feat: 升级至 v0.2.1 — 流式渲染修复、安全增强、工具自动执行

流式渲染修复：
- runId 机制防止 abort 后旧流事件污染新 run
- run lock 防止并发 run 污染引擎状态
- abort race 提前退出工具执行等待
- TERMINATED 状态通过 stateChange 发射
- tool_call_delta 流式参数拼接 + pending 占位替换
- 首轮卡片创建路径统一，traceStep 按 ID 精确匹配
- compressed 事件转发为 toast 通知

安全增强：
- ConfirmationHook 支持持久化自动执行（跨会话）
- 设置面板新增自动执行工具管理 UI
- SandboxManager 双重安全校验 fail-closed
- 审计日志链式哈希防篡改
- PromptInjectionDefender 中文注入标记清理
- scanCode 28 模式 + base64/$() 检测
- validatePath realpathSync 防符号链接逃逸
- code-search 使用 execFile 防命令注入

新增工具：
- file_editor、code_search、task_manager、diff_viewer

其他：
- Agent Loop 加 PARSING/REFLECTING 状态 + 指数退避重试
- MemoryManager TF-IDF 语义检索
- run_command Windows 中文编码修复（chcp 65001）
- 版本号 0.2.0 → 0.2.1

electron/harness/security/prompt-injection-defense.ts

@@ -6,6 +6,13 @@
  * 2. 语义级检测（可选）
  * 3. 指令隔离标记
  *
+ * v0.2.0 增强：
+ * - 扩展注入检测模式至 30+ 种
+ * - 添加多语言检测（中英文）
+ * - 添加编码注入检测（hex、unicode 转义）
+ * - 添加角色扮演注入检测
+ * - 添加间接注入检测（通过工具返回值注入）
+ *
  * @see docs/生产级通用 AI Agent 智能体桌面应用：完整设计与构建指南.html — 第十章
  */
 
@@ -22,39 +29,77 @@ export interface InjectionFinding {
   severity: 'low' | 'medium' | 'high';
 }
 
+interface InjectionPattern {
+  pattern: RegExp;
+  severity: 'low' | 'medium' | 'high';
+}
+
 export class PromptInjectionDefender {
-  private static INJECTION_PATTERNS = [
-    /ignore\s+(all\s+)?(previous|above|prior)\s+(instructions|commands|directives)/i,
-    /forget\s+(everything|all\s+(of\s+)?(the|your)|above)/i,
-    /you\s+are\s+now/i,
-    /new\s+(instructions|directive|role|persona)/i,
-    /override\s+your\s+/i,
-    /(show|display|print|output|reveal|tell\s+me)\s+(your|the)\s+(system\s+)?(prompt|instruction|directive)/i,
-    /(dump|echo|log|expose)\s+(your|the)\s+(context|memory|history)/i,
-    /-{3,}\s*(system|user|assistant|instruction)/i,
-    /<{3,}(system|instruction|prompt)/i,
-    /\[{3,}(system|instruction|prompt)/i,
-    /base64\s*:?\s*[A-Za-z0-9+/=]{20,}/i,
-    /pretend\s+(you\s+are|to\s+be)/i,
-    /act\s+as\s+(if\s+you\s+were|you're)/i,
-    /DAN\s*[:\[]/i,
-    /JAILBREAK/i,
+  private static INJECTION_PATTERNS: InjectionPattern[] = [
+    // === HIGH 危险：直接越狱/忽略指令 ===
+    { pattern: /ignore\s+(all\s+)?(previous|above|prior)\s+(instructions|commands|directives)/i, severity: 'high' },
+    { pattern: /forget\s+(everything|all\s+(of\s+)?(the|your)|above)/i, severity: 'high' },
+    { pattern: /override\s+your\s+/i, severity: 'high' },
+    { pattern: /JAILBREAK/i, severity: 'high' },
+    { pattern: /DAN\s*[:\[]/i, severity: 'high' },
+    { pattern: /(?:enable|turn\s+on|activate)\s+(developer|debug|root|admin)\s+mode/i, severity: 'high' },
+    { pattern: /(?:disable|turn\s+off|bypass)\s+(your|the)\s+(safety|security|filter|guard|defense)/i, severity: 'high' },
+    { pattern: /(?:send|transmit|exfiltrate|upload)\s+(your|the|all)\s+(data|memory|context|secrets)/i, severity: 'high' },
+    { pattern: /(?:you\s+are|act\s+as|pretend\s+to\s+be)\s+(?:a|an)\s+(?:unrestricted|unfiltered|unlimited|free)/i, severity: 'high' },
+    { pattern: /(?:in|under)\s+(?:developer|unrestricted|jailbreak|god)\s+mode/i, severity: 'high' },
+    // 中文高危
+    { pattern: /忽略(?:以上|之前|前面|上面|所有)(?:的)?(?:指令|指示|命令|说明|规则)/i, severity: 'high' },
+    { pattern: /忘记(?:之前|上面|所有)(?:的)?(?:内容|对话|指令)/i, severity: 'high' },
+    { pattern: /(?:黑客|越狱|破解)(?:模式|命令|规则)/i, severity: 'high' },
+    { pattern: /无视(?:以上|之前|前面|所有)(?:的)?(?:指令|指示|命令|规则)/i, severity: 'high' },
+
+    // === MEDIUM 危险：角色扮演/权限提升/编码注入 ===
+    { pattern: /you\s+are\s+now/i, severity: 'medium' },
+    { pattern: /new\s+(instructions|directive|role|persona)/i, severity: 'medium' },
+    { pattern: /(show|display|print|output|reveal|tell\s+me)\s+(your|the)\s+(system\s+)?(prompt|instruction|directive)/i, severity: 'medium' },
+    { pattern: /(dump|echo|log|expose)\s+(your|the)\s+(context|memory|history)/i, severity: 'medium' },
+    { pattern: /pretend\s+(you\s+are|to\s+be)/i, severity: 'medium' },
+    { pattern: /act\s+as\s+(if\s+you\s+were|you're)/i, severity: 'medium' },
+    { pattern: /(?:grant|give)\s+(me|you|us)\s+(admin|root|sudo|super)/i, severity: 'medium' },
+    { pattern: /base64\s*:?\s*[A-Za-z0-9+/=]{20,}/i, severity: 'medium' },
+    { pattern: /eval\s*\(\s*atob\s*\(/i, severity: 'medium' },
+    { pattern: /\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}/i, severity: 'medium' },
+    { pattern: /\\u[0-9a-f]{4}\\u[0-9a-f]{4}/i, severity: 'medium' },
+    // 中文中危
+    { pattern: /你(?:现在|从现在开始)(?:是|扮演|作为一个)/i, severity: 'medium' },
+    { pattern: /新(?:的)?(?:指令|角色|设定|规则)/i, severity: 'medium' },
+    { pattern: /(?:显示|打印|输出|告诉我)(?:你的)?(?:系统|内部)(?:提示|指令|设定)/i, severity: 'medium' },
+    { pattern: /假装(?:你是|自己是)/i, severity: 'medium' },
+    { pattern: /扮演(?:一个|以下)/i, severity: 'medium' },
+    { pattern: /(?:恶意|危险|有害)(?:代码|命令|操作)/i, severity: 'medium' },
+
+    // === LOW 危险：分隔符/间接注入标记 ===
+    { pattern: /-{3,}\s*(system|user|assistant|instruction)/i, severity: 'low' },
+    { pattern: /<{3,}(system|instruction|prompt)/i, severity: 'low' },
+    { pattern: /\[{3,}(system|instruction|prompt)/i, severity: 'low' },
+    { pattern: /\[SYSTEM\]/i, severity: 'low' },
+    { pattern: /\[INSTRUCTION\]/i, severity: 'low' },
+    { pattern: /\[ADMIN\]/i, severity: 'low' },
+    { pattern: /\[OVERRIDE\]/i, severity: 'low' },
+    { pattern: /<system>/i, severity: 'low' },
+    { pattern: /<instruction>/i, severity: 'low' },
+    { pattern: /<admin>/i, severity: 'low' },
+    { pattern: /<override>/i, severity: 'low' },
   ];
 
   detect(input: string): InjectionDetectionResult {
     const findings: InjectionFinding[] = [];
     let riskScore = 0;
 
-    for (const pattern of PromptInjectionDefender.INJECTION_PATTERNS) {
+    for (const { pattern, severity } of PromptInjectionDefender.INJECTION_PATTERNS) {
       const matches = input.match(pattern);
       if (matches) {
         findings.push({
           pattern: pattern.source,
           matched: matches[0],
-          severity: this.classifySeverity(pattern.source),
+          severity,
         });
-        riskScore += this.classifySeverity(pattern.source) === 'high' ? 3 :
-          this.classifySeverity(pattern.source) === 'medium' ? 2 : 1;
+        riskScore += severity === 'high' ? 5 : severity === 'medium' ? 3 : 1;
       }
     }
 
@@ -66,21 +111,9 @@ export class PromptInjectionDefender {
     };
   }
 
-  private classifySeverity(pattern: string): 'low' | 'medium' | 'high' {
-    const highRiskKeywords = ['ignore', 'forget', 'jailbreak', 'DAN', 'override', 'new\\s+instruction'];
-    const mediumRiskKeywords = ['reveal', 'dump', 'pretend', 'act\\s+as'];
-
-    for (const kw of highRiskKeywords) {
-      if (new RegExp(kw, 'i').test(pattern)) return 'high';
-    }
-    for (const kw of mediumRiskKeywords) {
-      if (new RegExp(kw, 'i').test(pattern)) return 'medium';
-    }
-    return 'low';
-  }
-
   /**
    * 清理输入内容（移除明显的注入分隔符）
+   * v0.2.0: 增加中文注入标记清理
    */
   sanitize(input: string): string {
     let cleaned = input;
@@ -90,6 +123,15 @@ export class PromptInjectionDefender {
     cleaned = cleaned.replace(/<{3,}(system|instruction|prompt).*$/gim, '[REMOVED]');
     cleaned = cleaned.replace(/\[{3,}(system|instruction|prompt).*$/gim, '[REMOVED]');
 
+    // v0.2.0: 移除间接注入标记
+    cleaned = cleaned.replace(/\[(SYSTEM|INSTRUCTION|ADMIN|OVERRIDE)\]/gi, '[REMOVED]');
+    cleaned = cleaned.replace(/<(system|instruction|admin|override)>/gi, '[REMOVED]');
+
+    // v0.2.0: 移除编码注入
+    cleaned = cleaned.replace(/\\x[0-9a-f]{2}/gi, '[REMOVED]');
+    cleaned = cleaned.replace(/\\u[0-9a-f]{4}/gi, '[REMOVED]');
+    cleaned = cleaned.replace(/eval\s*\(\s*atob\s*\([^)]*\)\s*\)/gi, '[REMOVED]');
+
     return cleaned.trim();
   }