pi-web-ui 0.97.0 → 0.98.0

package/dist/server/mcp-hot-reload.js

@@ -31,15 +31,22 @@ export function createMcpHotReload(deps) {
     let debounce = null;
     let poller = null;
     let watcher = null;
-    /** 读一次磁盘：指纹 + 清单（`servers` 为 null = 坏配置）。文件不在按「没有服务器」算。 */
+    /** 读一次磁盘：指纹 + 清单（`servers` 为 null = 坏配置/读失败）。文件不在按「没有服务器」算。 */
     function readOnce() {
         let raw;
         try {
             raw = readFileSync(file, "utf8");
         }
-        catch {
-            // 读不到（文件/目录不在）→ 空配置：删掉 mcp.json 就是「关掉全部 MCP 服务器」。
-            return { fp: "empty", servers: {} };
+        catch (err) {
+            // 不变量 3 只覆盖「文件不在」：删掉 mcp.json = 关掉全部 MCP 服务器。
+            // #497：EBUSY/EACCES 等临时读失败（OneDrive/杀毒独占、权限误改）既不是
+            // 坏配置也不是删除意图——按坏配置口径走（servers: null → 保留在跑的
+            // 服务器 + 一次性提示），否则会把在跑的 MCP 服务器全杀还报「成功 0 个」。
+            const code = err?.code;
+            if (code === "ENOENT")
+                return { fp: "empty", servers: {} };
+            log(`[mcp] mcp.json 读取失败（${code ?? String(err)}），按坏配置处理：保留在跑的 MCP 服务器`);
+            return { fp: `unreadable:${code ?? "unknown"}`, servers: null };
         }
         const parsed = parseMcpConfig(raw);
         if (!parsed)
@@ -54,7 +61,7 @@ export function createMcpHotReload(deps) {
         applied = fp;
         if (!servers) {
             log("[mcp] mcp.json 解析失败，保留在跑的 MCP 服务器");
-            deps.onNotice?.("warning", "mcp.json 解析失败，已保留当前 MCP 服务器（改好保存后会自动重载）", "Failed to parse mcp.json — keeping the running MCP servers (saving a valid file reloads automatically)");
+            deps.onNotice?.("warning", "mcp.json 解析/读取失败，已保留当前 MCP 服务器（恢复可读后会自动重载）", "Failed to parse/read mcp.json — keeping the running MCP servers (it reloads automatically once readable)");
             return "invalid";
         }
         const summary = await deps.reload();

package/dist/server/model-admin.js

@@ -11,8 +11,9 @@
  * 经 ModelAdminHost 与 ClientSession 解耦（同 settings/goal/slash 服务模式）。
  * UI 文案直接中文（服务端 notice 约定）。apiKey/headers 绝不下发浏览器。
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { writeJsonAtomicSync } from "./atomic-file.js";
 import { enrichBatch } from "./model-enrich.js";
 import { pick } from "./i18n.js";
 import { ProviderOAuthFlowManager } from "./provider-oauth-flow.js";
@@ -65,12 +66,9 @@ export function graduateOverlayModels(providers, official) {
     }
     return graduated;
 }
-/** 原子写 JSON（tmp + rename）：进程崩溃不留半截文件——裸 writeFileSync 中途被
- *  杀会把整份配置截断，下次读盘即空表。tmp 名带 pid，避免同机多进程互踩。 */
+/** 原子写 JSON（tmp + rename）：进程崩溃不留半截文件。 */
 function atomicWriteJson(path, data) {
-    const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
-    renameSync(tmp, path);
+    writeJsonAtomicSync(path, data);
 }
 /** Strip // and /* *\/ comments without touching string literals (URLs contain //). */
 function stripJsonComments(src) {
@@ -378,13 +376,8 @@ export class ModelAdminService {
         return out;
     }
     writeProviderKeys(data) {
-        mkdirSync(this.host.agentDir, { recursive: true });
-        // 原子写（tmp+rename）：崩溃不留半截 JSON；0o600 限权防本机其他用户读密钥
-        //（Windows 忽略 mode 无害，POSIX 生效）。
-        const path = this.providerKeysPath();
-        const tmp = `${path}.${process.pid}.tmp`;
-        writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
-        renameSync(tmp, path);
+        // 原子写（tmp+rename）：崩溃不留半截 JSON。
+        writeJsonAtomicSync(this.providerKeysPath(), data);
     }
     /** 解析失败的配置文件改名留存为 <name>.corrupt-<timestamp>。改名失败（占用/
      *  跨盘等）也不抛——留存是尽力而为，绝不能阻塞主流程。 */
@@ -1461,7 +1454,15 @@ export class ModelAdminService {
             }
             const fetched = await ModelAdminService.probeModelsEndpoint(baseUrl, saved.apiKey, saved.authHeader === true ? true : undefined, saved.api, saved.headers, lang);
             // Merge: manual values win; fetched fills blanks and appends new ids.
-            const prev = new Map((saved.models ?? []).map((m) => [m.id, m]));
+            // #486：probe 是数秒级网络 await，期间用户可能已在设置面板编辑同一服务商——
+            // 以盘上最新条目为合并基准（旧快照 saved 只提供探测参数），否则刷新会用
+            // 旧快照整表覆盖，静默回滚并发编辑（删除的模型复活、手动新增丢失）。
+            const fresh = this.readModelsConfig().providers[pid];
+            if (!fresh) {
+                // probe 期间服务商被删除：不再写回，避免用旧快照复活已删除的条目。
+                return done(false, { error: "provider deleted during refresh" });
+            }
+            const prev = new Map((fresh.models ?? []).map((m) => [m.id, m]));
             let added = 0;
             for (const f of fetched) {
                 const cur = prev.get(f.id);
@@ -1478,11 +1479,11 @@ export class ModelAdminService {
             const merged = [...prev.values()].sort((a, b) => a.id.localeCompare(b.id));
             await this.saveModelConfig(pid, {
                 providerId: pid,
-                name: saved.name,
-                api: saved.api,
-                baseUrl: saved.baseUrl,
+                name: fresh.name,
+                api: fresh.api,
+                baseUrl: fresh.baseUrl,
                 // apiKey/headers 不回传浏览器——saveModelConfig 会保留旧值
-                authHeader: saved.authHeader === true ? true : undefined,
+                authHeader: fresh.authHeader === true ? true : undefined,
                 models: merged,
             });
             this.host.emit({

package/dist/server/model-enrich.js

@@ -159,9 +159,6 @@ async function fetchJson(fetchFn, url, maxBytes, timeoutMs, signal) {
 /** 目录抓取缓存（24h TTL，进程内；首跑后无感）。 */
 const catalogCache = new Map();
 const CATALOG_TTL_MS = 24 * 3600 * 1000;
-export function clearEnrichCache() {
-    catalogCache.clear();
-}
 export async function getOpenRouterCatalog(fetchFn = fetch, signal) {
     const hit = catalogCache.get("openrouter");
     if (hit && Date.now() - hit.at < CATALOG_TTL_MS)

package/dist/server/patch-tool.js

@@ -11,11 +11,13 @@
 import { resolve } from "node:path";
 import { defineTool } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
-import { applyHashlinePatch, computeFileHash, formatHashlineHeader, formatNumberedLines, globalSnapshotStore, } from "./hashline-engine.js";
+import { pick } from "./i18n.js";
+import { applyHashlinePatch, formatHashlineHeader, globalSnapshotStore, } from "./hashline-engine.js";
 import { getLiveLspDiagnostics } from "./lsp-tool.js";
 export const PATCH_TOOL_NAME = "patch";
 export function makePatchTool(options) {
     const cwd = options.cwd;
+    const getLang = options.lang ?? (() => "en");
     return defineTool({
         name: PATCH_TOOL_NAME,
         promptSnippet: "apply content-hashed, line-anchored patches to workspace files (prevents stale edits, line drift, and indentation hallucination)",
@@ -34,10 +36,13 @@ On divergence the engine attempts a 3-way merge. After success the tool returns
                 description: "The complete Hashline patch text containing one or more [path#TAG] sections with PUT/CUT/REM/MV operations.",
             }),
             timeout: Type.Optional(Type.Number({
-                description: "Optional execution timeout in seconds.",
+                minimum: 1,
+                maximum: 300,
+                description: "Optional execution timeout in seconds (1-300).",
             })),
         }),
         async execute(_callId, params, _signal, _onUpdate, _ctx) {
+            const L = getLang();
             const patchText = typeof params?.patch === "string" ? params.patch : "";
             if (!patchText.trim()) {
                 const emptyReport = {
@@ -47,7 +52,12 @@ On divergence the engine attempts a 3-way merge. After success the tool returns
                     error: "Empty patch",
                 };
                 return {
-                    content: [{ type: "text", text: "Error: No patch content provided." }],
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(L, "错误：未提供任何 patch 补丁内容。", "Error: No patch content provided."),
+                        },
+                    ],
                     details: emptyReport,
                 };
             }
@@ -57,7 +67,12 @@ On divergence the engine attempts a 3-way merge. After success the tool returns
             });
             if (!report.ok) {
                 return {
-                    content: [{ type: "text", text: `Patch Failed:\n${report.summary}` }],
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(L, `补丁应用失败：\n${report.summary}`, `Patch Failed:\n${report.summary}`),
+                        },
+                    ],
                     details: report,
                 };
             }
@@ -66,12 +81,12 @@ On divergence the engine attempts a 3-way merge. After success the tool returns
             for (const r of report.results) {
                 if (r.op !== "deleted" && r.newHash) {
                     const targetPath = r.newPath || r.filePath;
-                    textOutput.push(`\nNext edit anchor for ${targetPath}: \`${formatHashlineHeader(targetPath, r.newHash)}\``);
+                    textOutput.push(pick(L, `\n${targetPath} 的下一处编辑锚点：\`${formatHashlineHeader(targetPath, r.newHash)}\``, `\nNext edit anchor for ${targetPath}: \`${formatHashlineHeader(targetPath, r.newHash)}\``));
                     try {
                         const fullPath = resolve(cwd, targetPath);
                         const diags = await getLiveLspDiagnostics(fullPath, cwd);
                         if (diags) {
-                            textOutput.push(`\nLive LSP diagnostics for ${targetPath}:\n${diags}`);
+                            textOutput.push(pick(L, `\n${targetPath} 的实时 LSP 诊断：\n${diags}`, `\nLive LSP diagnostics for ${targetPath}:\n${diags}`));
                         }
                     }
                     catch { }

package/dist/server/permission-preset.js

@@ -67,3 +67,28 @@ export function readPermissionFromSession(sm) {
     }
     return undefined;
 }
+/**
+ * 从会话 sessionManager entries 回放恢复最后保存的结构化计划状态。
+ * customType 为 "plan/update" 或 "pi-web-ui/plan"，载荷结构为 { plan: PlanState }。
+ */
+export function readPlanFromSession(sm) {
+    try {
+        const mgr = sm;
+        if (typeof mgr?.getEntries !== "function")
+            return null;
+        const entries = mgr.getEntries();
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const e = entries[i];
+            if (e?.type === "custom" &&
+                (e.customType === "plan/update" || e.customType === "pi-web-ui/plan") &&
+                e.data?.plan &&
+                Array.isArray(e.data.plan.steps)) {
+                return e.data.plan;
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    return null;
+}

package/dist/server/plan-manager.js

@@ -12,15 +12,84 @@
  *    - 客户端也可通过协议消息 `plan_update` 调整
  *    - 状态自动同步到快照 `UiState.plan`
  */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 const VALID_STATUSES = new Set(["pending", "in_progress", "done", "failed"]);
 export class PlanManager {
+    filePath;
     plans = new Map();
-    /** 获取指定会话的计划状态。 */
+    convToSession = new Map();
+    constructor(filePath) {
+        this.filePath = filePath;
+        if (filePath) {
+            this.load();
+        }
+    }
+    load() {
+        if (!this.filePath)
+            return;
+        try {
+            const raw = JSON.parse(readFileSync(this.filePath, "utf8"));
+            for (const [key, val] of Object.entries(raw)) {
+                if (val && typeof val === "object" && Array.isArray(val.steps)) {
+                    this.plans.set(key, val);
+                }
+            }
+        }
+        catch {
+            // 文件不存在或格式异常，以空状态起步
+        }
+    }
+    save() {
+        if (!this.filePath)
+            return;
+        try {
+            mkdirSync(dirname(this.filePath), { recursive: true });
+            const obj = {};
+            for (const [k, v] of this.plans.entries()) {
+                obj[k] = v;
+            }
+            const tmp = `${this.filePath}.tmp.${Date.now()}`;
+            writeFileSync(tmp, JSON.stringify(obj, null, 2), "utf8");
+            renameSync(tmp, this.filePath);
+        }
+        catch {
+            // 持久化失败绝不阻断主流程
+        }
+    }
+    /** 绑定 conversationId 与 sessionId。若 sessionId 已有落盘计划，立即恢复给 conversationId。 */
+    bindSession(conversationId, sessionId) {
+        this.convToSession.set(conversationId, sessionId);
+        const existing = this.plans.get(sessionId);
+        if (existing) {
+            this.plans.set(conversationId, existing);
+            return existing;
+        }
+        const convExisting = this.plans.get(conversationId);
+        if (convExisting) {
+            this.plans.set(sessionId, convExisting);
+            this.save();
+            return convExisting;
+        }
+        return null;
+    }
+    /** 获取指定会话的计划状态。优先使用 conversationId，若无则回退查找绑定的 sessionId。 */
     getPlan(conversationId) {
-        return this.plans.get(conversationId) ?? null;
+        const direct = this.plans.get(conversationId);
+        if (direct)
+            return direct;
+        const sessionId = this.convToSession.get(conversationId);
+        if (sessionId) {
+            const bySession = this.plans.get(sessionId);
+            if (bySession) {
+                this.plans.set(conversationId, bySession);
+                return bySession;
+            }
+        }
+        return null;
     }
-    /** 设置/全量更新指定会话的计划。 */
-    setPlan(conversationId, steps, activeStepId) {
+    /** 设置/全量更新指定会话的计划（可选绑定 sessionId 进行稳定落盘）。 */
+    setPlan(conversationId, steps, activeStepId, sessionId) {
         const normalizedSteps = (Array.isArray(steps) ? steps : []).map((s, idx) => {
             const status = (VALID_STATUSES.has(s.status) ? s.status : "pending");
             return {
@@ -42,11 +111,17 @@ export class PlanManager {
             updatedAt: Date.now(),
         };
         this.plans.set(conversationId, state);
+        const effectiveSessionId = sessionId ?? this.convToSession.get(conversationId);
+        if (effectiveSessionId) {
+            this.convToSession.set(conversationId, effectiveSessionId);
+            this.plans.set(effectiveSessionId, state);
+        }
+        this.save();
         return state;
     }
     /** 增量更新单个步骤的状态或内容。 */
     updateStep(conversationId, stepId, patch) {
-        const current = this.plans.get(conversationId);
+        const current = this.getPlan(conversationId);
         if (!current)
             return null;
         const idx = current.steps.findIndex((s) => s.id === stepId);
@@ -86,11 +161,81 @@ export class PlanManager {
             updatedAt: Date.now(),
         };
         this.plans.set(conversationId, nextState);
+        const sessId = this.convToSession.get(conversationId);
+        if (sessId) {
+            this.plans.set(sessId, nextState);
+        }
+        this.save();
+        return nextState;
+    }
+    /** 增量删除单个步骤。 */
+    deleteStep(conversationId, stepId) {
+        const current = this.plans.get(conversationId);
+        if (!current)
+            return null;
+        const idx = current.steps.findIndex((s) => s.id === stepId);
+        if (idx === -1)
+            return current;
+        const nextSteps = current.steps.filter((s) => s.id !== stepId);
+        let nextActive = current.activeStepId;
+        if (current.activeStepId === stepId) {
+            const nextPending = nextSteps.find((s) => s.status === "pending" || s.status === "in_progress");
+            nextActive = nextPending ? nextPending.id : null;
+        }
+        const nextState = {
+            steps: nextSteps,
+            activeStepId: nextActive,
+            updatedAt: Date.now(),
+        };
+        this.plans.set(conversationId, nextState);
+        return nextState;
+    }
+    /** 增量新增步骤。 */
+    addStep(conversationId, step, afterStepId) {
+        const current = this.plans.get(conversationId);
+        const existingSteps = current?.steps ?? [];
+        const normalized = {
+            id: String(step.id ?? `step-${Date.now()}`),
+            title: String(step.title ?? "").slice(0, 200),
+            status: step.status && VALID_STATUSES.has(step.status) ? step.status : "pending",
+        };
+        const description = String(step.description ?? "").slice(0, 1000);
+        if (description)
+            normalized.description = description;
+        let nextSteps;
+        if (afterStepId) {
+            const idx = existingSteps.findIndex((s) => s.id === afterStepId);
+            if (idx !== -1) {
+                nextSteps = [...existingSteps.slice(0, idx + 1), normalized, ...existingSteps.slice(idx + 1)];
+            }
+            else {
+                nextSteps = [...existingSteps, normalized];
+            }
+        }
+        else {
+            nextSteps = [...existingSteps, normalized];
+        }
+        let nextActive = current?.activeStepId ?? null;
+        if (!nextActive && normalized.status === "in_progress") {
+            nextActive = normalized.id;
+        }
+        const nextState = {
+            steps: nextSteps,
+            activeStepId: nextActive,
+            updatedAt: Date.now(),
+        };
+        this.plans.set(conversationId, nextState);
         return nextState;
     }
     /** 清除指定会话的计划。 */
     clearPlan(conversationId) {
         this.plans.delete(conversationId);
+        const sessId = this.convToSession.get(conversationId);
+        if (sessId) {
+            this.plans.delete(sessId);
+            this.convToSession.delete(conversationId);
+        }
+        this.save();
     }
     /** 格式化计划为简洁文本，供模型上下文或诊断使用。 */
     describePlan(conversationId) {

package/dist/server/plan-mode.js

@@ -46,6 +46,9 @@ const BLOCKED_TOOLS = new Set([
     "rename",
     // 版本控制写（git add/commit/checkout/reset…；git 的只读子命令走 bash 白名单）
     "git",
+    // 代码求值（eval 沙箱的 execute 直接 kernel.execute，可写真实文件系统；
+    // 默认关但用户可开，开了就是一条写路径 —— #436）
+    "eval",
     // 形态变换（会重写整个文件树）
     "format",
     "prettier",
@@ -53,25 +56,43 @@ const BLOCKED_TOOLS = new Set([
     "autofix",
 ]);
 /**
- * 计划模式下也禁掉的「旁路工具」：它们能在**别的会话**里干活，而闸门是
- * 会话级的 —— 子代理/排程对话的 planMode 是 false，等于绕过只读约束。
- * 调研靠本对话的 read/grep/只读 bash 足够，需要并行调研时先退出计划模式。
+ * 常驻终端的「写向」工具（server/terminals.ts）：直接往 PTY stdin 写字符/按键。
+ * 必须整体剥离而不只是补检查：terminal_input 只在自带换行时才过 checkSafety，
+ * terminal_key 的 Enter 连检查都没有 —— 「input(无换行) + key(Enter)」两步即可
+ * 绕过 bash 只读白名单执行任意命令（#436）。且 PTY 的行编辑缓冲在 shell 进程内，
+ * 服务端拿不到可靠的「待提交行」（退格/Ctrl+U/补全都无法镜像），按缓冲检查既会
+ * 误放也会误拦 —— 所以计划模式下干脆不给这两件工具：调研用 bash（走白名单），
+ * 观察已有终端用 terminal_read/terminal_list/terminal_wait（只读）。
  */
-const BYPASS_TOOLS = new Set([
-    "spawn",
-    "spawn_agent",
-    "subagent_spawn",
-    "delegate_task",
-    "schedule_agent",
-    "host_schedule",
-    "create_goal",
-    "set_goal",
-    "start_goal_wizard",
-    "create_conversation",
-    "fork_conversation",
-]);
+const TERMINAL_WRITE_TOOLS = new Set(["terminal_input", "terminal_key"]);
+/**
+ * 三个只读闸门（计划 / 审查者 / 目标审查）共用的「派发类」工具名：它们会把活
+ * 派到**别的会话**执行（delegate_task 走子代理 spawn 通道；schedule_task 到期
+ * 唤醒对话跑 prompt），而这三道闸门都是会话级的 —— 放行即绕过。
+ *
+ * 名单以 server/tool-manager.ts 实际注册的工具名为事实源（#436）：历史名单里的
+ * spawn / spawn_agent / subagent_spawn / schedule_agent / host_schedule /
+ * create_goal / set_goal / start_goal_wizard / create_conversation /
+ * fork_conversation / schedule / set_plan_mode 等都是协议消息名或从未注册的
+ * 幽灵名，一个真实工具都没拦住，反而掩盖了 schedule_task 这类真实旁路工具
+ * 完全可用的事实。subagent 是单 action 工具，由各闸门按 action 细分（只读
+ * action 放行，见各闸门的判定函数）。
+ */
+export const SESSION_DISPATCH_TOOLS = new Set(["delegate_task", "schedule_task"]);
+/**
+ * 计划模式下也禁掉的「旁路工具」（真实派发类，见 SESSION_DISPATCH_TOOLS）：
+ * 它们能在**别的会话**里干活，而闸门是会话级的 —— 子代理/排程对话的
+ * planMode 是 false，等于绕过只读约束。调研靠本对话的 read/grep/只读 bash
+ * 足够，需要并行调研时先退出计划模式。
+ */
+const BYPASS_TOOLS = SESSION_DISPATCH_TOOLS;
 /** 计划模式下从模型视野中彻底隐藏的写类工具与旁路工具全集。 */
-export const PLAN_MODE_BLOCKED_TOOL_NAMES = new Set([...BLOCKED_TOOLS, ...BYPASS_TOOLS, "subagent"]);
+export const PLAN_MODE_BLOCKED_TOOL_NAMES = new Set([
+    ...BLOCKED_TOOLS,
+    ...BYPASS_TOOLS,
+    ...TERMINAL_WRITE_TOOLS,
+    "subagent",
+]);
 /** bash 类工具名（terminalBash 开关分流后可能是这几个）。 */
 const BASH_TOOLS = new Set(["bash", "bash_execute", "run_command", "shell", "terminal", "terminal_exec"]);
 /** 计划模式放行的只读命令（basename，无参数）。刻意保守：宁可拒一次让模型换命令。 */
@@ -238,6 +259,10 @@ function segmentIsReadOnly(segment) {
         return false;
     if (name === "awk" && /system\s*\(/.test(rest))
         return false;
+    // find 的 -exec/-delete/-fprintf 族有写副作用（issue #483）：白名单命中不等于只读，
+    // `find . -name '*.log' -delete` / `-exec touch x {} +` 无任何重定向特征，必须显式拒。
+    if (name === "find" && args.some((a) => /^-(exec|execdir|ok|okdir|delete|fprint0|fprint|fprintf|fls)$/.test(a)))
+        return false;
     // 解释器：只放行 --version/--help 这类无副作用调用。
     if (name === "node" || name === "python" || name === "python3" || name === "npm") {
         return args.length > 0 && args.every((a) => INTERPRETER_SAFE_ARGS.has(a));
@@ -274,6 +299,7 @@ function commandOf(params) {
  * 计划模式闸门（纯函数）：命中即拒绝，并把可操作的替代路径告诉模型。
  * - 写类工具 → 拒（提示：把要做的事写进计划，用户确认后另起一轮实施）
  * - bash 非常规命令 → 拒（提示：用 read/grep/只读 git，或给出计划）
+ * - 终端写向工具（terminal_input/terminal_key）→ 拒（会绕过只读命令白名单）
  * - 旁路工具（spawn/delegate/目标模式/排程）→ 拒（会绕过本会话只读约束）
  */
 export function planModeDenial(toolName, params) {
@@ -283,14 +309,26 @@ export function planModeDenial(toolName, params) {
     if (name === "subagent") {
         const action = typeof params === "object" && params !== null ? params.action : undefined;
         const act = typeof action === "string" ? action.trim().toLowerCase() : "";
-        if (!act || act === "spawn") {
+        // 与 goal-review-gate 同口径：只读 action（get_result/list/templates，看状态
+        // 与名录）放行；其余（spawn/steer/stop/wait_all/handoff，见 subagents.ts 的
+        // SUBAGENT_ACTIONS）或未传 action 一律拒 —— steer/handoff 会向运行中的子代理
+        // 会话投指令驱动它继续写代码，子代理会话 planMode=false 工具齐全，等于绕过
+        // 本会话的只读约束（#436 此前只拒了 spawn）。
+        if (act !== "get_result" && act !== "list" && act !== "templates") {
             return {
                 kind: "bypass-tool",
-                reason: `计划模式：不能调用 subagent(action="spawn")（它会在别的会话里执行，绕过本会话的只读约束）。请在本对话内用只读工具完成调研。`,
-                reasonEn: `Plan mode: subagent(action="spawn") is unavailable (it runs outside this conversation and would bypass the read-only constraint). Research with read-only tools here.`,
+                reason: `计划模式：不能调用 subagent(action="${act || "spawn"}")（它会在别的会话里执行，绕过本会话的只读约束）。请在本对话内用只读工具完成调研。`,
+                reasonEn: `Plan mode: subagent(action="${act || "spawn"}") is unavailable (it runs outside this conversation and would bypass the read-only constraint). Research with read-only tools here.`,
             };
         }
     }
+    if (TERMINAL_WRITE_TOOLS.has(name)) {
+        return {
+            kind: "write-tool",
+            reason: `计划模式：不能调用 ${name}（终端输入/按键会绕过只读命令白名单，见 #436）。调研请用 bash 跑只读命令；观察已有终端用 terminal_read/terminal_list/terminal_wait。`,
+            reasonEn: `Plan mode: ${name} is unavailable (terminal input/keys would bypass the read-only command allowlist). Run read-only commands via bash; observe existing terminals with terminal_read/terminal_list/terminal_wait.`,
+        };
+    }
     if (BYPASS_TOOLS.has(name)) {
         return {
             kind: "bypass-tool",

package/dist/server/plugin-api-catalog.js

@@ -23,6 +23,8 @@ export const SLOT_EXAMPLES = {
     "goalbar.actions": `{ "ui": { "goalbar.actions": [{ "id": "m", "label": "目标条", "kind": "action", "action": "my:m" }] } }`,
     "notice.actions": `{ "ui": { "notice.actions": [{ "id": "m", "label": "通知动作", "kind": "action", "action": "my:m" }] } }`,
     "modal.dialog": `{ "modal": [{ "id": "m", "label": "弹窗", "kind": "action", "action": "my:m" }] }`,
+    "sidebar.left": `{ "sidebar.left": [{ "id": "m", "label": "左侧悬浮", "kind": "action", "action": "my:m" }] }`,
+    "sidebar.right": `{ "sidebar.right": [{ "id": "m", "label": "右侧悬浮", "kind": "action", "action": "my:m" }] }`,
 };
 /** 宿主方法表（与 server/plugins.ts#PluginHost 同语义的精简版：只收发现用的注册/调用面）。
  *  needs="-" = 观察/基础设施类（无需能力声明）；其余走 can() 门控。 */

package/dist/server/plugin-catalog.js

@@ -14,8 +14,8 @@
  * 设计上服务端不做网络探测（不拉 manifest）：名称/简介/图标由条目本身携带
  * （作者填），id 由来源推导或作者显式指定 —— 保持离线可用、可单测。
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { writeJsonAtomicSync } from "./atomic-file.js";
 import { normalizeIconSvg } from "./icon-svg.js";
 import { pick } from "./i18n.js";
 /** 合法插件 id（与 server/plugins.ts 的 ID_RE 一致，防路径穿越）。 */
@@ -61,10 +61,7 @@ function readJsonSafe(path, fallback) {
     }
 }
 function atomicWrite(path, data) {
-    mkdirSync(dirname(path), { recursive: true });
-    const tmp = `${path}.tmp-${process.pid}`;
-    writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
-    renameSync(tmp, path);
+    writeJsonAtomicSync(path, data);
 }
 /** 把任意对象规范化为合法条目；非法则返回 null。 */
 function toEntry(raw, builtin) {
@@ -75,6 +72,7 @@ function toEntry(raw, builtin) {
     if (!ID_RE.test(id))
         return null;
     const name = typeof raw.name === "string" && raw.name.trim() ? raw.name.trim() : id;
+    const nameEn = typeof raw.nameEn === "string" && raw.nameEn.trim() ? raw.nameEn.trim() : undefined;
     const description = typeof raw.description === "string" && raw.description.trim() ? raw.description.trim() : undefined;
     const descriptionEn = typeof raw.descriptionEn === "string" && raw.descriptionEn.trim() ? raw.descriptionEn.trim() : undefined;
     const icon = typeof raw.icon === "string" && raw.icon.trim() ? raw.icon.trim() : undefined;
@@ -85,6 +83,7 @@ function toEntry(raw, builtin) {
         name,
         source,
         builtin,
+        ...(nameEn ? { nameEn } : {}),
         ...(description ? { description } : {}),
         ...(descriptionEn ? { descriptionEn } : {}),
         ...(icon ? { icon } : {}),
@@ -231,6 +230,7 @@ export function writeCustomCatalog(customPath, incoming, replace) {
         id: e.id,
         source: e.source,
         name: e.name,
+        ...(e.nameEn ? { nameEn: e.nameEn } : {}),
         ...(e.description ? { description: e.description } : {}),
         ...(e.descriptionEn ? { descriptionEn: e.descriptionEn } : {}),
         ...(e.icon ? { icon: e.icon } : {}),

package/dist/server/plugin-dom.js

@@ -13,8 +13,9 @@
  * - 只有真正发生变更的写才落盘（临时文件 + rename 原子写）；写失败 best-effort
  *   （内存态仍生效，本次会话可用）。
  */
-import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { writeJsonAtomicSync } from "./atomic-file.js";
 const FILE = "plugin-dom.json";
 /** manifest.permissions 条目 → 是否请求特权 DOM（只看 `:` 前的族名，与宿主 can() 同口径）。
  *  例外：`dom:anchor` 只是客户端锚点挂载点的范围 DOM（免用户授权），不触发 bundle 403；
@@ -71,9 +72,7 @@ export class PluginDomConsent {
         else
             this.granted.delete(id);
         try {
-            const tmp = join(this.dataDir, `${FILE}.tmp.${process.pid}`);
-            writeFileSync(tmp, JSON.stringify({ v: 1, granted: this.list() }), "utf8");
-            renameSync(tmp, join(this.dataDir, FILE));
+            writeJsonAtomicSync(join(this.dataDir, FILE), { v: 1, granted: this.list() });
         }
         catch {
             /* 写失败 best-effort：内存态仍生效，本次会话可用 */

package/dist/server/plugin-facilities.js

@@ -16,9 +16,10 @@
  *     不能防同一用户账号下的完整进程妥协——本地个人工具的合理折衷。
  */
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, statSync } from "node:fs";
 import { readFile as fspReadFile, readdir as fspReaddir, rm as fspRm, mkdir as fspMkdir, writeFile as fspWriteFile, appendFile as fspAppendFile, stat as fspStat, } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
+import { writeAtomicSync } from "./atomic-file.js";
 import { createRequire } from "node:module";
 import { spawnSync } from "node:child_process";
 // 与 plugin-project 共用同一套 realpath 越界复核（isInsideRoot / realPathOfNearest），
@@ -26,10 +27,7 @@ import { spawnSync } from "node:child_process";
 import { isInsideRoot, realPathOfNearest } from "./plugin-project.js";
 /** tmp+rename 原子写（错误由调用方隔离——插件设施的 IO 一律尽力而为）。 */
 function atomicWrite(file, data) {
-    mkdirSync(dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}`;
-    writeFileSync(tmp, data);
-    renameSync(tmp, file);
+    writeAtomicSync(file, data);
 }
 // ---------------------------------------------------------------------------
 // storage.json 的进程内「读-改-写」互斥