mingdao-harness 0.2.4 → 0.2.6

package/src/web/routes/domains/config.js

@@ -0,0 +1,280 @@
+// 配置域（Phase C C1）：/api/state /api/config /api/models-config
+// 服务商 Key 管理、自定义模型增删改、API 地址覆盖、系统状态快照。
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadConfig, saveConfig } from '../../../config.js';
+import { setStoredKey, removeStoredKey, getStoredKey, maskKey } from '../../../credentials.js';
+import { availableModels, fetchProviderModels, providerHasKey } from '../../../model-discovery.js';
+import { createProvider, resolveProviderConfig } from '../../../providers/index.js';
+import { MODELS, PROVIDERS } from '../../../models.js';
+import { detectSandbox } from '../../../tools/bash.js';
+import { enableAutostart, disableAutostart, autostartStatus } from '../../../autostart.js';
+import { PRICE_DATA_AS_OF } from '../../../pricing.js';
+import { listSessions, relativeTime, sessionPreview } from '../../../session.js';
+import { currentWorkspace } from '../../../workspace.js';
+
+/**
+ * 配置域路由。命中返回 true，未命中返回 false。
+ * @param {{req:any,res:any,method:any,p:any,url:any}} ctx
+ * @param {any} deps
+ * @param {{json:any,readBody:any,MAX_API_BODY:any,validateRemoteUrl:any}} shared
+ */
+export async function handle({ req, res, method, p, url }, deps, shared) {
+  const { json, readBody, MAX_API_BODY } = shared;
+  const { cfg, home, state, providerCache, getProviderFor, mcpFacade } = deps;
+
+  if (method === 'GET' && p === '/api/state') {
+    const sessions = listSessions(home)
+      .slice(0, 30)
+      .map((s) => ({ file: s.name, mtime: s.mtime, label: `${relativeTime(s.mtime)} · ${sessionPreview(s.file)}` }));
+    // 模型列表：只列已设置 Key 的服务商，名称以 /models 接口线上名单为准（预设仅回退与补价）
+    const models = await availableModels(cfg, state.modelName);
+    json(res, 200, {
+      ok: true,
+      model: state.modelName,
+      models,
+      // 首次使用引导：当前模型无可用 API Key 时前端显示「去 ⚙ 设置填 Key」横幅
+      keyReady: Boolean((resolveProviderConfig(cfg, state.modelName) || {}).apiKey),
+      permissions: ['ask', 'auto', 'readonly'],
+      permission: cfg.permission ?? 'ask',
+      sandbox: cfg.sandbox || 'off',
+      sandboxSupported: detectSandbox() !== 'none',
+      routing: cfg.routing?.enabled ? cfg.routing : null,
+      contextBudget: cfg.contextBudget || 128000,
+      pricingAsOf: PRICE_DATA_AS_OF,
+      autostart: autostartStatus(),
+      notify: cfg.notify !== false,
+      workspace: currentWorkspace(state.workingDir)?.name || null,
+      home,
+      workingDir: state.workingDir,
+      mcp: mcpFacade.status(),
+      sessions,
+    });
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/config') {
+    const body = await readBody(req, MAX_API_BODY);
+    // 内存 cfg 可能比磁盘旧（如 CLI 改过同步地址）：先从磁盘刷新 sync，避免保存时回滚
+    cfg.sync = loadConfig()?.sync || cfg.sync;
+    const next = /** @type {any} */ ({ model: state.modelName, permission: cfg.permission ?? 'ask' });
+    if (body.model !== undefined) {
+      const target = String(body.model).trim();
+      if (!target) return json(res, 400, { error: '模型名不能为空' });
+      const tpc = resolveProviderConfig(cfg, target);
+      if (!tpc.apiKey) {
+        const hint = tpc.name.startsWith('custom:')
+          ? '请在 设置 → 模型与 API Key 中填写该模型的 Key'
+          : `请先运行 mingdao key set ${tpc.name}`;
+        return json(res, 400, { error: `模型 ${target} 没有可用 API Key（服务商 ${tpc.name}），${hint}` });
+      }
+      await getProviderFor(target); // 预热（失败会抛错）
+      next.model = target;
+    }
+    if (body.permission !== undefined) {
+      const perm = String(body.permission);
+      if (!['ask', 'auto', 'readonly'].includes(perm)) {
+        return json(res, 400, { error: '权限模式必须是 ask / auto / readonly' });
+      }
+      next.permission = perm;
+    }
+    if (body.sandbox !== undefined) {
+      const sbx = String(body.sandbox);
+      if (!['off', 'readonly', 'safe'].includes(sbx)) {
+        return json(res, 400, { error: '沙箱模式必须是 off / readonly / safe' });
+      }
+      next.sandbox = sbx;
+      cfg.sandbox = sbx;
+    }
+    if (body.routing !== undefined) {
+      const on = body.routing === true || body.routing === 'on';
+      cfg.routing = {
+        enabled: on,
+        planner: cfg.routing?.planner || 'deepseek-v4-pro',
+        executor: cfg.routing?.executor || 'deepseek-v4-flash',
+      };
+      next.routing = on;
+    }
+    if (body.contextBudget !== undefined) {
+      const n = Number(body.contextBudget);
+      if (!Number.isInteger(n) || n < 1000) {
+        return json(res, 400, { error: '上下文预算必须是 ≥1000 的整数' });
+      }
+      next.contextBudget = n;
+      cfg.contextBudget = n;
+    }
+    let autostartChanged = false;
+    if (body.autostart !== undefined) {
+      autostartChanged = true;
+      const okAuto = body.autostart === true || body.autostart === 'on' ? enableAutostart() : disableAutostart();
+      if (!okAuto) return json(res, 500, { error: '开机自启设置失败' });
+    }
+    if (body.notify !== undefined) {
+      next.notify = body.notify === true || body.notify === 'on';
+      cfg.notify = next.notify;
+    }
+    if (body.syncAuto !== undefined) {
+      cfg.sync = cfg.sync || {};
+      cfg.sync.auto = body.syncAuto === true || body.syncAuto === 'on';
+    }
+    state.modelName = next.model;
+    cfg.model = next.model;
+    cfg.permission = next.permission;
+    saveConfig(cfg);
+    json(res, 200, { ok: true, model: state.modelName, permission: cfg.permission, sandbox: cfg.sandbox, routing: cfg.routing?.enabled, contextBudget: cfg.contextBudget, autostart: autostartChanged ? autostartStatus() : undefined, notify: cfg.notify !== false });
+    return true;
+  }
+
+  if (method === 'GET' && p === '/api/models-config') {
+    const providers = Object.keys(PROVIDERS).map((name) => {
+      const pp = /** @type {Record<string, any>} */ (PROVIDERS)[name];
+      const stored = getStoredKey(name);
+      const env = pp.envKey && process.env[pp.envKey] ? true : false;
+      return {
+        name,
+        label: pp.label,
+        baseUrl: pp.baseUrl,
+        envKey: pp.envKey || null,
+        keyState: stored ? 'stored' : env ? 'env' : 'none',
+        keyMasked: stored ? maskKey(stored) : null,
+      };
+    });
+    const customModels = Object.entries(cfg.customModels || {}).map(([name, cm]) => {
+      const stored = getStoredKey(`custom:${name}`);
+      return {
+        name,
+        label: cm.label || '',
+        baseUrl: cm.baseUrl || '',
+        envKey: cm.envKey || null,
+        vision: Boolean(cm.vision),
+        keyState: stored ? 'stored' : 'none',
+        keyMasked: stored ? maskKey(stored) : null,
+      };
+    });
+    json(res, 200, {
+      ok: true,
+      providers,
+      customModels,
+      model: state.modelName,
+      provider: resolveProviderConfig(cfg, state.modelName).name,
+      baseUrlOverride: cfg.baseUrl || '',
+    });
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/models-config') {
+    const body = await readBody(req, MAX_API_BODY);
+    const action = body.action;
+    // —— 服务商 Key 管理 ——
+    if (action === 'setProviderKey') {
+      const provider = String(body.provider || '').trim();
+      if (!/** @type {Record<string, any>} */ (PROVIDERS)[provider]) return json(res, 400, { error: `未知服务商 ${provider}` });
+      const key = String(body.key || '').trim();
+      if (!key) return json(res, 400, { error: 'Key 不能为空（删除请用 removeProviderKey）' });
+      setStoredKey(provider, key);
+      providerCache.clear(); // 质检：Key 立即生效（缓存持有旧无 Key 实例 → 此前需重启）
+      // 设置 Key 后立即拉取线上真实模型名单（失败不影响 Key 保存，回退预设）
+      const fr = provider === 'custom' ? { error: '自定义服务商无模型列表' } : await fetchProviderModels(cfg, provider, { force: true });
+      return json(res, 200, {
+        ok: true,
+        provider,
+        keyMasked: maskKey(key),
+        models: fr.models || [],
+        modelsNote: fr.error ? `模型列表暂用预设（拉取失败：${fr.error}），稍后可用「刷新模型」重试` : null,
+      });
+    }
+    if (action === 'refreshModels') {
+      const provider = String(body.provider || '').trim();
+      if (!/** @type {Record<string, any>} */ (PROVIDERS)[provider] || provider === 'custom') return json(res, 400, { error: '未知服务商' });
+      if (!providerHasKey(provider)) return json(res, 400, { error: '该服务商未设置 API Key' });
+      const fr = await fetchProviderModels(cfg, provider, { force: true });
+      if (fr.error) return json(res, 400, { error: `拉取失败：${fr.error}` });
+      return json(res, 200, { ok: true, provider, models: fr.models, fromCache: fr.fromCache });
+    }
+    if (action === 'removeProviderKey') {
+      const provider = String(body.provider || '').trim();
+      if (!/** @type {Record<string, any>} */ (PROVIDERS)[provider]) return json(res, 400, { error: `未知服务商 ${provider}` });
+      removeStoredKey(provider);
+      providerCache.clear(); // 质检：Key 删除立即生效
+      return json(res, 200, { ok: true, provider });
+    }
+    // —— 自定义模型增删改 ——
+    if (action === 'addCustom' || action === 'updateCustom') {
+      const name = String(body.name || '').trim();
+      if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+        return json(res, 400, { error: '模型名非法：字母/数字开头，可含 . _ -，1–64 位' });
+      }
+      if (/** @type {Record<string, any>} */ (MODELS)[name]) return json(res, 400, { error: `${name} 与内置模型同名，请换一个名字` });
+      const label = String(body.label || '').trim();
+      const baseUrl = String(body.baseUrl || '').trim();
+      if (!baseUrl) return json(res, 400, { error: 'API 地址（baseUrl）不能为空' });
+      const vurl = await shared.validateRemoteUrl(baseUrl); // 质检 S1：SSRF 防护
+      if (vurl.error) return json(res, 400, { error: vurl.error });
+      if (action === 'addCustom' && (cfg.customModels || {})[name]) {
+        return json(res, 400, { error: `自定义模型 ${name} 已存在（可修改）` });
+      }
+      cfg.customModels = cfg.customModels || {};
+      cfg.customModels[name] = {
+        label,
+        baseUrl,
+        envKey: String(body.envKey || '').trim() || undefined,
+        vision: body.vision === true || body.vision === 'on' ? true : undefined,
+      };
+      if (String(body.key || '').trim()) setStoredKey(`custom:${name}`, String(body.key).trim());
+      saveConfig(cfg);
+      return json(res, 200, { ok: true, name });
+    }
+    if (action === 'removeCustom') {
+      const name = String(body.name || '').trim();
+      if (!(cfg.customModels || {})[name]) return json(res, 400, { error: `自定义模型 ${name} 不存在` });
+      delete cfg.customModels[name];
+      removeStoredKey(`custom:${name}`);
+      if (state.modelName === name) {
+        state.modelName = 'deepseek-v4-flash';
+        cfg.model = state.modelName;
+      }
+      saveConfig(cfg);
+      return json(res, 200, { ok: true, name, model: state.modelName });
+    }
+    // 质检（自定义模型连通性）：发起一次最小对话验证 baseUrl+Key 可用
+    if (action === 'testCustom') {
+      const name = String(body.name || '').trim();
+      const cm = (cfg.customModels || {})[name];
+      if (!cm) return json(res, 400, { error: `自定义模型 ${name} 不存在` });
+      const pc = resolveProviderConfig(cfg, name);
+      if (!pc.apiKey) return json(res, 400, { error: '该模型未设置 API Key，请先「设Key」再测试' });
+      const t0 = Date.now();
+      try {
+        const tp = await createProvider(cfg, name);
+        const r = await tp.chat({ model: name, messages: [{ role: 'user', content: 'ping' }], tools: [], temperature: 0, maxTokens: 8 });
+        return json(res, 200, { ok: true, name, latencyMs: Date.now() - t0, reply: String(r.text || r.reasoning || '').slice(0, 60) || '（空回复，但连接成功）' });
+      } catch (/** @type {any} */ e) {
+        return json(res, 200, { ok: false, name, latencyMs: Date.now() - t0, error: String(e?.message || e) });
+      }
+    }
+    if (action === 'setCustomKey') {
+      const name = String(body.name || '').trim();
+      if (!(cfg.customModels || {})[name]) return json(res, 400, { error: `自定义模型 ${name} 不存在` });
+      const key = String(body.key || '').trim();
+      if (!key) return json(res, 400, { error: 'Key 不能为空' });
+      setStoredKey(`custom:${name}`, key);
+      providerCache.clear(); // 质检：Key 立即生效
+      return json(res, 200, { ok: true, name, keyMasked: maskKey(key) });
+    }
+    // —— 当前服务商 API 地址覆盖 ——
+    if (action === 'setBaseUrl') {
+      const baseUrl = String(body.baseUrl || '').trim();
+      if (baseUrl) {
+        const vurl = await shared.validateRemoteUrl(baseUrl); // 质检 S1：SSRF 防护
+        if (vurl.error) return json(res, 400, { error: vurl.error });
+      }
+      cfg.baseUrl = baseUrl || undefined;
+      if (cfg.baseUrl === undefined) delete cfg.baseUrl;
+      saveConfig(cfg);
+      return json(res, 200, { ok: true, baseUrl: cfg.baseUrl || '' });
+    }
+    return json(res, 400, { error: '未知操作：setProviderKey|removeProviderKey|addCustom|updateCustom|removeCustom|setCustomKey|setBaseUrl' });
+  }
+
+  return false;
+}

package/src/web/routes/domains/misc.js

@@ -0,0 +1,129 @@
+// 杂项域（Phase C C1）：/api/chat /api/permission /api/abort /api/memory /api/cache-stats
+// 对话 SSE 流（并发上限 + 生命周期计数）、权限确认、任务中断、长期记忆、费用/缓存统计。
+import { loadMemory, writeMemory, dedupeMemory } from '../../../memory.js';
+import { recordUsage, listCacheStats, summarizeCacheStats, costBreakdown } from '../../../cachestats.js';
+import { costGuardStatus } from '../../../cost-guard.js';
+
+/**
+ * 杂项域路由。命中返回 true，未命中返回 false。
+ * @param {{req:any,res:any,method:any,p:any,url:any}} ctx
+ * @param {any} deps
+ * @param {{json:any,readBody:any,MAX_API_BODY:any}} shared
+ */
+export async function handle({ req, res, method, p, url }, deps, shared) {
+  const { json, readBody, MAX_API_BODY } = shared;
+  const { tasks, refs, MAX_CONCURRENT, handleChat, pruneTasks } = deps;
+
+  if (method === 'POST' && p === '/api/chat') {
+    // 质检 S2：inflight 计数绑定请求生命周期（进入 ++ / 结束 --）。
+    // 此前检查发生在 readBody 之前且占位即删，多请求可同时卡在 readBody 后批量登记 → 瞬时超并发
+    refs.inflight += 1;
+    if (refs.inflight > MAX_CONCURRENT) {
+      refs.inflight -= 1;
+      return json(res, 429, { error: `并发任务已达上限（${MAX_CONCURRENT}），请等待任务完成或中断` });
+    }
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream; charset=utf-8',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    });
+    let body;
+    try {
+      // chat 保留默认 40MB 上限（附件 base64 可达 ~26MB）；普通 JSON 接口才用 MAX_API_BODY=1MB
+      body = await readBody(req);
+    } catch (/** @type {any} */ e) {
+      refs.inflight -= 1;
+      res.write(`data: ${JSON.stringify({ type: 'error', message: e.message })}\n\n`);
+      res.end();
+      return true;
+    }
+    try {
+      await handleChat(res, body);
+    } catch (/** @type {any} */ err) {
+      // 兜底（审计：「点发送无反应」根因防护）：handleChat 内任意未捕获异常若直接外抛，
+      // SSE 已开流却无事件 → 前端永远停在「正在思考…」。此处统一转为 error 事件回给界面。
+      try {
+        res.write(`data: ${JSON.stringify({ type: 'error', message: '对话失败：' + String(err?.message || err) })}\n\n`);
+      } catch {}
+      try {
+        res.end();
+      } catch {}
+      pruneTasks();
+    }
+    refs.inflight -= 1; // 与 handleChat 的 finally 无关：handleChat 内部路径全部会返回/结束
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/permission') {
+    const body = await readBody(req, MAX_API_BODY);
+    const entry = tasks.get(body.taskId);
+    if (!entry || !entry.pendingAsk) return json(res, 409, { error: '没有挂起的权限确认' });
+    const pa = entry.pendingAsk;
+    entry.pendingAsk = null;
+    const answer = String(body.answer ?? '');
+    if (pa.options && Array.isArray(pa.options)) {
+      const opt = pa.options.find((/** @type {any} */ o) => String(o.value) === answer);
+      pa.resolve(opt ? opt.value : answer);
+    } else {
+      pa.resolve(answer);
+    }
+    json(res, 200, { ok: true });
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/abort') {
+    const body = await readBody(req, MAX_API_BODY);
+    if (body.taskId) {
+      const entry = tasks.get(body.taskId);
+      if (entry?.abortHandler) {
+        try {
+          entry.abortHandler();
+        } catch {}
+      }
+    } else {
+      // 未指定任务：中断全部运行中任务
+      for (const t of tasks.values()) {
+        if (t.status === 'running' && t.abortHandler) {
+          try {
+            t.abortHandler();
+          } catch {}
+        }
+      }
+    }
+    json(res, 200, { ok: true });
+    return true;
+  }
+
+  if (method === 'GET' && p === '/api/memory') {
+    json(res, 200, { ok: true, content: loadMemory() });
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/memory') {
+    const body = await readBody(req, MAX_API_BODY);
+    if (body.action === 'dedupe') {
+      const removed = dedupeMemory();
+      return json(res, 200, { ok: true, removed });
+    }
+    if (body.content !== undefined) {
+      writeMemory(body.content);
+      return json(res, 200, { ok: true });
+    }
+    return json(res, 400, { error: '缺少 content 或 action=dedupe' });
+  }
+
+  if (method === 'GET' && p === '/api/cache-stats') {
+    const entries = listCacheStats();
+    json(res, 200, {
+      ok: true,
+      summary: summarizeCacheStats(entries),
+      breakdown: costBreakdown(),
+      guard: costGuardStatus(),
+      recent: entries.slice(-10).reverse(),
+    });
+    return true;
+  }
+
+  return false;
+}

package/src/web/routes/domains/schedule.js

@@ -0,0 +1,127 @@
+// 调度域（Phase C C1）：/api/schedule /api/tasks
+// 定时任务增删暂停恢复/链式编排；聊天 SSE 任务 + 后台 worker + 调度任务合并面板。
+import path from 'node:path';
+import {
+  addSchedule,
+  listSchedules,
+  removeSchedule,
+  pauseSchedule,
+  resumeSchedule,
+  chainSchedules,
+  reconcileSchedules,
+} from '../../../schedule.js';
+import { listTasks } from '../../../tasks.js';
+
+/**
+ * 调度域路由。命中返回 true，未命中返回 false。
+ * @param {{req:any,res:any,method:any,p:any,url:any}} ctx
+ * @param {any} deps
+ * @param {{json:any,readBody:any,MAX_API_BODY:any}} shared
+ */
+export async function handle({ req, res, method, p, url }, deps, shared) {
+  const { json, readBody, MAX_API_BODY } = shared;
+  const { home, state, tasks, MAX_CONCURRENT } = deps;
+
+  if (method === 'GET' && p === '/api/tasks') {
+    const running = [...tasks.values()].filter((t) => t.status === 'running').length;
+    const list = [...tasks.entries()].map(([id, t]) => ({
+      id,
+      status: t.status,
+      message: t.message,
+      startedAt: t.startedAt,
+      durationMs: t.status === 'running' ? Date.now() - t.startedAt : t.durationMs,
+      session: t.session ? path.basename(t.session.file) : null,
+    }));
+    // 质检（等待状态静默）：后台 worker 任务与运行中的调度任务并入面板与状态条计数——
+    // 此前 /api/tasks 只含聊天 SSE 任务，后台下载/长任务期间界面完全无感知
+    let bgRunning = 0;
+    const background = [];
+    try {
+      for (const t of listTasks(home)) {
+        if (t.status === 'running') bgRunning += 1;
+        background.push({
+          id: t.id,
+          kind: 'worker',
+          status: t.status,
+          message: t.message || t.question || '',
+          startedAt: t.startedAt,
+          durationMs: t.status === 'running' ? Date.now() - t.startedAt : t.durationMs,
+          error: t.error || '',
+        });
+      }
+      for (const sch of listSchedules(home)) {
+        if (sch.status === 'running') bgRunning += 1;
+        background.push({
+          id: sch.id,
+          kind: 'schedule',
+          status: sch.status,
+          message: sch.question || sch.id || '',
+          startedAt: sch.createdAt || null,
+          durationMs: sch.status === 'running' ? Date.now() - (sch.lastRunAt || Date.now()) : null,
+        });
+      }
+    } catch {}
+    json(res, 200, { ok: true, running, bgRunning, maxConcurrent: MAX_CONCURRENT, tasks: list, background });
+    return true;
+  }
+
+  if (method === 'GET' && p === '/api/schedule') {
+    reconcileSchedules(home);
+    const jobs = listSchedules(home).map((j) => ({
+      id: j.id,
+      status: j.status,
+      kind: j.kind,
+      question: j.question,
+      nextRunAt: j.nextRunAt,
+      lastRunAt: j.lastRunAt,
+      lastTaskId: j.lastTaskId,
+      runs: j.runs,
+      interval: j.interval,
+      anchor: j.anchor,
+      after: j.after,
+      history: j.history || [],
+      note: j.note,
+    }));
+    json(res, 200, { ok: true, jobs });
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/schedule') {
+    const body = await readBody(req, MAX_API_BODY);
+    const action = String(body.action || '');
+    try {
+      if (action === 'add') {
+        if (!body.question || !String(body.question).trim()) return json(res, 400, { error: '任务内容不能为空' });
+        const r = addSchedule(home, String(body.question).trim(), {
+          at: body.at || null,
+          every: body.every || null,
+          anchor: body.anchor || null,
+          after: Array.isArray(body.after) ? body.after.map(String) : body.after ? String(body.after).split(',').map((x) => x.trim()).filter(Boolean) : undefined,
+          permission: body.permission || null,
+          model: body.model || null,
+          cwd: state.workingDir,
+          offpeak: body.offpeak === true,
+        });
+        if (r.error) return json(res, 400, { error: r.error });
+        return json(res, 200, { ok: true, id: r.id });
+      }
+      if (action === 'chain') {
+        const qs = Array.isArray(body.questions) ? body.questions.map(String).filter((/** @type {any} */ q) => q.trim()) : [];
+        if (qs.length < 2) return json(res, 400, { error: '链式需要至少两个任务' });
+        const r = /** @type {any} */ (chainSchedules(home, qs, { permission: body.permission || null, model: body.model || null }));
+        if (r.error) return json(res, 400, { error: r.error });
+        return json(res, 200, { ok: true, ids: r.ids });
+      }
+      const id = String(body.id || '');
+      if (!id) return json(res, 400, { error: '缺少 id' });
+      if (action === 'remove') return json(res, 200, { ok: removeSchedule(home, id) });
+      if (action === 'pause') return json(res, 200, { ok: pauseSchedule(home, id) });
+      if (action === 'resume') return json(res, 200, { ok: resumeSchedule(home, id) });
+      return json(res, 400, { error: '未知操作：add|chain|remove|pause|resume' });
+    } catch (/** @type {any} */ err) {
+      return json(res, 500, { error: String(err?.message || err) });
+    }
+  }
+
+  return false;
+}

package/src/web/routes/domains/sessions.js

@@ -0,0 +1,105 @@
+// 会话域（Phase C C1）：/api/sessions /api/session /api/draft
+// 会话列表/搜索、载入（聚焦工作空间）、重命名/删除、按会话隔离的草稿槽。
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+  listSessions,
+  loadSession,
+  searchSessions,
+  relativeTime,
+  sessionPreview,
+} from '../../../session.js';
+import { sanitizeTitle, renameSessionFile } from '../../../titles.js';
+import {
+  workspaceForDir,
+  touchWorkspace,
+  getSessionWorkspace,
+  moveSessionWorkspace,
+  removeSessionWorkspace,
+} from '../../../workspace.js';
+
+/**
+ * 会话域路由。命中返回 true，未命中返回 false。
+ * @param {{req:any,res:any,method:any,p:any,url:any}} ctx
+ * @param {any} deps
+ * @param {{json:any,readBody:any,MAX_API_BODY:any}} shared
+ */
+export async function handle({ req, res, method, p, url }, deps, shared) {
+  const { json, readBody, MAX_API_BODY } = shared;
+  const { home, state, draftTexts } = deps;
+
+  if (method === 'GET' && p === '/api/sessions') {
+    const q = url.searchParams.get('q');
+    const found = q
+      ? searchSessions(home, q, { limit: 30 }).map((/** @type {any} */ s) => ({ file: s.name, mtime: s.mtime, label: `${relativeTime(s.mtime)} · ${s.snippet}` }))
+      : listSessions(home).slice(0, 30).map((s) => ({ file: s.name, mtime: s.mtime, label: `${relativeTime(s.mtime)} · ${sessionPreview(s.file)}` }));
+    json(res, 200, { ok: true, sessions: found });
+    return true;
+  }
+
+  if (method === 'GET' && p === '/api/session') {
+    const file = url.searchParams.get('file');
+    if (!file) return json(res, 400, { error: '缺少 file 参数' });
+    try {
+      const loaded = loadSession(path.join(home, 'sessions', path.basename(file)));
+      // 载入会话时聚焦其工作空间（P3-4）：全局默认切到该会话的目录，前端下拉同步显示
+      const wsDir = getSessionWorkspace(path.basename(file));
+      const ws = workspaceForDir(wsDir);
+      if (wsDir && path.resolve(wsDir) !== path.resolve(state.workingDir)) {
+        state.workingDir = wsDir; // 审计 P2-5：仅在目录不同时才切换，减少全局状态抖动
+        if (ws) touchWorkspace(ws.name);
+      }
+      json(res, 200, {
+        ok: true,
+        messages: loaded.messages.filter((m) => m.role === 'user' || m.role === 'assistant').map((m) => ({ role: m.role, content: m.content ?? '' })),
+        workspace: ws?.name || null,
+      });
+    } catch {
+      json(res, 404, { error: '会话不存在' });
+    }
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/session') {
+    const body = await readBody(req, MAX_API_BODY);
+    const file = path.basename(String(body.file || ''));
+    const full = path.join(home, 'sessions', file);
+    if (!file || !fs.existsSync(full)) return json(res, 404, { error: '会话不存在' });
+    if (body.action === 'rename') {
+      const title = sanitizeTitle(String(body.title || '会话'));
+      const renamed = renameSessionFile(fs, path, home, { file: full }, title);
+      if (!renamed) return json(res, 500, { error: '重命名失败（可能存在同名会话）' });
+      moveSessionWorkspace(file, path.basename(renamed));
+      return json(res, 200, { ok: true, file: path.basename(renamed) });
+    }
+    if (body.action === 'delete') {
+      try {
+        fs.unlinkSync(full);
+        removeSessionWorkspace(file);
+        return json(res, 200, { ok: true });
+      } catch (/** @type {any} */ err) {
+        return json(res, 500, { error: String(err?.message || err) });
+      }
+    }
+    return json(res, 400, { error: '未知操作：rename|delete' });
+  }
+
+  if (method === 'GET' && p === '/api/draft') {
+    // 质检 A5：按会话维度读取（无 file 参数用全局槽，兼容旧客户端）
+    const key = String(url.searchParams.get('file') || '');
+    const text = draftTexts.get(key) || '';
+    draftTexts.delete(key); // 读取即清除
+    json(res, 200, { ok: true, text });
+    return true;
+  }
+
+  if (method === 'POST' && p === '/api/draft') {
+    const body = await readBody(req, MAX_API_BODY);
+    const key = String(body.file || '');
+    draftTexts.set(key, String(body.text ?? '').slice(0, 200000));
+    json(res, 200, { ok: true });
+    return true;
+  }
+
+  return false;
+}