@steerable/agent-shell 0.6.73 → 0.7.1

package/dist/local-backend/history-edit.js

@@ -36,11 +36,105 @@ export function rewindFrom(messages) {
         return null;
     return { deleteFromId: target.id, removed: index + 1 };
 }
-/** Newest-first history copied in time order. */
-export function forkHistory(messages) {
+/**
+ * Replace `from` only when it is a complete path prefix: the next character
+ * is a separator or the end of the string, and the previous character does
+ * not continue a path. Letters and digits count in any script, so a Han
+ * character glues the same way an ASCII letter does. A longer name that
+ * merely starts with the same characters is left alone.
+ * On Windows the match ignores letter case and treats `/` and `\` as the
+ * same separator.
+ */
+export function replacePathPrefix(text, from, to, platform = process.platform) {
+    const source = from.replace(/[\\/]+$/, '');
+    const target = to.replace(/[\\/]+$/, '');
+    if (!source || prefixesEqual(source, target, platform))
+        return text;
+    const win32 = platform === 'win32';
+    let out = '';
+    let cursor = 0;
+    while (cursor < text.length) {
+        const at = findPrefix(text, source, cursor, win32);
+        if (at < 0) {
+            out += text.slice(cursor);
+            break;
+        }
+        const next = text[at + source.length];
+        if (next === undefined || next === '/' || next === '\\') {
+            out += text.slice(cursor, at) + target;
+        }
+        else {
+            out += text.slice(cursor, at + source.length);
+        }
+        cursor = at + source.length;
+    }
+    return out;
+}
+function prefixesEqual(left, right, platform) {
+    return left.length === right.length && regionEquals(left, 0, right, platform === 'win32');
+}
+function findPrefix(text, source, fromIndex, win32) {
+    const limit = text.length - source.length;
+    for (let index = fromIndex; index <= limit; index += 1) {
+        if (index > 0 && continuesPath(text[index - 1] ?? ''))
+            continue;
+        if (regionEquals(text, index, source, win32))
+            return index;
+    }
+    return -1;
+}
+function continuesPath(char) {
+    if (char === '/' || char === '\\' || char === ':' || char === '.' || char === '_'
+        || char === '-' || char === '~') {
+        return true;
+    }
+    return /[\p{L}\p{N}\p{M}]/u.test(char);
+}
+function regionEquals(text, at, source, win32) {
+    for (let index = 0; index < source.length; index += 1) {
+        if (!charsEqual(text[at + index] ?? '', source[index] ?? '', win32))
+            return false;
+    }
+    return true;
+}
+function charsEqual(left, right, win32) {
+    if (left === right)
+        return true;
+    if (!win32)
+        return false;
+    if ((left === '/' || left === '\\') && (right === '/' || right === '\\'))
+        return true;
+    return left.toLowerCase() === right.toLowerCase();
+}
+function rewriteJsonValue(value, rewrite) {
+    if (typeof value === 'string')
+        return rewrite(value);
+    if (Array.isArray(value))
+        return value.map((item) => rewriteJsonValue(item, rewrite));
+    if (value && typeof value === 'object') {
+        const next = {};
+        for (const [key, item] of Object.entries(value)) {
+            next[key] = rewriteJsonValue(item, rewrite);
+        }
+        return next;
+    }
+    return value;
+}
+function rewriteMetadata(raw, rewrite) {
+    if (!raw)
+        return raw ?? null;
+    try {
+        return JSON.stringify(rewriteJsonValue(JSON.parse(raw), rewrite));
+    }
+    catch {
+        return rewrite(raw);
+    }
+}
+/** Newest-first history copied in time order. `rewrite` updates copied paths. */
+export function forkHistory(messages, rewrite = (text) => text) {
     return messages.slice().reverse().map((message) => ({
         role: message.role,
-        content: message.content,
-        messageMetadata: message.messageMetadata ?? null,
+        content: rewrite(message.content),
+        messageMetadata: rewriteMetadata(message.messageMetadata, rewrite),
     }));
 }

package/dist/local-backend/router.d.ts

@@ -197,6 +197,7 @@ export declare class LocalBackendRouter {
     private briefResult;
     private briefScalar;
     private chatBusy;
+    private forkChat;
     private tryChatLock;
     private withChatWriteLock;
     private sse;

package/dist/local-backend/router.js

@@ -4,11 +4,12 @@ import path from 'node:path';
 import { readFile, realpath, stat } from 'node:fs/promises';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import os from 'node:os';
+import { getLocale, tFor } from '../i18n.js';
 import { getAppRootDir, getUserDataDir, shellOpenPath } from '../runtime.js';
 import { acquireChatWriteLock, ChatBusyError, } from '../storage/process-locks.js';
 import { llmService, getSidecarSupervisor, whenSidecarSupervisor } from '../llm/index.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import { buildWorldState, getActiveCoreLoopStreamId, streamCoreLoopTurn, } from './coreloop-stream.js';
+import { buildWorldState, getActiveCoreLoopStreamId, streamCoreLoopTurn, toTurnTool, } from './coreloop-stream.js';
 import { driveWithAutoContinue, resolveAutoContinueMax, } from './auto-continue-helper.js';
 import { buildActiveGoalContext, buildGoalContinuationPrompt, shouldContinueGoal, } from './goal-continuation-helper.js';
 import { buildAmbientDelegateRoster, buildDelegateDispatchInstruction, buildDelegateRosterHint, buildMentionDelegateRoster, BUILTIN_SUBAGENT_PROFILES, mergeTurnSubagentParam, } from './subagent-profiles.js';
@@ -43,14 +44,16 @@ import { planRegenerateTruncate, resolveRegenerateContext, resolveRegenerateFork
 import { resolveBranchActivation } from './branch-helper.js';
 import { detectInterruptedTurn } from './interrupted-helper.js';
 import { handlePortableRequest } from './portable-service.js';
-import { isPortableProduct } from '../product-config.js';
+import { getProductConfig, isPortableProduct } from '../product-config.js';
 import { dropCurrentUserMessage } from './history-helper.js';
 import { parseImageAttachments, processImageAttachments } from '../image-attachment.js';
 import { chatAttachmentsDirPath, isValidChatAttachmentsKey } from '../attachments.js';
-import { loadProjectRuleFiles } from '../project-rules.js';
-import { allocateProjectHome, ensureChatWorkspace, ensureProjectHome, expandUserPath, } from '../project-home.js';
+import { canonicalFencePath, canonicalPathInside } from '../fence-path.js';
+import { listProjectRuleFiles, loadProjectRuleFiles } from '../project-rules.js';
+import { allocateProjectHome, chatWorkspacePath, ensureChatWorkspace, ensureProjectHome, expandUserPath, } from '../project-home.js';
 import { registerLiveStream, getLiveStream, removeLiveStream } from './live-stream.js';
 import { compactHistory, forkHistory, rewindFrom } from './history-edit.js';
+import { copyForkDirectory, DEFAULT_FORK_WORKSPACE_MAX_BYTES, directorySizeBytes, forkPathRewriter, removeForkDirectory, } from './fork-copy.js';
 import { beginPackTurnObservers, collectPackExecWritableRoots, collectPackForcedSkillVars, collectPackWorldState, } from './pack-turn-hooks.js';
 import { matchPackBackendRoute } from './pack-backend-routes.js';
 import { invokePackHttpRoute } from '../host/http-routes.js';
@@ -87,12 +90,9 @@ function readProjectOrderIds(value) {
 }
 /** 回合产物下载上限：base64 走 localBackend JSON 通道，过大文件先拒绝。 */
 const MAX_LOCAL_DOWNLOAD_BYTES = 128 * 1024 * 1024;
-/** `target` 是否位于 `root` 内部（含 root 本身）。 */
+/** `target` 是否位于 `root` 内部（含 root 本身）。比较前解析符号链接。 */
 function isPathInsideRoot(root, target) {
-    const rel = path.relative(path.resolve(root), path.resolve(target));
-    return rel === '' || (rel !== '..' &&
-        !rel.startsWith(`..${path.sep}`) &&
-        !path.isAbsolute(rel));
+    return canonicalPathInside(root, target);
 }
 /** 从一条消息的 `messageMetadata` 里取出本回合产物的绝对路径。 */
 function turnFilePathsFromMetadata(raw) {
@@ -292,6 +292,26 @@ function persistedAgentIdFromMetadata(raw) {
     const agentId = parseMessageMetadata(raw)?.agentId;
     return typeof agentId === 'string' && agentId ? agentId : undefined;
 }
+/** Rule path relative to the project root. A path outside that root keeps its base name. */
+function relativeRulePath(folderPath, file) {
+    if (!path.isAbsolute(file))
+        return file;
+    const relative = path.relative(folderPath, file);
+    if (!relative
+        || relative === '..'
+        || relative.startsWith(`..${path.sep}`)
+        || path.isAbsolute(relative))
+        return path.basename(file);
+    return relative;
+}
+/** Fork title in the caller's locale. The stored default title stays `新对话`. */
+function forkTitle(source, requestedLocale) {
+    const title = (source || '新对话').trim() || '新对话';
+    const locale = typeof requestedLocale === 'string' && requestedLocale.trim()
+        ? requestedLocale
+        : getLocale();
+    return tFor(locale, '{title} (fork)', { title });
+}
 export class LocalBackendRouter {
     toolRouter;
     defaultStore;
@@ -687,6 +707,32 @@ export class LocalBackendRouter {
                 data: { success: true, projects: registry.reorder(orderedIds) },
             };
         }
+        if (pathname === '/api/v2/projects/resolve' && method === 'POST') {
+            const registry = this.toolRouter.projectRegistry;
+            if (!registry) {
+                return { status: 503, data: { error: '项目注册表不可用' } };
+            }
+            const payload = this.toRecord(request.body);
+            const folderPath = typeof payload.folderPath === 'string' ? expandUserPath(payload.folderPath) : '';
+            if (!folderPath.trim()) {
+                return { status: 400, data: { error: '项目文件夹不能为空' } };
+            }
+            try {
+                const resolved = registry.resolveByFolder(folderPath, {
+                    ...(payload.origin === 'cli' ? { origin: 'cli' } : {}),
+                });
+                return {
+                    status: 200,
+                    data: { project: resolved.project, created: resolved.created },
+                };
+            }
+            catch (err) {
+                return {
+                    status: 400,
+                    data: { error: err instanceof Error ? err.message : String(err) },
+                };
+            }
+        }
         const projectMatch = pathname.match(/^\/api\/v2\/projects\/([^/]+)$/);
         if (projectMatch) {
             const projectId = decodeURIComponent(projectMatch[1]);
@@ -826,15 +872,16 @@ export class LocalBackendRouter {
                 return { status: 200, data: { project: null } };
             }
             const trusted = registry.isTrusted(project.id);
-            // 仅在已信任时才真正读取规则文件内容；未信任时只探测「有没有」，
-            // 不读内容（发现本身不解析、不注入）。
-            const rules = loadProjectRuleFiles(project.folderPath);
+            const files = trusted
+                ? loadProjectRuleFiles(project.folderPath).files
+                : listProjectRuleFiles(project.folderPath);
             return {
                 status: 200,
                 data: {
                     project: { id: project.id, name: project.name, folderPath: project.folderPath, trusted },
-                    ruleFileCount: rules.files.length,
-                    rulesActive: trusted && rules.files.length > 0,
+                    ruleFileCount: files.length,
+                    rulesActive: trusted && files.length > 0,
+                    files: files.map((file) => relativeRulePath(project.folderPath, file)),
                 },
             };
         }
@@ -845,6 +892,7 @@ export class LocalBackendRouter {
                 const chat = await this.store.getChat(chatId);
                 if (!chat)
                     return this.notFound('Chat not found');
+                const source = chat.forkedFrom ? await this.store.getChat(chat.forkedFrom) : null;
                 return {
                     status: 200,
                     data: {
@@ -858,6 +906,7 @@ export class LocalBackendRouter {
                         isPinned: chat.isPinned,
                         systemPrompt: chat.systemPrompt,
                         pinnedRefs: chat.pinnedRefs,
+                        forkedFrom: source ? { chatId: source.id, title: source.title } : null,
                     },
                 };
             }
@@ -941,13 +990,21 @@ export class LocalBackendRouter {
                     return this.badRequest('projectId 必须是项目 id 字符串或 null');
                 }
             }
+            let titleUpdate;
+            if (typeof payload.title === 'string') {
+                const trimmed = payload.title.trim();
+                if (!trimmed)
+                    return this.badRequest('标题不能为空');
+                titleUpdate = trimmed;
+            }
             const lease = this.tryChatLock(chatId);
             if (!lease)
                 return this.chatBusy();
             let updated;
             try {
                 updated = await this.store.updateChat(chatId, {
-                    title: typeof payload.title === 'string' ? payload.title : undefined,
+                    title: titleUpdate,
+                    titleSource: titleUpdate !== undefined ? 'user' : undefined,
                     systemPrompt: typeof payload.systemPrompt === 'string' ? payload.systemPrompt : undefined,
                     pinnedRefs: Array.isArray(payload.pinnedRefs) ? payload.pinnedRefs : undefined,
                     projectId: projectIdUpdate,
@@ -958,6 +1015,12 @@ export class LocalBackendRouter {
             }
             if (!updated)
                 return this.notFound('Chat not found');
+            if (titleUpdate !== undefined) {
+                this.broadcast?.('chat-title-updated', {
+                    chatId,
+                    title: updated.title,
+                });
+            }
             return {
                 status: 200,
                 data: {
@@ -1070,15 +1133,7 @@ export class LocalBackendRouter {
         }
         const forkMatch = pathname.match(/^\/api\/v2\/chats\/([^/]+)\/fork$/);
         if (forkMatch && method === 'POST') {
-            const chatId = forkMatch[1];
-            const chat = await this.store.getChat(chatId);
-            if (!chat)
-                return { status: 404, data: { detail: 'chat not found' } };
-            const created = await this.store.createChat(chat.title || '分叉', chat.agentId, chat.projectId);
-            for (const write of forkHistory(await this.historyTurns(chatId))) {
-                await this.store.addMessage(created.id, write.role, write.content, write.messageMetadata);
-            }
-            return { status: 200, data: { chatId: created.id } };
+            return await this.forkChat(forkMatch[1], request.body);
         }
         const rewindMatch = pathname.match(/^\/api\/v2\/chats\/([^/]+)\/rewind$/);
         if (rewindMatch && method === 'POST') {
@@ -2488,11 +2543,7 @@ export class LocalBackendRouter {
             const turnTools = this.toolRouter
                 .listModelSchemas(turnAgents.capability.toolPolicy)
                 .filter(schema => chatMode !== 'plan' || schema.mode === 'read')
-                .map(schema => ({
-                name: schema.name,
-                description: schema.description,
-                inputSchema: schema.inputSchema,
-            }));
+                .map(schema => toTurnTool(schema));
             // 用户通过 "/" 显式指定的 MCP 工具：从注册表补齐元信息，available 取决于
             // 该工具本轮是否真的在 turnTools 里（未启用/未连接/被 plan 模式过滤都算
             // 不可用——指令模块会据此渲染"强制调用"或"如实告知不可用"两种版本）。
@@ -2510,11 +2561,7 @@ export class LocalBackendRouter {
                     isToolAllowed(turnAgents.capability.toolPolicy, token)) {
                     const schema = this.toolRouter.getSchemaByName(token);
                     if (schema && (chatMode !== 'plan' || schema.mode === 'read')) {
-                        turnTools.push({
-                            name: schema.name,
-                            description: schema.description,
-                            inputSchema: schema.inputSchema,
-                        });
+                        turnTools.push(toTurnTool(schema));
                     }
                 }
                 forcedMcpTool = {
@@ -2619,15 +2666,18 @@ export class LocalBackendRouter {
                     });
                     return;
                 }
-                if (fresh.title && fresh.title !== '新对话') {
+                if (fresh.titleSource === 'user' || (fresh.title && fresh.title !== '新对话')) {
                     console.log('[local-backend] title-gen skip', {
                         chatId,
-                        reason: 'user-changed-title',
+                        reason: fresh.titleSource === 'user' ? 'user-title' : 'user-changed-title',
                         currentTitle: fresh.title,
                     });
                     return;
                 }
-                const updated = await this.store.updateChat(chatId, { title: result.title });
+                const updated = await this.store.updateChat(chatId, {
+                    title: result.title,
+                    titleSource: 'auto',
+                });
                 if (!updated) {
                     console.warn('[local-backend] title-gen write failed', { chatId });
                     return;
@@ -2717,7 +2767,10 @@ export class LocalBackendRouter {
                 },
             };
         }
-        const wanted = new Set([path.resolve(target), path.resolve(realPath)]);
+        const wanted = new Set([
+            canonicalFencePath(path.resolve(target)),
+            canonicalFencePath(realPath),
+        ]);
         let allowed = false;
         const teamUserRoot = process.env.DEEPPATH_TEAM_USER_DATA_ROOT?.trim();
         if (teamUserRoot) {
@@ -2739,7 +2792,7 @@ export class LocalBackendRouter {
             const messages = await this.store.listMessages(chatId, 1000);
             for (const message of messages) {
                 for (const listed of turnFilePathsFromMetadata(message.messageMetadata)) {
-                    if (wanted.has(path.resolve(listed))) {
+                    if (wanted.has(canonicalFencePath(path.resolve(listed)))) {
                         allowed = true;
                         break;
                     }
@@ -2874,7 +2927,15 @@ export class LocalBackendRouter {
             .filter((part) => part.trim())
             .join('\n\n');
         const polluted = this.detectToolDenialInHistory(historyAssistantTexts);
-        const runtimeEnvironment = this.buildRuntimeEnvironmentContext(chatMode);
+        const chatProject = await this.resolveChatProject(chatId);
+        const workspaceRoot = chatProject
+            ? chatProject.folderPath
+            : await this.resolveChatWorkspaceRoot(chatId);
+        // 与本回合发出的 execSandbox.enabled 同一条件。中途改成完整权限
+        // 只更新审批卡，这段提示已经发给模型。
+        const commandSandboxOn = clampExecPolicy(parseExecPolicy(payload.execPolicy), getResolvedHostTools()) !== 'full' &&
+            process.env.STEERABLE_EXEC_SANDBOX !== '0';
+        const runtimeEnvironment = this.buildRuntimeEnvironmentContext(chatMode, workspaceRoot);
         // 名录进 realityCheck：两条系统提示拼装路径（技能拼装 / 用户整段覆盖）
         // 都会带上它，且位置在末尾——不动技能正文那段 prompt cache 前缀。
         const activeGoal = (await this.toolRouter.goals().get(chatId)).goal;
@@ -2963,19 +3024,23 @@ export class LocalBackendRouter {
         // 项目模式：绑定项目的对话在系统提示末尾追加沙箱约定（两条拼装路径
         // 都追加）。硬围栏在 ToolRouter/LocalExecutor，这里让模型事先知道边界，
         // 减少越界尝试。
-        const chatProject = await this.resolveChatProject(chatId);
-        const workspaceRoot = chatProject
-            ? chatProject.folderPath
-            : await this.resolveChatWorkspaceRoot(chatId);
         if (chatProject) {
             const sourceFolderLine = chatProject.sourceFolders.length > 0
                 ? `源文件夹及其子目录也可读写：${chatProject.sourceFolders.join('、')}。`
                 : '如确需读写家目录外的目录，可请用户把该目录附加为源文件夹。';
+            const shellFence = commandSandboxOn
+                ? `文件写入（local_write_file / local_edit_file）和命令写入可以落在家目录及其全部子目录内。` +
+                    `${sourceFolderLine}` +
+                    `这些范围之外的写入会被拒绝。命令未指定 cwd 时在家目录运行。` +
+                    `只有 local_exec_shell 的显式 cwd 可以落在这些目录之外：命令仍在沙箱中运行，写入该目录会被拒绝；需要写入时，把它加为源文件夹。`
+                : `文件写入（local_write_file / local_edit_file）可以落在家目录及其全部子目录内。` +
+                    `${sourceFolderLine}` +
+                    `这些范围之外的文件写入会被拒绝。命令未指定 cwd 时在家目录运行。` +
+                    `本回合命令沙箱已关闭：local_exec_shell 的显式 cwd 可以落在这些目录之外，写入该目录不会被沙箱拒绝。`;
             systemPrompt +=
                 `\n\n【项目模式】当前对话绑定项目「${chatProject.name}」，家目录：${chatProject.folderPath}\n` +
-                    `文件写入（local_write_file / local_edit_file）和命令写入可以落在家目录及其全部子目录内。` +
-                    `${sourceFolderLine}` +
-                    `这些范围之外的写入会被拒绝。命令未指定 cwd 时在家目录运行；显式 cwd 必须落在上述可写目录（含子目录）内。` +
+                    shellFence +
+                    `pwsh 与代码片段的 cwd 必须留在这些目录内。` +
                     `相对路径按家目录解析。\n` +
                     `例外：本会话的用户上传附件目录 ${chatAttachmentsDirPath(chatId)} 只读，不在可写范围内，` +
                     `但 local_read_file 可以用绝对路径读取。` +
@@ -2999,11 +3064,15 @@ export class LocalBackendRouter {
             }
         }
         else {
+            const shellFence = commandSandboxOn
+                ? '只有 local_exec_shell 的显式 cwd 可以在工作区外：命令仍在沙箱中运行，写入该目录会被拒绝。'
+                : '本回合命令沙箱已关闭：local_exec_shell 的显式 cwd 可以在工作区外，写入该目录不会被沙箱拒绝。';
             systemPrompt +=
                 `\n\n【对话工作区】当前对话没有绑定项目。工作区：${workspaceRoot}\n` +
-                    `你的文件写入（local_write_file）和命令执行（local_exec_shell）都被限制在该目录及其子目录内：` +
-                    `写入路径越界会被拒绝；命令默认在工作区下运行，显式指定的 cwd 越界也会被拒绝。` +
-                    `请一律使用工作区内的路径（相对路径按工作区解析）。` +
+                    `文件写入（local_write_file）被限制在该目录及其子目录内，写入路径越界会被拒绝。` +
+                    `命令默认在工作区下运行。${shellFence}` +
+                    `pwsh 与代码片段的 cwd 必须留在工作区内。` +
+                    `需要保存的文件请放在工作区内（相对路径按工作区解析）。` +
                     `用户若要把对话绑到已有项目，可在输入框上方选择项目。`;
         }
         // @引用的历史对话（payload.referencedChatIds）：把被引用对话的最近消息
@@ -3269,10 +3338,10 @@ export class LocalBackendRouter {
         return (localHints.some((hint) => normalized.includes(hint)) &&
             actionHints.some((hint) => normalized.includes(hint)));
     }
-    buildRuntimeEnvironmentContext(chatMode) {
+    buildRuntimeEnvironmentContext(chatMode, workingDirectory) {
         const platform = process.platform;
         const arch = process.arch;
-        const cwd = process.cwd();
+        const cwd = workingDirectory;
         const shell = platform === 'win32'
             ? 'Windows PowerShell（默认；不要使用 bash/Linux 专属语法，除非工具返回证明实际 shell 是 WSL/bash）'
             : (process.env.SHELL || 'unknown');
@@ -3283,6 +3352,7 @@ export class LocalBackendRouter {
                 : platform === 'linux'
                     ? 'Linux'
                     : platform;
+        // 命令缺省 cwd 和相对路径都按这个目录解析，不按宿主进程的当前目录。
         const lines = [
             '',
             '',
@@ -3438,6 +3508,69 @@ export class LocalBackendRouter {
             data: { code: 'chat_busy', message: '该会话正在另一个进程中运行' },
         };
     }
+    async forkChat(chatId, body) {
+        const chat = await this.store.getChat(chatId);
+        if (!chat)
+            return { status: 404, data: { detail: 'chat not found' } };
+        const lease = this.tryChatLock(chatId);
+        if (!lease)
+            return this.chatBusy();
+        let createdId = null;
+        let attachmentsDst = null;
+        let workspaceDst = null;
+        try {
+            const workspaceSrc = chat.projectId ? null : chatWorkspacePath(chatId);
+            const maxBytes = getProductConfig().forkWorkspaceMaxBytes ?? DEFAULT_FORK_WORKSPACE_MAX_BYTES;
+            if (workspaceSrc) {
+                const bytes = directorySizeBytes(workspaceSrc);
+                if (bytes > maxBytes) {
+                    return {
+                        status: 413,
+                        data: {
+                            code: 'workspace_too_large',
+                            bytes,
+                            maxBytes,
+                            message: '工作区太大，无法分叉',
+                        },
+                    };
+                }
+            }
+            const title = forkTitle(chat.title, this.toRecord(body).locale);
+            const created = await this.store.createChat(title, chat.agentId, chat.projectId);
+            createdId = created.id;
+            await this.store.updateChat(created.id, { forkedFrom: chat.id });
+            attachmentsDst = chatAttachmentsDirPath(created.id);
+            await copyForkDirectory(chatAttachmentsDirPath(chatId), attachmentsDst);
+            if (workspaceSrc) {
+                workspaceDst = chatWorkspacePath(created.id);
+                await copyForkDirectory(workspaceSrc, workspaceDst);
+            }
+            const rewrite = forkPathRewriter(chatId, created.id);
+            for (const write of forkHistory(await this.historyTurns(chatId), rewrite)) {
+                await this.store.addMessage(created.id, write.role, write.content, write.messageMetadata);
+            }
+            return { status: 200, data: { chatId: created.id } };
+        }
+        catch (err) {
+            console.warn('[local-backend] fork failed', { chatId, err });
+            if (createdId) {
+                try {
+                    await this.store.deleteChat(createdId);
+                }
+                catch (deleteErr) {
+                    console.warn('[local-backend] fork rollback failed', { chatId: createdId, deleteErr });
+                }
+            }
+            if (attachmentsDst)
+                await removeForkDirectory(attachmentsDst);
+            if (workspaceDst)
+                await removeForkDirectory(workspaceDst);
+            return { status: 500, data: { detail: 'Fork failed' } };
+        }
+        finally {
+            lease.release();
+        }
+    }
     tryChatLock(chatId) {
         try {
             return acquireChatWriteLock(getUserDataDir(), chatId);
@@ -3639,7 +3772,9 @@ export class LocalBackendRouter {
                     ...(toolPolicy.mode === 'all' ? {} : { toolPolicy }),
                 },
                 execSandbox,
-                approval: approval ? { ...approval, writableRoots: turnFileRoots } : undefined,
+                approval: approval
+                    ? { ...approval, writableRoots: turnFileRoots, pathBase: workspaceRoot }
+                    : undefined,
                 // delegate-on-pool 统一:模型的多代理面收敛为单工具
                 // delegate_subagent(默认开)。内置画像集(explore/research/coder)
                 // 带工具域/轮次/并发/系统提示,模型按画像 description 选委派
@@ -3695,6 +3830,7 @@ export class LocalBackendRouter {
                         // W4-2: surface the per-exec sandbox marker on the tool card —
                         // enforcement is a value the user can see, not a log line.
                         ...(action.sandbox ? { sandbox: action.sandbox } : {}),
+                        ...(action.approval ? { approval: action.approval } : {}),
                         threw: false,
                     };
                     if (idx >= 0)

package/dist/local-backend/task-process.js

@@ -58,12 +58,17 @@ export function timelineFromHistoryEntries(entries) {
             if (idx < 0) {
                 idx = actions.findIndex((row) => row.tool === name && row.result === undefined);
             }
+            const data = asRecord(parsed.data);
+            const approval = asRecord(data?._approval);
+            const sandbox = asRecord(data?._sandbox);
             const row = {
                 ...(idx >= 0 ? actions[idx] : { tool: name }),
                 tool: name,
                 result: parsed.data ?? parsed,
                 success: parsed.success !== false && parsed.error == null,
                 error: typeof parsed.error === 'string' ? parsed.error : undefined,
+                ...(sandbox ? { sandbox } : {}),
+                ...(approval ? { approval } : {}),
                 threw: false,
             };
             if (idx >= 0)

package/dist/local-backend/task-service.js

@@ -26,7 +26,7 @@
 import path from 'node:path';
 import { llmService, getSidecarSupervisor } from '../llm/index.js';
 import { sidecarWireProvider } from '../storage/llm-settings.js';
-import { buildWorldState, streamCoreLoopTurn, } from './coreloop-stream.js';
+import { buildWorldState, streamCoreLoopTurn, toTurnTool, } from './coreloop-stream.js';
 import { builtinSubagentParam } from './subagent-profiles.js';
 import { buildExecSandbox } from '../sidecar/exec-sandbox.js';
 import { resolveTurnApproval } from '../host-tools-runtime.js';
@@ -290,11 +290,7 @@ export class TaskService {
         const tools = this.deps.toolRouter
             .listModelSchemas()
             .filter((schema) => schema.name !== 'task_run')
-            .map((schema) => ({
-            name: schema.name,
-            description: schema.description,
-            inputSchema: schema.inputSchema,
-        }));
+            .map((schema) => toTurnTool(schema));
         let answer = '';
         let status = 'completed';
         let error = null;
@@ -337,7 +333,9 @@ export class TaskService {
                     },
                 }),
                 execSandbox,
-                approval: approval ? { ...approval, writableRoots } : undefined,
+                approval: approval
+                    ? { ...approval, writableRoots, ...(fenceRoot ? { pathBase: fenceRoot } : {}) }
+                    : undefined,
                 // 与主对话同一套内置画像（explore/research/coder）——任务回合的
                 // 子代理编排语义不分叉。
                 subagent: builtinSubagentParam(),
@@ -383,6 +381,7 @@ export class TaskService {
                         error: action.error,
                         durationMs: action.durationMs,
                         ...(action.sandbox ? { sandbox: action.sandbox } : {}),
+                        ...(action.approval ? { approval: action.approval } : {}),
                         threw: false,
                     };
                     if (idx >= 0)

package/dist/local-backend/turn-files.js

@@ -582,7 +582,9 @@ function execCwdOf(action, projectRoot, homeDir) {
 function isCoveredByRoots(cwd, roots) {
     return roots.some((root) => {
         const rel = path.relative(path.resolve(root), cwd);
-        return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+        return rel === '' || (rel !== '..' &&
+            !rel.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(rel));
     });
 }
 /**

package/dist/local-executor.d.ts

@@ -179,8 +179,7 @@ export declare function isGuiLaunchCommand(command: string): boolean;
  * 字符串/相对路径判断，不碰 fs，方便 ToolRouter 与 LocalExecutor 共用。
  */
 export declare function isPathWithinRoot(resolvedPath: string, resolvedRoot: string): boolean;
-/** `~` 展开后 resolve。围栏比较前路径与根都要过这一步。 */
-export declare function expandFencePath(inputPath: string): string;
+export { canonicalFencePath, expandFencePath, resolveFencePath } from './fence-path.js';
 /**
  * 可写根：项目家目录（或对话工作区）加上额外可写根（源文件夹）。
  * 每个根都包含它自己和全部子目录。空列表表示不设围栏。
@@ -323,4 +322,3 @@ export declare class LocalExecutor {
     private computeDefaultShell;
     private detectWslAvailable;
 }
-export {};