mocode-ai 1.3.9 → 1.4.0

package/dist/skills/index.js

@@ -5,7 +5,7 @@
 // 优先级:内置 skill < 用户/系统 skill < 项目级 skill(后注册覆盖先注册,
 // 项目级最后扫描,自然在 Map 中胜出)。同名用户 skill 完全替换内置版。
 import { existsSync, readFileSync } from 'node:fs';
-import { discoverSkills, parseFrontmatter, skillsScanSignature, } from './discover.js';
+import { discoverSkills, parseFrontmatter, skillsScanSignature } from './discover.js';
 import { builtinSkills } from './builtin-skills.js';
 let cache = null;
 let cacheKey = null;

package/dist/skills/runner.js

@@ -13,19 +13,6 @@ import { isSkillTrusted, ensureSkillTrust } from './trust.js';
 import { mapSkillTools } from './toolmap.js';
 import { spawnAgent } from '../agent/spawn.js';
 import { runCommandRaw } from '../tools/builtins/run-command.js';
-/** 把 raw ChangeSet 折成 ToolOutcome 需要的 ChangeSetSummary(哈希缺失位填 null,仅用于展示)。 */
-function toChangeSetSummary(cs) {
-    return {
-        id: cs.id,
-        changedFiles: cs.changes.map((c) => c.path),
-        changes: cs.changes.map((c) => ({
-            path: c.path,
-            operation: c.operation,
-            beforeHash: null,
-            afterHash: null,
-        })),
-    };
-}
 const MAX_INJECTIONS = 4;
 const MAX_INJECTION_OUTPUT = 4096;
 const INJECT_TIMEOUT = 10_000;
@@ -87,36 +74,44 @@ async function injectCommands(body, skillDir, signal) {
  * 非 project 或已信任的 project skill 才执行注入;否则先尝试一次性确认,未通过则跳过注入。
  * 返回 null 表示正文缺失(调用方生成「未找到」错误)。
  */
-export async function renderSkillBody(skill, args, signal) {
+export async function renderSkillBody(skill, args, signal, parentAllowedToolNames) {
     const raw = getSkillBody(skill.name);
     if (raw === null)
         return null;
     let body = substituteArgs(raw, args, skill.dir);
     if (/!`[^`]+`/.test(body)) {
-        // 非 project 恒信任;project 依次查信任记录、再弹一次性确认。
-        // ensureSkillTrust 的 true 覆盖 'trusted'(已记录)与 'once'(仅本次)两种,直接据此注入。
-        const trusted = skill.origin !== 'project' || isSkillTrusted(skill) || (await ensureSkillTrust(skill));
-        if (trusted) {
-            body = await injectCommands(body, skill.dir, signal);
+        const allowed = mapSkillTools(skill.allowedTools).tools;
+        const disallowed = new Set(mapSkillTools(skill.disallowedTools).tools ?? []);
+        const parentAllowsShell = parentAllowedToolNames?.includes('run_command') === true;
+        const skillAllowsShell = (allowed === null || allowed.includes('run_command')) && !disallowed.has('run_command');
+        if (!parentAllowsShell || !skillAllowsShell) {
+            // Trust 只证明 skill 来源，不授予 capability；隐藏命令必须受产生 use_skill/run_skill
+            // 调用的父 step 快照约束，且不能借未声明/未知 allowed-tools 扩权。
+            body = body.replace(/!`[^`]+`/g, '_(command injection skipped: run_command not allowed by tool policy)_');
         }
         else {
-            // 未信任:清掉注入标记,避免把未授权命令留在提示里。
-            body = body.replace(/!`[^`]+`/g, '_(command injection skipped: skill not trusted)_');
+            // 非 project 恒信任;project 依次查信任记录、再弹一次性确认。
+            const trusted = skill.origin !== 'project' || isSkillTrusted(skill) || (await ensureSkillTrust(skill));
+            if (trusted) {
+                body = await injectCommands(body, skill.dir, signal);
+            }
+            else {
+                // 未信任:清掉注入标记,避免把未授权命令留在提示里。
+                body = body.replace(/!`[^`]+`/g, '_(command injection skipped: skill not trusted)_');
+            }
         }
     }
     return body;
 }
-/** 把 SpawnResult 转成 ToolOutcome,汇总/计费/变更集透传,不丢回滚信息。 */
+/** 把 SpawnResult 转成 ToolOutcome。子 agent 与主 agent 同权、直接写工作区,其文件修改已由
+ *  主 agent 当前轮次的回滚事务追踪,因此这里不再需要单独透传变更集。 */
 function toOutcome(res) {
     const status = res.status === 'completed' ? 'success' : res.status === 'aborted' ? 'aborted' : 'error';
     return {
         status,
-        code: res.status === 'completed' ? 'OK'
-            : res.status === 'aborted' ? 'ABORTED'
-                : 'EXECUTION_ERROR',
+        code: res.status === 'completed' ? 'OK' : res.status === 'aborted' ? 'ABORTED' : 'EXECUTION_ERROR',
         retryable: false,
         output: res.summary ?? (res.status === 'failed' ? '(skill failed with no output)' : ''),
-        changeSet: res.changeSet ? toChangeSetSummary(res.changeSet) : undefined,
         usage: res.usage,
     };
 }
@@ -138,26 +133,14 @@ export function readSkillFile(skill, file, maxBytes) {
         return null;
     }
 }
-/** 能产生副作用的 mocode 工具;用于在未显式声明 agent: 时推断 fork 子 agent 的模式。 */
-const WRITE_TOOLS = new Set(['write_file', 'edit_file', 'run_command']);
-/**
- * fork 子 agent 模式:`agent:` 显式声明优先;否则按工具面推断——
- * 未声明 allowed-tools(完整工具集)或白名单含写工具 → 'write',纯只读白名单 → 'read'。
- * 避免写类 skill 因缺省字段被静默降级为只读。
- */
-export function resolveSpawnMode(skill, tools) {
-    if (skill.agentMode)
-        return skill.agentMode;
-    if (tools === null || tools.some((t) => WRITE_TOOLS.has(t)))
-        return 'write';
-    return 'read';
-}
 /**
- * 执行一个 skill(无论 inline 还是 fork 都走隔离子 agent,保证「可执行」语义统一):
+ * 执行一个 skill(无论 inline 还是 fork 都走子 agent,保证「可执行」语义统一):
  *  - 找不到 → UNKNOWN_TOOL 语义 error
  *  - 执行面门禁(ensureSkillTrust)未过 → denied
- *  - 渲染正文 → spawnAgent(白名单工具 / mode / maxSteps / signal)
+ *  - 渲染正文 → spawnAgent(白名单工具 / maxSteps / signal)
  *  - 子 agent 摘要回灌为 output,usage / changeSet 透传
+ *
+ * fork 子 agent 与主 agent 同源同权,只有 allowed-tools 是 skill 作者声明的特化收缩。
  */
 export async function runSkill(a, ctx) {
     const name = String(a.name ?? '').trim();
@@ -176,7 +159,7 @@ export async function runSkill(a, ctx) {
             output: `拒绝:skill "${name}" 未获信任,已取消执行。`,
         };
     }
-    let body = await renderSkillBody(skill, a.args, ctx?.signal);
+    let body = await renderSkillBody(skill, a.args, ctx?.signal, ctx?.allowedToolNames);
     if (body === null) {
         return { status: 'error', code: 'UNKNOWN_TOOL', retryable: false, output: `错误:未找到 skill "${name}" 的正文。` };
     }
@@ -188,13 +171,14 @@ export async function runSkill(a, ctx) {
     const res = await spawnAgent({
         prompt: SKILL_PROTOCOL_HEADER + '\n\n' + body,
         tools: tools ?? undefined,
-        mode: resolveSpawnMode(skill, tools),
         maxSteps: skill.maxSteps,
         signal: ctx?.signal,
         context: a.context,
         systemPromptSuffix: `You are executing the "${skill.name}" skill. SKILL_DIR=${skill.dir}`,
         quiet: true, // fork skill 是 opaque workflow,不产可展开 batch
         quietLabel: `执行 ${skill.name}…`,
+        parentAllowedToolNames: ctx?.allowedToolNames,
+        delegation: ctx?.delegation,
     });
     return toOutcome(res);
 }

package/dist/skills/toolmap.js

@@ -38,8 +38,10 @@ export function mapSkillToolName(token) {
 /** 把 allowed-tools / disallowed-tools 的 token 列表映射为 mocode 工具名集合;
  * 未知 token 收集到 unknown 返回,供调用方记 warning。返回 null 表示未声明(不约束)。 */
 export function mapSkillTools(tokens) {
-    if (!tokens || tokens.length === 0)
+    if (tokens === undefined)
         return { tools: null, unknown: [] };
+    if (tokens.length === 0)
+        return { tools: [], unknown: [] };
     const tools = [];
     const unknown = [];
     for (const tk of tokens) {
@@ -52,5 +54,6 @@ export function mapSkillTools(tokens) {
             unknown.push(tk);
         }
     }
-    return { tools: tools.length ? tools : null, unknown };
+    // 显式声明但全是未知 token 时保持零工具，绝不回退成 unrestricted。
+    return { tools, unknown };
 }

package/dist/tools/builtins/browser.js

@@ -36,7 +36,19 @@ export const browserTool = {
         properties: {
             action: {
                 type: 'string',
-                enum: ['open', 'navigate', 'click', 'fill', 'press', 'wait_for', 'text', 'screenshot', 'console', 'list', 'close'],
+                enum: [
+                    'open',
+                    'navigate',
+                    'click',
+                    'fill',
+                    'press',
+                    'wait_for',
+                    'text',
+                    'screenshot',
+                    'console',
+                    'list',
+                    'close',
+                ],
                 description: 'Operation to perform',
             },
             sessionId: { type: 'string', description: 'Session from action=open; optional when only one session exists' },
@@ -172,13 +184,15 @@ export const browserTool = {
                             ...(savedPath ? { savedPath } : {}),
                             note: 'Rendered page is attached to the next model request.',
                         }, null, 2),
-                        modelAttachments: [{
+                        modelAttachments: [
+                            {
                                 type: 'image',
                                 name: `${meta.sessionId}.png`,
                                 mime: 'image/png',
                                 dataUrl: `data:image/png;base64,${buffer.toString('base64')}`,
                                 detail,
-                            }],
+                            },
+                        ],
                     };
                 }
                 case 'close': {

package/dist/tools/builtins/computer.js

@@ -0,0 +1,322 @@
+/**
+ * computer 工具:桌面 GUI 操控闭环(设计 docs/computer-use-design.md)。
+ *
+ * 结构:校验(纯函数,可单测) → 动作前截屏(拿物理分辨率做 norm1000 换算) →
+ * InputInjector 注入动作 → 动作后重截屏 → 缩放 → modelAttachments 回灌。
+ * 模型只面对归一化 0-1000 坐标网格,从不感知物理分辨率/DPI/多屏。
+ *
+ * 安全:risk=dangerous(权限弹窗默认高亮「拒绝」),plan 模式常驻屏蔽,
+ * /cu off 时既不进 schema 也被运行时兜底拦截。
+ */
+import { mkdir, readFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { jailResolve } from '../../sandbox/index.js';
+import { captureDesktop } from '../../runtime/screen-capture.js';
+import { decodePng, encodePng, downscale, fitToLongEdge, crop, normToPhysical, normRectToPhysical, physicalToNorm, isNormCoord, } from '../../runtime/screen-pipeline.js';
+import { createInputInjector } from '../../runtime/input-injector.js';
+/** 喂模型的截图长边上限(Anthropic 推荐区间)。 */
+const MAX_EDGE = 1280;
+const WAIT_MAX_MS = 10000;
+const SCROLL_MAX = 10;
+const ACTIONS = [
+    'screenshot',
+    'zoom',
+    'mouse_move',
+    'left_click',
+    'right_click',
+    'middle_click',
+    'double_click',
+    'triple_click',
+    'left_mouse_down',
+    'left_mouse_up',
+    'left_click_drag',
+    'type',
+    'key',
+    'scroll',
+    'wait',
+    'cursor_position',
+];
+const ACTIONS_NEEDING_COORDINATE = new Set([
+    'mouse_move',
+    'left_click',
+    'right_click',
+    'middle_click',
+    'double_click',
+    'triple_click',
+    'left_mouse_down',
+    'left_mouse_up',
+    'left_click_drag',
+    'scroll',
+]);
+function isPair(v) {
+    return Array.isArray(v) && v.length === 2 && isNormCoord(v[0]) && isNormCoord(v[1]);
+}
+/**
+ * 校验 computer 调用参数。返回 null 表示通过,否则返回面向模型的错误消息。
+ * 纯函数,独立可单测。
+ */
+export function validateComputerArgs(args) {
+    const action = args.action;
+    if (typeof action !== 'string' || !ACTIONS.includes(action)) {
+        return `unknown action "${String(args.action)}"; expected one of: ${ACTIONS.join(', ')}`;
+    }
+    if (ACTIONS_NEEDING_COORDINATE.has(action) && !isPair(args.coordinate)) {
+        return `action "${action}" requires coordinate: [x, y] integers in normalized 0-1000 space`;
+    }
+    if (action === 'left_click_drag' && !isPair(args.coordinate_to)) {
+        return 'action "left_click_drag" requires coordinate_to: [x, y] integers in normalized 0-1000 space';
+    }
+    if (action === 'zoom') {
+        const r = args.region;
+        if (!Array.isArray(r) || r.length !== 4 || !r.every(isNormCoord)) {
+            return 'action "zoom" requires region: [x, y, w, h] integers in normalized 0-1000 space';
+        }
+        if (r[2] <= 0 || r[3] <= 0) {
+            return 'zoom region w/h must be > 0';
+        }
+    }
+    if (action === 'type' || action === 'key') {
+        if (typeof args.text !== 'string' || args.text.length === 0) {
+            return `action "${action}" requires a non-empty text string`;
+        }
+    }
+    if (action === 'scroll') {
+        const dir = args.scroll_direction;
+        if (dir !== 'up' && dir !== 'down' && dir !== 'left' && dir !== 'right') {
+            return 'action "scroll" requires scroll_direction: up|down|left|right';
+        }
+        const amount = args.scroll_amount ?? 3;
+        if (typeof amount !== 'number' || !Number.isInteger(amount) || amount < 1 || amount > SCROLL_MAX) {
+            return `scroll_amount must be an integer in 1-${SCROLL_MAX}`;
+        }
+    }
+    if (action === 'wait') {
+        const ms = args.duration_ms;
+        if (typeof ms !== 'number' || !Number.isInteger(ms) || ms < 1 || ms > WAIT_MAX_MS) {
+            return `action "wait" requires duration_ms: integer in 1-${WAIT_MAX_MS}`;
+        }
+    }
+    return null;
+}
+/** 抓一次主屏并返回物理分辨率。 */
+async function capturePrimary(signal) {
+    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+    const outputPath = jailResolve(`.mocode/screenshots/computer-${ts}-${Math.random().toString(36).slice(2, 8)}.png`);
+    await mkdir(dirname(outputPath), { recursive: true });
+    const cap = await captureDesktop(outputPath, 'primary', signal);
+    if (cap.status !== 'passed') {
+        throw new Error(`screenshot capture failed: ${cap.detail}`);
+    }
+    const png = decodePng(await readFile(outputPath));
+    return { path: outputPath, physW: png.width, physH: png.height };
+}
+/** 读 PNG 文件 → 缩放 → 编码 → dataUrl。 */
+async function toAttachment(path) {
+    const png = decodePng(await readFile(path));
+    const { img } = downscale(png, MAX_EDGE);
+    const buf = encodePng(img);
+    return {
+        dataUrl: `data:image/png;base64,${buf.toString('base64')}`,
+        bytes: buf.length,
+        dispW: img.width,
+        dispH: img.height,
+    };
+}
+async function executeAction(injector, action, args, screen) {
+    const { physW, physH } = screen;
+    const toPhys = (pair) => normToPhysical(pair[0], pair[1], physW, physH);
+    switch (action) {
+        case 'mouse_move': {
+            const [x, y] = toPhys(args.coordinate);
+            await injector.moveTo(x, y);
+            return `moved cursor to (${x}, ${y})`;
+        }
+        case 'left_click':
+        case 'right_click':
+        case 'middle_click':
+        case 'double_click':
+        case 'triple_click': {
+            const [x, y] = toPhys(args.coordinate);
+            await injector.moveTo(x, y);
+            const button = action.startsWith('right') ? 'right' : action.startsWith('middle') ? 'middle' : 'left';
+            const count = action === 'double_click' ? 2 : action === 'triple_click' ? 3 : 1;
+            await injector.click(button, count);
+            return `${action} at (${x}, ${y})`;
+        }
+        case 'left_mouse_down':
+        case 'left_mouse_up': {
+            const [x, y] = toPhys(args.coordinate);
+            await injector.moveTo(x, y);
+            if (action === 'left_mouse_down')
+                await injector.mouseDown('left');
+            else
+                await injector.mouseUp('left');
+            return `${action} at (${x}, ${y})`;
+        }
+        case 'left_click_drag': {
+            const [x0, y0] = toPhys(args.coordinate);
+            const [x1, y1] = toPhys(args.coordinate_to);
+            await injector.moveTo(x0, y0);
+            await injector.mouseDown('left');
+            await injector.dragTo(x1, y1);
+            await injector.mouseUp('left');
+            return `dragged from (${x0}, ${y0}) to (${x1}, ${y1})`;
+        }
+        case 'type': {
+            await injector.typeText(args.text);
+            return `typed ${args.text.length} characters`;
+        }
+        case 'key': {
+            await injector.pressKey(args.text);
+            return `pressed key combo "${args.text}"`;
+        }
+        case 'scroll': {
+            const [x, y] = toPhys(args.coordinate);
+            await injector.moveTo(x, y);
+            const amount = args.scroll_amount ?? 3;
+            await injector.scroll(args.scroll_direction, amount);
+            return `scrolled ${args.scroll_direction} by ${amount} at (${x}, ${y})`;
+        }
+        case 'wait': {
+            await new Promise((r) => setTimeout(r, args.duration_ms));
+            return `waited ${args.duration_ms}ms`;
+        }
+        case 'cursor_position': {
+            const pos = await injector.cursorPosition();
+            const [nx, ny] = physicalToNorm(pos.x, pos.y, physW, physH);
+            return `cursor at physical (${pos.x}, ${pos.y}) = normalized (${nx}, ${ny})`;
+        }
+        default:
+            throw new Error(`no executor for action "${action}"`);
+    }
+}
+export const computerTool = {
+    name: 'computer',
+    description: 'Control the desktop GUI: move/click the mouse, type text, press keys, scroll, and zoom into screen regions. ' +
+        'Every action returns a fresh screenshot as a visual attachment — inspect it before the next action and self-correct. ' +
+        'Coordinates use a normalized 0-1000 grid (x right, y down) over the primary screen; you never need the physical resolution. ' +
+        'Use zoom on a tight region before clicking small or dense UI elements. Destructive or sensitive targets ' +
+        '(form submit, payment, credentials, delete/send) require explicit user intent — ask first.',
+    risk: 'dangerous',
+    parameters: {
+        type: 'object',
+        properties: {
+            action: { type: 'string', enum: [...ACTIONS] },
+            coordinate: {
+                type: 'array',
+                items: { type: 'integer' },
+                minItems: 2,
+                maxItems: 2,
+                description: '[x, y] in normalized 0-1000 space. Required for move/click/scroll/drag start.',
+            },
+            coordinate_to: {
+                type: 'array',
+                items: { type: 'integer' },
+                minItems: 2,
+                maxItems: 2,
+                description: 'Drag destination in normalized 0-1000 space (left_click_drag only).',
+            },
+            text: {
+                type: 'string',
+                description: 'Text to type (type) or key combo like "ctrl+s" / "Return" / "ctrl+shift+t" (key).',
+            },
+            scroll_direction: { type: 'string', enum: ['up', 'down', 'left', 'right'] },
+            scroll_amount: { type: 'integer', description: `Scroll clicks 1-${SCROLL_MAX} (default 3).` },
+            region: {
+                type: 'array',
+                items: { type: 'integer' },
+                minItems: 4,
+                maxItems: 4,
+                description: 'zoom only: [x, y, w, h] in normalized 0-1000 space.',
+            },
+            duration_ms: { type: 'integer', description: `wait only: milliseconds (1-${WAIT_MAX_MS}).` },
+            target: {
+                type: 'string',
+                enum: ['primary', 'all'],
+                description: 'screenshot only: display scope (default primary). All other actions act on the primary screen.',
+            },
+        },
+        required: ['action'],
+        additionalProperties: false,
+    },
+    async execute(args, ctx) {
+        const invalid = validateComputerArgs(args);
+        if (invalid) {
+            return { status: 'error', code: 'INVALID_ARGUMENTS', retryable: false, output: `Invalid computer action: ${invalid}` };
+        }
+        const action = args.action;
+        let injector;
+        try {
+            injector = createInputInjector();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { status: 'error', code: 'EXECUTION_ERROR', retryable: false, output: message };
+        }
+        injector.bindSignal(ctx?.signal);
+        try {
+            // 动作前截屏:拿物理分辨率(norm1000 → 物理像素换算的基础)。
+            const before = await capturePrimary(ctx?.signal);
+            const screen = { physW: before.physW, physH: before.physH };
+            // zoom:不注入输入,裁 region 放大回灌。
+            if (action === 'zoom') {
+                const rect = normRectToPhysical(args.region, screen.physW, screen.physH);
+                const png = decodePng(await readFile(before.path));
+                const zoomed = fitToLongEdge(crop(png, rect.x, rect.y, rect.w, rect.h), MAX_EDGE);
+                const buf = encodePng(zoomed);
+                return {
+                    status: 'success',
+                    code: 'OK',
+                    retryable: false,
+                    output: `Zoomed into region ${JSON.stringify(args.region)} → physical (${rect.x}, ${rect.y}, ${rect.w}×${rect.h}), ` +
+                        `magnified to ${zoomed.width}×${zoomed.height}. The attached image shows ONLY this region — ` +
+                        `coordinates you output still map to the FULL screen, so do not reuse this region's local coordinates for clicks.`,
+                    modelAttachments: [
+                        { type: 'image', name: 'computer-zoom.png', mime: 'image/png', dataUrl: `data:image/png;base64,${buf.toString('base64')}` },
+                    ],
+                };
+            }
+            // screenshot:只截屏回灌(target 可指定 all)。
+            if (action === 'screenshot') {
+                let shotPath = before.path;
+                if (args.target === 'all') {
+                    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+                    const allPath = jailResolve(`.mocode/screenshots/computer-${ts}-all.png`);
+                    await mkdir(dirname(allPath), { recursive: true });
+                    const cap = await captureDesktop(allPath, 'all', ctx?.signal);
+                    if (cap.status !== 'passed')
+                        throw new Error(`screenshot capture failed: ${cap.detail}`);
+                    shotPath = allPath;
+                }
+                const att = await toAttachment(shotPath);
+                return {
+                    status: 'success',
+                    code: 'OK',
+                    retryable: false,
+                    output: `Screenshot captured (physical ${screen.physW}×${screen.physH}, shown at ${att.dispW}×${att.dispH}). ` +
+                        'Coordinates remain normalized 0-1000 over the primary screen. Visual content is attached to the next model request.',
+                    modelAttachments: [{ type: 'image', name: 'computer-screenshot.png', mime: 'image/png', dataUrl: att.dataUrl }],
+                };
+            }
+            // 输入动作:注入 → 重截屏回灌(wait 也回灌,等待后界面往往已变化)。
+            const summary = await executeAction(injector, action, args, screen);
+            const after = await capturePrimary(ctx?.signal);
+            const att = await toAttachment(after.path);
+            return {
+                status: 'success',
+                code: 'OK',
+                retryable: false,
+                output: `${summary}. Screen re-captured (physical ${screen.physW}×${screen.physH}, shown at ${att.dispW}×${att.dispH}): ` +
+                    'inspect the attached screenshot to verify the result before the next action.',
+                modelAttachments: [{ type: 'image', name: 'computer-result.png', mime: 'image/png', dataUrl: att.dataUrl }],
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (ctx?.signal?.aborted || /aborted/i.test(message)) {
+                return { status: 'aborted', code: 'ABORTED', retryable: false, output: message };
+            }
+            return { status: 'error', code: 'EXECUTION_ERROR', retryable: false, output: `computer action failed: ${message}` };
+        }
+    },
+};

package/dist/tools/builtins/dev-server.js

@@ -11,9 +11,7 @@ function optionalString(args, name) {
 }
 function failure(error) {
     if (error instanceof DevServerManagerError) {
-        const status = error.code === 'SANDBOX_DENIED'
-            ? 'denied'
-            : error.code === 'ABORTED' ? 'aborted' : 'error';
+        const status = error.code === 'SANDBOX_DENIED' ? 'denied' : error.code === 'ABORTED' ? 'aborted' : 'error';
         return result(status, error.code, { error: error.message });
     }
     return result('error', 'EXECUTION_ERROR', {

package/dist/tools/builtins/edit-file.js

@@ -1,6 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { jailResolve } from '../../sandbox/index.js';
-import { commitChangeSet, createChangeSet, normalizeContentHash, summarizeChangeSet, } from '../../changeset/index.js';
+import { commitChangeSet, createChangeSet, normalizeContentHash, summarizeChangeSet } from '../../changeset/index.js';
 function conflict(path, details) {
     return {
         status: 'error',
@@ -35,11 +35,23 @@ expected_hash is required (sha256 from read_file artifact header) and must match
         type: 'object',
         properties: {
             path: { type: 'string', description: 'Absolute file path.' },
-            old_string: { type: 'string', description: 'String replacement mode: the exact text to replace (must occur once). Mutually exclusive with line_start/line_end.' },
+            old_string: {
+                type: 'string',
+                description: 'String replacement mode: the exact text to replace (must occur once). Mutually exclusive with line_start/line_end.',
+            },
             new_string: { type: 'string', description: 'The replacement text.' },
-            line_start: { type: 'integer', description: 'Line-range mode: start line (1-based, inclusive). Mutually exclusive with old_string.' },
-            line_end: { type: 'integer', description: 'Line-range mode: end line (1-based, inclusive). Mutually exclusive with old_string.' },
-            expected_hash: { type: 'string', description: 'sha256 hash from the latest read_file artifact header (sha256:<64 hex>).' },
+            line_start: {
+                type: 'integer',
+                description: 'Line-range mode: start line (1-based, inclusive). Mutually exclusive with old_string.',
+            },
+            line_end: {
+                type: 'integer',
+                description: 'Line-range mode: end line (1-based, inclusive). Mutually exclusive with old_string.',
+            },
+            expected_hash: {
+                type: 'string',
+                description: 'sha256 hash from the latest read_file artifact header (sha256:<64 hex>).',
+            },
         },
         // 注意:expected_hash 故意不放进 schema 的 required。
         // 原因:缺失时若被 AJV 在 schema 层拦下,只会得到泛化的
@@ -104,12 +116,14 @@ expected_hash is required (sha256 from read_file artifact header) and must match
             updated = lines.join('\n');
         }
         const replacement = data.includes('\r\n') ? updated.replace(/\n/g, '\r\n') : updated;
-        const result = await commitChangeSet(createChangeSet([{
+        const result = await commitChangeSet(createChangeSet([
+            {
                 path: file,
                 operation: 'update',
                 expectedHash,
                 replacement,
-            }]), ctx?.signal);
+            },
+        ]), ctx?.signal);
         if (result.status === 'conflict') {
             const item = result.conflicts[0];
             return conflict(file, `expected=${item?.expectedHash ?? 'missing'}, actual=${item?.actualHash ?? 'missing'}。请重新读取后再编辑。`);

package/dist/tools/builtins/grep.js

@@ -49,7 +49,7 @@ export const grepTool = {
         const hits = [];
         let scanned = 0;
         let truncated = false;
-        outer: for (const f of files) {
+        for (const f of files) {
             let content;
             try {
                 // jailResolve:realpath 化,防「牢内文件软链→牢外」的内容泄露;越界/不可读均 catch 跳过