sync: merge upstream main through 52b52f7

.github/workflows/ci.yml

@@ -78,3 +78,52 @@ jobs:
 
       - name: Test
         run: cargo test -p host-core --locked
+
+  trusted-extensions-e2e:
+    name: Trusted extensions Electron E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install virtual display
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes xauth xvfb
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Electron binary
+        run: pnpm --filter @pi-desktop/desktop exec install-electron
+
+      - name: Configure Chromium SUID sandbox
+        run: |
+          sandbox=apps/desktop/node_modules/electron/dist/chrome-sandbox
+          sudo chown root:root "$sandbox"
+          sudo chmod 4755 "$sandbox"
+
+      - name: Build workspace packages
+        run: pnpm build:js
+
+      - name: Build Desktop bundle
+        run: pnpm --filter @pi-desktop/desktop build
+
+      - name: Build host-core
+        run: cargo build -p host-core --locked
+
+      - name: Run trusted extensions E2E
+        env:
+          DEBUG_E2E: "1"
+        run: xvfb-run --auto-servernum pnpm test:e2e:trusted-extensions

Cargo.toml

@@ -5,4 +5,4 @@ resolver = "2"
 [workspace.package]
 edition = "2021"
 license = "LGPL-3.0-or-later"
-version = "0.16.1"
+version = "0.17.0"

README.md

@@ -37,7 +37,7 @@ Local-first · Model-agnostic · Plugin-powered · macOS / Windows / Linux
 
 </div>
 
-> **Current release line: 0.16.x (Early Preview).**
+> **Current release line: 0.17.x (Early Preview).**
 
 ---
 

README.zh-CN.md

@@ -105,7 +105,7 @@ Subagent 与 Worker Session 可以承担独立任务并行工作。
 > [!NOTE]
 > **PI-Desktop 目前仍处于 Early Preview。** 已可用于真实开发工作流，部分 API、插件接口与桌面能力仍在持续演进。
 
-> **当前发布线：0.16.x（Early Preview）。**
+> **当前发布线：0.17.x（Early Preview）。**
 
 ---
 

apps/desktop/electron/main/bootstrap/shutdown.ts

@@ -38,6 +38,7 @@ export type ShutdownDependencies = {
   activeTurns: Map<string, string>;
   persistenceOutbox: PersistenceOutbox;
   inflightCheckpointer: InflightCheckpointer;
+  flushEventPersistence: () => Promise<void>;
   pluginPanels: Pick<PluginPanelHost, "closeAll">;
   plugins: Pick<PluginRuntime, "disposeAll">;
   userMcp: Pick<UserMcpRuntime, "disposeAll">;
@@ -49,6 +50,7 @@ export type ShutdownDependencies = {
   confirmQuitDialog: () => Promise<boolean>;
   disposePowerSaveBlockers: () => void;
   liveCallService?: Pick<LiveCallService, "endForLifecycle">;
+  disposeSystemProxyRelay?: () => Promise<void>;
 };
 
 /** Register the last-window and before-quit resource lifecycle handlers. */
@@ -61,6 +63,7 @@ export function registerShutdownHandlers({
   activeTurns,
   persistenceOutbox,
   inflightCheckpointer,
+  flushEventPersistence,
   pluginPanels,
   plugins,
   userMcp,
@@ -72,6 +75,7 @@ export function registerShutdownHandlers({
   confirmQuitDialog,
   disposePowerSaveBlockers,
   liveCallService,
+  disposeSystemProxyRelay,
 }: ShutdownDependencies): void {
   app.on("window-all-closed", () => {
     // The D216 tray is resident on every platform, so its presence says nothing
@@ -121,6 +125,9 @@ export function registerShutdownHandlers({
     }
 
     state.quitting = true;
+    // Persist the confirmed shutdown before any awaited cleanup so a forced
+    // process termination still leaves an observable lifecycle boundary.
+    logger.app("lifecycle", "info", "app shutdown");
     disposePowerSaveBlockers();
     state.tray?.destroy();
     state.tray = null;
@@ -162,8 +169,28 @@ export function registerShutdownHandlers({
         pluginPanels.closeAll(),
         pluginViews.dispose(),
       ]);
-      logger.app("lifecycle", "info", "app shutdown");
       await pluginSurfacesShutdown;
+      // Stop event production before draining the terminal writes. A finished
+      // turn can already have left activeTurns while its branch archive is
+      // still awaiting the host; closing host-core first loses that archive.
+      const sidecarShutdown = getSidecar()?.dispose();
+      await Promise.allSettled([sidecarShutdown]);
+      await inflightCheckpointer.flushAll();
+      let persistenceTimer: ReturnType<typeof setTimeout> | undefined;
+      try {
+        const settled = await Promise.race([
+          flushEventPersistence().then(() => true),
+          new Promise<boolean>((resolve) => {
+            persistenceTimer = setTimeout(() => resolve(false), QUIT_TURN_SETTLE_BUDGET_MS);
+          }),
+        ]);
+        if (!settled) {
+          logger.app("lifecycle", "warn", "quit before event persistence settled");
+        }
+      } finally {
+        if (persistenceTimer) clearTimeout(persistenceTimer);
+      }
+      await persistenceOutbox.flush(getHost);
       const hostShutdown = getHost()?.dispose();
       const mcpShutdown = getMcpControl()?.stop();
       updater.dispose();
@@ -175,7 +202,6 @@ export function registerShutdownHandlers({
       mcpOAuth?.disposeAll();
       browserHost.dispose();
       inflightCheckpointer.dispose();
-      const sidecarShutdown = getSidecar()?.dispose();
 
       try {
         await hostShutdown;
@@ -188,6 +214,7 @@ export function registerShutdownHandlers({
         mcpShutdown,
         remoteHostsShutdown,
       ]);
+      await disposeSystemProxyRelay?.();
     })();
 
     const releaseQuit = () => {

apps/desktop/electron/main/chat-ref-resolve.ts

@@ -38,9 +38,25 @@ export type ChatRefRoots = {
    */
   project?: readonly FsChatRefProjectRoot[] | null;
   scratch?: string | null;
+  /**
+   * Roots an absolute reference may name without being searched by shorthand.
+   *
+   * A generated image lives in the scratch store of the session that produced
+   * it, and the user clicks it from whatever conversation they are reading —
+   * usually a later one. Every read guard (`fsRead`, `fsOpen`, the image
+   * reader, `fsReveal`) already accepts the whole scratch store, so completing
+   * against the session's own store alone reported a restriction for a file the
+   * app can open. These entries widen the absolute-path check only: a shorthand
+   * still searches the session's own root, so it never lands in another
+   * session's files.
+   */
+  containment?: readonly ChatRefContainmentRoot[] | null;
   attachments?: string | null;
 };
 
+/** A root an absolute reference may name, though no shorthand searches it. */
+export type ChatRefContainmentRoot = { kind: FsChatRefRoot; path: string };
+
 /** A root to search, and — for a project folder — which folder it is. */
 type ChatRefRootEntry = {
   kind: FsChatRefRoot;
@@ -147,6 +163,23 @@ function orderedRoots(roots: ChatRefRoots): ChatRefRootEntry[] {
   return list;
 }
 
+/**
+ * The containment-only roots, in the same vocabulary as the searched ones.
+ *
+ * They answer absolute references and nothing else: the shorthand walk below
+ * keeps searching `orderedRoots`, so a reference is never completed from
+ * another session's store.
+ */
+function containmentEntries(roots: ChatRefRoots): ChatRefRootEntry[] {
+  const list: ChatRefRootEntry[] = [];
+  for (const root of roots.containment ?? []) {
+    const path = String(root?.path ?? "").trim();
+    if (!path) continue;
+    list.push({ kind: root.kind, path: resolve(path) });
+  }
+  return list;
+}
+
 async function isRegularFile(target: string): Promise<boolean> {
   try {
     return (await stat(target)).isFile();
@@ -203,7 +236,7 @@ export async function isChatRefOutsideRoots(ref: string, roots: ChatRefRoots): P
   const cleaned = cleanRef(ref);
   if (!isAbsolute(cleaned)) return true;
   const absolutePath = resolve(cleaned);
-  const rootList = await canonicalRoots(orderedRoots(roots));
+  const rootList = await canonicalRoots([...orderedRoots(roots), ...containmentEntries(roots)]);
   if (!couldShareVolume(absolutePath, rootList)) return true;
   const targetPath = await canonicalPathOrMissingTail(absolutePath);
   if (!targetPath) return !rootList.some((root) => relativeInside(root.path, absolutePath) !== null);
@@ -343,7 +376,7 @@ export async function resolveChatFileRef(
   const parsed = parseChatRef(ref);
   if (!parsed) return null;
   const rootList = orderedRoots(roots);
-  if (rootList.length === 0) return null;
+  if (rootList.length === 0 && !(roots.containment ?? []).length) return null;
 
   const cleanedPosixRef = toPosix(cleanRef(ref));
   const isAttachmentRef = /^attachments(?:\/|$)/i.test(cleanedPosixRef);
@@ -353,7 +386,12 @@ export async function resolveChatFileRef(
     const cleaned = cleanRef(ref);
     if (!isAbsolute(cleaned)) return null;
     const absolutePath = resolve(cleaned);
-    const canonicalRootList = await canonicalRoots(rootList);
+    // An absolute reference may also name a store the app reads but no shorthand
+    // searches, such as an image another session generated.
+    const canonicalRootList = await canonicalRoots([
+      ...rootList,
+      ...containmentEntries(roots),
+    ]);
     if (!couldShareVolume(absolutePath, canonicalRootList)) return null;
     let targetPath: string;
     try {

apps/desktop/electron/main/index.ts

@@ -9,6 +9,8 @@ import { join } from "node:path";
 import {
   applyNetworkProxyFromAppSettings,
   currentNetworkProxy,
+  disposeSystemProxyRelay,
+  ensureSystemProxyRelay,
   testNetworkProxy,
 } from "./network-proxy";
 import {
@@ -281,6 +283,7 @@ const vendorOAuth = new VendorOAuth({
   openExternal: async (url) => {
     await safeOpenExternal(url);
   },
+  getPluginOAuthBridge: () => pluginServices.plugins,
   log: (level, message, data) => logger.app("provider", level, message, { data }),
   onAccountModels: (id, models) => modelsDevCatalog.setAccountModels(id, models),
   onAccountRemoved: (id) => modelsDevCatalog.deleteAccount(id),
@@ -773,6 +776,7 @@ const { startHost } = createHostRuntime({
   importLegacyScheduled,
   superviseRestart,
   isQuitting: () => mainState.quitting,
+  ensureSystemProxyRelay,
 });
 
 runtimeLifecycle = createRuntimeLifecycle({
@@ -1030,6 +1034,7 @@ registerShutdownHandlers({
   activeTurns,
   persistenceOutbox,
   inflightCheckpointer,
+  flushEventPersistence: eventPersistence.flush,
   pluginPanels,
   plugins,
   userMcp,
@@ -1041,6 +1046,7 @@ registerShutdownHandlers({
   confirmQuitDialog,
   disposePowerSaveBlockers,
   liveCallService,
+  disposeSystemProxyRelay,
 });
 
 registerApplicationActivation({

apps/desktop/electron/main/ipc/agent-ipc.ts

@@ -295,16 +295,20 @@ export function registerAgentIpc({
           Boolean(req.attachments?.length),
         )
       : null;
+    // The inline text the user's draft carried decides both what the message
+    // shows and where each image block sits in the prompt.
+    const steerContent = mcpExpansion?.expanded ?? req.content;
     const prepared = await preparePromptAttachments(
-      dataDir, req.sessionId, context.projectPath, req.attachments ?? [], context.supportsVision,
+      dataDir, req.sessionId, context.projectPath, req.attachments ?? [],
+      context.supportsVision, steerContent,
     );
     const session = await host.call<{ session?: { messages?: UiMessage[] } }>("session.get", {
       id: req.sessionId, messageLimit: 1,
     });
     const message: UiMessage = {
       id: durableUserMessageId(req.messageId, session.session?.messages ?? []),
       role: "user",
-      content: mcpExpansion?.expanded ?? req.content,
+      content: steerContent,
       ...(mcpExpansion ? { command: mcpExpansion.command } : {}),
       status: "complete",
       createdAt: new Date().toISOString(),
@@ -316,11 +320,12 @@ export function registerAgentIpc({
     // never turn into a normal prompt or alter the next turn's configuration.
     return sidecar.call<{ accepted: boolean; turnId: string }>("agent.steer", {
       sessionId: req.sessionId, expectedTurnId: req.expectedTurnId, message,
-      content: appendPromptFallbackPaths(mcpExpansion?.expanded ?? req.content, prepared),
+      content: appendPromptFallbackPaths(steerContent, prepared),
       ...(mcpExpansion ? { mcpServerIds: mcpExpansion.mcpServerIds, mcpToolNames: mcpExpansion.mcpToolNames } : {}),
       attachments: prepared.filter((attachment) => attachment.inlineData).map((attachment) => ({
         path: attachment.message.ref, name: attachment.message.name, kind: attachment.message.kind,
         mimeType: attachment.message.mimeType, size: attachment.message.size, data: attachment.inlineData,
+        ...(attachment.message.inlinePath ? { inlinePath: attachment.message.inlinePath } : {}),
       })),
     });
   });
@@ -560,6 +565,9 @@ export function registerAgentIpc({
           : undefined,
         req.attachments ?? [],
         supportsVision,
+        // The text the durable message will hold: an image chip the Composer
+        // left inline keeps its place in the prompt and in the transcript.
+        promptContent,
       );
     } catch (error) {
       await finishTurn(req.sessionId, "error", (error as any)?.errorCode, {
@@ -677,6 +685,9 @@ export function registerAgentIpc({
                 mimeType: attachment.message.mimeType,
                 size: attachment.message.size,
                 data: attachment.inlineData,
+                ...(attachment.message.inlinePath
+                  ? { inlinePath: attachment.message.inlinePath }
+                  : {}),
               })),
             // A referenced conversation crosses the sidecar as quoted text for
             // this turn; the durable record above keeps it for later turns.

apps/desktop/electron/main/ipc/jev-ipc.ts

@@ -0,0 +1,27 @@
+/**
+ * The Jev key check channel.
+ *
+ * One job, separate from the provider channels: Jev owns no provider row, and
+ * its credential lives under a fixed Host secret reference rather than a
+ * provider id. The handler only asks TypeSafe; it stores nothing, so a key
+ * that fails the check never reaches the secret store.
+ */
+import { IPC } from "@pi-desktop/shared";
+import { probeJevApiKey } from "../jev-probe";
+import type { Logger } from "../logger";
+import type { IpcRegistrar } from "./types";
+
+export type JevIpcDependencies = {
+  registrar: IpcRegistrar;
+  logger: Pick<Logger, "app">;
+};
+
+export function registerJevIpc({ registrar, logger }: JevIpcDependencies): void {
+  registrar.handle(IPC.invoke.jevTest, async (apiKey: unknown) => {
+    const result = await probeJevApiKey(typeof apiKey === "string" ? apiKey : "");
+    logger.app("provider", result.ok ? "info" : "warn", "TypeSafe Jev key check", {
+      data: { ok: result.ok, status: result.status },
+    });
+    return result;
+  });
+}

apps/desktop/electron/main/ipc/register.ts

@@ -17,6 +17,7 @@ import { searchMcpMarket } from "../mcp-registry-catalog";
 import { registerNotificationIpc } from "./notification-ipc";
 import { registerPluginIpc } from "./plugin-ipc";
 import { registerPluginUiIpc } from "./plugin-ui-ipc";
+import { registerJevIpc } from "./jev-ipc";
 import { registerProviderIpc } from "./provider-ipc";
 import { registerScheduledIpc } from "./scheduled-ipc";
 import { registerSessionIpc } from "./session-ipc";
@@ -299,6 +300,7 @@ export function registerIpcHandlers(dependencies: RegisterIpcDependencies) {
     bindingForModel,
     onProviderInvalidated: (providerId) => liveCallService?.invalidateProvider(providerId),
   });
+  registerJevIpc({ registrar, logger });
   const loadComposerTemplatesCached = createComposerTemplateLoader(logger);
   const composerCommandService = registerComposerIpc({
     registrar,