myagent-ai 1.32.4 → 1.32.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "myagent-ai",
-  "version": "1.32.4",
+  "version": "1.32.6",
   "description": "本地桌面端执行型AI助手 - Open Interpreter 风格 | Local Desktop Execution-Oriented AI Assistant",
   "main": "main.py",
   "bin": {

package/web/api_server.py

@@ -4331,7 +4331,8 @@ window.addEventListener('beforeunload', function() {{
         if agent:
             # [v1.27.2] 先将 agent 路径转为数字 ID，用数字 ID 精确过滤
             target_aid = self.core.memory.get_agent_id(agent) if agent else 0
-            if agent == "1":
+            # [v1.32.4] 兼容旧路径 "default" 和新路径 "1"，两者都指全权Agent
+            if agent == "1" or agent == "default":
                 # default agent: agent_id=0（未分配）或 agent_id=1（default 的数字 ID）或 旧格式
                 rows = conn.execute(
                     f"""SELECT DISTINCT session_id, COUNT(*) as cnt, MAX(created_at) as last,
@@ -4400,7 +4401,8 @@ window.addEventListener('beforeunload', function() {{
             return web.json_response({"agent": name, "sessions": []})
         # [v1.27.2] 使用数字 agent_id 精确过滤，同时兼容旧数据
         target_aid = self.core.memory.get_agent_id(name)
-        if name == "1":
+        # [v1.32.4] 兼容旧路径 "default" 和新路径 "1"
+        if name == "1" or name == "default":
             # default agent: agent_id=0 或 agent_id=1 或 旧格式
             rows = self.core.memory._get_conn().execute(
                 """SELECT DISTINCT session_id, COUNT(*) as cnt, MAX(created_at) as last FROM memories 

package/web/ui/admin/admin-platforms.js

@@ -1,11 +1,16 @@
 // ========== Platforms ==========
+// [v1.32.4] Bug修复: 1) 修复inline onclick中平台ID特殊字符导致的XSS风险
+//            2) 使用data-action事件委托替代inline onclick
+//            3) 模态框使用存储ID模式避免特殊字符注入
+var _editingPlatformId='';
+
 async function renderPlatforms(){
   const ps=await api('/api/platforms');
   if(ps.error){$('content').innerHTML='<div class="empty" style="color:var(--danger)">加载失败: '+escHtml(ps.error)+'</div>';return}
   const icons={telegram:'📱',discord:'🎮',feishu:'🐦',qq:'🐧',wechat:'💚',whatsapp:'💬'};
   let html=`<div class="flex justify-between items-center mb-16">
     <div style="color:var(--text2);font-size:13px">共 ${ps.length} 个平台实例</div>
-    <button class="btn btn-primary" onclick="showAddPlatformModal()">+ 添加平台</button></div>`;
+    <button class="btn btn-primary" data-action="addPlatform">+ 添加平台</button></div>`;
   if(!ps.length){html+='<div class="empty">暂无聊天平台配置，点击上方按钮添加</div>';$('content').innerHTML=html;return}
   html+='<div class="grid">';
   for(const p of ps){
@@ -17,7 +22,6 @@ async function renderPlatforms(){
     const _btnClass=_isEnabled?'btn-danger':'btn-success';
     const _btnText=_isEnabled?'停用':'启用';
     const _newState=!_isEnabled;
-    // [v1.23.56] 使用 data 属性避免 onclick 中特殊字符问题
     html+=`<div class="card"><div class="flex justify-between items-center">
       <h3 style="color:var(--text)">${icons[p.platform]||'📡'} ${escHtml(p.display_name||p.platform)}</h3>
       <span class="badge ${p.enabled?'badge-green':'badge-red'}">${p.enabled?'已启用':'未启用'}</span>
@@ -25,8 +29,8 @@ async function renderPlatforms(){
     ${bindInfo?'<p style="font-size:12px;color:var(--text3);margin-top:4px">'+bindInfo+'</p>':''}
     <div class="mt-8 flex gap-8">
       <button class="btn btn-sm ${_btnClass}" data-toggle-platform="${escHtml(pid)}" data-toggle-state="${_newState}">${_btnText}</button>
-      <button class="btn btn-sm btn-ghost" onclick="showEditPlatformModal('${escHtml(pid)}')">配置</button>
-      ${_supportsQR?'<button class="btn btn-sm btn-primary" onclick="showPlatformQRModal(\''+escHtml(pid)+'\')">📱 QR绑定</button>':''}
+      <button class="btn btn-sm btn-ghost" data-action="editPlatform" data-pid="${escHtml(pid)}">配置</button>
+      ${_supportsQR?'<button class="btn btn-sm btn-primary" data-action="showQR" data-pid="'+escHtml(pid)+'">📱 QR绑定</button>':''}
     </div></div>`;
   }
   html+='</div>';$('content').innerHTML=html;
@@ -69,12 +73,12 @@ function showAddPlatformModal(){
     <div class="form-group"><label>绑定 Agent</label>
       <div class="flex gap-8">
         <input id="apBindAgent" placeholder="手输 Agent ID (可选)" style="flex:1">
-        <button class="btn btn-sm btn-ghost" onclick="showAgentSelectorForPlatform('apBindAgent','apBindAgents')">选择 Agent</button>
+        <button class="btn btn-sm btn-ghost" data-action="selectAgent" data-input="apBindAgent" data-container="apBindAgents">选择 Agent</button>
       </div>
       <div id="apBindAgents" style="font-size:11px;color:var(--text3);margin-top:4px"></div>
       <div class="hint">手输 Agent ID 或点击"选择 Agent"从部门中选择。支持绑定多个 Agent。</div>
     </div>
-    <div class="flex gap-8 mt-16"><button class="btn btn-primary" onclick="doAddPlatform()">添加</button><button class="btn btn-ghost" onclick="closeModal()">取消</button></div>
+    <div class="flex gap-8 mt-16"><button class="btn btn-primary" data-action="doAddPlatform">添加</button><button class="btn btn-ghost" onclick="closeModal()">取消</button></div>
   </div></div>`;
 }
 function onPlatformTypeChange(){
@@ -95,9 +99,12 @@ async function doAddPlatform(){
   if(r.error){showToast(r.error,'danger');return}closeModal();showToast('已添加: '+(r.display_name||r.platform),'success');renderPlatforms();
 }
 async function showEditPlatformModal(id){
-  const p=await api(`/api/platforms/${id}`);
+  _editingPlatformId=id;
+  const p=await api(`/api/platforms/${encodeURIComponent(id)}`);
   if(p.error){showToast(p.error,'danger');return}
   const pid=p.id||id;
+  // 更新存储的 ID（可能因 API 返回而不同）
+  _editingPlatformId=pid;
   var bindAgentVal=p.bind_agent||'';
   var bindAgentsArr=p.bind_agents||[];
   $('modalContainer').innerHTML=`<div class="modal-overlay" onclick="closeModal()"><div class="modal" onclick="event.stopPropagation()" style="max-width:520px">
@@ -111,27 +118,29 @@ async function showEditPlatformModal(id){
     <div class="form-group"><label>绑定 Agent</label>
       <div class="flex gap-8">
         <input id="epBindAgent" value="${escHtml(bindAgentVal)}" placeholder="手输 Agent ID (可选)" style="flex:1">
-        <button class="btn btn-sm btn-ghost" onclick="showAgentSelectorForPlatform('epBindAgent','epBindAgents')">选择 Agent</button>
+        <button class="btn btn-sm btn-ghost" data-action="selectAgent" data-input="epBindAgent" data-container="epBindAgents">选择 Agent</button>
       </div>
       <div id="epBindAgents" style="font-size:11px;color:var(--text3);margin-top:4px">${bindAgentsArr.map(function(a){return '<span class="selected-agent-tag" data-agent="'+escHtml(a)+'" style="display:inline-block;background:var(--bg);border:1px solid var(--border);border-radius:4px;padding:1px 6px;margin:2px;font-size:11px;cursor:pointer" onclick="this.remove()" title="点击移除">'+escHtml(a)+' ×</span>';}).join('')}</div>
       <div class="hint">手输 Agent ID 或点击"选择 Agent"从部门中选择。一个平台可以绑定多个 Agent。</div>
     </div>
-    <div class="flex gap-8 mt-16"><button class="btn btn-primary" onclick="doSavePlatform('${escHtml(pid)}')">保存</button><button class="btn btn-danger" onclick="doDeletePlatform('${escHtml(pid)}')">删除平台</button><button class="btn btn-ghost" onclick="closeModal()">关闭</button></div>
+    <div class="flex gap-8 mt-16"><button class="btn btn-primary" data-action="doSavePlatform">保存</button><button class="btn btn-danger" data-action="doDeletePlatform">删除平台</button><button class="btn btn-ghost" onclick="closeModal()">关闭</button></div>
   </div></div>`;
 }
-async function doSavePlatform(id){
+async function doSavePlatform(){
+  var id=_editingPlatformId;if(!id){showToast('平台ID丢失','danger');return}
   var bindAgent=$('epBindAgent').value.trim();
   var bindAgents=[];
   var selectedEls=document.querySelectorAll('#epBindAgents .selected-agent-tag');
   selectedEls.forEach(function(el){var v=el.getAttribute('data-agent');if(v)bindAgents.push(v);});
   if(bindAgent)bindAgents.unshift(bindAgent);
   bindAgents=[...new Set(bindAgents)];
-  const r=await api(`/api/platforms/${id}`,{method:'PUT',body:JSON.stringify({display_name:$('epDisplayName').value,token:$('epToken').value,app_id:$('epAppId').value,app_secret:$('epSecret').value||undefined,webhook_url:$('epWebhook').value,allowed_users:$('epUsers').value.split(',').map(s=>s.trim()).filter(Boolean),bind_agent:bindAgents[0]||'',bind_agents:bindAgents})});
+  const r=await api(`/api/platforms/${encodeURIComponent(id)}`,{method:'PUT',body:JSON.stringify({display_name:$('epDisplayName').value,token:$('epToken').value,app_id:$('epAppId').value,app_secret:$('epSecret').value||undefined,webhook_url:$('epWebhook').value,allowed_users:$('epUsers').value.split(',').map(s=>s.trim()).filter(Boolean),bind_agent:bindAgents[0]||'',bind_agents:bindAgents})});
   if(r.error){showToast(r.error,'danger');return}closeModal();showToast('已保存','success');renderPlatforms();
 }
-async function doDeletePlatform(id){
+async function doDeletePlatform(){
+  var id=_editingPlatformId;if(!id){showToast('平台ID丢失','danger');return}
   showConfirm('删除平台','确认删除该平台实例吗？',async()=>{
-    const r=await api(`/api/platforms/${id}`,{method:'DELETE'});if(r.error){showToast(r.error,'danger');closeModal();return}closeModal();showToast('已删除','success');renderPlatforms();
+    const r=await api(`/api/platforms/${encodeURIComponent(id)}`,{method:'DELETE'});if(r.error){showToast(r.error,'danger');closeModal();return}closeModal();showToast('已删除','success');renderPlatforms();
   });
 }
 
@@ -139,7 +148,9 @@ async function doDeletePlatform(id){
 let _qrPollTimer=null;
 async function showPlatformQRModal(platformId){
   if(_qrPollTimer){clearInterval(_qrPollTimer);_qrPollTimer=null}
-  $('modalContainer').innerHTML='<div class="modal-overlay" onclick="closeModal();if(_qrPollTimer){clearInterval(_qrPollTimer);_qrPollTimer=null}"><div class="modal" onclick="event.stopPropagation()" style="max-width:420px;text-align:center"><h3>📱 QR 码绑定</h3><p style="font-size:13px;color:var(--text2);margin:8px 0">使用手机扫描下方二维码以绑定账号</p><div id="qrStatus" style="margin:12px 0;padding:12px;border-radius:var(--radius-sm);background:var(--bg3);font-size:13px;color:var(--text2)">正在请求 QR 码...</div><div id="qrCodeContainer" style="display:flex;justify-content:center;padding:16px 0"><div id="qrCodeImg" style="width:256px;height:256px;border:1px solid var(--bg4);border-radius:8px;display:flex;align-items:center;justify-content:center;color:var(--text3);font-size:13px">加载中...</div></div><div id="qrActions" style="display:none;margin-top:12px"><button class="btn btn-sm btn-ghost" onclick="requestNewQR(\''+escHtml(platformId)+'\')">🔄 刷新 QR 码</button></div><div class="flex gap-8 mt-16"><button class="btn btn-ghost" onclick="closeModal();if(_qrPollTimer){clearInterval(_qrPollTimer);_qrPollTimer=null}">关闭</button></div></div></div>';
+  $('modalContainer').innerHTML='<div class="modal-overlay" onclick="closeModal();if(_qrPollTimer){clearInterval(_qrPollTimer);_qrPollTimer=null}"><div class="modal" onclick="event.stopPropagation()" style="max-width:420px;text-align:center"><h3>📱 QR 码绑定</h3><p style="font-size:13px;color:var(--text2);margin:8px 0">使用手机扫描下方二维码以绑定账号</p><div id="qrStatus" style="margin:12px 0;padding:12px;border-radius:var(--radius-sm);background:var(--bg3);font-size:13px;color:var(--text2)">正在请求 QR 码...</div><div id="qrCodeContainer" style="display:flex;justify-content:center;padding:16px 0"><div id="qrCodeImg" style="width:256px;height:256px;border:1px solid var(--bg4);border-radius:8px;display:flex;align-items:center;justify-content:center;color:var(--text3);font-size:13px">加载中...</div></div><div id="qrActions" style="display:none;margin-top:12px"><button class="btn btn-sm btn-ghost" data-action="refreshQR">🔄 刷新 QR 码</button></div><div class="flex gap-8 mt-16"><button class="btn btn-ghost" onclick="closeModal();if(_qrPollTimer){clearInterval(_qrPollTimer);_qrPollTimer=null}">关闭</button></div></div></div>';
+  // 存储当前 QR 平台 ID
+  _editingPlatformId=platformId;
   var r=await api('/api/platforms/'+encodeURIComponent(platformId)+'/qr',{method:'POST'});
   if(r.error){$('qrStatus').textContent='错误: '+escHtml(r.error);return}
   if(r.qr_code){
@@ -184,10 +195,14 @@ async function requestNewQR(platformId){
 // Agent 选择器（从部门树选择 Agent）
 // [v1.23.56] 修复: 不再覆盖 modalContainer，而是保存/恢复编辑表单 HTML
 var _savedEditModalHtml='';
+var _agentSelectorInputId='';
+var _agentSelectorContainerId='';
 async function showAgentSelectorForPlatform(inputId,containerId){
   try{
     // 保存当前编辑表单 HTML
     _savedEditModalHtml=$('modalContainer').innerHTML;
+    _agentSelectorInputId=inputId;
+    _agentSelectorContainerId=containerId;
     var agents=await api('/api/agents');
     if(!Array.isArray(agents)){showToast('加载 Agent 列表失败','danger');return}
     var agentList=agents.filter(function(a){return!a.system&&a.path!=='default'});
@@ -214,18 +229,18 @@ async function showAgentSelectorForPlatform(inputId,containerId){
       });
       html+='</div>';
     }
-    html+='<div class="flex gap-8 mt-16"><button class="btn btn-primary" onclick="confirmAgentSelection(\''+inputId+'\',\''+containerId+'\')">确定</button><button class="btn btn-ghost" onclick="cancelAgentSelection()">取消</button></div></div></div>';
+    html+='<div class="flex gap-8 mt-16"><button class="btn btn-primary" data-action="confirmAgentSelection">确定</button><button class="btn btn-ghost" data-action="cancelAgentSelection">取消</button></div></div></div>';
     $('modalContainer').innerHTML=html;
   }catch(e){showToast('加载失败: '+e.message,'danger')}
 }
-function confirmAgentSelection(inputId,containerId){
+function confirmAgentSelection(){
   // 收集选中的 agent 列表
   var checked=[];
   document.querySelectorAll('.modal input[type="checkbox"]:checked').forEach(function(cb){checked.push(cb.value);});
   // 恢复编辑表单
   if(_savedEditModalHtml){$('modalContainer').innerHTML=_savedEditModalHtml;_savedEditModalHtml='';}
   // 更新编辑表单中的 agent 标签
-  var container=document.getElementById(containerId);
+  var container=document.getElementById(_agentSelectorContainerId);
   if(container){
     container.innerHTML='';
     checked.forEach(function(agentPath){
@@ -240,7 +255,7 @@ function confirmAgentSelection(inputId,containerId){
     });
   }
   // 同步第一个到输入框
-  var input=document.getElementById(inputId);
+  var input=document.getElementById(_agentSelectorInputId);
   if(input){input.value=checked[0]||'';}
 }
 function cancelAgentSelection(){
@@ -254,3 +269,37 @@ function toggleAgentSelection(cb,inputId,containerId){
 
 if (typeof window._adminRenderers === 'undefined') window._adminRenderers = {};
 window._adminRenderers['platforms'] = renderPlatforms;
+
+// [v1.32.4] 事件委托: 处理平台管理页面的 data-action 按钮（防止 XSS 注入）
+document.addEventListener('click', function(e) {
+  var btn = e.target.closest('[data-action]');
+  if (!btn) return;
+  var action = btn.getAttribute('data-action');
+
+  // 主内容区按钮（data-page=platforms）
+  if (btn.closest('#content')?.getAttribute('data-page') === 'platforms') {
+    switch (action) {
+      case 'addPlatform': showAddPlatformModal(); break;
+      case 'editPlatform': showEditPlatformModal(btn.getAttribute('data-pid') || ''); break;
+      case 'showQR': showPlatformQRModal(btn.getAttribute('data-pid') || ''); break;
+    }
+  }
+
+  // 模态框内的按钮（不在 #content 内，需要单独处理）
+  if (btn.closest('#modalContainer')) {
+    switch (action) {
+      case 'doAddPlatform': doAddPlatform(); break;
+      case 'doSavePlatform': doSavePlatform(); break;
+      case 'doDeletePlatform': doDeletePlatform(); break;
+      case 'selectAgent':
+        showAgentSelectorForPlatform(
+          btn.getAttribute('data-input') || '',
+          btn.getAttribute('data-container') || ''
+        );
+        break;
+      case 'confirmAgentSelection': confirmAgentSelection(); break;
+      case 'cancelAgentSelection': cancelAgentSelection(); break;
+      case 'refreshQR': requestNewQR(_editingPlatformId); break;
+    }
+  }
+});

package/web/ui/admin/admin-sessions.js

@@ -1,4 +1,8 @@
 // ========== Sessions ==========
+// [v1.32.4] Bug修复: 1) 修复硬编码agentDbId=1导致切入会话跳转错误Agent
+//            2) 修复inline onclick的XSS风险（改用data-action事件委托）
+//            3) 修复"返回查看"导航错误（应返回消息视图而非会话列表）
+//            4) 修复"清除"操作无确认提示
 async function renderSessions(){
   const ss=await api('/api/sessions');
   if(!ss||!ss.length){
@@ -22,19 +26,22 @@ async function renderSessions(){
     const displayName=s.display_name||s.id;
     const dbId=s.agent_db_id||1;
     html+=`<tr><td title="${escHtml(s.id)}">${escHtml(displayName.length>30?displayName.slice(0,30)+'...':displayName)}</td><td>${escHtml(agentName)}</td><td>${s.messages}</td><td>${s.last?.slice(0,19)||''}</td>
-      <td><button class="btn btn-sm" style="background:var(--success);color:#fff" onclick="enterSession('${escHtml(s.id)}',${dbId})">切入</button>
-      <button class="btn btn-sm btn-ghost" onclick="viewSession('${escHtml(s.id)}')">查看</button>
-      <button class="btn btn-sm btn-danger" onclick="clearSession('${escHtml(s.id)}')">清除</button></td></tr>`;}
+      <td><button class="btn btn-sm" style="background:var(--success);color:#fff" data-action="enterSession" data-sid="${escHtml(s.id)}" data-aid="${dbId}">切入</button>
+      <button class="btn btn-sm btn-ghost" data-action="viewSession" data-sid="${escHtml(s.id)}" data-aid="${dbId}">查看</button>
+      <button class="btn btn-sm btn-danger" data-action="clearSession" data-sid="${escHtml(s.id)}">清除</button></td></tr>`;}
   html+='</table></div>';
   $('content').innerHTML=html;
 }
-async function viewSession(sid){
-  window._viewSessionSid=sid;window._viewSessionOffset=0;
+async function viewSession(sid, agentDbId){
+  window._viewSessionSid=sid;
+  window._viewSessionAgentDbId=agentDbId||1;
+  window._viewSessionOffset=0;
   _navSubState='view:'+sid;
   navigateTo('sessions','view:'+sid,_loadSessionMessages);
 }
 async function _loadSessionMessages(){
   const sid=window._viewSessionSid;if(!sid)return;
+  const agentDbId=window._viewSessionAgentDbId||1;
   const offset=window._viewSessionOffset||0;
   const msgs=await api(`/api/session/messages?sid=${encodeURIComponent(sid)}&limit=100&offset=${offset}`);
   if(!Array.isArray(msgs)){showToast('加载失败','danger');return}
@@ -79,15 +86,15 @@ async function _loadSessionMessages(){
       html+=`<div style="flex-shrink:0;font-size:16px;margin-top:2px">${avatar}</div>`;
       html+=`<div class="msg-bubble-wrap" style="min-width:0"><div style="font-size:11px;color:var(--text3);margin-bottom:2px;${isUser?'text-align:right':''}">${isUser?'用户':'助手'} <span style="margin-left:4px">${time}</span></div>`;
       html+=`<div style="background:${bg};color:${fg};padding:10px 14px;border-radius:var(--radius);font-size:13px;line-height:1.6;white-space:pre-wrap;word-break:break-word">${escHtml(displayContent)}</div>`;
-      if(long)html+=`<button class="btn btn-sm btn-ghost" style="margin-top:4px;font-size:11px" onclick="this.previousElementSibling.textContent=this.dataset.full;this.remove()" data-full="${escHtml(content).replace(/"/g,'&quot;')}">展开全部 (${content.length}字符)</button>`;
+      if(long)html+=`<button class="btn btn-sm btn-ghost" style="margin-top:4px;font-size:11px" data-action="expandMsg" data-full="${escHtml(content).replace(/"/g,'&quot;')}">展开全部 (${content.length}字符)</button>`;
       html+=`</div></div>`;
     }
   }
   html+='</div>';
-  if(hasMore)html+=`<button class="btn btn-ghost mt-8" onclick="window._viewSessionOffset=${offset+100};_loadSessionMessages()">加载更多...</button>`;
-  html+='<div class="flex gap-8 mt-8"><button class="btn btn-ghost" onclick="goBack()">返回</button>';
-  html+=`<button class="btn" style="background:var(--accent);color:#fff" onclick="viewSessionRaw('${escHtml(sid)}')">Raw 原始消息</button>`;
-  html+=`<button class="btn btn-primary" onclick="enterSession('${escHtml(sid)}',1)">在聊天中查看完整记录</button></div>`;
+  if(hasMore)html+=`<button class="btn btn-ghost mt-8" data-action="loadMore" data-offset="${offset+100}">加载更多...</button>`;
+  html+='<div class="flex gap-8 mt-8"><button class="btn btn-ghost" data-action="backToSessions">返回</button>';
+  html+=`<button class="btn" style="background:var(--accent);color:#fff" data-action="viewRaw" data-sid="${escHtml(sid)}">Raw 原始消息</button>`;
+  html+=`<button class="btn btn-primary" data-action="enterSessionChat" data-sid="${escHtml(sid)}" data-aid="${agentDbId}">在聊天中查看完整记录</button></div>`;
   $('content').innerHTML=html;
 }
 // ========== Raw 原始消息查看 ==========
@@ -96,7 +103,7 @@ var _rawMsgsCache=[];
 async function viewSessionRaw(sid){
   window._viewSessionSid=sid;
   _navSubState='raw:'+sid;
-  _navHistory.push({page:currentPage,sub:window._navSubState});
+  _navHistory.push({page:currentPage,sub:'view:'+sid});
   if(_navHistory.length>6)_navHistory.shift();
   var hash='sessions'+'~raw:'+sid;
   history.pushState({page:'sessions',sub:'raw:'+sid},'','#'+hash);
@@ -158,8 +165,8 @@ function _renderRawView(msgs,sid){
     html+=`</div></div>`;
   }
   html+=`</div>`;
-  html+=`<div class="flex gap-8 mt-8"><button class="btn btn-ghost" onclick="goBack()">返回查看</button>`;
-  html+=`<button class="btn btn-ghost" onclick="goBack()">返回会话列表</button></div>`;
+  html+=`<div class="flex gap-8 mt-8"><button class="btn btn-ghost" data-action="backToMsgView">返回查看</button>`;
+  html+=`<button class="btn btn-ghost" data-action="backToSessions">返回会话列表</button></div>`;
   $('content').innerHTML=html;
   _buildTimeNav(msgs);
 }
@@ -232,7 +239,14 @@ function _buildTimeNav(msgs){
   }
   nav.innerHTML=navHtml;
 }
-async function clearSession(sid){await api(`/api/session?sid=${encodeURIComponent(sid)}`,{method:'DELETE'});renderSessions()}
+async function clearSession(sid){
+  showConfirm('清除会话', '确定要清除该会话的所有消息吗？此操作不可恢复。', async function(){
+    var r = await api(`/api/session?sid=${encodeURIComponent(sid)}`,{method:'DELETE'});
+    if(r.error){showToast('清除失败: '+r.error,'danger');return}
+    showToast('会话已清除','success');
+    renderSessions();
+  });
+}
 // 切入会话: 打开聊天页面并自动加载指定会话
 // [v1.27.2] 使用 aid（数字 agent ID）+ s（编码 session ID），不再暴露明文 agent 名字
 function enterSession(sid,agentDbId){
@@ -241,3 +255,44 @@ function enterSession(sid,agentDbId){
 
 if (typeof window._adminRenderers === 'undefined') window._adminRenderers = {};
 window._adminRenderers['sessions'] = renderSessions;
+
+// [v1.32.4] 事件委托: 处理会话管理页面的 data-action 按钮（防止 XSS 注入）
+document.addEventListener('click', function(e) {
+  var btn = e.target.closest('[data-action]');
+  if (!btn) return;
+  var action = btn.getAttribute('data-action');
+
+  // 会话列表页按钮（data-page=sessions）
+  if (btn.closest('#content')?.getAttribute('data-page') === 'sessions') {
+    var sid = btn.getAttribute('data-sid') || '';
+    var aid = parseInt(btn.getAttribute('data-aid')) || 1;
+    switch (action) {
+      case 'enterSession': enterSession(sid, aid); break;
+      case 'viewSession': viewSession(sid, aid); break;
+      case 'clearSession': clearSession(sid); break;
+      case 'viewRaw': viewSessionRaw(sid); break;
+      case 'enterSessionChat': enterSession(sid, aid); break;
+      case 'loadMore':
+        window._viewSessionOffset = parseInt(btn.getAttribute('data-offset')) || 0;
+        _loadSessionMessages();
+        break;
+      case 'backToSessions':
+        _navSubState = null;
+        renderSessions();
+        break;
+      case 'backToMsgView':
+        // 返回消息视图（不回到列表）
+        _navSubState = 'view:' + (window._viewSessionSid || '');
+        _loadSessionMessages();
+        break;
+      case 'expandMsg':
+        // 展开长消息
+        var prev = btn.previousElementSibling;
+        if (prev && btn.dataset.full) {
+          prev.textContent = btn.dataset.full;
+          btn.remove();
+        }
+        break;
+    }
+  }
+});

package/web/ui/admin/admin-sites.js

@@ -1,5 +1,7 @@
 // ========== Site Management ==========
 // [v1.31.1] 网站注册/浏览器Profile统一管理
+// [v1.32.4] Bug修复: 1) 修复模态框inline onclick中网站名称特殊字符导致的XSS风险
+//            2) 使用data-action事件委托+存储ID模式替代inline onclick
 
 const SITE_CAT_ICONS = {
   email: '\u{1F4E7}', social: '\u{1F4AC}', cloud: '\u2601\uFE0F',
@@ -12,6 +14,8 @@ const SITE_CAT_LABELS = {
 
 let _sitesFilter = '';
 let _sitesProfileView = false;
+// 存储当前正在操作/编辑的网站名称（避免在onclick中传递，防XSS）
+var _editingSiteName = '';
 
 async function renderSites() {
   _sitesProfileView = false;
@@ -44,8 +48,8 @@ async function renderSites() {
     '</div>' +
     '<div class="flex gap-8">' +
     '<input id="siteSearch" placeholder="搜索网站..." style="width:200px" oninput="filterSites()">' +
-    '<button class="btn btn-primary btn-sm" onclick="showAddSiteModal()">+ 添加网站</button>' +
-    '<button class="btn btn-ghost btn-sm" onclick="initAllProfiles()">初始化所有 Profile</button>' +
+    '<button class="btn btn-primary btn-sm" data-action="addSite">+ 添加网站</button>' +
+    '<button class="btn btn-ghost btn-sm" data-action="initAllProfiles">初始化所有 Profile</button>' +
     '</div></div>';
 
   // Render each category group
@@ -121,6 +125,7 @@ function filterSites() {
 
 // ── View Site Detail ──
 async function viewSiteDetail(name) {
+  _editingSiteName = name;
   var s = await api('/api/sites/' + encodeURIComponent(name));
   if (s.error) { showToast(s.error, 'danger'); return; }
 
@@ -166,8 +171,8 @@ async function viewSiteDetail(name) {
     urlsHtml + tipsHtml + profileInfo +
     '<div class="flex gap-8 mt-16">' +
     '<button class="btn btn-ghost" onclick="closeModal()">关闭</button>' +
-    (!s.is_builtin ? '<button class="btn btn-primary" onclick="closeModal();editSiteModal(\'' + escHtml(s.name) + '\')">编辑</button>' : '') +
-    '<button class="btn btn-ghost" onclick="initSiteProfile(\'' + escHtml(s.name) + '\');closeModal()">初始化 Profile</button>' +
+    (!s.is_builtin ? '<button class="btn btn-primary" data-action="editSiteFromModal">编辑</button>' : '') +
+    '<button class="btn btn-ghost" data-action="initProfileFromModal">初始化 Profile</button>' +
     '</div>';
 
   $('modalContainer').innerHTML = '<div class="modal-overlay" onclick="closeModal()"><div class="modal" onclick="event.stopPropagation()" style="max-width:600px">' + html + '</div></div>';
@@ -197,7 +202,7 @@ function showAddSiteModal() {
     '<div class="form-group"><label>登录检测 URL</label>' +
     '<input id="siteFormDetectUrl" placeholder="https://example.com/dashboard"></div>' +
     '<div class="flex gap-8 mt-16">' +
-    '<button class="btn btn-primary" onclick="doAddSite()">添加</button>' +
+    '<button class="btn btn-primary" data-action="doAddSite">添加</button>' +
     '<button class="btn btn-ghost" onclick="closeModal()">取消</button>' +
     '</div>';
 
@@ -227,6 +232,7 @@ async function doAddSite() {
 
 // ── Edit Site Modal ──
 async function editSiteModal(name) {
+  _editingSiteName = name;
   var s = await api('/api/sites/' + encodeURIComponent(name));
   if (s.error) { showToast(s.error, 'danger'); return; }
 
@@ -252,14 +258,16 @@ async function editSiteModal(name) {
     '<div class="form-group"><label>登录检测 URL</label>' +
     '<input id="editSiteDetectUrl" value="' + escHtml(s.detect_url || '') + '"></div>' +
     '<div class="flex gap-8 mt-16">' +
-    '<button class="btn btn-primary" onclick="doUpdateSite(\'' + escHtml(s.name) + '\')">保存</button>' +
+    '<button class="btn btn-primary" data-action="doUpdateSite">保存</button>' +
     '<button class="btn btn-ghost" onclick="closeModal()">取消</button>' +
     '</div>';
 
   $('modalContainer').innerHTML = '<div class="modal-overlay" onclick="closeModal()"><div class="modal" onclick="event.stopPropagation()" style="max-width:500px">' + html + '</div></div>';
 }
 
-async function doUpdateSite(name) {
+async function doUpdateSite() {
+  var name = _editingSiteName;
+  if (!name) { showToast('网站名称丢失', 'danger'); return; }
   var data = {
     display_name: $('editSiteDisplay')?.value || '',
     category: $('editSiteCategory')?.value || 'custom',
@@ -342,18 +350,41 @@ if (typeof window._adminRenderers === 'undefined') window._adminRenderers = {};
 window._adminRenderers['sites'] = renderSites;
 
 // [v1.31.4] 事件委托: 处理网站管理页面的 data-action 按钮（防止 XSS 注入）
+// [v1.32.4] 扩展事件委托：同时处理内容区和模态框内的按钮
 document.addEventListener('click', function(e) {
   var btn = e.target.closest('[data-action]');
-  if (!btn || btn.closest('#content')?.getAttribute('data-page') !== 'sites') return;
+  if (!btn) return;
   var action = btn.getAttribute('data-action');
   var name = btn.getAttribute('data-name') || '';
-  switch (action) {
-    case 'viewSite': viewSiteDetail(name); break;
-    case 'editSite': editSiteModal(name); break;
-    case 'removeSite': removeSite(name); break;
-    case 'openBrowser': openSiteBrowser(name); break;
-    case 'closeBrowser': closeSiteBrowser(name); break;
-    case 'deleteProfile': deleteSiteProfile(name); break;
-    case 'initProfile': initSiteProfile(name); break;
+
+  // 主内容区按钮（data-page=sites）
+  if (btn.closest('#content')?.getAttribute('data-page') === 'sites') {
+    switch (action) {
+      case 'viewSite': viewSiteDetail(name); break;
+      case 'editSite': editSiteModal(name); break;
+      case 'removeSite': removeSite(name); break;
+      case 'openBrowser': openSiteBrowser(name); break;
+      case 'closeBrowser': closeSiteBrowser(name); break;
+      case 'deleteProfile': deleteSiteProfile(name); break;
+      case 'initProfile': initSiteProfile(name); break;
+      case 'addSite': showAddSiteModal(); break;
+      case 'initAllProfiles': initAllProfiles(); break;
+    }
+  }
+
+  // 模态框内的按钮
+  if (btn.closest('#modalContainer')) {
+    switch (action) {
+      case 'doAddSite': doAddSite(); break;
+      case 'doUpdateSite': doUpdateSite(); break;
+      case 'editSiteFromModal':
+        closeModal();
+        if (_editingSiteName) editSiteModal(_editingSiteName);
+        break;
+      case 'initProfileFromModal':
+        if (_editingSiteName) initSiteProfile(_editingSiteName);
+        closeModal();
+        break;
+    }
   }
 });

package/web/ui/admin/admin-skills.js

@@ -148,7 +148,7 @@ function guideRowHtml(s){
   const isDisabled=s.disabled;
   const refTag=(s.references||[]).length>0?`<span class="tag">${s.references.length} 参考资料</span>`:'';
   const tplTag=s.has_templates?'<span class="tag">含模板</span>':'';
-  const scriptTag=s.has_scripts?'<span class="tag">含脚本</span>`:'';
+  const scriptTag=s.has_scripts?'<span class="tag">含脚本</span>':'';
   const catBadge=s.category?`<span class="badge badge-purple">${escHtml(s.category)}</span>`:'';
   return `<div class="skill-row" data-name="${escHtml(s.name||'')}" data-desc="${escHtml(s.description||'')}">
     <div style="flex-shrink:0;width:36px;text-align:center;font-size:18px">📝</div>

package/web/ui/chat/chat_main.js

@@ -150,7 +150,7 @@ function popoutChat() {
   const h = Math.min(720, screen.height - 100);
   const left = Math.round((screen.width - w) / 2);
   const top = Math.round((screen.height - h) / 2);
-  window.open(popoutUrl, 'myagent_popout_' + (state.activeAgent || 'default'), 'width=' + w + ',height=' + h + ',left=' + left + ',top=' + top + ',menubar=no,toolbar=no,location=no,status=no,scrollbars=yes,resizable=yes');
+  window.open(popoutUrl, 'myagent_popout_' + (state.activeAgent || '1'), 'width=' + w + ',height=' + h + ',left=' + left + ',top=' + top + ',menubar=no,toolbar=no,location=no,status=no,scrollbars=yes,resizable=yes');
 }
 
 // Override toggleAgentPanel for mobile (deferred since function is defined later)
@@ -227,11 +227,11 @@ const state = {
   // ── Agent state (层级体系) ──
   agentTree: [],         // 树形结构 [{path, name, children: [...], ...}]
   agentsFlat: [],        // 扁平列表 [{path, name, parent, depth, ...}]
-  activeAgent: 'default',
+  activeAgent: '1',
   agentPanelOpen: true,
   agentSessions: {},     // {agentPath: [{id, name, messages, last}]}
   agentDetails: {},      // {agentPath: {soul, identity, model, ...}}
-  expandedNodes: new Set(['default']),  // 树形展开状态
+  expandedNodes: new Set(['1']),  // 树形展开状态
   modelsLibrary: [],     // 模型库 [{id, name, provider, model, base_url, enabled, has_api_key, ...}]
   // ── Message queue during generation ──
   pendingMessages: [],   // 待发送的消息队列 [{text, time}]
@@ -330,7 +330,7 @@ const StatePersistence = {
     // 持久化当前活跃会话ID，用于页面刷新后恢复
     if (state.activeSessionId && state.activeSessionId !== '__new__') {
       StatePersistence.save('activeSessionId', state.activeSessionId);
-      StatePersistence.save('activeSessionAgent', state.activeAgent || 'default');
+      StatePersistence.save('activeSessionAgent', state.activeAgent || '1');
     }
     // 持久化当前会话的滚动位置（立即保存，不防抖）
     if (typeof saveScrollPosition === 'function') {
@@ -344,12 +344,12 @@ const StatePersistence = {
   },
   /** 恢复 UI 状态 */
   restoreUIState() {
-    state.activeAgent = StatePersistence.load('activeAgent', 'default');
+    state.activeAgent = StatePersistence.load('activeAgent', '1');
     state.chatMode = StatePersistence.load('chatMode', 'exec');
     state.agentPanelOpen = StatePersistence.load('agentPanelOpen', true);
     var savedRpSections = StatePersistence.load('rpSections');
     if (savedRpSections) { Object.assign(rpSections, savedRpSections); }
-    const savedNodes = StatePersistence.load('expandedNodes', ['default']);
+    const savedNodes = StatePersistence.load('expandedNodes', ['1']);
     state.expandedNodes = new Set(savedNodes);
     // 恢复上次活跃的会话 ID，供 loadSessions() 使用
     var savedSessionId = StatePersistence.load('activeSessionId', null);
@@ -529,23 +529,23 @@ async function initChat() {
   } else if (urlAgent) {
     var resolved = urlAgent;
     if (!findAgentByPath(resolved)) {
-      console.warn('URL agent not found, fallback to default:', resolved);
-      resolved = 'default';
+      console.warn('URL agent not found, fallback to master:', resolved);
+      resolved = findMasterAgentPath();
     }
     if (resolved !== state.activeAgent) {
       selectAgent(resolved);
     }
   } else if (urlSession) {
     // 只有 session 没有 agent，尝试从 session ID 推断 agent（兼容旧格式 agent_web_xxx）
-    var targetAgent = 'default';
+    var targetAgent = findMasterAgentPath();
     if (urlSession.indexOf('_web_') >= 0) {
-      targetAgent = urlSession.split('_web_')[0] || 'default';
+      targetAgent = urlSession.split('_web_')[0] || findMasterAgentPath();
     }
-    // 新格式 sess_xxx 无法推断 agent，回退 default
+    // 新格式 sess_xxx 无法推断 agent，回退 master
     var target = targetAgent;
     if (!findAgentByPath(target)) {
-      console.warn('Session-inferred agent not found, fallback to default:', target);
-      target = 'default';
+      console.warn('Session-inferred agent not found, fallback to master:', target);
+      target = findMasterAgentPath();
     }
     if (target !== state.activeAgent) {
       selectAgent(target);
@@ -835,7 +835,7 @@ function hasTaskListChanged() {
 
 async function loadTaskPlan() {
   try {
-    var agent = state.activeAgent || 'default';
+    var agent = state.activeAgent || '1';
     var session = state.activeSessionId || '';
     var url = '/api/task-plan?agent=' + encodeURIComponent(agent);
     if (session) url += '&session=' + encodeURIComponent(session);
@@ -906,7 +906,7 @@ async function toggleTaskDone(idx) {
     t.done = !t.done;
   }
   try {
-    var agent = state.activeAgent || 'default';
+    var agent = state.activeAgent || '1';
     var session = state.activeSessionId || '';
     await api('/api/task-plan', {
       method: 'PUT',
@@ -931,7 +931,7 @@ async function addTaskItem() {
   if (!text) return;
   input.value = '';
   try {
-    var agent = state.activeAgent || 'default';
+    var agent = state.activeAgent || '1';
     var session = state.activeSessionId || '';
     var data = await api('/api/task-plan', {
       method: 'POST',
@@ -948,7 +948,7 @@ async function addTaskItem() {
 async function deleteTaskItem(idx) {
  if (idx < 0 || idx >= state.taskItems.length) return;
   try {
-    var agent = state.activeAgent || 'default';
+    var agent = state.activeAgent || '1';
     var session = state.activeSessionId || '';
     var url = '/api/task-plan/' + idx + '?agent=' + encodeURIComponent(agent);
     if (session) url += '&session=' + encodeURIComponent(session);
@@ -1822,6 +1822,28 @@ function findAgentByPath(path) {
   return state.agentsFlat.find(function(a) { return a.path === path; });
 }
 
+// [v1.32.4] 查找系统级 Agent 的路径（兼容旧路径 'default'/'配置助手' 和新路径 '1'/'2'）
+function findMasterAgentPath() {
+  // 优先按新路径 "1"，兼容旧路径 "default"，再按 system 标志+名称兜底
+  var a = state.agentsFlat.find(function(x) { return x.path === '1'; })
+    || state.agentsFlat.find(function(x) { return x.path === 'default'; })
+    || state.agentsFlat.find(function(x) { return x.system && x.name === '全权Agent'; })
+    || state.agentsFlat.find(function(x) { return x.system; });
+  return a ? a.path : 'default';
+}
+function findHelperAgentPath() {
+  var a = state.agentsFlat.find(function(x) { return x.path === '2'; })
+    || state.agentsFlat.find(function(x) { return x.path === '配置助手'; })
+    || state.agentsFlat.find(function(x) { return x.system && x.name === '配置助手'; })
+    || null;
+  return a ? a.path : null;
+}
+function isSystemAgentPath(path) {
+  var mp = findMasterAgentPath();
+  var hp = findHelperAgentPath();
+  return path === mp || (hp !== null && path === hp);
+}
+
 function getActiveAgentObj() {
   return findAgentByPath(state.activeAgent);
 }
@@ -1832,18 +1854,16 @@ async function loadAgents() {
     state.agentTree = treeData || [];
     state.agentsFlat = flattenTree(state.agentTree, 0, null);
 
-    if (!state.agentsFlat.find(function(a) { return a.path === 'default'; })) {
-      var defAgent = {path:'default', name:'default', depth:0, parent:null, description:'默认助手', avatar_emoji:'🤖', execution_mode:'local', avatar_color:getAgentColorClass('default'), session_count:0};
-      state.agentsFlat.unshift(defAgent);
-      state.agentTree.unshift(Object.assign({}, defAgent, {children:[]}));
-    }
+    // [v1.32.4] 兼容旧路径：如果后端没有 path='default' 的 agent，不创建合成的 fake agent
+    // 而是依赖 findMasterAgentPath() 来正确解析 master agent 路径
+    var _masterPath = findMasterAgentPath();
 
     for (var i = 0; i < state.agentsFlat.length; i++) {
       state.expandedNodes.add(state.agentsFlat[i].path);
     }
 
     if (!state.activeAgent || !findAgentByPath(state.activeAgent)) {
-      state.activeAgent = 'default';
+      state.activeAgent = _masterPath;
     }
 
     renderAgentTree();
@@ -1852,10 +1872,10 @@ async function loadAgents() {
     await loadSessions();
     loadAllAgentSessions(); // fire-and-forget, will update recent agents
   } catch (e) {
-    var defAgent = {path:'default', name:'default', depth:0, parent:null, description:'默认助手', avatar_emoji:'🤖', execution_mode:'local', avatar_color:getAgentColorClass('default'), session_count:0};
+    var defAgent = {path:'1', name:'全权Agent', depth:0, parent:null, description:'全权Agent - 拥有完整权限的本地助手', avatar_emoji:'🤖', execution_mode:'local', system:true, avatar_color:getAgentColorClass('全权Agent'), session_count:0};
     state.agentsFlat = [defAgent];
     state.agentTree = [Object.assign({}, defAgent, {children:[]})];
-    state.activeAgent = 'default';
+    state.activeAgent = '1';
     renderAgentTree();
     updateActiveAgentBadge();
     updateExecModeUI();
@@ -1909,18 +1929,20 @@ function renderRightPanelSections() {
 function renderMasterAgentCard() {
   var el = document.getElementById('rpMasterAgent');
   if (!el) return;
-  var agent = findAgentByPath('default');
-  var isActive = state.activeAgent === 'default';
+  // [v1.32.4] 使用 findMasterAgentPath() 兼容旧路径 'default' 和新路径 '1'
+  var masterPath = findMasterAgentPath();
+  var agent = findAgentByPath(masterPath);
+  var isActive = state.activeAgent === masterPath;
   var name = agent ? agent.name : '全权Agent';
   var emoji = agent ? (agent.avatar_emoji || '🛡️') : '🛡️';
   var desc = agent ? (agent.description || '拥有完整权限的本地助手') : '拥有完整权限的本地助手';
   var color = agent ? (agent.avatar_color || 'linear-gradient(135deg,#6366f1,#8b5cf6)') : 'linear-gradient(135deg,#6366f1,#8b5cf6)';
   var bgStyle = color.includes('gradient') ? 'background:' + color : '';
-  var bgClass = color.includes('gradient') ? '' : getAgentColorClass('default');
+  var bgClass = color.includes('gradient') ? '' : getAgentColorClass(masterPath);
   // [v1.20.9] 修复: avatar_image 不为空时显示图片，onerror 回退到 emoji
   var avatarContent = (agent && agent.avatar_image) ? '<img src="' + escapeHtml(agent.avatar_image) + '" style="width:100%;height:100%;object-fit:cover;border-radius:12px" onerror="this.outerHTML=\'' + escapeHtml(emoji) + '\'">' : emoji;
 
-  el.innerHTML = '<div class="rp-master-card ' + (isActive ? 'active' : '') + '" onclick="selectAgent(\'default\')">'
+  el.innerHTML = '<div class="rp-master-card ' + (isActive ? 'active' : '') + '" onclick="selectAgent(\'' + escapeHtml(masterPath) + '\')">'
     + '<div class="rp-master-avatar ' + bgClass + '" style="' + bgStyle + '">' + avatarContent + '</div>'
     + '<div class="rp-master-info">'
     + '<div class="rp-master-name">' + escapeHtml(name) + '</div>'
@@ -1931,8 +1953,11 @@ function renderMasterAgentCard() {
 function renderHelperAgentCard() {
   var el = document.getElementById('rpHelperAgent');
   if (!el) return;
-  var agent = findAgentByPath('配置助手');
-  var isActive = state.activeAgent === '配置助手';
+  // [v1.32.4] 使用 findHelperAgentPath() 兼容旧路径 '配置助手' 和新路径 '2'
+  var helperPath = findHelperAgentPath();
+  if (!helperPath) { el.innerHTML = ''; return; }  // 无配置助手则不渲染
+  var agent = findAgentByPath(helperPath);
+  var isActive = state.activeAgent === helperPath;
   var name = agent ? agent.name : '配置助手';
   var emoji = agent ? (agent.avatar_emoji || '🛡️') : '🛡️';
   var desc = agent ? (agent.description || '智能配置助手') : '智能配置助手';
@@ -1945,7 +1970,7 @@ function renderHelperAgentCard() {
     avatarContent = emoji;
   }
 
-  el.innerHTML = '<div class="rp-helper-card ' + (isActive ? 'active' : '') + '" onclick="selectAgent(\'配置助手\')">'
+  el.innerHTML = '<div class="rp-helper-card ' + (isActive ? 'active' : '') + '" onclick="selectAgent(\'' + escapeHtml(helperPath) + '\')">'
     + '<div class="rp-helper-avatar" style="' + (avatarImage ? 'background:transparent' : '') + '">' + avatarContent + '</div>'
     + '<div class="rp-master-info">'
     + '<div class="rp-master-name" style="font-size:13px">' + escapeHtml(name) + '</div>'
@@ -1962,7 +1987,7 @@ async function renderRecentAgents() {
   var recentAgents = [];
 
   for (var key in state.agentSessions) {
-    if (key === 'default' || key === '配置助手') continue;
+    if (isSystemAgentPath(key)) continue;
     var sessions = state.agentSessions[key];
     if (sessions && sessions.length > 0) {
       var agent = findAgentByPath(key);
@@ -2168,10 +2193,10 @@ function quickChatAgent(agentPath) {
 }
 
 async function selectAgent(agentPath) {
-  // 安全校验：agent 必须在已加载的列表中存在，否则回退 default
+  // 安全校验：agent 必须在已加载的列表中存在，否则回退 master agent
   if (!findAgentByPath(agentPath)) {
-    console.warn('selectAgent: agent not found, fallback to default:', agentPath);
-    agentPath = 'default';
+    console.warn('selectAgent: agent not found, fallback to master:', agentPath);
+    agentPath = findMasterAgentPath();
   }
   // 从群聊视图切换回个人聊天视图
   if (currentView === 'group') {
@@ -2575,7 +2600,7 @@ async function saveAgentModal(editPath, parentPath) {
 }
 
 async function deleteAgent(agentPath) {
-  if (agentPath === 'default') { toast('不能删除默认 Agent', 'error'); return; }
+  if (agentPath === findMasterAgentPath()) { toast('不能删除默认 Agent', 'error'); return; }
   var msg = '确定删除 Agent "' + agentPath + '" 吗？\n\n删除后将同时清理：\n  📁 工作目录及所有文件\n  💬 该 Agent 的所有会话历史\n  🧠 相关记忆数据\n  🔗 所有子 Agent\n\n⚠️ 此操作不可撤销！';
   if (!confirm(msg)) return;
   try {
@@ -2583,7 +2608,7 @@ async function deleteAgent(agentPath) {
     toast('Agent 已删除', 'success');
     closeAgentModal();
     if (state.activeAgent === agentPath || state.activeAgent.startsWith(agentPath + '/')) {
-      state.activeAgent = 'default';
+      state.activeAgent = findMasterAgentPath();
     }
     await loadAgents();
   } catch (e) {
@@ -5120,7 +5145,8 @@ function skipSetup() {
   StatePersistence.markSetupDone();
   try { api('/api/setup/complete', { method: 'POST' }); } catch(e) {}
   // 自动切换到配置助手 Agent
-  selectAgent('配置助手');
+  var _helperPath = findHelperAgentPath();
+  if (_helperPath) selectAgent(_helperPath);
 }
 
 function renderSetupDots() {

package/web/ui/chat/flow_engine.js

@@ -7,7 +7,7 @@
 // ── 输入框草稿持久化（按 agent + session 维度保存，刷新页面不丢失） ──
 var _draftTimer = null;
 function _draftKey() {
-  return 'myagent_draft_' + (state.activeAgent || 'default') + '_' + (state.activeSessionId || '__new__');
+  return 'myagent_draft_' + (state.activeAgent || '1') + '_' + (state.activeSessionId || '__new__');
 }
 function saveDraft() {
   if (_draftTimer) clearTimeout(_draftTimer);
@@ -128,7 +128,7 @@ async function confirmLargeTextAction() {
   var text = _pendingLargeText;
   if (text === null || idx === null) return;
 
-  var agentPath = state.activeAgent || 'default';
+  var agentPath = state.activeAgent || '1';
 
   if (idx === 0) {
     // 导入知识库

package/web/ui/chat/groupchat.js

@@ -346,7 +346,7 @@ function exitGroupChat() {
   groupMessages = [];
   // [v1.23.81] 清除群聊 ?g= session URL，恢复普通聊天 URL
   var cleanUrl = '/ui/chat/chat_container.html';
-  if (typeof state !== 'undefined' && state.activeAgent && state.activeAgent !== 'default') {
+  if (typeof state !== 'undefined' && state.activeAgent && state.activeAgent !== (typeof findMasterAgentPath === 'function' ? findMasterAgentPath() : '1')) {
     cleanUrl += '?a=' + encodeURIComponent(state.activeAgent);
   }
   if (typeof state !== 'undefined' && state.activeSessionId && state.activeSessionId !== '__new__') {
@@ -456,7 +456,7 @@ function startPrivateChatFromGroup(agentPath) {
     StatePersistence.remove('currentGroupId');
     // 清除群聊 URL 中的 ?g= 参数
     var cleanUrl = '/ui/chat/chat_container.html';
-    if (typeof state !== 'undefined' && agentPath && agentPath !== 'default') {
+    if (typeof state !== 'undefined' && agentPath && agentPath !== (typeof findMasterAgentPath === 'function' ? findMasterAgentPath() : '1')) {
       cleanUrl += '?a=' + encodeURIComponent(agentPath);
     }
     window.history.replaceState({}, '', cleanUrl);