pi-web-ui 0.95.0 → 0.96.1

package/dist/server/eval-tool.js

@@ -22,7 +22,7 @@ import { join } from "node:path";
 import readline from "node:readline";
 import { defineTool } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import { bilingual, pick } from "./i18n.js";
+import { pick } from "./i18n.js";
 import { EVAL_TOOL_NAME } from "./tool-manager.js";
 export { EVAL_TOOL_NAME };
 const DEFAULT_TIMEOUT_SECONDS = 15;
@@ -194,6 +194,59 @@ rl.on("line", (line) => {
   }
 });
 `;
+/**
+ * 净化 Eval 子进程环境变量：仅保留操作系统基础变量，剥离所有包含 key/token/secret/auth/cred 等敏感环境变量，
+ * 杜绝沙箱脚本窃取宿主云凭据与 API Key。
+ */
+export function sanitizeEvalEnv(sourceEnv) {
+    const allowedKeys = new Set([
+        "path",
+        "pathext",
+        "systemroot",
+        "windir",
+        "temp",
+        "tmp",
+        "tmpdir",
+        "home",
+        "userprofile",
+        "lang",
+        "lc_all",
+        "term",
+        "shell",
+        "comspec",
+        "os",
+        "number_of_processors",
+        "processor_architecture",
+        "appdata",
+        "localappdata",
+        "homedrive",
+        "homepath",
+        "systemdrive",
+        "programdata",
+        "programfiles",
+        "programfiles(x86)",
+        "commonprogramfiles",
+        "node_env",
+    ]);
+    const cleanEnv = {};
+    for (const [key, value] of Object.entries(sourceEnv)) {
+        if (value === undefined)
+            continue;
+        const lowerKey = key.toLowerCase();
+        if (lowerKey.includes("key") ||
+            lowerKey.includes("token") ||
+            lowerKey.includes("secret") ||
+            lowerKey.includes("auth") ||
+            lowerKey.includes("pass") ||
+            lowerKey.includes("cred")) {
+            continue;
+        }
+        if (allowedKeys.has(lowerKey) || lowerKey.startsWith("npm_") || lowerKey.startsWith("python")) {
+            cleanEnv[key] = value;
+        }
+    }
+    return cleanEnv;
+}
 /** 单个持久内核工作进程包装。 */
 class EvalKernel {
     language;
@@ -221,7 +274,7 @@ class EvalKernel {
             stdio: ["pipe", "pipe", "pipe"],
             detached: process.platform !== "win32",
             env: {
-                ...process.env,
+                ...sanitizeEvalEnv(process.env),
                 PI_EVAL_WORKDIR: this.workdir,
                 PI_EVAL_PROJECT_DIR: this.cwd,
             },
@@ -442,29 +495,27 @@ export function makeEvalTool(opts) {
     return defineTool({
         name: EVAL_TOOL_NAME,
         label: "Execute code in persistent sandbox",
-        description: bilingual("Execute Python or JavaScript/TypeScript code in an isolated evaluation sandbox. " +
+        description: "Execute Python or JavaScript/TypeScript code in an isolated evaluation sandbox. " +
             "Variables and imported modules persist across calls within the conversation. " +
-            "Ideal for quick calculations, data transformations, algorithm verification, and inspecting outputs without creating temporary script files.", "在隔离的代码求值沙箱中执行 Python 或 JavaScript/TypeScript 代码。" +
-            "变量与导入的模块在会话内的多次调用间持续保留。" +
-            "适用于无需创建临时文件的即时计算、数据转换、算法验证与推演。"),
-        promptSnippet: bilingual("evaluate Python or JS/TS code with persistent state (default-off sandbox)", "在保持变量状态的沙箱中执行 Python 或 JS/TS 代码（默认关闭）"),
+            "Ideal for quick calculations, data transformations, algorithm verification, and inspecting outputs without creating temporary script files.",
+        promptSnippet: "evaluate Python or JS/TS code with persistent state (default-off sandbox)",
         parameters: Type.Object({
             code: Type.String({
-                description: bilingual("The code snippet to evaluate. Top-level variables and functions are preserved across calls.", "要执行的代码片段。顶层变量和函数会在后续调用中持续保留。"),
+                description: "The code snippet to evaluate. Top-level variables and functions are preserved across calls.",
             }),
             language: Type.Optional(Type.Union([Type.Literal("py"), Type.Literal("js"), Type.Literal("ts")], {
-                description: bilingual('Target language: "py" for Python (default), "js" or "ts" for Node.js sandbox.', '目标语言："py" 为 Python（默认），"js" 或 "ts" 为 Node.js 沙箱。'),
+                description: 'Target language: "py" for Python (default), "js" or "ts" for Node.js sandbox.',
             })),
             title: Type.Optional(Type.String({
-                description: bilingual('Optional short label for this step (e.g. "Calculate metrics", "Parse payload").', '可选的简短标题（例如 "计算指标"、"解析数据"）。'),
+                description: 'Optional short label for this step (e.g. "Calculate metrics", "Parse payload").',
             })),
             timeout: Type.Optional(Type.Integer({
                 minimum: 1,
                 maximum: MAX_TIMEOUT_SECONDS,
-                description: bilingual(`Execution timeout in seconds (default: ${DEFAULT_TIMEOUT_SECONDS}, maximum: ${MAX_TIMEOUT_SECONDS}).`, `执行超时秒数（默认 ${DEFAULT_TIMEOUT_SECONDS}，最大 ${MAX_TIMEOUT_SECONDS}）。`),
+                description: `Execution timeout in seconds (default: ${DEFAULT_TIMEOUT_SECONDS}, maximum: ${MAX_TIMEOUT_SECONDS}).`,
             })),
             reset: Type.Optional(Type.Boolean({
-                description: bilingual("Whether to reset the sandbox environment before executing (clears all previous variables).", "是否在执行前重置沙箱环境（清空之前的所有变量）。"),
+                description: "Whether to reset the sandbox environment before executing (clears all previous variables).",
             })),
         }),
         execute: async (_id, params) => {
@@ -498,14 +549,16 @@ export function makeEvalTool(opts) {
                 if (text.length > MAX_OUTPUT_CHARS) {
                     text = text.slice(0, MAX_OUTPUT_CHARS) + `\n… [${text.length - MAX_OUTPUT_CHARS} chars truncated]`;
                 }
+                const maxDetailChars = MAX_OUTPUT_CHARS;
+                const truncateDetail = (s) => s && s.length > maxDetailChars ? s.slice(0, maxDetailChars) + `\n… [truncated]` : s;
                 return {
                     content: [{ type: "text", text }],
                     details: {
                         language,
                         durationMs,
                         ok: res.ok,
-                        stdout: res.stdout,
-                        stderr: res.stderr,
+                        stdout: truncateDetail(res.stdout),
+                        stderr: truncateDetail(res.stderr),
                         result: res.result,
                         error: res.error,
                         reset: params.reset ?? false,

package/dist/server/file-archives.js

@@ -64,12 +64,20 @@ export async function safeDestination(root, name) {
     }
     return path;
 }
-function byteLimit() {
+/**
+ * Transform that enforces the 1 GiB expanded-size cap on the bytes that
+ * actually flow through it. `total` makes several transforms share one global
+ * counter — for ZIP extraction the header-declared uncompressedSize is
+ * attacker-controlled, so the cap must be enforced on REAL decompressed output.
+ */
+function byteLimit(total) {
     let bytes = 0;
     return new Transform({
         transform(chunk, _encoding, done) {
             bytes += chunk.length;
-            done(bytes > MAX_BYTES ? new Error("Archive exceeds 1 GiB expanded size") : null, chunk);
+            if (total)
+                total.bytes += chunk.length;
+            done((total ? total.bytes : bytes) > MAX_BYTES ? new Error("Archive exceeds 1 GiB expanded size") : null, chunk);
         },
     });
 }
@@ -119,7 +127,10 @@ export async function createArchive(source, outputDir) {
 async function unzip(source, stage) {
     const zip = await new Promise((ok, fail) => yauzl.open(source, { lazyEntries: true, strictFileNames: true }, (err, z) => (err ? fail(err) : ok(z))));
     let count = 0;
-    let bytes = 0;
+    // 全局实量字节计数：zip 头声明的 uncompressedSize 可被伪造（头写小、解压输出
+    // 无限膨胀的 zip 炸弹），上限必须按每个条目实际解压输出累加，超限抛错 ——
+    // extractArchive 的 finally 会清理临时目录。tar 分支不受影响。
+    const total = { bytes: 0 };
     const paths = new Set();
     await new Promise((ok, fail) => {
         const abort = (err) => {
@@ -135,7 +146,7 @@ async function unzip(source, stage) {
                 const type = (entry.externalFileAttributes >>> 16) & 0o170000;
                 if (type && type !== 0o100000 && type !== 0o040000)
                     throw new Error("Archive contains a link or special file");
-                if (++count > MAX_ENTRIES || (bytes += entry.uncompressedSize) > MAX_BYTES)
+                if (++count > MAX_ENTRIES)
                     throw new Error("Archive limit exceeded (20,000 entries / 1 GiB)");
                 const dest = join(stage, name);
                 if (entry.fileName.endsWith("/"))
@@ -143,7 +154,7 @@ async function unzip(source, stage) {
                 else {
                     await mkdir(dirname(dest), { recursive: true });
                     const stream = await new Promise((resolveStream, reject) => zip.openReadStream(entry, (err, s) => (err ? reject(err) : resolveStream(s))));
-                    await pipeline(stream, byteLimit(), createWriteStream(dest, { flags: "wx", mode: 0o600 }));
+                    await pipeline(stream, byteLimit(total), createWriteStream(dest, { flags: "wx", mode: 0o600 }));
                 }
                 zip.readEntry();
             })().catch(abort);

package/dist/server/files-service.js

@@ -5,9 +5,9 @@
  * 全部为无状态 fs 操作 + 两个自持的 watcher（当前列出目录、git dir），
  * 经 FilesHost 回调与 ClientSession 解耦。
  */
-import { Dirent, mkdirSync, readFileSync, statSync, writeFileSync, watch } from "node:fs";
+import { Dirent, existsSync, mkdirSync, readFileSync, statSync, writeFileSync, watch } from "node:fs";
 import { homedir } from "node:os";
-import { resolve, relative, sep } from "node:path";
+import { resolve, relative, sep, isAbsolute } from "node:path";
 import { pick } from "./i18n.js";
 import { previewKind, looksLikeText, decodeText, hexDump, countLines } from "./text-sniff.js";
 import { extractOfficeText, isOfficeFile, OFFICE_MAX_FILE_BYTES } from "./office-parse.js";
@@ -48,11 +48,15 @@ export function desktopDirWire(homeWire) {
 }
 /** wire 路径统一用 "/"。绝对 = posix "/..."；win32 还有 "C:/..." / 裸 "C:"。
  *  机器浏览（越过工作区根换盘符）发送这些路径；工作区相对树不会产生它们（Windows
- *  文件名不能含 ":"，相对路径经 relative() 归一化后也不以 "/" 开头）。 */
+ *  文件名不能含 ":"，相对路径经 relative() 归一化后也不以 "/" 开头）。
+ *  win32 还必须把盘符相对路径（"D:x"，冒号后无分隔符 —— resolve 会落到该盘的
+ *  当前目录）与 UNC（"\\host\share"；"//host/share" 已被上面的 "/" 前缀覆盖）
+ *  判为绝对：这些形态若被当工作区相对路径处理，会在跨盘/UNC 下绕过 ".." 检查
+ *  逃出工作区。posix 上 "C:x" 是合法文件名，故盘符检查必须限定在 win32。 */
 export function isAbsoluteWirePath(p) {
-    if (p === MACHINE_ROOT || p.startsWith("/"))
+    if (p === MACHINE_ROOT || p.startsWith("/") || p.startsWith("\\\\"))
         return true;
-    return IS_WIN32 && /^[A-Za-z]:([\\/]|$)/.test(p);
+    return IS_WIN32 && /^[A-Za-z]:/.test(p);
 }
 /** 去掉结尾 "/"（保留 posix 根 "/" 本身），归一成规范的 wire 形式。前端面包屑
  *  不产生结尾斜杠，这里只对补全/直接输入做防御性清理。 */
@@ -132,7 +136,11 @@ function ignoredEntries() {
 export function workspacePath(root, raw) {
     const abs = resolve(root, raw);
     const rawRel = relative(root, abs);
-    if (rawRel.startsWith("..") || rawRel.includes(`${sep}..`))
+    // 只查 ".." 拦不住 Windows 的跨盘/UNC：relative("C:/a","D:/x") 与
+    // relative("C:/a","//h/s") 返回绝对路径（"D:\x"、"\\h\s\"），不以 ".." 开头；
+    // 盘符相对路径（"D:x"）经 resolve 落到该盘当前目录后也归此形 —— 必须同时
+    // 拒绝 isAbsolute 的结果，否则 "D:x" 这类输入可逃出工作区根。
+    if (rawRel.startsWith("..") || rawRel.includes(`${sep}..`) || isAbsolute(rawRel))
         return null;
     // Normalize to forward slashes: the wire protocol and the frontend always
     // use "/", but relative() returns "\\" on Windows.
@@ -952,10 +960,14 @@ export class FilesService {
             else {
                 wp = { abs: root, rel: "" };
             }
-            // Basename only — strips any path separators / ".." the name carries;
-            // reject empty results and Windows-illegal characters outright.
-            const base = name.split(/[\\/]/).pop() ?? "";
-            const safe = (base.replace(/[/:*?"<>|\x00-\x1f]/g, "_").trim() || "file").slice(0, 200);
+            // 与 createEntry/renameEntry 同口径（this.sanitizeName）：只取 basename，
+            // 空 / "." / ".." / Windows 保留名 / 尾点空格一律拒绝 —— 旧的内联替换
+            // 会放过 "con.txt"、"a.." 这类「建了删不掉」的名字。
+            const safe = this.sanitizeName(name);
+            if (!safe) {
+                emitErr(`文件名不合法：${name}`, `Invalid file name: ${name}`);
+                return;
+            }
             const abs = resolve(wp.abs, safe);
             let uploadRel;
             if (absDir) {
@@ -984,7 +996,14 @@ export class FilesService {
                 return;
             }
             mkdirSync(wp.abs, { recursive: true });
-            writeFileSync(abs, buf);
+            if (existsSync(abs)) {
+                emitErr(`已存在：${uploadRel}`, `Already exists: ${uploadRel}`);
+                return;
+            }
+            // wx：与预检之间存在窗口（TOCTOU），并发同名上传走 EEXIST 落到 catch
+            // 报错 —— 两个上传路径语义统一为「目标已存在拒绝」，绝不静默截断覆盖
+            // （/api/file-transfer/upload 一直是 open(dest, "wx") 拒绝）。
+            writeFileSync(abs, buf, { flag: "wx" });
             this.host.emit({
                 type: "notice",
                 level: "info",

package/dist/server/goal-service.js

@@ -12,11 +12,111 @@
  * 结构化子集 GoalConversation 传入（真实 Conversation 满足该结构），会话创建/对话框
  * 取消/git diff 等宿主能力走回调，便于独立测试。UI 文案直接中文（服务端 notice 约定）。
  */
+import { mkdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { Type } from "typebox";
 import { createAgentSessionFromServices, createAgentSessionServices, defineTool, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
-import { bilingual, pick } from "./i18n.js";
+import { pick } from "./i18n.js";
 import { parseModelSpec } from "./attachments.js";
+/**
+ * 自主模式完成标记（与注入对话的【目标…】约定严格一致）：
+ *  - 【目标已达成】/【目标完成】/【目标达成】——必须带全角括号；
+ *  - GOAL 后必须跟至少一个分隔符（冒号/下划线/空白）且 COMPLETED/PASSED 为整词。
+ * 刻意不收裸子串（如「目标已达成」不带括号）：模型在计划、复述目标或假设句里
+ * 也会写出这些字样（"如果测试全绿则目标已达成"），裸匹配会把中间轮误判成 pass。
+ */
+const GOAL_COMPLETION_RE = /【目标(?:已)?(?:达成|完成)】|(?<![A-Za-z])GOAL(?:[:：_]|\s+)+(?:IS\s+)?(?:COMPLETED|PASSED)(?![A-Za-z])/i;
+/** 自主轮次完成信号判定（纯函数，供 runGoalReview 与单测共用）。 */
+export function isGoalCompletionSignal(finalText) {
+    return GOAL_COMPLETION_RE.test(finalText);
+}
+/** 提取 raw 中第一个括号平衡的 {...} 子串（字符串字面量内的引号/转义/花括号不参与配对）。 */
+function firstBalancedJsonObject(raw) {
+    const start = raw.indexOf("{");
+    if (start < 0)
+        return undefined;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < raw.length; i++) {
+        const ch = raw[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "{")
+            depth++;
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return raw.slice(start, i + 1);
+        }
+    }
+    return undefined;
+}
+/**
+ * 解析审查模型的 verdict 输出（纯函数）。优先取第一个平衡 {...} 做 JSON.parse：
+ * 模型常包 markdown 围栏或前后闲话，feedback 里也可能有 \" 转义与嵌套引号，
+ * 这些由 JSON 语义天然处理；整体解析失败（单引号/尾逗号等）再退回旧的宽松
+ * 正则逐字段抠。两者都失败返回 undefined，调用方按「无 JSON」处理。
+ */
+export function parseReviewerVerdict(raw) {
+    const json = firstBalancedJsonObject(raw);
+    if (json !== undefined) {
+        try {
+            const value = JSON.parse(json);
+            if (value && typeof value === "object" && !Array.isArray(value)) {
+                if (value.verdict === "pass" || value.verdict === "fail") {
+                    return { verdict: value.verdict, feedback: typeof value.feedback === "string" ? value.feedback : "" };
+                }
+            }
+        }
+        catch {
+            // 不是合法 JSON（围栏残留/单引号/尾逗号）→ 落到正则兜底
+        }
+    }
+    const m = raw.match(/\{\s*"verdict"\s*:\s*"(pass|fail)"[^}]*\}/);
+    if (m) {
+        const fm = raw.match(/"feedback"\s*:\s*"([^"]*)"/);
+        return { verdict: m[1], feedback: fm?.[1] ?? "" };
+    }
+    return undefined;
+}
+/** diff 正文进审查 prompt 的截断上限（完整规模信息走 [diff-meta] 尾段）。 */
+export const GIT_DIFF_CAP = 60_000;
+/**
+ * 由 git 原始输出构造「变更指纹」（纯函数，供 AgentService.gitDiff 与单测共用）。
+ *  - diff 正文非空 → 截断正文 + [diff-meta] 尾段（完整字符数 + 排序后的 status
+ *    指纹）。尾段永不参与截断：大 diff 两轮的前 60_000 字符可能完全相同（改动
+ *    落在截断线之后），只比截断正文会把持续推进误判成停滞；对内容变化敏感的
+ *    完整字符数让 prevDiff 等值比较能区分「真没变」与「变了但被截断」。
+ *  - diff 正文为空 → 排序后的 `git status --porcelain` 指纹（未跟踪文件不进
+ *    diff，却是新工作区最常见的实际进展）；两段都空（返回 ""）才算真停滞。
+ *  - status 输出为空/拍不到 → 对应段省略，退化为旧版纯 diff 行为。
+ */
+export function buildDiffFingerprint(diffOut, statusOut) {
+    let status = "";
+    if (statusOut.trim() !== "") {
+        // porcelain 不承诺输出有序，显式排序保证指纹逐轮稳定可比。
+        status = statusOut
+            .split("\n")
+            .filter((line) => line.trim() !== "")
+            .sort()
+            .join("\n")
+            .slice(0, 20_000);
+    }
+    if (diffOut.trim() === "")
+        return status;
+    const meta = `\n[diff-meta] chars=${diffOut.length}${status ? `\n[git-status]\n${status}` : ""}`;
+    return diffOut.slice(0, GIT_DIFF_CAP) + meta;
+}
 /** System prompt for the goal-wizard session. The wizard asks the user a few
  *  questions (via its goal_ask tool) to scope a raw requirement into a precise,
  *  reviewable goal, then emits ONLY the final goal text as its last message. */
@@ -27,8 +127,11 @@ function wizardPrompt(draft) {
         `# User's raw requirement`, // eslint-disable-line no-regex-spaces
         draft,
         ``,
-        `Use your goal_ask tool to ask the user focused questions to pin down the essential, ambiguous details. Keep it concise — usually 2 to 4 questions: what exactly to build/do, scope boundaries (what NOT to do), acceptance criteria / done-definition, and any constraints (style, performance, environment).`, // eslint-disable-line max-len
-        `Prefer multiple-choice (goal_ask with options) when you can offer clear choices; use open questions only for things that genuinely need free text.`, // eslint-disable-line max-len
+        `Use your goal_ask tool to ask the user focused questions to pin down the essential, ambiguous details.`,
+        `Convergence guidelines:`,
+        `- Ask ONE question at a time, strictly 1 to 3 questions total: what exactly to build/do, scope boundaries (what NOT to do), acceptance criteria / done-definition, and any constraints (style, performance, environment).`, // eslint-disable-line max-len
+        `- Prefer multiple-choice with 2-4 mutually exclusive options and place your recommended choice FIRST.`,
+        `- In each option, concisely explain the impact or tradeoff. Use open questions only for things that genuinely need free text.`, // eslint-disable-line max-len
         `Once you have enough to write an unambiguous, reviewable goal, STOP asking and reply with EXACTLY this format and nothing else (no preamble, no bullets):`, // eslint-disable-line max-len
         `GOAL: <one concrete, verifiable sentence describing the deliverable and its acceptance criteria>`, // eslint-disable-line max-len
         `If the user cancels or stops answering (the tool reports a cancellation), still produce a sensible best-effort goal from what you already know.`, // eslint-disable-line max-len
@@ -363,6 +466,7 @@ export class GoalService {
             draft,
         }), { draft });
         let refinedGoal = "";
+        let goalEphemeralDir;
         try {
             const wmSpec = opts?.wizardModel ? this.resolveReviewModel(opts.wizardModel) : null; // reuse the honest "provider/id" parser
             const services = await createAgentSessionServices({
@@ -387,10 +491,14 @@ export class GoalService {
             const goalAsk = defineTool({
                 name: "goal_ask",
                 label: "Ask the user",
-                description: bilingual("Ask the user ONE question at a time to scope down the goal. Provide a clear question and 2-4 concise options; or ask an open question. Returns the user's chosen answer.", "一次只向用户提一个问题，以明确目标范围。给出清晰的问题和 2-4 个简洁选项；或提开放式问题。返回用户选择的答案。"),
+                description: "Ask the user ONE focused question at a time to scope down the goal. " +
+                    "Provide 2-4 mutually exclusive options with the recommended option first, " +
+                    "briefly noting its impact or tradeoff; or ask an open question. Returns the user's chosen answer.",
                 parameters: Type.Object({
-                    question: Type.String({ description: bilingual("The question to ask", "要问的问题") }),
-                    options: Type.Optional(Type.Array(Type.String())),
+                    question: Type.String({ description: "The question to ask" }),
+                    options: Type.Optional(Type.Array(Type.String(), {
+                        description: "2-4 mutually exclusive options (recommended option first)",
+                    })),
                 }),
                 // ONE question at a time. Sequential execution prevents the agent from
                 // firing parallel goal_ask calls whose dialogs would overwrite each other
@@ -496,9 +604,16 @@ export class GoalService {
                     }
                 },
             });
+            const sm = SessionManager.inMemory(this.host.cwd());
+            goalEphemeralDir = join(services.agentDir, "goal-sessions", `wizard-${Date.now()}`);
+            try {
+                mkdirSync(goalEphemeralDir, { recursive: true });
+                sm.sessionDir = goalEphemeralDir;
+            }
+            catch { }
             const srv = await createAgentSessionFromServices({
                 services,
-                sessionManager: SessionManager.inMemory(this.host.cwd()),
+                sessionManager: sm,
                 customTools: [goalAsk],
                 ...(model ? { model } : {}),
             });
@@ -550,6 +665,12 @@ export class GoalService {
             wgoal.wizard.status = "";
             wgoal.wizard.statusEn = "";
             this.wizardSession = null;
+            if (goalEphemeralDir) {
+                try {
+                    rmSync(goalEphemeralDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
             this.emitGoalStatus();
         }
         // Aborted externally (✗ / clear_goal / idle-timeout): do NOT set a goal. The raw
@@ -728,9 +849,12 @@ export class GoalService {
         // Goal review hook: after the run finished normally, if a goal is
         // active (and it belonged to the ACTIVE conversation) and we're not
         // already mid-review, spawn the isolated reviewer.
+        // Only run when verdict is pending — failed/blocked terminal goals must not
+        // re-trigger reviews on subsequent unrelated conversational turns.
         if (g.goal &&
             g.conversationId === conv.id &&
             !g.reviewing &&
+            g.verdict === "pending" &&
             !conv.wizardRunning &&
             !this.host.isDisposed() &&
             this.goalEnabled()) {
@@ -913,9 +1037,8 @@ export class GoalService {
         const isAutonomous = !g.reviewModel;
         if (isAutonomous) {
             // DSH 风格自主轮次驱动（免拉起独立审查会话，省 token + 零启动延迟）：
-            // 检查模型自身是否在输出中表明目标已达成
-            const completionRegex = /【目标(?:已)?(?:达成|完成)】|GOAL(?:[:：_]|\s+)*(?:IS\s+)?(?:COMPLETED|PASSED)|目标已达成|目标已完成/i;
-            const isCompleted = completionRegex.test(finalText);
+            // 检查模型自身是否在输出中表明目标已达成（只认约定标记，见 GOAL_COMPLETION_RE）
+            const isCompleted = isGoalCompletionSignal(finalText);
             if (isCompleted) {
                 reviewerVerdict = "pass";
                 reviewerFeedback = pick(this.lang(), "模型自主验证：目标已达成", "Model autonomous evaluation: Goal completed", "goal.autonomous.pass");
@@ -987,11 +1110,10 @@ export class GoalService {
                 await reviewer.prompt(this.reviewerPrompt(goalText, g.round, reviewCap, finalText, diff, reviewPrompt));
                 // Parse the reviewer's final output (expected to be a JSON object).
                 const raw = reviewer.getLastAssistantText() ?? "";
-                const m = raw.match(/\{\s*"verdict"\s*:\s*"(pass|fail)"[^}]*\}/);
-                if (m) {
-                    reviewerVerdict = m[1];
-                    const fm = raw.match(/"feedback"\s*:\s*"([^"]*)"/);
-                    reviewerFeedback = fm?.[1] ?? "";
+                const parsed = parseReviewerVerdict(raw);
+                if (parsed) {
+                    reviewerVerdict = parsed.verdict;
+                    reviewerFeedback = parsed.feedback;
                 }
                 else {
                     // No JSON — assume fail with the raw output as feedback.
@@ -1063,8 +1185,7 @@ export class GoalService {
             catch {
                 // Best-effort.
             }
-            g.conversationId = null;
-            g.goal = null; // loop blocked — clear the active goal
+            g.reviewing = false;
             this.emitGoalStatus();
             this.host.flushSnapshot();
             return;
@@ -1075,6 +1196,8 @@ export class GoalService {
         if (!isLastRound) {
             g.status = `本轮不通过，正在把意见交给 agent 修改（${roundsZh}）…`;
             g.statusEn = `Round failed, sending feedback to the agent (${roundsEn})…`;
+            // 注入修改意见后保持 verdict 为 pending，让 agent 下一次答完后继续下一轮审查
+            g.verdict = "pending";
             this.host.emit({
                 type: "notice",
                 level: "warning",
@@ -1126,8 +1249,7 @@ export class GoalService {
             text: "目标未通过审查（已达最大轮数）",
             textEn: "Goal failed review (max rounds reached)",
         });
-        g.conversationId = null;
-        g.goal = null; // loop exhausted — clear the active goal
+        g.reviewing = false; // 审查结束：保留 g.goal 与 g.conversationId，让用户看到未通过的目标，不丢弃目标文本
         this.emitGoalStatus();
         this.host.flushSnapshot();
     }

package/dist/server/hashline-engine.js

@@ -287,6 +287,9 @@ export function parseHashlinePatch(patchText) {
 // 快照存储与三方合并恢复（Snapshot Store & 3-Way Merge Recovery）
 // ----------------------------------------------------------------------------
 export class HashlineSnapshotStore {
+    /** 单个文件保留的快照代数上限（LRU）：全局单例会跨整个会话存活，反复编辑
+     *  同一文件会让快照按编辑次数无界增长，必须驱逐最旧一代。 */
+    static MAX_PER_FILE = 200;
     snapshots = new Map(); // path -> (hash -> content)
     record(filePath, text) {
         const hash = computeFileHash(text);
@@ -295,11 +298,29 @@ export class HashlineSnapshotStore {
             fileMap = new Map();
             this.snapshots.set(filePath, fileMap);
         }
+        // 先删后插：覆盖同代快照的同时把访问序刷到尾部（Map 插入序即 LRU 序）
+        fileMap.delete(hash);
         fileMap.set(hash, text);
+        while (fileMap.size > HashlineSnapshotStore.MAX_PER_FILE) {
+            const oldest = fileMap.keys().next().value;
+            if (oldest === undefined)
+                break;
+            fileMap.delete(oldest);
+        }
         return hash;
     }
     get(filePath, hash) {
-        return this.snapshots.get(filePath)?.get(hash.toUpperCase());
+        const fileMap = this.snapshots.get(filePath);
+        if (!fileMap)
+            return undefined;
+        const key = hash.toUpperCase();
+        const hit = fileMap.get(key);
+        if (hit !== undefined) {
+            // get 命中即 refresh：重插到尾部，正在参与三方合并的快照不被 LRU 驱逐
+            fileMap.delete(key);
+            fileMap.set(key, hit);
+        }
+        return hit;
     }
 }
 /** 全局会话级快照单例 */
@@ -433,9 +454,10 @@ export function applyHashlinePatch(patchText, options = {}) {
         const liveHash = computeFileHash(currentText);
         let workingText = currentText;
         let isRecovered = false;
-        // 哈希校验与三方冲突自愈
+        // 哈希校验与三方冲突自愈（快照按绝对路径优先隔离，兼容相对路径回退）
+        const absFilePath = resolve(cwd, sec.filePath);
         if (sec.expectedHash && sec.expectedHash !== liveHash) {
-            const snapshot = store.get(sec.filePath, sec.expectedHash);
+            const snapshot = store.get(absFilePath, sec.expectedHash) ?? store.get(sec.filePath, sec.expectedHash);
             if (snapshot) {
                 const recovery = tryRecoverEdits(snapshot, currentText, sec.hunks, sec.filePath);
                 if (recovery.success && recovery.remappedHunks) {
@@ -548,26 +570,39 @@ export function applyHashlinePatch(patchText, options = {}) {
         }
         const replacementSpans = [];
         for (const h of sec.hunks) {
-            if (h.kind === "put_range" ||
+            let s;
+            let e;
+            if (h.kind === "insert_before" || h.kind === "insert_after") {
+                // insert 类 hunk 也纳入重叠校验（锚点单行）：执行时按行号降序 splice，
+                // 若锚点行被同补丁的 replace/cut 覆盖删除、或与其它 insert 锚点重合，
+                // 插入位置会随前面的改动串位，产出与模型意图不符的内容。保守策略：
+                // 锚点行与任何 replace span / 其它 insert 锚点重叠即报错。
+                s = h.lineStart === -1 ? lines.length : (h.lineStart ?? 1);
+                e = s;
+            }
+            else if (h.kind === "put_range" ||
                 h.kind === "put_block" ||
                 h.kind === "cut_range" ||
                 h.kind === "cut_block" ||
                 h.kind === "paste_over_range" ||
                 h.kind === "paste_over_block") {
-                const s = h.lineStart === -1 ? lines.length : (h.lineStart ?? 1);
-                const e = h.lineEnd ?? s;
-                for (const prev of replacementSpans) {
-                    if (!(e < prev.start || s > prev.end)) {
-                        return {
-                            ok: false,
-                            summary: `补丁段存在重叠的行范围：${sec.filePath}（行 ${s}-${e} 与行 ${prev.start}-${prev.end} 发生重叠）。请合并为一个连续的修改块。`,
-                            results: [],
-                            error: `Overlapping hunks in ${sec.filePath} (${s}-${e} overlaps with ${prev.start}-${prev.end})`,
-                        };
-                    }
+                s = h.lineStart === -1 ? lines.length : (h.lineStart ?? 1);
+                e = h.lineEnd ?? s;
+            }
+            else {
+                continue;
+            }
+            for (const prev of replacementSpans) {
+                if (!(e < prev.start || s > prev.end)) {
+                    return {
+                        ok: false,
+                        summary: `补丁段存在重叠的行范围：${sec.filePath}（行 ${s}-${e} 与行 ${prev.start}-${prev.end} 发生重叠）。请合并为一个连续的修改块。`,
+                        results: [],
+                        error: `Overlapping hunks in ${sec.filePath} (${s}-${e} overlaps with ${prev.start}-${prev.end})`,
+                    };
                 }
-                replacementSpans.push({ start: s, end: e });
             }
+            replacementSpans.push({ start: s, end: e });
         }
         // 按行号从大到小排序执行，避免前方修改引起后续行号错位
         const sortedHunks = [...sec.hunks]
@@ -642,13 +677,16 @@ export function applyHashlinePatch(patchText, options = {}) {
         }
     }
     // ===== 阶段 2: 全部校验通过，统一落盘 =====
-    for (const p of plannedDeletes) {
-        remove(p);
-    }
+    // 先执行所有写入，确保新文件与移动目标成功落盘，避免先删后写异常时永久丢失源文件
     for (const [p, content] of plannedWrites.entries()) {
         write(p, content);
-        // 记住新快照
-        store.record(p, content);
+        // 记住新快照（统一采用绝对路径隔离多工作区）
+        store.record(resolve(cwd, p), content);
+    }
+    for (const p of plannedDeletes) {
+        if (!plannedWrites.has(p)) {
+            remove(p);
+        }
     }
     const summaryParts = results.map((r) => {
         if (r.op === "deleted")