dominds 0.8.19 → 0.9.0

package/README.md

@@ -167,9 +167,13 @@ Then:
 1. Your browser should land on `http://localhost:5666/setup` (either directly, or via an automatic redirect).
 2. In **Setup**, pick a provider + model. If your template didn’t create `.minds/team.yaml`, use Setup to create/overwrite it (this writes a minimal `member_defaults` config).
 3. Still in **Setup**, set the required provider env var (the name comes from the provider catalog, e.g. `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `CODEX_HOME`, etc.).
-   - The setup UI can write it into `~/.zshrc` / `~/.bashrc` in a managed block, and also applies it to the running server process immediately.
+   - The setup UI can write it to `.env.local` (all platforms), and on Linux/macOS it can also write into `~/.zshrc` / `~/.bashrc` in managed blocks. It also applies the value to the running server process immediately.
 4. Click **Go to App**, create a dialog, and start working.
 
+Platform note:
+
+- On Windows, the runtime does not register the `codex_style_tools` toolset. Do not grant `codex_style_tools` in `.minds/team.yaml` for Windows hosts.
+
 ## Start from scratch
 
 Starting from scratch means: create an empty folder, run `dominds`, let Setup generate the minimal `.minds/team.yaml`, then use the shadow team manager (`@fuxi`) to design a real team for your product.

package/README.zh.md

@@ -89,9 +89,13 @@ dominds
 首次启动后，通常会自动跳转至 `http://localhost:5666/setup` 配置页面，按以下步骤操作：
 
 1. 选择提供商（provider）及模型（model），创建或覆盖 `.minds/team.yaml`（最小化可运行配置文件）。
-2. 根据提示设置提供商所需的环境变量（配置页可协助将变量写入 `~/.zshrc` 或 `~/.bashrc` 的托管区块）。
+2. 根据提示设置提供商所需的环境变量（配置页可将变量写入 `.env.local`，并在 Linux/macOS 上额外支持写入 `~/.zshrc` 或 `~/.bashrc` 的托管区块）。
 3. 进入主界面，创建对话即可开始工作（对话、记忆、差遣牒等运行态数据均存储在当前 rtws 下）。
 
+平台说明：
+
+- Windows 运行时不会注册 `codex_style_tools` 工具集。在 Windows 主机上的 `.minds/team.yaml` 中不要授予 `codex_style_tools`。
+
 ## 从零开始（空文件夹启动）
 
 若暂无模板或团队配置，可直接从空目录启动：

package/dist/access-control.js

@@ -10,7 +10,7 @@ exports.getAccessDeniedMessage = getAccessDeniedMessage;
 /**
  * Module: access-control
  *
- * Directory-based access control helpers:
+ * Directory/file-extension based access control helpers:
  * - `matchesPattern` for glob-like directory scope matching (supports `*` and `**`)
  * - `hasReadAccess`/`hasWriteAccess` to evaluate member permissions
  * - `getAccessDeniedMessage` to format denial responses
@@ -31,6 +31,41 @@ function isRootDialogsPath(targetPath) {
     const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
     return normalized === '.dialogs' || normalized.startsWith('.dialogs/');
 }
+function normalizeFileExtName(raw) {
+    return raw.trim().toLowerCase().replace(/^\.+/, '');
+}
+function extractFileExtName(targetPath) {
+    const normalized = targetPath.replace(/\\/g, '/').replace(/\/+$/g, '');
+    if (normalized === '' || normalized === '.')
+        return undefined;
+    const baseName = normalized.split('/').pop();
+    if (!baseName || baseName === '.' || baseName === '..')
+        return undefined;
+    const dotIndex = baseName.lastIndexOf('.');
+    if (dotIndex <= 0 || dotIndex === baseName.length - 1)
+        return undefined;
+    return normalizeFileExtName(baseName.slice(dotIndex + 1));
+}
+function hasFileExtAccess(fileExtName, whitelist, blacklist) {
+    // Extension rules only apply to file-like paths with a detectable extension.
+    if (!fileExtName)
+        return true;
+    for (const ext of blacklist ?? []) {
+        if (normalizeFileExtName(ext) === fileExtName) {
+            return false;
+        }
+    }
+    const allow = whitelist ?? [];
+    if (allow.length === 0) {
+        return true;
+    }
+    for (const ext of allow) {
+        if (normalizeFileExtName(ext) === fileExtName) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Directory-specific pattern matching for access control.
  * This function determines if a target path (file or directory) should be controlled
@@ -142,8 +177,10 @@ function matchesPattern(targetPath, dirPattern) {
  * Access control logic:
  * 1. Check blacklist first (no_read_dirs) - if path matches any blacklist pattern, deny access
  * 2. Check whitelist (read_dirs) - if path matches any whitelist pattern, allow access
- * 3. If no whitelist patterns are defined, allow access (default allow)
- * 4. If whitelist patterns exist but none match, deny access
+ * 3. Check extension blacklist (no_read_file_ext_names) - if extension matches, deny access
+ * 4. Check extension whitelist (read_file_ext_names)
+ * 5. If no whitelist patterns are defined for a dimension, allow access (default allow)
+ * 6. If whitelist patterns exist but none match, deny access
  */
 function hasReadAccess(member, targetPath) {
     // Get resolved relative path from rtws root
@@ -183,17 +220,19 @@ function hasReadAccess(member, targetPath) {
     const whitelist = member.read_dirs || [];
     // Note: `.minds/**` is handled above as a hard deny (unless internal bypass is enabled).
     // If no whitelist is defined, allow access (after blacklist check)
-    if (whitelist.length === 0) {
-        return true;
-    }
-    // Check if path matches any whitelist pattern
-    for (const pattern of whitelist) {
-        if (matchesPattern(relativePath, pattern)) {
-            return true; // Explicitly allowed
+    let directoryAllowed = whitelist.length === 0;
+    if (!directoryAllowed) {
+        // Check if path matches any whitelist pattern
+        for (const pattern of whitelist) {
+            if (matchesPattern(relativePath, pattern)) {
+                directoryAllowed = true;
+                break;
+            }
         }
     }
-    // Path doesn't match any whitelist pattern
-    return false;
+    if (!directoryAllowed)
+        return false;
+    return hasFileExtAccess(extractFileExtName(relativePath), member.read_file_ext_names, member.no_read_file_ext_names);
 }
 /**
  * Check if a member has write access to a specific path.
@@ -201,8 +240,10 @@ function hasReadAccess(member, targetPath) {
  * Access control logic:
  * 1. Check blacklist first (no_write_dirs) - if path matches any blacklist pattern, deny access
  * 2. Check whitelist (write_dirs) - if path matches any whitelist pattern, allow access
- * 3. If no whitelist patterns are defined, allow access (default allow)
- * 4. If whitelist patterns exist but none match, deny access
+ * 3. Check extension blacklist (no_write_file_ext_names) - if extension matches, deny access
+ * 4. Check extension whitelist (write_file_ext_names)
+ * 5. If no whitelist patterns are defined for a dimension, allow access (default allow)
+ * 6. If whitelist patterns exist but none match, deny access
  */
 function hasWriteAccess(member, targetPath) {
     // Get resolved relative path from rtws root
@@ -242,17 +283,19 @@ function hasWriteAccess(member, targetPath) {
     const whitelist = member.write_dirs || [];
     // Note: `.minds/**` is handled above as a hard deny (unless internal bypass is enabled).
     // If no whitelist is defined, allow access (after blacklist check)
-    if (whitelist.length === 0) {
-        return true;
-    }
-    // Check if path matches any whitelist pattern
-    for (const pattern of whitelist) {
-        if (matchesPattern(relativePath, pattern)) {
-            return true; // Explicitly allowed
+    let directoryAllowed = whitelist.length === 0;
+    if (!directoryAllowed) {
+        // Check if path matches any whitelist pattern
+        for (const pattern of whitelist) {
+            if (matchesPattern(relativePath, pattern)) {
+                directoryAllowed = true;
+                break;
+            }
         }
     }
-    // Path doesn't match any whitelist pattern
-    return false;
+    if (!directoryAllowed)
+        return false;
+    return hasFileExtAccess(extractFileExtName(relativePath), member.write_file_ext_names, member.no_write_file_ext_names);
 }
 /**
  * Get an access denied error message for a specific operation and path.
@@ -308,5 +351,11 @@ function getAccessDeniedMessage(operation, targetPath, language = 'en') {
             lines.push(`- Hint: For Dominds debugging, reproduce in a nested rtws (e.g. \`ux-rtws/.dialogs/\`), which is not covered by this hard deny.`);
         }
     }
+    if (language === 'zh') {
+        lines.push(`- 说明：该路径可能命中目录权限（\`read_dirs/write_dirs/no_*_dirs\`）或扩展名权限（\`*_file_ext_names/no_*_file_ext_names\`）。`);
+    }
+    else {
+        lines.push(`- Note: This path may be blocked by directory rules (\`read_dirs/write_dirs/no_*_dirs\`) or file-extension rules (\`*_file_ext_names/no_*_file_ext_names\`).`);
+    }
     return lines.join('\n');
 }

package/dist/docs/team_mgmt-toolset.md

@@ -424,6 +424,7 @@ Best practices:
 
 - Make `member_defaults` conservative. Grant additional tools/dirs on a per-member basis.
 - Prefer toolsets over individually enumerating tools unless you need a one-off tool.
+- Platform note: Windows runtime intentionally does not register `codex_style_tools`; do not grant that toolset in `.minds/team.yaml` on Windows hosts.
 - Keep `.minds/team.yaml` ownership tight; only the team manager should be able to edit it.
 - Avoid repeating built-in constraints in `team.yaml`:
   - `*.tsk/**` (encapsulated Taskdocs) are hard-denied for all general file tools.

package/dist/docs/team_mgmt-toolset.zh.md

@@ -370,6 +370,7 @@ members:
 
 - 使 `member_defaults` 保守。按成员授予额外的工具/目录
 - 优先使用工具集而不是单独枚举工具，除非你需要一次性工具
+- 平台说明：Windows 运行时不会注册 `codex_style_tools`；在 Windows 主机上的 `.minds/team.yaml` 中不要授予该工具集
 - 保持 `.minds/team.yaml` 的所有权严格；只有团队管理者应该能够编辑它
 - 避免在 `team.yaml` 中重复内置约束：
   - `*.tsk/**`（封装的 Taskdocs）对所有通用文件工具被硬性拒绝

package/dist/server/setup-routes.js

@@ -19,14 +19,17 @@ const team_config_updates_1 = require("../team-config-updates");
 const log = (0, log_1.createLogger)('setup-routes');
 const TEAM_YAML_PATH = path_1.default.join('.minds', 'team.yaml');
 const RTWS_LLM_YAML_PATH = path_1.default.join('.minds', 'llm.yaml');
+const RTWS_ENV_LOCAL_PATH = '.env.local';
 const BUILTIN_DEFAULTS_YAML_PATH = path_1.default.join(__dirname, '..', 'llm', 'defaults.yaml');
 const DOMINDS_ENV_BLOCK_START = '# >>> dominds env >>>';
 const DOMINDS_ENV_BLOCK_END = '# <<< dominds env <<<';
 async function buildSetupStatusResponse() {
     const builtin = await loadBuiltinProviders();
     const merged = await client_1.LlmConfig.load();
+    const shellPlatform = resolveSetupPlatform(process.platform);
     const shellEnv = typeof process.env.SHELL === 'string' ? process.env.SHELL : null;
     const shellKind = resolveShellKind(shellEnv);
+    const envLocal = await statRcFile(RTWS_ENV_LOCAL_PATH);
     const home = os_1.default.homedir();
     const bashrcPath = path_1.default.join(home, '.bashrc');
     const zshrcPath = path_1.default.join(home, '.zshrc');
@@ -44,7 +47,13 @@ async function buildSetupStatusResponse() {
         return {
             success: false,
             requirement,
-            shell: { env: shellEnv, kind: shellKind, defaultRc: shellKindToDefaultRc(shellKind) },
+            shell: {
+                platform: shellPlatform,
+                env: shellEnv,
+                kind: shellKind,
+                defaultRc: shellKindToDefaultRc(shellKind),
+            },
+            envLocal,
             rc,
             teamYaml,
             rtwsLlmYaml,
@@ -53,13 +62,20 @@ async function buildSetupStatusResponse() {
         };
     }
     const providers = await buildProviderSummaries(builtin.providers, builtin.providerKeysInOrder, {
+        envLocalPath: RTWS_ENV_LOCAL_PATH,
         bashrcPath,
         zshrcPath,
     });
     return {
         success: true,
         requirement,
-        shell: { env: shellEnv, kind: shellKind, defaultRc: shellKindToDefaultRc(shellKind) },
+        shell: {
+            platform: shellPlatform,
+            env: shellEnv,
+            kind: shellKind,
+            defaultRc: shellKindToDefaultRc(shellKind),
+        },
+        envLocal,
         rc,
         teamYaml,
         rtwsLlmYaml,
@@ -117,15 +133,27 @@ async function handleWriteShellEnv(rawBody) {
     try {
         // Apply to the current backend process immediately so setup can proceed without a restart.
         process.env[req.envVar] = req.value;
-        const home = os_1.default.homedir();
-        const targets = req.targets;
-        const outcomes = [];
-        for (const target of targets) {
-            const filePath = path_1.default.join(home, target === 'bashrc' ? '.bashrc' : '.zshrc');
-            const result = await upsertEnvVarIntoRcFile(filePath, req.envVar, req.value);
-            outcomes.push({ target, path: filePath, result });
+        let filePath;
+        let result;
+        if (req.target === 'env_local') {
+            filePath = RTWS_ENV_LOCAL_PATH;
+            result = await upsertEnvVarIntoDotenvFile(filePath, req.envVar, req.value);
+        }
+        else {
+            if (!isPosixSetupPlatform(process.platform)) {
+                return {
+                    kind: 'bad_request',
+                    errorText: `Unsupported target on this platform: ${req.target}`,
+                };
+            }
+            const home = os_1.default.homedir();
+            filePath = path_1.default.join(home, req.target === 'bashrc' ? '.bashrc' : '.zshrc');
+            result = await upsertEnvVarIntoRcFile(filePath, req.envVar, req.value);
         }
-        return { kind: 'ok', response: { success: true, outcomes } };
+        return {
+            kind: 'ok',
+            response: { success: true, outcome: { target: req.target, path: filePath, result } },
+        };
     }
     catch (error) {
         log.error('Failed to write shell env vars', error);
@@ -270,8 +298,9 @@ async function buildProviderSummaries(providers, providerKeysInOrder, paths) {
     for (const [providerKey, cfg] of orderedProviderEntries(providers, providerKeysInOrder)) {
         const envVar = cfg.apiKeyEnvVar;
         const envVarIsSet = typeof process.env[envVar] === 'string' && process.env[envVar] !== '';
-        const bashrcHas = await rcHasEnvVar(paths.bashrcPath, envVar);
-        const zshrcHas = await rcHasEnvVar(paths.zshrcPath, envVar);
+        const envLocalHas = await fileHasEnvVar(paths.envLocalPath, envVar);
+        const bashrcHas = await fileHasEnvVar(paths.bashrcPath, envVar);
+        const zshrcHas = await fileHasEnvVar(paths.zshrcPath, envVar);
         const models = Object.entries(cfg.models ?? {}).map(([modelKey, modelInfo]) => {
             const info = isRecord(modelInfo) ? modelInfo : {};
             const name = typeof info.name === 'string' ? info.name : undefined;
@@ -298,7 +327,7 @@ async function buildProviderSummaries(providers, providerKeysInOrder, paths) {
             apiKeyEnvVar: envVar,
             techSpecUrl: cfg.tech_spec_url,
             apiMgmtUrl: cfg.api_mgmt_url,
-            envVar: { isSet: envVarIsSet, bashrcHas, zshrcHas },
+            envVar: { isSet: envVarIsSet, envLocalHas, bashrcHas, zshrcHas },
             models,
             ...(prominent.length > 0 ? { prominentModelParams: prominent } : {}),
         };
@@ -515,6 +544,18 @@ async function resolveSetupRequirement(params) {
     }
     return { kind: 'ok' };
 }
+function resolveSetupPlatform(platform) {
+    if (platform === 'win32')
+        return 'windows';
+    if (platform === 'darwin')
+        return 'macos';
+    if (platform === 'linux')
+        return 'linux';
+    return 'other';
+}
+function isPosixSetupPlatform(platform) {
+    return platform === 'darwin' || platform === 'linux';
+}
 function resolveShellKind(shellEnv) {
     if (!shellEnv)
         return 'other';
@@ -537,21 +578,14 @@ function parseWriteShellEnvRequest(value) {
         return null;
     const envVar = value['envVar'];
     const rawVal = value['value'];
-    const targetsUnknown = value['targets'];
+    const target = value['target'];
     if (typeof envVar !== 'string' || !isSafeEnvVarName(envVar))
         return null;
     if (typeof rawVal !== 'string')
         return null;
-    if (!Array.isArray(targetsUnknown))
-        return null;
-    const targets = [];
-    for (const t of targetsUnknown) {
-        if (t === 'bashrc' || t === 'zshrc')
-            targets.push(t);
-    }
-    if (targets.length === 0)
+    if (target !== 'env_local' && target !== 'bashrc' && target !== 'zshrc')
         return null;
-    return { envVar, value: rawVal, targets };
+    return { envVar, value: rawVal, target };
 }
 function parseWriteTeamYamlRequest(value) {
     if (!isRecord(value))
@@ -640,10 +674,10 @@ async function isWritable(filePath) {
         return false;
     }
 }
-async function rcHasEnvVar(rcPath, envVar) {
+async function fileHasEnvVar(filePath, envVar) {
     try {
-        const raw = await promises_1.default.readFile(rcPath, 'utf-8');
-        const re = new RegExp(`(^|\\n)\\s*export\\s+${escapeRegExp(envVar)}=`, 'm');
+        const raw = await promises_1.default.readFile(filePath, 'utf-8');
+        const re = new RegExp(`(^|\\n)\\s*(?:export\\s+)?${escapeRegExp(envVar)}\\s*=`, 'm');
         return re.test(raw);
     }
     catch {
@@ -657,6 +691,28 @@ function shellQuoteSingle(value) {
     // Safe POSIX shell single-quoted string: close quote, escape single quote, reopen.
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function dotenvQuoteDouble(value) {
+    const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t')
+        .replace(/"/g, '\\"');
+    return `"${escaped}"`;
+}
+async function upsertEnvVarIntoDotenvFile(filePath, envVar, value) {
+    const line = `${envVar}=${dotenvQuoteDouble(value)}`;
+    const exists = await fileExists(filePath);
+    const original = exists ? await promises_1.default.readFile(filePath, 'utf-8') : '';
+    const normalized = original.replace(/\r\n/g, '\n');
+    const lines = normalized === '' ? [] : normalized.split('\n');
+    const nextLines = upsertDotenvLine(lines, envVar, line);
+    let next = nextLines.join('\n');
+    if (!next.endsWith('\n'))
+        next += '\n';
+    await promises_1.default.writeFile(filePath, next, 'utf-8');
+    return exists ? 'updated' : 'created';
+}
 async function upsertEnvVarIntoRcFile(filePath, envVar, value) {
     const exportLine = `export ${envVar}=${shellQuoteSingle(value)}`;
     const exists = await fileExists(filePath);
@@ -684,6 +740,16 @@ async function upsertEnvVarIntoRcFile(filePath, envVar, value) {
     await promises_1.default.writeFile(filePath, next, 'utf-8');
     return exists ? 'updated' : 'created';
 }
+function upsertDotenvLine(lines, envVar, envLine) {
+    const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(envVar)}\\s*=`);
+    const idx = lines.findIndex((l) => re.test(l));
+    if (idx >= 0) {
+        const copy = [...lines];
+        copy[idx] = envLine;
+        return copy;
+    }
+    return [...lines, envLine];
+}
 function upsertExportLine(lines, envVar, exportLine) {
     const re = new RegExp(`^\\s*export\\s+${escapeRegExp(envVar)}=`);
     const idx = lines.findIndex((l) => re.test(l));

package/dist/static/assets/{_baseUniq-Bz-BK38X.js → _baseUniq-CoUduYbj.js}

@@ -1,4 +1,4 @@
-import { aV as isObjectLike, br as baseGetTag, aE as isArray, aT as Symbol$1, bs as arrayLikeKeys, bt as baseKeys, aD as isArrayLike, bu as memoize, bv as isArguments, bw as MapCache, bm as eq, bx as Uint8Array, aW as getTag, a$ as isBuffer, b2 as Stack, by as isTypedArray, aZ as isObject, bz as isLength, bp as isIndex, aF as identity, bn as baseFor, bA as Set } from "./index-BRtsWi20.js";
+import { aV as isObjectLike, br as baseGetTag, aE as isArray, aT as Symbol$1, bs as arrayLikeKeys, bt as baseKeys, aD as isArrayLike, bu as memoize, bv as isArguments, bw as MapCache, bm as eq, bx as Uint8Array, aW as getTag, a$ as isBuffer, b2 as Stack, by as isTypedArray, aZ as isObject, bz as isLength, bp as isIndex, aF as identity, bn as baseFor, bA as Set } from "./index-BWgwzFdG.js";
 var symbolTag$1 = "[object Symbol]";
 function isSymbol(value) {
   return typeof value == "symbol" || isObjectLike(value) && baseGetTag(value) == symbolTag$1;
@@ -658,4 +658,4 @@ export {
   hasIn as x,
   toString as y
 };
-//# sourceMappingURL=_baseUniq-Bz-BK38X.js.map
+//# sourceMappingURL=_baseUniq-CoUduYbj.js.map