dsh-crwu-workbench 0.0.39 → 0.0.40

package/CHANGELOG.md

@@ -7,6 +7,14 @@
 `cordis_define` + `cordis_run` 装配，版本号用 DSH 的 `pkg-N`）；它已在本仓收尾时删除
 （见 `0.0.1` 一节），下面 `legacy · pkg-43` 及更早的记录是它的历史。
 
+## package · 0.0.40 · 2026-10-05 · fix · 普通 DSH 会话支持完整手工审核（协议 26）
+
+- 修复复制提示词到新会话后，脚本、知识库、附件下载、OSS 发布、钉钉归档和本人通知因缺少审核子会话身份被统一拒绝的问题。普通会话按选定工作空间下的 `<工作空间>/<流水号>` 校验案例目录，无需登记审核记录或讨论范围；氚云访问仍使用员工凭据与远端权限。
+- 统一案例访问入口：托管审核子会话仍校验本轮案例与附件白名单，已结束、已停止、不完整及待接管状态不得降级为普通会话；已登记讨论会话可以使用全部案例工具，记录和附件清单查询仅允许登记的 ObjectId。
+- `crwu_run_python_script` 通过调用者 Agent 解析 DSH Python，首次手工审核无需先运行一次工作台自动审核来填充缓存。
+- 手工兜底提示词携带选定工作空间的案例路径，先用 `crwu_audit_case_bootstrap` 刷新输入快照，再完成两阶段审核和各交付通道。普通会话遵循自己的 DSH 沙箱策略，本机访问授权与托管审核隔离保持生效。
+- 新增普通会话、托管审核和登记讨论的工具对照回归，覆盖 Windows 路径、写后校验、通知幂等与越界零进程。
+
 ## package · 0.0.39 · 2026-10-05 · feat · 审核 Skill 默认发布最终 HTML 与 JSON 到 OSS
 
 - 新增 `crwu-audit/references/15-oss-result-publish.md`，把默认 OSS 双文件发布、精确文件名逐项写后验证、受信目标和非阻塞失败收尾纳入 Skill，而非仅依赖插件提示词。

package/README.en.md

@@ -112,6 +112,12 @@ Building the tarball yourself (from the `crwu-ai` repository): `make plugin-pack
 > root and child sessions are always `workspace-write` with `approval=never`, and the account-connection
 > step also offers a read-only `.dws` checkup with a second-confirmed permission repair.
 
+### Manual audit in a new DSH session
+
+The fallback prompt carries the selected workspace's case directory and refreshes the record/attachment input snapshot with `crwu_audit_case_bootstrap`. Ordinary sessions can run scripts, materialize knowledge, download attachments, publish to OSS, archive to DingTalk, and notify themselves without registering an audit child or discussion session. Keep the workspace, case path, employee logins, and local-access consent ready; the session's own DSH sandbox policy still applies.
+
+Managed audit children remain bound to their current case and attachment manifest, including after stopping. Registered discussions can use case tools and query their own report. After updating, fully quit and restart DSH, then copy the prompt again.
+
 ### Updating CRWU (self-update, from 0.0.12)
 
 **Where to look:** the version badge in the sidebar card header and in the panel header (`dev` / `v0.0.12`)

package/README.md

@@ -175,6 +175,13 @@ node <仓库>/install/browser-check.mjs \
 
 `DSH_PERMISSION_MODE=danger-full-access` 只在**开发自测**（§「真实验证」里那个临时 profile）才需要。
 
+### 在 DSH 新会话中手工审核
+
+手工兜底提示词携带选定工作空间的案例目录，并先用 `crwu_audit_case_bootstrap` 刷新记录和附件输入快照。普通会话无需登记审核子会话或讨论范围，即可运行脚本、下载知识与附件、发布 OSS、钉钉归档和通知本人。请先准备工作空间、案例路径、员工登录和本机访问授权；执行仍遵循该会话自己的 DSH 沙箱策略。
+
+托管审核子会话继续限定本轮案例和附件清单，停止后也不得转为普通权限。已登记讨论会话可使用案例工具并查询自己的报告。更新插件后完整退出并重启 DSH，再重新复制提示词。
+
+
 ### 不需要任何 PATH 配置（2026-09-25 起，且**不要再加回来**）
 
 `crwu` / `dws` / `ossutil` 随插件发布在包内 `bin/<平台>/`，插件用**包内绝对路径**经 `ctx.shell`

package/bin/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "crwu.plugin-bin-manifest.v1",
-  "generatedAt": "2026-10-05T06:35:26.570Z",
+  "generatedAt": "2026-10-05T07:55:04.905Z",
   "platforms": [
     {
       "platform": "darwin-arm64",
@@ -12,9 +12,9 @@
           "source": "repo-build",
           "sourceVersion": "0.0.1",
           "target": "darwin/arm64",
-          "buildCommit": "7d713b651b913e99b0e7094ae64a8402f27957a6",
+          "buildCommit": "4a2cd69f23a20dd3424d58b1f8a35d13d2f3419e",
           "size": 7351330,
-          "sha256": "1d989a152e2ee0d8e1724ba1ceeb6fc425eb5d41da5f967e56dd78d9fc199318"
+          "sha256": "baecdedd7294c707c4be85679e3257f464c304d7d06e3214b710715d17f06d59"
         },
         {
           "tool": "ossutil",
@@ -50,9 +50,9 @@
           "source": "repo-build",
           "sourceVersion": "0.0.1",
           "target": "windows/amd64",
-          "buildCommit": "7d713b651b913e99b0e7094ae64a8402f27957a6",
+          "buildCommit": "4a2cd69f23a20dd3424d58b1f8a35d13d2f3419e",
           "size": 8128000,
-          "sha256": "14a97c0c3cccd89735bac07f12685f21563f82d141d9dd87dabc94240eccdf81"
+          "sha256": "d62601e00513b83a72dbccdec1b6ec18d8849b26d8e9e1325acac285e7bec6a8"
         },
         {
           "tool": "ossutil",

package/lib/client.js

@@ -7500,19 +7500,66 @@ body[data-ds-dark-theme] .crwu-audit-root {
 			};
 		}
 		//#endregion
+		//#region src/shared/utils/case-dir.ts
+		/**
+		* 一条报告的**案例目录**：`<工作空间>/<流水号>`（Windows 上是 `<工作空间>\<流水号>`）。
+		*
+		* 这是 Host 与 Client 都依赖的唯一约定，所以只在这里定义一次：
+		* - Host 的审核提示词拿它告诉审核子代理「本案例目录必须是 …」（`host/audit/prompt.ts`）；
+		* - Client 的讨论 / 分析提示词拿它告诉模型「下载与读取只允许在这个目录里」。
+		*
+		* **为什么必须共用一份**：2026-09-25 实测到漂移的代价 —— 审核链路一直用
+		* `<工作空间>/<流水号>`，而讨论会话的模型没人告诉它目录，于是它自己 `ls` + `find` 去猜，
+		* 猜成了 `<工作空间>/cases/<流水号>`：既扫了用户的磁盘，又把材料下到了错的地方。
+		* 两处各写一份拼接逻辑就是这种漂移的温床，所以宁可多一个共享模块。
+		*
+		* **拼接交给 `joinLocalPath`**（2026-09-28 Windows 适配）：分隔符随工作空间的风格走 ——
+		* 在 Windows 上硬拼 `/` 会得到 `C:\Work/S1` 这种混用形式，而这条路径既进提示词
+		* （模型照着写 PowerShell 命令）又进 `ctx.shell` 的 `workdir`。
+		*
+		* 任一侧为空、或流水号不是安全的一段（绝对路径 / 含 `..`）时返回空串，
+		* 调用方据此**不写这一段**（宁可不给，也不给一个半截或越界的路径）。
+		*/
+		function caseDirOf(workspacePath, seqNo) {
+			const workspace = text(workspacePath);
+			const seq = text(seqNo).trim();
+			if (workspace === "" || seq === "") return "";
+			try {
+				return joinLocalPath(workspace, seq);
+			} catch (error) {
+				return "";
+			}
+		}
+		//#endregion
 		//#region src/client/features/workbench/Handoff.tsx
 		/** 手工提示词全文。字段缺失时给出可操作的提示，而不是留空。 */
-		function handoffPrompt(task) {
+		function handoffPrompt(task, workspacePath = "") {
+			const caseDir = caseDirOf(workspacePath, task.seqNo);
 			return [
 				zhCN.handoffIntro,
 				"",
 				`- ${zhCN.handoffObjectId}${task.id === "" ? zhCN.handoffObjectIdMissing : task.id}`,
 				`- ${zhCN.handoffSeqNo}${task.seqNo === "" ? task.name : task.seqNo}`,
-				`- ${zhCN.handoffProject}${task.project === "" ? zhCN.handoffProjectMissing : task.project}`
+				`- ${zhCN.handoffProject}${task.project === "" ? zhCN.handoffProjectMissing : task.project}`,
+				"",
+				"这是普通会话中的手工审核，无需登记为审核子会话。先准备本轮输入快照，再执行技能的完整两阶段审核。",
+				...caseDir === "" ? ["请先在工作台选定工作空间并确认报告流水号，然后重新复制提示词；不要猜案例目录。"] : [
+					`本次唯一案例目录：${caseDir}`,
+					"若案例目录不存在，只在上述工作空间下创建这个目录；所有材料、脚本与交付件均放在其中，不复用旧审核产物。",
+					...task.id === "" ? [] : [`先调用 crwu_audit_case_bootstrap(${JSON.stringify({
+						objectId: task.id,
+						seqNo: task.seqNo,
+						caseDir,
+						refresh: true
+					})})。`, "成功后只读取它返回的 snapshotPath、attachmentsPath、metadataPath；失败则停止并报告结构化错误。"],
+					"附件按清单通过 crwu_h3yun_file_get 逐件下载，知识清单用 crwu_audit_knowledge_materialize 实时下载。",
+					"技能脚本用 crwu_run_python_script；运行时仅由 load_workspace_dependencies 解析，不查找或改用系统 Python。",
+					"最终 HTML/JSON 校验通过后，分别调用 crwu_audit_oss_publish、crwu_audit_dingtalk_archive、crwu_audit_dingtalk_notify_self，独立报告各通道交付结果。"
+				]
 			].join("\n");
 		}
 		function Handoff(props) {
-			const prompt = handoffPrompt(props.task);
+			const prompt = handoffPrompt(props.task, props.workspacePath);
 			const copy = () => {
 				const fallback = () => {
 					workbenchApi.clipboard({ text: prompt });
@@ -8661,37 +8708,6 @@ body[data-ds-dark-theme] .crwu-audit-root {
 			};
 		}
 		//#endregion
-		//#region src/shared/utils/case-dir.ts
-		/**
-		* 一条报告的**案例目录**：`<工作空间>/<流水号>`（Windows 上是 `<工作空间>\<流水号>`）。
-		*
-		* 这是 Host 与 Client 都依赖的唯一约定，所以只在这里定义一次：
-		* - Host 的审核提示词拿它告诉审核子代理「本案例目录必须是 …」（`host/audit/prompt.ts`）；
-		* - Client 的讨论 / 分析提示词拿它告诉模型「下载与读取只允许在这个目录里」。
-		*
-		* **为什么必须共用一份**：2026-09-25 实测到漂移的代价 —— 审核链路一直用
-		* `<工作空间>/<流水号>`，而讨论会话的模型没人告诉它目录，于是它自己 `ls` + `find` 去猜，
-		* 猜成了 `<工作空间>/cases/<流水号>`：既扫了用户的磁盘，又把材料下到了错的地方。
-		* 两处各写一份拼接逻辑就是这种漂移的温床，所以宁可多一个共享模块。
-		*
-		* **拼接交给 `joinLocalPath`**（2026-09-28 Windows 适配）：分隔符随工作空间的风格走 ——
-		* 在 Windows 上硬拼 `/` 会得到 `C:\Work/S1` 这种混用形式，而这条路径既进提示词
-		* （模型照着写 PowerShell 命令）又进 `ctx.shell` 的 `workdir`。
-		*
-		* 任一侧为空、或流水号不是安全的一段（绝对路径 / 含 `..`）时返回空串，
-		* 调用方据此**不写这一段**（宁可不给，也不给一个半截或越界的路径）。
-		*/
-		function caseDirOf(workspacePath, seqNo) {
-			const workspace = text(workspacePath);
-			const seq = text(seqNo).trim();
-			if (workspace === "" || seq === "") return "";
-			try {
-				return joinLocalPath(workspace, seq);
-			} catch (error) {
-				return "";
-			}
-		}
-		//#endregion
 		//#region src/client/features/report-audit/ReportPane.tsx
 		/**
 		* 复用的搜索组件（报告列表与 AI 审核列表是**同一个**）。
@@ -9791,6 +9807,7 @@ body[data-ds-dark-theme] .crwu-audit-root {
 								}),
 								state.handoff === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Handoff, {
 									task: state.handoff,
+									workspacePath: props.workspace?.path,
 									copied: props.handoffCopied,
 									onCopied: props.onHandoffCopied
 								}),
@@ -10742,7 +10759,7 @@ body[data-ds-dark-theme] .crwu-audit-root {
 		}
 		/** 宿主与客户端是不是同一代（不同代时**必须**拦住发起审核，见 AGENTS.md §7.12）。 */
 		function hostIsStale(snapshot) {
-			return snapshot.protocol !== null && snapshot.protocol !== 25;
+			return snapshot.protocol !== null && snapshot.protocol !== 26;
 		}
 		/**
 		* 宿主执行的权限说明版本与客户端是否一致（协议 18）。

package/lib/index.js

@@ -231,7 +231,7 @@ const PLUGIN_INJECT = [
 * 还会让打包器的 JSON 插件成为隐式依赖。代价是升版本时要同时改这里 ——
 * `tests/unit/host-package.test.mjs` 有一条断言盯着它必须等于 `package.json` 的 version。
 */
-const PLUGIN_VERSION = "0.0.39";
+const PLUGIN_VERSION = "0.0.40";
 /**
 * `ping` / `boot` 应答里的版本指纹，形如 `pkg-0.0.5`。
 *
@@ -3171,10 +3171,11 @@ function samePathText(a, b) {
 */
 function isAuditChild(state, childId, parentSessionId = "") {
 	if (childId === "") return false;
+	if (parentSessionId !== "" && parentSessionId === state.auditRoot?.sessionId) return true;
 	for (const record of Object.values(state.audits ?? {})) {
 		if (record === void 0) continue;
-		if (record.childId === childId) return true;
-		if (record.pending === true && record.childId === "" && parentSessionId !== "" && record.parentSessionId === parentSessionId) return true;
+		if (record.childId === childId || record.replacedChildId === childId) return true;
+		if (parentSessionId !== "" && record.parentSessionId === parentSessionId) return true;
 	}
 	return false;
 }
@@ -3189,7 +3190,7 @@ function isAuditChild(state, childId, parentSessionId = "") {
 * 退路问的是会话存储本身：**审核根的孩子里有没有这个调用者**。
 * 两条都拿不到才算"问不到"，由门禁 fail closed（不猜）。
 *
-* 只对**待接管**的候选问（正常最多一条）：多条 pending 是状态异常，直接不认。
+* Query known audit roots so replaced children retain their managed identity.
 */
 async function callerParentSessionId(ctx, state, exec) {
 	const { childId, parentSessionId } = callerIdentity(exec);
@@ -3197,13 +3198,10 @@ async function callerParentSessionId(ctx, state, exec) {
 	if (parentSessionId !== "") return parentSessionId;
 	const subagents = ctx.get("subagents");
 	if (subagents === void 0 || typeof subagents.listChildren !== "function") return "";
-	const candidates = Object.values(state.audits ?? {}).filter((record) => record !== void 0 && record.pending === true && record.childId === "" && record.parentSessionId !== "");
-	if (candidates.length !== 1) return "";
-	const parentId = candidates[0]?.parentSessionId ?? "";
-	if (parentId === "") return "";
-	try {
+	const candidates = new Set([text(state.auditRoot?.sessionId), ...Object.values(state.audits ?? {}).map((record) => text(record?.parentSessionId))].filter((id) => id !== ""));
+	for (const parentId of candidates) try {
 		const children = await subagents.listChildren(parentId);
-		if (!Array.isArray(children)) return "";
+		if (!Array.isArray(children)) continue;
 		for (const child of children) {
 			if (child === null || typeof child !== "object") continue;
 			const record = child;
@@ -5366,6 +5364,182 @@ function nodeSize(item) {
 	}
 	return null;
 }
+function createDiscussionScopeRegistry(options = {}) {
+	const now = options.now ?? (() => Date.now());
+	const ttlMs = options.ttlMs ?? 432e5;
+	const limit = options.limit ?? 32;
+	const scopes = /* @__PURE__ */ new Map();
+	/** 过期的一律先清掉：判据只有 `expiresAt` 与当前时刻。 */
+	const sweep = () => {
+		const at = now();
+		for (const [id, scope] of scopes) if (scope.expiresAt <= at) scopes.delete(id);
+	};
+	/** 超出上限时丢**最久没用过**的（不是最早建的：人可能一直在用一条老会话）。 */
+	const trim = () => {
+		while (scopes.size > limit) {
+			let oldestId = "";
+			let oldestAt = Number.POSITIVE_INFINITY;
+			for (const [id, scope] of scopes) if (scope.lastUsedAt < oldestAt) {
+				oldestAt = scope.lastUsedAt;
+				oldestId = id;
+			}
+			if (oldestId === "") return;
+			scopes.delete(oldestId);
+		}
+	};
+	return {
+		register(input) {
+			const at = now();
+			const scope = {
+				sessionId: text(input.sessionId),
+				seqNo: text(input.seqNo),
+				objectId: text(input.objectId),
+				caseDir: text(input.caseDir),
+				allowedAttachmentIds: [...input.allowedAttachmentIds].map((id) => text(id)).filter((id) => id !== ""),
+				createdAt: at,
+				lastUsedAt: at,
+				expiresAt: at + ttlMs
+			};
+			scopes.set(scope.sessionId, scope);
+			trim();
+			return scope;
+		},
+		use(sessionId) {
+			sweep();
+			const id = text(sessionId);
+			if (id === "") return void 0;
+			const scope = scopes.get(id);
+			if (scope === void 0) return void 0;
+			const touched = {
+				...scope,
+				lastUsedAt: now()
+			};
+			scopes.set(id, touched);
+			return touched;
+		},
+		peek(sessionId) {
+			sweep();
+			return scopes.get(text(sessionId));
+		},
+		drop(sessionId) {
+			scopes.delete(text(sessionId));
+		},
+		list() {
+			sweep();
+			return [...scopes.values()];
+		},
+		clear() {
+			scopes.clear();
+		},
+		size() {
+			sweep();
+			return scopes.size;
+		}
+	};
+}
+/**
+* 案例内 Tool 的**统一门禁**：认证身份 → 解析范围 → 校验模型提交的标识。
+*
+* 与 `requireAuditScope` 的关系：后者是"审核子会话"这一支的实现，这里在它之前再加一支
+* "已登记的讨论会话"。**讨论会话绝不复用审核 scope**（见文件头第 2 条）。
+*/
+async function requireMaterialScope(ctx, state, scopes, exec, args, options = {}) {
+	const { childId } = callerIdentity(exec);
+	if (childId === "") return { ...failure$1("policy", "无法确认调用者身份：案例内的操作只允许由本次审核的子会话或已登记的报告讨论会话发起") };
+	if (auditScopeFor(state, childId) !== void 0) {
+		const checked = await requireAuditScope(ctx, state, exec, args, options);
+		if (!checked.ok) return checked;
+		return {
+			ok: true,
+			material: {
+				kind: "audit",
+				scope: checked.scope
+			}
+		};
+	}
+	const scope = scopes.use(childId);
+	if (scope === void 0) return { ...failure$1("policy", "调用者既不是进行中的审核子会话，也不是已登记的报告讨论会话：案例内的操作一律拒绝（报告讨论请在工作台点「与 DeepSeek 讨论报告」重新登记材料范围）") };
+	const seqNo = text(args.seqNo).trim();
+	if (seqNo !== "" && seqNo !== scope.seqNo) return { ...failure$1("input", "流水号与本次登记的材料范围不一致：拒绝操作") };
+	const objectId = text(args.objectId).trim();
+	if (objectId !== "" && objectId !== scope.objectId) return { ...failure$1("input", "记录标识与本次登记的材料范围不一致：拒绝操作") };
+	const caseDir = text(args.caseDir).trim();
+	if (caseDir === "") {
+		if (options.requireCaseDir === false) return {
+			ok: true,
+			material: {
+				kind: "discussion",
+				scope
+			}
+		};
+		return { ...failure$1("input", "缺少案例目录：案例内的操作必须带上本轮案例目录") };
+	}
+	if (fileSystem(ctx) === void 0) return { ...failure$1("infrastructure", "Host 文件服务不可用") };
+	try {
+		const given = await resolveTarget(ctx, caseDir);
+		const expected = await resolveTarget(ctx, scope.caseDir);
+		if (text(given.targetKey) === "" || given.targetKey !== expected.targetKey) return { ...failure$1("policy", "案例目录必须是本次登记的那一个（不许用工作空间根、兄弟案例或子目录）") };
+	} catch (error) {
+		return { ...failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`) };
+	}
+	return {
+		ok: true,
+		material: {
+			kind: "discussion",
+			scope
+		}
+	};
+}
+//#endregion
+//#region src/host/audit/case-access.ts
+async function requireCaseAccess(ctx, state, discussions, exec, args) {
+	const { childId } = callerIdentity(exec);
+	if (childId === "") return failure$1("policy", "无法确认调用者身份：案例操作需要会话上下文");
+	const parentId = await callerParentSessionId(ctx, state, exec);
+	if (isAuditChild(state, childId, parentId)) {
+		const checked = await requireAuditScope(ctx, state, exec, args);
+		if (!checked.ok) return checked;
+		return {
+			ok: true,
+			kind: "audit",
+			casePath: checked.casePath,
+			allowedAttachmentIds: checked.scope.allowedAttachmentIds
+		};
+	}
+	const header = exec.agent?.session?.header;
+	if (Object.values(state.audits ?? {}).some((record) => record?.pending === true && record.childId === "") && parentId === "" && header === void 0) return failure$1("policy", "审核子会话正在建立，尚无法确认调用者的会话范围：请稍后重试");
+	if (discussions.peek(childId) !== void 0) {
+		const checked = await requireMaterialScope(ctx, state, discussions, exec, args);
+		if (!checked.ok) return checked;
+		const scope = checked.material.scope;
+		return {
+			ok: true,
+			kind: checked.material.kind,
+			casePath: checked.material.kind === "audit" ? checked.material.scope.casePath : checked.material.scope.caseDir,
+			allowedAttachmentIds: scope.allowedAttachmentIds
+		};
+	}
+	const root = allowedCaseRootOf(state);
+	const checked = await requireCaseDir(ctx, args.caseDir, { allowedRoot: root });
+	if (!checked.ok) return checked;
+	const seqNo = text(args.seqNo).trim() || basenameLocalPath(checked.path);
+	if (seqNo === "." || seqNo === ".." || /[\\/]/.test(seqNo)) return failure$1("input", "流水号必须是单段案例目录名，不能包含路径分隔符");
+	const expectedPath = caseDirOf(root, seqNo);
+	if (expectedPath === "") return failure$1("input", "流水号必须是有效的案例目录名");
+	try {
+		const given = await resolveTarget(ctx, checked.path);
+		const expected = await resolveTarget(ctx, expectedPath);
+		const workspace = await resolveTarget(ctx, root);
+		if (text(given.targetKey) === "" || given.targetKey === workspace.targetKey || given.targetKey !== expected.targetKey) return failure$1("policy", "案例目录必须是当前工作空间下的 `<工作空间>/<流水号>`，不能使用工作空间根或嵌套目录");
+	} catch (error) {
+		return failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`);
+	}
+	return {
+		ok: true,
+		kind: "session",
+		casePath: checked.path
+	};
+}
 //#endregion
 //#region src/host/dws/run.ts
 /** 允许出现在产品域之前的**全局**取值 flag；值必须紧随其后。 */
@@ -5767,7 +5941,7 @@ function dingtalkTools(deps) {
 				steps
 			};
 			const ctx = toolContext(deps.ctx, exec);
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, {
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, {
 				caseDir: args.caseDir,
 				seqNo: args.seqNo
 			});
@@ -6153,7 +6327,7 @@ function dingtalkTools(deps) {
 				openDingId: "",
 				steps
 			};
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, {
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, {
 				caseDir: args.caseDir,
 				seqNo: args.seqNo
 			});
@@ -6481,136 +6655,6 @@ function locateMessage(payload, fileName) {
 async function persistNotifyState(ctx, path, state, options) {
 	return (await writeCaseText(ctx, path, `${JSON.stringify(state, null, 2)}\n`, options)).ok;
 }
-function createDiscussionScopeRegistry(options = {}) {
-	const now = options.now ?? (() => Date.now());
-	const ttlMs = options.ttlMs ?? 432e5;
-	const limit = options.limit ?? 32;
-	const scopes = /* @__PURE__ */ new Map();
-	/** 过期的一律先清掉：判据只有 `expiresAt` 与当前时刻。 */
-	const sweep = () => {
-		const at = now();
-		for (const [id, scope] of scopes) if (scope.expiresAt <= at) scopes.delete(id);
-	};
-	/** 超出上限时丢**最久没用过**的（不是最早建的：人可能一直在用一条老会话）。 */
-	const trim = () => {
-		while (scopes.size > limit) {
-			let oldestId = "";
-			let oldestAt = Number.POSITIVE_INFINITY;
-			for (const [id, scope] of scopes) if (scope.lastUsedAt < oldestAt) {
-				oldestAt = scope.lastUsedAt;
-				oldestId = id;
-			}
-			if (oldestId === "") return;
-			scopes.delete(oldestId);
-		}
-	};
-	return {
-		register(input) {
-			const at = now();
-			const scope = {
-				sessionId: text(input.sessionId),
-				seqNo: text(input.seqNo),
-				objectId: text(input.objectId),
-				caseDir: text(input.caseDir),
-				allowedAttachmentIds: [...input.allowedAttachmentIds].map((id) => text(id)).filter((id) => id !== ""),
-				createdAt: at,
-				lastUsedAt: at,
-				expiresAt: at + ttlMs
-			};
-			scopes.set(scope.sessionId, scope);
-			trim();
-			return scope;
-		},
-		use(sessionId) {
-			sweep();
-			const id = text(sessionId);
-			if (id === "") return void 0;
-			const scope = scopes.get(id);
-			if (scope === void 0) return void 0;
-			const touched = {
-				...scope,
-				lastUsedAt: now()
-			};
-			scopes.set(id, touched);
-			return touched;
-		},
-		peek(sessionId) {
-			sweep();
-			return scopes.get(text(sessionId));
-		},
-		drop(sessionId) {
-			scopes.delete(text(sessionId));
-		},
-		list() {
-			sweep();
-			return [...scopes.values()];
-		},
-		clear() {
-			scopes.clear();
-		},
-		size() {
-			sweep();
-			return scopes.size;
-		}
-	};
-}
-/**
-* 案例内 Tool 的**统一门禁**：认证身份 → 解析范围 → 校验模型提交的标识。
-*
-* 与 `requireAuditScope` 的关系：后者是"审核子会话"这一支的实现，这里在它之前再加一支
-* "已登记的讨论会话"。**讨论会话绝不复用审核 scope**（见文件头第 2 条）。
-*/
-async function requireMaterialScope(ctx, state, scopes, exec, args, options = {}) {
-	const { childId } = callerIdentity(exec);
-	if (childId === "") return { ...failure$1("policy", "无法确认调用者身份：案例内的操作只允许由本次审核的子会话或已登记的报告讨论会话发起") };
-	if (auditScopeFor(state, childId) !== void 0) {
-		const checked = await requireAuditScope(ctx, state, exec, args, options);
-		if (!checked.ok) return checked;
-		return {
-			ok: true,
-			material: {
-				kind: "audit",
-				scope: checked.scope
-			}
-		};
-	}
-	const scope = scopes.use(childId);
-	if (scope === void 0) return { ...failure$1("policy", "调用者既不是进行中的审核子会话，也不是已登记的报告讨论会话：案例内的操作一律拒绝（报告讨论请在工作台点「与 DeepSeek 讨论报告」重新登记材料范围）") };
-	const seqNo = text(args.seqNo).trim();
-	if (seqNo !== "" && seqNo !== scope.seqNo) return { ...failure$1("input", "流水号与本次登记的材料范围不一致：拒绝操作") };
-	const objectId = text(args.objectId).trim();
-	if (objectId !== "" && objectId !== scope.objectId) return { ...failure$1("input", "记录标识与本次登记的材料范围不一致：拒绝操作") };
-	const caseDir = text(args.caseDir).trim();
-	if (caseDir === "") {
-		if (options.requireCaseDir === false) return {
-			ok: true,
-			material: {
-				kind: "discussion",
-				scope
-			}
-		};
-		return { ...failure$1("input", "缺少案例目录：案例内的操作必须带上本轮案例目录") };
-	}
-	if (fileSystem(ctx) === void 0) return { ...failure$1("infrastructure", "Host 文件服务不可用") };
-	try {
-		const given = await resolveTarget(ctx, caseDir);
-		const expected = await resolveTarget(ctx, scope.caseDir);
-		if (text(given.targetKey) === "" || given.targetKey !== expected.targetKey) return { ...failure$1("policy", "案例目录必须是本次登记的那一个（不许用工作空间根、兄弟案例或子目录）") };
-	} catch (error) {
-		return { ...failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`) };
-	}
-	return {
-		ok: true,
-		material: {
-			kind: "discussion",
-			scope
-		}
-	};
-}
-/** 这次调用是不是**已登记**的报告讨论会话（给它开材料权限的那一条身份判据）。 */
-function isRegisteredDiscussion(scopes, sessionId) {
-	return scopes.peek(sessionId) !== void 0;
-}
 //#endregion
 //#region src/host/tools/h3yun.ts
 /**
@@ -6746,10 +6790,17 @@ function h3yunTools(deps) {
 					...failure$1("policy", "审核子会话不能直接查询氚云记录：本轮记录与附件清单已在输入快照里"),
 					...base
 				};
-				if (isRegisteredDiscussion(deps.discussionScopes, callerIdentity(exec).childId)) return {
-					...failure$1("policy", "报告讨论会话不能查询氚云记录：材料范围只包含登记时取到的那批附件"),
-					...base
-				};
+				const discussion = deps.discussionScopes.peek(callerIdentity(exec).childId);
+				if (discussion !== void 0) {
+					const checked = await requireMaterialScope(ctx, deps.state, deps.discussionScopes, exec, {
+						caseDir: args.caseDir,
+						objectId
+					}, { requireCaseDir: false });
+					if (!checked.ok) return {
+						...checked,
+						...base
+					};
+				}
 				const platform = await deps.world.platform();
 				const gap = await requireCrwu(ctx, platform);
 				if (gap !== null) return {
@@ -6762,7 +6813,7 @@ function h3yunTools(deps) {
 					...base
 				};
 				const requested = text(args.caseDir).trim();
-				let workdir = await deps.world.workdir();
+				let workdir = discussion?.caseDir || await deps.world.workdir();
 				if (requested !== "") {
 					const caseCheck = await requireCaseDir(ctx, requested, { allowedRoot: allowedCaseRootOf(deps.state) });
 					if (!caseCheck.ok) return {
@@ -6885,11 +6936,18 @@ function h3yunTools(deps) {
 					count: 0,
 					files: []
 				};
-				if (isRegisteredDiscussion(deps.discussionScopes, callerIdentity(exec).childId)) return {
-					...failure$1("policy", "报告讨论会话不能列举氚云附件：材料范围只包含登记时取到的那批附件"),
-					count: 0,
-					files: []
-				};
+				const discussion = deps.discussionScopes.peek(callerIdentity(exec).childId);
+				if (discussion !== void 0) {
+					const checked = await requireMaterialScope(ctx, deps.state, deps.discussionScopes, exec, {
+						caseDir: args.caseDir,
+						objectId
+					}, { requireCaseDir: false });
+					if (!checked.ok) return {
+						...checked,
+						count: 0,
+						files: []
+					};
+				}
 				const platform = await deps.world.platform();
 				const gap = await requireCrwu(ctx, platform);
 				if (gap !== null) return {
@@ -6904,7 +6962,7 @@ function h3yunTools(deps) {
 					files: []
 				};
 				const requested = text(args.caseDir).trim();
-				let workdir = await deps.world.workdir();
+				let workdir = discussion?.caseDir || await deps.world.workdir();
 				if (requested !== "") {
 					const caseCheck = await requireCaseDir(ctx, requested, { allowedRoot: allowedCaseRootOf(deps.state) });
 					if (!caseCheck.ok) return {
@@ -6967,7 +7025,7 @@ function h3yunTools(deps) {
 			name: TOOL_NAMES.h3yunFileGet,
 			description: [
 				"按 fileId **单附件定向下载**氚云记录附件到**本轮案例目录**内的相对路径。",
-				"只接受本轮输入快照（附件清单）里登记过的 fileId；不在清单里的附件在起进程之前就被拒绝。",
+				"普通会话可按员工权限下载；托管审核与已登记讨论会话只接受本次材料清单里的 fileId。",
 				"目标必须落在给定案例目录之下（越界直接拒绝）。",
 				"本工具没有「整单下载」路径：一次只取一个附件，失败就是失败，不会退化成批量下载。"
 			].join(" "),
@@ -6975,7 +7033,7 @@ function h3yunTools(deps) {
 				fileId: {
 					type: "string",
 					required: true,
-					description: "附件 fileId（只接受本轮输入快照登记过的附件）"
+					description: "附件 fileId（托管审核与已登记讨论会话须在本次材料清单内）"
 				},
 				caseDir: {
 					type: "string",
@@ -7013,22 +7071,22 @@ function h3yunTools(deps) {
 			async execute(args, exec) {
 				const ctx = toolContext(deps.ctx, exec);
 				const fileId = text(args.fileId).trim();
-				const materialCheck = await requireMaterialScope(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir });
+				const materialCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir });
 				if (!materialCheck.ok) return {
 					...materialCheck,
 					fileId,
 					path: "",
 					sizeBytes: 0
 				};
-				const material = materialCheck.material;
-				const casePath = material.kind === "audit" ? material.scope.casePath : material.scope.caseDir;
+				const material = materialCheck;
+				const casePath = material.casePath;
 				if (fileId === "") return {
 					...failure$1("input", "fileId 不能为空"),
 					fileId,
 					path: "",
 					sizeBytes: 0
 				};
-				if (!material.scope.allowedAttachmentIds.includes(fileId)) return {
+				if (material.kind !== "session" && !material.allowedAttachmentIds?.includes(fileId)) return {
 					...failure$1("policy", material.kind === "audit" ? "这个附件不在本轮审核的输入快照里：只允许下载本次登记的附件" : "这个附件不在本次登记的材料范围里：只允许下载登记时取到的那批附件（请在工作台重新点「与 DeepSeek 讨论报告」刷新）"),
 					fileId,
 					path: "",
@@ -9406,7 +9464,7 @@ function knowledgeTools(deps) {
 				...failure$1("input", "paths 不能为空"),
 				...empty
 			};
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, { caseDir: args.caseDir });
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir });
 			if (!caseCheck.ok) return {
 				...caseCheck,
 				...empty
@@ -9983,7 +10041,7 @@ function ossTools(deps) {
 				...failure$1("input", `流水号形状不对（不放进 OSS 路径）：${seqNo === "" ? "(空)" : seqNo}`),
 				...empty
 			};
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, {
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, {
 				caseDir: args.caseDir,
 				seqNo: args.seqNo
 			});
@@ -10410,7 +10468,7 @@ function pythonScriptTools(deps) {
 			caseDir: {
 				required: true,
 				type: "string",
-				description: "本轮案例目录（Host 用它做审核范围校验）。"
+				description: "本轮案例目录（Host 校验工作空间与案例范围）。"
 			},
 			script: {
 				required: true,
@@ -10522,7 +10580,7 @@ function pythonScriptTools(deps) {
 		async execute(args, exec) {
 			const ctx = toolContext(deps.ctx, exec);
 			const base = idleResult();
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, { caseDir: args.caseDir });
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir });
 			if (!caseCheck.ok) return {
 				...base,
 				...caseCheck
@@ -10553,7 +10611,7 @@ function pythonScriptTools(deps) {
 				...base,
 				...failure$1("capability-gap", "DSH 自带 Python 解析器没有装配：本插件实例不能执行技能脚本")
 			};
-			const runtime = await deps.python.check();
+			const runtime = await deps.python.check({ agent: exec.agent });
 			if (!runtime.ok) return {
 				...base,
 				...failure$1("capability-gap", `DSH 自带 Python 不可用（${runtime.state}）：${runtime.error}`),
@@ -16313,7 +16371,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 			buildKind: HOST_BUILD_KIND,
 			at: (/* @__PURE__ */ new Date()).toISOString(),
 			builtAt: HOST_BUILD_STAMP,
-			protocol: 25
+			protocol: 26
 		}),
 		boot: async () => {
 			const home = await world.home();
@@ -16332,7 +16390,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 			});
 			return {
 				ok: true,
-				protocol: 25,
+				protocol: 26,
 				permissionSchemaVersion: 1,
 				localAccess: await syncLocalAccessConsent({
 					ctx,
@@ -16433,7 +16491,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 		*/
 		trust: async () => ({
 			ok: false,
-			error: `客户端与宿主的权限说明版本不一致：本机访问授权已改为版本化收据（协议 ${String(25)}），请完全退出并重新打开 DeepSeek Harness 后在「账号连接」里按新的范围允许一次。`,
+			error: `客户端与宿主的权限说明版本不一致：本机访问授权已改为版本化收据（协议 ${String(26)}），请完全退出并重新打开 DeepSeek Harness 后在「账号连接」里按新的范围允许一次。`,
 			protocolMismatch: true,
 			consent: await readLocalAccessConsent({
 				ctx,
@@ -18747,7 +18805,7 @@ function apply(ctx, pluginConfig) {
 			"oss-config": ossConfigPath
 		},
 		hostVersion: PLUGIN_VERSION,
-		protocolVersion: 25
+		protocolVersion: 26
 	});
 	subscribeAuditEvents(ctx, state);
 	const form = new H3yunFormResolver({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crwu-workbench",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "description": "中瑞世联工作台 / CRWU audit workbench for DeepSeek Harness: pick a pending audit report, dispatch one AI audit subagent, watch and stop/restart it, auto-upload deliverables to Aliyun OSS.",
   "keywords": [
     "deepseek-harness",