修复沙箱内置工具（Glob / Grep / Read / Edit / Skill）文件查找问题

findCmd := fmt.Sprintf(
    "find %s -type f -name '%s' -not -path '*/.*' -not -path '*/node_modules/*' 2>/dev/null | head -200",
    searchDir, pattern)

grepCmd += fmt.Sprintf(" --include='%s'", include)

{filepath.Join(ctx.WorkspaceRoot, "skills"), "/workspace/skills"},
{filepath.Join(ctx.WorkspaceRoot, ".skills"), "/workspace/.skills"},

// sandboxBaseDir 返回沙箱内的工作目录前缀。
// 优先使用 ctx.SandboxWorkDir，兜底为 "/workspace"。
func sandboxBaseDir(ctx *ToolContext) string {
    if ctx != nil && ctx.SandboxWorkDir != "" {
        return ctx.SandboxWorkDir
    }
    return "/workspace"
}

// shellEscape 对字符串进行 shell 单引号转义，防止命令注入。
// 将字符串中的单引号替换为 '\''
func shellEscape(s string) string {
    return strings.ReplaceAll(s, "'", "'\\''")
}

// globToFindArgs 将 glob pattern 翻译为 find 命令的参数。
// 返回值：(find 搜索子目录, find 过滤参数片段)
//
// 翻译规则：
//   - *.go            → ("", "-maxdepth 1 -name '*.go'")
//   - **/*.go         → ("", "-name '*.go'")               // 递归
//   - src/*.go        → ("src", "-maxdepth 1 -name '*.go'")
//   - src/**/*.go     → ("src", "-name '*.go'")            // 递归
//   - **/test/*.go    → ("", "-path '*/test/*.go'")        // 递归
//   - src/**/test/*.go→ ("src", "-path '*/test/*.go'")     // 递归
func globToFindArgs(pattern string) (searchBase string, args string)

func globToFindArgs(pattern string) (searchBase string, args string) {
    pattern = strings.Trim(pattern, "/")
    pattern = filepath.ToSlash(pattern)
    if pattern == "" {
        return "", ""
    }

    segments := strings.Split(pattern, "/")

    // 定位第一个 ** 的位置
    doubleStarIdx := -1
    for i, seg := range segments {
        if seg == "**" {
            doubleStarIdx = i
            break
        }
    }

    if doubleStarIdx == -1 {
        // 无 **：简单匹配，-maxdepth 1 限定不递归
        if len(segments) == 1 {
            return "", fmt.Sprintf("-maxdepth 1 -name '%s'", segments[0])
        }
        base := strings.Join(segments[:len(segments)-1], "/")
        name := segments[len(segments)-1]
        return base, fmt.Sprintf("-maxdepth 1 -name '%s'", name)
    }

    // 有 **：
    prefix := strings.Join(segments[:doubleStarIdx], "/")
    suffixSegments := segments[doubleStarIdx+1:]

    if len(suffixSegments) == 0 {
        return prefix, ""
    }

    if len(suffixSegments) == 1 {
        return prefix, fmt.Sprintf("-name '%s'", suffixSegments[0])
    }

    // 多个后缀 segment：用 -path
    pathPattern := "*/" + strings.Join(suffixSegments, "/")
    return prefix, fmt.Sprintf("-path '%s'", pathPattern)
}

func (t *GlobTool) executeInSandbox(ctx *ToolContext, pattern, path string) (*ToolResult, error) {
    sandboxBase := sandboxBaseDir(ctx)

    // 翻译 glob pattern → find 参数
    searchBase, findArgs := globToFindArgs(pattern)

    // 确定 find 搜索目录
    searchDir := sandboxBase
    if path != "" {
        if strings.HasPrefix(path, sandboxBase+"/") {
            searchDir = path
        } else {
            searchDir = sandboxBase + "/" + path
        }
    } else if ctx != nil && ctx.CurrentDir != "" {
        if strings.HasPrefix(ctx.CurrentDir, ctx.WorkspaceRoot) {
            rel, _ := filepath.Rel(ctx.WorkspaceRoot, ctx.CurrentDir)
            searchDir = sandboxBase + "/" + rel
        }
    }

    // 合并 globToFindArgs 的子目录前缀
    if searchBase != "" {
        searchDir = searchDir + "/" + searchBase
    }

    // 构建 find 命令（对 searchDir 做 shellEscape 防注入）
    escapedDir := shellEscape(searchDir)
    findCmd := fmt.Sprintf(
        "find %s -type f %s -not -path '*/.*' -not -path '*/node_modules/*' 2>/dev/null | head -200",
        escapedDir, findArgs)

    output, err := RunInSandboxWithShell(ctx, findCmd)
    // ... 其余不变
}

// include brace 展开（复用已有函数）
if include != "" {
    patterns := expandBracePattern(include)
    for _, p := range patterns {
        grepCmd += fmt.Sprintf(" --include='%s'", shellEscape(p))
    }
}

// pattern 和 searchDir 也需要 shellEscape
grepCmd += fmt.Sprintf(" %s %s", shellEscape(pattern), shellEscape(searchDir))

sandboxBase := sandboxBaseDir(ctx)
// ... 路径解析逻辑中使用 sandboxBase 替代 "/workspace" ...
cmd := fmt.Sprintf("cat '%s'", shellEscape(sandboxPath))

if !strings.HasPrefix(params.Path, "/workspace/") && !strings.HasPrefix(params.Path, "/") {
    sandboxPath = "/workspace/" + params.Path
} else if strings.HasPrefix(params.Path, "/workspace/") {
    sandboxPath = params.Path
} else if strings.HasPrefix(params.Path, "/") {
    rel, _ := filepath.Rel(ctx.WorkspaceRoot, params.Path)
    sandboxPath = "/workspace/" + rel
}

sandboxBase := sandboxBaseDir(ctx)
if !strings.HasPrefix(params.Path, sandboxBase+"/") && !strings.HasPrefix(params.Path, "/") {
    sandboxPath = sandboxBase + "/" + params.Path
} else if strings.HasPrefix(params.Path, sandboxBase+"/") {
    sandboxPath = params.Path
} else if strings.HasPrefix(params.Path, "/") {
    rel, _ := filepath.Rel(ctx.WorkspaceRoot, params.Path)
    sandboxPath = sandboxBase + "/" + rel
}

candidates = []candidate{
    {filepath.Join(ctx.WorkspaceRoot, "skills"), "/workspace/skills"},
    {filepath.Join(ctx.WorkspaceRoot, ".skills"), "/workspace/.skills"},
}

sandboxBase := sandboxBaseDir(ctx)
candidates = []candidate{
    {filepath.Join(ctx.WorkspaceRoot, "skills"), filepath.Join(sandboxBase, "skills")},
    {filepath.Join(ctx.WorkspaceRoot, ".skills"), filepath.Join(sandboxBase, ".skills")},
}