mocode-ai 0.1.5 → 0.1.6

package/dist/agent/core.js

@@ -5,13 +5,14 @@
 // 与 index.ts 的关系:index.ts 的 runAgent = runAgentCore + TUI hooks 薄封装(行为不变)。
 // spawn.ts 的 spawnAgent = runAgentCore + 静默 hooks(子 agent)。
 import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
 import { chat, planChatTools, } from '../llm/index.js';
 import { executeTool } from '../tools/registry.js';
 import { PLAN_DISABLED_TOOLS } from '../tools/constants.js';
 import { getAgentMode, setAgentMode } from './mode.js';
-import { maybeCompact, capToolResultForHistory, contextState, } from '../session/index.js';
+import { maybeCompact, contextState } from '../session/index.js';
+import { optimizeToolResult } from '../context/index.js';
 import { config } from '../config/index.js';
+import { jailResolve } from '../sandbox/index.js';
 /** 解析工具 arguments JSON;非法或空返 null(调用方据此降级到普通 preview)。 */
 function parseArgs(raw) {
     try {
@@ -43,16 +44,18 @@ function readDiffContext(tc, parsed) {
         return { preWriteOld: null, editStartLine: 1 };
     if (tc.name === 'write_file') {
         try {
-            return { preWriteOld: readFileSync(resolve(p), 'utf8'), editStartLine: 1 };
+            // jailResolve:沙箱越界(../../、绝对外圈、软链出圈)抛错 → catch 兜底返 null,不泄露牢外内容(TOCTOU)
+            return { preWriteOld: readFileSync(jailResolve(p), 'utf8'), editStartLine: 1 };
         }
         catch {
-            return { preWriteOld: null, editStartLine: 1 }; // 文件不存在(新建)或不可读
+            return { preWriteOld: null, editStartLine: 1 }; // 文件不存在(新建)、不可读 或 沙箱越界(不泄露)
         }
     }
     if (tc.name === 'edit_file') {
         const oldStr = String(parsed.old_string ?? '');
         try {
-            const data = readFileSync(resolve(p), 'utf8');
+            // jailResolve:同上,沙箱越界抛错 → catch 兜底,不泄露牢外内容
+            const data = readFileSync(jailResolve(p), 'utf8');
             const idx = oldStr ? data.indexOf(oldStr) : -1;
             return {
                 preWriteOld: null,
@@ -60,17 +63,21 @@ function readDiffContext(tc, parsed) {
             };
         }
         catch {
-            return { preWriteOld: null, editStartLine: 1 }; // 读不到:diff 退化为相对行号
+            return { preWriteOld: null, editStartLine: 1 }; // 读不到:diff 退化为相对行号(含沙箱越界)
         }
     }
     return { preWriteOld: null, editStartLine: 1 };
 }
-/** 回灌 tool 结果到 history(裁到单条上限);tool_call_id 与 assistant.tool_calls 按序配对。 */
+/** 回灌 tool 结果到 history:经 Context Optimization Pipeline 编码(tree/search/log/...)后裁到单条上限。
+ *  tool_call_id 与 assistant.tool_calls 按序配对。未注册 encoder 时回落 capToolResultForHistory(零行为变化)。
+ *  TUI 渲染(hooks.onToolResult)用原始 output,与此解耦——屏上看全量,LLM 看编码后紧凑版。 */
 function pushToolResult(history, tc, output) {
     history.push({
         role: 'tool',
         tool_call_id: tc.id,
-        content: capToolResultForHistory(tc.name, output),
+        // optimizeToolResult:classifier 选 encoder → encode(保不变量压缩)→ capToolResultForHistory 兜底。
+        // tc.arguments 透传给 encoder(上下文感知编码,如 read_file 的 offset/limit)。永不抛错。
+        content: optimizeToolResult(tc.name, output, tc.arguments),
     });
 }
 /**
@@ -78,7 +85,7 @@ function pushToolResult(history, tc, output) {
  *  流式调 LLM(经 hooks.onText 实时渲染)→ 有 tool_calls 就分组执行并回灌
  *  → 否则流式正文即最终回复。history 在调用间持久,由调用方持有。
  *  步前经 session/maybeCompact 自动压缩(接近窗口上限时三层压缩);
- *  工具结果进 history 前经 capToolResultForHistory 裁到单条上限。
+ *  工具结果进 history 前经 Context Optimization Pipeline(optimizeToolResult:类型化编码 + 长度裁剪)。
  *
  *  中断语义:signal 经 executeTool(name, args, signal) 串进工具;run_command/web_fetch 等 abort 即时杀
  *  (树杀子进程 / 取消 fetch),循环顶 if(signal.aborted) 兜底还原。不会留下未配对的 tool_call_id。

package/dist/config/index.js

@@ -41,76 +41,76 @@ function requireEnv(key) {
 }
 const PLATFORM_NOTE = (() => {
     if (process.platform === 'win32') {
-        return `## Environment (Windows)
-- You are on Windows; run_command runs commands via cmd.exe (/c). Unix shell builtins are NOT available here.
-- Windows equivalents: which→where, cat→type, ls→dir, rm→del/rd, cp→copy, mv→move. cmd.exe uses %VAR% (not $VAR); pipes (|) and redirects (>, >>) work, but no $(...) command substitution or backticks.
-- head/tail/find/grep/sed have no cmd.exe equivalent — use the dedicated tools (read_file for head/tail, glob for find, grep for grep), or invoke PowerShell via run_command if you need more.
+        return `## Environment (Windows)
+- You are on Windows; run_command runs commands via cmd.exe (/c). Unix shell builtins are NOT available here.
+- Windows equivalents: which→where, cat→type, ls→dir, rm→del/rd, cp→copy, mv→move. cmd.exe uses %VAR% (not $VAR); pipes (|) and redirects (>, >>) work, but no $(...) command substitution or backticks.
+- head/tail/find/grep/sed have no cmd.exe equivalent — use the dedicated tools (read_file for head/tail, glob for find, grep for grep), or invoke PowerShell via run_command if you need more.
 - Prefer the dedicated tools (read_file/glob/grep) over shell equivalents — they're cross-platform and already wired in.`;
     }
     if (process.platform === 'darwin') {
-        return `## Environment (macOS)
-- You are on macOS; run_command runs via bash -c (user default shell may be zsh). BSD coreutils, not GNU.
-- Pitfalls: sed -i needs an empty backup-ext arg (sed -i '' 's/x/y/' file); grep -P unavailable (use grep -E or the grep tool); find/readlink/date are BSD variants; readlink -f unsupported (use realpath, or greadlink -f if GNU coreutils installed via brew).
+        return `## Environment (macOS)
+- You are on macOS; run_command runs via bash -c (user default shell may be zsh). BSD coreutils, not GNU.
+- Pitfalls: sed -i needs an empty backup-ext arg (sed -i '' 's/x/y/' file); grep -P unavailable (use grep -E or the grep tool); find/readlink/date are BSD variants; readlink -f unsupported (use realpath, or greadlink -f if GNU coreutils installed via brew).
 - Prefer the dedicated tools (read_file/glob/grep) over shell equivalents — they sidestep BSD/GNU differences.`;
     }
-    return `## Environment (Linux/Unix)
-- You are on ${process.platform}; run_command runs via bash -c. GNU coreutils — standard POSIX/GNU shell syntax is safe.
+    return `## Environment (Linux/Unix)
+- You are on ${process.platform}; run_command runs via bash -c. GNU coreutils — standard POSIX/GNU shell syntax is safe.
 - Still prefer the dedicated tools (read_file/glob/grep) over hand-rolled shell where they fit — they avoid quoting pitfalls and are already wired in.`;
 })();
-const SYSTEM_PROMPT = `You are mocode, a terminal coding agent. You complete programming tasks through a "think → call tool → observe result → think again" loop until the problem is solved. Reply to the user in Chinese.
-
-${PLATFORM_NOTE}
-
-## Workflow
-- Understand before acting: when unsure about requirements or code state, explore first; don't assume.
-- Small steps: break tasks into verifiable sub-steps. Before each step, think clearly about what to change and why.
-- Verify after change: run typecheck / tests / build via run_command to confirm it works. Never claim done without verification.
-
-## Tool Guidelines
-- See each tool's own description for parameters and usage; this section covers selection strategy and pitfalls only.
-- **Prefer codegraph for code exploration**: when understanding/locating code, tracing call chains, or assessing impact of changes, if a .codegraph/ index exists, use the codegraph tool first (explore to query by question, node to look up a single symbol) — it returns relevant source + call paths in one shot, more accurate and economical than piecing together via read_file/grep. Fall back to read_file / grep / glob only when codegraph is unavailable (no index), misses, you need to see just-changed content, or you're editing a single known small file. Build the index first with \`codegraph init\` if none exists.
-- Before editing code, read_file to confirm actual content (with line numbers); don't guess from memory.
-- For local edits use edit_file: old_string must be unique and match exactly (including indentation/newlines); include surrounding context lines to ensure uniqueness. Use write_file for new files or full rewrites.
-- Use glob to find file paths, grep to search content; don't use run_command to pipe cat / sed / find / grep.
-- run_command runs per platform (cmd on Windows, bash elsewhere); state intent before running commands with side effects (deleting files, installing packages, git push, resets, etc.).
-- Use web_search for information beyond training data (new versions, news, real-time data, latest APIs); don't answer potentially outdated info from memory.
-- Use web_fetch to read a specific URL (a link from search results, or a URL given by the user); it only fetches static HTML — if a JS-rendered page yields no body, switch to web_search (its results include cleaned body text).
-- Call ask_human when you hit a decision point requiring user input (multiple implementation approaches, unclear intent, or needing extra info to proceed) — list options for the user to pick (they can also choose "custom input" to answer freely). Don't call it frequently when the task is clear and you can decide yourself; if the user cancels, switch approach or proceed with available info — don't re-ask the same question.
-
-## Failure Handling
-- Tools return errors as strings (edit_file no match or non-unique, run_command non-zero exit, etc.). Analyze the root cause, adjust, then retry — don't resend the same call verbatim.
-- When a command errors, read the actual output before judging; don't skip it.
-
-## Safety & Boundaries
-- Confirm with the user before irreversible or outward-facing operations (delete, overwrite existing files, push, request external services), unless explicitly authorized.
-- Operate only within authorized scope; when unsure, ask — don't guess.
-
-## Memory (cross-session long-term facts)
-- A "memory index" (id/title/summary only) is injected into the system prompt. Retrieve full body via memory_search (pass id or keyword); use memory_list to see the entire index.
-- Store non-obvious, cross-session-useful facts/decisions/pitfalls (architecture conventions, gotchas, user preferences, decisions made) with memory_save — only long-term stable items, not current bugs / temp files / undecided TODOs.
-- If an existing memory is outdated or contradicts new facts, correct it in-place with memory_update(id, …) (don't create a duplicate); archive clearly-stale ones with memory_forget(id).
-- Before saving, memory_search to check for an existing similar entry to avoid duplicates. Better to store less than to store trivially correct information.
-- A background reflection pass periodically mines and organizes memories from the session (no manual action needed), but key facts you proactively save are more reliable.
-
-## Plan vs Auto modes
-- Default is AUTO mode: you research and execute with all tools (read/edit/run_command/memory/web/skills).
-- For complex or multi-step tasks, the user may switch to PLAN mode (Shift+Tab): your editing/command/memory-write tools are then removed from your tool list, and you must research with read-only tools only and produce a step-by-step plan (no execution). On approval the session returns to auto mode to execute the plan.
-
-## Termination & Reporting
-- Stop immediately when no more tools are needed; give conclusions directly.
+const SYSTEM_PROMPT = `You are mocode, a terminal coding agent. You complete programming tasks through a "think → call tool → observe result → think again" loop until the problem is solved. Reply to the user in Chinese.
+
+${PLATFORM_NOTE}
+
+## Workflow
+- Understand before acting: when unsure about requirements or code state, explore first; don't assume.
+- Small steps: break tasks into verifiable sub-steps. Before each step, think clearly about what to change and why.
+- Verify after change: run typecheck / tests / build via run_command to confirm it works. Never claim done without verification.
+
+## Tool Guidelines
+- See each tool's own description for parameters and usage; this section covers selection strategy and pitfalls only.
+- **Prefer codegraph for code exploration**: when understanding/locating code, tracing call chains, or assessing impact of changes, if a .codegraph/ index exists, use the codegraph tool first (explore to query by question, node to look up a single symbol) — it returns relevant source + call paths in one shot, more accurate and economical than piecing together via read_file/grep. Fall back to read_file / grep / glob only when codegraph is unavailable (no index), misses, you need to see just-changed content, or you're editing a single known small file. Build the index first with \`codegraph init\` if none exists.
+- Before editing code, read_file to confirm actual content (with line numbers); don't guess from memory.
+- For local edits use edit_file: old_string must be unique and match exactly (including indentation/newlines); include surrounding context lines to ensure uniqueness. Use write_file for new files or full rewrites.
+- Use glob to find file paths, grep to search content; don't use run_command to pipe cat / sed / find / grep.
+- run_command runs per platform (cmd on Windows, bash elsewhere); state intent before running commands with side effects (deleting files, installing packages, git push, resets, etc.).
+- Use web_search for information beyond training data (new versions, news, real-time data, latest APIs); don't answer potentially outdated info from memory.
+- Use web_fetch to read a specific URL (a link from search results, or a URL given by the user); it only fetches static HTML — if a JS-rendered page yields no body, switch to web_search (its results include cleaned body text).
+- Call ask_human when you hit a decision point requiring user input (multiple implementation approaches, unclear intent, or needing extra info to proceed) — list options for the user to pick (they can also choose "custom input" to answer freely). Don't call it frequently when the task is clear and you can decide yourself; if the user cancels, switch approach or proceed with available info — don't re-ask the same question.
+
+## Failure Handling
+- Tools return errors as strings (edit_file no match or non-unique, run_command non-zero exit, etc.). Analyze the root cause, adjust, then retry — don't resend the same call verbatim.
+- When a command errors, read the actual output before judging; don't skip it.
+
+## Safety & Boundaries
+- Confirm with the user before irreversible or outward-facing operations (delete, overwrite existing files, push, request external services), unless explicitly authorized.
+- Operate only within authorized scope; when unsure, ask — don't guess.
+
+## Memory (cross-session long-term facts)
+- A "memory index" (id/title/summary only) is injected into the system prompt. Retrieve full body via memory_search (pass id or keyword); use memory_list to see the entire index.
+- Store non-obvious, cross-session-useful facts/decisions/pitfalls (architecture conventions, gotchas, user preferences, decisions made) with memory_save — only long-term stable items, not current bugs / temp files / undecided TODOs.
+- If an existing memory is outdated or contradicts new facts, correct it in-place with memory_update(id, …) (don't create a duplicate); archive clearly-stale ones with memory_forget(id).
+- Before saving, memory_search to check for an existing similar entry to avoid duplicates. Better to store less than to store trivially correct information.
+- A background reflection pass periodically mines and organizes memories from the session (no manual action needed), but key facts you proactively save are more reliable.
+
+## Plan vs Auto modes
+- Default is AUTO mode: you research and execute with all tools (read/edit/run_command/memory/web/skills).
+- For complex or multi-step tasks, the user may switch to PLAN mode (Shift+Tab): your editing/command/memory-write tools are then removed from your tool list, and you must research with read-only tools only and produce a step-by-step plan (no execution). On approval the session returns to auto mode to execute the plan.
+
+## Termination & Reporting
+- Stop immediately when no more tools are needed; give conclusions directly.
 - Report honestly: say success when successful, say where you're stuck when failing, and mention anything skipped. Reference code in "path:line" format (e.g., src/index.ts:42). Keep it concise.`;
 /**
  * plan 模式追加到系统提示末尾的指令(切到 plan 模式时由 repl 拼进 history[0])。
  * 与 SYSTEM_PROMPT 同语种(英文),指示:只读探查、产出步骤化计划、不执行、审批后回 auto。
  */
-export const PLAN_MODE_SUFFIX = `
-
-## ⛯ PLAN MODE (active now)
-You are in PLAN mode: investigate and design only — do NOT execute or change anything.
-- Your editing / command / memory-write tools (write_file, edit_file, run_command, memory_save, memory_update, memory_forget) have been REMOVED from your tool list. Use only the read-only tools available to you (read_file, glob, grep, codegraph, web_search, web_fetch, use_skill, ask_human, memory_search, memory_list) to investigate.
-- Research thoroughly: locate the relevant code, trace call paths, and understand existing patterns and conventions before designing. Prefer codegraph when a .codegraph/ index exists.
-- Then produce a clear, actionable implementation plan: files to change (with paths), what to change in each and why, the ordered steps, edge cases to handle, and how to verify (typecheck / tests / build). Be specific enough to execute against.
-- Present the plan as your final reply and STOP, unless the user explicitly asked you to "plan first then execute" / "先 plan 再 auto" / autonomous execution: in that case, after presenting the plan, call the switch_mode tool with mode="auto" to switch back to auto mode WITHIN THE SAME TURN and continue implementing the plan yourself (your write/edit/command/memory-write tools become available again immediately). The user will see no approval prompt because you self-switched.
+export const PLAN_MODE_SUFFIX = `
+
+## ⛯ PLAN MODE (active now)
+You are in PLAN mode: investigate and design only — do NOT execute or change anything.
+- Your editing / command / memory-write tools (write_file, edit_file, run_command, memory_save, memory_update, memory_forget) have been REMOVED from your tool list. Use only the read-only tools available to you (read_file, glob, grep, codegraph, web_search, web_fetch, use_skill, ask_human, memory_search, memory_list) to investigate.
+- Research thoroughly: locate the relevant code, trace call paths, and understand existing patterns and conventions before designing. Prefer codegraph when a .codegraph/ index exists.
+- Then produce a clear, actionable implementation plan: files to change (with paths), what to change in each and why, the ordered steps, edge cases to handle, and how to verify (typecheck / tests / build). Be specific enough to execute against.
+- Present the plan as your final reply and STOP, unless the user explicitly asked you to "plan first then execute" / "先 plan 再 auto" / autonomous execution: in that case, after presenting the plan, call the switch_mode tool with mode="auto" to switch back to auto mode WITHIN THE SAME TURN and continue implementing the plan yourself (your write/edit/command/memory-write tools become available again immediately). The user will see no approval prompt because you self-switched.
 - If the user entered plan mode manually (via /plan or Shift+Tab) for a safety review and did NOT ask for autonomous execution, do NOT call switch_mode — present the plan and STOP; the user will approve via a prompt and execution happens in a follow-up turn.`;
 export const config = {
     baseURL: requireEnv('LLM_BASE_URL'),
@@ -122,12 +122,14 @@ export const config = {
     compactThreshold: Number(process.env.COMPACT_THRESHOLD) || 0.85,
     includeUsage: process.env.LLM_STREAM_USAGE !== 'false',
     autoCompact: process.env.AUTO_COMPACT !== 'false',
+    contextOptimize: process.env.MOCODE_CONTEXT_OPTIMIZE !== 'false',
     autoReflect: process.env.AUTO_REFLECT !== 'false',
     reflectEveryN: Number(process.env.REFLECT_EVERY_N) || 5,
     maxSteps: Number(process.env.MAX_STEPS) || 200,
     subAgentMaxSteps: Number(process.env.SUB_AGENT_MAX_STEPS) || 50,
     sessionDir: path.join(process.cwd(), '.mocode', 'sessions'),
     searchApiKey: process.env.ANYSEARCH_API_KEY,
+    sandboxRoot: process.env.SANDBOX_ROOT || undefined,
     searchBaseUrl: process.env.ANYSEARCH_BASE_URL || 'https://api.anysearch.com',
     theme: process.env.MOCODE_THEME || 'default',
     themeFromShell,

package/dist/context/classifier.js

@@ -0,0 +1,83 @@
+// Context Classifier:据工具名(强先验)+ 输出形状(启发)+ 兜底,选 ContextKind。
+//
+// 三级信号:
+//  1) 名字强先验(BY_NAME 表,覆盖全部 17 内置工具,确定性强)。
+//  2) 形状启发(为 MCP 工具 / 未来工具 / 未登记工具兜底识别)。
+//  3) 兜底 'passthrough'(不认识 = 不动,零行为变化)。
+//
+// 单一事实源风格(仿 tools/constants.ts 的 READ_TOOL_NAMES / PLAN_DISABLED_TOOLS)。
+// 加新工具:在 BY_NAME 加一行;或靠形状启发自动识别。
+/** 工具名 → ContextKind 的强先验表(覆盖全部 17 内置工具)。 */
+const BY_NAME = {
+    // tree:路径列表 → 缩进树
+    glob: 'tree',
+    // search:file:line 分组
+    grep: 'search',
+    web_search: 'search',
+    // graph:CLI dump → 精炼图
+    codegraph: 'graph',
+    // log:分级 / 折叠 / 尾偏置
+    run_command: 'log',
+    // code:保行号(edit_file 依赖,最敏感)
+    read_file: 'code',
+    // table:列对齐
+    memory_list: 'table',
+    // memory:紧凑卡片
+    memory_search: 'memory',
+    // doc:去噪音保正文
+    web_fetch: 'doc',
+    use_skill: 'doc',
+    // status:一行状态(identity,不动)
+    edit_file: 'status',
+    write_file: 'status',
+    ask_human: 'status',
+    switch_mode: 'status',
+    memory_save: 'status',
+    memory_update: 'status',
+    memory_forget: 'status',
+    // summary:子 agent 摘要(轻量)
+    task: 'summary',
+};
+/**
+ * 形状启发:对未在 BY_NAME 登记的工具输出做模式识别(为 MCP / 未来工具兜底)。
+ * 故意保守:识别不准时回落 passthrough(不动),宁可不少省也不可错改。
+ */
+function classifyByShape(output) {
+    // file:line: content 形(grep 风格)
+    if (/^[^\n:]+:\d+:[^\n]*$/m.test(output))
+        return 'search';
+    // [退出码 N] 前缀(run_command / codegraph 风格)
+    if (/^\[退出码 \d+\]/m.test(output))
+        return 'log';
+    // 路径列表:多行都是含分隔符的相对路径(glob 风格)
+    const lines = output.split('\n').filter((l) => l.trim().length > 0);
+    if (lines.length >= 3 &&
+        lines.every((l) => /^[\w.\-\\/ ]+$/.test(l.trim()) && /[\\/]/.test(l))) {
+        return 'tree';
+    }
+    // JSON 结构化(web_fetch 的 JSON 响应等)→ doc 渲染
+    const trimmed = output.trimStart();
+    if (trimmed.startsWith('{') || trimmed.startsWith('['))
+        return 'doc';
+    return 'passthrough';
+}
+/**
+ * 判定 ContextKind。
+ *  - 有 BY_NAME 强先验 → 用之(内置工具确定性强)。
+ *  - 否则形状启发(MCP / 未来工具)。
+ *  - 都不中 → passthrough(不动)。
+ *
+ * @param toolName 工具名
+ * @param output 工具原始输出(形状启发用;有 BY_NAME 时不读)
+ * @param _args 已解析参数(预留:未来 read_file 的 offset/limit 可影响 code 编码策略;Phase 1 不用)
+ */
+export function classify(toolName, output, _args) {
+    const byName = BY_NAME[toolName];
+    if (byName)
+        return byName;
+    return classifyByShape(output);
+}
+/** 暴露 BY_NAME 副本供调试 / 未来 /context 展示(只读视图)。 */
+export function knownToolKinds() {
+    return { ...BY_NAME };
+}

package/dist/context/encoders/index.js

@@ -0,0 +1,10 @@
+// 内置 encoder 清单。启动期 pipeline 首次调用时经 registerAll 注册到 registry。
+//
+// Phase 1:仅 passthrough(identity)→ 全链路零行为变化(所有 kind 都回落到它)。
+// Phase 2 起逐步加入:tree / search / log / code / table / memory(见各 encoder 文件)。
+//
+// 加 encoder:新建 encoders/xxx.ts 导出 ContextEncoder,在此数组加一行。无需动 agent / llm / core。
+import { passthroughEncoder } from './passthrough.js';
+export const builtinEncoders = [
+    passthroughEncoder,
+];

package/dist/context/encoders/passthrough.js

@@ -0,0 +1,23 @@
+/**
+ * 兜底 encoder:identity,原样返回。
+ *  - classifier 未命中任何 kind(返回 'passthrough')时用。
+ *  - pipeline 总开关关闭(MOCODE_CONTEXT_OPTIMIZE=false)时,所有 kind 都走它 → 行为与改造前逐字节一致。
+ *  - Phase 1 阶段 registry 只注册它 → 全链路零行为变化。
+ *  - 任何 encoder 报错时,pipeline catch 后回落到它(传原 output)。
+ *
+ * 永不抛错:output 可能是任意字符串(含 ANSI / 多行 / 非法 UTF-8 片段),identity 直接返回,无解析风险。
+ */
+export const passthroughEncoder = {
+    kind: 'passthrough',
+    encode({ output }) {
+        return {
+            text: output,
+            meta: {
+                kind: 'passthrough',
+                originalLen: output.length,
+                encodedLen: output.length,
+                note: 'identity (no encoder registered)',
+            },
+        };
+    },
+};

package/dist/context/index.js

@@ -0,0 +1,10 @@
+// context/ barrel:Context Optimization Pipeline。
+//
+// 单一入口 optimizeToolResult(agent/core.ts pushToolResult 调)接管"工具结果进 LLM 前"的表示。
+// 不调 LLM、不碰 Tool Calling schema / executeTool / tool_call_id 配对 / TUI 渲染
+// (叶子级:仅 stdlib + tools/constants + session/compact 的 capToolResultForHistory 兜底 + config 开关)。
+//
+// 见 CLAUDE.md「Context Optimization Pipeline」节。
+export { optimizeToolResult } from './pipeline.js';
+export { classify, knownToolKinds } from './classifier.js';
+export { registerEncoder, registerAll, getEncoder, registeredKinds, } from './registry.js';

package/dist/context/pipeline.js

@@ -0,0 +1,84 @@
+// Context Optimization Pipeline 单一入口。
+//
+// 接管"工具结果进 LLM 前"的表示优化(C1 收口,agent/core.ts pushToolResult 调)。
+// 流程:
+//   1) 解析 argsRaw(失败返 null,encoder 据此降级)。
+//   2) classify(name, output, args) → ContextKind。
+//   3) getEncoder(kind) ?? passthrough → encode(保不变量压缩,纯函数)。
+//   4) capToolResultForHistory(name, text) 作末尾长度裁剪兜底(保 head+标记+tail,与改造前一致)。
+//
+// 不抛错:encoder 报错 → catch 回落原 output + capToolResultForHistory(对齐「调度器永不抛错」)。
+// 兜底零行为变化:未注册 encoder / pipeline 关闭 → passthrough identity → 末尾 cap 与改造前逐字节一致。
+//
+// 兼容:不改 Tool Calling JSON schema、不改 executeTool、不改 tool_call_id 配对、不改 TUI 渲染
+// (hooks.onToolResult 用原始 output,本函数只管进 history 的 content)。
+//
+// 依赖方向:context → {tools/constants, session/compact 的 cap, config};叶子,不反向依赖 llm/agent/tools。
+import { classify } from './classifier.js';
+import { getEncoder, registerAll } from './registry.js';
+import { builtinEncoders } from './encoders/index.js';
+import { passthroughEncoder } from './encoders/passthrough.js';
+import { capToolResultForHistory } from '../session/compact.js';
+import { config } from '../config/index.js';
+import { MAX_HISTORY_RESULT, MAX_SKILL_RESULT, MAX_MEMORY_RESULT, } from '../tools/constants.js';
+let booted = false;
+/** 懒注册内置 encoder(首次调用 optimizeToolResult 时触发,避免模块加载期循环 import)。 */
+function boot() {
+    if (booted)
+        return;
+    registerAll(builtinEncoders);
+    booted = true;
+}
+/** 解析工具 arguments JSON;非法或空返 null(同 agent/core.ts parseArgs 语义,独立实现避免循环依赖)。 */
+function tryParseArgs(raw) {
+    try {
+        return raw.trim() ? JSON.parse(raw) : {};
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 按工具名取软目标 budget(字符)。对齐 capToolResultForHistory 的放宽规则:
+ * use_skill / memory_search 走放宽上限(指令 / 记忆正文须完整);其余走 MAX_HISTORY_RESULT。
+ * 仅作 encoder 软目标;最终裁剪仍由末尾 capToolResultForHistory 兜底,故两处常量偶有漂移不致命。
+ */
+function budgetFor(name) {
+    if (name === 'use_skill')
+        return MAX_SKILL_RESULT;
+    if (name === 'memory_search')
+        return MAX_MEMORY_RESULT;
+    return MAX_HISTORY_RESULT;
+}
+/**
+ * 优化工具结果为进 LLM 的 tool 消息 content。
+ *
+ * @param name 工具名
+ * @param output executeTool 的原始返回字符串
+ * @param argsRaw 工具 arguments 原始 JSON 字符串(tc.arguments,可空;未传则 args=null)
+ * @returns 进 history 的 content 字符串(永不抛错)
+ */
+export function optimizeToolResult(name, output, argsRaw) {
+    boot();
+    // 总开关关闭:完全走老路径,零行为变化(Phase 1 默认 true,但保留紧急回退开关)。
+    if (!config.contextOptimize) {
+        return capToolResultForHistory(name, output);
+    }
+    try {
+        const args = argsRaw != null ? tryParseArgs(argsRaw) : null;
+        const kind = classify(name, output, args);
+        const enc = getEncoder(kind) ?? passthroughEncoder;
+        const { text } = enc.encode({
+            toolName: name,
+            output,
+            args,
+            budget: budgetFor(name),
+        });
+        // 末尾长度裁剪兜底(同改造前):encoder 已更短则 no-op;use_skill/memory_search 的放宽 cap 由此保留。
+        return capToolResultForHistory(name, text);
+    }
+    catch {
+        // encoder 报错(不应发生,纯函数):回落原 output + cap(永不抛错契约)。
+        return capToolResultForHistory(name, output);
+    }
+}

package/dist/context/registry.js

@@ -0,0 +1,30 @@
+// kind → encoder 注册表。单一事实源(仿 tools/registry.ts 的 tools[] 风格)。
+//
+// 内置 encoder 在 encoders/index.ts 的 builtinEncoders 数组声明,启动期 pipeline 首次调用时
+// 经 registerAll 注册(懒注册,避免循环 import 在模块加载期触发)。
+// MCP 工具(未来)可在并入 tools/registry.ts 时调 registerEncoder 注册私有 encoder(后注册覆盖默认)。
+//
+// 未注册的 kind → getEncoder 返 undefined → pipeline 回落 passthrough(identity),零行为变化。
+const encoders = new Map();
+let registered = false;
+/** 注册一个 encoder(后注册覆盖先注册,允许 MCP 覆盖默认)。返回 encoder 自身供链式。 */
+export function registerEncoder(enc) {
+    encoders.set(enc.kind, enc);
+    return enc;
+}
+/** 批量注册(启动期 pipeline 调一次)。幂等:重复调忽略。 */
+export function registerAll(list) {
+    if (registered)
+        return;
+    for (const e of list)
+        registerEncoder(e);
+    registered = true;
+}
+/** 取某 kind 的 encoder;未注册返 undefined(pipeline 回落 passthrough)。 */
+export function getEncoder(kind) {
+    return encoders.get(kind);
+}
+/** 调试:列出已注册 kind。 */
+export function registeredKinds() {
+    return [...encoders.keys()];
+}

package/dist/context/types.js

@@ -0,0 +1,12 @@
+// Context Optimization Pipeline 的类型契约。
+//
+// 设计原则(见 CLAUDE.md context/ 子系统):
+//  - Tool Calling 的 JSON schema 与 executeTool 不动;本层只接管"工具结果进 LLM 前"的表示。
+//  - 不设计统一 DSL,针对不同数据类型各做最优 encoder。
+//  - 所有 encoder 是纯函数(无 LLM 调用 / 无 IO / 无副作用),永不抛错(pipeline 层 try/catch,
+//    失败回落原 output + capToolResultForHistory,对齐 tools/registry.ts「调度器永不抛错」契约)。
+//  - 兜底 encoder = passthrough(identity):未注册 encoder 时行为与改造前逐字节一致。
+//
+// 依赖方向:context 是叶子(仅 stdlib + tools/constants + session/compact 的 cap + config 开关),
+// 不反向依赖 llm / agent / tools 业务,无环。
+export {};

package/dist/index.js

@@ -36,6 +36,16 @@ process.on('unhandledRejection', (e) => {
  */
 async function main() {
     const args = process.argv.slice(2);
+    // --sandbox-root <path>:覆盖沙箱根(文件操作边界)。缺值或以 -- 开头报错退出。
+    const sr = args.indexOf('--sandbox-root');
+    let sandboxRootOverride;
+    if (sr !== -1) {
+        sandboxRootOverride = args[sr + 1];
+        if (!sandboxRootOverride || sandboxRootOverride.startsWith('--')) {
+            console.error('[cli] --sandbox-root 需要一个路径参数');
+            process.exit(1);
+        }
+    }
     // 首跑配置向导:写 ~/.mocode/config。独立模块,不触发 config 校验,故零配置也能跑。
     if (args[0] === 'config') {
         const { runConfigWizard } = await import('./commands/config.js');
@@ -66,12 +76,12 @@ async function main() {
         }
         const updateNotice = checkAndMaybeUpdate();
         const { startRepl } = await import('./repl/index.js');
-        await startRepl(loaded.history, loaded.id, updateNotice);
+        await startRepl(loaded.history, loaded.id, updateNotice, sandboxRootOverride);
     }
     else {
         const updateNotice = checkAndMaybeUpdate();
         const { startRepl } = await import('./repl/index.js');
-        await startRepl(undefined, undefined, updateNotice);
+        await startRepl(undefined, undefined, updateNotice, sandboxRootOverride);
     }
     process.exit(0);
 }

package/dist/repl/index.js

@@ -5,6 +5,7 @@ import { config, PLAN_MODE_SUFFIX } from '../config/index.js';
 import { updateConfigKey } from '../config/file.js';
 import { runAgent } from '../agent/index.js';
 import { getAgentMode, setAgentMode, onModeChange } from '../agent/mode.js';
+import { setSandboxRoot } from '../sandbox/root.js';
 import { ui, setTheme, getTheme, listThemes, themeExists } from '../ui/theme.js';
 import { bannerString, displayWidth, padEndDisplay, summarizeToolCall, summarizeToolResult } from '../ui/render.js';
 import * as layout from '../ui/layout.js';
@@ -341,9 +342,12 @@ export function renderHistory(history) {
  * contentWrite 落入内容区(滚动区域内自动滚动,底栏不动)。history 由本模块持有,在轮次间持久;
  * agent 只读取并追加(+ 经 session/ 压缩)。每轮成功结束后自动落盘,退出后可用 --resume / /resume 续接。
  */
-export async function startRepl(initialHistory, sessionId, updateNotice = null) {
+export async function startRepl(initialHistory, sessionId, updateNotice = null, sandboxRootOverride) {
     // 模式重置:agentMode 不落盘,每个 REPL 会话从 auto 开始(/resume / --resume 亦重置)。
     setAgentMode('auto');
+    // 沙箱根:文件操作边界。优先级 --sandbox-root > SANDBOX_ROOT env > process.cwd()。
+    // 纯边界记录(不 chdir),jail.ts 内部 resolve。子 agent 同进程继承全局 root。
+    setSandboxRoot(sandboxRootOverride ?? config.sandboxRoot ?? process.cwd());
     // 构造系统提示:auto 用 base;plan 在 config.systemPrompt 后追加 PLAN_MODE_SUFFIX。
     // 切模式时 applyMode 重算 history[0](history[0] 恒 system,compaction 保它,不破坏)。
     const buildSystemMessage = (planMode) => effectiveSystemPrompt(config.systemPrompt +

package/dist/sandbox/command.js

@@ -0,0 +1,41 @@
+// run_command 的 best-effort 命令层原语。**非安全边界**——只挡误操作与低水平 prompt 注入,
+// 真隔离需 OS jailer(bwrap/firejail/sandbox-exec/docker,本次不做)。cwd 钉死由 run_command
+// 自己用 getSandboxRoot() 做;本模块只提供 env 脱敏与灾难命令 denylist。
+/** env 脱敏 denylist:删敏感键(*KEY / *TOKEN / *SECRET / *CREDENTIAL / *PASSWORD / LLM_*)。
+ *  防 LLM_API_KEY / ANYSEARCH_API_KEY 泄给子进程。用 denylist——白名单会误杀 npm/git 需要的
+ *  PATH/HOME/USERPROFILE 等 vars,不稳。 */
+const ENV_DENY = /^(.*_?KEY|.*TOKEN|.*SECRET|.*CREDENTIAL|.*PASSWORD|LLM_.*)$/i;
+/** 返回 env 浅拷贝,删敏感键。 */
+export function filterEnv(env) {
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (ENV_DENY.test(k))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * 灾难性文件操作 denylist:仅挡最明显的 fs 破坏(rm -rf /、rm -rf ~、rm -rf /*、fork bomb、
+ * mkfs、dd of=/dev/、chmod -R 777 /)。**不挡 curl/wget/sudo**——用户目标是 fs 隔离,不是网络/提权;
+ * curl 写到 cwd 不算逃逸。大小写无关、粗匹配。刻意者可绕($IFS / base64 / env var 拼接),
+ * 故文档明确:非安全边界。返 string = 拒绝原因;null = 放行。
+ */
+const CMD_DENY = [
+    // rm -rf /  (flags 含 r 与 f,任序;目标 = 根、根*、家目录)
+    /\brm\s+-[a-z]*r[a-z]*f[a-z]*\s+\/(\s|$|\*)/i,
+    /\brm\s+-[a-z]*f[a-z]*r[a-z]*\s+\/(\s|$|\*)/i,
+    /\brm\s+-[a-z]*r[a-z]*f[a-z]*\s+~(\s|$)/i,
+    /\brm\s+-[a-z]*f[a-z]*r[a-z]*\s+~(\s|$)/i,
+    /:\s*\(\)\s*\{/i, // :(){ fork bomb
+    /\bmkfs\b/i,
+    /\bdd\b.*of=\/dev\//i,
+    /\bchmod\s+-R\s+777\s+\/(\s|$)/i,
+];
+export function isCommandDenied(cmd) {
+    for (const re of CMD_DENY) {
+        if (re.test(cmd))
+            return `命令被沙箱拒绝(灾难性文件操作): ${cmd}`;
+    }
+    return null;
+}

package/dist/sandbox/index.js

@@ -0,0 +1,5 @@
+// 沙箱子系统 barrel。叶子:仅 node:path / node:fs,不反向依赖业务。
+export { getSandboxRoot, setSandboxRoot } from './root.js';
+export { jailResolve, jailGlobPattern, isInsideRoot } from './jail.js';
+export { filterEnv, isCommandDenied } from './command.js';
+export { SANDBOX_EXEMPT_TOOLS, SANDBOX_PATH_TOOLS, enforceSandbox, } from './policy.js';

package/dist/sandbox/jail.js

@@ -0,0 +1,75 @@
+// 路径牢笼原语:把任意输入路径解析到沙箱根之内,拒绝越界(../、绝对路径外圈、符号链接出圈)。
+// 核心:resolve(root, input) → realpath(解软链)→ 前缀校验。
+// 新文件(目标不存在)走「最近存在祖先 realpath 再拼回剩余分量」,同样挡住「祖先是出圈软链」。
+import { realpathSync, existsSync } from 'node:fs';
+import { resolve, relative, isAbsolute, dirname, basename, join } from 'node:path';
+import { getSandboxRoot } from './root.js';
+const isWin = process.platform === 'win32';
+/** 当前沙箱根(绝对),未初始化回退 process.cwd()。 */
+function root() {
+    return resolve(getSandboxRoot() ?? process.cwd());
+}
+/**
+ * abs 是否在沙箱根内(含 == 根)。win32 下两边 toLowerCase 再比(node 的 path.relative 不做
+ * 大小写无关比较,盘符大小写差异会误判出圈)。**不做 realpath**——用于 glob/grep 结果后置过滤;
+ * 越界软链的拦挡靠 jailResolve 的 realpath。
+ */
+export function isInsideRoot(abs) {
+    const r = root();
+    // resolve 相对 r(sandbox root):glob/grep 结果相对 sandbox root,需对齐;
+    // 传绝对路径时 resolve(r, abs) 返 abs 不变,兼容 jailResolve 的 realpath 结果。
+    const a = isWin ? resolve(r, abs).toLowerCase() : resolve(r, abs);
+    const rr = isWin ? r.toLowerCase() : r;
+    const rel = relative(rr, a);
+    return !rel.startsWith('..') && !isAbsolute(rel);
+}
+/**
+ * 把输入路径解析为沙箱根内的绝对路径;越界(../、绝对外圈、符号链接出圈)抛错。
+ * 供 enforceSandbox 重写 args.path(读/写/改)、readDiffContext 预读旧内容用。
+ * 同步:realpathSync 仅做 fs 元数据查询(微秒级),与既有 readFileSync/existsSync 用法一致。
+ */
+export function jailResolve(input) {
+    const r = root();
+    let abs = resolve(r, input);
+    try {
+        abs = realpathSync(abs);
+    }
+    catch {
+        // 目标或中间段不存在(写新文件 / 路径中间段未建):realpath 最近存在祖先,拼回剩余分量。
+        let dir = dirname(abs);
+        const rest = [basename(abs)];
+        while (!existsSync(dir)) {
+            const parent = dirname(dir);
+            if (parent === dir)
+                break; // 已到 FS 根(C:\ 或 /),无法再上
+            rest.unshift(basename(dir));
+            dir = parent;
+        }
+        try {
+            abs = join(realpathSync(dir), ...rest);
+        }
+        catch {
+            // 连祖先都 realpath 失败(不该发生,除非 root 本身不可达):用 resolve 值,交由包含校验兜底
+            abs = resolve(r, input);
+        }
+    }
+    if (!isInsideRoot(abs)) {
+        throw new Error(`路径越界,已被沙箱拒绝: ${input}`);
+    }
+    return abs;
+}
+/**
+ * glob pattern 校验:拒绝对路径(平台相关的 isAbsolute)与含 `..` 段的 pattern。
+ * 返 null = 通过;返 string = 拒绝原因。形如 *.ts 的正常 pattern 放行。
+ */
+export function jailGlobPattern(pattern) {
+    const p = String(pattern ?? '').trim();
+    if (!p)
+        return '空 pattern';
+    if (isAbsolute(p))
+        return `不得为绝对路径: ${pattern}`;
+    const segs = p.split(/[\\/]/);
+    if (segs.includes('..'))
+        return `不得含 .. 段: ${pattern}`;
+    return null;
+}

package/dist/sandbox/policy.js

@@ -0,0 +1,58 @@
+// 沙箱策略分类集 + 集中执行 enforceSandbox。单一事实源,仿 tools/constants.ts 的
+// PLAN_DISABLED_TOOLS / READ_TOOL_NAMES 风格。
+import { jailResolve, jailGlobPattern } from './jail.js';
+/**
+ * 豁免 cwd 牢笼的工具:
+ *  - memory_*:操作 ~/.mocode 与 <cwd>/.mocode(CLAUDE.md 明确不进回滚、在外圈),本就该在外圈
+ *  - use_skill:读 ~/.claude/skills、~/.mocode/skills、<cwd>/.mocode/skills,部分在外圈
+ *  - web_*:跨网络,非文件路径
+ *  - ask_human / switch_mode:无文件路径
+ *  - codegraph:只读 cwd 下 .codegraph/ 索引(只读、不写盘)
+ *  - task:派生子 agent,继承全局 root(子 agent 同进程天然共享 getSandboxRoot)
+ */
+export const SANDBOX_EXEMPT_TOOLS = new Set([
+    'memory_save', 'memory_update', 'memory_forget', 'memory_search', 'memory_list',
+    'use_skill',
+    'web_search', 'web_fetch',
+    'ask_human', 'switch_mode',
+    'codegraph',
+    'task',
+]);
+/**
+ * 路径类工具:enforceSandbox 集中把 args.path 重写为牢内绝对路径(默认安全;工具内
+ * resolve(absolutePath) 原样返回)。**新加带 path 参数的工具须列入此集**,否则不会被牢笼挡。
+ */
+export const SANDBOX_PATH_TOOLS = new Set(['read_file', 'write_file', 'edit_file']);
+/**
+ * 工具执行前的沙箱校验。返 string = 拒绝(直接喂 LLM,不执行);返 null = 放行(可能已重写 args.path)。
+ * **不抛**——契约对齐「调度器永不抛错、永远返回字符串」(tools/registry.ts executeTool)。
+ * run_command 不在此处理(cwd / env / denylist 在其站点)。
+ */
+export function enforceSandbox(name, args) {
+    if (SANDBOX_EXEMPT_TOOLS.has(name))
+        return null;
+    if (SANDBOX_PATH_TOOLS.has(name)) {
+        const p = args.path;
+        if (typeof p === 'string' && p) {
+            try {
+                args.path = jailResolve(p);
+            }
+            catch (e) {
+                const why = e instanceof Error ? e.message : String(e);
+                return `错误:路径越界,已被沙箱拒绝: ${p} (${why})`;
+            }
+        }
+        return null;
+    }
+    if (name === 'glob') {
+        const pat = String(args.pattern ?? '');
+        const err = jailGlobPattern(pat);
+        return err ? `错误:glob ${err}` : null;
+    }
+    if (name === 'grep') {
+        const pat = String(args.glob ?? '**/*');
+        const err = jailGlobPattern(pat);
+        return err ? `错误:grep glob ${err}` : null;
+    }
+    return null;
+}

package/dist/sandbox/root.js

@@ -0,0 +1,19 @@
+// 共享叶子:沙箱根目录(文件操作边界)。零依赖、不反向引用业务、不落盘。
+// 依赖方向无环:tools/registry → sandbox、tools/builtins/* → sandbox、agent/core → sandbox、repl → sandbox
+// —— 全是「业务 → 叶子」,同 src/agent/mode.ts。
+//
+// 设计:sandboxRoot 是纯边界记录(默认 = process.cwd(),不 chdir),避免与 config.sessionDir 等
+// 模块加载期计算的值产生错位(若 chdir 会令那些值变陈旧)。子 agent 同进程天然继承全局 root
+// (未来 agents/ 做 worktree 隔离时再改为沿 opts 透传,照 signal 同形链路,7 处改动)。
+let currentRoot = null;
+/** 当前沙箱根(绝对路径)。未初始化返 null,调用方 ?? process.cwd() 兜底(防御)。 */
+export function getSandboxRoot() {
+    return currentRoot;
+}
+/** 设置沙箱根。repl startRepl 启动时调一次(默认 process.cwd();--sandbox-root / SANDBOX_ROOT 可覆盖)。
+ *  返回之前的值,供未来 save/restore(子 agent worktree 隔离)用。 */
+export function setSandboxRoot(root) {
+    const prev = currentRoot;
+    currentRoot = root;
+    return prev;
+}

package/dist/tools/builtins/glob.js

@@ -1,5 +1,6 @@
 import fg from 'fast-glob';
 import { IGNORE } from '../constants.js';
+import { getSandboxRoot, isInsideRoot } from '../../sandbox/index.js';
 // ---------- glob ----------
 export const globTool = {
     name: 'glob',
@@ -14,12 +15,15 @@ export const globTool = {
     },
     async execute(args) {
         const pattern = String(args.pattern);
-        const files = await fg(pattern, {
-            cwd: process.cwd(),
+        const cwd = getSandboxRoot() ?? process.cwd();
+        const files = (await fg(pattern, {
+            cwd,
             onlyFiles: true,
             dot: true,
             ignore: IGNORE,
-        });
+            followSymbolicLinks: false, // 不跟随软链目录,防经软链列出牢外文件
+            throwErrorOnBrokenSymbolicLink: false,
+        })).filter((f) => isInsideRoot(f)); // 后置兜底:仅留牢内
         if (files.length === 0)
             return '无匹配文件';
         const shown = files.slice(0, 200);

package/dist/tools/builtins/grep.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
 import fg from 'fast-glob';
 import { MAX_RESULTS, IGNORE } from '../constants.js';
+import { getSandboxRoot, isInsideRoot, jailResolve } from '../../sandbox/index.js';
 // ---------- grep ----------
 export const grepTool = {
     name: 'grep',
@@ -25,12 +25,15 @@ export const grepTool = {
         catch (e) {
             return `错误:非法正则 ${pattern}: ${e instanceof Error ? e.message : String(e)}`;
         }
-        const files = await fg(g, {
-            cwd: process.cwd(),
+        const cwd = getSandboxRoot() ?? process.cwd();
+        const files = (await fg(g, {
+            cwd,
             onlyFiles: true,
             dot: true,
             ignore: IGNORE,
-        });
+            followSymbolicLinks: false, // 不跟随软链目录,防经软链扫到牢外文件
+            throwErrorOnBrokenSymbolicLink: false,
+        })).filter((f) => isInsideRoot(f)); // 后置兜底:仅留牢内
         const results = [];
         let scanned = 0;
         for (const f of files) {
@@ -38,10 +41,11 @@ export const grepTool = {
                 break;
             let content;
             try {
-                content = await readFile(resolve(f), 'utf8');
+                // jailResolve:realpath 化,防「牢内文件软链→牢外」的内容泄露;越界/不可读均 catch 跳过
+                content = await readFile(jailResolve(f), 'utf8');
             }
             catch {
-                continue; // 跳过无法读的文件(二进制/权限)
+                continue; // 跳过无法读的文件(二进制/权限/沙箱越界)
             }
             scanned++;
             const lines = content.split(/\r?\n/);

package/dist/tools/builtins/run-command.js

@@ -1,5 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { MAX_OUTPUT } from '../constants.js';
+import { getSandboxRoot, filterEnv, isCommandDenied } from '../../sandbox/index.js';
 // ---------- run_command ----------
 export const runCommandTool = {
     name: 'run_command',
@@ -15,9 +16,14 @@ export const runCommandTool = {
     async execute(args, ctx) {
         const command = String(args.command);
         const timeout = Number(args.timeout ?? 120000);
+        // 沙箱 best-effort:灾难性文件操作 denylist(非安全边界,只挡误操作;真隔离需 OS jailer)。
+        const deny = isCommandDenied(command);
+        if (deny)
+            return `错误:${deny}`;
         return new Promise((done) => {
             const isWin = process.platform === 'win32';
-            const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/c', command] : ['-c', command], { cwd: process.cwd() });
+            // 沙箱 best-effort:cwd 钉死 sandbox root(相对路径写落在牢内)+ env 脱敏(剥 *KEY/*TOKEN 等,防 LLM_API_KEY 泄子进程)
+            const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/c', command] : ['-c', command], { cwd: getSandboxRoot() ?? process.cwd(), env: filterEnv(process.env) });
             let out = '';
             let finished = false;
             let timer;

package/dist/tools/registry.js

@@ -1,5 +1,6 @@
 import { builtinTools } from './builtins/index.js';
 import { recordMutation } from '../rollback/index.js';
+import { enforceSandbox } from '../sandbox/index.js';
 /**
  * 工具注册表。当前 = 内置工具;
  * 未来可在此合并 MCP 工具、用户自定义工具等(见 src/mcp/)。
@@ -23,6 +24,12 @@ export async function executeTool(name, argsRaw, signal, opts) {
         return `错误:工具 ${name} 的 arguments 不是合法 JSON: ${argsRaw}`;
     }
     try {
+        // 沙箱:路径类工具(读/写/改)越界拒绝 + args.path 重写为牢内绝对;glob/grep pattern 校验。
+        // 返 string = 拒绝(直接喂 LLM,不执行);返 null = 放行(可能已重写 args.path)。
+        // 须在 recordMutation 前:让快照路径 = 牢内绝对路径,与回滚一致。不抛(契约:调度器永不抛错)。
+        const sbErr = enforceSandbox(name, args);
+        if (sbErr)
+            return sbErr;
         // 撤销回滚用:write_file/edit_file 改动前记 before 快照(回滚时恢复到轮末状态)。
         // 子 agent(skipRollback)跳过:其改动不进主回滚链,主 /rollback 不撤销(靠 git 兜底)。
         if (!opts?.skipRollback &&

package/dist/ui/layout.js

@@ -415,9 +415,9 @@ function composeStatus(status, cols) {
     const lead = spinning ? `${RUNNING_FRAMES[runningFrame]} ` : `◆ `;
     // 模式 chip:lead 之后、model 之前。auto 显 dim 'auto'(常态),plan 显亮黄 'plan'(切换时颜色+文字都变,明显)。
     const modeChip = status.modeTag
-        ? ` ${status.modeTag === 'plan' ? ui.yellow : ui.dim}${status.modeTag}${ui.reset}`
+        ? ` ${status.modeTag === 'plan' ? ui.yellow : ui.dim}${status.modeTag}${ui.reset} `
         : '';
-    const modeChipW = status.modeTag ? 1 + displayWidth(status.modeTag) : 0; // 1 = 前导空格
+    const modeChipW = status.modeTag ? 2 + displayWidth(status.modeTag) : 0; // 2 = 前导+尾随空格
     const model = truncateDisplay(status.model, 22);
     const ctx = status.contextBar; // 已带色
     const ctxW = ansiDisplayWidth(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mocode-ai",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "终端编码 agent:LLM + tool-call 循环 + 流式输出(含思考)+ 16 个工具,接任意 OpenAI 兼容后端。",
   "type": "module",
   "bin": {