dsh-agent-persona 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -4,6 +4,61 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.8] - 2026-10-23
+
+这一版几乎全部来自一次逐行读代码的审查：不改功能，修的是「它看起来在做 A，实际在做 B」的地方。
+
+### Fixed
+
+- **人设文件的守卫改成按能力判定，不再按工具名。** 原来维护两张工具名白名单，名单外的工具（`str_replace_editor`、
+  `terminal_send`，以及任何后来装上的插件工具）无论参数指向哪里都放行；`apply_patch` 的补丁正文更是完全看不见。
+  现在问的是「这次调用会不会写到受保护的文件」：参数里的路径（解析 `~` 与相对路径）、shell 行的重定向目标与写入型
+  命令、补丁正文里的 `*** Update File:` 目标，命中主文件、历史文件及其 `.bak-*`/`.tmp-*` 副本就拒。
+- **不再误杀只读的重定向。** `jq . <人设文件> > /tmp/c.json` 以前因为同一行里既有路径又有 `>` 而被拒；现在看的是
+  `>` 后面那个目标，写到别处就放行，写到人设文件才拒（`2>/dev/null` 也不再算写入）。
+- **`prefix` 规则不再把隔壁项目算进来。** `raw.startsWith(value)` 让 `/tmp/ws` 匹配到 `/tmp/ws-legacy`；现在两侧
+  `resolve` 后按分隔符比较，Windows 上按大小写不敏感比，`exact` 也开始认 `~/`。
+- **正则规则不再能卡死事件循环。** 长度上限 500 字符，编译缓存上限 64 条（原来既无上限也无淘汰）。
+- **局部更新不再毁字段。** `savePersona({ id, name })` 以前会把正文清空、把停用的人设重新启用（缺字段一律取默认值）；
+  现在每个字段都是「传了才覆盖」。
+- **保存失败不再留下脏内存。** 所有写操作先克隆当前 store 再改，持久化成功后才替换内存与时间戳；此前 `commit`
+  不刷新 `storeStamp`，写进去的内容下一次 reload 就被自己丢掉。
+- **版本历史坏掉不再让保存永久失败。** 记录前先校验链能否重放到当前正文，不能就重新以当前正文为基准（自愈），
+  而不是抛「版本历史损坏」；历史文件损坏时先复制成 `.bak-<时间戳>` 再重建，不再直接覆盖。
+- **`{"personas": []}` 不再静默吞掉全部版本。** 数组被当成对象接受，版本写到数组属性上，`JSON.stringify` 一序列化就没了。
+- **删除人设会清掉它的历史。** 之前 `personas.history.json` 只增不减。
+- **`duplicatePersona` 的副本保留注入方式。** 复制 `replace` 人设会退化成 `append`。
+- **备份文件名不再同秒覆盖。** 时间戳加到毫秒。
+- **`clipMarkdown` 不再劈开代理对。** 按 UTF-16 长度切片时可能停在半个 emoji 上，现在退一位。
+- **RPC 失败只回 `error.message`。** 以前把 `error.stack` 整段回给浏览器。
+- **配置里的 `tuneProvider` / `tuneModel` 进了 schema。** 代码一直在读它们，README 一直在写它们，只有校验层不认。
+- **设置页保存不再吞掉在途输入。** 保存返回时用服务端数据覆盖草稿，保存期间继续敲的字会消失；现在只有草稿没被改过
+  才覆盖，并用 `saveSeq` 丢弃过期响应。
+- **恢复版本、切换开关不再与在途保存打架。** 恢复前取消自动保存定时器并推进 `saveSeq`；版本 diff 请求带令牌，
+  过期响应不会覆盖新选择。
+- **关掉设置页不会再丢最后一次编辑。** 卸载时若草稿是脏的且自动保存开着，补一次保存。
+- **`Cmd/Ctrl+S` 不再能重入。** 保存中按快捷键会并发发两个请求。
+- **toast 不再常驻。** `onDone` 每次渲染都是新函数，宿主 `Toast` 的 `useEffect` 依赖它 → 定时器被不断续命。
+- **自动保存不再每次都弹两句话。** 去掉了先报的「正在自动保存…」，只留结果。
+- **偏好同步只发改动的那一项。** 以前发整份 prefs，两个标签页会互相覆盖。
+- **设置页刷新后偏好与存储一致。** `view.prefs` 现在也回填到界面状态，不只是写 localStorage。
+- **导入失败后重新拉取。** replace 模式中途失败会留下删了一半的列表。
+- **开关的无障碍语义。** `role="switch"` + `aria-checked` + `aria-describedby`（说明不再塞进 `aria-label` 变成一句话）。
+- **`injectStyles` 缓存不再指向已移除的节点。**
+
+### Changed
+
+- `files` 补上 `src`、`scripts/generate-remote.mjs` 与两份 tsconfig：以前 `npm ci` 之后 `prepare` 会用构建产物
+  覆盖源码，仓库里「生成产物漂移」的校验因此永远是绿的，而消费者从一个 tarball 里 rebuild 会直接失败。
+- CI 增加矩阵（Node 22 / 24）、`git diff --exit-code` 漂移门，以及一个把 tarball 装进空目录再 import 的冒烟 job。
+- `release.yml` 的手动触发默认 `dry_run: true`（以前默认直接发布）。
+- peer 依赖加上上界 `<0.3.0`：`>=` 表示「任何未来版本都能用」，这不成立。
+
+### Known
+
+- `exports["./client"]` 仍然没有 `types`：`lib/client.js` 是 esbuild 打成的一整个 IIFE，没有对应的 `.d.ts` 产物。
+  补它需要单独的类型入口，留给下一版。
+
 ## [0.1.7] - 2026-10-23
 
 ### Fixed

package/README.md

@@ -145,7 +145,8 @@ dsh plugin --profile web remove dsh-agent-persona            # 卸载
 | 编辑后自动保存 | 关 | 停手约 1 秒自动保存编辑区内容 | 立即；切换到人设规则行（工作区/会话）时**不**自动保存，避免存下半截选择 |
 | 在对话页显示「人设」标签 | 开 | 是否注册对话页那个视图 | 立即（运行时注册/注销） |
 | 注册到 dsh-better-sidebar | 开 | 是否把「人设」页面注册进 dsh-better-sidebar 的右侧栏 | 立即；**没装该插件时这个开关不显示** |
-| 禁止模型改写人设文件 | 开 | 拒绝模型的文件与命令工具写入或删除人设存储（读取不受影响）；关掉后模型可以直接改它 | 立即；对**下一次工具调用**生效 |
+| 禁止模型改写人设文件 | 开 | 按**能力**判定：任何会写入/删除人设存储（含它的历史文件与备份副本）的工具调用都拒绝，读取、`grep`、把路径写进笔记都不受影响；关掉后不拦 | 立即；对**下一次工具调用**生效 |
+| 保存人设版本历史 | 关 | 每次保存记一条可重放的 diff（最多 200 条，可查看/对比/恢复） | 立即；关掉后不再记新版本，已有历史仍可查看 |
 
 偏好存在人设文件的 `prefs` 字段里（不是浏览器），所以它和数据的可见范围一致；浏览器里只留一份镜像，
 供"加载时决定要不要注册视图"用。
@@ -179,8 +180,9 @@ dsh plugin --profile web remove dsh-agent-persona            # 卸载
 
 ```
 ~/.dsh/dsh-agent-persona/
-├── personas.json   # 人设数据 + 偏好，权限 600，原子写入
-└── state.json      # 加载心跳，每次加载时重写
+├── personas.json          # 人设数据 + 偏好，权限 600，原子写入
+├── personas.history.json  # 版本历史（开关打开后才出现）
+└── state.json             # 加载心跳，每次加载时重写
 ```
 
 正文里可以写 `{{model}}` 和 `{{cwd}}`，渲染时替换成当前的值；其他 `{{...}}` 会被去掉（未注册的变量会让
@@ -218,16 +220,18 @@ AI 只产出建议稿，点「采用」或「追加」才会进编辑框，再
 ## 几句实话
 
 - **人设是行为约束，不是安全边界**。它约束模型怎么说，不阻止模型用工具。
-- `personas.json` 的防篡改是**行为层面**的：插件注册了全局 `tools.guard`，拒绝指向该文件的写入（文件工具看参数里
-  的路径，shell 命令看"是否提到该路径或文件名"且"是否带写入特征"）。本机是 `danger-full-access` 时仍然可以绕过：
-  改插件代码、改 profile 的补丁文件，或者构造一条不带写入特征的载荷。要更结实就得在本机层面做：
+- 人设文件的防篡改是**能力层面**的判定：插件注册了全局 `tools.guard`，它不看工具叫什么名字，而是看这次调用会不会写到
+  受保护的文件 —— 参数里的路径（解析 `~` 与相对路径）、shell 命令里的重定向目标、写入型命令（删、移、原地改、解释器
+  `-c`），以及补丁正文里的 `*** Update File:` 目标。受保护的是主文件 `personas.json`、它的历史文件和它们的备份/临时副本。
+- 它仍然只是行为约束，绕过面写在明处：本机 `danger-full-access` 下改插件代码、改 profile 补丁文件都能绕过；脚本里
+  运行时拼出来的路径静态看不出；`$VAR` 展开看不出；别名/函数包装也看不出。要更结实得在本机层面做：
   `chflags uchg <人设文件>`（自己改之前先 `chflags nouchg`），或者把 DSH 跑在受限沙箱里、让人设文件属于别的用户。
-- 那条 shell 判定**按整条命令**生效：把 `md5 <人设文件>` 和 `chmod <人设文件>` 写在同一行，整条都会被拒（设计如此）。
+- 判定**按单次工具调用**生效：同一条命令里既读又写，写的那部分照样被拒，只读的部分不会被连坐。
 - 多处同时匹配时**只取第一条**，不拼接；规则是线性扫的，几十条没问题，几百条就该重新设计了。
 - 一个 profile 里只装一次。同一个进程挂两个同 id 的行会让组合起不来。
-- **测试的边界**：仓库里的测试是**单元测试 + 源码审计**（200 条宿主断言 + 165 条客户端断言 + 生成产物漂移校验；
-  这个数字由测试自己统计，不会随文件改动而失真），
-  它们保证逻辑与代码形状，**不驱动浏览器** —— 界面行为（视图渲染、开关、侧边栏卡片）目前靠人工核对。
+- **测试的边界**：仓库里的测试是**单元测试 + 源码审计**（236 条宿主断言 + 187 条客户端断言 + 生成产物漂移校验；
+  这个数字由测试自己统计，不会随文件改动而失真），它们保证逻辑与代码形状，**不驱动浏览器** —— 界面行为
+  （视图渲染、开关、侧边栏卡片）目前靠人工核对。
 
 ## 开发
 
@@ -246,7 +250,7 @@ docs/              架构、开发笔记、设计决策
 npm install
 npm run build        # generate:remote → tsc → esbuild（产出 lib/）
 npm run typecheck    # 两个 tsconfig 都不报错
-npm test             # 200 + 165 条断言 + 生成产物漂移校验
+npm test             # 236 + 187 条断言 + 生成产物漂移校验
 dsh --profile web --dump-config | grep -c 'id: agent-persona'   # 组合自检，应输出 1
 ```
 

package/README_EN.md

@@ -194,8 +194,9 @@ error.
 
 ```
 ~/.dsh/dsh-agent-persona/
-├── personas.json   # personas + preferences, mode 600, written atomically
-└── state.json      # load heartbeat, rewritten on every load
+├── personas.json          # personas + preferences, mode 600, written atomically
+├── personas.history.json  # version history (only while the switch is on)
+└── state.json             # load heartbeat, rewritten on every load
 ```
 
 The body may use `{{model}}` and `{{cwd}}`; other `{{...}}` are de-braced (an unregistered variable would make the
@@ -229,18 +230,22 @@ Agent 人设 page (`保存在 …`), so it is never a mystery which file you are
 
 - **A persona is a behavioural constraint, not a security boundary.** It shapes what the model says; it does not
   stop tools.
-- Tamper protection is a **behaviour** measure: the plugin registers a global `tools.guard` that refuses writes to
-  `personas.json` (file tools by the paths in their arguments; shell commands by mentioning the store together
-  with a write feature). On a `danger-full-access` machine it can still be bypassed — edit the plugin, edit the
-  profile patch, or craft a payload without a write marker. Harder options live at the machine level:
-  `chflags uchg <store>` (run `chflags nouchg` before editing it yourself), or a restricted sandbox with the store
-  owned by another user.
-- That shell test reads the **whole command**: a `md5 <store>` and a `chmod <store>` on one line are refused as a
-  unit (deliberate).
+- Tamper protection is decided by **capability, not by tool name**: a global `tools.guard` asks whether this call
+  would write a protected file — the paths in its arguments (resolved through `~` and relative paths), redirect
+  targets and writing commands in a shell line (delete, move, in-place edit, interpreter `-c`), and the targets
+  named by `*** Update File:` markers in a patch body. Protected: `personas.json`, its history file, and their
+  backup and temp copies.
+- It is still a behavioural measure, and the bypass surface is stated plainly: on `danger-full-access` you can
+  edit the plugin or the profile patch; a path assembled at runtime inside a script, `$VAR` expansion, or an
+  alias/function wrapper is invisible to a static read. Harder options live at the machine level: `chflags uchg
+  <store>` (run `chflags nouchg` before editing it yourself), or a restricted sandbox with the store owned by
+  another user.
+- The decision is per **tool call**: a line that both reads and writes has its writing half refused; the reading
+  half is not implicated.
 - Only the **first** match is used — no concatenation. Matching is a linear scan; dozens of rules are fine,
   hundreds want a redesign.
 - Install once per profile: two rows with the same id in one process make the composition fail.
-- **Test boundary**: the suite is unit tests plus source audits (200 host assertions, 165 client assertions, and a
+- **Test boundary**: the suite is unit tests plus source audits (236 host assertions, 187 client assertions, and a
   generated-artifact drift check; the numbers are counted by the suites themselves, so they cannot fall behind
   the files). It does not drive a browser — UI behaviour is checked by hand today.
 
@@ -261,7 +266,7 @@ docs/              architecture, development notes, design decisions
 npm install
 npm run build        # generate:remote → tsc → esbuild (writes lib/)
 npm run typecheck    # both tsconfigs, no errors
-npm test             # 200 + 165 assertions plus the generated-artifact drift check
+npm test             # 236 + 187 assertions plus the generated-artifact drift check
 dsh --profile web --dump-config | grep -c 'id: agent-persona'   # composition self-check, expects 1
 ```
 

package/lib/client.js

@@ -246,7 +246,7 @@
         report({ prefs: next, status: prefStatus(patch) });
         syncSidebarModule();
         if (api === void 0 || typeof api.savePrefs !== "function") return next;
-        void api.savePrefs(next).then((result) => {
+        void api.savePrefs(patch).then((result) => {
           const view = unwrap === void 0 ? result : unwrap(result);
           const stored = view !== void 0 && view !== null && view.prefs !== void 0 && view.prefs !== null ? writePrefs(view.prefs) : void 0;
           report(stored === void 0 ? { view } : { prefs: { ...next, ...stored }, view });
@@ -496,6 +496,10 @@
 .wsp-switch input:checked + .wsp-switch-track { background: var(--wsp-success); }
 .wsp-switch input:checked + .wsp-switch-track::after { transform: translateX(12px); }
 .wsp-switch input:focus-visible + .wsp-switch-track { outline: 2px solid var(--wsp-accent); outline-offset: 2px; }
+.wsp-sr-only {
+  position: absolute; width: 1px; height: 1px; margin: -1px; padding: 0;
+  overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0;
+}
 .wsp-switch-text { font-size: 11.5px; color: var(--wsp-muted); }
 
 /* \u2500\u2500 editor / preview \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
@@ -756,7 +760,8 @@
 `;
       let styleElement;
       const injectStyles = () => {
-        if (styleElement !== void 0) return styleElement;
+        if (styleElement !== void 0 && styleElement.isConnected) return styleElement;
+        if (styleElement !== void 0) styleElement.remove();
         styleElement = document.createElement("style");
         styleElement.setAttribute("data-dsh-agent-persona", "");
         styleElement.textContent = CSS;
@@ -1151,18 +1156,27 @@
       const Badge = ({ children, tone }) => h("span", {
         className: tone === void 0 ? "wsp-badge" : `wsp-badge wsp-badge-${tone}`
       }, children);
+      let switchId = 0;
       const Switch = ({ checked, disabled, label, hint, onChange }) => {
+        const descriptionId = React.useMemo(() => `wsp-switch-hint-${switchId += 1}`, []);
         const control = h("label", { className: "wsp-switch", title: hint === void 0 ? label : void 0 }, [
           h("input", {
             key: "i",
             type: "checkbox",
+            // Role and state, not just appearance: a checkbox announced as "checkbox" next to a track that
+            // says "switch" is two different controls to a screen reader. The hint belongs in the
+            // description, not in the name — a name that reads a whole sentence is unusable in a list.
+            role: "switch",
+            "aria-checked": checked === true,
             checked,
             disabled,
-            "aria-label": hint === void 0 ? label : `${label}\uFF1A${hint}`,
+            "aria-label": label,
+            "aria-describedby": hint === void 0 ? void 0 : descriptionId,
             onChange: (event) => onChange(event.target.checked)
           }),
           h("span", { key: "t", className: "wsp-switch-track" }),
-          h("span", { key: "l", className: "wsp-switch-text" }, label)
+          h("span", { key: "l", className: "wsp-switch-text" }, label),
+          hint === void 0 ? null : h("span", { key: "d", id: descriptionId, className: "wsp-sr-only" }, hint)
         ]);
         return hint === void 0 ? control : h(Tooltip, { label: hint, side: "top", delayMs: 260, maxWidth: 320 }, control);
       };
@@ -1211,6 +1225,9 @@
           this.importHighlightRef = React.createRef();
           this.importTimer = void 0;
           this.statusSeq = 0;
+          this.saveSeq = 0;
+          this.versionSeq = 0;
+          this.clearStatus = () => this.onChange({ status: "" });
           this.onChange = (patch) => {
             if (!this.mounted) return;
             if (patch !== null && typeof patch === "object" && "status" in patch) {
@@ -1225,6 +1242,7 @@
             const root = this.rootRef.current;
             if (root === null || !root.contains(event.target)) return;
             event.preventDefault();
+            if (this.state.busy === "save") return;
             void this.save();
           };
         }
@@ -1236,6 +1254,11 @@
           void this.load();
         }
         componentWillUnmount() {
+          if (this.autosaveTimer !== void 0 && this.isDirty()) {
+            clearTimeout(this.autosaveTimer);
+            this.autosaveTimer = void 0;
+            void this.save();
+          }
           clearTimeout(this.autosaveTimer);
           clearTimeout(this.importTimer);
           this.mounted = false;
@@ -1285,12 +1308,13 @@
           this.onChange({ busy: "load", error: "" });
           try {
             const view = this.unwrap(await api.listPersonas());
-            if (view?.prefs !== void 0 && view?.prefs !== null) writePrefs(view.prefs);
+            const stored = view?.prefs !== void 0 && view?.prefs !== null ? writePrefs(view.prefs) : void 0;
             const wanted = keepOpen === true ? this.state.openId : void 0;
             const persona = wanted === void 0 ? void 0 : (view.personas || []).find((item) => item.id === wanted);
             this.onChange({
               view,
               busy: "",
+              ...stored === void 0 ? {} : { prefs: { ...this.state.prefs, ...stored } },
               openId: persona === void 0 ? void 0 : wanted,
               draft: persona === void 0 ? void 0 : this.draftFrom(persona)
             });
@@ -1390,11 +1414,14 @@
           const api = this.api();
           const versions = this.state.versions;
           if (api === void 0 || versions === void 0 || index < 0) return;
+          const seq = this.versionSeq += 1;
           this.onChange({ versionsBusy: "diff", versionIndex: index, versionsError: "" });
           try {
             const diff = this.unwrap(await api.versionDiff({ id: versions.id, index }));
+            if (seq !== this.versionSeq) return;
             this.onChange({ versionsBusy: "", versionDiff: diff });
           } catch (error) {
+            if (seq !== this.versionSeq) return;
             this.onChange({ versionsBusy: "", versionDiff: void 0, versionsError: String(error && error.message || error) });
           }
         }
@@ -1403,6 +1430,9 @@
           const api = this.api();
           const versions = this.state.versions;
           if (api === void 0 || versions === void 0) return;
+          clearTimeout(this.autosaveTimer);
+          this.autosaveTimer = void 0;
+          this.saveSeq += 1;
           this.onChange({ versionsBusy: "restore", versionsError: "" });
           try {
             const view = this.unwrap(await api.restoreVersion({ id: versions.id, index }));
@@ -1606,7 +1636,6 @@
           clearTimeout(this.autosaveTimer);
           this.autosaveTimer = setTimeout(() => {
             this.autosaveTimer = void 0;
-            this.onChange({ status: "\u6B63\u5728\u81EA\u52A8\u4FDD\u5B58\u2026" });
             void this.save();
           }, 1200);
         }
@@ -1789,6 +1818,7 @@
             });
           } catch (error) {
             this.onChange({ transfer: { ...transfer, busy: false, error: `\u5BFC\u5165\u5931\u8D25\uFF1A${String(error && error.message || error)}` } });
+            await this.load(true);
           }
         }
         async pickImportFile(event) {
@@ -1808,6 +1838,8 @@
           const api = this.api();
           const draft = this.state.draft;
           if (api === void 0 || draft === void 0) return;
+          if (this.state.busy === "save") return;
+          const seq = this.saveSeq += 1;
           this.onChange({ busy: "save", error: "", status: "" });
           try {
             const view = this.unwrap(await api.savePersona({
@@ -1819,14 +1851,13 @@
               text: draft.text,
               targets: draft.targets
             }));
+            if (seq !== this.saveSeq) return;
             const persona = (view.personas || []).find((item) => item.id === draft.id);
-            this.onChange({
-              view,
-              busy: "",
-              draft: persona === void 0 ? void 0 : this.draftFrom(persona),
-              status: view.notice ?? "\u5DF2\u4FDD\u5B58\uFF0C\u4E0B\u4E00\u6761\u6D88\u606F\u5C31\u4F1A\u7528\u4E0A"
-            });
+            const latest = this.state.draft;
+            const draftAfter = latest === draft && persona !== void 0 ? this.draftFrom(persona) : latest;
+            this.onChange({ view, busy: "", draft: draftAfter, status: view.notice ?? "\u5DF2\u4FDD\u5B58\uFF0C\u4E0B\u4E00\u6761\u6D88\u606F\u5C31\u4F1A\u7528\u4E0A" });
           } catch (error) {
+            if (seq !== this.saveSeq) return;
             this.onChange({ busy: "", error: String(error && error.message || error) });
           }
         }
@@ -2447,7 +2478,6 @@ ${state.proposal.trim()}
               onClick: () => this.onChange({ filter: "" })
             }, "\u6E05\u7A7A")
           ]);
-          const hiddenNote = null;
           const conflictNotice = conflicts.size === 0 ? null : h("div", { className: "wsp-conflict-notice", key: "conflicts" }, [
             h(IconWarningOutline16, { key: "i" }),
             `${conflicts.size} \u6761\u4EBA\u8BBE\u7684\u8303\u56F4\u53EF\u80FD\u88AB\u4E0A\u9762\u7684\u4EBA\u8BBE\u5148\u547D\u4E2D\uFF08\u9F20\u6807\u60AC\u505C\u5BF9\u5E94\u5361\u7247\u770B\u539F\u56E0\uFF09`
@@ -2500,7 +2530,7 @@ ${state.proposal.trim()}
             key: `st-${String(state.statusSeq)}`,
             text: state.status,
             icon: h(IconCheckOutline14, {}),
-            onDone: () => this.onChange({ status: "" })
+            onDone: this.clearStatus
           });
           const history = state.history;
           const historyModal = h(Modal, {
@@ -2605,7 +2635,7 @@ ${state.proposal.trim()}
               key: "guard",
               checked: prefs.guard !== false,
               label: "\u7981\u6B62\u6A21\u578B\u6539\u5199\u4EBA\u8BBE\u6587\u4EF6",
-              hint: "\u6253\u5F00\u540E\uFF0C\u6A21\u578B\u7684\u6587\u4EF6\u4E0E\u547D\u4EE4\u5DE5\u5177\u4E0D\u80FD\u5199\u5165\u6216\u5220\u9664\u4EBA\u8BBE\u5B58\u50A8\uFF08personas.json \u53CA\u5176\u5907\u4EFD\uFF09\uFF1B\u8BFB\u53D6\u4E0D\u53D7\u5F71\u54CD\u3002\u5173\u6389\u540E\u6A21\u578B\u5C31\u80FD\u76F4\u63A5\u6539\u5B83\u3002\u8FD9\u662F\u884C\u4E3A\u5C42\u9762\u7684\u9650\u5236\uFF0C\u4E0D\u662F\u5B89\u5168\u8FB9\u754C\uFF1A\u672C\u673A\u4E0A\u7684\u5176\u5B83\u7A0B\u5E8F\u4ECD\u53EF\u4FEE\u6539\u3002",
+              hint: "\u6309\u80FD\u529B\u5224\u5B9A\uFF1A\u4EFB\u4F55\u4F1A\u5199\u5165\u6216\u5220\u9664\u4EBA\u8BBE\u5B58\u50A8\uFF08\u542B\u5B83\u7684\u5386\u53F2\u6587\u4EF6\u4E0E\u5907\u4EFD\u526F\u672C\uFF09\u7684\u5DE5\u5177\u8C03\u7528\u90FD\u4F1A\u88AB\u62D2\uFF0C\u4E0D\u770B\u5DE5\u5177\u53EB\u4EC0\u4E48\u540D\u5B57\uFF1B\u8BFB\u53D6\u3001\u641C\u7D22\u3001\u628A\u8DEF\u5F84\u5199\u8FDB\u7B14\u8BB0\u90FD\u4E0D\u53D7\u5F71\u54CD\u3002\u8FD9\u662F\u884C\u4E3A\u5C42\u9762\u7684\u9650\u5236\uFF0C\u4E0D\u662F\u5B89\u5168\u8FB9\u754C\uFF1A\u672C\u673A\u4E0A\u7684\u5176\u5B83\u7A0B\u5E8F\u4ECD\u53EF\u4FEE\u6539\u3002",
               onChange: (next) => this.setPref({ guard: next })
             }),
             h(Switch, {
@@ -2797,13 +2827,16 @@ ${state.proposal.trim()}
               ])
             ])
           ]));
-          return h("div", rootProps, [header, healthNote, prefsRow, transferRow, searchRow, hiddenNote, conflictNotice, h("div", { className: "wsp-cards", key: "cards" }, cards), status, historyModal, confirmModal, versionsModal, importModal]);
+          return h("div", rootProps, [header, healthNote, prefsRow, transferRow, searchRow, conflictNotice, h("div", { className: "wsp-cards", key: "cards" }, cards), status, historyModal, confirmModal, versionsModal, importModal]);
         }
       }
       const inject = ["slots", "remote", "connection"];
       function apply(ctx) {
         const style = injectStyles();
-        ctx.effect(() => () => style.remove(), `${NS}: styles`);
+        ctx.effect(() => () => {
+          style.remove();
+          if (styleElement === style) styleElement = void 0;
+        }, `${NS}: styles`);
         const prefs = readPrefs();
         if (prefs.showTab) ctx.slots.inject("conversation.view", () => ctx.slots.register({
           name: "conversation.view",

package/lib/index.d.ts

@@ -52,11 +52,17 @@ export declare const name = "agent-persona";
  * when the row loads, and a wrong value fails loudly instead of being ignored.
  */
 export declare const Config: Schema<Schemastery.ObjectS<{
-    /** Where the personas live. Empty means `$DSH_HOME/dsh-agent-persona/personas.json`. */
+    /** Where the personas live. Empty selects the default store under the DSH state directory. */
     storePath: Schema<string, string>;
+    /** Provider and model the AI-tuning button calls. Empty means whatever DSH is set to. */
+    tuneProvider: Schema<string, string>;
+    tuneModel: Schema<string, string>;
 }>, Schemastery.ObjectT<{
-    /** Where the personas live. Empty means `$DSH_HOME/dsh-agent-persona/personas.json`. */
+    /** Where the personas live. Empty selects the default store under the DSH state directory. */
     storePath: Schema<string, string>;
+    /** Provider and model the AI-tuning button calls. Empty means whatever DSH is set to. */
+    tuneProvider: Schema<string, string>;
+    tuneModel: Schema<string, string>;
 }>>;
 export declare const inject: string[];
 /** Persona injection modes: append after the preset persona, or replace it. */
@@ -92,7 +98,7 @@ export declare const normalizePrefs: (raw: any) => {
     /** Opt-in version history: off by default, because it writes a second file on every save. */
     history: boolean;
 };
-/** Filename-safe local timestamp for a store backup. */
+/** Filename-safe local timestamp for a store backup (milliseconds keep same-second backups apart). */
 export declare const backupStamp: (now?: Date) => string;
 /**
  * Copy the store aside before it is overwritten for the first time after a failed load. An exception here
@@ -101,14 +107,14 @@ export declare const backupStamp: (now?: Date) => string;
 export declare const backupStoreFile: (storePath: any, stamp: any) => string;
 /**
  * The store is this plugin's own instruction source, so a session running under a persona must not be able
- * to rewrite or delete that persona. This is the monotonic guard for that: it refuses any call whose
- * arguments point at the store, and any command that mentions the store together with a write feature.
+ * to rewrite or delete that persona. This guard refuses any call that would write the store (or the history
+ * file beside it), decided by what the arguments resolve to rather than by which tools happen to exist.
  *
- * Two honest limits, both deliberate: this constrains behaviour rather than enforcing security (a payload
- * without a write marker, a plugin edit, or a manual edit still get through), and the shell test reads the
- * whole command, so a read and a write of the store in one line is refused as a unit.
+ * Honest limits, all deliberate: it constrains behaviour rather than enforcing security (a plugin edit, a
+ * manual edit, or a path assembled at runtime inside a script still get through), it reads only the strings
+ * a tool call carries, and a command line is analysed statically — no shell is run to expand variables.
  */
-export declare const personaStoreGuardReason: (execution: any, storePath: any) => string;
+export declare const personaStoreGuardReason: (execution: any, storePath: any, cwd: any) => string;
 export declare const sanitizePersona: (text: any, warn?: () => void) => string;
 /**
  * Opt-in per-persona version history.