dsh-gitbash-shell 0.43.2 → 0.44.0

package/CHANGELOG.md

@@ -3,6 +3,51 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## [0.44.0] — 2026-10-28
+
+### feat:跟随 dsh 0.2.2-alpha.2 的工具执行器架构(executor 行、subagent 模型键、assemble 事件收窄、promoted 文案精简)
+
+- **背景**:官方 0.2.2-alpha.2 重做了工具执行架构(`docs/upgrade-guide/v0.2.1-rc.2/tool-executor-plugins/`):`dsh-tools` 的 `mode`/`maxParallelSubCalls` 配置被 `z.never()` 拒绝,执行模式改由显式 `tool-executor-native` / `tool-executor-ptc` 行承载(base 已挂 native,PTC 侧需 preset 级覆盖);`dsh-agent-tool-presentation` 仍支持但已弃用。同期 preset 还有三处形状变化,官方 preset 逐行对齐面因此多了一个代际。
+- **组合跟随(探测门控)**:`probeHostExtras` 增加 `executorPlugin`(`@deepseek-ai/dsh-tool-executor-ptc` 可解析)与 `profileContext`(live 服务读取)。新宿主上:PTC 变体改挂 `tool-executor-ptc`,不再挂 `tool-presentation(mode: ptc)`;`tool-subagent-list-agents` 行删除(list_agents 已并入 `tool-subagent-control` 主行);subagent 配置键 `modelSelectionSettings` → `modelSelection` + `modelDiscovery`;plugin-manager / plugin-market 两行改由 `profileContext` 门控(官方 `!!js "!ctx.get('profileContext')"` 语义,三个变体一致)。旧宿主全部保持原行集不变——组合对齐的向后兼容纪律照旧。
+- **assemble 事件收窄**:0.2.2-alpha.2 的 `system-prompt/assemble` 只带 prompt presentation,不再带 `tools`(`PromptAssembly` 拆分,工具声明改由 provider 持有)。`applyToolRouting` 与 `runCodeHintFor` 因此改为:宿主给了工具列表就用宿主的,否则从 `ctx.get('tools').schemas(agent)` 读回——新老宿主都拿到真实工具面,方言路由与 run_code 提示句不受影响。
+- **promoted 文案精简**:测试钩子 `renderPromoted` 跟随官方简化——只留 `[still running after Nms; moved to background job id]`,跟随指引(读输出/停止)改由官方 `tool:jobs` 段落统一承载,不再重复。
+- **测试(337 项:336 pass + 1 skip)**:`probeHostExtras` 断言扩到新字段(含 live 服务读取与抛错降级);新增 alpha.2 组合形态测试(executor 行/无 list-agents 行/新 subagent 键/profile 门控/旧宿主不变);源码断言与新工具列表回退路径。
+
+## [0.43.3] — 2026-10-27
+
+### fix:工具面晚于 `agent/created` 落定时,bash 补位永久错过(真机复现;PR #36,致谢 @qiantao448-ux 首次贡献)
+
+- **症状**:冷启动后某个会话既没有 `bash`、又留着一个被拦截的 `pwsh`。插件日志里**没有**
+  `own bash tool activated`,但 `tools/pre-execute` 的拒绝句照旧生效——两层里只有调用层活着,
+  「注册 bash + 遮蔽 pwsh」那一次 `reconcile` 从没跑成。
+- **根因**:`reconcile` 只由 `agent/created`、挂载时的存量 sweep 和设置开关变化触发;面为空时
+  250ms×5 有界重试,**过期即终局**。桌面端启动要先挂 profile 级插件再挂预设行,这个窗口很容易
+  被跨过去,而宿主其实有 `tools/change` 事件——本插件没监听,也没有第二个落点。
+- **修法**:在 `tools/pre-execute` 里做一次**惰性再对账**——该 agent 还没有 bash scope 时重跑
+  决策。第一次工具调用是"面一定已落定"的最早时刻;`state.scope` 一旦存在即永久跳过,幂等,
+  且不监听 `tools/change`(不会自己触发自己)。
+- **真机验证**:Windows 桌面端(bash 5.3,`pwshTool` 关闭),重启后日志出现
+  `own bash tool ready (private Git Bash executor at C:/Program Files/Git/bin/bash.exe)` 与
+  `own bash tool activated for this agent`,`bash` 工具可用、`uname -s` 返回 `MINGW64_NT-*`。
+
+### fix:面里没有 pwsh 时撤掉自己注册的 bash(遮蔽型 preset 不再漏 shell)
+
+- 自有 bash 注册在 **agent 自有 scope**;宿主契约写明掩码只裁全局工具、**scope 注册保持可见**,
+  所以一旦注册成功,任何 preset 的 `restrict({ allow })` 都拿不回来。若在面还没落定时抢注,
+  纯聊天类 preset(只放行两个工具的白名单)会凭空多出一条命令通道。
+- 修法:`reconcile` 观测到的 `names` 是**解开自身 pwsh 掩码之后**的面,权威;只要它非空且不含
+  `pwsh`,就 dispose 自己那个 scope 并撤掉 ops shell 遮蔽,下一轮再按真实面决策。
+  `names.length > 0` 兜住"注册表读不到/读到空"的情形,避免把读取失败误判成"被掩码"。
+- 与上一条互为正反面:一条负责"该有时一定要有",一条负责"不该有时一定没有"。
+
+### 补充(维护者):回归测试锁定两处新行为
+
+- `tests/host-regressions.mjs` 新增两测试:①`inlineNeeds` 对 pwsh-less/空面的负例(撤回永不
+  重建的直接依据:`needsBash` 要求 `pwsh` 在场);②源码断言锁 lazy 再对账的守卫形状
+  (scope/pending 幂等 + try/catch 不破坏工具调用)与 stand-down 分支的位置与顺序
+  (条件 `names.length > 0 && !names.includes('pwsh') && state.scope`,scope 置空先于
+  `needsBash` 判断,dispose 真实发生并留日志)。全量 336 项 0 fail。
+
 ## [0.43.2] — 2026-10-23
 
 ### fix:被我们杀掉的 run 统一归 `code=-1`(Windows `taskkill /F` 退出码语义)

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.43.2",
+  "version": "0.44.0",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:自带 bash 工具(私有 Git Bash 执行器实例,官方 PowerShell 执行器原样保留),官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0 起;v0.39.0 起不再替换宿主执行器),四个 *·Git Bash 变体 preset 可开关;官方 pwsh 工具默认隐藏、开关可见(真 PowerShell);附带 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.43.2",
+  "version": "0.44.0",
   "description": "Windows 上给 agent 一个真正的 Git Bash 命令工具:私有 Git Bash 执行器实例(官方 PowerShell 执行器原样保留),统一 MSYS 盘根路径方言,官方 pwsh 工具默认隐藏可开关,物化四个内置预设的 Git Bash 变体,侧栏终端接管可开关。· Give agents a real Git Bash tool on Windows: a private Git Bash executor instance (the official PowerShell executor stays untouched), a unified MSYS drive-root path dialect, an opt-in official pwsh tool, and four Git Bash preset variants.",
   "type": "module",
   "repository": {

package/src/bash-render.js

@@ -119,7 +119,11 @@ export function renderResult(result, escalationModes = []) {
 
 /**
  * Shape a foreground call that stopped waiting into the text the model sees.
- * Mirrors the official `renderPromoted` (tool-bash render.ts:77).
+ * Mirrors the official `renderPromoted` (tool-bash render.ts:77) as of dsh
+ * 0.2.2-alpha.2: the marker alone — the follow-up guidance now lives in the
+ * shared `tool:jobs` system-prompt section, so the older "read newer output
+ * with job_output, stop it with job_kill" sentence would duplicate it
+ * (upstream simplified this in 0.2.2-alpha.2).
  * @param {{ jobId: string, timeoutMs: number, output: string, sandbox?: object }} promoted
  * @param {string[]} [escalationModes]
  * @returns {string}
@@ -128,9 +132,7 @@ export function renderPromoted(promoted, escalationModes = []) {
   const body = promoted.output.length > 0
     ? (promoted.output.endsWith('\n') ? promoted.output : `${promoted.output}\n`)
     : ''
-  const text = `${body}[still running after ${promoted.timeoutMs}ms; moved to background job ${promoted.jobId}]\n`
-    + 'The command keeps running in the background. You will be notified when it finishes; '
-    + 'read newer output with job_output, stop it with job_kill.'
+  const text = `${body}[still running after ${promoted.timeoutMs}ms; moved to background job ${promoted.jobId}]`
   const notes = sandboxNotes(promoted.sandbox, escalationModes)
   return notes.length > 0 ? `${text}\n${notes.join('\n')}` : text
 }

package/src/compositions.js

@@ -90,12 +90,19 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
   // toolFilter deny from the subagent/subagent_fork configs (official
   // reminders reach subagents again — the deny was never load-bearing,
   // nothing replaces it); alpha.4 added a tool-plugin-market row to every
-  // full preset. A preset row whose package is absent rejects the WHOLE
-  // mount, so these ride a host probe (index.js probeHostExtras, resolved
-  // from ctx.baseUrl — the base rows mount from); absent/older hosts keep
-  // the byte-identical 0.1.7 row set. The minimal variant carries its own
-  // 0.2.1-alpha.3 delta (tool-fs + compaction) behind the compaction flag.
-  const { timeContext = false, toolSchedule = false, pluginMarket = false, compaction = false } = hostExtras
+  // full preset. 0.2.2-alpha.2 then reworked the tool execution architecture
+  // (`executorPlugin`): the official executors moved into explicit
+  // tool-executor-native/-ptc rows, the subagent config renamed
+  // `modelSelectionSettings` to `modelSelection` + opt-in `modelDiscovery`,
+  // list-agents folded into the tool-subagent-control row itself (its
+  // separate row is gone), and the manager/market rows enable under a
+  // profile context instead of staying off outside cordis. A preset row whose
+  // package is absent rejects the WHOLE mount, so these ride a host probe
+  // (index.js probeHostExtras, resolved from ctx.baseUrl — the base rows
+  // mount from); absent/older hosts keep the byte-identical earlier row set.
+  // The minimal variant carries its own 0.2.1-alpha.3 delta (tool-fs +
+  // compaction) behind the compaction flag.
+  const { timeContext = false, toolSchedule = false, pluginMarket = false, compaction = false, executorPlugin = false, profileContext = false } = hostExtras
   const rows = [
     {
       id: 'persona',
@@ -168,11 +175,15 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
       isolate: { workflowEngine: true },
       config: [
         { id: 'tool-subagent-control', name: '@deepseek-ai/dsh-tool-subagent-control' },
-        { id: 'tool-subagent-list-agents', name: '@deepseek-ai/dsh-tool-subagent-control/list-agents' },
+        // 0.2.2-alpha.2 folded list_agents into the control row itself; the
+        // separate child row is gone, so alpha.2+ hosts must not mount it.
+        ...(executorPlugin ? [] : [{ id: 'tool-subagent-list-agents', name: '@deepseek-ai/dsh-tool-subagent-control/list-agents' }]),
         {
           id: 'tool-subagent',
           name: '@deepseek-ai/dsh-tool-subagent',
-          config: { provider: 'spawn', toolName: 'subagent', modelSelectionSettings: true, ...(timeContext ? {} : { backgroundMode: 'continuable' }) },
+          config: executorPlugin
+            ? { provider: 'spawn', toolName: 'subagent', modelSelection: true, modelDiscovery: true, ...(timeContext ? {} : { backgroundMode: 'continuable' }) }
+            : { provider: 'spawn', toolName: 'subagent', modelSelectionSettings: true, ...(timeContext ? {} : { backgroundMode: 'continuable' }) },
         },
         {
           id: 'tool-subagent-fork',
@@ -207,11 +218,13 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
     },
   ]
   if (kind === 'ptc') {
-    rows.push({
-      id: 'tool-presentation',
-      name: '@deepseek-ai/dsh-agent-tool-presentation',
-      config: { mode: 'ptc' },
-    })
+    // 0.2.2-alpha.2 replaced the deprecated presentation selector with the
+    // explicit PTC executor row (the base deployment keeps
+    // tool-executor-native; a scoped executor row overrides it for this
+    // agent). Older hosts keep the presentation row they ship.
+    rows.push(executorPlugin
+      ? { id: 'tool-executor-ptc', name: '@deepseek-ai/dsh-tool-executor-ptc' }
+      : { id: 'tool-presentation', name: '@deepseek-ai/dsh-agent-tool-presentation', config: { mode: 'ptc' } })
   }
   if (kind === 'cordis') {
     rows.push({ id: 'tool-cordis', name: '@deepseek-ai/dsh-tool-cordis' })
@@ -224,16 +237,20 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
   rows.push({
     id: 'tool-plugin-manager',
     name: '@deepseek-ai/dsh-plugin-manager/tools',
-    // The official 0.1.7 rows: ptc/standard ship it disabled, cordis keeps it
-    // on wherever a profile context exists (every web deployment does).
-    ...off(kind !== 'cordis'),
+    // The official rows: before 0.2.2-alpha.2 ptc/standard ship it disabled and
+    // cordis keeps it on (every web deployment has a profile context). From
+    // 0.2.2-alpha.2 on every preset enables it exactly when a profile context
+    // exists, so the probe decides for all three variants.
+    ...(executorPlugin ? off(!profileContext) : off(kind !== 'cordis')),
   })
   if (pluginMarket) {
     rows.push({
-      // The official 0.2.1-alpha.4 rows: same disabled split as the manager.
+      // The official 0.2.1-alpha.4 rows, following the manager's split on
+      // both architectures (alpha.4: disabled on standard/ptc, profile-gated
+      // on cordis; alpha.2 of 0.2.2: profile-gated everywhere).
       id: 'tool-plugin-market',
       name: '@deepseek-ai/dsh-plugin-market/tools',
-      ...off(kind !== 'cordis'),
+      ...(executorPlugin ? off(!profileContext) : off(kind !== 'cordis')),
     })
   }
   return rows

package/src/index.js

@@ -1791,22 +1791,32 @@ function cleanupLegacyTrees(presetIds) {
 }
 
 /**
- * Probe the dsh 0.2.1 host additions for the variant compositions: every
- * full-tool official preset gained a `time-context` row (durable clock
- * readings) and a `tool-schedule` row (the reminder tools). A preset row whose
- * package is absent rejects the WHOLE mount, so the rows ride this probe: each
- * is added only when its package resolves from the HOST's module base —
- * `ctx.baseUrl`, the exact base `prepareProfileEntries` mounts preset rows
- * from, so the probe can never disagree with the mounter. On dsh <= 0.2.0 all
- * stay false and the row set stays byte-identical to the 0.1.7 mirror. Probed
- * once per boot; the profile's package set does not change under a running
- * host. `compaction` is the one flag minimal consumes (the official
- * 0.2.1-alpha.3 minimal rows); the rest only shape the full variants.
+ * Probe the dsh host additions for the variant compositions.
+ *
+ * `timeContext` / `toolSchedule` / `pluginMarket` / `compaction` are the
+ * 0.2.1 rows (durable clock readings, reminder tools, the plugin market row,
+ * the minimal tool-fs + compaction delta). `executorPlugin` marks the
+ * 0.2.2-alpha.2 tool-execution architecture: the packages tool-executor-native
+ * and tool-executor-ptc exist, the official presets mount the latter for PTC,
+ * the subagent config renamed `modelSelectionSettings` to
+ * `modelSelection` + `modelDiscovery`, and list-agents folded into the control
+ * row. `profileContext` is the host fact the manager/market rows gate on since
+ * alpha.2 (`!!js "!ctx.get('profileContext')"`) — computed from the live
+ * service, not the package set.
+ *
+ * A preset row whose package is absent rejects the WHOLE mount, so every row
+ * rides this probe: each is added only when its package resolves from the
+ * HOST's module base — `ctx.baseUrl`, the exact base `prepareProfileEntries`
+ * mounts preset rows from, so the probe can never disagree with the mounter.
+ * On older hosts all stay false and the row set stays byte-identical to the
+ * earlier mirror. Probed once per boot; the profile's package set does not
+ * change under a running host.
  * @param {object} ctx - cordis context (any fiber of the running host).
  * @param {Function} [resolve] - predicate override for tests; receives a
  *   package specifier, resolves like `require.resolve`, returns boolean.
  * @returns {Promise<{timeContext: boolean, toolSchedule: boolean,
- *   pluginMarket: boolean, compaction: boolean}>}
+ *   pluginMarket: boolean, compaction: boolean, executorPlugin: boolean,
+ *   profileContext: boolean}>}
  */
 export async function probeHostExtras(ctx, resolve) {
   let ok = resolve
@@ -1821,13 +1831,20 @@ export async function probeHostExtras(ctx, resolve) {
       ok = () => false
     }
   }
-  const [timeContext, toolSchedule, pluginMarket, compaction] = await Promise.all([
+  const [timeContext, toolSchedule, pluginMarket, compaction, executorPlugin] = await Promise.all([
     Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-time-context')).then(Boolean),
     Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-tool-schedule')).then(Boolean),
     Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-plugin-market/tools')).then(Boolean),
     Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-compaction-basic')).then(Boolean),
+    Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-tool-executor-ptc')).then(Boolean),
   ])
-  return { timeContext, toolSchedule, pluginMarket, compaction }
+  let profileContext = false
+  try {
+    profileContext = ctx?.get?.('profileContext') !== undefined
+  } catch {
+    profileContext = false
+  }
+  return { timeContext, toolSchedule, pluginMarket, compaction, executorPlugin, profileContext }
 }
 
 /** Run one probe predicate; ANY failure reads as "absent" (a throwing
@@ -2274,12 +2291,25 @@ export async function apply(ctx, config = {}) {
              no run_code hint — so they meet the shell they were composed for. */
           const dialect = liveSettings.dialect()
           const applies = dialectApplies(dialect, assembleContext && assembleContext.agent)
+          // dsh 0.2.2-alpha.2 narrowed this event to prompt PRESENTATION: it no
+          // longer carries `tools` ("tool declarations remain provider-owned"),
+          // so read the same list back from the tools service; older hosts keep
+          // handing it over on the assembly.
+          const offeredTools = Array.isArray(assembly && assembly.tools)
+            ? assembly.tools
+            : (() => {
+                try {
+                  return ctx.get('tools')?.schemas?.(assembleContext && assembleContext.agent) ?? []
+                } catch {
+                  return []
+                }
+              })()
           // Routing is dialect-independent and follows actual offered tools.
           // PTC may expose only run_code here: its generic SDK decision rule
           // relies on the registered bindings' own descriptions, not guessed
           // hidden names. Replace our block on reassembly/visibility changes.
           if (assembly && typeof assembly === 'object') {
-            applyToolRouting(assembly.tools, {
+            applyToolRouting(offeredTools, {
               pwshVisible: liveSettings.pwshTool() === true,
               msys: applies && dialect.posixPaths === true,
               terminalGitBash: terminalDialect.gitBash === true,
@@ -2302,7 +2332,7 @@ export async function apply(ctx, config = {}) {
             // v0.20.1: the run_code sentence rides the SAME context entry, but
             // only when this assembly actually offers the tool (see
             // runCodeHintFor) — every other mode stays quiet.
-            const hint = runCodeHintFor(assembly.tools, dialect.codePaths === true)
+            const hint = runCodeHintFor(offeredTools, dialect.codePaths === true)
             if (hint !== '') {
               for (const assembled of Array.isArray(assembly.contexts) ? assembly.contexts : []) {
                 if (assembled && assembled.name === 'gitbash-shell:posix-paths' && typeof assembled.text === 'string') {

package/src/inline-tools.js

@@ -502,6 +502,21 @@ export function mountInlineTools(ctx, deps) {
         }
       }
     }
+    // A face WITHOUT pwsh is not the official win32 composition: something
+    // masked the host tool away, and the only such mask in the wild is a
+    // preset gate (`tools.restrict({ allow })`, e.g. the pure-chat preset).
+    // Our bash lives in an AGENT-OWNED scope, and scoped registrations stay
+    // visible through masks by contract — so a registration made while the
+    // face was still settling would leak a shell into that preset for the
+    // rest of the agent's life. `names` above is the PRE-MASK observation
+    // (our own deny was lifted first), so it is authoritative: stand down.
+    if (names.length > 0 && !names.includes('pwsh') && state.scope) {
+      const withdrawn = state.scope
+      state.scope = undefined
+      if (state.denyOpsShell) { state.denyOpsShell(); state.denyOpsShell = undefined }
+      void Promise.resolve(withdrawn.dispose()).catch((error) => log(`own bash withdrawal failed: ${error?.message ?? error}`))
+      log('own bash tool withdrawn for this agent (the tool face carries no pwsh: a preset mask owns the tool set)')
+    }
     if (needs.needsBash && !state.scope) {
       startBash(agent, state)
     }
@@ -576,6 +591,19 @@ export function mountInlineTools(ctx, deps) {
     // ON the REAL tool answers for itself.
     ctx.on('tools/pre-execute', (exec, next) => {
       try {
+        // THE FACE CAN SETTLE AFTER `agent/created` (Unreleased). Preset rows
+        // and plugin tools keep registering while the Loader walks the tree,
+        // so on a slow boot the bounded retry above can burn through its five
+        // 250ms attempts on an empty face and be FINAL: the agent then never
+        // gets its bash and keeps a visible (but denied) pwsh. The first tool
+        // call is the first moment the face is guaranteed to be settled, so
+        // re-run the decision there while this agent still owns no bash scope.
+        // Idempotent: once the scope exists this branch never fires again.
+        const lazyAgent = exec?.agent
+        const lazyState = lazyAgent ? tracked.get(lazyAgent) : undefined
+        if (lazyState && !lazyState.scope && !lazyState.pending) {
+          try { reconcile(lazyAgent) } catch (error) { log(`lazy re-reconcile failed: ${error?.message ?? error}`) }
+        }
         if (exec?.name === 'pwsh' && !opsSeen && deps.pwshEnabled?.() !== true) {
           return { kind: 'deny', reason: hiddenPwshDenyReason() }
         }