feat: 升级至 v0.2.1 — 流式渲染修复、安全增强、工具自动执行

流式渲染修复：
- runId 机制防止 abort 后旧流事件污染新 run
- run lock 防止并发 run 污染引擎状态
- abort race 提前退出工具执行等待
- TERMINATED 状态通过 stateChange 发射
- tool_call_delta 流式参数拼接 + pending 占位替换
- 首轮卡片创建路径统一，traceStep 按 ID 精确匹配
- compressed 事件转发为 toast 通知

安全增强：
- ConfirmationHook 支持持久化自动执行（跨会话）
- 设置面板新增自动执行工具管理 UI
- SandboxManager 双重安全校验 fail-closed
- 审计日志链式哈希防篡改
- PromptInjectionDefender 中文注入标记清理
- scanCode 28 模式 + base64/$() 检测
- validatePath realpathSync 防符号链接逃逸
- code-search 使用 execFile 防命令注入

新增工具：
- file_editor、code_search、task_manager、diff_viewer

其他：
- Agent Loop 加 PARSING/REFLECTING 状态 + 指数退避重试
- MemoryManager TF-IDF 语义检索
- run_command Windows 中文编码修复（chcp 65001）
- 版本号 0.2.0 → 0.2.1

electron/harness/sandbox/permissions.ts

@@ -65,13 +65,33 @@ export class PolicyEngine {
       };
     }
 
+    const argsStr = JSON.stringify(args);
+
+    // v0.2.0: allowedPatterns 白名单校验 — 若定义了白名单，参数必须匹配其中之一
+    if (policy.allowedPatterns && policy.allowedPatterns.length > 0) {
+      let matchedAllowed = false;
+      for (const pattern of policy.allowedPatterns) {
+        if (pattern.test(argsStr)) {
+          matchedAllowed = true;
+          break;
+        }
+      }
+      if (!matchedAllowed) {
+        return {
+          authorized: false,
+          reason: 'Arguments do not match any allowed pattern',
+          level: policy.requiredLevel,
+          requiresConfirmation: policy.requireConfirmation ?? false,
+        };
+      }
+    }
+
     if (policy.deniedPatterns) {
-      const argsStr = JSON.stringify(args);
       for (const pattern of policy.deniedPatterns) {
         if (pattern.test(argsStr)) {
           return {
             authorized: false,
-            reason: `Arguments match denied pattern: ${pattern.source}`,
+            reason: 'Command blocked by security policy',
             level: policy.requiredLevel,
             requiresConfirmation: false,
           };

electron/harness/sandbox/sandbox.ts

@@ -7,6 +7,7 @@
  */
 
 import { resolve, sep } from 'path';
+import { existsSync, realpathSync } from 'fs';
 
 export interface SandboxConfig {
   allowedPaths?: string[];
@@ -49,6 +50,7 @@ export class SandboxManager {
    * 校验文件路径是否在白名单内
    *
    * 安全策略：fail-closed — 如果未配置任何白名单路径，拒绝所有访问。
+   * 同时解析符号链接，防止通过 symlink 逃逸白名单。
    */
   validatePath(requestedPath: string): { allowed: boolean; resolvedPath: string; reason?: string } {
     const resolved = resolve(requestedPath);
@@ -57,6 +59,7 @@ export class SandboxManager {
       return { allowed: false, resolvedPath: resolved, reason: 'No allowed paths configured (fail-closed)' };
     }
 
+    // 先做字符串级白名单校验
     const isAllowed = Array.from(this.allowedPaths).some(
       (allowed) => resolved === allowed || resolved.startsWith(allowed + sep),
     );
@@ -64,28 +67,79 @@ export class SandboxManager {
       return { allowed: false, resolvedPath: resolved, reason: 'Path not in allowed list' };
     }
 
+    // 解析符号链接（如果路径存在）
+    if (existsSync(resolved)) {
+      try {
+        const realPath = realpathSync(resolved);
+        const realAllowed = Array.from(this.allowedPaths).some(
+          (allowed) => realPath === allowed || realPath.startsWith(allowed + sep),
+        );
+        if (!realAllowed) {
+          return { allowed: false, resolvedPath: realPath, reason: 'Symlink escape detected' };
+        }
+        return { allowed: true, resolvedPath: realPath };
+      } catch {
+        // realpath 解析失败（权限问题等），保守拒绝
+        return { allowed: false, resolvedPath: resolved, reason: 'Path resolution failed' };
+      }
+    }
+
     return { allowed: true, resolvedPath: resolved };
   }
 
   /**
    * 静态代码安全扫描
+   *
+   * 检测危险模块导入、代码执行、路径遍历、危险命令、反向 shell、
+   * fork bomb、PowerShell 编码执行、环境变量窃取、编码绕过等。
    */
   scanCode(code: string): { safe: boolean; reason?: string } {
     const dangerousPatterns = [
-      /require\s*\(\s*['"]child_process['"]\s*\)/,
-      /eval\s*\(/,
-      /process\.exit/,
-      /import\s+.*from\s+['"]fs['"]/,
-      /\.\.\//,
-      /rm\s+-rf/,
-      />\s*\/dev\/null/,
-      /curl.*\|\s*bash/,
-      /wget.*\|\s*sh/,
+      // 危险模块导入
+      /require\s*\(\s*['"]child_process['"]\s*\)/i,
+      /import\s+.*from\s+['"]fs['"]/i,
+      /import\s+.*from\s+['"]child_process['"]/i,
+      // 代码执行
+      /\beval\s*\(/i,
+      /process\.exit/i,
+      /Function\s*\(/i,
+      // 路径遍历
+      /\.\.\//i,
+      /\\\.\.\\/i, // Windows ..\
+      // 危险命令
+      /\brm\s+-rf\b/i,
+      /\bkillall\s+-9\b/i,
+      /\bchown\s+-R\s+\//i,
+      // 重定向到系统目录
+      />\s*\/dev\/null/i,
+      />\s*\/etc\//i,
+      // 管道执行
+      /\bcurl\b.*\|\s*(bash|sh|zsh)\b/i,
+      /\bwget\b.*\|\s*(sh|bash|zsh)\b/i,
+      // 反向 shell
+      /\/bin\/(bash|sh)\s+-i/i,
+      /\bnc\s+-e\b/i,
+      /\bbash\s+-i\b/i,
+      // Fork bomb
+      /:\(\)\s*\{\s*:\|:\s*&\s*\};:/i,
+      // PowerShell 编码执行
+      /powershell.*-enc(odedCommand)?\s+/i,
+      // 环境变量窃取
+      /env\b.*\b(GITHUB_TOKEN|API_KEY|SECRET|PASSWORD)\b/i,
+      // 编码绕过检测
+      /\bbase64\b.*\|\s*(sh|bash|zsh)\b/i,
+      /\batob\s*\(/i,
+      /\bprintf\s+['"]\\x[0-9a-f]/i,
+      // 命令替换
+      /\$\([^)]*(rm|kill|del|format|mkfs)\b/i,
+      // heredoc 执行
+      /<<\s*(EOF|END)\s*[\s\S]*?\b(rm|kill|del|format|mkfs)\b/i,
     ];
 
     for (const pattern of dangerousPatterns) {
       if (pattern.test(code)) {
-        return { safe: false, reason: `Dangerous pattern detected: ${pattern.source}` };
+        // 不暴露 pattern.source，使用通用错误信息
+        return { safe: false, reason: 'Command blocked by security policy' };
       }
     }