@qt4798/pi-web 0.9.17-beta.2 → 0.9.17-beta.3

package/.next/trace-build

@@ -1 +1 @@
-[{"name":"run-webpack","duration":34859916,"timestamp":360383651829,"id":14,"parentId":1,"tags":{},"startTime":1786034404554,"traceId":"99e44986e4051211"},{"name":"run-typescript","duration":5475260,"timestamp":360418513086,"id":1004,"parentId":1,"tags":{},"startTime":1786034439416,"traceId":"99e44986e4051211"},{"name":"static-check","duration":1109111,"timestamp":360424000225,"id":1007,"parentId":1,"tags":{},"startTime":1786034444903,"traceId":"99e44986e4051211"},{"name":"static-generation","duration":1615248,"timestamp":360425415761,"id":1155,"parentId":1,"tags":{},"startTime":1786034446318,"traceId":"99e44986e4051211"},{"name":"collect-build-traces","duration":14322945,"timestamp":360425110965,"id":1152,"parentId":1,"tags":{},"startTime":1786034446014,"traceId":"99e44986e4051211"},{"name":"telemetry-flush","duration":12,"timestamp":360439439908,"id":1164,"parentId":1,"tags":{},"startTime":1786034460342,"traceId":"99e44986e4051211"},{"name":"next-build","duration":55903327,"timestamp":360383536596,"id":1,"tags":{"buildMode":"default","version":"16.2.12","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1786034404439,"traceId":"99e44986e4051211"}]
+[{"name":"run-webpack","duration":89174945,"timestamp":400130066892,"id":14,"parentId":1,"tags":{},"startTime":1786074151025,"traceId":"93144e710d7dc818"},{"name":"run-typescript","duration":16338980,"timestamp":400219244807,"id":926,"parentId":1,"tags":{},"startTime":1786074240205,"traceId":"93144e710d7dc818"},{"name":"static-check","duration":4724559,"timestamp":400235612204,"id":929,"parentId":1,"tags":{},"startTime":1786074256572,"traceId":"93144e710d7dc818"},{"name":"static-generation","duration":4626174,"timestamp":400241391475,"id":1077,"parentId":1,"tags":{},"startTime":1786074262352,"traceId":"93144e710d7dc818"},{"name":"collect-build-traces","duration":36861527,"timestamp":400240343225,"id":1074,"parentId":1,"tags":{},"startTime":1786074261303,"traceId":"93144e710d7dc818"},{"name":"telemetry-flush","duration":36,"timestamp":400277216062,"id":1086,"parentId":1,"tags":{},"startTime":1786074298177,"traceId":"93144e710d7dc818"},{"name":"next-build","duration":147687381,"timestamp":400129528723,"id":1,"tags":{"buildMode":"default","version":"16.2.12","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1786074150487,"traceId":"93144e710d7dc818"}]

package/README.en.md

@@ -65,7 +65,18 @@ The board's own **Task settings** button configures per-project execution (separ
 - The engine is a single server process (exclusive lock); interrupted tasks are recovered on restart (marked failed/interrupted, retryable).
 - Beta: desktop only; the mobile UI does not show the board.
 
-## Latest changes (2026-08-06 · v0.9.17-beta.2)
+## Latest changes (2026-08-07 · v0.9.17-beta.3)
+
+- **Zero install-time warnings**: provider icons are now inlined components, so `@lobehub/icons` is gone and npm no longer auto-installs the `@lobehub/ui` / `antd` / `@emoji-mart/react` chain — no more `ERESOLVE overriding peer dependency` and `deprecated intersection-observer` warnings during install (see "npm 11 install notes").
+- **undici fix now runs at runtime**: the `postinstall` hook is gone; `pi-web` applies the undici CVE fix at startup and `dev`/`start` scripts apply it before launching, so installing no longer requires approving install scripts.
+- **Title generation no longer times out (524)**: generating a title while the session is still running waits at most 10s for idle then snapshots the current conversation; the model call timeout is tightened to 80s, keeping the total comfortably under the Cloudflare 100s gateway timeout.
+- **Default mode is now Normal**: new chats default to Normal task mode instead of inheriting Plan.
+- **Task board toggle takes effect immediately**: turning the task board on/off in Settings > Features syncs the toolbar entry and board view without a page refresh.
+- **settings.json concurrency protection**: the modes, features, and title-model modules now share one file lock (proper-lockfile + atomic writes), so concurrent saves can no longer overwrite each other and drop config.
+- **Default mode settings UI**: Settings > Features can now set the default task mode (Normal / Plan / Goal), token profile (Lite / Balanced / Delivery, default Balanced) and tool approval (Ask / Auto / Yolo); already-open chats apply the changes immediately and new chats inherit them.
+- **SPA navigation robustness**: switching projects via the address bar (`?session=` ↔ `?cwd=`) is honored without a full reload; a brand-new project folder with no sessions yet stays in the project list; created sessions appear in the sidebar promptly.
+
+## Previous changes (2026-08-06 · v0.9.17-beta.2)
 
 - **Chat mode system** (ported from Reasonix): the composer toolbar gains three mode controls — task mode (Normal / Plan / Goal), token profile (Lite / Balanced / Delivery) and tool approval (Ask / Auto / Yolo). Plan mode produces a read-only plan then shows a confirm card (Execute / Suggest / Exit); Goal mode auto-continues with a turn budget and stall detection; Lite narrows the toolset to save tokens; Delivery injects a verify-first instruction.
 - **Tool-call approval (real interception)**: in Ask mode, write-class tool calls are suspended before execution and a shelf card appears above the composer — allow, deny, or deny with a reason; parallel batches resolve one by one; 120s timeout auto-denies. Rules (deny > ask > allow) support `ToolName` / `ToolName(glob)` / `Bash(command:*)` and persist to `~/.pi/agent/settings.json`.
@@ -100,6 +111,31 @@ The board's own **Task settings** button configures per-project execution (separ
 - The mobile composer is now 52px high. It keeps a 16px input font to prevent iOS Safari zoom, while tighter line height and letter spacing make the text read smaller.
 - Production serving no longer relies on Turbopack development chunks, and quoteable Markdown table rows render with valid table DOM.
 
+## npm 11 install notes
+
+Since **v0.9.17-beta.3** the `ERESOLVE overriding peer dependency` and `deprecated intersection-observer` warnings are gone: provider icons are inlined (no more `@lobehub/icons`, so npm no longer auto-installs the `@lobehub/ui` / `antd` / `@emoji-mart/react` chain). Two **informational** warnings may remain — both harmless:
+
+- `deprecated node-domexception`: pulled in transitively by `@google/genai` → `google-auth-library` → `fetch-blob`. It is a polyfill for older Node versions; Node ≥ 18 ships `DOMException` natively, so it is unused at runtime. It cannot be removed from the package side until the upstream fix lands.
+
+- `allow-scripts`: npm ≥ 11.16's install-script approval notice (`@google/genai` / `protobufjs` / `sharp` etc. transitive lifecycle scripts). Current versions only warn (scripts still run); future versions may block by default. To clear the notice in your project:
+
+  ```bash
+  npm approve-scripts --allow-scripts-pending   # view pending list first
+  npm approve-scripts @google/genai protobufjs sharp   # approve and write to your package.json
+  ```
+
+  Or declare in your project `package.json`:
+
+  ```json
+  "allowScripts": {
+    "@google/genai@1.52.0": true,
+    "protobufjs@7.6.5": true,
+    "sharp@0.34.5": true
+  }
+  ```
+
+  Note this field matches `package@exact-version`; update it after version bumps.
+
 ## Requirements
 
 - Node.js **22.19.0 or newer**

package/README.md

@@ -87,7 +87,18 @@
 - 引擎由服务器进程持有（单实例锁），重启后自动恢复中断的任务（标记为失败/中断，可重试）。
 - Beta 阶段：仅在桌面端显示入口；移动端不可用。
 
-## 最新更新（2026-08-06 · v0.9.17-beta.2）
+## 最新更新（2026-08-07 · v0.9.17-beta.3）
+
+- **生成标题不再超时（524）**：会话运行中点「生成标题」最多等待空闲 10 秒后直接用当前对话快照生成，模型调用超时收紧到 80 秒，总时长稳在 Cloudflare 100 秒网关超时内。
+- **默认任务模式改为常规**：新对话默认不再继承「计划」。
+- **任务看板开关实时生效**：设置-功能里关闭/打开任务看板立即同步顶部入口与看板视图，无需刷新页面。
+- **settings.json 并发写保护**：模式、功能开关、标题模型共用同一文件锁（proper-lockfile + 原子写），并发保存不再互相覆盖丢配置。
+- **设置-功能页新增模式默认项**：可配置默认任务模式（常规 / 计划 / 目标）、默认运行档位（轻量 / 均衡 / 交付，默认均衡）、默认工具权限（批准 / 自动 / Yolo），已打开的对话立即生效、新对话自动继承。
+- **SPA 导航修复**：地址栏 `?session=` ↔ `?cwd=` 切换项目无需整页刷新；全新项目（尚无会话）仍保留在项目列表；新会话创建后立即出现在侧栏。
+- **安装提示清零**：供应商图标改为内置组件，移除 `@lobehub/icons` 依赖，不再被 npm 自动安装 `@lobehub/ui` / `antd` / `@emoji-mart/react` 整条链——安装时不再出现 `ERESOLVE overriding peer dependency` 与 `deprecated intersection-observer` 警告（详情见「安装提示（npm 11）」）。
+- **undici 修复改为运行时执行**：移除 `postinstall` 钩子，`pi-web` 启动与 dev/start 脚本执行前自动应用 undici CVE 修复，安装不再要求审批安装脚本。
+
+## 历史更新（2026-08-06 · v0.9.17-beta.2）
 
 - **对话框模式系统**（移植自 Reasonix）：输入框工具栏新增三组模式控件——任务模式（常规 / 计划 / 目标）、运行档位（轻量 / 均衡 / 交付）、工具权限（批准 / 自动 / Yolo）。计划模式只读产出计划后弹出确认卡（开始执行 / 提出建议 / 退出）；目标模式输入目标后自动持续推进，带轮次预算与无进展检测；轻量档位收窄工具集省 token，交付档位强制验收指令。
 - **工具调用审批（真拦截）**：权限为「批准」时，agent 的写类工具调用在真正执行前挂起，输入框上方弹出审批卡，可允许 / 拒绝 / 附理由拒绝；规则（deny > ask > allow）支持 `ToolName` / `ToolName(glob)` / `Bash(command:*)`，持久化到 settings.json。
@@ -138,15 +149,28 @@
 
 ## 安装提示（npm 11）
 
-使用 npm ≥ 11 安装本包时可能出现两类提示，均为**提示性警告，不影响安装与运行**：
+自 **v0.9.17-beta.3 起**，`ERESOLVE overriding peer dependency` 与 `deprecated intersection-observer` 两类提示已消除：供应商图标改为内置（不再依赖 `@lobehub/icons`，从而不再被 npm 自动安装 `@lobehub/ui` / `antd` / `@emoji-mart/react` 整条链）。新装本包时仅剩以下两类**提示性警告，均不影响安装与运行**：
+
+- `deprecated node-domexception`：来自 `@google/genai` → `google-auth-library` 的传递依赖 `fetch-blob`。它只是旧版 Node 的 polyfill，Node ≥ 18 原生自带 `DOMException`，运行时完全用不到。上游未修复前无法从包侧移除。
+
+- `allow-scripts`：npm ≥ 11.16 新增的安装脚本审批提示（`@google/genai` / `protobufjs` / `sharp` 等传递依赖的 preinstall/postinstall/install 脚本）。当前版本**只提示、不拦截**（脚本照常执行），未来版本可能改为默认拦截。想消除提示可在你的项目执行：
+
+  ```bash
+  npm approve-scripts --allow-scripts-pending   # 先查看待审批清单
+  npm approve-scripts @google/genai protobufjs sharp   # 逐个批准并写入你的 package.json
+  ```
 
-- `ERESOLVE overriding peer dependency`：上游 `@lobehub/ui` 依赖的 `@emoji-mart/react@1.1.1` 的 peer 声明仅到 React 18，而本包使用 React 19。npm 会自动 override 并继续安装（实际兼容）。如需彻底消除，可在你的项目 `package.json` 添加：
+  或在项目 `package.json` 声明：
 
   ```json
-  "overrides": { "@emoji-mart/react": { "react": "$react" } }
+  "allowScripts": {
+    "@google/genai@1.52.0": true,
+    "protobufjs@7.6.5": true,
+    "sharp@0.34.5": true
+  }
   ```
 
-- `allow-scripts`：npm 11 新增的安装脚本审批提示（sharp / protobufjs / @google/genai 等）。本项目已在包内声明 `allowScripts`，若你的 npm 仍提示，可执行 `npm approve-scripts --all` 审批，或在安装命令加 `--allow-scripts=sharp,protobufjs,@google/genai`。
+  注意该字段按 `包名@精确版本` 匹配，版本升级后需同步更新。
 
 ## 历史更新（2026-08-03）
 

package/bin/fix-pi-agent-undici.js

@@ -9,54 +9,69 @@
 // Note: npm audit will still report undici CVEs because the lockfile
 // references the old version. This is a cosmetic false positive — the
 // code loaded at runtime is undici@^8.10.0.
+//
+// The fix used to run as a `postinstall` hook. It now runs lazily at
+// `pi-web` startup (bin/pi-web.js) and before the repo's dev/start scripts.
+// Moving it out of postinstall keeps `npm install` output quiet under
+// npm >= 11.16's allow-scripts policy and guarantees the fix applies even on
+// installs where lifecycle scripts are blocked or skipped.
 
 const fs = require("fs");
 const path = require("path");
 
-const root = path.join(__dirname, "..");
-const agentDir = path.join(
-  root,
-  "node_modules",
-  "@earendil-works",
-  "pi-coding-agent",
-);
-const shrinkwrap = path.join(agentDir, "npm-shrinkwrap.json");
-const nestedUndici = path.join(agentDir, "node_modules", "undici");
-const topUndici = path.join(root, "node_modules", "undici");
-
-// 1. Remove shrinkwrap
-if (fs.existsSync(shrinkwrap)) {
-  console.log("[pi-web] Removing pi-coding-agent shrinkwrap…");
-  fs.rmSync(shrinkwrap);
-}
+function applyUndiciFix(rootDir = path.join(__dirname, "..")) {
+  const agentDir = path.join(
+    rootDir,
+    "node_modules",
+    "@earendil-works",
+    "pi-coding-agent",
+  );
+  if (!fs.existsSync(agentDir)) return; // not installed here — nothing to fix
+
+  const shrinkwrap = path.join(agentDir, "npm-shrinkwrap.json");
+  const nestedUndici = path.join(agentDir, "node_modules", "undici");
+  const topUndici = path.join(rootDir, "node_modules", "undici");
+
+  // 1. Remove shrinkwrap
+  if (fs.existsSync(shrinkwrap)) {
+    console.log("[pi-web] Removing pi-coding-agent shrinkwrap…");
+    fs.rmSync(shrinkwrap);
+  }
 
-// 2. Replace nested undici@8.5.0 with symlink to top-level undici@^8.10.0
-if (
-  fs.existsSync(topUndici) &&
-  fs.existsSync(nestedUndici) &&
-  // Only replace if it's a real directory, not already a symlink
-  fs.lstatSync(nestedUndici).isDirectory() &&
-  !fs.lstatSync(nestedUndici).isSymbolicLink()
-) {
-  try {
-    const nestedVersion = require(path.join(nestedUndici, "package.json")).version;
-    const topVersion = require(path.join(topUndici, "package.json")).version;
-
-    if (nestedVersion !== topVersion) {
-      console.log(
-        `[pi-web] Replacing pi-coding-agent's undici@${nestedVersion} ` +
-          `→ symlink to undici@${topVersion}`,
-      );
-      fs.rmSync(nestedUndici, { recursive: true, force: true });
-
-      const rel = path.relative(path.dirname(nestedUndici), topUndici);
-      fs.symlinkSync(
-        rel,
-        nestedUndici,
-        process.platform === "win32" ? "junction" : "dir",
-      );
+  // 2. Replace nested undici@8.5.0 with symlink to top-level undici@^8.10.0
+  if (
+    fs.existsSync(topUndici) &&
+    fs.existsSync(nestedUndici) &&
+    // Only replace if it's a real directory, not already a symlink
+    fs.lstatSync(nestedUndici).isDirectory() &&
+    !fs.lstatSync(nestedUndici).isSymbolicLink()
+  ) {
+    try {
+      const nestedVersion = require(path.join(nestedUndici, "package.json")).version;
+      const topVersion = require(path.join(topUndici, "package.json")).version;
+
+      if (nestedVersion !== topVersion) {
+        console.log(
+          `[pi-web] Replacing pi-coding-agent's undici@${nestedVersion} ` +
+            `→ symlink to undici@${topVersion}`,
+        );
+        fs.rmSync(nestedUndici, { recursive: true, force: true });
+
+        const rel = path.relative(path.dirname(nestedUndici), topUndici);
+        fs.symlinkSync(
+          rel,
+          nestedUndici,
+          process.platform === "win32" ? "junction" : "dir",
+        );
+      }
+    } catch (err) {
+      console.warn("[pi-web] Symlink fix skipped:", err.message);
     }
-  } catch (err) {
-    console.warn("[pi-web] Symlink fix skipped:", err.message);
   }
 }
+
+module.exports = { applyUndiciFix };
+
+if (require.main === module) {
+  applyUndiciFix();
+}

package/bin/pi-web.js

@@ -10,6 +10,17 @@ const fs = require("fs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { parseLaunchOptions } = require("./pi-web-options");
 
+// Apply the undici CVE fix (formerly a postinstall hook). Running it here —
+// before the pi agent's undici can be loaded — keeps installs quiet under
+// npm >= 11.16's allow-scripts policy and survives installs that skip scripts.
+try {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  require("./fix-pi-agent-undici").applyUndiciFix();
+} catch {
+  // Best-effort; the app still starts with the shrinkwrapped undici if the
+  // fix cannot be applied.
+}
+
 const pkgDir = path.join(__dirname, "..");
 const nextDir = path.join(pkgDir, ".next");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qt4798/pi-web",
-  "version": "0.9.17-beta.2",
+  "version": "0.9.17-beta.3",
   "description": "Web workspace for the pi coding agent",
   "homepage": "https://github.com/t479842598/pi-web-QT#readme",
   "repository": {
@@ -28,14 +28,13 @@
     "package.json"
   ],
   "scripts": {
-    "dev": "next dev -H 127.0.0.1 -p 0 --turbopack",
-    "dev:lan": "next dev -H 0.0.0.0 -p 0 --turbopack",
+    "dev": "node bin/fix-pi-agent-undici.js && next dev -H 127.0.0.1 -p 0 --turbopack",
+    "dev:lan": "node bin/fix-pi-agent-undici.js && next dev -H 0.0.0.0 -p 0 --turbopack",
     "build": "env -u TURBOPACK next build --webpack",
-    "start": "next start -H 127.0.0.1 -p 0",
-    "start:lan": "next start -H 0.0.0.0 -p 0",
+    "start": "node bin/fix-pi-agent-undici.js && next start -H 127.0.0.1 -p 0",
+    "start:lan": "node bin/fix-pi-agent-undici.js && next start -H 0.0.0.0 -p 0",
     "lint": "eslint .",
     "release": "npm version patch --no-git-tag-version && npm run build && npm publish --access public",
-    "postinstall": "node bin/fix-pi-agent-undici.js",
     "test": "node --experimental-strip-types --test $(find app components hooks lib -name '*.test.mjs' -print)"
   },
   "dependencies": {
@@ -45,7 +44,6 @@
     "@earendil-works/pi-tui": "0.83.0",
     "@fontsource/ia-writer-quattro": "^5.3.0",
     "@fontsource/lilex": "^5.3.0",
-    "@lobehub/icons": "^5.6.0",
     "@phosphor-icons/react": "^2.1.10",
     "@types/react-syntax-highlighter": "^15.5.13",
     "adm-zip": "^0.6.0",
@@ -67,18 +65,17 @@
   },
   "overrides": {
     "undici": "^8.10.0",
-    "@emoji-mart/react": {
-      "react": "$react"
-    },
     "@earendil-works/pi-coding-agent": {
       "undici": "^8.10.0"
-    }
+    },
+    "node-domexception": "npm:@profoundlogic/node-domexception@1.0.2",
+    "intersection-observer": "npm:noop2@2.0.0"
   },
   "allowScripts": {
     "@google/genai@1.52.0": true,
     "protobufjs@7.6.5": true,
     "sharp@0.34.5": true,
-    "unrs-resolver@1.11.1": true
+    "unrs-resolver@1.12.2": true
   },
   "devDependencies": {
     "@resvg/resvg-js": "^2.6.2",
@@ -90,6 +87,7 @@
     "eslint": "^9.39.5",
     "eslint-config-next": "16.2.12",
     "jiti": "^2.7.0",
+    "lightningcss": "^1.33.0",
     "postcss": "^8",
     "tailwindcss": "^4.2.2",
     "to-ico": "^1.1.5",