dsh-agent-persona 0.1.4 → 0.1.5

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.5] - 2026-10-20
+
+### Changed
+
+- **适配最新版 DSH `0.2.1-rc.2`。** 在 0.2.1-rc.2 上实测通过：设置页的人设列表、新建、保存
+  （`listPersonas` / `savePersona`，正文按 `MAX_TEXT_BYTES` 的 64 KiB 上限测了 6 KB 长文）与
+  system prompt 注入都正常；0.1.4 为 0.2.0-rc.2 补的 strict codec 契约（`create`/`decode`/`encode`）
+  与图标命名在 0.2.1-rc.2 上没有变化，所以那次适配继续有效。
+  `dsh.compatibility.dshReleases` 补上 `0.2.1-rc.2`（与 `0.1.5-rc.1`、`0.1.5-rc.2`、`0.2.0-rc.2`
+  并列 `compatible`）；宿主代码并不读取这个字段，它服务于插件市场/商店的版本提示，补上是为了让
+  "跑过哪些版本"与事实一致。
+- 宿主对**每一个**工具调用都会跑 `tools.guard`（0.2.1-rc.2 上实测 `compress` 也被拦），于是下面那条
+  守卫的误判从"偶尔"变成"常态"。
+
+### Fixed
+
+- **只读工具不再因为参数里出现人设存储路径而被拒绝。** `personaStoreGuardReason` 原来只看参数里有没有那个
+  路径，于是 `read`、`grep`、`compress` 这类根本不能改写存储的调用也会被拒绝，并回一条"工具不能写入或删除它"，
+  等于让会话连解释这个文件都做不到（同一个会话里 `compress` 就被挡过一次）。现在按工具名判断写意图：
+  `write`/`edit`/`multiedit`/`apply_patch` 等"参数即目标路径"的工具，路径指向存储才拒绝；`bash`/`pwsh`
+  等命令类工具仍要求同一个字符串里同时出现写特征（`rm`、`>`、`cp` 等）；其余只读工具一律放行。
+  存储保护本身没有放松：直接写存储、命令里删/覆盖存储，仍然照旧拒绝。
+
 ## [0.1.4] - 2026-10-08
 
 ### Fixed

package/README.md

@@ -51,9 +51,9 @@ DSH 会把工作区指令（`AGENTS.md` 之类）变成一条 **user 角色**的
 
 ## 装
 
-**实测过的 DSH 版本：`0.1.5-rc.1`（作者的开发环境）与 `0.1.5-rc.2`。** `package.json` 的 `dsh.compatibility`
-声明的就是这两项 —— 含义是"我们在这些版本上跑过"，**不是**对更早或更新版本做过兼容工作的承诺；
-其它版本请自行验证。
+**实测过的 DSH 版本：`0.1.5-rc.1`（作者的开发环境）、`0.1.5-rc.2`、`0.2.0-rc.2` 与最新版
+`0.2.1-rc.2`。** `package.json` 的 `dsh.compatibility` 声明的就是这四项 —— 含义是"我们在这些版本上跑过"，
+**不是**对更早或更新版本做过兼容工作的承诺；其它版本请自行验证。
 
 侧边栏卡片还需要 **`dsh-better-sidebar`**：没装它时，「注册到 dsh-better-sidebar」这个开关不会出现
 （没有可注册的地方），插件其余功能照常。

package/README_EN.md

@@ -61,9 +61,9 @@ workspace cannot touch this layer.
 
 ## Install
 
-**Tested against DSH `0.1.5-rc.1` (the author's development environment) and `0.1.5-rc.2`.** That is what
-`package.json`'s `dsh.compatibility` declares — it means "we ran on these", not a promise of compatibility work
-for older or newer releases; please verify on yours.
+**Tested against DSH `0.1.5-rc.1` (the author's development environment), `0.1.5-rc.2`, `0.2.0-rc.2` and
+the current `0.2.1-rc.2`.** That is what `package.json`'s `dsh.compatibility` declares — it means "we ran on
+these", not a promise of compatibility work for older or newer releases; please verify on yours.
 
 The sidebar card additionally needs **`dsh-better-sidebar`**: without it the `注册到 dsh-better-sidebar` switch is not
 shown at all (there is nothing to register into), and everything else works as usual.

package/lib/index.js

@@ -221,6 +221,10 @@ export const backupStoreFile = (storePath, stamp) => {
 /** Write features that turn "mentions the store" into "writes the store" inside one shell command. */
 const STORE_WRITE_MARKERS = ['>', 'rm ', 'rm\t', 'mv ', 'cp ', 'chmod', 'chflags', 'truncate', 'sed -i', 'tee ', 'write(', 'unlink(', 'rename('];
 const STORE_REFUSAL = '人设存储由 agent-persona 插件管理：工具不能写入或删除它。需要修改人设时，请让用户在「设置 → Agent 人设」里操作。';
+/** Tools whose own arguments name the file they write, so a store path in them is the target. */
+const STORE_PATH_TOOLS = new Set(['write', 'edit', 'multiedit', 'apply_patch', 'create_file', 'delete_file', 'move_file']);
+/** Tools that run a command line, where the store only matters next to a write feature. */
+const STORE_SHELL_TOOLS = new Set(['bash', 'pwsh', 'shell', 'exec', 'terminal', 'run_command']);
 /** Every string nested anywhere in a tool call's arguments, to a bounded depth. */
 const stringsIn = (value, out = [], depth = 0) => {
     if (depth > 6 || value === null || value === undefined)
@@ -251,23 +255,32 @@ const stringsIn = (value, out = [], depth = 0) => {
  * whole command, so a read and a write of the store in one line is refused as a unit.
  */
 export const personaStoreGuardReason = (execution, storePath) => {
+    const name = String(execution?.name ?? '');
+    const shell = STORE_SHELL_TOOLS.has(name);
+    // A read-only call cannot rewrite the store, so a path that merely appears in its arguments is not a
+    // write. Refusing those (`read`, `grep`, `compress`, ...) turned the guard into a trap for honest work:
+    // any tool whose arguments quoted the store path was denied with a message about writing it.
+    if (!shell && !STORE_PATH_TOOLS.has(name))
+        return undefined;
     const values = stringsIn(execution?.arguments);
     const target = resolve(storePath);
-    if (values.some((value) => {
+    const base = basename(storePath);
+    const dir = dirname(storePath);
+    const pointsAtStore = values.some((value) => {
         try {
             return resolve(value) === target;
         }
         catch {
             return false;
         }
-    }))
-        return STORE_REFUSAL;
-    const base = basename(storePath);
-    const dir = dirname(storePath);
-    if (values.some((value) => (value.includes(base) || value.includes(dir))
-        && STORE_WRITE_MARKERS.some((marker) => value.includes(marker))))
-        return STORE_REFUSAL;
-    return undefined;
+    });
+    const nearStore = values.some((value) => value.includes(base) || value.includes(dir));
+    const writes = values.some((value) => STORE_WRITE_MARKERS.some((marker) => value.includes(marker)));
+    // A tool that names its own target writes exactly what it points at; a shell command has to mention a
+    // write feature before the path inside it counts.
+    if (shell)
+        return nearStore && writes ? STORE_REFUSAL : undefined;
+    return pointsAtStore || (nearStore && writes) ? STORE_REFUSAL : undefined;
 };
 export const sanitizePersona = (text, warn = () => { }) => {
     const dropped = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agent-persona",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Workspace personas for DeepSeek Harness (DSH): create many system-prompt personas and scope each one by workspace path or session id (exact / prefix / regex / contains), managed from a Web settings page with Markdown editing and AI tuning.",
   "type": "module",
   "main": "lib/index.js",
@@ -82,7 +82,8 @@
       "dshReleases": {
         "0.1.5-rc.1": "compatible",
         "0.1.5-rc.2": "compatible",
-        "0.2.0-rc.2": "compatible"
+        "0.2.0-rc.2": "compatible",
+        "0.2.1-rc.2": "compatible"
       }
     }
   },