feat: 升级至 v0.3.0 — 安全增强、死循环检测、六轮全面审计修复

大版本迭代，新增安全增强、Agent Loop 增强、UI/UX 增强，经六轮全面审计修复所有问题。

新增功能：
- OutputValidator 事实一致性检查 + 幻觉检测
- PromptInjectionDefender 语义级检测（指令性动词密度、角色边界、分隔符嵌套）
- DeadLoopError 死循环检测（连续3轮相同工具调用自动终止）
- PolicyEngine maxFrequency 滑动窗口频率限制
- MemoryManager TF-IDF 语义检索 + IDF 缓存原子替换
- 斜杠命令（/tool /memory /clear /export）+ 快捷键（Ctrl+B/J/Shift+F/N/[/]）
- 专注模式（Ctrl+Shift+F）带面板状态快照保存/恢复

六轮审计修复（共修复 3 CRITICAL + 8 HIGH + 13 MEDIUM + 11 LOW）：

CRITICAL:
- main.ts 传入 createAdapter 而非 reloadAdapter，导致 Provider 切换完全失效
- Ctrl+N/Ctrl+[/Ctrl+] 不同步 agent-store，导致消息发到错误会话
- engine.ts emit('error') 无监听器导致 DONE 事件丢失、前端卡死

HIGH:
- 死循环检测在工具执行之后（移入 PARSING 后 EXECUTING 前）
- deadLoop 事件前端未处理
- ConfirmationHook.clearPending 从未调用导致定时器泄漏
- engine.ts retry abort listener 未移除导致监听器堆积
- MCPManager JSON.parse 无 try-catch 导致初始化崩溃
- sendMessage 自动创建会话不同步 session-store
- setCurrentSession 竞态导致旧请求覆盖新会话数据

MEDIUM:
- toggleFocusMode 覆盖用户原有面板状态
- 正则检测可被常见词绕过
- 频率限制内存泄漏 + customPolicies 覆盖
- LIKE 回退转义未包含反斜杠
- OutputValidator 新功能未传入 toolResults/context
- MemoryConsolidator LLM 调用无超时保护
- AuditService 每次 log 都查询数据库
- browser-window-manager 超时后未停止页面加载
- output-validator URL 比较大小写敏感
- FileReader 无 onerror 导致 Promise 永久挂起
- /clear /export 不关闭斜杠菜单
- 专注模式下 toggleSidebar/toggleDetail 未恢复另一面板快照

LOW:
- abortPromise 事件监听器堆积
- RateLimitHook Map 内存泄漏
- memory.ts await 同步方法
- PolicyEngine 死代码清理
- Orchestrator sessionDepth 会话结束不清理
- workspace.service.ts 元数据插入边界问题

src/App.tsx

@@ -33,6 +33,10 @@ export default function App(): React.JSX.Element {
   const resolvedTheme = useUIStore((s) => s.resolvedTheme);
   const muiTheme = resolvedTheme === 'dark' ? metonaDarkTheme : metonaLightTheme;
 
+  // v0.3.0: 面板可见性（支持快捷键和专注模式）
+  const sidebarVisible = useUIStore((s) => s.sidebarVisible);
+  const detailVisible = useUIStore((s) => s.detailVisible);
+
   // 启动时从数据库恢复状态
   useEffect(() => {
     if (window.metona?.config?.get) {
@@ -56,9 +60,9 @@ export default function App(): React.JSX.Element {
         style={{ background: muiTheme.palette.background.default, color: muiTheme.palette.text.primary }}
       >
         <div className="flex-1 flex overflow-hidden min-h-0">
-          <Sidebar />
+          {sidebarVisible && <Sidebar />}
           <ChatPanel />
-          <DetailPanel />
+          {detailVisible && <DetailPanel />}
         </div>
         <StatusBar />
         <SettingsModal />

src/components/chat/ChatInput.tsx

@@ -14,6 +14,7 @@ import { Box, Typography, IconButton, Tooltip, Stack, Button, Paper } from '@mui
 import { Send, Paperclip, Square, X, FileText, Image as ImageIcon } from 'lucide-react';
 import { useAgentStore } from '@renderer/stores/agent-store';
 import { useSessionStore } from '@renderer/stores/session-store';
+import { useUIStore } from '@renderer/stores/ui-store';
 import { formatTokens, formatFileSize } from '@renderer/lib/formatters';
 
 const SLASH_COMMANDS = [
@@ -70,17 +71,19 @@ export function ChatInput(): React.JSX.Element {
 
     if (type === 'image') {
       // 图片转 base64 data URL → 压缩（限制 1024px, JPEG 0.7）
-      const dataUri = await new Promise<string>((resolve) => {
+      const dataUri = await new Promise<string>((resolve, reject) => {
         const reader = new FileReader();
         reader.onload = () => resolve(reader.result as string);
+        reader.onerror = () => reject(new Error('图片读取失败'));
         reader.readAsDataURL(file);
       });
       attachment.preview = await compressImage(dataUri, 1024, 0.7);
     } else if (type === 'text') {
       // 文本文件读取内容
-      attachment.textContent = await new Promise<string>((resolve) => {
+      attachment.textContent = await new Promise<string>((resolve, reject) => {
         const reader = new FileReader();
         reader.onload = () => resolve(reader.result as string);
+        reader.onerror = () => reject(new Error('文本文件读取失败'));
         reader.readAsText(file);
       });
     }
@@ -97,13 +100,36 @@ export function ChatInput(): React.JSX.Element {
       : fileArray.filter((f) => !IMAGE_TYPES.includes(f.type));
 
     if (filtered.length < fileArray.length && !supportsImages) {
-      // TODO: 用 Toast 提示用户 "DeepSeek 不支持图片，已自动跳过 N 个图片文件"
+      // v0.3.0: 用 Toast 提示用户 DeepSeek 不支持图片
+      const skipped = fileArray.length - filtered.length;
+      // v0.3.0 修复：记录 Toast 加载失败错误到控制台，而非静默吞掉
+      import('metona-toast').then((mod) => {
+        mod.default.warning(`DeepSeek 不支持图片，已自动跳过 ${skipped} 个图片文件`);
+      }).catch((err) => {
+        console.error('[ChatInput] Failed to load metona-toast for DeepSeek image warning:', err);
+      });
     }
 
     if (filtered.length === 0) return;
 
-    const newAttachments = await Promise.all(filtered.map(processFile));
-    setAttachments((prev) => [...prev, ...newAttachments]);
+    // v0.3.0 修复: 使用 allSettled 处理部分文件读取失败，避免一个失败导致全部丢失
+    const results = await Promise.allSettled(filtered.map(processFile));
+    const successful = results.filter(
+      (r): r is PromiseFulfilledResult<Attachment> => r.status === 'fulfilled',
+    ).map((r) => r.value);
+    if (successful.length === 0) {
+      import('metona-toast').then((mod) => {
+        mod.default.error('文件读取失败，请检查文件是否损坏或被锁定');
+      }).catch(() => {});
+      return;
+    }
+    if (successful.length < filtered.length) {
+      const failedCount = filtered.length - successful.length;
+      import('metona-toast').then((mod) => {
+        mod.default.warning(`${failedCount} 个文件读取失败，已跳过`);
+      }).catch(() => {});
+    }
+    setAttachments((prev) => [...prev, ...successful]);
   }, [processFile, supportsImages]);
 
   const removeAttachment = useCallback((id: string) => {
@@ -147,10 +173,39 @@ export function ChatInput(): React.JSX.Element {
     // 处理 / 命令
     if (trimmed.startsWith('/')) {
       const cmd = trimmed.split(' ')[0].toLowerCase();
-      if (cmd === '/clear') { useAgentStore.getState().clearMessages(); setInput(''); setAttachments([]); return; }
+      if (cmd === '/clear') { useAgentStore.getState().clearMessages(); setInput(''); setAttachments([]); setShowSlashMenu(false); return; }
       if (cmd === '/export') {
         const blob = new Blob([JSON.stringify(useAgentStore.getState().messages, null, 2)], { type: 'application/json' });
-        const a = document.createElement('a'); a.href = URL.createObjectURL(blob); a.download = `session-${Date.now()}.json`; a.click(); setInput(''); return;
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = `session-${Date.now()}.json`;
+        a.click();
+        // v0.3.0 修复：释放 Blob URL，避免内存泄漏
+        URL.revokeObjectURL(url);
+        setInput(''); setShowSlashMenu(false); return;
+      }
+      // v0.3.0: /tool — 打开设置面板的工具管理 Tab
+      if (cmd === '/tool') {
+        useUIStore.getState().openSettings();
+        setInput(''); setAttachments([]); setShowSlashMenu(false);
+        return;
+      }
+      // v0.3.0: /memory — 切换到详情面板的 Memory 标签
+      // v0.3.0 修复：确保详情面板可见，否则切换标签用户看不到
+      if (cmd === '/memory') {
+        const uiStore = useUIStore.getState();
+        uiStore.setDetailTab('memory');
+        // v0.3.0 修复: 专注模式下先退出专注模式（恢复快照），再确保详情面板可见
+        if (uiStore.focusMode) {
+          uiStore.toggleFocusMode();
+        }
+        // 退出专注模式后再次检查详情面板可见性
+        if (!useUIStore.getState().detailVisible) {
+          uiStore.toggleDetail();
+        }
+        setInput(''); setAttachments([]); setShowSlashMenu(false);
+        return;
       }
     }
 

src/components/layout/DetailPanel.tsx

@@ -2,9 +2,10 @@
  * DetailPanel — 右侧详情面板
  *
  * 通过 Tab 切换显示 Trace / Memory / Tasks / Workspace。
+ *
+ * v0.3.0: Tab 状态提升到 ui-store，支持斜杠命令切换标签。
  */
 
-import { useState } from 'react';
 import { Box, Tabs, Tab } from '@mui/material';
 import { Activity, Brain, ListChecks, FolderOpen } from 'lucide-react';
 import { TraceViewer } from '@renderer/components/trace/TraceViewer';
@@ -15,11 +16,16 @@ import { TaskList } from '@renderer/components/tasks/TaskList';
 import { WorkspaceViewer } from '@renderer/components/workspace/WorkspaceViewer';
 import { ErrorBoundary } from '@renderer/components/common/ErrorBoundary';
 import { LAYOUT } from '@renderer/lib/constants';
-
-type DetailTab = 'trace' | 'memory' | 'tasks' | 'workspace';
+import { useUIStore, type DetailTab } from '@renderer/stores/ui-store';
 
 export function DetailPanel(): React.JSX.Element {
-  const [tab, setTab] = useState<DetailTab>('trace');
+  // v0.3.0: 从 ui-store 获取 tab 状态（支持斜杠命令切换）
+  const tab = useUIStore((s) => s.detailTab);
+  const setTab = useUIStore((s) => s.setDetailTab);
+
+  // v0.3.0 修复：验证 tab 值有效性，非预期值回退到 'trace'
+  const validTabs: DetailTab[] = ['trace', 'memory', 'tasks', 'workspace'];
+  const safeTab: DetailTab = validTabs.includes(tab) ? tab : 'trace';
 
   return (
     <Box
@@ -30,8 +36,13 @@ export function DetailPanel(): React.JSX.Element {
       }}
     >
       <Tabs
-        value={tab}
-        onChange={(_, v) => setTab(v as DetailTab)}
+        value={safeTab}
+        onChange={(_, v) => {
+          // v0.3.0 修复：类型安全检查，只接受有效的 tab 值
+          if (typeof v === 'string' && validTabs.includes(v as DetailTab)) {
+            setTab(v as DetailTab);
+          }
+        }}
         variant="fullWidth"
         sx={{
           minHeight: 32, height: 32, flexShrink: 0,
@@ -47,7 +58,7 @@ export function DetailPanel(): React.JSX.Element {
       </Tabs>
 
       <Box sx={{ p: 1.5, flex: 1, display: 'flex', flexDirection: 'column', overflow: 'hidden', minHeight: 0 }}>
-        {tab === 'trace' && (
+        {safeTab === 'trace' && (
           <ErrorBoundary fallbackTitle="Trace 渲染失败">
             <>
               <TraceViewer />
@@ -56,17 +67,17 @@ export function DetailPanel(): React.JSX.Element {
             </>
           </ErrorBoundary>
         )}
-        {tab === 'memory' && (
+        {safeTab === 'memory' && (
           <ErrorBoundary fallbackTitle="Memory 渲染失败">
             <MemoryViewer />
           </ErrorBoundary>
         )}
-        {tab === 'tasks' && (
+        {safeTab === 'tasks' && (
           <ErrorBoundary fallbackTitle="Tasks 渲染失败">
             <TaskList />
           </ErrorBoundary>
         )}
-        {tab === 'workspace' && (
+        {safeTab === 'workspace' && (
           <ErrorBoundary fallbackTitle="Workspace 渲染失败">
             <WorkspaceViewer />
           </ErrorBoundary>

src/hooks/useKeyboardShortcuts.ts

@@ -12,8 +12,15 @@ import { toggleTheme } from './useTheme';
 
 /**
  * 检测是否为 macOS
+ * v0.3.0 修复：navigator.platform 已废弃，改用 userAgentData（Chromium 90+）或降级到 platform
  */
 function isMac(): boolean {
+  // 优先使用 userAgentData.platform（现代 API）
+  const userAgentData = (navigator as Navigator & { userAgentData?: { platform?: string } }).userAgentData;
+  if (userAgentData?.platform) {
+    return userAgentData.platform.toUpperCase().includes('MAC');
+  }
+  // 降级到 navigator.platform（已废弃但仍可用）
   return navigator.platform.toUpperCase().indexOf('MAC') >= 0;
 }
 
@@ -55,6 +62,8 @@ export function useKeyboardShortcuts(): void {
           window.metona.sessions.create().then((result: MetonaSessionInfo) => {
             useSessionStore.getState().addSession(result);
             useSessionStore.getState().setCurrentSession(result.id);
+            // v0.3.0 修复: 同步 agent-store，确保聊天面板清空并加载新会话
+            useAgentStore.getState().setCurrentSession(result.id);
           }).catch((err) => { console.error('[KeyboardShortcuts]', err); });
         }
         e.preventDefault();
@@ -101,7 +110,12 @@ export function useKeyboardShortcuts(): void {
         const { sessions, currentSessionId, setCurrentSession } = useSessionStore.getState();
         if (sessions.length > 0 && currentSessionId) {
           const idx = sessions.findIndex((s) => s.id === currentSessionId);
-          if (idx > 0) setCurrentSession(sessions[idx - 1].id);
+          // v0.3.0 修复: 同步 agent-store，确保聊天面板加载新会话消息
+          if (idx > 0) {
+            const newId = sessions[idx - 1].id;
+            setCurrentSession(newId);
+            useAgentStore.getState().setCurrentSession(newId);
+          }
         }
         e.preventDefault();
         return;
@@ -112,14 +126,25 @@ export function useKeyboardShortcuts(): void {
         const { sessions, currentSessionId, setCurrentSession } = useSessionStore.getState();
         if (sessions.length > 0 && currentSessionId) {
           const idx = sessions.findIndex((s) => s.id === currentSessionId);
-          if (idx < sessions.length - 1) setCurrentSession(sessions[idx + 1].id);
+          // v0.3.0 修复: 同步 agent-store，确保聊天面板加载新会话消息
+          if (idx < sessions.length - 1) {
+            const newId = sessions[idx + 1].id;
+            setCurrentSession(newId);
+            useAgentStore.getState().setCurrentSession(newId);
+          }
         }
         e.preventDefault();
         return;
       }
 
       // Ctrl+Shift+C — 复制最后一条 Agent 回复
+      // v0.3.0 修复：若有任何选中文本（无论是否在输入框），跳过（让浏览器执行默认复制操作）
       if (key === 'c' && matchModifier(e, true, true)) {
+        const selection = window.getSelection();
+        if (selection && selection.toString().length > 0) {
+          // 有选中文本，让浏览器执行默认复制操作
+          return;
+        }
         const { messages } = useAgentStore.getState();
         const lastAssistant = [...messages].reverse().find((m) => m.role === 'assistant');
         if (lastAssistant?.content) {
@@ -128,6 +153,27 @@ export function useKeyboardShortcuts(): void {
         e.preventDefault();
         return;
       }
+
+      // v0.3.0: Ctrl+B — 切换侧边栏
+      if (key === 'b' && matchModifier(e, true)) {
+        useUIStore.getState().toggleSidebar();
+        e.preventDefault();
+        return;
+      }
+
+      // v0.3.0: Ctrl+J — 切换详情面板
+      if (key === 'j' && matchModifier(e, true)) {
+        useUIStore.getState().toggleDetail();
+        e.preventDefault();
+        return;
+      }
+
+      // v0.3.0: Ctrl+Shift+F — 专注模式
+      if (key === 'f' && matchModifier(e, true, true)) {
+        useUIStore.getState().toggleFocusMode();
+        e.preventDefault();
+        return;
+      }
     };
 
     window.addEventListener('keydown', handleKeyDown);

src/lib/constants.ts

@@ -72,7 +72,7 @@ export const SHORTCUTS = {
   SEND_MESSAGE: { key: 'Enter', ctrl: false },
   NEW_LINE: { key: 'Enter', ctrl: true },
   ABORT: { key: '.', ctrl: true },
-  // TODO: implement in future version
+  // v0.3.0: 已实现的面板控制快捷键
   FOCUS_MODE: { key: 'f', ctrl: true, shift: true },
   TOGGLE_SIDEBAR: { key: 'b', ctrl: true },
   TOGGLE_DETAIL: { key: 'j', ctrl: true },

src/stores/agent-store.ts

@@ -144,6 +144,8 @@ export const useAgentStore = create<AgentState>((set, get) => ({
     // 从数据库加载该会话的消息
     if (id && window.metona?.sessions?.getMessages) {
       window.metona.sessions.getMessages(id).then((msgs) => {
+        // v0.3.0 修复: 竞态保护 — 快速切换会话时，旧请求返回后不再覆盖当前会话消息
+        if (get().currentSessionId !== id) return;
         const messages = (msgs as Array<{
           id: string; role: string; content: string;
           reasoningContent?: string; toolCalls?: unknown[];
@@ -168,6 +170,8 @@ export const useAgentStore = create<AgentState>((set, get) => ({
     // 从数据库加载该会话的 trace 步骤和 token 用量
     if (id && window.metona?.sessions?.getTrace) {
       window.metona.sessions.getTrace(id).then((data) => {
+        // v0.3.0 修复: 竞态保护 — 快速切换会话时，旧请求返回后不再覆盖当前会话 trace
+        if (get().currentSessionId !== id) return;
         if (data) {
           if (data.traceSteps) {
             // 兼容旧数据：为缺少 id/states 的 trace 步骤补全
@@ -210,6 +214,8 @@ export const useAgentStore = create<AgentState>((set, get) => ({
         });
         sessionId = session.id;
         set({ currentSessionId: sessionId });
+        // v0.3.0 修复: 同步 session-store，确保 Sidebar 高亮和 Ctrl+[/] 可用
+        useSessionStore.getState().setCurrentSession(sessionId);
       } catch (err) {
         console.error('[AgentStore]', 'Failed to create session:', err);
         set({ agentStatus: 'error', isStreaming: false });

src/stores/ui-store.ts

@@ -2,12 +2,20 @@
  * Zustand Store — UI 状态管理
  *
  * 主题、设置弹窗、引导向导等全局 UI 状态。
+ *
+ * v0.3.0 增强：
+ * - 添加详情面板标签控制（detailTab）— 支持斜杠命令切换标签
+ * - 添加侧边栏/详情面板可见性控制 — 支持快捷键切换
+ * - 添加专注模式 — 隐藏侧边栏和详情面板
  */
 
 import { create } from 'zustand';
 
 export type ThemeMode = 'dark' | 'light' | 'auto';
 
+/** v0.3.0: 详情面板标签类型 */
+export type DetailTab = 'trace' | 'memory' | 'tasks' | 'workspace';
+
 interface UIState {
   // 主题
   theme: ThemeMode;
@@ -17,12 +25,30 @@ interface UIState {
   settingsOpen: boolean;
   onboardingCompleted: boolean;
 
+  // v0.3.0: 面板可见性
+  sidebarVisible: boolean;
+  detailVisible: boolean;
+  focusMode: boolean;
+
+  // v0.3.0: 详情面板标签
+  detailTab: DetailTab;
+
+  // v0.3.0: 进入专注模式前的面板状态快照（用于恢复）
+  preFocusSidebarVisible: boolean;
+  preFocusDetailVisible: boolean;
+
   // Actions
   setTheme: (theme: ThemeMode) => void;
   setResolvedTheme: (theme: 'dark' | 'light') => void;
   openSettings: () => void;
   closeSettings: () => void;
   setOnboardingCompleted: (completed: boolean) => void;
+
+  // v0.3.0: 面板控制 Actions
+  setDetailTab: (tab: DetailTab) => void;
+  toggleSidebar: () => void;
+  toggleDetail: () => void;
+  toggleFocusMode: () => void;
 }
 
 export const useUIStore = create<UIState>((set) => ({
@@ -31,9 +57,48 @@ export const useUIStore = create<UIState>((set) => ({
   settingsOpen: false,
   onboardingCompleted: false,
 
+  // v0.3.0: 面板默认可见
+  sidebarVisible: true,
+  detailVisible: true,
+  focusMode: false,
+  detailTab: 'trace',
+  preFocusSidebarVisible: true,
+  preFocusDetailVisible: true,
+
   setTheme: (theme) => set({ theme }),
   setResolvedTheme: (resolvedTheme) => set({ resolvedTheme }),
   openSettings: () => set({ settingsOpen: true }),
   closeSettings: () => set({ settingsOpen: false }),
   setOnboardingCompleted: (completed) => set({ onboardingCompleted: completed }),
+
+  // v0.3.0: 面板控制
+  setDetailTab: (tab) => set({ detailTab }),
+  // 退出专注模式时恢复快照（若用户在专注模式下手动切换面板，视为退出专注模式）
+  // v0.3.0 修复: 退出专注模式时同时恢复另一个面板的快照，与 toggleFocusMode 关闭逻辑一致
+  toggleSidebar: () => set((s) => s.focusMode
+    ? { sidebarVisible: !s.sidebarVisible, detailVisible: s.preFocusDetailVisible, focusMode: false }
+    : { sidebarVisible: !s.sidebarVisible }),
+  toggleDetail: () => set((s) => s.focusMode
+    ? { detailVisible: !s.detailVisible, sidebarVisible: s.preFocusSidebarVisible, focusMode: false }
+    : { detailVisible: !s.detailVisible }),
+  // v0.3.0 修复：专注模式开启时保存当前面板状态快照，关闭时恢复快照
+  // 避免关闭时强制设为 true 覆盖用户进入专注模式前的原有状态
+  toggleFocusMode: () => set((s) => {
+    if (!s.focusMode) {
+      // 开启专注模式：保存快照，隐藏面板
+      return {
+        focusMode: true,
+        preFocusSidebarVisible: s.sidebarVisible,
+        preFocusDetailVisible: s.detailVisible,
+        sidebarVisible: false,
+        detailVisible: false,
+      };
+    }
+    // 关闭专注模式：恢复快照
+    return {
+      focusMode: false,
+      sidebarVisible: s.preFocusSidebarVisible,
+      detailVisible: s.preFocusDetailVisible,
+    };
+  }),
 }));