lumencode 1.3.0 → 1.3.2

package/lib/server.js

@@ -3,16 +3,18 @@ import { readFileSync, existsSync } from 'fs';
 import { join, extname, resolve, sep } from 'path';
 import { fileURLToPath } from 'url';
 import { saveConfig } from './config.js';
-import { generateWorkReport, generateFeishuCard } from './report.js';
+import { parseRepoPaths } from './path-utils.js';
+import { generateWorkReport, generateFeishuCard, generateBossReport } from './report.js';
+import { classifyRecord } from './scenario.js';
 import { collectAllRecords, filterRecordsByPeriod, groupBySessions, computeUsageStats, computeTrendData, computePrevPeriodRange } from './aggregate.js';
 import { normalizeProjectPath } from './aggregate.js';
 import { invalidateFileCache } from './cache.js';
-import { invalidateGitCache, getGitStatsForMultipleReposAsync, finalizeGitStats } from './git.js';
+import { invalidateGitCache, getGitStatsForMultipleReposAsync, finalizeGitStats, computeAIContribution, computeCommitTypes, computeFileHotspots } from './git.js';
 import { identifyBillingBlocks } from './blocks.js';
-import { detectAvailableTools, parseAllEnabledTools } from './parsers/index.js';
-import { isAssistantRecord, getInputTokens, getOutputTokens } from './record-utils.js';
-import { StepTracker } from './step-tracker.js';
-import { disableHooks, enableHooks, getHooksStatus, HOOK_TOOLS, initStepTracking } from './hooks-manager.js';
+import { detectAvailableTools, parseAllEnabledTools } from './parsers/index.js';
+import { isAssistantRecord, getInputTokens, getOutputTokens } from './record-utils.js';
+import { StepTracker } from './step-tracker.js';
+import { disableHooks, enableHooks, getHooksStatus, HOOK_TOOLS, initStepTracking } from './hooks-manager.js';
 
 // basename 提取，兼容不同路径格式
 function getProjectBaseName(p) {
@@ -39,42 +41,42 @@ const MIME = {
   '.ico': 'image/x-icon',
 };
 
-export function startServer(config, effectiveIncludeProjects, buildReportData, configPath) {
-  function computeIncludeProjects(cfg) {
-    if (cfg.repos && cfg.repos.length > 0) {
-      return cfg.repos.map(r => normalizeProjectPath(r));
-    }
-    return null;
-  }
-
-  function getHookProjectRoots(cfg) {
-    if (!Array.isArray(cfg.repos)) return [];
-    return [...new Set(cfg.repos.map(r => normalizeProjectPath(String(r || '').trim())).filter(Boolean))];
-  }
-
-  function getConfiguredHooksStatus(cfg) {
-    const projectRoots = getHookProjectRoots(cfg);
-    const projects = projectRoots.map(root => getHooksStatus(root));
-    const total = projects.length;
-    const enabledCount = (tool) => projects.filter(p => p[tool]?.enabled).length;
-    const stepsReadyCount = projects.filter(p => p.stepsInitialized).length;
-    const toolStatus = (tool) => ({
-      enabled: total > 0 && enabledCount(tool) === total,
-      enabledCount: enabledCount(tool),
-      total,
-    });
-
-    return {
-      targetMode: 'configured-projects',
-      projectCount: total,
-      projects,
-      stepsInitialized: total > 0 && stepsReadyCount === total,
-      stepsReadyCount,
-      claude: toolStatus(HOOK_TOOLS.CLAUDE),
-      codex: toolStatus(HOOK_TOOLS.CODEX),
-      opencode: toolStatus(HOOK_TOOLS.OPENCODE),
-    };
-  }
+export function startServer(config, effectiveIncludeProjects, buildReportData, configPath) {
+  function computeIncludeProjects(cfg) {
+    if (cfg.repos && cfg.repos.length > 0) {
+      return cfg.repos.map(r => normalizeProjectPath(r));
+    }
+    return null;
+  }
+
+  function getHookProjectRoots(cfg) {
+    if (!Array.isArray(cfg.repos)) return [];
+    return [...new Set(cfg.repos.map(r => normalizeProjectPath(String(r || '').trim())).filter(Boolean))];
+  }
+
+  function getConfiguredHooksStatus(cfg) {
+    const projectRoots = getHookProjectRoots(cfg);
+    const projects = projectRoots.map(root => getHooksStatus(root));
+    const total = projects.length;
+    const enabledCount = (tool) => projects.filter(p => p[tool]?.enabled).length;
+    const stepsReadyCount = projects.filter(p => p.stepsInitialized).length;
+    const toolStatus = (tool) => ({
+      enabled: total > 0 && enabledCount(tool) === total,
+      enabledCount: enabledCount(tool),
+      total,
+    });
+
+    return {
+      targetMode: 'configured-projects',
+      projectCount: total,
+      projects,
+      stepsInitialized: total > 0 && stepsReadyCount === total,
+      stepsReadyCount,
+      claude: toolStatus(HOOK_TOOLS.CLAUDE),
+      codex: toolStatus(HOOK_TOOLS.CODEX),
+      opencode: toolStatus(HOOK_TOOLS.OPENCODE),
+    };
+  }
 
   const PORT = process.env.LUMENCODE_PORT || 4567;
 
@@ -89,8 +91,8 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
   const REPORT_CACHE_TTL = 30_000; // 30s
   const REPORT_CACHE_MAX_SIZE = 50;
 
-  function getReportCacheKey(period, date, tool, customStart, customEnd, format) {
-    return `${period}|${date}|${tool || 'all'}|${customStart || ''}|${customEnd || ''}|${format || 'json'}`;
+  function getReportCacheKey(period, date, tool, customStart, customEnd) {
+    return `${period}|${date}|${tool || 'all'}|${customStart || ''}|${customEnd || ''}`;
   }
 
   function getCachedReport(cacheKey) {
@@ -109,55 +111,55 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
     }
   }
 
-  function invalidateReportCache() {
-    _reportCache.clear();
-  }
-
-  function writeJson(res, statusCode, data) {
-    res.writeHead(statusCode, {
-      'Content-Type': 'application/json',
-      'Access-Control-Allow-Origin': 'http://localhost:' + PORT,
-    });
-    res.end(JSON.stringify(data));
-  }
-
-  function parseHookTools(value) {
-    if (!value) return [HOOK_TOOLS.CLAUDE, HOOK_TOOLS.CODEX, HOOK_TOOLS.OPENCODE];
-    const tools = [];
-    for (const raw of String(value).split(',')) {
-      const tool = raw.trim().toLowerCase();
-      if (!tool) continue;
-      if (tool === 'claude' || tool === 'claude-code') tools.push(HOOK_TOOLS.CLAUDE);
-      else if (tool === 'codex') tools.push(HOOK_TOOLS.CODEX);
-      else if (tool === 'opencode' || tool === 'open-code') tools.push(HOOK_TOOLS.OPENCODE);
-    }
-    return [...new Set(tools)];
-  }
-
-  function readJsonBody(req, res, callback) {
-    let body = '';
-    let bodySize = 0;
-    const MAX_BODY = 1024 * 1024; // 1MB
-    req.on('data', chunk => {
-      bodySize += chunk.length;
-      if (bodySize > MAX_BODY) { req.destroy(); return; }
-      body += chunk;
-    });
-    req.on('end', () => {
-      if (bodySize > MAX_BODY) {
-        writeJson(res, 413, { error: '请求体过大' });
-        return;
-      }
-      try {
-        Promise.resolve(callback(body ? JSON.parse(body) : {})).catch(err => {
-          console.error('API error:', err.message);
-          writeJson(res, 500, { error: err.message || '服务器内部错误' });
-        });
-      } catch {
-        writeJson(res, 400, { error: 'JSON 解析失败' });
-      }
-    });
-  }
+  function invalidateReportCache() {
+    _reportCache.clear();
+  }
+
+  function writeJson(res, statusCode, data) {
+    res.writeHead(statusCode, {
+      'Content-Type': 'application/json',
+      'Access-Control-Allow-Origin': 'http://localhost:' + PORT,
+    });
+    res.end(JSON.stringify(data));
+  }
+
+  function parseHookTools(value) {
+    if (!value) return [HOOK_TOOLS.CLAUDE, HOOK_TOOLS.CODEX, HOOK_TOOLS.OPENCODE];
+    const tools = [];
+    for (const raw of String(value).split(',')) {
+      const tool = raw.trim().toLowerCase();
+      if (!tool) continue;
+      if (tool === 'claude' || tool === 'claude-code') tools.push(HOOK_TOOLS.CLAUDE);
+      else if (tool === 'codex') tools.push(HOOK_TOOLS.CODEX);
+      else if (tool === 'opencode' || tool === 'open-code') tools.push(HOOK_TOOLS.OPENCODE);
+    }
+    return [...new Set(tools)];
+  }
+
+  function readJsonBody(req, res, callback) {
+    let body = '';
+    let bodySize = 0;
+    const MAX_BODY = 1024 * 1024; // 1MB
+    req.on('data', chunk => {
+      bodySize += chunk.length;
+      if (bodySize > MAX_BODY) { req.destroy(); return; }
+      body += chunk;
+    });
+    req.on('end', () => {
+      if (bodySize > MAX_BODY) {
+        writeJson(res, 413, { error: '请求体过大' });
+        return;
+      }
+      try {
+        Promise.resolve(callback(body ? JSON.parse(body) : {})).catch(err => {
+          console.error('API error:', err.message);
+          writeJson(res, 500, { error: err.message || '服务器内部错误' });
+        });
+      } catch {
+        writeJson(res, 400, { error: 'JSON 解析失败' });
+      }
+    });
+  }
 
   function getCachedParse(config, includeProjects) {
     const key = `${config.claudeDir}|${includeProjects?.join(',') || ''}`;
@@ -179,6 +181,66 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
     return result;
   }
 
+  function deriveProjectGitStats(gitStats, project, start, end, attributionOptions) {
+    if (!gitStats?.commitList?.length || !project) return null;
+    const windowEnd = end + 'T23:59:59';
+    const commitList = gitStats.commitList.filter(c => {
+      return getProjectBaseName(c.repo) === project && (c.date || '') >= start && (c.date || '') <= windowEnd;
+    });
+    if (commitList.length === 0) return null;
+
+    return {
+      commits: commitList.length,
+      filesChanged: new Set(commitList.flatMap(c => (c.files || []).map(f => f.path))).size,
+      linesAdded: commitList.reduce((s, c) => s + (c.linesAdded || 0), 0),
+      linesDeleted: commitList.reduce((s, c) => s + (c.linesDeleted || 0), 0),
+      commitList,
+      commitTypes: computeCommitTypes(commitList),
+      fileHotspots: computeFileHotspots(commitList, 10),
+      aiContribution: computeAIContribution(commitList, null, attributionOptions),
+      attributionSummary: gitStats.attributionSummary,
+    };
+  }
+
+  function prepareJsonReportData(baseData, tool) {
+    const data = { ...baseData };
+
+    if (tool !== 'all' && data.gitStats?.aiContributionByTool) {
+      const toolAi = data.gitStats.aiContributionByTool[tool];
+      if (toolAi) {
+        data.gitStats = { ...data.gitStats, aiContribution: toolAi };
+      }
+    }
+
+    if (data.usageStats?.models) {
+      const modelEntries = Object.entries(data.usageStats.models)
+        .sort((a, b) => b[1].cost - a[1].cost);
+      const totalCost = modelEntries.reduce((s, [, d]) => s + (d.cost || 0), 0);
+      const cacheRead = data.usageStats.cacheRead || 0;
+      const cacheCreate = data.usageStats.cacheCreate || 0;
+      let cacheSaving = 0;
+      if (totalCost > 0 && (cacheRead + cacheCreate) > 0) {
+        const totalInput = data.usageStats.inputTokens || 1;
+        const avgInputCostPerToken = totalCost / (totalInput + data.usageStats.outputTokens + cacheRead + cacheCreate || 1);
+        cacheSaving = Math.round(cacheRead * avgInputCostPerToken * 0.9 * 100) / 100;
+      }
+      data.costBreakdown = {
+        models: modelEntries.map(([name, d]) => ({
+          name,
+          cost: d.cost || 0,
+          mode: d.costMode || 'unknown',
+          requests: d.count,
+          inputTokens: d.inputTokens,
+          outputTokens: d.outputTokens,
+        })),
+        cacheSaving,
+        total: Math.round(totalCost * 100) / 100,
+      };
+    }
+
+    return data;
+  }
+
   const server = createServer(async (req, res) => {
     const url = new URL(req.url, `http://localhost:${PORT}`);
 
@@ -189,60 +251,60 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
     res.setHeader('X-XSS-Protection', '1; mode=block');
     res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
 
-    // API endpoint
-    if (url.pathname === '/api/hooks') {
-      try {
-        if (req.method === 'GET') {
-          writeJson(res, 200, getConfiguredHooksStatus(config));
-          return;
-        }
-
-        if (req.method === 'POST') {
-          readJsonBody(req, res, async (body) => {
-            const action = body.action || 'enable';
-            const tools = parseHookTools(body.tools || url.searchParams.get('tools'));
-            if (tools.length === 0) {
-              writeJson(res, 400, { error: '未选择支持的 hooks 工具' });
-              return;
-            }
-            const projectRoots = getHookProjectRoots(config);
-            if (projectRoots.length === 0) {
-              writeJson(res, 400, { error: '请先在设置中添加项目路径，页面开启 hooks 只作用于设置内配置的项目。' });
-              return;
-            }
-            const stepTracking = [];
-            const results = [];
-            for (const projectRoot of projectRoots) {
-              let projectStepTracking = null;
-              if (action !== 'disable') {
-                projectStepTracking = await initStepTracking(projectRoot);
-                stepTracking.push({ projectRoot, ...projectStepTracking });
-              }
-              const projectResults = action === 'disable'
-                ? disableHooks(projectRoot, tools, { backup: true })
-                : enableHooks(projectRoot, tools, { backup: true });
-              results.push({ projectRoot, stepTracking: projectStepTracking, results: projectResults });
-            }
-            writeJson(res, 200, {
-              success: true,
-              action,
-              stepTracking,
-              results,
-              status: getConfiguredHooksStatus(config),
-            });
-          });
-          return;
-        }
-
-        writeJson(res, 405, { error: 'Method not allowed' });
-      } catch (err) {
-        console.error('API error:', err.message);
-        writeJson(res, 500, { error: err.message || '服务器内部错误' });
-      }
-      return;
-    }
-
-    if (url.pathname === '/api/tools') {
+    // API endpoint
+    if (url.pathname === '/api/hooks') {
+      try {
+        if (req.method === 'GET') {
+          writeJson(res, 200, getConfiguredHooksStatus(config));
+          return;
+        }
+
+        if (req.method === 'POST') {
+          readJsonBody(req, res, async (body) => {
+            const action = body.action || 'enable';
+            const tools = parseHookTools(body.tools || url.searchParams.get('tools'));
+            if (tools.length === 0) {
+              writeJson(res, 400, { error: '未选择支持的 hooks 工具' });
+              return;
+            }
+            const projectRoots = getHookProjectRoots(config);
+            if (projectRoots.length === 0) {
+              writeJson(res, 400, { error: '请先在设置中添加项目路径，页面开启 hooks 只作用于设置内配置的项目。' });
+              return;
+            }
+            const stepTracking = [];
+            const results = [];
+            for (const projectRoot of projectRoots) {
+              let projectStepTracking = null;
+              if (action !== 'disable') {
+                projectStepTracking = await initStepTracking(projectRoot);
+                stepTracking.push({ projectRoot, ...projectStepTracking });
+              }
+              const projectResults = action === 'disable'
+                ? disableHooks(projectRoot, tools, { backup: true })
+                : enableHooks(projectRoot, tools, { backup: true });
+              results.push({ projectRoot, stepTracking: projectStepTracking, results: projectResults });
+            }
+            writeJson(res, 200, {
+              success: true,
+              action,
+              stepTracking,
+              results,
+              status: getConfiguredHooksStatus(config),
+            });
+          });
+          return;
+        }
+
+        writeJson(res, 405, { error: 'Method not allowed' });
+      } catch (err) {
+        console.error('API error:', err.message);
+        writeJson(res, 500, { error: err.message || '服务器内部错误' });
+      }
+      return;
+    }
+
+    if (url.pathname === '/api/tools') {
       try {
         const tools = await detectAvailableTools(config);
         const enabled = config.enabledTools || tools.filter(t => t.detected).map(t => t.name);
@@ -312,20 +374,25 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
 
       try {
         // 查询结果缓存：相同条件直接返回缓存
-        const reportCacheKey = getReportCacheKey(period, date, tool, customStart, customEnd, format);
+        const reportCacheKey = getReportCacheKey(period, date, tool, customStart, customEnd);
         let data = getCachedReport(reportCacheKey);
-        if (data) {
+        if (data && format !== 'work') {
+          const responseData = prepareJsonReportData(data, tool);
           res.writeHead(200, {
             'Content-Type': 'application/json',
             'Access-Control-Allow-Origin': 'http://localhost:' + PORT,
             'X-Cache': 'HIT',
           });
-          res.end(JSON.stringify(data));
+          res.end(JSON.stringify(responseData));
           return;
         }
 
-        const parsed = await getOrParse(config, includeProjects);
-        data = await buildReportData(period, date, config, includeProjects, tool, parsed, { customStart, customEnd });
+        let parsed = null;
+        if (!data) {
+          parsed = await getOrParse(config, includeProjects);
+          data = await buildReportData(period, date, config, includeProjects, tool, parsed, { customStart, customEnd });
+          if (data) setCachedReport(reportCacheKey, data);
+        }
         if (!data) {
           res.writeHead(200, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({
@@ -355,6 +422,7 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
           let projectName = '';
 
           if (project) {
+            if (!parsed) parsed = await getOrParse(config, includeProjects);
             const { records: allRecords } = parsed;
             const toolRecords = tool !== 'all' ? allRecords.filter(r => r.tool === tool) : allRecords;
             // basename 匹配
@@ -375,27 +443,15 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
             projPrevStats = prevProjFiltered.length > 0 ? computeUsageStats(prevProjFiltered, config.scenarioKeywords, config.costMode) : null;
 
             // 单项目 Git 统计
-            if (config.repos?.length > 0) {
-              const matchedRepo = config.repos.find(r => getProjectBaseName(r) === project);
-              if (matchedRepo) {
-                try {
-                  const { getGitStatsAsync } = await import('./git.js');
-                  const sessions = groupBySessions(projFiltered);
-                  const { finalizeGitStats, getGitStatsForMultipleReposAsync } = await import('./git.js');
-                  let repoGit = await getGitStatsForMultipleReposAsync([matchedRepo], pStart, pEnd + 'T23:59:59');
-                  repoGit = await finalizeGitStats(repoGit, sessions, {
-                    attribution: config.aiAttribution,
-                    stepTracking: config.stepTracking,
-                  });
-                  projGitStats = repoGit;
-                } catch (e) { console.warn("[server] error", e.message); }
-              }
-            } else {
-              projGitStats = null;
-            }
+            projGitStats = deriveProjectGitStats(data.gitStats, project, pStart, pEnd, config.aiAttribution);
           }
 
-          const markdown = generateWorkReport(projUsageStats, projGitStats, period, data.start, data.end, projPrevStats, { level, platform, tool, projectName });
+          let markdown;
+          if (level === 'boss') {
+            markdown = generateBossReport(projUsageStats, projGitStats, period, data.start, data.end, projPrevStats, platform);
+          } else {
+            markdown = generateWorkReport(projUsageStats, projGitStats, period, data.start, data.end, projPrevStats, { level, platform, tool, projectName });
+          }
           res.writeHead(200, {
             'Content-Type': 'text/plain; charset=utf-8',
             'Access-Control-Allow-Origin': 'http://localhost:' + PORT,
@@ -404,52 +460,14 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
           return;
         }
 
-        // 按工具替换 aiContribution
-        if (tool !== 'all' && data.gitStats?.aiContributionByTool) {
-          const toolAi = data.gitStats.aiContributionByTool[tool];
-          if (toolAi) {
-            data.gitStats.aiContribution = toolAi;
-          }
-        }
-
-        // 添加费用分解
-        if (data.usageStats?.models) {
-          const modelEntries = Object.entries(data.usageStats.models)
-            .sort((a, b) => b[1].cost - a[1].cost);
-          const totalCost = modelEntries.reduce((s, [, d]) => s + (d.cost || 0), 0);
-          // 缓存节省 = (inputTokens - cacheRead) * avgInputRate - 已通过 cacheRead 低价体现
-          // 简化：缓存节省 = cacheRead * avgInputRate * (1 - cacheReadRate/inputRate)
-          const cacheRead = data.usageStats.cacheRead || 0;
-          const cacheCreate = data.usageStats.cacheCreate || 0;
-          let cacheSaving = 0;
-          if (totalCost > 0 && (cacheRead + cacheCreate) > 0) {
-            const totalInput = data.usageStats.inputTokens || 1;
-            const avgInputCostPerToken = totalCost / (totalInput + data.usageStats.outputTokens + cacheRead + cacheCreate || 1);
-            cacheSaving = Math.round(cacheRead * avgInputCostPerToken * 0.9 * 100) / 100;
-          }
-          data.costBreakdown = {
-            models: modelEntries.map(([name, d]) => ({
-              name,
-              cost: d.cost || 0,
-              mode: d.costMode || 'unknown',
-              requests: d.count,
-              inputTokens: d.inputTokens,
-              outputTokens: d.outputTokens,
-            })),
-            cacheSaving,
-            total: Math.round(totalCost * 100) / 100,
-          };
-        }
-
-        // 写入查询结果缓存
-        setCachedReport(reportCacheKey, data);
+        const responseData = prepareJsonReportData(data, tool);
 
         res.writeHead(200, {
           'Content-Type': 'application/json',
           'Access-Control-Allow-Origin': 'http://localhost:' + PORT,
           'X-Cache': 'MISS',
         });
-        res.end(JSON.stringify(data));
+        res.end(JSON.stringify(responseData));
       } catch (err) {
         res.writeHead(500, { 'Content-Type': 'application/json' });
         console.error('API error:', err.message);
@@ -480,10 +498,10 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
               const extEnd = new Date(end);
               extEnd.setDate(extEnd.getDate() + 2);
               const gitStats = await getGitStatsForMultipleReposAsync(sessionRepos, start, extEnd.toISOString().slice(0, 10) + 'T23:59:59');
-              await finalizeGitStats(gitStats, sessions, {
-                attribution: config.aiAttribution,
-                stepTracking: config.stepTracking,
-              });
+              await finalizeGitStats(gitStats, sessions, {
+                attribution: config.aiAttribution,
+                stepTracking: config.stepTracking,
+              });
             }
           } catch (e) { console.warn("[server] error", e.message); }
         }
@@ -545,21 +563,14 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
           }
           result = Object.values(dailyMap).sort((a, b) => a.date.localeCompare(b.date));
         } else if (dimension === 'scenario') {
+          // 复用 classifyRecord 确保与统计逻辑一致
           const matched = filtered.filter(r => {
-            const text = r.metadata?.text || r.text || '';
-            const type = r.metadata?.type || r.type;
-            return type === 'user' && text;
+            const classified = classifyRecord(r, config.scenarioKeywords);
+            return !!classified[key];
           });
           for (const r of matched) {
             const text = r.metadata?.text || r.text || '';
-            const lower = text.toLowerCase();
-            const keywords = config.scenarioKeywords?.[key] || [];
-            for (const kw of keywords) {
-              if (lower.includes(kw.toLowerCase())) {
-                result.push({ text: text.slice(0, 200), timestamp: r.timestamp, project: r.project });
-                break;
-              }
-            }
+            result.push({ text: text.slice(0, 200), timestamp: r.timestamp, project: r.project });
             if (result.length >= 10) break;
           }
         }
@@ -633,10 +644,25 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
             if (newConfig.codexDir !== undefined) { if (!validatePath(newConfig.codexDir)) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'codexDir 格式无效' })); return; } config.codexDir = newConfig.codexDir; }
             if (newConfig.opencodeDir !== undefined) { if (!validatePath(newConfig.opencodeDir)) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'opencodeDir 格式无效' })); return; } config.opencodeDir = newConfig.opencodeDir; }
             if (newConfig.enabledTools !== undefined) config.enabledTools = newConfig.enabledTools;
-            if (newConfig.repos !== undefined) { if (!Array.isArray(newConfig.repos)) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'repos 格式无效' })); return; } config.repos = newConfig.repos; }
-            if (newConfig.excludeProjects !== undefined) config.excludeProjects = newConfig.excludeProjects;
-            if (newConfig.scenarioKeywords !== undefined) config.scenarioKeywords = newConfig.scenarioKeywords;
-            if (newConfig.stepTracking !== undefined) config.stepTracking = newConfig.stepTracking;
+            if (newConfig.repos !== undefined) config.repos = parseRepoPaths(newConfig.repos);
+            if (newConfig.excludeProjects !== undefined) config.excludeProjects = parseRepoPaths(newConfig.excludeProjects);
+            if (newConfig.scenarioKeywords !== undefined) {
+              // 服务端校验：限制关键词长度和数量
+              const sk = newConfig.scenarioKeywords;
+              if (typeof sk === 'object' && sk !== null) {
+                const sanitized = {};
+                for (const [scene, words] of Object.entries(sk)) {
+                  if (!Array.isArray(words)) continue;
+                  sanitized[scene] = words
+                    .map(w => String(w).trim())
+                    .filter(w => w.length > 0 && w.length <= 100)
+                    .filter(w => !/[\x00-\x1f\x7f]/.test(w))
+                    .slice(0, 50);
+                }
+                config.scenarioKeywords = sanitized;
+              }
+            }
+            if (newConfig.stepTracking !== undefined) config.stepTracking = newConfig.stepTracking;
             invalidateFileCache();
             invalidateGitCache();
             _parsedCache = null; // 配置变更后清除解析缓存
@@ -658,21 +684,21 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
     }
 
     // Step blame stats API
-    if (url.pathname === '/api/step-stats') {
-      let stepStats = { stepCount: 0, sessionCount: 0, available: false };
-      try {
-        if (config.stepTracking?.enabled !== false) {
-          for (const repo of config.repos || []) {
-            const tracker = new StepTracker(repo, { dbPath: config.stepTracking?.dbPath });
-            if (await tracker.isAvailableAsync()) {
-              await tracker.open();
-              stepStats = { ...tracker.getStats(), available: true };
-              tracker.close();
-              break;
-            }
-          }
-        }
-      } catch { /* step tracking not available */ }
+    if (url.pathname === '/api/step-stats') {
+      let stepStats = { stepCount: 0, sessionCount: 0, available: false };
+      try {
+        if (config.stepTracking?.enabled !== false) {
+          for (const repo of config.repos || []) {
+            const tracker = new StepTracker(repo, { dbPath: config.stepTracking?.dbPath });
+            if (await tracker.isAvailableAsync()) {
+              await tracker.open();
+              stepStats = { ...tracker.getStats(), available: true };
+              tracker.close();
+              break;
+            }
+          }
+        }
+      } catch { /* step tracking not available */ }
       res.writeHead(200, {
         'Content-Type': 'application/json',
         'Access-Control-Allow-Origin': 'http://localhost:' + PORT,
@@ -727,9 +753,9 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
     const cyan = '\x1b[96m';
     const green = '\x1b[92m';
     const yellow = '\x1b[93m';
-    const blue = '\x1b[94m';
-    const dim = '\x1b[2m';
-    const actualPort = server.address()?.port || PORT;
+    const blue = '\x1b[94m';
+    const dim = '\x1b[2m';
+    const actualPort = server.address()?.port || PORT;
 
     const banner = [
       '',
@@ -752,35 +778,35 @@ export function startServer(config, effectiveIncludeProjects, buildReportData, c
     if (configPath) {
       process.stdout.write(`  ${dim}●${R}  ${B}Config${R}      ${configPath}\n`);
     }
-    const repoCount = config.repos?.length || 0;
-    if (repoCount > 0) {
-      process.stdout.write(`  ${dim}●${R}  ${B}Projects${R}    ${repoCount} repo(s) detected\n`);
-    }
-    const hookStatus = getConfiguredHooksStatus(config);
-    const hookParts = [
-      `Claude ${hookStatus.claude.enabledCount}/${hookStatus.projectCount}`,
-      `Codex ${hookStatus.codex.enabledCount}/${hookStatus.projectCount}`,
-      `OpenCode ${hookStatus.opencode.enabledCount}/${hookStatus.projectCount}`,
-      `steps ${hookStatus.stepsReadyCount}/${hookStatus.projectCount}`,
-    ];
-    process.stdout.write(`  ${dim}●${R}  ${B}Hooks${R}       ${hookParts.join(' / ')}\n`);
-    if (hookStatus.projectCount === 0) {
-      process.stdout.write(`  ${yellow}${B}!${R}  未配置项目路径：请先在页面设置中添加项目，页面开启 hooks 只作用于设置内项目。\n`);
-    } else if (!hookStatus.claude.enabled || !hookStatus.codex.enabled || !hookStatus.opencode.enabled || !hookStatus.stepsInitialized) {
-      process.stdout.write(`  ${yellow}${B}!${R}  行级归因未完整开启：在页面中开启，或进入项目目录运行 ${B}npx lumencode hooks enable${R}。\n`);
-    }
-    process.stdout.write('\n');
-    process.stdout.write(`  ${green}${B}✓${R}  Server ready at ${blue}${B}http://localhost:${actualPort}${R}\n`);
+    const repoCount = config.repos?.length || 0;
+    if (repoCount > 0) {
+      process.stdout.write(`  ${dim}●${R}  ${B}Projects${R}    ${repoCount} repo(s) detected\n`);
+    }
+    const hookStatus = getConfiguredHooksStatus(config);
+    const hookParts = [
+      `Claude ${hookStatus.claude.enabledCount}/${hookStatus.projectCount}`,
+      `Codex ${hookStatus.codex.enabledCount}/${hookStatus.projectCount}`,
+      `OpenCode ${hookStatus.opencode.enabledCount}/${hookStatus.projectCount}`,
+      `steps ${hookStatus.stepsReadyCount}/${hookStatus.projectCount}`,
+    ];
+    process.stdout.write(`  ${dim}●${R}  ${B}Hooks${R}       ${hookParts.join(' / ')}\n`);
+    if (hookStatus.projectCount === 0) {
+      process.stdout.write(`  ${yellow}${B}!${R}  未配置项目路径：请先在页面设置中添加项目，页面开启 hooks 只作用于设置内项目。\n`);
+    } else if (!hookStatus.claude.enabled || !hookStatus.codex.enabled || !hookStatus.opencode.enabled || !hookStatus.stepsInitialized) {
+      process.stdout.write(`  ${yellow}${B}!${R}  行级归因未完整开启：在页面中开启，或进入项目目录运行 ${B}npx lumencode hooks enable${R}。\n`);
+    }
+    process.stdout.write('\n');
+    process.stdout.write(`  ${green}${B}✓${R}  Server ready at ${blue}${B}http://localhost:${actualPort}${R}\n`);
     process.stdout.write('\n');
 
-    // Auto-open browser
-    if (process.env.LUMENCODE_NO_OPEN !== '1') {
-      const openCmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';
-      import('child_process').then(({ exec }) => {
-        exec(`${openCmd} http://localhost:${actualPort}`, () => {});
-      });
-    }
-  });
-
-  return server;
-}
+    // Auto-open browser
+    if (process.env.LUMENCODE_NO_OPEN !== '1') {
+      const openCmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';
+      import('child_process').then(({ exec }) => {
+        exec(`${openCmd} http://localhost:${actualPort}`, () => {});
+      });
+    }
+  });
+
+  return server;
+}