dsh-tiddlywiki 0.27.2 → 0.28.0

package/src/client/wiki-scope-dock.ts

@@ -0,0 +1,116 @@
+/**
+ * Per-SESSION knowledge-base selector above the chat input box
+ * (需求: 会话栏上面可动态选择当前会话能用的 wiki).
+ *
+ * Registers into `conversation.input.dock` — the sanctioned "full-width entries
+ * above the composer" seat the quick-note button already uses. That slot is
+ * `kind: 'list', scope: 'session'`, so the component receives the `sessionId` it
+ * is mounted for, which is exactly what the host needs to answer "which wiki is
+ * THIS conversation working on".
+ *
+ * WHY THE SELECTION LIVES HOST-SIDE: it drives the agent's tool scope AND the
+ * injected prompt (see host/session-scope.ts), so it cannot be a browser-only
+ * preference. Picking here is all the user has to do.
+ *
+ * SINGLE-WIKI INSTALLS SEE NOTHING: the control renders only when MORE THAN ONE
+ * `agentVisible` wiki exists. Hidden wikis are deliberately absent from the
+ * list — offering one would contradict the setting the user just made (the host
+ * refuses it with a 400 as well).
+ *
+ * @module dsh-tiddlywiki/client/wiki-scope-dock
+ */
+import * as React from 'react'
+import { fetchStatus } from './status-cache.ts'
+import { SESSION_WIKI_ENDPOINT } from './endpoints.ts'
+
+interface WikiOption { id: string; label: string; running: boolean }
+
+/** Props the shell passes to a `conversation.input.dock` entry (scope: session). */
+interface DockProps { sessionId?: string }
+
+/**
+ * The dock entry. Returning `null` is a supported way to occupy the slot and
+ * show nothing — which is what a single-wiki install gets.
+ */
+export function createWikiScopeDock(): (props: DockProps) => React.ReactElement | null {
+  return function WikiScopeDock(props: DockProps) {
+    const sessionId = typeof props.sessionId === 'string' && props.sessionId.length > 0 ? props.sessionId : undefined
+    const [wikis, setWikis] = React.useState<WikiOption[]>([])
+    const [scope, setScope] = React.useState('')
+    const [note, setNote] = React.useState<string | undefined>(undefined)
+    const [busy, setBusy] = React.useState(false)
+
+    React.useEffect(() => {
+      if (sessionId === undefined) return
+      let alive = true
+      void (async () => {
+        const [status, current] = await Promise.all([
+          fetchStatus(),
+          fetch(`${SESSION_WIKI_ENDPOINT}?session=${encodeURIComponent(sessionId)}`, { signal: AbortSignal.timeout(8_000) })
+            .then((res) => (res.ok ? res.json() : null))
+            .catch(() => null),
+        ])
+        if (!alive) return
+        const visible = (status?.wikis ?? []).filter((wiki) => wiki.agentVisible)
+        setWikis(visible.map((wiki) => ({ id: wiki.id, label: wiki.label, running: wiki.running })))
+        setScope(typeof current?.scope === 'string' ? current.scope : '')
+        setNote(typeof current?.reason === 'string' ? current.reason : undefined)
+      })()
+      return () => { alive = false }
+    }, [sessionId])
+
+    if (sessionId === undefined || wikis.length <= 1) return null
+
+    const apply = (next: string): void => {
+      setBusy(true)
+      void (async () => {
+        try {
+          const res = await fetch(SESSION_WIKI_ENDPOINT, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            // A generous budget: selecting a wiki that is not running STARTS it
+            // host-side (the tools resolve the scope synchronously and never start
+            // anything themselves), and a cold child can take tens of seconds.
+            body: JSON.stringify({ session: sessionId, wiki: next.length > 0 ? next : null }),
+            signal: AbortSignal.timeout(120_000),
+          })
+          const payload = (await res.json().catch(() => ({}))) as { ok?: boolean; scope?: string; reason?: string; error?: string }
+          if (!res.ok || payload.ok !== true) {
+            setNote(payload.error ?? `切换失败（HTTP ${res.status}）`)
+            return
+          }
+          setScope(typeof payload.scope === 'string' ? payload.scope : next)
+          setNote(typeof payload.reason === 'string' ? payload.reason : undefined)
+        } catch (err) {
+          setNote(err instanceof Error ? err.message : String(err))
+        } finally {
+          setBusy(false)
+        }
+      })()
+    }
+
+    return React.createElement(
+      'div',
+      { className: 'dsh-tw-scope-dock' },
+      React.createElement('span', { className: 'dsh-tw-scope-label' }, '知识库'),
+      React.createElement(
+        'select',
+        {
+          className: 'dsh-tw-scope-select',
+          value: scope,
+          disabled: busy,
+          'aria-label': '本会话使用的知识库',
+          title: '本会话的 tiddlywiki_* 工具与注入提示词都作用于这个知识库（下一个模型步骤生效）',
+          onChange: (event: React.ChangeEvent<HTMLSelectElement>) => { apply(event.target.value) },
+        },
+        React.createElement('option', { value: '' }, '默认库'),
+        ...wikis.map((wiki) => React.createElement(
+          'option',
+          { key: wiki.id, value: wiki.id },
+          `${wiki.label}${wiki.running ? '' : '（未运行，选中会启动）'}`,
+        )),
+      ),
+      note !== undefined ? React.createElement('span', { className: 'dsh-tw-scope-note' }, note) : null,
+    )
+  }
+}

package/src/host/admin.ts

@@ -510,11 +510,19 @@ export async function ensureLanguage(wikiPath: string, twRoot: string, lang: str
 }
 
 export interface AdminDeps {
-  server: WikiServer
-  getClient: () => TiddlyWebClient | undefined
-  getWikiPath: () => string
+  /** The TW child serving the wiki this request targets (undefined = not up). */
+  server: (req: IncomingMessage) => WikiServer | undefined
+  getClient: (req: IncomingMessage) => TiddlyWebClient | undefined
+  getWikiPath: (req: IncomingMessage) => string
   twRoot: () => string
-  config: ConfigStore
+  /**
+   * The config overlay OF THE TARGETED WIKI (v0.28.0: per request).
+   *
+   * Every knowledge base keeps its own `$:/plugins/dsh-tiddlywiki/config`
+   * tiddler — that IS what "each wiki has independent settings" means in
+   * practice, so the settings-page routes must say WHICH wiki they configure.
+   */
+  config: (req: IncomingMessage) => ConfigStore
   /**
    * Called after a successful settings-page save (v0.21.0). The plugin rebuilds
    * its system-prompt section here, so a prompt.* edit applies to the running
@@ -527,7 +535,17 @@ export interface AdminDeps {
    * effective config; called with a draft (v0.22.7) → those unsaved values.
    * Read-only and side-effect free; absent in headless contexts.
    */
-  getPrompt?: (draft?: PromptPreviewConfig) => { enabled: boolean; mode: string; text: string }
+  /**
+   * The system-prompt text that WOULD be injected for a configuration, for the
+   * settings page preview (v0.21.0). Called with no draft → the SAVED effective
+   * config OF THE TARGETED WIKI; called with a draft (v0.22.7) → those unsaved
+   * values. Takes the request since v0.28.0: every knowledge base carries its
+   * own `prompt.*` in its own config tiddler, so "the saved config" is
+   * meaningless without saying WHICH wiki.
+   *
+   * Read-only and side-effect free; absent in headless contexts.
+   */
+  getPrompt?: (draft: PromptPreviewConfig | undefined, req: IncomingMessage) => { enabled: boolean; mode: string; text: string }
   /**
    * Runtime wiki location (v0.22.0): where the wiki folder is, how that was
    * decided, and the two operations the settings page can perform. Absent in
@@ -538,6 +556,17 @@ export interface AdminDeps {
     switch: (target: { root?: unknown; name?: unknown }) => Promise<WikiSwitchResult>
     reset: () => Promise<WikiSwitchResult>
   }
+  /**
+   * The knowledge-base LIST (v0.28.0): read it, and change it one action at a
+   * time. `info` reports the CONTROL FILE (what the user edits), which is not
+   * the same thing as what is running — in single mode the farm serves a
+   * one-entry registry synthesized from the legacy pointer, while the file may
+   * already list several candidates.
+   */
+  wikis?: {
+    info: () => Promise<AdminWikisView>
+    apply: (body: unknown) => Promise<AdminWikisApplyResult>
+  }
   /** Seed registry for the settings-page "初始化" section. */
   seeds: {
     /**
@@ -552,6 +581,50 @@ export interface AdminDeps {
   }
 }
 
+/** One knowledge base as the settings page lists it. */
+export interface AdminWikiItem {
+  id: string
+  label: string
+  root: string
+  name: string
+  /** Absolute folder (`root/name`); shown so the user can find it in a file manager. */
+  path: string
+  agentVisible: boolean
+  autostart: boolean
+  running: boolean
+  status: string
+}
+
+/** The control file's view (what the settings page edits). */
+export interface AdminWikisView {
+  mode: string
+  defaultId: string
+  /** Where the list came from: 'file' | 'legacy' (migrated pointer) | 'default'. */
+  source: string
+  /** Path of the control file (so a user can fix it by hand when told to). */
+  registryFile: string
+  /** Set when the control file exists but could not be fully trusted. */
+  error?: string
+  /** Non-fatal problems healed on the way (skipped entry, dangling default). */
+  warnings: string[]
+  wikis: AdminWikiItem[]
+}
+
+/** What one list change actually did (toast text + diagnostics). */
+export interface AdminWikisChange {
+  started: string[]
+  stopped: string[]
+  updated: string[]
+  running: string[]
+  /** Wikis that failed to start/stop; the change itself still stands. */
+  errors: Array<{ id: string; message: string }>
+}
+
+/** Result of a list change: either the new state, or why it was refused. */
+export type AdminWikisApplyResult =
+  | { ok: true; info: AdminWikisView; change: AdminWikisChange }
+  | { ok: false; error: string }
+
 /**
  * Sentinel returned instead of a stored secret (`bridge.token` /
  * `ui.sendToAgent.token`) by `GET /admin/state` and by `POST /admin/config`'s
@@ -663,7 +736,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
   const handleState = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     try {
       if (rejectNonRead(req, res)) return
-      const wikiPath = deps.getWikiPath()
+      const wikiPath = deps.getWikiPath(req)
       const [info, catalog] = await Promise.all([readWikiInfo(wikiPath), bundledCatalog(deps.twRoot())])
       let git: unknown = null
       try {
@@ -672,12 +745,12 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       } catch {
         git = null
       }
-      const view = deps.server.status()
+      const view = deps.server(req)?.status() ?? { status: 'stopped' as const, wikiPath, logs: [] }
       // Which theme the runtime actually shows (v0.22.3): the settings page used
       // to derive it from the LAST entry of info.themes, so a non-last active
       // theme displayed the wrong radio — and re-applying it (even without
       // touching the radios) rewrote `$:/theme` to that wrong pick.
-      const themeActive = await readActiveThemeName(deps.getClient())
+      const themeActive = await readActiveThemeName(deps.getClient(req))
       // Runtime plugin truth (v0.26.0): wiki-installed plugin tiddlers + the
       // disabled markers, so 插件管理 rows can be labelled honestly. `null`
       // (scan failed) is passed through — the client hides the section rather
@@ -690,11 +763,11 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
         info: { plugins: info.plugins, themes: info.themes, languages: info.languages ?? [], themeActive },
         catalog,
         runtimePlugins,
-        config: maskConfigSecrets(deps.config.get()),
+        config: maskConfigSecrets(deps.config(req).get()),
         // Why the overrides above are NOT in effect (v0.23.4): a stored config
         // that does not parse keeps being ignored silently otherwise, and the
         // page would show the (masked) defaults as if the user had chosen them.
-        configError: deps.config.parseError() ?? null,
+        configError: deps.config(req).parseError() ?? null,
         git,
       })
     } catch (err) {
@@ -706,7 +779,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
     try {
       if (rejectCrossSiteWrite(req, res, ['POST'])) return
       const body = JSON.parse(await readBody(req)) as { plugins?: unknown; themes?: unknown; themeActive?: unknown; languages?: unknown }
-      const wikiPath = deps.getWikiPath()
+      const wikiPath = deps.getWikiPath(req)
       // A read failure must NEVER be turned into "the wiki has no plugins":
       // saving would then rewrite the file without them. Fail with 500 and
       // leave the file untouched.
@@ -795,15 +868,15 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
         // This path predates the "restarting over unflushed writes loses them"
         // insight that the seed path below already documents (rule #1).
         await drainThenStop({
-          client: deps.getClient(),
-          tiddlersDir: join(deps.getWikiPath(), 'tiddlers'),
-          stop: () => deps.server.restart(),
+          client: deps.getClient(req),
+          tiddlersDir: join(deps.getWikiPath(req), 'tiddlers'),
+          stop: async () => { await deps.server(req)?.restart() },
           log: (message) => console.warn('[dsh-tiddlywiki]', message),
         })
       }
       // Activate the chosen theme tiddler (mirrors TW's own Control Panel).
       if (Array.isArray(body.themes) && activatedTheme !== undefined) {
-        const client = deps.getClient()
+        const client = deps.getClient(req)
         if (client !== undefined) {
           await client
             .put({ title: '$:/theme', text: `$:/themes/${activatedTheme}`, type: 'text/vnd.tiddlywiki', tags: [] })
@@ -814,7 +887,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       // enabled language, or en-GB when none is enabled. Only when the request
       // actually carried a languages array (plugins/themes restarts skip this).
       if (Array.isArray(body.languages)) {
-        const client = deps.getClient()
+        const client = deps.getClient(req)
         if (client !== undefined) {
           const langs = info.languages ?? []
           const active = langs.length > 0 ? `$:/languages/${langs[0]}` : '$:/languages/en-GB'
@@ -829,8 +902,8 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
           // the active language, so a later dsh-web restart doesn't re-enable
           // a language the user just disabled here.
           const hint = langs.length > 0 ? langs[0] : ''
-          if ((deps.config.get().uiLanguage ?? '') !== hint) {
-            await deps.config.set(client, { uiLanguage: hint }).catch(() => undefined)
+          if ((deps.config(req).get().uiLanguage ?? '') !== hint) {
+            await deps.config(req).set(client, { uiLanguage: hint }).catch(() => undefined)
           }
         }
       }
@@ -844,7 +917,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
     try {
       if (rejectCrossSiteWrite(req, res, ['POST'])) return
       const body = JSON.parse(await readBody(req)) as unknown
-      const client = deps.getClient()
+      const client = deps.getClient(req)
       if (client === undefined) {
         json(res, { ok: false, error: 'wiki service is not running' }, 503)
         return
@@ -856,11 +929,11 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       const patch = normalizeConfigPatch(body)
       // Never persist the masked placeholders the page read back from /state
       // (v0.19.3): saving an untouched form must not clobber a real token.
-      await deps.config.set(client, stripMaskedSecrets(patch as Record<string, unknown>, deps.config.get()) as PluginConfigShape)
+      await deps.config(req).set(client, stripMaskedSecrets(patch as Record<string, unknown>, deps.config(req).get()) as PluginConfigShape)
       // prompt.* may have changed: let the plugin re-register its prompt
       // section now (a no-op when the built text is unchanged).
       deps.onConfigChanged?.()
-      json(res, { ok: true, config: maskConfigSecrets(deps.config.get()) })
+      json(res, { ok: true, config: maskConfigSecrets(deps.config(req).get()) })
     } catch (err) {
       // A malformed patch is the caller's problem (400): the page can then show
       // exactly which field was wrong instead of a generic 500.
@@ -888,12 +961,12 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       // v0.24.1: drain the syncer queue first (ironclad rule #1) — this route
       // used to kill the child with writes still queued, losing them silently.
       const drained = await drainThenStop({
-        client: deps.getClient(),
-        tiddlersDir: join(deps.getWikiPath(), 'tiddlers'),
-        stop: () => deps.server.restart(),
+        client: deps.getClient(req),
+        tiddlersDir: join(deps.getWikiPath(req), 'tiddlers'),
+        stop: async () => { await deps.server(req)?.restart() },
         log: (message) => console.warn('[dsh-tiddlywiki]', message),
       })
-      json(res, { ok: true, status: deps.server.status().status, drained })
+      json(res, { ok: true, status: deps.server(req)?.status().status, drained })
     } catch (err) {
       json(res, { ok: false, error: err instanceof Error ? err.message : String(err) }, 500)
     }
@@ -907,7 +980,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
   const handleSeeds = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     try {
       if (rejectNonRead(req, res)) return
-      const client = deps.getClient()
+      const client = deps.getClient(req)
       if (client === undefined) {
         json(res, { ok: false, error: 'wiki service is not running' }, 503)
         return
@@ -930,7 +1003,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       const body = JSON.parse(await readBody(req)) as { id?: unknown; force?: unknown }
       const id = typeof body.id === 'string' && body.id.trim().length > 0 ? body.id.trim() : undefined
       const force = body.force === true
-      const client = deps.getClient()
+      const client = deps.getClient(req)
       if (client === undefined) {
         json(res, { ok: false, error: 'wiki service is not running' }, 503)
         return
@@ -948,7 +1021,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       let restartError: string | undefined
       if (needsRestartAfterSeeds(results)) {
         try {
-          const flushed = await waitForFileWrite(join(deps.getWikiPath(), 'tiddlers', RENDER_PLUGIN_FILE), 8_000, 150, seedStartedAt)
+          const flushed = await waitForFileWrite(join(deps.getWikiPath(req), 'tiddlers', RENDER_PLUGIN_FILE), 8_000, 150, seedStartedAt)
           if (!flushed) console.warn('[dsh-tiddlywiki] seeded render plugin file not seen on disk before restart')
           // Drain the rest of the syncer queue too: force-all writes every seed,
           // and a restart that boots from a stale snapshot silently loses the
@@ -956,8 +1029,8 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
           // v0.24.1: the drain+restart pair is now the shared primitive.
           const drained = await drainThenStop({
             client,
-            tiddlersDir: join(deps.getWikiPath(), 'tiddlers'),
-            stop: () => deps.server.restart(),
+            tiddlersDir: join(deps.getWikiPath(req), 'tiddlers'),
+            stop: async () => { await deps.server(req)?.restart() },
             log: (message) => console.warn('[dsh-tiddlywiki]', message),
           })
           if (!drained) console.warn('[dsh-tiddlywiki] seed writes may not have been flushed before restart')
@@ -985,7 +1058,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       if (rejectCrossSiteWrite(req, res, ['POST'])) return
       const body = JSON.parse(await readBody(req)) as { id?: unknown }
       const id = typeof body.id === 'string' && body.id.trim().length > 0 ? body.id.trim() : undefined
-      const client = deps.getClient()
+      const client = deps.getClient(req)
       if (client === undefined) {
         json(res, { ok: false, error: 'wiki service is not running' }, 503)
         return
@@ -1027,7 +1100,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
             return
           }
         }
-        const prompt = deps.getPrompt?.(normalizePromptPreview(body))
+        const prompt = deps.getPrompt?.(normalizePromptPreview(body), req)
         if (prompt === undefined) {
           json(res, { ok: false, error: 'prompt preview is not available' }, 503)
           return
@@ -1036,7 +1109,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
         return
       }
       if (rejectNonRead(req, res)) return
-      const prompt = deps.getPrompt?.()
+      const prompt = deps.getPrompt?.(undefined, req)
       if (prompt === undefined) {
         json(res, { ok: false, error: 'prompt preview is not available' }, 503)
         return
@@ -1081,7 +1154,7 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
       }
       const body = JSON.parse(await readBody(req)) as { root?: unknown; name?: unknown }
       const result = await deps.wiki.switch({ root: body.root, name: body.name })
-      json(res, result.ok ? { ...result, status: deps.server.status().status } : result, result.ok ? 200 : 400)
+      json(res, result.ok ? { ...result, status: deps.server(req)?.status().status } : result, result.ok ? 200 : 400)
     } catch (err) {
       json(res, { ok: false, error: err instanceof Error ? err.message : String(err) }, errorStatus(err))
     }
@@ -1099,16 +1172,83 @@ export function registerAdminRoutes(ctx: { webServer: WebServerFace }, deps: Adm
         return
       }
       const result = await deps.wiki.reset()
-      json(res, result.ok ? { ...result, status: deps.server.status().status } : result, result.ok ? 200 : 400)
+      json(res, result.ok ? { ...result, status: deps.server(req)?.status().status } : result, result.ok ? 200 : 400)
+    } catch (err) {
+      json(res, { ok: false, error: err instanceof Error ? err.message : String(err) }, errorStatus(err))
+    }
+  }
+
+  /**
+   * GET /dsh-tiddlywiki/admin/wikis — the knowledge-base LIST as the settings
+   * page edits it: the CONTROL FILE's contents (mode / list / default), which is
+   * NOT the same as what is running. Read-only + CSRF-hardened.
+   */
+  const handleWikis = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    try {
+      if (rejectNonRead(req, res)) return
+      if (deps.wikis === undefined) {
+        json(res, { ok: false, error: '知识库列表不可用' }, 503)
+        return
+      }
+      json(res, { ok: true, ...(await deps.wikis.info()) })
+    } catch (err) {
+      json(res, { ok: false, error: err instanceof Error ? err.message : String(err) }, 500)
+    }
+  }
+
+  /**
+   * POST /dsh-tiddlywiki/admin/wikis { action, … } — add / update / remove /
+   * set-default / set-mode. ONE action per request (see `applyWikiAction`): the
+   * page then cannot post an inconsistent list, and every mutation goes through
+   * the same validation the boot path uses.
+   *
+   * A REFUSED action is a 400 with the reason. A change whose new wiki fails to
+   * START is still 200: the list is saved and the failure is reported in
+   * `change.errors` — refusing the save would silently discard the user's edit
+   * for a problem they can fix by restarting the wiki.
+   */
+  const handleWikisApply = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    try {
+      if (deps.wikis === undefined) {
+        json(res, { ok: false, error: '知识库列表不可用' }, 503)
+        return
+      }
+      let body: unknown
+      try {
+        body = JSON.parse(await readBody(req))
+      } catch {
+        json(res, { ok: false, error: '请求体必须是 JSON' }, 400)
+        return
+      }
+      const result = await deps.wikis.apply(body)
+      if (!result.ok) {
+        json(res, { ok: false, error: result.error }, 400)
+        return
+      }
+      json(res, { ok: true, ...result.info, change: result.change })
     } catch (err) {
       json(res, { ok: false, error: err instanceof Error ? err.message : String(err) }, errorStatus(err))
     }
   }
 
+  /**
+   * `/admin/wikis` takes BOTH methods on ONE registration: the host webserver
+   * dispatches by pathname only, and registering the same exact path twice would
+   * throw `duplicate exact route`.
+   */
+  const handleWikisRoute = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    if ((req.method ?? 'GET').toUpperCase() === 'POST') {
+      if (rejectCrossSiteWrite(req, res, ['POST'])) return
+      return handleWikisApply(req, res)
+    }
+    return handleWikis(req, res)
+  }
+
   // Same rejection safety net as routes.ts (v0.19.3).
   const disposers = [
     ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/admin/state`, handler: guardHandler(handleState) }),
     ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/admin/prompt`, handler: guardHandler(handlePrompt) }),
+    ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/admin/wikis`, handler: guardHandler(handleWikisRoute) }),
     ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/admin/wiki/location`, handler: guardHandler(handleWikiLocation) }),
     ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/admin/wiki/switch`, handler: guardHandler(handleWikiSwitch) }),
     ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/admin/wiki/reset`, handler: guardHandler(handleWikiReset) }),

package/src/host/git.ts

@@ -28,7 +28,7 @@
  */
 import { execFile } from 'node:child_process'
 import { existsSync, readFileSync, statSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
 import { promisify } from 'node:util'
 
 const execFileP = promisify(execFile)
@@ -148,6 +148,42 @@ export class GitFace {
     return r.ok && r.stdout.trim() === 'true'
   }
 
+  /**
+   * The repository a folder belongs to (`git rev-parse --show-toplevel`), or
+   * undefined when it is not inside a work tree (v0.28.0).
+   *
+   * WHY THE PLUGIN NEEDS THIS: several knowledge bases may be SUBFOLDERS of one
+   * repository — the "工作 + 个人 共用现有仓库、按文件夹物理划分" topology. Git
+   * then has ONE index and `git add -A` (from any subdirectory) stages the WHOLE
+   * working tree, so the auto-committer must be keyed by the REPOSITORY rather
+   * than by the wiki; two per-folder committers would each commit the other's
+   * changes and one would forever report "nothing to commit" (see
+   * host/repo-committers.ts).
+   */
+  async repoRoot(dir: string): Promise<string | undefined> {
+    const r = await this.exec(['rev-parse', '--show-toplevel'], { cwd: dir, timeout: QUICK_TIMEOUT_MS })
+    if (!r.ok) return undefined
+    const root = r.stdout.trim()
+    // git prints forward slashes even on Windows; `resolve` normalises to the
+    // platform form so the value can be compared/passed on directly.
+    return root.length > 0 ? resolve(root) : undefined
+  }
+
+  /**
+   * Repository-relative paths that differ between two commits (v0.28.0).
+   *
+   * Used after a pull to decide WHICH knowledge bases need their TW child
+   * restarted: with one repository holding several wikis, "the pull changed
+   * something" is not the same question as "THIS wiki's content changed".
+   * Returns [] for an unusable range (no commits yet, unknown ref).
+   */
+  async filesChangedBetween(dir: string, from: string, to: string): Promise<string[]> {
+    if (from.length === 0 || to.length === 0 || from === to) return []
+    const r = await this.exec(['diff', '--name-only', from, to], { cwd: dir, timeout: QUICK_TIMEOUT_MS })
+    if (!r.ok) return []
+    return r.stdout.split('\n').map((line) => line.trim()).filter((line) => line.length > 0)
+  }
+
   async init(dir: string, branch = 'main'): Promise<boolean> {
     const r = await this.exec(['init', '-b', branch], { cwd: dir, timeout: HEAVY_TIMEOUT_MS })
     return r.ok
@@ -219,13 +255,15 @@ export class GitFace {
   /** `git pull --rebase --autostash`; on conflict: abort + report files.
    *  On success, `changed: true` means HEAD actually moved (files came in /
    *  commits were replayed) — callers use it to decide whether a running TW
-   *  child needs a restart to drop its stale in-memory snapshot.
+   *  child needs a restart to drop its stale in-memory snapshot, and
+   *  `changedFiles` (v0.28.0) says WHICH paths moved, so a caller serving
+   *  several wikis out of one repository can restart only the affected ones.
    *  Serialized against `commit()` (index.lock). */
-  pull(dir: string): Promise<GitActionResult & { changed?: boolean }> {
+  pull(dir: string): Promise<GitActionResult & { changed?: boolean; changedFiles?: string[] }> {
     return this.withLock(() => this.pullUnlocked(dir))
   }
 
-  private async pullUnlocked(dir: string): Promise<GitActionResult & { changed?: boolean }> {
+  private async pullUnlocked(dir: string): Promise<GitActionResult & { changed?: boolean; changedFiles?: string[] }> {
     const before = await this.exec(['rev-parse', 'HEAD'], { cwd: dir, timeout: QUICK_TIMEOUT_MS })
     const beforeHead = before.ok ? before.stdout.trim() : ''
     // Did a rebase already exist BEFORE we ran? (v0.23.5)
@@ -241,7 +279,14 @@ export class GitFace {
       const after = await this.exec(['rev-parse', 'HEAD'], { cwd: dir, timeout: QUICK_TIMEOUT_MS })
       const afterHead = after.ok ? after.stdout.trim() : ''
       const changed = beforeHead.length > 0 && beforeHead !== afterHead
-      return { ok: true, message: r.stdout.trim() || 'pull ok', ...(changed ? { changed: true } : {}) }
+      if (!changed) return { ok: true, message: r.stdout.trim() || 'pull ok' }
+      const changedFiles = await this.filesChangedBetween(dir, beforeHead, afterHead)
+      return {
+        ok: true,
+        message: r.stdout.trim() || 'pull ok',
+        changed: true,
+        ...(changedFiles.length > 0 ? { changedFiles } : {}),
+      }
     }
     const conflictFiles = await this.unmergedFiles(dir)
     // Only abort when WE left a rebase behind: either it did not exist before,

package/src/host/path-key.ts

@@ -0,0 +1,35 @@
+/**
+ * Path comparison keys (v0.28.0).
+ *
+ * WHY THIS IS ITS OWN MODULE: three places must agree on "is this the same
+ * folder?" — the wiki registry (duplicate/nested entries), the repo grouping
+ * (two wikis sharing one repository) and the farm's path-change detection. A
+ * second copy of this rule is exactly the drift this repository keeps paying
+ * for, so there is one function and everybody imports it.
+ *
+ * THE RULES
+ * ---------
+ *   - separators normalised to `/` (git prints forward slashes on Windows);
+ *   - trailing separators dropped (`D:/notes/` === `D:/notes`);
+ *   - **case-insensitive everywhere**, deliberately: on Windows and default
+ *     macOS two paths differing only in case ARE the same folder, and no honest
+ *     setup has two knowledge bases there.
+ *
+ * @module dsh-tiddlywiki/host/path-key
+ */
+
+/**
+ * The comparison key for a path. NOT a path: never hand it to the filesystem —
+ * on a case-sensitive filesystem a lowercased path may not exist.
+ */
+export function pathComparisonKey(path: string): string {
+  return path.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase()
+}
+
+/** True when `candidate` is strictly inside `parent` (both are absolute paths). */
+export function isInsidePath(parent: string, candidate: string): boolean {
+  const from = pathComparisonKey(parent)
+  const to = pathComparisonKey(candidate)
+  if (from.length === 0 || to.length === 0) return false
+  return to.startsWith(`${from}/`)
+}

package/src/host/prompt.ts

@@ -34,6 +34,30 @@
  * @module dsh-tiddlywiki/host/prompt
  */
 
+/**
+ * The scope banner prepended to the injected prompt when MORE THAN ONE knowledge
+ * base is visible to the agent (v0.28.0).
+ *
+ * Why a banner at all: with several wikis the model has no way to know which one
+ * its `tiddlywiki_*` calls act on, and the failure mode (writing a note into the
+ * wrong knowledge base) is silent. The banner names the scope, and every tool
+ * result repeats it. With a single visible wiki this returns `''`, so existing
+ * installs keep exactly the text they had.
+ */
+export function scopeBanner(scope: { id?: string; label?: string; reason?: string; ambiguous: boolean }): string {
+  if (!scope.ambiguous || scope.id === undefined) return ''
+  const why = scope.reason === undefined ? '' : `（${scope.reason}）`
+  return `> **本会话作用域：${scope.label ?? scope.id}（${scope.id}）**${why}\n`
+    + '> 本会话所有 `tiddlywiki_*` 工具都只作用于这个知识库，每条工具回执也会标明它。'
+}
+
+/** Built prompt text plus the optional scope banner (the section's final text). */
+export function withScopeBanner(text: string, scope: { id?: string; label?: string; reason?: string; ambiguous: boolean }): string {
+  if (text.length === 0) return ''
+  const banner = scopeBanner(scope)
+  return banner.length === 0 ? text : `${banner}\n\n${text}`
+}
+
 /** Prompt section name (stable id; a re-registration replaces the old one). */
 export const PROMPT_SECTION_NAME = 'dsh-tiddlywiki'