dsh-remote-plugin 0.6.23 → 0.6.25

package/public/desktop/desktop.html

@@ -393,6 +393,27 @@
     </div>
   </div>
 
+  <!-- 新建会话工作区模态 -->
+  <div id="modal-new-session" class="ds-modal hidden" role="dialog" aria-modal="true">
+    <div class="ds-modal-card">
+      <div class="ds-modal-title" data-i18n="ds.newSessionTitle">新建会话</div>
+      <div class="ds-modal-body">
+        <p class="ds-new-session-desc" data-i18n="ds.newSessionDesc">选择一个 DSH 工作区，新会话将在该工作区中创建。</p>
+        <label class="ds-new-session-label" for="new-session-workspace" data-i18n="ds.newSessionWorkspace">工作区</label>
+        <select id="new-session-workspace" class="ds-new-session-select"></select>
+        <div id="new-session-workspace-details" class="ds-new-session-details">
+          <span id="new-session-workspace-name" class="ds-new-session-name"></span>
+          <code id="new-session-workspace-path" class="ds-new-session-path"></code>
+        </div>
+        <div id="new-session-empty" class="ds-empty hidden" data-i18n="ds.newSessionNoWorkspaces">暂无可用工作区，请先创建一个工作区。</div>
+      </div>
+      <div class="ds-modal-actions">
+        <button id="new-session-cancel" class="ds-btn" data-i18n="ds.cancel">取消</button>
+        <button id="new-session-create" class="ds-btn primary" data-i18n="ds.newSessionCreate">创建</button>
+      </div>
+    </div>
+  </div>
+
   <!-- 预设提示词管理模态 -->
   <div id="modal-presets" class="ds-modal hidden" role="dialog" aria-modal="true">
     <div class="ds-modal-card">
@@ -470,7 +491,7 @@
   <script>
     window.DESKTOP_STR = {
       zh: {
-        'ds.repo': 'GitHub 仓库', 'ds.newSession': '+ 新会话', 'ds.newWorkspace': '新建工作区', 'ds.sessions': '会话', 'ds.overview': '主页', 'ds.overviewEyebrow': 'SYSTEM OVERVIEW', 'ds.overviewSubtitle': '实时状态与需要你处理的事项',
+        'ds.repo': 'GitHub 仓库', 'ds.newSession': '+ 新会话', 'ds.sessionUntitled': '新会话', 'ds.newWorkspace': '新建工作区', 'ds.sessions': '会话', 'ds.overview': '主页', 'ds.overviewEyebrow': 'SYSTEM OVERVIEW', 'ds.overviewSubtitle': '实时状态与需要你处理的事项',
         'ds.systemPulse': '系统链路', 'ds.systemNominal': '系统链路正常', 'ds.systemDegraded': '部分链路需要关注', 'ds.systemOffline': '连接已断开', 'ds.checking': '检查中…', 'ds.components': '{n}/4 个模块在线', 'ds.live': 'LIVE', 'ds.allLinked': '全部链路', 'ds.offlineCore': 'OFFLINE',
         'ds.gateway': '网关', 'ds.dshUpstream': 'DSH 上游', 'ds.mux': '实时 mux', 'ds.host': '实时 host', 'ds.online': '在线', 'ds.offlineShort': '离线',
         'ds.attention': '需要你处理', 'ds.runtime': '运行指标', 'ds.recentActivity': '近期活动', 'ds.dshVersion': 'DSH 版本', 'ds.gatewayStatus': '网关状态', 'ds.activeSessions': '活跃会话', 'ds.connectionMode': '连接模式', 'ds.liveWs': '实时 WS', 'ds.poll': '降级轮询', 'ds.running': '运行中', 'ds.noReason': '无说明', 'ds.noActivity': '暂无后台活动', 'ds.noSessions': '暂无会话', 'ds.refreshOverview': '刷新总览', 'ds.pendingCount': '{n} 项待处理', 'ds.activeCount': '{n} 个活跃会话', 'ds.nothingPending': '暂无事项', 'ds.action.openSession': '打开最近会话', 'ds.action.newSession': '新建会话', 'ds.action.attention': '处理待办', 'ds.action.connect': '去设置连接', 'ds.action.refresh': '重新检查连接',
@@ -482,7 +503,7 @@
         'ds.cmdFeedback': '/feedback 反馈当前会话', 'ds.cmdGoal': '/goal 设置/查看任务目标',
         'ds.cmdPermission': '/permission 切换权限预设', 'ds.cmdPlan': '/plan 进入/退出计划模式',
         'ds.fsUp': '上级', 'ds.fsRoot': '允许根目录', 'ds.fsNewWorkspace': '新建工作区', 'ds.fsRefresh': '刷新', 'ds.fsEmpty': '目录为空',
-        'ds.workspaceCreateTitle': '新建工作区', 'ds.workspaceCreateDesc': '将在当前文件目录下创建文件夹，并自动打开新会话。', 'ds.workspaceParent': '父目录', 'ds.workspaceNamePlaceholder': '例如：my-project', 'ds.workspaceCreate': '创建并打开', 'ds.cancel': '取消', 'ds.workspaceNameRequired': '请输入工作区名称', 'ds.workspaceExists': '该目录已存在', 'ds.workspaceInvalidName': '名称不能包含路径分隔符', 'ds.workspaceCreateFailed': '创建工作区失败', 'ds.workspaceCreated': '工作区已创建', 'ds.workspaceCreatedNoSession': '工作区已创建，但新会话未能打开',
+        'ds.workspaceCreateTitle': '新建工作区', 'ds.workspaceCreateDesc': '将在当前文件目录下创建文件夹，并自动打开新会话。', 'ds.workspaceParent': '父目录', 'ds.workspaceNamePlaceholder': '例如：my-project', 'ds.workspaceCreate': '创建并打开', 'ds.cancel': '取消', 'ds.workspaceNameRequired': '请输入工作区名称', 'ds.workspaceExists': '该目录已存在', 'ds.workspaceInvalidName': '名称不能包含路径分隔符', 'ds.workspaceCreateFailed': '创建工作区失败', 'ds.workspaceCreated': '工作区已创建', 'ds.workspaceCreatedNoSession': '工作区已创建，但新会话未能打开', 'ds.newSessionTitle': '新建会话', 'ds.newSessionDesc': '选择一个 DSH 工作区，新会话将在该工作区中创建。', 'ds.newSessionWorkspace': '工作区', 'ds.newSessionNoWorkspaces': '暂无可用工作区，请先创建一个工作区。', 'ds.newSessionCreate': '创建', 'ds.newSessionChooseWorkspace': '请选择一个工作区',
         'ds.groupGeneral': '通用', 'ds.groupGeneralDesc': '工具调用、预设提示词',
         'ds.groupServers': '服务器', 'ds.groupServersDesc': '服务器地址与令牌',
         'ds.groupNotify': '通知', 'ds.groupNotifyDesc': '通知与提醒',
@@ -575,7 +596,7 @@
         'menu.modelTitle': '模型切换', 'menu.effortTitle': '思考深度',
       },
       en: {
-        'ds.repo': 'GitHub repo', 'ds.newSession': '+ New session', 'ds.newWorkspace': 'New workspace', 'ds.sessions': 'Sessions', 'ds.overview': 'Home', 'ds.overviewEyebrow': 'SYSTEM OVERVIEW', 'ds.overviewSubtitle': 'Live status and items needing your attention',
+        'ds.repo': 'GitHub repo', 'ds.newSession': '+ New session', 'ds.sessionUntitled': 'New session', 'ds.newWorkspace': 'New workspace', 'ds.sessions': 'Sessions', 'ds.overview': 'Home', 'ds.overviewEyebrow': 'SYSTEM OVERVIEW', 'ds.overviewSubtitle': 'Live status and items needing your attention',
         'ds.systemPulse': 'System pulse', 'ds.systemNominal': 'System nominal', 'ds.systemDegraded': 'Some links need attention', 'ds.systemOffline': 'Connection offline', 'ds.checking': 'Checking…', 'ds.components': '{n}/4 components online', 'ds.live': 'LIVE', 'ds.allLinked': 'ALL LINKED', 'ds.offlineCore': 'OFFLINE',
         'ds.gateway': 'Gateway', 'ds.dshUpstream': 'DSH upstream', 'ds.mux': 'Live mux', 'ds.host': 'Live host', 'ds.online': 'Online', 'ds.offlineShort': 'Offline',
         'ds.attention': 'Needs attention', 'ds.runtime': 'Runtime metrics', 'ds.recentActivity': 'Recent activity', 'ds.dshVersion': 'DSH version', 'ds.gatewayStatus': 'Gateway status', 'ds.activeSessions': 'Active sessions', 'ds.connectionMode': 'Connection mode', 'ds.liveWs': 'Live WS', 'ds.poll': 'Degraded polling', 'ds.running': 'Running', 'ds.noReason': 'No reason given', 'ds.noActivity': 'No background activity', 'ds.noSessions': 'No sessions yet', 'ds.refreshOverview': 'Refresh overview', 'ds.pendingCount': '{n} pending', 'ds.activeCount': '{n} active sessions', 'ds.nothingPending': 'Nothing pending', 'ds.action.openSession': 'Open recent session', 'ds.action.newSession': 'New session', 'ds.action.attention': 'Review pending', 'ds.action.connect': 'Set up connection', 'ds.action.refresh': 'Check connection',
@@ -587,7 +608,7 @@
         'ds.cmdFeedback': '/feedback Feedback current session', 'ds.cmdGoal': '/goal Set/view task goal',
         'ds.cmdPermission': '/permission Switch permission preset', 'ds.cmdPlan': '/plan Enter/exit plan mode',
         'ds.fsUp': 'Up', 'ds.fsRoot': 'Allowed root', 'ds.fsNewWorkspace': 'New workspace', 'ds.fsRefresh': 'Refresh', 'ds.fsEmpty': 'Empty directory',
-        'ds.workspaceCreateTitle': 'New workspace', 'ds.workspaceCreateDesc': 'Create a folder in the current file directory and open a new session there.', 'ds.workspaceParent': 'Parent folder', 'ds.workspaceNamePlaceholder': 'For example: my-project', 'ds.workspaceCreate': 'Create & open', 'ds.cancel': 'Cancel', 'ds.workspaceNameRequired': 'Enter a workspace name', 'ds.workspaceExists': 'That folder already exists', 'ds.workspaceInvalidName': 'The name cannot contain path separators', 'ds.workspaceCreateFailed': 'Could not create workspace', 'ds.workspaceCreated': 'Workspace created', 'ds.workspaceCreatedNoSession': 'Workspace created, but the new session could not be opened',
+        'ds.workspaceCreateTitle': 'New workspace', 'ds.workspaceCreateDesc': 'Create a folder in the current file directory and open a new session there.', 'ds.workspaceParent': 'Parent folder', 'ds.workspaceNamePlaceholder': 'For example: my-project', 'ds.workspaceCreate': 'Create & open', 'ds.cancel': 'Cancel', 'ds.workspaceNameRequired': 'Enter a workspace name', 'ds.workspaceExists': 'That folder already exists', 'ds.workspaceInvalidName': 'The name cannot contain path separators', 'ds.workspaceCreateFailed': 'Could not create workspace', 'ds.workspaceCreated': 'Workspace created', 'ds.workspaceCreatedNoSession': 'Workspace created, but the new session could not be opened', 'ds.newSessionTitle': 'New session', 'ds.newSessionDesc': 'Choose a DSH workspace for the new session.', 'ds.newSessionWorkspace': 'Workspace', 'ds.newSessionNoWorkspaces': 'No workspaces are available. Create a workspace first.', 'ds.newSessionCreate': 'Create', 'ds.newSessionChooseWorkspace': 'Choose a workspace',
         'ds.groupGeneral': 'General', 'ds.groupGeneralDesc': 'Tool calls, prompt presets',
         'ds.groupServers': 'Servers', 'ds.groupServersDesc': 'Server address and token',
         'ds.groupNotify': 'Notifications', 'ds.groupNotifyDesc': 'Notifications & reminders',
@@ -682,6 +703,8 @@
     }
   </script>
   <script src="i18n.js"></script>
+  <link rel="stylesheet" href="../genui.css">
+  <script src="../genui.js"></script>
   <script src="../md.js"></script>
   <script src="../vendor/gsap/gsap.min.js"></script>
   <script src="../motion.js"></script>

package/public/desktop/desktop.js

@@ -78,6 +78,7 @@ const state = {
   approvals: [],
   questions: [],
   queues: {},
+  sessionActivity: new Set(),
   queueSteering: {},
   compactions: {},
   pendingCommands: {},
@@ -95,6 +96,7 @@ const state = {
   pollSeq: { mux: 0, host: 0 },
   fs: { path: null, initial: null, loaded: false, roots: [], rootIndex: 0 },
   models: { loaded: false, loading: false, groups: [], current: null, failures: [] },
+  workspaces: [],
   wb: { bound: false, path: '', title: '', expanded: false, projects: null, open: null, apiMissing: false },
   archivedIds: [],
   view: 'sessions',
@@ -1353,6 +1355,10 @@ document.addEventListener('visibilitychange', () => {
 function onMuxFrame(full) {
   const f = full.payload
   if (!f) return
+  if (f.type === 'session/reasoning') {
+    if (f.sessionId === state.current) { applyReasoningBaseline(f.partialReasoning); scheduleReasoningRender() }
+    return
+  }
   if (f.type === 'session/event') return onSessionEvent(f.sessionId, f.event)
   if (f.type === 'approval/requested') {
     state.approvals = state.approvals.filter(a => a.approvalId !== f.approvalId)
@@ -1530,7 +1536,17 @@ function resyncAfterStreamOpen() {
   void refreshSessions().then(() => resyncCurrentSession())
 }
 function proj(s, key, d) { return s?.projections?.values?.[key] ?? d }
-function titleOf(s) { return proj(s, 'title') || (s?.sessionId ? short(s.sessionId) : t('ds.sessions')) }
+function sessionTitleValue(s) {
+  const value = proj(s, 'title', '')
+  return value == null ? '' : String(value).trim()
+}
+function hasSessionTitle(s) { return !!sessionTitleValue(s) }
+function titleOf(s) { return sessionTitleValue(s) || (s?.sessionId ? t('ds.sessionUntitled') : t('ds.sessions')) }
+function sessionLabelOf(s) {
+  const title = titleOf(s)
+  if (!s?.sessionId || hasSessionTitle(s)) return title
+  return `${title} · ${String(s.sessionId).slice(-8)}`
+}
 function isTopLevelSession(session) {
   return !!session && !session.parentSessionId && session.origin !== 'subagent'
 }
@@ -1660,7 +1676,7 @@ function renderSessions() {
   const renderSession = s => {
       const workspace = sessionWorkspaceLabel(s)
       const workspaceName = workspaceDisplayName(workspace)
-      const title = titleOf(s)
+      const title = sessionLabelOf(s)
       return `<button class="ds-session-item ${state.current === s.sessionId ? 'current' : ''}" data-id="${esc(s.sessionId)}">
         <span class="ds-session-title">${esc(title)}</span>
         <span class="ds-session-workspace" title="${esc(workspace)}">⌂ ${esc(workspaceName)}</span>
@@ -1717,7 +1733,31 @@ function renderSessions() {
   renderWorkbench()
 }
 
+const emptySessionCleanup = new Set()
+async function archiveEmptySessionOnLeave(sessionId) {
+  const base = state.server
+  const protectedSession = () => state.server !== base || state.current !== sessionId
+    || !state.byId.has(sessionId) || state.byId.get(sessionId)?.running
+    || state.sessionActivity?.has(sessionId) || state.pendingPrompts?.has(sessionId)
+    || (state.queues[sessionId] || []).length > 0
+    || (state.composerImages || []).length > 0 || !!$('composer')?.value?.trim()
+  if (!sessionId || emptySessionCleanup.has(sessionId) || protectedSession()) return false
+  emptySessionCleanup.add(sessionId)
+  try {
+    const history = await rpc('session.history', { sessionId, maxMessages: 1 })
+    if (protectedSession() || !Array.isArray(history?.events) || history.events.some(item => !['permission/preset', 'sandbox/mode', 'approval/policy'].includes(item?.event?.type || item?.type))
+        || history.hasMore || (history.partialReasoning || []).length) return false
+    const result = await rpc('workspace.archiveSession', { sessionId })
+    if (!Array.isArray(result?.archivedSessionIds) || !result.archivedSessionIds.includes(sessionId)) return false
+    if (state.server !== base) return false
+    await refreshSessions()
+    return true
+  } catch { return false } // 离线、历史未知或归档失败时保留会话。
+  finally { emptySessionCleanup.delete(sessionId) }
+}
+
 async function openSession(id) {
+  if (state.current && state.current !== id) await archiveEmptySessionOnLeave(state.current)
   state.current = id
   setSessionRecovery('loading')
   state.history = emptyDesktopHistory()
@@ -1734,7 +1774,10 @@ async function openSession(id) {
   void refreshCompactionStatus(id)
   await loadHistory()
 }
-function closeSession() {
+async function closeSession() {
+  const sessionId = state.current
+  if (sessionId) await archiveEmptySessionOnLeave(sessionId)
+  if (state.current !== sessionId) return
   state.current = null
   setSessionRecovery('idle')
   state.history = emptyDesktopHistory()
@@ -1749,17 +1792,22 @@ function closeSession() {
 async function loadHistory() {
   const id = state.current
   if (!id || state.history.loading) return
+  const history = state.history
+  const reasoningVersion = history.reasoningVersion || 0
   state.history.loading = true
   setSessionRecovery('loading')
   let v
   try { v = await rpc('session.history', { sessionId: id, maxMessages: 60 }) }
   catch (e) {
+    if (state.current !== id || state.history !== history) return
     state.history.loading = false
     if (e.message === 'AUTH') return
     setSessionRecovery('error', e.message)
     $('history').innerHTML = `<div class="ds-empty">${e.message}</div>`
     return
   }
+  if (state.current !== id || state.history !== history) return
+  const liveReasoning = (history.reasoningVersion || 0) !== reasoningVersion ? new Map(history.partialReasoning) : null
   hydrateSessionProjections(id, v.projections)
   for (const entry of v.events || []) {
     const ev = entry?.event
@@ -1772,6 +1820,8 @@ async function loadHistory() {
     state.history.visible.push({ seq, event: ev })
   }
   state.history.visible.sort((a, b) => a.seq - b.seq)
+  if (liveReasoning) history.partialReasoning = liveReasoning
+  else applyReasoningBaseline(v.partialReasoning)
   state.history.hasMore = !!v.hasMore
   state.history.loading = false
   setSessionRecovery('ready')
@@ -1806,6 +1856,12 @@ function shouldShowEvent(type, event) {
   return true
 }
 function reasoningStreamKey(data, index) { return `${data?.turn ?? '?'}:${data?.step ?? '?'}:${index ?? '?'}` }
+function applyReasoningBaseline(items) {
+  if (!Array.isArray(items)) return
+  state.history.reasoningVersion = (state.history.reasoningVersion || 0) + 1
+  state.history.partialReasoning.clear()
+  for (const item of items) state.history.partialReasoning.set(reasoningStreamKey(item, item.index), item)
+}
 function applyReasoningStreamEvent(event) {
   const h = state.history
   const data = event?.data || {}
@@ -1831,7 +1887,7 @@ function applyReasoningStreamEvent(event) {
     item.text += Array.isArray(data.texts) ? data.texts.join('') : String(data.text || '')
     h.partialReasoning.set(key, item)
     changed = true
-  } else if (event?.type === 'assistant/message') {
+  } else if (event?.type === 'assistant/message' || event?.type === 'assistant/attempt') {
     for (const [key, item] of h.partialReasoning) {
       if (item.turn === data.turn && item.step === data.step) { h.partialReasoning.delete(key); changed = true }
     }
@@ -1857,6 +1913,7 @@ function safeJson(v) { try { return JSON.stringify(v, null, 2) } catch { return
 function blockHtml(b) {
   if (!b) return ''
   if (b.type === 'text') return `<div class="md">${window.mdToHtml ? window.mdToHtml(b.text ?? '') : esc(b.text ?? '')}</div>`
+  if (b.type === 'file') return `<div class="ds-tool">📎 ${esc(b.attachment?.name || b.name || 'file')} <small>${esc(b.attachment?.bytes ?? b.bytes ?? '')} bytes</small></div>`
   if (b.type === 'thinking' || b.type === 'reasoning') return `<details><summary>${esc(t('block.thinking'))}</summary><div style="opacity:.82">${esc(b.text ?? b.content ?? '')}</div></details>`
   if (b.type === 'tool-call') return `<div>🔧 ${esc(b.name || '')}</div>`
   if (b.type === 'tool-result') return `<div>📦</div>`
@@ -2122,6 +2179,7 @@ async function sendMessage() {
   const input = $('composer')
   const text = input.value.trim()
   if (!text || !state.current) return
+  state.sessionActivity.add(state.current)
   if (await runSlashCommand(text)) { input.value = ''; return }
   input.value = ''
   setSessionRecovery('resuming')
@@ -2146,7 +2204,7 @@ function renameSession(sessionId = state.current) {
   const session = state.byId.get(sessionId)
   if (!session) return
   renamePendingSessionId = sessionId
-  $('rename-session-input').value = titleOf(session)
+  $('rename-session-input').value = sessionTitleValue(session)
   $('modal-rename').classList.remove('hidden')
   setTimeout(() => { $('rename-session-input').focus(); $('rename-session-input').select() }, 40)
 }
@@ -2480,9 +2538,19 @@ async function createWorkspace() {
     }
     closeWorkspaceModal()
     await loadFs(parent || null, true)
-    const v = await safeRpc('session.create', { cwd: data.path }, t('ds.toastOpFailed'))
+    let workspace = null
+    try {
+      const created = await rpc('workspace.create', { path: data.path })
+      workspace = created?.workspace || null
+    } catch {}
+    if (workspace?.workspaceId) {
+      state.workspaces = [...state.workspaces.filter(item => item.workspaceId !== workspace.workspaceId), workspace]
+    }
+    const sessionPayload = workspace?.workspaceId ? { workspaceId: workspace.workspaceId } : { cwd: data.path }
+    const v = await safeRpc('session.create', sessionPayload, t('ds.toastOpFailed'))
     await refreshSessions()
     if (v?.sessionId) {
+      if (workspace?.workspaceId) LS.set('lastNewSessionWorkspaceV1', workspace.workspaceId)
       toast(t('ds.workspaceCreated'), 'ok')
       openSession(v.sessionId)
     } else {
@@ -2566,6 +2634,22 @@ function wbBaseName(p) {
   const value = String(p || '').replace(/[\\/]+$/, '')
   return value.split(/[\\/]/).pop() || value
 }
+function workspaceItems() {
+  return (state.workspaces || []).filter(w => w && typeof w.workspaceId === 'string' && w.workspaceId && typeof w.path === 'string' && w.path)
+}
+function workspaceById(workspaceId) {
+  return workspaceItems().find(w => w.workspaceId === workspaceId) || null
+}
+function workspaceName(workspace) {
+  return String(workspace?.title || wbBaseName(workspace?.path) || workspace?.path || '').trim()
+}
+function workspaceOptionLabel(workspace) {
+  const name = workspaceName(workspace)
+  return workspace.path && workspace.path !== name ? `${name} — ${workspace.path}` : name
+}
+function workspaceOptionsHtml(selected = '') {
+  return workspaceItems().map(workspace => `<option value="${esc(workspace.workspaceId)}"${workspace.workspaceId === selected ? ' selected' : ''}>${esc(workspaceOptionLabel(workspace))}</option>`).join('')
+}
 function wbStrictInside(pathValue, rootValue) {
   const pathKey = wbPathKey(pathValue)
   const rootKey = wbPathKey(rootValue)
@@ -2668,6 +2752,7 @@ async function refreshWorkbench({ silent = false } = {}) {
   }
   const wl = await safeRpc('workspace.list', {}, '')
   state.archivedIds = wl && Array.isArray(wl.archivedSessionIds) ? wl.archivedSessionIds : []
+  state.workspaces = wl && Array.isArray(wl.items) ? wl.items.slice() : []
   if (!wb) { renderWorkbench(); renderSessions(); return }
   if (!wb.bound) {
     state.wb = { bound: false, path: '', title: '', expanded: false, projects: null, open: null, apiMissing: false }
@@ -2696,7 +2781,11 @@ async function refreshWorkbench({ silent = false } = {}) {
           if (have.has(wbPathKey(projectPath))) continue
           try {
             const created = await rpc('workspace.create', { path: projectPath })
-            if (created?.workspace) { items.push(created.workspace); have.add(wbPathKey(projectPath)) }
+            if (created?.workspace) {
+              items.push(created.workspace)
+              state.workspaces.push(created.workspace)
+              have.add(wbPathKey(projectPath))
+            }
           } catch {}
         }
       }
@@ -2744,7 +2833,7 @@ function renderWorkbench() {
       </button>
       <div class="ds-wb-project-body ${open ? '' : 'hidden'}">
         <button type="button" class="ds-mini-btn ds-wb-new-session" data-wb-new="${esc(id)}">+ ${esc(t('wb.newSession'))}</button>
-        ${sessions.length ? sessions.map(s => `<button type="button" class="ds-wb-session ${state.current === s.sessionId ? 'current' : ''}" data-wb-session="${esc(s.sessionId)}" data-motion-key="${esc(s.sessionId)}"><span class="ds-wb-session-drag-handle" data-reorder-handle aria-hidden="true">⠿</span><span class="ds-wb-session-dot ${s.running ? 'running' : ''}"></span><span class="ds-wb-session-title">${esc(titleOf(s))}</span></button>`).join('') : `<div class="ds-wb-session-empty">${esc(t('wb.noSessions'))}</div>`}
+        ${sessions.length ? sessions.map(s => `<button type="button" class="ds-wb-session ${state.current === s.sessionId ? 'current' : ''}" data-wb-session="${esc(s.sessionId)}" data-motion-key="${esc(s.sessionId)}"><span class="ds-wb-session-drag-handle" data-reorder-handle aria-hidden="true">⠿</span><span class="ds-wb-session-dot ${s.running ? 'running' : ''}"></span><span class="ds-wb-session-title">${esc(sessionLabelOf(s))}</span></button>`).join('') : `<div class="ds-wb-session-empty">${esc(t('wb.noSessions'))}</div>`}
       </div>
     </div>`
   }).join('') : `<div class="ds-wb-empty">${esc(t('wb.noProjects'))}</div>`
@@ -2774,6 +2863,46 @@ function renderWorkbench() {
   panel.querySelectorAll('[data-wb-session]').forEach(button => button.addEventListener('click', () => openSession(button.dataset.wbSession)))
   panel.querySelectorAll('[data-wb-unbind-panel]').forEach(button => button.addEventListener('click', unbindWorkbench))
 }
+function renderNewSessionWorkspace(preferredId = '') {
+  const items = workspaceItems()
+  const select = $('new-session-workspace')
+  if (!select) return
+  const current = workspaceById(preferredId || select.value)?.workspaceId || items[0]?.workspaceId || ''
+  select.innerHTML = workspaceOptionsHtml(current)
+  select.disabled = !items.length
+  const workspace = workspaceById(select.value)
+  $('new-session-workspace-name').textContent = workspace ? workspaceName(workspace) : ''
+  $('new-session-workspace-path').textContent = workspace?.path || ''
+  $('new-session-empty').classList.toggle('hidden', !!items.length)
+  $('new-session-create').disabled = !workspace
+}
+async function openNewSessionModal() {
+  if (!state.token) return showView('view-settings')
+  if (!workspaceItems().length) await refreshWorkbench({ silent: true })
+  renderNewSessionWorkspace(LS.get('lastNewSessionWorkspaceV1', ''))
+  $('modal-new-session').classList.remove('hidden')
+  setTimeout(() => $('new-session-workspace')?.focus(), 50)
+}
+function closeNewSessionModal() { $('modal-new-session').classList.add('hidden') }
+async function createSessionInWorkspace() {
+  if (createSessionInWorkspace.busy) return
+  const workspaceId = $('new-session-workspace').value
+  if (!workspaceById(workspaceId)) return toast(t('ds.newSessionChooseWorkspace'), 'err')
+  createSessionInWorkspace.busy = true
+  const button = $('new-session-create')
+  button.disabled = true
+  try {
+    const value = await safeRpc('session.create', { workspaceId }, '')
+    if (!value?.sessionId) return
+    LS.set('lastNewSessionWorkspaceV1', workspaceId)
+    closeNewSessionModal()
+    await refreshSessions()
+    openSession(value.sessionId)
+  } finally {
+    createSessionInWorkspace.busy = false
+    button.disabled = false
+  }
+}
 const wbFs = { path: null, initial: null }
 function openWorkbenchModal() {
   $('modal-workbench').classList.remove('hidden')
@@ -2975,7 +3104,7 @@ function renderOverviewDesktop() {
   ]
   $('ds-overview-attention-count').textContent = pending.length ? t('ds.pendingCount', { n: pending.length }) : '—'
   $('ds-overview-attention-list').innerHTML = pending.length ? pending.slice(0, 4).map(({ kind, item }) => {
-    const title = titleOf(state.byId.get(item.sessionId))
+    const title = sessionLabelOf(state.byId.get(item.sessionId))
     if (kind === 'approval') return `<div class="ds-overview-attention-item" data-ds-overview-approval="${esc(item.approvalId)}">
       <span class="ds-overview-mark">⌁</span><span class="ds-overview-copy"><span class="ds-overview-item-title">${esc(item.toolName || t('ds.toolDefault'))}</span><span class="ds-overview-item-desc">${esc(desktopApprovalDetail(item))} · ${esc(title)}</span></span>
       <span class="ds-overview-actions"><button class="ds-btn allow" data-ds-overview-approve="1">${t('ds.allow')}</button><button class="ds-btn reject" data-ds-overview-approve="0">${t('ds.reject')}</button></span>
@@ -3019,7 +3148,7 @@ function renderOverviewDesktop() {
   $('ds-overview-connection-mode').textContent = state.token ? t(state.streamMode === 'poll' ? 'ds.poll' : 'ds.liveWs') : '—'
   $('ds-overview-active-count').textContent = running ? t('ds.activeCount', { n: running }) : ''
   $('ds-overview-session-list').innerHTML = sessions.length ? sessions.map(s => `<button type="button" class="ds-overview-session-item ${s.running ? 'running' : ''}" data-ds-overview-session="${esc(s.sessionId)}">
-    <span class="ds-overview-mark">${s.running ? '●' : '○'}</span><span class="ds-overview-copy"><span class="ds-overview-item-title">${esc(titleOf(s))}</span><span class="ds-overview-item-desc">${s.running ? esc(t('ds.running')) + ' · ' : ''}${esc(fmtTime(sessionSortTime(s)))}</span></span><span class="ds-overview-arrow">›</span>
+    <span class="ds-overview-mark">${s.running ? '●' : '○'}</span><span class="ds-overview-copy"><span class="ds-overview-item-title">${esc(sessionLabelOf(s))}</span><span class="ds-overview-item-desc">${s.running ? esc(t('ds.running')) + ' · ' : ''}${esc(fmtTime(sessionSortTime(s)))}</span></span><span class="ds-overview-arrow">›</span>
   </button>`).join('') : `<div class="ds-overview-empty">${t('ds.noSessions')}</div>`
   $('ds-overview-session-list').querySelectorAll('[data-ds-overview-session]').forEach(btn => btn.addEventListener('click', () => openSession(btn.dataset.dsOverviewSession)))
 }
@@ -3039,6 +3168,7 @@ function setMobileSidebar(open) {
 }
 
 function showView(id) {
+  if (state.view === 'view-chat' && id !== 'view-chat' && state.current) void archiveEmptySessionOnLeave(state.current)
   state.view = id
   for (const v of ['view-overview', 'view-sessions', 'view-chat', 'view-files', 'view-settings']) $(v).classList.toggle('hidden', v !== id)
   document.querySelectorAll('.ds-nav-item').forEach(b => b.classList.toggle('active', b.dataset.view === id))
@@ -3128,17 +3258,7 @@ function updateConn() {
 
 /* ---------------- 初始化 ---------------- */
 function bindUi() {
-  $('btn-new-session').addEventListener('click', async () => {
-    let payload = {}
-    // 与移动端保持一致：新会话继承 DSH 当前工作目录；查询失败时兼容回退。
-    try {
-      const host = await rpc('host.describe', {}, 5000)
-      const cwd = typeof host?.cwd === 'string' ? host.cwd.trim() : ''
-      if (cwd) payload = { cwd }
-    } catch {}
-    const v = await safeRpc('session.create', payload, '')
-    if (v?.sessionId) { await refreshSessions(); openSession(v.sessionId) }
-  })
+  $('btn-new-session').addEventListener('click', openNewSessionModal)
   $('btn-new-workspace').addEventListener('click', openWorkspaceModal)
   $('session-sort')?.addEventListener('change', (e) => {
     state.sessionSort = e.target.value === 'workspace' ? 'workspace' : 'time'
@@ -3261,6 +3381,10 @@ function bindUi() {
   $('workspace-create').addEventListener('click', createWorkspace)
   $('workspace-name').addEventListener('keydown', (e) => { if (e.key === 'Enter') createWorkspace() })
   $('modal-workspace').addEventListener('click', (e) => { if (e.target === $('modal-workspace')) closeWorkspaceModal() })
+  $('new-session-workspace').addEventListener('change', () => renderNewSessionWorkspace())
+  $('new-session-cancel').addEventListener('click', closeNewSessionModal)
+  $('new-session-create').addEventListener('click', createSessionInWorkspace)
+  $('modal-new-session').addEventListener('click', (e) => { if (e.target === $('modal-new-session')) closeNewSessionModal() })
   $('modal-notes').addEventListener('click', (e) => { if (e.target === $('modal-notes')) closeNotesModal() })
   // 反馈
   $('btn-feedback').addEventListener('click', (e) => { e.stopPropagation(); toggleFeedbackMenu() })

package/public/genui.css

@@ -0,0 +1,2 @@
+.genui{margin:14px 0;padding:14px;border:1px solid #8884;border-radius:12px;line-height:1.65;overflow:hidden;color:inherit;background:#88808;font-size:14px}
+.genui *{box-sizing:border-box}.genui h1,.genui h2,.genui h3,.genui h4,.genui p{margin:0 0 10px}.genui-caption{font-size:11px;opacity:.65;margin-bottom:12px}.genui-row{display:flex;flex-wrap:wrap;gap:12px}.genui-row>*{flex:1;min-width:120px}.genui-col{display:grid;gap:12px}.genui-grid{display:grid;grid-template-columns:repeat(var(--genui-cols,2),minmax(0,1fr));gap:12px}.genui-card{border:1px solid #8884;border-radius:8px;padding:12px;min-width:0}.genui-card>h4{font-size:16px}.genui-stat{display:flex;flex-direction:column;min-width:0;padding:8px 0}.genui-stat strong{font-size:28px;line-height:1.25;font-variant-numeric:tabular-nums;overflow-wrap:anywhere}.genui-stat small,.genui-stat span{opacity:.75}.genui-badge{display:inline-block;padding:2px 9px;border:1px solid #8885;border-radius:20px}.genui progress{display:block;width:100%;accent-color:#2563eb;height:10px;margin:7px 0}.genui-spacer{height:12px}.genui-callout{border-left:3px solid #2563eb;padding:10px 12px;background:#2563eb12}.genui-chart{margin:10px 0}.genui-chart figcaption{font-weight:600}.genui-chart svg{display:block;width:100%;height:auto;max-height:520px}.genui-chart svg text{fill:currentColor;font:11px system-ui}.genui-gridline{stroke:currentColor;opacity:.15;fill:none}.genui-legend{display:flex;flex-wrap:wrap;gap:7px 14px;font-size:12px}.genui-legend i{display:inline-block;width:9px;height:9px;border-radius:2px;margin-right:5px}.genui-scroll{overflow:auto;max-height:420px}.genui table{width:100%;border-collapse:collapse;font-size:12px}.genui td,.genui th{text-align:left;padding:7px;border-bottom:1px solid #8884;white-space:nowrap}.genui-source{margin-top:12px}.genui summary{cursor:pointer;font-size:12px}.genui pre{max-height:320px;overflow:auto;white-space:pre-wrap;word-break:break-word}.genui-unsupported{border-left:2px solid #d97706;padding:8px;margin:8px 0}.genui-html{display:block;width:100%;height:440px;border:1px solid #8884;border-radius:7px;background:white}.genui dl{display:grid;grid-template-columns:auto 1fr;gap:6px 12px}.genui dd{margin:0}.genui li{margin:4px 0}@media(max-width:520px){.genui{padding:10px}.genui-grid{grid-template-columns:repeat(2,minmax(0,1fr))}.genui-stat strong{font-size:23px}.genui-html{height:380px}}

package/public/genui.js

@@ -0,0 +1,144 @@
+/* DSH Remote: dependency-free, read-only dsh-ui subset. Never executes model code. */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory()
+  else root.DshGenUi = factory()
+})(typeof self !== 'undefined' ? self : this, function () {
+  'use strict'
+  const esc = value => String(value == null ? '' : value).replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]))
+  const palette = ['#2563eb', '#059669', '#d97706', '#db2777', '#7c3aed', '#0891b2']
+  const array = value => Array.isArray(value) ? value : []
+  const number = value => typeof value === 'number' && Number.isFinite(value) && Math.abs(value) <= 1e12
+  const color = (value, i) => /^#[0-9a-f]{3}(?:[0-9a-f]{3})?$/i.test(value || '') ? value : palette[i % palette.length]
+  const raw = value => '<pre><code>' + esc(typeof value === 'string' ? value : JSON.stringify(value, null, 2)) + '</code></pre>'
+  const details = value => '<details class="genui-source"><summary>JSON / 源码</summary>' + raw(value) + '</details>'
+  function unsupported(node, reason) {
+    return '<div class="genui-unsupported">暂不支持 / Unsupported: ' + esc(reason || node?.type || 'spec') + details(node) + '</div>'
+  }
+
+  function chart(node) {
+    const kind = node.kind || 'bars'
+    if (!['bars', 'line', 'donut'].includes(kind) || node.stacked || node.filter || node.sortField) return unsupported(node, 'chart options')
+    const series = array(node.series).length ? node.series : [{ label: node.title || '', data: node.data }]
+    if (series.length > 6 || (kind === 'donut' && series.length !== 1)) return unsupported(node, 'chart series')
+    if (series.some(s => !s || !Array.isArray(s.data) || !s.data.length || s.data.length > 100 || s.data.some(d => !d || !number(d.value)))) return unsupported(node, 'chart data')
+    const data = series[0].data
+    if (series.some(s => s.data.length !== data.length || s.data.some((d, i) => d.label !== data[i].label))) return unsupported(node, 'unaligned series')
+    const colors = series.map((s, i) => color(s.color || array(node.palette)[i], i))
+    const table = '<div class="genui-scroll"><table><thead><tr><th></th>' + series.map(s => '<th>' + esc(s.label || 'Value') + '</th>').join('') + '</tr></thead><tbody>' + data.map((d, i) => '<tr><th>' + esc(d.label) + '</th>' + series.map(s => '<td>' + esc(s.data[i].value) + '</td>').join('') + '</tr>').join('') + '</tbody></table></div>'
+    let svg = ''
+    if (kind === 'donut') {
+      const total = data.reduce((sum, d) => sum + d.value, 0)
+      if (data.some(d => d.value < 0) || total <= 0) return unsupported(node, 'donut requires non-negative values and positive total')
+      let offset = 0
+      svg = data.map((d, i) => {
+        const fraction = d.value / total * 100
+        const segment = '<circle cx="160" cy="120" r="75" fill="none" stroke="' + color(d.color || array(node.palette)[i], i) + '" stroke-width="34" pathLength="100" stroke-dasharray="' + fraction + ' ' + (100 - fraction) + '" stroke-dashoffset="' + (-offset) + '" transform="rotate(-90 160 120)"><title>' + esc(d.label) + ': ' + esc(d.value) + ' (' + fraction.toFixed(1) + '%)</title></circle>'
+        offset += fraction
+        return segment
+      }).join('') + '<text x="160" y="124" text-anchor="middle" fill="currentColor">' + esc(total) + '</text>'
+      svg = '<svg viewBox="0 0 320 240" role="img" aria-label="' + esc(node.title || 'Donut chart') + '">' + svg + '</svg>'
+      svg += '<div class="genui-legend">' + data.map((d, i) => '<span><i style="background:' + color(d.color || array(node.palette)[i], i) + '"></i>' + esc(d.label) + ' · ' + (d.value / total * 100).toFixed(1) + '%</span>').join('') + '</div>'
+    } else {
+      const values = series.flatMap(s => s.data.map(d => d.value))
+      let min = Math.min(0, ...values), max = Math.max(0, ...values)
+      if (min === max) max = min + 1
+      const horizontal = kind === 'bars' && node.horizontal === true
+      const width = 560, height = horizontal ? Math.max(240, data.length * 35 + 50) : 270
+      const left = horizontal ? 110 : 64, right = 20, top = 20, bottom = 45
+      const w = width - left - right, h = height - top - bottom
+      const scale = value => horizontal ? left + (value - min) / (max - min) * w : top + (max - value) / (max - min) * h
+      for (let i = 0; i <= 4; i++) {
+        const value = min + (max - min) * i / 4, p = scale(value)
+        svg += horizontal
+          ? '<path d="M' + p + ' ' + top + 'V' + (top + h) + '" class="genui-gridline"/><text x="' + p + '" y="' + (height - 12) + '" text-anchor="middle">' + esc(Number(value.toPrecision(4))) + '</text>'
+          : '<path d="M' + left + ' ' + p + 'H' + (left + w) + '" class="genui-gridline"/><text x="' + (left - 7) + '" y="' + (p + 4) + '" text-anchor="end">' + esc(Number(value.toPrecision(4))) + '</text>'
+      }
+      const step = (horizontal ? h : w) / data.length
+      series.forEach((s, si) => {
+        const points = []
+        s.data.forEach((d, i) => {
+          const center = (horizontal ? top : left) + step * (i + 0.5), pos = scale(d.value)
+          const hint = '<title>' + esc((s.label ? s.label + ' · ' : '') + d.label + ': ' + d.value) + '</title>'
+          if (kind === 'line') {
+            points.push(center + ',' + pos)
+            svg += '<circle cx="' + center + '" cy="' + pos + '" r="3" fill="' + colors[si] + '">' + hint + '</circle>'
+          } else {
+            const size = step * 0.7 / series.length, lane = center - step * 0.35 + si * size
+            const zero = scale(0)
+            svg += '<rect x="' + (horizontal ? Math.min(zero, pos) : lane) + '" y="' + (horizontal ? lane : Math.min(zero, pos)) + '" width="' + (horizontal ? Math.abs(zero - pos) : size) + '" height="' + (horizontal ? size : Math.abs(zero - pos)) + '" fill="' + (series.length === 1 ? color(d.color || array(node.palette)[i], i) : colors[si]) + '">' + hint + '</rect>'
+          }
+        })
+        if (kind === 'line') svg += '<polyline points="' + points.join(' ') + '" fill="none" stroke="' + colors[si] + '" stroke-width="2.5"/>'
+      })
+      data.forEach((d, i) => {
+        if (!horizontal && i % Math.ceil(data.length / 8) !== 0) return
+        const text = String(d.label || '')
+        svg += '<text x="' + (horizontal ? left - 6 : left + step * (i + 0.5)) + '" y="' + (horizontal ? top + step * (i + 0.5) + 4 : height - 21) + '" text-anchor="' + (horizontal ? 'end' : 'middle') + '">' + esc(text.length > 12 ? text.slice(0, 11) + '…' : text) + '</text>'
+      })
+      svg = '<svg viewBox="0 0 ' + width + ' ' + height + '" role="img" aria-label="' + esc(node.title || kind + ' chart') + '">' + svg + '</svg>'
+      if (series.length > 1) svg += '<div class="genui-legend">' + series.map((s, i) => '<span><i style="background:' + colors[i] + '"></i>' + esc(s.label) + '</span>').join('') + '</div>'
+    }
+    return '<figure class="genui-chart">' + (node.title ? '<figcaption>' + esc(node.title) + '</figcaption>' : '') + svg + '<details><summary>数据 / Data</summary>' + table + '</details></figure>'
+  }
+
+  function render(spec) {
+    if (!spec || typeof spec !== 'object') throw Error('Invalid spec')
+    let count = 0
+    function nodes(items, depth) { return array(items).map(n => node(n, depth)).join('') }
+    function node(n, depth) {
+      if (++count > 240 || depth > 12) throw Error('Component limit')
+      if (!n || typeof n !== 'object' || Array.isArray(n)) return unsupported(n)
+      const type = n.type
+      // Reject data-transforming options rather than silently displaying different data.
+      if (n.filter || n.sortField) return unsupported(n, type + ' filter/sort')
+      if ((type === 'table' && (array(n.rows).length > 200 || array(n.columns).length > 30)) ||
+          (['list', 'timeline', 'steps', 'keyvalue'].includes(type) && array(n.items || n.steps || n.pairs).length > 100)) return unsupported(n, type + ' size limit')
+      if (['row', 'col', 'grid', 'card'].includes(type)) {
+        const cols = Math.max(1, Math.min(4, Math.floor(Number(n.cols) || 2)))
+        return '<section class="genui-' + type + '"' + (type === 'grid' ? ' style="--genui-cols:' + cols + '"' : '') + '>' + (n.title ? '<h4>' + esc(n.title) + '</h4>' : '') + nodes(n.items, depth + 1) + '</section>'
+      }
+      if (type === 'text') { const tag = ['h1', 'h2', 'h3'].includes(n.size) ? n.size : 'p'; return '<' + tag + '>' + esc(n.content) + '</' + tag + '>' }
+      if (type === 'hero') return '<div class="genui-stat"><small>' + esc(n.label) + '</small><strong>' + esc(n.value) + '</strong><h4>' + esc(n.title) + '</h4><span>' + esc(n.subtitle) + '</span><span>' + esc(n.delta) + '</span></div>'
+      if (type === 'stat') return '<div class="genui-stat"><small>' + esc(n.label) + '</small><strong>' + esc(n.value) + '</strong><span>' + esc(n.delta) + '</span></div>'
+      if (type === 'badge') return '<span class="genui-badge">' + esc(n.label) + '</span>'
+      if (type === 'divider') return '<hr>'
+      if (type === 'spacer') return '<div class="genui-spacer"></div>'
+      if (type === 'progress' && !number(n.value)) return unsupported(n, 'progress value')
+      if (type === 'progress') return '<div>' + esc(n.label) + '<progress max="100" value="' + Math.max(0, Math.min(100, Number(n.value) || 0)) + '"></progress><small>' + esc(n.valueLabel || String(n.value || 0) + '%') + '</small>' + (number(n.target) ? '<small> · 目标 / Target: ' + esc(n.target) + '%</small>' : '') + '</div>'
+      if (type === 'callout') return '<aside class="genui-callout"><strong>' + esc(n.title) + '</strong><p>' + esc(n.content) + '</p></aside>'
+      if (type === 'code' || type === 'json') return raw(type === 'code' ? n.code : n.value)
+      if (type === 'list' || type === 'timeline' || type === 'steps') return '<ul>' + array(n.items || n.steps).slice(0, 100).map(v => '<li>' + (v && typeof v === 'object' ? (v.type ? node(v, depth + 1) : '<strong>' + esc(v.title) + '</strong> ' + esc(v.desc) + ' ' + esc(v.time)) : esc(v)) + '</li>').join('') + '</ul>'
+      if (type === 'keyvalue') return '<dl>' + array(n.pairs).slice(0, 100).map(v => '<dt>' + esc(v?.key) + '</dt><dd>' + esc(v?.value) + '</dd>').join('') + '</dl>'
+      if (type === 'table') return '<div class="genui-scroll"><table><thead><tr>' + array(n.columns).slice(0, 30).map(v => '<th>' + esc(v) + '</th>').join('') + '</tr></thead><tbody>' + array(n.rows).slice(0, 200).map(row => '<tr>' + array(row).slice(0, 30).map(v => '<td>' + esc(v) + '</td>').join('') + '</tr>').join('') + '</tbody></table></div>'
+      if (type === 'chart') return chart(n)
+      if (type === 'echart' && !n.option && ['bar', 'line', 'pie'].includes(n.preset)) return '<small>ECharts 基础数据预览 / Basic preview</small>' + chart({ ...n, type: 'chart', kind: { bar: 'bars', line: 'line', pie: 'donut' }[n.preset] })
+      if (type === 'accordion' || type === 'tabs') return array(n.tabs || n.items).slice(0, 30).map(v => '<details><summary>' + esc(v?.label || v?.title) + '</summary>' + nodes(v?.items, depth + 1) + '</details>').join('')
+      return unsupported(n)
+    }
+    const body = Array.isArray(spec) ? nodes(spec, 0) : spec.type ? node(spec, 0) : nodes(spec.items, 0)
+    if (!body) throw Error('No components')
+    return '<section class="genui"><div class="genui-caption">DSH UI · 只读预览 / Read-only</div>' + (spec.title ? '<h3>' + esc(spec.title) + '</h3>' : '') + body + details(spec) + '</section>'
+  }
+
+  function html(source) {
+    if (typeof document === 'undefined' || String(source).length > 200000) return raw(source)
+    // Template contents are inert: source images cannot start fetching during sanitization.
+    const template = document.createElement('template')
+    template.innerHTML = String(source)
+    const allowed = new Set('title style div span p br hr h1 h2 h3 h4 h5 h6 strong em b i u s small sub sup pre code blockquote ul ol li dl dt dd table thead tbody tfoot tr td th caption colgroup col section article header footer main aside figure figcaption details summary progress'.split(' '))
+    function clean(parent) {
+      for (const child of Array.from(parent.children)) {
+        if (!allowed.has(child.localName)) { child.remove(); continue }
+        for (const attr of Array.from(child.attributes)) {
+          if (!['style', 'class', 'colspan', 'rowspan', 'value', 'max'].includes(attr.name)) child.removeAttribute(attr.name)
+        }
+        clean(child)
+      }
+    }
+    clean(template.content)
+    const policy = "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; img-src 'none'; connect-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+    const srcDoc = '<!doctype html><html><head><meta http-equiv="Content-Security-Policy" content="' + policy + '"><meta name="viewport" content="width=device-width,initial-scale=1"><style>body{font:14px/1.6 system-ui;margin:16px;overflow-wrap:anywhere}table{border-collapse:collapse}td,th{padding:6px;border:1px solid #ccc}pre{white-space:pre-wrap}*{max-width:100%;box-sizing:border-box}</style></head><body>' + template.innerHTML + '</body></html>'
+    return '<section class="genui"><div class="genui-caption">HTML · 只读预览（脚本及外部资源已禁用）</div><iframe class="genui-html" sandbox="" referrerpolicy="no-referrer" title="HTML preview" srcdoc="' + esc(srcDoc) + '"></iframe></section>'
+  }
+  return { render, html }
+})