claude-simple 0.2.27 → 0.2.30

package/public/style.css

@@ -1830,6 +1830,122 @@ html.settings-open #app { visibility: hidden; }
   .set-nav-item { white-space: nowrap; }
 }
 
+/* ── Personal notes (main pane, sidebar stays) ────────────────────────────── */
+
+.notes-page {
+  flex: 1;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
+  padding: 16px clamp(12px, 3vw, 32px) 24px;
+  gap: 12px;
+  overflow-y: auto;
+  background: hsl(var(--b1));
+  color: hsl(var(--bc));
+}
+.notes-page[hidden] { display: none !important; }
+.notes-count {
+  margin: 4px 0 0;
+  font-size: 12px;
+  color: hsl(var(--bc) / .55);
+}
+.notes-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  border-bottom: 1px solid hsl(var(--b3) / .35);
+  padding-bottom: 12px;
+}
+.notes-header h2 {
+  margin: 0;
+  font-size: 1.4rem;
+  letter-spacing: .02em;
+}
+.notes-header-actions { display: flex; gap: 8px; }
+.notes-add {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 12px;
+  border-radius: 12px;
+  background: hsl(var(--b2));
+  border: 1px solid hsl(var(--b3) / .4);
+}
+.notes-add textarea,
+.notes-edit-text {
+  width: 100%;
+  font: inherit;
+  background: hsl(var(--b1));
+  color: inherit;
+  border: 1px solid hsl(var(--b3) / .4);
+  border-radius: 8px;
+  padding: 10px 12px;
+  resize: vertical;
+  min-height: 80px;
+}
+.notes-form-actions {
+  display: flex;
+  gap: 8px;
+  justify-content: flex-end;
+}
+.notes-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+.notes-empty {
+  padding: 28px;
+  text-align: center;
+  color: hsl(var(--bc) / .55);
+  border: 1px dashed hsl(var(--b3) / .45);
+  border-radius: 12px;
+}
+.notes-error { color: hsl(var(--er) / .85); border-color: hsl(var(--er) / .35); }
+.notes-item {
+  background: hsl(var(--b2));
+  border: 1px solid hsl(var(--b3) / .35);
+  border-radius: 12px;
+  padding: 14px 16px;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.notes-text {
+  white-space: pre-wrap;
+  word-break: break-word;
+  font-size: .98rem;
+  line-height: 1.55;
+}
+.notes-meta {
+  font-size: .75rem;
+  color: hsl(var(--bc) / .55);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+}
+.notes-item-foot {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.notes-item-actions {
+  display: flex;
+  gap: 4px;
+  margin-left: auto;
+}
+.btn.danger {
+  background: hsl(var(--er) / .15);
+  color: hsl(var(--er));
+  border: 1px solid hsl(var(--er) / .35);
+}
+.btn.primary {
+  background: hsl(var(--p));
+  color: hsl(var(--pc));
+  border: 1px solid hsl(var(--p) / .85);
+}
+
 /* Overlays must not eat keystrokes when hidden */
 #sidebar-overlay.hidden,
 .mermaid-zoom-overlay.hidden,
@@ -1847,3 +1963,48 @@ html.settings-open #app { visibility: hidden; }
   cursor: not-allowed;
   opacity: .78;
 }
+
+.notes-add[hidden] { display: none; }
+.notes-error { color: #ef4444; }
+
+.notes-item {
+  background: rgba(255255255, .04);
+  border: 1px solid rgba(255255255, .08);
+  border-radius: 8px;
+  padding: 12px;
+}
+.notes-text {
+  white-space: pre-wrap;
+  word-break: break-word;
+  line-height: 1.55;
+}
+.notes-meta {
+  margin-top: 8px;
+  color: rgba(255255255, .4);
+  font-size: 11px;
+  display: flex;
+  gap: 6px;
+}
+.notes-item-actions {
+  margin-top: 8px;
+  display: flex;
+  gap: 6px;
+  justify-content: flex-end;
+}
+.notes-edit-text {
+  width: 100%;
+  resize: vertical;
+  min-height: 60px;
+  background: transparent;
+  color: inherit;
+  border: 1px solid rgba(255255255, .08);
+  border-radius: 6px;
+  padding: 6px 8px;
+  font-family: inherit;
+  font-size: 14px;
+}
+
+.ma-reasoning { border: 1px solid var(--color-base-300); border-radius: 8px; padding: 8px 10px; color: var(--color-base-content); font-size: 12px; }
+.ma-reasoning summary, .ma-tool summary { cursor: pointer; }
+.ma-reasoning pre { max-height: 260px; overflow: auto; overflow-wrap: anywhere; font: inherit; opacity: .7; }
+.ma-tool[open] .ma-tool-args, .ma-tool[open] .ma-tool-result { max-height: 320px; }

package/public/sw.js

@@ -1,12 +1,12 @@
 /* Agent UI service worker — cache shell assets only.
  * Never intercepts WebSocket or mutates API semantics beyond offline fallback.
  * Bump CACHE when shipping UI that must invalidate old shells. */
-const CACHE = 'agent-ui-shell-v27';
+const CACHE = 'agent-ui-shell-v34';
 const PRECACHE = [
   '/',
   '/index.html',
   '/manifest.webmanifest',
-  '/style.css?v=ui-22',
+  '/style.css?v=ui-25',
   '/style.css',
   '/ui.min.css',
   '/vendor/mini-react.min.js',
@@ -16,7 +16,7 @@ const PRECACHE = [
   '/vendor/mermaid.min.js',
   '/vendor/katex.min.js',
   '/vendor/katex.min.css',
-  '/app.js?v=ui-22',
+  '/app.js?v=ui-25',
   '/icons/icon-192.png',
   '/icons/icon-512.png',
   '/icons/icon-maskable-512.png',
@@ -49,6 +49,8 @@ function isApiOrRealtime(url) {
     || p === '/machine-connect'
     || p.startsWith('/machine/')
     || p === '/healthz'
+    // Never cache the worker itself or an update can stall on the old shell.
+    || p === '/sw.js'
   );
 }
 
@@ -89,8 +91,10 @@ self.addEventListener('fetch', (event) => {
     return;
   }
 
-  // Same-origin static modules: stale-while-revalidate.
+  // App JS/CSS must be network-first so a Hub public/ deploy is visible
+  // on the next reload. Vendor + icons stay stale-while-revalidate.
   if (isStaticAsset(url)) {
+    const vendor = url.pathname.startsWith('/vendor/') || url.pathname.startsWith('/icons/');
     event.respondWith(
       caches.open(CACHE).then(async (cache) => {
         const cached = await cache.match(req);
@@ -100,7 +104,8 @@ self.addEventListener('fetch', (event) => {
             return res;
           })
           .catch(() => cached);
-        return cached || network;
+        if (vendor) return cached || network;
+        return network.then((res) => res || cached).catch(() => cached);
       }),
     );
   }

package/public/workspace-path.js

@@ -0,0 +1,61 @@
+/** Resolve a markdown/chat href into a Files-tab target on the edge machine. */
+
+function decodeHref(href) {
+  const raw = String(href ?? '').trim();
+  if (!raw) return '';
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+
+function slash(p) {
+  return String(p || '').replace(/\\/g, '/');
+}
+
+function stripLineSuffix(p) {
+  return p.replace(/:[0-9]+(?::[0-9]+)?$/, '');
+}
+
+export function resolveWorkspaceFile(href, cwd) {
+  let raw = decodeHref(href);
+  if (!raw) return null;
+  if (/^(https?:|mailto:|tel:|javascript:|#)/i.test(raw)) return null;
+  raw = slash(raw).split(/[?#]/)[0];
+  raw = raw.replace(/^file:\/\//i, '');
+  if (/^\/[A-Za-z]:\//.test(raw)) raw = raw.slice(1);
+  if (!raw || raw === '.' || raw === '/') return null;
+  if (/^\/(api|ws|session)\b/.test(raw)) return null;
+
+  const isDir = raw.endsWith('/');
+  let path = stripLineSuffix(raw.replace(/\/+$/, ''));
+  const root = slash(cwd).replace(/\/+$/, '');
+  const isAbs = path.startsWith('/') || /^[A-Za-z]:\//.test(path);
+
+  if (isAbs && root) {
+    const p = path.toLowerCase();
+    const r = root.toLowerCase();
+    if (p === r) return { relative: '', isDir: true, root };
+    if (p.startsWith(`${r}/`)) {
+      return { relative: path.slice(root.length + 1), isDir, root };
+    }
+    const parts = path.split('/');
+    const name = parts.pop() || '';
+    const parent = parts.join('/') || (path.startsWith('/') ? '/' : '');
+    return { relative: name, isDir, root: parent };
+  }
+
+  path = path.replace(/^\.\//, '');
+  if (path.startsWith('../') && root) {
+    const base = root.split('/');
+    const segs = path.split('/');
+    for (const seg of segs) {
+      if (seg === '..') base.pop();
+      else if (seg && seg !== '.') base.push(seg);
+    }
+    const abs = base.join('/') || '/';
+    return resolveWorkspaceFile(abs, cwd);
+  }
+  return { relative: path, isDir, root: root || cwd };
+}

package/src/agent-quota.js

@@ -0,0 +1,228 @@
+// Read subscription meters without starting an inference turn. Credentials
+// stay on the owning edge; only the normalized meters leave this module.
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { spawn, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+
+function percent(value) {
+  return typeof value === 'number' && Number.isFinite(value) ? Math.max(0, Math.min(100, value)) : null;
+}
+function meter(label, used, reset, minutes) {
+  const usedPercent = percent(used);
+  if (usedPercent == null) return null;
+  const date = typeof reset === 'number' ? reset * 1000 : Date.parse(reset);
+  return { label, usedPercent, remainingPercent: 100 - usedPercent,
+    resetsAt: Number.isFinite(date) ? new Date(date).toISOString() : null,
+    windowMinutes: minutes || null };
+}
+
+export function normalizeClaudeQuota(data) {
+  const meters = [];
+  for (const [key, label, minutes] of [
+    ['five_hour', '5 小时', 300], ['seven_day', '周额度', 10080],
+    ['seven_day_opus', 'Opus 周额度', 10080], ['seven_day_sonnet', 'Sonnet 周额度', 10080],
+    ['seven_day_oauth_apps', 'OAuth 应用周额度', 10080],
+  ]) {
+    const row = data?.[key];
+    const m = meter(label, row?.utilization, row?.resets_at, minutes);
+    if (m) meters.push(m);
+  }
+  // Newer Claude usage responses expose named meters instead of fixed keys.
+  for (const row of (Array.isArray(data) ? data : data?.meters || [])) {
+    const m = meter(row.scope?.model?.display_name || row.kind || '额度', row.percent, row.resets_at,
+      row.group === 'weekly' ? 10080 : null);
+    if (m) meters.push(m);
+  }
+  return meters;
+}
+
+export function normalizeCodexQuota(data) {
+  const meters = [];
+  const buckets = data?.rateLimitsByLimitId || { codex: data?.rateLimits };
+  for (const [id, bucket] of Object.entries(buckets)) {
+    for (const key of ['primary', 'secondary']) {
+      const row = bucket?.[key];
+      const mins = row?.windowDurationMins;
+      const label = mins === 10080 ? '周额度' : mins === 300 ? '5 小时' : mins ? `${mins / 60} 小时` : key;
+      const m = meter(`${bucket?.limitName || id} · ${label}`, row?.usedPercent, row?.resetsAt, mins);
+      if (m) meters.push(m);
+    }
+  }
+  return meters;
+}
+
+export function normalizeGrokQuota(data) {
+  const config = data?.config;
+  if (!config) return [];
+  const period = config.currentPeriod;
+  const weekly = period?.type?.includes('WEEKLY');
+  const used = config.creditUsagePercent ?? (config.monthlyLimit?.val > 0 && typeof config.used?.val === 'number'
+    ? config.used.val / config.monthlyLimit.val * 100 : null);
+  const m = meter(weekly ? '周额度' : '账期额度', used, period?.end || config.billingPeriodEnd, weekly ? 10080 : null);
+  return m ? [m] : [];
+}
+
+async function getJSON(url, headers) {
+  const response = await fetch(url, { headers, signal: AbortSignal.timeout(15000), redirect: 'error' });
+  if (!response.ok) {
+    const err = new Error(response.status === 429 ? '额度接口限流，请稍后刷新' : response.status === 401 || response.status === 403 ? '登录已过期或缺少额度读取权限，请在机器上重新登录' : `额度服务返回 HTTP ${response.status}`);
+    err.status = response.status;
+    throw err;
+  }
+  return response.json();
+}
+
+export function readClaudeLimits(cliPath, configDir) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn(cliPath, ['-p', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose', '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}'], {
+      env: { ...process.env, CLAUDE_CONFIG_DIR: configDir }, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true,
+    });
+    let buffer = '';
+    let settled = false;
+    const finish = (err, value) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer); proc.stdin.end(); proc.kill();
+      if (err) reject(err); else resolve(value);
+    };
+    const timer = setTimeout(() => finish(new Error('Claude quota control timeout')), 20000);
+    const send = (id, request) => proc.stdin.write(`${JSON.stringify({ type: 'control_request', request_id: id, request })}\n`);
+    proc.on('error', () => finish(new Error('Claude CLI unavailable')));
+    proc.stdin.on('error', () => finish(new Error('Claude CLI closed')));
+    proc.stderr.on('data', () => {});
+    proc.on('exit', () => { if (!settled) finish(new Error('Claude CLI exited')); });
+    proc.stdout.on('data', chunk => {
+      buffer += chunk.toString();
+      if (buffer.length > 1024 * 1024) return finish(new Error('Claude quota response too large'));
+      let end;
+      while ((end = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, end); buffer = buffer.slice(end + 1);
+        let msg; try { msg = JSON.parse(line); } catch { continue; }
+        if (msg.type !== 'control_response') continue;
+        const response = msg.response;
+        if (response?.request_id === 'quota-init') {
+          if (response.subtype === 'error') return finish(new Error('Claude initialization failed'));
+          send('quota-read', { subtype: 'get_usage' });
+        } else if (response?.request_id === 'quota-read') {
+          if (response.subtype === 'error') return finish(new Error('Claude usage control unsupported'));
+          finish(null, response.response);
+        }
+      }
+    });
+    send('quota-init', { subtype: 'initialize', hooks: {} });
+  });
+}
+
+async function claudeQuota(configDir, cliPath) {
+  // Let Claude read its own Keychain entry through its native credential
+  // integration. No user prompt is submitted and no model turn is started.
+  try {
+    const usage = await readClaudeLimits(cliPath, configDir);
+    if (usage?.rate_limits_available) return { meters: normalizeClaudeQuota(usage.rate_limits), plan: usage.subscription_type };
+    if (usage?.rate_limits_available === false) return { status: 'unavailable', meters: [], message: '当前 Claude 登录没有可读取的订阅额度（API Key、第三方网关或缺少用量权限）' };
+  } catch {}
+  let credentials;
+  try { credentials = JSON.parse(await fs.readFile(path.join(configDir, '.credentials.json'), 'utf8')); } catch {}
+  if (!credentials && process.platform === 'darwin') {
+    const standard = path.join(os.homedir(), '.claude');
+    const suffix = `-${crypto.createHash('sha256').update(configDir).digest('hex').slice(0, 8)}`;
+    let locked = false;
+    for (const service of [`Claude Code-credentials${suffix}`, ...(configDir === standard ? ['Claude Code-credentials'] : [])]) {
+      try {
+        const result = await exec('/usr/bin/security', ['find-generic-password', '-s', service, '-w'], { timeout: 5000 });
+        credentials = JSON.parse(result.stdout);
+        if (credentials?.claudeAiOauth?.accessToken) break;
+      } catch (err) { if (err.code === 36 || err.killed) locked = true; }
+    }
+    if (!credentials && locked) return { status: 'unavailable', message: '这台机器的 macOS 钥匙串未解锁或不允许后台读取，请在机器上解锁并授权 security 读取 Claude 登录', meters: [] };
+  }
+  const oauth = credentials?.claudeAiOauth;
+  if (!oauth?.accessToken) return { status: 'unavailable', message: '未找到 Claude 订阅登录；API Key 或第三方网关没有订阅周额度', meters: [] };
+  const data = await getJSON('https://api.anthropic.com/api/oauth/usage', {
+    Authorization: `Bearer ${oauth.accessToken}`, 'anthropic-beta': 'oauth-2025-04-20', 'User-Agent': 'claude-simple-quota/1.0',
+  });
+  return { meters: normalizeClaudeQuota(data), plan: oauth.subscriptionType || null };
+}
+
+export function readCodexLimits(cliPath, codexHome) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn(cliPath, ['app-server'], { env: { ...process.env, CODEX_HOME: codexHome }, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+    let buffer = '';
+    let settled = false;
+    const finish = (err, result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      proc.stdin.end();
+      proc.kill();
+      if (err) reject(err); else resolve(result);
+    };
+    const timer = setTimeout(() => finish(new Error('Codex 额度读取超时')), 20000);
+    const send = msg => proc.stdin.write(`${JSON.stringify(msg)}\n`);
+    proc.on('error', () => finish(new Error('Codex CLI 不可用')));
+    proc.stdin.on('error', () => finish(new Error('Codex CLI 连接失败')));
+    proc.stderr.on('data', () => {}); // Never expose CLI diagnostics or credentials.
+    proc.on('exit', () => { if (!settled) finish(new Error('Codex CLI 未返回额度，请检查登录或升级 CLI')); });
+    proc.stdout.on('data', chunk => {
+      buffer += chunk.toString();
+      if (buffer.length > 1024 * 1024) return finish(new Error('Codex 额度响应过大'));
+      let index;
+      while ((index = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, index); buffer = buffer.slice(index + 1);
+        let msg; try { msg = JSON.parse(line); } catch { continue; }
+        if (msg.id === 1) {
+          if (msg.error) return finish(new Error('Codex CLI 初始化失败'));
+          send({ method: 'initialized' });
+          send({ id: 2, method: 'account/rateLimits/read' });
+        } else if (msg.id === 2) {
+          if (msg.error) return finish(new Error('Codex 未提供订阅额度，请检查 ChatGPT 登录；API Key 模式不支持此额度'));
+          finish(null, msg.result);
+        }
+      }
+    });
+    send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'claude_simple_quota', version: '1.0.0' } } });
+  });
+}
+
+async function grokQuota(grokHome) {
+  let auth;
+  try {
+    const store = JSON.parse(await fs.readFile(path.join(grokHome, 'auth.json'), 'utf8'));
+    auth = Object.values(store).find(row => row?.auth_mode === 'oidc' && typeof row.key === 'string');
+  } catch {}
+  if (!auth) return { status: 'unavailable', message: '未找到 Grok 订阅登录；API Key 模式没有个人周额度', meters: [] };
+  const data = await getJSON('https://cli-chat-proxy.grok.com/v1/billing?format=credits', {
+    Authorization: `Bearer ${auth.key}`, 'x-userid': auth.user_id, 'x-grok-client-version': '1.0.46', 'X-XAI-Token-Auth': 'xai-grok-cli',
+  });
+  return { meters: normalizeGrokQuota(data), plan: data.subscriptionTier || null };
+}
+
+export function createQuotaReader({ claudePath = 'claude', codexPath, codexHome, grokHome, defaultClaudeDir, allowedClaudeDirs }) {
+  const cache = new Map();
+  return async ({ agent, configDir } = {}) => {
+    const dir = configDir || defaultClaudeDir;
+    if (agent === 'claude' && !allowedClaudeDirs().includes(dir)) throw new Error('Unknown Claude config directory');
+    const key = `${agent}:${agent === 'claude' ? dir : ''}`;
+    const cached = cache.get(key);
+    if (cached && Date.now() < cached.expiresAt) return cached.promise;
+    const promise = (async () => {
+      let result;
+      try {
+        if (agent === 'claude') result = await claudeQuota(dir, claudePath);
+        else if (agent === 'codex') result = { meters: normalizeCodexQuota(await readCodexLimits(codexPath, codexHome)) };
+        else if (agent === 'grok') result = await grokQuota(grokHome);
+        else throw new Error('Unsupported agent');
+        return { agent, status: result.meters.length ? 'ok' : 'unavailable',
+          ...(result.meters.length ? {} : { message: '当前账号未返回额度数据' }), ...result, fetchedAt: Date.now() };
+      } catch (err) {
+        return { agent, status: 'error', message: err.status ? err.message : '无法读取额度，请检查机器上的 CLI 登录和网络', meters: [], fetchedAt: Date.now() };
+      }
+    })();
+    // Shared per account, including failures, to avoid vendor endpoint limits.
+    cache.set(key, { promise, expiresAt: Date.now() + 5 * 60 * 1000 });
+    return promise;
+  };
+}

package/src/agents/codex.js

@@ -1,4 +1,5 @@
 import { spawn } from 'child_process';
+import { spawnAgentOpts } from '../platform.js';
 import readline from 'readline';
 import crypto from 'crypto';
 
@@ -94,6 +95,7 @@ export function runCodex(command, options, send, { cliPath, activeSessions }) {
         cwd: options.cwd || process.cwd(),
         env,
         stdio: ['pipe', 'pipe', 'pipe'],
+        ...spawnAgentOpts(),
       });
     } catch (e) {
       send({ type: 'error', message: `Failed to start codex: ${e.message}`, agent: 'codex' });

package/src/agents/cursor.js

@@ -50,12 +50,13 @@ function toolBlocks(message) {
 export function runCursor(command, options, send, { cliPath, cursorHome, activeSessions }) {
   return new Promise(resolve => {
     const sessionKey = options.sessionId || crypto.randomUUID();
-    const home = cursorHome || path.join(process.env.HOME || '', '.cursor');
+    const home = cursorHome || path.join(process.env.HOME || process.env.USERPROFILE || '', '.cursor');
     const args = buildArgs(command, options);
     let child;
     try {
       child = spawn(cliPath || 'cursor-agent', args, {
         cwd: options.cwd || process.cwd(), env: { ...process.env }, stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: process.platform === 'win32',
       });
     } catch (error) {
       send({ type: 'error', message: `Failed to start cursor-agent: ${error.message}`, agent: 'cursor' });

package/src/agents/gemini.js

@@ -51,7 +51,7 @@ function toolInput(update) {
 export function runGemini(command, options, send, { cliPath, geminiHome, activeSessions }) {
   return new Promise(resolve => {
     const sessionKey = options.sessionId || crypto.randomUUID();
-    const home = geminiHome || path.join(process.env.HOME || '', '.gemini');
+    const home = geminiHome || path.join(process.env.HOME || process.env.USERPROFILE || '', '.gemini');
     const args = buildArgs(command, options);
     // A resumed native conversation may predate the UI journal. Start recording
     // from this turn so its subsequent history/search/usage is still complete.
@@ -68,6 +68,7 @@ export function runGemini(command, options, send, { cliPath, geminiHome, activeS
         cwd: options.cwd || process.cwd(),
         env: { ...process.env },
         stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: process.platform === 'win32',
       });
     } catch (error) {
       send({ type: 'error', message: `Failed to start agy: ${error.message}`, agent: 'gemini' });

package/src/agents/grok.js

@@ -1,4 +1,5 @@
 import { spawn } from 'child_process';
+import { spawnAgentOpts } from '../platform.js';
 import fs from 'fs';
 import path from 'path';
 import readline from 'readline';
@@ -99,6 +100,7 @@ class TerminalHost {
         cwd,
         env,
         stdio: ['ignore', 'pipe', 'pipe'],
+        ...spawnAgentOpts(),
         shell: args.length === 0,
       });
     } catch (error) {
@@ -215,7 +217,10 @@ class GrokACPClient {
     if (model) args.push('--model', model);
     if (effort) args.push('--reasoning-effort', effort);
     args.push('stdio');
-    this.child = spawn(cliPath || 'grok', args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    this.child = spawn(cliPath || 'grok', args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      ...spawnAgentOpts(),
+    });
     this.pending = new Map();
     this.listeners = new Map();
     this.sessionCwd = new Map();
@@ -388,8 +393,24 @@ function clientFor(options, cliPath) {
   return client;
 }
 
+export function grokActivityStatus(update) {
+  const kind = update?.sessionUpdate;
+  if (kind === 'tool_call' || kind === 'tool_call_update') {
+    const name = update.title || update.kind || 'tool';
+    const st = update.status ? ` (${update.status})` : '';
+    return `Grok 工具: ${name}${st}`;
+  }
+  if (kind === 'agent_thought_chunk') return 'Grok 正在思考…';
+  if (kind === 'agent_message_chunk') return '';
+  return 'Grok ACP running…';
+}
+
 function emitUpdate(update, send, state) {
   const kind = update?.sessionUpdate;
+  const activity = grokActivityStatus(update);
+  if (activity) {
+    send({ type: 'status', message: activity, agent: 'grok' });
+  }
   if (kind === 'agent_message_chunk' && update.content?.text) {
     if (state.thoughtOpen) {
       send({ type: 'thought_stream_end', agent: 'grok' });

package/src/agents/meta-agent.js

@@ -26,6 +26,7 @@ import path from 'path';
 import os from 'os';
 import crypto from 'crypto';
 import { spawn } from 'child_process';
+import { expandHome, shellExecSpec, spawnCommandOpts } from '../platform.js';
 
 export const AI_DEFAULTS = {
   url: 'https://api.xiaomimimo.com/v1/chat/completions',
@@ -443,7 +444,7 @@ const TOOLS = [
 
 function expandPath(p) {
   if (!p) return p;
-  return String(p).replace(/^~(?=$|[/\\])/, os.homedir());
+  return expandHome(String(p));
 }
 
 function pad(n) {
@@ -1919,7 +1920,8 @@ export function createMetaAgent(deps) {
         const p = expandPath(args.path);
         if (!path.isAbsolute(p)) return { error: 'path must be absolute' };
         // block writing into sensitive system dirs
-        if (p === '/' || p.startsWith('/etc') || p.startsWith('/usr') || p.startsWith('/bin')) {
+        if (p === '/' || p.startsWith('/etc') || p.startsWith('/usr') || p.startsWith('/bin')
+          || /^[a-zA-Z]:\\(Windows|Program Files)/i.test(p)) {
           return { error: 'refusing to write to system path' };
         }
         await fs.mkdir(path.dirname(p), { recursive: true });
@@ -1933,10 +1935,11 @@ export function createMetaAgent(deps) {
         const cwd = expandPath(args.cwd || os.homedir());
         const timeoutMs = Math.min(Math.max(args.timeoutMs || 60000, 1000), 180000);
         return await new Promise((resolve) => {
-          const child = spawn(process.env.SHELL || 'bash', ['-c', args.command], {
+          const spec = shellExecSpec(args.command);
+          const child = spawn(spec.bin, spec.args, {
             cwd: fsSync.existsSync(cwd) ? cwd : os.homedir(),
             env: { ...process.env },
-            shell: false,
+            ...spawnCommandOpts({ extra: { shell: false } }),
           });
           let stdout = '';
           let stderr = '';