@co0ontty/wand 4.72.2 → 4.73.0

package/dist/render-structured-host.js

@@ -0,0 +1,218 @@
+import { spawn } from "node:child_process";
+import { existsSync, lstatSync, readFileSync, unlinkSync } from "node:fs";
+import net from "node:net";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { getErrorMessage } from "./error-utils.js";
+import { currentRenderTriple, isExecutableFile } from "./render-binary.js";
+import { RenderStructuredClient } from "./render-structured-client.js";
+import { structuredRenderPaths } from "./render-structured-protocol.js";
+const READY_TIMEOUT_MS = 5_000;
+/** Resolve the separate v2 executable; do not confuse it with PTY v1 wand-render. */
+export function resolveStructuredRenderBinary(configPath) {
+    const explicit = process.env.WAND_STRUCTURED_RENDER_BIN?.trim();
+    if (explicit) {
+        if (!isExecutableFile(explicit))
+            throw new Error("WAND_STRUCTURED_RENDER_BIN is not executable");
+        return explicit;
+    }
+    const binary = process.platform === "win32" ? "wand-structured-renderd.exe" : "wand-structured-renderd";
+    const root = path.resolve(import.meta.dirname, "..");
+    const choices = [
+        path.join(root, "render", "target", "release", binary),
+        path.join(root, "render", "target", "debug", binary),
+        path.join(path.dirname(configPath), "bin", binary),
+        path.join(root, "dist", "native", currentRenderTriple(), binary),
+        ...(process.env.PATH ?? "").split(path.delimiter).filter(Boolean).map((dir) => path.join(dir, binary)),
+    ];
+    return choices.find(isExecutableFile) ?? null;
+}
+function livePid(file) {
+    try {
+        const pid = Number(readFileSync(file, "utf8").trim());
+        if (!Number.isSafeInteger(pid) || pid <= 0)
+            return null;
+        process.kill(pid, 0);
+        return pid;
+    }
+    catch (error) {
+        return error.code === "EPERM" ? -1 : null;
+    }
+}
+async function socketIsListening(socketPath) {
+    return new Promise((resolve) => {
+        const socket = net.createConnection(socketPath);
+        let done = false;
+        const finish = (listening) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            socket.destroy();
+            resolve(listening);
+        };
+        const timer = setTimeout(() => finish(false), 250);
+        socket.once("connect", () => finish(true));
+        socket.once("error", () => finish(false));
+    });
+}
+async function connectExisting(configPath) {
+    const paths = structuredRenderPaths(configPath);
+    if (!existsSync(paths.socketPath))
+        return null;
+    const client = new RenderStructuredClient(configPath);
+    try {
+        await client.connect();
+        return client;
+    }
+    catch (error) {
+        client.disconnect();
+        if (await socketIsListening(paths.socketPath) || livePid(paths.pidPath) !== null) {
+            throw new Error(`Structured Render endpoint exists but refused adoption: ${getErrorMessage(error)}`);
+        }
+        // Only remove our own private, unlistened stale socket. Never unlink a
+        // foreign path or race a live daemon's startup/credential rotation.
+        const stat = lstatSync(paths.socketPath);
+        const ownUid = typeof process.getuid !== "function" || stat.uid === process.getuid();
+        if (!stat.isSocket() || !ownUid || (stat.mode & 0o777) !== 0o600) {
+            throw new Error("Structured Render endpoint is not a private socket; refusing cleanup");
+        }
+        unlinkSync(paths.socketPath);
+        return null;
+    }
+}
+async function startV2(configPath) {
+    const existing = await connectExisting(configPath);
+    if (existing)
+        return existing;
+    const paths = structuredRenderPaths(configPath);
+    if (livePid(paths.pidPath) !== null) {
+        const deadline = Date.now() + READY_TIMEOUT_MS;
+        while (Date.now() < deadline) {
+            const starting = await connectExisting(configPath);
+            if (starting)
+                return starting;
+            await delay(50);
+        }
+        throw new Error("Structured Render PID is alive but its socket is unavailable; refusing a competing daemon");
+    }
+    const binary = resolveStructuredRenderBinary(configPath);
+    if (!binary)
+        throw new Error("structured.processHost=rust requires a v2 binary; build wand-structured-renderd or set WAND_STRUCTURED_RENDER_BIN");
+    const child = spawn(binary, ["--config", configPath], {
+        detached: true, stdio: "ignore", cwd: process.cwd(), env: process.env,
+    });
+    child.on("error", (error) => process.stderr.write(`[wand] Structured Render launch failed: ${getErrorMessage(error)}\n`));
+    child.unref();
+    const deadline = Date.now() + READY_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        try {
+            const client = await connectExisting(configPath);
+            if (client)
+                return client;
+        }
+        catch (error) {
+            // A live but incompatible owner must not be replaced or silently downgraded.
+            throw error;
+        }
+        await delay(50);
+    }
+    if (child.pid) {
+        try {
+            process.kill(child.pid, "SIGTERM");
+        }
+        catch { /* child already exited */ }
+    }
+    throw new Error("Structured Render v2 did not become ready; refusing legacy fallback");
+}
+/**
+ * A stable runId can belong to exactly one persistent daemon. Configuration
+ * chooses only new runs; existing owners are always resolved by inventories.
+ */
+export class CompositeStructuredExecHost {
+    legacy;
+    rust;
+    newOwner;
+    persistent = true;
+    owners = new Map();
+    starting = new Map();
+    constructor(legacy, rust, newOwner) {
+        this.legacy = legacy;
+        this.rust = rust;
+        this.newOwner = newOwner;
+        if (!legacy && !rust)
+            throw new Error("at least one structured daemon is required");
+    }
+    getHost(owner) {
+        return owner === "legacy" ? this.legacy : this.rust;
+    }
+    async listRuns() {
+        const [legacyRuns, rustRuns] = await Promise.all([
+            this.legacy?.listRuns() ?? Promise.resolve([]),
+            this.rust?.listRuns() ?? Promise.resolve([]),
+        ]);
+        const legacyIds = new Set(legacyRuns.map((run) => run.runId));
+        for (const run of rustRuns) {
+            if (legacyIds.has(run.runId))
+                throw new Error(`structured run ${run.runId} has competing owners; refusing adoption`);
+        }
+        for (const run of legacyRuns)
+            this.owners.set(run.runId, "legacy");
+        for (const run of rustRuns)
+            this.owners.set(run.runId, "rust");
+        return [...legacyRuns, ...rustRuns];
+    }
+    async ownerOf(runId) {
+        const cached = this.owners.get(runId);
+        if (cached)
+            return cached;
+        await this.listRuns();
+        return this.owners.get(runId) ?? null;
+    }
+    async spawnStructured(request) {
+        const pending = this.starting.get(request.runId);
+        if (pending)
+            return pending;
+        const attempt = (async () => {
+            const owner = (await this.ownerOf(request.runId)) ?? this.newOwner;
+            const host = this.getHost(owner);
+            if (!host)
+                throw new Error(`structured owner ${owner} is unavailable; no fallback across owners`);
+            const handle = await host.spawnStructured(request);
+            this.owners.set(request.runId, owner);
+            return handle;
+        })();
+        this.starting.set(request.runId, attempt);
+        try {
+            return await attempt;
+        }
+        finally {
+            if (this.starting.get(request.runId) === attempt)
+                this.starting.delete(request.runId);
+        }
+    }
+    async attachRun(runId) {
+        const owner = await this.ownerOf(runId);
+        return owner ? this.getHost(owner)?.attachRun(runId) ?? null : null;
+    }
+    async adoptRun(runId) {
+        const owner = await this.ownerOf(runId);
+        return owner ? this.getHost(owner)?.adoptRun(runId) ?? null : null;
+    }
+    forgetRun(runId) {
+        const owner = this.owners.get(runId);
+        this.owners.delete(runId);
+        if (owner)
+            this.getHost(owner)?.forgetRun(runId);
+    }
+}
+/** Default legacy. v2 is adopted even on rollback when it still owns runs. */
+export async function createUpgradeAwareStructuredHost(configPath, legacy, processHost = "legacy") {
+    if (process.env.WAND_TEST_MODE === "1" || process.env.NODE_TEST_CONTEXT) {
+        return { host: legacy ?? undefined, rustClient: null };
+    }
+    const rustClient = processHost === "rust" ? await startV2(configPath) : await connectExisting(configPath);
+    if (!rustClient && !legacy)
+        return { host: undefined, rustClient: null };
+    return { host: new CompositeStructuredExecHost(legacy, rustClient, processHost), rustClient };
+}

package/dist/render-structured-protocol.d.ts

@@ -0,0 +1,101 @@
+/** Separate structured process daemon. v1 PTY socket and wire format are unchanged. */
+export declare const STRUCTURED_RENDER_PROTOCOL_VERSION = 2;
+export declare const STRUCTURED_RENDER_RUN_LOG_MAX_BYTES: number;
+export declare const STRUCTURED_RENDER_REPLAY_PAGE_MAX_BYTES: number;
+/** Envelope and length-prefixed JSON framing are identical to Render v1. */
+export { encodeRenderFrame, decodeRenderFrames } from "./render-protocol.js";
+export type { RenderResponse, RenderErrorCode } from "./render-protocol.js";
+export interface StructuredRenderRunState {
+    runId: string;
+    incarnationId: string;
+    pid: number;
+    status: "running" | "exited";
+    exitCode: number | null;
+    signal: number | null;
+    stdoutSeq: number;
+    stderrSeq: number;
+    stdoutTruncated: boolean;
+    stderrTruncated: boolean;
+}
+export interface StructuredRenderSpawnParams {
+    runId: string;
+    file: string;
+    args: string[];
+    cwd: string;
+    env: Record<string, string>;
+    stdinData?: string;
+}
+export interface StructuredRenderSpawnResult {
+    state: StructuredRenderRunState;
+    isNew: boolean;
+}
+/** Inventory deliberately carries no raw bytes, prompt, argv, cwd or env. */
+export interface StructuredRenderListResult {
+    runs: StructuredRenderRunState[];
+}
+export interface StructuredRenderAttachParams {
+    runId: string;
+    afterStdoutSeq?: number;
+    afterStderrSeq?: number;
+    maxBytes?: number;
+}
+export interface StructuredRenderReplayStream {
+    chunks: {
+        seq: number;
+        data: string;
+    }[];
+    nextSeq: number;
+    complete: boolean;
+    resetRequired: boolean;
+}
+export interface StructuredRenderAttachResult {
+    state: StructuredRenderRunState;
+    stdout: StructuredRenderReplayStream;
+    stderr: StructuredRenderReplayStream;
+}
+export interface StructuredRenderHelloResult {
+    version: string;
+    protocolVersion: number;
+    pid: number;
+    startedAt: string;
+    runs: number;
+}
+export interface StructuredRenderStatsResult {
+    runs: number;
+    runningRuns: number;
+    retainedLogBytes: number;
+    rssBytes: number;
+}
+export type StructuredRenderEvent = {
+    event: "stream";
+    runId: string;
+    incarnationId: string;
+    stream: "stdout" | "stderr";
+    seq: number;
+    data: string;
+} | {
+    event: "exit";
+    runId: string;
+    incarnationId: string;
+    exitCode: number | null;
+    signal: number | null;
+} | {
+    event: "reconcile";
+    runIds: string[];
+};
+export type StructuredRenderMethod = "hello" | "ping" | "list" | "spawn" | "attach" | "interrupt" | "forget" | "stats" | "shutdown";
+export interface StructuredRenderRequest {
+    id: number;
+    token: string;
+    protocolVersion: number;
+    method: StructuredRenderMethod;
+    params?: Record<string, unknown>;
+}
+export interface StructuredRenderPaths {
+    socketPath: string;
+    tokenPath: string;
+    pidPath: string;
+    metaPath: string;
+}
+/** Mirrors Rust normalized_absolute() and config_suffix(), in an independent namespace. */
+export declare function structuredRenderPaths(configPath: string): StructuredRenderPaths;

package/dist/render-structured-protocol.js

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** Separate structured process daemon. v1 PTY socket and wire format are unchanged. */
+export const STRUCTURED_RENDER_PROTOCOL_VERSION = 2;
+export const STRUCTURED_RENDER_RUN_LOG_MAX_BYTES = 8 * 1024 * 1024;
+export const STRUCTURED_RENDER_REPLAY_PAGE_MAX_BYTES = 512 * 1024;
+/** Envelope and length-prefixed JSON framing are identical to Render v1. */
+export { encodeRenderFrame, decodeRenderFrames } from "./render-protocol.js";
+/** Mirrors Rust normalized_absolute() and config_suffix(), in an independent namespace. */
+export function structuredRenderPaths(configPath) {
+    const absolute = path.resolve(configPath);
+    let resolved = absolute;
+    try {
+        resolved = realpathSync(absolute);
+    }
+    catch { /* config may not exist yet */ }
+    const suffix = createHash("sha256").update(resolved).digest("hex").slice(0, 12);
+    const dir = path.dirname(resolved);
+    const uid = (() => {
+        try {
+            return os.userInfo().uid;
+        }
+        catch {
+            return 0;
+        }
+    })();
+    return {
+        socketPath: path.join("/tmp", `wand-structured-render-${uid}-${suffix}.sock`),
+        tokenPath: path.join(dir, `.structured-render-${suffix}.token`),
+        pidPath: path.join(dir, `.structured-render-${suffix}.pid`),
+        metaPath: path.join(dir, `.structured-render-${suffix}.json`),
+    };
+}

package/dist/server-session-routes.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { SessionInputError } from "./process-manager.js";
+import { PtyInputDeliveryError, SessionInputError } from "./process-manager.js";
 import { getDefaultModelForProvider, isExecutionMode } from "./config.js";
 import { blockWindowMessagesForTransport, sliceTurnBlocksForTransport, truncateMessagesForTransport, windowMessagesForTransport } from "./message-truncator.js";
 import { toSessionDetailDTO, toSessionListItemDTO } from "./session-transport.js";
@@ -17,6 +17,7 @@ import { sendRouteError } from "./server-request.js";
 import { registerStructuredResumeRoutes } from "./server-resume-routes.js";
 import { addHiddenSessionIds, removeHiddenSessionIds } from "./session-registry.js";
 import { enrichStructuredMessages, WAND_PROTOCOL_VERSION } from "./structured-client-protocol.js";
+import { asRecord, isStructuredImagePart } from "./structured-content.js";
 import { syncWorkspaceTaskToBoard } from "./wand-task-sync.js";
 import { buildDirectoryTree, normalizeSessionDirectory, } from "./session-directory-tree.js";
 import { projectCwdForSession, renameWorkspaceDirectory, resolveWorkspaceIdForNewSession, } from "./workspace-binding.js";
@@ -64,6 +65,17 @@ export function parseSessionCreationOrigin(body) {
     };
 }
 function getInputErrorResponse(error, sessionId) {
+    if (error instanceof PtyInputDeliveryError) {
+        return {
+            statusCode: 503,
+            payload: {
+                error: "PTY 输入结果未获确认；请先检查终端输出，不要直接重复提交。",
+                errorCode: "INPUT_DELIVERY_UNCONFIRMED",
+                sessionId,
+                sessionStatus: null,
+            },
+        };
+    }
     if (error instanceof SessionInputError) {
         const statusCode = error.code === "SESSION_NOT_FOUND" ? 404 : 409;
         return {
@@ -351,7 +363,7 @@ function isMergeActionAllowed(snapshot) {
 }
 export function registerSessionRoutes(app, processes, structured, storage, defaultMode, config, sessions, onSessionCreated) {
     const sessionResponseDTO = (snapshot) => {
-        const windowed = windowMessagesForTransport(enrichStructuredMessages(snapshot.messages ?? []), config.cardDefaults ?? {});
+        const windowed = windowMessagesForTransport(enrichStructuredMessages(snapshot.messages ?? [], snapshot.id), config.cardDefaults ?? {});
         return toSessionDetailDTO(snapshot, {
             messages: windowed.messages,
             messageOffset: windowed.messageOffset,
@@ -620,6 +632,19 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
             sendRouteError(res, error, "无法调整排队顺序。");
         }
     });
+    app.patch("/api/structured-sessions/:id/queued/:index", (req, res) => {
+        const { expectedText, text } = req.body ?? {};
+        if (typeof expectedText !== "string" || typeof text !== "string" || !text.trim()) {
+            res.status(400).json({ error: "排队消息不能为空，且必须提供原文。" });
+            return;
+        }
+        try {
+            res.json(sessionResponseDTO(structured.editQueuedMessage(req.params.id, Number(req.params.index), expectedText, text)));
+        }
+        catch (error) {
+            sendRouteError(res, error, "无法编辑排队消息。");
+        }
+    });
     app.delete("/api/structured-sessions/:id/queued/:index", (req, res) => {
         const index = Number(req.params.index);
         if (!Number.isFinite(index)) {
@@ -688,6 +713,41 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
         }
         res.status(404).json({ error: "未找到该工具结果。" });
     });
+    // ── Inline tool image endpoint ──
+    // tool_result 里内联的 base64 图片在传输层被改写为这个 URL（避免把整张图的 base64
+    // 塞进每次快照 / WS 帧）。各端用同一套带鉴权的取图通道按需加载。
+    app.get("/api/sessions/:id/tool-images/:toolUseId/:index", (req, res) => {
+        const snapshot = sessions.get(req.params.id);
+        if (!snapshot) {
+            res.status(404).json({ error: "未找到该会话。" });
+            return;
+        }
+        const toolUseId = req.params.toolUseId;
+        const index = Number.parseInt(req.params.index, 10);
+        if (!Number.isFinite(index) || index < 0) {
+            res.status(400).json({ error: "无效的图片序号。" });
+            return;
+        }
+        for (const turn of snapshot.messages ?? []) {
+            for (const block of turn.content) {
+                if (block.type !== "tool_result" || block.tool_use_id !== toolUseId || !Array.isArray(block.content))
+                    continue;
+                const part = block.content.filter(isStructuredImagePart)[index];
+                const source = asRecord(part?.source);
+                const data = typeof source?.data === "string" ? source.data : undefined;
+                if (source?.type !== "base64" || !data) {
+                    res.status(404).json({ error: "未找到该图片。" });
+                    return;
+                }
+                res.setHeader("Content-Type", typeof source.media_type === "string" ? source.media_type : "image/png");
+                res.setHeader("Cache-Control", "private, max-age=3600");
+                res.setHeader("X-Content-Type-Options", "nosniff");
+                res.send(Buffer.from(data, "base64"));
+                return;
+            }
+        }
+        res.status(404).json({ error: "未找到该工具结果。" });
+    });
     app.post("/api/sessions/:id/worktree/merge/check", asyncRoute(async (req, res) => {
         try {
             const current = requireWorktreeSession(sessions.getLatest(req.params.id));
@@ -1016,7 +1076,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
             const rawBudget = req.query.blockBudget;
             if (typeof rawBudget === "string" && /^\d+$/.test(rawBudget) && Number(rawBudget) > 0) {
                 const blockBudget = parseBoundedInteger(rawBudget, 1, 1, 2_000);
-                const windowed = blockWindowMessagesForTransport(enrichStructuredMessages(snapshot.messages ?? []), config.cardDefaults ?? {}, blockBudget);
+                const windowed = blockWindowMessagesForTransport(enrichStructuredMessages(snapshot.messages ?? [], snapshot.id), config.cardDefaults ?? {}, blockBudget);
                 res.json(toSessionDetailDTO(snapshot, {
                     output: transcriptOutput,
                     messages: windowed.messages,
@@ -1028,7 +1088,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
                 return;
             }
             // 与 WS init 对齐：只回最近一窗 turn + offset/total，更早的走 /messages 翻页。
-            const windowed = windowMessagesForTransport(enrichStructuredMessages(snapshot.messages ?? []), config.cardDefaults ?? {});
+            const windowed = windowMessagesForTransport(enrichStructuredMessages(snapshot.messages ?? [], snapshot.id), config.cardDefaults ?? {});
             res.json(toSessionDetailDTO(snapshot, {
                 output: transcriptOutput,
                 messages: windowed.messages,
@@ -1048,7 +1108,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
             res.status(404).json({ error: "未找到该会话，可能已被删除。" });
             return;
         }
-        const all = enrichStructuredMessages(snapshot.messages ?? []);
+        const all = enrichStructuredMessages(snapshot.messages ?? [], snapshot.id);
         const total = all.length;
         // 块级翻页（iOS）：?turn=<i>&blockOffset=<当前 leading 偏移>&blockLimit=<N>
         // 取该 turn 的 [start, blockOffset) 段（start = max(0, blockOffset - blockLimit)）。
@@ -1069,7 +1129,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
             const blocks = enrichStructuredMessages([{
                     ...turn,
                     content: sliceTurnBlocksForTransport(turn, blockStart, blockEnd, config.cardDefaults ?? {}),
-                }])[0].content;
+                }], snapshot.id)[0].content;
             res.json({ wandProtocolVersion: WAND_PROTOCOL_VERSION, turnIndex, blocks, blockOffset: blockStart, blockTotal });
             return;
         }
@@ -1078,7 +1138,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
         const limit = Math.min(Math.max(Number.isFinite(rawLimit) ? rawLimit : 40, 1), 200);
         const offset = Math.min(Math.max(Number.isFinite(rawOffset) ? rawOffset : 0, 0), total);
         const end = Math.min(offset + limit, total);
-        const slice = enrichStructuredMessages(truncateMessagesForTransport(all.slice(offset, end), config.cardDefaults ?? {}));
+        const slice = enrichStructuredMessages(truncateMessagesForTransport(all.slice(offset, end), config.cardDefaults ?? {}), snapshot.id);
         res.json({ wandProtocolVersion: WAND_PROTOCOL_VERSION, messages: slice, offset, total });
     });
     app.post("/api/sessions/:id/resume", asyncRoute(async (req, res) => {
@@ -1207,14 +1267,17 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
             const autoResumeInput = getAutoResumeInitialInput(existingSession, input, view, shortcutKey);
             if (autoResumeInput !== null && canAutoResumePtyForInput(existingSession, autoResumeInput)) {
                 const snapshot = await startResumedPtySession(processes, storage, existingSession, sessionId, defaultMode, {}, autoResumeInput);
+                // Resume input waits for the provider prompt and is deliberately queued after start.
+                // This branch reports a pending delivery, unlike an already-running PTY write.
+                res.setHeader("X-Wand-Input-Delivery", "pending");
                 if (body.responseMode === "accepted") {
-                    res.status(202).json({ accepted: true });
+                    res.status(202).json({ accepted: true, deliveryConfirmed: false });
                     return;
                 }
                 res.json(sessionResponseDTO(snapshot));
                 return;
             }
-            const snapshot = processes.sendInput(sessionId, input, view, shortcutKey);
+            const snapshot = await processes.sendInputConfirmed(sessionId, input, view, shortcutKey);
             if (body.responseMode === "accepted") {
                 res.status(202).json({ accepted: true });
                 return;

package/dist/server-task-routes.js

@@ -53,6 +53,37 @@ function labelsFrom(value) {
         return [];
     return value.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean).slice(0, 20);
 }
+/** 新认领只能挂到同项目且正在处理的任务；历史归属在父任务完成后仍保留。 */
+function parentTaskIdFrom(storage, value, workspaceId, childId = null, existingParentId = null) {
+    if (value === null || value === "")
+        return null;
+    if (typeof value !== "string" || !value.trim())
+        throw new Error("父任务无效。");
+    const parentId = value.trim();
+    const parent = storage.getWandTask(parentId);
+    if (!parent)
+        throw new Error("父任务不存在。");
+    if (parent.workspaceId !== workspaceId)
+        throw new Error("父任务必须与子任务属于同一项目目录。");
+    if (parent.status !== "doing" && parentId !== existingParentId) {
+        throw new Error("只能认领到正在处理的父任务。");
+    }
+    // 不允许自己做父任务，也不允许把祖先接到后代下。
+    const visited = new Set();
+    let ancestorId = parentId;
+    while (ancestorId) {
+        if (ancestorId === childId || visited.has(ancestorId))
+            throw new Error("父任务不能形成循环。");
+        visited.add(ancestorId);
+        ancestorId = storage.getWandTask(ancestorId)?.parentTaskId ?? null;
+    }
+    return parentId;
+}
+function assertTaskWorkspaceMove(storage, taskId, workspaceId) {
+    if (storage.listWandTasks().some((task) => task.parentTaskId === taskId && task.workspaceId !== workspaceId)) {
+        throw new Error("请先将子任务解除归属，再移动父任务的项目目录。");
+    }
+}
 /** 里程碑名：必填、去首尾空白、限长。 */
 function milestoneNameFrom(value) {
     const name = text(value).slice(0, WAND_MILESTONE_NAME_MAX_LENGTH);
@@ -350,9 +381,13 @@ export function registerTaskRoutes(app, deps) {
     app.post("/api/wand-tasks", (req, res) => {
         try {
             const body = bodyObject(req.body);
-            const workspaceId = body.workspaceId === null ? null : text(body.workspaceId) || null;
+            const requestedParent = body.parentTaskId == null ? null : storage.getWandTask(text(body.parentTaskId));
+            const workspaceId = body.workspaceId === undefined && requestedParent
+                ? requestedParent.workspaceId
+                : body.workspaceId === null ? null : text(body.workspaceId) || null;
             if (workspaceId && !storage.getWorkspace(workspaceId))
                 throw new Error("项目不存在。");
+            const parentTaskId = parentTaskIdFrom(storage, body.parentTaskId ?? null, workspaceId);
             const description = text(body.description);
             // 标题是可选字段：用户不写就先用描述首行占位，再由模型在后台覆盖。
             const providedTitle = text(body.title);
@@ -374,6 +409,7 @@ export function registerTaskRoutes(app, deps) {
             const task = storage.transaction(() => {
                 const card = storage.createWandTask({
                     workspaceId,
+                    parentTaskId,
                     title,
                     titleSource,
                     description,
@@ -403,6 +439,11 @@ export function registerTaskRoutes(app, deps) {
     app.patch("/api/wand-tasks/:id", (req, res) => {
         try {
             const body = bodyObject(req.body);
+            const currentTask = storage.getWandTask(req.params.id);
+            if (!currentTask) {
+                res.status(404).json({ error: "未找到该任务。" });
+                return;
+            }
             const patch = {};
             if (body.title !== undefined) {
                 // 显式改标题（包括原生端的可编辑标题框）都算用户自己写的。
@@ -444,10 +485,15 @@ export function registerTaskRoutes(app, deps) {
                 patch.milestoneId = scopedMilestoneId(storage, milestoneId, patch.workspaceId)
                     ?? defaultMilestoneIdForWrite(storage);
             }
+            if (body.parentTaskId !== undefined || body.workspaceId !== undefined) {
+                const workspaceId = patch.workspaceId === undefined ? currentTask.workspaceId : patch.workspaceId;
+                patch.parentTaskId = parentTaskIdFrom(storage, body.parentTaskId === undefined ? currentTask.parentTaskId : body.parentTaskId, workspaceId, currentTask.id, currentTask.parentTaskId);
+                if (workspaceId !== currentTask.workspaceId)
+                    assertTaskWorkspaceMove(storage, currentTask.id, workspaceId);
+            }
             if (body.agent !== undefined) {
                 // 老客户端不传 mode / kind：沿用任务当前值，而不是复位成标准 / 结构化。
-                const current = storage.getWandTask(req.params.id);
-                patch.agent = parseTaskAgent(body.agent, current?.agent?.mode, current?.agent?.kind);
+                patch.agent = parseTaskAgent(body.agent, currentTask.agent?.mode, currentTask.agent?.kind);
                 if (patch.agent)
                     writeTaskBoardLastAgent(storage, patch.agent);
             }
@@ -537,6 +583,9 @@ export function registerTaskRoutes(app, deps) {
                 const workspaceId = body.workspaceId === null ? null : text(body.workspaceId) || null;
                 if (workspaceId && !storage.getWorkspace(workspaceId))
                     throw new Error("项目不存在。");
+                parentTaskIdFrom(storage, task.parentTaskId, workspaceId, task.id, task.parentTaskId);
+                if (workspaceId !== task.workspaceId)
+                    assertTaskWorkspaceMove(storage, task.id, workspaceId);
                 task = storage.updateWandTask(task.id, { workspaceId }) ?? task;
             }
             const workspace = task.workspaceId ? storage.getWorkspace(task.workspaceId) : null;

package/dist/server-update-routes.d.ts

@@ -34,6 +34,8 @@ export interface PublicUpdateRoutesDependencies {
     computeAssetSha256(asset: DownloadAsset): Promise<string | null>;
     resolveLatestDmg(): Promise<ResolvedUpdateAsset | null>;
     resolveMacosDownload(): Promise<DownloadAsset | null>;
+    resolveLatestMacosBeta(): Promise<ResolvedUpdateAsset | null>;
+    resolveMacosBetaDownload(fileName: string): Promise<DownloadAsset | null>;
     resolveLatestIpa(): Promise<ResolvedUpdateAsset | null>;
     resolveIosDownload(): Promise<DownloadAsset | null>;
 }