codebee 0.1.105 → 0.1.106

package/CHANGELOG.md

@@ -4,6 +4,15 @@ CodeBee 的用户可感知变更记录。发布新版时：最上面加一节，
 `<!-- relnotes:start -->…<!-- relnotes:end -->` 段（那段会被 `npm view` 的
 README 元数据带回，供老版本在「发现新版本」时展示新版更新内容）。
 
+## v0.1.106（2026-10-12）
+
+- **发布台章节批量发布工作流升级**：待发章节自动对账（已发布/已存草稿自动排除）、按卷计划自动分卷、章节状态徽章一目了然（已过审可直发 / 发布受限 / 审稿未通过 / 已修改需重审 / 待审或评审不足）、「只选可直发」一键筛选；任务按工作区分组管理（工作区视图+区內新建任务）
+- **Windows/macOS 桌面版预览**：新增桌面壳、桌面宿主与运行时锁（防双开），CI 产出预览安装包（npm 主分发不变）
+- **输入区 Codex 风格重排**：目标与对话输入布局更聚焦，配套 markdown 渲染回归测试
+- **移动端任务对话控制增强**
+- **自由 3D 入口暂对用户隐藏**：引擎保留给内部 QA（未达发布质量），hidden/aria-hidden + CSS 双保险防旧缓存/恢复状态重新显示
+- 蜂巢 3D 翅膀/手臂视觉打磨多分支合流收口
+
 ## v0.1.105（2026-10-12）
 
 - **claude CLI 输出上限 16000→32000**：全局评审读 40 万字级书稿（约 28 万 token 输入）时按旧值反复续烧 23 分钟后报「response exceeded the 16000 output token maximum」三连挂（实案：单次 $3 零产出）；32000=claude CLI 官方默认档，`setdefault` 语义保留——用户显式配置不覆盖

package/README.md

@@ -25,12 +25,12 @@ Trae Agent、OpenClaw……），提供
 ---
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.105）
+### 最新版更新内容（v0.1.106）
 
-- 修复 40 万字级书稿全局评审被 claude 输出上限 16000 顶爆三连挂：上限提到 32000（用户显式配置不覆盖）
-- 新增治理契约：外部人工评审请求通道（append-only 台账+幂等流转）+ 能力清单/记忆注入预览接口
-- 蜂巢 3D 蜜蜂翅膀精修：更纤薄透明、脉络清晰、手部姿态自然
-- 项目记忆注入预算封顶 20000 防挤占
+- 发布台章节批量发布升级：待发自动对账、按卷自动分卷、可直发状态徽章与一键筛选
+- Windows/macOS 桌面版预览打包（CI 预览安装包）
+- 输入区 Codex 风格重排 + 移动端对话控制增强
+- 自由 3D 入口暂对用户隐藏（未达发布质量，保留内部 QA）
 <!-- relnotes:end -->
 
 
@@ -331,8 +331,11 @@ cloudflared tunnel login
 cloudflared tunnel create codebee
 cloudflared tunnel route dns --overwrite-dns <隧道UUID> codebee.你的域名.com
 
-:: 之后日常启动（服务 + 隧道一键起）：
-start-public.bat
+:: 日常启动服务（本机后台窗口）：
+start-service.bat
+
+:: 启动隧道（另开一个窗口；也可 cloudflared service install 注册为开机自启）：
+cloudflared tunnel --config "%USERPROFILE%\.cloudflared\config.yml" run
 ```
 
 - 真本机（不带转发头的 loopback）不受影响。

package/app/core/activity.py

@@ -0,0 +1,36 @@
+"""Small, read-only projections for the sidebar activity view."""
+from __future__ import annotations
+
+from . import contracts
+
+
+def run_activity(run):
+    steps = [step for step in (run.get("steps") or []) if isinstance(step, dict)]
+    current = next((step for step in reversed(steps)
+                    if step.get("status") == "running"), None)
+    if current is None and steps:
+        current = steps[-1]
+    failed = next((step for step in reversed(steps)
+                   if step.get("status") in ("failed", "timeout")), None)
+    result = {}
+    for name, step in (("current_step", current), ("failed_step", failed)):
+        if step:
+            result[name] = {key: step[key] for key in
+                            ("n", "role", "agent", "agent_label", "status") if key in step}
+            result[name]["summary"] = " ".join(str(step.get("summary") or "").split())[:240]
+    return result
+
+
+def task_attention(tasks, latest):
+    """Approval state is authoritative; never infer approval from a read marker."""
+    result = {}
+    for task in tasks:
+        run = latest.get(task["id"]) or {}
+        contract = contracts.get(task["id"]) or {}
+        requires_approval = bool(task.get("approval_required") or
+                                 contract.get("approval_required"))
+        if not requires_approval or run.get("status") != "done":
+            continue
+        if (contract.get("approval") or {}).get("status") != "approved":
+            result[task["id"]] = {"approval_pending": True}
+    return result

package/app/core/builtin_agent.py

@@ -931,7 +931,8 @@ def _exec_tool(workdir, name, args, cancel_event=None, deadline=None, task_creat
                             remaining if remaining is not None else CMD_MAX_TIMEOUT)
             r = mcp_client.dispatch_full_name(
                 name, args or {}, sandbox=sandbox, workdir=workdir,
-                disabled_tools=denied, timeout_s=timeout_s)
+                disabled_tools=denied, timeout_s=timeout_s,
+                cancel_event=cancel_event, deadline=deadline)
             return r.get("text") or ("（MCP 工具失败: %s）" % r.get("error") if not r.get("ok") else "")
         except Exception as e:
             return "MCP 工具执行失败: %s" % e
@@ -1983,6 +1984,10 @@ def run(bi, prompt, workdir, timeout=180, cancel_event=None, log=None, images=No
                                              disabled_tools=disabled_tools, sandbox=sandbox,
                                              checkpoint_run_id=checkpoint_run_id,
                                              tool_output_run_id=tool_output_run_id)
+                            if deadline is not None and time.monotonic() >= deadline:
+                                return _deadline_fail()
+                            if cancel_event is not None and cancel_event.is_set():
+                                return _cancel_fail()
                             # 运行期注入警示层：外部内容（网页/命令输出/文件）一律
                             # 包围栏进上下文；检测命中升级强围栏（prompt_guard）。
                             try:

package/app/core/jobs.py

@@ -314,6 +314,13 @@ def cancel_restart_drain():
         _restart_drain = False
 
 
+def begin_shutdown_drain():
+    """Stop accepting work before a confirmed desktop shutdown cancels runs."""
+    global _restart_drain
+    with _pool_lock:
+        _restart_drain = True
+
+
 def _close_unstarted(job, message, statuses=("queued",)):
     """无法启动时统一收口 run/task，供所有入口复用。"""
     try:

package/app/core/market_remote.py

@@ -110,18 +110,29 @@ def _cache_file(source_id):
 
 # ---------------------------------------------------------------- 网络边界
 
+def _reject_url_userinfo(url):
+    """拒绝 URL authority 中的凭据；错误不回显可能含令牌的原始 URL。"""
+    parsed = urlparse(url or "")
+    if parsed.username is not None or parsed.password is not None:
+        raise ValueError("URL 不允许携带用户信息")
+    return parsed
+
+
 def assert_public_url(url):
     """SSRF 防护：仅 https；host 解析出的所有 IP 都不得是环回/私有/保留地址。
     返回 (host, port)，不合法直接抛 ValueError。"""
-    u = urlparse(url or "")
+    u = _reject_url_userinfo(url)
     if u.scheme != "https":
-        raise ValueError("仅允许 https 地址: %s" % url)
+        raise ValueError("仅允许 https 地址")
     host = u.hostname
     if not host:
-        raise ValueError("URL 缺少主机名: %s" % url)
-    if u.port is not None and not (0 < u.port < 65536):
-        raise ValueError("端口非法: %s" % url)
-    port = u.port or 443
+        raise ValueError("URL 缺少主机名")
+    try:
+        port = u.port or 443
+    except ValueError:
+        raise ValueError("端口非法") from None
+    if not (0 < port < 65536):
+        raise ValueError("端口非法")
     infos = socket.getaddrinfo(host, port, proto=socket.IPPROTO_TCP)
     if not infos:
         raise ValueError("主机无法解析: %s" % host)
@@ -856,7 +867,7 @@ def _download_git(entry, tmp):
                                   text=True, encoding="utf-8", errors="replace",
                                   env=env)
         except subprocess.TimeoutExpired:
-            raise ValueError("git 克隆超时: %s" % inst["url"])
+            raise ValueError("git 克隆超时")
         if proc.returncode == 0:
             break
         err = (proc.stderr or "").strip()[-200:]
@@ -875,6 +886,7 @@ def _download_git(entry, tmp):
 def _download_git_any(entry, tmp):
     """git 类来源安装：codeload tarball 优先（完整、最新）→ jsdelivr 逐文件
     兜底（codeload 不可达时）→ git 浅克隆收尾（非 github 托管 / 精确 ref）。"""
+    _reject_url_userinfo(entry["install"].get("url"))
     try:
         return _gh_tarball(entry, tmp)
     except ValueError as e:

package/app/core/mcp_client.py

@@ -19,6 +19,7 @@ from __future__ import annotations
 import json
 import hashlib
 import os
+import queue
 import re
 import shutil
 import subprocess
@@ -28,6 +29,7 @@ import time
 from pathlib import Path
 
 _LOCK = threading.RLock()
+_REFRESH_LOCK = threading.Lock()
 _TOOLS_CACHE = {}          # server_key → (ts, tools)
 _TOOLS_TTL = 300.0
 _TOOLS_CONFIG_SHA = ""
@@ -35,6 +37,7 @@ _TOOLS_CONFIG_SHA = ""
 MAX_SERVERS = 4
 MAX_MCP_TOOLS = 24         # 全部服务器合计注入内置智能体的工具数上限
 _NAME_RE = re.compile(r"^[a-z0-9_-]{1,24}$")
+_MODEL_TOOL_NAME_RE = re.compile(r"^[A-Za-z0-9_-]{1,64}$")
 _INIT_TIMEOUT = 15.0
 _CALL_TIMEOUT = 60.0
 _CALL_TIMEOUT_MAX = 300.0
@@ -64,6 +67,7 @@ def parse_servers(text):
     if len(arr) > MAX_SERVERS:
         return None, "最多 %d 个 MCP 服务器" % MAX_SERVERS
     out = []
+    names = set()
     for item in arr:
         if not isinstance(item, dict):
             return None, "MCP 服务器配置必须是对象"
@@ -71,6 +75,11 @@ def parse_servers(text):
         command = str(item.get("command") or "").strip()
         if not _NAME_RE.match(name):
             return None, "服务器名 %r 只能是小写字母/数字/-/_（≤24 位）" % name[:24]
+        if "__" in name:
+            return None, "服务器名 %s 不能包含工具分隔符 __" % name
+        if name in names:
+            return None, "MCP 服务器名 %s 重名" % name
+        names.add(name)
         if not command:
             return None, "服务器 %s 缺 command" % name
         args = item.get("args") if isinstance(item.get("args"), list) else []
@@ -152,12 +161,16 @@ def _bubblewrap_argv(server, sandbox, roots, cwd):
 class _Session:
     """一次性的 MCP 服务器会话：spawn → initialize → （list/call）→ 杀树。"""
 
-    def __init__(self, server, sandbox=None, workdir=None, timeout_s=None):
+    def __init__(self, server, sandbox=None, workdir=None, timeout_s=None,
+                 cancel_event=None, deadline=None):
         self.server = server
         self.sandbox = sandbox
         self.workdir = workdir
         self.timeout_s = timeout_s
-        self.deadline = None
+        self.deadline = deadline
+        self.task_deadline = deadline
+        self.cancel_event = cancel_event
+        self._nest = None
         self.proc = None
         self.lines = None       # reader 线程产出的行队列
         self.err = None
@@ -190,7 +203,9 @@ class _Session:
 
     def __enter__(self):
         if self.timeout_s is not None:
-            self.deadline = time.monotonic() + max(0.0, float(self.timeout_s))
+            call_deadline = time.monotonic() + max(0.0, float(self.timeout_s))
+            self.deadline = min(self.deadline, call_deadline) if self.deadline is not None else call_deadline
+        self._check_interrupted()
         try:
             argv, env, cwd = _sandbox_launch(self.server, self.sandbox, self.workdir)
             if self.deadline is not None and time.monotonic() >= self.deadline:
@@ -199,18 +214,22 @@ class _Session:
                 argv,
                 stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE, text=False,
-                env=env, cwd=cwd, start_new_session=True)
+                env=env, cwd=cwd, start_new_session=(os.name != "nt"))
         except Exception as e:
             raise RuntimeError("MCP 服务器启动失败: %s" % e)
-        import queue as _queue
-        self.lines = _queue.Queue()
-        self._reader_threads = [
-            threading.Thread(target=self._pump_out, daemon=True),
-            threading.Thread(target=self._pump_err, daemon=True),
-        ]
-        for thread in self._reader_threads:
-            thread.start()
         try:
+            import queue as _queue
+            self.lines = _queue.Queue()
+            self._reader_threads = [
+                threading.Thread(target=self._pump_out, daemon=True),
+                threading.Thread(target=self._pump_err, daemon=True),
+            ]
+            for thread in self._reader_threads:
+                thread.start()
+            if os.name == "nt":
+                from . import beekeeper
+                self._nest = beekeeper.BeeNest()
+                self._nest.adopt(self.proc)
             init_timeout = _INIT_TIMEOUT
             if self.deadline is not None:
                 init_timeout = min(init_timeout, self.deadline - time.monotonic())
@@ -220,57 +239,48 @@ class _Session:
                 "protocolVersion": "2024-11-05", "capabilities": {},
                 "clientInfo": _CLIENT_INFO}, timeout=init_timeout)
             self._notify("notifications/initialized")
-        except Exception:
+        except BaseException:
             # Context manager __exit__ is not called when __enter__ raises.
             self.__exit__(None, None, None)
             raise
         return self
 
     def __exit__(self, *exc):
+        proc = self.proc
+        if proc is None:
+            return False
         try:
-            if self.proc and self.proc.stdin:
+            if self._nest is not None:
+                self._nest.close()
+        except Exception:
+            pass
+        if os.name != "nt" or proc.poll() is None:
+            try:
+                from . import runner
+                runner._kill_tree(proc.pid)
+            except Exception:
                 try:
-                    self.proc.stdin.close()
+                    proc.kill()
                 except Exception:
                     pass
+        try:
+            proc.wait(timeout=2)
+        except Exception:
+            pass
+        if proc.stdin is not None:
             try:
-                if self.proc and self.proc.poll() is None:
-                    # bwrap runs in its own process group; terminate descendants
-                    # as well as the launcher so timed-out MCP servers cannot
-                    # leave background children holding pipes or doing work.
-                    try:
-                        from . import runner
-                        runner._kill_tree(self.proc.pid)
-                    except Exception:
-                        pass
-                    self.proc.kill()
-            except Exception:
-                pass
-            try:
-                if self.proc:
-                    self.proc.wait(timeout=1)
+                proc.stdin.close()
             except Exception:
                 pass
-        finally:
-            # Close all parent-side pipe handles even if initialization failed.
-            # Do not close a stream while its reader is blocked in read(): the
-            # buffered stream lock can make close wait forever if an escaped
-            # descendant still holds the pipe open. Let daemon readers finish
-            # on EOF and close only streams no thread currently owns.
-            for thread in self._reader_threads:
+        for thread, pipe in zip(self._reader_threads, (proc.stdout, proc.stderr)):
+            if thread is not None and thread.is_alive():
+                thread.join(timeout=0.5)
+            # 读线程持有管道锁时主线程 close 可能卡到孙进程自然退出。
+            if pipe is not None and (thread is None or not thread.is_alive()):
                 try:
-                    thread.join(timeout=0.2)
+                    pipe.close()
                 except Exception:
                     pass
-            for name in ("stdout", "stderr"):
-                pipe = getattr(self.proc, name, None) if self.proc else None
-                readers_alive = any(
-                    thread.is_alive() for thread in self._reader_threads)
-                if pipe and not readers_alive:
-                    try:
-                        pipe.close()
-                    except Exception:
-                        pass
         return False
 
     def _send(self, obj):
@@ -281,8 +291,15 @@ class _Session:
     def _notify(self, method, params=None):
         self._send({"jsonrpc": "2.0", "method": method, "params": params or {}})
 
+    def _check_interrupted(self):
+        if self.cancel_event is not None and self.cancel_event.is_set():
+            raise RuntimeError("任务已取消")
+        if self.task_deadline is not None and time.monotonic() >= self.task_deadline:
+            raise RuntimeError("任务总时限已到")
+
     def _request(self, method, params, timeout):
         """单请求单响应；忽略通知与未知 id 的服务端请求。"""
+        self._check_interrupted()
         duration = max(0.0, float(timeout))
         if self.deadline is not None:
             duration = min(duration, self.deadline - time.monotonic())
@@ -293,13 +310,15 @@ class _Session:
                     "method": method, "params": params or {}})
         deadline = time.monotonic() + duration
         while True:
+            self._check_interrupted()
             remain = deadline - time.monotonic()
             if remain <= 0:
                 raise RuntimeError("%s 超时（%.0fs）" % (method, timeout))
             try:
-                line = self.lines.get(timeout=remain)
-            except Exception:
-                raise RuntimeError("%s 超时（%.0fs）" % (method, timeout))
+                wait = min(remain, 0.1) if self.cancel_event is not None else remain
+                line = self.lines.get(timeout=wait)
+            except queue.Empty:
+                continue
             if line is None:
                 raise RuntimeError("MCP 服务器提前退出")
             line = line.strip()
@@ -327,10 +346,11 @@ def list_tools(server, *, sandbox=None, workdir=None):
         tools = []
         for t in (res.get("tools") or [])[:16]:
             if isinstance(t, dict) and isinstance(t.get("name"), str) and t["name"]:
+                schema = t.get("inputSchema", t.get("input_schema"))
                 tools.append({"name": t["name"],
                               "description": str(t.get("description") or "")[:400],
-                              "input_schema": t.get("input_schema")
-                              if isinstance(t.get("input_schema"), dict) else
+                              "input_schema": schema
+                              if isinstance(schema, dict) else
                               {"type": "object", "properties": {}}})
         return {"ok": True, "tools": tools, "error": ""}
     except Exception as e:
@@ -338,12 +358,13 @@ def list_tools(server, *, sandbox=None, workdir=None):
 
 
 def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT,
-              *, sandbox=None, workdir=None):
+              *, sandbox=None, workdir=None, cancel_event=None, deadline=None):
     """调用一个工具。返回 {"ok", "text", "error", "is_error"}。"""
     try:
         timeout = min(_CALL_TIMEOUT_MAX, max(0.001, float(timeout_s or _CALL_TIMEOUT)))
         with _Session(server, sandbox=sandbox, workdir=workdir,
-                      timeout_s=timeout) as sess:
+                      timeout_s=timeout, cancel_event=cancel_event,
+                      deadline=deadline) as sess:
             res = sess._request("tools/call",
                                 {"name": tool_name,
                                  "arguments": arguments if isinstance(arguments, dict) else {}},
@@ -364,6 +385,12 @@ def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT,
 # ---- 面向 builtin_agent 的合并视图（带缓存） ----
 
 def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
+    """Serialize discoveries so callers cannot observe incomplete refreshes."""
+    with _REFRESH_LOCK:
+        return _tool_specs_cached(force=force, sandbox=sandbox, workdir=workdir)
+
+
+def _tool_specs_cached(force=False, *, sandbox=None, workdir=None):
     """全部服务器的工具合并清单：[{server, name(原名), full_name, description,
     input_schema}]。TTL 内走缓存；单个服务器失败跳过（error 挂在条目外不打断）。"""
     global _TOOLS_CONFIG_SHA
@@ -398,8 +425,8 @@ def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
     disabled = set(policy.normalize_disabled_tools(
         (sandbox or {}).get("disabled_tools")))
     out = []
-    with _LOCK:
-        _TOOLS_CACHE.clear()
+    discovered = {}
+    seen_names = set()
     for srv in servers:
         res = list_tools(srv, sandbox=sandbox, workdir=workdir)
         if not res.get("ok"):
@@ -410,25 +437,36 @@ def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
             if (t["name"] in srv.get("disabled_tools", [])
                     or t["name"] in disabled or full_name in disabled):
                 continue
+            if not _MODEL_TOOL_NAME_RE.fullmatch(full_name) or full_name in seen_names:
+                continue
+            seen_names.add(full_name)
             specs.append({"server": srv["name"], "name": t["name"],
                           "full_name": full_name,
                           "description": t["description"],
                           "input_schema": t["input_schema"]})
-        with _LOCK:
-            _TOOLS_CACHE[(scope_sha, srv["name"])] = (time.time(), specs)
+        discovered[(scope_sha, srv["name"])] = (time.time(), specs)
         out.extend(specs)
         if len(out) >= MAX_MCP_TOOLS:
             break
+    with _LOCK:
+        if config_sha != _TOOLS_CONFIG_SHA:
+            return []
+        for key in list(_TOOLS_CACHE):
+            if isinstance(key, tuple) and key[0] == scope_sha:
+                del _TOOLS_CACHE[key]
+        _TOOLS_CACHE.update(discovered)
     return out[:MAX_MCP_TOOLS]
 
 
 def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT, *,
-                       sandbox=None, workdir=None, disabled_tools=None):
+                       sandbox=None, workdir=None, disabled_tools=None,
+                       cancel_event=None, deadline=None):
     """mcp__<server>__<tool> → 找服务器配置并调用。返回 {"ok","text","error"}。"""
-    m = re.match(r"^mcp__([a-z0-9_-]{1,24})__(.+)$", str(full_name or ""))
-    if not m:
+    full_name = str(full_name or "")
+    sname, sep, tool = full_name[5:].partition("__") if full_name.startswith("mcp__") \
+        else ("", "", "")
+    if not sep or not _NAME_RE.fullmatch(sname) or "__" in sname or not tool:
         return {"ok": False, "text": "", "error": "非法 MCP 工具名"}
-    sname, tool = m.group(1), m.group(2)
     servers, err = parse_servers(_settings_text())
     if err:
         return {"ok": False, "text": "", "error": err}
@@ -443,7 +481,8 @@ def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT, *,
     if sandbox is None or not workdir:
         return {"ok": False, "text": "", "error": "MCP 调用缺少任务沙箱策略或工作目录，拒绝启动"}
     return call_tool(srv, tool, arguments, timeout_s=timeout_s,
-                     sandbox=sandbox, workdir=workdir)
+                     sandbox=sandbox, workdir=workdir,
+                     cancel_event=cancel_event, deadline=deadline)
 
 
 _SETTINGS_TEXT = None     # main.py 启动注入（读 settings.mcp_servers）——本模块

package/app/core/pipeline.py

@@ -807,6 +807,18 @@ def _cost_gate_block():
     return None
 
 
+def _run_sandbox(run_id):
+    """Return a run's persisted sandbox policy, or the unrestricted default hint.
+
+    Low-level callers such as budget-gate tests may use a run id before creating
+    a task. The runner still enforces any task policy when one is present.
+    """
+    run = store.get_run(run_id) or {}
+    task_id = run.get("task_id")
+    task = store.get_task(task_id) if task_id else None
+    return (task or {}).get("sandbox") or {}
+
+
 def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
                 timeout, resume, step, log_abs, images=None, require_tools=False,
                 deadline=None):
@@ -846,9 +858,7 @@ def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
                            timeout=timeout, cancel_event=ev, log_path=str(log_abs),
                            images=images, require_tools=require_tools, deadline=deadline,
                            command_context={"run_id": session_run_id,
-                                            "sandbox": (store.get_task(
-                                                (store.get_run(session_run_id) or {}).get("task_id")
-                                            ) or {}).get("sandbox") or {},
+                                            "sandbox": _run_sandbox(session_run_id),
                                             "allow_terminal": not readonly},
                            checkpoint_run_id=session_run_id)
 
@@ -880,9 +890,7 @@ def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
                                resume=resume, images=images, require_tools=require_tools,
                                deadline=deadline,
                                command_context={"run_id": session_run_id,
-                                                "sandbox": (store.get_task(
-                                                    (store.get_run(session_run_id) or {}).get("task_id")
-                                                ) or {}).get("sandbox") or {},
+                                                "sandbox": _run_sandbox(session_run_id),
                                                 "allow_terminal": not readonly},
                                checkpoint_run_id=session_run_id)
     # 默认关闭压缩和 resume 都走直通分支，也必须把真实 usage 送进预算表；否则

package/app/core/publish/auto.py

@@ -215,6 +215,67 @@ def pending(task_id, platform):
     return out, ""
 
 
+def chapter_review_states(task, items, quality, hard_ok, hard_reason="", direct_ok=True):
+    """逐章最新评审证据与实际发布门禁同时展示，不把单章通过当作放行。"""
+    from .. import store, quality_gate
+    try:
+        reviewed_through = int(quality.get("reviewed_through") or 0)
+    except (ValueError, TypeError):
+        reviewed_through = 0
+    runs = []
+    for tid in store.serial_chain_ids(task.get("id")):
+        runs.extend(store.task_runs(tid) or [])
+    evidence = {}
+    for run in sorted(runs, key=lambda r: str(r.get("id") or ""), reverse=True):
+        verdict = run.get("verdict") if run.get("status") == "done" else None
+        if not isinstance(verdict, dict):
+            continue
+        for score in verdict.get("chapter_scores") or []:
+            if not isinstance(score, dict):
+                continue
+            try:
+                n = int(score.get("chapter") or 0)
+            except (ValueError, TypeError):
+                continue
+            if n > 0 and n not in evidence:
+                evidence[n] = (score, run)
+    for item in items:
+        score, run = evidence.get(item["chapter_no"], ({}, {}))
+        state, reason = "pending", "尚无有效单章评审"
+        try:
+            valid = (score.get("passed") is True
+                     and int(score.get("reviewer_count") or 0) >= quality_gate.MIN_REVIEWERS
+                     and score.get("reviewer_consensus") is True)
+        except (ValueError, TypeError):
+            valid = False
+        if score.get("passed") is False:
+            state, reason = "failed", "单章质量评审未通过"
+        elif score and not valid:
+            reason = "有效评审人数不足或未形成共识"
+        elif valid:
+            state, reason = "passed_blocked", "单章已过审，发布门禁未过"
+            if not hard_ok:
+                reason = hard_reason
+            elif not quality.get("allowed"):
+                reason = "；".join(quality.get("blockers") or []) or reason
+            elif item["chapter_no"] > reviewed_through:
+                reason = "目标章节超出当前发布评审版本"
+            elif not direct_ok:
+                reason = "平台发布流程尚未校准，可人工确认发布，暂不可自动直发"
+            else:
+                state, reason = "ready", "单章及发布门禁均已通过"
+            try:
+                reviewed_at = time.mktime(time.strptime(run.get("ended_at") or "", "%Y-%m-%d %H:%M:%S"))
+                if os.path.getmtime(os.path.join(task.get("workdir") or "", item["file"])) > reviewed_at + 1:
+                    state, reason = "stale", "正文在评审后修改，需要重新评审"
+            except (OSError, ValueError, TypeError):
+                pass
+        item.update(review_status=state, review_reason=reason,
+                    review_passed=valid and state != "stale",
+                    publish_ready=state == "ready", review_run_id=run.get("id") or "")
+    return items
+
+
 def status(task_id):
     """前端视图：待发清单 + 护栏状态 + 自动发布进度。
 
@@ -233,6 +294,7 @@ def status(task_id):
         if not _book_ready(info):
             hard_ok, hard_why = False, "该平台建书结果未确认（缺少作品 ID），请重试创建作品或登记已有作品"
         blockers = []
+        quality = {"allowed": False, "blockers": []}
         if task and _book_ready(info):
             quality = manager._quality_release_guard(task, plat, action="publish")
             if not quality.get("allowed"):
@@ -240,15 +302,24 @@ def status(task_id):
         ok, why = hard_ok, hard_why
         if ok and blockers:
             ok, why = False, "质量门禁拦截：%s" % "；".join(blockers)
+        direct_ok = calibrated(plat)
+        chapter_review_states(task or {}, pend, quality, hard_ok, hard_why, direct_ok)
+        published = ledger.published_chapters(task_id, plat)
+        drafted = ledger.drafted_chapters(task_id, plat) - published
         books.append({"platform": plat, "bound": True,
                       "title": info.get("title") or "",
                       "pending": len(pend),
-                      "items": pend[:200],
+                      "items": pend,
+                      "published_latest": max(published, default=0),
+                      "next_chapter": pend[0]["chapter_no"] if pend else None,
+                      "ready_count": sum(p["publish_ready"] for p in pend),
+                      "review_passed_count": sum(p["review_passed"] for p in pend),
+                      "drafted_nos": sorted(drafted),
                       "guard_ok": ok, "guard_reason": why,
                       "draft_ok": hard_ok, "draft_reason": hard_why,
                       "quality_blockers": blockers,
-                      "drafted": len(ledger.drafted_chapters(task_id, plat)),
-                      "calibrated": calibrated(plat)})
+                      "drafted": len(drafted),
+                      "calibrated": direct_ok})
     run = _running.get(task_id) or None
     if run:
         run = dict(run)

package/app/core/publish/ledger.py

@@ -102,6 +102,11 @@ def published_chapters(task_id, platform):
                 out.add(int(n))
     try:
         ent = book_for(task_id, platform) or {}
+        # 用户确认的连续发布进度独立于平台数行结果；跨卷校准漏行不能
+        # 让已发布的旧章重新进入待发。它是章号边界，不是平台章节数量。
+        through = int(ent.get("confirmed_published_through") or 0)
+        if 0 < through <= 100000:
+            out.update(range(1, through + 1))
         for n in (ent.get("remote_published_nos") or []):
             n = int(n)
             if n > 0: