fix: stabilize gateway upgrades and version sync

Author: javazys

AGENTS.md

@@ -58,7 +58,7 @@ bun run dev -- db check  # 检查数据库完整性与业务统计
 - PM2 替换已有 Gateway 前必须先用保存的运行环境验证管理命令可执行；若新旧进程无法共用同一可回滚的 PM2 管理路径，必须在删除旧进程前失败关闭。
 - PM2 替换、数据库维护、卸载与 macOS supervisor 检查必须先共用 `PM2_HOME/supertask-gateway.manage.sqlite` canonical SQLite 事务锁；兼容旧 custom lock 时还必须从 PM2 dump/运行环境和 LaunchAgent 恢复全部旧路径，并按固定顺序同时持有，不能因后续 CLI 缺少旧环境变量而绕过旧 supervisor。已安装 LaunchAgent 的 `PM2_HOME` 与当前 CLI 不同必须在任何修改前失败关闭，避免两个 PM2 daemon 争用同一 Gateway。不得恢复 PID/stale 文件锁。PM2 kill timeout 不得低于 Worker shutdown grace 加 15 秒，`stop/delete` 命令 timeout 不得低于实际 kill timeout 加 5 秒，管理锁必须持有到命令返回；显式低值必须在删除旧进程前失败关闭。
 - macOS supervisor 只有在 `jlist` 成功且确认 Gateway 缺失、同时 `dump.pm2` 明确包含 Gateway 时才可 `resurrect`；状态未知、`errored`、`stopped` 和卸载后的空 dump 都不得触发重启。卸载必须停止并移除项目 LaunchAgent。
-- `/health` 必须分别反映 Worker、Scheduler、Watchdog 和历史清理的活跃度与连续失败；`supertask doctor` 还要解析 OpenCode 最终配置，要求唯一的精确插件版本，核对对应缓存、PM2 实际 Gateway 入口包和 ready 锁版本，并验证 macOS LaunchAgent 与 PM2 dump 可恢复性。浮动 `@latest`/`@next` Gateway 入口必须失败；全局 CLI 版本不同只提示按原包管理器更新。PM2 替换/回滚必须保留既有 Bun 路径、完整运行环境和数据库作用域。
+- `/health` 必须分别反映 Worker、Scheduler、Watchdog 和历史清理的活跃度与连续失败；`supertask doctor` 还要解析 OpenCode 最终配置，要求唯一的精确插件版本，核对对应缓存、全局 CLI、PM2 实际 Gateway 入口包和 ready 锁版本，并验证 macOS LaunchAgent 与 PM2 dump 可恢复性。浮动 `@latest`/`@next` 入口或任一组件版本不一致必须失败。升级成功替换插件和 Gateway 后必须检测全局 CLI 的 npm/Bun 安装来源并同步精确版本；无法确认时返回明确的部分失败和人工命令。PM2 自动替换/恢复必须保留既有 Bun 路径、完整运行环境和数据库作用域。用户显式执行 `install` / `upgrade` 时，目标 Gateway 可从当前终端刷新 OpenCode、XDG 与 Provider 执行环境，但必须固定旧 `HOME`、`PATH`、`PM2_HOME`、全部 `SUPERTASK_*`、Bun 路径、cwd 和数据库/配置作用域；失败回滚必须使用未修改的完整旧环境。
 - 数据库检查、备份、清空和恢复统一经过 `DatabaseMaintenanceService`；CLI 清空/恢复必须显式确认并拒绝运行中任务，且只可自动停启 PID 与当前数据库新鲜 ready 锁一致的 PM2 Gateway；前台或无法确认归属的进程必须拒绝误杀。清空/恢复前必须自动创建校验通过的安全备份；清空必须动态删除全部业务表数据（包括 N+1 expand-only 表），通过延迟外键检查支持循环依赖，并保留 `gateway_lock` 与 migration 元数据。恢复来源必须从已打开的 SQLite 连接生成包含已提交 WAL 页的一致快照，并拒绝当前数据库的符号链接/硬链接别名。恢复必须动态校验 source/live 业务表和可写列：source-only 未知表/列在删除前失败关闭，共有未来列完整复制，live-only 列只允许可空/默认值且 live-only 新表必须清空，避免 N/N-1 形成混合时间点；随后在当前连接的排他事务内原位替换，不得关闭连接后 rename 换库。默认在操作失败时也恢复原 Gateway 状态，`--keep-stopped` 除外。
 - Dashboard 清空只能豁免当前 Gateway PID，仍必须服务端确认、拒绝运行中任务并在同一事务内先备份后动态删除全部业务表；不得恢复为路由内直接 `DELETE` 的实现。
 - Dashboard 的浏览器写请求必须通过同源检查，数据库字符串进入 HTML 前必须调用 `esc`；API 的 ID、状态和配置不得直接断言类型。

CHANGELOG.md

@@ -0,0 +1,44 @@
+# Changelog
+
+All notable user-facing changes are recorded here. This project follows semantic versioning while it is in the `0.x` development series.
+
+## [0.1.34] - 2026-07-18
+
+### Fixed
+
+- Explicit `supertask install` and `supertask upgrade` now refresh the Gateway's OpenCode, XDG, and model-provider execution environment from the invoking terminal. PM2 identity, Bun, `HOME`, `PATH`, all `SUPERTASK_*` scope, database/config paths, and the complete rollback runtime remain pinned.
+- Failed Worker runs now record the effective Agent, model source, and working directory next to the OpenCode exit code, making terminal-vs-Gateway differences diagnosable.
+- `supertask doctor` now fails when the global CLI, exact OpenCode plugin, PM2 Gateway package, and ready-lock versions do not all match.
+
+### Added
+
+- CLI help and interactive `doctor` / database summaries support `auto`, `zh-CN`, and `en` through `--lang` or `SUPERTASK_LANG`.
+- Upgrade now detects whether the installed global CLI came from npm or Bun and synchronizes it to the same exact version after the plugin and Gateway are ready.
+- README and operations guidance now cover custom primary Agent troubleshooting and execution-environment refresh behavior in both user languages.
+
+### Compatibility
+
+- JSON field names and raw backend diagnostic errors are unchanged; language selection only affects human-facing help and summaries.
+
+## [0.1.33] - 2026-07-18
+
+This release contains the full 0.1.32 change set plus a deterministic database-restore concurrency regression test. It is the stable upgrade target after 0.1.31.
+
+### Fixed
+
+- Pinned plugin installation and Gateway launch to one exact npm version, rejecting stale floating `@latest` / `@next` cache entries and invalid file-as-directory working paths.
+- Recorded and validated task working directories before queueing so Gateway-launched OpenCode runs execute in the submitting project.
+- Hardened launcher/Worker IPC with a per-run guardian token and bidirectional drain proof; unknown or still-live process trees remain quarantined instead of being settled or retried unsafely.
+- Made database clear/restore backup-first, transactional, WAL-consistent, schema-compatible across expand-only N/N-1 releases, and safe against concurrent successful writes.
+- Hardened PM2 replacement, rollback, lifecycle locking, kill timeouts, macOS restart supervision, and Bun 1.1.45 IPC compatibility.
+
+### Added
+
+- Project-directory grouping, project statistics, task creation/editing, priority/model controls, and project running-state visibility in the Web Dashboard.
+- Web creation/editing for cron, delayed, and recurring tasks; “Run now” always creates a normal queued task and waits behind the global concurrency limit.
+- PM2-backed “save and restart” configuration flow, light/dark/system themes, Chinese/English Web UI, and mobile layout.
+- Global same-`batchId` serialization across projects and Gateway restarts, while independent batches can execute concurrently.
+- Safe task deletion, dependency-aware retry, legacy quarantined-run recovery tooling, and stronger end-to-end diagnostics.
+
+[0.1.34]: https://github.com/vbgate/opencode-supertask/compare/v0.1.33...v0.1.34
+[0.1.33]: https://github.com/vbgate/opencode-supertask/compare/v0.1.31...v0.1.33