pi-web-ui 0.95.0 → 0.96.0

package/dist/server/mcp-bridge.js

@@ -16,8 +16,12 @@
 import { spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { bilingual } from "./i18n.js";
 const PROTOCOL_VERSION = "2025-03-26"; // 广泛支持的工具版本
+/** 单行（一条 JSON-RPC 消息）的长度上限（1MB）：失控服务器一行永不换行会顶爆内存。 */
+const MCP_MAX_LINE_CHARS = 1024 * 1024;
+/** 未换行数据的总缓冲上限（4MB）：服务器只吐垃圾不吐换行时按协议错误杀进程。
+ *  上限按 JS 字符串长度计（UTF-16 码元 ≤ UTF-8 字节），内存放大有界。 */
+const MCP_MAX_BUFFER_CHARS = 4 * 1024 * 1024;
 let rpcSeq = 0;
 /**
  * 单个 MCP 服务器的客户端：管理子进程、请求/响应按 id 关联、握手与工具调用。
@@ -245,12 +249,22 @@ export class McpClient {
     }
     onData(chunk) {
         this.buffer += chunk;
+        // 总缓冲上限：服务器一直输出却不换行（或极慢地换行）时，缓冲会无限涨，
+        // 宿主内存被一个失控子进程吃光。超限按协议错误处理：杀进程 + 拒绝在途请求。
+        if (this.buffer.length > MCP_MAX_BUFFER_CHARS) {
+            this.killForProtocolError(new Error(`[mcp:${this.name}] stdout 缓冲超过 ${Math.round(MCP_MAX_BUFFER_CHARS / 1024 / 1024)}MB 上限，按协议错误关闭`));
+            return;
+        }
         let nl;
         while ((nl = this.buffer.indexOf("\n")) >= 0) {
             const line = this.buffer.slice(0, nl).trim();
             this.buffer = this.buffer.slice(nl + 1);
             if (!line)
                 continue;
+            if (line.length > MCP_MAX_LINE_CHARS) {
+                this.killForProtocolError(new Error(`[mcp:${this.name}] 单行超过 ${Math.round(MCP_MAX_LINE_CHARS / 1024 / 1024)}MB 上限，按协议错误关闭`));
+                return;
+            }
             let msg;
             try {
                 msg = JSON.parse(line);
@@ -262,6 +276,24 @@ export class McpClient {
             this.handleMessage(msg);
         }
     }
+    /** 协议错误（stdout 缓冲超限）：杀掉子进程、拒绝全部在途请求、清空缓冲。
+     *  与进程自然退出共用自愈语义 —— 下一次工具调用会重新拉起并重新握手
+     *  （失控服务器重启后再次超限就再次杀，不会永久占用宿主内存）。 */
+    killForProtocolError(err) {
+        this.log(err.message);
+        this.buffer = "";
+        const child = this.child;
+        this.child = null;
+        this.rejectAll(err);
+        if (child) {
+            try {
+                child.kill();
+            }
+            catch {
+                /* 已退出 */
+            }
+        }
+    }
     handleMessage(msg) {
         if (msg.id !== undefined) {
             const pending = this.pending.get(String(msg.id));
@@ -360,8 +392,7 @@ function adaptMcpTool(serverName, mcpTool, client) {
     return {
         name,
         label: `${serverName} · ${mcpTool.name}`,
-        description: mcpTool.description ??
-            bilingual(`Tool ${mcpTool.name} provided by MCP server "${serverName}"`, `从 MCP 服务器「${serverName}」提供的工具 ${mcpTool.name}`),
+        description: mcpTool.description ?? `Tool ${mcpTool.name} provided by MCP server "${serverName}"`,
         parameters: mcpTool.inputSchema ?? {},
         execute: async (_toolCallId, params, _signal) => {
             return client.call(mcpTool.name, params ?? {});
@@ -380,6 +411,8 @@ export class McpBridge {
     opts;
     clients = [];
     tools = [];
+    /** reload 串行化链：重入的 reload 排在前一个之后，杜绝交叠留下的孤儿进程。 */
+    reloadChain = Promise.resolve();
     constructor(dataDir, log = () => { }, opts = {}) {
         this.dataDir = dataDir;
         this.log = log;
@@ -411,6 +444,12 @@ export class McpBridge {
     }
     /**
      * 按磁盘上的最新配置**整体换入**服务器集合（`mcp.json` 热加载用），可重复调用。
+     *
+     * 并发互斥：watch + 轮询 + 手动 apply 可能同时触发 reload，两个 reload 交叠跑
+     * 会各自 startOne/close —— 同一服务器起两个子进程、或把别人刚换入的实例当
+     * stale 关掉（孤儿/误杀）。这里用一条 promise 链把重入排成队，每个 reload
+     * 看到的是前一个完成后的最新状态；热加载的防抖窗口之外再兜一道。
+     *
      * 三步的顺序都有讲究：
      *  1. 规格没变的服务器**沿用原实例** —— 改一个服务器不该连带重启其它服务器（子进程、
      *     浏览器会话、在途调用全都不动）；
@@ -419,6 +458,11 @@ export class McpBridge {
      *  3. 最后才 close 掉被移除/被替换的旧实例，并按新集合重建工具表。
      */
     async reload() {
+        const run = this.reloadChain.then(() => this.reloadOnce(), () => this.reloadOnce());
+        this.reloadChain = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    async reloadOnce() {
         const cfg = optsOverrideOrRead(this.opts.specOverride, this.dataDir);
         const next = new Map();
         let kept = 0;

package/dist/server/model-admin.js

@@ -11,7 +11,7 @@
  * 经 ModelAdminHost 与 ClientSession 解耦（同 settings/goal/slash 服务模式）。
  * UI 文案直接中文（服务端 notice 约定）。apiKey/headers 绝不下发浏览器。
  */
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { enrichBatch } from "./model-enrich.js";
 import { pick } from "./i18n.js";
@@ -65,6 +65,13 @@ export function graduateOverlayModels(providers, official) {
     }
     return graduated;
 }
+/** 原子写 JSON（tmp + rename）：进程崩溃不留半截文件——裸 writeFileSync 中途被
+ *  杀会把整份配置截断，下次读盘即空表。tmp 名带 pid，避免同机多进程互踩。 */
+function atomicWriteJson(path, data) {
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
+    renameSync(tmp, path);
+}
 /** Strip // and /* *\/ comments without touching string literals (URLs contain //). */
 function stripJsonComments(src) {
     let out = "";
@@ -111,7 +118,7 @@ function stripJsonComments(src) {
 /** Merge a UI-submitted provider config into the existing models.json entry.
  *
  * 表单（`UiProviderConfig`）只承载 UI 认识的字段：provider 级 name/api/baseUrl/
- * apiKey/authHeader，模型级 id/name/reasoning/input/contextWindow/maxTokens。
+ * hasApiKey/authHeader，模型级 id/name/reasoning/input/contextWindow/maxTokens。
  * models.json 里还可能有 UI 不认识的字段——provider 级 headers（浏览器拿不到，
  * 见 listModelsConfig）、模型级 api/baseUrl/cost/compat/thinkingLevelMap（手写或
  * 脚本写入，pi-ai 靠它们决定请求地址与推理格式）。按表单整体重建条目会把这些字段
@@ -120,6 +127,10 @@ function stripJsonComments(src) {
  *
  * 所以这里以已有条目为底、表单字段覆盖：表单没提到的字段原样保留，表单清空的可选
  * 字段才真正删除；`models` 仍是「表单即全集」——表单里删掉的 id 会被移除。
+ *
+ * apiKey 例外：浏览器不再持有明文（只见 hasApiKey），**缺字段 = 保留旧值**；显式
+ * 空串才清除（协议级"空=清除"语义保留，但 Web 表单留空时整字段不传）。这样
+ * refresh_provider_models 等不带 apiKey 的内部保存路径也绝不会把密钥抹掉。
  */
 export function mergeProviderConfigEntry(prevEntry, config, models) {
     const prevModels = new Map();
@@ -134,7 +145,7 @@ export function mergeProviderConfigEntry(prevEntry, config, models) {
     }
     const mergedModels = models.map((model) => {
         // 旧条目同 id 的字段（api/baseUrl/cost/compat/…）先铺底，表单字段覆盖。
-        const merged = { ...(prevModels.get(model.id) ?? {}), id: model.id };
+        const merged = { ...prevModels.get(model.id), id: model.id };
         if (model.name?.trim())
             merged.name = model.name.trim();
         else
@@ -167,7 +178,12 @@ export function mergeProviderConfigEntry(prevEntry, config, models) {
     apply("name", config.name?.trim() || undefined);
     apply("api", config.api?.trim() || undefined);
     apply("baseUrl", config.baseUrl?.trim() || undefined);
-    apply("apiKey", config.apiKey?.trim() || undefined);
+    if (config.apiKey === undefined) {
+        // 表单没带 apiKey（留空/内部路径）→ 保留旧值，绝不清除。
+    }
+    else {
+        apply("apiKey", config.apiKey.trim() || undefined);
+    }
     apply("authHeader", config.authHeader ? true : undefined);
     mergedEntry.models = mergedModels;
     return mergedEntry;
@@ -331,29 +347,55 @@ export class ModelAdminService {
     }
     /** Read + parse provider-keys.json. */
     readProviderKeys() {
+        let raw;
         try {
-            const parsed = JSON.parse(readFileSync(this.providerKeysPath(), "utf8"));
-            const out = {};
-            for (const [pid, entry] of Object.entries(parsed)) {
-                const keys = Array.isArray(entry?.keys) ? entry.keys.filter((k) => k?.name && k?.apiKey) : [];
-                if (!pid || keys.length === 0)
-                    continue;
-                const activeKeyName = entry.activeKeyName === null
-                    ? null
-                    : entry.activeKeyName && keys.some((k) => k.name === entry.activeKeyName)
-                        ? entry.activeKeyName
-                        : keys[0].name;
-                out[pid] = { activeKeyName, keys };
-            }
-            return out;
+            raw = readFileSync(this.providerKeysPath(), "utf8");
         }
         catch {
+            return {}; // 文件不存在 = 首次引导
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            // 坏文件改名留存：里面可能有全部备用密钥，绝不能被后续种子/空表整份覆盖。
+            this.quarantineCorruptFile(this.providerKeysPath(), err);
             return {};
         }
+        const out = {};
+        for (const [pid, entry] of Object.entries(parsed)) {
+            const keys = Array.isArray(entry?.keys) ? entry.keys.filter((k) => k?.name && k?.apiKey) : [];
+            if (!pid || keys.length === 0)
+                continue;
+            const activeKeyName = entry.activeKeyName === null
+                ? null
+                : entry.activeKeyName && keys.some((k) => k.name === entry.activeKeyName)
+                    ? entry.activeKeyName
+                    : keys[0].name;
+            out[pid] = { activeKeyName, keys };
+        }
+        return out;
     }
     writeProviderKeys(data) {
         mkdirSync(this.host.agentDir, { recursive: true });
-        writeFileSync(this.providerKeysPath(), JSON.stringify(data, null, 2) + "\n");
+        // 原子写（tmp+rename）：崩溃不留半截 JSON；0o600 限权防本机其他用户读密钥
+        //（Windows 忽略 mode 无害，POSIX 生效）。
+        const path = this.providerKeysPath();
+        const tmp = `${path}.${process.pid}.tmp`;
+        writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    /** 解析失败的配置文件改名留存为 <name>.corrupt-<timestamp>。改名失败（占用/
+     *  跨盘等）也不抛——留存是尽力而为，绝不能阻塞主流程。 */
+    quarantineCorruptFile(path, err) {
+        try {
+            renameSync(path, `${path}.corrupt-${Date.now()}`);
+            console.warn(`[model-admin] 配置文件解析失败，已改名留存：${path}（${err.message}）`);
+        }
+        catch {
+            console.warn(`[model-admin] 配置文件解析失败且无法留存：${path}（${err.message}）`);
+        }
     }
     /** Default name "密钥 N" for a provider's Nth key. */
     defaultKeyName(keys) {
@@ -421,12 +463,17 @@ export class ModelAdminService {
         }
     }
     /** Push the masked provider-keys map to the client. Seeds the store from any
-     *  auth.json credentials so legacy single-key setups show up immediately. */
+     *  auth.json credentials so legacy single-key setups show up immediately.
+     *  只在文件不存在（首次引导）时才落盘种子；文件存在（含空表）绝不整份写回
+     *  ——写回的来源永远是读盘结果，避免任何竞态把用户密钥覆盖掉。 */
     listProviderKeys() {
+        const path = this.providerKeysPath();
         const data = this.readProviderKeys();
-        for (const pid of this.builtinProviderIds())
-            this.seedProviderKeysFromAuth(pid, data);
-        this.writeProviderKeys(data);
+        if (!existsSync(path)) {
+            for (const pid of this.builtinProviderIds())
+                this.seedProviderKeysFromAuth(pid, data);
+            this.writeProviderKeys(data);
+        }
         this.host.emit({ type: "provider_keys", ...this.providerKeysInfo(data) });
         this.host.flushSnapshot();
     }
@@ -458,7 +505,7 @@ export class ModelAdminService {
             // no file yet / unparsable — start fresh
         }
         data[pid] = { type: "api_key", key: apiKey };
-        writeFileSync(authPath, JSON.stringify(data, null, 2) + "\n");
+        atomicWriteJson(authPath, data);
         const mr = this.host.modelRuntime();
         await mr.setRuntimeApiKey(pid, apiKey);
         await mr.refresh({ allowNetwork: true, providers: [pid] });
@@ -689,7 +736,7 @@ export class ModelAdminService {
                     // no file yet — nothing to clean
                 }
                 delete auth[pid];
-                writeFileSync(authPath, JSON.stringify(auth, null, 2) + "\n");
+                atomicWriteJson(authPath, auth);
                 const mr = this.host.modelRuntime();
                 await mr.removeRuntimeApiKey(pid);
                 await mr.refresh({ providers: [pid] });
@@ -780,7 +827,7 @@ export class ModelAdminService {
                 return;
             }
             delete data[pid];
-            writeFileSync(authPath, JSON.stringify(data, null, 2) + "\n");
+            atomicWriteJson(authPath, data);
             // Clear every stored key so the provider returns to unconfigured.
             delete keyData[pid];
             this.writeProviderKeys(keyData);
@@ -1131,7 +1178,8 @@ export class ModelAdminService {
                 name: p.name,
                 api: p.api,
                 baseUrl: p.baseUrl,
-                apiKey: p.apiKey,
+                // apiKey 明文绝不下发浏览器，只报有无；表单留空 = 保持不变。
+                hasApiKey: typeof p.apiKey === "string" && p.apiKey.trim() !== "",
                 authHeader: p.authHeader,
                 // headers are intentionally NOT sent to the browser — they may
                 // contain Authorization / API-key values; kept server-side only.
@@ -1232,12 +1280,23 @@ export class ModelAdminService {
      *  because the baseUrl is often a LAN/loopback host the browser can't reach
      *  cross-origin) and return the advertised models. reqId is echoed back
      *  in fetch_models_result so the UI can match concurrent requests. */
+    /** 编辑表单的探测（fetch_models / test_model_connection）没带明文 apiKey 时，
+     *  按 providerId 回落到 models.json 里已保存的密钥——编辑存量服务商时表单
+     *  一律留空（明文不再回传浏览器），没有这个回落「测试连接」就会 401。 */
+    savedProviderApiKey(providerId) {
+        const pid = providerId?.trim();
+        if (!pid)
+            return undefined;
+        const saved = this.readModelsConfig().providers[pid];
+        return typeof saved?.apiKey === "string" && saved.apiKey.trim() ? saved.apiKey : undefined;
+    }
     async fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, 
     /** 探测抛错文案语言（默认英文）；调用方可传 () => getLang() 实现跟随。 */
-    lang) {
+    lang, providerId) {
         const emitError = (error) => this.host.emit({ type: "fetch_models_result", reqId, ok: false, error });
         try {
-            const models = await ModelAdminService.probeModelsEndpoint(baseUrl, apiKey, authHeader, api, undefined, lang);
+            const key = apiKey?.trim() || this.savedProviderApiKey(providerId);
+            const models = await ModelAdminService.probeModelsEndpoint(baseUrl, key, authHeader, api, undefined, lang);
             this.host.emit({ type: "fetch_models_result", reqId, ok: true, models });
         }
         catch (err) {
@@ -1248,10 +1307,11 @@ export class ModelAdminService {
      * Lightweight connectivity and auth probe for a provider endpoint.
      * Measures latency in ms and returns ok/error.
      */
-    async testConnection(reqId, baseUrl, apiKey, authHeader, api, lang) {
+    async testConnection(reqId, baseUrl, apiKey, authHeader, api, lang, providerId) {
         const start = Date.now();
         try {
-            await ModelAdminService.probeModelsEndpoint(baseUrl, apiKey, authHeader, api, undefined, lang);
+            const key = apiKey?.trim() || this.savedProviderApiKey(providerId);
+            await ModelAdminService.probeModelsEndpoint(baseUrl, key, authHeader, api, undefined, lang);
             const latencyMs = Date.now() - start;
             this.host.emit({ type: "test_model_connection_result", reqId, ok: true, latencyMs });
         }
@@ -1545,7 +1605,7 @@ export class ModelAdminService {
         if (graduated.length === 0)
             return graduated;
         try {
-            writeFileSync(this.modelsConfigPath(), JSON.stringify({ providers }, null, 2) + "\n");
+            atomicWriteJson(this.modelsConfigPath(), { providers });
         }
         catch {
             return [];
@@ -1582,7 +1642,7 @@ export class ModelAdminService {
      *  config list + the picker. Callers emit their own notice. */
     async writeModelsConfigAndReload(providers, pid) {
         mkdirSync(this.host.agentDir, { recursive: true });
-        writeFileSync(this.modelsConfigPath(), JSON.stringify({ providers }, null, 2) + "\n");
+        atomicWriteJson(this.modelsConfigPath(), { providers });
         // Allow a models.json entry to reuse the provider credential already
         // stored in auth.json. Seed the shared runtime too, because older pi-ai
         // versions did not always fall back to stored credentials for a
@@ -1739,7 +1799,7 @@ export class ModelAdminService {
                 return;
             }
             delete providers[providerId];
-            writeFileSync(this.modelsConfigPath(), JSON.stringify({ providers }, null, 2) + "\n");
+            atomicWriteJson(this.modelsConfigPath(), { providers });
             await this.host.modelRuntime().refresh();
             this.host.invalidatePiConfig();
             await this.listModelsConfig();

package/dist/server/office-parse.js

@@ -67,9 +67,9 @@ export function unzipFiles(buf, wanted) {
     let totalUncomp = 0;
     const out = new Map();
     for (const [name, meta] of files) {
-        totalUncomp += meta.uncompSize;
-        if (totalUncomp > OFFICE_MAX_UNCOMPRESSED_BYTES)
+        if (meta.uncompSize > OFFICE_MAX_UNCOMPRESSED_BYTES) {
             throw new Error("解包后内容过大（疑似 zip 炸弹），拒绝预览");
+        }
         const lp = meta.localOffset;
         if (buf.readUInt32LE(lp) !== 0x04034b50)
             throw new Error(`zip 局部头损坏：${name}`);
@@ -81,42 +81,88 @@ export function unzipFiles(buf, wanted) {
         if (meta.flag & 0x1)
             throw new Error(`不支持加密 zip 条目：${name}`);
         const method = lMethod || meta.method;
-        if (method === 0)
-            out.set(name, Buffer.from(raw));
-        else if (method === 8)
-            out.set(name, Buffer.from(inflateRawSync(raw)));
-        else
+        let decompressed;
+        if (method === 0) {
+            decompressed = Buffer.from(raw);
+        }
+        else if (method === 8) {
+            const remainingQuota = OFFICE_MAX_UNCOMPRESSED_BYTES - totalUncomp;
+            if (remainingQuota <= 0)
+                throw new Error("解包后内容过大（疑似 zip 炸弹），拒绝预览");
+            try {
+                decompressed = Buffer.from(inflateRawSync(raw, { maxOutputLength: remainingQuota }));
+            }
+            catch (err) {
+                if (err.message?.includes("maxOutputLength") ||
+                    err.code === "ERR_BUFFER_TOO_LARGE") {
+                    throw new Error("解包后内容过大（疑似 zip 炸弹），拒绝预览");
+                }
+                throw err;
+            }
+        }
+        else {
             throw new Error(`不支持的压缩方式 ${method}：${name}`);
+        }
+        totalUncomp += decompressed.length;
+        if (totalUncomp > OFFICE_MAX_UNCOMPRESSED_BYTES) {
+            throw new Error("解包后内容过大（疑似 zip 炸弹），拒绝预览");
+        }
+        out.set(name, decompressed);
     }
     return out;
 }
+const NAMED_ENTITIES = { lt: "<", gt: ">", amp: "&", quot: '"', apos: "'" };
+/**
+ * 单轮解码命名实体与十/十六进制数字实体（一次扫描同时匹配三类）。
+ *
+ * 旧实现分三段 replace：`&amp;#60;` 会先被命名段解码成 `&#60;`、再被数字段
+ * 解码成 `<`——双重解码让转义文本"逃出"字面量（可注入标签）。单轮扫描把
+ * `&…;` 整体消费、解码产物不参与后续匹配：`&amp;#60;` 正确地得到 `&#60;`。
+ */
 function decodeEntities(s) {
-    return String(s ?? "")
-        .replace(/&(lt|gt|amp|quot|apos);/g, (_, e) => ({ lt: "<", gt: ">", amp: "&", quot: '"', apos: "'" })[e])
-        .replace(/&#(\d+);/g, (_, n) => {
-        try {
-            return String.fromCodePoint(Number(n));
-        }
-        catch {
-            return "";
-        }
-    })
-        .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => {
-        try {
-            return String.fromCodePoint(Number.parseInt(h, 16));
+    return String(s ?? "").replace(/&(?:#([0-9]+);|#x([0-9a-fA-F]+);|([a-zA-Z]+);)/g, (_whole, dec, hex, name) => {
+        if (dec !== undefined) {
+            try {
+                return String.fromCodePoint(Number(dec));
+            }
+            catch {
+                return "";
+            }
         }
-        catch {
-            return "";
+        if (hex !== undefined) {
+            try {
+                return String.fromCodePoint(Number.parseInt(hex, 16));
+            }
+            catch {
+                return "";
+            }
         }
+        // 未知的命名实体保留原文（与旧实现一致，不臆造映射）
+        return NAMED_ENTITIES[name ?? ""] ?? _whole;
     });
 }
 const stripTags = (s) => decodeEntities(String(s ?? "").replace(/<[^>]+>/g, ""));
+/** document.xml 解压后的字节上限：超大 XML 会让段落正则扫描退化成秒级卡顿（同步事件循环被挂死）。 */
+const DOCX_MAX_XML_BYTES = 20 * 1024 * 1024;
 /** docx → 段落数组。 */
 export function parseDocxParagraphs(buf) {
     const files = unzipFiles(buf, ["word/document.xml"]);
     const xml = files.get("word/document.xml")?.toString("utf8");
     if (!xml)
         throw new Error("docx 里找不到 word/document.xml");
+    // 预检 1：解压后过大的 document.xml 在下面的正则扫描里代价爆炸（一次性物化
+    // 全部段落、非贪婪匹配最坏回溯到文本末尾），直接友好报错而不是挂住进程。
+    if (xml.length > DOCX_MAX_XML_BYTES) {
+        throw new Error(`文档内容过大（document.xml 解压后 ${(xml.length / 1048576).toFixed(1)} MB，上限 20 MB），拒绝预览`);
+    }
+    // 预检 2：正常文档的段落闭合标签与开标签同量级。"只有开标签、没有闭标签"
+    // 的恶意结构会让非贪婪正则在每个候选起点都回溯扫描到文本末尾（O(n²)），
+    // 同步挂死事件循环——开标签远多于闭标签（>2 倍）且闭标签为 0 时直接报错。
+    const opens = xml.match(/<w:p[\s>]/g)?.length ?? 0;
+    const closes = xml.match(/<\/w:p>/g)?.length ?? 0;
+    if (opens > 0 && closes === 0) {
+        throw new Error("文档结构异常（段落标签大量未闭合），疑似恶意文档，拒绝预览");
+    }
     const paragraphs = [];
     for (const m of xml.matchAll(/<w:p[\s>][\s\S]*?<\/w:p>/g)) {
         const pXml = m[0];
@@ -160,11 +206,22 @@ function parseSharedStrings(xml) {
     }
     return out;
 }
+const MAX_PARSE_ROWS = 1000;
+const MAX_PARSE_COLS = 100;
 function parseSheet(xml, shared) {
     const rows = [];
+    let maxRowSeen = 0;
+    let maxColSeen = 0;
     for (const m of xml.matchAll(/<row[^>]*>([\s\S]*?)<\/row>/g)) {
         const rowAttr = m[0].slice(0, m[0].indexOf(">"));
-        const rNum = Number(/r="(\d+)"/.exec(rowAttr)?.[1] ?? rows.length + 1) - 1;
+        const rawRNum = /r="(\d+)"/.exec(rowAttr)?.[1];
+        const rNum = rawRNum ? Number(rawRNum) - 1 : rows.length;
+        if (!Number.isFinite(rNum) || rNum < 0)
+            continue;
+        maxRowSeen = Math.max(maxRowSeen, rNum + 1);
+        // 防 OOM：巨大行号不进行无边界预分配，仅计入总量
+        if (rNum >= MAX_PARSE_ROWS)
+            continue;
         while (rows.length <= rNum)
             rows.push([]);
         const row = rows[rNum];
@@ -173,7 +230,11 @@ function parseSheet(xml, shared) {
             const ref = /r="([^"]+)"/.exec(attrs)?.[1];
             const t = /t="([^"]+)"/.exec(attrs)?.[1];
             const pos = splitCellRef(ref ?? "");
-            if (!pos)
+            if (!pos || pos.col < 0)
+                continue;
+            maxColSeen = Math.max(maxColSeen, pos.col + 1);
+            // 防 OOM：巨大列号不进行无边界空字符串 push
+            if (pos.col >= MAX_PARSE_COLS)
                 continue;
             const inner = c[2];
             let val = "";
@@ -197,7 +258,11 @@ function parseSheet(xml, shared) {
             row[pos.col] = val;
         }
     }
-    return rows;
+    return {
+        rows,
+        nRows: Math.max(rows.length, maxRowSeen),
+        nCols: Math.max(Math.max(0, ...rows.map((r) => r.length)), maxColSeen),
+    };
 }
 /** xlsx/xlsm → sheet 数组（名按 workbook 还原，取不到时回落 sheetN）。 */
 export function parseXlsxSheets(buf) {
@@ -227,10 +292,11 @@ export function parseXlsxSheets(buf) {
     const shared = parseSharedStrings(files.get("xl/sharedStrings.xml")?.toString("utf8"));
     return targets.map((t) => {
         const xml = files.get(t.file)?.toString("utf8");
-        const all = xml ? parseSheet(xml, shared) : [];
-        const fullCols = Math.max(0, ...all.map((r) => r.length));
+        const parsed = xml ? parseSheet(xml, shared) : { rows: [], nRows: 0, nCols: 0 };
+        const fullCols = parsed.nCols;
+        const fullRows = parsed.nRows;
         const nCols = Math.min(MAX_COLS, fullCols);
-        const cut = all.slice(0, MAX_ROWS).map((r) => {
+        const cut = parsed.rows.slice(0, MAX_ROWS).map((r) => {
             const row = r.slice(0, MAX_COLS);
             while (row.length < nCols)
                 row.push("");
@@ -238,10 +304,10 @@ export function parseXlsxSheets(buf) {
         });
         return {
             name: t.name,
-            nRows: all.length,
+            nRows: fullRows,
             nCols: fullCols,
             rows: cut,
-            truncated: all.length > MAX_ROWS || fullCols > MAX_COLS,
+            truncated: fullRows > MAX_ROWS || fullCols > MAX_COLS,
         };
     });
 }

package/dist/server/patch-tool.js

@@ -19,21 +19,15 @@ export function makePatchTool(options) {
     return defineTool({
         name: PATCH_TOOL_NAME,
         label: "Apply Hashline patch",
-        description: `Apply high-reliability, content-hashed, line-anchored patches to files in the workspace.
-Designed to prevent stale edits, line-drift, and indentation hallucination.
-Each file section starts with \`[path#TAG]\` (or \`[path]\` if hash is not yet known).
-Supports:
-- \`PUT N.=M:\` replace original inclusive lines N to M with following \`+TEXT\` lines.
-- \`PUT N*:\` replace entire syntactic block starting at line N (closing brace/indentation resolved automatically).
-- \`PUT <N:\` insert lines before line N (\`PUT <1:\` = head of file).
-- \`PUT >N:\` insert lines after line N (\`PUT >$:\` = end of file).
-- \`CUT N.=M [@name]\` / \`CUT N* [@name]\` delete lines and save to register.
-- \`PUT <N @name\` / \`PUT >N @name\` paste register.
-- \`REM\` delete file.
-- \`MV dest/path\` move/rename file.
-- Body rows under \`:\` headers MUST start with \`+\` (\`+TEXT\`, \`+\` for blank line).
-If file content diverged, the engine attempts automatic 3-way merge recovery.
-After successful patch, the tool returns the next anchor tag and live LSP diagnostics for subsequent edits.`,
+        description: `Apply content-hashed, line-anchored patches to workspace files — prevents stale edits, line drift, and indentation hallucination.
+Each file section starts with \`[path#TAG]\` (or \`[path]\` if the hash is unknown yet). Operations:
+- \`PUT N.=M:\` replace lines N..M (inclusive) with the following \`+TEXT\` lines.
+- \`PUT N*:\` replace the whole syntactic block starting at line N (closing brace/indent auto-resolved).
+- \`PUT <N:\` insert before line N (\`<1\` = head of file); \`PUT >N:\` insert after (\`>$\` = end).
+- \`CUT N.=M [@name]\` / \`CUT N* [@name]\` delete lines and save to register; \`PUT <N @name\` / \`PUT >N @name\` paste it.
+- \`REM\` delete file; \`MV dest/path\` move/rename file.
+- Body rows under \`:\` headers MUST start with \`+\` (\`+\` alone = blank line).
+On divergence the engine attempts a 3-way merge. After success the tool returns the next anchor tag and live LSP diagnostics.`,
         parameters: Type.Object({
             patch: Type.String({
                 description: "The complete Hashline patch text containing one or more [path#TAG] sections with PUT/CUT/REM/MV operations.",

package/dist/server/permission-preset.js

@@ -0,0 +1,25 @@
+/**
+ * 权限预设相关辅助逻辑与会话回放。
+ */
+/**
+ * 从会话 sessionManager entries 回放恢复最后设定的权限预设（若从未设定则返回 undefined）。
+ * customType 为 "permission/preset"，载荷结构为 { preset: string }。
+ */
+export function readPermissionFromSession(sm) {
+    try {
+        const mgr = sm;
+        if (typeof mgr?.getEntries !== "function")
+            return undefined;
+        const entries = mgr.getEntries();
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const e = entries[i];
+            if (e?.type === "custom" && e.customType === "permission/preset" && typeof e.data?.preset === "string") {
+                return e.data.preset;
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    return undefined;
+}

package/dist/server/plan-manager.js

@@ -54,11 +54,21 @@ export class PlanManager {
             return null;
         const currentStep = current.steps[idx];
         const nextStatus = patch.status && VALID_STATUSES.has(patch.status) ? patch.status : currentStep.status;
+        // patch 里剥掉 id：步骤 id 是 activeStepId / first-match 推进的锚点，
+        // 被改掉会让 activeStepId 悬空（指向不存在的步骤）。
+        const { id: _ignored, ...rest } = patch;
         const nextStep = {
             ...currentStep,
-            ...patch,
+            ...rest,
             status: nextStatus,
+            // title/description 与 setPlan 同口径截断（200/1000），防超长内容撑爆快照。
+            title: String(rest.title ?? currentStep.title ?? "").slice(0, 200),
         };
+        const description = String(rest.description ?? currentStep.description ?? "").slice(0, 1000);
+        if (description)
+            nextStep.description = description;
+        else
+            delete nextStep.description;
         const nextSteps = [...current.steps];
         nextSteps[idx] = nextStep;
         let nextActive = current.activeStepId;