v0.1.2: 全项目代码审查修复 + 子代理编排器 + 上下文压缩 + 并行工具执行

后端修复: Ollama adapter 移除死代码/修复超时硬编码/iteration硬编码/pullModel无超时/流异常断开补发DONE; SSE解析器支持非字符串arguments; Sandbox fail-closed安全加固; IPC移除未使用变量

新增功能: TaskOrchestrator子任务编排器; DelegateTaskTool委派工具; Agent Loop并行工具执行; 上下文自动压缩; 记忆检索注入System Prompt

前端修复: useAgentStream text_delta thought累积bug; 工具调用状态正确流转; 修复重复stateChange事件; TraceStep.thought正确填充

electron/harness/sandbox/sandbox.ts

@@ -6,6 +6,8 @@
  * @see docs/生产级通用 AI Agent 智能体桌面应用：完整设计与构建指南.html — 第五章
  */
 
+import { resolve, sep } from 'path';
+
 export interface SandboxConfig {
   allowedPaths?: string[];
   networkPolicy?: 'allowall' | 'deny-all' | 'allowlist';
@@ -45,20 +47,21 @@ export class SandboxManager {
 
   /**
    * 校验文件路径是否在白名单内
+   *
+   * 安全策略：fail-closed — 如果未配置任何白名单路径，拒绝所有访问。
    */
   validatePath(requestedPath: string): { allowed: boolean; resolvedPath: string; reason?: string } {
-    const { resolve } = require('path');
     const resolved = resolve(requestedPath);
 
-    if (requestedPath.includes('..')) {
-      return { allowed: false, resolvedPath: resolved, reason: 'Path traversal detected' };
+    if (this.allowedPaths.size === 0) {
+      return { allowed: false, resolvedPath: resolved, reason: 'No allowed paths configured (fail-closed)' };
     }
 
-    if (this.allowedPaths.size > 0) {
-      const isAllowed = Array.from(this.allowedPaths).some((allowed) => resolved.startsWith(allowed));
-      if (!isAllowed) {
-        return { allowed: false, resolvedPath: resolved, reason: 'Path not in allowed list' };
-      }
+    const isAllowed = Array.from(this.allowedPaths).some(
+      (allowed) => resolved === allowed || resolved.startsWith(allowed + sep),
+    );
+    if (!isAllowed) {
+      return { allowed: false, resolvedPath: resolved, reason: 'Path not in allowed list' };
     }
 
     return { allowed: true, resolvedPath: resolved };