feat(y-log): 操作日志上报（前端直连 + 后端公开只读下发地址）

- 后端新增 y_log 公开只读配置：YLogConfig + AppConfig.y_log +
  GET /api/public/config/y-log，地址写在 config.yaml（mtime 热重载）
- 前端核心 src/core/log/：writeYLog（双门控/异步即发即忘/永不抛错/
  去ip-host/对象序列化裁剪/optResult恒0）+ 配置加载 + token1 隔离存取
- 登录(token)持久化 token1 并报登录、登出先报后清；启动预热配置
- 各 API client 成功路径埋点：敏感词/菜单/按钮/技能地址/轻应用、
  会商草稿+任务草稿+后台任务、智能体/定时任务/知识库、Word导出，
  以及问答完成钩子(ChatPage/AgentChatPage onFinish)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -90,6 +90,7 @@ The frontend (`frontend-web/`) is a React 19 + Vite SPA:
 - **Shims**: `src/shims/` provides `next/link` and `next/navigation` polyfills (original code was Next.js)
 - **Login URL params** (`LoginPage.tsx`, frontend-only — the backend never sees these): besides the auth params (`ticket`/`userId`/`env`/`theme`/`yUserId`/`token`/`access_token`/`authToken`/`password`), the page supports a **task deep-link** via `?taskId=&goPath=`. After login it calls the consumer API `GET {VITE_AIPI_CONSUMER_URL}/taskAnalyseSearch/cop-task-detail?taskId=` (header `Authorization: Bearer admin`, auto-injected by `utils/request.ts`), stashes the full `data` (`id/overview/taskDirection/taskName/taskContent`) into `sessionStorage["login.copTaskDetail"]`, then routes by `goPath`: base codes `3qfx`/`rwfx`/`xdfx` → that business's configured **single agent** Q&A inside a **任务工作区** (resolved via `/api/business-mapping`; `resolveTaskDeeplinkTarget` calls `persistTaskContext({taskId, agentId, openingText})` and navigates to the `…/chats` **index**, which opens the latest task conversation or 新建 — a 1:N task↔对话 workspace, NOT `pendingAgentMessage`); the `-A` suffix (`3qfx-A`/…) → **multi-agent roundtable** with `roundtablePrefill.businessCode` so the page auto-selects the configured 业务链条. **xdfx's deep-link `?taskId=` is actually an 行动id, not a 任务id** — `resolveDeeplinkTaskId(goPath, rawId)` (called in `LoginPage` before everything) detects `xdfx`/`xdfx-A` and resolves it via `GET {action_detail_url}/{actionId}` → `data.taskId` (`fetchTaskIdFromAction`; `action_test`+`mock.action_detail` for offline testing); the resolved 任务id then drives `cop-task-detail`, the purpose tree, and the 1:N binding (other businesses pass the id through unchanged). **xdfx additionally partitions its chat records by 行动id (action_id), NOT by task_id**: `resolveTaskDeeplinkTarget` sets `partitionByAction:true` + keeps the raw action_id as `TaskContext.actionId`, so new threads are tagged `metadata.{taskId,actionId}` (taskId kept only to preserve the backend「任务深链对话全局共享」semantics, which keys off `metadata.taskId`) and the conversation list filters by `actionId` (+`agent_id`) — different actions of the same task get separate lists. xdfx's first-question opening text also appends `行动id（action_id）为…` (see `buildOpeningText` / `taskThreadMetadata`). goPath→businessCode: `3qfx`→`3Q`, `rwfx`→`6BF`, `xdfx`→`7BF`. The roundtable target also threads the URL `taskId` into `roundtablePrefill.taskId` (`resolveTaskDeeplinkTarget(goPath, detail, taskId)`), which turns on two taskId-scoped behaviors: (1) **separate, unpartitioned per-task storage** — taskId 会商聊天记录 live in their **own** store/table (`roundtable_task_drafts`), keyed **only by `task_id`** (one taskId = many records, shared across users, **no user 分权** at all; `created_by` is audit-only), kept entirely out of the per-user personal store (`roundtable_drafts`, now strictly per-user) so the two never mix. Backend router `/api/roundtable-task-drafts` (`GET /by-task/{id}` + `/by-task/{id}/latest`, `POST`, `GET/PUT/DELETE /{id}` — all user-agnostic); frontend client `roundtable-planning/api/task-drafts.ts`, and `useDraftPersistence`/`useRoundtableDrafts` route **all** CRUD to it when a `taskId` is present (else the personal `drafts.ts`). The matching **background jobs** are shared by task too: `roundtable_jobs.task_id` marks a task job; reads/dedup/stream/resume/cancel pass `?task_id=` so any user opening the task sees the same running 研讨 (progress/flowchart), and the executor writes the final report back to the task-draft store. Existing rows are moved over by `scripts/migrate_roundtable_task_drafts.py` (migration `20260618_01`). The history dropdown filters to the task and 新建 keeps the binding; (2) **Step-3 auto structured output** — after the `roundtable-summary` agent writes the Markdown report it automatically runs a second round emitting a `flow-json` flowchart (`useStep3Summary` `autoFlow`+`chainLevels`), whose hierarchy follows the business chain's stage goals (任务 → 目的 → 行为体 → …; coordinatorPrompt-specified hierarchy wins) and whose nodes never carry 阶段编号/阶段名 (the prior bug). **Both targets render embedded under the 任务管理 layout** — nested routes under `task-management/<business-path>/{roundtable,agent/:agent_id/chats}` in `StrategyRoutes.tsx` (`<business-path>` = `plan-task-sentiment` / `plan-task/plan-task-fx` / `plan-task/plan-task-action`, matching the COH中任务 menu paths in `sidebar-menu.ts`) so the global sidebar keeps 任务管理 → COH中任务 → the matching business highlighted. **All three single-agent businesses share `TaskFxWorkspace`** (`task-components/TaskFxWorkspace.tsx`): left = a「当前任务」card (`readCopTaskDetail()` 任务名称 + 简介, desensitized, 留存 above 新建对话) + per-task 1:N conversation list (`useTaskThreads(taskId, agentId, actionId?)` — filtered by **both** `metadata.taskId` AND `metadata.agent_id` so the three businesses' conversations staLine truncated
 - **iframe 嵌入模式 (外部系统用 iframe 套用深链问答/会商)** — 三个**按标签页**开关，全部由深链 URL 参数开启、存进同一份 `sessionStorage` 会话（`embed.session`，键名常量在 `core/embed/embed-session.ts`），跨登录跳转/刷新/页内导航存活，**绝不跨标签污染**同浏览器另开的正常系统页。核心隔离手法：用 `sessionStorage`（按标签页/浏览上下文隔离，iframe 即便同源也有独立一份）而非 `localStorage`（跨标签共享）。开关：(1) **`?embed=1`（可带 `&theme=`）** — 去全局 chrome（`PageLayout` 的 `pageSidebarAllowed && !isEmbedActive()` → 隐藏 Header + PageSidebar）+ 按外部主题色**强制**明/暗：走 next-themes 的 `forcedTheme`（`App.tsx` `AppProviders` 调 `resolveForcedEmbedTheme`，**不写** localStorage `strategy-theme`），离散映射 `dark-blue`/`dark`→深、其余→浅；嵌入侧**绝不**调 `setTheme`/`persistSidebarEnabled`（那俩落 localStorage 跨标签污染，`LoginPage` 据 `readEmbedParam` 跳过）。(2) **`?hideJump=1`** — 隐藏深链底部「快捷跳转」栏 `TaskJumpBar` 的两部分（底部「下一步」等按钮 + 右侧垂直居中悬浮菜单），单智能体问答 + 会商共用该栏，`isJumpBarHidden()` 为真时整条 `return null`。(3) **登录用户隔离** — 嵌入态下鉴权/身份键（`deerflow.auth` token、`userInfo`、`login.*`、`tools_token`、maxkey/userDetail token）全部经 `core/auth/scoped-storage.ts` 的 `authStorage()`（嵌入→sessionStorage / 正常→localStorage）读写，使 iframe 里登录的用户与正常登录用户**完全隔离**、互不覆盖；所有 token 读取都过 `getStoredAuth()`/`getAuthorizationHeaderValue()`（API 客户端 `core/api/*` 全走这俩），改中心函数即让全体调用方自动隔离；跨标签账号变更监听 `AuthSyncWatcher`（`core/auth/sync.tsx`）在嵌入态禁用。嵌入会话在 `main.tsx` 渲染前 `syncEmbedSessionFromCurrentUrl()` 同步启用（早于任何鉴权写入，避免首帧 effect 顺序漏写 localStorage）；`AppProviders` 的 effect 再按 SPA 导航同步。`embed=0`/`hideJump=0` 可显式关闭。正常（非嵌入）标签页所有 `isXxx()` 恒 false，行为**零变化**。
+- **操作日志（Y-Log）上报** — 用户的关键操作（登录登出/查询/查看/增删改/启停/导入导出/问答等）成功后，**前端直连**外部接口 `POST {write_url}`（默认 `https://ch1.b.uat.4.cn/api/y-log/write`）记一条审计日志。核心模块 `src/core/log/`：`y-log.ts`（`writeYLog(params)` + `OptType` 枚举 0/1/3..12；**异步即发即忘、永不 await、永不抛错、失败静默**，自动把完整 url 转相对路径去 ip/host、对象入参/返回自动 `JSON.stringify` + 50k 裁剪、`optResult` 恒 0 只报成功），`y-log-config.ts`（从公开只读 `GET /api/public/config/y-log` 拉 `{enabled, writeUrl}`，模块级缓存 + 去重 + 默认兜底；`App.tsx` `AppProviders` 启动预热 `fetchYLogConfig()`），`y-log-token.ts`（token1 = token 登录的 `?authToken=`，经 [[scoped-storage]] 的 `authStorage*` 存取，嵌入态自动隔离）。**双门控**：仅当①存在 token1（即用 token 登录，`LoginPage` 成功后 `persistYLogToken(authToken)`，登出 `account-settings-page.tsx` 先报后清 token1）且②配置 `enabled && writeUrl` 才上报；否则一律不发。`optDetail` 统一「B1-CM助手-…」（**禁内部框架名**）。埋点集中在各 API client 的成功路径：`strategy-components/api/{sensitive-words,menu-overrides,task-buttons,skill-addresses,light-apps}.ts`、`roundtable-planning/api/{drafts,task-drafts,roundtable-jobs}.ts`、`core/{agents,scheduled-tasks,knowledge}/api.ts`、`core/api/markdown-docx-export.ts`，以及问答完成钩子（`ChatPage`/`AgentChatPage` 的 `useThreadStream` `onFinish`，用最终汇总文本作 `returnParam`，optType 12）。后端仅新增公开只读配置：`deerflow/config/y_log_config.py`（`YLogConfig{enabled,write_url}`）挂到 `AppConfig.y_log`，`app/gateway/routers/public_config.py` 加 `GET /api/public/config/y-log`，地址写在 `config.yaml` 的 `y_log` 段（mtime 热重载，前端无需重建）；**不做后端代理**。Tests：`tests/test_y_log_config.py`。
 
 ### Configuration
 

frontend-web/src/App.tsx

@@ -7,6 +7,7 @@ import { FontScaleApplier } from "@/components/font-scale";
 import { QueryClientProvider } from "@/components/query-client-provider";
 import { AuthSyncWatcher } from "@/core/auth/sync";
 import { I18nProvider } from "@/core/i18n/context";
+import { fetchYLogConfig } from "@/core/log/y-log-config";
 import { detectLocale } from "@/core/i18n/locale";
 import { resolveForcedThemeForPath } from "@/core/page-layout/chats-iframe-route";
 import { ChatProvider } from "@/contexts/ChatContext";
@@ -50,6 +51,11 @@ function AppProviders({ children }: { children: React.ReactNode }) {
   useEffect(() => {
     syncEmbedSessionFromSearch(location.search);
   }, [location.search]);
+  // 操作日志(Y-Log)：启动早期预热上报配置，使 writeYLog 同步读缓存即可工作
+  // （刷新后 module 缓存清空，token 登录用户也能继续上报）。失败静默。
+  useEffect(() => {
+    void fetchYLogConfig();
+  }, []);
   const forcedTheme = useMemo(() => {
     // iframe 嵌入模式（外部系统 `&embed=1`）最高优先：按本标签页的嵌入主题强制明/暗。
     // 走 next-themes forcedTheme（不写 localStorage）→ 同浏览器另开的正常系统页不受影响。

frontend-web/src/components/workspace/settings/account-settings-page.tsx

@@ -7,6 +7,8 @@ import { toast } from "sonner";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { clearStoredAuth, getAccountDisplayName, getStoredAuth } from "@/core/auth";
+import { OptType, writeYLog } from "@/core/log/y-log";
+import { clearYLogToken } from "@/core/log/y-log-token";
 
 import { SettingsSection } from "./settings-section";
 
@@ -40,7 +42,15 @@ export function AccountSettingsPage() {
   const displayName = getAccountDisplayName(auth);
 
   const handleLogout = () => {
+    // 操作日志(Y-Log)：在清除 token1 之前上报登出（此时 token1 还在），keepalive 保证发出。
+    writeYLog({
+      optType: OptType.logout,
+      optDetail: "B1-CM助手-登出",
+      url: "/api/v1/auth/logout",
+      keepalive: true,
+    });
     clearStoredAuth();
+    clearYLogToken();
     // Match the rest of the app's logout flow: blow away the cookie session
     // by hitting the gateway logout endpoint and then forcing a full reload
     // so any cached query state goes too.

frontend-web/src/core/agents/api.ts

@@ -1,5 +1,6 @@
 import { getBackendBaseURL } from "@/core/config";
 import { apiFetch } from "@/core/api";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 import type {
   Agent,
@@ -58,6 +59,13 @@ export async function listAgents(params: ListAgentsParams = {}): Promise<Agent[]
   );
   if (!res.ok) throw new Error(`Failed to load agents: ${res.statusText}`);
   const data = (await res.json()) as { agents: Agent[] };
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-智能体列表",
+    url: `/api/agents${query ? `?${query}` : ""}`,
+    reqParam: params,
+    returnParam: data.agents,
+  });
   return data.agents;
 }
 
@@ -76,12 +84,20 @@ export async function listAgentsPaginated(
     page?: number;
     page_size?: number;
   };
-  return {
+  const result: PaginatedAgents = {
     agents: data.agents,
     total: data.total ?? data.agents.length,
     page: data.page ?? params.page ?? 1,
     pageSize: data.page_size ?? params.pageSize ?? data.agents.length,
   };
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-智能体列表",
+    url: `/api/agents${query ? `?${query}` : ""}`,
+    reqParam: params,
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function listAllAgentsAdmin(): Promise<Agent[]> {
@@ -91,6 +107,12 @@ export async function listAllAgentsAdmin(): Promise<Agent[]> {
     throw new Error(err.detail ?? `Failed to load agents: ${res.statusText}`);
   }
   const data = (await res.json()) as { agents: Agent[] };
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-智能体列表",
+    url: `/api/agents?admin=true`,
+    returnParam: data.agents,
+  });
   return data.agents;
 }
 
@@ -110,7 +132,15 @@ export async function createAgent(request: CreateAgentRequest): Promise<Agent> {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to create agent: ${res.statusText}`);
   }
-  return res.json() as Promise<Agent>;
+  const created = (await res.json()) as Agent;
+  writeYLog({
+    optType: OptType.create,
+    optDetail: "B1-CM助手-智能体-新建",
+    url: `/api/agents`,
+    reqParam: request,
+    returnParam: created,
+  });
+  return created;
 }
 
 export async function updateAgent(
@@ -126,7 +156,15 @@ export async function updateAgent(
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to update agent: ${res.statusText}`);
   }
-  return res.json() as Promise<Agent>;
+  const updated = (await res.json()) as Agent;
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-修改",
+    url: `/api/agents/${id}`,
+    reqParam: { id, ...request },
+    returnParam: updated,
+  });
+  return updated;
 }
 
 export async function deleteAgent(id: string): Promise<void> {
@@ -134,6 +172,12 @@ export async function deleteAgent(id: string): Promise<void> {
     method: "DELETE",
   });
   if (!res.ok) throw new Error(`Failed to delete agent: ${res.statusText}`);
+  writeYLog({
+    optType: OptType.delete,
+    optDetail: "B1-CM助手-智能体-删除",
+    url: `/api/agents/${id}`,
+    reqParam: { id },
+  });
 }
 
 export async function getAgentSelector(): Promise<AgentSelectorResponse> {
@@ -150,6 +194,12 @@ export async function favoriteAgent(id: string): Promise<void> {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to favorite agent: ${res.statusText}`);
   }
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-收藏",
+    url: `/api/agents/${id}/favorite`,
+    reqParam: { id },
+  });
 }
 
 export async function unfavoriteAgent(id: string): Promise<void> {
@@ -160,6 +210,12 @@ export async function unfavoriteAgent(id: string): Promise<void> {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to unfavorite agent: ${res.statusText}`);
   }
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-取消收藏",
+    url: `/api/agents/${id}/favorite`,
+    reqParam: { id },
+  });
 }
 
 export async function pinAgent(id: string): Promise<void> {
@@ -170,6 +226,12 @@ export async function pinAgent(id: string): Promise<void> {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to pin agent: ${res.statusText}`);
   }
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-置顶",
+    url: `/api/agents/${id}/pin`,
+    reqParam: { id },
+  });
 }
 
 export async function unpinAgent(id: string): Promise<void> {
@@ -180,6 +242,12 @@ export async function unpinAgent(id: string): Promise<void> {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to unpin agent: ${res.statusText}`);
   }
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-取消置顶",
+    url: `/api/agents/${id}/pin`,
+    reqParam: { id },
+  });
 }
 
 export async function reorderFeaturedAgents(agentIds: string[]): Promise<void> {
@@ -197,6 +265,12 @@ export async function reorderFeaturedAgents(agentIds: string[]): Promise<void> {
       err.detail ?? `Failed to reorder featured agents: ${res.statusText}`,
     );
   }
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-精选排序",
+    url: `/api/agents/featured/order`,
+    reqParam: { agent_ids: agentIds },
+  });
 }
 
 export async function listPrivateAgents(password: string): Promise<Agent[]> {
@@ -215,6 +289,12 @@ export async function listPrivateAgents(password: string): Promise<Agent[]> {
     );
   }
   const data = (await res.json()) as { agents: Agent[] };
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-私有广场智能体列表",
+    url: `/api/agents/private-square/list`,
+    returnParam: data.agents,
+  });
   return data.agents;
 }
 
@@ -261,12 +341,20 @@ export async function listPrivateAgentsPaginated(
     page?: number;
     page_size?: number;
   };
-  return {
+  const result: PaginatedAgents = {
     agents: data.agents,
     total: data.total ?? data.agents.length,
     page: data.page ?? params.page ?? 1,
     pageSize: data.page_size ?? params.pageSize ?? data.agents.length,
   };
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-私有广场智能体列表",
+    url: `/api/agents/private-square/list`,
+    reqParam: { ...params, password: undefined },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function setAgentPrivate(
@@ -287,7 +375,15 @@ export async function setAgentPrivate(
       err.detail ?? `Failed to update agent privacy: ${res.statusText}`,
     );
   }
-  return res.json() as Promise<Agent>;
+  const updated = (await res.json()) as Agent;
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-设置私有",
+    url: `/api/agents/${id}/private`,
+    reqParam: { id, is_private: isPrivate },
+    returnParam: updated,
+  });
+  return updated;
 }
 
 export async function setAgentFeatured(
@@ -308,7 +404,15 @@ export async function setAgentFeatured(
       err.detail ?? `Failed to set featured: ${res.statusText}`,
     );
   }
-  return res.json() as Promise<Agent>;
+  const updated = (await res.json()) as Agent;
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-设置精选",
+    url: `/api/agents/${id}/featured`,
+    reqParam: { id, order },
+    returnParam: updated,
+  });
+  return updated;
 }
 
 export interface AgentSkillsSyncRemoval {
@@ -333,7 +437,14 @@ export async function adminSyncAgentSkills(): Promise<AgentSkillsSyncResult> {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `Failed to sync agent skills: ${res.statusText}`);
   }
-  return res.json() as Promise<AgentSkillsSyncResult>;
+  const result = (await res.json()) as AgentSkillsSyncResult;
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-智能体-同步技能",
+    url: `/api/agents/admin/sync-skills`,
+    returnParam: result,
+  });
+  return result;
 }
 
 export interface KnowledgeIngestAttempt {
@@ -371,7 +482,15 @@ export async function publishArtifactToKnowledge(request: {
     const err = (await res.json().catch(() => ({}))) as { detail?: string };
     throw new Error(err.detail ?? `发布入库失败: ${res.statusText}`);
   }
-  return res.json() as Promise<KnowledgeIngestPublishResult>;
+  const result = (await res.json()) as KnowledgeIngestPublishResult;
+  writeYLog({
+    optType: OptType.export,
+    optDetail: "B1-CM助手-智能体-产物发布入库",
+    url: `/api/knowledge-ingest/publish`,
+    reqParam: request,
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function checkAgentName(

frontend-web/src/core/api/markdown-docx-export.ts

@@ -1,5 +1,6 @@
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 import { downloadMarkdownAsDocx } from "@/core/scheduled-tasks/markdown-docx";
 
 function filenameFromContentDisposition(header: string | null): string | null {
@@ -79,13 +80,31 @@ export async function downloadMarkdownDocxFromBackend(options: {
 
     if (response.status === 404) {
       await downloadMarkdownAsDocx(markdown, options.title?.trim() || "document", options.title);
+      writeYLog({
+        optType: OptType.export,
+        optDetail: "B1-CM助手-导出-Word",
+        url: `${getBackendBaseURL()}/api/writing/export/docx`,
+        reqParam: { title: options.title?.trim() || undefined },
+      });
       return;
     }
 
     await downloadBlobResponse(response, fallbackFilename);
+    writeYLog({
+      optType: OptType.export,
+      optDetail: "B1-CM助手-导出-Word",
+      url: `${getBackendBaseURL()}/api/writing/export/docx`,
+      reqParam: { title: options.title?.trim() || undefined },
+    });
   } catch (err) {
     if (err instanceof TypeError) {
       await downloadMarkdownAsDocx(markdown, options.title?.trim() || "document", options.title);
+      writeYLog({
+        optType: OptType.export,
+        optDetail: "B1-CM助手-导出-Word",
+        url: `${getBackendBaseURL()}/api/writing/export/docx`,
+        reqParam: { title: options.title?.trim() || undefined },
+      });
       return;
     }
     throw err;

frontend-web/src/core/knowledge/api.ts

@@ -1,5 +1,6 @@
 import { apiFetch } from "@/core/api";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 import type {
   BatchIngestPayload,
@@ -41,9 +42,17 @@ export async function listKnowledgeNotes(params: KnowledgeListParams = {}) {
   if (params.folder !== undefined) qs.set("folder", params.folder);
   qs.set("limit", String(params.limit ?? 20));
   qs.set("offset", String(params.offset ?? 0));
-  return parseResponse<KnowledgeListResponse>(
+  const result = await parseResponse<KnowledgeListResponse>(
     await apiFetch(`${baseUrl()}/notes?${qs.toString()}`),
   );
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-知识库-检索",
+    url: `${baseUrl()}/notes?${qs.toString()}`,
+    reqParam: params,
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function getKnowledgeNote(noteId: string) {
@@ -67,6 +76,13 @@ export async function createKnowledgeNote(data: {
       body: JSON.stringify(data),
     }),
   );
+  writeYLog({
+    optType: OptType.create,
+    optDetail: "B1-CM助手-知识库-新建",
+    url: `${baseUrl()}/notes`,
+    reqParam: data,
+    returnParam: res.note,
+  });
   return res.note;
 }
 
@@ -81,22 +97,38 @@ export async function updateKnowledgeNote(
     folder: string | null;
   }>,
 ) {
-  return parseResponse<KnowledgeNote>(
+  const result = await parseResponse<KnowledgeNote>(
     await apiFetch(`${baseUrl()}/notes/${encodeURIComponent(noteId)}`, {
       method: "PUT",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(data),
     }),
   );
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-知识库-修改",
+    url: `${baseUrl()}/notes/${encodeURIComponent(noteId)}`,
+    reqParam: { noteId, data },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function deleteKnowledgeNote(noteId: string, hard = false) {
-  return parseResponse<{ ok: boolean; note_id: string }>(
+  const result = await parseResponse<{ ok: boolean; note_id: string }>(
     await apiFetch(
       `${baseUrl()}/notes/${encodeURIComponent(noteId)}${hard ? "?hard=true" : ""}`,
       { method: "DELETE" },
     ),
   );
+  writeYLog({
+    optType: OptType.delete,
+    optDetail: "B1-CM助手-知识库-删除",
+    url: `${baseUrl()}/notes/${encodeURIComponent(noteId)}${hard ? "?hard=true" : ""}`,
+    reqParam: { noteId, hard },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function searchKnowledge(query: string, limit = 8) {
@@ -107,11 +139,18 @@ export async function searchKnowledge(query: string, limit = 8) {
       body: JSON.stringify({ query, mode: "keyword", limit }),
     }),
   );
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-知识库-检索",
+    url: `${baseUrl()}/search`,
+    reqParam: { query, mode: "keyword", limit },
+    returnParam: res.items,
+  });
   return res.items;
 }
 
 export async function ingestThread(threadId: string, payload: IngestThreadPayload = {}) {
-  return parseResponse<{
+  const result = await parseResponse<{
     note?: KnowledgeNote;
     created?: boolean;
     queued?: boolean;
@@ -122,16 +161,32 @@ export async function ingestThread(threadId: string, payload: IngestThreadPayloa
       body: JSON.stringify(payload),
     }),
   );
+  writeYLog({
+    optType: OptType.import,
+    optDetail: "B1-CM助手-知识库-导入",
+    url: `${baseUrl()}/ingest/thread/${encodeURIComponent(threadId)}`,
+    reqParam: { threadId, payload },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function ingestThreadsBatch(payload: BatchIngestPayload = {}) {
-  return parseResponse<BatchIngestResult>(
+  const result = await parseResponse<BatchIngestResult>(
     await apiFetch(`${baseUrl()}/ingest/threads/batch`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload),
     }),
   );
+  writeYLog({
+    optType: OptType.import,
+    optDetail: "B1-CM助手-知识库-导入",
+    url: `${baseUrl()}/ingest/threads/batch`,
+    reqParam: payload,
+    returnParam: result,
+  });
+  return result;
 }
 
 export interface IngestFileResult {
@@ -162,9 +217,17 @@ export async function ingestKnowledgeFile(
   if (opts.template_id) form.append("template_id", opts.template_id);
   if (opts.folder) form.append("folder", opts.folder);
   // No Content-Type header — the browser sets the multipart boundary itself.
-  return parseResponse<IngestFileResult>(
+  const result = await parseResponse<IngestFileResult>(
     await apiFetch(`${baseUrl()}/ingest/file`, { method: "POST", body: form }),
   );
+  writeYLog({
+    optType: OptType.import,
+    optDetail: "B1-CM助手-知识库-导入",
+    url: `${baseUrl()}/ingest/file`,
+    reqParam: { fileName: file.name, ...opts },
+    returnParam: result,
+  });
+  return result;
 }
 
 /** Resolve `[[wikilink]]` targets to note ids / vault pages. */
@@ -197,9 +260,16 @@ export async function fetchVaultPage(path: string) {
 }
 
 export async function exportKnowledgeGraph() {
-  return parseResponse<GraphExportResult>(
+  const result = await parseResponse<GraphExportResult>(
     await apiFetch(`${baseUrl()}/export/graph`, { method: "POST" }),
   );
+  writeYLog({
+    optType: OptType.export,
+    optDetail: "B1-CM助手-知识库-导出",
+    url: `${baseUrl()}/export/graph`,
+    returnParam: result,
+  });
+  return result;
 }
 
 /** Absolute URL of a served wiki-export file (for iframe / download). */

frontend-web/src/core/log/y-log-config.ts

@@ -0,0 +1,68 @@
+/**
+ * 操作日志（Y-Log）上报的运行时配置：从后端公开只读接口
+ * ``GET /api/public/config/y-log`` 读取（地址 + 开关在后端 ``config.yaml`` 的
+ * ``y_log`` 段，改完即时生效，前端无需重建）。
+ *
+ * 仿 [[task-deeplink-config]]：
+ *   - ``fetchYLogConfig()`` 拉取并模块级缓存（启动早期预热一次即可）。
+ *   - ``getCachedYLogConfig()`` 同步读缓存（``writeYLog`` 即发即忘，必须同步可用）。
+ *
+ * 拉取失败 → 用内置默认值兜底（``enabled:false``，但保留默认地址），绝不抛错。
+ */
+
+import { apiFetch } from "@/core/api/fetch-client";
+import { getBackendBaseURL } from "@/core/config";
+
+export interface YLogConfig {
+  /** 是否启用上报。 */
+  enabled: boolean;
+  /** 上报外部接口完整地址（POST）。 */
+  writeUrl: string;
+}
+
+/** 内置默认地址（后端拿不到 / 未配置时的兜底地址；enabled 默认 false 不上报）。 */
+const DEFAULT_WRITE_URL = "https://ch1.b.uat.4.cn/api/y-log/write";
+
+/** 内置默认配置（拉取失败兜底；默认不上报）。 */
+export const DEFAULT_Y_LOG_CONFIG: YLogConfig = {
+  enabled: false,
+  writeUrl: DEFAULT_WRITE_URL,
+};
+
+/** 后端 snake_case 响应 → 前端 camelCase；缺字段回退默认值。 */
+function normalize(body: unknown): YLogConfig {
+  const o = body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  const writeUrl =
+    typeof o.write_url === "string" && o.write_url.trim() ? o.write_url.trim() : DEFAULT_WRITE_URL;
+  return {
+    enabled: o.enabled === true,
+    writeUrl,
+  };
+}
+
+let cached: YLogConfig | null = null;
+let inflight: Promise<YLogConfig> | null = null;
+
+/** 拉取（带模块级缓存 + 并发去重）；失败回退默认值。 */
+export async function fetchYLogConfig(): Promise<YLogConfig> {
+  if (cached) return cached;
+  if (inflight) return inflight;
+  inflight = (async () => {
+    try {
+      const res = await apiFetch(`${getBackendBaseURL()}/api/public/config/y-log`);
+      if (!res.ok) throw new Error(`y-log config ${res.status}`);
+      cached = normalize(await res.json());
+    } catch {
+      cached = { ...DEFAULT_Y_LOG_CONFIG };
+    } finally {
+      inflight = null;
+    }
+    return cached;
+  })();
+  return inflight;
+}
+
+/** 同步读缓存（未拉取过则返回默认值，默认 enabled:false 不上报）。 */
+export function getCachedYLogConfig(): YLogConfig {
+  return cached ?? DEFAULT_Y_LOG_CONFIG;
+}

frontend-web/src/core/log/y-log-token.ts

@@ -0,0 +1,34 @@
+/**
+ * token1（token 登录用的上游 token，即 URL 参数 ``?authToken=``）的存取。
+ *
+ * 复用 [[scoped-storage]] 的 ``authStorage*``：嵌入(iframe)态自动落 sessionStorage、
+ * 正常态落 localStorage，使 iframe 里登录的用户 token1 与正常标签页**完全隔离**、
+ * 互不污染（与其它鉴权键同一隔离语义）。
+ *
+ * 只有用 token 登录（存在 token1）才上报操作日志；非 token 登录不写 token1，
+ * 该会话从此不上报（见 [[y-log]]）。
+ */
+
+import {
+  authStorageGet,
+  authStorageRemove,
+  authStorageSet,
+} from "@/core/auth/scoped-storage";
+
+const Y_LOG_TOKEN_KEY = "ylog.token1";
+
+/** 持久化 token1（token 登录成功后调用；空值忽略）。 */
+export function persistYLogToken(token: string | null | undefined): void {
+  const t = token?.trim();
+  if (t) authStorageSet(Y_LOG_TOKEN_KEY, t);
+}
+
+/** 读 token1（无则返回 null → 不上报）。 */
+export function readYLogToken(): string | null {
+  return authStorageGet(Y_LOG_TOKEN_KEY);
+}
+
+/** 清除 token1（登出时调用）。 */
+export function clearYLogToken(): void {
+  authStorageRemove(Y_LOG_TOKEN_KEY);
+}

frontend-web/src/core/log/y-log.ts

@@ -0,0 +1,109 @@
+/**
+ * 操作日志（Y-Log）上报主函数。
+ *
+ * 把用户的关键操作（点击/查询/查看/增删改/启停/导入导出/登录登出/问答等）上报到
+ * 外部日志接口（见 [[y-log-config]] 的 ``writeUrl``）。**前端直连**该接口，不经后端代理。
+ *
+ * 硬性约束（务必满足）：
+ *   ① **token 门控**：无 token1（非 token 登录）→ 直接 return，不发请求。
+ *   ② **配置门控**：``enabled=false`` 或 ``writeUrl`` 为空 → 不发请求。
+ *   ③ **异步即发即忘**：``void fetch(...)`` 不被 ``await``，绝不阻塞业务/UI。
+ *   ④ **永不抛错**：整体包在 ``try/catch`` 中，任何异常（取 token/读配置/序列化/网络）静默吞掉。
+ *   ⑤ **只报成功**：埋点只放在操作成功路径，``optResult`` 恒为 ``0``。
+ *   ⑥ **失败静默**：``fetch`` 的 ``.catch`` 吞掉网络/跨域失败。
+ */
+
+import { getCachedYLogConfig } from "@/core/log/y-log-config";
+import { readYLogToken } from "@/core/log/y-log-token";
+
+/** 操作类型，数值与外部系统约定一致，不可改。 */
+export enum OptType {
+  login = 0,
+  logout = 1,
+  search = 3,
+  view = 4,
+  edit = 5,
+  delete = 6,
+  import = 7,
+  export = 8,
+  create = 9,
+  disabled = 10,
+  enabled = 11,
+  other = 12,
+}
+
+export interface WriteYLogParams {
+  /** 操作类型枚举。 */
+  optType: OptType;
+  /** 操作详情（简短描述），统一「B1-CM助手-xxx」。 */
+  optDetail: string;
+  /** 操作命中的接口地址（完整或相对，内部自动转相对，去 ip/host）。 */
+  url: string;
+  /** 入参（对象自动 JSON 序列化）。 */
+  reqParam?: unknown;
+  /** 返回参数（对象自动 JSON 序列化）。 */
+  returnParam?: unknown;
+  /** 登出 / 页面卸载等场景置 true，保证请求在卸载时仍能发出。 */
+  keepalive?: boolean;
+}
+
+/** 入参/返回体积上限，超出裁剪。 */
+const MAX_PARAM_LEN = 50_000;
+
+/** 上报一条操作日志（异步即发即忘，永不抛错）。 */
+export function writeYLog(params: WriteYLogParams): void {
+  try {
+    const token = readYLogToken();
+    if (!token) return; // ① 无 token1 不上报
+    const { enabled, writeUrl } = getCachedYLogConfig();
+    if (!enabled || !writeUrl) return; // ② 配置门控
+    if (typeof fetch === "undefined") return;
+
+    const body = {
+      optType: params.optType,
+      optDetail: params.optDetail ?? "",
+      url: toRelativeUrl(params.url ?? ""), // ③ 去 ip/host
+      reqParam: toParamString(params.reqParam), // ④ 对象→字符串+裁剪
+      returnParam: toParamString(params.returnParam),
+      optResult: 0, // ⑤ 恒为 0（只报成功）
+    };
+
+    void fetch(writeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify(body),
+      keepalive: params.keepalive ?? false,
+    }).catch(() => undefined); // ⑥ 失败静默
+  } catch {
+    /* 绝不影响业务 */
+  }
+}
+
+function toParamString(v: unknown): string {
+  if (v == null) return "";
+  const s = typeof v === "string" ? v : safeStringify(v);
+  return s.length > MAX_PARAM_LEN ? `${s.slice(0, MAX_PARAM_LEN)}…[truncated]` : s;
+}
+
+function safeStringify(v: unknown): string {
+  try {
+    return JSON.stringify(v) ?? "";
+  } catch {
+    return String(v);
+  }
+}
+
+/** 去掉 ip/host，只留 path + query。 */
+function toRelativeUrl(url: string): string {
+  if (!url) return "";
+  try {
+    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+    const u = new URL(url, base);
+    return `${u.pathname}${u.search}`;
+  } catch {
+    return url;
+  }
+}

frontend-web/src/core/scheduled-tasks/api.ts

@@ -1,5 +1,6 @@
 import { apiFetch } from "@/core/api";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 import type {
   HtmlPageFavorite,
@@ -42,9 +43,17 @@ export async function listScheduledTasks(params: ListScheduledTasksParams = {})
   if (params.search) qs.set("search", params.search);
   for (const id of params.tagIds ?? []) qs.append("tag_ids", id);
   const query = qs.toString();
-  return parseResponse<ScheduledTask[]>(
+  const result = await parseResponse<ScheduledTask[]>(
     await apiFetch(`${baseUrl()}${query ? `?${query}` : ""}`),
   );
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-定时任务-列表",
+    url: `${baseUrl()}${query ? `?${query}` : ""}`,
+    reqParam: params,
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function createScheduledTask(data: {
@@ -57,13 +66,21 @@ export async function createScheduledTask(data: {
   require_markdown?: boolean;
   execution_context?: ScheduledTaskExecutionContext | null;
 }) {
-  return parseResponse<ScheduledTask>(
+  const result = await parseResponse<ScheduledTask>(
     await apiFetch(baseUrl(), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(data),
     }),
   );
+  writeYLog({
+    optType: OptType.create,
+    optDetail: "B1-CM助手-定时任务-新建",
+    url: baseUrl(),
+    reqParam: data,
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function listScheduledTaskRuns(taskId: string) {
@@ -73,9 +90,17 @@ export async function listScheduledTaskRuns(taskId: string) {
 }
 
 export async function getScheduledTaskRun(runId: string) {
-  return parseResponse<ScheduledTaskRun>(
+  const result = await parseResponse<ScheduledTaskRun>(
     await apiFetch(`${baseUrl()}/runs/${encodeURIComponent(runId)}`),
   );
+  writeYLog({
+    optType: OptType.view,
+    optDetail: "B1-CM助手-定时任务-运行详情",
+    url: `${baseUrl()}/runs/${encodeURIComponent(runId)}`,
+    reqParam: { runId },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function deleteScheduledTaskRun(runId: string) {
@@ -219,45 +244,85 @@ export async function updateScheduledTask(
     execution_context: ScheduledTaskExecutionContext | null;
   }>,
 ) {
-  return parseResponse<ScheduledTask>(
+  const result = await parseResponse<ScheduledTask>(
     await apiFetch(`${baseUrl()}/${encodeURIComponent(taskId)}`, {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(data),
     }),
   );
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-定时任务-修改",
+    url: `${baseUrl()}/${encodeURIComponent(taskId)}`,
+    reqParam: { taskId, data },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function deleteScheduledTask(taskId: string) {
-  return parseResponse<{ success: boolean }>(
+  const result = await parseResponse<{ success: boolean }>(
     await apiFetch(`${baseUrl()}/${encodeURIComponent(taskId)}`, {
       method: "DELETE",
     }),
   );
+  writeYLog({
+    optType: OptType.delete,
+    optDetail: "B1-CM助手-定时任务-删除",
+    url: `${baseUrl()}/${encodeURIComponent(taskId)}`,
+    reqParam: { taskId },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function pauseScheduledTask(taskId: string) {
-  return parseResponse<ScheduledTask>(
+  const result = await parseResponse<ScheduledTask>(
     await apiFetch(`${baseUrl()}/${encodeURIComponent(taskId)}/pause`, {
       method: "POST",
     }),
   );
+  writeYLog({
+    optType: OptType.disabled,
+    optDetail: "B1-CM助手-定时任务-暂停",
+    url: `${baseUrl()}/${encodeURIComponent(taskId)}/pause`,
+    reqParam: { taskId },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function resumeScheduledTask(taskId: string) {
-  return parseResponse<ScheduledTask>(
+  const result = await parseResponse<ScheduledTask>(
     await apiFetch(`${baseUrl()}/${encodeURIComponent(taskId)}/resume`, {
       method: "POST",
     }),
   );
+  writeYLog({
+    optType: OptType.enabled,
+    optDetail: "B1-CM助手-定时任务-恢复",
+    url: `${baseUrl()}/${encodeURIComponent(taskId)}/resume`,
+    reqParam: { taskId },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function triggerScheduledTask(taskId: string) {
-  return parseResponse<{ success: boolean; task: ScheduledTask }>(
+  const result = await parseResponse<{ success: boolean; task: ScheduledTask }>(
     await apiFetch(`${baseUrl()}/${encodeURIComponent(taskId)}/trigger`, {
       method: "POST",
     }),
   );
+  writeYLog({
+    optType: OptType.other,
+    optDetail: "B1-CM助手-定时任务-手动运行",
+    url: `${baseUrl()}/${encodeURIComponent(taskId)}/trigger`,
+    reqParam: { taskId },
+    returnParam: result,
+  });
+  return result;
 }
 
 export async function listPublishedScheduledTasks(params: { limit?: number; offset?: number } = {}) {

frontend-web/src/core/scheduled-tasks/markdown-docx.ts

@@ -42,6 +42,8 @@ import {
   type IRunOptions,
 } from "docx";
 
+import { OptType, writeYLog } from "@/core/log/y-log";
+
 const BLACK = "000000";
 const BODY_FONT = { ascii: "Calibri", eastAsia: "Microsoft YaHei" };
 const MONO_FONT = { ascii: "Consolas", eastAsia: "Microsoft YaHei" };
@@ -484,6 +486,12 @@ export async function downloadMarkdownAsDocx(
   title?: string,
 ): Promise<void> {
   const blob = await markdownToDocxBlob(markdown, title);
+  writeYLog({
+    optType: OptType.export,
+    optDetail: "B1-CM助手-定时任务-导出",
+    url: "/scheduled-tasks/export/docx",
+    reqParam: { fileName, title },
+  });
   const safeName = fileName.replace(/\.(md|markdown)$/i, "") || "document";
   const url = URL.createObjectURL(blob);
   const anchor = document.createElement("a");

frontend-web/src/pages/AgentChatPage.tsx

@@ -30,6 +30,7 @@ import { useNotification } from "@/core/notification/hooks";
 import { saveLastAgentId, useThreadSettings } from "@/core/settings";
 import { stopThreadRun, useThreadStream } from "@/core/threads/hooks";
 import { textOfMessage } from "@/core/threads/utils";
+import { OptType, writeYLog } from "@/core/log/y-log";
 import { env } from "@/env";
 import { readTaskContext, taskThreadMetadata } from "@/core/auth/task-purpose";
 import { TaskPurposePanel } from "@/strategy-components/components/task-components/TaskPurposePanel";
@@ -157,6 +158,21 @@ export default function AgentChatPage({
       );
     },
     onFinish: (state) => {
+      // 操作日志(Y-Log)：专家代理问答完成（成功）后，用最终汇总文本上报一条。
+      try {
+        const msgs = state.messages ?? [];
+        const lastAi = [...msgs].reverse().find((m) => (m as { type?: string }).type === "ai");
+        const lastHuman = [...msgs].reverse().find((m) => (m as { type?: string }).type === "human");
+        writeYLog({
+          optType: OptType.other,
+          optDetail: "B1-CM助手-专家代理问答",
+          url: `/api/threads/${threadId ?? ""}/runs/stream`,
+          reqParam: { agent_id, question: lastHuman ? textOfMessage(lastHuman) : "" },
+          returnParam: { data: lastAi ? textOfMessage(lastAi) : "" },
+        });
+      } catch {
+        /* 上报绝不影响问答 */
+      }
       if (document.hidden || !document.hasFocus()) {
         let body = "Conversation finished";
         const lastMessage = state.messages[state.messages.length - 1];

frontend-web/src/pages/ChatPage.tsx

@@ -49,6 +49,7 @@ import { useThreadStream } from "@/core/threads/hooks";
 import { useLayoutMode } from "@/core/system-settings/hooks";
 import { useRouteBase } from "@/core/route-base";
 import { textOfMessage } from "@/core/threads/utils";
+import { OptType, writeYLog } from "@/core/log/y-log";
 import { env } from "@/env";
 import { cn } from "@/lib/utils";
 
@@ -183,6 +184,21 @@ export default function ChatPage() {
       );
     },
     onFinish: (state) => {
+      // 操作日志(Y-Log)：问答完成（成功）后，用最终汇总文本上报一条。
+      try {
+        const msgs = state.messages ?? [];
+        const lastAi = [...msgs].reverse().find((m) => (m as { type?: string }).type === "ai");
+        const lastHuman = [...msgs].reverse().find((m) => (m as { type?: string }).type === "human");
+        writeYLog({
+          optType: OptType.other,
+          optDetail: "B1-CM助手-专家代理问答",
+          url: `/api/threads/${threadId ?? ""}/runs/stream`,
+          reqParam: { agent_id: selectedAgentId, question: lastHuman ? textOfMessage(lastHuman) : "" },
+          returnParam: { data: lastAi ? textOfMessage(lastAi) : "" },
+        });
+      } catch {
+        /* 上报绝不影响问答 */
+      }
       if (document.hidden || !document.hasFocus()) {
         let body = "Conversation finished";
         const lastMessage = state.messages.at(-1);

frontend-web/src/pages/LoginPage.tsx

@@ -31,6 +31,9 @@ import {
   isSidebarEnabledFromSearch,
   persistSidebarEnabled,
 } from '@/core/page-layout/sidebar-enabled';
+import { fetchYLogConfig } from '@/core/log/y-log-config';
+import { persistYLogToken } from '@/core/log/y-log-token';
+import { OptType, writeYLog } from '@/core/log/y-log';
 
 const DEFAULT_USERNAME = 'guest';
 const IFRAME_LOGIN_SOURCE = 'iframe';
@@ -160,6 +163,19 @@ export default function LoginPage() {
           return;
         }
         setStoredAuth(auth);
+        // 操作日志(Y-Log)：只有 token 登录（存在 token1=authToken）才上报。
+        // 持久化 token1（走 authStorage，嵌入态自动隔离）+ 预热上报配置 + 上报登录。
+        if (authToken) {
+          persistYLogToken(authToken);
+          void fetchYLogConfig();
+          writeYLog({
+            optType: OptType.login,
+            optDetail: 'B1-CM助手-登录',
+            url: '/api/v1/auth/login/token',
+            reqParam: { username: loginUserName || auth.user_id },
+            returnParam: { user_id: auth.user_id },
+          });
+        }
         // 标准登录把用户名写入 userInfo，供顶栏用户区显示（已有则不覆盖）
         setStoredUserName(loginUserName);
         // 内网透传的 access_token 合并进 userInfo（在 loginByYUserId 覆盖之后），

frontend-web/src/roundtable-planning/api/drafts.ts

@@ -14,6 +14,7 @@
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 import type { IntentSummary } from "@/roundtable-planning/api/intent";
 import type { ThreadIdMap } from "@/roundtable-planning/api/multi-agent";
@@ -314,7 +315,14 @@ export function fromUpdate(p: DraftUpdatePayload) {
 export async function listDrafts(): Promise<DraftMeta[]> {
   const res = await apiFetch(BASE(), { method: "GET" });
   const data = await readJson<{ drafts: ServerDraftMeta[] }>(res, "list drafts");
-  return (data.drafts ?? []).map(toMeta);
+  const metas = (data.drafts ?? []).map(toMeta);
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-会商-查询草稿",
+    url: BASE(),
+    returnParam: { count: metas.length },
+  });
+  return metas;
 }
 
 /** Fetch the full draft (incl. step1/step2). Returns null on 404. */
@@ -332,7 +340,15 @@ export async function createDraft(payload: DraftCreatePayload): Promise<DraftRec
     body: JSON.stringify(fromCreate(payload)),
   });
   const data = await readJson<ServerDraftFull>(res, "create draft");
-  return toRecord(data);
+  const record = toRecord(data);
+  writeYLog({
+    optType: OptType.create,
+    optDetail: "B1-CM助手-会商-新建草稿",
+    url: BASE(),
+    reqParam: { title: payload.title, furthestStep: payload.furthestStep, taskId: payload.taskId ?? null },
+    returnParam: { id: record.id, title: record.title },
+  });
+  return record;
 }
 
 export async function updateDraft(id: string, patch: DraftUpdatePayload): Promise<DraftRecord | null> {
@@ -343,7 +359,15 @@ export async function updateDraft(id: string, patch: DraftUpdatePayload): Promis
   });
   if (res.status === 404) return null;
   const data = await readJson<ServerDraftFull>(res, "update draft");
-  return toRecord(data);
+  const record = toRecord(data);
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-会商-更新草稿",
+    url: `${BASE()}/${id}`,
+    reqParam: { id, ...patch },
+    returnParam: { id: record.id, title: record.title },
+  });
+  return record;
 }
 
 export async function deleteDraft(id: string): Promise<void> {
@@ -352,6 +376,12 @@ export async function deleteDraft(id: string): Promise<void> {
     const text = await res.text().catch(() => "");
     throw new Error(`delete draft failed (${res.status}): ${text}`);
   }
+  writeYLog({
+    optType: OptType.delete,
+    optDetail: "B1-CM助手-会商-删除草稿",
+    url: `${BASE()}/${id}`,
+    reqParam: { id },
+  });
 }
 
 /**

frontend-web/src/roundtable-planning/api/roundtable-jobs.ts

@@ -13,6 +13,7 @@
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 import { getAvatarTypeFor } from "../lib/roundtable-constants";
 import { seatModeToRunParams } from "../lib/seat-mode";
@@ -111,7 +112,15 @@ export async function startJob(payload: StartJobPayload): Promise<RoundtableJob>
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(toStartBody(payload)),
   });
-  return mapJob(await readJson<Record<string, unknown>>(res, "start job"));
+  const job = mapJob(await readJson<Record<string, unknown>>(res, "start job"));
+  writeYLog({
+    optType: OptType.other,
+    optDetail: "B1-CM助手-会商-运行",
+    url: BASE(),
+    reqParam: { draftId: payload.draftId ?? null, taskId: payload.taskId ?? null, model: payload.model },
+    returnParam: { id: job.id, status: job.status },
+  });
+  return job;
 }
 
 /**
@@ -168,7 +177,15 @@ export async function resumeJob(jobId: string, answer: string, taskId?: string |
 /** 取消作业。`taskId` 非空 → task 共享取消（不分权）。 */
 export async function cancelJob(jobId: string, taskId?: string | null): Promise<RoundtableJob> {
   const res = await apiFetch(`${BASE()}/${encodeURIComponent(jobId)}/cancel${taskQuery(taskId, "?")}`, { method: "POST" });
-  return mapJob(await readJson<Record<string, unknown>>(res, "cancel job"));
+  const job = mapJob(await readJson<Record<string, unknown>>(res, "cancel job"));
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-会商-取消",
+    url: `${BASE()}/${jobId}/cancel`,
+    reqParam: { jobId, taskId: taskId ?? null },
+    returnParam: { id: job.id, status: job.status },
+  });
+  return job;
 }
 
 // ── SSE 进度订阅 ─────────────────────────────────────────────────────────────

frontend-web/src/roundtable-planning/api/task-drafts.ts

@@ -12,6 +12,7 @@
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 import {
   fromCreate,
@@ -33,7 +34,15 @@ const BASE = () => `${getBackendBaseURL()}/api/roundtable-task-drafts`;
 export async function listTaskDraftsByTask(taskId: string): Promise<DraftMeta[]> {
   const res = await apiFetch(`${BASE()}/by-task/${encodeURIComponent(taskId)}`, { method: "GET" });
   const data = await readJson<{ drafts: ServerDraftMeta[] }>(res, "list task drafts");
-  return (data.drafts ?? []).map(toMeta);
+  const metas = (data.drafts ?? []).map(toMeta);
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-会商任务-查询草稿",
+    url: `${BASE()}/by-task/${taskId}`,
+    reqParam: { taskId },
+    returnParam: { count: metas.length },
+  });
+  return metas;
 }
 
 /** 按外部任务 id 取最新一条聊天记录（不分权）。无则 null（404）。 */
@@ -60,7 +69,15 @@ export async function createTaskDraft(payload: DraftCreatePayload): Promise<Draf
     body: JSON.stringify(fromCreate(payload)),
   });
   const data = await readJson<ServerDraftFull>(res, "create task draft");
-  return toRecord(data);
+  const record = toRecord(data);
+  writeYLog({
+    optType: OptType.create,
+    optDetail: "B1-CM助手-会商任务-新建草稿",
+    url: BASE(),
+    reqParam: { taskId: payload.taskId ?? null, title: payload.title, furthestStep: payload.furthestStep },
+    returnParam: { id: record.id, title: record.title },
+  });
+  return record;
 }
 
 export async function updateTaskDraft(id: string, patch: DraftUpdatePayload): Promise<DraftRecord | null> {
@@ -71,7 +88,15 @@ export async function updateTaskDraft(id: string, patch: DraftUpdatePayload): Pr
   });
   if (res.status === 404) return null;
   const data = await readJson<ServerDraftFull>(res, "update task draft");
-  return toRecord(data);
+  const record = toRecord(data);
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-会商任务-更新草稿",
+    url: `${BASE()}/${id}`,
+    reqParam: { id, ...patch },
+    returnParam: { id: record.id, title: record.title },
+  });
+  return record;
 }
 
 export async function deleteTaskDraft(id: string): Promise<void> {
@@ -80,4 +105,10 @@ export async function deleteTaskDraft(id: string): Promise<void> {
     const text = await res.text().catch(() => "");
     throw new Error(`delete task draft failed (${res.status}): ${text}`);
   }
+  writeYLog({
+    optType: OptType.delete,
+    optDetail: "B1-CM助手-会商任务-删除草稿",
+    url: `${BASE()}/${id}`,
+    reqParam: { id },
+  });
 }

frontend-web/src/strategy-components/api/light-apps.ts

@@ -16,6 +16,7 @@ import {
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 import { parseThemeMap, stringifyThemeMap } from "@/strategy-components/lib/light-app";
 
 export type LightAppType = "window_open" | "iframe";
@@ -156,7 +157,15 @@ export async function listLightApps(params: ListLightAppsParams = {}): Promise<L
   const query = qs.toString();
   const res = await apiFetch(`${BASE()}${query ? `?${query}` : ""}`, { method: "GET" });
   const data = await readJson<{ apps: ServerApp[] }>(res, "list light apps");
-  return (data.apps ?? []).map(toApp);
+  const apps = (data.apps ?? []).map(toApp);
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-轻应用-列表",
+    url: `${BASE()}${query ? `?${query}` : ""}`,
+    reqParam: params,
+    returnParam: apps,
+  });
+  return apps;
 }
 
 export async function getLightApp(appId: string): Promise<LightApp> {
@@ -170,7 +179,15 @@ export async function createLightApp(input: LightAppInput): Promise<LightApp> {
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(toBody(input)),
   });
-  return toApp(await readJson<ServerApp>(res, "create light app"));
+  const app = toApp(await readJson<ServerApp>(res, "create light app"));
+  writeYLog({
+    optType: OptType.create,
+    optDetail: "B1-CM助手-轻应用-注册",
+    url: BASE(),
+    reqParam: input,
+    returnParam: app,
+  });
+  return app;
 }
 
 export async function updateLightApp(
@@ -182,12 +199,26 @@ export async function updateLightApp(
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(toBody(patch)),
   });
-  return toApp(await readJson<ServerApp>(res, "update light app"));
+  const app = toApp(await readJson<ServerApp>(res, "update light app"));
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-轻应用-修改",
+    url: `${BASE()}/${encodeURIComponent(appId)}`,
+    reqParam: { appId, patch },
+    returnParam: app,
+  });
+  return app;
 }
 
 export async function deleteLightApp(appId: string): Promise<void> {
   const res = await apiFetch(`${BASE()}/${encodeURIComponent(appId)}`, { method: "DELETE" });
   await readJson<{ success: boolean }>(res, "delete light app");
+  writeYLog({
+    optType: OptType.delete,
+    optDetail: "B1-CM助手-轻应用-删除",
+    url: `${BASE()}/${encodeURIComponent(appId)}`,
+    reqParam: { appId },
+  });
 }
 
 // ── React Query hooks（管理页 / 列表页 / 侧边栏共用缓存） ───────────────────

frontend-web/src/strategy-components/api/menu-overrides.ts

@@ -10,6 +10,7 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 import type { MenuOverride } from "@/core/page-layout/menu-overrides";
 
 const BASE = () => `${getBackendBaseURL()}/api/menu-overrides`;
@@ -67,7 +68,15 @@ export async function replaceMenuOverrides(overrides: MenuOverride[]): Promise<M
     body: JSON.stringify({ overrides: overrides.map(toBody) }),
   });
   const data = await readJson<{ overrides: ServerOverride[] }>(res, "save menu overrides");
-  return (data.overrides ?? []).map(toOverride);
+  const saved = (data.overrides ?? []).map(toOverride);
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-菜单管理-保存",
+    url: "/api/menu-overrides",
+    reqParam: { overrides },
+    returnParam: saved,
+  });
+  return saved;
 }
 
 // ── React Query hooks（侧边栏 + 管理页共用缓存） ────────────────────────────

frontend-web/src/strategy-components/api/sensitive-words.ts

@@ -10,6 +10,7 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 const BASE = () => `${getBackendBaseURL()}/api/sensitive-words`;
 
@@ -71,7 +72,14 @@ async function readJson<T>(res: Response, ctx: string): Promise<T> {
 export async function listSensitiveWords(): Promise<SensitiveWord[]> {
   const res = await apiFetch(BASE(), { method: "GET" });
   const data = await readJson<{ words: ServerWord[] }>(res, "list sensitive words");
-  return (data.words ?? []).map(toWord);
+  const words = (data.words ?? []).map(toWord);
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-敏感词管理-列表",
+    url: "/api/sensitive-words",
+    returnParam: words,
+  });
+  return words;
 }
 
 export async function replaceSensitiveWords(words: SensitiveWord[]): Promise<SensitiveWord[]> {
@@ -81,7 +89,15 @@ export async function replaceSensitiveWords(words: SensitiveWord[]): Promise<Sen
     body: JSON.stringify({ words: words.map(toBody) }),
   });
   const data = await readJson<{ words: ServerWord[] }>(res, "save sensitive words");
-  return (data.words ?? []).map(toWord);
+  const saved = (data.words ?? []).map(toWord);
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-敏感词管理-保存",
+    url: "/api/sensitive-words",
+    reqParam: { words },
+    returnParam: saved,
+  });
+  return saved;
 }
 
 /** 把「启用」的词条折叠成运行时脱敏所需的 `原始词 → 替换词` 映射。 */

frontend-web/src/strategy-components/api/skill-addresses.ts

@@ -11,6 +11,7 @@ import { useQuery } from "@tanstack/react-query";
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 
 const BASE = () => `${getBackendBaseURL()}/api/skill-addresses`;
 
@@ -197,7 +198,15 @@ export async function scanAddresses(kinds?: AddressKind[], skill?: string): Prom
   if (skill) params.set("skill", skill);
   const qs = params.toString();
   const res = await apiFetch(`${BASE()}/scan${qs ? `?${qs}` : ""}`, { method: "GET" });
-  return toScanResult(await readJson<any>(res, "扫描"));
+  const result = toScanResult(await readJson<any>(res, "扫描"));
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-技能地址管理-扫描",
+    url: `${BASE()}/scan${qs ? `?${qs}` : ""}`,
+    reqParam: { kinds, skill },
+    returnParam: result,
+  });
+  return result;
 }
 
 /** 流式扫描：逐技能上报进度，返回最终聚合结果。 */
@@ -216,6 +225,13 @@ export async function scanAddressesStream(
     else if (ev.type === "result") result = toScanResult(ev);
   });
   if (!result) throw new Error("扫描未返回结果");
+  writeYLog({
+    optType: OptType.search,
+    optDetail: "B1-CM助手-技能地址管理-扫描",
+    url: `${BASE()}/scan/stream${qs ? `?${qs}` : ""}`,
+    reqParam: { kinds: opts.kinds, skill: opts.skill },
+    returnParam: result,
+  });
   return result;
 }
 
@@ -251,6 +267,13 @@ export async function applyReplacementsStream(
     else if (ev.type === "result") result = toApplyResult(ev);
   });
   if (!result) throw new Error("应用未返回结果");
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-技能地址管理-应用替换",
+    url: `${BASE()}/apply/stream`,
+    reqParam: body,
+    returnParam: result,
+  });
   return result;
 }
 
@@ -269,7 +292,15 @@ export async function listBackups(): Promise<BackupEntry[]> {
 export async function rollbackBackup(backupId: string): Promise<{ restored: number }> {
   const res = await apiFetch(`${BASE()}/rollback/${encodeURIComponent(backupId)}`, { method: "POST" });
   const data = await readJson<{ restored_files: string[] }>(res, "撤销");
-  return { restored: (data.restored_files ?? []).length };
+  const result = { restored: (data.restored_files ?? []).length };
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-技能地址管理-回退",
+    url: `${BASE()}/rollback/${encodeURIComponent(backupId)}`,
+    reqParam: { backupId },
+    returnParam: result,
+  });
+  return result;
 }
 
 // ── React Query ────────────────────────────────────────────────────────────

frontend-web/src/strategy-components/api/task-buttons.ts

@@ -10,6 +10,7 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 
 import { apiFetch } from "@/core/api/fetch-client";
 import { getBackendBaseURL } from "@/core/config";
+import { OptType, writeYLog } from "@/core/log/y-log";
 import type {
   TaskBusiness,
   TaskButton,
@@ -87,7 +88,15 @@ export async function replaceTaskButtons(buttons: TaskButton[]): Promise<TaskBut
     body: JSON.stringify({ buttons: buttons.map(toBody) }),
   });
   const data = await readJson<{ buttons: ServerButton[] }>(res, "save task buttons");
-  return (data.buttons ?? []).map(toButton);
+  const saved = (data.buttons ?? []).map(toButton);
+  writeYLog({
+    optType: OptType.edit,
+    optDetail: "B1-CM助手-按钮管理-保存",
+    url: "/api/task-buttons",
+    reqParam: { buttons },
+    returnParam: saved,
+  });
+  return saved;
 }
 
 // ── React Query hooks（工作区 + 管理页共用缓存） ────────────────────────────

offline-backend-20260512/backend/app/gateway/routers/public_config.py

@@ -26,3 +26,10 @@ async def get_task_deeplink_config() -> dict:
     """返回 ``config.yaml`` 的 ``task_deeplink`` 段（含 test/delete_test/各 URL/mock）。"""
     config = get_app_config()
     return config.task_deeplink.model_dump()
+
+
+@router.get("/y-log")
+async def get_y_log_config() -> dict:
+    """返回 ``config.yaml`` 的 ``y_log`` 段（enabled / write_url），无密钥，公开只读。"""
+    config = get_app_config()
+    return config.y_log.model_dump()

offline-backend-20260512/backend/packages/harness/deerflow/config/app_config.py

@@ -39,6 +39,7 @@ from deerflow.config.token_usage_config import TokenUsageConfig
 from deerflow.config.tool_config import ToolConfig, ToolGroupConfig
 from deerflow.config.tool_search_config import ToolSearchConfig, load_tool_search_config_from_dict
 from deerflow.config.vision_config import VisionConfig
+from deerflow.config.y_log_config import YLogConfig
 
 load_dotenv()
 
@@ -141,6 +142,7 @@ class AppConfig(BaseModel):
     knowledge: KnowledgeConfig = Field(default_factory=KnowledgeConfig, description="Product knowledge base (obsidian-wiki compatible vault) configuration")
     knowledge_ingest: KnowledgeIngestConfig = Field(default_factory=KnowledgeIngestConfig, description="External knowledge-ingest endpoint configuration")
     task_deeplink: TaskDeeplinkConfig = Field(default_factory=TaskDeeplinkConfig, description="任务深链(rwfx)目的树闸门与跳转地址配置(前端经 /api/public/config/task-deeplink 读取)")
+    y_log: YLogConfig = Field(default_factory=YLogConfig, description="操作日志上报配置（前端经 /api/public/config/y-log 读取）")
 
     @classmethod
     def resolve_config_path(cls, config_path: str | None = None) -> Path:

offline-backend-20260512/backend/packages/harness/deerflow/config/y_log_config.py

@@ -0,0 +1,20 @@
+"""操作日志（Y-Log）上报配置。
+
+前端经公开只读接口 ``GET /api/public/config/y-log`` 读取本段（地址 + 开关），
+据此决定是否把用户的关键操作上报到外部日志接口。段内只有地址与开关，无密钥，
+公开只读。仿 :mod:`deerflow.config.log_system_config` 的写法。
+"""
+
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+
+class YLogConfig(BaseModel):
+    """操作日志（Y-Log）上报配置：前端经 /api/public/config/y-log 读取。"""
+
+    enabled: bool = Field(default=False, description="是否启用操作日志上报")
+    write_url: str = Field(
+        default="",
+        description="日志上报外部接口完整地址（POST），如 https://ch1.b.uat.4.cn/api/y-log/write",
+    )

offline-backend-20260512/config.yaml

@@ -308,6 +308,14 @@ log_system:
   url: "https://your-log-system.example.com"
   label: "日志系统"
 
+# ───────────────────────────────────────────────────────────────────────────
+# 操作日志（Y-Log）上报：前端直连外部接口记录用户的关键操作（审计/统计）。
+# 仅在「token 登录」（存在 token1）时上报；前端经公开只读接口
+# GET /api/public/config/y-log 读取本段，改这里即时生效（Gateway mtime 热重载）。
+y_log:
+  enabled: true
+  write_url: https://ch1.b.uat.4.cn/api/y-log/write
+
 summarization:
   # 开关已移到聊天框下方(参考文献下面)的「上下文压缩」按钮,默认关闭。
   # 这里 enabled 仅作为非 Web 路径(渠道/定时任务)的后备开关;下面的 trigger/keep