@shgroup/dsh-serenity-hooks 1.51.3 → 1.51.4

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.51.3",
+  "version": "1.51.4",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：给 DSH 装一个「AI 工作区」——12 个工具（container_fs/container_trajectory/dashboard/container_git/msm/praxis/handyman/localstore/container_admin/im-bridge/acc-diag/diagram；后三个按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫）+ 轨迹日志与原地重建 + 网页登录入口/微信桥/子角色/对外问答页/trajectory 唤醒注册表。适配 DSH 0.1.7-rc.1（deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/{ccc-DG4Oc7I1.js → ccc-DXky9UZu.js}

@@ -156,6 +156,31 @@ function readExclusiveTools(root, paths = DEFAULT_SERENITY_CONFIG_PATHS) {
 	return list.filter((x) => typeof x === "string" && x.trim() !== "").map((x) => x.trim());
 }
 /**
+* 读取 CCC 声明的「安全模式期间隐藏的工具」清单（`safeMode.hiddenTools`，v1.51.4）。
+*
+* 语义（R↓）：**标记文件存在 ⇒ 才生效**。deny = `['bash', ...本清单]`（并集去重）；
+* 标记消失 ⇒ 连同 `bash` 一起解除（调用点在 `syncSafeModeRestriction`，与基础表同一处）。
+*
+* 失败方向 = **fail-open**（与 `exclusiveTools` 的 fail-closed 相反，理由不同）：
+* 未配置 / 字段缺失 / 配置损坏 ⇒ **空数组** = 只隐藏基础表。本键是**附加**屏蔽，
+* 读不到声明就等于"没有证据要求多藏"；且**隐藏是危险方向**（藏掉 agent 真正要用的工具
+* 会静默损害能力），而配置损坏本身已有 `loadSerenityConfig` 的响亮告警（不静默）。
+*
+* 🔴 名字在此**不做**校验——未注册的名字会被 DSH `restrict` 拒绝（宿主契约逐字：
+* "Empty filters, unknown names, scope-local names, and reserved transport names **fail**"）
+* ⇒ **调用方必须按"失败退化为基础表"处理**（见 `syncSafeModeRestriction`），
+* 否则 CCC 写错一个名字会连 `bash` 的隐藏一起丢掉。
+*
+* @param root CCC 根
+* @param paths 候选配置相对路径
+* @returns 去空白后的工具名列表（非字符串/空白项被丢弃）
+*/
+function readSafeModeHiddenTools(root, paths = DEFAULT_SERENITY_CONFIG_PATHS) {
+	const list = loadSerenityConfig(root, paths).safeMode?.hiddenTools;
+	if (!Array.isArray(list)) return [];
+	return list.filter((x) => typeof x === "string" && x.trim() !== "").map((x) => x.trim());
+}
+/**
 * 读取 CCC 声明的「轨迹默认 skill」清单（`trajectory.skills`，v1.44.0）。
 *
 * 语义与失败方向（R↓）：
@@ -214,4 +239,4 @@ function matchBlacklist(relPath, rules) {
 	return null;
 }
 //#endregion
-export { findSerenityRoot as a, matchBlacklist as c, readCccName as d, readExclusiveTools as f, resolveInside as g, readUtf8 as h, findGitRoot as i, pathInside as l, readTrajectorySkills as m, SAFE_MODE_MARKER as n, isSafeModeOn as o, readHandymanConfig as p, classifyPath as r, loadSerenityConfig as s, DEFAULT_SERENITY_CONFIG_PATHS as t, readBlacklist as u };
+export { resolveInside as _, findSerenityRoot as a, matchBlacklist as c, readCccName as d, readExclusiveTools as f, readUtf8 as g, readTrajectorySkills as h, findGitRoot as i, pathInside as l, readSafeModeHiddenTools as m, SAFE_MODE_MARKER as n, isSafeModeOn as o, readHandymanConfig as p, classifyPath as r, loadSerenityConfig as s, DEFAULT_SERENITY_CONFIG_PATHS as t, readBlacklist as u };

package/lib/{ccc-roots-DtiMVRPo.js → ccc-roots-Bo0HKLlM.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { a as hostSessions, i as hostService } from "./access-CNccNtgf.js";
-import { a as findSerenityRoot } from "./ccc-DG4Oc7I1.js";
+import { a as findSerenityRoot } from "./ccc-DXky9UZu.js";
 import { basename } from "node:path";
 //#region src/ccc-roots.ts
 /**
@@ -150,7 +150,7 @@ async function listCccs(ctx, opts = {}) {
 	if (typeof defaultRoot === "string" && defaultRoot !== "" && !c.roots.includes(defaultRoot)) c.roots.unshift(defaultRoot);
 	let rolesOf = null;
 	if (opts.withRoles === true) {
-		const { readSkiffRoles } = await import("./skiff-role-DQZ6eR51.js").then((n) => n.u);
+		const { readSkiffRoles } = await import("./skiff-role-BSg6Qu9k.js").then((n) => n.u);
 		rolesOf = (root) => [...readSkiffRoles(root).keys()];
 	}
 	return c.roots.map((root) => ({

package/lib/ccc.d.ts

@@ -57,6 +57,15 @@ interface SerenityConfig {
     };
     safeMode?: {
         blacklist?: string[];
+        /**
+         * **安全模式开启期间**额外从模型工具清单隐藏的工具（v1.51.4，owner 2026-10-09 令）。
+         *
+         * 语义（与 `exclusiveTools` 的区别，判据是"条件"）：本键不是无条件的可见性白名单，
+         * 而是**条件屏蔽**——`\.serenity-safe-on` 标记存在时才隐藏，标记消失即**全部恢复**
+         * （基础表恒隐 `bash` 不受影响）。机制在 ACC、声明在 CCC（D23）：
+         * ACC 代码里不出现任何具体工具名。
+         */
+        hiddenTools?: string[];
     };
     /** localstore git 提交策略（S134 重设计）：allow 可提交 / deny 禁提交（缺省 deny） */
     localstore?: {
@@ -311,6 +320,27 @@ export declare function loadSerenityConfig(root: string, paths?: string[]): Sere
  * @returns 去空白后的工具名列表（非字符串项被丢弃）
  */
 export declare function readExclusiveTools(root: string, paths?: string[]): string[];
+/**
+ * 读取 CCC 声明的「安全模式期间隐藏的工具」清单（`safeMode.hiddenTools`，v1.51.4）。
+ *
+ * 语义（R↓）：**标记文件存在 ⇒ 才生效**。deny = `['bash', ...本清单]`（并集去重）；
+ * 标记消失 ⇒ 连同 `bash` 一起解除（调用点在 `syncSafeModeRestriction`，与基础表同一处）。
+ *
+ * 失败方向 = **fail-open**（与 `exclusiveTools` 的 fail-closed 相反，理由不同）：
+ * 未配置 / 字段缺失 / 配置损坏 ⇒ **空数组** = 只隐藏基础表。本键是**附加**屏蔽，
+ * 读不到声明就等于"没有证据要求多藏"；且**隐藏是危险方向**（藏掉 agent 真正要用的工具
+ * 会静默损害能力），而配置损坏本身已有 `loadSerenityConfig` 的响亮告警（不静默）。
+ *
+ * 🔴 名字在此**不做**校验——未注册的名字会被 DSH `restrict` 拒绝（宿主契约逐字：
+ * "Empty filters, unknown names, scope-local names, and reserved transport names **fail**"）
+ * ⇒ **调用方必须按"失败退化为基础表"处理**（见 `syncSafeModeRestriction`），
+ * 否则 CCC 写错一个名字会连 `bash` 的隐藏一起丢掉。
+ *
+ * @param root CCC 根
+ * @param paths 候选配置相对路径
+ * @returns 去空白后的工具名列表（非字符串/空白项被丢弃）
+ */
+export declare function readSafeModeHiddenTools(root: string, paths?: string[]): string[];
 /**
  * 读取 CCC 声明的「轨迹默认 skill」清单（`trajectory.skills`，v1.44.0）。
  *

package/lib/index.js

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { a as hostSessions, c as hostWeb, i as hostService, l as hostWebServer, n as hostInjected, o as hostSettings, r as hostLlm, s as hostSubagents, t as hostAgents } from "./access-CNccNtgf.js";
-import { a as findSerenityRoot, c as matchBlacklist, d as readCccName$1, f as readExclusiveTools, g as resolveInside, i as findGitRoot, l as pathInside, m as readTrajectorySkills, n as SAFE_MODE_MARKER, o as isSafeModeOn, p as readHandymanConfig, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-DG4Oc7I1.js";
-import { i as cccRootForExec, n as agentCwdFor, o as listCccs, r as cccRootForCwd, t as NO_CCC_FROM_AGENT_CWD } from "./ccc-roots-DtiMVRPo.js";
-import { A as localIdStamp, C as setActiveSessionInfo, D as isoLocal, E as useSession, O as localFileStamp, S as sessionsRoot, T as summarize, _ as namingTitleFor, a as pruneMissingBindings, b as resolveSessionByTitle, c as setBindingStore, d as clearActiveSessionInfo, f as createSession, g as listSessions, h as getActiveSessionInfo, i as listBoundSessionIds, k as localHuman, l as DEFAULT_SESSION_SCOPE, m as findSession, n as PLUGIN_SOURCE, o as readLastBound, p as extractSessionMdPathFromText, r as appendBound, s as resolveSessionTrajectoryLabel, t as ACC_MESSAGE_KIND, u as TRAJECTORY_ACTIONS, v as parseSessionContextFromEvents, w as showSession, x as sessionEvents$1, y as readActiveSessionMd } from "./message-source-LnJwIqLm.js";
-import { a as readWeixinCredential, c as weixinInboundDir, d as LOCALSTORE_SCOPES, f as checkLocalstoreGitCompliance, g as runLocalStore, h as readStore, i as matchWeixinRoute, l as weixinSessionIdFor, m as readGitTrack, n as extractWeixinText, o as readWeixinSettings, p as localstorePath, r as hasVoiceItem, s as sanitizeFileName$1, t as extractWeixinMedia } from "./weixin-route-7BtOiy4X.js";
+import { _ as resolveInside, a as findSerenityRoot, c as matchBlacklist, d as readCccName$1, f as readExclusiveTools, h as readTrajectorySkills, i as findGitRoot, l as pathInside, m as readSafeModeHiddenTools, n as SAFE_MODE_MARKER, o as isSafeModeOn, p as readHandymanConfig, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-DXky9UZu.js";
+import { i as cccRootForExec, n as agentCwdFor, o as listCccs, r as cccRootForCwd, t as NO_CCC_FROM_AGENT_CWD } from "./ccc-roots-Bo0HKLlM.js";
+import { A as localIdStamp, C as setActiveSessionInfo, D as isoLocal, E as useSession, O as localFileStamp, S as sessionsRoot, T as summarize, _ as namingTitleFor, a as pruneMissingBindings, b as resolveSessionByTitle, c as setBindingStore, d as clearActiveSessionInfo, f as createSession, g as listSessions, h as getActiveSessionInfo, i as listBoundSessionIds, k as localHuman, l as DEFAULT_SESSION_SCOPE, m as findSession, n as PLUGIN_SOURCE, o as readLastBound, p as extractSessionMdPathFromText, r as appendBound, s as resolveSessionTrajectoryLabel, t as ACC_MESSAGE_KIND, u as TRAJECTORY_ACTIONS, v as parseSessionContextFromEvents, w as showSession, x as sessionEvents$1, y as readActiveSessionMd } from "./message-source-BExngUPX.js";
+import { a as readWeixinCredential, c as weixinInboundDir, d as LOCALSTORE_SCOPES, f as checkLocalstoreGitCompliance, g as runLocalStore, h as readStore, i as matchWeixinRoute, l as weixinSessionIdFor, m as readGitTrack, n as extractWeixinText, o as readWeixinSettings, p as localstorePath, r as hasVoiceItem, s as sanitizeFileName$1, t as extractWeixinMedia } from "./weixin-route-BNyH5ghC.js";
 import { a as unregisterSkiffSession$1, i as skiffSessionSnapshot$1, n as skiffRoleFor$1, o as ACC_VERSION, r as skiffSessionInfo$1, t as registerSkiffSession$1 } from "./skiff-registry-BjIX_KD1.js";
-import { a as readSkiffRoles, c as roleMsmWhitelist, d as systemPromptSource, f as trajectorySubset, i as isSkiffSessionId, l as roleToolWhitelist, n as buildSkiffBasePrompt, o as resolveRoleSystemPrompt, r as createRolePromptReader, s as resolveSkiffKind } from "./skiff-role-DQZ6eR51.js";
+import { a as readSkiffRoles, c as roleMsmWhitelist, d as systemPromptSource, f as trajectorySubset, i as isSkiffSessionId, l as roleToolWhitelist, n as buildSkiffBasePrompt, o as resolveRoleSystemPrompt, r as createRolePromptReader, s as resolveSkiffKind } from "./skiff-role-BSg6Qu9k.js";
 import { a as ACP_HTTP_PORT, c as MAIN_WEB_PORT, d as WEIXIN_SEND_PORT, l as MECHANISM_PORTS, n as readSimpleSettings, o as FACE_PORTS, r as registerSettingsSection, s as GATEWAY_PORT, u as SKIFF_DEBUG_PORT } from "./settings-section-xHABl8nk.js";
 import { a as markdownToPlainText, c as sendTyping, i as getUpdates, l as sniffImageExt, n as downloadMedia, o as sendFileMessage, r as getConfig, s as sendTextMessage, t as TypingStatus } from "./weixin-api-BrRcPiQs.js";
 import { createRequire } from "node:module";
@@ -1091,6 +1091,7 @@ Directory of ACC capabilities — each area lists where to go for details (guide
   ⑦ 注册表与安全      → mech-registry.json 由 container_admin msm register/deregister 管理（写保护——不可直接编辑）
                          dashboard health 输出 registry 完整性检查；损坏恢复指引见 health registry.issues
                          CCC 级开关：exclusiveTools（声明专属工具）/ safeMode.blacklist（写路径黑名单）
+                         / safeMode.hiddenTools（**安全模式开启期间**额外隐藏的工具，v1.51.4）
                          CCC 级 skill 供给：trajectory.skills（v1.44.0——**本 CCC 每条轨迹都带**，含 skiff 会话；与轨迹自己的 frontmatter 声明取并集）
 
 每区：一句话定位 + 详细入口（工具名 / guide 子命令）。详情永远以对应工具的 guide/ccc-config 为单一真相源。
@@ -1205,11 +1206,21 @@ deny 时写入自动确保 .gitignore 含该文件（物理保证），container
   Config:
     { "hooks": { "autoRestoreSession": false } }
 
-── 5. safeMode / blacklist ──
+── 5. safeMode（黑名单 ＋ 开启期间隐藏的工具）──
 safe-mode 由 WebUI 开关控制（写 .serenity-safe-on 标记）；黑名单路径受 guards seam 拦截。
 
+  ▸ blacklist：写路径黑名单（同下 Config）。
+  ▸ hiddenTools（v1.51.4，owner 2026-10-09 令）：**仅在安全模式开启期间**额外从模型工具
+    清单隐藏的工具（ACC 基础表恒隐 bash）。打开 safe-mode 生效、**关掉即全部恢复**；
+    改本键**热生效**（下一个 pre-step 重算，无需重启）。声明在 CCC（D23）——ACC 代码里
+    不出现任何具体工具名。
+    ⚠️ 写一个**本 CCC 未注册**的名字会让**整次 restrict 失败**（DSH 契约逐字："unknown
+    names … fail"）⇒ 此时**退化为只隐藏基础表**并在日志响亮报错（绝不因一个错名丢掉
+    safe-mode 的核心隐藏）。诊断：\`AGENT_SESSIONS/.restrict-diag.json\` 的 \`denyByKey\`。
+    ⚠️ 隐藏 = **从 schema 移除**（agent 根本看不到该工具）⇒ 别把 skill/文档还在教的工具写进来。
+
   Config:
-    { "safeMode": { "blacklist": [".secrets/"] } }
+    { "safeMode": { "blacklist": [".secrets/"], "hiddenTools": ["workflow", "job_kill"] } }
 
 ── 6. skiff.roles（F4 认知子集角色）──
 Skiff 角色 = 全知全能 trajectory 的任意子集（CCC 定义）。每角色独立模型 + 双白名单
@@ -8713,21 +8724,25 @@ function decideGuard(input) {
 function resolveAgentCwd(exec) {
 	return exec.agent?.session?.header?.cwd ?? process.cwd();
 }
-/** 安全模式开启时从模型工具列表隐藏的工具（只隐藏 bash；write/edit 保留） */
+/**
+* 安全模式开启时从模型工具列表隐藏的工具 —— **基础表**（只隐藏 bash；write/edit 保留）。
+* 它**恒隐**、与 CCC 配置无关；CCC 声明的 `safeMode.hiddenTools` 是**附加**项（见下）。
+*/
 const SAFE_MODE_DENY_TOOLS = ["bash"];
-/** agent key → restrict disposer（安全模式工具隐藏状态） */
 const safeModeRestrictions = /* @__PURE__ */ new Map();
 const restrictDiag = {
 	lastKey: null,
 	lastAttemptAt: null,
 	lastSuccess: null,
 	lastError: null,
-	activeKeys: []
+	activeKeys: [],
+	denyByKey: {}
 };
 function getRestrictDiagnostics() {
 	return {
 		...restrictDiag,
-		activeKeys: [...safeModeRestrictions.keys()]
+		activeKeys: [...safeModeRestrictions.keys()],
+		denyByKey: Object.fromEntries([...safeModeRestrictions].map(([k, v]) => [k, v.deny]))
 	};
 }
 /** 诊断落盘：AGENT_SESSIONS/.restrict-diag.json（文件通道，避免 HTTP 自锁） */
@@ -8742,35 +8757,85 @@ function writeRestrictDiag(root) {
 	} catch {}
 }
 /**
-* 同步安全模式工具隐藏：标记存在 → agent.ctx.tools.restrict deny 隐藏写工具；
-* 标记消失 → 解除。pre-step 每步调用 → 切换实时生效。
+* 同步安全模式工具隐藏：标记存在 → `agent.ctx.tools.restrict deny` 隐藏
+* **基础表（bash）∪ CCC 声明的 `safeMode.hiddenTools`**；标记消失 → 全部解除。
+* pre-step 每步调用 ⇒ 开／关／**改声明**三种变化都实时生效（v1.51.4 起含"改声明"）。
+*
+* 与 `readSafeModeHiddenTools` 的分工（R↓）：本函数负责**形状与失败退化**，reader 只管取值。
+* 🔴 退化规则：DSH 契约规定 **未注册的工具名会让整次 restrict 失败**（"unknown names … fail"）
+* ⇒ 绝不能让 CCC 写错一个名字就丢掉 safe-mode 的核心隐藏（bash）。失败时退化为**只隐藏基础表**，
+* 并在日志响亮报错；退化态**按期望签名记账**，不会每步重试刷屏。
 */
 function syncSafeModeRestriction(agent, root) {
 	const key = agent.session.id ?? "global";
 	const on = isSafeModeOn(root);
 	const existing = safeModeRestrictions.get(key);
-	if (on && !existing) try {
-		const dispose = agent.ctx.tools.restrict({ deny: [...SAFE_MODE_DENY_TOOLS] });
-		safeModeRestrictions.set(key, dispose);
-		restrictDiag.lastKey = key;
-		restrictDiag.lastAttemptAt = isoLocal();
-		restrictDiag.lastSuccess = true;
-		restrictDiag.lastError = null;
+	if (!on) {
+		if (existing !== void 0) {
+			try {
+				existing.dispose();
+			} catch (e) {
+				console.error(`[serenity-hooks] restrict 解除失败 (key=${key}):`, e.message);
+			}
+			safeModeRestrictions.delete(key);
+		}
+		writeRestrictDiag(root);
+		return;
+	}
+	let declared = [];
+	try {
+		declared = readSafeModeHiddenTools(root);
+	} catch (e) {
+		console.error(`[serenity-hooks] safeMode.hiddenTools 判据读取失败 (key=${key}):`, e.message);
+	}
+	const deny = [.../* @__PURE__ */ new Set([...SAFE_MODE_DENY_TOOLS, ...declared])];
+	const signature = deny.join(",");
+	if (existing !== void 0 && existing.signature === signature) {
+		writeRestrictDiag(root);
+		return;
+	}
+	if (existing !== void 0) {
+		try {
+			existing.dispose();
+		} catch (e) {
+			console.error(`[serenity-hooks] restrict 重算前解除失败 (key=${key}):`, e.message);
+		}
+		safeModeRestrictions.delete(key);
+	}
+	let applied = deny;
+	let dispose;
+	try {
+		dispose = agent.ctx.tools.restrict({ deny: [...deny] });
 	} catch (e) {
 		restrictDiag.lastKey = key;
 		restrictDiag.lastAttemptAt = isoLocal();
 		restrictDiag.lastSuccess = false;
 		restrictDiag.lastError = e.message;
-		console.error(`[serenity-hooks] restrict 失败 (key=${key}):`, e.message);
-	}
-	else if (!on && existing) {
+		console.error(`[serenity-hooks] restrict 失败，已退化为基础表（多为 safeMode.hiddenTools 里有本 CCC **未注册**的工具名）(key=${key}):`, e.message);
+		applied = [...SAFE_MODE_DENY_TOOLS];
 		try {
-			existing();
-		} catch (e) {
-			console.error(`[serenity-hooks] restrict 解除失败 (key=${key}):`, e.message);
+			dispose = agent.ctx.tools.restrict({ deny: applied });
+		} catch (e2) {
+			restrictDiag.lastError = `${e.message} ／ 退化亦失败: ${e2.message}`;
+			console.error(`[serenity-hooks] restrict 退化失败（守卫仍兜底拦截）(key=${key}):`, e2.message);
+			safeModeRestrictions.set(key, {
+				signature,
+				deny: [],
+				dispose: () => {}
+			});
+			writeRestrictDiag(root);
+			return;
 		}
-		safeModeRestrictions.delete(key);
 	}
+	restrictDiag.lastKey = key;
+	restrictDiag.lastAttemptAt = isoLocal();
+	restrictDiag.lastSuccess = true;
+	restrictDiag.lastError = null;
+	safeModeRestrictions.set(key, {
+		signature,
+		deny: applied,
+		dispose
+	});
 	writeRestrictDiag(root);
 }
 /** 条件可见的 IM 工具名（与 tools/im-bridge.ts 的注册名一致） */
@@ -10393,11 +10458,11 @@ function registerStatusApi(ctx, opts = {}) {
 						sendJson$4(res, 400, { error: chk.error });
 						return;
 					}
-					const { readWeixinSettings } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+					const { readWeixinSettings } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 					const { weixinBridgeStatus } = await Promise.resolve().then(() => weixin_bridge_exports);
 					const settings = readWeixinSettings(chk.root);
 					const bridge = weixinBridgeStatus().find((b) => b.ccc === chk.root);
-					const { readWeixinCredential } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+					const { readWeixinCredential } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 					const accounts = (settings.accounts ?? []).map((a) => ({
 						accountId: a.accountId,
 						name: a.name ?? void 0,
@@ -10429,7 +10494,7 @@ function registerStatusApi(ctx, opts = {}) {
 					const { fetchQRCode } = await import("./weixin-api-BrRcPiQs.js").then((n) => n.u);
 					const { randomUUID } = await import("node:crypto");
 					for (const [key, v] of weixinLogins) if (Date.now() - v.startedAt > WEIXIN_LOGIN_TTL_MS) weixinLogins.delete(key);
-					const { readWeixinSettings } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+					const { readWeixinSettings } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 					const qr = await fetchQRCode({ botType: readWeixinSettings(root).botType ?? void 0 });
 					const loginKey = randomUUID();
 					weixinLogins.set(loginKey, {
@@ -10450,7 +10515,7 @@ function registerStatusApi(ctx, opts = {}) {
 						sendJson$4(res, 400, { error: "missing accountId" });
 						return;
 					}
-					const { removeWeixinAccount } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+					const { removeWeixinAccount } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 					const { syncCccBridge } = await Promise.resolve().then(() => weixin_bridge_exports);
 					removeWeixinAccount(root, body.accountId);
 					syncCccBridge(ctx, root);
@@ -10463,8 +10528,8 @@ function registerStatusApi(ctx, opts = {}) {
 						sendJson$4(res, 400, { error: "invalid routes (expected [{user, role}, ...])" });
 						return;
 					}
-					const { saveWeixinRoutes } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
-					const { readSkiffRoles } = await import("./skiff-role-DQZ6eR51.js").then((n) => n.u);
+					const { saveWeixinRoutes } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
+					const { readSkiffRoles } = await import("./skiff-role-BSg6Qu9k.js").then((n) => n.u);
 					const roles = readSkiffRoles(root);
 					for (const r of routes) if (!roles.has(r.role)) {
 						sendJson$4(res, 400, { error: `unknown role: ${r.role} (not in ${root} skiff.roles)` });
@@ -10476,7 +10541,7 @@ function registerStatusApi(ctx, opts = {}) {
 				}
 				if (body.action === "set-enabled") {
 					const enabled = body.enabled === true;
-					const { readWeixinSettings, setWeixinEnabled } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+					const { readWeixinSettings, setWeixinEnabled } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 					const { syncCccBridge } = await Promise.resolve().then(() => weixin_bridge_exports);
 					const settings = readWeixinSettings(root);
 					if (enabled && (settings.accounts ?? []).length === 0) {
@@ -10520,7 +10585,7 @@ function registerStatusApi(ctx, opts = {}) {
 					return;
 				}
 				const { pollQRStatus } = await import("./weixin-api-BrRcPiQs.js").then((n) => n.u);
-				const { readWeixinSettings } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+				const { readWeixinSettings } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 				const settings = readWeixinSettings(login.root);
 				const status = await pollQRStatus({
 					baseUrl: void 0,
@@ -10535,7 +10600,7 @@ function registerStatusApi(ctx, opts = {}) {
 							});
 							return;
 						}
-						const { upsertWeixinAccount, writeWeixinCredential, nextWeixinAccountId } = await import("./weixin-route-7BtOiy4X.js").then((n) => n.u);
+						const { upsertWeixinAccount, writeWeixinCredential, nextWeixinAccountId } = await import("./weixin-route-BNyH5ghC.js").then((n) => n.u);
 						const { syncCccBridge } = await Promise.resolve().then(() => weixin_bridge_exports);
 						const accountId = nextWeixinAccountId(settings);
 						upsertWeixinAccount(login.root, {
@@ -16688,7 +16753,7 @@ function manualOutputFallbackNeeded(input) {
 */
 async function resolveCccRootByAlias(ctx, alias) {
 	try {
-		const { listCccs } = await import("./ccc-roots-DtiMVRPo.js").then((n) => n.a);
+		const { listCccs } = await import("./ccc-roots-Bo0HKLlM.js").then((n) => n.a);
 		const entries = await listCccs(ctx);
 		const byName = entries.find((e) => e.name === alias);
 		if (byName) return byName.root;
@@ -17187,7 +17252,7 @@ function syncHumanChannel(ctx) {
 	(async () => {
 		try {
 			stopMachineLoops();
-			const { listCccs } = await import("./ccc-roots-DtiMVRPo.js").then((n) => n.a);
+			const { listCccs } = await import("./ccc-roots-Bo0HKLlM.js").then((n) => n.a);
 			for (const entry of await listCccs(ctx)) syncCccBridge(ctx, entry.root);
 		} catch {}
 	})();
@@ -17423,7 +17488,7 @@ function matchCcc(input, candidates) {
 }
 /** 组装候选列表（`ccc-roots.listCccs` 投影 + `.serenity` 名；动态 import 保持本模块静态依赖轻量） */
 async function collectCandidates(ctx) {
-	const { listCccs } = await import("./ccc-roots-DtiMVRPo.js").then((n) => n.a);
+	const { listCccs } = await import("./ccc-roots-Bo0HKLlM.js").then((n) => n.a);
 	const entries = await listCccs(ctx, { defaultRoot: process.cwd() });
 	const seen = /* @__PURE__ */ new Set();
 	const out = [];

package/lib/{message-source-LnJwIqLm.js → message-source-BExngUPX.js}

@@ -1,4 +1,4 @@
-import { r as cccRootForCwd } from "./ccc-roots-DtiMVRPo.js";
+import { r as cccRootForCwd } from "./ccc-roots-Bo0HKLlM.js";
 import { basename, dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
 //#region src/time.ts

package/lib/seams/guards.d.ts

@@ -39,11 +39,19 @@ interface RestrictDiagnostics {
     lastSuccess: boolean | null;
     lastError: string | null;
     activeKeys: string[];
+    /** v1.51.4：每个 key **实际生效**的 deny 清单（排查"某工具为什么／为什么没被隐藏"） */
+    denyByKey: Record<string, string[]>;
 }
 export declare function getRestrictDiagnostics(): RestrictDiagnostics;
 /**
- * 同步安全模式工具隐藏：标记存在 → agent.ctx.tools.restrict deny 隐藏写工具；
- * 标记消失 → 解除。pre-step 每步调用 → 切换实时生效。
+ * 同步安全模式工具隐藏：标记存在 → `agent.ctx.tools.restrict deny` 隐藏
+ * **基础表（bash）∪ CCC 声明的 `safeMode.hiddenTools`**；标记消失 → 全部解除。
+ * pre-step 每步调用 ⇒ 开／关／**改声明**三种变化都实时生效（v1.51.4 起含"改声明"）。
+ *
+ * 与 `readSafeModeHiddenTools` 的分工（R↓）：本函数负责**形状与失败退化**，reader 只管取值。
+ * 🔴 退化规则：DSH 契约规定 **未注册的工具名会让整次 restrict 失败**（"unknown names … fail"）
+ * ⇒ 绝不能让 CCC 写错一个名字就丢掉 safe-mode 的核心隐藏（bash）。失败时退化为**只隐藏基础表**，
+ * 并在日志响亮报错；退化态**按期望签名记账**，不会每步重试刷屏。
  */
 export declare function syncSafeModeRestriction(agent: Agent, root: string): void;
 /** im-bridge 隐藏诊断（排查"工具为什么不在清单里"） */

package/lib/{skiff-role-DQZ6eR51.js → skiff-role-BSg6Qu9k.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { g as resolveInside, h as readUtf8, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS } from "./ccc-DG4Oc7I1.js";
+import { _ as resolveInside, g as readUtf8, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS } from "./ccc-DXky9UZu.js";
 import { existsSync, statSync } from "node:fs";
 //#region src/skiff-role.ts
 /**

package/lib/status.d.ts

@@ -56,6 +56,8 @@ interface SerenityStatus {
         lastSuccess: boolean | null;
         lastError: string | null;
         activeKeys: string[];
+        /** v1.51.4：每个 key **实际生效**的 deny 清单（含 safeMode.hiddenTools 的并集） */
+        denyByKey: Record<string, string[]>;
     };
 }
 export declare function getStatus(cwd: string, configPaths?: string[]): SerenityStatus;

package/lib/{weixin-route-7BtOiy4X.js → weixin-route-BNyH5ghC.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS } from "./ccc-DG4Oc7I1.js";
+import { s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS } from "./ccc-DXky9UZu.js";
 import { join, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.51.3",
+  "version": "1.51.4",
   "description": "宁静号 ACC harness（Native Cordis 插件）——给 DeepSeek Harness 装一个「AI 工作区」：12 个工具（container_fs/container_trajectory/dashboard/container_git/msm/praxis/handyman/localstore/container_admin/im-bridge/acc-diag/diagram）+ 机械约束（安全模式/工作区围墙/密钥守卫/对外输出守卫）+ 工作日志与原地重建 + 网页登录入口/微信桥/子角色/对外问答页/trajectory 唤醒注册表。适配 DSH 0.1.7-rc.1。",
   "license": "MIT",
   "repository": {