dominds 1.25.11 → 1.25.13

package/README.md

@@ -251,7 +251,7 @@ Then:
 
 Platform note:
 
-- On Windows, the runtime does not register the `codex_inspect_and_patch_tools` toolset. Do not grant `codex_inspect_and_patch_tools` in `.minds/team.yaml` for Windows hosts.
+- Windows also registers `codex_inspect_and_patch_tools`; its `readonly_shell` tool runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH, such as `rg`, `git`, `dir`, `type`, and `where`.
 
 ## Start from scratch
 

package/README.zh.md

@@ -190,7 +190,7 @@ dominds
 
 平台说明：
 
-- Windows 运行时不会注册 `codex_inspect_and_patch_tools` 工具集。在 Windows 主机上的 `.minds/team.yaml` 中不要授予 `codex_inspect_and_patch_tools`。
+- Windows 也会注册 `codex_inspect_and_patch_tools`；其中 `readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 和 `where`。
 
 ## 从零开始（空文件夹启动）
 

package/dist/access-control.js

@@ -10,19 +10,23 @@ exports.getAccessDeniedMessage = getAccessDeniedMessage;
 const path_1 = __importDefault(require("path"));
 const log_1 = require("./log");
 function isEncapsulatedTaskPath(targetPath) {
-    const normalized = targetPath.replace(/\\/g, '/');
+    const normalized = normalizeAccessControlPath(targetPath);
     // Matches: "foo.tsk", "foo.tsk/", "a/b/foo.tsk/x", etc.
     return /(^|\/)[^/]+\.tsk(\/|$)/.test(normalized);
 }
 function isMindsPath(targetPath) {
-    const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    const normalized = normalizeAccessControlPath(targetPath).replace(/^\/+/, '');
     return normalized === '.minds' || normalized.startsWith('.minds/');
 }
 function isMainDialogsPath(targetPath) {
     // Only deny `.dialogs/**` at rtws root; allow nested `foo/.dialogs/**` for dev rtws layouts.
-    const normalized = targetPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    const normalized = normalizeAccessControlPath(targetPath).replace(/^\/+/, '');
     return normalized === '.dialogs' || normalized.startsWith('.dialogs/');
 }
+function normalizeAccessControlPath(targetPath) {
+    const normalized = targetPath.replace(/\\/g, '/');
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
 function normalizeFileExtName(raw) {
     return raw.trim().toLowerCase().replace(/^\.+/, '');
 }
@@ -84,8 +88,8 @@ function resolveRtwsRelativePath(targetPath) {
  */
 function matchesPattern(targetPath, dirPattern) {
     // Normalize paths - remove leading/trailing slashes, convert to forward slashes, handle empty paths
-    const normalizedTarget = targetPath.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
-    let normalizedDirPattern = dirPattern.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
+    const normalizedTarget = normalizeAccessControlPath(targetPath).replace(/^\/+|\/+$/g, '') || '.';
+    let normalizedDirPattern = normalizeAccessControlPath(dirPattern).replace(/^\/+|\/+$/g, '') || '.';
     // Patterns ending in `/**` represent a directory scope and should match the directory itself too.
     // Example: `.minds/**` must match both `.minds` and `.minds/team.yaml`.
     while (normalizedDirPattern.endsWith('/**')) {

package/dist/docs/team_mgmt-toolset.md

@@ -559,7 +559,7 @@ Best practices:
 
 - Make `member_defaults` conservative. Grant additional tools/dirs on a per-member basis.
 - Prefer toolsets over individually enumerating tools unless you need a one-off tool.
-- Platform note: Windows runtime intentionally does not register `codex_inspect_and_patch_tools`; do not grant that toolset in `.minds/team.yaml` on Windows hosts.
+- Platform note: Windows also supports `codex_inspect_and_patch_tools`; `readonly_shell` runs through `cmd.exe`, so prefer allowlisted commands available in that shell/PATH.
 - Keep `.minds/team.yaml` ownership tight; only the team manager should be able to edit it.
 - Avoid repeating built-in constraints in `team.yaml`:
   - `*.tsk/**` (encapsulated Taskdocs) are hard-denied for all general file tools.

package/dist/docs/team_mgmt-toolset.zh.md

@@ -473,7 +473,7 @@ members:
 
 - 使 `member_defaults` 保守。按成员授予额外的工具/目录
 - 优先使用工具集而不是单独枚举工具，除非你需要一次性工具
-- 平台说明：Windows 运行时不会注册 `codex_inspect_and_patch_tools`；在 Windows 主机上的 `.minds/team.yaml` 中不要授予该工具集
+- 平台说明：Windows 也支持 `codex_inspect_and_patch_tools`；`readonly_shell` 通过 `cmd.exe` 执行，因此优先使用该 shell/PATH 中可用的白名单命令
 - 保持 `.minds/team.yaml` 的所有权严格；只有团队管理者应该能够编辑它
 - 避免在 `team.yaml` 中重复内置约束：
   - `*.tsk/**`（封装的差遣牒任务包）对所有通用文件工具被硬性拒绝

package/dist/llm/kernel-driver/sideDialog.d.ts

@@ -47,5 +47,6 @@ export declare function supplySideDialogResponseToAssignedAskerIfPendingV2(args:
         callId: string;
         replyCallName: 'replyTellask' | 'replyTellaskSessionless' | 'replyTellaskBack';
     };
+    allowExplicitReplyWithoutAssignmentAnchor?: boolean;
     scheduleDrive: ScheduleDriveFn;
 }): Promise<boolean>;

package/dist/llm/kernel-driver/sideDialog.js

@@ -655,18 +655,36 @@ async function supplySideDialogResponseToAssignedAskerIfPendingV2(args) {
             status: sideDialog.status,
         });
         if (!assignmentAnchorRef) {
-            log_1.log.debug('Skip assigned Type B response supply before updated assignment is rendered locally', undefined, {
-                rootId: sideDialog.mainDialog.id.rootId,
-                sideDialogId: sideDialog.id.selfId,
-                askerDialogId: askerDialog.id.selfId,
-                callId: activeCalleeDispatch.callId,
-                responseGenseq,
-            });
-            return false;
+            const replyResolution = args.replyResolution;
+            if (args.allowExplicitReplyWithoutAssignmentAnchor === true &&
+                args.deliveryMode === 'reply_tool' &&
+                replyResolution !== undefined) {
+                log_1.log.warn('Delivering assigned Type B reply without local assignment anchor', undefined, {
+                    rootId: sideDialog.mainDialog.id.rootId,
+                    sideDialogId: sideDialog.id.selfId,
+                    askerDialogId: askerDialog.id.selfId,
+                    callId: activeCalleeDispatch.callId,
+                    replyCallId: replyResolution.callId,
+                    replyCallName: replyResolution.replyCallName,
+                    responseCourse: sideDialog.currentCourse,
+                    responseGenseq,
+                });
+            }
+            else {
+                log_1.log.debug('Skip assigned Type B response supply before updated assignment is rendered locally', undefined, {
+                    rootId: sideDialog.mainDialog.id.rootId,
+                    sideDialogId: sideDialog.id.selfId,
+                    askerDialogId: askerDialog.id.selfId,
+                    callId: activeCalleeDispatch.callId,
+                    responseGenseq,
+                });
+                return false;
+            }
         }
-        if (sideDialog.currentCourse < assignmentAnchorRef.course ||
-            (sideDialog.currentCourse === assignmentAnchorRef.course &&
-                responseGenseq < assignmentAnchorRef.genseq)) {
+        if (assignmentAnchorRef !== undefined &&
+            (sideDialog.currentCourse < assignmentAnchorRef.course ||
+                (sideDialog.currentCourse === assignmentAnchorRef.course &&
+                    responseGenseq < assignmentAnchorRef.genseq))) {
             log_1.log.debug('Skip assigned stale Type B response supply from before latest local assignment', undefined, {
                 rootId: sideDialog.mainDialog.id.rootId,
                 sideDialogId: sideDialog.id.selfId,

package/dist/llm/kernel-driver/tellask-special.js

@@ -1957,13 +1957,16 @@ async function executeReplyTellaskCall(args) {
                 sideDialog: args.dlg,
                 responseText: args.call.replyContent,
                 responseGenseq: genseq,
+                deliveryMode: 'reply_tool',
                 replyResolution: {
                     callId: args.call.callId,
                     replyCallName: args.call.callName,
                 },
+                allowExplicitReplyWithoutAssignmentAnchor: true,
                 scheduleDrive: args.callbacks.scheduleDrive,
             });
             if (!supplied) {
+                await persistence_1.DialogPersistence.clearPendingReplyDeliveryForCall(args.dlg.id, args.call.callId, args.dlg.status);
                 return {
                     delivered: false,
                     messages: [

package/dist/persistence.d.ts

@@ -660,6 +660,7 @@ export declare class DialogPersistence {
     static loadActiveTellaskReplyObligation(dialogId: DialogID, status?: DialogStatusKind): Promise<TellaskReplyDirective | undefined>;
     static markReplyDeliveryDelivered(dialogId: DialogID, replyCallId: string, deliveredAt: string, status?: DialogStatusKind): Promise<void>;
     static markReplyDeliveryToolResultRecorded(dialogId: DialogID, replyCallId: string, status?: DialogStatusKind): Promise<void>;
+    static clearPendingReplyDeliveryForCall(dialogId: DialogID, replyCallId: string, status?: DialogStatusKind): Promise<void>;
     static lookupRecordedTellaskCall(dialogId: DialogID, callId: string, status?: DialogStatusKind): Promise<DialogTellaskCallState['calls'][number] | undefined>;
     static recordTellaskCall(dialogId: DialogID, record: TellaskCallRecord, course: number, status?: DialogStatusKind): Promise<void>;
     static hasRecordedTellaskResult(dialogId: DialogID, callId: string, status?: DialogStatusKind): Promise<boolean>;

package/dist/persistence.js

@@ -2924,7 +2924,7 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
             });
             acceptedTriggers = triggerSelection.acceptedTriggers;
             if (triggerSelection.supersededTriggers.length > 0) {
-                log_1.log.debug('Superseded stale next-step triggers while starting queued runtime prompt generation', undefined, {
+                log_1.log.debug('Superseded stale next-step triggers while starting prompt-driven generation', undefined, {
                     dialogId: this.dialogId.valueOf(),
                     rootId: this.dialogId.rootId,
                     selfId: this.dialogId.selfId,
@@ -2933,7 +2933,7 @@ class DiskFileDialogStore extends dialog_1.DialogStore {
                     msgId: msgId ?? null,
                     acceptedTriggerIds: acceptedTriggers.map((trigger) => trigger.triggerId),
                     supersededTriggerIds: triggerSelection.supersededTriggers.map((trigger) => trigger.triggerId),
-                    reason: 'queued_runtime_prompt_new_course_takes_precedence',
+                    reason: 'prompt_generation_takes_precedence',
                 });
             }
             const acceptedTriggerIds = acceptedTriggers.map((trigger) => trigger.triggerId);
@@ -4960,23 +4960,17 @@ function filterNextStepTriggersForGenerationStart(args) {
     if (typeof args.msgId !== 'string' || args.msgId.trim() === '') {
         return { acceptedTriggers: orderedTriggers, supersededTriggers: [] };
     }
-    const promptTrigger = orderedTriggers.find((trigger) => trigger.kind === 'queued_prompt' &&
-        trigger.promptId === args.msgId &&
-        trigger.course === args.currentCourse);
-    if (promptTrigger === undefined) {
-        return { acceptedTriggers: orderedTriggers, supersededTriggers: [] };
-    }
     const acceptedTriggers = [];
     const supersededTriggers = [];
     for (const trigger of orderedTriggers) {
-        const belongsToPromptCourse = (() => {
+        const shouldAcceptTrigger = (() => {
             switch (trigger.kind) {
                 case 'queued_prompt':
                 case 'user_input':
                 case 'open_generation_recovery':
                     return trigger.course === args.currentCourse;
                 case 'followup':
-                    return trigger.sourceGeneration.course === args.currentCourse;
+                    return false;
                 case 'mainline_diligence':
                 case 'result_arrival':
                 case 'reply_delivery_recovery':
@@ -4987,7 +4981,7 @@ function filterNextStepTriggersForGenerationStart(args) {
                 }
             }
         })();
-        if (belongsToPromptCourse) {
+        if (shouldAcceptTrigger) {
             acceptedTriggers.push(trigger);
         }
         else {
@@ -8437,6 +8431,24 @@ class DialogPersistence {
             };
         }, status);
     }
+    static async clearPendingReplyDeliveryForCall(dialogId, replyCallId, status = 'running') {
+        await this.mutateDialogLatest(dialogId, (previous) => {
+            const replyDelivery = previous.replyDelivery;
+            if (!replyDelivery ||
+                replyDelivery.replyCallId !== replyCallId ||
+                replyDelivery.status !== 'pending') {
+                return { kind: 'noop' };
+            }
+            return {
+                kind: 'patch',
+                patch: {
+                    replyDelivery: undefined,
+                    nextStep: removeNextStepTrigger(previous.nextStep, (trigger) => trigger.kind === 'reply_delivery_recovery' &&
+                        trigger.replyDeliveryId === replyDelivery.replyDeliveryId),
+                },
+            };
+        }, status);
+    }
     static async lookupRecordedTellaskCall(dialogId, callId, status = 'running') {
         const normalizedCallId = callId.trim();
         if (normalizedCallId === '') {

package/dist/server/api-routes.js

@@ -66,6 +66,7 @@ const id_1 = require("../utils/id");
 const taskdoc_search_1 = require("../utils/taskdoc-search");
 const taskdoc_search_worker_client_1 = require("../utils/taskdoc-search-worker-client");
 const create_dialog_contract_1 = require("./create-dialog-contract");
+const dialog_forensics_routes_1 = require("./dialog-forensics-routes");
 const dominds_runtime_status_1 = require("./dominds-runtime-status");
 const dominds_self_update_1 = require("./dominds-self-update");
 const mime_types_1 = require("./mime-types");
@@ -1063,6 +1064,12 @@ async function handleApiRoute(req, res, pathname, context) {
         if (pathname === '/api/info' && req.method === 'GET') {
             return await handleGetRuntimeInfo(res, context);
         }
+        if (pathname === '/api/dialog-forensics.zip' && req.method === 'GET') {
+            return await (0, dialog_forensics_routes_1.handleDialogForensicsZipRoute)(req.url, res);
+        }
+        if (pathname === '/api/rtws/raw' && req.method === 'GET') {
+            return await handleGetRtwsRaw(req, res);
+        }
         if (pathname === '/api/dominds/self-update' && req.method === 'POST') {
             const body = await readRequestBody(req);
             let parsed;
@@ -1407,6 +1414,64 @@ async function handleApiRoute(req, res, pathname, context) {
         return true;
     }
 }
+function encodeContentDispositionFilenameStar(name) {
+    return encodeURIComponent(name).replace(/['()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function contentDispositionInlineFilename(name) {
+    const fallback = name.replace(/[^\x20-\x7e]|[\r\n\\"]/g, '_');
+    return `inline; filename="${fallback}"; filename*=UTF-8''${encodeContentDispositionFilenameStar(name)}`;
+}
+async function handleGetRtwsRaw(req, res) {
+    const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
+    const rawPath = urlObj.searchParams.get('path');
+    if (rawPath === null || rawPath.trim() === '') {
+        respondJson(res, 400, { success: false, error: '`path` is required' });
+        return true;
+    }
+    const pathRel = normalizeRtwsRelativePath(rawPath, { allowRoot: false });
+    if (pathRel === null) {
+        respondJson(res, 400, { success: false, error: 'Invalid rtws path' });
+        return true;
+    }
+    try {
+        const resolved = await resolveWorkspacePreviewPath(pathRel);
+        const stat = await promises_1.default.stat(resolved.candidateAbsPath);
+        if (!stat.isFile()) {
+            respondJson(res, 400, {
+                success: false,
+                error: 'Path must resolve to a file',
+                path: pathRel,
+            });
+            return true;
+        }
+        const headBytes = await readFileHead(resolved.candidateAbsPath, 512);
+        const mimeType = (0, mime_types_1.sniffMimeType)(pathRel, headBytes);
+        const data = await promises_1.default.readFile(resolved.candidateAbsPath);
+        res.writeHead(200, {
+            'Content-Type': mimeType,
+            'Content-Length': data.byteLength,
+            'Content-Disposition': contentDispositionInlineFilename(path.basename(pathRel)),
+            'Cache-Control': 'no-store',
+            'X-Content-Type-Options': 'nosniff',
+        });
+        res.end(data);
+        return true;
+    }
+    catch (error) {
+        const code = getErrorCode(error);
+        if (code === 'ENOENT') {
+            respondJson(res, 404, { success: false, error: 'Path not found', path: pathRel });
+            return true;
+        }
+        if (code === 'OUTSIDE_RTWS') {
+            respondJson(res, 403, { success: false, error: 'Path resolves outside rtws', path: pathRel });
+            return true;
+        }
+        log.error('Failed to read rtws raw file', error, { path: pathRel });
+        respondJson(res, 500, { success: false, error: 'Failed to read rtws raw file', path: pathRel });
+        return true;
+    }
+}
 function resolveRtwsDiligencePath(lang) {
     const parsed = typeof lang === 'string' ? (0, language_1.normalizeLanguageCode)(lang) : null;
     if (parsed === 'zh')

package/dist/server/dialog-forensics-routes.d.ts

@@ -0,0 +1,2 @@
+import type { ServerResponse } from 'http';
+export declare function handleDialogForensicsZipRoute(reqUrl: string | undefined, res: ServerResponse): Promise<boolean>;