dsh-subagent-profile 0.3.2 → 0.3.4

package/lib/core/http-routes.mjs

@@ -1,32 +1,24 @@
-// lib/core/http-routes.mjs — settings HTTP loopback routes for the Client UI.
-// Read routes (list / options summary / per-model efforts / tools) + write
-// routes (set-enabled / add / remove / reset / reset-all / set-profile-enabled).
-// The /options catalog (models / presets / tools / efforts) is served from the
-// shared catalog cache (lib/core/catalog-cache.mjs), so these routes no longer
-// walk the llm directory themselves.
-//
-// Injection: every apply-closure / ctx dependency is an explicit parameter —
-//   store         the profile store (profiles Map / persistProfiles /
-//                 persistEnabled / deletedBuiltins),
-//   getEnabled    reads the apply-closure `enabled` flag (mutated by
-//                 /set-enabled),
-//   setEnabled    writes it,
-//   syncTool      unregisters/registers the dispatch tool on /set-enabled,
-//   catalog       the shared catalog cache (getSnapshot / invalidate),
-//   logger        ctx.logger (route error warnings).
-// The factory returns the scope.effect setup function so the caller keeps the
-// exact original registration shape: effect(() => register + disposer).
-//
-// 写路由各抽为模块级处理函数（if 链分发保持）；/options 拆三读路由 + 手动刷新，
-// 目录数据统一来自 catalog 快照。
+// lib/core/http-routes.mjs — Client UI 设置 HTTP loopback 路由。/options 目录由共享
+// catalog 缓存（catalog-cache.mjs）提供；注入全是显式参数——store、getEnabled/setEnabled、
+// syncTool、catalog、logger；写路由各抽为模块级处理函数，工厂返回 scope.effect 设置函数。
 
 import { sanitizeProfile } from './pure.mjs';
 import { BUILTIN_SEEDS } from './profiles-store.mjs';
 import { detectVersions } from './shims.mjs';
+import { readSummaries, computeAdvice } from './evolution-advice.mjs';
+import { profileStatsFromSummaries } from './profile-directory.mjs';
+import { costSummaryFromSummaries } from './cost-evidence.mjs';
 
-// Only the loopback interfaces may drive the settings HTTP routes.
+// 只有 loopback 接口可以驱动设置 HTTP 路由。
 const LOOPBACKS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
 
+// CSRF 三件套：loopback 只挡「非本机」；这三件挡「跨域表单/脚本冒充本机提交」。
+// IPv6 字面量带方括号形态，两种形态都列入避免误拒。
+const LOOPBACK_ORIGIN_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+const CSRF_HEADER = 'X-DSH-Plugin';
+const CSRF_HEADER_KEY = CSRF_HEADER.toLowerCase();
+const CSRF_HEADER_VALUE = 'dsh-subagent-profile';
+
 function json(res, code, data) {
   res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' });
   res.end(JSON.stringify(data));
@@ -48,10 +40,6 @@ function readBody(req) {
   });
 }
 
-// Write-failure contract: the write routes return HTTP 200 with
-// `persisted` always present; when the disk write failed, persistWarning
-// explains "已保存但未持久化" (in-memory state drives this process, the
-// disk did not update). The client renders that as the amber warning.
 function persistOk(res, payload, persist) {
   return json(res, 200, {
     ok: true,
@@ -61,27 +49,56 @@ function persistOk(res, payload, persist) {
   });
 }
 
-function listClean(store) {
+function listClean(store, stats) {
+  const map = stats instanceof Map ? stats : new Map();
   return [...store.profiles.values()].map((profile) => {
     const clean = {};
     for (const [key, value] of Object.entries(profile)) if (value !== undefined && key !== 'persisted') clean[key] = value;
-    // The internal `persisted` flag is stripped above; expose a UI-facing
-    // "modified" signal so the reset panel can label a changed builtin.
+    // 对外暴露 UI 面向的 "modified" 信号（内置方案被改过）。
     if (profile.builtin === true && profile.persisted === true) clean.modified = true;
+    // 方案卡成本预览数据（有数据才带；N 必显作置信度信号）。
+    const stat = map.get(profile.id);
+    if (stat !== undefined) {
+      if (stat.avgCost !== null && stat.avgCost !== undefined) clean.avgCost = stat.avgCost;
+      if (stat.successRate !== null && stat.successRate !== undefined) clean.successRate = stat.successRate;
+      if (stat.n !== undefined) clean.n = stat.n;
+    }
     return clean;
   });
 }
 
-// --- 路由处理函数（从 createHttpRoutes 拆出；if 链分发在内保持）----------------
-
 async function handleList(deps, res) {
-  return json(res, 200, { ok: true, profiles: listClean(deps.store) });
+  let stats = new Map();
+  let costSummary = { global: null, byModel: [] };
+  let advice = [];
+  let adviceGlobal = null;
+  try {
+    if (typeof deps.refreshAdvice === 'function') deps.refreshAdvice();
+    const summaries = typeof deps.summariesFile === 'string' ? readSummaries(deps.summariesFile, deps.logger) : null;
+    stats = profileStatsFromSummaries(deps.store, summaries);
+    costSummary = costSummaryFromSummaries(summaries);
+    if (deps.adviceWhitelist !== undefined && typeof deps.dispatchFile === 'string') {
+      const result = computeAdvice({ summariesFile: deps.summariesFile, dispatchFile: deps.dispatchFile, whitelist: deps.adviceWhitelist, logger: deps.logger });
+      advice = result.advice ?? [];
+      adviceGlobal = result.global ?? null;
+    }
+  } catch { /* 统计/建议是增量展示；失败不影响 /list 主响应 */ }
+  return json(res, 200, { ok: true, profiles: listClean(deps.store, stats), costSummary, advice, adviceGlobal });
 }
 
-// 轻量摘要：enabled + 模型目录（含 provider 信息，客户端据此派生提供方列表）+ 预设名册。
+// 轻量摘要：enabled/advice 开关/模型目录/预设名册/审计分级。
 async function handleSummary(deps, res) {
   const snapshot = await deps.catalog.getSnapshot();
-  return json(res, 200, { ok: true, enabled: deps.getEnabled(), models: snapshot.models, presets: snapshot.presets });
+  return json(res, 200, {
+    ok: true,
+    enabled: deps.getEnabled(),
+    evolutionAdvice: deps.getEvolutionAdvice(),
+    models: snapshot.models,
+    presets: snapshot.presets,
+    audit: deps.getAudit(),
+    escapeEnabled: deps.getEscapeEnabled(),
+    escapePresets: deps.escape.list(),
+  });
 }
 
 // 每模型 reasoning-effort 等级（懒加载；model 命中快照的 efforts 表）。
@@ -100,50 +117,164 @@ async function handleTools(deps, res) {
 
 // 版本探测：三包 version + 越界/未知的中文 warnings（纯探测，同步）。
 function handleVersions(res) {
-  const { versions, warnings } = detectVersions();
-  return json(res, 200, { ok: true, versions, warnings });
+  const { versions, warnings, pluginVersion } = detectVersions();
+  return json(res, 200, { ok: true, versions, warnings, pluginVersion });
 }
 
-// 手动刷新：清缓存兜底（TTL 过期前的目录变更经此立即生效）。
 async function handleRefresh(deps, res) {
   deps.catalog.invalidate();
+  if (typeof deps.refreshAdvice === 'function') deps.refreshAdvice();
   return json(res, 200, { ok: true, refreshed: true });
 }
 
+// 提醒系统：提醒与审计同源（host reminder store），全动作留痕。
+async function handleRemindersList(deps, res) {
+  const store = deps.reminderStore;
+  return json(res, 200, { ok: true, reminders: store !== undefined ? store.list() : [], unread: store !== undefined ? store.unreadCount() : 0 });
+}
+
+async function handleRemindersAck(deps, req, res) {
+  const body = await readBody(req);
+  const ids = Array.isArray(body.ids) ? body.ids.filter((id) => typeof id === 'string') : [];
+  const acked = deps.reminderStore !== undefined ? deps.reminderStore.ack(ids) : [];
+  return json(res, 200, { ok: true, acked });
+}
+
+async function handleReminderAction(deps, req, res) {
+  const body = await readBody(req);
+  const id = typeof body.id === 'string' ? body.id : '';
+  const action = typeof body.action === 'string' ? body.action : '';
+  const done = deps.reminderStore !== undefined ? deps.reminderStore.actOn(id, action) : false;
+  if (!done) return json(res, 400, { ok: false, error: 'subagent-profiles: 提醒 id 或动作无效' });
+  return json(res, 200, { ok: true, id, action });
+}
+
+async function handleLedgerFailures(deps, url, res) {
+  const session = url.searchParams.get('session') ?? '';
+  return json(res, 200, { ok: true, failures: deps.ledger.get(session) });
+}
+
+async function handleLedgerJobs(deps, url, res) {
+  const session = url.searchParams.get('session') ?? '';
+  const jobs = deps.backgroundLedger !== undefined ? deps.backgroundLedger.get(session) : [];
+  return json(res, 200, { ok: true, jobs });
+}
+
+async function handleDraftsList(deps, res) {
+  return json(res, 200, { ok: true, drafts: deps.draftsStore.list() });
+}
+
+async function handleDraftAdd(deps, req, res) {
+  const body = await readBody(req);
+  const config = body && typeof body.config === 'object' && body.config !== null ? body.config : {};
+  if (typeof config.id !== 'string' || config.id === '') return json(res, 400, { ok: false, error: 'draft config.id 必须为非空字符串' });
+  const draft = {
+    id: 'draft-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8),
+    source: typeof body.source === 'string' && body.source !== '' ? body.source : 'human',
+    config,
+    name: typeof body.name === 'string' && body.name !== '' ? body.name : config.id,
+    description: typeof body.description === 'string' ? body.description : '',
+    createdAt: Date.now(),
+  };
+  const persist = deps.draftsStore.add(draft);
+  return persistOk(res, { draft }, persist);
+}
+
+async function handleDraftApply(deps, req, res) {
+  const body = await readBody(req);
+  const id = body && typeof body.id === 'string' ? body.id : '';
+  if (id === '') return json(res, 400, { ok: false, error: 'draft id 不能为空' });
+  const draft = deps.draftsStore.get(id);
+  if (draft === undefined) return json(res, 404, { ok: false, error: 'draft 不存在（可能已被应用或删除）' });
+  const next = { ...draft };
+  if (typeof body.name === 'string' && body.name !== '') next.name = body.name;
+  if (typeof body.description === 'string') next.description = body.description;
+  const applied = await deps.applyDraft(next);
+  deps.draftsStore.remove(id);
+  return persistOk(res, applied, { persisted: applied.persisted !== false });
+}
+
+async function handleDraftRemove(deps, req, res) {
+  const body = await readBody(req);
+  const id = body && typeof body.id === 'string' ? body.id : '';
+  if (id === '') return json(res, 400, { ok: false, error: 'draft id 不能为空' });
+  const result = deps.draftsStore.remove(id);
+  return persistOk(res, { id }, result);
+}
+
 async function handleSetEnabled(deps, req, res) {
   const body = await readBody(req);
   const next = !!(body && body.enabled === true);
   deps.setEnabled(next);
-  deps.store.persistEnabled(next);
+  const persist = deps.store.persistEnabled(next);
   deps.syncTool();
-  return json(res, 200, { ok: true, enabled: deps.getEnabled() });
+  return persistOk(res, { enabled: deps.getEnabled() }, persist);
+}
+
+// 派发优化建议注入开关（默认关，只提示不改派发行为）。
+async function handleSetEvolutionAdvice(deps, req, res) {
+  const body = await readBody(req);
+  const next = !!(body && body.advice === true);
+  deps.setEvolutionAdvice(next);
+  const persist = deps.store.persistEvolutionAdvice(next);
+  return persistOk(res, { evolutionAdvice: deps.getEvolutionAdvice() }, persist);
+}
+
+// 逃生舱开关（默认关）：只放行「放行集内且三道闸全过」的非 system 预设。
+async function handleSetEscape(deps, req, res) {
+  const body = await readBody(req);
+  const next = !!(body && body.enabled === true);
+  deps.setEscapeEnabled(next);
+  const persist = deps.store.persistEscapeEnabled(next);
+  return persistOk(res, { escapeEnabled: deps.getEscapeEnabled() }, persist);
+}
+
+// 放行集写路径校验：preset id 非字符串/缺失归一空串（调用方 400 拒绝）。
+function escapePresetId(body) {
+  const raw = body && typeof body === 'object' && typeof body.preset === 'string' ? body.preset : '';
+  return raw.trim();
+}
+
+async function handleEscapeAdd(deps, req, res) {
+  const body = await readBody(req);
+  const preset = escapePresetId(body);
+  if (preset === '') return json(res, 400, { ok: false, error: 'subagent-profiles: escape preset 必须为非空字符串' });
+  const snapshot = await deps.catalog.getSnapshot();
+  if (snapshot.presets.some((p) => p && p.id === preset)) {
+    return json(res, 400, { ok: false, error: `subagent-profiles: preset "${preset}" 已是 system-trust，无需加入逃生舱` });
+  }
+  const persist = deps.escape.add(preset);
+  return persistOk(res, { preset, presets: deps.escape.list() }, persist);
+}
+
+async function handleEscapeRemove(deps, req, res) {
+  const body = await readBody(req);
+  const preset = escapePresetId(body);
+  if (preset === '') return json(res, 400, { ok: false, error: 'subagent-profiles: escape preset 必须为非空字符串' });
+  const persist = deps.escape.remove(preset);
+  return persistOk(res, { preset, presets: deps.escape.list() }, persist);
 }
 
 async function handleAdd(deps, req, res) {
   const body = await readBody(req);
   const profile = body && typeof body === 'object' ? body : {};
   if (typeof profile.id !== 'string' || profile.id.length === 0) {
-    return json(res, 400, { ok: false, error: 'subagent-profiles: profile id must be a non-empty string' });
+    return json(res, 400, { ok: false, error: 'subagent-profiles: profile id 必须为非空字符串' });
   }
-  // 写路径上限：strict=true —— 超限/非法字段直接 400 拒绝，
-  // 与 loadProfiles（strict=false 迁移宽松读取）的行为区分。列被拒字段与中文原因。
+  // 写路径 strict=true：超限/非法字段 400 拒绝（与 loadProfiles 宽松读取区分）。
   const { clean, warnings } = sanitizeProfile(profile, { strict: true });
   if (warnings.length > 0) {
     const detail = warnings.map((w) => `${w.field}：${w.reason}`).join('；');
     return json(res, 400, { ok: false, error: `写入被拒绝：${detail}` });
   }
   const hadToolFilter = profile.toolFilter !== undefined;
-  // tokenTier 不参与上方通用 merge 循环：sanitizeProfile 对「未提供」恒回填
-  // balanced，若进循环会破坏「未传→保留 existing」语义（编辑内置 researcher
-  // 时 cheap 会被重置为 balanced）。故单独用 raw-body 守卫：传了才写（strict
-  // 模式下非法值已在上面 400 拒绝，clean.tokenTier 必为合法 enum）。
+  // tokenTier 单独用 raw-body 守卫（sanitize 恒回填 balanced，进 merge 会破坏
+  // 「未传→保留 existing」语义）；strict 下非法值已在上面 400 拒绝。
   const hadTokenTier = profile.tokenTier !== undefined;
   const existing = deps.store.profiles.get(clean.id);
   const seed = BUILTIN_SEEDS.find((s) => s.id === clean.id);
   const isBuiltin = (existing !== undefined && existing.builtin === true) || seed !== undefined;
-  // Merge (not replace): start from the existing profile — or its seed when it
-  // was deleted — so fields not present in the form (e.g. a builtin's
-  // persona/preset) survive an edit or a re-add.
+  // 合并而非替换：表单未带字段（内置 persona/preset 等）编辑后仍保留。
   const merged = { ...(existing ?? seed ?? {}) };
   merged.id = clean.id;
   for (const key of ['name', 'description', 'preset', 'provider', 'model', 'reasoningEffort', 'persona', 'enabled']) {
@@ -151,8 +282,7 @@ async function handleAdd(deps, req, res) {
     if (clean[key] === '' || clean[key] === null) { delete merged[key]; continue; }  // 空：清除字段
     merged[key] = clean[key];
   }
-  // toolFilter 特殊处理：前端改成多选下拉后总是传数组，空数组 = 清除。请求未传
-  // toolFilter 时保留 existing 原值（merge 语义）；传了但被 sanitize 归一为空则清除。
+  // toolFilter：空数组 = 清除；未传保留 existing；传了但归一为空则清除。
   if (hadToolFilter) {
     const tf = clean.toolFilter;
     if (tf !== undefined && ((Array.isArray(tf.allow) && tf.allow.length > 0) || (Array.isArray(tf.deny) && tf.deny.length > 0))) {
@@ -173,7 +303,7 @@ async function handleRemove(deps, req, res) {
   const id = body && typeof body === 'object' && typeof body.id === 'string' ? body.id : '';
   const existing = deps.store.profiles.get(id);
   if (existing === undefined) {
-    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" does not exist` });
+    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不存在（可在设置页确认可用的 profile id）` });
   }
   deps.store.profiles.delete(id);
   if (existing.builtin === true) deps.store.deletedBuiltins.add(id);
@@ -185,7 +315,7 @@ async function handleReset(deps, req, res) {
   const id = body && typeof body === 'object' && typeof body.id === 'string' ? body.id : '';
   const seed = BUILTIN_SEEDS.find((s) => s.id === id);
   if (seed === undefined) {
-    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" is not a builtin (nothing to reset)` });
+    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不是内置方案（无可重置项）` });
   }
   deps.store.profiles.set(id, { ...seed });
   deps.store.deletedBuiltins.delete(id);
@@ -205,37 +335,91 @@ async function handleSetProfileEnabled(deps, req, res) {
   const id = body && typeof body === 'object' && typeof body.id === 'string' ? body.id : '';
   const existing = deps.store.profiles.get(id);
   if (existing === undefined) {
-    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" does not exist` });
+    return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不存在（可在设置页确认可用的 profile id）` });
   }
   existing.enabled = body && body.enabled === false ? false : true;
-  // Persist unconditionally (not just for builtins): a runtime-registered
-  // profile's enable/disable must also survive a restart.
+  // 无条件持久化：运行时注册的 profile 启用/禁用也须重启后保留。
   existing.persisted = true;
   return persistOk(res, { id, enabled: existing.enabled }, deps.store.persistProfiles());
 }
 
-export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syncTool, catalog, logger }) {
-  const deps = { store, getEnabled, setEnabled, syncTool, catalog, logger };
-  // 路由分发（if 链保持，判断顺序与 404/500 兜底不变）。
+// CSRF 传输授权：Origin 白名单 + Content-Type + 自定义头；reason 进 403 与 warn
+// 日志，GET 只读不设防。
+function csrfViolation(req) {
+  const headers = req.headers ?? {};
+  const origin = typeof headers.origin === 'string' ? headers.origin : '';
+  const contentType = typeof headers['content-type'] === 'string' ? headers['content-type'] : '';
+  // 1. Origin 白名单：只放行本机源；无 Origin 的本地脚本靠第 3 道兜底。
+  if (origin !== '') {
+    let host;
+    try { host = new URL(origin).hostname; } catch { host = null; }
+    if (host === null || !LOOPBACK_ORIGIN_HOSTS.has(host)) {
+      return { reason: `Origin 不在本机白名单（收到：${origin}）`, origin, contentType };
+    }
+  }
+  // 2. 强制 Content-Type: application/json（text/plain、表单编码等一律拒绝）。
+  if (!contentType.toLowerCase().startsWith('application/json')) {
+    return { reason: `写请求必须带 Content-Type: application/json（收到：${contentType || '缺失'}）`, origin, contentType };
+  }
+  // 3. 自定义头逼 preflight：跨域表单/脚本无法携带非简单头，缺头即拒。
+  if (headers[CSRF_HEADER_KEY] !== CSRF_HEADER_VALUE) {
+    return { reason: `写请求必须带 ${CSRF_HEADER}: ${CSRF_HEADER_VALUE} 请求头`, origin, contentType };
+  }
+  return null;
+}
+
+// 路由分发链（从 createHttpRoutes 抽出守行门）：纯 if 链分发，每条路由一行；
+// 未知路由 404 兜底。CSRF 与 loopback 守卫在 createHttpRoutes 入口完成。
+async function routeRequest(deps, req, res, url, sub) {
+  if (req.method === 'GET' && (sub === '/' || sub === '/list')) return handleList(deps, res);
+  if (req.method === 'GET' && sub === '/options/summary') return handleSummary(deps, res);
+  if (req.method === 'GET' && sub === '/options/versions') return handleVersions(res);
+  if (req.method === 'GET' && sub === '/options/efforts') return handleEfforts(deps, url, res);
+  if (req.method === 'GET' && sub === '/options/tools') return handleTools(deps, res);
+  if (req.method === 'GET' && sub === '/ledger/failures') return handleLedgerFailures(deps, url, res);
+  if (req.method === 'GET' && sub === '/ledger/jobs') return handleLedgerJobs(deps, url, res);
+  if (req.method === 'GET' && sub === '/reminders') return handleRemindersList(deps, res);
+  if (req.method === 'POST' && sub === '/reminders/ack') return handleRemindersAck(deps, req, res);
+  if (req.method === 'POST' && sub === '/reminders/action') return handleReminderAction(deps, req, res);
+  if (req.method === 'GET' && sub === '/drafts') return handleDraftsList(deps, res);
+  if (req.method === 'POST' && sub === '/draft') return handleDraftAdd(deps, req, res);
+  if (req.method === 'POST' && sub === '/draft/apply') return handleDraftApply(deps, req, res);
+  if (req.method === 'POST' && sub === '/draft/remove') return handleDraftRemove(deps, req, res);
+  if (req.method === 'POST' && sub === '/draft/preview') { const body = await readBody(req); return json(res, 200, { ok: true, ...(await deps.previewDraft(body)) }); }
+  if (req.method === 'POST' && sub === '/options/refresh') return handleRefresh(deps, res);
+  if (req.method === 'POST' && sub === '/set-enabled') return handleSetEnabled(deps, req, res);
+  if (req.method === 'POST' && sub === '/set-evolution-advice') return handleSetEvolutionAdvice(deps, req, res);
+  if (req.method === 'POST' && sub === '/set-escape') return handleSetEscape(deps, req, res);
+  if (req.method === 'POST' && sub === '/escape-add') return handleEscapeAdd(deps, req, res);
+  if (req.method === 'POST' && sub === '/escape-remove') return handleEscapeRemove(deps, req, res);
+  if (req.method === 'POST' && sub === '/add') return handleAdd(deps, req, res);
+  if (req.method === 'POST' && sub === '/remove') return handleRemove(deps, req, res);
+  if (req.method === 'POST' && sub === '/reset') return handleReset(deps, req, res);
+  if (req.method === 'POST' && sub === '/reset-all') return handleResetAll(deps, res);
+  if (req.method === 'POST' && sub === '/set-profile-enabled') return handleSetProfileEnabled(deps, req, res);
+  json(res, 404, { ok: false, error: `未知路由 ${sub}` });
+}
+
+export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syncTool, catalog, ledger, backgroundLedger, draftsStore, applyDraft, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, summariesFile, dispatchFile, adviceWhitelist, previewDraft, reminderStore, logger }) {
+  const deps = { store, getEnabled, setEnabled, syncTool, catalog, ledger, backgroundLedger, draftsStore, applyDraft, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, summariesFile, dispatchFile, adviceWhitelist, previewDraft, reminderStore, logger };
   const handler = async (req, res) => {
     const remote = req.socket?.remoteAddress;
     if (!LOOPBACKS.has(remote)) return json(res, 403, { ok: false, error: '仅限本机访问' });
     const url = new URL(req.url ?? '/', 'http://localhost');
     const sub = (url.pathname.replace(/^\/subagent-profiles/, '') || '/').replace(/\/+$/, '') || '/';
     try {
-      if (req.method === 'GET' && (sub === '/' || sub === '/list')) return handleList(deps, res);
-      if (req.method === 'GET' && sub === '/options/summary') return handleSummary(deps, res);
-      if (req.method === 'GET' && sub === '/options/versions') return handleVersions(res);
-      if (req.method === 'GET' && sub === '/options/efforts') return handleEfforts(deps, url, res);
-      if (req.method === 'GET' && sub === '/options/tools') return handleTools(deps, res);
-      if (req.method === 'POST' && sub === '/options/refresh') return handleRefresh(deps, res);
-      if (req.method === 'POST' && sub === '/set-enabled') return handleSetEnabled(deps, req, res);
-      if (req.method === 'POST' && sub === '/add') return handleAdd(deps, req, res);
-      if (req.method === 'POST' && sub === '/remove') return handleRemove(deps, req, res);
-      if (req.method === 'POST' && sub === '/reset') return handleReset(deps, req, res);
-      if (req.method === 'POST' && sub === '/reset-all') return handleResetAll(deps, res);
-      if (req.method === 'POST' && sub === '/set-profile-enabled') return handleSetProfileEnabled(deps, req, res);
-      json(res, 404, { ok: false, error: `未知路由 ${sub}` });
+      // 写路由统一做 CSRF 传输授权（loopback 之后、路由分发之前）；GET 只读不设防。
+      if (req.method === 'POST') {
+        const violation = csrfViolation(req);
+        if (violation !== null) {
+          deps.logger.warn(
+            `[dsh-subagent-profile] CSRF 防护拒绝：${violation.reason}` +
+            `（origin=${violation.origin || '无'}，contentType=${violation.contentType || '无'}）`
+          );
+          return json(res, 403, { ok: false, error: `CSRF 防护拒绝：${violation.reason}` });
+        }
+      }
+      return routeRequest(deps, req, res, url, sub);
     } catch (error) {
       // 通用 500 不回显内部错误信息（防泄漏），详情只进宿主日志。
       deps.logger.error('[dsh-subagent-profile] settings route error:', error instanceof Error ? (error.stack ?? error.message) : String(error));

package/lib/core/intersection.mjs

@@ -1,16 +1,13 @@
-// lib/core/intersection.mjs — tool intersection（安全门 1）纯函数核心，从 index.mjs
+// lib/core/intersection.mjs — tool intersection（安全门 1）纯函数核心，从 index.mjs
 // 的 provider start 拆出。无 @deepseek-ai 依赖。此处只做 allow 收窄计算；
 // 调用方（provider start）保留空集 fail-loud throw（错误文案逐字不变）与
 // restrict 的 try/catch 包裹。
 //
-// Relationship to lib/core/pure.mjs computeContinuableAllow(parentNames, toolFilter):
-// the continuable variant has NO childNames — it assumes the child toolset ≈
-// parent toolset (continuable inherits the parent preset, so a true parent∩child
-// intersection cannot be recomputed there) and computes parent − run_code − deny
-// → allow. computeEffectiveAllow additionally intersects with the ACTUAL child
-// toolset (parentNames ∩ childNames), so it stays correct even when the child
-// composes a different toolset. The two serve different call paths and safety
-// guarantees and must NOT be merged.
+// 与 lib/core/pure.mjs 的 computeContinuableAllow(parentNames, toolFilter) 的关系：
+// continuable 变体没有 childNames——它假设子工具集 ≈ 父工具集（continuable 继承
+// 父预设，那里无法重算真正的父∩子交集），计算 parent − run_code − deny → allow。
+// computeEffectiveAllow 额外与真实子工具集求交（parentNames ∩ childNames），
+// 子组合了不同工具集时仍然正确。两者服务于不同的调用路径与安全保证，不得合并。
 
 // parent∩child − run_code − deny → allow 收窄；空集返回 []（fail-loud 由调用方
 // provider start 以逐字不变的 error 文案 throw）。