@dsh-cc/plugin-dsh-cc-shunt 0.8.0-rc.3 → 0.8.1

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "dsh-cc-shunt",
   "description": "Official dsh-cc plugin: hard PreToolUse gates redirect bulk reads/boilerplate generation to cheap-lane shunt-worker subagents to save main-context tokens.",
-  "version": "0.8.0-rc.3"
+  "version": "0.8.1"
 }

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm check:readme --write
-README.md: 937a8f850b1d498a61ab12b61ee36ed5503b1058
-README.zh.md: 2d68014bcbde12df912085cc4639b446a460a23b
+README.md: af2dde8faba4b786c213fc515d15182f81c1809a
+README.zh.md: dd7e01ae12856243617fdd46b1ad69231f2f52f3

package/README.md

@@ -43,6 +43,24 @@ alias is unconfigured, the workers silently inherit the parent's model route
 — everything works, but you get **zero token savings**. Configure the haiku
 alias for actual savings.
 
+## Subagent exemption
+
+Hook invocations that carry CC-parity caller identity (`agent_id` on the
+PreToolUse payload) bypass both gates. The field is injected by the dsh-cc
+bridge when the caller is a live subagent — it is not user-settable via
+`tool_input` — so workers (critic/executor/marathon, shunt-reader,
+shunt-writer, and any other subagent) paginate and inspect files freely;
+the gate's value lives on the main thread, where the harness read caps
+would make a block pure churn anyway.
+
+## Images
+
+The Read gate sniffs magic bytes (PNG, JPEG, GIF, WEBP) before the
+thresholds: `read_image` has no offset/limit, so large images are allowed
+regardless of size, extensioned or extensionless. There is no extension
+shortcut — a large **text** file named `*.png` is still gated. Any read
+error falls through to the normal thresholds.
+
 ## Known limits
 
 - Digest line references can go stale after edits — verify with a targeted

package/README.zh.md

@@ -33,6 +33,14 @@
 
 **shunt-worker 子代理固定 `model: haiku`。** 如果你的部署未配置 haiku 别名，worker 会静默继承父级的模型路由——一切照常工作，但**节省的 token 为零**。要真正省钱，请配置 haiku 别名。
 
+## 子代理豁免
+
+携带 CC 对齐调用者身份（PreToolUse 载荷上的 `agent_id`）的钩子调用会绕过两个门。该字段由 dsh-cc 桥接层在调用者是存活子代理时注入——不是用户可通过 `tool_input` 设置的——因此 worker（critic/executor/marathon、shunt-reader、shunt-writer 及其他子代理）可以自由分页和查看文件；门的价值在主线程，在那里 harness 读取上限本会让拦截变成纯粹的往返浪费。
+
+## 图片
+
+Read 门在阈值之前按魔数（PNG、JPEG、GIF、WEBP）嗅探：`read_image` 没有 offset/limit，因此大图片无论多大都放行，带扩展名或不带扩展名均可。没有基于扩展名的捷径——名为 `*.png` 的大**文本**文件仍然会被拦截。任何读取错误都会回退到正常阈值。
+
 ## 已知限制
 
 - 摘要中的行号引用在编辑后可能失效——在引用位置编辑前，请先用带 offset/limit 的定向读取确认。

package/hooks/check-bash-read.mjs

@@ -60,6 +60,10 @@ const command = typeof payload.tool_input?.command === 'string' ? payload.tool_i
 // Kill switch.
 if (truthy(process.env.SHUNT_DISABLED)) allow()
 
+// Subagent exemption: invocations carrying CC-parity caller identity
+// (agent_id, bridge-injected for live subagents) bypass the gate.
+if (typeof payload.agent_id === 'string' && payload.agent_id !== '') allow()
+
 // No command, or a targeted (piped / redirected) command.
 if (!command || command.includes('|') || command.includes('>') || !READ_COMMAND_RE.test(command)) allow()
 

package/hooks/check-file-size.mjs

@@ -10,7 +10,7 @@
  * Allow contract: {"decision": "allow"} on stdout, exit 0.
  * Block contract: one-line {"decision": "block", "reason": "..."} on stdout, exit 0.
  */
-import { existsSync, readFileSync, statSync } from 'node:fs'
+import { closeSync, existsSync, openSync, readFileSync, readSync, statSync } from 'node:fs'
 
 const DEFAULT_MIN_LINES = 350
 const DEFAULT_MAX_BYTES = 100000
@@ -61,6 +61,10 @@ const limit = toolInput.limit
 // Kill switch.
 if (truthy(process.env.SHUNT_DISABLED)) allow()
 
+// Subagent exemption: invocations carrying CC-parity caller identity
+// (agent_id, bridge-injected for live subagents) bypass the gate.
+if (typeof payload.agent_id === 'string' && payload.agent_id !== '') allow()
+
 // Targeted reads always pass — the caller already knows what it needs.
 if (offset !== undefined || limit !== undefined) allow()
 
@@ -75,6 +79,31 @@ try {
 }
 if (!stat.isFile()) allow()
 
+// Magic-byte image sniff: read_image has no offset/limit and accepts
+// extensionless paths by content sniffing, so large images can never be
+// paginated — allow real image content. No extension shortcut: a text file
+// named *.png stays gated. Any read error falls through to the thresholds.
+try {
+  const fd = openSync(filePath, 'r')
+  try {
+    const head = Buffer.alloc(12)
+    const n = readSync(fd, head, 0, 12, 0)
+    const b = head.subarray(0, n)
+    const isPng = n >= 8 && b.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+    const isJpeg = n >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff
+    const isGif = n >= 4 && b.subarray(0, 4).equals(Buffer.from('GIF8', 'ascii'))
+    const isWebp =
+      n >= 12 &&
+      b.subarray(0, 4).equals(Buffer.from('RIFF', 'ascii')) &&
+      b.subarray(8, 12).equals(Buffer.from('WEBP', 'ascii'))
+    if (isPng || isJpeg || isGif || isWebp) allow()
+  } finally {
+    closeSync(fd)
+  }
+} catch {
+  // fall through
+}
+
 const minLines = intEnv('SHUNT_MIN_LINES', DEFAULT_MIN_LINES)
 const maxBytes = intEnv('SHUNT_MAX_BYTES', DEFAULT_MAX_BYTES)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-cc/plugin-dsh-cc-shunt",
-  "version": "0.8.0-rc.3",
+  "version": "0.8.1",
   "description": "Official dsh-cc plugin: hard PreToolUse gates redirect bulk reads and boilerplate generation to cheap-lane shunt-worker subagents to save main-context tokens.",
   "type": "module",
   "license": "Apache-2.0",