dsh-custom-mode 2.3.0 → 2.3.1

package/README.i18n.yaml

@@ -1,5 +1,5 @@
 # 双语配对一致性记录：两侧在「上次确认一致」时的 git blob 哈希。
 # 两份文档权威相同——改完任意一侧，请把另一侧也改掉，然后重新记录：
 #   node tools/verify-translation-pairing.mjs --write
-README.md: c45d995f478c01972b08ea681831a593531c279a
-README.zh.md: f2a7906bddc3559d96585c8474a0a102d74cf44c
+README.md: 3c201bfc473b860dec48b561a8467590683b3394
+README.zh.md: 7e1fdbb9503908d8e285d9087653aa964510fd3c

package/README.md

@@ -10,9 +10,21 @@ Edit your DeepSeek Harness (`dsh`) assistants' system prompts, base modes and pl
 
 [Install](#install-and-make-the-first-request) · [First use](#verify-the-whole-path) · [Updates](#plugin-updates) · [Screenshots](#screenshots) · [Compatibility](#compatibility-and-versioning) · [Help](#help-and-docs)
 
+## Editing and draft safety
+
+This section describes editing and draft protection in `2.3.1`. Confirm that exact version is available in [Releases](https://github.com/BOWLUNA/dsh-custom-mode/releases) before installing.
+
+Select **New assistant…** in the page header to move to the existing creation form and focus its name input. Creating the assistant still requires choosing its starting settings, naming it and submitting the form. The currently selected assistant remains the editing target until creation succeeds. Enter is ignored while text is being composed; ordinary Enter submits the completed name.
+
+Drafts remain in memory for the **current browser document**, including when you leave and return to the settings page. They are not a disk backup: reloading the document, closing the tab or restarting/unloading the plugin can lose unsaved edits. A leave-page warning cannot restore text after you confirm leaving. Copy or export important draft text first. When duplicating with pending edits, confirm that the copy uses the saved configuration; the original draft is retained.
+
+Restoring the starting prompt, importing a file or loading saved history replaces only the prompt draft. If that would overwrite unsaved prompt text, confirm the replacement first; canceling keeps the text. Saving is still required to write the files.
+
+If a save reports a conflict, copy the complete draft before selecting **Discard edits and reload**. A routine refresh keeps the dirty draft and its original baseline; it does not resolve the conflict. Compare the newly loaded files with your copied text before applying the intended edits again.
+
 ## Install and make the first request
 
-These instructions describe version `2.3.0`. Confirm that the exact version is available in [Releases](https://github.com/BOWLUNA/dsh-custom-mode/releases), and check the [exact-host results and acceptance limits](docs/CURRENT_COMPATIBILITY.md) before installing or updating.
+These instructions describe version `2.3.1`. Confirm that the exact version is available in [Releases](https://github.com/BOWLUNA/dsh-custom-mode/releases), and check the [exact-host results and acceptance limits](docs/CURRENT_COMPATIBILITY.md) before installing or updating.
 
 Start with an installed [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) and a model configured through its own interface. Check `dsh --version` against the exact hosts in the compatibility record. This package does not install the host or configure model credentials.
 
@@ -22,21 +34,21 @@ Pin the plugin version; a bare name can resolve an older build during pnpm's rel
 
 ```sh
 dsh --version
-dsh plugin --profile web add dsh-custom-mode@2.3.0
+dsh plugin --profile web add dsh-custom-mode@2.3.1
 ```
 
 Restart the process that serves this Web profile using its usual launcher. For a local CLI instance, the existing launch form is `dsh web --port 3081 --no-open`; use a free port and open the URL printed by that process. Restart only that instance. Installing a bundle does not refresh an already running host.
 
 ### Desktop and Windows
 
-In the desktop app, use its **Plugins** page to install `dsh-custom-mode@2.3.0`, then restart the app. This project's scripts deliberately refuse `--profile desktop`; do not modify its profile files by hand. Windows/Electron acceptance remains separate from Web acceptance; see the compatibility record.
+In the desktop app, use its **Plugins** page to install `dsh-custom-mode@2.3.1`, then restart the app. This project's scripts deliberately refuse `--profile desktop`; do not modify its profile files by hand. Windows/Electron acceptance remains separate from Web acceptance; see the compatibility record.
 
 On Windows, the npm installation above can use the host's `dsh` command from PowerShell. Only the optional clone installer requires Git Bash (plus Node.js and npm). If `dsh` is not on PATH, use the host's supplied launcher, or replace `dsh` with `node "<host-install>/node_modules/@deepseek-ai/dsh/lib/bin.js"`. Do not point that path at this plugin's directory unless the host is actually installed there.
 
 ### Verify the whole path
 
 1. Open Settings → Custom mode and check the displayed version. A page that opens is only the first check.
-2. Scroll to **New assistant at the bottom of the page**. When the built-in `custom` assistant already exists, this section follows its editor. Choose a starting setting such as Writing, enter a recognizable name, and select New assistant. The created assistant becomes the editing target.
+2. Select **New assistant…** in the page header to focus the creation form. Choose a starting setting such as Writing, enter a recognizable name and select New assistant. The created assistant becomes the editing target.
 3. Set a temporary prompt such as `For the next readiness check, reply with exactly CUSTOM_MODE_READY.` Save and wait for the page to confirm that it was applied. If it says the file was saved but application failed, select Retry activation before continuing.
 4. Start a **new session**, open its mode/assistant selector, and explicitly choose that named assistant. Send `Readiness check.` through a model already configured in DSH.
 5. Success means the assistant is selectable without a broken-preset warning and returns the expected readiness reply without a prompt-assembly error. Restore your intended prompt after the check. If it fails, use the [current recovery steps](docs/TROUBLESHOOTING.md#current-recovery-steps).
@@ -76,7 +88,7 @@ The prompt is stored in `prompt.md` and reread when the next model step is assem
 
 ## Upgrade, clone development, and removal
 
-The page header shows the **running plugin version**. With DSH `0.2.2-alpha.2`'s native update capability, select **Check for updates** to ask the host for eligible versions. A recommended version offers **Update in Plugins**, which opens the official plugin details for its own confirmation, progress and result. The custom page does not install a package itself. Save pending drafts and resolve activation/refresh warnings before leaving the page.
+The page header shows the **running plugin version**. When the host provides its native update capability, select **Check for updates** to ask the host for eligible versions. A recommended version offers **Update in Plugins**, which opens the official plugin details for its own confirmation, progress and result. The custom page does not install a package itself. Save pending drafts and resolve activation/refresh warnings before leaving the page.
 
 On `0.2.1-rc.2`, `0.2.1-rc.4`, `0.2.0-rc.2` and `0.1.7-rc.2`, the native version-query API is absent: use **Open plugin details** or **Update guide** and the manual fixed-version path below. File, tarball and source-linked installations remain managed by their original source; checking does not silently convert them to npm. Permission denial, network failure, filtered versions or a partial result do not mean the plugin is current. A separate **Installed on disk** version does not prove that the running code has changed.
 
@@ -88,13 +100,13 @@ That command targets Web/CLI only. Desktop users must use an update path actuall
 
 For source development, follow [the isolated setup](CONTRIBUTING.md#isolated-development). The optional `./install.sh --profile web` keeps the source-linked workflow and preserves existing prompt, metadata and composition. Its local package/code rollback and recovery paths are explained in [package and release assets](docs/PUBLISHING.md#package-and-release-assets).
 
-`./uninstall.sh` removes the plugin but keeps assistant data. `--purge` explicitly deletes the managed assistant directories and their prompts; keep your own backup before using it.
+`./uninstall.sh` removes the plugin but keeps assistant data. `--purge` explicitly deletes the managed assistant directories and their prompts; keep your own backup before using it. In `2.3.1`, a failed or unverifiable host removal stops cleanup and purge, preserves the remaining files and exits with an error. Resolve the reported host error before retrying; desktop removal stays in the app's Plugins page.
 
 ## Compatibility and versioning
 
 Declared host range: `>=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0 || >=0.1.7-alpha.1 <0.2.0-0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0 || >=0.2.2-alpha.2 <0.3.0-0`
 
-The plugin version is its own stable `x.y.z` line; it does not mirror DSH. On 2026-10-27 the public host tags were `latest=0.2.1-rc.2`, `next=0.2.1-rc.4`, and `alpha=0.2.2-alpha.2`. Tags move; the declared range and completed checks are separate facts. See [exact versions, acceptance limits and historical evidence](docs/CURRENT_COMPATIBILITY.md) for the tested scope.
+The plugin version is its own stable `x.y.z` line; it does not mirror DSH. On 2026-11-04 the public host tags were `latest=0.2.1-rc.5`, `next=0.2.2-rc.1`, and `alpha=0.2.2-alpha.3`. Tags move; the declared range and completed checks are separate facts. See [exact versions, acceptance limits and historical evidence](docs/CURRENT_COMPATIBILITY.md) for the tested scope.
 
 Release requires the compatibility and browser workflows. The unit runner, real prompt-component checks, packed-install checks and browser checks cover different boundaries. Windows/Electron, a real model response and GPU execution must each have their own evidence; they are not inferred from a page screenshot or unit count. Headless mode does not start an agent-preset session.
 

package/README.zh.md

@@ -10,9 +10,21 @@
 
 [安装](#安装并完成首次请求) · [首次使用](#验证完整路径) · [更新](#plugin-updates) · [截图](#使用截图) · [兼容](#兼容与版本) · [求助](#帮助与文档)
 
+## 编辑与草稿保护
+
+本节说明`2.3.1`的编辑与草稿保护行为；安装前请先确认[发布版本](https://github.com/BOWLUNA/dsh-custom-mode/releases)中已有该精确版本。
+
+点击页首「**新建助手…**」即可定位到既有新建表单并聚焦名称输入框。仍需选择起步设置、填写名称并提交表单；创建成功前，当前选中的助手仍是编辑对象。文字仍在组合输入时不会用Enter提交，普通Enter可提交完成的名称。
+
+草稿仅保存在**当前浏览器文档的内存**中，离开并返回设置页时仍可继续编辑。它不是磁盘备份：刷新文档、关闭标签页或重启/卸载插件可能丢失未保存编辑；确认离开后的文本无法靠离页提醒恢复。先复制或导出重要草稿；有待保存编辑时复制助手，须确认副本使用已保存配置，原草稿继续保留。
+
+恢复起步提示词、导入文件或载入已保存历史只替换提示词草稿；会覆盖未保存提示词时，先确认替换，取消则保留原文。仍需保存才写入文件。
+
+保存报告冲突时，先复制完整草稿，再明确选择「**放弃修改并重新读取**」。普通读取会保留脏草稿及其原基线，不能解除冲突；请将重新载入的文件与复制文本对比后，再应用确实需要的编辑。
+
 ## 安装并完成首次请求
 
-本说明描述版本 `2.3.0`。安装或更新前，先确认[发布版本](https://github.com/BOWLUNA/dsh-custom-mode/releases)中已有该精确版本，并核对[精确宿主结果与验收边界](docs/CURRENT_COMPATIBILITY.zh.md)。
+本说明描述版本 `2.3.1`。安装或更新前，先确认[发布版本](https://github.com/BOWLUNA/dsh-custom-mode/releases)中已有该精确版本，并核对[精确宿主结果与验收边界](docs/CURRENT_COMPATIBILITY.zh.md)。
 
 先安装 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)，并在宿主自己的界面中配置可用模型。用 `dsh --version` 对照兼容记录中的精确宿主版本。本插件不安装宿主，也不配置模型凭据。
 
@@ -22,21 +34,21 @@
 
 ```sh
 dsh --version
-dsh plugin --profile web add dsh-custom-mode@2.3.0
+dsh plugin --profile web add dsh-custom-mode@2.3.1
 ```
 
 用原有启动方式重启为该 Web profile 提供服务的进程。本地 CLI 的既有启动形式是 `dsh web --port 3081 --no-open`；选择空闲端口，打开该进程打印的地址。只重启这个实例。安装 bundle 不会刷新已经运行的宿主。
 
 ### 桌面端与 Windows
 
-在桌面应用的 **Plugins（插件）** 页安装 `dsh-custom-mode@2.3.0`，然后重启应用。本项目脚本明确拒绝 `--profile desktop`，不要手改它的 profile 文件。Windows/Electron 与 Web 分别验收，详见兼容记录。
+在桌面应用的 **Plugins（插件）** 页安装 `dsh-custom-mode@2.3.1`，然后重启应用。本项目脚本明确拒绝 `--profile desktop`，不要手改它的 profile 文件。Windows/Electron 与 Web 分别验收，详见兼容记录。
 
 Windows 上可在 PowerShell 中用宿主提供的 `dsh` 执行上面的 npm 安装命令。只有可选的 clone 安装脚本需要 Git Bash，另需 Node.js 和 npm。PATH 中没有 `dsh` 时，使用宿主自带启动器，或将 `dsh` 替换为 `node "<host-install>/node_modules/@deepseek-ai/dsh/lib/bin.js"`。除非宿主确实装在本插件目录中，否则不要把这个路径指向插件目录。
 
 ### 验证完整路径
 
 1. 打开设置 → 自定义模式，检查显示版本。页面能打开只是第一步。
-2. 滚动到**页面底部的「新建助手」区**。已有内置 `custom` 助手时，该区位于编辑区之后。选择写作等起步设置，输入容易辨认的名称，再点「新增助手」；新建的助手会成为编辑对象。
+2. 点击页首「**新建助手…**」聚焦新建表单，选择写作等起步设置，输入容易辨认的名称，再点「新增助手」；新建的助手会成为编辑对象。
 3. 临时把提示词设为 `下一次就绪检查只回复 CUSTOM_MODE_READY。`，保存并等页面确认已应用。若提示文件已保存但应用失败，先点「重试生效」。
 4. 新建一个**会话**，打开该会话的模式/助手选择器，明确选择刚才命名的助手。通过 DSH 中已经配置的模型发送 `就绪检查。`
 5. 成功意味着助手可以选择、没有预设损坏告警，并返回预期就绪回复且不出现提示词组装错误。检查后恢复自己的提示词。失败时先看[当前自救步骤](docs/TROUBLESHOOTING.zh.md#当前自救步骤)。
@@ -76,7 +88,7 @@ Windows 上可在 PowerShell 中用宿主提供的 `dsh` 执行上面的 npm 安
 
 ## 升级、clone 开发与卸载
 
-页首显示**运行中的插件版本**。宿主提供DSH `0.2.2-alpha.2`的原生更新能力时，点「**检查更新**」让宿主查询可用版本。有推荐版本后，「**在插件管理中更新**」会打开官方插件详情，由它承接确认、进度与结果；自定义页不直接安装包。离开前先保存待处理草稿，并处理生效/读取告警。
+页首显示**运行中的插件版本**。宿主提供原生更新能力时，点「**检查更新**」让宿主查询可用版本。有推荐版本后，「**在插件管理中更新**」会打开官方插件详情，由它承接确认、进度与结果；自定义页不直接安装包。离开前先保存待处理草稿，并处理生效/读取告警。
 
 `0.2.1-rc.2`、`0.2.1-rc.4`、`0.2.0-rc.2`和`0.1.7-rc.2`没有原生版本查询API，可用「**打开插件详情**」或「**更新指引**」，再按下方固定版本方式手动更新。文件、tarball与源码链接安装继续由原来源管理，不会因检查更新而悄悄转成npm。权限拒绝、网络失败、版本被筛除或结果不完整都不代表已是最新。「**磁盘安装版本**」与运行版本不同，不能据此认定新代码已运行。
 
@@ -88,13 +100,13 @@ Windows 上可在 PowerShell 中用宿主提供的 `dsh` 执行上面的 npm 安
 
 源码开发按[隔离准备步骤](CONTRIBUTING.zh.md#隔离开发)进行。可选的`./install.sh --profile web`保留源码链接方式，已有提示词、元数据和组成不被覆盖。本地包/代码回滚与恢复路径见[包与发布资产](docs/PUBLISHING.zh.md#包与发布资产)。
 
-`./uninstall.sh` 移除插件但保留助手数据。`--purge` 明确删除受管助手目录及提示词，使用前请自行备份。
+`./uninstall.sh` 移除插件但保留助手数据。`--purge` 明确删除受管助手目录及提示词，使用前请自行备份。`2.3.1`中，宿主卸载失败或其结果无法核实时，会停止清理与purge、保留剩余文件并以错误退出；处理报告的宿主错误后再重试。桌面端卸载仍使用应用内Plugins页。
 
 ## 兼容与版本
 
 声明的宿主范围：`>=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0 || >=0.1.7-alpha.1 <0.2.0-0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0 || >=0.2.2-alpha.2 <0.3.0-0`
 
-插件版本走独立的稳定 `x.y.z` 版本线，不镜像 DSH。2026-10-27 公开宿主标签为 `latest=0.2.1-rc.2`、`next=0.2.1-rc.4`、`alpha=0.2.2-alpha.2`。标签会移动，声明范围与已完成检查是两件事。实测范围见[精确版本、验收边界与历史证据](docs/CURRENT_COMPATIBILITY.zh.md)。
+插件版本走独立的稳定 `x.y.z` 版本线，不镜像 DSH。2026-11-04 公开宿主标签为 `latest=0.2.1-rc.5`、`next=0.2.2-rc.1`、`alpha=0.2.2-alpha.3`。标签会移动，声明范围与已完成检查是两件事。实测范围见[精确版本、验收边界与历史证据](docs/CURRENT_COMPATIBILITY.zh.md)。
 
 发布必须通过兼容性与浏览器工作流。单元、真实提示词组件、打包安装和浏览器检查分别覆盖不同边界。Windows/Electron、真实模型回复、GPU 执行都必须单独留证，不能从页面截图或单元计数推断。headless 不启动使用 agent preset 的会话。
 

package/client.js

@@ -139,6 +139,9 @@ try {
         "assistant.brokenHint": "此模式在本机无法启动，不会出现在新会话菜单里。点「按本线修复」只关闭那些行。",
         "assistant.switchHint": "切换助手保留各自的未保存草稿；列表中的「未保存」标记即为此。",
         "btn.create": "新增助手",
+        "btn.newAssistant": "新建助手…",
+        "assistant.duplicateSavedConfirm": "复制使用磁盘上已保存的配置，不包含当前未保存的修改。继续复制已保存版本？当前草稿会保留。",
+        "prompt.replaceConfirm": "替换当前提示词草稿？尚未保存的提示词会被替换，无法从保存历史中恢复。请先复制保留需要的内容。",
         "create.heading": "新建助手",
         "btn.creating": "创建中…",
         "btn.duplicate": "复制",
@@ -188,7 +191,7 @@ try {
         "meta.version": "插件版本",
         "meta.versionHint": "未钉版本时，可能装到较旧的发布。要换版本，按 README 钉版本重装，然后重启。",
         "api.saved": "已保存（{name}，{mode}）。下一步组装时会重读已保存的提示词。",
-        "api.conflict": "磁盘上的提示词已经变了，这次没有写入。先重新读取，再决定要不要覆盖。",
+        "api.conflict": "磁盘上的助手配置已经变了，这次没有写入。请先导出或复制保留草稿，再重新读取并合并修改。",
         "api.savedWithExclusiveRows": "已保存（{name}，{mode}）。已关闭不能同时启用的行：{rows}。",
         "api.created": "已创建「{name}」。可继续编辑；使用时请在新会话的模式菜单选择它。",
         "api.savedPrompt": "已保存系统提示词（{name}）。下一步组装时会重读这个文件。",
@@ -441,6 +444,9 @@ try {
         "assistant.brokenHint": "This mode cannot start here, so it will not appear for a new session. Fix for this line turns off only those rows.",
         "assistant.switchHint": "Switching assistants keeps each draft; the \"Unsaved\" marker in the list is exactly that.",
         "btn.create": "New assistant",
+        "btn.newAssistant": "New assistant…",
+        "assistant.duplicateSavedConfirm": "Copy the saved configuration from disk? Unsaved changes are not included, and your current draft will be kept.",
+        "prompt.replaceConfirm": "Replace the current prompt draft? Unsaved prompt text will be replaced and cannot be recovered from saved history. Copy any content you need to keep first.",
         "create.heading": "New assistant",
         "btn.creating": "Creating…",
         "btn.duplicate": "Duplicate",
@@ -490,7 +496,7 @@ try {
         "meta.version": "Plugin version",
         "meta.versionHint": "Without a pinned version, an older release may be installed. To change it, reinstall with the version pin from the README, then restart.",
         "api.saved": "Saved ({name}, {mode}). The next model step rereads the saved prompt.",
-        "api.conflict": "The prompt on disk has changed, so this save was not written. Reload, then decide whether to overwrite.",
+        "api.conflict": "The assistant configuration on disk has changed. Nothing was written. Export or copy your draft, then reload and merge your changes.",
         "api.savedWithExclusiveRows": "Saved ({name}, {mode}). Turned off rows that cannot be on together: {rows}.",
         "api.created": "Created {name}. Continue editing here, then choose it in the mode menu for a new session.",
         "api.savedPrompt": "System prompt saved ({name}). The next model step rereads this file.",
@@ -1139,6 +1145,39 @@ try {
         )
       }
 
+      // Private to this module instance in this document. Leaving a settings
+      // section must not lose a draft; no prompt is written to browser storage.
+      const draftContexts = new WeakMap()
+      function mountDraftProtection(ctx) {
+        let session = draftContexts.get(ctx)
+        if (session === undefined) {
+          const memory = { entries: {}, selected: "", newName: "", syncNeeded: false, refreshNeeded: null }
+          session = { memory, owners: new Set(), beforeUnload: (event) => {
+            if (memory.newName === "" && Object.keys(memory.entries).length === 0) return
+            event.preventDefault()
+            event.returnValue = ""
+          } }
+          draftContexts.set(ctx, session)
+        }
+        ctx.effect(() => {
+          const owner = {}
+          session.owners.add(owner)
+          if (session.owners.size === 1 && typeof window.addEventListener === "function") window.addEventListener("beforeunload", session.beforeUnload)
+          return () => {
+            session.owners.delete(owner)
+            if (session.owners.size !== 0) return
+            if (typeof window.removeEventListener === "function") window.removeEventListener("beforeunload", session.beforeUnload)
+            session.memory.entries = {}
+            session.memory.selected = ""
+            session.memory.newName = ""
+            session.memory.syncNeeded = false
+            session.memory.refreshNeeded = null
+            draftContexts.delete(ctx)
+          }
+        }, "custom-mode: draft protection")
+        return session.memory
+      }
+
       /** `「名称」副本`-style copy name, from a locale template. */
       function copyName(template, name) {
         return String(template).replace("{name}", name)
@@ -1325,6 +1364,7 @@ try {
       }
 
       function CustomModeSection(props) {
+        const draftMemory = props.draftMemory
         // Compatibility: a shell that does not hand us a bound `t` (older or
         // changed settings contract) must still render real copy. Falling back to
         // the Chinese dictionary means the worst case is "Chinese text", never a
@@ -1390,28 +1430,38 @@ try {
         const [list, setListState] = react.useState(null)
         const heldRoster = react.useRef(list)
         const setList = (value) => { heldRoster.current = value; setListState(value) }
-        const [selected, setSelected] = react.useState("")
+        const [selected, setSelectedState] = react.useState(draftMemory.selected)
+        const setSelected = (value) => { draftMemory.selected = value; setSelectedState(value) }
         /** id → { payload, saved, value }: loaded state, baseline and live draft. */
-        const [entries, setEntriesState] = react.useState({})
+        const [entries, setEntriesState] = react.useState(draftMemory.entries)
         const heldEntries = react.useRef(entries)
         const setEntries = (next) => {
           heldEntries.current = typeof next === "function" ? next(heldEntries.current) : next
+          draftMemory.entries = Object.fromEntries(Object.entries(heldEntries.current).filter(([, held]) => !sameDraft(held.value, held.saved)))
           setEntriesState(heldEntries.current)
         }
         const [status, setStatus] = react.useState("")
         const [failed, setFailed] = react.useState(false)
         const [busy, setBusy] = react.useState(false)
         const [pending, setPending] = react.useState("")
-        const [syncNeeded, setSyncNeededState] = react.useState(false)
-        const [refreshNeeded, setRefreshNeededState] = react.useState(null)
-        const navigationState = react.useRef({ syncNeeded: false, refreshNeeded: null, newName: "" })
-        const setSyncNeeded = (value) => { navigationState.current.syncNeeded = value; setSyncNeededState(value) }
-        const setRefreshNeeded = (value) => { navigationState.current.refreshNeeded = value; setRefreshNeededState(value) }
+        const [syncNeeded, setSyncNeededState] = react.useState(draftMemory.syncNeeded)
+        const [refreshNeeded, setRefreshNeededState] = react.useState(draftMemory.refreshNeeded)
+        const navigationState = react.useRef({ syncNeeded, refreshNeeded, newName: draftMemory.newName })
+        const setSyncNeeded = (value) => { draftMemory.syncNeeded = value; navigationState.current.syncNeeded = value; setSyncNeededState(value) }
+        const setRefreshNeeded = (value) => { draftMemory.refreshNeeded = value; navigationState.current.refreshNeeded = value; setRefreshNeededState(value) }
         // A ref closes the interval before React renders disabled controls. Only the
         // owning operation may apply a response or release the busy state.
         const operation = react.useRef({ alive: true, current: null })
-        const [newName, setNewNameState] = react.useState("")
-        const setNewName = (value) => { navigationState.current.newName = value; setNewNameState(value) }
+        const [newName, setNewNameState] = react.useState(draftMemory.newName)
+        const setNewName = (value) => { draftMemory.newName = value; navigationState.current.newName = value; setNewNameState(value) }
+        const createSection = react.useRef(null)
+        const createNameInput = react.useRef(null)
+        const editorSection = react.useRef(null)
+        const [focusCreated, setFocusCreated] = react.useState("")
+        const focusCreate = () => {
+          createSection.current?.scrollIntoView?.({ block: "start", behavior: "auto" })
+          createNameInput.current?.focus?.({ preventScroll: true })
+        }
         const [runtimeVersion, setRuntimeVersion] = react.useState("")
         const [updateResult, setUpdateResult] = react.useState(null)
         const [updateNotice, setUpdateNotice] = react.useState("")
@@ -1444,7 +1494,9 @@ try {
         const repairRowsNow = async () => {
           if (draft === null) return
           return runOperation("status.repairing", "msg.saveFailed", async (token) => {
-            const result = await postJson(ROUTES.repair, { id: selected })
+            const baseRevision = entry?.payload?.revision
+            const result = await postJson(ROUTES.repair, { id: selected,
+              ...(typeof baseRevision === "string" ? { baseRevision } : {}) })
             if (!ownsOperation(token)) return
             showResult(result, "msg.repaired", "msg.saveFailed")
             if (result?.ok === true || result?.persisted === true) {
@@ -1457,9 +1509,17 @@ try {
               const repairedIds = Array.isArray(result.params?.repairedIds) ? result.params.repairedIds : []
               if (repairedIds.length > 0 && draft !== null) {
                 // 草稿里的 `overrides` 是"显式**启用**"语义，所以关闭 = false。
-                const nextOverrides = { ...draft.overrides }
-                for (const rowId of repairedIds) nextOverrides[rowId] = false
-                update({ overrides: nextOverrides }, { force: true })
+                setEntries((previous) => {
+                  const before = previous[selected]
+                  const overrides = { ...before.value.overrides }
+                  const savedOverrides = { ...before.saved.overrides }
+                  for (const rowId of repairedIds) { overrides[rowId] = false; savedOverrides[rowId] = false }
+                  const ownRevision = typeof result.revision === "string" && before.payload.revision === baseRevision
+                  return { ...previous, [selected]: { ...before,
+                    value: { ...before.value, overrides },
+                    ...(ownRevision ? { payload: { ...before.payload, revision: result.revision },
+                      saved: { ...before.saved, overrides: savedOverrides } } : {}) } }
+                })
               }
               await refreshAfterWrite(result, "msg.repaired", selected, token, () => reload(selected, undefined, token))
             }
@@ -1497,6 +1557,12 @@ try {
         const payload = entry === undefined ? null : entry.payload
         const editorReady = draft !== null && payload !== null
         const dirty = editorReady && !sameDraft(draft, entry.saved)
+        react.useEffect(() => {
+          if (focusCreated === "" || focusCreated !== selected || !editorReady) return
+          editorSection.current?.scrollIntoView?.({ block: "start", behavior: "auto" })
+          editorSection.current?.focus?.({ preventScroll: true })
+          setFocusCreated("")
+        }, [focusCreated, selected, editorReady])
 
         /** Which assistants hold unsaved edits — the list marks them. */
         const dirtyIds = new Set()
@@ -1575,8 +1641,14 @@ try {
           const fresh = draftOf(result)
           setEntries((previous) => {
             const before = previous[id]
-            const keep = discard !== true && before !== undefined && !sameDraft(before.value, before.saved) ? before.value : fresh
-            return { ...previous, [id]: { payload: result, saved: fresh, value: keep } }
+            const keep = discard !== true && before !== undefined && !sameDraft(before.value, before.saved)
+            // A dirty draft owns the revision it was loaded from. A read may
+            // discover someone else's change, but cannot authorize overwriting it.
+            if (keep && typeof before.payload?.revision === "string") return { ...previous, [id]: { ...before,
+              // Diagnostics may recover independently of this draft. Refresh
+              // those fields without changing its editable baseline or token.
+              value: { ...before.value, warnings: fresh.warnings, broken: fresh.broken, baseUnavailable: fresh.baseUnavailable } } }
+            return { ...previous, [id]: { payload: result, saved: fresh, value: keep ? before.value : fresh } }
           })
         }
 
@@ -1856,13 +1928,17 @@ try {
             if (!ownsOperation(token)) return
             showResult(result, from === undefined ? "msg.created" : "msg.duplicated", "msg.createFailed")
             if (result?.ok === true || result?.persisted === true) {
-              setNewName("")
+              if (from === undefined) setNewName("")
+              setFocusCreated(result.id)
               await refreshAfterWrite(result, from === undefined ? "msg.created" : "msg.duplicated", result.id, token, () => reload(result.id, undefined, token))
             }
           })
         }
 
-        const duplicate = () => create({ from: draft.id, name: copyName(t("assistant.copyName"), draft.name || draft.id) })
+        const duplicate = () => {
+          if (dirty && (typeof window.confirm !== "function" || !window.confirm(t("assistant.duplicateSavedConfirm")))) return
+          return create({ from: draft.id, name: copyName(t("assistant.copyName"), draft.name || draft.id) })
+        }
 
         /**
          * Move the selected assistant one slot in the picker order.
@@ -1872,10 +1948,18 @@ try {
          */
         const move = async (direction) => {
           return runOperation("status.reordering", "msg.reorderFailed", async (token) => {
-            const result = await postJson(ROUTES.reorder, { id: draft.id, direction })
+            const baseRevisions = Object.fromEntries(Object.entries(heldEntries.current)
+              .filter(([, held]) => typeof held.payload?.revision === "string")
+              .map(([id, held]) => [id, held.payload.revision]))
+            const result = await postJson(ROUTES.reorder, { id: draft.id, direction, baseRevisions })
             if (!ownsOperation(token)) return
             showResult(result, "msg.reordered", "msg.reorderFailed")
             if (result?.ok === true || result?.persisted === true) {
+              setEntries((previous) => Object.fromEntries(Object.entries(previous).map(([id, held]) => {
+                const revision = result.revisions?.[id]
+                return [id, typeof revision === "string" && typeof baseRevisions[id] === "string" &&
+                  held.payload?.revision === baseRevisions[id] ? { ...held, payload: { ...held.payload, revision } } : held]
+              })))
               await refreshAfterWrite(result, "msg.reordered", draft.id, token, () => reload(draft.id, undefined, token))
             }
           })
@@ -1888,16 +1972,21 @@ try {
          * 只改**草稿**，不写盘：这样"一键回到官方"既立刻可见，又可被「重新读取」撤销 ——
          * 与页面其余部分一样，一切改动都要点保存才落盘。
          */
+        const allowPromptReplacement = () => {
+          const held = heldEntries.current[selected]
+          return held === undefined || sameDraft(held.value, held.saved) ||
+            (typeof window.confirm === "function" && window.confirm(t("prompt.replaceConfirm")))
+        }
         const resetPrompt = () => {
           const factory = typeof draft.factoryPrompt === "string" ? draft.factoryPrompt : ""
-          if (factory === "") return
+          if (factory === "" || !allowPromptReplacement()) return
           update({ prompt: factory })
         }
 
         /** 把某个历史版本载入编辑器。与「恢复出厂」同一条纪律：只改草稿，保存前不落盘。 */
         const loadVersion = async () => {
           const picked = typeof draft.historyPick === "string" ? draft.historyPick : ""
-          if (picked === "" || draft.id === undefined) return
+          if (picked === "" || draft.id === undefined || !allowPromptReplacement()) return
           return runOperation("status.reading", "msg.loadFailed", async (token) => {
             // 版本键是序号（时间戳会在同一毫秒内撞车 —— 单测就是那样抓到它的）。
             const response = await fetch(ROUTES.history + "?id=" + encodeURIComponent(draft.id) + "&n=" + encodeURIComponent(picked))
@@ -1952,6 +2041,7 @@ try {
             setStatus(t("msg.importTooLarge"))
             return
           }
+          if (!allowPromptReplacement()) return
           return runOperation("status.importing", "msg.importFailed", async (token) => {
             const text = await new Promise((resolve, reject) => {
               const reader = new FileReader()
@@ -2014,7 +2104,7 @@ try {
         }
 
         const save = async () => {
-          if (draft === null) return
+          if (draft === null || navigationState.current.refreshNeeded !== null || navigationState.current.syncNeeded) return
           return runOperation("status.saving", "msg.saveFailed", async (token) => {
             const savedHistory = entry?.saved?.history
             const newest = Array.isArray(savedHistory) && savedHistory.length > 0 ? savedHistory[0].n : undefined
@@ -2025,11 +2115,16 @@ try {
               prompt: draft.prompt,
               name: draft.name,
               description: draft.description,
-              ...(typeof newest === "number" ? { baseN: newest } : {}),
+              ...(typeof entry?.payload?.revision === "string" ? { baseRevision: entry.payload.revision }
+                : typeof newest === "number" ? { baseN: newest } : {}),
             })
             if (!ownsOperation(token)) return
             if (result?.synchronized === false) setSyncNeeded(true)
             else if (result?.synchronized === true) setSyncNeeded(false)
+            if ((result?.ok === true || result?.persisted === true) && typeof result.revision === "string") {
+              setEntries((previous) => ({ ...previous, [draft.id]: { ...previous[draft.id],
+                payload: { ...previous[draft.id].payload, revision: result.revision }, saved: draft } }))
+            }
             if (result !== null && result !== undefined && result.ok === true) {
               setFailed(false)
               const compositionChanged =
@@ -2104,7 +2199,7 @@ try {
         ]
         const createGroup = react.createElement(
           "section",
-          { className: "cpfe-create" },
+          { className: "cpfe-create", ref: createSection },
           react.createElement("h2", { className: "cpfe-h" }, t("create.heading")),
           react.createElement(SectionHint, { text: t("posture.hint") }),
           react.createElement(
@@ -2145,13 +2240,15 @@ try {
               "div",
               { className: "cpfe-newrow" },
             react.createElement(A.Input, {
+              ref: createNameInput,
               className: "cpfe-newinput",
               value: newName,
               disabled: busy,
               placeholder: t("assistant.newPlaceholder"),
               "aria-label": t("assistant.newPlaceholder"),
               onKeyDown: (event) => {
-                if (event.key === "Enter" && busy !== true) create()
+                if (event.key === "Enter" && !event.isComposing && !event.nativeEvent?.isComposing &&
+                    event.keyCode !== 229 && event.nativeEvent?.keyCode !== 229 && busy !== true) create()
               },
               onChange: (event) => {
                 setNewName(event.target.value)
@@ -2241,7 +2338,9 @@ try {
         const assistantList = react.createElement(
           "section",
           null,
-          react.createElement("h2", { className: "cpfe-h" }, t("assistant.heading")),
+          react.createElement("div", { className: "cpfe-sec-head" },
+            react.createElement("h2", { className: "cpfe-h" }, t("assistant.heading")),
+            react.createElement(A.Button, { variant: "outline", disabled: busy, onClick: focusCreate, "data-create-entry": true }, t("btn.newAssistant"))),
                 react.createElement(SectionHint, { text: t("assistant.hint") }),
           list === null
             ? react.createElement(
@@ -2713,7 +2812,7 @@ try {
           editorReady
             ? react.createElement(
                 "section",
-                null,
+                { ref: editorSection, tabIndex: -1, "data-assistant-editor": true },
                 react.createElement("h2", { className: "cpfe-h" }, t("editor.heading")),
                 react.createElement(SectionHint, { text: fillPlaceholders(t("editor.hint"), { name: draft.name || draft.id }) }),
                 react.createElement(
@@ -2728,7 +2827,7 @@ try {
               {
                 variant: "primary",
                 icon: A.IconCheckOutline14 === undefined ? null : react.createElement(A.IconCheckOutline14),
-                disabled: busy || syncNeeded || editorReady === false || dirty === false,
+                disabled: busy || syncNeeded || refreshNeeded !== null || editorReady === false || dirty === false,
                 onClick: save,
               },
               pending === "status.saving" ? t("btn.saving") : t("btn.save"),
@@ -2863,6 +2962,7 @@ try {
             console.warn("dsh-custom-mode: slots service unavailable; settings page not registered")
             return
           }
+          const draftMemory = mountDraftProtection(ctx)
           try { mountUpdateServices(ctx) }
           catch { console.warn("dsh-custom-mode: optional native update services unavailable") }
           slots.inject("settings.section", () => {
@@ -2880,7 +2980,7 @@ try {
                 label: () => translate("nav", undefined, navT === null ? undefined : navT),
                 locale: NS,
               },
-              CustomModeSection,
+              function CustomModeSettings(props) { return CustomModeSection({ ...props, draftMemory }) },
             )
           })
         } catch (error) {

package/composition.mjs

@@ -24,6 +24,18 @@
 
 import { readFileSync, existsSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { decodeJsExpression, evaluateDisabledPredicate } from './preset-backend/parse-composition.mjs'
+
+// Capabilities belong to the request that observed them, never to a module-global
+// host context. Store only known booleans, not service objects or arbitrary ctx access.
+const predicateCapabilities = new AsyncLocalStorage()
+export function withPredicateCapabilities(snapshot, work) {
+  const capabilities = typeof snapshot?.profileContext === 'boolean'
+    ? Object.freeze({ profileContext: snapshot.profileContext })
+    : Object.freeze({})
+  return predicateCapabilities.run(capabilities, work)
+}
 
 // 出厂组成「从哪来」是两条 dsh 线唯一还没收进后端的一处：旧线是文件，0.1.7 是
 // agentPresets.readDocument()。解析链整个搬到了 base-composition.mjs（含它的理由与实测），
@@ -460,7 +472,7 @@ function setDisabled(segmentText, disabled) {
     const shipped = lines[index].trim().replace(/^disabled:\s*/, '')
     if (disabled) {
       lines[index] = `${' '.repeat(indent)}disabled: true${carriage}`
-    } else if (shipped.startsWith('!!js') && evalDisabledExpression(shipped) !== true) {
+    } else if (shipped.startsWith('!!js') && evalDisabledExpression(shipped) === false) {
       // 显式打开，但出厂那行是平台表达式、且它在本机求值就是"开"：这不是覆盖，而是**撤销覆盖** ——
       // 保持出厂表达式原样，这一行就回到"跟随平台"。（原先这里删掉整行，结果是文件既不是出厂原样、
       // 也不是显式覆盖，页面却显示"未拨过" —— 文件与显示同时失真。）
@@ -496,9 +508,8 @@ function setDisabled(segmentText, disabled) {
 function evalDisabledExpression(expression) {
   if (typeof expression !== 'string' || !expression.startsWith('!!js')) return undefined
   try {
-    // eslint-disable-next-line no-new-func -- evaluating the composition's own predicate is the point
-    const fn = new Function('process', `return (${expression.slice(4).trim()});`)
-    return fn(process) === true
+    const source = decodeJsExpression(expression.slice(4))
+    return evaluateDisabledPredicate(source, predicateCapabilities.getStore())
   } catch {
     // 求值失败与「表达式不存在」都是 undefined。调用方若已经确认这是 `!!js`，
     // 必须把 undefined 当成关闭：挂载侧同样按关闭处理，两边不能一个开一个关。
@@ -1020,13 +1031,19 @@ export function overridesOf(text, modeId) {
     // 某个字面量一致 —— 只看求值结果，会把"表达式被换成字面量"误判成"没动过"。
     const sameForm = baseRow !== undefined
       && baseRow.disabled === row.disabled
-      && baseRow.disabledExpression === row.disabledExpression
+      && predicateForm(baseRow.disabledExpression) === predicateForm(row.disabledExpression)
     if (sameForm) continue
     overrides[id] = row.disabled !== true
   }
   return overrides
 }
 
+/** YAML quoting is transport syntax, while literal versus expression remains significant. */
+function predicateForm(expression) {
+  if (typeof expression !== 'string') return expression
+  try { return decodeJsExpression(expression.slice(4)) } catch { return expression }
+}
+
 /**
  * 按允许名单生成显式开关。
  *

package/index.mjs

@@ -55,7 +55,8 @@ import {
   effectiveRosterRows,
 } from './preset-backend/index.mjs'
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { createHash } from 'node:crypto'
+import { basename, dirname, join } from 'node:path'
 import { PROMPT_PATH, COMPOSITION_PATH, ROUTE_PATH, PRESET_DIR, dshHome } from './paths.mjs'
 import { ensureUnsetDefaultPreset } from './defaults.mjs'
 import {
@@ -76,6 +77,7 @@ import {
   setBaseCompositions,
   setShippedPresetsDir,
   unresolvableRows,
+  withPredicateCapabilities,
 } from './composition.mjs'
 import { presetMetaText, readPresetMeta, writePresetMeta, presetMetaPath, PRESET_META_PATH } from './meta.mjs'
 import { listHistory, readVersion, recordExternalChange, recordPrompt, HISTORY_SOURCE } from './journal.mjs'
@@ -373,11 +375,42 @@ export function brokenRowIds(message) {
   return [...new Set(ids)]
 }
 
+/**
+ * An opaque content revision of the complete editable state. Length framing and
+ * an explicit missing marker distinguish absent files from empty ones. History
+ * is deliberately excluded: losing an audit write must not disable conflict checks.
+ */
+export function stateRevision(directory) {
+  return revisionWithEntries(directory)
+}
+
+function revisionWithEntries(directory, entries = []) {
+  const replacements = new Map(entries.map(([file, text]) => [basename(file), Buffer.from(text, 'utf8')]))
+  const hash = createHash('sha256')
+  for (const name of ['prompt.md', 'preset.yml', 'agent.cordis.yml']) {
+    hash.update(name + '\0')
+    let bytes
+    try {
+      bytes = replacements.has(name) ? replacements.get(name) : readFileSync(join(directory, name))
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error
+      hash.update('missing\0')
+      continue
+    }
+    hash.update('present:' + String(bytes.length) + '\0')
+    hash.update(bytes)
+  }
+  return hash.digest('hex')
+}
+
 export function readState(rows, id, options = {}) {
   const directory = assistantDir(rows, id)
   if (directory === undefined) return unknownAssistant(id)
   const recovery = restoreBackups(directory)
   if (recovery.ok !== true) return { ok: false, code: 'recoveryRequired', params: { path: directory, detail: recovery.detail }, error: '助手文件需要恢复：' + recovery.detail }
+  // Take the token before reading the displayed fields. A later external edit
+  // can then cause a conservative conflict, never bless an older displayed value.
+  const revision = stateRevision(directory)
   const composition = compositionFile(directory)
   if (!existsSync(composition)) return { ok: false, code: 'compositionMissing', params: { path: composition }, error: '找不到组成文件：' + composition }
   const text = readFileSync(composition, 'utf8')
@@ -423,6 +456,7 @@ export function readState(rows, id, options = {}) {
   return {
     ok: true,
     id,
+    revision,
     mode,
     modes: BASE_MODES,
     rows: rowTree,
@@ -503,33 +537,75 @@ const writeChains = new Map()
 /**
  * 打开页面之后、按下保存之前，`prompt.md` 可能已被会话工具或手工改过。
  *
- * 先把磁盘上的那一版记进历史。页面带了 JSON 数字 `baseN`，且那个版本不是磁盘上这一版时，
- * 拒绝写入：磁盘保持外部文本。不带 `baseN` 的旧客户端仍覆盖，但原文已经在历史里。
- * 数字字符串不算 `baseN`。留痕自己失败时不挡住这次保存。
+ * 新页面用 baseRevision 比较三个编辑文件的原始内容。旧页面的 JSON 数字
+ * baseN 仍比较提示词历史；没有 token 的旧 API 保留覆盖语义。
+ * 冲突判定与审计写入隔离：历史不可写时也不能放行过期草稿。
  *
  * @param {string} directory
  * @param {string} prompt - the text this save wants to write.
  * @param {unknown} baseN
+ * @param {unknown} baseRevision - opaque revision returned when the draft was loaded.
  * @returns {object|null} a `conflict` result, or null when the write may proceed.
  */
-function refuseStalePrompt(directory, prompt, baseN) {
-  try {
-    const diskPrompt = readPrompt(directory)
-    if (diskPrompt.ok !== true || diskPrompt.text === prompt) return null
-    recordExternalChange(directory, diskPrompt.text)
-    if (typeof baseN === 'number' && readVersion(directory, baseN) !== diskPrompt.text) {
-      return {
-        ok: false,
-        code: 'conflict',
-        params: { baseN },
-        error: '磁盘上的提示词已经变了，这次保存没有写入。',
-        note: '磁盘上的提示词已经变了，这次保存没有写入。',
+function refuseStaleState(directory, prompt, baseN, baseRevision) {
+  const diskPrompt = readPrompt(directory)
+  let stale = false
+  if (typeof baseRevision === 'string') {
+    try {
+      stale = stateRevision(directory) !== baseRevision
+    } catch {
+      // An unreadable editable file cannot prove the loaded baseline is current.
+      stale = true
+    }
+  } else if (typeof baseN === 'number') {
+    stale = diskPrompt.ok !== true || (diskPrompt.text !== prompt && readVersion(directory, baseN) !== diskPrompt.text)
+  }
+  if (diskPrompt.ok === true && diskPrompt.text !== prompt) {
+    try {
+      recordExternalChange(directory, diskPrompt.text)
+    } catch {
+      /* 审计留痕失败不改变上面已经完成的冲突判定 */
+    }
+  }
+  return stale ? {
+    ok: false,
+    code: 'conflict',
+    params: typeof baseRevision === 'string' ? {} : { baseN },
+    error: '磁盘上的助手文件已经变了或无法核对，这次保存没有写入。',
+    note: '磁盘上的助手文件已经变了或无法核对，这次保存没有写入。',
+  } : null
+}
+
+/** Reordering writes every assistant's metadata, so validate all held baselines first. */
+function reorderState(rows, input) {
+  const baselines = input?.baseRevisions
+  if (baselines !== null && typeof baselines === 'object') {
+    for (const [id, revision] of Object.entries(baselines)) {
+      const directory = assistantDir(rows, id)
+      if (directory === undefined || typeof revision !== 'string') {
+        return { ok: false, code: 'conflict', params: {}, error: '助手列表或文件已经变了，这次排序没有写入。' }
       }
+      const conflict = refuseStaleState(directory, readPrompt(directory).text ?? '', undefined, revision)
+      if (conflict !== null) return conflict
     }
-  } catch {
-    /* 审计留痕失败不挡住这次保存 */
   }
-  return null
+  const ids = new Map(assistantsFromRoster(rows).map(({ id }) => [assistantDir(rows, id), id]))
+  const revisions = {}
+  const result = reorderAssistant(rows, input, (name, description, directory, options) => {
+    const rendered = presetMetaText(name, description, directory, options)
+    if (rendered.ok !== true) return rendered
+    try {
+      const entries = [[presetMetaPath(directory), rendered.text]]
+      const revision = revisionWithEntries(directory, entries)
+      writeAtomic(presetMetaPath(directory), rendered.text)
+      revisions[ids.get(directory)] = revision
+      return { ok: true, name: rendered.name }
+    } catch (error) {
+      return { ok: false, code: 'metaWriteFailed', params: { detail: describe(error) }, error: '写入 preset.yml 失败：' + describe(error) }
+    }
+  })
+  // Failed reorders can roll back earlier writes; none of their tokens may be adopted.
+  return result.ok === true ? { ...result, revisions } : result
 }
 
 function serializedWrite(key, work) {
@@ -549,13 +625,15 @@ function serializedWrite(key, work) {
  * 的行集合也就不变，这是所有选项里破坏性最小的一个。
  *
  * @param {string} directory - the assistant's preset directory.
- * @param {{id: string, mode: string, prompt: string, name: string, description: string, displayName?: string, baseN?: number}} input
+ * @param {{id: string, mode: string, prompt: string, name: string, description: string, displayName?: string, baseN?: number, baseRevision?: string}} input
  *   - the validated save; `name` decides whether `preset.yml` is written, `displayName` is what the response
  *   reports (the disk name when the request omitted one — issue #9). `baseN` is the same stale-save
  *   token as {@link saveState}: a JSON number only.
  * @returns {object} the shape `saveState` returns, with `code: 'savedPromptOnly'`.
  */
-export function savePromptOnly(directory, { id, mode, prompt, name, description, displayName, baseN }) {
+export function savePromptOnly(directory, { id, mode, prompt, name, description, displayName, baseN, baseRevision }) {
+  const recovery = restoreBackups(directory)
+  if (recovery.ok !== true) return { ok: false, code: 'recoveryRequired', params: { path: directory, detail: recovery.detail }, error: '助手文件需要恢复：' + recovery.detail }
   // 与正常保存同一条纪律：提示词与 preset.yml 一起换名，失败则两个都不动。
   let metaText = null
   if (name !== '') {
@@ -563,13 +641,18 @@ export function savePromptOnly(directory, { id, mode, prompt, name, description,
     if (rendered.ok !== true) return rendered
     metaText = rendered.text
   }
-  const conflict = refuseStalePrompt(directory, prompt, baseN)
+  const conflict = refuseStaleState(directory, prompt, baseN, baseRevision)
   if (conflict !== null) return conflict
+  let revision
   try {
-    writeAtomicPair([
+    const entries = [
       [promptFile(directory), prompt],
       ...metaText === null ? [] : [[presetMetaPath(directory), metaText]],
-    ])
+    ]
+    // Return our exact submitted generation, without a post-commit read that
+    // could fail or accidentally adopt a different writer's subsequent change.
+    revision = revisionWithEntries(directory, entries)
+    writeAtomicPair(entries)
   } catch (error) {
     return { ok: false, code: 'writeFailed', params: { detail: describe(error) }, error: '写入失败：' + describe(error) }
   }
@@ -583,6 +666,7 @@ export function savePromptOnly(directory, { id, mode, prompt, name, description,
     id,
     mode,
     code: 'savedPromptOnly',
+    revision,
     // 响应里的名字用**磁盘上的那个**（issue #9）：请求省略 name 时不该把 params.name 报成裸目录 id。
     params: { name: (displayName === undefined || displayName === '' ? name : displayName) === '' ? id : (displayName === undefined || displayName === '' ? name : displayName), mode },
     note: '已保存系统提示词（本机取不到基础模式的出厂组成，插件开关与基础模式未改动）。下一步组装时会重读这个文件。',
@@ -669,6 +753,7 @@ export function saveState(rows, input) {
           description,
           displayName: effectiveName,
           baseN: input !== null && typeof input === 'object' ? input.baseN : undefined,
+          baseRevision: input !== null && typeof input === 'object' ? input.baseRevision : undefined,
         })
       }
       return {
@@ -701,14 +786,17 @@ export function saveState(rows, input) {
     if (rendered.ok !== true) return rendered
     metaText = rendered.text
   }
-  const conflict = refuseStalePrompt(directory, prompt, input !== null && typeof input === 'object' ? input.baseN : undefined)
+  const conflict = refuseStaleState(directory, prompt, input?.baseN, input?.baseRevision)
   if (conflict !== null) return conflict
+  let revision
   try {
-    writeAtomicPair([
+    const entries = [
       [compositionFile(directory), composition],
       [promptFile(directory), prompt],
       ...metaText === null ? [] : [[presetMetaPath(directory), metaText]],
-    ])
+    ]
+    revision = revisionWithEntries(directory, entries)
+    writeAtomicPair(entries)
   } catch (error) {
     return { ok: false, code: 'writeFailed', params: { detail: describe(error) }, error: '写入失败：' + describe(error) }
   }
@@ -732,6 +820,7 @@ export function saveState(rows, input) {
       id,
       mode,
       code: 'savedWithExclusiveRows',
+      revision,
       // `rows` 用行 id：页面自己按 `row.<id>.label` 渲染，英文界面不会因为这条掉回中文。
       params: { name: displayName, mode, rows: autoOff.join(', ') },
       note:
@@ -744,6 +833,7 @@ export function saveState(rows, input) {
     id,
     mode,
     code: 'saved',
+    revision,
     params: { name: displayName, mode },
     note: '已保存（' + displayName + '，基础模式 ' + mode + '）。下一步组装时会重读已保存的提示词。',
   }
@@ -976,6 +1066,8 @@ export function repairComposition(rows, input) {
   const id = input !== null && typeof input === 'object' && typeof input.id === 'string' ? input.id : ''
   const directory = assistantDir(rows, id)
   if (directory === undefined) return unknownAssistant(id)
+  const conflict = refuseStaleState(directory, readPrompt(directory).text ?? '', undefined, input?.baseRevision)
+  if (conflict !== null) return conflict
   const file = compositionFile(directory)
   if (!existsSync(file)) return { ok: false, code: 'compositionMissing', params: { path: file }, error: '找不到组成文件：' + file }
   const text = readFileSync(file, 'utf8')
@@ -1006,7 +1098,9 @@ export function repairComposition(rows, input) {
   }
   // **就地**关闭那几行，不重渲染：重渲染会顺手丢掉 base 之外的自有行，而用户的数据不该被这样动。
   const rendered = disableRowsInPlace(text, bad.map((row) => row.id))
+  let revision
   try {
+    revision = revisionWithEntries(directory, [[file, rendered]])
     writeAtomic(file, rendered)
   } catch (error) {
     return { ok: false, code: 'writeFailed', params: { detail: describe(error) }, error: '写入失败：' + describe(error) }
@@ -1016,6 +1110,7 @@ export function repairComposition(rows, input) {
     ok: true,
     id,
     code: 'repaired',
+    revision,
     // `ids` 是给人看的一串；`repairedIds` 是给**页面**用的数组 —— 页面必须把这几行写进它自己的
     // 草稿，否则下一次保存会按草稿重渲染，把刚才的修复原样撤销（issue #8 实测：
     // 修复写进了磁盘，但草稿里那几行仍是启用的，于是保存后 ghost 行又回来了）。
@@ -1422,7 +1517,15 @@ export function apply(ctx) {
       detail: outcome.failures.map((failure) => failure.error ?? failure.code ?? 'unknown').join('; '),
     })
 
-    const handle = async (request, pathname) => {
+    const capabilitySnapshot = () => {
+      try {
+        if (typeof scope.get === 'function') return { profileContext: Boolean(scope.get('profileContext')) }
+      } catch {
+        /* Optional host capability is unknown; keep predicate warning/fail-safe. */
+      }
+      return {}
+    }
+    const handle = (request, pathname) => withPredicateCapabilities(capabilitySnapshot(), async () => {
       try {
         const url = new URL(request.url)
         if (request.method === 'GET' && pathname === ROUTE_PATH) {
@@ -1488,7 +1591,7 @@ export function apply(ctx) {
           const result = pathname === STATE_PATH ? saveState(rows, parsed)
             : pathname === CREATE_PATH ? createAssistant(rows, parsed)
               : pathname === REPAIR_PATH ? repairComposition(rows, parsed)
-                : pathname === REORDER_PATH ? reorderAssistant(rows, parsed)
+                : pathname === REORDER_PATH ? reorderState(rows, parsed)
                   : await deleteAssistant(rows, parsed, presetRemover())
           if (result.ok !== true) return json(result, 400)
           const synced = await resyncPresets()
@@ -1507,7 +1610,7 @@ export function apply(ctx) {
         // ——中文界面里会蹦出一句英文。带 code 后页面用自己的词典渲染，原始串只作为 `detail` 参数。
         return json({ ok: false, code: 'internalError', params: { detail: describe(error) }, error: describe(error) }, 500)
       }
-    }
+    })
 
     // One registration per exact path — the platform's Fetch registry matches exact paths, not prefixes —
     // each declaring the methods it owns. The method table doubles as the guarantee that a prefetched

package/locales.mjs

@@ -101,6 +101,9 @@ export const zh = {
   'assistant.brokenHint': '此模式在本机无法启动，不会出现在新会话菜单里。点「按本线修复」只关闭那些行。',
   'assistant.switchHint': '切换助手保留各自的未保存草稿；列表中的「未保存」标记即为此。',
   'btn.create': '新增助手',
+  'btn.newAssistant': '新建助手…',
+  'assistant.duplicateSavedConfirm': '复制使用磁盘上已保存的配置，不包含当前未保存的修改。继续复制已保存版本？当前草稿会保留。',
+  'prompt.replaceConfirm': '替换当前提示词草稿？尚未保存的提示词会被替换，无法从保存历史中恢复。请先复制保留需要的内容。',
   'create.heading': '新建助手',
   'btn.creating': '创建中…',
   'btn.duplicate': '复制',
@@ -150,7 +153,7 @@ export const zh = {
   'meta.version': '插件版本',
   'meta.versionHint': '未钉版本时，可能装到较旧的发布。要换版本，按 README 钉版本重装，然后重启。',
   'api.saved': '已保存（{name}，{mode}）。下一步组装时会重读已保存的提示词。',
-  'api.conflict': '磁盘上的提示词已经变了，这次没有写入。先重新读取，再决定要不要覆盖。',
+  'api.conflict': '磁盘上的助手配置已经变了，这次没有写入。请先导出或复制保留草稿，再重新读取并合并修改。',
   'api.savedWithExclusiveRows': '已保存（{name}，{mode}）。已关闭不能同时启用的行：{rows}。',
   'api.created': '已创建「{name}」。可继续编辑；使用时请在新会话的模式菜单选择它。',
   'api.savedPrompt': '已保存系统提示词（{name}）。下一步组装时会重读这个文件。',
@@ -425,6 +428,9 @@ export const en = {
   'assistant.brokenHint': 'This mode cannot start here, so it will not appear for a new session. Fix for this line turns off only those rows.',
   'assistant.switchHint': 'Switching assistants keeps each draft; the "Unsaved" marker in the list is exactly that.',
   'btn.create': 'New assistant',
+  'btn.newAssistant': 'New assistant…',
+  'assistant.duplicateSavedConfirm': 'Copy the saved configuration from disk? Unsaved changes are not included, and your current draft will be kept.',
+  'prompt.replaceConfirm': 'Replace the current prompt draft? Unsaved prompt text will be replaced and cannot be recovered from saved history. Copy any content you need to keep first.',
   'create.heading': 'New assistant',
   'btn.creating': 'Creating…',
   'btn.duplicate': 'Duplicate',
@@ -474,7 +480,7 @@ export const en = {
   'meta.version': 'Plugin version',
   'meta.versionHint': 'Without a pinned version, an older release may be installed. To change it, reinstall with the version pin from the README, then restart.',
   'api.saved': 'Saved ({name}, {mode}). The next model step rereads the saved prompt.',
-  'api.conflict': 'The prompt on disk has changed, so this save was not written. Reload, then decide whether to overwrite.',
+  'api.conflict': 'The assistant configuration on disk has changed. Nothing was written. Export or copy your draft, then reload and merge your changes.',
   'api.savedWithExclusiveRows': 'Saved ({name}, {mode}). Turned off rows that cannot be on together: {rows}.',
   'api.created': 'Created {name}. Continue editing here, then choose it in the mode menu for a new session.',
   'api.savedPrompt': 'System prompt saved ({name}). The next model step rereads this file.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-custom-mode",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Customize DeepSeek Harness assistants: edit system prompts, base modes, and plugin switches.",
   "license": "MIT",
   "type": "module",

package/preset-backend/declarative.mjs

@@ -26,20 +26,17 @@
 import { existsSync, readFileSync, renameSync, rmSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { parseComposition } from './parse-composition.mjs'
+import { parseComposition, evaluateDisabledPredicate, profileContextPredicate } from './parse-composition.mjs'
 
 export const BACKEND_ID = 'declarative'
 
-/** Evaluate a `!!js` predicate. Only ever applied to text this feature itself wrote. */
+/** Preserve the host-native predicate node so the loader evaluates it against its real Entry.ctx. */
 function resolveDisabled(value) {
   if (value !== null && typeof value === 'object' && typeof value.__js === 'string') {
-    try {
-      // eslint-disable-next-line no-new-func
-      return Boolean(new Function(`"use strict"; return (${value.__js});`)())
-    } catch {
-      // 表达式求值不了时按"关掉"处理：宁可少一行能力，也不要让整条 preset 挂载失败。
-      return true
-    }
+    // An unknown ctx service can return undefined rather than throw, which would
+    // make the native loader enable it. Keep unsupported conditions truly off.
+    if (profileContextPredicate(value.__js) === null && evaluateDisabledPredicate(value.__js) === undefined) return true
+    return { __jsExpr: value.__js }
   }
   return value === true
 }

package/preset-backend/parse-composition.mjs

@@ -39,6 +39,56 @@ export class CompositionParseError extends Error {
 const isBlank = (line) => line.trim() === '' || line.trim().startsWith('#')
 const indentOf = (line) => line.length - line.trimStart().length
 
+/** Decode the YAML scalar around a tagged JS source; never execute the expression. */
+export function decodeJsExpression(raw, lineNo = 0) {
+  const source = String(raw).trim()
+  if (source === '') throw new CompositionParseError('!!js 后面没有表达式', lineNo)
+  if (source.startsWith("'")) {
+    if (!/^'(?:[^']|'')*'$/.test(source)) throw new CompositionParseError('!!js 单引号标量无效', lineNo)
+    return source.slice(1, -1).replace(/''/g, "'")
+  }
+  if (source.startsWith('"')) {
+    try {
+      const decoded = JSON.parse(source)
+      if (typeof decoded !== 'string') throw new Error('Expected a string')
+      return decoded
+    } catch {
+      throw new CompositionParseError('!!js 双引号标量无效', lineNo)
+    }
+  }
+  return source
+}
+
+/** The only context-service predicate currently understood by the editor. */
+export function profileContextPredicate(source) {
+  const match = /^(!{0,2})\s*ctx\s*\.\s*get\s*\(\s*(['"])profileContext\2\s*\)$/.exec(source)
+  return match === null ? null : match[1].length
+}
+
+/**
+ * Preserve existing non-context evaluation semantics for installed composition
+ * code, while unknown context references stay unsupported rather than guessed.
+ */
+export function evaluateDisabledPredicate(source, capabilities = {}) {
+  const negations = profileContextPredicate(source)
+  if (negations !== null) {
+    if (typeof capabilities?.profileContext !== 'boolean') return undefined
+    return negations === 1 ? !capabilities.profileContext : capabilities.profileContext
+  }
+  const code = source
+    .replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g, '')
+    .replace(/\/\*[\s\S]*?\*\/|\/\/[^\r\n]*/g, '')
+  if (/\bctx\b/.test(code)) return undefined
+  try {
+    // Composition files are installed executable code. No real host context is
+    // supplied, and the ctx parameter shadows any unrelated global of that name.
+    const evaluate = new Function('process', 'ctx', `return (${source});`)
+    return Boolean(evaluate(process, undefined))
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Parse a composition document into plain JS.
  *
@@ -156,9 +206,7 @@ export function parseScalar(raw, lineNo = 0) {
   const value = raw.trim()
   if (value === '') return null
   if (value.startsWith('!!js')) {
-    const source = value.slice(4).trim()
-    if (source === '') throw new CompositionParseError('!!js 后面没有表达式', lineNo)
-    return { __js: source }
+    return { __js: decodeJsExpression(value.slice(4), lineNo) }
   }
   if (value === 'true') return true
   if (value === 'false') return false