@cjhyy/code-shell-server 0.9.22 → 0.9.23

package/dist/panels/runtime.js

@@ -1,19 +1,24 @@
+import { panelExecutionGate, PanelExecutionBusyError } from "./execution-gate.js";
 import { randomBytes, createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, opendir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, extname, join, resolve, sep } from "node:path";
-import { listInstalledPanelApps, validateToolArgsStrict, } from "@cjhyy/code-shell-core";
+import { listInstalledPanelApps, inspectProjectPanelApps, CredentialStore, validateToolArgsStrict, } from "@cjhyy/code-shell-core";
 import { panelRuntimeApiVersion, panelProcessMethods, panelResourceMethods, panelToolJobMethods, panelRuntimeCapabilities, PanelBridgeError, panelBridgeFailure, } from "./bridge-contract.js";
 import { PanelResourceService } from "./resources/service.js";
+import { servePanelResource } from "./resources/http.js";
 import { panelConnections, panelConnectionIds, materializePanelConnections, } from "./connections.js";
 import { PanelRuntimeServices } from "./runtime-services.js";
 import { PanelToolJobService, toolJobLimits, } from "./tool-jobs.js";
 import { createPanelToolExecutor } from "./tool-executor.js";
-import { PanelAppDirectoryBookmarks } from "./directory-bookmarks.js";
+import { PanelTaskCookieHost } from "./task-cookie-host.js";
+import { taskCookieFromInput, taskCookieSelection, } from "./task-cookies.js";
+import { desktopPanelDirectoryBookmarks, hubPanelDirectoryBookmarks, } from "./directory-bookmarks.js";
 import { handlePanelProcessDirectory } from "./process-files.js";
 import { PanelAppProcessService, panelExecutableDirectories, panelProcessInfo, } from "./process-service.js";
 import { PanelManagementError } from "./management.js";
+import { panelAutomationMethods } from "./automations.js";
 const ASSETS = "/api/v1/panel-assets/";
 const ROOT = "/api/v1/panels/runtime/";
 const MAX_FILE = 16 * 1024 * 1024;
@@ -21,6 +26,8 @@ const GRANT_TTL = 30 * 60_000;
 const METHODS = [
     "context.get",
     "storage.get",
+    "storage.getSnapshot",
+    "storage.compareAndSet",
     "storage.set",
     "storage.delete",
     "workspace.info",
@@ -30,10 +37,16 @@ const METHODS = [
     "external.open",
     "agent.submitPrompt",
     "notifications.send",
+    ...panelAutomationMethods,
     ...panelProcessMethods,
     ...panelResourceMethods,
+    "resources.open",
+    "resources.preview",
+    "resources.recordAudio",
     ...panelToolJobMethods,
     "credentials.connections.list",
+    "credentials.cookies.listForTask",
+    "credentials.cookies.authorizeProcess",
     "credentials.connections.authorizeProcess",
     "agent.task.models",
     "agent.task.start",
@@ -55,7 +68,9 @@ const PERMISSIONS = new Set([
     "notifications.send",
     "process",
     "resources",
+    "resources.directRead",
     "credentials.connections",
+    "credentials.cookies",
     "agent.task",
 ]);
 const MIME = {
@@ -75,12 +90,44 @@ const MIME = {
     ".woff2": "font/woff2",
     ".ttf": "font/ttf",
 };
-export const panelWebCompatibility = (app) => ({
+// The asset origin is also an allowed script source. Never expose uploaded
+// documents or executable MIME types there, even with a resource permission.
+const INLINE_RESOURCE_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+    "image/avif",
+    "image/bmp",
+    "audio/mpeg",
+    "audio/mp4",
+    "audio/wav",
+    "audio/x-wav",
+    "audio/ogg",
+    "audio/webm",
+    "audio/flac",
+    "audio/aac",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
+    "font/woff",
+    "font/woff2",
+    "font/ttf",
+    "font/otf",
+]);
+const INLINE_RESOURCE_PATH = "_codeshell_resources/";
+export const panelWebCompatibility = (app, options) => ({
     supported: true,
     reasons: [
         ...app.permissions
-            .filter((permission) => !PERMISSIONS.has(permission))
+            .filter((permission) => !PERMISSIONS.has(permission) &&
+            !(permission === "automations.manage" && options?.automations))
             .map((permission) => "网页暂不提供 " + permission + "，对应功能需要桌面客户端。"),
+        ...(app.permissions.includes("credentials.cookies")
+            ? [
+                "网页可选择 Host 已保存的账号用于后台任务和受授权的临时程序；登录采集和浏览器登录恢复仍需桌面端。",
+            ]
+            : []),
     ],
 });
 function methodPermission(method) {
@@ -88,12 +135,16 @@ function methodPermission(method) {
         return "resources";
     if (method.startsWith("credentials.connections."))
         return "credentials.connections";
+    if (method.startsWith("credentials.cookies."))
+        return "credentials.cookies";
     if (method.startsWith("storage."))
         return "storage";
     if (method.startsWith("process.") || method.startsWith("filesystem."))
         return "process";
     if (method.startsWith("agent.task."))
         return "agent.task";
+    if (method.startsWith("automations."))
+        return "automations.manage";
     if (method === "workspace.info")
         return "workspace.info";
     if (method === "workspace.writeText")
@@ -248,7 +299,7 @@ function bridgeScript(id, origin) {
       const requestId = String(++next);
       const timer = setTimeout(() => {
         pending.delete(requestId); reject(new Error("Panel request timed out"));
-      }, method === "tasks.start" ? 30 * 60 * 1000 : 60000);
+      }, ["tasks.start", "tasks.retry", "tasks.queue.set", "resources.recordAudio"].includes(method) ? 30 * 60 * 1000 : 60000);
       pending.set(requestId, { resolve, reject, timer });
       try {
         parent.postMessage({ type: "codeshell-panel:call", instanceId: id, requestId, method, params }, origin);
@@ -357,6 +408,8 @@ function injectBridge(html, source) {
 /** Owner-bound capability grants serve reviewed static bytes to an opaque-origin iframe. */
 export function createPanelRuntime(options) {
     const publicPathPrefix = options.publicPathPrefix ?? "";
+    // An admitted task belongs to the project. Login/page grants only control access.
+    const projectOwnedTools = options.host === "hub" || !!options.sharedToolJobs;
     if (publicPathPrefix &&
         !/^\/p\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(publicPathPrefix))
         throw new Error("Invalid project public path prefix");
@@ -364,30 +417,112 @@ export function createPanelRuntime(options) {
     const assets = new Map();
     const now = options.now ?? Date.now;
     const services = new PanelRuntimeServices({ dataDir: options.dataDir });
-    const installed = options.listInstalled ?? listInstalledPanelApps;
+    const installed = options.listInstalled ??
+        (options.projectPackages
+            ? async (appId) => (await inspectProjectPanelApps(options.bindingCwd ?? options.cwd, appId)).apps
+            : listInstalledPanelApps);
     let closed = false;
     let generation = 0;
     let nextGuest = 0;
     let nextToolOwner = -1;
     const byGuest = new Map();
-    const directoryBookmarks = new PanelAppDirectoryBookmarks(join(options.dataDir, "panel-web-directory-bookmarks.json"));
+    const directoryBookmarks = options.host === "desktop"
+        ? desktopPanelDirectoryBookmarks(options.dataDir)
+        : hubPanelDirectoryBookmarks(options.dataDir);
     const panelDataDirectory = (appId) => join(options.dataDir, "panel-data", appId, digest(Buffer.from(options.bindingCwd ?? options.cwd)).slice(0, 24));
     const toolOwners = new Map();
     const jobOwners = new Map();
     let toolJobs;
+    let taskCookies;
+    function getTaskCookies() {
+        if (options.host !== "hub" || options.sharedToolJobs)
+            throw new PanelBridgeError("NOT_SUPPORTED", "Background Cookie access is unavailable");
+        return (taskCookies ??= new PanelTaskCookieHost({
+            rootDirectory: join(options.dataDir, "panel-task-cookies"),
+            // A cloud project must not inherit credentials from the controller's user account.
+            credentials: async (scope) => new CredentialStore(scope.projectPath).list("project"),
+            authorize: async (scope) => {
+                if (!(await installedToolApp(scope)).permissions.includes("credentials.cookies"))
+                    throw new PanelBridgeError("PERMISSION_DENIED", "Tool requires Cookie permission");
+            },
+        }));
+    }
+    function cookieAccess(grant) {
+        if (!grant.app.permissions.includes("process") ||
+            !grant.app.permissions.includes("resources") ||
+            !grant.app.permissions.includes("credentials.cookies"))
+            error(403, "后台账号访问缺少面板权限。");
+        if (grant.sharedTools) {
+            if (!grant.sharedTools.cookies)
+                error(501, "当前 Host 不支持后台账号授权。");
+            return grant.sharedTools.cookies;
+        }
+        if (options.sharedToolJobs)
+            error(410, "共享任务授权已失效。");
+        const scope = {
+            appId: grant.app.id,
+            projectPath: options.bindingCwd ?? options.cwd,
+            revision: grant.revision,
+        };
+        const host = getTaskCookies();
+        return {
+            list: (url) => host.list(scope, url),
+            check: (selection) => host.check(scope, selection),
+            materialize: (selection) => host.materialize(scope, selection),
+        };
+    }
+    async function taskConsentDetail(grant, input, entry) {
+        const selection = taskCookieFromInput(input);
+        if (!selection)
+            return entry;
+        const account = await cookieAccess(grant).check(selection);
+        return `工具：${entry}\n账号：${account.label}\n站点：${new URL(selection.url).hostname}\n所选登录信息仅交付给已审查的后台程序，任务可在关闭页面后继续。`;
+    }
+    const localToolRoot = options.host === "desktop"
+        ? join(options.dataDir, "panel-web-tool-jobs", digest(Buffer.from(options.cwd)).slice(0, 24))
+        : join(options.dataDir, "panel-tool-jobs");
+    let legacyPresent;
+    async function legacyJobs(scope) {
+        if (!options.sharedToolJobs || options.host !== "desktop")
+            return [];
+        const present = await (legacyPresent ??= lstat(localToolRoot)
+            .then((info) => {
+            if (!info.isDirectory() || info.isSymbolicLink())
+                throw new Error("Invalid legacy task store");
+            return true;
+        })
+            .catch((cause) => {
+            if (cause.code === "ENOENT")
+                return false;
+            throw cause;
+        }));
+        // Opening an existing store marks unfinished jobs interrupted; it never replays them.
+        return present
+            ? (await getToolJobs().list(scope)).map((job) => ({
+                ...job,
+                readOnly: true,
+                historySource: "desktop-web-legacy",
+            }))
+            : [];
+    }
     async function installedToolApp(scope) {
         if (closed || scope.projectPath !== (options.bindingCwd ?? options.cwd))
             throw new PanelBridgeError("REVOKED", "Tool task workspace is unavailable");
-        const panel = (await snapshot()).panels.find((candidate) => candidate.id === scope.appId);
-        const app = (await installed()).find((candidate) => candidate.id === scope.appId);
+        const panel = (await snapshot(scope.appId)).panels.find((candidate) => candidate.id === scope.appId);
+        const app = (await installed(scope.appId)).find((candidate) => candidate.id === scope.appId);
         if (!panel?.enabled ||
             panel.revision !== scope.revision ||
+            (panel.packageDigest !== undefined && panel.packageDigest !== app?.packageDigest) ||
             !app?.permissions.includes("process") ||
             !app.permissions.includes("resources"))
             throw new PanelBridgeError("REVOKED", "Installed tool task is no longer authorized");
         return app;
     }
     const processes = new PanelAppProcessService({
+        acquireExecution: (owner) => panelExecutionGate.enter({
+            appId: owner.appId,
+            projectPath: options.bindingCwd ?? options.cwd,
+        }),
         approvalScope: "guest",
         resolvePackageEntry: async (owner, name) => {
             const taskScope = toolOwners.get(owner.guestId);
@@ -427,7 +562,7 @@ export function createPanelRuntime(options) {
         rootDirectory: join(options.dataDir, "panel-app-media"),
         isScopeAuthorized: async (scope) => {
             if (scope.projectPath === (options.bindingCwd ?? options.cwd)) {
-                const panel = (await snapshot()).panels.find((candidate) => candidate.id === scope.appId);
+                const panel = (await snapshot(scope.appId)).panels.find((candidate) => candidate.id === scope.appId);
                 if (panel?.enabled && panel.permissions.includes("resources"))
                     return true;
             }
@@ -457,16 +592,33 @@ export function createPanelRuntime(options) {
             revision: grant.revision,
         };
         const input = (params ?? {});
-        const service = getToolJobs();
+        const shared = grant.sharedTools;
+        const service = shared ?? {
+            start: (request, signal) => getToolJobs().start(scope, request, signal),
+            list: () => getToolJobs().list(scope),
+            get: (id) => getToolJobs().get(scope, id),
+            cancel: (id) => getToolJobs().cancel(scope, id),
+            retry: (id) => getToolJobs().retry(scope, id),
+            find: (requestKey) => getToolJobs().find(scope, requestKey),
+            getQueue: () => getToolJobs().getQueue(scope),
+            setQueue: (update) => getToolJobs().setQueue(scope, update),
+        };
+        if (options.sharedToolJobs && !shared)
+            error(410, "共享任务授权已失效，请重新打开面板。");
         if (method === "tasks.start") {
             const app = await installedToolApp(scope);
             const entry = app.nativeEntries?.[input.entry ?? ""];
             if (!entry)
                 error(501, "安装的原生工具不可用。");
-            if (!(await confirm(grant, `启动 ${grant.app.title.default} 的后台工具？`, input.entry)))
+            const detail = await taskConsentDetail(grant, input.input, input.entry);
+            if (!(await confirm(grant, `启动 ${grant.app.title.default} 的后台工具？`, detail)))
                 error(403, "你取消了后台工具执行。");
             if (!(await authorized(grant)))
                 error(410, "面板授权已失效。");
+            if (taskCookieFromInput(input.input))
+                await taskConsentDetail(grant, input.input, input.entry);
+            if (!(await authorized(grant)))
+                error(410, "面板授权已失效。");
             const preparation = {
                 owner: grant.owner,
                 appId: scope.appId,
@@ -474,31 +626,46 @@ export function createPanelRuntime(options) {
             };
             preparingTools.add(preparation);
             try {
-                const job = await service.start(scope, {
+                const job = await service.start({
                     entry: { name: input.entry, sha256: entry.sha256 },
                     input: input.input,
                     recovery: input.recovery ?? "manual",
                     requestKey: input.requestKey,
                 }, preparation.controller.signal);
-                if (!jobOwners.has(job.id))
+                if (!projectOwnedTools && !jobOwners.has(job.id))
                     jobOwners.set(job.id, { owner: grant.owner, scope });
                 if (!(await authorized(grant))) {
-                    if (jobOwners.get(job.id)?.owner === grant.owner)
-                        await service.cancel(scope, job.id);
+                    if (!projectOwnedTools && jobOwners.get(job.id)?.owner === grant.owner)
+                        await service.cancel(job.id);
                     error(410, "登录授权已撤销。");
                 }
-                emitTaskEvent(await service.get(scope, job.id));
+                if (!shared)
+                    emitTaskEvent(await service.get(job.id));
                 return job;
             }
             catch (cause) {
                 if (preparation.controller.signal.aborted)
-                    error(410, "登录授权已撤销，输入准备已取消。");
+                    error(410, projectOwnedTools
+                        ? "登录授权已撤销。请重新连接后查询任务，已接收的项目任务可能仍在运行。"
+                        : "登录授权已撤销，输入准备已取消。");
                 throw cause;
             }
             finally {
                 preparingTools.delete(preparation);
             }
         }
+        if (method === "tasks.find")
+            return service.find(input.requestKey);
+        if (method === "tasks.queue.get")
+            return service.getQueue();
+        if (method === "tasks.queue.set") {
+            // Resuming may launch previously admitted jobs; use the existing owner consent gate.
+            if (!(await confirm(grant, `调整 ${grant.app.title.default} 的后台队列？`, "暂停只影响等待任务，正在执行的任务继续运行。")))
+                error(403, "你取消了队列调整。");
+            if (!(await authorized(grant)))
+                error(410, "面板授权已失效。");
+            return service.setQueue(params);
+        }
         if (method === "tasks.list") {
             const offset = input.offset ?? 0, limit = input.limit ?? 50;
             if (!Number.isSafeInteger(offset) ||
@@ -507,26 +674,48 @@ export function createPanelRuntime(options) {
                 limit < 1 ||
                 limit > 50)
                 throw new PanelBridgeError("INVALID_ARGUMENT", "Invalid task page");
-            return (await service.list(scope))
-                .slice(offset, offset + limit)
-                .map((job) => toolSummary(job));
+            const jobs = [...(await service.list()), ...(await legacyJobs(scope))].sort((a, b) => b.createdAt - a.createdAt || a.id.localeCompare(b.id));
+            return jobs.slice(offset, offset + limit).map((job) => toolSummary(job));
+        }
+        if (shared && ["tasks.get", "tasks.cancel", "tasks.retry"].includes(method)) {
+            // Explicitly identify legacy IDs. Authorization failures on the shared service
+            // must never fall through to a less restrictive coordinator.
+            if (!(await shared.has(input.id))) {
+                const legacy = (await legacyJobs(scope)).find((job) => job.id === input.id);
+                if (legacy) {
+                    if (method === "tasks.get")
+                        return legacy;
+                    throw new PanelBridgeError("NOT_SUPPORTED", "旧网页任务仅供查看，请从原输入创建新的共享任务。");
+                }
+            }
         }
         if (method === "tasks.get")
-            return service.get(scope, input.id);
+            return service.get(input.id);
         if (method === "tasks.cancel")
-            return service.cancel(scope, input.id);
+            return service.cancel(input.id);
         if (method === "tasks.retry") {
-            if (!(await confirm(grant, `重试 ${grant.app.title.default} 的后台工具？`, input.id ?? "")))
+            const previous = await service.get(input.id);
+            if (previous.readOnly)
+                throw new PanelBridgeError("NOT_SUPPORTED", "旧任务仅供查看，请检查输入后创建新任务。");
+            const detail = await taskConsentDetail(grant, previous.input, previous.entry.name);
+            if (!(await confirm(grant, `重试 ${grant.app.title.default} 的后台工具？`, detail)))
                 error(403, "你取消了后台工具重试。");
             if (!(await authorized(grant)))
                 error(410, "面板授权已失效。");
-            const job = await service.retry(scope, input.id);
-            jobOwners.set(job.id, { owner: grant.owner, scope });
+            if (taskCookieFromInput(previous.input))
+                await taskConsentDetail(grant, previous.input, previous.entry.name);
+            if (!(await authorized(grant)))
+                error(410, "面板授权已失效。");
+            const job = await service.retry(input.id);
+            if (!projectOwnedTools)
+                jobOwners.set(job.id, { owner: grant.owner, scope });
             if (!(await authorized(grant))) {
-                await service.cancel(scope, job.id);
-                error(410, "登录授权已撤销，后台工具已取消。");
+                if (!projectOwnedTools)
+                    await service.cancel(job.id);
+                error(410, "登录授权已撤销，请重新连接后查看任务状态。");
             }
-            emitTaskEvent(await service.get(scope, job.id));
+            if (!shared)
+                emitTaskEvent(await service.get(job.id));
             return job;
         }
         throw new PanelBridgeError("NOT_SUPPORTED", "Unknown tool task operation");
@@ -537,10 +726,11 @@ export function createPanelRuntime(options) {
     }
     function emitTaskEvent(job) {
         const owner = jobOwners.get(job.id)?.owner;
-        if (!owner)
+        if (!projectOwnedTools && !owner)
             return;
         for (const grant of grants.values())
-            if (grant.owner === owner &&
+            if ((projectOwnedTools || grant.owner === owner) &&
+                job.scope.projectPath === (options.bindingCwd ?? options.cwd) &&
                 grant.app.id === job.scope.appId &&
                 grant.revision === job.scope.revision &&
                 grant.app.permissions.includes("process") &&
@@ -553,6 +743,7 @@ export function createPanelRuntime(options) {
         if (toolJobs)
             return toolJobs;
         const executor = createPanelToolExecutor({
+            ...(options.host === "hub" && !options.sharedToolJobs ? { cookies: getTaskCookies() } : {}),
             processes,
             resources,
             owner: (job, send) => {
@@ -577,6 +768,15 @@ export function createPanelRuntime(options) {
                 if (!app.permissions.includes("credentials.connections"))
                     throw new PanelBridgeError("PERMISSION_DENIED", "Tool requires connection permission");
             },
+            authorizeDirectRead: async (scope) => {
+                const app = await installedToolApp(scope);
+                if (!app.permissions.includes("resources.directRead"))
+                    throw new PanelBridgeError("PERMISSION_DENIED", "Tool requires direct read permission");
+            },
+            resolveDirectoryBookmark: async (scope, bookmark) => {
+                await installedToolApp(scope);
+                return directoryBookmarks.restore(scope.appId, scope.projectPath, bookmark);
+            },
             appDataDirectory: async (scope) => {
                 await installedToolApp(scope);
                 const path = panelDataDirectory(scope.appId);
@@ -586,27 +786,31 @@ export function createPanelRuntime(options) {
             sealedRoot: join(options.dataDir, "panel-app-sealed"),
         });
         toolJobs = new PanelToolJobService({
-            // Desktop's IPC bridge has its own in-memory coordinator for panel-tool-jobs.
-            // A Desktop Web workspace must not open the same store concurrently.
-            rootDir: options.host === "desktop"
-                ? join(options.dataDir, "panel-web-tool-jobs", digest(Buffer.from(options.cwd)).slice(0, 24))
-                : join(options.dataDir, "panel-tool-jobs"),
+            // Separate legacy store when a Desktop coordinator is injected. Existing
+            // history stays readable; shared jobs never acquire a second disk lock.
+            rootDir: localToolRoot,
             ...executor,
             isAuthorized: async (scope) => !!(await installedToolApp(scope).catch(() => null)),
+            describePackage: async (scope) => {
+                const app = await installedToolApp(scope);
+                if (!app.packageDigest)
+                    throw new Error("Project package digest is unavailable");
+                return { version: app.version, packageDigest: app.packageDigest };
+            },
             onEvent: emitTaskEvent,
         });
         return toolJobs;
     }
-    let readingSnapshot;
-    function snapshot() {
+    const readingSnapshots = new Map();
+    function snapshot(appId) {
         // Parallel module requests share current disk work, without a stale TTL
         // that could keep an unbound or updated package authorized.
-        const pending = readingSnapshot ?? options.snapshot();
-        readingSnapshot = pending;
+        const pending = readingSnapshots.get(appId) ?? options.snapshot(appId);
+        readingSnapshots.set(appId, pending);
         void pending
             .finally(() => {
-            if (readingSnapshot === pending)
-                readingSnapshot = undefined;
+            if (readingSnapshots.get(appId) === pending)
+                readingSnapshots.delete(appId);
         })
             .catch(() => { });
         return pending;
@@ -614,6 +818,7 @@ export function createPanelRuntime(options) {
     function remove(grant) {
         if (grants.get(grant.id) !== grant)
             return;
+        grant.unsubscribeTools?.();
         grants.delete(grant.id);
         assets.delete(grant.asset);
         byGuest.delete(grant.guestId);
@@ -704,6 +909,9 @@ export function createPanelRuntime(options) {
         };
     }
     async function onPanelAction(scope, input) {
+        return panelExecutionGate.run({ appId: scope.appId, projectPath: options.bindingCwd ?? options.cwd }, () => onPanelActionAdmitted(scope, input));
+    }
+    async function onPanelActionAdmitted(scope, input) {
         const grant = grants.get(scope.instanceId);
         if (!grant || grant.owner !== scope.ownerId || !(await authorized(grant)))
             return { ok: false, detail: "面板已关闭或授权已撤销。" };
@@ -737,13 +945,20 @@ export function createPanelRuntime(options) {
             return { ok: false, detail: "用户取消了面板工具操作。" };
         if (grant.toolCalls.size >= 16)
             return { ok: false, detail: "面板工具调用过多。" };
+        const releaseExecution = panelExecutionGate.enter({
+            appId: grant.app.id,
+            projectPath: options.bindingCwd ?? options.cwd,
+        });
         const requestId = randomBytes(18).toString("base64url");
         const value = await new Promise((done) => {
-            const timer = setTimeout(() => finish({ error: "面板工具调用超时。" }), 45_000);
+            // Keep the operation occupied after the caller stops waiting. A late reply
+            // or revoked guest ends it; a timeout alone is not proof of termination.
+            const timer = setTimeout(() => done({ error: "面板工具调用超时。" }), 45_000);
             timer.unref();
             const finish = (result) => {
                 if (!grant.toolCalls.delete(requestId))
                     return;
+                releaseExecution();
                 clearTimeout(timer);
                 done(result);
             };
@@ -783,10 +998,12 @@ export function createPanelRuntime(options) {
             return false;
         }
         try {
-            const panel = (await snapshot()).panels.find((candidate) => candidate.id === grant.app.id);
+            const panel = (await snapshot(grant.app.id)).panels.find((candidate) => candidate.id === grant.app.id);
             const info = await lstat(grant.root);
             const ownerStillAuthorized = await options.isAuthorized(grant.request);
             const currentOwner = await options.ownerId(grant.request);
+            if (grant.app.permissions.includes("process"))
+                await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
             const valid = !closed &&
                 grants.get(grant.id) === grant &&
                 grant.expiresAt > now() &&
@@ -825,7 +1042,7 @@ export function createPanelRuntime(options) {
                 !/^[a-f0-9]{64}$/.test(input.revision) ||
                 Object.keys(input).some((key) => !["appId", "revision", "sessionId", "theme", "locale"].includes(key)))
                 error(400, "面板参数无效。");
-            const panel = (await snapshot()).panels.find((candidate) => candidate.id === input.appId);
+            const panel = (await snapshot(input.appId)).panels.find((candidate) => candidate.id === input.appId);
             if (!panel?.enabled || !panel.compatibility.supported)
                 error(403, "请先将面板绑定到当前工作区。");
             if (panel.revision !== input.revision)
@@ -833,9 +1050,11 @@ export function createPanelRuntime(options) {
             if (input.sessionId !== undefined &&
                 (typeof input.sessionId !== "string" || !/^[A-Za-z0-9_-]{8,128}$/.test(input.sessionId)))
                 error(400, "会话标识无效。");
-            const app = (await installed()).find((candidate) => candidate.id === input.appId);
+            const app = (await installed(input.appId)).find((candidate) => candidate.id === input.appId);
             if (!app)
                 error(404, "面板已卸载。");
+            if (panel.packageDigest && panel.packageDigest !== app.packageDigest)
+                error(409, "项目面板版本已改变，请重新打开。");
             const root = await realpath(app.installPath), info = await lstat(app.installPath);
             if (info.isSymbolicLink() || !info.isDirectory())
                 error(403, "面板安装目录无效。");
@@ -844,6 +1063,13 @@ export function createPanelRuntime(options) {
                 error(404, "找不到面板入口。");
             if (closed || generation !== startedGeneration || preparation.cancelled)
                 error(410, "面板授权已失效，请重新打开。");
+            const sharedTools = options.sharedToolJobs &&
+                app.permissions.includes("process") &&
+                app.permissions.includes("resources")
+                ? await options.sharedToolJobs.bind(app, options.bindingCwd ?? options.cwd)
+                : undefined;
+            if (closed || generation !== startedGeneration || preparation.cancelled)
+                error(410, "面板授权已失效，请重新打开。");
             for (const grant of grants.values())
                 if (grant.expiresAt <= now())
                     remove(grant);
@@ -860,12 +1086,32 @@ export function createPanelRuntime(options) {
                 capabilities: {
                     ...panelRuntimeCapabilities({
                         process: app.permissions.includes("process"),
+                        cookieProcess: app.permissions.includes("process") &&
+                            app.permissions.includes("resources") &&
+                            app.permissions.includes("credentials.cookies") &&
+                            (sharedTools
+                                ? !!sharedTools.cookies?.materialize
+                                : options.host === "hub" && !options.sharedToolJobs),
                         resources: app.permissions.includes("resources") ? resources.capabilities() : undefined,
                         tasks: app.permissions.includes("process") && app.permissions.includes("resources")
                             ? {
                                 available: true,
+                                directoryBookmarks: true,
+                                queueControl: true,
+                                cookieCredentials: app.permissions.includes("credentials.cookies") &&
+                                    (sharedTools
+                                        ? !!sharedTools.cookies
+                                        : options.host === "hub" && !options.sharedToolJobs),
                                 ...toolJobLimits,
+                                ownership: projectOwnedTools ? "project" : "session",
+                                executionRevision: sharedTools?.scope.revision ?? panel.revision,
+                                sharedAcrossDevices: projectOwnedTools,
+                                continuesAfterDisconnect: true,
+                                continuesAfterLogout: projectOwnedTools,
                                 maxHttpResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024,
+                                ...(app.permissions.includes("resources.directRead")
+                                    ? { directRead: true }
+                                    : {}),
                             }
                             : undefined,
                         limits: {
@@ -878,25 +1124,52 @@ export function createPanelRuntime(options) {
                             consentTimeoutMs: 50000,
                         },
                     }),
-                    ...(app.permissions.includes("process") && app.permissions.includes("resources")
+                    ...(app.permissions.includes("resources")
                         ? {
                             methodLimits: {
-                                "tasks.start": {
-                                    maxParamsBytes: toolJobLimits.maxInputBytes,
-                                    maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024,
-                                    timeoutMs: 30 * 60 * 1000,
-                                },
-                                "tasks.get": { maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024 },
-                                "tasks.retry": { maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024 },
-                                "tasks.cancel": { maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024 },
+                                "resources.recordAudio": { timeoutMs: 30 * 60 * 1000 },
+                                ...(app.permissions.includes("process")
+                                    ? {
+                                        "tasks.start": {
+                                            maxParamsBytes: toolJobLimits.maxInputBytes,
+                                            maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024,
+                                            timeoutMs: 30 * 60 * 1000,
+                                        },
+                                        "tasks.find": { maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024 },
+                                        "tasks.get": { maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024 },
+                                        "tasks.retry": {
+                                            maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024,
+                                            timeoutMs: 30 * 60 * 1000,
+                                        },
+                                        "tasks.cancel": {
+                                            maxResultBytes: toolJobLimits.maxRecordBytes + 128 * 1024,
+                                        },
+                                    }
+                                    : {}),
                             },
                         }
                         : {}),
                 },
                 host: options.host,
                 availableMethods: METHODS.filter((method) => {
+                    if (method === "credentials.cookies.listForTask" ||
+                        method === "credentials.cookies.authorizeProcess")
+                        return (app.permissions.includes("credentials.cookies") &&
+                            app.permissions.includes("process") &&
+                            app.permissions.includes("resources") &&
+                            (sharedTools
+                                ? method === "credentials.cookies.authorizeProcess"
+                                    ? !!sharedTools.cookies?.materialize
+                                    : !!sharedTools.cookies
+                                : options.host === "hub" && !options.sharedToolJobs));
                     if (method.startsWith("agent.task.") && !agentTasks)
                         return false;
+                    if (method.startsWith("automations."))
+                        return (!!options.automations &&
+                            (!method.endsWith("IfRevision") ||
+                                options.automations.conditionalMutations === true) &&
+                            ["automations.manage", "context.workspace", "context.session"].every((permission) => app.permissions.includes(permission)) &&
+                            !!input.sessionId);
                     if (method.startsWith("tasks."))
                         return app.permissions.includes("process") && app.permissions.includes("resources");
                     if ([
@@ -923,6 +1196,7 @@ export function createPanelRuntime(options) {
                 context.busy = false;
             }
             const grant = {
+                sharedTools,
                 guestId: ++nextGuest,
                 id,
                 asset,
@@ -948,6 +1222,27 @@ export function createPanelRuntime(options) {
             grants.set(id, grant);
             byGuest.set(grant.guestId, grant);
             assets.set(asset, grant);
+            if (sharedTools) {
+                // Keep event order across asynchronous viewer-authorization checks. A slow
+                // or revoked viewer cannot stop the owning coordinator or another viewer.
+                let events = Promise.resolve();
+                let pendingEvents = 0;
+                grant.unsubscribeTools = sharedTools.subscribe((job) => {
+                    if (++pendingEvents > 1024) {
+                        remove(grant);
+                        return;
+                    }
+                    events = events
+                        .then(async () => {
+                        // The native Host may have revoked project trust independently of
+                        // this Web session. Check both authorities before sending metadata.
+                        if ((await sharedTools.has(job.id)) && (await authorized(grant)))
+                            emit(grant, "tasks.changed", job);
+                        pendingEvents--;
+                    })
+                        .catch(() => remove(grant));
+                });
+            }
             if (!(await authorized(grant))) {
                 remove(grant);
                 error((await options.isAuthorized(request)) ? 410 : 401, "面板授权已失效，请重新打开。");
@@ -965,6 +1260,9 @@ export function createPanelRuntime(options) {
         }
     }
     async function call(grant, input) {
+        return panelExecutionGate.run({ appId: grant.app.id, projectPath: options.bindingCwd ?? options.cwd }, () => callAdmitted(grant, input));
+    }
+    async function callAdmitted(grant, input) {
         if (!(await authorized(grant)))
             error(410, "面板授权已失效，请重新打开。");
         if (Object.keys(input).some((key) => !["method", "params"].includes(key)))
@@ -1003,6 +1301,23 @@ export function createPanelRuntime(options) {
         const permission = methodPermission(method);
         if (!grant.app.permissions.includes(permission))
             error(403, "面板未声明这个权限。");
+        if (method.startsWith("automations.")) {
+            if (!options.automations)
+                error(501, "当前执行环境尚未接入面板自动化。");
+            if (method.endsWith("IfRevision") && !options.automations.conditionalMutations)
+                error(501, "当前执行环境尚未接入自动化版本检查。");
+            if (!grant.app.permissions.includes("context.workspace") ||
+                !grant.app.permissions.includes("context.session") ||
+                typeof grant.context.sessionId !== "string")
+                error(403, "自动化需要已绑定的项目与对话。");
+            return options.automations.call({
+                appId: grant.app.id,
+                cwd: options.cwd,
+                sessionId: grant.context.sessionId,
+                revision: grant.revision,
+                isAuthorized: () => authorized(grant),
+            }, method, params);
+        }
         const processOwner = {
             guestId: grant.guestId,
             appId: grant.app.id,
@@ -1011,6 +1326,49 @@ export function createPanelRuntime(options) {
             send: (event, payload) => emit(grant, event, payload),
         };
         if (method.startsWith("resources.")) {
+            if (method === "resources.recordAudio") {
+                const value = (params ?? {});
+                const maxDurationSeconds = value.maxDurationSeconds ?? 300;
+                const maxBytes = value.maxBytes ?? 16 * 1024 * 1024;
+                if (!value ||
+                    typeof value !== "object" ||
+                    Array.isArray(value) ||
+                    Object.keys(value).some((key) => !["maxDurationSeconds", "maxBytes"].includes(key)) ||
+                    !Number.isInteger(maxDurationSeconds) ||
+                    Number(maxDurationSeconds) < 1 ||
+                    Number(maxDurationSeconds) > 600 ||
+                    !Number.isInteger(maxBytes) ||
+                    Number(maxBytes) < 1 ||
+                    Number(maxBytes) > 25 * 1024 * 1024)
+                    error(400, "录音限制无效。");
+                // This effect only opens a trusted chooser. Device access and upload each
+                // require an explicit user action; the iframe retains microphone=().
+                return { effect: "resources.recordAudio", maxDurationSeconds, maxBytes };
+            }
+            if (method === "resources.open" || method === "resources.preview") {
+                const value = params;
+                if (!value ||
+                    Object.keys(value).some((key) => key !== "assetId") ||
+                    typeof value.assetId !== "string" ||
+                    !/^(?:asset|external)-[a-f0-9]{64}$/.test(value.assetId))
+                    error(400, "文件资源标识无效。");
+                const asset = await resources.get({ appId: grant.app.id, projectPath: options.bindingCwd ?? options.cwd }, value.assetId);
+                if (!(await authorized(grant)))
+                    error(410, "面板授权已失效。");
+                if (method === "resources.preview") {
+                    if (!INLINE_RESOURCE_TYPES.has(asset.mimeType))
+                        error(400, "此资源类型不能在面板内播放或显示。");
+                    return {
+                        asset,
+                        url: `${grant.origin}${publicPathPrefix}${ASSETS}${grant.asset}/${INLINE_RESOURCE_PATH}${asset.id}`,
+                    };
+                }
+                return {
+                    effect: "resources.open",
+                    asset,
+                    url: `${ROOT}${grant.id}/resources/${asset.id}`,
+                };
+            }
             if ([
                 "resources.materialize",
                 "resources.capture",
@@ -1021,6 +1379,51 @@ export function createPanelRuntime(options) {
                 error(403, "资源工具交接需要process权限。");
             return resources.dispatch({ appId: grant.app.id, projectPath: options.bindingCwd ?? options.cwd }, method, params, { resolveDirectory: (handle) => processes.directoryPath(processOwner, handle) });
         }
+        if (method === "credentials.cookies.listForTask") {
+            const value = await cookieAccess(grant).list(params?.url);
+            if (!(await authorized(grant)))
+                error(410, "面板授权已失效。");
+            return value;
+        }
+        if (method === "credentials.cookies.authorizeProcess") {
+            const value = params;
+            const selection = taskCookieSelection({
+                credentialId: value?.credentialId,
+                url: value?.url,
+                revision: value?.revision,
+            });
+            const access = cookieAccess(grant);
+            if (!access.materialize)
+                error(501, "当前 Host 不支持临时进程账号授权。");
+            const executable = processes.executableName(processOwner, value.executableHandle);
+            const account = await access.check(selection);
+            if (!(await confirm(grant, "允许程序使用这个已保存账号？", `程序：${executable}\n账号：${account.label}\n站点：${new URL(selection.url).hostname}\n登录信息仅通过私密文件交给所选程序；关闭页面或撤销授权会停止使用。`)))
+                return { authorized: false, cancelled: true };
+            const validate = async () => {
+                await access.check(selection);
+                if (!(await authorized(grant)))
+                    error(410, "面板授权已失效。");
+            };
+            await validate();
+            const lease = await access.materialize(selection);
+            try {
+                await validate();
+                const sealed = await processes.grantFileArgument(processOwner, {
+                    executableHandle: value.executableHandle,
+                    argumentName: "--cookies",
+                    path: lease.path,
+                    validate,
+                    cleanup: () => {
+                        void lease.cleanup().catch(() => { });
+                    },
+                });
+                return { authorized: true, fileArgumentHandle: sealed.handle, count: lease.count };
+            }
+            catch (cause) {
+                await lease.cleanup();
+                throw cause;
+            }
+        }
         if (method === "credentials.connections.list")
             return panelConnections(options.cwd);
         if (method === "credentials.connections.authorizeProcess") {
@@ -1089,10 +1492,14 @@ export function createPanelRuntime(options) {
                 };
             }
             if (method === "filesystem.restoreDirectory") {
+                await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
                 const saved = directoryBookmarks.restore(grant.app.id, options.bindingCwd ?? options.cwd, params?.bookmark);
-                if (saved !== (await realpath(join(options.cwd, "downloads"))))
+                if (!options.authorizePanelDirectory &&
+                    saved !== (await realpath(options.cwd)) &&
+                    saved !== (await realpath(join(options.cwd, "downloads"))))
                     throw new PanelBridgeError("PERMISSION_DENIED", "Saved server directory is unavailable");
                 const restored = await processes.grantDirectory(owner, saved);
+                await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
                 directoryBookmarks.restore(grant.app.id, options.bindingCwd ?? options.cwd, params?.bookmark);
                 return { ...restored, bookmark: params.bookmark };
             }
@@ -1111,12 +1518,13 @@ export function createPanelRuntime(options) {
             if (method === "filesystem.pickDirectory" &&
                 !(await confirm(grant, "使用服务端下载目录？", directory)))
                 return null;
+            await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
             if (name !== "project")
                 await mkdir(directory, { recursive: true, mode: 0o700 });
             if (!(await authorized(grant)))
                 error(410, "面板授权已失效。");
             const selected = await processes.grantDirectory(owner, directory);
-            if (method !== "filesystem.pickDirectory")
+            if (method !== "filesystem.pickDirectory" && !["downloads", "project"].includes(String(name)))
                 return selected;
             const bookmark = directoryBookmarks.remember(grant.app.id, options.bindingCwd ?? options.cwd, selected.path);
             if (!(await authorized(grant)))
@@ -1175,7 +1583,9 @@ export function createPanelRuntime(options) {
         }, method, params);
     }
     return {
-        activeTaskCount: () => (agentTasks?.activeTaskCount?.() ?? 0) + (toolJobs?.activeCount() ?? 0),
+        activeTaskCount: () => (agentTasks?.activeTaskCount?.() ?? 0) +
+            (toolJobs?.activeCount() ?? 0) +
+            (options.sharedToolJobs?.activeCount(options.bindingCwd ?? options.cwd) ?? 0),
         async panelAction(ownerId, sessionId, input) {
             const candidates = [];
             for (const grant of grants.values()) {
@@ -1213,12 +1623,13 @@ export function createPanelRuntime(options) {
             for (const grant of grants.values())
                 if (!appId || grant.app.id === appId)
                     remove(grant);
+            const sharedInvalidation = options.sharedToolJobs?.invalidate(options.bindingCwd ?? options.cwd, appId);
             if (!toolJobs)
-                return Promise.resolve();
+                return sharedInvalidation ?? Promise.resolve();
             const appIds = appId
                 ? [appId]
                 : [...new Set([...jobOwners.values()].map((record) => record.scope.appId))];
-            return Promise.all(appIds.map((id) => toolJobs.cancelApp(id))).then(() => undefined);
+            return Promise.all([sharedInvalidation, ...appIds.map((id) => toolJobs.cancelApp(id))]).then(() => undefined);
         },
         async close() {
             closed = true;
@@ -1232,6 +1643,7 @@ export function createPanelRuntime(options) {
                 preparation.cancelled = true;
             try {
                 await toolJobs?.shutdown();
+                await taskCookies?.shutdown();
             }
             finally {
                 processes.close();
@@ -1252,7 +1664,10 @@ export function createPanelRuntime(options) {
                     return true;
                 }
                 const directoryMatch = /^\/api\/v1\/panels\/runtime\/([\w-]+)\/directory\/([a-f0-9-]{36})$/.exec(url.pathname);
-                const match = /^\/api\/v1\/panels\/runtime\/([\w-]+)(?:\/(call|renew|events|confirm|tool-results))?$/.exec(url.pathname) ?? directoryMatch;
+                const resourceMatch = /^\/api\/v1\/panels\/runtime\/([\w-]+)\/resources\/((?:asset|external)-[a-f0-9]{64})$/.exec(url.pathname);
+                const match = /^\/api\/v1\/panels\/runtime\/([\w-]+)(?:\/(call|renew|events|confirm|tool-results))?$/.exec(url.pathname) ??
+                    directoryMatch ??
+                    resourceMatch;
                 const grant = match && grants.get(match[1]);
                 if (!grant)
                     error(410, "面板连接已失效，请关闭后重新打开。");
@@ -1261,7 +1676,26 @@ export function createPanelRuntime(options) {
                 activeGrant = grant;
                 if (!(await authorized(grant)))
                     error(410, "面板连接已失效，请关闭后重新打开。");
-                if (directoryMatch) {
+                if (resourceMatch) {
+                    if (!grant.app.permissions.includes("resources"))
+                        error(403, "面板未声明资源权限。");
+                    if ([...url.searchParams.keys()].some((key) => !["download", "workspace"].includes(key)) ||
+                        url.searchParams.getAll("download").length > 1 ||
+                        url.searchParams.getAll("workspace").length > 1 ||
+                        (url.searchParams.has("download") && url.searchParams.get("download") !== "1") ||
+                        (url.searchParams.has("workspace") && url.searchParams.get("workspace") !== options.cwd))
+                        error(400, "文件访问参数无效。");
+                    await servePanelResource(request, response, {
+                        service: resources,
+                        scope: { appId: grant.app.id, projectPath: options.bindingCwd ?? options.cwd },
+                        id: resourceMatch[2],
+                        download: url.searchParams.get("download") === "1",
+                        isAuthorized: async () => currentOwner === grant.owner &&
+                            (await options.isAuthorized(request)) &&
+                            (await authorized(grant)),
+                    });
+                }
+                else if (directoryMatch) {
                     if (!grant.app.permissions.includes("process"))
                         error(403, "面板未声明这个权限。");
                     const root = processes.directoryPath({
@@ -1346,7 +1780,7 @@ export function createPanelRuntime(options) {
                     error(405, "不支持这个面板请求。");
             }
             catch (cause) {
-                let status = cause instanceof PanelManagementError
+                let status = cause instanceof PanelManagementError || cause instanceof PanelExecutionBusyError
                     ? cause.status
                     : cause instanceof PanelBridgeError && cause.code === "RATE_LIMITED"
                         ? 429
@@ -1398,6 +1832,27 @@ export function createPanelRuntime(options) {
                     return true;
                 }
                 const path = parts.map(decodeURIComponent).join("/");
+                if (path.startsWith(INLINE_RESOURCE_PATH)) {
+                    if (!grant.app.permissions.includes("resources"))
+                        error(403, "面板未声明资源权限。");
+                    const id = path.slice(INLINE_RESOURCE_PATH.length);
+                    if (!/^(?:asset|external)-[a-f0-9]{64}$/.test(id))
+                        error(404, "文件资源标识无效。");
+                    const scope = { appId: grant.app.id, projectPath: options.bindingCwd ?? options.cwd };
+                    const asset = await resources.get(scope, id).catch(() => error(404, "文件资源不可用。"));
+                    if (!INLINE_RESOURCE_TYPES.has(asset.mimeType))
+                        error(403, "资源类型不可预览。");
+                    // A direct navigation must not turn project data into an active document.
+                    response.setHeader("Content-Security-Policy", "default-src 'none'; sandbox");
+                    await servePanelResource(request, response, {
+                        service: resources,
+                        scope,
+                        id,
+                        download: false,
+                        isAuthorized: () => authorized(grant),
+                    });
+                    return true;
+                }
                 let bytes;
                 if (path === "_codeshell_bridge.js")
                     bytes = Buffer.from(bridgeScript(grant.id, grant.origin));
@@ -1417,6 +1872,9 @@ export function createPanelRuntime(options) {
                     bytes = Buffer.from(injectBridge(bytes.toString("utf8"), source));
                     const resourceOrigin = grant.origin;
                     const assetSource = resourceOrigin + source;
+                    // Panels export their own generated files (for example JSON backups).
+                    // Download permission does not grant origin access, network fetches or popups.
+                    // The embedding iframe must enable the same permission.
                     response.setHeader("Content-Security-Policy", "default-src 'none'; script-src " +
                         assetSource +
                         "; style-src " +
@@ -1427,7 +1885,7 @@ export function createPanelRuntime(options) {
                         assetSource +
                         " blob:; font-src " +
                         assetSource +
-                        " data:; connect-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; sandbox allow-scripts; frame-ancestors " +
+                        " data:; connect-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; sandbox allow-scripts allow-downloads; frame-ancestors " +
                         resourceOrigin);
                     response.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=(), display-capture=()");
                 }