pi-web-ui 0.95.0 → 0.96.0

package/dist/server/plugin-updater.js

@@ -11,6 +11,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, cpSync, write
 import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { pick } from "./i18n.js";
+import { parseInstallSpec, manifestCandidateUrls } from "./plugin-install-spec.js";
 const PLUGIN_ID_RE = /^[A-Za-z0-9_-]+$/;
 /** 保留的备份份数（超出删除最旧的）。 */
 export const BACKUP_KEEP = 3;
@@ -150,10 +151,66 @@ export async function resolveRemoteSha(spec, exec = execGit) {
     const sha = res.stdout.match(/^([0-9a-f]{40,64})\s+HEAD/m)?.[1] ?? null;
     return sha ? sha.slice(0, 12) : null;
 }
-/** 扫描全部已装插件，对比本地 sha 与远端 sha，报告更新状态。 */
+/** 简易数字 semver 比较：>0 代表 a 比 b 新。 */
+export function compareVersions(a, b) {
+    const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+    const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (x !== y)
+            return x - y;
+    }
+    return 0;
+}
+/** 判断某个插件是否属于随包维护的内置插件（官方插件）。 */
+export function isBuiltinPlugin(id, source, builtinCatalogPath) {
+    if (source && /xing-shuyin\/pi-web-ui\/plugins\//i.test(source))
+        return true;
+    if (builtinCatalogPath && existsSync(builtinCatalogPath)) {
+        try {
+            const raw = JSON.parse(readFileSync(builtinCatalogPath, "utf8"));
+            if (Array.isArray(raw)) {
+                return raw.some((e) => e?.id === id);
+            }
+        }
+        catch {
+            /* ignore parse errors */
+        }
+    }
+    return false;
+}
+/** 探测远端 manifest 中的版本号（通过 raw.githubusercontent.com 或注入的 fetcher）。 */
+async function fetchRemoteVersion(source, fetcher) {
+    const spec = parseInstallSpec(source);
+    const urls = manifestCandidateUrls(spec);
+    if (urls.length === 0)
+        return null;
+    const fetchImpl = fetcher ?? (typeof fetch === "function" ? fetch : null);
+    if (!fetchImpl)
+        return null;
+    for (const url of urls) {
+        try {
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), 6000);
+            const res = await fetchImpl(url, { signal: ctrl.signal }).finally(() => clearTimeout(timer));
+            if (!res.ok)
+                continue;
+            const data = (await res.json());
+            if (typeof data?.version === "string" && data.version.trim()) {
+                return data.version.trim();
+            }
+        }
+        catch {
+            // 单个 URL 失败继续尝试下一个候选
+        }
+    }
+    return null;
+}
+/** 扫描全部已装插件，对比本地 sha/version 与远端 sha/version，报告更新状态。 */
 export async function checkPluginUpdates(dataDir, exec = execGit, 
 /** error 字段文案语言（默认英文）；调用方可传 () => getLang() 实现跟随。 */
-lang) {
+lang, opts) {
     const l = lang?.() ?? "en";
     const pluginsDir = join(dataDir, "plugins");
     let names = [];
@@ -180,6 +237,42 @@ lang) {
             catch {
                 localSha = null; // 无 sha 记录 → 保守认为可更新（不知道装了哪个版本）
             }
+            let name;
+            let version;
+            try {
+                const m = JSON.parse(readFileSync(join(dir, "manifest.json"), "utf8"));
+                name = m.name;
+                version = m.version;
+            }
+            catch {
+                /* 坏 manifest：仍报告 */
+            }
+            const builtin = isBuiltinPlugin(n, source, opts?.builtinCatalogPath);
+            let latestVersion = null;
+            // 本地开发模式下，如果宿主包自带 plugins/<id>/manifest.json，可直接读本地最新版本号
+            if (opts?.pkgRoot) {
+                const localPkgManifest = join(opts.pkgRoot, "plugins", n, "manifest.json");
+                if (existsSync(localPkgManifest)) {
+                    try {
+                        const rawPkg = JSON.parse(readFileSync(localPkgManifest, "utf8"));
+                        if (typeof rawPkg?.version === "string" && rawPkg.version.trim()) {
+                            latestVersion = rawPkg.version.trim();
+                        }
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                }
+            }
+            // 若本地未取到最新版本号，则尝试通过 fetcher 探测远端 manifest.json
+            if (!latestVersion) {
+                try {
+                    latestVersion = await fetchRemoteVersion(source, opts?.fetcher);
+                }
+                catch {
+                    latestVersion = null;
+                }
+            }
             let remoteSha = null;
             let error;
             try {
@@ -189,27 +282,37 @@ lang) {
                 error = err instanceof Error ? err.message : String(err);
                 remoteSha = null;
             }
-            if (!remoteSha && !error)
+            if (!remoteSha && !latestVersion && !error)
                 error = pick(l, "无法检查（非 git 源或 git 不可用）", "Cannot check (non-git source or git unavailable)", "pluginupdate.cannot.check");
-            let name;
-            let version;
-            try {
-                const m = JSON.parse(readFileSync(join(dir, "manifest.json"), "utf8"));
-                name = m.name;
-                version = m.version;
+            let updatable = false;
+            if (latestVersion && version) {
+                const cmp = compareVersions(latestVersion, version);
+                if (cmp > 0) {
+                    updatable = true;
+                }
+                else if (cmp === 0 && remoteSha && localSha) {
+                    updatable = localSha !== remoteSha;
+                }
+                else if (cmp === 0 && remoteSha && !localSha) {
+                    updatable = true;
+                }
             }
-            catch {
-                /* 坏 manifest：仍报告 */
+            else if (remoteSha) {
+                updatable = !localSha || localSha !== remoteSha;
+            }
+            else if (latestVersion && !version) {
+                updatable = true;
             }
-            const updatable = !!remoteSha && (!localSha || localSha !== remoteSha);
             out.push({
                 id: n,
                 name,
                 version,
+                latestVersion,
                 source,
                 localSha,
                 remoteSha,
                 updatable,
+                builtin,
                 error,
             });
         }

package/dist/server/plugins.js

@@ -21,7 +21,7 @@ import { existsSync, readFileSync, renameSync, watch as fsWatch, writeFileSync }
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pathToFileURL, fileURLToPath } from "node:url";
 import { pick } from "./i18n.js";
-import { PluginStorage, PluginSecrets, ensurePluginDeps, WorkspaceFS } from "./plugin-facilities.js";
+import { PluginStorage, PluginSecrets, ensurePluginDeps, WorkspaceFS, withFileRmwLock } from "./plugin-facilities.js";
 import { parseCronSpec, armDelay, nextCronFire, loadScheduleRecords, saveScheduleRecords, } from "./plugin-schedule.js";
 import { PluginPermissionStore } from "./plugin-permissions.js";
 import { readCatalog, addCustomEntry, removeCustomEntry } from "./plugin-catalog.js";
@@ -34,7 +34,7 @@ import { AGENT_TOOL_CATALOG } from "./tool-manager.js";
 import { applyPostEdit, denialText, freezeParams, isBlockingDecision, normalizePostEdit, normalizePreDecision, withGuardTimeout, } from "./plugin-tool-guard.js";
 // 工作区根的归一化与 client-state 共用一份（同一份语义：只收绝对路径 / 去重 / 上限）。
 import { normalizeWorkspaceRoots } from "./client-state.js";
-import { createProject } from "./plugin-project.js";
+import { createProject, isInsideRoot, realPathOfNearest, } from "./plugin-project.js";
 import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -958,16 +958,20 @@ lang, secrets) {
             if (!secretKeys.has(k))
                 persist[k] = v;
         const file = join(dir, "storage.json");
-        let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(file, "utf8"));
-        }
-        catch {
-            /* 首次 */
-        }
-        const tmp = `${file}.tmp-${process.pid}`;
-        writeFileSync(tmp, JSON.stringify({ ...existing, settings: persist }));
-        renameSync(tmp, file);
+        // 与 PluginStorage.set/delete 同一把按文件路径的 RMW 锁（见 plugin-facilities.ts
+        // 的 withFileRmwLock）：两个「读-改-写」者串行，谁也不会拿旧快照抹掉对方刚写的键。
+        withFileRmwLock(file, () => {
+            let existing = {};
+            try {
+                existing = JSON.parse(readFileSync(file, "utf8"));
+            }
+            catch {
+                /* 首次 */
+            }
+            const tmp = `${file}.tmp-${process.pid}`;
+            writeFileSync(tmp, JSON.stringify({ ...existing, settings: persist }));
+            renameSync(tmp, file);
+        });
     }
     catch (err) {
         console.error(`[plugins] settings persist failed (${dir}):`, err);
@@ -1219,6 +1223,17 @@ export class PluginManager {
         this.senders.add(s);
         return () => this.senders.delete(s);
     }
+    /** 当前在线（hello 过）的 clientId 去重集合。插件授权弹窗广播后按它做应答
+     *  来源绑定——广播后才连上的端没见过弹窗，不许代答（index.ts 三类授权应答校验）。 */
+    onlineClientIds() {
+        const out = new Set();
+        for (const s of this.senders) {
+            const cid = s.cid();
+            if (cid)
+                out.add(cid);
+        }
+        return [...out];
+    }
     /** 客户端上行：路由给对应插件的处理器；未知/未激活的插件静默丢弃。
      *  插件代码不可信——同步抛错与返回的 Promise rejection 都必须隔离在
      *  这里，绝不能炸主进程。 */
@@ -1385,6 +1400,11 @@ export class PluginManager {
             return false;
         return !this.domConsentStore.has(pluginId);
     }
+    /** plugin_dom_consent 两步握手的预检（index.ts 用）：只有声明了 dom 能力的
+     *  插件才允许生成在途 consent 请求——任意 pluginId 进不来，在途表不膨胀。 */
+    isDomPlugin(pluginId) {
+        return this.domWants.get(pluginId) === true;
+    }
     /** 特权 DOM 授权/撤销（设置面板 plugin_dom_consent）。
      *  返回 { changed }：变了才 epoch+1 重推（浏览器按新 epoch 重拉 bundle，
      *  失败缓存随 syncPluginViews 的 epoch 切换清掉）；目标不是 wantsDom 插件
@@ -1642,13 +1662,37 @@ export class PluginManager {
     }
     /** 当前打开对话的快照（无提供者/暂无对话时返回 null）。 */
     getActiveConversation() {
+        let snap;
         try {
-            return this.conversationProvider?.() ?? null;
+            snap = this.conversationProvider?.() ?? null;
         }
         catch (err) {
             console.error("[plugins] conversationProvider failed:", err);
             return null;
         }
+        if (!snap)
+            return null;
+        // 交给插件前做防御性拷贝：provider 回的是快照管线的**活引用** —— messages
+        // 数组与元素对象都被 60ms 推送管线缓存复用（lastMessagesArray / uiMessageCache），
+        // 插件原地改一个字段/挪一个元素，污染的就是推给真实客户端的快照。浅拷数组 +
+        // 元素对象 structuredClone；元素是纯 JSON 结构（details 已过 JSON.stringify 闸），
+        // structuredClone 不会失败，JSON 往返只是万一携带不可克隆值时的兜底。
+        return {
+            ...snap,
+            messages: snap.messages.map((m) => {
+                try {
+                    return structuredClone(m);
+                }
+                catch {
+                    try {
+                        return JSON.parse(JSON.stringify(m));
+                    }
+                    catch {
+                        return { ...m }; // 连 JSON 往返都失败（循环引用）：至少不共享顶层对象
+                    }
+                }
+            }),
+        };
     }
     /** agent-service 调：当前打开对话变了（切历史会话/切 running 对话/新对话）——
      *  轨迹类插件靠它重拉时间线（异常隔离）。 */
@@ -1726,13 +1770,23 @@ export class PluginManager {
             out.push(...table.values());
         return out;
     }
-    /** 注册一个供 AI 调用的工具；重名拒绝并返回空操作注销函数。 */
+    /** 注册一个供 AI 调用的工具；重名拒绝并返回空操作注销函数。
+     *  跨插件重名同样拒绝（与 registerCommand 同口径）：工具进会话时按名字合入
+     *  （syncPluginToolsIntoSession 的 byName 覆盖），重名意味着后注册者静默抢注
+     *  前者的工具，必须在这里挡下。 */
     registerAgentTool(pluginId, tool) {
         if (!tool || typeof tool.execute !== "function" || !tool.name || !tool.description) {
             console.error(`[plugin:${pluginId}] registerAgentTool: 缺少 name/description/execute，忽略`);
             this.pushRuntimeDiag(pluginId, "registerAgentTool: missing name/description/execute, ignored");
             return () => { };
         }
+        for (const [pid, other] of this.agentTools) {
+            if (pid !== pluginId && other.has(tool.name)) {
+                console.error(`[plugin:${pluginId}] AI 工具 "${tool.name}" 已被插件 ${pid} 注册，忽略重复`);
+                this.pushRuntimeDiag(pluginId, `agent tool "${tool.name}": already registered by plugin ${pid}, ignored`);
+                return () => { };
+            }
+        }
         let table = this.agentTools.get(pluginId);
         if (!table)
             this.agentTools.set(pluginId, (table = new Map()));
@@ -2596,6 +2650,23 @@ export class PluginManager {
                 return abs;
             throw new Error(`目录未授权：先 await host.fs.requestAccess(dir)（${abs}）`);
         };
+        /** 写类操作（write/remove）的 realpath 复核：allowAbs 是纯字符串判定，
+         *  授权目录里的符号链接/junction 能把写入/递归删除引到授权范围之外。
+         *  取目标最近已存在祖先的 realpath，要求它仍落在（工作区或该插件任一
+         *  已授权目录）的 realpath 内。读/list/stat 保持字符串校验（高频路径，
+         *  且读不存在「把内容写到别处」的风险）。 */
+        const assertRealInsideGrant = async (abs) => {
+            const targetReal = realPathOfNearest(abs);
+            if (!targetReal)
+                throw new Error(`无法解析真实路径：${abs}`);
+            const granted = self.grants.list().find((g) => g.pluginId === info.id)?.paths ?? [];
+            for (const r of [self.cwdValue, ...granted]) {
+                const rootReal = realPathOfNearest(resolve(r)) ?? resolve(r);
+                if (isInsideRoot(rootReal, targetReal))
+                    return;
+            }
+            throw new Error(`路径越界（符号链接指向授权范围之外）：${abs}`);
+        };
         const crossDirFs = {
             list: async (absDir) => {
                 const abs = allowAbs(absDir);
@@ -2610,11 +2681,13 @@ export class PluginManager {
             },
             write: async (absPath, data) => {
                 const abs = allowAbs(absPath);
+                await assertRealInsideGrant(abs);
                 await mkdir(dirname(abs), { recursive: true });
                 await writeFile(abs, data);
             },
             remove: async (absPath) => {
                 const abs = allowAbs(absPath);
+                await assertRealInsideGrant(abs);
                 await rm(abs, { recursive: true, force: true });
             },
             stat: async (absPath) => {
@@ -3208,8 +3281,23 @@ export class PluginManager {
                         self.pushRuntimeDiag(info.id, `ui.update: unknown id "${String(id).slice(0, 32)}", ignored`);
                         return;
                     }
-                    const merged = { ...base, ...patch, id, slot: base.slot };
-                    self.uiRuntimeFor(info.id).items.set(id, merged);
+                    // 与注册同一条校验管线：patch 合进 base 后整体过 parseUiItem，
+                    // 非法字段按 parse 语义丢弃/回落（未知键清掉、iconSvg 重新归一化、
+                    // 超长截断、progress 夹取），id 与 slot 不可被 patch 改写。
+                    const diags = [];
+                    const mergedRaw = typeof patch === "object" && patch !== null && !Array.isArray(patch)
+                        ? { ...base, ...patch, id, slot: base.slot }
+                        : { ...base, id, slot: base.slot };
+                    const parsed = parseUiItem(mergedRaw, base.slot, diags);
+                    for (const m of diags)
+                        self.pushRuntimeDiag(info.id, `ui.update: ${m}`);
+                    if (!parsed) {
+                        // 合并结果不合法（典型：patch 把 label 改成空）——按现有 parse 语义
+                        // 视为无效更新，保留原条目。
+                        self.pushRuntimeDiag(info.id, `ui.update: merged item invalid, update ignored`);
+                        return;
+                    }
+                    self.uiRuntimeFor(info.id).items.set(id, parsed);
                     void self.pushToAll().catch(() => { });
                 },
                 remove: (id) => {
@@ -3548,36 +3636,13 @@ export class PluginManager {
                 fetch: async (url, init) => {
                     if (!can("net"))
                         return { ok: false, error: '插件未声明能力 "net"（manifest.permissions）——请求被拒' };
-                    try {
-                        const u = new URL(String(url));
-                        if (u.protocol !== "http:" && u.protocol !== "https:") {
-                            return { ok: false, error: `net: 不支持的协议 ${u.protocol}` };
-                        }
+                    return pluginNetFetch(url, init, {
                         // 白名单：主机相等或 .后缀匹配；空表即全拒（fail-closed）。
                         // 用户动态批准的主机（host.requestPermission）同样放行，免改 manifest 重装。
-                        const hostname = u.hostname.toLowerCase();
-                        const allowed = netAllow.some((entry) => hostname === entry || hostname.endsWith(`.${entry}`)) ||
-                            self.permGrants.has(info.id, "net", { host: hostname });
-                        if (!allowed)
-                            return {
-                                ok: false,
-                                error: `net: 主机 ${u.hostname} 未授权（manifest.netAllowlist 或 host.requestPermission 申请）`,
-                            };
-                        if (init?.body !== undefined && Buffer.byteLength(String(init.body), "utf8") > 1024 * 1024) {
-                            return { ok: false, error: "net: body 超过 1MB 上限" };
-                        }
-                        const res = await globalThis.fetch(String(url), {
-                            method: init?.method ?? "GET",
-                            ...(init?.headers ? { headers: init.headers } : {}),
-                            ...(init?.body !== undefined ? { body: init.body } : {}),
-                            signal: AbortSignal.timeout(15_000),
-                        });
-                        const text = (await res.text()).slice(0, 512 * 1024);
-                        return { ok: true, status: res.status, text };
-                    }
-                    catch (err) {
-                        return { ok: false, error: err.message };
-                    }
+                        hostAllowed: (hostname) => netAllow.some((entry) => hostname === entry || hostname.endsWith(`.${entry}`)) ||
+                            self.permGrants.has(info.id, "net", { host: hostname }),
+                        fetchImpl: (input, reqInit) => globalThis.fetch(input, reqInit),
+                    });
                 },
             },
             events: {
@@ -3805,3 +3870,99 @@ export function syncPluginToolsIntoSession(session, defs, prevNames) {
     session._refreshToolRegistry();
     return new Set(defs.map((d) => d.name));
 }
+/** net.fetch 的手动重定向跳数上限。 */
+const NET_FETCH_MAX_REDIRECTS = 5;
+/**
+ * net.fetch 的白名单 + 手动重定向循环（抽出为纯可注入函数，vitest 直测）。
+ *
+ * 为什么不用 redirect:"follow"：跟随重定向不复查白名单，会把「只授权了 A 主机」
+ * 变成「A 主机一跳把你带到任意主机/内网地址」（经典白名单绕过跳板）。所以：
+ *  - 每一跳（含首次）的目标 host 都重新过 allowHost（manifest 白名单 + 用户动态批准）；
+ *  - redirect:"manual"，至多 NET_FETCH_MAX_REDIRECTS 跳；
+ *  - 跨宿主重定向剥掉 authorization/cookie 头（浏览器同款语义，防凭据外带）；
+ *  - 303 一律转 GET 并丢 body；其余 3xx 保持原 method/body（307/308 语义）；
+ *  - 响应文本整体回给插件的现状保留（512KB 截断不变）；
+ *  - timeout 是整条请求链（含所有跳）共享的墙钟预算（与原实现 15s 同量级）。
+ */
+export async function pluginNetFetch(url, init, deps) {
+    const deadline = Date.now() + Math.max(1000, Number(deps.timeoutMs ?? 15_000));
+    let current = String(url ?? "");
+    let method = init?.method;
+    let headers = init?.headers;
+    let body = init?.body;
+    for (let hop = 0;; hop++) {
+        let u;
+        try {
+            u = new URL(current);
+        }
+        catch {
+            return { ok: false, error: `net: 无效 URL ${current}` };
+        }
+        if (u.protocol !== "http:" && u.protocol !== "https:") {
+            return { ok: false, error: `net: 不支持的协议 ${u.protocol}` };
+        }
+        // 白名单：主机相等或 .后缀匹配；空表即全拒（fail-closed）。每一跳都查。
+        if (!deps.hostAllowed(u.hostname.toLowerCase())) {
+            return {
+                ok: false,
+                error: `net: 主机 ${u.hostname} 未授权（manifest.netAllowlist 或 host.requestPermission 申请）`,
+            };
+        }
+        if (body !== undefined && Buffer.byteLength(String(body), "utf8") > 1024 * 1024) {
+            return { ok: false, error: "net: body 超过 1MB 上限" };
+        }
+        let res;
+        try {
+            res = await deps.fetchImpl(current, {
+                ...(method ? { method } : {}),
+                ...(headers ? { headers } : {}),
+                ...(body !== undefined ? { body } : {}),
+                redirect: "manual",
+                signal: AbortSignal.timeout(Math.max(1000, deadline - Date.now())),
+            });
+        }
+        catch (err) {
+            return { ok: false, error: err.message };
+        }
+        // 3xx 且带 location → 手动跳下一跳（目标 host 重新过上面的白名单）。
+        if (res.status >= 300 && res.status < 400) {
+            const loc = res.headers.get("location");
+            if (loc) {
+                if (hop >= NET_FETCH_MAX_REDIRECTS) {
+                    return { ok: false, error: `net: 重定向超过 ${NET_FETCH_MAX_REDIRECTS} 跳上限` };
+                }
+                let next;
+                try {
+                    next = new URL(loc, u);
+                }
+                catch {
+                    return { ok: false, error: `net: 重定向目标无效 ${loc}` };
+                }
+                if (next.hostname.toLowerCase() !== u.hostname.toLowerCase() && headers) {
+                    // 跨宿主：凭据类头不外带。
+                    const stripped = {};
+                    for (const [k, v] of Object.entries(headers)) {
+                        const key = k.toLowerCase();
+                        if (key === "authorization" || key === "cookie")
+                            continue;
+                        stripped[k] = v;
+                    }
+                    headers = stripped;
+                }
+                if (res.status === 303) {
+                    method = "GET";
+                    body = undefined;
+                }
+                current = next.toString();
+                continue;
+            }
+        }
+        try {
+            const text = (await res.text()).slice(0, 512 * 1024);
+            return { ok: true, status: res.status, text };
+        }
+        catch (err) {
+            return { ok: false, error: err.message };
+        }
+    }
+}

package/dist/server/present-files-tool.js

@@ -19,7 +19,7 @@
  * resolvePathForDirCheck）；回传的 `path` 是线形绝对路径（"C:/…" / "/…"），
  * 前端拿它直接打 /api/file、file_reveal、file_open_default，不受会话 cwd 影响。
  *
- * 双语约定（issue #91）：definition 走 bilingual(en, zh) 内联双语；per-call
+ * 文案约定：工具 definition（description/promptSnippet/promptGuidelines）为纯英文；per-call
  * 结果文本走 pick(lang, zh, en, key, vars)，缺表回落英文内联。
  *
  * DSH 引擎无 customTool 注册面（工具来自 shipped preset），本工具只服务 pi 引擎。
@@ -28,7 +28,7 @@ import { open, stat } from "node:fs/promises";
 import { basename, extname, sep } from "node:path";
 import { defineTool } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import { bilingual, pick } from "./i18n.js";
+import { pick } from "./i18n.js";
 import { resolvePathForDirCheck } from "./read-tool.js";
 import { decodeText, isAudioFile, looksLikeText, previewKind } from "./text-sniff.js";
 import { PRESENT_FILES_TOOL_NAME } from "./tool-manager.js";
@@ -239,17 +239,14 @@ export function makePresentFilesTool(fallbackCwd, options = {}) {
     return defineTool({
         name: PRESENT_FILES_TOOL_NAME,
         label: "Show files to the user",
-        description: bilingual("Show files to the user as preview cards in the chat. Each item renders as a card: images/videos/audio are displayed inline, text/markdown/HTML can be opened in the preview dialog, and every card carries buttons to open the file locally, reveal it in the file manager, download it or copy its path. " +
-            "Use it whenever the user should LOOK at an artifact you produced or changed: a screenshot, chart, diagram, generated video/audio, report, log, build output. " +
-            "Give workspace-relative paths (or absolute ones); up to 12 items per call; `title` and `note` are shown above the cards, `caption` under the file name, and `focus: true` makes the client open that item in the preview dialog right away. " +
-            "Do not use it for files you merely read while reasoning, and do not repeat the file contents in your reply afterwards.", "把文件作为预览卡片展示给用户。每个条目渲染成一张卡片：图片/视频/音频直接在对话里显示，文本/markdown/HTML 可一键打开预览弹窗，每张卡片都带「本地打开 / 在文件管理器中显示 / 下载 / 复制路径」按钮。" +
-            "适合用户**应该看一眼**的产物：截图、图表、示意图、生成的视频音频、报告、日志、构建产物。" +
-            "路径写工作区相对路径（或绝对路径）；单次最多 12 条；`title`/`note` 显示在卡片上方，`caption` 显示在文件名旁，`focus: true` 让客户端立刻用预览弹窗打开该条目。" +
-            "只是自己读文件来推理时不要调用它，调用后也不要在回复里把文件内容再贴一遍。"),
-        promptSnippet: bilingual("show images/videos/text files to the user as preview cards", "把图片/视频/文本文件作为预览卡片展示给用户"),
+        description: "Show files to the user as preview cards in the chat: images/videos/audio inline, text/markdown/HTML in a preview dialog; each card can open locally, reveal in file manager, download, or copy path. " +
+            "Use whenever the user should LOOK at an artifact you produced or changed (screenshot, chart, diagram, video/audio, report, log, build output). " +
+            "Give workspace-relative paths (max 12 items); `title`/`note` show above the cards, `caption` next to the file name, `focus: true` opens that item in the preview dialog immediately. " +
+            "Do not use for files you merely read while reasoning, and do not repeat file contents in your reply.",
+        promptSnippet: "show images/videos/text files to the user as preview cards",
         promptGuidelines: [
-            bilingual("After producing something visual or user-facing (screenshot, chart, video, report, log, build output), call present_files so the user can actually see it instead of only printing the path", "产出可视化或面向用户的文件后（截图、图表、视频、报告、日志、构建产物），调 present_files 让用户真的看到，而不是只打印一行路径"),
-            bilingual("Do not call present_files for ordinary source edits the user did not ask to see, and never call it twice for the same file in one turn", "用户没要求看的普通源码改动不要用 present_files；同一轮里不要为同一个文件调两次"),
+            "After producing something visual or user-facing (screenshot, chart, video, report, log, build output), call present_files so the user can actually see it instead of only printing the path",
+            "Do not call present_files for ordinary source edits the user did not ask to see, and never call it twice for the same file in one turn",
         ],
         parameters: Type.Object({
             title: Type.Optional(Type.String({

package/dist/server/process-utils.js

@@ -92,6 +92,10 @@ export async function snapshotProcessParents() {
  * asynchronous. Existing callers may continue to ignore it for best-effort
  * background cleanup; callers that own a deadline can await completion. */
 export async function killPidTree(pid) {
+    // pid 下界防护：pid<=1（init / Windows System 级 pid）或自身 pid 绝不能杀 ——
+    // POSIX 的 -pid 是进程组语义，误传 0/1/自身 pid 会杀掉整组无辜进程甚至本进程。
+    if (!(pid > 1 && pid !== process.pid))
+        return;
     try {
         if (process.platform === "win32") {
             const { spawn } = await import("node:child_process");

package/dist/server/prompt-composer.js

@@ -249,3 +249,12 @@ export function renderPromptTemplate(template, texts, overrides) {
 export function renderDefaultPrompt(texts) {
     return renderPromptTemplate(DEFAULT_PROMPT_TEMPLATE, texts, undefined);
 }
+const CJK_RE = /[\u3040-\u30ff\u3400-\u4dbf\u4e00-\u9fff\uf900-\ufaff\uac00-\ud7af]/gu;
+/** 粗略 token 估算（设置面板预览用，非精确分词，无 tokenizer 依赖）：
+ *  CJK 字符（汉字/假名/谚文）≈ 1 token/字，其余字符 ≈ 1 token / 4 字符。 */
+export function estimatePromptTokens(text) {
+    if (!text)
+        return 0;
+    const cjk = text.match(CJK_RE)?.length ?? 0;
+    return Math.ceil(cjk + (text.length - cjk) / 4);
+}

package/dist/server/protocol-version.js

@@ -8,4 +8,4 @@
  * its own copy in web/src/protocol-version.ts; scripts/check-protocol-sync.mjs
  * verifies the two never drift.
  */
-export const PROTOCOL_VERSION = 19;
+export const PROTOCOL_VERSION = 20;