newmark-agent 0.4.3 → 0.4.5

package/dist/main.js

@@ -735,12 +735,21 @@ function setWindowsConsoleMode(mode) {
     const setMode = Number.isInteger(mode);
     const script = [
         'Add-Type -TypeDefinition \'using System; using System.Runtime.InteropServices; public static class NewmarkConsoleMode { [DllImport("kernel32.dll")] public static extern IntPtr GetStdHandle(int n); [DllImport("kernel32.dll")] public static extern bool GetConsoleMode(IntPtr h, out uint mode); [DllImport("kernel32.dll")] public static extern bool SetConsoleMode(IntPtr h, uint mode); }\'',
-        '$handle = [NewmarkConsoleMode]::GetStdHandle(-10)',
-        '$current = [uint32]0',
-        'if (-not [NewmarkConsoleMode]::GetConsoleMode($handle, [ref]$current)) { exit 2 }',
+        // 输出句柄（STD_OUTPUT_HANDLE = -11）必须启用 ENABLE_VIRTUAL_TERMINAL_PROCESSING(0x4)，
+        // 否则 TUI 的备用屏 ?1049h / 清屏 2J 等 ANSI 序列在 ConHost/传统控制台下不被解析，
+        // 主屏保留滚动历史（滚轮能滚回旧帧），光标追踪也随之错位。
+        '$out = [NewmarkConsoleMode]::GetStdHandle(-11)',
+        '$outMode = [uint32]0',
+        'if (-not [NewmarkConsoleMode]::GetConsoleMode($out, [ref]$outMode)) { exit 2 }',
         setMode
-            ? `$target = [uint32]${mode}; if (-not [NewmarkConsoleMode]::SetConsoleMode($handle, $target)) { exit 3 }`
-            : '$target = [uint32](($current -band (-bnot 7)) -bor 512); if (-not [NewmarkConsoleMode]::SetConsoleMode($handle, $target)) { exit 3 }; Write-Output $current',
+            ? `$target = [uint32]${mode}; if (-not [NewmarkConsoleMode]::SetConsoleMode($out, $target)) { exit 3 }`
+            : 'if (-not [NewmarkConsoleMode]::SetConsoleMode($out, ($outMode -bor 4))) { exit 3 }',
+        // 输入句柄（STD_INPUT_HANDLE = -10）启用 ENABLE_VIRTUAL_TERMINAL_INPUT(0x200)，
+        // 清除 line/echo 让方向键等原始序列可读。
+        '$inp = [NewmarkConsoleMode]::GetStdHandle(-10)',
+        '$inpMode = [uint32]0',
+        'if ([NewmarkConsoleMode]::GetConsoleMode($inp, [ref]$inpMode)) { [NewmarkConsoleMode]::SetConsoleMode($inp, (($inpMode -band (-bnot 7)) -bor 512)) | Out-Null }',
+        'Write-Output $outMode',
     ].join('; ');
     const result = (0, child_process_1.spawnSync)('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script], {
         stdio: ['inherit', 'pipe', 'inherit'],
@@ -1206,6 +1215,11 @@ else if (isTuiArg) {
         || path.basename(process.execPath).toLowerCase() === 'newmark console runtime.exe'
         || process.env.NEWMARK_CONSOLE_WRAPPER === '1');
     if (isConsoleLauncher && process.env.NEWMARK_TUI_SIDECAR !== '1') {
+        // Console mode is shared by every process attached to the same console:
+        // enable output VT processing (and input VT) before spawning the sidecar so
+        // the TUI's ?1049h alternate-screen sequence is actually parsed by ConHost /
+        // traditional consoles. The sidecar also re-applies it defensively below.
+        setWindowsConsoleMode();
         const tuiProcess = (0, child_process_1.spawnSync)(process.execPath, [path.join(__dirname, 'launcher.js'), ...args], {
             cwd: process.cwd(),
             env: {
@@ -3162,16 +3176,31 @@ else {
             });
             electron_1.ipcMain.handle('agent:setModel', async (_event, model) => {
                 if (agent) {
-                    const before = agent.model;
+                    // Compare the resolved selection (qualified deployment or 'auto')
+                    // rather than the bare model name, so switching between two
+                    // same-named models on different providers is still recognized as a
+                    // real change.
+                    const before = agent.modelSelectionValue();
                     agent.setModel(model, true);
+                    const after = agent.modelSelectionValue();
                     // Compression and kernel reset only make sense when the model actually
                     // changed. The renderer sends this on every prompt, so an unchanged
                     // selection must not trigger a context compression round (which can
                     // run an extra model call on large histories).
-                    if (agent.model !== before) {
+                    if (after !== before) {
                         await agent.compressForModelSwitch();
                         resetConversationKernel();
                     }
+                    // Propagate the selection to the target-bound runtime. A running Build
+                    // block keeps its current model until the next Guide/Next re-enters it;
+                    // the runtime records the new selection as pending so the context
+                    // window and the next dequeue both follow the newly selected model.
+                    const target = conversationRuntimeTarget(agent.activeConversationId || 'default');
+                    ensureConversationKernel(root)?.setModel(target, model);
+                    if (wslBackendEnabled())
+                        await ensureWslConversationPool()?.setModel(target, model);
+                    else
+                        await ensureElectronUtilityPool()?.setModel(target, model);
                 }
                 return agent?.model;
             });

package/dist/tools/index.d.ts

@@ -91,13 +91,27 @@ export declare class ToolExecutor {
     private parseGitHubRepo;
     private githubFileAudit;
     private repoSecurityAudit;
+    private collectRepositoryFiles;
     private scanRepositorySecrets;
+    /**
+     * 扫描隐私地址类高危信息：带凭据的 URL（user:pass@）、私网 IP、本地用户目录
+     * 绝对路径（C:\Users\<user>、/home/<user>、/Users/<user>）。这些内容泄露个人
+     * 账号、内网拓扑或本地机器结构，进入公开 remote 即构成隐私暴露，需与密钥同级
+     * 硬性阻挡并在 Agent 二轮审查确认后放行。
+     */
+    private scanRepositoryPrivacyLeaks;
     private releaseExcludedPathFindings;
     private ghJson;
     private gbranch;
     private ghFork;
     private ghPrCreate;
     private withRemoteSecurityPreamble;
+    /**
+     * 硬性阻挡远程写：当密钥或隐私地址类高危信息存在且 Agent 尚未二轮审查确认时，
+     * 返回明确的阻挡结果（脱敏 findings），要求处理/确认后再以
+     * security_review_confirmed=true 重试放行。
+     */
+    private formatRemoteSecurityBlock;
     private gstat;
     private gpull;
     private gpush;

package/dist/tools/index.js

@@ -49,6 +49,7 @@ const terminalTakeover_1 = require("./terminalTakeover");
 const computerUse_1 = require("./computerUse");
 const nativeTools_1 = require("./nativeTools");
 const ssh_1 = require("../core/ssh");
+const workspace_1 = require("../core/workspace");
 const wslHostToolBridge_1 = require("../core/wslHostToolBridge");
 const utilityHostToolBridge_1 = require("../core/utilityHostToolBridge");
 const toolPolicy_1 = require("../core/toolPolicy");
@@ -61,6 +62,41 @@ const computerUseSession_1 = require("../core/computerUseSession");
 function normalizeComputerUseAction(action) {
     return String(action || '').trim().toLowerCase();
 }
+/**
+ * 统一跨环境路径归一。WSL 运行时里，Agent 可能用 Windows 盘符路径（`C:\...` /
+ * `C:/...`）引用 Windows 工作区；Linux 的 `path.isAbsolute` 不认识盘符，会把
+ * 它误当相对路径拼到 `/mnt/...` 工作区下。这里先把盘符路径转换为 `/mnt/<drive>/...`，
+ * 再做常规的绝对/相对判断。非 WSL 运行时行为与旧的 `resolve` 完全一致。
+ */
+function normalizeCrossEnvPath(value, wsPath) {
+    const raw = String(value || '').trim();
+    if (!raw)
+        return wsPath;
+    if (process.env.NEWMARK_WSL_DISTRO) {
+        const posix = (0, workspace_1.windowsDrivePathToPosix)(raw);
+        if (posix)
+            return posix;
+    }
+    if (path.isAbsolute(raw))
+        return raw;
+    return path.join(wsPath, raw);
+}
+/**
+ * WSL 运行时：把 bash 命令里出现的 Windows 盘符路径保守翻译为 `/mnt/<drive>/...`。
+ * 仅替换「以盘符开头、后跟路径字符（不含空白、引号、反引号与 shell 元字符）」的
+ * token，避免误伤 `C:` 标签、环境变量与字符串字面量。非 WSL 原样返回。
+ */
+function translateWindowsPathsForWslBash(script) {
+    if (!process.env.NEWMARK_WSL_DISTRO)
+        return script;
+    const value = String(script || '');
+    if (!/[A-Za-z]:[\\/]/.test(value))
+        return value;
+    return value.replace(/(?<![A-Za-z0-9_])([A-Za-z]):[\\/]([^\s"'`;|&<>()]+)/g, (_match, drive, rest) => {
+        const posix = rest.replace(/\\/g, '/').replace(/\/+$/, '');
+        return `/mnt/${drive.toLowerCase()}/${posix}`;
+    });
+}
 function computerUseOwner(context, wsPath) {
     const conversationId = String(context.conversationId || '').trim();
     if (conversationId)
@@ -350,7 +386,7 @@ class ToolExecutor {
             t('subagent_result', 'Return the persisted transcript, mailbox summary, status, and latest result for a peer agent. Target by exact id (preferred) or name.', { id: { type: 'string', description: 'Exact peer id from subagent_list.' }, name: { type: 'string', description: 'Convenience peer name.' } }, []),
             t('subagent_close', 'Close a same-conversation peer. Root can close any peer; a peer can close only itself. Target by exact id (preferred) or name.', { id: { type: 'string', description: 'Exact peer id from subagent_list.' }, name: { type: 'string', description: 'Convenience peer name.' } }, []),
             t('linked_plan', 'Read or update the current conversation linked Markdown plan. Update requires the current expected_revision.', { action: { type: 'string', enum: ['get', 'update'] }, markdown: { type: 'string' }, expected_revision: { type: 'number' } }, ['action']),
-            t('build_history_query', 'Read the concrete public work details of one historical Build Block. The prompt already exposes user input, final summary, and completion status; call this read-only tool only when the user asks what specifically happened. Select by newest-to-oldest history_index, or by run_id returned from an earlier query. Every activity/guide content is bounded to max_chars (default 2000) to keep the read lean and cache-friendly.', { history_index: { type: 'number', minimum: 1, description: '1-based historical Build Block index from the request ledger; 1 is the newest previous task.' }, run_id: { type: 'string', description: 'Exact run id returned by an earlier build_history_query result.' }, max_events: { type: 'number', minimum: 1, maximum: 200, description: 'Maximum trailing public work events; defaults to 80.' }, max_chars: { type: 'number', minimum: 100, maximum: 4000, description: 'Per-event/per-guide content character bound; defaults to 2000.' } }, []),
+            t('build_history_query', 'Read the concrete public work details (tool calls, results, file changes, guides) of one historical Build Block. Call it proactively when the current task continues, fixes, verifies, or depends on earlier work: reuse the returned activity instead of re-investigating from scratch. Do not call it merely to answer completion status already exposed by the prompt. Select by newest-to-oldest history_index, or by run_id returned from an earlier query. Every activity/guide content is bounded to max_chars (default 2000) to keep the read lean and cache-friendly.', { history_index: { type: 'number', minimum: 1, description: '1-based historical Build Block index from the request ledger; 1 is the newest previous task.' }, run_id: { type: 'string', description: 'Exact run id returned by an earlier build_history_query result.' }, max_events: { type: 'number', minimum: 1, maximum: 200, description: 'Maximum trailing public work events; defaults to 80.' }, max_chars: { type: 'number', minimum: 100, maximum: 4000, description: 'Per-event/per-guide content character bound; defaults to 2000.' } }, []),
             t('context_compress', 'Actively compress the LLM context history for this conversation. This collapses older history entries into a concise summary while preserving the recent tail, which reduces context tokens and cost. IMPORTANT: it affects only the LLM context (what the model sees); the displayed conversation history shown to the user is never altered. Call this when the conversation is long, token pressure is high, or you judge that older turns are no longer needed in full. Idempotent and safe: repeated calls produce incremental summaries.', { keep_recent: { type: 'number', minimum: 2, maximum: 60, description: 'Recent message count to keep uncompressed at the tail. Defaults to the configured keep_recent_messages.' }, force: { type: 'boolean', description: 'Compress even if the context is not yet over the automatic threshold. Defaults to false.' } }, []),
             t('context_history_manage', 'Manage the LLM context history for this conversation without affecting the displayed conversation history. This is the active context-management surface. The hot cache stays bounded; evicted folded segments remain in a conversation-isolated append-only cold archive and are loaded only by explicit search/read/restore calls. Actions: list returns a bounded index of current context entries; remove declares one long-term entry for unload (see below); summarize folds a contiguous current range; restore reinserts a folded segment when its summary marker is still present; search finds matching hot or archived segments; read returns one bounded segment without injecting the whole archive; status reports budgets, hot cache, cold archive, the protected recent zone, and pending removals. The recent context tail and last user message are protected from remove/summarize unless dangerous is true. For cache-optimization, remove ONLY targets long-term history (never the protected recent tail or last user message) and does NOT unload immediately: the declared entry stays in context for the rest of the current Build Block so the provider prefix cache stays stable, then is physically removed when the Block ends — applying to subsequent Blocks only.', {
                 action: { type: 'string', enum: ['list', 'remove', 'summarize', 'restore', 'search', 'read', 'status'], description: 'list current entries; remove one; summarize a range; restore by restore_id; search hot/cold folded segments; read one bounded folded segment; status report context budgets and storage.' },
@@ -422,12 +458,15 @@ class ToolExecutor {
                 include_remote: { type: 'boolean' },
                 base_ref: { type: 'string' },
             }, []),
-            t('repo_security_audit', 'Review a local or remote-backed repository for release/privacy risk before remote actions. Reports GitHub/private/public state, dirty files, ignored local-only files, likely secret material, release-excluded paths, and recommended next checks. Read-only.', {
+            t('repo_security_audit', 'Review a local or remote-backed repository for release/privacy risk before remote actions. Reports GitHub/private/public state, dirty files, ignored local-only files, likely secret material, privacy addresses (credential URLs, private network addresses, local user paths), release-excluded paths, and recommended next checks. Read-only.', {
                 path: { type: 'string' },
                 base_ref: { type: 'string' },
             }, []),
             t('git_pull', 'Pull from remote', {}, []),
-            t('git_push', 'Stage, commit, push', { message: { type: 'string' } }, ['message']),
+            t('git_push', 'Stage, commit, and push changes. Before a remote push, an automatic repository security review runs: if it finds high-risk content (personal keys/tokens or privacy addresses such as credential URLs, private network addresses, or local user paths), the push is BLOCKED. Complete a second review of every reported finding (remove/ignore it or confirm it is safe), then call git_push again with security_review_confirmed=true to proceed.', {
+                message: { type: 'string' },
+                security_review_confirmed: { type: 'boolean', description: 'Set true only after a second review resolved or explicitly confirmed every reported high-risk finding.' },
+            }, ['message']),
             t('git_clone', 'Clone a git repo', { url: { type: 'string' }, path: { type: 'string' } }, ['url', 'path']),
             t('git_branch', 'Inspect or manage local git branches. Actions: current, list, create, switch.', {
                 action: { type: 'string', enum: ['current', 'list', 'create', 'switch'] },
@@ -445,12 +484,13 @@ class ToolExecutor {
                 remote: { type: 'boolean' },
                 remote_name: { type: 'string' },
             }, []),
-            t('gh_pr_create', 'Create a GitHub pull request for the current branch through GitHub CLI. Requires explicit title and body.', {
+            t('gh_pr_create', 'Create a GitHub pull request for the current branch through GitHub CLI. Requires explicit title and body. Before creation, the same automatic repository security review as git_push runs: high-risk findings (personal keys/tokens or privacy addresses) BLOCK creation until a second review resolves them and you call again with security_review_confirmed=true.', {
                 title: { type: 'string' },
                 body: { type: 'string' },
                 base: { type: 'string' },
                 head: { type: 'string' },
                 draft: { type: 'boolean' },
+                security_review_confirmed: { type: 'boolean', description: 'Set true only after a second review resolved or explicitly confirmed every reported high-risk finding.' },
             }, ['title', 'body']),
         ];
         let visibleTools = tools.filter((tool) => (0, nativeTools_1.isNativeToolEnabled)(tool.function?.name || '', this.config.nativeToolEnabled()));
@@ -571,11 +611,7 @@ class ToolExecutor {
             const value = args[k];
             return value === undefined || value === null ? '' : String(value);
         };
-        const resolve = (relPath) => {
-            if (path.isAbsolute(relPath))
-                return relPath;
-            return path.join(wsPath, relPath);
-        };
+        const resolve = (relPath) => normalizeCrossEnvPath(relPath, wsPath);
         const targetForTool = () => {
             switch (tool) {
                 case 'read':
@@ -911,7 +947,7 @@ class ToolExecutor {
                 case 'file_audit': return await this.fileAudit(resolve(g('path') || '.'), wsPath, args.include_remote !== false, g('base_ref'), context.signal);
                 case 'repo_security_audit': return await this.repoSecurityAudit(resolve(g('path') || '.'), wsPath, g('base_ref'), context.signal);
                 case 'git_pull': return await this.gpull(wsPath, context.signal);
-                case 'git_push': return await this.withRemoteSecurityPreamble(wsPath, () => this.gpush(g('message'), wsPath, context.signal), context.signal);
+                case 'git_push': return await this.withRemoteSecurityPreamble(wsPath, () => this.gpush(g('message'), wsPath, context.signal), context.signal, args.security_review_confirmed === true);
                 case 'git_clone': return await this.gclone(g('url'), resolve(g('path')), context.signal);
                 case 'git_branch': return await this.gbranch(g('action'), g('name'), g('start_point'), wsPath, context.signal);
                 case 'gh_auth_status': return await this.gh(['auth', 'status'], wsPath, context.signal);
@@ -919,7 +955,7 @@ class ToolExecutor {
                 case 'gh_issue_list': return await this.ghList('issue', g('repo'), Number(args.limit || 20), wsPath, context.signal);
                 case 'gh_pr_list': return await this.ghList('pr', g('repo'), Number(args.limit || 20), wsPath, context.signal);
                 case 'gh_fork': return await this.ghFork(g('action'), g('repo'), args.clone === true, args.remote === true, g('remote_name'), wsPath, context.signal);
-                case 'gh_pr_create': return await this.withRemoteSecurityPreamble(wsPath, () => this.ghPrCreate(g('title'), g('body'), g('base'), g('head'), args.draft === true, wsPath, context.signal), context.signal);
+                case 'gh_pr_create': return await this.withRemoteSecurityPreamble(wsPath, () => this.ghPrCreate(g('title'), g('body'), g('base'), g('head'), args.draft === true, wsPath, context.signal), context.signal, args.security_review_confirmed === true);
                 default: return `[?] Unknown tool: ${tool}`;
             }
         }
@@ -1064,7 +1100,7 @@ class ToolExecutor {
             if (!this.looksLikePath(token))
                 continue;
             const withoutWildcard = token.replace(/[\\/][*?][^\\/]*$/g, '');
-            refs.push(path.isAbsolute(withoutWildcard) ? path.resolve(withoutWildcard) : path.resolve(wsPath, withoutWildcard));
+            refs.push(path.resolve(normalizeCrossEnvPath(withoutWildcard, wsPath)));
         }
         return Array.from(new Set(refs));
     }
@@ -1100,9 +1136,13 @@ class ToolExecutor {
         if (!cmd.trim())
             return '[bash] No command.';
         const timeout = this.resolveBashTimeout(timeoutMs);
+        // WSL 运行时跨环境归一：工作目录若仍是 Windows 盘符路径则转 /mnt/<drive>/...，
+        // 命令内的 Windows 盘符路径保守翻译为 WSL 挂载路径，让 bash 能直接操作 Windows 工作区。
+        const workspaceCwd = process.env.NEWMARK_WSL_DISTRO ? ((0, workspace_1.windowsDrivePathToPosix)(ws) || ws) : ws;
+        const translatedCmd = translateWindowsPathsForWslBash(cmd);
         try {
-            const result = await (0, nativeBash_1.executeWorkspaceBash)(cmd, ws, {
-                cwd: ws,
+            const result = await (0, nativeBash_1.executeWorkspaceBash)(translatedCmd, workspaceCwd, {
+                cwd: workspaceCwd,
                 timeoutMs: timeout,
                 signal,
                 allowHostFallback: true,
@@ -1739,6 +1779,7 @@ class ToolExecutor {
         const ignoredFiles = await this.gitExecAt(repoRoot, ['ls-files', '--others', '--ignored', '--exclude-standard'], signal);
         const changedAgainstBase = chosenBase ? await this.gitExecAt(repoRoot, ['diff', '--name-status', chosenBase], signal) : '';
         const secretFindings = this.scanRepositorySecrets(repoRoot, trackedFiles, statusShort);
+        const privacyFindings = this.scanRepositoryPrivacyLeaks(repoRoot, trackedFiles, statusShort);
         const localOnlyFindings = this.releaseExcludedPathFindings(repoRoot, ignoredFiles);
         const repoInfo = ghRemote
             ? await this.ghJson(['api', `repos/${ghRemote.owner}/${ghRemote.name}`, '--jq', '{name: .full_name, private: .private, visibility: .visibility, fork: .fork, archived: .archived, default_branch: .default_branch, html_url: .html_url}'], repoRoot, signal)
@@ -1751,6 +1792,8 @@ class ToolExecutor {
             risks.push('Remote GitHub repository is public; treat all tracked content and PR metadata as publicly visible.');
         if (ghRemote && secretFindings.length)
             risks.push('Potential secret-like material appears in tracked or changed files.');
+        if (ghRemote && privacyFindings.length)
+            risks.push('Privacy-address content (credential URLs, private network addresses, or local user paths) appears in tracked or changed files.');
         if (ghRemote && localOnlyFindings.length)
             risks.push('Workspace contains release-excluded/local-only files that must stay out of remote commits and public reports.');
         if (ghRemote && String(statusShort || '').trim())
@@ -1791,12 +1834,14 @@ class ToolExecutor {
                 verdict: risks.length ? 'review-required' : 'no-obvious-risk',
                 risks,
                 secret_findings: secretFindings,
+                privacy_findings: privacyFindings,
+                high_risk_findings: [...secretFindings, ...privacyFindings],
                 release_excluded_local_files: localOnlyFindings,
                 recommendations,
             },
         }, null, 2);
     }
-    scanRepositorySecrets(repoRoot, trackedFilesRaw, statusRaw) {
+    collectRepositoryFiles(trackedFilesRaw, statusRaw) {
         const files = new Set();
         for (const line of String(trackedFilesRaw || '').split(/\r?\n/)) {
             const rel = line.trim();
@@ -1808,6 +1853,10 @@ class ToolExecutor {
             if (rel)
                 files.add(rel.replace(/\\/g, '/'));
         }
+        return files;
+    }
+    scanRepositorySecrets(repoRoot, trackedFilesRaw, statusRaw) {
+        const files = this.collectRepositoryFiles(trackedFilesRaw, statusRaw);
         const patterns = [
             { id: 'openai_or_generic_sk_key', re: /\bsk-[A-Za-z0-9._-]{16,}\b/ },
             { id: 'github_token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/ },
@@ -1834,7 +1883,50 @@ class ToolExecutor {
             for (const [idx, line] of text.split(/\r?\n/).entries()) {
                 const matched = patterns.find(p => p.re.test(line));
                 if (matched) {
-                    findings.push({ path: rel, line: idx + 1, type: matched.id, sample: line.replace(/=.*/, '= <redacted>').replace(/\b(?:sk|gh[pousr]|sk-ant)-[A-Za-z0-9._-]{8,}\b/g, '<redacted-token>').slice(0, 160) });
+                    // 只汇报「类型 + 位置」，绝不把密钥值（含脱敏样本）暴露给 Agent，
+                    // 避免经 API 中转被拦截窃取。
+                    findings.push({ path: rel, line: idx + 1, type: matched.id });
+                    if (findings.length >= 40)
+                        break;
+                }
+            }
+        }
+        return findings;
+    }
+    /**
+     * 扫描隐私地址类高危信息：带凭据的 URL（user:pass@）、私网 IP、本地用户目录
+     * 绝对路径（C:\Users\<user>、/home/<user>、/Users/<user>）。这些内容泄露个人
+     * 账号、内网拓扑或本地机器结构，进入公开 remote 即构成隐私暴露，需与密钥同级
+     * 硬性阻挡并在 Agent 二轮审查确认后放行。
+     */
+    scanRepositoryPrivacyLeaks(repoRoot, trackedFilesRaw, statusRaw) {
+        const files = this.collectRepositoryFiles(trackedFilesRaw, statusRaw);
+        const patterns = [
+            { id: 'credential_url', re: /(?:https?|git|ssh|ftp):\/\/[^\s/@:]+:[^\s/@]+@/i },
+            { id: 'private_network_address', re: /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\b/ },
+            { id: 'local_user_path', re: /(?:^|[\s"'`])(?:C:\\(?:Users|Documents and Settings)\\[^\\\s"']+|~\/(?:[^/\s"']+\/){1,3}|\/(?:home|Users)\/[^/\s"']+\/[^\s"']*)/ },
+        ];
+        const findings = [];
+        for (const rel of Array.from(files).sort()) {
+            if (findings.length >= 40)
+                break;
+            const full = path.join(repoRoot, rel);
+            if (!fs.existsSync(full) || !fs.statSync(full).isFile())
+                continue;
+            if (fs.statSync(full).size > 512 * 1024)
+                continue;
+            let text = '';
+            try {
+                text = fs.readFileSync(full, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            for (const [idx, line] of text.split(/\r?\n/).entries()) {
+                const matched = patterns.find(p => p.re.test(line));
+                if (matched) {
+                    // 只汇报「类型 + 位置」，绝不把隐私地址值暴露给 Agent。
+                    findings.push({ path: rel, line: idx + 1, type: matched.id });
                     if (findings.length >= 40)
                         break;
                 }
@@ -1940,7 +2032,7 @@ class ToolExecutor {
             args.push('--draft');
         return this.gh(args, ws, signal);
     }
-    async withRemoteSecurityPreamble(ws, action, signal) {
+    async withRemoteSecurityPreamble(ws, action, signal, securityReviewConfirmed = false) {
         const repoRoot = await this.findGitRoot(ws, ws, signal);
         if (!repoRoot)
             return await action();
@@ -1954,6 +2046,11 @@ class ToolExecutor {
             const remote = audit.remote || {};
             const risks = Array.isArray(review.risks) ? review.risks : [];
             const findings = Array.isArray(review.secret_findings) ? review.secret_findings : [];
+            const privacy = Array.isArray(review.privacy_findings) ? review.privacy_findings : [];
+            const highRisk = [...findings, ...privacy];
+            if (highRisk.length && !securityReviewConfirmed) {
+                return this.formatRemoteSecurityBlock(remote, findings, privacy);
+            }
             const localOnly = Array.isArray(review.release_excluded_local_files) ? review.release_excluded_local_files : [];
             summary = [
                 '[repo_security_audit]',
@@ -1961,8 +2058,10 @@ class ToolExecutor {
                 `verdict=${review.verdict || 'unknown'}`,
                 risks.length ? `risks=${risks.length}` : 'risks=0',
                 findings.length ? `secret_findings=${findings.length}` : 'secret_findings=0',
+                privacy.length ? `privacy_findings=${privacy.length}` : 'privacy_findings=0',
                 localOnly.length ? `release_excluded_local_files=${localOnly.length}` : 'release_excluded_local_files=0',
-            ].join(' ');
+                securityReviewConfirmed ? 'security_review_confirmed=true' : '',
+            ].filter(Boolean).join(' ');
         }
         catch {
             // Keep the remote action result visible even if the preflight summary cannot be parsed.
@@ -1970,6 +2069,33 @@ class ToolExecutor {
         const actionOutput = await action();
         return `${summary}\n${actionOutput}`;
     }
+    /**
+     * 硬性阻挡远程写：当密钥或隐私地址类高危信息存在且 Agent 尚未二轮审查确认时，
+     * 返回明确的阻挡结果（脱敏 findings），要求处理/确认后再以
+     * security_review_confirmed=true 重试放行。
+     */
+    formatRemoteSecurityBlock(remote, secretFindings, privacyFindings) {
+        // 只汇报「类型 + 位置」，绝不把密钥值 / 隐私地址值（含脱敏样本）暴露给 Agent。
+        const detail = (finding) => `${String(finding.path || '')}:${String(finding.line || '')} [${String(finding.type || '')}]`.trim();
+        const lines = [
+            '[repo_security_audit] BLOCKED: remote write refused pending a second review.',
+            'High-risk content was detected in tracked or changed files.',
+            `Remote: ${remote.provider || 'git'}${remote.repository ? ` ${remote.repository}` : ''}.`,
+            `Secret-like findings: ${secretFindings.length}; privacy-address findings: ${privacyFindings.length}.`,
+        ];
+        if (secretFindings.length) {
+            lines.push('Secret-like findings:');
+            for (const finding of secretFindings.slice(0, 12))
+                lines.push(`  - ${detail(finding)}`);
+        }
+        if (privacyFindings.length) {
+            lines.push('Privacy-address findings:');
+            for (const finding of privacyFindings.slice(0, 12))
+                lines.push(`  - ${detail(finding)}`);
+        }
+        lines.push('Second review required: remove, .gitignore, or explicitly confirm each finding is safe.', 'Then retry this action with security_review_confirmed=true.');
+        return lines.join('\n');
+    }
     async gstat(ws, signal) {
         try {
             const r = await this.gitExec('git status --short', ws, signal);

package/dist/tui/src/app.js

@@ -51,8 +51,10 @@ const ESC = "\u001b[";
 function createPaintScheduler(state, output = process.stdout, renderFrame = render) {
   let pending = false;
   let lastFrame = "";
+  let cancelled = false;
   const flush = () => {
     pending = false;
+    if (cancelled) return;
     const frame = renderFrame(state);
     if (frame === lastFrame) return false;
     lastFrame = frame;
@@ -65,6 +67,8 @@ function createPaintScheduler(state, output = process.stdout, renderFrame = rend
     setImmediate(flush);
   };
   paint.flush = flush;
+  // 退出前调用：丢弃任何排队中的重绘，避免恢复主屏后又被画上一帧 TUI 画面。
+  paint.cancel = () => { cancelled = true; pending = false; };
   return paint;
 }
 
@@ -108,6 +112,28 @@ function resolveTuiWorkspacePath(args, options = {}) {
   return explicitRoot || process.cwd();
 }
 
+// 在 Windows 传统控制台（ConHost）下，输出句柄默认不启用
+// ENABLE_VIRTUAL_TERMINAL_PROCESSING，导致备用屏 ?1049h / 清屏 2J 等 ANSI
+// 序列不被解析，主屏保留滚动历史（滚轮能滚回旧帧）。Electron-as-node sidecar
+// 也不会像纯 Node 那样由 libuv 自动启用 VT。这里主动给输出句柄启用 VT 处理，
+// 给输入句柄启用原始输入，作为 main.ts 之外入口的保险。
+function enableWindowsVirtualTerminal() {
+  if (process.platform !== 'win32') return;
+  try {
+    const { spawnSync } = require('node:child_process');
+    const script = [
+      'Add-Type -TypeDefinition \'using System; using System.Runtime.InteropServices; public static class NewmarkTuiVT { [DllImport("kernel32.dll")] public static extern IntPtr GetStdHandle(int n); [DllImport("kernel32.dll")] public static extern bool GetConsoleMode(IntPtr h, out uint m); [DllImport("kernel32.dll")] public static extern bool SetConsoleMode(IntPtr h, uint m); }\'',
+      '$o = [NewmarkTuiVT]::GetStdHandle(-11); $om = [uint32]0; if ([NewmarkTuiVT]::GetConsoleMode($o, [ref]$om)) { [NewmarkTuiVT]::SetConsoleMode($o, ($om -bor 4)) | Out-Null }',
+      '$i = [NewmarkTuiVT]::GetStdHandle(-10); $im = [uint32]0; if ([NewmarkTuiVT]::GetConsoleMode($i, [ref]$im)) { [NewmarkTuiVT]::SetConsoleMode($i, (($im -band (-bnot 7)) -bor 512)) | Out-Null }',
+    ].join('; ');
+    spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script], {
+      stdio: 'ignore',
+      windowsHide: true,
+      timeout: 3000,
+    });
+  } catch {}
+}
+
 function start(options = {}) {
   const forcedTerminal = process.env.NEWMARK_FORCE_TTY === "1";
   if ((!process.stdin.isTTY || !process.stdout.isTTY) && !forcedTerminal) {
@@ -115,6 +141,9 @@ function start(options = {}) {
     process.exitCode = 1;
     return;
   }
+  // 备用屏依赖输出句柄的 VT 处理；纯 Node 的 libuv 会自动启用，但
+  // Electron-as-node sidecar 或强制 TTY 路径不会，这里补上。
+  if (forcedTerminal || !process.stdout.isTTY) enableWindowsVirtualTerminal();
 
   const args = process.argv.slice(2);
   let adapter;
@@ -140,24 +169,38 @@ function start(options = {}) {
   let timer = null;
   let animationTimer = null;
   let closing = false;
+  // 标准 TUI 屏幕模型：进入备用屏幕缓冲（alternate screen buffer）。
+  // 备用屏没有主屏的滚动历史：每次刷新用 2J 全量重绘而不是滚动新页面，
+  // 鼠标滚轮无法滚回上一次刷新，终端滚动也不会让画面错位（否则高亮行
+  // 会随终端滚动"离开屏幕"）。
+  const enterAltScreen = () => process.stdout.write(`${ESC}?1049h${ESC}?25l${ESC}2J${ESC}H`);
+  const leaveAltScreen = () => `${ESC}?25h${ESC}?1049l${ESC}0m${ESC}2J${ESC}H`;
   const paint = createPaintScheduler(state);
   const cleanup = () => {
     if (timer) clearInterval(timer);
     if (animationTimer) clearInterval(animationTimer);
     if (typeof process.stdin.setRawMode === "function") process.stdin.setRawMode(false);
     process.stdin.pause();
-    process.stdout.write(`${ESC}?25h${ESC}0m${ESC}2J${ESC}H`);
   };
   const quit = () => {
     if (closing) return;
     closing = true;
+    paint.cancel();
     cleanup();
     if (typeof state.adapter.close === "function") state.adapter.close();
-    process.stdout.write(state.adapterKind === "mock"
-      ? "Newmark TUI demo closed. No state was saved.\n"
-      : "Newmark TUI closed. Conversation and settings state are persisted by Newmark.\n");
+    // 退出序列与关闭消息用 fs.writeSync 同步写入 fd：直接进入内核管道，
+    // 不经过异步流缓冲，process.exit() 不会丢弃任何字节（此前异步 write
+    // 在退出瞬间被 ConPTY/管道丢弃，导致恢复主屏后看不到退出消息）。
+    try {
+      const fs = require("node:fs");
+      const fd = process.stdout.fd || 1;
+      fs.writeSync(fd, `${leaveAltScreen()}\n`);
+      fs.writeSync(fd, state.adapterKind === "mock"
+        ? "Newmark TUI demo closed. No state was saved.\n"
+        : "Newmark TUI closed. Conversation and settings state are persisted by Newmark.\n");
+    } catch {}
     process.exitCode = 0;
-    setImmediate(() => process.exit(0));
+    process.exit(0);
   };
 
   function simulateReply(text) {
@@ -554,8 +597,10 @@ function start(options = {}) {
   process.stdin.resume();
   process.stdin.on("keypress", handleKey);
   process.stdout.on("resize", paint);
-  process.on("exit", () => process.stdout.write(`${ESC}?25h${ESC}0m`));
+  // 兜底：任何退出路径（包括未捕获异常后的 exit 事件）都恢复主屏缓冲与光标。
+  process.on("exit", () => process.stdout.write(`${ESC}?25h${ESC}?1049l${ESC}0m`));
   process.on("SIGTERM", quit);
+  enterAltScreen();
   paint();
 }
 

package/dist/tui/src/data.js

@@ -204,6 +204,34 @@ const providers = [
   }
 ];
 
+// Demo-only long-list injection: NEWMARK_TUI_DEMO_MODELS=<count> appends a
+// dedicated stress provider with <count> models so the featureless --demo TUI
+// can exercise long model-selection cursor-follow behavior without any runtime.
+const DEMO_MODEL_COUNT = Number(process.env.NEWMARK_TUI_DEMO_MODELS || 0);
+if (Number.isFinite(DEMO_MODEL_COUNT) && DEMO_MODEL_COUNT > 0) {
+  providers.push({
+    id: "provider-demo-stress",
+    name: "Demo Stress",
+    base_url: "https://demo.invalid/v1",
+    api_key: "",
+    has_api_key: false,
+    protocol: "openai",
+    enabled: true,
+    models: Array.from({ length: DEMO_MODEL_COUNT }, (_, index) => ({
+      name: `demo-stress-model-${String(index).padStart(3, "0")}`,
+      display: `Stress Model ${String(index).padStart(3, "0")}`,
+      description: `Long-list cursor-follow stress model ${index} description`,
+      max_tokens: 128000,
+      vision: false,
+      thinking: false,
+      enabled: true,
+      speed_rating: "unknown",
+      capability_rating: "unknown",
+      validation: { status: "unavailable", level: "discovered", checked_at: "" }
+    }))
+  });
+}
+
 const flows = [
   {
     name: "release-readiness",