mocode-ai 1.7.2 → 1.7.5

package/dist/permissions/index.js

@@ -7,6 +7,7 @@ import { config } from '../config/index.js';
 import { readConfigFile, updateConfigKey } from '../config/file.js';
 import { getSandboxRoot } from '../sandbox/index.js';
 import { t } from '../i18n/index.js';
+import { lookupElementRefName } from '../runtime/uia-selector.js';
 const PERMISSIONS_PATH = path.join(os.homedir(), '.mocode', 'permissions.json');
 const PERMISSIONS_VERSION = 3;
 let permanentGrants = [];
@@ -27,23 +28,24 @@ function canonicalProjectRoot(root) {
     const resolved = path.resolve(root);
     return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
 }
-/**
- * computer 工具的 type/key 文本内容审查:
- * 命中 URL / 密码形态 / 支付关键词时,无论是否已授权都强制 once 级确认——
- * 这类文本是「把内容敲进任意应用」的载体,不能因 session/项目授权而放行后续所有输入。
- * 纯函数,独立可单测。
- */
-export function computerTextNeedsReview(text) {
-    const s = text.toLowerCase();
-    if (/https?:\/\/|www\.[a-z0-9-]+\.[a-z]{2,}/i.test(s))
-        return true;
-    if (/\b(pass(word)?|passwd|pwd|secret|token|api[_-]?key|credential)\b\s*[:=]/i.test(s))
-        return true;
-    if (/\b(card\s*number|cvv|cvc|expiry)\b/i.test(s))
-        return true;
-    // CJK 关键词没有 \b 词边界概念(\b 只在 \w 与非 \w 之间成立,中文不是 \w),用普通子串匹配。
-    if (/信用卡|卡号|密码|支付|付款|验证码/.test(s))
-        return true;
+// 敏感内容谓词住在叶子模块 computer-review.ts(flows/ 要复用,而本文件将反过来读 flow 文件,
+// 放叶子里避免 import 环);这里 re-export 保持既有 API 与测试不变。
+import { computerTargetNeedsReview, computerTextNeedsReview } from './computer-review.js';
+export { computerTargetNeedsReview, computerTextNeedsReview };
+import { reviewFlowRun } from './flow-review.js';
+/** computer 调用是否命中「强制 once」审查:敏感文本(type/key/set_value)或敏感按钮(click_element)。 */
+export function computerArgsNeedReview(args) {
+    if ((args.action === 'type' || args.action === 'key' || args.action === 'set_value') &&
+        typeof args.text === 'string') {
+        if (computerTextNeedsReview(args.text))
+            return true;
+    }
+    if (args.action === 'click_element' && typeof args.ref === 'string') {
+        const el = lookupElementRefName(args.ref);
+        // ref 无登记(未 inspect / 已过期):工具会以 ELEMENT_NOT_FOUND 拒绝执行,这里不额外弹窗。
+        if (el && computerTargetNeedsReview(el.name))
+            return true;
+    }
     return false;
 }
 /** A grant is bound to the actual command or logical resources, never merely a tool name. */
@@ -57,6 +59,11 @@ export function permissionFingerprint(tool, args) {
         // 按动作粒度授权:允许一次 left_click = 本会话允许任意坐标的左键。
         subject = { computer: typeof args.action === 'string' ? args.action : 'unknown' };
     }
+    else if (tool.name === 'run_flow') {
+        // run_flow:授权绑定 flow 名 + 文件 hash(flow 被改过,旧授权立即失效);参数值不进指纹。
+        const review = reviewFlowRun(args);
+        subject = { run_flow: review.name, hash: review.hash ?? 'unloadable' };
+    }
     else {
         let resources;
         try {
@@ -119,7 +126,10 @@ function savePermanent() {
 export function getToolRisk(tool) {
     return tool.risk ?? 'safe';
 }
-function summarizeArgs(args) {
+function summarizeArgs(args, toolName) {
+    // run_flow:弹窗展示整条 flow 的步骤摘要与参数(secret 以 *** 显示),而不是只有一个 flow 名。
+    if (toolName === 'run_flow')
+        return reviewFlowRun(args).summary;
     const lines = [];
     if (typeof args.path === 'string')
         lines.push(t('permission.path', { value: args.path }));
@@ -130,6 +140,11 @@ function summarizeArgs(args) {
         const parts = [args.action];
         if (Array.isArray(args.coordinate))
             parts.push(`@(${args.coordinate.join(', ')})`);
+        if (typeof args.ref === 'string') {
+            // click_element/set_value:弹窗显示 ref 对应的元素名,而不是只给一个无意义的 e9。
+            const el = lookupElementRefName(args.ref);
+            parts.push(el ? `${args.ref} ${el.role} ${JSON.stringify(el.name.slice(0, 60))}` : args.ref);
+        }
         if (typeof args.text === 'string' && args.text) {
             const preview = args.text.slice(0, 80);
             parts.push(`"${preview}${args.text.length > 80 ? '…' : ''}"`);
@@ -155,13 +170,13 @@ async function checkPermissionWithSessionGrants(runtimeConfig, runtimeSessionGra
     loadPermanent();
     if (permanentToolAllows.has(tool.name))
         return 'allow';
-    // computer 的 type/key 命中敏感内容(URL/密码/支付)时强制 once 级确认:
-    // 不看任何授权缓存,也不提供 session/项目/永久授权选项——这类文本是「敲进任意应用」的载体,
-    // 一旦放行不该沿用到下一次输入。
-    const forceOnce = tool.name === 'computer' &&
-        (args.action === 'type' || args.action === 'key') &&
-        typeof args.text === 'string' &&
-        computerTextNeedsReview(args.text);
+    // computer 命中敏感内容时强制 once 级确认:type/key/set_value 的文本(URL/密码/支付),
+    // 或 click_element 的目标按钮名(删除/发送/支付…)。不看任何授权缓存,也不提供
+    // session/项目/永久授权选项——这类动作一旦放行不该沿用到下一次。
+    // run_flow 回放内部的单步不再走本函数,所以整条 flow 的敏感判定在启动前一次做完(flow-review.ts)。
+    const flowReview = tool.name === 'run_flow' ? reviewFlowRun(args) : undefined;
+    const forceOnce = (tool.name === 'computer' && computerArgsNeedReview(args)) ||
+        (flowReview !== undefined && flowReview.reasons.length > 0);
     const fingerprint = permissionFingerprint(tool, args);
     const projectRoot = canonicalProjectRoot(options.projectRoot ?? getSandboxRoot() ?? process.cwd());
     if (!forceOnce) {
@@ -186,9 +201,13 @@ async function checkPermissionWithSessionGrants(runtimeConfig, runtimeSessionGra
         : [onceOption, sessionOption, projectOption, alwaysOption, denyOption];
     // 新手首次审批引导:第一次弹出确认面板时附一段说明(每个用户只出现一次,
     // ~/.mocode/config 的 onboarding_approval_hint 标记;读写失败静默,不阻断审批)。
-    let detail = summarizeArgs(args) + (dangerous ? `\n\n${t('permission.dangerWarning')}` : '');
-    if (forceOnce)
-        detail += `\n\n${t('permission.computerSensitiveReview')}`;
+    // run_flow:弹窗展示整条 flow 的步骤摘要(不含 secret 取值)与触发强制确认的原因。
+    let detail = (flowReview ? flowReview.summary : summarizeArgs(args)) + (dangerous ? `\n\n${t('permission.dangerWarning')}` : '');
+    if (forceOnce) {
+        detail += flowReview?.reasons.length
+            ? `\n\nPer-run approval required:\n${flowReview.reasons.map((r) => `  - ${r}`).join('\n')}`
+            : `\n\n${t('permission.computerSensitiveReview')}`;
+    }
     const ONBOARDING_KEY = 'onboarding_approval_hint';
     try {
         if (!readConfigFile()[ONBOARDING_KEY]) {

package/dist/repl/commands/flow.js

@@ -0,0 +1,210 @@
+/**
+ * 桌面流程命令组:/flow list · show <name> · save <name> [--from N] [--to M] [--force] [描述] · run <name> [参数=值 ...]
+ *
+ * 数据流(design-notes/computer-use-rpa.md §5):computer 动作被结构化录进会话的 gui-trace.jsonl,
+ * `/flow save` 把它导出成 `.mocode/flows/<name>.json`,`/flow run` 不经过模型直接回放。
+ * 回放受 Computer Use 总开关否决(/cu off);命中敏感内容(secret 参数、敏感文本、删除/发送/支付类目标)
+ * 的 flow 在开跑前强制逐次确认,与 run_flow 工具走同一套审查(permissions/flow-review.ts)。
+ *
+ * 重模块(computer.ts 及其 UIA/抓屏依赖)只在 run 时动态加载,不拖慢启动。
+ */
+import * as layout from '../../ui/layout.js';
+import { ui } from '../../ui/theme.js';
+import { t } from '../../i18n/index.js';
+import { isComputerUseRouteAllowed } from '../../config/index.js';
+import { promptIntervention } from '../../ui/intervention.js';
+import { startRunningListener, stopRunningListener } from '../running-input.js';
+import { unhandled, next } from './types.js';
+/** 按空白切词,支持 "双引号"(内部 \" 转义)与 '单引号';key="a b" 视为一个词。 */
+export function tokenizeFlowArgs(s) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    let has = false;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quote) {
+            if (c === quote)
+                quote = null;
+            else if (c === '\\' && quote === '"' && s[i + 1] === '"')
+                cur += s[++i];
+            else
+                cur += c;
+        }
+        else if (c === '"' || c === "'") {
+            quote = c;
+            has = true;
+        }
+        else if (/\s/.test(c)) {
+            if (has || cur) {
+                out.push(cur);
+                cur = '';
+                has = false;
+            }
+        }
+        else {
+            cur += c;
+            has = true;
+        }
+    }
+    if (has || cur)
+        out.push(cur);
+    return out;
+}
+const warn = (msg) => layout.contentWrite(`${ui.yellow}${msg}${ui.reset}\n`);
+const dim = (msg) => layout.contentWrite(`${ui.dim}${msg}${ui.reset}\n`);
+async function flowList() {
+    const { listFlows } = await import('../../flows/flow.js');
+    const items = listFlows();
+    if (items.length === 0) {
+        dim(t('flow.noFlows'));
+        return;
+    }
+    for (const it of items) {
+        layout.contentWrite(`${ui.accent}${it.name}${ui.reset}  ${ui.dim}${it.steps} steps${it.description ? ` · ${it.description}` : ''}${ui.reset}\n`);
+    }
+}
+async function flowShow(name) {
+    if (!name)
+        return warn(t('flow.usage'));
+    const { loadFlow, summarizeFlow } = await import('../../flows/flow.js');
+    const loaded = loadFlow(name);
+    if (!loaded.ok)
+        return warn(loaded.error);
+    layout.contentWrite(`${summarizeFlow(loaded.flow)}\n${ui.dim}${loaded.path}${ui.reset}\n`);
+}
+async function flowSave(tokens) {
+    let from;
+    let to;
+    let force = false;
+    const positional = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const tok = tokens[i];
+        if (tok === '--force')
+            force = true;
+        else if (tok === '--from' || tok === '--to') {
+            const n = Number(tokens[++i]);
+            if (!Number.isInteger(n) || n < 1)
+                return warn(t('flow.usage'));
+            if (tok === '--from')
+                from = n;
+            else
+                to = n;
+        }
+        else
+            positional.push(tok);
+    }
+    const name = positional.shift();
+    if (!name)
+        return warn(t('flow.usage'));
+    const description = positional.join(' ').trim() || undefined;
+    const { exportFlowFromTrace, saveFlow } = await import('../../flows/flow.js');
+    const { readTrace } = await import('../../flows/trace.js');
+    const exported = exportFlowFromTrace(readTrace(), { name, description, from, to });
+    if (!exported.ok)
+        return warn(exported.error);
+    const saved = saveFlow(exported.flow, { overwrite: force });
+    if (!saved.ok)
+        return warn(saved.error);
+    layout.contentWrite(`${ui.green}${t('flow.saved', { name, steps: exported.flow.steps.length, path: saved.path })}${ui.reset}\n`);
+    const required = Object.entries(exported.flow.params)
+        .filter(([, p]) => p.default === undefined)
+        .map(([k]) => k);
+    if (required.length)
+        dim(t('flow.savedParams', { name, params: required.join(', ') }));
+    const fragile = exported.flow.steps.filter((s) => s.fragile).length;
+    if (fragile)
+        warn(t('flow.fragile', { count: fragile }));
+}
+async function flowRun(tokens) {
+    const name = tokens.shift();
+    if (!name)
+        return warn(t('flow.usage'));
+    if (!isComputerUseRouteAllowed())
+        return warn(t('flow.gateOff'));
+    const params = {};
+    let windowTitleRegex;
+    for (let i = 0; i < tokens.length; i++) {
+        const tok = tokens[i];
+        if (tok === '--window') {
+            const re = tokens[++i];
+            if (!re)
+                return warn(t('flow.usage'));
+            try {
+                new RegExp(re, 'i');
+            }
+            catch {
+                return warn(t('flow.badParam', { token: `--window ${re}` }));
+            }
+            windowTitleRegex = re;
+            continue;
+        }
+        const eq = tok.indexOf('=');
+        if (eq <= 0)
+            return warn(t('flow.badParam', { token: tok }));
+        params[tok.slice(0, eq)] = tok.slice(eq + 1);
+    }
+    const { loadFlow } = await import('../../flows/flow.js');
+    const loaded = loadFlow(name);
+    if (!loaded.ok)
+        return warn(loaded.error);
+    // 与 run_flow 工具同一套审查:敏感 flow 开跑前必须逐次确认(回放内部的单步不再弹窗)。
+    const { reviewFlowRun } = await import('../../permissions/flow-review.js');
+    const review = reviewFlowRun({
+        name,
+        params,
+        ...(windowTitleRegex !== undefined ? { window_title_regex: windowTitleRegex } : {}),
+    });
+    if (review.reasons.length) {
+        const allow = t('permission.allow');
+        const deny = t('permission.deny');
+        const res = await promptIntervention({
+            type: 'choice',
+            title: t('permission.dangerTitle', { tool: 'flow run' }),
+            detail: `${review.summary}\n\nPer-run approval required:\n${review.reasons.map((r) => `  - ${r}`).join('\n')}`,
+            options: [allow, deny],
+            allowCustom: false,
+            defaultIndex: 1,
+        });
+        if (res.action === 'cancelled' || res.value !== allow)
+            return dim(t('flow.cancelled'));
+    }
+    const { runFlowWithComputer } = await import('../../tools/builtins/run-flow.js');
+    const { formatFlowRunResult } = await import('../../flows/runner.js');
+    const signal = startRunningListener(t('flow.running'));
+    let result;
+    try {
+        result = await runFlowWithComputer(loaded.flow, params, signal, { windowTitleRegex });
+    }
+    finally {
+        stopRunningListener();
+    }
+    const color = result.status === 'completed' ? ui.green : result.status === 'aborted' ? ui.dim : ui.yellow;
+    layout.contentWrite(`${color}${formatFlowRunResult(loaded.flow, result)}${ui.reset}\n`);
+}
+export const flowCommands = [
+    async (ctx) => {
+        const { line } = ctx;
+        if (line !== '/flow' && !line.startsWith('/flow '))
+            return unhandled();
+        const tokens = tokenizeFlowArgs(line.slice('/flow'.length));
+        const sub = (tokens.shift() ?? '').toLowerCase();
+        switch (sub) {
+            case 'list':
+                await flowList();
+                break;
+            case 'show':
+                await flowShow(tokens[0]);
+                break;
+            case 'save':
+                await flowSave(tokens);
+                break;
+            case 'run':
+                await flowRun(tokens);
+                break;
+            default:
+                warn(t('flow.usage'));
+        }
+        return next();
+    },
+];

package/dist/repl/commands/registry.js

@@ -20,6 +20,7 @@ import { jobsCommands } from './jobs.js';
 import { diffCommands } from './diff.js';
 import { scheduleCommands } from './schedule.js';
 import { botsCommands } from './bots.js';
+import { flowCommands } from './flow.js';
 /**
  * 命令注册表。顺序即匹配优先级 —— 更具体的分支放前面。
  * 组内顺序由各文件自己保证(见文件头注释);组间顺序互不影响(条件互斥)。
@@ -48,6 +49,7 @@ export const commandHandlers = [
     ...diffCommands,
     ...scheduleCommands,
     ...botsCommands,
+    ...flowCommands,
 ];
 /**
  * 依次询问 handler,返回第一个非 unhandled 的结果。

package/dist/repl/commands/tool-group.js

@@ -112,6 +112,12 @@ export const toolGroupCommands = [
                     layout.contentWrite(`${ui.dim}${s.count} calls · total p50 ${s.totalP50}ms / p95 ${s.totalP95}ms · ` +
                         `capture p50 ${s.captureP50}ms · ${kb}KB/frame · ` +
                         `dedup ${(s.skippedRatio * 100).toFixed(0)}%${ui.reset}\n`);
+                    // 按动作拆开:新动作(inspect / wait_until / 窗口类)单独对比基线,不被截图类动作的分位数淹没。
+                    const rows = Object.entries(s.byAction)
+                        .sort((a, b) => b[1].count - a[1].count)
+                        .map(([action, v]) => `${action} ×${v.count} p50 ${v.p50}ms / p95 ${v.p95}ms`);
+                    if (rows.length > 0)
+                        layout.contentWrite(`${ui.dim}${rows.join(' · ')}${ui.reset}\n`);
                 }
             }
             catch {
@@ -167,13 +173,15 @@ export const toolGroupCommands = [
             // 常驻 PowerShell 进程(注入 / 抓屏)不会随主进程自动退出(Windows 尤其),关开关时必须
             // 显式回收,否则每次 /cu off 都留一组孤儿进程。差分基准帧与几何缓存也一并清掉。
             try {
-                const [{ disposeInputInjector }, { disposeCaptureService }, { resetComputerState }] = await Promise.all([
+                const [{ disposeInputInjector }, { disposeCaptureService }, { disposeUiaService }, { resetComputerState }] = await Promise.all([
                     import('../../runtime/input-injector.js'),
                     import('../../runtime/screen-capture-service.js'),
+                    import('../../runtime/uia-service.js'),
                     import('../../tools/builtins/computer.js'),
                 ]);
                 await disposeInputInjector();
                 await disposeCaptureService();
+                await disposeUiaService();
                 resetComputerState();
             }
             catch {

package/dist/repl/commands.js

@@ -74,6 +74,16 @@ export function buildSlashCommands() {
                 { name: 'status', value: '/cu status', desc: d('commands.cuStatus') },
             ],
         },
+        {
+            name: '/flow',
+            desc: d('commands.flow'),
+            children: [
+                { name: 'list', value: '/flow list', desc: d('commands.flowList') },
+                { name: 'show', value: '/flow show ', submit: false, desc: d('commands.flowShow') },
+                { name: 'save', value: '/flow save ', submit: false, desc: d('commands.flowSave') },
+                { name: 'run', value: '/flow run ', submit: false, desc: d('commands.flowRun') },
+            ],
+        },
         {
             name: '/mcp',
             desc: d('commands.mcp'),

package/dist/repl/running-input.js

@@ -2,14 +2,18 @@ import { emitKeypressEvents } from 'node:readline';
 import { stdin } from 'node:process';
 import * as layout from '../ui/layout.js';
 import * as mouse from '../ui/mouse.js';
+import { promptComposer } from '../ui/composer.js';
 import { appendCurrentSessionRuntimeEvent } from '../session/index.js';
 const emitter = stdin;
-// ── 运行态交互(typeahead 输入 + 滚动回看 + Ctrl+C 中断)──
+// ── 运行态交互(typeahead 输入 + 滚动回看 + Ctrl+C 中断 + Ctrl+G 输入面板)──
 // 只在 await runAgent() 期间挂载;/resume /rollback /compact 等走 askLine(cooked readline)的分支不挂(避免抢 stdin)。
-let runningInput = ''; // 运行中已打字缓冲(单行;agent 结束后预填下一轮 INPUT 态)
+let runningInput = ''; // 运行中已打字缓冲(agent 结束后预填下一轮 INPUT 态;经输入面板可含换行)
 let runningCursor = 0; // 缓冲内光标字符索引(0..len);运行态支持任意位置编辑,与空闲态一致
 let runningPlaceholder = '';
 let currentAbort = null;
+let listening = false; // onRunningKey 是否处于挂载期(start → stop 之间)
+/** 运行态打开的输入面板(Ctrl+G);非 null = 面板仍开着。主循环进 INPUT 态前须等它关闭,否则两个 keypress 监听抢键。 */
+let composerPending = null;
 /** 获取运行中输入缓冲(agent 结束后预填下一轮 INPUT 态)。 */
 export function getRunningInput() {
     return runningInput;
@@ -19,7 +23,48 @@ export function clearRunningInput() {
     runningInput = '';
     runningCursor = 0;
 }
-/** 运行态按键:滚动优先,再 Ctrl+C 中断,再 typeahead 编辑(单行,Enter=无操作)。 */
+/**
+ * 等待运行态打开的输入面板关闭(无则立即返回)。
+ * agent 可能在面板打开期间结束:主循环在进入 INPUT 态(promptWithSlashMenu 挂自己的 keypress)前必须 await,
+ * 面板确认的内容随后经 getRunningInput 预填进输入框。
+ */
+export function waitForRunningComposer() {
+    return composerPending ?? Promise.resolve();
+}
+/** 单行回显:换行折为空格(等长替换,光标索引不变),防多行内容撑破底栏输入行。 */
+function paint() {
+    layout.paintRunningInput(runningInput.replace(/[\r\n]/g, ' '), runningCursor, runningPlaceholder);
+}
+/**
+ * Ctrl+G(运行态):打开输入面板编辑 typeahead 缓冲。
+ * 期间摘掉 onRunningKey(面板自己挂 keypress),并标记 overlay——流式输出 / 状态行心跳 / spinner 帧只喂缓冲
+ * 不物理写,否则 80ms 心跳与流式会覆盖弹窗、抢走光标。关闭后整幅重画;确认的内容写回 typeahead 缓冲(不发送)。
+ */
+async function openRunningComposer() {
+    emitter.off('keypress', onRunningKey);
+    layout.setOverlayActive(true);
+    let result = { text: null };
+    try {
+        result = await promptComposer({ initialText: runningInput });
+    }
+    finally {
+        layout.setOverlayActive(false);
+        if (listening) {
+            // agent 仍在跑:恢复运行态监听(面板 finish 会 pause stdin,这里续上)
+            emitter.on('keypress', onRunningKey);
+            stdin.resume();
+        }
+        layout.repaintViewport();
+        layout.drawStatusBar();
+    }
+    if (result.text != null) {
+        runningInput = result.text;
+        runningCursor = runningInput.length;
+    }
+    if (listening)
+        paint();
+}
+/** 运行态按键:滚动优先,再 Ctrl+C 中断,再 Ctrl+G 面板,再 typeahead 编辑(单行,Enter=无操作)。 */
 function onRunningKey(_str, key) {
     if (!key)
         return;
@@ -51,7 +96,7 @@ function onRunningKey(_str, key) {
         if (runningInput.length > 0) {
             runningInput = '';
             runningCursor = 0;
-            layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+            paint();
         }
         else if (currentAbort && !currentAbort.signal.aborted) {
             appendCurrentSessionRuntimeEvent('abort', { phase: 'requested', source: 'keyboard' });
@@ -59,47 +104,58 @@ function onRunningKey(_str, key) {
         }
         return;
     }
+    // Ctrl+G:打开输入面板(与 INPUT 态一致;确认只填回 typeahead 缓冲,agent 结束后预填,不发送)
+    if (key.ctrl && key.name === 'g') {
+        if (!composerPending) {
+            composerPending = openRunningComposer()
+                .catch(() => undefined)
+                .finally(() => {
+                composerPending = null;
+            });
+        }
+        return;
+    }
     const s = key.sequence ?? '';
     // 光标移动(单行 typeahead,光标可任意位置,与空闲态一致)
     if (key.name === 'left') {
         runningCursor = Math.max(0, runningCursor - 1);
-        layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+        paint();
         return;
     }
     if (key.name === 'right') {
         runningCursor = Math.min(runningInput.length, runningCursor + 1);
-        layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+        paint();
         return;
     }
     if (key.name === 'home' || (key.ctrl && key.name === 'a')) {
         runningCursor = 0;
-        layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+        paint();
         return;
     }
     if (key.name === 'end' || (key.ctrl && key.name === 'e')) {
         runningCursor = runningInput.length;
-        layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+        paint();
         return;
     }
     if (key.name === 'backspace') {
         if (runningCursor > 0) {
             runningInput = runningInput.slice(0, runningCursor - 1) + runningInput.slice(runningCursor);
             runningCursor--;
-            layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+            paint();
         }
         return;
     }
     if (key.name === 'delete') {
         if (runningCursor < runningInput.length) {
             runningInput = runningInput.slice(0, runningCursor) + runningInput.slice(runningCursor + 1);
-            layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+            paint();
         }
         return;
     }
     if (key.name === 'escape') {
         runningInput = '';
         runningCursor = 0;
-        layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+        paint();
         return;
     }
     // Enter / Ctrl+J:运行中 no-op(单行 typeahead;agent 结束后预填,用户在 INPUT 态按 Enter 提交)
@@ -110,7 +166,7 @@ function onRunningKey(_str, key) {
     if (s && s >= ' ' && !key.ctrl && !key.meta) {
         runningInput = runningInput.slice(0, runningCursor) + s + runningInput.slice(runningCursor);
         runningCursor += s.length;
-        layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+        paint();
     }
 }
 /** 鼠标右键单击输入框(未拖动)时 layout 读剪贴板后回调:在光标处插入 typeahead 缓冲(单行,换行折为空格)。 */
@@ -118,7 +174,7 @@ function onRunningMousePaste(text) {
     const flat = text.replace(/[\r\n]+/g, ' ');
     runningInput = runningInput.slice(0, runningCursor) + flat + runningInput.slice(runningCursor);
     runningCursor += flat.length;
-    layout.paintRunningInput(runningInput, runningCursor, runningPlaceholder);
+    paint();
 }
 /** 进入运行态:挂 keypress 监听 + raw mode + 新建 abort 控制器,返回其 signal。在 await runAgent 前、enterRunningMode 后调。 */
 export function startRunningListener(placeholder) {
@@ -134,13 +190,18 @@ export function startRunningListener(placeholder) {
     }
     stdin.resume();
     emitter.on('keypress', onRunningKey);
+    listening = true;
     layout.setPasteHandler(onRunningMousePaste); // 鼠标右键单击输入框(未拖动)→ 读剪贴板贴入
     const ac = new AbortController();
     currentAbort = ac;
     return ac.signal;
 }
-/** 退出运行态:摘监听 + 清 abort。不 pause / 不 setRawMode(false)——紧接着 promptWithSlashMenu 自己接管 raw。 */
+/**
+ * 退出运行态:摘监听 + 清 abort。不 pause / 不 setRawMode(false)——紧接着 promptWithSlashMenu 自己接管 raw。
+ * 若输入面板仍开着,面板继续持有键盘;关闭时据 listening=false 不再恢复运行态监听(主循环 await waitForRunningComposer)。
+ */
 export function stopRunningListener() {
+    listening = false;
     emitter.off('keypress', onRunningKey);
     layout.setPasteHandler(null);
     currentAbort = null;

package/dist/repl/runtime.js

@@ -32,7 +32,7 @@ import { PROMPT, buildSlashCommands, LLM_ERROR_HINT_KEYS, isCommandShape, sugges
 import { dispatchCommand } from './commands/registry.js';
 import { settlePlanStatus, refreshStatusBase, runningStateFor } from './status-bar.js';
 import { messageAttachments, formatUserMessage, textOf, queryHistoryFromMessages, renderHistory, } from './message-format.js';
-import { startRunningListener, stopRunningListener, getRunningInput, clearRunningInput } from './running-input.js';
+import { startRunningListener, stopRunningListener, getRunningInput, clearRunningInput, waitForRunningComposer, } from './running-input.js';
 const emitter = stdin;
 // ── 运行态交互已移到 ./running-input.ts ──
 // ── pendingPrefill / pendingTimer / pendingAttachments 保留在此(awaitPendingRecall / echoInput 用)
@@ -676,6 +676,9 @@ export async function startRepl(initialHistory, sessionId, sandboxRootOverride,
     }
     let hasSubmittedInput = false;
     while (true) {
+        // 运行态 Ctrl+G 打开的输入面板可能在 agent 结束时仍开着:等它关闭再进 INPUT 态,
+        // 否则面板与 promptWithSlashMenu 两个 keypress 监听抢键;面板确认的内容随后经 getRunningInput 预填。
+        await waitForRunningComposer();
         // INPUT 态:画底栏输入框 + 状态行,光标入输入框
         refreshStatusBase(history);
         // 后台反思若已完成(上轮 fire-and-forget),在安全点 flush 一行 dim 摘要: