codebee 0.1.99 → 0.1.100

package/app/core/command_auth.py

@@ -0,0 +1,302 @@
+# -*- coding: utf-8 -*-
+"""Command execution policy with live approval requests and redacted audit."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import threading
+import time
+import uuid
+from pathlib import Path
+
+from .redact import scrub_text
+
+_LOCK = threading.RLock()
+_FILE = None
+_PENDING = {}
+_WAIT_SECONDS = 300
+_MAX_AUDIT = 500
+_MODES = {"legacy", "restricted"}
+_SCOPES = {"once", "run", "project", "global"}
+_MATCHES = {"exact", "prefix", "any"}
+_SHELL_META = re.compile(r"[;&|<>`$\r\n]")
+
+
+def init(data_dir=None):
+    global _FILE, _PENDING
+    with _LOCK:
+        if data_dir is None:
+            from . import paths
+            base = paths.DATA_DIR
+        else:
+            base = Path(data_dir)
+        base.mkdir(parents=True, exist_ok=True)
+        _FILE = base / "command-permissions.json"
+        _PENDING = {}
+
+
+def _file():
+    global _FILE
+    if _FILE is None:
+        init()
+    return _FILE
+
+
+def _default_state():
+    return {"mode": "legacy", "rules": [], "audit": []}
+
+
+def _load():
+    path = _file()
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return _default_state()
+    except (OSError, ValueError):
+        return {"mode": "restricted", "rules": [], "audit": []}
+    if not isinstance(data, dict) or data.get("mode") not in _MODES:
+        return {"mode": "restricted", "rules": [], "audit": []}
+    return {"mode": data["mode"],
+            "rules": data.get("rules") if isinstance(data.get("rules"), list) else [],
+            "audit": data.get("audit") if isinstance(data.get("audit"), list) else []}
+
+
+def _persist(state):
+    path = _file()
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(json.dumps(state, ensure_ascii=False, indent=2), encoding="utf-8")
+    try:
+        os.chmod(str(tmp), 0o600)
+    except OSError:
+        pass
+    os.replace(str(tmp), str(path))
+
+
+def _hash(value):
+    return hashlib.sha256(str(value or "").encode("utf-8")).hexdigest()
+
+
+def _path_key(workdir):
+    if not workdir:
+        return ""
+    return _hash(os.path.normcase(os.path.realpath(os.path.expanduser(str(workdir)))))
+
+
+def _scope_key(scope, run_id, workdir):
+    if scope == "global":
+        return "*"
+    if scope == "run":
+        return str(run_id or "")
+    if scope == "project":
+        return _path_key(workdir)
+    return ""
+
+
+def _prefix_tokens(value):
+    return tuple(str(value or "").strip().split())
+
+
+def _rule_matches(rule, command, run_id, workdir):
+    scope = rule.get("scope")
+    if scope not in ("run", "project", "global"):
+        return False
+    if _scope_key(scope, run_id, workdir) != rule.get("scope_key"):
+        return False
+    match = rule.get("match")
+    if match == "any":
+        return True
+    if match == "exact":
+        return _hash(command) == rule.get("command_hash")
+    if match == "prefix":
+        if _SHELL_META.search(command):
+            return False
+        tokens = _prefix_tokens(command)
+        prefix_hashes = rule.get("prefix_hashes") or []
+        return (bool(prefix_hashes) and len(tokens) >= len(prefix_hashes) and
+                [_hash(x) for x in tokens[:len(prefix_hashes)]] == prefix_hashes)
+    return False
+
+
+def _audit(state, action, command, request_id="", scope="", match=""):
+    entry = {"id": request_id or uuid.uuid4().hex[:16], "action": action,
+             "command": scrub_text(command, limit=240), "command_sha256": _hash(command),
+             "scope": scope or "", "match": match or "", "at": time.time()}
+    state["audit"] = (state.get("audit") or [])[-(_MAX_AUDIT - 1):] + [entry]
+
+
+def _bump_state():
+    try:
+        from . import store
+        store.bump_state()
+    except Exception:
+        pass
+
+
+def mode():
+    with _LOCK:
+        return _load()["mode"]
+
+
+def set_mode(value):
+    if value not in _MODES:
+        raise ValueError("mode 必须是 legacy/restricted")
+    with _LOCK:
+        state = _load()
+        changed = state["mode"] != value
+        state["mode"] = value
+        _persist(state)
+        if changed:
+            for request in _PENDING.values():
+                request["decision"] = {"allowed": False, "reason": "policy_changed"}
+                request["event"].set()
+    if changed:
+        _bump_state()
+    return value
+
+
+def _make_rule(command, scope, match, run_id, workdir, prefix=None):
+    if scope not in ("run", "project", "global"):
+        raise ValueError("持久规则 scope 必须是 run/project/global")
+    if match not in _MATCHES:
+        raise ValueError("match 必须是 exact/prefix/any")
+    if scope == "run" and not run_id:
+        raise ValueError("当前运行授权缺少 run_id")
+    if scope == "project" and not workdir:
+        raise ValueError("项目授权缺少工作目录")
+    rule = {"id": uuid.uuid4().hex[:16], "scope": scope,
+            "scope_key": _scope_key(scope, run_id, workdir), "match": match,
+            "command_preview": scrub_text(command if match != "any" else "*", 180),
+            "created_at": time.time()}
+    if match == "exact":
+        rule["command_hash"] = _hash(command)
+    elif match == "prefix":
+        raw_prefix = str(prefix or command or "").strip()
+        if not raw_prefix or _SHELL_META.search(raw_prefix) or _SHELL_META.search(command):
+            raise ValueError("前缀授权只支持不含 shell 控制符的单条命令")
+        tokens = _prefix_tokens(raw_prefix)
+        if not tokens or len(tokens) > len(_prefix_tokens(command)):
+            raise ValueError("授权前缀必须是本次请求命令的前缀")
+        if _prefix_tokens(command)[:len(tokens)] != tokens:
+            raise ValueError("授权前缀必须与本次请求命令开头一致")
+        rule["prefix_hashes"] = [_hash(token) for token in tokens]
+        rule["command_preview"] = scrub_text(raw_prefix, 180)
+    return rule
+
+
+def authorize(command, *, run_id="", workdir="", timeout_s=None,
+              deadline=None, cancel_event=None, source="run_command"):
+    command = str(command or "").strip()
+    if not command:
+        return {"allowed": False, "reason": "empty_command"}
+    with _LOCK:
+        state = _load()
+        if state["mode"] == "legacy":
+            return {"allowed": True, "reason": "legacy"}
+        matched = next((rule for rule in reversed(state["rules"])
+                       if _rule_matches(rule, command, run_id, workdir)), None)
+        if matched:
+            _audit(state, "allowed_by_rule", command,
+                   scope=matched.get("scope"), match=matched.get("match"))
+            _persist(state)
+            return {"allowed": True, "reason": "rule", "rule_id": matched.get("id")}
+        wait_s = _WAIT_SECONDS if timeout_s is None else max(0.0, float(timeout_s))
+        if deadline is not None:
+            wait_s = min(wait_s, max(0.0, float(deadline) - time.monotonic()))
+        if wait_s <= 0 or (cancel_event is not None and cancel_event.is_set()):
+            reason = "cancelled" if cancel_event is not None and cancel_event.is_set() else "timeout"
+            _audit(state, reason, command)
+            _persist(state)
+            return {"allowed": False, "reason": reason}
+        request_id = uuid.uuid4().hex[:16]
+        request = {"id": request_id, "command": command, "run_id": str(run_id or ""),
+                   "workdir": str(workdir or ""), "source": str(source or "")[:40],
+                   "created_at": time.time(), "event": threading.Event(), "decision": None}
+        _PENDING[request_id] = request
+        _audit(state, "requested", command, request_id=request_id)
+        _persist(state)
+    _bump_state()
+    expires = time.monotonic() + wait_s
+    decision = None
+    while time.monotonic() < expires:
+        if cancel_event is not None and cancel_event.is_set():
+            decision = {"allowed": False, "reason": "cancelled"}
+            break
+        if request["event"].wait(min(0.2, max(0.0, expires - time.monotonic()))):
+            decision = request.get("decision")
+            break
+    if decision is None:
+        decision = {"allowed": False, "reason": "timeout"}
+    with _LOCK:
+        _PENDING.pop(request_id, None)
+        state = _load()
+        _audit(state, decision.get("reason") or "denied", command,
+               request_id=request_id, scope=decision.get("scope", ""),
+               match=decision.get("match", ""))
+        _persist(state)
+    _bump_state()
+    return decision
+
+
+def pending_requests():
+    with _LOCK:
+        rows = []
+        for request in _PENDING.values():
+            rows.append({"id": request["id"], "command": scrub_text(request["command"], 500),
+                         "run_id": request["run_id"], "source": request["source"],
+                         "created_at": request["created_at"]})
+        return sorted(rows, key=lambda row: row["created_at"])
+
+
+def decide(request_id, *, approve, scope="once", match="exact", prefix=None):
+    if not isinstance(approve, bool):
+        raise ValueError("approve 必須是布尔值")
+    with _LOCK:
+        request = _PENDING.get(str(request_id or ""))
+        if request is None:
+            raise KeyError("命令授权请求不存在或已结束")
+        state = _load()
+        if approve:
+            if scope not in _SCOPES:
+                raise ValueError("scope 必须是 once/run/project/global")
+            if scope == "once":
+                rule = None
+            else:
+                rule = _make_rule(request["command"], scope, match,
+                                  request["run_id"], request["workdir"], prefix=prefix)
+                state["rules"].append(rule)
+            request["decision"] = {"allowed": True, "reason": "approved",
+                                   "rule_id": rule.get("id") if rule else "",
+                                   "scope": scope, "match": match}
+            _audit(state, "approved", request["command"], request_id=request["id"],
+                   scope=scope, match=match)
+        else:
+            request["decision"] = {"allowed": False, "reason": "denied"}
+            _audit(state, "denied_by_user", request["command"],
+                   request_id=request["id"])
+        _persist(state)
+        request["event"].set()
+    _bump_state()
+    return {"ok": True}
+
+
+def revoke(rule_id):
+    with _LOCK:
+        state = _load()
+        remaining = [rule for rule in state["rules"] if rule.get("id") != str(rule_id or "")]
+        if len(remaining) == len(state["rules"]):
+            raise KeyError("授权规则不存在")
+        state["rules"] = remaining
+        _audit(state, "revoked", "", request_id=str(rule_id or ""))
+        _persist(state)
+    _bump_state()
+    return True
+
+
+def view():
+    with _LOCK:
+        state = _load()
+        return {"mode": state["mode"], "rules": [dict(rule) for rule in state["rules"]],
+                "pending": pending_requests(),
+                "audit": [dict(row) for row in state["audit"][-100:]]}

package/app/core/gitmod.py

@@ -29,8 +29,12 @@ def valid_rev(rev):
 
 
 def _git(workdir, *args, timeout=20):
-    r = runner.run_process(argv=["git", *args], cwd=str(workdir), timeout=timeout)
-    return r
+    # fetch/pull/push 走 HTTPS 远端与安装链同根因：GitHub 的 HTTP/2 常被中间
+    # 设备掐断（"Error in the HTTP2 framing layer"），统一强制 HTTP/1.1；
+    # 本地命令不受该配置影响。延迟 import 防 L2 层内环。
+    from . import manager
+    return runner.run_process(argv=["git", *args], cwd=str(workdir), timeout=timeout,
+                              env=manager.git_http11_env())
 
 
 def _gh(workdir, *args, timeout=60):

package/app/core/jobs.py

@@ -56,6 +56,8 @@ AI_REPAIR_PROMPT = """你是环境工程师。在 __OS__ 上执行下面的安
 硬性约束：command 只能是本机包管理器的安装命令，前缀必须是 __ALLOW__ 之一，且不要带 sudo
 （命令非交互执行，sudo 会挂死；brew/npm 本身也拒绝 sudo）。
 给不出符合约束的安全命令时，safe 设为 false 且 command 留空。
+优先沿用失败命令的包管理器与安装形态（如原命令是 uv tool install 就继续用 uv，
+不要另起 pip 换安装面）；git 拉取类的网络抖动直接给原命令即可，传输层兜底由执行方处理。
 
 ## 失败的命令
 __CMD__
@@ -1180,8 +1182,7 @@ def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
                           summary="AI 建议命令未过白名单，需人工执行：%s（诊断：%s）" % (cmd, diagnosis))
         return False
     from . import paths
-    fix = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT), timeout=1800,
-                             cancel_event=ev, log_path=str(log_abs))
+    fix = manager.run_install_cmd(cmd, cancel_event=ev, log_path=str(log_abs))
     manager.detect_all(force=True)
     with manager._LOCK:
         manager._STATE["versions"].pop(entry["id"], None)

package/app/core/manager.py

@@ -2019,6 +2019,64 @@ def _cmd_head_is_uv(cmd):
     return os.path.basename(stripped.split()[0]).lower() in ("uv", "uv.exe")
 
 
+# pip/uv 的 git+ 直装要从 GitHub 拉源码，国内链路对 GitHub 的 HTTP/2 常被中间设备
+# 掐断（git 报 "Error in the HTTP2 framing layer"，exit 128）——强制 HTTP/1.1 是
+# 标准绕法。用 GIT_CONFIG_* 环境变量注入，不动用户全局 git 配置；老 git 不识别
+# 这组变量时静默忽略，无害。
+_GIT_FLAKE_MARKERS = ("HTTP2 framing layer", "unable to access", "RPC failed",
+                      "Connection reset", "connection was reset", "Recv failure")
+
+
+def git_http11_env():
+    """git HTTPS 传输层 HTTP/1.1 兜底 env（返回新字典，调用方可自由合并）。
+
+    本模块是安装/工作台/git 插件拉取各执行面的共享源；L0 的 tlsctx 够不着
+    （L2 不准反向 import L0），runner 又在并行在制品里，故落在 manager。"""
+    return {"GIT_CONFIG_COUNT": "1",
+            "GIT_CONFIG_KEY_0": "http.version",
+            "GIT_CONFIG_VALUE_0": "HTTP/1.1"}
+
+
+def _git_safe_env(cmd):
+    """命令涉及 git+ 远端拉取时的 git 传输层兜底 env（只加键，不覆盖既有）。"""
+    if "git+" not in str(cmd or ""):
+        return {}
+    return git_http11_env()
+
+
+def _git_transport_flake(res):
+    """安装失败输出是否为 git 传输层抖动类错误（值得原地重试一次的那种）。
+
+    接受 run_process 结果字典，也接受纯文本 blob（gitmod/market_remote 的
+    subprocess 输出直接传字符串）。"""
+    if not isinstance(res, str):
+        res = "%s%s" % ((res or {}).get("stderr") or "", (res or {}).get("stdout") or "")
+    return any(m in res for m in _GIT_FLAKE_MARKERS)
+
+
+def run_install_cmd(cmd, cancel_event=None, log_path=None):
+    """安装类命令（目录页 install/upgrade 与 AI 修复命令）的统一执行面。
+
+    - uv 系挂镜像兜底（_uv_mirror_env，只补缺不覆盖）
+    - 带 git+ 拉取的命令强制 git 走 HTTP/1.1
+    - git 传输层抖动失败自动同命令重试一次——链路瞬断不值得烧一轮 AI 诊断
+    """
+    env = {}
+    if _cmd_head_is_uv(cmd):
+        env.update(_uv_mirror_env())
+    env.update(_git_safe_env(cmd))
+    res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT), timeout=1800,
+                             cancel_event=cancel_event, log_path=log_path,
+                             env=env or None)
+    if not res["ok"] and not res.get("cancelled") and _git_transport_flake(res):
+        res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT), timeout=1800,
+                                 cancel_event=cancel_event, log_path=log_path,
+                                 env=env or None,
+                                 audit_notes=["首跑 git 传输层抖动，同命令自动重试一次"])
+        res["retried"] = True
+    return res
+
+
 def _bootstrap_uv(cancel_event=None, log_path=None):
     """uv 不在本机时自动补装一个——安装按钮「点了就该装上」的契约兜底。
 
@@ -2096,10 +2154,7 @@ def run_mgmt_command(entry, op, cancel_event=None, log_path=None):
                     "error": "自动安装 uv 未成功（%s）。请手动安装：%s；"
                              "装完重启 CodeBee，再点一次安装。"
                              % (boot["detail"], _uv_install_hint())}
-    # uv 全家桶命令挂镜像兜底：Python 独立构建/包索引国内直连常断（只补缺不覆盖）
-    res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT),
-                             timeout=1800, cancel_event=cancel_event, log_path=log_path,
-                             env=_uv_mirror_env() if _cmd_head_is_uv(cmd) else None)
+    res = run_install_cmd(cmd, cancel_event=cancel_event, log_path=log_path)
     winget_noop = _winget_already_ok(cmd, op, res)
     detect_all(force=True)
     with _LOCK:

package/app/core/market_remote.py

@@ -843,13 +843,26 @@ def _download_git(entry, tmp):
     if inst.get("ref"):
         cmd += ["--branch", inst["ref"]]
     cmd += [inst["url"], str(dst)]
-    try:
-        proc = subprocess.run(cmd, capture_output=True, timeout=300,
-                              text=True, encoding="utf-8", errors="replace")
-    except subprocess.TimeoutExpired:
-        raise ValueError("git 克隆超时: %s" % inst["url"])
-    if proc.returncode != 0:
-        raise ValueError("git 克隆失败: %s" % (proc.stderr or "").strip()[-200:])
+    # git 走 HTTPS 拉远端与安装链同根因：国内链路对 GitHub 的 HTTP/2 常被中间
+    # 设备掐断（"Error in the HTTP2 framing layer"），manager.git_http11_env()
+    # 强制 HTTP/1.1；clone 已是最后一个下载通道，传输层抖动原地重试一次。
+    # 延迟 import：模块级挂 L2 重依赖会拖累 market 链加载。
+    from . import manager
+    env = os.environ.copy()
+    env.update(manager.git_http11_env())
+    for attempt in (1, 2):
+        try:
+            proc = subprocess.run(cmd, capture_output=True, timeout=300,
+                                  text=True, encoding="utf-8", errors="replace",
+                                  env=env)
+        except subprocess.TimeoutExpired:
+            raise ValueError("git 克隆超时: %s" % inst["url"])
+        if proc.returncode == 0:
+            break
+        err = (proc.stderr or "").strip()[-200:]
+        if attempt == 1 and manager._git_transport_flake(err):
+            continue
+        raise ValueError("git 克隆失败: %s" % err)
     root = dst / sub if sub else dst
     # 双保险：解析后必须仍在克隆目录内（防符号链接等绕过）
     if dst.resolve() != root.resolve() and dst.resolve() not in root.resolve().parents:

package/app/core/openapi.py

@@ -51,6 +51,15 @@ def document():
                               "items": {"type": "string", "maxLength": 80}},
             "task_id": {"type": "string", "maxLength": 100}, "status": {"type": "string", "maxLength": 30},
             "metadata": {"type": "object"}}},
+        "BackendProfile": {"type": "object", "required": ["label", "command"], "properties": {
+            "id": {"type": "string"}, "agent_id": {"type": "string"},
+            "label": {"type": "string", "maxLength": 80}, "command": {"type": "string", "maxLength": 500},
+            "args": {"type": "array", "maxItems": 80, "items": {"type": "string"}},
+            "env": {"type": "object", "additionalProperties": {"type": "string"}},
+            "workspace_path": {"type": "string"}, "enabled": {"type": "boolean"}}},
+        "CommandAuth": {"type": "object", "properties": {
+            "mode": {"type": "string", "enum": ["legacy", "restricted"]},
+            "pending": {"type": "array"}, "rules": {"type": "array"}, "audit": {"type": "array"}}},
     }
 
     def body(schema):
@@ -106,6 +115,29 @@ def document():
             "post": {"summary": "Agent 心跳", "security": security, "requestBody": body(ref("Presence")),
                      "responses": {"200": response("心跳已记录", {"type": "object"}), "400": errors["400"],
                                   "401": errors["401"], "423": errors["423"]}}},
+        "/api/backend-profiles": {
+            "get": {"summary": "读取 ACP Backend Profiles（密钥脱敏）", "security": security,
+                    "responses": {"200": response("Profiles", {"type": "object"}), "401": errors["401"]}},
+            "post": {"summary": "保存 ACP Backend Profile", "security": security,
+                     "requestBody": body(ref("BackendProfile")),
+                     "responses": {"200": response("Profile", {"type": "object"}), "400": errors["400"], "401": errors["401"]}}},
+        "/api/backend-profiles/{profile_id}/delete": {
+            "post": {"summary": "删除 ACP Backend Profile", "security": security,
+                     "responses": {"200": ok, "400": errors["400"], "401": errors["401"], "404": errors["404"]}}},
+        "/api/command-auth": {
+            "get": {"summary": "读取命令授权策略与待处理请求", "security": security,
+                    "responses": {"200": response("Authorization state", ref("CommandAuth")), "401": errors["401"]}},
+            "post": {"summary": "切换命令授权策略", "security": security,
+                     "requestBody": body({"type": "object", "properties": {"mode": {"type": "string", "enum": ["legacy", "restricted"]}}}),
+                     "responses": {"200": response("Authorization state", ref("CommandAuth")), "400": errors["400"], "401": errors["401"]}}},
+        "/api/command-auth/requests/{request_id}": {
+            "post": {"summary": "批准或拒绝等待中的命令", "security": security,
+                     "requestBody": body({"type": "object", "required": ["approve"], "properties": {
+                         "approve": {"type": "boolean"}, "scope": {"type": "string"}, "match": {"type": "string"}, "prefix": {"type": "string"}}}),
+                     "responses": {"200": ok, "400": errors["400"], "401": errors["401"], "404": errors["404"]}}},
+        "/api/command-auth/rules/{rule_id}/revoke": {
+            "post": {"summary": "撤销命令授权规则", "security": security,
+                     "responses": {"200": ok, "400": errors["400"], "401": errors["401"], "404": errors["404"]}}},
         "/api/retrieval/search": {"get": {"summary": "本地检索", "security": security,
             "parameters": [{"name": "q", "in": "query", "required": True,
                             "schema": {"type": "string", "maxLength": 500}},

package/app/core/pipeline.py

@@ -596,6 +596,16 @@ def _external_sandbox_block_reason(agent, workdir, sandbox):
         if normalized.get("env_allowlist"):
             return "沙箱拒绝：该 CLI 后端未接入环境变量白名单，拒绝运行受限任务"
         return ""
+    if (agent or {}).get("kind") == "acp":
+        if normalized.get("network") is False:
+            return "沙箱拒绝：ACP 后端进程未接入网络隔离，拒绝运行网络受限任务"
+        if normalized.get("env_allowlist"):
+            return "沙箱拒绝：ACP 后端进程未接入环境变量白名单，拒绝运行受限任务"
+        roots = [os.path.realpath(x) for x in normalized.get("allowed_roots") or []]
+        if roots and not any(root == allowed or root.startswith(allowed + os.sep)
+                             for allowed in roots):
+            return "沙箱拒绝：任务目录不在 ACP 允许目录内"
+        return ""
     # 非 codex 外部 CLI：默认策略放行，收窄策略拒绝
     if normalized.get("network") is False:
         return "沙箱拒绝：该任务要求禁网，外部 CLI 无法执行网络受限任务"
@@ -818,7 +828,13 @@ def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
         llm_caller = _make_llm_caller(agent, workdir, deadline=deadline)
         call_kwargs = dict(workdir=workdir, readonly=readonly,
                            timeout=timeout, cancel_event=ev, log_path=str(log_abs),
-                           images=images, require_tools=require_tools, deadline=deadline)
+                           images=images, require_tools=require_tools, deadline=deadline,
+                           command_context={"run_id": session_run_id,
+                                            "sandbox": (store.get_task(
+                                                (store.get_run(session_run_id) or {}).get("task_id")
+                                            ) or {}).get("sandbox") or {},
+                                            "allow_terminal": not readonly},
+                           checkpoint_run_id=session_run_id)
 
         def _call(p, **kw):
             nonlocal usage_recorded
@@ -846,7 +862,13 @@ def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
         res = runner.run_agent(agent, prompt, workdir=workdir, readonly=readonly,
                                timeout=timeout, cancel_event=ev, log_path=str(log_abs),
                                resume=resume, images=images, require_tools=require_tools,
-                               deadline=deadline)
+                               deadline=deadline,
+                               command_context={"run_id": session_run_id,
+                                                "sandbox": (store.get_task(
+                                                    (store.get_run(session_run_id) or {}).get("task_id")
+                                                ) or {}).get("sandbox") or {},
+                                                "allow_terminal": not readonly},
+                               checkpoint_run_id=session_run_id)
     # 默认关闭压缩和 resume 都走直通分支，也必须把真实 usage 送进预算表；否则
     # 下一步永远看到 used=0，max_tokens_per_run 只是一个无效设置。
     if not usage_recorded:
@@ -1561,7 +1583,8 @@ def _run_code(run, task, agents, ev, stats, mode):
 
     # 项目记忆既给规划器，也给快速路径的实现者；不能因省掉独立规划而漏掉。
     user_context_len = len(task.get("context") or "")
-    project_memory = _read_project_memory(workdir)
+    project_memory = _read_project_memory(
+        workdir, query=task.get("goal") or task.get("title") or "")
     if project_memory:
         task = dict(task, context=(task.get("context") or "") + "\n\n" + project_memory)
 
@@ -5382,11 +5405,11 @@ def _write_project_memory(task, workdir, lines, source_run=""):
         return ""
 
 
-def _read_project_memory(workdir, cap=4000):
+def _read_project_memory(workdir, cap=4000, query=""):
     """Only inject approved, unexpired and fingerprint-verified memory."""
     try:
         from . import project_memory
-        return project_memory.active_text(workdir, cap=cap)
+        return project_memory.active_text(workdir, cap=cap, query=query)
     except (OSError, ValueError, TypeError):
         return ""