dsh-instruction-memory 1.3.3 → 1.4.1

package/lib/client.js

@@ -22,6 +22,18 @@ window.__ModuleLoader__.load({
 
     const API = '/instruction-memory/api'
 
+    // The Host bounds one delivery at 60 s (lib/mailer.js SMTP_TOTAL_TIMEOUT_MS).
+    // Waiting longer than the generic 15 s keeps the panel honest: aborting while
+    // the Host is still delivering would tell the user "timed out" for a mail
+    // that then arrives, and the obvious retry would send a second copy.
+    const FEEDBACK_SEND_TIMEOUT_MS = 90000
+
+    // Feedback form: the kinds are a closed set shared with the Host (see
+    // lib/mailer.js); the ceilings repeat the Host defaults so an older Host
+    // that does not publish limits.maxFeedback* still renders a safe form.
+    const FEEDBACK_TYPES = ['bug', 'suggestion', 'other']
+    const FEEDBACK_DEFAULTS = Object.freeze({ maxTitle: 120, maxBody: 4000, maxContact: 200 })
+
     const CSS = `
 .im-root { display:flex; flex-direction:column; gap:16px; padding:6px 2px 56px; max-width:860px;
   color:var(--dsw-alias-label-primary,#1f2329); font-size:13px; line-height:1.6; }
@@ -32,6 +44,14 @@ window.__ModuleLoader__.load({
 .im-row { display:flex; align-items:center; justify-content:space-between; gap:12px; }
 .im-row-wrap { display:flex; align-items:center; gap:8px; flex-wrap:wrap; }
 .im-grid2 { display:grid; grid-template-columns:1fr 1fr; gap:10px; }
+/* The desktop shell is routinely dragged narrow: below this width the two
+   columns squeeze labels and placeholders into three-word lines. One column
+   keeps the form readable; the batch tag field already wraps, it just needs
+   its 160px floor lifted so it does not overflow. */
+@media (max-width:560px) {
+  .im-grid2 { grid-template-columns:1fr; }
+  .im-batch-tags .im-input { flex:1 1 100%; min-width:0; }
+}
 .im-spacer { flex:1; }
 .im-btn { border:1px solid var(--dsw-alias-border-l2,rgba(0,0,0,.18)); background:var(--dsw-alias-bg-layer-1,#fff);
   color:inherit; border-radius:8px; padding:5px 12px; font-size:12px; font-family:inherit; cursor:pointer; }
@@ -83,6 +103,9 @@ window.__ModuleLoader__.load({
 .im-batch-bar { display:flex; align-items:center; gap:8px; flex-wrap:wrap; padding:10px 12px; border-radius:10px;
   border:1px solid var(--dsw-alias-state-warn-primary,#d97706); background:rgba(217,119,6,.08); }
 .im-batch-check { width:15px; height:15px; margin:0; cursor:pointer; accent-color:var(--dsw-alias-brand-primary,#3b6cff); }
+.im-batch-tags { display:flex; align-items:center; gap:8px; flex-wrap:wrap; padding:8px 12px; border-radius:10px;
+  border:1px dashed var(--dsw-alias-state-warn-primary,#d97706); background:rgba(217,119,6,.05); }
+.im-batch-tags .im-input { flex:1; min-width:160px; width:auto; }
 .im-profiles { border:1px solid var(--dsw-alias-border-l1,rgba(0,0,0,.1)); border-radius:10px; padding:10px 12px;
   background:var(--dsw-alias-bg-layer-1,#fff); }
 .im-profiles-head { display:flex; align-items:center; gap:8px; flex-wrap:wrap; }
@@ -111,7 +134,9 @@ window.__ModuleLoader__.load({
 .im-dot-off { background:var(--dsw-alias-state-warn-primary,#d97706); }
 .im-dot-err { background:var(--dsw-alias-state-error-primary,#d94838); }
 .im-body-open { max-height:none; }
-.im-more { margin-top:4px; font-size:11.5px; color:var(--dsw-alias-brand-primary,#3b6cff); cursor:pointer; user-select:none; }
+.im-more { display:block; margin-top:4px; padding:0; border:0; background:transparent; font-family:inherit;
+  font-size:11.5px; color:var(--dsw-alias-brand-primary,#3b6cff); cursor:pointer; user-select:none; text-align:left; }
+.im-more:focus-visible { outline:2px solid var(--dsw-alias-brand-primary,#3b6cff); outline-offset:2px; border-radius:4px; }
 .im-search-meta { margin-top:5px; }
 .im-meter-line { margin-top:5px; }
 .im-undo { display:flex; align-items:center; gap:10px; padding:9px 13px; border-radius:8px; font-size:12px;
@@ -173,6 +198,16 @@ window.__ModuleLoader__.load({
   padding:6px 10px; border-radius:8px; font-size:12px;
   border:1px solid var(--dsw-alias-state-warn-primary,#d97706);
   background:var(--dsw-alias-state-warn-bg,rgba(217,119,6,.12)); color:var(--dsw-alias-state-warn-primary,#d97706); }
+/* ---- 反馈邮件 ---- */
+.im-feedback { display:flex; flex-direction:column; gap:8px; }
+.im-feedback-head { display:flex; align-items:center; gap:8px; flex-wrap:wrap; }
+.im-feedback-head .im-section-title { flex:1; }
+.im-feedback-form { display:flex; flex-direction:column; gap:8px; padding:10px 12px; border-radius:8px;
+  border:1px solid var(--dsw-alias-border-l1,rgba(0,0,0,.1)); background:var(--dsw-alias-bg-base,#fff); }
+.im-feedback-form .im-textarea { min-height:110px; }
+.im-feedback-hint { font-size:11.5px; color:var(--dsw-alias-label-secondary,#8a9099); }
+.im-feedback-actions { display:flex; align-items:center; gap:8px; flex-wrap:wrap; }
+.im-feedback-actions .im-meta { flex:1; }
 @media (max-width:640px) { .im-grid2 { grid-template-columns:1fr; } }
 `
 
@@ -224,6 +259,7 @@ window.__ModuleLoader__.load({
         'editor.hint': '保存后对下一轮对话立即生效',
         'editor.needTitleOrContent': '请至少填写标题或指令内容',
         'editor.confirmDiscard': '当前编辑内容尚未保存，确定放弃这些修改吗？',
+        'confirm.unavailable': '当前环境无法弹出确认对话框，操作已取消，未做任何改动。',
         'body.expand': '展开全部',
         'body.collapse': '收起',
         'budget.label': '注入字数上限（字符）',
@@ -243,6 +279,7 @@ window.__ModuleLoader__.load({
         'tags.label': '标签（可选，仅用于在本页分组与筛选，不会注入提示词）',
         'tags.placeholder': '输入标签后回车，逗号分隔多个，例如：代码规范',
         'tags.hint': '每条最多 {max} 个标签，单个不超过 {len} 字符',
+        'tags.remove': '移除标签 {tag}',
         'tags.duplicate': '已有同名标签',
         'tags.full': '每条最多 {max} 个标签',
         'filter.all': '全部',
@@ -270,7 +307,9 @@ window.__ModuleLoader__.load({
         'batch.tagPrompt': '输入要添加到 {count} 条指令的标签（多个用逗号分隔）',
         'batch.tagEmpty': '未输入有效的标签',
         'batch.noneSelected': '请先勾选要操作的指令',
-        'batch.promptUnavailable': '当前环境不支持快捷输入，请逐条编辑标签',
+        'batch.tagInputPlaceholder': '输入要添加的标签（多个用逗号分隔）',
+      'batch.tagConfirm': '添加',
+      'batch.tagCancel': '取消',
         'profiles.section': '用户形象',
         'profiles.subtitle': '关于你本人的身份背景、喜好、性格与追求。勾选「使用该形象」后，AI 会在保证回答正确且扣题的前提下据此调整详略、举例与建议侧重；不会为了迎合而改变事实或偏离问题。',
         'profiles.new': '＋ 新增形象',
@@ -369,6 +408,35 @@ window.__ModuleLoader__.load({
         'diag.issueWarning': '存储警告',
         'diag.issueHistory': '历史错误',
         'diag.issueSection': '注入错误',
+        // ---- 反馈邮件 ----
+        'feedback.section': '反馈',
+        'feedback.show': '反馈',
+        'feedback.hide': '收起反馈',
+        'feedback.intro': '遇到问题或有功能建议？填写下面的表单，通过邮件发送给插件维护者。',
+        'feedback.typeLabel': '问题类型',
+        'feedback.typeBug': '问题反馈（Bug）',
+        'feedback.typeSuggestion': '功能建议',
+        'feedback.typeOther': '其他',
+        'feedback.titleLabel': '标题',
+        'feedback.titlePlaceholder': '一句话概括问题或建议',
+        'feedback.bodyLabel': '详细描述',
+        'feedback.bodyPlaceholder': '复现步骤、期望结果、实际表现；建议请说明使用场景',
+        'feedback.contactLabel': '联系方式（可选）',
+        'feedback.contactPlaceholder': '邮箱 / 微信 / GitHub 用户名，便于回复你',
+        'feedback.hint': '发送时会自动附带插件版本、DSH / Node 版本与运行平台，不包含你的指令内容。',
+        'feedback.send': '发送反馈',
+        'feedback.sending': '正在发送…',
+        'feedback.clear': '清空',
+        'feedback.sent': '反馈已发送，感谢你的反馈！',
+        'feedback.failed': '反馈发送失败，请稍后重试。',
+        'feedback.failedDetail': '反馈发送失败：{detail}',
+        'feedback.timeout': '等待宿主响应超时（{seconds} 秒）。邮件可能已经发出，请先确认再重试。',
+        'feedback.errType': '请选择有效的问题类型',
+        'feedback.errTitle': '请填写标题',
+        'feedback.errTitleLong': '标题不能超过 {max} 个字符',
+        'feedback.errBody': '请补充详细描述（至少 5 个字符）',
+        'feedback.errBodyLong': '详细描述不能超过 {max} 个字符',
+        'feedback.errContact': '联系方式不能超过 {max} 个字符',
         // ---- F7 临时静音 ----
         'mute.menu': '暂停注入…',
         'mute.30m': '30 分钟',
@@ -475,6 +543,7 @@ window.__ModuleLoader__.load({
         'editor.hint': 'Takes effect for the next conversation turn once saved',
         'editor.needTitleOrContent': 'Fill in at least a title or the instruction content',
         'editor.confirmDiscard': 'The draft has unsaved changes. Discard them?',
+        'confirm.unavailable': 'This shell cannot show a confirmation dialog, so the action was cancelled and nothing changed.',
         'body.expand': 'Show all',
         'body.collapse': 'Show less',
         'budget.label': 'Injection size limit (characters)',
@@ -494,6 +563,7 @@ window.__ModuleLoader__.load({
         'tags.label': 'Tags (optional; used only for grouping/filtering on this page, never injected)',
         'tags.placeholder': 'Type a tag and press Enter; separate several with commas, e.g. code-style',
         'tags.hint': 'Up to {max} tags per entry, each at most {len} characters',
+        'tags.remove': 'Remove tag {tag}',
         'tags.duplicate': 'This tag already exists',
         'tags.full': 'Up to {max} tags per entry',
         'filter.all': 'All',
@@ -521,7 +591,9 @@ window.__ModuleLoader__.load({
         'batch.tagPrompt': 'Enter tags to add to {count} entries (separate several with commas)',
         'batch.tagEmpty': 'No valid tag entered',
         'batch.noneSelected': 'Tick the entries to act on first',
-        'batch.promptUnavailable': 'Quick entry is unavailable in this environment; edit tags one by one',
+        'batch.tagInputPlaceholder': 'Tags to add (separate several with commas)',
+      'batch.tagConfirm': 'Add',
+      'batch.tagCancel': 'Cancel',
         'profiles.section': 'User persona',
         'profiles.subtitle': 'Facts about you: background, tastes, personality and goals. When “Use this persona” is ticked, the AI adjusts depth, examples and advice to tilt toward you — while staying correct and on-topic; it must never change facts or wander off the question to please you.',
         'profiles.new': '＋ New persona',
@@ -620,6 +692,35 @@ window.__ModuleLoader__.load({
         'diag.issueWarning': 'Storage warning',
         'diag.issueHistory': 'History error',
         'diag.issueSection': 'Injection error',
+        // ---- feedback mail ----
+        'feedback.section': 'Feedback',
+        'feedback.show': 'Feedback',
+        'feedback.hide': 'Hide feedback',
+        'feedback.intro': 'Found a problem or have a suggestion? Send it to the plugin maintainer by email with the form below.',
+        'feedback.typeLabel': 'Category',
+        'feedback.typeBug': 'Problem report (bug)',
+        'feedback.typeSuggestion': 'Feature request',
+        'feedback.typeOther': 'Other',
+        'feedback.titleLabel': 'Title',
+        'feedback.titlePlaceholder': 'Sum up the problem or suggestion in one line',
+        'feedback.bodyLabel': 'Details',
+        'feedback.bodyPlaceholder': 'Steps to reproduce, expected result, actual result; for a suggestion, describe the use case',
+        'feedback.contactLabel': 'Contact (optional)',
+        'feedback.contactPlaceholder': 'Email / WeChat / GitHub handle so the maintainer can reply',
+        'feedback.hint': 'The mail automatically includes the plugin version, DSH / Node versions and platform — never your instruction content.',
+        'feedback.send': 'Send feedback',
+        'feedback.sending': 'Sending…',
+        'feedback.clear': 'Clear',
+        'feedback.sent': 'Feedback sent — thank you!',
+        'feedback.failed': 'Could not send the feedback. Please try again later.',
+        'feedback.failedDetail': 'Could not send the feedback: {detail}',
+        'feedback.timeout': 'Timed out waiting for the host ({seconds} s). The mail may already have been sent — check before retrying.',
+        'feedback.errType': 'Choose a valid category',
+        'feedback.errTitle': 'Enter a title',
+        'feedback.errTitleLong': 'The title must be at most {max} characters',
+        'feedback.errBody': 'Add a description (at least 5 characters)',
+        'feedback.errBodyLong': 'The description must be at most {max} characters',
+        'feedback.errContact': 'The contact must be at most {max} characters',
         // ---- F7 temporary mute ----
         'mute.menu': 'Pause injection…',
         'mute.30m': '30 minutes',
@@ -815,32 +916,95 @@ window.__ModuleLoader__.load({
 
     /* ---------------- data helpers ---------------- */
 
-    // Mirror the Host's tag limits (lib/index.js); kept local so the editor
-    // constrains input before the round-trip and tests can pin both to match.
+    // Mirror the Host's tag limits (lib/index.js) as FALLBACKS ONLY. The Host
+    // publishes the authoritative values in snapshot.limits; these constants
+    // keep the editor usable against an older Host that predates them.
     const MAX_TAGS = 8
     const MAX_TAG_LEN = 24
+    const DEFAULT_MAX_TITLE = 120
+    const DEFAULT_MAX_CONTENT = 6000
+    const DEFAULT_MAX_WHEN = 200
+
+    /**
+     * Per-field ceilings for the entry editor.
+     *
+     * These used to be hard-coded at the call sites (120/6000/200, tags 8/24),
+     * which meant a Host-side limit change left the panel silently disagreeing
+     * with the loader: the editor accepted text the Host then truncated, with a
+     * notice the user could not have predicted. The Host now publishes every
+     * one of them; the historical defaults remain only for older Hosts.
+     */
+    function fieldLimitsOf(limits) {
+      const source = limits !== null && typeof limits === 'object' ? limits : {}
+      const pick = (key, fallback) => (
+        typeof source[key] === 'number' && Number.isFinite(source[key]) && source[key] > 0 ? source[key] : fallback
+      )
+      return {
+        maxTitle: pick('maxTitle', DEFAULT_MAX_TITLE),
+        maxContent: pick('maxContent', DEFAULT_MAX_CONTENT),
+        maxWhen: pick('maxWhen', DEFAULT_MAX_WHEN),
+        maxTags: pick('maxTagsPerEntry', MAX_TAGS),
+        maxTagLength: pick('maxTagLength', MAX_TAG_LEN),
+      }
+    }
 
     /**
      * Parse free text typed into the tag box into normalised tag candidates.
      * Tags are split on commas (ASCII/full-width), semicolons and newlines —
      * never spaces, so a tag may contain spaces. Each piece is trimmed,
-     * collapsed to one line, cut to MAX_TAG_LEN, de-duplicated and capped at
-     * MAX_TAGS. Pinned as a pure export.
+     * collapsed to one line, cut to the length cap, de-duplicated and capped at
+     * the count cap. Both caps come from the snapshot when supplied. Pinned as
+     * a pure export.
      */
-    function parseTagInput(text) {
+    function parseTagInput(text, limits) {
       if (typeof text !== 'string') return []
+      const caps = fieldLimitsOf(limits)
       const out = []
       const seen = new Set()
       for (const piece of text.split(/[,，;；\n\r]+/)) {
-        const tag = piece.replace(/\s+/g, ' ').trim().slice(0, MAX_TAG_LEN)
+        const tag = piece.replace(/\s+/g, ' ').trim().slice(0, caps.maxTagLength)
         if (tag === '' || seen.has(tag)) continue
         seen.add(tag)
-        if (out.length >= MAX_TAGS) break
+        if (out.length >= caps.maxTags) break
         out.push(tag)
       }
       return out
     }
 
+    /**
+     * Decide what a `window.prompt` call site should do, without assuming the
+     * API works. Pinned as a pure export so the Electron path is testable in
+     * Node.
+     *
+     * Three outcomes, and the difference between the last two is the whole
+     * point: Electron 44 installs
+     * `window.prompt = function () { throw new Error("prompt() is not
+     * supported.") }` (and propagates it through contextBridge), so `typeof`
+     * still reports 'function' and a type guard cannot tell it apart from a
+     * real prompt. Cancel returns `null` from a WORKING prompt and must stay a
+     * deliberate no; only a throw (or a missing API) may open the fallback form.
+     *
+     * @param {((message: string, initial: string) => string | null) | null} ask
+     * @param {string} message
+     * @returns {{ kind: 'unavailable' } | { kind: 'cancel' } | { kind: 'answer', text: string }}
+     */
+    function batchTagOutcome(ask, message) {
+      if (typeof ask !== 'function') return { kind: 'unavailable' }
+      let answer
+      try {
+        answer = ask(message, '')
+      } catch (err) {
+        return { kind: 'unavailable' }
+      }
+      // Only a real `null` means the user pressed Cancel. `undefined` and any
+      // non-string (a broken polyfill, a Promise) mean the runtime cannot
+      // deliver an answer, so the caller must show the fallback form instead of
+      // swallowing the click.
+      if (answer === null) return { kind: 'cancel' }
+      if (typeof answer !== 'string') return { kind: 'unavailable' }
+      return { kind: 'answer', text: answer }
+    }
+
     function cloneEntry(entry) {
       return {
         id: entry.id,
@@ -905,15 +1069,58 @@ window.__ModuleLoader__.load({
       return tagsKey(draft) !== tagsKey(base)
     }
 
+    const CONFIRM_YES = 'yes'
+    const CONFIRM_NO = 'no'
+    const CONFIRM_UNAVAILABLE = 'unavailable'
+
+    /**
+     * The single gate every confirmation goes through.
+     *
+     * Two different fallbacks used to be hard-coded at the call sites, which
+     * meant the same class of irreversible action behaved differently
+     * depending on the shell: bulk delete, set delete, persona delete and
+     * single-entry delete all PROCEEDED when `window.confirm` was missing
+     * (`typeof confirm === 'function' && !confirm(…)` short-circuits to false),
+     * while version rollback and whole-store restore REFUSED. On top of that,
+     * Electron 44 ships a `prompt()` that exists but throws — `typeof` still
+     * says 'function' — so a `typeof`-only guard proves nothing.
+     *
+     * Three outcomes, not two, because "the user said no" and "this shell has
+     * no dialog" need different UI: the first is silent, the second must tell
+     * the user why nothing happened instead of swallowing the click.
+     *
+     * `unavailable` makes the fallback explicit per call site, chosen by what
+     * is actually at stake:
+     *   - 'deny'  (default) — durable data (entries, sets, personas, history,
+     *             a whole-store restore). If no dialog exists, do NOT destroy
+     *             anything.
+     *   - 'allow' — unsaved drafts only (leaving the editor, reloading the
+     *             source view). Nothing on disk is lost, and refusing here
+     *             would trap the user with a dead button, which is why
+     *             verify.mjs pins this fallback.
+     */
+    function askConfirm(message, unavailable = 'deny') {
+      const fallback = unavailable === 'allow'
+      if (typeof window === 'undefined' || typeof window.confirm !== 'function') {
+        return fallback ? CONFIRM_YES : CONFIRM_UNAVAILABLE
+      }
+      try {
+        return window.confirm(message) === true ? CONFIRM_YES : CONFIRM_NO
+      } catch {
+        // A dialog stub that exists but throws (the Electron 44 `prompt()`
+        // pattern, seen in the desktop shell).
+        return fallback ? CONFIRM_YES : CONFIRM_UNAVAILABLE
+      }
+    }
+
     /**
      * Ask before throwing the draft away. Falls back to "yes" when no dialog
      * is available (a bare webview without window.confirm): blocking the
-     * cancel button entirely would be worse than the old instant discard.
+     * cancel button entirely would be worse than the old instant discard, and
+     * no saved data is lost either way.
      */
     function confirmDiscard() {
-      return typeof window !== 'undefined' && typeof window.confirm === 'function'
-        ? window.confirm(t('editor.confirmDiscard'))
-        : true
+      return askConfirm(t('editor.confirmDiscard'), 'allow') === CONFIRM_YES
     }
 
     /**
@@ -1244,11 +1451,14 @@ window.__ModuleLoader__.load({
       }
     }
 
-    async function callHost(method, args) {
+    async function callHost(method, args, options) {
       // A hung host used to pin the panel on 保存中… forever; fail visibly
-      // after a generous timeout instead.
+      // after a generous timeout instead. A caller that knows its request is
+      // slow (a feedback send) passes its own budget and its own wording.
+      const settings = options !== null && typeof options === 'object' ? options : {}
+      const timeoutMs = typeof settings.timeoutMs === 'number' && settings.timeoutMs > 0 ? settings.timeoutMs : 15000
       const controller = typeof AbortController === 'function' ? new AbortController() : null
-      const timer = controller !== null ? setTimeout(() => controller.abort(), 15000) : null
+      const timer = controller !== null ? setTimeout(() => controller.abort(), timeoutMs) : null
       try {
         const response = await fetch(API, {
           method: 'POST',
@@ -1273,40 +1483,78 @@ window.__ModuleLoader__.load({
         }
         return await response.json()
       } catch (err) {
-        if (controller !== null && controller.signal.aborted) throw new Error(t('err.timeout'))
+        if (controller !== null && controller.signal.aborted) {
+          throw new Error(typeof settings.timeoutMessage === 'string' && settings.timeoutMessage !== ''
+            ? settings.timeoutMessage
+            : t('err.timeout'))
+        }
         throw err
       } finally {
         if (timer !== null) clearTimeout(timer)
       }
     }
 
+    /**
+     * Client-side mirror of the Host's normalizeFeedback. Returns either
+     * `{ ok: true, value }` (trimmed) or `{ ok: false, message }` (already
+     * translated); the Host re-validates and stays authoritative (a forged
+     * request can bypass every check here).
+     */
+    function feedbackVerdict(type, title, body, contact, limits) {
+      const source = limits !== null && typeof limits === 'object' ? limits : FEEDBACK_DEFAULTS
+      const maxTitle = typeof source.maxFeedbackTitle === 'number' ? source.maxFeedbackTitle : FEEDBACK_DEFAULTS.maxTitle
+      const maxBody = typeof source.maxFeedbackBody === 'number' ? source.maxFeedbackBody : FEEDBACK_DEFAULTS.maxBody
+      const maxContact = typeof source.maxFeedbackContact === 'number' ? source.maxFeedbackContact : FEEDBACK_DEFAULTS.maxContact
+      const kind = typeof type === 'string' ? type : ''
+      if (!FEEDBACK_TYPES.includes(kind)) return { ok: false, message: t('feedback.errType') }
+      const cleanTitle = typeof title === 'string' ? title.trim() : ''
+      if (cleanTitle === '') return { ok: false, message: t('feedback.errTitle') }
+      if (cleanTitle.length > maxTitle) {
+        return { ok: false, message: t('feedback.errTitleLong', { max: maxTitle }) }
+      }
+      const cleanBody = typeof body === 'string' ? body.trim() : ''
+      if (cleanBody.length < 5) return { ok: false, message: t('feedback.errBody') }
+      if (cleanBody.length > maxBody) {
+        return { ok: false, message: t('feedback.errBodyLong', { max: maxBody }) }
+      }
+      const cleanContact = typeof contact === 'string' ? contact.trim() : ''
+      if (cleanContact.length > maxContact) {
+        return { ok: false, message: t('feedback.errContact', { max: maxContact }) }
+      }
+      return { ok: true, value: { type: kind, title: cleanTitle, body: cleanBody, contact: cleanContact } }
+    }
+
     function EntryEditor(props) {
       const draft = props.draft
+      const caps = fieldLimitsOf(props.limits)
       const set = (patch) => props.onChange(Object.assign(cloneEntry(draft), patch))
       const children = [
         h('h3', { className: 'im-h', key: 'title' }, draft.id === '' ? t('editor.new') : t('editor.edit')),
         h('div', { key: 't' },
-          h('label', { className: 'im-label' }, t('editor.title')),
+          h('label', { className: 'im-label', htmlFor: 'im-entry-title' }, t('editor.title')),
           h('input', {
+            id: 'im-entry-title',
             className: 'im-input',
             value: draft.title,
-            maxLength: 120,
+            maxLength: caps.maxTitle,
             placeholder: t('editor.titlePlaceholder'),
             onChange: (ev) => set({ title: ev.target.value }),
           })),
         h('div', { key: 'c' },
-          h('label', { className: 'im-label' }, t('editor.content')),
+          h('label', { className: 'im-label', htmlFor: 'im-entry-content' }, t('editor.content')),
           h('textarea', {
+            id: 'im-entry-content',
             className: 'im-textarea',
             value: draft.content,
-            maxLength: 6000,
+            maxLength: caps.maxContent,
             placeholder: t('editor.contentPlaceholder'),
             onChange: (ev) => set({ content: ev.target.value }),
           })),
         h('div', { className: 'im-grid2', key: 'g' },
           h('div', null,
-            h('label', { className: 'im-label' }, t('editor.mode')),
+            h('label', { className: 'im-label', htmlFor: 'im-entry-mode' }, t('editor.mode')),
             h('select', {
+              id: 'im-entry-mode',
               className: 'im-select',
               value: draft.mode,
               onChange: (ev) => set({ mode: ev.target.value }),
@@ -1314,8 +1562,9 @@ window.__ModuleLoader__.load({
               h('option', { value: 'always' }, t('editor.modeAlways')),
               h('option', { value: 'auto' }, t('editor.modeAuto')))),
           h('div', null,
-            h('label', { className: 'im-label' }, t('editor.priority')),
+            h('label', { className: 'im-label', htmlFor: 'im-entry-priority' }, t('editor.priority')),
             h('select', {
+              id: 'im-entry-priority',
               className: 'im-select',
               value: String(draft.priority),
               onChange: (ev) => set({ priority: Number(ev.target.value) }),
@@ -1326,19 +1575,22 @@ window.__ModuleLoader__.load({
       ]
       if (draft.mode === 'auto') {
         children.push(h('div', { key: 'w' },
-          h('label', { className: 'im-label' }, t('editor.when')),
+          h('label', { className: 'im-label', htmlFor: 'im-entry-when' }, t('editor.when')),
           h('input', {
+            id: 'im-entry-when',
             className: 'im-input',
             value: draft.when,
-            maxLength: 200,
+            maxLength: caps.maxWhen,
             placeholder: t('editor.whenPlaceholder'),
             onChange: (ev) => set({ when: ev.target.value }),
           })))
       }
       children.push(h('div', { key: 'tags' },
-        h('label', { className: 'im-label' }, t('tags.label')),
+        h('label', { className: 'im-label', htmlFor: 'im-entry-tags' }, t('tags.label')),
         h(TagInput, {
+          inputId: 'im-entry-tags',
           tags: draft.tags,
+          limits: props.limits,
           disabled: props.busy,
           onChange: (next) => set({ tags: next }),
         })))
@@ -1360,15 +1612,16 @@ window.__ModuleLoader__.load({
     function TagInput(props) {
       const [text, setText] = React.useState('')
       const tags = Array.isArray(props.tags) ? props.tags : []
+      const caps = fieldLimitsOf(props.limits)
       const merge = (pieces) => {
         const merged = []
         for (const tag of [...tags, ...pieces]) {
           if (!merged.includes(tag)) merged.push(tag)
         }
-        props.onChange(merged.slice(0, MAX_TAGS))
+        props.onChange(merged.slice(0, caps.maxTags))
       }
       const commit = () => {
-        const parsed = parseTagInput(text)
+        const parsed = parseTagInput(text, props.limits)
         if (parsed.length > 0) merge(parsed)
         setText('')
       }
@@ -1382,14 +1635,19 @@ window.__ModuleLoader__.load({
               tag,
               h('button', {
                 type: 'button', className: 'im-chip-x', disabled: props.disabled,
+                // A lone "×" is not an accessible name: a screen reader
+                // announces it as "times" with no idea which tag it removes.
+                'aria-label': t('tags.remove', { tag }),
+                title: t('tags.remove', { tag }),
                 onClick: () => remove(tag),
               }, '×'))))
           : null,
         h('input', {
+          id: props.inputId,
           className: 'im-input',
           value: text,
           disabled: props.disabled,
-          maxLength: MAX_TAG_LEN,
+          maxLength: caps.maxTagLength,
           placeholder: t('tags.placeholder'),
           onChange: (ev) => {
             const v = ev.target.value
@@ -1398,11 +1656,11 @@ window.__ModuleLoader__.load({
               // v is the input's full new value (it already contains what was
               // typed before the separator) — do NOT prepend `text`, that
               // duplicated it ("b" + "b," -> "bb").
-              const parsed = parseTagInput(v)
+              const parsed = parseTagInput(v, props.limits)
               if (parsed.length > 0) merge(parsed)
               setText('')
             } else {
-              setText(v.slice(0, MAX_TAG_LEN))
+              setText(v.slice(0, caps.maxTagLength))
             }
           },
           onKeyDown: (ev) => {
@@ -1415,7 +1673,7 @@ window.__ModuleLoader__.load({
           },
           onBlur: commit,
         }),
-        h('div', { className: 'im-meta' }, t('tags.hint', { max: MAX_TAGS, len: MAX_TAG_LEN })))
+        h('div', { className: 'im-meta' }, t('tags.hint', { max: caps.maxTags, len: caps.maxTagLength })))
     }
 
     /**
@@ -1433,7 +1691,12 @@ window.__ModuleLoader__.load({
       }, [props.text])
       return h('div', null,
         h('div', { className: 'im-body' + (open ? ' im-body-open' : ''), ref: bodyRef }, props.text),
-        overflowing ? h('div', { className: 'im-more', onClick: () => setOpen(!open) }, open ? t('body.collapse') : t('body.expand')) : null)
+        overflowing ? h('button', {
+          type: 'button',
+          className: 'im-more',
+          'aria-expanded': open,
+          onClick: () => setOpen(!open),
+        }, open ? t('body.collapse') : t('body.expand')) : null)
     }
 
     /** How long the undo bar keeps its offer alive after a confirmed delete. */
@@ -1454,8 +1717,9 @@ window.__ModuleLoader__.load({
       const canSave = (props.draft.name.trim() !== '' || props.draft.content.trim() !== '')
       return h('div', { className: 'im-editor im-profiles' },
         h('div', null,
-          h('label', { className: 'im-label' }, t('profiles.name')),
+          h('label', { className: 'im-label', htmlFor: 'im-profile-name' }, t('profiles.name')),
           h('input', {
+            id: 'im-profile-name',
             className: 'im-input',
             value: props.draft.name,
             maxLength: maxName,
@@ -1464,8 +1728,9 @@ window.__ModuleLoader__.load({
             onChange: (ev) => set({ name: ev.target.value }),
           })),
         h('div', null,
-          h('label', { className: 'im-label' }, t('profiles.content')),
+          h('label', { className: 'im-label', htmlFor: 'im-profile-content' }, t('profiles.content')),
           h('textarea', {
+            id: 'im-profile-content',
             className: 'im-textarea',
             rows: 6,
             value: props.draft.content,
@@ -1519,6 +1784,13 @@ window.__ModuleLoader__.load({
       // F3: bulk-select mode and the chosen entry ids in it.
       const [batchMode, setBatchMode] = React.useState(false)
       const [selected, setSelected] = React.useState([])
+      // The bulk "add tags" input. `window.prompt` is the fast path on a plain
+      // browser, but Electron REPLACES it with a function that throws
+      // ("prompt() is not supported.") — typeof still says 'function', so a
+      // type guard cannot catch it. `batchTagOpen` is the fallback form, shown
+      // whenever prompt is missing OR throws.
+      const [batchTagOpen, setBatchTagOpen] = React.useState(false)
+      const [batchTagText, setBatchTagText] = React.useState('')
       // F13: the set form (null = closed). One small inline form serves create,
       // rename and duplicate, because all three are "type a name and confirm".
       const [setForm, setSetForm] = React.useState(null)
@@ -1548,6 +1820,18 @@ window.__ModuleLoader__.load({
       // pretending the copy happened.
       const [diagOpen, setDiagOpen] = React.useState(false)
       const [diagFallback, setDiagFallback] = React.useState(null)
+      // Feedback form: closed by default so the settings card stays compact.
+      // The draft lives in the panel (not in a child) because the send handler
+      // needs the same values the inputs show, and keeping them here survives
+      // an SSE snapshot absorb while the user is typing.
+      const [feedbackOpen, setFeedbackOpen] = React.useState(false)
+      const [feedbackType, setFeedbackType] = React.useState('bug')
+      const [feedbackTitle, setFeedbackTitle] = React.useState('')
+      const [feedbackBody, setFeedbackBody] = React.useState('')
+      const [feedbackContact, setFeedbackContact] = React.useState('')
+      const [feedbackBusy, setFeedbackBusy] = React.useState(false)
+      const [feedbackError, setFeedbackError] = React.useState('')
+      const [feedbackSent, setFeedbackSent] = React.useState('')
       // F7: the pause menu (null-state boolean) and a 1s clock tick that exists
       // ONLY while a pause is live (its effect cleans up after itself). The
       // tick drives nothing but the remaining-time text; authority stays with
@@ -1705,6 +1989,12 @@ window.__ModuleLoader__.load({
       function exitBatch() {
         setBatchMode(false)
         setSelected([])
+        closeBatchTags()
+      }
+
+      function closeBatchTags() {
+        setBatchTagOpen(false)
+        setBatchTagText('')
       }
 
       async function doBatch(op, value) {
@@ -1713,10 +2003,12 @@ window.__ModuleLoader__.load({
           setError(t('batch.noneSelected'))
           return
         }
-        if (op === 'delete'
-          && typeof window.confirm === 'function'
-          && !window.confirm(t('batch.confirmDelete', { count: ids.length }))) {
-          return
+        if (op === 'delete') {
+          const ask = askConfirm(t('batch.confirmDelete', { count: ids.length }))
+          if (ask !== CONFIRM_YES) {
+            if (ask === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+            return
+          }
         }
         const result = await send('batch', { op, ids, value, baseRev: revOf() })
         if (result !== null && result.ok === true && op === 'delete') {
@@ -1726,19 +2018,41 @@ window.__ModuleLoader__.load({
         }
       }
 
+      /** Parse a raw tag string and fire the bulk op. Returns false when empty. */
+      function commitBatchTags(raw) {
+        const tags = parseTagInput(raw === undefined || raw === null ? '' : String(raw), view.limits)
+        if (tags.length === 0) {
+          setError(t('batch.tagEmpty'))
+          return false
+        }
+        setError('')
+        void doBatch('add-tags', tags)
+        return true
+      }
+
+      /**
+       * Bulk "add tags": `window.prompt` when the runtime really implements it,
+       * the inline form otherwise. See batchTagOutcome() for why `typeof` alone
+       * cannot make that call. The wrapper (rather than passing `window.prompt`
+       * by value) keeps `this === window`, which WebIDL operations require.
+       */
       function batchAddTags() {
-        if (typeof window.prompt !== 'function') {
-          setError(t('batch.promptUnavailable'))
+        const ids = liveSelected()
+        if (ids.length === 0) {
+          setError(t('batch.noneSelected'))
           return
         }
-        const answer = window.prompt(t('batch.tagPrompt', { count: liveSelected().length }), '')
-        if (answer === null) return
-        const tags = parseTagInput(answer)
-        if (tags.length === 0) {
-          setError(t('batch.tagEmpty'))
+        const ask = typeof window.prompt === 'function'
+          ? (message, initial) => window.prompt(message, initial)
+          : null
+        const outcome = batchTagOutcome(ask, t('batch.tagPrompt', { count: ids.length }))
+        if (outcome.kind === 'cancel') return
+        if (outcome.kind === 'answer') {
+          if (commitBatchTags(outcome.text)) closeBatchTags()
           return
         }
-        void doBatch('add-tags', tags)
+        setError('')
+        setBatchTagOpen(true)
       }
 
       // ---- User persona ("用户形象") handlers ----
@@ -1767,10 +2081,13 @@ window.__ModuleLoader__.load({
 
       function removeProfile(profile) {
         if (busy) return
-        if (typeof window.confirm === 'function'
-          && !window.confirm(t('profiles.confirmDelete', {
-            name: profile.name !== '' ? profile.name : t('profiles.untitled'),
-          }))) return
+        const ask = askConfirm(t('profiles.confirmDelete', {
+          name: profile.name !== '' ? profile.name : t('profiles.untitled'),
+        }))
+        if (ask !== CONFIRM_YES) {
+          if (ask === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+          return
+        }
         void send('delete-profile', { id: profile.id, baseRev: revOf() })
       }
 
@@ -1828,8 +2145,11 @@ window.__ModuleLoader__.load({
           setError(t('sets.deleteActive'))
           return
         }
-        if (typeof window.confirm === 'function'
-          && !window.confirm(t('sets.deleteConfirm', { name: set.name, entries: set.entries, profiles: set.profiles }))) return
+        const askDeleteSet = askConfirm(t('sets.deleteConfirm', { name: set.name, entries: set.entries, profiles: set.profiles }))
+        if (askDeleteSet !== CONFIRM_YES) {
+          if (askDeleteSet === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+          return
+        }
         void send('delete-set', { id: set.id, baseRev: revOf() })
       }
 
@@ -1861,9 +2181,13 @@ window.__ModuleLoader__.load({
       }
 
       function rollbackTo(item) {
-        if (busy || typeof window.confirm !== 'function') return
+        if (busy) return
         const when = new Date(item.epoch).toLocaleString()
-        if (!window.confirm(t('history.restoreConfirm', { time: when, rev: item.rev }))) return
+        const ask = askConfirm(t('history.restoreConfirm', { time: when, rev: item.rev }))
+        if (ask !== CONFIRM_YES) {
+          if (ask === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+          return
+        }
         void send('history-restore', { name: item.name, baseRev: revOf() }).then((result) => {
           if (result !== null && result.ok === true) void loadHistory()
         })
@@ -1871,12 +2195,97 @@ window.__ModuleLoader__.load({
 
       function removeSnapshot(item) {
         if (busy) return
-        if (typeof window.confirm === 'function' && !window.confirm(t('history.deleteConfirm'))) return
+        const askDeleteHistory = askConfirm(t('history.deleteConfirm'))
+        if (askDeleteHistory !== CONFIRM_YES) {
+          if (askDeleteHistory === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+          return
+        }
         void send('history-delete', { name: item.name }).then((result) => {
           if (result !== null && result.ok === true) void loadHistory()
         })
       }
 
+      // ---- 反馈邮件 ----
+
+      function toggleFeedback() {
+        const next = !feedbackOpen
+        setFeedbackOpen(next)
+        setFeedbackError('')
+        if (!next) setFeedbackSent('')
+      }
+
+      function clearFeedback() {
+        setFeedbackType('bug')
+        setFeedbackTitle('')
+        setFeedbackBody('')
+        setFeedbackContact('')
+        setFeedbackError('')
+        setFeedbackSent('')
+      }
+
+      /**
+       * Send one report. The host validates again, enforces its own ceiling and
+       * a cool-down, and decides the recipient from configuration — the panel
+       * only supplies text plus the presentation facts (locale / time zone /
+       * user agent). The error log deliberately carries the same reason the
+       * user sees: a send failure is a configuration or network problem, and
+       * the console is where a maintainer will look for it.
+       */
+      async function submitFeedback() {
+        if (feedbackBusy) return
+        const verdict = feedbackVerdict(feedbackType, feedbackTitle, feedbackBody, feedbackContact, view !== null ? view.limits : null)
+        if (!verdict.ok) {
+          setFeedbackSent('')
+          setFeedbackError(verdict.message)
+          return
+        }
+        setFeedbackBusy(true)
+        setFeedbackError('')
+        setFeedbackSent('')
+        const nav = typeof navigator !== 'undefined' && navigator !== null ? navigator : {}
+        let timezone = ''
+        try {
+          timezone = typeof Intl === 'object' && Intl !== null && typeof Intl.DateTimeFormat === 'function'
+            ? String(Intl.DateTimeFormat().resolvedOptions().timeZone || '')
+            : ''
+        } catch (err) {
+          timezone = ''
+        }
+        try {
+          const result = await callHost('send-feedback', {
+            type: verdict.value.type,
+            title: verdict.value.title,
+            body: verdict.value.body,
+            contact: verdict.value.contact,
+            locale: typeof nav.language === 'string' ? nav.language : '',
+            userAgent: typeof nav.userAgent === 'string' ? nav.userAgent : '',
+            timezone,
+          }, {
+            timeoutMs: FEEDBACK_SEND_TIMEOUT_MS,
+            timeoutMessage: t('feedback.timeout', { seconds: Math.round(FEEDBACK_SEND_TIMEOUT_MS / 1000) }),
+          })
+          if (result === null || typeof result !== 'object' || result.ok !== true) {
+            const message = result !== null && typeof result === 'object' && typeof result.message === 'string' && result.message !== ''
+              ? result.message
+              : t('feedback.failed')
+            setFeedbackError(message)
+            console.error('[instruction-memory] feedback failed:', message)
+            return
+          }
+          setFeedbackSent(t('feedback.sent'))
+          setFeedbackType('bug')
+          setFeedbackTitle('')
+          setFeedbackBody('')
+          setFeedbackContact('')
+        } catch (err) {
+          const detail = String(err && err.message ? err.message : err)
+          setFeedbackError(t('feedback.failedDetail', { detail }))
+          console.error('[instruction-memory] feedback request failed:', detail)
+        } finally {
+          setFeedbackBusy(false)
+        }
+      }
+
       // ---- F16 source mode ----
 
       async function openSource() {
@@ -1917,7 +2326,7 @@ window.__ModuleLoader__.load({
       }
 
       function reloadSource() {
-        if (typeof window.confirm === 'function' && !window.confirm(t('source.reloadConfirm'))) return
+        if (askConfirm(t('source.reloadConfirm'), 'allow') !== CONFIRM_YES) return
         void openSource()
       }
 
@@ -1950,7 +2359,11 @@ window.__ModuleLoader__.load({
 
       async function handleRestoreFile(file) {
         try {
-          if (typeof window.confirm === 'function' && !window.confirm(t('restore.confirm'))) return
+          const askRestore = askConfirm(t('restore.confirm'))
+          if (askRestore !== CONFIRM_YES) {
+            if (askRestore === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+            return
+          }
           const text = typeof file.text === 'function'
             ? await file.text()
             : await new Promise((resolve, reject) => {
@@ -2094,17 +2507,51 @@ window.__ModuleLoader__.load({
        */
       React.useEffect(() => {
         if (typeof EventSource !== 'function') return
-        const source = new EventSource(API)
+        // `?lite=1`: the Host then answers with `{ rev, lite: true }` instead
+        // of a whole snapshot (up to ~3.4 MB at the 200 × 6,000-character cap,
+        // pushed to every open panel on every save). A Host that predates the
+        // flag ignores the query string and keeps sending full frames — the
+        // branch below still accepts those, so the negotiation is additive and
+        // one-way: neither side has to know the other's version.
+        const source = new EventSource(API + '?lite=1')
+        let alive = true
+        let refreshing = false
+        let missed = false
+        const refresh = () => {
+          // One refetch at a time. A frame that arrives mid-flight means the
+          // store moved again, and is re-checked after this response lands —
+          // dropping it outright could leave the panel one revision behind.
+          if (refreshing) { missed = true; return }
+          refreshing = true
+          callHost('state', null).then((result) => {
+            refreshing = false
+            if (!alive) return
+            absorb(result)
+            if (missed) { missed = false; refresh() }
+          }, (err) => {
+            refreshing = false
+            if (!alive) return
+            if (missed) { missed = false; refresh() }
+            else if (err) setError(String(err && err.message ? err.message : err))
+          })
+        }
         source.onmessage = (ev) => {
           try {
             const pushed = JSON.parse(ev.data)
+            if (pushed !== null && typeof pushed === 'object' && pushed.lite === true) {
+              const current = viewRef.current
+              // A null view means the initial POST `state` is still in flight;
+              // its response already carries the current rev.
+              if (current !== null && current.data !== null && current.data.rev !== pushed.rev) refresh()
+              return
+            }
             if (sameSnapshot(pushed, viewRef.current)) return
             absorb(pushed)
           } catch {
             // A malformed frame is dropped; the next frame, or 重新载入, catches up.
           }
         }
-        return () => { source.close() }
+        return () => { alive = false; source.close() }
       }, [])
 
       if (view === null) {
@@ -2117,6 +2564,10 @@ window.__ModuleLoader__.load({
           h(EntryEditor, {
             draft,
             busy,
+            // `limits` is computed below for the main branch; the editor is an
+            // early return, so read the snapshot directly (fieldLimitsOf falls
+            // back per field for an older Host).
+            limits: view.limits || null,
             onChange: setDraft,
             onCancel: () => {
               if (draftIsDirty(draft, view.data.entries) && !confirmDiscard()) return
@@ -2131,7 +2582,11 @@ window.__ModuleLoader__.load({
                 if (result && result.ok === true) { setDraft(null); setError('') }
               })
             },
-          }))
+          }),
+          // The editor is an early return, so it must render its OWN error
+          // line: without this, a blank save (or a conflict / failed write)
+          // set the message and showed the user nothing at all.
+          error !== '' ? h('div', { className: 'im-err', role: 'alert' }, error) : null)
       }
 
       const data = view.data
@@ -2142,6 +2597,14 @@ window.__ModuleLoader__.load({
         minBudget: 800, maxBudget: 40000, maxEntries: 200, maxProfiles: 50,
         maxSets: 20, maxSetName: 30, maxHistory: 20, maxBackupDir: 512,
       }
+      // The feedback ceilings only exist on a Host that ships the feedback
+      // route; an older Host hands over limits without them, so the form falls
+      // back to the same defaults the validator uses.
+      const feedbackMax = {
+        title: typeof limits.maxFeedbackTitle === 'number' ? limits.maxFeedbackTitle : FEEDBACK_DEFAULTS.maxTitle,
+        body: typeof limits.maxFeedbackBody === 'number' ? limits.maxFeedbackBody : FEEDBACK_DEFAULTS.maxBody,
+        contact: typeof limits.maxFeedbackContact === 'number' ? limits.maxFeedbackContact : FEEDBACK_DEFAULTS.maxContact,
+      }
       // Mirrored for the debounced source check (see its effect above): reading
       // it here keeps the effect's dependency list down to the text itself.
       sourceCeilingRef.current = typeof limits.maxBodyChars === 'number' ? limits.maxBodyChars : 0
@@ -2318,9 +2781,91 @@ window.__ModuleLoader__.load({
         void send('set-options', { disabledUntil: 0, baseRev: revOf() })
       }
 
+      // Feedback is the first row of the settings card so it is immediately
+      // visible; source mode keeps its own header and never reaches it.
+      const feedbackCard = h('div', { key: 'feedback', className: 'im-feedback' },
+        h('div', { className: 'im-feedback-head' },
+          h('span', { className: 'im-section-title' }, t('feedback.section')),
+          h('span', { className: 'im-spacer' }),
+          h('button', {
+            className: feedbackOpen ? 'im-btn' : 'im-btn im-btn-primary',
+            disabled: busy,
+            onClick: toggleFeedback,
+          }, feedbackOpen ? t('feedback.hide') : t('feedback.show'))),
+        feedbackOpen
+          ? h('div', { className: 'im-feedback-form' },
+            h('div', { className: 'im-meta' }, t('feedback.intro')),
+            h('div', { className: 'im-grid2' },
+              h('div', null,
+                h('label', { className: 'im-label', htmlFor: 'im-feedback-type' }, t('feedback.typeLabel')),
+                h('select', {
+                  id: 'im-feedback-type',
+                  className: 'im-select',
+                  value: feedbackType,
+                  disabled: feedbackBusy,
+                  onChange: (ev) => setFeedbackType(String(ev.target.value)),
+                },
+                  h('option', { value: 'bug' }, t('feedback.typeBug')),
+                  h('option', { value: 'suggestion' }, t('feedback.typeSuggestion')),
+                  h('option', { value: 'other' }, t('feedback.typeOther')))),
+              h('div', null,
+                h('label', { className: 'im-label', htmlFor: 'im-feedback-contact' }, t('feedback.contactLabel')),
+                h('input', {
+                  id: 'im-feedback-contact',
+                  className: 'im-input',
+                  type: 'text',
+                  value: feedbackContact,
+                  maxLength: feedbackMax.contact,
+                  placeholder: t('feedback.contactPlaceholder'),
+                  disabled: feedbackBusy,
+                  onChange: (ev) => setFeedbackContact(String(ev.target.value)),
+                }))),
+            h('div', null,
+              h('label', { className: 'im-label', htmlFor: 'im-feedback-title' }, t('feedback.titleLabel')),
+              h('input', {
+                id: 'im-feedback-title',
+                className: 'im-input',
+                type: 'text',
+                value: feedbackTitle,
+                maxLength: feedbackMax.title,
+                placeholder: t('feedback.titlePlaceholder'),
+                disabled: feedbackBusy,
+                onChange: (ev) => setFeedbackTitle(String(ev.target.value)),
+              })),
+            h('div', null,
+              h('label', { className: 'im-label', htmlFor: 'im-feedback-body' }, t('feedback.bodyLabel')),
+              h('textarea', {
+                id: 'im-feedback-body',
+                className: 'im-textarea',
+                value: feedbackBody,
+                maxLength: feedbackMax.body,
+                placeholder: t('feedback.bodyPlaceholder'),
+                disabled: feedbackBusy,
+                onChange: (ev) => setFeedbackBody(String(ev.target.value)),
+              })),
+            h('div', { className: 'im-meta' }, t('feedback.hint')),
+            // Send failures are shown next to the form and never replace the
+            // panel-wide error line: a mail problem must not look like a
+            // storage problem.
+            feedbackError !== '' ? h('div', { className: 'im-err' }, feedbackError) : null,
+            feedbackSent !== '' ? h('div', { className: 'im-ok' }, feedbackSent) : null,
+            h('div', { className: 'im-feedback-actions' },
+              h('button', {
+                className: 'im-btn im-btn-primary',
+                disabled: feedbackBusy,
+                onClick: () => { void submitFeedback() },
+              }, feedbackBusy ? t('feedback.sending') : t('feedback.send')),
+              h('button', {
+                className: 'im-btn',
+                disabled: feedbackBusy,
+                onClick: clearFeedback,
+              }, t('feedback.clear'))))
+          : null)
+
       const header = h('div', { className: 'im-card', key: 'head' },
-        // F12: the non-loopback warning sits at the TOP of the panel — not
-        // inside the collapsible diagnostics card — so it cannot be missed.
+        feedbackCard,
+        // F12: the non-loopback warning stays high in the panel — directly
+        // under the feedback entry — so it cannot be missed.
         security.hostGuarded === false
           ? h('div', { className: 'im-hostwarn', key: 'hostwarn' },
             t('diag.hostWarn', { host: security.boundHost !== '' ? security.boundHost : '?' }))
@@ -2362,8 +2907,9 @@ window.__ModuleLoader__.load({
           h('span', { className: injection.error ? 'im-err' : 'im-meta' }, dotText)),
         h('div', { className: 'im-grid2' },
           h('div', null,
-            h('label', { className: 'im-label' }, t('budget.label')),
+            h('label', { className: 'im-label', htmlFor: 'im-budget' }, t('budget.label')),
             h('input', {
+              id: 'im-budget',
               className: 'im-input',
               type: 'number',
               min: limits.minBudget,
@@ -2455,8 +3001,9 @@ window.__ModuleLoader__.load({
                 }, t('sets.delete')))),
             setForm !== null
               ? h('div', { className: 'im-inline-form' },
-                h('span', { className: 'im-meta' }, t('sets.nameLabel')),
+                h('label', { className: 'im-meta', htmlFor: 'im-set-name' }, t('sets.nameLabel')),
                 h('input', {
+                  id: 'im-set-name',
                   className: 'im-input',
                   value: setForm.name,
                   maxLength: limits.maxSetName,
@@ -2572,6 +3119,39 @@ window.__ModuleLoader__.load({
             }, t('batch.delete')),
             h('button', { className: 'im-btn', disabled: busy, onClick: exitBatch }, t('batch.exit')))
           : null,
+        // Browser runtimes get window.prompt for the bulk tag text; Electron's
+        // prompt throws instead, so the same action falls back to this field.
+        (batchMode && batchTagOpen)
+          ? h('div', { key: 'batchtags', className: 'im-batch-tags' },
+            h('input', {
+              className: 'im-input',
+              type: 'text',
+              autoFocus: true,
+              value: batchTagText,
+              disabled: busy,
+              placeholder: t('batch.tagInputPlaceholder'),
+              onChange: (ev) => setBatchTagText(ev.target.value),
+              onKeyDown: (ev) => {
+                if (ev.key === 'Enter') {
+                  ev.preventDefault()
+                  if (commitBatchTags(batchTagText)) closeBatchTags()
+                } else if (ev.key === 'Escape') {
+                  ev.preventDefault()
+                  closeBatchTags()
+                }
+              },
+            }),
+            h('button', {
+              className: 'im-btn im-btn-primary',
+              disabled: busy,
+              onClick: () => { if (commitBatchTags(batchTagText)) closeBatchTags() },
+            }, t('batch.tagConfirm')),
+            h('button', {
+              className: 'im-btn',
+              disabled: busy,
+              onClick: () => { closeBatchTags() },
+            }, t('batch.tagCancel')))
+          : null,
         // ---- F17 本地预演：字面关键词匹配「按需」条目（不是模型真实判断） ----
         (data.enabled === true && autoEntries.length > 0)
           ? h('div', { key: 'sim', className: 'im-profiles' },
@@ -2710,7 +3290,7 @@ window.__ModuleLoader__.load({
           h('button', {
             className: 'im-btn',
             disabled: busy || entries.length === 0,
-            onClick: () => { setBatchMode(!batchMode); setSelected([]) },
+            onClick: () => { setBatchMode(!batchMode); setSelected([]); closeBatchTags() },
           }, batchMode ? t('batch.exit') : t('action.batch')),
           h('span', { className: 'im-spacer' }),
           h('span', { className: 'im-meta' }, t('stats.count', { total: entries.length, active: activeCount }))),
@@ -2726,9 +3306,10 @@ window.__ModuleLoader__.load({
         // ---- F18 备份位置 ----
         h('div', { key: 'backup', className: 'im-backup' },
           h('div', { className: 'im-section-title' }, t('backup.section')),
-          h('label', { className: 'im-label' }, t('backup.label')),
+          h('label', { className: 'im-label', htmlFor: 'im-backup-dir' }, t('backup.label')),
           h('div', { className: 'im-backup-row' },
             h('input', {
+              id: 'im-backup-dir',
               className: 'im-input',
               value: backupText,
               disabled: busy,
@@ -2833,9 +3414,9 @@ window.__ModuleLoader__.load({
                   }))
                 : null)
             : null),
-        error !== '' ? h('div', { className: 'im-err' }, error) : null,
-        error === '' && notice !== '' ? h('div', { className: 'im-ok' }, notice) : null,
-        error === '' && notice === '' && storage.error ? h('div', { className: 'im-err' }, storage.error) : null,
+        error !== '' ? h('div', { className: 'im-err', role: 'alert' }, error) : null,
+        error === '' && notice !== '' ? h('div', { className: 'im-ok', role: 'status', 'aria-live': 'polite' }, notice) : null,
+        error === '' && notice === '' && storage.error ? h('div', { className: 'im-err', role: 'alert' }, storage.error) : null,
         undo !== null ? h('div', { className: 'im-undo', key: 'undo' },
           h('span', null, t('undo.deleted', { title: undo.entry.title !== '' ? undo.entry.title : t('entry.untitled') })),
           h('button', { disabled: busy, onClick: () => {
@@ -2913,12 +3494,12 @@ window.__ModuleLoader__.load({
               sourceVerdict !== null
                 ? h('div', { className: sourceVerdict.ok ? 'im-source-ok' : 'im-warn' }, sourceVerdict.message)
                 : null,
-              error !== '' ? h('div', { className: 'im-err' }, error) : null,
+              error !== '' ? h('div', { className: 'im-err', role: 'alert' }, error) : null,
               // Saving can be refused (a conflict, a future version, a shape
               // problem). The draft is never thrown away by a refusal, and the
               // user needs to know that before deciding what to do next.
               error !== '' ? h('div', { className: 'im-meta' }, t('source.keepDraft')) : null,
-              error === '' && notice !== '' ? h('div', { className: 'im-ok' }, notice) : null,
+              error === '' && notice !== '' ? h('div', { className: 'im-ok', role: 'status', 'aria-live': 'polite' }, notice) : null,
               h('div', { className: 'im-row-wrap' },
                 h('button', {
                   className: 'im-btn im-btn-primary',
@@ -3008,12 +3589,17 @@ window.__ModuleLoader__.load({
                 className: 'im-btn im-btn-danger',
                 disabled: busy,
                 onClick: () => {
-                  // confirm() is standard DOM, guarded anyway: if the embedded
-                  // shell omits it, deletion proceeds rather than breaking.
-                  if (typeof window.confirm === 'function'
-                    && !window.confirm(t('entry.confirmDelete', {
-                      title: entry.title !== '' ? entry.title : t('entry.untitled'),
-                    }))) return
+                  // Durable-data delete: if this shell has no working dialog,
+                  // the delete is refused and the reason is shown — silently
+                  // dropping an instruction because a button was clickable
+                  // and the shell lacked confirm() is the worse failure.
+                  const askEntry = askConfirm(t('entry.confirmDelete', {
+                    title: entry.title !== '' ? entry.title : t('entry.untitled'),
+                  }))
+                  if (askEntry !== CONFIRM_YES) {
+                    if (askEntry === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
+                    return
+                  }
                   // Keep the full entry for the undo bar; the POST response
                   // (not this closure) is what confirms the deletion happened.
                   setUndo(null)
@@ -3133,13 +3719,16 @@ window.__ModuleLoader__.load({
     exports.__draftIsDirty = draftIsDirty
     exports.__sameSnapshot = sameSnapshot
     exports.__confirmDiscard = confirmDiscard
+    exports.__askConfirm = askConfirm
     exports.__importSizeVerdict = importSizeVerdict
     exports.__nextBudgetText = nextBudgetText
     exports.__budgetMeter = budgetMeter
     exports.__parseTagInput = parseTagInput
+    exports.__batchTagOutcome = batchTagOutcome
     exports.__relevanceTerms = relevanceTerms
     exports.__relevancePreview = relevancePreview
     exports.__sourceParseVerdict = sourceParseVerdict
+    exports.__feedbackVerdict = feedbackVerdict
     exports.__diagnosticsText = diagnosticsText
     exports.__strings = STRINGS
     exports.__ns = NS