dsh-subagent-profile 0.3.2 → 0.3.3

package/lib/core/http-routes.mjs

@@ -1,21 +1,19 @@
-// lib/core/http-routes.mjs — settings HTTP loopback routes for the Client UI.
-// Read routes (list / options summary / per-model efforts / tools) + write
-// routes (set-enabled / add / remove / reset / reset-all / set-profile-enabled).
-// The /options catalog (models / presets / tools / efforts) is served from the
-// shared catalog cache (lib/core/catalog-cache.mjs), so these routes no longer
-// walk the llm directory themselves.
+// lib/core/http-routes.mjs — Client UI 的设置 HTTP loopback 路由。
+// 读路由（list / options 摘要 / 按模型 efforts / tools）+ 写路由
+// （set-enabled / add / remove / reset / reset-all / set-profile-enabled）。
+// /options 目录（models / presets / tools / efforts）由共享 catalog 缓存
+// （lib/core/catalog-cache.mjs）提供，这些路由不再自行遍历 llm 目录。
 //
-// Injection: every apply-closure / ctx dependency is an explicit parameter —
-//   store         the profile store (profiles Map / persistProfiles /
-//                 persistEnabled / deletedBuiltins),
-//   getEnabled    reads the apply-closure `enabled` flag (mutated by
-//                 /set-enabled),
-//   setEnabled    writes it,
-//   syncTool      unregisters/registers the dispatch tool on /set-enabled,
-//   catalog       the shared catalog cache (getSnapshot / invalidate),
-//   logger        ctx.logger (route error warnings).
-// The factory returns the scope.effect setup function so the caller keeps the
-// exact original registration shape: effect(() => register + disposer).
+// 注入：所有 apply 闭包 / ctx 依赖都是显式参数——
+//   store         profile store（profiles Map / persistProfiles /
+//                 persistEnabled / deletedBuiltins），
+//   getEnabled    读取 apply 闭包 `enabled` 标志（被 /set-enabled 改写），
+//   setEnabled    写它，
+//   syncTool      在 /set-enabled 时注销/注册 dispatch 工具，
+//   catalog       共享 catalog 缓存（getSnapshot / invalidate），
+//   logger        ctx.logger（路由错误告警）。
+// 工厂返回 scope.effect 设置函数，调用方保持原有注册形状：
+// effect(() => register + disposer)。
 //
 // 写路由各抽为模块级处理函数（if 链分发保持）；/options 拆三读路由 + 手动刷新，
 // 目录数据统一来自 catalog 快照。
@@ -24,9 +22,18 @@ import { sanitizeProfile } from './pure.mjs';
 import { BUILTIN_SEEDS } from './profiles-store.mjs';
 import { detectVersions } from './shims.mjs';
 
-// Only the loopback interfaces may drive the settings HTTP routes.
+// 只有 loopback 接口可以驱动设置 HTTP 路由。
 const LOOPBACKS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
 
+// 写路由 CSRF 传输授权三件套。loopback 只挡「来源不是本机」；这三件挡「浏览器里的
+// 跨域表单/脚本冒充本机提交」——schema 校验的是数据形状，管不到谁有权写。
+// URL.hostname 对 IPv6 字面量返回带方括号形态（http://[::1]:port → '[::1]'），
+// 两种形态都列入，避免 IPv6 loopback 源被误拒。
+const LOOPBACK_ORIGIN_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+const CSRF_HEADER = 'X-DSH-Plugin';
+const CSRF_HEADER_KEY = CSRF_HEADER.toLowerCase();
+const CSRF_HEADER_VALUE = 'dsh-subagent-profile';
+
 function json(res, code, data) {
   res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' });
   res.end(JSON.stringify(data));
@@ -48,10 +55,9 @@ function readBody(req) {
   });
 }
 
-// Write-failure contract: the write routes return HTTP 200 with
-// `persisted` always present; when the disk write failed, persistWarning
-// explains "已保存但未持久化" (in-memory state drives this process, the
-// disk did not update). The client renders that as the amber warning.
+// 写失败契约：写路由返回 HTTP 200 且 `persisted` 恒在场；磁盘写失败时
+// persistWarning 说明「已保存但未持久化」（内存态驱动本进程，磁盘未更新）。
+// 客户端把它渲染为琥珀色警告。
 function persistOk(res, payload, persist) {
   return json(res, 200, {
     ok: true,
@@ -65,8 +71,8 @@ function listClean(store) {
   return [...store.profiles.values()].map((profile) => {
     const clean = {};
     for (const [key, value] of Object.entries(profile)) if (value !== undefined && key !== 'persisted') clean[key] = value;
-    // The internal `persisted` flag is stripped above; expose a UI-facing
-    // "modified" signal so the reset panel can label a changed builtin.
+    // 内部 `persisted` 标志已在上方剥离；对外暴露 UI 面向的 "modified"
+    // 信号，供重置面板标注被改过的内置方案。
     if (profile.builtin === true && profile.persisted === true) clean.modified = true;
     return clean;
   });
@@ -78,10 +84,20 @@ async function handleList(deps, res) {
   return json(res, 200, { ok: true, profiles: listClean(deps.store) });
 }
 
-// 轻量摘要：enabled + 模型目录（含 provider 信息，客户端据此派生提供方列表）+ 预设名册。
+// 轻量摘要：enabled + evolutionAdvice + 模型目录（含 provider 信息，客户端据此派生提供方列表）+ 预设名册
+// + 审计分级（lostTelemetry/lostGovernance/health，供设置页红字与丢失计数展示）。
 async function handleSummary(deps, res) {
   const snapshot = await deps.catalog.getSnapshot();
-  return json(res, 200, { ok: true, enabled: deps.getEnabled(), models: snapshot.models, presets: snapshot.presets });
+  return json(res, 200, {
+    ok: true,
+    enabled: deps.getEnabled(),
+    evolutionAdvice: deps.getEvolutionAdvice(),
+    models: snapshot.models,
+    presets: snapshot.presets,
+    audit: deps.getAudit(),
+    escapeEnabled: deps.getEscapeEnabled(),
+    escapePresets: deps.escape.list(),
+  });
 }
 
 // 每模型 reasoning-effort 等级（懒加载；model 命中快照的 efforts 表）。
@@ -104,26 +120,82 @@ function handleVersions(res) {
   return json(res, 200, { ok: true, versions, warnings });
 }
 
-// 手动刷新：清缓存兜底（TTL 过期前的目录变更经此立即生效）。
+// 手动刷新：清缓存兜底（TTL 过期前的目录变更经此立即生效）+ 重算 evolution:advice
+// 聚合（T1：/options/refresh 此前不触发聚合，summaries.json 永无生成路径）。
 async function handleRefresh(deps, res) {
   deps.catalog.invalidate();
+  if (typeof deps.refreshAdvice === 'function') deps.refreshAdvice();
   return json(res, 200, { ok: true, refreshed: true });
 }
 
+// 失败台账读取：GET /ledger/failures?session=<id> → { ok:true, failures:[...] }。
+// 未知 session 返回空数组；台账是会话级内存结构，进程重启即失。
+async function handleLedgerFailures(deps, url, res) {
+  const session = url.searchParams.get('session') ?? '';
+  return json(res, 200, { ok: true, failures: deps.ledger.get(session) });
+}
+
 async function handleSetEnabled(deps, req, res) {
   const body = await readBody(req);
   const next = !!(body && body.enabled === true);
   deps.setEnabled(next);
-  deps.store.persistEnabled(next);
+  const persist = deps.store.persistEnabled(next);
   deps.syncTool();
-  return json(res, 200, { ok: true, enabled: deps.getEnabled() });
+  return persistOk(res, { enabled: deps.getEnabled() }, persist);
+}
+
+// 只读建议注入开关（默认关）：改写 apply 闭包 evolutionAdvice 并持久化到 state.json。
+// 不改派发行为（建议只读提示）；写路由 CSRF 三件套自动生效。
+async function handleSetEvolutionAdvice(deps, req, res) {
+  const body = await readBody(req);
+  const next = !!(body && body.advice === true);
+  deps.setEvolutionAdvice(next);
+  const persist = deps.store.persistEvolutionAdvice(next);
+  return persistOk(res, { evolutionAdvice: deps.getEvolutionAdvice() }, persist);
+}
+
+// 逃生舱开关（默认关）：改写 apply 闭包 escapeEnabled 并持久化到 state.json。
+// 只放行「放行集内且其余三道闸全过」的非 system 预设；非成员即便开关开也恒拒。
+async function handleSetEscape(deps, req, res) {
+  const body = await readBody(req);
+  const next = !!(body && body.enabled === true);
+  deps.setEscapeEnabled(next);
+  const persist = deps.store.persistEscapeEnabled(next);
+  return persistOk(res, { escapeEnabled: deps.getEscapeEnabled() }, persist);
+}
+
+// 放行集写路径校验：解析请求体的 preset id（非字符串/缺失归一为空串，由调用方
+// 400 拒绝）。纯同步、无副作用。
+function escapePresetId(body) {
+  const raw = body && typeof body === 'object' && typeof body.preset === 'string' ? body.preset : '';
+  return raw.trim();
+}
+
+async function handleEscapeAdd(deps, req, res) {
+  const body = await readBody(req);
+  const preset = escapePresetId(body);
+  if (preset === '') return json(res, 400, { ok: false, error: 'subagent-profiles: escape preset 必须为非空字符串' });
+  const snapshot = await deps.catalog.getSnapshot();
+  if (snapshot.presets.some((p) => p && p.id === preset)) {
+    return json(res, 400, { ok: false, error: `subagent-profiles: preset "${preset}" 已是 system-trust，无需加入逃生舱` });
+  }
+  const persist = deps.escape.add(preset);
+  return persistOk(res, { preset, presets: deps.escape.list() }, persist);
+}
+
+async function handleEscapeRemove(deps, req, res) {
+  const body = await readBody(req);
+  const preset = escapePresetId(body);
+  if (preset === '') return json(res, 400, { ok: false, error: 'subagent-profiles: escape preset 必须为非空字符串' });
+  const persist = deps.escape.remove(preset);
+  return persistOk(res, { preset, presets: deps.escape.list() }, persist);
 }
 
 async function handleAdd(deps, req, res) {
   const body = await readBody(req);
   const profile = body && typeof body === 'object' ? body : {};
   if (typeof profile.id !== 'string' || profile.id.length === 0) {
-    return json(res, 400, { ok: false, error: 'subagent-profiles: profile id must be a non-empty string' });
+    return json(res, 400, { ok: false, error: 'subagent-profiles: profile id 必须为非空字符串' });
   }
   // 写路径上限：strict=true —— 超限/非法字段直接 400 拒绝，
   // 与 loadProfiles（strict=false 迁移宽松读取）的行为区分。列被拒字段与中文原因。
@@ -141,9 +213,8 @@ async function handleAdd(deps, req, res) {
   const existing = deps.store.profiles.get(clean.id);
   const seed = BUILTIN_SEEDS.find((s) => s.id === clean.id);
   const isBuiltin = (existing !== undefined && existing.builtin === true) || seed !== undefined;
-  // Merge (not replace): start from the existing profile — or its seed when it
-  // was deleted — so fields not present in the form (e.g. a builtin's
-  // persona/preset) survive an edit or a re-add.
+  // 合并而非替换：从现有 profile（或它被删时的 seed）出发，表单未带的字段
+  // （如内置方案的 persona/preset）在编辑或重新添加后仍然保留。
   const merged = { ...(existing ?? seed ?? {}) };
   merged.id = clean.id;
   for (const key of ['name', 'description', 'preset', 'provider', 'model', 'reasoningEffort', 'persona', 'enabled']) {
@@ -173,7 +244,7 @@ async function handleRemove(deps, req, res) {
   const id = body && typeof body === 'object' && typeof body.id === 'string' ? body.id : '';
   const existing = deps.store.profiles.get(id);
   if (existing === undefined) {
-    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" does not exist` });
+    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不存在（可在设置页确认可用的 profile id）` });
   }
   deps.store.profiles.delete(id);
   if (existing.builtin === true) deps.store.deletedBuiltins.add(id);
@@ -185,7 +256,7 @@ async function handleReset(deps, req, res) {
   const id = body && typeof body === 'object' && typeof body.id === 'string' ? body.id : '';
   const seed = BUILTIN_SEEDS.find((s) => s.id === id);
   if (seed === undefined) {
-    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" is not a builtin (nothing to reset)` });
+    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不是内置方案（无可重置项）` });
   }
   deps.store.profiles.set(id, { ...seed });
   deps.store.deletedBuiltins.delete(id);
@@ -205,17 +276,45 @@ async function handleSetProfileEnabled(deps, req, res) {
   const id = body && typeof body === 'object' && typeof body.id === 'string' ? body.id : '';
   const existing = deps.store.profiles.get(id);
   if (existing === undefined) {
-    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" does not exist` });
+    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不存在（可在设置页确认可用的 profile id）` });
   }
   existing.enabled = body && body.enabled === false ? false : true;
-  // Persist unconditionally (not just for builtins): a runtime-registered
-  // profile's enable/disable must also survive a restart.
+  // 无条件持久化（不只是内置方案）：运行时注册的 profile 的启用/禁用也必须
+  // 在重启后保留。
   existing.persisted = true;
   return persistOk(res, { id, enabled: existing.enabled }, deps.store.persistProfiles());
 }
 
-export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syncTool, catalog, logger }) {
-  const deps = { store, getEnabled, setEnabled, syncTool, catalog, logger };
+// 写路由 CSRF 传输授权：Origin 白名单 + Content-Type + 自定义头三道检查。
+// 返回 null 表示放行；否则返回 { reason, origin, contentType }——reason 进 403
+// 响应与 warn 日志，origin/contentType 只进日志（二者本就是请求头，非秘密）。
+// GET 只读路由不经过此处（只读无状态变更，不设防）。
+function csrfViolation(req) {
+  const headers = req.headers ?? {};
+  const origin = typeof headers.origin === 'string' ? headers.origin : '';
+  const contentType = typeof headers['content-type'] === 'string' ? headers['content-type'] : '';
+  // 1. Origin 白名单：带 Origin 时只放行本机源（hostname 宽松判定，端口不限）；
+  //    无 Origin 的本地脚本/curl 跳过此道，靠第 3 道自定义头兜底。
+  if (origin !== '') {
+    let host;
+    try { host = new URL(origin).hostname; } catch { host = null; }
+    if (host === null || !LOOPBACK_ORIGIN_HOSTS.has(host)) {
+      return { reason: `Origin 不在本机白名单（收到：${origin}）`, origin, contentType };
+    }
+  }
+  // 2. 强制 Content-Type: application/json（text/plain、表单编码等一律拒绝）。
+  if (!contentType.toLowerCase().startsWith('application/json')) {
+    return { reason: `写请求必须带 Content-Type: application/json（收到：${contentType || '缺失'}）`, origin, contentType };
+  }
+  // 3. 自定义头逼 preflight：跨域表单/脚本无法携带非简单头，缺头即拒。
+  if (headers[CSRF_HEADER_KEY] !== CSRF_HEADER_VALUE) {
+    return { reason: `写请求必须带 ${CSRF_HEADER}: ${CSRF_HEADER_VALUE} 请求头`, origin, contentType };
+  }
+  return null;
+}
+
+export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syncTool, catalog, ledger, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, logger }) {
+  const deps = { store, getEnabled, setEnabled, syncTool, catalog, ledger, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, logger };
   // 路由分发（if 链保持，判断顺序与 404/500 兜底不变）。
   const handler = async (req, res) => {
     const remote = req.socket?.remoteAddress;
@@ -223,13 +322,29 @@ export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syn
     const url = new URL(req.url ?? '/', 'http://localhost');
     const sub = (url.pathname.replace(/^\/subagent-profiles/, '') || '/').replace(/\/+$/, '') || '/';
     try {
+      // 写路由统一做 CSRF 传输授权（loopback 之后、路由分发之前）；GET 只读不设防。
+      if (req.method === 'POST') {
+        const violation = csrfViolation(req);
+        if (violation !== null) {
+          deps.logger.warn(
+            `[dsh-subagent-profile] CSRF 防护拒绝：${violation.reason}` +
+            `（origin=${violation.origin || '无'}，contentType=${violation.contentType || '无'}）`
+          );
+          return json(res, 403, { ok: false, error: `CSRF 防护拒绝：${violation.reason}` });
+        }
+      }
       if (req.method === 'GET' && (sub === '/' || sub === '/list')) return handleList(deps, res);
       if (req.method === 'GET' && sub === '/options/summary') return handleSummary(deps, res);
       if (req.method === 'GET' && sub === '/options/versions') return handleVersions(res);
       if (req.method === 'GET' && sub === '/options/efforts') return handleEfforts(deps, url, res);
       if (req.method === 'GET' && sub === '/options/tools') return handleTools(deps, res);
+      if (req.method === 'GET' && sub === '/ledger/failures') return handleLedgerFailures(deps, url, res);
       if (req.method === 'POST' && sub === '/options/refresh') return handleRefresh(deps, res);
       if (req.method === 'POST' && sub === '/set-enabled') return handleSetEnabled(deps, req, res);
+      if (req.method === 'POST' && sub === '/set-evolution-advice') return handleSetEvolutionAdvice(deps, req, res);
+      if (req.method === 'POST' && sub === '/set-escape') return handleSetEscape(deps, req, res);
+      if (req.method === 'POST' && sub === '/escape-add') return handleEscapeAdd(deps, req, res);
+      if (req.method === 'POST' && sub === '/escape-remove') return handleEscapeRemove(deps, req, res);
       if (req.method === 'POST' && sub === '/add') return handleAdd(deps, req, res);
       if (req.method === 'POST' && sub === '/remove') return handleRemove(deps, req, res);
       if (req.method === 'POST' && sub === '/reset') return handleReset(deps, req, res);

package/lib/core/intersection.mjs

@@ -1,16 +1,13 @@
-// lib/core/intersection.mjs — tool intersection（安全门 1）纯函数核心，从 index.mjs
+// lib/core/intersection.mjs — tool intersection（安全门 1）纯函数核心，从 index.mjs
 // 的 provider start 拆出。无 @deepseek-ai 依赖。此处只做 allow 收窄计算；
 // 调用方（provider start）保留空集 fail-loud throw（错误文案逐字不变）与
 // restrict 的 try/catch 包裹。
 //
-// Relationship to lib/core/pure.mjs computeContinuableAllow(parentNames, toolFilter):
-// the continuable variant has NO childNames — it assumes the child toolset ≈
-// parent toolset (continuable inherits the parent preset, so a true parent∩child
-// intersection cannot be recomputed there) and computes parent − run_code − deny
-// → allow. computeEffectiveAllow additionally intersects with the ACTUAL child
-// toolset (parentNames ∩ childNames), so it stays correct even when the child
-// composes a different toolset. The two serve different call paths and safety
-// guarantees and must NOT be merged.
+// 与 lib/core/pure.mjs 的 computeContinuableAllow(parentNames, toolFilter) 的关系：
+// continuable 变体没有 childNames——它假设子工具集 ≈ 父工具集（continuable 继承
+// 父预设，那里无法重算真正的父∩子交集），计算 parent − run_code − deny → allow。
+// computeEffectiveAllow 额外与真实子工具集求交（parentNames ∩ childNames），
+// 子组合了不同工具集时仍然正确。两者服务于不同的调用路径与安全保证，不得合并。
 
 // parent∩child − run_code − deny → allow 收窄；空集返回 []（fail-loud 由调用方
 // provider start 以逐字不变的 error 文案 throw）。