zen-gitsync 2.17.15 → 2.17.17

package/src/ui/public/index.html

@@ -5,41 +5,42 @@
     <meta name="google" content="notranslate" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <!-- 浏览器 chrome 配色与页面背景对齐（浅色 --bg-page / 深色 --bg-page-dark） -->
+    <meta name="theme-color" content="#f0f2f5" />
+    <meta name="theme-color" content="#141820" media="(prefers-color-scheme: dark)" />
     <title>Zen GitSync</title>
-    <!-- Premium fonts: Plus Jakarta Sans (UI) + JetBrains Mono (code) -->
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,400&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-gpuX9fhG.js"></script>
+    <!-- 字体改为自托管(@font-face 见 src/main.css),不再依赖 Google Fonts 外链 -->
+    <script type="module" crossorigin src="/assets/index-Di5cimoI.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
-    <link rel="modulepreload" crossorigin href="/assets/element-plus-DxBPQwL7.js">
+    <link rel="modulepreload" crossorigin href="/assets/element-plus-D7LDHcAn.js">
     <link rel="modulepreload" crossorigin href="/assets/monaco-BScz9v63.js">
-    <link rel="modulepreload" crossorigin href="/assets/vendor-IQQMq-1c.js">
-    <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-B1mHBne9.js">
-    <link rel="modulepreload" crossorigin href="/assets/SvgIcon-yefEMV0-.js">
-    <link rel="modulepreload" crossorigin href="/assets/IconButton-DcOAqpq0.js">
-    <link rel="modulepreload" crossorigin href="/assets/configStore-BDxel6Co.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-CLmPUj3K.js">
+    <link rel="modulepreload" crossorigin href="/assets/_plugin-vue_export-helper-BLGowG5t.js">
+    <link rel="modulepreload" crossorigin href="/assets/SvgIcon-Bkc_oGUI.js">
+    <link rel="modulepreload" crossorigin href="/assets/IconButton-BEiZI4F6.js">
+    <link rel="modulepreload" crossorigin href="/assets/configStore-BUXv5i5j.js">
     <link rel="modulepreload" crossorigin href="/assets/socket-io-BFqQXqAp.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitStore-D5CWxPLv.js">
-    <link rel="modulepreload" crossorigin href="/assets/useThemeObserver-E7Hk50l3.js">
-    <link rel="modulepreload" crossorigin href="/assets/flow-mindmap-BqFb1WO5.js">
-    <link rel="modulepreload" crossorigin href="/assets/previewSandbox-qLKxghfr.js">
-    <link rel="modulepreload" crossorigin href="/assets/FileDiffViewer-C4xxq5S0.js">
-    <link rel="modulepreload" crossorigin href="/assets/CommonDialog-B_qUsIGr.js">
-    <link rel="modulepreload" crossorigin href="/assets/TemplateManager-CCy_WcSK.js">
-    <link rel="modulepreload" crossorigin href="/assets/vue-flow-fLUQ0_kE.js">
-    <link rel="stylesheet" crossorigin href="/assets/element-plus-Cwwq-Gje.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitStore-BGbEYd0U.js">
+    <link rel="modulepreload" crossorigin href="/assets/useThemeObserver-QpveGpnn.js">
+    <link rel="modulepreload" crossorigin href="/assets/flow-mindmap-zXXF3qDh.js">
+    <link rel="modulepreload" crossorigin href="/assets/previewSandbox-DEQpyVNu.js">
+    <link rel="modulepreload" crossorigin href="/assets/CommonDialog-CecgvEzd.js">
+    <link rel="modulepreload" crossorigin href="/assets/FileDiffViewer-DH8Y2lUO.js">
+    <link rel="modulepreload" crossorigin href="/assets/toolsStore-DMCSd287.js">
+    <link rel="modulepreload" crossorigin href="/assets/TemplateManager-9e4amMlI.js">
+    <link rel="modulepreload" crossorigin href="/assets/vue-flow-CxnoC7Uq.js">
+    <link rel="stylesheet" crossorigin href="/assets/element-plus-C1xzgNSR.css">
     <link rel="stylesheet" crossorigin href="/assets/monaco-B2lPvkrc.css">
-    <link rel="stylesheet" crossorigin href="/assets/vendor-C5qX_I8r.css">
+    <link rel="stylesheet" crossorigin href="/assets/vendor-C-GCxMMu.css">
     <link rel="stylesheet" crossorigin href="/assets/SvgIcon-CDNsk4-Q.css">
-    <link rel="stylesheet" crossorigin href="/assets/IconButton-tjkOjzkC.css">
+    <link rel="stylesheet" crossorigin href="/assets/IconButton-RlXqKOeu.css">
     <link rel="stylesheet" crossorigin href="/assets/flow-mindmap-DnzM9SlK.css">
-    <link rel="stylesheet" crossorigin href="/assets/previewSandbox-CgdwPcuW.css">
-    <link rel="stylesheet" crossorigin href="/assets/FileDiffViewer-B9EkuKdF.css">
-    <link rel="stylesheet" crossorigin href="/assets/CommonDialog-jP0E9mco.css">
-    <link rel="stylesheet" crossorigin href="/assets/TemplateManager-DMuG4i3G.css">
+    <link rel="stylesheet" crossorigin href="/assets/previewSandbox-CxLaNg4X.css">
+    <link rel="stylesheet" crossorigin href="/assets/CommonDialog-w6EmBEXv.css">
+    <link rel="stylesheet" crossorigin href="/assets/FileDiffViewer-n5ea9qMe.css">
+    <link rel="stylesheet" crossorigin href="/assets/TemplateManager-DO7EPfj8.css">
     <link rel="stylesheet" crossorigin href="/assets/vue-flow-CavUTEzp.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-CmbatbSR.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-DIU5200G.css">
   </head>
   <body>
     <div id="app"></div>

package/src/ui/server/routes/workbench/agentChat.js

@@ -24,14 +24,13 @@
 //   - { type: 'tool_call_start', toolCallId, name, argsPreview }
 //   - { type: 'tool_output', toolCallId, chunk }       — 命令执行中的增量输出(仅展示)
 //   - { type: 'tool_result', toolCallId, name, result }
-//   - { type: 'ask_user', interactionId, question, options, allowFreeText }
+//   - { type: 'ask_user', interactionId, question, options, allowFreeText, multiple }
 //   - { type: 'done', content }            — 本轮最终完成
 //   - { type: 'error', error }
 
 import path from 'path';
 import os from 'os';
 import { logger } from './shared.js';
-import { agentSessionStore } from './agentSessionStore.js';
 
 // 从 CLI 侧导入工具定义、执行器与 LLM 传输层（同一 monorepo，路径可达）
 import { TOOL_DEFINITIONS, executeTool } from '../../../../cli/ai/tools.js';
@@ -135,6 +134,7 @@ ${isWin ? `- 当前是 Windows,以下 Unix 命令**不存在**,用了必定报"
 # 与用户交互
 - 需要向用户确认、提问或汇报重要决策时,直接用普通文本输出
 - 需要暂停当前任务并等待用户决定或补充信息时,调用 ask_user,不要猜测或只在普通文本里提问
+- 一次要让用户从多个选项里选好几项时(如"要我改哪几个文件"),传 multiple: true,用户会勾选后统一提交
 - 不要调用不存在的工具,可用工具只有上面列出的 ${builtinToolCount} 个
 - 用户可能随消息附带图片:图片以 image_url 部件出现在 user 消息里;如果当前模型不支持视觉(带图请求报错),提醒用户换用支持视觉的模型
 - 发现高风险或状态不一致的情况时:先用文本说明发现和影响,停下来等用户指示,不要擅自继续破坏性操作
@@ -205,7 +205,7 @@ ${isWin ? `- This is Windows. The following Unix commands do NOT exist here:
 
 # How you work
 - Act first, ask later: use tools to investigate before asking the user
-- When a decision or missing detail must come from the user, call ask_user. Do not guess or merely describe a question in plain text.
+- When a decision or missing detail must come from the user, call ask_user. Do not guess or merely describe a question in plain text. Pass multiple: true when the user should pick several options at once.
 - After modifying code, verify: run tests, build, or at least syntax check
 - Prefer edit_file for precise replacements; read_file first to confirm original text
 - Use offset/limit for large files
@@ -241,6 +241,9 @@ ${isWin ? `- This is Windows. The following Unix commands do NOT exist here:
 //   - model: { baseURL, model, apiKey }
 //   - userMessage: 用户输入文本
 //   - images: base64 dataURL 数组(可选,多模态图片,随最新一条 user 消息发给模型)
+//   - openFilePath: 文件空间里当前打开的文档(可选,注入请求副本,不落库)
+//   - attachments: 非图片附件(可选) = [{ name, path }],path 是**服务端落盘后的绝对路径**,
+//     只把路径写进请求副本的 system 提示,内容由模型自己用工具读(见 utils/agentAttachments.js)
 //   - cwd: 工作目录
 //   - locale: 'zh' | 'en'
 //   - signal: AbortSignal (客户端断开时触发)
@@ -251,7 +254,7 @@ ${isWin ? `- This is Windows. The following Unix commands do NOT exist here:
 //     (由 agentRoutes 注入:最近目录/tasks.json/看板统计只有 GUI 侧拿得到)
 //
 // 返回: { aborted: boolean }
-export async function runAgentTurn({ session, model, userMessage, images = [], cwd, locale, signal, send, onChild, askUser, listProjects }) {
+export async function runAgentTurn({ session, model, userMessage, images = [], cwd, locale, openFilePath, attachments = [], signal, send, onChild, askUser, listProjects }) {
   const ctx = { cwd, locale, onChild, askUser, listProjects };
 
   // 确保 session.messages 存在
@@ -283,6 +286,8 @@ export async function runAgentTurn({ session, model, userMessage, images = [], c
     // 摘录成一条梗概 → 旧图片降级 → provider 兼容消毒。
     // 只作用于副本,session.messages 保持完整(与 CLI 的磁盘口径一致)。
     const messages = prepareRequestMessages(session.messages, { locale });
+    // 请求级上下文：当前打开的文档 + 本轮附件路径（只改副本，不落 session.messages，下一轮不重复累积）
+    injectRequestContext(messages, { cwd, openFilePath, attachments, locale });
 
     let result;
     try {
@@ -305,14 +310,6 @@ export async function runAgentTurn({ session, model, userMessage, images = [], c
       return { aborted: false };
     }
 
-    if (result.aborted) {
-      // 保存当前会话状态
-      session.updatedAt = new Date().toISOString();
-      await agentSessionStore.write(session.sessionId, session).catch(() => {});
-      send({ type: 'error', error: '已取消' });
-      return { aborted: true };
-    }
-
     const { content, toolCalls } = result;
 
     // 推理内容必须原样带回历史。DeepSeek 系 thinking 模式下带 tool_calls 的 assistant
@@ -321,6 +318,18 @@ export async function runAgentTurn({ session, model, userMessage, images = [], c
     // 口径与 CLI 侧 src/cli/ai/turn.js 的 assistant.reasoning_content 保持一致。
     const withReasoning = msg => (result.reasoning ? { ...msg, reasoning_content: result.reasoning } : msg);
 
+    if (result.aborted) {
+      // 用户点了"停止"：把已经流出来的部分正文补进历史，否则磁盘上这一轮只剩一条
+      // user 消息，重新打开会话时刚才生成的内容会整段丢失。
+      // 半截的 tool_calls 已被 transport 在中止时丢弃，这里只补正文，不会有悬空引用。
+      // 落盘由路由层统一负责（中止的轮次同样要写，见 agentRoutes.js）。
+      if (content) {
+        session.messages.push(withReasoning({ role: 'assistant', content }));
+      }
+      send({ type: 'error', error: '已取消' });
+      return { aborted: true };
+    }
+
     // 无工具调用：本轮结束
     if (toolCalls.length === 0) {
       session.messages.push(withReasoning({ role: 'assistant', content: content || null }));
@@ -408,4 +417,52 @@ function summarizeArgs(name, args) {
   }
 }
 
+// ── 请求级上下文注入（文件空间对话 / 本轮附件） ──────────────
+// 把"用户当前打开的文件"与"本轮附件的落盘路径"追加到**请求副本**的 system 消息末尾：
+// 只影响这一次请求，session.messages 与磁盘历史保持原样，下一轮也不会重复累积。
+//
+// 附件为什么只给路径、不给内容：见 utils/agentAttachments.js 的头注释 —— 非图片附件
+// 由服务端落盘，模型自己用 read / grep 按需取，比把几百 KB 文本内联进消息省得多。
+export function injectRequestContext(messages, { cwd, openFilePath, attachments = [], locale }) {
+  if (!Array.isArray(messages)) return;
+  const en = String(locale || '').startsWith('en');
+
+  const parts = [];
+
+  // ① 当前打开的文档（文件空间对话才有；项目外或等于根目录直接忽略）
+  if (openFilePath) {
+    const root = cwd || process.cwd();
+    let rel = '';
+    try {
+      rel = path.relative(root, path.resolve(root, openFilePath));
+    } catch {
+      rel = '';
+    }
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {
+      const file = rel.split(path.sep).join('/');
+      parts.push(en
+        ? `The file the user currently has open in the editor is \`${file}\` (relative to the project root). When the user says "this file" / "the current file" / "here", that is what they mean; read it with your tools before assuming its content.`
+        : `用户此刻在文件空间打开的文件是 \`${file}\`（相对项目根目录）。用户说"这个文件/当前文件"时默认指它；请先用工具读取内容，不要臆测。`);
+    }
+  }
+
+  // ② 本轮附件：只给绝对路径，内容让模型自己去读
+  const files = (Array.isArray(attachments) ? attachments : [])
+    .filter(a => a && typeof a.path === 'string' && a.path)
+    .slice(0, 20);
+  if (files.length > 0) {
+    const lines = files.map(a => `- \`${a.path}\`${a.name && a.name !== path.basename(a.path) ? ` (${a.name})` : ''}`);
+    parts.push(en
+      ? `The user attached ${files.length} file(s) this turn; they were saved to these absolute paths:\n${lines.join('\n')}\nRead them with your tools when relevant (they are NOT inlined here). Do not guess their contents.`
+      : `用户本轮附带了 ${files.length} 个文件，已保存到以下绝对路径：\n${lines.join('\n')}\n需要时用工具读取（内容没有内联在这里），不要臆测。`);
+  }
+
+  if (parts.length === 0) return;
+
+  const note = `\n\n# ${en ? 'Current context' : '当前上下文'}\n${parts.join('\n\n')}`;
+  const sys = messages.find(m => m && m.role === 'system' && typeof m.content === 'string');
+  if (sys) sys.content += note;
+  else messages.unshift({ role: 'system', content: note.trim() });
+}
+
 export { buildWebSystemPrompt };

package/src/ui/server/routes/workbench/agentChatContext.test.js

@@ -0,0 +1,106 @@
+// injectRequestContext：把"当前打开的文档"与"本轮附件路径"注进**请求副本**。
+// 关键口径：只改请求副本、不碰 session.messages；越界路径忽略；下一轮不会重复累积；
+// 附件只给绝对路径、不给内容（内容由模型自己用 read / grep 取）。
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import path from 'node:path'
+import { injectRequestContext } from './agentChat.js'
+
+const ROOT = path.resolve('C:/proj')
+
+test('injectRequestContext: 相对项目根的斜杠路径追加进 system 消息', () => {
+  const messages = [
+    { role: 'system', content: 'rules' },
+    { role: 'user', content: 'hi' }
+  ]
+  injectRequestContext(messages, { cwd: ROOT, openFilePath: path.join(ROOT, 'src', 'a.md'), locale: 'zh' })
+  assert.match(messages[0].content, /^rules\n\n# 当前上下文/)
+  assert.match(messages[0].content, /src\/a\.md/)
+  assert.equal(messages[1].content, 'hi', '其它消息不受影响')
+})
+
+test('injectRequestContext: 项目外路径 / 空值一律忽略', () => {
+  const outside = [{ role: 'system', content: 'rules' }]
+  injectRequestContext(outside, { cwd: ROOT, openFilePath: 'D:/other/x.md', locale: 'zh' })
+  assert.equal(outside[0].content, 'rules', '项目外路径不注入')
+
+  const none = [{ role: 'system', content: 'rules' }]
+  injectRequestContext(none, { cwd: ROOT, openFilePath: '', locale: 'zh' })
+  assert.equal(none[0].content, 'rules', '没传 openFilePath 时不动消息')
+})
+
+test('injectRequestContext: 没有 system 消息时补一条，英文 locale 用英文说明', () => {
+  const messages = [{ role: 'user', content: 'hi' }]
+  injectRequestContext(messages, { cwd: ROOT, openFilePath: 'README.md', locale: 'en' })
+  assert.equal(messages.length, 2)
+  assert.equal(messages[0].role, 'system')
+  assert.match(messages[0].content, /README\.md/)
+  assert.match(messages[0].content, /Current context/)
+})
+
+test('injectRequestContext: 每轮都基于副本重新注入，不会重复累积', () => {
+  const session = [{ role: 'system', content: 'rules' }]
+  const first = session.map(m => ({ ...m }))
+  const second = session.map(m => ({ ...m }))
+  injectRequestContext(first, { cwd: ROOT, openFilePath: 'a.md', locale: 'zh' })
+  injectRequestContext(second, { cwd: ROOT, openFilePath: 'a.md', locale: 'zh' })
+  assert.equal(session[0].content, 'rules', '原始会话记录保持干净')
+  assert.equal((first[0].content.match(/# 当前上下文/g) || []).length, 1)
+  assert.equal((second[0].content.match(/# 当前上下文/g) || []).length, 1)
+})
+
+test('injectRequestContext: 附件只注入绝对路径,内容不进消息体', () => {
+  const messages = [{ role: 'system', content: 'rules' }, { role: 'user', content: '看下这个日志' }]
+  injectRequestContext(messages, {
+    cwd: ROOT,
+    locale: 'zh',
+    attachments: [
+      { name: '错误日志.log', path: 'C:\\Users\\x\\.zen-gitsync\\agent-attachments\\20260927-193000-ab12\\错误日志.log' }
+    ]
+  })
+  assert.match(messages[0].content, /^rules\n\n# 当前上下文/)
+  assert.match(messages[0].content, /用户本轮附带了 1 个文件/)
+  assert.match(messages[0].content, /agent-attachments.+错误日志\.log/)
+  assert.match(messages[0].content, /不要臆测/)
+  // 消息体本身没有任何文件内容
+  assert.equal(messages[1].content, '看下这个日志')
+})
+
+test('injectRequestContext: 文档 + 附件可以同时注入,各成一段', () => {
+  const messages = [{ role: 'system', content: 'rules' }]
+  injectRequestContext(messages, {
+    cwd: ROOT,
+    openFilePath: 'src/a.md',
+    locale: 'en',
+    attachments: [
+      { name: 'a.log', path: '/tmp/att/a.log' },
+      { name: 'b.csv', path: '/tmp/att/b.csv' }
+    ]
+  })
+  const sys = messages[0].content
+  assert.match(sys, /# Current context/)
+  assert.match(sys, /src\/a\.md/)
+  assert.match(sys, /attached 2 file/)
+  assert.match(sys, /\/tmp\/att\/a\.log/)
+  assert.match(sys, /\/tmp\/att\/b\.csv/)
+  // 只加一个标题段
+  assert.equal((sys.match(/# Current context/g) || []).length, 1)
+})
+
+test('injectRequestContext: 脏附件数据(缺 path / 空数组)不会破坏消息,也不留空段', () => {
+  const dirty = [{ role: 'system', content: 'rules' }]
+  injectRequestContext(dirty, { cwd: ROOT, locale: 'zh', attachments: [{ name: 'x.txt' }, null, 'oops'] })
+  assert.equal(dirty[0].content, 'rules', '没有可用 path 时不注入')
+
+  const empty = [{ role: 'system', content: 'rules' }]
+  injectRequestContext(empty, { cwd: ROOT, locale: 'zh', attachments: [] })
+  assert.equal(empty[0].content, 'rules')
+})
+
+test('injectRequestContext: 附件条数超过 20 时截断(防御性上限)', () => {
+  const messages = [{ role: 'system', content: 'rules' }]
+  const many = Array.from({ length: 25 }, (_, i) => ({ name: `f${i}.txt`, path: `/tmp/att/f${i}.txt` }))
+  injectRequestContext(messages, { cwd: ROOT, locale: 'zh', attachments: many })
+  assert.match(messages[0].content, /用户本轮附带了 20 个文件/)
+  assert.ok(!messages[0].content.includes('f24.txt'), '第 21 个之后不该出现')
+})

package/src/ui/server/routes/workbench/agentChatShared.test.js

@@ -45,16 +45,18 @@ const longSession = () => {
 }
 
 // 跑一轮真实的 runAgentTurn,桩掉 globalThis.fetch —— 抓住发出去的请求体与产生的事件
-async function runWeb({ session, userMessage, respond, locale = 'zh-CN' }) {
+// (respond 收到 fetch 的 init,方便测试按 signal 模拟"读到一半被中止")
+async function runWeb({ session, userMessage, respond, locale = 'zh-CN', signal, onEvent }) {
   const { runAgentTurn } = await import('./agentChat.js')
   const events = []
   let sent
   const original = globalThis.fetch
-  globalThis.fetch = async (_url, init) => { sent = JSON.parse(init.body); return respond() }
+  globalThis.fetch = async (_url, init) => { sent = JSON.parse(init.body); return respond(init) }
   try {
     const result = await runAgentTurn({
       session, model, userMessage, locale, cwd: process.cwd(),
-      signal: new AbortController().signal, send: e => events.push(e),
+      signal: signal ?? new AbortController().signal,
+      send: e => { events.push(e); onEvent?.(e) },
     })
     return { sent, events, result }
   } finally {
@@ -134,6 +136,34 @@ test('流被截断（没有 finish_reason 也没有 [DONE]）时不执行半截
   assert.equal(session.messages.some(m => m.role === 'tool'), false, '被截断的调用不得留下工具结果')
 })
 
+// 回归：用户点"停止"（中止正在跑的这一轮）时，已经流出来的正文必须留在会话记录里。
+// 之前中止分支只把当时的状态写盘、不回填正文，重新打开这条会话时刚才生成的内容整段消失。
+test('中止时已流出的正文要留在会话记录里', async () => {
+  const session = newSession('ag-sandbox-aborted', withSystem())
+  const controller = new AbortController()
+
+  // 吐一段正文后挂住（模拟"停在生成中"）；真 fetch 在 signal abort 时会打断 body 读取，
+  // 桩里照做才能真的走到中止分支
+  const hanging = init => new Response(new ReadableStream({
+    start(stream) {
+      const bytes = new TextEncoder()
+      stream.enqueue(bytes.encode(event({ choices: [{ delta: { content: '已经写了一半' } }] })))
+      init?.signal?.addEventListener('abort', () => stream.error(new DOMException('Aborted', 'AbortError')))
+    },
+  }), { status: 200, headers: { 'content-type': 'text/event-stream' } })
+
+  const { result } = await runWeb({
+    session, userMessage: '写一半就停', respond: hanging, signal: controller.signal,
+    // 正文事件到达 = 这段已经被读进来，此刻中止最贴近用户点"停止"的时机
+    onEvent: e => { if (e.type === 'content') controller.abort() },
+  })
+
+  assert.equal(result.aborted, true)
+  const last = session.messages[session.messages.length - 1]
+  assert.equal(last.role, 'assistant')
+  assert.equal(last.content, '已经写了一半')
+})
+
 test('400 且正文提到 tool/function 时提示换模型,而不是甩网关 JSON', async () => {
   const session = newSession('ag-sandbox-nofc', withSystem())
   const noFunctionCalling = () => new Response(

package/src/ui/server/routes/workbench/agentMarketplace.js

@@ -225,6 +225,15 @@ function isSafeSubpath(value) {
   return SAFE_SUBPATH.test(String(value || ''));
 }
 
+// 本地关键词匹配:与 awesomeSkills 同一套语义(小写子串)。
+// 静态来源(builtin / Anthropic 官方仓库)也必须过这一关 ——
+// 它们不走目录站的 query 参数,漏掉过滤就等于搜索框对这两组完全失效。
+function matchesQuery(query, ...fields) {
+  const q = String(query || '').trim().toLowerCase();
+  if (!q) return true;
+  return fields.join(' ').toLowerCase().includes(q);
+}
+
 function resolveProjectPath(value, fallback) {
   const raw = String(value || fallback || '').trim();
   if (!raw) throw new HttpError(400, '项目路径不能为空');
@@ -292,15 +301,17 @@ async function cached(key, loader) {
 // ── provider: Skill ───────────────────────────────────────────
 
 // builtin:纯静态,不联网
-function builtinSkills() {
-  return BUILTIN_SKILLS.map(item => ({ ...item, type: 'skill' }));
+function builtinSkills(query) {
+  return BUILTIN_SKILLS
+    .filter(item => matchesQuery(query, item.name, item.description, ...(item.tags || [])))
+    .map(item => ({ ...item, type: 'skill' }));
 }
 
 // Anthropic 官方仓库:用 GitHub contents API 列出 skills/ 下的目录。
 // 这是所有 skill 的"源头",目录结构稳定(path = skills/<name>)。
 // contents API 不返回描述,所以用内置表里的描述补上(两边都以目录名为键),
 // 补不到的条目在前端只显示名字,不会假装有描述。
-async function officialSkills() {
+async function officialSkills(query) {
   const data = await fetchJson('https://api.github.com/repos/anthropics/skills/contents/skills', { headers: githubHeaders() });
   if (!Array.isArray(data)) throw new Error('GitHub 返回结构异常');
   const described = new Map(ANTHROPIC_SKILLS);
@@ -315,7 +326,8 @@ async function officialSkills() {
       subpath: `skills/${entry.name}`,
       upstream: entry.html_url,
       tags: ['official'],
-    }));
+    }))
+    .filter(item => matchesQuery(query, item.name, item.description));
 }
 
 // SkillsMP:第三方 skill 目录站,给的是 owner/repo + 仓库内路径,可直接安装。
@@ -467,8 +479,10 @@ function normalizeNpmSearch(data, type) {
 
 // ── provider: MCP ─────────────────────────────────────────────
 
-function builtinMcps() {
-  return BUILTIN_MCPS.map(item => ({ ...item, type: 'mcp', command: 'npx' }));
+function builtinMcps(query) {
+  return BUILTIN_MCPS
+    .filter(item => matchesQuery(query, item.name, item.description, item.package, ...(item.tags || [])))
+    .map(item => ({ ...item, type: 'mcp', command: 'npx' }));
 }
 
 // MCP 官方注册表:canonical 数据源,直接给出 npm identifier 与所需环境变量,
@@ -562,15 +576,15 @@ async function npmMcps(query) {
 
 const PROVIDERS = {
   skill: {
-    builtin: () => builtinSkills(),
-    official: () => officialSkills(),
+    builtin: ({ query }) => builtinSkills(query),
+    official: ({ query }) => officialSkills(query),
     skillsmp: ({ query }) => skillsmpSkills(query),
     awesome: ({ query }) => awesomeSkills(query),
     github: ({ query }) => (query ? githubSkills(query) : Promise.resolve([])),
     npm: ({ query }) => npmSkills(query),
   },
   mcp: {
-    builtin: () => builtinMcps(),
+    builtin: ({ query }) => builtinMcps(query),
     registry: ({ query }) => registryMcps(query),
     smithery: ({ query }) => smitheryMcps(query),
     npm: ({ query }) => npmMcps(query),

package/src/ui/server/routes/workbench/agentMarketplace.test.js

@@ -91,6 +91,38 @@ test('catalog: 只查内置来源时完全离线,并保留按来源分组的形
   }
 });
 
+test('catalog: 内置来源也按关键词过滤(skill / MCP 都不例外)', async () => {
+  const { call } = harness();
+
+  const all = await call('GET /api/agent/marketplace/catalog', {
+    query: { type: 'skill', sources: 'builtin', cwd: sandboxProject },
+  });
+  const unfiltered = all.payload.groups[0].items.length;
+
+  const { payload } = await call('GET /api/agent/marketplace/catalog', {
+    query: { type: 'skill', sources: 'builtin', cwd: sandboxProject, q: 'pdf' },
+  });
+  const [group] = payload.groups;
+  assert.equal(group.status, 'ok');
+  assert.ok(group.items.length > 0, 'pdf 是内置条目,不该被过滤掉');
+  assert.ok(group.items.length < unfiltered, '关键词必须真的收窄结果');
+  assert.equal(group.items.some(item => item.name === 'docx'), false, '关键词 pdf 不该命中 docx');
+  for (const item of group.items) {
+    assert.match(`${item.name} ${item.description}`, /pdf/i, `${item.name} 与关键词无关`);
+  }
+
+  const { payload: mcp } = await call('GET /api/agent/marketplace/catalog', {
+    query: { type: 'mcp', sources: 'builtin', cwd: sandboxProject, q: 'memory' },
+  });
+  assert.deepEqual(mcp.groups[0].items.map(item => item.name), ['Memory']);
+
+  // 清空关键词必须回到全量,否则用户删掉搜索词后会看到一片空
+  const { payload: cleared } = await call('GET /api/agent/marketplace/catalog', {
+    query: { type: 'mcp', sources: 'builtin', cwd: sandboxProject, q: '' },
+  });
+  assert.ok(cleared.groups[0].items.length > 1, '空关键词应返回全部内置 MCP');
+});
+
 test('catalog: 未指定来源时返回全部来源,每个来源是独立的一组', async () => {
   const { call } = harness();
   const { payload } = await call('GET /api/agent/marketplace/catalog', {