ec-web 0.0.1 → 0.0.2

package/dist/sources/role-definitions.js

@@ -0,0 +1,1195 @@
+/**
+ * Role Definitions 数据源 — 管理角色定义及其权限配置
+ *
+ * 功能：
+ * 1. 读取 roles.json 或内置角色配置
+ * 2. 提供角色定义的 CRUD API
+ * 3. WebSocket 推送角色配置变化
+ *
+ * 数据流：
+ * - 读取：从 evolclaw/dist/config/roles.ts 导入 readRolesConfig
+ * - 写入：保存到 .evolclaw/roles.json
+ * - 推送：2秒轮询 + JSON diff
+ */
+import { getModelCatalogSnapshot } from './models.js';
+import { resolveParentDistModule, toFileUrl } from './parent-package.js';
+import { resolvePaths } from '../paths.js';
+import { ipcQuery } from '../ipc-client.js';
+// 动态导入 evolclaw 主项目的角色配置模块
+async function getRolesModule() {
+    const rolesPath = resolveParentDistModule('config', 'roles.js');
+    const cmPath = resolveParentDistModule('config', 'config-manager.js');
+    const resolverPath = resolveParentDistModule('config', 'peer-role-resolver.js');
+    const authPath = resolveParentDistModule('core', 'auth', 'auth-gateway.js');
+    // Windows 上需要转换为 file:// URL
+    try {
+        const rolesMod = await import(toFileUrl(rolesPath));
+        const cmMod = await import(toFileUrl(cmPath));
+        const resolverMod = await import(toFileUrl(resolverPath));
+        const authMod = await import(toFileUrl(authPath));
+        if (!rolesMod.readRolesConfig)
+            throw new Error('readRolesConfig not found in roles.js');
+        if (!rolesMod.getBuiltinRolesConfig)
+            throw new Error('getBuiltinRolesConfig not found in roles.js');
+        if (!rolesMod.roleExists)
+            throw new Error('roleExists not found in roles.js');
+        if (!cmMod.read)
+            throw new Error('read not found in config-manager.js');
+        if (!cmMod.write)
+            throw new Error('write not found in config-manager.js');
+        if (!cmMod.ConfigTarget)
+            throw new Error('ConfigTarget not found in config-manager.js');
+        if (!authMod.buildAuthSubject)
+            throw new Error('buildAuthSubject not found in auth-gateway.js');
+        if (!authMod.authorizeOperation)
+            throw new Error('authorizeOperation not found in auth-gateway.js');
+        return {
+            readRolesConfig: rolesMod.readRolesConfig,
+            getBuiltinRolesConfig: rolesMod.getBuiltinRolesConfig,
+            roleExists: rolesMod.roleExists,
+            read: cmMod.read,
+            write: cmMod.write,
+            ConfigTarget: cmMod.ConfigTarget,
+            resolver: resolverMod,
+            buildAuthSubject: authMod.buildAuthSubject,
+            authorizeOperation: authMod.authorizeOperation,
+        };
+    }
+    catch (err) {
+        console.error('[role-definitions] Failed to import roles modules:', err);
+        throw err;
+    }
+}
+async function getRoleConstraintsModule() {
+    const constraintsPath = resolveParentDistModule('config', 'role-constraints.js');
+    const mod = await import(toFileUrl(constraintsPath));
+    if (!mod.isModelAllowedByPatterns)
+        throw new Error('isModelAllowedByPatterns not found in role-constraints.js');
+    return {
+        isModelAllowedByPatterns: mod.isModelAllowedByPatterns,
+    };
+}
+async function getOperationRegistryModule() {
+    const registryPath = resolveParentDistModule('core', 'command', 'operation-registry.js');
+    const mod = await import(toFileUrl(registryPath));
+    if (!mod.listOperations)
+        throw new Error('listOperations not found in operation-registry.js');
+    return {
+        listOperations: mod.listOperations,
+    };
+}
+async function execRoleMenu(aid, payload, auth) {
+    const response = await ipcQuery(resolvePaths().socket, {
+        type: 'menu.exec',
+        payload: { ...payload, name: 'role', agent: aid, args: { self: aid, ...(payload.args ?? {}) } },
+        auth: { source: 'ecweb', actorAid: auth.actorAid ?? null, localDirect: !!auth.localDirect },
+    }, 10_000);
+    if (!response?.ok || !response.response)
+        throw new Error(response?.error || 'Role Menu is unavailable');
+    return response.response;
+}
+function roleMenuHttpStatus(code) {
+    if (code === 'NOT_FOUND')
+        return 404;
+    if (code === 'CONFLICT')
+        return 409;
+    if (code === 'PERMISSION_DENIED' || code === 'NOT_ALLOWED')
+        return 403;
+    if (code === 'TEMPORARILY_UNAVAILABLE')
+        return 503;
+    return 400;
+}
+function sendRoleMenuError(res, response) {
+    const error = response?.error ?? { code: 'INTERNAL_ERROR', message: 'Role Menu request failed' };
+    sendJson(res, roleMenuHttpStatus(error.code), {
+        error: error.message,
+        code: error.code,
+        data: error.data,
+    });
+}
+async function rolePolicyRevision(aid, auth) {
+    const response = await execRoleMenu(aid, {
+        type: 'menu.query', id: `ecweb-role-revision-${Date.now()}`,
+        args: { view: 'defaults' },
+    }, auth);
+    if (response.error)
+        throw Object.assign(new Error(response.error.message), { menuResponse: response });
+    return response.data.policyRevision;
+}
+async function buildMenuSnapshot(aid, agents, auth) {
+    const [roleOptions, defaults] = await Promise.all([
+        execRoleMenu(aid, { type: 'menu.options', id: `ecweb-role-options-${Date.now()}`, args: { option: 'roles' } }, auth),
+        execRoleMenu(aid, { type: 'menu.query', id: `ecweb-role-defaults-${Date.now()}`, args: { view: 'defaults' } }, auth),
+    ]);
+    if (roleOptions.error)
+        throw Object.assign(new Error(roleOptions.error.message), { menuResponse: roleOptions });
+    if (defaults.error)
+        throw Object.assign(new Error(defaults.error.message), { menuResponse: defaults });
+    const userRoles = roleOptions.data.filter(item => item.kind === 'user');
+    const details = await Promise.all(userRoles.map(item => execRoleMenu(aid, {
+        type: 'menu.query', id: `ecweb-role-${item.value}-${Date.now()}`,
+        args: { view: 'role', roleId: item.value },
+    }, auth)));
+    const roles = {};
+    for (const detail of details) {
+        if (!detail.error)
+            roles[detail.data.roleId] = detail.data.definition;
+    }
+    return {
+        $schema_version: 1,
+        aid,
+        self: aid,
+        agents: summarizeAgents(agents),
+        defaultRoles: defaults.data.defaultRoles,
+        policyRevision: defaults.data.policyRevision,
+        roles,
+    };
+}
+function isWriteMethod(method) {
+    return method === 'PUT' || method === 'POST' || method === 'DELETE';
+}
+function isReadMethod(method) {
+    return method === 'GET';
+}
+async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, operation, args) {
+    const actor = auth.actorAid || '';
+    const processOwners = Array.isArray(processConfig?.owners) ? processConfig.owners.map(String) : [];
+    const syntheticOwner = !!auth.localDirect || (!!actor && processOwners.includes(actor));
+    const subject = modules.buildAuthSubject({
+        selfAid: aid,
+        actorId: auth.localDirect ? 'local-direct' : actor || undefined,
+        channel: `ecweb#${aid}`,
+        channelType: 'aun',
+        channelId: actor || 'ecweb',
+        chatType: 'private',
+        conversationId: actor || 'ecweb',
+        processOwners,
+        ...(syntheticOwner ? {
+            roleDetail: {
+                effectiveRole: 'owner',
+                source: 'agent-config-owner',
+                isAuthenticated: true,
+                allowAccess: true,
+                roleExists: true,
+            },
+        } : {}),
+    });
+    return modules.authorizeOperation({
+        source: 'ecweb',
+        subject,
+        intent: {
+            operation,
+            scope: 'agent',
+            source: 'ecweb',
+            args: {
+                self: aid,
+                ...args,
+            },
+        },
+    });
+}
+const MODEL_PERMISSION_FIELD = 'baseagents.claude.model';
+const MODEL_PATTERN_OPTIONS = ['*', 'claude-opus-*', 'claude-sonnet-*', 'claude-haiku-*'];
+const COMMAND_PERMISSION_SCOPES = new Set(['relation', 'role', 'agent', 'process', 'filesystem', 'control', 'raw-cli']);
+const COMMAND_CONSTRAINT_KEYS = new Set([
+    'ownPeerOnly',
+    'ownAgentOnly',
+    'targetCurrentAgentOnly',
+    'requireAgentAdmin',
+    'requireAgentOwner',
+    'privateOnly',
+    'groupOnly',
+    'requireDaemonOwner',
+    'requireControlChannel',
+    'requireExplicitDangerousGrant',
+    'requireFieldOverride',
+    'allowedArgs',
+    'deniedArgs',
+    'forbiddenFlags',
+    'allowedConfigKeys',
+    'allowedPrefixes',
+    'timeoutMs',
+    'outputLimitBytes',
+    'cwdPolicy',
+    'envAllowlist',
+]);
+const COMMAND_BOOLEAN_CONSTRAINTS = new Set([
+    'ownPeerOnly',
+    'ownAgentOnly',
+    'targetCurrentAgentOnly',
+    'requireAgentAdmin',
+    'requireAgentOwner',
+    'privateOnly',
+    'groupOnly',
+    'requireDaemonOwner',
+    'requireControlChannel',
+    'requireExplicitDangerousGrant',
+]);
+const COMMAND_STRING_ARRAY_CONSTRAINTS = new Set([
+    'forbiddenFlags',
+    'allowedConfigKeys',
+    'allowedPrefixes',
+    'envAllowlist',
+]);
+const COMMAND_INTEGER_CONSTRAINTS = new Set(['timeoutMs', 'outputLimitBytes']);
+const ROLE_USAGE_COST_BASIS = new Set(['gateway', 'official']);
+const ROLE_USAGE_SCOPES = new Set(['subject', 'role']);
+const ROLE_USAGE_RESET_MODES = new Set(['never', 'daily', 'weekly', 'monthly']);
+const ROLE_USAGE_CURRENCIES = new Set(['CNY', 'USD']);
+function sendJson(res, status, payload) {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+}
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let body = '';
+        req.on('data', (chunk) => {
+            body += chunk.toString();
+            if (body.length > 1024 * 1024) {
+                reject(new Error('Request body too large'));
+                req.destroy();
+            }
+        });
+        req.on('end', () => {
+            if (!body.trim()) {
+                resolve({});
+                return;
+            }
+            try {
+                resolve(JSON.parse(body));
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function parseUrl(rawUrl) {
+    const qIdx = rawUrl.indexOf('?');
+    if (qIdx === -1)
+        return { path: rawUrl, query: {} };
+    const query = {};
+    for (const pair of rawUrl.slice(qIdx + 1).split('&')) {
+        const [k, v] = pair.split('=');
+        if (k)
+            query[decodeURIComponent(k)] = decodeURIComponent(v || '');
+    }
+    return { path: rawUrl.slice(0, qIdx), query };
+}
+async function getAgentsFromIpc() {
+    try {
+        const { ipcQuery } = await import('../ipc-client.js');
+        const resp = await ipcQuery(resolvePaths().socket, { type: 'evolagent.list' }, 3000);
+        return resp?.agents ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+function summarizeAgents(agents) {
+    return agents
+        .filter(agent => agent?.aid)
+        .map(agent => ({
+        aid: agent.aid,
+        displayName: agent.displayName ?? agent.personalName,
+        name: agent.name,
+    }));
+}
+function resolveRequestedAid(raw, agents) {
+    const requested = typeof raw === 'string' ? raw.trim() : '';
+    if (requested)
+        return requested;
+    return agents.find(agent => agent?.aid)?.aid || null;
+}
+function isReservedRoleName(roleName) {
+    return roleName === 'owner' || roleName === 'admin';
+}
+function isValidUserRoleName(roleName) {
+    return /^[a-z0-9_-]+$/.test(roleName) && !isReservedRoleName(roleName);
+}
+function builtinUserRoles(modules) {
+    return new Set(Object.keys(modules.getBuiltinRolesConfig().roles || {}));
+}
+function readAgentConfig(modules, aid) {
+    return modules.read(modules.ConfigTarget.Agent, { self: aid }) || { aid, channels: [] };
+}
+function writeAgentConfig(modules, aid, config) {
+    modules.write(modules.ConfigTarget.Agent, { ...config, aid, channels: Array.isArray(config.channels) ? config.channels : [] }, { self: aid });
+}
+function getAgentRoleDefinitions(config) {
+    return config.roles?.definitions && typeof config.roles.definitions === 'object'
+        ? config.roles.definitions
+        : {};
+}
+function updateAgentRoles(modules, aid, updater) {
+    const config = readAgentConfig(modules, aid);
+    const roles = config.roles && typeof config.roles === 'object' ? { ...config.roles } : {};
+    if (roles.definitions && typeof roles.definitions === 'object') {
+        roles.definitions = { ...roles.definitions };
+    }
+    if (roles.defaultRoles && typeof roles.defaultRoles === 'object') {
+        roles.defaultRoles = { ...roles.defaultRoles };
+    }
+    updater(roles, config);
+    const next = { ...config, roles };
+    writeAgentConfig(modules, aid, next);
+    return next;
+}
+function normalizeDefaultRoleInput(value, current) {
+    if (value === null || value === '')
+        return null;
+    if (typeof value === 'string')
+        return value;
+    return current ?? null;
+}
+function validateRoleDefinitionName(roleName) {
+    if (!roleName || !/^[a-z0-9_-]+$/.test(roleName))
+        return 'Invalid role name';
+    if (isReservedRoleName(roleName))
+        return 'owner/admin are management identities and cannot be user role definitions';
+    return null;
+}
+function inferSelectionMode(allowedModels = []) {
+    if (allowedModels.length === 0)
+        return 'explicit';
+    const patternCount = allowedModels.filter(m => m === '*' || m.endsWith('*')).length;
+    if (patternCount === allowedModels.length)
+        return 'pattern';
+    if (patternCount === 0)
+        return 'explicit';
+    return 'mixed';
+}
+function normalizeStringList(value) {
+    if (!Array.isArray(value))
+        return null;
+    const out = [];
+    const seen = new Set();
+    for (const item of value) {
+        if (typeof item !== 'string')
+            return null;
+        const trimmed = item.trim();
+        if (!trimmed)
+            return null;
+        if (!seen.has(trimmed)) {
+            seen.add(trimmed);
+            out.push(trimmed);
+        }
+    }
+    return out;
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function validateScalarArrayMap(value, label, errors) {
+    if (!isRecord(value)) {
+        errors.push(`${label} must be an object`);
+        return;
+    }
+    for (const [argName, allowedValues] of Object.entries(value)) {
+        if (!Array.isArray(allowedValues)) {
+            errors.push(`${label}.${argName} must be an array`);
+            continue;
+        }
+        for (const item of allowedValues) {
+            if (!['string', 'number', 'boolean'].includes(typeof item)) {
+                errors.push(`${label}.${argName} entries must be string, number, or boolean`);
+            }
+        }
+    }
+}
+function validateCommandPermissionConstraints(rule, constraints, errors) {
+    if (!isRecord(constraints)) {
+        errors.push(`${rule}.constraints must be an object`);
+        return;
+    }
+    for (const [key, value] of Object.entries(constraints)) {
+        const label = `${rule}.constraints.${key}`;
+        if (!COMMAND_CONSTRAINT_KEYS.has(key)) {
+            errors.push(`${label} is not supported`);
+            continue;
+        }
+        if (COMMAND_BOOLEAN_CONSTRAINTS.has(key) && typeof value !== 'boolean') {
+            errors.push(`${label} must be a boolean`);
+        }
+        else if (key === 'requireFieldOverride' && typeof value !== 'string') {
+            errors.push(`${label} must be a string`);
+        }
+        else if (COMMAND_STRING_ARRAY_CONSTRAINTS.has(key)) {
+            if (!Array.isArray(value) || !value.every(item => typeof item === 'string')) {
+                errors.push(`${label} must be a string array`);
+            }
+        }
+        else if (COMMAND_INTEGER_CONSTRAINTS.has(key)) {
+            if (!Number.isInteger(value) || value < 0)
+                errors.push(`${label} must be a non-negative integer`);
+        }
+        else if (key === 'cwdPolicy' && !['agentProject', 'evolclawHome', 'none'].includes(String(value))) {
+            errors.push(`${label} must be agentProject, evolclawHome, or none`);
+        }
+        else if (key === 'allowedArgs' || key === 'deniedArgs') {
+            validateScalarArrayMap(value, label, errors);
+        }
+    }
+}
+function validateCommandPermissions(value) {
+    const errors = [];
+    if (value === undefined)
+        return { ok: true, errors };
+    if (!isRecord(value)) {
+        return { ok: false, errors: ['commandPermissions must be an object'] };
+    }
+    for (const [rule, permission] of Object.entries(value)) {
+        if (!isRecord(permission)) {
+            errors.push(`${rule} must be an object`);
+            continue;
+        }
+        if (typeof permission.allow !== 'boolean') {
+            errors.push(`${rule}.allow must be a boolean`);
+        }
+        if (permission.dangerous !== undefined && typeof permission.dangerous !== 'boolean') {
+            errors.push(`${rule}.dangerous must be a boolean`);
+        }
+        if (permission.reason !== undefined && typeof permission.reason !== 'string') {
+            errors.push(`${rule}.reason must be a string`);
+        }
+        if (permission.scopes !== undefined) {
+            if (!Array.isArray(permission.scopes)) {
+                errors.push(`${rule}.scopes must be an array`);
+            }
+            else {
+                for (const scope of permission.scopes) {
+                    if (typeof scope !== 'string' || !COMMAND_PERMISSION_SCOPES.has(scope)) {
+                        errors.push(`${rule}.scopes contains unsupported scope: ${String(scope)}`);
+                    }
+                }
+            }
+        }
+        if (permission.constraints !== undefined) {
+            validateCommandPermissionConstraints(rule, permission.constraints, errors);
+        }
+    }
+    return { ok: errors.length === 0, errors };
+}
+function validateRoleUsageLimits(value) {
+    const errors = [];
+    if (value === undefined)
+        return { ok: true, errors };
+    if (!isRecord(value)) {
+        return { ok: false, errors: ['usageLimits must be an object'] };
+    }
+    if (value.enabled !== undefined && typeof value.enabled !== 'boolean') {
+        errors.push('usageLimits.enabled must be a boolean');
+    }
+    if (value.resetMode !== undefined && !ROLE_USAGE_RESET_MODES.has(String(value.resetMode))) {
+        errors.push('usageLimits.resetMode must be never, daily, weekly, or monthly');
+    }
+    if (value.currency !== undefined && !ROLE_USAGE_CURRENCIES.has(String(value.currency))) {
+        errors.push('usageLimits.currency must be CNY or USD');
+    }
+    const amount = value.limitAmount;
+    if (amount !== undefined && amount !== null) {
+        if (typeof amount !== 'number' || !Number.isFinite(amount) || amount < 0) {
+            errors.push('usageLimits.limitAmount must be a non-negative number or null');
+        }
+    }
+    if (value.costBasis !== undefined && !ROLE_USAGE_COST_BASIS.has(String(value.costBasis))) {
+        errors.push('usageLimits.costBasis must be gateway or official');
+    }
+    if (value.scope !== undefined && !ROLE_USAGE_SCOPES.has(String(value.scope))) {
+        errors.push('usageLimits.scope must be subject or role');
+    }
+    return { ok: errors.length === 0, errors };
+}
+function normalizeRoleUsageLimits(value) {
+    if (value === undefined)
+        return undefined;
+    const out = {};
+    if (typeof value.enabled === 'boolean')
+        out.enabled = value.enabled;
+    if (ROLE_USAGE_RESET_MODES.has(String(value.resetMode)))
+        out.resetMode = String(value.resetMode);
+    if (ROLE_USAGE_CURRENCIES.has(String(value.currency)))
+        out.currency = String(value.currency);
+    const amount = value.limitAmount;
+    if (amount === null)
+        out.limitAmount = null;
+    else if (typeof amount === 'number' && Number.isFinite(amount) && amount >= 0)
+        out.limitAmount = amount;
+    if (ROLE_USAGE_COST_BASIS.has(String(value.costBasis)))
+        out.costBasis = String(value.costBasis);
+    if (ROLE_USAGE_SCOPES.has(String(value.scope)))
+        out.scope = String(value.scope);
+    return out;
+}
+function normalizeRoleDefinitionForSave(roleDef) {
+    if (!isRecord(roleDef) || roleDef.usageLimits === undefined)
+        return roleDef;
+    return { ...roleDef, usageLimits: normalizeRoleUsageLimits(roleDef.usageLimits) };
+}
+function getModelPermission(roleDef) {
+    const permissions = roleDef?.permissions;
+    if (!permissions || typeof permissions !== 'object')
+        return {};
+    const perm = permissions[MODEL_PERMISSION_FIELD];
+    return perm && typeof perm === 'object' ? perm : {};
+}
+function stripSelectionModeFromPermission(perm) {
+    if (!perm || typeof perm !== 'object')
+        return perm;
+    const { selectionMode: _selectionMode, ...rest } = perm;
+    return rest;
+}
+function extractModelPermissionPayload(payload, currentPerm) {
+    const source = payload?.modelPermission && typeof payload.modelPermission === 'object'
+        ? payload.modelPermission
+        : payload;
+    return {
+        defaultModel: source.defaultModel ?? source.default ?? currentPerm.default,
+        allowOverride: source.allowOverride ?? currentPerm.allowOverride ?? false,
+        allowedModels: source.allowedModels ?? currentPerm.allowedModels,
+    };
+}
+async function validateModelPermissionInput(input) {
+    const errors = [];
+    const defaultModel = typeof input.defaultModel === 'string' ? input.defaultModel.trim() : '';
+    const allowedModels = normalizeStringList(input.allowedModels);
+    const allowOverride = input.allowOverride;
+    if (!defaultModel)
+        errors.push('defaultModel must be a non-empty string');
+    if (typeof allowOverride !== 'boolean')
+        errors.push('allowOverride must be a boolean');
+    if (!allowedModels || allowedModels.length === 0)
+        errors.push('allowedModels must be a non-empty string array');
+    if (defaultModel && allowedModels && allowedModels.length > 0) {
+        const { isModelAllowedByPatterns } = await getRoleConstraintsModule();
+        if (!isModelAllowedByPatterns(defaultModel, allowedModels)) {
+            errors.push('defaultModel must be allowed by allowedModels');
+        }
+    }
+    if (errors.length > 0 || !allowedModels) {
+        return { ok: false, errors };
+    }
+    return { ok: true, errors: [], value: { defaultModel, allowOverride, allowedModels } };
+}
+async function validateRoleModelPermission(roleDef) {
+    const permissions = roleDef?.permissions;
+    if (!permissions || typeof permissions !== 'object')
+        return { ok: true, errors: [] };
+    const perm = permissions[MODEL_PERMISSION_FIELD];
+    if (!perm || typeof perm !== 'object')
+        return { ok: true, errors: [] };
+    permissions[MODEL_PERMISSION_FIELD] = stripSelectionModeFromPermission(perm);
+    const result = await validateModelPermissionInput({
+        defaultModel: permissions[MODEL_PERMISSION_FIELD].default,
+        allowOverride: permissions[MODEL_PERMISSION_FIELD].allowOverride,
+        allowedModels: permissions[MODEL_PERMISSION_FIELD].allowedModels,
+    });
+    return { ok: result.ok, errors: result.errors };
+}
+async function filterAllowedCatalogModels(models, allowedModels) {
+    const { isModelAllowedByPatterns } = await getRoleConstraintsModule();
+    return models.filter(model => !model.isAlias && isModelAllowedByPatterns(model.id, allowedModels));
+}
+async function buildModelPermissionResponse(roleName, roleDef, override) {
+    const currentPerm = getModelPermission(roleDef);
+    const defaultModel = override?.defaultModel ?? currentPerm.default ?? '';
+    const allowOverride = override?.allowOverride ?? currentPerm.allowOverride ?? false;
+    const allowedModels = override?.allowedModels ?? (Array.isArray(currentPerm.allowedModels) ? currentPerm.allowedModels : []);
+    const catalog = await getModelCatalogSnapshot('claude');
+    const matchingModels = await filterAllowedCatalogModels(catalog.models, allowedModels);
+    return {
+        role: roleName,
+        field: MODEL_PERMISSION_FIELD,
+        permission: {
+            default: defaultModel,
+            allowOverride,
+            allowedModels,
+        },
+        selectionMode: inferSelectionMode(allowedModels),
+        patternOptions: MODEL_PATTERN_OPTIONS,
+        catalog,
+        matchingModels,
+        stats: {
+            catalogTotal: catalog.models.filter(model => !model.isAlias).length,
+            matchedTotal: matchingModels.length,
+        }
+    };
+}
+async function buildSnapshot(params = {}, auth = {}) {
+    try {
+        const agents = await getAgentsFromIpc();
+        const aid = resolveRequestedAid(params.aid, agents);
+        if (!aid)
+            return { $schema_version: 1, aid: null, agents: [], roles: {}, defaultRoles: { private: null, group: null } };
+        return await buildMenuSnapshot(aid, agents, auth);
+    }
+    catch (err) {
+        console.error('[role-definitions] Failed to build snapshot:', err);
+        return { $schema_version: 1, aid: null, agents: [], roles: {}, error: String(err) };
+    }
+}
+export const roleDefinitionsSource = {
+    kind: 'roleDefinitions',
+    async snapshot(params = {}) {
+        return buildSnapshot(params, params.__menuAuth ?? {});
+    },
+    subscribe(_params, push) {
+        let lastJson = '';
+        let stopped = false;
+        const tick = async () => {
+            if (stopped)
+                return;
+            try {
+                const snap = await buildSnapshot(_params, _params.__menuAuth ?? {});
+                const json = JSON.stringify(snap);
+                if (json !== lastJson) {
+                    lastJson = json;
+                    push(snap);
+                }
+            }
+            catch (err) {
+                console.error('[role-definitions] Polling error:', err);
+            }
+        };
+        // 立即执行一次
+        tick();
+        const timer = setInterval(tick, 2000); // 2秒轮询
+        return () => {
+            stopped = true;
+            clearInterval(timer);
+        };
+    }
+};
+async function handleRoleMenuCompatibility(req, res, auth, aid, agents, parsedUrl) {
+    const urlPath = parsedUrl.path;
+    const roleRoute = urlPath.match(/^\/api\/role-definitions\/([^/]+)$/);
+    const roleNestedRoute = urlPath.match(/^\/api\/role-definitions\/([^/]+)\/([^/]+)$/);
+    const decodeRole = (raw) => {
+        try {
+            return decodeURIComponent(raw);
+        }
+        catch {
+            return raw;
+        }
+    };
+    const requireAid = () => {
+        if (aid)
+            return true;
+        sendJson(res, 400, { error: 'aid is required' });
+        return false;
+    };
+    const execute = async (payload, successStatus = 200) => {
+        const response = await execRoleMenu(aid, payload, auth);
+        if (response.error) {
+            sendRoleMenuError(res, response);
+            return null;
+        }
+        if (successStatus > 0)
+            sendJson(res, successStatus, response.data);
+        return response.data;
+    };
+    try {
+        if (req.method === 'GET' && urlPath === '/api/role-definitions') {
+            if (!requireAid())
+                return true;
+            try {
+                sendJson(res, 200, await buildMenuSnapshot(aid, agents, auth));
+            }
+            catch (error) {
+                if (error?.menuResponse)
+                    sendRoleMenuError(res, error.menuResponse);
+                else
+                    throw error;
+            }
+            return true;
+        }
+        if (req.method === 'GET' && urlPath === '/api/role-definitions/operations') {
+            if (!requireAid())
+                return true;
+            const data = await execute({
+                type: 'menu.options', id: `ecweb-role-operations-${Date.now()}`, args: { option: 'operations' },
+            }, 0);
+            if (data)
+                sendJson(res, 200, { operations: data.map((item) => ({ id: item.value, ...item })) });
+            return true;
+        }
+        if (req.method === 'PUT' && urlPath === '/api/role-definitions') {
+            if (!requireAid())
+                return true;
+            const body = await readJsonBody(req);
+            if (body.roles !== undefined) {
+                sendJson(res, 400, { error: 'Bulk role replacement is not supported; update roles individually' });
+                return true;
+            }
+            const revision = await rolePolicyRevision(aid, auth);
+            const data = await execute({
+                type: 'menu.update', id: `ecweb-role-defaults-update-${Date.now()}`,
+                args: { resource: 'defaultRoles', expectedPolicyRevision: revision },
+                value: JSON.stringify(body.defaultRoles ?? {}),
+            }, 0);
+            if (data)
+                sendJson(res, 200, { ok: true, data: await buildMenuSnapshot(aid, agents, auth) });
+            return true;
+        }
+        if (req.method === 'POST' && urlPath === '/api/role-definitions') {
+            if (!requireAid())
+                return true;
+            const body = await readJsonBody(req);
+            const { name, ...definition } = body;
+            const revision = await rolePolicyRevision(aid, auth);
+            const data = await execute({
+                type: 'menu.action', id: `ecweb-role-create-${Date.now()}`, action: 'create',
+                args: { roleId: name, definition, expectedPolicyRevision: revision },
+            }, 0);
+            if (data)
+                sendJson(res, 201, { ok: true, role: data.definition, policyRevision: data.policyRevision });
+            return true;
+        }
+        if (req.method === 'GET' && roleRoute) {
+            if (!requireAid())
+                return true;
+            const data = await execute({
+                type: 'menu.query', id: `ecweb-role-detail-${Date.now()}`,
+                args: { view: 'role', roleId: decodeRole(roleRoute[1]) },
+            }, 0);
+            if (data)
+                sendJson(res, 200, data.definition);
+            return true;
+        }
+        if (req.method === 'PUT' && roleRoute) {
+            if (!requireAid())
+                return true;
+            const updates = await readJsonBody(req);
+            const revision = await rolePolicyRevision(aid, auth);
+            const data = await execute({
+                type: 'menu.update', id: `ecweb-role-update-${Date.now()}`,
+                args: { resource: 'definition', roleId: decodeRole(roleRoute[1]), expectedPolicyRevision: revision },
+                value: JSON.stringify(updates),
+            }, 0);
+            if (data)
+                sendJson(res, 200, { ok: true, policyRevision: data.policyRevision });
+            return true;
+        }
+        if (req.method === 'POST' && roleNestedRoute?.[2] === 'reset') {
+            if (!requireAid())
+                return true;
+            const revision = await rolePolicyRevision(aid, auth);
+            const data = await execute({
+                type: 'menu.action', id: `ecweb-role-reset-${Date.now()}`, action: 'reset',
+                args: { roleId: decodeRole(roleNestedRoute[1]), expectedPolicyRevision: revision },
+            }, 0);
+            if (data) {
+                const detail = await execRoleMenu(aid, {
+                    type: 'menu.query', id: `ecweb-role-reset-detail-${Date.now()}`,
+                    args: { view: 'role', roleId: decodeRole(roleNestedRoute[1]) },
+                }, auth);
+                sendJson(res, 200, { ok: true, role: detail.data?.definition, policyRevision: data.policyRevision });
+            }
+            return true;
+        }
+        if (req.method === 'DELETE' && roleRoute) {
+            if (!requireAid())
+                return true;
+            const revision = await rolePolicyRevision(aid, auth);
+            const actionArgs = {
+                roleId: decodeRole(roleRoute[1]),
+                expectedPolicyRevision: revision,
+            };
+            if (Object.prototype.hasOwnProperty.call(parsedUrl.query, 'replacementRoleId')) {
+                actionArgs.replacementRoleId = parsedUrl.query.replacementRoleId || null;
+            }
+            else if (parsedUrl.query.clearReferences === 'true') {
+                actionArgs.replacementRoleId = null;
+            }
+            const data = await execute({
+                type: 'menu.action', id: `ecweb-role-delete-${Date.now()}`, action: 'delete', args: actionArgs,
+            }, 0);
+            if (data)
+                sendJson(res, 200, { ok: true, ...data });
+            return true;
+        }
+        if (req.method === 'PUT' && roleNestedRoute?.[2] === 'model-permissions') {
+            if (!requireAid())
+                return true;
+            const payload = await readJsonBody(req);
+            const revision = await rolePolicyRevision(aid, auth);
+            const permission = {
+                default: payload.defaultModel ?? payload.default,
+                allowOverride: payload.allowOverride === true,
+                allowedModels: Array.isArray(payload.allowedModels) ? payload.allowedModels : [],
+            };
+            const data = await execute({
+                type: 'menu.update', id: `ecweb-role-model-update-${Date.now()}`,
+                args: { resource: 'definition', roleId: decodeRole(roleNestedRoute[1]), expectedPolicyRevision: revision },
+                value: JSON.stringify({ permissions: { [MODEL_PERMISSION_FIELD]: permission } }),
+            }, 0);
+            if (data)
+                sendJson(res, 200, { success: true, data: await buildModelPermissionResponse(decodeRole(roleNestedRoute[1]), data.definition) });
+            return true;
+        }
+    }
+    catch (error) {
+        if (error?.menuResponse)
+            sendRoleMenuError(res, error.menuResponse);
+        else
+            sendJson(res, 500, { error: error?.message || String(error) });
+        return true;
+    }
+    return false;
+}
+// HTTP API handler
+export async function handleRoleDefinitionsApi(req, res, auth = {}) {
+    try {
+        const parsedUrl = parseUrl(req.url || '');
+        const urlPath = parsedUrl.path;
+        const agents = await getAgentsFromIpc();
+        const aid = resolveRequestedAid(parsedUrl.query.aid, agents);
+        if (await handleRoleMenuCompatibility(req, res, auth, aid, agents, parsedUrl))
+            return;
+        if (isWriteMethod(req.method)) {
+            sendJson(res, 405, { error: 'This Role endpoint is not supported; use Role Menu' });
+            return;
+        }
+        const modules = await getRolesModule();
+        const { readRolesConfig, getBuiltinRolesConfig, read, ConfigTarget } = modules;
+        const roleRoute = urlPath.match(/^\/api\/role-definitions\/([^/]+)$/);
+        const roleNestedRoute = urlPath.match(/^\/api\/role-definitions\/([^/]+)\/([^/]+)$/);
+        const decodeRoleName = (raw) => {
+            try {
+                return decodeURIComponent(raw);
+            }
+            catch {
+                return raw;
+            }
+        };
+        if (req.method === 'GET' && urlPath === '/api/role-definitions/operations') {
+            const { listOperations } = await getOperationRegistryModule();
+            sendJson(res, 200, { operations: listOperations() });
+            return;
+        }
+        if ((isWriteMethod(req.method) || (isReadMethod(req.method) && aid)) && urlPath !== '/api/role-definitions/operations') {
+            if (!aid) {
+                sendJson(res, 400, { error: 'aid is required' });
+                return;
+            }
+            const processConfig = read(ConfigTarget.Process) || {};
+            const operation = isWriteMethod(req.method) ? 'role.policy.write' : 'role.policy.read';
+            const decision = await authorizeRolePolicyOperation(modules, processConfig, auth, aid, operation, {
+                method: req.method,
+                path: urlPath,
+            });
+            if (!decision.allow) {
+                console.warn('[role-definitions] Role policy access forbidden:', {
+                    method: req.method,
+                    url: req.url,
+                    actorAid: auth.actorAid,
+                    localDirect: !!auth.localDirect,
+                    operation,
+                    code: decision.code,
+                    reason: decision.reason,
+                });
+                sendJson(res, 403, {
+                    error: isWriteMethod(req.method)
+                        ? 'forbidden: agent owner required'
+                        : 'forbidden: role policy read not allowed',
+                    code: decision.code,
+                    reason: decision.reason,
+                    actorRole: decision.subject?.role,
+                });
+                return;
+            }
+        }
+        if (req.method === 'GET' && urlPath === '/api/role-definitions') {
+            sendJson(res, 200, await buildSnapshot({ aid }));
+            return;
+        }
+        if (req.method === 'PUT' && urlPath === '/api/role-definitions') {
+            try {
+                const incoming = await readJsonBody(req);
+                const currentConfig = readRolesConfig(aid || undefined);
+                if (incoming.roles && typeof incoming.roles === 'object') {
+                    for (const [roleName, roleDef] of Object.entries(incoming.roles)) {
+                        const nameError = validateRoleDefinitionName(roleName);
+                        if (nameError) {
+                            sendJson(res, 400, { error: `${nameError}: ${roleName}` });
+                            return;
+                        }
+                        const validation = await validateRoleModelPermission(roleDef);
+                        if (!validation.ok) {
+                            sendJson(res, 400, { error: `Invalid model permissions for role ${roleName}`, errors: validation.errors });
+                            return;
+                        }
+                        const commandValidation = validateCommandPermissions(roleDef?.commandPermissions);
+                        if (!commandValidation.ok) {
+                            sendJson(res, 400, { error: `Invalid command permissions for role ${roleName}`, errors: commandValidation.errors });
+                            return;
+                        }
+                        const usageValidation = validateRoleUsageLimits(roleDef?.usageLimits);
+                        if (!usageValidation.ok) {
+                            sendJson(res, 400, { error: `Invalid usage limits for role ${roleName}`, errors: usageValidation.errors });
+                            return;
+                        }
+                    }
+                }
+                updateAgentRoles(modules, aid, (roles) => {
+                    if (incoming.defaultRoles && typeof incoming.defaultRoles === 'object') {
+                        roles.defaultRoles = {
+                            private: normalizeDefaultRoleInput(incoming.defaultRoles.private, currentConfig.defaultRoles?.private),
+                            group: normalizeDefaultRoleInput(incoming.defaultRoles.group, currentConfig.defaultRoles?.group),
+                        };
+                    }
+                    if (incoming.roles && typeof incoming.roles === 'object') {
+                        const nextDefinitions = {};
+                        for (const [roleName, roleDef] of Object.entries(incoming.roles)) {
+                            nextDefinitions[roleName] = normalizeRoleDefinitionForSave(roleDef);
+                        }
+                        roles.definitions = nextDefinitions;
+                    }
+                });
+                sendJson(res, 200, { ok: true, data: await buildSnapshot({ aid }) });
+            }
+            catch (err) {
+                console.error('[role-definitions] Failed to update agent role config:', err);
+                sendJson(res, 400, { error: err.message });
+            }
+            return;
+        }
+        if (req.method === 'POST' && urlPath === '/api/role-definitions') {
+            try {
+                const data = await readJsonBody(req);
+                const { name, description, permissions, commandPermissions, usageLimits } = data;
+                const nameError = validateRoleDefinitionName(name);
+                if (nameError) {
+                    sendJson(res, 400, { error: nameError });
+                    return;
+                }
+                const config = readRolesConfig(aid || undefined);
+                if (config.roles[name]) {
+                    sendJson(res, 409, { error: 'Role already exists' });
+                    return;
+                }
+                const newRole = {
+                    description: typeof description === 'string' ? description : '',
+                    allowAccess: typeof data.allowAccess === 'boolean' ? data.allowAccess : true,
+                    permissions: isRecord(permissions) ? permissions : {},
+                    commandPermissions: isRecord(commandPermissions) ? commandPermissions : {}
+                };
+                const validation = await validateRoleModelPermission(newRole);
+                if (!validation.ok) {
+                    sendJson(res, 400, { error: 'Invalid model permissions', errors: validation.errors });
+                    return;
+                }
+                const commandValidation = validateCommandPermissions(newRole.commandPermissions);
+                if (!commandValidation.ok) {
+                    sendJson(res, 400, { error: 'Invalid command permissions', errors: commandValidation.errors });
+                    return;
+                }
+                const usageValidation = validateRoleUsageLimits(usageLimits);
+                if (!usageValidation.ok) {
+                    sendJson(res, 400, { error: 'Invalid usage limits', errors: usageValidation.errors });
+                    return;
+                }
+                if (usageLimits !== undefined) {
+                    newRole.usageLimits = normalizeRoleUsageLimits(usageLimits);
+                }
+                updateAgentRoles(modules, aid, (roles) => {
+                    roles.definitions = { ...(roles.definitions || {}), [name]: newRole };
+                });
+                sendJson(res, 201, { ok: true, role: newRole });
+            }
+            catch (err) {
+                console.error('[role-definitions] Failed to create role:', err);
+                sendJson(res, 400, { error: err.message });
+            }
+            return;
+        }
+        if (req.method === 'GET' && roleNestedRoute?.[2] === 'configurable-models') {
+            const roleName = decodeRoleName(roleNestedRoute[1]);
+            const config = readRolesConfig(aid || undefined);
+            const roleDef = config.roles[roleName];
+            if (!roleDef) {
+                sendJson(res, 404, { success: false, error: 'Role not found' });
+                return;
+            }
+            const data = await buildModelPermissionResponse(roleName, roleDef);
+            sendJson(res, 200, { success: true, data });
+            return;
+        }
+        if (req.method === 'POST' && roleNestedRoute?.[2] === 'preview-models') {
+            const roleName = decodeRoleName(roleNestedRoute[1]);
+            const config = readRolesConfig(aid || undefined);
+            const roleDef = config.roles[roleName];
+            if (!roleDef) {
+                sendJson(res, 404, { success: false, error: 'Role not found' });
+                return;
+            }
+            const payload = await readJsonBody(req);
+            const currentPerm = getModelPermission(roleDef);
+            const validation = await validateModelPermissionInput(extractModelPermissionPayload(payload, currentPerm));
+            if (!validation.ok || !validation.value) {
+                sendJson(res, 400, { success: false, error: 'Invalid model permissions', errors: validation.errors });
+                return;
+            }
+            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value);
+            sendJson(res, 200, { success: true, data });
+            return;
+        }
+        if (req.method === 'PUT' && roleNestedRoute?.[2] === 'model-permissions') {
+            const roleName = decodeRoleName(roleNestedRoute[1]);
+            const config = readRolesConfig(aid || undefined);
+            const roleDef = config.roles[roleName];
+            if (!roleDef) {
+                sendJson(res, 404, { success: false, error: 'Role not found' });
+                return;
+            }
+            const payload = await readJsonBody(req);
+            const currentPerm = getModelPermission(roleDef);
+            const validation = await validateModelPermissionInput(extractModelPermissionPayload(payload, currentPerm));
+            if (!validation.ok || !validation.value) {
+                sendJson(res, 400, { success: false, error: 'Invalid model permissions', errors: validation.errors });
+                return;
+            }
+            roleDef.permissions = roleDef.permissions && typeof roleDef.permissions === 'object'
+                ? roleDef.permissions
+                : {};
+            const existingPerm = stripSelectionModeFromPermission(getModelPermission(roleDef));
+            roleDef.permissions[MODEL_PERMISSION_FIELD] = {
+                ...existingPerm,
+                default: validation.value.defaultModel,
+                allowOverride: validation.value.allowOverride,
+                allowedModels: validation.value.allowedModels,
+            };
+            updateAgentRoles(modules, aid, (roles) => {
+                roles.definitions = { ...(roles.definitions || {}), [roleName]: roleDef };
+            });
+            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value);
+            sendJson(res, 200, { success: true, data });
+            return;
+        }
+        if (req.method === 'POST' && roleNestedRoute?.[2] === 'reset') {
+            const roleName = decodeRoleName(roleNestedRoute[1]);
+            const builtinConfig = getBuiltinRolesConfig();
+            const builtinRole = builtinConfig.roles[roleName];
+            if (!builtinRole) {
+                sendJson(res, 404, { error: 'Role not found in builtin config' });
+                return;
+            }
+            updateAgentRoles(modules, aid, (roles) => {
+                const definitions = { ...(roles.definitions || {}) };
+                delete definitions[roleName];
+                if (Object.keys(definitions).length)
+                    roles.definitions = definitions;
+                else
+                    delete roles.definitions;
+            });
+            sendJson(res, 200, { ok: true, role: builtinRole });
+            return;
+        }
+        if (req.method === 'GET' && roleRoute) {
+            const roleName = decodeRoleName(roleRoute[1]);
+            const config = readRolesConfig(aid || undefined);
+            const roleDef = config.roles[roleName];
+            if (!roleDef) {
+                sendJson(res, 404, { error: 'Role not found' });
+                return;
+            }
+            sendJson(res, 200, roleDef);
+            return;
+        }
+        if (req.method === 'DELETE' && roleRoute) {
+            const roleName = decodeRoleName(roleRoute[1]);
+            const builtinRoles = builtinUserRoles(modules);
+            if (builtinRoles.has(roleName) || isReservedRoleName(roleName)) {
+                sendJson(res, 403, { error: 'Cannot delete builtin or management role' });
+                return;
+            }
+            const agentConfig = readAgentConfig(modules, aid);
+            const definitions = getAgentRoleDefinitions(agentConfig);
+            if (!definitions[roleName]) {
+                sendJson(res, 404, { error: 'Role not found' });
+                return;
+            }
+            updateAgentRoles(modules, aid, (roles) => {
+                const nextDefinitions = { ...(roles.definitions || {}) };
+                delete nextDefinitions[roleName];
+                if (Object.keys(nextDefinitions).length)
+                    roles.definitions = nextDefinitions;
+                else
+                    delete roles.definitions;
+            });
+            sendJson(res, 200, { ok: true });
+            return;
+        }
+        if (req.method === 'PUT' && roleRoute) {
+            try {
+                const roleName = decodeRoleName(roleRoute[1]);
+                const updates = await readJsonBody(req);
+                const nameError = validateRoleDefinitionName(roleName);
+                if (nameError) {
+                    sendJson(res, 400, { error: nameError });
+                    return;
+                }
+                const config = readRolesConfig(aid || undefined);
+                const currentRole = config.roles[roleName];
+                if (!currentRole) {
+                    sendJson(res, 404, { error: 'Role not found' });
+                    return;
+                }
+                const nextRole = {
+                    ...currentRole,
+                    ...updates
+                };
+                if (updates.permissions && typeof updates.permissions === 'object') {
+                    const mergedPermissions = { ...(currentRole.permissions || {}) };
+                    for (const [permKey, permValue] of Object.entries(updates.permissions)) {
+                        const currentPerm = mergedPermissions[permKey];
+                        if (currentPerm && typeof currentPerm === 'object' && !Array.isArray(currentPerm) &&
+                            permValue && typeof permValue === 'object' && !Array.isArray(permValue)) {
+                            mergedPermissions[permKey] = { ...currentPerm, ...permValue };
+                        }
+                        else {
+                            mergedPermissions[permKey] = permValue;
+                        }
+                    }
+                    nextRole.permissions = mergedPermissions;
+                }
+                if (Object.prototype.hasOwnProperty.call(updates, 'commandPermissions')) {
+                    const commandValidation = validateCommandPermissions(updates.commandPermissions);
+                    if (!commandValidation.ok) {
+                        sendJson(res, 400, { error: 'Invalid command permissions', errors: commandValidation.errors });
+                        return;
+                    }
+                    nextRole.commandPermissions = updates.commandPermissions;
+                }
+                if (Object.prototype.hasOwnProperty.call(updates, 'usageLimits')) {
+                    const usageValidation = validateRoleUsageLimits(updates.usageLimits);
+                    if (!usageValidation.ok) {
+                        sendJson(res, 400, { error: 'Invalid usage limits', errors: usageValidation.errors });
+                        return;
+                    }
+                    nextRole.usageLimits = normalizeRoleUsageLimits(updates.usageLimits);
+                }
+                const validation = await validateRoleModelPermission(nextRole);
+                if (!validation.ok) {
+                    sendJson(res, 400, { error: 'Invalid model permissions', errors: validation.errors });
+                    return;
+                }
+                updateAgentRoles(modules, aid, (roles) => {
+                    roles.definitions = { ...(roles.definitions || {}), [roleName]: nextRole };
+                });
+                sendJson(res, 200, { ok: true });
+            }
+            catch (err) {
+                console.error('[role-definitions] Failed to update role:', err);
+                sendJson(res, 400, { error: err.message });
+            }
+            return;
+        }
+        sendJson(res, 404, { error: 'Not found' });
+    }
+    catch (err) {
+        console.error('[role-definitions] API error:', err);
+        sendJson(res, 500, { error: err.message });
+    }
+}