dominds 1.15.3 → 1.15.4

package/dist/docs/team_mgmt-toolset.md

@@ -133,6 +133,9 @@ Notes:
   - For `team_mgmt`, that explicit allowlist is `.minds/**` (including `.minds/memory/**`) so the
     team manager can repair accidental corruptions made by other tools (even though `.minds/memory/**`
     already has dedicated `personal_memory` / `team_memory` tools for normal use).
+- Conversely, the denial of `.minds/**` / `*.tsk/**` for general file tools is a **built-in hard runtime
+  rule**, not a standard deny stanza you should keep repeating in `team.yaml`. Only additional
+  business-specific constraints belong in explicit `no_read_dirs` / `no_write_dirs`.
 - Require explicit `.minds/...` paths and validate them; do not support “implicitly scoped” paths
   like `team.yaml`.
 
@@ -444,19 +447,14 @@ member_defaults:
   toolsets:
     - ws_read
     - personal_memory
-  # Default posture: deny `.minds/` edits for normal members.
-  # (Team management should be done via `team_mgmt` tools, not general file tools.)
-  no_read_dirs:
-    - .minds/team.yaml
-    - .minds/llm.yaml
-    - .minds/mcp.yaml
-    - .minds/team/**
-  no_write_dirs:
-    - .minds/**
 
 default_responder: fuxi
 
 members:
+
+Note: in the normal-member example above, do **not** add `no_read_dirs` / `no_write_dirs` merely to
+restate that `.minds/**` is blocked. That boundary is already enforced by the runtime for general
+file tools; explicit deny entries should be reserved for extra constraints beyond the built-ins.
   # Example visible teammate (recommended): define at least one non-hidden responder for daily work.
   dev:
     name: Dev

package/dist/docs/team_mgmt-toolset.zh.md

@@ -110,6 +110,7 @@
   - 拒绝规范化后解析到 `.minds/` 之外的任何路径
 - 优先使用显式白名单而非" rtws 中的任何内容"
 - 对于 `team_mgmt`，该显式白名单是 `.minds/**`（包括 `.minds/memory/**`），以便团队管理者可以修复其他工具造成的意外损坏（即使 `.minds/memory/**` 已有专用的 `personal_memory` / `team_memory` 工具供正常使用）
+- 反过来，普通通用文件工具对 `.minds/**` / `*.tsk/**` 的拒绝是**系统内置硬约束**，不是需要在 `team.yaml` 里重复书写的常规 deny 项。只有额外业务约束才需要显式写入 `no_read_dirs` / `no_write_dirs`
 - 需要显式的 `.minds/...` 路径并验证它们；不支持像 `team.yaml` 这样的"隐式作用域"路径
 
 ### 为什么需要专用工具集（而不是仅 `read_dirs` / `write_dirs`）？
@@ -383,19 +384,12 @@ member_defaults:
   toolsets:
     - ws_read
     - personal_memory
-  # 默认姿态：拒绝普通成员的 `.minds/` 编辑
-  #（团队管理应通过 `team_mgmt` 工具完成，而非通用文件工具）
-  no_read_dirs:
-    - .minds/team.yaml
-    - .minds/llm.yaml
-    - .minds/mcp.yaml
-    - .minds/team/**
-  no_write_dirs:
-    - .minds/**
 
 default_responder: fuxi
 
 members:
+
+说明：上面的普通成员默认示例**不要**再额外写 `no_read_dirs` / `no_write_dirs` 去重复声明 `.minds/**` 拒绝。那是运行时内置边界，不是常规样板；只有要表达超出内置边界的额外 deny 规则时，才应显式写这些字段。
   # 示例显在成员（推荐）：至少定义一个非隐藏的响应者用于日常工作
   dev:
     name: Dev

package/dist/tools/team_mgmt.js

@@ -3147,8 +3147,6 @@ function renderTeamManual(language) {
             '      - ws_read\n' +
             '      - ws_mod\n' +
             (windowsHost ? '' : '      - codex_style_tools\n') +
-            "    no_read_dirs: ['.minds/**']\n" +
-            "    no_write_dirs: ['.minds/**']\n" +
             '  qa_guard:\n' +
             '    name: QA Guard\n' +
             '    gofor:\n' +
@@ -3209,8 +3207,6 @@ function renderTeamManual(language) {
         '      - ws_read\n' +
         '      - ws_mod\n' +
         (windowsHost ? '' : '      - codex_style_tools\n') +
-        "    no_read_dirs: ['.minds/**']\n" +
-        "    no_write_dirs: ['.minds/**']\n" +
         '```\n');
 }
 async function renderMcpManual(language) {
@@ -3389,6 +3385,8 @@ function renderPermissionsManual(language) {
                 '示例：`.minds/**` 会匹配 `.minds/team.yaml`、`.minds/team/<id>/persona.zh.md` 等；常用于限制普通成员访问 minds 资产。',
                 '`*.tsk/` 是封装差遣牒：只能用函数工具 `change_mind` 维护。任何通用文件工具都无法访问该目录树（硬编码无条件拒绝）。',
                 '`.minds/**` 是 rtws（运行时工作区）的“团队配置/记忆/资产”目录：任何通用文件工具都无法访问（硬编码无条件拒绝）。只有专用的 `.minds/` 工具集（例如 `team_mgmt`）可访问它。',
+                '因此，**不要**为了“重申系统内置限制”而在 `team.yaml` 里机械地添加 `no_read_dirs: [".minds/**"]` / `no_write_dirs: [".minds/**"]`（或出于同类目的添加 `*.tsk/**` deny）。这类条目不增加任何真实约束，只会制造样板噪音，并误导团队管理智能体以为它们是常规必填项。',
+                '原则：`team.yaml` 里的权限字段只写**额外**业务约束；系统内置的硬边界由运行时自己保证，不需要也不应重复书写。',
                 '说明：如果你在 `team.yaml` 的 allow-list（`read_dirs`/`write_dirs`）里写了 `.minds/**` 或 `*.tsk/**` 试图绕过限制，运行时会忽略并上报 err 级别问题。',
             ]) +
             fmtCodeBlock('yaml', [
@@ -3397,8 +3395,6 @@ function renderPermissionsManual(language) {
                 '  coder:',
                 '    read_dirs: ["dominds/**"]',
                 '    write_dirs: ["dominds/**"]',
-                '    no_read_dirs: [".minds/**"]',
-                '    no_write_dirs: [".minds/**"]',
             ]));
     }
     return (fmtHeader('Permissions (Directory + Extension)') +
@@ -3415,6 +3411,8 @@ function renderPermissionsManual(language) {
             'Example: `.minds/**` matches `.minds/team.yaml` and `.minds/team/<id>/persona.*.md`; commonly used to restrict normal members from minds assets.',
             '`*.tsk/` is an encapsulated Taskdoc: it must be maintained via the function tool `change_mind` only. It is hard-denied for all general file tools.',
             '`.minds/**` stores rtws (runtime workspace) team config/memory/assets: it is hard-denied for all general file tools. Only dedicated `.minds/`-scoped toolsets (e.g. `team_mgmt`) may access it.',
+            'Therefore, do **not** mechanically restate that built-in hard deny in `team.yaml` with `no_read_dirs: [".minds/**"]` / `no_write_dirs: [".minds/**"]` (or similar `*.tsk/**` deny lines). Those entries add no real constraint, only boilerplate noise, and they incorrectly teach team managers that such lines are standard required practice.',
+            'Rule of thumb: permission fields in `team.yaml` should describe only **additional** business-specific constraints. Built-in hard boundaries are enforced by the runtime and should not be redundantly copied into member config.',
             'Note: If you try to whitelist `.minds/**` or `*.tsk/**` via `read_dirs`/`write_dirs`, the runtime ignores it and reports an error-level Problem.',
         ]) +
         fmtCodeBlock('yaml', [
@@ -3423,8 +3421,6 @@ function renderPermissionsManual(language) {
             '  coder:',
             '    read_dirs: ["dominds/**"]',
             '    write_dirs: ["dominds/**"]',
-            '    no_read_dirs: [".minds/**"]',
-            '    no_write_dirs: [".minds/**"]',
         ]));
 }
 function renderMindsManual(language) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dominds",
-  "version": "1.15.3",
+  "version": "1.15.4",
   "description": "Dominds CLI and aggregation shell for the LongRun AI kernel/runtime packages.",
   "type": "commonjs",
   "publishConfig": {