@spzxg/cli-ui 0.6.11 → 0.6.13

package/dist/cli-ui.js

@@ -1,4 +1,4 @@
-import { C as a, b as i, d as r, e as t, f as o, h as C, i as l, j as n, k as m, m as d, l as u, n as w, o as B, p as f } from "./cli-ui-embed-CbxWozLO.js";
+import { C as a, b as i, d as r, e as t, f as o, h as C, i as l, j as n, k as m, m as d, l as u, n as w, o as B, p as f } from "./cli-ui-embed-CXaGT9e4.js";
 export {
   a as CliBoard,
   i as CliBrowserView,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spzxg/cli-ui",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "type": "module",
   "description": "相互联动的 CliMsgList、CliChat、CliBoard，支持任务中枢和完整 Operator 工作区。",
   "main": "src/index.ts",

package/src/board/CliBoard.tsx

@@ -101,7 +101,7 @@ export interface CliBoardProps extends CliStoreOptions, WorkspaceHandlers {
    * 缺省和 quoteToChat 一样。
    */
   autoQuoteOpenFile?: boolean;
-  /** 给了就在页签栏右侧显示「隐藏面板」按钮。 */
+  /** 保留旧宿主兼容；看板不再显示内置收起按钮。 */
   onCollapse?: () => void;
   /**
    * 收起状态：只显示一条窄栏（点一下展开）。收起时仍然接对话里的打开请求——接到就记下要打开的东西并调 onExpand，
@@ -125,7 +125,7 @@ export function CliBoard(props: CliBoardProps) {
 
 interface OpenFile { name?: string; reloadKey?:number; path: string; size?: number; mtime?: number; version: number }
 
-function BoardInner({ jobId: jobIdProp, taskId: taskIdProp, tabs, availableTabs, defaultTab, readOnly, fileActions, acceptOpen = true, quoteToChat, autoQuoteOpenFile, extraTabs, onCollapse, collapsed, onExpand, onNavigate, onEvent, onFilesChange, onFilesWatch, onBoardContextChange, watchFiles = true, fileWatchIntervalMs, theme = "light", className, style, inProvider, inlineLayout, inlineOwner, visible: visibilityOverride, onQuoteToChat }: CliBoardProps & { inProvider: boolean }) {
+function BoardInner({ jobId: jobIdProp, taskId: taskIdProp, tabs, availableTabs, defaultTab, readOnly, fileActions, acceptOpen = true, quoteToChat, autoQuoteOpenFile, extraTabs, collapsed, onExpand, onNavigate, onEvent, onFilesChange, onFilesWatch, onBoardContextChange, watchFiles = true, fileWatchIntervalMs, theme = "light", className, style, inProvider, inlineLayout, inlineOwner, visible: visibilityOverride, onQuoteToChat }: CliBoardProps & { inProvider: boolean }) {
   useComponentEvents(onEvent, {onFilesChange,onFilesWatch,onBoardContextChange}, inProvider);
   const store = useCliStore();
   const backend = store.client.board;
@@ -471,7 +471,6 @@ function BoardInner({ jobId: jobIdProp, taskId: taskIdProp, tabs, availableTabs,
         {info?.dispatched && !file && <button className="rail-collapse" onClick={refreshAll} title={running ? "运行中 · 本轮结束后同步，点击立即检查" : "刷新"}>
           <span className={`cli-sync-dot ${running ? "on" : ""}`} />↻
         </button>}
-        {onCollapse && <button className="rail-collapse" onClick={onCollapse} title="隐藏面板">{Icon.chevRight()}</button>}
       </div>;
   return <>
     {inlineLayout?.tabsHost && createPortal(tabBar, inlineLayout.tabsHost)}

package/src/board/FileViewer.tsx

@@ -188,9 +188,9 @@ function FileViewerInner({ backend, jobId, path, displayName, size, mtime, versi
   const fileReadAbort = useRef<AbortController | null>(null);
   const readingAbort = useRef<AbortController | null>(null);
   const cancelRead = () => { fileReadAbort.current?.abort(); readingAbort.current?.abort(); setSyncing(false); setParsing(false); setCancelled(true); };
-  useEffect(() => retainFileScope(backend, jobId, { paths: [path], dirs: [], onDenied: () => {
+  useEffect(() => retainFileScope(backend, jobId, { paths: [path], dirs: [], onDenied: message => {
     fileReadAbort.current?.abort(); readingAbort.current?.abort(); revisionRef.current = undefined;
-    setLoaded(null); setHtmlDoc(null); setSyncing(false); setParsing(false); setError("文件访问权限已失效，请重新登录或检查任务权限");
+    setLoaded(null); setHtmlDoc(null); setSyncing(false); setParsing(false); setError(message || "文件访问受限，请检查任务文件目录或访问权限");
   } }), [backend, jobId, path]);
   // 放大：盖住页面看（看板窄的时候看报告、表格、图片）。Esc 还原。
   const [big, setBig] = useState(false);
@@ -474,7 +474,7 @@ function FileViewerInner({ backend, jobId, path, displayName, size, mtime, versi
   const toolbar = <>
           {(copying || copied || busy) && <span className="cli-fv-status" role="status">{copying ? "正在复制路径…" : copied ? "路径已复制" : "正在下载…"}</span>}
           <div className="cli-fv-actions">
-            {embedded && <button className="cli-fv-icon" title={syncing || parsing ? "正在同步当前文件" : "刷新当前文件"} aria-label="刷新当前文件" disabled={syncing || parsing} onClick={() => setAttempt(value => value + 1)}>↻</button>}
+            {embedded && <button className="cli-fv-icon" title={syncing || parsing ? "正在同步当前文件" : "刷新当前文件"} aria-label="刷新当前文件" aria-busy={syncing || parsing} disabled={syncing || parsing} onClick={() => setAttempt(value => value + 1)}>↻</button>}
             <button ref={moreRef} className="cli-fv-icon cli-fv-more" title="更多文件操作" aria-label="更多文件操作" aria-haspopup="dialog" aria-expanded={actionsOpen} onClick={() => setActionsOpen(open => !open)}>{Icon.dots()}</button>
             {actionsOpen && <Popover className="cli-fv-menu" ariaLabel="文件操作" returnFocusRef={moreRef} onClose={() => setActionsOpen(false)}>
               <div className="cli-fv-menu-head"><strong>文件操作</strong><span title={path}>{path}</span></div>

package/src/board/FilesPane.tsx

@@ -50,7 +50,7 @@ export function FilesPane({ backend, jobId, dir, onDir, onOpen, refreshKey, onLi
   const end = Math.min(entries?.length ?? 0, first + Math.min(80, Math.ceil(viewport / rowHeight) + 8));
   const visiblePaths = (entries ?? []).slice(first, end).filter(file => file.type === "file").map(file => file.path);
   const scopeKey = JSON.stringify(visiblePaths);
-  useEffect(() => retainFileScope(backend, jobId, { dirs: [dir || "."], paths: JSON.parse(scopeKey) as string[], onDenied: () => { generation.current++; pageAbort.current?.abort(); setLoading(false); setMoreLoading(false); setEntries(null); setError("工作区访问权限已失效，请重新登录或检查任务权限"); } }), [backend, jobId, dir, scopeKey]);
+  useEffect(() => retainFileScope(backend, jobId, { dirs: [dir || "."], paths: JSON.parse(scopeKey) as string[], onDenied: message => { generation.current++; pageAbort.current?.abort(); setLoading(false); setMoreLoading(false); setEntries(null); setError(message || "工作区访问受限，请检查任务文件目录或访问权限"); } }), [backend, jobId, dir, scopeKey]);
   useEffect(() => {
     if (!listRef.current || typeof ResizeObserver === "undefined") return;
     const observer = new ResizeObserver(([box]) => { if (box.contentRect.height) setViewport(box.contentRect.height); });

package/src/board/fileScope.ts

@@ -1,6 +1,6 @@
 import type { BoardBackend } from "../core/client";
 
-type Scope = { paths: string[]; dirs: string[]; onDenied?: () => void };
+type Scope = { paths: string[]; dirs: string[]; onDenied?: (message?: string) => void };
 const scopes = new WeakMap<BoardBackend, Map<string, Map<object, Scope>>>();
 const listeners = new WeakMap<BoardBackend, Map<string, Set<() => void>>>();
 /** A preview/list owns its subscription. Unmounted/closed directories are not polled. */
@@ -17,8 +17,11 @@ export function readFileScope(backend: BoardBackend, jobId: string): Scope {
   const active = [...(scopes.get(backend)?.get(jobId)?.values() ?? [])];
   return { paths: [...new Set(active.flatMap(scope => scope.paths))].sort(), dirs: [...new Set(active.flatMap(scope => scope.dirs))].sort() };
 }
-export function denyFileScope(backend: BoardBackend, jobId: string) {
-  for (const scope of scopes.get(backend)?.get(jobId)?.values() ?? []) scope.onDenied?.();
+export function denyFileScope(backend: BoardBackend, jobId: string, message?: string, denied?: { paths: readonly string[]; dirs: readonly string[] }) {
+  for (const scope of scopes.get(backend)?.get(jobId)?.values() ?? []) {
+    // A list owns its directory; a rejected child file must not erase that list.
+    if (!denied || (scope.dirs.length ? scope.dirs.some(dir => denied.dirs.includes(dir || ".")) : scope.paths.some(path => denied.paths.includes(path)))) scope.onDenied?.(message);
+  }
 }
 export function onFileScope(backend: BoardBackend, jobId: string, listener: () => void) {
   let jobs = listeners.get(backend); if (!jobs) { jobs = new Map(); listeners.set(backend, jobs); }

package/src/board/fileSync.ts

@@ -15,7 +15,7 @@ export class FileSyncError extends Error {
 }
 export interface FileSyncProgress { phase: "manifest" | "chunks" | "verify"; loadedBytes: number; totalBytes: number; downloadedBytes: number; reusedBytes: number }
 export interface FileSyncOptions { signal?: AbortSignal; onProgress?: (progress: FileSyncProgress) => void; decode?: boolean; range?: { start?: number; maxBytes: number; tail?: boolean }; pendingTimeoutMs?: number; /** Require a manifest request started after this explicit refresh. */ fresh?: boolean; /** Remember only successfully viewed ranges, never downloads. */ preview?: boolean }
-export interface FilePreviewRefresh { changed: string[]; error?: Error }
+export interface FilePreviewRefresh { changed: string[]; error?: Error; denied?: Array<{ path: string; message: string }> }
 export interface SyncedFile {
   readonly bytes: Uint8Array<ArrayBuffer>;
   revision: string; namespace: string; hash: string; size: number; start: number; end: number; truncated: boolean;
@@ -151,7 +151,7 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
         if ([401, 403, 404].includes(status)) {
           last.delete(resource);
           if (previous) {
-            if (status === 404) { const scope = { namespace: previous.namespace, taskId: jobId, path }; retireFile(scope); await cache.purgeFile(scope); }
+            if (status === 404 || (status === 403 && (error as FileSyncError).code === "file_forbidden")) { const scope = { namespace: previous.namespace, taskId: jobId, path }; retireFile(scope); await cache.purgeFile(scope); }
             else { retireNamespace(previous.namespace); await cache.purgeNamespace(previous.namespace); }
           }
         }
@@ -261,6 +261,7 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
     // prevent several 100MiB workers allocating full buffers at the same time.
     const work = async (): Promise<FilePreviewRefresh> => {
       const changed = new Set<string>(); let error: Error | undefined, hasRecoverableError = false, retryAfterMs = 0;
+      const denied: NonNullable<FilePreviewRefresh["denied"]> = [];
       for (const path of requested) {
         if (signal?.aborted) throw aborted();
         const resource = JSON.stringify([jobId, path]), previous = previews.get(resource);
@@ -277,7 +278,14 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
           }
         } catch (failure) {
           const status = statusOf(failure);
-          if (signal?.aborted || (failure instanceof Error && failure.name === "AbortError") || status === 401 || status === 403) throw failure;
+          if (signal?.aborted || (failure instanceof Error && failure.name === "AbortError") || status === 401) throw failure;
+          if (status === 403) {
+            if ((failure as FileSyncError).code !== "file_forbidden") throw failure;
+            const scope = { namespace: last.get(resource)?.namespace ?? previous.namespace, taskId: jobId, path };
+            last.delete(resource); previews.delete(resource); retireFile(scope); await cache.purgeFile(scope);
+            changed.delete(path); denied.push({ path, message: failure instanceof Error ? failure.message : String(failure) });
+            continue;
+          }
           if (status === 404) {
             changed.add(path);
             if (previews.get(resource) === previous) {
@@ -304,7 +312,7 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
       }
       // Preserve the original errors: consumers may share them with other reads.
       const combined = error && hasRecoverableError && retryAfterMs > 0 ? Object.assign(new Error(error.message), error, { name: error.name, retryAfterMs }) : error;
-      return { changed: [...changed], ...(combined ? { error: combined } : {}) };
+      return { changed: [...changed], ...(combined ? { error: combined } : {}), ...(denied.length ? { denied } : {}) };
     };
     return refreshQueue.run(work, signal);
   };

package/src/board/fileSyncProcessor.ts

@@ -1,8 +1,9 @@
 import { decodeText } from "../core/textDecode";
+import { sha256 } from "../core/sha256";
 
 const aborted = () => new DOMException("文件同步已取消", "AbortError");
 const integrity = (message: string) => Object.assign(new Error(message), { status: 422, code: "integrity" });
-const digest = async (bytes: Uint8Array<ArrayBuffer>) => [...new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))].map(byte => byte.toString(16).padStart(2, "0")).join("");
+const digest = async (bytes: Uint8Array<ArrayBuffer>) => globalThis.crypto?.subtle ? [...new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))].map(byte => byte.toString(16).padStart(2, "0")).join("") : sha256(bytes);
 type Processed = { bytes: Uint8Array<ArrayBuffer>; text?: string; encoding?: string };
 
 /** One worker owns the assembled buffer; chunks are transferred, not copied into a second main-thread file. */
@@ -18,8 +19,8 @@ export class FileSyncProcessor {
   private failed: Error | null = null;
   constructor(private signal: AbortSignal) {
     if (typeof Worker !== "undefined" && typeof URL.createObjectURL === "function") try {
-      const script = `const decode=${decodeText.toString()};let output=null,offset=0;
-const hash=async b=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',b)),v=>v.toString(16).padStart(2,'0')).join('');
+      const script = `const decode=${decodeText.toString()},fallback=${sha256.toString()};let output=null,offset=0;
+const hash=async b=>globalThis.crypto?.subtle?Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',b)),v=>v.toString(16).padStart(2,'0')).join(''):fallback(b instanceof Uint8Array?b:new Uint8Array(b));
 onmessage=async({data:m})=>{try{let value;
 if(m.op==='start'){output=new Uint8Array(m.size);offset=0;value=true;}
 if(m.op==='verify'){if(await hash(m.bytes)!==m.hash)throw Error('文件块校验失败');value={bytes:m.bytes};}

package/src/board/fileSyncTransport.ts

@@ -43,8 +43,8 @@ export function createFileSyncTransport(fetcher: typeof fetch, pathBuilder: (job
         const retryAfterMs = retry ? (/^\d+(\.\d+)?$/.test(retry) ? Number(retry) * 1000 : Math.max(0, Date.parse(retry) - Date.now())) : undefined;
         const missingRoute = response.status === 501 || (response.status === 404 && !["file_not_found", "task_not_found", "job_not_found"].includes(error.error ?? ""));
         const code = missingRoute ? "unsupported" : error.error ?? "http_error";
-        const common: Record<string, string> = { node_unreachable: "执行节点暂时连不上，请稍后重试", unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_sync_unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_not_found: "文件不存在（可能已删除或改名）", file_forbidden: "文件访问权限失效，请重新登录或确认权限", file_sync_busy: "文件服务繁忙，请稍后重试", too_many_snapshot_builds: "文件服务繁忙，请稍后重试", too_many_uploads: "上传任务较多，请稍后重试", file_sync_queue_timeout: "文件处理排队超时，请稍后重试", file_sync_timeout: "文件服务响应超时，请重试", snapshot_cache_full: "文件缓存空间不足，请稍后重试", upload_storage_full: "文件上传空间不足，请稍后重试" };
-        const message = common[code] ?? ([401, 403].includes(response.status) ? "文件访问权限失效，请重新登录或确认权限" : error.detail ?? `文件同步失败（HTTP ${response.status})`);
+        const common: Record<string, string> = { node_unreachable: "执行节点暂时连不上，请稍后重试", unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_sync_unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_not_found: "文件不存在（可能已删除或改名）", file_forbidden: error.detail || "文件不在当前任务允许访问的目录中，或没有访问权限", file_sync_busy: "文件服务繁忙，请稍后重试", too_many_snapshot_builds: "文件服务繁忙，请稍后重试", too_many_uploads: "上传任务较多，请稍后重试", file_sync_queue_timeout: "文件处理排队超时，请稍后重试", file_sync_timeout: "文件服务响应超时，请重试", snapshot_cache_full: "文件缓存空间不足，请稍后重试", upload_storage_full: "文件上传空间不足，请稍后重试" };
+        const message = response.status === 401 ? "登录已失效，请重新登录" : common[code] ?? (response.status === 403 ? error.detail || "没有读取该文件的权限，请检查任务访问权限" : error.detail ?? `文件同步失败（HTTP ${response.status})`);
         throw new FileSyncError(message, response.status, code, retryAfterMs);
       }
       return { response, bytes };

package/src/board/fileWatch.ts

@@ -78,12 +78,43 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
    const state={baseline:new Map(baseline),known:new Set(known)},nextDirectories=new Map(directories),nextCursors=new Map(cursors);
    try{
     const changes:WorkspaceFileChange[]=[];
+    let accessError:string|undefined;
+    const forbidden=(error:unknown)=>(error as {status?:number;code?:string})?.status===403&&(error as {code?:string}).code==='file_forbidden';
+    const deny=(error:unknown,paths:string[],dirs:string[])=>{
+     accessError=error instanceof Error?error.message:String(error);
+     denyFileScope(backend,jobId,accessError,{paths,dirs});
+    };
+    // A rejected path in a batch is not evidence that the whole task lost access.
+    // Inspect only that batch's metadata; healthy files and directories remain usable.
+    const inspect=async(paths:string[],dirs:string[])=>{
+     const listed=new Map<string,FileEntry>(),deniedPaths=new Set<string>();
+     for(const dir of dirs){
+      try{
+       const result=await requests.run(()=>backend.stat(jobId,dir||'.'),ctl.signal);if(!current())return;
+       if(result.type!=='dir')continue;
+       for(const file of result.entries)listed.set(file.path,file);
+       const revision=result.revision??JSON.stringify(result.entries.map(file=>[file.path,fingerprint(file)]));
+       if(nextDirectories.has(dir)&&nextDirectories.get(dir)!==revision)changes.push({kind:'modified',path:dir});
+       nextDirectories.set(dir,revision);
+      }catch(error){if(!current())return;if(!forbidden(error))throw error;deny(error,[],[dir||'.']);}
+     }
+     const files:FileEntry[]=[];
+     for(const path of paths){
+      const listedFile=listed.get(path);if(listedFile){files.push(listedFile);continue;}
+      try{const result=await requests.run(()=>backend.stat(jobId,path),ctl.signal);if(result.type==='file')files.push(result);}
+      catch(error){if(!current())return;if(forbidden(error)){deniedPaths.add(path);state.baseline.delete(path);state.known.delete(path);deny(error,[path],[]);}else if((error as {status?:number}).status!==404)throw error;}
+      if(!current())return;
+     }
+     changes.push(...snapshot(files,paths.filter(path=>!deniedPaths.has(path)),state));
+    };
     if(backend.pollFiles){
      const activeKeys=new Set<string>();
      const count=Math.max(Math.ceil(scope.paths.length/200),Math.ceil(scope.dirs.length/32));
      for(let index=0;index<count;index++){
       const paths=scope.paths.slice(index*200,index*200+200),dirs=scope.dirs.slice(index*32,index*32+32),key=JSON.stringify([paths,dirs]);activeKeys.add(key);
-      const batch=await requests.run(()=>backend.pollFiles!(jobId,{paths,dirs,cursor:nextCursors.get(key)},ctl.signal),ctl.signal);
+      let batch:Awaited<ReturnType<NonNullable<BoardBackend['pollFiles']>>>;
+      try{batch=await requests.run(()=>backend.pollFiles!(jobId,{paths,dirs,cursor:nextCursors.get(key)},ctl.signal),ctl.signal);}
+      catch(error){if(!forbidden(error))throw error;nextCursors.delete(key);await inspect(paths,dirs);if(!current())return;continue;}
       if(!current())return;
       if(!batch||typeof batch!=='object')throw invalidResponse('文件变化响应不完整，请重试');
       if(batch.type==='resync'){cursors.delete(key);throw new Error('文件修订已变化，请重新核对');}
@@ -99,27 +130,12 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
      for(const key of nextCursors.keys())if(!activeKeys.has(key))nextCursors.delete(key);
     }else{
      // Compatibility hosts: inspect requested entries, never recurse a workspace.
-     const listed=new Map<string,FileEntry>();
-     for(const dir of scope.dirs){
-      const result=await requests.run(()=>backend.stat(jobId,dir||'.'),ctl.signal);if(!current())return;
-      if(result.type!=='dir')continue;
-      for(const file of result.entries)listed.set(file.path,file);
-      const revision=result.revision??JSON.stringify(result.entries.map(file=>[file.path,fingerprint(file)]));
-      if(nextDirectories.has(dir)&&nextDirectories.get(dir)!==revision)changes.push({kind:'modified',path:dir});
-      nextDirectories.set(dir,revision);
-     }
-     const files:FileEntry[]=[];
-     for(const path of scope.paths){
-      const listedFile=listed.get(path);if(listedFile){files.push(listedFile);continue;}
-      try{const result=await requests.run(()=>backend.stat(jobId,path),ctl.signal);if(result.type==='file')files.push(result);}
-      catch(error){if((error as {status?:number}).status!==404)throw error;}
-      if(!current())return;
-     }
-     changes.push(...snapshot(files,scope.paths,state));
+     await inspect(scope.paths,scope.dirs);
     }
     if(!current())return;
     const previews=backend.fileSync?await refreshFilePreviews(backend.fileSync,jobId,scope.paths,ctl.signal):undefined;
     if(!current())return;
+    for(const file of previews?.denied??[])deny(new Error(file.message),[file.path],[]);
     const changedPaths=new Set(changes.map(change=>change.path));
     for(const path of previews?.changed??[])if(!changedPaths.has(path)){changes.push({kind:'modified',path});changedPaths.add(path);}
     const active=new Set(scope.paths);for(const path of state.known)if(!active.has(path)){state.known.delete(path);state.baseline.delete(path);}
@@ -127,7 +143,7 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
     baseline=state.baseline;known=state.known;directories=nextDirectories;cursors=nextCursors;
     publish(changes);
     if(previews?.error)throw previews.error;
-    failed=0;serverNotBefore=0;retryAt=0;exhaustedUntil=0;if(current())status('ready');
+    failed=0;serverNotBefore=0;retryAt=0;exhaustedUntil=0;if(current())status(accessError?'error':'ready',accessError);
    }catch(error){if(current()){
     failed++;const code=(error as {status?:number}).status??0;
     const failureCode=(error as {code?:string}).code;
@@ -139,7 +155,7 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
      retryAt=Math.max(Date.now()+base,serverNotBefore)+Math.floor(Math.random()*base/2);
      if(failed>retryDelays.length)exhaustedUntil=Math.max(Date.now()+30000,serverNotBefore);
     }
-    if([401,403].includes(code))denyFileScope(backend,jobId);
+    if([401,403].includes(code))denyFileScope(backend,jobId,error instanceof Error?error.message:undefined);
     status('error',error instanceof Error?error.message:String(error));
    }}
    finally{if(controller===ctl){

package/src/chat/CliChat.tsx

@@ -1,6 +1,8 @@
 // cli-chat：对话。界面取自 Operator 的会话视图（SessionView 的对话部分 + Composer），
 // 数据来自 center 的对话任务（mode=conversation）：实时流里的节点转录按 Operator 的规则渲染，
 // 每条消息是中枢的一轮，排队 / 执行 / 结束都跟 center 保持一致。
+import { SubagentChatScope } from "../ui/SubagentChat";
+import { parentMessages } from "../core/subagents";
 import { useCallback, useEffect, useId, useLayoutEffect, useMemo, useRef, useState, type ReactNode, type CSSProperties } from "react";
 import { CliErrorBoundary } from "../ui/ErrorBoundary";
 import type { CliEvent, CliStore, CliStoreOptions } from "../core/store";
@@ -198,11 +200,18 @@ function ChatInner({ slots, passiveContext = true, configurationBusy, onClear, j
 
   const allMessages = useMemo(() => (conv ? viewMessages(conv) : []), [conv]);
   // config.transcript.tools=false：去掉工具卡片，只留文字往来（提问 / 输入卡片要用户操作，照常显示）。
-  const messages = useMemo(() => (cfg.transcript.tools ? allMessages : allMessages.filter((m) => {
+  const parent = useMemo(() => parentMessages(allMessages), [allMessages]);
+  const messages = useMemo(() => (cfg.transcript.tools ? parent : parent.filter((m) => {
     if (m.role !== "tool") return true;
     const data = toolDataOf(m);
     return !!(data.ask || data.input);
-  })), [allMessages, cfg.transcript.tools]);
+  })), [parent, cfg.transcript.tools]);
+  const remoteTaskId = conv?.remoteTaskId ?? conv?.task?.remote_task_id ?? null;
+  const loadSubagent = useCallback(async (id: string, generation: number, before?: string) => {
+    if (!key || !remoteTaskId || !store.client.subagent) throw new Error("当前接入未提供子代理历史接口");
+    return store.client.subagent(key, remoteTaskId, id, generation, before);
+  }, [store, key, remoteTaskId]);
+  const renderSubagentMessage = useCallback((message: Msg, name: string) => <MessageView m={message} initial={false} hideWho={false} handlers={{}} agentLabel={name} view={{ timestamps: true, initialBadge: false, userLabel: "收到的任务", agentName: name }} />, []);
   const running = conv ? isRunning(conv) : false;
   const job = entry?.job;
   // 一次性任务没有轮次：补充消息通过 continueTask 接在当前子任务的对话后面。
@@ -691,6 +700,7 @@ function ChatInner({ slots, passiveContext = true, configurationBusy, onClear, j
     <FileLinkContext.Provider value={resolveFile}>
     <FileOpenContext.Provider value={openFile}>
     <div ref={chatRef} className={`cli-ui cli-chat ${className ?? ""}`} data-theme={theme} style={style}>
+      <SubagentChatScope scopeKey={`${key ?? "new"}:${remoteTaskId ?? ""}`} messages={allMessages} load={store.client.subagent ? loadSubagent : undefined} renderMessage={renderSubagentMessage}>
       <div className="session">
         {h.show && (workspaceAvailable || externalBoardVisible || h.crumb || h.export || h.title || h.agent || h.usage || h.model || h.status || h.close) && <div className="sess-head">
           {workspaceTabs ? <WorkspaceTabs title={convTitle} subtitle={h.crumb ? title : undefined} chatActive={!workspaceActive} onChat={showChat} onTabsHost={setTabsHost} /> : (h.crumb || showCurrentTitle) && <div className="sh-main">
@@ -883,6 +893,7 @@ function ChatInner({ slots, passiveContext = true, configurationBusy, onClear, j
           inlineLayout={mobileWorkspace ? undefined : { tabsHost, active: workspaceActive, onActivate: showWorkspace, onChat: showChat }} />}
         </WorkspaceDrawer>
       </div>
+      </SubagentChatScope>
       {popup && key && board && (
         <div className="scrim" onClick={(e) => { if (e.target === e.currentTarget) setPopup(null); }}>
           <div className={`modal cli-popup ${popup.kind}`} role="dialog" aria-modal="true" aria-label={popup.kind === "file" ? popup.path : "任务浏览器"}>

package/src/core/client.ts

@@ -1,3 +1,4 @@
+import type { SubagentTranscript } from "./subagents";
 import { createSseParser } from "./sse";
 import { NEW_TASK, parseConvKey } from "./conversation";
 import type {
@@ -107,6 +108,8 @@ export interface ConversationBackend {
   /** taskId：只要对话任务里这一个对话的轮次。 */
   listTurns(jobId: string, query?: { afterSeq?: number; limit?: number; taskId?: string }): Promise<{ job_id: string; turns: CenterTurn[] }>;
   listTasks(): Promise<{ tasks: CenterTask[] }>;
+  /** 原生子代理的公开运行记录；before 用于读取更早的一页。 */
+  subagent?(jobId: string, remote: string, childId: string, generation: number, before?: string): Promise<SubagentTranscript>;
   /**
    * 更早的节点转录（往上翻）：remote 是流里给的节点会话，before 是手里最早那条消息的 id。
    * 返回这一页（旧的在前）和再往前还剩几条。旧版中枢没有这个接口（实时流也就给的是全量，用不到）。
@@ -344,6 +347,7 @@ export function createCenterClient(options: CenterClientOptions = {}): Conversat
         return error instanceof Error ? error.message : String(error);
       }
     },
+    subagent: (jobId, remote, childId, generation, before) => request<SubagentTranscript>(`/api/jobs/${id(parseConvKey(jobId).jobId)}/subagents/${id(childId)}?remote=${id(remote)}&generation=${generation}&limit=200${before ? `&before=${id(before)}` : ""}`),
     history: (jobId: string, remote: string, before: string, limit = 200) =>
       request<{ messages: Message[]; older: number }>(`/api/jobs/${id(parseConvKey(jobId).jobId)}/history?remote=${id(remote)}&before=${id(before)}&limit=${limit}`),
     createConversation: (firstMessage: string, opts: NewConversationOptions & { businessId?: string } = {}) => {

package/src/core/conversation.ts

@@ -229,19 +229,25 @@ export function applyNodeEvent(conv: ConvState, ev: NodeEvent): ConvState {
     case "assistant":
       return set(upsertMsg(conv.msgs, { id: e.msgId ?? localId("a"), role: "assistant", content: e.content, generation: gen, ts: e.ts }));
     case "tool": {
-      const data: ToolData = { title: e.title, detail: e.detail, peek: e.peek, diff: e.diff };
-      return set(upsertMsg(conv.msgs, { id: e.msgId ?? localId("t"), role: "tool", content: JSON.stringify(data), generation: gen, toolId: e.id }));
+      const data: ToolData = { title: e.title, detail: e.detail, peek: e.peek, diff: e.diff, subagent: e.subagent, subagentMessage: e.subagentMessage };
+      return set(upsertMsg(conv.msgs, { id: e.msgId ?? localId("t"), role: "tool", content: JSON.stringify(data), generation: gen, toolId: e.id, ts: e.ts }));
     }
     case "tool_result": {
       // 先按消息 id 找（快照加载的消息也能对上），找不到再按 tool_use id。结果多在末尾，从后往前找。
       const arr = conv.msgs;
       let i = arr.length - 1;
       while (i >= 0 && (arr[i].role !== "tool" || (arr[i].id !== e.msgId && arr[i].toolId !== e.id))) i--;
-      if (i < 0) return conv;
+      if (i < 0) {
+        if (!e.msgId || (!e.subagent && !e.subagentMessage)) return conv;
+        const data: ToolData = { title: e.subagent?.title ?? e.subagentMessage?.tool?.title ?? "子代理消息", subagent: e.subagent, subagentMessage: e.subagentMessage };
+        return set(upsertMsg(arr, { id: e.msgId, role: "tool", content: JSON.stringify(data), generation: gen, toolId: e.id, ts: e.ts }));
+      }
       try {
         const d = JSON.parse(arr[i].content) as ToolData;
         d.result = e.content;
         d.isError = e.isError;
+        if (e.subagent) d.subagent = e.subagent;
+        if (e.subagentMessage) d.subagentMessage = e.subagentMessage;
         if (e.peek) d.peek = e.peek;
         const next = arr.slice();
         next[i] = { ...arr[i], content: JSON.stringify(d) };
@@ -535,6 +541,7 @@ export function turnCallback(conv: ConvState, turn: CenterTurn, continuedFrom: s
     context_reset: turn.context_reset,
     merged: !!turn.merged,
     merge_error: turn.merge_error ?? null,
+    ...(turn.saved !== undefined ? { saved: turn.saved, saved_at: turn.saved_at ?? null, save_error: turn.save_error ?? null } : {}),
     agent: turn.agent,
     resolved_model: turn.resolved_model,
     total_tokens: turn.total_tokens, input_tokens: turn.input_tokens, output_tokens: turn.output_tokens,

package/src/core/identity.ts

@@ -1,22 +1,10 @@
 import type { CenterClientOptions } from './client';
 import { clientId } from './id';
+import { sha256 } from './sha256';
 // A synchronous SHA-256 fingerprint partitions persistent drafts without putting
 // credentials in localStorage keys. It is never used for authentication.
-const K = [0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2];
-const rotate = (x:number,n:number)=>(x>>>n)|(x<<(32-n));
 export function connectionFingerprint(text:string):string {
- const raw=new TextEncoder().encode(text),data=new Uint8Array(Math.ceil((raw.length+9)/64)*64);data.set(raw);data[raw.length]=128;
- const view=new DataView(data.buffer);view.setUint32(data.length-8,Math.floor(raw.length/0x20000000));view.setUint32(data.length-4,(raw.length*8)>>>0);
- const hash=[0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19],w=new Int32Array(64);
- for(let offset=0;offset<data.length;offset+=64){
-  for(let i=0;i<16;i++)w[i]=view.getInt32(offset+i*4);
-  for(let i=16;i<64;i++){const x=w[i-15],y=w[i-2];w[i]=(w[i-16]+(rotate(x,7)^rotate(x,18)^(x>>>3))+w[i-7]+(rotate(y,17)^rotate(y,19)^(y>>>10)))|0;}
-  let [a,b,c,d,e,f,g,h]=hash;
-  for(let i=0;i<64;i++){const t1=(h+(rotate(e,6)^rotate(e,11)^rotate(e,25))+((e&f)^(~e&g))+K[i]+w[i])|0,t2=((rotate(a,2)^rotate(a,13)^rotate(a,22))+((a&b)^(a&c)^(b&c)))|0;
-   h=g;g=f;f=e;e=(d+t1)|0;d=c;c=b;b=a;a=(t1+t2)|0;}
-  [a,b,c,d,e,f,g,h].forEach((value,i)=>{hash[i]=(hash[i]+value)|0;});
- }
- return hash.map(value=>(value>>>0).toString(16).padStart(8,'0')).join('');
+ return sha256(new TextEncoder().encode(text));
 }
 const customScopes=new WeakMap<object,string>();
 export function connectionDraftScope(options:CenterClientOptions&{namespace?:string|null;client?:object}):string {

package/src/core/sha256.ts

@@ -0,0 +1,21 @@
+/** Keep this byte-only fallback self-contained so file workers can use the same implementation. */
+export function sha256(bytes: Uint8Array): string {
+ const K = [0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2];
+ const rotate = (x:number,n:number)=>(x>>>n)|(x<<(32-n));
+ // Only the final one or two blocks need padding; do not copy an entire large file.
+ const blockBytes=bytes.length-bytes.length%64,tail=new Uint8Array(bytes.length%64<56?64:128);
+ tail.set(bytes.subarray(blockBytes));tail[bytes.length%64]=128;
+ const input=new DataView(bytes.buffer,bytes.byteOffset,bytes.byteLength),padding=new DataView(tail.buffer);
+ padding.setUint32(tail.length-8,Math.floor(bytes.length/0x20000000));padding.setUint32(tail.length-4,(bytes.length*8)>>>0);
+ const hash=[0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19],w=new Int32Array(64);
+ for(let offset=0;offset<blockBytes+tail.length;offset+=64){
+  const view=offset<blockBytes?input:padding,base=offset<blockBytes?offset:offset-blockBytes;
+  for(let i=0;i<16;i++)w[i]=view.getInt32(base+i*4);
+  for(let i=16;i<64;i++){const x=w[i-15],y=w[i-2];w[i]=(w[i-16]+(rotate(x,7)^rotate(x,18)^(x>>>3))+w[i-7]+(rotate(y,17)^rotate(y,19)^(y>>>10)))|0;}
+  let [a,b,c,d,e,f,g,h]=hash;
+  for(let i=0;i<64;i++){const t1=(h+(rotate(e,6)^rotate(e,11)^rotate(e,25))+((e&f)^(~e&g))+K[i]+w[i])|0,t2=((rotate(a,2)^rotate(a,13)^rotate(a,22))+((a&b)^(a&c)^(b&c)))|0;
+   h=g;g=f;f=e;e=(d+t1)|0;d=c;c=b;b=a;a=(t1+t2)|0;}
+  [a,b,c,d,e,f,g,h].forEach((value,i)=>{hash[i]=(hash[i]+value)|0;});
+ }
+ return hash.map(value=>(value>>>0).toString(16).padStart(8,'0')).join('');
+}

package/src/core/subagents.ts

@@ -0,0 +1,78 @@
+/** Shared wire format for native CLI subagents. These are not Center tasks. */
+export interface SubagentInfo {
+  id: string;
+  parentId?: string;
+  title: string;
+  task?: string;
+  status: "running" | "completed" | "failed" | "cancelled" | "unknown";
+  detailAvailability: "full" | "partial" | "unavailable";
+  detailReason?: string;
+  updatedAt?: number;
+}
+
+export interface SubagentMessage {
+  subagentId: string;
+  role: "user" | "assistant" | "tool" | "system";
+  content: string;
+  tool?: { id: string; title: string; detail?: string; result?: string; isError?: boolean };
+  eventId: string;
+  updatedAt?: number;
+}
+
+export interface SubagentFields {
+  subagent?: SubagentInfo;
+  subagentMessage?: SubagentMessage;
+}
+
+type Row = { id: string; role: string; content: string; generation: number; ts?: number; created_at?: number };
+export interface SubagentTranscript { subagent: SubagentInfo; messages: Row[]; refreshable?: boolean; older?: number }
+export type LoadSubagent = (id: string, generation: number, before?: string) => Promise<SubagentTranscript>;
+
+const cache = new WeakMap<Row, SubagentFields>();
+export function subagentFields(row: Row): SubagentFields {
+  const known = cache.get(row);
+  if (known) return known;
+  const fields: SubagentFields = {};
+  if (row.role === "tool") {
+    try {
+      const value = JSON.parse(row.content);
+      const info = value?.subagent;
+      if (info && typeof info.id === "string" && typeof info.title === "string") fields.subagent = {
+        id: info.id, title: info.title,
+        parentId: typeof info.parentId === "string" ? info.parentId : undefined,
+        task: typeof info.task === "string" ? info.task : undefined,
+        status: ["running", "completed", "failed", "cancelled", "unknown"].includes(info.status) ? info.status : "unknown",
+        detailAvailability: ["full", "partial", "unavailable"].includes(info.detailAvailability) ? info.detailAvailability : "partial",
+        detailReason: typeof info.detailReason === "string" ? info.detailReason : undefined,
+        updatedAt: typeof info.updatedAt === "number" && Number.isFinite(info.updatedAt) ? info.updatedAt : undefined,
+      };
+      if (value?.subagentMessage && typeof value.subagentMessage.subagentId === "string" && typeof value.subagentMessage.content === "string"
+        && ["user", "assistant", "tool", "system"].includes(value.subagentMessage.role)) fields.subagentMessage = value.subagentMessage;
+    } catch { /* Ordinary or malformed tool output is handled by the existing renderer. */ }
+  }
+  cache.set(row, fields);
+  return fields;
+}
+
+/** Keep child activity out of the parent timeline, but retain an entry if its card is outside the loaded tail. */
+export function parentMessages<T extends Row>(rows: T[]): T[] {
+  const cardKeys = new Set(rows.flatMap(row => {
+    const info = subagentFields(row).subagent;
+    return info ? [`${row.generation}:${info.id}`] : [];
+  }));
+  const emitted = new Set<string>();
+  return rows.flatMap(row => {
+    const { subagent, subagentMessage } = subagentFields(row);
+    if (subagent?.parentId && cardKeys.has(`${row.generation}:${subagent.parentId}`)) return [];
+    if (!subagentMessage) return [row];
+    const key = `${row.generation}:${subagentMessage.subagentId}`;
+    if (cardKeys.has(key) || emitted.has(key)) return [];
+    emitted.add(key);
+    const info: SubagentInfo = { id: subagentMessage.subagentId, title: "子代理", status: "unknown", detailAvailability: "partial", detailReason: "正在读取子代理详情" };
+    return [{ ...row, id: `subagent-entry:${key}`, role: "tool", content: JSON.stringify({ title: info.title, subagent: info }) }];
+  });
+}
+
+export function childMessages(rows: Row[], id: string, generation: number) {
+  return rows.filter(row => row.generation === generation && (subagentFields(row).subagentMessage?.subagentId === id || subagentFields(row).subagent?.parentId === id));
+}

package/src/core/types.ts

@@ -1,3 +1,4 @@
+import type { SubagentInfo, SubagentMessage } from "./subagents";
 /**
  * 两套数据形状：
  *   · center 服务（cli-task-center）对话任务接口的返回（snake_case，原样保留，便于对照 API 文档）；
@@ -37,6 +38,10 @@ export interface CenterTurn {
   /** 这一轮的改动是否已合并回项目基线。 */
   merged?: boolean;
   merge_error?: string | null;
+  /** 保存本任务分支与合并项目主分支分别记录；旧版中枢不返回。 */
+  saved?: boolean;
+  saved_at?: string | null;
+  save_error?: string | null;
   created_at: string;
   started_at: string | null;
   ended_at: string | null;
@@ -203,6 +208,8 @@ export type ToolPeek =
   | { kind: "todos"; items: { text: string; status: string }[] };
 
 export interface ToolData {
+  subagent?: SubagentInfo;
+  subagentMessage?: SubagentMessage;
   title: string;
   detail?: string;
   result?: string;
@@ -228,8 +235,8 @@ export type NodeEvent =
   | { type: "dequeued"; msgId: string }
   | { type: "model"; model: string }
   | { type: "assistant"; content: string; msgId?: string; generation?: number; ts?: number }
-  | { type: "tool"; id: string; title: string; detail: string; peek?: ToolPeek; diff?: DiffLine[]; msgId?: string; generation?: number }
-  | { type: "tool_result"; id: string; content: string; isError: boolean; peek?: ToolPeek; msgId?: string }
+  | { type: "tool"; id: string; title: string; detail: string; peek?: ToolPeek; diff?: DiffLine[]; subagent?: SubagentInfo; subagentMessage?: SubagentMessage; msgId?: string; generation?: number; ts?: number }
+  | { type: "tool_result"; id: string; content: string; isError: boolean; peek?: ToolPeek; subagent?: SubagentInfo; subagentMessage?: SubagentMessage; msgId?: string; generation?: number; ts?: number }
   | { type: "ask"; id: string; questions: AskQuestion[]; msgId?: string; generation?: number }
   | { type: "ask_answered"; id: string; answers: AskAnswers; msgId?: string; awaiting_input?: 0 | 1 }
   | { type: "input"; input: InputRequest; msgId?: string; generation?: number; awaiting_input?: 0 | 1 }
@@ -338,6 +345,9 @@ export interface ConversationTurnCallback {
   context_reset: boolean;
   merged: boolean;
   merge_error: string | null;
+  saved?: boolean;
+  saved_at?: string | null;
+  save_error?: string | null;
   agent: string | null;
   resolved_model: string | null;
   total_tokens: number;