dominds 1.25.11 → 1.25.12

package/README.md

@@ -251,7 +251,7 @@ Then:
 
 Platform note:
 
-- On Windows, the runtime does not register the `codex_inspect_and_patch_tools` toolset. Do not grant `codex_inspect_and_patch_tools` in `.minds/team.yaml` for Windows hosts.
+- Windows also registers `codex_inspect_and_patch_tools`; its `readonly_shell` tool runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH, such as `rg`, `git`, `dir`, `type`, and `where`.
 
 ## Start from scratch
 

package/README.zh.md

@@ -190,7 +190,7 @@ dominds
 
 平台说明：
 
-- Windows 运行时不会注册 `codex_inspect_and_patch_tools` 工具集。在 Windows 主机上的 `.minds/team.yaml` 中不要授予 `codex_inspect_and_patch_tools`。
+- Windows 也会注册 `codex_inspect_and_patch_tools`；其中 `readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 和 `where`。
 
 ## 从零开始（空文件夹启动）
 

package/dist/access-control.js

@@ -10,19 +10,23 @@ exports.getAccessDeniedMessage = getAccessDeniedMessage;
 const path_1 = __importDefault(require("path"));
 const log_1 = require("./log");
 function isEncapsulatedTaskPath(targetPath) {
-    const normalized = targetPath.replace(/\\/g, '/');
+    const normalized = normalizeAccessControlPath(targetPath);
     // Matches: "foo.tsk", "foo.tsk/", "a/b/foo.tsk/x", etc.
     return /(^|\/)[^/]+\.tsk(\/|$)/.test(normalized);
 }
 function isMindsPath(targetPath) {
-    const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    const normalized = normalizeAccessControlPath(targetPath).replace(/^\/+/, '');
     return normalized === '.minds' || normalized.startsWith('.minds/');
 }
 function isMainDialogsPath(targetPath) {
     // Only deny `.dialogs/**` at rtws root; allow nested `foo/.dialogs/**` for dev rtws layouts.
-    const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    const normalized = normalizeAccessControlPath(targetPath).replace(/^\/+/, '');
     return normalized === '.dialogs' || normalized.startsWith('.dialogs/');
 }
+function normalizeAccessControlPath(targetPath) {
+    const normalized = targetPath.replace(/\\/g, '/');
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
 function normalizeFileExtName(raw) {
     return raw.trim().toLowerCase().replace(/^\.+/, '');
 }
@@ -84,8 +88,8 @@ function resolveRtwsRelativePath(targetPath) {
  */
 function matchesPattern(targetPath, dirPattern) {
     // Normalize paths - remove leading/trailing slashes, convert to forward slashes, handle empty paths
-    const normalizedTarget = targetPath.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
-    let normalizedDirPattern = dirPattern.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
+    const normalizedTarget = normalizeAccessControlPath(targetPath).replace(/^\/+|\/+$/g, '') || '.';
+    let normalizedDirPattern = normalizeAccessControlPath(dirPattern).replace(/^\/+|\/+$/g, '') || '.';
     // Patterns ending in `/**` represent a directory scope and should match the directory itself too.
     // Example: `.minds/**` must match both `.minds` and `.minds/team.yaml`.
     while (normalizedDirPattern.endsWith('/**')) {

package/dist/docs/team_mgmt-toolset.md

@@ -559,7 +559,7 @@ Best practices:
 
 - Make `member_defaults` conservative. Grant additional tools/dirs on a per-member basis.
 - Prefer toolsets over individually enumerating tools unless you need a one-off tool.
-- Platform note: Windows runtime intentionally does not register `codex_inspect_and_patch_tools`; do not grant that toolset in `.minds/team.yaml` on Windows hosts.
+- Platform note: Windows also supports `codex_inspect_and_patch_tools`; `readonly_shell` runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH.
 - Keep `.minds/team.yaml` ownership tight; only the team manager should be able to edit it.
 - Avoid repeating built-in constraints in `team.yaml`:
   - `*.tsk/**` (encapsulated Taskdocs) are hard-denied for all general file tools.

package/dist/docs/team_mgmt-toolset.zh.md

@@ -473,7 +473,7 @@ members:
 
 - 使 `member_defaults` 保守。按成员授予额外的工具/目录
 - 优先使用工具集而不是单独枚举工具，除非你需要一次性工具
-- 平台说明：Windows 运行时不会注册 `codex_inspect_and_patch_tools`；在 Windows 主机上的 `.minds/team.yaml` 中不要授予该工具集
+- 平台说明：Windows 也支持 `codex_inspect_and_patch_tools`；`readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令
 - 保持 `.minds/team.yaml` 的所有权严格；只有团队管理者应该能够编辑它
 - 避免在 `team.yaml` 中重复内置约束：
   - `*.tsk/**`（封装的差遣牒任务包）对所有通用文件工具被硬性拒绝

package/dist/persistence.js

@@ -2924,7 +2924,7 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
             });
             acceptedTriggers = triggerSelection.acceptedTriggers;
             if (triggerSelection.supersededTriggers.length > 0) {
-                log_1.log.debug('Superseded stale next-step triggers while starting queued runtime prompt generation', undefined, {
+                log_1.log.debug('Superseded stale next-step triggers while starting prompt-driven generation', undefined, {
                     dialogId: this.dialogId.valueOf(),
                     rootId: this.dialogId.rootId,
                     selfId: this.dialogId.selfId,
@@ -2933,7 +2933,7 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
                     msgId: msgId ?? null,
                     acceptedTriggerIds: acceptedTriggers.map((trigger) => trigger.triggerId),
                     supersededTriggerIds: triggerSelection.supersededTriggers.map((trigger) => trigger.triggerId),
-                    reason: 'queued_runtime_prompt_new_course_takes_precedence',
+                    reason: 'prompt_generation_takes_precedence',
                 });
             }
             const acceptedTriggerIds = acceptedTriggers.map((trigger) => trigger.triggerId);
@@ -4960,23 +4960,17 @@ function filterNextStepTriggersForGenerationStart(args) {
     if (typeof args.msgId !== 'string' || args.msgId.trim() === '') {
         return { acceptedTriggers: orderedTriggers, supersededTriggers: [] };
     }
-    const promptTrigger = orderedTriggers.find((trigger) => trigger.kind === 'queued_prompt' &&
-        trigger.promptId === args.msgId &&
-        trigger.course === args.currentCourse);
-    if (promptTrigger === undefined) {
-        return { acceptedTriggers: orderedTriggers, supersededTriggers: [] };
-    }
     const acceptedTriggers = [];
     const supersededTriggers = [];
     for (const trigger of orderedTriggers) {
-        const belongsToPromptCourse = (() => {
+        const shouldAcceptTrigger = (() => {
             switch (trigger.kind) {
                 case 'queued_prompt':
                 case 'user_input':
                 case 'open_generation_recovery':
                     return trigger.course === args.currentCourse;
                 case 'followup':
-                    return trigger.sourceGeneration.course === args.currentCourse;
+                    return false;
                 case 'mainline_diligence':
                 case 'result_arrival':
                 case 'reply_delivery_recovery':
@@ -4987,7 +4981,7 @@ function filterNextStepTriggersForGenerationStart(args) {
                 }
             }
         })();
-        if (belongsToPromptCourse) {
+        if (shouldAcceptTrigger) {
             acceptedTriggers.push(trigger);
         }
         else {

package/dist/tools/builtins.js

@@ -319,22 +319,20 @@ for (const tool of team_mgmt_1.teamMgmtTools) {
     manualSpec: manualSpecFor('ws_mod'),
 });
 // Inspect-and-patch helpers (function tools only; useful for GPT-5.x coding agents)
-if (process.platform !== 'win32') {
-    (0, registry_1.registerToolset)('codex_inspect_and_patch_tools', [os_1.readonlyShellTool, apply_patch_1.applyPatchTool]);
-    (0, registry_1.setToolsetMeta)('codex_inspect_and_patch_tools', {
-        source: 'dominds',
-        descriptionI18n: {
-            en: 'Inspect-and-patch helpers: use readonly_shell for lightweight inspection and apply_patch for reviewable edits.',
-            zh: '检查与补丁工具：用 readonly_shell 做轻量检查，用 apply_patch 做可审查修改。',
-        },
-        promptI18n: {
-            en: 'Use `apply_patch` (apply_patch patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
-            zh: '使用 `apply_patch`（apply_patch patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
-        },
-        promptFilesI18n: promptFilesFor('codex_inspect_and_patch_tools'),
-        manualSpec: manualSpecFor('codex_inspect_and_patch_tools'),
-    });
-}
+(0, registry_1.registerToolset)('codex_inspect_and_patch_tools', [os_1.readonlyShellTool, apply_patch_1.applyPatchTool]);
+(0, registry_1.setToolsetMeta)('codex_inspect_and_patch_tools', {
+    source: 'dominds',
+    descriptionI18n: {
+        en: 'Inspect-and-patch helpers: use readonly_shell for lightweight inspection and apply_patch for reviewable edits.',
+        zh: '检查与补丁工具：用 readonly_shell 做轻量检查，用 apply_patch 做可审查修改。',
+    },
+    promptI18n: {
+        en: 'Use `apply_patch` (apply_patch patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. On Windows, `readonly_shell` runs through `cmd.exe`; use allowlisted commands available in that shell/PATH such as `rg`, `git`, `dir`, `type`, or `where`. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
+        zh: '使用 `apply_patch`（apply_patch patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。Windows 上 `readonly_shell` 通过 `cmd.exe` 执行；请使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 或 `where`。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
+    },
+    promptFilesI18n: promptFilesFor('codex_inspect_and_patch_tools'),
+    manualSpec: manualSpecFor('codex_inspect_and_patch_tools'),
+});
 (0, registry_1.registerToolset)('team_mgmt', [...team_mgmt_1.teamMgmtTools]);
 (0, registry_1.setToolsetMeta)('team_mgmt', {
     source: 'dominds',

package/dist/tools/os.d.ts

@@ -19,6 +19,20 @@ export declare function formatShellExecutionErrorForTests(shell: string | undefi
 export declare function resolveReadonlyShellSpawnSpecForTests(command: string, platform: NodeJS.Platform): ShellSpawnSpec;
 export declare const shellCmdReminderOwner: ReminderOwner;
 export declare const shellCmdTool: FuncTool;
+type ReadonlyShellValidationFailureReason = 'MAX_DEPTH' | 'INVALID_CD_SYNTAX' | 'UNSAFE_RELATIVE_PATH' | 'CHAIN_PARSE_EMPTY_SEGMENT' | 'CHAIN_PARSE_UNSUPPORTED_OPERATOR' | 'CHAIN_PARSE_UNTERMINATED_QUOTE' | 'CHAIN_PARSE_TRAILING_ESCAPE' | 'UNSAFE_SHELL_SYNTAX' | 'GIT_C_INVALID' | 'GIT_C_UNSAFE_PATH' | 'GIT_C_UNSUPPORTED_SUBCOMMAND' | 'COMMAND_NOT_ALLOWLISTED';
+type ReadonlyShellValidationFailure = Readonly<{
+    reason: ReadonlyShellValidationFailureReason;
+    rejectedSegment: string;
+}>;
+type ReadonlyShellValidationResult = Readonly<{
+    ok: true;
+}> | Readonly<{
+    ok: false;
+    failure: ReadonlyShellValidationFailure;
+}>;
+export declare function validateReadonlyShellCommandForTests(command: string, platform: NodeJS.Platform): ReadonlyShellValidationResult;
+type ForbiddenHiddenDir = '.minds' | '.dialogs';
+export declare function detectReadonlyShellForbiddenHiddenDirAccessForTests(workspaceRootAbs: string, command: string, platform: NodeJS.Platform): ForbiddenHiddenDir | null;
 export declare const readonlyShellTool: FuncTool;
 export declare const stopDaemonTool: FuncTool;
 export declare const getDaemonOutputTool: FuncTool;