@wendongfly/myhi 1.3.98 → 1.3.101

package/dist/admin.html

@@ -143,6 +143,32 @@
     <div class="msg" id="gw-msg"></div>
   </div>
 
+  <!-- 命名密钥库 -->
+  <div class="card">
+    <h3>密钥库（Secret Vault）</h3>
+    <div style="font-size:0.75rem;color:#6e7681;margin-bottom:0.6rem;line-height:1.5">
+      集中存 GitLab PAT / 部署 token / 网关 key / 证书等敏感值，spawn 会话时注入成环境变量，AI/命令用
+      <code style="background:#161b22;padding:0.1em 0.3em;border-radius:3px">$名字</code>
+      引用——密钥值不进聊天、不落 transcript。类型选「文件」（证书等）时注入的是路径
+      <code style="background:#161b22;padding:0.1em 0.3em;border-radius:3px">$MYHI_SECRET_名字</code>。
+      作用域「项目」仅注给该 cwd 的会话（最小权限）。<b>密钥值绝不写进记忆/CLAUDE.md。</b>
+    </div>
+    <div id="sec-list" style="margin-bottom:0.6rem"></div>
+    <div class="inp-row" style="gap:0.4rem;flex-wrap:wrap">
+      <input type="text" class="inp" id="sec-name" placeholder="名字（如 GITLAB_PAT，作环境变量名）" style="flex:1;min-width:150px">
+      <select class="inp" id="sec-type" style="max-width:90px"><option value="env">变量</option><option value="file">文件</option></select>
+      <select class="inp" id="sec-scope" style="max-width:100px" onchange="toggleSecScope()"><option value="global">全局</option><option value="project">项目</option></select>
+    </div>
+    <div class="inp-row" id="sec-cwd-row" style="margin-top:0.4rem;display:none">
+      <input type="text" class="inp" id="sec-cwd" placeholder="项目 cwd（如 D:\project\myhi）">
+    </div>
+    <div class="inp-row" style="margin-top:0.4rem">
+      <input type="password" class="inp" id="sec-value" placeholder="密钥值 / 证书内容（编辑时留空保持不变）">
+      <button class="btn-sm" onclick="addSecret()">保存</button>
+    </div>
+    <div class="msg" id="sec-msg"></div>
+  </div>
+
   <div class="uptime" id="uptime"></div>
 </div>
 
@@ -175,6 +201,74 @@ async function showAdmin() {
   await refresh();
   setInterval(refresh, 10000);
   loadGateway();
+  loadSecrets();
+}
+
+function toggleSecScope() {
+  const isProj = document.getElementById('sec-scope').value === 'project';
+  document.getElementById('sec-cwd-row').style.display = isProj ? '' : 'none';
+}
+
+function escHtml(s) { return String(s).replace(/[&<>"]/g, c => ({ '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;' }[c])); }
+
+async function loadSecrets() {
+  try {
+    const r = await fetch('/api/secrets', { headers: H() });
+    if (!r.ok) return;
+    const d = await r.json();
+    const box = document.getElementById('sec-list');
+    let html = '';
+    const row = (s, scope, cwd) => `<div style="display:flex;align-items:center;gap:0.5rem;padding:0.25rem 0;border-bottom:1px solid #21262d;font-size:0.8rem">
+      <span style="color:#e6edf3;font-family:monospace">${escHtml(s.name)}</span>
+      <span style="color:#6e7681">${s.type === 'file' ? '📄文件' : '🔑变量'}</span>
+      <span style="color:#6e7681;font-family:monospace;flex:1">${escHtml(s.preview)}</span>
+      <button class="btn-sm" style="padding:0.1rem 0.5rem" onclick="delSecret('${escHtml(s.name)}','${scope}','${escHtml(cwd || '')}')">删</button>
+    </div>`;
+    if (d.global && d.global.length) {
+      html += '<div style="color:#8b949e;font-size:0.72rem;margin:0.2rem 0">全局</div>';
+      html += d.global.map(s => row(s, 'global', '')).join('');
+    }
+    for (const p of (d.projects || [])) {
+      if (!p.secrets.length) continue;
+      html += `<div style="color:#8b949e;font-size:0.72rem;margin:0.4rem 0 0.2rem;font-family:monospace">项目 ${escHtml(p.cwd)}</div>`;
+      html += p.secrets.map(s => row(s, 'project', p.cwd)).join('');
+    }
+    box.innerHTML = html || '<div style="color:#6e7681;font-size:0.78rem">（暂无密钥）</div>';
+  } catch {}
+}
+
+async function addSecret() {
+  const name = document.getElementById('sec-name').value.trim();
+  const value = document.getElementById('sec-value').value;
+  const type = document.getElementById('sec-type').value;
+  const scope = document.getElementById('sec-scope').value;
+  const cwd = document.getElementById('sec-cwd').value.trim();
+  const msg = document.getElementById('sec-msg');
+  try {
+    const r = await fetch('/api/secrets', { method: 'POST', headers: H(), body: JSON.stringify({ name, value, type, scope, cwd }) });
+    const d = await r.json();
+    if (d.ok) {
+      msg.className = 'msg msg-ok';
+      msg.textContent = '已保存，新建（该作用域的）会话自动生效';
+      document.getElementById('sec-name').value = '';
+      document.getElementById('sec-value').value = '';
+      loadSecrets();
+    } else {
+      msg.className = 'msg msg-err';
+      msg.textContent = d.error || '失败';
+    }
+  } catch {
+    msg.className = 'msg msg-err';
+    msg.textContent = '连接失败';
+  }
+}
+
+async function delSecret(name, scope, cwd) {
+  if (!confirm(`删除密钥 ${name}？`)) return;
+  try {
+    await fetch('/api/secrets', { method: 'DELETE', headers: H(), body: JSON.stringify({ name, scope, cwd }) });
+    loadSecrets();
+  } catch {}
 }
 
 async function loadGateway() {

package/dist/attach.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{createRequire as e}from"module";if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=new URL(".",import.meta.url).pathname.slice(import.meta.url.match(/^file:\/\/\/\w:/)?1:0,-1)+"/";var t={};const s=e(import.meta.url)("module");const r=e(import.meta.url)("fs");const o=e(import.meta.url)("path");const n=e(import.meta.url)("os");const i=e(import.meta.url)("readline");const c=(0,s.createRequire)(import.meta.url);const{io:p}=c("socket.io-client");const a=process.env.MYHI_SERVER||"http://localhost:12300";let m=null;const d=process.argv.slice(2);for(let e=0;e<d.length;e++){if((d[e]==="--password"||d[e]==="-pw")&&d[e+1]){m=d[e+1];d.splice(e,2);e--}}let u;if(m){u={password:m}}else{try{u={token:(0,r.readFileSync)((0,o.join)((0,n.homedir)(),".myhi","token"),"utf8").trim()}}catch{console.error("[myhi] 未找到 token，请使用 --password <密码> 或先启动服务器");process.exit(1)}}function cleanup(e){try{process.stdin.setRawMode(false)}catch{}process.stdin.pause();e.disconnect()}function attach(e,t){e.emit("join",t);e.on("joined",(s=>{const r=s.mode==="agent";process.stderr.write(`\r\n[myhi] 已附加到 "${s.title}" (${t}) 模式=${r?"agent":"pty"}\r\n`);process.stderr.write("[myhi] 按 Ctrl+] 分离\r\n\r\n");e.emit("take-control",{sessionId:t});if(r){let t="";e.on("agent:message",(e=>{if(!e)return;switch(e.type){case"system":if(e.subtype==="init")process.stderr.write("[会话已连接]\r\n");else if(e.subtype==="interrupted")process.stderr.write("\r\n[已中断]\r\n");break;case"assistant":if(e.message?.content){for(const t of e.message.content){if(t.type==="text")process.stdout.write(t.text+"\r\n");else if(t.type==="tool_use"){process.stdout.write(`\r\n[工具] ${t.name}\r\n`);if(t.input){const e=typeof t.input==="string"?t.input:JSON.stringify(t.input,null,2);process.stdout.write(""+e.slice(0,500)+"\r\n")}}}}break;case"content_block_delta":if(e.delta?.text){process.stdout.write(e.delta.text);t+=e.delta.text}break;case"content_block_stop":if(t){process.stdout.write("\r\n");t=""}break;case"tool_use":process.stdout.write(`\r\n[工具] ${e.tool_name||e.name||"?"}\r\n`);break;case"tool_result":if(e.content){const t=typeof e.content==="string"?e.content:Array.isArray(e.content)?e.content.map((e=>e.text||"")).join(""):"";if(t)process.stdout.write(""+t.slice(0,1e3)+"\r\n")}break;case"result":process.stdout.write(`\r\n[完成] ${e.duration_ms?(e.duration_ms/1e3).toFixed(1)+"s":""} ${e.total_cost_usd?"$"+e.total_cost_usd.toFixed(4):""}\r\n\r\n`);break}}));e.on("agent:history",(e=>{for(const t of e){if(t.type==="user")process.stdout.write(`> ${t.content}\r\n`);else if(t.type==="result")process.stdout.write("[完成]\r\n")}process.stdout.write("\r\n")}));e.on("agent:busy",(e=>{if(e)process.stderr.write("[思考中...]\r\n")}));e.on("agent:error",(e=>{process.stderr.write(`[错误] ${e.message}\r\n`)}));const s=(0,i.createInterface)({input:process.stdin,output:process.stdout,prompt:"> "});let r=false;e.on("agent:busy",(e=>{r=e;if(!e)s.prompt()}));s.prompt();s.on("line",(t=>{const o=t.trim();if(!o){if(!r)s.prompt();return}if(o==="/quit"||o==="/exit"||o==="/q"){process.stderr.write("[myhi] 已分离\r\n");cleanup(e);process.exit(0)}if(r){process.stderr.write("[正在处理中，请等待]\r\n");return}e.emit("agent:query",{prompt:o})}));s.on("close",(()=>{cleanup(e);process.exit(0)}))}else{try{process.stdin.setRawMode(true)}catch{}process.stdin.resume();process.stdin.setEncoding("binary");process.stdin.on("data",(t=>{if(t===""){process.stderr.write("\r\n[myhi] 已分离\r\n");cleanup(e);process.exit(0)}e.emit("input",t)}));e.on("output",(e=>{process.stdout.write(e,"binary")}));process.stdout.on("resize",(()=>{e.emit("resize",{cols:process.stdout.columns||80,rows:process.stdout.rows||24})}))}}));e.on("control-denied",(({reason:e})=>{process.stderr.write(`\r\n[myhi] 获取控制权失败: ${e}\r\n`)}));e.on("control-changed",(({holder:t,holderName:s})=>{if(t&&t!==e.id){process.stderr.write(`\r\n[myhi] ${s||"其他用户"} 已获取控制权，当前为只读\r\n`)}else if(!t){process.stderr.write("\r\n[myhi] 控制权已释放\r\n")}}));e.on("kicked",(({reason:t})=>{process.stderr.write(`\r\n[myhi] ${t||"你已被管理员踢出"}\r\n`);cleanup(e);process.exit(1)}));e.on("session-exit",(({code:t})=>{process.stderr.write(`\r\n[myhi] 会话已退出 (code ${t})\r\n`);cleanup(e);process.exit(0)}));e.on("error",(({message:t})=>{process.stderr.write(`\r\n[myhi] 错误: ${t}\r\n`);cleanup(e);process.exit(1)}))}async function pickSession(e){return new Promise((t=>{e.emit("list");e.once("sessions",(s=>{const r=s.filter((e=>e.alive));if(!r.length){process.stderr.write("[myhi] 没有活跃的会话。\n");cleanup(e);process.exit(0)}process.stdout.write("\n活跃会话:\n");r.forEach(((e,t)=>{const s=e.viewers>0?` (${e.viewers} 人在线)`:"";const r=e.mode==="agent"?" [Agent]":" [PTY]";process.stdout.write(`  [${t+1}] ${e.title}${r}${s}  — ${e.id}\n`)}));process.stdout.write("\n");const o=(0,i.createInterface)({input:process.stdin,output:process.stdout});o.question("选择会话编号: ",(s=>{o.close();const n=parseInt(s,10)-1;if(n<0||n>=r.length){process.stderr.write("[myhi] 无效的选择。\n");cleanup(e);process.exit(1)}t(r[n].id)}))}))}))}async function createAndAttach(e,t){return new Promise((s=>{e.emit("create",t,(t=>{if(!t?.ok){process.stderr.write(`[myhi] 创建失败: ${t?.error||"未知错误"}\n`);cleanup(e);process.exit(1)}process.stdout.write(`[myhi] 已创建会话 "${t.session.title}" — ${t.session.id}\n`);s(t.session.id)}))}))}async function promptNew(e){const t=(0,i.createInterface)({input:process.stdin,output:process.stdout});const ask=e=>new Promise((s=>t.question(e,s)));const s=(await ask("会话名称 [shell]: ")).trim()||"shell";const r=(await ask("启动命令（可选）: ")).trim()||undefined;t.close();return createAndAttach(e,{title:s,initCmd:r})}const l=p(a,{transports:["websocket","polling"],auth:u});l.on("connect_error",(e=>{process.stderr.write(`[myhi] 连接失败: ${e.message}\n`);process.exit(1)}));l.on("connect",(async()=>{const e=d[0];if(e==="--new"){const e=d[1];const t=d[2]||undefined;const s=e?await createAndAttach(l,{title:e,initCmd:t}):await promptNew(l);attach(l,s)}else{const t=e||await pickSession(l);attach(l,t)}}));for(const e of["SIGINT","SIGTERM"]){process.on(e,(()=>{cleanup(l);process.exit(0)}))}process.on("exit",(()=>{try{process.stdin.setRawMode(false)}catch{}}));
+import{createRequire as e}from"module";if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=new URL(".",import.meta.url).pathname.slice(import.meta.url.match(/^file:\/\/\/\w:/)?1:0,-1)+"/";var t={};const s=e(import.meta.url)("module");const r=e(import.meta.url)("fs");const o=e(import.meta.url)("path");const n=e(import.meta.url)("os");const i=e(import.meta.url)("readline");const c=(0,s.createRequire)(import.meta.url);const{io:p}=c("socket.io-client");const a=process.env.MYHI_SERVER||"http://localhost:12300";let m=null;const u=process.argv.slice(2);for(let e=0;e<u.length;e++){if((u[e]==="--password"||u[e]==="-pw")&&u[e+1]){m=u[e+1];u.splice(e,2);e--}}let d;if(m){d={password:m}}else{try{d={token:(0,r.readFileSync)((0,o.join)((0,n.homedir)(),".myhi","token"),"utf8").trim()}}catch{console.error("[myhi] 未找到 token，请使用 --password <密码> 或先启动服务器");process.exit(1)}}function cleanup(e){try{process.stdin.setRawMode(false)}catch{}process.stdin.pause();e.disconnect()}function attach(e,t){e.emit("join",t);e.on("joined",(s=>{const r=s.mode==="agent";process.stderr.write(`\r\n[myhi] 已附加到 "${s.title}" (${t}) 模式=${r?"agent":"pty"}\r\n`);process.stderr.write("[myhi] 按 Ctrl+] 分离\r\n\r\n");e.emit("take-control",{sessionId:t});if(r){let t="";e.on("agent:message",(e=>{if(!e)return;switch(e.type){case"system":if(e.subtype==="init")process.stderr.write("[会话已连接]\r\n");else if(e.subtype==="interrupted")process.stderr.write("\r\n[已中断]\r\n");break;case"assistant":if(e.message?.content){for(const t of e.message.content){if(t.type==="text")process.stdout.write(t.text+"\r\n");else if(t.type==="tool_use"){const e=t.name==="Task"?`子代理 · ${t.input&&t.input.subagent_type||"general-purpose"}`:t.name;process.stdout.write(`\r\n[工具] ${e}\r\n`);if(t.input){const e=typeof t.input==="string"?t.input:JSON.stringify(t.input,null,2);process.stdout.write(""+e.slice(0,500)+"\r\n")}}}}break;case"content_block_delta":if(e.delta?.text){process.stdout.write(e.delta.text);t+=e.delta.text}break;case"content_block_stop":if(t){process.stdout.write("\r\n");t=""}break;case"tool_use":process.stdout.write(`\r\n[工具] ${e.tool_name||e.name||"?"}\r\n`);break;case"tool_result":if(e.content){const t=typeof e.content==="string"?e.content:Array.isArray(e.content)?e.content.map((e=>e.text||"")).join(""):"";if(t)process.stdout.write(""+t.slice(0,1e3)+"\r\n")}break;case"result":process.stdout.write(`\r\n[完成] ${e.duration_ms?(e.duration_ms/1e3).toFixed(1)+"s":""} ${e.total_cost_usd?"$"+e.total_cost_usd.toFixed(4):""}\r\n\r\n`);break}}));e.on("agent:history",(e=>{for(const t of e){if(t.type==="user")process.stdout.write(`> ${t.content}\r\n`);else if(t.type==="result")process.stdout.write("[完成]\r\n")}process.stdout.write("\r\n")}));e.on("agent:busy",(e=>{if(e)process.stderr.write("[思考中...]\r\n")}));e.on("agent:error",(e=>{process.stderr.write(`[错误] ${e.message}\r\n`)}));const s=(0,i.createInterface)({input:process.stdin,output:process.stdout,prompt:"> "});let r=false;e.on("agent:busy",(e=>{r=e;if(!e)s.prompt()}));s.prompt();s.on("line",(t=>{const o=t.trim();if(!o){if(!r)s.prompt();return}if(o==="/quit"||o==="/exit"||o==="/q"){process.stderr.write("[myhi] 已分离\r\n");cleanup(e);process.exit(0)}if(r){process.stderr.write("[正在处理中，请等待]\r\n");return}e.emit("agent:query",{prompt:o})}));s.on("close",(()=>{cleanup(e);process.exit(0)}))}else{try{process.stdin.setRawMode(true)}catch{}process.stdin.resume();process.stdin.setEncoding("binary");process.stdin.on("data",(t=>{if(t===""){process.stderr.write("\r\n[myhi] 已分离\r\n");cleanup(e);process.exit(0)}e.emit("input",t)}));e.on("output",(e=>{process.stdout.write(e,"binary")}));process.stdout.on("resize",(()=>{e.emit("resize",{cols:process.stdout.columns||80,rows:process.stdout.rows||24})}))}}));e.on("control-denied",(({reason:e})=>{process.stderr.write(`\r\n[myhi] 获取控制权失败: ${e}\r\n`)}));e.on("control-changed",(({holder:t,holderName:s})=>{if(t&&t!==e.id){process.stderr.write(`\r\n[myhi] ${s||"其他用户"} 已获取控制权，当前为只读\r\n`)}else if(!t){process.stderr.write("\r\n[myhi] 控制权已释放\r\n")}}));e.on("kicked",(({reason:t})=>{process.stderr.write(`\r\n[myhi] ${t||"你已被管理员踢出"}\r\n`);cleanup(e);process.exit(1)}));e.on("session-exit",(({code:t})=>{process.stderr.write(`\r\n[myhi] 会话已退出 (code ${t})\r\n`);cleanup(e);process.exit(0)}));e.on("error",(({message:t})=>{process.stderr.write(`\r\n[myhi] 错误: ${t}\r\n`);cleanup(e);process.exit(1)}))}async function pickSession(e){return new Promise((t=>{e.emit("list");e.once("sessions",(s=>{const r=s.filter((e=>e.alive));if(!r.length){process.stderr.write("[myhi] 没有活跃的会话。\n");cleanup(e);process.exit(0)}process.stdout.write("\n活跃会话:\n");r.forEach(((e,t)=>{const s=e.viewers>0?` (${e.viewers} 人在线)`:"";const r=e.mode==="agent"?" [Agent]":" [PTY]";process.stdout.write(`  [${t+1}] ${e.title}${r}${s}  — ${e.id}\n`)}));process.stdout.write("\n");const o=(0,i.createInterface)({input:process.stdin,output:process.stdout});o.question("选择会话编号: ",(s=>{o.close();const n=parseInt(s,10)-1;if(n<0||n>=r.length){process.stderr.write("[myhi] 无效的选择。\n");cleanup(e);process.exit(1)}t(r[n].id)}))}))}))}async function createAndAttach(e,t){return new Promise((s=>{e.emit("create",t,(t=>{if(!t?.ok){process.stderr.write(`[myhi] 创建失败: ${t?.error||"未知错误"}\n`);cleanup(e);process.exit(1)}process.stdout.write(`[myhi] 已创建会话 "${t.session.title}" — ${t.session.id}\n`);s(t.session.id)}))}))}async function promptNew(e){const t=(0,i.createInterface)({input:process.stdin,output:process.stdout});const ask=e=>new Promise((s=>t.question(e,s)));const s=(await ask("会话名称 [shell]: ")).trim()||"shell";const r=(await ask("启动命令（可选）: ")).trim()||undefined;t.close();return createAndAttach(e,{title:s,initCmd:r})}const l=p(a,{transports:["websocket","polling"],auth:d});l.on("connect_error",(e=>{process.stderr.write(`[myhi] 连接失败: ${e.message}\n`);process.exit(1)}));l.on("connect",(async()=>{const e=u[0];if(e==="--new"){const e=u[1];const t=u[2]||undefined;const s=e?await createAndAttach(l,{title:e,initCmd:t}):await promptNew(l);attach(l,s)}else{const t=e||await pickSession(l);attach(l,t)}}));for(const e of["SIGINT","SIGTERM"]){process.on(e,(()=>{cleanup(l);process.exit(0)}))}process.on("exit",(()=>{try{process.stdin.setRawMode(false)}catch{}}));

package/dist/chat.html

@@ -382,7 +382,6 @@
       <button class="sk sk-claude" onclick="openResumeSheet()">恢复</button>
       <button class="sk sk-claude" onclick="doCompact()">压缩</button>
       <button class="sk sk-claude" data-cmd="/clear">清除</button>
-      <button class="sk sk-claude" onclick="doRename()">命名</button>
       <button class="sk sk-claude" onclick="openGitSheet()" style="color:var(--green)">提交</button>
       <button class="sk" data-send="ctrl-c">Ctrl+C</button>
       <button class="sk" data-send="esc">Esc</button>
@@ -393,7 +392,7 @@
       <button class="sk sk-claude" onclick="doSlashCmd('/compact')">压缩</button>
       <button class="sk sk-claude" onclick="openResumeSheet()">恢复</button>
       <button class="sk sk-claude" onclick="doClear()">清除</button>
-      <button class="sk sk-claude" onclick="doSlashCmd('/rename')">命名</button>
+      <button class="sk sk-claude" onclick="openSecretsSheet()" style="color:var(--blue2)">🔑 密钥</button>
       <button class="sk sk-claude" onclick="openGitSheet()" style="color:var(--green)">提交</button>
       <button class="sk sk-claude" onclick="showMemory()">记忆</button>
       <button class="sk sk-claude" onclick="openVaSheet()" style="color:var(--blue2)">语音</button>
@@ -534,6 +533,27 @@
     </div>
   </div>
 
+  <!-- 项目密钥（会话级，绑定本会话 cwd） -->
+  <div id="secrets-sheet" class="action-sheet">
+    <div class="action-sheet-backdrop" onclick="closeSecretsSheet()"></div>
+    <div class="action-sheet-box" style="max-height:82vh;display:flex;flex-direction:column">
+      <div class="action-sheet-title">项目密钥 · 本会话</div>
+      <div style="font-size:0.68rem;color:var(--muted);padding:0 0.2rem 0.4rem;line-height:1.5">
+        只注入到<b>本项目 (cwd) 的会话</b>，命令里用 <code>$名字</code> 引用（证书类型用 <code>$MYHI_SECRET_名字</code>）。密钥值不进聊天。新增后需 <b>清除/重开会话</b>才注入进环境变量。
+      </div>
+      <div id="sec-sheet-list" style="flex:1;overflow-y:auto;padding:0.2rem 0;font-size:0.8rem;scrollbar-width:thin"></div>
+      <div style="padding:0.3rem 0.2rem;display:flex;flex-direction:column;gap:0.4rem;border-top:1px solid var(--surface2)">
+        <div style="display:flex;gap:0.4rem">
+          <input id="sec-sheet-name" class="slash-inp" placeholder="名字 如 GITLAB_PAT" autocomplete="off" style="flex:1">
+          <select id="sec-sheet-type" class="slash-inp" style="max-width:88px"><option value="env">变量</option><option value="file">文件</option></select>
+        </div>
+        <input id="sec-sheet-value" class="slash-inp" type="password" placeholder="密钥值 / 证书内容" autocomplete="off">
+      </div>
+      <button class="action-sheet-cancel" style="background:var(--blue2);color:#fff;font-weight:600;margin-bottom:0.4rem" onclick="addProjectSecret()">保存密钥</button>
+      <button class="action-sheet-cancel" onclick="closeSecretsSheet()">关闭</button>
+    </div>
+  </div>
+
   <div id="memory-sheet" class="action-sheet">
     <div class="action-sheet-backdrop" onclick="closeMemorySheet()"></div>
     <div class="action-sheet-box" style="max-height:80vh;display:flex;flex-direction:column">
@@ -932,7 +952,7 @@
 
       // 工具调用（Claude Code 使用 box-drawing 字符或特定标签）
       if (/^[╭┌│╰┘╮┐└┤├]/.test(lines[0]?.trim()) ||
-          /^\s*(Read|Edit|Write|Bash|Grep|Glob|WebFetch|WebSearch|LSP|TodoRead|TodoWrite|Agent)\s*[:(]/i.test(lines[0]?.trim())) {
+          /^\s*(Read|Edit|Write|Bash|Grep|Glob|WebFetch|WebSearch|LSP|TodoRead|TodoWrite|Task|Agent)\s*[:(]/i.test(lines[0]?.trim())) {
         return { type: 'tool', name: extractToolName(clean) };
       }
 
@@ -950,11 +970,22 @@
     }
 
     function extractToolName(clean) {
-      const m = clean.match(/^\s*(Read|Edit|Write|Bash|Grep|Glob|WebFetch|WebSearch|LSP|TodoRead|TodoWrite|Agent)/i);
+      const m = clean.match(/^\s*(Read|Edit|Write|Bash|Grep|Glob|WebFetch|WebSearch|LSP|TodoRead|TodoWrite|Task|Agent)/i);
       return m ? m[1] : '工具';
     }
 
-    const TOOL_ICONS = { Read:'📄', Edit:'✏️', Write:'📝', Bash:'💻', Grep:'🔍', Glob:'📂', WebFetch:'🌐', WebSearch:'🔎', LSP:'🔧', Agent:'🤖' };
+    const TOOL_ICONS = { Read:'📄', Edit:'✏️', Write:'📝', Bash:'💻', Grep:'🔍', Glob:'📂', WebFetch:'🌐', WebSearch:'🔎', LSP:'🔧', Task:'🤖', Agent:'🤖' };
+
+    // 子代理（Task 工具）渲染：把 subagent_type / description / prompt 拆开展示，
+    // 而不是甩一坨 input JSON。返回 { label, body } 交给 addToolMessage。
+    function subagentToolInfo(input) {
+      const type = (input && input.subagent_type) || 'general-purpose';
+      const desc = (input && input.description) || '';
+      const prompt = (input && input.prompt) || '';
+      const label = `子代理 · ${type}`;
+      const body = (desc ? `📋 ${desc}\n\n` : '') + (prompt || JSON.stringify(input || {}, null, 2));
+      return { label, body };
+    }
 
     // ── 消息渲染 ──────────────────────────────────
     function addInputMessage(text) {
@@ -1210,7 +1241,7 @@
       // 造成「文本堆在上面、工具回显落在后面」的错序——重进后按 history 顺序回放才正常。
       endStream();
       removeThinking();
-      const icon = TOOL_ICONS[toolName] || '🔧';
+      const icon = TOOL_ICONS[toolName] || (typeof toolName === 'string' && toolName.startsWith('子代理') ? '🤖' : '🔧');
       const collapsed = settings.collapseTools;
 
       // 创建单个工具项
@@ -1652,7 +1683,12 @@
                 if (block.name === 'AskUserQuestion' && block.input) {
                   openAskSheet(block.input);
                 }
-                addToolMessage(JSON.stringify(block.input || {}, null, 2), block.name || '工具');
+                if (block.name === 'Task' && block.input) {
+                  const info = subagentToolInfo(block.input);
+                  addToolMessage(info.body, info.label);
+                } else {
+                  addToolMessage(JSON.stringify(block.input || {}, null, 2), block.name || '工具');
+                }
               } else if (block.type === 'tool_result') {
                 const content = typeof block.content === 'string' ? block.content : JSON.stringify(block.content);
                 addRawOutput(content);
@@ -1714,7 +1750,12 @@
           if (msg.name === 'AskUserQuestion' && msg.input) {
             openAskSheet(msg.input);
           }
-          addToolMessage(JSON.stringify(msg.input || {}, null, 2), msg.name || '工具');
+          if (msg.name === 'Task' && msg.input) {
+            const info = subagentToolInfo(msg.input);
+            addToolMessage(info.body, info.label);
+          } else {
+            addToolMessage(JSON.stringify(msg.input || {}, null, 2), msg.name || '工具');
+          }
           setWorkState('working');
           break;
         case 'tool_result':
@@ -2785,6 +2826,69 @@
       }
     };
 
+    // ── 项目密钥（会话级，绑定本会话 cwd；普通登录即可，非 admin）─────────
+    window.openSecretsSheet = function() {
+      document.getElementById('secrets-sheet').classList.add('open');
+      loadProjectSecrets();
+    };
+    window.closeSecretsSheet = function() {
+      document.getElementById('secrets-sheet').classList.remove('open');
+    };
+    async function loadProjectSecrets() {
+      const box = document.getElementById('sec-sheet-list');
+      box.innerHTML = '<div style="text-align:center;color:var(--muted);padding:1rem 0">加载中...</div>';
+      try {
+        const r = await fetch(`/api/session/${SESSION_ID}/secrets`);
+        if (!r.ok) { box.innerHTML = '<div style="color:var(--muted);padding:0.5rem">读取失败</div>'; return; }
+        const d = await r.json();
+        const row = (s, isGlobal) => `<div style="display:flex;align-items:center;gap:0.5rem;padding:0.3rem 0.2rem;border-bottom:1px solid var(--surface2)">
+          <span style="font-family:monospace;color:var(--text)">${escHtml(s.name)}</span>
+          <span style="color:var(--muted);font-size:0.7rem">${s.type === 'file' ? '📄' : '🔑'}</span>
+          <span style="flex:1;font-family:monospace;color:var(--muted);font-size:0.72rem">${escHtml(s.preview)}</span>
+          ${isGlobal ? '<span style="color:var(--muted);font-size:0.68rem">全局·只读</span>'
+                     : `<button class="sk sk-claude" style="padding:0.05rem 0.5rem" onclick="delProjectSecret('${escHtml(s.name)}')">删</button>`}
+        </div>`;
+        let html = '';
+        if (d.project && d.project.length) {
+          html += '<div style="color:var(--muted);font-size:0.7rem;margin:0.2rem 0">本项目</div>' + d.project.map(s => row(s, false)).join('');
+        } else {
+          html += '<div style="color:var(--muted);font-size:0.75rem;padding:0.3rem">（本项目暂无密钥）</div>';
+        }
+        if (d.global && d.global.length) {
+          html += '<div style="color:var(--muted);font-size:0.7rem;margin:0.5rem 0 0.2rem">继承自全局</div>' + d.global.map(s => row(s, true)).join('');
+        }
+        box.innerHTML = html;
+      } catch { box.innerHTML = '<div style="color:var(--muted);padding:0.5rem">连接失败</div>'; }
+    }
+    window.addProjectSecret = async function() {
+      const name = document.getElementById('sec-sheet-name').value.trim();
+      const value = document.getElementById('sec-sheet-value').value;
+      const type = document.getElementById('sec-sheet-type').value;
+      if (!name || !value) { addStatusMessage('密钥名和值都要填'); return; }
+      try {
+        const r = await fetch(`/api/session/${SESSION_ID}/secrets`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ name, value, type }),
+        });
+        const d = await r.json();
+        if (d.ok) {
+          document.getElementById('sec-sheet-name').value = '';
+          document.getElementById('sec-sheet-value').value = '';
+          addStatusMessage('项目密钥已保存，清除/重开会话后可用 $' + name + ' 引用');
+          loadProjectSecrets();
+        } else { addStatusMessage(d.error || '保存失败'); }
+      } catch { addStatusMessage('连接失败'); }
+    };
+    window.delProjectSecret = async function(name) {
+      try {
+        await fetch(`/api/session/${SESSION_ID}/secrets`, {
+          method: 'DELETE', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ name }),
+        });
+        loadProjectSecrets();
+      } catch {}
+    };
+
     // ── 会话命名 ──────────────────────────────────
     let _slashCmd = null;
     const _slashTitles = { '/plan': '计划模式', '/compact': '压缩上下文', '/rename': '重命名会话' };