dsh-context-toolkit 0.2.2 → 0.2.3

package/README.md

@@ -113,7 +113,7 @@ Tool switches: `tools.execute`, `tools.executeFile`, `tools.batchExecute`, `tool
 The offline suites need no DSH runtime:
 
 ```bash
-node smoke.mjs        # 66 checks: contract, runtime discovery, tools, gate (segment matching, prefix/path normalisation, script_path coverage), resource disposal, knowledge base, observability, version reporting
+node smoke.mjs        # 68 checks: contract, runtime discovery, tools, gate (segment matching, prefix/path normalisation, script_path coverage and relative-path alignment), resource disposal, knowledge base, observability, version reporting
 node test-client.mjs  # 27 checks: browser-half contract and bilingual dictionary parity
 node test-package.mjs # 20 checks: publish manifest and the zero-dependency constraint
 node release-check.mjs # 27 checks: release readiness (manifest, deps, tool count, gate matching, version, SHA coverage, no hardcoded paths)

package/README.zh.md

@@ -113,7 +113,7 @@ await ctk_search({ queries: ['rate limit', 'auth'] });  // 只取相关片段
 离线套件不依赖 DSH 运行时：
 
 ```bash
-node smoke.mjs        # 66 项：契约、运行时探测、三工具、门禁（分段匹配 + 前缀/路径归一 + script_path 覆盖）、资源释放、知识库、观测、版本自述
+node smoke.mjs        # 68 项：契约、运行时探测、三工具、门禁（分段匹配 + 前缀/路径归一 + script_path 覆盖与相对路径对齐）、资源释放、知识库、观测、版本自述
 node test-client.mjs  # 27 项：浏览器半体契约与双语字典一致性
 node test-package.mjs # 20 项：发布清单与零依赖约束
 node release-check.mjs # 27 项：发布就绪（清单/依赖/工具数/门禁匹配/版本/SHA 覆盖/无硬编码路径）

package/index.js

@@ -365,18 +365,43 @@ const SCRIPT_READ_MAX = 256 * 1024
  * the same bypass the shell-name list fixed, one field over: whichever field carries
  * the payload, the gate has to follow it.
  */
-function shellTextOf(args) {
+function shellTextOf(args, exec) {
   const parts = []
   if (typeof args.command === 'string') parts.push(args.command)
   if (typeof args.script_path === 'string' && args.script_path.trim()) {
+    const path = resolveScriptPath(args.script_path, args.cwd, exec)
     try {
-      const st = statSync(args.script_path)
-      if (st.isFile()) parts.push(readFileSync(args.script_path, 'utf8').slice(0, SCRIPT_READ_MAX))
+      const st = statSync(path)
+      if (st.isFile()) parts.push(readFileSync(path, 'utf8').slice(0, SCRIPT_READ_MAX))
     } catch { /* an unreadable script is the shell tool's error to report, not the gate's */ }
   }
   return parts.join('\n')
 }
 
+/**
+ * Where a relative script_path actually points.
+ *
+ * The host resolves a relative script against the *session* working directory, while
+ * statSync resolves it against this process's cwd — the install directory. The two
+ * disagree, so reading the raw string saw nothing for a relative script_path and waved
+ * the call through even though the host would run it happily. Aligning the base closes
+ * the last way a shell call can carry a payload the gate cannot see: whenever the host
+ * can run the file, the gate resolves the same file.
+ */
+function resolveScriptPath(requested, requestedCwd, exec) {
+  if (isAbsolute(requested)) return requested
+  let session = null
+  try {
+    session = exec && exec.agent && exec.agent.session && exec.agent.session.header
+      ? exec.agent.session.header.cwd : null
+  } catch { /* no session on this exec: fall back to the process default */ }
+  const base = session || process.cwd()
+  const cwd = typeof requestedCwd === 'string' && requestedCwd.trim()
+    ? (isAbsolute(requestedCwd) ? requestedCwd : resolve(base, requestedCwd))
+    : base
+  return resolve(cwd, requested)
+}
+
 function floodReason(toolName, args, text) {
   if (!SHELL_TOOL_NAMES.has(toolName)) return undefined
   const command = text === undefined ? shellTextOf(args) : text
@@ -407,7 +432,7 @@ function registerRoutingGate(ctx, config, stats) {
 
       // Read the call's text once and reuse it: a script can be 256 KB, and the deny
       // path used to read it three times to answer three questions about one string.
-      const shellText = SHELL_TOOL_NAMES.has(toolName) ? shellTextOf(args) : ''
+      const shellText = SHELL_TOOL_NAMES.has(toolName) ? shellTextOf(args, exec) : ''
 
       if (config.denyCurlWget !== false) {
         const reason = floodReason(toolName, args, shellText)
@@ -459,7 +484,7 @@ function registerRoutingGate(ctx, config, stats) {
   })
 
   if (config.denyCurlWget !== false && ctx.tools && typeof ctx.tools.guard === 'function') {
-    ctx.tools.guard((exec) => floodReason(exec && exec.name, (exec && exec.arguments) || {}))
+    ctx.tools.guard((exec) => { const a = (exec && exec.arguments) || {}; return floodReason(exec && exec.name, a, shellTextOf(a, exec)) })
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-context-toolkit",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "DeepSeek Harness bundle: native ctk_* sandbox tools, a routing gate that keeps bulk output out of the transcript, and a local full-text knowledge base. No third-party runtime dependencies.",
   "repository": {
     "type": "git",