fix: 安全加固+性能优化+边界修复

- /api/label: 使用 readBody 限制请求体 + safeWindowId 防注入 + label 长度限制100
- setBoardColor: 颜色白名单校验，防止 CSS 注入
- confirmBoardTitle: 长度限制100 + 成功后同步 data-original
- cancelBoardEditTitle: 恢复输入框原始值，防止空值残留
- launchSSHPresets: getWindows 调用从2N次优化为2次
- renderLayouts: displayCols 除零保护 + displayRows 修正

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: zzmlb

lib/panel.js

@@ -400,6 +400,12 @@ function launchSSHPresets(presetIds) {
   const launched = [];
   const presetWindowMap = {};
 
+  // 启动前记录一次窗口集合（避免每个预设都调用 AppleScript）
+  let beforeIds;
+  try {
+    beforeIds = new Set(getWindows().map(w => w.id));
+  } catch { beforeIds = new Set(); }
+
   for (const pid of presetIds) {
     const preset = presets[pid];
     if (!preset) continue;
@@ -409,12 +415,6 @@ function launchSSHPresets(presetIds) {
     const dir = (preset.directory || '').replace(/'/g, "'\\''");
     const cmd = (preset.command || '').replace(/'/g, "'\\''");
 
-    // 记录启动前的窗口 ID 集合
-    let beforeIds;
-    try {
-      beforeIds = new Set(getWindows().map(w => w.id));
-    } catch { beforeIds = new Set(); }
-
     if (conn.type === 'local') {
       let localCmd = '';
       if (dir && cmd) localCmd = `cd '${dir}' && ${cmd}`;
@@ -454,18 +454,21 @@ function launchSSHPresets(presetIds) {
       } catch {}
     }
 
-    // 启动后找出新增的窗口 ID
-    try {
-      const afterWindows = getWindows();
-      for (const w of afterWindows) {
-        if (!beforeIds.has(w.id)) {
-          presetWindowMap[pid] = w.id;
-          break;
-        }
-      }
-    } catch {}
   }
 
+  // 启动后统一获取一次新窗口列表，找出所有新增窗口
+  try {
+    const afterWindows = getWindows();
+    const newWindowIds = afterWindows.filter(w => !beforeIds.has(w.id)).map(w => w.id);
+    // 按顺序将新窗口分配给各预设
+    let ni = 0;
+    for (const pid of presetIds) {
+      if (ni < newWindowIds.length && launched.includes(presets[pid]?.name)) {
+        presetWindowMap[pid] = newWindowIds[ni++];
+      }
+    }
+  } catch {}
+
   return { ok: true, launched, presetWindowMap };
 }
 
@@ -954,8 +957,8 @@ function renderLayouts(wc){
     var maxCells=Math.min(wc,12);
     var cells='';for(var i=0;i<maxCells;i++)cells+='<div class="layout-cell">'+(NUM[i]||i+1)+'</div>';
     if(wc>12)cells+='<div class="layout-cell">+' +(wc-12)+'</div>';
-    var displayCols=wc>12?Math.min(cols,cols):cols;
-    var displayRows=wc>12?Math.ceil((maxCells+1)/displayCols):rows;
+    var displayCols=cols||1;
+    var displayRows=wc>12?Math.ceil((maxCells+1)/displayCols):Math.ceil(wc/displayCols);
     var gridH=Math.max(48,Math.min(80,displayRows*16));
     return '<div class="layout-card'+act+'" onclick="selectLayout(\\''+l.id+'\\','+l.cols+')"><div class="layout-grid" style="grid-template-columns:repeat('+displayCols+',1fr);height:'+gridH+'px">'+cells+'</div><div class="layout-name">'+l.name+(l.cols?' ('+rows+'x'+cols+')':'')+'</div></div>';
   }).join('')+'<div class="layout-actions"><button class="btn primary" onclick="applyLayout()" '+(selectedLayout?'':'disabled')+'>应用排布</button><button class="btn" onclick="bringToFront()">显示终端</button></div>';
@@ -1601,7 +1604,7 @@ function renderBoard(){
     var colorBar='<div class="bn-color-bar" style="background:'+color+'">';
     BOARD_COLORS.forEach(function(c){colorBar+='<div class="bn-cswatch" style="background:'+c+'" onclick="event.stopPropagation();setBoardColor(\\''+escA(w.id)+'\\',\\''+c+'\\')"></div>'});
     colorBar+='</div>';
-    html+='<div class="board-node state-'+sc+'" data-winid="'+escA(w.id)+'" style="left:'+x+'px;top:'+y+'px;border-left:4px solid '+color+'" onmousedown="startNodeDrag(event,\\''+escA(w.id)+'\\')" ondblclick="onBoardNodeDblClick(event,\\''+escA(w.id)+'\\')"><div class="bn-header"><span class="bn-idx">'+(NUM[si-1]||si)+'</span><input class="bn-title" value="'+escA(titleText)+'" data-winid="'+escA(w.id)+'" readonly ondblclick="event.stopPropagation();startBoardEditTitle(this)" onkeydown="onBoardTitleKey(event,this)" onblur="cancelBoardEditTitle(this)"><span class="bn-dot dot '+dotCls+'"></span><span class="bn-stag '+sc+'">'+stLabel+'</span></div><div class="bn-preview">'+preview+'</div>'+colorBar+'</div>';
+    html+='<div class="board-node state-'+sc+'" data-winid="'+escA(w.id)+'" style="left:'+x+'px;top:'+y+'px;border-left:4px solid '+color+'" onmousedown="startNodeDrag(event,\\''+escA(w.id)+'\\')" ondblclick="onBoardNodeDblClick(event,\\''+escA(w.id)+'\\')"><div class="bn-header"><span class="bn-idx">'+(NUM[si-1]||si)+'</span><input class="bn-title" value="'+escA(titleText)+'" data-winid="'+escA(w.id)+'" data-original="'+escA(titleText)+'" readonly ondblclick="event.stopPropagation();startBoardEditTitle(this)" onkeydown="onBoardTitleKey(event,this)" onblur="cancelBoardEditTitle(this)"><span class="bn-dot dot '+dotCls+'"></span><span class="bn-stag '+sc+'">'+stLabel+'</span></div><div class="bn-preview">'+preview+'</div>'+colorBar+'</div>';
     usedPositions[w.id]={x:x,y:y};
   });
 
@@ -1802,6 +1805,7 @@ function resetBoardLayout(){
 
 // --- 底部色条颜色选择 ---
 function setBoardColor(winId,color){
+  if(BOARD_COLORS.indexOf(color)<0)return;
   var node=document.querySelector('.board-node[data-winid="'+winId+'"]');
   if(!node)return;
   if(!boardData.nodes[winId])boardData.nodes[winId]={x:parseInt(node.style.left)||0,y:parseInt(node.style.top)||0};
@@ -1819,16 +1823,18 @@ function startBoardEditTitle(inp){
   inp.select();
 }
 function confirmBoardTitle(inp){
-  var label=inp.value.trim();
+  var label=inp.value.trim().slice(0,100);
   if(!label){cancelBoardEditTitle(inp);return}
   inp.readOnly=true;
+  inp.dataset.original=label;
   var winId=inp.dataset.winid;
   fetch('/api/label',{method:'POST',headers:{'Content-Type':'application/json'},
     body:JSON.stringify({windowId:winId,label:label})
   }).catch(function(){});
 }
 function cancelBoardEditTitle(inp){
   if(inp.readOnly)return;
+  inp.value=inp.dataset.original||'';
   inp.readOnly=true;
 }
 function onBoardTitleKey(e,inp){
@@ -1980,18 +1986,20 @@ export async function startPanel(port) {
     }
 
     if (url.pathname === '/api/label' && req.method === 'POST') {
-      let body = '';
-      req.on('data', d => body += d);
-      req.on('end', async () => {
+      readBody(req, async (body) => {
         try {
           const { windowId, label, stableIndex, index } = JSON.parse(body);
+          // 安全：校验 windowId + 限制 label 长度
+          const safeLabel = String(label || '').slice(0, 100);
+          if (!safeLabel) { res.writeHead(400); res.end('empty label'); return; }
           if (windowId) {
-            // 优先使用窗口 ID（稳定，不受焦点影响）
-            await labelWindowById(windowId, label, stableIndex || 1);
+            const wid = safeWindowId(windowId);
+            if (!wid) { res.writeHead(400); res.end('invalid windowId'); return; }
+            await labelWindowById(wid, safeLabel, stableIndex || 1);
           } else {
-            await labelWindow(index, label, { displayIndex: stableIndex || index });
+            await labelWindow(index, safeLabel, { displayIndex: stableIndex || index });
           }
-          _statusCache = null; // 清缓存让前端立即看到新标签
+          _statusCache = null;
           res.writeHead(200, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ ok: true }));
         } catch { res.writeHead(400); res.end('bad request'); }