codebee 0.1.104 → 0.1.106

package/CHANGELOG.md

@@ -4,6 +4,23 @@ CodeBee 的用户可感知变更记录。发布新版时：最上面加一节，
 `<!-- relnotes:start -->…<!-- relnotes:end -->` 段（那段会被 `npm view` 的
 README 元数据带回，供老版本在「发现新版本」时展示新版更新内容）。
 
+## v0.1.106（2026-10-12）
+
+- **发布台章节批量发布工作流升级**：待发章节自动对账（已发布/已存草稿自动排除）、按卷计划自动分卷、章节状态徽章一目了然（已过审可直发 / 发布受限 / 审稿未通过 / 已修改需重审 / 待审或评审不足）、「只选可直发」一键筛选；任务按工作区分组管理（工作区视图+区內新建任务）
+- **Windows/macOS 桌面版预览**：新增桌面壳、桌面宿主与运行时锁（防双开），CI 产出预览安装包（npm 主分发不变）
+- **输入区 Codex 风格重排**：目标与对话输入布局更聚焦，配套 markdown 渲染回归测试
+- **移动端任务对话控制增强**
+- **自由 3D 入口暂对用户隐藏**：引擎保留给内部 QA（未达发布质量），hidden/aria-hidden + CSS 双保险防旧缓存/恢复状态重新显示
+- 蜂巢 3D 翅膀/手臂视觉打磨多分支合流收口
+
+## v0.1.105（2026-10-12）
+
+- **claude CLI 输出上限 16000→32000**：全局评审读 40 万字级书稿（约 28 万 token 输入）时按旧值反复续烧 23 分钟后报「response exceeded the 16000 output token maximum」三连挂（实案：单次 $3 零产出）；32000=claude CLI 官方默认档，`setdefault` 语义保留——用户显式配置不覆盖
+- **治理契约：外部人工评审请求通道**：新增 append-only 评审请求台账（requested→assigned→approved/changes_requested/dismissed/expired 幂等流转）与 `/api/reviews`、`/api/reviews/<id>/transition` 路由，外部智能体可按契约提交待人工评审的产物；配套 `/api/capabilities` 能力清单与 `/api/tasks/<id>/memory/preview` 任务记忆注入预览接口
+- **项目记忆注入预算封顶 20000**：注入预算配置值超过 20000 时按 20000 收敛，防止过大预算挤占提示词（含回归测试锁定）
+- **蜂巢 3D 蜜蜂翅膀精修**：翅膀更纤薄透明、减淡青雾、脉络几何强化，助手蜂手臂/键盘手部姿态与腕端高光对齐，视觉契约测试全程护航（约 40 笔打磨）
+- 英文界面补齐「会话续跑」能力标签词条
+
 ## v0.1.104（2026-10-11）
 
 - **连载「一直重写不达标」根因防线（马甲指纹三道防线）**：「落笔入册」「整段连排」类跨章复用此前只能靠评审判死，而重写用的是同一作者模型、长出来的还是同族指纹——循环烧钱永不达标。现把防线前移到生成侧：①**章稿落盘确定性查重闸**：整段（≥40 字）/整句（≥12 字）/完整对白（≥6 字）逐字重复检测，阈值按真实事故章校准，白描短句复沓不误伤；带重复的章稿直接打回，同作者重试与换将的提示词自动追加消重指令（同提示重跑只会长出同族事故）；②**起草负样例注入**：近 4 章实际开笔/收束摘录随提示词下发（`__REUSE_GUARD__`），跨章句式同款从评审判据前移成起草约束；③**大纲轮换纪律**：开笔方式与收束形态批内硬性轮换。查重证据自动进评审面可见。生效范围：发版后的新批连载

package/README.md

@@ -25,9 +25,12 @@ Trae Agent、OpenClaw……），提供
 ---
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.104）
+### 最新版更新内容（v0.1.106）
 
-- 连载新防线：跨章复用「马甲指纹」从评审判死前移到起草拦截——落盘查重闸（段落/整句/对白逐字重复直接打回）+ 近章开笔摘录作负样例注入 + 大纲开笔收束批内轮换，重写不再空转
+- 发布台章节批量发布升级：待发自动对账、按卷自动分卷、可直发状态徽章与一键筛选
+- Windows/macOS 桌面版预览打包（CI 预览安装包）
+- 输入区 Codex 风格重排 + 移动端对话控制增强
+- 自由 3D 入口暂对用户隐藏（未达发布质量，保留内部 QA）
 <!-- relnotes:end -->
 
 
@@ -328,8 +331,11 @@ cloudflared tunnel login
 cloudflared tunnel create codebee
 cloudflared tunnel route dns --overwrite-dns <隧道UUID> codebee.你的域名.com
 
-:: 之后日常启动（服务 + 隧道一键起）：
-start-public.bat
+:: 日常启动服务（本机后台窗口）：
+start-service.bat
+
+:: 启动隧道（另开一个窗口；也可 cloudflared service install 注册为开机自启）：
+cloudflared tunnel --config "%USERPROFILE%\.cloudflared\config.yml" run
 ```
 
 - 真本机（不带转发头的 loopback）不受影响。

package/app/core/activity.py

@@ -0,0 +1,36 @@
+"""Small, read-only projections for the sidebar activity view."""
+from __future__ import annotations
+
+from . import contracts
+
+
+def run_activity(run):
+    steps = [step for step in (run.get("steps") or []) if isinstance(step, dict)]
+    current = next((step for step in reversed(steps)
+                    if step.get("status") == "running"), None)
+    if current is None and steps:
+        current = steps[-1]
+    failed = next((step for step in reversed(steps)
+                   if step.get("status") in ("failed", "timeout")), None)
+    result = {}
+    for name, step in (("current_step", current), ("failed_step", failed)):
+        if step:
+            result[name] = {key: step[key] for key in
+                            ("n", "role", "agent", "agent_label", "status") if key in step}
+            result[name]["summary"] = " ".join(str(step.get("summary") or "").split())[:240]
+    return result
+
+
+def task_attention(tasks, latest):
+    """Approval state is authoritative; never infer approval from a read marker."""
+    result = {}
+    for task in tasks:
+        run = latest.get(task["id"]) or {}
+        contract = contracts.get(task["id"]) or {}
+        requires_approval = bool(task.get("approval_required") or
+                                 contract.get("approval_required"))
+        if not requires_approval or run.get("status") != "done":
+            continue
+        if (contract.get("approval") or {}).get("status") != "approved":
+            result[task["id"]] = {"approval_pending": True}
+    return result

package/app/core/builtin_agent.py

@@ -931,7 +931,8 @@ def _exec_tool(workdir, name, args, cancel_event=None, deadline=None, task_creat
                             remaining if remaining is not None else CMD_MAX_TIMEOUT)
             r = mcp_client.dispatch_full_name(
                 name, args or {}, sandbox=sandbox, workdir=workdir,
-                disabled_tools=denied, timeout_s=timeout_s)
+                disabled_tools=denied, timeout_s=timeout_s,
+                cancel_event=cancel_event, deadline=deadline)
             return r.get("text") or ("（MCP 工具失败: %s）" % r.get("error") if not r.get("ok") else "")
         except Exception as e:
             return "MCP 工具执行失败: %s" % e
@@ -1983,6 +1984,10 @@ def run(bi, prompt, workdir, timeout=180, cancel_event=None, log=None, images=No
                                              disabled_tools=disabled_tools, sandbox=sandbox,
                                              checkpoint_run_id=checkpoint_run_id,
                                              tool_output_run_id=tool_output_run_id)
+                            if deadline is not None and time.monotonic() >= deadline:
+                                return _deadline_fail()
+                            if cancel_event is not None and cancel_event.is_set():
+                                return _cancel_fail()
                             # 运行期注入警示层：外部内容（网页/命令输出/文件）一律
                             # 包围栏进上下文；检测命中升级强围栏（prompt_guard）。
                             try:

package/app/core/checkpoints.py

@@ -40,6 +40,20 @@ def _hash(value):
     return hashlib.sha256(raw.encode("utf-8")).hexdigest()
 
 
+def _side_effects(value):
+    """Normalize side-effect labels without persisting arbitrary tool output."""
+    if isinstance(value, str):
+        value = [value]
+    if not isinstance(value, (list, tuple, set)):
+        return []
+    out = []
+    for item in value:
+        label = str(item or "").strip()[:80]
+        if label and label not in out:
+            out.append(label)
+    return out[:20]
+
+
 def _append(row):
     _DIR.mkdir(parents=True, exist_ok=True)
     with _file().open("a", encoding="utf-8") as handle:
@@ -48,7 +62,8 @@ def _append(row):
 
 
 def start(run_id, step, role, prompt="", *, input_data=None, attempt=1,
-          idempotency_key=""):
+          idempotency_key="", tool_call=None, conversation_ref="",
+          side_effects=None):
     """Record a step start without persisting prompt contents."""
     now = time.time()
     try:
@@ -61,6 +76,14 @@ def start(run_id, step, role, prompt="", *, input_data=None, attempt=1,
            "attempt": attempt, "idempotency_key": str(idempotency_key or "")[:160],
            "prompt_sha256": _hash(prompt), "input_sha256": _hash(input_data),
            "created_at": now}
+    if tool_call is not None:
+        row["tool_call_digest"] = _hash(tool_call)
+    if conversation_ref:
+        row["conversation_ref"] = str(conversation_ref)[:200]
+    normalized_effects = _side_effects(side_effects)
+    if normalized_effects:
+        row["side_effects"] = normalized_effects
+    row["repropose_required"] = bool(tool_call is not None or normalized_effects)
     with _LOCK:
         try:
             _append(row)
@@ -73,13 +96,24 @@ def finish(run_id, step, status, *, error="", output=None, metadata=None):
     status = str(status or "unknown").strip().lower()
     if status not in _TERMINAL:
         status = "unknown"
+    safe_metadata = {}
+    for key, value in (metadata or {}).items():
+        name = str(key)[:40]
+        if name == "side_effects":
+            safe_metadata[name] = _side_effects(value)
+        elif name == "repropose_required":
+            safe_metadata[name] = bool(value)
+        elif isinstance(value, (str, int, float, bool)):
+            safe_metadata[name] = value
     row = {"event_id": "cp-" + secrets.token_hex(10), "event": "finish",
            "run_id": str(run_id or "")[:80], "step": int(step),
            "status": status, "error": scrub_text(error, limit=500),
-           "output_sha256": _hash(output), "metadata": {
-               str(k)[:40]: v for k, v in (metadata or {}).items()
-               if isinstance(v, (str, int, float, bool))
-           }, "created_at": time.time()}
+           "output_sha256": _hash(output), "metadata": safe_metadata,
+           "created_at": time.time()}
+    if "side_effects" in safe_metadata:
+        row["side_effects"] = safe_metadata["side_effects"]
+    if "repropose_required" in safe_metadata:
+        row["repropose_required"] = safe_metadata["repropose_required"]
     with _LOCK:
         try:
             _append(row)
@@ -135,6 +169,15 @@ def replay_preview(run_id):
         if key in starts:
             item.setdefault("prompt_sha256", starts[key].get("prompt_sha256"))
             item.setdefault("attempt", starts[key].get("attempt", 1))
+        metadata = item.get("metadata") or {}
+        for field in ("tool_call_digest", "conversation_ref", "side_effects",
+                      "repropose_required"):
+            if field not in item and field in metadata:
+                item[field] = metadata[field]
+        item.setdefault("side_effects", [])
+        item["repropose_required"] = bool(
+            item.get("repropose_required") or item.get("side_effects")
+            or item.get("tool_call_digest"))
         steps.append(item)
     unknown = next((x for x in steps if x.get("status") in ("unknown", "running")
                     or x.get("event") != "finish"

package/app/core/jobs.py

@@ -314,6 +314,13 @@ def cancel_restart_drain():
         _restart_drain = False
 
 
+def begin_shutdown_drain():
+    """Stop accepting work before a confirmed desktop shutdown cancels runs."""
+    global _restart_drain
+    with _pool_lock:
+        _restart_drain = True
+
+
 def _close_unstarted(job, message, statuses=("queued",)):
     """无法启动时统一收口 run/task，供所有入口复用。"""
     try:

package/app/core/manager.py

@@ -2374,6 +2374,7 @@ def catalog_view():
             "model": read_model(e),
             "orch_kind": (e.get("orch") or {}).get("kind"),
             "orch_enabled": orch_enabled,
+            "capabilities": registry.capability_manifest(e),
             "update": update_info(e),
             "has_install": bool(e.get("install")),
             "has_upgrade": bool(e.get("upgrade")),

package/app/core/market_remote.py

@@ -110,18 +110,29 @@ def _cache_file(source_id):
 
 # ---------------------------------------------------------------- 网络边界
 
+def _reject_url_userinfo(url):
+    """拒绝 URL authority 中的凭据；错误不回显可能含令牌的原始 URL。"""
+    parsed = urlparse(url or "")
+    if parsed.username is not None or parsed.password is not None:
+        raise ValueError("URL 不允许携带用户信息")
+    return parsed
+
+
 def assert_public_url(url):
     """SSRF 防护：仅 https；host 解析出的所有 IP 都不得是环回/私有/保留地址。
     返回 (host, port)，不合法直接抛 ValueError。"""
-    u = urlparse(url or "")
+    u = _reject_url_userinfo(url)
     if u.scheme != "https":
-        raise ValueError("仅允许 https 地址: %s" % url)
+        raise ValueError("仅允许 https 地址")
     host = u.hostname
     if not host:
-        raise ValueError("URL 缺少主机名: %s" % url)
-    if u.port is not None and not (0 < u.port < 65536):
-        raise ValueError("端口非法: %s" % url)
-    port = u.port or 443
+        raise ValueError("URL 缺少主机名")
+    try:
+        port = u.port or 443
+    except ValueError:
+        raise ValueError("端口非法") from None
+    if not (0 < port < 65536):
+        raise ValueError("端口非法")
     infos = socket.getaddrinfo(host, port, proto=socket.IPPROTO_TCP)
     if not infos:
         raise ValueError("主机无法解析: %s" % host)
@@ -856,7 +867,7 @@ def _download_git(entry, tmp):
                                   text=True, encoding="utf-8", errors="replace",
                                   env=env)
         except subprocess.TimeoutExpired:
-            raise ValueError("git 克隆超时: %s" % inst["url"])
+            raise ValueError("git 克隆超时")
         if proc.returncode == 0:
             break
         err = (proc.stderr or "").strip()[-200:]
@@ -875,6 +886,7 @@ def _download_git(entry, tmp):
 def _download_git_any(entry, tmp):
     """git 类来源安装：codeload tarball 优先（完整、最新）→ jsdelivr 逐文件
     兜底（codeload 不可达时）→ git 浅克隆收尾（非 github 托管 / 精确 ref）。"""
+    _reject_url_userinfo(entry["install"].get("url"))
     try:
         return _gh_tarball(entry, tmp)
     except ValueError as e:

package/app/core/mcp_client.py

@@ -19,6 +19,7 @@ from __future__ import annotations
 import json
 import hashlib
 import os
+import queue
 import re
 import shutil
 import subprocess
@@ -28,6 +29,7 @@ import time
 from pathlib import Path
 
 _LOCK = threading.RLock()
+_REFRESH_LOCK = threading.Lock()
 _TOOLS_CACHE = {}          # server_key → (ts, tools)
 _TOOLS_TTL = 300.0
 _TOOLS_CONFIG_SHA = ""
@@ -35,6 +37,7 @@ _TOOLS_CONFIG_SHA = ""
 MAX_SERVERS = 4
 MAX_MCP_TOOLS = 24         # 全部服务器合计注入内置智能体的工具数上限
 _NAME_RE = re.compile(r"^[a-z0-9_-]{1,24}$")
+_MODEL_TOOL_NAME_RE = re.compile(r"^[A-Za-z0-9_-]{1,64}$")
 _INIT_TIMEOUT = 15.0
 _CALL_TIMEOUT = 60.0
 _CALL_TIMEOUT_MAX = 300.0
@@ -64,6 +67,7 @@ def parse_servers(text):
     if len(arr) > MAX_SERVERS:
         return None, "最多 %d 个 MCP 服务器" % MAX_SERVERS
     out = []
+    names = set()
     for item in arr:
         if not isinstance(item, dict):
             return None, "MCP 服务器配置必须是对象"
@@ -71,6 +75,11 @@ def parse_servers(text):
         command = str(item.get("command") or "").strip()
         if not _NAME_RE.match(name):
             return None, "服务器名 %r 只能是小写字母/数字/-/_（≤24 位）" % name[:24]
+        if "__" in name:
+            return None, "服务器名 %s 不能包含工具分隔符 __" % name
+        if name in names:
+            return None, "MCP 服务器名 %s 重名" % name
+        names.add(name)
         if not command:
             return None, "服务器 %s 缺 command" % name
         args = item.get("args") if isinstance(item.get("args"), list) else []
@@ -152,12 +161,16 @@ def _bubblewrap_argv(server, sandbox, roots, cwd):
 class _Session:
     """一次性的 MCP 服务器会话：spawn → initialize → （list/call）→ 杀树。"""
 
-    def __init__(self, server, sandbox=None, workdir=None, timeout_s=None):
+    def __init__(self, server, sandbox=None, workdir=None, timeout_s=None,
+                 cancel_event=None, deadline=None):
         self.server = server
         self.sandbox = sandbox
         self.workdir = workdir
         self.timeout_s = timeout_s
-        self.deadline = None
+        self.deadline = deadline
+        self.task_deadline = deadline
+        self.cancel_event = cancel_event
+        self._nest = None
         self.proc = None
         self.lines = None       # reader 线程产出的行队列
         self.err = None
@@ -190,7 +203,9 @@ class _Session:
 
     def __enter__(self):
         if self.timeout_s is not None:
-            self.deadline = time.monotonic() + max(0.0, float(self.timeout_s))
+            call_deadline = time.monotonic() + max(0.0, float(self.timeout_s))
+            self.deadline = min(self.deadline, call_deadline) if self.deadline is not None else call_deadline
+        self._check_interrupted()
         try:
             argv, env, cwd = _sandbox_launch(self.server, self.sandbox, self.workdir)
             if self.deadline is not None and time.monotonic() >= self.deadline:
@@ -199,18 +214,22 @@ class _Session:
                 argv,
                 stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE, text=False,
-                env=env, cwd=cwd, start_new_session=True)
+                env=env, cwd=cwd, start_new_session=(os.name != "nt"))
         except Exception as e:
             raise RuntimeError("MCP 服务器启动失败: %s" % e)
-        import queue as _queue
-        self.lines = _queue.Queue()
-        self._reader_threads = [
-            threading.Thread(target=self._pump_out, daemon=True),
-            threading.Thread(target=self._pump_err, daemon=True),
-        ]
-        for thread in self._reader_threads:
-            thread.start()
         try:
+            import queue as _queue
+            self.lines = _queue.Queue()
+            self._reader_threads = [
+                threading.Thread(target=self._pump_out, daemon=True),
+                threading.Thread(target=self._pump_err, daemon=True),
+            ]
+            for thread in self._reader_threads:
+                thread.start()
+            if os.name == "nt":
+                from . import beekeeper
+                self._nest = beekeeper.BeeNest()
+                self._nest.adopt(self.proc)
             init_timeout = _INIT_TIMEOUT
             if self.deadline is not None:
                 init_timeout = min(init_timeout, self.deadline - time.monotonic())
@@ -220,57 +239,48 @@ class _Session:
                 "protocolVersion": "2024-11-05", "capabilities": {},
                 "clientInfo": _CLIENT_INFO}, timeout=init_timeout)
             self._notify("notifications/initialized")
-        except Exception:
+        except BaseException:
             # Context manager __exit__ is not called when __enter__ raises.
             self.__exit__(None, None, None)
             raise
         return self
 
     def __exit__(self, *exc):
+        proc = self.proc
+        if proc is None:
+            return False
         try:
-            if self.proc and self.proc.stdin:
+            if self._nest is not None:
+                self._nest.close()
+        except Exception:
+            pass
+        if os.name != "nt" or proc.poll() is None:
+            try:
+                from . import runner
+                runner._kill_tree(proc.pid)
+            except Exception:
                 try:
-                    self.proc.stdin.close()
+                    proc.kill()
                 except Exception:
                     pass
+        try:
+            proc.wait(timeout=2)
+        except Exception:
+            pass
+        if proc.stdin is not None:
             try:
-                if self.proc and self.proc.poll() is None:
-                    # bwrap runs in its own process group; terminate descendants
-                    # as well as the launcher so timed-out MCP servers cannot
-                    # leave background children holding pipes or doing work.
-                    try:
-                        from . import runner
-                        runner._kill_tree(self.proc.pid)
-                    except Exception:
-                        pass
-                    self.proc.kill()
-            except Exception:
-                pass
-            try:
-                if self.proc:
-                    self.proc.wait(timeout=1)
+                proc.stdin.close()
             except Exception:
                 pass
-        finally:
-            # Close all parent-side pipe handles even if initialization failed.
-            # Do not close a stream while its reader is blocked in read(): the
-            # buffered stream lock can make close wait forever if an escaped
-            # descendant still holds the pipe open. Let daemon readers finish
-            # on EOF and close only streams no thread currently owns.
-            for thread in self._reader_threads:
+        for thread, pipe in zip(self._reader_threads, (proc.stdout, proc.stderr)):
+            if thread is not None and thread.is_alive():
+                thread.join(timeout=0.5)
+            # 读线程持有管道锁时主线程 close 可能卡到孙进程自然退出。
+            if pipe is not None and (thread is None or not thread.is_alive()):
                 try:
-                    thread.join(timeout=0.2)
+                    pipe.close()
                 except Exception:
                     pass
-            for name in ("stdout", "stderr"):
-                pipe = getattr(self.proc, name, None) if self.proc else None
-                readers_alive = any(
-                    thread.is_alive() for thread in self._reader_threads)
-                if pipe and not readers_alive:
-                    try:
-                        pipe.close()
-                    except Exception:
-                        pass
         return False
 
     def _send(self, obj):
@@ -281,8 +291,15 @@ class _Session:
     def _notify(self, method, params=None):
         self._send({"jsonrpc": "2.0", "method": method, "params": params or {}})
 
+    def _check_interrupted(self):
+        if self.cancel_event is not None and self.cancel_event.is_set():
+            raise RuntimeError("任务已取消")
+        if self.task_deadline is not None and time.monotonic() >= self.task_deadline:
+            raise RuntimeError("任务总时限已到")
+
     def _request(self, method, params, timeout):
         """单请求单响应；忽略通知与未知 id 的服务端请求。"""
+        self._check_interrupted()
         duration = max(0.0, float(timeout))
         if self.deadline is not None:
             duration = min(duration, self.deadline - time.monotonic())
@@ -293,13 +310,15 @@ class _Session:
                     "method": method, "params": params or {}})
         deadline = time.monotonic() + duration
         while True:
+            self._check_interrupted()
             remain = deadline - time.monotonic()
             if remain <= 0:
                 raise RuntimeError("%s 超时（%.0fs）" % (method, timeout))
             try:
-                line = self.lines.get(timeout=remain)
-            except Exception:
-                raise RuntimeError("%s 超时（%.0fs）" % (method, timeout))
+                wait = min(remain, 0.1) if self.cancel_event is not None else remain
+                line = self.lines.get(timeout=wait)
+            except queue.Empty:
+                continue
             if line is None:
                 raise RuntimeError("MCP 服务器提前退出")
             line = line.strip()
@@ -327,10 +346,11 @@ def list_tools(server, *, sandbox=None, workdir=None):
         tools = []
         for t in (res.get("tools") or [])[:16]:
             if isinstance(t, dict) and isinstance(t.get("name"), str) and t["name"]:
+                schema = t.get("inputSchema", t.get("input_schema"))
                 tools.append({"name": t["name"],
                               "description": str(t.get("description") or "")[:400],
-                              "input_schema": t.get("input_schema")
-                              if isinstance(t.get("input_schema"), dict) else
+                              "input_schema": schema
+                              if isinstance(schema, dict) else
                               {"type": "object", "properties": {}}})
         return {"ok": True, "tools": tools, "error": ""}
     except Exception as e:
@@ -338,12 +358,13 @@ def list_tools(server, *, sandbox=None, workdir=None):
 
 
 def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT,
-              *, sandbox=None, workdir=None):
+              *, sandbox=None, workdir=None, cancel_event=None, deadline=None):
     """调用一个工具。返回 {"ok", "text", "error", "is_error"}。"""
     try:
         timeout = min(_CALL_TIMEOUT_MAX, max(0.001, float(timeout_s or _CALL_TIMEOUT)))
         with _Session(server, sandbox=sandbox, workdir=workdir,
-                      timeout_s=timeout) as sess:
+                      timeout_s=timeout, cancel_event=cancel_event,
+                      deadline=deadline) as sess:
             res = sess._request("tools/call",
                                 {"name": tool_name,
                                  "arguments": arguments if isinstance(arguments, dict) else {}},
@@ -364,6 +385,12 @@ def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT,
 # ---- 面向 builtin_agent 的合并视图（带缓存） ----
 
 def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
+    """Serialize discoveries so callers cannot observe incomplete refreshes."""
+    with _REFRESH_LOCK:
+        return _tool_specs_cached(force=force, sandbox=sandbox, workdir=workdir)
+
+
+def _tool_specs_cached(force=False, *, sandbox=None, workdir=None):
     """全部服务器的工具合并清单：[{server, name(原名), full_name, description,
     input_schema}]。TTL 内走缓存；单个服务器失败跳过（error 挂在条目外不打断）。"""
     global _TOOLS_CONFIG_SHA
@@ -398,8 +425,8 @@ def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
     disabled = set(policy.normalize_disabled_tools(
         (sandbox or {}).get("disabled_tools")))
     out = []
-    with _LOCK:
-        _TOOLS_CACHE.clear()
+    discovered = {}
+    seen_names = set()
     for srv in servers:
         res = list_tools(srv, sandbox=sandbox, workdir=workdir)
         if not res.get("ok"):
@@ -410,25 +437,36 @@ def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
             if (t["name"] in srv.get("disabled_tools", [])
                     or t["name"] in disabled or full_name in disabled):
                 continue
+            if not _MODEL_TOOL_NAME_RE.fullmatch(full_name) or full_name in seen_names:
+                continue
+            seen_names.add(full_name)
             specs.append({"server": srv["name"], "name": t["name"],
                           "full_name": full_name,
                           "description": t["description"],
                           "input_schema": t["input_schema"]})
-        with _LOCK:
-            _TOOLS_CACHE[(scope_sha, srv["name"])] = (time.time(), specs)
+        discovered[(scope_sha, srv["name"])] = (time.time(), specs)
         out.extend(specs)
         if len(out) >= MAX_MCP_TOOLS:
             break
+    with _LOCK:
+        if config_sha != _TOOLS_CONFIG_SHA:
+            return []
+        for key in list(_TOOLS_CACHE):
+            if isinstance(key, tuple) and key[0] == scope_sha:
+                del _TOOLS_CACHE[key]
+        _TOOLS_CACHE.update(discovered)
     return out[:MAX_MCP_TOOLS]
 
 
 def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT, *,
-                       sandbox=None, workdir=None, disabled_tools=None):
+                       sandbox=None, workdir=None, disabled_tools=None,
+                       cancel_event=None, deadline=None):
     """mcp__<server>__<tool> → 找服务器配置并调用。返回 {"ok","text","error"}。"""
-    m = re.match(r"^mcp__([a-z0-9_-]{1,24})__(.+)$", str(full_name or ""))
-    if not m:
+    full_name = str(full_name or "")
+    sname, sep, tool = full_name[5:].partition("__") if full_name.startswith("mcp__") \
+        else ("", "", "")
+    if not sep or not _NAME_RE.fullmatch(sname) or "__" in sname or not tool:
         return {"ok": False, "text": "", "error": "非法 MCP 工具名"}
-    sname, tool = m.group(1), m.group(2)
     servers, err = parse_servers(_settings_text())
     if err:
         return {"ok": False, "text": "", "error": err}
@@ -443,7 +481,8 @@ def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT, *,
     if sandbox is None or not workdir:
         return {"ok": False, "text": "", "error": "MCP 调用缺少任务沙箱策略或工作目录，拒绝启动"}
     return call_tool(srv, tool, arguments, timeout_s=timeout_s,
-                     sandbox=sandbox, workdir=workdir)
+                     sandbox=sandbox, workdir=workdir,
+                     cancel_event=cancel_event, deadline=deadline)
 
 
 _SETTINGS_TEXT = None     # main.py 启动注入（读 settings.mcp_servers）——本模块