dsh-doc-assistant 0.1.14 → 0.1.18

package/src/host/preview.js

@@ -3,7 +3,7 @@
  *
  * PowerPoint is one PNG per slide. Word, Excel and PDF use the same page
  * PNGs. `/doc/page-text` without `page` is the PDF text layer. Word keeps
- * this native layer when available; other page requests use macOS Vision
+ * this native layer when available; pages without text use the system OCR
  * to read the page's PNG and return boxes only — the reader
  * does not paint the recognized glyphs. The PDF iframe remains the fallback
  * when both layers are empty.
@@ -27,15 +27,16 @@ import { extname, join } from 'node:path';
 import { enqueueRender } from './covers.js';
 import { available, convert, renderImages, ConvertError, WORD_PREVIEW_VERSION } from './convert.js';
 import { PREVIEW_UNAVAILABLE_MESSAGE, RUNTIME_HELP_URL, needsRuntimeHelp } from './setup.js';
-import { recognizePage } from './ocr.js';
+import { recognizePage, cachedPageRecognition } from './ocr.js';
 import { pdfPageText } from './pdfText.js';
+import { getPptxSlideImages } from './officeImages.js';
 
 /** Office/PDF files above this are refused before LibreOffice starts. */
 export const PREVIEW_LIMIT = 40_000_000;
 
 const MAX_CACHED = 40;
 const SLIDE_DPI = 144;
-const LAYOUT_FORMATS = new Set(['pdf', 'docx', 'xlsx', 'pptx']);
+const LAYOUT_FORMATS = new Set(['pdf', 'doc', 'docx', 'xlsx', 'pptx']);
 
 /** @type {Map<string, Promise<string>>} */
 const inflight = new Map();
@@ -86,7 +87,7 @@ async function sweep(dir) {
     await rm(join(dir, `${key}.json`), { force: true }).catch(() => undefined);
     const siblings = await readdir(dir).catch(() => []);
     await Promise.all(siblings
-      .filter((name) => name.startsWith(`${key}-p`) && (name.endsWith('.png') || name.endsWith('.png.ocr.json')))
+      .filter((name) => name.startsWith(`${key}-p`) && /\.(?:png|jpe?g)(?:\.ocr(?:-vision-[a-f\d]+)?\.json)?$/.test(name))
       .map((name) => rm(join(dir, name), { force: true }).catch(() => undefined)));
   }
 }
@@ -119,6 +120,29 @@ async function readPageCount(metaPath) {
  */
 export async function ensureSlide(abs, format, home, page, signal) {
   if (!Number.isInteger(page) || page < 1 || page > 5000) throw new Error('页码不正确');
+  if (signal?.aborted) throw new Error('版式预览已取消');
+  if (format === 'pptx') {
+    const before = await stat(abs);
+    if (before.size > PREVIEW_LIMIT) throw new Error('文件超过版式预览上限（40 MB）');
+    const original = await getPptxSlideImages(abs, { pages: [page] });
+    if (original.totalPages && page > original.totalPages) throw new Error('没有这一页');
+    const image = original.images[0];
+    if (image) {
+      const info = await stat(abs);
+      if (info.size !== before.size || info.mtimeMs !== before.mtimeMs || info.ino !== before.ino) {
+        throw new Error('文档已更新，请重新加载预览');
+      }
+      if (info.size > PREVIEW_LIMIT) throw new Error('文件超过版式预览上限（40 MB）');
+      const dir = join(home, 'previews');
+      const key = cacheKey(abs, info);
+      const imagePath = join(dir, `${key}-p${String(page).padStart(4, '0')}-source.${image.mime === 'image/jpeg' ? 'jpg' : 'png'}`);
+      await mkdir(dir, { recursive: true });
+      // Preserve the original page pixels and its OCR cache timestamps.
+      try { if ((await stat(imagePath)).size !== image.bytes.length) await writeFile(imagePath, image.bytes); }
+      catch { await writeFile(imagePath, image.bytes); }
+      return { pngPath: imagePath, pages: original.totalPages, mime: image.mime, aspect: image.width / image.height };
+    }
+  }
   const pdfPath = await ensurePdf(abs, format, home, signal);
   const fileStat = await stat(abs);
   const key = cacheKey(abs, fileStat);
@@ -370,11 +394,11 @@ export async function handleSlide(deps, _req, res, url) {
   try {
     const target = await resolveLayout(deps, url);
     const page = Number(url.searchParams.get('page') ?? '1');
-    const { pngPath, pages } = await ensureSlide(target.abs, target.format, deps.config.home, page);
+    const { pngPath, pages, mime } = await ensureSlide(target.abs, target.format, deps.config.home, page);
     if (res.writableEnded || res.headersSent) return;
     const body = await readFile(pngPath);
     res.writeHead(200, {
-      'content-type': 'image/png',
+      'content-type': mime || 'image/png',
       'content-length': String(body.length),
       'cache-control': 'private, max-age=300',
       'x-content-type-options': 'nosniff',
@@ -388,11 +412,95 @@ export async function handleSlide(deps, _req, res, url) {
   }
 }
 
+/** Shared reader/chat page recognition. Native PDF text takes precedence for
+ * every format; image pages use the same local OCR cache as the reader.
+ * A caller may supply the already parsed PDF layer to avoid reading it again.
+ * The optional selected-model fallback is restricted to this requested page.
+ */
+export function sparseNativeSlide(lines) {
+  const chars = lines.reduce((total, line) => total + String(line.text || '').replace(/\s+/g, '').length, 0);
+  const area = lines.reduce((total, line) => total + Math.max(0, Number(line.w) || 0) * Math.max(0, Number(line.h) || 0), 0);
+  // A heading, copyright or a few labels do not prove that the image body has
+  // a text layer. Dense text slides can keep their native, precise fast path.
+  return chars < 120 || (chars < 300 && area < .1);
+}
+
+export function mergePageText(native, recognized) {
+  const kept = native.map(line => ({ ...line, ocr: false }));
+  const comparable = text => String(text || '').replace(/\s+/g, '').toLowerCase();
+  for (const line of recognized) {
+    const duplicate = native.some(original => {
+      const ix = Math.min(original.x + original.w, line.x + line.w) - Math.max(original.x, line.x);
+      const iy = Math.min(original.y + original.h, line.y + line.h) - Math.max(original.y, line.y);
+      if (!(ix > 0 && iy > 0)) return false;
+      const overlap = ix * iy;
+      const originalArea = original.w * original.h, recognizedArea = line.w * line.h;
+      // Native spelling and exact glyphs win even when OCR makes a typo.
+      return overlap / recognizedArea > .7 || (comparable(original.text) === comparable(line.text)
+        && overlap / Math.min(originalArea, recognizedArea) > .5);
+    });
+    if (!duplicate) kept.push({ ...line, ocr: true });
+  }
+  return kept.sort((a, b) => Number(a.page) - Number(b.page) || a.y - b.y || a.x - b.x);
+}
+
+export async function recognizeLayoutPage(abs, format, home, page, options = {}) {
+  if (!Number.isInteger(page) || page < 1 || page > 5000) throw new Error('页码超出预览范围');
+  if (options.signal?.aborted) throw new Error('页面文字识别已取消');
+  // A strict full-slide source image needs neither Office conversion nor PDF
+  // parsing. Complex or editable slides still use the regular render path.
+  const embedded = format === 'pptx' ? (await getPptxSlideImages(abs, { pages: [page] })).images[0] : null;
+  const text = options.nativeText || (embedded ? { pages: 0, aspect: embedded.width / embedded.height, lines: [] }
+    : await pdfPageText(await ensurePdf(abs, format, home, options.signal)));
+  const native = (Array.isArray(text.lines) ? text.lines : []).filter(line => Number(line.page) === page);
+  if (native.length > 0 && ((format !== 'pptx' && options.inspectImages !== true) || !sparseNativeSlide(native))) return { source: 'pdf', pages: Number(text.pages) || page,
+    aspect: Number(text.aspect) || .772, lines: native };
+  const { pngPath, pages } = await ensureSlide(abs, format, home, page, options.signal);
+  const local = await recognizePage(pngPath, home, options.localOcr || {});
+  if (options.signal?.aborted) throw new Error('页面文字识别已取消');
+  let recognized = local;
+  if (options.allowVision !== false && options.deps && options.route &&
+      (local.lines.length === 0 || local.ocr?.code === 'missing-chinese')) {
+    const { recognizeVisionPage } = await import('./visionOcr.js');
+    const visual = await recognizeVisionPage(options.deps, options.route, pngPath, { signal: options.signal });
+    if (visual?.ocr?.status === 'ready' || visual?.ocr?.status === 'empty') recognized = visual;
+    else if (visual?.ocr?.error) recognized = { ...local, ocr: { ...local.ocr, visionError: visual.ocr.error } };
+  }
+  const ocrLines = recognized.lines.map(line => ({ ...line, page }));
+  const lines = native.length ? mergePageText(native, ocrLines) : ocrLines;
+  return { source: native.length ? (lines.some(line => line.ocr) ? 'mixed' : 'pdf') : 'ocr', pages,
+    aspect: recognized.aspect > 0 ? recognized.aspect : Number(text.aspect) || .772,
+    lines, ocr: recognized.ocr };
+}
+
+/** Chat can reuse reader OCR without converting/rendering/recognizing a page.
+ * Returns null when it has not yet been recognized. This is intentionally
+ * cache-only: whole-document chat chooses its own bounded image strategy.
+ */
+export async function cachedLayoutPageText(abs, format, home, page, options = {}) {
+  if (!Number.isInteger(page) || page < 1 || page > 5000) return null;
+  let info;
+  try { info = await stat(abs); } catch { return null; }
+  const key = cacheKey(abs, info);
+  const base = join(home, 'previews', `${key}-p${String(page).padStart(4, '0')}`);
+  for (const imagePath of [`${base}-source.jpg`, `${base}-source.png`, `${base}.png`]) {
+    const local = await cachedPageRecognition(imagePath);
+    if (local?.lines.length && local.ocr?.code !== 'missing-chinese') return { source: 'ocr', ...local, lines: local.lines.map(line => ({ ...line, page })) };
+    if (options.route) {
+      const { cachedVisionRecognition } = await import('./visionOcr.js');
+      const visual = await cachedVisionRecognition(imagePath, options.route);
+      if (visual?.lines.length) return { source: 'ocr', ...visual, lines: visual.lines.map(line => ({ ...line, page })) };
+    }
+    if (local?.lines.length) return { source: 'ocr', ...local, lines: local.lines.map(line => ({ ...line, page })) };
+  }
+  return null;
+}
+
 /**
  * `GET /doc/page-text` — selectable lines for the layout preview.
  * Without `page`, this is the PDF text layer for the whole document.
- * With `page`, Word first uses the native PDF text (`source: "pdf"`);
- * only pages without native text fall back to Vision (`source: "ocr"`).
+ * With `page`, native PDF text is preferred (`source: "pdf"`);
+ * image pages use local system OCR or the explicitly selected vision model.
  * An empty `lines` list means the reader should keep whatever it already has.
  * Business failures stay `{ ok: false }` at HTTP 200.
  *
@@ -407,28 +515,24 @@ export async function handlePageText(deps, _req, res, url) {
     const pageRaw = url.searchParams.get('page');
     if (pageRaw != null && pageRaw !== '') {
       const page = Number(pageRaw);
-      if (!Number.isInteger(page) || page < 1 || page > 80) throw new Error('页码超出预览范围');
-      if (target.format === 'docx') {
-        const pdfPath = await ensurePdf(target.abs, target.format, deps.config.home);
-        const text = await pdfPageText(pdfPath);
-        const lines = text.lines.filter((line) => Number(line.page) === page);
-        if (lines.length > 0) {
-          if (res.writableEnded || res.headersSent) return;
-          sendJson(res, { ok: true, source: 'pdf', pages: text.pages, aspect: text.aspect, lines });
-          return;
-        }
+      if (!Number.isInteger(page) || page < 1 || page > 5000) throw new Error('页码超出预览范围');
+      let route;
+      if (url.searchParams.has('provider') || url.searchParams.has('model')) {
+        const { selectedModelRoute } = await import('./chat.js');
+        route = await selectedModelRoute(deps, { provider: url.searchParams.get('provider'), model: url.searchParams.get('model') });
+      } else {
+        const { resolveRoute } = await import('./revise.js');
+        route = await resolveRoute(deps.ctx, deps, {});
       }
-      const { pngPath, pages } = await ensureSlide(target.abs, target.format, deps.config.home, page);
-      const ocr = await recognizePage(pngPath, deps.config.home);
-      if (res.writableEnded || res.headersSent) return;
-      const lines = (Array.isArray(ocr.lines) ? ocr.lines : []).map((line) => ({ ...line, page }));
-      sendJson(res, {
-        ok: true,
-        source: 'ocr',
-        pages,
-        aspect: ocr.aspect > 0 ? ocr.aspect : 0.772,
-        lines,
+      const recognized = await recognizeLayoutPage(target.abs, target.format, deps.config.home, page, {
+        deps, route,
+        // PPTX requests only its active slide. PDF/Word readers prefetch their
+        // complete local text layer, so a missing system OCR must not silently
+        // turn that prefetch into dozens of paid vision requests.
+        allowVision: target.format === 'pptx' || url.searchParams.get('vision') === '1',
       });
+      if (res.writableEnded || res.headersSent) return;
+      sendJson(res, { ok: true, ...recognized });
       return;
     }
     const pdfPath = await ensurePdf(target.abs, target.format, deps.config.home);

package/src/host/revise.js

@@ -64,7 +64,12 @@
  */
 
 import { randomUUID } from 'node:crypto';
+import { realpath } from 'node:fs/promises';
 import { expansionPlan, expansionPrompt } from './expansion.js';
+import { needsRevisionBoundary, normalizeRevisionBoundary, revisionBoundaryPrompt } from './revisionBoundary.js';
+import { resolveWordSelection, protectWordSelectionPrefix } from './wordSelection.js';
+import { rebaseRevisionSelection } from './revisionRebase.js';
+import { createWriteback } from './writeback.js';
 
 // ---------------------------------------------------------------------------
 // deps / ctx normalization
@@ -158,6 +163,7 @@ export const SYSTEM_PROMPT = [
   '3. 不得增删事实；不得编造原文没有的数字、日期、名称。',
   '4. 如果原文没有需要改动的地方，原样返回。',
   '5. 同时给出一句不超过 50 字的修改理由。',
+  '6. 润色和扩写只替换选区本身：原文没有选入末尾句末标点时，结尾不得新增句末标点，选区外的标点会保留。',
   '',
   '【输出格式】',
   '只返回一个 JSON 对象，前后不要有任何其他文字（不要 Markdown 代码块）：',
@@ -181,6 +187,8 @@ function buildUserPrompt(p) {
   if (p.before) parts.push(`【上文】\n${p.before}`);
   if (p.after) parts.push(`【下文】\n${p.after}`);
   parts.push(`【待改写的原文】\n<<<ORIGINAL\n${p.original}\nORIGINAL>>>`);
+  if (p.protectBoundary) parts.push(revisionBoundaryPrompt(p.boundaryOriginal ?? p.original));
+  if (p.wholeSelection) parts.push('【完整选区】以上原文由多个相邻段落组成，是同一次选择。必须一次处理全部选中内容，revised 返回整份完整结果；不得只处理第一段或最后一段，不得省略中间任何一句。可按逻辑使用换行，不要把结果按原段字数拆分；原文开头独立的列表标记保持原样。');
   parts.push('请只返回改写后的这段文字（不要包含 <<<ORIGINAL 标记），并附一句理由。');
   return parts.join('\n\n');
 }
@@ -593,6 +601,7 @@ async function viaLlm(ctx, deps, params, req) {
         throw new Error(`模型调用失败：${chunk.reason?.failure?.message ?? '未知错误'}`);
       }
       if (kind === 'aborted') throw new Error('改写请求已取消');
+      if (kind === 'max-tokens') throw new Error('修改结果超过模型输出长度，未生成修订；请缩小选区后重试');
     }
   }
   return { raw: text, model: `${route.provider}/${route.model}` };
@@ -771,6 +780,11 @@ function pushVersion(revision, at = Date.now()) {
   return revision;
 }
 
+async function relocateSelection(deps, params, phase) {
+  try { return await rebaseRevisionSelection(deps, params); }
+  catch (error) { error.message = `${phase}：${error.message}`; throw error; }
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -794,7 +808,8 @@ function pushVersion(revision, at = Date.now()) {
 export async function generate(first, params, completedReply) {
   const { ctx, deps } = normalizeDeps(first);
   if (!params || typeof params !== 'object') throw new Error('revise.generate 缺少参数');
-  const { anchor, instruction, styleId } = params;
+  const { instruction, styleId } = params;
+  let anchor = params.anchor ? structuredClone(params.anchor) : params.anchor;
   if (!anchor || typeof anchor !== 'object') throw new Error('缺少修订锚点 anchor');
 
   const docir = deps.docir ?? (await import('./docir.js'));
@@ -817,22 +832,46 @@ export async function generate(first, params, completedReply) {
     }
   }
 
-  const initialInfo = abs ? await docir.detect(abs) : null;
-  const earlyFormat = params.format ?? (initialInfo ? initialInfo.format : 'markdown');
+  const sourceIdentity = abs ? await realpath(abs) : null;
+  const locked = fn => abs && projects?.resolve ? createWriteback(deps).withDocLock(project, params.path, async () => {
+    const live = projects.get?.(project.id);
+    if (typeof projects.get === 'function' && !live) throw new Error('项目已被移除，已取消生成修订');
+    const current = projects.resolve(project.id, params.path);
+    if (current.readOnly) throw new Error('文档所在根目录已改为只读，已取消生成修订');
+    if (await realpath(current.abs) !== sourceIdentity) throw new Error('文档所在根目录已改变，已取消生成修订');
+    return fn();
+  }) : fn();
+  let initialInfo, earlyFormat, parsed = null, wordSelection, resolvedAnchor, original;
+  await locked(async () => {
+  initialInfo = abs ? await docir.detect(abs) : null;
+  earlyFormat = params.format ?? (initialInfo ? initialInfo.format : 'markdown');
   if (!writers.canWrite?.(earlyFormat) && writers.reason?.(earlyFormat)) {
     throw new Error(`无法为 ${earlyFormat} 生成可写回的修订：${writers.reason(earlyFormat)}`);
   }
 
-  let parsed = null;
+  if (params.expectedDocumentHash && initialInfo && params.expectedDocumentHash !== initialInfo.hash) {
+    const relocated = await relocateSelection(deps, { project, path: params.path, abs,
+      fromHash: params.expectedDocumentHash, toHash: initialInfo.hash, anchor,
+      original: params.expectedOriginal ?? params.original, format: earlyFormat }, '文档在选中后已经变化');
+    anchor = relocated.anchor; source = undefined;
+  }
   if (source === undefined) {
     const loaded = await loadPlain(docir, abs, earlyFormat);
     source = loaded.source;
     parsed = loaded.doc;
   }
-  let resolvedAnchor = enrichAnchor(anchor, parsed);
+  if (earlyFormat === 'docx' && !parsed && abs) parsed = await docir.parse(abs);
+  wordSelection = earlyFormat === 'docx' && parsed ? resolveWordSelection(parsed, anchor) : null;
+  if (earlyFormat === 'docx' && Array.isArray(anchor.segments) && !wordSelection) throw new Error('复合 Word 选区必须核对文档真实段落');
+  resolvedAnchor = wordSelection?.anchor || enrichAnchor(anchor, parsed);
+  if (wordSelection) source = (await import('./office.js')).plainSource(parsed);
 
   // ---- extract the original text for the anchor --------------------------
-  let original = params.original;
+  original = params.original;
+  if (wordSelection) {
+    if (original !== undefined && original !== wordSelection.original) throw new Error('选区文字与文档中的完整原文不一致，请重新选择后生成修订');
+    original = wordSelection.original;
+  }
   if (original === undefined) {
     if (Number.isInteger(resolvedAnchor.srcStart) && Number.isInteger(resolvedAnchor.srcEnd)) {
       original = source.slice(resolvedAnchor.srcStart, resolvedAnchor.srcEnd);
@@ -853,16 +892,22 @@ export async function generate(first, params, completedReply) {
   if (typeof params.expectedOriginal === 'string' && params.expectedOriginal !== original) {
     throw new Error('选区文字与文档中的完整原文不一致，请重新选择后生成修订');
   }
-  if (params.expectedDocumentHash && abs && (await docir.detect(abs)).hash !== params.expectedDocumentHash) {
+  if (initialInfo && abs && (await docir.detect(abs)).hash !== initialInfo.hash) {
     throw new Error('文档在选中后已经变化，请重新打开并选择文字');
   }
+  });
 
   // 用户在「改文本框」里自己改的字，不再送给模型。写回仍用同一条修订。
   if (typeof params.revised === 'string') {
-    const revised = params.revised;
+    return locked(async () => {
+    const revised = completedReply ? protectWordSelectionPrefix(resolvedAnchor, normalizeRevisionBoundary(original, params.revised)) : params.revised;
     if (revised.length > 8000) throw new Error('修改内容过长，无法生成修订');
     const manualInfo = abs ? await docir.detect(abs) : { hash: '' };
-    if (initialInfo && manualInfo.hash !== initialInfo.hash) throw new Error('文档在生成修订期间发生变化，请重新选择后再试');
+    if (initialInfo && manualInfo.hash !== initialInfo.hash) {
+      const moved = await relocateSelection(deps, { project, path: params.path, abs,
+        fromHash: initialInfo.hash, toHash: manualInfo.hash, anchor: resolvedAnchor, original, format: earlyFormat }, '文档在生成修订期间发生变化');
+      resolvedAnchor = moved.anchor;
+    }
     if (completedReply && revised.replace(/\r\n?/g, '\n').trim() === original.replace(/\r\n?/g, '\n').trim()) {
       return { unchanged: true, projectId: project.id ?? params.projectId, docPath: params.path,
         original, revised: original, action: 'chat', model: completedReply.model, status: 'unchanged' };
@@ -889,6 +934,7 @@ export async function generate(first, params, completedReply) {
     pushVersion(manual);
     if (deps.revisions?.save) await deps.revisions.save(project, manual);
     return manual;
+    });
   }
 
   // ---- style preset ------------------------------------------------------
@@ -909,6 +955,8 @@ export async function generate(first, params, completedReply) {
     before,
     after,
     original,
+    protectBoundary: needsRevisionBoundary(params.action, instruction),
+    wholeSelection: Array.isArray(resolvedAnchor.segments),
   });
 
   const signal = params.signal ?? new AbortController().signal;
@@ -920,8 +968,10 @@ export async function generate(first, params, completedReply) {
     expansionTargetChars: setting(deps, 'expansionTargetChars', 300),
   }) : null;
 
-  const out = await rewriteOnce(ctx, deps, plan && params.maxTokens === undefined
-    ? { ...params, maxTokens: Math.min(32768, Math.max(4096, plan.targetChars * 4 + 1024)) } : params, {
+  const wholeSelection = Array.isArray(resolvedAnchor.segments);
+  const budget = plan ? plan.targetChars * 4 + 1024 : original.length * 4 + 1024;
+  const out = await rewriteOnce(ctx, deps, (plan || wholeSelection) && params.maxTokens === undefined
+    ? { ...params, maxTokens: Math.min(32768, Math.max(4096, budget)) } : params, {
     system: SYSTEM_PROMPT,
     user: expansion ? `${user}\n\n${expansionPrompt(plan)}\n第二份完整文本放在 alternatives 数组中（最多一项），不要为了凑两份只改措辞。` : user,
     original,
@@ -933,12 +983,21 @@ export async function generate(first, params, completedReply) {
   });
 
   // ---- assemble the Revision (§3) ---------------------------------------
+  return locked(async () => {
   const info = abs ? await docir.detect(abs) : { hash: '' };
-  if (initialInfo && info.hash !== initialInfo.hash) throw new Error('文档在生成修订期间发生变化，请重新选择后再试');
+  if (initialInfo && info.hash !== initialInfo.hash) {
+    const moved = await relocateSelection(deps, { project, path: params.path, abs,
+      fromHash: initialInfo.hash, toHash: info.hash, anchor: resolvedAnchor, original, format: earlyFormat }, '文档在生成修订期间发生变化');
+    resolvedAnchor = moved.anchor;
+  }
   const sameText = text => text.replace(/\r\n?/g, '\n').trim() === original.replace(/\r\n?/g, '\n').trim();
   const extraChoices = expansion && Array.isArray(out.alternatives) ? out.alternatives.filter(item => item && typeof item.revised === 'string'
     && item.revised.trim() && item.revised.length <= 8000).slice(0, 1) : [];
+  const protectBoundary = needsRevisionBoundary(params.action, instruction);
   const choices = [{ revised: out.revised, rationale: out.rationale }, ...extraChoices]
+    .map(item => ({ ...item, revised: protectWordSelectionPrefix(resolvedAnchor,
+      protectBoundary ? normalizeRevisionBoundary(original, item.revised) : item.revised) }))
+    .filter(item => !protectBoundary || item.revised.trim() !== '')
     .filter((item, index, all) => !sameText(item.revised) && all.findIndex(other => other.revised.trim() === item.revised.trim()) === index);
   if (!choices.length) {
     return { unchanged: true, projectId: project.id ?? params.projectId, docPath: params.path,
@@ -964,6 +1023,7 @@ export async function generate(first, params, completedReply) {
     instruction: instruction ?? '',
     rationale: primary.rationale,
     status: 'pending',
+    layoutWarning: null,
     versions: [],
     createdAt: Date.now(),
     model: out.model,
@@ -982,6 +1042,7 @@ export async function generate(first, params, completedReply) {
   if (deps.revisions?.save) await deps.revisions.save(project, revision);
   for (const alternative of alternatives) if (deps.revisions?.save) await deps.revisions.save(project, alternative);
   return revision;
+  });
 }
 
 /** A chat completion already supplied the wording; reuse all source/hash checks without a second model call. */
@@ -1011,6 +1072,7 @@ export async function iterate(first, params) {
   if (!params.instruction) throw new Error('revise.iterate 缺少 instruction');
 
   const docir = deps.docir ?? (await import('./docir.js'));
+  const writers = deps.writers ?? (await import('./writers/index.js'));
 
   // Locate the stored revision: explicit object, or via the revisions service.
   let revision = params.revision;
@@ -1026,21 +1088,55 @@ export async function iterate(first, params) {
     if (!revision) throw new Error(`找不到修订 ${params.revisionId}`);
   }
   if (revision.status === 'rejected') throw new Error('该修订已被拒绝，请重新生成');
+  let sourceIdentity;
+  const locked = fn => deps.projects?.resolve && project
+    ? createWriteback(deps).withDocLock(project, revision.docPath, async () => {
+      if (typeof deps.projects.get === 'function' && !deps.projects.get(project.id)) throw new Error('项目已被移除，已取消生成修订');
+      const current = deps.projects.resolve(project.id, revision.docPath);
+      if (current.readOnly) throw new Error('文档所在根目录已改为只读，已取消生成修订');
+      if (sourceIdentity && await realpath(current.abs) !== sourceIdentity) throw new Error('文档所在根目录已改变，已取消生成修订');
+      return fn();
+    }) : fn();
 
   // Read the *current* file so context reflects what is actually on disk.
   // Office context is the extracted plain text, not the zip.
   let source = params.source;
   let abs = params.abs;
-  if (source === undefined && deps.projects?.resolve && revision.docPath) {
+  let iterateInfo = null, iterateDoc = null;
+  if (!abs && deps.projects?.resolve && revision.docPath) {
     const pid = params.projectId ?? revision.projectId;
-    const resolved = deps.projects.resolve(pid, revision.docPath);
-    abs = resolved.abs;
-    const fmt = (await docir.detect(abs)).format;
-    const loaded = await loadPlain(docir, abs, fmt);
-    source = loaded.source;
+    abs = deps.projects.resolve(pid, revision.docPath).abs;
+  }
+  sourceIdentity = abs ? await realpath(abs) : null;
+  let anchor = revision.anchor ?? {};
+  await locked(async () => {
+  if (abs) {
+    iterateInfo = await docir.detect(abs);
+    const fmt = iterateInfo.format;
+    if (!writers.canWrite?.(fmt) && writers.reason?.(fmt)) {
+      throw new Error(`无法继续修改 ${fmt} 修订：${writers.reason(fmt)}`);
+    }
+    if (source === undefined) {
+      const loaded = await loadPlain(docir, abs, fmt);
+      source = loaded.source;
+      iterateDoc = loaded.doc;
+    }
   }
 
-  const anchor = revision.anchor ?? {};
+  if (abs && iterateInfo && revision.docHash !== iterateInfo.hash) {
+    const moved = await rebaseRevisionSelection(deps, { project, path: revision.docPath, abs,
+      fromHash: revision.docHash, toHash: iterateInfo.hash, anchor, original: revision.original, format: iterateInfo.format });
+    anchor = moved.anchor;
+  }
+  if (iterateInfo?.format === 'docx') {
+    iterateDoc = await docir.parse(abs);
+    const selected = resolveWordSelection(iterateDoc, anchor);
+    if (selected.original !== revision.original) throw new Error('修订的完整原文已经变化，请重新选择');
+    anchor = selected.anchor;
+    source = (await import('./office.js')).plainSource(iterateDoc);
+  }
+  if (abs && iterateInfo && (await docir.detect(abs)).hash !== iterateInfo.hash) throw new Error('文档在读取修订期间发生变化');
+  });
   const { before, after } = Number.isInteger(anchor.srcStart)
     ? surrounding(source ?? '', anchor.srcStart, anchor.srcEnd, setting(deps, 'contextChars', 200))
     : { before: '', after: '' };
@@ -1057,9 +1153,13 @@ export async function iterate(first, params) {
     original: revision.revised,
     before,
     after,
+    protectBoundary: needsRevisionBoundary(revision.action, combinedInstruction),
+    boundaryOriginal: revision.original,
+    wholeSelection: Array.isArray(anchor.segments),
   });
 
-  const out = await rewriteOnce(ctx, deps, params, {
+  const out = await rewriteOnce(ctx, deps, Array.isArray(anchor.segments) && params.maxTokens === undefined
+    ? { ...params, maxTokens: Math.min(32768, Math.max(4096, String(revision.revised || '').length * 4 + 1024)) } : params, {
     system: SYSTEM_PROMPT,
     user,
     original: revision.revised,
@@ -1070,13 +1170,29 @@ export async function iterate(first, params) {
     prefer: resolveChannel(deps, params),
   });
 
+  if (needsRevisionBoundary(revision.action, combinedInstruction)) {
+    out.revised = normalizeRevisionBoundary(String(revision.original ?? ''), out.revised);
+  }
+  out.revised = protectWordSelectionPrefix(anchor, out.revised);
+  return locked(async () => {
+  const endInfo = abs ? await docir.detect(abs) : iterateInfo;
+  if (abs && iterateInfo && endInfo.hash !== iterateInfo.hash) {
+    const moved = await rebaseRevisionSelection(deps, { project, path: revision.docPath, abs,
+      fromHash: iterateInfo.hash, toHash: endInfo.hash, anchor, original: revision.original, format: endInfo.format });
+    anchor = moved.anchor;
+  }
+  if (out.revised.replace(/\r\n?/g, '\n').trim() === String(revision.revised ?? '').replace(/\r\n?/g, '\n').trim()) return revision;
+
   const next = {
     ...revision,
+    anchor,
     revised: out.revised,
     rationale: out.rationale,
     instruction: combinedInstruction,
     status: 'pending',
     model: out.model,
+    error: '',
+    layoutWarning: null,
     // Recompute against the *original* text, not the previous revision, so the
     // diff the user sees is always "current file -> proposed text".
     inlineDiff:
@@ -1095,10 +1211,19 @@ export async function iterate(first, params) {
 
   if (deps.revisions?.update) {
     const proj = project ?? (deps.projects?.get ? deps.projects.get(next.projectId) : null);
-    if (proj) return deps.revisions.update(proj, next.id, next);
+    if (proj) {
+      const current = typeof deps.revisions.get === 'function' ? await deps.revisions.get(proj, next.id) : revision;
+      if (!current || current.deletedAt || current.status !== 'pending') throw new Error('这张修订在生成期间已经改变，请重新生成');
+      if (endInfo?.hash && current.docHash !== endInfo.hash) {
+        if (!deps.revisions.rebase) throw new Error('修订存储尚不支持安全重定位');
+        await deps.revisions.rebase(proj, next.id, { fromHash: current.docHash, docHash: endInfo.hash, anchor });
+      }
+      return deps.revisions.update(proj, next.id, next);
+    }
   }
   void docir;
   return next;
+  });
 }
 
 export default { generate, fromChatReply, iterate, parseRewriteReply, resolveParentAgent, resolveChannel, resolveRoute, diffWords, RESPONSE_SCHEMA, SYSTEM_PROMPT };

package/src/host/revisionBoundary.js

@@ -0,0 +1,45 @@
+/** Keep model rewrites within the punctuation boundary of the selected text.
+ * Only generated revision text uses this helper; manual replacements and
+ * ordinary chat/translation replies remain literal user/model content.
+ */
+const STOPS = /[。！？；.!?;]/;
+const CLOSE = new Set(Array.from('”’"\'」』》〉】〕〗］）)]}'));
+const TAIL_SPACE = /[\s\u200b-\u200d\u2060\ufeff]/;
+const TAIL_SPACES = /[\s\u200b-\u200d\u2060\ufeff]*$/;
+
+/** Inspect a final stop before optional closing quotes/brackets and whitespace. */
+export function hasTrailingSentencePunctuation(text) {
+  let end = String(text || '').replace(TAIL_SPACES, '').length;
+  const value = String(text || '');
+  while (end > 0 && (CLOSE.has(value[end - 1]) || TAIL_SPACE.test(value[end - 1]))) end -= 1;
+  return end > 0 && STOPS.test(value[end - 1]);
+}
+
+/** Remove introduced terminal stops only; internal punctuation, decimal text,
+ * trailing whitespace and closing punctuation retain their original spelling.
+ */
+export function normalizeRevisionBoundary(original, revised) {
+  if (typeof revised !== 'string' || hasTrailingSentencePunctuation(original)) return revised;
+  let value = revised;
+  while (value) {
+    const whitespace = TAIL_SPACES.exec(value)[0];
+    const body = value.slice(0, value.length - whitespace.length);
+    let end = body.length;
+    while (end > 0 && (CLOSE.has(body[end - 1]) || TAIL_SPACE.test(body[end - 1]))) end -= 1;
+    let start = end;
+    while (start > 0 && STOPS.test(body[start - 1])) start -= 1;
+    if (start === end) break;
+    value = body.slice(0, start) + body.slice(end) + whitespace;
+  }
+  return value;
+}
+
+export function revisionBoundaryPrompt(original) {
+  return hasTrailingSentencePunctuation(original)
+    ? '【选区末尾边界】只替换选区本身，保留选区外的文字和标点。原文已选入末尾标点，可按修改要求调整句式与标点。'
+    : '【选区末尾边界】原文没有选入末尾句末标点，revised 及每份 alternatives 的结尾不得新增。！？；或英文 .!?;。不要为了组成完整句子补标点，也不要在末尾引号或括号内补句末标点；内部标点可正常使用，保留成对引号括号。选区外原有的标点会保留。';
+}
+
+export function needsRevisionBoundary(action, instruction) {
+  return action === 'polish' || action === 'expand' || action === 'chat' || /(?:润色|扩写)/.test(instruction || '');
+}