dsh-godot-dev-shell 2.1.0

package/README.md

@@ -0,0 +1,30 @@
+# dsh-godot-dev-shell
+
+DSH Profile Bundle（项目无关的最小工具集 + 配置面板）。
+
+设计原则：**插件与项目无关，不绑定任何代码/对象；只提供最小工具并保证鲁棒性。** 命令清单、退出码语义、规则模板全部由各工作区自己声明。
+
+- **`ps_script`** — PowerShell 脚本落临时文件执行（pwsh 7 优先，5.1 兜底；UTF-8 BOM + 编码前导），消除多层转义、命令行长度限制、执行策略拦截与中文编码问题；stdout/stderr 分离 + 精确退出码；拒绝 NUL 与超大脚本；受沙箱约束并支持 `sandbox_permissions` 升级。
+- **`run_command`** — 运行当前工作区在 `.dsh/godot-dev-shell.json` 的 `commands` 里声明的固化命令；`.ps1` 走 pwsh 7 `-File`，`.bat/.cmd/.exe` 走调用运算符，其余扩展名明确报错；未声明/文件缺失/旧版配置均给清晰错误。
+- **`add_command`** — 向工作区注册/更新命令（安全写入配置：名字/路径/扩展名校验、存在性预检、JSON 合并保留其他命令）；工作流：写脚本 → `add_command` 注册 → 更新规则 md → `run_command` 验证。
+- **设置面板** — 设置 → Plugins → godot-dev-shell 页签：工作区选择（活跃优先）、项目命令表（存在性/超时/描述）、项目规则 md、模板、配置原文。
+
+## 项目级声明（跟项目走）
+
+在工作区放：
+
+- `.dsh/godot-dev-shell.json` — 命令清单：
+  ```json
+  {
+    "commands": {
+      "check":  { "file": ".dsh/scripts/gd_check.ps1", "description": "编译检查（0=通过 1=有错误 2=不可信）", "timeoutMs": 120000 },
+      "luban":  { "file": "Tools/gen.bat", "workdir": "Tools", "description": "生成配置表" }
+    }
+  }
+  ```
+  `file` 相对工作区根或绝对路径；`workdir`/`timeoutMs`/`description` 可选。没有此文件：`ps_script` 完整可用，`run_command` 会报"未声明命令"。
+- `.dsh/godot-dev-shell.md` — 项目规则/模板索引（AI 开工前先读）；GDScript 模板放 `.dsh/templates/`。
+
+## 安装/更新（本机）
+
+源码在 `~/.dsh/packages/dsh-godot-dev-shell`。改动后重拷到 `profiles/<p>/node_modules/dsh-godot-dev-shell`（或跑 `dsh plugin --profile <p> install`），重启 Profile 生效。

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# dsh-godot-dev-shell bundle patch: registers the host plugin for every
+# session on this profile. The row name must match the npm package name
+# and the host half's exported `name`.
+- insert:
+    - id: godot-dev-shell
+      name: 'dsh-godot-dev-shell'

package/lib/client.js

@@ -0,0 +1,162 @@
+// dsh-godot-dev-shell client bundle (ModuleLoader format).
+// Settings → Plugins → godot-dev-shell 页签：当前工作区的配置面板。
+// 数据来自 host 的 GET /api/godot-dev-shell/panel?workspace=<path>。
+
+window.__ModuleLoader__.load({ id: 'dsh-godot-dev-shell', factory: (require) => {
+  var module = { exports: {} }
+  var exports = module.exports
+  var React = require('react')
+
+  var LS_KEY = 'godot-dev-shell:workspace'
+
+  function loadPanel(selected) {
+    var url = '/api/godot-dev-shell/panel'
+    if (selected) url += '?workspace=' + encodeURIComponent(selected)
+    return fetch(url).then(function (res) {
+      if (!res.ok) throw new Error('HTTP ' + res.status)
+      return res.json()
+    })
+  }
+
+  function rememberedWorkspace() {
+    try { return window.localStorage.getItem(LS_KEY) || '' } catch (e) { return '' }
+  }
+
+  function rememberWorkspace(path) {
+    try { window.localStorage.setItem(LS_KEY, path) } catch (e) { /* ignore */ }
+  }
+
+  function Section(props) {
+    return React.createElement('div', { style: { border: '1px solid var(--dsh-border, rgba(128,128,128,0.35))', borderRadius: '8px', padding: '12px 14px', marginBottom: '12px' } }, props.children)
+  }
+
+  function Pre(props) {
+    return React.createElement('pre', { style: { margin: '0', whiteSpace: 'pre-wrap', wordBreak: 'break-word', fontFamily: 'ui-monospace, Consolas, monospace', fontSize: '12px', lineHeight: '1.5', maxHeight: props.maxH || '320px', overflow: 'auto' } }, props.children)
+  }
+
+  function Row(props) {
+    return React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: '8px', marginBottom: '8px', flexWrap: 'wrap' } }, props.children)
+  }
+
+  function Badge(props) {
+    var ok = props.ok === true
+    return React.createElement('span', { style: { display: 'inline-block', padding: '1px 8px', borderRadius: '10px', fontSize: '11px', border: '1px solid ' + (ok ? 'rgba(70,160,90,0.7)' : 'rgba(190,80,80,0.7)'), color: ok ? 'rgba(70,160,90,1)' : 'rgba(190,80,80,1)' } }, props.children)
+  }
+
+  function Panel() {
+    var state = React.useState({ loading: true, error: null, data: null })
+    var setState = state[1]
+    state = state[0]
+    var sel = React.useState(rememberedWorkspace())
+    var selected = sel[0]
+    var setSelected = sel[1]
+    var tick = React.useState(0)
+    var refresh = function () { tick[1](tick[0] + 1) }
+    var tpl = React.useState(null)
+    var openTpl = tpl[0]
+    var setOpenTpl = tpl[1]
+
+    React.useEffect(function () {
+      var alive = true
+      setState({ loading: true, error: null, data: null })
+      loadPanel(selected).then(function (data) {
+        if (alive) setState({ loading: false, error: null, data: data })
+      }, function (e) {
+        if (alive) setState({ loading: false, error: String(e && e.message ? e.message : e), data: null })
+      })
+      return function () { alive = false }
+    }, [selected, tick[0]])
+
+    var box = { padding: '4px 2px', fontSize: '13px', color: 'inherit' }
+    var h2 = { margin: '0 0 10px 0', fontSize: '14px', fontWeight: 600 }
+    var h3 = { margin: '0 0 8px 0', fontSize: '12px', fontWeight: 600, opacity: 0.75 }
+    var btn = { padding: '3px 12px', fontSize: '12px', borderRadius: '6px', border: '1px solid var(--dsh-border, rgba(128,128,128,0.45))', background: 'transparent', color: 'inherit', cursor: 'pointer' }
+
+    if (state.loading && state.data === null) {
+      return React.createElement('div', { style: box }, '加载中…')
+    }
+    if (state.error !== null) {
+      return React.createElement('div', { style: box },
+        React.createElement('div', { style: { color: 'rgba(190,80,80,1)', marginBottom: '8px' } }, '加载失败: ' + state.error),
+        React.createElement('button', { style: btn, onClick: refresh }, '重试'))
+    }
+    var d = state.data || {}
+    var current = selected !== '' ? selected : (typeof d.workspace === 'string' ? d.workspace : '')
+
+    var cmdRows = (d.commands || []).map(function (c) {
+      return React.createElement('tr', { key: c.name },
+        React.createElement('td', { style: { padding: '3px 10px 3px 0', verticalAlign: 'top' } },
+          c.name,
+          c.description ? React.createElement('div', { style: { fontSize: '11px', opacity: 0.65, fontWeight: 400 } }, c.description) : null),
+        React.createElement('td', { style: { padding: '3px 10px 3px 0', fontFamily: 'ui-monospace, Consolas, monospace', fontSize: '12px', verticalAlign: 'top' } }, c.file),
+        React.createElement('td', { style: { padding: '3px 10px 3px 0', verticalAlign: 'top' } }, c.timeoutMs === null ? '默认' : (c.timeoutMs / 1000 + 's')),
+        React.createElement('td', { style: { padding: '3px 0', verticalAlign: 'top' } }, React.createElement(Badge, { ok: c.exists }, c.exists ? '存在' : '缺失')))
+    })
+
+    var tplItems = (d.templates || []).map(function (t) {
+      var open = openTpl === t.name
+      return React.createElement('div', { key: t.name, style: { marginBottom: '6px' } },
+        React.createElement('button', { style: btn, onClick: function () { setOpenTpl(open ? null : t.name) } }, (open ? '▾ ' : '▸ ') + t.name),
+        open ? React.createElement('div', { style: { marginTop: '6px' } }, React.createElement(Pre, null, t.content)) : null)
+    })
+
+    return React.createElement('div', { style: box },
+      React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: '10px', marginBottom: '12px' } },
+        React.createElement('h2', { style: h2 }, 'godot-dev-shell · 工作区配置'),
+        React.createElement('span', { style: { flex: 1 } }),
+        React.createElement('button', { style: btn, onClick: refresh }, '刷新')),
+      React.createElement(Section, null,
+        React.createElement(Row, null,
+          React.createElement('span', { style: h3 }, '工作区'),
+          React.createElement('select', {
+            value: current,
+            onChange: function (e) { setSelected(e.target.value); rememberWorkspace(e.target.value) },
+            style: { padding: '3px 8px', borderRadius: '6px', border: '1px solid var(--dsh-border, rgba(128,128,128,0.45))', background: 'transparent', color: 'inherit', fontSize: '12px' }
+          }, (d.workspaces || []).map(function (w) {
+            return React.createElement('option', { key: w.id || w.path, value: w.path }, (w.title || w.path) + (w.path ? ' — ' + w.path : '') + (w.live === true ? ' （活跃）' : ''))
+          }))),
+        React.createElement(Row, null,
+          React.createElement('span', { style: h3 }, 'Shell 执行器'),
+          React.createElement('code', { style: { fontFamily: 'ui-monospace, Consolas, monospace', fontSize: '12px' } }, String(d.pwshRunner || '?')))),
+      React.createElement(Section, null,
+        React.createElement('h3', { style: h3 }, '项目命令 (.dsh/godot-dev-shell.json 的 commands)'),
+        d.legacy === true
+          ? React.createElement('div', { style: { color: 'rgba(200,140,60,1)', marginBottom: '6px', fontSize: '12px' } }, '配置仍是旧版 modes/verifyDir 结构——请迁移到 commands（每条命令: file/description/workdir/timeoutMs）')
+          : null,
+        cmdRows.length > 0
+          ? React.createElement('table', { style: { borderCollapse: 'collapse', fontSize: '12px' } },
+              React.createElement('tbody', null, cmdRows))
+          : React.createElement('span', { style: { opacity: 0.7 } }, '（未配置——在工作区 .dsh/godot-dev-shell.json 的 commands 里声明，run_command 即可执行）')),
+      React.createElement(Section, null,
+        React.createElement('h3', { style: h3 }, '项目规则 (.dsh/godot-dev-shell.md)'),
+        d.rulesMd
+          ? React.createElement(Pre, { maxH: '420px' }, d.rulesMd)
+          : React.createElement('span', { style: { opacity: 0.7 } }, '（未创建——放一个即可让 AI 开工前自动读到项目规则/模板索引）')),
+      React.createElement(Section, null,
+        React.createElement('h3', { style: h3 }, 'GDScript 模板 (.dsh/templates/)'),
+        tplItems.length > 0 ? tplItems : React.createElement('span', { style: { opacity: 0.7 } }, '（无模板文件）')),
+      React.createElement(Section, null,
+        React.createElement('h3', { style: h3 }, '机器配置 (.dsh/godot-dev-shell.json)'),
+        d.configError
+          ? React.createElement('div', { style: { color: 'rgba(190,80,80,1)', marginBottom: '6px' } }, 'JSON 解析失败: ' + d.configError)
+          : null,
+        d.configRaw
+          ? React.createElement(Pre, null, d.configRaw)
+          : React.createElement('span', { style: { opacity: 0.7 } }, '（未创建——ps_script 可用；run_command 需要至少一条 commands 声明）')))
+  }
+
+  function apply(ctx) {
+    ctx.slots.inject('settings.plugins.tab', function () {
+      return ctx.slots.register(
+        { name: 'settings.plugins.tab', id: 'godot-dev-shell', order: 100, label: 'godot-dev-shell' },
+        function () { return React.createElement(Panel) }
+      )
+    })
+  }
+
+  exports.apply = apply
+  exports.inject = ['slots']
+  return module.exports
+} })
+
+// [end of dsh-godot-dev-shell client bundle]

package/lib/index.js

@@ -0,0 +1,712 @@
+// dsh-godot-dev-shell host half.
+//
+// Minimal, project-neutral tools for every session on this profile:
+//   ps_script    — execute a PowerShell script via a UTF-8(BOM) temp file
+//                  (`pwsh 7 -NoProfile -ExecutionPolicy Bypass -File`), killing
+//                  the multi-layer escaping / argv-limit / execution-policy /
+//                  encoding problems at the architecture level.
+//   run_command  — run a fixed command declared by the current workspace in
+//                  .dsh/godot-dev-shell.json (`commands` map). Zero built-in
+//                  project semantics: names, scripts, exit-code meanings, and
+//                  rules all travel with each workspace.
+//
+// Plus the config-panel HTTP API consumed by the client half
+// (Settings → Plugins → godot-dev-shell): GET /api/godot-dev-shell/panel.
+//
+// Machine-level facts (pwsh 7 discovery, sandbox escalation) live here.
+// Project-level facts travel with each workspace instead:
+//   <workspace>/.dsh/godot-dev-shell.json  — commands: { name: { file, description?, workdir?, timeoutMs? } }
+//   <workspace>/.dsh/godot-dev-shell.md    — project rules / template index for the AI
+
+import { lstatSync } from 'node:fs'
+import { readFile, readdir, stat } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { URL } from 'node:url'
+
+/** Cordis plugin name — must match the row name in cordis.patch.yml. */
+export const name = 'dsh-godot-dev-shell'
+
+/** Hard dependencies: tool registry, shell executor, filesystem provider. */
+export const inject = ['tools', 'shell', 'fs']
+
+const DEFAULT_SCRIPT_TIMEOUT = 180000
+const DEFAULT_COMMAND_TIMEOUT = 120000
+const MAX_SCRIPT_CHARS = 2 * 1024 * 1024
+const ESCALATION_TARGETS = ['workspace-write', 'danger-full-access']
+const WIDER_MODES = {
+  'read-only': ['workspace-write', 'danger-full-access'],
+  'workspace-write': ['danger-full-access'],
+}
+const PROLOGUE = '[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)'
+// NOTE: ps_script 的 execute 里临时脚本内容开头拼了一个字面 U+FEFF BOM 字符(单引号里那个不可见字符),
+// 让 Windows PowerShell 5.1 把文件按 UTF-8 解析;编辑那一行时不要弄丢它。
+
+// ───────────────────────── shared helpers ─────────────────────────
+
+function renderStream(stream) {
+  if (stream === undefined || stream === null) return ''
+  if (!stream.truncated) return stream.text
+  return stream.text + '\n[output truncated; full output: ' + (stream.spillPath === undefined ? '(unavailable)' : stream.spillPath) + ']'
+}
+
+function renderResult(value) {
+  let body = renderStream(value.stdout)
+  const err = renderStream(value.stderr)
+  if (err.length > 0) {
+    if (body.length > 0 && !body.endsWith('\n')) body += '\n'
+    body += '[stderr]\n' + err
+  }
+  if (body.length === 0) body = '(no output)'
+  const markers = []
+  if (value.sandbox !== undefined) {
+    if (value.sandbox.runnerFailed === true) markers.push('[sandbox: the sandbox runner itself failed under ' + value.sandbox.mode + ' mode — the command did not run; this is a sandbox problem, not a command failure]')
+    else if (value.sandbox.denied === true) markers.push('[sandbox: file access denied under ' + value.sandbox.mode + ' mode]')
+    else if (value.sandbox.mode !== 'danger-full-access') {
+      const et = value.stderr === undefined ? '' : value.stderr.text
+      if (et.indexOf('failed to run') >= 0 || et.indexOf('The operation was canceled') >= 0) {
+        markers.push('[sandbox: native output capture is pipe-blocked under confined modes — retry this exact call once with sandbox_permissions="danger-full-access" + justification]')
+      }
+    }
+  }
+  if (value.timedOut === true) markers.push('[timed out after ' + value.timeoutMs + 'ms]')
+  if (value.signal !== null && value.signal !== undefined) markers.push('[killed by signal: ' + value.signal + ']')
+  else if (value.exitCode !== 0) markers.push('[exit code: ' + value.exitCode + ']')
+  if (markers.length === 0) return body
+  if (!body.endsWith('\n')) body += '\n'
+  return body + markers.join('\n')
+}
+
+function canonicalResult(result) {
+  const stream = (s) => ({ text: s.text, truncated: s.truncated, ...(s.spillPath !== undefined ? { spillPath: s.spillPath } : {}) })
+  const out = {
+    exitCode: result.exitCode,
+    signal: result.signal,
+    timedOut: result.timedOut,
+    aborted: result.aborted,
+    timeoutMs: result.timeoutMs,
+    stdout: stream(result.stdout),
+    stderr: stream(result.stderr),
+  }
+  if (result.sandbox !== undefined) {
+    out.sandbox = {
+      mode: result.sandbox.mode,
+      denied: result.sandbox.denied,
+      ...(result.sandbox.enforcement !== undefined ? { enforcement: result.sandbox.enforcement } : {}),
+      ...(result.sandbox.runnerFailed !== undefined ? { runnerFailed: result.sandbox.runnerFailed } : {}),
+    }
+  }
+  return out
+}
+
+function errText(e) {
+  if (e !== undefined && e !== null && typeof e.message === 'string') return e.message
+  return String(e)
+}
+
+function validateEscalationArgs(sandboxPermissions, justification) {
+  if (sandboxPermissions !== undefined && justification === undefined) throw new Error('invalid escalation: sandbox_permissions requires a justification')
+  if (justification !== undefined && sandboxPermissions === undefined) throw new Error('invalid escalation: justification is only valid together with sandbox_permissions')
+  if (justification !== undefined && justification.trim().length === 0) throw new Error('invalid justification: expected a non-empty sentence')
+}
+
+function writeJson(res, status, body) {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' })
+  res.end(payload)
+}
+
+// ───────────────────── machine-level pwsh discovery ─────────────────────
+
+let cachedRunner = null
+
+function pwshCandidates() {
+  const out = []
+  const programFiles = process.env.ProgramFiles ?? 'C:\\Program Files'
+  out.push(join(programFiles, 'PowerShell', '7', 'pwsh.exe'))
+  for (const entry of String(process.env.PATH ?? '').split(';')) {
+    const trimmed = entry.trim().replace(/^"|"$/g, '')
+    if (trimmed.length > 0) out.push(join(trimmed, 'pwsh.exe'))
+  }
+  out.push(join(homedir(), 'AppData', 'Local', 'Microsoft', 'WindowsApps', 'pwsh.exe'))
+  return out
+}
+
+/** Preferred shell runner as a PS call-operator operand (`'C:\...\pwsh.exe'` or `powershell`). */
+function shellRunnerQuoted() {
+  if (cachedRunner !== null) return cachedRunner
+  for (const candidate of pwshCandidates()) {
+    if (candidate.indexOf("'") >= 0) continue
+    try {
+      const st = lstatSync(candidate)
+      if (st.isFile() || st.isSymbolicLink()) {
+        cachedRunner = "'" + candidate + "'"
+        return cachedRunner
+      }
+    } catch { /* try next candidate */ }
+  }
+  cachedRunner = 'powershell'
+  return cachedRunner
+}
+
+// ───────────────────── registry-ready JSON schemas ─────────────────────
+
+const OUTPUT_SCHEMA = {
+  type: 'object',
+  additionalProperties: false,
+  required: ['exitCode', 'signal', 'timedOut', 'aborted', 'timeoutMs', 'stdout', 'stderr'],
+  properties: {
+    exitCode: { oneOf: [{ type: 'integer' }, { type: 'null' }] },
+    signal: { oneOf: [{ type: 'string' }, { type: 'null' }] },
+    timedOut: { type: 'boolean' },
+    aborted: { type: 'boolean' },
+    timeoutMs: { type: 'number' },
+    stdout: {
+      type: 'object',
+      additionalProperties: false,
+      required: ['text', 'truncated'],
+      properties: {
+        text: { type: 'string' },
+        truncated: { type: 'boolean' },
+        spillPath: { type: 'string' },
+      },
+    },
+    stderr: {
+      type: 'object',
+      additionalProperties: false,
+      required: ['text', 'truncated'],
+      properties: {
+        text: { type: 'string' },
+        truncated: { type: 'boolean' },
+        spillPath: { type: 'string' },
+      },
+    },
+    sandbox: {
+      type: 'object',
+      additionalProperties: false,
+      required: ['mode', 'denied'],
+      properties: {
+        mode: { type: 'string' },
+        denied: { type: 'boolean' },
+        enforcement: { type: 'string' },
+        runnerFailed: { type: 'boolean' },
+      },
+    },
+  },
+}
+
+const ESCAL_PERMISSION_PARAM = {
+  type: 'string',
+  enum: ESCALATION_TARGETS,
+  description: '更宽的沙箱模式。仅在本调用刚因沙箱受限失败(如文件写入被拒、原生输出捕获管道被拦截)时作为一次性重试使用;需要 justification 并由用户审批。',
+}
+const JUSTIFICATION_PARAM = {
+  type: 'string',
+  description: '配合 sandbox_permissions 必填:一句话向用户说明为何这次调用需要更宽权限。',
+}
+
+const PS_SCRIPT_PARAMS = {
+  type: 'object',
+  properties: {
+    script: { type: 'string', description: '完整 PowerShell 脚本源码。原样写入临时文件执行,无需任何转义;多行直接写,换行就是换行。' },
+    description: { type: 'string', description: '5-10 个词的简短主动语态描述(显示在 UI),例如 "Run compile check"。' },
+    workdir: { type: 'string', description: '工作目录。绝对路径直接用;相对路径按会话工作区根解析。默认为会话工作区根。' },
+    timeoutMs: { type: 'number', description: '超时毫秒数,默认 180000;超时会终止整棵进程树并在结果中标记 [timed out ...]。' },
+    sandbox_permissions: ESCAL_PERMISSION_PARAM,
+    justification: JUSTIFICATION_PARAM,
+  },
+  required: ['script', 'description'],
+}
+
+const RUN_COMMAND_PARAMS = {
+  type: 'object',
+  properties: {
+    name: { type: 'string', description: '要运行的命令名(必须是项目 .dsh/godot-dev-shell.json 的 commands 里声明过的名字)。' },
+    description: { type: 'string', description: '5-10 个词的简短主动语态描述(显示在 UI),例如 "Run compile check"。' },
+    timeoutMs: { type: 'number', description: '超时毫秒数,覆盖命令声明的 timeoutMs;缺省用声明值或默认 120000。' },
+    sandbox_permissions: ESCAL_PERMISSION_PARAM,
+    justification: JUSTIFICATION_PARAM,
+  },
+  required: ['name', 'description'],
+}
+
+// ─────────────────────────────── plugin ───────────────────────────────
+
+export function apply(ctx) {
+  const sandboxPolicy = ctx.get('sandboxPolicy')
+  const shellEnv = ctx.get('shellEnv')
+  const approval = ctx.get('approval')
+  let seq = 0
+
+  function workspaceRoot(exec) {
+    try {
+      if (exec !== undefined && exec !== null && exec.agent !== undefined) {
+        const cwd = exec.agent.session.header.cwd
+        if (typeof cwd === 'string' && cwd.length > 1 && cwd.indexOf("'") < 0) return cwd
+      }
+    } catch { /* fall through */ }
+    try {
+      if (sandboxPolicy !== undefined && typeof sandboxPolicy.workspaceRoot === 'string' && sandboxPolicy.workspaceRoot.length > 1 && sandboxPolicy.workspaceRoot.indexOf("'") < 0) {
+        return sandboxPolicy.workspaceRoot
+      }
+    } catch { /* fall through */ }
+    return process.cwd()
+  }
+
+  function resolveWorkdir(modelWorkdir, exec) {
+    const root = workspaceRoot(exec).replace(/[\\/]+$/, '')
+    if (modelWorkdir === undefined) return root
+    let w = String(modelWorkdir)
+    if (!/^[A-Za-z]:[\\/]/.test(w) && !/^\\\\/.test(w)) w = root + '\\' + w.replace(/^[\\/]+/, '')
+    return w
+  }
+
+  function resolveStanding(exec) {
+    if (sandboxPolicy === undefined) return undefined
+    try {
+      return sandboxPolicy.resolve(exec.agent === undefined ? {} : { session: exec.agent.session })
+    } catch {
+      return undefined
+    }
+  }
+
+  async function approveEscalation(toolName, mode, justification, exec, standing) {
+    const effectiveMode = standing !== undefined ? standing.mode : 'read-only'
+    const wider = WIDER_MODES[effectiveMode] || []
+    if (wider.indexOf(mode) < 0) throw new Error('sandbox escalation to "' + mode + '" is not strictly wider than this call\'s current "' + effectiveMode + '" mode')
+    if (approval === undefined) throw new Error('sandbox escalation to "' + mode + '" requires approval, but no approval service is composed')
+    if (exec.agent === undefined) throw new Error('sandbox escalation to "' + mode + '" requires approval, but the call has no agent to route it through')
+    const outcome = await approval.request({
+      agent: exec.agent,
+      toolName: toolName,
+      callId: exec.callId,
+      reason: 'escalate sandbox to ' + mode + ': ' + justification,
+      signal: exec.signal,
+    })
+    if (outcome === 'allowed-once') return mode
+    if (outcome === 'rejected') throw new Error('the user rejected escalating this call to "' + mode + '"')
+    if (outcome === 'cancelled') throw new Error('approval for escalating to "' + mode + '" was cancelled')
+    throw new Error('sandbox escalation to "' + mode + '" requires approval, but no approval channel is available')
+  }
+
+  async function resolveCallPolicy(toolName, args, exec) {
+    const standing = resolveStanding(exec)
+    validateEscalationArgs(args.sandbox_permissions, args.justification)
+    if (args.sandbox_permissions === undefined) return standing
+    if (sandboxPolicy === undefined) throw new Error('sandbox_permissions is not available in this composition (no sandbox policy service)')
+    const granted = await approveEscalation(toolName, args.sandbox_permissions, args.justification, exec, standing)
+    return standing === undefined ? { mode: granted, workspaceRoot: workspaceRoot(exec) } : { ...standing, mode: granted }
+  }
+
+  async function runShell(command, workdir, timeoutMs, exec, policy) {
+    const request = { command: command, timeoutMs: timeoutMs, signal: exec.signal }
+    if (workdir !== undefined) request.workdir = workdir
+    if (shellEnv !== undefined) {
+      try { request.dshEnv = shellEnv.collect(exec) } catch { /* optional managed env */ }
+    }
+    if (policy !== undefined) request.sandboxPolicy = policy
+    return await ctx.shell.run(ctx.shell.resolve(request))
+  }
+
+  function validateCommon(args) {
+    if (args === undefined || args === null || typeof args !== 'object') throw new Error('invalid arguments')
+    if (typeof args.description !== 'string' || args.description.trim().length === 0) throw new Error('invalid description: expected a non-empty string (5-10 words, shown in the UI)')
+    if (args.timeoutMs !== undefined && (typeof args.timeoutMs !== 'number' || !Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) throw new Error('invalid timeoutMs: expected a positive number')
+  }
+
+  async function loadProjectConfig(exec) {
+    const cfgPath = join(workspaceRoot(exec), '.dsh', 'godot-dev-shell.json')
+    let info
+    try {
+      info = await ctx.fs.lstat(cfgPath)
+    } catch {
+      return {}
+    }
+    if (info === undefined) return {}
+    const target = await ctx.fs.resolve(cfgPath)
+    const text = await ctx.fs.readText(target)
+    try {
+      const parsed = JSON.parse(text)
+      return parsed !== null && typeof parsed === 'object' ? parsed : {}
+    } catch (e) {
+      throw new Error('godot-dev-shell: 项目配置解析失败 ' + cfgPath + ': ' + errText(e))
+    }
+  }
+
+  function configCommands(cfg) {
+    if (cfg === null || typeof cfg !== 'object') return undefined
+    if (cfg.commands === null || typeof cfg.commands !== 'object') return undefined
+    return cfg.commands
+  }
+
+  function legacyConfig(cfg) {
+    if (cfg === null || typeof cfg !== 'object') return false
+    return configCommands(cfg) === undefined && (cfg.modes !== undefined || cfg.verifyDir !== undefined)
+  }
+
+  function absoluteUnderRoot(root, rel) {
+    if (/^[A-Za-z]:[\\/]/.test(rel) || /^\\\\/.test(rel)) return rel
+    return root + '\\' + rel.replace(/\//g, '\\').replace(/^[\\]+/, '')
+  }
+
+  // Project-neutral prompt pointers; project specifics live in each workspace.
+  try {
+    const systemPrompt = ctx.get('systemPrompt')
+    if (systemPrompt !== undefined) {
+      ctx.effect(() => systemPrompt.section({
+        name: 'tool:ps_script',
+        order: 106,
+        text: 'PowerShell 多行脚本(超过一行)一律用 ps_script 工具(脚本落临时文件执行,零转义层),不要内联进 pwsh 的 command;含中文/引号/反引号/${} 的命令同理。受限沙箱会拦截捕获原生命令输出的管道($x = & exe 静默变空,2>&1 可能报 failed to run):需要捕获输出时优先用 cmd /c 重定向到工作区内文件再读,或用 sandbox_permissions 升级重试。项目声明的固化命令(验证/构建/统计等)一律用 run_command(清单由项目 .dsh/godot-dev-shell.json 的 commands 声明,各命令语义见其 description 与项目 .dsh/godot-dev-shell.md;做该项目工作前先读规则)。',
+      }))
+    }
+  } catch (e) {
+    console.error('dsh-godot-dev-shell: systemPrompt section unavailable: ' + errText(e))
+  }
+
+  // ── ps_script ──
+  ctx.tools.register({
+    name: 'ps_script',
+    description: '以「临时脚本文件 + pwsh 7 优先(自动探测安装路径,未装则回退 Windows PowerShell 5.1)+ -NoProfile -ExecutionPolicy Bypass -File」方式执行 PowerShell 脚本,从架构上消除多层转义、命令行长度限制、执行策略拦截和中文编码问题。script 参数就是纯 PowerShell 源码:原样写入 UTF-8(带 BOM)临时文件后执行,不经任何命令行转义层,引号/反引号/${}/大括号/中文任意使用。多行脚本、含特殊字符的脚本、需要执行其他 .ps1 的脚本一律优先用本工具;单行简单命令用 pwsh 即可。返回结构化结果:stdout 与 stderr 分离、精确退出码(exit N 原样传播)、超时/信号标记、截断时附完整输出文件路径。脚本在会话工作区 .dsh/tmp/ 下生成,执行后自动删除。执行受文件沙箱约束(覆盖整棵进程树,工作区外写入会被拒绝)。重要限制:受限沙箱模式下,PowerShell 捕获原生命令输出所需的管道会被拦截($x = & exe 赋值捕获会静默变空,带 2>&1 的原生命令可能报 failed to run)——纯透传输出(不赋值不重定向)不受影响;需要捕获输出时优先用 cmd /c \'"exe" args > "输出文件" 2>&1\' 重定向到工作区内文件再 Get-Content,或用 sandbox_permissions="danger-full-access" + justification 重试本调用(审批向用户请求)。另注意:不要设 $ErrorActionPreference=\'Stop\' 再配合原生命令 2>&1(Godot 的 WARNING 会变 ErrorRecord 直接中断脚本)。常用配方:执行 .ps1 → & \'D:\\path\\x.ps1\';跑批处理 → & \'D:\\path\\to\\x.bat\'(必要时配合 workdir);需要透传退出码时结尾加 exit $LASTEXITCODE。',
+    parameters: PS_SCRIPT_PARAMS,
+    output: {
+      schema: OUTPUT_SCHEMA,
+      render: (_args, value) => [{ type: 'text', text: renderResult(value) }],
+    },
+    presentCall: (args) => {
+      try {
+        const a = args !== undefined && args !== null && typeof args === 'object' ? args : {}
+        const first = typeof a.script === 'string' && a.script.length > 0 ? a.script.split('\n')[0].slice(0, 100) : 'ps_script'
+        const desc = typeof a.description === 'string' && a.description.length > 0 ? a.description : 'PowerShell script file execution'
+        return { card: 'terminal', title: first, description: desc }
+      } catch {
+        return undefined
+      }
+    },
+    async execute(args, exec) {
+      validateCommon(args)
+      if (typeof args.script !== 'string' || args.script.trim().length === 0) throw new Error('invalid script: expected a non-empty PowerShell source string')
+      if (args.script.indexOf(String.fromCharCode(0)) >= 0) throw new Error('invalid script: contains NUL characters')
+      if (args.script.length > MAX_SCRIPT_CHARS) throw new Error('invalid script: exceeds ' + MAX_SCRIPT_CHARS + ' characters')
+      if (args.workdir !== undefined && typeof args.workdir !== 'string') throw new Error('invalid workdir: expected a string')
+      const standing = resolveStanding(exec)
+      const root = workspaceRoot(exec).replace(/[\\/]+$/, '')
+      const tmpDir = join(root, '.dsh', 'tmp')
+      const fileName = 'gsh_' + Date.now().toString(36) + '_' + (seq = seq + 1) + '.ps1'
+      const scriptPath = join(tmpDir, fileName)
+      const content = '' + PROLOGUE + '\n' + args.script + (args.script.endsWith('\n') ? '' : '\n')
+      try {
+        const target = await ctx.fs.resolve(scriptPath)
+        await ctx.fs.writeText(target, content, undefined, undefined, standing)
+      } catch (e) {
+        throw new Error('ps_script: writing temp script ' + scriptPath + ' failed: ' + errText(e) + ' — the file sandbox may have denied it; this tool needs workspace-write')
+      }
+      const sweep = "Get-ChildItem -LiteralPath '" + tmpDir + "' -Filter 'gsh_*.ps1' -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTimeUtc -lt [datetime]::UtcNow.AddHours(-1) } | Remove-Item -ErrorAction SilentlyContinue"
+      const runner = shellRunnerQuoted()
+      const runLine = '& ' + runner + " -NoProfile -ExecutionPolicy Bypass -File '" + scriptPath + "'"
+      const cleanupLine = "Remove-Item -LiteralPath '" + scriptPath + "' -ErrorAction SilentlyContinue"
+      const command = sweep + '; ' + runLine + '; $gsh_ec = $LASTEXITCODE; ' + cleanupLine + '; if ($null -eq $gsh_ec) { $gsh_ec = 1 }; exit $gsh_ec'
+      const policy = await resolveCallPolicy('ps_script', args, exec)
+      const result = await runShell(command, resolveWorkdir(args.workdir, exec), args.timeoutMs === undefined ? DEFAULT_SCRIPT_TIMEOUT : args.timeoutMs, exec, policy)
+      if (result.aborted) throw new Error('tool call aborted')
+      return canonicalResult(result)
+    },
+  })
+
+  // ── run_command ──
+  ctx.tools.register({
+    name: 'run_command',
+    description: '运行当前工作区在 .dsh/godot-dev-shell.json 的 commands 里声明的固化命令(验证脚本/批处理/可执行文件)。命令清单、各命令的语义与退出码约定完全由项目定义——见各命令的 description 与项目规则 .dsh/godot-dev-shell.md。执行机制与 ps_script 相同:.ps1 用 pwsh 7 优先的 -NoProfile -ExecutionPolicy Bypass -File;.bat/.cmd/.exe 用调用运算符;受沙箱约束并支持 sandbox_permissions 升级;返回 stdout/stderr 分离 + 精确退出码。参数化变体(如不同帧数)用 ps_script 直接带参数调用脚本。未声明的命令名会报错并列出可用清单。',
+    parameters: RUN_COMMAND_PARAMS,
+    output: {
+      schema: OUTPUT_SCHEMA,
+      render: (_args, value) => [{ type: 'text', text: renderResult(value) }],
+    },
+    presentCall: (args) => {
+      try {
+        const a = args !== undefined && args !== null && typeof args === 'object' ? args : {}
+        const n = typeof a.name === 'string' && a.name.length > 0 ? a.name : 'command'
+        const desc = typeof a.description === 'string' && a.description.length > 0 ? a.description : 'Project command'
+        return { card: 'terminal', title: n, description: desc }
+      } catch {
+        return undefined
+      }
+    },
+    async execute(args, exec) {
+      validateCommon(args)
+      if (typeof args.name !== 'string' || args.name.length === 0) throw new Error('invalid name: expected a non-empty command name')
+      const cfg = await loadProjectConfig(exec)
+      const commands = configCommands(cfg)
+      if (commands === undefined) {
+        if (legacyConfig(cfg)) throw new Error('run_command: 项目配置仍是旧版 modes/verifyDir 结构——请迁移到 commands(每条: file/description/workdir/timeoutMs),见 .dsh/godot-dev-shell.json')
+        throw new Error('run_command: 本项目未声明任何命令——在工作区 .dsh/godot-dev-shell.json 的 commands 里声明(键为命令名,值含 file 字段)')
+      }
+      const cmd = commands[args.name]
+      if (cmd === null || typeof cmd !== 'object' || typeof cmd.file !== 'string' || cmd.file.length === 0) {
+        throw new Error('unknown command: ' + JSON.stringify(args.name) + ' — 可用命令: ' + Object.keys(commands).join('/') + ' (项目 .dsh/godot-dev-shell.json 的 commands)')
+      }
+      const root = workspaceRoot(exec).replace(/[\\/]+$/, '')
+      const fileAbs = absoluteUnderRoot(root, cmd.file)
+      if (fileAbs.indexOf("'") >= 0) throw new Error('run_command: 命令文件路径含单引号,拒绝执行: ' + fileAbs)
+      try {
+        const info = await ctx.fs.lstat(fileAbs)
+        if (info === undefined) throw new Error('file not found')
+      } catch (e) {
+        throw new Error('run_command: 命令文件不存在: ' + fileAbs + ' — 检查项目 .dsh/godot-dev-shell.json 的 commands.' + args.name + '.file (' + errText(e) + ')')
+      }
+      const ext = fileAbs.substring(fileAbs.lastIndexOf('.')).toLowerCase()
+      const runner = shellRunnerQuoted()
+      let runLine
+      if (ext === '.ps1') {
+        runLine = '& ' + runner + " -NoProfile -ExecutionPolicy Bypass -File '" + fileAbs + "'"
+      } else if (ext === '.bat' || ext === '.cmd' || ext === '.exe') {
+        runLine = "& '" + fileAbs + "'"
+      } else {
+        throw new Error('run_command: 不支持的命令文件类型 "' + ext + '"(支持 .ps1/.bat/.cmd/.exe): ' + fileAbs)
+      }
+      const command = runLine + '; exit $LASTEXITCODE'
+      let workdir
+      if (typeof cmd.workdir === 'string' && cmd.workdir.length > 0) {
+        workdir = absoluteUnderRoot(root, cmd.workdir)
+      } else {
+        workdir = root
+      }
+      const timeout = args.timeoutMs !== undefined ? args.timeoutMs : (typeof cmd.timeoutMs === 'number' && Number.isFinite(cmd.timeoutMs) && cmd.timeoutMs > 0 ? cmd.timeoutMs : DEFAULT_COMMAND_TIMEOUT)
+      const policy = await resolveCallPolicy('run_command', args, exec)
+      const result = await runShell(command, workdir, timeout, exec, policy)
+      if (result.aborted) throw new Error('tool call aborted')
+      return canonicalResult(result)
+    },
+  })
+
+  // ── add_command ──
+  ctx.tools.register({
+    name: 'add_command',
+    description: '向当前工作区注册或更新一条 run_command 命令(写入 .dsh/godot-dev-shell.json 的 commands;重名覆盖为更新)。完整工作流:先用 write/ps_script 把脚本写好(建议放 .dsh/scripts/)→ 用本工具注册(描述里写清语义与退出码约定)→ 需要时更新 .dsh/godot-dev-shell.md 的命令说明 → run_command 验证。',
+    parameters: {
+      type: 'object',
+      properties: {
+        name: { type: 'string', description: '命令名:字母开头,仅字母/数字/下划线/连字符,≤64 字符;run_command 按此名执行。' },
+        file: { type: 'string', description: '命令文件路径(相对工作区根或绝对);须已存在,支持 .ps1/.bat/.cmd/.exe。' },
+        description: { type: 'string', description: '命令语义说明(显示在配置面板,并指导模型正确使用;建议写清退出码约定)。' },
+        workdir: { type: 'string', description: '运行时工作目录(相对工作区根或绝对);缺省为工作区根。' },
+        timeoutMs: { type: 'number', description: '超时毫秒数;缺省用 run_command 默认 120000。' },
+      },
+      required: ['name', 'file'],
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        required: ['name', 'file', 'created', 'commands'],
+        properties: {
+          name: { type: 'string' },
+          file: { type: 'string' },
+          created: { type: 'boolean' },
+          commands: { type: 'array', items: { type: 'string' } },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: (value.created ? '已注册命令 ' : '已更新命令 ') + value.name + ' → ' + value.file + '\n当前命令清单: ' + value.commands.join('/') }],
+    },
+    presentCall: (args) => {
+      try {
+        const a = args !== undefined && args !== null && typeof args === 'object' ? args : {}
+        const n = typeof a.name === 'string' && a.name.length > 0 ? a.name : 'add_command'
+        const desc = typeof a.description === 'string' && a.description.length > 0 ? a.description : 'Register project command'
+        return { card: 'terminal', title: n, description: desc }
+      } catch {
+        return undefined
+      }
+    },
+    async execute(args, exec) {
+      if (args === undefined || args === null || typeof args !== 'object') throw new Error('invalid arguments')
+      if (typeof args.name !== 'string' || !/^[A-Za-z_][A-Za-z0-9_-]{0,63}$/.test(args.name)) throw new Error('invalid name: expected a letter-starting identifier (letters/digits/_/-, max 64 chars)')
+      if (typeof args.file !== 'string' || args.file.length === 0) throw new Error('invalid file: expected a non-empty path')
+      if (args.workdir !== undefined && typeof args.workdir !== 'string') throw new Error('invalid workdir: expected a string')
+      if (args.timeoutMs !== undefined && (typeof args.timeoutMs !== 'number' || !Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) throw new Error('invalid timeoutMs: expected a positive number')
+      const root = workspaceRoot(exec).replace(/[\\/]+$/, '')
+      const fileAbs = absoluteUnderRoot(root, args.file)
+      if (fileAbs.indexOf("'") >= 0) throw new Error('add_command: 命令文件路径含单引号,拒绝: ' + fileAbs)
+      try {
+        const info = await ctx.fs.lstat(fileAbs)
+        if (info === undefined) throw new Error('file not found')
+      } catch (e) {
+        throw new Error('add_command: 命令文件不存在: ' + fileAbs + ' — 先把脚本写好(建议 .dsh/scripts/)再注册 (' + errText(e) + ')')
+      }
+      const ext = fileAbs.substring(fileAbs.lastIndexOf('.')).toLowerCase()
+      if (ext !== '.ps1' && ext !== '.bat' && ext !== '.cmd' && ext !== '.exe') {
+        throw new Error('add_command: 不支持的命令文件类型 "' + ext + '"(支持 .ps1/.bat/.cmd/.exe): ' + fileAbs)
+      }
+      const standing = resolveStanding(exec)
+      const cfgPath = join(root, '.dsh', 'godot-dev-shell.json')
+      let cfgRaw = null
+      try {
+        cfgRaw = await readFile(cfgPath, 'utf8')
+      } catch { cfgRaw = null }
+      let cfg = {}
+      if (cfgRaw !== null) {
+        try {
+          const parsed = JSON.parse(cfgRaw)
+          if (parsed !== null && typeof parsed === 'object') cfg = parsed
+        } catch (e) {
+          throw new Error('add_command: 项目配置解析失败 ' + cfgPath + ': ' + errText(e))
+        }
+      }
+      if (legacyConfig(cfg)) {
+        throw new Error('add_command: 项目配置仍是旧版 modes/verifyDir 结构——请先迁移到 commands 再添加')
+      }
+      if (cfg.commands === null || typeof cfg.commands !== 'object' || Array.isArray(cfg.commands)) cfg.commands = {}
+      const existed = Object.prototype.hasOwnProperty.call(cfg.commands, args.name)
+      cfg.commands[args.name] = {
+        file: args.file,
+        ...(typeof args.description === 'string' && args.description.length > 0 ? { description: args.description } : {}),
+        ...(typeof args.workdir === 'string' && args.workdir.length > 0 ? { workdir: args.workdir } : {}),
+        ...(typeof args.timeoutMs === 'number' ? { timeoutMs: args.timeoutMs } : {}),
+      }
+      try {
+        const target = await ctx.fs.resolve(cfgPath)
+        await ctx.fs.writeText(target, JSON.stringify(cfg, null, 2) + '\n', undefined, undefined, standing)
+      } catch (e) {
+        throw new Error('add_command: 写入配置失败 ' + cfgPath + ': ' + errText(e))
+      }
+      return { name: args.name, file: args.file, created: !existed, commands: Object.keys(cfg.commands) }
+    },
+  })
+
+  // ── config panel API (GET /api/godot-dev-shell/panel?workspace=<path>) ──
+
+  async function gatherPanelData(requested) {
+    const registry = ctx.get('workspaceRegistry')
+    const workspaces = []
+    if (registry !== undefined) {
+      try {
+        const list = await registry.list()
+        if (Array.isArray(list)) {
+          for (const w of list) {
+            if (w === null || typeof w !== 'object') continue
+            workspaces.push({
+              id: typeof w.id === 'string' ? w.id : String(w.id === undefined ? '' : w.id),
+              path: typeof w.path === 'string' ? w.path : '',
+              title: typeof w.title === 'string' ? w.title : '',
+              live: false,
+            })
+          }
+        }
+      } catch { /* empty workspace list */ }
+    }
+    // 有活跃会话的工作区排前并标记（当前会话的工作区自然成为默认选中）
+    try {
+      const sessionsSvc = ctx.get('sessions')
+      if (sessionsSvc !== undefined) {
+        const live = sessionsSvc.list()
+        if (Array.isArray(live)) {
+          const cwds = []
+          for (const s of live) {
+            try {
+              const c = s.header.cwd
+              if (typeof c === 'string' && c.length > 1) cwds.push(c.replace(/[\\/]+$/, '').toLowerCase())
+            } catch { /* skip session */ }
+          }
+          if (cwds.length > 0) {
+            for (const w of workspaces) {
+              if (cwds.indexOf(String(w.path || '').replace(/[\\/]+$/, '').toLowerCase()) >= 0) w.live = true
+            }
+            workspaces.sort((a, b) => (a.live === true ? 0 : 1) - (b.live === true ? 0 : 1))
+          }
+        }
+      }
+    } catch { /* keep registry order */ }
+    let selected = typeof requested === 'string' && requested.length > 0 ? requested : ''
+    if (selected === '' && workspaces.length > 0) selected = workspaces[0].path
+    if (selected === '' || selected.indexOf("'") >= 0) {
+      return { workspaces, workspace: '', pwshRunner: 'pwsh (unresolved)', configRaw: '', configError: null, rulesMd: '', templates: [], commands: [], legacy: false, note: 'no workspace selected' }
+    }
+    const root = selected.replace(/[\\/]+$/, '')
+    const readIf = async (p) => {
+      try { return await readFile(p, 'utf8') } catch { return null }
+    }
+    const cfgRaw = await readIf(join(root, '.dsh', 'godot-dev-shell.json'))
+    let cfg = {}
+    let cfgError = null
+    if (cfgRaw !== null) {
+      try {
+        const parsed = JSON.parse(cfgRaw)
+        if (parsed !== null && typeof parsed === 'object') cfg = parsed
+      } catch (e) { cfgError = errText(e) }
+    }
+    const commands = configCommands(cfg)
+    const commandRows = []
+    if (commands !== undefined) {
+      for (const key of Object.keys(commands)) {
+        const c = commands[key]
+        if (c === null || typeof c !== 'object' || typeof c.file !== 'string' || c.file.length === 0) continue
+        const fileAbs = /^[A-Za-z]:[\\/]/.test(c.file) ? c.file : join(root, c.file)
+        let exists = false
+        try {
+          const st = await stat(fileAbs)
+          exists = st.isFile()
+        } catch { exists = false }
+        commandRows.push({
+          name: key,
+          description: typeof c.description === 'string' ? c.description : '',
+          file: c.file,
+          workdir: typeof c.workdir === 'string' ? c.workdir : '',
+          timeoutMs: typeof c.timeoutMs === 'number' && Number.isFinite(c.timeoutMs) ? c.timeoutMs : null,
+          exists,
+        })
+      }
+    }
+    const rulesMd = await readIf(join(root, '.dsh', 'godot-dev-shell.md'))
+    const templates = []
+    try {
+      const entries = await readdir(join(root, '.dsh', 'templates'), { withFileTypes: true })
+      for (const ent of entries) {
+        if (!ent.isFile()) continue
+        const name = ent.name
+        if (name === '' || name.indexOf("'") >= 0) continue
+        const content = await readIf(join(root, '.dsh', 'templates', name))
+        if (content !== null && content.length <= 65536) templates.push({ name, content })
+      }
+    } catch { /* no templates dir */ }
+    return {
+      workspaces,
+      workspace: root,
+      pwshRunner: shellRunnerQuoted(),
+      configRaw: cfgRaw === null ? '' : cfgRaw,
+      configError: cfgError,
+      rulesMd: rulesMd === null ? '' : rulesMd,
+      templates,
+      commands: commandRows,
+      legacy: legacyConfig(cfg),
+    }
+  }
+
+  try {
+    const webServer = ctx.get('webServer')
+    if (webServer !== undefined) {
+      ctx.effect(() => webServer.register({
+        kind: 'prefix',
+        path: '/api/godot-dev-shell/panel',
+        handler: async (req, res) => {
+          if (req.method !== 'GET') {
+            res.writeHead(405, { allow: 'GET' })
+            res.end('method not allowed')
+            return
+          }
+          try {
+            const url = new URL(req.url, 'http://localhost')
+            const data = await gatherPanelData(url.searchParams.get('workspace') ?? '')
+            writeJson(res, 200, data)
+          } catch (e) {
+            writeJson(res, 500, { error: errText(e) })
+          }
+        },
+      }))
+    } else {
+      console.error('dsh-godot-dev-shell: webServer unavailable — config panel API not registered')
+    }
+  } catch (e) {
+    console.error('dsh-godot-dev-shell: panel route registration failed: ' + errText(e))
+  }
+
+  console.log('dsh-godot-dev-shell: registered ps_script + run_command + add_command + panel API (pwsh runner: ' + shellRunnerQuoted() + ')')
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "dsh-godot-dev-shell",
+  "version": "2.1.0",
+  "description": "DSH bundle（项目无关的最小工具集）：ps_script（PowerShell 脚本落临时文件执行，消除多层转义/编码/执行策略/退出码问题）+ run_command（运行工作区 .dsh/godot-dev-shell.json 声明的固化命令）+ 设置面板（工作区命令/规则/模板可视化）。零内置项目语义：命令清单、退出码约定、规则全部跟项目走。",
+  "keywords": [
+    "deepseek",
+    "harness",
+    "dsh",
+    "cordis",
+    "plugin",
+    "powershell",
+    "godot"
+  ],
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "license": "MIT",
+  "dsh": {
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime"
+      ],
+      "platform": "web"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}