侧栏集成分支：门禁修复 + #3 健壮性安全 + #4 审查修复 + #5 性能 + #6 泄漏

.github/workflows/chat_kernel_ui.yml

@@ -5,6 +5,13 @@ on:
   pull_request:
     paths:
       - 'renderer.js'
+      - 'main.js'
+      - 'style.css'
+      - 'Groupmodules/**'
+      - 'ProjectForgemodules/**'
+      - 'VCPDistributedServer/Plugin/PowerShellExecutor/**'
+      - 'VCPDistributedServer/Plugin/ProjectForge/**'
+      - 'vendor/xterm/**'
       - 'main.html'
       - 'modules/**'
       - 'preloads/**'
@@ -54,6 +61,12 @@ jobs:
       - name: Run Chat Kernel tests
         run: npm run test:chat-kernel
 
+      - name: Run side pane tests
+        run: npm run test:side-pane
+
+      - name: Run side pane workbench surface tests
+        run: npm run test:workbench
+
       - name: Run Chat contract evidence gate
         env:
           VCPCHAT_PACKAGED_ARTIFACT_SMOKE_OUTPUT: ${{ runner.temp }}/packaged-artifact-smoke.json
@@ -91,3 +104,45 @@ jobs:
 
       - name: Run complete UI system gate
         run: npm run check:ui-system
+
+  side-pane-e2e:
+    name: Side pane end-to-end smoke (real Electron)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Setup Node 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: npm
+
+      # 和 mobile_sync 打包任务一样：先装依赖不跑原生脚本，再按 Electron 的 ABI 重编原生模块，
+      # 按 Node ABI 编出来的原生模块（better-sqlite3 等）在 Electron 里加载不了
+      - name: Install package graph without native lifecycle scripts
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: 'true'
+        run: npm ci --ignore-scripts
+
+      - name: Install Electron runtime
+        run: node node_modules/electron/install.js
+
+      - name: Rebuild Electron native modules used by the app
+        run: npx electron-rebuild -f -w better-sqlite3,node-pty,sharp
+
+      - name: Ensure a virtual display
+        run: command -v xvfb-run || (sudo apt-get update && sudo apt-get install -y xvfb)
+
+      - name: Run side pane smoke
+        env:
+          SIDE_PANE_SMOKE_DIR: ${{ runner.temp }}/side-pane-smoke
+        run: xvfb-run -a -s "-screen 0 1600x1000x24" npm run smoke:side-pane
+
+      - name: Upload smoke evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: side-pane-smoke-evidence
+          path: ${{ runner.temp }}/side-pane-smoke

Groupmodules/groupchat.js

@@ -621,7 +621,7 @@ async function getAgentGroups() {
                 if (await fs.pathExists(configPath)) {
                     const config = normalizeGroupModeSettings(await fs.readJson(configPath));
                     if (config.avatar) {
-                        config.avatarUrl = `file://${path.join(groupPath, config.avatar)}?t=${Date.now()}`;
+                        config.avatarUrl = await versionedGroupAvatarUrl(groupPath, config.avatar);
                     } else {
                         config.avatarUrl = null;
                     }
@@ -639,6 +639,14 @@ async function getAgentGroups() {
     }
 }
 
+// Version the avatar URL by modification time so the agent list keeps its
+// cached image until the avatar file actually changes.
+async function versionedGroupAvatarUrl(groupDir, avatarFile) {
+    const avatarPath = path.join(groupDir, avatarFile);
+    const stat = await fs.stat(avatarPath).catch(() => null);
+    return `file://${avatarPath}?v=${stat ? Math.round(stat.mtimeMs) : Date.now()}`;
+}
+
 /**
  * 获取指定 AgentGroup 的配置
  * @param {string} groupId - 群组 ID
@@ -652,7 +660,7 @@ async function getAgentGroupConfig(groupId) {
         if (await fs.pathExists(configPath)) {
             const config = normalizeGroupModeSettings(await fs.readJson(configPath));
             if (config.avatar) {
-                config.avatarUrl = `file://${path.join(groupDir, config.avatar)}?t=${Date.now()}`;
+                config.avatarUrl = await versionedGroupAvatarUrl(groupDir, config.avatar);
             } else {
                 config.avatarUrl = null;
             }

Groupmodules/grouprenderer.js

@@ -40,6 +40,11 @@ window.GroupRenderer = (() => {
     const pendingGroupUserMessageIds = new Set();
     let groupSettingsGeneration = 0;
     let groupSettingsReady = false;
+    // Group settings save only on the Save button, like Agent settings. Track
+    // unsaved edits the same way so the form shows 未保存更改 before a switch
+    // throws them away.
+    let groupSettingsDirty = false;
+    let groupSettingsRevision = 0;
     let groupSlotsLoadPromise = null;
 
     function ensureGroupSlotsBridge() {
@@ -629,6 +634,11 @@ window.GroupRenderer = (() => {
         }
         groupSettingsForm.addEventListener('submit', handleSaveGroupSettings);
         groupSettingsForm._eventListenerAttached = true;
+        if (!groupSettingsForm._dirtyListenerAttached) {
+            groupSettingsForm.addEventListener('input', markGroupSettingsDirty);
+            groupSettingsForm.addEventListener('change', markGroupSettingsDirty);
+            groupSettingsForm._dirtyListenerAttached = true;
+        }
 
 
         if (deleteGroupBtn?._eventListenerAttached) {
@@ -646,6 +656,7 @@ window.GroupRenderer = (() => {
         groupAvatarInput._eventListenerAttached = true;
 
         groupSettingsReady = true;
+        resetGroupSettingsDirty();
         updateAllGroupSectionSummaries();
     }
 
@@ -722,7 +733,10 @@ window.GroupRenderer = (() => {
             list: sequentialSpeakerOrderList,
             agents: availableAgentsForGroup,
             groupConfig,
-            onChanged: () => updateGroupSectionSummary('mode')
+            onChanged: () => {
+                updateGroupSectionSummary('mode');
+                markGroupSettingsDirty();
+            }
         });
     }
 
@@ -732,7 +746,10 @@ window.GroupRenderer = (() => {
             membersContainer: groupMembersListDiv,
             agents: availableAgentsForGroup,
             groupConfig,
-            onChanged: () => updateGroupSectionSummary('mode')
+            onChanged: () => {
+                updateGroupSectionSummary('mode');
+                markGroupSettingsDirty();
+            }
         });
     }
 
@@ -743,7 +760,10 @@ window.GroupRenderer = (() => {
             membersContainer: groupMembersListDiv,
             agents: availableAgentsForGroup,
             groupConfig,
-            onChanged: () => updateGroupSectionSummary('mode')
+            onChanged: () => {
+                updateGroupSectionSummary('mode');
+                markGroupSettingsDirty();
+            }
         });
     }
 
@@ -757,7 +777,41 @@ window.GroupRenderer = (() => {
         updateGroupSectionSummary('mode');
     }
 
-    function reportSettingsSaveResult(success, error = '') {
+    function setGroupSaveState(state) {
+        const indicator = groupSettingsForm?.querySelector('.form-save-state-indicator');
+        if (!indicator) return;
+        indicator.dataset.state = state;
+        const label = indicator.querySelector('.form-state-dot-label');
+        if (label) label.textContent = state === 'warning' ? '未保存更改' : (state === 'ongoing' ? '保存中...' : '已保存');
+        const dotHost = indicator.querySelector('.form-state-dot-host');
+        if (!dotHost) return;
+        dotHost.replaceChildren();
+        try {
+            window.VCPUIUX?.mountStateDot?.(dotHost, { state, size: 7 }, {
+                own: () => {},
+                child: () => ({ own: () => {}, listen: () => {}, dispose: () => {} }),
+                listen: () => {},
+                dispose: () => {}
+            });
+        } catch (_) {}
+    }
+
+    function markGroupSettingsDirty() {
+        if (!groupSettingsReady) return;
+        groupSettingsDirty = true;
+        ++groupSettingsRevision;
+        setGroupSaveState('warning');
+    }
+
+    function resetGroupSettingsDirty() {
+        groupSettingsDirty = false;
+        groupSettingsRevision = 0;
+        setGroupSaveState('done');
+    }
+
+    function reportSettingsSaveResult(success, error = '', saveRevision = null) {
+        if (success && saveRevision === groupSettingsRevision) groupSettingsDirty = false;
+        setGroupSaveState(success && !groupSettingsDirty ? 'done' : 'warning');
         groupSettingsForm?.dispatchEvent(new CustomEvent('vcp-settings-save-result', {
             detail: { success: Boolean(success), error }
         }));
@@ -790,6 +844,8 @@ window.GroupRenderer = (() => {
         const selectedMemberIds = [...getSelectedMemberIds()];
         const targetGroupId = groupId;
         const saveGeneration = groupSettingsGeneration;
+        const saveRevision = groupSettingsRevision;
+        setGroupSaveState('ongoing');
         const saveSurface = window.VCPSettingsSidebar;
         const saveSnapshot = saveSurface?.getSnapshot?.();
         const isCurrentSave = () => {
@@ -959,7 +1015,7 @@ window.GroupRenderer = (() => {
             const saveButton = groupSettingsForm.querySelector('button[type="submit"]');
 
             if (result.success && result.agentGroup) {
-                reportSettingsSaveResult(true);
+                reportSettingsSaveResult(true, '', saveRevision);
                 if (saveButton) uiHelper.showSaveFeedback(saveButton, true, "已保存!", "保存群组设置");
                 await mainRendererFunctions.loadItems(); // Reload list to reflect name/avatar changes
                 if (!isCurrentSave()) return;

VCPDistributedServer/Plugin/PowerShellExecutor/PowerShellExecutor.js

@@ -213,10 +213,15 @@ ipcMain.handle('read-from-clipboard', () => {
 function applyPtyResize(cols, rows) {
     const normalizedCols = Number(cols);
     const normalizedRows = Number(rows);
+    const previous = lastKnownSize;
 
     if (Number.isInteger(normalizedCols) && Number.isInteger(normalizedRows) && normalizedCols > 0 && normalizedRows > 0) {
         lastKnownSize = { cols: normalizedCols, rows: normalizedRows };
     }
+    // 镜像视图（侧栏终端）里不持有尺寸的那些要跟着新尺寸画
+    if (lastKnownSize.cols !== previous.cols || lastKnownSize.rows !== previous.rows) {
+        notifyMirrors('onResize', lastKnownSize.cols, lastKnownSize.rows);
+    }
 
     if (ptyProcess) {
         try {
@@ -742,20 +747,50 @@ function dispatchPtyData(rawData) {
 // 输入与尺寸调整直接落到同一个 PTY，AI 工具执行的命令因此对两处都可见。
 const MIRROR_REPLAY_LIMIT = 256 * 1024;
 const mirrorSinks = new Set();
-let replayBuffer = '';
+// 回放缓存按块存：满了从头部整块丢掉，每块均摊 O(1)，只在挂载回放时拼一次。
+// 原来每块都把 256KB 拼接再切片，刷屏输出时主进程每秒要复制几百 MB（同 DSH terminal-io 的有界缓冲预算）
+let replayChunks = [];
+let replayHead = 0;
+let replayLength = 0;
 let mirrorStartupPending = false;
 let mirrorStartupHeld = '';
 
 function emitMirrorData(dataStr) {
     if (!dataStr) return;
     // 侧栏终端可能在会话进行中才挂载，缓存最近输出用于回放。
-    replayBuffer += dataStr;
-    if (replayBuffer.length > MIRROR_REPLAY_LIMIT) {
-        replayBuffer = replayBuffer.slice(-MIRROR_REPLAY_LIMIT);
-    }
+    appendReplay(dataStr);
     notifyMirrors('onData', dataStr);
 }
 
+function appendReplay(dataStr) {
+    replayChunks.push(dataStr);
+    replayLength += dataStr.length;
+    while (replayLength - replayChunks[replayHead].length >= MIRROR_REPLAY_LIMIT) {
+        replayLength -= replayChunks[replayHead].length;
+        replayChunks[replayHead++] = undefined;
+    }
+    if (replayHead > 1024 && replayHead * 2 > replayChunks.length) {
+        replayChunks = replayChunks.slice(replayHead);
+        replayHead = 0;
+    }
+}
+
+function readReplay() {
+    if (replayLength === 0) return '';
+    const text = replayChunks.slice(replayHead).join('');
+    if (text.length <= MIRROR_REPLAY_LIMIT) return text;
+    // 超出的部分从下一行开头回放，不从控制序列中间切开
+    const kept = text.slice(-MIRROR_REPLAY_LIMIT);
+    const lineStart = kept.indexOf('\n');
+    return lineStart >= 0 && lineStart < 4096 ? kept.slice(lineStart + 1) : kept;
+}
+
+function clearReplay() {
+    replayChunks = [];
+    replayHead = 0;
+    replayLength = 0;
+}
+
 /** 结束启动握手：成功时只放出就绪标记之后的内容（通常是提示符），失败时原样放出便于排查。 */
 function releaseMirrorStartup(afterReady = null) {
     if (!mirrorStartupPending) return;
@@ -782,9 +817,10 @@ function notifyMirrors(method, ...args) {
  */
 function attachMirror(sink) {
     mirrorSinks.add(sink);
-    if (replayBuffer) {
+    const replay = readReplay();
+    if (replay) {
         try {
-            sink.onData(replayBuffer);
+            sink.onData(replay);
         } catch (e) {
             console.error('[PowerShellExecutor] Mirror replay failed:', e);
         }
@@ -886,7 +922,7 @@ function createNewPtySession() {
             guiWindow.webContents.send('powershell-clear');
         }
     }
-    replayBuffer = '';
+    clearReplay();
     notifyMirrors('onClear');
 
     let shell = 'bash';
@@ -1005,6 +1041,14 @@ function createNewPtySession() {
             reject(new Error('PowerShell did not complete its startup readiness probe within 15 seconds.'));
         }, 15000);
 
+        // macOS / Linux 起的是 bash：PowerShell 的初始化写进去只会报语法错误，边界永远等不到，
+        // 前 15 秒侧栏一片空白。环境变量 spawn 时已经给了，这里只打印边界：两段引号拼起来，
+        // 回显的命令行里是 '…''…'，不会提前命中
+        if (os.platform() !== 'win32') {
+            const split = Math.floor(readyBoundary.length / 2);
+            currentPtyProcess.write(`printf '%s\\n' '${readyBoundary.slice(0, split)}''${readyBoundary.slice(split)}'; clear\r`);
+            return;
+        }
         const initializationCommand = [
             '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8',
             '$env:PAGER = "cat"',
@@ -1024,6 +1068,8 @@ function createNewPtySession() {
         ].join('; ');
         currentPtyProcess.write(`${initializationCommand}\r`);
     });
+    // 只有 AI 命令会等它；没人等的时候超时也不能变成未处理的 rejection
+    ptyReadyPromise.catch(() => {});
 
     // 当 pty 进程意外退出时，清理资源。
     // 注意：newSession 会先 kill 旧 PTY 再创建新 PTY，旧 PTY 的异步 onExit 不能误清理新会话。
@@ -1917,7 +1963,7 @@ function cleanup() {
 
     // 4. 确保 ptyProcess 状态被重置
     mirrorSinks.clear();
-    replayBuffer = '';
+    clearReplay();
     mirrorStartupPending = false;
     mirrorStartupHeld = '';
     ptyProcess = null;

VCPDistributedServer/Plugin/PowerShellExecutor/commandRunStore.js

@@ -78,13 +78,24 @@ function listCommandRuns() {
     return commandRuns.map(summarizeCommandRun).reverse();
 }
 
+// 清洗是逐字符的屏幕模拟，几百 KB 要几十毫秒，而且在主进程里同步跑：输出没变时直接用上次的结果
+const cleanedOutput = new WeakMap(); // run -> { raw, clean }
+
+function cleanRunOutput(run) {
+    const cached = cleanedOutput.get(run);
+    if (cached && cached.raw === run.raw) return cached.clean;
+    // 起始标记那一行留下的换行不算输出
+    const clean = sanitizeTerminalOutput(run.raw).replace(/\r\n/g, '\n').replace(/\r/g, '').replace(/^\n/, '');
+    cleanedOutput.set(run, { raw: run.raw, clean });
+    return clean;
+}
+
 /** 读取一条记录，输出为清洗后的纯文本，只保留末尾 maxChars 个字符。 */
 function getCommandRun(id, { maxChars = COMMAND_RUN_READ_LIMIT } = {}) {
     const run = commandRuns.find(item => item.id === id);
     if (!run) return null;
     const limit = Math.max(1, Math.min(COMMAND_RUN_READ_LIMIT, Math.floor(Number(maxChars)) || COMMAND_RUN_READ_LIMIT));
-    // 起始标记那一行留下的换行不算输出
-    const clean = sanitizeTerminalOutput(run.raw).replace(/\r\n/g, '\n').replace(/\r/g, '').replace(/^\n/, '');
+    const clean = cleanRunOutput(run);
     const truncated = run.rawTruncated || clean.length > limit;
     return {
         ...summarizeCommandRun(run),