dsh-sidecard-ask 2.1.8 → 2.1.9

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 2.1.9
+
+**主题：承载面适配对齐 dsh-better-sidebar 0.28.2，修掉两个已复现的用户可见缺陷。**
+
+触发是一次专家评审（架构 / 安全 / 验收三线独立复核）：0.28.x 把 better 的 tab 从它自己的
+workbench 搬进了 **DSH 原生右栏**，而本插件仍按「better 是一个独立面板」建模——落点矩阵、
+`dockRail` 锚点、tab 归属、菜单入口四处同时失真。四个发布闸门当时全绿（1928），
+但绿只证明旧契约面没坏。
+
+### 修复（适配）
+
+- **A1 跨会话关闭/删除不关 tab**：归属从进程级单槽 `cardId` 改为按 `(kind, session)` 记录
+  （`owners` Map）。单槽在跨会话时会误判「别的卡拥有它」，让 A 会话的 tab 永远关不掉。
+  会话未知（历史条目、幽灵 id）时仍退回单槽，保住 2.1.5 R2 的归属语义。
+- **A2 重载后的幽灵面板没有出口**：无主 body 现在渲染「关闭此页」；**只有本页真的挂载过**
+  该 tab 才自动关闭。宿主会持久化栏布局，别的窗口恢复的同一张 tab 不会被本页抢走。
+- **A3 dockRail 铺到别人的页面上**：`CardHost` 根节点声明 `data-dsa-card-id`，
+  `findRail` 拒绝不属于本层卡片的 body；全部候选被占时 `data-dsa-dock="occupied"`，浮层保持浮动。
+- **A4 `+` 菜单里的空页胶囊**：better 描述符加 `hidden: true`——保留 `openTab` 可用，只是不再进菜单。
+  原生 guide 那一条缺宿主语义材料，仍会显示，已记入 README §5.6「仍未验证」。
+- **A5 禁用态被误判成故障**：`available()` 读 0.28.x 的 `isTabEnabled`，禁用即 `reason='tab-disabled'`，
+  `auto` 直接落浮层，不再先挂 600 ms 再报「承载面未证实」。
+- **A6 非当前会话的卡被证明迁走**：宿主对非当前屏的 `openTab` 是排队而不是拒绝，渲染证明
+  现在只对当前屏会话武装。
+- **A7 自检看不清真相**：上报增 `railTabs`（宿主清单里本插件行数）与 `mountedTabId`。
+
+### 修复（安全 / 归属）
+
+- `/config` 改 SMTP 主机/端口/TLS/账号任一项 → 已存授权码作废（凭据不再跟随新目标外送）。
+- `/config` 的 `sideTools: "inherit"` 需要 `confirmInheritTools: true`（防误触；不是安全边界）。
+- 只读护栏 **fail-closed**：注册表答了却认不出只读工具时拒跑（新错误码 `no-readonly-guard`，
+  客户端中英文案 + 错误码分类已补），不再静默继承父会话全部工具。
+- `cardId` 不可预测；better tab 标题不再携带问题原文；`tab.meta.cardId` 校验归属会话。
+- `closeRailRow` 容忍带 `dsh-better-sidebar:` 前缀的 kind；`/ask` 的 start 帧回带
+  `parentSessionId` / `requestedSessionId`，跨会话作答可被看见。
+
+### 新增（行为）
+
+- **答完自动展开卡片**：浮层默认是胶囊（一行状态），答案在那里只看得到「已完成」三个字。
+  现在回答结束（`done` / `stopped` / `error`）时自动把浮层切到卡片形态并展开该卡，
+  答案内容直接出现在侧边卡片里。设置页新增「答完自动展开卡片」开关（默认开）；
+  置 `autoExpandOnDone: false` 可恢复旧行为（始终停在胶囊，点一下才展开）。
+### 闸门
+
+- `node test/verify.mjs` → 58 / 0
+- `node test/contract-test.mjs` → 1499 / 0
+- `node test/float-placement.mjs` → 100 / 0
+- `node test/smoke-test.mjs` → 291 / 0
+- 合计 **1948**（2.1.8 基线 1928，新增 20 条：hidden、禁用门、SMTP 换目标清密码、
+  inherit 确认、`no-readonly-guard` 拒跑等）。
+
+### 未执行
+
+真实浏览器/Electron 点按与视觉、桌面 profile、macOS/Linux 均未验证；详见 README §5.6。
+
 ## 2.1.8
 
 **主题：交付《非 Node 宿主契约》文档，无代码改动。**

package/README.md

@@ -167,6 +167,7 @@ plugin_manager(action="install_bundle", target="D:\\Users\\34332\\AI\\dsh-sideca
 | `sideSurface` | `auto` \| `native-rightbar` \| `better-sidebar` \| `flow` | `auto` | **窗口模式（侧边承载面）**：自动挑选（先 dsh-better-sidebar，再内置浮层卡片）/ 强制 DSH 原生右侧栏（不参与自动）/ 强制 dsh-better-sidebar / 强制内置浮层卡片 | 立即 |
 | `maxChars` | 200–60000 | `4000` | **最大字符数**：超出部分头尾保留、中间截断并标注 | 立即 |
 | `floatMode` | `capsule` \| `full` | `capsule` | **内置浮层的默认形态**：胶囊（一行，最小遮挡）/ 完整卡片栈。运行时可即时收起为胶囊，但不写回本项——刷新后仍回到这里设的默认。旧配置里存过 `off` 的会在启动时校验失败、回退为 `capsule`，并在 `problems` 里给出提示（`index.js` 的 `sanitizeLayer`），无需手工迁移 | 立即 |
+| `autoExpandOnDone` | 布尔 | `true` | **答完自动展开卡片**：回答结束（`done` / `stopped` / `error`）时把浮层从胶囊切到卡片形态并展开该卡，答案正文直接显示在侧边卡片里。置 `false` 则始终停在胶囊，点一下才展开（2.1.9 起） | 立即 |
 | `floatMaxWidth` | 240–560 | `340` | **内置浮层宽度上限**（px）：实际宽度 = `min(本项, 对话区右侧可用带宽)`，可用带宽不足 240px 时才会压入对话区 | 立即 |
 | `dockRail` | 布尔 | `true` | **右侧栏打开时占满它**：答案卡铺满右栏标签条下方的内容区，读起来像栏内的一页，而不是 340px 的小浮层。收起为胶囊、点卡片底部「关闭」、右栏宽度 < 280px 或高度 < 240px 时自动回到常规浮层；实现靠测量右栏 DOM 矩形，**没有**走 DSH 的右栏 API（见 §4.2 与 §6.1） | 立即 |
 | `shortcut` | 形如 `Alt+Q`、`Ctrl+Shift+K` | `Alt+Q` | **快捷键**：唤起提问框（`trigger` 允许时） | 立即 |
@@ -549,6 +550,72 @@ dsh-better-sidebar 为此专门带了一条防御（`html[data-platform] body>[d
 
 ---
 
+### 5.6 2026-11-03 复核（v2.1.9 / dsh-better-sidebar 0.28.2）
+
+本轮把适配核对的**对象**从上表的 0.22.1（网页）/ 0.24.1（桌面）更新到本机实际运行的
+**0.28.2**（`SIDEBAR_SERVICE_VERSION = "0.28.2"`，`SIDEBAR_FEATURES` 14 项），并修掉四处
+按旧模型写的假设。证据分三类：**源码级**（读 0.28.2 的 `lib/types/client/service.d.ts`
+与 `src/client/*.ts`）、**替身复现**（`test/` 下的 0.28.2 形状替身）、**真机**（本轮**未做**，见末尾）。
+
+#### 0.28.2 的关键事实（相对 0.22.1 的漂移）
+
+| # | 事实 | 对适配的影响 |
+|---|---|---|
+| 1 | 组件类 seed 的 `openTab` 实际落到 **DSH 原生右栏**（`service.ts:1120-1145`），不再进 better 自己的 workbench | better 与 native **共用同一个物理容器**；`dockRail` 的锚点会指到别人的页面 |
+| 2 | tab id 由宿主 mint（`tab1…`），seed id 被忽略，`closeTab(seed.id)` 是 no-op | 关闭必须用 `CardHost` 记录的真实 id（2.1.6 S1 已做） |
+| 3 | 同 kind 每会话只有**一个 page 地址**（无 `multiple`） | 同会话再开一张 = 导航，旧卡必须迁回浮层（2.1.6 S2 已做） |
+| 4 | `isTabEnabled(type)` 禁用后 `openTab` **warn + return**，不抛错 | 禁用态会被误判成「承载面未证实」并弹假故障（2.1.9 A5 修） |
+| 5 | 每个注册类型自动进 `+` 菜单，并生成 guide 胶囊 | 点开是一张无 `cardId` 的空页（2.1.9 A4 用 `hidden: true` 修） |
+| 6 | `OpenTabSeed.target` 支持 `right/bottom/side`，另有 `preferNewPane` 与 split pane | 本插件不传 target（默认 right）；分栏时 panel 级回退会横跨两栏 |
+| 7 | 非当前会话的 `openTab` 是**排队**，不是拒绝；只有 on-screen 才 mount | 600 ms 渲染证明会把排队中的卡误判为失败（2.1.9 A6 修） |
+| 8 | 镜像注册的 `id` 是 `dsh-better-sidebar:<id>`、`kind` 是描述符 id | 两个适配器同 kind 相撞的旧缺陷**已清除**；但 `closeRailRow` 需容忍带前缀的 kind |
+
+> `.d.ts` 里 `openTab` 的注释写「每次 open 落在 bottom workbench」，而 `OpenTabSeed.target`
+> 的注释写默认 `'right'` 是原生右栏——两者矛盾，**只有 `src/client/service.ts` 给出真值**。
+> 下一位维护者不要只看 `.d.ts`。
+
+#### 本版修掉的适配缺陷
+
+| 编号 | 缺陷 | 修法 |
+|---|---|---|
+| A1 | 跨会话关闭/删除不关 better tab（进程级单槽 `cardId` 误判归属） | 归属改为按 `(kind, session)` 记（`owners` Map）；「本会话有别的卡持有才拒绝」，会话未知时退回单槽 |
+| A2 | 刷新后宿主还原的 better tab 无人认领、没有出口 | 空页渲染「关闭此页」；**只有本页真的挂载过**该 tab 才自动关（别的窗口的 tab 不抢） |
+| A3 | `dockRail` 把浮层卡铺到另一张卡自己的页面上 | `CardHost` 根节点声明 `data-dsa-card-id`；`findRail` 拒绝不属于本层的 body，全被拒时 `data-dsa-dock="occupied"` |
+| A4 | `+` 菜单两条「点开即空页」胶囊 | descriptor 加 `hidden: true`（保留可 open，只是不进菜单）；原生 guide 那条缺宿主语义材料，仍会显示 |
+| A5 | 禁用的 tab 类型仍被 `auto` 选中并报假故障 | `available()` 读 `isTabEnabled`，禁用即 `reason='tab-disabled'`，直接落浮层 |
+| A6 | 非当前会话的卡被 600 ms 证明迁走 | 证明只对「当前屏会话」武装 |
+| A7 | 自检看不出「到底有没有落栏」 | 上报增 `railTabs`（宿主清单里本插件行数）与 `mountedTabId`（最近一次真实挂载的宿主 tab id） |
+
+#### 安全相关（同一轮，详见 §十二）
+
+- `/config` 改 `feedbackSmtpHost/Port/Secure/User` 任一项 → **已存授权码作废**。否则「空密码 = 保留旧值」
+  等于把凭据交给新主机，而 `AUTH PLAIN` 是明文。
+- `/config` 写 `sideTools: "inherit"` 需要 `confirmInheritTools: true`。**这不是安全边界**
+  （同源脚本可以伪造这个字段），只让这次提权必须是有意的；同源信任边界由宿主权限决定。
+- 只读护栏改为 **fail-closed**：工具注册表答了却认不出任何只读工具时，除非另有 `agentPreset`
+  收窄，否则**拒跑**（新错误码 `no-readonly-guard`，卡片文案中英齐全）。
+- `cardId` 改为不可预测（`card-<base36 时间>-<序号>-<随机 6 位>`）；better tab 标题不再携带问题原文
+  （0.28.x 会把 title/meta 随布局持久化）；`tab.meta.cardId` 增加「属于本会话」校验。
+
+#### 0.28.2 新 API 的准入条件（采用前必须满足）
+
+- `updateTab(tabId, { title, path, meta }, sessionId)`：① 只允许 `embeddedTabIds` 里的自持 tabId；
+  ② `sessionId === card.sessionId`；③ **永不带 `path`**（那等于给出「在后台会话打开任意文件路径」的原语）。
+- `stateSubscription` / `getSnapshot`：只用来读，**禁止**用快照的 `sessionId` 重定向在飞请求。
+- `pluginSettings`：只放 UI 偏好，绝不放卡片正文或选中文本。
+
+#### 仍未验证（如实记录）
+
+- 真实浏览器 / Electron 页面里的**点按与视觉**：本机无 GUI 自动化。`dockRail` 的 `occupied`、
+  `hidden` 之后的 `+` 菜单、跨窗口清扫都**没有被真机执行**。
+- 桌面端：desktop profile 同样是 `dsh-better-sidebar ^0.28.2`，§5.3 的 0.24.1 核对**已过期**；
+  本版按同一套源码事实处理，但没跑桌面。
+- macOS / Linux：零用例，仓库没有 CI。
+- `openTabs` 是否跨窗口共享（`app.asar` 内的 `sidebar-right` 读不到）：因此「自动清扫」只采用
+  「本页挂载过」这一按页成立的判据，没有做 boot 期盲扫。
+
+---
+
 ## 六、未知 DSH API：占位接口与替换方式
 
 开发时以**运行时能力探测**为主，任何"本机没验证到"的接口都在代码里显式留了占位与替换点。它们集中在三处：

package/client.js

@@ -117,7 +117,7 @@ window.__ModuleLoader__.load({
      * the Host and the module's `api.version` both read it, so a report can
      * never claim a generation the browser is not actually running.
      */
-    const CLIENT_VERSION = '2.1.8'
+    const CLIENT_VERSION = '2.1.9'
 
     /**
      * Tab kind served by the DSH native right rail (also its implementation id).
@@ -206,6 +206,10 @@ window.__ModuleLoader__.load({
       // tool-narrowing channel 0.2.1 honors (see the settings row help text).
       sideAgentPreset: '',
       floatMode: 'capsule',
+      // 2.1.9：答完自动把浮层从胶囊展开成卡片。胶囊只渲染一行状态，答案要
+      // 点一下 › 才看得到；用户明确要求「提问完成之后直接在侧边卡片显示回答内容」。
+      // 置 false 可恢复旧行为（始终停在胶囊）。
+      autoExpandOnDone: true,
       floatMaxWidth: 340,
       // Docked presentation (1.8.3): when the right rail is on screen, the
       // answer paints inside the rail's rectangle instead of floating as a
@@ -463,6 +467,12 @@ window.__ModuleLoader__.load({
       // where a page goes. It also works on builds whose rail markers we have
       // never seen — including the leftover "card closed" tab, which still
       // occupies a page body.
+      //
+      // 0.28.x moved the side-card plugin's tabs INTO this same rail, so this
+      // marker now also matches a DIFFERENT card's page. `findRail` refuses a
+      // body that declares another card id (`data-dsa-card-id`) instead of
+      // painting our card on top of it; unmarked bodies (older hosts, leftover
+      // closed-card faces) stay eligible.
       '[data-dsa-rail-host]',
       '[data-sidebar-right-panel][data-sidebar-right-open] [data-dockkit-pane]',
       '[data-sidebar-right-panel][data-sidebar-right-open]',
@@ -539,17 +549,31 @@ window.__ModuleLoader__.load({
      *
      * @returns {{node: Element, box: {left: number, top: number, width: number, height: number}}|null}
      */
-    function findRail(scope) {
+    function findRail(scope, ownCardIds) {
       if (scope === null || scope === undefined || typeof scope.querySelector !== 'function') return null
+      const owns = ownCardIds instanceof Set ? ownCardIds : null
+      let occupied = false
       for (const selector of RAIL_SELECTORS) {
         let node = null
         try { node = scope.querySelector(selector) } catch { node = null }
         if (node === null || typeof node.getBoundingClientRect !== 'function') continue
+        // A body that names a card this layer does not own belongs to another
+        // side card (or another session's page). Docking into it would cover
+        // that card, so it is skipped and remembered as "occupied" — the layer
+        // then stays floating and says why through `data-dsa-dock`.
+        let cardId = null
+        try {
+          cardId = typeof node.getAttribute === 'function' ? node.getAttribute('data-dsa-card-id') : null
+        } catch { cardId = null }
+        if (typeof cardId === 'string' && cardId !== '' && (owns === null || !owns.has(cardId))) {
+          occupied = true
+          continue
+        }
         let box = null
         try { box = dockedBodyRect(node) } catch { box = null }
-        if (railOnScreen(box)) return { node, box }
+        if (railOnScreen(box)) return { node, box, occupied }
       }
-      return null
+      return occupied ? { node: null, box: null, occupied: true } : null
     }
 
     /**
@@ -627,6 +651,7 @@ window.__ModuleLoader__.load({
         answerNonStreaming: '当前 DSH 版本未提供流式帧，答案一次性返回',
         answerEmpty: '（没有内容）',
         cardClosed: '该卡片已关闭',
+        closeThisTab: '关闭此页',
         cardMovedToFlow: '该卡片已移至浮层显示',
         cardDelete: '删除这条追问对话',
         cardDeleteTitle: '删除这条追问对话？',
@@ -660,6 +685,7 @@ window.__ModuleLoader__.load({
         errorBusy: '并发追问已达上限（{n}），请稍后再试',
         errorNoSideEngineBody: '这台 DSH 组合没有可用的子代理 provider',
         errorNoParentBody: '当前没有活动的会话代理，无法发起独立作答',
+        errorNoReadonlyGuardBody: '这台宿主的工具注册表里认不出只读工具，为保证侧边作答不写工作区，本次已拒绝',
         errorAborted: '作答被取消或超时',
         errorUnreachableBody: '宿主接口不可达',
         errorUnauthorizedBody: '需要先通过 DSH 登录（宿主会话未认证）',
@@ -689,6 +715,8 @@ window.__ModuleLoader__.load({
         setFloatModeCapsule: '胶囊（不遮挡对话，可随时展开）',
         setFloatModeFull: '直接展开成卡片',
         setFloatModeHint: '浮层贴右侧边缘，只在空间不足时才可能压到对话区',
+        setAutoExpandOnDone: '答完自动展开卡片',
+        setAutoExpandOnDoneHint: '开启后，回答一结束就展开成卡片显示正文；关闭后保持一行胶囊，点一下才展开',
         setFloatMaxWidth: '浮层宽度上限（px）',
         setFloatMaxWidthHint: '空间不足时自动收窄，不会硬顶',
         setDockRail: '右侧栏打开时占满它',
@@ -902,6 +930,7 @@ window.__ModuleLoader__.load({
         answerNonStreaming: 'This DSH build publishes no stream frames; the answer arrived at once',
         answerEmpty: '(empty)',
         cardClosed: 'This card was closed',
+        closeThisTab: 'Close this tab',
         cardMovedToFlow: 'This card moved to the floating stack',
         cardDelete: 'Delete this follow-up conversation',
         cardDeleteTitle: 'Delete this follow-up conversation?',
@@ -935,6 +964,7 @@ window.__ModuleLoader__.load({
         errorBusy: 'Too many concurrent answers (limit {n}); try again shortly',
         errorNoSideEngineBody: 'This DSH composition has no usable subagent provider',
         errorNoParentBody: 'No active session agent to answer independently',
+        errorNoReadonlyGuardBody: 'This host\'s tool registry has no recognisable read-only tools, so the side answer was refused to keep the workspace untouched',
         errorAborted: 'The answer was cancelled or timed out',
         errorUnreachableBody: 'The host API is unreachable',
         errorUnauthorizedBody: 'Sign in to DSH first (the host session is not authenticated)',
@@ -964,6 +994,8 @@ window.__ModuleLoader__.load({
         setFloatModeCapsule: 'Capsule (never covers the conversation)',
         setFloatModeFull: 'Expanded card stack',
         setFloatModeHint: 'The layer is anchored to the right edge and only overlaps on very narrow frames',
+        setAutoExpandOnDone: 'Expand the card when the answer finishes',
+        setAutoExpandOnDoneHint: 'On: the answer appears in the card the moment it settles. Off: the one-line capsule stays until you click it',
         setFloatMaxWidth: 'Floating layer max width (px)',
         setFloatMaxWidthHint: 'Narrows automatically when there is not enough room',
         setDockRail: 'Fill the right rail while it is open',
@@ -1215,6 +1247,9 @@ window.__ModuleLoader__.load({
       busy: { key: 'errorBusy', vars: () => ({ n: store?.state?.config?.maxConcurrentAsks ?? 0 }) },
       'no-side-engine': { key: 'errorNoSideEngineBody' },
       'no-parent': { key: 'errorNoParentBody' },
+      // 2.1.9: the read-only guard now fails closed. The code must be named
+      // Client-side, or an English UI would show the Host's Chinese line.
+      'no-readonly-guard': { key: 'errorNoReadonlyGuardBody' },
       aborted: { key: 'errorAborted' },
       unreachable: { key: 'errorUnreachableBody' },
       // The Host now gates these routes on the DSH browser session, so both are
@@ -1606,6 +1641,23 @@ window.__ModuleLoader__.load({
       store.set({ floatMode: mode })
     }
 
+    /**
+     * Bring a finished card on screen.
+     *
+     * The floating layer defaults to the `capsule` pill (one line of status), so
+     * an answer that finishes while collapsed never shows its text. Only a card
+     * carried by the flow layer needs this: a card in the right rail already has
+     * its own page, and an already-expanded card is left alone.
+     * @param {string} id - the card that just finished.
+     */
+    function revealFinishedCard(id) {
+      if (store.state.config.autoExpandOnDone === false) return
+      const card = store.state.cards.find(item => item.id === id)
+      if (card === undefined || card.surface !== 'flow') return
+      setFloatMode('full')
+      patchCard(id, { open: true })
+    }
+
     /** Replace one card by id (immutably; a no-op when it is gone). */
     function patchCard(id, patch) {
       const cards = store.state.cards.map(card => (card.id === id ? { ...card, ...patch } : card))
@@ -2332,21 +2384,34 @@ window.__ModuleLoader__.load({
          * this id instead of guessing at a `tab.meta` that no longer exists.
          */
         cardId: null,
+        /** Per-session tab ownership; see `ownerKeyOf`. */
+        owners: new Map(),
         open(card) {
           if (!this.available() || typeof this.controller.openTab !== 'function') return false
           // 同一个 kind 在原生栏里只有一个地址（见 cardId 的注释）：先把栏里
           // 其它卡片迁回浮层，否则它们既不在栏里也不在浮层上，流式输出还会
           // 继续往一张看不见的卡片里写。
+          const openSession = typeof card.sessionId === 'string' && card.sessionId !== ''
+            ? card.sessionId
+            : store.state.sessionId
+          const openKey = ownerKeyOf(openSession)
           for (const other of store.state.cards) {
-            if (other.id !== card.id && other.surface === 'native-rightbar') {
-              // `open: true` is load-bearing: the floating layer only mounts a
-              // card whose `surface === 'flow'` AND `open` is true, so migrating
-              // a card back to the flow while leaving it folded hid it on BOTH
-              // surfaces — not in the rail, not on screen, still streaming.
-              patchCard(other.id, { surface: 'flow', open: true })
-            }
+            if (other.id === card.id || other.surface !== 'native-rightbar') continue
+            // Only the SAME session's other card loses its address: every
+            // session keeps its own tab, so migrating across sessions would
+            // yank a card out of a rail the user is still looking at.
+            const otherSession = typeof other.sessionId === 'string' && other.sessionId !== ''
+              ? other.sessionId
+              : store.state.sessionId
+            if (ownerKeyOf(otherSession) !== openKey) continue
+            // `open: true` is load-bearing: the floating layer only mounts a
+            // card whose `surface === 'flow'` AND `open` is true, so migrating
+            // a card back to the flow while leaving it folded hid it on BOTH
+            // surfaces — not in the rail, not on screen, still streaming.
+            patchCard(other.id, { surface: 'flow', open: true })
           }
           this.cardId = card.id
+          this.owners.set(openKey, card.id)
           try {
             this.controller.openTab(CARD_KIND, { params: { cardId: card.id }, revealIfOpened: true })
           } catch (error) {
@@ -2372,12 +2437,20 @@ window.__ModuleLoader__.load({
           // 却把另一种真实场景关在门外：页面重载后宿主会从布局里恢复出这张
           // tab，而 `cardId` 是内存态、必然是 null —— 此时没有卡片认领它，
           // 删除历史条目也永远关不掉，就是专家复现的"幽灵面板"。
-          // 规则改为：**已知别的卡拥有它才拒绝**；无主时按 kind + 会话定位。
-          if (this.cardId !== null && this.cardId !== card.id) return false
-          // 卡片自己的会话优先：用户切走会话后关闭 A 的 tab，仍应落在 A。
+          // 规则改为：**本会话里有别的卡拥有它才拒绝**；本会话无主时按
+          // kind + 会话定位（重载后的幽灵面板由此能关掉）。
+          //
+          // 2.1.9：归属按会话记。进程级单槽在跨会话时会误判「别的卡拥有它」，
+          // 让 A 会话的 tab 永远关不掉（专家复现的跨会话残留）。
           const ownerSession = typeof card.sessionId === 'string' && card.sessionId !== ''
             ? card.sessionId
             : store.state.sessionId
+          const knownSession = typeof card.sessionId === 'string' && card.sessionId !== ''
+          const holderId = this.owners.get(ownerKeyOf(ownerSession))
+          if (holderId !== undefined && holderId !== card.id) return false
+          // 会话未知（历史条目/幽灵 id）时，退回进程级单槽：没有任何会话认领
+          // 它，而栏里那张属于别的卡，就不能替它关。
+          if (holderId === undefined && !knownSession && this.cardId !== null && this.cardId !== card.id) return false
           let rows = []
           try {
             rows = typeof controller.openTabs?.getSnapshot === 'function'
@@ -2403,6 +2476,7 @@ window.__ModuleLoader__.load({
               return false
             }
             if (this.cardId === card.id) this.cardId = null
+            if (this.owners.get(ownerKeyOf(ownerSession)) === card.id) this.owners.delete(ownerKeyOf(ownerSession))
             return true
           } catch (error) {
             console.warn(`[${PLUGIN_ID}] the right rail refused the close:`, error)
@@ -2425,6 +2499,8 @@ window.__ModuleLoader__.load({
          * that is not this owner must not close someone else's tab.
          */
         cardId: null,
+        /** Per-session tab ownership; see `ownerKeyOf`. */
+        owners: new Map(),
         /**
          * Why this adapter is (not) usable, in the settings page's own words.
          * `null` means "usable"; a string explains the refusal.
@@ -2445,7 +2521,21 @@ window.__ModuleLoader__.load({
          */
         available() {
           if (this.service === null || this.error !== null) return false
-          return Array.isArray(this.features) && this.features.includes('tabMeta')
+          if (!(Array.isArray(this.features) && this.features.includes('tabMeta'))) return false
+          // 0.28.x: every registered type has its own on/off switch in the
+          // side-card plugin's settings, and `openTab` on a disabled type
+          // warns and returns instead of throwing. Treat it as "not usable"
+          // here so `auto` goes straight to the floating card instead of
+          // spending 600 ms proving a surface that deliberately refused.
+          try {
+            if (typeof this.service.isTabEnabled === 'function'
+              && this.service.isTabEnabled(CARD_KIND_BETTER) === false) {
+              this.reason = 'tab-disabled'
+              return false
+            }
+          } catch { /* the probe is optional */ }
+          if (this.reason === 'tab-disabled') this.reason = null
+          return true
         },
         open(card) {
           if (!this.available() || typeof this.service.openTab !== 'function') return false
@@ -2468,21 +2558,25 @@ window.__ModuleLoader__.load({
           // `dedupeKey` on our descriptor is what collapses repeat opens onto
           // the same tab; both are part of the stable consumer contract.
           this.service.openTab(
-            { type: CARD_KIND_BETTER, id: tabId, title: card.question.slice(0, 32), meta: { cardId: card.id } },
+            { type: CARD_KIND_BETTER, id: tabId, title: t('answerTitle'), meta: { cardId: card.id } },
             typeof targetSession === 'string' && targetSession !== '' ? { sessionId: targetSession } : undefined,
           )
           this.cardId = card.id
+          this.owners.set(ownerKeyOf(targetSession), card.id)
           return true
         },
         close(card) {
           if (!this.available() || typeof this.service.closeTab !== 'function') return false
-          // 单一 page 地址：只有最后 open 的那张卡拥有栏里的 tab。
-          // 同 native.close：无主（cardId 为 null，页面重载后）也要放行，
-          // 否则在历史管理器里删掉一条 better 卡，栏里那张 tab 永远留空。
-          if (this.cardId !== null && this.cardId !== card.id) return false
+          // 单一 page 地址（每个会话一个）：只有本会话里最后 open 的那张卡
+          // 拥有栏里的 tab。同 native.close：本会话无主（页面重载后）也要
+          // 放行，否则在历史管理器里删掉一条 better 卡，栏里那张 tab 永远留空。
           const sessionId = typeof card.sessionId === 'string' && card.sessionId !== ''
             ? card.sessionId
             : (store.state.sessionId ?? undefined)
+          const knownSession = typeof card.sessionId === 'string' && card.sessionId !== ''
+          const holderId = this.owners.get(ownerKeyOf(sessionId))
+          if (holderId !== undefined && holderId !== card.id) return false
+          if (holderId === undefined && !knownSession && this.cardId !== null && this.cardId !== card.id) return false
           const scope = typeof sessionId === 'string' && sessionId !== '' ? { sessionId } : undefined
           // 0.28.x 的原生 tab id 由宿主 mint（tab1…），不是我们传入的 seed id；
           // CardHost 挂载时把真实 id 记进 embeddedTabIds。
@@ -2490,17 +2584,20 @@ window.__ModuleLoader__.load({
           if (typeof mountedId === 'string' && mountedId !== '') {
             this.service.closeTab(mountedId, scope)
             this.cardId = null
+            if (this.owners.get(ownerKeyOf(sessionId)) === card.id) this.owners.delete(ownerKeyOf(sessionId))
             return true
           }
           // 卡片还没挂载过（或已从 store 移除）：按 kind + 会话在栏的清单里
           // 找到唯一那张 tab，经原生控制器关闭。
           if (closeRailRow(CARD_KIND_BETTER, sessionId)) {
             this.cardId = null
+            if (this.owners.get(ownerKeyOf(sessionId)) === card.id) this.owners.delete(ownerKeyOf(sessionId))
             return true
           }
           // 0.19 之前的 bottom workbench：seed id 就是 tab id。
           this.service.closeTab(`${CARD_KIND_BETTER}:${card.id}`, scope)
           this.cardId = null
+          if (this.owners.get(ownerKeyOf(sessionId)) === card.id) this.owners.delete(ownerKeyOf(sessionId))
           return true
         },
       },
@@ -2549,6 +2646,29 @@ window.__ModuleLoader__.load({
      * @param {object} state - `store.state`.
      * @returns {object} the report body (allow-listed again on the Host).
      */
+    /**
+     * How many rail rows currently belong to this plugin.
+     *
+     * 0.28.x's `available` only says the descriptor registered — it cannot say
+     * the tab ever sat in the rail, because a disabled type or a missing guide
+     * entry makes `openTab` return silently. Counting the host's own inventory
+     * is the only first-hand signal, and it is what a bug report needs.
+     * @returns {number}
+     */
+    function clientRailTabCount() {
+      const controller = surfaces.native === null ? null : surfaces.native.controller
+      try {
+        const rows = typeof controller?.openTabs?.getSnapshot === 'function'
+          ? controller.openTabs.getSnapshot()
+          : []
+        if (!Array.isArray(rows)) return 0
+        return rows.filter(row => typeof row?.kind === 'string'
+          && (row.kind === CARD_KIND
+            || row.kind === CARD_KIND_BETTER
+            || row.kind === `dsh-better-sidebar:${CARD_KIND_BETTER}`)).length
+      } catch { return 0 }
+    }
+
     function buildClientReport(state) {
       return {
         // Read from the module's own version constant so the report can never
@@ -2567,6 +2687,10 @@ window.__ModuleLoader__.load({
           ...(surfaces.better.version === null ? {} : { version: surfaces.better.version }),
           ...(surfaces.better.reason === null ? {} : { reason: String(surfaces.better.reason) }),
           features: surfaces.better.features,
+          // First-hand proof that a page really exists in the rail, plus the
+          // last host tab id a body actually mounted with.
+          railTabs: clientRailTabCount(),
+          mountedTabId: lastMountedHostTabId,
         },
         // §4.5 family singleton verdict (host-side diagnostics only).
         family: {
@@ -2586,6 +2710,9 @@ window.__ModuleLoader__.load({
      */
     let renderedCardId = null
 
+    /** The host tab id the most recent embedded body mounted with. */
+    let lastMountedHostTabId = null
+
     /**
      * Host tab ids for cards mounted by an external embedder, keyed by card id.
      *
@@ -2595,8 +2722,29 @@ window.__ModuleLoader__.load({
      * open lands in DSH's native rail, so `closeTab(seed.id)` is a strict no-op.
      * The body records the real id here and `surfaces.better.close` uses it.
      */
+    /**
+     * The key an adapter records tab ownership under.
+     *
+     * Ownership is per SESSION, never process-global: each session has its own
+     * page address for a kind, so one slot could only ever describe the last
+     * opened card and would deny every other session its own close.
+     * @param {string|null|undefined} sessionId
+     * @returns {string} '' for "unknown session"
+     */
+    const ownerKeyOf = sessionId => (typeof sessionId === 'string' && sessionId !== '' ? sessionId : '')
+
     const embeddedTabIds = new Map()
 
+    /**
+     * Card ids this page has actually rendered a body for.
+     *
+     * Mount is the only thing that proves a tab belongs to THIS page: the host
+     * persists the rail layout, so another window can restore the same tab
+     * record while its card lives there. A restored-but-unmounted tab therefore
+     * gets a close button, never an automatic close.
+     */
+    const everMountedCards = new Set()
+
     /**
      * Pick the surface for a new card.
      * @param {string} wanted - `auto` | adapter kind.
@@ -4911,8 +5059,10 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             } catch { return null }
           }
           const laneRect = measure(lane)
-          const rail = findRail(document)
-          const railBox = rail === null ? null : rail.box
+          const ownCards = new Set(store.state.cards.filter(item => item.surface === 'flow').map(item => item.id))
+          const rail = findRail(document, ownCards)
+          const railBox = rail === null || rail.box === null ? null : rail.box
+          const railOccupied = rail !== null && rail.occupied === true && railBox === null
           const laneRight = laneRect === null ? rootWidth : laneRect.right
           const railLeft = railBox === null ? null : railBox.left
           // 2.1.3: the composer occupies the bottom of the conversation column,
@@ -4965,7 +5115,9 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             ? 'dock'
             : (mode !== 'full'
               ? 'mode'
-              : (dockWanted ? (railBox === null ? 'no-rail' : 'rail-too-small') : 'off'))
+              : (dockWanted
+                ? (railBox !== null ? 'rail-too-small' : (railOccupied ? 'occupied' : 'no-rail'))
+                : 'off'))
           // The rail can appear AFTER this effect ran (opening it mounts new
           // nodes), and it can be re-created later: keep the observer pointed at
           // whichever node is currently accepted.
@@ -5722,6 +5874,14 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             : notifyPerm === 'denied'
               ? t('notifyDenied')
               : t('setNotifyOnDoneHint')),
+        h('label', { className: 'dsa-check' },
+          h('input', {
+            type: 'checkbox',
+            checked: draft.autoExpandOnDone !== false,
+            onChange: event => setDraft({ ...draft, autoExpandOnDone: event.target.checked }),
+          }),
+          t('setAutoExpandOnDone')),
+        h('span', { className: 'dsa-muted' }, t('setAutoExpandOnDoneHint')),
         h('label', { className: 'dsa-check' },
           h('input', {
             type: 'checkbox',
@@ -6240,7 +6400,8 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               : []
           } catch { return false }
           if (!Array.isArray(rows)) return false
-          const candidates = rows.filter(entry => entry?.kind === kind
+          const candidates = rows.filter(entry => (entry?.kind === kind
+            || entry?.kind === `dsh-better-sidebar:${kind}`)
             && typeof entry?.tabId === 'string' && entry.tabId !== '')
           // 会话已知时按会话匹配；会话未知（旧历史没有 sessionId）时只有
           // 全进程恰好一张该 kind 的 tab 才敢关，否则可能误关别的会话。
@@ -6276,15 +6437,19 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           const better = surfaces.better
           if (better === null || better === undefined) return
           if (better.service === null || typeof better.service?.closeTab !== 'function') return
-          // 单一 page 地址：只有最后 open 的那张卡拥有栏里的 tab；释放一张
-          // 不是当前所有者的历史条目，会把现在真正在栏里的卡片连带关掉。
-          // 无主（null）时也放行：理由见 better.close。
-          if (better.cardId !== null && better.cardId !== id) return
+          // 单一 page 地址（每个会话一个）：只有本会话里最后 open 的那张卡
+          // 拥有栏里的 tab；释放一张不是本会话所有者的历史条目，会把现在
+          // 真正在栏里的卡片连带关掉。本会话无主时也放行（理由见 better.close）。
+          const knownSession = typeof sessionId === 'string' && sessionId !== ''
+          const holderId = better.owners.get(ownerKeyOf(sessionId))
+          if (holderId !== undefined && holderId !== id) return
+          if (holderId === undefined && !knownSession && better.cardId !== null && better.cardId !== id) return
           const scope = typeof sessionId === 'string' && sessionId !== '' ? { sessionId } : undefined
           const mountedId = embeddedTabIds.get(id)
           if (typeof mountedId === 'string' && mountedId !== '') {
             try { better.service.closeTab(mountedId, scope) } catch { /* the host may already be gone */ }
             better.cardId = null
+            if (better.owners.get(ownerKeyOf(sessionId)) === id) better.owners.delete(ownerKeyOf(sessionId))
             return
           }
           if (closeRailRow(CARD_KIND_BETTER, sessionId)) {
@@ -6310,8 +6475,9 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           const native = surfaces.native
           if (native === null || native === undefined) return
           if (native.controller === null || native.controller === undefined) return
-          // 无主（null）时也放行：理由见 native.close。
-          if (native.cardId !== null && native.cardId !== id) return
+          // 本会话无主时也放行：理由见 native.close。
+          const holderId = native.owners.get(ownerKeyOf(sessionId))
+          if (holderId !== undefined && holderId !== id) return
           try {
             native.close({ id, sessionId })
           } catch { /* the rail owns its tab's lifetime */ }
@@ -6349,6 +6515,41 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
         }
 
         const actions = {
+          /**
+           * Close the rail page that is rendering `props`, by its host tab id
+           * when the host gave one, else by kind + session through the rail
+           * inventory. Used by the orphan page's own close button.
+           * @param {object} props - the body props the host handed `CardHost`.
+           * @returns {boolean} whether a close was issued.
+           */
+          closeRailTab(props) {
+            const tabId = typeof props?.tab?.id === 'string' && props.tab.id !== '' ? props.tab.id : null
+            const scopeId = typeof props?.scope?.sessionId === 'string' && props.scope.sessionId !== ''
+              ? props.scope.sessionId
+              : (props?.tab?.sessionId ?? null)
+            const controller = surfaces.native === null ? null : surfaces.native.controller
+            try {
+              if (tabId !== null && controller !== null && controller !== undefined) {
+                if (typeof controller.closeIn === 'function' && typeof scopeId === 'string') {
+                  controller.closeIn(scopeId, tabId)
+                  return true
+                }
+                if (typeof controller.close === 'function') {
+                  controller.close(tabId)
+                  return true
+                }
+              }
+            } catch { /* the rail owns its tab's lifetime */ }
+            if (typeof scopeId === 'string' && closeRailRow(CARD_KIND, scopeId)) return true
+            const better = surfaces.better
+            try {
+              if (tabId !== null && better?.service && typeof better.service.closeTab === 'function') {
+                better.service.closeTab(tabId, typeof scopeId === 'string' ? { sessionId: scopeId } : undefined)
+                return true
+              }
+            } catch { /* host may be gone */ }
+            return false
+          },
           openPopover(candidate) {
             // P2-2: the composer must be remembered BEFORE the popover's
             // textarea takes focus, otherwise "insert into composer" has no
@@ -6503,7 +6704,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             const config = store.state.config
             const cut = truncateSelection(candidate.text, config.maxChars)
             const card = {
-              id: `card-${Date.now()}-${nextCardId++}`,
+              id: `card-${Date.now().toString(36)}-${nextCardId++}-${Math.random().toString(36).slice(2, 8)}`,
               question: payload.question,
               selection: candidate.text,
               selected: cut.text,
@@ -6589,6 +6790,15 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
                 // what the "moved to the flow stack" body below covers.
                 const proof = setTimeout(() => {
                   pendingProofs.delete(card.id)
+                  // A card whose session is not the one on screen is queued by
+                  // the host, not refused: the rail only mounts on-screen tabs.
+                  // Judging it "unproven" here moved a perfectly live card to
+                  // the flow stack and closed the tab it had just opened.
+                  const ownSession = typeof card.sessionId === 'string' && card.sessionId !== ''
+                    ? card.sessionId
+                    : null
+                  if (ownSession !== null && store.state.sessionId !== null
+                    && ownSession !== store.state.sessionId) return
                   const live = store.state.cards.find(item => item.id === card.id)
                   if (live === undefined || live.surface === 'flow') return
                   if (renderedCardId === card.id) return
@@ -6874,7 +7084,11 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             // and managed explicitly in the settings-page history manager.
           },
           async saveConfig(patch) {
-            const value = await postJson('config', patch)
+            // 宿主要求 inherit 显式确认（防误触/静默提权）；用户点"保存"本身
+            // 就是那个确认动作，恶意同源脚本仍可伪造 —— 它不是安全边界，
+            // 只让这种变更必须是有意的。
+            const body = patch?.sideTools === 'inherit' ? { ...patch, confirmInheritTools: true } : patch
+            const value = await postJson('config', body)
             store.set({
               config: { ...CLIENT_DEFAULTS, ...(value.config ?? {}) },
               problems: value.problems ?? [],
@@ -7046,6 +7260,8 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               })
               controllers.delete(cardId)
               syncPersisted()
+              // 2.1.9：答完就让答案出现在卡片里（胶囊态不再只显示一行状态）。
+              revealFinishedCard(cardId)
               // #5: background finish notification (guarded inside).
               const finished = store.state.cards.find(item => item.id === cardId)
               if (finished !== undefined) notifyCardFinish(finished)
@@ -7055,6 +7271,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               flushStreamBuffers()
               patchCard(cardId, { status: 'error', error, elapsedMs: Date.now() - startedAt })
               controllers.delete(cardId)
+              revealFinishedCard(cardId)
               const failed = store.state.cards.find(item => item.id === cardId)
               if (failed !== undefined) notifyCardFinish(failed)
             },
@@ -7536,6 +7753,12 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
                 title: () => t('answerTitle'),
                 description: () => t('settingsDesc'),
                 order: 120,
+                // 0.28.x: a registered type is added to the + menu automatically,
+                // and a guide entry opened with no card behind it renders this
+                // plugin's "card closed" page — two dead entries per session
+                // (native guide + this mirror). `hidden` keeps the type usable
+                // through `openTab` while dropping it from the menu.
+                hidden: true,
                 dedupeKey: tab => (tab?.meta?.cardId !== undefined ? String(tab.meta.cardId) : undefined),
                 component: props => h(CardHost, {
                   props: { tab: props?.tab, sessionId: props?.scope?.sessionId },
@@ -7587,7 +7810,16 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
         function CardHost({ props, surface }) {
           const state = useStoreState()
           const cardId = hostCardIdOf(props)
-          const card = state.cards.find(item => item.id === cardId)
+          // A tab's `meta.cardId` is just a string the host persisted; it must
+          // not route this body to a card that lives in ANOTHER session.
+          const scopeId = typeof props?.scope?.sessionId === 'string' && props.scope.sessionId !== ''
+            ? props.scope.sessionId
+            : null
+          const card = state.cards.find(item => item.id === cardId
+            && (scopeId === null
+              || typeof item.sessionId !== 'string'
+              || item.sessionId === ''
+              || item.sessionId === scopeId))
           // The embedder's REAL tab id (better-sidebar 0.28.x mints it and
           // ignores the seed id we passed), recorded for close/delete.
           const hostTabId = typeof props?.tab?.id === 'string' && props.tab.id !== '' ? props.tab.id : null
@@ -7596,7 +7828,11 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           React.useEffect(() => {
             if (typeof cardId !== 'string' || cardId === '') return undefined
             renderedCardId = cardId
-            if (hostTabId !== null) embeddedTabIds.set(cardId, hostTabId)
+            everMountedCards.add(cardId)
+            if (hostTabId !== null) {
+              embeddedTabIds.set(cardId, hostTabId)
+              lastMountedHostTabId = hostTabId
+            }
             // Mounting settles the render proof, even when this host mounted
             // late (a lazy tab panel slower than the 600ms timer) — the proof
             // must never fire after the card is demonstrably on screen.
@@ -7605,6 +7841,13 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               clearTimeout(proof)
               pendingProofs.delete(cardId)
             }
+            // A body whose card is gone, for a tab THIS page mounted before:
+            // release it now. A tab restored by another window was never
+            // mounted here (`everMountedCards`), so it keeps its close button
+            // instead of being stolen from that window.
+            if (card === undefined && everMountedCards.has(cardId)) {
+              try { actions.closeRailTab(props) } catch { /* host may be gone */ }
+            }
             return () => {
               if (renderedCardId === cardId) renderedCardId = null
               if (hostTabId !== null && embeddedTabIds.get(cardId) === hostTabId) {
@@ -7612,10 +7855,26 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               }
             }
           }, [cardId, hostTabId])
+          // No live card claims this body: a tab the host restored from its
+          // persisted layout, or a card deleted before its body mounted. Give
+          // the page an exit — the old build rendered one grey line and left
+          // the user with no way to close it (A1 was fixed for the native
+          // sweep, never for this face).
           if (card === undefined) {
-            return h('div', { className: 'dsa-settings', 'data-dsa-root': '', 'data-dsa-rail-host': '' },
+            return h('div', {
+              className: 'dsa-settings',
+              'data-dsa-root': '',
+              'data-dsa-rail-host': '',
+              'data-dsa-card-id': typeof cardId === 'string' ? cardId : '',
+            },
               h(Styles, null),
-              h('div', { className: 'dsa-muted' }, t('cardClosed')))
+              h('div', { className: 'dsa-muted' }, t('cardClosed')),
+              h('button', {
+                type: 'button',
+                className: 'dsa-btn',
+                'data-dsa-action': 'close-orphan-tab',
+                onClick: () => { try { actions.closeRailTab(props) } catch { /* host may be gone */ } },
+              }, t('closeThisTab')))
           }
           if (card.surface === 'flow') {
             // The proof already moved this card to the flow stack and this
@@ -7624,11 +7883,22 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             // note for a rail that keeps it.
             try { surfaces.native.close(card) } catch { /* the rail owns its lifecycle */ }
             try { surfaces.better.close(card) } catch { /* the host may already be gone */ }
-            return h('div', { className: 'dsa-settings', 'data-dsa-root': '', 'data-dsa-rail-host': '' },
+            return h('div', {
+              className: 'dsa-settings',
+              'data-dsa-root': '',
+              'data-dsa-rail-host': '',
+              'data-dsa-card-id': typeof cardId === 'string' ? cardId : '',
+            },
               h(Styles, null),
               h('div', { className: 'dsa-muted' }, t('cardMovedToFlow')))
           }
-          return h('div', { className: 'dsa-settings', 'data-dsa-root': '', 'data-dsa-rail-host': '', style: { padding: '10px' } },
+          return h('div', {
+            className: 'dsa-settings',
+            'data-dsa-root': '',
+            'data-dsa-rail-host': '',
+            'data-dsa-card-id': typeof cardId === 'string' ? cardId : '',
+            style: { padding: '10px' },
+          },
             h(Styles, null),
             h(MemoAnswerCard, {
               card,

package/index.js

@@ -45,7 +45,7 @@ export const name = 'dsh-sidecard-ask'
 export const inject = ['webServer']
 
 /** Version of this plugin (kept in step with package.json by test/verify.mjs). */
-export const PLUGIN_VERSION = '2.1.8'
+export const PLUGIN_VERSION = '2.1.9'
 
 /** Route prefix of the plugin's own API. */
 export const ROUTE_PREFIX = '/sidecard-ask/api'
@@ -127,6 +127,9 @@ export const DEFAULT_CONFIG = {
    * floating layer is used either way.
    */
   dockRail: true,
+  // 2.1.9: expand the floating layer when an answer settles, so the answer is
+  // visible in the side card instead of hiding behind the capsule pill.
+  autoExpandOnDone: true,
   /**
    * One-click quick actions rendered beside the selection trigger.
    *
@@ -534,7 +537,7 @@ export function sanitizeLayer(raw, problems = []) {
     if (value !== null && (value === '' || looksLikeEmail(value))) out.feedbackSmtpFrom = value
     else problems.push('feedbackSmtpFrom: 必须是合法邮箱或空字符串，已忽略')
   }
-  for (const boolKey of ['showInUnclassified', 'notifyOnDone', 'contextMenu', 'followUpSuggestions', 'dockRail']) {
+  for (const boolKey of ['showInUnclassified', 'notifyOnDone', 'contextMenu', 'followUpSuggestions', 'dockRail', 'autoExpandOnDone']) {
     if (raw[boolKey] === undefined) continue
     if (typeof raw[boolKey] === 'boolean') out[boolKey] = raw[boolKey]
     else problems.push(`${boolKey}: 必须是布尔值，已忽略`)
@@ -1346,7 +1349,12 @@ export function readOnlyToolFilter(ctx) {
   if (!Array.isArray(known)) return undefined
   const names = new Set(known.map(schema => schema?.name).filter(name => typeof name === 'string'))
   const allow = READONLY_TOOL_NAMES.filter(name => names.has(name))
-  return allow.length === 0 ? undefined : { allow }
+  // A registry that answered but names NONE of our read-only tools cannot
+  // honour the guard. Returning `undefined` here made the child inherit every
+  // parent tool (fail-open) while the card only said "unsupported" — the guard
+  // disappeared exactly when a host upgrade renamed things.
+  if (allow.length === 0) return { blocked: 'no-readonly-guard' }
+  return { allow }
 }
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -1762,6 +1770,7 @@ function createSideEngine(ctx, configOf) {
     ]
     const seen = new Set()
     let fallback
+    let live
     for (const agent of listed) {
       const id = agentSessionId(agent)
       if (id === undefined || seen.has(id)) continue
@@ -1769,11 +1778,16 @@ function createSideEngine(ctx, configOf) {
       const isArchived = archived.has(id)
       candidates.push({ id, archived: isArchived })
       if (fallback === undefined) fallback = { agent, id, archived: isArchived }
-      if (!isArchived) return { agent, id, archived: false, candidates }
-    }
-    return fallback === undefined
+      if (live === undefined && !isArchived) live = { agent, id, archived: false }
+    }
+    // A caller that NAMED a session which is not live is answered by another
+    // one (the host's historical fallback — older clients depend on it), but the
+    // start frame now says WHICH session answered so the card can show it
+    // instead of silently publishing into an unfamiliar conversation.
+    const chosen = live ?? fallback
+    return chosen === undefined
       ? { agent: undefined, id: undefined, archived: false, candidates }
-      : { ...fallback, candidates }
+      : { ...chosen, candidates }
   }
 
   /**
@@ -1967,6 +1981,20 @@ function createSideEngine(ctx, configOf) {
       const preset = typeof config.sideAgentPreset === 'string' ? config.sideAgentPreset.trim() : ''
       const presetSupported = caps?.agentPreset === true
       const presetInForce = config.sideTools === 'readonly' && preset !== '' && presetSupported
+      // 2.1.9: the read-only guard must fail CLOSED. Without a preset there is
+      // no other real narrowing channel on this host, so a guard we cannot
+      // build is a refusal, not an inheritance.
+      if (config.sideTools === 'readonly' && !presetInForce
+        && toolFilter !== undefined && toolFilter.blocked === 'no-readonly-guard') {
+        sink.send('error', {
+          id,
+          code: 'no-readonly-guard',
+          message: '这台宿主的工具注册表里认不出任何只读工具，无法保证侧边作答只读，已拒绝本次作答',
+          retryable: false,
+          fallback: 'main',
+        })
+        return
+      }
       // Style and the user's own extra instruction ride the SAME persona
       // string, so the "persona vs prompt" gate above covers all three of
       // them with one branch — there is no second injection point.
@@ -1979,7 +2007,7 @@ function createSideEngine(ctx, configOf) {
         signal: controller.signal,
         ...(personaSupported ? { persona: personaText } : {}),
         ...(presetInForce ? { agentPreset: preset } : {}),
-        ...(toolFilter === undefined || !toolFilterSupported ? {} : { toolFilter }),
+        ...(toolFilter === undefined || toolFilter.allow === undefined || !toolFilterSupported ? {} : { toolFilter }),
       })
       runRecord.dispose = run.dispose
 
@@ -2005,12 +2033,20 @@ function createSideEngine(ctx, configOf) {
           ? 'inherit'
           : (presetInForce
             ? 'preset'
-            : (toolFilter === undefined
-              ? 'unsupported'
-              : (toolFilterSupported ? 'applied' : 'unsupported'))),
+            : (toolFilter !== undefined && toolFilter.blocked !== undefined
+              ? 'blocked'
+              : (toolFilter === undefined
+                ? 'unsupported'
+                : (toolFilterSupported ? 'applied' : 'unsupported')))),
         agentPreset: presetInForce ? preset : null,
         persona: personaSupported ? 'section' : 'prompt',
         parentArchived: parent.archived === true,
+        // The session that actually owns this child. A mismatch with the
+        // requested session is shown on the card, never silently absorbed.
+        parentSessionId: parent.id ?? null,
+        requestedSessionId: typeof request.sessionId === 'string' && request.sessionId !== ''
+          ? request.sessionId
+          : null,
       })
 
       const childId = run.id
@@ -2698,6 +2734,25 @@ export function apply(ctx, patchConfig) {
       writeError(res, 400, 'invalid-config', problems.join('；'))
       return
     }
+    // 2.1.9: changing WHERE mail is sent (host/port/tls/user) invalidates the
+    // stored authorization code. Keeping it made "host:" a one-field takeover:
+    // point the host at an attacker and the next /feedback hands them the
+    // password in cleartext AUTH PLAIN. Losing the password is recoverable;
+    // leaking it is not.
+    const endpointChanged = ['feedbackSmtpHost', 'feedbackSmtpPort', 'feedbackSmtpSecure', 'feedbackSmtpUser']
+      .some(key => accepted[key] !== undefined && String(accepted[key]) !== String(state.config[key] ?? ''))
+    if (endpointChanged && accepted.feedbackSmtpPass === undefined) {
+      delete userLayer.feedbackSmtpPass
+      problems.push('SMTP 目标已变更，已保存的授权码随之作废，请重新填写')
+    }
+    // The side answerer inheriting the whole tool set is the one irreversible
+    // kind of change here (a page-level script can ask the host to run with the
+    // session's tools). A written confirmation does not stop same-origin code,
+    // but it stops the accident and makes the intent auditable.
+    if (accepted.sideTools === 'inherit' && body.confirmInheritTools !== true) {
+      writeError(res, 400, 'privileged-key', 'sideTools=inherit 需要显式确认（confirmInheritTools: true）')
+      return
+    }
     userLayer = { ...userLayer, ...accepted }
     const saved = writePersistedConfig(userLayer, ctx.logger)
     if (!saved.ok) {

package/locale/en.json

@@ -41,5 +41,7 @@
   "versionViewing": "Viewing an older version (read-only)",
   "suggestionsLabel": "Suggested follow-ups",
   "setFollowUps": "Suggest follow-ups at the end",
-  "setFollowUpsHint": "The model ends each answer with a <followups> block of 2–3 next questions, rendered as clickable chips (no extra request)"
+  "setFollowUpsHint": "The model ends each answer with a <followups> block of 2–3 next questions, rendered as clickable chips (no extra request)",
+  "setAutoExpandOnDone": "Expand the card when the answer finishes",
+  "setAutoExpandOnDoneHint": "On: the answer appears in the card the moment it settles. Off: the one-line capsule stays until you click it"
 }

package/locale/zh.json

@@ -41,5 +41,7 @@
   "versionViewing": "正在查看历史版本（只读）",
   "suggestionsLabel": "建议追问",
   "setFollowUps": "答案末尾给出建议追问",
-  "setFollowUpsHint": "开启后模型会用 <followups> 块在答案末尾给出 2–3 个可点的下一步问题，点一下即追问（不额外发请求）"
+  "setFollowUpsHint": "开启后模型会用 <followups> 块在答案末尾给出 2–3 个可点的下一步问题，点一下即追问（不额外发请求）",
+  "setAutoExpandOnDone": "答完自动展开卡片",
+  "setAutoExpandOnDoneHint": "开启后，回答一结束就展开成卡片显示正文；关闭后保持一行胶囊，点一下才展开"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-sidecard-ask",
-  "version": "2.1.8",
+  "version": "2.1.9",
   "description": "DSH 划词追问（侧边卡片作答）：在聊天区与任务区选中文本就地追问，答案由独立子代理在侧边卡片里流式呈现，也可选择落回主对话。",
   "type": "module",
   "main": "index.js",