@co0ontty/wand 4.105.1 → 4.106.0

package/dist/storage/knowledge-repository.js

@@ -0,0 +1,208 @@
+import crypto from "node:crypto";
+import { isGlobalWorkspace } from "../workspace-binding.js";
+import { normalizeEmployeeKnowledge } from "../employee-knowledge-content.js";
+import { EMPLOYEE_KNOWLEDGE_MAX_ENTRIES } from "../employee-knowledge-types.js";
+import { KnowledgeError } from "../knowledge-types.js";
+const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const spec = (scope) => scope === "personal"
+    ? { table: "employee_knowledge", owner: "employee_id" }
+    : { table: "project_knowledge", owner: "workspace_id" };
+export class KnowledgeRepository {
+    db;
+    s;
+    constructor(db, s) {
+        this.db = db;
+        this.s = s;
+    }
+    #owner(scope, ownerId) {
+        if (scope === "personal") {
+            const employee = this.s.getSiliconEmployeeDefinition(ownerId);
+            if (!employee)
+                throw new KnowledgeError("员工已删除或不存在，不能改存到其他员工。", 404);
+            return { name: employee.name, readOnly: false };
+        }
+        const workspace = this.s.getWorkspace(ownerId);
+        if (workspace && !isGlobalWorkspace(workspace))
+            return { name: workspace.name, readOnly: false };
+        if (!workspace) {
+            const orphan = this.db.prepare("SELECT project_name FROM project_knowledge WHERE workspace_id = ? LIMIT 1").get(ownerId);
+            if (orphan)
+                return { name: `${String(orphan.project_name)}（已移除项目）`, readOnly: true };
+        }
+        throw new KnowledgeError("项目不存在，或当前空间不是项目知识库。", 404);
+    }
+    knowledgeOwners() {
+        const projects = this.s.listWorkspaces().filter(workspace => !isGlobalWorkspace(workspace))
+            .map(workspace => ({ id: workspace.id, name: workspace.name, readOnly: false }));
+        const orphans = this.db.prepare(`SELECT workspace_id, MAX(project_name) AS project_name FROM project_knowledge
+      WHERE NOT EXISTS (SELECT 1 FROM workspaces w WHERE w.id = workspace_id) GROUP BY workspace_id`).all();
+        for (const row of orphans)
+            projects.push({ id: String(row.workspace_id), name: `${String(row.project_name)}（已移除项目）`, readOnly: true });
+        return { employees: this.s.listSiliconEmployees({ includeArchived: true }).map(employee => ({ id: employee.id, name: employee.name })), projects };
+    }
+    #project(row, scope, ownerId) {
+        return { id: row.id, scope, ownerId, title: row.title || row.content.split(/\r?\n/).find(line => line.trim())?.trim().slice(0, 100) || "无标题文档",
+            content: row.content, folder: row.folder || "未分类", revision: row.revision, createdAt: row.created_at, updatedAt: row.updated_at || row.created_at };
+    }
+    readKnowledgeLibrary(scope, ownerId, query = "", accessToken) {
+        if (accessToken)
+            this.#requireAccess(accessToken, scope, ownerId);
+        const owner = this.#owner(scope, ownerId);
+        const { table, owner: column } = spec(scope);
+        const rows = this.db.prepare(`SELECT * FROM ${table} WHERE ${column} = ? ORDER BY COALESCE(updated_at, created_at) DESC, rowid DESC LIMIT ?`)
+            .all(ownerId, EMPLOYEE_KNOWLEDGE_MAX_ENTRIES);
+        const normalizedQuery = query.trim().slice(0, 200).toLocaleLowerCase();
+        const entries = rows.map(row => this.#project(row, scope, ownerId))
+            .filter(entry => `${entry.title}\n${entry.content}\n${entry.folder}`.toLocaleLowerCase().includes(normalizedQuery));
+        return { scope, ownerId, ownerName: owner.name, readOnly: owner.readOnly, entries, total: rows.length, limit: EMPLOYEE_KNOWLEDGE_MAX_ENTRIES };
+    }
+    getKnowledgeDocument(scope, ownerId, id, accessToken) {
+        if (accessToken)
+            this.#requireAccess(accessToken, scope, ownerId);
+        this.#owner(scope, ownerId);
+        const { table, owner } = spec(scope);
+        const row = this.db.prepare(`SELECT * FROM ${table} WHERE ${owner} = ? AND id = ?`).get(ownerId, id);
+        if (!row)
+            throw new KnowledgeError("文档不属于当前知识库或已删除。", 404);
+        return this.#project(row, scope, ownerId);
+    }
+    #normalize(input) {
+        let content;
+        try {
+            content = normalizeEmployeeKnowledge(input.content);
+        }
+        catch (error) {
+            throw new KnowledgeError(error.message);
+        }
+        const title = (input.title ?? "").trim();
+        const folder = (input.folder ?? "").trim();
+        if (title.length > 100 || folder.length > 100)
+            throw new KnowledgeError("标题和目录名最多 100 个字符。");
+        // The same credential guard covers metadata, without imposing the body non-empty rule on optional fields.
+        for (const value of [title, folder])
+            if (value) {
+                try {
+                    normalizeEmployeeKnowledge(value);
+                }
+                catch (error) {
+                    throw new KnowledgeError(error.message);
+                }
+            }
+        return { content, title, folder };
+    }
+    createKnowledgeDocument(scope, ownerId, input, accessToken) {
+        const values = this.#normalize(input);
+        return this.s.transaction(() => {
+            if (accessToken)
+                this.#requireAccess(accessToken, scope, ownerId);
+            const owner = this.#owner(scope, ownerId);
+            if (owner.readOnly)
+                throw new KnowledgeError("项目已移除，知识保留供查看和删除，不能新增或编辑。", 409);
+            const { table, owner: column } = spec(scope);
+            const contentHash = hash(values.content);
+            const existing = this.db.prepare(`SELECT * FROM ${table} WHERE ${column} = ? AND content_hash = ?`).get(ownerId, contentHash);
+            if (existing)
+                return { entry: this.#project(existing, scope, ownerId), created: false };
+            const count = Number(this.db.prepare(`SELECT COUNT(*) AS count FROM ${table} WHERE ${column} = ?`).get(ownerId)?.count ?? 0);
+            if (count >= EMPLOYEE_KNOWLEDGE_MAX_ENTRIES)
+                throw new KnowledgeError("知识库已满，请先删除不需要的文档；不会自动丢弃旧知识。");
+            const id = `${scope === "personal" ? "k" : "pk"}_${crypto.randomUUID().replace(/-/g, "")}`;
+            const now = new Date().toISOString();
+            if (scope === "personal")
+                this.db.prepare(`INSERT INTO employee_knowledge (id, employee_id, title, folder, content, content_hash, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(id, ownerId, values.title, values.folder, values.content, contentHash, now, now);
+            else
+                this.db.prepare(`INSERT INTO project_knowledge (id, workspace_id, project_name, title, folder, content, content_hash, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, ownerId, owner.name, values.title, values.folder, values.content, contentHash, now, now);
+            return { entry: this.getKnowledgeDocument(scope, ownerId, id), created: true };
+        });
+    }
+    updateKnowledgeDocument(scope, ownerId, id, revision, input, accessToken) {
+        const values = this.#normalize(input);
+        return this.s.transaction(() => {
+            if (accessToken)
+                this.#requireAccess(accessToken, scope, ownerId);
+            const owner = this.#owner(scope, ownerId);
+            if (owner.readOnly)
+                throw new KnowledgeError("项目已移除，知识保留供查看和删除，不能新增或编辑。", 409);
+            const previous = this.getKnowledgeDocument(scope, ownerId, id);
+            if (previous.revision !== revision)
+                throw new KnowledgeError("这篇文档已被修改。请重新读取，保留并核对当前草稿后再保存。", 409);
+            const { table, owner: column } = spec(scope);
+            const contentHash = hash(values.content);
+            const duplicate = this.db.prepare(`SELECT id FROM ${table} WHERE ${column} = ? AND content_hash = ? AND id != ?`).get(ownerId, contentHash, id);
+            if (duplicate)
+                throw new KnowledgeError("当前知识库已有相同正文，请核对后保留一篇。");
+            this.db.prepare(`UPDATE ${table} SET title = ?, folder = ?, content = ?, content_hash = ?, updated_at = ?, revision = revision + 1
+        WHERE ${column} = ? AND id = ? AND revision = ?`).run(values.title, values.folder, values.content, contentHash, new Date().toISOString(), ownerId, id, revision);
+            // An older execution must not recreate the previous fact after the user corrected it.
+            this.invalidateKnowledgeNamespace(scope, ownerId);
+            return this.getKnowledgeDocument(scope, ownerId, id);
+        });
+    }
+    deleteKnowledgeDocument(scope, ownerId, id, revision, accessToken) {
+        this.s.transaction(() => {
+            if (accessToken)
+                this.#requireAccess(accessToken, scope, ownerId);
+            const previous = this.getKnowledgeDocument(scope, ownerId, id);
+            if (previous.revision !== revision)
+                throw new KnowledgeError("文档已变化，请重新读取后再确认删除。", 409);
+            const { table, owner } = spec(scope);
+            this.db.prepare(`DELETE FROM ${table} WHERE ${owner} = ? AND id = ?`).run(ownerId, id);
+            this.invalidateKnowledgeNamespace(scope, ownerId);
+        });
+    }
+    invalidateKnowledgeNamespace(scope, ownerId) {
+        this.db.prepare(`INSERT INTO knowledge_namespace_versions(scope, owner_id, revision) VALUES (?, ?, 1)
+      ON CONFLICT(scope, owner_id) DO UPDATE SET revision = revision + 1`).run(scope, ownerId);
+        if (scope === "personal")
+            this.db.prepare("DELETE FROM employee_knowledge_access WHERE employee_id = ?").run(ownerId);
+    }
+    #namespaceRevision(scope, ownerId) {
+        return ownerId ? Number(this.db.prepare("SELECT revision FROM knowledge_namespace_versions WHERE scope = ? AND owner_id = ?").get(scope, ownerId)?.revision ?? 0) : 0;
+    }
+    /** Only persisted bindings count; legacy UI identity projections are not authority. */
+    knowledgeSessionScope(sessionId) {
+        const session = this.db.prepare(`SELECT automation_id,
+      CASE WHEN json_valid(session_options) THEN json_extract(session_options, '$.employeeId') END AS employee_id
+      FROM command_sessions WHERE id = ?`).get(sessionId);
+        if (!session || (typeof session.automation_id === "string" && session.automation_id.startsWith("dingtalk:")))
+            return null;
+        const employeeId = typeof session.employee_id === "string" && this.s.getSiliconEmployeeDefinition(session.employee_id) ? session.employee_id : null;
+        const binding = this.s.getSessionWorkspace(sessionId);
+        const task = binding?.workspaceTaskId ? this.s.getWorkspaceTask(binding.workspaceTaskId) : null;
+        const workspace = binding?.workspaceId ? this.s.getWorkspace(binding.workspaceId) : null;
+        const workspaceId = workspace && !isGlobalWorkspace(workspace) && (!binding?.workspaceTaskId || task?.workspaceId === workspace.id) ? workspace.id : null;
+        return employeeId || workspaceId ? { sessionId, employeeId, workspaceId } : null;
+    }
+    issueKnowledgeAccess(sessionId, now = Date.now()) {
+        const scope = this.knowledgeSessionScope(sessionId);
+        if (!scope)
+            throw new KnowledgeError("当前会话未绑定可用员工或项目，知识库能力不可用。", 403);
+        this.db.prepare("DELETE FROM knowledge_access WHERE expires_at <= ?").run(now);
+        const token = crypto.randomBytes(32).toString("base64url");
+        this.db.prepare(`INSERT INTO knowledge_access (token_hash, session_id, employee_id, workspace_id, employee_revision, project_revision, expires_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)`).run(hash(token), sessionId, scope.employeeId, scope.workspaceId, this.#namespaceRevision("personal", scope.employeeId), this.#namespaceRevision("project", scope.workspaceId), now + 6 * 3600_000);
+        return token;
+    }
+    resolveKnowledgeAccess(token, now = Date.now()) {
+        if (!/^[A-Za-z0-9_-]{43}$/.test(token))
+            return null;
+        const row = this.db.prepare("SELECT * FROM knowledge_access WHERE token_hash = ? AND expires_at > ?").get(hash(token), now);
+        if (!row)
+            return null;
+        const current = this.knowledgeSessionScope(String(row.session_id));
+        if (!current || current.employeeId !== row.employee_id || current.workspaceId !== row.workspace_id
+            || this.#namespaceRevision("personal", current.employeeId) !== row.employee_revision
+            || this.#namespaceRevision("project", current.workspaceId) !== row.project_revision)
+            return null;
+        return current;
+    }
+    revokeKnowledgeAccess(token) { this.db.prepare("DELETE FROM knowledge_access WHERE token_hash = ?").run(hash(token)); }
+    revokeSessionKnowledgeAccess(sessionId) { this.db.prepare("DELETE FROM knowledge_access WHERE session_id = ?").run(sessionId); }
+    #requireAccess(token, scope, ownerId) {
+        const access = this.resolveKnowledgeAccess(token);
+        if ((scope === "personal" ? access?.employeeId : access?.workspaceId) !== ownerId)
+            throw new KnowledgeError("知识库归属已变化或访问已失效，请等待新的会话执行。", 403);
+    }
+}

package/dist/storage/mappers.js

@@ -330,7 +330,7 @@ export function normalizeWorktreeMergeStatus(raw) {
     return undefined;
 }
 export function normalizeSessionSource(raw) {
-    return raw === "automation" || raw === "startup" || raw === "interactive" ? raw : "interactive";
+    return raw === "automation" || raw === "startup" || raw === "interactive" || raw === "quick-terminal" ? raw : "interactive";
 }
 export function mapWorktreeMergeFields(row) {
     return {

package/dist/storage/migrations.js

@@ -9,6 +9,49 @@ import { isThinkingEffort } from "../structured-provider-common.js";
 import { DEFAULT_WAND_TASK_PRIORITY, normalizeWandTaskAgentMode } from "../task-types.js";
 import { GLOBAL_WORKSPACE_ID } from "../types.js";
 import { mapSessionCore, parseWandTaskAgent, sessionSelectFields } from "./mappers.js";
+/** Additive, idempotent initialization; legacy content and IDs are never rewritten. */
+function migrateKnowledgeDocumentsV22(db) {
+    const columns = new Set(db.prepare("PRAGMA table_info(employee_knowledge)").all().map(row => row.name));
+    for (const [name, definition] of [["title", "TEXT NOT NULL DEFAULT ''"], ["folder", "TEXT NOT NULL DEFAULT ''"], ["revision", "INTEGER NOT NULL DEFAULT 1"], ["updated_at", "TEXT"]]) {
+        if (!columns.has(name))
+            db.exec(`ALTER TABLE employee_knowledge ADD COLUMN ${name} ${definition}`);
+    }
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS project_knowledge (
+      id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, project_name TEXT NOT NULL,
+      title TEXT NOT NULL DEFAULT '', folder TEXT NOT NULL DEFAULT '', content TEXT NOT NULL,
+      content_hash TEXT NOT NULL, revision INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL, updated_at TEXT, UNIQUE(workspace_id, content_hash)
+    );
+    CREATE INDEX IF NOT EXISTS idx_project_knowledge_owner ON project_knowledge(workspace_id);
+    CREATE TABLE IF NOT EXISTS knowledge_namespace_versions (
+      scope TEXT NOT NULL, owner_id TEXT NOT NULL, revision INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY(scope, owner_id)
+    );
+    CREATE TABLE IF NOT EXISTS knowledge_access (
+      token_hash TEXT PRIMARY KEY, session_id TEXT NOT NULL REFERENCES command_sessions(id) ON DELETE CASCADE,
+      employee_id TEXT, workspace_id TEXT, employee_revision INTEGER NOT NULL,
+      project_revision INTEGER NOT NULL, expires_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_knowledge_access_session ON knowledge_access(session_id);
+    CREATE TRIGGER IF NOT EXISTS revoke_knowledge_access_on_session_binding
+    AFTER UPDATE OF workspace_id, workspace_task_id, session_options, automation_id ON command_sessions
+    WHEN OLD.workspace_id IS NOT NEW.workspace_id
+      OR OLD.workspace_task_id IS NOT NEW.workspace_task_id
+      OR OLD.automation_id IS NOT NEW.automation_id
+      OR (CASE WHEN json_valid(OLD.session_options) THEN json_extract(OLD.session_options, '$.employeeId') END)
+        IS NOT (CASE WHEN json_valid(NEW.session_options) THEN json_extract(NEW.session_options, '$.employeeId') END)
+    BEGIN
+      DELETE FROM knowledge_access WHERE session_id = NEW.id;
+      DELETE FROM employee_knowledge_access WHERE session_id = NEW.id;
+    END;
+    CREATE TRIGGER IF NOT EXISTS revoke_knowledge_access_on_employee_delete
+    AFTER DELETE ON silicon_employees
+    BEGIN
+      DELETE FROM knowledge_access WHERE employee_id = OLD.id;
+    END;
+  `);
+}
 const LEGACY_TASK_RECORDS_KEY = "pref:taskRecordsVersion";
 function nowIsoFrozen() {
     return new Date().toISOString();
@@ -352,4 +395,12 @@ export const STORAGE_MIGRATIONS = [
   `) },
     { version: 20, name: "apns-device-subscriptions-and-outbox", up: db => db.exec(APNS_SCHEMA) },
     { version: 21, name: "apns-live-activity-updates", up: db => db.exec(LIVE_ACTIVITY_SCHEMA) },
+    { version: 22, name: "scoped-knowledge-documents", up: migrateKnowledgeDocumentsV22 },
+    { version: 23, name: "task-retention-archive-provenance", up: db => {
+            const columns = db.prepare("PRAGMA table_info(wand_tasks)").all();
+            if (!columns.some(column => column.name === "retention_archive_version")) {
+                // NULL deliberately protects every pre-policy archive, even if it was once accepted.
+                db.exec("ALTER TABLE wand_tasks ADD COLUMN retention_archive_version INTEGER");
+            }
+        } },
 ];

package/dist/storage/sessions-repository.d.ts

@@ -8,6 +8,8 @@ export declare class SessionRepository {
     private readonly db;
     private readonly s;
     constructor(db: DatabaseSync, s: WandStorage);
+    /** Change only the client surface binding; preserve the process, transcript and task membership. */
+    claimQuickTerminal(id: string): SessionSnapshot;
     listGithubIssueBindings(owner: string, repo: string, issueNumber: number): Array<{
         sessionId: string;
         boundAt: string;

package/dist/storage/sessions-repository.js

@@ -4,6 +4,8 @@ import { nowIso } from "../password-manager.js";
 import { sessionSelectFields, sessionPersistFields, sessionPersistAssignments, sessionRuntimeMetadataAssignments, mapSessionCore, sessionRowQuery } from "./mappers.js";
 import { SYSTEM_AI_AUXILIARY_PURPOSES, SYSTEM_AI_CALL_PREFIX } from "../system-ai-call.js";
 import { validPiCliCheckpoint } from "../pi-cli-checkpoint.js";
+import { canClaimQuickTerminal } from "../quick-terminal-session.js";
+import { badRequest, notFound } from "../http-error.js";
 const AUXILIARY_HISTORY_PATTERNS = SYSTEM_AI_AUXILIARY_PURPOSES.map(purpose => `${SYSTEM_AI_CALL_PREFIX}${purpose}:?*`);
 /** Session storage: one domain of the WandStorage facade. Shares the connection and the facade's transaction. */
 export class SessionRepository {
@@ -13,6 +15,20 @@ export class SessionRepository {
         this.db = db;
         this.s = s;
     }
+    /** Change only the client surface binding; preserve the process, transcript and task membership. */
+    claimQuickTerminal(id) {
+        return this.s.transaction(() => {
+            const session = this.getSession(id);
+            if (!session)
+                throw notFound("未找到该终端，可能已被删除。");
+            if (!canClaimQuickTerminal(session))
+                throw badRequest("只有普通空白终端可以作为快捷终端。");
+            if (session.sessionSource !== "quick-terminal") {
+                this.db.prepare("UPDATE command_sessions SET session_source = 'quick-terminal' WHERE id = ?").run(id);
+            }
+            return { ...session, sessionSource: "quick-terminal" };
+        });
+    }
     listGithubIssueBindings(owner, repo, issueNumber) {
         const rows = this.db.prepare(`SELECT session_id, bound_at FROM github_issue_bindings
        WHERE owner = ? AND repo = ? AND issue_number = ? ORDER BY bound_at ASC`).all(owner, repo, issueNumber);

package/dist/storage/tasks-repository.d.ts

@@ -106,6 +106,13 @@ export declare class TaskRepository {
     recordTaskCommentSessionEvent(event: import("../types.js").ProcessEvent): void;
     getWandTask(id: string): WandTask | null;
     getWandTaskByWorkspaceTaskId(workspaceTaskId: string): WandTask | null;
+    /** Internal retention facts only: no settings, transcripts, or public DTO fields. */
+    taskRetentionArchiveVersions(): Map<string, number>;
+    taskCommentRetentionFacts(): Array<{
+        taskId: string;
+        sessionId: string | null;
+        state: string;
+    }>;
     insertWandTask(input: CreateWandTaskInput, createdAt?: string): WandTask;
     private insertWandTaskBody;
     createWandTask(input: CreateWandTaskInput): WandTask;

package/dist/storage/tasks-repository.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { assertTaskHierarchy } from "../task-hierarchy.js";
+import { TASK_RETENTION_ARCHIVE_VERSION } from "../task-retention.js";
 import { firstLayoutTabId } from "../layout-tree.js";
 import { nowIso } from "../password-manager.js";
 import { isSessionProvider } from "../session-provider.js";
@@ -426,6 +427,17 @@ export class TaskRepository {
             .get(workspaceTaskId);
         return row ? this.mapWandTaskRow(row) : null;
     }
+    /** Internal retention facts only: no settings, transcripts, or public DTO fields. */
+    taskRetentionArchiveVersions() {
+        const rows = this.db.prepare("SELECT id, retention_archive_version FROM wand_tasks WHERE status = 'archived' AND retention_archive_version IS NOT NULL")
+            .all();
+        return new Map(rows.map(row => [row.id, row.retention_archive_version]));
+    }
+    taskCommentRetentionFacts() {
+        return this.db.prepare("SELECT task_id, session_id, state FROM wand_task_comment_dispatches")
+            .all()
+            .map(row => ({ taskId: row.task_id, sessionId: row.session_id, state: row.state }));
+    }
     insertWandTask(input, createdAt = nowIso()) {
         return this.s.transaction(() => this.insertWandTaskBody(input, createdAt));
     }
@@ -453,6 +465,10 @@ export class TaskRepository {
             }
             throw error;
         }
+        if (status === "archived") {
+            this.db.prepare("UPDATE wand_tasks SET retention_archive_version = ? WHERE id = ?")
+                .run(TASK_RETENTION_ARCHIVE_VERSION, id);
+        }
         if (input.parentTaskId) {
             const parent = this.getWandTask(input.parentTaskId);
             if (parent?.acceptance?.acceptedAt)
@@ -537,6 +553,11 @@ export class TaskRepository {
       archived_at = ?, updated_at = ?, acceptance_json = ?
       WHERE id = ?`)
             .run(next.workspaceId, next.workspaceTaskId, next.parentTaskId, next.title, next.titleSource, next.autoTitleSignature ?? null, next.description, next.status, next.priority, JSON.stringify(next.labels), next.dueDate, next.milestoneId ?? null, next.sortOrder, next.agent ? JSON.stringify(next.agent) : null, next.executionSubject ? JSON.stringify(next.executionSubject) : null, next.archivedAt, next.updatedAt, next.acceptance ? JSON.stringify(next.acceptance) : null, next.id);
+        // Only a real transition may opt into the new policy. Editing/backfilling an old archive must not do so.
+        if (next.status !== current.status) {
+            this.db.prepare("UPDATE wand_tasks SET retention_archive_version = ? WHERE id = ?")
+                .run(next.status === "archived" ? TASK_RETENTION_ARCHIVE_VERSION : null, next.id);
+        }
         if (patch.workspaceId !== undefined && next.workspaceTaskId) {
             const workspaceId = next.workspaceId ?? this.s.ensureGlobalWorkspace().id;
             // The container FK/index and standalone session workspace bucket follow the canonical project.

package/dist/storage/workspaces-repository.d.ts

@@ -38,6 +38,7 @@ export declare class WorkspaceRepository {
     countSessionsByWorkspace(options?: {
         includeArchived?: boolean;
         excludeSystemAiCalls?: boolean;
+        excludeQuickTerminals?: boolean;
     }): Map<string, number>;
     /** Count user-initiated CLI launches (one per session), including archived sessions. */
     countInteractiveSessionsByProvider(): Record<SessionProvider, number>;

package/dist/storage/workspaces-repository.js

@@ -175,8 +175,9 @@ export class WorkspaceRepository {
              ORDER BY updated_at DESC, rowid DESC LIMIT 1
            ), '') <> 'archived'))
            AND (? = 0 OR COALESCE(session.automation_id, '') NOT GLOB ?)
+           AND (? = 0 OR session.session_source <> 'quick-terminal')
          GROUP BY session.workspace_id`)
-            .all(options.includeArchived === true ? 1 : 0, options.excludeSystemAiCalls === true ? 1 : 0, `${SYSTEM_AI_CALL_PREFIX}*`);
+            .all(options.includeArchived === true ? 1 : 0, options.excludeSystemAiCalls === true ? 1 : 0, `${SYSTEM_AI_CALL_PREFIX}*`, options.excludeQuickTerminals === true ? 1 : 0);
         return new Map(rows.map((row) => [row.id, Number(row.n) || 0]));
     }
     /** Count user-initiated CLI launches (one per session), including archived sessions. */

package/dist/storage.d.ts

@@ -11,6 +11,7 @@ import { PreferencesRepository } from "./storage/preferences-repository.js";
 import { WorkspaceRepository } from "./storage/workspaces-repository.js";
 import { TaskRepository } from "./storage/tasks-repository.js";
 import { SecretsRepository } from "./storage/secrets-repository.js";
+import { KnowledgeRepository } from "./storage/knowledge-repository.js";
 import { EmployeeRepository } from "./storage/employees-repository.js";
 import { UserMemoryRepository } from "./storage/user-memory-repository.js";
 import { AiTeamRepository } from "./storage/ai-teams-repository.js";
@@ -25,7 +26,7 @@ export { ensureDatabaseFile } from "./storage-schema.js";
 type RepositoryMethods<T> = Pick<T, {
     [K in keyof T]: T[K] extends (...args: never[]) => unknown ? K : never;
 }[keyof T]>;
-export interface WandStorage extends RepositoryMethods<DingTalkRepository>, RepositoryMethods<ConversationRepository>, RepositoryMethods<ConversationOrganizationRepository>, RepositoryMethods<PreferencesRepository>, RepositoryMethods<WorkspaceRepository>, RepositoryMethods<TaskRepository>, RepositoryMethods<SecretsRepository>, RepositoryMethods<EmployeeRepository>, RepositoryMethods<UserMemoryRepository>, RepositoryMethods<AiTeamRepository>, RepositoryMethods<MissionRepository>, RepositoryMethods<SessionRepository>, RepositoryMethods<UploadRepository>, RepositoryMethods<FeedbackRepository> {
+export interface WandStorage extends RepositoryMethods<DingTalkRepository>, RepositoryMethods<ConversationRepository>, RepositoryMethods<ConversationOrganizationRepository>, RepositoryMethods<PreferencesRepository>, RepositoryMethods<WorkspaceRepository>, RepositoryMethods<TaskRepository>, RepositoryMethods<SecretsRepository>, RepositoryMethods<EmployeeRepository>, RepositoryMethods<KnowledgeRepository>, RepositoryMethods<UserMemoryRepository>, RepositoryMethods<AiTeamRepository>, RepositoryMethods<MissionRepository>, RepositoryMethods<SessionRepository>, RepositoryMethods<UploadRepository>, RepositoryMethods<FeedbackRepository> {
 }
 export declare class WandStorage {
     readonly dingtalk: DingTalkRepository;
@@ -38,6 +39,7 @@ export declare class WandStorage {
     readonly tasks: TaskRepository;
     readonly secrets: SecretsRepository;
     readonly employees: EmployeeRepository;
+    readonly knowledge: KnowledgeRepository;
     readonly userMemory: UserMemoryRepository;
     readonly aiTeams: AiTeamRepository;
     readonly missions: MissionRepository;

package/dist/storage.js

@@ -14,6 +14,7 @@ import { PreferencesRepository } from "./storage/preferences-repository.js";
 import { WorkspaceRepository } from "./storage/workspaces-repository.js";
 import { TaskRepository } from "./storage/tasks-repository.js";
 import { SecretsRepository } from "./storage/secrets-repository.js";
+import { KnowledgeRepository } from "./storage/knowledge-repository.js";
 import { EmployeeRepository } from "./storage/employees-repository.js";
 import { UserMemoryRepository } from "./storage/user-memory-repository.js";
 import { AiTeamRepository } from "./storage/ai-teams-repository.js";
@@ -34,6 +35,7 @@ export class WandStorage {
     tasks;
     secrets;
     employees;
+    knowledge;
     userMemory;
     aiTeams;
     missions;
@@ -100,6 +102,7 @@ export class WandStorage {
         this.tasks = new TaskRepository(this.db, this);
         this.secrets = new SecretsRepository(this.db, this);
         this.employees = new EmployeeRepository(this.db, this);
+        this.knowledge = new KnowledgeRepository(this.db, this);
         this.userMemory = new UserMemoryRepository(this.db, this);
         this.aiTeams = new AiTeamRepository(this.db, this);
         this.missions = new MissionRepository(this.db, this);
@@ -255,6 +258,7 @@ const REPOSITORY_FORWARDS = [
     ["tasks", TaskRepository],
     ["secrets", SecretsRepository],
     ["employees", EmployeeRepository],
+    ["knowledge", KnowledgeRepository],
     ["userMemory", UserMemoryRepository],
     ["aiTeams", AiTeamRepository],
     ["missions", MissionRepository],

package/dist/structured-session-manager.d.ts

@@ -96,6 +96,8 @@ export declare class StructuredSessionManager {
     private readonly autoAssignPending;
     private readonly preserveQueueOnInterrupt;
     private readonly interruptedScheduling;
+    /** 排队条「立即发送」中断后要补发的那条，也不得再回到员工并发排队。 */
+    private readonly interruptedImmediateStart;
     private employeeInputAdmission;
     private inputSequence;
     /** Last wall-clock time (ms) a streaming checkpoint reached SQLite. */
@@ -249,6 +251,7 @@ export declare class StructuredSessionManager {
         idempotencyKey?: string;
         preserveQueue?: boolean;
         queueAlreadyRemoved?: boolean;
+        immediateStart?: boolean;
         teamRequestStarted?: (sessionId: string, requestId: string) => void;
         source?: EmployeeInputScheduling["source"];
         scheduling?: EmployeeInputScheduling;

package/dist/structured-session-manager.js

@@ -118,6 +118,8 @@ export class StructuredSessionManager {
     autoAssignPending = new Map();
     preserveQueueOnInterrupt = new Set();
     interruptedScheduling = new Map();
+    /** 排队条「立即发送」中断后要补发的那条，也不得再回到员工并发排队。 */
+    interruptedImmediateStart = new Set();
     employeeInputAdmission = null;
     inputSequence = 0;
     /** Last wall-clock time (ms) a streaming checkpoint reached SQLite. */
@@ -421,6 +423,7 @@ export class StructuredSessionManager {
         this.pendingRunnerExecutions.clear();
         this.interruptedWith.clear();
         this.interruptedScheduling.clear();
+        this.interruptedImmediateStart.clear();
         this.preserveQueueOnInterrupt.clear();
         for (const token of this.autoAssignPending.values())
             token.cancelled = true;
@@ -982,8 +985,9 @@ export class StructuredSessionManager {
             this.preserveQueueOnInterrupt.delete(sessionId);
             const scheduling = this.interruptedScheduling.get(sessionId);
             this.interruptedScheduling.delete(sessionId);
+            const immediateStart = this.interruptedImmediateStart.delete(sessionId);
             setImmediate(() => {
-                this.sendMessage(sessionId, interruptPrompt, { scheduling }).catch((error) => {
+                this.sendMessage(sessionId, interruptPrompt, { scheduling, immediateStart }).catch((error) => {
                     console.error("[WAND] recovered interrupt-and-send failed:", error);
                 });
             });
@@ -1082,6 +1086,7 @@ export class StructuredSessionManager {
         }
         this.interruptedWith.delete(sessionId);
         this.interruptedScheduling.delete(sessionId);
+        this.interruptedImmediateStart.delete(sessionId);
         this.preserveQueueOnInterrupt.delete(sessionId);
         this.clearStreamingCheckpoint(sessionId);
         this.disarmCandidateStartupWatchdog(sessionId);
@@ -1524,7 +1529,7 @@ export class StructuredSessionManager {
         if ("result" in inFlight)
             return inFlight.result;
         session = inFlight.session;
-        if (session.employeeId && this.employeeInputAdmission && !this.employeeInputAdmission.canStart(session, scheduling)) {
+        if (session.employeeId && this.employeeInputAdmission && !this.employeeInputAdmission.canStart(session, scheduling, opts?.immediateStart)) {
             return this.enqueueInput(session, prompt, false, scheduling);
         }
         if (isAutoAssignSelector(session.selectedModel)) {
@@ -1545,7 +1550,7 @@ export class StructuredSessionManager {
         // await, so the drain cannot observe idle and then admit a new Core turn.
         if (this.coreRestartDrains > 0 && this.usesCoreEngine(session))
             return this.enqueueInput(session, prompt, false, scheduling);
-        if (session.employeeId && this.employeeInputAdmission && !this.employeeInputAdmission.canStart(session, scheduling)) {
+        if (session.employeeId && this.employeeInputAdmission && !this.employeeInputAdmission.canStart(session, scheduling, opts?.immediateStart)) {
             return this.enqueueInput(session, prompt, true, scheduling);
         }
         // 检测上一轮 assistant 是否有未配对的 AskUserQuestion tool_use（说明前一次
@@ -1667,6 +1672,8 @@ export class StructuredSessionManager {
         this.interruptedWith.set(id, prompt);
         if (opts.scheduling)
             this.interruptedScheduling.set(id, opts.scheduling);
+        if (opts.immediateStart)
+            this.interruptedImmediateStart.add(id);
         let current = session;
         if (opts.preserveQueue) {
             this.preserveQueueOnInterrupt.add(id);
@@ -1996,6 +2003,7 @@ export class StructuredSessionManager {
                 interrupt: inFlight,
                 preserveQueue: inFlight,
                 queueAlreadyRemoved: true,
+                immediateStart: true,
                 idempotencyKey,
                 source: "user",
             });
@@ -2945,8 +2953,9 @@ export class StructuredSessionManager {
             this.preserveQueueOnInterrupt.delete(sessionId);
             const scheduling = this.interruptedScheduling.get(sessionId);
             this.interruptedScheduling.delete(sessionId);
+            const immediateStart = this.interruptedImmediateStart.delete(sessionId);
             setImmediate(() => {
-                this.sendMessage(sessionId, interruptPrompt, { scheduling }).catch((error) => {
+                this.sendMessage(sessionId, interruptPrompt, { scheduling, immediateStart }).catch((error) => {
                     console.error("[WAND] interrupt-and-send failed:", error);
                 });
             });

package/dist/task-action-types.d.ts

@@ -0,0 +1,22 @@
+/** Read-only navigation projection; not a task status, queue, or mutation protocol. */
+export type TaskActionKind = "permission" | "question" | "plan" | "reply" | "review" | "blocker";
+export interface TaskActionItem {
+    key: string;
+    taskId: string;
+    identifier: string;
+    title: string;
+    workspaceId: string | null;
+    kind: TaskActionKind;
+    reason: string;
+    source: {
+        sessionId?: string;
+        requestId?: string;
+        toolId?: string;
+        runId?: string;
+    };
+}
+export interface TaskActionsSnapshot {
+    items: TaskActionItem[];
+    /** Non-zero means counts are lower bounds, never a verified empty inbox. */
+    incompleteSources: number;
+}

package/dist/task-action-types.js

@@ -0,0 +1 @@
+export {};

package/dist/task-actions.d.ts

@@ -0,0 +1,5 @@
+import type { SessionRegistry } from "./session-registry.js";
+import type { WandStorage } from "./storage.js";
+import type { TaskActionsSnapshot } from "./task-action-types.js";
+/** Read-only, runtime-backed navigation. No stored transcript hydration, repair, or mutation. */
+export declare function readTaskActions(storage: WandStorage, registry?: SessionRegistry, workspaceId?: string): TaskActionsSnapshot;