AskaEth
bc0047b449
design/11 §7.1（主人 2026-10-03 拍板）。此前 hub.broadcast 是全连接广播，而任意角色
（含 viewer）都能连 /ws/chat ⇒ viewer 能收到角色回复正文（message.*）、推理内容
（thinking.*）、消息增量、graph_update、mood 等。这与 design/19 §1/§3「flow 可视化仅
owner/admin 可见」冲突，也与 GET /sessions/{id}/messages 的 owner/admin 档位不一致。
收口：唯一分类点 internal/services/gateway/ws_frame_scope.go 的 frameReachesAll(typ)
（fail-closed switch，默认 false）；hub.broadcast 投递前查表，白名单外对非 owner/admin
连接直接跳过。**不给 broadcast 加 bool 参数、不让调用点自己判断** —— 那正是"漏一处就是
泄漏"的形状。全包只有一个 fan-out 循环，14 个 .broadcast( 调用点全部落进该入口。
- 白名单只有 7 个状态机信号帧（不含任何内容）：session_busy / pending_ack / pending_drain /
session_idle / session_interrupted / pending_full / session_read
- 其余全部（流式 message/thinking/tool_call、message_persisted/edited/deleted、graph_update、
subagent_event/result、task_output/task_done、automation_result、tool_used、capacity_awaken、
mode_switch、mood、device_update、reminder）仅 owner+admin
- 语义澄清：本门管「谁被主动推送」，数据可见性仍由 REST 决定（viewer 的 12 条只读监控端点
不变，含 GET /personas 的 mood）；/ws/chat 连接鉴权与 voice_output 定向帧不动
契约：Docs/api-client.md → v0.48（对 viewer 是收紧；owner/admin 零变化；无端点/字段形状变更）
验证：go build/vet 绿；go test ./... = 58 包 ok / 0 FAIL；-race ./internal/services/gateway/... ok；
linux/amd64 + darwin/arm64 交叉编译绿。真 httptest WS + 真 JWT 按角色逐帧实测 37 帧：
viewer 只收到 7 个状态信号，owner/admin 37/37。
变异验证：① graph_update 加回白名单 → 真 WS 抓到 viewer 收到 graph_update，3 个测试 FAIL；
② session_idle 移出白名单 → 3 个测试 FAIL（viewer 等不到哨兵帧而超时）。均已还原。
遗留（已登记，待主人裁决）：① 握手 history 回放对任意角色照发（viewer 连上即得主会话最近
50 条正文）；② /ws/chat 上行未按角色授权（viewer 可发 chat = 真驱动模型并落库；
subagent_ask / task_output_query 的定向应答绕过本门）。
85 lines
4.0 KiB
Go
85 lines
4.0 KiB
Go
package gateway
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/history"
|
|
)
|
|
|
|
// This file owns the gateway's outbound realtime pushes: the persisted-message
|
|
// frames shared with the channel bridge plus the per-persona state frames the
|
|
// frontend renders (mood badge, capacity awaken).
|
|
|
|
// BroadcastPersisted broadcasts a just-persisted chat message as a WS event so
|
|
// every browser of the same account appends it without a manual refresh
|
|
// (design/16 §4.2). It is shared by the orchestrator (Web turns) and the channel
|
|
// bridge (IM messages), so both paths flow through one frame shape. The event type
|
|
// is split by session: the main web session and its web sub-sessions broadcast
|
|
// `message_persisted` for web-chat realtime sync, while any other session id is an
|
|
// isolated channel adapter session (sess-xxx) and broadcasts `channel_persisted`
|
|
// for the IM adapter log page — the web chat has no handler for the latter, so it
|
|
// is naturally ignored there and never pollutes the conversation. Thinking is
|
|
// stripped to stay consistent with the WS history replay (design/16 §6). It is a
|
|
// no-op-safe call when the hub has broadcast wired. Both frame types carry message
|
|
// content, so the design/11 §7.1 frame gate delivers them to owner/admin
|
|
// connections only.
|
|
func (s *Server) BroadcastPersisted(msg history.Message) {
|
|
wire := toHistoryMessage(msg)
|
|
wire.Thinking = ""
|
|
typ := "channel_persisted"
|
|
if msg.SessionID == history.MainSessionID || strings.HasPrefix(msg.SessionID, history.MainSessionID+":") {
|
|
typ = "message_persisted"
|
|
}
|
|
s.hub.broadcast(wsEvent{Type: typ, SessionID: msg.SessionID, Data: map[string]any{"message": wire}})
|
|
}
|
|
|
|
// wsCapacityAwaken is the WS event type for a capacity state transition
|
|
// (design/14 §5). Its data field is the frontend AwakenPayload {fromState,toState,tool}.
|
|
const wsCapacityAwaken = "capacity_awaken"
|
|
|
|
// BroadcastCapacityAwaken fans a capacity state transition to the Web UI as a
|
|
// `capacity_awaken` frame (design/14 §5). sessionID is the conversation that
|
|
// transitioned, so the client targets the correct session rather than treating the
|
|
// wake event as global. data matches the frontend AwakenPayload {fromState, toState,
|
|
// tool}; tool may be empty (no single tool was lit, the client then keeps the prior
|
|
// tool badge). It is NOT one of the design/11 §7.1 「状态机信号」 (its `tool` names
|
|
// what woke, and the panel that renders it is an owner surface), so the frame gate
|
|
// delivers it to owner/admin connections only.
|
|
func (s *Server) BroadcastCapacityAwaken(sessionID, fromState, toState, tool string) {
|
|
s.hub.broadcast(wsEvent{
|
|
Type: wsCapacityAwaken,
|
|
SessionID: sessionID,
|
|
Data: map[string]any{
|
|
"fromState": fromState,
|
|
"toState": toState,
|
|
"tool": tool,
|
|
},
|
|
})
|
|
}
|
|
|
|
// wsMoodEvent is the WS event type carrying the persona's mood after a turn
|
|
// (design/07 §3 下行 `mood`; design/01 §2 情绪状态机). The frontend's existing
|
|
// `mood` handler (ws.ts) reads data.mood and shows the 心情 badge.
|
|
const wsMoodEvent = "mood"
|
|
|
|
// BroadcastMood fans one emotion change to the owner/admin Web clients as a `mood`
|
|
// frame (design/07 §3). Persona mood/affection is private state, so the design/11
|
|
// §7.1 frame gate keeps it off viewer connections. It is called only when the mood
|
|
// actually changed — the
|
|
// machinery in the composition root is the gate — so the badge does not flicker
|
|
// with an unchanged value on every turn. data matches what the frontend `mood`
|
|
// handler reads ({mood}); affection/personaId ride along as the honest extra
|
|
// detail (affection is the persona's current 好感度, personaId the persona whose
|
|
// mood moved) and are ignored by clients that do not render them. The mood is a
|
|
// persona-level value, not a per-session one, so no sessionId is attached.
|
|
func (s *Server) BroadcastMood(personaID, mood string, affection int) {
|
|
s.hub.broadcast(wsEvent{
|
|
Type: wsMoodEvent,
|
|
Data: map[string]any{
|
|
"mood": mood,
|
|
"personaId": personaID,
|
|
"affection": affection,
|
|
},
|
|
})
|
|
}
|