@spzxg/cli-ui 0.6.12 → 0.6.13

package/dist/cli-ui.js

@@ -1,4 +1,4 @@
-import { C as a, b as i, d as r, e as t, f as o, h as C, i as l, j as n, k as m, m as d, l as u, n as w, o as B, p as f } from "./cli-ui-embed-B0HDalUb.js";
+import { C as a, b as i, d as r, e as t, f as o, h as C, i as l, j as n, k as m, m as d, l as u, n as w, o as B, p as f } from "./cli-ui-embed-CXaGT9e4.js";
 export {
   a as CliBoard,
   i as CliBrowserView,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spzxg/cli-ui",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "type": "module",
   "description": "相互联动的 CliMsgList、CliChat、CliBoard，支持任务中枢和完整 Operator 工作区。",
   "main": "src/index.ts",

package/src/board/CliBoard.tsx

@@ -101,7 +101,7 @@ export interface CliBoardProps extends CliStoreOptions, WorkspaceHandlers {
    * 缺省和 quoteToChat 一样。
    */
   autoQuoteOpenFile?: boolean;
-  /** 给了就在页签栏右侧显示「隐藏面板」按钮。 */
+  /** 保留旧宿主兼容；看板不再显示内置收起按钮。 */
   onCollapse?: () => void;
   /**
    * 收起状态：只显示一条窄栏（点一下展开）。收起时仍然接对话里的打开请求——接到就记下要打开的东西并调 onExpand，
@@ -125,7 +125,7 @@ export function CliBoard(props: CliBoardProps) {
 
 interface OpenFile { name?: string; reloadKey?:number; path: string; size?: number; mtime?: number; version: number }
 
-function BoardInner({ jobId: jobIdProp, taskId: taskIdProp, tabs, availableTabs, defaultTab, readOnly, fileActions, acceptOpen = true, quoteToChat, autoQuoteOpenFile, extraTabs, onCollapse, collapsed, onExpand, onNavigate, onEvent, onFilesChange, onFilesWatch, onBoardContextChange, watchFiles = true, fileWatchIntervalMs, theme = "light", className, style, inProvider, inlineLayout, inlineOwner, visible: visibilityOverride, onQuoteToChat }: CliBoardProps & { inProvider: boolean }) {
+function BoardInner({ jobId: jobIdProp, taskId: taskIdProp, tabs, availableTabs, defaultTab, readOnly, fileActions, acceptOpen = true, quoteToChat, autoQuoteOpenFile, extraTabs, collapsed, onExpand, onNavigate, onEvent, onFilesChange, onFilesWatch, onBoardContextChange, watchFiles = true, fileWatchIntervalMs, theme = "light", className, style, inProvider, inlineLayout, inlineOwner, visible: visibilityOverride, onQuoteToChat }: CliBoardProps & { inProvider: boolean }) {
   useComponentEvents(onEvent, {onFilesChange,onFilesWatch,onBoardContextChange}, inProvider);
   const store = useCliStore();
   const backend = store.client.board;
@@ -471,7 +471,6 @@ function BoardInner({ jobId: jobIdProp, taskId: taskIdProp, tabs, availableTabs,
         {info?.dispatched && !file && <button className="rail-collapse" onClick={refreshAll} title={running ? "运行中 · 本轮结束后同步，点击立即检查" : "刷新"}>
           <span className={`cli-sync-dot ${running ? "on" : ""}`} />↻
         </button>}
-        {onCollapse && <button className="rail-collapse" onClick={onCollapse} title="隐藏面板">{Icon.chevRight()}</button>}
       </div>;
   return <>
     {inlineLayout?.tabsHost && createPortal(tabBar, inlineLayout.tabsHost)}

package/src/board/FileViewer.tsx

@@ -188,9 +188,9 @@ function FileViewerInner({ backend, jobId, path, displayName, size, mtime, versi
   const fileReadAbort = useRef<AbortController | null>(null);
   const readingAbort = useRef<AbortController | null>(null);
   const cancelRead = () => { fileReadAbort.current?.abort(); readingAbort.current?.abort(); setSyncing(false); setParsing(false); setCancelled(true); };
-  useEffect(() => retainFileScope(backend, jobId, { paths: [path], dirs: [], onDenied: () => {
+  useEffect(() => retainFileScope(backend, jobId, { paths: [path], dirs: [], onDenied: message => {
     fileReadAbort.current?.abort(); readingAbort.current?.abort(); revisionRef.current = undefined;
-    setLoaded(null); setHtmlDoc(null); setSyncing(false); setParsing(false); setError("文件访问权限已失效，请重新登录或检查任务权限");
+    setLoaded(null); setHtmlDoc(null); setSyncing(false); setParsing(false); setError(message || "文件访问受限，请检查任务文件目录或访问权限");
   } }), [backend, jobId, path]);
   // 放大：盖住页面看（看板窄的时候看报告、表格、图片）。Esc 还原。
   const [big, setBig] = useState(false);
@@ -474,7 +474,7 @@ function FileViewerInner({ backend, jobId, path, displayName, size, mtime, versi
   const toolbar = <>
           {(copying || copied || busy) && <span className="cli-fv-status" role="status">{copying ? "正在复制路径…" : copied ? "路径已复制" : "正在下载…"}</span>}
           <div className="cli-fv-actions">
-            {embedded && <button className="cli-fv-icon" title={syncing || parsing ? "正在同步当前文件" : "刷新当前文件"} aria-label="刷新当前文件" disabled={syncing || parsing} onClick={() => setAttempt(value => value + 1)}>↻</button>}
+            {embedded && <button className="cli-fv-icon" title={syncing || parsing ? "正在同步当前文件" : "刷新当前文件"} aria-label="刷新当前文件" aria-busy={syncing || parsing} disabled={syncing || parsing} onClick={() => setAttempt(value => value + 1)}>↻</button>}
             <button ref={moreRef} className="cli-fv-icon cli-fv-more" title="更多文件操作" aria-label="更多文件操作" aria-haspopup="dialog" aria-expanded={actionsOpen} onClick={() => setActionsOpen(open => !open)}>{Icon.dots()}</button>
             {actionsOpen && <Popover className="cli-fv-menu" ariaLabel="文件操作" returnFocusRef={moreRef} onClose={() => setActionsOpen(false)}>
               <div className="cli-fv-menu-head"><strong>文件操作</strong><span title={path}>{path}</span></div>

package/src/board/FilesPane.tsx

@@ -50,7 +50,7 @@ export function FilesPane({ backend, jobId, dir, onDir, onOpen, refreshKey, onLi
   const end = Math.min(entries?.length ?? 0, first + Math.min(80, Math.ceil(viewport / rowHeight) + 8));
   const visiblePaths = (entries ?? []).slice(first, end).filter(file => file.type === "file").map(file => file.path);
   const scopeKey = JSON.stringify(visiblePaths);
-  useEffect(() => retainFileScope(backend, jobId, { dirs: [dir || "."], paths: JSON.parse(scopeKey) as string[], onDenied: () => { generation.current++; pageAbort.current?.abort(); setLoading(false); setMoreLoading(false); setEntries(null); setError("工作区访问权限已失效，请重新登录或检查任务权限"); } }), [backend, jobId, dir, scopeKey]);
+  useEffect(() => retainFileScope(backend, jobId, { dirs: [dir || "."], paths: JSON.parse(scopeKey) as string[], onDenied: message => { generation.current++; pageAbort.current?.abort(); setLoading(false); setMoreLoading(false); setEntries(null); setError(message || "工作区访问受限，请检查任务文件目录或访问权限"); } }), [backend, jobId, dir, scopeKey]);
   useEffect(() => {
     if (!listRef.current || typeof ResizeObserver === "undefined") return;
     const observer = new ResizeObserver(([box]) => { if (box.contentRect.height) setViewport(box.contentRect.height); });

package/src/board/fileScope.ts

@@ -1,6 +1,6 @@
 import type { BoardBackend } from "../core/client";
 
-type Scope = { paths: string[]; dirs: string[]; onDenied?: () => void };
+type Scope = { paths: string[]; dirs: string[]; onDenied?: (message?: string) => void };
 const scopes = new WeakMap<BoardBackend, Map<string, Map<object, Scope>>>();
 const listeners = new WeakMap<BoardBackend, Map<string, Set<() => void>>>();
 /** A preview/list owns its subscription. Unmounted/closed directories are not polled. */
@@ -17,8 +17,11 @@ export function readFileScope(backend: BoardBackend, jobId: string): Scope {
   const active = [...(scopes.get(backend)?.get(jobId)?.values() ?? [])];
   return { paths: [...new Set(active.flatMap(scope => scope.paths))].sort(), dirs: [...new Set(active.flatMap(scope => scope.dirs))].sort() };
 }
-export function denyFileScope(backend: BoardBackend, jobId: string) {
-  for (const scope of scopes.get(backend)?.get(jobId)?.values() ?? []) scope.onDenied?.();
+export function denyFileScope(backend: BoardBackend, jobId: string, message?: string, denied?: { paths: readonly string[]; dirs: readonly string[] }) {
+  for (const scope of scopes.get(backend)?.get(jobId)?.values() ?? []) {
+    // A list owns its directory; a rejected child file must not erase that list.
+    if (!denied || (scope.dirs.length ? scope.dirs.some(dir => denied.dirs.includes(dir || ".")) : scope.paths.some(path => denied.paths.includes(path)))) scope.onDenied?.(message);
+  }
 }
 export function onFileScope(backend: BoardBackend, jobId: string, listener: () => void) {
   let jobs = listeners.get(backend); if (!jobs) { jobs = new Map(); listeners.set(backend, jobs); }

package/src/board/fileSync.ts

@@ -15,7 +15,7 @@ export class FileSyncError extends Error {
 }
 export interface FileSyncProgress { phase: "manifest" | "chunks" | "verify"; loadedBytes: number; totalBytes: number; downloadedBytes: number; reusedBytes: number }
 export interface FileSyncOptions { signal?: AbortSignal; onProgress?: (progress: FileSyncProgress) => void; decode?: boolean; range?: { start?: number; maxBytes: number; tail?: boolean }; pendingTimeoutMs?: number; /** Require a manifest request started after this explicit refresh. */ fresh?: boolean; /** Remember only successfully viewed ranges, never downloads. */ preview?: boolean }
-export interface FilePreviewRefresh { changed: string[]; error?: Error }
+export interface FilePreviewRefresh { changed: string[]; error?: Error; denied?: Array<{ path: string; message: string }> }
 export interface SyncedFile {
   readonly bytes: Uint8Array<ArrayBuffer>;
   revision: string; namespace: string; hash: string; size: number; start: number; end: number; truncated: boolean;
@@ -151,7 +151,7 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
         if ([401, 403, 404].includes(status)) {
           last.delete(resource);
           if (previous) {
-            if (status === 404) { const scope = { namespace: previous.namespace, taskId: jobId, path }; retireFile(scope); await cache.purgeFile(scope); }
+            if (status === 404 || (status === 403 && (error as FileSyncError).code === "file_forbidden")) { const scope = { namespace: previous.namespace, taskId: jobId, path }; retireFile(scope); await cache.purgeFile(scope); }
             else { retireNamespace(previous.namespace); await cache.purgeNamespace(previous.namespace); }
           }
         }
@@ -261,6 +261,7 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
     // prevent several 100MiB workers allocating full buffers at the same time.
     const work = async (): Promise<FilePreviewRefresh> => {
       const changed = new Set<string>(); let error: Error | undefined, hasRecoverableError = false, retryAfterMs = 0;
+      const denied: NonNullable<FilePreviewRefresh["denied"]> = [];
       for (const path of requested) {
         if (signal?.aborted) throw aborted();
         const resource = JSON.stringify([jobId, path]), previous = previews.get(resource);
@@ -277,7 +278,14 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
           }
         } catch (failure) {
           const status = statusOf(failure);
-          if (signal?.aborted || (failure instanceof Error && failure.name === "AbortError") || status === 401 || status === 403) throw failure;
+          if (signal?.aborted || (failure instanceof Error && failure.name === "AbortError") || status === 401) throw failure;
+          if (status === 403) {
+            if ((failure as FileSyncError).code !== "file_forbidden") throw failure;
+            const scope = { namespace: last.get(resource)?.namespace ?? previous.namespace, taskId: jobId, path };
+            last.delete(resource); previews.delete(resource); retireFile(scope); await cache.purgeFile(scope);
+            changed.delete(path); denied.push({ path, message: failure instanceof Error ? failure.message : String(failure) });
+            continue;
+          }
           if (status === 404) {
             changed.add(path);
             if (previews.get(resource) === previous) {
@@ -304,7 +312,7 @@ export function createFileSynchronizer(transport: FileSyncTransport, cache = new
       }
       // Preserve the original errors: consumers may share them with other reads.
       const combined = error && hasRecoverableError && retryAfterMs > 0 ? Object.assign(new Error(error.message), error, { name: error.name, retryAfterMs }) : error;
-      return { changed: [...changed], ...(combined ? { error: combined } : {}) };
+      return { changed: [...changed], ...(combined ? { error: combined } : {}), ...(denied.length ? { denied } : {}) };
     };
     return refreshQueue.run(work, signal);
   };

package/src/board/fileSyncProcessor.ts

@@ -1,8 +1,9 @@
 import { decodeText } from "../core/textDecode";
+import { sha256 } from "../core/sha256";
 
 const aborted = () => new DOMException("文件同步已取消", "AbortError");
 const integrity = (message: string) => Object.assign(new Error(message), { status: 422, code: "integrity" });
-const digest = async (bytes: Uint8Array<ArrayBuffer>) => [...new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))].map(byte => byte.toString(16).padStart(2, "0")).join("");
+const digest = async (bytes: Uint8Array<ArrayBuffer>) => globalThis.crypto?.subtle ? [...new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))].map(byte => byte.toString(16).padStart(2, "0")).join("") : sha256(bytes);
 type Processed = { bytes: Uint8Array<ArrayBuffer>; text?: string; encoding?: string };
 
 /** One worker owns the assembled buffer; chunks are transferred, not copied into a second main-thread file. */
@@ -18,8 +19,8 @@ export class FileSyncProcessor {
   private failed: Error | null = null;
   constructor(private signal: AbortSignal) {
     if (typeof Worker !== "undefined" && typeof URL.createObjectURL === "function") try {
-      const script = `const decode=${decodeText.toString()};let output=null,offset=0;
-const hash=async b=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',b)),v=>v.toString(16).padStart(2,'0')).join('');
+      const script = `const decode=${decodeText.toString()},fallback=${sha256.toString()};let output=null,offset=0;
+const hash=async b=>globalThis.crypto?.subtle?Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',b)),v=>v.toString(16).padStart(2,'0')).join(''):fallback(b instanceof Uint8Array?b:new Uint8Array(b));
 onmessage=async({data:m})=>{try{let value;
 if(m.op==='start'){output=new Uint8Array(m.size);offset=0;value=true;}
 if(m.op==='verify'){if(await hash(m.bytes)!==m.hash)throw Error('文件块校验失败');value={bytes:m.bytes};}

package/src/board/fileSyncTransport.ts

@@ -43,8 +43,8 @@ export function createFileSyncTransport(fetcher: typeof fetch, pathBuilder: (job
         const retryAfterMs = retry ? (/^\d+(\.\d+)?$/.test(retry) ? Number(retry) * 1000 : Math.max(0, Date.parse(retry) - Date.now())) : undefined;
         const missingRoute = response.status === 501 || (response.status === 404 && !["file_not_found", "task_not_found", "job_not_found"].includes(error.error ?? ""));
         const code = missingRoute ? "unsupported" : error.error ?? "http_error";
-        const common: Record<string, string> = { node_unreachable: "执行节点暂时连不上，请稍后重试", unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_sync_unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_not_found: "文件不存在（可能已删除或改名）", file_forbidden: "文件访问权限失效，请重新登录或确认权限", file_sync_busy: "文件服务繁忙，请稍后重试", too_many_snapshot_builds: "文件服务繁忙，请稍后重试", too_many_uploads: "上传任务较多，请稍后重试", file_sync_queue_timeout: "文件处理排队超时，请稍后重试", file_sync_timeout: "文件服务响应超时，请重试", snapshot_cache_full: "文件缓存空间不足，请稍后重试", upload_storage_full: "文件上传空间不足，请稍后重试" };
-        const message = common[code] ?? ([401, 403].includes(response.status) ? "文件访问权限失效，请重新登录或确认权限" : error.detail ?? `文件同步失败（HTTP ${response.status})`);
+        const common: Record<string, string> = { node_unreachable: "执行节点暂时连不上，请稍后重试", unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_sync_unsupported: "服务端尚未支持大文件增量同步，请升级节点和中枢", file_not_found: "文件不存在（可能已删除或改名）", file_forbidden: error.detail || "文件不在当前任务允许访问的目录中，或没有访问权限", file_sync_busy: "文件服务繁忙，请稍后重试", too_many_snapshot_builds: "文件服务繁忙，请稍后重试", too_many_uploads: "上传任务较多，请稍后重试", file_sync_queue_timeout: "文件处理排队超时，请稍后重试", file_sync_timeout: "文件服务响应超时，请重试", snapshot_cache_full: "文件缓存空间不足，请稍后重试", upload_storage_full: "文件上传空间不足，请稍后重试" };
+        const message = response.status === 401 ? "登录已失效，请重新登录" : common[code] ?? (response.status === 403 ? error.detail || "没有读取该文件的权限，请检查任务访问权限" : error.detail ?? `文件同步失败（HTTP ${response.status})`);
         throw new FileSyncError(message, response.status, code, retryAfterMs);
       }
       return { response, bytes };

package/src/board/fileWatch.ts

@@ -78,12 +78,43 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
    const state={baseline:new Map(baseline),known:new Set(known)},nextDirectories=new Map(directories),nextCursors=new Map(cursors);
    try{
     const changes:WorkspaceFileChange[]=[];
+    let accessError:string|undefined;
+    const forbidden=(error:unknown)=>(error as {status?:number;code?:string})?.status===403&&(error as {code?:string}).code==='file_forbidden';
+    const deny=(error:unknown,paths:string[],dirs:string[])=>{
+     accessError=error instanceof Error?error.message:String(error);
+     denyFileScope(backend,jobId,accessError,{paths,dirs});
+    };
+    // A rejected path in a batch is not evidence that the whole task lost access.
+    // Inspect only that batch's metadata; healthy files and directories remain usable.
+    const inspect=async(paths:string[],dirs:string[])=>{
+     const listed=new Map<string,FileEntry>(),deniedPaths=new Set<string>();
+     for(const dir of dirs){
+      try{
+       const result=await requests.run(()=>backend.stat(jobId,dir||'.'),ctl.signal);if(!current())return;
+       if(result.type!=='dir')continue;
+       for(const file of result.entries)listed.set(file.path,file);
+       const revision=result.revision??JSON.stringify(result.entries.map(file=>[file.path,fingerprint(file)]));
+       if(nextDirectories.has(dir)&&nextDirectories.get(dir)!==revision)changes.push({kind:'modified',path:dir});
+       nextDirectories.set(dir,revision);
+      }catch(error){if(!current())return;if(!forbidden(error))throw error;deny(error,[],[dir||'.']);}
+     }
+     const files:FileEntry[]=[];
+     for(const path of paths){
+      const listedFile=listed.get(path);if(listedFile){files.push(listedFile);continue;}
+      try{const result=await requests.run(()=>backend.stat(jobId,path),ctl.signal);if(result.type==='file')files.push(result);}
+      catch(error){if(!current())return;if(forbidden(error)){deniedPaths.add(path);state.baseline.delete(path);state.known.delete(path);deny(error,[path],[]);}else if((error as {status?:number}).status!==404)throw error;}
+      if(!current())return;
+     }
+     changes.push(...snapshot(files,paths.filter(path=>!deniedPaths.has(path)),state));
+    };
     if(backend.pollFiles){
      const activeKeys=new Set<string>();
      const count=Math.max(Math.ceil(scope.paths.length/200),Math.ceil(scope.dirs.length/32));
      for(let index=0;index<count;index++){
       const paths=scope.paths.slice(index*200,index*200+200),dirs=scope.dirs.slice(index*32,index*32+32),key=JSON.stringify([paths,dirs]);activeKeys.add(key);
-      const batch=await requests.run(()=>backend.pollFiles!(jobId,{paths,dirs,cursor:nextCursors.get(key)},ctl.signal),ctl.signal);
+      let batch:Awaited<ReturnType<NonNullable<BoardBackend['pollFiles']>>>;
+      try{batch=await requests.run(()=>backend.pollFiles!(jobId,{paths,dirs,cursor:nextCursors.get(key)},ctl.signal),ctl.signal);}
+      catch(error){if(!forbidden(error))throw error;nextCursors.delete(key);await inspect(paths,dirs);if(!current())return;continue;}
       if(!current())return;
       if(!batch||typeof batch!=='object')throw invalidResponse('文件变化响应不完整，请重试');
       if(batch.type==='resync'){cursors.delete(key);throw new Error('文件修订已变化，请重新核对');}
@@ -99,27 +130,12 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
      for(const key of nextCursors.keys())if(!activeKeys.has(key))nextCursors.delete(key);
     }else{
      // Compatibility hosts: inspect requested entries, never recurse a workspace.
-     const listed=new Map<string,FileEntry>();
-     for(const dir of scope.dirs){
-      const result=await requests.run(()=>backend.stat(jobId,dir||'.'),ctl.signal);if(!current())return;
-      if(result.type!=='dir')continue;
-      for(const file of result.entries)listed.set(file.path,file);
-      const revision=result.revision??JSON.stringify(result.entries.map(file=>[file.path,fingerprint(file)]));
-      if(nextDirectories.has(dir)&&nextDirectories.get(dir)!==revision)changes.push({kind:'modified',path:dir});
-      nextDirectories.set(dir,revision);
-     }
-     const files:FileEntry[]=[];
-     for(const path of scope.paths){
-      const listedFile=listed.get(path);if(listedFile){files.push(listedFile);continue;}
-      try{const result=await requests.run(()=>backend.stat(jobId,path),ctl.signal);if(result.type==='file')files.push(result);}
-      catch(error){if((error as {status?:number}).status!==404)throw error;}
-      if(!current())return;
-     }
-     changes.push(...snapshot(files,scope.paths,state));
+     await inspect(scope.paths,scope.dirs);
     }
     if(!current())return;
     const previews=backend.fileSync?await refreshFilePreviews(backend.fileSync,jobId,scope.paths,ctl.signal):undefined;
     if(!current())return;
+    for(const file of previews?.denied??[])deny(new Error(file.message),[file.path],[]);
     const changedPaths=new Set(changes.map(change=>change.path));
     for(const path of previews?.changed??[])if(!changedPaths.has(path)){changes.push({kind:'modified',path});changedPaths.add(path);}
     const active=new Set(scope.paths);for(const path of state.known)if(!active.has(path)){state.known.delete(path);state.baseline.delete(path);}
@@ -127,7 +143,7 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
     baseline=state.baseline;known=state.known;directories=nextDirectories;cursors=nextCursors;
     publish(changes);
     if(previews?.error)throw previews.error;
-    failed=0;serverNotBefore=0;retryAt=0;exhaustedUntil=0;if(current())status('ready');
+    failed=0;serverNotBefore=0;retryAt=0;exhaustedUntil=0;if(current())status(accessError?'error':'ready',accessError);
    }catch(error){if(current()){
     failed++;const code=(error as {status?:number}).status??0;
     const failureCode=(error as {code?:string}).code;
@@ -139,7 +155,7 @@ export function subscribeWorkspaceFiles(backend:BoardBackend,jobId:string,listen
      retryAt=Math.max(Date.now()+base,serverNotBefore)+Math.floor(Math.random()*base/2);
      if(failed>retryDelays.length)exhaustedUntil=Math.max(Date.now()+30000,serverNotBefore);
     }
-    if([401,403].includes(code))denyFileScope(backend,jobId);
+    if([401,403].includes(code))denyFileScope(backend,jobId,error instanceof Error?error.message:undefined);
     status('error',error instanceof Error?error.message:String(error));
    }}
    finally{if(controller===ctl){

package/src/core/identity.ts

@@ -1,22 +1,10 @@
 import type { CenterClientOptions } from './client';
 import { clientId } from './id';
+import { sha256 } from './sha256';
 // A synchronous SHA-256 fingerprint partitions persistent drafts without putting
 // credentials in localStorage keys. It is never used for authentication.
-const K = [0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2];
-const rotate = (x:number,n:number)=>(x>>>n)|(x<<(32-n));
 export function connectionFingerprint(text:string):string {
- const raw=new TextEncoder().encode(text),data=new Uint8Array(Math.ceil((raw.length+9)/64)*64);data.set(raw);data[raw.length]=128;
- const view=new DataView(data.buffer);view.setUint32(data.length-8,Math.floor(raw.length/0x20000000));view.setUint32(data.length-4,(raw.length*8)>>>0);
- const hash=[0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19],w=new Int32Array(64);
- for(let offset=0;offset<data.length;offset+=64){
-  for(let i=0;i<16;i++)w[i]=view.getInt32(offset+i*4);
-  for(let i=16;i<64;i++){const x=w[i-15],y=w[i-2];w[i]=(w[i-16]+(rotate(x,7)^rotate(x,18)^(x>>>3))+w[i-7]+(rotate(y,17)^rotate(y,19)^(y>>>10)))|0;}
-  let [a,b,c,d,e,f,g,h]=hash;
-  for(let i=0;i<64;i++){const t1=(h+(rotate(e,6)^rotate(e,11)^rotate(e,25))+((e&f)^(~e&g))+K[i]+w[i])|0,t2=((rotate(a,2)^rotate(a,13)^rotate(a,22))+((a&b)^(a&c)^(b&c)))|0;
-   h=g;g=f;f=e;e=(d+t1)|0;d=c;c=b;b=a;a=(t1+t2)|0;}
-  [a,b,c,d,e,f,g,h].forEach((value,i)=>{hash[i]=(hash[i]+value)|0;});
- }
- return hash.map(value=>(value>>>0).toString(16).padStart(8,'0')).join('');
+ return sha256(new TextEncoder().encode(text));
 }
 const customScopes=new WeakMap<object,string>();
 export function connectionDraftScope(options:CenterClientOptions&{namespace?:string|null;client?:object}):string {

package/src/core/sha256.ts

@@ -0,0 +1,21 @@
+/** Keep this byte-only fallback self-contained so file workers can use the same implementation. */
+export function sha256(bytes: Uint8Array): string {
+ const K = [0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2];
+ const rotate = (x:number,n:number)=>(x>>>n)|(x<<(32-n));
+ // Only the final one or two blocks need padding; do not copy an entire large file.
+ const blockBytes=bytes.length-bytes.length%64,tail=new Uint8Array(bytes.length%64<56?64:128);
+ tail.set(bytes.subarray(blockBytes));tail[bytes.length%64]=128;
+ const input=new DataView(bytes.buffer,bytes.byteOffset,bytes.byteLength),padding=new DataView(tail.buffer);
+ padding.setUint32(tail.length-8,Math.floor(bytes.length/0x20000000));padding.setUint32(tail.length-4,(bytes.length*8)>>>0);
+ const hash=[0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19],w=new Int32Array(64);
+ for(let offset=0;offset<blockBytes+tail.length;offset+=64){
+  const view=offset<blockBytes?input:padding,base=offset<blockBytes?offset:offset-blockBytes;
+  for(let i=0;i<16;i++)w[i]=view.getInt32(base+i*4);
+  for(let i=16;i<64;i++){const x=w[i-15],y=w[i-2];w[i]=(w[i-16]+(rotate(x,7)^rotate(x,18)^(x>>>3))+w[i-7]+(rotate(y,17)^rotate(y,19)^(y>>>10)))|0;}
+  let [a,b,c,d,e,f,g,h]=hash;
+  for(let i=0;i<64;i++){const t1=(h+(rotate(e,6)^rotate(e,11)^rotate(e,25))+((e&f)^(~e&g))+K[i]+w[i])|0,t2=((rotate(a,2)^rotate(a,13)^rotate(a,22))+((a&b)^(a&c)^(b&c)))|0;
+   h=g;g=f;f=e;e=(d+t1)|0;d=c;c=b;b=a;a=(t1+t2)|0;}
+  [a,b,c,d,e,f,g,h].forEach((value,i)=>{hash[i]=(hash[i]+value)|0;});
+ }
+ return hash.map(value=>(value>>>0).toString(16).padStart(8,'0')).join('');
+}

package/src/operator/node/Layout.tsx

@@ -88,7 +88,9 @@ export function ColResize({ min, max, onWidth, onReset, side = "left" }: { min:
     const move = (e: MouseEvent) => {
       if (!dragging.current) return;
       if (side === "right") {
-        const col = ref.current?.nextElementSibling as HTMLElement | null;
+        // WorkspaceDrawer keeps display:contents wrappers on desktop; measure the visible rail.
+        const next = ref.current?.nextElementSibling as HTMLElement | null;
+        const col = next?.querySelector<HTMLElement>(".sess-rail") ?? next;
         if (!col) return;
         const right = col.getBoundingClientRect().right;
         onWidthRef.current(Math.max(min, Math.min(max, Math.round(right - e.clientX))));

package/src/operator/node/SessionRail.tsx

@@ -122,7 +122,7 @@ function ContextPane({ task, sessions, running, onClear }: { task: TaskRow; sess
   );
 }
 
-export function SessionRail({ project, task, sessions, running, onResolveWithAI, onMerged, onPrCreated, onClear, onCollapse, onSwitchToChat,
+export function SessionRail({ project, task, sessions, running, onResolveWithAI, onMerged, onPrCreated, onClear, onSwitchToChat,
   tabs, availableTabs, defaultTab, autoContext, watchFiles = true, fileWatchIntervalMs, onFilesChange, onFilesWatch, onBoardContextChange, onEvent, openRequest, onRequestHandled, onQuote, inlineLayout, onExpand, visible = true }: OperatorBoardOptions & {
   project: ProjectRow; task: TaskRow; sessions: Session[]; running: boolean;
   onResolveWithAI: (taskId: string) => Promise<ResolveResult>; onMerged?: () => void;
@@ -268,7 +268,7 @@ export function SessionRail({ project, task, sessions, running, onResolveWithAI,
       </div>
       <PanelControls toolbarRef={setToolbarHost} available={available} open={panels.open} label={label} onShow={id=>{panels.show(id);setTab(id);inlineLayout?.onActivate();}} onClose={close}
         upload={available.includes('files')?{onChoose:upload.choose,disabled:upload.busy||!uploader,hint:canUpload?undefined:'启动会话并创建工作区后可上传文件'}:undefined}/>
-      {inlineLayout ? onExpand&&<button className="rail-collapse" onClick={onExpand} title="展开右侧看板" aria-label="展开看板">{Icon.chevRight()}</button> : <button className="rail-collapse" onClick={onCollapse} title="隐藏面板" aria-label="隐藏看板">{Icon.chevRight()}</button>}
+      {inlineLayout && onExpand && <button className="rail-collapse" onClick={onExpand} title="展开右侧看板" aria-label="展开看板">{Icon.chevRight()}</button>}
     </div>;
   return <aside className={`sess-rail${inlineLayout?' sess-rail-inline':''}`} aria-label="任务看板" hidden={!contentVisible} style={!contentVisible?{display:'none'}:undefined} onPointerDown={()=>activateBoardState(task.id,owner)} onClickCapture={()=>activateBoardState(task.id,owner)} onFocusCapture={()=>activateBoardState(task.id,owner)}>
     {inlineLayout ? inlineLayout.tabsHost&&createPortal(railTabs,inlineLayout.tabsHost) : railTabs}

package/src/operator.base.css

@@ -1871,6 +1871,12 @@ button.pop-item:hover{background:var(--surface-2);}
 [data-chat-layout]>.cli-refs,[data-chat-layout]>.cli-queue{width:calc(100% - 2 * var(--cli-chat-gutter) - var(--cli-chat-scrollbar,0px));max-width:var(--cli-chat-content-max);margin-inline:auto;margin-inline-start:max(var(--cli-chat-gutter),calc((100% - var(--cli-chat-scrollbar,0px) - var(--cli-chat-content-max)) / 2));flex-shrink:0;}
 @container chat-column (max-width:900px){[data-chat-layout]>*{--cli-chat-content-max:100%;}}
 @container chat-column (max-width:640px){[data-chat-layout]>*{--cli-chat-gutter:12px;}.session [data-chat-layout]>.composer{padding-inline-end:var(--cli-chat-gutter);}}
+@media (min-width:761px){
+  [data-chat-layout]{--cli-chat-gutter:32px;}
+  .session [data-chat-layout] .composer{padding-inline:var(--cli-chat-gutter);padding-inline-end:calc(var(--cli-chat-gutter) + var(--cli-chat-scrollbar,0px));}
+  [data-chat-layout] .composer>.composer-inner{width:100%;max-width:var(--cli-chat-content-max);margin-inline:auto;}
+  @container chat-column (max-width:640px){[data-chat-layout]>*{--cli-chat-gutter:24px;}.session [data-chat-layout] .composer{padding-inline-end:var(--cli-chat-gutter);}}
+}
 .task-origin{display:flex;align-items:center;gap:5px;font-size:10px;color:var(--ink-3);padding-top:7px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;}
 .fork-sources{display:flex;flex-wrap:wrap;gap:6px;padding:12px 14px 0;}
 .fork-sources>span{max-width:100%;display:flex;align-items:center;gap:6px;padding:6px 8px;border:1px solid var(--line);background:var(--surface-2);border-radius:8px;font-size:11px;color:var(--ink-2);overflow-wrap:anywhere;}

package/src/operator.css

@@ -1871,6 +1871,12 @@
 .cli-ui [data-chat-layout]>.cli-refs,.cli-ui [data-chat-layout]>.cli-queue{width:calc(100% - 2 * var(--cli-chat-gutter) - var(--cli-chat-scrollbar,0px));max-width:var(--cli-chat-content-max);margin-inline:auto;margin-inline-start:max(var(--cli-chat-gutter),calc((100% - var(--cli-chat-scrollbar,0px) - var(--cli-chat-content-max)) / 2));flex-shrink:0;}
 @container chat-column (max-width:900px){.cli-ui [data-chat-layout]>*{--cli-chat-content-max:100%;}}
 @container chat-column (max-width:640px){.cli-ui [data-chat-layout]>*{--cli-chat-gutter:12px;}.cli-ui .session [data-chat-layout]>.composer{padding-inline-end:var(--cli-chat-gutter);}}
+@media (min-width:761px){
+  .cli-ui [data-chat-layout]{--cli-chat-gutter:32px;}
+  .cli-ui .session [data-chat-layout] .composer{padding-inline:var(--cli-chat-gutter);padding-inline-end:calc(var(--cli-chat-gutter) + var(--cli-chat-scrollbar,0px));}
+  .cli-ui [data-chat-layout] .composer>.composer-inner{width:100%;max-width:var(--cli-chat-content-max);margin-inline:auto;}
+  @container chat-column (max-width:640px){.cli-ui [data-chat-layout]>*{--cli-chat-gutter:24px;}.cli-ui .session [data-chat-layout] .composer{padding-inline-end:var(--cli-chat-gutter);}}
+}
 .cli-ui .task-origin{display:flex;align-items:center;gap:5px;font-size:10px;color:var(--ink-3);padding-top:7px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;}
 .cli-ui .fork-sources{display:flex;flex-wrap:wrap;gap:6px;padding:12px 14px 0;}
 .cli-ui .fork-sources>span{max-width:100%;display:flex;align-items:center;gap:6px;padding:6px 8px;border:1px solid var(--line);background:var(--surface-2);border-radius:8px;font-size:11px;color:var(--ink-2);overflow-wrap:anywhere;}