dsh-any-agent 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -7,6 +7,74 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.2] — 2026-11-05
+
+### Fixed
+
+- **`workspace_changed` no longer misses real edits.** The turn snapshot now
+  fingerprints every `git status` entry (status line + per-path size/mtime,
+  with untracked directories expanded recursively), not just the first 40
+  status lines. A file that was already dirty and changed again, or any change
+  past the 40th entry, is detected; `changed_files` and `entries` keep their
+  old meaning (`entries` is still display-truncated to 40).
+- **`gitStatus` is asynchronous.** Turn start/end snapshots now use `execFile`
+  instead of `spawnSync`, so a large repository's `git status` (up to 8 s) no
+  longer blocks the shared MCP event loop, ACP messages, approvals or other
+  conversations. `busy` is still set before any await; turn finalization keeps
+  releasing `busy`, waking interject waiters and scheduling the drain before
+  waiting for git, and only writes the sentinel after the result (including
+  `workspace_changed` and the review ticket) is complete.
+- `--no-optional-locks` is passed as a **global** git option (before the
+  subcommand); previously `git status ... --no-optional-locks` exited 129, so
+  every real snapshot was `null` and `workspace_changed` stayed false.
+- **`dsh_get(max_chars)` now bounds the whole response.** The budget used to
+  apply only to the rendered text while `structured.run.result` kept every
+  tool's full input, so a 77-tool turn came back as ~75K characters and was
+  rejected by Claude Code's per-call limit even with `max_chars=8000`. With
+  `max_chars > 0`, structured is compacted too: the answer is truncated and
+  `tools_used[]` keeps `id/title/name/status/kind` plus `input_chars`
+  (`run.result_compacted: true`). `max_chars=0` (default) is unchanged; the
+  full result is always in the sentinel file.
+- **`dsh_doctor` flags unverified DSH versions and fragile entry points.** A new
+  `dsh_version` check grades the DSH version against the compatibility matrix
+  (`verified` 0.1.7 ≤ v < 0.2.0 → ok; `partial`, `unsupported`, `unverified`
+  such as 0.2.x, or unreadable → warn). `dsh_bin` warns when DSH resolves from
+  an npx cache (`_npx/<hash>/`), which disappears on cache cleanup.
+
+### Added
+
+- **Auto-approved approvals are visible.** Under `on_approval=auto-allow`, every
+  turn result now carries `auto_approvals_total`, `auto_escalations_total`
+  (requests with `sandbox_permissions`, e.g. `danger-full-access`) and up to 20
+  redacted `auto_approvals` summaries (tool, escalation, justification, command
+  preview). The review ticket's evidence and checklist call them out, so a
+  `workspace-write` session that silently escalated no longer looks like it
+  stayed in bounds. Defaults are unchanged; use `on_approval=ask` to gate each.
+- **PowerShell sentinel waiter.** On Windows the background receipt includes a
+  ready-made, quote-escaped `sentinel_wait_powershell` command (also in the
+  text), and the server instructions document it, for hosts where Git Bash is
+  missing or hangs.
+
+### Website
+
+- Playground: step backward, stateful connection-line status, sentinel receipt
+  pulse, and a "try interject" cross-scenario action on dispatch frames.
+- Code snippets now use one-pass syntax highlighting (quoted keys, values,
+  comments and arrows) without nested spans; the Cursor config tab and copy
+  success icon were added; `/en/` HTML is explicitly revalidated.
+- Navigation now surfaces the FAQ; English and Chinese nav order match.
+
+### Documentation
+
+- Fix the profile-creation command in `USAGE-NOTES.md` / `.en.md`: it needs
+  `dsh --profile dsh-mcp --from-default-profile acp`, and 0.5.0+ normally
+  bootstraps the profile automatically.
+- Correct the team-mode profile default in `docs/zh/limits.md` and the
+  architecture diagrams: `dsh-mcp` is default; `dsh-team` is used only when
+  team mode is on.
+- Clarify the website README's Node.js floor (website build ≥ 22; the MCP
+  server itself requires ≥ 22.15).
+
 ## [0.5.1] — 2026-11-04
 
 ### Security

package/DESIGN.md

@@ -252,7 +252,7 @@ Profile = `~/.dsh/profiles/<name>/`，由 `package.json` 的 `dsh.profile.bundle
 
 **B11 设计要点（调用方审核）**
 - **为什么放进返回载荷**：返回值是"另一个 agent 的自述"。调用方最常见的失败模式是直接转述"已完成/已修好"。审核要求必须和结果出现在同一条消息里（`content.text`、`structuredContent`、哨兵 `result.review`），才可能改变调用方的下一步动作；单独一个"记得审核"的约定会被忽略。
-- **审核单形状**：`{review_id, mode, status, run_id, prompt_preview, checklist, evidence, submit:{tool:"dsh_review", arguments}, instructions}`。清单随回合形状变化（有没有改工作区、有没有错误、用了哪些工具）；`evidence` 只放核对所需的最小事实（stop_reason、error、changed_files、工具名）。
+- **审核单形状**：`{review_id, mode, status, run_id, prompt_preview, checklist, evidence, submit:{tool:"dsh_review", arguments}, instructions}`。清单随回合形状变化（有没有改工作区、有没有错误、用了哪些工具）；`evidence` 只放核对所需的最小事实（stop_reason、error、changed_files、工具名）。`workspace_changed` 必须基于**全量**快照指纹（逐路径 size/mtime，未跟踪目录递归），只比前 40 条状态行会把"同一状态行但内容变了"误报成没落地，审核清单也就失去了证据价值。
 - **默认 advisory，不阻塞**：这是刻意的产品选择。强制门禁会打断"审核失败 → 派修复回合"的自然流程，也会破坏既有调用方；advisory 只把审核请求显性化。`review=off` 可按会话/单次派活关闭；即使 off，`dsh_review` 仍可对旧 run 显式补审核。
 - **裁决落盘与回写**：`reviews/<会话id>/<run_id>.review.json` 原子写入（tmp + rename，唯一 tmp 名），含裁决、理由/findings、清单与证据。`submitReview` 依次从内存 run → 哨兵 → 已有审核记录取事实，所以服务重启、run 被挤出内存后仍可审核。提交后 **原子重写哨兵里的 `result.review`**，避免异步调用方下次读文件看到与事实相反的 `pending`。
 - **隐私**：审核单不含思考正文；理由、findings、任务预览、证据**与每个 checklist 项**在落盘前都走 `redact.sanitizeApprovalContext`（与审批上下文同一套规则）——checklist 会拼接 `result.error`，漏掉它就会成为第二个明文泄漏点。审核记录与哨兵共用 `DSH_MCP_SENTINEL_TTL_MS` 的 7 天清理。
@@ -305,7 +305,7 @@ Profile = `~/.dsh/profiles/<name>/`，由 `package.json` 的 `dsh.profile.bundle
 
 | # | 功能 | 说明 |
 |---|---|---|
-| E1 | **返回变更 diff** | 回合结束后返回工作区变更（`workspace/changes` 事件 + `git diff --stat`）。**让调用方 agent 能审阅 DSH 的产出再决定是否接受**——这是"外包工程师"模式的关键 |
+| E1 | **返回工作区变更** | 回合结束后返回 `workspace_changed`（本回合前后 `git status` 的**全量**快照指纹：状态行 + 逐路径 size/mtime，未跟踪目录递归展开）与 `diff_stat`（当前脏文件摘要）。快照走异步子进程，不阻塞共享 MCP 事件循环。**让调用方 agent 能审阅 DSH 的产出再决定是否接受**——这是"外包工程师"模式的关键 |
 | E2 | 计划模式 | 只出计划不落地（`dsh-plan-mode`），调用方批准后再执行 |
 | E3 | 审查模式 | 对既有改动做对抗式审查 |
 | E4 | 接受/回滚 | 会话级 checkpoint（DSH 有 `dsh-session-checkpoint-policy`）配合 git 做回滚 |

package/README.md

@@ -15,7 +15,7 @@
 
 </div>
 
-🧪 0.5.1 offline suite green, including caller review and input-boundary hardening · 🔌 MCP over stdio · 📦 Zero dependencies · 📜 MIT
+🧪 0.5.2 offline suite green, including the workspace-change detection fix and visible auto-approvals · 🔌 MCP over stdio · 📦 Zero dependencies · 📜 MIT
 
 An MCP server that drives DeepSeek Harness as a **long-lived coding agent**. Hand it a goal, let it write code and run scripts, steer it mid-flight, and collect the result when you are ready.
 

package/README.zh.md

@@ -15,7 +15,7 @@
 
 </div>
 
-🧪 0.5.1 本机离线套件全绿，含调用方审核与输入边界加固 · 🔌 MCP over stdio · 📦 零依赖 · 📜 MIT
+🧪 0.5.2 本机离线套件全绿，含工作区变化检测修复、自动放行审批可见 · 🔌 MCP over stdio · 📦 零依赖 · 📜 MIT
 
 一个 MCP 服务端，把 DeepSeek Harness 当作**长驻的编码 agent** 来驱动。开个会话、扔个目标，它自己写代码、跑脚本、派子代理；你随时能看、能插话、能回头验收。
 

package/USAGE-NOTES.en.md

@@ -8,7 +8,7 @@ Practical gotchas and trade-offs you *will* hit when letting Claude / Codex driv
 
 ## 1. Setup
 
-**1.1 The profile must exist first.** Otherwise every turn fails with `no adapter registered for provider "xxx"`. This server ships no provider config; it drives `~/.dsh/profiles/dsh-mcp/`. Create it with `dsh dsh-mcp --from-default-profile acp` and fill in your own provider per [`profile-example/cordis.patch.yml`](profile-example/cordis.patch.yml).
+**1.1 The profile must exist first.** Otherwise every turn fails with `no adapter registered for provider "xxx"`. This server ships no provider config; it drives `~/.dsh/profiles/dsh-mcp/`. Create it with `dsh --profile dsh-mcp --from-default-profile acp` and fill in your own provider per [`profile-example/cordis.patch.yml`](profile-example/cordis.patch.yml). On 0.5.0+ the server bootstraps this profile on first start, so the manual command is normally only needed when `DSH_MCP_BOOTSTRAP=0` or the profile is broken.
 
 **1.2 ★ The most common trap: ACP's model does NOT come from `agent-default-model`.** You configure your provider there, yet turns fail with `no API key for provider route "deepseek-official"`. ACP reads the `dsh-acp` plugin's own `config.provider` / `config.model`, which the `acp` bundle hard-codes. You must override the `acp` row:
 
@@ -130,7 +130,7 @@ Practical gotchas and trade-offs you *will* hit when letting Claude / Codex driv
 1. **Give goals, not commands.** DSH is an agent: say "add tests for this module and make them pass", not "run pytest". It picks tools, plans steps, and spawns subagents on its own.
 2. **One conversation per task** — mixing unrelated work pollutes history and costs more.
 3. **Split long work into dispatch + collect**: `wait=false` → do something else → `dsh_get(run_id)`.
-4. **Review output via workspace changes** — `workspace_changed` is true when the `git status` entry set changed across the turn; `diff_stat` lists the current dirty files (it is not a per-turn diff).
+4. **Review output via workspace changes** — `workspace_changed` compares a **full** `git status` snapshot fingerprint taken before and after the turn (status line plus each dirty/untracked path's size and mtime; untracked directories are expanded recursively), so an already-dirty file that changes again, or a change past the 40th entry, is still detected. `diff_stat` lists the current dirty files (it is not a per-turn diff).
 5. **Review the result, don't just relay it** — every result carries a `review` ticket. Check at least one claim with your own tools (read the changed file, inspect `git diff`, run the relevant test), then record `pass` / `partial` / `fail` with `dsh_review`. Default `advisory` does not block the next send; `fail`/`partial` need a reason, and a failed review is not fed back to DSH automatically.
 6. **Ask for a plan first** if you want to approve before execution (DSH has plan mode).
 7. **Three cost knobs**: lower `reasoning_effort`, keep `reasoning=hide`, release and start fresh.

package/USAGE-NOTES.md

@@ -11,7 +11,7 @@
 ### 1.1 profile 必须先建，否则连不上模型
 - **现象**：所有回合都失败，报 `no adapter registered for provider "xxx"`。
 - **原因**：本服务不自带任何 provider 配置，它驱动的是 `~/.dsh/profiles/dsh-mcp/` 这个 profile。
-- **对策**：`dsh dsh-mcp --from-default-profile acp`，然后照 [`profile-example/cordis.patch.yml`](profile-example/cordis.patch.yml) 填上你自己的 provider。
+- **对策**：`dsh --profile dsh-mcp --from-default-profile acp`，然后照 [`profile-example/cordis.patch.yml`](profile-example/cordis.patch.yml) 填上你自己的 provider。0.5.0+ 首次启动会自动 bootstrap 这个 profile，通常无需手工执行；只有在 `DSH_MCP_BOOTSTRAP=0` 或 profile 损坏时才需要。
 
 ### 1.2 ★ 最常见的坑：ACP 的模型不走 `agent-default-model`
 - **现象**：明明在 `agent-default-model` 里配了自己的 provider，会话却报 `no API key for provider route "deepseek-official"`。
@@ -271,7 +271,7 @@
 1. **给它目标，不要给命令**。DSH 是 agent：说"把这个模块的测试补上并跑通"，别说"执行 pytest"。它自己会选工具、分步骤、必要时派子代理。
 2. **一个会话一件事**。别往一个会话里塞互不相关的任务，历史会互相污染且越来越贵。
 3. **长任务拆成"派活 + 验收"**：`wait=false` → 干别的 → `dsh_get(run_id)`。
-4. **要审查产出就用工作区变更**：`workspace_changed` 表示本回合前后 `git status` 的条目集合发生了变化；`diff_stat` 列出当前仍处于改动状态的文件（不是本回合的精确 diff）。
+4. **要审查产出就用工作区变更**：`workspace_changed` 比较的是本回合前后 `git status` 的**全量**快照指纹（状态行 + 每个脏/未跟踪路径的 size/mtime；未跟踪目录会递归展开），所以"回合前已经脏、回合内又被改内容"或"改动落在第 41 条之后"都能识别。`diff_stat` 列出当前仍处于改动状态的文件（不是本回合的精确 diff）。
 5. **审核结果，别直接转述**：每个结果都带 `review` 审核单。用自己的工具核验至少一项关键声明（读改动的文件、看 `git diff`、跑相关测试），再用 `dsh_review` 记录 `pass` / `partial` / `fail`。默认 `advisory` 不阻塞下一次派活；`fail`/`partial` 必须给理由，且审核不通过不会自动回灌给 DSH。
 6. **要它先想清楚再动手**：让它先给方案、你确认后再执行（DSH 有计划模式）。
 7. **省钱的三个旋钮**：`reasoning_effort` 调低、`reasoning` 保持 `hide`、及时 `dsh_release` 并开新会话。

package/docs/en/architecture.md

@@ -24,9 +24,9 @@ DSH ships two programmable entry points. The `sdk` profile looks simpler, but it
          │ MCP over stdio              │ newline-delimited JSON-RPC (ACP)
          ▼                             ▼
    ┌─────────────┐            ┌──────────────────────────┐
-   │dsh-any-agent│───────────▶│ dsh --profile dsh-team   │  sessions with the same
-   └─────────────┘            │                          │  (cwd, permission) share
-                              └────────────┬─────────────┘  one process (default since 0.5.0)
+   │dsh-any-agent│───────────▶│ dsh --profile dsh-mcp     │  sessions with the same
+   └─────────────┘            │ (dsh-team when team on)   │  (cwd, permission) share
+                              └────────────┬──────────────┘  one process (default since 0.5.0)
                                            │
                               ┌────────────┴─────────────┐
                               │ DSH's own tools          │ files, shell, search,

package/docs/en/compatibility.md

@@ -36,7 +36,8 @@ dsh-any-agent team status        # team switch and profile
 
 In an MCP client, call `dsh_doctor` and look at:
 
-- `dsh_bin`: DSH entry point and version;
+- `dsh_bin`: DSH entry point and version; **warn** when it resolves from an npx cache (`_npx/<hash>/`), which disappears on cache cleanup — install DSH globally or pin `DSH_BIN`;
+- `dsh_version`: the version graded against the table above — `verified` is ok; `partial` / `unsupported` / `unverified` (e.g. 0.2.x) / unreadable are **warn**;
 - `profile`: exists, drift, route source;
 - `team`: `on` / `off` / `requested but unavailable` (version or profile lacks the team package);
 - `config`: effective permission, idle reaping, shared process, and so on.

package/docs/en/security.md

@@ -10,6 +10,8 @@
 
 `on_approval` can be `auto-allow`, `auto-deny`, or `ask` (which exposes a pending approval for `dsh_approval_decide` to adjudicate).
 
+**Under `auto-allow`, `workspace-write` is a soft boundary.** When DSH's sandbox blocks something (e.g. child-process pipes on Windows), DSH asks for `sandbox_permissions: danger-full-access` and `auto-allow` grants it. The default is unchanged, but the grant is **no longer silent**: every turn result carries `auto_approvals_total`, `auto_escalations_total` and up to 20 redacted `auto_approvals` summaries (tool, escalation tier, justification, command preview), and the review ticket's evidence and checklist call out "N auto-approved this turn, M of them escalations". To gate each one, start a conversation with `on_approval=ask`.
+
 **`read-only` is enforced, not merely a default**: it always runs with `auto-deny`; passing `auto-allow` or `ask` for a read-only conversation is rejected at `dsh_start`, and the approval layer refuses any permission request from a read-only conversation. After create/resume the server reads back the session's recorded tier; for read-only it **fails closed** if the projection cache has no permission record within the DSH flush window, rather than relying on the approval layer alone. Without that, a profile `defaultPreset` plus a permissive approval policy could let a write through (found by the adversarial audit).
 
 ## 🧷 Input boundaries

package/docs/en/tests.md

@@ -24,11 +24,11 @@ The suite **cleans up after itself**: `run.mjs` always ends with `cleanup.mjs`,
 | `prune` | 11 | **sentinel retention**: prunes over-age and crash-leftover files, keeps fresh ones, removes empty shells, `TTL=0` disables pruning, and never touches the conversation registry beside it (no tokens, runs every time) |
 | `guards` | 40 | **environment-variable guards**: odd numbers always land on the safe side — `IDLE_TTL_MS=-1` means "never reap", garbage/empty falls back to the 10-minute default, a too-small reap interval falls back to the default (no busy loop), and the **lost-holder threshold is floored at 30 s** (so another instance cannot "legitimately" preempt and kill our turn); plus the team-mode default and precedence (`DSH_MCP_TEAM` > `settings.json` > off) (no tokens, runs every time) |
 | `sandbox-guard` | 21 | **the test sandbox itself**: a "throwaway HOME" that resolves to the real user profile, to the filesystem root, or to anywhere outside the OS temp dir is refused with an error instead of being written to and deleted. Every other suite builds its HOME through `test/sandbox-home.mjs` and can only destroy what it created there (no tokens, runs every time) |
-| `approval-details` | 27 | **approval review context**: the pending-approval snapshot carries the command, reason, cwd and original approval ID — not just a bare ID — so a caller can actually adjudicate; missing `rawInput` is correlated from the earlier `tool_call` update by ID; credential-shaped fields and common inline literals are redacted; closing a conversation cancels pending approvals. Verified end-to-end over real stdio MCP |
+| `approval-details` | 37 | **approval review context**: the pending-approval snapshot carries the command, reason, cwd and original approval ID — not just a bare ID — so a caller can actually adjudicate; missing `rawInput` is correlated from the earlier `tool_call` update by ID; credential-shaped fields and common inline literals are redacted; closing a conversation cancels pending approvals. Verified end-to-end over real stdio MCP |
 | `failure-terminal` | 11 | **terminal state on failure**: an `ensureAlive` failure wakes `dsh_interject` waiters, writes an `error` sentinel, and attaches `runId` to the error; an approval with no matching option reports `effective=cancelled` instead of a fake allow; `dsh_get` reads a run back from its sentinel (no tokens) |
 | `shared-host` | 25 | **shared process host**: notifications and permission requests route by `sessionId`, unknown-session approvals are cancelled, a process exit fans out to every attached conversation, the child stops only when the last conversation detaches; **on by default and switchable off with `=0`** (an empty value counts as unset); the pre-takeover collision check for a shared process; RSS helper (no tokens) |
 | `shared-process` | 8 (skips without DSH) | **real-DSH shared process**: two conversations with the same `(cwd, permission)` share one PID, closing one leaves the other alive, closing both clears the host and exits the PID (needs a local DSH; runs with `--all`) |
-| `dispatch-tools` | 31 | **dispatch surface**: `dsh_inbox` aggregates pending approvals across conversations, `client_run_id` idempotency hits and evicts with its run, queue list/update/promote/remove (remove writes a cancelled sentinel), `dsh_get(max_chars)` truncates only the text while structured keeps the full answer, audit records metadata only, `dsh_doctor` essential checks (no tokens) |
+| `dispatch-tools` | 55 (53 off Windows) | **dispatch surface**: `dsh_inbox` aggregates pending approvals across conversations, `client_run_id` idempotency hits and evicts with its run, queue list/update/promote/remove (remove writes a cancelled sentinel), `dsh_get(max_chars)` compacts both text and structured (answer truncated, tool inputs reduced to `input_chars`; `max_chars=0` still returns everything), `dsh_doctor` DSH-version grading and npx-cache detection, PowerShell sentinel-waiter escaping plus a real run (Windows only), audit records metadata only, `dsh_doctor` essential checks (no tokens) |
 | `line-decoder` | 4 | **UTF-8 line framing**: multi-byte characters split across MCP/ACP stream chunks are preserved (no U+FFFD), including CRLF and EOF-without-newline (no tokens) |
 | `read-cursor` | 10 | **`dsh_read` cursor semantics**: text appended to an already-read entry is delivered again (revision cursor, match by `seq`), and `limit` is clamped to 1..500 so `0`/negative cannot spin or drop the tail (no tokens) |
 | `sentinel-redaction` | 19 | **sentinel disk hygiene**: `result.thinking` is stripped, `thinking_omitted` is always a boolean, and `answer`/`error`/`title`/`tools_used[].input` all pass the same credential redaction as approvals (no tokens) |

package/docs/en/usage.md

@@ -43,7 +43,16 @@ done
 echo "DONE"                            # task exits → host wakes you → read the file to collect
 ```
 
-Once the file exists: **read it** for `status` and `result` (preferred — immune to the in-memory window and survives restarts), or use `dsh_get(conversation_id, run_id)`.
+On a Windows host where Git Bash is unavailable (or hangs), wait on the native `sentinel_file` with PowerShell. On Windows the background receipt's structured content carries a ready-made, escaped **`sentinel_wait_powershell`** — use it directly:
+
+```powershell
+$f='C:\Users\you\.dsh\.dsh-any-agent\runs\<conversation_id>\<run_id>.json'   # write ' as '' inside the path
+$dl=(Get-Date).AddSeconds(2100)
+while(-not (Test-Path -LiteralPath $f)){ if((Get-Date) -gt $dl){ 'TIMEOUT'; exit 1 }; Start-Sleep -Seconds 2 }
+'DONE'
+```
+
+Once the file exists: **read it** for `status` and `result` (preferred — immune to the in-memory window and survives restarts), or use `dsh_get(conversation_id, run_id)`. When a turn used many tools, the full result (every tool's complete input included) can exceed the client's per-call tool-result limit; pass `max_chars` (e.g. 8000) to `dsh_get`: the budget now applies to **both** text and structured — the answer is truncated and each tool keeps only its name/status plus `input_chars`. The full version is always in the sentinel file.
 
 Design notes (especially under **concurrent multi-session** use):
 

package/docs/zh/architecture.md

@@ -24,9 +24,9 @@ DSH 自带两个可编程入口。`sdk` profile 看着更简单，但它的 JSON
          │ MCP over stdio            │ 换行分隔 JSON-RPC（ACP）
          ▼                           ▼
    ┌─────────────┐          ┌──────────────────────────┐
-   │dsh-any-agent│─────────▶│ dsh --profile dsh-team   │  同 (cwd, 权限) 的会话
-   └─────────────┘          │                          │  共用一个长驻进程
-                            └────────────┬─────────────┘  （0.5.0 起默认）
+   │dsh-any-agent│─────────▶│ dsh --profile dsh-mcp    │  同 (cwd, 权限) 的会话
+   └─────────────┘          │ (team on → dsh-team)     │  共用一个长驻进程
+                            └────────────┬─────────────┘  （0.5.0 起默认共享进程）
                                          │
                             ┌────────────┴─────────────┐
                             │ DSH 自带工具             │ 文件/shell/搜索/

package/docs/zh/compatibility.md

@@ -34,7 +34,8 @@ dsh-any-agent team status        # 团队开关与 profile
 
 在 MCP 客户端里调用 `dsh_doctor`，重点看：
 
-- `dsh_bin`：DSH 入口与版本；
+- `dsh_bin`：DSH 入口与版本；入口落在 npx 缓存（`_npx/<hash>/`）时 **warn** —— 清缓存就会失效，建议全局安装 DSH 或固定 `DSH_BIN`；
+- `dsh_version`：按上表给版本定档 —— `verified` 为 ok；`partial` / `unsupported` / `unverified`（如 0.2.x）/ 读不到版本为 **warn**；
 - `profile`：是否存在、是否漂移、路由来源；
 - `team`：`on` / `off` / `requested but unavailable`（版本或 profile 不含 team 包）；
 - `config`：当前 permission、空闲回收、共享进程等生效值。

package/docs/zh/limits.md

@@ -17,7 +17,7 @@
 
 因为改名会打断一堆已经落盘的东西。
 
-本服务首次启动时会在 `~/.dsh/profiles/dsh-mcp/` 建一个 DSH profile。0.4.0 起团队模式默认改用 `dsh-team`（同样由本服务自动创建）；`dsh-mcp` 仍用于团队关闭或既有部署。两者共用同一套 `DSH_MCP_*` 变量与 `# dsh-mcp:managed` 标记。
+本服务首次启动时会在 `~/.dsh/profiles/dsh-mcp/` 建一个 DSH profile。0.5.0 起团队模式按需开启：开启时 profile 切到 `dsh-team`（同样由本服务自动创建），默认或关闭时仍用 `dsh-mcp`。两者共用同一套 `DSH_MCP_*` 变量与 `# dsh-mcp:managed` 标记。
 
 这个目录名被另外三样持久化标识引用着：
 

package/docs/zh/security.md

@@ -10,6 +10,8 @@
 
 `on_approval` 可选 `auto-allow` / `auto-deny` / `ask`（`ask` 会把审批挂起，交给 `dsh_approval_decide` 裁决）。
 
+**`auto-allow` 下 `workspace-write` 是软边界。** DSH 碰到沙箱挡住的操作（例如 Windows 上子进程管道被拦）会申请 `sandbox_permissions: danger-full-access`，`auto-allow` 会直接放行。默认值不变，但放行**不再是静默的**：每个回合结果都带 `auto_approvals_total`、`auto_escalations_total` 和最多 20 条脱敏后的 `auto_approvals` 摘要（工具、提权档、理由、命令预览）；审核单的证据与清单会点名"本轮有 N 次自动放行，其中 M 次提权"。要逐次把关，就用 `on_approval=ask` 新建会话。
+
 **`read-only` 是强制边界，不只是默认值**：它固定使用 `auto-deny`；给只读会话传 `auto-allow` / `ask` 会在 `dsh_start` 被直接拒绝，审批层也会拒绝来自只读会话的任何权限请求。建会话/resume 后还会回读会话自己记录的权限档；只读档如果在 DSH 投影缓存刷盘窗口内仍读不到记录，会 **fail-closed 拒绝继续**，而不是只依赖审批层兜底。否则 profile 的 `defaultPreset` 加宽松审批策略可能放行写操作（对抗审计实测过）。
 
 ## 🧷 输入边界

package/docs/zh/tests.md

@@ -23,11 +23,11 @@ node test/cleanup.mjs      # 单独跑收尾清理（只清测试自己造的目
 | `prune` | 11 | **哨兵留存**：清超期与崩溃残留、留新、清空壳目录、`TTL=0` 关闭清理、且绝不碰同目录的会话注册表（不花 token，每次必跑） |
 | `guards` | 40 | **环境变量守卫**：奇怪的数值一律压到安全侧 —— `IDLE_TTL_MS` 的 `-1` 当"永不回收"、非法值/空串回落默认 10 分钟、回收间隔过小压回默认（防空转紧循环）、**失联阈值下限 30 秒**（防别的实例"合法地"抢占并杀掉我们的回合）；以及团队模式的默认值与优先级（`DSH_MCP_TEAM` > `settings.json` > 默认关）（不花 token，每次必跑） |
 | `sandbox-guard` | 21 | **测试沙箱自身**：「临时 HOME」如果落到真实用户目录、它的子目录、盘符根目录，或 OS 临时目录之外，一律报错拒绝，绝不被写入和删除。其余套件都通过 `test/sandbox-home.mjs` 拿目录、只销毁自己建的那个（不花 token，每次必跑） |
-| `approval-details` | 27 | **审批审查上下文**：待决审批的快照带命令、理由、cwd 与原始审批 ID —— 不只是一个裸 ID，调用方才能真正裁决；缺失的 `rawInput` 会按 ID 从先前的 `tool_call` 更新关联回来；凭据形状的字段与常见内联字面量在结构化上下文和展示标题里都会脱敏；关闭会话会取消待决审批。经真实 stdio MCP 端到端验证 |
+| `approval-details` | 37 | **审批审查上下文**：待决审批的快照带命令、理由、cwd 与原始审批 ID —— 不只是一个裸 ID，调用方才能真正裁决；缺失的 `rawInput` 会按 ID 从先前的 `tool_call` 更新关联回来；凭据形状的字段与常见内联字面量在结构化上下文和展示标题里都会脱敏；关闭会话会取消待决审批。经真实 stdio MCP 端到端验证 |
 | `failure-terminal` | 11 | **失败路径的终态**：`ensureAlive` 失败时唤醒 `dsh_interject` 等待者、落 `status=error` 哨兵、错误对象挂 `runId`；审批没有对应 option 时 `effective=cancelled` 而不是假报 allow；`dsh_get` 能从哨兵文件回读（不花 token） |
 | `shared-host` | 25 | **共享进程宿主**：通知/审批按 `sessionId` 路由、未知会话审批一律取消、进程退出扇出所有挂载会话、最后一个会话 detach 才停进程；**默认开启且 `=0` 可关闭**（空串按未设置处理）；`takeover` 杀共享进程前的连坐检查；以及 RSS 读取（不花 token） |
 | `shared-process` | 8（无 DSH 时 skip） | **共享进程真机验证**：同 `(cwd, permission)` 的两个会话落在同一个 PID、关一个不影响另一个、全部关闭后宿主清空且 PID 退出（需要本机 DSH，`--all` 时运行） |
-| `dispatch-tools` | 31 | **派发面**：`dsh_inbox` 跨会话汇总待决审批、`client_run_id` 幂等命中与淘汰、队列 list/update/promote/remove（remove 写 cancelled 哨兵）、`dsh_get(max_chars)` 只截断 text 且 structured 保留全文、审计只记元数据不记正文、`dsh_doctor` 关键检查项（不花 token） |
+| `dispatch-tools` | 55（非 Windows 53） | **派发面**：`dsh_inbox` 跨会话汇总待决审批、`client_run_id` 幂等命中与淘汰、队列 list/update/promote/remove（remove 写 cancelled 哨兵）、`dsh_get(max_chars)` 同时压缩 text 与 structured（正文截断、工具输入只留 `input_chars`，`max_chars=0` 仍返回全文）、`dsh_doctor` 的 DSH 版本档位与 npx 缓存识别、PowerShell 哨兵等待命令的转义与真机执行（仅 Windows）、审计只记元数据不记正文、`dsh_doctor` 关键检查项（不花 token） |
 | `read-cursor` | 10 | **`dsh_read` 游标语义**：追加到已读条目里的文本必须再次返回（修订号游标，按 `seq` 替换全文）；`limit` 钳到 1..500，`0`/负数不会空转或丢尾（不花 token） |
 | `line-decoder` | 4 | **UTF-8 行分帧**：MCP/ACP 的 chunk 边界不能把中文/emoji 截成 U+FFFD；覆盖逐字节、任意 chunk、CRLF 与 EOF 残留（不花 token） |
 | `sentinel-redaction` | 19 | **哨兵落盘卫生**：`result.thinking` 被剥掉、`thinking_omitted` 始终是布尔值、`answer`/`error`/`title`/`tools_used[].input` 都走与审批相同的凭据脱敏（不花 token） |

package/docs/zh/usage.md

@@ -43,7 +43,16 @@ done
 echo "DONE"                            # 后台任务退出 → 宿主唤醒你 → 读文件收活
 ```
 
-文件出现后：**直接读它**即得 `status` 和 `result`（推荐——不受内存窗口限制、还扛服务重启），或用 `dsh_get(conversation_id, run_id)` 验收。
+Windows 宿主上 Git Bash 不可用（或会挂住）时，用 PowerShell 等原生路径 `sentinel_file`。在 Windows 上，后台收据的 structured 里有拼好、已转义的 **`sentinel_wait_powershell`**，直接用它：
+
+```powershell
+$f='C:\Users\you\.dsh\.dsh-any-agent\runs\<conversation_id>\<run_id>.json'   # 路径里的 ' 写成 ''
+$dl=(Get-Date).AddSeconds(2100)
+while(-not (Test-Path -LiteralPath $f)){ if((Get-Date) -gt $dl){ 'TIMEOUT'; exit 1 }; Start-Sleep -Seconds 2 }
+'DONE'
+```
+
+文件出现后：**直接读它**即得 `status` 和 `result`（推荐——不受内存窗口限制、还扛服务重启），或用 `dsh_get(conversation_id, run_id)` 验收。一个回合用了很多工具时，完整结果（含每个工具的完整输入）可能超过客户端单次工具结果的上限；这时给 `dsh_get` 传 `max_chars`（如 8000）：预算**同时**作用于 text 与 structured，正文截断、工具只留名字/状态与 `input_chars`，完整版本始终在哨兵文件里。
 
 设计要点（尤其**多会话并发**）：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-any-agent",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Drive DeepSeek Harness (DSH) as a long-lived coding agent from any MCP client — Claude Code, Claude Desktop, Codex, Cursor, Windsurf, Zed, Gemini CLI, opencode, VS Code. Resume-aware, interruptible, approval-capable, and it only ever touches the one config entry it owns.",
   "type": "module",
   "license": "MIT",

package/src/config.mjs

@@ -128,6 +128,46 @@ export function resolveDshBin() {
   );
 }
 
+/**
+ * 兼容性矩阵（docs/zh/compatibility.md）的机器可读版本，供 dsh_doctor 使用。
+ * 改矩阵时同步改这里：`[verifiedMin, verifiedBelow)` 是“已验证”区间。
+ * 用 `-0` 后缀是为了把同号的 rc 版本也算进去（semver 里 `0.1.7-rc.1 < 0.1.7`）。
+ */
+export const DSH_COMPAT = Object.freeze({
+  partialMin: '0.1.5-0',
+  verifiedMin: '0.1.7-0',
+  verifiedBelow: '0.2.0-0',
+});
+
+/**
+ * 给一个 DSH 版本打兼容性档位：ok（已验证）/ warn（部分可用、未验证或读不到）。
+ * 只是体检提示，不拦启动 —— 未验证不等于不能用。
+ */
+export function dshVersionStatus(version) {
+  if (!version) {
+    return { status: 'warn', level: 'unknown', note: '读不到 DSH 版本（package.json 缺失或不可读）' };
+  }
+  if (cmpVersion(version, DSH_COMPAT.partialMin) < 0) {
+    return { status: 'warn', level: 'unsupported', note: `DSH ${version} 低于已知可用的最低版本 0.1.5` };
+  }
+  if (cmpVersion(version, DSH_COMPAT.verifiedMin) < 0) {
+    return { status: 'warn', level: 'partial', note: `DSH ${version} 部分可用：ACP 基本路径可用，缺 team 包` };
+  }
+  if (cmpVersion(version, DSH_COMPAT.verifiedBelow) < 0) {
+    return { status: 'ok', level: 'verified', note: `DSH ${version} 在已验证区间（0.1.7 ~ 0.2.0 之前）` };
+  }
+  return {
+    status: 'warn',
+    level: 'unverified',
+    note: `DSH ${version} 未经本版本验证（兼容性矩阵只覆盖到 0.1.x），ACP session/* 面可能有变化`,
+  };
+}
+
+/** DSH 入口是不是落在 npx 缓存里（`_npx/<hash>/…`）：那里随 `npm cache clean` 或 npx 自身淘汰随时消失。 */
+export function isNpxCachePath(p) {
+  return /[\\/]_npx[\\/]/.test(String(p ?? ''));
+}
+
 /**
  * DSH 主目录。**默认就是本机用户自己的 ~/.dsh** —— 本服务不拥有独立的 home，
  * 因此凭据（.credentials.yaml）、会话历史、工作区登记与 GUI 完全共用一份。

package/src/hub.mjs

@@ -24,12 +24,15 @@ import {
   existsSync,
   renameSync,
   statSync,
+  lstatSync,
   rmSync,
   readdirSync,
 } from 'node:fs';
 import { dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
-import { spawnSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { promisify } from 'node:util';
 import {
   ALLOW_FULL_ACCESS,
   APPROVAL_POLICIES,
@@ -190,6 +193,10 @@ const MAX_PROMPT_ECHO = 4000;
 const MAX_RUNS = 20;
 /** 回合记录里 prompt 预览的长度。 */
 const MAX_RUN_PREVIEW = 200;
+/** 每个回合最多保留多少条"自动放行审批"摘要（总数另计，不受此限）。 */
+const MAX_AUTO_APPROVALS_KEPT = 20;
+/** 自动放行审批里命令预览的长度。 */
+const MAX_AUTO_APPROVAL_PREVIEW = 200;
 
 /**
  * 清掉 `dir` 下超过 TTL 的文件与空会话目录；`.tmp` 残留不论年龄都按同一 cutoff 清。
@@ -310,6 +317,10 @@ export function sanitizeResultForSentinel(result) {
       return input === undefined ? safeMeta : { ...safeMeta, input: sanitizeApprovalContext(input) };
     });
   }
+  // 自动放行审批摘要记录时已脱敏；落盘前再过一遍，防止将来有人加字段漏掉。
+  if (Array.isArray(rest.auto_approvals)) {
+    rest.auto_approvals = rest.auto_approvals.map((a) => (a && typeof a === 'object' ? sanitizeApprovalContext(a) : a));
+  }
   // 审核单里可能有原任务预览、审核理由与证据摘要；哨兵会保留 7 天，同样要脱敏。
   if (rest.review && typeof rest.review === 'object') {
     const rv = { ...rest.review };
@@ -822,6 +833,9 @@ export class Conversation {
     }
     if (this.onApproval === 'auto-allow') {
       this.#hub.log.info(`[conv ${this.id}] 审批放行: ${desc}`);
+      // ★ 自动放行必须对调用方可见：DSH 会借审批把沙箱提升到 danger-full-access，
+      //   不记下来的话 workspace-write 会话事后看起来像从未越界（实测一轮 6 次提权无人知晓）。
+      if (allowId) this.#recordAutoApproval(params, toolCall, desc, options);
       return allowId
         ? { outcome: { outcome: 'selected', optionId: allowId } }
         : { outcome: { outcome: 'cancelled' } };
@@ -854,6 +868,35 @@ export class Conversation {
     });
   }
 
+  /**
+   * 记一条"被自动放行的审批"到本回合收集器（只记摘要，且先脱敏）。
+   * 回合外到来的审批（没有收集器）不记 —— 没有结果可挂。
+   */
+  #recordAutoApproval(params, toolCall, desc, options) {
+    const c = this.collector;
+    if (!c) return;
+    c.autoApprovalTotal = (c.autoApprovalTotal ?? 0) + 1;
+    const input = toolCall.rawInput ?? toolCall.input ?? null;
+    const escalation =
+      input && typeof input === 'object' && typeof input.sandbox_permissions === 'string'
+        ? input.sandbox_permissions
+        : null;
+    if (escalation) c.autoEscalationTotal = (c.autoEscalationTotal ?? 0) + 1;
+    if (!Array.isArray(c.autoApprovals)) c.autoApprovals = [];
+    if (c.autoApprovals.length >= MAX_AUTO_APPROVALS_KEPT) return;
+    const ctx = approvalContext(params, toolCall, desc, options);
+    const cmd = input && typeof input === 'object' ? input.command ?? input.cmd ?? null : null;
+    c.autoApprovals.push({
+      tool: ctx.tool ?? desc,
+      tool_call_id: ctx.tool_call_id ?? null,
+      escalation,
+      reason: typeof ctx.reason === 'string' ? ctx.reason.slice(0, 300) : null,
+      command_preview:
+        typeof cmd === 'string' ? sanitizeApprovalContext(cmd, 'command').slice(0, MAX_AUTO_APPROVAL_PREVIEW) : null,
+      at: new Date().toISOString(),
+    });
+  }
+
   /** 调用方裁决一个待决审批。 */
   decideApproval(approvalId, decision) {
     const p = this.pendingApprovals.get(approvalId);
@@ -975,17 +1018,22 @@ export class Conversation {
     runRecord.status = 'running';
     runRecord.started_at = now();
     this.currentRun = runRecord;
-    const before = gitStatus(this.cwd);
+    let before = null;
     let proc;
     // ★ `busy` 必须在 ensureAlive **之前**置位。
     //   否则"把进程拉起来"这段（spawn + initialize + resume，可能好几秒）是一个**裸奔窗口**：
     //     ① reaper 看到 busy=false 且 lastUsedAt 还是上一轮的时刻（已过期），会把这个**刚拉起来**
     //        的进程当空闲回收掉 → 紧接着 resume 就报"DSH 进程未运行"（test/cycle.mjs 实测抓到）；
     //     ② 第二个 dsh_send 同样能通过 busy 检查，于是为同一会话再拉一个子进程 → 互相撞锁 + 泄漏。
+    //   ★ 同理，git 快照的 await 也必须放在 busy 置位**之后**（见下面的 Promise.all）。
     this.busy = true;
     this.lastUsedAt = now();
+    const beforePromise = gitStatus(this.cwd);
     try {
-      proc = await this.ensureAlive();
+      // 快照与拉起进程并行：快照只是读盘，不改变生命周期，早取晚取语义一致。
+      const [beforeSnap, liveProc] = await Promise.all([beforePromise, this.ensureAlive()]);
+      before = beforeSnap;
+      proc = liveProc;
     } catch (e) {
       // 起不来（撞写锁 / 会话损坏）就**必须放开 busy**，否则这个会话被永久占住；
       // 同时别留一条永远 "running" 的幽灵记录。
@@ -1013,6 +1061,10 @@ export class Conversation {
       usage: null,
       plan: null,
       otherUpdates: [],
+      /** 本回合被 auto-allow 放行的审批摘要（最多 MAX_AUTO_APPROVALS_KEPT 条）与总数。 */
+      autoApprovals: [],
+      autoApprovalTotal: 0,
+      autoEscalationTotal: 0,
     };
     this.collector = c;
     const t0 = now();
@@ -1038,102 +1090,137 @@ export class Conversation {
       return result;
     };
 
-    /** 回合真正结束时收尾。无论有没有人在等，都**只执行一次**。 */
+    /**
+     * 回合真正结束时收尾。无论有没有人在等，都**只执行一次**。
+     *
+     * 现在是异步的（git 快照走异步子进程），但保持了三个不变量：
+     *   1. 幂等：重复调用返回同一个 Promise，不会重复写哨兵；
+     *   2. 不拖累生命周期：`busy=false`、唤醒 idleWaiters、#scheduleDrain
+     *      都在**第一个 await 之前**同步完成，git 最慢 8s 也影响不到 reaper/插话；
+     *   3. 防弹：内部异常一律兜底成 error 结果 + 哨兵，返回的 Promise 不会 reject
+     *      （wait=false 的调用方不会 await 它，不能让 unhandled rejection 杀掉服务）。
+     */
+    let finalizePromise = null;
     const finalize = (stopReason, failure) => {
-      if (settled) return runRecord.result;
+      if (finalizePromise) return finalizePromise;
       settled = true;
-      // ★ 收尾本身也必须防弹：它跑在 ACP 的异步回调里，一旦抛出去就是 unhandled
-      //   rejection —— Node ≥15 会直接杀掉进程，连带丢掉所有会话的活进程；
-      //   而且调用方会永远等不到哨兵。所以出错也要落一个"收尾异常"的哨兵。
-      try {
-        this.busy = false;
-        if (this.currentRun === runRecord) this.currentRun = null;
-        this.collector = null;
-        this.currentTool = null;
-        // 回合结束后，任何仍挂着的审批都已失效：统一取消并清空，避免状态里
-        // 留下一个 dsh_approval_decide 只会回"没有待决审批"的幽灵。
-        for (const [, p] of this.pendingApprovals) {
-          try {
-            p.resolve({ outcome: { outcome: 'cancelled' } });
-          } catch {}
+      finalizePromise = (async () => {
+        // ★ 先启动 after 快照：调用 gitStatus 时子进程立刻 spawn，但**不 await**；
+        //   这样 snapshot 的时间点仍贴近回合结束，而 busy 释放/唤醒不必等 git。
+        const afterPromise = gitStatus(this.cwd);
+        try {
+          this.busy = false;
+          if (this.currentRun === runRecord) this.currentRun = null;
+          this.collector = null;
+          this.currentTool = null;
+          // 回合结束后，任何仍挂着的审批都已失效：统一取消并清空，避免状态里
+          // 留下一个 dsh_approval_decide 只会回"没有待决审批"的幽灵。
+          for (const [, p] of this.pendingApprovals) {
+            try {
+              p.resolve({ outcome: { outcome: 'cancelled' } });
+            } catch {}
+          }
+          this.pendingApprovals.clear();
+          this.pushOut('turn', `第 ${this.currentTurn} 轮结束（${stopReason ?? 'unknown'}）`, {
+            phase: 'end',
+            stop_reason: stopReason,
+            error: failure ?? undefined,
+          });
+          this.turnCount += 1;
+          this.lastUsedAt = now();
+          this.#hub.save();
+          // 唤醒所有"等本轮结束"的插话请求（busy 已置 false，它们可以安全地发下一轮）
+          const waiters = this.idleWaiters;
+          this.idleWaiters = [];
+          for (const w of waiters) w();
+          this.#scheduleDrain();
+          // 到这里才允许被 git 拖慢；结果/审核单/哨兵必须等快照完成后再落。
+          const after = await afterPromise;
+          const result = {
+            conversation_id: this.id,
+            run_id: runRecord.run_id,
+            stop_reason: stopReason,
+            error: failure,
+            answer: c.answer,
+            thinking: formatReasoning(c, reasoning),
+            thinking_stats: {
+              hidden: reasoning === 'hide' || reasoning === 'marker',
+              chars: c.reasoning.length,
+              chunks: c.reasoningChunks,
+              ms: c.reasoningStartedAt ? now() - c.reasoningStartedAt : 0,
+            },
+            tools_used: [...c.tools.values()],
+            usage: c.usage,
+            auto_approvals_total: c.autoApprovalTotal,
+            auto_escalations_total: c.autoEscalationTotal,
+            auto_approvals: c.autoApprovals,
+            workspace_changed: !sameWorkspaceSnapshot(before, after),
+            diff_stat: after,
+            elapsed_ms: now() - t0,
+          };
+          attachReview(result);
+          runRecord.ended_at = now();
+          runRecord.elapsed_ms = result.elapsed_ms;
+          runRecord.status = failure ? 'error' : stopReason === 'cancelled' ? 'cancelled' : 'done';
+          runRecord.result = result;
+          // ★ 无条件写哨兵：**一个回合 = 一个哨兵文件**，没有例外。
+          //   之前只在"调用方没在原地等"时才写，于是插话那一轮没有哨兵 —— 调用方的
+          //   等待逻辑（等文件出现）就永远空等，即使 run 早已 status=done（真实事故）。
+          //   统一规则也消除了整类"有 run_id 却没有哨兵"的坑。
+          const sentinelFile = this.#hub.writeRunSentinel(this.id, runRecord);
+          result.sentinel_file = sentinelFile ?? this.#hub.runSentinelPath(this.id, runRecord.run_id);
+          if (!sentinelFile) result.sentinel_error = runRecord.sentinel_error ?? '哨兵文件写入失败';
+          return result;
+        } catch (e) {
+          this.#hub.log.info(`[conv ${this.id}] 回合收尾异常（已兜底）: ${e.message}`);
+          this.busy = false;
+          if (this.currentRun === runRecord) this.currentRun = null;
+          this.collector = null;
+          const waiters = this.idleWaiters;
+          this.idleWaiters = [];
+          for (const w of waiters) w();
+          this.#scheduleDrain();
+          const fallback = {
+            conversation_id: this.id,
+            run_id: runRecord.run_id,
+            stop_reason: 'error',
+            error: `回合收尾异常: ${e.message}`,
+            answer: c.answer ?? '',
+            thinking_stats: { hidden: true, chars: 0, chunks: 0, ms: 0 },
+            tools_used: [...(c.tools?.values?.() ?? [])],
+            workspace_changed: false,
+            elapsed_ms: now() - t0,
+          };
+          attachReview(fallback);
+          runRecord.ended_at = now();
+          runRecord.status = 'error';
+          runRecord.error = fallback.error;
+          runRecord.result = fallback;
+          const sentinelFile = this.#hub.writeRunSentinel(this.id, runRecord);
+          fallback.sentinel_file = sentinelFile ?? this.#hub.runSentinelPath(this.id, runRecord.run_id);
+          if (!sentinelFile) fallback.sentinel_error = runRecord.sentinel_error ?? '哨兵文件写入失败';
+          return fallback;
         }
-        this.pendingApprovals.clear();
-        this.pushOut('turn', `第 ${this.currentTurn} 轮结束（${stopReason ?? 'unknown'}）`, {
-          phase: 'end',
-          stop_reason: stopReason,
-          error: failure ?? undefined,
-        });
-        this.turnCount += 1;
-        this.lastUsedAt = now();
-        this.#hub.save();
-        // 唤醒所有"等本轮结束"的插话请求（busy 已置 false，它们可以安全地发下一轮）
-        const waiters = this.idleWaiters;
-        this.idleWaiters = [];
-        for (const w of waiters) w();
-        this.#scheduleDrain();
-        const after = gitStatus(this.cwd);
-        const result = {
-          conversation_id: this.id,
-          run_id: runRecord.run_id,
-          stop_reason: stopReason,
-          error: failure,
-          answer: c.answer,
-          thinking: formatReasoning(c, reasoning),
-          thinking_stats: {
-            hidden: reasoning === 'hide' || reasoning === 'marker',
-            chars: c.reasoning.length,
-            chunks: c.reasoningChunks,
-            ms: c.reasoningStartedAt ? now() - c.reasoningStartedAt : 0,
-          },
-          tools_used: [...c.tools.values()],
-          usage: c.usage,
-          workspace_changed: !sameWorkspaceSnapshot(before, after),
-          diff_stat: after,
-          elapsed_ms: now() - t0,
-        };
-        attachReview(result);
-        runRecord.ended_at = now();
-        runRecord.elapsed_ms = result.elapsed_ms;
-        runRecord.status = failure ? 'error' : stopReason === 'cancelled' ? 'cancelled' : 'done';
-        runRecord.result = result;
-        // ★ 无条件写哨兵：**一个回合 = 一个哨兵文件**，没有例外。
-        //   之前只在"调用方没在原地等"时才写，于是插话那一轮没有哨兵 —— 调用方的
-        //   等待逻辑（等文件出现）就永远空等，即使 run 早已 status=done（真实事故）。
-        //   统一规则也消除了整类"有 run_id 却没有哨兵"的坑。
-        const sentinelFile = this.#hub.writeRunSentinel(this.id, runRecord);
-        result.sentinel_file = sentinelFile ?? this.#hub.runSentinelPath(this.id, runRecord.run_id);
-        if (!sentinelFile) result.sentinel_error = runRecord.sentinel_error ?? '哨兵文件写入失败';
-        return result;
-      } catch (e) {
-        this.#hub.log.info(`[conv ${this.id}] 回合收尾异常（已兜底）: ${e.message}`);
-        this.busy = false;
-        if (this.currentRun === runRecord) this.currentRun = null;
-        this.collector = null;
-        const waiters = this.idleWaiters;
-        this.idleWaiters = [];
-        for (const w of waiters) w();
-        this.#scheduleDrain();
-        const fallback = {
-          conversation_id: this.id,
-          run_id: runRecord.run_id,
-          stop_reason: 'error',
-          error: `回合收尾异常: ${e.message}`,
-          answer: c.answer ?? '',
-          thinking_stats: { hidden: true, chars: 0, chunks: 0, ms: 0 },
-          tools_used: [...(c.tools?.values?.() ?? [])],
-          workspace_changed: false,
-          elapsed_ms: now() - t0,
-        };
-        attachReview(fallback);
-        runRecord.ended_at = now();
-        runRecord.status = 'error';
-        runRecord.error = fallback.error;
-        runRecord.result = fallback;
-        const sentinelFile = this.#hub.writeRunSentinel(this.id, runRecord);
-        fallback.sentinel_file = sentinelFile ?? this.#hub.runSentinelPath(this.id, runRecord.run_id);
-        if (!sentinelFile) fallback.sentinel_error = runRecord.sentinel_error ?? '哨兵文件写入失败';
-        return fallback;
-      }
+      })().catch((e) => {
+        // 最后一层保险：收尾连兜底都失败时也绝不把 rejection 丢给事件循环。
+        this.#hub.log.info(`[conv ${this.id}] 回合收尾二次异常（已忽略）: ${e.message}`);
+        if (!runRecord.result) {
+          runRecord.result = {
+            conversation_id: this.id,
+            run_id: runRecord.run_id,
+            stop_reason: 'error',
+            error: `回合收尾异常: ${e.message}`,
+            answer: c.answer ?? '',
+            thinking_stats: { hidden: true, chars: 0, chunks: 0, ms: 0 },
+            tools_used: [],
+            workspace_changed: false,
+            elapsed_ms: now() - t0,
+          };
+          runRecord.status = 'error';
+        }
+        return runRecord.result;
+      });
+      return finalizePromise;
     };
 
     /** 没等到结果时给调用方的收据（它靠 run_id + 哨兵文件事后验收）。 */
@@ -1150,30 +1237,40 @@ export class Conversation {
 
     // 关键：第三个参数传 0 = **不设超时**。回合只能由它自己结束，或由 session/cancel 结束。
     const acp = proc.request('session/prompt', { sessionId: this.id, prompt: [{ type: 'text', text }] }, 0);
-    acp.then(
-      (res) => {
-        if (res?.usage) c.usage = c.usage ?? res.usage;
-        finalize(res?.stopReason ?? null, null);
-      },
-      (e) => finalize('error', e.message),
-    );
+    // 这个 Promise 在 finalize **真正完成**（含 workspace_changed、审核单、哨兵）后才 settle。
+    // 等待方必须等它，而不是只等 acp —— 否则会拿到还没填完的 runRecord.result。
+    const finished = acp
+      .then(
+        (res) => {
+          if (res?.usage) c.usage = c.usage ?? res.usage;
+          return finalize(res?.stopReason ?? null, null);
+        },
+        (e) => finalize('error', e.message),
+      )
+      .catch((e) => {
+        // finalize 自己是防弹的；这里只兜住同步抛出的极端情况。
+        this.#hub.log.info(`[conv ${this.id}] 回合回调异常（已兜底）: ${e.message}`);
+        return runRecord.result ?? null;
+      });
 
-    if (!wait) return settled ? runRecord.result : receipt(0);
+    if (!wait) {
+      // 同步走到这里时 finalize 还没开始（ACP 回调在微任务里），返回收据即可。
+      // 若极端情况下已经收尾，则等它给出完整结果，不要返回半成品。
+      return settled ? await (finalizePromise ?? runRecord.result) : receipt(0);
+    }
     if (timeoutMs <= 0) {
-      await acp.then(
-        () => {},
-        () => {},
-      );
+      await finished;
       return runRecord.result;
     }
     const timedOut = await Promise.race([
-      acp.then(
+      finished.then(
         () => false,
         () => false,
       ),
       new Promise((r) => setTimeout(() => r(true), timeoutMs)),
     ]);
-    if (timedOut && !settled) return receipt(timeoutMs);
+    // 超时发生在 finalize 完成之前（包括 git 快照还在跑）：给收据，不返回半成品结果。
+    if (timedOut) return receipt(timeoutMs);
     return runRecord.result;
   }
 
@@ -1667,30 +1764,178 @@ export class Conversation {
   }
 }
 
-/** 两次 git status 快照是否表示同一组工作区变更。 */
+/**
+ * 两次 workspace 快照是否表示同一组工作区变更。
+ *
+ * 优先比较 `fingerprint`（覆盖**全量**条目：状态行 + 每个路径的 size/mtime，
+ * 未跟踪目录递归展开）。只比较前 40 条 entries 会把"同一状态行但内容变了"
+ * 和第 41 条之后的改动都漏掉（workspace_changed 假阴性）。
+ */
 export function sameWorkspaceSnapshot(a, b) {
   if (!a && !b) return true;
   if (!a || !b) return false;
+  if (typeof a.fingerprint === 'string' && typeof b.fingerprint === 'string') {
+    return a.fingerprint === b.fingerprint;
+  }
+  // 兼容旧快照/测试里手写的 { changed_files, entries }。
   return JSON.stringify(a.entries ?? []) === JSON.stringify(b.entries ?? []);
 }
 
-/** 收集当前工作区的 git 变更摘要（非 git 目录返回 null）。 */
-export function gitStatus(cwd) {
+const GIT_TIMEOUT_MS = 8000;
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+const MAX_UNTRACKED_DIR_ENTRIES = 2000;
+const execFileAsync = promisify(execFile);
+
+/**
+ * 安全 git 参数（放 subcommand 之前）。
+ *
+ * `--no-optional-locks` 是 **git 全局选项**，放在 `status` 之后会被 git 当成
+ * 未知参数直接退出 129 —— 那样快照永远是 null，workspace_changed 恒为 false。
+ */
+const GIT_SAFE = ['--no-optional-locks', '-c', 'core.fsmonitor=false'];
+
+function gitEnv() {
+  return { ...process.env, GIT_OPTIONAL_LOCKS: '0' };
+}
+
+/** 异步跑一次 git 并取 stdout；非 git 目录/超时/输出过大都抛给调用方。 */
+async function gitOutput(cwd, args) {
+  const { stdout } = await execFileAsync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    timeout: GIT_TIMEOUT_MS,
+    maxBuffer: GIT_MAX_BUFFER,
+    windowsHide: true,
+    env: gitEnv(),
+  });
+  return stdout;
+}
+
+/** 解析 porcelain v1 -z 状态行；rename/copy 的“原路径”是下一个 NUL 段。 */
+function parsePorcelainZ(stdout) {
+  const tokens = String(stdout ?? '').split('\0');
+  const rows = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token) continue;
+    // 形如 "XY path"；posix 允许路径里有空格，所以只切前三个字符。
+    if (token.length < 4 || token[2] !== ' ') continue;
+    const status = token.slice(0, 2);
+    const path = token.slice(3);
+    let orig = null;
+    if (/[RC]/.test(status)) orig = tokens[++i] || null;
+    rows.push({ status, path, orig });
+  }
+  return rows;
+}
+
+/**
+ * 把一个路径的当前状态（类型 + size + mtimeMs）混进指纹。
+ *
+ * - 普通文件：size + mtimeMs 足以识别"状态行没变、内容变了"；
+ * - 未跟踪目录（`?? dir/`）：目录 mtime 只在直接子项增删时变，光看它不够，
+ *   所以递归展开（只用 lstat，不跟随符号链接/不钻 .git，且有预算上限）；
+ * - 已跟踪的目录条目（子模块）：只看它自己的 lstat，避免把子模块整个走一遍。
+ */
+function hashPathStat(hash, full, label, budget) {
+  let st;
+  try {
+    st = lstatSync(full);
+  } catch {
+    hash.update(`${label}\0missing\0`);
+    return;
+  }
+  if (st.isDirectory() && budget) {
+    hash.update(`${label}\0dir\0${st.mtimeMs}\0`);
+    let entries;
+    try {
+      entries = readdirSync(full, { withFileTypes: true });
+    } catch {
+      hash.update('unreadable\0');
+      return;
+    }
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const ent of entries) {
+      if (ent.name === '.git') continue;
+      if (budget.left <= 0) {
+        hash.update(`${label}\0truncated\0`);
+        return;
+      }
+      budget.left -= 1;
+      hashPathStat(hash, join(full, ent.name), `${label}/${ent.name}`, budget);
+    }
+    return;
+  }
+  const kind = st.isSymbolicLink() ? 'link' : st.isFile() ? 'file' : st.isDirectory() ? 'dir' : 'other';
+  hash.update(`${label}\0${kind}\0${st.size}\0${st.mtimeMs}\0`);
+}
+
+/**
+ * 收集当前工作区的 git 变更摘要（非 git 目录返回 null）。
+ *
+ * 异步实现：`execFile` 不占用事件循环 —— 一个 MCP 服务进程承载多个会话，
+ * 同步 `spawnSync` 最长 8s 会把所有会话的 ACP 消息/审批一起卡住。
+ *
+ * 返回对象向后兼容：`changed_files` = 全量状态条目数，`entries` = 前 40 条
+ * 展示用状态行；新增 `fingerprint` 覆盖**全量**条目（含逐路径 size/mtime），
+ * 供 `sameWorkspaceSnapshot` 判断"内容是否真的变了"。
+ */
+export async function gitStatus(cwd) {
   if (process.env.DSH_MCP_GIT_STATUS === '0') return null;
   try {
     // ★ 在不可信仓库里 `git status` 可能触发仓库配置的 fsmonitor/filter；这些
     //   命令发生在 DSH 沙箱与审批层之外。禁用可选锁与 fsmonitor，并允许用
     //   DSH_MCP_GIT_STATUS=0 完全关掉。
-    const r = spawnSync('git', ['-c', 'core.fsmonitor=false', 'status', '--porcelain', '--no-optional-locks'], {
-      cwd,
-      encoding: 'utf8',
-      timeout: 8000,
-      env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' },
-    });
-    if (r.status !== 0 || !r.stdout) return null;
-    const lines = r.stdout.split('\n').filter(Boolean);
-    if (!lines.length) return null;
-    return { changed_files: lines.length, entries: lines.slice(0, 40) };
+    // porcelain 的路径相对 **仓库根**（cwd 是子目录时也是），所以同时取 top-level。
+    const [statusOut, rootOut] = await Promise.all([
+      gitOutput(cwd, [...GIT_SAFE, 'status', '--porcelain', '-z']),
+      gitOutput(cwd, [...GIT_SAFE, 'rev-parse', '--show-toplevel']),
+    ]);
+    const rows = parsePorcelainZ(statusOut);
+    if (!rows.length) return null;
+    // git 输出的是 `C:/...` 风格，统一成原生分隔符，后面 startsWith 才不会误判越界。
+    const root = resolve(String(rootOut ?? '').trim() || cwd);
+
+    // 状态行按路径排序后参与指纹，避免依赖 git 的输出顺序。
+    const sorted = rows
+      .slice()
+      .sort((a, b) =>
+        a.path === b.path
+          ? a.status < b.status
+            ? -1
+            : a.status > b.status
+              ? 1
+              : 0
+          : a.path < b.path
+            ? -1
+            : 1,
+      );
+
+    const hash = createHash('sha256');
+    const budget = { left: MAX_UNTRACKED_DIR_ENTRIES };
+    const entries = [];
+    const rootPrefix = root.endsWith(sep) ? root : root + sep;
+    for (const row of sorted) {
+      const display = row.orig ? `${row.status} ${row.orig} -> ${row.path}` : `${row.status} ${row.path}`;
+      if (entries.length < 40) entries.push(display);
+      hash.update(display);
+      hash.update('\0');
+
+      const cleanPath = row.path.endsWith('/') ? row.path.slice(0, -1) : row.path;
+      const full = resolve(root, cleanPath);
+      if (full !== root && !full.startsWith(rootPrefix)) {
+        hash.update('outside-worktree\0');
+        continue;
+      }
+      // 只有未跟踪目录需要递归；已跟踪条目（含子模块）看 lstat 即可。
+      hashPathStat(hash, full, cleanPath, row.status === '??' ? budget : null);
+    }
+
+    return {
+      changed_files: rows.length,
+      entries,
+      fingerprint: hash.digest('hex'),
+    };
   } catch {
     return null;
   }

package/src/mcp.mjs

@@ -80,6 +80,9 @@ dsh_interject —— 一个回合 = 一个哨兵，没有例外）。dsh_send
   你再读文件即得结果。示例（Bash；直接用返回里的 sentinel_file_posix，别手工转换路径）：
     sent="$sentinel_file_posix"
     dl=$(( $(date +%s)+2100 )); until [ -f "$sent" ]; do [ $(date +%s) -ge $dl ] && { echo TIMEOUT; exit 1; }; sleep 2; done; echo DONE
+  宿主是 Windows、只有 PowerShell（或 Git Bash 不可用）时，用原生路径 sentinel_file：
+    $f='<sentinel_file>'; $dl=(Get-Date).AddSeconds(2100); while(-not (Test-Path -LiteralPath $f)){ if((Get-Date) -gt $dl){ 'TIMEOUT'; exit 1 }; Start-Sleep -Seconds 2 }; 'DONE'
+  （路径里有单引号时写成两个单引号；后台收据会直接给出拼好的这一行。）
   读文件即可拿到 status 和 result（result.review 是审核单）；**不受内存窗口限制、也扛本服务重启**。文件里 status=error 表示失败。
   拿到结果后先按审核单独立核验，再调用 dsh_review 提交裁决；审核状态会回写进哨兵。
 - 想阻塞拿结果 → 传 **wait=true**；即使等超时也不会丢结果：返回会变成收据（still_running + sentinel_file），

package/src/review.mjs

@@ -85,6 +85,15 @@ export function buildReviewChecklist({ result = {}, permission = null } = {}) {
       }），确认影响并决定是否重派。`,
     );
   }
+  const autoTotal = Number(result.auto_approvals_total) || 0;
+  if (autoTotal > 0) {
+    const esc = Number(result.auto_escalations_total) || 0;
+    items.push(
+      `本轮有 ${autoTotal} 次审批被自动放行（on_approval=auto-allow）` +
+        (esc > 0 ? `，其中 ${esc} 次申请了沙箱提权（如 danger-full-access），这些操作已在 ${permission ?? '权限档'} 之外执行` : '') +
+        '：对照 result.auto_approvals 逐条确认是否在预期内；需要逐次把关就用 on_approval=ask 新建会话。',
+    );
+  }
   if (permission) items.push(`确认操作没有超出会话权限档（${permission}）。`);
   items.push('裁决：pass（可直接采用）/ partial（部分可用，需补充）/ fail（不可用，需重做）；fail/partial 必须在 notes 里说明理由。');
   return items;
@@ -109,6 +118,8 @@ export function buildReviewTicket({
     workspace_changed: result?.workspace_changed ?? null,
     changed_files: result?.diff_stat?.changed_files ?? null,
     tools: toolNames(result),
+    auto_approvals: Number.isFinite(result?.auto_approvals_total) ? result.auto_approvals_total : null,
+    auto_escalations: Number.isFinite(result?.auto_escalations_total) ? result.auto_escalations_total : null,
     elapsed_ms: result?.elapsed_ms ?? null,
   };
   return {

package/src/tools.mjs

@@ -29,6 +29,8 @@ import {
   DSH_PROFILE,
   toPosixPath,
   resolveDshBin,
+  dshVersionStatus,
+  isNpxCachePath,
 } from './config.mjs';
 import { inspectProfile } from './bootstrap.mjs';
 import { audit } from './audit.mjs';
@@ -140,7 +142,7 @@ export const TOOL_DEFS = [
       '而是自动降级为后台：返回 run_id + sentinel_file，回合继续跑完，结果稍后由哨兵文件通知。' +
       '（timeout_ms=0 表示一直等。）所以任何时候你都能拿到结果，不用怕"超时了白干"。' +
       '等待模式与后台模式都在回合结束时原子落地一个含最终结果的小文件——' +
-      '**推荐用后台任务（Bash run_in_background + `until [ -f sentinel_file ]`）等它，跑完自动通知你，无需轮询**；' +
+      '**推荐用后台任务（Bash run_in_background + `until [ -f sentinel_file ]`；Windows/PowerShell 用 `Test-Path` 循环，收据里给出现成命令）等它，跑完自动通知你，无需轮询**；' +
       '文件出现后读它即得结果，或用 dsh_get(conversation_id, run_id) 验收，dsh_read 可中途看输出。' +
       '默认隐藏思考内容（只返回正文 + 思考统计）。' +
       '结果与后台收据都会带 `review` 审核单（默认 advisory）：调用方核验后用 dsh_review 提交裁决。' +
@@ -252,8 +254,10 @@ export const TOOL_DEFS = [
         max_chars: {
           type: 'number',
           description:
-            '正文在 **text** 里的最大字符数（默认 0 = 不截断）。' +
-            'structured.run.result 仍保留完整内容；截断时附带 answer_truncated/next_offset，可自行分页。',
+            '结果预算（默认 0 = 不截断，返回完整结果）。>0 时**同时**作用于 text 与 structured：' +
+            '正文截到该长度（附 answer_truncated/next_offset），structured.run.result.tools_used 只保留' +
+            '工具名/状态与 input_chars，不再带完整输入。完整结果始终在 sentinel_file 里。' +
+            '一个回合用了很多工具时，默认返回可能超过客户端单次工具结果上限，建议传 8000 左右。',
         },
       },
       ['conversation_id'],
@@ -452,6 +456,9 @@ function renderReviewSection(review) {
   if (ev.workspace_changed != null) bits.push(`工作区变化=${ev.workspace_changed ? '是' : '否'}`);
   if (ev.changed_files != null) bits.push(`改动文件=${ev.changed_files}`);
   if (Array.isArray(ev.tools) && ev.tools.length) bits.push(`工具=[${ev.tools.join(', ')}]`);
+  if (ev.auto_approvals) {
+    bits.push(`⚠ 自动放行审批=${ev.auto_approvals}${ev.auto_escalations ? `（含提权 ${ev.auto_escalations}）` : ''}`);
+  }
   if (bits.length) lines.push(`证据: ${bits.join(' · ')}`);
   if (pending) {
     lines.push('在把这次结果当作完成之前，请独立核验：');
@@ -471,6 +478,48 @@ function renderReviewSection(review) {
   return lines.join('\n');
 }
 
+/**
+ * 按 `max_chars` 预算压缩一份回合结果（只用于返回给调用方，不改原对象）。
+ *
+ * 体积大头是 tools_used[].input：edit/write 会带完整的新旧文本，几十次工具调用
+ * 轻松几万字。压缩后每个工具只留 id/title/name/status/kind 与 input_chars；
+ * 正文与思考截到预算长度。完整版本仍在哨兵文件里。
+ */
+export function compactResultForBudget(result, cap) {
+  if (!result || typeof result !== 'object' || !(cap > 0)) return result ?? null;
+  const out = { ...result };
+  if (typeof out.answer === 'string' && out.answer.length > cap) out.answer = out.answer.slice(0, cap);
+  if (typeof out.thinking === 'string' && out.thinking.length > cap) out.thinking = out.thinking.slice(0, cap);
+  if (Array.isArray(out.tools_used)) {
+    out.tools_used = out.tools_used.map((t) => {
+      if (!t || typeof t !== 'object') return t;
+      const { input, ...meta } = t;
+      if (input === undefined) return meta;
+      let chars = 0;
+      try {
+        chars = typeof input === 'string' ? input.length : JSON.stringify(input)?.length ?? 0;
+      } catch {
+        chars = 0;
+      }
+      return { ...meta, input_chars: chars };
+    });
+  }
+  return out;
+}
+
+/**
+ * PowerShell 版的哨兵等待命令（Windows 宿主上 Git Bash 可能不可用或挂住）。
+ * 路径放进单引号字面量：PowerShell 单引号里只有 `'` 需要转义（写成 `''`），
+ * `$`、反引号都不展开，所以不会被路径内容注入。
+ */
+export function psWaitCommand(sentinelPath, timeoutSec = 2100) {
+  const lit = `'${String(sentinelPath).replace(/'/g, "''")}'`;
+  return (
+    `$f=${lit}; $dl=(Get-Date).AddSeconds(${Math.max(1, Math.floor(timeoutSec))}); ` +
+    `while(-not (Test-Path -LiteralPath $f)){ if((Get-Date) -gt $dl){ 'TIMEOUT'; exit 1 }; Start-Sleep -Seconds 2 }; 'DONE'`
+  );
+}
+
 /** 把结构化结果渲染成给模型看的文本。 */
 function renderSendResult(r) {
   const lines = [];
@@ -496,6 +545,12 @@ function renderSendResult(r) {
   const tools = (r.tools_used ?? []).map((t) => t.name ?? t.title).filter(Boolean);
   if (tools.length) meta.push(`工具=[${[...new Set(tools)].join(', ')}]`);
   if (r.workspace_changed) meta.push(`本轮工作区状态发生变化(当前共 ${r.diff_stat?.changed_files ?? '?'} 个文件有改动)`);
+  if (r.auto_approvals_total) {
+    meta.push(
+      `自动放行审批 ${r.auto_approvals_total} 次` +
+        (r.auto_escalations_total ? `(含沙箱提权 ${r.auto_escalations_total} 次)` : ''),
+    );
+  }
   lines.push('');
   lines.push(`[${meta.join(' · ')}]`);
 
@@ -533,6 +588,8 @@ function backgroundReceipt(hub, conv, res) {
       sentinel_file: sentinel,
       /** Bash/MSYS 形式（D:\a\b → /d/a/b）；非 Windows 等于 sentinel_file。 */
       sentinel_file_posix: sentinelPosix,
+      /** Windows 宿主：现成的 PowerShell 等待命令（路径已按单引号字面量转义）。 */
+      ...(process.platform === 'win32' ? { sentinel_wait_powershell: psWaitCommand(sentinel) } : {}),
       ...(review ? { review } : {}),
     },
     text:
@@ -544,6 +601,10 @@ function backgroundReceipt(hub, conv, res) {
       `推荐用后台任务等它出现，文件一到就会唤醒你：\n` +
       `  Bash(run_in_background): sent="${sentinelPosix}"; \\\n` +
       `    dl=$(( $(date +%s)+2100 )); until [ -f "$sent" ]; do [ $(date +%s) -ge $dl ] && { echo TIMEOUT; exit 1; }; sleep 2; done; echo DONE\n` +
+      (process.platform === 'win32'
+        ? `Windows 上 Bash 不可用（或会挂住）时，用 PowerShell 版本（原生路径，已转义好）：\n` +
+          `  PowerShell(run_in_background): ${psWaitCommand(sentinel)}\n`
+        : '') +
       `文件出现后：直接读它拿结果（推荐——不受内存窗口限制、还扛服务重启），或 dsh_get(conversation_id, run_id) 验收。\n` +
       `消费完可以 rm 掉它。其它随时可用：dsh_status（是否在跑）、dsh_read（增量看输出）。` +
       (review ? `\n\n${renderReviewSection(review)}` : '') +
@@ -917,7 +978,9 @@ export function createHandlers(hub, opts = {}) {
           `未知 run_id: ${args.run_id}（内存只留最近 20 条；哨兵文件 ${hub.runSentinelPath(args.conversation_id, args.run_id)} 也不存在或不可读）`,
         );
       }
-      // 正文预算只作用于 text；structured 里保留完整 result，调用方要做程序化处理时仍然拿得到。
+      // 预算同时作用于 text 与 structured：Claude Code 等客户端会把 structuredContent
+      // 一并塞进上下文，只截 text 时一次带几十个工具输入的回合仍会超过单次结果上限
+      // （实测 75K 字符被拒收）。完整结果始终在哨兵文件里。
       const answerFull = String(run?.result?.answer ?? '');
       const capRaw = Number(args.max_chars);
       const cap = Number.isFinite(capRaw) && capRaw > 0 ? Math.floor(capRaw) : 0;
@@ -966,10 +1029,14 @@ export function createHandlers(hub, opts = {}) {
             answer_truncated: truncated,
             next_offset: truncated ? cap : null,
             review: run.review ?? run.result?.review ?? null,
-            result: run.result,
+            result: cap > 0 ? compactResultForBudget(run.result, cap) : run.result,
+            ...(cap > 0 ? { result_compacted: true } : {}),
           }
         : null;
-      if (sentinelFile) meta.push(`\n哨兵文件: ${sentinelFile}`);
+      if (sentinelFile) {
+        meta.push(`\n哨兵文件: ${sentinelFile}`);
+        if (cap > 0) meta.push('（max_chars 已同时压缩 structured：正文截断、工具输入只留长度；完整结果读这个文件）');
+      }
       return {
         structured: {
           ...snap,
@@ -1296,7 +1363,26 @@ export function createHandlers(hub, opts = {}) {
           version =
             JSON.parse(readFileSync(join(dirname(bin), '..', 'package.json'), 'utf8')).version ?? null;
         } catch {}
-        add('dsh_bin', 'ok', `${bin}${version ? ` (DSH ${version})` : ''}`);
+        const fromNpx = isNpxCachePath(bin);
+        add(
+          'dsh_bin',
+          fromNpx ? 'warn' : 'ok',
+          `${bin}${version ? ` (DSH ${version})` : ''}${fromNpx ? ' —— 位于 npx 缓存，清缓存后会失效' : ''}`,
+          fromNpx
+            ? '全局安装 DSH（npm i -g @deepseek-ai/dsh）或把 DSH_BIN 指向一个固定位置的 lib/bin.js'
+            : null,
+        );
+        const vs = dshVersionStatus(version);
+        add(
+          'dsh_version',
+          vs.status,
+          `${vs.level}: ${vs.note}`,
+          vs.status === 'ok'
+            ? null
+            : vs.level === 'unverified'
+              ? '对照 docs/zh/compatibility.md；升级后跑一遍 npm test，必要时 npm run test:all'
+              : '升级到 DSH 0.1.7-rc.1 及以上',
+        );
       } catch (e) {
         add('dsh_bin', 'fail', e.message, '设置 DSH_BIN 指向 @deepseek-ai/dsh/lib/bin.js');
       }