codebee 0.1.101 → 0.1.102

package/CHANGELOG.md

@@ -4,6 +4,15 @@ CodeBee 的用户可感知变更记录。发布新版时：最上面加一节，
 `<!-- relnotes:start -->…<!-- relnotes:end -->` 段（那段会被 `npm view` 的
 README 元数据带回，供老版本在「发现新版本」时展示新版更新内容）。
 
+## v0.1.102（2026-10-10）
+
+- **蜂巢 3D 蜜蜂办公室全面重建（程序化 WebGL 场景）**：3D 场景从参考贴图升级为全程序化 WebGL 实时渲染——办公室/工位/灯光/蜜蜂形态全部由代码建模并大幅精修（关节手打字、椭圆半透明翅膀、腹部金环纹、人体工学椅、双层光源与接触阴影），静态几何 GPU 批处理+按需渲染更流畅，轨道/平移/复位手感修正，实时遥测投到工位屏幕玻璃上，场景 overlay 支持读屏与键盘；新增**全屏工作台**：参考图/WebGL/2D 三种视图皆可一键全屏（保留画面比例），全屏冒烟测试常驻护航
+- **发布台存草稿四修**：44 章假成功真凶=submit 被 auto_submit 人工闸吞掉而 manager 仍记成功；现以编辑器保存反馈为凭据、起草前 attach-only 对账剔除已发布章、连接瞬断同章自动重试一次、跨批自动发布浏览器互斥（拒起/让位）；对账剔除/跳过/重试在发布台进度提示可见
+- **连载超限快照改存 git 对象库**：书稿 manuscript.md 涨破 1MB 快照单文件上限时，评审步曾全灭报「评审模型不可用」伞形文案（增长型悬崖）；现超限前态改 `hash-object` 存工作区对象库（≤1MB 仍内嵌），快照/预览/恢复全链路适配并修正大文件恢复指纹；非 git 目录维持拒绝（宁拒不假装可恢复）
+- **大屏实时流对 CLI 步骤回退读日志**：外部 CLI 只落日志文件不写 stream/thinking，连载全 CLI 流程大屏此前永远停在「等待实时输出…」；现回退读步骤日志尾巴（与蜂巢卡同源翻译），跑马灯取实时窗口末行
+- **运行详情步骤行窄主列折行**：模型/供应商徽章把定宽列总和顶到超宽，浏览器缩放/窄窗/检查器挤压主列时必出面板横向滚动条、CLI 日志按钮被切半；≤820px 容器查询自动折行，宽主列单行形态不变，老浏览器优雅降级
+- **命令执行后端可选 Docker 容器**：设置页新增沙箱后端选择（本机默认/Docker 容器）；Docker 仅适用于内置命令工具，ACP、外部 CLI 与 MCP 暂不支持容器化、将安全拒绝执行
+
 ## v0.1.101（2026-10-10）
 
 - **重写未达标章带上旧账（连载）**：上一轮评审的 major 意见（章节点名+全书级）随重写提示词下发（`__REDO_ISSUES__` 渲染「上一轮评审未达标原因」块），被 major 点名的过线章一并回炉——总判定卡 major 时只重写未过线章消不掉账的空转实案修复，作者第一遍就知道往哪改

package/README.md

@@ -25,13 +25,14 @@ Trae Agent、OpenClaw……），提供
 ---
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.101）
-
-- 连载重写带旧账：上一轮评审 major 意见随重写提示词下发，被点名章一并回炉
-- 评审口径事前下发作者面：写作前就知道按什么标准被审（与评审面同源，永不脱节）
-- 插件安装失败回滚修复（人话报错+残缺自愈，不再 500/永久撞车）
-- 错误行带崩溃现场（traceback 尾帧直达 UI，同因止损按位置区分）
-- 代码块长行缺省自动换行，运行详情不再撑横向滚动条
+### 最新版更新内容（v0.1.102）
+
+- 蜂巢 3D 蜜蜂办公室全面重建：全程序化 WebGL 实时渲染+大幅视觉精修，参考图/WebGL/2D 三视图皆可一键全屏
+- 发布台存草稿四修：假成功真凶（submit 被人工闸吞掉）根治，保存反馈当凭据+对账剔除+瞬断重试+跨批互斥
+- 连载书稿涨破 1MB 快照上限不再全灭：超限前态改存 git 对象库，恢复链路全适配
+- 大屏实时流对 CLI 步骤回退读日志，全 CLI 连载流程不再永远「等待实时输出」
+- 运行详情窄主列自动折行，缩放/窄窗不再出横向滚动条
+- 命令执行后端可选 Docker 容器（内置命令工具专属）
 <!-- relnotes:end -->
 
 

package/app/core/acp_client.py

@@ -15,6 +15,34 @@ from .env_scrub import scrub_env
 
 _MAX_LINE = 2 * 1024 * 1024
 _MAX_TEXT = 2 * 1024 * 1024
+_MAX_ACP_EVENTS = 200
+_ACP_EVENT_TYPES = {
+    "agent_thought_chunk", "tool_call", "tool_call_update", "plan",
+    "current_mode_update", "config_option_update", "session_info_update",
+    "available_commands_update", "usage_update", "session_notification",
+}
+
+
+def _record_session_update(events, update):
+    """Keep bounded, redacted ACP event metadata without tool payloads."""
+    if not isinstance(update, dict) or len(events) >= _MAX_ACP_EVENTS:
+        return
+    kind = str(update.get("sessionUpdate") or "")[:60]
+    if kind not in _ACP_EVENT_TYPES:
+        return
+    from .redact import scrub_text
+    item = {"sessionUpdate": kind}
+    for key in ("toolCallId", "title", "status", "modeId", "configId", "commandId"):
+        value = update.get(key)
+        if isinstance(value, (str, int, float, bool)):
+            item[key] = scrub_text(str(value), limit=160)
+    entries = update.get("entries")
+    if kind == "plan" and isinstance(entries, list):
+        item["entries"] = [{
+            "content": scrub_text(str(entry.get("content") or ""), limit=160),
+            "status": scrub_text(str(entry.get("status") or ""), limit=40),
+        } for entry in entries[:12] if isinstance(entry, dict)]
+    events.append(item)
 
 
 class ACPError(Exception):
@@ -336,6 +364,7 @@ def run_agent(agent, prompt, workdir=None, readonly=True, timeout=1200,
         if absolute_deadline is None:
             absolute_deadline = started + max(1.0, float(timeout or 1200))
         text_parts = []
+        acp_events = []
         terminals = {}
         session_id = str(resume or "")
 
@@ -344,8 +373,9 @@ def run_agent(agent, prompt, workdir=None, readonly=True, timeout=1200,
             if message.get("method") == "session/update":
                 params = message.get("params") or {}
                 update = params.get("update") or {}
-                if params.get("sessionId") == session_id and \
-                        update.get("sessionUpdate") == "agent_message_chunk":
+                if params.get("sessionId") == session_id:
+                    _record_session_update(acp_events, update)
+                if params.get("sessionId") == session_id and update.get("sessionUpdate") == "agent_message_chunk":
                     content = update.get("content") or {}
                     if content.get("type") == "text":
                         piece = str(content.get("text") or "")
@@ -395,7 +425,8 @@ def run_agent(agent, prompt, workdir=None, readonly=True, timeout=1200,
         return {"ok": True, "text": "".join(text_parts)[:_MAX_TEXT], "json": None,
                 "cost_usd": 0.0, "tokens": 0, "usage": None, "error": "",
                 "error_code": "", "raw": {"exit_code": 0,
-                                               "duration": time.monotonic() - started},
+                                               "duration": time.monotonic() - started,
+                                               "acp_events": acp_events},
                 "kind": "acp", "model": None, "sid": session_id,
                 "attempts": []}
     except InterruptedError as exc:

package/app/core/board.py

@@ -66,22 +66,16 @@ def run_detail(run_id):
     }
 
 
-def _tail(step):
-    """步骤实时流（正文优先，其次思考）的最后一行，给大屏跑马灯。"""
-    for key in ("stream", "thinking"):
-        v = step.get(key)
-        if isinstance(v, str) and v.strip():
-            lines = [ln.strip() for ln in v.strip().splitlines() if ln.strip()]
-            if lines:
-                return lines[-1][:_TAIL_MAX]
-    return ""
-
-
-def _live_block(step):
+def _live_windows(run_id, step):
     """步骤实时流窗口：尾部多行（正文优先，其次思考），供大屏看它在想什么。
 
     返回 (来源标签 code, 文本)；标签是 code（output/thinking），由前端 i18n
-    翻译——大屏要做多语言，后端不下发中文。都没有返回 ("", "")。
+    翻译——大屏要做多语言，后端不下发中文。
+
+    内置智能体步骤边跑边把流写进步骤记录（store.stream_step）；外部 CLI 步骤
+    只落日志文件、run.json 里没有 stream——此前的连载全 CLI 流程在大屏上永远
+    「等待实时输出…」（弹窗日志却有内容，2026-10-10 用户反馈）。故回退读日志
+    尾巴：与蜂巢卡 hiveTick 同源同窗口（tail 夹取，不整读大日志）。
     """
     for key, code in (("stream", "output"), ("thinking", "thinking")):
         v = step.get(key)
@@ -91,6 +85,14 @@ def _live_block(step):
         lines = [ln for ln in lines if ln]
         if lines:
             return code, "\n".join(lines[-_TAIL_LINES:])
+    rel = step.get("log")
+    if rel and run_id:
+        from . import store
+        text = store.read_step_log(str(run_id), str(rel), tail=2400, pretty=True)
+        lines = [ln.strip()[:_TAIL_LINE_CHARS] for ln in (text or "").splitlines()]
+        lines = [ln for ln in lines if ln]
+        if lines:
+            return "output", "\n".join(lines[-_TAIL_LINES:])
     return "", ""
 
 
@@ -129,18 +131,19 @@ def _duration_s(run):
     return None
 
 
-def _step_view(steps, prov_map):
+def _step_view(steps, prov_map, run_id=""):
     """进度概要：完成数 + 当前运行中步骤（含模型/厂商/实时流）。"""
     done = sum(1 for s in steps if s.get("status") == "done")
     cur = next((s for s in steps if s.get("status") == "running"), None)
     cur_v = None
     if cur:
-        live_label, live_text = _live_block(cur)
+        live_label, live_text = _live_windows(run_id, cur)
         model = str(cur.get("model") or "")[:60]
+        tail = (live_text.splitlines() or [""])[-1][:_TAIL_MAX] if live_text else ""
         cur_v = {"n": cur.get("n"), "role": cur.get("role") or "",
                  "agent": cur.get("agent_label") or cur.get("agent") or "",
                  "summary": (cur.get("summary") or "")[:80],
-                 "tail": _tail(cur),
+                 "tail": tail,
                  "model": model, "provider": prov_map.get(model, "") if model else "",
                  "live_label": live_label, "live_text": live_text}
     return done, len(steps), cur_v
@@ -167,7 +170,8 @@ def _build():
         run = latest.get(tid)
         status = t.get("status")
         if status == "running" and run and run.get("status") == "running":
-            done, total, cur = _step_view(run.get("steps") or [], prov_map)
+            done, total, cur = _step_view(run.get("steps") or [], prov_map,
+                                          run_id=run.get("id"))
             running.append({
                 "task_id": tid, "run_id": run.get("id"),
                 "title": t.get("title") or "", "goal": (t.get("goal") or "")[:120],

package/app/core/builtin_agent.py

@@ -441,13 +441,20 @@ def _tool_run_command(workdir, args, cancel_event=None, deadline=None, sandbox=N
     # policy keeps the user-approved full-trust tier (2026-09-22) instead of
     # refusing every command.
     has_bwrap = os.name == "posix" and bool(shutil.which("bwrap"))
-    if sandbox.get("network") is False and not has_bwrap:
+    if sandbox.get("network") is False and not has_bwrap and sandbox.get("backend") != "docker":
         return "（沙箱拒绝：当前系统没有可用的网络隔离后端，命令未执行）"
-    if sandbox.get("env_allowlist"):
+    if sandbox.get("env_allowlist") and sandbox.get("backend") != "docker":
         # run_process 的 env 是注入语义（合并进完整父环境，供凭据注入），
         # 不是白名单替换——环境收窄在子进程侧无法兑现，宁拒不假装
         return "（沙箱拒绝：该任务带环境变量白名单，命令执行无法兑现该策略，未执行）"
-    if has_bwrap:
+    if sandbox.get("backend") == "docker":
+        try:
+            from .sandbox_runtime import docker_argv, docker_env
+            argv = docker_argv(cmdline, sandbox=sandbox, workdir=cwd)
+            launch_env = docker_env(sandbox)
+        except Exception as exc:
+            return "（沙箱拒绝：%s，命令未执行）" % str(exc)[:240]
+    elif has_bwrap:
         argv = ["bwrap", "--die-with-parent", "--new-session", "--tmpfs", "/"]
         # Mount only the runtime needed by ordinary commands. Do not expose the
         # entire host root read-only: read access can still leak user secrets.
@@ -468,10 +475,12 @@ def _tool_run_command(workdir, args, cancel_event=None, deadline=None, sandbox=N
             argv.extend(["--dir", root_path])
             argv.extend(["--bind", root_path, root_path])
         argv.extend(["--chdir", cwd, "--", "/bin/sh", "-lc", cmdline])
+        launch_env = None
     else:
         argv = None   # 全信任档：runner 按平台自包 cmd /c 或 /bin/sh -c
+        launch_env = None
     r = runner.run_process(argv=argv, shell_cmd=cmdline if argv is None else None,
-                           cwd=cwd, env=None,
+                           cwd=cwd, env=launch_env,
                            timeout=min(timeout, CMD_MAX_TIMEOUT),
                            deadline=deadline, cancel_event=cancel_event)
     out = runner.clean_cli_text(

package/app/core/catalog.py

@@ -200,15 +200,19 @@ DEFAULT_CATALOG = [
     {
         "id": "trae-agent", "name": "Trae Agent", "cli_group": "installable",
         "note": "字节跳动开源 trae-agent；可执行名 trae-cli；PyPI 无包，uv tool 从 "
-                "GitHub 直装（Python ≥3.12）；无头 trae-cli run \"提示词\"（一次性任务"
-                "形态）；配置 trae_config.yaml 默认找当前工作目录（TRAE_CONFIG_FILE "
-                "可指定），默认模型是 agents.trae_agent.model 指向 models 表别名的两层"
-                "引用，CodeBee 暂不托管其模型落盘——绑定模型请在 trae_config.yaml 自配",
+                "GitHub 直装（Python ≥3.12）；--with 钉 cryptography<49——49.0.0 起"
+                "上游不再发 Intel Mac wheel，缺 brew 的 Mac 落 sdist 编译必死于 "
+                "openssl-sys；无头 trae-cli run \"提示词\"（一次性任务形态）；配置 "
+                "trae_config.yaml 默认找当前工作目录（TRAE_CONFIG_FILE 可指定），"
+                "默认模型是 agents.trae_agent.model 指向 models 表别名的两层引用，"
+                "CodeBee 暂不托管其模型落盘——绑定模型请在 trae_config.yaml 自配",
         "detect": {"cli": "trae-cli"},
         "orch": {"kind": "generic", "command": "trae-cli", "argv_template": ["run", "{prompt}"]},
         "config": {"path": "~/.trae/trae_config.yaml", "format": None, "model_key": None},
-        "install": "uv tool install --python 3.12 git+https://github.com/bytedance/trae-agent",
-        "upgrade": "uv tool install --force --python 3.12 git+https://github.com/bytedance/trae-agent",
+        "install": 'uv tool install --python 3.12 --with "cryptography<49"'
+                   " git+https://github.com/bytedance/trae-agent",
+        "upgrade": 'uv tool install --force --python 3.12 --with "cryptography<49"'
+                   " git+https://github.com/bytedance/trae-agent",
         "uninstall": "uv tool uninstall trae-agent",
         "default_enabled": False,
     },
@@ -395,6 +399,24 @@ def _apply_install_patch(entries):
         cur = (e.get("install") or "").strip()
         if "pip" in cur and "install" in cur:
             e["install"], e["upgrade"] = aider_uv
+    # trae-agent 经 google-genai→google-auth 拉 cryptography，而 cryptography
+    # 49.0.0 起不再发 Intel Mac wheel（只剩 macosx_11_0_arm64）——uv 找不到
+    # wheel 落 sdist 经 maturin/cargo 编译，openssl-sys 在无 brew 的 Mac 上
+    # 缺 pkg-config/OpenSSL 开发头必死（2026-10-10 Mac 实案）。钉 <49（48.x
+    # 是最后带 macosx_10_9_universal2 的系列，google-auth 只要求 >=38.0.3）
+    # 让 uv 恒走预编译 wheel。凡 uv 形态且未钉 cryptography 的旧命令一律
+    # 迁移——钉版是兼容底线不是偏好，trae 的安装命令本就无人手改。
+    trae_pinned = ('uv tool install --python 3.12 --with "cryptography<49"'
+                   " git+https://github.com/bytedance/trae-agent")
+    trae_upgrade_pinned = ('uv tool install --force --python 3.12'
+                           ' --with "cryptography<49"'
+                           " git+https://github.com/bytedance/trae-agent")
+    for e in entries:
+        if e.get("id") != "trae-agent":
+            continue
+        cur = (e.get("install") or "").strip()
+        if "uv tool install" in cur and "cryptography<" not in cur:
+            e["install"], e["upgrade"] = trae_pinned, trae_upgrade_pinned
     if sys.platform == "win32":
         return
     for e in entries:

package/app/core/checkpoints.py

@@ -7,6 +7,7 @@ import json
 import base64
 import difflib
 import os
+import re
 import secrets
 import stat
 import subprocess
@@ -21,7 +22,7 @@ from .redact import scrub_text
 _DIR = paths.DATA_DIR / "checkpoints"
 _LOCK = threading.RLock()
 _TERMINAL = {"done", "failed", "cancelled", "timeout", "unknown"}
-_SNAPSHOT_MAX_BYTES = 1024 * 1024
+_SNAPSHOT_MAX_BYTES = 1024 * 1024      # ≤此值内嵌快照 JSON；超限进 git 对象库
 _SNAPSHOT_TOTAL_MAX_BYTES = 16 * 1024 * 1024
 _SUPPORTS_DIR_FD_RENAME = os.rename in getattr(os, "supports_dir_fd", set())
 
@@ -141,7 +142,12 @@ def replay_preview(run_id):
                     or x.get("step") not in starts), None)
     if not steps:
         unknown = {"reason": "checkpoint_not_found"}
+    total_steps = len(steps)
+    max_preview_steps = 200
+    steps = steps[-max_preview_steps:]
     return {"run_id": str(run_id or ""), "steps": steps,
+            "total_steps": total_steps,
+            "truncated": total_steps > max_preview_steps,
             "replayable": unknown is None,
             "blocked_reason": ("checkpoint_not_found" if not steps else
                                "requires_reconciliation" if unknown else "")}
@@ -198,15 +204,17 @@ def _load_snapshot(run_id, rel):
 def capture_file(run_id, workdir, path):
     """Persist the first pre-edit bytes for a workspace-relative file.
 
-    Full-content snapshots are intentionally bounded; unsupported/large files
-    are reported as untracked rather than silently treated as reversible.
+    ≤1MB 内嵌进快照 JSON（b64）；更大的文件（连载全书稿这类持续增长的
+    tracked 脏文件）前态进工作区 git 对象库，不再顶着 1MB 上限把整步拒死
+    （2026-10-10 实案：manuscript.md 涨到 1.14MB 后全部评审步被「已有改动
+    无法完整快照」拒起 CLI）。对象库也存不进（非 git 目录）才维持拒绝：
+    起跑闸宁拒不假装可恢复。
     """
     root, rel = _safe_snapshot_path(workdir, path)
     if root is None:
         return {"ok": False, "reason": "path_outside_workspace"}
     with _LOCK:
-        existing = _load_snapshot(run_id, rel)
-        if existing:
+        if _load_snapshot(run_id, rel):
             return {"ok": True, "existing": True, "path": rel}
         snap_dir = _snapshot_dir(run_id)
         try:
@@ -215,28 +223,32 @@ def capture_file(run_id, workdir, path):
             target = root / rel
             existed = target.exists()
             raw = target.read_bytes() if existed else b""
-            if len(raw) > _SNAPSHOT_MAX_BYTES or total + len(raw) > _SNAPSHOT_TOTAL_MAX_BYTES:
-                return {"ok": False, "reason": "snapshot_size_limit", "path": rel}
-            item = {"path": rel, "existed": existed,
-                    "before_b64": base64.b64encode(raw).decode("ascii"),
-                    "before_sha256": hashlib.sha256(raw).hexdigest() if existed else "",
-                    "after_sha256": None, "captured_at": time.time()}
-            _snapshot_file(run_id, rel).write_text(
-                json.dumps(item, ensure_ascii=False, sort_keys=True), encoding="utf-8")
-            return {"ok": True, "existing": False, "path": rel}
+            if len(raw) > _SNAPSHOT_MAX_BYTES:
+                return _write_oversize_snapshot(run_id, root, rel, existed,
+                                                file_path=target)
+            if total + len(raw) > _SNAPSHOT_TOTAL_MAX_BYTES:
+                # b64 预算满：大内容照样可以走对象库，别在这里误杀
+                return _write_oversize_snapshot(run_id, root, rel, existed,
+                                                file_path=target) if raw else \
+                    {"ok": False, "reason": "snapshot_size_limit", "path": rel}
+            return _write_snapshot(run_id, rel, existed, raw=raw)
         except OSError as exc:
             return {"ok": False, "reason": "snapshot_io_error", "path": rel,
                     "detail": str(exc)[:200]}
 
 
 def capture_bytes(run_id, workdir, path, raw, *, existed=True):
-    """Persist an explicit pre-step byte image (used for clean Git baseline files)."""
+    """Persist an explicit pre-step byte image (used for clean Git baseline files).
+
+    超限字节流同样进 git 对象库兜底：finish 阶段从 HEAD 取回的 clean 基线
+    （如归档后的整本 manuscript.md）此前只能给 warning，现在也能完整留底。
+    """
     root, rel = _safe_snapshot_path(workdir, path)
     if root is None:
         return {"ok": False, "reason": "path_outside_workspace"}
     raw = bytes(raw or b"") if existed else b""
     if len(raw) > _SNAPSHOT_MAX_BYTES:
-        return {"ok": False, "reason": "snapshot_size_limit", "path": rel}
+        return _write_oversize_snapshot(run_id, root, rel, existed, raw=raw)
     with _LOCK:
         if _load_snapshot(run_id, rel):
             return {"ok": True, "existing": True, "path": rel}
@@ -246,27 +258,87 @@ def capture_bytes(run_id, workdir, path, raw, *, existed=True):
             total = sum(p.stat().st_size for p in snap_dir.glob("*.json") if p.is_file())
             if total + len(raw) > _SNAPSHOT_TOTAL_MAX_BYTES:
                 return {"ok": False, "reason": "snapshot_size_limit", "path": rel}
-            item = {"path": rel, "existed": bool(existed),
-                    "before_b64": base64.b64encode(raw).decode("ascii"),
-                    "before_sha256": hashlib.sha256(raw).hexdigest() if existed else "",
-                    "after_sha256": None, "captured_at": time.time()}
-            _snapshot_file(run_id, rel).write_text(
-                json.dumps(item, ensure_ascii=False, sort_keys=True), encoding="utf-8")
-            return {"ok": True, "existing": False, "path": rel}
+            return _write_snapshot(run_id, rel, existed, raw=raw)
         except OSError as exc:
             return {"ok": False, "reason": "snapshot_io_error", "path": rel,
                     "detail": str(exc)[:200]}
 
 
-def _git_bytes(workdir, *args):
+def _git_bytes(workdir, *args, data=None):
     try:
         return subprocess.run(["git", "-C", str(workdir), *args],
                               stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                              input=data,
                               timeout=15, check=False)
     except (OSError, subprocess.SubprocessError):
         return None
 
 
+def _git_blob_sha(workdir, *, file_path=None, raw=None):
+    """把内容存进工作区 git 仓库的对象库，返回 blob sha（空串=失败）。
+
+    超限文件的前态走这里：blob 内容寻址、批间归档提交后自然转为被引用；
+    未被引用期间也只在 git gc 的两周宽限后才可能被清，与检查点生命周期同量级。
+    """
+    if file_path is not None:
+        res = _git_bytes(workdir, "hash-object", "-w", "--", str(file_path))
+    else:
+        res = _git_bytes(workdir, "hash-object", "-w", "--stdin", data=bytes(raw or b""))
+    if not res or res.returncode:
+        return ""
+    sha = os.fsdecode(res.stdout).strip()
+    return sha if re.fullmatch(r"[0-9a-f]{40}", sha) else ""
+
+
+def _snapshot_before_bytes(item, root):
+    """快照的前态字节：小文件取 JSON 内嵌 b64，超限文件回对象库取 blob。
+
+    返回 None = 前态不可得（对象库不可用或已被清理），调用方按不可恢复处理。
+    """
+    b64 = item.get("before_b64")
+    if b64:
+        return base64.b64decode(b64, validate=True)
+    sha = item.get("before_git_blob") or ""
+    if sha:
+        res = _git_bytes(root, "cat-file", "blob", sha)
+        if res is not None and not res.returncode:
+            return res.stdout
+    return None
+
+
+def _write_snapshot(run_id, rel, existed, raw=None, blob_sha=""):
+    """落一份前态快照记录：小文件内嵌 b64，超限文件只记 blob 引用。"""
+    item = {"path": rel, "existed": bool(existed),
+            "before_sha256": hashlib.sha256(raw or b"").hexdigest() if existed else "",
+            "after_sha256": None, "captured_at": time.time()}
+    if blob_sha:
+        item["before_git_blob"] = blob_sha
+    else:
+        item["before_b64"] = base64.b64encode(raw or b"").decode("ascii")
+    _snapshot_file(run_id, rel).write_text(
+        json.dumps(item, ensure_ascii=False, sort_keys=True), encoding="utf-8")
+    return {"ok": True, "existing": False, "path": rel}
+
+
+def _write_oversize_snapshot(run_id, root, rel, existed, *, file_path=None, raw=None):
+    """超限前态的落盘：存进 git 对象库；存不进（非 git 目录）才维持拒绝。"""
+    if file_path is not None:
+        sha = _git_blob_sha(root, file_path=file_path)
+    else:
+        sha = _git_blob_sha(root, raw=raw)
+    if not sha:
+        return {"ok": False, "reason": "snapshot_size_limit", "path": rel}
+    with _LOCK:
+        if _load_snapshot(run_id, rel):
+            return {"ok": True, "existing": True, "path": rel}
+        try:
+            _snapshot_dir(run_id).mkdir(parents=True, exist_ok=True)
+            return _write_snapshot(run_id, rel, existed, blob_sha=sha)
+        except OSError as exc:
+            return {"ok": False, "reason": "snapshot_io_error", "path": rel,
+                    "detail": str(exc)[:200]}
+
+
 def _git_changed_paths(workdir, gitmod):
     """Return every changed path, including both sides of renames/copies."""
     result = _git_bytes(workdir, "status", "--porcelain", "-z", "--untracked-files=all")
@@ -453,7 +525,7 @@ def snapshot_preview(run_id, workdir):
                 target = root / rel
                 current = target.read_bytes() if target.is_file() and not target.is_symlink() else None
                 current_hash = hashlib.sha256(current).hexdigest() if current is not None else None
-                before = base64.b64decode(item.get("before_b64") or "", validate=True)
+                before = _snapshot_before_bytes(item, root)
                 status = "unchanged" if current_hash == item.get("before_sha256") else "changed"
                 if "after_exists" in item:
                     can_restore = (bool(item.get("after_exists")) == (current is not None)
@@ -464,7 +536,9 @@ def snapshot_preview(run_id, workdir):
                 else:
                     can_restore = item.get("after_sha256") == current_hash
                 diff = ""
-                if current is not None and item.get("existed"):
+                if before is None and item.get("before_git_blob"):
+                    diff = "（大文件前态存于 git 对象库且当前不可读取，差异省略）"
+                elif current is not None and item.get("existed") and before is not None:
                     try:
                         old_text = before.decode("utf-8").splitlines(True)
                         new_text = current.decode("utf-8").splitlines(True)
@@ -521,16 +595,26 @@ def _restore_file_posix(root, rel, item, expected_exists, expected_hash):
                 try:
                     if not stat.S_ISREG(os.fstat(file_fd).st_mode):
                         return False
-                    with os.fdopen(file_fd, "rb", closefd=False) as handle:
-                        current = handle.read(_SNAPSHOT_MAX_BYTES + 1)
+                    # 全量流式哈希：截断读会让超限文件（前态走对象库的那种）
+                    # 的指纹恒不匹配、永远拒恢复。
+                    digest = hashlib.sha256()
+                    while True:
+                        chunk = os.read(file_fd, 1 << 20)
+                        if not chunk:
+                            break
+                        digest.update(chunk)
+                    current = digest.hexdigest()
                 finally:
                     os.close(file_fd)
         current_exists = current is not None
-        current_hash = hashlib.sha256(current).hexdigest() if current_exists else None
+        current_hash = current if current_exists else None
         if current_exists != bool(expected_exists) or current_hash != expected_hash:
             return False
 
         if item.get("existed"):
+            raw = _snapshot_before_bytes(item, root)
+            if raw is None:
+                return False
             if missing_parent:
                 parent_fd = root_fd
                 for part in parts[:-1]:
@@ -541,7 +625,6 @@ def _restore_file_posix(root, rel, item, expected_exists, expected_hash):
                     child_fd = os.open(part, directory_flags, dir_fd=parent_fd)
                     owned_fds.append(child_fd)
                     parent_fd = child_fd
-            raw = base64.b64decode(item.get("before_b64") or "", validate=True)
             temp_name = ".codebee-restore-%s.tmp" % secrets.token_hex(12)
             temp_fd = os.open(temp_name, os.O_WRONLY | os.O_CREAT | os.O_EXCL
                               | getattr(os, "O_NOFOLLOW", 0), 0o600, dir_fd=parent_fd)
@@ -611,7 +694,10 @@ def restore_files(run_id, workdir):
                     conflicts.append(rel)
                     continue
                 if item.get("existed"):
-                    raw = base64.b64decode(item.get("before_b64") or "", validate=True)
+                    raw = _snapshot_before_bytes(item, root)
+                    if raw is None:
+                        conflicts.append(rel)
+                        continue
                     target.parent.mkdir(parents=True, exist_ok=True)
                     safe_root, safe_rel = _safe_snapshot_path(root, root / rel)
                     if safe_root is None or safe_rel != rel:

package/app/core/eval_matrix.py

@@ -56,12 +56,20 @@ def evaluate(manifest, results, baseline=None):
     manifest = normalize_manifest(manifest)
     results = results if isinstance(results, dict) else {}
     baseline = baseline if isinstance(baseline, dict) else {}
+    baseline_present = bool(baseline)
+    baseline_manifest_hash = (baseline.get("manifest_sha256")
+                              if isinstance(baseline.get("manifest_sha256"), str) else None)
+    baseline_scores = baseline.get("scores") if isinstance(baseline.get("scores"), dict) else baseline
+    baseline_compatible = (not baseline_present or
+                           bool(baseline_manifest_hash) and
+                           baseline_manifest_hash == manifest["manifest_sha256"])
+    comparable_baseline = baseline_scores if baseline_compatible else {}
     matrix, regressions, totals = [], [], {}
     for candidate in manifest["candidates"]:
         scores = []
         for case in manifest["cases"]:
             candidate_results = results.get(candidate)
-            candidate_baseline = baseline.get(candidate)
+            candidate_baseline = comparable_baseline.get(candidate)
             value = (candidate_results.get(case["id"]) if isinstance(candidate_results, dict) else None)
             old_value = (candidate_baseline.get(case["id"]) if isinstance(candidate_baseline, dict) else None)
             score = _score(value)
@@ -79,4 +87,5 @@ def evaluate(manifest, results, baseline=None):
     return {"manifest": manifest, "matrix": matrix, "averages": totals,
             "best_candidate": ranked[0][1] if ranked else "",
             "regressions": regressions,
+            "baseline_compatible": baseline_compatible,
             "passed": not regressions}

package/app/core/mcp_client.py

@@ -98,10 +98,15 @@ def _sandbox_launch(server, sandbox, workdir):
     from . import policy
     if not sandbox or not workdir:
         raise RuntimeError("MCP 调用缺少任务沙箱策略或工作目录，拒绝启动")
-    if os.name != "posix" or sys.platform == "darwin" or not shutil.which("bwrap"):
-        raise RuntimeError("MCP 服务尚无可用的 OS 隔离后端，拒绝启动")
     root = Path(workdir).expanduser().resolve(strict=True)
     normalized = policy.normalize_sandbox(sandbox, root)
+    if normalized.get("backend") == "docker":
+        # MCP command/args may include host-specific executables and absolute
+        # script paths. Until those are explicitly mapped into an image and
+        # verified mounts, refuse instead of launching a misleading container.
+        raise RuntimeError("MCP Docker 启动映射尚未配置；拒绝降级到宿主机")
+    if os.name != "posix" or sys.platform == "darwin" or not shutil.which("bwrap"):
+        raise RuntimeError("MCP 服务尚无可用的 OS 隔离后端，拒绝启动")
     roots = [Path(value).resolve(strict=True)
              for value in normalized.get("allowed_roots") or []]
     if not roots:

package/app/core/openapi.py

@@ -12,6 +12,14 @@ def document():
         "TaskCreate": {"type": "object", "required": ["goal"], "properties": {
             "type": {"type": "string"}, "title": {"type": "string"},
             "goal": {"type": "string", "maxLength": 4000}, "workdir": {"type": "string"},
+            "sandbox": {"type": "object", "properties": {
+                "backend": {"type": "string", "enum": ["native", "docker"]},
+                "docker_image": {"type": "string", "maxLength": 240},
+                "allowed_roots": {"type": "array", "maxItems": 16,
+                                   "items": {"type": "string", "maxLength": 1024}},
+                "env_allowlist": {"type": "array", "maxItems": 64,
+                                  "items": {"type": "string", "maxLength": 128}},
+                "network": {"type": "boolean"}, "timeout_s": {"type": "integer"}}},
             "acceptance_criteria": {"type": "array", "maxItems": 40,
                                      "items": {"type": "string", "maxLength": 500}},
             "approval_required": {"type": "boolean"}}},

package/app/core/pipeline.py

@@ -586,6 +586,8 @@ def _external_sandbox_block_reason(agent, workdir, sandbox):
     from . import policy
     root = os.path.realpath(workdir or ".")
     normalized = policy.normalize_sandbox(sandbox, root)
+    if normalized.get("backend") == "docker":
+        return "沙箱拒绝：Docker 目前仅接入内置命令工具，外部 CLI 未验证容器启动，拒绝运行"
     if (agent or {}).get("kind") == "codex":
         if normalized.get("network") is False:
             return "沙箱拒绝：该 CLI 后端未接入网络隔离，拒绝运行网络受限任务"
@@ -912,7 +914,8 @@ def _finish_step_result(run_id, step, res, role, agent, start):
                       followups=res.get("followups"),
                       # 思考过程（内置智能体流式抓取）：落进步骤记录，对话气泡折叠展示
                       thinking=res.get("reasoning") or None,
-                      partial=bool(res.get("partial")))
+                      partial=bool(res.get("partial")),
+                      acp_events=(raw.get("acp_events") or []))
     try:
         checkpoint_status = ("unknown" if raw.get("unknown") else
                              "timeout" if status == "timeout" else

package/app/core/policy.py

@@ -50,9 +50,18 @@ def normalize_sandbox(spec=None, workdir=None):
     else:
         # Invalid policy input must never silently widen network access.
         network = False
+    backend = str(spec.get("backend") or "native").strip().lower()
+    if backend not in ("native", "docker"):
+        raise ValueError("沙箱 backend 必须是 native 或 docker")
+    image = str(spec.get("docker_image") or "").strip()[:240]
+    if backend == "docker":
+        import re
+        if not image or not re.match(r"^[A-Za-z0-9][A-Za-z0-9._/:@-]*$", image):
+            raise ValueError("Docker 镜像名无效")
     return {"allowed_roots": [str(x) for x in roots], "env_allowlist": env,
             "network": network, "timeout_s": timeout,
             "max_output_bytes": output,
+            "backend": backend, "docker_image": image,
             "disabled_tools": normalize_disabled_tools(spec.get("disabled_tools"))}