dsh-subagent-profile 0.3.3 → 0.4.0

package/lib/core/http-routes.mjs

@@ -1,91 +1,70 @@
-// lib/core/http-routes.mjs — Client UI 的设置 HTTP loopback 路由。
-// 读路由（list / options 摘要 / 按模型 efforts / tools）+ 写路由
-// （set-enabled / add / remove / reset / reset-all / set-profile-enabled）。
-// /options 目录（models / presets / tools / efforts）由共享 catalog 缓存
-// （lib/core/catalog-cache.mjs）提供，这些路由不再自行遍历 llm 目录。
-//
-// 注入：所有 apply 闭包 / ctx 依赖都是显式参数——
-//   store         profile store（profiles Map / persistProfiles /
-//                 persistEnabled / deletedBuiltins），
-//   getEnabled    读取 apply 闭包 `enabled` 标志（被 /set-enabled 改写），
-//   setEnabled    写它，
-//   syncTool      在 /set-enabled 时注销/注册 dispatch 工具，
-//   catalog       共享 catalog 缓存（getSnapshot / invalidate），
-//   logger        ctx.logger（路由错误告警）。
-// 工厂返回 scope.effect 设置函数，调用方保持原有注册形状：
-// effect(() => register + disposer)。
-//
-// 写路由各抽为模块级处理函数（if 链分发保持）；/options 拆三读路由 + 手动刷新，
-// 目录数据统一来自 catalog 快照。
+// lib/core/http-routes.mjs — Client UI 设置 HTTP loopback 路由。/options 目录由共享
+// catalog 缓存（catalog-cache.mjs）提供；注入全是显式参数——store、getEnabled/setEnabled、
+// syncTool、catalog、logger；写路由各抽为模块级处理函数，工厂返回 scope.effect 设置函数。
 
 import { sanitizeProfile } from './pure.mjs';
 import { BUILTIN_SEEDS } from './profiles-store.mjs';
 import { detectVersions } from './shims.mjs';
+import { readSummaries } from './evolution-advice.mjs';
+import { profileStatsFromSummaries } from './profile-directory.mjs';
+import { costSummaryFromSummaries } from './cost-evidence.mjs';
+import { json, readBody, persistOk } from './http-helpers.mjs';
+import { handleEvolutionAssets, handleEvolutionApply, handleEvolutionRegenerate, handleAdviceSaveProfile, handleSettingsCandidate } from './evolution-routes.mjs';
 
 // 只有 loopback 接口可以驱动设置 HTTP 路由。
 const LOOPBACKS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
 
-// 写路由 CSRF 传输授权三件套。loopback 只挡「来源不是本机」；这三件挡「浏览器里的
-// 跨域表单/脚本冒充本机提交」——schema 校验的是数据形状，管不到谁有权写。
-// URL.hostname 对 IPv6 字面量返回带方括号形态（http://[::1]:port → '[::1]'），
-// 两种形态都列入，避免 IPv6 loopback 源被误拒。
+// CSRF 三件套：loopback 只挡「非本机」；这三件挡「跨域表单/脚本冒充本机提交」。
+// IPv6 字面量带方括号形态，两种形态都列入避免误拒。
 const LOOPBACK_ORIGIN_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
 const CSRF_HEADER = 'X-DSH-Plugin';
 const CSRF_HEADER_KEY = CSRF_HEADER.toLowerCase();
 const CSRF_HEADER_VALUE = 'dsh-subagent-profile';
 
-function json(res, code, data) {
-  res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' });
-  res.end(JSON.stringify(data));
-}
-
-function readBody(req) {
-  return new Promise((resolve, reject) => {
-    let data = '';
-    let size = 0;
-    req.on('data', (chunk) => {
-      size += chunk.length;
-      if (size > 1 << 20) { reject(new Error('请求体过大')); req.destroy(); return; }
-      data += chunk;
-    });
-    req.on('end', () => {
-      try { resolve(data === '' ? {} : JSON.parse(data)); } catch { reject(new Error('请求体不是合法 JSON')); }
-    });
-    req.on('error', reject);
-  });
-}
-
-// 写失败契约：写路由返回 HTTP 200 且 `persisted` 恒在场；磁盘写失败时
-// persistWarning 说明「已保存但未持久化」（内存态驱动本进程，磁盘未更新）。
-// 客户端把它渲染为琥珀色警告。
-function persistOk(res, payload, persist) {
-  return json(res, 200, {
-    ok: true,
-    ...payload,
-    persisted: persist.persisted,
-    ...(persist.persisted ? {} : { persistWarning: '已保存但未持久化' }),
-  });
-}
-
-function listClean(store) {
+function listClean(store, stats) {
+  const map = stats instanceof Map ? stats : new Map();
   return [...store.profiles.values()].map((profile) => {
     const clean = {};
     for (const [key, value] of Object.entries(profile)) if (value !== undefined && key !== 'persisted') clean[key] = value;
-    // 内部 `persisted` 标志已在上方剥离；对外暴露 UI 面向的 "modified"
-    // 信号，供重置面板标注被改过的内置方案。
+    // 对外暴露 UI 面向的 "modified" 信号（内置方案被改过）。
     if (profile.builtin === true && profile.persisted === true) clean.modified = true;
+    // 方案卡成本预览数据（有数据才带；N 必显作置信度信号）。
+    const stat = map.get(profile.id);
+    if (stat !== undefined) {
+      if (stat.avgCost !== null && stat.avgCost !== undefined) clean.avgCost = stat.avgCost;
+      if (stat.successRate !== null && stat.successRate !== undefined) clean.successRate = stat.successRate;
+      if (stat.n !== undefined) clean.n = stat.n;
+    }
     return clean;
   });
 }
 
-// --- 路由处理函数（从 createHttpRoutes 拆出；if 链分发在内保持）----------------
-
 async function handleList(deps, res) {
-  return json(res, 200, { ok: true, profiles: listClean(deps.store) });
+  let stats = new Map();
+  let costSummary = { global: null, byModel: [] };
+  let advice = [];
+  let adviceGlobal = null;
+  let evolutionCandidates = [];
+  let adviceDetails = {};
+  try {
+    if (typeof deps.refreshAdvice === 'function') deps.refreshAdvice();
+    const summaries = typeof deps.summariesFile === 'string' ? readSummaries(deps.summariesFile, deps.logger) : null;
+    stats = profileStatsFromSummaries(deps.store, summaries);
+    costSummary = costSummaryFromSummaries(summaries);
+    if (deps.adviceWhitelist !== undefined && typeof deps.dispatchFile === 'string' && typeof deps.adviceSource === 'function') {
+      // 建议 + 候选生成统一走装配层 helper（computeAdvice 之后推导候选资产），
+      // 避免 /list 与其它消费点重复生成；候选随建议链开关同生共死。
+      const result = await deps.adviceSource();
+      advice = result.advice ?? [];
+      adviceGlobal = result.global ?? null;
+      evolutionCandidates = Array.isArray(result.candidates) ? result.candidates : [];
+      adviceDetails = result.adviceDetails !== null && typeof result.adviceDetails === 'object' ? result.adviceDetails : {};
+    }
+  } catch { /* 统计/建议是增量展示；失败不影响 /list 主响应 */ }
+  return json(res, 200, { ok: true, profiles: listClean(deps.store, stats), costSummary, advice, adviceGlobal, evolutionCandidates, adviceDetails });
 }
 
-// 轻量摘要：enabled + evolutionAdvice + 模型目录（含 provider 信息，客户端据此派生提供方列表）+ 预设名册
-// + 审计分级（lostTelemetry/lostGovernance/health，供设置页红字与丢失计数展示）。
+// 轻量摘要：enabled/advice 开关/模型目录/预设名册/审计分级。
 async function handleSummary(deps, res) {
   const snapshot = await deps.catalog.getSnapshot();
   return json(res, 200, {
@@ -97,6 +76,8 @@ async function handleSummary(deps, res) {
     audit: deps.getAudit(),
     escapeEnabled: deps.getEscapeEnabled(),
     escapePresets: deps.escape.list(),
+    candidateMode: deps.store.loadCandidateMode(),
+    candidateTtlH: deps.store.loadCandidateTtlH(),
   });
 }
 
@@ -116,25 +97,91 @@ async function handleTools(deps, res) {
 
 // 版本探测：三包 version + 越界/未知的中文 warnings（纯探测，同步）。
 function handleVersions(res) {
-  const { versions, warnings } = detectVersions();
-  return json(res, 200, { ok: true, versions, warnings });
+  const { versions, warnings, pluginVersion } = detectVersions();
+  return json(res, 200, { ok: true, versions, warnings, pluginVersion });
 }
 
-// 手动刷新：清缓存兜底（TTL 过期前的目录变更经此立即生效）+ 重算 evolution:advice
-// 聚合（T1：/options/refresh 此前不触发聚合，summaries.json 永无生成路径）。
 async function handleRefresh(deps, res) {
   deps.catalog.invalidate();
   if (typeof deps.refreshAdvice === 'function') deps.refreshAdvice();
   return json(res, 200, { ok: true, refreshed: true });
 }
 
-// 失败台账读取：GET /ledger/failures?session=<id> → { ok:true, failures:[...] }。
-// 未知 session 返回空数组；台账是会话级内存结构，进程重启即失。
+// 提醒系统：提醒与审计同源（host reminder store），全动作留痕。
+async function handleRemindersList(deps, res) {
+  const store = deps.reminderStore;
+  return json(res, 200, { ok: true, reminders: store !== undefined ? store.list() : [], unread: store !== undefined ? store.unreadCount() : 0 });
+}
+
+async function handleRemindersAck(deps, req, res) {
+  const body = await readBody(req);
+  const ids = Array.isArray(body.ids) ? body.ids.filter((id) => typeof id === 'string') : [];
+  const acked = deps.reminderStore !== undefined ? deps.reminderStore.ack(ids) : [];
+  return json(res, 200, { ok: true, acked });
+}
+
+async function handleReminderAction(deps, req, res) {
+  const body = await readBody(req);
+  const id = typeof body.id === 'string' ? body.id : '';
+  const action = typeof body.action === 'string' ? body.action : '';
+  const done = deps.reminderStore !== undefined ? deps.reminderStore.actOn(id, action) : false;
+  if (!done) return json(res, 400, { ok: false, error: 'subagent-profiles: 提醒 id 或动作无效' });
+  return json(res, 200, { ok: true, id, action });
+}
+
 async function handleLedgerFailures(deps, url, res) {
   const session = url.searchParams.get('session') ?? '';
   return json(res, 200, { ok: true, failures: deps.ledger.get(session) });
 }
 
+async function handleLedgerJobs(deps, url, res) {
+  const session = url.searchParams.get('session') ?? '';
+  const jobs = deps.backgroundLedger !== undefined ? deps.backgroundLedger.get(session) : [];
+  return json(res, 200, { ok: true, jobs });
+}
+
+async function handleDraftsList(deps, res) {
+  return json(res, 200, { ok: true, drafts: deps.draftsStore.list() });
+}
+
+async function handleDraftAdd(deps, req, res) {
+  const body = await readBody(req);
+  const config = body && typeof body.config === 'object' && body.config !== null ? body.config : {};
+  if (typeof config.id !== 'string' || config.id === '') return json(res, 400, { ok: false, error: 'draft config.id 必须为非空字符串' });
+  const draft = {
+    id: 'draft-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8),
+    source: typeof body.source === 'string' && body.source !== '' ? body.source : 'human',
+    config,
+    name: typeof body.name === 'string' && body.name !== '' ? body.name : config.id,
+    description: typeof body.description === 'string' ? body.description : '',
+    createdAt: Date.now(),
+  };
+  const persist = deps.draftsStore.add(draft);
+  return persistOk(res, { draft }, persist);
+}
+
+async function handleDraftApply(deps, req, res) {
+  const body = await readBody(req);
+  const id = body && typeof body.id === 'string' ? body.id : '';
+  if (id === '') return json(res, 400, { ok: false, error: 'draft id 不能为空' });
+  const draft = deps.draftsStore.get(id);
+  if (draft === undefined) return json(res, 404, { ok: false, error: 'draft 不存在（可能已被应用或删除）' });
+  const next = { ...draft };
+  if (typeof body.name === 'string' && body.name !== '') next.name = body.name;
+  if (typeof body.description === 'string') next.description = body.description;
+  const applied = await deps.applyDraft(next);
+  deps.draftsStore.remove(id);
+  return persistOk(res, applied, { persisted: applied.persisted !== false });
+}
+
+async function handleDraftRemove(deps, req, res) {
+  const body = await readBody(req);
+  const id = body && typeof body.id === 'string' ? body.id : '';
+  if (id === '') return json(res, 400, { ok: false, error: 'draft id 不能为空' });
+  const result = deps.draftsStore.remove(id);
+  return persistOk(res, { id }, result);
+}
+
 async function handleSetEnabled(deps, req, res) {
   const body = await readBody(req);
   const next = !!(body && body.enabled === true);
@@ -144,8 +191,7 @@ async function handleSetEnabled(deps, req, res) {
   return persistOk(res, { enabled: deps.getEnabled() }, persist);
 }
 
-// 只读建议注入开关（默认关）：改写 apply 闭包 evolutionAdvice 并持久化到 state.json。
-// 不改派发行为（建议只读提示）；写路由 CSRF 三件套自动生效。
+// 派发优化建议注入开关（默认关，只提示不改派发行为）。
 async function handleSetEvolutionAdvice(deps, req, res) {
   const body = await readBody(req);
   const next = !!(body && body.advice === true);
@@ -154,8 +200,7 @@ async function handleSetEvolutionAdvice(deps, req, res) {
   return persistOk(res, { evolutionAdvice: deps.getEvolutionAdvice() }, persist);
 }
 
-// 逃生舱开关（默认关）：改写 apply 闭包 escapeEnabled 并持久化到 state.json。
-// 只放行「放行集内且其余三道闸全过」的非 system 预设；非成员即便开关开也恒拒。
+// 逃生舱开关（默认关）：只放行「放行集内且三道闸全过」的非 system 预设。
 async function handleSetEscape(deps, req, res) {
   const body = await readBody(req);
   const next = !!(body && body.enabled === true);
@@ -164,8 +209,7 @@ async function handleSetEscape(deps, req, res) {
   return persistOk(res, { escapeEnabled: deps.getEscapeEnabled() }, persist);
 }
 
-// 放行集写路径校验：解析请求体的 preset id（非字符串/缺失归一为空串，由调用方
-// 400 拒绝）。纯同步、无副作用。
+// 放行集写路径校验：preset id 非字符串/缺失归一空串（调用方 400 拒绝）。
 function escapePresetId(body) {
   const raw = body && typeof body === 'object' && typeof body.preset === 'string' ? body.preset : '';
   return raw.trim();
@@ -197,24 +241,20 @@ async function handleAdd(deps, req, res) {
   if (typeof profile.id !== 'string' || profile.id.length === 0) {
     return json(res, 400, { ok: false, error: 'subagent-profiles: profile id 必须为非空字符串' });
   }
-  // 写路径上限：strict=true —— 超限/非法字段直接 400 拒绝，
-  // 与 loadProfiles（strict=false 迁移宽松读取）的行为区分。列被拒字段与中文原因。
+  // 写路径 strict=true：超限/非法字段 400 拒绝（与 loadProfiles 宽松读取区分）。
   const { clean, warnings } = sanitizeProfile(profile, { strict: true });
   if (warnings.length > 0) {
     const detail = warnings.map((w) => `${w.field}：${w.reason}`).join('；');
     return json(res, 400, { ok: false, error: `写入被拒绝：${detail}` });
   }
   const hadToolFilter = profile.toolFilter !== undefined;
-  // tokenTier 不参与上方通用 merge 循环：sanitizeProfile 对「未提供」恒回填
-  // balanced，若进循环会破坏「未传→保留 existing」语义（编辑内置 researcher
-  // 时 cheap 会被重置为 balanced）。故单独用 raw-body 守卫：传了才写（strict
-  // 模式下非法值已在上面 400 拒绝，clean.tokenTier 必为合法 enum）。
+  // tokenTier 单独用 raw-body 守卫（sanitize 恒回填 balanced，进 merge 会破坏
+  // 「未传→保留 existing」语义）；strict 下非法值已在上面 400 拒绝。
   const hadTokenTier = profile.tokenTier !== undefined;
   const existing = deps.store.profiles.get(clean.id);
   const seed = BUILTIN_SEEDS.find((s) => s.id === clean.id);
   const isBuiltin = (existing !== undefined && existing.builtin === true) || seed !== undefined;
-  // 合并而非替换：从现有 profile（或它被删时的 seed）出发，表单未带的字段
-  // （如内置方案的 persona/preset）在编辑或重新添加后仍然保留。
+  // 合并而非替换：表单未带字段（内置 persona/preset 等）编辑后仍保留。
   const merged = { ...(existing ?? seed ?? {}) };
   merged.id = clean.id;
   for (const key of ['name', 'description', 'preset', 'provider', 'model', 'reasoningEffort', 'persona', 'enabled']) {
@@ -222,8 +262,7 @@ async function handleAdd(deps, req, res) {
     if (clean[key] === '' || clean[key] === null) { delete merged[key]; continue; }  // 空：清除字段
     merged[key] = clean[key];
   }
-  // toolFilter 特殊处理：前端改成多选下拉后总是传数组，空数组 = 清除。请求未传
-  // toolFilter 时保留 existing 原值（merge 语义）；传了但被 sanitize 归一为空则清除。
+  // toolFilter：空数组 = 清除；未传保留 existing；传了但归一为空则清除。
   if (hadToolFilter) {
     const tf = clean.toolFilter;
     if (tf !== undefined && ((Array.isArray(tf.allow) && tf.allow.length > 0) || (Array.isArray(tf.deny) && tf.deny.length > 0))) {
@@ -279,22 +318,18 @@ async function handleSetProfileEnabled(deps, req, res) {
     return json(res, 404, { ok: false, error: `subagent-profiles: profile "${id}" 不存在（可在设置页确认可用的 profile id）` });
   }
   existing.enabled = body && body.enabled === false ? false : true;
-  // 无条件持久化（不只是内置方案）：运行时注册的 profile 的启用/禁用也必须
-  // 在重启后保留。
+  // 无条件持久化：运行时注册的 profile 启用/禁用也须重启后保留。
   existing.persisted = true;
   return persistOk(res, { id, enabled: existing.enabled }, deps.store.persistProfiles());
 }
 
-// 写路由 CSRF 传输授权：Origin 白名单 + Content-Type + 自定义头三道检查。
-// 返回 null 表示放行；否则返回 { reason, origin, contentType }——reason 进 403
-// 响应与 warn 日志，origin/contentType 只进日志（二者本就是请求头，非秘密）。
-// GET 只读路由不经过此处（只读无状态变更，不设防）。
+// CSRF 传输授权：Origin 白名单 + Content-Type + 自定义头；reason 进 403 与 warn
+// 日志，GET 只读不设防。
 function csrfViolation(req) {
   const headers = req.headers ?? {};
   const origin = typeof headers.origin === 'string' ? headers.origin : '';
   const contentType = typeof headers['content-type'] === 'string' ? headers['content-type'] : '';
-  // 1. Origin 白名单：带 Origin 时只放行本机源（hostname 宽松判定，端口不限）；
-  //    无 Origin 的本地脚本/curl 跳过此道，靠第 3 道自定义头兜底。
+  // 1. Origin 白名单：只放行本机源；无 Origin 的本地脚本靠第 3 道兜底。
   if (origin !== '') {
     let host;
     try { host = new URL(origin).hostname; } catch { host = null; }
@@ -313,9 +348,45 @@ function csrfViolation(req) {
   return null;
 }
 
-export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syncTool, catalog, ledger, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, logger }) {
-  const deps = { store, getEnabled, setEnabled, syncTool, catalog, ledger, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, logger };
-  // 路由分发（if 链保持，判断顺序与 404/500 兜底不变）。
+// 路由分发链（从 createHttpRoutes 抽出守行门）：纯 if 链分发，每条路由一行；
+// 未知路由 404 兜底。CSRF 与 loopback 守卫在 createHttpRoutes 入口完成。
+async function routeRequest(deps, req, res, url, sub) {
+  if (req.method === 'GET' && (sub === '/' || sub === '/list')) return handleList(deps, res);
+  if (req.method === 'GET' && sub === '/options/summary') return handleSummary(deps, res);
+  if (req.method === 'GET' && sub === '/options/versions') return handleVersions(res);
+  if (req.method === 'GET' && sub === '/options/efforts') return handleEfforts(deps, url, res);
+  if (req.method === 'GET' && sub === '/options/tools') return handleTools(deps, res);
+  if (req.method === 'GET' && sub === '/ledger/failures') return handleLedgerFailures(deps, url, res);
+  if (req.method === 'GET' && sub === '/ledger/jobs') return handleLedgerJobs(deps, url, res);
+  if (req.method === 'GET' && sub === '/reminders') return handleRemindersList(deps, res);
+  if (req.method === 'POST' && sub === '/reminders/ack') return handleRemindersAck(deps, req, res);
+  if (req.method === 'POST' && sub === '/reminders/action') return handleReminderAction(deps, req, res);
+  if (req.method === 'GET' && sub === '/drafts') return handleDraftsList(deps, res);
+  if (req.method === 'POST' && sub === '/draft') return handleDraftAdd(deps, req, res);
+  if (req.method === 'POST' && sub === '/draft/apply') return handleDraftApply(deps, req, res);
+  if (req.method === 'POST' && sub === '/draft/remove') return handleDraftRemove(deps, req, res);
+  if (req.method === 'POST' && sub === '/draft/preview') { const body = await readBody(req); return json(res, 200, { ok: true, ...(await deps.previewDraft(body)) }); }
+  if (req.method === 'GET' && sub === '/evolution/assets') return handleEvolutionAssets(deps, res);
+  if (req.method === 'POST' && sub === '/evolution/apply') return handleEvolutionApply(deps, req, res);
+  if (req.method === 'POST' && sub === '/evolution/regenerate') return handleEvolutionRegenerate(deps, req, res);
+  if (req.method === 'POST' && sub === '/advice/save-profile') return handleAdviceSaveProfile(deps, req, res);
+  if (req.method === 'POST' && sub === '/settings/candidate') return handleSettingsCandidate(deps, req, res);
+  if (req.method === 'POST' && sub === '/options/refresh') return handleRefresh(deps, res);
+  if (req.method === 'POST' && sub === '/set-enabled') return handleSetEnabled(deps, req, res);
+  if (req.method === 'POST' && sub === '/set-evolution-advice') return handleSetEvolutionAdvice(deps, req, res);
+  if (req.method === 'POST' && sub === '/set-escape') return handleSetEscape(deps, req, res);
+  if (req.method === 'POST' && sub === '/escape-add') return handleEscapeAdd(deps, req, res);
+  if (req.method === 'POST' && sub === '/escape-remove') return handleEscapeRemove(deps, req, res);
+  if (req.method === 'POST' && sub === '/add') return handleAdd(deps, req, res);
+  if (req.method === 'POST' && sub === '/remove') return handleRemove(deps, req, res);
+  if (req.method === 'POST' && sub === '/reset') return handleReset(deps, req, res);
+  if (req.method === 'POST' && sub === '/reset-all') return handleResetAll(deps, res);
+  if (req.method === 'POST' && sub === '/set-profile-enabled') return handleSetProfileEnabled(deps, req, res);
+  json(res, 404, { ok: false, error: `未知路由 ${sub}` });
+}
+
+export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syncTool, catalog, ledger, backgroundLedger, draftsStore, applyDraft, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, summariesFile, dispatchFile, adviceWhitelist, previewDraft, reminderStore, adviceSource, evolution, logger }) {
+  const deps = { store, getEnabled, setEnabled, syncTool, catalog, ledger, backgroundLedger, draftsStore, applyDraft, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice, summariesFile, dispatchFile, adviceWhitelist, previewDraft, reminderStore, adviceSource, evolution, logger };
   const handler = async (req, res) => {
     const remote = req.socket?.remoteAddress;
     if (!LOOPBACKS.has(remote)) return json(res, 403, { ok: false, error: '仅限本机访问' });
@@ -333,24 +404,7 @@ export function createHttpRoutes({ webServer, store, getEnabled, setEnabled, syn
           return json(res, 403, { ok: false, error: `CSRF 防护拒绝：${violation.reason}` });
         }
       }
-      if (req.method === 'GET' && (sub === '/' || sub === '/list')) return handleList(deps, res);
-      if (req.method === 'GET' && sub === '/options/summary') return handleSummary(deps, res);
-      if (req.method === 'GET' && sub === '/options/versions') return handleVersions(res);
-      if (req.method === 'GET' && sub === '/options/efforts') return handleEfforts(deps, url, res);
-      if (req.method === 'GET' && sub === '/options/tools') return handleTools(deps, res);
-      if (req.method === 'GET' && sub === '/ledger/failures') return handleLedgerFailures(deps, url, res);
-      if (req.method === 'POST' && sub === '/options/refresh') return handleRefresh(deps, res);
-      if (req.method === 'POST' && sub === '/set-enabled') return handleSetEnabled(deps, req, res);
-      if (req.method === 'POST' && sub === '/set-evolution-advice') return handleSetEvolutionAdvice(deps, req, res);
-      if (req.method === 'POST' && sub === '/set-escape') return handleSetEscape(deps, req, res);
-      if (req.method === 'POST' && sub === '/escape-add') return handleEscapeAdd(deps, req, res);
-      if (req.method === 'POST' && sub === '/escape-remove') return handleEscapeRemove(deps, req, res);
-      if (req.method === 'POST' && sub === '/add') return handleAdd(deps, req, res);
-      if (req.method === 'POST' && sub === '/remove') return handleRemove(deps, req, res);
-      if (req.method === 'POST' && sub === '/reset') return handleReset(deps, req, res);
-      if (req.method === 'POST' && sub === '/reset-all') return handleResetAll(deps, res);
-      if (req.method === 'POST' && sub === '/set-profile-enabled') return handleSetProfileEnabled(deps, req, res);
-      json(res, 404, { ok: false, error: `未知路由 ${sub}` });
+      return routeRequest(deps, req, res, url, sub);
     } catch (error) {
       // 通用 500 不回显内部错误信息（防泄漏），详情只进宿主日志。
       deps.logger.error('[dsh-subagent-profile] settings route error:', error instanceof Error ? (error.stack ?? error.message) : String(error));