@agent-native/core 0.79.25 → 0.79.27

package/docs/content/locales/zh-CN/progress.mdx

@@ -41,13 +41,55 @@ await completeRun(run.id, run.owner, "succeeded");
 | `failed`    | 错误终端                  |
 | `cancelled` | 用户中断                  |
 
-```an-diagram title="运行生命周期" summary="startRun 打开一个运行行； updateRunProgress 修补它； completeRun 将其移至一种终端状态并标记 completed_at。"
-{
-  "html": "<div class=\"diagram-run\"><div class=\"diagram-box\" data-rough>startRun()</div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-panel running\" data-rough><span class=\"diagram-pill accent\">running</span><small class=\"diagram-muted\">updateRunProgress() &#8635; percent + step</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-col terminal\"><span class=\"diagram-pill ok\">succeeded</span><span class=\"diagram-pill warn\">failed</span><span class=\"diagram-pill\">cancelled</span><small class=\"diagram-muted\">completeRun() &rarr; sets completed_at</small></div></div>",
-  "css": ".diagram-run{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.diagram-run .diagram-panel{display:flex;flex-direction:column;gap:6px;padding:12px 16px}.diagram-run .terminal{display:flex;flex-direction:column;gap:6px;align-items:flex-start}.diagram-run .diagram-arrow{font-size:22px;line-height:1}"
+<Diagram id="doc-block-jtjrxw" title={"运行生命周期"} summary={"startRun 打开一个运行行； updateRunProgress 修补它； completeRun 将其移至一种终端状态并标记 completed_at。"}>
+
+```html
+<div class="diagram-run">
+  <div class="diagram-box" data-rough>startRun()</div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-panel running" data-rough>
+    <span class="diagram-pill accent">running</span
+    ><small class="diagram-muted"
+      >updateRunProgress() &#8635; percent + step</small
+    >
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-col terminal">
+    <span class="diagram-pill ok">succeeded</span
+    ><span class="diagram-pill warn">failed</span
+    ><span class="diagram-pill">cancelled</span
+    ><small class="diagram-muted">completeRun() &rarr; sets completed_at</small>
+  </div>
+</div>
+```
+
+```css
+.diagram-run {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  flex-wrap: wrap;
+}
+.diagram-run .diagram-panel {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  padding: 12px 16px;
+}
+.diagram-run .terminal {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  align-items: flex-start;
+}
+.diagram-run .diagram-arrow {
+  font-size: 22px;
+  line-height: 1;
 }
 ```
 
+</Diagram>
+
 终端状态设置为 `completed_at`。 UI 托盘仅显示 `running` 行；完成的行保留在数据库中以供 `action=list` 查询。
 
 ## API {#api}

package/docs/content/locales/zh-CN/pure-agent-apps.mdx

@@ -12,13 +12,55 @@ description: "代理是整个产品的应用程序：应用程序代理循环是
 属于。它仍然是一个真实的应用程序：actions、会话、应用程序状态、历史记录，
 设置、凭据和共享记录均位于 SQL 中。
 
-```an-diagram title="应用程序代理循环是前门" summary="许多入口点通过 SQL-backed 操作和状态到达一个代理循环；结果返回到请求来自的地方。仅当需要人类监督时才添加 UI。"
-{
-  "html": "<div class=\"diagram-pure\"><div class=\"diagram-col\"><div class=\"diagram-pill\">Terminal</div><div class=\"diagram-pill\">Slack · 邮件</div><div class=\"diagram-pill\">定时任务</div><div class=\"diagram-pill\">Another agent (A2A)</div><div class=\"diagram-pill\">Chat</div></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-panel center\" data-rough><span class=\"diagram-pill accent\">应用代理循环</span><small class=\"diagram-muted\">操作 · 会话 · SQL 中的应用状态</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-box\" data-rough>结果返回<br><small class=\"diagram-muted\">to where it belongs</small></div></div>",
-  "css": ".diagram-pure{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.diagram-pure .diagram-col{display:flex;flex-direction:column;gap:8px}.diagram-pure .diagram-arrow{font-size:22px;line-height:1}.diagram-pure .center{display:flex;flex-direction:column;align-items:center;gap:4px}"
+<Diagram id="doc-block-3r5jvj" title={"应用程序代理循环是前门"} summary={"许多入口点通过 SQL-backed 操作和状态到达一个代理循环；结果返回到请求来自的地方。仅当需要人类监督时才添加 UI。"}>
+
+```html
+<div class="diagram-pure">
+  <div class="diagram-col">
+    <div class="diagram-pill">Terminal</div>
+    <div class="diagram-pill">Slack · 邮件</div>
+    <div class="diagram-pill">定时任务</div>
+    <div class="diagram-pill">Another agent (A2A)</div>
+    <div class="diagram-pill">Chat</div>
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-panel center" data-rough>
+    <span class="diagram-pill accent">应用代理循环</span
+    ><small class="diagram-muted">操作 · 会话 · SQL 中的应用状态</small>
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-box" data-rough>
+    结果返回<br /><small class="diagram-muted">to where it belongs</small>
+  </div>
+</div>
+```
+
+```css
+.diagram-pure {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  flex-wrap: wrap;
+}
+.diagram-pure .diagram-col {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.diagram-pure .diagram-arrow {
+  font-size: 22px;
+  line-height: 1;
+}
+.diagram-pure .center {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 4px;
 }
 ```
 
+</Diagram>
+
 当工作在后台运行时，达到此形状，输出离开
 应用程序，域是一次性的，或者您正在制作原型。代理仍然需要 UI —
 不是仪表板，而是人类监督、配置和引导它的地方 -

package/docs/content/locales/zh-CN/real-time-collaboration.mdx

@@ -36,13 +36,53 @@ description: "多用户协作编辑，其中 AI 代理是一流的同行：CRDT
 
 协作系统有五个互锁层。
 
-```an-diagram title="五层互锁" summary="从内存中的 CRDT 到在对等点之间传送更新的传输 — 每一层都有一项工作。"
-{
-  "html": "<div class=\"diagram-stack\"><div class=\"diagram-card layer\"><span class=\"diagram-pill accent\">1 &middot; Yjs Y.Doc</span><small class=\"diagram-muted\">CRDT &mdash; 无冲突合并，无协调器</small></div><div class=\"diagram-card layer\"><span class=\"diagram-pill\">2 &middot; SQL 规范内容</span><small class=\"diagram-muted\">_collab_docs &mdash; durable source of truth, versioned</small></div><div class=\"diagram-card layer\"><span class=\"diagram-pill\">3 &middot; 由 updatedAt 门控的对账</span><small class=\"diagram-muted\">代理编辑通过 SQL 更新时间传播</small></div><div class=\"diagram-card layer\"><span class=\"diagram-pill\">4 &middot; 主客户端选举</span><small class=\"diagram-muted\">恰好一个标签页应用快照</small></div><div class=\"diagram-card layer\"><span class=\"diagram-pill ok\">5 &middot; SSE 快速路径 + 轮询</span><small class=\"diagram-muted\">约几十毫秒，任何地方都可降级为 2 秒轮询</small></div></div>",
-  "css": ".diagram-stack{display:flex;flex-direction:column;gap:8px}.diagram-stack .layer{display:flex;flex-direction:column;gap:4px;padding:12px 14px}"
+<Diagram id="doc-block-ilxaw7" title={"五层互锁"} summary={"从内存中的 CRDT 到在对等点之间传送更新的传输 — 每一层都有一项工作。"}>
+
+```html
+<div class="diagram-stack">
+  <div class="diagram-card layer">
+    <span class="diagram-pill accent">1 &middot; Yjs Y.Doc</span
+    ><small class="diagram-muted">CRDT &mdash; 无冲突合并，无协调器</small>
+  </div>
+  <div class="diagram-card layer">
+    <span class="diagram-pill">2 &middot; SQL 规范内容</span
+    ><small class="diagram-muted"
+      >_collab_docs &mdash; durable source of truth, versioned</small
+    >
+  </div>
+  <div class="diagram-card layer">
+    <span class="diagram-pill">3 &middot; 由 updatedAt 门控的对账</span
+    ><small class="diagram-muted">代理编辑通过 SQL 更新时间传播</small>
+  </div>
+  <div class="diagram-card layer">
+    <span class="diagram-pill">4 &middot; 主客户端选举</span
+    ><small class="diagram-muted">恰好一个标签页应用快照</small>
+  </div>
+  <div class="diagram-card layer">
+    <span class="diagram-pill ok">5 &middot; SSE 快速路径 + 轮询</span
+    ><small class="diagram-muted"
+      >约几十毫秒，任何地方都可降级为 2 秒轮询</small
+    >
+  </div>
+</div>
+```
+
+```css
+.diagram-stack {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.diagram-stack .layer {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  padding: 12px 14px;
 }
 ```
 
+</Diagram>
+
 ### 1。 Yjs Y.Doc（CRDT层）
 
 每个协作文档都是一个包含共享类型的 `Y.Doc` — 通常是
@@ -100,13 +140,63 @@ gate 确保仅采用真正较新的内容 - 滞后的民意调查响应
 
 网络错误使用带抖动的指数退避，上限约为 15 秒。
 
-```an-diagram title="两条编辑路径，一条合并" summary="人类击键流程 Y.Doc → 服务器 → SSE。代理编辑经过 SQL：操作在更新时发生碰撞，主要客户进行协调，然后更改重新进入 Yjs。"
-{
-  "html": "<div class=\"diagram-collab\"><div class=\"lane\"><span class=\"diagram-pill\">人工编辑</span><div class=\"diagram-node\">Y.Doc update<br><small class=\"diagram-muted\">debounce 约 80ms</small></div><span class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</span><div class=\"diagram-box\" data-rough>POST /update<br><small class=\"diagram-muted\">apply + persist</small></div><span class=\"diagram-arrow diagram-accent\" aria-hidden=\"true\">&rarr;</span><div class=\"diagram-box diagram-accent\">SSE push<br><small class=\"diagram-muted\">to all peers</small></div></div><div class=\"lane\"><span class=\"diagram-pill warn\">代理编辑</span><div class=\"diagram-node\">Action 写入 SQL<br><small class=\"diagram-muted\">更新 updatedAt</small></div><span class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</span><div class=\"diagram-box\" data-rough>主客户端<br><small class=\"diagram-muted\">setContent 写入 Y.Doc</small></div><span class=\"diagram-arrow diagram-accent\" aria-hidden=\"true\">&rarr;</span><div class=\"diagram-box diagram-accent\">POST /update<br><small class=\"diagram-muted\">re-enters Yjs &middot; SSE push</small></div></div></div>",
-  "css": ".diagram-collab{display:flex;flex-direction:column;gap:14px}.diagram-collab .lane{display:flex;align-items:center;gap:10px;flex-wrap:wrap}.diagram-collab .diagram-arrow{font-size:22px;line-height:1}"
+<Diagram id="doc-block-1oqvb9x" title={"两条编辑路径，一条合并"} summary={"人类击键流程 Y.Doc → 服务器 → SSE。代理编辑经过 SQL：操作在更新时发生碰撞，主要客户进行协调，然后更改重新进入 Yjs。"}>
+
+```html
+<div class="diagram-collab">
+  <div class="lane">
+    <span class="diagram-pill">人工编辑</span>
+    <div class="diagram-node">
+      Y.Doc update<br /><small class="diagram-muted">debounce 约 80ms</small>
+    </div>
+    <span class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</span>
+    <div class="diagram-box" data-rough>
+      POST /update<br /><small class="diagram-muted">apply + persist</small>
+    </div>
+    <span class="diagram-arrow diagram-accent" aria-hidden="true">&rarr;</span>
+    <div class="diagram-box diagram-accent">
+      SSE push<br /><small class="diagram-muted">to all peers</small>
+    </div>
+  </div>
+  <div class="lane">
+    <span class="diagram-pill warn">代理编辑</span>
+    <div class="diagram-node">
+      Action 写入 SQL<br /><small class="diagram-muted">更新 updatedAt</small>
+    </div>
+    <span class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</span>
+    <div class="diagram-box" data-rough>
+      主客户端<br /><small class="diagram-muted">setContent 写入 Y.Doc</small>
+    </div>
+    <span class="diagram-arrow diagram-accent" aria-hidden="true">&rarr;</span>
+    <div class="diagram-box diagram-accent">
+      POST /update<br /><small class="diagram-muted"
+        >re-enters Yjs &middot; SSE push</small
+      >
+    </div>
+  </div>
+</div>
+```
+
+```css
+.diagram-collab {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+.diagram-collab .lane {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+.diagram-collab .diagram-arrow {
+  font-size: 22px;
+  line-height: 1;
 }
 ```
 
+</Diagram>
+
 ## 快速入门 {#quickstart}
 
 ### 1。安装包

package/docs/content/locales/zh-CN/recurring-jobs.mdx

@@ -113,13 +113,68 @@ Summarize overnight emails.`,
 
 调度程序是一个在进程中运行的框架插件（内部 `processRecurringJobs()` 例程）：无论服务器在何处运行，代理聊天插件内的 `setInterval` 每 60 秒触发一次（有 10 秒的启动延迟）。
 
-```an-diagram title="一个调度程序勾选" summary="每 60 秒，调度程序就会找到到期的作业，将每个作业作为新的代理线程运行，并将结果写回作业文件。"
-{
-  "html": "<div class=\"sched\"><div class=\"diagram-box accent\"><code>setInterval</code> &bull; 60s &#8635;</div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&darr;</div><div class=\"diagram-card\"><span class=\"diagram-pill\">1 &middot; scan</span><small class=\"diagram-muted\">list every enabled <code>jobs/*.md</code> across all owners</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&darr;</div><div class=\"diagram-card\"><span class=\"diagram-pill\">2 &middot; due?</span><small class=\"diagram-muted\">compare <code>nextRun</code> to now</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&darr;</div><div class=\"diagram-card accent\"><span class=\"diagram-pill accent\">3 &middot; run</span><small class=\"diagram-muted\">fresh agent thread, job body as the user message &mdash; actions, SQL, A2A, email</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&darr;</div><div class=\"diagram-card ok\"><span class=\"diagram-pill ok\">4 &middot; record</span><small class=\"diagram-muted\">write <code>lastRun</code> / <code>lastStatus</code> / <code>lastError</code>, recompute <code>nextRun</code></small></div></div>",
-  "css": ".sched{display:flex;flex-direction:column;gap:6px;max-width:520px}.sched .diagram-card{display:flex;flex-direction:column;gap:2px;padding:10px 14px}.sched .diagram-box{align-self:flex-start}.sched .diagram-arrow{font-size:18px;align-self:center}"
+<Diagram id="doc-block-1u2v87h" title={"一个调度程序勾选"} summary={"每 60 秒，调度程序就会找到到期的作业，将每个作业作为新的代理线程运行，并将结果写回作业文件。"}>
+
+```html
+<div class="sched">
+  <div class="diagram-box accent">
+    <code>setInterval</code> &bull; 60s &#8635;
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>
+  <div class="diagram-card">
+    <span class="diagram-pill">1 &middot; scan</span
+    ><small class="diagram-muted"
+      >list every enabled <code>jobs/*.md</code> across all owners</small
+    >
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>
+  <div class="diagram-card">
+    <span class="diagram-pill">2 &middot; due?</span
+    ><small class="diagram-muted">compare <code>nextRun</code> to now</small>
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>
+  <div class="diagram-card accent">
+    <span class="diagram-pill accent">3 &middot; run</span
+    ><small class="diagram-muted"
+      >fresh agent thread, job body as the user message &mdash; actions, SQL,
+      A2A, email</small
+    >
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&darr;</div>
+  <div class="diagram-card ok">
+    <span class="diagram-pill ok">4 &middot; record</span
+    ><small class="diagram-muted"
+      >write <code>lastRun</code> / <code>lastStatus</code> /
+      <code>lastError</code>, recompute <code>nextRun</code></small
+    >
+  </div>
+</div>
+```
+
+```css
+.sched {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  max-width: 520px;
+}
+.sched .diagram-card {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  padding: 10px 14px;
+}
+.sched .diagram-box {
+  align-self: flex-start;
+}
+.sched .diagram-arrow {
+  font-size: 18px;
+  align-self: center;
 }
 ```
 
+</Diagram>
+
 <Callout id="doc-block-j6yn07" tone="risk">
 
 **Scale-to-zero caveat.** The scheduler is in-process, so on serverless hosts jobs only fire while an instance is warm. If reliable scheduling matters, keep an instance warm with keep-alive pings or use an always-on host (Fly, Render, a VPS).

package/docs/content/locales/zh-CN/routing.mdx

@@ -21,14 +21,51 @@ description: "使用 React Router v8 为代理本机应用程序提供基于文
 
 为动态参数添加 `$` 前缀。以 `_` 为前缀，使其成为无路径布局路线（无 URL 段）。模板使用 `flatRoutes()` — 上面的点符号文件是主要的；嵌套文件夹形式 `inbox/route.tsx` 也适用。
 
-```an-diagram title="无路径布局包裹页面" summary="_app.tsx 布局（无 URL 段）渲染共享 shell 一次；匹配的页面在其 <Outlet/> 内呈现，因此代理侧边栏永远不会在导航时重新安装。"
-{
-"html": "<div class=\"diagram-layout\" data-rough><div class=\"diagram-shell\"><span class=\"diagram-pill accent\">_app.tsx</span><small class=\"diagram-muted\">无路径布局 · 持久外壳 + Agent 侧边栏</small><div class=\"diagram-outlet\" data-rough><small class=\"diagram-muted\">&lt;Outlet/&gt; — the matched page</small><div class=\"diagram-row\"><span class=\"diagram-pill\">_index.tsx &rarr; /</span><span class=\"diagram-pill\">settings.tsx &rarr; /settings</span><span class=\"diagram-pill\">inbox.$threadId.tsx &rarr; /inbox/:threadId</span></div></div></div></div>",
-"css": ".diagram-layout .diagram-shell{display:flex;flex-direction:column;gap:8px;padding:16px}.diagram-layout .diagram-outlet{display:flex;flex-direction:column;gap:8px;padding:14px;margin-top:6px}.diagram-layout .diagram-row{display:flex;flex-wrap:wrap;gap:8px;margin-top:4px}"
-}
+<Diagram id="doc-block-1t5h7ch" title={"无路径布局包裹页面"} summary={"_app.tsx 布局（无 URL 段）渲染共享 shell 一次；匹配的页面在其 <Outlet/> 内呈现，因此代理侧边栏永远不会在导航时重新安装。"}>
+
+```html
+<div class="diagram-layout" data-rough>
+  <div class="diagram-shell">
+    <span class="diagram-pill accent">_app.tsx</span
+    ><small class="diagram-muted">无路径布局 · 持久外壳 + Agent 侧边栏</small>
+    <div class="diagram-outlet" data-rough>
+      <small class="diagram-muted">&lt;Outlet/&gt; — the matched page</small>
+      <div class="diagram-row">
+        <span class="diagram-pill">_index.tsx &rarr; /</span
+        ><span class="diagram-pill">settings.tsx &rarr; /settings</span
+        ><span class="diagram-pill"
+          >inbox.$threadId.tsx &rarr; /inbox/:threadId</span
+        >
+      </div>
+    </div>
+  </div>
+</div>
+```
 
+```css
+.diagram-layout .diagram-shell {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 16px;
+}
+.diagram-layout .diagram-outlet {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 14px;
+  margin-top: 6px;
+}
+.diagram-layout .diagram-row {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 4px;
+}
 ```
 
+</Diagram>
+
 ## 添加新页面 {#adding-a-page}
 
 创建文件并导出默认组件：

package/docs/content/locales/zh-CN/sandbox-adapters.mdx

@@ -40,13 +40,50 @@ Agent-Native 有两个适配器接缝，可消除狭窄后面的问题，
 
 保持契约范围窄意味着远程适配器继承相同的安全状态。父进程保留所有秘密的所有权：它构建沙箱模块，运行本地主机桥（它保存请求上下文并应用主机允许列表+ SSRF 防护），清理环境并格式化输出。适配器仅接收已准备好的、**非秘密**模块源加上资源限制 - 它仅负责*运行*它并捕获 stdout/stderr/exit 状态。
 
-```an-diagram title="父母保守秘密；适配器仅运行代码" summary="run-code 构建模块并运行环回桥；适配器接收非秘密模块+限制并返回stdout/stderr/exit。"
-{
-  "html": "<div class=\"diagram-sandbox\"><div class=\"diagram-box\" data-rough><strong>父进程</strong><small class=\"diagram-muted\">构建模块 · loopback 桥 · 环境清理 · 输出格式</small></div><div class=\"diagram-col\"><div class=\"diagram-pill accent\">non-secret module + limits &rarr;</div><div class=\"diagram-pill ok\">&larr; stdout / stderr / exitCode</div><div class=\"diagram-pill\">&harr; bridge calls (127.0.0.1)</div></div><div class=\"diagram-panel center\" data-rough><strong>SandboxAdapter.run</strong><small class=\"diagram-muted\">本地子进程 · Docker · 远程 · 持久</small></div></div>",
-  "css": ".diagram-sandbox{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.diagram-sandbox .diagram-col{display:flex;flex-direction:column;gap:8px}.diagram-sandbox .center{display:flex;flex-direction:column;align-items:center;gap:4px}"
+<Diagram id="doc-block-oct5kl" title={"父母保守秘密；适配器仅运行代码"} summary={"run-code 构建模块并运行环回桥；适配器接收非秘密模块+限制并返回stdout/stderr/exit。"}>
+
+```html
+<div class="diagram-sandbox">
+  <div class="diagram-box" data-rough>
+    <strong>父进程</strong
+    ><small class="diagram-muted"
+      >构建模块 · loopback 桥 · 环境清理 · 输出格式</small
+    >
+  </div>
+  <div class="diagram-col">
+    <div class="diagram-pill accent">non-secret module + limits &rarr;</div>
+    <div class="diagram-pill ok">&larr; stdout / stderr / exitCode</div>
+    <div class="diagram-pill">&harr; bridge calls (127.0.0.1)</div>
+  </div>
+  <div class="diagram-panel center" data-rough>
+    <strong>SandboxAdapter.run</strong
+    ><small class="diagram-muted">本地子进程 · Docker · 远程 · 持久</small>
+  </div>
+</div>
+```
+
+```css
+.diagram-sandbox {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  flex-wrap: wrap;
+}
+.diagram-sandbox .diagram-col {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.diagram-sandbox .center {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 4px;
 }
 ```
 
+</Diagram>
+
 ## 界面 {#interface}
 
 接缝位于 `packages/core/src/coding-tools/sandbox/` 的核心 - `adapter.ts`（合约）、`index.ts`（选择：`getSandboxAdapter()` / `registerSandboxAdapter()`）和 `local-child-process-adapter.ts`（默认）。采用`run-code.ts`封装内接线；主机通过 `index.ts` 注册助手插入不同的后端（或者，对于 Docker 后端，通过直接编辑这些文件的 [blueprint](/docs/blueprint-installer)）。

package/docs/content/locales/zh-CN/security.mdx

@@ -9,13 +9,45 @@ description: "代理原生应用的安全模型：输入验证、SQL 注入预
 
 ## 你免费得到什么，以及你拥有什么 {#what-you-own}
 
-```an-diagram title="层层防守" summary="该框架拥有大部分威胁面；您拥有两件事——标记表以确定范围和验证外部输入。"
-{
-  "html": "<div class=\"sec-layers\"><div class=\"diagram-card free\"><span class=\"diagram-pill ok\">由框架拥有</span><small class=\"diagram-muted\">SQL isolation &middot; parameterized queries &middot; XSS escaping &middot; auth guard &middot; CSRF cookies &middot; secret encryption</small></div><div class=\"diagram-card you\"><span class=\"diagram-pill warn\">由你掌控</span><small class=\"diagram-muted\">A. tag tables with ownableColumns() &amp; route through access guards<br>B. give every action a Zod schema &amp; send user URLs through the SSRF guard</small></div></div>",
-  "css": ".sec-layers{display:flex;flex-direction:column;gap:12px}.sec-layers .diagram-card{display:flex;flex-direction:column;gap:6px;padding:14px 16px}"
+<Diagram id="doc-block-c5ewgy" title={"层层防守"} summary={"该框架拥有大部分威胁面；您拥有两件事——标记表以确定范围和验证外部输入。"}>
+
+```html
+<div class="sec-layers">
+  <div class="diagram-card free">
+    <span class="diagram-pill ok">由框架拥有</span
+    ><small class="diagram-muted"
+      >SQL isolation &middot; parameterized queries &middot; XSS escaping
+      &middot; auth guard &middot; CSRF cookies &middot; secret
+      encryption</small
+    >
+  </div>
+  <div class="diagram-card you">
+    <span class="diagram-pill warn">由你掌控</span
+    ><small class="diagram-muted"
+      >A. tag tables with ownableColumns() &amp; route through access guards<br />B.
+      give every action a Zod schema &amp; send user URLs through the SSRF
+      guard</small
+    >
+  </div>
+</div>
+```
+
+```css
+.sec-layers {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+.sec-layers .diagram-card {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  padding: 14px 16px;
 }
 ```
 
+</Diagram>
+
 当您构建标准模式时，框架已经为您处理了大部分威胁面：
 
 - **数据隔离** — 代理 SQL 被重写，因此它只能看到当前用户（和活动组织）的行。参见[Data Scoping](#data-scoping)。
@@ -122,13 +154,51 @@ const res = await ssrfSafeFetch(userProvidedUrl, {}, { maxRedirects: 3 });
 session.orgId → AGENT_ORG_ID → SQL row scoping
 ```
 
-```an-diagram title="范围界定管道" summary="代理 SQL 从不直接接触基表 - 它读取范围为当前标识的临时视图，因此裸表名称只能返回拥有的行。"
-{
-  "html": "<div class=\"scope-pipe\"><div class=\"diagram-node\">已登录会话<br><small class=\"diagram-muted\">email &middot; orgId</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-node\">Request context<br><small class=\"diagram-muted\">AGENT_ORG_ID</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-box\">Temporary VIEW<br><small class=\"diagram-muted\">WHERE owner_email = ? AND org_id = ?</small></div><div class=\"diagram-arrow diagram-muted\" aria-hidden=\"true\">&rarr;</div><div class=\"diagram-node ok\">代理 SQL<br><small class=\"diagram-muted\">bare table names only</small></div></div>",
-  "css": ".scope-pipe{display:flex;align-items:center;gap:12px;flex-wrap:wrap}.scope-pipe .diagram-node{display:flex;flex-direction:column;gap:2px;padding:10px 14px}.scope-pipe .diagram-arrow{font-size:22px;line-height:1}"
+<Diagram id="doc-block-19tnfdt" title={"范围界定管道"} summary={"代理 SQL 从不直接接触基表 - 它读取范围为当前标识的临时视图，因此裸表名称只能返回拥有的行。"}>
+
+```html
+<div class="scope-pipe">
+  <div class="diagram-node">
+    已登录会话<br /><small class="diagram-muted">email &middot; orgId</small>
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-node">
+    Request context<br /><small class="diagram-muted">AGENT_ORG_ID</small>
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-box">
+    Temporary VIEW<br /><small class="diagram-muted"
+      >WHERE owner_email = ? AND org_id = ?</small
+    >
+  </div>
+  <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
+  <div class="diagram-node ok">
+    代理 SQL<br /><small class="diagram-muted">bare table names only</small>
+  </div>
+</div>
+```
+
+```css
+.scope-pipe {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  flex-wrap: wrap;
+}
+.scope-pipe .diagram-node {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  padding: 10px 14px;
+}
+.scope-pipe .diagram-arrow {
+  font-size: 22px;
+  line-height: 1;
 }
 ```
 
+</Diagram>
+
 登录会话携带 `email` 和（当组织处于活动状态时）`orgId`。该框架从该会话建立请求上下文，将活动组织暴露给代理 SQL 作为 `AGENT_ORG_ID`，并重写每个查询，以便它只能看到当前身份拥有的行。无论查询来自 UI、操作还是代理，都适用相同的路径 - 代理无法读取用户不是其成员的组织的数据。
 
 ### 每用户范围 (`owner_email`)