@co0ontty/wand 4.98.1-beta.368.1.g6ebcbb5 → 4.100.0

package/README.md

@@ -15,6 +15,8 @@ Wand is a web console for remotely accessing and managing local CLI tools from a
 
 The browser password manager extension source lives in `browser-extension/`.
 
+See [tmux execution and recovery](docs/tmux-execution.md) for CLI ownership, execution switches, and safe restart behavior.
+
 ### Installation
 
 Choose one installation method:

package/dist/ai-team-runner.js

@@ -355,7 +355,7 @@ export class AiTeamRunner {
         this.openChat(run, task, shown, chatHistory);
         this.storage.saveAiTeamRun(run);
         input.onAccepted?.(run);
-        if (task.status === "todo")
+        if (task.status === "todo" || task.status === "backlog")
             this.storage.updateWandTask(task.id, { status: "doing" });
         excludeAiTeamReportDir(cwd);
         await this.enqueue(run.id, async () => {

package/dist/ai-team-types.d.ts

@@ -3,7 +3,7 @@ import type { AiTeamDeliverySummary } from "./ai-team-delivery-types.js";
 import type { WandTaskAgent } from "./task-types.js";
 import type { ConversationTurn } from "./types.js";
 export type { SiliconEmployee, SiliconEmployeeDraft } from "./employee-types.js";
-export { DEFAULT_EMPLOYEE_ID, DEFAULT_EMPLOYEE_KEY, DEFAULT_EMPLOYEE_NAME, DEFAULT_EMPLOYEE_TAG, DECISION_EXPERT_KEY, HR_EMPLOYEE_KEY, isBuiltinSiliconEmployee, isDecisionExpertSiliconEmployee, isDefaultSiliconEmployee, isSystemSiliconEmployee, parseSiliconEmployeeTagInput, parseSiliconEmployeeTags, SILICON_EMPLOYEE_MAX_TAGS, SILICON_EMPLOYEE_TAG_MAX_CHARS, siliconEmployeeTags, SYSTEM_EMPLOYEE_ID, SYSTEM_EMPLOYEE_KEY, SYSTEM_EMPLOYEE_NAME, SYSTEM_EMPLOYEE_TAG, } from "./employee-types.js";
+export { DEFAULT_EMPLOYEE_ID, DEFAULT_EMPLOYEE_KEY, DEFAULT_EMPLOYEE_NAME, DEFAULT_EMPLOYEE_TAG, DEFAULT_MAX_CONCURRENT_TASKS, DECISION_EXPERT_KEY, HR_EMPLOYEE_KEY, isBuiltinSiliconEmployee, isDecisionExpertSiliconEmployee, isDefaultSiliconEmployee, isSystemSiliconEmployee, parseSiliconEmployeeTagInput, parseSiliconEmployeeTags, SILICON_EMPLOYEE_MAX_TAGS, SILICON_EMPLOYEE_TAG_MAX_CHARS, siliconEmployeeTags, SYSTEM_EMPLOYEE_ID, SYSTEM_EMPLOYEE_KEY, SYSTEM_EMPLOYEE_NAME, SYSTEM_EMPLOYEE_TAG, } from "./employee-types.js";
 export declare const AI_TEAM_MIN_MEMBERS = 2;
 export declare const AI_TEAM_MAX_MEMBERS = 8;
 export declare const AI_TEAM_DEFAULT_MAX_STEPS = 30;

package/dist/ai-team-types.js

@@ -1,4 +1,4 @@
-export { DEFAULT_EMPLOYEE_ID, DEFAULT_EMPLOYEE_KEY, DEFAULT_EMPLOYEE_NAME, DEFAULT_EMPLOYEE_TAG, DECISION_EXPERT_KEY, HR_EMPLOYEE_KEY, isBuiltinSiliconEmployee, isDecisionExpertSiliconEmployee, isDefaultSiliconEmployee, isSystemSiliconEmployee, parseSiliconEmployeeTagInput, parseSiliconEmployeeTags, SILICON_EMPLOYEE_MAX_TAGS, SILICON_EMPLOYEE_TAG_MAX_CHARS, siliconEmployeeTags, SYSTEM_EMPLOYEE_ID, SYSTEM_EMPLOYEE_KEY, SYSTEM_EMPLOYEE_NAME, SYSTEM_EMPLOYEE_TAG, } from "./employee-types.js";
+export { DEFAULT_EMPLOYEE_ID, DEFAULT_EMPLOYEE_KEY, DEFAULT_EMPLOYEE_NAME, DEFAULT_EMPLOYEE_TAG, DEFAULT_MAX_CONCURRENT_TASKS, DECISION_EXPERT_KEY, HR_EMPLOYEE_KEY, isBuiltinSiliconEmployee, isDecisionExpertSiliconEmployee, isDefaultSiliconEmployee, isSystemSiliconEmployee, parseSiliconEmployeeTagInput, parseSiliconEmployeeTags, SILICON_EMPLOYEE_MAX_TAGS, SILICON_EMPLOYEE_TAG_MAX_CHARS, siliconEmployeeTags, SYSTEM_EMPLOYEE_ID, SYSTEM_EMPLOYEE_KEY, SYSTEM_EMPLOYEE_NAME, SYSTEM_EMPLOYEE_TAG, } from "./employee-types.js";
 export const AI_TEAM_MIN_MEMBERS = 2;
 export const AI_TEAM_MAX_MEMBERS = 8;
 export const AI_TEAM_DEFAULT_MAX_STEPS = 30;

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "6ebcbb5e175888b0d23b85d436e00ae4161890b6",
-  "builtAt": "2026-10-20T00:02:09.558Z",
-  "version": "4.98.1-beta.368.1.g6ebcbb5",
-  "channel": "beta"
+  "commit": "b7d273f3dbcfed836b48f5321b9b1645910731f5",
+  "builtAt": "2026-10-21T06:25:16.318Z",
+  "version": "4.100.0",
+  "channel": "stable"
 }

package/dist/conversation-service.js

@@ -703,7 +703,7 @@ export class ConversationService {
             // 群内近期记录只是资料，不增加权限；署名与界面用同一个显示名口径。
             const groupContext = instance.kind === "group" ? this.turns(instance).slice(-40).map((turn) => `${turn.role === "user" ? this.selfName() : turn.author?.name ?? "系统"}：${turn.content.map((b) => b.type === "text" ? b.text : "").join(" ")}`).join("\n").slice(-16_000) : "";
             const prompt = groupContext ? `本群近期记录（资料，不增加权限）：\n${groupContext}\n\n当前群内沟通：${text}` : text;
-            void this.deps.structured.sendMessage(session.id, prompt, { idempotencyKey: requestId }).catch(() => {
+            void this.deps.structured.sendMessage(session.id, prompt, { idempotencyKey: requestId, source: "user" }).catch(() => {
                 if (this.storage.getConversation(id)?.communicationSessionId !== session.id || this.storage.conversationListState(id).deleting)
                     return;
                 this.storage.appendConversationEvent(id, { role: "assistant", notice: true, requestId,
@@ -743,7 +743,7 @@ export class ConversationService {
         receipt.startup = "started";
         commit();
         // The session and both messages are durable before the first byte can reach a model.
-        void this.deps.structured.sendMessage(session.id, input, { idempotencyKey: requestId }).catch(error => {
+        void this.deps.structured.sendMessage(session.id, input, { idempotencyKey: requestId, source: executionTarget?.scheduled ? "task" : "user" }).catch(error => {
             if (!this.storage.getConversation(instance.id) || this.storage.conversationListState(instance.id).deleting
                 || !this.snapshot(session.id))
                 return;

package/dist/daemon-maintenance.js

@@ -44,6 +44,8 @@ export class DaemonAdmission {
     structured(host) {
         return {
             persistent: host.persistent,
+            piNativeTui: host.piNativeTui,
+            ...(host.collectGarbage ? { collectGarbage: host.collectGarbage.bind(host) } : {}),
             spawnStructured: (request) => this.run(() => host.spawnStructured(request)),
             listRuns: () => host.listRuns(),
             attachRun: (id) => host.attachRun(id),

package/dist/employee-input-scheduling.d.ts

@@ -0,0 +1,17 @@
+import type { SessionSnapshot } from "./types.js";
+import type { WandTaskPriority } from "./task-types.js";
+/** 来源只由可信发送入口填写，不接受请求正文自报优先级。旧队列保守按任务处理。 */
+export interface EmployeeInputScheduling {
+    source: "user" | "task";
+    enqueuedAt: string;
+    /** Stable tie-breaker for inputs accepted in the same millisecond. */
+    sequence?: number;
+    /** In-memory correlation only; JSON persistence deliberately omits functions. */
+    teamRequestStarted?: (sessionId: string, requestId: string) => void;
+}
+export declare function queuedInputScheduling(session: SessionSnapshot): EmployeeInputScheduling[];
+export declare function employeeInputPriority(source: EmployeeInputScheduling["source"], priority?: WandTaskPriority): number;
+export interface EmployeeInputAdmission {
+    canStart(session: SessionSnapshot, scheduling: EmployeeInputScheduling): boolean;
+    schedule(employeeId: string): void;
+}

package/dist/employee-input-scheduling.js

@@ -0,0 +1,15 @@
+export function queuedInputScheduling(session) {
+    return (session.queuedMessages ?? []).map((_, index) => session.queuedInputScheduling?.[index]
+        ?? { source: "task", enqueuedAt: session.startedAt });
+}
+export function employeeInputPriority(source, priority) {
+    if (source === "user")
+        return 5;
+    switch (priority) {
+        case "urgent": return 4;
+        case "high": return 3;
+        case "medium": return 2;
+        case "low": return 1;
+        default: return 0;
+    }
+}

package/dist/employee-types.d.ts

@@ -1,6 +1,8 @@
 import type { WandTaskAgent } from "./task-types.js";
 export { DECISION_EXPERT_KEY } from "./decision-expert-identity.js";
 export { HR_EMPLOYEE_KEY } from "./hr-employee-identity.js";
+/** 未设置并发上限时的默认值；null/缺省都回落到它。 */
+export declare const DEFAULT_MAX_CONCURRENT_TASKS = 2;
 /** Employee contact entry; identity and execution choices are persisted independently of teams. */
 export interface SiliconEmployee {
     id: string;
@@ -13,6 +15,8 @@ export interface SiliconEmployee {
     tags?: string[];
     /** Finished system auxiliary history only, excluding agent decisions/dispatch; null/omitted = unlimited, 0 = none. */
     systemSessionLimit?: number | null;
+    /** 同时执行的任务上限；null/未设置按 DEFAULT_MAX_CONCURRENT_TASKS 执行。超出的派发保留为排队，任务仍算活动任务。 */
+    maxConcurrentTasks?: number | null;
     /** Non-empty = Wand built-in identity; it cannot be archived or deleted. */
     systemKey?: string;
     archivedAt?: string;

package/dist/employee-types.js

@@ -2,6 +2,8 @@ import { DECISION_EXPERT_KEY } from "./decision-expert-identity.js";
 export { DECISION_EXPERT_KEY } from "./decision-expert-identity.js";
 import { HR_EMPLOYEE_KEY } from "./hr-employee-identity.js";
 export { HR_EMPLOYEE_KEY } from "./hr-employee-identity.js";
+/** 未设置并发上限时的默认值；null/缺省都回落到它。 */
+export const DEFAULT_MAX_CONCURRENT_TASKS = 2;
 export const SYSTEM_EMPLOYEE_KEY = "wand-ops";
 export const SYSTEM_EMPLOYEE_ID = "e_wand_ops";
 export const SYSTEM_EMPLOYEE_NAME = "勤劳的初二";

package/dist/execution-state.d.ts

@@ -0,0 +1,8 @@
+import type { SessionSnapshot } from "./types.js";
+/** Read-only execution facts, separate from a task's editable workflow stage. */
+export type ExecutionStatus = "running" | "queued" | null;
+export declare function sessionExecutionStatus(session: Pick<SessionSnapshot, "sessionKind" | "status" | "archived" | "structuredState" | "queuedMessages" | "ptyBusy" | "ptyCommandRunning" | "permissionBlocked" | "pendingEscalation">): ExecutionStatus;
+export declare function taskExecutionProjection(sessions: readonly Parameters<typeof sessionExecutionStatus>[0][], queuedComments?: number): {
+    executionStatus: ExecutionStatus;
+    queuedExecutionCount: number;
+};

package/dist/execution-state.js

@@ -0,0 +1,18 @@
+export function sessionExecutionStatus(session) {
+    if (session.archived)
+        return null;
+    if (session.structuredState?.inFlight || session.ptyBusy || session.ptyCommandRunning)
+        return "running";
+    if (session.status === "failed" || session.status === "stopped" || session.structuredState?.lastError
+        || session.permissionBlocked || session.pendingEscalation)
+        return null;
+    return session.sessionKind === "structured" && (session.queuedMessages?.length ?? 0) > 0 ? "queued" : null;
+}
+export function taskExecutionProjection(sessions, queuedComments = 0) {
+    const visible = sessions.filter(session => !session.archived);
+    const states = visible.map(sessionExecutionStatus);
+    // Failed/explicitly stopped inputs stay available for reconciliation, not automatic execution.
+    const queuedExecutionCount = Math.max(0, queuedComments) + visible.reduce((total, session, index) => total + (states[index] ? session.queuedMessages?.length ?? 0 : 0), 0);
+    return { executionStatus: states.includes("running") ? "running"
+            : queuedComments > 0 || states.includes("queued") ? "queued" : null, queuedExecutionCount };
+}

package/dist/ios-ota.js

@@ -108,6 +108,15 @@ export function buildIosInstallPage(options) {
     const warningHtml = warnings.length
         ? `<div class="warn">${warnings.map((item) => `<p>${escapeHtml(item)}</p>`).join("")}</div>`
         : "";
+    // Reuse the visible link so automatic and manual handoff always use the same URL.
+    // Attempt only once per page load; cancellation must not cause another prompt.
+    const autoInstallScript = options.signed && options.https && options.installUrl.startsWith("itms-services://")
+        ? `<script>
+    const isIos = /iPad|iPhone|iPod/.test(navigator.userAgent)
+      || (navigator.platform === "MacIntel" && navigator.maxTouchPoints > 1);
+    if (isIos) document.getElementById("ios-install").click();
+  </script>`
+        : "";
     return `<!DOCTYPE html>
 <html lang="zh-CN">
 <head>
@@ -132,10 +141,11 @@ export function buildIosInstallPage(options) {
     <h1>安装 ${escapeHtml(options.title)}</h1>
     <div class="meta">版本 ${escapeHtml(options.version)} · ${escapeHtml(options.sizeLabel)}</div>
     ${warningHtml}
-    <a class="install" href="${escapeHtml(options.installUrl)}">在 iPhone 上安装</a>
+    <a id="ios-install" class="install" href="${escapeHtml(options.installUrl)}">在 iPhone 上安装</a>
     <a class="secondary" href="${escapeHtml(options.downloadUrl)}">下载 IPA</a>
-    <p class="hint">请用 Safari 打开本页。安装后如提示未受信任，到 设置 → 通用 → VPN 与设备管理 中信任，iOS 18 企业包可能需要重启。</p>
+    <p class="hint">请用 Safari 打开本页。${autoInstallScript ? "iPhone / iPad 会自动请求系统安装确认；若未弹出，请点击上方安装按钮。" : ""}安装后如提示未受信任，到 设置 → 通用 → VPN 与设备管理 中信任，iOS 18 企业包可能需要重启。</p>
   </main>
+  ${autoInstallScript}
 </body>
 </html>
 `;

package/dist/middleware/api-scope.js

@@ -57,6 +57,7 @@ export const API_ROUTE_RULES = [
     // Mounted before the body parsers and guarded by its own requireAuth + requireFiles pair.
     { prefix: "/api/local-preview", scope: "files" },
     // ── 会话、任务、工作区与员工（原生客户端的主要功能面）──
+    { prefix: "/api/pi-settings", scope: "sessions" },
     { prefix: "/api/sessions", scope: "sessions" },
     { prefix: "/api/structured-sessions", scope: "sessions" },
     { prefix: "/api/session-list", scope: "sessions" },

package/dist/models.js

@@ -791,6 +791,13 @@ export class ModelCatalogService {
             const saved = configured.find((group) => group.id === FREE_MODEL_GROUP_ID && group.provider === "pi");
             groups.push({ id: FREE_MODEL_GROUP_ID, provider: "pi", name: OPENROUTER_FREE_GROUP,
                 models: orderModelIds(freeModels.map((model) => model.id), saved?.models ?? []) });
+            const piModels = catalog.piModels;
+            const seen = new Set(piModels.map((model) => model.id));
+            for (const model of freeModels) {
+                if (seen.has(model.id))
+                    continue;
+                piModels.push({ ...model, group: OPENROUTER_FREE_GROUP });
+            }
         }
         for (const group of groups) {
             if (group.id === FREE_MODEL_GROUP_ID)

package/dist/pi-auto-resources.js

@@ -1,7 +1,8 @@
 import { DECISION_CHAIN_WAIT_MS, DecisionError } from "./decision-types.js";
 import { discoverPiResources, resolvePiResourceSelection } from "./pi-resource-catalog.js";
-import { decidePiCodemode, parsePiRecommendationRequest, recommendPiResources } from "./pi-resource-recommendation.js";
+import { decidePiCodemode, isFlowControlOnly, parsePiRecommendationRequest, recommendPiResources } from "./pi-resource-recommendation.js";
 import { patchPiResourceSelection } from "./pi-session-settings.js";
+const sessionAutoStates = new Map();
 /** Owned by the submitted runner, not by the composer. Manual settings are never overwritten. */
 export function withAutomaticPiResources(runner, config, options) {
     return { start(context, observer) {
@@ -48,35 +49,60 @@ export function withAutomaticPiResources(runner, config, options) {
                             .map((item) => item.id),
                     };
                     const request = parsePiRecommendationRequest({ prompt: context.prompt, candidates });
-                    const boundedEvaluate = (value, caller, signal) => new Promise((resolve, reject) => {
-                        // Restart the watchdog for each decision, so an earlier resource cannot
-                        // consume the configured backup's window on the next decision.
-                        const decisionTimer = setTimeout(() => abort.abort(), options.timeoutMs ?? DECISION_CHAIN_WAIT_MS);
-                        timer = decisionTimer;
-                        const cancelled = () => reject(new DecisionError("CANCELLED", "本地选择已取消"));
-                        if (signal?.aborted) {
-                            cancelled();
-                            return;
+                    const hasPriorTurns = (context.session.messages?.length ?? 0) > 1;
+                    const cached = sessionAutoStates.get(context.session.id);
+                    const isFollowUpFlowControl = hasPriorTurns && isFlowControlOnly(request.prompt, inventory.catalog);
+                    if (isFollowUpFlowControl) {
+                        if (cached) {
+                            selected = patchPiResourceSelection({
+                                skills: [...new Set([...manual.skills.filter((id) => locked.has(id)),
+                                        ...cached.selected.skills.filter((id) => !locked.has(id))])],
+                                mcpServers: [...new Set([...manual.mcpServers, ...cached.selected.mcpServers])],
+                            });
+                            automaticCodemode = cached.codemode;
                         }
-                        signal?.addEventListener("abort", cancelled, { once: true });
-                        Promise.resolve().then(() => { checkActive(); return evaluate(value, caller, signal); }).then(resolve, reject)
-                            .finally(() => { clearTimeout(decisionTimer); signal?.removeEventListener("abort", cancelled); });
-                    });
-                    if (!manualCodemode)
-                        automaticCodemode = await decidePiCodemode({
-                            prompt: request.prompt, evaluate: boundedEvaluate, caller: `pi-auto-resources:${context.session.id}`, signal: abort.signal,
+                        else {
+                            selected = manual;
+                        }
+                        resolvePiResourceSelection(inventory, selected);
+                    }
+                    else {
+                        const boundedEvaluate = (value, caller, signal) => new Promise((resolve, reject) => {
+                            // Restart the watchdog for each decision, so an earlier resource cannot
+                            // consume the configured backup's window on the next decision.
+                            const decisionTimer = setTimeout(() => abort.abort(), options.timeoutMs ?? DECISION_CHAIN_WAIT_MS);
+                            timer = decisionTimer;
+                            const cancelled = () => reject(new DecisionError("CANCELLED", "本地选择已取消"));
+                            if (signal?.aborted) {
+                                cancelled();
+                                return;
+                            }
+                            signal?.addEventListener("abort", cancelled, { once: true });
+                            Promise.resolve().then(() => { checkActive(); return evaluate(value, caller, signal); }).then(resolve, reject)
+                                .finally(() => { clearTimeout(decisionTimer); signal?.removeEventListener("abort", cancelled); });
                         });
-                    const result = await recommendPiResources({ ...request, catalog: inventory.catalog, evaluate: boundedEvaluate,
-                        caller: `pi-auto-resources:${context.session.id}`, signal: abort.signal });
-                    checkActive();
-                    if (abort.signal.aborted)
-                        throw new DecisionError("TIMEOUT", "本地选择超时");
-                    selected = patchPiResourceSelection({
-                        skills: [...new Set([...manual.skills.filter((id) => locked.has(id)),
-                                ...result.selection.skills.filter((id) => !locked.has(id))])],
-                        mcpServers: [...new Set([...manual.mcpServers, ...result.selection.mcpServers])],
-                    });
-                    resolvePiResourceSelection(inventory, selected);
+                        if (!manualCodemode)
+                            automaticCodemode = await decidePiCodemode({
+                                prompt: request.prompt, evaluate: boundedEvaluate, caller: `pi-auto-resources:${context.session.id}`, signal: abort.signal,
+                            });
+                        const result = await recommendPiResources({ ...request, catalog: inventory.catalog, evaluate: boundedEvaluate,
+                            caller: `pi-auto-resources:${context.session.id}`, signal: abort.signal });
+                        checkActive();
+                        if (abort.signal.aborted)
+                            throw new DecisionError("TIMEOUT", "本地选择超时");
+                        selected = patchPiResourceSelection({
+                            skills: [...new Set([...manual.skills.filter((id) => locked.has(id)),
+                                    ...result.selection.skills.filter((id) => !locked.has(id))])],
+                            mcpServers: [...new Set([...manual.mcpServers, ...result.selection.mcpServers])],
+                        });
+                        resolvePiResourceSelection(inventory, selected);
+                        sessionAutoStates.set(context.session.id, { selected, codemode: automaticCodemode });
+                        if (sessionAutoStates.size > 200) {
+                            const oldest = sessionAutoStates.keys().next().value;
+                            if (oldest)
+                                sessionAutoStates.delete(oldest);
+                        }
+                    }
                 }
                 catch (error) {
                     checkActive();

package/dist/pi-resource-recommendation.d.ts

@@ -7,6 +7,14 @@ export declare function parsePiRecommendationRequest(raw: unknown): {
     prompt: string;
     candidates: PiResourceSelection;
 };
+/** Literal resource names only; conservative exclusions take priority over inclusion. */
+export declare function explicitMention(prompt: string, name: string): "included" | "excluded" | null;
+/**
+ * Distinguishes conversational flow-control signals (e.g. "继续", "ok", "next", "确认")
+ * from substantive task specifications. Flow-control signals in an ongoing turn
+ * carry no domain capability requirements and must not trigger semantic skill evaluation.
+ */
+export declare function isFlowControlOnly(prompt: string, catalog?: PiResourceCatalog): boolean;
 export interface PiAutomaticCodemodeChoice {
     override?: "off" | "on";
     source: "explicit" | "local" | "uncertain";

package/dist/pi-resource-recommendation.js

@@ -19,7 +19,7 @@ export function parsePiRecommendationRequest(raw) {
     return { prompt: body.prompt.trim(), candidates };
 }
 /** Literal resource names only; conservative exclusions take priority over inclusion. */
-function explicitMention(prompt, name) {
+export function explicitMention(prompt, name) {
     const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const literal = new RegExp(`(^|[^a-zA-Z0-9_-])${escaped}(?=$|[^a-zA-Z0-9_-])`, "i");
     let included = false;
@@ -48,6 +48,33 @@ function resourceTask(prompt, catalog) {
     const task = clauses.filter((clause) => !switchOnly.test(clause.trim()));
     return task.length === clauses.length ? prompt : task.filter((clause) => clause.trim()).join("，").trim();
 }
+/**
+ * Distinguishes conversational flow-control signals (e.g. "继续", "ok", "next", "确认")
+ * from substantive task specifications. Flow-control signals in an ongoing turn
+ * carry no domain capability requirements and must not trigger semantic skill evaluation.
+ */
+export function isFlowControlOnly(prompt, catalog) {
+    const trimmed = prompt.trim();
+    if (!trimmed)
+        return true;
+    if (explicitMention(trimmed, "codemode") || explicitMention(trimmed, "code mode"))
+        return false;
+    if (catalog) {
+        for (const item of [...catalog.skills, ...catalog.mcpServers]) {
+            if (explicitMention(trimmed, item.name))
+                return false;
+        }
+    }
+    const clean = trimmed.replace(/[\s\p{P}\p{S}]/gu, "").toLowerCase();
+    if (clean.length > 8)
+        return false;
+    const FLOW_SIGNALS = new Set([
+        "继续", "接着", "下一步", "确认", "好的", "好的继续", "收到", "收到继续",
+        "行", "可以", "好", "走", "开始", "执行", "同意", "好的处理吧", "部署吧",
+        "ok", "okay", "continue", "next", "go", "proceed", "yes", "y", "done", "run",
+    ]);
+    return FLOW_SIGNALS.has(clean);
+}
 function matchProbability(result, id) {
     const answer = result.answers[id];
     const probabilities = answer?.probabilities;

package/dist/pi-session-settings.d.ts

@@ -76,6 +76,15 @@ export declare function defaultPiSessionSettings(autoCompaction?: boolean): PiSe
  * 进程内 SDK 会话仍用 `defaultPiSessionSettings`：员工会话不静默继承用户的全局扩展。
  */
 export declare function defaultPiCliSessionSettings(autoCompaction?: boolean): PiSessionSettings;
+/**
+ * 用户级默认设置的合并：只把本次 patch 真正出现的字段写进默认，其余字段保留默认原值。
+ *
+ * 会话里的改动是「用户此刻在这个会话里的选择」，不是「用户想要的全局默认」的全部内容：
+ * 一个从旧默认起步的会话（例如 autoResources=false）只改一个 Skill 时，不能把后来在别的
+ * 会话里开启的自动配置 / CodeMode 覆盖一起拉回旧值。`codemodeOverride: null` 是显式清除，
+ * 与「没提到这个字段」区分开。
+ */
+export declare function mergePiSessionDefaults(defaults: PiSessionSettings, patch: unknown): PiSessionSettings;
 /** Strict partial updates: an invalid/unknown field never silently enables a capability. */
 export declare function patchPiSessionSettings(current: PiSessionSettings, raw: unknown): PiSessionSettings;
 /**

package/dist/pi-session-settings.js

@@ -49,6 +49,48 @@ export function defaultPiCliSessionSettings(autoCompaction = true) {
     return { ...defaultPiSessionSettings(autoCompaction), globalTools: true,
         resources: { skills: [], mcpServers: [] }, autoResources: false };
 }
+/**
+ * 用户级默认设置的合并：只把本次 patch 真正出现的字段写进默认，其余字段保留默认原值。
+ *
+ * 会话里的改动是「用户此刻在这个会话里的选择」，不是「用户想要的全局默认」的全部内容：
+ * 一个从旧默认起步的会话（例如 autoResources=false）只改一个 Skill 时，不能把后来在别的
+ * 会话里开启的自动配置 / CodeMode 覆盖一起拉回旧值。`codemodeOverride: null` 是显式清除，
+ * 与「没提到这个字段」区分开。
+ */
+export function mergePiSessionDefaults(defaults, patch) {
+    if (!patch || typeof patch !== "object" || Array.isArray(patch))
+        return defaults;
+    const touched = patch;
+    if (!Object.keys(touched).length)
+        return defaults;
+    const next = { ...defaults, tools: [...defaults.tools] };
+    if ("resources" in touched)
+        next.resources = patchPiResourceSelection(touched.resources);
+    if ("lockedSkills" in touched)
+        next.lockedSkills = [...(patchPiSessionSettings(defaults, { lockedSkills: touched.lockedSkills }).lockedSkills ?? [])];
+    for (const key of ["codemode", "tools", "globalTools", "goalMode", "localDecision", "autoCompaction", "autoResources"]) {
+        if (!(key in touched))
+            continue;
+        const patched = patchPiSessionSettings(defaults, { [key]: touched[key] });
+        if (key === "tools")
+            next.tools = [...patched.tools];
+        else if (key === "codemode")
+            next.codemode = patched.codemode;
+        else
+            next[key] = patched[key] === true;
+    }
+    if ("codemodeOverride" in touched) {
+        const patched = patchPiSessionSettings(defaults, { codemodeOverride: touched.codemodeOverride });
+        if (patched.codemodeOverride === undefined)
+            delete next.codemodeOverride;
+        else
+            next.codemodeOverride = patched.codemodeOverride;
+    }
+    // 自动选择或锁定需要一个显式的资源边界，否则会退回旧会话的 Pi 自动发现。
+    if ((next.autoResources || next.lockedSkills?.length) && !next.resources)
+        next.resources = { skills: [], mcpServers: [] };
+    return next;
+}
 /** Strict partial updates: an invalid/unknown field never silently enables a capability. */
 export function patchPiSessionSettings(current, raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))

package/dist/pi-tmux-host.d.ts

@@ -21,14 +21,15 @@ interface WorkerState {
 /** New Pi CLI turns use real native TUI tmux panes; existing daemon runs stay with their original owner. */
 export declare class PiTmuxHost implements StructuredExecHost {
     private readonly legacy;
+    private readonly enabled;
     readonly persistent = true;
-    readonly piNativeTui = true;
+    get piNativeTui(): boolean;
     private readonly root;
     private readonly prefix;
     private readonly owners;
     private readonly observed;
     private readonly terminations;
-    constructor(configDir: string, legacy: StructuredExecHost);
+    constructor(configDir: string, legacy: StructuredExecHost, enabled?: boolean);
     private slot;
     private job;
     private tmux;

package/dist/pi-tmux-host.js

@@ -36,6 +36,7 @@ class NativeProcess {
     decoders = { stdout: createUtf8TextDecoder(), stderr: createUtf8TextDecoder() };
     timer = null;
     ended = null;
+    observationFailed = false;
     identities;
     constructor(job, host, after) {
         this.job = job;
@@ -103,16 +104,25 @@ class NativeProcess {
             return;
         try {
             const state = this.host.state(this.job);
-            this.read("stdout", state.status === "exited");
-            this.read("stderr", state.status === "exited");
+            if (!this.observationFailed) {
+                this.read("stdout", state.status === "exited");
+                this.read("stderr", state.status === "exited");
+            }
             if (state.status !== "exited")
                 return;
             this.ended = { exitCode: state.exitCode, signal: state.signal ? signalNumberFromName(state.signal) : null };
         }
         catch (error) {
-            logInfo(`Pi native file observation failed: ${error instanceof Error ? error.message : String(error)}`);
-            this.ended = { exitCode: 1, signal: null, processExited: false };
-            void this.host.kill(this.job).catch(() => { });
+            if (!this.observationFailed) {
+                this.observationFailed = true;
+                logInfo(`Pi native file observation failed: ${error instanceof Error ? error.message : String(error)}`);
+                for (const listener of this.exits)
+                    listener({ exitCode: 1, signal: null, processExited: false });
+                void this.host.kill(this.job).catch(error => logInfo(`Pi native cleanup failed: ${String(error)}`));
+            }
+            // An observation failure ends the response, not ownership of the process.
+            // Keep watching state so actual termination can release deletion barriers.
+            return;
         }
         if (this.timer)
             clearInterval(this.timer);
@@ -124,15 +134,17 @@ class NativeProcess {
 /** New Pi CLI turns use real native TUI tmux panes; existing daemon runs stay with their original owner. */
 export class PiTmuxHost {
     legacy;
+    enabled;
     persistent = true;
-    piNativeTui = true;
+    get piNativeTui() { return this.enabled; }
     root;
     prefix;
     owners = new Map();
     observed = new Map();
     terminations = new Map();
-    constructor(configDir, legacy) {
+    constructor(configDir, legacy, enabled = true) {
         this.legacy = legacy;
+        this.enabled = enabled;
         this.root = path.join(configDir, "pi-native");
         this.prefix = `wand-pi-${createHash("sha256").update(path.resolve(configDir)).digest("hex").slice(0, 6)}-`;
         mkdirSync(this.root, { recursive: true, mode: 0o700 });
@@ -142,8 +154,10 @@ export class PiTmuxHost {
         try {
             return JSON.parse(readFileSync(path.join(this.slot(runId), "current.json"), "utf8"));
         }
-        catch {
-            return null;
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
         }
     }
     async tmux(args) {
@@ -198,9 +212,15 @@ export class PiTmuxHost {
     }
     async spawnStructured(request) {
         if (!request.nativePi) {
+            const previous = this.job(request.runId);
+            if (previous && (!existsSync(previous.ack) || this.state(previous).status !== "exited")) {
+                throw Object.assign(new Error("原 Pi 原生回合尚未释放；未重复发送输入。"), { preflightBlocked: true });
+            }
             this.owners.set(request.runId, "legacy");
             return this.legacy.spawnStructured(request);
         }
+        if (!this.enabled)
+            throw Object.assign(new Error("Pi 原生 tmux 已禁用，未发送输入。"), { preflightBlocked: true });
         if (request.launchSignal?.aborted)
             throw new Error("Pi 原生启动已取消，未发送输入。");
         if (process.platform === "win32")
@@ -329,20 +349,25 @@ export class PiTmuxHost {
         for (const item of readdirSync(this.root, { withFileTypes: true })) {
             if (!item.isDirectory())
                 continue;
-            try {
-                const job = JSON.parse(readFileSync(path.join(this.root, item.name, "current.json"), "utf8"));
-                if (!existsSync(job.ack) || this.state(job).status !== "exited") {
-                    native.push(this.snapshot(job));
-                    this.owners.set(job.runId, "native");
-                }
+            const current = path.join(this.root, item.name, "current.json");
+            if (!existsSync(current))
+                continue;
+            // A published owner with unreadable state is unknown, not an idle host.
+            const job = JSON.parse(readFileSync(current, "utf8"));
+            if (!existsSync(job.ack) || this.state(job).status !== "exited") {
+                native.push(this.snapshot(job));
+                this.owners.set(job.runId, "native");
             }
-            catch { /* An incomplete startup is not a fabricated live execution. */ }
         }
         const legacy = await this.legacy.listRuns();
-        for (const state of legacy)
-            if (!native.some((other) => other.runId === state.runId))
+        for (const state of legacy) {
+            if (native.some(other => other.runId === state.runId && (other.status === "running" || state.status === "running"))) {
+                throw new Error("Pi 执行存在冲突的持久宿主，拒绝继续维护。");
+            }
+            if (!native.some(other => other.runId === state.runId))
                 this.owners.set(state.runId, "legacy");
-        return [...legacy.filter((state) => !native.some((other) => other.runId === state.runId)), ...native];
+        }
+        return [...legacy.filter(state => !native.some(other => other.runId === state.runId)), ...native];
     }
     kill(job) {
         const previous = this.terminations.get(job.incarnationId);
@@ -375,12 +400,24 @@ export class PiTmuxHost {
             this.legacy.forgetRun(runId);
             return;
         }
-        void this.kill(job).catch((error) => {
-            if (this.state(job).status !== "exited")
-                logInfo(`Pi tmux cleanup failed: ${String(error)}`);
-        });
-        writeFileSync(job.ack, "consumed\n", { mode: 0o600 });
-        this.observed.delete(runId);
+        const acknowledge = () => {
+            writeFileSync(job.ack, "consumed\n", { mode: 0o600 });
+            if (this.observed.get(runId)?.incarnationId === job.incarnationId)
+                this.observed.delete(runId);
+        };
+        if (this.state(job).status === "exited") {
+            acknowledge();
+            return;
+        }
+        void this.kill(job).then(async () => {
+            const deadline = Date.now() + 10000;
+            while (this.state(job).status !== "exited") {
+                if (Date.now() >= deadline)
+                    throw new Error("Pi process exit is not yet confirmed");
+                await delay(25);
+            }
+            acknowledge();
+        }).catch((error) => logInfo(`Pi tmux cleanup failed: ${String(error)}`));
     }
     /**
      * 回收 pi-native 下已经没用的执行产物。每次 Pi 原生回合都会在 slot 里