@qt4798/pi-web 0.9.4 → 0.9.6

package/.next/types/app/api/settings/title-model/route.ts

@@ -0,0 +1,351 @@
+// File: /Volumes/1T 原装/项目研发/pi-web-QT/app/api/settings/title-model/route.ts
+import * as entry from '../../../../../../app/api/settings/title-model/route.js'
+import type { NextRequest } from 'next/server.js'
+
+import type { InstantConfigForTypeCheckInternal } from 'next/dist/build/segment-config/app/app-segment-config.js'
+
+type TEntry = typeof import('../../../../../../app/api/settings/title-model/route.js')
+
+type SegmentParams<T extends Object = any> = T extends Record<string, any>
+  ? { [K in keyof T]: T[K] extends string ? string | string[] | undefined : never }
+  : T
+
+// Check that the entry is a valid entry
+checkFields<Diff<{
+  GET?: Function
+  HEAD?: Function
+  OPTIONS?: Function
+  POST?: Function
+  PUT?: Function
+  DELETE?: Function
+  PATCH?: Function
+  config?: {}
+  generateStaticParams?: Function
+  unstable_instant?: InstantConfigForTypeCheckInternal
+  unstable_dynamicStaleTime?: number
+  revalidate?: RevalidateRange<TEntry> | false
+  dynamic?: 'auto' | 'force-dynamic' | 'error' | 'force-static'
+  dynamicParams?: boolean
+  fetchCache?: 'auto' | 'force-no-store' | 'only-no-store' | 'default-no-store' | 'default-cache' | 'only-cache' | 'force-cache'
+  preferredRegion?: 'auto' | 'global' | 'home' | string | string[]
+  runtime?: 'nodejs' | 'experimental-edge' | 'edge'
+  maxDuration?: number
+  
+}, TEntry, ''>>()
+
+type RouteContext = { params: Promise<SegmentParams> }
+// Check the prop type of the entry function
+if ('GET' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'GET',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'GET',
+        __return_type__: ReturnType<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('HEAD' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'HEAD',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'HEAD',
+        __return_type__: ReturnType<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('OPTIONS' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: ReturnType<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('POST' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'POST',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'POST',
+        __return_type__: ReturnType<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PUT' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PUT',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PUT',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('DELETE' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'DELETE',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'DELETE',
+        __return_type__: ReturnType<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PATCH' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PATCH',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PATCH',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+}
+
+// Check the arguments and return type of the generateStaticParams function
+if ('generateStaticParams' in entry) {
+  checkFields<Diff<{ params: SegmentParams }, FirstArg<MaybeField<TEntry, 'generateStaticParams'>>, 'generateStaticParams'>>()
+  checkFields<Diff<{ __tag__: 'generateStaticParams', __return_type__: any[] | Promise<any[]> }, { __tag__: 'generateStaticParams', __return_type__: ReturnType<MaybeField<TEntry, 'generateStaticParams'>> }>>()
+}
+
+export interface PageProps {
+  params?: Promise<SegmentParams>
+  searchParams?: Promise<any>
+}
+export interface LayoutProps {
+  children?: React.ReactNode
+
+  params?: Promise<SegmentParams>
+}
+
+// =============
+// Utility types
+type RevalidateRange<T> = T extends { revalidate: any } ? NonNegative<T['revalidate']> : never
+
+// If T is unknown or any, it will be an empty {} type. Otherwise, it will be the same as Omit<T, keyof Base>.
+type OmitWithTag<T, K extends keyof any, _M> = Omit<T, K>
+type Diff<Base, T extends Base, Message extends string = ''> = 0 extends (1 & T) ? {} : OmitWithTag<T, keyof Base, Message>
+
+type FirstArg<T extends Function> = T extends (...args: [infer T, any]) => any ? unknown extends T ? any : T : never
+type SecondArg<T extends Function> = T extends (...args: [any, infer T]) => any ? unknown extends T ? any : T : never
+type MaybeField<T, K extends string> = T extends { [k in K]: infer G } ? G extends Function ? G : never : never
+
+type ParamCheck<T> = {
+  __tag__: string
+  __param_position__: string
+  __param_type__: T
+}
+
+function checkFields<_ extends { [k in keyof any]: never }>() {}
+
+// https://github.com/sindresorhus/type-fest
+type Numeric = number | bigint
+type Zero = 0 | 0n
+type Negative<T extends Numeric> = T extends Zero ? never : `${T}` extends `-${string}` ? T : never
+type NonNegative<T extends Numeric> = T extends Zero ? T : Negative<T> extends never ? T : '__invalid_negative_number__'

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/"
-type AppRouteHandlerRoutes = "/api/agent/[id]" | "/api/agent/[id]/bash-output" | "/api/agent/[id]/events" | "/api/agent/new" | "/api/agent/running" | "/api/auth/all-providers" | "/api/auth/api-key/[provider]" | "/api/auth/login/[provider]" | "/api/auth/logout/[provider]" | "/api/auth/providers" | "/api/cwd/browse" | "/api/cwd/validate" | "/api/default-cwd" | "/api/file-index" | "/api/files/[...path]" | "/api/git/diff" | "/api/git/status" | "/api/home" | "/api/models" | "/api/models-config" | "/api/models-config/catalog" | "/api/models-config/discover" | "/api/models-config/test" | "/api/plugins" | "/api/project-trust" | "/api/sessions" | "/api/sessions/[id]" | "/api/sessions/[id]/auto-name" | "/api/sessions/[id]/context" | "/api/sessions/[id]/entries/[entryId]/thinking" | "/api/sessions/[id]/export" | "/api/sessions/[id]/queue-recovery" | "/api/sessions/[id]/state" | "/api/skills" | "/api/skills/check" | "/api/skills/install" | "/api/skills/search" | "/api/skills/update" | "/api/themes" | "/api/themes/[name]" | "/api/worktrees"
+type AppRouteHandlerRoutes = "/api/agent/[id]" | "/api/agent/[id]/bash-output" | "/api/agent/[id]/events" | "/api/agent/new" | "/api/agent/running" | "/api/auth/all-providers" | "/api/auth/api-key/[provider]" | "/api/auth/login/[provider]" | "/api/auth/logout/[provider]" | "/api/auth/providers" | "/api/backup/export" | "/api/backup/import" | "/api/cwd/browse" | "/api/cwd/validate" | "/api/default-cwd" | "/api/file-index" | "/api/files/[...path]" | "/api/git/diff" | "/api/git/status" | "/api/home" | "/api/import/discover" | "/api/import/execute" | "/api/import/status" | "/api/models" | "/api/models-config" | "/api/models-config/builtin" | "/api/models-config/catalog" | "/api/models-config/discover" | "/api/models-config/test" | "/api/plugins" | "/api/project-trust" | "/api/sessions" | "/api/sessions/[id]" | "/api/sessions/[id]/auto-name" | "/api/sessions/[id]/context" | "/api/sessions/[id]/entries/[entryId]/thinking" | "/api/sessions/[id]/export" | "/api/sessions/[id]/queue-recovery" | "/api/sessions/[id]/state" | "/api/settings/title-model" | "/api/skills" | "/api/skills/check" | "/api/skills/install" | "/api/skills/search" | "/api/skills/update" | "/api/themes" | "/api/themes/[name]" | "/api/worktrees"
 type PageRoutes = never
 type LayoutRoutes = "/"
 type RedirectRoutes = never
@@ -22,6 +22,8 @@ interface ParamMap {
   "/api/auth/login/[provider]": { "provider": string; }
   "/api/auth/logout/[provider]": { "provider": string; }
   "/api/auth/providers": {}
+  "/api/backup/export": {}
+  "/api/backup/import": {}
   "/api/cwd/browse": {}
   "/api/cwd/validate": {}
   "/api/default-cwd": {}
@@ -30,8 +32,12 @@ interface ParamMap {
   "/api/git/diff": {}
   "/api/git/status": {}
   "/api/home": {}
+  "/api/import/discover": {}
+  "/api/import/execute": {}
+  "/api/import/status": {}
   "/api/models": {}
   "/api/models-config": {}
+  "/api/models-config/builtin": {}
   "/api/models-config/catalog": {}
   "/api/models-config/discover": {}
   "/api/models-config/test": {}
@@ -45,6 +51,7 @@ interface ParamMap {
   "/api/sessions/[id]/export": { "id": string; }
   "/api/sessions/[id]/queue-recovery": { "id": string; }
   "/api/sessions/[id]/state": { "id": string; }
+  "/api/settings/title-model": {}
   "/api/skills": {}
   "/api/skills/check": {}
   "/api/skills/install": {}

package/.next/types/validator.ts

@@ -146,6 +146,24 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../app/api/backup/export/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/backup/export">> = Specific
+  const handler = {} as typeof import("../../app/api/backup/export/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/api/backup/import/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/backup/import">> = Specific
+  const handler = {} as typeof import("../../app/api/backup/import/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../app/api/cwd/browse/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/cwd/browse">> = Specific
@@ -218,6 +236,42 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../app/api/import/discover/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/import/discover">> = Specific
+  const handler = {} as typeof import("../../app/api/import/discover/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/api/import/execute/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/import/execute">> = Specific
+  const handler = {} as typeof import("../../app/api/import/execute/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/api/import/status/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/import/status">> = Specific
+  const handler = {} as typeof import("../../app/api/import/status/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../app/api/models-config/builtin/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/models-config/builtin">> = Specific
+  const handler = {} as typeof import("../../app/api/models-config/builtin/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../app/api/models-config/catalog/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/models-config/catalog">> = Specific
@@ -353,6 +407,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../app/api/settings/title-model/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/settings/title-model">> = Specific
+  const handler = {} as typeof import("../../app/api/settings/title-model/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../app/api/skills/check/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/skills/check">> = Specific

package/README.en.md

@@ -19,8 +19,11 @@
 - Model, OAuth/API-key, skill, plugin, theme, language, and Git worktree management in the browser.
 - Mobile layout keeps the selected model and send action visible, while long project and repository labels truncate instead of causing horizontal scrolling.
 
-## Latest changes (2026-08-03)
+## Latest changes (2026-08-04)
 
+- **Backup & restore** — a new Backup tab in Settings exports/imports core config, skills, plugins, MCP servers, and sessions (optionally including API keys) as a pi-backup zip; imports remap paths and adapt MCP commands per platform, with per-category selection and per-server skip.
+- **Auto session titles** — hover actions on a session now include a "Generate title" button that names the session from its content via a model; the title model can be set globally.
+- **Security hardening** — auth checks were added to the auto-name, settings/title-model, models-config, and builtin-model routes; backup import gained decompression-bomb limits (per-entry and total, verified against actual bytes), script shebang allow-lists, local-package name validation, and opt-in npm reinstall.
 - The repository now uses the `pi-web-desktop` web baseline only. Electron, desktop packaging, the PWA Service Worker, and tag-triggered desktop releases were removed.
 - **Choose folder** opens a browsable directory picker instead of asking for a manually typed path.
 - On mobile, project and Git worktree labels are smaller and truncate safely; the model selector and send action remain visible.
@@ -43,7 +46,7 @@ npm ci
 npm run dev
 ```
 
-Open `http://127.0.0.1:30141`. The development server listens on loopback by default; use `npm run dev:lan` only for trusted LAN testing.
+`npm run dev` uses a **random port** (`-p 0`); the startup log prints the actual address, e.g. `http://127.0.0.1:<random port>`. The local repo build is for testing only — for daily command-line use, run the globally installed `@qt4798/pi-web` via the `pi-web` command (fixed `http://127.0.0.1:30141`). The development server listens on loopback by default; use `npm run dev:lan` only for trusted LAN testing.
 
 ## Production deployment
 

package/README.md

@@ -28,21 +28,44 @@
 | --- | --- |
 | 实时对话 | 通过 SSE 显示 Pi Agent 的流式输出、工具调用、思考过程与错误状态。 |
 | 会话管理 | 按项目查看会话，支持会话内分支、Fork、重命名、删除、AI 自动生成标题与 HTML 导出。 |
+| 会话导入 | 从 Reasonix 等工具导入历史对话记录，自动发现项目与会话，支持合并或新建项目。 |
 | 项目与文件 | 通过目录选择器加载项目，浏览文件、Diff、图片、音频、PDF、DOCX。 |
 | 模型与认证 | 在网页中管理模型、OAuth/API Key、连通性测试和默认模型；支持从供应商自动获取模型列表与 models.dev 定价预设一键填入。 |
+| 备份恢复 | 一键导出/导入核心配置、技能、插件、MCP 服务器与会话（可选含密钥），跨平台自动适配路径与命令。 |
 | 技能与插件 | 查询、安装、启停 Skills 与 package 插件。 |
 | Git Worktree | 在同一项目下创建、切换和移除 Worktree。 |
 | 主题与语言 | 支持 Pi TUI 主题、亮暗模式及中文/English。 |
 | 移动端 | 适配 Safari/Chrome 窄屏布局；模型选择和发送操作保持可见。 |
 
-## 最新更新（2026-08-04）
+## 最新更新（2026-08-05）
 
+- **会话导入**：设置弹窗新增「导入会话」标签页，自动发现 `~/.reasonix/projects/` 下的项目与历史会话，支持按项目勾选批量导入，可选择合并到现有项目或新建项目；导入后可选调用模型生成标题。
+- **Windows 兼容修复**：修复全新安装（无历史会话）时项目选择器消失的问题；修复 `~` 路径缩写和快捷工作区识别的大小写敏感问题。
+
+## 历史更新（2026-08-04）
+
+- **跨平台备份恢复**：设置弹窗新增「备份」标签页，一键导出/导入核心配置、技能、插件、MCP 与会话；导入按平台自动适配路径与命令，支持类别勾选与 MCP 跳过。
+- **自动生成会话标题**：会话列表新增“生成标题”按钮，基于会话内容调用模型命名；可全局指定标题生成模型。
+- **内置模型覆盖**：模型配置可查看供应商内置模型明细并叠加 models.json 自定义覆盖项。
+- **安全加固**：auto-name / settings / models-config 等 API 补齐请求鉴权；备份导入增加解压炸弹防护（单条目/总量双重上限 + 实际字节校验）、脚本白名单、路径穿越校验与 npm 插件 opt-in 重装。
 - **供应商获取模型**：模型配置中可直接从供应商的 Base URL 拉取模型列表（支持 OpenAI / Anthropic / Google 等协议），筛选、多选后一键添加，无需手写模型 ID。
 - **models.dev 定价预设**：填写模型 ID 后一键从 models.dev 拉取名称、上下文窗口、价格等字段填入，支持撤销；价格来源与可信度一目了然。
 - **对话滚动跟随**：修复 agent 运行时消息列表跳到底部空白的问题；流式输出期间停留在列表底部则自动跟随，滚到上方查看历史不被打断，且最后一条消息与输入框之间保留间距。
 - **快捷操作**：文件标签页支持中间键关闭；会话删除支持 Shift+点击跳过确认；Markdown 中的本地图片可直接预览。
 - **URL 直达目录**：通过 `?cwd=<路径>` 参数打开网页时直接校验并进入指定目录的新会话。
 
+## 安装提示（npm 11）
+
+使用 npm ≥ 11 安装本包时可能出现两类提示，均为**提示性警告，不影响安装与运行**：
+
+- `ERESOLVE overriding peer dependency`：上游 `@lobehub/ui` 依赖的 `@emoji-mart/react@1.1.1` 的 peer 声明仅到 React 18，而本包使用 React 19。npm 会自动 override 并继续安装（实际兼容）。如需彻底消除，可在你的项目 `package.json` 添加：
+
+  ```json
+  "overrides": { "@emoji-mart/react": { "react": "$react" } }
+  ```
+
+- `allow-scripts`：npm 11 新增的安装脚本审批提示（sharp / protobufjs / @google/genai 等）。本项目已在包内声明 `allowScripts`，若你的 npm 仍提示，可执行 `npm approve-scripts --all` 审批，或在安装命令加 `--allow-scripts=sharp,protobufjs,@google/genai`。
+
 ## 最新更新（2026-08-03）
 
 - **Web-only 基线**：界面和运行代码已统一为 `pi-web-desktop` 的网页基线；Electron 主进程、桌面端打包、PWA Service Worker 与 tag 驱动的桌面 Release 工作流已移除。
@@ -103,7 +126,7 @@ npm ci
 npm run dev
 ```
 
-浏览器打开 `http://127.0.0.1:30141`。
+`npm run dev` 使用**随机端口**（`-p 0`），启动日志会打印实际地址，如 `http://127.0.0.1:<随机端口>`。本地仓库构建仅作为测试环境；日常命令行运行请使用 npm 全局安装的 `@qt4798/pi-web`（`pi-web` 命令，固定 `http://127.0.0.1:30141`）。
 
 开发服务器默认只监听本机。局域网调试可使用：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qt4798/pi-web",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Web workspace for the pi coding agent",
   "homepage": "https://github.com/t479842598/pi-web-QT#readme",
   "repository": {
@@ -28,11 +28,11 @@
     "package.json"
   ],
   "scripts": {
-    "dev": "next dev -H 127.0.0.1 -p 30141 --turbopack",
-    "dev:lan": "next dev -H 0.0.0.0 -p 30141 --turbopack",
+    "dev": "next dev -H 127.0.0.1 -p 0 --turbopack",
+    "dev:lan": "next dev -H 0.0.0.0 -p 0 --turbopack",
     "build": "env -u TURBOPACK next build --webpack",
-    "start": "next start -H 127.0.0.1 -p 30141",
-    "start:lan": "next start -H 0.0.0.0 -p 30141",
+    "start": "next start -H 127.0.0.1 -p 0",
+    "start:lan": "next start -H 0.0.0.0 -p 0",
     "lint": "eslint .",
     "release": "npm version patch --no-git-tag-version && npm run build && npm publish --access public",
     "test": "node --experimental-strip-types --test $(find app components hooks lib -name '*.test.mjs' -print)"
@@ -47,6 +47,7 @@
     "@lobehub/icons": "^5.6.0",
     "@phosphor-icons/react": "^2.1.10",
     "@types/react-syntax-highlighter": "^15.5.13",
+    "adm-zip": "^0.6.0",
     "katex": "^0.16.47",
     "mammoth": "^1.12.0",
     "mermaid": "^11.14.0",
@@ -63,6 +64,17 @@
     "remark-math": "^6.0.0",
     "undici": "8.5.0"
   },
+  "overrides": {
+    "@emoji-mart/react": {
+      "react": "$react"
+    }
+  },
+  "allowScripts": {
+    "@google/genai@1.52.0": true,
+    "protobufjs@7.6.5": true,
+    "sharp@0.34.5": true,
+    "unrs-resolver@1.11.1": true
+  },
   "devDependencies": {
     "@resvg/resvg-js": "^2.6.2",
     "@tailwindcss/postcss": "^4.2.2",
@@ -70,12 +82,12 @@
     "@types/proper-lockfile": "4.1.4",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "eslint": "^9",
+    "eslint": "^9.39.5",
     "eslint-config-next": "16.2.12",
     "jiti": "^2.7.0",
     "postcss": "^8",
     "tailwindcss": "^4.2.2",
     "to-ico": "^1.1.5",
-    "typescript": "^5"
+    "typescript": "^5.9.3"
   }
 }

package/.next/static/-RoYqrN1Mf4JD9crC9rVq/_buildManifest.js

@@ -1 +0,0 @@
-self.__BUILD_MANIFEST={__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:32,errorRate:1e-4,numBits:614,numHashes:14,bitArray:[0,0,1,0,1,1,0,1,0,1,1,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,1,1,0,1,0,1,0,1,0,1,0,0,1,0,0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,1,1,0,1,1,0,0,0,0,0,1,0,0,0,0,1,0,0,1,1,1,0,0,0,0,1,1,0,0,0,0,0,1,0,0,0,0,1,1,1,1,1,1,0,1,0,1,1,0,1,1,0,0,1,0,0,1,1,0,0,0,1,0,1,0,1,1,0,1,1,1,0,0,0,1,1,1,0,0,1,1,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,1,1,1,0,1,0,1,0,1,0,0,0,1,0,1,1,0,0,0,1,1,1,1,1,1,1,0,0,1,0,1,0,1,1,1,0,0,0,1,1,1,0,0,0,1,0,1,0,1,0,1,1,1,0,0,1,0,1,1,0,0,1,1,1,0,1,1,0,1,1,0,0,0,0,0,0,1,0,1,0,1,1,0,0,0,1,0,0,0,1,0,0,0,1,1,0,1,0,0,1,0,1,1,0,0,0,0,0,1,1,1,1,1,1,0,0,1,0,1,0,0,1,1,0,0,1,1,0,0,1,1,1,1,1,0,0,1,1,0,0,0,0,0,0,0,1,0,1,1,0,1,1,0,1,1,1,0,1,0,0,0,1,0,0,0,1,1,1,1,1,1,1,1,1,0,0,1,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,1,1,0,0,0,1,0,1,1,1,0,1,1,0,0,0,0,0,1,0,1,1,1,0,1,0,0,1,0,0,1,0,0,0,1,0,0,0,0,1,1,0,1,0,1,1,0,1,1,1,0,0,1,1,0,1,0,1,1,0,0,1,0,0,1,1,0,1,1,0,0,0,0,0,0,1,0,0,1,0,0,0,1,1,0,1,0,1,1,1,1,1,0,1,1,0,1,0,1,1,1,0,0,1,1,0,1,1,1,0,0,0,1,0,0,0,1,1,1,1,1,0,1,1,1,0,1,1,0,1,1,1,1,0,1,1,1,0,0,1,1,1,0,0,0,0,1,1,0,1,1,1,1,0,1,1,1,1,1,0,0,0,0,1,1,1,0,1,0,1,1,1,1,0,1,1,0,1,1,1,0,1,0,1,0,1,0,1,1,1,0,0,1,0,0,1,0,1,1,1,0,1,0,0,1,0,0,1,0,1,1,0,1,1,0,1,1,1,1,0,1,0,1,0,0,1,0,1,0,1,1,1,1,1,1,0,0,1,1,0,0,0,1,1,1,0,1,0,1,0,1,1,1,1,1,0,0,0,1,1]},__routerFilterDynamic:{numItems:7,errorRate:1e-4,numBits:135,numHashes:14,bitArray:[0,1,1,0,0,1,0,1,0,0,1,0,0,1,0,1,0,0,0,0,1,0,1,1,1,1,0,0,1,0,0,0,1,1,1,1,1,0,1,0,1,1,1,0,0,0,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,0,0,1,1,1,1,0,1,1,1,1,1,0,0,0,0,1,0,0,1,0,1,0,0,0,1,0,1,1,1,0,0,1,0,0,0,0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,1,1,0,0,0,0,0,1,0,0,1,1,1,1,1,0,0,1,0,1,0,1]},sortedPages:["/_app"]},self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

package/.next/static/chunks/app/_global-error/page-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/agent/[id]/bash-output/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/agent/[id]/events/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/agent/[id]/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/agent/new/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/agent/running/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/auth/all-providers/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/auth/api-key/[provider]/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/auth/login/[provider]/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);

package/.next/static/chunks/app/api/auth/logout/[provider]/route-1fddebcafb57d31a.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[552,976,1004,1097,1541,1960,2053,2138,2504,2835,2837,3432,3507,3851,3943,3955,4016,4037,4896,5221,5907,6450,6709,6819,6849,6919,6988,7067,7483,7769,7812,7851,8167,8197,8335,8380,8429,8504,8658,8743,8933,9156,9742,9747,9787,9968],{84441:()=>{}},_=>{_.O(0,[8441,3794,7358],()=>_(_.s=84441)),_N_E=_.O()}]);