sintbot 1.3.0 → 1.4.1

package/src/agent/codexstatus.js

@@ -0,0 +1,181 @@
+// Codex subscription introspection — login status + rate-limit (quota) usage, for the
+// console's codex model card. Two headless probes, neither needs an API key:
+//   loginStatus() → `codex login status` (exit 0 = logged in; prints the auth mode)
+//   rateLimits()  → short-lived `codex app-server` JSON-RPC (newline-framed over stdio):
+//                   initialize → initialized → account/rateLimits/read → quit.
+// The exec event stream can't carry rate limits (exec responses lack the x-codex-*
+// headers, openai/codex#14728), so app-server is the only headless source. Protocol
+// shape confirmed against a working driver; exact behaviour is verified on the target
+// machine. Both return best-effort and never throw.
+
+const { spawn } = require('node:child_process')
+const { IS_WIN, resolveSpawn } = require('./winexec')
+
+// `codex login status` output → { loggedIn, mode }. The line typically reads
+// "Logged in using ChatGPT" (subscription) or mentions an API key.
+function parseLoginStatus(stdout, code) {
+  const text = (stdout || '').trim()
+  let mode = ''
+  if (/chatgpt/i.test(text)) mode = 'chatgpt'
+  else if (/api[\s-]?key/i.test(text)) mode = 'apikey'
+  return { loggedIn: code === 0, mode, text: text.slice(0, 200) }
+}
+
+function loginStatus(bin = 'codex', timeoutMs = 8000) {
+  return new Promise((resolve) => {
+    const { file, spawnArgs } = resolveSpawn(bin, ['login', 'status'])
+    let out = '', err = '', settled = false
+    const done = (v) => { if (settled) return; settled = true; clearTimeout(timer); resolve(v) }
+    const child = spawn(file, spawnArgs, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true })
+    const timer = setTimeout(() => { try { child.kill() } catch {} done({ ok: false, error: 'timeout' }) }, timeoutMs)
+    child.stdout.on('data', (c) => { out += c.toString('utf8') })
+    child.stderr.on('data', (c) => { err += c.toString('utf8') })
+    child.on('error', (e) => done({ ok: false, error: e.code === 'ENOENT' ? "'codex' not found on PATH" : e.message }))
+    child.on('close', (code) => done({ ok: true, ...parseLoginStatus(out || err, code) }))
+  })
+}
+
+// TTL 缓存(与 claudestatus 同款):doctor 是一次性的,但控制台 /api/state 每次动作 + 60s 自动刷新
+// 都会重建健康行,每次都 spawn 一个进程没必要。
+const LOGIN_CACHE = new Map() // bin -> { at, val }
+async function cachedLoginStatus(bin = 'codex', ttl = 60_000) {
+  const c = LOGIN_CACHE.get(bin)
+  if (c && Date.now() - c.at < ttl) return c.val
+  const val = await loginStatus(bin)
+  LOGIN_CACHE.set(bin, { at: Date.now(), val })
+  return val
+}
+function clearLoginCache() { LOGIN_CACHE.clear() }
+
+// account/rateLimits/read response → compact usage. Windows: primary = 5h rolling
+// window, secondary = weekly (see docs/CODEX-RUNNER.md). resetsAt is an epoch (secs).
+function mapRateLimits(result) {
+  const rl = result && result.rateLimits
+  if (!rl) return null
+  const w = (x) => (x && typeof x.usedPercent === 'number')
+    ? { usedPercent: x.usedPercent, windowMins: x.windowDurationMins, resetsAt: x.resetsAt } : null
+  const out = { primary: w(rl.primary), secondary: w(rl.secondary), planType: rl.planType || '' }
+  if (rl.credits) out.credits = { balance: rl.credits.balance, hasCredits: !!rl.credits.hasCredits, unlimited: !!rl.credits.unlimited }
+  return (out.primary || out.secondary || out.credits) ? out : null
+}
+
+function killTree(child) {
+  if (!child || !child.pid) return
+  if (IS_WIN) { try { spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore', windowsHide: true }) } catch {} }
+  else { try { child.kill('SIGKILL') } catch {} }
+}
+
+// Generic short-lived `codex app-server` JSON-RPC call: initialize → initialized →
+// <method> → map → quit. One JSON object per line. Returns mapped value or null
+// (never throws). Cache results upstream — each call spawns a process and may hit
+// the ChatGPT backend.
+function appServerCall(bin, method, params, mapFn, timeoutMs = 12000) {
+  return new Promise((resolve) => {
+    let child
+    try {
+      const { file, spawnArgs } = resolveSpawn(bin, ['app-server'])
+      child = spawn(file, spawnArgs, { stdio: ['pipe', 'pipe', 'ignore'], windowsHide: true })
+    } catch { return resolve(null) }
+
+    let settled = false
+    const finish = (v) => { if (settled) return; settled = true; clearTimeout(timer); killTree(child); resolve(v) }
+    const timer = setTimeout(() => finish(null), timeoutMs)
+    child.on('error', () => finish(null))
+    child.stdin.on('error', () => {})
+
+    const send = (obj) => { try { child.stdin.write(JSON.stringify(obj) + '\n') } catch {} }
+    const INIT_ID = 1, CALL_ID = 2
+    send({ jsonrpc: '2.0', id: INIT_ID, method: 'initialize', params: { clientInfo: { name: 'sbot', title: 'sbot', version: '0.1.0' }, capabilities: { experimentalApi: true } } })
+
+    let buf = ''
+    child.stdout.on('data', (chunk) => {
+      buf += chunk.toString('utf8')
+      let nl
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, nl).trim(); buf = buf.slice(nl + 1)
+        if (!line) continue
+        let msg; try { msg = JSON.parse(line) } catch { continue }
+        // Responses carry id + result/error and NO method; ignore notifications /
+        // server→client requests (none expected without a running turn).
+        if (msg.method) continue
+        if (msg.id === INIT_ID) { send({ jsonrpc: '2.0', method: 'initialized' }); send({ jsonrpc: '2.0', id: CALL_ID, method, params: params || {} }) }
+        else if (msg.id === CALL_ID) return finish(msg.error ? null : mapFn(msg.result))
+      }
+    })
+  })
+}
+
+// Subscription rate limits (5h/weekly windows) — see mapRateLimits.
+function rateLimits(bin = 'codex', timeoutMs = 12000) {
+  return appServerCall(bin, 'account/rateLimits/read', {}, mapRateLimits, timeoutMs)
+}
+
+// model/list 响应 → 精简模型清单(过滤 hidden;efforts 兼容字符串/对象两形)。
+// 空/坏返回 → null(上游回退内置预设)。协议 v2,codex 0.144.3 真机验证(2026-07)。
+function mapModels(result) {
+  const data = (result && result.data) || []
+  const out = []
+  for (const x of data) {
+    if (!x || x.hidden || !(x.model || x.id)) continue
+    out.push({
+      model: x.model || x.id,
+      name: x.displayName || x.model || x.id,
+      desc: x.description || '',
+      isDefault: !!x.isDefault,
+      efforts: Array.isArray(x.supportedReasoningEfforts)
+        ? x.supportedReasoningEfforts.map((e) => (e && e.reasoningEffort) || e).filter((e) => typeof e === 'string')
+        : [],
+      defEffort: x.defaultReasoningEffort || '',
+    })
+  }
+  return out.length ? out : null
+}
+
+// 当前账号可用的 codex 模型(控制台 codex 面板下拉的数据源)。
+function listModels(bin = 'codex', timeoutMs = 12000) {
+  return appServerCall(bin, 'model/list', {}, mapModels, timeoutMs)
+}
+
+// 探测不到(未登录/老版本/超时)时的内置预设 —— 2026-07 实测自 codex 0.144.3 的
+// model/list 真实返回;随 sbot 版本按需更新。UI 恒留「自定义」逃生口。
+// ⚠ efforts 已剔除 'ultra':model/list 把它列进 sol/terra,但服务端不认 —— 2026-07-20
+// 真机用非法值触发参数校验拿到权威合法集:'none','minimal','low','medium','high','xhigh','max'。
+// 前端另有 RE_LEGAL 兜底过滤(live 探测结果同样会带 ultra,源头改不了)。
+const PRESET_MODELS = [
+  { model: 'gpt-5.6-sol', name: 'GPT-5.6-Sol', desc: 'Latest frontier agentic coding model.', isDefault: true, efforts: ['low', 'medium', 'high', 'xhigh', 'max'], defEffort: 'low' },
+  { model: 'gpt-5.6-terra', name: 'GPT-5.6-Terra', desc: 'Balanced agentic coding model for everyday work.', isDefault: false, efforts: ['low', 'medium', 'high', 'xhigh', 'max'], defEffort: 'medium' },
+  { model: 'gpt-5.6-luna', name: 'GPT-5.6-Luna', desc: 'Fast and affordable agentic coding model.', isDefault: false, efforts: ['low', 'medium', 'high', 'xhigh', 'max'], defEffort: 'medium' },
+  { model: 'gpt-5.5', name: 'GPT-5.5', desc: 'Frontier model for complex coding and research.', isDefault: false, efforts: ['low', 'medium', 'high', 'xhigh'], defEffort: 'medium' },
+  { model: 'gpt-5.4', name: 'GPT-5.4', desc: 'Strong model for everyday coding.', isDefault: false, efforts: ['low', 'medium', 'high', 'xhigh'], defEffort: 'medium' },
+  { model: 'gpt-5.4-mini', name: 'GPT-5.4-Mini', desc: 'Small, fast, and cost-efficient.', isDefault: false, efforts: ['low', 'medium', 'high', 'xhigh'], defEffort: 'medium' },
+]
+
+// A window's label DERIVED from its duration, not its position. Codex changed the shape:
+// a window that used to sit in `primary` as 5h (≈300min) now arrives as the weekly window
+// (10080min) with `secondary: null`, so the old positional `primary='5h'` mislabeled a
+// weekly window as "5h". Read windowMins instead: ~300 ⇒ "5h", 10080 ⇒ "周".
+// 窗口名(v0.11.8 起用于紧凑格式 `7d:12%`,故周窗口标 7d 而非「周」,与 Claude 卡一致)
+function windowLabel(mins) {
+  if (!mins) return '窗口'
+  if (mins >= 1440) return `${Math.round(mins / 1440)}d`
+  return `${Math.round(mins / 60)}h`
+}
+
+// Mapped rate-limits → a compact one-line string for the group's /hud reply.
+// Mirrors the console's fmtUsage (client-side) but runs in the daemon.
+// Date.now() is real here (Node), so the reset countdown is live.
+// 紧凑一行(v0.11.8 与 Claude 卡同口径):`5h:98% (1.8h) │ 7d:12% (6.1d)`。
+// ⚠ **百分比是「已用」不是「剩余」** —— 这里是群内 /hud 对 codex 群的实际渲染,与
+// claudeusage.formatClaudeUsage / console 的 fmtUsage / usage.js 的 minimax 行必须同口径,
+// 漏改任何一处就会出现同一个数字两种含义(98% 既可能是快满也可能是还剩很多)。
+function formatUsage(u) {
+  if (!u) return null
+  const dur = (ms) => { const trim = (v) => (v < 10 ? String(Number(v.toFixed(1))) : String(Math.round(v))); const h = ms / 3600e3; if (h >= 24) return `${trim(h / 24)}d`; if (h >= 1) return `${trim(h)}h`; return `${Math.max(1, Math.round(ms / 60e3))}m` }
+  const reset = (w) => { if (!w || w.resetsAt == null) return ''; const ms = w.resetsAt > 1e9 ? w.resetsAt * 1000 - Date.now() : w.resetsAt * 1000; return (ms > 0 && ms < 9 * 864e5) ? ` (${dur(ms)})` : '' }
+  const win = (w) => w ? `${windowLabel(w.windowMins)}:${Math.min(100, Math.max(0, Math.round(w.usedPercent || 0)))}%${reset(w)}` : ''
+  const parts = [win(u.primary), win(u.secondary)].filter(Boolean)
+  if (u.credits && u.credits.hasCredits && u.credits.balance != null) parts.push(`credits ${u.credits.balance}`)
+  return parts.join(' │ ') || null
+}
+
+module.exports = { loginStatus, cachedLoginStatus, clearLoginCache, rateLimits, listModels, parseLoginStatus, mapRateLimits, mapModels, formatUsage, windowLabel, PRESET_MODELS }

package/src/agent/privatecore.js

@@ -3,7 +3,7 @@ const fs = require('node:fs')
 const path = require('node:path')
 const { createHash } = require('node:crypto')
 
-const EXPECTED_SHA256 = 'c9b89e6f748c94415aa853be6ccaef35030f754b8898cb81b6cc0d02cf85e222'
+const EXPECTED_SHA256 = '1ab99efd538588accb90756aff9843063337cf666a679b2897630477c912bdf0'
 let bytes
 try {
   bytes = fs.readFileSync(path.join(__dirname, 'privatecore.wasm'))

package/src/c2configcontrol.js

@@ -0,0 +1,214 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+const { isDeepStrictEqual } = require('node:util')
+const { atomicWriteJSON } = require('./core/store')
+const { loadInstallationFromRaw, assertJournalScope, assertRunnerExecutable,
+  MANIFEST, VALIDATORS } = require('./c2install')
+const { C2DurableJournal } = require('./core/c2durablejournal')
+const { assertNoLegacyGroupState } = require('./c2migration')
+
+const GLOBAL_TASK_KEYS = ['providers', 'agent', 'defaultProvider', 'timezone', 'brand']
+const RESET_KEYS = ['provider', 'model', 'workdir', 'codexApp']
+
+// Synchronous validation/application around one atomic configuration write.
+// A group-scoped edit waits only for that group to settle. Changing a group's
+// model, project or backend clears its session before the new configuration
+// is written, so no later turn can resume a session from another backend.
+// It never moves a journal, settles a receipt or reconnects the platform.
+function createC2ConfigControl({ installation, getBindings, getHeld = () => new Map(),
+  assertWriterLock, store = null, activateRoute = null, probeRunner = assertRunnerExecutable,
+  log = () => {} } = {}) {
+  if (!installation?.cfg?._path || typeof getBindings !== 'function' ||
+      typeof getHeld !== 'function' ||
+      typeof assertWriterLock !== 'function' ||
+      store !== null && typeof store.resetGroupSession !== 'function' ||
+      activateRoute !== null && typeof activateRoute !== 'function' ||
+      typeof probeRunner !== 'function') {
+    throw new TypeError('Configuration control needs live installation authority')
+  }
+  const { cfg, routes, stateDir } = installation
+  let prepared = null
+
+  function held() {
+    if (assertWriterLock() !== true) throw new Error('Service writer authority is unavailable')
+  }
+  function assertSettled(chatId, binding) {
+    if (!binding) return
+    if (binding.gate.blocked || binding.runtime.blocked ||
+        [...binding.engine.rts.values()].some(rt => rt.v2NormalRouteActive ||
+          rt.v2AdmissionPending || rt.v2Controller || rt.v2QueueReceiptIds?.length)) {
+      throw new Error('Wait until the group task is settled before changing its task settings')
+    }
+    assertJournalScope(binding.journal, chatId, { requireSettled: true })
+  }
+
+  function validateConfig(raw) {
+    prepared = null
+    held()
+    const next = loadInstallationFromRaw(raw, cfg._path, { dataDir: stateDir,
+      allowAddedGroups: !!activateRoute && !!store })
+    const bindings = getBindings()
+    const current = new Set(routes.map(route => route.chatId))
+    if (routes.some(route => !next.routes.some(item => item.chatId === route.chatId))) {
+      throw new Error('Removing a configured group requires a stopped migration')
+    }
+    const added = next.routes.filter(route => !current.has(route.chatId))
+    if (added.length && (!activateRoute || !store)) {
+      throw new Error('Adding a group requires a service that can open it online')
+    }
+    const connectionOnly = value => {
+      const copy = { ...value }
+      delete copy.admins; delete copy.adminOpenId; delete copy.adminName
+      return copy
+    }
+    if (!isDeepStrictEqual(connectionOnly(cfg.feishu), connectionOnly(next.cfg.feishu))) {
+      throw new Error('Connection settings require a service restart')
+    }
+    for (const key of ['wecom', 'slack', 'proxy', 'projectsRoots', 'browser', 'providers', 'defaultProvider']) {
+      if (!isDeepStrictEqual(cfg[key], next.cfg[key])) throw new Error('Connection and filesystem settings require a service restart')
+    }
+    if (cfg.agent.maxConcurrent !== next.cfg.agent.maxConcurrent) {
+      throw new Error('Changing global concurrency requires a service restart')
+    }
+    const resets = [], activations = [], changed = []
+    const heldGroups = getHeld()
+    for (const route of routes) {
+      const target = next.routes.find(item => item.chatId === route.chatId)
+      if (route.group.platform !== target.group.platform) {
+        throw new Error('Moving a group to another platform requires an explicit state migration')
+      }
+      if (heldGroups.has(route.chatId)) {
+        // Edits elsewhere proceed; the held group keeps its exact settings.
+        if (!isDeepStrictEqual(route.group, target.group)) {
+          throw new Error('This group is held after an unresolved fault; seal its incident and restart before changing it')
+        }
+        continue
+      }
+      if (!isDeepStrictEqual(route.group, target.group)) changed.push(route.chatId)
+      if (RESET_KEYS.some(key => !isDeepStrictEqual(route.group[key], target.group[key]))) {
+        if (!store) throw new Error('Changing model or project requires session reset authority')
+        resets.push(route.chatId)
+        if (!target.paused) probeRunner(target.provider, next.cfg)
+      }
+      if (!bindings.has(route.chatId)) {
+        // Only a route paused since startup lacks a binding once serving.
+        if (!route.paused) throw new Error('The group is not open yet; wait for the service to finish starting')
+        if (!target.paused) {
+          if (!activateRoute) throw new Error('An initially paused group must be activated during a service restart')
+          activations.push(route.chatId)
+          probeRunner(target.provider, next.cfg)
+        }
+      }
+    }
+    for (const route of added) {
+      assertNoLegacyGroupState({ stateDir, chatId: route.chatId })
+      if (fs.existsSync(route.file)) {
+        throw new Error('A journal already exists for the new group; preserve it and review it before binding')
+      }
+      if (!route.paused) probeRunner(route.provider, next.cfg)
+    }
+    // Global task settings affect every group; a group edit affects only that
+    // group. Authentication/profile-only edits never wait for running turns.
+    const global = GLOBAL_TASK_KEYS.some(key => !isDeepStrictEqual(cfg[key], next.cfg[key]))
+    for (const [chatId, binding] of bindings) {
+      if (global || changed.includes(chatId)) assertSettled(chatId, binding)
+    }
+    prepared = { raw: JSON.stringify(raw), next, resets, activations, added }
+    return true
+  }
+
+  // Runs after validation and before the configuration file is replaced.
+  // Every step is idempotent or fails closed; a crash leaves either the old
+  // configuration with a fresh session, or a mapped empty journal for review.
+  function beforeWrite(raw) {
+    held()
+    if (!prepared || prepared.raw !== JSON.stringify(raw)) {
+      throw new Error('Configuration was not validated against the current service')
+    }
+    for (const chatId of prepared.resets) store.resetGroupSession(chatId)
+    if (prepared.added.length) {
+      for (const route of prepared.added) {
+        C2DurableJournal.initialize(route.file, {
+          state: { version: 2, seq: 0, lanes: {} },
+          receipts: { pending: [], completed: [] },
+        }, VALIDATORS)
+        const journal = C2DurableJournal.open(route.file, VALIDATORS)
+        const snapshot = assertJournalScope(journal, route.chatId, { requireSettled: true })
+        if (journal.blocked || snapshot.cursor !== 0 || snapshot.eventCount !== 0) {
+          throw new Error('New group journal verification failed; preserve the file for review')
+        }
+      }
+      const manifestFile = path.join(stateDir, MANIFEST)
+      const persisted = JSON.parse(fs.readFileSync(manifestFile, 'utf8'))
+      const manifest = { version: 1,
+        groups: prepared.next.routes.map(({ chatId, file }) => ({ chatId, journal: path.basename(file) })) }
+      if (persisted.migrationSha256 !== undefined) manifest.migrationSha256 = persisted.migrationSha256
+      atomicWriteJSON(manifestFile, manifest, { mode: 0o600 })
+    }
+    return true
+  }
+
+  function applyConfig(raw) {
+    if (assertWriterLock() !== true || !prepared || prepared.raw !== JSON.stringify(raw)) {
+      throw new Error('Configuration was not validated against the current service')
+    }
+    const { next, activations, added } = prepared
+    const global = GLOBAL_TASK_KEYS.some(key => !isDeepStrictEqual(cfg[key], next.cfg[key]))
+    prepared = null
+    for (const key of Object.keys(cfg)) delete cfg[key]
+    Object.assign(cfg, next.cfg)
+    const bindings = getBindings()
+    for (const route of routes) {
+      const target = next.routes.find(item => item.chatId === route.chatId)
+      const groupChanged = !isDeepStrictEqual(route.group, target.group)
+      Object.assign(route, target)
+      const engine = bindings.get(route.chatId)?.engine
+      if (engine && (global || groupChanged)) {
+        engine.cfg = { ...cfg, groups: { [route.chatId]: route.group } }
+        engine.tz = cfg.timezone
+      }
+    }
+    for (const route of added) routes.push(route)
+    routes.sort((a, b) => a.chatId < b.chatId ? -1 : a.chatId > b.chatId ? 1 : 0)
+    for (const route of [...routes.filter(item => activations.includes(item.chatId)),
+      ...added.filter(item => !item.paused)]) {
+      // Opening runs the group's normal recovery gate. Until it finishes the
+      // service ignores that group's messages instead of admitting receipts.
+      Promise.resolve().then(() => activateRoute(route)).catch(error => {
+        log(`group ${route.chatId}: online activation failed: ${error?.message || String(error)}`)
+      })
+    }
+    return true
+  }
+
+  // One writer for the console and chat commands: read the file, change it,
+  // validate, reset affected sessions, replace atomically, then go live.
+  function writeConfig(mutate) {
+    held()
+    if (typeof mutate !== 'function') throw new TypeError('Configuration change needs a mutation')
+    const raw = JSON.parse(fs.readFileSync(cfg._path, 'utf8'))
+    mutate(raw)
+    validateConfig(raw)
+    beforeWrite(raw)
+    atomicWriteJSON(cfg._path, raw, { mode: 0o600 })
+    applyConfig(raw)
+    return raw
+  }
+
+  function switchGroupProvider(chatId, name) {
+    return writeConfig(raw => {
+      const group = raw.groups?.[chatId]
+      if (!group) throw new Error('Unknown group')
+      if (!cfg.providers?.[name]) throw new Error('Unknown model')
+      group.provider = name
+      // A pinned model id belongs to the previous provider.
+      delete group.model
+    })
+  }
+
+  return { validateConfig, beforeWrite, applyConfig, writeConfig, switchGroupProvider }
+}
+
+module.exports = { createC2ConfigControl }

package/src/c2console.js

@@ -0,0 +1,149 @@
+'use strict'
+
+const path = require('node:path')
+const { createUiServer } = require('./ui/serverbase')
+const { START_PATH, CALLBACK_PATH } = require('./ui/feishulogin')
+
+// A host facade over existing v2 authorities, not a second execution engine.
+// The allowlist applies after the existing console's authentication boundary.
+const READ_PATHS = ['/api/state', '/api/events', '/api/inbox', '/api/activity',
+  '/api/changelog', '/api/changelog-en', '/api/codex/models', '/api/usage',
+  '/api/plugins', '/api/design/styles', '/api/design/icons', '/api/fs/listdir',
+  '/api/feishu/admin-candidates', '/api/feishu/org-users', '/api/feishu/resolve-contact',
+  '/api/feishu/chats', '/api/feishu/chat-members', START_PATH, CALLBACK_PATH]
+const WRITE_PATHS = ['/api/login', '/api/logout', '/api/logout/all',
+  '/api/ui/network', '/api/ui/public-url', '/api/ui/update-settings', '/api/feishu/admins',
+  '/api/groups', '/api/groups/provider', '/api/fs/mkdir',
+  '/api/groups/order', '/api/groups/policy', '/api/groups/redact',
+  '/api/groups/codex-steer', '/api/groups/pause', '/api/groups/stop',
+  '/api/agent', '/api/provider-settings', '/api/codex/verify', '/api/usage/refresh',
+  '/api/inbox/dismiss', '/api/issues/status']
+const SUPPORTED_RUNNERS = ['claude', 'codex']
+
+function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld = () => new Map(),
+  assertWriterLock, validateConfig, applyConfig, beforeWrite = () => true, now = Date.now } = {}) {
+  for (const callback of [getBindings, getCapacity, getConfig, getHeld, assertWriterLock,
+    validateConfig, applyConfig, beforeWrite, now]) {
+    if (typeof callback !== 'function') throw new TypeError('C2 console needs live authority and configuration hooks')
+  }
+  if ([validateConfig, applyConfig, beforeWrite].some(callback => callback.constructor?.name === 'AsyncFunction')) {
+    throw new TypeError('C2 console configuration hooks must be synchronous')
+  }
+  const startedAt = now()
+  const capabilities = Object.freeze({ mode: 'durable-v2',
+    reason: '此操作尚未接入当前版本的持久处理流程，未执行。',
+    summary: '实时状态、认证管理、停止任务、绑定新群，以及空闲群的模型切换（Codex / Claude Code）和项目目录修改已接入；该群有任务或未结记录时不能修改。开新会话、解除绑定、控制台插话、定时任务、画布和升级暂不可用。',
+    allowed: { GET: READ_PATHS, POST: WRITE_PATHS } })
+  function held() {
+    if (assertWriterLock() !== true) throw new Error('服务写入权限已失效，操作未执行')
+  }
+  const bindings = () => {
+    const value = getBindings()
+    if (!(value instanceof Map)) throw new TypeError('C2 console bindings must be a Map')
+    return value
+  }
+  function getLiveState() {
+    const cfg = getConfig()
+    const capacity = getCapacity()
+    const heldGroups = getHeld()
+    const groups = {}
+    let queue = 0
+    for (const [chatId, group] of Object.entries(cfg.groups || {})) {
+      const binding = bindings().get(chatId)
+      const hold = heldGroups.get(chatId)
+      const rt = binding?.engine?.rts.get(chatId)
+      const snapshot = binding?.journal?.snapshot()
+      const pending = snapshot?.receipts?.pending || []
+      const queued = snapshot?.state?.lanes?.queue?.[chatId]?.queue?.length || 0
+      queue += queued
+      groups[chatId] = {
+        busy: !!rt?.v2NormalRouteActive,
+        finalizing: !!rt?.v2TerminalStarted,
+        followups: !!rt?.v2SteerControl && !rt?.v2SteerClosing && !rt?.v2TerminalStarted,
+        queue: queued, pending: pending.length,
+        queueFaulted: !group.paused && (!binding || (!rt?.v2NormalRouteActive && !!binding.gate?.blocked)),
+        waitingForCapacity: !!rt?.v2AdmissionPending,
+        sinceMs: rt?.v2StartedAt ? Math.max(0, now() - rt.v2StartedAt) : 0,
+        sessionId: binding?.engine?.store?.getSession(chatId) || '',
+        // A held group needs the operator: its last result is unknown.
+        ...(hold ? { held: true, heldReason: hold.reason, heldSinceMs: Math.max(0, now() - hold.since) } : {}),
+      }
+    }
+    const activeBindingsReady = Object.entries(cfg.groups || {})
+      .filter(([chatId, group]) => !group.paused && !heldGroups.has(chatId))
+      .every(([chatId]) => bindings().has(chatId))
+    return { running: assertWriterLock() === true && !capacity.closed && activeBindingsReady,
+      uptimeMs: Math.max(0, now() - startedAt),
+      concurrency: { active: capacity.active, max: capacity.maxConcurrent },
+      queue, waiting: capacity.waiting, held: heldGroups.size, groups }
+  }
+  function getActivity() {
+    const cfg = getConfig(), items = []
+    for (const [chatId, binding] of bindings()) {
+      const snap = binding.journal.snapshot()
+      const rt = binding.engine.rts.get(chatId)
+      const group = cfg.groups[chatId]?.name || chatId.slice(-8)
+      for (const receipt of snap.receipts.pending) {
+        const running = rt?.v2RunningJobs?.some(job => job.msg?._c2ReceiptId === receipt.id)
+        items.push({ id: receipt.id, chatId, group, ts: receipt.acceptedAt,
+          kind: running ? 'start' : 'done', status: running ? 'running' : '等待处理',
+          text: running ? '正在处理群消息' : '消息已登记，等待处理', sender: '' })
+      }
+      for (const receipt of snap.receipts.completed.slice(-30)) {
+        // A settled receipt alone does not prove successful answer delivery.
+        items.push({ id: receipt.id, chatId, group, ts: receipt.settledAt,
+          kind: 'done', status: '已结账', text: '消息处理记录已结账', sender: '' })
+      }
+    }
+    return items.sort((a, b) => b.ts - a.ts).slice(0, 30)
+  }
+  return {
+    capabilities,
+    allows: (method, pathname) => (capabilities.allowed[method] || []).includes(pathname),
+    // A provider without a runner field is Claude Code, as everywhere else.
+    providerSupported: provider => SUPPORTED_RUNNERS.includes(provider?.runner || 'claude'),
+    getLiveState, getActivity,
+    validateConfig(raw) { held(); validateConfig(raw) },
+    beforeWrite(raw) { held(); beforeWrite(raw) },
+    applyConfig(raw) { held(); applyConfig(raw) },
+    decorateState(state) {
+      state.runtimeCapabilities = capabilities
+      state.previews = (state.previews || []).filter(item => getConfig().groups?.[item.chatId])
+      state.leftovers = { supported: false, rows: [], error: null }
+    },
+    control: {
+      providerOf(chatId) {
+        const binding = bindings().get(chatId)
+        const cfg = getConfig(), group = cfg.groups?.[chatId]
+        return binding?.engine?.store?.getProvider(chatId) || group?.provider || cfg.defaultProvider
+      },
+      stop(chatId) {
+        held()
+        const binding = bindings().get(chatId)
+        if (!binding) throw new Error('此群未运行，未执行停止')
+        return binding.engine.stop(chatId)
+      },
+    },
+  }
+}
+
+function createC2Console(options = {}) {
+  const { stateDir, configPath, getConnHealth, host = '127.0.0.1', log = () => {} } = options
+  if (!path.isAbsolute(stateDir || '') || !path.isAbsolute(configPath || '')) {
+    throw new TypeError('C2 console requires explicit installation paths')
+  }
+  const facade = createC2ConsoleFacade(options)
+  const ui = createUiServer({ configPath, host, log, getConnHealth,
+    onHostChange: options.onHostChange,
+    getLiveState: facade.getLiveState, control: facade.control, runtimePolicy: facade,
+    issuesPath: path.join(stateDir, 'issues.jsonl'),
+    sessionsPath: path.join(stateDir, 'ui-sessions.json'),
+    auditPath: path.join(stateDir, 'audit.jsonl'),
+    ledgerPath: path.join(stateDir, 'turns.jsonl'),
+    inboxDismissPath: path.join(stateDir, 'inbox-dismissed.json'),
+    verifyFile: path.join(stateDir, 'verify.json'),
+  })
+  return { ...ui, facade }
+}
+
+module.exports = { createC2Console, createC2ConsoleFacade }