@xiaoso/dsh-tool-plus 0.1.0-beta.7 → 0.1.1

package/README.en.md

@@ -2,13 +2,17 @@
 
 [简体中文](./README.md) | English
 
-Essential tools enhancement for DeepSeek Harness: persistent bash, structured read, multi-mode edit, atomic write, full-text search, and direct image reading — one plugin covers it all. Ported from the [Oh My Pi](https://github.com/can1357/oh-my-pi) core; once installed it automatically takes over the official bash / pwsh / file / search tools, with optional `ast_grep` / `ast_edit` structural search and rewrite.
+[![npm version](https://img.shields.io/npm/v/@xiaoso/dsh-tool-plus?logo=npm)](https://www.npmjs.com/package/@xiaoso/dsh-tool-plus)
+[![License: MIT](https://img.shields.io/github/license/xiaoso456/dsh-tool-plus)](LICENSE)
+[![Node](https://img.shields.io/badge/node-%3E%3D22.19%20%7C%20%3E%3D24-339933?logo=nodedotjs)](https://nodejs.org)
+[![Platform](https://img.shields.io/badge/platform-windows%20%7C%20macos%20%7C%20linux-lightgrey)]()
 
-> Currently in early beta — behavior and configuration may change at any time.
+Essential tools enhancement for DeepSeek Harness: persistent bash, structured read, multi-mode edit, atomic write, full-text search, and direct image reading — one plugin covers it all. Ported from the [Oh My Pi](https://github.com/can1357/oh-my-pi) core; once installed it automatically takes over the official bash / pwsh / file / search tools, with optional `ast_grep` / `ast_edit` structural search and rewrite.
 
 ## Features
 
 - **bash**: persistent shell; `cd` and `export` keep state across calls; verbose logs (git/npm/cargo…) are condensed automatically; overlong output keeps only head and tail, with the full content written to disk for later retrieval; long-running commands are moved to the background automatically; optionally intercepts `cat`, `grep`, `find`, and `sed -i` to steer you toward the dedicated tools
+- **Safe delete**: `rm` moves files to the system trash by default instead of deleting permanently, so accidental deletes are recoverable; use `command rm` for a real delete
 - **read**: precise line-range reading (supports `:N-M`, `:raw`, and multiple ranges); large code files return a structural summary by default, with details expanded on demand; zip/tar archives, SQLite, notebooks, and PDFs read directly; PNG / JPEG / WebP / GIF images read directly, oversized ones scaled down automatically; can fetch web content (including images embedded in the page); SPA sites (content rendered dynamically by JS, e.g. excalidraw.com) are automatically fetched via local browser rendering
 - **write**: atomic writes that return a diff of the changes; supports patch-style writing, and can write directly into zip/tar archive members and SQLite data
 - **edit**: `replace` by default, with patch / hashline / apply-patch formats also supported; multi-hunk edits, uniqueness validation, fuzzy matching tolerant of whitespace differences
@@ -30,12 +34,12 @@ Install **both** the plugin and the presets:
 ### Install from npm (recommended)
 
 ```sh
-dsh plugin --profile web add @xiaoso/dsh-tool-plus@beta
+dsh plugin --profile web add @xiaoso/dsh-tool-plus
 ```
 
 ### Install from GitHub
 
-Track the latest development build (the project has no formal release yet — every install is a test build):
+Track the latest development build:
 
 ```sh
 dsh plugin --profile web add github:xiaoso456/dsh-tool-plus
@@ -52,7 +56,7 @@ dsh plugin --profile web add link:<path to this repo>
 **Option 1 · Install with the npx script**
 
 ```sh
-npx @xiaoso/dsh-tool-plus-presets@beta
+npx @xiaoso/dsh-tool-plus-presets
 ```
 
 **Option 2 · Have an AI session configure the presets** (no dependency on the package above) — paste the following into an AI session that can edit files on your machine:

package/README.md

@@ -2,13 +2,17 @@
 
 简体中文 | [English](./README.en.md)
 
-DeepSeek Harness 基础工具增强：持久 bash、结构化 read、多模式 edit、原子 write、全文搜索、图像直读，一个插件全覆盖。基于 [Oh My Pi](https://github.com/can1357/oh-my-pi) 内核移植，安装后自动接管官方 bash / pwsh / 文件 / 搜索工具，另有可选的 `ast_grep` / `ast_edit` 结构化搜索与重写。
+[![npm version](https://img.shields.io/npm/v/@xiaoso/dsh-tool-plus?logo=npm)](https://www.npmjs.com/package/@xiaoso/dsh-tool-plus)
+[![License: MIT](https://img.shields.io/github/license/xiaoso456/dsh-tool-plus)](LICENSE)
+[![Node](https://img.shields.io/badge/node-%3E%3D22.19%20%7C%20%3E%3D24-339933?logo=nodedotjs)](https://nodejs.org)
+[![Platform](https://img.shields.io/badge/platform-windows%20%7C%20macos%20%7C%20linux-lightgrey)]()
 
-> 当前为早期测试版（beta），行为与配置可能随时调整。
+DeepSeek Harness 基础工具增强：持久 bash、结构化 read、多模式 edit、原子 write、全文搜索、图像直读，一个插件全覆盖。基于 [Oh My Pi](https://github.com/can1357/oh-my-pi) 内核移植，安装后自动接管官方 bash / pwsh / 文件 / 搜索工具，另有可选的 `ast_grep` / `ast_edit` 结构化搜索与重写。
 
 ## 功能特性
 
 - **bash**：持久 shell，`cd`、`export` 跨调用保持状态；冗长日志（git/npm/cargo…）自动压缩；超长输出只保留头尾，完整内容落盘可回读；长命令自动转后台；可选拦截 `cat`、`grep`、`find`、`sed -i`，引导改用专用工具
+- **安全删除**：`rm` 默认把文件移入系统回收站而非永久删除，误删可恢复；需要真删时用 `command rm`
 - **read**：按行区间精准读取（支持 `:N-M`、`:raw`、多区间）；大代码文件默认返回结构摘要，细节按需展开；zip/tar 归档、SQLite、notebook、PDF 直接读；PNG / JPEG / WebP / GIF 图片直读，超大图自动缩放；可抓取网页内容（含网页内图片）；SPA 站点（内容由 JS 动态渲染，如 excalidraw.com）自动改用本机浏览器渲染后抓取
 - **write**：原子写入，返回修改 diff；支持补丁式写入，可直接写 zip/tar 归档成员与 SQLite 数据
 - **edit**：replace 默认，另支持 patch / hashline / apply-patch 三种补丁格式；多段编辑、唯一性校验、空白差异模糊匹配
@@ -30,12 +34,12 @@ DeepSeek Harness 基础工具增强：持久 bash、结构化 read、多模式 e
 ### 从 npm 安装（推荐）
 
 ```sh
-dsh plugin --profile web add @xiaoso/dsh-tool-plus@beta
+dsh plugin --profile web add @xiaoso/dsh-tool-plus
 ```
 
 ### 从 GitHub 安装
 
-跟踪最新开发版（本项目现阶段没有正式发布，一切安装均为测试构建）：
+跟踪最新开发版：
 
 ```sh
 dsh plugin --profile web add github:xiaoso456/dsh-tool-plus
@@ -52,7 +56,7 @@ dsh plugin --profile web add link:<本仓库路径>
 **方法一 · 使用 npx 脚本安装**
 
 ```sh
-npx @xiaoso/dsh-tool-plus-presets@beta
+npx @xiaoso/dsh-tool-plus-presets
 ```
 
 **方法二 · 使用大模型配置预设**（不依赖上面的包）——把下面这段发给一个能改你电脑上文件的 AI 会话：

package/lib/client.js

@@ -75,6 +75,15 @@ window.__ModuleLoader__.load({
 				group: "behavior",
 				tool: "bash"
 			},
+			{
+				name: "rmSafe",
+				kind: "boolean",
+				default: true,
+				labelKey: "rmSafe",
+				hintKey: "rmSafeHint",
+				group: "behavior",
+				tool: "bash"
+			},
 			{
 				name: "useShellCommandWrapper",
 				kind: "boolean",
@@ -745,7 +754,6 @@ window.__ModuleLoader__.load({
 		const SETTINGS_ROWS_CSS = `
 .tp-row{display:flex;align-items:center;gap:12px;padding:12px 0;border-bottom:1px solid var(--dsw-alias-border-l1);transition:background .16s ease}
 .tp-row:last-child{border-bottom:none}
-.tp-rowClickable{cursor:pointer}
 .tp-rowText{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px;padding-right:24px}
 .tp-rowTitle{font-size:14px;font-weight:400;line-height:22px;color:var(--dsw-alias-label-primary)}
 .tp-rowDesc{font-size:12px;font-weight:400;line-height:18px;color:var(--dsw-alias-label-tertiary)}
@@ -824,18 +832,16 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* Number row: same left-text / right-control anatomy as toggle and select
-		* rows, with the input right-aligned at a fixed width. The label is wired to
-		* the input (htmlFor) and clicking anywhere on the row focuses the input.
+		* rows, with the input right-aligned at a fixed width. The title is wired to
+		* the input (htmlFor), so clicking the title focuses the input; the
+		* description and the rest of the row are inert — each side manages its own
+		* interaction.
 		*/
 		function NumberRow(props) {
 			const { t, control, disabled, onEdit, onReset } = props;
 			const inputId = (0, react.useId)();
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "tp-row" + (disabled ? "" : " tp-rowClickable"),
-				onClick: (event) => {
-					if (event.target.closest("input,button,select,textarea,a")) return;
-					event.currentTarget.querySelector(".tp-input")?.focus();
-				},
+				className: "tp-row",
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "tp-rowText",
@@ -883,11 +889,7 @@ window.__ModuleLoader__.load({
 			}));
 			const close = () => onOpenChange(null);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "tp-row" + (disabled ? "" : " tp-rowClickable"),
-				onClick: (event) => {
-					if (event.target.closest("input,button,select,textarea,a")) return;
-					event.currentTarget.querySelector(".tp-selectTrigger")?.click();
-				},
+				className: "tp-row",
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "tp-rowText",
@@ -941,11 +943,7 @@ window.__ModuleLoader__.load({
 		function ToggleRow(props) {
 			const { t, control, disabled, onToggle, onReset } = props;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "tp-row" + (disabled ? "" : " tp-rowClickable"),
-				onClick: (event) => {
-					if (event.target.closest("input,button,select,textarea,a")) return;
-					event.currentTarget.querySelector(".tp-switch input")?.click();
-				},
+				className: "tp-row",
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "tp-rowText",
@@ -1641,6 +1639,8 @@ window.__ModuleLoader__.load({
 		*/
 		/** Logical RPC channel registered by the host half of this plugin. */
 		const TOOL_PLUS_RPC_CHANNEL = "/tool-plus";
+		/** Endpoint that reports the rmSafe injection status (query = ensure + verify). */
+		const RM_SAFE_STATUS_ENDPOINT = "rmSafe/status";
 		//#endregion
 		//#region src/client/web-connection-rpc.ts
 		/**
@@ -2029,6 +2029,27 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/rm-safe-status-text.ts
+		/** Locale key of one rmSafe failure reason. */
+		function rmSafeReasonKey(reason) {
+			switch (reason) {
+				case "snapshot-unavailable": return "rmSafeReasonSnapshotUnavailable";
+				case "cli-missing": return "rmSafeReasonCliMissing";
+				case "script-write-failed": return "rmSafeReasonScriptWriteFailed";
+				case "snapshot-write-failed": return "rmSafeReasonSnapshotWriteFailed";
+				case "runtime-not-effective": return "rmSafeReasonRuntimeNotEffective";
+			}
+		}
+		/**
+		* Localized text of one rmSafe/status result. `disabled` maps to the empty
+		* string — the caller decides not to surface it.
+		*/
+		function rmSafeStatusText(t, value) {
+			if (value.status === "failed") return t("rmSafeStatusFailed").replace("{reason}", t(rmSafeReasonKey(value.reason)));
+			if (value.status === "disabled") return "";
+			return value.runtime === "function" ? t("rmSafeStatusInjected") : t("rmSafeStatusInjectedUnverified");
+		}
+		//#endregion
 		//#region src/client/ToolPlusSection.tsx
 		/**
 		* Tool Plus settings section — the plugin's own page in the Settings panel,
@@ -2272,6 +2293,27 @@ window.__ModuleLoader__.load({
 			const [openSelect, setOpenSelect] = (0, react.useState)(null);
 			const [actionState, setActionState] = (0, react.useState)({});
 			const [actionResults, setActionResults] = (0, react.useState)({});
+			const [rmSafeToast, setRmSafeToast] = (0, react.useState)(null);
+			const handleSave = (0, react.useCallback)(async () => {
+				const before = Boolean(scope.getSnapshot().value?.rmSafe ?? true);
+				await form.actions.save();
+				const after = Boolean(scope.getSnapshot().value?.rmSafe ?? true);
+				if (before === after || !after) return;
+				try {
+					const result = await createWebConnectionRpc().call(TOOL_PLUS_RPC_CHANNEL, RM_SAFE_STATUS_ENDPOINT, {});
+					if (!result.ok) return;
+					const value = result.value;
+					if (value.status === "disabled") return;
+					setRmSafeToast({
+						text: rmSafeStatusText(t, value),
+						ok: value.status === "injected"
+					});
+				} catch {}
+			}, [
+				scope,
+				form,
+				t
+			]);
 			const runAction = (0, react.useCallback)((field) => {
 				const actionKey = field.actionKey;
 				if (!actionKey) return;
@@ -2520,10 +2562,17 @@ window.__ModuleLoader__.load({
 								type: "button",
 								className: "tps-save",
 								disabled: blocked,
-								onClick: () => void form.actions.save(),
+								onClick: () => void handleSave(),
 								children: form.shell.saving ? t("saving") : t("save")
 							})
 						]
+					}),
+					rmSafeToast !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Toast, {
+						text: rmSafeToast.text,
+						icon: rmSafeToast.ok ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutline16, {}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconWarningOutline16, {}),
+						onDone: () => {
+							setRmSafeToast(null);
+						}
 					})
 				]
 			});
@@ -2663,6 +2712,16 @@ window.__ModuleLoader__.load({
 			nonInteractiveEnvHint: "对非交互使用加固环境：关闭分页器与彩色输出，不弹交互提示。",
 			snapshotEnabled: "Shell 快照",
 			snapshotEnabledHint: "把用户的 rc 文件（别名、函数、选项）快照进会话 shell。",
+			rmSafe: "安全 rm",
+			rmSafeHint: "在会话 shell 里重定义 rm：删除的文件移入系统回收站而非永久删除；command rm 仍走真删除。",
+			rmSafeStatusInjected: "安全 rm 已注入并验证：rm 进入回收站",
+			rmSafeStatusInjectedUnverified: "安全 rm 已注入（运行时验证不可用）",
+			rmSafeStatusFailed: "安全 rm 注入失败：{reason}，rm 将永久删除",
+			rmSafeReasonSnapshotUnavailable: "快照不可用",
+			rmSafeReasonCliMissing: "trash-cli 产物缺失",
+			rmSafeReasonScriptWriteFailed: "脚本写入失败",
+			rmSafeReasonSnapshotWriteFailed: "快照不可写",
+			rmSafeReasonRuntimeNotEffective: "运行时未生效",
 			useShellCommandWrapper: "用 bash -c 包裹命令",
 			useShellCommandWrapperHint: "把每条命令用 bash -c 包裹，以获得完整的 bash 环境。",
 			outputTruncateStrategy: "截断按",
@@ -2834,6 +2893,16 @@ window.__ModuleLoader__.load({
 			nonInteractiveEnvHint: "Harden the environment for non-interactive use: no pagers, no prompts, no color.",
 			snapshotEnabled: "Shell snapshot",
 			snapshotEnabledHint: "Capture the user's rc file (aliases, functions, options) into the session shell.",
+			rmSafe: "Safe rm",
+			rmSafeHint: "Redefine rm in the session shell: deleted files move to the system trash instead of being permanently removed; `command rm` still deletes for real.",
+			rmSafeStatusInjected: "Safe rm injected and verified: rm moves to trash",
+			rmSafeStatusInjectedUnverified: "Safe rm injected (runtime verification unavailable)",
+			rmSafeStatusFailed: "Safe rm injection failed: {reason}, rm deletes permanently",
+			rmSafeReasonSnapshotUnavailable: "snapshot unavailable",
+			rmSafeReasonCliMissing: "trash-cli binary missing",
+			rmSafeReasonScriptWriteFailed: "script write failed",
+			rmSafeReasonSnapshotWriteFailed: "snapshot not writable",
+			rmSafeReasonRuntimeNotEffective: "not effective at runtime",
 			useShellCommandWrapper: "Wrap commands in bash -c",
 			useShellCommandWrapperHint: "Wrap every command in bash -c for a full bash environment.",
 			outputTruncateStrategy: "Truncate by",

package/lib/index.mjs

@@ -3,7 +3,7 @@ __installBunShim();
 import { n as fs_promises_shim_exports, t as exists } from "./fs-promises-shim-Bx0fpxuk.mjs";
 import { i as setRuntimeLogger, n as systemChromiumCandidatesForTest, r as runtimeLogger } from "./launch-DwpE70Pv.mjs";
 import { $ as peekFile, A as formatAge, C as error, F as $envpos, I as $flag, M as formatCount, P as $env, Q as isProbablyBinary, S as debug, T as warn, U as getAutoQaDbPath, V as VERSION, X as getRemoteDir, Y as getPuppeteerDir, b as isEnotdir, c as combineSignals, d as $which, j as formatBytes$1, k as installBunShim, l as exec, p as readImageMetadata, q as getInstallId, tt as untilAborted, u as render, v as hasFsCode, y as isEnoent } from "./src-D_e1qMwi.mjs";
-import { C as truncateToWidth$1, S as replaceTabs, _ as formatCodeFrameLine, a as fetchBinary, b as LRUCache, c as getParallelExtractContent, d as convertFileWithMarkit, f as Settings, g as capParseErrors, h as OMP_DEFAULTS, i as convertWithMarkit, l as ensureTool, m as settings, o as extractWithParallel, p as isSettingsInitialized, s as findParallelApiKey, u as CONVERTIBLE_EXTENSIONS, v as formatParseErrors, x as padding, y as shortenPath } from "./utils-DSEEKy3G.mjs";
+import { C as truncateToWidth$1, S as replaceTabs, _ as formatCodeFrameLine, a as fetchBinary, b as LRUCache, c as getParallelExtractContent, d as convertFileWithMarkit, f as Settings, g as capParseErrors, h as OMP_DEFAULTS, i as convertWithMarkit, l as ensureTool, m as settings, o as extractWithParallel, p as isSettingsInitialized, s as findParallelApiKey, u as CONVERTIBLE_EXTENSIONS, v as formatParseErrors, x as padding, y as shortenPath } from "./utils-D1p8-H8L.mjs";
 import { t as sanitizeText } from "./sanitize-text-CfcXzw5X.mjs";
 import { n as isRecord$2 } from "./type-guards-B9VVjRDK.mjs";
 import { n as ToolError, r as throwIfAborted, t as ToolAbortError } from "./tool-errors-DoyxivAR.mjs";
@@ -719,7 +719,26 @@ async function getOrCreateSnapshot(shell, env, timeoutMs = SNAPSHOT_TIMEOUT_MS)
 	const cached = cachedSnapshotPaths.get(cacheKey);
 	if (cached && fs.existsSync(cached)) return cached;
 	if (cached) cachedSnapshotPaths.delete(cacheKey);
-	if (process.platform === "win32") return null;
+	if (process.platform === "win32") {
+		const uid = process.getuid?.();
+		const snapshotDir = path.join(os.tmpdir(), uid === void 0 ? "omp-shell-snapshots" : `omp-shell-snapshots-${uid}`);
+		const snapshotPath = path.join(snapshotDir, `snapshot-bash-${crypto.randomUUID()}.sh`);
+		try {
+			fs.mkdirSync(snapshotDir, {
+				recursive: true,
+				mode: 448
+			});
+			fs.writeFileSync(snapshotPath, "# Shell snapshot - generated by omp agent (windows minimal)\n", { mode: 384 });
+			cachedSnapshotPaths.set(cacheKey, snapshotPath);
+			return snapshotPath;
+		} catch (err) {
+			runtimeLogger().debug("shell-snapshot: windows snapshot dir unusable", {
+				dir: snapshotDir,
+				err: String(err)
+			});
+			return null;
+		}
+	}
 	const rcFile = getShellConfigFile(shell, env);
 	const uid = process.getuid?.();
 	const snapshotDir = path.join(os.tmpdir(), uid === void 0 ? "omp-shell-snapshots" : `omp-shell-snapshots-${uid}`);
@@ -788,6 +807,85 @@ function cleanupSnapshots() {
 	cachedSnapshotPaths.clear();
 }
 //#endregion
+//#region src/tools/bash/rm-safe.ts
+/**
+* rmSafe: rm 重定义脚本的生成与快照注入。
+*
+* 生成一个 bash 函数定义脚本（rm → `node <trash-cli.mjs> "$@"`），
+* 通过快照文件（会话 shell 创建时 source 一次）注入：
+* - POSIX：追加到用户环境快照末尾（幂等，带标记行）；
+* - Windows：getOrCreateSnapshot 生成"仅注入"快照文件后同样追加。
+*
+* rmSafe 关闭时调用方不注入，快照保持原样，系统 rm 生效。
+* @module @xiaoso/dsh-tool-plus/bash/rm-safe
+*/
+/** 注入标记行：injectRmSafe 以此判断是否已注入（幂等）。 */
+const RM_SAFE_MARKER = "# dsh-tool-plus rmSafe";
+/** rm-safe 脚本缓存目录（tmpdir 下，跨会话复用）。 */
+function rmSafeScriptDir() {
+	return path.join(os.tmpdir(), "dsh-bash-plus");
+}
+/** trash-cli 构建产物路径（lib/trash-cli.mjs，与主 bundle 同目录）。 */
+function rmSafeCliPath() {
+	return fileURLToPath(new URL("./trash-cli.mjs", import.meta.url));
+}
+/** 单引号转义（bash 单引号内 `'\''` 表示一个字面单引号）。 */
+function quote(s) {
+	return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* 生成 rm 重定义脚本内容：bash 函数 `rm()` 把参数原样转交 trash-cli。
+* 逃生口：`command rm`（bash 的 command 关键字跳过函数/alias 查找）或
+* 绝对路径（/usr/bin/rm）走系统真删除。注意 `\rm` 反斜杠只抑制 alias
+* 展开、不抑制函数查找，对函数重定义无效——不是逃生口。
+*/
+function rmSafeScript(nodePath, cliPath) {
+	return [
+		RM_SAFE_MARKER,
+		"rm() {",
+		`  ${quote(nodePath)} ${quote(cliPath)} "$@"`,
+		"}",
+		""
+	].join("\n");
+}
+/**
+* 确保 rm-safe 脚本存在（内容不变时幂等，不重写文件）。
+* 返回脚本路径；目录/写入失败时返回 null（不抛异常，调用方降级并告警）。
+*/
+function ensureRmSafeScript(dir, nodePath, cliPath) {
+	const target = path.join(dir, "rm-safe.sh");
+	const content = rmSafeScript(nodePath, cliPath);
+	try {
+		if (fs.readFileSync(target, "utf8") === content) return target;
+	} catch {}
+	try {
+		fs.mkdirSync(dir, { recursive: true });
+		fs.writeFileSync(target, content, { mode: 384 });
+		return target;
+	} catch {
+		return null;
+	}
+}
+/**
+* 向快照文件追加 `source <rm-safe.sh>`（幂等：已有标记则跳过）。
+* 返回是否注入成功；快照文件不可读/不可写时返回 false（不抛异常）。
+*/
+function injectRmSafe(snapshotPath, scriptPath) {
+	let content;
+	try {
+		content = fs.readFileSync(snapshotPath, "utf8");
+	} catch {
+		return false;
+	}
+	if (content.includes("# dsh-tool-plus rmSafe")) return true;
+	try {
+		fs.appendFileSync(snapshotPath, `\n${RM_SAFE_MARKER}\nsource ${quote(scriptPath)}\n`);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region node_modules/.pnpm/@oh-my-pi+pi-utils@17.3.5/node_modules/@oh-my-pi/pi-utils/src/path.ts
 const WINDOWS_DRIVE_EXTENDED_PREFIX = /^\\\\[?]\\([A-Za-z]:[\\/].*)$/;
 const WINDOWS_UNC_EXTENDED_PREFIX = /^\\\\[?]\\UNC[\\/]([^\\/]+)[\\/](.+)$/i;
@@ -2325,7 +2423,19 @@ async function executeBash(command, options) {
 	const baseShellConfig = getShellConfig();
 	const { shell, args, env: shellEnv, prefix } = options?.useUserShell === true ? resolveUserShellConfig(baseShellConfig) : baseShellConfig;
 	const bashShell = isBashShell(shell);
-	const snapshotPath = bashShell && options?.snapshotEnabled !== false ? await getOrCreateSnapshot(shell, shellEnv) : null;
+	let snapshotPath = bashShell && options?.snapshotEnabled !== false ? await getOrCreateSnapshot(shell, shellEnv) : null;
+	let rmSafeInjectionFailed = false;
+	if (snapshotPath !== null && options?.rmSafe === true) {
+		const scriptPath = ensureRmSafeScript(rmSafeScriptDir(), process.execPath, rmSafeCliPath());
+		if (scriptPath === null || !injectRmSafe(snapshotPath, scriptPath)) {
+			rmSafeInjectionFailed = true;
+			runtimeLogger().warn("rmSafe: injection failed, rm will delete permanently", {
+				scriptPath: scriptPath ?? null,
+				snapshotPath
+			});
+		}
+	}
+	const injectionFailedMarker = rmSafeInjectionFailed ? { rmSafeInjectionFailed: true } : {};
 	const minimizerSettings = options?.minimizerSettings ?? DEFAULT_MINIMIZER_SETTINGS;
 	const minimizer = options?.minimizerEnabled ?? minimizerSettings.enabled ? buildMinimizerOptions(minimizerSettings) : void 0;
 	const commandCwd = resolveShellCwd(options?.cwd);
@@ -2354,6 +2464,7 @@ async function executeBash(command, options) {
 	if (options?.signal?.aborted) return {
 		exitCode: void 0,
 		cancelled: true,
+		...injectionFailedMarker,
 		...await settle("Command cancelled")
 	};
 	const shellOptions = {
@@ -2432,6 +2543,7 @@ async function executeBash(command, options) {
 			return {
 				exitCode: void 0,
 				cancelled: true,
+				...injectionFailedMarker,
 				...winner.kind === "timeout" ? { timedOut: true } : {},
 				...await settle(winner.kind === "timeout" && deadlineTimeoutMs !== void 0 ? `Command timed out after ${Math.round(deadlineTimeoutMs / 1e3)} seconds` : "Command cancelled")
 			};
@@ -2448,6 +2560,7 @@ async function executeBash(command, options) {
 				exitCode: void 0,
 				cancelled: true,
 				timedOut: true,
+				...injectionFailedMarker,
 				...await settle(annotation)
 			};
 		}
@@ -2457,6 +2570,7 @@ async function executeBash(command, options) {
 			return {
 				exitCode: void 0,
 				cancelled: true,
+				...injectionFailedMarker,
 				...await settle("Command cancelled")
 			};
 		}
@@ -2473,6 +2587,7 @@ async function executeBash(command, options) {
 		return {
 			exitCode: winner.result.exitCode,
 			cancelled: false,
+			...injectionFailedMarker,
 			minimized: minimized && minimized.text !== minimized.originalText ? {
 				filter: minimized.filter,
 				inputBytes: minimized.inputBytes,
@@ -3166,6 +3281,7 @@ function renderBashResult(value) {
 	const truncation = formatTruncationNotice(value.output);
 	if (truncation !== void 0) notices.push(...truncation);
 	else if (value.output.spillPath !== void 0) notices.push(`[full raw stream saved: ${value.output.spillPath}]`);
+	if (value.rmSafeInjectionFailed === true) notices.push("[Safe rm injection failed: rm deletes permanently — use `command rm` to bypass]");
 	const markers = [];
 	if (value.timedOut) markers.push(`[timed out after ${value.timeoutMs ?? "?"}ms]`);
 	else if (value.exitCode !== 0) markers.push(`[exit code: ${value.exitCode}]`);
@@ -3229,6 +3345,15 @@ const TOOL_PLUS_FIELDS = [
 		group: "behavior",
 		tool: "bash"
 	},
+	{
+		name: "rmSafe",
+		kind: "boolean",
+		default: true,
+		labelKey: "rmSafe",
+		hintKey: "rmSafeHint",
+		group: "behavior",
+		tool: "bash"
+	},
 	{
 		name: "useShellCommandWrapper",
 		kind: "boolean",
@@ -3895,6 +4020,7 @@ const Config = z.object({
 	interceptorEnabled: z.boolean().default(fieldDefault("interceptorEnabled", true)),
 	nonInteractiveEnv: z.boolean().default(fieldDefault("nonInteractiveEnv", true)),
 	snapshotEnabled: z.boolean().default(fieldDefault("snapshotEnabled", true)),
+	rmSafe: z.boolean().default(fieldDefault("rmSafe", true)),
 	useShellCommandWrapper: z.boolean().default(fieldDefault("useShellCommandWrapper", false)),
 	maxBackgroundJobs: z.number().default(fieldDefault("maxBackgroundJobs", 15)),
 	outputTruncateStrategy: z.union(["bytes", "lines"]).default(fieldDefault("outputTruncateStrategy", "bytes")),
@@ -3987,6 +4113,7 @@ function resolveConfig(config) {
 		interceptorEnabled: config.interceptorEnabled ?? fieldDefault("interceptorEnabled", true),
 		nonInteractiveEnv: config.nonInteractiveEnv ?? fieldDefault("nonInteractiveEnv", true),
 		snapshotEnabled: config.snapshotEnabled ?? fieldDefault("snapshotEnabled", true),
+		rmSafe: config.rmSafe ?? fieldDefault("rmSafe", true),
 		useShellCommandWrapper: config.useShellCommandWrapper ?? fieldDefault("useShellCommandWrapper", false),
 		maxBackgroundJobs: config.maxBackgroundJobs ?? fieldDefault("maxBackgroundJobs", 15),
 		outputTruncate: {
@@ -4196,27 +4323,145 @@ function probeBrowsers(env = defaultBrowserDetectEnv()) {
 	return found;
 }
 //#endregion
+//#region src/tools/bash/rm-safe-status.ts
+/**
+* rmSafe 注入状态查询：文件层（快照标记 + 脚本 + trash-cli 产物）与
+* 运行时层（一次性 bash 会话 source 快照后探测 `rm` 是否被重定义）。
+*
+* 分层语义：
+* - 文件层成功只证明"注入已写入快照"，不证明"会话里生效"——快照是会话
+*   创建时 source 的，注入只对之后创建的会话生效；trash-cli 产物缺失或
+*   node 路径不可用时函数调用会直接失败。
+* - 运行时层用一次性 bash 会话模拟"新会话创建"（source 快照 + `type rm`），
+*   验证的正是注入承诺的语义：新会话里 `rm` 是函数而非系统命令。探测
+*   无副作用，不触碰任何真实会话。
+* @module @xiaoso/dsh-tool-plus/bash/rm-safe-status
+*/
+/**
+* 解析 `type rm` / `declare -f rm` 探测输出。
+* `rm is a function` → 函数重定义生效；其余（`rm is /usr/bin/rm`、
+* `rm is hashed (...)`、空输出）→ 系统命令。
+*/
+function parseProbeOutput(stdout) {
+	return /rm is a function/.test(stdout) ? "function" : "system";
+}
+/**
+* Windows 路径转 Git Bash 形式（`C:\Users\x` → `/c/Users/x`）。
+* 非 Windows 原样返回；非盘符路径仅把反斜杠转正斜杠。
+*/
+function toGitBashPath(p) {
+	if (process.platform !== "win32") return p;
+	const drive = /^([A-Za-z]):[\\/](.*)$/.exec(p);
+	if (drive === null) return p.replace(/\\/g, "/");
+	return `/${drive[1].toLowerCase()}/${drive[2].replace(/\\/g, "/")}`;
+}
+/** 默认 spawn 实现：收集 stdout，超时 kill 并标记 timedOut。 */
+const defaultSpawnDeps = { spawnShell: (shell, args, timeoutMs) => new Promise((resolve, reject) => {
+	const child = spawn(shell, args, { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	let timedOut = false;
+	const timer = setTimeout(() => {
+		timedOut = true;
+		child.kill();
+	}, timeoutMs);
+	child.stdout.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.on("error", (error) => {
+		clearTimeout(timer);
+		reject(error);
+	});
+	child.on("close", () => {
+		clearTimeout(timer);
+		resolve({
+			stdout,
+			timedOut
+		});
+	});
+}) };
+/**
+* 运行时探测：在一次性 bash 会话里 source 快照（模拟新会话创建），
+* 然后 `type rm` + `declare -f rm` 看 `rm` 是否被重定义为函数。
+* spawn 失败或超时 → 'unknown'（探测不可用，不代表注入失败）。
+*/
+async function probeRmSafeRuntime(shell, snapshotPath, deps = defaultSpawnDeps, timeoutMs = 5e3) {
+	const script = `source ${quote(toGitBashPath(snapshotPath))}; type rm; declare -f rm`;
+	try {
+		const { stdout, timedOut } = await deps.spawnShell(shell, ["-c", script], timeoutMs);
+		if (timedOut) return "unknown";
+		return parseProbeOutput(stdout);
+	} catch {
+		return "unknown";
+	}
+}
+/**
+* 查询 rmSafe 注入状态（查询即确保注入：幂等，与 executeBash 的注入
+* 路径一致）。rmSafe 关闭时调用方不应调用本函数（返回 disabled 由
+* 调用方短路）；此处仍兜底返回 disabled 语义由调用方保证。
+*/
+async function queryRmSafeStatus(deps) {
+	const snapshotPath = await deps.getOrCreateSnapshot();
+	if (snapshotPath === null) return {
+		status: "failed",
+		reason: "snapshot-unavailable"
+	};
+	if (!deps.cliExists()) return {
+		status: "failed",
+		reason: "cli-missing"
+	};
+	const scriptPath = deps.ensureScript();
+	if (scriptPath === null) return {
+		status: "failed",
+		reason: "script-write-failed"
+	};
+	if (!deps.inject(snapshotPath, scriptPath)) return {
+		status: "failed",
+		reason: "snapshot-write-failed"
+	};
+	const runtime = await deps.probe(snapshotPath);
+	if (runtime === "system") return {
+		status: "failed",
+		reason: "runtime-not-effective"
+	};
+	return {
+		status: "injected",
+		runtime
+	};
+}
+//#endregion
 //#region src/host/browser-probe-rpc.ts
 /**
-* Install the browser/detect RPC endpoint. Returns a disposer that removes
+* Host half of the tool-plus RPC channel: registers the `/tool-plus` logical
+* channel on the official Connection transport and answers
+* `browser/detect` (probe the machine for usable browsers) and
+* `rmSafe/status` (query = ensure + verify the rmSafe injection). The
+* settings panel (client half) calls these through
+* `createWebConnectionRpc().call(...)` — the documented public RPC surface
+* of `@deepseek-ai/dsh-client-connection`, not a private plugin hook.
+*
+* Trust policy is `loopback`: the probe only reports local filesystem paths,
+* so it must never be reachable from a non-loopback host. Registration is
+* best-effort — if `connection` is missing (non-web deployments) or the
+* channel is already taken, the endpoints are simply unavailable and the
+* panel shows "Unavailable".
+* @module @xiaoso/dsh-tool-plus/host/browser-probe-rpc
+*/
+/**
+* Install the tool-plus RPC endpoints. Returns a disposer that removes
 * the registration (call it from the plugin's `ctx.effect` teardown).
 * Never throws for "unavailable" — the return value tells the caller whether
 * the channel is actually live.
 */
-function installBrowserProbeRpc(ctx) {
+function installBrowserProbeRpc(ctx, deps) {
 	let disposer;
 	ctx.inject(["connection"], (connectionCtx) => {
 		try {
 			const handler = async (endpoint, _payload, _signal) => {
-				if (endpoint !== "browser/detect") return {
-					ok: false,
-					error: {
-						code: "bad-request",
-						message: `Unknown tool-plus endpoint: ${endpoint}`,
-						details: { issues: [] }
-					}
-				};
-				try {
+				if (endpoint === "browser/detect") try {
 					return {
 						ok: true,
 						value: { found: probeBrowsers() }
@@ -4231,6 +4476,42 @@ function installBrowserProbeRpc(ctx) {
 						}
 					};
 				}
+				if (endpoint === "rmSafe/status") {
+					if (!deps.getRmSafe()) return {
+						ok: true,
+						value: { status: "disabled" }
+					};
+					try {
+						const { shell, env } = getShellConfig();
+						return {
+							ok: true,
+							value: await queryRmSafeStatus({
+								getOrCreateSnapshot: () => getOrCreateSnapshot(shell, env),
+								cliExists: () => fs.existsSync(rmSafeCliPath()),
+								ensureScript: () => ensureRmSafeScript(rmSafeScriptDir(), process.execPath, rmSafeCliPath()),
+								inject: (snapshotPath, scriptPath) => injectRmSafe(snapshotPath, scriptPath),
+								probe: (snapshotPath) => probeRmSafeRuntime(shell, snapshotPath)
+							})
+						};
+					} catch (error) {
+						return {
+							ok: false,
+							error: {
+								code: "internal",
+								message: error instanceof Error ? error.message : String(error),
+								details: {}
+							}
+						};
+					}
+				}
+				return {
+					ok: false,
+					error: {
+						code: "bad-request",
+						message: `Unknown tool-plus endpoint: ${endpoint}`,
+						details: { issues: [] }
+					}
+				};
 			};
 			disposer = connectionCtx.connection.rpc.handle(TOOL_PLUS_RPC_CHANNEL, handler, { authority: "loopback" });
 		} catch {
@@ -14555,7 +14836,7 @@ let specialHandlersPromise;
 * requires a special handler, so we keep them out of the cold-startup graph.
 */
 function loadSpecialHandlers() {
-	specialHandlersPromise ??= import("./scrapers-DrSYgPyf.mjs").then((m) => m.specialHandlers);
+	specialHandlersPromise ??= import("./scrapers-DI8yWlu_.mjs").then((m) => m.specialHandlers);
 	return specialHandlersPromise;
 }
 /**
@@ -25704,6 +25985,7 @@ function buildForeground(result, wallTimeMs, timeoutMs) {
 		wallTimeMs,
 		...result.workingDir !== void 0 ? { workingDir: result.workingDir } : {},
 		...result.minimized !== void 0 ? { minimized: result.minimized } : {},
+		...result.rmSafeInjectionFailed === true ? { rmSafeInjectionFailed: true } : {},
 		output: {
 			text: result.output,
 			truncated: result.truncated,
@@ -25772,7 +26054,7 @@ function apply(ctx, config = {}) {
 		cfg = current();
 		registerModeSensitive();
 	});
-	const disposeBrowserProbe = installBrowserProbeRpc(ctx);
+	const disposeBrowserProbe = installBrowserProbeRpc(ctx, { getRmSafe: () => cfg.rmSafe });
 	ctx.systemPrompt.section({
 		name: "tool:bash",
 		order: 105,
@@ -26028,6 +26310,7 @@ function apply(ctx, config = {}) {
 						headBytes: cfg.outputSinkHeadBytes,
 						useShellCommandWrapper: cfg.useShellCommandWrapper,
 						snapshotEnabled: cfg.snapshotEnabled,
+						rmSafe: cfg.rmSafe,
 						nonInteractiveEnv: cfg.nonInteractiveEnv,
 						artifactPath: allocateSpillFile()
 					});
@@ -26085,6 +26368,7 @@ function apply(ctx, config = {}) {
 				headBytes: cfg.outputSinkHeadBytes,
 				useShellCommandWrapper: cfg.useShellCommandWrapper,
 				snapshotEnabled: cfg.snapshotEnabled,
+				rmSafe: cfg.rmSafe,
 				nonInteractiveEnv: cfg.nonInteractiveEnv,
 				artifactPath: allocateSpillFile()
 			});

package/lib/{scrapers-DrSYgPyf.mjs → scrapers-DI8yWlu_.mjs}

@@ -3,7 +3,7 @@ __installBunShim();
 import { n as fs_promises_shim_exports } from "./fs-promises-shim-Bx0fpxuk.mjs";
 import { B as USER_AGENT, G as getDocsRsCacheDir, N as formatNumber, P as $env, T as warn, c as combineSignals, j as formatBytes, l as exec, s as Snowflake, x as parseFrontmatter, y as isEnoent } from "./src-D_e1qMwi.mjs";
 import { V as tryParseJson } from "./utils-fnV2zzp3.mjs";
-import { a as fetchBinary, c as getParallelExtractContent, i as convertWithMarkit, l as ensureTool, m as settings, n as asRecord, o as extractWithParallel, r as asString, s as findParallelApiKey, t as asNumber } from "./utils-DSEEKy3G.mjs";
+import { a as fetchBinary, c as getParallelExtractContent, i as convertWithMarkit, l as ensureTool, m as settings, n as asRecord, o as extractWithParallel, r as asString, s as findParallelApiKey, t as asNumber } from "./utils-D1p8-H8L.mjs";
 import { n as isRecord } from "./type-guards-B9VVjRDK.mjs";
 import { r as throwIfAborted, t as ToolAbortError } from "./tool-errors-DoyxivAR.mjs";
 import { c as getLocalizedText, d as looksLikeHtml, i as decodeHtmlEntities, l as htmlToBasicMarkdown, o as formatIsoDate, r as buildResult, s as formatMediaDuration, u as loadPage } from "./types-BUO0JXO-.mjs";

package/lib/trash-cli.mjs

@@ -0,0 +1,281 @@
+import * as fs from "node:fs";
+//#region src/tools/bash/trash-cli.ts
+const SHORT_OPTIONS = {
+	r: "recursive",
+	R: "recursive",
+	f: "force",
+	i: "interactive",
+	I: "interactive",
+	v: "verbose",
+	d: "dir"
+};
+const LONG_OPTIONS = {
+	"--recursive": {
+		field: "recursive",
+		value: true
+	},
+	"--force": {
+		field: "force",
+		value: true
+	},
+	"--interactive": {
+		field: "interactive",
+		value: true
+	},
+	"--verbose": {
+		field: "verbose",
+		value: true
+	},
+	"--dir": {
+		field: "dir",
+		value: true
+	},
+	"--preserve-root": {
+		field: "preserveRoot",
+		value: true
+	},
+	"--no-preserve-root": {
+		field: "preserveRoot",
+		value: false
+	},
+	"--one-file-system": {
+		field: "oneFileSystem",
+		value: true
+	}
+};
+/** --interactive=WHEN 的合法取值（GNU rm 语义）。 */
+const INTERACTIVE_WHEN = /* @__PURE__ */ new Set([
+	"once",
+	"always",
+	"never"
+]);
+/**
+* 解析 rm 风格参数（coreutils rm 语义）：
+* - 短选项支持组合（`-rf`），`-r`/`-R`/`--recursive` 等价，`-i`/`-I` 等价；
+* - `--` 结束符后全部视为路径（允许 `-` 开头的文件名）；
+* - `--interactive[=once|always|never]` 接受（回收站模式忽略交互）；
+* - 未知短选项 → invalid-option，未知长选项 → unrecognized-option；
+* - 无路径 → missing-operand。
+*/
+function parseRmArgs(argv) {
+	const parsed = {
+		recursive: false,
+		force: false,
+		interactive: false,
+		verbose: false,
+		dir: false,
+		preserveRoot: true,
+		oneFileSystem: false,
+		paths: []
+	};
+	let afterDoubleDash = false;
+	for (const arg of argv) {
+		if (afterDoubleDash) {
+			parsed.paths.push(arg);
+			continue;
+		}
+		if (arg === "--") {
+			afterDoubleDash = true;
+			continue;
+		}
+		if (arg.startsWith("--")) {
+			const eq = arg.indexOf("=");
+			const name = eq >= 0 ? arg.slice(0, eq) : arg;
+			const value = eq >= 0 ? arg.slice(eq + 1) : void 0;
+			if (name === "---presume-input-tty") continue;
+			const flag = LONG_OPTIONS[name];
+			if (flag === void 0) {
+				parsed.error = {
+					kind: "unrecognized-option",
+					option: name
+				};
+				return parsed;
+			}
+			if (value !== void 0) {
+				if (name === "--interactive") {
+					if (!INTERACTIVE_WHEN.has(value)) {
+						parsed.error = {
+							kind: "invalid-argument",
+							option: name,
+							value
+						};
+						return parsed;
+					}
+					parsed.interactive = true;
+				} else if (name === "--preserve-root") {
+					if (value === "all") parsed.preserveRoot = true;
+					else {
+						parsed.error = {
+							kind: "invalid-argument",
+							option: name,
+							value
+						};
+						return parsed;
+					}
+				} else {
+					parsed.error = {
+						kind: "option-argument",
+						option: name
+					};
+					return parsed;
+				}
+			} else parsed[flag.field] = flag.value;
+			continue;
+		}
+		if (arg.startsWith("-") && arg.length > 1) {
+			for (const ch of arg.slice(1)) {
+				const flag = SHORT_OPTIONS[ch];
+				if (flag === void 0) {
+					parsed.error = {
+						kind: "invalid-option",
+						option: ch
+					};
+					return parsed;
+				}
+				parsed[flag] = true;
+			}
+			continue;
+		}
+		parsed.paths.push(arg);
+	}
+	if (parsed.paths.length === 0 && parsed.error === void 0) parsed.error = { kind: "missing-operand" };
+	return parsed;
+}
+/** 规范化 verbose 输出的目录尾部斜杠（`a///` → `a/`，对齐 rm）。 */
+function normalizeTrailingSlash(p) {
+	return p.replace(/[\\/]+$/, "/");
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/** 路径规范化后以 `.` 或 `..` 结尾（r-4 移植：拒绝删除）。 */
+function isDotOrDotDot(p) {
+	const last = p.replace(/[\\/]+$/, "").split(/[\\/]/).pop();
+	return last === "." || last === "..";
+}
+/**
+* 路径是 `/` 或其同义词（`//`、`///`、符号链接/junction 指向根目录）。
+* 根判定用 dev/ino 比较（GNU preserve-root 的精确语义）：字符串比较在
+* Windows 上会漏判（junction 指向 C:\ 时 realpath 是 "C:\\" 而非 "/"），
+* 而 dev/ino 在 Windows 与 POSIX 上都正确。空串不是根。
+*
+* Windows 语义说明：Node 的 `/` 解析为当前盘根（随 cwd 变化），而 Git
+* bash 的 `/` 是 MSYS 根——两者都只保护"字面 `/` 及其 dev/ino 等价物"，
+* 与 GNU rm 在 Git bash 的行为一致（GNU 同样不保护指向盘根的链接）。
+*/
+async function isRootPath(p, deps) {
+	if (p.length > 0 && p.replace(/[\\/]+$/, "") === "") return true;
+	const st = await deps.stat(p);
+	if (st === null) return false;
+	const root = await deps.stat("/");
+	return root !== null && st.dev === root.dev && st.ino === root.ino;
+}
+/**
+* 执行一次 rm 语义的回收站删除。
+*
+* 行为对齐 coreutils rm：
+* - 无 -r/-d 时目录报 `Is a directory` 并保留（rm4）；
+* - 不存在路径：-f 静默忽略（f-1），否则报 `No such file or directory`；
+* - `.`/`..` 结尾路径拒绝（r-4）；`/` 及同义词拒绝（r-root，preserve-root 默认开）；
+* - 符号链接按链接本身处理（lstat，dangling-symlink 移植）；
+* - trash 失败：-f 静默但退出 1，否则报 `cannot remove`；
+* - -v 输出 `removed 'x'` / `removed directory 'x'`（r-1/d-1/v-slash）；
+* - 退出码：全部成功 0，任一失败 1。
+*/
+async function runTrashCli(argv, deps) {
+	const parsed = parseRmArgs(argv);
+	if (parsed.error !== void 0) {
+		if (parsed.error.kind === "missing-operand") deps.stderr("rm: missing operand");
+		else if (parsed.error.kind === "invalid-option") deps.stderr(`rm: invalid option -- '${parsed.error.option}'`);
+		else if (parsed.error.kind === "unrecognized-option") deps.stderr(`rm: unrecognized option '${parsed.error.option}'`);
+		else if (parsed.error.kind === "invalid-argument") deps.stderr(`rm: invalid argument '${parsed.error.value}' for '${parsed.error.option}'`);
+		else deps.stderr(`rm: option '${parsed.error.option}' doesn't allow an argument`);
+		deps.exit(1);
+		return;
+	}
+	const { recursive, force, verbose, dir, preserveRoot, paths } = parsed;
+	const items = [];
+	let failed = false;
+	for (const p of paths) {
+		if (isDotOrDotDot(p)) {
+			deps.stderr(`rm: refusing to remove '.' or '..' directory: skipping '${p}'`);
+			failed = true;
+			continue;
+		}
+		if (preserveRoot && await isRootPath(p, deps)) {
+			deps.stderr("rm: it is dangerous to operate recursively on '/'");
+			deps.stderr("rm: use --no-preserve-root to override this failsafe");
+			failed = true;
+			continue;
+		}
+		const st = await deps.lstat(p);
+		if (st === null) {
+			if (!force) {
+				deps.stderr(`rm: cannot remove '${p}': No such file or directory`);
+				failed = true;
+			}
+			continue;
+		}
+		if (st.isDirectory && !recursive && !dir) {
+			deps.stderr(`rm: cannot remove '${p}': Is a directory`);
+			failed = true;
+			continue;
+		}
+		items.push({
+			path: p,
+			isDir: st.isDirectory
+		});
+	}
+	if (items.length > 0) try {
+		await deps.trash(items.map((item) => item.path));
+	} catch (err) {
+		deps.stderr(`rm: cannot remove '${items[0].path}': ${errorMessage(err)}`);
+		failed = true;
+	}
+	if (verbose && !failed) for (const { path: p, isDir } of items) deps.stdout(isDir ? `removed directory '${normalizeTrailingSlash(p)}'` : `removed '${p}'`);
+	deps.exit(failed ? 1 : 0);
+}
+//#endregion
+//#region src/tools/bash/trash-cli-main.ts
+/**
+* rmSafe CLI 入口（构建产物 lib/trash-cli.mjs，被注入的 bash `rm()` 函数调用）。
+*
+* trash 包在此动态加载：单测只 import trash-cli.ts（纯逻辑），
+* 不会触发 trash 依赖解析。
+* @module @xiaoso/dsh-tool-plus/bash/trash-cli-main
+*/
+async function main() {
+	const { default: trash } = await import("trash");
+	await runTrashCli(process.argv.slice(2), {
+		trash,
+		lstat: async (p) => {
+			try {
+				return { isDirectory: (await fs.promises.lstat(p)).isDirectory() };
+			} catch {
+				return null;
+			}
+		},
+		stat: async (p) => {
+			try {
+				const st = await fs.promises.stat(p);
+				return {
+					dev: st.dev,
+					ino: st.ino
+				};
+			} catch {
+				return null;
+			}
+		},
+		stdout: (s) => process.stdout.write(`${s}\n`),
+		stderr: (s) => process.stderr.write(`${s}\n`),
+		exit: (c) => {
+			process.exitCode = c;
+		}
+	});
+}
+main().catch((err) => {
+	process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export {};

package/lib/{utils-DSEEKy3G.mjs → utils-D1p8-H8L.mjs}

@@ -7202,7 +7202,7 @@ const settings = {
 };
 //#endregion
 //#region package.json
-var version = "0.1.0-beta.7";
+var version = "0.1.1";
 /** `.tmp` files older than this are treated as orphaned writes and swept. */
 const TMP_ORPHAN_MAX_AGE_MS = 3e5;
 function markitConversionCacheKey(bytes, extension) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xiaoso/dsh-tool-plus",
   "description": "Oh My Pi bash runtime ported as a deepseek-harness tool plugin: persistent shell session, output minimizer, managed background jobs, command interception",
-  "version": "0.1.0-beta.7",
+  "version": "0.1.1",
   "license": "MIT",
   "keywords": [
     "deepseek-harness",
@@ -109,6 +109,7 @@
     "@oh-my-pi/pi-utils": "17.3.5",
     "json5": "^2.2.3",
     "puppeteer-core": "^25.3.0",
+    "trash": "^10.1.1",
     "yaml": "^2.9.0"
   },
   "devDependencies": {

package/presets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaoso/dsh-tool-plus-presets",
-  "version": "0.1.0-beta.7",
+  "version": "0.1.1",
   "description": "Agent-preset installer for dsh-tool-plus: installs the standard / PTC enhanced preset templates into a DeepSeek Harness home.",
   "license": "MIT",
   "keywords": [