pi-web-ui 0.90.1 → 0.91.0

package/dist/server/client-state.js

@@ -8,6 +8,7 @@
  */
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
+import { normalizeSoftCapByModel, normalizeSoftCapTokens } from "./soft-cap.js";
 import { deriveLegacy, legacyToDisabled, normalizeDisabledAgentTools } from "./tool-manager.js";
 /** 大模型 API 出错自动重试次数的默认值（SDK 默认 3）。 */
 export const DEFAULT_RETRY_MAX_ATTEMPTS = 6;
@@ -66,11 +67,44 @@ export function normalizeUiLayout(v) {
         }
         return Object.keys(out).length ? out : undefined;
     };
-    const hidden = arr(o.hidden, 200);
-    const shown = arr(o.shown, 200);
-    const order = arr(o.order, 200);
-    const groups = dict(o.groups, 200);
-    const labels = dict(o.labels, 200);
+    // 品牌二合一迁移：旧 host:brand-logo/host:brand-name → host:brand（去重；显式新值赢）。
+    const BRAND_NEW = "host:brand";
+    const isBrandOld = (id) => id === "host:brand-logo" || id === "host:brand-name";
+    const mapBrandList = (list) => {
+        if (!list)
+            return undefined;
+        const out = [];
+        for (const id of list) {
+            const mapped = isBrandOld(id) ? BRAND_NEW : id;
+            if (!out.includes(mapped))
+                out.push(mapped);
+        }
+        return out.length ? out : undefined;
+    };
+    /** 旧品牌 key 折进 host:brand：logo 优先还是名称优先由调用方定（对齐/分组跟 logo，走名称）。 */
+    const foldBrandDict = (src, logoFirst) => {
+        if (!src)
+            return undefined;
+        const out = {};
+        for (const [k, val] of Object.entries(src)) {
+            if (isBrandOld(k))
+                continue;
+            out[k] = val;
+        }
+        if (out[BRAND_NEW] === undefined) {
+            const picked = logoFirst
+                ? (src["host:brand-logo"] ?? src["host:brand-name"])
+                : (src["host:brand-name"] ?? src["host:brand-logo"]);
+            if (picked !== undefined)
+                out[BRAND_NEW] = picked;
+        }
+        return Object.keys(out).length ? out : undefined;
+    };
+    const hidden = mapBrandList(arr(o.hidden, 200));
+    const shown = mapBrandList(arr(o.shown, 200));
+    const order = mapBrandList(arr(o.order, 200));
+    const groups = foldBrandDict(dict(o.groups, 200), true);
+    const labels = foldBrandDict(dict(o.labels, 200), false);
     // 用户对齐：只收 start/center/end（手改脏值回落丢弃，不污染合并结果）。
     let align;
     if (o.align && typeof o.align === "object" && !Array.isArray(o.align)) {
@@ -83,6 +117,23 @@ export function normalizeUiLayout(v) {
         if (Object.keys(align).length === 0)
             align = undefined;
     }
+    // 品牌对齐同样折进 host:brand（跟 logo 的值，显式新值赢）。
+    if (align && ("host:brand-logo" in align || "host:brand-name" in align)) {
+        const out = {};
+        for (const [k, val] of Object.entries(align)) {
+            if (k === "host:brand-logo" || k === "host:brand-name")
+                continue;
+            out[k] = val;
+        }
+        if (out[BRAND_NEW] === undefined) {
+            const picked = align["host:brand-logo"] ?? align["host:brand-name"];
+            if (picked !== undefined)
+                out[BRAND_NEW] = picked;
+        }
+        align = Object.keys(out).length ? out : undefined;
+    }
+    // 顶栏按钮文字总开关：只收布尔值（缺席 = 显示，兼容老存档）。
+    const topbarText = typeof o.topbarText === "boolean" ? o.topbarText : undefined;
     return {
         ...(hidden ? { hidden } : {}),
         ...(shown ? { shown } : {}),
@@ -90,6 +141,7 @@ export function normalizeUiLayout(v) {
         ...(groups ? { groups } : {}),
         ...(align ? { align } : {}),
         ...(labels ? { labels } : {}),
+        ...(topbarText !== undefined ? { topbarText } : {}),
     };
 }
 /** 归一化技能名单：字符串数组原样过滤；其他（含旧 bool 开关）回落空数组。 */
@@ -374,6 +426,7 @@ export class ClientStateStore {
                 ? deriveLegacy(legacyToDisabled(stored)).questionnaireEnabled
                 : (stored?.questionnaireEnabled ?? true),
             goalModeEnabled: stored?.goalModeEnabled ?? true,
+            parallelReminderEnabled: stored?.parallelReminderEnabled ?? true,
             thinkingWrap: stored?.thinkingWrap ?? false,
             devNoCache: stored?.devNoCache,
             autoReload: stored?.autoReload,
@@ -383,8 +436,12 @@ export class ClientStateStore {
             visionBridgeModel: stored?.visionBridgeModel ?? null,
             visionBridgePromptMode: stored?.visionBridgePromptMode === "replace" ? "replace" : "append",
             visionBridgePrompt: stored?.visionBridgePrompt ?? "",
+            scmCommitMsgPromptMode: stored?.scmCommitMsgPromptMode === "replace" ? "replace" : "append",
+            scmCommitMsgPrompt: stored?.scmCommitMsgPrompt ?? "",
             subagentDefaultModel: stored?.subagentDefaultModel ?? null,
             retryMaxAttempts: normalizeRetryMaxAttempts(stored?.retryMaxAttempts),
+            softCapTokens: normalizeSoftCapTokens(stored?.softCapTokens),
+            softCapByModel: normalizeSoftCapByModel(stored?.softCapByModel),
             quickPhrases: stored?.quickPhrases ?? [],
             quickPhrasesEnabled: stored?.quickPhrasesEnabled ?? true,
             reviewPrompt: stored?.reviewPrompt ?? "",
@@ -419,6 +476,7 @@ export class ClientStateStore {
             editSoftEnabled: settings.editSoftEnabled ?? cur.editSoftEnabled ?? false,
             questionnaireEnabled: settings.questionnaireEnabled ?? cur.questionnaireEnabled ?? true,
             goalModeEnabled: settings.goalModeEnabled ?? cur.goalModeEnabled ?? true,
+            parallelReminderEnabled: settings.parallelReminderEnabled ?? cur.parallelReminderEnabled ?? true,
             thinkingWrap: settings.thinkingWrap ?? cur.thinkingWrap ?? false,
             devNoCache: settings.devNoCache ?? cur.devNoCache,
             autoReload: settings.autoReload ?? cur.autoReload,
@@ -428,8 +486,12 @@ export class ClientStateStore {
             visionBridgeModel: settings.visionBridgeModel ?? cur.visionBridgeModel ?? null,
             subagentDefaultModel: settings.subagentDefaultModel ?? cur.subagentDefaultModel ?? null,
             retryMaxAttempts: normalizeRetryMaxAttempts(settings.retryMaxAttempts ?? cur.retryMaxAttempts ?? DEFAULT_RETRY_MAX_ATTEMPTS),
+            softCapTokens: normalizeSoftCapTokens(settings.softCapTokens ?? cur.softCapTokens ?? 0),
+            softCapByModel: normalizeSoftCapByModel(settings.softCapByModel ?? cur.softCapByModel ?? {}),
             visionBridgePromptMode: settings.visionBridgePromptMode ?? cur.visionBridgePromptMode ?? "append",
             visionBridgePrompt: settings.visionBridgePrompt ?? cur.visionBridgePrompt ?? "",
+            scmCommitMsgPromptMode: settings.scmCommitMsgPromptMode ?? cur.scmCommitMsgPromptMode ?? "append",
+            scmCommitMsgPrompt: settings.scmCommitMsgPrompt ?? cur.scmCommitMsgPrompt ?? "",
             reviewPrompt: settings.reviewPrompt ?? cur.reviewPrompt ?? "",
             reviewDisabledSkills: settings.reviewDisabledSkills ?? cur.reviewDisabledSkills ?? [],
             disabledPlugins: settings.disabledPlugins ?? cur.disabledPlugins ?? [],
@@ -450,6 +512,9 @@ export class ClientStateStore {
             reviewDisabledSkills: p.reviewDisabledSkills ?? [],
             // Older presets predate the configurable retry count.
             retryMaxAttempts: normalizeRetryMaxAttempts(p.retryMaxAttempts),
+            // Older presets predate the compaction soft cap (issue #229).
+            softCapTokens: normalizeSoftCapTokens(p.softCapTokens),
+            softCapByModel: normalizeSoftCapByModel(p.softCapByModel),
         }));
     }
     /** Persist the named settings presets — global shared config. */

package/dist/server/compaction-markers.js

@@ -0,0 +1,287 @@
+/**
+ * Compaction transcript markers + transcript repair (issue #235).
+ *
+ * 背景：pi-web-ui 在 compaction_start 时往会话 JSONL 尾追加一行自有的 custom
+ * 标记（crash-safe 的"正在压缩"记录），compaction_end 时原地改写为完成标记。
+ * 0.90.x 用硬编码 id（pi-web-ui-compaction-pending / -done），多次压缩后文件
+ * 里出现多个同名 entry；SDK 的 byId 索引是 last-wins，leaf 又是文件最后一行，
+ * 若标记恰为末行则新消息的 parentId 记成共享 id，下次 open 回溯 parent 链成环，
+ * getBranch 死循环 push 直到 V8 抛 RangeError: Invalid array length，整个会话
+ * 打不开（"Failed to initialize session"）。
+ *
+ * 本模块：
+ * - makeCompactionMarkerId：每次压缩唯一 id，根除新坏文件；
+ * - repairSessionTranscript：纯函数，移除残留 pending（其子节点旁路到 pending
+ *   的 parent，marker 对 LLM 上下文零贡献）＋ 重复 id 改名 ＋ 重复 id 引用改指
+ *   最近的前序同名 ＋ 环路截断。只改坏行，其余字节不动；
+ * - repairSessionFile：落盘版，改前写 <原名>.bak（已存在则保留最早那份）；
+ * - looksLikeChainCorruption：识别链损坏报错，供 open 重试分支用。
+ */
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+export const COMPACTION_PENDING_TYPE = "pi-web-ui/compaction-pending";
+export const COMPACTION_DONE_TYPE = "pi-web-ui/compaction-done";
+/** 0.90.x 写死的 id——repair 用来识别存量坏标记。 */
+const LEGACY_PENDING_ID = "pi-web-ui-compaction-pending";
+const LEGACY_DONE_ID = "pi-web-ui-compaction-done";
+/** 每次压缩唯一 id：Date.now 保证先后可辨，random 保证同毫秒不撞。 */
+export function makeCompactionMarkerId(kind) {
+    return `pi-web-ui-compaction-${kind}-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+}
+function markerKindOf(entry) {
+    if (typeof entry !== "object" || entry === null)
+        return null;
+    const e = entry;
+    if (e.type !== "custom" || typeof e.id !== "string")
+        return null;
+    if (e.customType === COMPACTION_PENDING_TYPE)
+        return "pending";
+    if (e.customType === COMPACTION_DONE_TYPE)
+        return "done";
+    // 兜底：customType 丢失的手工改坏文件，按 id 前缀认（SDK 自生成的 id 不带此前缀）。
+    if (e.id === LEGACY_PENDING_ID || e.id.startsWith(`${LEGACY_PENDING_ID}-`))
+        return "pending";
+    if (e.id === LEGACY_DONE_ID || e.id.startsWith(`${LEGACY_DONE_ID}-`))
+        return "done";
+    return null;
+}
+function parentIdOf(entry) {
+    const p = entry.parentId;
+    return typeof p === "string" ? p : null;
+}
+/**
+ * 修复会话转录文本。健康文件原样返回（changed=false，text === raw）。
+ * 有坏必修：pending 残留→删（子节点旁路）；重复 id→首个保留、其余改名，
+ * 引用改指最近前序同名；残余环→截断。调用方负责落盘＋备份（见 repairSessionFile）。
+ */
+export function repairSessionTranscript(raw) {
+    const result = {
+        text: raw,
+        changed: false,
+        removedPending: 0,
+        renamedIds: 0,
+        rewiredParents: 0,
+        cyclesBroken: 0,
+        interrupted: false,
+    };
+    const lines = raw.split("\n");
+    const slots = lines.map((line) => {
+        if (!line.trim())
+            return { raw: line, entry: null, removed: false, dirty: false, finalId: null };
+        try {
+            const parsed = JSON.parse(line);
+            if (typeof parsed === "object" && parsed !== null) {
+                const id = parsed.id;
+                return {
+                    raw: line,
+                    entry: parsed,
+                    removed: false,
+                    dirty: false,
+                    finalId: typeof id === "string" ? id : null,
+                };
+            }
+        }
+        catch {
+            // 脏行：SDK 加载时同样跳过，这里原样保留。
+        }
+        return { raw: line, entry: null, removed: false, dirty: false, finalId: null };
+    });
+    // 第 1 步：移除残留 pending，记录 id→parent 供子节点旁路。
+    const pendingParent = new Map();
+    for (const s of slots) {
+        if (!s.entry || markerKindOf(s.entry) !== "pending")
+            continue;
+        const id = typeof s.entry.id === "string" ? s.entry.id : null;
+        if (!id)
+            continue;
+        s.removed = true;
+        result.removedPending += 1;
+        if (!pendingParent.has(id))
+            pendingParent.set(id, parentIdOf(s.entry));
+    }
+    if (pendingParent.size > 0) {
+        const resolveBypass = (id) => {
+            // pending 套 pending 理论上不存在，visited 防万一。
+            const seen = new Set();
+            let cur = id;
+            while (cur !== null && pendingParent.has(cur) && !seen.has(cur)) {
+                seen.add(cur);
+                cur = pendingParent.get(cur) ?? null;
+            }
+            return cur;
+        };
+        for (const s of slots) {
+            if (s.removed || !s.entry)
+                continue;
+            const p = parentIdOf(s.entry);
+            if (p === null || !pendingParent.has(p))
+                continue;
+            const next = resolveBypass(p);
+            if (next === p)
+                continue;
+            if (next === null) {
+                // pending 本就没有 parent（首行标记）——子节点提升为根。
+                s.entry.parentId = null;
+            }
+            else {
+                s.entry.parentId = next;
+            }
+            s.dirty = true;
+            result.rewiredParents += 1;
+        }
+    }
+    // 第 2 步：重复 id 改名（首个保留），引用改指"最近的前序同名"。
+    // 先算每行的最终 id，再统一改引用，避免先改后认错。
+    const live = slots.filter((s) => !s.removed && s.entry && s.finalId !== null);
+    const seenIds = new Set();
+    const takenIds = new Set();
+    for (const s of live)
+        takenIds.add(s.finalId);
+    const dupSeq = new Map();
+    for (const s of live) {
+        const id = s.finalId;
+        if (!seenIds.has(id)) {
+            seenIds.add(id);
+            continue;
+        }
+        let k = (dupSeq.get(id) ?? 0) + 1;
+        let candidate = `${id}--dup-${k}`;
+        while (takenIds.has(candidate)) {
+            k += 1;
+            candidate = `${id}--dup-${k}`;
+        }
+        dupSeq.set(id, k);
+        s.finalId = candidate;
+        takenIds.add(candidate);
+        result.renamedIds += 1;
+    }
+    const dupIds = new Set();
+    {
+        const counts = new Map();
+        for (const s of live) {
+            const orig = typeof s.entry?.id === "string" ? s.entry.id : null;
+            if (orig)
+                counts.set(orig, (counts.get(orig) ?? 0) + 1);
+        }
+        for (const [id, c] of counts)
+            if (c > 1)
+                dupIds.add(id);
+    }
+    if (dupIds.size > 0) {
+        // origId → 按行序排好的 (行号, 最终id)
+        const occ = new Map();
+        live.forEach((s, i) => {
+            const orig = typeof s.entry?.id === "string" ? s.entry.id : null;
+            if (!orig || !dupIds.has(orig))
+                return;
+            let arr = occ.get(orig);
+            if (!arr) {
+                arr = [];
+                occ.set(orig, arr);
+            }
+            arr.push({ idx: i, finalId: s.finalId });
+        });
+        live.forEach((s, i) => {
+            if (!s.entry)
+                return;
+            const p = parentIdOf(s.entry);
+            if (p === null || !dupIds.has(p))
+                return;
+            const arr = occ.get(p);
+            let target = null;
+            for (const o of arr) {
+                if (o.idx < i)
+                    target = o.finalId;
+                else
+                    break;
+            }
+            // 引用落在全部同名之前（正常追加不可能，手改文件才有）——保持悬空，
+            // SDK 按 orphan 截断，安全降级。
+            if (target === null || target === p)
+                return;
+            s.entry.parentId = target;
+            s.dirty = true;
+            result.rewiredParents += 1;
+        });
+        // 应用改名。
+        for (const s of live) {
+            if (!s.entry || s.finalId === null || s.entry.id === s.finalId)
+                continue;
+            s.entry.id = s.finalId;
+            s.dirty = true;
+        }
+    }
+    // 第 3 步：残余环截断（纵深防御——前两步之后正常已无环）。
+    // byId 语义与 SDK 一致：同名取其一（此时已无重复）。
+    if (live.length > 0) {
+        const byId = new Map();
+        for (const s of live)
+            if (s.finalId !== null)
+                byId.set(s.finalId, s);
+        for (const s of live) {
+            if (!s.entry)
+                continue;
+            const seen = new Set([s.finalId]);
+            let prev = s;
+            let cur = parentIdOf(s.entry);
+            while (cur !== null) {
+                if (seen.has(cur)) {
+                    prev.entry.parentId = null;
+                    prev.dirty = true;
+                    result.cyclesBroken += 1;
+                    break;
+                }
+                seen.add(cur);
+                const next = byId.get(cur);
+                if (!next?.entry)
+                    break;
+                prev = next;
+                cur = parentIdOf(next.entry);
+            }
+        }
+    }
+    const anyChange = result.removedPending > 0 || result.renamedIds > 0 || result.rewiredParents > 0 || result.cyclesBroken > 0;
+    if (!anyChange)
+        return result;
+    result.changed = true;
+    result.interrupted = result.removedPending > 0;
+    const out = [];
+    for (const s of slots) {
+        if (s.removed)
+            continue;
+        out.push(s.dirty && s.entry ? JSON.stringify(s.entry) : s.raw);
+    }
+    result.text = out.join("\n");
+    return result;
+}
+/**
+ * 落盘版修复：健康文件只读不写；坏文件先写 <原名>.bak（已存在则保留最早那份，
+ * 不覆盖），再写回修复文本。读失败/写失败返回 null（调用方按原错误继续抛）。
+ */
+export function repairSessionFile(filePath) {
+    let raw;
+    try {
+        raw = readFileSync(filePath, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const r = repairSessionTranscript(raw);
+    if (!r.changed)
+        return { ...r, file: filePath, backup: null };
+    try {
+        const bak = `${filePath}.bak`;
+        if (!existsSync(bak))
+            writeFileSync(bak, raw, "utf8");
+        writeFileSync(filePath, r.text, "utf8");
+        return { ...r, file: filePath, backup: bak };
+    }
+    catch {
+        return null;
+    }
+}
+/** 链损坏的典型报错（SDK getBranch 死循环 → V8 RangeError）。 */
+export function looksLikeChainCorruption(err) {
+    const msg = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+    return /invalid array length|maximum call stack|too much recursion/i.test(msg);
+}

package/dist/server/delegate-task.js

@@ -159,7 +159,18 @@ export function makeDelegateTaskTool(host, lang) {
             if (err)
                 return text(err, { delegated: false, agent: input.agent });
             const prompt = buildDelegationPrompt(input, getLang());
-            const convId = await host.spawnSubagent(prompt, "delegate", ctx.cwd, input.agent, input.model);
+            // 与 subagent_spawn 同理：spawn 通道是唯一的失败面（数量上限 / runtime
+            // 创建失败都经由 host 抛错），转成返回文本让 AI 能读到原因并修正重试。
+            let convId;
+            try {
+                convId = await host.spawnSubagent(prompt, "delegate", ctx.cwd, input.agent, input.model);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return text(pick(getLang(), `派单启动失败：${msg}`, `Failed to start delegation: ${msg}`, "delegate.start.failed", {
+                    error: msg,
+                }), { delegated: false, agent: input.agent });
+            }
             const title = subagentTitle(prompt);
             const modelLineZh = input.model ? `\n模型：${input.model}` : "";
             const modelLineEn = input.model ? `\nModel: ${input.model}` : "";

package/dist/server/dsh/dsh-agent-service.js

@@ -125,6 +125,7 @@ const DEFAULT_SETTINGS = {
     editSoftEnabled: false,
     questionnaireEnabled: true,
     goalModeEnabled: true,
+    parallelReminderEnabled: true,
     thinkingWrap: false,
     toolsWrap: true,
     disabledPlugins: [],
@@ -269,6 +270,7 @@ export class DshClientSession {
                 editSoftEnabled: savedSettings.editSoftEnabled,
                 questionnaireEnabled: savedSettings.questionnaireEnabled ?? true,
                 goalModeEnabled: savedSettings.goalModeEnabled ?? true,
+                parallelReminderEnabled: savedSettings.parallelReminderEnabled ?? true,
                 thinkingWrap: savedSettings.thinkingWrap,
                 toolsWrap: savedSettings.toolsWrap,
                 disabledPlugins: savedSettings.disabledPlugins ?? [],
@@ -1485,8 +1487,9 @@ export class DshClientSession {
         }
         // issue #145：同项目并行感知（与 pi 引擎同语义；DSH 无 display:false 的
         // custom 消息通道，提醒以前置系统文本随本轮发给运行时，用户气泡保持原文）。
+        // parallelReminderEnabled=false 时整段跳过。
         let sysPrefix = "";
-        if (!conv.isStreaming) {
+        if (!conv.isStreaming && this.settings.parallelReminderEnabled !== false) {
             const localTitles = [...this.convs.values()]
                 .filter((c) => c.id !== conv.id && c.cwd === conv.cwd && c.isStreaming)
                 .map((c) => `本窗口「${c.title}」`);
@@ -2590,8 +2593,12 @@ export class DshClientSession {
             editSoftEnabled: this.settings.editSoftEnabled,
             // DSH 无独立重试配置（pi 引擎才暴露），保持默认。
             retryMaxAttempts: DEFAULT_RETRY_MAX_ATTEMPTS,
+            // DSH 另有运行时：压缩软上限是 pi 引擎概念，这里保持关闭保协议完整。
+            softCapTokens: 0,
+            softCapByModel: {},
             questionnaireEnabled: this.settings.questionnaireEnabled,
             goalModeEnabled: this.settings.goalModeEnabled,
+            parallelReminderEnabled: this.settings.parallelReminderEnabled,
             thinkingWrap: this.settings.thinkingWrap,
             toolsWrap: this.settings.toolsWrap,
             // DSH 无 skill 全文注入概念，给空保协议完整。
@@ -2600,6 +2607,9 @@ export class DshClientSession {
             visionBridgeModel: null,
             visionBridgePromptMode: "append",
             visionBridgePrompt: "",
+            // DSH 无「AI 生成提交信息」（scm_commitmsg 分发处直接报错），保协议完整。
+            scmCommitMsgPromptMode: "append",
+            scmCommitMsgPrompt: "",
             reviewPrompt: this.settings.reviewPrompt,
             reviewDisabledSkills: [],
             disabledPlugins: this.settings.disabledPlugins,
@@ -2611,6 +2621,7 @@ export class DshClientSession {
             // DSH 引擎不接标准 pi 的 customTool 工具 schema（走 goal-rpc），此处给空。
             toolsSchema: "",
             visionBridgeDefaultPrompt: "",
+            scmCommitMsgDefaultPrompt: "",
             visionModels: [],
             skills: this.skillsCache,
             reviewSkills: [],
@@ -2652,6 +2663,8 @@ export class DshClientSession {
             this.settings.questionnaireEnabled = partial.questionnaireEnabled;
         if (partial.goalModeEnabled !== undefined)
             this.settings.goalModeEnabled = partial.goalModeEnabled;
+        if (partial.parallelReminderEnabled !== undefined)
+            this.settings.parallelReminderEnabled = partial.parallelReminderEnabled;
         if (partial.thinkingWrap !== undefined)
             this.settings.thinkingWrap = partial.thinkingWrap;
         if (partial.toolsWrap !== undefined)
@@ -2683,8 +2696,12 @@ export class DshClientSession {
             editSoftEnabled: this.settings.editSoftEnabled,
             // DSH 无独立重试配置（pi 引擎才暴露），保持默认。
             retryMaxAttempts: DEFAULT_RETRY_MAX_ATTEMPTS,
+            // DSH 另有运行时：压缩软上限是 pi 引擎概念，这里保持关闭保协议完整。
+            softCapTokens: 0,
+            softCapByModel: {},
             questionnaireEnabled: this.settings.questionnaireEnabled,
             goalModeEnabled: this.settings.goalModeEnabled,
+            parallelReminderEnabled: this.settings.parallelReminderEnabled,
             thinkingWrap: this.settings.thinkingWrap,
             toolsWrap: this.settings.toolsWrap,
             disabledPlugins: this.settings.disabledPlugins,
@@ -3004,6 +3021,9 @@ export class DshClientSession {
             // DSH 无 skill 全文注入概念，给空保预设类型完整。
             skillsFullText: [],
             retryMaxAttempts: DEFAULT_RETRY_MAX_ATTEMPTS,
+            // DSH 另有运行时：压缩软上限是 pi 引擎概念，预设里保持关闭。
+            softCapTokens: 0,
+            softCapByModel: {},
             visionBridgePromptMode: "append",
             visionBridgePrompt: "",
             reviewPrompt: this.settings.reviewPrompt,

package/dist/server/file-transfer-routes.js

@@ -59,7 +59,10 @@ export function registerFileTransferRoutes(app, getCwd, temporaryRoot = tmpdir()
                     if ((await stat(archive.path)).size > 200 * 1024 * 1024)
                         throw new Error("Temporary download exceeds 200 MiB; compress in place and download the archive instead");
                     // The callback runs on completion AND disconnect. Never expose a reusable temp URL.
-                    await new Promise((ok, fail) => res.download(archive.path, archive.name, (err) => (err ? fail(err) : ok())));
+                    // dotfiles: allow — issue #223：Express 5 的 send 默认 dotfiles=ignore，
+                    // TMPDIR 等临时根位于隐藏目录下（如 ~/.cache）时下载会被判 404。
+                    // 路径是服务端刚创建的受控临时包，放行安全。
+                    await new Promise((ok, fail) => res.download(archive.path, archive.name, { dotfiles: "allow" }, (err) => (err ? fail(err) : ok())));
                 }
                 else
                     res.json({ name: archive.name });

package/dist/server/icon-svg.js

@@ -0,0 +1,35 @@
+/**
+ * 插件内联 SVG 图标（manifest.json `iconSvg` / catalog `iconSvg`）的校验与规范化。
+ *
+ * 为什么是纯函数独立模块：
+ *   - server/plugins.ts 与 server/plugin-catalog.ts 都要用；normalize 放 plugins.ts
+ *     里会形成循环依赖（plugins.ts 已 import plugin-catalog.ts）。
+ *   - 前端另有一份 sanitize（web/src/plugin-icon.tsx）：服务端只做形状校验与长度
+ *     截断（入库前），渲染前的前端 sanitize 负责真正的 XSS 过滤（去 script/on*）。
+ */
+/** iconSvg 上限：16px 展示位，正常图标 <2KB；超了直接拒掉（不是截断，截断会断标签）。 */
+export const MAX_ICON_SVG_LENGTH = 8192;
+/**
+ * 校验并规范化内联 SVG 图标；非法返回 undefined。
+ * 接受：以 `<svg` 开头（含 `<?xml` 前导也认）、`</svg>` 结尾、不含 `<script`、
+ * 不含行内事件处理器（`on*=`) 的字符串。返回 trim 后的原文（不改写内容）。
+ */
+export function normalizeIconSvg(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const s = raw.trim();
+    if (!s || s.length > MAX_ICON_SVG_LENGTH)
+        return undefined;
+    const body = s.startsWith("<?xml") ? s.slice(s.indexOf("?>") + 2).trimStart() : s;
+    if (!/^<svg[\s>]/.test(body))
+        return undefined;
+    if (!/<\/svg\s*>\s*$/.test(body))
+        return undefined;
+    if (/<script[\s>]/i.test(body))
+        return undefined;
+    if (/\son\w+\s*=/i.test(body))
+        return undefined;
+    if (/javascript\s*:/i.test(body))
+        return undefined;
+    return s;
+}