ai-project-manage-cli 7.1.7 → 7.1.9

package/dist/index.js

@@ -6469,6 +6469,22 @@ var EventSession = class {
       this.dirtyIndices.delete(index);
     }
   }
+  /**
+   * 仅清除仍与上传快照一致的 dirty index。
+   * 异步同步期间若事件内容又变了，保留 dirty，由下一轮 drain 继续覆盖写入。
+   */
+  clearDirtyIfUnchanged(synced) {
+    for (const { index, data } of synced) {
+      const event = this.events[index];
+      if (!event) {
+        this.dirtyIndices.delete(index);
+        continue;
+      }
+      if (JSON.stringify(event) === data) {
+        this.dirtyIndices.delete(index);
+      }
+    }
+  }
   getEventCount() {
     return this.events.length;
   }
@@ -6621,7 +6637,7 @@ function createThrottledCursorMessageLogSync(cfg, ctx, onError) {
     lastRunAt = Date.now();
     try {
       await syncCursorMessageLog(cfg, ctx, events);
-      session.clearDirty(events.map((event) => event.index));
+      session.clearDirtyIfUnchanged(events);
     } catch (err) {
       onError(err);
     }
@@ -7023,7 +7039,11 @@ async function obtainAgent(ctx) {
       cwd: ctx.cwd,
       store: createWorkspaceLocalAgentStore(ctx.workdir),
       ...ctx.customTools ? { customTools: ctx.customTools } : {},
-      ...ctx.enableSandbox ? { sandboxOptions: { enabled: true } } : {}
+      ...ctx.enableSandbox ? {
+        sandboxOptions: { enabled: true },
+        // 只加载项目级设置，避免 ~/.cursor/mcp.json 里需 OAuth/审批的 MCP 在无头沙箱被拒
+        settingSources: ["project"]
+      } : {}
     },
     ...ctx.mode ? { mode: ctx.mode } : {}
     // mcpServers: createPlaywrightMcpServers(),
@@ -7084,9 +7104,7 @@ async function runCursorAgent(cfg, ctx, options) {
   });
   const enableSandbox = Boolean(options?.enableSandbox);
   let prompt = withPlanModeToolHint(ctx.prompt, ctx.mode);
-  if (enableSandbox) {
-    prompt = withWorkspaceBoundaryHint(prompt);
-  }
+  prompt = withWorkspaceBoundaryHint(prompt);
   console.log(
     `[apm] Cursor Agent \u5F00\u59CB messageId=${ctx.messageId} sessionId=${ctx.sessionId} cwd=${workdir} sandbox=${enableSandbox}`
   );

package/dist/webide-message-worker.js

@@ -1113,6 +1113,22 @@ var EventSession = class {
       this.dirtyIndices.delete(index);
     }
   }
+  /**
+   * 仅清除仍与上传快照一致的 dirty index。
+   * 异步同步期间若事件内容又变了，保留 dirty，由下一轮 drain 继续覆盖写入。
+   */
+  clearDirtyIfUnchanged(synced) {
+    for (const { index, data } of synced) {
+      const event = this.events[index];
+      if (!event) {
+        this.dirtyIndices.delete(index);
+        continue;
+      }
+      if (JSON.stringify(event) === data) {
+        this.dirtyIndices.delete(index);
+      }
+    }
+  }
   getEventCount() {
     return this.events.length;
   }
@@ -1265,7 +1281,7 @@ function createThrottledCursorMessageLogSync(cfg, ctx, onError) {
     lastRunAt = Date.now();
     try {
       await syncCursorMessageLog(cfg, ctx, events);
-      session.clearDirty(events.map((event) => event.index));
+      session.clearDirtyIfUnchanged(events);
     } catch (err) {
       onError(err);
     }
@@ -1743,7 +1759,11 @@ async function obtainAgent(ctx) {
       cwd: ctx.cwd,
       store: createWorkspaceLocalAgentStore(ctx.workdir),
       ...ctx.customTools ? { customTools: ctx.customTools } : {},
-      ...ctx.enableSandbox ? { sandboxOptions: { enabled: true } } : {}
+      ...ctx.enableSandbox ? {
+        sandboxOptions: { enabled: true },
+        // 只加载项目级设置，避免 ~/.cursor/mcp.json 里需 OAuth/审批的 MCP 在无头沙箱被拒
+        settingSources: ["project"]
+      } : {}
     },
     ...ctx.mode ? { mode: ctx.mode } : {}
     // mcpServers: createPlaywrightMcpServers(),
@@ -1804,9 +1824,7 @@ async function runCursorAgent(cfg, ctx, options) {
   });
   const enableSandbox = Boolean(options?.enableSandbox);
   let prompt = withPlanModeToolHint(ctx.prompt, ctx.mode);
-  if (enableSandbox) {
-    prompt = withWorkspaceBoundaryHint(prompt);
-  }
+  prompt = withWorkspaceBoundaryHint(prompt);
   console.log(
     `[apm] Cursor Agent \u5F00\u59CB messageId=${ctx.messageId} sessionId=${ctx.sessionId} cwd=${workdir} sandbox=${enableSandbox}`
   );
@@ -2200,7 +2218,7 @@ function createThrottledWebIdeMessageLogSync(cfg, ctx, onError) {
       await upsertLogHeader(cfg, ctx, {
         eventCount: session.getEventCount()
       });
-      session.clearDirty(events.map((e) => e.index));
+      session.clearDirtyIfUnchanged(events);
     } catch (err) {
       onError(err);
     }
@@ -2581,66 +2599,9 @@ async function ensureWebIdeDraftPullRequests(cfg, taskId, workdir) {
   }
 }
 
-// src/commands/connect/ensure-workspace-permissions.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
-import { join as join8 } from "path";
-var WEBIDE_MCP_ALLOWLIST = ["custom-user-tools:*"];
-function parsePermissionsConfig(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return void 0;
-    }
-    return parsed;
-  } catch {
-    return void 0;
-  }
-}
-function mergeMcpAllowlist(existing) {
-  const merged = /* @__PURE__ */ new Set([
-    ...existing ?? [],
-    ...WEBIDE_MCP_ALLOWLIST
-  ]);
-  return [...merged];
-}
-function needsMcpAllowlistUpdate(existing) {
-  const current = existing ?? [];
-  return WEBIDE_MCP_ALLOWLIST.some((entry) => !current.includes(entry));
-}
-function ensureWorkspacePermissionsConfig(workdir) {
-  const cursorDir = toFsPath(join8(workdir, ".cursor"));
-  const permissionsPath = toFsPath(join8(cursorDir, "permissions.json"));
-  let config = {};
-  if (existsSync6(permissionsPath)) {
-    const raw = readFileSync8(permissionsPath, "utf8");
-    const parsed = parsePermissionsConfig(raw);
-    if (!parsed) {
-      console.warn(
-        `[apm] \u5DE5\u4F5C\u533A permissions.json \u65E0\u6CD5\u89E3\u6790\uFF0C\u8DF3\u8FC7\u5199\u5165\uFF1A${permissionsPath}`
-      );
-      return;
-    }
-    config = parsed;
-  }
-  if (!needsMcpAllowlistUpdate(config.mcpAllowlist)) {
-    return;
-  }
-  config.mcpAllowlist = mergeMcpAllowlist(config.mcpAllowlist);
-  mkdirSync7(cursorDir, { recursive: true });
-  writeFileSync9(
-    permissionsPath,
-    `${JSON.stringify(config, null, 2)}
-`,
-    "utf8"
-  );
-  console.log(
-    `[apm] \u5DF2\u66F4\u65B0\u5DE5\u4F5C\u533A permissions \u914D\u7F6E\uFF08mcpAllowlist\uFF09\uFF1A${permissionsPath}`
-  );
-}
-
 // src/commands/connect/ensure-workspace-sandbox.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync10, existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync9, existsSync as existsSync6 } from "fs";
+import { join as join8 } from "path";
 var DEFAULT_SANDBOX_JSON = `{
   "type": "workspace_readwrite",
   "networkPolicy": {
@@ -2649,11 +2610,11 @@ var DEFAULT_SANDBOX_JSON = `{
 }
 `;
 function ensureWorkspaceSandboxConfig(workdir) {
-  const cursorDir = toFsPath(join9(workdir, ".cursor"));
-  const sandboxPath = toFsPath(join9(cursorDir, "sandbox.json"));
-  if (existsSync7(sandboxPath)) return;
-  mkdirSync8(cursorDir, { recursive: true });
-  writeFileSync10(sandboxPath, DEFAULT_SANDBOX_JSON, "utf8");
+  const cursorDir = toFsPath(join8(workdir, ".cursor"));
+  const sandboxPath = toFsPath(join8(cursorDir, "sandbox.json"));
+  if (existsSync6(sandboxPath)) return;
+  mkdirSync7(cursorDir, { recursive: true });
+  writeFileSync9(sandboxPath, DEFAULT_SANDBOX_JSON, "utf8");
   console.log(`[apm] \u5DF2\u5199\u5165\u5DE5\u4F5C\u533A sandbox \u914D\u7F6E\uFF1A${sandboxPath}`);
 }
 
@@ -2686,7 +2647,6 @@ async function handleWebIdeInboundMessage(cfg, msg, signal) {
       assertApmGitignoredInRepo(workdir);
     }
     ensureWorkspaceSandboxConfig(workdir);
-    ensureWorkspacePermissionsConfig(workdir);
     resolveWorkspaceRepos(workdir);
     if (shouldRunBranch(branchCacheKey, workdir)) {
       if (signal.aborted) throw new Error("\u4EFB\u52A1\u5DF2\u53D6\u6D88");
@@ -2727,6 +2687,7 @@ async function handleWebIdeInboundMessage(cfg, msg, signal) {
           signal
         }),
         enableWebIdePlanTools: true,
+        // sandbox：工作区 FS 硬隔离；自定义工具由 CLI createCursorCustomTools 注册
         enableSandbox: true,
         taskId,
         createRemoteLogSync: (agentId) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-project-manage-cli",
-  "version": "7.1.7",
+  "version": "7.1.9",
   "description": "命令行工具：后续用于调用平台后端 API 完成运维与自动化操作",
   "type": "module",
   "private": false,