pi-web-ui 0.96.0 → 0.97.0

package/dist/server/index.js

@@ -16,6 +16,9 @@
  *   all share one conversation list per project.
  *   PI_CODING_AGENT_DIR  pi config dir (auth/models/skills) — passed to the SDK
  */
+// MUST be imported before the SDK is loaded so on-disk patches apply cleanly.
+import "./patch-remote-catalog.js";
+import "./patch-turn-end-boundary.js";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { stat } from "node:fs/promises";
 import { createServer, request as proxyRequest } from "node:http";
@@ -48,7 +51,7 @@ import { validateClientId } from "./ws-client-id.js";
 import { PendingCommandQueue } from "./ws-pending-queue.js";
 import { installPack, isKnownPack, listPacks, loadServerStrings, readPackFile, removePack, unloadServerStrings, } from "./locales.js";
 import { PluginManager, resolvePluginClientFile, } from "./plugins.js";
-import { buildPluginJobArgs, inspectInstallSpec, PluginInstaller } from "./plugin-installer.js";
+import { buildPluginJobArgs, confirmPluginInstall, inspectInstallSpec, PluginInstaller } from "./plugin-installer.js";
 import { syncPluginCatalog } from "./plugin-catalog-sync.js";
 import { McpBridge } from "./mcp-bridge.js";
 import { createMcpHotReload } from "./mcp-hot-reload.js";
@@ -1129,22 +1132,14 @@ function findDomConsentById(id) {
 }
 // ---------------------------------------------------------------------------
 // 插件安装的用户确认门（P0）：plugin_catalog_sync 的 install:true 与 plugin_job
-// 的 install/update 在真正动安装器之前必须拿到用户确认。第三方页面脚本可以直发
-// 这两类消息，没有这道门就能借 WS 静默安装任意插件。复用 permissionRequester
-// 的同一条「plugin_permission_request 弹窗 + 120s 超时视为拒绝」管线 —— 不新增
-// 协议消息，将安装清单放在 reason 里展示；这里直接调 requester（不写授权表，
-// remember 标志被忽略）。拒绝 / 超时 / 未接弹窗设施（无头 DSH）一律 fail-closed。
+// 的 install/update 在真正动安装器之前必须拿到用户确认。
 // ---------------------------------------------------------------------------
-async function confirmPluginInstall(items) {
-    const ask = pluginMgr.permissionRequester;
-    if (!ask)
-        return false;
-    const list = items.map((x) => `${x.id} ← ${x.source}`).join("\n");
-    const ans = await ask("plugin-installer", {
-        family: "net",
-        reason: `安装确认：将安装/更新以下插件（id ← source）：\n${list}\n拒绝或 120 秒未确认则不安装。`,
+async function confirmPluginInstallHelper(items) {
+    return confirmPluginInstall(items, {
+        permGrants: pluginMgr.permGrants,
+        permissionRequester: pluginMgr.permissionRequester,
+        onGrantsChanged: pushPluginPermissions,
     });
-    return ans.ok === true;
 }
 // 内置定时任务（issue #184）：全局 <dataDir>/scheduler-tasks.json，TTL 与
 // client-state 同级；Agent 工具建的任务优先唤醒发起对话（issue #193：
@@ -1641,9 +1636,20 @@ wss.on("connection", (ws) => {
             return;
         }
         switch (msg.type) {
-            case "prompt":
+            case "prompt": {
+                const hasAttach = Boolean(msg.attachments && msg.attachments.length > 0);
+                if (!msg.text?.trim() && !hasAttach) {
+                    send({
+                        type: "notice",
+                        level: "warning",
+                        text: "发送已忽略：提示词为空且未附带文件或上下文引用。",
+                        textEn: "Prompt ignored: text is empty and no attachments were provided.",
+                    });
+                    break;
+                }
                 void cs.prompt(msg.text, msg.attachments, msg.queue);
                 break;
+            }
             case "queue_remove":
                 cs.removeQueued(msg.kind, msg.text, msg.index);
                 break;
@@ -1705,6 +1711,9 @@ wss.on("connection", (ws) => {
                     send({ type: "tool_info", name: msg.name, found: false, unsupported: true });
                 }
                 break;
+            case "get_compacted_messages":
+                void cs.getCompactedMessages?.(msg.compactionMessageId, msg.conversationId);
+                break;
             case "list_sessions":
                 void cs.refreshSessions();
                 break;
@@ -1731,6 +1740,11 @@ wss.on("connection", (ws) => {
                     void cs.persistConversation(msg.id);
                 }
                 break;
+            case "pin_conversation":
+                if (typeof cs.setConversationPinned === "function") {
+                    void cs.setConversationPinned(msg.id, msg.pinned);
+                }
+                break;
             case "dismiss_finished_subagents":
                 void cs.dismissFinishedSubagents(msg.parentId);
                 break;
@@ -2027,6 +2041,7 @@ wss.on("connection", (ws) => {
                     reviewModel: msg.reviewModel,
                     maxRounds: msg.maxRounds,
                     locked: msg.locked,
+                    execModel: msg.execModel,
                 });
                 break;
             case "clear_goal":
@@ -2044,6 +2059,7 @@ wss.on("connection", (ws) => {
                     reviewModel: msg.reviewModel,
                     maxRounds: msg.maxRounds,
                     locked: msg.locked,
+                    execModel: msg.execModel,
                 });
                 break;
             case "get_settings":
@@ -2174,15 +2190,35 @@ wss.on("connection", (ws) => {
                 // plugin_job；拒绝/超时直接回一条 done，让面板上的作业就地结束（不占
                 // 安装锁、不弹「失败」之外的噪音）。卸载不在本门范围内（由面板本身发起）。
                 if (jobAction === "install" || jobAction === "update") {
-                    void confirmPluginInstall([{ id: pluginId, source: String(msg.source ?? "") }])
+                    const alreadyGranted = pluginMgr.permGrants.has("plugin-installer", "net", { host: "github.com" });
+                    if (!alreadyGranted) {
+                        send({
+                            type: "plugin_job",
+                            jobId,
+                            action: jobAction,
+                            pluginId,
+                            phase: "start",
+                        });
+                        send({
+                            type: "plugin_job",
+                            jobId,
+                            action: jobAction,
+                            pluginId,
+                            phase: "log",
+                            line: jobLang() === "zh" ? "等待确认安装授权…" : "Waiting for install confirmation…",
+                        });
+                    }
+                    void confirmPluginInstallHelper([{ id: pluginId, source: String(msg.source ?? "") }])
                         .then((confirmed) => {
                         if (!confirmed) {
-                            jobDone(false, "用户未确认安装（拒绝或 120 秒超时）");
+                            jobDone(false, jobLang() === "zh"
+                                ? "用户未确认安装（拒绝或 120 秒超时）"
+                                : "Installation not confirmed (rejected or timed out after 120s)");
                             return;
                         }
                         startPluginJob();
                     })
-                        .catch(() => jobDone(false, "安装确认流程异常"));
+                        .catch(() => jobDone(false, jobLang() === "zh" ? "安装确认流程异常" : "Installation confirmation error"));
                     break;
                 }
                 startPluginJob();
@@ -2195,6 +2231,19 @@ wss.on("connection", (ws) => {
                         done: async (ok, info) => {
                             if (ok) {
                                 await reloadPluginsAndPush(jobLang);
+                                const isZh = jobLang() === "zh";
+                                const actionLabel = jobAction === "uninstall"
+                                    ? isZh
+                                        ? "卸载"
+                                        : "uninstalled"
+                                    : jobAction === "update"
+                                        ? isZh
+                                            ? "更新"
+                                            : "updated"
+                                        : isZh
+                                            ? "安装"
+                                            : "installed";
+                                cs?.emitNotice("info", `插件「${pluginId}」${actionLabel}完成`, `Plugin "${pluginId}" ${actionLabel} successfully`);
                             }
                             else if (info.error) {
                                 cs?.emitNotice("error", `插件操作失败：${info.error}`, `Plugin operation failed: ${info.error}`);
@@ -2354,7 +2403,7 @@ wss.on("connection", (ws) => {
                     // 本地文件来源只允许工作区内（防任意路径文件探测 oracle）。
                     workspaceRoot: cs?.cwd ?? CWD,
                     // 安装确认门（P0）：拒绝/超时只写目录不安装。
-                    confirmInstall: (items) => confirmPluginInstall(items),
+                    confirmInstall: (items) => confirmPluginInstallHelper(items),
                 }).then((r) => {
                     if (r.installRefused) {
                         cs?.emitNotice("warning", "目录已同步，但安装未获用户确认（拒绝或超时），未安装任何插件", "Catalog synced, but installation was not confirmed (denied or timed out) — nothing was installed");
@@ -2423,6 +2472,16 @@ wss.on("connection", (ws) => {
             case "plan_update":
                 cs.updatePlan?.(msg.steps, msg.activeStepId, msg.conversationId);
                 break;
+            case "set_plan_mode":
+                // 计划模式（只规划不实施）：会话级开关，热生效（提示词重建 + 工具硬闸门）。
+                void cs.setPlanMode?.(msg.enabled, msg.conversationId);
+                break;
+            case "set_delegate_mode":
+                // 审查者模式（自动委派）：会话级开关，默认关。开启后本对话只审阅，
+                // 用户 prompt 由服务端转给常驻落盘执行对话。DSH 引擎的实现在
+                // setDelegateMode 里直接拒（无 customTools 注册面 → 闸门无处可挂）。
+                void cs.setDelegateMode?.(msg.enabled, msg.conversationId);
+                break;
             case "page_response":
                 // 浏览器（page-picker 扩展经前端）对 browser_page 的回包：恢复挂起的
                 // pageCall；id 不匹配（超时后迟到/页面刷新）由 resolvePageCall 静默忽略。

package/dist/server/lsp-tool.js

@@ -795,6 +795,7 @@ export function makeLspTool(options) {
     const cwd = options.cwd;
     return defineTool({
         name: LSP_TOOL_NAME,
+        promptSnippet: "IDE-grade semantic analysis (LSP) across the workspace: definition, references, hover, diagnostics, symbols, impact check",
         label: "LSP code intelligence",
         description: `IDE-grade semantic analysis (LSP) across the workspace. Actions:
 - \`definition\`: definition of the symbol at \`line\`/\`character\` in \`path\` (file, line, snippet).
@@ -807,16 +808,18 @@ export function makeLspTool(options) {
 - \`cascade\`: impact check for \`path\` — report diagnostics of files referencing it.
 Lines are 1-indexed.`,
         parameters: Type.Object({
-            action: Type.Union([
-                Type.Literal("definition"),
-                Type.Literal("references"),
-                Type.Literal("hover"),
-                Type.Literal("diagnostics"),
-                Type.Literal("documentSymbol"),
-                Type.Literal("read_symbol"),
-                Type.Literal("workspaceSymbol"),
-                Type.Literal("cascade"),
-            ], {
+            action: Type.Unsafe({
+                type: "string",
+                enum: [
+                    "definition",
+                    "references",
+                    "hover",
+                    "diagnostics",
+                    "documentSymbol",
+                    "read_symbol",
+                    "workspaceSymbol",
+                    "cascade",
+                ],
                 description: "The LSP operation to perform.",
             }),
             path: Type.Optional(Type.String({

package/dist/server/markers/builtins/todo.js

@@ -40,14 +40,12 @@ export function describeTodos(state, includeDeleted = false, lang = "en") {
         .join("\n");
 }
 const TODO_GUIDANCE_ZH = [
-    "# 内联标记工具（状态类操作请写在回答正文，不要调用工具）",
     "- 标记语法：[[todo:new:<主题>]] 新建；[[todo:set:<id>,completed|in_progress|pending]] 状态；[[todo:remove:<id>]] 删除；[[todo:dep:<id>,blocks=<依赖id,逗号分隔>]] 设依赖。",
     "- 状态变化全部用上面的 [[todo:...]] 内联标记表达，不会中断回答，无需等待返回。",
     "- 想查看/list 当前任务列表时，才用 `todo_list` 工具（读操作走工具）。",
     "- 不要编造不存在的任务 id；id 由 [[todo:new:...]] 分配，首次分配是自增整数。",
 ];
 const TODO_GUIDANCE_EN = [
-    "# Inline marker tools (express state changes inline in your reply text — never call a tool for them)",
     "- Marker syntax: [[todo:new:<subject>]] to create; [[todo:set:<id>,completed|in_progress|pending]] for status; [[todo:remove:<id>]] to delete; [[todo:dep:<id>,blocks=<dep ids, comma-separated>]] to set dependencies.",
     "- Express all status changes with the [[todo:...]] inline markers above; they never interrupt your reply and need no waiting for a result.",
     "- Only use the `todo_list` tool (the read path goes through the tool) when you want to list the current tasks.",

package/dist/server/mcp-bridge.js

@@ -393,12 +393,25 @@ function adaptMcpTool(serverName, mcpTool, client) {
         name,
         label: `${serverName} · ${mcpTool.name}`,
         description: mcpTool.description ?? `Tool ${mcpTool.name} provided by MCP server "${serverName}"`,
+        // 无 snippet 的工具不会进系统提示词的「Available tools」清单（SDK 只列有
+        // snippet 的工具），MCP 工具会变成 schema-only：模型读清单以为自己没有
+        // 这个能力（#403）。这里从 description 提取首句做极简 snippet。
+        promptSnippet: firstSentenceSnippet(mcpTool.description) ?? `MCP tool ${mcpTool.name} (server: ${serverName})`,
         parameters: mcpTool.inputSchema ?? {},
         execute: async (_toolCallId, params, _signal) => {
             return client.call(mcpTool.name, params ?? {});
         },
     };
 }
+/** 从 MCP 工具 description 提取首句做 promptSnippet（≤100 字符）；空描述返回 undefined。 */
+function firstSentenceSnippet(description) {
+    const text = (description ?? "").replace(/\s+/g, " ").trim();
+    if (!text)
+        return undefined;
+    const cut = text.search(/[.。!?！?]/);
+    const head = cut > 0 ? text.slice(0, cut + 1) : text;
+    return head.length > 100 ? `${head.slice(0, 99)}…` : head;
+}
 /** 工具名必须是 [A-Za-z0-9_-]+（与插件工具同规则），MCP 可能含冒号/斜杠 — 归一化。 */
 function sanitizeToolName(name) {
     const cleaned = (name || "").replace(/[^A-Za-z0-9_-]/g, "_");

package/dist/server/patch-tool.js

@@ -18,6 +18,7 @@ export function makePatchTool(options) {
     const cwd = options.cwd;
     return defineTool({
         name: PATCH_TOOL_NAME,
+        promptSnippet: "apply content-hashed, line-anchored patches to workspace files (prevents stale edits, line drift, and indentation hallucination)",
         label: "Apply Hashline patch",
         description: `Apply content-hashed, line-anchored patches to workspace files — prevents stale edits, line drift, and indentation hallucination.
 Each file section starts with \`[path#TAG]\` (or \`[path]\` if the hash is unknown yet). Operations:

package/dist/server/patch-turn-end-boundary.js

@@ -0,0 +1,77 @@
+/**
+ * turn_end boundary error patch for @earendil-works/pi-coding-agent (issue #411).
+ *
+ * In SDK 0.87+, when an in-flight turn is aborted or torn down before its assistant
+ * message is persisted, `_dispatchTurnEndBoundary()` in `agent-session.js` calls
+ * `this._extensionRunner.emitError({ event: "turn_end", error: "turn_end could not resolve..." })`
+ * right before returning `false`, causing false-positive extension errors to flood
+ * both the main conversation and subagents.
+ *
+ * This module idempotently patches `agent-session.js` in the installed SDK to
+ * silently skip the boundary (`return false`) without emitting an error, matching
+ * the upstream issue expectation (earendil-works/pi#10149).
+ *
+ * Same pattern as patch-remote-catalog.ts and patch-node-pty.ts: best-effort, idempotent,
+ * and skips gracefully if the SDK code structure differs or is already fixed upstream.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { sdkCopies } from "./sdk-origin.js";
+export const TARGET_PATTERN = /if\s*\(!messageEntryId\)\s*\{\s*this\._extensionRunner\.emitError\(\{\s*extensionPath:\s*"<boundary>",\s*event:\s*"turn_end",\s*error:\s*"turn_end could not resolve the persisted assistant entry ID",\s*\}\);\s*return false;\s*\}/;
+export const PATCHED_SENTINEL = "// pi-web-ui patch (issue #411: silent turn_end on aborted turns)";
+export const REPLACEMENT = `if (!messageEntryId) {
+            ${PATCHED_SENTINEL}
+            return false;
+        }`;
+/**
+ * 纯函数：给定 agent-session.js 内容，返回打补丁后的内容。
+ * - 命中目标代码段 → 替换并返回新内容；
+ * - 已打过补丁（含 PATCHED_SENTINEL）→ 原样返回；
+ * - 目标代码段未命中（上游已修复或版本不匹配）→ 原样返回，静默跳过。
+ */
+export function patchAgentSessionSource(src) {
+    if (src.includes(PATCHED_SENTINEL)) {
+        return { patched: false, code: src };
+    }
+    if (!TARGET_PATTERN.test(src)) {
+        return { patched: false, code: src };
+    }
+    return { patched: true, code: src.replace(TARGET_PATTERN, REPLACEMENT) };
+}
+export function candidateAgentSessionFiles() {
+    const files = new Set();
+    try {
+        const entry = fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"));
+        files.add(join(dirname(entry), "core", "agent-session.js"));
+    }
+    catch {
+        // Ignore resolve failures
+    }
+    try {
+        for (const copy of sdkCopies()) {
+            files.add(join(dirname(copy.path), "dist", "core", "agent-session.js"));
+        }
+    }
+    catch {
+        // Ignore copy inspection failures
+    }
+    return [...files];
+}
+export function applyPatch() {
+    for (const file of candidateAgentSessionFiles()) {
+        try {
+            if (!existsSync(file))
+                continue;
+            const src = readFileSync(file, "utf8");
+            const { patched, code } = patchAgentSessionSource(src);
+            if (patched) {
+                writeFileSync(file, code, "utf8");
+            }
+        }
+        catch {
+            // best-effort
+        }
+    }
+}
+applyPatch();

package/dist/server/permission-preset.js

@@ -1,6 +1,50 @@
 /**
  * 权限预设相关辅助逻辑与会话回放。
  */
+/**
+ * 从会话 sessionManager entries 回放恢复最后设定的**计划模式**状态（同 permission/preset
+ * 的落盘口径：切会话/重载不丢）。从未设定或非布尔 → false。
+ */
+export function readPlanModeFromSession(sm) {
+    try {
+        const mgr = sm;
+        if (typeof mgr?.getEntries !== "function")
+            return false;
+        const entries = mgr.getEntries();
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const e = entries[i];
+            if (e?.customType === "plan/mode" && typeof e.data?.enabled === "boolean")
+                return e.data.enabled;
+        }
+    }
+    catch {
+        // ignore
+    }
+    return false;
+}
+/**
+ * 从会话 sessionManager entries 回放恢复最后设定的**审查者模式**状态（同 plan/mode
+ * 口径：customType "delegate/mode"）。从未设定或非布尔 → false。
+ * ⚠️ 执行对话 id **不回放**：常驻执行对话是本进程内的活对象，重启后
+ * 首条请求会重新建一个（宁可多一个执行对话，也别指向一个不存在的 id）。
+ */
+export function readDelegateModeFromSession(sm) {
+    try {
+        const mgr = sm;
+        if (typeof mgr?.getEntries !== "function")
+            return false;
+        const entries = mgr.getEntries();
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const e = entries[i];
+            if (e?.customType === "delegate/mode" && typeof e.data?.enabled === "boolean")
+                return e.data.enabled;
+        }
+    }
+    catch {
+        // ignore
+    }
+    return false;
+}
 /**
  * 从会话 sessionManager entries 回放恢复最后设定的权限预设（若从未设定则返回 undefined）。
  * customType 为 "permission/preset"，载荷结构为 { preset: string }。