@rexvane/piweb 0.3.3 → 0.3.5

package/README.md

@@ -14,109 +14,84 @@
 
 ---
 
-**PiWeb** brings a sleek, feature-rich browser interface to the [pi coding agent](https://github.com/earendil-works/pi) with zero modifications to the core Pi engine. Built with Next.js and Tailwind CSS.
+**PiWeb** brings a sleek, feature-rich browser interface to the [pi coding agent](https://github.com/earendil-works/pi) with zero modifications to the core Pi engine. Install with one command, and all your existing pi configuration, sessions, models, skills, and plugins work out of the box.
 
-## Key Features
+## Features
 
-- **Real-Time Streaming**: Full SSE snapshots with ordered deltas, automatic replay via `Last-Event-ID`, real-time thinking process and inline tool execution cards.
-- **Composer & Input**: Image attachments (paste, pick, drag-and-drop), 2-level model selector, model cycling forward/backward, queue management (steering / follow-up), and `/` slash commands.
-- **Decoupled Workspaces & Sessions**: Group sessions by workspace folders, native system folder picker on Windows, rename/delete workspaces with centered confirmation modals, preserve sessions under "Ungrouped", and maintain empty workspaces independently.
-- **Session Exploration**: Session tree branch visualization & navigation, user message draft recovery, export session logs to JSONL / HTML, and trajectory views.
-- **Comprehensive Settings**:
-  - **General**: Tool presets (Read Only / Workspace Write / Full Access), language (zh/en), appearance, enter key behaviors, and auto-compact.
-  - **Models**: Manage 30+ built-in providers, custom providers in `models.json`, and OAuth logins (Claude, Codex, Copilot, etc.).
-  - **Plugins & Skills**: View and manage extensions and skills directly via Pi's built-in package manager.
-- **Security & Sandboxing**: Optional HTTP Basic Auth via `PI_WEB_PASSWORD`, origin validation on write actions, and strict path boundary checks.
+### Real-Time Streaming Chat
 
-## Quick Start
+Full SSE snapshots with ordered deltas and automatic replay via `Last-Event-ID`. The thinking process and inline tool execution cards stream live.
 
-**Prerequisites**: Node.js ≥ 22.19.0 (Node.js 24 recommended) and Git for repository and growth-history features.
+<p align="center"><img src="assets/showcase.png" alt="Streaming chat with tool cards" width="840" /></p>
 
-### Install from npm (recommended)
+### Workspaces & Sessions
 
-```bash
-npm install -g @rexvane/piweb
-piweb
-```
+Sessions grouped by project folder, with a native folder picker (Windows / macOS / Linux), rename and archive. Session tree branches, draft recovery, and JSONL / HTML export.
 
-A global install prepares the production bundle once (during install, or on the first run if the script was skipped) and then starts in production mode. If that build fails, `piweb` reports it instead of falling back to a development server that cannot work without dev dependencies; retry with `npm rebuild -g @rexvane/piweb`. The package registers only the `piweb` command, so it never conflicts with the official `pi` CLI (`npm i -g @earendil-works/pi-coding-agent`) if you have both.
+### Project Growth Tree
 
-### Inside this repository
+Every step the agent takes on your codebase is snapshotted: navigate the timeline round by round, see added/modified/deleted files, and open line-level diffs for any file at any step — even if the workspace has no git history of its own.
 
-```bash
-npm install
-npm run dev        # development server with hot reload
-```
+### Context Meter
 
-Or run a production build locally:
+Click the ring next to the composer to see the context window broken down into 13 segments — System Prompt, System/Custom Tools, Memory (AGENTS.md), Skills, messages by type, Compacted Data, Auto-Compact Buffer, and Free Space.
 
-```bash
-npm install
-npm run build      # or: npm run build:release (staged, does not touch a running build)
-npm start          # serves on http://127.0.0.1:30141 (auto-increments if busy)
-```
+### Model & Provider Management
 
-### CLI Options (`bin/piweb.js`)
+30+ built-in providers, OAuth logins (Claude, Codex, Copilot, etc.), custom providers written to `models.json`, one-click model discovery, and a placeholder key auto-filled for local gateways like Ollama.
 
-```
--p, --port <port>      Listen port (default 30141, env PORT; auto-increments if in use)
--H, --hostname <host>  Bind address (default 127.0.0.1, env PI_WEB_HOSTNAME)
---dev                  Start in development mode (`next dev`; env PI_WEB_DEV=1; also used when no production build exists)
---no-open              Do not automatically open browser (env PI_WEB_NO_OPEN=1)
--h, --help             Show help
-```
+### Plugins & Skills
+
+Install, update, and uninstall pi packages directly from the UI. Enable/disable or delete skills; every change applies to running sessions immediately.
 
-Environment variables: `PI_WEB_PASSWORD` enables a browser login session and HTTP Basic Auth for API clients (user `pi`). It is **required** for any non-loopback production bind address. Development mode is loopback-only, even with a password; if no production build exists, an external bind fails rather than falling back to an exposed development server. Use HTTPS or a trusted VPN for remote access. `PI_WEB_EDITOR` overrides the editor used by "open in editor" (default `code`). Without a password, PiWeb only accepts requests whose `Host` is loopback.
+### Security
 
-`GET /api/health` exposes only a fixed service identifier for credential-free startup probes. Runtime versions are available from the authenticated `/api/version` endpoint. Tool presets limit the tools offered to the agent; they are not an operating-system sandbox, and installed extensions run with the server process's permissions.
+Optional login via `PI_WEB_PASSWORD` (required for non-loopback binds), origin validation on write actions, strict path boundary checks, and tool presets (Read Only / Workspace Write / Full Access).
 
-Model catalog discovery blocks loopback, private, and reserved network addresses by default. If you intentionally use a local model gateway, set `PI_WEB_ALLOW_PRIVATE_MODEL_DISCOVERY=1` before starting PiWeb. This relaxes the discovery endpoint only; use it only on a trusted PiWeb instance.
+## Usage
 
-### Development
+### Install
 
 ```bash
-npm run dev        # Run Next.js in development mode
-npm run typecheck  # TypeScript check
-npm test           # Service, protocol and component regressions
-npm run check      # Full check (types + tests + build)
-npm run build:release # Validate and stage a production build without replacing the running build
+npm install -g @rexvane/piweb
+piweb
 ```
 
-## Status and known limitations (2026-09-14)
-
-The audit follow-up is merged into this branch and has been through an isolated release plus a local production deployment. It covers the production login build, upload integrity through the Next.js proxy, per-session extension isolation and tool-policy reloads, lossless model/settings writes, composer and pending-extension-UI lifecycle, Git/Growth/diff correctness, and isolated release preparation.
+The package registers only the `piweb` command, so it never conflicts with the official `pi` CLI. Requires Node.js ≥ 22.19.0 (24 recommended); Git is needed for growth-history features.
 
-The latest local validation passed TypeScript checking, **355 tests across 52 files** (one additional test skipped), `npm run build`, and `git diff --check`. The skipped test requires Windows symlink privileges or Developer Mode.
+### Update
 
-Known limitations: saving the model configuration normalizes it to plain JSON (comments are not preserved, data is); updates replace dependencies in place during a maintenance window rather than being zero-downtime; a custom tool allowlist lives only for the session lifetime; third-party extension module globals are not isolated.
+```bash
+npm update -g @rexvane/piweb
+```
 
-## Production builds and updates
+Or install a specific version: `npm install -g @rexvane/piweb@0.3.4`.
 
-Use `npm run build:release` when preparing a build while PiWeb is running. It validates types and tests, builds into a fresh `.next-releases/<id>` directory, and only then publishes the build selection for the next start. It does not restart the server or replace the output used by an existing process. `npm start` uses the last successfully prepared release; after a failed or interrupted release attempt it reports the problem instead of silently serving a stale build. Correct the error and run `npm run build:release` again to recover.
+### Uninstall
 
-The in-app updater uses the same validation path. Source files and npm dependencies are still updated in the installation directory, so perform updates during a maintenance window with no running agent turns. This is not a fully isolated zero-downtime deployment system. Restart PiWeb manually after a successful update; running processes do not automatically switch to the new build.
+```bash
+npm uninstall -g @rexvane/piweb
+```
 
-CI runs the full checks on Linux and Windows with Node.js 22.19.0 and 24. Ordinary `npm run build` still uses `.next`, so do not run it against an installation whose active production process is using that directory.
+This removes PiWeb only — your pi data lives in `~/.pi/agent/` and is left untouched.
 
-## Architecture
+### Run
 
+```bash
+piweb                    # http://127.0.0.1:30141 (auto-increments if busy)
+piweb -p 30143 --no-open # custom port, don't open the browser
+piweb -H 0.0.0.0         # LAN access (requires PI_WEB_PASSWORD)
 ```
-Browser (React 19 + Tailwind, src/components)
-   │  REST commands (POST /api/agent/[id]) + SSE streams (GET /api/agent/[id]/events)
-   ▼
-Next.js Server (src/app/api, src/lib)
-   ├─ agent-manager    AgentSession pool: lazy startup, event translation, idle eviction
-   ├─ session-reader   Direct read ~/.pi/agent/sessions/**.jsonl (cold render without running agent)
-   ├─ trajectory       Trajectory ledger + server-side timing (TTFT / decode)
-   ├─ skills/prompts   Skills & Prompt template discovery + frontmatter toggles
-   ├─ models-service   Model catalogue, auth, OAuth bridge & models.json
-   ├─ security-service Tool presets & project trust
-   ├─ plugins-service  Pi package management (DefaultPackageManager) & extension registry
-   ├─ workspace-store  Persistent workspaces registry & native folder picker
-   ▼
-@earendil-works/pi-coding-agent  (Official Pi SDK, zero engine modifications)
-```
+
+| Option | Description |
+| --- | --- |
+| `-p, --port <port>` | Listen port (default 30141, env `PORT`) |
+| `-H, --hostname <host>` | Bind address (default 127.0.0.1, env `PI_WEB_HOSTNAME`) |
+| `--dev` | Development mode |
+| `--no-open` | Do not auto-open the browser |
+
+Set `PI_WEB_PASSWORD` to enable the login page and HTTP Basic Auth (user `pi`). Remote access over plain HTTP is not recommended; use HTTPS or a trusted VPN.
 
 ## License
 
-[MIT License](LICENSE)
+[MIT](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rexvane/piweb",
-	"version": "0.3.3",
+	"version": "0.3.5",
 	"license": "MIT",
 	"type": "module",
 	"description": "Modern web UI for the pi coding agent, driven by the official pi SDK without modifying pi",

package/scripts/build-output.mjs

@@ -54,8 +54,9 @@ export function assertInstallation(root) {
 	const realRoot = fs.realpathSync(root);
 	const manifestPath = assertLocalPath(realRoot, "package.json");
 	const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-	// Accept the historical name so installations made before the npm rename keep working.
-	if (manifest?.name !== "piweb" && manifest?.name !== "pi-web") throw new Error(`refusing to update outside the PiWeb installation: ${realRoot}`);
+	// Accept the historical names so installations made before the npm rename keep working.
+	const validNames = ["piweb", "pi-web", "@rexvane/piweb"];
+	if (!validNames.includes(manifest?.name)) throw new Error(`refusing to update outside the PiWeb installation: ${realRoot}`);
 	return realRoot;
 }
 

package/scripts/install-build.mjs

@@ -9,6 +9,7 @@
  * Repository checkouts always have dev dependencies and keep `npm run dev`.
  */
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { createRequire } from "node:module";
 import { spawnSync } from "node:child_process";
@@ -65,15 +66,64 @@ export function resolveNextBin(root) {
  * neither compiled nor mapped through the `@/*` path alias. Build in a staging
  * directory outside `node_modules` (same drive, so the dependency links resolve)
  * and copy the finished output back into the package.
+ *
+ * The staging directory must NOT sit inside any `node_modules`: for a global
+ * install like ~/.local/lib/node_modules/@rexvane/piweb, the grandparent IS
+ * node_modules, and Next would exclude the staged sources exactly the same way.
+ * Walk up until we are outside every node_modules segment; give up and use the
+ * system temp dir (cross-device copy is still correct, just slower).
  */
+function stagingParent(root) {
+	// Split on BOTH separators: a win32 Node can see POSIX paths (and vice versa)
+	// when the package is installed through a compatibility layer or the test
+	// suite simulates foreign layouts.
+	const segments = path.dirname(root).split(/[\\/]/).filter(Boolean);
+	// Drop trailing path components while the path still contains a node_modules segment.
+	while (segments.length > 1 && segments.includes("node_modules")) {
+		segments.pop();
+	}
+	const candidate = segments.length ? path.resolve(`/${segments.join(path.sep)}`) : path.sep;
+	try {
+		fs.mkdirSync(candidate, { recursive: true });
+		fs.accessSync(candidate, fs.constants.W_OK);
+		return candidate;
+	} catch {
+		return os.tmpdir();
+	}
+}
+
+/** Staging directory must live outside EVERY node_modules on the way up (Next excludes those paths). */
+export function assertStagingOutsideNodeModules(root) {
+	const parent = stagingParent(root);
+	if (parent.split(/[\\/]/).includes("node_modules")) {
+		throw new Error(`staging parent is inside node_modules: ${parent}`);
+	}
+	return parent;
+}
+
+function tryLinkDependencies(root, staging) {
+	try {
+		fs.symlinkSync(path.join(root, "node_modules"), path.join(staging, "node_modules"), "junction");
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 function buildInStaging(root, nextBin, env, log, warn) {
-	const parent = path.dirname(path.dirname(root));
 	let staging;
 	try {
-		staging = fs.mkdtempSync(path.join(parent, ".piweb-build-"));
+		staging = fs.mkdtempSync(path.join(stagingParent(root), ".piweb-build-"));
 	} catch {
 		staging = fs.mkdtempSync(path.join(os.tmpdir(), "piweb-build-"));
 	}
+	// junction 不能跨卷：staging 与包不同盘时链接会失败，退回系统临时目录再试一次
+	if (!tryLinkDependencies(root, staging) && path.parse(staging).root !== path.parse(os.tmpdir()).root) {
+		try {
+			fs.rmSync(staging, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+		} catch { /* proceed to the tmpdir attempt */ }
+		staging = fs.mkdtempSync(path.join(os.tmpdir(), "piweb-build-"));
+	}
 	try {
 		for (const entry of ["src", "public", "assets", "scripts", "bin"]) {
 			const from = path.join(root, entry);
@@ -83,10 +133,8 @@ function buildInStaging(root, nextBin, env, log, warn) {
 			const from = path.join(root, file);
 			if (fs.existsSync(from)) fs.copyFileSync(from, path.join(staging, file));
 		}
-		try {
-			fs.symlinkSync(path.join(root, "node_modules"), path.join(staging, "node_modules"), "junction");
-		} catch (error) {
-			warn(`[piweb] Could not link dependencies into the staging build: ${error.message}`);
+		if (!tryLinkDependencies(root, staging)) {
+			warn("[piweb] Could not link dependencies into the staging build (junction unavailable).");
 			return false;
 		}
 		log(`[piweb] Building in ${staging} ...`);

package/src/app/api/models/route.ts

@@ -72,6 +72,7 @@ export async function POST(req: Request) {
 			revision?: string;
 			text?: string;
 			force?: boolean;
+			allowPrivate?: boolean;
 		};
 		if (body.action === "setKey") {
 			if (!body.providerId || !body.apiKey) return NextResponse.json({ success: false, error: "missing fields" }, { status: 400 });
@@ -93,7 +94,7 @@ export async function POST(req: Request) {
 		}
 		if (body.action === "discoverModels") {
 			if (!body.baseUrl) return NextResponse.json({ success: false, error: "missing baseUrl" }, { status: 400 });
-			const models = await discoverModels({ baseUrl: body.baseUrl, api: body.api, apiKey: body.apiKey, providerId: body.providerId });
+			const models = await discoverModels({ baseUrl: body.baseUrl, api: body.api, apiKey: body.apiKey, providerId: body.providerId, allowPrivate: body.allowPrivate === true });
 			return NextResponse.json({ success: true, data: { models } });
 		}
 		if (body.action === "providerUsage") {

package/src/app/api/skills/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { listSkills, readSkillFile, setSkillDisabled } from "@/lib/skills-service";
+import { deleteSkill, listSkills, readSkillFile, setSkillDisabled } from "@/lib/skills-service";
 import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
 
 export const dynamic = "force-dynamic";
@@ -17,7 +17,7 @@ export async function GET(req: Request) {
 
 export async function POST(req: Request) {
 	try {
-		const body = (await req.json()) as { action: "toggle" | "read"; filePath?: string; disabled?: boolean; cwd?: string };
+		const body = (await req.json()) as { action: "toggle" | "read" | "delete"; filePath?: string; disabled?: boolean; cwd?: string };
 		const cwd = await resolveWorkspacePath(body.cwd || process.cwd());
 		if (body.action === "toggle") {
 			if (!body.filePath || typeof body.disabled !== "boolean")
@@ -29,6 +29,11 @@ export async function POST(req: Request) {
 			if (!body.filePath) return NextResponse.json({ success: false, error: "missing filePath" }, { status: 400 });
 			return NextResponse.json({ success: true, data: { content: await readSkillFile(body.filePath, cwd) } });
 		}
+		if (body.action === "delete") {
+			if (!body.filePath) return NextResponse.json({ success: false, error: "missing filePath" }, { status: 400 });
+			const r = await deleteSkill(body.filePath, cwd);
+			return NextResponse.json({ success: true, data: r });
+		}
 		return NextResponse.json({ success: false, error: "unknown action" }, { status: 400 });
 	} catch (error) {
 		return NextResponse.json(

package/src/components/AppShell.tsx

@@ -201,11 +201,17 @@ export function AppShell() {
 	}, [currentPath]);
 
 	// 已知工作区列表（给 Hero 建议）；启动不预选任何工作区，
-	// 未选择时输入框仍可用，发送会提示先选择工作区
-	const knownCwds = useMemo(
-		() => Array.from(new Set([...addedWorkspaces, ...sessions.map((s) => s.cwd)])).filter(Boolean),
-		[addedWorkspaces, sessions],
-	);
+	// 未选择时输入框仍可用，发送会提示先选择工作区。
+	// 已删除工作区要过滤（与会话栏分组同口径）：否则它下面残留的会话 cwd
+	// 会把刚删掉的工作区重新喂回顶部下拉。
+	const knownCwds = useMemo(() => {
+		const removed = new Set(removedWorkspaces.map((w) => w.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase()));
+		const keep = (cwd: string) => {
+			const norm = cwd.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+			return Boolean(norm) && !removed.has(norm);
+		};
+		return Array.from(new Set([...addedWorkspaces, ...sessions.map((s) => s.cwd)].filter(keep)));
+	}, [addedWorkspaces, sessions, removedWorkspaces]);
 
 	// 模型目录派生值：数百个模型对象的映射只在目录变化时重算，
 	// 不能跟着每次 token 增量 / 3 秒轮询重跑（usePiWeb 的 setState 都会触发本组件渲染）
@@ -825,7 +831,7 @@ export function AppShell() {
 											contextPercent={snapshot?.contextUsage?.percent ?? null}
 											contextTokens={snapshot?.contextUsage?.tokens ?? null}
 											contextWindow={snapshot?.contextUsage?.contextWindow ?? null}
-											contextSource={{ systemChars: contextSystemChars, messages: state.messages }}
+											contextSource={{ systemChars: contextSystemChars, messages: state.messages, breakdown: snapshot?.contextBreakdown }}
 											contextVisible={(snapshot?.messages?.length ?? 0) > 0}
 											model={snapshot?.model}
 											thinkingLevel={snapshot?.thinkingLevel}

package/src/components/ChatInput.tsx

@@ -84,7 +84,11 @@ export function ChatInput({
 	contextTokens: number | null;
 	contextWindow: number | null;
 	/** 上下文分段数据源：ContextMeter 弹窗打开时才做字符统计 */
-	contextSource?: { systemChars: number; messages: { content: Array<{ type: string; text?: string; thinking?: string }> }[] };
+	contextSource?: {
+		systemChars: number;
+		messages: { role?: string; content: Array<{ type: string; text?: string; thinking?: string }> }[];
+		breakdown?: import("@/lib/types").ContextBreakdown;
+	};
 	/** 还没有对话时隐藏上下文计量 */
 	contextVisible?: boolean;
 	model?: { provider: string; id: string; name: string };

package/src/components/ChatWindow.tsx

@@ -35,8 +35,10 @@ import type { ContextResource, TrajEntry, TrajTokens, WebContent, WebMessage, We
 import {
 	classifyModelError,
 	cleanCommand,
+	deleteTargetOf,
 	displayToolName,
 	firstSentence,
+	isDeleteCommand,
 	langOfPath,
 	previewSide,
 	relativizeInText,
@@ -457,10 +459,10 @@ const ToolStep = memo(function ToolStep({
 		if (kind !== "write" || !state || state.state !== "done" || state.isError) return null;
 		const parsed = parseUnifiedDiff(state.patch || output);
 		if (parsed) return parsed;
-		// pi 的 write 工具不带 patch：新文件按带行号的正文展示（中性色，不标 +）
+		// pi 的 write 工具不带 patch：新文件按新增行展示（全绿 +），与 edit 的 diff 口径一致
 		if (isWriteTool) {
 			const content = str((args as { content?: unknown } | undefined)?.content);
-			if (content) return content.replace(/\r/g, "").replace(/\n$/, "").split("\n").map((text, i): DiffLine => ({ kind: "ctx", old: i + 1, new: i + 1, text }));
+			if (content) return content.replace(/\r/g, "").replace(/\n$/, "").split("\n").map((text, i): DiffLine => ({ kind: "add", new: i + 1, text }));
 		}
 		return null;
 	}, [args, isWriteTool, kind, output, state]);
@@ -478,6 +480,8 @@ const ToolStep = memo(function ToolStep({
 		return str(a?.path ?? a?.file_path) ?? "";
 	})();
 	const fullCommand = kind === "cmd" ? (str((args as Record<string, unknown>)?.command) ?? str((args as Record<string, unknown>)?.cmd) ?? str((args as Record<string, unknown>)?.script) ?? "") : "";
+	// 删除文件的命令：完成后给红色标记（内容级 diff 不强求）
+	const deletedTarget = kind === "cmd" && !running && !failed && isDeleteCommand(fullCommand) ? deleteTargetOf(fullCommand) : "";
 	const preview = state ? toolPreview(kind, state, tt, cwd) : { lines: [], hidden: 0 };
 	const hasDiff = Boolean(diff && diff.length) && !failed;
 	const hasOutput = Boolean(output || state?.encodingLoss);
@@ -488,7 +492,7 @@ const ToolStep = memo(function ToolStep({
 	const diffHidden = diff && diffLines && !open ? diff.length - diffLines.length : 0;
 	const diffStat = hasDiff && diff
 		? isWriteTool && !state?.patch
-			? t.resultWrote.replace("{n}", String(diff.length))
+			? t.diffSummary.replace("{add}", String(diff.length)).replace("{del}", "0")
 			: t.diffSummary.replace("{add}", String(diff.filter((l) => l.kind === "add").length)).replace("{del}", String(diff.filter((l) => l.kind === "del").length))
 		: "";
 	const toggle = () => setOpen((o) => !o);
@@ -508,6 +512,11 @@ const ToolStep = memo(function ToolStep({
 					<span className="pw-arg" style={{ color: "var(--dsw-label-caption)" }}>{displayToolName(name)}</span>
 				)}
 				{diffStat && <span className="pw-meta">{diffStat}</span>}
+				{deletedTarget && (
+					<span className="pw-meta" style={{ color: "var(--dsw-danger)" }} title={deletedTarget}>
+						{t.deletedFile.replace("{path}", relativizeInText(deletedTarget, cwd || ""))}
+					</span>
+				)}
 				{summary.scriptLines > 1 && <span className="pw-meta">{t.commandLines.replace("{n}", String(summary.scriptLines))}</span>}
 				{running && <span className="pw-meta">{fmtSpan(elapsed)}</span>}
 				{!running && duration >= 1000 && <span className="pw-meta">{fmtSpan(duration)}</span>}
@@ -638,6 +647,7 @@ const ERROR_HINT_KEY: Record<ModelErrorKind, string> = {
 	timeout: "modelErrorTimeout",
 	server: "modelErrorServer",
 	network: "modelErrorNetwork",
+	moderation: "modelErrorModeration",
 };
 
 function ErrorStep({ message, count, model }: { message: string; count: number; model?: string }) {

package/src/components/ContextMeter.tsx

@@ -1,18 +1,31 @@
 "use client";
 
 /**
- * 上下文占用（对齐 dsh ContextMeter）：
- * 圆环常驻按钮 + 弹窗显示「百分比 / ~已用 / 窗口」与分段占用条
- * （系统提示词 / 对话消息 / 工具，mac 磁盘存储条式的多色分段）。
+ * 上下文占用：
+ * 圆环常驻按钮 + 弹窗显示「百分比 / ~已用 / 窗口」与 13 类分段占用条
+ * （mac 磁盘存储条式的多色分段，含 Free Space 段）。
+ * 分段口径：全部为字符/4 启发式估算（与 SDK estimateTokens 一致），
+ * 服务端分项（System Prompt / Tools / Memory / Skills / Compacted / Buffer）来自快照，
+ * 消息分项（User / Agent Text / Thinking / Tool Call / Tool Output）弹窗打开时前端统计。
  * 无对话时不渲染（由父组件经 contextVisible 控制）。
  */
 import { useEffect, useMemo, useRef, useState } from "react";
 import { useI18n } from "@/i18n";
+import { classifyMessageChars } from "@/lib/process-format";
+import type { ContextBreakdown } from "@/lib/types";
 
 function fmtTok(n: number): string {
 	return n >= 1000 ? `${(n / 1000).toFixed(1)}K` : String(Math.round(n));
 }
 
+/** 13 类分段的定义（顺序即渲染顺序） */
+interface Segment {
+	key: string;
+	label: string;
+	tokens: number;
+	color: string;
+}
+
 export function ContextMeter({
 	percent,
 	tokens,
@@ -22,8 +35,12 @@ export function ContextMeter({
 	percent: number | null;
 	tokens: number | null;
 	contextWindow: number | null;
-	/** 分段数据源：字符统计只在弹窗打开时执行（流式期间消息每 token 都变，不能常驻扫描） */
-	source?: { systemChars: number; messages: { content: Array<{ type: string; text?: string; thinking?: string }> }[] };
+	/** 分段数据源：消息字符统计只在弹窗打开时执行（流式期间消息每 token 都变，不能常驻扫描） */
+	source?: {
+		systemChars: number;
+		messages: { role?: string; content: Array<{ type: string; text?: string; thinking?: string; arguments?: unknown }> }[];
+		breakdown?: ContextBreakdown;
+	};
 }) {
 	const [open, setOpen] = useState(false);
 	const ref = useRef<HTMLDivElement>(null);
@@ -38,16 +55,21 @@ export function ContextMeter({
 		return () => document.removeEventListener("mousedown", h);
 	}, [open]);
 
-	// 分段估算只在弹窗打开时计算（≈3.5 字符/token）
-	const segments = useMemo(() => {
-		if (!open) return { system: 0, messages: 0 };
-		let chars = 0;
-		for (const message of source?.messages ?? []) {
-			for (const content of message.content) {
-				chars += content.type === "text" ? (content.text?.length ?? 0) : content.type === "thinking" ? (content.thinking?.length ?? 0) : 0;
-			}
-		}
-		return { system: Math.round((source?.systemChars ?? 0) / 3.5), messages: Math.round(chars / 3.5) };
+	const used = tokens ?? 0;
+	const window_ = contextWindow ?? 0;
+	const b = source?.breakdown;
+
+	// 消息分项只在弹窗打开时统计（≈4 字符/token，与 SDK 一致）
+	const messageSegments = useMemo(() => {
+		if (!open) return { user: 0, agentText: 0, agentThinking: 0, agentToolCall: 0, toolOutput: 0 };
+		const chars = classifyMessageChars(source?.messages ?? []);
+		return {
+			user: Math.max(0, Math.round(chars.user / 4)),
+			agentText: Math.max(0, Math.round(chars.agentText / 4)),
+			agentThinking: Math.max(0, Math.round(chars.agentThinking / 4)),
+			agentToolCall: Math.max(0, Math.round(chars.agentToolCall / 4)),
+			toolOutput: Math.max(0, Math.round(chars.toolOutput / 4)),
+		};
 	}, [open, source]);
 
 	const p = percent ?? 0;
@@ -55,15 +77,34 @@ export function ContextMeter({
 	const r = 5.5;
 	const c = 2 * Math.PI * r;
 	const shown = Math.max(0, Math.min(100, p));
-	const used = tokens ?? 0;
-	const window_ = contextWindow ?? 0;
 
-	// 分段估算：系统提示词 / 对话消息；工具与基底取余量，保证各段之和等于总量
-	const systemTokens = Math.max(0, Math.round(segments?.system ?? 0));
-	const messageTokens = Math.max(0, Math.round(segments?.messages ?? 0));
-	const toolTokens = Math.max(0, used - systemTokens - messageTokens);
-	const segTotal = systemTokens + messageTokens + toolTokens || 1;
-	const bar = (n: number) => `${(n / segTotal) * 100}%`;
+	const segments: Segment[] = b
+		? [
+				{ key: "systemPrompt", label: t.contextSystemPrompt, tokens: b.systemPrompt, color: "var(--dsw-accent)" },
+				{ key: "systemTools", label: t.contextSystemTools, tokens: b.systemTools, color: "#8B7EC8" },
+				{ key: "customTools", label: t.contextCustomTools, tokens: b.customTools, color: "#B39DDB" },
+				{ key: "memory", label: t.contextMemory, tokens: b.memory, color: "#5FA8D3" },
+				{ key: "skills", label: t.contextSkills, tokens: b.skills, color: "#4FB286" },
+				{ key: "user", label: t.contextUserMessages, tokens: messageSegments.user, color: "var(--dsw-success)" },
+				{ key: "agentText", label: t.contextAgentText, tokens: messageSegments.agentText, color: "#7BC96F" },
+				{ key: "agentThinking", label: t.contextAgentThinking, tokens: messageSegments.agentThinking, color: "#C9A66B" },
+				{ key: "agentToolCall", label: t.contextAgentToolCall, tokens: messageSegments.agentToolCall, color: "#D3A15F" },
+				{ key: "toolOutput", label: t.contextToolOutput, tokens: messageSegments.toolOutput, color: "var(--dsw-warn)" },
+				{ key: "compacted", label: t.contextCompacted, tokens: b.compacted, color: "#A05A78" },
+				{ key: "buffer", label: t.contextAutoCompactBuffer, tokens: b.autoCompactBuffer, color: "var(--dsw-border-l3)" },
+			]
+		: // 服务端分项缺失（旧快照）：退回旧三段口径
+			[
+				{ key: "system", label: t.contextSystem, tokens: Math.max(0, Math.round((source?.systemChars ?? 0) / 4)), color: "var(--dsw-accent)" },
+				{ key: "messages", label: t.contextMessages, tokens: messageSegments.user + messageSegments.agentText + messageSegments.agentThinking, color: "var(--dsw-success)" },
+				{ key: "tools", label: t.contextTools, tokens: Math.max(0, used - Math.max(0, Math.round((source?.systemChars ?? 0) / 4)) - messageSegments.user - messageSegments.agentText - messageSegments.agentThinking), color: "var(--dsw-warn)" },
+			];
+
+	// Free Space：窗口余量（窗口未知则不显示）；分段条不归一化到已用之和
+	const usedSum = segments.reduce((sum, s) => sum + s.tokens, 0);
+	const free = window_ > 0 ? Math.max(0, window_ - usedSum) : 0;
+	const barTotal = window_ > 0 ? window_ : usedSum || 1;
+	const bar = (n: number) => `${(n / barTotal) * 100}%`;
 
 	return (
 		<div ref={ref} className="relative">
@@ -98,18 +139,20 @@ export function ContextMeter({
 						{tokens === null ? "—" : `~${fmtTok(used)}`} / {window_ > 0 ? fmtTok(window_) : "—"}
 					</div>
 
-					{/* 分段占用条（mac 磁盘存储条式多色分段） */}
-					{(systemTokens > 0 || messageTokens > 0 || toolTokens > 0) && (
+					{/* 分段占用条（mac 磁盘存储条式多色分段，含 Free Space） */}
+					{usedSum > 0 && (
 						<div className="mt-3 flex h-2 w-full overflow-hidden rounded-full" style={{ background: "var(--dsw-selector)" }} aria-hidden>
-							{systemTokens > 0 && <span style={{ width: bar(systemTokens), background: "var(--dsw-accent)" }} />}
-							{messageTokens > 0 && <span style={{ width: bar(messageTokens), background: "var(--dsw-success)" }} />}
-							{toolTokens > 0 && <span style={{ width: bar(toolTokens), background: "var(--dsw-warn)" }} />}
+							{segments.filter((s) => s.tokens > 0).map((s) => (
+								<span key={s.key} style={{ width: bar(s.tokens), background: s.color }} />
+							))}
+							{free > 0 && <span style={{ width: bar(free), background: "transparent" }} />}
 						</div>
 					)}
 					<div className="mt-2 flex flex-col gap-1" style={{ color: "var(--dsw-label-tertiary)" }}>
-						<SegmentRow label={t.contextSystem} tokens={systemTokens} color="var(--dsw-accent)" />
-						<SegmentRow label={t.contextMessages} tokens={messageTokens} color="var(--dsw-success)" />
-						<SegmentRow label={t.contextTools} tokens={toolTokens} color="var(--dsw-warn)" />
+						{segments.filter((s) => s.tokens > 0).map((s) => (
+							<SegmentRow key={s.key} label={s.label} tokens={s.tokens} color={s.color} />
+						))}
+						{window_ > 0 && <SegmentRow label={t.contextFreeSpace} tokens={free} color="var(--dsw-selector)" />}
 					</div>
 				</div>
 			)}

package/src/components/ProjectPanel.tsx

@@ -161,6 +161,12 @@ export function ProjectPanel({
 					<IconCloseOutline14 size={13} />
 				</button>
 			</div>
+			{/* 生长快照不可用（找不到 git 等）：明确提示 + 已退化为当前目录结构 */}
+			{cwd && hasSession && !growth.available && !growth.loading && (
+				<div className="mx-3 mb-2 rounded-lg px-2 py-1" style={{ fontSize: 11.5, color: "var(--dsw-warn)", background: "var(--dsw-hover)" }} role="status">
+					{t.growthUnavailableFallback}
+				</div>
+			)}
 			{gitError && (
 				<div className="mx-3 mb-2 rounded-lg px-2 py-1" style={{ fontSize: 11.5, color: "var(--dsw-danger)" }} title={gitError} role="alert" data-testid="growth-git-error">
 					{t.gitStatusUnknown}

package/src/components/ProviderSetupModal.module.css

@@ -271,6 +271,24 @@
 	opacity: 0.48;
 }
 
+.discoverControls {
+	display: flex;
+	flex: none;
+	align-items: center;
+	gap: 12px;
+}
+
+.allowPrivate {
+	display: flex;
+	align-items: center;
+	gap: 4px;
+	font-size: 11.5px;
+	color: var(--dsw-label-caption);
+	cursor: pointer;
+	user-select: none;
+	white-space: nowrap;
+}
+
 .modelEmpty {
 	margin-top: 13px;
 	padding: 17px;