@tencent-ai/agent-sdk 0.3.206-dev.0c715ff.202607102010 → 0.3.206

package/cli/vendor/shim/sitecustomize.py

@@ -13,11 +13,8 @@ genie-safe-delete — Python 运行时安全删除 shim
 """
 
 import errno
-import builtins
-import io
 import json
 import os
-import socket
 import stat
 import sys
 import tempfile
@@ -32,11 +29,6 @@ _SESSION_ID = (
     or os.environ.get("CLAUDE_SESSION_ID")
 )
 _IN_SANDBOX = os.environ.get("CODEBUDDY_SAFE_DELETE_SANDBOX") == "1"
-_SAFE_DELETE_ENABLED = os.environ.get("CODEBUDDY_SAFE_DELETE_ENABLED") != "0"
-_BROKERED_FS_HOOK_ENABLED = (
-    os.environ.get("CODEBUDDY_BROKERED_FS_HOOK_ENABLED") == "1"
-    or _IN_SANDBOX
-)
 
 if _SESSION_ID:
     # __file__ 在 sitecustomize 加载时指向本文件路径，dirname 即 vendor/shim/
@@ -276,484 +268,14 @@ if _SESSION_ID:
     import pathlib
     import platform
 
-    _orig_builtin_open = builtins.open
-    _orig_io_open = io.open
-    _orig_os_open = os.open
     _orig_remove = os.remove
     _orig_unlink = os.unlink
     _orig_rmdir = os.rmdir
-    _orig_mkdir = os.mkdir
-    _orig_makedirs = os.makedirs
-    _orig_rename = os.rename
-    _orig_replace = os.replace
-    _orig_chmod = os.chmod
-    _orig_link = os.link
-    _orig_symlink = os.symlink
     _orig_shutil_rmtree = shutil.rmtree
-    _orig_shutil_copyfile = shutil.copyfile
-    _orig_shutil_copy2 = shutil.copy2
-    _orig_shutil_copytree = shutil.copytree
     _orig_path_unlink = pathlib.Path.unlink
     _orig_path_rmdir = pathlib.Path.rmdir
-    _orig_path_mkdir = pathlib.Path.mkdir
-    _orig_path_touch = pathlib.Path.touch
     _report_path = os.environ.get("CODEBUDDY_SAFE_DELETE_REPORT_PATH")
 
-    # -----------------------------------------------------------------------
-    # Brokered sandbox file-token support.
-    #
-    # Mirrors the shell/toybox broker model, but the interception point is
-    # Python's runtime file APIs. The host still owns policy and token issuing.
-    # -----------------------------------------------------------------------
-
-    _broker_socket_path = os.environ.get("CODEBUDDY_SANDBOX_BROKER_IPC_ADDRESS")
-    _broker_session_id = os.environ.get("CODEBUDDY_SANDBOX_BROKER_SESSION_ID") or _SESSION_ID
-    _broker_tool_call_id = (
-        os.environ.get("CODEBUDDY_SANDBOX_BROKER_TOOL_CALL_ID")
-        or os.environ.get("CODEBUDDY_TOOL_CALL_ID")
-    )
-    _broker_trace_id = os.environ.get("CODEBUDDY_SANDBOX_BROKER_TRACE_ID")
-    _broker_file_token_command = (
-        os.environ.get("CODEBUDDY_SANDBOX_FILE_TOKEN_OPERATION_COMMAND")
-        or "FileTokenRequest"
-    )
-    _broker_host_operation_command = os.environ.get(
-        "CODEBUDDY_SANDBOX_HOST_FILE_OPERATION_COMMAND"
-    )
-    _broker_request_seq = 0
-    _broker_host_operation_depth = 0
-    _COPYTREE_DEFAULT = object()
-
-    def _broker_enabled():
-        return bool(sys.platform == "darwin" and _BROKERED_FS_HOOK_ENABLED and _broker_socket_path and _broker_session_id and _broker_file_token_command)
-
-    def _broker_write_completed_enabled():
-        return bool(sys.platform == "darwin" and _BROKERED_FS_HOOK_ENABLED and _broker_socket_path and _broker_session_id)
-
-    def _broker_host_ops_enabled():
-        return bool(
-            sys.platform == "darwin"
-            and _BROKERED_FS_HOOK_ENABLED
-            and _broker_socket_path
-            and _broker_session_id
-            and _broker_host_operation_command
-            and _broker_host_operation_depth == 0
-        )
-
-    def _broker_abs_path(file_path, dir_fd=None):
-        if isinstance(file_path, int):
-            return None
-        try:
-            raw_path = os.fspath(file_path)
-        except TypeError:
-            return None
-        if isinstance(raw_path, bytes):
-            try:
-                raw_path = os.fsdecode(raw_path)
-            except UnicodeError:
-                return None
-        if not raw_path:
-            return None
-        if dir_fd is not None and not os.path.isabs(raw_path):
-            return None
-        return os.path.abspath(raw_path)
-
-    def _broker_readline(sock):
-        chunks = []
-        while True:
-            chunk = sock.recv(1)
-            if not chunk:
-                break
-            if chunk == b"\n":
-                break
-            chunks.append(chunk)
-        return b"".join(chunks).decode("utf-8", errors="replace")
-
-    def _broker_consume_token(token):
-        if sys.platform != "darwin":
-            return
-        import ctypes
-
-        lib = ctypes.CDLL(None, use_errno=True)
-        fn = lib.sandbox_extension_consume
-        fn.argtypes = [ctypes.c_char_p]
-        fn.restype = ctypes.c_int64
-        handle = fn(token.encode("utf-8"))
-        if handle <= 0:
-            err = ctypes.get_errno() or errno.EINVAL
-            raise OSError(err, os.strerror(err))
-
-    def _broker_send_request(request):
-        try:
-            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
-                sock.settimeout(5)
-                sock.connect(_broker_socket_path)
-                sock.sendall((json.dumps(request, separators=(",", ":")) + "\n").encode("utf-8"))
-                line = _broker_readline(sock)
-        except Exception:
-            return None
-
-        try:
-            response = json.loads(line)
-        except Exception:
-            return None
-        return response if isinstance(response, dict) else None
-
-    def _broker_request_file_token(abs_path, operation):
-        global _broker_request_seq
-        if not _broker_enabled():
-            return
-
-        _broker_request_seq += 1
-        request = {
-            "id": "python-%d" % _broker_request_seq,
-            "command": _broker_file_token_command,
-            "runtime": "python",
-            "operation": operation,
-            "path": abs_path,
-            "sessionId": _broker_session_id,
-        }
-        if _broker_tool_call_id:
-            request["toolCallId"] = _broker_tool_call_id
-        if _broker_trace_id:
-            request["brokerTraceId"] = _broker_trace_id
-
-        response = _broker_send_request(request)
-        if response is None:
-            # Match toybox's fail-to-sandbox behavior: if IPC is unavailable,
-            # do not grant anything here; let the native sandbox decide.
-            return
-
-        token = response.get("token") if response.get("ok") is True else None
-        if isinstance(token, str) and token:
-            _broker_consume_token(token)
-            return
-        if response.get("decision") == "sandbox":
-            return
-
-        raise PermissionError(
-            response.get("error")
-            or "Brokered sandbox denied %s access to %s" % (operation, abs_path)
-        )
-
-    def _broker_notify_file_write_completed(abs_path, existed_before):
-        global _broker_request_seq
-        if existed_before:
-            return
-        if not _broker_write_completed_enabled():
-            return
-
-        _broker_request_seq += 1
-        request = {
-            "id": "python-%d" % _broker_request_seq,
-            "command": "FileWriteCompleted",
-            "runtime": "python",
-            "operation": "write",
-            "path": abs_path,
-            "sessionId": _broker_session_id,
-        }
-        if _broker_tool_call_id:
-            request["toolCallId"] = _broker_tool_call_id
-        if _broker_trace_id:
-            request["brokerTraceId"] = _broker_trace_id
-        _broker_send_request(request)
-
-    def _broker_request_host_operation(operation, primary_path, **fields):
-        global _broker_request_seq
-        if not _broker_host_ops_enabled():
-            return False
-
-        _broker_request_seq += 1
-        request = {
-            "id": "python-%d" % _broker_request_seq,
-            "command": _broker_host_operation_command,
-            "runtime": "python",
-            "operation": operation,
-            "sessionId": _broker_session_id,
-        }
-        request.update(fields)
-        if _broker_tool_call_id:
-            request["toolCallId"] = _broker_tool_call_id
-        if _broker_trace_id:
-            request["brokerTraceId"] = _broker_trace_id
-
-        response = _broker_send_request(request)
-        if response is None:
-            return False
-        if response.get("ok") is True:
-            return True
-        if response.get("decision") == "sandbox":
-            return False
-        raise PermissionError(
-            response.get("error")
-            or "Brokered sandbox denied host %s for %s" % (operation, primary_path)
-        )
-
-    def _broker_call_native_host_operation(fn, *args, **kwargs):
-        global _broker_host_operation_depth
-        _broker_host_operation_depth += 1
-        try:
-            return fn(*args, **kwargs)
-        finally:
-            _broker_host_operation_depth -= 1
-
-    def _broker_operation_for_mode(mode):
-        mode = mode or "r"
-        return "write" if any(ch in mode for ch in "wax+") else "read"
-
-    def _broker_operation_for_flags(flags):
-        write_flags = (
-            os.O_WRONLY
-            | os.O_RDWR
-            | os.O_CREAT
-            | os.O_TRUNC
-            | os.O_APPEND
-            | getattr(os, "O_TMPFILE", 0)
-        )
-        return "write" if flags & write_flags else "read"
-
-    def _broker_gate(file_path, operation, dir_fd=None):
-        abs_path = _broker_abs_path(file_path, dir_fd=dir_fd)
-        if abs_path:
-            _broker_request_file_token(abs_path, operation)
-
-    def _brokered_open(
-        open_fn,
-        file,
-        mode="r",
-        buffering=-1,
-        encoding=None,
-        errors=None,
-        newline=None,
-        closefd=True,
-        opener=None,
-    ):
-        operation = _broker_operation_for_mode(mode)
-        abs_path = _broker_abs_path(file)
-        existed_before = bool(abs_path and os.path.exists(abs_path))
-        if abs_path:
-            _broker_request_file_token(abs_path, operation)
-        file_obj = open_fn(file, mode, buffering, encoding, errors, newline, closefd, opener)
-        if operation == "write" and abs_path and os.path.exists(abs_path):
-            _broker_notify_file_write_completed(abs_path, existed_before)
-        return file_obj
-
-    def _brokered_builtin_open(
-        file,
-        mode="r",
-        buffering=-1,
-        encoding=None,
-        errors=None,
-        newline=None,
-        closefd=True,
-        opener=None,
-    ):
-        return _brokered_open(
-            _orig_builtin_open,
-            file, mode, buffering, encoding, errors, newline, closefd, opener,
-        )
-
-    def _brokered_io_open(
-        file,
-        mode="r",
-        buffering=-1,
-        encoding=None,
-        errors=None,
-        newline=None,
-        closefd=True,
-        opener=None,
-    ):
-        return _brokered_open(
-            _orig_io_open,
-            file, mode, buffering, encoding, errors, newline, closefd, opener,
-        )
-
-    def _brokered_os_open(path, flags, mode=0o777, *, dir_fd=None):
-        _broker_gate(path, _broker_operation_for_flags(flags), dir_fd=dir_fd)
-        if dir_fd is not None:
-            return _orig_os_open(path, flags, mode, dir_fd=dir_fd)
-        return _orig_os_open(path, flags, mode)
-
-    def _brokered_os_mkdir(path, mode=0o777, *, dir_fd=None):
-        abs_path = _broker_abs_path(path, dir_fd=dir_fd)
-        if abs_path and isinstance(mode, int) and _broker_request_host_operation(
-            "mkdir", abs_path, path=abs_path, mode=mode
-        ):
-            return None
-        if dir_fd is not None:
-            return _broker_call_native_host_operation(_orig_mkdir, path, mode, dir_fd=dir_fd)
-        return _broker_call_native_host_operation(_orig_mkdir, path, mode)
-
-    def _brokered_os_makedirs(name, mode=0o777, exist_ok=False):
-        abs_path = _broker_abs_path(name)
-        if abs_path and isinstance(mode, int):
-            if not exist_ok and os.path.exists(abs_path):
-                return _broker_call_native_host_operation(
-                    _orig_makedirs, name, mode=mode, exist_ok=exist_ok
-                )
-            if _broker_request_host_operation(
-                "mkdir", abs_path, path=abs_path, recursive=True, mode=mode
-            ):
-                return None
-        return _broker_call_native_host_operation(
-            _orig_makedirs, name, mode=mode, exist_ok=exist_ok
-        )
-
-    def _brokered_os_rename(src, dst, *, src_dir_fd=None, dst_dir_fd=None):
-        from_path = _broker_abs_path(src, dir_fd=src_dir_fd)
-        to_path = _broker_abs_path(dst, dir_fd=dst_dir_fd)
-        if from_path and to_path and _broker_request_host_operation(
-            "rename", from_path, **{"from": from_path, "to": to_path}
-        ):
-            return None
-        if src_dir_fd is not None or dst_dir_fd is not None:
-            return _broker_call_native_host_operation(
-                _orig_rename, src, dst, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd
-            )
-        return _broker_call_native_host_operation(_orig_rename, src, dst)
-
-    def _brokered_os_replace(src, dst, *, src_dir_fd=None, dst_dir_fd=None):
-        from_path = _broker_abs_path(src, dir_fd=src_dir_fd)
-        to_path = _broker_abs_path(dst, dir_fd=dst_dir_fd)
-        if from_path and to_path and _broker_request_host_operation(
-            "rename", from_path, **{"from": from_path, "to": to_path}
-        ):
-            return None
-        if src_dir_fd is not None or dst_dir_fd is not None:
-            return _broker_call_native_host_operation(
-                _orig_replace, src, dst, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd
-            )
-        return _broker_call_native_host_operation(_orig_replace, src, dst)
-
-    def _brokered_os_chmod(path, mode, *, dir_fd=None, follow_symlinks=True):
-        abs_path = _broker_abs_path(path, dir_fd=dir_fd)
-        if abs_path and isinstance(mode, int) and follow_symlinks and _broker_request_host_operation(
-            "chmod", abs_path, path=abs_path, mode=mode
-        ):
-            return None
-        if dir_fd is not None:
-            return _broker_call_native_host_operation(
-                _orig_chmod, path, mode, dir_fd=dir_fd, follow_symlinks=follow_symlinks
-            )
-        return _broker_call_native_host_operation(
-            _orig_chmod, path, mode, follow_symlinks=follow_symlinks
-        )
-
-    def _brokered_os_link(src, dst, *, src_dir_fd=None, dst_dir_fd=None, follow_symlinks=True):
-        from_path = _broker_abs_path(src, dir_fd=src_dir_fd)
-        to_path = _broker_abs_path(dst, dir_fd=dst_dir_fd)
-        should_broker = follow_symlinks and from_path and to_path
-        try:
-            should_broker = should_broker and not os.path.islink(from_path)
-        except Exception:
-            should_broker = False
-        if should_broker and _broker_request_host_operation(
-            "link", from_path, **{"from": from_path, "to": to_path, "symbolic": False}
-        ):
-            return None
-        if src_dir_fd is not None or dst_dir_fd is not None:
-            return _broker_call_native_host_operation(
-                _orig_link, src, dst, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd,
-                follow_symlinks=follow_symlinks
-            )
-        return _broker_call_native_host_operation(
-            _orig_link, src, dst, follow_symlinks=follow_symlinks
-        )
-
-    def _brokered_os_symlink(src, dst, target_is_directory=False, *, dir_fd=None):
-        source = None
-        try:
-            source = os.fspath(src)
-            if isinstance(source, bytes):
-                source = os.fsdecode(source)
-        except (TypeError, UnicodeError):
-            source = None
-        to_path = _broker_abs_path(dst, dir_fd=dir_fd)
-        if source and to_path and _broker_request_host_operation(
-            "link", to_path, **{"from": source, "to": to_path, "symbolic": True}
-        ):
-            return None
-        if dir_fd is not None:
-            return _broker_call_native_host_operation(
-                _orig_symlink, src, dst, target_is_directory, dir_fd=dir_fd
-            )
-        return _broker_call_native_host_operation(
-            _orig_symlink, src, dst, target_is_directory
-        )
-
-    def _brokered_shutil_copyfile(src, dst, *, follow_symlinks=True):
-        from_path = _broker_abs_path(src)
-        to_path = _broker_abs_path(dst)
-        if follow_symlinks and from_path and to_path and _broker_request_host_operation(
-            "copy", from_path, **{"from": from_path, "to": to_path, "recursive": False}
-        ):
-            return dst
-        return _broker_call_native_host_operation(
-            _orig_shutil_copyfile, src, dst, follow_symlinks=follow_symlinks
-        )
-
-    def _brokered_shutil_copytree(
-        src,
-        dst,
-        symlinks=False,
-        ignore=None,
-        copy_function=_COPYTREE_DEFAULT,
-        ignore_dangling_symlinks=False,
-        dirs_exist_ok=False,
-    ):
-        native_copy_function = (
-            _orig_shutil_copy2
-            if copy_function is _COPYTREE_DEFAULT
-            else copy_function
-        )
-        can_broker = (
-            symlinks is False
-            and ignore is None
-            and native_copy_function is _orig_shutil_copy2
-            and ignore_dangling_symlinks is False
-            and dirs_exist_ok is False
-        )
-        from_path = _broker_abs_path(src) if can_broker else None
-        to_path = _broker_abs_path(dst) if can_broker else None
-        if from_path and to_path and _broker_request_host_operation(
-            "copy", from_path, **{"from": from_path, "to": to_path, "recursive": True}
-        ):
-            return dst
-        return _broker_call_native_host_operation(
-            _orig_shutil_copytree,
-            src,
-            dst,
-            symlinks=symlinks,
-            ignore=ignore,
-            copy_function=native_copy_function,
-            ignore_dangling_symlinks=ignore_dangling_symlinks,
-            dirs_exist_ok=dirs_exist_ok,
-        )
-
-    def _brokered_path_mkdir(self, mode=0o777, parents=False, exist_ok=False):
-        abs_path = _broker_abs_path(self)
-        if abs_path and isinstance(mode, int):
-            if not exist_ok and os.path.exists(abs_path):
-                return _broker_call_native_host_operation(
-                    _orig_path_mkdir, self, mode=mode, parents=parents, exist_ok=exist_ok
-                )
-            if _broker_request_host_operation(
-                "mkdir", abs_path, path=abs_path, recursive=parents, mode=mode
-            ):
-                return None
-        return _broker_call_native_host_operation(
-            _orig_path_mkdir, self, mode=mode, parents=parents, exist_ok=exist_ok
-        )
-
-    def _brokered_path_touch(self, mode=0o666, exist_ok=True):
-        abs_path = _broker_abs_path(self)
-        can_broker = abs_path and mode == 0o666 and (exist_ok or not os.path.exists(abs_path))
-        if can_broker and _broker_request_host_operation("touch", abs_path, path=abs_path):
-            return None
-        return _broker_call_native_host_operation(
-            _orig_path_touch, self, mode=mode, exist_ok=exist_ok
-        )
-
     def _path_for_compare(path):
         return os.path.normcase(os.path.realpath(os.path.abspath(path)))
 
@@ -792,7 +314,7 @@ if _SESSION_ID:
         if not _report_path:
             return
         try:
-            with _orig_builtin_open(_report_path, "a", encoding="utf-8") as f:
+            with open(_report_path, "a", encoding="utf-8") as f:
                 f.write(json.dumps({
                     "operation": "trash",
                     "runtime": "python",
@@ -897,30 +419,11 @@ if _SESSION_ID:
         return False
 
     # -----------------------------------------------------------------------
-    # 核心：移入回收站。
+    # 核心：尝试移入回收站。优先 binary，降级到平台内联实现。
     # 返回 True=已移入回收站；抛错=fail-closed，调用方不得真删。
     # -----------------------------------------------------------------------
 
-    def _try_broker_delete(abs_path, recursive=False, force=False):
-        if not _broker_host_ops_enabled():
-            return "unavailable"
-        try:
-            if _broker_request_host_operation(
-                "delete",
-                abs_path,
-                path=abs_path,
-                deleteMode="trash",
-                recursive=bool(recursive),
-                force=bool(force),
-            ):
-                return "ok"
-            return "unavailable"
-        except PermissionError:
-            return "denied"
-        except Exception:
-            return "unavailable"
-
-    def _try_trash(abs_path, recursive=False, force=False):
+    def _try_trash(abs_path):
         if sys.platform == "win32" and _IN_SANDBOX:
             message = (
                 "[safe-delete][SAFE_DELETE_FAIL_CLOSED] "
@@ -936,15 +439,6 @@ if _SESSION_ID:
                 pass
             raise OSError(message)
         _check_bulk_delete_guard(abs_path)
-
-        broker_result = _try_broker_delete(abs_path, recursive=recursive, force=force)
-        if broker_result == "ok":
-            return True
-        if broker_result == "denied":
-            raise PermissionError(
-                "[safe-delete] broker denied delete: path=%s" % abs_path
-            )
-
         if _try_trash_via_binary(abs_path):
             _record_trash(abs_path)
             return True
@@ -967,18 +461,17 @@ if _SESSION_ID:
         except OSError:
             return False
 
-    def _is_under_root(root, abs_path):
+    def _is_under_os_tmp_dir(abs_path):
         try:
             target = _path_for_compare(os.fsdecode(abs_path))
-            root_path = _path_for_compare(root)
-            rel = os.path.relpath(target, root_path)
-        except (TypeError, UnicodeError, ValueError):
+        except (TypeError, UnicodeError):
             return False
-        return rel not in ("", ".") and rel != ".." and not rel.startswith(".." + os.sep) and not os.path.isabs(rel)
-
-    def _is_under_os_tmp_dir(abs_path):
         for tmp_dir in _os_tmp_dirs:
-            if _is_under_root(tmp_dir, abs_path):
+            try:
+                rel = os.path.relpath(target, tmp_dir)
+            except ValueError:
+                continue
+            if rel not in ("", ".") and rel != ".." and not rel.startswith(".." + os.sep) and not os.path.isabs(rel):
                 return True
         return False
 
@@ -996,9 +489,6 @@ if _SESSION_ID:
                 return True
         return False
 
-    def _should_bypass_safe_delete(abs_path):
-        return _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path)
-
     # -----------------------------------------------------------------------
     # 包装：os.remove / os.unlink （文件，不能是目录）
     # -----------------------------------------------------------------------
@@ -1008,7 +498,7 @@ if _SESSION_ID:
         if dir_fd is not None:
             return _orig_remove(path, dir_fd=dir_fd)
         abs_path = os.path.abspath(os.fspath(path))
-        if _should_bypass_safe_delete(abs_path):
+        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
             return _orig_remove(path)
         st = _safe_lstat(abs_path)
         if not st:
@@ -1025,7 +515,7 @@ if _SESSION_ID:
         if dir_fd is not None:
             return _orig_rmdir(path, dir_fd=dir_fd)
         abs_path = os.path.abspath(os.fspath(path))
-        if _should_bypass_safe_delete(abs_path):
+        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
             return _orig_rmdir(path)
         st = _safe_lstat(abs_path)
         if not st:
@@ -1049,7 +539,7 @@ if _SESSION_ID:
                 path, ignore_errors=ignore_errors, onerror=onerror, **kwargs
             )
 
-        if _should_bypass_safe_delete(abs_path):
+        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
             return _orig_shutil_rmtree(
                 path, ignore_errors=ignore_errors, onerror=onerror, **kwargs
             )
@@ -1066,7 +556,7 @@ if _SESSION_ID:
             )
 
         try:
-            _try_trash(abs_path, recursive=True)
+            _try_trash(abs_path)
         except Exception as e:
             if ignore_errors:
                 return
@@ -1081,7 +571,7 @@ if _SESSION_ID:
 
     def _safe_path_unlink(self, missing_ok=False):
         abs_path = os.path.abspath(str(self))
-        if _should_bypass_safe_delete(abs_path):
+        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
             return _orig_path_unlink(self, missing_ok=missing_ok)
         st = _safe_lstat(abs_path)
         if not st:
@@ -1094,7 +584,7 @@ if _SESSION_ID:
 
     def _safe_path_rmdir(self):
         abs_path = os.path.abspath(str(self))
-        if _should_bypass_safe_delete(abs_path):
+        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
             return _orig_path_rmdir(self)
         st = _safe_lstat(abs_path)
         if not st:
@@ -1109,28 +599,9 @@ if _SESSION_ID:
     # 安装 patch
     # -----------------------------------------------------------------------
 
-    if _broker_enabled():
-        builtins.open = _brokered_builtin_open
-        io.open = _brokered_io_open
-        os.open = _brokered_os_open
-
-    if _broker_host_ops_enabled():
-        os.mkdir = _brokered_os_mkdir
-        os.makedirs = _brokered_os_makedirs
-        os.rename = _brokered_os_rename
-        os.replace = _brokered_os_replace
-        os.chmod = _brokered_os_chmod
-        os.link = _brokered_os_link
-        os.symlink = _brokered_os_symlink
-        shutil.copyfile = _brokered_shutil_copyfile
-        shutil.copytree = _brokered_shutil_copytree
-        pathlib.Path.mkdir = _brokered_path_mkdir
-        pathlib.Path.touch = _brokered_path_touch
-
-    if _SAFE_DELETE_ENABLED:
-        os.remove = _safe_remove
-        os.unlink = _safe_remove  # CPython 里 os.unlink is os.remove，显式 patch 兼容其它实现
-        os.rmdir = _safe_rmdir
-        shutil.rmtree = _safe_shutil_rmtree
-        pathlib.Path.unlink = _safe_path_unlink
-        pathlib.Path.rmdir = _safe_path_rmdir
+    os.remove = _safe_remove
+    os.unlink = _safe_remove  # CPython 里 os.unlink is os.remove，显式 patch 兼容其它实现
+    os.rmdir = _safe_rmdir
+    shutil.rmtree = _safe_shutil_rmtree
+    pathlib.Path.unlink = _safe_path_unlink
+    pathlib.Path.rmdir = _safe_path_rmdir

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tencent-ai/agent-sdk",
-  "version": "0.3.206-dev.0c715ff.202607102010",
+  "version": "0.3.206",
   "description": "CodeBuddy Code SDK for JavaScript/TypeScript",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -31,7 +31,6 @@
     "zod": "^4.0.0"
   },
   "publishConfig": {
-    "access": "public",
-    "tag": "dev"
+    "access": "public"
   }
 }