dominds 1.25.11 → 1.25.13

package/dist/tools/os.js

@@ -15,6 +15,8 @@ exports.resolveShellCmdSpawnSpecForTests = resolveShellCmdSpawnSpecForTests;
 exports.detectWindowsShellUsageWarningForTests = detectWindowsShellUsageWarningForTests;
 exports.formatShellExecutionErrorForTests = formatShellExecutionErrorForTests;
 exports.resolveReadonlyShellSpawnSpecForTests = resolveReadonlyShellSpawnSpecForTests;
+exports.validateReadonlyShellCommandForTests = validateReadonlyShellCommandForTests;
+exports.detectReadonlyShellForbiddenHiddenDirAccessForTests = detectReadonlyShellForbiddenHiddenDirAccessForTests;
 const time_1 = require("@longrun-ai/kernel/utils/time");
 const child_process_1 = require("child_process");
 const crypto_1 = __importDefault(require("crypto"));
@@ -1194,7 +1196,7 @@ const readonlyShellSchema = {
     properties: {
         command: {
             type: 'string',
-            description: 'Read-only shell command (allowed prefixes: cat, rg, sed, ls, nl, wc, head, tail, stat, file, uname, whoami, id, echo, pwd, which, date, diff, realpath, readlink, printf, cut, sort, uniq, tr, awk, shasum, sha256sum, md5sum, uuid, git show, git status, git diff, git log, git blame, find, tree, jq, true; exact version probes: node --version|-v, python3 --version|-V; also allows: git -C <relative-path> <show|status|diff|log|blame> ...; also allows: cd <relative-path> && <allowed command...> (or ||); command chains via |/&&/|| are validated segment-by-segment)',
+            description: 'Read-only shell command (common allowed prefixes: cat, rg, sed, ls, nl, wc, head, tail, stat, file, uname, whoami, id, echo, pwd, which, date, diff, realpath, readlink, printf, cut, sort, uniq, tr, awk, shasum, sha256sum, md5sum, uuid, git show, git status, git diff, git log, git blame, find, tree, jq, true; Windows also allows: where, fc, findstr, dir, type, more, ver; exact version probes: node --version|-v, python3/python/py --version|-V; also allows: git -C <relative-path> <show|status|diff|log|blame> ...; also allows: cd <relative-path> && <allowed command...> (or ||); command chains via |/&&/|| are validated segment-by-segment)',
         },
         timeout_ms: {
             type: 'number',
@@ -1621,7 +1623,7 @@ exports.shellCmdTool = {
         }
     },
 };
-const readonlyShellAllowedPrefixes = [
+const readonlyShellCommonAllowedPrefixes = [
     'cat',
     'rg',
     'sed',
@@ -1662,22 +1664,42 @@ const readonlyShellAllowedPrefixes = [
     'jq',
     'true',
 ];
-function isAllowedReadonlyShellVersionProbe(command) {
-    const tokens = splitShellTokens(command);
+const readonlyShellWindowsAllowedPrefixes = [
+    'where',
+    'fc',
+    'findstr',
+    'dir',
+    'type',
+    'more',
+    'ver',
+];
+function getReadonlyShellAllowedPrefixes(platform = process.platform) {
+    if (platform === 'win32') {
+        return [...readonlyShellCommonAllowedPrefixes, ...readonlyShellWindowsAllowedPrefixes];
+    }
+    return readonlyShellCommonAllowedPrefixes;
+}
+function isAllowedReadonlyShellVersionProbe(command, platform = process.platform) {
+    const tokens = splitShellTokens(command, platform);
     if (tokens.length !== 2)
         return false;
-    const cmd = tokens[0]?.text ?? '';
+    const cmdRaw = tokens[0]?.text ?? '';
+    const cmd = platform === 'win32' ? cmdRaw.toLowerCase() : cmdRaw;
     const flag = tokens[1]?.text ?? '';
     if (cmd === 'node')
         return flag === '--version' || flag === '-v';
-    if (cmd === 'python3')
+    if (cmd === 'python3' || cmd === 'python' || cmd === 'py') {
         return flag === '--version' || flag === '-V';
+    }
     return false;
 }
-function validateReadonlyShellCommand(command) {
-    return validateReadonlyShellCommandInternal(command.trimStart(), 0);
+function validateReadonlyShellCommand(command, platform = process.platform) {
+    return validateReadonlyShellCommandInternal(command.trimStart(), platform, 0);
 }
-function validateReadonlyShellCommandInternal(command, depth) {
+function validateReadonlyShellCommandForTests(command, platform) {
+    return validateReadonlyShellCommand(command, platform);
+}
+function validateReadonlyShellCommandInternal(command, platform, depth) {
     if (depth > 8) {
         return {
             ok: false,
@@ -1688,8 +1710,8 @@ function validateReadonlyShellCommandInternal(command, depth) {
         };
     }
     const trimmed = command.trimStart();
-    if (trimmed.startsWith('cd ')) {
-        const parsed = parseCdChain(trimmed);
+    if (startsWithReadonlyShellCommand(trimmed, 'cd', platform)) {
+        const parsed = parseCdChain(trimmed, platform);
         if (!parsed) {
             return { ok: false, failure: { reason: 'INVALID_CD_SYNTAX', rejectedSegment: trimmed } };
         }
@@ -1703,9 +1725,9 @@ function validateReadonlyShellCommandInternal(command, depth) {
                 },
             };
         }
-        return validateReadonlyShellCommandInternal(parsed.rest, depth + 1);
+        return validateReadonlyShellCommandInternal(parsed.rest, platform, depth + 1);
     }
-    const chainParsed = splitTopLevelReadonlyShellChain(trimmed);
+    const chainParsed = splitTopLevelReadonlyShellChain(trimmed, platform);
     if (!chainParsed.ok) {
         return {
             ok: false,
@@ -1717,23 +1739,27 @@ function validateReadonlyShellCommandInternal(command, depth) {
     }
     if (chainParsed.segments.length > 1) {
         for (const segment of chainParsed.segments) {
-            const segmentValidation = validateReadonlyShellCommandInternal(segment, depth + 1);
+            const segmentValidation = validateReadonlyShellCommandInternal(segment, platform, depth + 1);
             if (!segmentValidation.ok) {
                 return segmentValidation;
             }
         }
         return { ok: true };
     }
-    if (trimmed.startsWith('git -C ')) {
+    if (startsWithReadonlyShellCommand(trimmed, 'git', platform) && /^git\s+-C\s+/iu.test(trimmed)) {
         // Allow a narrow, read-only subset of `git -C <dir> <subcommand> ...` as long as <dir> looks
         // like a safe *relative* path (no absolute paths / parent traversal). This avoids accidentally
         // inspecting outside the rtws with `git -C /...`.
         const tokens = trimmed.split(/\s+/g);
         // Expected: git -C <dir> <subcommand> ...
-        if (tokens.length >= 4 && tokens[0] === 'git' && tokens[1] === '-C') {
+        const gitCommand = tokens[0] ?? '';
+        const gitFlag = tokens[1] ?? '';
+        const isGitCommand = platform === 'win32' ? gitCommand.toLowerCase() === 'git' : gitCommand === 'git';
+        if (tokens.length >= 4 && isGitCommand && gitFlag === '-C') {
             const dirRaw = tokens[2] ?? '';
             const dir = dirRaw.replace(/^["']|["']$/g, '');
-            const subcommand = tokens[3] ?? '';
+            const subcommandRaw = tokens[3] ?? '';
+            const subcommand = platform === 'win32' ? subcommandRaw.toLowerCase() : subcommandRaw;
             if (!isSafeRelativePath(dir)) {
                 return { ok: false, failure: { reason: 'GIT_C_UNSAFE_PATH', rejectedSegment: trimmed } };
             }
@@ -1742,6 +1768,12 @@ function validateReadonlyShellCommandInternal(command, depth) {
                 subcommand === 'diff' ||
                 subcommand === 'log' ||
                 subcommand === 'blame') {
+                if (hasUnsafeReadonlyShellCommandOptions(trimmed, platform)) {
+                    return {
+                        ok: false,
+                        failure: { reason: 'UNSAFE_SHELL_SYNTAX', rejectedSegment: trimmed },
+                    };
+                }
                 return { ok: true };
             }
             return {
@@ -1751,17 +1783,93 @@ function validateReadonlyShellCommandInternal(command, depth) {
         }
         return { ok: false, failure: { reason: 'GIT_C_INVALID', rejectedSegment: trimmed } };
     }
-    if (isAllowedReadonlyShellVersionProbe(trimmed)) {
+    if (isAllowedReadonlyShellVersionProbe(trimmed, platform)) {
         return { ok: true };
     }
-    for (const prefix of readonlyShellAllowedPrefixes) {
-        if (trimmed === prefix || trimmed.startsWith(`${prefix} `)) {
+    for (const prefix of getReadonlyShellAllowedPrefixes(platform)) {
+        if (matchesReadonlyShellPrefix(trimmed, prefix, platform)) {
+            if (hasUnsafeReadonlyShellCommandOptions(trimmed, platform)) {
+                return {
+                    ok: false,
+                    failure: { reason: 'UNSAFE_SHELL_SYNTAX', rejectedSegment: trimmed },
+                };
+            }
             return { ok: true };
         }
     }
     return { ok: false, failure: { reason: 'COMMAND_NOT_ALLOWLISTED', rejectedSegment: trimmed } };
 }
-function splitTopLevelReadonlyShellChain(command) {
+function hasUnsafeReadonlyShellCommandOptions(command, platform) {
+    const tokens = splitShellTokens(command, platform);
+    const cmdRaw = tokens[0]?.text ?? '';
+    const cmd = platform === 'win32' ? cmdRaw.toLowerCase() : cmdRaw;
+    const args = tokens.slice(1).map((token) => token.text);
+    if (cmd === 'awk') {
+        return args.some((arg) => /\bsystem\s*\(/.test(arg) ||
+            arg.includes('>') ||
+            arg.includes('|') ||
+            arg === '-i' ||
+            arg.startsWith('-i') ||
+            arg === '--include' ||
+            arg.startsWith('--include=') ||
+            arg === '-l' ||
+            arg.startsWith('-l') ||
+            arg === '--load' ||
+            arg.startsWith('--load='));
+    }
+    if (cmd === 'sed') {
+        return args.some((arg) => arg === '-i' ||
+            arg.startsWith('-i') ||
+            arg === '--in-place' ||
+            arg.startsWith('--in-place=') ||
+            looksLikeSedWriteScript(arg));
+    }
+    if (cmd === 'find') {
+        return args.some((arg) => [
+            '-delete',
+            '-exec',
+            '-execdir',
+            '-ok',
+            '-okdir',
+            '-fprint',
+            '-fprint0',
+            '-fprintf',
+            '-fls',
+        ].includes(arg));
+    }
+    if (cmd === 'git') {
+        return args.some((arg) => arg === '-c' ||
+            arg === '--config-env' ||
+            arg.startsWith('--config-env=') ||
+            arg === '--exec-path' ||
+            arg.startsWith('--exec-path=') ||
+            arg === '--paginate' ||
+            arg === '--output' ||
+            arg.startsWith('--output=') ||
+            arg === '--ext-diff' ||
+            arg === '--external-diff' ||
+            arg === '--textconv');
+    }
+    if (cmd === 'sort') {
+        return args.some((arg) => arg === '-o' || arg.startsWith('-o') || arg.startsWith('--output'));
+    }
+    if (cmd === 'rg') {
+        return args.some((arg) => arg === '--pre' ||
+            arg.startsWith('--pre=') ||
+            arg === '--hostname-bin' ||
+            arg.startsWith('--hostname-bin='));
+    }
+    if (cmd === 'date') {
+        return args.some((arg) => arg === '-s' || arg.startsWith('-s') || arg === '--set' || arg.startsWith('--set='));
+    }
+    return false;
+}
+function looksLikeSedWriteScript(script) {
+    const commandParts = script.split(/[;{}]/g);
+    return commandParts.some((part) => /^\s*(?:[0-9,$!+~\/\\-]+|\/(?:\\.|[^/])*\/)?w(?:\s|$)/.test(part) ||
+        /s(.)(?:\\.|(?!\1).)*\1(?:\\.|(?!\1).)*\1[0-9gIpMew]*w/.test(part));
+}
+function splitTopLevelReadonlyShellChain(command, platform = process.platform) {
     const segments = [];
     let quote = null;
     let escape = false;
@@ -1775,6 +1883,7 @@ function splitTopLevelReadonlyShellChain(command) {
     };
     for (let i = 0; i < command.length; i++) {
         const ch = command[i] ?? '';
+        const next = command[i + 1] ?? '';
         if (escape) {
             escape = false;
             continue;
@@ -1783,20 +1892,38 @@ function splitTopLevelReadonlyShellChain(command) {
             if (ch === quote) {
                 quote = null;
             }
-            else if (ch === '\\' && quote === '"') {
+            else if (quote === '"' &&
+                (ch === '`' || (ch === '$' && next === '(') || (platform === 'win32' && ch === '%'))) {
+                return {
+                    ok: false,
+                    reason: 'UNSAFE_SHELL_SYNTAX',
+                    rejectedSegment: command.slice(segmentStart).trim() || command.trim(),
+                };
+            }
+            else if (ch === '\\' && quote === '"' && platform !== 'win32') {
                 escape = true;
             }
             continue;
         }
-        if (ch === '\\') {
+        if (ch === '\\' && platform !== 'win32') {
             escape = true;
             continue;
         }
-        if (ch === "'" || ch === '"') {
+        if (ch === '"' || (ch === "'" && platform !== 'win32')) {
             quote = ch;
             continue;
         }
-        const next = command[i + 1] ?? '';
+        if (ch === '`' ||
+            (ch === '$' && next === '(') ||
+            ch === '<' ||
+            ch === '>' ||
+            (platform === 'win32' && ch === '%')) {
+            return {
+                ok: false,
+                reason: 'UNSAFE_SHELL_SYNTAX',
+                rejectedSegment: command.slice(segmentStart).trim() || command.trim(),
+            };
+        }
         if ((ch === '&' && next === '&') || (ch === '|' && next === '|')) {
             if (!pushSegment(i)) {
                 return {
@@ -1861,15 +1988,28 @@ function splitTopLevelReadonlyShellChain(command) {
 function isSafeRelativePath(dir) {
     const hasParentTraversal = /(^|[\\/])\.\.([\\/]|$)/.test(dir);
     const isAbsoluteOrHome = dir.startsWith('/') ||
+        dir.startsWith('\\') ||
         dir.startsWith('~') ||
-        /^[A-Za-z]:[\\/]/.test(dir) ||
+        /^[A-Za-z]:/.test(dir) ||
         dir.startsWith('\\\\');
     return !isAbsoluteOrHome && !hasParentTraversal && dir.trim() !== '';
 }
-function parseCdChain(command) {
+function startsWithReadonlyShellCommand(command, executable, platform) {
+    return matchesReadonlyShellPrefix(command, executable, platform);
+}
+function matchesReadonlyShellPrefix(command, prefix, platform) {
+    const normalizedCommand = platform === 'win32' ? command.toLowerCase() : command;
+    const normalizedPrefix = platform === 'win32' ? prefix.toLowerCase() : prefix;
+    return (normalizedCommand === normalizedPrefix ||
+        new RegExp(`^${escapeRegexLiteral(normalizedPrefix)}\\s`, 'u').test(normalizedCommand));
+}
+function escapeRegexLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function parseCdChain(command, platform) {
     // Supports: cd <dir> && <rest>   or   cd <dir> || <rest>
-    // `<dir>` may be single/double-quoted; `<rest>` must be non-empty.
-    if (!command.startsWith('cd '))
+    // `<dir>` may be quoted; Windows cmd.exe only treats double quotes as quotes.
+    if (!/^cd\s+/iu.test(command))
         return null;
     let i = 2;
     while (i < command.length && /\s/.test(command[i] ?? ''))
@@ -1878,7 +2018,7 @@ function parseCdChain(command) {
         return null;
     const start = i;
     const first = command[i] ?? '';
-    if (first === '"' || first === "'") {
+    if (first === '"' || (first === "'" && platform !== 'win32')) {
         const quote = first;
         i++;
         while (i < command.length && command[i] !== quote)
@@ -1907,7 +2047,7 @@ function parseCdChain(command) {
         return null;
     return { dir, rest };
 }
-function splitShellTokens(command) {
+function splitShellTokens(command, platform = process.platform) {
     const out = [];
     let buf = '';
     let quote = null;
@@ -1929,7 +2069,7 @@ function splitShellTokens(command) {
             buf += ch;
             continue;
         }
-        if (ch === "'" || ch === '"') {
+        if (ch === '"' || (ch === "'" && platform !== 'win32')) {
             quote = ch;
             tokenQuoted = true;
             continue;
@@ -1943,9 +2083,12 @@ function splitShellTokens(command) {
     push();
     return out;
 }
+function normalizeReadonlyShellToken(token, platform) {
+    return platform === 'win32' ? token.toLowerCase() : token;
+}
 function firstReadonlyShellToken(segment) {
     const tokens = splitShellTokens(segment.trim());
-    return tokens[0]?.text ?? '';
+    return normalizeReadonlyShellToken(tokens[0]?.text ?? '', process.platform);
 }
 function getReadonlyShellSuggestionEn(failure) {
     const token = firstReadonlyShellToken(failure.rejectedSegment);
@@ -1957,6 +2100,9 @@ function getReadonlyShellSuggestionEn(failure) {
         failure.reason === 'CHAIN_PARSE_TRAILING_ESCAPE') {
         return 'Fix shell quoting first, then run an allowlisted segment (for example: `ls` or `rg <pattern>`).';
     }
+    if (failure.reason === 'UNSAFE_SHELL_SYNTAX') {
+        return 'Do not use redirects, command substitution, or Windows environment expansion in `readonly_shell`; run a plain allowlisted inspection command.';
+    }
     if (failure.reason === 'INVALID_CD_SYNTAX' || failure.reason === 'UNSAFE_RELATIVE_PATH') {
         return 'Use `cd <relative-path> && <allowed command...>`.';
     }
@@ -1970,8 +2116,8 @@ function getReadonlyShellSuggestionEn(failure) {
     }
     if (token === 'node')
         return 'Only version probes are allowed: `node --version || true`.';
-    if (token === 'python3' || token === 'python') {
-        return 'Only version probes are allowed: `python3 --version || true`.';
+    if (token === 'python3' || token === 'python' || token === 'py') {
+        return 'Only version probes are allowed: `python3 --version || true` (or `python --version` / `py --version` on Windows).';
     }
     if (token === 'false')
         return 'Use `true` as fallback (for example: `ls || true`).';
@@ -1992,6 +2138,9 @@ function getReadonlyShellSuggestionZh(failure) {
         failure.reason === 'CHAIN_PARSE_TRAILING_ESCAPE') {
         return '先修正引号/转义，再执行白名单子命令（例如：`ls` 或 `rg <pattern>`）。';
     }
+    if (failure.reason === 'UNSAFE_SHELL_SYNTAX') {
+        return '请勿在 `readonly_shell` 中使用重定向或命令替换；请直接运行白名单检查命令。';
+    }
     if (failure.reason === 'INVALID_CD_SYNTAX' || failure.reason === 'UNSAFE_RELATIVE_PATH') {
         return '请使用 `cd <相对路径> && <允许命令...>`。';
     }
@@ -2005,8 +2154,8 @@ function getReadonlyShellSuggestionZh(failure) {
     }
     if (token === 'node')
         return '仅允许版本探针：`node --version || true`。';
-    if (token === 'python3' || token === 'python') {
-        return '仅允许版本探针：`python3 --version || true`。';
+    if (token === 'python3' || token === 'python' || token === 'py') {
+        return '仅允许版本探针：`python3 --version || true`（Windows 上也可用 `python --version` / `py --version`）。';
     }
     if (token === 'false')
         return '兜底请用 `true`（例如：`ls || true`）。';
@@ -2020,8 +2169,9 @@ function getReadonlyShellSuggestionZh(failure) {
 function normalizeRelFromRtwsRoot(relPath) {
     return relPath.replace(/\\/g, '/').replace(/^\/+/, '');
 }
-function detectForbiddenRtwsRootHiddenDir(relFromRoot) {
-    const normalized = normalizeRelFromRtwsRoot(relFromRoot);
+function detectForbiddenRtwsRootHiddenDir(relFromRoot, platform = process.platform) {
+    const rawNormalized = normalizeRelFromRtwsRoot(relFromRoot);
+    const normalized = platform === 'win32' ? rawNormalized.toLowerCase() : rawNormalized;
     if (normalized === '.minds' || normalized.startsWith('.minds/'))
         return '.minds';
     if (normalized === '.dialogs' || normalized.startsWith('.dialogs/'))
@@ -2032,26 +2182,42 @@ function resolveRelFromRtwsRoot(workspaceRootAbs, baseDirRel, token) {
     const abs = path_1.default.resolve(workspaceRootAbs, baseDirRel, token);
     return path_1.default.relative(workspaceRootAbs, abs);
 }
-function detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command) {
+function detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command, platform = process.platform) {
     // Deny access to rtws-root `.minds/**` and `.dialogs/**` only.
     // Nested rtws (e.g. `ux-rtws/.minds/**`, `ux-rtws/.dialogs/**`) remains allowed.
     let baseDirRel = '.';
     let rest = command.trimStart();
     // Evaluate chained `cd ... && ...` prefixes and track base dir.
-    while (rest.startsWith('cd ')) {
-        const parsed = parseCdChain(rest);
+    while (startsWithReadonlyShellCommand(rest, 'cd', platform)) {
+        const parsed = parseCdChain(rest, platform);
         if (!parsed)
             break;
         const dir = parsed.dir.replace(/^["']|["']$/g, '');
         const relFromRoot = resolveRelFromRtwsRoot(workspaceRootAbs, baseDirRel, dir);
-        const forbidden = detectForbiddenRtwsRootHiddenDir(relFromRoot);
+        const forbidden = detectForbiddenRtwsRootHiddenDir(relFromRoot, platform);
         if (forbidden)
             return forbidden;
         baseDirRel = path_1.default.join(baseDirRel, dir);
         rest = parsed.rest.trimStart();
     }
-    const tokens = splitShellTokens(rest);
-    const cmd = tokens[0]?.text ?? '';
+    const chainParsed = splitTopLevelReadonlyShellChain(rest, platform);
+    if (chainParsed.ok && chainParsed.segments.length > 1) {
+        for (const segment of chainParsed.segments) {
+            const forbidden = detectReadonlyShellForbiddenHiddenDirAccessInSegment(workspaceRootAbs, baseDirRel, segment, platform);
+            if (forbidden)
+                return forbidden;
+        }
+        return null;
+    }
+    return detectReadonlyShellForbiddenHiddenDirAccessInSegment(workspaceRootAbs, baseDirRel, rest, platform);
+}
+function detectReadonlyShellForbiddenHiddenDirAccessForTests(workspaceRootAbs, command, platform) {
+    return detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command, platform);
+}
+function detectReadonlyShellForbiddenHiddenDirAccessInSegment(workspaceRootAbs, baseDirRel, segment, platform) {
+    const tokens = splitShellTokens(segment, platform);
+    const cmdRaw = tokens[0]?.text ?? '';
+    const cmd = platform === 'win32' ? cmdRaw.toLowerCase() : cmdRaw;
     if (!cmd)
         return null;
     const tokenText = (i) => {
@@ -2060,101 +2226,332 @@ function detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command)
             return null;
         return v.text;
     };
-    // Handle the special allowed form: `git -C <dir> <subcommand> ...`
-    if (cmd === 'git' && tokenText(1) === '-C') {
-        const dirToken = tokenText(2);
-        if (dirToken) {
-            const relFromRoot = resolveRelFromRtwsRoot(workspaceRootAbs, baseDirRel, dirToken);
-            const forbidden = detectForbiddenRtwsRootHiddenDir(relFromRoot);
-            if (forbidden)
-                return forbidden;
-        }
-        return null;
-    }
     const checkPathToken = (raw) => {
         const trimmed = raw.trim();
         if (trimmed === '' || trimmed === '-' || trimmed === '--')
             return null;
         const relFromRoot = resolveRelFromRtwsRoot(workspaceRootAbs, baseDirRel, trimmed);
-        return detectForbiddenRtwsRootHiddenDir(relFromRoot);
+        return detectForbiddenRtwsRootHiddenDir(relFromRoot, platform);
     };
+    const checkGitPathspecToken = (raw, gitBaseDirRel) => {
+        let pathspec = raw.trim();
+        if (pathspec === '' || pathspec === '-' || pathspec === '--')
+            return null;
+        if (pathspec.startsWith(':(')) {
+            const magicEnd = pathspec.indexOf(')');
+            if (magicEnd >= 0)
+                pathspec = pathspec.slice(magicEnd + 1);
+        }
+        if (pathspec.startsWith(':/'))
+            pathspec = pathspec.slice(2);
+        if (pathspec.startsWith(':'))
+            pathspec = pathspec.slice(1);
+        const relFromRoot = resolveRelFromRtwsRoot(workspaceRootAbs, gitBaseDirRel, pathspec);
+        return detectForbiddenRtwsRootHiddenDir(relFromRoot, platform);
+    };
+    if (cmd === 'git') {
+        let gitBaseDirRel = baseDirRel;
+        let argsStart = 2;
+        if (tokenText(1) === '-C') {
+            const dirToken = tokenText(2);
+            if (dirToken) {
+                const relFromRoot = resolveRelFromRtwsRoot(workspaceRootAbs, baseDirRel, dirToken);
+                const forbidden = detectForbiddenRtwsRootHiddenDir(relFromRoot, platform);
+                if (forbidden)
+                    return forbidden;
+                gitBaseDirRel = path_1.default.join(baseDirRel, dirToken);
+            }
+            argsStart = 4;
+        }
+        for (let index = argsStart; index < tokens.length; index++) {
+            const token = tokenText(index);
+            if (!token || token === '--' || token.startsWith('-'))
+                continue;
+            const forbidden = checkGitPathspecToken(token, gitBaseDirRel);
+            if (forbidden)
+                return forbidden;
+        }
+        return null;
+    }
     // Command-specific parsing to avoid false-positives where `.minds` is just a pattern/filter.
     if (cmd === 'rg') {
-        // `rg [OPTIONS] PATTERN [PATH ...]`
-        let i = 1;
-        while (i < tokens.length) {
-            const t = tokenText(i);
-            if (!t)
+        // `rg [OPTIONS] PATTERN [PATH ...]`; `rg --files [PATH ...]` has no pattern.
+        let index = 1;
+        let filesMode = false;
+        let patternConsumed = false;
+        while (index < tokens.length) {
+            const token = tokenText(index);
+            if (!token)
                 break;
-            if (t === '--') {
-                i += 1;
+            if (token === '--') {
+                index += 1;
                 break;
             }
-            if (t.startsWith('-')) {
-                i += 1;
+            if (token === '--files') {
+                filesMode = true;
+                index += 1;
                 continue;
             }
-            // First non-flag token is PATTERN (do not treat as a path).
-            i += 1;
-            break;
+            if (token === '-g' || token === '--glob' || token === '--iglob' || token === '-f') {
+                const optionValue = tokenText(index + 1);
+                if (optionValue) {
+                    const forbidden = checkPathToken(optionValue);
+                    if (forbidden)
+                        return forbidden;
+                }
+                index += 2;
+                continue;
+            }
+            if ((token.startsWith('-g') || token.startsWith('-f')) && token.length > 2) {
+                const optionValue = token.slice(2);
+                const forbidden = checkPathToken(optionValue);
+                if (forbidden)
+                    return forbidden;
+                index += 1;
+                continue;
+            }
+            if (token.startsWith('--glob=') ||
+                token.startsWith('--iglob=') ||
+                token.startsWith('--file=')) {
+                const optionValue = token.slice(token.indexOf('=') + 1);
+                const forbidden = checkPathToken(optionValue);
+                if (forbidden)
+                    return forbidden;
+                index += 1;
+                continue;
+            }
+            if (token === '-e' || token === '--regexp') {
+                index += 2;
+                continue;
+            }
+            if (token.startsWith('--regexp=')) {
+                index += 1;
+                continue;
+            }
+            if (token.startsWith('-')) {
+                index += 1;
+                continue;
+            }
+            if (!filesMode && !patternConsumed) {
+                patternConsumed = true;
+                index += 1;
+                continue;
+            }
+            const forbidden = checkPathToken(token);
+            if (forbidden)
+                return forbidden;
+            index += 1;
         }
-        for (; i < tokens.length; i++) {
-            const t = tokenText(i);
-            if (!t)
+        for (; index < tokens.length; index++) {
+            const token = tokenText(index);
+            if (!token)
                 continue;
-            const forbidden = checkPathToken(t);
+            const forbidden = checkPathToken(token);
             if (forbidden)
                 return forbidden;
         }
         return null;
     }
     if (cmd === 'jq') {
-        // `jq [OPTIONS] FILTER [FILE ...]`
-        let i = 1;
-        while (i < tokens.length) {
-            const t = tokenText(i);
-            if (!t)
+        // `jq [OPTIONS] FILTER [FILE ...]`; some options read files before FILTER.
+        let index = 1;
+        while (index < tokens.length) {
+            const token = tokenText(index);
+            if (!token)
                 break;
-            if (t === '--') {
-                i += 1;
+            if (token === '--') {
+                index += 1;
                 break;
             }
-            if (t.startsWith('-')) {
-                i += 1;
+            if (token === '-f' || token === '--from-file') {
+                const optionValue = tokenText(index + 1);
+                if (optionValue) {
+                    const forbidden = checkPathToken(optionValue);
+                    if (forbidden)
+                        return forbidden;
+                }
+                index += 2;
+                continue;
+            }
+            if (token.startsWith('--from-file=')) {
+                const optionValue = token.slice(token.indexOf('=') + 1);
+                const forbidden = checkPathToken(optionValue);
+                if (forbidden)
+                    return forbidden;
+                index += 1;
+                continue;
+            }
+            if (token === '--slurpfile' || token === '--rawfile' || token === '--argfile') {
+                const fileValue = tokenText(index + 2);
+                if (fileValue) {
+                    const forbidden = checkPathToken(fileValue);
+                    if (forbidden)
+                        return forbidden;
+                }
+                index += 3;
+                continue;
+            }
+            if (token === '--arg' || token === '--argjson') {
+                index += 3;
+                continue;
+            }
+            if (token.startsWith('-')) {
+                index += 1;
                 continue;
             }
             // First non-flag token is FILTER (do not treat as a file path).
-            i += 1;
+            index += 1;
             break;
         }
-        for (; i < tokens.length; i++) {
-            const t = tokenText(i);
-            if (!t)
+        for (; index < tokens.length; index++) {
+            const token = tokenText(index);
+            if (!token)
                 continue;
-            const forbidden = checkPathToken(t);
+            const forbidden = checkPathToken(token);
             if (forbidden)
                 return forbidden;
         }
         return null;
     }
+    if (cmd === 'where') {
+        // Windows `where /r <dir> <pattern>` recursively searches a directory.
+        for (let index = 1; index < tokens.length; index++) {
+            const token = tokenText(index);
+            if (!token)
+                continue;
+            if (token.toLowerCase() === '/r' || token.toLowerCase() === '-r') {
+                const optionValue = tokenText(index + 1);
+                if (optionValue) {
+                    const forbidden = checkPathToken(optionValue);
+                    if (forbidden)
+                        return forbidden;
+                }
+                index += 1;
+            }
+        }
+        return null;
+    }
+    if (cmd === 'findstr') {
+        // `findstr [OPTIONS] STRINGS [FILE ...]` — treat the first non-option as the pattern.
+        let index = 1;
+        while (index < tokens.length) {
+            const token = tokenText(index);
+            if (!token)
+                break;
+            const findstrOptionPath = /^[/\-](?:f|g|d):(.+)$/iu.exec(token);
+            if (findstrOptionPath) {
+                const optionValue = findstrOptionPath[1] ?? '';
+                const optionPaths = /^[/\-]d:/iu.test(token) ? optionValue.split(';') : [optionValue];
+                for (const optionPath of optionPaths) {
+                    const forbidden = checkPathToken(optionPath);
+                    if (forbidden)
+                        return forbidden;
+                }
+                index += 1;
+                continue;
+            }
+            if (token.startsWith('/') || token.startsWith('-')) {
+                index += 1;
+                continue;
+            }
+            index += 1;
+            break;
+        }
+        for (; index < tokens.length; index++) {
+            const token = tokenText(index);
+            if (!token)
+                continue;
+            const forbidden = checkPathToken(token);
+            if (forbidden)
+                return forbidden;
+        }
+        return null;
+    }
+    if (cmd === 'awk') {
+        let index = 1;
+        let programConsumed = false;
+        while (index < tokens.length) {
+            const token = tokenText(index);
+            if (!token)
+                break;
+            if (token === '-f' || token === '--file') {
+                const optionValue = tokenText(index + 1);
+                if (optionValue) {
+                    const forbidden = checkPathToken(optionValue);
+                    if (forbidden)
+                        return forbidden;
+                }
+                programConsumed = true;
+                index += 2;
+                continue;
+            }
+            if (token.startsWith('-f') && token.length > 2) {
+                const optionValue = token.slice(2);
+                const forbidden = checkPathToken(optionValue);
+                if (forbidden)
+                    return forbidden;
+                programConsumed = true;
+                index += 1;
+                continue;
+            }
+            if (token.startsWith('--file=')) {
+                const optionValue = token.slice(token.indexOf('=') + 1);
+                const forbidden = checkPathToken(optionValue);
+                if (forbidden)
+                    return forbidden;
+                programConsumed = true;
+                index += 1;
+                continue;
+            }
+            if (token === '-v' || token === '-F') {
+                index += 2;
+                continue;
+            }
+            if (token.startsWith('-F') && token.length > 2) {
+                index += 1;
+                continue;
+            }
+            if (token.startsWith('-')) {
+                index += 1;
+                continue;
+            }
+            if (!programConsumed) {
+                programConsumed = true;
+                index += 1;
+                continue;
+            }
+            const forbidden = checkPathToken(token);
+            if (forbidden)
+                return forbidden;
+            index += 1;
+        }
+        return null;
+    }
     if (cmd === 'find') {
-        // `find [path ...] [expression]` — only treat the initial paths as path roots.
-        for (let i = 1; i < tokens.length; i++) {
-            const t = tokenText(i);
-            if (!t)
+        // `find [global-options] [path ...] [expression]` — treat only initial roots as paths.
+        for (let index = 1; index < tokens.length; index++) {
+            const token = tokenText(index);
+            if (!token)
                 continue;
-            if (t.startsWith('-'))
+            if (token === '-H' || token === '-L' || token === '-P' || /^-O[0-9]$/.test(token)) {
+                continue;
+            }
+            if (token === '-D') {
+                index += 1;
+                continue;
+            }
+            if (token.startsWith('-'))
                 break;
-            if (t === '!' || t === '(' || t === ')')
+            if (token === '!' || token === '(' || token === ')')
                 break;
-            const forbidden = checkPathToken(t);
+            const forbidden = checkPathToken(token);
             if (forbidden)
                 return forbidden;
         }
         return null;
     }
     // Default conservative: treat non-flag args as potential paths for common file-inspection commands.
-    // This intentionally does NOT block `echo/printf/awk/...` where args are data, not paths.
+    // This intentionally does NOT block `echo/printf/...` where args are data, not paths.
     const pathLikeCommands = new Set([
         'cat',
         'ls',
@@ -2167,8 +2564,18 @@ function detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command)
         'diff',
         'realpath',
         'readlink',
+        'cut',
+        'sort',
+        'uniq',
+        'shasum',
+        'sha256sum',
+        'md5sum',
         'tree',
         'sed',
+        'dir',
+        'type',
+        'more',
+        'fc',
     ]);
     if (pathLikeCommands.has(cmd)) {
         for (let i = 1; i < tokens.length; i++) {
@@ -2187,10 +2594,10 @@ function detectReadonlyShellForbiddenHiddenDirAccess(workspaceRootAbs, command)
 exports.readonlyShellTool = {
     type: 'func',
     name: 'readonly_shell',
-    description: 'Execute a read-only shell command from a small allowlist. Only exact version probes are allowed for node/python (no scripts such as `node -e` or `python3 -c`). Command chains via |/&&/|| are validated segment-by-segment. Commands outside the allowlist are rejected.',
+    description: 'Execute a read-only shell command from a small allowlist. On Windows this runs through cmd.exe, so use allowlisted cmd/PATH commands such as `rg`, `git`, `dir`, `type`, or `where`. Only exact version probes are allowed for node/python (no scripts such as `node -e` or `python3 -c`). Command chains via |/&&/|| are validated segment-by-segment. Commands outside the allowlist are rejected.',
     descriptionI18n: {
-        en: 'Execute a read-only shell command from a small allowlist. Only exact version probes are allowed for node/python (no scripts such as `node -e` or `python3 -c`). Command chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call this tool yourself (no delegation). Commands outside the allowlist are rejected.',
-        zh: '执行只读 shell 命令，仅允许少量白名单命令前缀。对 node/python 仅允许版本探针（不允许 `node -e` / `python3 -c` 这类脚本）。通过 |/&&/|| 串联时会按子命令逐段校验。你已被明确授权自行调用该工具（无需委派）。不在允许列表内的命令会被拒绝。',
+        en: 'Execute a read-only shell command from a small allowlist. On Windows this runs through cmd.exe, so use allowlisted cmd/PATH commands such as `rg`, `git`, `dir`, `type`, or `where`. Only exact version probes are allowed for node/python (no scripts such as `node -e` or `python3 -c`). Command chains via |/&&/|| are validated segment-by-segment. You are explicitly authorized to call this tool yourself (no delegation). Commands outside the allowlist are rejected.',
+        zh: '执行只读 shell 命令，仅允许少量白名单命令前缀。Windows 上通过 cmd.exe 执行，请使用白名单内且 cmd/PATH 可用的命令，例如 `rg`、`git`、`dir`、`type` 或 `where`。对 node/python 仅允许版本探针（不允许 `node -e` / `python3 -c` 这类脚本）。通过 |/&&/|| 串联时会按子命令逐段校验。你已被明确授权自行调用该工具（无需委派）。不在允许列表内的命令会被拒绝。',
     },
     parameters: readonlyShellSchema,
     async call(dlg, caller, args) {
@@ -2206,15 +2613,15 @@ exports.readonlyShellTool = {
         }
         const validation = validateReadonlyShellCommand(command);
         if (!validation.ok) {
-            const allowedList = readonlyShellAllowedPrefixes.join(', ');
+            const allowedList = getReadonlyShellAllowedPrefixes().join(', ');
             const rejectedSegment = validation.failure.rejectedSegment.trim();
             const rejectedSegmentOrCommand = rejectedSegment === '' ? command : rejectedSegment;
             const suggestion = language === 'zh'
                 ? getReadonlyShellSuggestionZh(validation.failure)
                 : getReadonlyShellSuggestionEn(validation.failure);
             return (0, tool_1.toolFailure)(prependShellWarning(language === 'zh'
-                ? `❌ readonly_shell 仅允许以下命令前缀：${allowedList}\n另外允许（仅版本探针）：node --version|-v、python3 --version|-V\n脚本执行（如 node -e / python3 -c）一律拒绝。\n另外允许：git -C <相对路径> <show|status|diff|log|blame> ...\n另外允许：cd <相对路径> && <允许命令...>（或 ||）\n说明：通过 |/&&/|| 串联时会按子命令逐段校验。\n被拒子命令段：${rejectedSegmentOrCommand}\n允许的等价写法：${suggestion}\n收到：${command}`
-                : `❌ readonly_shell only allows these command prefixes: ${allowedList}\nAlso allowed (exact version probes only): node --version|-v, python3 --version|-V\nNode/python scripts (for example: node -e, python3 -c) are rejected.\nAlso allowed: git -C <relative-path> <show|status|diff|log|blame> ...\nAlso allowed: cd <relative-path> && <allowed command...> (or ||)\nNote: chains via |/&&/|| are validated segment-by-segment.\nRejected segment: ${rejectedSegmentOrCommand}\nAllowed equivalent: ${suggestion}\nGot: ${command}`, warning));
+                ? `❌ readonly_shell 仅允许以下命令前缀：${allowedList}\n另外允许（仅版本探针）：node --version|-v、python3/python/py --version|-V\n脚本执行（如 node -e / python3 -c）一律拒绝。\n另外允许：git -C <相对路径> <show|status|diff|log|blame> ...\n另外允许：cd <相对路径> && <允许命令...>（或 ||）\nWindows 上通过 cmd.exe 执行；请使用该 shell/PATH 中可用的白名单命令。\n说明：通过 |/&&/|| 串联时会按子命令逐段校验。\n被拒子命令段：${rejectedSegmentOrCommand}\n允许的等价写法：${suggestion}\n收到：${command}`
+                : `❌ readonly_shell only allows these command prefixes: ${allowedList}\nAlso allowed (exact version probes only): node --version|-v, python3/python/py --version|-V\nNode/python scripts (for example: node -e, python3 -c) are rejected.\nAlso allowed: git -C <relative-path> <show|status|diff|log|blame> ...\nAlso allowed: cd <relative-path> && <allowed command...> (or ||)\nOn Windows this runs through cmd.exe; use allowlisted commands available in that shell/PATH.\nNote: chains via |/&&/|| are validated segment-by-segment.\nRejected segment: ${rejectedSegmentOrCommand}\nAllowed equivalent: ${suggestion}\nGot: ${command}`, warning));
         }
         const forbiddenHiddenDir = detectReadonlyShellForbiddenHiddenDirAccess(path_1.default.resolve(process.cwd()), command);
         if (forbiddenHiddenDir) {