@deepseek-ai/dsh-tool-pwsh 0.2.1-alpha.1 → 0.2.1-alpha.3

package/README.i18n.yaml

@@ -15,8 +15,8 @@
   en: d152484eb41ac6b4
   zh: 09388d293f9be9cb
 /deepseek-ai-dsh-tool-pwsh/use-this-package:
-  en: a49b7ebce02d3c94
-  zh: 99c6cfbb42dbb6aa
+  en: 873b8b99a2018ed7
+  zh: c4481ffd20168071
 /deepseek-ai-dsh-tool-pwsh/use-this-package/when-to-choose-it:
   en: d274c33ae8a646f8
   zh: 99e3e64e61735e50
@@ -36,8 +36,8 @@
   en: c1a9cc1201ed3a89
   zh: a43a659d350e9d4a
 /deepseek-ai-dsh-tool-pwsh/understand-the-implementation:
-  en: 8d94a7381bca3fa9
-  zh: f4bd2866fff6fa8d
+  en: 165313776a851b51
+  zh: 828f48807036aff0
 /deepseek-ai-dsh-tool-pwsh/understand-the-implementation/design-philosophy:
   en: 86a8ad5203f7e239
   zh: 056c0d6d6ca5f36a
@@ -117,8 +117,8 @@
   en: f5d5f97a153f7c70
   zh: 31911b4f3506d6c8
 /deepseek-ai-dsh-tool-pwsh/known-limitations-and-deferred-work:
-  en: 7d165285266e6639
-  zh: 541e6daf5169e24c
+  en: 04c2102bcc5ebc6d
+  zh: d13640d3fddb8e9c
 /deepseek-ai-dsh-tool-pwsh/known-limitations-and-deferred-work/dev-note:
   en: e67f633dc6fe7773
   zh: 3bb0c20c93f16f98

package/README.md

@@ -25,6 +25,8 @@ English | [中文](README.zh.md)
 <a id="use-this-package"></a>
 ## Use this package
 
+New commands start in the Session's current working directory. Relative `workdir` values resolve from that directory; per-call overrides and background jobs do not change it.
+
 Load this plugin in any composition where the agent should run PowerShell commands — typically a Windows composition whose `ctx.shell` is backed by a PowerShell executor. It registers the `pwsh` tool once the executor provider and the `dsh-shell-env` registry are mounted.
 
 ### When to choose it
@@ -74,6 +76,8 @@ A composition with no PowerShell executor never activates the tool, and the inje
 <details>
 <summary>Implementation internals — click to expand</summary>
 
+Structured foreground and background results expose `cwd`, the executor-resolved launch directory. Persisted presentation metadata carries the same value so settled cards retain the directory used by that call. A command’s own `cd` does not change this launch value; native result text remains stdout, stderr, and status markers.
+
 This section explains the design decisions behind the tool and points at the code that realizes them; the observable behavior is fully covered in [Use this package](#use-this-package).
 
 ### Design philosophy
@@ -204,7 +208,6 @@ These limits define when the tool is a poor fit or needs special care. They are
 - **Language mode and named-pipe capture under the Windows sandbox** — under the [Windows ACL sandbox](../../sandbox/sandbox-windows-acl/README.md), read-only pwsh starts in ConstrainedLanguage because its temp write denial makes PowerShell's AppLocker probe fail closed: `Add-Type`, non-core .NET statics (`[System.IO.*]::`, `[math]::`), COM objects, and reflection fail with "only core types" errors, and the mode cannot be lifted from inside. Workspace-write's private temp lets the probe complete, so it stays in FullLanguage unless host policy says otherwise. Both confined modes deny named-pipe opens, so a piped-stdio spawn inside a confined command fails with EPERM. The tool description teaches both contracts to the model; the backend README owns the full limitations.
 - **No persistent shell** — every call starts a fresh `pwsh -Command`; the persistent-shell counterpart is [`@deepseek-ai/dsh-tool-pwsh-persistent`](../tool-pwsh-persistent/README.md), which keeps one owner-scoped pwsh alive across calls.
 - **PowerShell-dialect contract** — the model must write PowerShell (native paths, `$env:` variables), not bash; there is no dialect translation.
-- **Session-cwd identity is not canonicalized** — the workdir base is the session header cwd as-is, unlike the bash tool's sandbox-root-canonicalized identity. Under a confining executor the policy's workspace root IS canonicalized (by the shared policy service), so the workdir and the confinement root can diverge when the raw session cwd differs from its canonical form — a parity gap deferred to the shared shell-tool base extraction.
 
 <a id="dev-note"></a>
 ### Dev Note

package/README.zh.md

@@ -25,6 +25,8 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用本包
 
+新命令从 Session 的当前工作目录启动。相对 `workdir` 从该目录解析；单次调用的覆盖值与后台任务不会改变该目录。
+
 在 agent 需要运行 PowerShell 命令的任何组合中加载本插件——通常是 `ctx.shell` 由 PowerShell 执行器支撑的 Windows 组合。一旦挂载执行器提供方与 `dsh-shell-env` 注册表，它就注册 `pwsh` 工具。
 
 ### 何时选择
@@ -74,6 +76,8 @@ kind: "package-reference"
 <details>
 <summary>实现细节——点击展开</summary>
 
+前台与后台的结构化结果均包含 `cwd`，即执行器解析后的启动目录。持久化展示元数据携带同一值，使已结束的调用卡片保留该次调用使用的目录。命令内部的 `cd` 不会改变这个启动值；原生结果文本仍由 stdout、stderr 与状态标记组成。
+
 本节解释工具背后的设计决策，并指出实现它们的代码位置；可观察行为已在[使用本包](#use-this-package)中完整说明。
 
 ### 设计理念
@@ -204,7 +208,6 @@ Non-zero exits are reported as `[exit code: N]` markers; investigate failures be
 - **Windows 沙箱下的语言模式与命名管道捕获**——在 [Windows ACL 沙箱](../../sandbox/sandbox-windows-acl/README.zh.md)下，只读 pwsh 以 ConstrainedLanguage 启动，因为其临时目录写入被拒绝，导致 PowerShell 的 AppLocker 探测失败并按拒绝处理：`Add-Type`、非核心 .NET 静态调用（`[System.IO.*]::`、`[math]::`）、COM 对象与反射会以 "only core types" 错误失败，且该模式无法从内部解除。workspace-write 的私有临时目录让探测完成，因此除非宿主策略另有规定，它保持 FullLanguage。两种受限模式都拒绝命名管道打开，因此受限命令内部的管道 stdio spawn 会以 EPERM 失败。工具描述把两条约定都教给模型；完整限制以后端 README 为准。
 - **没有持久 shell**——每次调用都启动全新的 `pwsh -Command`；持久 shell 对应物是 [`@deepseek-ai/dsh-tool-pwsh-persistent`](../tool-pwsh-persistent/README.zh.md)，它跨调用保持一个按所有者隔离的 pwsh 存活。
 - **PowerShell 方言约定**——模型必须编写 PowerShell（原生路径、`$env:` 变量），而不是 bash；没有方言翻译。
-- **会话 cwd 身份未规范化**——workdir 基准就是会话头部 cwd 原样，不像 bash 工具那样以沙箱根规范化身份为准。在约束执行器下，策略的 workspace root 确实被规范化（由共享策略服务完成），因此当原始会话 cwd 与其规范形式不同时，workdir 与约束根可能分叉——这是推迟到共享 shell 工具基座抽取的对齐差距。
 
 <a id="dev-note"></a>
 ### 开发备注

package/lib/index.js

@@ -238,7 +238,8 @@ const inject = [
 	"tools",
 	"shell",
 	"systemPrompt",
-	"shellEnv"
+	"shellEnv",
+	"workingDirectory"
 ];
 /** Runtime configuration schema for the pwsh tool plugin. */
 const Config = z.object({
@@ -256,24 +257,21 @@ function pwshDescription(windowsSandbox) {
 	if (!windowsSandbox) return base;
 	return "Execute a PowerShell command (`pwsh -Command`) and return its stdout/stderr. Each call runs in a fresh pwsh process; pass `workdir` instead of using `cd`. Paths use native Windows form (`C:\\...`); read environment variables with `$env:NAME`. Managed `$env:DSH_*` variables expose current harness environment facts. Long output is truncated to its tail; the full output is saved to a file whose path is reported when available. On Windows a force-killed command settles as `[exit code: 1]` without a signal marker — treat it as an interruption, not a command failure. Provide `description` before `command` in the arguments. Before any delete or move, verify that the resolved absolute target path is the intended one; never run it against a computed path you have not checked. Do not assign to automatic variables such as `$HOME`; variable names are case-insensitive, so `$home` is the same read-only variable. Commands may run under a file sandbox; a blocked file operation is reported as `[sandbox: file access denied under <mode> mode]`, a policy denial: do not retry another way. Under the Windows sandbox, read-only pwsh runs in PowerShell ConstrainedLanguage mode, while workspace-write stays in FullLanguage unless host policy says otherwise. In read-only, prefer cmdlets and core types (`[string]`, `[datetime]`, `[regex]`, `[guid]`); .NET static calls (`[System.IO.*]::`, `[math]::`), `Add-Type`, COM objects, and reflection fail with \"only core types\" errors. `-f` formatting, property access, and core cmdlets work. In both confined modes, programs cannot open named pipes, so a command that captures another program's output through piped stdio (Node.js `child_process.spawn`/`exec` with the default `stdio: 'pipe'`) fails with EPERM, while `stdio: 'inherit'` and `stdio: 'ignore'` spawns work and PowerShell's own pipelines are unaffected. That EPERM is the documented boundary: do not retry the command another way — escalate the exact command once or restructure it to avoid capturing output.";
 }
-/**
-* Resolve an explicit workdir first, making a relative one session-workspace-relative;
-* otherwise use the session header cwd and leave executor defaulting as the fallback.
-*/
-function resolveWorkdir(modelWorkdir, exec) {
-	const headerCwd = exec.agent?.session.header.cwd;
-	if (modelWorkdir === void 0) return headerCwd;
-	if (headerCwd !== void 0 && !isAbsolute(modelWorkdir)) return resolve(headerCwd, modelWorkdir);
+/** Resolve a relative per-call override against the Session's current directory. */
+function resolveWorkdir(modelWorkdir, sessionCwd) {
+	if (modelWorkdir === void 0) return sessionCwd;
+	if (sessionCwd !== void 0 && !isAbsolute(modelWorkdir)) return resolve(sessionCwd, modelWorkdir);
 	return modelWorkdir;
 }
 /** Detach the executor DTO from readonly Service Definition types into plain JSON data. */
-function canonicalPwshResult(result) {
+function canonicalPwshResult(result, cwd) {
 	const output = (stream) => ({
 		text: stream.text,
 		truncated: stream.truncated,
 		...stream.spillPath !== void 0 ? { spillPath: stream.spillPath } : {}
 	});
 	return {
+		cwd,
 		kind: "foreground",
 		exitCode: result.exitCode,
 		signal: result.signal,
@@ -306,6 +304,10 @@ const BACKGROUND_OUTPUT_PROPERTIES = {
 	jobId: {
 		type: "string",
 		required: true
+	},
+	cwd: {
+		type: "string",
+		required: true
 	}
 };
 function apply(ctx, config = {}) {
@@ -366,6 +368,10 @@ function apply(ctx, config = {}) {
 				id: registry.start({
 					kind: "pwsh",
 					label: args.command,
+					toolCall: {
+						callId: exec.callId,
+						rootCallId: exec.rootCallId
+					},
 					...exec.agent ? { owner: exec.agent.id } : {},
 					output: processSources(() => proc),
 					run: () => {
@@ -416,6 +422,7 @@ function apply(ctx, config = {}) {
 				await stop("timed out during preparation");
 				return {
 					kind: "foreground",
+					cwd: spec.workdir,
 					exitCode: null,
 					signal: null,
 					timedOut: true,
@@ -439,6 +446,7 @@ function apply(ctx, config = {}) {
 				const read = registry.read(attached.id, owner);
 				return {
 					kind: "promoted",
+					cwd: spec.workdir,
 					jobId: attached.id,
 					timeoutMs,
 					output: renderPwshJobRead(ringDelta(read.chunks), read.lossy, read.job.output.spillPaths ?? [], attached.process()?.sandbox, escalationModes)
@@ -450,7 +458,7 @@ function apply(ctx, config = {}) {
 			const result = await process.result();
 			const stopped = attached.stopped();
 			return {
-				...canonicalPwshResult(result),
+				...canonicalPwshResult(result, spec.workdir),
 				...stopped !== void 0 ? { stopped } : {}
 			};
 		};
@@ -508,6 +516,10 @@ function apply(ctx, config = {}) {
 								required: true,
 								const: "promoted"
 							},
+							cwd: {
+								type: "string",
+								required: true
+							},
 							jobId: {
 								type: "string",
 								required: true
@@ -531,6 +543,10 @@ function apply(ctx, config = {}) {
 								required: true,
 								const: "foreground"
 							},
+							cwd: {
+								type: "string",
+								required: true
+							},
 							exitCode: {
 								required: true,
 								oneOf: [{ type: "integer" }, { type: "null" }]
@@ -606,7 +622,8 @@ function apply(ctx, config = {}) {
 				render: (_args, value) => [{
 					type: "text",
 					text: value.kind === "background" ? `started background job ${value.jobId}` : value.kind === "promoted" ? renderPwshPromoted(value) : renderPwshResult(value, escalationModes)
-				}]
+				}],
+				presentationMeta: (_args, value) => ({ cwd: value.cwd })
 			},
 			async execute(args, exec) {
 				validatePwshArgs(args);
@@ -616,7 +633,8 @@ function apply(ctx, config = {}) {
 					...standingPolicy,
 					mode: approvedMode
 				};
-				const workdir = resolveWorkdir(args.workdir, exec);
+				const cwd = exec.agent === void 0 ? void 0 : await ctx.workingDirectory.ensure(exec.agent, exec.signal);
+				const workdir = resolveWorkdir(args.workdir, cwd);
 				const request = {
 					command: args.command,
 					...workdir !== void 0 ? { workdir } : {},
@@ -628,12 +646,14 @@ function apply(ctx, config = {}) {
 					if (!backgroundEnabled) throw new Error("run_in_background is disabled for this deployment (enableRunInBackground: false)");
 					if (jobs === void 0) throw new Error("background jobs unavailable: load @deepseek-ai/dsh-jobs and @deepseek-ai/dsh-tool-jobs");
 					if (exec.signal.aborted) throw toolAborted();
+					const spec = ctx.shell.resolve({
+						...request,
+						onExpiry: "none"
+					});
 					return {
 						kind: "background",
-						jobId: startJob(jobs, args, exec, ctx.shell.resolve({
-							...request,
-							onExpiry: "none"
-						})).id
+						jobId: startJob(jobs, args, exec, spec).id,
+						cwd: spec.workdir
 					};
 				}
 				if (jobs !== void 0 && promote) {
@@ -649,12 +669,13 @@ function apply(ctx, config = {}) {
 					}
 					if (attached !== void 0) return waitOnJob(jobs, attached, exec, spec);
 				}
-				const result = await (await ctx.shell.execute(ctx.shell.resolve({
+				const spec = ctx.shell.resolve({
 					...request,
 					signal: exec.signal
-				}))).result();
+				});
+				const result = await (await ctx.shell.execute(spec)).result();
 				if (result.aborted) throw toolAborted();
-				return canonicalPwshResult(result);
+				return canonicalPwshResult(result, spec.workdir);
 			},
 			presentCall: (args) => {
 				if (args.run_in_background === true) return {

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "tool-pwsh"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "PowerShell 命令工具",
+    "description": "让 AI 执行 PowerShell 命令。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-tool-pwsh",
   "description": "Model-facing pwsh tool over the bash executor seam",
-  "version": "0.2.1-alpha.1",
+  "version": "0.2.1-alpha.3",
   "publishConfig": {
     "access": "public"
   },
@@ -19,49 +19,54 @@
       "default": "./lib/index.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "files": [
+    "locale/*.json",
     "lib/index.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-jobs": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-shell": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-shell-env": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-jobs": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-shell": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-shell-env": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-alpha.3"
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.1"
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-agent-loop": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-jobs-local": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-jobs": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-loader-smoke": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-pwsh-local": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-shell": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-shell-env": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tool-jobs": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-jobs": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-jobs-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-loader-smoke": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-pwsh-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-shell": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-shell-env": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tool-jobs": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-alpha.3"
   }
 }