codebee 0.1.99 → 0.1.101

package/CHANGELOG.md

@@ -4,6 +4,20 @@ CodeBee 的用户可感知变更记录。发布新版时：最上面加一节，
 `<!-- relnotes:start -->…<!-- relnotes:end -->` 段（那段会被 `npm view` 的
 README 元数据带回，供老版本在「发现新版本」时展示新版更新内容）。
 
+## v0.1.101（2026-10-10）
+
+- **重写未达标章带上旧账（连载）**：上一轮评审的 major 意见（章节点名+全书级）随重写提示词下发（`__REDO_ISSUES__` 渲染「上一轮评审未达标原因」块），被 major 点名的过线章一并回炉——总判定卡 major 时只重写未过线章消不掉账的空转实案修复，作者第一遍就知道往哪改
+- **评审口径事前下发作者面（连载）**：单章评审清单、全局关注点、签约专项维度与评审面同源提取（单一真源常量装配，两边永不脱节），经 `__REVIEW_RUBRIC__` 注入起草/修订/打磨提示词——作者开写前就知道按什么标准被审；评分机制本体（分值/阈值）刻意不下发
+- **插件安装失败回滚修复**：回滚标记提前绑定+残缺目标自愈重装；此前标记未绑定把人话错误炸成 500 且跳过残留清理（Mac 装 Auto Retry 撞 429 永久撞车实案）
+- **全局兜底错误行带崩溃现场**：任务异常时 traceback 尾帧（文件：行号：函数）追加进错误字段，UI 错误行直接说清死在哪、不必翻 run 目录日志；同因止损签名按崩溃位置区分，代码升级行号漂移自动允许再试一轮
+- **代码块长行自动换行缺省改为开**：运行详情对话里长 JSON/代码行自动折行，不再撑横向滚动条；设置页「长行自动换行」仍可显式关闭
+
+## v0.1.100（2026-10-10）
+
+- **ACP 智能体接入（Agent Client Protocol v1）**：设置页新增「ACP Backend Profiles」，可把遵循 ACP v1 的本地/SSH stdio Agent 登记为执行后端（名称/启动命令/参数/工作区），登记后进入智能体注册表、可被编排路由选用；密钥只保存在本机、读取视图始终脱敏
+- **命令执行治理（命令授权）**：新增 legacy / restricted 两档策略，默认 legacy（自动执行，行为不变）；切到 restricted 后命令逐条等待批准（5 分钟等待窗口），批准队列在设置页操作，执行留脱敏审计
+- **git 传输抖动统一 HTTP/1.1 兜底**：插件市场 clone 与工作台 git 全量调用统一挂 HTTP/1.1 传输层兜底（trae Mac 实案同类点扫捕），市场源下载抖动原地重试一次，clone 更稳
+
 ## v0.1.99（2026-10-09）
 
 - **直连对话「本轮失败 NameError」修复**：内置智能体（CodeBee 直连）每轮起跑数秒即失败，根因是沙箱加固提交把 `sandbox=task.get("sandbox")` 误引入无 task 上下文的内置步骤函数——实参求值即 NameError，Mac/Windows 全平台直连对话不可用。现改为显式传参，任务沙箱策略照常透传生效（回归测试锁定形参与全链）

package/README.md

@@ -25,12 +25,13 @@ Trae Agent、OpenClaw……），提供
 ---
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.99）
+### 最新版更新内容（v0.1.101）
 
-- 修复直连对话每轮起跑即「本轮失败 NameError」：Mac/Windows 全平台直连对话恢复可用
-- 内置智能体命令执行沙箱闸策略感知：默认策略照常直跑，仅收窄策略仍拒绝
-- 大屏 KPI 长数值不再裁字：禁换行 + 按内容长度三档降字号
-- 经验库设置页注入范围文案与全类型实现口径对齐
+- 连载重写带旧账：上一轮评审 major 意见随重写提示词下发，被点名章一并回炉
+- 评审口径事前下发作者面：写作前就知道按什么标准被审（与评审面同源，永不脱节）
+- 插件安装失败回滚修复（人话报错+残缺自愈，不再 500/永久撞车）
+- 错误行带崩溃现场（traceback 尾帧直达 UI，同因止损按位置区分）
+- 代码块长行缺省自动换行，运行详情不再撑横向滚动条
 <!-- relnotes:end -->
 
 

package/app/core/acp_client.py

@@ -0,0 +1,426 @@
+# -*- coding: utf-8 -*-
+"""Minimal ACP v1 stdio client for locally configured agent processes."""
+from __future__ import annotations
+
+import json
+import os
+import queue
+import subprocess
+import threading
+import time
+import uuid
+
+from . import runner
+from .env_scrub import scrub_env
+
+_MAX_LINE = 2 * 1024 * 1024
+_MAX_TEXT = 2 * 1024 * 1024
+
+
+class ACPError(Exception):
+    pass
+
+
+class _Connection:
+    def __init__(self, process):
+        self.process = process
+        self.incoming = queue.Queue()
+        self.write_lock = threading.Lock()
+        self.next_id = 1
+        self.closed = False
+        self.reader = threading.Thread(target=self._read_lines,
+                                       name="acp-stdio-reader", daemon=True)
+        self.reader.start()
+
+    def _read_lines(self):
+        try:
+            while True:
+                line = self.process.stdout.readline()
+                if not line:
+                    break
+                if len(line) > _MAX_LINE:
+                    self.incoming.put({"_transport_error": "ACP 响应超过 2 MiB"})
+                    break
+                try:
+                    message = json.loads(line.decode("utf-8") if isinstance(line, bytes)
+                                         else line)
+                    if isinstance(message, dict):
+                        self.incoming.put(message)
+                except (ValueError, UnicodeDecodeError):
+                    self.incoming.put({"_transport_error": "ACP 返回了无效 JSON"})
+        except Exception as exc:
+            self.incoming.put({"_transport_error": "ACP 读取失败：%s" % exc})
+        finally:
+            self.incoming.put(None)
+
+    def send(self, message):
+        raw = (json.dumps(message, ensure_ascii=False, separators=(",", ":")) + "\n")
+        with self.write_lock:
+            if self.closed or self.process.poll() is not None:
+                raise ACPError("ACP 进程已退出")
+            try:
+                self.process.stdin.write(raw.encode("utf-8"))
+            except TypeError:
+                self.process.stdin.write(raw)
+            self.process.stdin.flush()
+
+    def request(self, method, params, deadline, cancel_event, on_message):
+        request_id = self.next_id
+        self.next_id += 1
+        self.send({"jsonrpc": "2.0", "id": request_id,
+                   "method": method, "params": params})
+        while True:
+            if cancel_event is not None and cancel_event.is_set():
+                self.send({"jsonrpc": "2.0", "method": "session/cancel",
+                           "params": {"sessionId": params.get("sessionId", "")}})
+                raise InterruptedError("ACP 任务已取消")
+            if deadline is not None and time.monotonic() >= deadline:
+                self.send({"jsonrpc": "2.0", "method": "session/cancel",
+                           "params": {"sessionId": params.get("sessionId", "")}})
+                raise TimeoutError("ACP 任务总时限已到")
+            wait = 0.2
+            if deadline is not None:
+                wait = min(wait, max(0.01, deadline - time.monotonic()))
+            try:
+                message = self.incoming.get(timeout=wait)
+            except queue.Empty:
+                if self.process.poll() is not None and self.incoming.empty():
+                    raise ACPError("ACP 进程退出码 %s" % self.process.poll())
+                continue
+            if message is None:
+                raise ACPError("ACP 连接已关闭")
+            if message.get("_transport_error"):
+                raise ACPError(message["_transport_error"])
+            if message.get("id") == request_id and ("result" in message or "error" in message):
+                if "error" in message:
+                    error = message.get("error") or {}
+                    raise ACPError("ACP %s 失败：%s" %
+                                   (method, str(error.get("message") or error)[:500]))
+                return message.get("result") or {}
+            if message.get("method"):
+                response = on_message(message)
+                if response is not None:
+                    self.send(response)
+
+    def close(self):
+        self.closed = True
+        try:
+            if self.process.poll() is None:
+                self.process.stdin.close()
+        except Exception:
+            pass
+        try:
+            self.process.wait(timeout=0.5)
+        except Exception:
+            try:
+                runner._kill_tree(self.process.pid)
+            except Exception:
+                try:
+                    self.process.kill()
+                except Exception:
+                    pass
+        for stream_name in ("stdout", "stderr"):
+            try:
+                getattr(self.process, stream_name).close()
+            except Exception:
+                pass
+
+
+def _profile_runtime(agent):
+    if not agent.get("profile_managed"):
+        return dict(agent)
+    from . import backend_profiles
+    profile = backend_profiles.get_runtime(agent.get("profile_id"))
+    if not profile:
+        raise ACPError("ACP Backend Profile 不存在或已停用")
+    merged = dict(agent)
+    merged.update({"command": profile["command"], "args": profile["args"],
+                   "env": profile["env"],
+                   "workspace_path": profile.get("workspace_path") or ""})
+    return merged
+
+
+def _path(workdir, configured_root, requested):
+    from pathlib import Path
+    root = Path(workdir or ".").expanduser().resolve(strict=True)
+    raw = str(requested or "")
+    if not raw or "\x00" in raw:
+        raise ValueError("ACP 文件路径无效")
+    configured = str(configured_root or "").rstrip("/\\")
+    if configured and (raw == configured or raw.startswith(configured + "/") or
+                       raw.startswith(configured + "\\")):
+        rel = raw[len(configured):].lstrip("/\\")
+        target = root.joinpath(*rel.replace("\\", "/").split("/"))
+    else:
+        target = Path(raw).expanduser()
+        if not target.is_absolute():
+            raise ValueError("ACP 文件路径必须映射到当前工作区")
+    resolved = target.resolve(strict=False)
+    if resolved != root and root not in resolved.parents:
+        raise ValueError("ACP 文件路径超出当前工作区")
+    return root, resolved
+
+
+def _fs_request(method, params, workdir, configured_root, readonly, checkpoint_run_id):
+    from . import checkpoints
+    root, target = _path(workdir, configured_root, params.get("path"))
+    if method == "fs/read_text_file":
+        try:
+            content = target.read_text(encoding="utf-8")
+        except (OSError, UnicodeError) as exc:
+            raise ValueError("文件不可读取：%s" % exc)
+        lines = content.splitlines(keepends=True)
+        line = max(1, int(params.get("line") or 1))
+        limit = max(1, min(10000, int(params.get("limit") or 10000)))
+        if line > 1 or len(lines) > limit:
+            content = "".join(lines[line - 1:line - 1 + limit])
+        return {"content": content}
+    if method == "fs/write_text_file":
+        if readonly:
+            raise ValueError("此步骤为只读模式")
+        content = params.get("content")
+        if not isinstance(content, str) or len(content.encode("utf-8")) > 16 * 1024 * 1024:
+            raise ValueError("写入内容无效或超过 16 MiB")
+        if checkpoint_run_id:
+            saved = checkpoints.capture_file(checkpoint_run_id, str(root), target)
+            if not saved.get("ok"):
+                raise ValueError("检查点无法保存原始文件，拒绝写入")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        # Keep Python 3.8 compatibility: pathlib.Path.write_text did not yet
+        # accept ``newline`` on all supported runtimes.
+        with target.open("w", encoding="utf-8", newline="") as handle:
+            handle.write(content)
+        if checkpoint_run_id and not checkpoints.mark_file_after(
+                checkpoint_run_id, str(root), target):
+            raise ValueError("检查点无法记录写入后的状态")
+        return {}
+    raise ValueError("不支持的 ACP 文件系统方法")
+
+
+def _agent_request(message, *, connection, session_id, workdir, configured_root,
+                   readonly, checkpoint_run_id, cancel_event, deadline, sandbox,
+                   command_context, terminals):
+    method = message.get("method")
+    params = message.get("params") or {}
+    request_id = message.get("id")
+    try:
+        if method in ("fs/read_text_file", "fs/write_text_file"):
+            blocked = set(sandbox.get("disabled_tools") or [])
+            required = "read_file" if method == "fs/read_text_file" else "write_file"
+            if required in blocked:
+                raise ValueError("沙箱策略已禁用 %s" % required)
+            result = _fs_request(method, params, workdir, configured_root,
+                                 readonly, checkpoint_run_id)
+        elif method == "session/request_permission":
+            result = {"outcome": {"outcome": "cancelled"}}
+        elif method == "terminal/create":
+            if readonly:
+                raise ValueError("此步骤禁止执行终端命令")
+            if not command_context.get("allow_terminal", True):
+                raise ValueError("ACP 终端能力已禁用")
+            command = str(params.get("command") or "").strip()
+            args = params.get("args") or []
+            if not command or not isinstance(args, list) or len(args) > 100:
+                raise ValueError("ACP 命令参数无效")
+            if any(not isinstance(arg, str) or "\x00" in arg or len(arg) > 8192
+                   for arg in args):
+                raise ValueError("ACP 命令参数无效")
+            cwd = str(params.get("cwd") or workdir or "")
+            from . import policy
+            if not policy.path_allowed(cwd, sandbox):
+                raise ValueError("沙箱拒绝：终端工作目录超出允许范围")
+            if os.path.realpath(cwd) != os.path.realpath(workdir or "."):
+                raise ValueError("ACP 终端目前仅允许在任务工作目录执行")
+            from .builtin_agent import _exec_tool
+            import shlex
+            terminal_id = "term-" + uuid.uuid4().hex[:16]
+            terminal = {"output": "", "done": threading.Event(),
+                        "cancel": threading.Event(), "released": False}
+            terminals[terminal_id] = terminal
+
+            def _run_terminal():
+                rendered = shlex.join([command] + args)
+                terminal["output"] = _exec_tool(
+                    workdir, "run_command", {"command": rendered},
+                    cancel_event=terminal["cancel"], deadline=deadline,
+                    disabled_tools=sandbox.get("disabled_tools"), sandbox=sandbox,
+                    checkpoint_run_id=command_context.get("run_id", ""))
+                terminal["done"].set()
+
+            threading.Thread(target=_run_terminal, name="acp-terminal", daemon=True).start()
+            result = {"terminalId": terminal_id}
+        elif method == "terminal/output":
+            terminal = terminals.get(str(params.get("terminalId") or ""))
+            if not terminal:
+                raise ValueError("terminalId 不存在或已释放")
+            output = terminal["output"]
+            marker = "退出码: "
+            code = None
+            if marker in output:
+                try:
+                    code = int(output.split(marker, 1)[1].splitlines()[0].strip())
+                except (ValueError, IndexError):
+                    pass
+            limit = max(1, min(4 * 1024 * 1024,
+                               int(params.get("outputByteLimit") or 1024 * 1024)))
+            encoded = output.encode("utf-8")
+            truncated = len(encoded) > limit
+            if truncated:
+                output = encoded[-limit:].decode("utf-8", errors="ignore")
+            result = {"output": output, "truncated": truncated,
+                      "exitStatus": {"exitCode": code, "signal": None}}
+        elif method == "terminal/wait_for_exit":
+            terminal = terminals.get(str(params.get("terminalId") or ""))
+            if not terminal:
+                raise ValueError("terminalId 不存在或已释放")
+            while not terminal["done"].wait(0.1):
+                if cancel_event is not None and cancel_event.is_set():
+                    terminal["cancel"].set()
+                if deadline is not None and time.monotonic() >= deadline:
+                    terminal["cancel"].set()
+                    raise TimeoutError("ACP 终端等待超过任务时限")
+            code = None
+            if "退出码: " in terminal["output"]:
+                try:
+                    code = int(terminal["output"].split("退出码: ", 1)[1].splitlines()[0])
+                except (ValueError, IndexError):
+                    pass
+            result = {"exitCode": code, "signal": None}
+        elif method == "terminal/kill":
+            terminal = terminals.get(str(params.get("terminalId") or ""))
+            if not terminal:
+                raise ValueError("terminalId 不存在或已释放")
+            terminal["cancel"].set()
+            result = {}
+        elif method == "terminal/release":
+            terminal = terminals.pop(str(params.get("terminalId") or ""), None)
+            if not terminal:
+                raise ValueError("terminalId 不存在或已释放")
+            if not terminal["done"].is_set():
+                terminal["cancel"].set()
+            result = {}
+        else:
+            raise ValueError("不支持的 ACP client 方法：%s" % str(method or "")[:80])
+        return {"jsonrpc": "2.0", "id": request_id, "result": result}
+    except Exception as exc:
+        return {"jsonrpc": "2.0", "id": request_id,
+                "error": {"code": -32000, "message": str(exc)[:500]}}
+
+
+def run_agent(agent, prompt, workdir=None, readonly=True, timeout=1200,
+              cancel_event=None, deadline=None, command_context=None,
+              checkpoint_run_id="", resume=None):
+    """Run an ACP v1 agent over stdio and return the common runner result shape."""
+    started = time.monotonic()
+    process = None
+    connection = None
+    command_context = dict(command_context or {})
+    try:
+        profile = _profile_runtime(agent)
+        cwd = os.path.realpath(workdir or ".")
+        if not os.path.isdir(cwd):
+            raise ACPError("ACP 工作目录不可用")
+        command = str(profile.get("command") or "").strip()
+        args = profile.get("args") or []
+        if not command or not isinstance(args, list) or any(not isinstance(x, str) for x in args):
+            raise ACPError("ACP 启动命令配置无效")
+        env = scrub_env(os.environ.copy())
+        env.update({str(k): str(v) for k, v in (profile.get("env") or {}).items()})
+        argv = runner.resolve_command(command) + args
+        process = subprocess.Popen(argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                                   stderr=subprocess.PIPE, cwd=cwd, env=env,
+                                   bufsize=0, start_new_session=(os.name != "nt"),
+                                   creationflags=runner.CREATE_NO_WINDOW)
+        connection = _Connection(process)
+        absolute_deadline = deadline
+        if absolute_deadline is None:
+            absolute_deadline = started + max(1.0, float(timeout or 1200))
+        text_parts = []
+        terminals = {}
+        session_id = str(resume or "")
+
+        def on_message(message):
+            nonlocal session_id
+            if message.get("method") == "session/update":
+                params = message.get("params") or {}
+                update = params.get("update") or {}
+                if params.get("sessionId") == session_id and \
+                        update.get("sessionUpdate") == "agent_message_chunk":
+                    content = update.get("content") or {}
+                    if content.get("type") == "text":
+                        piece = str(content.get("text") or "")
+                        if sum(map(len, text_parts)) < _MAX_TEXT:
+                            text_parts.append(piece[:_MAX_TEXT - sum(map(len, text_parts))])
+                return None
+            return _agent_request(
+                message, connection=connection, session_id=session_id,
+                workdir=cwd, configured_root=profile.get("workspace_path"),
+                readonly=readonly, checkpoint_run_id=checkpoint_run_id,
+                cancel_event=cancel_event, deadline=absolute_deadline,
+                sandbox=command_context.get("sandbox") or {},
+                command_context=command_context, terminals=terminals)
+
+        client_capabilities = {"fs": {"readTextFile": True,
+                                       "writeTextFile": not readonly},
+                               "terminal": not readonly and
+                                   command_context.get("allow_terminal", True)}
+        initialized = connection.request("initialize", {
+            "protocolVersion": 1, "clientCapabilities": client_capabilities,
+            "clientInfo": {"name": "CodeBee", "title": "CodeBee", "version": "1"}},
+            absolute_deadline, cancel_event, on_message)
+        if int(initialized.get("protocolVersion") or 0) != 1:
+            raise ACPError("ACP 版本不兼容：服务端未协商 protocolVersion 1")
+        mcp_servers = []
+        if session_id:
+            capabilities = initialized.get("agentCapabilities") or {}
+            if not capabilities.get("loadSession"):
+                raise ACPError("此 ACP Agent 不支持恢复会话")
+            connection.request("session/load", {
+                "sessionId": session_id,
+                "cwd": profile.get("workspace_path") or cwd,
+                "mcpServers": mcp_servers}, absolute_deadline, cancel_event, on_message)
+        else:
+            session = connection.request("session/new", {
+                "cwd": profile.get("workspace_path") or cwd,
+                "mcpServers": mcp_servers}, absolute_deadline, cancel_event, on_message)
+            session_id = str(session.get("sessionId") or "")
+            if not session_id:
+                raise ACPError("ACP 未返回 sessionId")
+        connection.request("session/prompt", {
+            "sessionId": session_id,
+            "prompt": [{"type": "text", "text": str(prompt or "")}]},
+            absolute_deadline, cancel_event, on_message)
+        if not text_parts:
+            raise ACPError("ACP 完成但未返回文本消息")
+        return {"ok": True, "text": "".join(text_parts)[:_MAX_TEXT], "json": None,
+                "cost_usd": 0.0, "tokens": 0, "usage": None, "error": "",
+                "error_code": "", "raw": {"exit_code": 0,
+                                               "duration": time.monotonic() - started},
+                "kind": "acp", "model": None, "sid": session_id,
+                "attempts": []}
+    except InterruptedError as exc:
+        return {"ok": False, "text": "", "json": None, "cost_usd": 0.0,
+                "tokens": 0, "usage": None, "error": str(exc),
+                "raw": {"exit_code": None, "cancelled": True,
+                        "duration": time.monotonic() - started},
+                "kind": "acp", "model": None, "attempts": []}
+    except TimeoutError as exc:
+        return {"ok": False, "text": "", "json": None, "cost_usd": 0.0,
+                "tokens": 0, "usage": None, "error": str(exc),
+                "raw": {"exit_code": None, "timed_out": True,
+                        "deadline_exceeded": deadline is not None,
+                        "duration": time.monotonic() - started},
+                "kind": "acp", "model": None, "attempts": []}
+    except Exception as exc:
+        return {"ok": False, "text": "", "json": None, "cost_usd": 0.0,
+                "tokens": 0, "usage": None, "error": str(exc)[:1000],
+                "raw": {"exit_code": None, "duration": time.monotonic() - started},
+                "kind": "acp", "model": None, "attempts": []}
+    finally:
+        if connection is not None:
+            connection.close()
+        elif process is not None:
+            try:
+                runner._kill_tree(process.pid)
+            except Exception:
+                pass

package/app/core/backend_profiles.py

@@ -0,0 +1,188 @@
+# -*- coding: utf-8 -*-
+"""User-managed ACP agent launch profiles with secret-redacted views."""
+from __future__ import annotations
+
+import json
+import os
+import re
+import threading
+import uuid
+from pathlib import Path
+
+from .redact import scrub_text
+
+_LOCK = threading.RLock()
+_FILE = None
+_SECRET_NAME = re.compile(r"(?i)(token|secret|password|passwd|api[_-]?key|credential)")
+_PROFILE_ID = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$")
+_ENV_NAME = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def init(data_dir=None):
+    global _FILE
+    with _LOCK:
+        if data_dir is None:
+            from . import paths
+            base = paths.DATA_DIR
+        else:
+            base = Path(data_dir)
+        base.mkdir(parents=True, exist_ok=True)
+        _FILE = base / "backend-profiles.json"
+
+
+def _file():
+    global _FILE
+    if _FILE is None:
+        init()
+    return _FILE
+
+
+def _load():
+    path = _file()
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return []
+    except (OSError, ValueError) as exc:
+        raise ValueError("ACP 后端配置不可读取，已阻止覆盖") from exc
+    profiles = data.get("profiles") if isinstance(data, dict) else None
+    if not isinstance(profiles, list):
+        raise ValueError("ACP 后端配置格式无效")
+    return [row for row in profiles if isinstance(row, dict)][:50]
+
+
+def _persist(profiles):
+    path = _file()
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(json.dumps({"profiles": profiles}, ensure_ascii=False, indent=2),
+                   encoding="utf-8")
+    try:
+        os.chmod(str(tmp), 0o600)
+    except OSError:
+        pass
+    os.replace(str(tmp), str(path))
+
+
+def _valid_workspace_path(value):
+    value = str(value or "").strip()
+    if not value:
+        return ""
+    if "\x00" in value or len(value) > 1024:
+        raise ValueError("workspace_path 无效")
+    if not (value.startswith("/") or value.startswith("\\") or
+            re.match(r"^[A-Za-z]:[\\/]", value)):
+        raise ValueError("workspace_path 必须是绝对路径")
+    return value
+
+
+def _normalize(payload, existing=None):
+    if not isinstance(payload, dict):
+        raise ValueError("profile 必须是 JSON 对象")
+    old = existing or {}
+    profile_id = str(payload.get("id") or old.get("id") or
+                     ("backend-" + uuid.uuid4().hex[:16])).strip()
+    if not _PROFILE_ID.fullmatch(profile_id):
+        raise ValueError("profile id 格式无效")
+    label = str(payload.get("label") or "").strip()
+    command = str(payload.get("command") or "").strip()
+    if not label or len(label) > 80:
+        raise ValueError("label 必填且不能超过 80 个字符")
+    if not command or len(command) > 500 or "\x00" in command:
+        raise ValueError("command 必填且格式无效")
+    raw_args = payload.get("args", old.get("args", []))
+    if not isinstance(raw_args, list) or len(raw_args) > 80:
+        raise ValueError("args 必须是最多 80 项的列表")
+    args = []
+    for value in raw_args:
+        if not isinstance(value, str) or len(value) > 2048 or "\x00" in value:
+            raise ValueError("args 只能包含不超过 2048 字符的文本")
+        args.append(value)
+    raw_env = payload.get("env", old.get("env", {}))
+    if not isinstance(raw_env, dict) or len(raw_env) > 100:
+        raise ValueError("env 必须是最多 100 项的对象")
+    env = {}
+    old_env = old.get("env") or {}
+    for name, value in raw_env.items():
+        name = str(name)
+        if not _ENV_NAME.fullmatch(name) or not isinstance(value, str) \
+                or len(value) > 8192 or "\x00" in value:
+            raise ValueError("env 变量名或值无效")
+        if value == "__REDACTED__" and name in old_env:
+            value = old_env[name]
+        env[name] = value
+    enabled = payload.get("enabled", old.get("enabled", True))
+    if not isinstance(enabled, bool):
+        raise ValueError("enabled 必须是布尔值")
+    return {"id": profile_id, "agent_id": "acp-" + profile_id,
+            "label": label, "command": command, "args": args,
+            "env": env, "workspace_path": _valid_workspace_path(
+                payload.get("workspace_path", old.get("workspace_path", ""))),
+            "enabled": enabled}
+
+
+def _view(profile):
+    row = dict(profile)
+    row["command"] = scrub_text(profile.get("command") or "", 500)
+    row["args"] = [scrub_text(value, 2048) for value in profile.get("args") or []]
+    env = {}
+    for name, value in (profile.get("env") or {}).items():
+        env[name] = "__REDACTED__" if _SECRET_NAME.search(name) and value else value
+    row["env"] = env
+    return row
+
+
+def list_profiles():
+    with _LOCK:
+        return [_view(row) for row in _load()]
+
+
+def runtime_profiles():
+    with _LOCK:
+        return [dict(row, env=dict(row.get("env") or {})) for row in _load()
+                if row.get("enabled", True)]
+
+
+def get_runtime(profile_id):
+    with _LOCK:
+        return next((dict(row, env=dict(row.get("env") or {}))
+                     for row in _load() if row.get("id") == str(profile_id or "")
+                     and row.get("enabled", True)), None)
+
+
+def runtime_agents():
+    return [{"id": row["agent_id"], "profile_id": row["id"],
+             "label": row["label"], "kind": "acp", "mode": "real",
+             "command": row["command"], "args": list(row["args"]),
+             "env": {}, "workspace_path": row["workspace_path"],
+             "profile_managed": True}
+            for row in runtime_profiles()]
+
+
+def save(payload):
+    with _LOCK:
+        profiles = _load()
+        requested_id = str((payload or {}).get("id") or "")
+        old = next((row for row in profiles if row.get("id") == requested_id), None)
+        if requested_id and old is None:
+            raise KeyError("ACP 后端配置不存在")
+        profile = _normalize(payload, old)
+        if any(row.get("id") == profile["id"] and row is not old for row in profiles):
+            raise ValueError("profile id 已存在")
+        if old is None and len(profiles) >= 50:
+            raise ValueError("ACP 后端最多配置 50 个")
+        if old is None:
+            profiles.append(profile)
+        else:
+            profiles[profiles.index(old)] = profile
+        _persist(profiles)
+        return _view(profile)
+
+
+def remove(profile_id):
+    with _LOCK:
+        profiles = _load()
+        remaining = [row for row in profiles if row.get("id") != str(profile_id or "")]
+        if len(remaining) == len(profiles):
+            raise KeyError("ACP 后端配置不存在")
+        _persist(remaining)
+        return True

package/app/core/builtin_agent.py

@@ -958,6 +958,18 @@ def _exec_tool(workdir, name, args, cancel_event=None, deadline=None, task_creat
             except Exception:
                 return "（检查点拒绝：文件原始版本保存失败，未执行文件操作）"
         if name == "run_command":
+            try:
+                from . import command_auth
+                approval = command_auth.authorize(
+                    str((args or {}).get("command") or ""),
+                    run_id=checkpoint_run_id, workdir=workdir,
+                    deadline=deadline, cancel_event=cancel_event,
+                    source="run_command")
+            except Exception:
+                approval = {"allowed": False, "reason": "authorization_unavailable"}
+            if not approval.get("allowed"):
+                reason = approval.get("reason") or "denied"
+                return "（命令授权%s，未执行；拒绝后不会自动重放，请模型检查并重新请求）" % reason
             result = fn(workdir, args or {}, cancel_event=cancel_event,
                         deadline=deadline, sandbox=sandbox)
         else: