dsh-contextos-devops 0.0.0-stage → 1.48.31

package/lib/core/device.js

@@ -0,0 +1,148 @@
+// 核心业务：周边设备发现（ContextOS 节点 / WiFi / 蓝牙 / 局域网）。
+import { runShell } from '../misc/shell.js';
+import { listNodes } from '../base/registry.js';
+
+const DEVICE_ADAPTERS = [
+  { kind: 'contextos', label: 'ContextOS 节点', supported: true, reason: '' },
+  { kind: 'wifi', label: 'WiFi / 局域网', supported: process.platform === 'darwin' || process.platform === 'linux', reason: '' },
+  { kind: 'bluetooth', label: '蓝牙', supported: process.platform === 'darwin' || process.platform === 'linux', reason: '' },
+  { kind: 'infrared', label: '红外', supported: false, reason: '当前宿主无红外适配器；预留 IR 适配层' },
+];
+
+function walkBluetooth(value, out) {
+  if (!value || typeof value !== 'object') return;
+  if (Array.isArray(value)) { for (const x of value) walkBluetooth(x, out); return; }
+  const keys = Object.keys(value);
+  const name = value.device_name || value._name || value.name || value.device_title;
+  const addr = value.device_address || value.address || value.device_addr;
+  if (name || addr) out.push({ name: String(name || addr), address: String(addr || ''), raw: value });
+  for (const k of keys) {
+    if (typeof value[k] === 'object') walkBluetooth(value[k], out);
+  }
+}
+
+async function scanWifiNetworks() {
+  const candidates = [
+    '/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s 2>/dev/null',
+    'airport -s 2>/dev/null',
+  ];
+  for (const cmd of candidates) {
+    const r = await runShell(cmd, process.cwd(), { timeoutMs: 8000 }).catch(() => null);
+    if (!r || r.code !== 0 || !String(r.out || '').trim()) continue;
+    const rows = [];
+    for (const line of r.out.split('\n').slice(1)) {
+      const t = line.trim();
+      if (!t) continue;
+      const m = /^(.*?)\s+([0-9a-f:]{17})\s+(-?\d+)\s+(\d+)(?:\s+.*)?$/i.exec(t);
+      if (m) rows.push({ ssid: m[1].trim(), bssid: m[2].toLowerCase(), rssi: Number(m[3]), channel: Number(m[4]) });
+    }
+    if (rows.length) return rows;
+  }
+  // 新版 macOS 无 airport：从 system_profiler 的 “Other Local Wi-Fi Networks” 解析
+  const prof = await runShell('/usr/sbin/system_profiler SPAirPortDataType 2>/dev/null', process.cwd(), { timeoutMs: 10000 }).catch(() => null);
+  if (prof && prof.code === 0) {
+    const lines = String(prof.out || '').split('\n');
+    const start = lines.findIndex((l) => /Other Local Wi-Fi Networks:/i.test(l));
+    const rows = [];
+    let cur = null;
+    for (let i = start + 1; start >= 0 && i < lines.length; i += 1) {
+      const raw = lines[i];
+      const t = raw.trim();
+      if (!t) continue;
+      if (/^[a-z]+\d+:$/.test(t)) break;
+      if (/^[A-Za-z].*:$/.test(t) && /^(Interfaces|Current Network|Other Local|Software|AirPort|Wake|AirDrop|Auto|Status)/i.test(t)) break;
+      if (/^<redacted>:$/.test(t) || /^.+:$/.test(t) && !/^([A-Z][A-Za-z /]+):/.test(t)) {
+        if (cur) rows.push(cur);
+        cur = { ssid: /<redacted>/.test(t) ? `网络 ${rows.length + 1}` : t.replace(/:$/, ''), bssid: '', rssi: null, channel: null };
+        continue;
+      }
+      if (!cur) continue;
+      const ch = /Channel:\s*(\d+)/i.exec(t); if (ch) cur.channel = Number(ch[1]);
+      const sg = /Signal \/ Noise:\s*(-?\d+)/i.exec(t); if (sg) cur.rssi = Number(sg[1]);
+    }
+    if (cur) rows.push(cur);
+    if (rows.length) return rows;
+  }
+  return [];
+}
+
+async function scanBluetoothNearby() {
+  const r = await runShell('blueutil --inquiry 5 --format json 2>/dev/null', process.cwd(), { timeoutMs: 12000 }).catch(() => null);
+  if (r && r.code === 0 && String(r.out || '').trim()) {
+    try {
+      const arr = JSON.parse(r.out);
+      if (Array.isArray(arr)) return arr.map((d) => ({ name: d.name || d.address || 'BLE', address: d.address || '', rssi: d.rssi ?? null, nearby: true }));
+    } catch { /* fall through */ }
+  }
+  return [];
+}
+
+async function scanLanHosts() {
+  const r = await runShell('/usr/sbin/arp -a 2>/dev/null', process.cwd(), { timeoutMs: 4000 }).catch(() => null);
+  const hosts = [];
+  if (r && r.code === 0) {
+    for (const line of String(r.out || '').split('\n')) {
+      const m = /^(\S+)\s+\(([^)]+)\)\s+at\s+([0-9a-f:]+)/i.exec(line.trim());
+      if (!m) continue;
+      hosts.push({ ip: m[2], mac: m[3], name: m[1] === '?' ? '' : m[1] });
+    }
+  }
+  return hosts;
+}
+
+export async function discoverDevices({ node } = {}) {
+  const devices = [];
+  const adapters = DEVICE_ADAPTERS.map((x) => ({ ...x }));
+  const nodes = await listNodes();
+  for (const n of nodes) {
+    devices.push({
+      id: `contextos:${n.port}`,
+      name: n.name || `ContextOS-${n.port}`,
+      kind: 'contextos',
+      address: `127.0.0.1:${n.port}`,
+      status: n.state,
+      controllable: true,
+      meta: { dir: n.dir, env: n.env || '', version: n.version || '' },
+    });
+  }
+  const wifi = await runShell('/usr/sbin/arp -a 2>/dev/null', process.cwd(), { timeoutMs: 4000 }).catch(() => null);
+  if (wifi && wifi.code === 0) {
+    for (const line of wifi.out.split('\n')) {
+      const m = /^(\S+)\s+\(([^)]+)\)\s+at\s+([0-9a-f:]+)/i.exec(line.trim());
+      if (!m) continue;
+      devices.push({ id: `wifi:${m[2]}:${m[3]}`, name: m[1] === '?' ? `WiFi ${m[2]}` : m[1], kind: 'wifi', address: m[2], status: 'online', controllable: false, meta: { mac: m[3], raw: line.trim() } });
+    }
+  } else {
+    const a = adapters.find((x) => x.kind === 'wifi');
+    if (a) { a.supported = false; a.reason = 'arp 不可用或超时'; }
+  }
+  const bt = await runShell(process.platform === 'darwin' ? 'system_profiler SPBluetoothDataType -json 2>/dev/null' : 'bluetoothctl devices 2>/dev/null', process.cwd(), { timeoutMs: 8000 }).catch(() => null);
+  if (bt && bt.code === 0 && bt.out.trim()) {
+    let found = [];
+    try {
+      const json = JSON.parse(bt.out);
+      walkBluetooth(json, found);
+    } catch {
+      for (const line of bt.out.split('\n')) {
+        const m = /Device\s+([0-9A-F:]{17})\s+(.+)$/i.exec(line.trim());
+        if (m) found.push({ name: m[2], address: m[1] });
+      }
+    }
+    const seen = new Set();
+    for (const d of found) {
+      const key = `${d.address}:${d.name}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      devices.push({ id: `bluetooth:${d.address || d.name}`, name: d.name, kind: 'bluetooth', address: d.address || '', status: 'paired', controllable: false, meta: {} });
+    }
+  } else {
+    const a = adapters.find((x) => x.kind === 'bluetooth');
+    if (a) { a.reason = bt ? '蓝牙不可用或超时' : '蓝牙扫描失败'; }
+  }
+  const [wifiNetworks, btNearby, lanHosts] = await Promise.all([scanWifiNetworks(), scanBluetoothNearby(), scanLanHosts()]);
+  return {
+    adapters, devices, wifiNetworks, bluetoothNearby: btNearby, lanHosts,
+    scannedAt: new Date().toISOString(),
+    note: 'macOS 会隐藏未授权的 Wi-Fi 名称（显示为 网络 N）；附近蓝牙需要安装 blueutil；局域网来自 arp 邻居表；ContextOS 节点可控制。',
+  };
+}

package/lib/core/files.js

@@ -0,0 +1,152 @@
+// 核心业务：空间文件操作（列目录/读写/树/新建/改名/删除/git 状态）。
+import fs from 'node:fs/promises';
+import fsp from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { listNodes } from '../base/registry.js';
+import { spaceBase, baseDirOf } from './spaces.js';
+
+export async function listDir({ node, space, path: sub = '' } = {}) {
+  const n = (await listNodes()).find((x) => x.port === Number(node));
+  if (!n) throw new Error(`node ${node} not found`);
+  const base = path.join(n.dir, 'usr', 'local', 'work', space);
+  const dir = sub ? path.join(base, ...sub.split('/').filter(Boolean)) : base;
+  if (dir !== base && !dir.startsWith(base + path.sep)) throw new Error('path escapes the space');
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch (e) {
+    throw new Error(`cannot read ${dir}: ${String(e?.message || e)}`);
+  }
+  const out = [];
+  for (const ent of entries) {
+    if (ent.name === '.git') continue;
+    const p = path.join(dir, ent.name);
+    let st = null;
+    try { st = await fs.stat(p); } catch {}
+    out.push({
+      name: ent.name,
+      type: ent.isDirectory() ? 'dir' : 'file',
+      size: st?.size ?? 0,
+      mtime: st ? st.mtime.toISOString() : '',
+      path: sub ? `${sub}/${ent.name}` : ent.name,
+    });
+  }
+  const ORDER = ['src', 'etc', 'bin', 'var', 'usr'];
+  const rank = (e) => { const i = ORDER.indexOf(e.name); return i < 0 ? 99 : i; };
+  out.sort((a, b) => {
+    if (a.type !== b.type) return a.type === 'dir' ? -1 : 1;
+    if (a.type === 'dir') {
+      const ra = rank(a), rb = rank(b);
+      if (ra !== rb) return ra - rb;
+    }
+    return a.name.localeCompare(b.name);
+  });
+  return { node: Number(node), space, path: sub || '', entries: out.filter((e) => !e.name.startsWith('.')) };
+}
+
+export async function readFile({ node, space, path: p } = {}) {
+  const n = (await listNodes()).find((x) => x.port === Number(node));
+  if (!n) throw new Error(`node ${node} not found`);
+  const base = baseDirOf(n, space);
+  const file = path.join(base, ...String(p || '').replace(/^\/+/, '').split('/').filter(Boolean));
+  if (file !== base && !file.startsWith(base + path.sep)) throw new Error('path escapes the space');
+  let content;
+  try {
+    content = await fs.readFile(file, 'utf8');
+  } catch (e) {
+    throw new Error(`cannot read ${file}: ${String(e?.message || e)}`);
+  }
+  return { node: Number(node), space, path: p || '', content };
+}
+
+export async function writeFile({ node, space, path: p, content = '' } = {}) {
+  const n = (await listNodes()).find((x) => x.port === Number(node));
+  if (!n) throw new Error(`node ${node} not found`);
+  const base = baseDirOf(n, space);
+  const file = path.join(base, ...String(p || '').replace(/^\/+/, '').split('/').filter(Boolean));
+  if (file !== base && !file.startsWith(base + path.sep)) throw new Error('path escapes the space');
+  await fs.writeFile(file, content, 'utf8');
+  return { node: Number(node), space, path: p || '', saved: true };
+}
+
+/** 列出项目空间内的目录项（IDE 文件树用）。 */
+export async function listTree({ node, space, path: p = '' } = {}) {
+  const n = (await listNodes()).find((x) => x.port === Number(node));
+  if (!n) throw new Error(`node ${node} not found`);
+  const base = baseDirOf(n, space);
+  const dir = path.join(base, ...String(p || '').replace(/^\/+/, '').split('/').filter(Boolean));
+  if (dir !== base && !dir.startsWith(base + path.sep)) throw new Error('path escapes the space');
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  const skip = new Set(['.git', 'var', 'bin', 'node_modules']);
+  return entries
+    .filter((e) => !skip.has(e.name))
+    .map((e) => ({ name: e.name, type: e.isDirectory() ? 'dir' : 'file', path: [p, e.name].filter(Boolean).join('/') }))
+    .sort((a, b) => (a.type === b.type ? a.name.localeCompare(b.name) : a.type === 'dir' ? -1 : 1));
+}
+
+/** 项目空间内路径解析（防越界）。 */
+function resolveIn(base, p) {
+  const full = path.join(base, ...String(p || '').split('/').filter(Boolean));
+  if (full !== base && !full.startsWith(base + path.sep)) throw new Error('path escapes the space');
+  return full;
+}
+export async function makeDir({ node, space, path: p = '' } = {}) {
+  const base = await spaceBase({ node, space });
+  await fs.mkdir(resolveIn(base, p), { recursive: true });
+  return { path: p, created: true };
+}
+export async function renamePath({ node, space, from = '', to = '' } = {}) {
+  const base = await spaceBase({ node, space });
+  if (!from || !to) throw new Error('from/to are required');
+  await fs.rename(resolveIn(base, from), resolveIn(base, to));
+  return { from, to, renamed: true };
+}
+export async function removePath({ node, space, path: p = '' } = {}) {
+  const base = await spaceBase({ node, space });
+  if (!p) throw new Error('path is required');
+  await fs.rm(resolveIn(base, p), { recursive: true, force: true });
+  return { path: p, removed: true };
+}
+export async function gitStatus({ node, space } = {}) {
+  const base = await spaceBase({ node, space });
+  const run = (args) => new Promise((resolve) => {
+    const child = spawn('git', ['-C', base, ...args], { stdio: ['ignore', 'pipe', 'pipe'] });
+    let out = '';
+    child.stdout.on('data', (d) => { out += d; });
+    child.stderr.on('data', (d) => { out += d; });
+    child.on('close', (code) => resolve({ code, out }));
+    child.on('error', () => resolve({ code: -1, out: '' }));
+  });
+  const st = await run(['status', '--porcelain=v1', '-b']);
+  if (st.code !== 0) return { branch: '', ahead: 0, behind: 0, files: {}, changed: 0, commits: 0, error: st.out.slice(0, 200) };
+  const files = {};
+  let branch = '', ahead = 0, behind = 0;
+  st.out.split('\n').forEach((line) => {
+    if (!line) return;
+    if (line.startsWith('## ')) {
+      const head = line.slice(3);
+      const m = head.match(/^[^.\s]+/);
+      branch = m ? m[0] : '';
+      const a = head.match(/ahead (\d+)/); if (a) ahead = Number(a[1]);
+      const b = head.match(/behind (\d+)/); if (b) behind = Number(b[1]);
+      return;
+    }
+    const xy = line.slice(0, 2).trim();
+    let file = line.slice(3);
+    if (file.includes(' -> ')) file = file.split(' -> ').pop();
+    if (xy) files[file] = xy;
+  });
+  const hist = await run(['rev-list', '--count', 'HEAD']);
+  const log = await run(['log', '-n', '40', '--pretty=format:%h%x1f%s%x1f%an%x1f%ar']);
+  const history = log.code === 0
+    ? log.out.split('\n').filter(Boolean).map((line) => { const [hash, subject, author, when] = line.split('\x1f'); return { hash, subject, author, when }; })
+    : [];
+  return { branch, ahead, behind, files, changed: Object.keys(files).length, commits: Number((hist.out || '').trim()) || 0, history };
+}
+
+/** 项目空间的绝对路径（终端 cwd 用）。 */
+/** Node-level recent apps: gonganxitong.recent for the persistent DSH user. */
+/** Filesystem fallback: every src/<name>/portal.json is one app. */
+/** git init after dream create: required remote, otherwise no skeleton is written. */
+/** Platform-style app: service/autogen, then compile + verify portal. */

package/lib/core/gobuild.js

@@ -0,0 +1,63 @@
+// 核心业务：用本地 Go 工具链构建空间，不依赖宿主进程的 PATH。
+import path from 'node:path';
+import fsp from 'node:fs';
+import { spawn } from 'node:child_process';
+import { ctxRoot } from '../base/env.js';
+
+export function goBinary() {
+  const candidates = [
+    process.env.GO,
+    path.join(ctxRoot(), 'usr', 'local', 'go', 'bin', 'go'),
+    '/usr/local/go/bin/go',
+  ].filter(Boolean);
+  return candidates.find((p) => fsp.existsSync(p)) || '';
+}
+
+export function runGo(args, { cwd, timeout = 120000, env = null } = {}) {
+  const go = goBinary();
+  if (!go) return Promise.reject(new Error('Go toolchain not found; set GO or install usr/local/go'));
+  return new Promise((resolve, reject) => {
+    const child = spawn(go, args, {
+      cwd,
+      env: {
+        ...process.env,
+        ...(env || {}),
+        PATH: `${path.dirname(go)}:/usr/local/bin:/usr/bin:/bin`,
+        CGO_ENABLED: '0',
+        GOPROXY: process.env.GOPROXY || 'https://goproxy.cn,direct',
+      },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    let err = '';
+    const timer = setTimeout(() => {
+      child.kill('SIGKILL');
+      reject(new Error(`go ${args[0]} timed out`));
+    }, timeout);
+    child.stdout.on('data', (d) => { out += String(d); });
+    child.stderr.on('data', (d) => { err += String(d); });
+    child.on('error', (e) => { clearTimeout(timer); reject(e); });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve({ out, err });
+      else reject(new Error(`go ${args.join(' ')} failed (${code}): ${(err || out).trim().slice(-1200)}`));
+    });
+  });
+}
+
+/** Build `bin/ice.bin` for one space. */
+export async function goTidyBuild(dir) {
+  // 空间是独立模块：必须关掉节点的 go.work，否则 go 会把「主模块」认成
+  // shylinux.com/x/ContextOS，报 "main module ... does not contain package".
+  const real = await fsp.promises.realpath(dir).catch(() => dir);
+  if (!fsp.existsSync(path.join(real, 'go.mod'))) {
+    throw new Error(`space is not initialised (no go.mod in ${real})`);
+  }
+  const env = { ...process.env, GOWORK: 'off', GO111MODULE: 'on', GOFLAGS: '' };
+  await runGo(['mod', 'tidy'], { cwd: real, timeout: 180000, env });
+  await runGo(['build', '-ldflags', '-w -s', '-o', 'bin/ice.bin', './src'], {
+    cwd: real,
+    timeout: 300000,
+    env,
+  });
+}

package/lib/core/iam.js

@@ -0,0 +1,122 @@
+// 用户 / 会话 / 权限的统一入口。
+//
+// 系统级（节点自身）   用户 aaa.user   会话 aaa.sess   权限 aaa.role
+// 平台级（云社区）     用户 web.team.gonganxitong.user   会话 web.team.gonganxitong.sess
+// 应用级（每个实例）   成员 web.team.<mod>.member   申请 web.team.<mod>.apply   审批 web.team.<mod>.allow
+import { http, encode, envelopeRows } from '../base/http.js';
+import { parseTextTable } from '../base/texttable.js';
+import { fieldSegments } from '../base/field.js';
+
+// 系统级命令在 ice 里注册了短名：user / sess / role（aaa.* 是完整名，两者等价）
+export const IAM = {
+  system: { user: 'user', sess: 'sess', role: 'role' },
+  platform: { user: 'web.team.gonganxitong.user', sess: 'web.team.gonganxitong.sess' },
+  instance: { member: 'web.team.<mod>.member', apply: 'web.team.<mod>.apply', allow: 'web.team.<mod>.allow' },
+};
+
+export function iamCommand({ level = 'system', kind = 'user', mod = '' }) {
+  const table = IAM[level];
+  if (!table) throw new Error(`unknown level: ${level}`);
+  const tpl = table[kind];
+  if (!tpl) throw new Error(`unknown kind: ${level}.${kind}`);
+  if (!mod) return tpl;
+  return tpl.replace('<mod>', mod);
+}
+
+function iamPath({ level, node, space, command, uid = '' }) {
+  if (level === 'system') return `/c/${command}${uid ? `?user.uid=${encode(uid)}` : ''}`;
+  if (!space) throw new Error(`${level} commands need a space`);
+  return `/s/${encode(space)}/c/${command}${uid ? `?user.uid=${encode(uid)}` : ''}`;
+}
+
+/** 列表：系统级是文本表，平台/应用级是 JSON 信封，两者统一成 {columns, rows, url}。 */
+export async function iamList({ node, level = 'system', kind = 'user', space = '', mod = '', uid = '' }) {
+  const command = iamCommand({ level, kind, mod });
+  const path = iamPath({ level, node, space, command, uid });
+  const r = await http(node, path, { timeout: 15000, auth: !uid });
+  const url = `http://127.0.0.1:${node}${path}`;
+  if (level === 'system') {
+    const t = parseTextTable(r.text);
+    return { ...t, command, url, status: r.status, empty: t.rows.length === 0 };
+  }
+  let env = null;
+  try { env = JSON.parse(r.text); } catch { env = null; }
+  if (env && Array.isArray(env.append) && env.append.length) {
+    const { columns, rows } = envelopeRows(r.text);
+    return { columns, rows, command, url, status: r.status, empty: rows.length === 0 };
+  }
+  // 没有行：把回执摘要带回去，界面据此提示「需要实例上下文 / 暂无可管理数据」
+  const status = (() => { try { return JSON.parse((env && env._status) ? env._status[0] : '[]'); } catch { return []; } })();
+  return { columns: [], rows: [], command, url, status: r.status, empty: true, raw: status };
+}
+
+/** 通用动作：create / modify / remove / allow / apply …（PUT，字段走路径段）。 */
+export async function iamCall({ node, level = 'system', kind = 'user', space = '', mod = '', action = 'create', fields = {}, args = [], uid = '' }) {
+  const command = iamCommand({ level, kind, mod });
+  const base = iamPath({ level, node, space, command, uid: '' });
+  // 系统级命令多是位置参数（role create <name>），平台/应用级多是 k/v 段
+  const seg = args && args.length
+    ? args.map((v) => encode(v)).join('/')
+    : fieldSegments(fields || {});
+  const q = new URLSearchParams();
+  if (uid) q.set('user.uid', uid);
+  if (level === 'system' && !space) { /* 系统级不需要 pod */ }
+  const path = `${base}/action/${action}${seg ? '/' + seg : ''}${q.toString() ? '?' + q : ''}`;
+  const r = await http(node, path, { method: 'PUT', timeout: 20000, headers: { accept: 'application/json' } });
+  let env = null;
+  try { env = JSON.parse(r.text); } catch { env = null; }
+  const status = (() => { try { return JSON.parse((env && env._status) ? env._status[0] : '[]'); } catch { return []; } })();
+  const count = (status.find((x) => x.name === 'count') || {}).value || '';
+  const result = (env && env.result) || [];
+  const ok = r.status === 200 && !!env && count !== '0x0' ? true : r.status === 200 && !env;
+  return { ok, status: r.status, count, result, command, url: `http://127.0.0.1:${node}${path}`, text: env ? '' : String(r.text || '').slice(0, 200) };
+}
+
+/**
+ * 平台主体：一个平台里固定五类主体。
+ * 平台 / 城市 / 公司（街道、学校、医院等组织） / 服务（应用实例） / 个人。
+ */
+export const SUBJECTS = [
+  { type: 'platform', label: '平台', command: 'web.team.gonganxitong.place' },
+  { type: 'city', label: '城市', command: 'web.team.gonganxitong.city' },
+  { type: 'org', label: '公司/组织', command: 'web.team.gonganxitong.street' },
+  { type: 'service', label: '服务', command: 'web.team.gonganxitong.service' },
+  { type: 'user', label: '个人', command: 'web.team.gonganxitong.user' },
+];
+
+/** 资金与交易：现在存在的是经费 / 广场 / 名片，订单与账单尚未实现。 */
+export const FUND = [
+  { type: 'fund', label: '经费', command: 'web.team.gonganxitong.fund', ready: true },
+  { type: 'market', label: '人民广场', command: 'web.team.gonganxitong.market', ready: true },
+  { type: 'credit', label: '服务名片', command: 'web.team.gonganxitong.credit', ready: true },
+  { type: 'order', label: '订单', command: 'web.team.gonganxitong.order', ready: false },
+  { type: 'bill', label: '账单', command: 'web.team.gonganxitong.bill', ready: false },
+  { type: 'account', label: '资金账户', command: 'web.team.gonganxitong.account', ready: false },
+];
+
+/** 命令是否存在：真命令才有 index / help / list；不存在的命令只是回声信封。 */
+export async function commandExists({ node, space, command }) {
+  const r = await http(node, `/s/${encode(space)}/c/command/${command}`, { timeout: 10000 });
+  try {
+    const env = JSON.parse(r.text);
+    return !!(env.index || env.help || env.list || env.meta);
+  } catch { return false; }
+}
+
+export async function subjectEndpoints({ node, space = '20240724-community' }) {
+  const host = `http://127.0.0.1:${node}/s/${space}/c/`;
+  return SUBJECTS.map((x) => ({ ...x, url: host + x.command }));
+}
+
+/** 管理矩阵：把三层入口列出来，界面可以直接打开对应页面。 */
+export function iamEndpoints({ node, space = '20240724-community', mod = '' }) {
+  const host = `http://127.0.0.1:${node}`;
+  const out = [];
+  for (const [kind, command] of Object.entries(IAM.system)) out.push({ level: 'system', kind, command, url: `${host}/c/${command}` });
+  for (const [kind, command] of Object.entries(IAM.platform)) out.push({ level: 'platform', kind, command, url: `${host}/s/${space}/c/${command}` });
+  if (mod) for (const [kind, tpl] of Object.entries(IAM.instance)) {
+    const command = tpl.replace('<mod>', mod);
+    out.push({ level: 'instance', kind, command, url: `${host}/s/${space}/c/${command}` });
+  }
+  return out;
+}

package/lib/core/identity.js

@@ -0,0 +1,22 @@
+// 唯一身份：创建、访问、最近应用、打开网页都用同一个 user.uid。
+// 解析顺序：显式传入 → 节点上「当前分身」→ 节点自有账号。
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { stateDir } from '../base/env.js';
+import { ensureUser } from './users.js';
+
+const FILE = () => path.join(stateDir(), 'avatars.json');
+
+export async function activeAvatarUid(node) {
+  try {
+    const all = JSON.parse(await fs.readFile(FILE(), 'utf8'));
+    const bucket = all[String(Number(node))] || {};
+    const items = Array.isArray(bucket.items) ? bucket.items : [];
+    const hit = items.find((x) => x && x.uid === bucket.active) || items[0];
+    return hit && hit.uid ? String(hit.uid) : '';
+  } catch { return ''; }
+}
+
+export async function resolveActorUid(node, uid = '') {
+  return uid || await activeAvatarUid(node) || await ensureUser(node);
+}