@cjhyy/code-shell-server 0.9.50 → 0.9.52

package/dist/hub/configuration.d.ts

@@ -31,6 +31,10 @@ export declare function createHubConfiguration(options: HubConfigurationOptions)
             text?: string | undefined;
         };
         connections: {
+            paramValues?: {
+                [k: string]: string | number | boolean;
+            } | undefined;
+            unavailableParameters?: string[] | undefined;
             id: string;
             revision: string;
             catalogId: string;
@@ -46,6 +50,13 @@ export declare function createHubConfiguration(options: HubConfigurationOptions)
             adapterKind: string;
             defaultBaseUrl: string;
             needsKey: boolean;
+            modelPresets: {
+                parameters: import("./model-parameter-metadata.js").PublicModelParameter[];
+                supportsVision?: boolean | undefined;
+                maxContextTokens?: number | undefined;
+                value: string;
+                label: string;
+            }[];
         }[];
         skills: {
             disabledReason?: string | undefined;

package/dist/hub/configuration.js

@@ -4,6 +4,7 @@ import { SettingsManager, invalidateSkillCache, mergePluginMcpServers, scanSkill
 import { computeEffectiveDisabledLists, getMergedCatalog } from "@cjhyy/code-shell-core/internal";
 import { withModelTraceContext } from "@cjhyy/code-shell-core/internal";
 import { probeConfiguredModel } from "@cjhyy/code-shell-host";
+import { publicModelPresets, publicParameterValues, validateParameterPatch, unavailableParameters, } from "./model-parameter-metadata.js";
 const ROOT = "/api/v1/configuration";
 const MAX_BODY_BYTES = 64 * 1024;
 const MAX_SKILL_BYTES = 2 * 1024 * 1024;
@@ -69,6 +70,7 @@ export function createHubConfiguration(options) {
                 protocol: template?.protocol,
                 adapterKind: template?.adapterKind,
                 defaultBaseUrl: template?.defaultBaseUrl,
+                modelPresets: template?.modelPresets,
             },
         }))
             .digest("hex");
@@ -131,6 +133,12 @@ export function createHubConfiguration(options) {
                     baseUrl: displayUrl(connection.baseUrl ?? credential?.baseUrl ?? template?.defaultBaseUrl),
                     hasApiKey: Boolean(credential?.apiKey),
                     needsKey: template?.needsKey !== false,
+                    ...(connection.tag === "text"
+                        ? {
+                            paramValues: publicParameterValues(template?.modelPresets?.find((preset) => preset.value === connection.model), connection.paramValues),
+                            unavailableParameters: unavailableParameters(template?.modelPresets?.find((preset) => preset.value === connection.model), connection.paramValues),
+                        }
+                        : {}),
                 };
             }),
             catalog: catalog
@@ -141,6 +149,7 @@ export function createHubConfiguration(options) {
                 adapterKind: entry.adapterKind,
                 defaultBaseUrl: displayUrl(entry.defaultBaseUrl),
                 needsKey: entry.needsKey !== false,
+                modelPresets: publicModelPresets(entry),
             })),
             skills: allSkills.map((skill) => ({
                 name: skill.name,
@@ -200,7 +209,15 @@ export function createHubConfiguration(options) {
         });
     }
     function updateConnection(input) {
-        knownFields(input, ["id", "catalogId", "model", "baseUrl", "apiKey", "expectedRevision"]);
+        knownFields(input, [
+            "id",
+            "catalogId",
+            "model",
+            "baseUrl",
+            "apiKey",
+            "expectedRevision",
+            "paramValues",
+        ]);
         const id = boundedString(input.id, "id", 128);
         const catalogId = boundedString(input.catalogId, "catalogId", 128);
         const model = boundedString(input.model, "model", 256);
@@ -213,6 +230,21 @@ export function createHubConfiguration(options) {
             const effective = settingsManager().get();
             checkConnectionRevision(input, id, effective);
             const existing = effective.modelConnections.find((entry) => entry.id === id);
+            if (input.paramValues !== undefined &&
+                (existing ? typeof input.expectedRevision !== "string" : input.expectedRevision !== null))
+                throw new HubConfigurationError(409, "请载入最新连接后再保存模型参数。");
+            const parameters = input.paramValues === undefined
+                ? undefined
+                : validateParameterPatch(template.modelPresets?.find((preset) => preset.value === model), input.paramValues);
+            if (input.paramValues !== undefined && parameters === undefined)
+                throw new HubConfigurationError(400, "模型参数不受支持或超出允许范围，请刷新后检查。");
+            const mergedParameters = { ...existing?.paramValues };
+            for (const [key, value] of Object.entries(parameters ?? {})) {
+                if (value === null)
+                    delete mergedParameters[key];
+                else
+                    mergedParameters[key] = value;
+            }
             if (existing && (existing.tag !== "text" || existing.catalogId !== catalogId)) {
                 throw new HubConfigurationError(400, "existing connection provider cannot be changed");
             }
@@ -246,6 +278,7 @@ export function createHubConfiguration(options) {
                 model,
                 ...(credentialId ? { credentialId } : {}),
                 ...(baseUrl !== undefined ? { baseUrl: baseUrl || template.defaultBaseUrl } : {}),
+                ...(parameters !== undefined ? { paramValues: mergedParameters } : {}),
             };
             current.modelConnections = [
                 ...effective.modelConnections.filter((entry) => entry.id !== id),

package/dist/hub/model-parameter-metadata.d.ts

@@ -0,0 +1,26 @@
+import type { getMergedCatalog } from "@cjhyy/code-shell-core/internal";
+type Catalog = ReturnType<typeof getMergedCatalog>[number];
+type Preset = NonNullable<Catalog["modelPresets"]>[number];
+export interface PublicModelParameter {
+    name: string;
+    label: string;
+    control: "enum" | "number" | "toggle";
+    options?: string[];
+    min?: number;
+    max?: number;
+    default?: string | number | boolean;
+}
+export declare function modelParameters(preset?: Preset): PublicModelParameter[];
+export declare function publicParameterValues(preset: Preset | undefined, values: unknown): {
+    [k: string]: string | number | boolean;
+};
+export declare function unavailableParameters(preset: Preset | undefined, values: unknown): string[];
+export declare function validateParameterPatch(preset: Preset | undefined, input: unknown): Record<string, string | number | boolean | null> | undefined;
+export declare function publicModelPresets(entry: Catalog): {
+    parameters: PublicModelParameter[];
+    supportsVision?: boolean | undefined;
+    maxContextTokens?: number | undefined;
+    value: string;
+    label: string;
+}[];
+export {};

package/dist/hub/model-parameter-metadata.js

@@ -0,0 +1,92 @@
+/** Deliberately limited to text-generation controls; credential, endpoint,
+ * header, arbitrary text and wire-path declarations never reach the browser. */
+const NAMES = new Set([
+    "reasoning",
+    "reasoning_effort",
+    "thinking_type",
+    "temperature",
+    "top_p",
+    "max_tokens",
+]);
+const FIELDS = {
+    reasoning: [
+        "reasoning",
+        "reasoning_effort",
+        "reasoning.effort",
+        "thinking.budget_tokens",
+        "thinking.type",
+    ],
+    reasoning_effort: ["reasoning_effort"],
+    thinking_type: ["thinking_type", "thinking.type"],
+    temperature: ["temperature"],
+    top_p: ["top_p"],
+    max_tokens: ["max_tokens"],
+};
+export function modelParameters(preset) {
+    return (preset?.params ?? []).flatMap((spec) => {
+        if (!NAMES.has(spec.name) ||
+            preset.params.filter((candidate) => candidate.name === spec.name).length !== 1 ||
+            (spec.control !== "enum" && spec.control !== "number" && spec.control !== "toggle") ||
+            !FIELDS[spec.name]?.includes(spec.wire?.field ?? spec.name))
+            return [];
+        const result = {
+            name: spec.name,
+            label: spec.label ?? spec.name,
+            control: spec.control,
+            ...(spec.control === "enum" ? { options: [...(spec.options ?? [])] } : {}),
+            ...(spec.control === "number" ? { min: spec.min ?? 0, max: spec.max ?? 1_000_000_000 } : {}),
+        };
+        if (validParameter(result, spec.default))
+            result.default = spec.default;
+        return [result];
+    });
+}
+function validParameter(spec, value) {
+    if (spec.control === "enum")
+        return typeof value === "string" && value.length <= 256 && !!spec.options?.includes(value);
+    if (spec.control === "toggle")
+        return typeof value === "boolean";
+    if (spec.control !== "number")
+        return false;
+    return (typeof value === "number" &&
+        Number.isFinite(value) &&
+        value >= (spec.min ?? 0) &&
+        value <= (spec.max ?? 1_000_000_000));
+}
+export function publicParameterValues(preset, values) {
+    const source = values && typeof values === "object" && !Array.isArray(values) ? values : {};
+    return Object.fromEntries(modelParameters(preset).flatMap((spec) => {
+        const value = source[spec.name];
+        return validParameter(spec, value) ? [[spec.name, value]] : [];
+    }));
+}
+export function unavailableParameters(preset, values) {
+    const source = values && typeof values === "object" && !Array.isArray(values) ? values : {};
+    return modelParameters(preset)
+        .filter((spec) => Object.hasOwn(source, spec.name) &&
+        !validParameter(spec, source[spec.name]))
+        .map((spec) => spec.name);
+}
+export function validateParameterPatch(preset, input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return undefined;
+    const specs = modelParameters(preset);
+    const patch = Object.entries(input);
+    if (patch.length > NAMES.size)
+        return undefined;
+    if (patch.some(([key, value]) => {
+        const spec = specs.find((candidate) => candidate.name === key);
+        return !spec || (value !== null && !validParameter(spec, value));
+    }))
+        return undefined;
+    return input;
+}
+export function publicModelPresets(entry) {
+    return (entry.modelPresets ?? []).map((preset) => ({
+        value: preset.value,
+        label: preset.label ?? preset.value,
+        ...(preset.maxContextTokens !== undefined ? { maxContextTokens: preset.maxContextTokens } : {}),
+        ...(preset.supportsVision !== undefined ? { supportsVision: preset.supportsVision } : {}),
+        parameters: modelParameters(preset),
+    }));
+}

package/dist/index.panels.d.ts

@@ -1,7 +1,7 @@
 export { createPanelHttp } from "./panels/http.js";
 export * from "./panels/automations.js";
 export * from "./panels/hub-automations.js";
-export { createPanelManagement, PanelManagementError } from "./panels/management.js";
+export { createPanelManagement, createPanelSnapshotReads, PanelManagementError, type PanelSnapshotReads, } from "./panels/management.js";
 export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
 export { createHubPanelBinding } from "./panels/hub-binding.js";
 export * from "./panels/project-scope.js";

package/dist/index.panels.js

@@ -1,7 +1,7 @@
 export { createPanelHttp } from "./panels/http.js";
 export * from "./panels/automations.js";
 export * from "./panels/hub-automations.js";
-export { createPanelManagement, PanelManagementError } from "./panels/management.js";
+export { createPanelManagement, createPanelSnapshotReads, PanelManagementError, } from "./panels/management.js";
 export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
 export { createHubPanelBinding } from "./panels/hub-binding.js";
 export * from "./panels/project-scope.js";

package/dist/mobile-remote/mobile-chat-turn.d.ts

@@ -14,6 +14,10 @@ export interface DispatchMobileChatTurnInput {
     attachments?: MobileImageAttachment[];
     clientMessageId?: string;
     modelTraceSource?: string;
+    /** Host-resolved per-run model pool key; never a global model setting. */
+    model?: string;
+    configuredModel?: import("@cjhyy/code-shell-core/internal").ConfiguredTextModelIntent;
+    workspaceProfile?: string;
     permissionMode?: PermissionMode;
     runId: string;
     bridge: MobileRunBridge;

package/dist/mobile-remote/mobile-chat-turn.js

@@ -44,6 +44,9 @@ export async function dispatchMobileChatTurn(input) {
         id: input.runId,
         params: {
             task: text,
+            ...(input.model ? { model: input.model } : {}),
+            ...(input.configuredModel ? { configuredModel: { ...input.configuredModel } } : {}),
+            ...(input.workspaceProfile ? { workspaceProfile: input.workspaceProfile } : {}),
             ...(input.modelTraceSource && /^panel:[a-z][a-z0-9-]{0,63}$/.test(input.modelTraceSource)
                 ? { modelTraceSource: input.modelTraceSource }
                 : {}),

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -28,8 +28,14 @@ export function parseMobileClientEvent(value) {
             break;
         case "chat.send":
             valid =
-                optionalMember(event.permissionMode, PERMISSION_MODES) &&
+                event.configuredModel === undefined &&
+                    event.model === undefined &&
+                    optionalMember(event.permissionMode, PERMISSION_MODES) &&
                     boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
+                    (event.nativeConnectionId === undefined ||
+                        (boundedTrimmedString(event.nativeConnectionId, MAX_ID_LENGTH) &&
+                            !/[\r\n\0]/.test(event.nativeConnectionId))) &&
+                    !(event.modelKey !== undefined && event.nativeConnectionId !== undefined) &&
                     (event.modelKey === undefined ||
                         (boundedString(event.modelKey, MAX_ID_LENGTH) &&
                             /^(codex|claude-code)\/[^\r\n\0]*$/.test(event.modelKey))) &&

package/dist/mobile-remote/remote-host-manager.d.ts

@@ -44,6 +44,8 @@ export interface RemoteHostManagerOptions {
     outputJournalPageFrames?: 2048;
     /** Selected-session Host implements verified display views and bounded detail parts. */
     historyView?: boolean;
+    /** The attached command Host resolves native text connections per authorized Session. */
+    nativeModelSelection?: boolean;
     onClientEvent: (event: unknown, ws: WebSocket) => void | Promise<void>;
     /**
      * Absolute path to the built mobile app (out/mobile). Defaults to the

package/dist/mobile-remote/remote-host-manager.js

@@ -474,13 +474,18 @@ export class RemoteHostManager extends EventEmitter {
             return {
                 type: "pair.ok",
                 device,
-                ...(this.opts.outputJournal
+                ...(this.opts.outputJournal || this.opts.nativeModelSelection
                     ? {
                         capabilities: {
-                            outputJournal: 1,
-                            ...(this.opts.historyView ? { historyView: 1 } : {}),
-                            ...(this.opts.legacyBasePages ? { legacyBasePages: 1 } : {}),
-                            ...(this.opts.outputJournalPageFrames === 2048
+                            ...(this.opts.outputJournal ? { outputJournal: 1 } : {}),
+                            ...(this.opts.nativeModelSelection ? { nativeModelSelection: 1 } : {}),
+                            ...(this.opts.outputJournal && this.opts.historyView
+                                ? { historyView: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.legacyBasePages
+                                ? { legacyBasePages: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.outputJournalPageFrames === 2048
                                 ? { outputJournalPageFrames: 2048 }
                                 : {}),
                         },
@@ -501,13 +506,18 @@ export class RemoteHostManager extends EventEmitter {
             return {
                 type: "auth.ok",
                 device,
-                ...(this.opts.outputJournal
+                ...(this.opts.outputJournal || this.opts.nativeModelSelection
                     ? {
                         capabilities: {
-                            outputJournal: 1,
-                            ...(this.opts.historyView ? { historyView: 1 } : {}),
-                            ...(this.opts.legacyBasePages ? { legacyBasePages: 1 } : {}),
-                            ...(this.opts.outputJournalPageFrames === 2048
+                            ...(this.opts.outputJournal ? { outputJournal: 1 } : {}),
+                            ...(this.opts.nativeModelSelection ? { nativeModelSelection: 1 } : {}),
+                            ...(this.opts.outputJournal && this.opts.historyView
+                                ? { historyView: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.legacyBasePages
+                                ? { legacyBasePages: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.outputJournalPageFrames === 2048
                                 ? { outputJournalPageFrames: 2048 }
                                 : {}),
                         },

package/dist/panels/directory-picker.d.ts

@@ -0,0 +1,48 @@
+export declare const directoryPickerLifetime: number;
+export interface PanelDirectorySelection {
+    path: string;
+    assertCurrent(): void;
+}
+/** Used only after a Host bookmark proves a previous choice; a client path is never sufficient. */
+export declare function capturePanelWorkspaceDirectory(cwd: string, path: string): PanelDirectorySelection;
+/** A pending parent-UI choice of an existing project directory, not filesystem authority. */
+export declare class PanelDirectoryPicker {
+    private readonly cwd;
+    private readonly now;
+    readonly rootPath: string;
+    readonly rootToken: string;
+    readonly initialToken: string;
+    readonly expiresAt: number;
+    private readonly root;
+    private readonly choices;
+    private closed;
+    private reading;
+    private tokenBytes;
+    constructor(cwd: string, now: () => number);
+    close(): void;
+    private assertRoot;
+    assertCurrent(): void;
+    private check;
+    private get;
+    private add;
+    list(token: unknown, authorize: () => Promise<void>): Promise<{
+        rootToken: string;
+        directories: {
+            name: string;
+            token: string;
+        }[];
+        truncated: boolean;
+        parentToken?: string | undefined;
+        directoryToken: string;
+        relativePath: string;
+        name: string;
+    }>;
+    assertListing(listing: {
+        directoryToken: string;
+        directories: Array<{
+            token: string;
+        }>;
+    }): void;
+    /** Called synchronously after final authorization, while this exact confirmation is pending. */
+    select(token: unknown): PanelDirectorySelection;
+}

package/dist/panels/directory-picker.js

@@ -0,0 +1,247 @@
+import { randomBytes } from "node:crypto";
+import { lstatSync, realpathSync } from "node:fs";
+import { opendir } from "node:fs/promises";
+import { basename, isAbsolute, join, relative, sep } from "node:path";
+import { PanelManagementError } from "./management.js";
+import { PanelBridgeError } from "./bridge-contract.js";
+export const directoryPickerLifetime = 5 * 60_000;
+const TOKEN = /^[A-Za-z0-9_-]{24}$/;
+const MAX_TOKENS = 1024;
+const MAX_ENTRIES = 200;
+const MAX_SCAN = 4096;
+const MAX_TOKEN_BYTES = 1024 * 1024;
+function unavailable() {
+    throw new PanelManagementError(409, "panel_directory_picker", "目录选择已失效，请重新发起。");
+}
+function identity(path) {
+    try {
+        const info = lstatSync(path, { bigint: true });
+        if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(path) !== path)
+            unavailable();
+        return { path, dev: info.dev, ino: info.ino };
+    }
+    catch {
+        return unavailable();
+    }
+}
+function assertIdentity(expected) {
+    const actual = identity(expected.path);
+    if (actual.dev !== expected.dev || actual.ino !== expected.ino)
+        unavailable();
+}
+function visibleName(name) {
+    return (name.length > 0 &&
+        name.length <= 255 &&
+        !name.startsWith(".") &&
+        !/[\\/\u0000-\u001f\u007f]/u.test(name));
+}
+/** Used only after a Host bookmark proves a previous choice; a client path is never sufficient. */
+export function capturePanelWorkspaceDirectory(cwd, path) {
+    let root;
+    try {
+        root = realpathSync(cwd);
+    }
+    catch {
+        return unavailable();
+    }
+    const rel = relative(root, path);
+    if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+        unavailable();
+    const parts = rel.split(sep).filter(Boolean);
+    if (parts.length > 64)
+        unavailable();
+    const chain = [identity(root)];
+    for (let i = 0; i < parts.length; i++)
+        chain.push(identity(join(root, ...parts.slice(0, i + 1))));
+    const assertCurrent = () => {
+        try {
+            if (realpathSync(cwd) !== root)
+                unavailable();
+        }
+        catch {
+            unavailable();
+        }
+        for (const entry of chain)
+            assertIdentity(entry);
+    };
+    assertCurrent();
+    return { path, assertCurrent };
+}
+/** A pending parent-UI choice of an existing project directory, not filesystem authority. */
+export class PanelDirectoryPicker {
+    cwd;
+    now;
+    rootPath;
+    rootToken;
+    initialToken;
+    expiresAt;
+    root;
+    choices = new Map();
+    closed = false;
+    reading = false;
+    tokenBytes = 0;
+    constructor(cwd, now) {
+        this.cwd = cwd;
+        this.now = now;
+        this.rootPath = realpathSync(cwd);
+        this.root = identity(this.rootPath);
+        this.expiresAt = now() + directoryPickerLifetime;
+        this.rootToken = this.add([], [this.root]).token;
+        const path = join(this.rootPath, "downloads");
+        let child;
+        try {
+            child = identity(path);
+        }
+        catch (error) {
+            if (!(error instanceof PanelManagementError) &&
+                error.code !== "ENOENT")
+                throw error;
+        }
+        this.initialToken = child
+            ? this.add(["downloads"], [this.root, child], this.rootToken).token
+            : this.rootToken;
+        this.assertCurrent();
+    }
+    close() {
+        this.closed = true;
+        this.choices.clear();
+        this.tokenBytes = 0;
+    }
+    assertRoot() {
+        try {
+            if (realpathSync(this.cwd) !== this.rootPath)
+                unavailable();
+        }
+        catch {
+            unavailable();
+        }
+        assertIdentity(this.root);
+    }
+    assertCurrent() {
+        if (this.closed || this.now() >= this.expiresAt)
+            unavailable();
+        this.assertRoot();
+    }
+    check(choice) {
+        this.assertCurrent();
+        for (const entry of choice.chain)
+            assertIdentity(entry);
+    }
+    get(token) {
+        const choice = typeof token === "string" && TOKEN.test(token) && this.choices.get(token);
+        if (!choice)
+            unavailable();
+        this.check(choice);
+        return choice;
+    }
+    add(parts, chain, parentToken) {
+        const existing = [...this.choices.values()].find((item) => item.parts.join("/") === parts.join("/"));
+        if (existing) {
+            this.check(existing);
+            return existing;
+        }
+        const bytes = Buffer.byteLength(join(this.rootPath, ...parts)) +
+            Buffer.byteLength(parts.join("/")) +
+            chain.length * 32 +
+            256;
+        if (this.choices.size >= MAX_TOKENS ||
+            parts.length > 64 ||
+            this.tokenBytes + bytes > MAX_TOKEN_BYTES)
+            unavailable();
+        const choice = {
+            token: randomBytes(18).toString("base64url"),
+            parts,
+            chain,
+            ...(parentToken ? { parentToken } : {}),
+        };
+        this.choices.set(choice.token, choice);
+        this.tokenBytes += bytes;
+        return choice;
+    }
+    async list(token, authorize) {
+        if (this.reading)
+            throw new PanelBridgeError("RATE_LIMITED", "目录正在读取，请稍后重试。", 50);
+        this.reading = true;
+        try {
+            const choice = this.get(token);
+            await authorize();
+            this.check(choice);
+            const directories = [];
+            let truncated = false;
+            {
+                const directory = await opendir(join(this.rootPath, ...choice.parts));
+                let scanned = 0;
+                try {
+                    this.check(choice);
+                    for await (const entry of directory) {
+                        this.check(choice);
+                        if (++scanned > MAX_SCAN) {
+                            truncated = true;
+                            break;
+                        }
+                        if (!entry.isDirectory() || entry.isSymbolicLink() || !visibleName(entry.name))
+                            continue;
+                        if (directories.length >= MAX_ENTRIES) {
+                            truncated = true;
+                            break;
+                        }
+                        const parts = [...choice.parts, entry.name];
+                        const path = join(this.rootPath, ...parts);
+                        let child;
+                        try {
+                            child = identity(path);
+                        }
+                        catch {
+                            continue;
+                        }
+                        const item = this.add(parts, [...choice.chain, child], choice.token);
+                        directories.push({ name: entry.name, token: item.token });
+                    }
+                }
+                finally {
+                    // for-await closes its directory; the explicit close covers failure before iteration.
+                    try {
+                        await directory.close();
+                    }
+                    catch {
+                        /* Already closed by the iterator. */
+                    }
+                }
+            }
+            await authorize();
+            this.check(choice);
+            for (const item of directories)
+                this.get(item.token);
+            return {
+                directoryToken: choice.token,
+                relativePath: choice.parts.join("/"),
+                name: choice.parts.at(-1) ?? (basename(this.rootPath) || this.rootPath),
+                ...(choice.parentToken ? { parentToken: choice.parentToken } : {}),
+                rootToken: this.rootToken,
+                directories: directories.sort((a, b) => a.name.localeCompare(b.name)),
+                truncated,
+            };
+        }
+        finally {
+            this.reading = false;
+        }
+    }
+    assertListing(listing) {
+        this.get(listing.directoryToken);
+        for (const item of listing.directories)
+            this.get(item.token);
+    }
+    /** Called synchronously after final authorization, while this exact confirmation is pending. */
+    select(token) {
+        const choice = this.get(token);
+        const path = join(this.rootPath, ...choice.parts);
+        const chain = [...choice.chain];
+        const assertCurrent = () => {
+            this.assertRoot();
+            for (const entry of chain)
+                assertIdentity(entry);
+        };
+        assertCurrent();
+        return { path, assertCurrent };
+    }
+}

package/dist/panels/http.d.ts

@@ -17,7 +17,7 @@ export declare function createPanelHttp(options: PanelManagementHttpOptions & {
     authorizePanelDirectory?: PanelDirectoryAuthorizer;
 }): {
     service: {
-        snapshot: (appId?: string) => Promise<import("./types.js").PanelSnapshot>;
+        snapshot: (appId?: string, reads?: import("./management.js").PanelSnapshotReads) => Promise<import("./types.js").PanelSnapshot>;
         packageHistory(context: import("./types.js").PanelOperationContext, id: unknown, expected: unknown): Promise<import("./types.js").PanelPackageHistory>;
         previewRestore(context: import("./types.js").PanelOperationContext, id: unknown, digest: unknown, expected: unknown): Promise<import("./types.js").PanelPackageRestoreReview>;
         cancelRestore(context: import("./types.js").PanelOperationContext, token: unknown): Promise<{

package/dist/panels/management-http.d.ts

@@ -8,7 +8,7 @@ export interface PanelManagementHttpOptions extends PanelManagementOptions {
 /** Call only after the host's same-origin authentication boundary. */
 export declare function createPanelManagementHttp(options: PanelManagementHttpOptions): {
     service: {
-        snapshot: (appId?: string) => Promise<import("./types.js").PanelSnapshot>;
+        snapshot: (appId?: string, reads?: import("./management.js").PanelSnapshotReads) => Promise<import("./types.js").PanelSnapshot>;
         packageHistory(context: PanelOperationContext, id: unknown, expected: unknown): Promise<import("./types.js").PanelPackageHistory>;
         previewRestore(context: PanelOperationContext, id: unknown, digest: unknown, expected: unknown): Promise<import("./types.js").PanelPackageRestoreReview>;
         cancelRestore(context: PanelOperationContext, token: unknown): Promise<{

package/dist/panels/management.d.ts

@@ -1,5 +1,5 @@
 import { type PanelExecutionScope } from "./execution-gate.js";
-import { type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
+import { type PanelAppInspectionReads, type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
 import type { PanelCompatibility, PanelDiscovery, PanelOperationContext, PanelReview, PanelProjectReview, PanelSnapshot, PanelPackageHistory, PanelPackageRestoreReview } from "./types.js";
 export declare class PanelManagementError extends Error {
     readonly status: number;
@@ -28,8 +28,17 @@ export interface PanelManagementOptions {
         repo: string;
     }, ref: string) => Promise<string>;
 }
+/**
+ * Verified reads shared by the snapshots of one multi-project request, so the
+ * same package is not re-verified once per project. Create one per request.
+ */
+export interface PanelSnapshotReads {
+    inspection: PanelAppInspectionReads;
+    digests: Map<string, Promise<string>>;
+}
+export declare function createPanelSnapshotReads(): PanelSnapshotReads;
 export declare function createPanelManagement(options: PanelManagementOptions): {
-    snapshot: (appId?: string) => Promise<PanelSnapshot>;
+    snapshot: (appId?: string, reads?: PanelSnapshotReads) => Promise<PanelSnapshot>;
     packageHistory(context: PanelOperationContext, id: unknown, expected: unknown): Promise<PanelPackageHistory>;
     previewRestore(context: PanelOperationContext, id: unknown, digest: unknown, expected: unknown): Promise<PanelPackageRestoreReview>;
     cancelRestore(context: PanelOperationContext, token: unknown): Promise<{

package/dist/panels/management.js

@@ -3,7 +3,7 @@ import { panelPackageMutationMatches } from "./package-mutation.js";
 import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, mkdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, join, resolve } from "node:path";
-import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, currentPanelAppPackagePins, installedPanelAppUpdatedAt, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
+import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, currentPanelAppPackagePins, installedPanelAppUpdatedAt, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, inspectInstalledPanelAppDigest, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
 import { mutateJsonFile } from "@cjhyy/code-shell-core/internal";
 import { parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
 const REVIEW_TTL = 8 * 60_000;
@@ -151,6 +151,9 @@ function assertRevision(revision) {
     if (typeof revision !== "string" || !/^[a-f0-9]{64}$/.test(revision))
         invalid();
 }
+export function createPanelSnapshotReads() {
+    return { inspection: { packages: new Map() }, digests: new Map() };
+}
 export function createPanelManagement(options) {
     const now = options.now ?? Date.now;
     const workspace = resolve(options.bindingCwd ?? options.cwd);
@@ -206,12 +209,17 @@ export function createPanelManagement(options) {
     const listApps = () => options.projectPackages
         ? inspectProjectPanelApps(workspace).then((result) => result.apps)
         : listInstalledPanelApps();
-    async function inspectApp(app) {
+    async function inspectApp(app, reads) {
         const info = lstatSync(app.installPath);
         if (info.isSymbolicLink() || !info.isDirectory())
             throw new PanelManagementError(403, "unsafe_path", "面板安装目录不支持链接。");
-        const preview = await previewLocalPanelApp({ kind: "dir", path: app.installPath });
-        return { app, digest: preview.reviewToken };
+        // Same digest a dir preview reports, without re-hashing unchanged installed bytes.
+        let digest = reads?.digests.get(app.installPath);
+        if (!digest) {
+            digest = inspectInstalledPanelAppDigest(app.installPath);
+            reads?.digests.set(app.installPath, digest);
+        }
+        return { app, digest: await digest };
     }
     async function selectedApp(id) {
         const app = (await listApps()).find((item) => item.id === id);
@@ -240,12 +248,12 @@ export function createPanelManagement(options) {
             commit: SHA.test(parsed.source.ref ?? "") ? parsed.source.ref : "",
         };
     }
-    async function snapshot(appId) {
+    async function snapshot(appId, reads) {
         if (appId !== undefined)
             assertSafePanelAppId(appId);
         options.assertBinding?.();
         const inspected = options.projectPackages
-            ? await inspectProjectPanelApps(workspace, appId)
+            ? await inspectProjectPanelApps(workspace, appId, reads?.inspection)
             : undefined;
         const apps = inspected?.apps ?? (await listInstalledPanelApps(appId));
         options.assertBinding?.();
@@ -268,7 +276,7 @@ export function createPanelManagement(options) {
                 .digest("hex"),
         }));
         for (const listed of apps) {
-            const { app, digest } = await inspectApp(listed);
+            const { app, digest } = await inspectApp(listed, reads);
             const source = savedSource(app, saved);
             const { installPath: _path, source: _source, installedAt: _installedAt, lastUpdated: _lastUpdated, ...publicApp } = app;
             const support = compatibility(app);

package/dist/panels/runtime.js

@@ -18,6 +18,7 @@ import { PanelTaskCookieHost } from "./task-cookie-host.js";
 import { taskCookieFromInput, taskCookieSelection, } from "./task-cookies.js";
 import { desktopPanelDirectoryBookmarks, hubPanelDirectoryBookmarks, } from "./directory-bookmarks.js";
 import { handlePanelProcessDirectory } from "./process-files.js";
+import { PanelDirectoryPicker, capturePanelWorkspaceDirectory, directoryPickerLifetime, } from "./directory-picker.js";
 import { PanelAppProcessService, panelExecutableDirectories, panelProcessInfo, } from "./process-service.js";
 import { PanelManagementError } from "./management.js";
 import { panelAutomationMethods } from "./automations.js";
@@ -305,7 +306,7 @@ function bridgeScript(id, origin) {
       const requestId = String(++next);
       const timer = setTimeout(() => {
         pending.delete(requestId); reject(new Error("Panel request timed out"));
-      }, ["tasks.start", "tasks.retry", "tasks.queue.set", "resources.recordAudio", "resources.recordVideo"].includes(method) ? 30 * 60 * 1000 : 60000);
+      }, ["tasks.start", "tasks.retry", "tasks.queue.set", "resources.recordAudio", "resources.recordVideo"].includes(method) ? 30 * 60 * 1000 : method === "filesystem.pickDirectory" ? 6 * 60 * 1000 : 60000);
       pending.set(requestId, { resolve, reject, timer });
       try {
         parent.postMessage({ type: "codeshell-panel:call", instanceId: id, requestId, method, params }, origin);
@@ -911,6 +912,52 @@ export function createPanelRuntime(options) {
         });
         return result && (await authorized(grant));
     }
+    async function pickDirectory(grant) {
+        if (!(await authorized(grant)))
+            error(410, "面板授权已失效。");
+        if ([...grant.confirmations.values()].some((item) => item.picker && item.result === undefined))
+            error(409, "请先完成当前目录选择。");
+        for (const [id, item] of grant.confirmations) {
+            if (item.result !== undefined)
+                grant.confirmations.delete(id);
+        }
+        if (grant.confirmations.size >= 64)
+            error(429, "待确认操作过多。");
+        const picker = new PanelDirectoryPicker(options.cwd, now);
+        const requestId = randomBytes(18).toString("base64url");
+        const pending = { picker };
+        const allowed = await new Promise((done) => {
+            const timer = setTimeout(() => pending.finish(false), directoryPickerLifetime);
+            timer.unref();
+            pending.finish = (value) => {
+                if (pending.result !== undefined)
+                    return;
+                pending.result = value;
+                clearTimeout(timer);
+                picker.close();
+                done(value);
+            };
+            grant.confirmations.set(requestId, pending);
+            emit(grant, "host.confirm", {
+                requestId,
+                title: options.host === "desktop" ? "选择电脑上的目录" : "选择服务器上的目录",
+                body: "仅可选择当前项目内的目录，确认后授予此面板使用。",
+                expiresAt: picker.expiresAt,
+                directoryPicker: {
+                    kind: "workspace-directory",
+                    rootPath: picker.rootPath,
+                    rootToken: picker.rootToken,
+                    initialToken: picker.initialToken,
+                },
+            });
+        });
+        if (!(await authorized(grant)))
+            error(410, "面板授权已失效。");
+        if (!allowed)
+            return undefined;
+        pending.selection.assertCurrent();
+        return pending.selection;
+    }
     function taskScope(grant) {
         return {
             instanceId: grant.id,
@@ -1166,12 +1213,19 @@ export function createPanelRuntime(options) {
                             consentTimeoutMs: 50000,
                         },
                     }),
-                    ...(app.permissions.includes("resources")
+                    ...(app.permissions.includes("resources") || app.permissions.includes("process")
                         ? {
                             methodLimits: {
-                                "resources.recordAudio": { timeoutMs: 30 * 60 * 1000 },
-                                "resources.recordVideo": { timeoutMs: 30 * 60 * 1000 },
+                                ...(app.permissions.includes("resources")
+                                    ? {
+                                        "resources.recordAudio": { timeoutMs: 30 * 60 * 1000 },
+                                        "resources.recordVideo": { timeoutMs: 30 * 60 * 1000 },
+                                    }
+                                    : {}),
                                 ...(app.permissions.includes("process")
+                                    ? { "filesystem.pickDirectory": { timeoutMs: 6 * 60_000 } }
+                                    : {}),
+                                ...(app.permissions.includes("process") && app.permissions.includes("resources")
                                     ? {
                                         "tasks.start": {
                                             maxParamsBytes: toolJobLimits.maxInputBytes,
@@ -1583,16 +1637,30 @@ export function createPanelRuntime(options) {
             if (method === "filesystem.restoreDirectory") {
                 await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
                 const saved = directoryBookmarks.restore(grant.app.id, options.bindingCwd ?? options.cwd, params?.bookmark);
-                if (!options.authorizePanelDirectory &&
-                    saved !== (await realpath(options.cwd)) &&
-                    saved !== (await realpath(join(options.cwd, "downloads"))))
-                    throw new PanelBridgeError("PERMISSION_DENIED", "Saved server directory is unavailable");
-                const restored = await processes.grantDirectory(owner, saved);
+                const workspaceSelection = !options.authorizePanelDirectory
+                    ? capturePanelWorkspaceDirectory(options.cwd, saved)
+                    : undefined;
+                const restored = await processes.grantDirectory(owner, saved, workspaceSelection);
                 await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
                 directoryBookmarks.restore(grant.app.id, options.bindingCwd ?? options.cwd, params?.bookmark);
+                workspaceSelection?.assertCurrent();
                 return { ...restored, bookmark: params.bookmark };
             }
-            const name = method === "filesystem.pickDirectory" ? "downloads" : params?.name;
+            if (method === "filesystem.pickDirectory") {
+                const selection = await pickDirectory(grant);
+                if (!selection)
+                    return { cancelled: true };
+                selection.assertCurrent();
+                const selected = await processes.grantDirectory(owner, selection.path, selection);
+                selection.assertCurrent();
+                if (!(await authorized(grant)))
+                    error(410, "面板授权已失效。");
+                selection.assertCurrent();
+                const bookmark = directoryBookmarks.remember(grant.app.id, options.bindingCwd ?? options.cwd, selected.path);
+                processes.directoryPath(owner, selected.handle);
+                return { ...selected, bookmark };
+            }
+            const name = params?.name;
             const directory = name === "project"
                 ? options.cwd
                 : name === "downloads"
@@ -1604,16 +1672,13 @@ export function createPanelRuntime(options) {
                             : undefined;
             if (!directory)
                 error(400, "不支持这个服务端目录。");
-            if (method === "filesystem.pickDirectory" &&
-                !(await confirm(grant, "使用服务端下载目录？", directory)))
-                return { cancelled: true };
             await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
             if (name !== "project")
                 await mkdir(directory, { recursive: true, mode: 0o700 });
             if (!(await authorized(grant)))
                 error(410, "面板授权已失效。");
             const selected = await processes.grantDirectory(owner, directory);
-            if (method !== "filesystem.pickDirectory" && !["downloads", "project"].includes(String(name)))
+            if (!["downloads", "project"].includes(String(name)))
                 return selected;
             const bookmark = directoryBookmarks.remember(grant.app.id, options.bindingCwd ?? options.cwd, selected.path);
             if (!(await authorized(grant)))
@@ -1780,7 +1845,7 @@ export function createPanelRuntime(options) {
                 }
                 const directoryMatch = /^\/api\/v1\/panels\/runtime\/([\w-]+)\/directory\/([a-f0-9-]{36})$/.exec(url.pathname);
                 const resourceMatch = /^\/api\/v1\/panels\/runtime\/([\w-]+)\/resources\/((?:asset|external)-[a-f0-9]{64})$/.exec(url.pathname);
-                const match = /^\/api\/v1\/panels\/runtime\/([\w-]+)(?:\/(call|renew|events|confirm|tool-results))?$/.exec(url.pathname) ??
+                const match = /^\/api\/v1\/panels\/runtime\/([\w-]+)(?:\/(call|renew|events|confirm|directory-picker|tool-results))?$/.exec(url.pathname) ??
                     directoryMatch ??
                     resourceMatch;
                 const grant = match && grants.get(match[1]);
@@ -1850,15 +1915,57 @@ export function createPanelRuntime(options) {
                     const batch = grant.events.slice(0, 128);
                     json(response, 200, { events: batch, cursor: batch.at(-1)?.id ?? after });
                 }
+                else if (request.method === "POST" && match[2] === "directory-picker") {
+                    if (request.headers.origin !== grant.origin)
+                        error(403, "目录选择仅供当前宿主页面使用。");
+                    const input = await body(request);
+                    if (Object.keys(input).some((key) => !["requestId", "directoryToken"].includes(key)))
+                        error(400, "目录选择参数无效。");
+                    const pending = typeof input.requestId === "string" && grant.confirmations.get(input.requestId);
+                    if (!pending || !pending.picker || pending.result !== undefined)
+                        error(409, "目录选择已失效，请重新发起。");
+                    const assertPending = async () => {
+                        if (!(await authorized(grant)))
+                            error(410, "面板授权已失效。");
+                        if (pending.result !== undefined || now() >= pending.picker.expiresAt) {
+                            pending.finish(false);
+                            error(409, "目录选择已失效，请重新发起。");
+                        }
+                    };
+                    await assertPending();
+                    const listing = await pending.picker.list(input.directoryToken, assertPending);
+                    await assertPending();
+                    pending.picker.assertListing(listing);
+                    json(response, 200, { requestId: input.requestId, ...listing });
+                }
                 else if (request.method === "POST" && match[2] === "confirm") {
                     const input = await body(request);
                     const pending = typeof input.requestId === "string" && grant.confirmations.get(input.requestId);
                     if (!pending ||
                         typeof input.allowed !== "boolean" ||
-                        Object.keys(input).some((key) => !["requestId", "allowed"].includes(key)))
+                        Object.keys(input).some((key) => !["requestId", "allowed", ...(pending?.picker ? ["directoryToken"] : [])].includes(key)) ||
+                        (input.allowed === false && input.directoryToken !== undefined))
                         error(400, "找不到这个待确认操作。");
                     if (!(await authorized(grant)))
                         error(410, "面板授权已失效。");
+                    if (pending.picker) {
+                        if (request.headers.origin !== grant.origin)
+                            error(403, "目录选择仅供当前宿主页面使用。");
+                        if (input.allowed) {
+                            if (pending.result === undefined) {
+                                if (now() >= pending.picker.expiresAt) {
+                                    pending.finish(false);
+                                    error(409, "目录选择已失效，请重新发起。");
+                                }
+                                pending.selection = pending.picker.select(input.directoryToken);
+                                pending.directoryToken = input.directoryToken;
+                            }
+                            else if (pending.result !== true ||
+                                input.directoryToken !== pending.directoryToken) {
+                                error(409, "目录选择已失效，请重新发起。");
+                            }
+                        }
+                    }
                     pending.finish(input.allowed);
                     json(response, 200, { accepted: true, allowed: pending.result });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.50",
+  "version": "0.9.52",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,14 +62,14 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.50",
-    "@cjhyy/code-shell-core": "0.9.50",
-    "@cjhyy/code-shell-web": "0.9.50",
+    "@cjhyy/code-shell-capability-coding": "0.9.52",
+    "@cjhyy/code-shell-core": "0.9.52",
+    "@cjhyy/code-shell-web": "0.9.52",
     "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.50",
-    "@cjhyy/code-shell-host": "0.9.50"
+    "@cjhyy/code-shell-link": "0.9.52",
+    "@cjhyy/code-shell-host": "0.9.52"
   },
   "engines": {
     "node": ">=20.10"