pi-web-ui 0.90.1 → 0.91.0

package/dist/server/index.js

@@ -212,6 +212,16 @@ function cookieToken(req) {
     }
     return "";
 }
+/** Express 5 命名通配 `*splat` 的取值：单段是字符串，多段是字符串数组
+ *  （issue #225：直接 String() 会把多段用逗号拼成 "a,b.mjs"，插件 vendor 子
+ *  目录、嵌套文件预览、插件子路径 API 全 404）。统一拼回 "/" 即得 Express 4
+ *  语义；下游既有的越界/包含校验（workspacePath / resolvePluginClientFile）不变。 */
+function splatParam(req) {
+    const v = req.params.splat;
+    if (Array.isArray(v))
+        return v.join("/");
+    return String(v ?? "");
+}
 if (AUTH_TOKEN) {
     // /api/health 保持开放：无敏感信息，容器/监控探针需要它。
     // 但绝不能因命中 /api/health 就反射下发真实 token cookie（安全漏洞：issue #45）。
@@ -318,7 +328,10 @@ app.get("/api/file", async (req, res) => {
         if (isDownload) {
             // res.download sets Content-Disposition: attachment and RFC 5987
             // filename* encoding for non-ASCII names.
-            res.download(abs, name);
+            // dotfiles: allow — issue #223：Express 5 的 send 默认 dotfiles=ignore，
+            // 工作区/数据目录常位于隐藏目录下（如 ~/.pi-web），绝对路径含点号段会被判 404。
+            // 路径已由上方的 workspacePath/isAbsoluteWirePath 做工作区 containment 校验，放行安全。
+            res.download(abs, name, { dotfiles: "allow" });
         }
         else {
             if (isHtmlPreview) {
@@ -335,7 +348,7 @@ app.get("/api/file", async (req, res) => {
                 res.setHeader("Content-Security-Policy", allowJs ? "sandbox allow-scripts" : "sandbox");
                 res.setHeader("X-Content-Type-Options", "nosniff");
             }
-            res.sendFile(abs);
+            res.sendFile(abs, { dotfiles: "allow" });
         }
     }
     catch {
@@ -360,8 +373,8 @@ app.get("/api/file", async (req, res) => {
  */
 app.get("/api/preview/*splat", async (req, res) => {
     try {
-        // SAFETY: Express 5 命名通配 *splat 落在 req.params.splat（Express 4 是 params[0]）。
-        const captured = String(req.params.splat ?? "");
+        // 多段路径的 splat 是数组（见 splatParam），拼回 "/" 后才是线形路径。
+        const captured = splatParam(req);
         const ABS_MARKER = "__abs__/";
         const cid = typeof req.query.clientId === "string" ? req.query.clientId : "";
         const cs = cid ? service.get(cid) : undefined;
@@ -399,7 +412,7 @@ app.get("/api/preview/*splat", async (req, res) => {
             const allowJs = req.query.allowJs === "1";
             res.setHeader("Content-Security-Policy", allowJs ? "sandbox allow-scripts" : "sandbox");
         }
-        res.sendFile(abs);
+        res.sendFile(abs, { dotfiles: "allow" });
     }
     catch {
         res.status(404).end("not found");
@@ -498,7 +511,10 @@ app.get("/themes/:id.css", (req, res) => {
     }
     res.setHeader("Content-Type", "text/css; charset=utf-8");
     res.setHeader("Cache-Control", "no-cache");
-    res.sendFile(file);
+    // dotfiles: allow — issue #223：Express 5 的 send 默认 dotfiles=ignore，主题文件位于
+    // 隐藏目录下（如 ~/.pi-web/themes、npm 全局目录 ~/.local/…）时会被判 404。路径已由
+    // resolveThemeFile 校验（id 白名单 + 仅已知目录 + isFile），放行安全。
+    res.sendFile(file, { dotfiles: "allow" });
 });
 // Plugin client bundles: <dataDir>/plugins/<id>/client/* served at
 // /plugins/<id>/client/* so the frontend can import() plugin views. Only the
@@ -510,8 +526,8 @@ const PLUGINS_DIR = join(DATA_DIR, "plugins");
 // /plugins-api/<id>/inbox。PI_WEB_TOKEN 鉴权（上方 app.use）自动覆盖；
 // 响应已在前面过了 express.json。注意不要在此 catch-all 里消费 body。
 app.all(["/plugins-api/:id/*splat", "/plugins-api/:id"], (req, res) => {
-    // SAFETY: Express 5 命名通配 *splat 落在 req.params.splat（Express 4 是 params[0]）。
-    const rest = String(req.params.splat ?? "");
+    // 多段子路径的 splat 是数组（见 splatParam），拼回 "/" 后再交插件路由。
+    const rest = splatParam(req);
     pluginMgr.handleHttp(String(req.params.id ?? ""), req.method, rest, req, res);
 });
 function proxyForwardPath(hit, url) {
@@ -584,8 +600,8 @@ app.use((req, res, next) => {
     proxyHttp(hit, req, res);
 });
 app.get("/plugins/:id/client/*splat", (req, res) => {
-    // SAFETY: Express 5 命名通配 *splat 落在 req.params.splat（Express 4 是 params[0]）。
-    const rest = String(req.params.splat ?? "");
+    // 多段子路径（插件 vendor/分包）的 splat 是数组（见 splatParam），拼回 "/"。
+    const rest = splatParam(req);
     // 特权 DOM 门禁：声明了 dom 能力的插件，其 bundle 需用户逐个授权后才下发
     // （同源 bundle 技术上拦不住 DOM 访问，门只能放在这里；见 server/plugin-dom.ts）。
     if (pluginMgr.isDomBundleBlocked(String(req.params.id ?? ""))) {
@@ -602,7 +618,8 @@ app.get("/plugins/:id/client/*splat", (req, res) => {
         res.setHeader("Content-Type", "text/javascript; charset=utf-8");
     }
     res.setHeader("Cache-Control", "no-cache"); // 开发期改文件即生效
-    res.sendFile(abs, (err) => {
+    // dotfiles: allow — issue #223：插件目录默认在 ~/.pi-web/plugins（隐藏目录段），同上需放行。
+    res.sendFile(abs, { dotfiles: "allow" }, (err) => {
         if (err && !res.headersSent)
             res
                 .status(err.statusCode === 404 ? 404 : 500)
@@ -659,7 +676,8 @@ if (existsSync(webDist)) {
         const stored = readDevNoCacheSetting();
         const noStore = stored ?? envDefault;
         res.setHeader("Cache-Control", noStore ? "no-store" : "public, max-age=0");
-        res.sendFile(join(webDist, "index.html"), (err) => {
+        // dotfiles: allow — issue #223：nvm 等安装路径本身在隐藏目录下（如 ~/.nvm/…），同上需放行。
+        res.sendFile(join(webDist, "index.html"), { dotfiles: "allow" }, (err) => {
             if (err && !res.headersSent) {
                 res.status(503).send("正在更新 pi-web-ui，请稍后刷新…");
             }
@@ -967,7 +985,8 @@ pluginMgr.permissionRequester = (pluginId, req) => new Promise((resolve) => {
 pluginMgr.onPermGrantsChanged = () => pushPluginPermissions();
 // 内置定时任务（issue #184）：全局 <dataDir>/scheduler-tasks.json，TTL 与
 // client-state 同级；Agent 工具建的任务优先唤醒发起对话（issue #193：
-// wakeConversation steer 投递，不切用户当前对话），对话不在了再回落无头伪
+// wakeConversation steer 投递，不切用户当前对话），原对话不在先回落同项目
+// 活跃对话（issue #231：视口兜底＋自动重绑定＋明确降级提示），都没有才无头伪
 // 客户端（chatFromScheduler）；单次任务触发后自动删除。DSH 引擎无这俩方法时
 // executor 回 not-supported（历史里记失败，不炸进程）。
 const scheduler = new SchedulerStore(DATA_DIR, {
@@ -979,31 +998,83 @@ const scheduler = new SchedulerStore(DATA_DIR, {
                 result = { ok: false, error: "当前引擎不支持定时任务（仅标准 pi 引擎）" };
             }
             else {
-                // 发起对话还在 → steer 唤醒它（报告直接落原对话）；不在了 → 无头执行。
+                const runHeadless = () => svc.chatFromScheduler({
+                    id: task.id,
+                    cwd: task.cwd,
+                    prompt: task.prompt,
+                    model: task.model,
+                    thinkingLevel: task.thinkingLevel,
+                });
                 const target = String(task.conversationId ?? "").trim();
-                if (target && typeof svc.wakeConversation === "function") {
-                    const w = await svc.wakeConversation(target, `[定时任务 ${task.name}] ${task.prompt}`);
+                const taskFile = String(task.sessionFile ?? "").trim();
+                const text = `[定时任务 ${task.name}] ${task.prompt}`;
+                if (!target && !taskFile) {
+                    // 面板建的任务：创建时就没绑对话，保持无头语义（不抢占用户视口）。
+                    result = await runHeadless();
+                }
+                else if (typeof svc.wakeConversation === "function") {
+                    // 原绑定对话还在（含压缩/重启后按会话文件重认）→ steer 唤醒，报告落原对话。
+                    let w;
+                    try {
+                        w = await svc.wakeConversation(target, text, { sessionFile: taskFile, cwd: task.cwd });
+                    }
+                    catch (err) {
+                        w = { ok: false, error: err.message };
+                    }
                     if (w.ok) {
+                        // 会话继承（issue #231）：压缩/重启后同文件对话换了新 id → 任务跟过去，
+                        // 下次触发直达，不再误判 closed/gone。单次任务随后自删，免一次写盘。
+                        if (!task.oneShot) {
+                            try {
+                                if (w.conversationId && w.conversationId !== target)
+                                    scheduler.rebind(task.id, { conversationId: w.conversationId });
+                                if (w.sessionFile && w.sessionFile !== taskFile)
+                                    scheduler.rebind(task.id, { sessionFile: w.sessionFile });
+                            }
+                            catch {
+                                // 重绑失败不影响本次已投递的唤醒
+                            }
+                        }
                         result = { ok: true, conversationId: w.conversationId };
                     }
+                    else if (typeof svc.wakeViewportInCwd === "function") {
+                        // 活跃视口兜底（issue #231）：原句柄断开（切走释放/过户改名/重启），
+                        // 只要同项目还有用户正看着的对话，报告落那里 —— 不静默吞结果。
+                        const fallbackText = `[定时任务 ${task.name}｜原对话不在，已转到本窗口继续] ${task.prompt}`;
+                        let f;
+                        try {
+                            f = await svc.wakeViewportInCwd(task.cwd, fallbackText);
+                        }
+                        catch (err) {
+                            f = { ok: false, error: err.message };
+                        }
+                        if (f.ok) {
+                            if (!task.oneShot) {
+                                try {
+                                    scheduler.rebind(task.id, {
+                                        conversationId: f.conversationId ?? "",
+                                        sessionFile: f.sessionFile ?? "",
+                                    });
+                                }
+                                catch {
+                                    // 重绑失败不影响本次已投递的唤醒
+                                }
+                            }
+                            pushNoticeToAll("info", `定时任务「${task.name}」原对话不在，已转到同项目的活跃对话继续（原绑定 ${target || "（未知）"}）。报告直接落在当前对话。`, `Scheduled task "${task.name}" moved to the project's active conversation (was ${target || "unknown"}). The report lands in the current chat.`);
+                            result = { ok: true, conversationId: f.conversationId };
+                        }
+                        else {
+                            // 降级可见性（issue #231）：必须无头时明确广播去向，不静默。
+                            pushNoticeToAll("warning", `定时任务「${task.name}」原对话不在、同项目也无存活对话，已转后台执行（无头）。报告在后台任务面板的调度历史中查看。`, `Scheduled task "${task.name}" found no live conversation and runs headless; see its report in the background-tasks panel history.`);
+                            result = await runHeadless();
+                        }
+                    }
                     else {
-                        result = await svc.chatFromScheduler({
-                            id: task.id,
-                            cwd: task.cwd,
-                            prompt: task.prompt,
-                            model: task.model,
-                            thinkingLevel: task.thinkingLevel,
-                        });
+                        result = await runHeadless();
                     }
                 }
                 else {
-                    result = await svc.chatFromScheduler({
-                        id: task.id,
-                        cwd: task.cwd,
-                        prompt: task.prompt,
-                        model: task.model,
-                        thinkingLevel: task.thinkingLevel,
-                    });
+                    result = await runHeadless();
                 }
             }
         }
@@ -1489,6 +1560,22 @@ wss.on("connection", (ws) => {
             case "scm_commit":
                 void cs.scmQuery("commit", msg.reqId, { hash: msg.hash });
                 break;
+            case "scm_commitmsg":
+                if (typeof cs.scmGenCommitMessage === "function") {
+                    void cs.scmGenCommitMessage(msg.reqId);
+                }
+                else {
+                    // DSH 等引擎没有 pi 的 ModelRuntime——照样应答一次（ok:false），
+                    // 前端按钮不能因引擎差异卡在转圈。
+                    send({
+                        type: "scm_data",
+                        reqId: msg.reqId,
+                        kind: "commitmsg",
+                        ok: false,
+                        error: "当前引擎不支持 AI 生成提交信息（请用 pi 引擎）/ AI commit messages need the pi engine",
+                    });
+                }
+                break;
             case "read_file":
                 void cs.readFile(msg.path);
                 break;
@@ -1729,6 +1816,7 @@ wss.on("connection", (ws) => {
                     terminalBashIdleMs: msg.terminalBashIdleMs,
                     editSoftEnabled: msg.editSoftEnabled,
                     questionnaireEnabled: msg.questionnaireEnabled,
+                    parallelReminderEnabled: msg.parallelReminderEnabled,
                     goalModeEnabled: msg.goalModeEnabled,
                     thinkingWrap: msg.thinkingWrap,
                     toolsWrap: msg.toolsWrap,
@@ -1741,6 +1829,8 @@ wss.on("connection", (ws) => {
                     visionBridgePrompt: msg.visionBridgePrompt,
                     subagentDefaultModel: msg.subagentDefaultModel,
                     retryMaxAttempts: msg.retryMaxAttempts,
+                    softCapTokens: msg.softCapTokens,
+                    softCapByModel: msg.softCapByModel,
                     reviewPrompt: msg.reviewPrompt,
                     reviewDisabledSkills: msg.reviewDisabledSkills,
                     markersEnabled: msg.markersEnabled,

package/dist/server/plugin-catalog.js

@@ -16,6 +16,7 @@
  */
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+import { normalizeIconSvg } from "./icon-svg.js";
 import { pick } from "./i18n.js";
 /** 合法插件 id（与 server/plugins.ts 的 ID_RE 一致，防路径穿越）。 */
 const ID_RE = /^[A-Za-z0-9_-]+$/;
@@ -77,6 +78,7 @@ function toEntry(raw, builtin) {
     const description = typeof raw.description === "string" && raw.description.trim() ? raw.description.trim() : undefined;
     const descriptionEn = typeof raw.descriptionEn === "string" && raw.descriptionEn.trim() ? raw.descriptionEn.trim() : undefined;
     const icon = typeof raw.icon === "string" && raw.icon.trim() ? raw.icon.trim() : undefined;
+    const iconSvg = normalizeIconSvg(raw.iconSvg);
     const homepage = typeof raw.homepage === "string" && raw.homepage.trim() ? raw.homepage.trim() : undefined;
     return {
         id,
@@ -86,6 +88,7 @@ function toEntry(raw, builtin) {
         ...(description ? { description } : {}),
         ...(descriptionEn ? { descriptionEn } : {}),
         ...(icon ? { icon } : {}),
+        ...(iconSvg ? { iconSvg } : {}),
         ...(homepage ? { homepage } : {}),
     };
 }
@@ -146,6 +149,7 @@ lang) {
             ? { description: input.description.trim() }
             : {}),
         ...(typeof input?.icon === "string" && input.icon.trim() ? { icon: input.icon.trim() } : {}),
+        ...(normalizeIconSvg(input?.iconSvg) ? { iconSvg: normalizeIconSvg(input?.iconSvg) } : {}),
     });
     atomicWrite(customPath, { entries: next });
     return toEntry(next[next.length - 1], false);
@@ -223,6 +227,7 @@ export function writeCustomCatalog(customPath, incoming, replace) {
         ...(e.description ? { description: e.description } : {}),
         ...(e.descriptionEn ? { descriptionEn: e.descriptionEn } : {}),
         ...(e.icon ? { icon: e.icon } : {}),
+        ...(e.iconSvg ? { iconSvg: e.iconSvg } : {}),
         ...(e.homepage ? { homepage: e.homepage } : {}),
     }));
     atomicWrite(customPath, { entries });

package/dist/server/plugin-facilities.js

@@ -16,7 +16,7 @@
  *     不能防同一用户账号下的完整进程妥协——本地个人工具的合理折衷。
  */
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { readFile as fspReadFile, readdir as fspReaddir, rm as fspRm, mkdir as fspMkdir, writeFile as fspWriteFile, appendFile as fspAppendFile, stat as fspStat, } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -31,24 +31,52 @@ function atomicWrite(file, data) {
 // ---------------------------------------------------------------------------
 // storage
 // ---------------------------------------------------------------------------
-/** 每插件的 JSON 文件 KV。所有方法同步（数据量小，避免并发写乱序）。 */
+/** 每插件的 JSON 文件 KV。所有方法同步（数据量小，避免并发写乱序）。
+ *
+ * 缓存按文件 mtimeMs 失效（而非「首次读入后永不失效」）：storage.json 有两个
+ * 写入者 —— 本类，以及宿主 settings 面板的 saveSettingsValues（直写磁盘的
+ * settings 键，不经过本缓存）。插件长轮询里每隔几秒就 store.set("cursor", …)
+ * 一次，若缓存永不失效，set() 会把整份旧快照回写，把面板刚保存的 settings
+ * 抹掉 —— 表现为「设置重启即丢」。mtime 失效让下一次 load() 重读，两个写入者
+ * 各自保留自己的键。 */
 export class PluginStorage {
     file;
     cache;
+    /** 缓存对应的文件 mtimeMs（undefined = 文件尚不存在或不可 stat）。 */
+    cacheMtimeMs;
     constructor(file) {
         this.file = file;
     }
-    load() {
-        if (this.cache)
-            return this.cache;
+    mtime() {
         try {
-            const parsed = JSON.parse(readFileSync(this.file, "utf8"));
-            this.cache = parsed && typeof parsed === "object" ? parsed : {};
+            return statSync(this.file).mtimeMs;
         }
         catch {
-            this.cache = {}; // 不存在/损坏 = 空表（损坏不致命，重新积累）
+            return undefined; // 不存在 / 不可 stat
         }
-        return this.cache;
+    }
+    /** 从磁盘重读（不存在 / 损坏 = 空表）并同步缓存与 mtime。 */
+    readFromDisk(mtimeMs = this.mtime()) {
+        let parsed = {};
+        if (mtimeMs !== undefined) {
+            try {
+                const raw = JSON.parse(readFileSync(this.file, "utf8"));
+                if (raw && typeof raw === "object")
+                    parsed = raw;
+            }
+            catch {
+                parsed = {}; // 损坏 = 空表（不致命，重新积累）
+            }
+        }
+        this.cache = parsed;
+        this.cacheMtimeMs = mtimeMs;
+        return parsed;
+    }
+    load() {
+        const mtimeMs = this.mtime();
+        if (this.cache && this.cacheMtimeMs === mtimeMs)
+            return this.cache;
+        return this.readFromDisk(mtimeMs);
     }
     get(key, fallback) {
         const v = this.load()[key];
@@ -60,7 +88,10 @@ export class PluginStorage {
     set(key, value) {
         if (!key)
             throw new Error("storage.set: key 不能为空");
-        const store = this.load();
+        // 写前必重读磁盘：宿主 settings 面板的 saveSettingsValues 直写同一文件的
+        // settings 键（不经过本缓存），拿旧快照整份回写会把它抹掉。写是低频路径，
+        // 重读的代价可忽略；mtime 粒度即使同毫秒也抹不掉（这里是无条件重读）。
+        const store = this.readFromDisk();
         store[key] = value;
         try {
             atomicWrite(this.file, JSON.stringify(store));
@@ -70,7 +101,7 @@ export class PluginStorage {
         }
     }
     delete(key) {
-        const store = this.load();
+        const store = this.readFromDisk(); // 同 set：写前重读，不拿旧快照回写
         if (!(key in store))
             return;
         delete store[key];

package/dist/server/plugins.js

@@ -26,6 +26,7 @@ import { parseCronSpec, nextCronFire, loadScheduleRecords, saveScheduleRecords,
 import { PluginPermissionStore } from "./plugin-permissions.js";
 import { readCatalog, addCustomEntry, removeCustomEntry } from "./plugin-catalog.js";
 import { PluginGrantsStore, normalizeGrantPath } from "./plugin-grants.js";
+import { normalizeIconSvg } from "./icon-svg.js";
 import { PluginDomConsent, declarationWantsDom } from "./plugin-dom.js";
 // 工作区根的归一化与 client-state 共用一份（同一份语义：只收绝对路径 / 去重 / 上限）。
 import { normalizeWorkspaceRoots } from "./client-state.js";
@@ -371,6 +372,9 @@ export function parseUiItem(raw, slot, diagnostics) {
         ...(align ? { align } : {}),
         ...(trimStr(o.labelEn, 60) ? { labelEn: trimStr(o.labelEn, 60) } : {}),
         ...(trimStr(o.icon, 16) ? { icon: trimStr(o.icon, 16) } : {}),
+        ...(normalizeIconSvg(o.iconSvg)
+            ? { iconSvg: normalizeIconSvg(o.iconSvg) }
+            : {}),
         ...(trimStr(o.hint, 200) ? { hint: trimStr(o.hint, 200) } : {}),
         ...(trimStr(o.hintEn, 200) ? { hintEn: trimStr(o.hintEn, 200) } : {}),
         kind,
@@ -538,6 +542,9 @@ export function parseUiArrange(raw, diagnostics) {
             ...(trimStr(o.label, 60) ? { label: trimStr(o.label, 60) } : {}),
             ...(trimStr(o.hint, 200) ? { hint: trimStr(o.hint, 200) } : {}),
             ...(trimStr(o.icon, 16) ? { icon: trimStr(o.icon, 16) } : {}),
+            ...(normalizeIconSvg(o.iconSvg)
+                ? { iconSvg: normalizeIconSvg(o.iconSvg) }
+                : {}),
         });
     }
     return out;
@@ -1582,15 +1589,15 @@ export class PluginManager {
         }
     }
     /** 当前目录清单（重扫 manifest，不重新 import）。 */
-    async list() {
-        return this.scan();
+    async list(lang) {
+        return this.scan(lang);
     }
     /**
      * attach 时调用：重扫目录 + 激活尚未加载的新插件。
      * 返回给浏览器的目录（含激活失败的条目，前端显示为不可用）。
      */
     async ensureLoaded(lang) {
-        const found = await this.scan();
+        const found = await this.scan(lang);
         for (const info of found) {
             if (this.loaded.has(info.id) || this.attempted.has(info.id))
                 continue;
@@ -1607,10 +1614,13 @@ export class PluginManager {
         }
         return found.map((f) => {
             const base = this.loaded.get(f.id)?.info ?? f;
+            // 运行相位（设置面板清单用）：宿主持有实例即 active（含激活失败的占位行；
+            // 纯前端插件无 index.mjs、从未进 loaded 表，保持非 active）。
+            const withPhase = { ...base, active: this.loaded.has(f.id) };
             const agentTools = this.agentToolsSnapshot(f.id);
             if (agentTools.length)
-                return { ...base, agentTools };
-            const { agentTools: _drop, ...rest } = base;
+                return { ...withPhase, agentTools };
+            const { agentTools: _drop, ...rest } = withPhase;
             return rest;
         });
     }
@@ -1702,7 +1712,8 @@ export class PluginManager {
         this.pluginLogs.clear();
     }
     /** 读 manifest 清单；坏目录（无 manifest/id 非法）直接跳过。 */
-    async scan() {
+    async scan(lang) {
+        const l = lang?.() ?? "en";
         let names;
         try {
             names = await readdir(this.pluginsDir);
@@ -1731,6 +1742,7 @@ export class PluginManager {
                     version: typeof m.version === "string" ? m.version : undefined,
                     description: typeof m.description === "string" ? m.description : undefined,
                     icon: typeof m.icon === "string" && m.icon.trim() ? m.icon.trim() : undefined,
+                    iconSvg: normalizeIconSvg(m.iconSvg),
                     hasClient: existsSync(join(dir, "client", "entry.mjs")),
                     error: this.loaded.get(name)?.info.error,
                     // manifest 声明的能力清单（fs/net/tools…）——设置面板展示用
@@ -1840,7 +1852,19 @@ export class PluginManager {
                 }
             }
             catch {
-                continue; // 无 manifest / JSON 坏 —— 不是插件
+                // 无 manifest.json / JSON 解析失败 —— 占位行展示（坏插件不跳过，
+                // 设置面板清单标红 + 给原因；ensureLoaded 照例跳过激活）。
+                const msg = pick(l, `manifest.json 缺失或解析失败（${name}/），不是有效插件 —— 修复或移走该目录后点“重新扫描”`, `manifest.json missing or unparsable (${name}/), not a valid plugin — fix or remove the directory, then hit Rescan`, "plugins.manifest.broken", { name });
+                console.error(`[plugin:${name}] ${msg}`);
+                const brokenDiags = this.diagnosticsOf(name);
+                out.push({
+                    id: name,
+                    name,
+                    hasClient: existsSync(join(dir, "client", "entry.mjs")),
+                    error: msg,
+                    view: false,
+                    ...(brokenDiags ? { diagnostics: brokenDiags } : {}),
+                });
             }
         }
         // 删掉的目录不同时清快照：门禁会把不存在的 id 当 403，正确的应该是 404。
@@ -2073,7 +2097,22 @@ export class PluginManager {
             if (text.length > 8000)
                 return Promise.reject(new Error("chat: text 超长（>8000 字），请裁剪后重发"));
             const accountId = String(req?.accountId ?? "default").slice(0, 64);
-            return self.chatProvider(info.id, { text, accountId });
+            // issue #226：透传定时任务对齐的四件套（各按长度封顶，语义校验归宿主 chatFromPlugin）。
+            const r = (req ?? {});
+            const passthrough = { text, accountId };
+            const cwd = String(r.cwd ?? "").trim();
+            if (cwd)
+                passthrough.cwd = cwd.slice(0, 1024);
+            const conversationId = String(r.conversationId ?? "").trim();
+            if (conversationId)
+                passthrough.conversationId = conversationId.slice(0, 128);
+            const model = String(r.model ?? "").trim();
+            if (model)
+                passthrough.model = model.slice(0, 256);
+            const thinkingLevel = String(r.thinkingLevel ?? "").trim();
+            if (thinkingLevel)
+                passthrough.thinkingLevel = thinkingLevel.slice(0, 64);
+            return self.chatProvider(info.id, passthrough);
         };
         const host = {
             broadcast: (payload) => this.broadcast(info.id, payload),

package/dist/server/prompt-composer.js

@@ -149,7 +149,7 @@ export function buildSkillsText(skills, lang = "en", fullText = false) {
         return "";
     const lines = [
         pick(lang, "以下技能为特定任务提供专门的指令。", "The following skills provide specialized instructions for specific tasks.", "prompt.skills.intro.specialized"),
-        pick(lang, "当任务与某技能的描述相符时，用 read 工具加载该技能文件。", "Use the read tool to load a skill's file when the task matches its description.", "prompt.skills.intro.use.read"),
+        pick(lang, "当任务与某技能的描述相符时，用 skill 工具按名称加载该技能全文。", "Use the skill tool to load a skill's full text by name when the task matches its description.", "prompt.skills.intro.use.skill"),
         pick(lang, "当技能文件引用相对路径时，以技能目录（SKILL.md 的父目录 / 该路径的 dirname）为基准解析，并在工具命令中使用解析后的绝对路径。", "When a skill file references a relative path, resolve it against the skill directory (parent of SKILL.md / dirname of the path) and use that absolute path in tool commands.", "prompt.skills.intro.resolve.path"),
         "",
         "<available_skills>",

package/dist/server/protocol-version.js

@@ -8,4 +8,4 @@
  * its own copy in web/src/protocol-version.ts; scripts/check-protocol-sync.mjs
  * verifies the two never drift.
  */
-export const PROTOCOL_VERSION = 17;
+export const PROTOCOL_VERSION = 18;

package/dist/server/schedule-agent-tool.js

@@ -111,12 +111,12 @@ export function makeScheduleTools(host, ownerConversationId, lang) {
             "Use it when the user asks for periodic checks, delayed reminders, or scheduled summaries — do NOT fake it with sleep loops (a sleeping script can never push a message back). " +
             'Schedule accepts a 5-field cron ("0 * * * *" = hourly) or a relative delay ("in 30m", "in 1h", "30m"); minimum interval is 60s. ' +
             "One-shot by default (recurring=false auto-deletes the task after it fires); pass recurring=true for repeats. " +
-            "If the conversation is gone when it fires (closed/restarted), the task runs headless in its project and the report stays in the scheduler panel history. " +
+            "The wake-up binds the originating conversation AND its persisted session file: after context compaction or a restart the scheduler re-binds to the same session automatically; if the original conversation is gone it first falls back to the project's active conversation (and visibly reports the move), and only runs headless (report in panel history) when no live conversation exists for the project. " +
             "Manage with schedule_list / schedule_cancel; the user can also cancel from the background-tasks panel.", "在**当前对话**里创建一个定时唤醒：到指定 cron 时间或延迟后，调度器自动把你的 prompt 投回本对话，你继续执行并向用户汇报。" +
             "用户要求定时巡检、延时提醒、定时汇总时用它 —— 不要用 sleep 死循环假装答应（休眠的脚本推不回任何消息）。" +
             "时间写法收 5 字段 cron（“0 * * * *”=每小时）或相对延迟（“in 30m”“in 1h”“30m”）；最短间隔 60s。" +
             "默认单次（recurring=false 触发后自动删除）；传 recurring=true 做周期任务。" +
-            "触发时对话已不在（关闭/重启）则回落无头执行，报告留在调度面板历史里。" +
+            "唤醒绑定发起对话与其落盘会话文件：上下文压缩或重启后自动重绑到同一会话；原对话不在时先回落到同项目的活跃对话（并明确提示迁移），同项目无存活对话才无头执行，报告留在调度面板历史里。" +
             "用 schedule_list / schedule_cancel 管理；用户也可从后台任务面板取消。"),
         promptSnippet: "schedule a wake-up in this conversation (cron or delay), auto-report on fire",
         parameters: Type.Object({
@@ -154,16 +154,34 @@ export function makeScheduleTools(host, ownerConversationId, lang) {
             const labelRaw = typeof p.label === "string" ? p.label.trim().slice(0, 80) : "";
             const name = labelRaw || prompt.split("\n")[0].slice(0, 40) || "定时任务";
             const convId = (ownerConversationId ?? "").trim() || String(host.activeConversationId() ?? "").trim();
+            // 稳定绑定（issue #231）：owner 对话的落盘会话文件 —— 压缩/重启后靠它重认同一会话，
+            // 内存对话 id（c1/c2…）只做首选唤醒键。宿主没实现 conversationInfo 时按原来只绑 id。
+            let bindCwd = cwd;
+            let bindSessionFile = "";
+            try {
+                const info = host.conversationInfo?.((ownerConversationId ?? "").trim() || convId || undefined);
+                if (info) {
+                    if (String(info.cwd ?? "").trim())
+                        bindCwd = String(info.cwd).trim();
+                    bindSessionFile = String(info.sessionFile ?? "")
+                        .trim()
+                        .slice(0, 1024);
+                }
+            }
+            catch {
+                /* 绑定快照尽力而为：拿不到稳定键就按原来的 id 绑定触发 */
+            }
             const recurring = p.recurring === true;
             let task;
             try {
                 task = store.upsert({
                     name,
-                    cwd,
+                    cwd: bindCwd,
                     kind: parsed.kind,
                     spec: parsed.spec,
                     prompt,
                     conversationId: convId,
+                    sessionFile: bindSessionFile,
                     oneShot: !recurring,
                 });
             }
@@ -178,8 +196,8 @@ export function makeScheduleTools(host, ownerConversationId, lang) {
                 : `Fires: ${parsed.kind === "cron" ? `cron ${parsed.spec}` : `every ${Math.round(Number(parsed.spec) / 1000)}s`}, next ${fmtTime(next, L)}${recurring ? " (recurring)" : " (one-shot, auto-deleted after firing)"}`;
             const targetLine = convId
                 ? L === "zh"
-                    ? `汇报：触发时自动唤醒本对话（${convId}）；对话已不在则无头执行，报告进调度面板历史。`
-                    : `Reports: wakes this conversation (${convId}) on fire; runs headless (report in panel history) if it is gone.`
+                    ? `汇报：触发时自动唤醒本对话（${convId}）；压缩/重启后按会话文件自动重绑，原对话不在时先回落同项目活跃对话（明确提示），无存活对话才无头执行。`
+                    : `Reports: wakes this conversation (${convId}) on fire; re-binds by session file after compaction/restart, falls back to the project's active conversation (with a visible note), headless only with no live conversation.`
                 : L === "zh"
                     ? "汇报：无头执行，报告进调度面板历史（创建时没拿到对话 id）。"
                     : "Reports: headless run, report in panel history (no conversation id captured at creation).";