zen-gitsync 2.13.15 → 2.13.18

package/src/ui/server/routes/exec.js

@@ -123,20 +123,21 @@ export function registerExecRoutes({
       // npm、node、git 等现代工具都输出 UTF-8
       const isWindows = process.platform === 'win32';
       const cmdBuiltins = ['dir', 'type', 'set', 'path', 'cd', 'md', 'rd', 'del', 'copy', 'move', 'ren'];
-      
+
       // echo 命令特殊处理：如果包含变量替换（如 {{xxx}}），说明内容可能已经是 UTF-8，不转换
-      const isEchoCommand = command.trim().toLowerCase().startsWith('echo ');
+      const trimmed = command.trim().toLowerCase();
+      const firstToken = trimmed.split(/\s+/, 1)[0] || '';
+      const isEchoCommand = firstToken === 'echo';
       const hasVariableSubstitution = isEchoCommand && (
-        command.includes('{{') || 
-        command.includes('${') || 
+        command.includes('{{') ||
+        command.includes('${') ||
         command.includes('%')  // Windows 环境变量
       );
-      
+
+      // 必须按 token 边界判断,避免 'dir' 误匹配 'directory'、'path' 误匹配 'path-to'
       const needsGbkConversion = isWindows && (
-        cmdBuiltins.some(builtin =>
-          command.trim().toLowerCase().startsWith(builtin + ' ') ||
-          command.trim().toLowerCase() === builtin
-        ) || (isEchoCommand && !hasVariableSubstitution)  // echo 只在没有变量替换时才转换
+        cmdBuiltins.includes(firstToken) ||
+        (isEchoCommand && !hasVariableSubstitution)  // echo 只在没有变量替换时才转换
       );
 
       console.log(`[流式输出] 命令: ${command.substring(0, 50)}, 需要GBK转换: ${needsGbkConversion}`);

package/src/ui/server/routes/status.js

@@ -33,32 +33,31 @@ export function registerStatusRoutes({
   app.get('/api/status_porcelain', async (req, res) => {
     try {
       const { stdout } = await execGitCommand('git status --porcelain --untracked-files=all');
-      // 检测是否处于 MERGING 状态（MERGE_HEAD 文件存在）
+      // 检测是否处于 MERGING 状态（MERGE_HEAD 存在）
       let isMergeInProgress = false;
       let mergeMessage = '';
       try {
         const { stdout: mergeHead } = await execGitCommand('git rev-parse -q --verify MERGE_HEAD');
         isMergeInProgress = mergeHead.trim().length > 0;
-        if (isMergeInProgress) {
-          // 读取 Git 自动生成的合并提交信息
-          try {
-            const { stdout: gitDir } = await execGitCommand('git rev-parse --git-dir');
-            const mergeMsgPath = path.resolve(gitDir.trim(), 'MERGE_MSG');
-            const raw = await fs.readFile(mergeMsgPath, 'utf-8');
-            // 过滤掉以 # 开头的注释行，取第一个非空行
-            mergeMessage = raw
-              .split('\n')
-              .filter(line => line.trim() && !line.startsWith('#'))
-              .join('\n')
-              .trim();
-          } catch (_) {
-            // MERGE_MSG 不存在时忽略
-          }
-        }
       } catch (_) {
         // MERGE_HEAD 不存在时命令会报错，属正常情况
         isMergeInProgress = false;
       }
+      if (isMergeInProgress) {
+        try {
+          const { stdout: gitDir } = await execGitCommand('git rev-parse --git-dir');
+          const mergeMsgPath = path.resolve(gitDir.trim(), 'MERGE_MSG');
+          const raw = await fs.readFile(mergeMsgPath, 'utf-8');
+          // 过滤掉以 # 开头的注释行，拼接所有非空非注释行（保留多段信息如合并分支列表）
+          mergeMessage = raw
+            .split('\n')
+            .filter(line => line.trim() && !line.startsWith('#'))
+            .join('\n')
+            .trim();
+        } catch (_) {
+          // MERGE_MSG 不存在/无权限时忽略
+        }
+      }
       res.json({ status: stdout, isMergeInProgress, mergeMessage });
     } catch (error) {
       res.status(500).json({ error: error.message });

package/src/ui/server/routes/terminal.js

@@ -13,6 +13,7 @@
 // limitations under the License.
 //
 import { spawn, exec } from 'child_process';
+import { psEscape, appleEscape, shQuote } from '../utils/shellQuote.js';
 
 export function registerTerminalRoutes({
   app,
@@ -25,7 +26,6 @@ export function registerTerminalRoutes({
 
     if (process.platform === 'win32') {
       const cmdToRun = String(command || '').trim();
-      const safeWorkingDir = String(targetDir).replace(/"/g, '""');
 
       const splitArgs = (input) => {
         const s = String(input || '');
@@ -59,6 +59,7 @@ export function registerTerminalRoutes({
       const tokens = splitArgs(cmdToRun);
       const isStartCommand = tokens.length > 0 && String(tokens[0]).toLowerCase() === 'start';
 
+      // PowerShell 转义全部走 shellQuote.psEscape ($ ` " 都会被处理)
       let psScript;
       if (isStartCommand) {
         const args = tokens.slice(1);
@@ -69,19 +70,14 @@ export function registerTerminalRoutes({
         const exe = candidateExe && !isUrl(candidateExe) ? String(candidateExe) : null;
 
         if (!exe && candidateUrl) {
-          const safeUrl = String(candidateUrl).replace(/"/g, '""');
-          psScript = `$p = Start-Process -FilePath "${safeUrl}" -WorkingDirectory "${safeWorkingDir}" -PassThru; Write-Output $p.Id`;
+          psScript = `$p = Start-Process -FilePath "${psEscape(candidateUrl)}" -WorkingDirectory "${psEscape(targetDir)}" -PassThru; Write-Output $p.Id`;
         } else if (exe && candidateUrl) {
-          const safeExe = String(exe).replace(/"/g, '""');
-          const safeUrl = String(candidateUrl).replace(/"/g, '""');
-          psScript = `$p = Start-Process -FilePath "${safeExe}" -ArgumentList "${safeUrl}" -WorkingDirectory "${safeWorkingDir}" -PassThru; Write-Output $p.Id`;
+          psScript = `$p = Start-Process -FilePath "${psEscape(exe)}" -ArgumentList "${psEscape(candidateUrl)}" -WorkingDirectory "${psEscape(targetDir)}" -PassThru; Write-Output $p.Id`;
         } else {
-          const safeCmd = String(cmdToRun).replace(/"/g, '""');
-          psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/C", "${safeCmd}" -WorkingDirectory "${safeWorkingDir}" -WindowStyle Hidden -PassThru; Write-Output $p.Id`;
+          psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/C", "${psEscape(cmdToRun)}" -WorkingDirectory "${psEscape(targetDir)}" -WindowStyle Hidden -PassThru; Write-Output $p.Id`;
         }
       } else {
-        const safeCmd = String(cmdToRun).replace(/"/g, '""');
-        psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/K", "${safeCmd}" -WorkingDirectory "${safeWorkingDir}" -PassThru; Write-Output $p.Id`;
+        psScript = `$p = Start-Process -FilePath "cmd.exe" -ArgumentList "/K", "${psEscape(cmdToRun)}" -WorkingDirectory "${psEscape(targetDir)}" -PassThru; Write-Output $p.Id`;
       }
 
       return await new Promise((resolve, reject) => {
@@ -118,8 +114,10 @@ export function registerTerminalRoutes({
     }
 
     if (process.platform === 'darwin') {
-      const script = `tell application "Terminal" to do script "cd ${targetDir} && ${command.trim()}"`;
-      exec(`osascript -e '${script}'`, (error) => {
+      // AppleScript 转义统一走 shellQuote.appleEscape (\ " 都会被处理)
+      const script = `tell application "Terminal" to do script "cd ${appleEscape(targetDir)} && ${appleEscape(command.trim())}"`;
+      // 外层用单引号包,把脚本里可能出现的单引号转义为 '\''
+      exec(`osascript -e ${shQuote(script)}`, (error) => {
         if (error) {
           console.error('打开终端失败:', error);
         }
@@ -127,7 +125,8 @@ export function registerTerminalRoutes({
       return { pid: null };
     }
 
-    const terminalCommand = `gnome-terminal -- bash -c "cd ${targetDir} && ${command.trim()}; exec bash" || xterm -e "cd ${targetDir} && ${command.trim()}; bash"`;
+    // Linux: 用 sh 单引号包命令行,单引号内不解释 $ ` " \ ,只把单引号自身 '\''
+    const terminalCommand = `gnome-terminal -- bash -c ${shQuote(`cd ${targetDir} && ${command.trim()}; exec bash`)} || xterm -e ${shQuote(`cd ${targetDir} && ${command.trim()}; bash`)}`;
     exec(terminalCommand, (error) => {
       if (error) {
         console.error('打开终端失败:', error);

package/src/ui/server/routes/workbench.js

@@ -1070,20 +1070,35 @@ function launchClaudeInNewWindow(cwd, promptText, resumeSessionId) {
   });
 }
 
-// 顺序执行一个任务下所有子任务；上一个结束再启动下一个
-async function runTaskQueue(task, repoPath, branch) {
-  // 前序上下文：跑完一个 sub 后把它"完成态"摘要存到这里，下一个 sub 启动时
-  // 拼到 prompt 头部，让 Claude 知道前面做了什么、产出了什么。
-  // 故意不用 raw output 全文——LLM 已经习惯"摘要 + 关键结论"的格式，且不会
+/**
+ * 顺序执行一个任务下所有子任务；上一个结束再启动下一个。
+ * 入参 fromIndex 指定从哪个 sub 开始(0-based,默认 0),用于"从此处开始"入口;
+ * fromIndex>0 时,把 [0, fromIndex) 区间内已 done 的 sub 输出预填到 priorOutputs,
+ * 这样后续 sub 仍能拿到前序上下文(跟单 sub 执行的语义保持一致)。
+ */
+async function runTaskQueue(task, repoPath, branch, opts) {
+  // 前序上下文:跑完一个 sub 后把它"完成态"摘要存到这里,下一个 sub 启动时
+  // 拼到 prompt 头部,让 Claude 知道前面做了什么、产出了什么。
+  // 故意不用 raw output 全文——LLM 已经习惯"摘要 + 关键结论"的格式,且不会
   // 一次塞几 MB 进 prompt 烧 token。truncate 到每条 MAX_PREV_OUTPUT_CHARS。
   const MAX_PREV_OUTPUT_CHARS = 2000
-  const priorOutputs = []
-  for (const sub of task.subtasks) {
+  const requested = Number(opts && opts.fromIndex)
+  const fromIndex = Number.isInteger(requested) && requested >= 0 && requested < task.subtasks.length
+    ? requested
+    : 0
+  // 从 fromIndex 开始时,把前面已 done 的 sub 输出预填进 priorOutputs,
+  // 否则"从中间开始"会丢失前序上下文。
+  const priorOutputs = fromIndex > 0
+    ? await collectPriorOutputsUpTo(task, fromIndex)
+    : []
+  for (let i = fromIndex; i < task.subtasks.length; i++) {
+    const sub = task.subtasks[i]
     if (sub.status === 'done') continue;
     await runSingleSubtask(task, sub, repoPath, branch, priorOutputs)
+    // 逐 sub 落盘:之前只在队列跑完才 persistTaskAfterRun,中途崩溃会丢已完成
+    // sub 的状态。runSingleSubtask 已经把 sub.status 改完,这里补一次落盘。
+    await persistTaskAfterRun(task)
   }
-  // 写回 tasks.json
-  await persistTaskAfterRun(task)
 }
 
 /**
@@ -1324,11 +1339,19 @@ async function persistTaskAfterRun(task) {
  * 子任务输出摘要收集起来。这样单独跑一个 sub 时,它也能拿到前序上下文。
  */
 async function collectPriorOutputs(task, targetSub) {
+  const targetIdx = task.subtasks.findIndex(s => s.id === targetSub.id)
+  if (targetIdx < 0) return []
+  return collectPriorOutputsUpTo(task, targetIdx)
+}
+
+/**
+ * 收集 [0, endIdx) 区间内已 done 的 sub 输出摘要,作为队列内 sub 的前序上下文。
+ * runTaskQueue 在 fromIndex>0 时调这个,让"从此处开始"也能拼上前序 done sub 的结论。
+ */
+async function collectPriorOutputsUpTo(task, endIdx) {
   const MAX_PREV_OUTPUT_CHARS = 2000
   const prior = []
-  const targetIdx = task.subtasks.findIndex(s => s.id === targetSub.id)
-  if (targetIdx < 0) return prior
-  for (let i = 0; i < targetIdx; i++) {
+  for (let i = 0; i < endIdx; i++) {
     const s = task.subtasks[i]
     if (s.status !== 'done') continue
     // 从 jobs 列表里找最近一个属于这个 sub 且 status=done 的 job,
@@ -2305,6 +2328,40 @@ ${desc ? `描述：${desc}` : '描述：（无）'}${attachmentBlock}${templateB
     }
   });
 
+  // ── 从指定子任务开始执行 ───────────────────────────────────────────
+  // POST /api/workbench/tasks/:id/run-from
+  // 入参 body: { startSubIndex: number }
+  // 行为:
+  //   - 从 task.subtasks[startSubIndex] 开始按序执行,前面 [0, startSubIndex) 区间的
+  //     done sub 输出会自动作为前序上下文(同单 sub 执行的语义)
+  //   - 前面 error / running 的 sub 不会被自动重跑;从 startSubIndex 开始重新走队列
+  //   - 适合"中间某个 sub 失败/被取消后,从该 sub 继续"的场景
+  //   - startSubIndex 必须落在 [0, task.subtasks.length) 范围内
+  app.post('/api/workbench/tasks/:id/run-from', async (req, res) => {
+    try {
+      const data = await readJson(TASKS_FILE, { tasks: [] });
+      const task = (data.tasks || []).find(t => t.id === req.params.id);
+      if (!task) return res.status(404).json({ success: false, error: '任务不存在' });
+      if (!task.subtasks || task.subtasks.length === 0) {
+        return res.status(400).json({ success: false, error: '任务没有子任务' });
+      }
+      const startSubIndex = Number(req.body?.startSubIndex);
+      if (!Number.isInteger(startSubIndex)
+        || startSubIndex < 0
+        || startSubIndex >= task.subtasks.length) {
+        return res.status(400).json({ success: false, error: 'startSubIndex 越界' });
+      }
+      const repoPath = typeof getCurrentProjectPath === 'function' ? getCurrentProjectPath() : '';
+      // 异步执行,立即返回(同 /run 的 fire-and-forget 模式)
+      res.json({ success: true, message: `已从第 ${startSubIndex + 1} 个子任务开始执行` });
+      runTaskQueue(task, repoPath, '', { fromIndex: startSubIndex }).catch(err => {
+        publish('task:error', { taskId: task.id, error: err.message });
+      });
+    } catch (err) {
+      res.status(500).json({ success: false, error: err.message });
+    }
+  });
+
   // ── 执行简单任务（无子任务直接跑） ──────────────────────────────────
   // POST /api/workbench/tasks/:id/run-simple
   // 行为：
@@ -2672,6 +2729,199 @@ ${desc ? `描述：${desc}` : '描述：（无）'}${attachmentBlock}${templateB
     }
   })
 
+  // POST /api/workbench/tasks/:id/clear-execution
+  // 一次性清空指定 task 的所有执行痕迹:
+  //   1. 删除内存 + 磁盘 jobs.json 中该 task 的全部 job(跳过 running/pending)
+  //   2. 把 tasks.json 中该 task 的所有 subtasks status 重置为 'todo'(让"重新执行"能从头跑)
+  //   3. 同步清掉 sub 的 error 字段,broadcast task:update + 一组 sub:update
+  // 任务描述、附件、提示词模板等"内容"字段保留不动——只清"执行痕迹"。
+  // 活跃态(有 running/pending job)时拒绝,避免误杀正在跑的实例。
+  app.post('/api/workbench/tasks/:id/clear-execution', async (req, res) => {
+    try {
+      const taskId = req.params.id
+      if (!taskId) return res.status(400).json({ success: false, error: '缺少 taskId' })
+      // 检查活跃 job
+      const live = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        if (j.status === 'running' || j.status === 'pending') live.push(j.id)
+      }
+      if (live.length > 0) {
+        return res.status(400).json({ success: false, error: `有 ${live.length} 个 job 正在执行,请先停止` })
+      }
+      // 1) 清空 jobs(内存 + 磁盘)
+      const removedJobIds = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        jobs.delete(j.id)
+        removedJobIds.push(j.id)
+      }
+      const jobsData = await readJson(JOBS_FILE, { version: 1, jobs: [] })
+      if (jobsData && Array.isArray(jobsData.jobs)) {
+        const before = jobsData.jobs.length
+        jobsData.jobs = jobsData.jobs.filter(j => j.taskId !== taskId)
+        if (jobsData.jobs.length !== before) await writeJson(JOBS_FILE, jobsData)
+      }
+      // 2) 重置 subtasks.status → todo
+      const tasksData = await readJson(TASKS_FILE, { tasks: [] })
+      const task = (tasksData.tasks || []).find(t => t.id === taskId)
+      if (!task) {
+        return res.json({ success: true, removedJobs: removedJobIds.length, resetSubs: 0, message: '任务不存在,仅清空 job' })
+      }
+      let resetSubs = 0
+      if (Array.isArray(task.subtasks)) {
+        for (const s of task.subtasks) {
+          if (s.status !== 'todo') {
+            s.status = 'todo'
+            resetSubs++
+            if (s.error) delete s.error
+            publish('sub:update', { taskId, sub: s })
+          }
+        }
+        task.updatedAt = nowIso()
+        await writeJson(TASKS_FILE, tasksData)
+        publish('task:update', task)
+      }
+      res.json({
+        success: true,
+        removedJobs: removedJobIds.length,
+        resetSubs,
+        message: `已清空 ${removedJobIds.length} 条执行记录,${resetSubs} 个子任务重置为待执行`
+      })
+    } catch (err) {
+      res.status(500).json({ success: false, error: '清空执行痕迹失败: ' + (err.message || String(err)) })
+    }
+  })
+
+  // POST /api/workbench/tasks/:id/reset-shell
+  // 把 task 还原成"只有标题的空壳",清掉 desc / attachments / promptId / subtasks。
+  // 与 clear-execution 的区别:
+  //   - clear-execution 只重置 sub.status + 清 jobs(保留拆分/描述/附件)
+  //   - reset-shell 直接删除 subtasks 数组和描述/附件,任务只剩标题
+  // 同时清空该 task 的所有 job(沿用 by-task 删除语义,跳过 running/pending)。
+  // 活跃态拒绝,避免误杀正在跑的实例。
+  app.post('/api/workbench/tasks/:id/reset-shell', async (req, res) => {
+    try {
+      const taskId = req.params.id
+      if (!taskId) return res.status(400).json({ success: false, error: '缺少 taskId' })
+      // 检查活跃 job
+      const live = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        if (j.status === 'running' || j.status === 'pending') live.push(j.id)
+      }
+      if (live.length > 0) {
+        return res.status(400).json({ success: false, error: `有 ${live.length} 个 job 正在执行,请先停止` })
+      }
+      // 1) 清空 jobs(内存 + 磁盘)
+      const removedJobIds = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        jobs.delete(j.id)
+        removedJobIds.push(j.id)
+      }
+      const jobsData = await readJson(JOBS_FILE, { version: 1, jobs: [] })
+      if (jobsData && Array.isArray(jobsData.jobs)) {
+        const before = jobsData.jobs.length
+        jobsData.jobs = jobsData.jobs.filter(j => j.taskId !== taskId)
+        if (jobsData.jobs.length !== before) await writeJson(JOBS_FILE, jobsData)
+      }
+      // 2) 重置 task 字段:只留 id / title / createdAt / status / projectPath(如存在)
+      const tasksData = await readJson(TASKS_FILE, { tasks: [] })
+      const task = (tasksData.tasks || []).find(t => t.id === taskId)
+      if (!task) {
+        return res.json({ success: true, removedJobs: removedJobIds.length, message: '任务不存在,仅清空 job' })
+      }
+      const removedSubCount = Array.isArray(task.subtasks) ? task.subtasks.length : 0
+      const removedAttCount = Array.isArray(task.attachments) ? task.attachments.length : 0
+      const hadDesc = !!(task.desc && task.desc.length > 0)
+      const hadPrompt = !!task.promptId
+      // 保留字段:id / title / createdAt / status / projectPath
+      // 清理:desc / attachments / promptId / subtasks
+      const preservedProjectPath = task.projectPath
+      const preservedCreatedAt = task.createdAt
+      const preservedStatus = task.status || 'todo'
+      // 重建对象(顺序保留 title 在前,符合视觉习惯)
+      const newTask = { id: task.id, title: task.title, status: preservedStatus }
+      if (preservedProjectPath) newTask.projectPath = preservedProjectPath
+      if (preservedCreatedAt) newTask.createdAt = preservedCreatedAt
+      newTask.subtasks = []
+      newTask.attachments = []
+      newTask.updatedAt = nowIso()
+      // 用 Object.assign 替换 task 的所有自身属性,保留原型链
+      for (const k of Object.keys(task)) delete task[k]
+      Object.assign(task, newTask)
+      await writeJson(TASKS_FILE, tasksData)
+      publish('task:update', task)
+      res.json({
+        success: true,
+        removedJobs: removedJobIds.length,
+        removedSubs: removedSubCount,
+        removedAttachments: removedAttCount,
+        clearedDesc: hadDesc,
+        clearedPrompt: hadPrompt,
+        message: `已清空:删除 ${removedSubCount} 个子任务${removedAttCount ? '、' + removedAttCount + ' 个附件' : ''}${hadDesc ? '、任务描述' : ''},任务标题保留`
+      })
+    } catch (err) {
+      res.status(500).json({ success: false, error: '清空任务内容失败: ' + (err.message || String(err)) })
+    }
+  })
+
+  // POST /api/workbench/tasks/:id/clear-subtasks
+  // 只清空 subtasks 数组(及关联的 jobs),保留 desc / attachments / promptId / projectPath。
+  // 与 reset-shell 的区别:reset-shell 把任务还原成只有标题的空壳,这个只删拆分结果。
+  // 活跃 job 拒绝,避免误杀正在跑的实例。
+  app.post('/api/workbench/tasks/:id/clear-subtasks', async (req, res) => {
+    try {
+      const taskId = req.params.id
+      if (!taskId) return res.status(400).json({ success: false, error: '缺少 taskId' })
+      // 1) 检查活跃 job
+      const live = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        if (j.status === 'running' || j.status === 'pending') live.push(j.id)
+      }
+      if (live.length > 0) {
+        return res.status(400).json({ success: false, error: `有 ${live.length} 个 job 正在执行,请先停止` })
+      }
+      // 2) 清空该 task 的所有 jobs(内存 + 磁盘)
+      const removedJobIds = []
+      for (const j of jobs.values()) {
+        if (j.taskId !== taskId) continue
+        jobs.delete(j.id)
+        removedJobIds.push(j.id)
+      }
+      const jobsData = await readJson(JOBS_FILE, { version: 1, jobs: [] })
+      if (jobsData && Array.isArray(jobsData.jobs)) {
+        const before = jobsData.jobs.length
+        jobsData.jobs = jobsData.jobs.filter(j => j.taskId !== taskId)
+        if (jobsData.jobs.length !== before) await writeJson(JOBS_FILE, jobsData)
+      }
+      // 3) 更新 task:只清 subtasks,其他字段(尤其 desc / attachments / promptId)保留
+      const tasksData = await readJson(TASKS_FILE, { tasks: [] })
+      const task = (tasksData.tasks || []).find(t => t.id === taskId)
+      if (!task) {
+        return res.json({ success: true, removedJobs: removedJobIds.length, removedSubs: 0, message: '任务不存在,仅清空 job' })
+      }
+      const removedSubCount = Array.isArray(task.subtasks) ? task.subtasks.length : 0
+      if (removedSubCount === 0) {
+        return res.json({ success: true, removedJobs: removedJobIds.length, removedSubs: 0, message: '没有子任务需要清空' })
+      }
+      task.subtasks = []
+      task.updatedAt = nowIso()
+      await writeJson(TASKS_FILE, tasksData)
+      publish('task:update', task)
+      res.json({
+        success: true,
+        removedJobs: removedJobIds.length,
+        removedSubs: removedSubCount,
+        message: `已清空 ${removedSubCount} 个子任务,任务描述和附件保留`
+      })
+    } catch (err) {
+      res.status(500).json({ success: false, error: '清空子任务失败: ' + (err.message || String(err)) })
+    }
+  })
+
   // GET /api/workbench/jobs/:id
   app.get('/api/workbench/jobs/:id', async (req, res) => {
     try {

package/src/ui/server/utils/shellQuote.js

@@ -0,0 +1,68 @@
+// Copyright 2026 xz333221
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+/**
+ * Shell / PowerShell 字符串转义工具
+ *
+ * 提供三种转义策略:
+ *   - shQuote: POSIX shell 单引号包字符串（git add / osascript / gnome-terminal 用）
+ *   - psEscape: PowerShell 双引号内安全转义（terminal.js 的 PowerShell 脚本用）
+ *   - appleEscape: AppleScript 双引号字符串内安全转义（macOS 终端用）
+ *
+ * 三种都不依赖外部包，纯字符串操作。
+ *
+ * @typedef {string | number | null | undefined} ShellInput
+ */
+
+/**
+ * POSIX shell 单引号包裹
+ * 单引号内不解释 $ ` " \,只把单引号自身转义为 '\''
+ * 例: shQuote('a"b$c') === "'a\"b$c'"
+ *
+ * @param {ShellInput} input
+ * @returns {string}
+ */
+export function shQuote(input) {
+  if (input === null || input === undefined) return "''"
+  return `'${String(input).replace(/'/g, `'\\''`)}'`
+}
+
+/**
+ * PowerShell 双引号字符串内安全转义
+ * 需要把 $ (变量/子表达式) 和 ` (子表达式) 各自前置一个反引号
+ * 双引号本身用 "" 转义;反引号自身先用 `` 转义避免吃掉后续转义
+ *
+ * @param {ShellInput} input
+ * @returns {string}
+ */
+export function psEscape(input) {
+  if (input === null || input === undefined) return '""'
+  return String(input)
+    .replace(/`/g, '``')
+    .replace(/\$/g, '`$')
+    .replace(/"/g, '""')
+}
+
+/**
+ * AppleScript 双引号字符串内安全转义
+ * 反斜杠和双引号都需要前置反斜杠
+ *
+ * @param {ShellInput} input
+ * @returns {string}
+ */
+export function appleEscape(input) {
+  if (input === null || input === undefined) return '""'
+  return String(input).replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}

package/src/ui/server/utils/shellQuote.test.js

@@ -0,0 +1,110 @@
+// Copyright 2026 xz333221
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// shellQuote 单元测试（node:test 内置）
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { shQuote, psEscape, appleEscape } from '../utils/shellQuote.js'
+
+test('shQuote 普通字符串', () => {
+  assert.equal(shQuote('hello'), "'hello'")
+})
+
+test('shQuote 单引号需要转义', () => {
+  // POSIX shell: 单引号字符串里唯一需要处理的就是单引号自身
+  // 关闭单引号 + 转义 + 开启单引号 = '\''
+  assert.equal(shQuote("a'b"), "'a'\\''b'")
+})
+
+test('shQuote 注入字符也能合法包裹', () => {
+  // POSIX shell 单引号内 $ ` " \ 都不展开,所以原样包住就是安全的
+  // 函数职责只保证产出一个语法合法的单引号字符串
+  const evil = '$(rm -rf /); `whoami` "$PATH" \\path'
+  const quoted = shQuote(evil)
+  // 必须以单引号开头和结尾,内部任何单引号都被 '\'' 转义
+  assert.ok(quoted.startsWith("'"))
+  assert.ok(quoted.endsWith("'"))
+  // 内部裸的单引号不会破坏字符串:
+  // 统计未配对的单引号数量,被正确转义的 ' 必须成对出现 '\''
+  // 这里因为输入不含单引号,所以 quoted 形如 '<evil>'
+  assert.equal(quoted.length, evil.length + 2)
+})
+
+test('shQuote null / undefined / number 都安全', () => {
+  assert.equal(shQuote(null), "''")
+  assert.equal(shQuote(undefined), "''")
+  assert.equal(shQuote(42), "'42'")
+})
+
+test('shQuote 文件名场景:含空格和双引号', () => {
+  // 模拟 git status --porcelain 解出的文件名
+  assert.equal(shQuote('my file.txt'), "'my file.txt'")
+  assert.equal(shQuote('a"b.txt'), `'a"b.txt'`)
+})
+
+test('psEscape $ 变量必须前置反引号', () => {
+  // 原: $(rm -rf /)  → 期望:  `$(rm -rf /)
+  // （PowerShell 双引号内 $ 会触发子表达式求值,前置 ` 取消求值）
+  assert.equal(psEscape('$(rm -rf /)'), '`$(rm -rf /)')
+})
+
+test('psEscape 反引号自身先转义', () => {
+  // 反引号是 PowerShell 转义符,先自身转义避免吃掉后续的转义符
+  // 原: `n  → 期望: ``n
+  assert.equal(psEscape('`n'), '``n')
+  // 原: $`n (3 字符) → 期望: `$``n (5 字符: ` $ ` ` n)
+  //   反引号先转:  $``n (4)  →  然后 $ 前置: `$``n (5)
+  assert.equal(psEscape('$`n'), '`$``n')
+})
+
+test('psEscape 双引号用 "" 转义', () => {
+  assert.equal(psEscape('a"b'), 'a""b')
+})
+
+test('psEscape 普通字符串不变', () => {
+  assert.equal(psEscape('hello world'), 'hello world')
+})
+
+test('psEscape null / undefined → 空字符串', () => {
+  assert.equal(psEscape(null), '""')
+  assert.equal(psEscape(undefined), '""')
+})
+
+test('psEscape 工作目录路径 (Windows 含反斜杠和 $)', () => {
+  // PowerShell 里 $env:TEMP 是变量; $ 开头的路径是注入面
+  const path = '$env:TEMP\\evil$(rm).txt'
+  const escaped = psEscape(path)
+  // 所有 $ 必须前置反引号
+  assert.ok(!escaped.match(/(?<!`)\$/), '不应有未转义的 $')
+  assert.ok(escaped.includes('`$env:'))
+  assert.ok(escaped.includes('`$(rm)'))
+})
+
+test('appleEscape 双引号前置反斜杠', () => {
+  assert.equal(appleEscape('a"b'), 'a\\"b')
+})
+
+test('appleEscape 反斜杠先转义', () => {
+  // 反斜杠要双写避免吃掉后面的 "
+  assert.equal(appleEscape('a\\"b'), 'a\\\\\\"b')
+})
+
+test('appleEscape 普通字符串不变', () => {
+  assert.equal(appleEscape('cd /tmp && ls'), 'cd /tmp && ls')
+})
+
+test('appleEscape null / undefined → 空字符串', () => {
+  assert.equal(appleEscape(null), '""')
+  assert.equal(appleEscape(undefined), '""')
+})