pi-skill-evolve 0.1.3 → 0.1.5

package/extensions/skill-evolve/test/config.test.ts

@@ -17,11 +17,11 @@ function workspace(): string {
   return path.join(cwd, ".pi", "evolution");
 }
 
-test("DEFAULT_CONFIG：只开自动评审，采集 / 复盘 / 自动采纳都默认关", () => {
-  // 自动评审单独为 true 是安全的：enabled 关着时它永远走不到，不会替 clone 下来的人花 token
+test("DEFAULT_CONFIG：四个开关默认全关", () => {
+  // 四个默认全关：clone 下来不采集、不派生、不评审、不落盘（2026-11-08 用户定）
   assert.deepEqual(
     [DEFAULT_CONFIG.enabled, DEFAULT_CONFIG.telemetry, DEFAULT_CONFIG.autoReview, DEFAULT_CONFIG.autoApply],
-    [false, false, true, false],
+    [false, false, false, false],
   );
 });
 
@@ -30,14 +30,14 @@ test("loadConfig：没有 config.json 时只开自动评审，且不会顺手造
   const config = loadConfig(evolutionDir);
   assert.deepEqual(
     [config.enabled, config.telemetry, config.autoReview, config.autoApply],
-    [false, false, true, false],
+    [false, false, false, false],
   );
   assert.equal(fs.existsSync(configFile(evolutionDir)), false, "读配置不能有副作用");
 });
 
 test("normalizeConfig：空对象与缺字段都回落到默认（评审开、其余关）", () => {
   const empty = normalizeConfig({});
-  assert.deepEqual([empty.enabled, empty.telemetry, empty.autoReview, empty.autoApply], [false, false, true, false]);
+  assert.deepEqual([empty.enabled, empty.telemetry, empty.autoReview, empty.autoApply], [false, false, false, false]);
   const onlyEnabled = normalizeConfig({ enabled: true });
   assert.deepEqual(
     [onlyEnabled.enabled, onlyEnabled.telemetry, onlyEnabled.autoApply],
@@ -49,12 +49,12 @@ test("normalizeConfig：空对象与缺字段都回落到默认（评审开、
 test("normalizeConfig：autoReview / autoApply 写错类型回落到默认值", () => {
   // 手改配置写成字符串是常事：坏值只回退那一个字段，不能让整份配置失效
   const wrong = normalizeConfig({ autoReview: "off", autoApply: 1 });
-  assert.deepEqual([wrong.autoReview, wrong.autoApply], [true, false]);
+  assert.deepEqual([wrong.autoReview, wrong.autoApply], [false, false]);
   const explicit = normalizeConfig({ autoReview: false, autoApply: true, enabled: true });
   assert.deepEqual([explicit.enabled, explicit.autoReview, explicit.autoApply], [true, false, true]);
 });
 
-test("saveConfigSwitch：on 只开复盘 + 评审，采集与自动采纳保持原值", async () => {
+test("saveConfigSwitch：on 只开复盘，采集 / 评审 / 采纳都保持原值", async () => {
   const evolutionDir = workspace();
   fs.mkdirSync(evolutionDir, { recursive: true });
   fs.writeFileSync(
@@ -65,13 +65,13 @@ test("saveConfigSwitch：on 只开复盘 + 评审，采集与自动采纳保持
   const next = await saveConfigSwitch(evolutionDir, true, directQueue);
   assert.deepEqual(
     [next.enabled, next.autoReview, next.telemetry, next.autoApply, next.idleMs, next.perSessionCap],
-    [true, true, true, false, 1_234, 3],
+    [true, false, true, false, 1_234, 3],
   );
   const raw = JSON.parse(fs.readFileSync(configFile(evolutionDir), "utf8"));
   assert.deepEqual(
     [raw.enabled, raw.autoReview, raw.telemetry, raw.autoApply, raw.idleMs, raw.perSessionCap],
-    [true, true, true, false, 1_234, 3],
-    "写盘内容必须与返回值一致：采集关着不能被 on 顺手打开，自动采纳更不能被打开",
+    [true, false, true, false, 1_234, 3],
+    "写盘内容必须与返回值一致：on 只开复盘，采集 / 评审 / 采纳都保持原值",
   );
 });
 

package/extensions/skill-evolve/test/dispatch-supervisor.test.ts

@@ -68,7 +68,8 @@ function harness(
 }
 
 test("派发成功时同一轮就起评审督导，并把评审模型透传过去", async () => {
-  const h = harness({ reviewModel: () => "deepseek/deepseek-v3.2" });
+  // 评审默认关（2026-11-08），这里显式打开才测得到「起督导 + 透传模型」
+  const h = harness({ config: { autoReview: true }, reviewModel: () => "deepseek/deepseek-v3.2" });
   const outcome = await h.dispatch({ sessionId: "sess-1", skills: ["alpha"] });
   assert.equal(outcome.status, "dispatched");
   assert.equal(h.supervisorCalls.length, 1, "必须起且只起一个督导");

package/extensions/skill-evolve/test/evolution.test.ts

@@ -222,7 +222,7 @@ test("statusText / reportText：无数据也不崩，且带上盲区提示", asy
   const status = await h.evo.statusText();
   assert.equal(
     status.includes(
-      "采集：开（遥测写入 .pi/evolution/telemetry/）｜复盘：开（会派生 agent）｜评审：开（提案后自动起督导）｜采纳：关（auto 提案等人工批准）",
+      "采集：开（遥测写入 .pi/evolution/telemetry/）｜复盘：开（会派生 agent）｜评审：关（提案停在 proposed 等人工）｜采纳：关（auto 提案等人工批准）",
     ),
     true,
   );
@@ -257,7 +257,7 @@ test("reportText：按遥测给出曝光/加载/未命中", async () => {
   );
 });
 
-test("setEnabled：off 四个全关、on 只开复盘 + 评审（不动采集与自动采纳）", async () => {
+test("setEnabled：off 四个全关、on 只开复盘（不动采集 / 评审 / 采纳）", async () => {
   const h = harness();
   const message = await h.evo.setEnabled(false);
   assert.equal(message.includes("关闭"), true);
@@ -267,8 +267,8 @@ test("setEnabled：off 四个全关、on 只开复盘 + 评审（不动采集与
 
   await h.evo.setEnabled(true);
   const back = JSON.parse(fs.readFileSync(path.join(h.dir, ".pi", "evolution", "config.json"), "utf8"));
-  // 用户定的语义：on = 复盘 + 评审两开；采集要另外 collect on，自动采纳要另外 apply on
-  assert.deepEqual([back.enabled, back.autoReview, back.telemetry, back.autoApply], [true, true, false, false]);
+  // 用户定的语义（2026-11-08）：四个开关各管一段，on 只开自动复盘；评审要另外 review on
+  assert.deepEqual([back.enabled, back.autoReview, back.telemetry, back.autoApply], [true, false, false, false]);
 });
 
 test("setFlag：只切一个字段，并把当前四个开关的状态写进回执", async () => {
@@ -309,9 +309,9 @@ test("没有 config.json 时默认全关：不派生、不落遥测", async () =
   });
   const status = await evo.statusText();
   assert.equal(
-    status.includes("采集：关（不写遥测）｜复盘：关（不会派生 agent）｜评审：开（提案后自动起督导）｜采纳：关（auto 提案等人工批准）"),
+    status.includes("采集：关（不写遥测）｜复盘：关（不会派生 agent）｜评审：关（提案停在 proposed 等人工）｜采纳：关（auto 提案等人工批准）"),
     true,
-    "默认只开自动评审：enabled 关着时它永远走不到",
+    "默认四个全关：采集 / 复盘 / 评审 / 采纳都不动",
   );
   evo.recordAdvertised({ sessionId: "s1", cwd: dir, prompt: "x", skills: [skill("a")] });
   evo.settle({ sessionId: "s1" });

package/extensions/skill-evolve/test/session-page.test.ts

@@ -0,0 +1,194 @@
+/**
+ * 会话详情页的读盘层与整页渲染（node --test）。
+ *
+ * 纪律：所有会话文件都造在临时目录里，并把 `home` 显式传进 readSessionSource ——
+ * 绝不扫真实 `~/.pi/agent/sessions`（本机会话文件随时在变，测试不能依赖它）。
+ *
+ * 覆盖：按 sessionId 反查、三条安全闸（根外路径 / 名字不含 sessionId / 非 .jsonl）、
+ * run.json 里的 sessionFile 优先、文件不在本机的文案、整页统计与「工具块默认收起」、HTTP 路由接对。
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+import type { WebState } from "../lib/web/data.ts";
+import { renderSessionPage } from "../lib/web/render-session.ts";
+import {
+  declaredSessionFile,
+  findSessionFile,
+  readSessionSource,
+  resolveSessionFile,
+  safeSessionId,
+  sessionsRoot,
+} from "../lib/web/session-file.ts";
+import { startWebPanel } from "../lib/web/server.ts";
+
+const SESSION_ID = "01a1b90f-08c3-722c-871d-d024b083770a";
+
+/** 一段最小的会话 JSONL：一条用户消息 + 一次带结果的工具调用 */
+function sessionJsonl(): string {
+  return [
+    JSON.stringify({ type: "session", id: SESSION_ID }),
+    JSON.stringify({ type: "message", message: { role: "user", content: [{ type: "text", text: "看一下这个文件" }] } }),
+    JSON.stringify({
+      type: "message",
+      message: { role: "assistant", content: [{ type: "toolCall", id: "c1", name: "read", arguments: { path: "a.ts" } }] },
+    }),
+    JSON.stringify({ type: "message", message: { role: "toolResult", toolCallId: "c1", toolName: "read", content: [{ type: "text", text: "文件内容" }] } }),
+  ].join("\n") + "\n";
+}
+
+/** 临时 home：`<home>/.pi/agent/sessions/--project--/2026-11-08T00-00-00-000Z_<id>.jsonl` */
+function fakeHome(): { home: string; file: string } {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-home-"));
+  const dir = path.join(sessionsRoot(home), "--home-suveng-demo--");
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, `2026-11-08T00-00-00-000Z_${SESSION_ID}.jsonl`);
+  fs.writeFileSync(file, sessionJsonl(), "utf8");
+  return { home, file };
+}
+
+/** 临时工作区：只造 runs/<runId>/run.json，够 readSessionSource 反查 sessionFile */
+function fakeEvolution(runId: string, record: Record<string, unknown>): string {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-evo-"));
+  const evolutionDir = path.join(cwd, ".pi", "evolution");
+  const runDir = path.join(evolutionDir, "runs", runId);
+  fs.mkdirSync(runDir, { recursive: true });
+  fs.writeFileSync(path.join(runDir, "run.json"), JSON.stringify({ runId, ...record }), "utf8");
+  return evolutionDir;
+}
+
+function emptyState(): WebState {
+  return {
+    pending: [],
+    approvals: [],
+    applied: [],
+    done: [],
+    reports: [],
+    summary: { reviewing: 0, stale: 0, pendingApprovals: 0, appliedTotal: 0, rollbackRate: 0 },
+  };
+}
+
+test("sessionsRoot / safeSessionId：路径拼对，非法 id 一律拒（它会被当文件名匹配词）", () => {
+  assert.equal(sessionsRoot("/home/demo"), path.join("/home/demo", ".pi", "agent", "sessions"));
+  assert.equal(safeSessionId(SESSION_ID), SESSION_ID);
+  assert.equal(safeSessionId("  " + SESSION_ID + "  "), SESSION_ID);
+  for (const bad of ["", "../../etc/passwd", "a/b", "x".repeat(200), "id with space"]) {
+    assert.equal(safeSessionId(bad), null, bad);
+  }
+});
+
+test("findSessionFile：按 sessionId 在 sessions 子目录里反查，命中多条取最近（文件名时间最大）", () => {
+  const { home, file } = fakeHome();
+  const dir = path.dirname(file);
+  const older = path.join(dir, `2026-11-07T00-00-00-000Z_${SESSION_ID}.jsonl`);
+  fs.copyFileSync(file, older);
+  assert.equal(findSessionFile(SESSION_ID, sessionsRoot(home)), file);
+  // 换一个 sessionId 就找不到（绝不模糊匹配到别的会话）
+  assert.equal(findSessionFile("ffffffff-0000-0000-0000-000000000000", sessionsRoot(home)), null);
+});
+
+test("resolveSessionFile 安全闸：根目录外 / 名字不含 sessionId / 非 .jsonl 一律不采纳（回落到按 id 反查）", () => {
+  const { home, file } = fakeHome();
+  const root = sessionsRoot(home);
+  assert.equal(resolveSessionFile({ sessionId: SESSION_ID, file, root }), file);
+
+  // 根目录内但不是这个会话的文件：不采纳那一条，落到反查（反查命中的才是真会话）
+  const other = path.join(path.dirname(file), "2026-11-08T00-00-00-000Z_other.jsonl");
+  fs.writeFileSync(other, "{}\n", "utf8");
+  assert.equal(resolveSessionFile({ sessionId: SESSION_ID, file: other, root }), file);
+  // 后缀不是 .jsonl 同理
+  const txt = path.join(path.dirname(file), `${SESSION_ID}.txt`);
+  fs.writeFileSync(txt, "x", "utf8");
+  assert.equal(resolveSessionFile({ sessionId: SESSION_ID, file: txt, root }), file);
+
+  // ?file=/etc/passwd 这种绝不能读（根目录外）：任何情况下都不会返回它
+  const outside = resolveSessionFile({ sessionId: SESSION_ID, file: "/etc/passwd", root });
+  assert.equal(outside, file);
+  assert.equal(resolveSessionFile({ sessionId: "ffffffff-0000-0000-0000-000000000000", file: "/etc/passwd", root }), null);
+});
+
+test("declaredSessionFile：从 runs 里的 run.json 反查同一会话的 sessionFile", () => {
+  const file = "/tmp/demo-session.jsonl";
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, sessionFile: file, status: "rejected" });
+  assert.equal(declaredSessionFile(evolutionDir, SESSION_ID), file);
+  assert.equal(declaredSessionFile(evolutionDir, "ffffffff-0000-0000-0000-000000000000"), null);
+});
+
+test("readSessionSource：解析会话原文并给出消息数 / 工具调用数 / 字节数", () => {
+  const { home, file } = fakeHome();
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, sessionFile: file, status: "rejected" });
+  const source = readSessionSource({ evolutionDir, sessionId: SESSION_ID, home });
+  assert.equal(source.file, file);
+  assert.equal(source.transcript?.messages, 3);
+  assert.equal(source.transcript?.toolCalls, 1);
+  assert.equal(source.sizeBytes, Buffer.byteLength(sessionJsonl(), "utf8"));
+});
+
+test("readSessionSource：run.json 记的路径已不在本机时按 sessionId 反查兜底", () => {
+  const { home, file } = fakeHome();
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, sessionFile: "/gone/away.jsonl", status: "rejected" });
+  const source = readSessionSource({ evolutionDir, sessionId: SESSION_ID, home });
+  assert.equal(source.file, file, "声明的路径没了，但本机其它目录里还留着这个会话");
+});
+
+test("readSessionSource：彻底找不到 → file 与 transcript 都是 null（页面要说人话，不能 500）", () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-home-empty-"));
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, sessionFile: null, status: "rejected" });
+  const source = readSessionSource({ evolutionDir, sessionId: SESSION_ID, home });
+  assert.deepEqual([source.file, source.transcript, source.sizeBytes], [null, null, 0]);
+});
+
+test("readSessionSource：非法 sessionId 直接返回空，不扫盘", () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-home-empty-"));
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, status: "rejected" });
+  const source = readSessionSource({ evolutionDir, sessionId: "../../etc/passwd", home });
+  assert.deepEqual([source.file, source.transcript], [null, null]);
+});
+
+test("renderSessionPage：顶部给完整 sessionId 与文件路径，底部给原文件统计，工具块默认收起", () => {
+  const { home, file } = fakeHome();
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, sessionFile: file, status: "rejected" });
+  const source = readSessionSource({ evolutionDir, sessionId: SESSION_ID, home });
+  const html = renderSessionPage(source, { state: emptyState() });
+  assert.match(html, new RegExp(`<code>${SESSION_ID}</code>`));
+  assert.match(html, /<code>.*2026-11-08T00-00-00-000Z_.*\.jsonl<\/code>/);
+  assert.match(html, /原文件 <code>.*\.jsonl<\/code>（3 条消息 \/ 1 次工具调用 \/ \d+B）/);
+  assert.equal(/<details[^>]*\sopen/.test(html), false, "工具块默认收起");
+  assert.match(html, /看一下这个文件/);
+});
+
+test("renderSessionPage：会话文件不在本机时给一句人话，不是空白页", () => {
+  const source = readSessionSource({
+    evolutionDir: fakeEvolution("run-1", { sessionId: SESSION_ID, status: "rejected" }),
+    sessionId: SESSION_ID,
+    home: fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-home-empty-")),
+  });
+  const html = renderSessionPage(source, { state: emptyState() });
+  assert.match(html, /会话文件已不在本机/);
+  assert.match(html, /原文件：<span class="off">会话文件已不在本机<\/span>/);
+});
+
+test("HTTP 路由：GET /?view=session&sessionId= 接对了（HOME 指到临时目录，绝不碰真实 sessions）", async () => {
+  const { home, file } = fakeHome();
+  const evolutionDir = fakeEvolution("run-1", { sessionId: SESSION_ID, sessionFile: file, status: "rejected" });
+  const original = process.env.HOME;
+  process.env.HOME = home;
+  const result = await startWebPanel({ evolutionDir, port: 0 });
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  try {
+    const response = await fetch(`${result.panel.url}/?view=session&sessionId=${SESSION_ID}`);
+    assert.equal(response.status, 200);
+    assert.match(response.headers.get("content-type") ?? "", /text\/html/);
+    const html = await response.text();
+    assert.match(html, /工具调用：read ×1（点击展开）/);
+    assert.equal(/<details[^>]*\sopen/.test(html), false);
+  } finally {
+    await result.panel.close();
+    if (original === undefined) delete process.env.HOME;
+    else process.env.HOME = original;
+  }
+});

package/extensions/skill-evolve/test/session-view.test.ts

@@ -0,0 +1,192 @@
+/**
+ * 会话详情页的纯函数单测（node --test）：
+ * JSONL 解析（只认 message、跳过 system / thinking、工具调用回连结果、连续工具聚块）、
+ * 渲染（默认收起、全转义、单条与总输出截断、只留最后 200 条）。
+ *
+ * 纪律：不读真实 `~/.pi/agent/sessions`、不读真实 run 目录 —— 所有输入都是本文件里现造的 JSONL 片段，
+ * 这样用例既快又不受本机会话文件变动影响。
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  MAX_MESSAGES,
+  MAX_OUTPUT,
+  parseSessionText,
+  renderSessionBody,
+  type SessionTranscript,
+} from "../lib/web/session-view.ts";
+
+/** 一行 JSONL（pi 的真实形态：顶层 type + message） */
+function line(record: unknown): string {
+  return `${JSON.stringify(record)}\n`;
+}
+
+function userMessage(text: string): string {
+  return line({ type: "message", message: { role: "user", content: [{ type: "text", text }] } });
+}
+
+function assistantMessage(text: string, calls: { id: string; name: string; arguments?: unknown }[] = []): string {
+  const content: unknown[] = [];
+  if (text.length > 0) content.push({ type: "text", text });
+  for (const call of calls) content.push({ type: "toolCall", id: call.id, name: call.name, arguments: call.arguments ?? {} });
+  return line({ type: "message", message: { role: "assistant", content } });
+}
+
+function toolResult(toolCallId: string, text: string): string {
+  return line({ type: "message", message: { role: "toolResult", toolCallId, toolName: "read", content: [{ type: "text", text }] } });
+}
+
+test("解析：只认顶层 type=message，session / model_change / custom 全跳过", () => {
+  const raw =
+    line({ type: "session", id: "s1" }) +
+    line({ type: "model_change", model: "x" }) +
+    line({ type: "custom", data: {} }) +
+    userMessage("你好") +
+    "这不是 JSON\n";
+  const transcript = parseSessionText(raw);
+  assert.equal(transcript.messages, 1);
+  assert.deepEqual(transcript.entries, [{ kind: "user", text: "你好" }]);
+});
+
+test("解析：system 提示词与 thinking 块都不渲染（它们不是对话）", () => {
+  const raw =
+    line({ type: "message", message: { role: "system", content: [{ type: "text", text: "你是复盘助手" }] } }) +
+    line({ type: "message", message: { role: "assistant", content: [{ type: "thinking", thinking: "先看看 diff" }, { type: "text", text: "结论：没问题" }] } });
+  const transcript = parseSessionText(raw);
+  assert.deepEqual(transcript.entries, [{ kind: "assistant", text: "结论：没问题" }]);
+});
+
+test("解析：工具调用按 toolCallId 回连结果，连续调用聚成一个块", () => {
+  const raw =
+    userMessage("看两个文件") +
+    assistantMessage("", [
+      { id: "c1", name: "read", arguments: { path: "a.ts" } },
+      { id: "c2", name: "read", arguments: { path: "b.ts" } },
+    ]) +
+    toolResult("c1", "文件 a 的内容") +
+    toolResult("c2", "文件 b 的内容") +
+    assistantMessage("看完了");
+  const transcript = parseSessionText(raw);
+  assert.deepEqual(transcript.entries.map((entry) => entry.kind), ["user", "tools", "assistant"]);
+  const tools = transcript.entries[1];
+  assert.equal(tools.kind, "tools");
+  if (tools.kind !== "tools") return;
+  assert.equal(tools.calls.length, 2);
+  assert.deepEqual(
+    tools.calls.map((call) => [call.name, call.args, call.result]),
+    [
+      ["read", '{"path":"a.ts"}', "文件 a 的内容"],
+      ["read", '{"path":"b.ts"}', "文件 b 的内容"],
+    ],
+  );
+  assert.equal(transcript.toolCalls, 2);
+});
+
+test("解析：两次 assistant 消息之间的调用（中间只隔 toolResult）也聚成一个块", () => {
+  const raw =
+    assistantMessage("先读一个", [{ id: "c1", name: "read", arguments: { path: "a" } }]) +
+    toolResult("c1", "ok") +
+    assistantMessage("", [{ id: "c2", name: "bash", arguments: { command: "ls" } }]) +
+    toolResult("c2", "ok");
+  const transcript = parseSessionText(raw);
+  // 文本在前、工具在后：中间那两次调用仍属同一段连续工具调用
+  assert.deepEqual(transcript.entries.map((entry) => entry.kind), ["assistant", "tools"]);
+  const tools = transcript.entries[1];
+  assert.equal(tools.kind === "tools" ? tools.calls.length : 0, 2);
+});
+
+test("解析：没有结果的调用写「（没有结果）」（子进程被 kill 时会这样）", () => {
+  const transcript = parseSessionText(assistantMessage("", [{ id: "c9", name: "read", arguments: {} }]));
+  const tools = transcript.entries[0];
+  assert.equal(tools.kind === "tools" ? tools.calls[0]?.result : "", "（没有结果）");
+});
+
+test("渲染：用户与助手各一段，抬头写明是谁", () => {
+  const html = renderSessionBody(parseSessionText(userMessage("你好") + assistantMessage("你好，有什么要看的？")));
+  assert.match(html, /<div class="msg user">\s*<p class="who">用户<\/p>\s*<pre>你好<\/pre>/);
+  assert.match(html, /<div class="msg assistant">\s*<p class="who">助手<\/p>/);
+});
+
+test("渲染：工具块默认收起（details 不带 open），抬头是「工具名 ×次数（点击展开）」", () => {
+  const raw =
+    assistantMessage("", [
+      { id: "c1", name: "read", arguments: { path: "a" } },
+      { id: "c2", name: "read", arguments: { path: "b" } },
+      { id: "c3", name: "bash", arguments: { command: "ls" } },
+    ]) +
+    toolResult("c1", "A") +
+    toolResult("c2", "B") +
+    toolResult("c3", "C");
+  const html = renderSessionBody(parseSessionText(raw));
+  assert.match(html, /<details class="tools"><summary>工具调用：read ×2、bash ×1（点击展开）<\/summary>/);
+  assert.equal(/<details[^>]*\sopen/.test(html), false, "默认收起：不许出现 open 属性");
+  // 每次调用的三段都在：名字 / 参数 / 结果
+  assert.match(html, /<p class="tool-name">read<\/p>/);
+  assert.match(html, /<pre class="tool-args">\{&quot;path&quot;:&quot;a&quot;\}<\/pre>/);
+  assert.match(html, /<pre class="tool-result">A<\/pre>/);
+});
+
+test("渲染：消息里的 HTML 一律转义，页面不出现裸 <script>", () => {
+  const raw =
+    userMessage("<script>alert(1)</script>") +
+    assistantMessage("引用 <b>粗体</b>") +
+    assistantMessage("", [{ id: "c1", name: "read", arguments: { path: "<img src=x>" } }]) +
+    toolResult("c1", "<script>x()</script>");
+  const html = renderSessionBody(parseSessionText(raw));
+  assert.equal(/<script/i.test(html), false);
+  assert.equal(/<img/i.test(html), false);
+  assert.match(html, /&lt;script&gt;alert\(1\)&lt;\/script&gt;/);
+  assert.match(html, /&lt;b&gt;粗体&lt;\/b&gt;/);
+  assert.match(html, /&lt;img src=x&gt;/);
+});
+
+test("渲染：用户原文超 2000 字截断并加省略号，助手正文超 4000 字同理", () => {
+  const longUser = "u".repeat(2500);
+  const longAssistant = "a".repeat(4500);
+  const transcript = parseSessionText(userMessage(longUser) + assistantMessage(longAssistant));
+  const html = renderSessionBody(transcript);
+  assert.equal(html.includes("u".repeat(2000) + "…"), true);
+  assert.equal(html.includes("u".repeat(2001)), false);
+  assert.equal(html.includes("a".repeat(4000) + "…"), true);
+  assert.equal(html.includes("a".repeat(4001)), false);
+});
+
+test("渲染：工具参数截到 400 字、结果截到 200 字", () => {
+  const raw =
+    assistantMessage("", [{ id: "c1", name: "read", arguments: "p".repeat(600) }]) +
+    toolResult("c1", "r".repeat(400));
+  const html = renderSessionBody(parseSessionText(raw));
+  assert.equal(html.includes("p".repeat(400) + "…"), true);
+  assert.equal(html.includes("p".repeat(401)), false);
+  assert.equal(html.includes("r".repeat(200) + "…"), true);
+  assert.equal(html.includes("r".repeat(201)), false);
+});
+
+test("解析：超过 200 条只留最后 200 条，dropped 记下丢掉多少", () => {
+  const raw = Array.from({ length: MAX_MESSAGES + 5 }, (_, index) => userMessage(`第 ${index} 条`)).join("");
+  const transcript = parseSessionText(raw);
+  assert.equal(transcript.messages, MAX_MESSAGES + 5);
+  assert.equal(transcript.entries.length, MAX_MESSAGES);
+  assert.equal(transcript.dropped, 5);
+  assert.equal(transcript.entries[0]?.kind === "user" ? transcript.entries[0].text : "", "第 5 条");
+  // 丢掉的要说明，否则用户以为会话只有 200 条
+  const html = renderSessionBody(transcript, { dropped: transcript.dropped });
+  assert.match(html, /只渲染最后 200 条消息，前面还有 5 条未显示/);
+});
+
+test("渲染：总输出超 2MB 就停手并指路原文件", () => {
+  // 用会被转义成 6 个字符的引号撑大输出：200 条 × 4000 字 → 转义后远超上限
+  const entries: SessionTranscript["entries"] = Array.from({ length: MAX_MESSAGES }, () => ({
+    kind: "assistant",
+    text: '"'.repeat(4000),
+  }));
+  const html = renderSessionBody({ entries, messages: entries.length, toolCalls: 0, dropped: 0 });
+  assert.equal(html.length > MAX_OUTPUT, false, "输出必须被截在上限以内");
+  assert.match(html, /已达页面输出上限（2048KB），后面还有内容未渲染/);
+  assert.match(html, /继续看请用 rg\/read 打开原文件/);
+});
+
+test("渲染：空会话给一句空态，不留白页", () => {
+  assert.match(renderSessionBody({ entries: [], messages: 0, toolCalls: 0, dropped: 0 }), /没有可渲染的对话/);
+});

package/extensions/skill-evolve/test/web-session-column.test.ts

@@ -0,0 +1,141 @@
+/**
+ * 列表页的「会话」列：五个视图（待处理 / 待审批 / 已采纳 / 已处理 / 复盘报告）都必须带，
+ * 且文案一致 —— 只显示 sessionId 前 8 位，完整 id 放 title，点进 `?view=session`。
+ *
+ * 为什么必须每页都有（用户 2026-11-08）：「面板展示的也应该是 pi sessionId 否则我都不知道怎么看对应会话」。
+ * 同一个渲染函数 `sessionCell` 供五处复用，本文件就是把这条约定钉住：
+ * 少一页就说明有人另写了一份行渲染。
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { AppliedItem } from "../lib/web/applied.ts";
+import type { ApprovalItem } from "../lib/web/approvals.ts";
+import type { QueueItem } from "../lib/queue.ts";
+import type { DoneItem, PendingItem, WebState } from "../lib/web/data.ts";
+import type { RunReport } from "../lib/web/reports.ts";
+import { renderPage } from "../lib/web/render.ts";
+import { pendingRows } from "../lib/web/render-rows.ts";
+import type { SessionRef } from "../lib/web/run-session.ts";
+
+const NOW = new Date(2026, 10, 8, 12).getTime();
+const SESSION_ID = "01a1b90f-08c3-722c-871d-d024b083770a";
+const SESSION: SessionRef = { sessionId: SESSION_ID, sessionFile: `/tmp/${SESSION_ID}.jsonl` };
+const NO_SESSION: SessionRef = { sessionId: null, sessionFile: null };
+const CTX = { csrf: "c", writable: true, view: "pending" as const };
+
+function state(parts: Partial<WebState> = {}): WebState {
+  return {
+    pending: [],
+    approvals: [],
+    applied: [],
+    done: [],
+    reports: [],
+    summary: { reviewing: 0, stale: 0, pendingApprovals: 0, appliedTotal: 0, rollbackRate: 0 },
+    ...parts,
+  };
+}
+
+function pendingItem(session: SessionRef): PendingItem {
+  return { runId: "run-p-1794133942", kind: "reviewed", skill: "demo", at: NOW, detail: "", session };
+}
+
+function approvalItem(session: SessionRef): ApprovalItem {
+  return {
+    runId: "run-b-1794133942",
+    session,
+    skill: "demo",
+    level: "approval",
+    targets: [".pi/skills/demo/SKILL.md"],
+    createdAt: NOW,
+    proposal: { type: "improve", added: 3, removed: 1 },
+    review: { verdict: "pass", blocking: 0 },
+    detail: "",
+  };
+}
+
+function appliedItem(session: SessionRef): AppliedItem {
+  return {
+    runId: "run-a-1794133942",
+    session,
+    level: "approval",
+    skill: "demo",
+    type: "improve",
+    added: 3,
+    removed: 1,
+    appliedAt: NOW,
+    gates: [],
+    gatesOk: null,
+  };
+}
+
+function doneItem(session: SessionRef): DoneItem {
+  return { runId: "run-d-1794133942", status: "rejected", source: "run", level: "-", skill: "demo", at: NOW, detail: "", session };
+}
+
+function reportItem(session: SessionRef): RunReport {
+  return {
+    runId: "run-r-1794133942",
+    status: "reviewed",
+    trigger: "auto",
+    session,
+    startedAt: NOW,
+    findings: { total: 0, rows: [] },
+    proposal: null,
+    review: null,
+    decision: null,
+    verify: null,
+  };
+}
+
+/** 五个视图各塞一条带会话的行，返回整页 HTML */
+function pageWithSession(): Record<string, string> {
+  const base: Partial<WebState> = {
+    pending: [pendingItem(SESSION)],
+    approvals: [approvalItem(SESSION)],
+    applied: [appliedItem(SESSION)],
+    done: [doneItem(SESSION)],
+    reports: [reportItem(SESSION)],
+  };
+  const current = state(base);
+  return {
+    pending: renderPage(current, "pending"),
+    approvals: renderPage(current, "approvals"),
+    applied: renderPage(current, "applied"),
+    done: renderPage(current, "done"),
+    reports: renderPage(current, "reports"),
+  };
+}
+
+test("五个视图都有会话列：链接指向 ?view=session，文案是 sessionId 前 8 位，title 是完整 id", () => {
+  const pages = pageWithSession();
+  for (const [view, html] of Object.entries(pages)) {
+    const href = `/?view=session&amp;sessionId=${SESSION_ID}`;
+    assert.equal(html.includes(href), true, `${view} 页缺会话链接`);
+    assert.match(html, /会话 01a1b90f/, `${view} 页会话列要显示前 8 位`);
+    assert.equal(html.includes(`title="${SESSION_ID}"`), true, `${view} 页 title 要放完整 sessionId`);
+  }
+});
+
+test("待处理行：会话列跟在 runId 后面，同一行里两者都在", () => {
+  const html = pendingRows([pendingItem(SESSION)], CTX);
+  const runIdIndex = html.indexOf("run-p-1794133942");
+  const sessIndex = html.indexOf('class="sess"');
+  assert.equal(runIdIndex >= 0 && sessIndex > runIdIndex, true, "会话列应在 runId 之后");
+  assert.match(html, / · <a class="sess"/, "会话列与行头之间用 · 分隔");
+});
+
+test("待审批行：summary 里同样带会话列（它是自己拼的 details，最容易漏）", () => {
+  const html = renderPage(state({ approvals: [approvalItem(SESSION)] }), "approvals");
+  assert.match(html, /<summary class="head">[^<]*<a class="sess" href="\/\?view=session&amp;sessionId=/);
+});
+
+test("没有 sessionId 的老 run：写「会话 —」占位，不造空链接、不报错", () => {
+  const html = renderPage(state({ pending: [pendingItem(NO_SESSION)], done: [doneItem(NO_SESSION)] }), "pending");
+  assert.match(html, /<span class="hint">会话 —<\/span>/);
+  assert.equal(html.includes("view=session"), false, "缺 id 时不许出现会话链接");
+});
+
+test("会话链接带 file 参数：页面可直接打开声明过的会话文件，不必再反查", () => {
+  const html = pendingRows([pendingItem(SESSION)], CTX);
+  assert.match(html, new RegExp(`file=%2Ftmp%2F${SESSION_ID}\\.jsonl`));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-skill-evolve",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "技能进化：采集会话中的技能曝光/加载，异步复盘、生成改进提案并独立评审，附本机 Web 管理面板",
   "keywords": [
     "pi-package",