@rexvane/piweb 0.3.14 → 0.3.15

package/scripts/managed-niubash-assets.mjs

@@ -0,0 +1,146 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export const NIUBASH_VERSION = "1.1.4";
+export const NIUBASH_TAG = `v${NIUBASH_VERSION}`;
+export const NIUBASH_DISTRIBUTION_VERSION = `${NIUBASH_VERSION}-piweb.0`;
+export const NIUBASH_REPOSITORY = "https://github.com/unixwin/niubash";
+
+export const MANAGED_NIUBASH_ASSETS = Object.freeze({
+	x64: Object.freeze({
+		arch: "x64",
+		machine: 0x8664,
+		packageName: "@rexvane/piweb-niubash-win32-x64",
+		directory: "piweb-niubash-win32-x64",
+		asset: "niubash-v1.1.4-win-x64.zip",
+		sha256: "9f543634288a316f7ed8e5a76ff794eca402cb21e74b8f8a551daffafde162f5",
+	}),
+	arm64: Object.freeze({
+		arch: "arm64",
+		machine: 0xaa64,
+		packageName: "@rexvane/piweb-niubash-win32-arm64",
+		directory: "piweb-niubash-win32-arm64",
+		asset: "niubash-v1.1.4-win-arm64.zip",
+		sha256: "77e98ba8d7f6be70c35388bcc28bdbc883c06bcaafffbe186a88788ad32ccf00",
+	}),
+});
+
+export const NIUBASH_LICENSES = Object.freeze([
+	Object.freeze({
+		filename: "NIUBASH.txt",
+		url: "https://raw.githubusercontent.com/unixwin/niubash/v1.1.4/LICENSE",
+		sha256: "1290aae99e71239ee3154e7847830e49e7a36c758fa6d659d73fa752dc9f81c8",
+	}),
+	Object.freeze({
+		filename: "RUBASH.txt",
+		url: "https://raw.githubusercontent.com/unixwin/rubash/8b81c7501646/LICENSE",
+		sha256: "e426a75a20633f3088da22aef61a5a44d06f1f884c600f6011d00702c3989079",
+	}),
+	Object.freeze({
+		filename: "WINUXCMD.txt",
+		url: "https://raw.githubusercontent.com/unixwin/WinuxCmd/v1.0.8/LICENSE",
+		sha256: "8ffc4ed56f5e6ab8183a7ece2e3aa6ea4800b0a4e8170d11bd60856f2dd760f3",
+	}),
+]);
+
+export function niubashAssetUrl(asset) {
+	return `${NIUBASH_REPOSITORY}/releases/download/${NIUBASH_TAG}/${asset.asset}`;
+}
+
+export function sha256(data) {
+	return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+export function sha256File(filename) {
+	return sha256(fs.readFileSync(filename));
+}
+
+export function listFiles(root) {
+	const files = [];
+	const visit = (directory, prefix = "") => {
+		for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+			const absolute = path.join(directory, entry.name);
+			if (entry.isDirectory()) visit(absolute, relative);
+			else if (entry.isFile()) files.push(relative);
+			else throw new Error(`managed niubash runtime contains an unsupported entry: ${relative}`);
+		}
+	};
+	visit(root);
+	return files;
+}
+
+export function readPeMachine(filename) {
+	const data = fs.readFileSync(filename);
+	if (data.length < 64 || data[0] !== 0x4d || data[1] !== 0x5a) throw new Error(`${filename} is not a PE executable`);
+	const peOffset = data.readUInt32LE(0x3c);
+	if (peOffset + 6 > data.length || data.toString("ascii", peOffset, peOffset + 4) !== "PE\0\0") {
+		throw new Error(`${filename} has an invalid PE header`);
+	}
+	return data.readUInt16LE(peOffset + 4);
+}
+
+function readJson(filename) {
+	return JSON.parse(fs.readFileSync(filename, "utf8"));
+}
+
+function assertEqual(actual, expected, label) {
+	if (actual !== expected) throw new Error(`${label}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+
+/** Validate a prepared source package or an unpacked npm tarball. */
+export function validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles = true } = {}) {
+	const packageInfo = readJson(path.join(packageRoot, "package.json"));
+	assertEqual(packageInfo.name, asset.packageName, "managed niubash package name");
+	assertEqual(packageInfo.version, NIUBASH_DISTRIBUTION_VERSION, "managed niubash package version");
+	if (!Array.isArray(packageInfo.os) || packageInfo.os.length !== 1 || packageInfo.os[0] !== "win32") {
+		throw new Error(`${asset.packageName} must be restricted to os=win32`);
+	}
+	if (!Array.isArray(packageInfo.cpu) || packageInfo.cpu.length !== 1 || packageInfo.cpu[0] !== asset.arch) {
+		throw new Error(`${asset.packageName} must be restricted to cpu=${asset.arch}`);
+	}
+
+	const runtime = path.join(packageRoot, "runtime");
+	if (!fs.existsSync(path.join(runtime, "niu.exe"))) {
+		throw new Error(`${asset.packageName} has no prepared runtime; run \`node scripts/prepare-niubash-packages.mjs\` before packing/publishing`);
+	}
+	const manifest = readJson(path.join(packageRoot, "runtime-manifest.json"));
+	assertEqual(manifest.schema, 1, "managed niubash manifest schema");
+	assertEqual(manifest.source?.repository, NIUBASH_REPOSITORY, "managed niubash source repository");
+	assertEqual(manifest.source?.tag, NIUBASH_TAG, "managed niubash source tag");
+	assertEqual(manifest.source?.asset, asset.asset, "managed niubash source asset");
+	assertEqual(manifest.source?.sha256, asset.sha256, "managed niubash source SHA-256");
+	if (!manifest.files || typeof manifest.files !== "object" || Array.isArray(manifest.files)) {
+		throw new Error(`${asset.packageName} runtime manifest has no file map`);
+	}
+	const expectedFiles = Object.keys(manifest.files);
+	if (expectedFiles.length < 300) throw new Error(`${asset.packageName} runtime is incomplete (${expectedFiles.length} files)`);
+	for (const relative of expectedFiles) {
+		if (!relative || relative.includes("\\") || path.posix.isAbsolute(relative) || relative.split("/").includes("..")) {
+			throw new Error(`${asset.packageName} runtime manifest contains an unsafe path: ${relative}`);
+		}
+		const filename = path.join(runtime, ...relative.split("/"));
+		const stat = fs.statSync(filename);
+		if (!stat.isFile()) throw new Error(`${asset.packageName} runtime entry is not a file: ${relative}`);
+		assertEqual(sha256File(filename), manifest.files[relative], `${asset.packageName} hash for ${relative}`);
+	}
+	const actualFiles = listFiles(runtime);
+	const extra = actualFiles.filter((file) => !(file in manifest.files));
+	if (!allowExtraRuntimeFiles && extra.length > 0) {
+		throw new Error(
+			`${asset.packageName} runtime has ${extra.length} files not in the signed manifest (niubash self-activates command links on first run). Re-run \`node scripts/prepare-niubash-packages.mjs\` before packing. First extra: ${extra[0]}`,
+		);
+	}
+
+	for (const required of ["niu.exe", "winuxcmd/usr/bin/winuxcmd.exe", "bundles/oh-my-niu/bundle.toml"]) {
+		if (!expectedFiles.includes(required)) throw new Error(`${asset.packageName} is missing ${required}`);
+	}
+	for (const executable of ["niu.exe", "winuxcmd/usr/bin/winuxcmd.exe"]) {
+		assertEqual(readPeMachine(path.join(runtime, ...executable.split("/"))), asset.machine, `${asset.packageName} PE machine for ${executable}`);
+	}
+	for (const license of NIUBASH_LICENSES) {
+		assertEqual(sha256File(path.join(packageRoot, "licenses", license.filename)), license.sha256, `${asset.packageName} license ${license.filename}`);
+	}
+	return { files: expectedFiles.length, runtime };
+}

package/scripts/prepare-niubash-packages.mjs

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * Build the Windows-only npm packages from pinned official niubash portable
+ * archives. Nothing is downloaded on macOS/Linux user installs: this runs only
+ * in PiWeb's release workflow (or explicitly by a maintainer).
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+	MANAGED_NIUBASH_ASSETS,
+	NIUBASH_LICENSES,
+	NIUBASH_REPOSITORY,
+	NIUBASH_TAG,
+	listFiles,
+	niubashAssetUrl,
+	sha256,
+	sha256File,
+	validateManagedNiubashPackage,
+} from "./managed-niubash-assets.mjs";
+import { isMainModule } from "./entrypoint.mjs";
+
+const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+async function download(url, expectedSha256) {
+	let lastError;
+	for (let attempt = 1; attempt <= 3; attempt += 1) {
+		try {
+			const response = await fetch(url, {
+				headers: { "user-agent": "PiWeb managed-niubash packager" },
+				signal: AbortSignal.timeout(120_000),
+			});
+			if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
+			const data = Buffer.from(await response.arrayBuffer());
+			const actual = sha256(data);
+			if (actual !== expectedSha256) throw new Error(`SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
+			return data;
+		} catch (error) {
+			lastError = error;
+			if (attempt < 3) await new Promise((resolve) => setTimeout(resolve, attempt * 1000));
+		}
+	}
+	throw new Error(`failed to download ${url}: ${lastError instanceof Error ? lastError.message : lastError}`);
+}
+
+function extractZip(archive, destination) {
+	fs.mkdirSync(destination, { recursive: true });
+	let result;
+	if (process.platform === "win32") {
+		result = spawnSync("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			"Expand-Archive -LiteralPath $env:PIWEB_NIUBASH_ARCHIVE -DestinationPath $env:PIWEB_NIUBASH_DESTINATION -Force",
+		], {
+			encoding: "utf8",
+			env: { ...process.env, PIWEB_NIUBASH_ARCHIVE: archive, PIWEB_NIUBASH_DESTINATION: destination },
+		});
+	} else {
+		result = spawnSync("unzip", ["-q", "-o", archive, "-d", destination], { encoding: "utf8" });
+		if (result.error?.code === "ENOENT") {
+			result = spawnSync("python3", ["-m", "zipfile", "-e", archive, destination], { encoding: "utf8" });
+		}
+	}
+	if (result.error) throw new Error(`cannot extract ${path.basename(archive)}: ${result.error.message}`);
+	if (result.status !== 0) throw new Error(`cannot extract ${path.basename(archive)}: ${result.stderr || result.stdout}`);
+}
+
+async function replaceDirectory(source, destination) {
+	fs.rmSync(destination, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	for (let attempt = 1; ; attempt += 1) {
+		try {
+			fs.renameSync(source, destination);
+			return;
+		} catch (error) {
+			// Windows：刚写入几百个文件时，Defender/索引器会短暂持有句柄，目录 rename 报 EPERM。
+			// 先退避重试，仍不行就退化成复制（读通常是被允许的）。
+			if (!["EPERM", "EBUSY", "EACCES"].includes(error?.code)) throw error;
+			if (attempt >= 5) {
+				fs.cpSync(source, destination, { recursive: true });
+				fs.rmSync(source, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, attempt * 250));
+		}
+	}
+}
+
+function extractedPortableRoot(destination) {
+	const entries = fs.readdirSync(destination, { withFileTypes: true }).filter((entry) => entry.name !== "__MACOSX");
+	if (entries.length !== 1 || !entries[0].isDirectory()) throw new Error("niubash archive must contain exactly one top-level directory");
+	return path.join(destination, entries[0].name);
+}
+
+async function prepareLicenses(root, packageRoot) {
+	const destination = path.join(packageRoot, "licenses");
+	const staging = path.join(packageRoot, `.licenses-${process.pid}`);
+	fs.rmSync(staging, { recursive: true, force: true });
+	fs.mkdirSync(staging, { recursive: true });
+	try {
+		for (const license of NIUBASH_LICENSES) {
+			const source = path.join(root, "third-party", "managed-niubash", "licenses", license.filename);
+			if (sha256File(source) !== license.sha256) throw new Error(`license source failed integrity check: ${license.filename}`);
+			fs.copyFileSync(source, path.join(staging, license.filename));
+		}
+		await replaceDirectory(staging, destination);
+	} finally {
+		fs.rmSync(staging, { recursive: true, force: true });
+	}
+}
+
+async function prepareAsset(root, asset, log) {
+	const packageRoot = path.join(root, "platform-packages", asset.directory);
+	if (!fs.existsSync(path.join(packageRoot, "package.json"))) throw new Error(`missing platform package skeleton: ${packageRoot}`);
+	const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `piweb-niubash-${asset.arch}-`));
+	const archive = path.join(temporary, asset.asset);
+	const extracted = path.join(temporary, "extracted");
+	const staging = path.join(packageRoot, `.runtime-${process.pid}`);
+	try {
+		log(`[piweb] Downloading ${asset.asset} ...`);
+		fs.writeFileSync(archive, await download(niubashAssetUrl(asset), asset.sha256));
+		extractZip(archive, extracted);
+		const source = extractedPortableRoot(extracted);
+		for (const required of ["niu.exe", "winuxcmd", "bundles"]) {
+			if (!fs.existsSync(path.join(source, required))) throw new Error(`${asset.asset} is missing ${required}`);
+		}
+
+		fs.rmSync(staging, { recursive: true, force: true });
+		fs.cpSync(source, staging, { recursive: true });
+		await replaceDirectory(staging, path.join(packageRoot, "runtime"));
+		const runtime = path.join(packageRoot, "runtime");
+
+		const files = {};
+		for (const relative of listFiles(runtime)) files[relative] = sha256File(path.join(runtime, ...relative.split("/")));
+		fs.writeFileSync(path.join(packageRoot, "runtime-manifest.json"), `${JSON.stringify({
+			schema: 1,
+			source: { repository: NIUBASH_REPOSITORY, tag: NIUBASH_TAG, asset: asset.asset, sha256: asset.sha256 },
+			files,
+		}, null, 2)}\n`);
+		await prepareLicenses(root, packageRoot);
+		const checked = validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles: false });
+		log(`[piweb] Prepared ${asset.packageName}: ${checked.files} runtime files.`);
+		return checked;
+	} finally {
+		fs.rmSync(staging, { recursive: true, force: true });
+		fs.rmSync(temporary, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	}
+}
+
+function selectAssets(args) {
+	if (args.length === 0) return Object.values(MANAGED_NIUBASH_ASSETS);
+	if (args.length === 1 && args[0] === "--current") {
+		if (process.platform !== "win32" || !(process.arch in MANAGED_NIUBASH_ASSETS)) {
+			throw new Error(`--current requires Windows x64/ARM64 (got ${process.platform}/${process.arch})`);
+		}
+		return [MANAGED_NIUBASH_ASSETS[process.arch]];
+	}
+	if (args.length === 1 && args[0].startsWith("--arch=")) {
+		const arch = args[0].slice("--arch=".length);
+		const asset = MANAGED_NIUBASH_ASSETS[arch];
+		if (!asset) throw new Error(`unsupported niubash architecture: ${arch}`);
+		return [asset];
+	}
+	throw new Error("Usage: node scripts/prepare-niubash-packages.mjs [--current|--arch=x64|--arch=arm64]");
+}
+
+export async function prepareManagedNiubashPackages(root = DEFAULT_ROOT, { args = [], log = console.log } = {}) {
+	const results = [];
+	for (const asset of selectAssets(args)) results.push(await prepareAsset(root, asset, log));
+	return results;
+}
+
+if (isMainModule(import.meta.url)) {
+	try {
+		await prepareManagedNiubashPackages(DEFAULT_ROOT, { args: process.argv.slice(2) });
+	} catch (error) {
+		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
+		process.exitCode = 1;
+	}
+}

package/scripts/smoke-managed-niubash.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/** Native smoke test. Run on both windows-latest (x64) and windows-11-arm. */
+import assert from "node:assert/strict";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
+import { MANAGED_NIUBASH_ASSETS, validateManagedNiubashPackage } from "./managed-niubash-assets.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+if (process.platform !== "win32" || !(process.arch in MANAGED_NIUBASH_ASSETS)) {
+	throw new Error(`managed niubash smoke test requires Windows x64/ARM64 (got ${process.platform}/${process.arch})`);
+}
+const asset = MANAGED_NIUBASH_ASSETS[process.arch];
+const packageRoot = path.join(root, "platform-packages", asset.directory);
+validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles: false });
+const require = createRequire(path.join(root, "package.json"));
+const runtime = require(path.join(packageRoot, "index.cjs"));
+assert.equal(runtime.packageName, asset.packageName);
+assert.equal(runtime.arch, process.arch);
+
+const version = spawnSync(runtime.shellPath, ["--version"], { encoding: "utf8", windowsHide: true });
+assert.equal(version.status, 0, version.stderr);
+assert.match(version.stdout, /Niubash 1\.1\.4/);
+assert.match(version.stdout, /rubash\s+git 8b81c7501646/);
+assert.match(version.stdout, /winuxcmd WinuxCmd 1\.0\.8/);
+
+const operations = createLocalBashOperations({ shellPath: runtime.shellPath });
+async function execute(command, options = {}) {
+	const chunks = [];
+	const result = await operations.exec(command, process.cwd(), {
+		onData: (data) => chunks.push(data),
+		...options,
+	});
+	return { exitCode: result.exitCode, output: Buffer.concat(chunks).toString("utf8") };
+}
+
+const empty = await execute("");
+assert.equal(empty.exitCode, 0);
+assert.equal(empty.output, "");
+
+const pwd = await execute("pwd");
+assert.equal(pwd.exitCode, 0);
+assert.equal(path.resolve(pwd.output.trim().replaceAll("/", path.sep)).toLowerCase(), path.resolve(process.cwd()).toLowerCase());
+
+const quoted = await execute(`node -e "console.log(JSON.stringify(process.argv.slice(1)))" 'a b' '' 'c"d' 'e\\f'`);
+assert.equal(quoted.exitCode, 0, quoted.output);
+assert.deepEqual(JSON.parse(quoted.output.trim()), ["a b", "", "c\"d", "e\\f"]);
+
+const shellQuotedCwd = process.cwd().replaceAll("'", `'"'"'`);
+const windowsPath = await execute(`cd '${shellQuotedCwd}' && pwd`);
+assert.equal(windowsPath.exitCode, 0, windowsPath.output);
+assert.equal(path.resolve(windowsPath.output.trim().replaceAll("/", path.sep)).toLowerCase(), path.resolve(process.cwd()).toLowerCase());
+
+await assert.rejects(() => execute("sleep 5", { timeout: 0.1 }), /timeout/);
+const controller = new AbortController();
+const aborted = execute("sleep 5", { signal: controller.signal });
+setTimeout(() => controller.abort(), 100);
+await assert.rejects(() => aborted, /aborted/);
+
+console.log(`[piweb] Managed niubash ${process.arch} smoke test passed (${version.stdout.split(/\r?\n/, 1)[0]}).`);

package/scripts/verify-package.mjs

@@ -13,9 +13,15 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { readProductionBuild } from "./build-output.mjs";
 import { isMainModule } from "./entrypoint.mjs";
+import {
+	MANAGED_NIUBASH_ASSETS,
+	NIUBASH_DISTRIBUTION_VERSION,
+	validateManagedNiubashPackage,
+} from "./managed-niubash-assets.mjs";
 
 const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -66,9 +72,56 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 	}
 }
 
+/** Pack and inspect one actual OS/CPU package, including every runtime hash and license. */
+export function verifyPackedManagedNiubashPackage(packageRoot, asset, { log = console.log } = {}) {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `piweb-niubash-pack-${asset.arch}-`));
+	try {
+		const packed = JSON.parse(runNpm(["pack", "--json", "--pack-destination", tmp], { cwd: packageRoot }));
+		const entry = Array.isArray(packed) ? packed[0] : packed;
+		if (!entry?.filename) throw new Error(`npm pack produced no tarball for ${asset.packageName}`);
+		const files = (entry.files ?? []).map((file) => String(file.path).replaceAll("\\", "/").replace(/^package\//, ""));
+		for (const required of [
+			"package.json", "index.cjs", "runtime-manifest.json", "runtime/niu.exe",
+			"runtime/winuxcmd/usr/bin/winuxcmd.exe", "runtime/bundles/oh-my-niu/bundle.toml",
+			"licenses/NIUBASH.txt", "licenses/RUBASH.txt", "licenses/WINUXCMD.txt",
+		]) {
+			if (!files.includes(required)) throw new Error(`${asset.packageName} tarball is missing ${required}`);
+		}
+		const unpacked = path.join(tmp, "unpacked");
+		fs.mkdirSync(unpacked, { recursive: true });
+		run("tar", ["-xzf", entry.filename, "-C", "unpacked"], { cwd: tmp });
+		const installedRoot = path.join(unpacked, "package");
+		const checked = validateManagedNiubashPackage(installedRoot, asset, { allowExtraRuntimeFiles: false });
+		const require = createRequire(path.join(installedRoot, "package.json"));
+		const exported = require(path.join(installedRoot, "index.cjs"));
+		if (exported.packageName !== asset.packageName || exported.arch !== asset.arch
+			|| exported.shellPath !== path.join(installedRoot, "runtime", "niu.exe")) {
+			throw new Error(`${asset.packageName} has an invalid runtime export`);
+		}
+		const bytes = fs.statSync(path.join(tmp, entry.filename)).size;
+		log(`[piweb] ${entry.filename}: ${checked.files} runtime files, ${(bytes / 1024 / 1024).toFixed(1)} MB.`);
+		return { filename: entry.filename, files, bytes, runtimeFiles: checked.files };
+	} finally {
+		fs.rmSync(tmp, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	}
+}
+
+export function verifyManagedNiubashPackages(root, { log = console.log } = {}) {
+	const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+	const results = [];
+	for (const asset of Object.values(MANAGED_NIUBASH_ASSETS)) {
+		if (manifest.optionalDependencies?.[asset.packageName] !== NIUBASH_DISTRIBUTION_VERSION) {
+			throw new Error(`PiWeb must use exact optional dependency ${asset.packageName}@${NIUBASH_DISTRIBUTION_VERSION}`);
+		}
+		results.push(verifyPackedManagedNiubashPackage(path.join(root, "platform-packages", asset.directory), asset, { log }));
+	}
+	return results;
+}
+
 if (isMainModule(import.meta.url)) {
 	try {
 		verifyPackedPackage(DEFAULT_ROOT);
+		verifyManagedNiubashPackages(DEFAULT_ROOT);
 	} catch (error) {
 		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
 		process.exitCode = 1;

package/src/components/SessionImportSection.tsx

@@ -36,6 +36,8 @@ interface ImportOutcome {
 	reason?: string;
 	messageCount?: number;
 	workspace?: string;
+	/** 已成功导入，但源里的运行时注入/加密内容等无法作为对话还原 */
+	skipped?: string[];
 }
 
 interface ImportReport {
@@ -60,6 +62,8 @@ function dayOf(ms?: number): string {
 	return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
 }
 
+const summaryKey = (summary: Pick<Summary, "source" | "externalId">) => `${summary.source}:${summary.externalId}`;
+
 export function SessionImportSection({ cwd }: { cwd: string }) {
 	const { t } = useI18n();
 	const [summaries, setSummaries] = useState<Summary[]>([]);
@@ -83,9 +87,14 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 				setFailure(json.error || t.toastError);
 				return;
 			}
-			setSummaries(json.data.sessions ?? []);
+			const nextSummaries = (json.data.sessions ?? []) as Summary[];
+			const nextImported = new Set<string>(json.data.imported ?? []);
+			const selectable = new Set(nextSummaries.map(summaryKey));
+			setSummaries(nextSummaries);
 			setErrors(json.data.errors ?? []);
-			setImportedKeys(new Set<string>(json.data.imported ?? []));
+			setImportedKeys(nextImported);
+			// 重新扫描后，源会话可能已经消失或被另一个请求导入；不要留下幽灵选择
+			setSelected((previous) => new Set([...previous].filter((item) => selectable.has(item) && !nextImported.has(item))));
 		} catch (error) {
 			setFailure(error instanceof Error ? error.message : String(error));
 		} finally {
@@ -109,8 +118,6 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 		void scan();
 	}, [scan]);
 
-	const key = (summary: Summary) => `${summary.source}:${summary.externalId}`;
-
 	const groups = useMemo(() => {
 		const bySource = new Map<string, Summary[]>();
 		for (const summary of summaries) {
@@ -120,27 +127,30 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 		}
 		return SOURCE_ORDER.filter((source) => bySource.has(source)).map((source) => {
 			const rows = [...(bySource.get(source) as Summary[])].sort((left, right) => (right.updatedAt ?? right.createdAt ?? 0) - (left.updatedAt ?? left.createdAt ?? 0));
-			return { source, rows, imported: rows.filter((row) => importedKeys.has(key(row))).length };
+			return { source, rows, imported: rows.filter((row) => importedKeys.has(summaryKey(row))).length };
 		});
 	}, [summaries, importedKeys]);
 
 	/**
 	 * 一次只显示一个来源：六个工具各列 15 条就是 90 行，全铺出来既难找也没必要。
-	 * 默认落在第一个有会话的来源上（SOURCE_ORDER 的顺序），用户切换后不被扫描结果重置。
+	 * 首次打开默认落到“最近活动会话”所在的来源；用户切换后保持选择。
+	 * 直接派生有效来源，不用 effect 回填，避免初始化 effect 覆盖用户刚完成的点击。
 	 */
 	const [activeSource, setActiveSource] = useState("");
-	useEffect(() => {
-		if (activeSource && groups.some((group) => group.source === activeSource)) return;
-		setActiveSource(groups[0]?.source ?? "");
-	}, [groups, activeSource]);
-	const activeGroup = groups.find((group) => group.source === activeSource);
+	const defaultSource = groups.reduce<{ source: string; at: number } | null>((latest, group) => {
+		const first = group.rows[0];
+		const at = first?.updatedAt ?? first?.createdAt ?? 0;
+		return !latest || at > latest.at ? { source: group.source, at } : latest;
+	}, null)?.source ?? "";
+	const visibleSource = activeSource && groups.some((group) => group.source === activeSource) ? activeSource : defaultSource;
+	const activeGroup = groups.find((group) => group.source === visibleSource);
 
 	const toggle = (summary: Summary) => {
-		if (importedKeys.has(key(summary))) return;
+		if (importedKeys.has(summaryKey(summary))) return;
 		setSelected((previous) => {
 			const next = new Set(previous);
-			if (next.has(key(summary))) next.delete(key(summary));
-			else next.add(key(summary));
+			if (next.has(summaryKey(summary))) next.delete(summaryKey(summary));
+			else next.add(summaryKey(summary));
 			return next;
 		});
 	};
@@ -149,9 +159,9 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 		setSelected((previous) => {
 			const next = new Set(previous);
 			for (const row of rows) {
-				if (importedKeys.has(key(row))) continue;
-				if (checked) next.add(key(row));
-				else next.delete(key(row));
+				if (importedKeys.has(summaryKey(row))) continue;
+				if (checked) next.add(summaryKey(row));
+				else next.delete(summaryKey(row));
 			}
 			return next;
 		});
@@ -159,7 +169,7 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 
 	const run = async () => {
 		if (!selected.size) return;
-		const items = summaries.filter((summary) => selected.has(key(summary))).map((summary) => ({ source: summary.source, externalId: summary.externalId }));
+		const items = summaries.filter((summary) => selected.has(summaryKey(summary))).map((summary) => ({ source: summary.source, externalId: summary.externalId }));
 		setImporting(true);
 		setFailure(null);
 		setReport(null);
@@ -198,6 +208,7 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 
 	const failures = report?.results.filter((result) => result.status === "failed") ?? [];
 	const skipped = report?.results.filter((result) => result.status === "skipped") ?? [];
+	const importedWithNotes = report?.results.filter((result) => result.status === "imported" && result.skipped?.length) ?? [];
 
 	return (
 		<div className="flex flex-col gap-4" data-testid="session-import">
@@ -277,6 +288,11 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 							{sourceLabel(result.source)} · {result.title || result.externalId} — {result.reason}
 						</div>
 					))}
+					{importedWithNotes.map((result) => (
+						<div key={`note-${result.source}-${result.externalId}`} className="mt-1" style={{ fontSize: 11.5, color: "var(--dsw-label-caption)" }}>
+							{sourceLabel(result.source)} · {result.title || result.externalId} — {result.skipped?.join("；")}
+						</div>
+					))}
 					{failures.map((result) => (
 						<div key={`fail-${result.source}-${result.externalId}`} className="mt-1" style={{ fontSize: 11.5, color: "var(--dsw-danger)" }}>
 							{sourceLabel(result.source)} · {result.title || result.externalId} — {result.reason}
@@ -291,7 +307,7 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 			{groups.length > 0 && (
 				<div className="flex flex-wrap items-center gap-1.5" role="tablist" aria-label={t.importPickSource} data-testid="import-source-tabs">
 					{groups.map((group) => {
-						const active = group.source === activeSource;
+						const active = group.source === visibleSource;
 						return (
 							<button
 								key={group.source}
@@ -332,7 +348,7 @@ export function SessionImportSection({ cwd }: { cwd: string }) {
 					</div>
 					<div className="flex flex-col gap-1.5">
 						{activeGroup.rows.map((row) => {
-							const rowKey = key(row);
+							const rowKey = summaryKey(row);
 							const done = importedKeys.has(rowKey);
 							const checked = selected.has(rowKey);
 							return (

package/src/lib/agent-manager.ts

@@ -35,6 +35,7 @@ import { sanitizeToolOutput } from "./text-sanitize";
 import { BoundaryError } from "./path-security";
 import { estimateTokensOf } from "./process-format";
 import { getPiSettings } from "./pi-settings";
+import { createManagedNiubashTools } from "./managed-niubash";
 import { clampThinkingLevel, getSupportedThinkingLevels } from "@earendil-works/pi-ai";
 import type {
 	AgentCommand,
@@ -799,6 +800,8 @@ export async function ensureSession(m: Managed): Promise<AgentSession> {
 				modelRuntime: await getModelRuntime(),
 				resourceLoader: loader,
 				settingsManager: getSettingsManager(m.cwd),
+				// Windows: 同名 bash 覆盖 SDK 内置工具，指向托管 niubash；其它平台返回 []，走 Pi 默认。
+				customTools: createManagedNiubashTools(m.cwd),
 			});
 			created = session;
 			if (m.disposed) throw new Error("session is disposed");