@co0ontty/wand 4.93.0 → 4.94.0

package/README.md

@@ -11,7 +11,7 @@
 
 ### Overview
 
-Wand is a web console for remotely accessing and managing local CLI tools from a browser. It supports [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai/), [Grok Build](https://grok.com/), [Qoder CLI](https://docs.qoder.com/en/cli/quick-start), and [Pi](https://pi.dev/), as well as [Gemini CLI](https://github.com/google-gemini/gemini-cli), with terminal and structured conversation views, persistent resumable sessions, permission controls, file browsing, and native clients for multiple platforms.
+Wand is a web console for remotely accessing and managing local CLI tools from a browser. It supports [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai/), [Grok Build](https://grok.com/), [Qoder CLI](https://docs.qoder.com/en/cli/quick-start), and [Pi](https://pi.dev/), with terminal and structured conversation views, persistent resumable sessions, permission controls, file browsing, and native clients for multiple platforms.
 
 The browser password manager extension source lives in `browser-extension/`.
 
@@ -48,7 +48,7 @@ wand config:password
 #### Core
 
 - **Dual view modes** — switch between raw terminal output and a structured conversation view for the same session
-- **Multiple providers** — create PTY or structured sessions for Claude Code, Codex, OpenCode, Grok, Qoder CLI, Pi, and Gemini CLI
+- **Multiple providers** — create PTY or structured sessions for Claude Code, Codex, OpenCode, Grok, Qoder CLI, and Pi
 - **Session management** — create, archive, and resume Claude, Codex, OpenCode, Grok, and Qoder sessions with their provider-native context; restore Claude/Codex native history; show summaries in the session list
 - **Permission control** — visual permission prompts with one-time approval, per-turn memory, and related policies
 
@@ -66,7 +66,7 @@ wand config:password
 - **Native clients** — Android, iOS, and macOS clients with encrypted connection codes and update checks
 - **HTTPS** — optional self-signed certificates for remote or mobile access
 - **Update channels** — built-in stable/beta update checks and upgrade prompts
-- **CLI updates** — check and quickly update Claude Code, Codex, OpenCode, Qoder CLI, Pi, and Gemini CLI from server settings, with optional automatic updates
+- **CLI updates** — check and quickly update Claude Code, Codex, OpenCode, Qoder CLI, and Pi from server settings, with optional automatic updates
 
 Stable subscribers receive npm `latest`; Beta subscribers receive the newer of `latest`
 and `beta`, including a stable release that supersedes its prerelease. Installing stable
@@ -113,16 +113,16 @@ Web and Android show inference calls as standalone local-decision cards, outside
 
 ### System Service
 
-The default service mode is system-wide: Linux writes `/etc/systemd/system/wand.service`, and macOS writes `/Library/LaunchDaemons/com.wand.web.plist`. Installing or removing the system service requires sudo.
+The default service mode is system-wide: Linux writes `/etc/systemd/system/wand.service`, and macOS writes `/Library/LaunchDaemons/com.wand.web.plist`. System service changes require administrator permission. Wand automatically invokes sudo and lets you enter the password in the terminal; it never reads or stores the password. Without an interactive terminal, only already-authorized noninteractive sudo is allowed. Restart waits for active Core turns before gracefully restarting Server, leaving Render/terminald running (`--timeout <seconds>` cancels on timeout).
 
 ```bash
-sudo wand service:install   # Register and start the service
-wand service:status         # Show status
-sudo wand service:start     # Start
-sudo wand service:stop      # Stop
-sudo wand service:restart   # Restart
-wand service:logs           # Show recent logs
-sudo wand service:uninstall # Stop and remove the service
+wand service:install   # Register and start; automatically request sudo
+wand service:status    # Show status
+wand service:start     # Start
+wand service:stop      # Stop
+wand service:restart   # Safely restart; automatically request sudo
+wand service:logs      # Show recent logs
+wand service:uninstall # Stop and remove the service
 ```
 
 Use `--user` for a user-level service:
@@ -180,17 +180,13 @@ npm uninstall -g opencode
 npm install -g opencode-ai@latest
 ```
 
-Gemini structured sessions require `@google/gemini-cli` 0.11 or newer (the release that added headless `--output-format stream-json`):
-
-```bash
-npm install -g @google/gemini-cli@latest
 ```
 
 ## 中文
 
 ### 概览
 
-通过浏览器远程访问和管理本地 CLI 工具的 Web 控制台。支持 [Claude Code](https://docs.anthropic.com/en/docs/claude-code)、[Codex](https://github.com/openai/codex)、[OpenCode](https://opencode.ai/)、[Grok Build](https://grok.com/)、[Qoder CLI](https://docs.qoder.com/zh/cli/quick-start)、[Pi](https://pi.dev/) 和 [Gemini CLI](https://github.com/google-gemini/gemini-cli)，提供终端和结构化对话双视图、会话持久化与恢复、权限管控、文件浏览和多平台客户端。
+通过浏览器远程访问和管理本地 CLI 工具的 Web 控制台。支持 [Claude Code](https://docs.anthropic.com/en/docs/claude-code)、[Codex](https://github.com/openai/codex)、[OpenCode](https://opencode.ai/)、[Grok Build](https://grok.com/)、[Qoder CLI](https://docs.qoder.com/zh/cli/quick-start)、[Pi](https://pi.dev/)，提供终端和结构化对话双视图、会话持久化与恢复、权限管控、文件浏览和多平台客户端。
 
 ### 安装
 
@@ -227,10 +223,6 @@ npm uninstall -g opencode
 npm install -g opencode-ai@latest
 ```
 
-Gemini 结构化会话需要 `@google/gemini-cli` 0.11 或更高版本（该版本才加入 headless 的 `--output-format stream-json`）：
-
-```bash
-npm install -g @google/gemini-cli@latest
 ```
 
 ### 功能
@@ -238,7 +230,7 @@ npm install -g @google/gemini-cli@latest
 #### 核心
 
 - **双视图模式** — 终端原始输出和结构化对话视图可随时切换，同一会话两种呈现
-- **多 Provider 支持** — Claude Code、Codex、OpenCode、Grok、Qoder CLI、Pi 和 Gemini CLI 均可创建 PTY 或结构化会话
+- **多 Provider 支持** — Claude Code、Codex、OpenCode、Grok、Qoder CLI 和 Pi 均可创建 PTY 或结构化会话
 - **会话管理** — 创建、归档并携带原生上下文恢复 Claude、Codex、OpenCode、Grok、Qoder 会话；支持恢复 Claude/Codex 原生历史记录；会话列表显示摘要
 - **权限控制** — 可视化权限提示，支持逐次确认、单次批准、本轮记忆等策略
 
@@ -282,7 +274,7 @@ master 的 Beta 发布只写入 `beta`，版本为下一补丁号加
 版本基数同时检查正式 Git tags 和 npm latest，兼容未推送 Git 的本地正式发布。
 Beta 标签缺失或无效时，Beta 订阅仍可接收有效正式版；正式通道始终不选择 beta。
 两个候选都无效或 npm 不可达时不安装。
-- **CLI 更新** — 在服务端设置中检查并快速更新 Claude Code、Codex、OpenCode、Qoder CLI、Pi 和 Gemini CLI，也可开启自动更新
+- **CLI 更新** — 在服务端设置中检查并快速更新 Claude Code、Codex、OpenCode、Qoder CLI 和 Pi，也可开启自动更新
 
 ### 配置
 
@@ -334,16 +326,16 @@ Web/Android 的推理调用独立显示为「本地决策」卡，不混入普
 
 ### 系统服务
 
-默认走 **system-wide**：Linux 写 `/etc/systemd/system/wand.service`，macOS 写 `/Library/LaunchDaemons/com.wand.web.plist`。开机自启、不依赖 login session、`service wand` / `systemctl status wand` 这些老命令都能用。装/卸需要 sudo。
+默认走 **system-wide**：Linux 写 `/etc/systemd/system/wand.service`，macOS 写 `/Library/LaunchDaemons/com.wand.web.plist`。开机自启、不依赖 login session、`service wand` / `systemctl status wand` 这些老命令都能用。系统服务变更需要管理员权限，Wand 会自动申请 sudo，让你在终端输入密码（不显示、不读取、不保存）。无交互终端时仅允许已经授权的非交互 sudo。重启会先等待 Core 回合排空，再优雅重启 Server，保留 Render/terminald；可用 `--timeout <秒数>` 限制等待时间，超时不停止服务。
 
 ```bash
-sudo wand service:install   # 注册并启动（首次安装走这里）
-wand service:status         # 查状态（active / inactive / failed） — 读取不要 sudo
-sudo wand service:start     # 启动
-sudo wand service:stop      # 停止
-sudo wand service:restart   # 重启
-wand service:logs           # 看最近日志（--lines N 调整行数）
-sudo wand service:uninstall # 卸载（停服 + 删 unit）
+wand service:install   # 注册并启动（自动申请 sudo）
+wand service:status    # 查状态（active / inactive / failed） — 读取不要 sudo
+wand service:start     # 启动
+wand service:stop      # 停止
+wand service:restart   # 安全重启（自动申请 sudo）
+wand service:logs      # 看最近日志（--lines N 调整行数）
+wand service:uninstall # 卸载（停服 + 删 unit）
 ```
 
 不想用 sudo？传 `--user` 切到 user-level（写 `~/.config/systemd/user/wand.service` 或 `~/Library/LaunchAgents/`）：
@@ -414,6 +406,9 @@ git submodule update --init -- render-bin
 macOS 每日清理历史归档编译中间物（保留7天）用 `npm run clean:build-cache:install -- --install`；
 范围、并发保护、日志和停用方式见[自动清理说明](docs/build-cache-cleanup.md)。不修改Git hook，不自动删除现用原生构建树。
 
+通过 npm 安装后，运行存储维护默认在后台自动执行：回收过期临时残留与无引用的上传文件，限制诊断日志大小并清理过期轮转日志。无需源码仓库或日常手动操作，保留会话历史和正在使用的文件。
+归属判断、保留时间与可选管理员诊断入口见[运行存储自动维护](docs/storage-cleanup.md)。
+
 数据存储在 `~/.wand/` 下：`config.json`（配置）、`wand.db`（SQLite）、`sessions/`（日志）。
 
 ### License

package/dist/ai-text-runner.d.ts

@@ -27,15 +27,6 @@ type CliAiTextOptions = QuickCommitAiOptions & {
 export declare function normalizeAiText(raw: string): string;
 export declare function buildPiTextArgs(request: AiTextRequest, opts: QuickCommitAiOptions, allowTools?: boolean): string[];
 export declare function buildGrokTextArgs(request: AiTextRequest, opts: QuickCommitAiOptions, allowTools?: boolean): string[];
-/**
- * Gemini CLI 没有 `--append-system-prompt`，规则走 `contentWithSystemPrompt` 并进内容；
- * headless 下必须带 `--skip-trust`，否则未信任的工作目录会直接以 55 退出。
- *
- * `-p ""` 只把 CLI 钉在 headless 模式，真正的 prompt 走 stdin：commit diff 可能很大，
- * 塞进 argv 会撞 ARG_MAX。Gemini 没有 Codex `--ephemeral` 那样的临时会话开关，
- * 一次性调用会留在它自己的聊天记录里（Wand 不扫描 Gemini 历史，不会误当可恢复会话）。
- */
-export declare function buildGeminiTextArgs(opts: QuickCommitAiOptions, allowTools?: boolean): string[];
 export declare function buildQoderTextArgs(request: AiTextRequest, opts: QuickCommitAiOptions, allowTools?: boolean): string[];
 /** provider 自己的系统提示开关 + 规则文本；没有开关的 provider 返回空。 */
 export declare function systemPromptArgsFrom(provider: SessionProvider, system: string): string[];
@@ -47,8 +38,9 @@ export declare function runCliText(command: string, args: string[], prompt: stri
     inheritEnv?: boolean;
     signal?: AbortSignal;
     env?: (base: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
+    temporaryDirectory?: string;
+    onChildClose?: () => void;
 }): Promise<string>;
-export declare function assertGeminiTextCapability(): void;
 export declare function callCliAiText(request: AiTextRequest, cwd: string, language: string, opts: CliAiTextOptions): Promise<string>;
 /** 角色设定走系统提示前缀；任务自己的输出格式与约束必须排在后面。 */
 export declare function withOpsPersona(request: AiTextRequest, persona?: string): AiTextRequest;

package/dist/ai-text-runner.js

@@ -1,11 +1,9 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { appendDiagnosticTail, MAX_AI_TEXT_BYTES } from "./bounded-process-output.js";
 import { QuickCommitError } from "./command-error.js";
+import { registerTemporaryChild } from "./managed-temp.js";
 import { abortableEmployeeText, prepareEmployeeTextCandidate } from "./employee-text.js";
 import { buildChildEnv } from "./env-utils.js";
 import { getGitErrorMessage } from "./git-utils.js";
@@ -112,12 +110,6 @@ function assertCliProtocolSucceeded(stdout, provider) {
                     ? failed(message.errorMessage) : null;
             }
         }
-        else if (provider === "gemini") {
-            if (event.type === "error" && event.severity === "error")
-                failure = failed(event);
-            if (event.type === "result")
-                failure = event.status === "error" ? failed(event) : null;
-        }
         else if ((provider === "grok" || provider === "opencode") && event.type === "error") {
             failure = failed(event);
         }
@@ -237,24 +229,6 @@ function extractPiText(stdout) {
     }
     return text.trim();
 }
-/** Gemini `--output-format stream-json`：assistant message 是增量 chunk，拼接即可。 */
-function extractGeminiText(stdout) {
-    assertCliProtocolSucceeded(stdout, "gemini");
-    let text = "";
-    for (const line of stdout.split(/\r?\n/)) {
-        const trimmed = line.trim();
-        if (!trimmed.startsWith("{"))
-            continue;
-        try {
-            const event = JSON.parse(trimmed);
-            if (event.type === "message" && event.role === "assistant" && typeof event.content === "string") {
-                text += event.content;
-            }
-        }
-        catch { /* ignore non-protocol stdout */ }
-    }
-    return text.trim();
-}
 export function buildPiTextArgs(request, opts, allowTools = false) {
     const args = ["--mode", "json", "--print", "--no-session"];
     if (!allowTools)
@@ -284,23 +258,6 @@ export function buildGrokTextArgs(request, opts, allowTools = false) {
         args.push("--tools", "", "--disallowed-tools", "run_terminal_cmd,read_file,search_replace,grep,list_dir,web_search,web_fetch,todo_write,task,Agent", "--deny", "MCPTool", "--disable-web-search", "--no-subagents");
     return args;
 }
-/**
- * Gemini CLI 没有 `--append-system-prompt`，规则走 `contentWithSystemPrompt` 并进内容；
- * headless 下必须带 `--skip-trust`，否则未信任的工作目录会直接以 55 退出。
- *
- * `-p ""` 只把 CLI 钉在 headless 模式，真正的 prompt 走 stdin：commit diff 可能很大，
- * 塞进 argv 会撞 ARG_MAX。Gemini 没有 Codex `--ephemeral` 那样的临时会话开关，
- * 一次性调用会留在它自己的聊天记录里（Wand 不扫描 Gemini 历史，不会误当可恢复会话）。
- */
-export function buildGeminiTextArgs(opts, allowTools = false) {
-    const args = ["-p", "", "--output-format", "stream-json", "--skip-trust"];
-    const model = opts.model?.trim();
-    if (model && model !== "default")
-        args.push("--model", model);
-    if (allowTools)
-        args.push("--approval-mode", "yolo");
-    return args;
-}
 export function buildQoderTextArgs(request, opts, allowTools = false) {
     const args = ["-p", request.prompt, "--output-format", "stream-json", "--no-session-persistence"];
     const model = opts.model?.trim();
@@ -337,6 +294,17 @@ export function runCliText(command, args, prompt, opts) {
             env: opts.env ? opts.env(baseEnv) : baseEnv,
             stdio: ["pipe", "pipe", "pipe"],
         });
+        if (opts.temporaryDirectory) {
+            try {
+                registerTemporaryChild(opts.temporaryDirectory, child.pid);
+            }
+            catch {
+                child.on("error", () => { });
+                child.once("close", () => { reject(new Error("AI text temporary lease unavailable")); });
+                child.kill("SIGKILL");
+                return;
+            }
+        }
         let stdout = "";
         let stdoutBytes = 0;
         const stdoutDecoder = new StringDecoder("utf8");
@@ -386,6 +354,7 @@ export function runCliText(command, args, prompt, opts) {
         });
         child.on("close", (code) => {
             cleanup();
+            opts.onChildClose?.();
             if (settled)
                 return;
             settled = true;
@@ -502,34 +471,6 @@ async function callPiText(request, cwd, opts) {
         throw new QuickCommitError("Pi 返回了空的 commit message。", "EMPTY_AI_MESSAGE");
     return text;
 }
-export function assertGeminiTextCapability() {
-    // Gemini ignores supplemental admin policy when a central policy exists.
-    // Refuse that unsupported text-only path rather than launching without deny.
-    const systemPolicies = process.platform === "darwin" ? "/Library/Application Support/GeminiCli/policies"
-        : process.platform === "win32" ? join(process.env.ProgramData ?? "C:\\ProgramData", "gemini-cli", "policies") : "/etc/gemini-cli/policies";
-    if (existsSync(systemPolicies) && readdirSync(systemPolicies).some(file => file.endsWith(".toml"))) {
-        throw new QuickCommitError("Gemini 中央策略阻止注入纯文本工具边界，请配置可用的文本候选。", "AI_FALLBACK_FAILED");
-    }
-}
-async function callGeminiText(request, cwd, opts) {
-    assertGeminiTextCapability();
-    const root = mkdtempSync(join(tmpdir(), "wand-gemini-text-"));
-    try {
-        const policy = join(root, "text-only.toml");
-        writeFileSync(policy, '[[rule]]\ntoolName = "*"\ndecision = "deny"\npriority = 999\n', { mode: 0o600 });
-        const args = [...buildGeminiTextArgs(opts), "--admin-policy", policy, "--extensions", "none", "--allowed-mcp-server-names", ""];
-        const stdout = await runCliText("gemini", args, contentWithSystemPrompt("gemini", request), {
-            cwd, timeoutMs: cliTextTimeoutMs(CODEX_MESSAGE_TIMEOUT_MS, opts), inheritEnv: opts.inheritEnv, signal: opts.signal,
-        });
-        const text = extractGeminiText(stdout);
-        if (!text)
-            throw new QuickCommitError("Gemini 返回了空的 commit message。", "EMPTY_AI_MESSAGE");
-        return text;
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-}
 export async function callCliAiText(request, cwd, language, opts) {
     const provider = defaultProvider(opts.provider);
     if (provider === "codex") {
@@ -543,8 +484,6 @@ export async function callCliAiText(request, cwd, language, opts) {
         return callQoderText(request, cwd, opts);
     if (provider === "pi")
         return callPiText(request, cwd, opts);
-    if (provider === "gemini")
-        return callGeminiText(request, cwd, opts);
     return callClaudeText(request, cwd, language, opts);
 }
 /**

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "6d9e09030eeb98d41403c42abe59226c730af9f0",
-  "builtAt": "2026-10-15T00:06:39.228Z",
-  "version": "4.93.0",
+  "commit": "4323ba1516bf4465bd3e239e67508a972f01a3e4",
+  "builtAt": "2026-10-15T00:50:47.298Z",
+  "version": "4.94.0",
   "channel": "stable"
 }

package/dist/cli.js

@@ -29,6 +29,9 @@ async function main() {
                 await runAttach(live, configPath, useTui);
                 break;
             }
+            const { installServiceDiagnosticRotation } = await import("./diagnostic-logs.js");
+            const { dirname } = await import("node:path");
+            installServiceDiagnosticRotation(dirname(configPath), "web");
             const { ensureNodePtyHelperExecutable } = await import("./ensure-node-pty-helper.js");
             ensureNodePtyHelperExecutable();
             const { isPortInUseError, startServer } = await import("./server.js");
@@ -93,6 +96,9 @@ async function main() {
             break;
         }
         case "terminald": {
+            const { installServiceDiagnosticRotation } = await import("./diagnostic-logs.js");
+            const { dirname } = await import("node:path");
+            installServiceDiagnosticRotation(dirname(configPath), "terminald");
             const { ensureNodePtyHelperExecutable } = await import("./ensure-node-pty-helper.js");
             ensureNodePtyHelperExecutable();
             const { runTerminalDaemon } = await import("./terminal-daemon-server.js");
@@ -103,6 +109,31 @@ async function main() {
             process.stdout.write(`${configPath}\n`);
             break;
         }
+        case "storage:cleanup": {
+            const options = args.slice(1);
+            for (let i = 0; i < options.length; i++) {
+                if (options[i] === "-c" || options[i] === "--config") {
+                    if (!options[++i] || options[i].startsWith("-"))
+                        throw new Error("Missing config path.");
+                }
+                else if (options[i] !== "--apply")
+                    throw new Error("Usage: wand storage:cleanup [--apply] [-c <config>]");
+            }
+            const { createStorageCleanup } = await import("./storage-cleanup.js");
+            const { dirname } = await import("node:path");
+            const { openUploadCleanupStore } = await import("./storage/uploads-repository.js");
+            const { resolveDatabasePath } = await import("./storage.js");
+            const database = openUploadCleanupStore(resolveDatabasePath(configPath), options.includes("--apply"));
+            const cleanup = createStorageCleanup(dirname(configPath), { uploads: database?.uploads });
+            try {
+                process.stdout.write(`${JSON.stringify(await cleanup.run(options.includes("--apply")), null, 2)}\n`);
+            }
+            finally {
+                await cleanup.stop();
+                database?.close();
+            }
+            break;
+        }
         case "config:show": {
             // 展示合并后的视图（JSON 部署字段 + DB 偏好字段），但绝不打印运行时密钥。
             const { ensureDatabaseFile, resolveDatabasePath, WandStorage } = await import("./storage.js");
@@ -279,6 +310,7 @@ Commands:
   wand config:show          Print current config
   wand config:password      Print current login password
   wand config:set           Update a simple config value
+  wand storage:cleanup [--apply]  Inspect/reclaim abandoned Wand runtime storage
 
 Agent runtime:
   wand session:list         List sessions as JSON
@@ -821,12 +853,13 @@ function setConfigValue(config, key, value) {
                 port: Number(value)
             };
         case "https":
+        case "autoCleanupTemporaryFiles":
             if (value !== "true" && value !== "false") {
-                throw new Error("https must be 'true' or 'false'");
+                throw new Error(`${key} must be 'true' or 'false'`);
             }
             return {
                 ...config,
-                https: value === "true"
+                [key]: value === "true"
             };
         case "publicOrigin": {
             if (!value)
@@ -861,13 +894,17 @@ function setConfigValue(config, key, value) {
  * 都在 tui/commands.ts 内部处理。
  */
 async function runServiceCommand(command, args, configPath) {
+    const { elevateServiceCommand, resolveServiceCommandScope } = await import("./service-command-privilege.js");
+    const scope = resolveServiceCommandScope(command, args);
+    if (command === "service:restart" && !readFlagValue(args, "-c") && !readFlagValue(args, "--config")) {
+        const { readServiceConfigPath } = await import("./service-manager/index.js");
+        configPath = readServiceConfigPath(scope) ?? configPath;
+    }
+    const elevated = await elevateServiceCommand(command, args, configPath, scope);
+    if (elevated !== null)
+        return elevated;
     const { installService, uninstallService, serviceStart, serviceStop, serviceRestart, serviceStatus, serviceLogs, } = await import("./tui/commands.js");
     const verbose = args.includes("--verbose");
-    // --user / --system 决定 scope；不传走库里 default（= system）。
-    // 同时传 --user 和 --system 时 --user 胜（更"友好"那一个不需要 root）。
-    const wantUser = args.includes("--user");
-    const wantSystem = args.includes("--system");
-    const scope = wantUser ? "user" : (wantSystem ? "system" : undefined);
     switch (command) {
         case "service:install": {
             const result = installService({ configPath, scope });
@@ -897,7 +934,8 @@ async function runServiceCommand(command, args, configPath) {
             return result.ok ? 0 : 1;
         }
         case "service:restart": {
-            const result = serviceRestart(scope ? { scope } : undefined);
+            const timeoutSeconds = Number(readFlagValue(args, "--timeout") ?? 0);
+            const result = await serviceRestart({ scope, configPath, timeoutSeconds });
             printServiceResult(result, verbose);
             return result.ok ? 0 : 1;
         }
@@ -929,7 +967,7 @@ async function runServiceCommand(command, args, configPath) {
 function printServiceResult(result, verbose) {
     const prefix = result.ok ? "[wand]" : "[wand] ✗";
     process.stdout.write(`${prefix} ${result.message}\n`);
-    if (verbose && result.detail) {
+    if ((verbose || !result.ok) && result.detail) {
         process.stdout.write(result.detail + "\n");
     }
 }

package/dist/config.d.ts

@@ -7,7 +7,7 @@ import type { WandStorage } from "./storage.js";
  * 升级路径：老 JSON 里仍存有这些字段时，首次启动会被搬到 DB（见 migrateLegacyPreferencesToDb），
  * 然后下一次 saveConfig 写回 JSON 时它们会被剥离（见 stripPreferenceFields）。
  */
-export type PreferenceKey = "defaultProvider" | "defaultSessionKind" | "defaultEngine" | "defaultTaskWorktree" | "defaultMode" | "defaultCwd" | "defaultModel" | "defaultCodexModel" | "defaultOpenCodeModel" | "defaultGrokModel" | "defaultQoderModel" | "defaultPiModel" | "defaultGeminiModel" | "modelGroups" | "commitCli" | "commitModel" | "systemAiCli" | "systemAiModel" | "defaultThinkingEffort" | "language" | "cardDefaults" | "inheritEnv" | "taskRetention" | "userProfile" | "localDecision";
+export type PreferenceKey = "defaultProvider" | "defaultSessionKind" | "defaultEngine" | "defaultTaskWorktree" | "defaultMode" | "defaultCwd" | "defaultModel" | "defaultCodexModel" | "defaultOpenCodeModel" | "defaultGrokModel" | "defaultQoderModel" | "defaultPiModel" | "modelGroups" | "commitCli" | "commitModel" | "systemAiCli" | "systemAiModel" | "defaultThinkingEffort" | "language" | "cardDefaults" | "inheritEnv" | "taskRetention" | "userProfile" | "localDecision";
 /**
  * 每个 provider 的默认模型偏好字段。新增 provider 时只改这一处：
  * 偏好读写、环境归一、默认模型投影都从这张表派生。
@@ -19,7 +19,6 @@ export declare const PROVIDER_MODEL_PREFERENCE_FIELDS: {
     readonly grok: "defaultGrokModel";
     readonly qoder: "defaultQoderModel";
     readonly pi: "defaultPiModel";
-    readonly gemini: "defaultGeminiModel";
 };
 export type ProviderModelField = (typeof PROVIDER_MODEL_PREFERENCE_FIELDS)[SessionProvider];
 export declare function isPreferenceKey(key: string): key is PreferenceKey;
@@ -74,7 +73,7 @@ export interface PreferenceSpec<T> {
     };
     readonly hot: true;
 }
-declare const TRIMMED_STRING_PREFERENCE_KEYS: readonly ["defaultModel", "defaultCodexModel", "defaultOpenCodeModel", "defaultGrokModel", "defaultQoderModel", "defaultPiModel", "defaultGeminiModel", "commitModel", "systemAiModel", "language"];
+declare const TRIMMED_STRING_PREFERENCE_KEYS: readonly ["defaultModel", "defaultCodexModel", "defaultOpenCodeModel", "defaultGrokModel", "defaultQoderModel", "defaultPiModel", "commitModel", "systemAiModel", "language"];
 export type TrimmedStringPreferenceKey = (typeof TRIMMED_STRING_PREFERENCE_KEYS)[number];
 /** Every preference key, in schema order. */
 export declare const PREFERENCE_KEYS: PreferenceKey[];

package/dist/config.js

@@ -24,7 +24,6 @@ export const PROVIDER_MODEL_PREFERENCE_FIELDS = {
     grok: "defaultGrokModel",
     qoder: "defaultQoderModel",
     pi: "defaultPiModel",
-    gemini: "defaultGeminiModel",
 };
 const PROVIDER_MODEL_FIELDS = Object.values(PROVIDER_MODEL_PREFERENCE_FIELDS);
 function preferenceStorageKey(key) {
@@ -59,6 +58,7 @@ export const defaultConfig = () => ({
     host: "127.0.0.1",
     port: 8443,
     https: false,
+    autoCleanupTemporaryFiles: true,
     password: "change-me",
     shell: resolveDefaultShell(),
     startupCommands: [],
@@ -169,7 +169,14 @@ export async function loadConfigWithStorage(configPath, storage) {
     }
     migrateLegacyPreferencesToDb(rawInput, storage);
     migrateLegacyPasswordToDb(rawInput, storage);
-    const config = mergeWithDefaults(rawInput);
+    // DB preferences are authoritative, including a user correction of an old
+    // JSON tool selection. Do not validate the shadowed legacy JSON value.
+    const mergeInput = { ...rawInput };
+    for (const key of EXECUTION_TOOL_PREFERENCES) {
+        if (storage.hasPreference(preferenceStorageKey(key)))
+            delete mergeInput[key];
+    }
+    const config = mergeWithDefaults(mergeInput);
     applyStoragePreferences(config, storage);
     // appSecret: DB 是权威源。
     // - DB 有 → 直接覆盖 runtime config（即使 mergeWithDefaults 临时生成了新的，也以 DB 为准）
@@ -306,7 +313,7 @@ function enumSpec(key, options) {
 }
 const TRIMMED_STRING_PREFERENCE_KEYS = [
     "defaultModel", "defaultCodexModel", "defaultOpenCodeModel", "defaultGrokModel", "defaultQoderModel",
-    "defaultPiModel", "defaultGeminiModel", "commitModel", "systemAiModel", "language",
+    "defaultPiModel", "commitModel", "systemAiModel", "language",
 ];
 function isOneOf(options) {
     return (value) => typeof value === "string" && options.includes(value);
@@ -364,7 +371,6 @@ const PREFERENCE_SPECS = {
     defaultGrokModel: trimmedStringSpec("defaultGrokModel", () => ""),
     defaultQoderModel: trimmedStringSpec("defaultQoderModel", () => ""),
     defaultPiModel: trimmedStringSpec("defaultPiModel", () => ""),
-    defaultGeminiModel: trimmedStringSpec("defaultGeminiModel", () => ""),
     modelGroups: {
         storageKey: preferenceStorageKey("modelGroups"),
         default: () => [],
@@ -472,6 +478,13 @@ export function preferenceSpec(key) {
 }
 /** Keys applied to the live process config without restart (all of them today). */
 export const HOT_PREFERENCE_KEYS = PREFERENCE_KEYS.filter((key) => PREFERENCE_SPECS[key].hot);
+const EXECUTION_TOOL_PREFERENCES = ["defaultProvider", "systemAiCli", "commitCli"];
+/** Removed/unknown explicit tools must never silently become another executable. */
+function assertSupportedToolPreference(key, value) {
+    if (typeof value === "string" && value.trim() && !PREFERENCE_SPECS[key].read(value)) {
+        throw new Error(`不支持的执行工具偏好 ${key}: ${value}。请重新选择受支持的工具；原配置与历史已保留。`);
+    }
+}
 /** 用 DB 里的偏好覆盖 config 对象（in-place），返回同一个引用。DB 里没有的字段不动，保留默认值。 */
 export function applyStoragePreferences(config, storage) {
     const target = config;
@@ -479,7 +492,11 @@ export function applyStoragePreferences(config, storage) {
         const spec = PREFERENCE_SPECS[key];
         if (!storage.hasPreference(spec.storageKey))
             continue;
-        const result = spec.read(storage.getPreference(spec.storageKey, spec.default()));
+        const raw = storage.getPreference(spec.storageKey, spec.default());
+        if (EXECUTION_TOOL_PREFERENCES.includes(key)) {
+            assertSupportedToolPreference(key, raw);
+        }
+        const result = spec.read(raw);
         if (result)
             target[key] = result.value;
     }
@@ -649,12 +666,16 @@ function normalizeStructuredChatPersona(input) {
     return { user, assistant };
 }
 function mergeWithDefaults(input) {
+    for (const key of EXECUTION_TOOL_PREFERENCES)
+        assertSupportedToolPreference(key, input[key]);
     const defaults = defaultConfig();
     return {
         ...defaults,
         ...input,
         // Ensure https is boolean
         https: typeof input.https === "boolean" ? input.https : defaults.https,
+        autoCleanupTemporaryFiles: typeof input.autoCleanupTemporaryFiles === "boolean"
+            ? input.autoCleanupTemporaryFiles : defaults.autoCleanupTemporaryFiles,
         browserExtensionIds: Array.isArray(input.browserExtensionIds)
             ? input.browserExtensionIds.filter((id) => typeof id === "string").map((id) => id.trim()).filter(Boolean)
             : undefined,

package/dist/core-status-cli.d.ts

@@ -8,4 +8,4 @@ export interface CoreStatus {
 export declare function remainingCoreRequestBudget(deadline: number): number;
 export declare function checkCoreStatus(configPath: string): Promise<void>;
 /** Zero means wait indefinitely. A timeout/error NEVER runs the stop command. */
-export declare function waitForCoreTurnsComplete(configPath: string, timeoutSeconds?: number, stopCommand?: string[], allowStopped?: boolean): Promise<number>;
+export declare function waitForCoreTurnsComplete(configPath: string, timeoutSeconds?: number, stopCommand?: string[] | (() => Promise<number>), allowStopped?: boolean): Promise<number>;

package/dist/core-status-cli.js

@@ -181,7 +181,7 @@ export async function checkCoreStatus(configPath) {
 export async function waitForCoreTurnsComplete(configPath, timeoutSeconds = 0, stopCommand, allowStopped = false) {
     if (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 0)
         throw new Error("--timeout 必须是非负秒数（0 表示一直等待）。");
-    if (stopCommand && !stopCommand.length)
+    if (Array.isArray(stopCommand) && !stopCommand.length)
         throw new Error("缺少等待完成后要执行的停止命令。");
     const deadline = timeoutSeconds > 0 ? Date.now() + timeoutSeconds * 1000 : Infinity;
     const control = await openControl(configPath, deadline);
@@ -240,6 +240,8 @@ export async function waitForCoreTurnsComplete(configPath, timeoutSeconds = 0, s
         console.log("[wand] 原生 Core 回合已全部完成，可以停止服务。");
         if (!stopCommand)
             return 0;
+        if (typeof stopCommand === "function")
+            return await stopCommand();
         return await new Promise((resolve, reject) => {
             const child = spawn(stopCommand[0], stopCommand.slice(1), { stdio: "inherit" });
             child.once("error", reject);

package/dist/daemon-connection.d.ts

@@ -4,6 +4,16 @@ export declare function rejectPendingRequests<T extends {
     timer: NodeJS.Timeout;
     reject(error: Error): void;
 }>(pending: Map<number, T>, error: Error): void;
+/** Replay a retained terminal event asynchronously; disposal cancels queued delivery. */
+export declare function subscribeWithPendingEvent<Event>(listeners: Set<(event: Event) => void>, listener: (event: Event) => void, pending: Event | null): {
+    dispose(): void;
+};
+/** A queued batch belongs to this registration; the owner has already taken it from its buffer. */
+export declare function subscribeWithBufferedEvents<Event>(listeners: Set<(event: Event) => void>, listener: (event: Event) => void, pending: readonly Event[]): {
+    dispose(): void;
+};
+/** Snapshot listeners once so re-entrant subscription changes cannot alter the current delivery. */
+export declare function emitToSubscribedListeners<Event>(listeners: Set<(event: Event) => void>, event: Event): boolean;
 /** Bound connect attempts, including sockets that close before the handshake. */
 export declare function waitForDaemonSocket(socket: net.Socket): Promise<void>;
 /** Probe the application, not just the fd: a half-open socket may still be writable. */

package/dist/daemon-connection.js

@@ -10,6 +10,34 @@ export function rejectPendingRequests(pending, error) {
     }
     pending.clear();
 }
+/** Replay a retained terminal event asynchronously; disposal cancels queued delivery. */
+export function subscribeWithPendingEvent(listeners, listener, pending) {
+    listeners.add(listener);
+    if (pending)
+        queueMicrotask(() => { if (listeners.has(listener))
+            listener(pending); });
+    return { dispose: () => listeners.delete(listener) };
+}
+/** A queued batch belongs to this registration; the owner has already taken it from its buffer. */
+export function subscribeWithBufferedEvents(listeners, listener, pending) {
+    const subscription = subscribeWithPendingEvent(listeners, listener, null);
+    if (pending.length > 0)
+        queueMicrotask(() => {
+            if (!listeners.has(listener))
+                return;
+            for (const event of pending)
+                listener(event);
+        });
+    return subscription;
+}
+/** Snapshot listeners once so re-entrant subscription changes cannot alter the current delivery. */
+export function emitToSubscribedListeners(listeners, event) {
+    if (listeners.size === 0)
+        return false;
+    for (const listener of Array.from(listeners))
+        listener(event);
+    return true;
+}
 /** Bound connect attempts, including sockets that close before the handshake. */
 export function waitForDaemonSocket(socket) {
     return new Promise((resolve, reject) => {

package/dist/diagnostic-logs.d.ts

@@ -0,0 +1,10 @@
+export declare const DIAGNOSTIC_LOG_MAX_BYTES: number;
+export declare const DIAGNOSTIC_LOG_ROTATIONS = 3;
+export declare const DIAGNOSTIC_LOG_RETENTION_DAYS = 14;
+export declare const DIAGNOSTIC_RECEIPT_SUFFIX = ".wand-log-receipt.json";
+export declare function diagnosticReceiptMatches(file: string): boolean;
+/** Only redundant diagnostics: PTY history and native protocol sources never enter this writer. */
+export declare function appendBoundedDiagnostic(file: string, data: string | Buffer, maxBytes?: number, rotations?: number): void;
+/** Attach only to launchd/file redirections matching this instance; keep TTYs and journald untouched. */
+export declare function installServiceDiagnosticRotation(configDir: string, kind: "web" | "terminald"): () => void;
+export declare function isDiagnosticArchive(name: string): boolean;