momo-ai 1.0.70 → 1.0.71

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "momo-ai",
-    "version": "1.0.70",
+    "version": "1.0.71",
     "description": "Rachel Momo ( OpenSpec )",
     "main": "src/momo.js",
     "bin": {

package/skills/mo-dev-antd-exform/SKILL.md

@@ -0,0 +1,162 @@
+---
+name: mo-dev-antd-exform
+description: Use when implementing ADD/EDIT/FILTER forms with ExForm component in React/Ant Design projects using the zero-ui framework
+---
+
+# ExForm Component Patterns
+
+## Overview
+
+ExForm provides standardized form handling with three modes (ADD/EDIT/FILTER), automatic validation, i18n integration, and Redux state synchronization.
+
+## When to Use
+
+- Building ADD forms for creating new records
+- Building EDIT forms for updating existing records
+- Building FILTER forms for search/query interfaces
+- Need automatic form validation and submission handling
+- Need integration with framework's dialog/notification system
+
+## Form Modes Quick Reference
+
+| Mode | yoForm Call | Purpose |
+|------|-------------|---------|
+| ADD | `Ex.yoForm(this, null)` | Create new record |
+| EDIT | `Ex.yoForm(this, null, $inited)` | Edit existing record |
+| FILTER | `Ex.yoFilter(this)` | Filter/search form |
+
+## Hard Rules (No Exceptions)
+
+- **Never** use raw Ant Design `<Form>` instead of `<ExForm>`
+- **Never** hardcode form configuration in JSX (use resource JSON `_form` block)
+- **Never** write custom `onFinish` handlers (use `$op` prop with `Ex.form()` API)
+- **Never** skip `@Ux.zero` decorator with `Ux.rxEtat` builder
+- **Never** forget `.form()` in decorator for FILTER mode
+- **Never** forget `.raft(1)` for single-column FILTER layout
+- **Never** pass `$inited` to ADD mode (only EDIT needs it)
+
+## Basic Pattern
+
+```jsx
+import {ExForm} from "ei";
+
+// ADD mode
+const form = Ex.yoForm(this, null);
+return <ExForm {...form} $height="300px" $op={Op.actions}/>;
+
+// EDIT mode with data
+const {$inited = {}} = this.props;
+const form = Ex.yoForm(this, null, $inited);
+return <ExForm {...form} $height="300px" $op={Op.actions}/>;
+
+// FILTER mode
+const form = Ex.yoFilter(this);
+return <ExForm {...form} $op={Op.actions}/>;
+```
+
+## RxEtat Decorator Configuration
+
+```js
+// ADD form
+@Ux.zero(Ux.rxEtat(require('../Cab'))
+    .cab("UI.Add")
+    .to()
+)
+
+// EDIT form
+@Ux.zero(Ux.rxEtat(require('../Cab'))
+    .cab("UI.Edit")
+    .to()
+)
+
+// FILTER form (single column)
+@Ux.zero(Ux.rxEtat(require('../Cab'))
+    .cab("UI.Filter")
+    .raft(1)            // Single column layout
+    .form()             // Enable form binding
+    .to()
+)
+```
+
+## Op.js Handler Pattern
+
+```js
+// All handlers MUST have $op prefix
+const $opAdd = (reference) => (params) =>
+    Ex.form(reference).add(params, {
+        uri: '/api/resource',
+        dialog: 'added'     // i18n key for success message
+    });
+
+const $opSave = (reference) => (params) =>
+    Ex.form(reference).save(params, {
+        uri: '/api/resource/:key',
+        dialog: 'saved'
+    });
+
+const $opFilter = (reference) => (params) =>
+    Ex.form(reference).filter(params);
+
+export default { $opAdd, $opSave, $opFilter };
+```
+
+## Post-Operation Redux Chaining
+
+```js
+// Update Redux after save
+const $opAdd = (reference) => (params) =>
+    Ex.form(reference).add(params, { uri: "/api/dept", dialog: "added" })
+        .then(data => Ux.of(reference)._.ioIn(Ex.K.DEPT, data));
+
+// Remove from Redux after delete
+const $opDelete = (reference) => (params) =>
+    Ex.form(reference).remove(params, { uri: "/api/dept/:key", dialog: "removed" })
+        .then(data => Ux.of(reference)._.ioOut(Ex.K.DEPT, data));
+```
+
+## Resource JSON Configuration
+
+```json
+{
+    "_form": {
+        "ui": ["name", "code", "status"],
+        "hidden": ["id", "tenantId"],
+        "rules": {
+            "name": [{ "required": true, "message": "Name is required" }]
+        }
+    }
+}
+```
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Using raw `<Form>` | Use `<ExForm>` from "ei" |
+| Hardcoding form config in JSX | Define in resource JSON `_form` block |
+| Custom `onFinish` with fetch/axios | Use `$op` prop with `Ex.form().add/save` |
+| Missing `.form()` in FILTER decorator | Add `.form()` to enable form binding |
+| Missing `.raft(1)` for FILTER | Add `.raft(1)` for single-column layout |
+| Passing `$inited` to ADD mode | Only pass to EDIT: `Ex.yoForm(this, null, $inited)` |
+| Op handler without `$op` prefix | All handler keys MUST start with `$op` |
+| Hardcoded success messages | Use `dialog` option with i18n key |
+
+## Red Flags — STOP and Fix
+
+- You're using `<Form>` from antd instead of `<ExForm>` from ei
+- You're writing custom form submission logic with fetch/axios
+- You're hardcoding form fields in JSX instead of resource JSON
+- You're missing `@Ux.zero` decorator
+- You're missing `.form()` or `.raft(1)` for FILTER mode
+- Op handler keys don't start with `$op`
+
+**All of these mean: Follow the ExForm pattern exactly.**
+
+## Common Rationalizations (and Why They're Wrong)
+
+| Excuse | Reality |
+|--------|---------|
+| "Raw Form is more flexible" | ExForm provides validation, i18n, Redux integration automatically |
+| "Hardcoding is faster" | Resource JSON enables reuse and i18n; hardcoding breaks framework |
+| "Custom handlers give more control" | `Ex.form()` API handles dialogs, loading states, Redux updates automatically |
+| "Decorator is too complex" | Decorator wires i18n, Redux, lifecycle; skipping breaks integration |

package/skills/mo-dev-antd-exlist/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: mo-dev-antd-exlist
+description: Use when building list/table pages with ExListFast or ExListComplex components in React/Ant Design projects using the zero-ui framework
+---
+
+# ExList Component Family
+
+## Overview
+
+ExList provides two variants for list/table pages with built-in search, pagination, and CRUD operations.
+
+## When to Use
+
+- Building list/table pages with search and pagination
+- Need quick list without embedded forms (use ExListFast)
+- Need full CRUD with Add/Edit/Filter forms (use ExListComplex)
+- Displaying data with custom column renderers
+- Implementing batch operations
+
+## Component Variants
+
+| Component | Features | Use Case |
+|-----------|----------|----------|
+| `ExListFast` | Search + Pagination + Actions | Quick list without forms |
+| `ExListComplex` | All Fast + Add/Edit/Filter forms | Full CRUD list page |
+
+## Hard Rules (No Exceptions)
+
+- **Never** use raw Ant Design `<Table>` instead of ExList components
+- **Never** skip the attributes builder pattern (`yoList()` with `Ex.yoAmbient()`)
+- **Never** use raw `fetch/axios` instead of `Ux.ajaxPost` for search
+- **Never** implement manual pagination logic (use `$options`)
+- **Never** hardcode columns array (use `$renders` pattern)
+- **Never** skip `$executor` pattern for actions
+- **Never** hardcode grid config (load from resource JSON via `Ux.fromHoc`)
+
+## Basic ExListFast Pattern
+
+```jsx
+import {ExListFast} from "ei";
+
+<ExListFast {...attrList}
+    $renders={columnFn(this)}
+    $executor={executeFn(this)}
+    rxSearch={query => Ux.ajaxPost("/api/search", query)}
+/>
+```
+
+## Attributes Builder (Op.js)
+
+```js
+const yoList = (reference) => {
+    const inherits = Ex.yoAmbient(reference);
+
+    // Load grid config from resource JSON
+    inherits.config = Ux.fromHoc(reference, "grid");
+
+    // Pagination options
+    inherits.$options = {
+        pageSize: 20,
+        showSizeChanger: true
+    };
+
+    return inherits;
+};
+```
+
+## Custom Column Renderers
+
+```js
+const columnFn = (reference) => ({
+    // Custom text rendering
+    name: (text, record) => (
+        <a onClick={() => handleEdit(record)}>{text}</a>
+    ),
+
+    // Status tag
+    status: (text) => (
+        <Tag color={text === 'active' ? 'green' : 'red'}>
+            {text === 'active' ? 'Active' : 'Inactive'}
+        </Tag>
+    ),
+
+    // Date formatting
+    createdAt: (text) => moment(text).format('YYYY-MM-DD HH:mm'),
+
+    // Actions column
+    $op: (text, record) => (
+        <Space>
+            <a onClick={() => editFn(record)}>Edit</a>
+            <a onClick={() => deleteFn(record)}>Delete</a>
+        </Space>
+    )
+});
+```

package/skills/mo-dev-antd-lifecycle/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: mo-dev-antd-lifecycle
+description: Use when creating or updating React/Ant Design pages that must follow the zero-ui yi/yu/yo lifecycle pattern and @Ux.zero decorator
+---
+
+# Page Lifecycle Patterns (yi/yu/yo)
+
+## Overview
+
+All Ant Design pages must use the zero-ui lifecycle pattern with `@Ux.zero` decorator, `yi/yu/yo` naming, and `Ex.yoRender` gated by `$ready`.
+
+## When to Use
+
+- Creating a new page component
+- Refactoring a page component
+- Fixing page initialization, data loading, or render issues
+- Migrating a function component to zero-ui class component
+
+## Hard Rules (No Exceptions)
+
+- **Never** use function components or hooks for pages
+- **Always** use class components with `React.PureComponent`
+- **Always** use `@Ux.zero(Ux.rxEtat(...).to())` decorator
+- **Always** call `Ex.yiAssist(this)` or `Ex.yiStandard(this)` in `componentDidMount`
+- **Always** render with `Ex.yoRender(this, fn, debug)`
+- **Always** gate rendering by `$ready` (handled by `Ex.yoRender`)
+- **Always** use Op handlers with `$op` prefix and `(reference) => (params) => Promise`
+
+## Canonical Pattern
+
+```js
+import Ux from 'ux';
+import Ex from 'ex';
+import Op from './Op';
+
+@Ux.zero(Ux.rxEtat(require('./Cab.json'))
+    .cab("UI")
+    .ready(true)
+    .connect(state => Ux.dataIn(state).revamp(["datum"]), true)
+    .state({})
+    .to()
+)
+class Component extends React.PureComponent {
+    componentDidMount() {
+        Ex.yiAssist(this);  // yi = initialize
+    }
+    render() {
+        return Ex.yoRender(this, () => {
+            // render logic here
+        }, Ex.parserOfColor("PageName"));
+    }
+}
+
+export default Component;
+```
+
+## RxEtat Builder Checklist
+
+```js
+Ux.rxEtat(require('./Cab'))
+    .cab("UI")
+    .ready(true)
+    .state({})
+    .connect(s2pFn)
+    .bind(OP)
+    .to()
+```
+
+## Op Handler Pattern
+
+```js
+const $opAdd = (reference) => (params) =>
+    Ex.form(reference).add(params, {
+        uri: '/api/resource',
+        dialog: 'added'
+    });
+
+export default { $opAdd };
+```
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Using hooks/function component | Use class component + @Ux.zero decorator |
+| Missing `Ex.yiAssist` | Call in `componentDidMount` |
+| Rendering without `Ex.yoRender` | Wrap render with `Ex.yoRender` |
+| Missing `$ready` gate | Use `.ready(true)` + `Ex.yoRender` |
+| Op handler without `$op` prefix | Prefix keys with `$op` |
+
+## Red Flags — STOP and Fix
+
+- You are writing a function component for a page
+- You are using React hooks in a page
+- You are rendering without `Ex.yoRender`
+- You are missing `@Ux.zero` decorator
+- You are calling `setState` before `$ready`
+- Op handlers are missing `$op` prefix
+
+**All of these mean: refactor to the zero-ui lifecycle pattern.**
+
+## Common Rationalizations (and Why They're Wrong)
+
+| Excuse | Reality |
+|--------|---------|
+| "Hooks are modern best practice" | Zero-ui framework requires class components for decorator wiring |
+| "Decorator is too complex" | Decorator injects i18n, Redux, lifecycle; skipping breaks framework |
+| "Render directly is fine" | `Ex.yoRender` provides loading/error gate and `$ready` handling |

package/skills/mo-dev-go-backend-route/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: mo-dev-go-backend-route
+description: Use when adding, removing, or moving Go backend modules under internal/apps, internal/system, internal/widgets, or internal/jobs where routes are generated
+---
+
+# Backend Dynamic Routing (Codegen)
+
+## Overview
+
+Backend module routing is **compile-time generated**. If you add/move a module and skip codegen, you create missing routes or duplicate route panics.
+
+## When to Use
+
+- You add/remove/move a module directory under:
+  - `internal/apps/<name>/`
+  - `internal/system/<name>/`
+  - `internal/widgets/<name>/`
+  - `internal/jobs/<name>/`
+- You modify a module’s `routes.go` or its `RegisterRoutes` signature
+- You see:
+  - “module not found” during mounting
+  - duplicate route registration panics
+
+## Quick Reference
+
+- **Codegen entry:** `cmd/codegen/main.go`
+- **Generated output:** `internal/api/routes_gen.go`
+- **Run:**
+  - `go run cmd/codegen/main.go`
+  - or `make codegen`
+
+## Required Contract
+
+### RegisterRoutes signature (MUST match)
+
+```go
+func RegisterRoutes(r *gin.RouterGroup, cfg *config.Config, db *gorm.DB) {
+    handler := NewHandler(cfg, db)
+    group := r.Group("/mymodule")
+    {
+        group.GET("/endpoint", handler.GetData)
+    }
+}
+```
+
+### Registry mounting (don’t bypass)
+
+- Use `internal/registry/` to mount **generated** `BuiltinModules`.
+- Do **not** manually import/register modules in `router.go`.
+
+## Hard Rules (No Exceptions)
+
+- **Never** hand-edit `internal/api/routes_gen.go`.
+- **Never** “just wire it up quickly” by manually importing a module into `router.go`.
+- **Never** re-apply `authMiddleware` inside module routes (parent group already has it).
+
+## Common Rationalizations (and Why They’re Wrong)
+
+| Excuse | Reality |
+|---|---|
+| “It’s one module, manual import is faster.” | Creates duplicates / drift; next codegen run breaks or overwrites behavior. |
+| “Codegen is optional.” | Architecture requires generated registry; skipping causes missing mounts. |
+| “I can tweak routes_gen.go directly.” | Generated file is overwritten; manual edits are lost and can break builds. |
+
+## Red Flags — STOP
+
+- You are about to edit `internal/api/routes_gen.go`
+- You are about to import a module directly in `router.go`
+- You changed `RegisterRoutes` signature
+
+**All of these mean: run codegen and follow registry mounting.**

package/skills/mo-dev-go-frontend-route/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: mo-dev-go-frontend-route
+description: Use when adding, removing, or moving Vue modules under web/src/apps, web/src/system, web/src/widgets, or web/src/jobs where module routing is code-generated
+---
+
+# Frontend Dynamic Routing (Codegen)
+
+## Overview
+
+Frontend module routing is **compile-time generated**. Manually importing modules or skipping codegen creates missing registry entries and runtime module errors.
+
+## When to Use
+
+- You add/remove/move a module under:
+  - `web/src/apps/<name>/`
+  - `web/src/system/<name>/`
+  - `web/src/widgets/<name>/`
+  - `web/src/jobs/<name>/`
+- You change a module `index.ts` manifest
+- You see errors like `Cannot find module '@/generated/modules'` or modules missing in UI
+
+## Quick Reference
+
+- **Codegen script:** `web/scripts/codegen.js`
+- **Generated output:** `web/src/generated/modules.ts`
+- **Run:**
+  - `cd web && npm run codegen`
+  - or `make codegen`
+
+## Required Manifest Contract
+
+```ts
+export const manifest: AppManifest = {
+  id: 'app-name',
+  title: { en: 'App Name', zh: '应用名称' },
+  icon: 'icon-name',
+  component: () => import('./App.vue')
+}
+```
+
+**Critical:** Use `title` (not `name`) for i18n labels.
+
+## Hard Rules (No Exceptions)
+
+- **Never** hand-edit `web/src/generated/modules.ts`.
+- **Never** manually import/register modules in window manager or control panel.
+- **Never** skip codegen after adding/moving a module.
+
+## Common Rationalizations (and Why They’re Wrong)
+
+| Excuse | Reality |
+|---|---|
+| “It’s faster to import manually.” | Registry stays stale; module won’t appear in app launcher. |
+| “Codegen is optional.” | Generated registry is required for discovery and lazy-loading. |
+| “I can tweak generated file.” | Overwritten on next codegen run; breaks consistency. |
+
+## Red Flags — STOP
+
+- You are about to edit `web/src/generated/modules.ts`
+- You are about to add manual imports for a module
+- You are skipping `npm run codegen`
+
+**All of these mean: run codegen and use the manifest discovery pattern.**

package/skills/mo-dev-go-module-api/SKILL.md

@@ -0,0 +1,249 @@
+---
+name: mo-dev-go-module-api
+description: Use when adding GET/PUT settings endpoints to existing Go modules with persistent JSON configuration
+---
+
+# Adding Module Settings API
+
+## Overview
+
+Add settings APIs to Go modules following the workspace JSON storage pattern with strict validation and response envelope.
+
+## When to Use
+
+- Adding GET/PUT config endpoints to apps/system/widgets modules
+- Module needs persistent user-specific settings
+- Settings stored as JSON in workspace (not DB)
+
+## Core Pattern
+
+**Endpoint convention:** GET/PUT `/api/<module>/config`
+**Storage:** `workspace/<username>/.ft-webos/<module>.json`
+**Response:** Always `{"success":bool,"data":any,"error":string}`
+
+## Quick Reference
+
+| File | Purpose |
+|------|---------|
+| `settings.go` | Model + validation + defaults |
+| `service.go` | GetSettings, UpdateSettings, getSettingsPath |
+| `handler.go` | GetSettings, UpdateSettings handlers |
+| `routes.go` | Register GET/PUT /config |
+| `settings_test.go` | Unit tests |
+
+## Implementation Checklist
+
+- [ ] **Response envelope enforced**: All handlers return `{"success":bool,"data":any,"error":string}`
+- [ ] **Path validation**: Validate workspace path against root to prevent traversal
+- [ ] **GET/PUT /config naming**: Use `/api/<module>/config` (not /settings)
+- [ ] **JSON file storage**: `workspace/<username>/.ft-webos/<module>.json` (no DB)
+- [ ] **Input validation**: Schema or field checks before processing
+- [ ] **Error handling**: Log + HTTP status + error field populated
+
+## Settings Model Template
+
+```go
+package mymodule
+
+import "errors"
+
+type MyModuleSettings struct {
+    Field1 bool   `json:"field1"`
+    Field2 string `json:"field2"`
+}
+
+var AllowedField2Values = []string{"option1", "option2"}
+var ErrInvalidField2 = errors.New("invalid field2 value")
+
+func DefaultSettings() *MyModuleSettings {
+    return &MyModuleSettings{
+        Field1: false,
+        Field2: "option1",
+    }
+}
+
+func (s *MyModuleSettings) Validate() error {
+    if !contains(AllowedField2Values, s.Field2) {
+        return ErrInvalidField2
+    }
+    return nil
+}
+
+func contains(slice []string, item string) bool {
+    for _, v := range slice {
+        if v == item {
+            return true
+        }
+    }
+    return false
+}
+```
+
+## Service Layer Template
+
+```go
+func (s *Service) GetSettings(username string) (*MyModuleSettings, error) {
+    path := s.getSettingsPath(username)
+
+    // Validate path against workspace root
+    if !strings.HasPrefix(path, s.cfg.WorkspaceRoot) {
+        return nil, errors.New("invalid settings path")
+    }
+
+    data, err := os.ReadFile(path)
+    if os.IsNotExist(err) {
+        return DefaultSettings(), nil
+    }
+    if err != nil {
+        return nil, fmt.Errorf("read settings: %w", err)
+    }
+
+    var settings MyModuleSettings
+    if err := json.Unmarshal(data, &settings); err != nil {
+        return nil, fmt.Errorf("parse settings: %w", err)
+    }
+
+    return &settings, nil
+}
+
+func (s *Service) UpdateSettings(username string, settings *MyModuleSettings) error {
+    if err := settings.Validate(); err != nil {
+        return err
+    }
+
+    path := s.getSettingsPath(username)
+
+    // Validate path against workspace root
+    if !strings.HasPrefix(path, s.cfg.WorkspaceRoot) {
+        return errors.New("invalid settings path")
+    }
+
+    // Ensure directory exists
+    if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+        return fmt.Errorf("create settings dir: %w", err)
+    }
+
+    data, err := json.MarshalIndent(settings, "", "  ")
+    if err != nil {
+        return fmt.Errorf("marshal settings: %w", err)
+    }
+
+    if err := os.WriteFile(path, data, 0644); err != nil {
+        return fmt.Errorf("write settings: %w", err)
+    }
+
+    return nil
+}
+
+func (s *Service) getSettingsPath(username string) string {
+    return filepath.Join(s.cfg.WorkspaceRoot, username, ".ft-webos", "mymodule.json")
+}
+```
+
+## Handler Template
+
+```go
+func (h *Handler) GetSettings(c *gin.Context) {
+    userVal, exists := c.Get("user")
+    if !exists {
+        c.JSON(http.StatusUnauthorized, gin.H{
+            "success": false,
+            "data":    nil,
+            "error":   "unauthorized",
+        })
+        return
+    }
+
+    user := userVal.(models.User)
+    settings, err := h.service.GetSettings(user.Username)
+    if err != nil {
+        logger.Error("Failed to get settings", "error", err)
+        c.JSON(http.StatusInternalServerError, gin.H{
+            "success": false,
+            "data":    nil,
+            "error":   "failed to load settings",
+        })
+        return
+    }
+
+    c.JSON(http.StatusOK, gin.H{
+        "success": true,
+        "data":    settings,
+        "error":   "",
+    })
+}
+
+func (h *Handler) UpdateSettings(c *gin.Context) {
+    userVal, exists := c.Get("user")
+    if !exists {
+        c.JSON(http.StatusUnauthorized, gin.H{
+            "success": false,
+            "data":    nil,
+            "error":   "unauthorized",
+        })
+        return
+    }
+
+    var settings MyModuleSettings
+    if err := c.ShouldBindJSON(&settings); err != nil {
+        c.JSON(http.StatusBadRequest, gin.H{
+            "success": false,
+            "data":    nil,
+            "error":   "invalid request body",
+        })
+        return
+    }
+
+    user := userVal.(models.User)
+    if err := h.service.UpdateSettings(user.Username, &settings); err != nil {
+        logger.Error("Failed to update settings", "error", err)
+        c.JSON(http.StatusBadRequest, gin.H{
+            "success": false,
+            "data":    nil,
+            "error":   err.Error(),
+        })
+        return
+    }
+
+    c.JSON(http.StatusOK, gin.H{
+        "success": true,
+        "data":    settings,
+        "error":   "",
+    })
+}
+```
+
+## Route Registration
+
+```go
+func RegisterRoutes(r *gin.RouterGroup, cfg *config.Config, db *gorm.DB) {
+    handler := NewHandler(cfg, db)
+    group := r.Group("/mymodule")
+    {
+        group.GET("/config", handler.GetSettings)
+        group.PUT("/config", handler.UpdateSettings)
+    }
+}
+```
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Using POST instead of PUT | Use PUT for updates (idempotent) |
+| Returning raw struct | Always wrap in `{"success":bool,"data":any,"error":string}` |
+| Skipping path validation | Validate against workspace root to prevent traversal |
+| Using DB for settings | Use JSON files in workspace/<username>/.ft-webos/ |
+| Endpoint named /settings | Use /config for consistency |
+| No input validation | Call `settings.Validate()` before saving |
+
+## Red Flags - STOP and Fix
+
+- Response without success/data/error envelope
+- File path not validated against workspace root
+- Endpoint not named /config
+- Settings stored in DB instead of JSON file
+- No validation before UpdateSettings
+- Swallowing errors without logging
+
+**All of these mean: Fix before proceeding.**

package/src/executor/executeRun.js

@@ -69,8 +69,8 @@ const _listTaskFiles = async (taskDir) => {
     return files.map((f) => f.name);
 };
 
-/** 提示词模板：阅读后为所选 md 的相对路径 */
-const _promptForTask = (relativePath) => `执行任务：读取当前工作目录下 ${relativePath} 的正文（frontmatter 之后），按其中要求完成任务。`;
+/** 提示词模板：阅读后为所选 md 的相对路径（统一模板） */
+const _promptForTask = (relativePath) => `执行任务：读取当前工作目录下 ${relativePath} 的正文（frontmatter 之后），按其中要求完成任务，若开启了 Team 模式则考虑使用 Team 模式执行，最多创建的 Worker（不包括Team Leader）最多5个，自动评估和创建，执行完成后 Team Leader 回写 ${relativePath} 追加 Changes 记录。`;
 
 
 module.exports = async () => {

package/src/executor/executeTask.js

@@ -117,8 +117,11 @@ const _yamlFrontmatter = (attrs) => {
     return lines.join('\n') + '\n';
 };
 
-/** 生成针对某槽位 task 文件的提示词 */
-const _taskPromptForSlot = (filename) => `执行任务：读取当前工作目录下 .r2mo/task/${filename} 的正文（frontmatter 之后），按其中要求完成任务。`;
+/** 生成针对某槽位 task 文件的提示词（统一模板） */
+const _taskPromptForSlot = (filename) => {
+    const relativePath = `.r2mo/task/${filename}`;
+    return `执行任务：读取当前工作目录下 ${relativePath} 的正文（frontmatter 之后），按其中要求完成任务，若开启了 Team 模式则考虑使用 Team 模式执行，最多创建的 Worker（不包括Team Leader）最多5个，自动评估和创建，执行完成后 Team Leader 回写 ${relativePath} 追加 Changes 记录。`;
+};
 
 module.exports = (options) => {
     try {