codebee 0.1.96 → 0.1.98

package/app/core/manager.py

@@ -91,19 +91,21 @@ def _safe_config_path(raw):
 # ---------------------------------------------------------------- 检测
 
 def _which_cli(cli):
-    """PATH 找 CLI；Windows 上再兜底 winget 便携包两处标准落点。
-
-    winget 装的 CLI（如 Claude Code）把 exe 放进
-    %LOCALAPPDATA%\\Microsoft\\WinGet\\Packages\\<PkgId>_*\\，并把该目录写进
-    注册表用户 PATH——注册表更新后已在跑的进程（本服务）不继承，shutil.which
-    落空 → 卡片「未安装」假象，点安装又被 winget「已装无可升级」非零退出拒掉
-    （2026-09-30 实案）。Links 是便携包符号链接标准目录，Packages 按
-    <cli>.exe 通配兜另一形态；两条都只兜 which 落空的场景，零额外开销。"""
+    """PATH 找 CLI；落空再按平台兜底磁盘已知安装位。
+
+    Windows 兜 winget 便携包两处标准落点：winget 装的 CLI（如 Claude Code）
+    把 exe 放进 %LOCALAPPDATA%\\Microsoft\\WinGet\\Packages\\<PkgId>_*\\，并把
+    该目录写进注册表用户 PATH——注册表更新后已在跑的进程（本服务）不继承，
+    shutil.which 落空 → 卡片「未安装」假象，点安装又被 winget「已装无可升级」
+    非零退出拒掉（2026-09-30 实案）。Links 是便携包符号链接标准目录，Packages
+    按 <cli>.exe 通配兜另一形态。POSIX 兜 runner 同款三落点（~/.local/bin 与
+    brew bin，Mac 服务吃不到 shell rc 里的 PATH 时同样假「未安装」）。
+    两条都只兜 which 落空的场景，零额外开销。"""
     path = shutil.which(cli)
     if path:
         return path
     if os.name != "nt":
-        return None
+        return runner._fallback_probe_cli(cli)
     local = os.environ.get("LOCALAPPDATA")
     if not local:
         return None
@@ -1974,7 +1976,10 @@ def _winget_already_ok(cmd, op, res):
     还要复检 installed 才按成功收口。"""
     if res.get("ok") or op not in ("install", "upgrade"):
         return False
-    if not str(cmd or "").strip().lower().startswith("winget"):
+    # 首 token 可能已被 _resolve_mgmt_tool 换成绝对路径（PATH 快照落空兜底），
+    # 所以按 basename 认 winget，别用 startswith
+    head = str(cmd or "").strip().split()[0] if str(cmd or "").strip() else ""
+    if os.path.basename(head).lower().rstrip(".exe") != "winget":
         return False
     code = res.get("exit_code")
     try:
@@ -1986,6 +1991,85 @@ def _winget_already_ok(cmd, op, res):
     return any(m in out for m in _WINGET_NOOP_MARKERS)
 
 
+def _uv_install_hint():
+    if sys.platform == "darwin":
+        return "brew install uv（或官网 curl -LsSf https://astral.sh/uv/install.sh | sh）"
+    return "winget install astral-sh.uv，或 pip install uv"
+
+
+def _uv_mirror_env():
+    """uv 系命令的镜像兜底 env（用户没自己配才补默认，绝不覆盖）。
+
+    uv tool install --python 3.12 会现场下载 CPython 独立构建（GitHub 直连，
+    国内常断流），包体走 PyPI——npmmirror/清华这对镜像是 2026-09 本机 uv
+    实装验证过的组合。"""
+    env = {}
+    if not os.environ.get("UV_PYTHON_INSTALL_MIRROR"):
+        env["UV_PYTHON_INSTALL_MIRROR"] = (
+            "https://registry.npmmirror.com/-/binary/python-build-standalone")
+    if not os.environ.get("UV_DEFAULT_INDEX"):
+        env["UV_DEFAULT_INDEX"] = "https://pypi.tuna.tsinghua.edu.cn/simple"
+    return env
+
+
+def _cmd_head_is_uv(cmd):
+    stripped = str(cmd or "").strip()
+    if not stripped:
+        return False
+    return os.path.basename(stripped.split()[0]).lower() in ("uv", "uv.exe")
+
+
+def _bootstrap_uv(cancel_event=None, log_path=None):
+    """uv 不在本机时自动补装一个——安装按钮「点了就该装上」的契约兜底。
+
+    按平台选渠道，全部免 sudo 非交互：POSIX 先 brew（在才用）后官方 curl
+    脚本（落 ~/.local/bin，探测表可寻址）；Windows 先 winget 后 pip。装完
+    不指望 PATH 快照自愈——调用方重跑 _resolve_mgmt_tool 用绝对路径接管。
+    返回 {ok, detail}；失败 detail 列出试过的渠道与结局，供人话收口。"""
+    candidates = []
+    if sys.platform == "win32":
+        if shutil.which("winget"):
+            candidates.append(("winget", "winget install -e --id astral-sh.uv --silent"))
+        if shutil.which("py"):
+            candidates.append(("pip(py)", "py -3 -m pip install uv"))
+        elif shutil.which("python"):
+            candidates.append(("pip", "python -m pip install uv"))
+    else:
+        if shutil.which("brew"):
+            candidates.append(("brew", "brew install uv"))
+        if shutil.which("curl"):
+            candidates.append(("curl", "curl -LsSf https://astral.sh/uv/install.sh | sh"))
+    attempts = []
+    for label, cmd in candidates:
+        res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT),
+                                 timeout=900, cancel_event=cancel_event,
+                                 log_path=log_path)
+        if res["ok"]:
+            return {"ok": True, "detail": "已自动补装 uv（%s）" % label}
+        attempts.append("%s 退出码 %s" % (label, res.get("exit_code")))
+    return {"ok": False,
+            "detail": "、".join(attempts) or "本机没有 brew/curl/winget/pip 任一渠道"}
+
+
+def _resolve_mgmt_tool(cmd, op):
+    """install/upgrade 命令首 token 的工具本体解析。
+
+    服务 PATH 是启动快照，本机后装的 uv/npm 不在快照里时 shell 报
+    command not found 退出码 127，零信息量。磁盘已知落点能探到就把首 token
+    原地换成绝对路径（装完即用，不必重启服务）；探不到且是 uv 系安装命令
+    则返回 uv_missing=True——本机连 uv 都没有，包无从装起，人话报错并跳过
+    AI 修复（修复链装上 uv 后复检目标 CLI 仍未装，白烧一轮诊断）。
+    返回 (替换后的命令, uv_missing)。"""
+    stripped = str(cmd or "").strip()
+    first = stripped.split()[0] if stripped else ""
+    if not first or os.path.isabs(first) or shutil.which(first):
+        return cmd, False
+    found = runner._fallback_probe_cli(first)
+    if found:
+        return found + stripped[len(first):], False
+    return cmd, (first == "uv" and op in ("install", "upgrade"))
+
+
 def run_mgmt_command(entry, op, cancel_event=None, log_path=None):
     """执行 install/upgrade/uninstall 命令（由任务执行器异步运行，日志实时落盘）。"""
     if op == "uninstall":
@@ -2000,8 +2084,22 @@ def run_mgmt_command(entry, op, cancel_event=None, log_path=None):
             return {"ok": False,
                     "error": "未配置 %s 命令：请在 data/catalog.json 的 \"%s\" 里补充，或用官方渠道安装"
                              % (op, entry["id"])}
+    cmd, uv_missing = _resolve_mgmt_tool(cmd, op)
+    if uv_missing:
+        # 「提供安装就该能装上」：uv 不在本机先自动补装，装 uv 不该是用户
+        # 操心的事；真补不上才退回人话指引（2026-10-09 Mac 双装失败实案）
+        boot = _bootstrap_uv(cancel_event=cancel_event, log_path=log_path)
+        if boot["ok"]:
+            cmd, uv_missing = _resolve_mgmt_tool(cmd, op)
+        if uv_missing:
+            return {"ok": False, "uv_missing": True,
+                    "error": "自动安装 uv 未成功（%s）。请手动安装：%s；"
+                             "装完重启 CodeBee，再点一次安装。"
+                             % (boot["detail"], _uv_install_hint())}
+    # uv 全家桶命令挂镜像兜底：Python 独立构建/包索引国内直连常断（只补缺不覆盖）
     res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT),
-                             timeout=1800, cancel_event=cancel_event, log_path=log_path)
+                             timeout=1800, cancel_event=cancel_event, log_path=log_path,
+                             env=_uv_mirror_env() if _cmd_head_is_uv(cmd) else None)
     winget_noop = _winget_already_ok(cmd, op, res)
     detect_all(force=True)
     with _LOCK:

package/app/core/mcp_client.py

@@ -17,15 +17,20 @@ name 用于工具名前缀（mcp__<name>__<tool>），必须 [a-z0-9_-]。
 from __future__ import annotations
 
 import json
+import hashlib
 import os
 import re
+import shutil
 import subprocess
+import sys
 import threading
 import time
+from pathlib import Path
 
 _LOCK = threading.RLock()
 _TOOLS_CACHE = {}          # server_key → (ts, tools)
 _TOOLS_TTL = 300.0
+_TOOLS_CONFIG_SHA = ""
 
 MAX_SERVERS = 4
 MAX_MCP_TOOLS = 24         # 全部服务器合计注入内置智能体的工具数上限
@@ -39,8 +44,10 @@ _CLIENT_INFO = {"name": "CodeBee", "version": "1.0"}
 
 def invalidate_tools_cache():
     """服务器配置变化后丢弃已发现工具（插件启停等场景调用）。"""
+    global _TOOLS_CONFIG_SHA
     with _LOCK:
         _TOOLS_CACHE.clear()
+        _TOOLS_CONFIG_SHA = ""
 
 
 def parse_servers(text):
@@ -70,18 +77,86 @@ def parse_servers(text):
         args = [str(a) for a in args][:16]
         env = item.get("env") if isinstance(item.get("env"), dict) else {}
         env = {str(k): str(v) for k, v in list(env.items())[:16]}
-        out.append({"name": name, "command": command, "args": args, "env": env})
+        disabled = item.get("disabled_tools")
+        if not isinstance(disabled, list):
+            disabled = []
+        disabled = list(dict.fromkeys(str(x).strip()[:120] for x in disabled
+                                      if str(x or "").strip()))[:200]
+        out.append({"name": name, "command": command, "args": args, "env": env,
+                    "disabled_tools": disabled})
     return out, None
 
 
+def _sandbox_launch(server, sandbox, workdir):
+    """Build an OS-isolated stdio server launch or refuse to spawn it.
+
+    MCP tools are arbitrary configured programs. On Linux they run under
+    bubblewrap with only declared roots mounted; platforms without an equivalent
+    backend fail closed. Runtime variables are synthetic/minimal unless explicitly
+    included in the task env allowlist.
+    """
+    from . import policy
+    if not sandbox or not workdir:
+        raise RuntimeError("MCP 调用缺少任务沙箱策略或工作目录，拒绝启动")
+    if os.name != "posix" or sys.platform == "darwin" or not shutil.which("bwrap"):
+        raise RuntimeError("MCP 服务尚无可用的 OS 隔离后端，拒绝启动")
+    root = Path(workdir).expanduser().resolve(strict=True)
+    normalized = policy.normalize_sandbox(sandbox, root)
+    roots = [Path(value).resolve(strict=True)
+             for value in normalized.get("allowed_roots") or []]
+    if not roots:
+        raise RuntimeError("MCP 沙箱没有允许目录，拒绝启动")
+    cwd = root if policy.path_allowed(root, normalized) else roots[0]
+    argv = _bubblewrap_argv(server, normalized, roots, cwd)
+    return argv, _sandbox_env(server, normalized), str(cwd)
+
+
+def _sandbox_env(server, sandbox):
+    """Pass only the minimal runtime environment and explicitly allowed values."""
+    env = {"PATH": os.environ.get("PATH", "/usr/bin:/bin"),
+           "HOME": "/tmp", "TMPDIR": "/tmp"}
+    for name in sandbox.get("env_allowlist") or []:
+        if name in os.environ:
+            env[name] = os.environ[name]
+        elif name in (server.get("env") or {}):
+            env[name] = str(server["env"][name])
+    return env
+
+
+def _bubblewrap_argv(server, sandbox, roots, cwd):
+    """Build bwrap argv from already validated paths (also host-testable)."""
+    argv = ["bwrap", "--die-with-parent", "--new-session", "--tmpfs", "/"]
+    for system_path in ("/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc"):
+        if os.path.exists(system_path):
+            argv.extend(["--dir", system_path, "--ro-bind", system_path, system_path])
+    argv.extend(["--dir", "/proc", "--dir", "/dev", "--proc", "/proc",
+                 "--dev", "/dev", "--tmpfs", "/tmp"])
+    if sandbox.get("network") is False:
+        argv.append("--unshare-net")
+    for allowed_root in roots:
+        for parent in reversed(allowed_root.parents):
+            if str(parent) != "/":
+                argv.extend(["--dir", str(parent)])
+        argv.extend(["--dir", str(allowed_root), "--bind",
+                     str(allowed_root), str(allowed_root)])
+    argv.extend(["--chdir", str(cwd), "--", server["command"]]
+                + list(server.get("args") or []))
+    return argv
+
+
 class _Session:
     """一次性的 MCP 服务器会话：spawn → initialize → （list/call）→ 杀树。"""
 
-    def __init__(self, server):
+    def __init__(self, server, sandbox=None, workdir=None, timeout_s=None):
         self.server = server
+        self.sandbox = sandbox
+        self.workdir = workdir
+        self.timeout_s = timeout_s
+        self.deadline = None
         self.proc = None
         self.lines = None       # reader 线程产出的行队列
         self.err = None
+        self._reader_threads = []
 
     def _pump_err(self):
         try:
@@ -89,6 +164,11 @@ class _Session:
                 pass
         except Exception:
             pass
+        finally:
+            try:
+                self.proc.stderr.close()
+            except Exception:
+                pass
 
     def _pump_out(self):
         try:
@@ -97,25 +177,48 @@ class _Session:
         except Exception:
             pass
         finally:
+            try:
+                self.proc.stdout.close()
+            except Exception:
+                pass
             self.lines.put(None)      # EOF 哨兵
 
     def __enter__(self):
+        if self.timeout_s is not None:
+            self.deadline = time.monotonic() + max(0.0, float(self.timeout_s))
         try:
+            argv, env, cwd = _sandbox_launch(self.server, self.sandbox, self.workdir)
+            if self.deadline is not None and time.monotonic() >= self.deadline:
+                raise RuntimeError("MCP 任务时限已到，拒绝启动")
             self.proc = subprocess.Popen(
-                [self.server["command"]] + list(self.server.get("args") or []),
+                argv,
                 stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE, text=False,
-                env={**os.environ, **(self.server.get("env") or {})})
+                env=env, cwd=cwd, start_new_session=True)
         except Exception as e:
             raise RuntimeError("MCP 服务器启动失败: %s" % e)
         import queue as _queue
         self.lines = _queue.Queue()
-        threading.Thread(target=self._pump_out, daemon=True).start()
-        threading.Thread(target=self._pump_err, daemon=True).start()
-        self._request("initialize", {
-            "protocolVersion": "2024-11-05", "capabilities": {},
-            "clientInfo": _CLIENT_INFO}, timeout=_INIT_TIMEOUT)
-        self._notify("notifications/initialized")
+        self._reader_threads = [
+            threading.Thread(target=self._pump_out, daemon=True),
+            threading.Thread(target=self._pump_err, daemon=True),
+        ]
+        for thread in self._reader_threads:
+            thread.start()
+        try:
+            init_timeout = _INIT_TIMEOUT
+            if self.deadline is not None:
+                init_timeout = min(init_timeout, self.deadline - time.monotonic())
+                if init_timeout <= 0:
+                    raise RuntimeError("MCP 任务时限已到，初始化未执行")
+            self._request("initialize", {
+                "protocolVersion": "2024-11-05", "capabilities": {},
+                "clientInfo": _CLIENT_INFO}, timeout=init_timeout)
+            self._notify("notifications/initialized")
+        except Exception:
+            # Context manager __exit__ is not called when __enter__ raises.
+            self.__exit__(None, None, None)
+            raise
         return self
 
     def __exit__(self, *exc):
@@ -125,12 +228,44 @@ class _Session:
                     self.proc.stdin.close()
                 except Exception:
                     pass
-        finally:
             try:
-                if self.proc:
+                if self.proc and self.proc.poll() is None:
+                    # bwrap runs in its own process group; terminate descendants
+                    # as well as the launcher so timed-out MCP servers cannot
+                    # leave background children holding pipes or doing work.
+                    try:
+                        from . import runner
+                        runner._kill_tree(self.proc.pid)
+                    except Exception:
+                        pass
                     self.proc.kill()
             except Exception:
                 pass
+            try:
+                if self.proc:
+                    self.proc.wait(timeout=1)
+            except Exception:
+                pass
+        finally:
+            # Close all parent-side pipe handles even if initialization failed.
+            # Do not close a stream while its reader is blocked in read(): the
+            # buffered stream lock can make close wait forever if an escaped
+            # descendant still holds the pipe open. Let daemon readers finish
+            # on EOF and close only streams no thread currently owns.
+            for thread in self._reader_threads:
+                try:
+                    thread.join(timeout=0.2)
+                except Exception:
+                    pass
+            for name in ("stdout", "stderr"):
+                pipe = getattr(self.proc, name, None) if self.proc else None
+                readers_alive = any(
+                    thread.is_alive() for thread in self._reader_threads)
+                if pipe and not readers_alive:
+                    try:
+                        pipe.close()
+                    except Exception:
+                        pass
         return False
 
     def _send(self, obj):
@@ -143,12 +278,17 @@ class _Session:
 
     def _request(self, method, params, timeout):
         """单请求单响应；忽略通知与未知 id 的服务端请求。"""
+        duration = max(0.0, float(timeout))
+        if self.deadline is not None:
+            duration = min(duration, self.deadline - time.monotonic())
+        if duration <= 0:
+            raise RuntimeError("%s 超时（任务时限已到）" % method)
         rid = id({})
         self._send({"jsonrpc": "2.0", "id": 1 if method == "initialize" else rid,
                     "method": method, "params": params or {}})
-        deadline = time.time() + max(1.0, timeout)
+        deadline = time.monotonic() + duration
         while True:
-            remain = deadline - time.time()
+            remain = deadline - time.monotonic()
             if remain <= 0:
                 raise RuntimeError("%s 超时（%.0fs）" % (method, timeout))
             try:
@@ -174,10 +314,10 @@ class _Session:
             return msg.get("result") or {}
 
 
-def list_tools(server):
+def list_tools(server, *, sandbox=None, workdir=None):
     """发现服务器工具。返回 {"ok", "tools":[{"name","description","input_schema"}], "error"}。"""
     try:
-        with _Session(server) as sess:
+        with _Session(server, sandbox=sandbox, workdir=workdir) as sess:
             res = sess._request("tools/list", {}, timeout=_INIT_TIMEOUT)
         tools = []
         for t in (res.get("tools") or [])[:16]:
@@ -192,11 +332,13 @@ def list_tools(server):
         return {"ok": False, "tools": [], "error": str(e)[:200]}
 
 
-def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT):
+def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT,
+              *, sandbox=None, workdir=None):
     """调用一个工具。返回 {"ok", "text", "error", "is_error"}。"""
     try:
-        timeout = min(_CALL_TIMEOUT_MAX, max(5.0, float(timeout_s or _CALL_TIMEOUT)))
-        with _Session(server) as sess:
+        timeout = min(_CALL_TIMEOUT_MAX, max(0.001, float(timeout_s or _CALL_TIMEOUT)))
+        with _Session(server, sandbox=sandbox, workdir=workdir,
+                      timeout_s=timeout) as sess:
             res = sess._request("tools/call",
                                 {"name": tool_name,
                                  "arguments": arguments if isinstance(arguments, dict) else {}},
@@ -216,46 +358,67 @@ def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT):
 
 # ---- 面向 builtin_agent 的合并视图（带缓存） ----
 
-def tool_specs_cached(force=False):
+def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
     """全部服务器的工具合并清单：[{server, name(原名), full_name, description,
     input_schema}]。TTL 内走缓存；单个服务器失败跳过（error 挂在条目外不打断）。"""
+    global _TOOLS_CONFIG_SHA
+    if not sandbox or not workdir:
+        return []
+    config_text = _settings_text()
+    config_sha = hashlib.sha256(config_text.encode("utf-8")).hexdigest()
+    scope_sha = hashlib.sha256(json.dumps({
+        "workdir": os.path.realpath(workdir), "sandbox": sandbox,
+    }, sort_keys=True, default=str).encode("utf-8")).hexdigest()
     with _LOCK:
+        if config_sha != _TOOLS_CONFIG_SHA:
+            _TOOLS_CACHE.clear()
+            _TOOLS_CONFIG_SHA = config_sha
         if not force:
             hit = True
-            for key, (ts, _t) in _TOOLS_CACHE.items():
+            scoped = [(key, value) for key, value in _TOOLS_CACHE.items()
+                      if isinstance(key, tuple) and key[0] == scope_sha]
+            for key, (ts, _t) in scoped:
                 if time.time() - ts > _TOOLS_TTL:
                     hit = False
                     break
-            if hit and _TOOLS_CACHE:
+            if hit and scoped:
                 out = []
-                for _key, (_ts, tools) in _TOOLS_CACHE.items():
+                for _key, (_ts, tools) in scoped:
                     out.extend(tools)
                 return out[:MAX_MCP_TOOLS]
-    servers, err = parse_servers(_settings_text())
+    servers, err = parse_servers(config_text)
     if err or not servers:
         return []
+    from . import policy
+    disabled = set(policy.normalize_disabled_tools(
+        (sandbox or {}).get("disabled_tools")))
     out = []
     with _LOCK:
         _TOOLS_CACHE.clear()
     for srv in servers:
-        res = list_tools(srv)
+        res = list_tools(srv, sandbox=sandbox, workdir=workdir)
         if not res.get("ok"):
             continue
         specs = []
         for t in res["tools"]:
+            full_name = "mcp__%s__%s" % (srv["name"], t["name"])
+            if (t["name"] in srv.get("disabled_tools", [])
+                    or t["name"] in disabled or full_name in disabled):
+                continue
             specs.append({"server": srv["name"], "name": t["name"],
-                          "full_name": "mcp__%s__%s" % (srv["name"], t["name"]),
+                          "full_name": full_name,
                           "description": t["description"],
                           "input_schema": t["input_schema"]})
         with _LOCK:
-            _TOOLS_CACHE[srv["name"]] = (time.time(), specs)
+            _TOOLS_CACHE[(scope_sha, srv["name"])] = (time.time(), specs)
         out.extend(specs)
         if len(out) >= MAX_MCP_TOOLS:
             break
     return out[:MAX_MCP_TOOLS]
 
 
-def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT):
+def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT, *,
+                       sandbox=None, workdir=None, disabled_tools=None):
     """mcp__<server>__<tool> → 找服务器配置并调用。返回 {"ok","text","error"}。"""
     m = re.match(r"^mcp__([a-z0-9_-]{1,24})__(.+)$", str(full_name or ""))
     if not m:
@@ -267,7 +430,15 @@ def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT):
     srv = next((s for s in servers if s["name"] == sname), None)
     if not srv:
         return {"ok": False, "text": "", "error": "MCP 服务器 %s 未配置" % sname}
-    return call_tool(srv, tool, arguments, timeout_s=timeout_s)
+    if tool in (srv.get("disabled_tools") or []):
+        return {"ok": False, "text": "", "error": "MCP 工具已禁用: %s" % full_name}
+    if (full_name in set(str(x) for x in (disabled_tools or []))
+            or tool in set(str(x) for x in (disabled_tools or []))):
+        return {"ok": False, "text": "", "error": "任务策略已禁用 MCP 工具: %s" % full_name}
+    if sandbox is None or not workdir:
+        return {"ok": False, "text": "", "error": "MCP 调用缺少任务沙箱策略或工作目录，拒绝启动"}
+    return call_tool(srv, tool, arguments, timeout_s=timeout_s,
+                     sandbox=sandbox, workdir=workdir)
 
 
 _SETTINGS_TEXT = None     # main.py 启动注入（读 settings.mcp_servers）——本模块