mocode-ai 0.1.4 → 0.1.6

package/dist/tools/builtins/run-command.js

@@ -1,30 +1,62 @@
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { MAX_OUTPUT } from '../constants.js';
+import { getSandboxRoot, filterEnv, isCommandDenied } from '../../sandbox/index.js';
 // ---------- run_command ----------
 export const runCommandTool = {
     name: 'run_command',
-    description: '执行 shell 命令,返回合并的 stdout+stderr。默认超时 120 秒。用于跑测试、构建、git 等。',
+    description: 'Execute a shell command, returning combined stdout+stderr. Default timeout 120s. Use for running tests, builds, git, etc.',
     parameters: {
         type: 'object',
         properties: {
-            command: { type: 'string', description: '要执行的命令(单行)' },
-            timeout: { type: 'integer', description: '超时毫秒,默认120000' },
+            command: { type: 'string', description: 'Command to execute (single line)' },
+            timeout: { type: 'integer', description: 'Timeout in milliseconds, default 120000' },
         },
         required: ['command'],
     },
-    async execute(args) {
+    async execute(args, ctx) {
         const command = String(args.command);
         const timeout = Number(args.timeout ?? 120000);
+        // 沙箱 best-effort:灾难性文件操作 denylist(非安全边界,只挡误操作;真隔离需 OS jailer)。
+        const deny = isCommandDenied(command);
+        if (deny)
+            return `错误:${deny}`;
         return new Promise((done) => {
             const isWin = process.platform === 'win32';
-            const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/c', command] : ['-c', command], { cwd: process.cwd() });
+            // 沙箱 best-effort:cwd 钉死 sandbox root(相对路径写落在牢内)+ env 脱敏(剥 *KEY/*TOKEN 等,防 LLM_API_KEY 泄子进程)
+            const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/c', command] : ['-c', command], { cwd: getSandboxRoot() ?? process.cwd(), env: filterEnv(process.env) });
             let out = '';
             let finished = false;
+            let timer;
+            // 杀整棵进程树。child.kill() 在 Windows 只杀 cmd.exe、npm 等子进程会孤儿继续跑(占锁、污染下一步),
+            // 故 Win 用 taskkill /T /F 树杀;Unix child.kill('SIGTERM')(bash -c 通常转发给前台子进程,best-effort)。
+            const killTree = () => {
+                try {
+                    if (isWin) {
+                        if (child.pid != null) {
+                            spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
+                                stdio: 'ignore',
+                            });
+                        }
+                    }
+                    else {
+                        child.kill('SIGTERM');
+                    }
+                }
+                catch {
+                    // 进程已退出 / kill 失败:忽略(close 事件会兜底 finish)
+                }
+            };
+            // abort(用户 Ctrl+C,经 executeTool ctx.signal 透传)→ 杀子进程树 + 返[已中断]
+            const onAbort = () => {
+                killTree();
+                finish(`[已中断]\n${out.trim()}`);
+            };
             const finish = (s) => {
                 if (finished)
                     return;
                 finished = true;
                 clearTimeout(timer);
+                ctx?.signal?.removeEventListener('abort', onAbort);
                 done(s);
             };
             const onChunk = (chunk) => {
@@ -40,10 +72,17 @@ export const runCommandTool = {
                     r += '\n...(输出已截断)';
                 finish(`[退出码 ${code}]\n${r || '(无输出)'}`);
             });
-            const timer = setTimeout(() => {
-                child.kill();
+            timer = setTimeout(() => {
+                killTree();
                 finish(`[超时,已终止]\n${out.trim()}`);
             }, timeout);
+            // 外部 abort signal:已 aborted 即时杀(防御;agent 循环顶检查通常会先拦),否则挂监听
+            if (ctx?.signal) {
+                if (ctx.signal.aborted)
+                    onAbort();
+                else
+                    ctx.signal.addEventListener('abort', onAbort, { once: true });
+            }
         });
     },
 };

package/dist/tools/builtins/switch-mode.js

@@ -0,0 +1,46 @@
+import { setAgentMode, getAgentMode } from '../../agent/mode.js';
+// ---------- switch_mode ----------
+export const switchModeTool = {
+    name: 'switch_mode',
+    description: [
+        'Switch the agent mode between "plan" (read-only investigation + planning) and "auto" (full tool execution).',
+        'In plan mode, write_file / edit_file / run_command / memory_save / memory_update / memory_forget are disabled; in auto mode, all tools are available.',
+        'Use this to autonomously transition from planning to execution WITHIN THE SAME TURN: investigate in plan mode, produce a plan, then call switch_mode("auto") and continue implementing it in the same turn — ONLY when the user has explicitly asked you to "plan first then execute" / "先 plan 再 auto" / autonomous execution.',
+        'Do NOT switch to auto if the user entered plan mode manually (via /plan or Shift+Tab) for a safety review — in that case present the plan and STOP; the user will approve via a prompt and execution happens in a follow-up turn.',
+        'Switching to plan from auto is rarely needed; do it only if you realize you should investigate before changing anything.',
+    ].join(' '),
+    parameters: {
+        type: 'object',
+        properties: {
+            mode: {
+                type: 'string',
+                enum: ['auto', 'plan'],
+                description: 'Target mode: "plan" (read-only) or "auto" (full tools)',
+            },
+        },
+        required: ['mode'],
+    },
+    async execute(args) {
+        const target = String(args.mode);
+        if (target !== 'auto' && target !== 'plan') {
+            return `错误:mode 必须是 "auto" 或 "plan",收到 "${target}"`;
+        }
+        const prev = getAgentMode();
+        if (prev === target) {
+            return `已在 ${target} 模式,无需切换。`;
+        }
+        setAgentMode(target); // 触发 listener:repl 重写 history[0] 系统提示 + 刷状态行 modeTag
+        if (target === 'auto') {
+            return [
+                `已从 plan 切换到 auto 模式。`,
+                `写盘 / 命令 / 记忆写入工具(write_file / edit_file / run_command / memory_save / memory_update / memory_forget)现已恢复可用。`,
+                `请按你刚才产出的计划继续执行(同一轮内,无需重述计划)。`,
+            ].join('\n');
+        }
+        return [
+            `已从 auto 切换到 plan 模式(只读探查)。`,
+            `写盘 / 命令 / 记忆写入工具已禁用;只用 read_file / glob / grep / codegraph / web_search / web_fetch / use_skill / ask_human / memory_search / memory_list 探查。`,
+            `产出计划后 STOP 等用户审批,或(若用户要求自主执行)再调 switch_mode("auto") 续跑。`,
+        ].join('\n');
+    },
+};

package/dist/tools/builtins/task.js

@@ -0,0 +1,62 @@
+import { spawnAgent } from '../../agent/spawn.js';
+import { MAX_OUTPUT } from '../constants.js';
+// ---------- task ----------
+// 派生子 agent 执行独立子任务。子 agent 有独立 history(不污染主对话),
+// 可受限工具子集 + 低步数上限,最终摘要回灌主 history 供主 agent 继续。
+//
+// 适用:并行探查多个文件 / 分而治之的复杂任务 / 隔离上下文避免子任务工具噪声撑爆主窗口。
+// 子 agent 中间过程不写主屏,只返回最终摘要;主 agent 据摘要决定下一步。
+export const taskTool = {
+    name: 'task',
+    description: [
+        'Spawn a sub-agent to handle an isolated sub-task with its own conversation history (independent of the main thread). The sub-agent runs to completion and returns a concise summary.',
+        'Use when: a task can be decomposed into independent sub-tasks, you want to explore multiple files/areas without polluting the main history, or a sub-task involves many tool calls that would bloat the main context window.',
+        'The sub-agent has its own history; only its final summary is returned to you as the tool result. It cannot recursively spawn further sub-agents (no "task" tool available to it).',
+        'Optionally restrict the sub-agent to a subset of tools (e.g. read-only tools for pure investigation) via the "tools" parameter.',
+    ].join(''),
+    parameters: {
+        type: 'object',
+        properties: {
+            prompt: {
+                type: 'string',
+                description: 'The sub-task instruction for the sub-agent. Be specific about what to investigate/implement and what to report back.',
+            },
+            tools: {
+                type: 'array',
+                items: { type: 'string' },
+                description: 'Optional whitelist of tool names the sub-agent is allowed to use (e.g. ["read_file","glob","grep","codegraph"] for read-only investigation). Omit to allow all tools.',
+            },
+            maxSteps: {
+                type: 'number',
+                description: 'Optional step limit for the sub-agent (default 50). Lower if the sub-task should be quick.',
+            },
+        },
+        required: ['prompt'],
+    },
+    async execute(args, ctx) {
+        const prompt = String(args.prompt ?? '');
+        if (!prompt)
+            return '错误:缺少 prompt(子任务指令)。';
+        const tools = Array.isArray(args.tools)
+            ? args.tools.map((t) => String(t))
+            : undefined;
+        const maxSteps = typeof args.maxSteps === 'number' && args.maxSteps > 0
+            ? Math.floor(args.maxSteps)
+            : undefined;
+        // 透传主 agent 的 abort signal:主 Ctrl+C 树杀子 agent(chat abort + 工具 abort)。
+        const result = await spawnAgent({ prompt, tools, maxSteps, signal: ctx?.signal });
+        if (!result.completed) {
+            return '子 agent 被中断,未完成。';
+        }
+        if (!result.summary) {
+            return '子 agent 完成但未返回文本摘要(可能只调了工具或达到步数上限)。';
+        }
+        // 摘要可能很长,截到 MAX_OUTPUT 保主 history 不爆。
+        const summary = result.summary;
+        if (summary.length > MAX_OUTPUT) {
+            return (summary.slice(0, MAX_OUTPUT) +
+                `\n\n…(子 agent 摘要已截断 ${summary.length - MAX_OUTPUT} 字符)`);
+        }
+        return summary;
+    },
+};

package/dist/tools/builtins/use-skill.js

@@ -4,13 +4,13 @@ import { getSkillBody } from '../../skills/index.js';
 // 系统提示里已列出可用 skill 的 name + description(何时用),模型据此决定调用。
 export const useSkillTool = {
     name: 'use_skill',
-    description: '加载并返回某个 skill 的完整 SKILL.md 指令(传 name)。何时用见系统提示的 skill 列表。',
+    description: 'Load and return the full SKILL.md instructions for a given skill (pass name). See the skill list in the system prompt for when to use each.',
     parameters: {
         type: 'object',
         properties: {
             name: {
                 type: 'string',
-                description: '要加载的 skill 名(见系统提示里的 skill 列表,或 /skills 命令)',
+                description: 'Name of the skill to load (see the skill list in the system prompt, or the /skills command)',
             },
         },
         required: ['name'],

package/dist/tools/builtins/web-fetch.js

@@ -4,15 +4,15 @@ const UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
 // ---------- web_fetch ----------
 export const webFetchTool = {
     name: 'web_fetch',
-    description: '抓取指定 URL 的网页内容并清洗成纯文本(去 HTML 标签/脚本/样式,保留正文)。用于读取搜索结果里的某个链接、或用户给出的具体 URL。',
+    description: 'Fetch the web page at a given URL and clean it into plain text (strips HTML tags/scripts/styles, keeps the body). Use to read a link from search results, or a specific URL given by the user.',
     parameters: {
         type: 'object',
         properties: {
-            url: { type: 'string', description: '要抓取的完整 URL,须 http/https' },
+            url: { type: 'string', description: 'Full URL to fetch; must be http/https' },
         },
         required: ['url'],
     },
-    async execute(args) {
+    async execute(args, ctx) {
         const rawUrl = String(args.url ?? '').trim();
         if (!rawUrl)
             return '错误:url 不能为空。';
@@ -28,6 +28,15 @@ export const webFetchTool = {
         }
         const ctrl = new AbortController();
         const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+        // 外部 abort signal(用户 Ctrl+C,经 executeTool ctx.signal 透传)→ 合并到 ctrl,fetch 即时取消(不等 30s 超时)
+        const onExternalAbort = () => ctrl.abort();
+        const externalSignal = ctx?.signal;
+        if (externalSignal) {
+            if (externalSignal.aborted)
+                ctrl.abort();
+            else
+                externalSignal.addEventListener('abort', onExternalAbort, { once: true });
+        }
         try {
             const resp = await fetch(url.href, {
                 method: 'GET',
@@ -56,6 +65,8 @@ export const webFetchTool = {
         }
         catch (e) {
             if (ctrl.signal.aborted) {
+                if (externalSignal?.aborted)
+                    return `错误:已中断: ${url.href}`;
                 return `错误:抓取超时(${FETCH_TIMEOUT_MS}ms): ${url.href}`;
             }
             const msg = e instanceof Error ? e.message : String(e);
@@ -63,6 +74,8 @@ export const webFetchTool = {
         }
         finally {
             clearTimeout(timer);
+            if (externalSignal)
+                externalSignal.removeEventListener('abort', onExternalAbort);
         }
     },
 };

package/dist/tools/builtins/web-search.js

@@ -6,20 +6,20 @@ const MAX_CONTENT_CHARS = 800;
 // ---------- web_search ----------
 export const webSearchTool = {
     name: 'web_search',
-    description: '联网搜索(AnySearch)。返回每条结果的标题/URL/摘要/正文。可选 tag 切换子域(见 tag 参数)。',
+    description: 'Search the web (AnySearch). Returns title/url/snippet/body for each result. Optional tag to switch sub-domain capability (see tag param).',
     parameters: {
         type: 'object',
         properties: {
-            query: { type: 'string', description: '搜索查询词' },
-            max_results: { type: 'integer', description: '返回条数,1-20,默认 10' },
+            query: { type: 'string', description: 'Search query' },
+            max_results: { type: 'integer', description: 'Number of results, 1-20, default 10' },
             tag: {
                 type: 'string',
-                description: '子域能力标签,如 general.general / code.doc / code.snippet;不传走通用搜索',
+                description: 'Sub-domain capability tag, e.g. general.general / code.doc / code.snippet; omit for general search',
             },
-            language: { type: 'string', description: '偏好语言,如 zh-CN / en,默认 zh-CN' },
+            language: { type: 'string', description: 'Preferred language, e.g. zh-CN / en, default zh-CN' },
             params: {
                 type: 'object',
-                description: '特定 tag 的扩展参数,如 code.doc 的 {"library":"golang"};通用搜索不需要',
+                description: 'Extended params for a specific tag, e.g. {"library":"golang"} for code.doc; not needed for general search',
             },
         },
         required: ['query'],

package/dist/tools/builtins/write-file.js

@@ -3,12 +3,12 @@ import { resolve, dirname } from 'node:path';
 // ---------- write_file ----------
 export const writeFileTool = {
     name: 'write_file',
-    description: '创建或覆盖文件,自动创建父目录。',
+    description: 'Create or overwrite a file, creating parent directories as needed.',
     parameters: {
         type: 'object',
         properties: {
-            path: { type: 'string', description: '文件路径' },
-            content: { type: 'string', description: '完整文件内容' },
+            path: { type: 'string', description: 'File path' },
+            content: { type: 'string', description: 'Full file content' },
         },
         required: ['path', 'content'],
     },

package/dist/tools/constants.js

@@ -22,3 +22,19 @@ export const GC_DAYS = 90;
 /** memory_search 结果(召回的记忆正文)的放宽上限:指令性内容,中截破坏语义,对齐 use_skill。 */
 export const MAX_MEMORY_RESULT = 64000;
 export const IGNORE = ['**/node_modules/**', '**/.git/**'];
+// ── plan 模式(只读规划,不执行)──────────────────────────────────────────────
+/**
+ * plan 模式下从工具 schema 里剔除的工具(模型根本看不到 → 调不到):
+ * 写盘 / 命令 / 记忆写入类 + task(派生子 agent,plan 模式只读不可有副作用)。单一事实源,
+ * 被 llm(planChatTools)与 agent(防御 backstop)共用。
+ * 只读工具(read_file/glob/grep/codegraph/web_search/web_fetch/use_skill/ask_human/memory_search/memory_list)保留。
+ */
+export const PLAN_DISABLED_TOOLS = new Set([
+    'write_file',
+    'edit_file',
+    'run_command',
+    'memory_save',
+    'memory_update',
+    'memory_forget',
+    'task',
+]);

package/dist/tools/registry.js

@@ -1,12 +1,18 @@
 import { builtinTools } from './builtins/index.js';
 import { recordMutation } from '../rollback/index.js';
+import { enforceSandbox } from '../sandbox/index.js';
 /**
  * 工具注册表。当前 = 内置工具;
  * 未来可在此合并 MCP 工具、用户自定义工具等(见 src/mcp/)。
  */
 export const tools = builtinTools;
-/** 按名调度工具,统一 try/catch + JSON 解析,返回字符串而非抛错。 */
-export async function executeTool(name, argsRaw) {
+/**
+ * 按名调度工具,统一 try/catch + JSON 解析,返回字符串而非抛错。
+ * signal 透传给 tool.execute(经 ctx):长任务工具(run_command/web_fetch)abort 即时取消,
+ * 让用户 Ctrl+C 能跟手中断工具执行(而非等命令跑完 / 超时)。
+ * opts.skipRollback:子 agent 逻辑隔离用——跳过 recordMutation,子 agent 改动不进主回滚快照链。
+ */
+export async function executeTool(name, argsRaw, signal, opts) {
     const tool = tools.find((t) => t.name === name);
     if (!tool)
         return `错误:未知工具 "${name}"`;
@@ -18,13 +24,21 @@ export async function executeTool(name, argsRaw) {
         return `错误:工具 ${name} 的 arguments 不是合法 JSON: ${argsRaw}`;
     }
     try {
+        // 沙箱:路径类工具(读/写/改)越界拒绝 + args.path 重写为牢内绝对;glob/grep pattern 校验。
+        // 返 string = 拒绝(直接喂 LLM,不执行);返 null = 放行(可能已重写 args.path)。
+        // 须在 recordMutation 前:让快照路径 = 牢内绝对路径,与回滚一致。不抛(契约:调度器永不抛错)。
+        const sbErr = enforceSandbox(name, args);
+        if (sbErr)
+            return sbErr;
         // 撤销回滚用:write_file/edit_file 改动前记 before 快照(回滚时恢复到轮末状态)。
-        if ((name === 'write_file' || name === 'edit_file') &&
+        // 子 agent(skipRollback)跳过:其改动不进主回滚链,主 /rollback 不撤销(靠 git 兜底)。
+        if (!opts?.skipRollback &&
+            (name === 'write_file' || name === 'edit_file') &&
             typeof args.path === 'string' &&
             args.path) {
             recordMutation(args.path);
         }
-        return await tool.execute(args);
+        return await tool.execute(args, { signal, skipRollback: opts?.skipRollback });
     }
     catch (e) {
         return `错误:工具 ${name} 执行失败: ${e instanceof Error ? e.message : String(e)}`;

package/dist/ui/content.js

@@ -2,7 +2,7 @@
  * 内容物理行缓冲(Phase 2 滚动回滚用)。
  *
  * 存折行后的物理行,每行自洽带色,供 layout.repaintViewport 单行直出、无需继承 SGR 状态。
- * contentWrite 逐字符喂入(feedChar / feedSgr / breakRow);eraseSegmentBack 用 popRows 同步删段。
+ * contentWrite 逐字符喂入(feedChar / feedSgr / breakRow);setLines 替换当前段(md 流式渲染用)。
  *
  * **SGR 自洽模型**:每行存 `rowStartSgr + curRaw + \x1B[0m`:
  *  - rowStartSgr:本行起始时继承的活跃 SGR 前缀(来自上一行末状态);
@@ -23,7 +23,7 @@ let curSgr = ''; // 当前活跃 SGR 状态(行内演进;行末值 = 下行继
 let rowStartSgr = ''; // 当前行起始继承的 SGR 前缀
 let curRaw = ''; // 当前行原始字节(可见 + 行内 SGR 码)
 let hasCurrent = false; // 是否有当前行(feed/breakRow 后;新空行也算)
-let segMark = null; // 段起点快照(供 eraseSegment 恢复)
+let segMark = null; // 段起点快照(md 段:setLines 截断用,commitSegment 清)
 export function reset() {
     rows = [];
     curSgr = '';
@@ -55,27 +55,35 @@ export function breakRow() {
     rowStartSgr = curSgr; // 下行继承本行末状态
     hasCurrent = true; // 新空行即当前行
 }
-/** 标记段(思考段)起点:快照当前缓冲状态,供 eraseSegment 恢复。 */
+/** 标记段起点:快照当前缓冲状态,供 setLines 截断定位段头(md 流式渲染每 chunk 截断重渲)。 */
 export function beginSegment() {
     segMark = { rowIdx: rows.length, rowStartSgr, curSgr, curRaw, hasCurrent };
 }
 /**
- * 删段并恢复到 beginSegment 时的状态;返回段物理行数(= segLines + 末行部分,与屏幕擦除行数一致)。
- * 段足迹 = 自 mark 后提交的行(committedErased)+ 当前行若有内容(currentErased)。
- * 恢复后当前行 = 段起点的那一行(折叠标题将写入此处),保证滚动回看只看到标题、不看到原文。
+ * 用预渲染的自洽 ANSI 行替换当前段(从 segMark 起),供 markdown 流式渲染:
+ * layout.contentWriteMd 每 chunk 把累积 text 经 renderMarkdown 渲成自洽行,调此替换缓冲段。
+ * 截断 rows 到 segMark.rowIdx(擦上次渲染)+ push 新行;curSgr 复位为默认(行末 reset);
+ * **保留 segMark**(下次 setLines 还要截断),由 commitSegment 清除。
+ * 行须各自自洽(行内 SGR 自带、行末 reset)——不经 feedChar/feedSgr,直接入 rows,
+ * 故 setLines 后 hasCurrent=false(snapshot 只返 rows;续写位由 layout 跟踪)。
  */
-export function eraseSegment() {
-    if (!segMark)
-        return 0;
-    const committedErased = rows.length - segMark.rowIdx;
-    const currentErased = hasCurrent && curRaw.length > 0 ? 1 : 0;
-    rows.length = segMark.rowIdx;
-    rowStartSgr = segMark.rowStartSgr;
-    curSgr = segMark.curSgr;
-    curRaw = segMark.curRaw;
-    hasCurrent = segMark.hasCurrent;
+export function setLines(lines) {
+    if (segMark) {
+        rows.length = segMark.rowIdx;
+    }
+    for (const line of lines) {
+        rows.push(line);
+    }
+    if (rows.length > MAX_ROWS + 512)
+        rows.splice(0, rows.length - MAX_ROWS);
+    curSgr = '';
+    rowStartSgr = '';
+    curRaw = '';
+    hasCurrent = false;
+}
+/** 提交段:清 segMark,后续写入不再被 setLines 截断(md 段结束、非 md 内容接续时调)。 */
+export function commitSegment() {
     segMark = null;
-    return committedErased + currentErased;
 }
 /** 快照(已提交行 + 当前行若有)。viewport 取行窗用。 */
 function snapshot() {

package/dist/ui/diff.js

@@ -36,35 +36,37 @@ function langForPath(p) {
     }
     return LANG_BY_EXT[base];
 }
-/** 包一层:token 文本 + 颜色 + reset,自成闭区间(防 SGR 跨行泄漏)。 */
-const paint = (color) => (s) => `${color}${s}${ui.reset}`;
+/**
+ * 包一层:token 文本 + 颜色 + reset,自成闭区间(防 SGR 跨行泄漏)。
+ * 取 ColorKey 而非 ANSI 串——闭包调用时才读 `ui[key]`,故 setTheme 后 diff 高亮即跟随。 */
+const paint = (key) => (s) => `${ui[key]}${s}${ui.reset}`;
 /** 自定义主题:default=plain(未匹配文本不着色,避免默认主题把普通代码染黄),常见 token 用 mocode ui 色板。 */
 const THEME = {
     default: plain,
-    keyword: paint(ui.magenta),
-    'built_in': paint(ui.cyan),
-    type: paint(ui.cyan),
-    literal: paint(ui.cyan),
-    number: paint(ui.green),
-    string: paint(ui.green),
-    subst: paint(ui.green),
-    comment: paint(ui.gray),
-    doctag: paint(ui.gray),
-    function: paint(ui.blue),
-    title: paint(ui.blue),
-    class: paint(ui.brightCyan),
-    meta: paint(ui.gray),
-    'meta-keyword': paint(ui.magenta),
-    regexp: paint(ui.red),
-    attr: paint(ui.cyan),
-    attribute: paint(ui.cyan),
-    variable: paint(ui.red),
-    tag: paint(ui.red),
-    name: paint(ui.cyan),
-    symbol: paint(ui.cyan),
-    section: paint(ui.brightMagenta),
-    addition: paint(ui.green),
-    deletion: paint(ui.red),
+    keyword: paint('magenta'),
+    'built_in': paint('cyan'),
+    type: paint('cyan'),
+    literal: paint('cyan'),
+    number: paint('green'),
+    string: paint('green'),
+    subst: paint('green'),
+    comment: paint('gray'),
+    doctag: paint('gray'),
+    function: paint('blue'),
+    title: paint('blue'),
+    class: paint('brightCyan'),
+    meta: paint('gray'),
+    'meta-keyword': paint('magenta'),
+    regexp: paint('red'),
+    attr: paint('cyan'),
+    attribute: paint('cyan'),
+    variable: paint('red'),
+    tag: paint('red'),
+    name: paint('cyan'),
+    symbol: paint('cyan'),
+    section: paint('brightMagenta'),
+    addition: paint('green'),
+    deletion: paint('red'),
 };
 function highlightLine(text, lang) {
     if (!lang || text === '')

package/dist/ui/intervention.js

@@ -3,6 +3,7 @@ import { stdin, stderr } from 'node:process';
 import { ui } from './theme.js';
 import { displayWidth, truncateDisplay } from './render.js';
 import * as layout from './layout.js';
+import * as mouse from './mouse.js';
 import { Spinner } from './spinner.js';
 const emitter = stdin;
 /** choice 末尾的"自定义输入"项标签(纯 ASCII,宽度安全)。选中后切到 input 子态。 */
@@ -128,8 +129,9 @@ export async function promptIntervention(req) {
             emitter.on('keypress', l);
         savedListeners = [];
         // 先 paintInput(dim,menu:null):擦菜单(用 lastMenuRows)+ 画 dim 占位底栏 + 复位 lastMenuRows=0;
-        // 再 repaintViewport:从 content 缓冲重画内容区(恢复被菜单覆盖的 ● ask_human 行)。
-        // 顺序不可反——repaintViewport 后再 paintInput(menu:null) 会用 stale lastMenuRows 擦掉已恢复的内容。
+        // 再处理滚动:面板内可能滚过滚轮(scrollOffset>0)→ resetScroll 回尾让 agent 后续输出可见;
+        //   未滚则 repaintViewport 从 content 缓冲重画内容区(恢复被菜单覆盖的 ● ask_human 行)。
+        // 顺序不可反——resetScroll/repaintViewport 在菜单还在(lastMenuRows>0)时会用内容覆盖菜单区,擦不掉菜单。
         layout.paintInput({
             prompt: '❯ ',
             lines: [''],
@@ -138,11 +140,24 @@ export async function promptIntervention(req) {
             menu: null,
             dim: true,
         });
-        layout.repaintViewport();
+        if (layout.isScrolled())
+            layout.resetScroll();
+        else
+            layout.repaintViewport();
     }
     function onKey(_str, key) {
         if (resolved || !key)
             return;
+        // SGR 鼠标 fragment:readline 拆碎 \x1B[<…M,经 mouse.consumeMouse 重组;
+        // 滚轮 → scrollBy(±5) 滚动查看 agent 输出内容(菜单只靠 ↑↓ 选,滚轮不选菜单);
+        // fragment 期间 suppress 吞掉防砸进 onKeyInput 的可打印插入。菜单经 scrollBy 末尾
+        // repaint()→paintInput(lastView) 重画,不被 viewport 滚动覆盖。
+        const _m = mouse.consumeMouse(key.sequence ?? '');
+        if (_m.suppress) {
+            if (_m.wheel)
+                layout.scrollBy(_m.wheel * 5);
+            return;
+        }
         // Ctrl+C → 取消(不 reject SIGINT——否则经 executeTool 的 try/catch 变成 tool 错误串)
         if (key.ctrl && key.name === 'c') {
             finish({ action: 'cancelled' });
@@ -158,6 +173,12 @@ export async function promptIntervention(req) {
             finish({ action: 'cancelled' });
             return;
         }
+        // PgUp/PgDn:翻页滚动查看 agent 输出内容(与 onRunningKey/prompt.ts 一致;↑↓ 仍归菜单导航,不抢)。
+        if (key.name === 'pageup' || key.name === 'pagedown') {
+            const pageH = layout.getGeo().contentBottom;
+            layout.scrollBy(key.name === 'pageup' ? pageH : -pageH);
+            return;
+        }
         if (mode === 'choice') {
             onKeyChoice(key);
         }