dominds 1.25.10 → 1.25.12

package/README.md

@@ -251,7 +251,7 @@ Then:
 
 Platform note:
 
-- On Windows, the runtime does not register the `codex_inspect_and_patch_tools` toolset. Do not grant `codex_inspect_and_patch_tools` in `.minds/team.yaml` for Windows hosts.
+- Windows also registers `codex_inspect_and_patch_tools`; its `readonly_shell` tool runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH, such as `rg`, `git`, `dir`, `type`, and `where`.
 
 ## Start from scratch
 

package/README.zh.md

@@ -190,7 +190,7 @@ dominds
 
 平台说明：
 
-- Windows 运行时不会注册 `codex_inspect_and_patch_tools` 工具集。在 Windows 主机上的 `.minds/team.yaml` 中不要授予 `codex_inspect_and_patch_tools`。
+- Windows 也会注册 `codex_inspect_and_patch_tools`；其中 `readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 和 `where`。
 
 ## 从零开始（空文件夹启动）
 

package/dist/access-control.js

@@ -10,19 +10,23 @@ exports.getAccessDeniedMessage = getAccessDeniedMessage;
 const path_1 = __importDefault(require("path"));
 const log_1 = require("./log");
 function isEncapsulatedTaskPath(targetPath) {
-    const normalized = targetPath.replace(/\\/g, '/');
+    const normalized = normalizeAccessControlPath(targetPath);
     // Matches: "foo.tsk", "foo.tsk/", "a/b/foo.tsk/x", etc.
     return /(^|\/)[^/]+\.tsk(\/|$)/.test(normalized);
 }
 function isMindsPath(targetPath) {
-    const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    const normalized = normalizeAccessControlPath(targetPath).replace(/^\/+/, '');
     return normalized === '.minds' || normalized.startsWith('.minds/');
 }
 function isMainDialogsPath(targetPath) {
     // Only deny `.dialogs/**` at rtws root; allow nested `foo/.dialogs/**` for dev rtws layouts.
-    const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    const normalized = normalizeAccessControlPath(targetPath).replace(/^\/+/, '');
     return normalized === '.dialogs' || normalized.startsWith('.dialogs/');
 }
+function normalizeAccessControlPath(targetPath) {
+    const normalized = targetPath.replace(/\\/g, '/');
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
 function normalizeFileExtName(raw) {
     return raw.trim().toLowerCase().replace(/^\.+/, '');
 }
@@ -84,8 +88,8 @@ function resolveRtwsRelativePath(targetPath) {
  */
 function matchesPattern(targetPath, dirPattern) {
     // Normalize paths - remove leading/trailing slashes, convert to forward slashes, handle empty paths
-    const normalizedTarget = targetPath.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
-    let normalizedDirPattern = dirPattern.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
+    const normalizedTarget = normalizeAccessControlPath(targetPath).replace(/^\/+|\/+$/g, '') || '.';
+    let normalizedDirPattern = normalizeAccessControlPath(dirPattern).replace(/^\/+|\/+$/g, '') || '.';
     // Patterns ending in `/**` represent a directory scope and should match the directory itself too.
     // Example: `.minds/**` must match both `.minds` and `.minds/team.yaml`.
     while (normalizedDirPattern.endsWith('/**')) {

package/dist/docs/team_mgmt-toolset.md

@@ -559,7 +559,7 @@ Best practices:
 
 - Make `member_defaults` conservative. Grant additional tools/dirs on a per-member basis.
 - Prefer toolsets over individually enumerating tools unless you need a one-off tool.
-- Platform note: Windows runtime intentionally does not register `codex_inspect_and_patch_tools`; do not grant that toolset in `.minds/team.yaml` on Windows hosts.
+- Platform note: Windows also supports `codex_inspect_and_patch_tools`; `readonly_shell` runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH.
 - Keep `.minds/team.yaml` ownership tight; only the team manager should be able to edit it.
 - Avoid repeating built-in constraints in `team.yaml`:
   - `*.tsk/**` (encapsulated Taskdocs) are hard-denied for all general file tools.

package/dist/docs/team_mgmt-toolset.zh.md

@@ -473,7 +473,7 @@ members:
 
 - 使 `member_defaults` 保守。按成员授予额外的工具/目录
 - 优先使用工具集而不是单独枚举工具，除非你需要一次性工具
-- 平台说明：Windows 运行时不会注册 `codex_inspect_and_patch_tools`；在 Windows 主机上的 `.minds/team.yaml` 中不要授予该工具集
+- 平台说明：Windows 也支持 `codex_inspect_and_patch_tools`；`readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令
 - 保持 `.minds/team.yaml` 的所有权严格；只有团队管理者应该能够编辑它
 - 避免在 `team.yaml` 中重复内置约束：
   - `*.tsk/**`（封装的差遣牒任务包）对所有通用文件工具被硬性拒绝

package/dist/llm/kernel-driver/drive.js

@@ -645,6 +645,7 @@ const TELLASK_SPECIAL_VIRTUAL_TOOLS = [
     {
         type: 'func',
         name: 'replyTellask',
+        followupMode: 'deferred',
         description: 'Deliver final reply for the current tellask session.',
         parameters: {
             type: 'object',
@@ -661,6 +662,7 @@ const TELLASK_SPECIAL_VIRTUAL_TOOLS = [
     {
         type: 'func',
         name: 'replyTellaskSessionless',
+        followupMode: 'deferred',
         description: 'Deliver final reply for the current one-shot tellask.',
         parameters: {
             type: 'object',
@@ -677,6 +679,7 @@ const TELLASK_SPECIAL_VIRTUAL_TOOLS = [
     {
         type: 'func',
         name: 'replyTellaskBack',
+        followupMode: 'deferred',
         description: 'Deliver final reply for the current tellaskBack request.',
         parameters: {
             type: 'object',
@@ -1228,6 +1231,49 @@ async function persistInvalidFuncCallRuntimeGuide(args) {
     });
     await persistAndPostRuntimeGuide(dlg, content);
 }
+function isQueuedNewCourseRuntimePrompt(prompt) {
+    return (prompt?.kind === 'new_course_runtime_guide' ||
+        prompt?.kind === 'new_course_runtime_reply' ||
+        prompt?.kind === 'new_course_runtime_sideDialog');
+}
+function queuedNewCourseRuntimePromptToKernelPrompt(prompt) {
+    const common = {
+        content: prompt.prompt,
+        msgId: prompt.msgId,
+        grammar: prompt.grammar ?? 'markdown',
+        userLanguageCode: prompt.userLanguageCode,
+        runControl: prompt.runControl,
+        origin: 'runtime',
+        ...(prompt.skipTaskdoc === undefined ? {} : { skipTaskdoc: prompt.skipTaskdoc }),
+    };
+    switch (prompt.kind) {
+        case 'new_course_runtime_guide':
+            return common;
+        case 'new_course_runtime_reply':
+            return {
+                ...common,
+                tellaskReplyDirective: prompt.tellaskReplyDirective,
+            };
+        case 'new_course_runtime_sideDialog':
+            return {
+                ...common,
+                tellaskReplyDirective: prompt.tellaskReplyDirective,
+                calleeDialogReplyTarget: prompt.calleeDialogReplyTarget,
+            };
+    }
+}
+async function consumeQueuedNewCourseRuntimePromptForSameDrive(dlg) {
+    const queuedPrompt = dlg.peekQueuedPrompt();
+    if (!isQueuedNewCourseRuntimePrompt(queuedPrompt)) {
+        return undefined;
+    }
+    const consumedPrompt = dlg.takeQueuedPrompt();
+    if (!consumedPrompt || consumedPrompt.msgId !== queuedPrompt.msgId) {
+        throw new Error(`queued new-course prompt invariant violation: expected queued prompt ${queuedPrompt.msgId} before same-drive continuation`);
+    }
+    await persistence_1.DialogPersistence.clearPendingRuntimePrompt(dlg.id, queuedPrompt.msgId, dlg.status);
+    return queuedNewCourseRuntimePromptToKernelPrompt(queuedPrompt);
+}
 function resolveFuncToolFollowupMode(tool) {
     return tool?.followupMode ?? 'immediate';
 }
@@ -1237,6 +1283,7 @@ function summarizeRoutedFunctionResult(routed) {
         hasImmediateTellaskOutputs: routed.hasImmediateTellaskOutputs,
         immediateFollowupCallIds: routed.immediateFollowupCallIds,
         immediateTellaskOutputCallIds: routed.immediateTellaskOutputCallIds,
+        invalidTellaskCallIds: routed.invalidTellaskCallIds,
         shouldStopAfterReplyTool: routed.shouldStopAfterReplyTool,
         shouldStopAfterPendingTellaskWait: routed.shouldStopAfterPendingTellaskWait,
         pairedMessageTypes: routed.pairedMessages.map((msg) => msg.type),
@@ -1455,14 +1502,22 @@ function buildImmediateFollowupTriggerExpectation(args) {
             replyCallId: args.routed.immediateTellaskOutputCallIds[0],
         });
     }
+    const invalidRecoveryCallIds = new Set(args.routed.invalidTellaskCallIds);
     if (args.invalidFuncCallCount > 0) {
-        const callIds = args.streamedFuncCalls.map((call) => call.id);
-        // Invalid provider tool payloads are a same-turn recovery fact, not a generic retry hint.
-        // Keep them inside the follow-up trigger so the next generation can repair the current turn
-        // immediately, while the invalid payload itself stays loud in runtime guides and logs.
+        for (const call of args.streamedFuncCalls) {
+            invalidRecoveryCallIds.add(call.id);
+        }
+        if (args.streamedFuncCalls.length === 0) {
+            invalidRecoveryCallIds.add(`invalid-tool:${args.invalidFuncCallCount}`);
+        }
+    }
+    if (invalidRecoveryCallIds.size > 0) {
+        // Invalid provider tool payloads and invalid tellask specials are same-turn recovery facts,
+        // not generic retry hints. Keep them inside the follow-up trigger so the next generation can
+        // repair the current turn immediately, while the invalid payload itself stays loud.
         reasons.push({
             kind: 'invalid_tool_recovery',
-            callIds: callIds.length > 0 ? callIds : [`invalid-tool:${args.invalidFuncCallCount}`],
+            callIds: [...invalidRecoveryCallIds],
         });
     }
     if (reasons.length === 0) {
@@ -1823,6 +1878,7 @@ async function executeFunctionRound(args) {
             hasImmediateTellaskOutputs: false,
             immediateFollowupCallIds: [],
             immediateTellaskOutputCallIds: [],
+            invalidTellaskCallIds: [],
             shouldStopAfterReplyTool: false,
             shouldStopAfterPendingTellaskWait: false,
             pairedMessages: [],
@@ -1933,6 +1989,7 @@ async function executeFunctionRound(args) {
         hasImmediateTellaskOutputs: tellaskRound.hasImmediateTellaskOutputs,
         immediateFollowupCallIds,
         immediateTellaskOutputCallIds: tellaskRound.immediateTellaskOutputCallIds,
+        invalidTellaskCallIds: tellaskRound.invalidTellaskCallIds,
         shouldStopAfterReplyTool: tellaskRound.shouldStopAfterReplyTool,
         shouldStopAfterPendingTellaskWait: tellaskRound.shouldStopAfterPendingTellaskWait,
         pairedMessages,
@@ -3255,6 +3312,12 @@ async function driveDialogStreamCore(dlg, callbacks, humanPrompt, driveOptions)
                         });
                         break;
                     }
+                    const queuedNewCoursePrompt = await consumeQueuedNewCourseRuntimePromptForSameDrive(dlg);
+                    if (queuedNewCoursePrompt !== undefined) {
+                        pendingPrompt = queuedNewCoursePrompt;
+                        skipTaskdocForThisDrive = false;
+                        continue;
+                    }
                     // Start an immediate post-tool generation only when this round produced tool outputs that
                     // warrant same-drive LLM reaction right away. Provider-native side-channel UI events are
                     // meaningful output, but they are not transcript/context inputs and therefore must not

package/dist/llm/kernel-driver/fbr.js

@@ -48,6 +48,7 @@ function buildFbrConclusionTools(language) {
         {
             type: 'func',
             name: exports.FBR_LOW_NOISE_CONCLUSION_TOOL_NAME,
+            followupMode: 'deferred',
             description: buildFbrConclusionToolDescription({ language, kind: 'low_noise' }),
             parameters: {
                 type: 'object',
@@ -67,6 +68,7 @@ function buildFbrConclusionTools(language) {
         {
             type: 'func',
             name: exports.FBR_UNREASONABLE_SITUATION_TOOL_NAME,
+            followupMode: 'deferred',
             description: buildFbrConclusionToolDescription({ language, kind: 'unreasonable' }),
             parameters: {
                 type: 'object',

package/dist/llm/kernel-driver/tellask-special.d.ts

@@ -121,6 +121,7 @@ export type TellaskFunctionRoundResult = Readonly<{
     hasInvalidTellaskCalls: boolean;
     hasImmediateTellaskOutputs: boolean;
     immediateTellaskOutputCallIds: readonly string[];
+    invalidTellaskCallIds: readonly string[];
     shouldStopAfterReplyTool: boolean;
     shouldStopAfterPendingTellaskWait: boolean;
 }>;

package/dist/llm/kernel-driver/tellask-special.js

@@ -2396,6 +2396,10 @@ async function processTellaskFunctionRound(args) {
             const result = output;
             tellaskFuncResultByCallId.set(result.id, result);
             tellaskFuncResults.push(result);
+            const originatingCall = specialCallById.get(result.id);
+            if (originatingCall !== undefined && isReplyTellaskCallName(originatingCall.callName)) {
+                continue;
+            }
             hasImmediateTellaskOutputs = true;
             immediateTellaskOutputCallIds.push(result.id);
             continue;
@@ -2460,7 +2464,8 @@ async function processTellaskFunctionRound(args) {
         hasInvalidTellaskCalls: orderedInvalidCalls.length > 0,
         hasImmediateTellaskOutputs,
         immediateTellaskOutputCallIds,
-        shouldStopAfterReplyTool: orderedInvalidCalls.length === 0 && tellaskExecution.successfulReplyCallIds.length > 0,
+        invalidTellaskCallIds: orderedInvalidCalls.map((issue) => issue.originalCall.id),
+        shouldStopAfterReplyTool: tellaskExecution.successfulReplyCallIds.length > 0,
         shouldStopAfterPendingTellaskWait,
     };
 }

package/dist/persistence.js

@@ -2924,7 +2924,7 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
             });
             acceptedTriggers = triggerSelection.acceptedTriggers;
             if (triggerSelection.supersededTriggers.length > 0) {
-                log_1.log.debug('Superseded stale next-step triggers while starting queued runtime prompt generation', undefined, {
+                log_1.log.debug('Superseded stale next-step triggers while starting prompt-driven generation', undefined, {
                     dialogId: this.dialogId.valueOf(),
                     rootId: this.dialogId.rootId,
                     selfId: this.dialogId.selfId,
@@ -2933,7 +2933,7 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
                     msgId: msgId ?? null,
                     acceptedTriggerIds: acceptedTriggers.map((trigger) => trigger.triggerId),
                     supersededTriggerIds: triggerSelection.supersededTriggers.map((trigger) => trigger.triggerId),
-                    reason: 'queued_runtime_prompt_new_course_takes_precedence',
+                    reason: 'prompt_generation_takes_precedence',
                 });
             }
             const acceptedTriggerIds = acceptedTriggers.map((trigger) => trigger.triggerId);
@@ -4960,23 +4960,17 @@ function filterNextStepTriggersForGenerationStart(args) {
     if (typeof args.msgId !== 'string' || args.msgId.trim() === '') {
         return { acceptedTriggers: orderedTriggers, supersededTriggers: [] };
     }
-    const promptTrigger = orderedTriggers.find((trigger) => trigger.kind === 'queued_prompt' &&
-        trigger.promptId === args.msgId &&
-        trigger.course === args.currentCourse);
-    if (promptTrigger === undefined) {
-        return { acceptedTriggers: orderedTriggers, supersededTriggers: [] };
-    }
     const acceptedTriggers = [];
     const supersededTriggers = [];
     for (const trigger of orderedTriggers) {
-        const belongsToPromptCourse = (() => {
+        const shouldAcceptTrigger = (() => {
             switch (trigger.kind) {
                 case 'queued_prompt':
                 case 'user_input':
                 case 'open_generation_recovery':
                     return trigger.course === args.currentCourse;
                 case 'followup':
-                    return trigger.sourceGeneration.course === args.currentCourse;
+                    return false;
                 case 'mainline_diligence':
                 case 'result_arrival':
                 case 'reply_delivery_recovery':
@@ -4987,7 +4981,7 @@ function filterNextStepTriggersForGenerationStart(args) {
                 }
             }
         })();
-        if (belongsToPromptCourse) {
+        if (shouldAcceptTrigger) {
             acceptedTriggers.push(trigger);
         }
         else {

package/dist/server/dominds-self-update.js

@@ -21,6 +21,7 @@ const LATEST_VERSION_CHECK_TIMEOUT_MS = 60000;
 const RESTART_PORT_RELEASE_TIMEOUT_MS = 15000;
 const RESTART_PORT_PROBE_INTERVAL_MS = 150;
 const RESTART_EXIT_GRACE_MS = 1000;
+const RESTART_FORCE_KILL_AFTER_MS = 3000;
 const COMMAND_OUTPUT_LOG_LIMIT = 2000;
 const PROXY_URL_ENV_KEYS = new Set([
     'HTTP_PROXY',
@@ -865,6 +866,8 @@ function spawnDetachedRestartHelper(params) {
         cwd: params.cwd,
         host: getRestartPortProbeHost(params.host),
         port: params.port,
+        retiringPid: process.pid,
+        forceKillAfterMs: RESTART_FORCE_KILL_AFTER_MS,
         probeIntervalMs: RESTART_PORT_PROBE_INTERVAL_MS,
         portReleaseTimeoutMs: RESTART_PORT_RELEASE_TIMEOUT_MS,
         stdioMode,
@@ -889,8 +892,8 @@ function spawnDetachedRestartHelper(params) {
         '    socket.setTimeout(1000, () => finish(true));',
         '  });',
         '}',
-        'async function waitForPortRelease() {',
-        '  const deadline = Date.now() + payload.portReleaseTimeoutMs;',
+        'async function waitForPortRelease(timeoutMs) {',
+        '  const deadline = Date.now() + timeoutMs;',
         '  let consecutiveIdle = 0;',
         '  while (Date.now() < deadline) {',
         '    if (await isPortBusy()) {',
@@ -899,13 +902,42 @@ function spawnDetachedRestartHelper(params) {
         '      continue;',
         '    }',
         '    consecutiveIdle += 1;',
-        '    if (consecutiveIdle >= 2) return;',
+        '    if (consecutiveIdle >= 2) return true;',
         '    await new Promise((resolve) => setTimeout(resolve, payload.probeIntervalMs));',
         '  }',
+        '  return false;',
+        '}',
+        'function forceKillRetiringProcess() {',
+        '  if (!Number.isInteger(payload.retiringPid) || payload.retiringPid <= 0) {',
+        '    throw new Error(`Invalid retiring Dominds pid for restart: ${String(payload.retiringPid)}`);',
+        '  }',
+        '  if (payload.retiringPid === process.pid) {',
+        '    throw new Error(`Refusing to kill restart helper pid ${String(process.pid)}`);',
+        '  }',
+        "  const killer = process.platform === 'win32'",
+        "    ? spawn('taskkill.exe', ['/PID', String(payload.retiringPid), '/F'], { stdio: payload.stdioMode })",
+        "    : spawn('kill', ['-KILL', String(payload.retiringPid)], { stdio: payload.stdioMode });",
+        '  return new Promise((resolve, reject) => {',
+        "    killer.once('error', reject);",
+        "    killer.once('exit', (code) => {",
+        '      if (code === 0) {',
+        '        resolve();',
+        '        return;',
+        '      }',
+        '      resolve();',
+        '    });',
+        '  });',
         '}',
         '(async () => {',
         '  try {',
-        '    await waitForPortRelease();',
+        '    const releasedGracefully = await waitForPortRelease(payload.forceKillAfterMs);',
+        '    if (!releasedGracefully) {',
+        '      await forceKillRetiringProcess();',
+        '      const releasedAfterKill = await waitForPortRelease(payload.portReleaseTimeoutMs);',
+        '      if (!releasedAfterKill) {',
+        '        throw new Error(`Dominds restart port ${String(payload.host)}:${String(payload.port)} is still busy after force-killing pid ${String(payload.retiringPid)}`);',
+        '      }',
+        '    }',
         "    const child = spawn(payload.command, payload.args, { cwd: payload.cwd, env: process.env, detached, stdio: payload.stdioMode, shell: process.platform === 'win32' });",
         '    if (detached) child.unref();',
         '    process.exit(0);',

package/dist/server/websocket-handler.js

@@ -1035,8 +1035,23 @@ async function handleDisplayDialog(ws, packet) {
         }
         const rootPrimingConfig = dialogIdObj.selfId === dialogIdObj.rootId ? (0, priming_1.getMainDialogPrimingConfig)(metadata) : undefined;
         const showPrimingEventsInUi = rootPrimingConfig?.showInUi !== false;
-        const decidedCourse = (await persistence_1.DialogPersistence.getCurrentCourseNumber(dialogIdObj, requestedStatus)) ||
+        if (packet.course !== undefined && (!Number.isInteger(packet.course) || packet.course <= 0)) {
+            ws.send(JSON.stringify({
+                type: 'error',
+                message: 'display_dialog course must be a positive integer when provided',
+            }));
+            return;
+        }
+        const latestCourse = (await persistence_1.DialogPersistence.getCurrentCourseNumber(dialogIdObj, requestedStatus)) ||
             (dialogState.currentCourse ?? 1);
+        const decidedCourse = packet.course ?? latestCourse;
+        if (decidedCourse > latestCourse) {
+            ws.send(JSON.stringify({
+                type: 'error',
+                message: `display_dialog course ${String(decidedCourse)} exceeds latest course ${String(latestCourse)}`,
+            }));
+            return;
+        }
         const enableLive = requestedStatus === 'running';
         const mainDialog = await (0, dialog_instance_registry_1.getOrRestoreMainDialog)(dialogIdObj.rootId, requestedStatus);
         if (!mainDialog) {
@@ -1068,7 +1083,7 @@ async function handleDisplayDialog(ws, packet) {
         try {
             const dialogStore = dialog.dlgStore;
             if (dialogStore instanceof persistence_1.DiskFileDialogStore) {
-                await dialogStore.sendDialogEventsDirectly(ws, dialog, decidedCourse, decidedCourse, requestedStatus, { showPrimingEventsInUi });
+                await dialogStore.sendDialogEventsDirectly(ws, dialog, decidedCourse, latestCourse, requestedStatus, { showPrimingEventsInUi });
             }
             else {
                 throw new Error('Unexpected dialog store type for sendDialogEventsDirectly');
@@ -1340,6 +1355,13 @@ async function handleDisplayCourse(ws, packet) {
         if (!dialog || typeof course !== 'number') {
             throw new Error('dialog and course are required');
         }
+        if (!Number.isInteger(course) || course <= 0) {
+            ws.send(JSON.stringify({
+                type: 'error',
+                message: 'display_course course must be a positive integer',
+            }));
+            return;
+        }
         // Extract dialog ID from DialogIdent
         let dialogIdStr = dialog.selfId;
         let mainDialogIdStr = dialog.rootId;
@@ -1371,6 +1393,13 @@ async function handleDisplayCourse(ws, packet) {
                 return;
             }
             const totalCourses = (await persistence_1.DialogPersistence.getCurrentCourseNumber(dialogId, requestedStatus)) || course;
+            if (course > totalCourses) {
+                ws.send(JSON.stringify({
+                    type: 'error',
+                    message: `display_course course ${String(course)} exceeds latest course ${String(totalCourses)}`,
+                }));
+                return;
+            }
             const mainDialog = await (0, dialog_instance_registry_1.getOrRestoreMainDialog)(dialogId.rootId, requestedStatus);
             if (!mainDialog)
                 return;

package/dist/tools/builtins.js

@@ -319,22 +319,20 @@ for (const tool of team_mgmt_1.teamMgmtTools) {
     manualSpec: manualSpecFor('ws_mod'),
 });
 // Inspect-and-patch helpers (function tools only; useful for GPT-5.x coding agents)
-if (process.platform !== 'win32') {
-    (0, registry_1.registerToolset)('codex_inspect_and_patch_tools', [os_1.readonlyShellTool, apply_patch_1.applyPatchTool]);
-    (0, registry_1.setToolsetMeta)('codex_inspect_and_patch_tools', {
-        source: 'dominds',
-        descriptionI18n: {
-            en: 'Inspect-and-patch helpers: use readonly_shell for lightweight inspection and apply_patch for reviewable edits.',
-            zh: '检查与补丁工具：用 readonly_shell 做轻量检查，用 apply_patch 做可审查修改。',
-        },
-        promptI18n: {
-            en: 'Use `apply_patch` (apply_patch patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
-            zh: '使用 `apply_patch`（apply_patch patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
-        },
-        promptFilesI18n: promptFilesFor('codex_inspect_and_patch_tools'),
-        manualSpec: manualSpecFor('codex_inspect_and_patch_tools'),
-    });
-}
+(0, registry_1.registerToolset)('codex_inspect_and_patch_tools', [os_1.readonlyShellTool, apply_patch_1.applyPatchTool]);
+(0, registry_1.setToolsetMeta)('codex_inspect_and_patch_tools', {
+    source: 'dominds',
+    descriptionI18n: {
+        en: 'Inspect-and-patch helpers: use readonly_shell for lightweight inspection and apply_patch for reviewable edits.',
+        zh: '检查与补丁工具：用 readonly_shell 做轻量检查，用 apply_patch 做可审查修改。',
+    },
+    promptI18n: {
+        en: 'Use `apply_patch` (apply_patch patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. On Windows, `readonly_shell` runs through `cmd.exe`; use allowlisted commands available in that shell/PATH such as `rg`, `git`, `dir`, `type`, or `where`. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
+        zh: '使用 `apply_patch`（apply_patch patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。Windows 上 `readonly_shell` 通过 `cmd.exe` 执行；请使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 或 `where`。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
+    },
+    promptFilesI18n: promptFilesFor('codex_inspect_and_patch_tools'),
+    manualSpec: manualSpecFor('codex_inspect_and_patch_tools'),
+});
 (0, registry_1.registerToolset)('team_mgmt', [...team_mgmt_1.teamMgmtTools]);
 (0, registry_1.setToolsetMeta)('team_mgmt', {
     source: 'dominds',

package/dist/tools/ctrl.js

@@ -612,6 +612,7 @@ exports.updateReminderTool = {
 exports.clearMindTool = {
     type: 'func',
     name: 'clear_mind',
+    followupMode: 'deferred',
     description: 'Start a new dialog course, optionally carrying one extra continuation reminder.',
     descriptionI18n: {
         en: 'Start a new dialog course, optionally carrying one extra continuation reminder.',

package/dist/tools/os.d.ts

@@ -19,6 +19,20 @@ export declare function formatShellExecutionErrorForTests(shell: string | undefi
 export declare function resolveReadonlyShellSpawnSpecForTests(command: string, platform: NodeJS.Platform): ShellSpawnSpec;
 export declare const shellCmdReminderOwner: ReminderOwner;
 export declare const shellCmdTool: FuncTool;
+type ReadonlyShellValidationFailureReason = 'MAX_DEPTH' | 'INVALID_CD_SYNTAX' | 'UNSAFE_RELATIVE_PATH' | 'CHAIN_PARSE_EMPTY_SEGMENT' | 'CHAIN_PARSE_UNSUPPORTED_OPERATOR' | 'CHAIN_PARSE_UNTERMINATED_QUOTE' | 'CHAIN_PARSE_TRAILING_ESCAPE' | 'UNSAFE_SHELL_SYNTAX' | 'GIT_C_INVALID' | 'GIT_C_UNSAFE_PATH' | 'GIT_C_UNSUPPORTED_SUBCOMMAND' | 'COMMAND_NOT_ALLOWLISTED';
+type ReadonlyShellValidationFailure = Readonly<{
+    reason: ReadonlyShellValidationFailureReason;
+    rejectedSegment: string;
+}>;
+type ReadonlyShellValidationResult = Readonly<{
+    ok: true;
+}> | Readonly<{
+    ok: false;
+    failure: ReadonlyShellValidationFailure;
+}>;
+export declare function validateReadonlyShellCommandForTests(command: string, platform: NodeJS.Platform): ReadonlyShellValidationResult;
+type ForbiddenHiddenDir = '.minds' | '.dialogs';
+export declare function detectReadonlyShellForbiddenHiddenDirAccessForTests(workspaceRootAbs: string, command: string, platform: NodeJS.Platform): ForbiddenHiddenDir | null;
 export declare const readonlyShellTool: FuncTool;
 export declare const stopDaemonTool: FuncTool;
 export declare const getDaemonOutputTool: FuncTool;