dsh-my-observability 0.1.0

package/lib/parts/i18n.js

@@ -0,0 +1,67 @@
+    // ── i18n（浏览器语言判定）──────────────────────────────────────────
+    function isZh() {
+      try {
+        const lang = (navigator.language || 'en').toLowerCase()
+        return lang.startsWith('zh')
+      } catch {
+        return false
+      }
+    }
+
+    const strings = {
+      replayTitle: () => (isZh() ? '轨迹回放' : 'Trajectory'),
+      gitTitle: () => (isZh() ? 'Git 工具' : 'Git Tools'),
+      allSessions: () => (isZh() ? '全部会话' : 'All sessions'),
+      filterAll: () => (isZh() ? '全部' : 'All'),
+      filterStatus: () => (isZh() ? '状态' : 'Status'),
+      filterLlm: () => (isZh() ? '模型流' : 'LLM'),
+      filterTools: () => (isZh() ? '工具' : 'Tools'),
+      emptyEvents: () => (isZh() ? '暂无审计事件——开始一段对话后，agent 的行为会出现在这里' : 'No audit events yet — agent activity will appear here after a conversation'),
+      loadError: () => (isZh() ? '加载失败' : 'Load failed'),
+      typeAgentStatus: () => (isZh() ? 'agent 状态' : 'agent status'),
+      typeLlmStream: () => (isZh() ? '模型流' : 'LLM stream'),
+      typeToolCall: () => (isZh() ? '工具调用' : 'tool call'),
+      typeToolResult: () => (isZh() ? '工具结果' : 'tool result'),
+      phaseStart: () => (isZh() ? '开始' : 'start'),
+      phaseEnd: () => (isZh() ? '结束' : 'end'),
+      phaseError: () => (isZh() ? '错误' : 'error'),
+      agentTop: () => (isZh() ? '顶层' : 'top'),
+      agentSub: () => (isZh() ? '子代理' : 'subagent'),
+      agentUnknown: () => (isZh() ? '未知' : 'unknown'),
+      toolOk: () => (isZh() ? '成功' : 'ok'),
+      toolFail: () => (isZh() ? '失败' : 'failed'),
+      // Git 面板
+      repoLabel: () => (isZh() ? '仓库路径' : 'Repo path'),
+      repoPlaceholder: () => (isZh() ? '如 /path/to/project' : 'e.g. /path/to/project'),
+      loadRepo: () => (isZh() ? '加载' : 'Load'),
+      branch: () => (isZh() ? '分支' : 'Branch'),
+      staged: () => (isZh() ? '已暂存' : 'staged'),
+      unstaged: () => (isZh() ? '未暂存' : 'unstaged'),
+      clean: () => (isZh() ? '工作区干净' : 'Working tree clean'),
+      diffTitle: () => (isZh() ? '差异' : 'Diff'),
+      showDiff: () => (isZh() ? '查看差异' : 'Show diff'),
+      showStagedDiff: () => (isZh() ? '查看暂存差异' : 'Staged diff'),
+      noChanges: () => (isZh() ? '没有变更' : 'No changes'),
+      review: () => (isZh() ? '提交前审查' : 'Review'),
+      reviewAi: () => (isZh() ? 'AI 审查' : 'AI review'),
+      reviewResult: () => (isZh() ? '审查结果' : 'Review result'),
+      reviewPass: () => (isZh() ? '未发现问题' : 'No issues found'),
+      issues: (count) => (isZh() ? `${count} 个问题` : `${count} issue(s)`),
+      commitTitle: () => (isZh() ? '类型化提交' : 'Typed commit'),
+      commitType: () => (isZh() ? '类型' : 'Type'),
+      commitScope: () => (isZh() ? '范围（可选）' : 'Scope (optional)'),
+      commitDesc: () => (isZh() ? '描述' : 'Description'),
+      commitBody: () => (isZh() ? '正文（可选）' : 'Body (optional)'),
+      commit: () => (isZh() ? '提交' : 'Commit'),
+      committed: () => (isZh() ? '已提交' : 'Committed'),
+      commitError: () => (isZh() ? '提交失败' : 'Commit failed'),
+      severityError: () => (isZh() ? '错误' : 'Error'),
+      severityWarning: () => (isZh() ? '警告' : 'Warning'),
+      severityInfo: () => (isZh() ? '提示' : 'Info'),
+      aiVerdictApprove: () => (isZh() ? 'AI 结论：可以提交' : 'AI verdict: approve'),
+      aiVerdictChanges: () => (isZh() ? 'AI 结论：建议修改' : 'AI verdict: changes'),
+      aiFailed: () => (isZh() ? 'AI 审查不可用' : 'AI review unavailable'),
+      loading: () => (isZh() ? '加载中…' : 'Loading…'),
+      emptyDiff: () => (isZh() ? '（空）' : '(empty)'),
+      noRepo: () => (isZh() ? '请输入仓库路径' : 'Enter a repo path'),
+    }

package/lib/parts/replay.js

@@ -0,0 +1,199 @@
+    // ── 轨迹回放面板（时间轴）──────────────────────────────────────────
+    const REPLAY_POLL_MS = 5000
+
+    /** 请求插件 API（非 2xx 抛错；返回响应 JSON 的 value 字段）。 */
+    function apiJson(path, options) {
+      return fetch(path, options).then(async (res) => {
+        const data = await res.json()
+        if (!res.ok) throw new Error(data.error?.message || `HTTP ${res.status}`)
+        return data.value
+      })
+    }
+
+    /** 事件类型 → 中文标签。 */
+    function typeLabel(event) {
+      switch (event.type) {
+        case 'agent_status': return strings.typeAgentStatus()
+        case 'llm_stream': return strings.typeLlmStream()
+        case 'tool_call': return strings.typeToolCall()
+        case 'tool_result': return strings.typeToolResult()
+        default: return event.type
+      }
+    }
+
+    /** 事件类型 → 徽标样式类别。 */
+    function badgeKind(event) {
+      if (event.type === 'agent_status') return 'status'
+      if (event.type === 'llm_stream') return 'llm'
+      return 'tool'
+    }
+
+    /** 时间戳 → HH:MM:SS。 */
+    function timeText(time) {
+      try {
+        const date = new Date(time)
+        const pad = (n) => String(n).padStart(2, '0')
+        return `${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`
+      } catch {
+        return ''
+      }
+    }
+
+    /** agent 类型标记 → 中文。 */
+    function agentTypeText(agentType) {
+      if (agentType === 'top') return strings.agentTop()
+      if (agentType === 'subagent') return strings.agentSub()
+      return strings.agentUnknown()
+    }
+
+    /** 模型流阶段 → 中文。 */
+    function phaseText(phase) {
+      if (phase === 'start') return strings.phaseStart()
+      if (phase === 'end') return strings.phaseEnd()
+      if (phase === 'error') return strings.phaseError()
+      return phase
+    }
+
+    /** agent 状态事件摘要。 */
+    function agentMeta(data) {
+      return `状态 ${data.status} · ${agentTypeText(data.agentType)}`
+    }
+
+    /** 模型流事件摘要（开始/结束/错误 + 统计）。 */
+    function llmMeta(data) {
+      const stats = data.phase === 'start' ? '' : ` · ${data.chunks} chunks / ${data.chars} chars / ${data.ms}ms`
+      const error = data.message !== undefined ? `：${data.message}` : ''
+      return `${phaseText(data.phase)}${stats}${error}`
+    }
+
+    /** 工具调用事件摘要（名称 + 参数摘要）。 */
+    function toolCallMeta(data) {
+      const args = data.args && data.args.summary !== undefined ? ` — ${data.args.summary}` : ''
+      return `${data.name}${args}`
+    }
+
+    /** 工具结果事件摘要（名称 + 成败 + 耗时）。 */
+    function toolResultMeta(data) {
+      const result = data.ok === false ? strings.toolFail() : strings.toolOk()
+      return `${data.name} · ${result} · ${data.ms}ms`
+    }
+
+    /** 事件 → 摘要文本（单行，尽力而为）。 */
+    function eventMeta(event) {
+      const data = event.data || {}
+      if (event.type === 'agent_status') return agentMeta(data)
+      if (event.type === 'llm_stream') return llmMeta(data)
+      if (event.type === 'tool_call') return toolCallMeta(data)
+      if (event.type === 'tool_result') return toolResultMeta(data)
+      return ''
+    }
+
+    /** 单条事件行（徽标 + 时间 + 摘要）。 */
+    function EventRow({ event }) {
+      const meta = eventMeta(event)
+      return createElement('div', { className: 'dso-event' },
+        createElement('div', { className: 'dso-event-head' },
+          createElement('span', { className: `dso-badge dso-badge-${badgeKind(event)}` }, typeLabel(event)),
+          createElement('span', { className: 'dso-time' }, timeText(event.time)),
+        ),
+        meta !== '' ? createElement('div', { className: 'dso-event-meta' }, meta) : null,
+      )
+    }
+
+    /** 类型过滤按钮组。 */
+    function TypeFilter({ filter, onFilter }) {
+      const options = [
+        ['', strings.filterAll()],
+        ['agent_status', strings.filterStatus()],
+        ['llm_stream', strings.filterLlm()],
+        ['tool', strings.filterTools()],
+      ]
+      return createElement('div', { className: 'dso-filters' },
+        options.map(([value, label]) => createElement('button', {
+          key: value,
+          className: `dso-chip${filter === value ? ' dso-chip-active' : ''}`,
+          onClick: () => onFilter(value),
+        }, label)),
+      )
+    }
+
+    /** 按过滤条件筛选事件（tool = tool_call + tool_result）。 */
+    function filterEvents(events, filter) {
+      if (filter === '') return events
+      return events.filter((event) => filter === 'tool'
+        ? event.type === 'tool_call' || event.type === 'tool_result'
+        : event.type === filter)
+    }
+
+    /** 拉取会话列表与事件（选中为空时自动选当前/首个会话）。 */
+    async function loadReplayData(selected, currentSession, setters) {
+      try {
+        const list = await apiJson('/observability/api/sessions')
+        setters.setSessions(list)
+        if (selected === '' && list.length > 0) {
+          const preferred = list.some((s) => s.sessionId === currentSession) ? currentSession : list[0].sessionId
+          setters.setSelected(preferred)
+          return
+        }
+        const query = selected !== ''
+          ? `/observability/api/events?sessionId=${encodeURIComponent(selected)}&limit=300`
+          : '/observability/api/events?limit=0'
+        setters.setEvents(await apiJson(query))
+        setters.setError('')
+      } catch (err) {
+        setters.setError(err instanceof Error ? err.message : String(err))
+      } finally {
+        setters.setLoading(false)
+      }
+    }
+
+    /** 工具栏：会话选择 + 类型过滤。 */
+    function ReplayToolbar({ sessions, selected, onSelect, filter, onFilter }) {
+      return createElement('div', { className: 'dso-toolbar' },
+        createElement('select', {
+          className: 'dso-select',
+          value: selected,
+          onChange: (e) => onSelect(e.target.value),
+        },
+        sessions.length === 0
+          ? createElement('option', { value: '' }, strings.allSessions())
+          : sessions.map((s) => createElement('option', { key: s.sessionId, value: s.sessionId }, s.sessionId)),
+        ),
+        createElement(TypeFilter, { filter, onFilter }),
+      )
+    }
+
+    /** 轨迹回放主面板：会话选择 + 类型过滤 + 时间轴（可见时轮询）。 */
+    function ReplayPanel(props) {
+      const currentSession = props.scope?.sessionId || ''
+      const visible = props.visible !== false
+      const [sessions, setSessions] = useState([])
+      const [selected, setSelected] = useState('')
+      const [filter, setFilter] = useState('')
+      const [events, setEvents] = useState([])
+      const [loading, setLoading] = useState(true)
+      const [error, setError] = useState('')
+
+      useEffect(() => {
+        if (!visible) return undefined
+        let alive = true
+        const setters = { setSessions, setSelected, setEvents, setError, setLoading }
+        const tick = () => { if (alive) void loadReplayData(selected, currentSession, setters) }
+        tick()
+        const timer = setInterval(tick, REPLAY_POLL_MS)
+        return () => { alive = false; clearInterval(timer) }
+      }, [visible, selected, currentSession])
+
+      const filtered = filterEvents(events, filter)
+      const rows = filtered.map((event, index) => createElement(EventRow, { key: event.id ?? index, event }))
+
+      return createElement('div', { className: 'dso-panel' },
+        createElement(ReplayToolbar, { sessions, selected, onSelect: setSelected, filter, onFilter: setFilter }),
+        error !== '' ? createElement('div', { className: 'dso-empty' }, `${strings.loadError()}：${error}`) : null,
+        loading && error === '' ? createElement('div', { className: 'dso-empty' }, strings.loading()) : null,
+        !loading && error === '' && filtered.length === 0
+          ? createElement('div', { className: 'dso-empty' }, strings.emptyEvents())
+          : null,
+        createElement('div', { className: 'dso-timeline' }, rows),
+      )
+    }

package/lib/parts/styles.js

@@ -0,0 +1,68 @@
+    // ── 样式（DSH 语义 token，随 activation 注入 / teardown 卸载）──────
+    const STYLES = `
+.dso-panel{display:flex;flex-direction:column;gap:10px;padding:12px;color:var(--dsw-alias-label-primary)}
+.dso-toolbar{display:flex;flex-direction:column;gap:8px}
+.dso-select{flex:1;min-width:0;font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-primary);
+  background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:6px;padding:4px 8px}
+.dso-input{flex:1;min-width:0;font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-primary);
+  background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:6px;padding:4px 8px}
+.dso-input::placeholder{color:var(--dsw-alias-label-tertiary)}
+.dso-repo-row{display:flex;gap:8px;align-items:center}
+.dso-repo-input{flex:1}
+.dso-filters{display:flex;gap:6px;flex-wrap:wrap}
+.dso-chip{font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-secondary);background:transparent;
+  border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:2px 10px;cursor:pointer}
+.dso-chip-active{color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-interactive-primary);
+  background:color-mix(in srgb, var(--dsw-alias-interactive-primary) 12%, transparent)}
+.dso-timeline{display:flex;flex-direction:column;gap:6px;max-height:calc(100vh - 240px);overflow-y:auto}
+.dso-event{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 10px}
+.dso-event-head{display:flex;align-items:center;gap:8px;justify-content:space-between}
+.dso-badge{flex:none;font:var(--dsw-font-xxxs-strong-11);border-radius:4px;padding:1px 6px}
+.dso-badge-status{color:var(--dsw-alias-state-info-primary);background:color-mix(in srgb, var(--dsw-alias-state-info-primary) 14%, transparent)}
+.dso-badge-llm{color:var(--dsw-alias-state-warn-primary);background:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 14%, transparent)}
+.dso-badge-tool{color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 14%, transparent)}
+.dso-time{font:var(--dsw-font-xxxs-11);color:var(--dsw-alias-label-tertiary)}
+.dso-event-meta{font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-secondary);line-height:1.6;word-break:break-word;margin-top:2px}
+.dso-empty{font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-tertiary);text-align:center;padding:16px 8px;line-height:1.7}
+.dso-status{font:var(--dsw-font-xxs-strong-12);color:var(--dsw-alias-label-secondary)}
+.dso-actions{display:flex;gap:8px;flex-wrap:wrap}
+.dso-btn{font:var(--dsw-font-xxs-strong-12);color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-layer-2);
+  border:1px solid var(--dsw-alias-border-l2);border-radius:6px;padding:4px 12px;cursor:pointer}
+.dso-btn:hover{background:var(--dsw-alias-interactive-bg-hover)}
+.dso-btn:disabled{opacity:.5;cursor:default}
+.dso-btn-primary{color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-interactive-primary);
+  background:color-mix(in srgb, var(--dsw-alias-interactive-primary) 16%, transparent)}
+.dso-section{display:flex;flex-direction:column;gap:6px;border-top:1px solid var(--dsw-alias-border-l2);padding-top:8px}
+.dso-section-title{font:var(--dsw-font-xs-strong-13);color:var(--dsw-alias-label-primary)}
+.dso-diff{max-height:240px;overflow:auto;font:var(--dsw-font-mono-xxs);font-size:11px;line-height:1.5;
+  color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);
+  border-radius:6px;padding:8px;white-space:pre-wrap;word-break:break-all}
+.dso-form{display:flex;flex-direction:column;gap:6px}
+.dso-type{flex:none;width:96px}
+.dso-textarea{min-height:52px;resize:vertical;font:var(--dsw-font-xxs-12)}
+.dso-feedback{font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-secondary);word-break:break-all;line-height:1.5}
+.dso-issue{display:flex;flex-direction:column;gap:2px;border-radius:6px;padding:6px 8px;font:var(--dsw-font-xxs-12)}
+.dso-issue-error{background:color-mix(in srgb, var(--dsw-alias-state-danger-primary) 12%, transparent)}
+.dso-issue-warning{background:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 12%, transparent)}
+.dso-issue-info{background:color-mix(in srgb, var(--dsw-alias-state-info-primary) 10%, transparent)}
+.dso-issue-sev{font:var(--dsw-font-xxxs-strong-11);text-transform:uppercase}
+.dso-issue-error .dso-issue-sev{color:var(--dsw-alias-state-danger-primary)}
+.dso-issue-warning .dso-issue-sev{color:var(--dsw-alias-state-warn-primary)}
+.dso-issue-info .dso-issue-sev{color:var(--dsw-alias-state-info-primary)}
+.dso-issue-rule{font:var(--dsw-font-mono-xxs);font-size:11px;color:var(--dsw-alias-label-secondary)}
+.dso-issue-msg{color:var(--dsw-alias-label-primary);line-height:1.5}
+.dso-review-ok{font:var(--dsw-font-xxs-strong-12);color:var(--dsw-alias-state-success-primary)}
+.dso-ai{font:var(--dsw-font-xxs-12);color:var(--dsw-alias-label-secondary);line-height:1.5;
+  border:1px dashed var(--dsw-alias-border-l2);border-radius:6px;padding:6px 8px}
+`
+
+    function injectStyles() {
+      if (typeof document === 'undefined' || typeof document.head === 'undefined') return () => {}
+      const style = document.createElement('style')
+      style.setAttribute('data-dsh-my-observability', 'styles')
+      style.textContent = STYLES
+      document.head.appendChild(style)
+      return () => {
+        if (style.parentNode !== null) style.parentNode.removeChild(style)
+      }
+    }

package/lib/review.js

@@ -0,0 +1,126 @@
+/**
+ * dsh-my-observability — incremental diff review (rule engine).
+ *
+ * 提交前增量 diff 审查：确定性规则引擎（纯函数，可独立测试），检查：
+ *  - debug-statement   调试残留（console.* / debugger / print 族）→ warning
+ *  - secret-leak       密钥/凭据硬编码（password/api_key/secret/token）→ error
+ *  - conflict-marker   合并冲突标记残留（<<<<<<< / ======= / >>>>>>>）→ error
+ *  - todo-marker       TODO/FIXME/HACK 标记 → info
+ *  - trailing-space    新增行尾随空格 → info
+ *  - large-diff        单文件变更超阈值 → warning
+ *  - binary-file       二进制文件变更 → warning
+ *  - no-test-change    有源码变更但无测试变更 → info
+ *
+ * AI 增强审查见 lib/ai.js（可选，agents 服务可用时追加 LLM 结论）。
+ */
+import { isTestFile, isSourceFile } from './diff.js'
+
+/** 单文件变更行数阈值（large-diff 规则）。 */
+export const LARGE_DIFF_LINES = 300
+
+/** 对已解析 diff 运行规则引擎，返回 { summary, issues }。 */
+export function reviewRules(parsed) {
+  const issues = []
+  for (const file of parsed.files) {
+    for (const added of file.addedLines) {
+      pushIf(issues, debugIssue(file, added))
+      pushIf(issues, secretIssue(file, added))
+      pushIf(issues, conflictIssue(file, added))
+      pushIf(issues, todoIssue(file, added))
+      pushIf(issues, trailingIssue(file, added))
+    }
+    pushIf(issues, largeDiffIssue(file))
+    pushIf(issues, binaryIssue(file))
+  }
+  pushIf(issues, noTestIssue(parsed))
+  return summarize(parsed, issues)
+}
+
+/** 汇总：变更统计 + 问题分级计数。 */
+function summarize(parsed, issues) {
+  const files = parsed.files
+  const insertions = files.reduce((sum, file) => sum + file.insertions, 0)
+  const deletions = files.reduce((sum, file) => sum + file.deletions, 0)
+  return {
+    issues,
+    summary: {
+      files: files.length,
+      insertions,
+      deletions,
+      issues: issues.length,
+      errors: countBy(issues, 'error'),
+      warnings: countBy(issues, 'warning'),
+      infos: countBy(issues, 'info'),
+      binary: parsed.binary,
+    },
+  }
+}
+
+function countBy(issues, severity) {
+  return issues.filter((issue) => issue.severity === severity).length
+}
+
+function pushIf(issues, issue) {
+  if (issue !== undefined) issues.push(issue)
+}
+
+/** 调试残留（console.* / debugger / print 族）。 */
+function debugIssue(file, added) {
+  if (!/console\.(log|debug|warn|info|error)|debugger\b|\bprint\(|println\(|System\.out\.print/.test(added.text)) return undefined
+  return issue('warning', 'debug-statement', file, added, '调试残留语句（console/print/debugger）')
+}
+
+/** 密钥/凭据硬编码。 */
+function secretIssue(file, added) {
+  if (!/(password|passwd|api[_-]?key|secret|access[_-]?token|auth[_-]?token)\s*[:=]\s*['"][^'"]{4,}['"]/i.test(added.text)) return undefined
+  return issue('error', 'secret-leak', file, added, '疑似硬编码密钥/凭据')
+}
+
+/** 合并冲突标记残留。 */
+function conflictIssue(file, added) {
+  if (!/^(<<<<<<<|=======|>>>>>>>)/.test(added.text)) return undefined
+  return issue('error', 'conflict-marker', file, added, '合并冲突标记残留')
+}
+
+/** TODO/FIXME 标记。 */
+function todoIssue(file, added) {
+  if (!/\b(TODO|FIXME|HACK|XXX)\b/.test(added.text)) return undefined
+  return issue('info', 'todo-marker', file, added, 'TODO/FIXME 标记')
+}
+
+/** 尾随空格。 */
+function trailingIssue(file, added) {
+  if (!/\s+$/.test(added.text)) return undefined
+  return issue('info', 'trailing-space', file, added, '行尾多余空格')
+}
+
+/** 单文件变更超阈值。 */
+function largeDiffIssue(file) {
+  const changed = file.insertions + file.deletions
+  if (changed <= LARGE_DIFF_LINES || file.binary) return undefined
+  return issue('warning', 'large-diff', file, null, `单文件变更 ${changed} 行（>${LARGE_DIFF_LINES}），建议拆分提交`)
+}
+
+/** 二进制文件变更。 */
+function binaryIssue(file) {
+  if (!file.binary) return undefined
+  return issue('warning', 'binary-file', file, null, '二进制文件变更')
+}
+
+/** 有源码变更但无测试变更。 */
+function noTestIssue(parsed) {
+  const sourceFiles = parsed.files.filter((file) => isSourceFile(file.path))
+  const testFiles = parsed.files.filter((file) => isTestFile(file.path))
+  if (sourceFiles.length === 0 || testFiles.length > 0) return undefined
+  return issue('info', 'no-test-change', null, null, '有源码变更但没有测试文件变更')
+}
+
+function issue(severity, rule, file, added, message) {
+  return {
+    severity,
+    rule,
+    file: file?.path ?? '',
+    line: added?.line ?? 0,
+    message,
+  }
+}

package/lib/routes.js

@@ -0,0 +1,215 @@
+/**
+ * dsh-my-observability — /observability/api routes.
+ *
+ * 所有请求先做 loopback 信任围栏（与 /api 网关一致的契约）。方法分派：
+ *  - GET  /sessions                — 有审计事件的会话列表
+ *  - GET  /events?sessionId&type&limit — 会话事件（时间轴正序）
+ *  - GET  /status                  — 审计统计 + 功能开关
+ *  - GET  /git/status?repo=        — 仓库状态（分支 + 变更）
+ *  - GET  /git/diff?repo=&staged=  — 差异文本
+ *  - POST /git/commit              — 类型化提交（Conventional Commits）
+ *  - POST /review                  — 增量 diff 审查（规则引擎 + 可选 AI）
+ */
+import { isTrustedApiRequest } from './fence.js'
+import { gitStatus, gitDiff, gitCommit } from './git.js'
+import { parseDiff } from './diff.js'
+import { reviewRules } from './review.js'
+import { runAiReview } from './ai.js'
+
+/** 注册 /observability/api 路由（effect 持有 disposer）。 */
+export function registerObservabilityRoutes(ctx, store, options) {
+  const webRuntime = ctx.get ? ctx.get('webRuntime') : undefined
+  const trustedHosts = webRuntime !== undefined && webRuntime !== null && Array.isArray(webRuntime.trustedHosts)
+    ? webRuntime.trustedHosts
+    : []
+  const fence = (request) => isTrustedApiRequest(request, trustedHosts)
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: '/observability/api',
+    handler: apiHandler(ctx, fence, store, options),
+  }), 'dsh-my-observability: /observability/api routes')
+}
+
+/** 统一 handler：fence → 方法分派 → 404/错误兜底。 */
+function apiHandler(ctx, fence, store, options) {
+  return async (request, response) => {
+    if (!fence(request)) {
+      writeJson(response, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden' } })
+      return
+    }
+    const url = new URL(request.url ?? '/', 'http://dsh.internal')
+    const pathname = url.pathname
+    const method = pathname.startsWith('/observability/api/') ? pathname.slice('/observability/api/'.length) : undefined
+    try {
+      const handled = await dispatchMethod(method, request, response, url, ctx, store, options)
+      if (!handled) {
+        writeJson(response, 404, { ok: false, error: { message: 'unknown dsh-my-observability API method' } })
+      }
+    } catch (error) {
+      writeError(response, error)
+    }
+  }
+}
+
+/** 方法 + 请求动词匹配。 */
+function isMethod(method, request, name, verb) {
+  return method === name && request.method === verb
+}
+
+/** 按 method 分派到具体 handler；未识别返回 false（调用方回 404）。 */
+async function dispatchMethod(method, request, response, url, ctx, store, options) {
+  if (isMethod(method, request, 'sessions', 'GET')) {
+    writeJson(response, 200, { ok: true, value: store.sessions() })
+    return true
+  }
+  if (isMethod(method, request, 'events', 'GET')) {
+    writeJson(response, 200, { ok: true, value: store.events(queryOf(url, 'sessionId'), queryOf(url, 'type'), limitOf(url)) })
+    return true
+  }
+  if (isMethod(method, request, 'status', 'GET')) {
+    writeJson(response, 200, { ok: true, value: statusValue(store, options) })
+    return true
+  }
+  if (isMethod(method, request, 'git/status', 'GET')) {
+    await handleGitStatus(response, repoOf(url))
+    return true
+  }
+  if (isMethod(method, request, 'git/diff', 'GET')) {
+    await handleGitDiff(response, repoOf(url), url.searchParams.get('staged') === '1')
+    return true
+  }
+  if (isMethod(method, request, 'git/commit', 'POST')) {
+    await handleGitCommit(request, response)
+    return true
+  }
+  if (isMethod(method, request, 'review', 'POST')) {
+    await handleReview(ctx, request, response, options)
+    return true
+  }
+  return false
+}
+
+// ── handlers ───────────────────────────────────────────────────────────────
+
+/** 状态：审计统计 + 功能开关（aiReview 只暴露开关）。 */
+function statusValue(store, options) {
+  return {
+    auditCount: store.count(),
+    sessions: store.sessions().length,
+    aiReview: options.aiReview !== false,
+    gitEnabled: true,
+  }
+}
+
+/** git status：非仓库路径 400。 */
+async function handleGitStatus(response, repoPath) {
+  if (repoPath === '') {
+    writeJson(response, 400, { ok: false, error: { message: 'repo query param required' } })
+    return
+  }
+  const result = await gitStatus(repoPath)
+  if (!result.ok) {
+    writeJson(response, 400, { ok: false, error: result.error })
+    return
+  }
+  writeJson(response, 200, { ok: true, value: result })
+}
+
+/** git diff：非仓库路径 400。 */
+async function handleGitDiff(response, repoPath, staged) {
+  if (repoPath === '') {
+    writeJson(response, 400, { ok: false, error: { message: 'repo query param required' } })
+    return
+  }
+  const result = await gitDiff(repoPath, staged)
+  if (!result.ok) {
+    writeJson(response, 400, { ok: false, error: result.error })
+    return
+  }
+  writeJson(response, 200, { ok: true, value: { text: result.text } })
+}
+
+/** 类型化提交：body { repoPath, type, scope, description, body }。 */
+async function handleGitCommit(request, response) {
+  const payload = await readJsonBody(request)
+  const repoPath = typeof payload.repoPath === 'string' ? payload.repoPath : ''
+  if (repoPath === '') {
+    writeJson(response, 400, { ok: false, error: { message: 'repoPath required' } })
+    return
+  }
+  const result = await gitCommit(repoPath, payload)
+  if (!result.ok) {
+    writeJson(response, 400, { ok: false, error: result.error })
+    return
+  }
+  writeJson(response, 200, {
+    ok: true,
+    value: { hash: result.hash, message: result.message, summary: result.summary },
+  })
+}
+
+/** 增量 diff 审查：规则引擎 + 可选 AI 增强（失败不影响规则结果）。 */
+async function handleReview(ctx, request, response, options) {
+  const payload = await readJsonBody(request)
+  const repoPath = typeof payload.repoPath === 'string' ? payload.repoPath : ''
+  if (repoPath === '') {
+    writeJson(response, 400, { ok: false, error: { message: 'repoPath required' } })
+    return
+  }
+  const staged = payload.staged === true
+  const diffResult = await gitDiff(repoPath, staged)
+  if (!diffResult.ok) {
+    writeJson(response, 400, { ok: false, error: diffResult.error })
+    return
+  }
+  const report = reviewRules(parseDiff(diffResult.text))
+  report.ai = await aiOutcome(ctx, payload, options, diffResult.text, report)
+  writeJson(response, 200, { ok: true, value: report })
+}
+
+/** AI 审查开关判定：配置开启 + 请求未显式关闭 → 运行（失败降级）。 */
+async function aiOutcome(ctx, payload, options, diffText, report) {
+  if (options.aiReview === false) return { enabled: false }
+  if (payload.aiReview === false) return { enabled: false }
+  return runAiReview(ctx, diffText, report, options.aiTimeoutMs)
+}
+
+// ── HTTP helpers ───────────────────────────────────────────────────────────
+
+function queryOf(url, name) {
+  return url.searchParams.get(name) ?? ''
+}
+
+function repoOf(url) {
+  const repo = url.searchParams.get('repo')
+  return typeof repo === 'string' ? repo : ''
+}
+
+function limitOf(url) {
+  const raw = url.searchParams.get('limit')
+  const parsed = raw === null ? 0 : Number(raw)
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 0
+}
+
+/** Read a JSON request body (bounded). */
+async function readJsonBody(request) {
+  let body = ''
+  for await (const chunk of request) {
+    body += chunk
+    if (body.length > 1_000_000) throw new Error('request body too large')
+  }
+  if (body === '') return {}
+  return JSON.parse(body)
+}
+
+function writeJson(response, status, value) {
+  const payload = JSON.stringify(value)
+  response.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-cache' })
+  response.end(payload)
+}
+
+function writeError(response, error) {
+  const message = error instanceof Error ? error.message : String(error)
+  writeJson(response, 400, { ok: false, error: { message } })
+}