npm - dominds - Versions diffs - 0.6.2 → 0.6.4 - Mend

dominds 0.6.2 → 0.6.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (149) hide show

package/dist/static/index.html CHANGED Viewed

@@ -52,7 +52,7 @@
         padding: 20px;
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-th_praGg.js"></script>
+    <script type="module" crossorigin src="/assets/index-BNBG2CE1.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DaIsSzC_.css">
   </head>
   <body>

package/dist/team.js CHANGED Viewed

@@ -249,9 +249,10 @@ exports.Team = Team;
          * Honors declaration order of toolsets and tools. Logs warnings for duplicate tool names
          * that resolve to different Tool objects. Returns no duplicate tools per name.
          */
-        listResolvedToolsetNames() {
+        listResolvedToolsetNames(options) {
             if (!this.toolsets)
                 return [];
+            const onMissing = options?.onMissing ?? 'warn';
             const excludedToolsets = new Set();
             for (const entry of this.toolsets) {
                 if (entry.startsWith('!') && entry.length > 1) {
@@ -273,7 +274,9 @@ exports.Team = Team;
                         continue;
                     const tools = (0, registry_1.getToolset)(resolvedToolsetName);
                     if (!tools) {
-                        log_1.log.warn(`Toolset '${resolvedToolsetName}' not found in registry for member '${this.id}'`);
+                        if (onMissing === 'warn') {
+                            log_1.log.warn(`Toolset '${resolvedToolsetName}' not found in registry for member '${this.id}'`);
+                        }
                         continue;
                     }
                     resolved.push(resolvedToolsetName);
@@ -282,11 +285,13 @@ exports.Team = Team;
             }
             return resolved;
         }
-        listTools() {
+        listTools(options) {
             const toolMap = new Map();
             const seenNames = new Set();
+            const onMissingToolset = options?.onMissingToolset ?? 'warn';
+            const onMissingTool = options?.onMissingTool ?? 'warn';
             // Process toolsets (in declaration order)
-            for (const toolsetName of this.listResolvedToolsetNames()) {
+            for (const toolsetName of this.listResolvedToolsetNames({ onMissing: onMissingToolset })) {
                 const tools = (0, registry_1.getToolset)(toolsetName);
                 if (!tools)
                     continue;
@@ -307,7 +312,9 @@ exports.Team = Team;
                 for (const toolName of this.tools) {
                     const tool = (0, registry_1.getTool)(toolName);
                     if (!tool) {
-                        log_1.log.warn(`Tool '${toolName}' not found in registry for member '${this.id}'`);
+                        if (onMissingTool === 'warn') {
+                            log_1.log.warn(`Tool '${toolName}' not found in registry for member '${this.id}'`);
+                        }
                         continue;
                     }
                     if (seenNames.has(toolName)) {
@@ -331,6 +338,12 @@ exports.Team = Team;
             id: 'defaulter',
             name: 'Defaulter',
             fbr_effort: 3,
+            // FBR defaults to tool-less web search policy, but users can override via
+            // member_defaults.fbr_model_params / members.<id>.fbr_model_params.
+            fbr_model_params: {
+                codex: { web_search: 'disabled' },
+                openai: { web_search: 'disabled' },
+            },
         });
         const fuxi = new Team.Member({
             id: 'fuxi',
@@ -380,7 +393,7 @@ exports.Team = Team;
         }
         function listShellTools(member) {
             const out = [];
-            for (const t of member.listTools()) {
+            for (const t of member.listTools({ onMissingToolset: 'silent', onMissingTool: 'silent' })) {
                 if (t.type !== 'func')
                     continue;
                 if (!isShellToolName(t.name))
@@ -723,6 +736,7 @@ exports.Team = Team;
         'reasoning_effort',
         'verbosity',
         'parallel_tool_calls',
+        'web_search',
     ];
     Team.TEAM_YAML_MODEL_PARAMS_CODEX_KEYS = Team.TEAM_YAML_MODEL_PARAMS_OPENAI_KEYS;
     Team.TEAM_YAML_MODEL_PARAMS_ANTHROPIC_KEYS = [
@@ -756,6 +770,7 @@ exports.Team = Team;
             reasoning_effort: `Did you mean \`${atPrefix}.model_params.codex.reasoning_effort\` (preferred for provider: codex) or \`${atPrefix}.model_params.openai.reasoning_effort\`? (not supported at ${atPrefix} root)`,
             verbosity: `Did you mean \`${atPrefix}.model_params.codex.verbosity\` (preferred for provider: codex) or \`${atPrefix}.model_params.openai.verbosity\`? (not supported at ${atPrefix} root)`,
             parallel_tool_calls: `Did you mean \`${atPrefix}.model_params.codex.parallel_tool_calls\` (preferred for provider: codex) or \`${atPrefix}.model_params.openai.parallel_tool_calls\`? (not supported at ${atPrefix} root)`,
+            web_search: `Did you mean \`${atPrefix}.model_params.codex.web_search\` (preferred for provider: codex) or \`${atPrefix}.model_params.openai.web_search\`? (not supported at ${atPrefix} root)`,
         };
         const unknownAtMember = listUnknownKeys(memberObj, Team.TEAM_YAML_MEMBER_KEYS);
         if (unknownAtMember.length > 0) {
@@ -776,6 +791,7 @@ exports.Team = Team;
                 reasoning_effort: `Did you mean \`${modelParamsAt}.codex.reasoning_effort\` (preferred for provider: codex) or \`${modelParamsAt}.openai.reasoning_effort\`?`,
                 verbosity: `Did you mean \`${modelParamsAt}.codex.verbosity\` (preferred for provider: codex) or \`${modelParamsAt}.openai.verbosity\`?`,
                 parallel_tool_calls: `Did you mean \`${modelParamsAt}.codex.parallel_tool_calls\` (preferred for provider: codex) or \`${modelParamsAt}.openai.parallel_tool_calls\`?`,
+                web_search: `Did you mean \`${modelParamsAt}.codex.web_search\` (preferred for provider: codex) or \`${modelParamsAt}.openai.web_search\`?`,
                 temperature: `Did you mean \`${modelParamsAt}.codex.temperature\` / \`${modelParamsAt}.openai.temperature\` (or \`${modelParamsAt}.anthropic.temperature\`)?`,
                 top_p: `Did you mean \`${modelParamsAt}.codex.top_p\` / \`${modelParamsAt}.openai.top_p\` (or \`${modelParamsAt}.anthropic.top_p\`)?`,
                 max_tokens: `Did you mean \`${modelParamsAt}.max_tokens\` / \`${modelParamsAt}.general.max_tokens\` (provider-agnostic), or \`${modelParamsAt}.codex.max_tokens\` / \`${modelParamsAt}.openai.max_tokens\` / \`${modelParamsAt}.anthropic.max_tokens\`?`,
@@ -1351,6 +1367,13 @@ exports.Team = Team;
                 verbosity !== 'high') {
                 throw new Error(`Invalid ${at2}.verbosity: expected low|medium|high (got ${describeValueType(verbosity)})`);
             }
+            const webSearch = params.web_search;
+            if (webSearch !== undefined &&
+                webSearch !== 'disabled' &&
+                webSearch !== 'cached' &&
+                webSearch !== 'live') {
+                throw new Error(`Invalid ${at2}.web_search: expected disabled|cached|live (got ${describeValueType(webSearch)})`);
+            }
         };
         const codex = obj.codex === undefined ? undefined : asRecord(obj.codex, `${at}.codex`);
         const openai = obj.openai === undefined ? undefined : asRecord(obj.openai, `${at}.openai`);

package/dist/tool.js CHANGED Viewed

@@ -44,11 +44,67 @@ function validateArgs(schema, args) {
     }
     return { ok: true };
 }
+function isJsonPrimitiveValue(value) {
+    return (typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean' ||
+        value === null);
+}
+function formatJsonPrimitiveValue(value) {
+    return JSON.stringify(value);
+}
+function describeShortValue(value) {
+    if (isJsonPrimitiveValue(value))
+        return formatJsonPrimitiveValue(value);
+    if (Array.isArray(value))
+        return '[array]';
+    if (typeof value === 'object' && value !== null)
+        return '[object]';
+    return JSON.stringify(value);
+}
+function formatEnumAllowedList(values, maxShown) {
+    const shown = values.slice(0, Math.max(0, Math.floor(maxShown)));
+    const shownText = shown.map((v) => formatJsonPrimitiveValue(v)).join(', ');
+    const remaining = values.length - shown.length;
+    if (remaining <= 0)
+        return shownText;
+    return shownText.length > 0
+        ? `${shownText}, ... (+${remaining} more)`
+        : `... (+${remaining} more)`;
+}
 function validateValue(schema, value, path) {
     if (!isRecord(schema)) {
         // Unknown schema shape: don't block execution.
         return { ok: true };
     }
+    // Best-effort const validation (only supports primitive const).
+    // For complex/object const, keep permissive behavior.
+    if ('const' in schema && isJsonPrimitiveValue(schema.const)) {
+        const expected = schema.const;
+        if (!isJsonPrimitiveValue(value) || value !== expected) {
+            return {
+                ok: false,
+                error: `Field ${path} must be ${formatJsonPrimitiveValue(expected)}; got ${describeShortValue(value)}`,
+            };
+        }
+    }
+    // Best-effort enum validation (only supports primitive enums).
+    // For complex/object enums, keep permissive behavior.
+    if ('enum' in schema && Array.isArray(schema.enum)) {
+        const enumValues = schema.enum;
+        const allPrimitive = enumValues.every((v) => isJsonPrimitiveValue(v));
+        if (allPrimitive) {
+            const allowedValues = enumValues;
+            const allowed = isJsonPrimitiveValue(value) && allowedValues.some((v) => v === value);
+            if (!allowed) {
+                const allowedText = formatEnumAllowedList(allowedValues, 10);
+                return {
+                    ok: false,
+                    error: `Field ${path} must be one of ${allowedText}; got ${describeShortValue(value)}`,
+                };
+            }
+        }
+    }
     const typeValue = 'type' in schema ? schema.type : undefined;
     const schemaType = typeof typeValue === 'string'
         ? typeValue

package/dist/tools/builtins.js CHANGED Viewed

@@ -15,6 +15,7 @@ const fs_1 = require("./fs");
 const mcp_1 = require("./mcp");
 const mem_1 = require("./mem");
 const os_1 = require("./os");
+const pending_tellask_reminder_1 = require("./pending-tellask-reminder");
 const plan_1 = require("./plan");
 const registry_1 = require("./registry");
 const ripgrep_1 = require("./ripgrep");
@@ -178,8 +179,8 @@ for (const tool of team_mgmt_1.teamMgmtTools) {
         zh: 'Codex 风格工具（apply_patch + readonly_shell + update_plan）',
     },
     promptI18n: {
-        en: 'Use `apply_patch` (Codex-style patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via a small allowlist (cat/rg/sed/ls/nl/wc/head/tail/stat/file/uname/whoami/id/echo/pwd/which/date/diff/realpath/readlink/printf/cut/sort/uniq/tr/awk/shasum/sha256sum/md5sum/uuid/git show/git status/git diff/git log/git blame/find/tree/jq; also supports: git -C <relative-path> <show|status|diff|log|blame> ...; also supports: cd <relative-path> && <allowed command...> (or ||)). Use `update_plan` to record/update the task plan (stored as a reminder). You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). `apply_patch` enforces Dominds directory allow/deny lists.',
-        zh: '使用 `apply_patch`（Codex 风格 patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查（仅允许 cat/rg/sed/ls/nl/wc/head/tail/stat/file/uname/whoami/id/echo/pwd/which/date/diff/realpath/readlink/printf/cut/sort/uniq/tr/awk/shasum/sha256sum/md5sum/uuid/git show/git status/git diff/git log/git blame/find/tree/jq；另支持：git -C <相对路径> <show|status|diff|log|blame> ...；另支持：cd <相对路径> && <允许命令...>（或 ||））。使用 `update_plan` 记录/更新任务计划（作为 reminder 存储）。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。`apply_patch` 会按成员的目录权限（allow/deny）做访问控制。',
+        en: 'Use `apply_patch` (Codex-style patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. Use `update_plan` to record/update the task plan (stored as a reminder). You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
+        zh: '使用 `apply_patch`（Codex 风格 patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。使用 `update_plan` 记录/更新任务计划（作为 reminder 存储）。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
     },
 });
 (0, registry_1.registerToolset)('team-mgmt', [...team_mgmt_1.teamMgmtTools]);
@@ -196,3 +197,4 @@ for (const tool of team_mgmt_1.teamMgmtTools) {
 // Register ReminderOwners
 (0, registry_1.registerReminderOwner)(os_1.shellCmdReminderOwner);
 (0, registry_1.registerReminderOwner)(mcp_1.mcpLeaseReminderOwner);
+(0, registry_1.registerReminderOwner)(pending_tellask_reminder_1.pendingTellaskReminderOwner);

package/dist/tools/context-health.js CHANGED Viewed

@@ -39,12 +39,12 @@ function formatContextHealthOwnerHeader(args) {
         ];
         if (!snapshot) {
             lines.push('- 状态：未知（尚未获取上下文统计）');
-            lines.push('- 现在就做：用提醒项收敛关键细节（update_reminder）→ change_mind(progress) → clear_mind');
+            lines.push('- 优先动作：change_mind(progress) → clear_mind');
             return lines.join('\n');
         }
         if (snapshot.kind !== 'available') {
             lines.push('- 状态：未知（token 统计不可用）');
-            lines.push('- 现在就做：用提醒项收敛关键细节（update_reminder）→ change_mind(progress) → clear_mind');
+            lines.push('- 优先动作：change_mind(progress) → clear_mind');
             return lines.join('\n');
         }
         switch (snapshot.level) {
@@ -53,16 +53,16 @@ function formatContextHealthOwnerHeader(args) {
                 return lines.join('\n');
             }
             case 'caution': {
-                lines.push('- 状态：🟡 黄（必须尽快清理）');
-                lines.push('- 硬规程：先 update_reminder 收敛工作集 → 再 change_mind(progress) → 然后 clear_mind');
+                lines.push('- 状态：🟡 黄（警告）');
+                lines.push('- 优先动作：change_mind(progress) → clear_mind');
                 return lines.join('\n');
             }
             case 'critical': {
-                lines.push('- 状态：🔴 红（硬闸门）');
+                lines.push('- 状态：🔴 红（危险）');
                 if (remainingGenTurns !== undefined) {
-                    lines.push(`- 倒数：剩余 ${remainingGenTurns} 次生成机会；到 0 系统将被动开启新一轮/新回合以保持稳定性`);
+                    lines.push(`- 倒数：剩余 ${remainingGenTurns} 次生成机会；到 0 系统将自动开启新一轮以保持稳定性`);
                 }
-                lines.push('- 禁止继续推进实现：先 update_reminder 收敛工作集 → 再 change_mind(progress) → 然后 clear_mind');
+                lines.push('- 立刻：change_mind(progress) → clear_mind');
                 return lines.join('\n');
             }
             default: {

package/dist/tools/os.js CHANGED Viewed

@@ -290,7 +290,7 @@ const readonlyShellSchema = {
     properties: {
         command: {
             type: 'string',
-            description: 'Read-only shell command (allowed prefixes: cat, rg, sed, ls, nl, wc, head, tail, stat, file, uname, whoami, id, echo, pwd, which, date, diff, realpath, readlink, printf, cut, sort, uniq, tr, awk, shasum, sha256sum, md5sum, uuid, git show, git status, git diff, git log, git blame, find, tree, jq; also allows: git -C <relative-path> <show|status|diff|log|blame> ...; also allows: cd <relative-path> && <allowed command...> (or ||))',
+            description: 'Read-only shell command (allowed prefixes: cat, rg, sed, ls, nl, wc, head, tail, stat, file, uname, whoami, id, echo, pwd, which, date, diff, realpath, readlink, printf, cut, sort, uniq, tr, awk, shasum, sha256sum, md5sum, uuid, git show, git status, git diff, git log, git blame, find, tree, jq, true; exact version probes: node --version|-v, python3 --version|-V; also allows: git -C <relative-path> <show|status|diff|log|blame> ...; also allows: cd <relative-path> && <allowed command...> (or ||); command chains via |/&&/|| are validated segment-by-segment)',
         },
         timeout_ms: {
             type: 'number',
@@ -591,23 +591,69 @@ const readonlyShellAllowedPrefixes = [
     'find',
     'tree',
     'jq',
+    'true',
 ];
-function isAllowedReadonlyShellCommand(command) {
-    const trimmed = command.trimStart();
-    return isAllowedReadonlyShellCommandInternal(trimmed, 0);
-}
-function isAllowedReadonlyShellCommandInternal(command, depth) {
-    if (depth > 8)
+function isAllowedReadonlyShellVersionProbe(command) {
+    const tokens = splitShellTokens(command);
+    if (tokens.length !== 2)
         return false;
+    const cmd = tokens[0]?.text ?? '';
+    const flag = tokens[1]?.text ?? '';
+    if (cmd === 'node')
+        return flag === '--version' || flag === '-v';
+    if (cmd === 'python3')
+        return flag === '--version' || flag === '-V';
+    return false;
+}
+function validateReadonlyShellCommand(command) {
+    return validateReadonlyShellCommandInternal(command.trimStart(), 0);
+}
+function validateReadonlyShellCommandInternal(command, depth) {
+    if (depth > 8) {
+        return {
+            ok: false,
+            failure: {
+                reason: 'MAX_DEPTH',
+                rejectedSegment: command.trim() === '' ? command : command.trim(),
+            },
+        };
+    }
     const trimmed = command.trimStart();
     if (trimmed.startsWith('cd ')) {
         const parsed = parseCdChain(trimmed);
-        if (!parsed)
-            return false;
+        if (!parsed) {
+            return { ok: false, failure: { reason: 'INVALID_CD_SYNTAX', rejectedSegment: trimmed } };
+        }
         const dir = parsed.dir.replace(/^["']|["']$/g, '');
-        if (!isSafeRelativePath(dir))
-            return false;
-        return isAllowedReadonlyShellCommandInternal(parsed.rest, depth + 1);
+        if (!isSafeRelativePath(dir)) {
+            return {
+                ok: false,
+                failure: {
+                    reason: 'UNSAFE_RELATIVE_PATH',
+                    rejectedSegment: `cd ${parsed.dir}`,
+                },
+            };
+        }
+        return validateReadonlyShellCommandInternal(parsed.rest, depth + 1);
+    }
+    const chainParsed = splitTopLevelReadonlyShellChain(trimmed);
+    if (!chainParsed.ok) {
+        return {
+            ok: false,
+            failure: {
+                reason: chainParsed.reason,
+                rejectedSegment: chainParsed.rejectedSegment,
+            },
+        };
+    }
+    if (chainParsed.segments.length > 1) {
+        for (const segment of chainParsed.segments) {
+            const segmentValidation = validateReadonlyShellCommandInternal(segment, depth + 1);
+            if (!segmentValidation.ok) {
+                return segmentValidation;
+            }
+        }
+        return { ok: true };
     }
     if (trimmed.startsWith('git -C ')) {
         // Allow a narrow, read-only subset of `git -C <dir> <subcommand> ...` as long as <dir> looks
@@ -619,23 +665,129 @@ function isAllowedReadonlyShellCommandInternal(command, depth) {
             const dirRaw = tokens[2] ?? '';
             const dir = dirRaw.replace(/^["']|["']$/g, '');
             const subcommand = tokens[3] ?? '';
-            if (isSafeRelativePath(dir)) {
-                if (subcommand === 'show' ||
-                    subcommand === 'status' ||
-                    subcommand === 'diff' ||
-                    subcommand === 'log' ||
-                    subcommand === 'blame') {
-                    return true;
-                }
+            if (!isSafeRelativePath(dir)) {
+                return { ok: false, failure: { reason: 'GIT_C_UNSAFE_PATH', rejectedSegment: trimmed } };
+            }
+            if (subcommand === 'show' ||
+                subcommand === 'status' ||
+                subcommand === 'diff' ||
+                subcommand === 'log' ||
+                subcommand === 'blame') {
+                return { ok: true };
             }
+            return {
+                ok: false,
+                failure: { reason: 'GIT_C_UNSUPPORTED_SUBCOMMAND', rejectedSegment: trimmed },
+            };
         }
+        return { ok: false, failure: { reason: 'GIT_C_INVALID', rejectedSegment: trimmed } };
+    }
+    if (isAllowedReadonlyShellVersionProbe(trimmed)) {
+        return { ok: true };
     }
     for (const prefix of readonlyShellAllowedPrefixes) {
         if (trimmed === prefix || trimmed.startsWith(`${prefix} `)) {
-            return true;
+            return { ok: true };
         }
     }
-    return false;
+    return { ok: false, failure: { reason: 'COMMAND_NOT_ALLOWLISTED', rejectedSegment: trimmed } };
+}
+function splitTopLevelReadonlyShellChain(command) {
+    const segments = [];
+    let quote = null;
+    let escape = false;
+    let segmentStart = 0;
+    const pushSegment = (endExclusive) => {
+        const segment = command.slice(segmentStart, endExclusive).trim();
+        if (segment === '')
+            return false;
+        segments.push(segment);
+        return true;
+    };
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i] ?? '';
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else if (ch === '\\' && quote === '"') {
+                escape = true;
+            }
+            continue;
+        }
+        if (ch === '\\') {
+            escape = true;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        const next = command[i + 1] ?? '';
+        if ((ch === '&' && next === '&') || (ch === '|' && next === '|')) {
+            if (!pushSegment(i)) {
+                return {
+                    ok: false,
+                    reason: 'CHAIN_PARSE_EMPTY_SEGMENT',
+                    rejectedSegment: command.trim(),
+                };
+            }
+            i += 1;
+            segmentStart = i + 1;
+            continue;
+        }
+        if (ch === '|') {
+            if (!pushSegment(i)) {
+                return {
+                    ok: false,
+                    reason: 'CHAIN_PARSE_EMPTY_SEGMENT',
+                    rejectedSegment: command.trim(),
+                };
+            }
+            segmentStart = i + 1;
+            continue;
+        }
+        if (ch === ';') {
+            return {
+                ok: false,
+                reason: 'CHAIN_PARSE_UNSUPPORTED_OPERATOR',
+                rejectedSegment: command.slice(segmentStart).trim() || command.trim(),
+            };
+        }
+        if (ch === '&') {
+            return {
+                ok: false,
+                reason: 'CHAIN_PARSE_UNSUPPORTED_OPERATOR',
+                rejectedSegment: command.slice(segmentStart).trim() || command.trim(),
+            };
+        }
+    }
+    if (quote) {
+        return {
+            ok: false,
+            reason: 'CHAIN_PARSE_UNTERMINATED_QUOTE',
+            rejectedSegment: command.trim(),
+        };
+    }
+    if (escape) {
+        return {
+            ok: false,
+            reason: 'CHAIN_PARSE_TRAILING_ESCAPE',
+            rejectedSegment: command.trim(),
+        };
+    }
+    if (!pushSegment(command.length)) {
+        return {
+            ok: false,
+            reason: 'CHAIN_PARSE_EMPTY_SEGMENT',
+            rejectedSegment: command.trim(),
+        };
+    }
+    return { ok: true, segments };
 }
 function isSafeRelativePath(dir) {
     const hasParentTraversal = /(^|[\\/])\.\.([\\/]|$)/.test(dir);
@@ -722,6 +874,80 @@ function splitShellTokens(command) {
     push();
     return out;
 }
+function firstReadonlyShellToken(segment) {
+    const tokens = splitShellTokens(segment.trim());
+    return tokens[0]?.text ?? '';
+}
+function getReadonlyShellSuggestionEn(failure) {
+    const token = firstReadonlyShellToken(failure.rejectedSegment);
+    if (failure.reason === 'CHAIN_PARSE_UNSUPPORTED_OPERATOR' ||
+        failure.reason === 'CHAIN_PARSE_EMPTY_SEGMENT') {
+        return 'Use only `|`, `&&`, `||` for chaining. Example: `ls || true`.';
+    }
+    if (failure.reason === 'CHAIN_PARSE_UNTERMINATED_QUOTE' ||
+        failure.reason === 'CHAIN_PARSE_TRAILING_ESCAPE') {
+        return 'Fix shell quoting first, then run an allowlisted segment (for example: `ls` or `rg <pattern>`).';
+    }
+    if (failure.reason === 'INVALID_CD_SYNTAX' || failure.reason === 'UNSAFE_RELATIVE_PATH') {
+        return 'Use `cd <relative-path> && <allowed command...>`.';
+    }
+    if (failure.reason === 'GIT_C_INVALID' ||
+        failure.reason === 'GIT_C_UNSAFE_PATH' ||
+        failure.reason === 'GIT_C_UNSUPPORTED_SUBCOMMAND') {
+        return 'Use `git -C <relative-path> <show|status|diff|log|blame> ...`.';
+    }
+    if (failure.reason === 'MAX_DEPTH') {
+        return 'Reduce nested chaining depth (for example split into smaller `readonly_shell` calls).';
+    }
+    if (token === 'node')
+        return 'Only version probes are allowed: `node --version || true`.';
+    if (token === 'python3' || token === 'python') {
+        return 'Only version probes are allowed: `python3 --version || true`.';
+    }
+    if (token === 'false')
+        return 'Use `true` as fallback (for example: `ls || true`).';
+    if (token === 'git') {
+        return 'Use `git <show|status|diff|log|blame> ...` or `git -C <relative-path> <show|status|diff|log|blame> ...`.';
+    }
+    if (token === 'cd')
+        return 'Use `cd <relative-path> && <allowed command...>`.';
+    return 'Use an allowlisted read-only segment (for example: `ls`, `rg <pattern>`, or `git status`).';
+}
+function getReadonlyShellSuggestionZh(failure) {
+    const token = firstReadonlyShellToken(failure.rejectedSegment);
+    if (failure.reason === 'CHAIN_PARSE_UNSUPPORTED_OPERATOR' ||
+        failure.reason === 'CHAIN_PARSE_EMPTY_SEGMENT') {
+        return '仅使用 `|`、`&&`、`||` 串联；示例：`ls || true`。';
+    }
+    if (failure.reason === 'CHAIN_PARSE_UNTERMINATED_QUOTE' ||
+        failure.reason === 'CHAIN_PARSE_TRAILING_ESCAPE') {
+        return '先修正引号/转义，再执行白名单子命令（例如：`ls` 或 `rg <pattern>`）。';
+    }
+    if (failure.reason === 'INVALID_CD_SYNTAX' || failure.reason === 'UNSAFE_RELATIVE_PATH') {
+        return '请使用 `cd <相对路径> && <允许命令...>`。';
+    }
+    if (failure.reason === 'GIT_C_INVALID' ||
+        failure.reason === 'GIT_C_UNSAFE_PATH' ||
+        failure.reason === 'GIT_C_UNSUPPORTED_SUBCOMMAND') {
+        return '请使用 `git -C <相对路径> <show|status|diff|log|blame> ...`。';
+    }
+    if (failure.reason === 'MAX_DEPTH') {
+        return '请降低链式嵌套深度（可拆成多次 `readonly_shell` 调用）。';
+    }
+    if (token === 'node')
+        return '仅允许版本探针：`node --version || true`。';
+    if (token === 'python3' || token === 'python') {
+        return '仅允许版本探针：`python3 --version || true`。';
+    }
+    if (token === 'false')
+        return '兜底请用 `true`（例如：`ls || true`）。';
+    if (token === 'git') {
+        return '可改为 `git <show|status|diff|log|blame> ...`，或 `git -C <相对路径> <show|status|diff|log|blame> ...`。';
+    }
+    if (token === 'cd')
+        return '可改为 `cd <相对路径> && <允许命令...>`。';
+    return '请改用白名单只读子命令（例如：`ls`、`rg <pattern>`、`git status`）。';
+}
 function normalizeRelFromRtwsRoot(relPath) {
     return relPath.replace(/\\/g, '/').replace(/^\/+/, '');
 }
@@ -892,10 +1118,10 @@ function detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command)
 exports.readonlyShellTool = {
     type: 'func',
     name: 'readonly_shell',
-    description: 'Execute a read-only shell command from a small allowlist (cat, rg, sed, ls, nl, wc, head, tail, stat, file, uname, whoami, id, echo, pwd, which, date, diff, realpath, readlink, printf, cut, sort, uniq, tr, awk, shasum, sha256sum, md5sum, uuid, git show, git status, git diff, git log, git blame, find, tree, jq; also supports: git -C <relative-path> <show|status|diff|log|blame> ...; also supports: cd <relative-path> && <allowed command...> (or ||)). Commands outside the allowlist are rejected.',
+    description: 'Execute a read-only shell command from a small allowlist. Only exact version probes are allowed for node/python (no scripts such as `node -e` or `python3 -c`). Command chains via |/&&/|| are validated segment-by-segment. Commands outside the allowlist are rejected.',
     descriptionI18n: {
-        en: 'Execute a read-only shell command from a small allowlist (cat, rg, sed, ls, nl, wc, head, tail, stat, file, uname, whoami, id, echo, pwd, which, date, diff, realpath, readlink, printf, cut, sort, uniq, tr, awk, shasum, sha256sum, md5sum, uuid, git show, git status, git diff, git log, git blame, find, tree, jq; also supports: git -C <relative-path> <show|status|diff|log|blame> ...; also supports: cd <relative-path> && <allowed command...> (or ||)). You are explicitly authorized to call this tool yourself (no delegation). Commands outside the allowlist are rejected.',
-        zh: '执行只读 shell 命令（仅允许：cat、rg、sed、ls、nl、wc、head、tail、stat、file、uname、whoami、id、echo、pwd、which、date、diff、realpath、readlink、printf、cut、sort、uniq、tr、awk、shasum、sha256sum、md5sum、uuid、git show、git status、git diff、git log、git blame、find、tree、jq；另支持：git -C <相对路径> <show|status|diff|log|blame> ...；另支持：cd <相对路径> && <允许命令...>（或 ||））。你已被明确授权自行调用该工具（无需委派）。不在允许列表内的命令会被拒绝。',
+        en: 'Execute a read-only shell command from a small allowlist. Only exact version probes are allowed for node/python (no scripts such as `node -e` or `python3 -c`). Command chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call this tool yourself (no delegation). Commands outside the allowlist are rejected.',
+        zh: '执行只读 shell 命令，仅允许少量白名单命令前缀。对 node/python 仅允许版本探针（不允许 `node -e` / `python3 -c` 这类脚本）。通过 |/&&/|| 串联时会按子命令逐段校验。你已被明确授权自行调用该工具（无需委派）。不在允许列表内的命令会被拒绝。',
     },
     parameters: readonlyShellSchema,
     async call(dlg, caller, args) {
@@ -908,17 +1134,28 @@ exports.readonlyShellTool = {
                 ? `❌ readonly_shell 不建议执行多行脚本式命令（检测到换行符）。请用单行命令（允许 |、&&、||）。\n收到：${command}`
                 : `❌ readonly_shell does not allow multi-line script-style commands (newline detected). Use a single-line command (|, &&, || are allowed).\nGot: ${command}`;
         }
-        if (!isAllowedReadonlyShellCommand(command)) {
+        const validation = validateReadonlyShellCommand(command);
+        if (!validation.ok) {
             const allowedList = readonlyShellAllowedPrefixes.join(', ');
+            const rejectedSegment = validation.failure.rejectedSegment.trim();
+            const rejectedSegmentOrCommand = rejectedSegment === '' ? command : rejectedSegment;
+            const suggestion = language === 'zh'
+                ? getReadonlyShellSuggestionZh(validation.failure)
+                : getReadonlyShellSuggestionEn(validation.failure);
             return language === 'zh'
-                ? `❌ readonly_shell 仅允许以下命令前缀：${allowedList}\n另外允许：git -C <相对路径> <show|status|diff|log|blame> ...\n另外允许：cd <相对路径> && <允许命令...>（或 ||）\n收到：${command}`
-                : `❌ readonly_shell only allows these command prefixes: ${allowedList}\nAlso allowed: git -C <relative-path> <show|status|diff|log|blame> ...\nAlso allowed: cd <relative-path> && <allowed command...> (or ||)\nGot: ${command}`;
+                ? `❌ readonly_shell 仅允许以下命令前缀：${allowedList}\n另外允许（仅版本探针）：node --version|-v、python3 --version|-V\n脚本执行（如 node -e / python3 -c）一律拒绝。\n另外允许：git -C <相对路径> <show|status|diff|log|blame> ...\n另外允许：cd <相对路径> && <允许命令...>（或 ||）\n说明：通过 |/&&/|| 串联时会按子命令逐段校验。\n被拒子命令段：${rejectedSegmentOrCommand}\n允许的等价写法：${suggestion}\n收到：${command}`
+                : `❌ readonly_shell only allows these command prefixes: ${allowedList}\nAlso allowed (exact version probes only): node --version|-v, python3 --version|-V\nNode/python scripts (for example: node -e, python3 -c) are rejected.\nAlso allowed: git -C <relative-path> <show|status|diff|log|blame> ...\nAlso allowed: cd <relative-path> && <allowed command...> (or ||)\nNote: chains via |/&&/|| are validated segment-by-segment.\nRejected segment: ${rejectedSegmentOrCommand}\nAllowed equivalent: ${suggestion}\nGot: ${command}`;
         }
         const forbiddenHiddenDir = detectReadonlyShellForbiddenHiddenDirAccess(path_1.default.resolve(process.cwd()), command);
         if (forbiddenHiddenDir) {
+            if (forbiddenHiddenDir === '.minds') {
+                return language === 'zh'
+                    ? `❌ **访问被拒绝**\n\n- 工具：\`readonly_shell\`\n- 路径：\`.minds/\`\n- 代码：\`ACCESS_DENIED\`\n\n说明：\`.minds/\` 是 rtws 根目录下的保留目录，readonly_shell 无条件拒绝访问。\n\n提示：\n- 若团队配置了 \`team-mgmt\` 工具集，请使用其中工具（\`team_mgmt_*\`）代管 \`.minds/**\`。\n- 若团队未配置该工具集或你不具备权限，请诉请具备 \`team-mgmt\` 权限的成员/团队管理员成员代管。\n- 若需要排查 Dominds，请在子目录 rtws 下复现（例如 \`ux-rtws/.dialogs/**\`）。`
+                    : `❌ **Access Denied**\n\n- Tool: \`readonly_shell\`\n- Path: \`.minds/\`\n- Code: \`ACCESS_DENIED\`\n\nNote: \`.minds/\` is a reserved directory at the rtws root; readonly_shell hard-denies access.\n\nHints:\n- If your team configured the \`team-mgmt\` toolset, use its tools (\`team_mgmt_*\`) to manage \`.minds/**\`.\n- If the toolset is not configured or you don\'t have permission, tellask a team-admin / a member with \`team-mgmt\` access to manage it for you.\n- For Dominds debugging, reproduce under a nested rtws (e.g. \`ux-rtws/.dialogs/**\`).`;
+            }
             return language === 'zh'
-                ? `❌ **访问被拒绝**\n\n- 工具：\`readonly_shell\`\n- 路径：\`${forbiddenHiddenDir}/\`\n- 代码：\`ACCESS_DENIED\`\n\n说明：\`${forbiddenHiddenDir}/\` 是 rtws 根目录下的保留目录，readonly_shell 无条件拒绝访问。\n\n提示：\n- 若需要访问 \`.minds/**\`，请使用 \`team_mgmt_*\` 工具。\n- 若需要排查 Dominds，请在子目录 rtws 下复现（例如 \`ux-rtws/.dialogs/**\`）。`
-                : `❌ **Access Denied**\n\n- Tool: \`readonly_shell\`\n- Path: \`${forbiddenHiddenDir}/\`\n- Code: \`ACCESS_DENIED\`\n\nNote: \`${forbiddenHiddenDir}/\` is a reserved directory at the rtws root; readonly_shell hard-denies access.\n\nHints:\n- To access \`.minds/**\`, use \`team_mgmt_*\` tools.\n- For Dominds debugging, reproduce under a nested rtws (e.g. \`ux-rtws/.dialogs/**\`).`;
+                ? `❌ **访问被拒绝**\n\n- 工具：\`readonly_shell\`\n- 路径：\`.dialogs/\`\n- 代码：\`ACCESS_DENIED\`\n\n说明：\`.dialogs/\` 是 rtws 根目录下的保留目录，readonly_shell 无条件拒绝访问。\n\n提示：\n- 若需要排查 Dominds，请在子目录 rtws 下复现（例如 \`ux-rtws/.dialogs/**\`）。`
+                : `❌ **Access Denied**\n\n- Tool: \`readonly_shell\`\n- Path: \`.dialogs/\`\n- Code: \`ACCESS_DENIED\`\n\nNote: \`.dialogs/\` is a reserved directory at the rtws root; readonly_shell hard-denies access.\n\nHints:\n- For Dominds debugging, reproduce under a nested rtws (e.g. \`ux-rtws/.dialogs/**\`).`;
         }
         const stdoutBuffer = new HeadTailByteBuffer(1024 * 1024);
         const stderrBuffer = new HeadTailByteBuffer(1024 * 1024);