agent-purge 0.2.8 → 0.2.9

package/lib/slashes.mjs

@@ -1,7 +1,7 @@
 // 会话内 `/purge`：把当前 persona 装进去，之后在这个会话里说一句 `/purge` 就切。
 //
 // 这里是整个项目里唯一"照实说实话"的地方：**斜杠命令不等于系统提示词注入**。
-//   pi        —— 扩展能在 before_agent_start 改写 systemPrompt → sys 层，热切换（实测 100%）
+//   pi / omp  —— 扩展能在 before_agent_start 改写 systemPrompt → sys 层，热切换（实测 100%）
 //   claude    —— ~/.claude/commands/purge.md 是**用户消息展开** → user 层
 //   codex     —— ~/.codex/prompts/purge.md 同上 → user 层
 //   opencode  —— ~/.config/opencode/command/purge.md 同上 → user 层（sys 层要靠 plugin 常驻）
@@ -9,7 +9,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { detect } from "./detect.mjs";
-import { SLASH_RESIDENT, addPlugin, hasPlugin, pluginDir, removePlugin, slashSource } from "./dsh.mjs";
+import { SLASH_RESIDENT, addPlugin, hasPluginAny, pluginFileOnDisk, removePlugin, slashSource } from "./dsh.mjs";
 
 const SIDECAR = ".disabled-by-agent-purge";
 
@@ -70,6 +70,19 @@ export function resolveSlash(id, root) {
 				note: "opencode 的 command 是用户消息 → user 层（bench 实测 0/2 无效）；要 sys 层请用 install（chat.system.transform 插件）",
 			};
 		},
+		omp: () => {
+			const base = homeOf("omp");
+			if (!base) return null;
+			return {
+				layer: "sys",
+				offered: true,
+				hot: true,
+				trigger: "/purge on|off|status|mode",
+				file: join(base, "agent", "extensions", "agent-purge.ts"),
+				render: () => ompExtension(root),
+				note: "扩展在 before_agent_start 改写 systemPrompt 数组：真系统提示词层，/purge 热切，下一轮生效",
+			};
+		},
 		// dsh：不是写文件，而是往三个 profile 各装一个 cordis 小插件（agent-purge-slash）。
 		// 它只注册 /purge 命令、改 state.json，不碰系统提示词 —— 注入归 agent-purge 常驻插件。
 		dsh: () => ({
@@ -77,7 +90,9 @@ export function resolveSlash(id, root) {
 			offered: true,
 			hot: true,
 			trigger: "/purge on|off|status|mode",
-			file: join(pluginDir("desktop", SLASH_RESIDENT), "index.js"),
+			file: pluginFileOnDisk(SLASH_RESIDENT),
+			// 真值看挂载块 + 文件，不看某个 profile 的固定路径（没建过 desktop 就无意义）；任一份在就算能用
+			probe: () => hasPluginAny(SLASH_RESIDENT),
 			render: () => slashSource(root),
 			note: "cordis 插件注册 /purge（/ap 为别名）：改 state.json，下一句生效，不产生模型消息",
 		}),
@@ -96,7 +111,7 @@ export function installSlash(id, root, { personaId, personaBody }) {
 	// dsh：装 cordis 插件到三个 profile，没有单文件可写
 	if (id === "dsh") {
 		const r = addPlugin(SLASH_RESIDENT, slashSource(root));
-		return { file: s.file, layer: s.layer, note: s.note, sidecars: [], profiles: r.profiles };
+		return { file: pluginFileOnDisk(SLASH_RESIDENT), layer: s.layer, note: s.note, sidecars: [], profiles: r.profiles };
 	}
 	mkdirSync(dirname(s.file), { recursive: true });
 
@@ -140,14 +155,14 @@ export function uninstallSlash(id, root) {
 
 export function slashStatus(root) {
 	const out = [];
-	for (const id of Object.keys({ pi: 1, claude: 1, codex: 1, opencode: 1, dsh: 1 })) {
+	for (const id of Object.keys({ pi: 1, omp: 1, claude: 1, codex: 1, opencode: 1, dsh: 1 })) {
 		const s = resolveSlash(id, root);
 		if (!s) continue;
-		const installed = id === "dsh" ? hasPlugin(SLASH_RESIDENT) : existsSync(s.file);
+		const installed = s.probe ? s.probe() : existsSync(s.file);
 		let personaId = null;
-		if (installed) {
+		if (installed && existsSync(s.file)) {
 			const text = readFileSync(s.file, "utf8");
-			personaId = (text.match(/agent-purge: ([a-z0-9_-]+)/i) || [])[1] ?? (id === "pi" ? "(跟随 state.json)" : null);
+			personaId = (text.match(/agent-purge: ([a-z0-9_-]+)/i) || [])[1] ?? (id === "pi" || id === "omp" ? "(跟随 state.json)" : null);
 		}
 		out.push({ id, layer: s.layer, offered: s.offered !== false, hot: s.hot, file: s.file, installed, personaId, trigger: s.trigger, note: s.note });
 	}
@@ -222,13 +237,13 @@ function loadState(): { persona: string | null; mode: string; shim: boolean; piA
 		};
 		return {
 			persona: envPersona ?? st.persona ?? null,
-			mode: envMode ?? st.default?.mode ?? "replace",
+			mode: st.default?.mode ?? "replace",
 			shim: Array.isArray(st.armed?.pi) && st.armed.pi.includes("shim"),
 			piAuto: st.piAuto === true,
 			piUserLayer: st.piUserLayer === true,
 		};
 	} catch {
-		return { persona: envPersona ?? null, mode: envMode ?? "replace", shim: false, piAuto: process.env.AGENT_PURGE_FORCE === "1", piUserLayer: false };
+		return { persona: envPersona ?? null, mode: "replace", shim: false, piAuto: process.env.AGENT_PURGE_FORCE === "1", piUserLayer: false };
 	}
 }
 
@@ -245,6 +260,11 @@ export default function agentPurge(pi: ExtensionAPI) {
 	// 所以“只装会话内热切”的扩展不会自己开工；直呼真身二进制也不会被劫持。
 	let forced: "on" | "off" | null = null;
 	let mode: "strict" | "replace" | "append" = "strict";
+	// 启动器用 AGENT_PURGE_MODE 指定本次启动的初始模式；/purge mode 必须能覆盖它，
+	// 否则环境变量会在每轮把热切换改回去。
+	const ENV_MODE = process.env.AGENT_PURGE_MODE;
+	let modeOverride: "strict" | "replace" | "append" | "off" | null =
+		ENV_MODE === "off" ? "off" : ENV_MODE === "strict" || ENV_MODE === "append" ? ENV_MODE : ENV_MODE ? "replace" : null;
 	let cache = { id: null as string | null, body: "" };
 
 	// 两条来源：启动器点名（FORCE=1），或 state.json 的 piAuto（裸敲 pi 也注入）
@@ -258,8 +278,9 @@ export default function agentPurge(pi: ExtensionAPI) {
 
 	pi.on("before_agent_start", async (event) => {
 		const st = loadState();
-		mode = st.mode === "strict" || st.mode === "append" ? st.mode : "replace";
-		const on = st.mode === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
+		const effective = modeOverride ?? st.mode;
+		mode = effective === "strict" || effective === "append" ? effective : "replace";
+		const on = effective === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
 		if (on !== "on") return;
 		cache = loadPersona();
 		if (!cache.body) return;
@@ -277,8 +298,8 @@ export default function agentPurge(pi: ExtensionAPI) {
 	try {
 		pi.on("context_with_system", async (event: any) => {
 			const st = loadState();
-			const m = st.mode === "strict" || st.mode === "append" ? st.mode : "replace";
-			const on = st.mode === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
+			const m = modeOverride ?? st.mode;
+			const on = m === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
 			if (on !== "on") return;
 			const p = loadPersona();
 			if (!p.body) return;
@@ -330,7 +351,8 @@ export default function agentPurge(pi: ExtensionAPI) {
 			const describe = () => {
 				const p = loadPersona();
 				const st = loadState();
-				const on = st.mode === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
+				const effective = modeOverride ?? st.mode;
+				const on = effective === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
 				const why =
 					on === "on"
 						? forced
@@ -338,14 +360,14 @@ export default function agentPurge(pi: ExtensionAPI) {
 							: process.env.AGENT_PURGE_FORCE === "1"
 								? "启动器要求注入"
 								: "接管裸命令已开"
-						: st.mode === "off"
+						: effective === "off"
 							? "总电源关着"
 							: st.piAuto
 								? "裸启动已开，这次是你手动关的"
 								: "只装了会话内热切，裸启动不注入";
 				return [
 					"状态: " + (on === "on" ? "开启" : "关闭") + "（" + why + "）",
-					"模式: " + st.mode,
+					"模式: " + effective,
 					"裸启动也注入: " + (st.piAuto ? "开" : "关") + "（/purge always on|off）",
 					"人设: " + (p.id ?? "(state.json 里没有 persona)") + "  " + (p.body.length ? p.body.length + " 字符" : "未加载"),
 					"来源: " + STATE,
@@ -353,7 +375,7 @@ export default function agentPurge(pi: ExtensionAPI) {
 			};
 			const turnOn = () => {
 				const st = loadState();
-				if (st.mode === "off") return notify("总电源关着（state.default.mode=off）：先开电源，/purge 才能注入", "error");
+				if ((modeOverride ?? st.mode) === "off") return notify("总电源关着（state.default.mode=off）：先开电源，/purge 才能注入", "error");
 				const p = loadPersona();
 				if (!p.body) return notify("开启失败：state.json 里没有可用 persona（先 agent-purge use <id>）", "error");
 				forced = "on";
@@ -366,7 +388,7 @@ export default function agentPurge(pi: ExtensionAPI) {
 					// 直接裸启动 pi 的时候 forced 是 null、注入本来是关的，第一次 /purge 应该是「开」而不是「关」。
 					const st = loadState();
 					const injecting =
-						st.mode !== "off" && (forced === "on" || (forced === null && Boolean(st.persona) && autoOn(st)));
+						(modeOverride ?? st.mode) !== "off" && (forced === "on" || (forced === null && Boolean(st.persona) && autoOn(st)));
 					if (!injecting) return turnOn();
 					forced = "off";
 					return notify("已关闭本会话注入，恢复 pi 原始系统提示词。再输入 /purge 即重新开启。");
@@ -375,19 +397,28 @@ export default function agentPurge(pi: ExtensionAPI) {
 					return turnOn();
 				case "off":
 					forced = "off";
-					return notify("已关闭本会话注入，恢复 pi 原始系统提示词。");				case "status":
+					return notify("已关闭本会话注入，恢复 pi 原始系统提示词。");
+				case "status":
 					return notify(describe());
 				case "reload":
-					forced = null;
+					// reload 只重读磁盘；本会话手工开的开关不能被重置
 					cache = loadPersona();
-					return notify("已重读 state.json（跟随其 mode）。\\n" + describe());
+					return notify("已重读 state.json（本会话开关不变）。\\n" + describe());
 				case "mode": {
 					const want = args.trim().split(/\\s+/)[1];
 					if (want !== "strict" && want !== "replace" && want !== "append") {
-						return notify("用法: /purge mode strict|replace|append\\nstrict=只发人设；replace=清宿主身份句；append=只挂头部", "error");
+						return notify("用法: /purge mode strict|replace|append\\nstrict=只发人设；replace=清宿主身份句；append=宿主后追加", "error");
+					}
+					try {
+						// 以前只改内存局部变量，下一轮就被 state.json 覆盖 → 写进去才算真切换
+						const raw = JSON.parse(readFileSync(STATE, "utf8")) as Record<string, any>;
+						raw.default = { ...(raw.default ?? { harness: "pi" }), mode: want };
+						writeFileSync(STATE, JSON.stringify(raw, null, 2) + "\\n");
+						modeOverride = want;
+						return notify("模式 → " + want + "（已写入 state.json，下一轮生效）\\n" + describe());
+					} catch (e) {
+						return notify("写 state.json 失败: " + String(e), "error");
 					}
-					mode = want;
-					return notify("模式 → " + want + "\\n" + describe());
 				}
 				case "always": {
 					const want = args.trim().split(/\\s+/)[1];
@@ -410,3 +441,188 @@ export default function agentPurge(pi: ExtensionAPI) {
 }
 `;
 }
+
+/** omp 扩展源码：每轮 before_agent_start 现读 state.json，/purge 热切 */
+function ompExtension(root) {
+	const statePath = join(root, "state.json").replace(/\\/g, "/");
+	const personasDir = join(root, "personas").replace(/\\/g, "/");
+	return `/**
+ * agent-purge 生成的 /purge 扩展（omp 版；删除本文件即取消）。
+ * 人设不内嵌：每次 before_agent_start 现读 state.json → 换 persona / 改模式下一轮就跟上。
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import type { ExtensionAPI } from "@oh-my-pi/pi-coding-agent";
+
+const HOME = process.env.AGENT_PURGE_HOME ? String(process.env.AGENT_PURGE_HOME).replace(/\\\\/g, "/") : null;
+const STATE = (HOME ? HOME + "/state.json" : ${JSON.stringify(statePath)});
+const PERSONAS = (HOME ? HOME + "/personas" : ${JSON.stringify(personasDir)});
+
+function stripFrontmatter(raw: string): string {
+	if (!raw.startsWith("---")) return raw;
+	const end = raw.indexOf("\\n---", 3);
+	return end === -1 ? raw : raw.slice(end + 4).replace(/^\\r?\\n/, "");
+}
+
+function loadPersona(): { id: string | null; body: string } {
+	try {
+		const st = JSON.parse(readFileSync(STATE, "utf8")) as { persona?: string };
+		const id = process.env.AGENT_PURGE_PERSONA ?? st.persona ?? null;
+		if (!id) return { id: null, body: "" };
+		return { id, body: stripFrontmatter(readFileSync(PERSONAS + "/" + id + ".md", "utf8")).trim() };
+	} catch {
+		return { id: process.env.AGENT_PURGE_PERSONA ?? null, body: "" };
+	}
+}
+
+function loadState(): { persona: string | null; mode: string; ompAuto: boolean } {
+	const envPersona = process.env.AGENT_PURGE_PERSONA;
+	const envMode = process.env.AGENT_PURGE_MODE;
+	try {
+		const st = JSON.parse(readFileSync(STATE, "utf8")) as {
+			persona?: string;
+			default?: { harness?: string; mode?: string };
+			ompAuto?: boolean;
+		};
+		return {
+			persona: envPersona ?? st.persona ?? null,
+			mode: envMode ?? st.default?.mode ?? "replace",
+			ompAuto: st.ompAuto === true,
+		};
+	} catch {
+		return { persona: envPersona ?? null, mode: envMode ?? "replace", ompAuto: process.env.AGENT_PURGE_FORCE === "1" };
+	}
+}
+
+function toLines(value: unknown): string[] {
+	if (Array.isArray(value)) return value.map((v) => String(v));
+	return value ? [String(value)] : [];
+}
+
+export default function agentPurge(pi: ExtensionAPI) {
+	let forced: "on" | "off" | null = null;
+	// 启动器的 AGENT_PURGE_MODE 只决定初始模式；/purge mode 必须能盖住它，
+	// 否则下一轮又被环境变量改回去。
+	const ENV_MODE = process.env.AGENT_PURGE_MODE;
+	let modeOverride: "strict" | "replace" | "append" | "off" | null =
+		ENV_MODE === "off" ? "off" : ENV_MODE === "strict" || ENV_MODE === "append" ? ENV_MODE : ENV_MODE ? "replace" : null;
+	let cache = { id: null as string | null, body: "" };
+	const autoOn = (st: { ompAuto?: boolean }) => process.env.AGENT_PURGE_FORCE === "1" || st.ompAuto === true;
+
+	pi.on("session_start", async () => {
+		forced = null;
+		cache = { id: null, body: "" };
+	});
+
+	// omp 每轮重拼 system 提示词；这里直接返回新的 systemPrompt（string[]）。
+	pi.on("before_agent_start", async (event) => {
+		const st = loadState();
+		const effective = modeOverride ?? st.mode;
+		const mode = effective === "strict" || effective === "append" ? effective : "replace";
+		const on = effective === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
+		if (on !== "on") return;
+		cache = loadPersona();
+		if (!cache.body) return;
+		const hostBlocks = toLines((event as any).systemPrompt).filter((l: string) => l.length > 0);
+		// AGENTS.md 常驻通道可能已经把同一份人设塞进 systemPrompt：前缀相同就别再叠一遍
+		if (hostBlocks.some((b: string) => b.includes(cache.body.slice(0, 40)))) return;
+		// strict=只发人设；replace=用新人设换掉基础身份块、保留 PROJECT 块；append=原样保留再追加
+		if (mode === "strict") return { systemPrompt: [cache.body] };
+		if (mode === "append") return { systemPrompt: [...hostBlocks, cache.body] };
+		const projectBlocks = hostBlocks.filter((b: string, i: number) => i > 0 || b.trim().startsWith("PROJECT"));
+		return { systemPrompt: [cache.body, ...projectBlocks] };
+	});
+
+	pi.registerCommand("purge", {
+		description: "会话级接管开关（人设跟随 agent-purge 的 state.json）",
+		getArgumentCompletions: (prefix: string) =>
+			["on", "off", "always", "status", "reload", "mode"].filter((v) => v.startsWith(prefix)).map((value) => ({ value, label: value })),
+		handler: async (args: string, ctx: any) => {
+			const cmd = (args.trim().split(/\\s+/)[0] ?? "").toLowerCase();
+			const notify = (t: string, level: "info" | "error" = "info") => ctx.ui.notify(t, level);
+			const describe = () => {
+				const p = loadPersona();
+				const st = loadState();
+				const effective = modeOverride ?? st.mode;
+				const on = effective === "off" ? "off" : (forced ?? (st.persona && autoOn(st) ? "on" : "off"));
+				const why =
+					on === "on"
+						? forced
+							? "本会话 /purge 开的"
+							: process.env.AGENT_PURGE_FORCE === "1"
+								? "启动器要求注入"
+								: "裸启动已开"
+						: effective === "off"
+							? "总电源关着"
+							: "只装了会话内热切，裸启动不注入";
+				return [
+					"状态: " + (on === "on" ? "开启" : "关闭") + "（" + why + "）",
+					"模式: " + effective,
+					"裸启动也注入: " + (st.ompAuto ? "开" : "关") + "（/purge always on|off）",
+					"人设: " + (p.id ?? "(state.json 里没有 persona)") + "  " + (p.body.length ? p.body.length + " 字符" : "未加载"),
+					"来源: " + STATE,
+				].join("\\n");
+			};
+			const turnOn = () => {
+				const st = loadState();
+				if ((modeOverride ?? st.mode) === "off") return notify("总电源关着（state.default.mode=off）：先开电源，/purge 才能注入", "error");
+				const p = loadPersona();
+				if (!p.body) return notify("开启失败：state.json 里没有可用 persona（先 agent-purge use <id>）", "error");
+				forced = "on";
+				cache = p;
+				notify("已开启（仅本会话），每轮注入 " + p.body.length + " 字符。\\n" + describe());
+			};
+			switch (cmd) {
+				case "": {
+					const st = loadState();
+					const injecting =
+						(modeOverride ?? st.mode) !== "off" && (forced === "on" || (forced === null && Boolean(st.persona) && autoOn(st)));
+					if (!injecting) return turnOn();
+					forced = "off";
+					return notify("已关闭本会话注入，恢复 omp 原始系统提示词。再输入 /purge 即重新开启。");
+				}
+				case "on":
+					return turnOn();
+				case "off":
+					forced = "off";
+					return notify("已关闭本会话注入，恢复 omp 原始系统提示词。");
+				case "status":
+					return notify(describe());
+				case "reload":
+					cache = loadPersona();
+					return notify("已重读 state.json（本会话开关不变）。\\n" + describe());
+				case "mode": {
+					const want = args.trim().split(/\\s+/)[1];
+					if (want !== "strict" && want !== "replace" && want !== "append") {
+						return notify("用法: /purge mode strict|replace|append\\nstrict=只发人设；replace=换基础提示、保留项目规则；append=宿主后追加", "error");
+					}
+					try {
+						const raw = JSON.parse(readFileSync(STATE, "utf8")) as Record<string, any>;
+						raw.default = { ...(raw.default ?? { harness: "omp" }), mode: want };
+						writeFileSync(STATE, JSON.stringify(raw, null, 2) + "\\n");
+						modeOverride = want;
+						return notify("模式 → " + want + "（已写入 state.json，下一轮生效）\\n" + describe());
+					} catch (e) {
+						return notify("写 state.json 失败: " + String(e), "error");
+					}
+				}
+				case "always": {
+					const want = args.trim().split(/\\s+/)[1];
+					if (want !== "on" && want !== "off")
+						return notify("用法: /purge always on|off —— 让裸敲 omp 也自动注入（写 state.json，新会话生效）", "error");
+					try {
+						const raw = JSON.parse(readFileSync(STATE, "utf8")) as Record<string, unknown>;
+						raw.ompAuto = want === "on";
+						writeFileSync(STATE, JSON.stringify(raw, null, 2) + "\\n");
+						return notify("已写入 ompAuto=" + want + "（新会话起生效）\\n" + describe());
+					} catch (e) {
+						return notify("写 state.json 失败: " + String(e), "error");
+					}
+				}
+				default:
+					return notify("用法: /purge [on|off|always on|off|status|reload|mode strict|replace|append]", "error");
+			}
+		},
+	});
+}
+`;
+}

package/lib/spawn.mjs

@@ -78,7 +78,9 @@ function cmdShimNodeTarget(file) {
 }
 
 function dispatch(name, args, opts) {
-	if (!WIN) return { cmd: name, args, opts: { ...opts, shell: false } };
+	// 非 Windows 也要解析成真实路径：否则 shim 目录里的同名壳转回 agent-purge 时，
+	// spawn("pi") 又会命中最前面的壳，无限套娃。
+	if (!WIN) return { cmd: resolveBin(name) ?? name, args, opts: { ...opts, shell: false } };
 	const full = resolveBin(name) ?? name;
 	const ext = extname(full).toLowerCase();
 	if (ext === ".ps1") {

package/lib/state.mjs

@@ -11,7 +11,7 @@
 //
 // personas/active.md 退化为「派生物」：由 launch/arm 时按 persona 生成，
 // 供落盘型 harness 与 opencode 插件读取，不再承载状态。
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 const FILE = "state.json";
@@ -33,7 +33,7 @@ export function statePath(root) {
 }
 
 function emptyState() {
-	return { v: 1, persona: null, default: null, armed: {}, piAuto: false, piUserLayer: false, dshProfiles: null };
+	return { v: 1, persona: null, default: null, armed: {}, piAuto: false, piUserLayer: false, ompAuto: false, dshProfiles: null };
 }
 
 /**
@@ -81,13 +81,25 @@ export function loadState(root) {
 	}
 
 	// 迁完立即落盘：否则下次调用看不到旧文件，迁移结果直接丢掉
-	if (migrated.length) writeFileSync(file, JSON.stringify(state, null, 2) + "\n");
+	if (migrated.length) saveState(root, state);
 
 	return { state, migrated };
 }
 
 export function saveState(root, state) {
-	writeFileSync(statePath(root), JSON.stringify(state, null, 2) + "\n");
+	// 先写临时文件再改名：Web 与 CLI 同时写时，读的一方不会看到半截 JSON
+	const file = statePath(root);
+	const tmp = `${file}.tmp-${process.pid}`;
+	try {
+		writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+		renameSync(tmp, file);
+	} catch (e) {
+		// rename 失败时别把半截临时文件留在 ~/.agent-purge
+		try {
+			unlinkSync(tmp);
+		} catch {}
+		throw e;
+	}
 	return state;
 }
 
@@ -115,6 +127,12 @@ export function setPiAuto(root, on) {
 	return saveState(root, { ...state, piAuto: on === true }).piAuto;
 }
 
+/** 裸敲 omp 是否也自动注入（omp 扩展读这个位） */
+export function setOmpAuto(root, on) {
+	const { state } = loadState(root);
+	return saveState(root, { ...state, ompAuto: on === true }).ompAuto;
+}
+
 /** pi 的人设走哪一层：false = system（默认），true = 额外塞进用户消息（给忽略 system 的模型用） */
 export function setPiUserLayer(root, on) {
 	const { state } = loadState(root);

package/matrix.json

@@ -181,9 +181,9 @@
 			"class": "launch-arg",
 			"override": true,
 			"inject": true,
-			"hotSwitch": false,
+			"hotSwitch": true,
 			"patch": false,
-			"launcher": "omp --system-prompt <persona>",
+			"launcher": "omp（扩展钩子 /purge 热切；--ask 用 --system-prompt）",
 			"defaultSystemChars": 34511,
 			"purgedSystemChars": 10106,
 			"measuredVersion": "17.4.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-purge",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "One persona, many coding agents: replace or inject system prompts across codex, claude, opencode (v1/v2), grok, omp, hermes, pi, zcode, dsh.",
   "type": "module",
   "bin": {
@@ -23,8 +23,7 @@
     "web": "node bin/agent-purge.mjs web",
     "matrix": "node bin/agent-purge.mjs matrix",
     "detect": "node bin/agent-purge.mjs detect",
-    "test": "node magpie-plugin/selftest.mjs && node magpie-plugin/test-page.mjs && node test/harness-adapters.test.mjs",
-    "build:exe": "node scripts/build-exe.mjs",
+    "test": "node magpie-plugin/selftest.mjs && node magpie-plugin/test-page.mjs && node test/harness-adapters.test.mjs && node test/regressions.test.mjs",
     "prepack": "node -e \"require('node:fs').rmSync('personas/.build',{recursive:true,force:true})\""
   },
   "keywords": [

package/web/server.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 import { detect } from "../lib/detect.mjs";
 import { oneshots } from "../backends/index.mjs";
 import { createStore } from "../lib/personas.mjs";
-import { MODES, armedOf, dshProfilesOf, loadState, patchState, setArmed, setDefault, setPersona, setPiAuto, setDshProfile } from "../lib/state.mjs";
+import { MODES, armedOf, dshProfilesOf, loadState, patchState, setArmed, setDefault, setPersona, setPiAuto, setOmpAuto, setDshProfile } from "../lib/state.mjs";
 import { install, status as persistStatus, uninstall } from "../lib/persist.mjs";
 import { plans, summary as armorSummary } from "../lib/armor.mjs";
 import { installShim, shimStatus, uninstallShim } from "../lib/shim.mjs";
@@ -31,7 +31,14 @@ const matrix = JSON.parse(readFileSync(join(ROOT, "matrix.json"), "utf8"));
 const store = createStore(DATA);
 
 export function serveWeb(port = 7788) {
-	const server = createServer(handle);
+	// handle 是 async：任何异常都在这里收口，否则请求会挂着不响应
+	const server = createServer((req, res) => {
+		handle(req, res).catch((e) => {
+			try {
+				send(res, 500, { error: `服务端错误: ${e.message}` });
+			} catch {}
+		});
+	});
 	server.on("error", (e) => {
 		// 端口被旧实例占着的时候，--detach 是静默的 → 这里必须说人话，否则用户看到的是旧 UI
 		if (e.code === "EADDRINUSE") {
@@ -51,11 +58,16 @@ async function handle(req, res) {
 	const url = new URL(req.url, "http://127.0.0.1");
 	const p = url.pathname;
 
+	// 防 CSRF：本机 Web 页面能 POST 就能写配置/改人设；跨站页面用 text/plain 也能发“简单请求”。
+	// 只放同源：Origin 的 host 必须和本次请求的 Host 完全一致（端口不同也挡住）。
+	if (isMutating(req.method) && !sameOrigin(req)) return send(res, 403, { error: "只接受本机同源请求" });
+
 	if (req.method === "GET" && (p === "/" || p === "/index.html")) return html(res);
 	if (req.method === "GET" && p === "/api/state") return send(res, 200, await state(url.searchParams.get("versions") === "1"));
 	if (req.method === "GET" && p === "/api/armor") return send(res, 200, armorState());
 	if (req.method === "POST" && p === "/api/defaults") return send(res, 200, saveDefaults(await body(req)));
 	if (req.method === "POST" && p === "/api/pi-auto") return send(res, 200, { piAuto: setPiAuto(DATA, (await body(req)).on === true) });
+	if (req.method === "POST" && p === "/api/omp-auto") return send(res, 200, { ompAuto: setOmpAuto(DATA, (await body(req)).on === true) });
 	if (req.method === "POST" && p === "/api/dsh-profile") return send(res, 200, saveDshProfile(await body(req)));
 	if (req.method === "POST" && p === "/api/persona") return send(res, 200, savePersona(await body(req)));
 	if (req.method === "DELETE" && p === "/api/persona") return send(res, 200, deletePersona(url.searchParams.get("id")));
@@ -144,6 +156,7 @@ async function state(withVersions) {
 		dshAll: DSH_PROFILES,
 		modes: MODES,
 		piAuto: st.piAuto === true,
+		ompAuto: st.ompAuto === true,
 		shimDir: shimStatus()[0]?.dir ?? null,
 		slashes: slashes,
 	};
@@ -228,7 +241,8 @@ function savePersona(payload) {
 function deletePersona(id) {
 	if (!id) return { error: "缺少 id" };
 	if (store.list().length <= 1) return { error: "至少保留一个 persona" };
-	store.remove(id); // remove 内部会处理“删的就是 active”的指针改道
+	if (!store.read(id)) return { error: "找不到这个 persona" };
+	if (!store.remove(id)) return { error: "非法 persona id" };
 	return { ok: true, active: store.activeId() };
 }
 
@@ -251,6 +265,7 @@ function usePersona(payload) {
 
 /** 全局总开关：所有 harness × 选定通道一次折腾完（= `agent-purge 注册 --all` / `disarm --all`）*/
 function applyArmAll(payload) {
+	if (!payload.action) return { error: "缺少 action" };
 	const { action } = payload;
 	const channel = payload.channel ?? "all";
 	const verb = verbOf(action);
@@ -310,6 +325,7 @@ function verbOf(action) {
 
 /** 裸命令接管（shim）、/purge（slash）、常驻（install）：Web 上一个开关全部搞定 */
 function applyArm(payload) {
+	if (!payload.action) return { error: "缺少 action" };
 	const { harness, channel, action } = payload;
 	const id = payload.persona ?? store.activeId();
 	if (!store.read(id)) return { error: "没有可用 persona" };
@@ -363,21 +379,57 @@ function armChannel(harness, channel, verb, id) {
 	return { error: `未知通道: ${channel}` };
 }
 
-const send = (res, code, obj) => res.writeHead(code, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify(obj));
+const send = (res, code, obj) =>
+	res.writeHead(code, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }).end(JSON.stringify(obj));
 const html = (res) =>
 	res
 		.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" })
 		.end(readFileSync(join(ROOT, "web", "ui.html"), "utf8"));
 
+function isMutating(method) {
+	return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+}
+
+/** 浏览器跨站请求会带 Origin；curl/脚本没有，放行。有 Origin 就必须和 Host 同源。 */
+function sameOrigin(req) {
+	// 先看浏览器声明的跨站属性：没有 Origin 的跨站请求（部分 fetch 场景）也要挡住
+	const site = req.headers["sec-fetch-site"];
+	if (site && site !== "same-origin" && site !== "none") return false;
+	const origin = req.headers.origin;
+	if (!origin) return true;
+	try {
+		const u = new URL(origin);
+		const loopback = u.hostname === "127.0.0.1" || u.hostname === "localhost" || u.hostname === "::1" || u.hostname === "[::1]";
+		return loopback && u.host.toLowerCase() === String(req.headers.host ?? "").toLowerCase();
+	} catch {
+		return false;
+	}
+}
+
 function body(req) {
 	return new Promise((resolve) => {
 		let raw = "";
-		req.on("data", (c) => (raw += c));
+		let size = 0;
+		let done = false;
+		const finish = (value) => {
+			if (done) return;
+			done = true;
+			resolve(value);
+		};
+		req.on("data", (c) => {
+			size += c.length;
+			// 本机也不该接无上限的 body：一个坏页面能靠大 POST 把内存吃光
+			if (size > 2 * 1024 * 1024) {
+				req.destroy();
+				return finish({});
+			}
+			raw += c;
+		});
 		req.on("end", () => {
 			try {
-				resolve(JSON.parse(raw || "{}"));
+				finish(JSON.parse(raw || "{}"));
 			} catch {
-				resolve({});
+				finish({});
 			}
 		});
 	});