dominds 1.25.11 → 1.25.13

package/dist/tools/builtins.js

@@ -319,22 +319,20 @@ for (const tool of team_mgmt_1.teamMgmtTools) {
     manualSpec: manualSpecFor('ws_mod'),
 });
 // Inspect-and-patch helpers (function tools only; useful for GPT-5.x coding agents)
-if (process.platform !== 'win32') {
-    (0, registry_1.registerToolset)('codex_inspect_and_patch_tools', [os_1.readonlyShellTool, apply_patch_1.applyPatchTool]);
-    (0, registry_1.setToolsetMeta)('codex_inspect_and_patch_tools', {
-        source: 'dominds',
-        descriptionI18n: {
-            en: 'Inspect-and-patch helpers: use readonly_shell for lightweight inspection and apply_patch for reviewable edits.',
-            zh: '检查与补丁工具：用 readonly_shell 做轻量检查，用 apply_patch 做可审查修改。',
-        },
-        promptI18n: {
-            en: 'Use `apply_patch` (apply_patch patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
-            zh: '使用 `apply_patch`（apply_patch patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
-        },
-        promptFilesI18n: promptFilesFor('codex_inspect_and_patch_tools'),
-        manualSpec: manualSpecFor('codex_inspect_and_patch_tools'),
-    });
-}
+(0, registry_1.registerToolset)('codex_inspect_and_patch_tools', [os_1.readonlyShellTool, apply_patch_1.applyPatchTool]);
+(0, registry_1.setToolsetMeta)('codex_inspect_and_patch_tools', {
+    source: 'dominds',
+    descriptionI18n: {
+        en: 'Inspect-and-patch helpers: use readonly_shell for lightweight inspection and apply_patch for reviewable edits.',
+        zh: '检查与补丁工具：用 readonly_shell 做轻量检查，用 apply_patch 做可审查修改。',
+    },
+    promptI18n: {
+        en: 'Use `apply_patch` (apply_patch patch format) to modify files. Use `readonly_shell` for simple rtws (runtime workspace) inspection via its small allowlist; commands outside the allowlist are rejected. On Windows, `readonly_shell` runs through `cmd.exe`; use allowlisted commands available in that shell/PATH such as `rg`, `git`, `dir`, `type`, or `where`. For node/python, only exact version probes are allowed (no scripts). Chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call `readonly_shell` yourself; do not delegate it to a shell specialist. Avoid multi-line script-style commands; single-line is preferred (|, &&, || are ok). Paths must be relative to the rtws (runtime workspace). Hard denies: `readonly_shell` refuses rtws-root `.minds/` and `.dialogs/`; `apply_patch` is subject to the same access-control (including hard denies for `*.tsk/`, `.minds/`, and rtws-root `.dialogs/`).',
+        zh: '使用 `apply_patch`（apply_patch patch 格式）修改文件；使用 `readonly_shell` 做少量只读命令行检查，仅允许白名单命令前缀，白名单之外的命令会被拒绝。Windows 上 `readonly_shell` 通过 `cmd.exe` 执行；请使用该 shell/PATH 中可用的白名单命令，例如 `rg`、`git`、`dir`、`type` 或 `where`。对 node/python 仅允许版本探针（不允许脚本执行）。通过 |/&&/|| 串联命令时会按子命令逐段校验。你已被明确授权自行调用 `readonly_shell`，不要把它委派给 shell 专员。不建议多行脚本式命令，优先单行（允许 |、&&、||）。路径必须相对 rtws（运行时工作区）根目录。硬拒绝点：`readonly_shell` 无条件拒绝访问 rtws root 的 `.minds/` 与 `.dialogs/`；`apply_patch` 也受相同的访问控制约束（包含对 `*.tsk/`、`.minds/`、rtws root `.dialogs/` 的硬拒绝）。',
+    },
+    promptFilesI18n: promptFilesFor('codex_inspect_and_patch_tools'),
+    manualSpec: manualSpecFor('codex_inspect_and_patch_tools'),
+});
 (0, registry_1.registerToolset)('team_mgmt', [...team_mgmt_1.teamMgmtTools]);
 (0, registry_1.setToolsetMeta)('team_mgmt', {
     source: 'dominds',

package/dist/tools/os.d.ts

@@ -19,6 +19,20 @@ export declare function formatShellExecutionErrorForTests(shell: string | undefi
 export declare function resolveReadonlyShellSpawnSpecForTests(command: string, platform: NodeJS.Platform): ShellSpawnSpec;
 export declare const shellCmdReminderOwner: ReminderOwner;
 export declare const shellCmdTool: FuncTool;
+type ReadonlyShellValidationFailureReason = 'MAX_DEPTH' | 'INVALID_CD_SYNTAX' | 'UNSAFE_RELATIVE_PATH' | 'CHAIN_PARSE_EMPTY_SEGMENT' | 'CHAIN_PARSE_UNSUPPORTED_OPERATOR' | 'CHAIN_PARSE_UNTERMINATED_QUOTE' | 'CHAIN_PARSE_TRAILING_ESCAPE' | 'UNSAFE_SHELL_SYNTAX' | 'GIT_C_INVALID' | 'GIT_C_UNSAFE_PATH' | 'GIT_C_UNSUPPORTED_SUBCOMMAND' | 'COMMAND_NOT_ALLOWLISTED';
+type ReadonlyShellValidationFailure = Readonly<{
+    reason: ReadonlyShellValidationFailureReason;
+    rejectedSegment: string;
+}>;
+type ReadonlyShellValidationResult = Readonly<{
+    ok: true;
+}> | Readonly<{
+    ok: false;
+    failure: ReadonlyShellValidationFailure;
+}>;
+export declare function validateReadonlyShellCommandForTests(command: string, platform: NodeJS.Platform): ReadonlyShellValidationResult;
+type ForbiddenHiddenDir = '.minds' | '.dialogs';
+export declare function detectReadonlyShellForbiddenHiddenDirAccessForTests(workspaceRootAbs: string, command: string, platform: NodeJS.Platform): ForbiddenHiddenDir | null;
 export declare const readonlyShellTool: FuncTool;
 export declare const stopDaemonTool: FuncTool;
 export declare const getDaemonOutputTool: FuncTool;