@trim21/personal-pi-extensions 0.1.626 → 0.1.628

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.626",
+  "version": "0.1.628",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/README.md

@@ -1,7 +1,8 @@
 # bwrap 沙箱与网络栈架构
 
 本文档描述 `network: limited` 模式下的进程模型、网络路径与生命周期管理。
-基础沙箱（bwrap 文件系统隔离）见 `core.ts` / `sandbox.ts`；本文聚焦网络栈
+基础沙箱（bwrap 文件系统隔离）见 `core.ts`（配置与 argv 内容）/ `exec.ts`
+（命令行组装与进程生命周期）/ `sandbox.ts`（加载配置并运行）；本文聚焦网络栈
 （`network-stack.ts` / `holder.ts` / `mihomo-config.ts`）。
 
 ## 进程模型
@@ -21,7 +22,7 @@ pi 进程（network-stack.ts）
      必须在宿主 netns 启动（原因见「设计约束」）；持 exit-fd 读端 + tapfd。
 ```
 
-每条命令的短命子树（命令结束即退）：
+每条命令的短命子树（命令结束即退），由 `exec.ts` 组装并 spawn：
 
 ```
 nsenter -U -n --preserve-credentials -t <①的pid> \
@@ -29,7 +30,9 @@ nsenter -U -n --preserve-credentials -t <①的pid> \
 ```
 
 nsenter 进入 holder 的 userns/netns，bwrap 在里面再嵌套创建自己的 user/pid
-ns 跑命令。网络栈是每条命令现建现停（起栈 ~40ms、停栈 ~100ms），不跨命令复用：
+ns 跑命令。网络栈对外只提供 holder pid（`NetworkStack.holderPid`）与停止，
+命令行怎么拼属于执行层——`--print-args` 预览与真正执行共用同一段组装。
+网络栈是每条命令现建现停（起栈 ~40ms、停栈 ~100ms），不跨命令复用：
 allowlist 变更因此即时生效，代价是每条命令重新启动一次 mihomo。
 
 ## 网络路径

package/src/bwrap/core.ts

@@ -1,23 +1,17 @@
-import { type ChildProcess, spawn } from "node:child_process";
-import { constants, type Dirent, existsSync, readFileSync } from "node:fs";
-import { access as fsAccess, readdir, realpath, stat } from "node:fs/promises";
+import { type Dirent, existsSync, readFileSync } from "node:fs";
+import { readdir, realpath, stat } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 import process from "node:process";
 
 import { StringEnum } from "@earendil-works/pi-ai";
-import { type BashOperations, getAgentDir, getShellConfig } from "@earendil-works/pi-coding-agent";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { type Static, Type } from "typebox";
 import { Value } from "typebox/value";
 
 import { parseWithSchema } from "../lib/parse-with-schema.js";
 import { expandHome } from "../lib/path.js";
 import { type ApprovalRule } from "./approval-rules.js";
-import {
-  type NetworkStack,
-  resolveDnsServers,
-  startNetworkStack,
-  TimeoutError,
-} from "./network-stack.js";
+import { type NetworkStack, resolveDnsServers, startNetworkStack } from "./network-stack.js";
 
 const PROTECTED_DIRS = [".pi", ".agent"];
 
@@ -452,17 +446,6 @@ export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Prom
   return args;
 }
 
-function killChild(child: ChildProcess): void {
-  if (!child.pid) {
-    return;
-  }
-  try {
-    process.kill(-child.pid, "SIGKILL");
-  } catch {
-    child.kill("SIGKILL");
-  }
-}
-
 /** 网络栈子进程输出转发通道，仅用于诊断（默认丢弃）。 */
 export interface NetworkStackLog {
   holder?: (chunk: string) => void;
@@ -484,150 +467,3 @@ export async function createNetworkStack(
     ...(log?.holder && { onHolderOutput: log.holder }),
   });
 }
-
-/** 一次 bwrap 调用的完整组装结果：argv 与干净环境。 */
-export interface BwrapInvocation {
-  /** bwrap 可执行文件路径 */
-  file: string;
-  /** bwrap 参数（不含结尾的 `-- shell -lc command`） */
-  args: string[];
-  /** 沙箱内 shell 的绝对路径 */
-  shell: string;
-  /** 交给 shell 的命令 */
-  command: string;
-  /** 命令执行目录 */
-  cwd: string;
-  /** 沙箱内环境（不继承父进程） */
-  env: Record<string, string>;
-  /** network limited 模式：命令需先经 nsenter 进入 holder 的 netns。 */
-  needsNetworkStack: boolean;
-}
-
-/**
- * 组装一次 bwrap 调用。实际执行（createBwrapBashOperations）与调试打印共用这里，
- * 保证 `--print-args` 输出的命令行与真正跑的那条完全一致。
- */
-export async function buildBwrapInvocation(
-  resolved: ResolvedBwrap,
-  workspace: string,
-  command: string,
-  cwd: string,
-): Promise<BwrapInvocation> {
-  // 干净环境：不继承父进程 env/PATH，由 bash -lc 从 /etc/profile 与用户 profile 重建
-  const home = process.env.HOME;
-  if (home === undefined) {
-    throw new Error("HOME is not set; refusing to run bash in a clean environment");
-  }
-  return {
-    // 沙箱内不透传 PATH，execvp 的默认路径可能找不到 bash（如 NixOS），故在父进程解析绝对路径
-    shell: getShellConfig().shell,
-    file: findBwrap(resolved.bwrapPath),
-    args: [
-      "--ro-bind",
-      "/",
-      "/",
-      ...(await buildBwrapArgs(resolved, workspace)),
-      "--dev",
-      "/dev",
-      "--proc",
-      "/proc",
-    ],
-    command,
-    cwd,
-    env: {
-      HOME: home,
-      SHELL: "/bin/bash",
-      TERM: "dumb",
-      LANG: "C.UTF-8",
-      // 基础 PATH：profile 加载阶段（设置 PATH 前）需要系统命令（如 id），由 profile 随后覆盖；不含 sbin
-      PATH: "/usr/local/bin:/usr/bin:/bin",
-    },
-    needsNetworkStack: resolved.network === "limited",
-  };
-}
-
-/** 完整 argv（`[bwrap, ...args, "--", shell, "-lc", command]`），spawn 与打印共用。 */
-export function bwrapArgv(invocation: BwrapInvocation): string[] {
-  return [invocation.file, ...invocation.args, "--", invocation.shell, "-lc", invocation.command];
-}
-
-/**
- * @param workspace session 工作区：writablePaths 的 "." 与 PROTECTED_DIRS 都基于它解析，
- *   与当次命令的 cwd（仅作为进程执行目录）解耦，避免 workdir 参数漂移可写边界。
- */
-export function createBwrapBashOperations(
-  resolved: ResolvedBwrap,
-  workspace: string,
-  networkStack?: NetworkStack,
-): BashOperations {
-  return {
-    async exec(command, cwd, { onData, signal, timeout }) {
-      await fsAccess(cwd, constants.F_OK).catch(() => {
-        throw new Error(`Working directory does not exist: ${cwd}\nCannot execute bash commands.`);
-      });
-      // 已中断（signal.reason 是 name=AbortError 的 DOMException）：直接抛，不再执行
-      signal?.throwIfAborted();
-
-      const invocation = await buildBwrapInvocation(resolved, workspace, command, cwd);
-
-      if (invocation.needsNetworkStack) {
-        if (!networkStack) {
-          throw new Error("Network stack is not initialized for network limited mode");
-        }
-        return networkStack.exec({
-          command,
-          cwd,
-          bwrapPath: invocation.file,
-          bwrapArgs: invocation.args,
-          shell: invocation.shell,
-          env: invocation.env,
-          onData,
-          signal,
-          timeout,
-        });
-      }
-
-      const argv = bwrapArgv(invocation);
-      const child = spawn(argv[0], argv.slice(1), {
-        cwd,
-        detached: true,
-        stdio: ["ignore", "pipe", "pipe"],
-        env: invocation.env,
-      });
-
-      return new Promise<{ exitCode: number | null }>((resolve, reject) => {
-        let timedOut = false;
-        const timeoutHandle = timeout
-          ? setTimeout(() => {
-              timedOut = true;
-              killChild(child);
-            }, timeout * 1000)
-          : undefined;
-        const onAbort = () => killChild(child);
-        child.stdout.on("data", onData);
-        child.stderr.on("data", onData);
-        signal?.addEventListener("abort", onAbort, { once: true });
-        child.once("error", reject);
-        child.once("close", (exitCode) => {
-          if (timeoutHandle) {
-            clearTimeout(timeoutHandle);
-          }
-          signal?.removeEventListener("abort", onAbort);
-          // 中断：reject signal.reason（默认是 name=AbortError 的 DOMException）
-          if (signal?.aborted) {
-            reject(
-              signal.reason instanceof Error
-                ? signal.reason
-                : new Error("The operation was aborted"),
-            );
-          } else if (timedOut) {
-            // 超时：name=TimeoutError（对齐标准错误分类）
-            reject(new TimeoutError(timeout));
-          } else {
-            resolve({ exitCode });
-          }
-        });
-      });
-    },
-  };
-}

package/src/bwrap/exec.ts

@@ -0,0 +1,246 @@
+/**
+ * 执行层：把一次组装好的 bwrap 调用变成进程。
+ *
+ * 完整命令行只在这里组装（`invocationArgv`），子进程生命周期只有一份实现
+ * （`execInvocation`）——direct 与经 `nsenter` 进 holder netns 两条路径共用，
+ * 预览（`--print-args`）也走同一次组装，超时 / 中断 / 启动失败的错误语义与
+ * 打印出的命令行因此不会漂移。argv 内容与配置解析由 core.ts 提供；holder pid
+ * 由 network-stack.ts 提供，网络栈本身不知道 bwrap 参数怎么拼。
+ */
+
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { access as fsAccess } from "node:fs/promises";
+
+import { type BashOperations, getShellConfig } from "@earendil-works/pi-coding-agent";
+
+import { buildBwrapArgs, findBwrap, type ResolvedBwrap } from "./core.js";
+import type { NetworkStack } from "./network-stack.js";
+
+/** 命令超时错误：name=TimeoutError（对齐标准错误分类），message 保留 timeout:N 格式。 */
+export class TimeoutError extends Error {
+  constructor(timeout: number | undefined) {
+    super(`timeout:${timeout}`);
+    this.name = "TimeoutError";
+  }
+}
+
+/** 一次 bwrap 调用的完整组装结果：argv 与干净环境。 */
+export interface BwrapInvocation {
+  /** bwrap 可执行文件路径 */
+  file: string;
+  /** bwrap 参数（不含结尾的 `-- shell -lc command`） */
+  args: string[];
+  /** 沙箱内 shell 的绝对路径 */
+  shell: string;
+  /** 交给 shell 的命令 */
+  command: string;
+  /** 沙箱内环境（不继承父进程） */
+  env: Record<string, string>;
+  /** network limited 模式：命令需先经 nsenter 进入 holder 的 netns。 */
+  needsNetworkStack: boolean;
+}
+
+/**
+ * 组装一次 bwrap 调用。实际执行（`execInvocation`）与调试打印共用这里，
+ * 保证 `--print-args` 输出的命令行与真正跑的那条完全一致。
+ */
+export async function buildBwrapInvocation(
+  resolved: ResolvedBwrap,
+  workspace: string,
+  command: string,
+): Promise<BwrapInvocation> {
+  // 干净环境：不继承父进程 env/PATH，由 bash -lc 从 /etc/profile 与用户 profile 重建
+  const home = process.env.HOME;
+  if (home === undefined) {
+    throw new Error("HOME is not set; refusing to run bash in a clean environment");
+  }
+  return {
+    // 沙箱内不透传 PATH，execvp 的默认路径可能找不到 bash（如 NixOS），故在父进程解析绝对路径
+    shell: getShellConfig().shell,
+    file: findBwrap(resolved.bwrapPath),
+    args: [
+      "--ro-bind",
+      "/",
+      "/",
+      ...(await buildBwrapArgs(resolved, workspace)),
+      "--dev",
+      "/dev",
+      "--proc",
+      "/proc",
+    ],
+    command,
+    env: {
+      HOME: home,
+      SHELL: "/bin/bash",
+      TERM: "dumb",
+      LANG: "C.UTF-8",
+      // 基础 PATH：profile 加载阶段（设置 PATH 前）需要系统命令（如 id），由 profile 随后覆盖；不含 sbin
+      PATH: "/usr/local/bin:/usr/bin:/bin",
+    },
+    needsNetworkStack: resolved.network === "limited",
+  };
+}
+
+/**
+ * 完整命令行：`[bwrap, ...args, "--", shell, "-lc", command]`；传 `nsenterPid` 时
+ * 前置 `nsenter` 前缀进入该 holder 的 userns + netns。
+ *
+ * 预览与实际执行都调用这里——`nsenterPid` 传数字是真实 holder pid，传字符串是
+ * 尚未启动时的占位符（打印用），不传即纯 bwrap 命令行。
+ */
+export function invocationArgv(
+  invocation: BwrapInvocation,
+  nsenterPid?: number | string,
+): string[] {
+  const argv = [
+    invocation.file,
+    ...invocation.args,
+    "--",
+    invocation.shell,
+    "-lc",
+    invocation.command,
+  ];
+  if (nsenterPid === undefined) {
+    return argv;
+  }
+  return ["nsenter", "-U", "-n", "--preserve-credentials", "-t", String(nsenterPid), "--", ...argv];
+}
+
+function killChild(pid: number | undefined): void {
+  if (!pid) {
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+      // 已退出
+    }
+  }
+}
+
+export interface ExecInvocationOptions {
+  /** 命令执行目录（进程 cwd）；沙箱内可写边界由 invocation 的挂载项决定，与此无关。 */
+  cwd: string;
+  /** netns holder pid：invocation 需要网络栈时必填，缺失即抛错。 */
+  holderPid?: number;
+  /** 流式输出回调（stdout 与 stderr 已合并）。 */
+  onData: (data: Buffer) => void;
+  /** 取消：终止整个进程组并以 signal.reason（默认 AbortError）结束。 */
+  signal?: AbortSignal;
+  /** 超时秒数：终止整个进程组并以 TimeoutError 结束。 */
+  timeout?: number;
+}
+
+/**
+ * 执行一次组装好的调用（唯一一处 spawn 与生命周期）。
+ *
+ * 需要网络栈时自动前置 `nsenter` 前缀；进程以独立进程组启动，超时与取消都
+ * 终止整组，启动失败（spawn error）立即结束且不残留超时定时器。
+ */
+export function execInvocation(
+  invocation: BwrapInvocation,
+  options: ExecInvocationOptions,
+): Promise<{ exitCode: number | null }> {
+  if (invocation.needsNetworkStack && options.holderPid === undefined) {
+    return Promise.reject(new Error("Network stack is not initialized for network limited mode"));
+  }
+  const argv = invocationArgv(
+    invocation,
+    invocation.needsNetworkStack ? options.holderPid : undefined,
+  );
+  const child = spawn(argv[0], argv.slice(1), {
+    cwd: options.cwd,
+    detached: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: invocation.env,
+  });
+
+  return new Promise<{ exitCode: number | null }>((resolve, reject) => {
+    let timedOut = false;
+    let settled = false;
+    const timeoutHandle = options.timeout
+      ? setTimeout(() => {
+          timedOut = true;
+          killChild(child.pid);
+        }, options.timeout * 1000)
+      : undefined;
+    const onAbort = (): void => {
+      killChild(child.pid);
+    };
+    // 结算一次：无论走 error 还是 close，都清掉超时定时器与 abort 监听——挂着的
+    // 定时器会白占事件循环到超时那一刻。
+    const settle = (): boolean => {
+      if (settled) {
+        return false;
+      }
+      settled = true;
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      options.signal?.removeEventListener("abort", onAbort);
+      return true;
+    };
+
+    child.stdout.on("data", options.onData);
+    child.stderr.on("data", options.onData);
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+
+    child.once("error", (error) => {
+      if (!settle()) {
+        return;
+      }
+      reject(error);
+    });
+    child.once("close", (exitCode) => {
+      if (!settle()) {
+        return;
+      }
+      // 中断：reject signal.reason（默认是 name=AbortError 的 DOMException）
+      if (options.signal?.aborted) {
+        reject(
+          options.signal.reason instanceof Error
+            ? options.signal.reason
+            : new Error("The operation was aborted"),
+        );
+      } else if (timedOut) {
+        // 超时：name=TimeoutError（对齐标准错误分类）
+        reject(new TimeoutError(options.timeout));
+      } else {
+        resolve({ exitCode });
+      }
+    });
+  });
+}
+
+/**
+ * @param workspace session 工作区：writablePaths 的 "." 与 PROTECTED_DIRS 都基于它解析，
+ *   与当次命令的 cwd（仅作为进程执行目录）解耦，避免 workdir 参数漂移可写边界。
+ */
+export function createBwrapBashOperations(
+  resolved: ResolvedBwrap,
+  workspace: string,
+  networkStack?: NetworkStack,
+): BashOperations {
+  return {
+    async exec(command, cwd, { onData, signal, timeout }) {
+      await fsAccess(cwd, constants.F_OK).catch(() => {
+        throw new Error(`Working directory does not exist: ${cwd}\nCannot execute bash commands.`);
+      });
+      // 已中断（signal.reason 是 name=AbortError 的 DOMException）：直接抛，不再执行
+      signal?.throwIfAborted();
+
+      const invocation = await buildBwrapInvocation(resolved, workspace, command);
+      return execInvocation(invocation, {
+        cwd,
+        holderPid: networkStack?.holderPid,
+        onData,
+        signal,
+        timeout,
+      });
+    },
+  };
+}

package/src/bwrap/network-stack.ts

@@ -9,14 +9,6 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { forEachLine } from "../lib/proc.js";
 import { generateMihomoConfig, TUN_MTU } from "./mihomo-config.js";
 
-/** 命令超时错误：name=TimeoutError（对齐标准错误分类），message 保留 timeout:N 格式。 */
-export class TimeoutError extends Error {
-  constructor(timeout: number | undefined) {
-    super(`timeout:${timeout}`);
-    this.name = "TimeoutError";
-  }
-}
-
 export interface NetworkStackOptions {
   /** 允许直连的域名 / IP:port 列表（每次命令从配置重新读取）。 */
   readonly allowlist: readonly string[];
@@ -31,19 +23,6 @@ export interface NetworkStackOptions {
   readonly onHolderOutput?: (chunk: string) => void;
 }
 
-interface NetworkStackExecOptions {
-  readonly command: string;
-  readonly cwd: string;
-  readonly bwrapPath: string;
-  /** bwrap 的完整参数（不含 -- 后的 shell 与命令），由 core.ts 组装。 */
-  readonly bwrapArgs: readonly string[];
-  readonly shell: string;
-  readonly env: Readonly<Record<string, string>>;
-  readonly onData: (data: Buffer) => void;
-  readonly signal?: AbortSignal;
-  readonly timeout?: number;
-}
-
 const NAMESERVER_PATTERN = /^\s*nameserver\s+(\S+)/;
 
 /**
@@ -198,21 +177,6 @@ function waitForMihomoStarted(holder: ChildProcess, timeoutMs = 20000): Promise<
   });
 }
 
-function killChild(pid: number | undefined): void {
-  if (!pid) {
-    return;
-  }
-  try {
-    process.kill(-pid, "SIGKILL");
-  } catch {
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch {
-      // 已退出
-    }
-  }
-}
-
 /**
  * 额外转发子进程输出给诊断回调（就绪探测的监听器不受影响），并把全部输出
  * 收进 collect：启动失败时落盘，否则没有别的渠道能看到 holder 的真实死因。
@@ -237,7 +201,6 @@ function forwardOutput(
 }
 
 export interface NetworkStack {
-  exec(options: NetworkStackExecOptions): Promise<{ exitCode: number | null }>;
   stop(): Promise<void>;
   /** holder pid：可 `nsenter -U -n --preserve-credentials -t <pid>` 手动进入该 netns 排查。 */
   readonly holderPid: number;
@@ -391,80 +354,6 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
 
     const state: NetworkStackState = { holderPid, slirpPid: slirp.pid, mihomoHome };
     const stack: NetworkStack = {
-      exec: async (execOptions: NetworkStackExecOptions) => {
-        const child = spawn(
-          "nsenter",
-          [
-            "-U",
-            "-n",
-            "--preserve-credentials",
-            "-t",
-            String(holderPid),
-            "--",
-            execOptions.bwrapPath,
-            ...execOptions.bwrapArgs,
-            "--",
-            execOptions.shell,
-            "-lc",
-            execOptions.command,
-          ],
-          {
-            cwd: execOptions.cwd,
-            detached: true,
-            stdio: ["ignore", "pipe", "pipe"],
-            env: execOptions.env,
-          },
-        );
-
-        return new Promise<{ exitCode: number | null }>((resolve, reject) => {
-          let timedOut = false;
-          let settled = false;
-          const timeoutHandle = execOptions.timeout
-            ? setTimeout(() => {
-                timedOut = true;
-                killChild(child.pid);
-              }, execOptions.timeout * 1000)
-            : undefined;
-          const onAbort = (): void => {
-            killChild(child.pid);
-          };
-
-          child.stdout.on("data", execOptions.onData);
-          child.stderr.on("data", execOptions.onData);
-          execOptions.signal?.addEventListener("abort", onAbort, { once: true });
-
-          child.once("error", (error) => {
-            if (settled) {
-              return;
-            }
-            settled = true;
-            reject(error);
-          });
-          child.once("close", (exitCode) => {
-            if (settled) {
-              return;
-            }
-            settled = true;
-            if (timeoutHandle) {
-              clearTimeout(timeoutHandle);
-            }
-            execOptions.signal?.removeEventListener("abort", onAbort);
-            // 中断：reject signal.reason（默认是 name=AbortError 的 DOMException）
-            if (execOptions.signal?.aborted) {
-              reject(
-                execOptions.signal.reason instanceof Error
-                  ? execOptions.signal.reason
-                  : new Error("The operation was aborted"),
-              );
-            } else if (timedOut) {
-              // 超时：name=TimeoutError（对齐标准错误分类）
-              reject(new TimeoutError(execOptions.timeout));
-            } else {
-              resolve({ exitCode });
-            }
-          });
-        });
-      },
       stop: async () => {
         const children = await readChildPids(state.holderPid);
         // slirp4netns 持有 tap fd（pin 住 netns），必须随 holder 一起显式终止；

package/src/bwrap/sandbox.ts

@@ -16,10 +16,7 @@ import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
 
 import { expandHome } from "../lib/path.js";
 import {
-  buildBwrapInvocation,
-  bwrapArgv,
   type BwrapConfig,
-  createBwrapBashOperations,
   createNetworkStack,
   type FsMode,
   getBwrapConfigPaths,
@@ -30,6 +27,7 @@ import {
   resolveBwrapPath,
   type ResolvedBwrap,
 } from "./core.js";
+import { buildBwrapInvocation, createBwrapBashOperations, invocationArgv } from "./exec.js";
 import type { NetworkStack } from "./network-stack.js";
 
 export interface SandboxConfigInput {
@@ -161,7 +159,7 @@ export interface SandboxPreview {
 }
 
 /**
- * 打印将要执行的命令行（`--print-args`）。与 runInSandbox 共用同一段组装逻辑，
+ * 打印将要执行的命令行（`--print-args`）。与 `execInvocation` 共用同一段组装，
  * 不存在「打印的是一回事、跑的是另一回事」的漂移。
  */
 export async function previewSandboxCommand(
@@ -171,23 +169,13 @@ export async function previewSandboxCommand(
   },
 ): Promise<SandboxPreview> {
   const workspace = expandHome(options.workspace);
-  const commandCwd = expandHome(options.commandCwd ?? workspace);
-  const invocation = await buildBwrapInvocation(resolved, workspace, options.command, commandCwd);
+  const invocation = await buildBwrapInvocation(resolved, workspace, options.command);
   if (!invocation.needsNetworkStack || options.unsandboxed === true) {
-    return { argv: bwrapArgv(invocation), env: invocation.env, needsNetworkStack: false };
+    return { argv: invocationArgv(invocation), env: invocation.env, needsNetworkStack: false };
   }
   return {
-    // 与 network-stack.ts 的实际 spawn 一致；holder 未启动时用占位符标出 pid 的位置
-    argv: [
-      "nsenter",
-      "-U",
-      "-n",
-      "--preserve-credentials",
-      "-t",
-      options.holderPid === undefined ? HOLDER_PID_PLACEHOLDER : String(options.holderPid),
-      "--",
-      ...bwrapArgv(invocation),
-    ],
+    // holder 未启动时用占位符标出 pid 的位置
+    argv: invocationArgv(invocation, options.holderPid ?? HOLDER_PID_PLACEHOLDER),
     env: invocation.env,
     needsNetworkStack: true,
   };

package/src/spawn-agent.ts

@@ -16,9 +16,11 @@
  * `MAX_PROGRESS_LINES` lines. Consecutive tool calls are merged into a
  * single `tool:` line (`read x 2, glob`) and over-long line content is
  * folded to the first/last 9 chars joined by `…`, so a burst of tool calls
- * or a long text block does not flood the window; any text block starts a
- * new line. Line content is sanitized first: markdown marker characters are
- * stripped and whitespace (including newlines) is collapsed to single spaces,
+ * or a long text block does not flood the window; only a text block starts
+ * a new line — thinking is a transient status line, so it does not break the
+ * merge across turn boundaries. Line content is sanitized first: markdown
+ * marker characters are stripped and whitespace (including newlines) is
+ * collapsed to single spaces,
  * so one log entry is always exactly one rendered line. The final line is
  * always the subagent name as a code span (`` `scout` ``), followed by the
  * live usage stats when there are any; it rides outside the rolling window so
@@ -91,8 +93,11 @@ export const SUBAGENT_DEFAULT_SANDBOX: BwrapConfig = completeBwrapConfig({
   fs: { mode: "readonly" },
   network: { mode: "block" },
 });
-/** Progress log keeps only the most recent lines (rolling window). */
-const MAX_PROGRESS_LINES = 5;
+/**
+ * Progress log keeps only the most recent lines (rolling window).
+ * 展开后面板最多 6 行内容：4 行日志 + 可能的一行瞬态 thinking + 固定的 metadata 行。
+ */
+const MAX_PROGRESS_LINES = 4;
 /** Progress line content (without the `tool:` / `text:` prefix) is capped at 21 chars; longer text is folded to the first/last 9 chars joined by ` … `. */
 const MAX_PROGRESS_CHARS_PER_LINE = 21;
 /**
@@ -464,7 +469,8 @@ export async function runAgent(
   let logLines: string[] = [];
   // 工具调用行合并:连续的 tool_execution_start 事件合并在同一 `tool:` 行
   // (如 `tool: read x 2, glob`),相同工具名连续出现时计为 `name x N`,
-  // 不同名按调用顺序罗列;任何非工具行都会打断合并。
+  // 不同名按调用顺序罗列;只有写入日志行的事件(text 块)打断合并,thinking
+  // 不写日志行、也不打断合并。
   let toolLineSegments: string[] = [];
   let toolLine: { name: string; count: number } | undefined;
   // 思考中状态：thinking_start 打开、thinking_delta 累计字符数、thinking_end
@@ -476,7 +482,7 @@ export async function runAgent(
     if (logLines.length > MAX_PROGRESS_LINES) {
       logLines = logLines.slice(-MAX_PROGRESS_LINES);
     }
-    // 任何非工具行都会打断工具调用合并,下一批调用另起一行。
+    // 写进日志的新行都会打断工具调用合并,下一批调用另起一行。
     toolLine = undefined;
   };
 
@@ -537,8 +543,8 @@ export async function runAgent(
             break;
           }
           case "thinking_start": {
-            // 思考横跨轮次边界：打断工具行合并，下一批工具调用另起一行。
-            toolLine = undefined;
+            // thinking 不产生日志行，因此不打断工具行合并：跨轮次的连续工具调用
+            // 仍累加到同一 `tool:` 行。
             thinkingChars = 0;
             emitUpdate();
             break;