mingdao-harness 0.2.0 → 0.2.2

package/docs/QUALITY-REVIEW-0.1.68.md

@@ -87,8 +87,9 @@
 - L1/L2/L3/L6/L11/L12/L13 顺手修
 - 验收：94 组测试 + 38 组 bench 全绿、tsc 0 错误、三平台 CI 过
 
-### Phase 2 —「结构治理」v0.2.0（≈4–6 天）
-目标：拆巨石、补安全短板，为后续演进铺路。
+### Phase 2 —「结构治理」v0.2.0（≈4–6 天）✅ 已实施（2026-08-29）
+实施项：server.js 拆路由模块（src/web/routes/api.js，1299→579 行）、cli.js 命令分发显式化、SPA JS 外置 app.js + CSP 收紧、SSRF 目标校验、inflight 并发、会话写互斥、listen Promise + 桌面端口重试、sync-server 限流加固、API Key 即时生效、更新下载失败可见化。
+（cli.js 的 REPL/worker 进一步拆分与 routes/api.js 按域细分留待 0.2.1 渐进完成。）
 - H5 server.js 拆 `src/web/routes/*.js`（chat/sessions/config/sync/schedule/skills/workspace/fs-browse 等）+ 共享中间件
 - M13 cli.js 命令分发重构 + REPL/worker 拆分 + 重复逻辑抽取
 - M14 index.html JS 外置 `app.js` + CSP 收紧（去 unsafe-inline）+ 图标表/双拉取去重

package/docs/ROADMAP-NEXT.md

@@ -0,0 +1,53 @@
+# 下一步迭代规划（v0.2.2 → v0.3.0）
+
+基于四路审计剩余清单、六份评估综合路线与近期反馈收敛。原则不变：每期可独立发布、全绿测试门禁、零依赖不动摇。**待确认后开工。**
+
+## 待办盘点（当前真实剩余）
+
+- 审计遗留（QUALITY-REVIEW 清单中未做的 12 项中低危）：sync-server devices/meta 互斥、sync login 密码走参数、fs-browse 基目录约束、readBody 按路由分级、draft 单槽、日志双文件 O(n) 重写、桌面崩溃循环护栏、notify 转义、cli 共享助手去重（offpeak/mcpFacade/参数解析）、会话/任务 misc。
+- 结构渐进（0.2.1 标注的渐进项）：routes/api.js 按域细分、cli.js REPL/worker 拆分。
+- strict 棘轮：1584 条隐式 any 待消（每版定削减配额，先安全关键模块）。
+- 省钱路线剩余（EVALUATION-SYNTHESIS 中期 6 项）：工具 Schema 按需挂载、Batch 输入侧智能、费用二级分账+看板、护栏 downgrade、评测基准扩充（压缩质量集/路由标注集/V4 词表对拍）。
+- 能力演进：跨平台沙箱补位、记忆语义检索、增量上下文。
+- 工程：覆盖率阈值随版本上调、CHANGELOG 历史回填、GitHub Release 附件自动清理（需 PAT）。
+
+## 分期方案
+
+### Phase A「正确性收尾」v0.2.2（约 1–1.5 天）
+审计遗留全部落地，零新功能：
+1. sync-server devices/meta 读改写加锁（withFileLockSync 复用）
+2. `mingdao sync login` 密码改隐藏输入/stdin，拒绝位置参数
+3. `/api/fs-browse` 限定基目录集合（工作空间根+显式授权），禁止向上越界、不回传绝对路径
+4. readBody 按路由分级（chat 40MB，其余 1MB）
+5. draft 按会话维度存储（key=session 而非全局单槽）
+6. 日志统一工具函数（append+按天滚动+按行截断），桌面/服务端共用口径
+7. 桌面渲染进程崩溃计数护栏（超 3 次弹窗提示重启）
+8. notify 结构化 argv（去掉启发式转义）
+9. cli.js 共享助手抽取（offpeak defer、mcpFacade 构建、run/run-worker 参数解析合一）
+- 验收：全绿 + 新增 fs-browse 越界与限流回归断言。
+
+### Phase B「省钱第二轮」v0.2.3（约 2–3 天）
+1. **工具 Schema 按需挂载**（每请求省 1–2K tokens）：只读阶段只发 read/ls/glob/grep/skill + 本回合已用工具；写类工具首次调用时动态注入
+2. **Batch 输入侧**：文本哈希去重（结果按 custom_id 回填全部位置）、单问超窗口预检报错、`--max-cost` 上限
+3. **费用二级分账 + 看板**：cache-stats 增 reasoning/tool 维度与 byTool 累加；WebUI 仪表盘加模型/工具 Top5 与按天折线（零依赖 SVG）
+4. **护栏 downgrade**：`action:'downgrade'` —— 触顶后自动切 flash + 明确提示（默认仍 warn/block 可选）
+5. **评测基准扩充**：压缩质量集（5 组长会话样本→压缩→关键事实追问断言）、路由 100 条标注集入 bench
+- 验收：bench 断言数 38→60+；覆盖率阈值上调至 60%。
+
+### Phase C「结构渐进」v0.2.4（约 2 天）
+1. routes/api.js 按域细分（config/sessions/sync/schedule/skills/workspace/misc 7 模块 + 共享中间件），每域配 API 契约测试
+2. cli.js REPL → commands/repl.js、worker → tasks/worker.js（e2e-local 16 项全绿做护栏）
+3. strict 棘轮削 300 条（先 credentials/permissions/config/sync-server/session 五个安全关键模块全量注解）
+- 验收：tsc full 错误数 ≤1284；结构清单在文档登记。
+
+### Phase D「能力演进」v0.3.0（约 3–5 天，可按需裁剪）
+1. **跨平台沙箱补位**：Windows Job Object + 降权 token（零依赖原生 API）、macOS seatbelt 规则；敏感命令平台无关拦截清单兜底
+2. **记忆语义检索**：零依赖实现（内存向量 + 余弦/哈希相似度；Node 22 可用 node:sqlite 持久化，Node 18 回退 JSONL 索引），记忆注入从「最近 3 条」升级为「相关 3 条」
+3. **WebUI 看板扩展**：预算燃尽预测、费用导出 CSV
+4. GitHub Release 附件自动清理（如你提供 PAT）+ 发布清单文档化
+
+## 需要你拍板的三件事
+
+1. **Phase 顺序**：A→B→C→D 直接推进，还是把 B（省钱）提前到 A 之前？
+2. **GitHub PAT**：是否提供（用于 Release 附件自动清理与发版自动化）？
+3. **Phase D 裁剪**：跨平台沙箱与语义检索是否都进 0.3.0，还是只做其一？

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mingdao-harness",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "MingDao Harness —— 开源智能体框架（Agent Harness）。零依赖、开箱即用，针对 DeepSeek-V4 系列优化，开放主流模型接入。",
   "type": "module",
   "bin": {
@@ -48,13 +48,18 @@
   "license": "MIT",
   "scripts": {
     "start": "node src/cli.js",
-    "test": "node test/smoke.js",
+    "test": "node test/run-all.mjs",
     "typecheck": "tsc -p tsconfig.json",
     "prepublishOnly": "node test/smoke.js && node test/e2e-local.js && node test/e2e-schedule.js",
     "desktop": "npm --prefix desktop start",
     "desktop:dist": "node scripts/sync-versions.mjs && npm --prefix desktop run dist:dir",
     "desktop:sync": "node scripts/sync-versions.mjs",
-    "bench": "node test/bench/bench-tokenizer.mjs && node test/bench/bench-routing.mjs && node test/bench/bench-compaction.mjs"
+    "bench": "node test/bench/bench-tokenizer.mjs && node test/bench/bench-routing.mjs && node test/bench/bench-compaction.mjs",
+    "coverage": "node test/run-all.mjs --coverage && node scripts/coverage-report.mjs",
+    "typecheck:strict": "node scripts/strict-ratchet.mjs",
+    "preversion": "node test/smoke.js && node test/e2e-local.js && npm run bench",
+    "version": "node scripts/bump-changelog.mjs",
+    "postversion": "git add package.json package-lock.json CHANGELOG.md 2>/dev/null; git commit -m \"chore: release v$npm_package_version\" --no-verify || true"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",

package/src/atomic-write.js

@@ -11,7 +11,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 
-export function atomicWriteFileSync(target, data, options = {}) {
+export function atomicWriteFileSync(/** @type {string} */ target, /** @type {string|Buffer} */ data, /** @type {any} */ options = {}) {
   const dir = path.dirname(target);
   const tmp = path.join(dir, `.${path.basename(target)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
   try {
@@ -25,16 +25,16 @@ export function atomicWriteFileSync(target, data, options = {}) {
   }
 }
 
-export function atomicWriteJsonSync(target, value, { mode = 0o600 } = {}) {
+export function atomicWriteJsonSync(/** @type {string} */ target, /** @type {any} */ value, { mode = 0o600 } = {}) {
   atomicWriteFileSync(target, JSON.stringify(value, null, 2) + '\n', { mode });
 }
 
 // 极简互斥锁：O_EXCL 创建 lockfile；持锁期间执行 fn（同步）；异常/完成释放。
 // 进程崩溃遗留的陈旧锁（> staleMs 未更新）自动回收，避免永久卡死。
 const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
-const sleepMs = (ms) => Atomics.wait(sleepBuf, 0, 0, ms);
+const sleepMs = (/** @type {number} */ ms) => Atomics.wait(sleepBuf, 0, 0, ms);
 
-export function withFileLockSync(lockPath, fn, { timeoutMs = 5000, staleMs = 15000 } = {}) {
+export function withFileLockSync(/** @type {string} */ lockPath, /** @type {() => any} */ fn, { timeoutMs = 5000, staleMs = 15000 } = {}) {
   fs.mkdirSync(path.dirname(lockPath), { recursive: true });
   const t0 = Date.now();
   for (;;) {
@@ -53,7 +53,7 @@ export function withFileLockSync(lockPath, fn, { timeoutMs = 5000, staleMs = 150
         } catch {}
       }
     } catch (err) {
-      if (err.code !== 'EEXIST') throw err;
+      if (/** @type {any} */ (err).code !== 'EEXIST') throw err;
       try {
         const st = fs.statSync(lockPath);
         if (Date.now() - st.mtimeMs > staleMs) {

package/src/cli.js

@@ -296,45 +296,36 @@ async function main() {
     }
   }
 
-  // 后台任务 worker（内部入口，由 mingdao run 启动）
-  if (opts.prompt[0] === 'run-worker') {
-    const id = opts.prompt[1];
-    let question = '';
-    let permission = null;
-    let model = null;
-    let offpeak = false;
-    for (let i = 2; i < opts.prompt.length; i++) {
-      const a = opts.prompt[i];
-      if (a === '--permission') permission = opts.prompt[++i];
-      else if (a === '--model') model = opts.prompt[++i];
-      else if (a === '--offpeak') offpeak = true;
+  // 质检 A9：run/run-worker 共用同一参数解析（此前两份重复且语义微妙不同）
+  const parseRunArgs = (argv, { questionFlag = false } = {}) => {
+    const out = { question: '', permission: null, model: null, offpeak: false };
+    for (let i = 0; i < argv.length; i++) {
+      const a = argv[i];
+      if (a === '--permission') out.permission = argv[++i];
+      else if (a === '--model') out.model = argv[++i];
+      else if (a === '--offpeak') out.offpeak = true;
       else if (a === '--question') {
-        // 收集到下一个已知 flag 为止（参数顺序：--question <任务> --permission … --model …）
         const parts = [];
-        while (i + 1 < opts.prompt.length && !['--permission', '--model', '--offpeak'].includes(opts.prompt[i + 1])) {
-          parts.push(opts.prompt[++i]);
+        while (i + 1 < argv.length && !['--permission', '--model', '--offpeak'].includes(argv[i + 1])) {
+          parts.push(argv[++i]);
         }
-        question = parts.join(' ');
-      }
+        out.question = parts.join(' ');
+      } else if (!out.question) out.question = a;
     }
+    return out;
+  };
+
+  // 后台任务 worker（内部入口，由 mingdao run 启动）
+  if (opts.prompt[0] === 'run-worker') {
+    const id = opts.prompt[1];
+    const { question, permission, model, offpeak } = parseRunArgs(opts.prompt.slice(2));
     await runWorkerTask(id, question, { permission, model, offpeak });
     return;
   }
 
   // 后台任务启动：mingdao run "<任务>" [--permission auto] [--model x]
   if (opts.prompt[0] === 'run') {
-    const rest = opts.prompt.slice(1);
-    let question = '';
-    let permission = null;
-    let model = null;
-    let offpeak = false;
-    for (let i = 0; i < rest.length; i++) {
-      const a = rest[i];
-      if (a === '--permission') permission = rest[++i];
-      else if (a === '--model') model = rest[++i];
-      else if (a === '--offpeak') offpeak = true;
-      else if (question === '') question = a;
-    }
+    const { question, permission, model, offpeak } = parseRunArgs(opts.prompt.slice(1));
     if (!question) {
       console.log('用法：mingdao run "<任务>" [--permission auto|readonly] [--model 模型名] [--offpeak]');
       process.exitCode = 1;

package/src/commands/sync.js

@@ -35,21 +35,31 @@ export async function handleSync(cmd, args) {
   if (sub === 'login') {
     const username = args[1];
     if (!username) {
-      console.log('用法：mingdao sync login <用户名> [密码] [服务器地址]（地址默认取已配置项）');
+      console.log('用法：mingdao sync login <用户名> [服务器地址] [--insecure]（密码将隐藏输入，绝不走命令行参数）');
+      process.exitCode = 1;
+      return true;
+    }
+    // 质检 A2：密码绝不接受位置参数（明文出现在 ps/shell history）——隐藏输入或 stdin 单行
+    if (args[2] && !String(args[2]).startsWith('http')) {
+      console.log('[错误] 出于安全考虑，密码不再支持命令行参数——运行 mingdao sync login <用户名> <地址> 后按提示隐藏输入。');
       process.exitCode = 1;
       return true;
     }
     const s0 = syncStatus();
-    const url = args[3] || s0.url;
+    const url = args[2] && String(args[2]).startsWith('http') ? args[2] : s0.url;
     if (!url) {
-      console.log('缺少服务器地址：mingdao sync login <用户名> [密码] <http(s)://地址>');
+      console.log('缺少服务器地址：mingdao sync login <用户名> <http(s)://地址>');
+      process.exitCode = 1;
+      return true;
+    }
+    const insecureFlag = args.includes('--insecure');
+    let password = await askHidden('密码（至少 8 位）：');
+    if (!password) {
+      console.log('[错误] 未输入密码');
       process.exitCode = 1;
       return true;
     }
-    let password = args[2];
-    if (!password) password = await askHidden('密码（至少 8 位）：');
-    const insecureFlag = args[4] === '--insecure' || args[5] === '--insecure';
-    const r = await syncLogin({ url, username, password, deviceName: args[4] === '--insecure' ? undefined : args[4], insecure: insecureFlag });
+    const r = await syncLogin({ url, username, password, deviceName: undefined, insecure: insecureFlag });
     if (r.error) {
       console.log('[错误] ' + r.error);
       process.exitCode = 1;

package/src/log-writer.js

@@ -0,0 +1,27 @@
+// 统一日志写入器（质检 A6）：追加写 + 超限按行截断（原子替换，绝不截断在行中间）。
+// 桌面主进程（appLog）与 Web 服务端（srvlog）共用同一实现，消除双文件口径漂移与 O(n) 全量重写。
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+export function createLogWriter(/** @type {string} */ file, { maxBytes = 512 * 1024 } = {}) {
+  return (/** @type {string} */ msg) => {
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const line = new Date().toISOString() + ' ' + String(msg) + '\n';
+      fs.appendFileSync(file, line);
+      const st = fs.statSync(file);
+      if (st.size > maxBytes) {
+        const raw = fs.readFileSync(file, 'utf8');
+        const cut = raw.length - maxBytes;
+        const nl = raw.indexOf('\n', cut);
+        const keep = nl === -1 ? raw.slice(cut) : raw.slice(nl + 1); // 行对齐保留尾部
+        const tmp = file + '.' + process.pid + '.' + crypto.randomBytes(3).toString('hex') + '.tmp';
+        fs.writeFileSync(tmp, keep);
+        fs.renameSync(tmp, file);
+      }
+    } catch {
+      // 日志失败绝不抛错（best-effort）
+    }
+  };
+}

package/src/notify.js

@@ -16,15 +16,15 @@ export function notify(title, message) {
       child.on('error', () => {});
       child.unref();
     } else if (process.platform === 'darwin') {
-      const safe = text.replace(/[\\"]/g, '\\$&');
-      const safeT = t.replace(/[\\"]/g, '\\$&');
-      const child = spawn('osascript', ['-e', `display notification "${safe}" with title "${safeT}"`], { detached: true, stdio: 'ignore' });
+      // 质检 A8：osascript 逐参数传递（spawn 不经 shell，无需手工引号转义）
+      const child = spawn('osascript', ['-e', 'display notification ' + JSON.stringify(text) + ' with title ' + JSON.stringify(t)], { detached: true, stdio: 'ignore' });
       child.on('error', () => {});
       child.unref();
     } else if (process.platform === 'win32') {
-      const safe = text.replace(/'/g, "''");
-      const safeT = t.replace(/'/g, "''");
-      const child = spawn('powershell', ['-NoProfile', '-Command', `(New-Object -ComObject Wscript.Shell).Popup('${safe}', 10, '${safeT}', 64)`], { detached: true, stdio: 'ignore' });
+      // 质检 A8：PowerShell 用 -EncodedCommand（Base64 UTF-16LE）传递，彻底消除引号/元字符问题
+      const script = `(New-Object -ComObject Wscript.Shell).Popup(${JSON.stringify(text)}, 10, ${JSON.stringify(t)}, 64)`;
+      const enc = Buffer.from(script, 'utf16le').toString('base64');
+      const child = spawn('powershell', ['-NoProfile', '-NonInteractive', '-EncodedCommand', enc], { detached: true, stdio: 'ignore' });
       child.on('error', () => {});
       child.unref();
     }

package/src/sync-server.js

@@ -201,6 +201,21 @@ function findDeviceByToken(token) {
 }
 
 // ---------- 业务 ----------
+// 质检 A1：通用写互斥（注册/pair/lastSeen/meta 更新串行化），防 devices.json/meta.json 读改写竞态
+let writeLock = null;
+async function withWriteLock(fn) {
+  const prev = writeLock || Promise.resolve();
+  let release;
+  writeLock = new Promise((resolve) => {
+    release = resolve;
+  });
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
 let registerLock = null;
 async function doRegister(body) {
   const username = String(body.username || '').trim();
@@ -232,7 +247,7 @@ async function doRegister(body) {
   }
 }
 
-function doPair(body) {
+async function doPair(body) {
   const username = String(body.username || '').trim();
   const password = String(body.password || '');
   const deviceName = String(body.deviceName || '').trim().slice(0, 60) || '未命名设备';
@@ -240,15 +255,17 @@ function doPair(body) {
   const u = users[username];
   if (!u) return { notFound: '用户不存在（请先注册）' };
   if (!verifyPassword(password, u.salt, u.hash)) return { unauthorized: '密码错误' };
-  const deviceId = crypto.randomBytes(8).toString('hex');
-  const token = crypto.randomBytes(24).toString('hex');
-  const devices = readJson(devicesFile(), {});
-  devices[username] = devices[username] || {};
-  devices[username][deviceId] = { name: deviceName, tokenHash: sha(token), createdAt: Date.now(), lastSeen: Date.now() };
-  writeJson(devicesFile(), devices);
-  invalidateDeviceCache();
-  log('pair', username, deviceName, deviceId);
-  return { ok: true, username, deviceId, deviceName, token };
+  return withWriteLock(() => {
+    const deviceId = crypto.randomBytes(8).toString('hex');
+    const token = crypto.randomBytes(24).toString('hex');
+    const devices = readJson(devicesFile(), {});
+    devices[username] = devices[username] || {};
+    devices[username][deviceId] = { name: deviceName, tokenHash: sha(token), createdAt: Date.now(), lastSeen: Date.now() };
+    writeJson(devicesFile(), devices);
+    invalidateDeviceCache();
+    log('pair', username, deviceName, deviceId);
+    return { ok: true, username, deviceId, deviceName, token };
+  });
 }
 
 function doListSessions(username) {
@@ -280,10 +297,12 @@ function doPush(username, body) {
   const tmp = file + '.tmp';
   fs.writeFileSync(tmp, content, { mode: 0o600 });
   fs.renameSync(tmp, file);
-  const meta = readJson(metaFile(username), {});
-  meta[name] = { mtime: Date.now(), size: Buffer.byteLength(content) };
-  writeJson(metaFile(username), meta);
-  return { ok: true, name, mtime: meta[name].mtime, size: meta[name].size };
+  return withWriteLock(() => {
+    const meta = readJson(metaFile(username), {});
+    meta[name] = { mtime: Date.now(), size: Buffer.byteLength(content) };
+    writeJson(metaFile(username), meta);
+    return { ok: true, name, mtime: meta[name].mtime, size: meta[name].size };
+  });
 }
 
 function doPull(username, name) {
@@ -307,10 +326,12 @@ function doDelete(username, name) {
   } catch {
     return { notFound: '会话不存在' };
   }
-  const meta = readJson(metaFile(username), {});
-  delete meta[name];
-  writeJson(metaFile(username), meta);
-  return { ok: true, name };
+  return withWriteLock(() => {
+    const meta = readJson(metaFile(username), {});
+    delete meta[name];
+    writeJson(metaFile(username), meta);
+    return { ok: true, name };
+  });
 }
 
 // ---------- 密码修改 ----------
@@ -410,23 +431,25 @@ function doShareAccept(username, shareId) {
     fs.mkdirSync(sessionsDir(username), { recursive: true, mode: 0o700 });
     atomicWriteFileSync(target, content, { mode: 0o600 }); // 质检 H4
   }
-  const meta = readJson(metaFile(username), {});
-  meta[savedAs] = { mtime: Date.now(), size: Buffer.byteLength(content) };
-  writeJson(metaFile(username), meta);
-  accepted[username] = accepted[username] || {};
-  accepted[username][shareId] = { owner: s.owner, name: s.name, savedAs, acceptedAt: Date.now(), copyHash: sha(content) };
-  writeJson(acceptedFile(), accepted);
-  shares[shareId].pulls = (shares[shareId].pulls || 0) + 1;
-  writeJson(sharesFile(), shares);
-  log('share-accept', username, shareId, savedAs, conflict ? '(conflict-copy)' : '(refresh)');
-  return {
-    ok: true,
-    shareId,
-    savedAs,
-    conflict,
-    content,
-    mtime: meta[savedAs]?.mtime || Date.now(),
-  };
+  return withWriteLock(() => {
+    const meta = readJson(metaFile(username), {});
+    meta[savedAs] = { mtime: Date.now(), size: Buffer.byteLength(content) };
+    writeJson(metaFile(username), meta);
+    accepted[username] = accepted[username] || {};
+    accepted[username][shareId] = { owner: s.owner, name: s.name, savedAs, acceptedAt: Date.now(), copyHash: sha(content) };
+    writeJson(acceptedFile(), accepted);
+    shares[shareId].pulls = (shares[shareId].pulls || 0) + 1;
+    writeJson(sharesFile(), shares);
+    log('share-accept', username, shareId, savedAs, conflict ? '(conflict-copy)' : '(refresh)');
+    return {
+      ok: true,
+      shareId,
+      savedAs,
+      conflict,
+      content,
+      mtime: meta[savedAs]?.mtime || Date.now(),
+    };
+  });
 }
 
 // ---------- 路由 ----------
@@ -457,7 +480,7 @@ async function handle(req, res) {
       const body = await parseBody(req);
       if (body.__error) return json(res, 400, { error: 'JSON 解析失败' });
       if (rateLimited(req, 5, String(body.username || '').toLowerCase())) return json(res, 429, { error: '该用户名的尝试过于频繁，请稍后再试' });
-      const r = doPair(body);
+      const r = await doPair(body);
       if (r.notFound) return json(res, 404, r);
       if (r.unauthorized) return json(res, 401, r);
       return json(res, 200, r);
@@ -469,11 +492,14 @@ async function handle(req, res) {
     const nowSeen = Date.now();
     if (nowSeen - (dev.device.lastSeen || 0) > 60000) {
       dev.device.lastSeen = nowSeen;
-      const devices = readJson(devicesFile(), {});
-      if (devices[dev.username]?.[dev.deviceId]) {
-        devices[dev.username][dev.deviceId] = dev.device;
-        writeJson(devicesFile(), devices);
-      }
+      // 质检 A1：与 pair 的 devices 写入互斥（60s 节流只降频，不消除竞态——加锁消除）
+      withWriteLock(() => {
+        const devices = readJson(devicesFile(), {});
+        if (devices[dev.username]?.[dev.deviceId]) {
+          devices[dev.username][dev.deviceId] = dev.device;
+          writeJson(devicesFile(), devices);
+        }
+      });
     }
 
     if (req.method === 'POST' && p === '/api/devices') {
@@ -492,7 +518,7 @@ async function handle(req, res) {
     if (req.method === 'POST' && p === '/api/sessions/push') {
       const body = await parseBody(req);
       if (body.__error) return json(res, 400, { error: 'JSON 解析失败' });
-      const r = doPush(dev.username, body);
+      const r = await doPush(dev.username, body);
       if (r.error) return json(res, 400, r);
       return json(res, 200, r);
     }
@@ -504,7 +530,7 @@ async function handle(req, res) {
     }
     if (req.method === 'POST' && p === '/api/sessions/delete') {
       const body = await parseBody(req);
-      const r = doDelete(dev.username, String(body.name || '').trim());
+      const r = await doDelete(dev.username, String(body.name || '').trim());
       if (r.notFound) return json(res, 404, r);
       return json(res, 200, r);
     }
@@ -536,7 +562,7 @@ async function handle(req, res) {
     if (req.method === 'POST' && p === '/api/share/accept') {
       if (rateLimited(req, 10)) return json(res, 429, { error: '尝试过于频繁，请稍后再试' });
       const body = await parseBody(req);
-      const r = doShareAccept(dev.username, String(body.shareId || '').trim());
+      const r = await doShareAccept(dev.username, String(body.shareId || '').trim());
       if (r.error) return json(res, 400, r);
       if (r.notFound) return json(res, 404, r);
       return json(res, 200, r);

package/src/web/app.js

@@ -423,7 +423,7 @@ function renderWorkStatus(){
     const secs=curWorkT0?Math.round((Date.now()-curWorkT0)/1000):0;
     html='<span class="ws-busy"><span class="spinner"></span>⏳ '+curSteps+' 步 · '+Math.floor(secs/60)+' 分 '+Math.round(secs%60)+' 秒 · '+curTools+' 工具步</span>';
   } else if(bgRunning>0){
-    html='<span class="ws-bg">🛠 '+bgRunning+' 个后台任务运行中 — 点击查看</span>';
+    html='<span class="ws-bg">🛠 '+bgRunning+' 个后台任务运行中（下载/定时任务等）— 点击查看，完成后会自动提示</span>';
   }
   el.style.display=html?'flex':'none';
   el.innerHTML=html;
@@ -481,10 +481,8 @@ function openTraj(msg){
     list.appendChild(div);
   }
   $('#trajPanel').style.display='flex';
-  $('#tasksPanel').style.display='none';
-  $('#subPanel').style.display='none';
+  $('#tasksPanel').style.display='none'; // 仅任务面板（右侧）与轨迹互斥；子代理面板可与轨迹同显
   $('#trajRailBtn').classList.add('on');
-  $('#subRailBtn').classList.remove('on');
 }
 function resultText(r){
   if(r==null||r===undefined) return '';
@@ -529,7 +527,7 @@ const toggleSubPanel=()=>{
   const willShow=p.style.display==='none';
   p.style.display=willShow?'flex':'none';
   $('#subRailBtn').classList.toggle('on', willShow);
-  if(willShow){ $('#tasksPanel').style.display='none'; $('#trajPanel').style.display='none'; $('#trajRailBtn').classList.remove('on'); renderSubPanel(); }
+  if(willShow){ $('#tasksPanel').style.display='none'; renderSubPanel(); } // 轨迹（左侧）可与子代理（右侧）同显
 };
 $('#subRailBtn').onclick=toggleSubPanel;
 $('#sbClose').onclick=()=>{ $('#subPanel').style.display='none'; $('#subRailBtn').classList.remove('on'); };
@@ -538,10 +536,21 @@ function setBtn(){
   sendBtn.textContent = generating ? '■ 停止' : '发送';
   sendBtn.className = generating ? 'danger' : 'primary';
 }
+const lastBgStatus = new Map(); // 后台任务状态跟踪（完成/失败转换 → 聊天横幅反馈）
 async function updateTasksPanel(){
   const r=await fetch('/api/tasks').catch(()=>null); if(!r) return;
   const j=await r.json(); const list=$('#tpList'); list.innerHTML='';
-  bgRunning=Number(j.running)||0; renderWorkStatus();
+  // 质检（等待状态静默）：后台任务（worker/调度）并入计数与面板；状态转换时在聊天区弹可见横幅
+  bgRunning=(Number(j.running)||0)+(Number(j.bgRunning)||0);
+  for(const t of (j.background||[])){
+    const prev=lastBgStatus.get(t.id);
+    if(prev && prev.status==='running' && t.status!=='running'){
+      if(t.status==='done') renderBanner({text:'✅ 后台任务「'+esc(String(t.message||'').slice(0,30)||'任务')+'」已完成'+(t.durationMs!=null?'（用时 '+(t.durationMs/1000).toFixed(1)+' 秒）':'')});
+      else if(t.status==='failed') renderBanner({text:'✖ 后台任务「'+esc(String(t.message||'').slice(0,30)||'任务')+'」失败：'+esc(String(t.error||'').slice(0,60))});
+    }
+    lastBgStatus.set(t.id,{status:t.status});
+  }
+  renderWorkStatus();
   $('#tpCount').textContent='（'+j.running+' 运行中 / 上限 '+j.maxConcurrent+'）';
   // 审计（第二问无反应修复）：generating 改为「本轮在途」本地状态，由 send/finally 维护，
   // 不再由 /api/tasks 轮询推导——任务面板瞬时波动或一次轮询失败曾让按钮永久卡在停止态，
@@ -554,6 +563,14 @@ async function updateTasksPanel(){
     if(t.status==='running'){ const b=document.createElement('button'); b.textContent='中断'; b.className='danger'; b.style.cssText='margin-left:auto;padding:2px 8px;font-size:11px'; b.onclick=()=>fetch('/api/abort',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({taskId:t.id})}).catch(()=>{}); div.querySelector('.tp-meta').appendChild(b); }
     list.appendChild(div);
   }
+  for(const t of (j.background||[])){
+    const div=document.createElement('div'); div.className='tp-item';
+    const dot = t.status==='running'?'tp-run':(t.status==='done'?'tp-done':'tp-bad');
+    const secs = t.status==='running'?'…':(t.durationMs!=null?' '+(t.durationMs/1000).toFixed(1)+'s':'');
+    const kindLabel = t.kind==='schedule'?'⏰ ':(t.kind==='worker'?'🛠 ':'');
+    div.innerHTML='<div class="tp-title">'+kindLabel+esc(t.message||t.id||'任务')+'</div><div class="tp-meta"><span class="tp-dot '+dot+'"></span>'+t.status+secs+'</div>';
+    list.appendChild(div);
+  }
 }
 setInterval(updateTasksPanel, 2000);
 // 费用徽标：今日费用 / 缓存命中率 / 护栏（15s 刷新）
@@ -617,7 +634,7 @@ async function init(){
   refreshSessions();
   refreshWsSel();
   try{
-    const dr=await fetch('/api/draft',{cache:'no-store'}); const dj=await dr.json();
+    const dr=await fetch('/api/draft?file='+encodeURIComponent(currentSession||''),{cache:'no-store'}); const dj=await dr.json();
     if(dj.text){ input.value=dj.text; input.style.height=Math.min(input.scrollHeight,200)+'px'; input.focus(); }
   }catch(e){}
 }
@@ -856,9 +873,10 @@ async function refreshModelsCfg(){
     const kstate=c.keyState==='stored'?'<span style="color:var(--accent)">'+esc(c.keyMasked||'')+'</span>':'<span style="color:var(--err)">无Key</span>';
     div.innerHTML='<span style="flex:1;min-width:0"><b>'+esc(c.name)+'</b> <span style="color:var(--faint)">'+esc(c.label)+' · '+esc(c.baseUrl)+'</span></span><span style="white-space:nowrap">'+kstate+'</span>';
     const sk=document.createElement('button'); sk.textContent='设Key'; sk.style.cssText='padding:1px 8px;font-size:11px'; sk.onclick=async()=>{ const k=await uiPrompt('API Key（'+c.name+'）：', null, {hidden:true}); if(k===null) return; fetch('/api/models-config',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({action:'setCustomKey',name:c.name,key:k})}).then(rr=>rr.json()).then(jj=>{ if(jj.ok) refreshModelsCfg(); else uiAlert(jj.error||'设置失败'); }); };
+    const test=document.createElement('button'); test.textContent='测试'; test.style.cssText='padding:1px 8px;font-size:11px'; test.onclick=async()=>{ test.disabled=true; test.textContent='测试中…'; try{ const rr=await fetch('/api/models-config',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({action:'testCustom',name:c.name})}); const jj=await rr.json().catch(()=>({error:'请求失败'})); if(jj.ok){ await uiAlert('✅ 连接成功（'+jj.latencyMs+'ms）：'+esc(jj.reply||'空回复')); } else { await uiAlert('✖ 连接失败：'+esc(jj.error||'未知错误')); } } finally { test.disabled=false; test.textContent='测试'; } };
     const ed=document.createElement('button'); ed.textContent='修改'; ed.style.cssText='padding:1px 8px;font-size:11px'; ed.onclick=async()=>{ const u=await uiPrompt('API 地址：', c.baseUrl); if(u===null) return; const l=await uiPrompt('标签：', c.label); if(l===null) return; fetch('/api/models-config',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({action:'updateCustom',name:c.name,baseUrl:u,label:l})}).then(rr=>rr.json()).then(jj=>{ if(jj.ok){ refreshModelsCfg(); reloadModels(); } else uiAlert(jj.error||'修改失败'); }); };
     const rm=document.createElement('button'); rm.textContent='删除'; rm.className='danger'; rm.style.cssText='padding:1px 8px;font-size:11px'; rm.onclick=async()=>{ if(!await uiConfirm('删除自定义模型 '+c.name+'？')) return; const rr=await fetch('/api/models-config',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({action:'removeCustom',name:c.name})}); const jj=await rr.json().catch(()=>({error:'失败'})); if(jj.ok){ refreshModelsCfg(); reloadModels(); } else uiAlert(jj.error||'删除失败'); };
-    div.appendChild(sk); div.appendChild(ed); div.appendChild(rm); cl.appendChild(div);
+    div.appendChild(sk); div.appendChild(test); div.appendChild(ed); div.appendChild(rm); cl.appendChild(div);
   }
   $('#baseUrlOverride').value=j.baseUrlOverride||'';
 }

package/src/web/index.html

@@ -43,11 +43,8 @@ header select{flex:none}
 /* 输入框上方工作状态条（审计：长任务静默硬伤——实时显示执行步数/耗时与后台任务数）。
    与输入框同宽对齐（复用 #composer 的居中容器），不再横贯整个聊天窗口 */
 #workStatus{max-width:860px;margin:0 auto 4px;display:flex;align-items:center;gap:10px;padding:6px 14px;background:var(--panel);border:1px solid var(--border);border-radius:12px;font-size:12.5px;color:var(--dim);flex:none}
-/* 顶部常驻活动条（静默深度优化）：与输入框同列、生成期间常驻——即使滚动离开消息区也始终可见 */
-#liveBar{position:sticky;top:0;z-index:20;max-width:860px;margin:0 auto 8px;display:flex;align-items:center;gap:10px;padding:8px 16px;background:linear-gradient(135deg,rgba(61,220,151,.12),rgba(34,184,207,.12));border:1px solid rgba(61,220,151,.45);border-radius:12px;font-size:13px;color:var(--text);box-shadow:0 2px 14px rgba(0,0,0,.25)}
-#liveBar .spinner{margin-right:2px}
-#liveBar .lb-phase{color:var(--accent2);font-weight:600;white-space:nowrap}
-#liveBar .lb-stat{color:var(--dim);white-space:nowrap}
+/* 状态条 busy 行：承载完整阶段信息（合并原顶部活动条），与输入框同列不遮挡聊天区 */
+#workStatus .ws-phase{color:var(--accent2);font-weight:600;white-space:nowrap}
 /* 左侧轨迹固定栏 + 右侧子代理面板（布局重构：轨迹在左、子代理在右） */
 #trajRail{position:fixed;left:0;top:52px;bottom:0;width:42px;background:var(--bg2);border-right:1px solid var(--border);z-index:35;display:flex;flex-direction:column;align-items:center;padding-top:10px;gap:10px}
 #trajRail .rail-btn{width:34px;height:34px;border-radius:10px;border:1px solid var(--border);background:var(--bg3);cursor:pointer;font-size:15px;display:flex;align-items:center;justify-content:center}
@@ -73,7 +70,7 @@ header select{flex:none}
 .trajBtn{cursor:pointer;background:var(--bg3);border:1px solid var(--border);color:var(--dim);border-radius:20px;padding:2px 10px;font-size:11.5px}
 .trajBtn:hover{color:var(--text);border-color:var(--accent2)}
 /* 轨迹面板（与任务面板互斥展示）：置于聊天窗口左侧（DSH 式侧栏） */
-#trajPanel{position:fixed;left:42px;top:52px;bottom:0;width:330px;background:var(--bg2);border-right:1px solid var(--border);z-index:40;display:flex;flex-direction:column;box-shadow:4px 0 24px rgba(0,0,0,.35)}
+#trajPanel{position:fixed;left:42px;top:52px;bottom:0;width:252px;background:var(--bg2);border-right:1px solid var(--border);z-index:40;display:flex;flex-direction:column;box-shadow:4px 0 24px rgba(0,0,0,.35)}
 .tj-head{padding:12px 14px;font-size:14px;font-weight:600;border-bottom:1px solid var(--border);color:var(--accent2);display:flex;align-items:center;gap:8px}
 .tj-head button{margin-left:auto}
 #tjList{flex:1;overflow-y:auto;padding:8px}
@@ -240,7 +237,7 @@ footer{flex:none;border-top:1px solid var(--border);background:var(--bg2);paddin
   <div class="tp-head">任务面板 <span id="tpCount"></span><button id="tpClose" style="float:right">✕</button></div>
   <div id="tpList"></div>
 </aside>
-<main><div id="liveBar" style="display:none"></div><div id="chat"></div></main>
+<main><div id="chat"></div></main>
 <footer>
   <div id="workStatus" style="display:none"></div>
   <input type="file" id="fileInput" accept="image/png,image/jpeg,image/gif,image/webp,.txt,.md,.json,.js,.py,.log,.csv,.html,.css" multiple style="display:none">

package/src/web/routes/api.js

@@ -1,6 +1,7 @@
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { ensureHome, loadConfig, saveConfig, mingdaoHome } from '../../config.js';
@@ -39,6 +40,7 @@ import {
   reconcileSchedules,
 } from '../../schedule.js';
 import { enableAutostart, disableAutostart, autostartStatus } from '../../autostart.js';
+import { listTasks } from '../../tasks.js';
 import { currentWorkspace, workspaceForDir, listWorkspaces, addWorkspace, removeWorkspace, renameWorkspace, setWorkspaceDir, workspacePath, touchWorkspace, getSessionWorkspace, setSessionWorkspace, removeSessionWorkspace, moveSessionWorkspace } from '../../workspace.js';
 import { loadMemory, writeMemory, dedupeMemory } from '../../memory.js';
 import { recordUsage, listCacheStats, summarizeCacheStats, costBreakdown } from '../../cachestats.js';
@@ -48,9 +50,10 @@ import { presetList, buildPreset } from '../../mcp-presets.js';
 import { syncStatus, syncLogin, syncLogout, syncPush, syncPull, syncRemoteList, maybeAutoSync, syncChangePassword, syncShareCreate, syncShareList, syncShareAccept, syncShareRevoke, listSyncConflicts, resolveSyncConflict } from '../../sync.js';
 
 export function createApiDispatch(deps) {
-  const { json, srvlog, readBody, cfg, home, providerCache, getProviderFor, tasks, MAX_CONCURRENT, pruneTasks, handleChat, mcpFacade, provider, validateRemoteUrl, isPrivateHost, authEnabled, tokenMatches, requestToken, trustedHost, INDEX_HTML } = deps;
-  const state = deps.state; // { modelName, workingDir, draftText }
+  const { json, srvlog, readBody, cfg, home, providerCache, getProviderFor, tasks, MAX_CONCURRENT, pruneTasks, handleChat, mcpFacade, provider, validateRemoteUrl, isPrivateHost, authEnabled, tokenMatches, requestToken, trustedHost, INDEX_HTML, draftTexts, startupCwd } = deps;
+  const state = deps.state; // { modelName, workingDir }
   const refs = deps.refs; // { inflight }
+  const MAX_API_BODY = 1024 * 1024; // 质检 A4：普通 JSON 接口 1MB；chat 保持 readBody 默认 40MB
   const dispatch = async (req, res) => {
     const url = new URL(req.url, 'http://localhost');
     const p = url.pathname;
@@ -150,7 +153,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/config') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       // 内存 cfg 可能比磁盘旧（如 CLI 改过同步地址）：先从磁盘刷新 sync，避免保存时回滚
       cfg.sync = loadConfig()?.sync || cfg.sync;
       const next = { model: state.modelName, permission: cfg.permission ?? 'ask' };
@@ -257,7 +260,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/models-config') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       const action = body.action;
       // —— 服务商 Key 管理 ——
       if (action === 'setProviderKey') {
@@ -330,6 +333,22 @@ export function createApiDispatch(deps) {
         saveConfig(cfg);
         return json(res, 200, { ok: true, name, model: state.modelName });
       }
+      // 质检（自定义模型连通性）：发起一次最小对话验证 baseUrl+Key 可用
+      if (action === 'testCustom') {
+        const name = String(body.name || '').trim();
+        const cm = (cfg.customModels || {})[name];
+        if (!cm) return json(res, 400, { error: `自定义模型 ${name} 不存在` });
+        const pc = resolveProviderConfig(cfg, name);
+        if (!pc.apiKey) return json(res, 400, { error: '该模型未设置 API Key，请先「设Key」再测试' });
+        const t0 = Date.now();
+        try {
+          const tp = await createProvider(cfg, name);
+          const r = await tp.chat({ model: name, messages: [{ role: 'user', content: 'ping' }], tools: [], temperature: 0, maxTokens: 8 });
+          return json(res, 200, { ok: true, name, latencyMs: Date.now() - t0, reply: String(r.text || r.reasoning || '').slice(0, 60) || '（空回复，但连接成功）' });
+        } catch (e) {
+          return json(res, 200, { ok: false, name, latencyMs: Date.now() - t0, error: String(e?.message || e) });
+        }
+      }
       if (action === 'setCustomKey') {
         const name = String(body.name || '').trim();
         if (!(cfg.customModels || {})[name]) return json(res, 400, { error: `自定义模型 ${name} 不存在` });
@@ -384,7 +403,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/session') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       const file = path.basename(String(body.file || ''));
       const full = path.join(home, 'sessions', file);
       if (!file || !fs.existsSync(full)) return json(res, 404, { error: '会话不存在' });
@@ -420,7 +439,36 @@ export function createApiDispatch(deps) {
         durationMs: t.status === 'running' ? Date.now() - t.startedAt : t.durationMs,
         session: t.session ? path.basename(t.session.file) : null,
       }));
-      json(res, 200, { ok: true, running, maxConcurrent: MAX_CONCURRENT, tasks: list });
+      // 质检（等待状态静默）：后台 worker 任务与运行中的调度任务并入面板与状态条计数——
+      // 此前 /api/tasks 只含聊天 SSE 任务，后台下载/长任务期间界面完全无感知
+      let bgRunning = 0;
+      const background = [];
+      try {
+        for (const t of listTasks(home)) {
+          if (t.status === 'running') bgRunning += 1;
+          background.push({
+            id: t.id,
+            kind: 'worker',
+            status: t.status,
+            message: t.message || t.question || '',
+            startedAt: t.startedAt,
+            durationMs: t.status === 'running' ? Date.now() - t.startedAt : t.durationMs,
+            error: t.error || '',
+          });
+        }
+        for (const sch of listSchedules(home)) {
+          if (sch.status === 'running') bgRunning += 1;
+          background.push({
+            id: sch.id,
+            kind: 'schedule',
+            status: sch.status,
+            message: sch.question || sch.id || '',
+            startedAt: sch.createdAt || null,
+            durationMs: sch.status === 'running' ? Date.now() - (sch.lastRunAt || Date.now()) : null,
+          });
+        }
+      } catch {}
+      json(res, 200, { ok: true, running, bgRunning, maxConcurrent: MAX_CONCURRENT, tasks: list, background });
       return;
     }
     if (req.method === 'POST' && p === '/api/chat') {
@@ -439,7 +487,7 @@ export function createApiDispatch(deps) {
       });
       let body;
       try {
-        body = await readBody(req);
+        body = await readBody(req, MAX_API_BODY);
       } catch (e) {
         refs.inflight -= 1;
         res.write(`data: ${JSON.stringify({ type: 'error', message: e.message })}\n\n`);
@@ -463,7 +511,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/permission') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       const entry = tasks.get(body.taskId);
       if (!entry || !entry.pendingAsk) return json(res, 409, { error: '没有挂起的权限确认' });
       const pa = entry.pendingAsk;
@@ -479,7 +527,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/abort') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       if (body.taskId) {
         const entry = tasks.get(body.taskId);
         if (entry?.abortHandler) {
@@ -501,14 +549,17 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'GET' && p === '/api/draft') {
-      const text = state.draftText;
-      state.draftText = ''; // 读取即清除
+      // 质检 A5：按会话维度读取（无 file 参数用全局槽，兼容旧客户端）
+      const key = String(url.searchParams.get('file') || '');
+      const text = draftTexts.get(key) || '';
+      draftTexts.delete(key); // 读取即清除
       json(res, 200, { ok: true, text });
       return;
     }
     if (req.method === 'POST' && p === '/api/draft') {
-      const body = await readBody(req);
-      state.draftText = String(body.text ?? '').slice(0, 200000);
+      const body = await readBody(req, MAX_API_BODY);
+      const key = String(body.file || '');
+      draftTexts.set(key, String(body.text ?? '').slice(0, 200000));
       json(res, 200, { ok: true });
       return;
     }
@@ -533,7 +584,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/schedule') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       const action = String(body.action || '');
       try {
         if (action === 'add') {
@@ -573,7 +624,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/workspaces') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       const name = String(body.name || '').trim();
       if (body.action === 'add') {
         if (!name) return json(res, 400, { error: '名称不能为空' });
@@ -626,6 +677,11 @@ export function createApiDispatch(deps) {
     if (req.method === 'GET' && p === '/api/fs-browse') {
       let dir = String(url.searchParams.get('dir') || '').trim();
       if (!path.isAbsolute(dir)) return json(res, 400, { error: '需要绝对路径' });
+      // 质检 A3：目录浏览限定基目录（默认家目录 + config.web.browseRoots 显式授权），
+      // 拒绝越界——此前可枚举服务器任意绝对路径（整机目录结构探测面）
+      const browseRoots = [os.homedir(), startupCwd, state.workingDir, ...(Array.isArray(cfg.web?.browseRoots) ? cfg.web.browseRoots : [])].map((r) => path.resolve(String(r)));
+      const inRoot = browseRoots.some((r) => dir === r || dir.startsWith(r + path.sep));
+      if (!inRoot) return json(res, 403, { error: '目录不在可浏览范围内（家目录或 web.browseRoots 授权目录）' });
       try {
         const st = fs.statSync(dir);
         if (!st.isDirectory()) return json(res, 400, { error: '不是目录' });
@@ -635,7 +691,9 @@ export function createApiDispatch(deps) {
           .map((e) => ({ name: e.name, path: path.join(dir, e.name) }))
           .sort((a, b) => a.name.localeCompare(b.name, 'zh-CN'))
           .slice(0, 300);
-        const parent = path.dirname(dir);
+        let parent = path.dirname(dir);
+        // 父目录同样不得越出基目录
+        if (!browseRoots.some((r) => parent === r || parent.startsWith(r + path.sep))) parent = null;
         json(res, 200, { ok: true, path: dir, parent: parent === dir ? null : parent, entries });
       } catch (err) {
         json(res, 400, { error: String(err?.message || err) });
@@ -647,7 +705,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/memory') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       if (body.action === 'dedupe') {
         const removed = dedupeMemory();
         return json(res, 200, { ok: true, removed });
@@ -674,7 +732,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/mcp-presets') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       const name = String(body.name || '').trim();
       const r = buildPreset(name, body.arg, state.workingDir);
       if (r.error) return json(res, 400, { error: r.error });
@@ -708,7 +766,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/skills') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       if (body.action === 'install') {
         const r = await installSkill(body.arg || body.name || '');
         if (r.error) return json(res, 400, { error: r.error });
@@ -732,7 +790,7 @@ export function createApiDispatch(deps) {
       return;
     }
     if (req.method === 'POST' && p === '/api/sync') {
-      const body = await readBody(req);
+      const body = await readBody(req, MAX_API_BODY);
       if (body.action === 'login') {
         const vurl = validateRemoteUrl(body.url); // 质检 S1：SSRF 防护（同步端点同样只允许公网）
         if (vurl.error) return json(res, 400, { error: vurl.error });

package/src/web/server.js

@@ -16,6 +16,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { createLogWriter } from '../log-writer.js';
 import { createApiDispatch } from './routes/api.js';
 import { ensureHome, loadConfig, saveConfig, mingdaoHome } from '../config.js';
 import { setStoredKey, removeStoredKey, getStoredKey, maskKey } from '../credentials.js';
@@ -163,6 +164,7 @@ export async function runWebServer({ host = '127.0.0.1', port = 3820, authToken
   }
 
   let workingDir = process.cwd(); // 工作空间切换时随之更新（后续会话/工具都跟随新目录）
+  const startupCwd = workingDir; // 质检 A3：启动工作目录恒为合法浏览根（工作空间切换后仍可浏览原位）
   // Provider 按模型懒加载缓存：界面切换模型后即时生效
   const providerCache = new Map();
   async function getProviderFor(m) {
@@ -206,23 +208,12 @@ export async function runWebServer({ host = '127.0.0.1', port = 3820, authToken
     sessionLocks.set(file, next.then(() => sessionLocks.delete(file), () => sessionLocks.delete(file)));
     return next;
   }
-  let draftText = ''; // 外部注入的草稿（VS Code 插件选中代码发送）
+  const draftTexts = new Map(); // 质检 A5：草稿按会话维度存储（此前单槽多客户端互相覆盖）
 
   // —— 服务端诊断日志（第二问无反应排查 + 长期运维）：<mingdao-home>/logs/web-server.log ——
   // 记录每次对话的关键阶段与耗时；2MB 滚动。桌面版与 WebUI 共用同一日志。
-  function srvlog(msg) {
-    try {
-      const dir = path.join(mingdaoHome(), 'logs');
-      fs.mkdirSync(dir, { recursive: true });
-      const f = path.join(dir, 'web-server.log');
-      let prev = '';
-      try {
-        prev = fs.readFileSync(f, 'utf8');
-      } catch {}
-      if (prev.length > 2 * 1024 * 1024) prev = prev.slice(-1024 * 1024);
-      fs.writeFileSync(f, prev + new Date().toISOString() + ' ' + msg + '\n');
-    } catch {}
-  }
+  // 质检 A6：统一日志写入器（append + 按行截断 + 原子替换），与桌面 appLog 同款实现
+  const srvlog = createLogWriter(path.join(mingdaoHome(), 'logs', 'web-server.log'));
 
   // —— SSRF 防护（质检 S1）：远端地址校验 ——
   function isPrivateHost(hostname) {
@@ -506,10 +497,9 @@ export async function runWebServer({ host = '127.0.0.1', port = 3820, authToken
     providerCache, getProviderFor, tasks,
     MAX_CONCURRENT, pruneTasks, handleChat,
     mcpFacade, provider, validateRemoteUrl, isPrivateHost,
-    authEnabled, tokenMatches, requestToken, trustedHost, INDEX_HTML,
+    authEnabled, tokenMatches, requestToken, trustedHost, INDEX_HTML, draftTexts, startupCwd,
     state: { get modelName() { return modelName; }, set modelName(v) { modelName = v; },
-             get workingDir() { return workingDir; }, set workingDir(v) { workingDir = v; },
-             get draftText() { return draftText; }, set draftText(v) { draftText = v; } },
+             get workingDir() { return workingDir; }, set workingDir(v) { workingDir = v; } },
     refs: { get inflight() { return inflight; }, set inflight(v) { inflight = v; } },
   });
   const server = http.createServer((req, res) => {