minimal-agent 0.13.0 → 0.15.0

package/src/tools/applypatch/applyPatch.ts

@@ -0,0 +1,428 @@
+import { existsSync } from 'node:fs';
+import { readFile, realpath, rm } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { z } from 'zod';
+
+import { getWorkingDir } from '../../bootstrap/workingDir.js';
+import type {
+  FileActivityMetadata,
+  Tool,
+  ToolCallContext,
+  ToolResult,
+} from '../../types.js';
+import { buildPatchSummary } from '../shared/diffSummary.js';
+import { fileActivityMetadata } from '../shared/fileActivity.js';
+import { emitFileMutation } from '../shared/fileMutationBus.js';
+import { hashFileBytes, recordRead } from '../shared/fileState.js';
+import {
+  type FileBomEncoding,
+  applyLineEnding,
+  atomicWriteFile,
+  encodeTextFile,
+  hasBinaryExtension,
+  readTextFile,
+} from '../shared/fileUtils.js';
+import { DEFAULT_MAX_RESULT_SIZE_CHARS } from '../types.js';
+
+interface PatchHunk {
+  header: string;
+  oldStart?: number;
+  lines: Array<{ kind: 'context' | 'add' | 'delete'; text: string }>;
+}
+
+type PatchOperation =
+  | { kind: 'add'; path: string; content: string }
+  | { kind: 'delete'; path: string }
+  | { kind: 'update'; path: string; moveTo?: string; hunks: PatchHunk[] };
+
+const schema = z.object({
+  patch: z.string().min(1).max(10_000_000),
+});
+type ApplyPatchInput = z.infer<typeof schema>;
+
+function fail(message: string): never {
+  throw new Error(message);
+}
+
+/** Parse the Codex apply_patch envelope without invoking a platform patch binary. */
+export function parseApplyPatch(input: string): PatchOperation[] {
+  const lines = input.replaceAll('\r\n', '\n').split('\n');
+  if (lines[0] !== '*** Begin Patch') fail('补丁必须以 *** Begin Patch 开始');
+  const operations: PatchOperation[] = [];
+  let index = 1;
+  while (index < lines.length) {
+    const line = lines[index]!;
+    if (line === '*** End Patch') {
+      if (lines.slice(index + 1).some((item) => item.trim()))
+        fail('*** End Patch 后不能再有内容');
+      if (!operations.length) fail('补丁中没有文件操作');
+      return operations;
+    }
+    if (line.startsWith('*** Add File: ')) {
+      const path = line.slice('*** Add File: '.length);
+      index += 1;
+      const added: string[] = [];
+      while (index < lines.length && !lines[index]!.startsWith('*** ')) {
+        const contentLine = lines[index]!;
+        if (!contentLine.startsWith('+'))
+          fail(`Add File ${path} 的内容行必须以 + 开头（第 ${index + 1} 行）`);
+        added.push(contentLine.slice(1));
+        index += 1;
+      }
+      operations.push({
+        kind: 'add',
+        path,
+        content: added.length ? `${added.join('\n')}\n` : '',
+      });
+      continue;
+    }
+    if (line.startsWith('*** Delete File: ')) {
+      operations.push({
+        kind: 'delete',
+        path: line.slice('*** Delete File: '.length),
+      });
+      index += 1;
+      continue;
+    }
+    if (line.startsWith('*** Update File: ')) {
+      const path = line.slice('*** Update File: '.length);
+      index += 1;
+      let moveTo: string | undefined;
+      if (lines[index]?.startsWith('*** Move to: ')) {
+        moveTo = lines[index]!.slice('*** Move to: '.length);
+        index += 1;
+      }
+      const hunks: PatchHunk[] = [];
+      while (index < lines.length && !lines[index]!.startsWith('*** ')) {
+        const headerLine = lines[index]!;
+        if (!headerLine.startsWith('@@'))
+          fail(`Update File ${path} 缺少 @@ hunk 头（第 ${index + 1} 行）`);
+        const match = /^@@(?: -(\d+)(?:,\d+)? \+\d+(?:,\d+)?)? @@\s*(.*)$/.exec(
+          headerLine,
+        );
+        const header = match
+          ? match[2]!
+          : headerLine.slice(2).replace(/^\s+|\s+$/g, '');
+        const oldStart = match?.[1] ? Number(match[1]) : undefined;
+        index += 1;
+        const hunkLines: PatchHunk['lines'] = [];
+        while (
+          index < lines.length &&
+          !lines[index]!.startsWith('@@') &&
+          (!lines[index]!.startsWith('*** ') ||
+            lines[index] === '*** End of File')
+        ) {
+          const hunkLine = lines[index]!;
+          if (hunkLine === '*** End of File') {
+            index += 1;
+            continue;
+          }
+          const prefix = hunkLine[0];
+          if (prefix !== ' ' && prefix !== '+' && prefix !== '-')
+            fail(`hunk 内容行必须以空格、+ 或 - 开头（第 ${index + 1} 行）`);
+          hunkLines.push({
+            kind:
+              prefix === ' ' ? 'context' : prefix === '+' ? 'add' : 'delete',
+            text: hunkLine.slice(1),
+          });
+          index += 1;
+        }
+        if (!hunkLines.length) fail(`Update File ${path} 包含空 hunk`);
+        hunks.push({ header, oldStart, lines: hunkLines });
+      }
+      if (!hunks.length && !moveTo) fail(`Update File ${path} 没有 hunk`);
+      operations.push({
+        kind: 'update',
+        path,
+        ...(moveTo ? { moveTo } : {}),
+        hunks,
+      });
+      continue;
+    }
+    fail(`无法识别补丁指令（第 ${index + 1} 行）：${line}`);
+  }
+  fail('补丁缺少 *** End Patch');
+}
+
+function within(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+  return (
+    rel === '' ||
+    (!isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${sep}`))
+  );
+}
+
+async function nearestExistingAncestor(path: string): Promise<string> {
+  let current = path;
+  while (!existsSync(current)) {
+    const parent = dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return realpath(current);
+}
+
+async function workspacePath(raw: string, cwd: string): Promise<string> {
+  if (!raw || isAbsolute(raw) || raw.includes('\0'))
+    fail(`补丁路径必须是非空的工作区相对路径：${raw}`);
+  const absolute = resolve(cwd, raw);
+  const rel = relative(resolve(cwd), absolute);
+  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+    fail(`补丁路径越过工作区边界：${raw}`);
+  const physicalRoot = await realpath(resolve(cwd)).catch(() => resolve(cwd));
+  const physicalBoundary = existsSync(absolute)
+    ? await realpath(absolute)
+    : await nearestExistingAncestor(dirname(absolute));
+  if (!within(physicalRoot, physicalBoundary))
+    fail(`补丁路径通过符号链接越过工作区边界：${raw}`);
+  if (hasBinaryExtension(absolute)) fail(`ApplyPatch 不支持二进制文件：${raw}`);
+  return absolute;
+}
+
+export function applyHunks(original: string, hunks: PatchHunk[]): string {
+  const normalized = original.replaceAll('\r\n', '\n');
+  const trailingNewline = normalized.endsWith('\n');
+  const lines = normalized.split('\n');
+  if (trailingNewline) lines.pop();
+  let cursor = 0;
+  for (const hunk of hunks) {
+    if (hunk.header) {
+      const anchor = lines.findIndex(
+        (line, index) => index >= cursor && line.includes(hunk.header),
+      );
+      if (anchor < 0) fail(`找不到 hunk 锚点：${hunk.header}`);
+      cursor = anchor;
+    }
+    const before = hunk.lines
+      .filter((line) => line.kind !== 'add')
+      .map((line) => line.text);
+    const after = hunk.lines
+      .filter((line) => line.kind !== 'delete')
+      .map((line) => line.text);
+    const matchesAt = (start: number) =>
+      before.every((line, offset) => lines[start + offset] === line);
+    let at = -1;
+    if (!before.length) {
+      at =
+        hunk.oldStart === undefined
+          ? cursor
+          : Math.max(cursor, Math.min(lines.length, hunk.oldStart - 1));
+    } else {
+      for (
+        let index = cursor;
+        index <= lines.length - before.length;
+        index += 1
+      ) {
+        if (matchesAt(index)) {
+          at = index;
+          break;
+        }
+      }
+      if (at < 0 && cursor > 0) {
+        const matches: number[] = [];
+        for (let index = 0; index <= lines.length - before.length; index += 1)
+          if (matchesAt(index)) matches.push(index);
+        if (matches.length === 1) at = matches[0]!;
+      }
+    }
+    if (at < 0)
+      fail(`hunk 上下文与当前文件不匹配：${before.join('\n').slice(0, 240)}`);
+    lines.splice(at, before.length, ...after);
+    cursor = at + after.length;
+  }
+  return `${lines.join('\n')}${trailingNewline ? '\n' : ''}`;
+}
+
+interface StagedFile {
+  path: string;
+  label: string;
+  before?: Buffer;
+  beforeText: string;
+  after?: string;
+  encoding: FileBomEncoding;
+  activity: 'created' | 'modified' | 'deleted';
+}
+
+async function stagePatch(
+  operations: PatchOperation[],
+  cwd: string,
+): Promise<StagedFile[]> {
+  const staged: StagedFile[] = [];
+  const touched = new Set<string>();
+  const claim = (path: string) => {
+    if (touched.has(path)) fail(`同一补丁不能重复操作同一路径：${path}`);
+    touched.add(path);
+  };
+  for (const operation of operations) {
+    const path = await workspacePath(operation.path, cwd);
+    claim(path);
+    if (operation.kind === 'add') {
+      if (existsSync(path)) fail(`Add File 目标已存在：${operation.path}`);
+      staged.push({
+        path,
+        label: operation.path,
+        beforeText: '',
+        after: operation.content,
+        encoding: 'utf8',
+        activity: 'created',
+      });
+      continue;
+    }
+    if (!existsSync(path))
+      fail(
+        `${operation.kind === 'delete' ? 'Delete' : 'Update'} File 不存在：${operation.path}`,
+      );
+    const snapshot = await readTextFile(path);
+    if (operation.kind === 'delete') {
+      staged.push({
+        path,
+        label: operation.path,
+        before: snapshot.bytes,
+        beforeText: snapshot.content,
+        encoding: snapshot.encoding,
+        activity: 'deleted',
+      });
+      continue;
+    }
+    const updated = applyLineEnding(
+      applyHunks(snapshot.content, operation.hunks),
+      snapshot.lineEnding,
+    );
+    if (operation.moveTo) {
+      const target = await workspacePath(operation.moveTo, cwd);
+      claim(target);
+      if (existsSync(target)) fail(`Move to 目标已存在：${operation.moveTo}`);
+      staged.push({
+        path,
+        label: operation.path,
+        before: snapshot.bytes,
+        beforeText: snapshot.content,
+        encoding: snapshot.encoding,
+        activity: 'deleted',
+      });
+      staged.push({
+        path: target,
+        label: operation.moveTo,
+        beforeText: '',
+        after: updated,
+        encoding: snapshot.encoding,
+        activity: 'created',
+      });
+    } else {
+      staged.push({
+        path,
+        label: operation.path,
+        before: snapshot.bytes,
+        beforeText: snapshot.content,
+        after: updated,
+        encoding: snapshot.encoding,
+        activity: 'modified',
+      });
+    }
+  }
+  return staged;
+}
+
+async function commit(staged: StagedFile[]): Promise<void> {
+  const committed: StagedFile[] = [];
+  try {
+    for (const file of staged) {
+      if (file.after === undefined) await rm(file.path);
+      else await atomicWriteFile(file.path, file.after, file.encoding);
+      committed.push(file);
+    }
+  } catch (error) {
+    const rollbackErrors: string[] = [];
+    for (const file of committed.reverse()) {
+      try {
+        if (file.before) await atomicWriteFile(file.path, file.before);
+        else await rm(file.path, { force: true });
+      } catch (rollbackError) {
+        rollbackErrors.push(
+          `${file.label}: ${(rollbackError as Error).message}`,
+        );
+      }
+    }
+    const suffix = rollbackErrors.length
+      ? `；回滚也有失败：${rollbackErrors.join('；')}`
+      : '；已回滚本次已落盘文件';
+    throw new Error(`${(error as Error).message}${suffix}`);
+  }
+}
+
+async function call(
+  input: ApplyPatchInput,
+  context?: ToolCallContext,
+): Promise<ToolResult> {
+  const cwd = context?.cwd ?? getWorkingDir();
+  let operations: PatchOperation[];
+  let staged: StagedFile[];
+  try {
+    operations = parseApplyPatch(input.patch);
+    staged = await stagePatch(operations, cwd);
+    await commit(staged);
+  } catch (error) {
+    return { ok: false, error: `ApplyPatch 失败：${(error as Error).message}` };
+  }
+
+  const files: FileActivityMetadata['files'] = [];
+  const summaries: string[] = [];
+  for (const file of staged) {
+    const afterText = file.after ?? '';
+    const patch = buildPatchSummary(file.beforeText, afterText, file.label);
+    const metadata = await fileActivityMetadata(
+      file.path,
+      file.activity,
+      'not_run',
+      'support',
+      cwd,
+      patch,
+    );
+    if (metadata) files.push(...metadata.files);
+    if (file.after === undefined)
+      context?.sessionState?.fileReads.entries.delete(file.path);
+    else
+      recordRead(
+        file.path,
+        {
+          contentHash: hashFileBytes(encodeTextFile(file.after, file.encoding)),
+        },
+        context?.sessionState?.fileReads,
+      );
+    emitFileMutation(file.path);
+    summaries.push(
+      `${file.activity}: ${file.label} (+${patch.additions} -${patch.deletions})`,
+    );
+  }
+  return {
+    ok: true,
+    content: `已应用补丁：\n${summaries.map((line) => `- ${line}`).join('\n')}`,
+    ...(files.length
+      ? { metadata: { kind: 'file_activity', files } as FileActivityMetadata }
+      : {}),
+  };
+}
+
+export const applyPatchTool: Tool<ApplyPatchInput> = {
+  name: 'ApplyPatch',
+  description:
+    'Applies one Codex-style *** Begin Patch / *** End Patch transaction across text files. ' +
+    'Supports Add File, Update File, Delete File and Move to. All operations are parsed and validated before writing; runtime failures roll back files already changed by this call. Paths must stay inside the workspace.',
+  inputSchema: schema,
+  parameters: {
+    type: 'object',
+    properties: {
+      patch: {
+        type: 'string',
+        description: 'Complete Codex-style patch envelope',
+      },
+    },
+    required: ['patch'],
+  },
+  isReadOnly: false,
+  isConcurrencySafe: false,
+  maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
+  interruptBehavior: () => 'block',
+  call: (input) => call(input),
+  callWithContext: (input, _signal, context) => call(input, context),
+};

package/src/tools/bash/bash.js

@@ -115,6 +115,26 @@ const WIN_BASH = detectWindowsBash();
 function effectiveShellKind() {
     return process.platform === 'win32' && !WIN_BASH ? 'cmd' : 'bash';
 }
+/**
+ * 每台机器不同、只能运行时探测的 shell 方言警告（K1 事故修复的核心内容）。
+ * 单一出处：完整 description（下方）和 toolPromptGuides.ts 的压缩 override
+ * 都调这个函数，不允许各自抄一份文案——否则「压缩省 token」的那份会在
+ * 无 Git Bash 的机器上悄悄丢掉这条警告，模型照抄 POSIX 语法必挂
+ * （`mkdir -p` 在 cmd.exe 下不生成中间目录、`$VAR`/`export` 不存在）。
+ */
+export function bashShellNotice() {
+    if (process.platform !== 'win32')
+        return '';
+    return WIN_BASH
+        ? `# Shell (this machine)
+Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
+        : `# Shell (this machine) — IMPORTANT
+No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
+ - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
+ - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
+ - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
+\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`;
+}
 /**
  * G1：stdout / stderr 即时缓冲上限（各自）。命令狂输出（如 cat 大文件 / yes）时，
  * 在最终统一截断之前先把内存封顶，防 OOM。取最终展示截断阈值的 2 倍 —— 正常输出不受影响，
@@ -278,6 +298,7 @@ const parameters = toToolParameters(inputSchema);
 //   - 先点明"专用工具优先"的原则，把每类操作映射到对应工具
 //   - 再列 Bash 自身的使用规范（绝对路径 / 不 cd / 超时 / 多命令并行...）
 //   - 最后强调安全黑名单（让模型知道哪些命令会被拒，避免反复试）
+const shellNotice = bashShellNotice();
 const description = `Executes a given bash command and returns its output.
 
 The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile.
@@ -363,21 +384,7 @@ These execute normally; a \`⚠️ 警告:\` line is prepended to the output as
  - \`DELETE FROM ...\` (SQL row deletion; DROP/TRUNCATE are in level 2)
  - \`kubectl delete\`, \`terraform destroy\`
 
-Regular Git operations (commit, add, status, log, diff, pull, fetch, checkout <branch>, merge, rebase, etc.) run without extra restrictions.${process.platform !== 'win32'
-    ? ''
-    : WIN_BASH
-        ? `
-
-# Shell (this machine)
-Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
-        : `
-
-# Shell (this machine) — IMPORTANT
-No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
- - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
- - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
- - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
-\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`}`;
+Regular Git operations (commit, add, status, log, diff, pull, fetch, checkout <branch>, merge, rebase, etc.) run without extra restrictions.${shellNotice ? `\n\n${shellNotice}` : ''}`;
 // ---------------- 4. call() —— 真正干活 ----------------
 async function call(input, signal, context) {
     const command = input.command;

package/src/tools/bash/bash.ts

@@ -126,6 +126,26 @@ function effectiveShellKind(): ShellKind {
   return process.platform === 'win32' && !WIN_BASH ? 'cmd' : 'bash';
 }
 
+/**
+ * 每台机器不同、只能运行时探测的 shell 方言警告（K1 事故修复的核心内容）。
+ * 单一出处：完整 description（下方）和 toolPromptGuides.ts 的压缩 override
+ * 都调这个函数，不允许各自抄一份文案——否则「压缩省 token」的那份会在
+ * 无 Git Bash 的机器上悄悄丢掉这条警告，模型照抄 POSIX 语法必挂
+ * （`mkdir -p` 在 cmd.exe 下不生成中间目录、`$VAR`/`export` 不存在）。
+ */
+export function bashShellNotice(): string {
+  if (process.platform !== 'win32') return '';
+  return WIN_BASH
+    ? `# Shell (this machine)
+Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
+    : `# Shell (this machine) — IMPORTANT
+No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
+ - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
+ - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
+ - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
+\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`;
+}
+
 /**
  * G1：stdout / stderr 即时缓冲上限（各自）。命令狂输出（如 cat 大文件 / yes）时，
  * 在最终统一截断之前先把内存封顶，防 OOM。取最终展示截断阈值的 2 倍 —— 正常输出不受影响，
@@ -303,6 +323,8 @@ const parameters = toToolParameters(inputSchema);
 //   - 先点明"专用工具优先"的原则，把每类操作映射到对应工具
 //   - 再列 Bash 自身的使用规范（绝对路径 / 不 cd / 超时 / 多命令并行...）
 //   - 最后强调安全黑名单（让模型知道哪些命令会被拒，避免反复试）
+const shellNotice = bashShellNotice();
+
 const description = `Executes a given bash command and returns its output.
 
 The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile.
@@ -388,23 +410,7 @@ These execute normally; a \`⚠️ 警告:\` line is prepended to the output as
  - \`DELETE FROM ...\` (SQL row deletion; DROP/TRUNCATE are in level 2)
  - \`kubectl delete\`, \`terraform destroy\`
 
-Regular Git operations (commit, add, status, log, diff, pull, fetch, checkout <branch>, merge, rebase, etc.) run without extra restrictions.${
-  process.platform !== 'win32'
-    ? ''
-    : WIN_BASH
-      ? `
-
-# Shell (this machine)
-Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
-      : `
-
-# Shell (this machine) — IMPORTANT
-No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
- - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
- - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
- - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
-\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`
-}`;
+Regular Git operations (commit, add, status, log, diff, pull, fetch, checkout <branch>, merge, rebase, etc.) run without extra restrictions.${shellNotice ? `\n\n${shellNotice}` : ''}`;
 
 // ---------------- 4. call() —— 真正干活 ----------------
 async function call(input: BashInput, signal?: AbortSignal, context?: ToolCallContext): Promise<ToolResult> {

package/src/tools/capabilities.js

@@ -1,7 +1,7 @@
 const TOOL_CAPABILITIES = Object.freeze({
     Read: 'files.read', Glob: 'files.read', Grep: 'files.read',
     Snip: 'files.read',
-    Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write',
+    Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write', ApplyPatch: 'files.write',
     Bash: 'shell',
     PowerShell: 'shell', TaskOutput: 'background.process', TaskStop: 'background.process',
     Trash: 'files.trash',
@@ -9,9 +9,11 @@ const TOOL_CAPABILITIES = Object.freeze({
     Skill: 'skill.invoke', EnterWorktree: 'worktree.session', ExitWorktree: 'worktree.session',
     TerminalCapture: 'terminal.capture',
     LSP: 'code.intelligence', NotebookEdit: 'files.write',
-    WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser',
+    WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser', BrowserBatch: 'web.browser', BrowserCDP: 'web.browser',
     Download: 'network.download',
-    ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', Agent: 'subagent',
+    ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', AdvisorDecision: 'advisor',
+    Agent: 'subagent', AgentMessage: 'subagent', AgentList: 'subagent', AgentWait: 'subagent',
+    AgentInterrupt: 'subagent', AgentFollowup: 'subagent',
     PresentResult: 'delivery', GenerateImage: 'media', GenerateSpeech: 'media',
     RecallMemory: 'memory', RememberMemory: 'memory', UpdateMemory: 'memory',
     ListMemories: 'memory', ForgetMemory: 'memory', SetPersona: 'memory',
@@ -19,9 +21,12 @@ const TOOL_CAPABILITIES = Object.freeze({
     SearchConversations: 'memory',
 });
 const CORE_TOOLS = new Set([
-    'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'NotebookEdit', 'Bash',
+    'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'ApplyPatch', 'NotebookEdit', 'Bash',
+]);
+const AUXILIARY_TOOLS = new Set([
+    'Advisor', 'AdvisorDecision', 'Agent', 'AgentMessage', 'AgentList',
+    'AgentWait', 'AgentInterrupt', 'AgentFollowup',
 ]);
-const AUXILIARY_TOOLS = new Set(['Advisor', 'Agent']);
 export function budgetClassForToolName(name) {
     if (CORE_TOOLS.has(name))
         return 'core';

package/src/tools/capabilities.ts

@@ -26,7 +26,7 @@ export type ToolBudgetClass = 'core' | 'task' | 'auxiliary';
 const TOOL_CAPABILITIES: Readonly<Record<string, CapabilityId>> = Object.freeze({
   Read: 'files.read', Glob: 'files.read', Grep: 'files.read',
   Snip: 'files.read',
-  Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write',
+  Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write', ApplyPatch: 'files.write',
   Bash: 'shell',
   PowerShell: 'shell', TaskOutput: 'background.process', TaskStop: 'background.process',
   Trash: 'files.trash',
@@ -34,9 +34,11 @@ const TOOL_CAPABILITIES: Readonly<Record<string, CapabilityId>> = Object.freeze(
   Skill: 'skill.invoke', EnterWorktree: 'worktree.session', ExitWorktree: 'worktree.session',
   TerminalCapture: 'terminal.capture',
   LSP: 'code.intelligence', NotebookEdit: 'files.write',
-  WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser',
+  WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser', BrowserBatch: 'web.browser', BrowserCDP: 'web.browser',
   Download: 'network.download',
-  ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', Agent: 'subagent',
+  ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', AdvisorDecision: 'advisor',
+  Agent: 'subagent', AgentMessage: 'subagent', AgentList: 'subagent', AgentWait: 'subagent',
+  AgentInterrupt: 'subagent', AgentFollowup: 'subagent',
   PresentResult: 'delivery', GenerateImage: 'media', GenerateSpeech: 'media',
   RecallMemory: 'memory', RememberMemory: 'memory', UpdateMemory: 'memory',
   ListMemories: 'memory', ForgetMemory: 'memory', SetPersona: 'memory',
@@ -45,9 +47,12 @@ const TOOL_CAPABILITIES: Readonly<Record<string, CapabilityId>> = Object.freeze(
 });
 
 const CORE_TOOLS = new Set([
-  'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'NotebookEdit', 'Bash',
+  'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'ApplyPatch', 'NotebookEdit', 'Bash',
+]);
+const AUXILIARY_TOOLS = new Set([
+  'Advisor', 'AdvisorDecision', 'Agent', 'AgentMessage', 'AgentList',
+  'AgentWait', 'AgentInterrupt', 'AgentFollowup',
 ]);
-const AUXILIARY_TOOLS = new Set(['Advisor', 'Agent']);
 
 export function budgetClassForToolName(name: string): ToolBudgetClass {
   if (CORE_TOOLS.has(name)) return 'core';

package/src/tools/computeruse/computerIntent.js

@@ -0,0 +1,32 @@
+const CONTINUATION_WINDOW_MS = 30 * 60_000;
+const CONTINUATION_ONLY = /^(?:请)?(?:继续|接着(?:做|操作)?|重试|再试一次|往下做|恢复操作)[。！!\s]*$/i;
+const DIRECT_DESKTOP = /(?:操作(?:电脑|桌面|屏幕|窗口|系统|本机)|电脑自动化|桌面自动化|查看(?:当前)?(?:桌面|屏幕|前台窗口)|截(?:取)?(?:当前)?屏|系统设置|控制面板|任务管理器|资源管理器|访达|Finder)/i;
+const GUI_ACTION = /(?:点击|双击|右键|拖拽|滚动|输入|粘贴|按(?:键|快捷键)|切换|激活|关闭|移动|调整窗口|发送|发布|上传)/i;
+const APP_TARGET = /(?:在|用|打开|切换到|进入)[^，。\n]{0,28}(?:应用|软件|客户端|微信|WeChat|钉钉|飞书|Slack|QQ|邮件|Outlook|Word|Excel|PowerPoint|设置|窗口)(?:里|中|上|内|给|向|并|，|。|\s|$)/i;
+const DISCUSSION_ONLY = /(?:解释|介绍|讨论|分析|评审|代码|源码|实现|设计|为什么|是什么|如何实现|测试.*ComputerUse|ComputerUse.*测试)/i;
+const DIRECT_TOOL_TASK = /(?:读取|分析|查看|理解).{0,12}(?:图片|照片|截图文件|PDF|文件|附件)|(?:搜索|修改|编写|重构|构建|运行测试|查找).{0,12}(?:代码|文件|网页)|(?:搜索网页|打开网址|访问网站|网页中)/i;
+/**
+ * Conservative, deterministic exposure classifier. It only consumes the
+ * current human input and a short-lived record of a real prior ComputerUse
+ * call; model output, page content, and tool arguments can never enable it.
+ */
+export function classifyComputerAutomationIntent(input, continuation, now = Date.now()) {
+    const text = input.trim();
+    if (continuation
+        && now - continuation.lastUsedAt <= CONTINUATION_WINDOW_MS
+        && CONTINUATION_ONLY.test(text)) {
+        return { needed: true, source: 'continuation', reason: '继续最近一次桌面自动化任务' };
+    }
+    if (!text)
+        return { needed: false, source: 'none', reason: '没有桌面操作请求' };
+    if (DIRECT_TOOL_TASK.test(text) && !DIRECT_DESKTOP.test(text)) {
+        return { needed: false, source: 'none', reason: '专用文件、图片或 Web 工具可直接完成' };
+    }
+    if (DISCUSSION_ONLY.test(text) && !DIRECT_DESKTOP.test(text) && !GUI_ACTION.test(text)) {
+        return { needed: false, source: 'none', reason: '仅讨论桌面能力，没有要求实际操作' };
+    }
+    if (DIRECT_DESKTOP.test(text) || (GUI_ACTION.test(text) && APP_TARGET.test(text))) {
+        return { needed: true, source: 'explicit-current', reason: '用户明确要求操作原生桌面界面' };
+    }
+    return { needed: false, source: 'none', reason: '未发现明确的原生桌面操作意图' };
+}