npm - zen-gitsync - Versions diffs - 2.13.15 → 2.13.16 - Mend

zen-gitsync 2.13.15 → 2.13.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/src/ui/public/index.html CHANGED Viewed

@@ -10,12 +10,12 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,400&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-YZlo31ni.js"></script>
+    <script type="module" crossorigin src="/assets/index-C19XAWFW.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CMxvf4Kt.js">
-    <link rel="modulepreload" crossorigin href="/assets/vendor-1pu0KtT-.js">
-    <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-FEqtfvX2.js">
-    <link rel="stylesheet" crossorigin href="/assets/vendor-B99WlFa_.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-BB8LQ04I.css">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-D72Z0Jmi.js">
+    <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-CT67BnrS.js">
+    <link rel="stylesheet" crossorigin href="/assets/vendor-F3eVqHe1.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-C3VghkAQ.css">
   </head>
   <body>
     <div id="app"></div>

package/src/ui/server/index.js CHANGED Viewed

@@ -134,7 +134,8 @@ async function startUIServer(noOpen = false, savePort = false) {
     execGitCommand,
     addCommandToHistory,
     getCurrentProjectPath: () => currentProjectPath,
-    nextProcessId: () => processIdCounter++,
+    // 用 pre-increment 从 1 起,避免首进程拿到 id=0（0 在 `if (processId)` 这类真值检查里会被吞）
+    nextProcessId: () => ++processIdCounter,
     runningProcesses
   });

package/src/ui/server/routes/exec.js CHANGED Viewed

@@ -123,20 +123,21 @@ export function registerExecRoutes({
       // npm、node、git 等现代工具都输出 UTF-8
       const isWindows = process.platform === 'win32';
       const cmdBuiltins = ['dir', 'type', 'set', 'path', 'cd', 'md', 'rd', 'del', 'copy', 'move', 'ren'];
       // echo 命令特殊处理：如果包含变量替换（如 {{xxx}}），说明内容可能已经是 UTF-8，不转换
-      const isEchoCommand = command.trim().toLowerCase().startsWith('echo ');
+      const trimmed = command.trim().toLowerCase();
+      const firstToken = trimmed.split(/\s+/, 1)[0] || '';
+      const isEchoCommand = firstToken === 'echo';
       const hasVariableSubstitution = isEchoCommand && (
-        command.includes('{{') ||
-        command.includes('${') ||
+        command.includes('{{') ||
+        command.includes('${') ||
         command.includes('%')  // Windows 环境变量
       );
+      // 必须按 token 边界判断,避免 'dir' 误匹配 'directory'、'path' 误匹配 'path-to'
       const needsGbkConversion = isWindows && (
-        cmdBuiltins.some(builtin =>
-          command.trim().toLowerCase().startsWith(builtin + ' ') ||
-          command.trim().toLowerCase() === builtin
-        ) || (isEchoCommand && !hasVariableSubstitution)  // echo 只在没有变量替换时才转换
+        cmdBuiltins.includes(firstToken) ||
+        (isEchoCommand && !hasVariableSubstitution)  // echo 只在没有变量替换时才转换
       );
       console.log(`[流式输出] 命令: ${command.substring(0, 50)}, 需要GBK转换: ${needsGbkConversion}`);

package/src/ui/server/routes/status.js CHANGED Viewed

@@ -33,32 +33,31 @@ export function registerStatusRoutes({
   app.get('/api/status_porcelain', async (req, res) => {
     try {
       const { stdout } = await execGitCommand('git status --porcelain --untracked-files=all');
-      // 检测是否处于 MERGING 状态（MERGE_HEAD 文件存在）
+      // 检测是否处于 MERGING 状态（MERGE_HEAD 存在）
       let isMergeInProgress = false;
       let mergeMessage = '';
       try {
         const { stdout: mergeHead } = await execGitCommand('git rev-parse -q --verify MERGE_HEAD');
         isMergeInProgress = mergeHead.trim().length > 0;
-        if (isMergeInProgress) {
-          // 读取 Git 自动生成的合并提交信息
-          try {
-            const { stdout: gitDir } = await execGitCommand('git rev-parse --git-dir');
-            const mergeMsgPath = path.resolve(gitDir.trim(), 'MERGE_MSG');
-            const raw = await fs.readFile(mergeMsgPath, 'utf-8');
-            // 过滤掉以 # 开头的注释行，取第一个非空行
-            mergeMessage = raw
-              .split('\n')
-              .filter(line => line.trim() && !line.startsWith('#'))
-              .join('\n')
-              .trim();
-          } catch (_) {
-            // MERGE_MSG 不存在时忽略
-          }
-        }
       } catch (_) {
         // MERGE_HEAD 不存在时命令会报错，属正常情况
         isMergeInProgress = false;
       }
+      if (isMergeInProgress) {
+        try {
+          const { stdout: gitDir } = await execGitCommand('git rev-parse --git-dir');
+          const mergeMsgPath = path.resolve(gitDir.trim(), 'MERGE_MSG');
+          const raw = await fs.readFile(mergeMsgPath, 'utf-8');
+          // 过滤掉以 # 开头的注释行，拼接所有非空非注释行（保留多段信息如合并分支列表）
+          mergeMessage = raw
+            .split('\n')
+            .filter(line => line.trim() && !line.startsWith('#'))
+            .join('\n')
+            .trim();
+        } catch (_) {
+          // MERGE_MSG 不存在/无权限时忽略
+        }
+      }
       res.json({ status: stdout, isMergeInProgress, mergeMessage });
     } catch (error) {
       res.status(500).json({ error: error.message });

package/src/ui/server/routes/terminal.js CHANGED Viewed

@@ -13,6 +13,7 @@
 // limitations under the License.
 //
 import { spawn, exec } from 'child_process';
+import { psEscape, appleEscape, shQuote } from '../utils/shellQuote.js';
 export function registerTerminalRoutes({
   app,
@@ -25,7 +26,6 @@ export function registerTerminalRoutes({
     if (process.platform === 'win32') {
       const cmdToRun = String(command || '').trim();
-      const safeWorkingDir = String(targetDir).replace(/"/g, '""');
       const splitArgs = (input) => {
         const s = String(input || '');
@@ -59,6 +59,7 @@ export function registerTerminalRoutes({
       const tokens = splitArgs(cmdToRun);
       const isStartCommand = tokens.length > 0 && String(tokens[0]).toLowerCase() === 'start';
+      // PowerShell 转义全部走 shellQuote.psEscape ($ ` " 都会被处理)
       let psScript;
       if (isStartCommand) {
         const args = tokens.slice(1);
@@ -69,19 +70,14 @@ export function registerTerminalRoutes({
         const exe = candidateExe && !isUrl(candidateExe) ? String(candidateExe) : null;
         if (!exe && candidateUrl) {
-          const safeUrl = String(candidateUrl).replace(/"/g, '""');
-          psScript = `$p = Start-Process -FilePath "${safeUrl}" -WorkingDirectory "${safeWorkingDir}" -PassThru; Write-Output $p.Id`;
+          psScript = `$p = Start-Process -FilePath "${psEscape(candidateUrl)}" -WorkingDirectory "${psEscape(targetDir)}" -PassThru; Write-Output $p.Id`;
         } else if (exe && candidateUrl) {
-          const safeExe = String(exe).replace(/"/g, '""');
-          const safeUrl = String(candidateUrl).replace(/"/g, '""');
-          psScript = `$p = Start-Process -FilePath "${safeExe}" -ArgumentList "${safeUrl}" -WorkingDirectory "${safeWorkingDir}" -PassThru; Write-Output $p.Id`;
+          psScript = `$p = Start-Process -FilePath "${psEscape(exe)}" -ArgumentList "${psEscape(candidateUrl)}" -WorkingDirectory "${psEscape(targetDir)}" -PassThru; Write-Output $p.Id`;
         } else {
-          const safeCmd = String(cmdToRun).replace(/"/g, '""');
-          psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/C", "${safeCmd}" -WorkingDirectory "${safeWorkingDir}" -WindowStyle Hidden -PassThru; Write-Output $p.Id`;
+          psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/C", "${psEscape(cmdToRun)}" -WorkingDirectory "${psEscape(targetDir)}" -WindowStyle Hidden -PassThru; Write-Output $p.Id`;
         }
       } else {
-        const safeCmd = String(cmdToRun).replace(/"/g, '""');
-        psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/K", "${safeCmd}" -WorkingDirectory "${safeWorkingDir}" -PassThru; Write-Output $p.Id`;
+        psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/K", "${psEscape(cmdToRun)}" -WorkingDirectory "${psEscape(targetDir)}" -PassThru; Write-Output $p.Id`;
       }
       return await new Promise((resolve, reject) => {
@@ -118,8 +114,10 @@ export function registerTerminalRoutes({
     }
     if (process.platform === 'darwin') {
-      const script = `tell application "Terminal" to do script "cd ${targetDir} && ${command.trim()}"`;
-      exec(`osascript -e '${script}'`, (error) => {
+      // AppleScript 转义统一走 shellQuote.appleEscape (\ " 都会被处理)
+      const script = `tell application "Terminal" to do script "cd ${appleEscape(targetDir)} && ${appleEscape(command.trim())}"`;
+      // 外层用单引号包,把脚本里可能出现的单引号转义为 '\''
+      exec(`osascript -e ${shQuote(script)}`, (error) => {
         if (error) {
           console.error('打开终端失败:', error);
         }
@@ -127,7 +125,8 @@ export function registerTerminalRoutes({
       return { pid: null };
     }
-    const terminalCommand = `gnome-terminal -- bash -c "cd ${targetDir} && ${command.trim()}; exec bash" || xterm -e "cd ${targetDir} && ${command.trim()}; bash"`;
+    // Linux: 用 sh 单引号包命令行,单引号内不解释 $ ` " \ ,只把单引号自身 '\''
+    const terminalCommand = `gnome-terminal -- bash -c ${shQuote(`cd ${targetDir} && ${command.trim()}; exec bash`)} || xterm -e ${shQuote(`cd ${targetDir} && ${command.trim()}; bash`)}`;
     exec(terminalCommand, (error) => {
       if (error) {
         console.error('打开终端失败:', error);

package/src/ui/server/routes/workbench.js CHANGED Viewed

@@ -1070,20 +1070,35 @@ function launchClaudeInNewWindow(cwd, promptText, resumeSessionId) {
   });
 }
-// 顺序执行一个任务下所有子任务；上一个结束再启动下一个
-async function runTaskQueue(task, repoPath, branch) {
-  // 前序上下文：跑完一个 sub 后把它"完成态"摘要存到这里，下一个 sub 启动时
-  // 拼到 prompt 头部，让 Claude 知道前面做了什么、产出了什么。
-  // 故意不用 raw output 全文——LLM 已经习惯"摘要 + 关键结论"的格式，且不会
+/**
+ * 顺序执行一个任务下所有子任务；上一个结束再启动下一个。
+ * 入参 fromIndex 指定从哪个 sub 开始(0-based,默认 0),用于"从此处开始"入口;
+ * fromIndex>0 时,把 [0, fromIndex) 区间内已 done 的 sub 输出预填到 priorOutputs,
+ * 这样后续 sub 仍能拿到前序上下文(跟单 sub 执行的语义保持一致)。
+ */
+async function runTaskQueue(task, repoPath, branch, opts) {
+  // 前序上下文:跑完一个 sub 后把它"完成态"摘要存到这里,下一个 sub 启动时
+  // 拼到 prompt 头部,让 Claude 知道前面做了什么、产出了什么。
+  // 故意不用 raw output 全文——LLM 已经习惯"摘要 + 关键结论"的格式,且不会
   // 一次塞几 MB 进 prompt 烧 token。truncate 到每条 MAX_PREV_OUTPUT_CHARS。
   const MAX_PREV_OUTPUT_CHARS = 2000
-  const priorOutputs = []
-  for (const sub of task.subtasks) {
+  const requested = Number(opts && opts.fromIndex)
+  const fromIndex = Number.isInteger(requested) && requested >= 0 && requested < task.subtasks.length
+    ? requested
+    : 0
+  // 从 fromIndex 开始时,把前面已 done 的 sub 输出预填进 priorOutputs,
+  // 否则"从中间开始"会丢失前序上下文。
+  const priorOutputs = fromIndex > 0
+    ? await collectPriorOutputsUpTo(task, fromIndex)
+    : []
+  for (let i = fromIndex; i < task.subtasks.length; i++) {
+    const sub = task.subtasks[i]
     if (sub.status === 'done') continue;
     await runSingleSubtask(task, sub, repoPath, branch, priorOutputs)
+    // 逐 sub 落盘:之前只在队列跑完才 persistTaskAfterRun,中途崩溃会丢已完成
+    // sub 的状态。runSingleSubtask 已经把 sub.status 改完,这里补一次落盘。
+    await persistTaskAfterRun(task)
   }
-  // 写回 tasks.json
-  await persistTaskAfterRun(task)
 }
 /**
@@ -1324,11 +1339,19 @@ async function persistTaskAfterRun(task) {
  * 子任务输出摘要收集起来。这样单独跑一个 sub 时,它也能拿到前序上下文。
  */
 async function collectPriorOutputs(task, targetSub) {
+  const targetIdx = task.subtasks.findIndex(s => s.id === targetSub.id)
+  if (targetIdx < 0) return []
+  return collectPriorOutputsUpTo(task, targetIdx)
+}
+/**
+ * 收集 [0, endIdx) 区间内已 done 的 sub 输出摘要,作为队列内 sub 的前序上下文。
+ * runTaskQueue 在 fromIndex>0 时调这个,让"从此处开始"也能拼上前序 done sub 的结论。
+ */
+async function collectPriorOutputsUpTo(task, endIdx) {
   const MAX_PREV_OUTPUT_CHARS = 2000
   const prior = []
-  const targetIdx = task.subtasks.findIndex(s => s.id === targetSub.id)
-  if (targetIdx < 0) return prior
-  for (let i = 0; i < targetIdx; i++) {
+  for (let i = 0; i < endIdx; i++) {
     const s = task.subtasks[i]
     if (s.status !== 'done') continue
     // 从 jobs 列表里找最近一个属于这个 sub 且 status=done 的 job,
@@ -2305,6 +2328,40 @@ ${desc ? `描述：${desc}` : '描述：（无）'}${attachmentBlock}${templateB
     }
   });
+  // ── 从指定子任务开始执行 ───────────────────────────────────────────
+  // POST /api/workbench/tasks/:id/run-from
+  // 入参 body: { startSubIndex: number }
+  // 行为:
+  //   - 从 task.subtasks[startSubIndex] 开始按序执行,前面 [0, startSubIndex) 区间的
+  //     done sub 输出会自动作为前序上下文(同单 sub 执行的语义)
+  //   - 前面 error / running 的 sub 不会被自动重跑;从 startSubIndex 开始重新走队列
+  //   - 适合"中间某个 sub 失败/被取消后,从该 sub 继续"的场景
+  //   - startSubIndex 必须落在 [0, task.subtasks.length) 范围内
+  app.post('/api/workbench/tasks/:id/run-from', async (req, res) => {
+    try {
+      const data = await readJson(TASKS_FILE, { tasks: [] });
+      const task = (data.tasks || []).find(t => t.id === req.params.id);
+      if (!task) return res.status(404).json({ success: false, error: '任务不存在' });
+      if (!task.subtasks || task.subtasks.length === 0) {
+        return res.status(400).json({ success: false, error: '任务没有子任务' });
+      }
+      const startSubIndex = Number(req.body?.startSubIndex);
+      if (!Number.isInteger(startSubIndex)
+        || startSubIndex < 0
+        || startSubIndex >= task.subtasks.length) {
+        return res.status(400).json({ success: false, error: 'startSubIndex 越界' });
+      }
+      const repoPath = typeof getCurrentProjectPath === 'function' ? getCurrentProjectPath() : '';
+      // 异步执行,立即返回(同 /run 的 fire-and-forget 模式)
+      res.json({ success: true, message: `已从第 ${startSubIndex + 1} 个子任务开始执行` });
+      runTaskQueue(task, repoPath, '', { fromIndex: startSubIndex }).catch(err => {
+        publish('task:error', { taskId: task.id, error: err.message });
+      });
+    } catch (err) {
+      res.status(500).json({ success: false, error: err.message });
+    }
+  });
   // ── 执行简单任务（无子任务直接跑） ──────────────────────────────────
   // POST /api/workbench/tasks/:id/run-simple
   // 行为：
@@ -2672,6 +2729,144 @@ ${desc ? `描述：${desc}` : '描述：（无）'}${attachmentBlock}${templateB
     }
   })
+  // POST /api/workbench/tasks/:id/clear-execution
+  // 一次性清空指定 task 的所有执行痕迹:
+  //   1. 删除内存 + 磁盘 jobs.json 中该 task 的全部 job(跳过 running/pending)
+  //   2. 把 tasks.json 中该 task 的所有 subtasks status 重置为 'todo'(让"重新执行"能从头跑)
+  //   3. 同步清掉 sub 的 error 字段,broadcast task:update + 一组 sub:update
+  // 任务描述、附件、提示词模板等"内容"字段保留不动——只清"执行痕迹"。
+  // 活跃态(有 running/pending job)时拒绝,避免误杀正在跑的实例。
+  app.post('/api/workbench/tasks/:id/clear-execution', async (req, res) => {
+    try {
+      const taskId = req.params.id
+      if (!taskId) return res.status(400).json({ success: false, error: '缺少 taskId' })
+      // 检查活跃 job
+      const live = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        if (j.status === 'running' || j.status === 'pending') live.push(j.id)
+      }
+      if (live.length > 0) {
+        return res.status(400).json({ success: false, error: `有 ${live.length} 个 job 正在执行,请先停止` })
+      }
+      // 1) 清空 jobs(内存 + 磁盘)
+      const removedJobIds = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        jobs.delete(j.id)
+        removedJobIds.push(j.id)
+      }
+      const jobsData = await readJson(JOBS_FILE, { version: 1, jobs: [] })
+      if (jobsData && Array.isArray(jobsData.jobs)) {
+        const before = jobsData.jobs.length
+        jobsData.jobs = jobsData.jobs.filter(j => j.taskId !== taskId)
+        if (jobsData.jobs.length !== before) await writeJson(JOBS_FILE, jobsData)
+      }
+      // 2) 重置 subtasks.status → todo
+      const tasksData = await readJson(TASKS_FILE, { tasks: [] })
+      const task = (tasksData.tasks || []).find(t => t.id === taskId)
+      if (!task) {
+        return res.json({ success: true, removedJobs: removedJobIds.length, resetSubs: 0, message: '任务不存在,仅清空 job' })
+      }
+      let resetSubs = 0
+      if (Array.isArray(task.subtasks)) {
+        for (const s of task.subtasks) {
+          if (s.status !== 'todo') {
+            s.status = 'todo'
+            resetSubs++
+            if (s.error) delete s.error
+            publish('sub:update', { taskId, sub: s })
+          }
+        }
+        task.updatedAt = nowIso()
+        await writeJson(TASKS_FILE, tasksData)
+        publish('task:update', task)
+      }
+      res.json({
+        success: true,
+        removedJobs: removedJobIds.length,
+        resetSubs,
+        message: `已清空 ${removedJobIds.length} 条执行记录,${resetSubs} 个子任务重置为待执行`
+      })
+    } catch (err) {
+      res.status(500).json({ success: false, error: '清空执行痕迹失败: ' + (err.message || String(err)) })
+    }
+  })
+  // POST /api/workbench/tasks/:id/reset-shell
+  // 把 task 还原成"只有标题的空壳",清掉 desc / attachments / promptId / subtasks。
+  // 与 clear-execution 的区别:
+  //   - clear-execution 只重置 sub.status + 清 jobs(保留拆分/描述/附件)
+  //   - reset-shell 直接删除 subtasks 数组和描述/附件,任务只剩标题
+  // 同时清空该 task 的所有 job(沿用 by-task 删除语义,跳过 running/pending)。
+  // 活跃态拒绝,避免误杀正在跑的实例。
+  app.post('/api/workbench/tasks/:id/reset-shell', async (req, res) => {
+    try {
+      const taskId = req.params.id
+      if (!taskId) return res.status(400).json({ success: false, error: '缺少 taskId' })
+      // 检查活跃 job
+      const live = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        if (j.status === 'running' || j.status === 'pending') live.push(j.id)
+      }
+      if (live.length > 0) {
+        return res.status(400).json({ success: false, error: `有 ${live.length} 个 job 正在执行,请先停止` })
+      }
+      // 1) 清空 jobs(内存 + 磁盘)
+      const removedJobIds = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        jobs.delete(j.id)
+        removedJobIds.push(j.id)
+      }
+      const jobsData = await readJson(JOBS_FILE, { version: 1, jobs: [] })
+      if (jobsData && Array.isArray(jobsData.jobs)) {
+        const before = jobsData.jobs.length
+        jobsData.jobs = jobsData.jobs.filter(j => j.taskId !== taskId)
+        if (jobsData.jobs.length !== before) await writeJson(JOBS_FILE, jobsData)
+      }
+      // 2) 重置 task 字段:只留 id / title / createdAt / status / projectPath(如存在)
+      const tasksData = await readJson(TASKS_FILE, { tasks: [] })
+      const task = (tasksData.tasks || []).find(t => t.id === taskId)
+      if (!task) {
+        return res.json({ success: true, removedJobs: removedJobIds.length, message: '任务不存在,仅清空 job' })
+      }
+      const removedSubCount = Array.isArray(task.subtasks) ? task.subtasks.length : 0
+      const removedAttCount = Array.isArray(task.attachments) ? task.attachments.length : 0
+      const hadDesc = !!(task.desc && task.desc.length > 0)
+      const hadPrompt = !!task.promptId
+      // 保留字段:id / title / createdAt / status / projectPath
+      // 清理:desc / attachments / promptId / subtasks
+      const preservedProjectPath = task.projectPath
+      const preservedCreatedAt = task.createdAt
+      const preservedStatus = task.status || 'todo'
+      // 重建对象(顺序保留 title 在前,符合视觉习惯)
+      const newTask = { id: task.id, title: task.title, status: preservedStatus }
+      if (preservedProjectPath) newTask.projectPath = preservedProjectPath
+      if (preservedCreatedAt) newTask.createdAt = preservedCreatedAt
+      newTask.subtasks = []
+      newTask.attachments = []
+      newTask.updatedAt = nowIso()
+      // 用 Object.assign 替换 task 的所有自身属性,保留原型链
+      for (const k of Object.keys(task)) delete task[k]
+      Object.assign(task, newTask)
+      await writeJson(TASKS_FILE, tasksData)
+      publish('task:update', task)
+      res.json({
+        success: true,
+        removedJobs: removedJobIds.length,
+        removedSubs: removedSubCount,
+        removedAttachments: removedAttCount,
+        clearedDesc: hadDesc,
+        clearedPrompt: hadPrompt,
+        message: `已清空:删除 ${removedSubCount} 个子任务${removedAttCount ? '、' + removedAttCount + ' 个附件' : ''}${hadDesc ? '、任务描述' : ''},任务标题保留`
+      })
+    } catch (err) {
+      res.status(500).json({ success: false, error: '清空任务内容失败: ' + (err.message || String(err)) })
+    }
+  })
   // GET /api/workbench/jobs/:id
   app.get('/api/workbench/jobs/:id', async (req, res) => {
     try {

package/src/ui/server/utils/shellQuote.js ADDED Viewed

@@ -0,0 +1,68 @@
+// Copyright 2026 xz333221
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+/**
+ * Shell / PowerShell 字符串转义工具
+ *
+ * 提供三种转义策略:
+ *   - shQuote: POSIX shell 单引号包字符串（git add / osascript / gnome-terminal 用）
+ *   - psEscape: PowerShell 双引号内安全转义（terminal.js 的 PowerShell 脚本用）
+ *   - appleEscape: AppleScript 双引号字符串内安全转义（macOS 终端用）
+ *
+ * 三种都不依赖外部包，纯字符串操作。
+ *
+ * @typedef {string | number | null | undefined} ShellInput
+ */
+/**
+ * POSIX shell 单引号包裹
+ * 单引号内不解释 $ ` " \,只把单引号自身转义为 '\''
+ * 例: shQuote('a"b$c') === "'a\"b$c'"
+ *
+ * @param {ShellInput} input
+ * @returns {string}
+ */
+export function shQuote(input) {
+  if (input === null || input === undefined) return "''"
+  return `'${String(input).replace(/'/g, `'\\''`)}'`
+}
+/**
+ * PowerShell 双引号字符串内安全转义
+ * 需要把 $ (变量/子表达式) 和 ` (子表达式) 各自前置一个反引号
+ * 双引号本身用 "" 转义;反引号自身先用 `` 转义避免吃掉后续转义
+ *
+ * @param {ShellInput} input
+ * @returns {string}
+ */
+export function psEscape(input) {
+  if (input === null || input === undefined) return '""'
+  return String(input)
+    .replace(/`/g, '``')
+    .replace(/\$/g, '`$')
+    .replace(/"/g, '""')
+}
+/**
+ * AppleScript 双引号字符串内安全转义
+ * 反斜杠和双引号都需要前置反斜杠
+ *
+ * @param {ShellInput} input
+ * @returns {string}
+ */
+export function appleEscape(input) {
+  if (input === null || input === undefined) return '""'
+  return String(input).replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}

package/src/ui/server/utils/shellQuote.test.js ADDED Viewed

@@ -0,0 +1,110 @@
+// Copyright 2026 xz333221
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// shellQuote 单元测试（node:test 内置）
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { shQuote, psEscape, appleEscape } from '../utils/shellQuote.js'
+test('shQuote 普通字符串', () => {
+  assert.equal(shQuote('hello'), "'hello'")
+})
+test('shQuote 单引号需要转义', () => {
+  // POSIX shell: 单引号字符串里唯一需要处理的就是单引号自身
+  // 关闭单引号 + 转义 + 开启单引号 = '\''
+  assert.equal(shQuote("a'b"), "'a'\\''b'")
+})
+test('shQuote 注入字符也能合法包裹', () => {
+  // POSIX shell 单引号内 $ ` " \ 都不展开,所以原样包住就是安全的
+  // 函数职责只保证产出一个语法合法的单引号字符串
+  const evil = '$(rm -rf /); `whoami` "$PATH" \\path'
+  const quoted = shQuote(evil)
+  // 必须以单引号开头和结尾,内部任何单引号都被 '\'' 转义
+  assert.ok(quoted.startsWith("'"))
+  assert.ok(quoted.endsWith("'"))
+  // 内部裸的单引号不会破坏字符串:
+  // 统计未配对的单引号数量,被正确转义的 ' 必须成对出现 '\''
+  // 这里因为输入不含单引号,所以 quoted 形如 '<evil>'
+  assert.equal(quoted.length, evil.length + 2)
+})
+test('shQuote null / undefined / number 都安全', () => {
+  assert.equal(shQuote(null), "''")
+  assert.equal(shQuote(undefined), "''")
+  assert.equal(shQuote(42), "'42'")
+})
+test('shQuote 文件名场景:含空格和双引号', () => {
+  // 模拟 git status --porcelain 解出的文件名
+  assert.equal(shQuote('my file.txt'), "'my file.txt'")
+  assert.equal(shQuote('a"b.txt'), `'a"b.txt'`)
+})
+test('psEscape $ 变量必须前置反引号', () => {
+  // 原: $(rm -rf /)  → 期望:  `$(rm -rf /)
+  // （PowerShell 双引号内 $ 会触发子表达式求值,前置 ` 取消求值）
+  assert.equal(psEscape('$(rm -rf /)'), '`$(rm -rf /)')
+})
+test('psEscape 反引号自身先转义', () => {
+  // 反引号是 PowerShell 转义符,先自身转义避免吃掉后续的转义符
+  // 原: `n  → 期望: ``n
+  assert.equal(psEscape('`n'), '``n')
+  // 原: $`n (3 字符) → 期望: `$``n (5 字符: ` $ ` ` n)
+  //   反引号先转:  $``n (4)  →  然后 $ 前置: `$``n (5)
+  assert.equal(psEscape('$`n'), '`$``n')
+})
+test('psEscape 双引号用 "" 转义', () => {
+  assert.equal(psEscape('a"b'), 'a""b')
+})
+test('psEscape 普通字符串不变', () => {
+  assert.equal(psEscape('hello world'), 'hello world')
+})
+test('psEscape null / undefined → 空字符串', () => {
+  assert.equal(psEscape(null), '""')
+  assert.equal(psEscape(undefined), '""')
+})
+test('psEscape 工作目录路径 (Windows 含反斜杠和 $)', () => {
+  // PowerShell 里 $env:TEMP 是变量; $ 开头的路径是注入面
+  const path = '$env:TEMP\\evil$(rm).txt'
+  const escaped = psEscape(path)
+  // 所有 $ 必须前置反引号
+  assert.ok(!escaped.match(/(?<!`)\$/), '不应有未转义的 $')
+  assert.ok(escaped.includes('`$env:'))
+  assert.ok(escaped.includes('`$(rm)'))
+})
+test('appleEscape 双引号前置反斜杠', () => {
+  assert.equal(appleEscape('a"b'), 'a\\"b')
+})
+test('appleEscape 反斜杠先转义', () => {
+  // 反斜杠要双写避免吃掉后面的 "
+  assert.equal(appleEscape('a\\"b'), 'a\\\\\\"b')
+})
+test('appleEscape 普通字符串不变', () => {
+  assert.equal(appleEscape('cd /tmp && ls'), 'cd /tmp && ls')
+})
+test('appleEscape null / undefined → 空字符串', () => {
+  assert.equal(appleEscape(null), '""')
+  assert.equal(appleEscape(undefined), '""')
+})