@lytharalab/dsh-cons-auto-review 1.2.0 → 1.2.2

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# 1.2.2
+
+- 适配 DSH **0.2.1-rc.5**，保留 **0.1.7-rc.2**、**0.2.0-rc.2** 与 **0.2.1-rc.2** 支持；测试依赖升级，CI 扩展为 Node.js 22 / 24 × 四个 DSH 版本。
+- 核对新版发布包后，现有审查逻辑可继续复用；无需修改宿主或用户权限配置。
+- 新增真实模型服务回归：能力变化后只选择当前明确提供的低推理档位；安全写入不查询模型，能力查询失败转中文审批且不执行工具。
+
+# 1.2.1
+
+- 适配 DSH **0.2.1-rc.2**，保留 **0.1.7-rc.2** 与 **0.2.0-rc.2** 支持；测试依赖升级，CI 扩展为 Node.js 22 / 24 × 三个 DSH 版本。
+- 修复会话切换工作目录后，程序检查及模型审查仍使用初始目录的问题：文件、搜索、自定义路径工具及 Shell 相对路径与宿主实际执行目录保持一致。
+- 切换目录不扩大自动放行边界；相对额外可写根与审计日志仍锚定原工作区。无初始目录的会话使用宿主默认目录，目录恢复遵循宿主行为；目录解析失败不自动批准。
+- `/dcar` 显示版本跟随包版本，避免升级后仍显示旧版本号。
+- 增加工作目录变化、外部写入拦截、受保护路径、目录恢复、默认目录、审查环境与日志位置的回归验证。
+
 # 1.2.0
 
 - 修复长会话下「授权上下文超过 180000 字符的配置上限，自动审查未完成」导致**每个**需要审查的操作都退回人工授权的问题：会话变长后历史会持续增长，此前一旦整体超限就直接放弃审查，模型根本没有被调用。现在历史与项目指令各自有独立字符预算，超出时从最旧条目开始省略，并在审查输入里留下 `omitted-context` 说明——模型可见，不是静默截断。

package/README.md

@@ -1,16 +1,16 @@
-# Con's 自动审查 — DCAR 1.2.0
+# Con's 自动审查 — DCAR 1.2.2
 
 [![npm version](https://img.shields.io/npm/v/@lytharalab/dsh-cons-auto-review.svg)](https://www.npmjs.com/package/@lytharalab/dsh-cons-auto-review)
 [![CI](https://github.com/LytharaLab/DSH-Cons-Auto-Review/actions/workflows/ci.yml/badge.svg)](https://github.com/LytharaLab/DSH-Cons-Auto-Review/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-> **English.** DCAR (`@lytharalab/dsh-cons-auto-review`) adds a **CAutoR** preset to the DeepSeek Harness permission menu. Deterministic rules approve safe operations first — workspace writes, declared temp/external roots, literal read-only shell commands — and only what a program cannot approve is escalated to the LLM auto-review. The deterministic layer returns `allow` or `escalate`, never a silent denial. Install with `dsh plugin --profile desktop add @lytharalab/dsh-cons-auto-review`; Node.js 22.19+ or 24+, tested against DSH `0.1.7-rc.2` and `0.2.0-rc.2`. The detailed documentation below is in Chinese.
+> **English.** DCAR (`@lytharalab/dsh-cons-auto-review`) adds a **CAutoR** preset to the DeepSeek Harness permission menu. Deterministic rules approve safe operations first — workspace writes, declared temp/external roots, literal read-only shell commands — and only what a program cannot approve is escalated to the LLM auto-review. The deterministic layer returns `allow` or `escalate`, never a silent denial. Install with `dsh plugin --profile desktop add @lytharalab/dsh-cons-auto-review`; Node.js 22.19+ or 24+, tested against DSH `0.1.7-rc.2`, `0.2.0-rc.2`, `0.2.1-rc.2` and `0.2.1-rc.5`. The detailed documentation below is in Chinese.
 
 **`@lytharalab/dsh-cons-auto-review`** 为 DeepSeek Harness 的「权限」菜单添加 **CAutoR** 模式：先用 DSH「工作区内修改」的确定性路径规则自动放行安全操作，仅将无法由程序自动批准的操作交给 LLM Auto Review。第一层只返回 `allow` 或 `escalate`。
 
 ## 安装与启用
 
-包已发布到 npm：[`@lytharalab/dsh-cons-auto-review`](https://www.npmjs.com/package/@lytharalab/dsh-cons-auto-review)。要求 Node.js 22.19+ 或 24+；兼容并测试 DSH **0.1.7-rc.2**、**0.2.0-rc.2**。DSH 的插件 API 仍在变化，其他版本不作为 1.2.0 的兼容承诺。
+包已发布到 npm：[`@lytharalab/dsh-cons-auto-review`](https://www.npmjs.com/package/@lytharalab/dsh-cons-auto-review)。要求 Node.js 22.19+ 或 24+；兼容并测试 DSH **0.1.7-rc.2**、**0.2.0-rc.2**、**0.2.1-rc.2**、**0.2.1-rc.5**。DSH 的插件 API 仍在变化，其他版本不作为 1.2.2 的兼容承诺。
 
 ```powershell
 dsh plugin --profile desktop add @lytharalab/dsh-cons-auto-review
@@ -20,7 +20,7 @@ Web 使用 `--profile web`。也可以离线安装解压的项目目录或仓库
 
 ```powershell
 dsh plugin --profile desktop add "L:\Projects\DSH-Cons-Auto-Review"
-dsh plugin --profile desktop add "L:\Projects\DSH-Cons-Auto-Review\lytharalab-dsh-cons-auto-review-1.2.0.tgz"
+dsh plugin --profile desktop add "L:\Projects\DSH-Cons-Auto-Review\lytharalab-dsh-cons-auto-review-1.2.2.tgz"
 ```
 
 **从旧包名升级：**包在首次公开发布时由 `dsh-cons-auto-review` 改名为 `@lytharalab/dsh-cons-auto-review`。关闭 Desktop，先移除旧包再装新包，然后重新打开：
@@ -66,6 +66,14 @@ profile 配置里若残留 `name: dsh-cons-auto-review` 的插件行或覆盖片
 
 CAutoR 的执行策略是 `danger-full-access`。它复用原模式的路径审查逻辑，并以程序检查及 LLM 作为授权入口；不使用原执行沙箱隔离进程。
 
+## 1.2.2 · DSH 0.2.1-rc.5 适配
+
+支持 DSH **0.2.1-rc.5**，保留此前三个版本的兼容性。测试依赖使用新版真实服务，CI 覆盖 Node.js 22 / 24 × 四个 DSH 版本；新增模型能力动态变化及能力查询失败的真实服务回归验证。
+
+## 1.2.1 · DSH 0.2.1 适配
+
+支持 DSH **0.2.1-rc.2** 的会话工作目录切换：相对文件路径、搜索路径、Shell 的 `workdir` 和审查输入均使用宿主当前目录。自动放行的工作区边界仍是会话初始工作区，切换目录不会扩大它；配置中的相对额外根目录与审计日志路径也仍以初始工作区为基准。当前目录消失时跟随宿主恢复；无法确定目录时按 `review.onError` 处理。旧 DSH 继续使用原有目录逻辑。
+
 ## 1.2.0 长会话上下文预算
 
 会话变长后，审查输入里的历史事实会持续增长。1.1.0 及更早版本一旦整体超过 `maxInputChars`（默认 180000）就放弃本次审查并退回人工授权——于是**每个**需要审查的操作都要手动确认，而模型根本没有被调用。1.2.0 把长上下文拆成两段独立预算来处理：
@@ -142,3 +150,6 @@ DCAR 放宽的是「哪些操作还需要人工确认」，不是隔离边界：
 ## 许可
 
 [MIT](LICENSE)。复制和改编的 DeepSeek MIT 代码见 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) 与 [THIRD_PARTY_LICENSE.txt](THIRD_PARTY_LICENSE.txt)。
+
+## CON？
+- 目前此项目由 [Con89524](https://github.com/Convex89524) 单人维护

package/THIRD_PARTY_NOTICES.md

@@ -8,3 +8,5 @@ This project includes adapted code from [DeepSeek Harness](https://github.com/de
 - `src/permission-presets.js`: subclasses the host DSH permission service, adding effect-scoped custom review presets and an absent-provider guard; the upstream base implementation stays in the host's installed package.
 
 The project's npm peer and development dependencies keep their own license terms. No dependency source or `node_modules` is included in the project ZIP or npm package.
+
+DCAR 1.2.1 also follows the working-directory snapshot change in [DeepSeek Harness 687f282e8625c6b8d11ff58211a90524be2e4317](https://github.com/deepseek-ai/deepseek-harness/tree/687f282e8625c6b8d11ff58211a90524be2e4317), under the same MIT License.

package/docs/COMPATIBILITY.md

@@ -2,15 +2,19 @@
 
 ## 支持版本
 
-DCAR 1.2.0 固定支持 DSH **0.1.7-rc.2** 与 **0.2.0-rc.2**。关键路径使用官方扩展点 `tools/pre-execute`、权限 Session 投影、命令注册表、文件系统解析和 `ctx.llm.stream`。
+DCAR 1.2.2 固定支持 DSH **0.1.7-rc.2**、**0.2.0-rc.2**、**0.2.1-rc.2** 与 **0.2.1-rc.5**。关键路径使用官方扩展点 `tools/pre-execute`、权限 Session 投影、命令注册表、文件系统解析和 `ctx.llm.stream`。
 
 源码基线：DeepSeek Harness `639ed015397290b3745d163aafe02ffee4aa3f84`（`dsh-v0.2.0-rc.2`）；旧版本基线为 `477b4f420553e8a52c2fbccc464d7561b239c443`（`dsh-v0.1.7-rc.2`）。两版使用的 reviewer、permission service、containment 与文件路径解析源码一致。
 
+新增基线：[DeepSeek Harness `687f282e8625c6b8d11ff58211a90524be2e4317`](https://github.com/deepseek-ai/deepseek-harness/tree/687f282e8625c6b8d11ff58211a90524be2e4317)（`dsh-v0.2.1-rc.2`）。新版将当前执行目录与原始工作区分开；DCAR 按宿主当前目录检查相对路径并构造审查环境，保留原工作区作为程序批准边界。当前目录变化通知只作为历史事实，不构成授权。旧版通过能力探测沿用初始目录，无需安装新版目录服务。
+
+新增基线：[DeepSeek Harness `b830ec950faba0a46dda564be3e2d854afed94f1`](https://github.com/deepseek-ai/deepseek-harness/tree/b830ec950faba0a46dda564be3e2d854afed94f1)（`dsh-v0.2.1-rc.5`）。已核对 GitHub 标签、版本间提交及新版权限服务源码，并比较 rc.2 / rc.5 对应测试依赖发布包：19 个直接 DSH 依赖的 `lib/` 运行时代码与类型声明（不含 source map）逐字节一致，当前适配逻辑可直接复用。新增真实服务测试验证动态模型能力与查询失败路径；这不替代真实远端模型目录及网络的验收。
+
 ## CAutoR 集成方式
 
 官方权限服务只提供固定 `registerAuto()` 动态接口，通用自定义模式依赖静态预设表。1.0.2 由主插件在激活时给已存在的权限服务实例附加动态模式注册能力；安装补丁只插入 `dcar`，不替换宿主的权限服务行。
 
-运行时适配覆盖该服务实例的 `names/specOf/derive/apply`，复用原始 Session 事件、沙箱和审批 setter、`/permission`、Remote `catalog()`、投影及官方 Auto 注册。审查入口安装后注册 CAutoR；停用时取消审查、回退已加载会话，再撤销审查注册并还原服务原始属性；已保存的默认设置保留只读守护项。它需要官方类中 `specOf/derive/apply/emitCatalogChanged` 的运行时方法；这些不是通用稳定第三方扩展接口，因此依赖版本明确固定为以上两个版本，并在加载时检查方法可用性。插件不修改 DSH 安装目录中的源码，也不注册第二个权限服务。
+运行时适配覆盖该服务实例的 `names/specOf/derive/apply`，复用原始 Session 事件、沙箱和审批 setter、`/permission`、Remote `catalog()`、投影及官方 Auto 注册。审查入口安装后注册 CAutoR；停用时取消审查、回退已加载会话，再撤销审查注册并还原服务原始属性；已保存的默认设置保留只读守护项。它需要官方类中 `specOf/derive/apply/emitCatalogChanged` 的运行时方法；这些不是通用稳定第三方扩展接口，因此依赖版本明确固定为以上四个版本，并在加载时检查方法可用性。插件不修改 DSH 安装目录中的源码，也不注册第二个权限服务。
 
 DSH Web/desktop 的权限 UI 从该 `catalog()` 读取选项，自定义标签按服务端 `name` 显示，CAutoR 无需修改前端 bundle。
 
@@ -24,7 +28,7 @@ DSH Web/desktop 的权限 UI 从该 `catalog()` 读取选项，自定义标签
 
 ## 已运行的检查
 
-见 `TEST_REPORT.md` 与 `test-results/`：两个发布版本分别安装对应的真实 DSH npm 包，运行相同的完整插件测试。测试使用真实 Cordis、权限目录、Session、Session 投影、工具执行管线、原生文件读写工具、原生审批和命令服务；模型响应由本地测试 Adapter 提供。
+见 `TEST_REPORT.md` 与 `test-results/`：四个发布版本分别安装对应的真实 DSH npm 包，运行完整插件测试；旧版显式跳过新版独有的目录服务场景。测试使用真实 Cordis、权限目录、Session、Session 投影、工具执行管线、原生文件读写工具、原生审批和命令服务；模型响应由本地测试 Adapter 提供。
 
 覆盖本地零模型写入、按需升级、拒绝不执行、询问只在批准后执行、符号链接和目录前缀、Shell 混合语法、PTC 内部调用、子 Agent 与创建竞态、卸载回退、缺失审查提供者、配置验证、模型路由、重试、超时、并发、缓存和默认日志参数省略。
 
@@ -34,7 +38,7 @@ DSH Web/desktop 的权限 UI 从该 `catalog()` 读取选项，自定义标签
 
 ## 验证范围
 
-验证环境是 Linux、Node.js 24.19.0。未实际运行 Windows/macOS desktop 窗口、真实 API 或 OS 级沙箱进程；平台临时目录和 Windows 路径行为沿用 DSH/Node 实现，需要在目标机器验证。这里的 PTC 检查使用真实工具管线的 nested dispatch 输入，未启动 PTC VM。
+1.2.2 与 1.2.1 验证环境为 Windows、Node.js 24.13.0；历史验证环境为 Linux、Node.js 24.19.0。未实际运行 Desktop 窗口、真实模型 API 或 OS 级沙箱进程。这里的 PTC 检查使用真实工具管线的 nested dispatch 输入，未启动 PTC VM。Node.js 22 / 24 的 Linux CI 矩阵仍需推送后运行。
 
 默认设置测试使用真实 Settings、Loader 和权限服务，并将配置保存到测试 JSON 文件后重新加载。测试存储替代 DSH 的完整多层 YAML 配置编辑器；未启动实际 Desktop 设置页面。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lytharalab/dsh-cons-auto-review",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Con's 自动审查（DCAR）：确定性规则优先、LLM 按需升级的 DeepSeek Harness 工具审查插件，提供 CAutoR 权限模式。Deterministic-first auto review for DeepSeek Harness.",
   "type": "module",
   "main": "./src/index.js",
@@ -68,34 +68,35 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.0",
-    "@deepseek-ai/dsh-llm": ">=0.0.1-rc.1",
-    "@deepseek-ai/dsh-permission-presets": "0.1.7-rc.2 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": ">=0.0.1-rc.1",
-    "@deepseek-ai/dsh-util-values": ">=0.0.1-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-permission-presets": "0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-sandbox": "0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-util-values": "0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
     "@deepseek-ai/schemastery": "*",
-    "@deepseek-ai/dsh-user-approval": "0.1.7-rc.2 || 0.2.0-rc.2"
+    "@deepseek-ai/dsh-user-approval": "0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/cordis-plugin-loader": "1.0.5",
-    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-commands": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-permission-presets": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-settings": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-shell": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-tool-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-util-values": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-permission-presets": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-shell": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-fs": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-util-values": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5",
     "@deepseek-ai/schemastery": "3.18.4",
     "yaml": "2.8.3"
   },

package/src/audit.js

@@ -32,7 +32,7 @@ export class Audit {
   request(id) {
     this.state(id).llmRequests++;
   }
-  record(exec, event, c) {
+  record(exec, event, c, workspaceRoot = exec.agent.session.header.cwd) {
     const id = String(exec.agent.session.id),
       s = this.state(id);
     s.total++;
@@ -74,10 +74,9 @@ export class Audit {
     if (s.history.length > c.audit.historyLimit)
       s.history.splice(0, s.history.length - c.audit.historyLimit);
     if (c.audit.file) {
-      const cwd = exec.agent.session.header.cwd;
       const file = isAbsolute(c.audit.file)
         ? c.audit.file
-        : resolve(cwd, c.audit.file);
+        : resolve(workspaceRoot, c.audit.file);
       this.tail = this.tail
         .then(async () => {
           await mkdir(dirname(file), { recursive: true });

package/src/deterministic.js

@@ -1,6 +1,7 @@
 /** Layer one: a positive authorization rule or escalation; never a final deny. */
 import { checkPaths, allow, escalate } from "./paths.js";
 import { checkShell } from "./shell.js";
+import { executionDirectories } from "./working-directory.js";
 function field(a, path) {
   return path
     .split(".")
@@ -28,18 +29,18 @@ export async function deterministic(exec, ctx, c, signal = exec.signal) {
     return escalate("INVALID_ARGUMENTS", "Expected object arguments");
   if (c.shell.tools.includes(name)) return checkShell(exec, ctx, c, signal);
   const custom = c.rules.customTools.find((r) => r.name === name);
-  const cwd = exec.agent.session.header.cwd;
+  const { cwd, workspaceRoot } = await executionDirectories(exec, ctx, signal);
   if (custom) {
     const paths = custom.pathFields.flatMap((p) => {
       const v = field(a, p);
       return Array.isArray(v) ? v : [v];
     });
-    return checkPaths(paths, custom.effect, cwd, ctx, c, signal);
+    return checkPaths(paths, custom.effect, cwd, ctx, c, signal, workspaceRoot);
   }
   if (c.rules.readTools.includes(name))
-    return checkPaths([a.file_path], "read", cwd, ctx, c, signal);
+    return checkPaths([a.file_path], "read", cwd, ctx, c, signal, workspaceRoot);
   if (c.rules.writeTools.includes(name))
-    return checkPaths([a.file_path], "write", cwd, ctx, c, signal);
+    return checkPaths([a.file_path], "write", cwd, ctx, c, signal, workspaceRoot);
   if (c.rules.searchTools.includes(name)) {
     const path = a.path ?? a.cwd ?? cwd;
     // An absolute/traversing glob can search beyond its supplied root; do not approve it by its cwd.
@@ -49,7 +50,7 @@ export async function deterministic(exec, ctx, c, signal = exec.signal) {
         /(^|[\\/])\.\.([\\/]|$)|^[\\/]|^[a-z]:/i.test(a.pattern))
     )
       return escalate("SEARCH_SCOPE", "Search pattern needs review");
-    return checkPaths([path], "read", cwd, ctx, c, signal);
+    return checkPaths([path], "read", cwd, ctx, c, signal, workspaceRoot);
   }
   return escalate(
     "UNKNOWN_TOOL",

package/src/engine.js

@@ -1,5 +1,6 @@
 /** Deterministic-first authorization, configurable LLM fallback, and audit. */
 import { deterministic } from "./deterministic.js";
+import { executionDirectories, workspaceDirectory } from "./working-directory.js";
 import {
   snapshotAutoReview,
   budgetReviewText,
@@ -86,7 +87,10 @@ export class ReviewEngine {
             c.review.maxQueued,
             reviewSignal,
           );
-          const snapshot = this.snapshot(exec.agent, exec);
+          const { cwd } = await abortable(
+            executionDirectories(exec, this.ctx, reviewSignal), reviewSignal,
+          );
+          const snapshot = this.snapshot(exec.agent, exec, cwd);
           const budgeted = budgetReviewText(snapshot, c.review);
           const text = budgeted.text;
           trace.contextOmitted =
@@ -286,6 +290,7 @@ export class ReviewEngine {
         displayReason,
       },
       c,
+      workspaceDirectory(exec, this.ctx),
     );
     return result;
   }

package/src/index.d.ts

@@ -91,7 +91,7 @@ export class ReviewEngine {
   );
   review(
     exec: {
-      agent: { session: { id: string; header: { cwd: string } } };
+      agent: { session: { id: string; header: { cwd?: string } } };
       name: string;
       arguments: unknown;
       callId: string;

package/src/index.js

@@ -1,5 +1,6 @@
-/** DCAR 1.1.0: CAutoR permission preset and deterministic-first tool gate. */
+/** CAutoR permission preset and deterministic-first tool gate. */
 import z from "@deepseek-ai/schemastery";
+import pkg from "../package.json" with { type: "json" };
 import { DEFAULTS, resolveConfig, patchConfig } from "./config.js";
 import { ReviewEngine } from "./engine.js";
 import { attachPermissionAdapter } from "./permission-adapter.js";
@@ -359,7 +360,7 @@ export function apply(ctx, input = {}) {
                 if (cmd === "" || cmd === "status")
                   return {
                     kind: "success",
-                    text: `DCAR 1.1.0 | 当前权限：${presets.current(session)} | CAutoR 审查：${selected(session) || inherited.has(session) ? "启用" : "未启用"}\n/dcar on · off · stats · history · config · reset · clear-cache · check`,
+                    text: `DCAR ${pkg.version} | 当前权限：${presets.current(session)} | CAutoR 审查：${selected(session) || inherited.has(session) ? "启用" : "未启用"}\n/dcar on · off · stats · history · config · reset · clear-cache · check`,
                   };
                 return {
                   kind: "error",

package/src/paths.js

@@ -38,17 +38,17 @@ export function protectedPath(path, config) {
   );
 }
 /** Check every path, including aliases and missing targets, without changing sandbox policy. */
-export async function checkPaths(paths, effect, cwd, ctx, config, signal) {
+export async function checkPaths(paths, effect, cwd, ctx, config, signal, workspaceRoot = cwd) {
   if (!paths.length)
     return escalate("INVALID_PATH", "No target paths supplied");
-  if (!isAbsolute(cwd))
+  if (!isAbsolute(cwd) || !isAbsolute(workspaceRoot))
     return escalate("WORKSPACE_UNAVAILABLE", "No absolute session workspace");
   const roots = config.rules.includeTempRoots
-    ? writableRoots({ mode: "workspace-write", workspaceRoot: cwd })
-    : [cwd];
+    ? writableRoots({ mode: "workspace-write", workspaceRoot })
+    : [workspaceRoot];
   roots.push(
     ...config.rules.additionalWritableRoots.map((p) =>
-      isAbsolute(p) ? p : resolve(cwd, p),
+      isAbsolute(p) ? p : resolve(workspaceRoot, p),
     ),
   );
   for (const path of paths) {

package/src/permission-adapter.js

@@ -24,7 +24,7 @@ export function attachPermissionAdapter(service) {
   if (typeof names !== "function" ||
       Object.values(original).some((method) => typeof method !== "function") ||
       typeof service.emitCatalogChanged !== "function")
-    throw new Error("DCAR requires the DSH 0.1.7-rc.2 / 0.2.0-rc.2 permission service runtime APIs");
+    throw new Error("DCAR 所需的 DSH 权限服务接口不可用，无法启用自动审查；请参阅 docs/COMPATIBILITY.md");
   if (!Object.isExtensible(service) || [...own.values()].some((d) => d && !d.configurable))
     throw new Error("DCAR cannot extend this permission service instance");
   const entries = new Map();

package/src/permission-presets.js

@@ -1,5 +1,5 @@
 /**
- * DSH 0.1.7-rc.2 / 0.2.0-rc.2 permission service adapter.
+ * Permission service adapter for the DSH releases listed in docs/COMPATIBILITY.md.
  * Adds effect-scoped review presets without changing DSH's built-in knob setters,
  * /permission command, session projection, catalog Remote, or official Auto integration.
  */
@@ -13,7 +13,7 @@ export default class DCARPermissionPresetService extends PermissionPresetService
     for (const method of ["specOf", "derive", "apply", "emitCatalogChanged"])
       if (typeof PermissionPresetService.prototype[method] !== "function")
         throw new Error(
-          `DCAR permission adapter requires DSH 0.1.7-rc.2 or 0.2.0-rc.2 (${method} is unavailable)`,
+          `DCAR 所需的 DSH 权限服务接口 ${method} 不可用，无法启用自动审查；请参阅 docs/COMPATIBILITY.md`,
         );
     super(ctx, config);
     this.dcarReviewPresets = new Map();

package/src/shell.js

@@ -1,5 +1,6 @@
 /** Conservative command grammar for unconfined execution. Unrecognized syntax escalates. */
 import { checkPaths, allow, escalate } from "./paths.js";
+import { executionDirectories } from "./working-directory.js";
 /** Parse literal argv only; never evaluate a command or use a prefix permission match. */
 export function literalArgv(command) {
   if (
@@ -61,9 +62,9 @@ export async function checkShell(exec, ctx, c, signal) {
       "Expansion, compound syntax or scripts require LLM review",
     );
   const [exe, ...args] = argv;
-  const cwd = exec.agent.session.header.cwd;
+  const { cwd, workspaceRoot } = await executionDirectories(exec, ctx, signal);
   if (a.workdir !== undefined) {
-    const checked = await checkPaths([a.workdir], "write", cwd, ctx, c, signal);
+    const checked = await checkPaths([a.workdir], "write", cwd, ctx, c, signal, workspaceRoot);
     if (checked.kind !== "allow") return checked;
   }
   const base =
@@ -109,6 +110,7 @@ export async function checkShell(exec, ctx, c, signal) {
         ctx,
         c,
         signal,
+        workspaceRoot,
       );
     }
     if (exe === "pwd")
@@ -181,6 +183,7 @@ export async function checkShell(exec, ctx, c, signal) {
       ctx,
       c,
       signal,
+      workspaceRoot,
     );
   }
   if (c.shell.workspaceMutationCommands.includes(exe)) {
@@ -191,7 +194,7 @@ export async function checkShell(exec, ctx, c, signal) {
     );
     if (!paths.length || paths.some((x) => x.startsWith("-")))
       return escalate("SHELL_OPTIONS", "Unsupported mutation options");
-    return checkPaths(paths, "write", base, ctx, c, signal);
+    return checkPaths(paths, "write", base, ctx, c, signal, workspaceRoot);
   }
   return escalate("UNKNOWN_COMMAND", `Command ${exe} requires semantic review`);
 }

package/src/upstream-reviewer.js

@@ -221,7 +221,7 @@ function ptcAction(exec, start, visibleParentKeys) {
     arguments: exec.arguments,
   };
 }
-function snapshotAutoReview(agent, exec) {
+function snapshotAutoReview(agent, exec, cwd = agent.session.header.cwd) {
   const { session } = agent;
   const events = session.snapshotEvents();
   const nodes = [...session.surface.nodes];
@@ -235,7 +235,6 @@ function snapshotAutoReview(agent, exec) {
       "auto-review: no complete request-header route is available",
     );
   }
-  const cwd = session.header.cwd;
   if (cwd === void 0 || cwd.length === 0) {
     throw new Error("auto-review: the session has no working directory");
   }

package/src/working-directory.js

@@ -0,0 +1,26 @@
+/** Resolve paths where the host executes them, without moving the permission root. */
+import { isAbsolute } from "node:path";
+
+function directoryService(ctx) {
+  return typeof ctx.get === "function"
+    ? ctx.get("workingDirectory")
+    : ctx.workingDirectory;
+}
+
+export function workspaceDirectory(exec, ctx) {
+  return exec.agent.session.header.cwd ?? directoryService(ctx)?.defaultDirectory;
+}
+
+export async function executionDirectories(exec, ctx, signal) {
+  const service = directoryService(ctx);
+  const original = exec.agent.session.header.cwd;
+  // Older DSH releases have no mutable working-directory service.
+  const cwd = service === undefined
+    ? original
+    : await service.ensure(exec.agent, signal);
+  const workspaceRoot = original ?? service?.defaultDirectory;
+  if (typeof cwd !== "string" || !isAbsolute(cwd) ||
+      typeof workspaceRoot !== "string" || !isAbsolute(workspaceRoot))
+    throw new Error("DCAR 无法确定当前工作目录和原始工作区，不能据此自动放行");
+  return { cwd, workspaceRoot };
+}