codebee 0.1.96 → 0.1.98

package/app/core/pipeline.py

@@ -229,10 +229,12 @@ def _resume_workdir(resume_ctx, fallback):
 
 
 def _compaction_enabled():
-    """Phase 2 灰度开关：环境变量 TUTTI_COMPACTION=1 或设置页
-    settings_v2 orchestrator.compaction.enabled 任一开启即生效（默认关）。"""
-    if os.environ.get("TUTTI_COMPACTION") == "1":
+    """环境变量可显式覆盖设置页开关；未设置时读取 settings_v2。"""
+    env_value = os.environ.get("TUTTI_COMPACTION", "").strip().lower()
+    if env_value in ("1", "true", "yes", "on"):
         return True
+    if env_value in ("0", "false", "no", "off"):
+        return False
     try:
         from .settings_schema import get as ss_get, register_default_namespaces
         register_default_namespaces()
@@ -451,6 +453,30 @@ def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner
     except Exception:
         pass
     start = time.time()
+    # Third-party CLI backends have their own sandbox semantics, but do not
+    # consume CodeBee's per-task policy. Fail closed for narrowed policies
+    # instead of treating a prompt or workdir as an OS-level boundary.
+    sandbox_error = ""
+    try:
+        run_row = store.get_run(run_id) or {}
+        task_row = store.get_task(run_row.get("task_id")) if run_row.get("task_id") else {}
+        if agent.get("mode") != "mock":
+            if not task_row:
+                sandbox_error = "无法读取任务沙箱策略，外部智能体执行已拒绝"
+            else:
+                from . import policy
+                sandbox_error = _external_sandbox_block_reason(
+                    agent, workdir, task_row.get("sandbox") or {})
+    except Exception:
+        # A missing task record is not permission to synthesize a wider policy.
+        sandbox_error = "无法读取任务沙箱策略，外部智能体执行已拒绝"
+    if sandbox_error:
+        res = {"ok": False, "text": "", "json": None, "cost_usd": 0.0,
+               "tokens": 0, "usage": None, "error": sandbox_error,
+               "raw": {"exit_code": None, "sandbox_blocked": True},
+               "kind": agent.get("kind", "generic"), "model": agent.get("model")}
+        _finish_step_result(run_id, step, res, role, agent, start)
+        return res
     if dead_binding:
         from .error_codes import ErrorCode
         res = {"ok": False, "text": "", "json": None, "cost_usd": 0.0,
@@ -492,11 +518,47 @@ def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner
         if directive_block:
             prompt = directive_block + "\n\n---\n\n" + prompt
         effective_prompt = (guard["reminder"] + "\n\n---\n\n" + prompt) if guard["reminder"] else prompt
+        git_checkpoint = None
+        try:
+            git_checkpoint = checkpoints.begin_git_step(run_id, workdir)
+        except Exception:
+            git_checkpoint = {"ok": False, "error": "文件检查点准备失败，外部智能体未启动"}
+        if not git_checkpoint.get("ok"):
+            res = {"ok": False, "text": "", "json": None, "cost_usd": 0.0,
+                   "tokens": 0, "usage": None,
+                   "error": git_checkpoint.get("error") or "文件检查点准备失败",
+                   "raw": {"exit_code": None, "checkpoint_blocked": True},
+                   "kind": agent.get("kind", "generic"), "model": agent.get("model")}
+            _finish_step_result(run_id, step, res, role, agent, start)
+            return res
         res = _spawn_step(session_run_id=run_id, role=role, agent=agent,
                           prompt=effective_prompt, workdir=workdir, readonly=readonly,
                           ev=ev, timeout=timeout, resume=resume, step=step,
                           log_abs=log_abs, images=images, require_tools=require_tools,
                           deadline=deadline)
+        checkpoint_warning = git_checkpoint.get("warning", "")
+        if git_checkpoint.get("supported"):
+            try:
+                finished_checkpoint = checkpoints.finish_git_step(
+                    run_id, workdir, git_checkpoint.get("head"),
+                    git_checkpoint.get("before_paths") or [])
+                checkpoint_warning = finished_checkpoint.get("warning") or ""
+                if not finished_checkpoint.get("ok"):
+                    checkpoint_warning = finished_checkpoint.get("warning") or "外部智能体文件快照未能完整记录"
+            except Exception:
+                checkpoint_warning = "外部智能体文件快照记录失败；本步骤改动可能无法恢复"
+        if checkpoint_warning:
+            res["checkpoint_warning"] = checkpoint_warning
+            if res.get("ok"):
+                res["text"] = (res.get("text") or "") + "\n\n（检查点范围提示：%s）" % checkpoint_warning
+            elif res.get("error"):
+                res["error"] = res["error"] + "；" + checkpoint_warning
+            if log_abs:
+                try:
+                    with log_abs.open("a", encoding="utf-8") as handle:
+                        handle.write("\n[检查点] %s\n" % checkpoint_warning)
+                except OSError:
+                    pass
     # 先收尾再查取消：取消时进程已被 run_process 杀停，若先抛 Cancelled，
     # 步骤记录会永远停在「运行中」变僵尸（与 _run_verify 的顺序对齐）
     _finish_step_result(run_id, step, res, role, agent, start)
@@ -508,6 +570,45 @@ def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner
     return res
 
 
+def _external_sandbox_block_reason(agent, workdir, sandbox):
+    """Reject task policies that this CLI launcher cannot enforce.
+
+    Codex is currently the only supported external runner with an OS-backed
+    workspace write sandbox. Other CLI integrations run with their natural
+    permission set (workdir read/write, network allowed): they are rejected
+    only when the task policy is *narrower* than that — fail closed for
+    narrowed policies, not for defaults（实案：create_task 改为强制落默认
+    策略后，本闸把 89—96 批的连载起草整批拒成「没有经验证的 OS 文件隔
+    离」；默认策略与外部 CLI 的天然权限一致，不属于收窄）.
+    """
+    if (agent or {}).get("mode") == "mock":
+        return ""
+    from . import policy
+    root = os.path.realpath(workdir or ".")
+    normalized = policy.normalize_sandbox(sandbox, root)
+    if (agent or {}).get("kind") == "codex":
+        if normalized.get("network") is False:
+            return "沙箱拒绝：该 CLI 后端未接入网络隔离，拒绝运行网络受限任务"
+        if [os.path.realpath(x) for x in normalized.get("allowed_roots") or []] != [root]:
+            return "沙箱拒绝：该 CLI 后端未接入允许目录隔离，拒绝运行目录受限任务"
+        if normalized.get("disabled_tools"):
+            return "权限拒绝：该 CLI 后端无法执行 CodeBee 工具禁用策略，拒绝运行"
+        if normalized.get("env_allowlist"):
+            return "沙箱拒绝：该 CLI 后端未接入环境变量白名单，拒绝运行受限任务"
+        return ""
+    # 非 codex 外部 CLI：默认策略放行，收窄策略拒绝
+    if normalized.get("network") is False:
+        return "沙箱拒绝：该任务要求禁网，外部 CLI 无法执行网络受限任务"
+    if normalized.get("disabled_tools"):
+        return "权限拒绝：该任务带工具禁用策略，外部 CLI 无法执行"
+    if normalized.get("env_allowlist"):
+        return "沙箱拒绝：该任务带环境变量白名单，外部 CLI 无法执行受限任务"
+    roots = [os.path.realpath(x) for x in normalized.get("allowed_roots") or []]
+    if roots and root not in roots:
+        return "沙箱拒绝：该任务目录白名单不含工作目录，外部 CLI 无法保证隔离范围"
+    return ""
+
+
 def _create_task_from_builtin(payload):
     """Create and enqueue a task requested by the direct conversation tool."""
     task = store.create_task(payload)
@@ -587,7 +688,8 @@ def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=Non
                             deadline=deadline, cancel_event=ev, log=_log, images=images,
                             on_reason=_on_reason, on_stream=_on_stream,
                             on_activity=_on_activity,
-                            task_creator=_create_task_from_builtin)
+                            task_creator=_create_task_from_builtin,
+                            sandbox=task.get("sandbox"), checkpoint_run_id=run_id)
     if followups and res.get("ok"):
         clean, fups = _parse_followups(res.get("text") or "")
         if fups:
@@ -1461,6 +1563,28 @@ def _run_code(run, task, agents, ev, stats, mode):
     if project_memory:
         task = dict(task, context=(task.get("context") or "") + "\n\n" + project_memory)
 
+    # 断点简报（B）：重试继承上一遍失败/中断 run 的现场，注入规划器与实现者
+    # 共用的 __CONTEXT__——「走到哪、改了什么、还剩什么」不再从零重建上下文。
+    _handoff = run.get("handoff") or {}
+    _brief = _handoff_brief(_handoff)
+    if _brief:
+        task = dict(task, context=(task.get("context") or "") + "\n\n" + _brief)
+    # 断点会话（A）：上一遍实现者的 CLI 会话 id，implement_all 里按人复用。
+    _inh_session = run.get("inherit_session") or {}
+
+    def _keep_sid(agent_row, agent_b, r):
+        """记录最后一次实现的会话 id：run 内 fix 轮复用 + 落盘 run 供重试跨 run 续会话。"""
+        sid = _resume_sid(agent_b, r.get("sid"))
+        if sid:
+            impl_sid[0] = sid
+            try:
+                store.update_run(run_id, impl_session={
+                    "agent": agent_row.get("id"), "session": sid,
+                    "workdir": workdir})
+            except Exception:
+                pass
+        return sid
+
     # ---- 规划。低风险短任务直接把目标作为单步计划，省掉一次独立模型调用；
     # 附件或较长的用户背景仍先规划，避免快速路径漏读约束。
     fast_path = (mode == "fast" or
@@ -1526,11 +1650,20 @@ def _run_code(run, task, agents, ev, stats, mode):
 
     def implement_all(impl_agent, prefix_note):
         nonlocal reviewer
-        # 会话延续只对原实现者有效；换将后新智能体没有该会话，必须丢弃
+        # 会话延续只对原实现者有效；换将后新智能体没有该会话，必须丢弃。
+        # 优先级：任务级 resume（用户显式指定）> 断点继承会话（A：跨 run 续跑，
+        # 仅同一实现者 + 同一工作目录 + 该 CLI 支持续会话时复用）
+        inh_sid = ""
+        if (not resume_ctx and _inh_session.get("session")
+                and _inh_session.get("agent") == impl_agent["id"]
+                and _same_workdir(_inh_session.get("workdir") or "", workdir)
+                and _resume_sid(impl_agent, _inh_session.get("session"))):
+            inh_sid = _inh_session["session"]
         use_resume = (resume_ctx["session"]
-                      if (resume_ctx and impl_agent["id"] == resume_ctx["agent"]["id"]) else None)
+                      if (resume_ctx and impl_agent["id"] == resume_ctx["agent"]["id"])
+                      else (inh_sid or None))
         # 续会话时 CLI 要在会话所属项目目录下启动，否则定位不到会话
-        step_wd = _resume_workdir(resume_ctx, workdir) if use_resume else workdir
+        step_wd = _resume_workdir(resume_ctx, workdir) if (resume_ctx and use_resume) else workdir
 
         def _run_one(agt):
             """用指定智能体跑全部子任务；返回 (ok, 最后一次 res)。"""
@@ -1576,10 +1709,20 @@ def _run_code(run, task, agents, ev, stats, mode):
                                 note=prefix_note if i == 0 else "",
                                 resume=use_resume, images=att_imgs,
                                 require_tools=True, swap_guard=swap_guard)
-                # §07 T1.1：记录最后一次实现的会话 id，fix 轮复用（会话内前缀走缓存读计价）
-                new_sid = _resume_sid(agt_b, res.get("sid"))
-                if new_sid:
-                    impl_sid[0] = new_sid
+                _keep_sid(agt, agt_b, res)
+                # 断点继承会话失效兜底（A）：会话可能已被 CLI 清理或跨机不可续。
+                # 认证/配额类死因换会话也没用，不重试；其余丢弃继承会话原样重跑一次。
+                if (not res["ok"] and inh_sid and i == 0 and use_resume == inh_sid
+                        and not (res.get("raw") or {}).get("cancelled")
+                        and not runner._auth_error(res.get("error") or "")
+                        and not runner._quota_error(res.get("error") or "")):
+                    res = _run_step(run_id, role, agt_b, prompt, step_wd,
+                                    readonly=False, ev=ev,
+                                    note=((prefix_note + "；") if prefix_note else "")
+                                    + "继承会话续跑失败，已丢弃旧会话全新执行",
+                                    resume=None, images=att_imgs,
+                                    require_tools=True, swap_guard=swap_guard)
+                    _keep_sid(agt, agt_b, res)
                 if agt.get("mode") == "mock" and res["ok"]:
                     try:
                         mock_path = os.path.abspath(os.path.join(workdir, "mock-impl.txt"))
@@ -1606,10 +1749,11 @@ def _run_code(run, task, agents, ev, stats, mode):
                              error=auth_err, ended_at=_now())
             return False
         # 单路实现失败：Best-of-N 赛马兜底（借鉴 orca worktree 择优）——多路并行
-        # 各自 worktree 隔离实现+验证，胜者 diff 回主工作区；失败回落走换将
+        # 各自 worktree 隔离实现+验证，胜者 diff 回主工作区；失败回落走换将。
+        # 会话延续在场时跳过（N 路共用同一 CLI 会话会互相践踏，与连载同理）
         if (mode == "auto" and impl_agent.get("mode") == "real"
                 and max(1, min(3, int(task.get("best_of") or 1))) >= 2
-                and resume_ctx is None
+                and resume_ctx is None and not inh_sid
                 and _code_bestof(run, task, impl_agent, difficulty, ev)):
             return True
         # 实现步失败不立刻判死：2026-09-16 实测配额烧干时 5 连跑全在同一条 CLI 上
@@ -1756,6 +1900,7 @@ def _run_code(run, task, agents, ev, stats, mode):
                             note="自动修复第 %d 轮" % round_no,
                             resume=resume_ctx["session"] if resume_ctx else impl_sid[0],
                             require_tools=True)
+            _keep_sid(impl, modelhub.bind_agent(impl, difficulty), res)
             if (res.get("raw") or {}).get("timed_out"):
                 # 自动修复没有换将/重试兜底；超时后继续验收会把未完成的修复
                 # 当作正常轮次，让 run 继续显示 running，最终还可能误标 done。
@@ -1873,7 +2018,7 @@ def _run_code(run, task, agents, ev, stats, mode):
         _mem_lines = ["改动文件：%s" % (_touched_str or "（无 diff）"),
                       "验收：%s" % ("通过" if verify_pass else "未通过"),
                       "修复轮数：%d" % (len(repairs) - 1)]
-        _write_project_memory(task, workdir, _mem_lines)
+        _write_project_memory(task, workdir, _mem_lines, source_run=run_id)
     except Exception:
         pass
     # Stop gate（planning-with-files）：收工时活计划若有未勾选项，摘要与 verdict
@@ -4913,6 +5058,14 @@ def _run_content_review(run, task, agents, ev, stats, mode):
             pass
     else:
         is_research = task.get("type") == "research"
+        # 经验库/知识库注入（review 引擎 13 类型补全，serial 起草同款）：
+        # learn_async 面向全部 run 收割，此前注入只在连载链——「全类型收割、
+        # 单链注入」闭环半开。在 _draft_prompt_for 外取一次（bestof 多稿件
+        # 共用一份，命中计数不重复累加）；stable_order 保前缀缓存，预算纪律
+        # 由块内自带（skills 包区限额+教训保底 / knowledge 装箱截断）。
+        sk_lessons, _ = skills.block_for(task, stable_order=True, run_id=run_id)
+        kb_block = knowledge.block_for(task)
+        ctx_block = "\n\n".join(p for p in (sk_lessons, kb_block) if p)
 
         def _draft_prompt_for(vfile):
             p = (_tpl(task, "draft_prompt", NOVEL_DRAFT_PROMPT).replace("__FILE__", vfile)
@@ -4946,6 +5099,9 @@ def _run_content_review(run, task, agents, ev, stats, mode):
                 gl = _gitlog_brief(workdir)
                 if gl:
                     p += ("\n\n## 本周提交素材（git log，如实取材，缺失勿虚构）\n" + gl)
+            if ctx_block:
+                # 空块不追加：零命中零噪音（空库时 prompt 与旧版字节一致）
+                p += "\n\n" + ctx_block
             p += _content_contract(task)
             return p
 
@@ -5006,6 +5162,16 @@ def _run_content_review(run, task, agents, ev, stats, mode):
             .replace("__MANUSCRIPT__", manuscript or "（稿件为空！）"))
         if task.get("context"):
             crit_prompt += "\n\n## 原始任务背景与附件参考\n" + task["context"]
+        # 经验库/知识库注入（serial 逐章评审同款；「## 待评审稿件」锚点由
+        # _ensure_critique_placeholders 保证存在），按证据强度随评审下发
+        sk, _ = skills.block_for(task, stable_order=True, run_id=run_id)
+        if sk:
+            crit_prompt = crit_prompt.replace(
+                "## 待评审稿件", "%s\n\n## 待评审稿件" % sk, 1)
+        kb = knowledge.block_for(task)
+        if kb:
+            crit_prompt = crit_prompt.replace(
+                "## 待评审稿件", "%s\n\n## 待评审稿件" % kb, 1)
         # AI 味确定性检测（借鉴 oh-story 去AI味）：客观参考线随评审下发，
         # 命中才追加——评审官结合上下文判断是否真问题，脚本不直接扣分
         crit_prompt = aiflavor.inject_into_prompt(crit_prompt, manuscript, task.get("type"))
@@ -5201,41 +5367,26 @@ def _read_constitution(workdir):
             "与其他要求冲突时以宪章为准）\n\n" + txt + "\n\n")
 
 
-def _write_project_memory(task, workdir, lines):
-    """项目记忆持久化（借鉴 agentmemory）：代码任务成功后把架构事实追加到
-    .codebee/project-memory.md——同目录后续 code 任务规划前自动注入，
-    让编排者「知道这个代码库的脾气」而非每次从零摸索。失败静默。"""
+def _write_project_memory(task, workdir, lines, source_run=""):
+    """Persist proposed project facts; they are not injected before approval."""
     if not lines:
         return ""
     try:
-        pm = os.path.join(workdir, ".codebee", "project-memory.md")
-        os.makedirs(os.path.dirname(pm), exist_ok=True)
-        header_needed = not os.path.isfile(pm)
-        with open(pm, "a", encoding="utf-8") as f:
-            if header_needed:
-                f.write("# 项目记忆（每次代码任务完成后自动追加，供后续任务参考）\n\n")
-            f.write("### %s · %s\n" % (task.get("title") or "", _now()))
-            for ln in lines:
-                f.write("- %s\n" % str(ln)[:300])
-            f.write("\n")
-        return pm
+        from . import project_memory
+        row = project_memory.propose(workdir, source_run=source_run,
+                                     title=task.get("title") or "", facts=lines)
+        return str(project_memory._file(workdir)) if row else ""
     except Exception:
         return ""
 
 
 def _read_project_memory(workdir, cap=4000):
-    """读取项目记忆供规划提示词注入。超出上限截断到最新条目。"""
-    p = os.path.join(workdir or "", ".codebee", "project-memory.md")
-    if not _inside(workdir, p) or not os.path.isfile(p):
-        return ""
+    """Only inject approved, unexpired and fingerprint-verified memory."""
     try:
-        txt = _read_text_any_enc(p)[:cap].strip()
-    except OSError:
-        return ""
-    if not txt:
+        from . import project_memory
+        return project_memory.active_text(workdir, cap=cap)
+    except (OSError, ValueError, TypeError):
         return ""
-    return ("## 项目记忆（此前代码任务在此工作目录留下的架构事实，"
-            "规划时优先参考）\n\n" + txt + "\n\n")
 
 
 def _write_task_spec(task, workdir):
@@ -5366,10 +5517,24 @@ def _write_task_plan(task, workdir, plan):
         if root not in target.parents:
             return ""
         target.parent.mkdir(parents=True, exist_ok=True)
+        # 断点续跑（B）：旧计划已勾选 [x] 的项按标题继承到新计划——重试重新
+        # 规划不再抹掉已完成进度（继承发生在写盘前，mark_task_plan 的行号
+        # 约定基于新文件，安全）；[!]/[>] 不继承，重跑自然重置。
+        prev_done = {}
+        try:
+            if target.is_file():
+                _pat = re.compile(r"^\d+\. \[([ x!>])\] (.+)$")
+                for _ln in target.read_text("utf-8").splitlines():
+                    _m = _pat.match(_ln)
+                    if _m and _m.group(1) == "x":
+                        prev_done.setdefault(_m.group(2).strip(), True)
+        except Exception:
+            prev_done = {}
         lines = ["# 任务计划", "", "来源：%s" % (plan or {}).get("source", "?"), ""]
         # checkbox 形态：mark_task_plan 按行号翻 [x]/[!]/[>]，断点一眼可见
         for i, s in enumerate((plan or {}).get("steps") or [], 1):
-            lines.append("%d. [ ] %s" % (i, str(s.get("detail") or s.get("title") or "")[:200]))
+            _t = str(s.get("detail") or s.get("title") or "")[:200]
+            lines.append("%d. [%s] %s" % (i, "x" if prev_done.get(_t.strip()) else " ", _t))
         target.write_text("\n".join(lines) + "\n", encoding="utf-8")
         return str(target)
     except Exception:
@@ -5433,6 +5598,79 @@ def mark_task_plan(workdir, index, status):
         return False
 
 
+def _same_workdir(a, b):
+    """路径同位判断（Windows 大小写/斜杠不敏感）；任一为空即不同。"""
+    try:
+        na = os.path.normcase(os.path.abspath(a or ""))
+        nb = os.path.normcase(os.path.abspath(b or ""))
+        return bool(na) and bool(nb) and na == nb
+    except Exception:
+        return False
+
+
+def _assemble_handoff(task, run):
+    """断点简报组装（B）：终态 run 的「走到哪/改了什么/还剩什么」快照。
+    存进 run 记录供 retry_task 继承；组装失败返回近空 dict，绝不挡收尾。"""
+    steps = run.get("steps") or []
+    done_steps = [{"role": s.get("role") or "", "summary": (s.get("summary") or "")[:120]}
+                  for s in steps if (s.get("status") or "") == "done"][-8:]
+    pending = ""
+    for s in steps:
+        if (s.get("status") or "") != "done":
+            pending = "%s%s" % (s.get("role") or "?",
+                                ("（%s）" % s["summary"][:100]) if s.get("summary") else "")
+            break
+    try:
+        _total, _left = plan_stopgate(task.get("workdir") or "")
+    except Exception:
+        _total, _left = 0, []
+    ch = run.get("changes")
+    if not ch:
+        try:
+            from . import gitmod
+            ch = gitmod.collect_changes(task.get("workdir") or "")
+        except Exception:
+            ch = {}
+    files = [f.get("path") for f in ((ch or {}).get("files") or []) if f.get("path")][:25]
+    return {
+        "status": run.get("status") or "",
+        "error": (run.get("error") or "")[:240],
+        "ended_at": run.get("ended_at") or "",
+        "done_steps": done_steps,
+        "pending": pending,
+        "plan_total": _total,
+        "plan_left": [[n, m, t] for n, m, t in (_left or [])][:6],
+        "changed_files": files,
+    }
+
+
+def _handoff_brief(h):
+    """断点简报 → 注入 __CONTEXT__ 的人话块；无实质内容返回空串（零噪音）。"""
+    if not isinstance(h, dict) or not (h.get("done_steps") or h.get("pending")
+                                       or h.get("plan_left") or h.get("changed_files")):
+        return ""
+    rows = ["## 断点简报（上次运行中断现场，系统注入）",
+            "上次运行以「%s」终止%s。工作目录/任务分支保留着上次已完成的部分改动。"
+            "先核对现场再继续：已完成的修复不要推翻重做，从中断处接着完成目标。"
+            % (h.get("status") or "?",
+               ("（原因：%s）" % h["error"]) if h.get("error") else "")]
+    done = h.get("done_steps") or []
+    if done:
+        rows.append("- 已完成步骤：" + "；".join(
+            ("%s：%s" % (s.get("role") or "?", s["summary"])) if s.get("summary")
+            else (s.get("role") or "?") for s in done))
+    if h.get("pending"):
+        rows.append("- 中断位置：%s" % h["pending"])
+    left = h.get("plan_left") or []
+    if left:
+        rows.append("- 活计划未完成项：" + "、".join(
+            "#%s[%s]%s" % (n, m, t) for n, m, t in left))
+    files = h.get("changed_files") or []
+    if files:
+        rows.append("- 上次已改动的文件：" + "、".join(str(f) for f in files))
+    return "\n".join(rows)
+
+
 def _workdir_blocker(task, run_id):
     """同工作目录互斥：返回占用该目录的任务（无则 None）。
     任务计划/项目记忆/任务分支检出都是工作目录级共享状态，并行会互相覆盖
@@ -5732,6 +5970,17 @@ def execute_run(run_id):
                                                   "restore_error": repr(e)[:200]})
                 except Exception:
                     pass
+        # 断点简报（B）：失败/取消/超时的代码 run 组装「走到哪/改了什么/还剩什么」，
+        # 供 retry_task 继承注入新 run——重试从断点继续，不从零烧 token。
+        # done 不组装：主动重跑语义就是重来。放在 git 收尾后，changes 是最新的。
+        try:
+            if (task.get("engine")
+                    or ("code" if task.get("type") == "code" else "review")) == "code":
+                _fin = store.get_run(run_id) or {}
+                if _fin.get("status") in ("failed", "cancelled", "timeout"):
+                    store.update_run(run_id, handoff=_assemble_handoff(task, _fin))
+        except Exception:
+            pass
         # 自学习闭环：运行结束自动把本次评审暴露的问题沉淀为可复用教训（异步，不阻塞）
         try:
             if store.get_run(run_id):

package/app/core/policy.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-"""Descriptive sandbox policy primitives shared by API and runners."""
+"""Execution policy primitives shared by tools and runners."""
 from __future__ import annotations
 
 import os
@@ -10,14 +10,24 @@ def normalize_sandbox(spec=None, workdir=None):
     spec = spec if isinstance(spec, dict) else {}
     root = Path(workdir or os.getcwd()).expanduser().resolve()
     roots = []
-    for value in spec.get("allowed_roots") or [str(root)]:
+    requested_roots = spec.get("allowed_roots")
+    if requested_roots is not None and not isinstance(requested_roots, (list, tuple)):
+        raise ValueError("allowed_roots 必须是路径列表")
+    explicit_roots = bool(requested_roots)
+    for value in requested_roots or [str(root)]:
         try:
             candidate = Path(value).expanduser().resolve()
         except (TypeError, OSError, ValueError):
             continue
+        # The task payload is not an authority to grant host filesystem access.
+        # Sandbox roots may narrow the selected workspace, never widen it.
+        if candidate != root and root not in candidate.parents:
+            continue
         if candidate not in roots:
             roots.append(candidate)
     if not roots:
+        if explicit_roots:
+            raise ValueError("allowed_roots 没有工作目录内的有效路径")
         roots = [root]
     env = []
     for value in spec.get("env_allowlist") or []:
@@ -32,9 +42,31 @@ def normalize_sandbox(spec=None, workdir=None):
         output = max(1024, min(100 * 1024 * 1024, int(spec.get("max_output_bytes") or 10 * 1024 * 1024)))
     except (TypeError, ValueError):
         output = 10 * 1024 * 1024
+    network_value = spec.get("network", True)
+    if isinstance(network_value, bool):
+        network = network_value
+    elif isinstance(network_value, str) and network_value.strip().lower() in ("true", "false"):
+        network = network_value.strip().lower() == "true"
+    else:
+        # Invalid policy input must never silently widen network access.
+        network = False
     return {"allowed_roots": [str(x) for x in roots], "env_allowlist": env,
-            "network": bool(spec.get("network", True)), "timeout_s": timeout,
-            "max_output_bytes": output}
+            "network": network, "timeout_s": timeout,
+            "max_output_bytes": output,
+            "disabled_tools": normalize_disabled_tools(spec.get("disabled_tools"))}
+
+
+def normalize_disabled_tools(items):
+    if not isinstance(items, (list, tuple, set)):
+        return []
+    out = []
+    for value in items:
+        name = str(value or "").strip()[:120]
+        if name and name not in out:
+            out.append(name)
+        if len(out) >= 200:
+            break
+    return out
 
 
 def path_allowed(path, sandbox):