@jetcrab/pi-desk 1.1.8 → 1.1.10-dev

package/src/common/l2_biz/auth/l2-auth-contract.ts

@@ -23,8 +23,21 @@ export const L2AuthSettingsGetResponseSchema = z
   })
   .strict()
 
+export const L2AuthNewPasswordSchema = z
+  .string()
+  .min(12)
+  .max(256)
+  .refine(
+    (password) => password === password.trim() && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(password)
+  )
+  .refine(
+    (password) =>
+      [/[A-Z]/, /[a-z]/, /[0-9]/, /[\p{P}\p{S}]/u].filter((pattern) => pattern.test(password))
+        .length >= 3
+  )
+
 export const L2AuthSettingsReplaceRequestSchema = z.union([
-  L2AuthLoginRequestSchema.extend({ password: z.string().min(8).max(256) }),
+  L2AuthLoginRequestSchema.extend({ password: L2AuthNewPasswordSchema }),
   z.object({ password: z.null() }).strict()
 ])
 export const L2AuthSettingsReplaceResponseSchema = z.object({}).strict()

package/src/common/l2_biz/auth/l2-auth-messages.ts

@@ -9,8 +9,12 @@ export const L2_AUTH_MESSAGES = {
     changePassword: 'Change password',
     setPassword: 'Set a password',
     newPassword: 'New password',
-    passwordHint: 'At least 8 characters',
-    saveEffect: 'Saving requires all devices to sign in again.',
+    passwordHint:
+      '12–256 characters; use at least three of: uppercase letters, lowercase letters, numbers and symbols. No leading/trailing spaces, line breaks or invisible control characters.',
+    generatePassword: 'Generate password',
+    generatePasswordHint: 'Generate a random 16-character password',
+    generatePasswordFailed: 'Unable to generate a password. Please try again.',
+    saveEffect: 'Keep your password safe. Saving requires all devices to sign in again.',
     enable: 'Enable sign-in protection',
     saveAndSignIn: 'Save and sign in again',
     saving: 'Saving…',
@@ -27,7 +31,7 @@ export const L2_AUTH_MESSAGES = {
     recoveryDescription:
       'Delete this file on the device running the service, then refresh the page to restore access.',
     settingsFailed: 'Unable to load or save sign-in protection settings.',
-    settingsInvalid: 'Enter a password of at least 8 characters.',
+    settingsInvalid: 'The password does not meet the requirements shown below the field.',
     configUnavailable:
       'Unable to read sign-in protection settings. Repair the configuration or delete auth.json and set it up again.',
     crossOriginDenied: 'Cross-site changes to sign-in protection are not allowed.',
@@ -36,8 +40,13 @@ export const L2_AUTH_MESSAGES = {
     submitting: 'Signing in…',
     loginFailed: 'Unable to sign in',
     invalidResponse: 'Invalid response from the sign-in service',
-    invalidCredentials: 'Incorrect password',
-    invalidInput: 'Invalid sign-in details',
+    invalidCredentials: 'Sign-in failed. Check your sign-in details and try again.',
+    invalidInput: 'Sign-in failed. Check your sign-in details and try again.',
+    unavailable: 'Sign-in is temporarily unavailable. Please try again later.',
+    tooManyAttempts: 'Too many sign-in attempts. Please try again later.',
+    loginAlertTitle: 'Unusual sign-in activity',
+    loginAlertDescription:
+      'More than 5 consecutive sign-in failures. Check whether these attempts were yours.',
     invalidClient: 'Invalid client identifier'
   },
   'zh-CN': {
@@ -50,8 +59,12 @@ export const L2_AUTH_MESSAGES = {
     changePassword: '修改密码',
     setPassword: '设置密码',
     newPassword: '新密码',
-    passwordHint: '至少 8 个字符',
-    saveEffect: '保存后，所有设备都需要重新登录。',
+    passwordHint:
+      '12–256 个字符，至少包含大写字母、小写字母、数字、符号中的三类；不能有首尾空白、换行或不可见控制字符。',
+    generatePassword: '生成密码',
+    generatePasswordHint: '随机生成 16 位密码',
+    generatePasswordFailed: '生成密码失败，请重试。',
+    saveEffect: '请妥善保存密码。保存后，所有设备都需要重新登录。',
     enable: '启用登录保护',
     saveAndSignIn: '保存并重新登录',
     saving: '正在保存…',
@@ -66,7 +79,7 @@ export const L2_AUTH_MESSAGES = {
     recovery: '忘记密码？',
     recoveryDescription: '在运行服务的设备上删除下面的文件，然后刷新页面，即可恢复访问。',
     settingsFailed: '登录保护设置处理失败。',
-    settingsInvalid: '请填写至少 8 位密码。',
+    settingsInvalid: '密码不符合要求，请按输入框下方的规则调整。',
     configUnavailable: '登录保护配置无法读取，请修复配置或删除 auth.json 后重新设置。',
     crossOriginDenied: '不允许跨站修改登录保护。',
     password: '密码',
@@ -74,8 +87,12 @@ export const L2_AUTH_MESSAGES = {
     submitting: '正在登录',
     loginFailed: '登录失败',
     invalidResponse: '登录服务响应无效',
-    invalidCredentials: '密码不正确',
-    invalidInput: '登录参数无效',
+    invalidCredentials: '登录失败，请检查登录信息后重试。',
+    invalidInput: '登录失败，请检查登录信息后重试。',
+    unavailable: '登录暂不可用，请稍后重试。',
+    tooManyAttempts: '登录尝试过多，请稍后重试。',
+    loginAlertTitle: '登录异常提醒',
+    loginAlertDescription: '登录已连续失败超过 5 次，请确认是否为本人操作。',
     invalidClient: '客户端标识无效'
   }
 } as const

package/src/common/l3_modules/app-runtime/l3-app-runtime-contract.ts

@@ -9,6 +9,7 @@ import {
 import { L4TimestampMsSchema } from '@common/l4_foundation/l4-timestamp-contract'
 
 export const L3AppNotificationIdSchema = z.string().uuid()
+export const L3AppNotificationKeySchema = z.string().trim().min(1).max(256)
 export const L3AppNotificationLevelSchema = z.enum(['info', 'success', 'warning', 'error'])
 export const L3AppNotificationTitleSchema = z.string().trim().min(1).max(120)
 export const L3AppNotificationDescriptionSchema = z.string().trim().max(320).nullable()
@@ -51,7 +52,8 @@ export const L3AppNotificationChangesSchema = z
   .object({
     level: L3AppNotificationLevelSchema.optional(),
     title: L3AppNotificationTitleSchema.optional(),
-    description: L3AppNotificationDescriptionSchema.optional()
+    description: L3AppNotificationDescriptionSchema.optional(),
+    event: L3AppNotificationEventSchema.nullable().optional()
   })
   .strict()
   .refine((changes) => Object.keys(changes).length > 0, {
@@ -173,6 +175,7 @@ export const L3PluginNotificationEventInputSchema = z
 
 export const L3PluginNotificationPublishInputSchema = z
   .object({
+    key: L3AppNotificationKeySchema.optional(),
     level: L3AppNotificationLevelSchema,
     title: L3AppNotificationTitleSchema,
     description: z.string().trim().max(320).optional(),

package/src/common/l3_modules/conversation/l3-conversation-locale-messages.ts

@@ -38,6 +38,8 @@ export const L3_CONVERSATION_LOCALE_MESSAGES = {
     thinkingLoading: 'Loading thoughts…',
     thinkingUnavailable: 'Thoughts unavailable',
     thinkingProcess: 'Reasoning',
+    thinkingTruncated: 'Showing the last {{count}} characters',
+    copyThinking: 'Copy full reasoning',
     streamInterrupted: 'The response stream ended before the model completed its answer.',
     requestTimedOut: 'The model did not complete its response in time.',
     modelFailed: 'The model request failed without a detailed error.',
@@ -183,6 +185,8 @@ export const L3_CONVERSATION_LOCALE_MESSAGES = {
     thinkingLoading: '正在加载思考内容…',
     thinkingUnavailable: '思考内容不可用',
     thinkingProcess: '思考过程',
+    thinkingTruncated: '仅显示最近 {{count}} 个字符',
+    copyThinking: '复制完整思考',
     streamInterrupted: '模型响应流意外中断：连接在回答完成前被关闭。',
     requestTimedOut: '模型请求超时：在限定时间内未收到完整响应。',
     modelFailed: '模型请求失败：服务端未提供具体错误信息。',

package/src/common/l3_modules/project-files/l3-project-files-locale-messages.ts

@@ -13,6 +13,10 @@ export const L3_PROJECT_FILES_LOCALE_MESSAGES = {
     noChangedFiles: 'No changed files',
     noChanges: 'No changes',
     gitBranches: 'Git branches',
+    gitBranchReadOnly: 'Git branch (read-only)',
+    selectPreviewDirectory: 'Switch preview directory',
+    previewDirectories: 'Preview directories',
+    sessionDirectory: 'Original folder',
     unavailable: 'Unavailable',
     projectFiles: '{{name}} project files',
     searchFiles: 'Search filenames',
@@ -107,6 +111,10 @@ export const L3_PROJECT_FILES_LOCALE_MESSAGES = {
     noChangedFiles: '没有变更文件',
     noChanges: '没有变更',
     gitBranches: 'Git 分支',
+    gitBranchReadOnly: 'Git 分支（只读）',
+    selectPreviewDirectory: '切换预览目录',
+    previewDirectories: '预览目录',
+    sessionDirectory: '原目录',
     unavailable: '不可用',
     projectFiles: '{{name}} 项目文件',
     searchFiles: '搜索文件名',

package/src/common/l4_foundation/file/l4-project-preview-contract.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod'
+
+export const L4_PROJECT_PREVIEW_PLUGIN_KEY = 'project-preview'
+export const L4_PROJECT_PREVIEW_MAX_DIRECTORIES = 32
+
+export const L4ProjectPreviewStateSchema = z
+  .object({
+    directories: z.array(z.string().min(1).max(4096)).max(L4_PROJECT_PREVIEW_MAX_DIRECTORIES),
+    defaultDirectory: z.string().min(1).max(4096).nullable()
+  })
+  .strict()
+
+export type L4ProjectPreviewState = z.infer<typeof L4ProjectPreviewStateSchema>
+
+export function readL4ProjectPreviewState(value: unknown): L4ProjectPreviewState {
+  const result = L4ProjectPreviewStateSchema.safeParse(value)
+  return result.success ? result.data : { directories: [], defaultDirectory: null }
+}
+
+export function projectPreviewDirectoryKey(directory: string): string {
+  const normalized = directory.replaceAll('\\', '/').replace(/\/+$/, '') || '/'
+  return /^[a-z]:/i.test(normalized) || normalized.startsWith('//')
+    ? normalized.toLowerCase()
+    : normalized
+}

package/src/server/l1_entry/api/l1-auth-login-route.ts

@@ -5,7 +5,7 @@ import {
   L2AuthLoginResponseSchema
 } from '@common/l2_biz/auth/l2-auth-contract'
 import { authenticateL2WebLogin } from '@server/l2_biz/auth/l2-auth'
-import { L4AuthConfigError } from '@server/l4_foundation/auth/l4-auth-config'
+import { L4AuthBusyError, L4AuthConfigError } from '@server/l4_foundation/auth/l4-auth-config'
 import {
   createL4WebAuthCookieHeader,
   shouldUseL4SecureWebCookie
@@ -25,18 +25,24 @@ export async function POST(request: Request): Promise<Response> {
   try {
     payload = await request.json()
   } catch {
-    return createL4ApiErrorResponse(400, '请求 JSON 格式无效', { key: 'auth:invalidInput' })
+    return createL4ApiErrorResponse(400, '登录失败，请检查登录信息后重试。', {
+      key: 'auth:invalidInput'
+    })
   }
 
   const input = L2AuthLoginRequestSchema.safeParse(payload)
   if (!input.success)
-    return createL4ApiErrorResponse(400, '登录参数无效', { key: 'auth:invalidInput' })
+    return createL4ApiErrorResponse(400, '登录失败，请检查登录信息后重试。', {
+      key: 'auth:invalidInput'
+    })
 
   try {
     const result = await authenticateL2WebLogin(input.data)
     if (!result) {
       console.warn('[Pi Desk][AuthLoginApi] 登录凭据无效', { clientId })
-      return createL4ApiErrorResponse(401, '密码不正确', { key: 'auth:invalidCredentials' })
+      return createL4ApiErrorResponse(401, '登录失败，请检查登录信息后重试。', {
+        key: 'auth:invalidCredentials'
+      })
     }
 
     const response = createL4ApiSuccessResponse(L2AuthLoginResponseSchema.parse({}))
@@ -53,13 +59,21 @@ export async function POST(request: Request): Promise<Response> {
     console.info('[Pi Desk][AuthLoginApi] 登录成功', { clientId })
     return response
   } catch (error) {
+    if (error instanceof L4AuthBusyError) {
+      const response = createL4ApiErrorResponse(429, error.message, { key: 'auth:tooManyAttempts' })
+      response.headers.set('Retry-After', '1')
+      response.headers.set('Cache-Control', 'no-store')
+      return response
+    }
     console.error('[Pi Desk][AuthLoginApi] 登录处理失败', {
       clientId,
       errorName: error instanceof Error ? error.name : 'UnknownError'
     })
     if (error instanceof L4AuthConfigError) {
-      return createL4ApiErrorResponse(503, error.message, { key: 'auth:configUnavailable' })
+      return createL4ApiErrorResponse(503, '登录暂不可用，请稍后重试。', {
+        key: 'auth:unavailable'
+      })
     }
-    return createL4ApiErrorResponse(500, '登录失败，请稍后重试', { key: 'auth:loginFailed' })
+    return createL4ApiErrorResponse(500, '登录暂不可用，请稍后重试。', { key: 'auth:unavailable' })
   }
 }

package/src/server/l1_entry/api/l1-auth-settings-routes.ts

@@ -65,7 +65,7 @@ async function handle(request: Request, action: 'get' | 'replace'): Promise<Resp
 
     const input = L2AuthSettingsReplaceRequestSchema.safeParse(payload)
     if (!input.success) {
-      return createL4ApiErrorResponse(400, '请填写至少 8 位密码', {
+      return createL4ApiErrorResponse(400, '密码不符合要求，请按输入框下方的规则调整。', {
         key: 'auth:settingsInvalid'
       })
     }

package/src/server/l1_entry/api/l1-project-route.ts

@@ -35,17 +35,26 @@ export function createL1ProjectRoute<I extends contracts.L3ProjectReadContext, O
         key: 'errors:projectCwdAbsolute'
       })
     try {
+      let isCurrent: (() => boolean) | undefined
       if (input.workId) {
-        const session = await getL2WorkSessionManage().getWorkSession(input.workId)
+        const manage = getL2WorkSessionManage()
+        const session = await manage.getWorkSession(input.workId)
         if (!session)
           return createL4ApiErrorResponse(404, '工作会话不存在', { key: 'errors:sessionMissing' })
-        if (session.cwd !== input.cwd)
-          return createL4ApiErrorResponse(409, '工作会话项目已变化', {
+        const context = manage.getProjectPreviewContext(session, input.cwd)
+        if (!context)
+          return createL4ApiErrorResponse(409, '工作会话项目已变化或预览目录未登记', {
             key: 'errors:projectChanged'
           })
-        input.cwd = session.cwd
+        input.cwd = context.cwd
+        isCurrent = context.isCurrent
       }
-      return createL4ApiSuccessResponse(contract.response.parse(await execute(input)))
+      const result = await execute(input)
+      if (isCurrent && !isCurrent())
+        return createL4ApiErrorResponse(409, '工作会话项目已变化', {
+          key: 'errors:projectChanged'
+        })
+      return createL4ApiSuccessResponse(contract.response.parse(result))
     } catch (error) {
       console.warn('[Pi Desk][Project] 项目请求失败', {
         path: contract.path,

package/src/server/l1_entry/node/l1-server.ts

@@ -113,12 +113,8 @@ function allowHttpRequest(
   try {
     authenticated = authRuntime?.isAuthenticated(request.headers.cookie) ?? false
   } catch {
-    endHttpAuthError(
-      response,
-      503,
-      '登录保护配置无法读取，请修复配置或删除 auth.json 后重新设置',
-      'auth:configUnavailable'
-    )
+    console.error('[Pi Desk][NodeServer] 登录保护配置读取失败')
+    endHttpAuthError(response, 503, '登录暂不可用，请稍后重试。', 'auth:unavailable')
     return false
   }
   if (pathname === LOGIN_PAGE_PATH) {
@@ -399,7 +395,8 @@ async function startServer(): Promise<void> {
     try {
       authenticated = authRuntime.isAuthenticated(request.headers.cookie)
     } catch {
-      rejectUpgrade(socket, 503, '登录保护配置无法读取')
+      console.error('[Pi Desk][NodeServer] 握手认证配置读取失败')
+      rejectUpgrade(socket, 503, '登录暂不可用，请稍后重试。')
       return
     }
     if (!authenticated) {

package/src/server/l2_biz/app-runtime/l2-app-runtime.ts

@@ -28,7 +28,12 @@ export { L3AppRuntimeTargetNotFoundError as L2AppRuntimeTargetNotFoundError }
 export type L2AppRuntime = L3AppRuntime
 
 export interface L2AppNotificationPublisher {
-  publish(input: { level: L3AppNotificationLevel; title: string; description?: string }): string
+  publish(input: {
+    key?: string
+    level: L3AppNotificationLevel
+    title: string
+    description?: string
+  }): string
   update(notificationId: string, changes: L3AppNotificationChanges): void
   delete(notificationId: string): void
   dispose(): void

package/src/server/l2_biz/auth/l2-auth.ts

@@ -19,12 +19,56 @@ import {
   type L4AuthCredentials
 } from '@server/l4_foundation/auth/l4-auth-config'
 import { appendL4LoginRecord } from '@server/l4_foundation/auth/l4-login-record-store'
+import {
+  getL3AppNotificationRuntime,
+  type L3AppNotificationPublisher,
+  type L3AppNotificationRuntime
+} from '@server/l3_modules/app-runtime/l3-app-notification-runtime'
+import { getL4HostSettingsStore } from '@server/l4_foundation/l4-host-settings-store'
+import { L2_AUTH_MESSAGES } from '@common/l2_biz/auth/l2-auth-messages'
 
 export const L2_WEB_SESSION_COOKIE_NAME = 'pi-desk-session'
 const WEB_SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30
 
+function recordLoginResult(success: boolean): void {
+  const runtime = getL3AppNotificationRuntime()
+  const loginAttempts = (globalThis.__piDeskLoginAttempts ??= new WeakMap())
+  let attempts = loginAttempts.get(runtime)
+  if (!attempts) {
+    attempts = { failures: 0, publisher: runtime.createPublisher() }
+    loginAttempts.set(runtime, attempts)
+  }
+  if (success) {
+    attempts.failures = 0
+    return
+  }
+  attempts.failures += 1
+  if (attempts.failures <= 5) return
+  if (attempts.failures === 6) {
+    console.warn('[Pi Desk][Auth] 连续登录失败超过阈值，发布登录异常提醒')
+  }
+  try {
+    const locale = getL4HostSettingsStore().getSnapshot().region.locale
+    const messages = L2_AUTH_MESSAGES[locale]
+    attempts.publisher.publish({
+      key: 'auth:login-failures',
+      level: 'warning',
+      title: messages.loginAlertTitle,
+      description: messages.loginAlertDescription
+    })
+  } catch (error) {
+    console.error('[Pi Desk][Auth] 登录异常提醒发布失败', {
+      errorName: error instanceof Error ? error.name : 'UnknownError'
+    })
+  }
+}
+
 declare global {
   var __piDeskAuthMutation: Promise<void> | undefined
+  // 跨 HTTP 路由共享，计数和发布者跟随通知 Runtime 释放，不保存失败请求内容。
+  var __piDeskLoginAttempts:
+    | WeakMap<L3AppNotificationRuntime, { failures: number; publisher: L3AppNotificationPublisher }>
+    | undefined
 }
 
 export interface L2WebAuthLoginResult {
@@ -58,15 +102,20 @@ export async function authenticateL2WebLogin(
 ): Promise<L2WebAuthLoginResult | null> {
   const credentials = readL4AuthCredentials()
   if (!credentials) {
+    recordLoginResult(true)
     return { cookieName: L2_WEB_SESSION_COOKIE_NAME, token: '', maxAgeSeconds: 0 }
   }
   const passwordMatches = await verifyL4AuthPassword(input.password, credentials.passwordHash)
-  if (!passwordMatches) return null
-  // scrypt 计算期间凭据可能已被修改或删除，不为旧配置签发会话。
+  // scrypt 计算期间凭据可能已被修改或删除，不为旧配置签发会话或累计失败次数。
   if (readL4AuthCredentials()?.sessionSecret !== credentials.sessionSecret) return null
+  if (!passwordMatches) {
+    recordLoginResult(false)
+    return null
+  }
 
   const loggedInAt = Date.now()
   appendL4LoginRecord({ loggedInAt })
+  recordLoginResult(true)
   return {
     cookieName: L2_WEB_SESSION_COOKIE_NAME,
     token: createL4WebAuthSessionToken(
@@ -101,6 +150,7 @@ export function replaceL2AuthSettings(
       throw new L2AuthRequiredError()
     }
     writeL4AuthConfig(config)
+    recordLoginResult(true)
     console.info('[Pi Desk][Auth] 登录保护已更新', { enabled: config !== null })
   })
   globalThis.__piDeskAuthMutation = operation.catch(() => undefined)

package/src/server/l2_biz/work-session/l2-work-session-chat-runtime.ts

@@ -1,5 +1,11 @@
 import 'server-only'
 
+import { resolve } from 'node:path'
+import {
+  L4_PROJECT_PREVIEW_PLUGIN_KEY,
+  projectPreviewDirectoryKey,
+  readL4ProjectPreviewState
+} from '@common/l4_foundation/file/l4-project-preview-contract'
 import {
   L2ChatModelContextGetRequestSchema,
   L2ChatModelContextGetResponseSchema,
@@ -274,6 +280,28 @@ export class L2WorkSessionChatRuntime {
     return record !== undefined && this.matches(record.source, source)
   }
 
+  getProjectPreviewContext(
+    workSession: WorkSession,
+    directory: string
+  ): { cwd: string; isCurrent: () => boolean } | null {
+    const record = this.recordsByWorkId.get(workSession.workId)
+    if (!record || record.workSession !== workSession) return null
+    const key = projectPreviewDirectoryKey(resolve(directory))
+    const originalCwd = key === projectPreviewDirectoryKey(resolve(workSession.cwd))
+    const registeredDirectory = (): string | undefined =>
+      readL4ProjectPreviewState(
+        record.state.runtime.plugins[L4_PROJECT_PREVIEW_PLUGIN_KEY]
+      ).directories.find((item) => projectPreviewDirectoryKey(item) === key)
+    const cwd = originalCwd ? workSession.cwd : registeredDirectory()
+    if (!cwd) return null
+    const isCurrent = (): boolean =>
+      this.recordsByWorkId.get(workSession.workId) === record &&
+      record.acceptingCommands &&
+      this.matches(record.source, this.sourceFor(workSession)) &&
+      (originalCwd || registeredDirectory() !== undefined)
+    return isCurrent() ? { cwd, isCurrent } : null
+  }
+
   refreshPluginMessages(): void {
     for (const record of this.recordsByWorkId.values()) {
       if (record.state.runtime.presentationMode === 'basic') continue

package/src/server/l2_biz/work-session/l2-work-session-manage.ts

@@ -477,6 +477,14 @@ export class WorkSessionManage {
     })
   }
 
+  getProjectPreviewContext(
+    workSession: WorkSession,
+    directory: string
+  ): { cwd: string; isCurrent: () => boolean } | null {
+    if (this.workSessionsById.get(workSession.workId) !== workSession) return null
+    return this.chat.getProjectPreviewContext(workSession, directory)
+  }
+
   async replaceProjectGitBranch(
     inputValue: L2WorkSessionGitBranchReplaceRequest
   ): Promise<L2WorkSessionGitBranchOperationResponse> {

package/src/server/l3_modules/app-runtime/l3-app-notification-runtime.ts

@@ -1,8 +1,10 @@
 import 'server-only'
 
 import { randomUUID } from 'node:crypto'
+import { isDeepStrictEqual } from 'node:util'
 import {
   L3AppNotificationChangesSchema,
+  L3AppNotificationKeySchema,
   L3AppNotificationSchema,
   L3PluginNotificationChangesSchema,
   L3PluginNotificationPublishInputSchema,
@@ -21,6 +23,7 @@ const L3_PLUGIN_NOTIFICATION_EVENT_MAX_JSON_BYTES = 64 * 1024
 type L3AppNotificationOwner = string | object
 
 export interface L3AppNotificationPublishInput {
+  key?: string
   level: L3AppNotificationLevel
   title: string
   description?: string
@@ -49,7 +52,10 @@ export class L3AppNotificationOwnerError extends Error {
 }
 
 export class L3AppNotificationRuntime {
-  private readonly ownersByNotificationId = new Map<string, L3AppNotificationOwner>()
+  private readonly ownersByNotificationId = new Map<
+    string,
+    { owner: L3AppNotificationOwner; key: string | undefined }
+  >()
   private readonly unsubscribe: () => void
   private disposed = false
 
@@ -100,6 +106,7 @@ export class L3AppNotificationRuntime {
     const pluginName = L3PluginNameSchema.parse(pluginNameInput)
     const normalized = L3PluginNotificationPublishInputSchema.parse(input)
     return this.publish(pluginName, {
+      key: normalized.key,
       level: normalized.level,
       title: normalized.title,
       ...(normalized.description === undefined ? {} : { description: normalized.description }),
@@ -154,7 +161,42 @@ export class L3AppNotificationRuntime {
       throw new Error('Plugin notification event data exceeds 64KB')
     }
 
+    const key = L3AppNotificationKeySchema.optional().parse(input.key)
     const current = this.runtime.readSnapshot().notifications
+    const existing =
+      key === undefined
+        ? undefined
+        : current.find((notification) => {
+            const registration = this.ownersByNotificationId.get(notification.notificationId)
+            return registration?.owner === owner && registration.key === key
+          })
+    const notification = L3AppNotificationSchema.parse({
+      notificationId: existing?.notificationId ?? randomUUID(),
+      level: input.level,
+      title: input.title,
+      description: input.description ?? null,
+      createdAt: existing?.createdAt ?? Date.now(),
+      event: input.event ?? null
+    })
+
+    if (existing) {
+      const changes = {
+        level: notification.level,
+        title: notification.title,
+        description: notification.description,
+        event: notification.event
+      }
+      if (
+        existing.level !== changes.level ||
+        existing.title !== changes.title ||
+        existing.description !== changes.description ||
+        !isDeepStrictEqual(existing.event, changes.event)
+      ) {
+        this.update(owner, existing.notificationId, changes)
+      }
+      return existing.notificationId
+    }
+
     const oldest = current.length >= L3_APP_NOTIFICATION_MAX_ITEMS ? current[0] : undefined
     if (oldest) {
       this.runtime.applyInternal({
@@ -163,15 +205,7 @@ export class L3AppNotificationRuntime {
       })
     }
 
-    const notification = L3AppNotificationSchema.parse({
-      notificationId: randomUUID(),
-      level: input.level,
-      title: input.title,
-      description: input.description ?? null,
-      createdAt: Date.now(),
-      event: input.event ?? null
-    })
-    this.ownersByNotificationId.set(notification.notificationId, owner)
+    this.ownersByNotificationId.set(notification.notificationId, { owner, key })
     try {
       this.runtime.applyInternal({
         key: 'notifications',
@@ -215,7 +249,7 @@ export class L3AppNotificationRuntime {
       this.runtime.readSnapshot().notifications.map((notification) => notification.notificationId)
     )
     const notificationIds = [...this.ownersByNotificationId.entries()]
-      .filter(([, currentOwner]) => currentOwner === owner)
+      .filter(([, registration]) => registration.owner === owner)
       .map(([notificationId]) => notificationId)
     for (const notificationId of notificationIds) {
       if (!activeIds.has(notificationId)) {
@@ -230,9 +264,9 @@ export class L3AppNotificationRuntime {
   }
 
   private assertOwner(owner: L3AppNotificationOwner, notificationId: string): void {
-    const currentOwner = this.ownersByNotificationId.get(notificationId)
-    if (!currentOwner) throw new L3AppNotificationNotFoundError(notificationId)
-    if (currentOwner !== owner) throw new L3AppNotificationOwnerError(notificationId)
+    const registration = this.ownersByNotificationId.get(notificationId)
+    if (!registration) throw new L3AppNotificationNotFoundError(notificationId)
+    if (registration.owner !== owner) throw new L3AppNotificationOwnerError(notificationId)
   }
 
   private ensureActive(): void {

package/src/server/l4_foundation/auth/l4-auth-config.ts

@@ -19,6 +19,15 @@ const ReadAuthConfigSchema = AuthConfigSchema.extend({
 
 type AuthConfig = z.infer<typeof AuthConfigSchema>
 
+let activePasswordVerifications = 0
+
+export class L4AuthBusyError extends Error {
+  constructor() {
+    super('登录尝试过多，请稍后重试。')
+    this.name = 'L4AuthBusyError'
+  }
+}
+
 export interface L4AuthCredentials extends AuthConfig {
   sessionSecret: string
 }
@@ -97,9 +106,16 @@ export async function verifyL4AuthPassword(
   password: string,
   passwordHash: string
 ): Promise<boolean> {
-  const [, salt, expected] = passwordHash.split(':')
-  const actual = await derivePassword(password, salt)
-  return timingSafeEqual(actual, Buffer.from(expected, 'hex'))
+  if (activePasswordVerifications >= 2) throw new L4AuthBusyError()
+  activePasswordVerifications += 1
+  try {
+    const [, salt, expected] = passwordHash.split(':')
+    const actual = await derivePassword(password, salt)
+    return timingSafeEqual(actual, Buffer.from(expected, 'hex'))
+  } finally {
+    // 计算完成才释放，不随 HTTP 连接提前关闭而释放。
+    activePasswordVerifications -= 1
+  }
 }
 
 export function writeL4AuthConfig(config: AuthConfig | null): void {

package/src/server/l4_foundation/pi/l4-pi-chat-worker.ts

@@ -444,7 +444,8 @@ export class L4PiChatWorker {
           console.warn('[Pi Desk][PiChatWorker] 已忽略非法插件运行态更新', {
             sessionId: this.sessionManager.getSessionId(),
             cwd: this.cwd,
-            errorName: cause instanceof Error ? cause.name : 'UnknownError'
+            errorName: cause instanceof Error ? cause.name : 'UnknownError',
+            message: cause instanceof Error ? cause.message : String(cause)
           })
         }
       }