flavor-code 1.3.0 → 1.3.3

package/README.md

@@ -204,7 +204,9 @@ npm run desktop:pack     # Windows portable directory
 npm run desktop:dist     # Windows NSIS installer
 ```
 
-The desktop app provides project and session switching, streaming Markdown, tool and diff views, permission confirmations, task status, and management of Skills, MCP, memory, and models.
+The desktop app keeps multiple projects open and can run up to four independent tasks concurrently inside one project; switching projects or tasks does not stop background work. Completion, failure, attention, and interruption events enter a persistent activity inbox and trigger native notifications, while unread completions retain a blue dot. Projects can be pinned, renamed, closed, revealed, or copied; tasks can be searched, renamed, pinned, and archived.
+
+Use `Ctrl+P` to switch projects, `Ctrl+K` for the command palette, and `Ctrl+N` for a new task; the title bar also supports back/forward navigation. Interrupted work gets a recovery banner after an abnormal exit. The **Git Changes** view provides per-file diffs, stage/unstage/discard, commits, and `/review` handoff. Streaming Markdown, permission confirmations, and Skills, MCP, memory, and model management remain available.
 
 The **E2E** module in the sidebar drives a rough requirement or an existing design export through the full delivery pipeline: it generates a PRD and an interactive prototype for review, then moves into D2C visual implementation (Vue 3 / React) under `src/d2c-output/<task>/`. A Vite dev server starts automatically for pixel-level comparison, producing a visual-fidelity score and a structured diff report (region offsets, color deviations, font differences); the results workbench offers overlay, curtain, flicker, and heatmap modes, an SVG annotation layer, and a severity-sorted issue list. After visual review, a Swagger/OpenAPI contract is generated or imported to auto-create Axios wrappers and an Express mock server, followed by autonomous interactive acceptance and scored delivery.
 
@@ -250,10 +252,10 @@ flavor mcp disable docs
 
 A Skill is a `SKILL.md` with YAML frontmatter, placed in `.flavor/skills/<name>/` or `~/.flavor-code/skills/<name>/`. Flavor loads skills progressively based on the task, and you can invoke one explicitly with `/<skill-name>`. Skill bodies support `$ARGUMENTS`, `$ARGUMENTS[N]`, and `$N` substitutions. A running composite Skill can load a dependency through the read-only `Skill` tool; plugin-qualified names such as `superharness:test-driven-development` resolve to discovered skills.
 
-Plugins live in `.flavor/plugins/` and can register commands, tools, hooks, Skill roots, and model adapters. `additionalContext` returned by `SessionStart` and `UserPromptSubmit` hooks is added to the current task context, enabling reliable project-level engineering policy injection. Production plugin activation is isolated in a Worker/vm realm by default and records a content fingerprint plus declared capabilities.
+Plugins live in `.flavor/plugins/` and can register commands, tools, hooks, Skill roots, and model adapters. `additionalContext` returned by `SessionStart` and `UserPromptSubmit` hooks is added to the current task context, enabling reliable project-level engineering policy injection. Plugin loads record a content fingerprint plus declared capabilities. Worker/vm isolation is available through the embedding API's `pluginSandbox: true` option; the compatibility default remains in-process because bundled and existing plugins use Node.js APIs that the isolated runtime does not yet mediate.
 
 > [!WARNING]
-> Sandboxing reduces ambient access but does not make untrusted instructions safe. Only install and enable plugins you trust; legacy `pluginSandbox: false` activation grants full in-process Node.js access.
+> The default in-process plugin runtime grants full Node.js access. Only install and enable plugins you trust. Sandboxing reduces ambient access but does not make untrusted instructions safe, and plugins that import Node.js built-ins will not load with `pluginSandbox: true` yet.
 
 ## Sessions, Memory & Execution Records
 

package/README.zh-CN.md

@@ -204,7 +204,9 @@ npm run desktop:pack     # Windows 免安装目录
 npm run desktop:dist     # Windows NSIS 安装包
 ```
 
-桌面端提供项目和会话切换、流式 Markdown、工具与 Diff 展示、权限确认、任务状态，以及 Skill、MCP、记忆和模型管理。
+桌面端可以同时保持多个项目打开，同一项目也可并行运行最多 4 个独立任务；切换项目或任务不会中止后台执行。运行中的任务显示动态活动标记；完成、失败、等待确认和异常中断会进入持久活动中心并触发系统通知，未读完成项保留蓝点。项目支持置顶、别名、关闭、定位和复制路径，任务支持搜索、重命名、置顶和归档。
+
+使用 `Ctrl+P` 快速切换项目、`Ctrl+K` 打开命令面板、`Ctrl+N` 新建任务，标题栏支持前进/后退。异常退出后会出现恢复条。**Git 变更**视图提供逐文件 Diff、暂存、取消暂存、还原、提交及 `/review` 联动。桌面端还提供流式 Markdown、权限确认、Skill、MCP、记忆和模型管理。
 
 侧栏的 **E2E** 模块覆盖从粗需求到可验收成果物的完整交付链路：从粗需求生成 PRD 与可交互原型（支持审阅与退回），确认后进入 D2C 视觉还原（Vue 3 / React），自动启动 Vite dev server 进行像素级对比，输出视觉还原度评分与结构化差异报告，并提供叠加、帘幕、闪烁与热力图等对比模式、SVG 标注层和按严重度排序的问题列表；视觉审阅通过后，自动生成或导入 Swagger/OpenAPI 契约以创建 Axios 封装与 Express mock 服务，随后进行自主交互验收，最终完成评分与成果物交付。
 
@@ -250,10 +252,10 @@ flavor mcp disable docs
 
 Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/` 或 `~/.flavor-code/skills/<name>/`。Flavor 会按任务渐进加载，也支持通过 `/<skill-name>` 显式调用。Skill 正文支持 `$ARGUMENTS`、`$ARGUMENTS[N]` 和 `$N` 参数占位符；运行中的组合 Skill 可以使用只读 `Skill` 工具继续加载依赖 Skill，插件限定名称（如 `superharness:test-driven-development`）会安全解析到已发现的 Skill。
 
-插件放在 `.flavor/plugins/`，可以注册命令、工具、Hook、Skill 根目录和模型适配器。`SessionStart` 与 `UserPromptSubmit` Hook 返回的 `additionalContext` 会进入当前任务上下文，可用于注入项目级工程规则。产品运行时默认在 Worker/vm 隔离环境激活插件，并记录内容指纹与声明的能力。
+插件放在 `.flavor/plugins/`，可以注册命令、工具、Hook、Skill 根目录和模型适配器。`SessionStart` 与 `UserPromptSubmit` Hook 返回的 `additionalContext` 会进入当前任务上下文，可用于注入项目级工程规则。插件加载会记录内容指纹与声明的能力。可通过嵌入 API 的 `pluginSandbox: true` 启用 Worker/vm 隔离；由于内置插件和已有插件依赖沙箱尚未代理的 Node.js API，当前兼容默认值仍为进程内运行。
 
 > [!WARNING]
-> 沙箱会降低环境权限，但不能让不可信指令自动变安全。只安装和启用可信插件；旧版兼容选项 `pluginSandbox: false` 会授予完整的进程内 Node.js 权限。
+> 默认的进程内插件运行时拥有完整 Node.js 权限，只安装和启用你信任的插件。沙箱会降低环境权限，但不能让不可信指令自动变安全；目前导入 Node.js 内置模块的插件在 `pluginSandbox: true` 下仍无法加载。
 
 ## 会话、记忆与执行记录
 

package/dist/{app-FOPTLLK5.js → app-NXOGWGSI.js}

@@ -16,7 +16,7 @@ import {
   redactErrorText,
   transcriptReducer,
   withTimeout
-} from "./chunk-KL4UHJ2Q.js";
+} from "./chunk-YY5H6GFN.js";
 import "./chunk-IG4Z23CL.js";
 import {
   Box_default,

package/dist/{chunk-IX65GYUF.js → chunk-JKJOQRAL.js}

@@ -4,7 +4,7 @@ import {
   message,
   redactErrorText,
   redactSecrets
-} from "./chunk-KL4UHJ2Q.js";
+} from "./chunk-YY5H6GFN.js";
 
 // src/rpc/server.ts
 import { createInterface } from "readline";

package/dist/{chunk-KL4UHJ2Q.js → chunk-YY5H6GFN.js}

@@ -561,7 +561,7 @@ function redactSecrets(input, secrets) {
 
 // src/init/project.ts
 import { lstat, mkdir, readdir, readFile, realpath, writeFile } from "fs/promises";
-import { copyFileSync, mkdirSync, readdirSync, readFileSync } from "fs";
+import { copyFileSync, mkdirSync, readdirSync } from "fs";
 import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath } from "url";
 var GENERATED_START = "<!-- flavor-code:start -->";
@@ -1014,22 +1014,6 @@ async function createExampleFlavorConfig(cwd) {
   };
   await writeFile(configPath, JSON.stringify(example, null, 2) + "\n");
 }
-var CODEISLAND_SRC_DIR = join(dirname2(fileURLToPath(import.meta.url)), "codeisland");
-var CODEISLAND_FILES = ["flavor-plugin.json", "activate.mjs", "bridge.mjs"];
-async function copyCodeIslandPlugin(cwd) {
-  const pluginDir = join(cwd, ".flavor", "plugins", "codeisland");
-  try {
-    await lstat(pluginDir);
-    return;
-  } catch (error) {
-    if (!isMissingPathError(error)) throw error;
-  }
-  await mkdir(pluginDir, { recursive: true, mode: 448 });
-  for (const name of CODEISLAND_FILES) {
-    const content = readFileSync(join(CODEISLAND_SRC_DIR, name), "utf8");
-    await writeFile(join(pluginDir, name), content);
-  }
-}
 var ASTGRAPH_SRC_DIR = join(dirname2(fileURLToPath(import.meta.url)), "astgraph");
 async function copyAstgraphPlugin(cwd) {
   const pluginDir = join(cwd, ".flavor", "plugins", "astgraph");
@@ -1052,7 +1036,6 @@ function copyDirectory(from, to) {
 }
 async function initializeFlavor(cwd) {
   await ensureFlavorDirectories(cwd);
-  await copyCodeIslandPlugin(cwd);
   await copyAstgraphPlugin(cwd);
   await createExampleFlavorConfig(cwd);
   const facts = await inspectProject(cwd);
@@ -1074,7 +1057,7 @@ async function initializeFlavor(cwd) {
 }
 
 // src/utils/version.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { dirname as dirname3, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var cached;
@@ -1083,7 +1066,7 @@ function packageVersion() {
   let directory = dirname3(fileURLToPath2(import.meta.url));
   for (; ; ) {
     try {
-      const manifest = JSON.parse(readFileSync2(join2(directory, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync(join2(directory, "package.json"), "utf8"));
       if (typeof manifest.version === "string" && manifest.version.length > 0) {
         cached = manifest.version;
         return cached;
@@ -4952,18 +4935,25 @@ function startupLockPath(address) {
 async function spawnProductionBroker(address) {
   const entry2 = process.argv[1];
   if (entry2 === void 0) throw new Error("Cannot auto-start pals broker without a CLI entry point");
+  return spawnPalBrokerProcess({ address, executable: process.execPath, args: [entry2, "--pals-broker", address] });
+}
+async function spawnPalBrokerProcess(options) {
+  if (options.executable.trim() === "" || options.args.length === 0) throw new Error("Pals broker process requires an executable and entry arguments");
+  const address = options.address;
   const lockPath = startupLockPath(address);
   const lock = await acquirePalFileLock({ path: lockPath, endpointLive: () => canConnect2(address) });
   if (lock === void 0) return;
   try {
-    const child = spawn3(process.execPath, [entry2, "--pals-broker", address], {
+    const child = spawn3(options.executable, [...options.args], {
       detached: true,
       stdio: "ignore",
-      windowsHide: true
+      windowsHide: true,
+      ...options.environment === void 0 ? {} : { env: options.environment }
     });
     child.unref();
     const deadline = Date.now() + 5e3;
     while (Date.now() < deadline && !await canConnect2(address)) await delay(25);
+    if (!await canConnect2(address)) throw new Error(`Pals broker process did not become ready at '${address}'`);
   } finally {
     await lock.release();
   }
@@ -7995,7 +7985,7 @@ function toModelTool(tool) {
 
 // src/harness/journal.ts
 import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
-import { closeSync, constants, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync, truncateSync, writeSync } from "fs";
+import { closeSync, constants, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, realpathSync as realpathSync2, statSync, truncateSync, writeSync } from "fs";
 import { join as join8, relative as relative7, resolve as resolve8, sep as sep7 } from "path";
 import { z as z10 } from "zod";
 
@@ -8213,7 +8203,7 @@ var HarnessJournal = class {
     const metadata = statSync(this.#path);
     if (!metadata.isFile()) throw new Error("Harness journal path is not a regular file");
     if (metadata.size > this.#maxBytes) throw new Error(`Harness journal exceeds ${this.#maxBytes} bytes`);
-    const raw = readFileSync3(this.#path, "utf8");
+    const raw = readFileSync2(this.#path, "utf8");
     const committed = raw.endsWith("\n") ? raw : raw.slice(0, Math.max(0, raw.lastIndexOf("\n") + 1));
     if (committed.length !== raw.length) truncateSync(this.#path, Buffer.byteLength(committed));
     const lines = committed.split("\n").filter(Boolean);
@@ -20213,6 +20203,51 @@ var INTERRUPTED_TASK_PLAN_CONTEXT = [
   "Reassess the current query independently.",
   "If the current work needs a plan, create a fresh one with TaskPlan before using TaskUpdate."
 ].join(" ");
+function recoverablePalClient(client, onRecovered) {
+  let presence;
+  let starting;
+  const ensure = () => {
+    if (presence !== void 0) return Promise.resolve(presence);
+    if (starting !== void 0) return starting;
+    starting = client.start().then((value) => {
+      presence = value;
+      onRecovered();
+      return value;
+    }).finally(() => {
+      starting = void 0;
+    });
+    return starting;
+  };
+  const invoke = async (run) => {
+    await ensure();
+    try {
+      return await run();
+    } catch (error) {
+      const detail = message(error);
+      if (!/not connected|connection closed|ECONNRESET|ECONNREFUSED|EPIPE/i.test(detail)) throw error;
+      presence = void 0;
+      await ensure();
+      return run();
+    }
+  };
+  return {
+    start: ensure,
+    list: () => invoke(() => client.list()),
+    rename: (alias) => invoke(() => client.rename(alias)),
+    sendTask: (target, value) => invoke(() => client.sendTask(target, value)),
+    sendChat: (target, value) => invoke(() => client.sendChat(target, value)),
+    startCoWork: (input) => invoke(() => client.startCoWork(input)),
+    coWorkAction: (action) => invoke(() => client.coWorkAction(action)),
+    coWorkStatus: (coWorkId) => invoke(() => client.coWorkStatus(coWorkId)),
+    integrateCoWork: (input) => invoke(() => client.integrateCoWork(input)),
+    cancelCoWork: (coWorkId, reason) => invoke(() => client.cancelCoWork(coWorkId, reason)),
+    subscribe: (listener) => client.subscribe(listener),
+    close: async () => {
+      presence = void 0;
+      await client.close();
+    }
+  };
+}
 var DEFAULT_SHUTDOWN_STEP_TIMEOUT_MS = 3e3;
 function createPromptEnvironment(input = {}) {
   const now = input.now ?? /* @__PURE__ */ new Date();
@@ -20472,7 +20507,10 @@ async function createProductionRuntime(options) {
     globalPluginDirs: [join24(home, ".flavor-code", "plugins")],
     projectPluginDirs: [join24(workspace, ".flavor", "plugins")],
     config,
-    sandbox: options.pluginSandbox ?? true,
+    // Existing project plugins (including astgraph and superharness) use Node.js
+    // built-ins. The Worker/vm sandbox deliberately blocks those imports, so it
+    // must stay opt-in until equivalent mediated capabilities are available.
+    sandbox: options.pluginSandbox ?? false,
     registrations: {
       command(name, handler, description) {
         if (typeof handler !== "function") throw new Error(`Plugin command "${name}" must be a function.`);
@@ -20533,6 +20571,7 @@ async function createProductionRuntime(options) {
   tools.push(evolveService.toolDefinition());
   let sleepScheduler;
   let collaborationClient;
+  let collaborationUnavailableDiagnostic;
   let unsubscribeCollaboration;
   let collaborationSession;
   let deliverCollaborationEvent;
@@ -20575,7 +20614,7 @@ async function createProductionRuntime(options) {
         userScope: home,
         runtimeDir: join24(tmpdir3(), `flavor-code-pals-${createHash17("sha256").update(home).digest("hex").slice(0, 16)}`)
       });
-      collaborationClient = collaboration.client ?? collaboration.createClient?.({
+      const baseCollaborationClient = collaboration.client ?? collaboration.createClient?.({
         instanceId: collaboration.instanceId,
         alias,
         projectPath: workspace
@@ -20583,8 +20622,13 @@ async function createProductionRuntime(options) {
         address,
         authHome: home,
         registration: { id: collaboration.instanceId, alias, projectPath: workspace },
-        startBroker: () => ensurePalBrokerRunning({ address })
+        startBroker: () => ensurePalBrokerRunning({ address, ...collaboration.startBroker === void 0 ? {} : { startBroker: () => collaboration.startBroker(address) } })
       });
+      collaborationClient = collaboration.optional ? recoverablePalClient(baseCollaborationClient, () => {
+        if (collaborationUnavailableDiagnostic === void 0) return;
+        remove(diagnostics, collaborationUnavailableDiagnostic);
+        collaborationUnavailableDiagnostic = void 0;
+      }) : baseCollaborationClient;
       deliverCollaborationEvent = async (event) => {
         const session2 = collaborationSession;
         const client = collaborationClient;
@@ -20639,11 +20683,19 @@ async function createProductionRuntime(options) {
         }
       };
       unsubscribeCollaboration = collaborationClient.subscribe(enqueueCollaborationEvent);
-      tools.push(...createPalsTools(collaborationClient, {
-        selfId: collaboration.instanceId,
-        shareGuard: new CollaborationShareGuard({ redact: (value) => redactSecrets(value, secrets) })
-      }));
-      await collaborationClient.start();
+      try {
+        await collaborationClient.start();
+      } catch (error) {
+        if (!collaboration.optional) throw error;
+        collaborationUnavailableDiagnostic = `Pals unavailable: ${message(error)}`;
+        diagnostics.push(collaborationUnavailableDiagnostic);
+      }
+      if (collaborationClient !== void 0) {
+        tools.push(...createPalsTools(collaborationClient, {
+          selfId: collaboration.instanceId,
+          shareGuard: new CollaborationShareGuard({ redact: (value) => redactSecrets(value, secrets) })
+        }));
+      }
     }
     const syncMcpTools = () => {
       for (const tool of mcpTools) remove(tools, tool);
@@ -21400,6 +21452,7 @@ async function createProductionRuntime(options) {
       }),
       rename: (alias) => collaborationClient.rename(alias),
       info: (target) => resolveCollaborationTarget(target),
+      sendChat: (target, message2) => collaborationClient.sendChat(target, message2),
       sendTask: (target, goal) => collaborationClient.sendTask(target, goal),
       startCoWork: async (target, goal) => {
         const recipient = await resolveCollaborationTarget(target);
@@ -21660,6 +21713,7 @@ ${summary2}`;
         return sessionHistory.checkpoint(tagged, harness.main.context.snapshot());
       },
       tree: () => sessionHistory.tree(),
+      historyLeaf: () => sessionHistory.leafId,
       rewind: async (nodeId) => {
         await sessionHistory.rewind(nodeId, harness.main.context.snapshot());
         await persist();
@@ -21848,7 +21902,7 @@ ${renderMemoryDocument(entries)}`;
       approvals,
       memoryReviews,
       restoredTranscript,
-      jobs: { list: () => jobs.list(), subscribe: (listener) => jobs.subscribe(listener) },
+      jobs: { list: () => jobs.list(), read: (id, owner2, cursor) => jobs.read(id, owner2, cursor), subscribe: (listener) => jobs.subscribe(listener) },
       get sessionId() {
         return sessionId;
       },
@@ -22691,6 +22745,7 @@ export {
   COMMAND_DESCRIPTIONS,
   AgentMessageQueue,
   FlavorSession,
+  classifyMemoryHeat,
   MemoryStore,
   buildDockerInvocation,
   DockerExecutionEnvironment,

package/dist/cli.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module"; const require = createRequire(impor
 import {
   FlavorRpcServer,
   TraceRecorder
-} from "./chunk-IX65GYUF.js";
+} from "./chunk-JKJOQRAL.js";
 import {
   staticTaskLines
 } from "./chunk-KKIBYDJI.js";
@@ -14,6 +14,7 @@ import {
   MemoryStore,
   PluginManifestSchema,
   SkillRegistry,
+  classifyMemoryHeat,
   createExecutionEnvironment,
   createProductionRuntime,
   executeShell,
@@ -22,7 +23,7 @@ import {
   packageVersion,
   redactErrorText,
   runPalBroker
-} from "./chunk-KL4UHJ2Q.js";
+} from "./chunk-YY5H6GFN.js";
 import {
   McpServerConfigSchema,
   McpServerNameSchema,
@@ -283,11 +284,22 @@ var ProjectMemoryManager = class {
     this.#store = store;
     this.#enabled = enabled;
   }
-  async snapshot() {
+  async snapshot(now = /* @__PURE__ */ new Date()) {
+    const references = this.#enabled ? await this.#store.references() : [];
     return {
       enabled: this.#enabled,
       path: this.#store.path,
-      entries: this.#enabled ? await this.#store.list() : []
+      entries: references.map((reference) => {
+        const lastRecalledAt = Object.values(reference.recalls).sort().at(-1);
+        return {
+          id: reference.id,
+          type: reference.type,
+          content: reference.summary,
+          recallTotal: reference.recallTotal,
+          heat: classifyMemoryHeat(reference, now),
+          ...lastRecalledAt === void 0 ? {} : { lastRecalledAt }
+        };
+      })
     };
   }
   async remember(candidate) {
@@ -304,6 +316,10 @@ var ProjectMemoryManager = class {
     this.#assertEnabled();
     return this.#store.delete(id);
   }
+  async deleteCold(now = /* @__PURE__ */ new Date()) {
+    this.#assertEnabled();
+    return this.#store.forgetCold(now);
+  }
   #assertEnabled() {
     if (!this.#enabled) throw new Error("Long-term memory is disabled for this project");
   }
@@ -861,7 +877,7 @@ async function runInteractiveCli(props) {
   const [{ render, AlternateScreen }, { createElement }, { App }] = await Promise.all([
     import("./claude-ink-ORUA7GWG.js"),
     import("react"),
-    import("./app-FOPTLLK5.js")
+    import("./app-NXOGWGSI.js")
   ]);
   const instance = await render(createElement(
     AlternateScreen,