psyclaw 0.27.0 → 0.27.5

package/dist/src/panel/server.js

@@ -13,7 +13,6 @@ import { KNOWN_AGENTS } from "../agents/catalog.js";
 import { planAgentInstall } from "../install/installer.js";
 import { deepSeekProviderSpec, PiModelGateway } from "../adapters/pi/model.js";
 import { PROVIDER_PRESETS, saveProviderConfig } from "../setup.js";
-import { readHitlWorkspace } from "../project/hitl.js";
 import { assertSafeProjectPath, projectPaths } from "../project/paths.js";
 import { readManuscript } from "../project/manuscript.js";
 import { appendJsonlIfMissing, atomicWriteFile, readJsonl } from "../project/jsonl.js";
@@ -30,11 +29,16 @@ export { verifyDoi } from "../core/doi.js";
 import { resumePlanWithPi } from "../orchestration/pi-executor.js";
 import { RunEventLog } from "./events.js";
 import { PSYCLAW_IDENTITY_PROMPT } from "../branding.js";
+import { recommendedSkillTarget } from "../skills/recommended.js";
+import { projectTraceSnapshot } from "../telemetry/export.js";
 const activePanelRuns = new Set();
 async function readRecommendationState(root) {
     try {
         const value = JSON.parse(await readFile(join(root, ".psyclaw", "recommendations.json"), "utf8"));
-        return { schemaVersion: "psyclaw/recommendation-state/v1", skills: Array.isArray(value.skills) ? value.skills.filter((id) => typeof id === "string") : [], mcp: Array.isArray(value.mcp) ? value.mcp.filter((id) => typeof id === "string") : [] };
+        const skillScopes = value.skillScopes && typeof value.skillScopes === "object"
+            ? Object.fromEntries(Object.entries(value.skillScopes).filter((entry) => entry[1] === "project" || entry[1] === "user"))
+            : undefined;
+        return { schemaVersion: "psyclaw/recommendation-state/v1", skills: Array.isArray(value.skills) ? value.skills.filter((id) => typeof id === "string") : [], mcp: Array.isArray(value.mcp) ? value.mcp.filter((id) => typeof id === "string") : [], ...(skillScopes === undefined ? {} : { skillScopes }) };
     }
     catch {
         return { schemaVersion: "psyclaw/recommendation-state/v1", skills: [], mcp: [] };
@@ -45,6 +49,7 @@ async function writeRecommendationState(root, state) {
 }
 /** The bundled core skills, always listed so the user can disable (not uninstall) them. */
 const CORE_SKILLS = [
+    { id: "academic-grill", name: "学术追问" },
     { id: "research-intake", name: "研究入口" },
     { id: "evidence-capture", name: "证据登记" },
     { id: "citation-audit", name: "引用审计" },
@@ -154,7 +159,7 @@ async function appendLedgerEvidence(root, body) {
  * Any root-level document (questionnaire exports etc.) is listed as well.
  */
 const DOCUMENT_EXTENSIONS = new Set(["md", "markdown", "docx", "doc", "pdf", "xlsx", "xls", "csv", "txt"]);
-const DOCUMENT_SKIP_DIRS = [".psyclaw", ".git", "node_modules", "analysis/scripts", "analysis/results", "analysis/configs", "artifacts", "logs", "paper/archive"];
+const DOCUMENT_SKIP_DIRS = [".psyclaw", ".git", "node_modules", "analysis/scripts", "analysis/results", "analysis/configs", "logs", "paper/archive", "literature/pdfs"];
 /** Classify a document by its location and extension (shared by scan + import). */
 function classifyDocumentKind(relative, extension) {
     return relative.startsWith("paper/") || relative.startsWith("docs/")
@@ -387,12 +392,55 @@ async function panelStats(root) {
     const files = await listProjectFiles(root);
     return { schemaVersion: "psyclaw/panel-stats/v1", runs: (await listRuns(root)).length, evidence: await countLines(paths.evidence), claims: await countLines(paths.claims), auditEvents: await countLines(paths.audit), trackedFiles: files.length, outputs: files.filter((path) => path.startsWith("outputs/")).length, generatedAt: new Date().toISOString() };
 }
+const PANEL_FILE_ROOTS = ["notes/", "paper/", "docs/", "outputs/", "logs/"];
+const PANEL_FILE_EXTENSIONS = /\.(md|markdown|txt|json|csv)$/i;
+function panelFileAllowed(relative) {
+    const normalized = relative.replaceAll("\\", "/");
+    return PANEL_FILE_ROOTS.some((prefix) => normalized.startsWith(prefix))
+        && PANEL_FILE_EXTENSIONS.test(normalized)
+        && !/credential|secret|auth\.json|\.env/i.test(normalized);
+}
+async function panelProjectFiles(root) {
+    return (await listProjectFiles(root)).filter(panelFileAllowed);
+}
+async function readPanelProjectFile(root, relative) {
+    const normalized = relative.replaceAll("\\", "/").trim();
+    if (!panelFileAllowed(normalized) || normalized.split("/").some((part) => part === "" || part === "..")) {
+        throw new Error("project file is outside the Panel read-only allowlist");
+    }
+    const target = await assertSafeProjectPath(root, normalized);
+    const stat = await lstat(target);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error("project file must be a regular file");
+    if (stat.size > 2 * 1024 * 1024)
+        throw new Error("project file is too large for Panel preview");
+    const format = normalized.toLowerCase().endsWith(".json") ? "json"
+        : normalized.toLowerCase().endsWith(".csv") ? "csv"
+            : /\.(md|markdown)$/i.test(normalized) ? "markdown" : "text";
+    return { path: normalized, content: await readFile(target, "utf8"), format };
+}
 function publicInstallPlan(plan) {
     // `projectRoot` is an internal containment anchor. It is not needed by a
     // read-only browser and would disclose a local filesystem path.
     const { projectRoot: _projectRoot, ...publicFields } = plan;
     return publicFields;
 }
+function panelSkillInstallTask(root, item, scope) {
+    const id = String(item.id ?? "");
+    const name = String(item.name ?? id);
+    const sourceRef = String(item.sourceRef ?? "");
+    const target = recommendedSkillTarget(root, id, scope);
+    return [
+        `安装推荐 Skill：${name} (${id})。`,
+        `来源网址：${sourceRef}`,
+        `安装位置：${scope === "user" ? "系统目录（所有项目）" : "项目目录（仅当前项目）"}。`,
+        `唯一允许的最终目标目录：${target}`,
+        "请使用当前会话的工具检查来源仓库并完成安装。不要写入其他 Skill 目录，不要修改 data/raw、.git 或研究产物。",
+        "目标目录最终必须直接包含有效 SKILL.md（YAML frontmatter 至少包含 name 和 description），不得包含 .git、符号链接、凭据或二进制大文件。",
+        "如果仓库包含多个 Skill，只安装与此推荐项相符的部分；如果它不是 Skill 或无法合理适配，停止并说明原因，不要伪造 SKILL.md。",
+        "安装完成后检查目标目录结构，并提醒用户执行 /skills 启用该项，再执行 /reload。",
+    ].join("\n");
+}
 /** Metadata-only catalog for the optional panel. No install or credential read. */
 async function panelCatalog(root) {
     const scans = await discoverAgents();
@@ -532,7 +580,15 @@ async function recommendedSkills() {
     for (const path of candidates) {
         try {
             const catalog = JSON.parse(await readFile(path, "utf8"));
-            return { ...catalog, items: (catalog.items ?? []).map((item) => ({ ...item, slashCommand: `/skills enable ${String(item.id ?? "")}`, installCommand: `/install skill ${String(item.id ?? "")}` })) };
+            return {
+                ...catalog,
+                items: (catalog.items ?? []).filter((item) => item.kind === "skill").map((item) => ({
+                    ...item,
+                    slashCommand: `/skills enable ${String(item.id ?? "")}`,
+                    installCommand: `/install skill ${String(item.id ?? "")}`,
+                })),
+                externalTools: (catalog.externalTools ?? []).filter((item) => item.kind === "external-tool"),
+            };
         }
         catch { /* try package layout */ }
     }
@@ -701,7 +757,7 @@ export function createPanelServer(root, options = {}) {
         const url = new URL(request.url ?? "/", "http://localhost");
         // Read-only surface: any write method is rejected before routing.
         const runAction = /^\/api\/runs\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\/(pause|resume)$/.test(url.pathname);
-        if (request.method !== "GET" && request.method !== "HEAD" && !(request.method === "POST" && (["/api/provider-config", "/api/hitl/decision", "/api/assistant", "/api/system-prompt", "/api/hooks", "/api/recommendation-state", "/api/install/execute", "/api/active-provider", "/api/artifact/save", "/api/manuscript", "/api/claim", "/api/evidence", "/api/doi/verify", "/api/documents/import", "/api/publish", "/api/references/verify", "/api/references/check", "/api/references/download", "/api/citations"].includes(url.pathname) || runAction))) {
+        if (request.method !== "GET" && request.method !== "HEAD" && !(request.method === "POST" && (["/api/provider-config", "/api/assistant", "/api/system-prompt", "/api/hooks", "/api/recommendation-state", "/api/install/execute", "/api/active-provider", "/api/artifact/save", "/api/manuscript", "/api/claim", "/api/evidence", "/api/doi/verify", "/api/documents/import", "/api/publish", "/api/references/verify", "/api/references/check", "/api/references/download", "/api/citations"].includes(url.pathname) || runAction))) {
             response.writeHead(405, { "content-type": "application/json", allow: "GET, HEAD" });
             response.end(JSON.stringify({ error: "method not allowed" }));
             return;
@@ -781,6 +837,22 @@ export function createPanelServer(root, options = {}) {
                 response.end(JSON.stringify({ schemaVersion: "psyclaw/panel-files/v1", files: await listProjectFiles(root) }));
                 return;
             }
+            if (url.pathname === "/api/project-files") {
+                response.writeHead(200, { "content-type": "application/json" });
+                response.end(JSON.stringify({ schemaVersion: "psyclaw/panel-project-files/v1", files: await panelProjectFiles(root) }));
+                return;
+            }
+            if (url.pathname === "/api/project-file") {
+                const relative = url.searchParams.get("path") ?? "";
+                response.writeHead(200, { "content-type": "application/json" });
+                response.end(JSON.stringify({ schemaVersion: "psyclaw/panel-project-file/v1", ...(await readPanelProjectFile(root, relative)) }));
+                return;
+            }
+            if (url.pathname === "/api/traces") {
+                response.writeHead(200, { "content-type": "application/json" });
+                response.end(JSON.stringify(await projectTraceSnapshot({ root })));
+                return;
+            }
             if (url.pathname === "/api/config") {
                 const promptPath = await assertSafeProjectPath(root, ".psyclaw/system-prompt.md");
                 let supplement = "";
@@ -817,6 +889,8 @@ export function createPanelServer(root, options = {}) {
                 const state = await readRecommendationState(root);
                 const disabled = await readDisabledCapabilities(root);
                 const [skills, mcps] = await Promise.all([recommendedSkills(), recommendedMcps()]);
+                const skillIds = new Set((skills.items ?? []).map((item) => String(item.id ?? "")));
+                const mcpIds = new Set((mcps.items ?? []).map((item) => String(item.id ?? "")));
                 const nameOf = (kind, id) => {
                     const catalog = kind === "skill" ? skills : mcps;
                     const item = (catalog.items ?? []).find((candidate) => candidate.id === id);
@@ -826,8 +900,8 @@ export function createPanelServer(root, options = {}) {
                 response.end(JSON.stringify({
                     schemaVersion: "psyclaw/enabled-capabilities/v1",
                     coreSkills: CORE_SKILLS.map((skill) => ({ id: skill.id, name: skill.name, enabled: !disabled.coreSkills.includes(skill.id) })),
-                    skills: state.skills.map((id) => ({ id, name: nameOf("skill", id), enabled: true })),
-                    mcp: state.mcp.map((id) => ({ id, name: nameOf("mcp", id), enabled: true })),
+                    skills: state.skills.filter((id) => skillIds.has(id)).map((id) => ({ id, name: nameOf("skill", id), enabled: true })),
+                    mcp: state.mcp.filter((id) => mcpIds.has(id)).map((id) => ({ id, name: nameOf("mcp", id), enabled: true })),
                 }));
                 return;
             }
@@ -864,6 +938,7 @@ export function createPanelServer(root, options = {}) {
                 const kind = body.kind === "skill" || body.kind === "mcp" ? body.kind : undefined;
                 const id = String(body.id ?? "").trim();
                 const approved = body.approved === true;
+                const scope = body.scope === "project" || body.scope === "user" ? body.scope : undefined;
                 const actor = String(body.actor ?? "researcher").trim();
                 if (!kind || !id || !approved || actor.length < 1)
                     throw new Error("kind, id, approved and actor are required");
@@ -873,12 +948,37 @@ export function createPanelServer(root, options = {}) {
                     response.end(JSON.stringify({ error: "unknown recommended item" }));
                     return;
                 }
-                const command = typeof found.prep?.command === "string" && found.prep.command.trim() ? found.prep.command.trim() : undefined;
-                if (!command) {
+                if (kind === "skill") {
+                    if (!scope)
+                        throw new Error("scope must be project or user for Skill installation");
+                    if (options.installSkill === undefined) {
+                        response.writeHead(503, { "content-type": "application/json" });
+                        response.end(JSON.stringify({ error: "Skill 安装需要当前模型通道；请在 PsyClaw 对话中执行 /panel 后再安装。", reasonCode: "panel.skill-installer-unavailable" }));
+                        return;
+                    }
+                    await options.installSkill(panelSkillInstallTask(root, found.item, scope));
+                    const state = await readRecommendationState(root);
+                    state.skillScopes = { ...(state.skillScopes ?? {}), [id]: scope };
+                    await writeRecommendationState(root, state);
+                    response.writeHead(202, { "content-type": "application/json" });
+                    response.end(JSON.stringify({
+                        schemaVersion: "psyclaw/model-install-task/v1",
+                        ok: true,
+                        queued: true,
+                        id,
+                        scope,
+                        reloadHint: "/reload",
+                        message: "安装任务已交给当前模型；模型完成后请启用 Skill 并执行 /reload。",
+                    }));
+                    return;
+                }
+                const shellCommand = typeof found.prep?.command === "string" && found.prep.command.trim() ? found.prep.command.trim() : undefined;
+                if (!shellCommand) {
                     response.writeHead(400, { "content-type": "application/json" });
                     response.end(JSON.stringify({ error: "no install command is available for this item", blockedReason: found.prep?.blockedReason ?? null }));
                     return;
                 }
+                const command = shellCommand;
                 const startedAt = new Date().toISOString();
                 const runId = `panel_${randomUUID().replaceAll("-", "")}`;
                 const idempotencyKey = `panel:install:${sha256Text(`${kind}\u0000${id}\u0000${actor}`).slice(0, 24)}`;
@@ -894,7 +994,9 @@ export function createPanelServer(root, options = {}) {
                     command,
                     startedAt,
                 };
-                const { exitCode, output } = await runShellCommand(command, root);
+                let exitCode;
+                let output;
+                ({ exitCode, output } = await runShellCommand(command, root));
                 receipt.ok = exitCode === 0;
                 receipt.exitCode = exitCode;
                 receipt.finishedAt = new Date().toISOString();
@@ -902,8 +1004,7 @@ export function createPanelServer(root, options = {}) {
                 await atomicWriteFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
                 if (receipt.ok) {
                     const state = await readRecommendationState(root);
-                    const key = kind === "skill" ? "skills" : "mcp";
-                    state[key] = [...new Set([...state[key], id])];
+                    state.mcp = [...new Set([...state.mcp, id])];
                     await writeRecommendationState(root, state);
                 }
                 await appendJsonlIfMissing(projectPaths(root).audit, {
@@ -1076,11 +1177,6 @@ export function createPanelServer(root, options = {}) {
                 }
                 return;
             }
-            if (url.pathname === "/api/hitl") {
-                response.writeHead(200, { "content-type": "application/json" });
-                response.end(JSON.stringify(await readHitlWorkspace(root, url.searchParams.get("contents") === "1")));
-                return;
-            }
             if (url.pathname === "/api/artifacts") {
                 const indexPath = projectPaths(root).outputs + "/index.json";
                 let indexedArtifacts = [];
@@ -1535,63 +1631,6 @@ export function createPanelServer(root, options = {}) {
                 response.end(JSON.stringify({ schemaVersion: "psyclaw/provider-config-receipt/v1", ok: true, provider: id, modelCount: models.length, apiKeyStored: Boolean(apiKey?.trim()) }));
                 return;
             }
-            if (url.pathname === "/api/hitl/decision") {
-                if (request.method !== "POST") {
-                    response.writeHead(405, { "content-type": "application/json", allow: "POST" });
-                    response.end(JSON.stringify({ error: "method not allowed" }));
-                    return;
-                }
-                const body = await readJsonBody(request);
-                const decision = String(body.decision ?? "").trim();
-                const rationale = String(body.rationale ?? "").trim();
-                const actor = String(body.actor ?? "researcher").trim();
-                if (!["approved", "denied", "needs-changes"].includes(decision) || rationale.length < 3 || actor.length < 1) {
-                    response.writeHead(400, { "content-type": "application/json" });
-                    response.end(JSON.stringify({ error: "decision, rationale (3+ chars), and actor are required" }));
-                    return;
-                }
-                const recordedAt = new Date().toISOString();
-                const idempotencyKey = `panel:hitl:${sha256Text(`${decision}\u0000${rationale}\u0000${actor}`).slice(0, 24)}`;
-                const decisionDocument = [
-                    "---",
-                    "schemaVersion: psyclaw/hitl-decision-request/v1",
-                    "documentVersion: 1.0.0",
-                    `recordedAt: ${recordedAt}`,
-                    `actor: ${actor.replaceAll("\n", " ")}`,
-                    `decision: ${decision}`,
-                    `idempotencyKey: ${idempotencyKey}`,
-                    "---",
-                    "",
-                    "# Decision Request",
-                    "",
-                    `Decision: ${decision}`,
-                    "",
-                    "## Rationale",
-                    "",
-                    rationale,
-                    "",
-                ].join("\n");
-                const decisionPath = await assertSafeProjectPath(root, "notes/decision_request.md");
-                await atomicWriteFile(decisionPath, decisionDocument);
-                const receipt = {
-                    schemaVersion: "psyclaw/tool-receipt/v1",
-                    runId: `panel_${randomUUID().replaceAll("-", "")}`,
-                    taskId: "hitl-decision",
-                    tool: "panel.hitl.decision",
-                    effect: "write",
-                    approval: "approved",
-                    idempotencyKey,
-                    ok: true,
-                    resultHash: sha256Text(decisionDocument),
-                    startedAt: recordedAt,
-                    finishedAt: new Date().toISOString(),
-                };
-                const receiptPath = await assertSafeProjectPath(root, `.psyclaw/manifests/${receipt.runId}.receipt.json`);
-                await atomicWriteFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
-                response.writeHead(200, { "content-type": "application/json" });
-                response.end(JSON.stringify({ schemaVersion: "psyclaw/hitl-decision-receipt/v1", ok: true, decision, decisionPath, receiptPath, idempotencyKey }));
-                return;
-            }
             if (url.pathname === "/" || url.pathname === "/index.html") {
                 const html = await readFile(panelHtmlPath, "utf8");
                 response.writeHead(200, { "content-type": "text/html; charset=utf-8" });