dsh-config-manager 0.1.12 → 0.1.13

package/lib/index.js

@@ -44,10 +44,16 @@ import { credentialRef } from '@deepseek-ai/dsh-credentials';
 import { dshHomePath, resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import * as yaml from 'js-yaml';
 import { Exporter, FileSnapshotStore, Importer } from "./core/index.js";
+import { listSnapshots, planRestore } from "./core/restore.js";
+import { RunRegistry } from "./core/run-registry.js";
 import { hasDshBundlePatch, installErrorFor, listInstalledPlugins, resolveProfileDir, resolveProfileNameFromArgv, runDshPlugin, validateProfileName, } from "./core/plugin-cli.js";
 import { createAdapters, USER_PATCH_FILE } from "./adapters/index.js";
 import { createEncryptionProvider, decryptCredentials } from "./security/index.js";
 import { createHardenedZipParser } from "./security/zip-security.js";
+import { GitTransport } from "./sync/git/git-transport.js";
+import { SyncEngine } from "./sync/sync-engine.js";
+import { loadSyncState } from "./sync/sync-state.js";
+import { readSyncConfig, writeSyncConfig, validateRepoUrl } from "./sync/sync-config.js";
 import { MANIFEST_FILE, parseManifest } from "./schema/manifest.js";
 import { SECTION_IDS } from "./schema/config.js";
 import { parseZip } from "./utils/zip.js";
@@ -59,7 +65,7 @@ export const name = 'config-manager';
 /** Services required before the engine can mount (present in every profile). */
 export const inject = ['settings', 'credentials'];
 /** Plugin version, kept in sync with package.json ("version"). */
-const PLUGIN_VERSION = '0.1.11';
+const PLUGIN_VERSION = '0.1.13';
 /* ---------------------------------------------------------------- constants */
 /** Route family — must match the browser half's CONFIG_MANAGER_API exactly. */
 const API = {
@@ -70,7 +76,21 @@ const API = {
     analyze: '/api/dsh-config-manager/analyze',
     plan: '/api/dsh-config-manager/plan',
     execute: '/api/dsh-config-manager/execute',
+    progress: '/api/dsh-config-manager/progress',
+    runs: '/api/dsh-config-manager/runs',
+    snapshots: '/api/dsh-config-manager/snapshots',
+    restore: '/api/dsh-config-manager/restore',
+    // m-sync-ui：远程同步（Git 私有仓库通道）
+    syncStatus: '/api/dsh-config-manager/sync/status',
+    syncPush: '/api/dsh-config-manager/sync/push',
+    syncPull: '/api/dsh-config-manager/sync/pull',
 };
+/**
+ * 同步 token 的 DSH credentials 引用名（POSIX env-var 形态，满足 CredentialRef 品牌要求）。
+ * token 只经 credentialRef 读写（写入由请求体触发，读取在每次 git 网络操作时 resolve），
+ * 永不进 repoUrl / argv / commit / 同步文件 / 日志。
+ */
+const SYNC_CREDENTIAL_REF = 'DSH_CONFIG_MANAGER_SYNC_TOKEN';
 /** Cap on JSON request bodies (import plans can be large: 4 MB). */
 const MAX_JSON_BODY_BYTES = 4 * 1024 * 1024;
 /** Cap on raw upload bodies (staged to the controlled tmp dir). */
@@ -544,6 +564,7 @@ class ConfigManagerHostContext {
     arch = process.arch;
     homeDir;
     dshVersion;
+    profile;
     log;
     settings;
     credentials;
@@ -554,6 +575,7 @@ class ConfigManagerHostContext {
     constructor(ctx, homeDir, profile) {
         this.homeDir = homeDir;
         this.dshVersion = resolveDshVersion(homeDir);
+        this.profile = profile;
         const level = process.env.DSH_CONFIG_MANAGER_LOG_LEVEL;
         this.log = createLogger({
             level: level === 'debug' || level === 'info' || level === 'warn' || level === 'error' ? level : 'info',
@@ -643,9 +665,142 @@ async function tryDecryptCredentials(zipPath, password) {
     }
     return map;
 }
+/* -------------------------------------------------- sync 路由（m-sync-ui） */
+/** 同步路由可预期的请求级错误（status 缺省 400；引擎/传输失败走 500） */
+export class SyncRouteError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.name = 'SyncRouteError';
+        this.status = status;
+    }
+}
+/** 同步路由错误统一出口：SyncRouteError 用其 status，其余 500（GitTransport 错误消息已脱敏） */
+export function writeSyncRouteError(res, error) {
+    if (error instanceof SyncRouteError) {
+        writeJson(res, error.status, { error: error.message });
+        return;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    writeJson(res, 500, { error: message });
+}
+export function buildRestoreBody(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        return { ok: false, error: 'invalid JSON body' };
+    }
+    const record = body;
+    const snapshotId = record['snapshotId'];
+    if (typeof snapshotId !== 'string' || snapshotId === '') {
+        return { ok: false, error: 'snapshotId is required' };
+    }
+    if (snapshotId === '.' || snapshotId === '..' || snapshotId.includes('/') || snapshotId.includes('\\')) {
+        return { ok: false, error: 'snapshotId 非法（禁止路径分隔符）/ invalid snapshotId' };
+    }
+    return { ok: true, value: { snapshotId, dryRun: record['dryRun'] === true } };
+}
+/**
+ * 按计划执行恢复动作（纯执行器；逐项 try/catch 不拖垮其余），
+ * 返回与 CLI 一致的诚实报告。顺序 = 计划顺序（整文件 → 插件 → file 补偿）。
+ */
+export async function executeRestorePlan(plan, exec) {
+    const report = {
+        snapshotId: plan.snapshotId,
+        restored: [],
+        removedPlugins: [],
+        manualHints: [],
+        failed: [],
+        skipped: [],
+    };
+    for (const action of plan.actions) {
+        try {
+            switch (action.kind) {
+                case 'hostFileRestore':
+                case 'fileRestore': {
+                    if (action.target === undefined || action.blobPath === undefined) {
+                        throw new Error('恢复动作缺少 target/blobPath');
+                    }
+                    if (await exec.existsHome(action.target))
+                        await exec.savePreRestore(action.target);
+                    await exec.writeHome(action.target, await exec.readBlob(action.blobPath));
+                    report.restored.push(action.target);
+                    break;
+                }
+                case 'hostFileRemove':
+                case 'fileRemove': {
+                    if (action.target === undefined)
+                        throw new Error('恢复动作缺少 target');
+                    if (await exec.existsHome(action.target)) {
+                        await exec.savePreRestore(action.target);
+                        await exec.removeHome(action.target);
+                    }
+                    report.restored.push(action.target);
+                    break;
+                }
+                case 'pluginRemove': {
+                    if (action.pluginName === undefined)
+                        throw new Error('恢复动作缺少插件名');
+                    const result = await exec.uninstallPlugin(action.pluginName);
+                    if (result.ok) {
+                        report.removedPlugins.push(action.pluginName);
+                    }
+                    else {
+                        report.failed.push({ item: `plugin:${action.pluginName}`, reason: result.message ?? '卸载失败' });
+                    }
+                    break;
+                }
+                case 'credentialHint':
+                    report.manualHints.push(action.manualHint ?? action.description);
+                    break;
+                case 'skip':
+                    report.skipped.push(action.description);
+                    break;
+                default:
+                    report.skipped.push(`未知动作 ${String(action.kind)}: ${action.description}`);
+            }
+        }
+        catch (err) {
+            report.failed.push({
+                item: action.target ?? action.pluginName ?? action.description,
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return report;
+}
+/** 宿主 restore 执行器装配：ctx.fs（home-relative）+ 快照目录（node fs）+ runDshPlugin。 */
+function makeRestoreExecutor(snapshotDir, host, profile) {
+    const profileDir = resolveProfileDir(host.homeDir, profile);
+    let seq = 0;
+    return {
+        readBlob: async (blobPath) => {
+            const target = resolve(snapshotDir, blobPath);
+            if (!isSameOrChild(target, snapshotDir))
+                throw new Error(`blob 路径越界: ${blobPath}`);
+            return fs.readFile(target);
+        },
+        savePreRestore: async (relPath) => {
+            const data = await host.fs.readFile(relPath);
+            seq += 1;
+            const safe = relPath.replace(/[\\/:*?"<>|]/g, '_');
+            await fs.mkdir(join(snapshotDir, 'pre-restore'), { recursive: true });
+            await fs.writeFile(join(snapshotDir, 'pre-restore', `${String(seq).padStart(4, '0')}-${safe}`), data);
+        },
+        existsHome: (relPath) => host.fs.exists(relPath),
+        writeHome: (relPath, data) => host.fs.writeFile(relPath, data),
+        removeHome: (relPath) => host.fs.remove(relPath),
+        uninstallPlugin: async (name) => {
+            const result = await runDshPlugin(profileDir, profile, ['remove', name]);
+            if (result.exitCode === 0)
+                return { ok: true };
+            const output = `${result.stderr}\n${result.stdout}`.trim();
+            const tail = output.split('\n').slice(-8).join('\n') || '无输出';
+            return { ok: false, message: `dsh plugin remove ${name} 失败（exit ${String(result.exitCode)}）：${tail}` };
+        },
+    };
+}
 /** Build the /api/dsh-config-manager route family. */
 function makeRoutes(deps) {
-    const { host, adapters, exportsDir, tmpDir, snapshotsDir } = deps;
+    const { host, adapters, exportsDir, tmpDir, snapshotsDir, runs, syncDir, credentials } = deps;
     const roots = [exportsDir, tmpDir];
     const makeImporter = () => new Importer({
         ctx: host,
@@ -666,6 +821,54 @@ function makeRoutes(deps) {
         }
         return true;
     };
+    // ------------------------------------------------- sync 路由装配（m-sync-ui）
+    // 请求级装配：每次 push/pull 从请求体取 repoUrl/gitBin，token 非空先写入 DSH
+    // credentials（只存值不落盘同步文件/日志），git 网络操作时经 resolve 现取 ——
+    // 与 GitTransport「token 只从注入 provider 读取」的安全契约完全对齐。
+    /** 解析同步请求体（repoUrl 必填；token 非空则先写入 DSH credentials）。 */
+    const prepareSync = async (body) => {
+        const repoUrl = typeof body['repoUrl'] === 'string' ? body['repoUrl'].trim() : '';
+        if (repoUrl === '')
+            throw new SyncRouteError('repoUrl is required');
+        const urlError = validateRepoUrl(repoUrl);
+        if (urlError !== null)
+            throw new SyncRouteError(urlError);
+        const gitBin = typeof body['gitBin'] === 'string' && body['gitBin'] !== '' ? body['gitBin'] : undefined;
+        const token = typeof body['token'] === 'string' && body['token'] !== '' ? body['token'] : undefined;
+        if (token !== undefined) {
+            try {
+                await credentials.set(credentialRef(SYNC_CREDENTIAL_REF), token);
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                throw new SyncRouteError(`token 写入 DSH credentials 失败：${reason}（请在 DSH 凭据管理里配置 ${SYNC_CREDENTIAL_REF} 后重试）`);
+            }
+        }
+        return { repoUrl, gitBin };
+    };
+    /** 构造 SyncEngine（Git 私有仓库通道 + 散文件快照目录 + pull 用 Importer）。 */
+    const makeSyncEngine = (repoUrl, gitBin) => {
+        const transport = new GitTransport({
+            repoUrl,
+            workDir: join(syncDir, 'work'),
+            credentials: {
+                getToken: async () => {
+                    const resolved = await credentials.resolve(credentialRef(SYNC_CREDENTIAL_REF));
+                    return resolved?.value ?? '';
+                },
+            },
+            gitBin,
+        });
+        return new SyncEngine({
+            ctx: host,
+            transport,
+            stateDir: syncDir,
+            adapters,
+            importer: makeImporter(),
+            localSnapshotsDir: join(syncDir, 'snapshots'),
+            zipDir: tmpDir,
+        });
+    };
     return [
         // ------------------------------------------------------------- status
         {
@@ -702,19 +905,43 @@ function makeRoutes(deps) {
                 // Encryption password is in-memory only (never persisted / logged).
                 const password = typeof body['password'] === 'string' && body['password'] !== '' ? body['password'] : undefined;
                 const outPath = join(exportsDir, `dsh-config-${dateStamp()}-${randomBytes(3).toString('hex')}.zip`);
+                // m1：执行开始注册 run（同 kind 已有进行中任务 → 409 拒绝，防止重复导出）
+                let run;
+                try {
+                    run = runs.register('export');
+                }
+                catch (error) {
+                    writeJson(res, 409, { error: error instanceof Error ? error.message : String(error) });
+                    return;
+                }
+                const runId = run.runId;
                 try {
                     const exporter = new Exporter({
                         ctx: host,
                         adapters,
                         encryption: includeSecrets && password !== undefined ? createEncryptionProvider(password) : null,
                         exporterVersion: PLUGIN_VERSION,
+                        // m1 埋点：每导出一个分区实时更新 run 状态（/progress 轮询可见）
+                        onSection: (info) => {
+                            runs.update(runId, {
+                                section: info.section,
+                                sectionTotal: info.total,
+                                item: info.index,
+                                itemTotal: info.total,
+                                detail: info.section,
+                            });
+                        },
                     });
                     const result = await withTimeout(exporter.export({ includeSecrets, only, outPath }), ROUTE_TIMEOUT_MS, '导出超时（5 分钟）：导出过程未完成，请重试；若反复超时请检查 profile 依赖状态');
-                    writeJson(res, 200, { zipPath: result.zipPath, manifest: result.manifest, report: result.report });
+                    // 结束写结果：完成结果落账（供 /progress 查询与刷新恢复后下载）
+                    runs.finish(runId, { zipPath: result.zipPath, manifest: result.manifest, report: result.report });
+                    writeJson(res, 200, { zipPath: result.zipPath, manifest: result.manifest, report: result.report, runId });
                 }
                 catch (error) {
-                    host.log.error('导出失败', { error: error instanceof Error ? error.message : String(error) });
-                    writeJson(res, 500, { error: error instanceof Error ? error.message : String(error) });
+                    const message = error instanceof Error ? error.message : String(error);
+                    runs.fail(runId, message);
+                    host.log.error('导出失败', { error: message });
+                    writeJson(res, 500, { error: message, runId });
                 }
             },
         },
@@ -840,6 +1067,39 @@ function makeRoutes(deps) {
                 }
             },
         },
+        // ------------------------------------------------------------ progress
+        // m1：查询单个 run 的实时状态（轮询 / 刷新恢复用；runId 不可猜，走 loopback-only 守卫）
+        {
+            kind: 'exact',
+            path: API.progress,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'GET'))
+                    return;
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const runId = queryParam(url, 'runId');
+                if (runId === undefined || runId === '') {
+                    writeJson(res, 400, { error: 'runId query parameter is required' });
+                    return;
+                }
+                const state = runs.get(runId);
+                if (state === undefined) {
+                    writeJson(res, 404, { error: `run ${runId} not found（可能已过保留期被清理）` });
+                    return;
+                }
+                writeJson(res, 200, state);
+            },
+        },
+        // ----------------------------------------------------------------- runs
+        // m1：列出当前活跃（running）的 run（刷新恢复时重新订阅进度用）
+        {
+            kind: 'exact',
+            path: API.runs,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'GET'))
+                    return;
+                writeJson(res, 200, runs.listActive());
+            },
+        },
         // ------------------------------------------------------------- execute
         {
             kind: 'exact',
@@ -864,6 +1124,16 @@ function makeRoutes(deps) {
                 const decryptPassword = typeof opts['decryptPassword'] === 'string' && opts['decryptPassword'] !== ''
                     ? opts['decryptPassword']
                     : undefined;
+                // m1：执行开始注册 run（同 kind 已有进行中任务 → 409 拒绝，防止重复导入）
+                let run;
+                try {
+                    run = runs.register('import');
+                }
+                catch (error) {
+                    writeJson(res, 409, { error: error instanceof Error ? error.message : String(error) });
+                    return;
+                }
+                const runId = run.runId;
                 try {
                     const decryptedCredentials = await tryDecryptCredentials(zipPath, decryptPassword);
                     const result = await makeImporter().executeImportPlan(zipPath, plan, {
@@ -873,15 +1143,168 @@ function makeRoutes(deps) {
                             : {},
                         rollbackOnError: opts['rollbackOnError'] === true,
                         decryptedCredentials,
+                        // m1 埋点：每完成一个计划项实时更新 run 状态（/progress 轮询可见）
+                        onItem: (info) => {
+                            runs.update(runId, {
+                                section: info.adapter,
+                                item: info.index,
+                                itemTotal: info.total,
+                                detail: info.detail ?? info.adapter,
+                            });
+                        },
                     });
-                    writeJson(res, 200, result);
+                    // 结束写结果：导入结果落账（供 /progress 查询与刷新恢复）
+                    runs.finish(runId, result);
+                    writeJson(res, 200, { ...result, runId });
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    runs.fail(runId, message);
+                    host.log.error('导入执行失败', { error: message });
+                    writeJson(res, 400, { error: message, runId });
+                }
+            },
+        },
+        // ---------------------------------------------------------- snapshots
+        // M4：列出快照元信息（id/createdAt/sourceZip/status/计数，createdAt 倒序）
+        {
+            kind: 'exact',
+            path: API.snapshots,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'GET'))
+                    return;
+                try {
+                    writeJson(res, 200, { snapshots: await listSnapshots(snapshotsDir) });
+                }
+                catch (error) {
+                    writeJson(res, 500, { error: error instanceof Error ? error.message : String(error) });
+                }
+            },
+        },
+        // ------------------------------------------------------------ restore
+        // M4：快照恢复。dryRun=true 只返回动作计划（planRestore，零写入）；
+        // 真实执行 = 计划 → 宿主执行器（ctx.fs 整文件/文件还原 + runDshPlugin 卸载插件）
+        // → 与 CLI 一致的诚实报告 { restored/removedPlugins/manualHints/failed/skipped }。
+        {
+            kind: 'exact',
+            path: API.restore,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'POST'))
+                    return;
+                const body = await readJsonBody(req);
+                const parsed = buildRestoreBody(body);
+                if (!parsed.ok) {
+                    writeJson(res, 400, { error: parsed.error });
+                    return;
+                }
+                const { snapshotId, dryRun } = parsed.value;
+                const snapshotDir = join(snapshotsDir, snapshotId);
+                const restoreOpts = {
+                    snapshotDir,
+                    homeDir: host.homeDir,
+                    profile: host.profile,
+                    settingsPath: undefined,
+                };
+                try {
+                    if (dryRun) {
+                        writeJson(res, 200, { dryRun: true, plan: await planRestore(restoreOpts) });
+                        return;
+                    }
+                    const plan = await planRestore(restoreOpts);
+                    const report = await executeRestorePlan(plan, makeRestoreExecutor(snapshotDir, host, host.profile));
+                    writeJson(res, 200, { dryRun: false, report });
                 }
                 catch (error) {
-                    host.log.error('导入执行失败', { error: error instanceof Error ? error.message : String(error) });
                     writeJson(res, 400, { error: error instanceof Error ? error.message : String(error) });
                 }
             },
         },
+        // ------------------------------------------------------ sync/status
+        // m-sync-ui：同步状态（仓库配置 / 凭据状态 / 上次同步 / 分区数）。只读，无 secret 值。
+        {
+            kind: 'exact',
+            path: API.syncStatus,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'GET'))
+                    return;
+                try {
+                    const [cfg, state, cred] = await Promise.all([
+                        readSyncConfig(syncDir),
+                        loadSyncState(syncDir),
+                        credentials.describe(credentialRef(SYNC_CREDENTIAL_REF)),
+                    ]);
+                    writeJson(res, 200, {
+                        ok: true,
+                        configured: cfg !== null,
+                        repoUrl: cfg?.repoUrl,
+                        gitBin: cfg?.gitBin,
+                        credentialConfigured: cred.configured,
+                        credentialWritable: cred.writable === true,
+                        lastSyncAt: state.lastSyncAt === '' ? undefined : state.lastSyncAt,
+                        sectionCount: Object.keys(state.sections).length,
+                        transport: state.transport,
+                    });
+                }
+                catch (error) {
+                    writeJson(res, 500, { error: error instanceof Error ? error.message : String(error) });
+                }
+            },
+        },
+        // ------------------------------------------------------ sync/push
+        // m-sync-ui：推送（导出 portable 分区 → 提交私有仓库 → 更新 sync-state）。
+        // token 可选：非空先写入 DSH credentials；成功则记忆仓库配置（回填表单用）。
+        {
+            kind: 'exact',
+            path: API.syncPush,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'POST'))
+                    return;
+                const body = await readJsonBody(req);
+                if (body === undefined) {
+                    writeJson(res, 400, { error: 'invalid JSON body' });
+                    return;
+                }
+                try {
+                    const { repoUrl, gitBin } = await prepareSync(body);
+                    const engine = makeSyncEngine(repoUrl, gitBin);
+                    const snapshotId = typeof body['snapshotId'] === 'string' && body['snapshotId'] !== '' ? body['snapshotId'] : undefined;
+                    const report = await withTimeout(engine.push(snapshotId === undefined ? {} : { snapshotId }), ROUTE_TIMEOUT_MS, '同步推送超时（5 分钟）：请检查网络与仓库可达性后重试');
+                    await writeSyncConfig(syncDir, { repoUrl, gitBin });
+                    writeJson(res, 200, report);
+                }
+                catch (error) {
+                    writeSyncRouteError(res, error);
+                }
+            },
+        },
+        // ------------------------------------------------------ sync/pull
+        // m-sync-ui：拉取差异预览（只读：list/download → 转临时 ZIP → Importer 分析出计划摘要）。
+        // 绝不直接写配置、绝不执行导入（executeImportPlan 由上层按用户确认驱动）。
+        {
+            kind: 'exact',
+            path: API.syncPull,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'POST'))
+                    return;
+                const body = await readJsonBody(req);
+                if (body === undefined) {
+                    writeJson(res, 400, { error: 'invalid JSON body' });
+                    return;
+                }
+                try {
+                    const { repoUrl, gitBin } = await prepareSync(body);
+                    const engine = makeSyncEngine(repoUrl, gitBin);
+                    const strategy = body['strategy'] === 'replace' || body['strategy'] === 'skipExisting' ? body['strategy'] : 'merge';
+                    const snapshotId = typeof body['snapshotId'] === 'string' && body['snapshotId'] !== '' ? body['snapshotId'] : undefined;
+                    const report = await withTimeout(engine.pull({ strategy, ...(snapshotId === undefined ? {} : { snapshotId }) }), ROUTE_TIMEOUT_MS, '同步拉取超时（5 分钟）：请检查网络与仓库可达性后重试');
+                    await writeSyncConfig(syncDir, { repoUrl, gitBin });
+                    writeJson(res, 200, report);
+                }
+                catch (error) {
+                    writeSyncRouteError(res, error);
+                }
+            },
+        },
     ];
 }
 /* ------------------------------------------------------------------ apply */
@@ -901,9 +1324,11 @@ export function apply(ctx, config) {
     const exportsDir = join(dataDir, 'exports');
     const tmpDir = join(dataDir, 'tmp');
     const snapshotsDir = join(dataDir, 'snapshots');
+    const syncDir = join(dataDir, 'sync');
     mkdirSync(exportsDir, { recursive: true });
     mkdirSync(tmpDir, { recursive: true });
     mkdirSync(snapshotsDir, { recursive: true });
+    mkdirSync(syncDir, { recursive: true });
     const host = new ConfigManagerHostContext(ctx, homeDir, resolveProfileName(config));
     const adapters = createAdapters({
         // Namespace list = everything the settings service has registered.
@@ -915,7 +1340,16 @@ export function apply(ctx, config) {
         dshVersion: host.dshVersion,
         adapters: adapters.map((a) => a.id),
     });
-    const routes = makeRoutes({ host, adapters, exportsDir, tmpDir, snapshotsDir });
+    const routes = makeRoutes({
+        host,
+        adapters,
+        exportsDir,
+        tmpDir,
+        snapshotsDir,
+        runs: new RunRegistry(),
+        syncDir,
+        credentials: ctx.credentials,
+    });
     const webServer = readService(ctx, 'webServer');
     if (webServer === undefined) {
         host.log.warn('webServer 服务不可用：跳过 /api/dsh-config-manager 路由注册（引擎能力仍可用）');