@godv61/dsh-task-engine 0.22.6 → 0.23.0

package/lib/controller.d.ts

@@ -8,6 +8,7 @@
  *
  * @module dsh-task-engine/controller
  */
+import type { ResourceImportRequest, ResourcePreview } from './resource-types.ts';
 import type { Context } from '@deepseek-ai/cordis';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { type StageBinding, type WorkflowConfig } from './engine.ts';
@@ -72,6 +73,28 @@ export interface InstallSkillRequest {
     /** Absolute workspace directory (required when level is `project`). */
     path?: string;
 }
+/** One child directory entry shown by the install directory picker. */
+export interface ListDirsEntry {
+    name: string;
+    /** True when this directory carries a SKILL.md of its own. */
+    hasSkill: boolean;
+}
+/** `listDirs` request: the absolute path to list (empty = the host home directory). */
+export interface ListDirsRequest {
+    path: string;
+}
+/** `listDirs` result: the subdirectories of one absolute path for the install picker. */
+export interface ListDirsView {
+    ok: boolean;
+    /** The absolute directory that was listed (normalized input). */
+    path: string;
+    entries: ListDirsEntry[];
+    /** Filesystem roots offered as jump targets (Windows drive letters, `/` on POSIX). */
+    roots: string[];
+    /** True when the listed directory itself carries a SKILL.md (installable as-is). */
+    currentHasSkill: boolean;
+    error?: string;
+}
 /** Create a project- or user-level rule. */
 export interface WriteRuleRequest {
     name: string;
@@ -163,6 +186,10 @@ export interface TaskLedgerItem {
 }
 /** One task's ledger projection: identity, stage, and the per-item audit trail. */
 export interface TaskLedgerEntry {
+    risk_level?: string;
+    updated_at?: string;
+    verification_passed?: boolean;
+    review_outcome?: string;
     task_id: string;
     title: string;
     stage: string;
@@ -218,6 +245,20 @@ export interface InitWriteResult {
  */
 export default class TaskEngineController extends TypertRemoteService {
     constructor(ctx: Context);
+    private authorizedPath;
+    /** Absolute installation roots for a selected workspace. */
+    resourceRoots(request: {
+        kind: 'skill' | 'rule';
+        path: string;
+    }): Promise<{
+        project: string;
+        user: string;
+    }>;
+    /** Inspect uploaded bytes or a host directory without writing. */
+    previewResource(request: ResourceImportRequest): Promise<ResourcePreview>;
+    /** Install exactly the reviewed bytes and target, without overwriting. */
+    importResource(request: ResourceImportRequest): Promise<ResourcePreview>;
+    private resourceImport;
     /**
      * Resolve one workspace's effective workflow: a preset flow plus the project's
      * stage-binding override.
@@ -292,6 +333,14 @@ export default class TaskEngineController extends TypertRemoteService {
      * @returns the installed path, or `ok: false` with an error.
      */
     installSkill(request: InstallSkillRequest): Promise<WriteResourceResult>;
+    /**
+     * List the direct subdirectories of an absolute path for the install
+     * directory picker. Each child is flagged when it carries its own SKILL.md,
+     * so the dialog can tell a skill root apart from a plain container or folder.
+     * @param request - absolute directory to list (empty = the host home directory).
+     * @returns subdirectory names, each with its hasSkill flag.
+     */
+    listDirs(request: ListDirsRequest): Promise<ListDirsView>;
     /**
      * Create a project- or user-level rule by writing its markdown file.
      * @param request - name, body, and target level.

package/lib/controller.js

@@ -42,7 +42,9 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { authorizedWorkspace } from "./workspace-access.js";
+import { prepareImport, commitImport } from "./resource-import.js";
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -100,38 +102,18 @@ function renderSkillFile(name, description, whenToUse, content) {
         head.push(`whenToUse: ${whenToUse.trim()}`);
     return `---\n${head.join('\n')}\n---\n\n${content.trimEnd()}\n`;
 }
-/** Directory names never copied when installing a skill directory. */
-const SKILL_SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.venv', 'venv', '.idea', '.vscode', '.cache']);
-/** Install bounds: refuse oversized bundles instead of copying junk. */
-const SKILL_MAX_FILES = 200;
-const SKILL_MAX_BYTES = 20 * 1024 * 1024;
-/**
- * Recursively copy a validated skill directory, skipping dependency caches and
- * enforcing file-count / byte caps. Throws with a clear message on oversize.
- */
-function copySkillDir(source, dest) {
-    let files = 0;
-    let bytes = 0;
-    const walk = (src, dst) => {
-        mkdirSync(dst, { recursive: true });
-        for (const entry of readdirSync(src, { withFileTypes: true })) {
-            if (entry.isDirectory()) {
-                if (SKILL_SKIP_DIRS.has(entry.name))
-                    continue;
-                walk(join(src, entry.name), join(dst, entry.name));
-            }
-            else if (entry.isFile()) {
-                const srcPath = join(src, entry.name);
-                bytes += statSync(srcPath).size;
-                files += 1;
-                if (files > SKILL_MAX_FILES || bytes > SKILL_MAX_BYTES) {
-                    throw new Error(`skill 目录过大（上限 ${SKILL_MAX_FILES} 个文件 / ${Math.round(SKILL_MAX_BYTES / 1024 / 1024)} MB），已排除 node_modules/.git 等缓存目录`);
-                }
-                copyFileSync(srcPath, join(dst, entry.name));
-            }
-        }
-    };
-    walk(source, dest);
+/** Dirs hidden from the install directory picker (plain dependency/ignore caches). */
+const SKILL_DIR_FILTER = new Set(['node_modules', '.git', '__pycache__', '.venv', 'venv']);
+/** Filesystem roots the picker offers as jump targets (drive letters on Windows, `/` elsewhere). */
+function filesystemRoots() {
+    if (process.platform !== 'win32')
+        return ['/'];
+    const roots = [];
+    for (const letter of 'CDEFGHIJKLMNOPQRSTUVWXYZ') {
+        if (existsSync(`${letter}:\\`))
+            roots.push(`${letter}:\\`);
+    }
+    return roots;
 }
 /** Scan a markdown directory, returning `{ name }` per `.md` file. */
 function scanRuleDir(dir, source) {
@@ -210,6 +192,9 @@ function listSkillsFromDir(dir, source) {
 let TaskEngineController = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
+    let _resourceRoots_decorators;
+    let _previewResource_decorators;
+    let _importResource_decorators;
     let _read_decorators;
     let _write_decorators;
     let _listSkills_decorators;
@@ -220,6 +205,7 @@ let TaskEngineController = (() => {
     let _generateInit_decorators;
     let _writeSkill_decorators;
     let _installSkill_decorators;
+    let _listDirs_decorators;
     let _writeRule_decorators;
     let _readSkill_decorators;
     let _readRule_decorators;
@@ -228,6 +214,9 @@ let TaskEngineController = (() => {
     return class TaskEngineController extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _resourceRoots_decorators = [Remote];
+            _previewResource_decorators = [Remote];
+            _importResource_decorators = [Remote];
             _read_decorators = [Remote];
             _write_decorators = [Remote];
             _listSkills_decorators = [Remote];
@@ -238,11 +227,15 @@ let TaskEngineController = (() => {
             _generateInit_decorators = [Remote];
             _writeSkill_decorators = [Remote];
             _installSkill_decorators = [Remote];
+            _listDirs_decorators = [Remote];
             _writeRule_decorators = [Remote];
             _readSkill_decorators = [Remote];
             _readRule_decorators = [Remote];
             _deleteSkill_decorators = [Remote];
             _deleteRule_decorators = [Remote];
+            __esDecorate(this, null, _resourceRoots_decorators, { kind: "method", name: "resourceRoots", static: false, private: false, access: { has: obj => "resourceRoots" in obj, get: obj => obj.resourceRoots }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _previewResource_decorators, { kind: "method", name: "previewResource", static: false, private: false, access: { has: obj => "previewResource" in obj, get: obj => obj.previewResource }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _importResource_decorators, { kind: "method", name: "importResource", static: false, private: false, access: { has: obj => "importResource" in obj, get: obj => obj.importResource }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _read_decorators, { kind: "method", name: "read", static: false, private: false, access: { has: obj => "read" in obj, get: obj => obj.read }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _write_decorators, { kind: "method", name: "write", static: false, private: false, access: { has: obj => "write" in obj, get: obj => obj.write }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _listSkills_decorators, { kind: "method", name: "listSkills", static: false, private: false, access: { has: obj => "listSkills" in obj, get: obj => obj.listSkills }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -253,6 +246,7 @@ let TaskEngineController = (() => {
             __esDecorate(this, null, _generateInit_decorators, { kind: "method", name: "generateInit", static: false, private: false, access: { has: obj => "generateInit" in obj, get: obj => obj.generateInit }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _writeSkill_decorators, { kind: "method", name: "writeSkill", static: false, private: false, access: { has: obj => "writeSkill" in obj, get: obj => obj.writeSkill }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _installSkill_decorators, { kind: "method", name: "installSkill", static: false, private: false, access: { has: obj => "installSkill" in obj, get: obj => obj.installSkill }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _listDirs_decorators, { kind: "method", name: "listDirs", static: false, private: false, access: { has: obj => "listDirs" in obj, get: obj => obj.listDirs }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _writeRule_decorators, { kind: "method", name: "writeRule", static: false, private: false, access: { has: obj => "writeRule" in obj, get: obj => obj.writeRule }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _readSkill_decorators, { kind: "method", name: "readSkill", static: false, private: false, access: { has: obj => "readSkill" in obj, get: obj => obj.readSkill }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _readRule_decorators, { kind: "method", name: "readRule", static: false, private: false, access: { has: obj => "readRule" in obj, get: obj => obj.readRule }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -264,6 +258,35 @@ let TaskEngineController = (() => {
             super(ctx, 'taskEngineController', { namespace: 'task-engine' });
             __runInitializers(this, _instanceExtraInitializers);
         }
+        async authorizedPath(path) {
+            return authorizedWorkspace(this.ctx, path, checkedPath);
+        }
+        /** Absolute installation roots for a selected workspace. */
+        async resourceRoots(request) {
+            if (!request.path.trim())
+                throw new Error('请选择工作区');
+            const workspace = await this.authorizedPath(request.path);
+            return { project: join(workspace, '.dsh', request.kind + 's'), user: join(dshHome(), request.kind + 's') };
+        }
+        /** Inspect uploaded bytes or a host directory without writing. */
+        async previewResource(request) {
+            return this.resourceImport(request, false);
+        }
+        /** Install exactly the reviewed bytes and target, without overwriting. */
+        async importResource(request) {
+            return this.resourceImport(request, true);
+        }
+        async resourceImport(request, commit) {
+            try {
+                const roots = await this.resourceRoots(request);
+                const base = roots[request.level];
+                const bundled = request.kind === 'skill' ? bundledSkillExists : bundledRuleExists;
+                return commit ? commitImport(request, base, bundled) : prepareImport(request, base, bundled).preview;
+            }
+            catch (error) {
+                return { ok: false, name: '', description: '', content: '', target: '', files: 0, bytes: 0, hash: '', conflict: false, error: error instanceof Error ? error.message : String(error) };
+            }
+        }
         /**
          * Resolve one workspace's effective workflow: a preset flow plus the project's
          * stage-binding override.
@@ -271,7 +294,7 @@ let TaskEngineController = (() => {
          * @returns the preset, project, or invalid selection plus its validation problems.
          */
         async read(path) {
-            path = checkedPath(path);
+            path = await this.authorizedPath(path);
             const fs = this.fs();
             const raw = await readEngText(fs, path);
             if (raw === undefined) {
@@ -325,7 +348,7 @@ let TaskEngineController = (() => {
          * `problems` filled when validation fails (nothing is written then).
          */
         async write(request) {
-            request.path = checkedPath(request.path);
+            request.path = await this.authorizedPath(request.path);
             const resolved = resolveFlow(request.flow, request.stage_bindings !== undefined ? { stage_bindings: request.stage_bindings } : undefined);
             if (!resolved.ok) {
                 return {
@@ -362,7 +385,7 @@ let TaskEngineController = (() => {
          * @returns the mountable skill catalog.
          */
         async listSkills(path) {
-            path = checkedPath(path);
+            path = await this.authorizedPath(path);
             const project = path === '' ? [] : listSkillsFromDir(join(path, '.dsh/skills'), 'project');
             const user = listSkillsFromDir(join(dshHome(), 'skills'), 'user');
             const bundled = listSkillsFromDir(BUNDLED_SKILLS_DIR, 'bundled');
@@ -381,7 +404,7 @@ let TaskEngineController = (() => {
          * @returns the mountable rule catalog.
          */
         async listRules(path) {
-            path = checkedPath(path);
+            path = await this.authorizedPath(path);
             const project = path === '' ? [] : scanRuleDir(join(path, '.dsh/rules'), 'project');
             const user = scanRuleDir(join(dshHome(), 'rules'), 'user');
             const bundled = scanRuleDir(BUNDLED_RULES_DIR, 'bundled');
@@ -405,7 +428,7 @@ let TaskEngineController = (() => {
          * @returns the ledger entries, empty when no task records exist.
          */
         async readTasks(path) {
-            path = checkedPath(path);
+            path = await this.authorizedPath(path);
             const fs = this.fs();
             const tasks = [];
             try {
@@ -422,14 +445,20 @@ let TaskEngineController = (() => {
                         state = JSON.parse(raw);
                     }
                     catch {
-                        continue; // A sibling `.dsh` file that happens to match the prefix but is not a task record.
+                        throw new Error('任务记录无法解析：' + entry.name);
                     }
+                    if (!state || ['id', 'title', 'stage', 'branch'].some(key => typeof state[key] !== 'string') || (state.items !== undefined && !Array.isArray(state.items)))
+                        throw new Error('任务记录格式无效：' + entry.name);
                     tasks.push({
+                        ...(state.risk_level ? { risk_level: state.risk_level } : {}),
+                        ...(state.updated_at ? { updated_at: state.updated_at } : {}),
+                        verification_passed: state.verification?.passed ?? false,
+                        review_outcome: state.review?.outcome ?? 'pending',
                         task_id: state.id,
                         title: state.title,
                         stage: state.stage,
                         branch: state.branch,
-                        items: state.items.map(item => ({
+                        items: (state.items ?? []).map(item => ({
                             id: item.id,
                             title: item.title,
                             status: item.status,
@@ -439,8 +468,10 @@ let TaskEngineController = (() => {
                     });
                 }
             }
-            catch {
-                // No listable `.dsh/` directory means there are no task records yet.
+            catch (error) {
+                // Only an absent directory is an empty ledger; denied access and corruption remain visible.
+                if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
+                    throw error;
             }
             return { tasks };
         }
@@ -450,7 +481,7 @@ let TaskEngineController = (() => {
          * @returns existence, body, and line count.
          */
         async readInit(path) {
-            path = checkedPath(path);
+            path = await this.authorizedPath(path);
             const { root } = locateInitRoot(path);
             const raw = await readTextAt(this.fs(), root, INITFILE);
             if (raw === undefined)
@@ -468,7 +499,7 @@ let TaskEngineController = (() => {
          * @returns `ok: false` with `lines` over the cap when the body is too long.
          */
         async writeInit(request) {
-            request.path = checkedPath(request.path);
+            request.path = await this.authorizedPath(request.path);
             const lines = lineCount(request.content);
             if (lines > INIT_MAX_LINES) {
                 return { ok: false, lines, error: `AGENTS.md 为 ${lines} 行，超过上限 ${INIT_MAX_LINES} 行；请精简到项目骨架后重试。` };
@@ -500,7 +531,7 @@ let TaskEngineController = (() => {
          * @returns the drafted body, or `ok: false` with an error when generation fails.
          */
         async generateInit(request) {
-            request.path = checkedPath(request.path);
+            request.path = await this.authorizedPath(request.path);
             const { root } = locateInitRoot(request.path);
             const snapshot = scanProject(root);
             const llm = this.ctx.get('llm');
@@ -551,7 +582,7 @@ let TaskEngineController = (() => {
          */
         async writeSkill(request) {
             if (request.path !== undefined)
-                request.path = checkedPath(request.path);
+                request.path = await this.authorizedPath(request.path);
             const name = sanitizeName(request.name);
             if (name === '' || request.description.trim() === '') {
                 return { ok: false, name, path: '', error: 'skill name and description must not be empty' };
@@ -574,45 +605,39 @@ let TaskEngineController = (() => {
          * @returns the installed path, or `ok: false` with an error.
          */
         async installSkill(request) {
-            const sourceDir = request.sourceDir.trim();
-            if (sourceDir === '' || !isAbsolute(sourceDir)) {
-                return { ok: false, name: '', path: '', error: '源目录必须是绝对路径' };
-            }
-            const skillFile = join(sourceDir, 'SKILL.md');
-            if (!existsSync(skillFile)) {
-                return { ok: false, name: '', path: '', error: `所选目录不是 skill：缺少 ${skillFile}` };
-            }
-            let parsed;
-            try {
-                parsed = parseSkillFile(readFileSync(skillFile, 'utf8'));
-            }
-            catch {
-                parsed = undefined;
-            }
-            if (parsed === undefined) {
-                return { ok: false, name: '', path: '', error: 'SKILL.md frontmatter 不可读（需要 name + description）' };
-            }
-            const name = sanitizeName(parsed.name);
-            if (name === '') {
-                return { ok: false, name, path: '', error: 'skill name 无效（只含小写字母数字和 -）' };
-            }
-            if (bundledSkillExists(name)) {
-                return { ok: false, name, path: '', error: `"${name}" 是内置技能，不可覆盖；给 SKILL.md 换个名字` };
-            }
-            const base = request.level === 'project'
-                ? join(request.path !== undefined ? checkedPath(request.path) : '', '.dsh/skills')
-                : join(dshHome(), 'skills');
-            const dest = join(base, name);
-            if (existsSync(dest)) {
-                return { ok: false, name, path: dest, error: `目标位置已存在同名技能（${dest}）——先删除或换名再装` };
-            }
+            const input = { kind: 'skill', level: request.level, path: request.path ?? process.cwd(), files: [], sourceDir: request.sourceDir };
+            const preview = await this.previewResource(input);
+            if (!preview.ok)
+                return { ok: false, name: preview.name, path: preview.target, error: preview.error ?? '安装校验失败' };
+            const result = await this.importResource({ ...input, expectedHash: preview.hash });
+            return result.ok ? { ok: true, name: result.name, path: result.target } : { ok: false, name: result.name, path: result.target, error: result.error ?? '安装失败' };
+        }
+        /**
+         * List the direct subdirectories of an absolute path for the install
+         * directory picker. Each child is flagged when it carries its own SKILL.md,
+         * so the dialog can tell a skill root apart from a plain container or folder.
+         * @param request - absolute directory to list (empty = the host home directory).
+         * @returns subdirectory names, each with its hasSkill flag.
+         */
+        async listDirs(request) {
+            const raw = request.path.trim();
+            const dir = raw === '' ? homedir() : raw;
+            const roots = filesystemRoots();
+            if (!isAbsolute(dir)) {
+                return { ok: false, path: dir, entries: [], roots, currentHasSkill: false, error: '路径必须是绝对路径' };
+            }
+            let entries;
             try {
-                copySkillDir(sourceDir, dest);
+                entries = readdirSync(dir, { withFileTypes: true });
             }
             catch (error) {
-                return { ok: false, name, path: dest, error: error instanceof Error ? error.message : String(error) };
+                return { ok: false, path: dir, entries: [], roots, currentHasSkill: false, error: error instanceof Error ? error.message : String(error) };
             }
-            return { ok: true, name, path: dest };
+            const list = entries
+                .filter(entry => entry.isDirectory() && !SKILL_DIR_FILTER.has(entry.name))
+                .sort((a, b) => a.name.localeCompare(b.name))
+                .map(entry => ({ name: entry.name, hasSkill: existsSync(join(dir, entry.name, 'SKILL.md')) }));
+            return { ok: true, path: dir, entries: list, roots, currentHasSkill: existsSync(join(dir, 'SKILL.md')) };
         }
         /**
          * Create a project- or user-level rule by writing its markdown file.
@@ -621,7 +646,7 @@ let TaskEngineController = (() => {
          */
         async writeRule(request) {
             if (request.path !== undefined)
-                request.path = checkedPath(request.path);
+                request.path = await this.authorizedPath(request.path);
             const name = sanitizeName(request.name);
             if (name === '' || request.content.trim() === '') {
                 return { ok: false, name, path: '', error: 'rule name and content must not be empty' };
@@ -643,7 +668,7 @@ let TaskEngineController = (() => {
          */
         async readSkill(request) {
             if (request.path !== undefined)
-                request.path = checkedPath(request.path);
+                request.path = await this.authorizedPath(request.path);
             const name = sanitizeName(request.name);
             const base = request.level === 'bundled'
                 ? BUNDLED_SKILLS_DIR
@@ -668,7 +693,7 @@ let TaskEngineController = (() => {
          */
         async readRule(request) {
             if (request.path !== undefined)
-                request.path = checkedPath(request.path);
+                request.path = await this.authorizedPath(request.path);
             const name = sanitizeName(request.name);
             const base = request.level === 'bundled'
                 ? BUNDLED_RULES_DIR
@@ -690,7 +715,7 @@ let TaskEngineController = (() => {
          */
         async deleteSkill(request) {
             if (request.path !== undefined)
-                request.path = checkedPath(request.path);
+                request.path = await this.authorizedPath(request.path);
             const name = sanitizeName(request.name);
             if (name === '')
                 return { ok: false, name, path: '', error: 'skill name must not be empty' };
@@ -707,7 +732,7 @@ let TaskEngineController = (() => {
          */
         async deleteRule(request) {
             if (request.path !== undefined)
-                request.path = checkedPath(request.path);
+                request.path = await this.authorizedPath(request.path);
             const name = sanitizeName(request.name);
             if (name === '')
                 return { ok: false, name, path: '', error: 'rule name must not be empty' };
@@ -802,7 +827,8 @@ class WorkspaceRegistry {
     }
 }
 function normalizeKey(path) {
-    return path.replace(/[\\/]+$/u, '').toLowerCase();
+    const key = path.replace(/\\/gu, '/').replace(/\/+$/u, '');
+    return process.platform === 'win32' ? key.toLowerCase() : key;
 }
 const workspaceRegistry = new WorkspaceRegistry();
 /** When true, an empty registry no longer falls back to checkedPath — Remote calls fail closed until a host registers workspaces. */
@@ -825,13 +851,16 @@ export function enableStrictWorkspaces() {
  */
 /** Exported for tests and host integrations: the Remote path guard itself. */
 export function checkedPath(raw) {
-    if (raw.trim() === '')
-        return raw; // empty means the host default, preserved for compatibility
+    if (raw.trim() === '') {
+        if (strictWorkspaces)
+            throw new Error('workspace path must be absolute');
+        return raw;
+    } // empty means the host default, preserved for compatibility
     if (!isAbsolute(raw)) {
         throw new RemoteError('gateway/internal', `task-engine: workspace path must be absolute: ${raw}`, {});
     }
     const normalized = raw.replace(/[\\/]+$/u, '');
-    const lower = normalized.toLowerCase();
+    const lower = normalized.replace(/\\/gu, '/').toLowerCase();
     const forbidden = ['c:/windows', 'c:/program files', 'c:/program files (x86)', 'c:/users'];
     for (const prefix of forbidden) {
         if (lower === prefix || lower.startsWith(`${prefix}/`)) {