parse(args);
+		} catch {
+			args = void 0;
+		}
+		if ((typeof args?.name === "string" ? args.name : typeof args?.skill === "string" ? args.skill : "").toLowerCase() === "cloudq") return true;
+	}
+	return false;
+}
+/**
+* Derive CloudQ session ids from their durable DSH logs. This is the source of
+* truth for historical rows; browser storage is only an optimistic cache for
+* a brand-new blank session that has no log yet.
+*/
+async function detectCloudqSessionIds(ctx) {
+	const query = ctx.get("sessionQuery");
+	if (query === void 0) throw new HttpError(503, "session-query-unavailable", "当前 DSH 未启用会话查询服务。");
+	const records = await query.listSessions();
+	const ids = [];
+	const queue = [...records];
+	const worker = async () => {
+		while (queue.length > 0) {
+			const sessionId = queue.shift()?.header?.id;
+			if (!sessionId) continue;
+			try {
+				if (hasCloudqEvidence((await query.readSession(sessionId))?.events)) ids.push(sessionId);
+			} catch {}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(6, queue.length) }, () => worker()));
+	return ids;
+}
+/** Settings namespace for the browser card (must equal client card `key`). */
+const SETTINGS_NAMESPACE = "dsh-cloudq";
+/** Empty schema; the card is credential-focused and stores nothing. */
+const Config = Schema.object({});
+/** Settings namespace for the plugin-manager card. */
+const PLUGIN_MANAGER_NAMESPACE = "dsh-plugin-manager";
+const name = "dsh-cloudq";
+const inject = [
+	"skills",
+	"webServer",
+	"settings",
+	"sessionQuery"
+];
+function apply(ctx) {
+	ctx.effect(() => ctx.settings.register(SETTINGS_NAMESPACE, Config, { base: {} }), "dsh-cloudq: settings namespace");
+	ctx.effect(() => ctx.settings.register(PLUGIN_MANAGER_NAMESPACE, Config, { base: {} }), "dsh-cloudq: plugin-manager settings namespace");
+	ctx.effect(() => ctx.skills.register({
+		name: "cloudq",
+		description: "用户咨询腾讯云产品资源、AWS、阿里云等多云资源时，查看智能顾问架构图、架构目录、架构详情、架构评估结果、绘制架构图、开通智能顾问时、AI智能巡检、AI容量监测、AI混沌演练、AI云诊断、主动预警、架构健康度、云运维问答、云资源查询、云成本优化、安全合规、云资源盘点、闲置资源检查、云产品最佳实践等AIOps、ChatOps、CloudOps操作时使用。",
+		whenToUse: "用户要求进入 CloudQ 模式、使用 CloudQ、咨询云上架构/资源/成本/巡检/诊断等多云或腾讯云运维问题，或点击输入栏 CloudQ 按钮时使用；也适用于架构图查看/评估、AI 巡检、容量监测、混沌演练、云诊断等场景。",
+		source: "bundled",
+		resourceBase: {
+			kind: "directory",
+			path: skillDirectory()
+		},
+		content: renderedSkillContent(),
+		invocation: {
+			modelInvocable: true,
+			userInvocable: true
+		}
+	}), "dsh-cloudq: CloudQ skill");
+	ctx.effect(() => {
+		const disposers = [];
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/credential",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					sendJson(response, 200, {
+						ok: true,
+						status: await credentialStatus()
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/login/url",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					const result = await authorizeUrl();
+					sendJson(response, 200, {
+						ok: true,
+						authorize_url: result.authorize_url,
+						state: result.state
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/login/save",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					const body = await readJsonBody(request);
+					const code = typeof body?.code === "string" ? body.code.trim() : "";
+					if (!code) throw new HttpError(400, "missing-code", "缺少授权码。");
+					sendJson(response, 200, {
+						ok: true,
+						status: await saveAuthCode(code)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/logout",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					sendJson(response, 200, {
+						ok: true,
+						status: await logout()
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/credential/test",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					const { secretId, secretKey } = readAccessKeyBody(await readJsonBody(request));
+					sendJson(response, 200, {
+						ok: true,
+						result: await testAccessKey(secretId, secretKey)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/credential/save",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					const { secretId, secretKey } = readAccessKeyBody(await readJsonBody(request));
+					sendJson(response, 200, {
+						ok: true,
+						status: await saveAccessKey(secretId, secretKey)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/logo.png",
+			handler: (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					response.statusCode = 200;
+					response.setHeader("Content-Type", "image/png");
+					response.setHeader("Cache-Control", "public, max-age=86400");
+					response.setHeader("X-Content-Type-Options", "nosniff");
+					response.end(LOGO_BUFFER);
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/plugins",
+			handler: (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					sendJson(response, 200, {
+						ok: true,
+						plugins: listPlugins(ctx.baseUrl)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/plugins/toggle",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					const body = await readJsonBody(request);
+					const id = typeof body?.id === "string" ? body.id : "";
+					if (!id) throw new HttpError(400, "missing-id", "缺少插件 ID。");
+					const disabled = body?.disabled === true;
+					sendJson(response, 200, {
+						ok: true,
+						result: setPluginDisabled(ctx.baseUrl, id, disabled)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/usage",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					const url = new URL(request.url, "http://localhost");
+					const startTime = url.searchParams.get("start") ?? "";
+					const endTime = url.searchParams.get("end") ?? "";
+					const limit = Number(url.searchParams.get("limit") ?? 20);
+					const offset = Number(url.searchParams.get("offset") ?? 0);
+					const timestampPattern = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/;
+					if (!timestampPattern.test(startTime) || !timestampPattern.test(endTime)) throw new HttpError(400, "invalid-range", "The start and end timestamps are invalid.");
+					if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100 || !Number.isSafeInteger(offset) || offset < 0) throw new HttpError(400, "invalid-pagination", "The pagination parameters are invalid.");
+					const [overview, detail] = await Promise.all([cloudqUsageOverview(), cloudqUsageDetail({
+						startTime,
+						endTime,
+						limit,
+						offset
+					})]);
+					sendJson(response, 200, {
+						ok: true,
+						overview: overview?.data ?? {},
+						detail: detail?.data?.Detail ?? [],
+						total: detail?.data?.TotalCount ?? detail?.data?.Detail?.length ?? 0
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/inspirations",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					const result = await cloudqInspirationList();
+					sendJson(response, 200, {
+						ok: true,
+						inspirations: result?.data?.InspirationSet ?? [],
+						total: result?.data?.TotalCount ?? 0
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/artifacts",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					const result = await cloudqArtifactLibrary();
+					const sessions = Array.isArray(result?.data?.Sessions) ? result.data.Sessions : [];
+					sendJson(response, 200, {
+						ok: true,
+						sessions,
+						total: Number(result?.data?.TotalCount) || sessions.length
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/sessions",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					sendJson(response, 200, {
+						ok: true,
+						sessionIds: await detectCloudqSessionIds(ctx)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/architecture/directories",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					const result = await cloudqArchitectureDirectories();
+					sendJson(response, 200, {
+						ok: true,
+						folders: Array.isArray(result?.data?.Folders) ? result.data.Folders : [],
+						firstFolderId: Number(result?.data?.FirstFolderId) || null
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/architecture/list",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					const url = new URL(request.url, "http://localhost");
+					const folderId = Number(url.searchParams.get("folderId"));
+					if (!Number.isSafeInteger(folderId) || folderId <= 0) throw new HttpError(400, "invalid-folder-id", "folderId 必须是正整数。");
+					const result = await cloudqArchitectureList({ folderId });
+					const architectures = Array.isArray(result?.data?.ArchList) ? result.data.ArchList : [];
+					sendJson(response, 200, {
+						ok: true,
+						architectures,
+						total: Number(result?.data?.TotalCount) || architectures.length
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		return () => {
+			for (const dispose of disposers) dispose();
+		};
+	}, "dsh-cloudq: credential, plugin-manager and data routes");
+}
+//#endregion
+export { Config, apply, inject, name };