@orion-agents/orion-code 0.1.2 → 0.1.4-2

package/README.md

@@ -2,7 +2,7 @@
 
 > **Goal-driven coding agent for the terminal.**
 >
-> v0.1.2 — Goal continuity and evidence audit
+> v0.1.4 — Goal continuity, model config & shell sandbox POC
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -29,14 +29,15 @@ Orion Code is a terminal-based coding agent. It wraps LLM APIs in a harness of s
 
 ### Requirements
 
-- Node.js >= 20.0
+- Node.js 20, 22, or 24 LTS
 - npm >= 9.0
 
 ### Install & Run
 
 ```bash
-# Install the v0.1.2 release:
-npm install -g @orion-agents/orion-code@0.1.2
+# Install the v0.1.4-2 maintenance prerelease:
+npm install -g @orion-agents/orion-code@0.1.4-2
+# Equivalent after publication: npm install -g @orion-agents/orion-code@next
 
 # Or run from a checked-out source tree:
 npm ci
@@ -73,6 +74,10 @@ orion -p "review the current git diff"
 echo "summarize this project" | orion --print
 ```
 
+> **Prerelease status.** `0.1.4-2` is a maintenance release candidate intended for
+> the npm `next` dist-tag; it is not tagged or published yet. Stable `latest` remains
+> `0.1.4` until a separate stable release is approved.
+
 ### TUI startup banner
 
 The default TUI displays a portable sky-blue pixel banner: a compact landscape
@@ -147,6 +152,78 @@ Configuration: `~/.orion-code/orion.json` | Priority: `CLI flags > config > env
 The renderer is a runtime choice rather than a persisted setting: `orion` starts
 the TUI, while `--ui terminal` selects the technical renderer.
 
+### Project tool rules (`allowedTools`)
+
+Per-project permission rules live under `projects["<absolute path>"].allowedTools`.
+They are scoped to a single repository and are evaluated on top of each tool's own
+policy — they can tighten the gate, never loosen it.
+
+```json
+{
+  "projects": {
+    "/Users/me/work/api": {
+      "allowedTools": [
+        "exec_command(git status*)",
+        "exec_command(npm test*)",
+        "ask:exec_command(git push*)",
+        "deny:read_file(*.env)"
+      ]
+    }
+  }
+}
+```
+
+- Grammar: `[allow|ask|deny:]tool[(subject glob)]`; `*` matches any run of characters,
+  `?` a single one, and `*` as the tool name matches every tool.
+- The subject is the call's `command` / `file_path` / `path` / `url` / `pattern` / `query`
+  argument, whichever comes first.
+- Conflicts resolve most-restrictive-first (`deny` > `ask` > `allow`), independent of order.
+- `allow` only skips an interactive confirmation. It never overrides a tool's own `deny`,
+  never escapes plan mode, and never auto-approves a destructive invocation.
+- Malformed entries are ignored and listed by `/config` rather than silently applied.
+
+### Shell execution sandbox (`sandbox`)
+
+`exec_command` can run inside an OS-level sandbox. This is a **security POC**: the
+backend is probed at runtime and a configured-but-unusable sandbox **fails closed**
+(refuses to run) rather than silently degrading to an unsandboxed execution.
+
+```json
+{
+  "sandbox": {
+    "profile": "none",
+    "backend": "auto",
+    "allowNetwork": false,
+    "writableRoots": [],
+    "image": "alpine:latest"
+  }
+}
+```
+
+- **Ownership** — `sandbox` lives in the global config (`~/.orion-code/orion.json`)
+  and can be overridden per project under `projects["<path>"].sandbox`. Project
+  keys win individually; absent keys inherit the global value.
+- **`profile`** — `none` (default, no isolation, identical to the legacy `sh -c`),
+  `read-only` (no writes anywhere, no network), or `workspace-write` (writes
+  confined to the workspace + temp dirs, network still blocked unless
+  `allowNetwork: true`). An unknown value (e.g. written by a newer Orion) is a
+  hard failure, never a downgrade to `none`.
+- **`backend`** — `auto` (default, picks the first usable backend), `seatbelt`
+  (macOS `sandbox-exec`), `bubblewrap` (Linux `bwrap`), or `docker`. Each backend
+  is validated with a real execution probe; `which`-based guessing is never used.
+- **`image`** — required only for `docker`; names the container image to run in.
+- **`writableRoots`** — extra host roots the `workspace-write` profile may write
+  to (in addition to the cwd and temp). Non-string / empty entries are dropped.
+- **Migration / rollback** — adding the `sandbox` key is backward compatible: the
+  default `profile: "none"` reproduces the previous behaviour exactly. Removing the
+  key (or reverting to a pre-sandbox version) is a safe rollback; older Orion
+  simply ignores the unknown field. No secrets are stored, so no redaction is
+  required.
+- **Known limitations** — `seatbelt` cannot be nested inside another sandbox (e.g.
+  when Orion itself runs inside an app sandbox); `docker` runs the command in a
+  separate process tree and only constrains what is bind-mounted (the image rootfs
+  is made read-only via `--read-only`); none of the backends constrain CPU/memory.
+
 ## Interactive Commands
 
 | Command                | Description                                                                 |
@@ -204,6 +281,23 @@ See the [v0.1.2 release notes](https://github.com/orion-agents/orion-code/blob/m
 [Goal evidence and recovery guide](https://github.com/orion-agents/orion-code/blob/main/docs/goals/goal-evidence-and-recovery.md),
 and [execution plan](https://github.com/orion-agents/orion-code/blob/main/docs/plan/v0.1.2-execution-plan.md).
 
+## Research-to-Evidence (v0.1.4, experimental)
+
+> **Status: experimental.** Turns the read-only `research` subagent output into a **traceable, recoverable** research→evidence loop.
+
+Hard guarantees (any violation is a No-Go; never published):
+
+- **Only specialized WebSearch / WebFetch** — no generic MCP, no write/exec grant.
+- **SSRF / DNS-rebind / redirect / body-size / timeout** re-use the existing guards: a lexical SSRF pre-check at selection, and the full per-hop guard set delegated to the real WebFetch tool.
+- A **claim must bind a source** to reach `observed`; a claim with no independent verification stays `partial`/`unmet` and is never counted as verified/complete.
+- A **security-gate failure becomes `blocked`/`failed` with a structured reason** — never faked as a hit; provider fallback only swaps the provider, never downgrades a source status or writes a failure as a success.
+- Research evidence (web) and execution-verification evidence (file / test / build / file facts) are **kept distinct**; a web summary cannot stand in for execution verification.
+- Packet + source metadata are saved **atomically with a CAS token**; project / session / Goal scope isolation; resume only derives state and never replays external side effects; old schema versions fail closed.
+
+Modules: `src/runtime/subagents/{research-types,research-contract,research-citation,web-research-adapter,research-renderer,research-artifact,research-quality}.ts`.
+
+> Real-terminal (PTY) and external-state evidence are marked `not_run` in CI; local tests are not treated as release completion.
+
 ## Development
 
 ```bash

package/README.zh-CN.md

@@ -3,7 +3,7 @@
 > **Orion Code — 通用 Agent 驾驭框架**
 > 一个 CLI 驱动的编码 Agent，具备安全边界、工具编排、记忆系统和上下文管理。
 >
-> v0.1.2 — Goal 连续性与证据审计
+> v0.1.4 — Goal 连续性、模型配置与命令沙箱 POC
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -60,7 +60,7 @@
 
 ### 环境要求
 
-- Node.js >= 20.0
+- Node.js 20、22 或 24 LTS
 - npm >= 9.0
 
 ### 安装运行
@@ -104,16 +104,20 @@ npm start -- --print "review the current git diff"
 
 ### 全局安装
 
-固定安装 v0.1.2：
+固定安装 v0.1.4-2 维护预发布版本：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.1.2
+npm install -g @orion-agents/orion-code@0.1.4-2
+# 发布后也可使用：npm install -g @orion-agents/orion-code@next
 # 任意目录运行
 orion
 ```
 
 也可以在源码工作树中使用 `npm ci && npm run build && npm start`。
 
+> **预发布状态**：`0.1.4-2` 是计划发布到 npm `next` dist-tag 的维护候选，
+> 当前尚未创建标签或发布。稳定版 `latest` 仍为 `0.1.4`。
+
 公众体验、交互优化和新增工作流优先落在 TUI。`terminal-ui` 不作为与
 TUI 并行发展的公众产品；Ink 只保留迁移期兼容，不再增加产品能力。
 
@@ -173,6 +177,69 @@ v0.1.2 只覆盖单 Session、单 Active Goal，不承诺多 Goal 调度或无
 CLI 参数 > ~/.orion-code/orion.json > 环境变量 > 内部默认
 ```
 
+### 项目级工具规则（`allowedTools`）
+
+权限规则写在 `projects["<项目绝对路径>"].allowedTools`，只作用于该仓库。规则叠加在
+工具自身的权限策略之上：**只能收紧，不能放宽**。
+
+```json
+{
+  "projects": {
+    "/Users/me/work/api": {
+      "allowedTools": [
+        "exec_command(git status*)",
+        "exec_command(npm test*)",
+        "ask:exec_command(git push*)",
+        "deny:read_file(*.env)"
+      ]
+    }
+  }
+}
+```
+
+- 语法：`[allow|ask|deny:]工具名[(参数通配)]`；`*` 匹配任意字符串，`?` 匹配单个字符，
+  工具名写 `*` 表示匹配所有工具。
+- 参数通配匹配的是调用参数中的 `command` / `file_path` / `path` / `url` / `pattern` /
+  `query`（按此顺序取第一个非空字符串）。
+- 冲突时按“最严格优先”解析：`deny` > `ask` > `allow`，与书写顺序无关。
+- `allow` 仅用于免去交互确认，**不会**覆盖工具自身的 `deny`、**不会**突破 plan 模式的
+  只读约束，也**不会**自动放行破坏性调用。
+- 无法解析的条目会被忽略而不是静默放行，可通过 `/config` 查看解析结果与非法条目。
+
+### 命令执行沙箱（`sandbox`）
+
+`exec_command` 可在操作系统级沙箱内执行。这是**安全 POC**：后端在运行
+时实测探测，已配置但不可用的沙箱会**fail closed**（拒绝执行），而不会静默降级为
+无沙箱执行。
+
+```json
+{
+  "sandbox": {
+    "profile": "none",
+    "backend": "auto",
+    "allowNetwork": false,
+    "writableRoots": [],
+    "image": "alpine:latest"
+  }
+}
+```
+
+- **归属** — `sandbox` 位于全局配置（`~/.orion-code/orion.json`），并可在项目级
+  `projects["<项目绝对路径>"].sandbox` 覆盖。项目级按 key 单独覆盖，缺省 key 继承全局。
+- **`profile`** — `none`（默认，不隔离，等价于旧版 `sh -c`）、`read-only`（任何位置不可写、无网络）、
+  `workspace-write`（写权限限定在工作区与临时目录，除非 `allowNetwork: true` 否则仍禁网）。
+  未知取值（如新版 Orion 写入的更严格值）一律硬失败，绝不降级为 `none`。
+- **`backend`** — `auto`（默认，自动选首个可用后端）、`seatbelt`（macOS `sandbox-exec`）、
+  `bubblewrap`（Linux `bwrap`）或 `docker`。每个后端都用真实执行探针校验，从不靠 `which` 推断。
+- **`image`** — 仅 `docker` 需要，指定运行所用的容器镜像。
+- **`writableRoots`** — `workspace-write` 可写入的额外宿主根目录（除工作区与临时目录外）。
+  非字符串 / 空项会被丢弃。
+- **迁移 / 回滚** — 新增 `sandbox` 完全向后兼容：默认 `profile: "none"` 与旧行为完全一致。
+  删除该 key（或回退到沙箱前的版本）是安全回滚；旧版 Orion 会忽略该未知字段。不涉及任何敏感信息，无需脱敏。
+- **已知限制** — `seatbelt` 不能嵌套在另一沙箱内（例如 Orion 自身运行在应用沙箱中时）；
+  `docker` 在独立进程树中运行命令，只约束被 bind-mount 的部分（镜像根文件系统已通过 `--read-only` 设为只读）；
+  各后端均不限制 CPU / 内存。
+
 ### 环境变量
 
 | 变量                            | 默认值        | 说明                            |
@@ -399,7 +466,29 @@ orion-code/
 
 ## 版本历史
 
-### v0.1.2（当前版本）
+### v0.1.4-2（候选，未发布）
+
+- 汇总 v0.1.4 后续的安全、持久化、Goal/runtime、Research、依赖与发布门禁修复；
+- 以 npm `next` dist-tag 发布，不移动稳定版 `latest`。
+
+### v0.1.4（已发布）
+
+- 版本元数据对齐：`package.json` / `package-lock.json` 升至 `0.1.4`，`orion --version`、
+  出站 `User-Agent` 与崩溃/遥测上报不再误报 `0.1.3`；
+- 类型安全推进：外部边界（LLM provider、MCP wire、工具返回）由 `any` 收窄为 `unknown` +
+  类型守卫，顺带修复被 `any` 掩盖的真实缺陷；
+- 可靠性：持久化与鉴权路径不再静默吞掉异常，ESLint 启用 `no-empty` 门禁。
+
+### v0.1.3（已发布）
+
+- `/model` 与 `/models` 拆分：`/model` 只显示当前模型信息，`/models` 承接交互式切换；
+- `modelRegistry` 成为模型展示与切换的唯一事实源，静态 catalog 退为 legacy fallback；
+- 内置 catalog 补全（火山方舟 / xf-yun / deepseek 等），未配置上下文时正确回退；
+- 命令沙箱 POC、只读 Git 工具与工具 allowlist 的安全基线。
+
+> 完整变更与交付状态（已发布 / 已合并 / 候选）以 `CHANGELOG.md` 为准。
+
+### v0.1.2（已发布）
 
 - 单 Session、单 Active Goal 的 typed continuation；
 - restart/resume 后安全暂停，必须显式恢复；
@@ -419,6 +508,25 @@ orion-code/
 
 ---
 
+## Research-to-Evidence（v0.1.4，实验性）
+
+> **状态标记：experimental（实验性）。** 把只读 `research` 子 agent 的结果转化为**可追踪、可恢复**的研究→证据闭环。
+
+核心保证（违反任一即 No-Go，绝不发布）：
+
+- **只接专用 WebSearch / WebFetch**，不暴露通用 MCP、不授予 write/exec。
+- **SSRF / DNS 重解析 / 重定向 / 响应大小 / 超时** 全部走既有守卫：选择期做 lexical SSRF 预检，逐跳防护委托给真实 WebFetch 工具。
+- **claim 必须有 source 绑定**才能进入 `observed`；无独立验证的 claim 永远停在 `partial`/`unmet`，绝不被算作已验证/完成。
+- **安全闸门失败 → `blocked`/`failed` + 结构化原因**，绝不伪装成命中；provider fallback 只换 provider，不降级 source status，也不把失败写成成功。
+- 研究证据（web）与执行验证证据（file / 测试 / 构建 / 文件事实）**明确区分**，web 摘要不能替代执行验证。
+- 包与源元数据**原子 CAS 保存**，project / session / Goal 作用域隔离；恢复只推导状态、不重放外部副作用；旧 schema 版本 fail-closed。
+
+模块：`src/runtime/subagents/{research-types,research-contract,research-citation,web-research-adapter,research-renderer,research-artifact,research-quality}.ts`。
+
+> 真实终端（PTY）与外部状态证据在 CI 中标记为 `not_run`；本地测试不视为发布完成。
+
+---
+
 ## 开发
 
 ```bash
@@ -439,6 +547,9 @@ npm run lint
 
 # 格式化
 npm run format
+
+# 发布前只读检查（不会 tag / push / publish）
+npm run release:check
 ```
 
 ---

package/dist/agents/coder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coder.d.ts","sourceRoot":"","sources":["../../src/agents/coder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEzE,qBAAa,UAAW,SAAQ,SAAS;gBAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAUnC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;YAwBhC,aAAa;CAO5B"}
+{"version":3,"file":"coder.d.ts","sourceRoot":"","sources":["../../src/agents/coder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAkB,MAAM,eAAe,CAAC;AAOzF,qBAAa,UAAW,SAAQ,SAAS;gBAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAUnC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;YAwBhC,aAAa;CAO5B"}

package/dist/agents/coder.js.map

@@ -1 +1 @@
-{"version":3,"file":"coder.js","sourceRoot":"","sources":["../../src/agents/coder.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,yCAAyE;AAEzE,MAAa,UAAW,SAAQ,iBAAS;IACvC,YAAY,MAA6B;QACvC,KAAK,CAAC;YACJ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,OAAO;YACzB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO;YAC7B,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,8BAA8B;YAClE,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC;YAC3F,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAU;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAE9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAExD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAU;QACpC,OAAO;QACP,OAAO;YACL,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,aAAa;YAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF;AA1CD,gCA0CC"}
+{"version":3,"file":"coder.js","sourceRoot":"","sources":["../../src/agents/coder.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,yCAAyF;AAOzF,MAAa,UAAW,SAAQ,iBAAS;IACvC,YAAY,MAA6B;QACvC,KAAK,CAAC;YACJ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,OAAO;YACzB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO;YAC7B,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,8BAA8B;YAClE,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC;YAC3F,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAU;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAE9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAExD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAU;QACpC,OAAO;QACP,OAAO;YACL,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,aAAa;YAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF;AA1CD,gCA0CC"}

package/dist/agents/fork.d.ts

@@ -4,16 +4,24 @@
  * Fork 一个子 Agent 继承父上下文，执行独立任务后返回结果。
  * 参考 OpenClaude 的 forkSubagent.ts 实现。
  */
-import type { Message } from '../services/llm';
-import type { OpenHorseTool } from '../framework/tool';
+import type { LLMService, Message } from '../services/llm';
+import type { OrionCodeTool } from '../framework/tool';
 import type { PermissionMode } from '../commands/types';
+import type { ToolConfirmationPolicy } from '../services/config';
+import type { ToolAllowlistEvaluator } from '../services/tool-allowlist';
 export interface ForkOptions {
     /** 继承父上下文（messages + systemPrompt） */
     inheritContext: boolean;
     /** 权限模式 */
     permissionMode?: PermissionMode;
-    /** 可用工具（默认 TOOLS） */
-    tools?: OpenHorseTool[];
+    /** LLM 服务实例。Fork 不会从 CLI 单例中隐式加载。 */
+    llm?: LLMService;
+    /** 可用工具（默认最小只读工具集） */
+    tools?: OrionCodeTool[];
+    /** 需要交互确认时的无 UI 回退策略 */
+    toolConfirmation?: ToolConfirmationPolicy;
+    /** 项目级工具 allow/ask/deny 规则 */
+    toolAllowlist?: ToolAllowlistEvaluator;
     /** 最大轮次 */
     maxTurns?: number;
     /** 后台执行（不阻塞父 Agent） */

package/dist/agents/fork.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../src/agents/fork.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQxD,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW;IACX,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,qBAAqB;IACrB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY;IACZ,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,YAAY;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+H5E;AA6BD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,UAAU,IAAI,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../src/agents/fork.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAe,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAQzE,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW;IACX,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,qCAAqC;IACrC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,8BAA8B;IAC9B,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY;IACZ,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,YAAY;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0I5E;AAoBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,UAAU,IAAI,kBAAkB,EAAE,CAAC"}

package/dist/agents/fork.js

@@ -18,7 +18,7 @@ const tools_1 = require("../tools");
  * Fork 子 Agent 执行任务
  */
 async function forkSubagent(options) {
-    const { inheritContext = true, tools = tools_1.TOOLS, maxTurns = 5, background = false, taskDescription, parentMessages = [], parentSystemPrompt, cwd = process.cwd(), memoryContent = '', skillsContent = '', } = options;
+    const { inheritContext = true, llm, tools = getDefaultForkTools(), permissionMode = 'plan', toolConfirmation, toolAllowlist, maxTurns = 5, background = false, taskDescription, parentMessages = [], parentSystemPrompt, cwd = process.cwd(), memoryContent = '', skillsContent = '', } = options;
     const startTime = Date.now();
     // 构建子 Agent 的消息历史
     let messages;
@@ -47,26 +47,27 @@ async function forkSubagent(options) {
             { role: 'user', content: taskDescription },
         ];
     }
-    // 工具执行器
+    const toolContext = {
+        cwd,
+        config: { name: 'orion-code', mode: 'development' },
+        permissionMode,
+        toolAllowlist,
+    };
+    // query scheduler 在调用执行器前统一应用 tool policy、permission mode 与 allowlist。
     const toolExecutor = async (name, args) => {
-        // 简化版：直接执行工具
         const tool = tools.find(t => t.name === name);
         if (!tool) {
             return JSON.stringify({ success: false, error: `Unknown tool: ${name}` });
         }
-        // 调用工具的 execute
-        const context = { cwd, config: { name: 'orion-code', mode: 'development' } };
         try {
-            const result = await tool.execute(args, context);
+            const result = await tool.execute(args, toolContext);
             return JSON.stringify(result);
         }
-        catch (err) {
-            return JSON.stringify({ success: false, error: err.message });
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return JSON.stringify({ success: false, error: message });
         }
     };
-    // 简化的 LLM（不使用完整 LLMService，避免依赖）
-    // 这里假设有全局的 llm 实例可用
-    const llm = getGlobalLLM();
     if (!llm) {
         return {
             success: false,
@@ -86,6 +87,10 @@ async function forkSubagent(options) {
             toolExecutor,
             llm,
             maxTurns,
+            permissionMode,
+            toolConfirmation,
+            toolAllowlist,
+            toolContext,
             streamCallbacks: {
                 onChunk: (chunk) => {
                     if (!background) {
@@ -120,34 +125,25 @@ async function forkSubagent(options) {
             tokenUsage: finalUsage,
         };
     }
-    catch (err) {
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
         return {
             success: false,
             content: '',
-            error: err.message,
+            error: message,
             duration: Date.now() - startTime,
         };
     }
 }
-// ============================================================================
-// 辅助函数
-// ============================================================================
-/**
- * 获取全局 LLM 实例（从 CLI 模块）
- * 注意：这是一个简化实现，实际应该通过参数传递 LLM
- */
-function getGlobalLLM() {
-    // 尝试从全局获取
-    try {
-        const cliModule = require('../cli');
-        if (cliModule.llm) {
-            return cliModule.llm;
-        }
-    }
-    catch {
-        // ignore
-    }
-    return null;
+const DEFAULT_FORK_TOOL_NAMES = new Set([
+    'read_file',
+    'list_files',
+    'glob',
+    'grep',
+    'batch_read',
+]);
+function getDefaultForkTools() {
+    return tools_1.TOOLS.filter(tool => DEFAULT_FORK_TOOL_NAMES.has(tool.name));
 }
 // ============================================================================
 // 防递归保护

package/dist/agents/fork.js.map

@@ -1 +1 @@
-{"version":3,"file":"fork.js","sourceRoot":"","sources":["../../src/agents/fork.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAoDH,oCA+HC;AAgCD,sDAEC;AAKD,0DAEC;AAvND,4CAA0E;AAC1E,oCAAiC;AAuCjC,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAAoB;IACrD,MAAM,EACJ,cAAc,GAAG,IAAI,EACrB,KAAK,GAAG,aAAK,EACb,QAAQ,GAAG,CAAC,EACZ,UAAU,GAAG,KAAK,EAClB,eAAe,EACf,cAAc,GAAG,EAAE,EACnB,kBAAkB,EAClB,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,aAAa,GAAG,EAAE,EAClB,aAAa,GAAG,EAAE,GACnB,GAAG,OAAO,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,kBAAkB;IAClB,IAAI,QAAmB,CAAC;IAExB,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,iBAAiB;QACjB,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC/B,eAAe;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,eAAe,eAAe,iJAAiJ;SACzL,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,UAAU;QACV,MAAM,SAAS,GAAkB;YAC/B,GAAG;YACH,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK;YACL,aAAa;YACb,aAAa;SACd,CAAC;QACF,MAAM,YAAY,GAAG,kBAAkB,IAAI,IAAA,2BAAe,EAAC,SAAS,CAAC,CAAC;QACtE,QAAQ,GAAG;YACT,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;YACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,QAAQ;IACR,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAE,IAA6B,EAAE,EAAE;QACzE,aAAa;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,gBAAgB;QAChB,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IAEF,iCAAiC;IACjC,oBAAoB;IACpB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,oCAAoC;YAC3C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,OAAO;IACP,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,UAA0E,CAAC;IAC/E,MAAM,SAAS,GAA2E,EAAE,CAAC;IAE7F,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAA,iBAAK,EAAC;YAC9B,QAAQ;YACR,KAAK;YACL,YAAY;YACZ,GAAG;YACH,QAAQ;YACR,eAAe,EAAE;gBACf,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,mBAAmB;wBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;aACF;SACF,CAAC,EAAE,CAAC;YACH,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,SAAS;oBACT,MAAM;gBACR,KAAK,aAAa;oBAChB,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,UAAU;oBACb,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;oBAC7B,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;oBACzB,MAAM;YACV,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,YAAY;YACrB,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,UAAU,EAAE,UAAU;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,YAAY;IACnB,UAAU;IACV,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,GAAG,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C;;GAEG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAe;IACrD,OAAO,GAAG,oBAAoB,KAAK,OAAO,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"fork.js","sourceRoot":"","sources":["../../src/agents/fork.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4DH,oCA0IC;AAuBD,sDAEC;AAKD,0DAEC;AA/ND,4CAA0E;AAC1E,oCAAiC;AA6CjC,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAAoB;IACrD,MAAM,EACJ,cAAc,GAAG,IAAI,EACrB,GAAG,EACH,KAAK,GAAG,mBAAmB,EAAE,EAC7B,cAAc,GAAG,MAAM,EACvB,gBAAgB,EAChB,aAAa,EACb,QAAQ,GAAG,CAAC,EACZ,UAAU,GAAG,KAAK,EAClB,eAAe,EACf,cAAc,GAAG,EAAE,EACnB,kBAAkB,EAClB,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,aAAa,GAAG,EAAE,EAClB,aAAa,GAAG,EAAE,GACnB,GAAG,OAAO,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,kBAAkB;IAClB,IAAI,QAAmB,CAAC;IAExB,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,iBAAiB;QACjB,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC/B,eAAe;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,eAAe,eAAe,iJAAiJ;SACzL,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,UAAU;QACV,MAAM,SAAS,GAAkB;YAC/B,GAAG;YACH,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK;YACL,aAAa;YACb,aAAa;SACd,CAAC;QACF,MAAM,YAAY,GAAG,kBAAkB,IAAI,IAAA,2BAAe,EAAC,SAAS,CAAC,CAAC;QACtE,QAAQ,GAAG;YACT,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;YACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAgB;QAC/B,GAAG;QACH,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE;QACnD,cAAc;QACd,aAAa;KACd,CAAC;IAEF,uEAAuE;IACvE,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAE,IAA6B,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,oCAAoC;YAC3C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,OAAO;IACP,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,UAA0E,CAAC;IAC/E,MAAM,SAAS,GAA2E,EAAE,CAAC;IAE7F,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAA,iBAAK,EAAC;YAC9B,QAAQ;YACR,KAAK;YACL,YAAY;YACZ,GAAG;YACH,QAAQ;YACR,cAAc;YACd,gBAAgB;YAChB,aAAa;YACb,WAAW;YACX,eAAe,EAAE;gBACf,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,mBAAmB;wBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;aACF;SACF,CAAC,EAAE,CAAC;YACH,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,SAAS;oBACT,MAAM;gBACR,KAAK,aAAa;oBAChB,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,UAAU;oBACb,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;oBAC7B,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;oBACzB,MAAM;YACV,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,YAAY;YACrB,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,UAAU,EAAE,UAAU;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,OAAO;YACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,YAAY;IACZ,MAAM;IACN,MAAM;IACN,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,mBAAmB;IAC1B,OAAO,aAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C;;GAEG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAe;IACrD,OAAO,GAAG,oBAAoB,KAAK,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/agents/leader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leader.d.ts","sourceRoot":"","sources":["../../src/agents/leader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEzE,qBAAa,WAAY,SAAQ,SAAS;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAUnC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;YAyBhC,cAAc;CAO7B"}
+{"version":3,"file":"leader.d.ts","sourceRoot":"","sources":["../../src/agents/leader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAkB,MAAM,eAAe,CAAC;AAOzF,qBAAa,WAAY,SAAQ,SAAS;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAUnC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;YAyBhC,cAAc;CAO7B"}

package/dist/agents/leader.js.map

@@ -1 +1 @@
-{"version":3,"file":"leader.js","sourceRoot":"","sources":["../../src/agents/leader.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,yCAAyE;AAEzE,MAAa,WAAY,SAAQ,iBAAS;IACxC,YAAY,MAA6B;QACvC,KAAK,CAAC;YACJ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,QAAQ;YAC1B,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,QAAQ;YAC9B,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,yBAAyB;YAC7D,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,mBAAmB,EAAE,cAAc,EAAE,YAAY,CAAC;YACzF,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAU;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAExD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAU;QACrC,cAAc;QACd,OAAO;YACL,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,yBAAyB;YACpD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF;AA3CD,kCA2CC"}
+{"version":3,"file":"leader.js","sourceRoot":"","sources":["../../src/agents/leader.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,yCAAyF;AAOzF,MAAa,WAAY,SAAQ,iBAAS;IACxC,YAAY,MAA6B;QACvC,KAAK,CAAC;YACJ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,QAAQ;YAC1B,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,QAAQ;YAC9B,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,yBAAyB;YAC7D,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,mBAAmB,EAAE,cAAc,EAAE,YAAY,CAAC;YACzF,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAU;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAExD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAU;QACrC,cAAc;QACd,OAAO;YACL,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,yBAAyB;YACpD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF;AA3CD,kCA2CC"}

package/dist/agents/worker-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../../src/agents/worker-pool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAgB,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAMzE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC3C;AAMD,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,YAAY,CAAK;gBAEb,MAAM,CAAC,EAAE,gBAAgB;IAMrC;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAqCjF;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAetG;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAShC;;OAEG;IACH,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;IAIzC;;OAEG;IACH,YAAY,IAAI,IAAI;IAQpB;;OAEG;IACH,SAAS,IAAI;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;KACxB;IAUD;;OAEG;IACH,OAAO,IAAI,IAAI;IAaf,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,cAAc;YAyBR,WAAW;CAwD1B;AAQD,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAKnE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
+{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../../src/agents/worker-pool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAgB,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAMzE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC3C;AAaD,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,YAAY,CAAK;gBAEb,MAAM,CAAC,EAAE,gBAAgB;IAMrC;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAmCjF;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAetG;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAShC;;OAEG;IACH,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;IAIzC;;OAEG;IACH,YAAY,IAAI,IAAI;IAQpB;;OAEG;IACH,SAAS,IAAI;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;KACxB;IAUD;;OAEG;IACH,OAAO,IAAI,IAAI;IAsBf,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,cAAc;YAyBR,WAAW;CAwD1B;AAQD,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAKnE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/agents/worker-pool.js

@@ -32,29 +32,28 @@ class WorkerPool {
         if (idleWorkers.length > 0 || this.workers.size < this.maxWorkers) {
             // 有空闲 Worker 或未达到上限：直接执行
             const workerId = this.allocateWorker(task);
-            const result = await this.executeTask(workerId, task, forkOptions);
-            return result;
+            return this.executeTask(workerId, task, forkOptions);
         }
-        // 无空闲 Worker：加入队列
-        this.taskQueue.push(task);
-        // 等待有空闲 Worker
+        // 无空闲 Worker：入队，待某个 Worker 完成任务后由 drainQueue 取出执行。
+        // 每个入队任务携带自己的 resolver，确保只被执行一次，避免重复执行。
         return new Promise((resolve) => {
-            const checkInterval = setInterval(() => {
-                if (this.getIdleWorkers().length > 0) {
-                    clearInterval(checkInterval);
-                    const workerId = this.allocateWorker(task);
-                    this.executeTask(workerId, task, forkOptions).then(resolve);
+            const finish = (result) => {
+                clearTimeout(timer);
+                resolve(result);
+            };
+            this.taskQueue.push({ task, forkOptions, resolve: finish });
+            // 超时保护：仍未被取出执行时才以超时失败结束。
+            const timer = setTimeout(() => {
+                const idx = this.taskQueue.findIndex(q => q.task === task && q.resolve === finish);
+                if (idx !== -1) {
+                    this.taskQueue.splice(idx, 1);
+                    finish({
+                        success: false,
+                        content: '',
+                        error: 'Task queue timeout',
+                        duration: this.taskTimeout,
+                    });
                 }
-            }, 100);
-            // 超时处理
-            setTimeout(() => {
-                clearInterval(checkInterval);
-                resolve({
-                    success: false,
-                    content: '',
-                    error: 'Task queue timeout',
-                    duration: this.taskTimeout,
-                });
             }, this.taskTimeout);
         });
     }
@@ -119,7 +118,16 @@ class WorkerPool {
                 this.workers.set(workerId, { ...info, status: 'failed' });
             }
         }
-        this.taskQueue = [];
+        // 解除仍在队列中的任务，避免 submit 返回的 Promise 永远挂起。
+        while (this.taskQueue.length > 0) {
+            const item = this.taskQueue.shift();
+            item.resolve({
+                success: false,
+                content: '',
+                error: 'Worker pool stopped',
+                duration: 0,
+            });
+        }
     }
     // ============================================================================
     // 内部方法
@@ -169,14 +177,15 @@ class WorkerPool {
             });
             // 保存结果
             this.results.set(task.id, result);
-            // 处理队列中的下一个任务
+            // 处理队列中的下一个任务（每个任务只会被 shift 一次，保证只执行一次）
             if (this.taskQueue.length > 0) {
-                const nextTask = this.taskQueue.shift();
-                if (nextTask) {
-                    this.executeTask(workerId, nextTask, forkOptions).catch(() => {
-                        // Prevent unhandled rejection from recursive call.
-                    });
-                }
+                const next = this.taskQueue.shift();
+                if (!next)
+                    return result;
+                const nextWorkerId = this.allocateWorker(next.task);
+                this.executeTask(nextWorkerId, next.task, next.forkOptions)
+                    .then(next.resolve)
+                    .catch(next.resolve);
             }
             return result;
         }
@@ -190,7 +199,7 @@ class WorkerPool {
             const result = {
                 success: false,
                 content: '',
-                error: err.message,
+                error: err instanceof Error ? err.message : String(err),
                 duration: Date.now() - (this.workers.get(workerId)?.startTime || Date.now()),
             };
             this.results.set(task.id, result);