dsh-hypatia-auto-memory 2.4.2 → 2.4.3

package/README.md

@@ -400,9 +400,12 @@ agent/created ──▶ rules/taboos inject()
 - **Auto-approve** answers the approval request for the agent's own bash
   `hypatia` calls, and only those: the executable word must be a trusted
   basename (after `KEY=value` prefixes) and the command must carry no pipe,
-  redirect, chain or command substitution *outside quotes* — a JSE argument full
-  of `|` and `>` inside quotes still qualifies. Everything else goes to the
-  human. The plugin's own writes never take this path.
+  redirect, chain or command substitution *outside single quotes* — a JSE
+  argument full of `|` and `>` inside quotes still qualifies. Double quotes do
+  **not** make a payload inert: the shell expands `$(…)` and backticks inside
+  them, so `hypatia query "$(id)"` goes to the human like any other composed
+  command. Everything else goes to the human. The plugin's own writes never
+  take this path.
 
   Scope, measured rather than assumed: in DSH a bash call raises an approval
   request **only** when the sandbox denies it and the model retries with
@@ -668,7 +671,7 @@ now only projects plugin Config forms.)
 | Every write fails right after changing `shelf` | The shelf is not registered or not connected — startup logs `shelf "<name>" is not registered`. Connect it (`hypatia connect <dir> --name <name>`) and save the setting again (or reload the profile), or pick another |
 | The agent searches `default` while the plugin writes elsewhere | A disk copy of `hypatia-memory` (see below) replaced the bundled skill, or recall is disabled, so nothing told the agent which shelf to use |
 | Duplicate `msg-*` after weird manual edits | Delete the entry in hypatia and lower `lastLoggedSeq` for that session in the state domain — backfill recreates it once |
-| The agent's own `hypatia` write still asks for approval | `autoApprove: false`, the command pipes/redirects/chains outside quotes, or its first word is not one of `binaries` — only plain calls are answered, by design. Reads never reach approval at all, so nothing to fix there |
+| The agent's own `hypatia` write still asks for approval | `autoApprove: false`, the command pipes/redirects/chains outside single quotes (or substitutes `$(…)`/backticks even inside double ones), or its first word is not one of `binaries` — only plain calls are answered, by design. Reads never reach approval at all, so nothing to fix there |
 | The agent got a memory protocol that tells it to log messages by hand | Another plugin registered `hypatia-memory` first (`dsh-hypatia` still in the profile), or a `hypatia-memory` exists on disk — typically `~/.agents/skills/hypatia-memory`, written by `hypatia skill install --agent codex`. Agent presets load disk skills in a layer nearer than plugins, so it wins in sessions even though the skill center may list this plugin. Remove the copy the startup warning names |
 | Can't tell which model actually ran | The list is a priority order, so a task's first attempt names the head of `consolidation.models` and a retry names the route it degraded to. Each attempt lands in `~/.dsh/storages/hypatia_auto_memory_diag.json` (`model_calls`) with purpose, provider/model, the `effort` actually sent, outcome, duration and the route's own token split — reading one task's rows top-down is how a fallback is confirmed, and `effort` is how a configured thinking level is confirmed to have been honoured. The usage ledger cannot answer this — it folds agent turns (`assistant/message`) and never sees a plugin's direct `llm.stream`. A `pending` row means the call is still in flight, or the process died mid-call: the row is written before the call and settled after it |
 | A configured `reasoningEffort` seems to do nothing | The route does not declare that level, so the call drops it rather than risk the core's `UNSUPPORTED_REASONING_EFFORT`. One warning names the route, the value and what the route does declare; `model_calls.effort` then reads empty for those attempts. The card offers exactly the levels the model advertises, so this normally only happens after editing the profile by hand or pointing the route at a different model |

package/README.zh-CN.md

@@ -307,8 +307,10 @@ agent/created ──▶ rules/taboos inject()
 
 - **Auto-approve** 只回答 Agent 自己的 bash `hypatia` 调用的审批请求，而且仅限这些：
   可执行词必须是一个可信的 basename（去掉 `KEY=value` 前缀之后），并且命令在
-  **引号之外**不能有管道、重定向、串联或命令替换——一个引号内满是 `|` 和 `>` 的 JSE
-  参数仍然合格。其余都交给人类。插件自己的写入从不走这条路。
+  **单引号之外**不能有管道、重定向、串联或命令替换——一个引号内满是 `|` 和 `>` 的 JSE
+  参数仍然合格。双引号**不**能当作"已成字面量"：shell 会在双引号内展开 `$(…)` 和
+  反引号，所以 `hypatia query "$(id)"` 和任何带组合的命令一样交给人类。其余都交给
+  人类。插件自己的写入从不走这条路。
 
   Scope 是实测而非想当然：在 DSH 里，一个 bash 调用**只有**在沙箱拒绝、且模型带
   `sandbox_permissions` 重试时才会发起审批请求。检索（`query`、`search`、`list`、
@@ -522,7 +524,7 @@ shelf 清单本来就不是配置，而设置域现在只投影插件的 Config
 | 改了 `shelf` 之后每次写入都失败 | shelf 没注册或没连接——启动时记录 `shelf "<name>" is not registered`。连接它（`hypatia connect <dir> --name <name>`）后重新保存设置（或重载 profile），或换一个 |
 | Agent 在 `default` 里搜，而插件写在别处 | 一份磁盘上的 `hypatia-memory`（见下）替换了随包技能，或 recall 被禁用，所以没有东西告诉 Agent 用哪个 shelf |
 | 手动乱改后出现重复 `msg-*` | 在 hypatia 里删掉该条目，并在 state domain 里把该会话的 `lastLoggedSeq` 调低——回填会重新创建它一次 |
-| Agent 自己的 `hypatia` 写入仍要审批 | `autoApprove: false`、命令在引号外有管道/重定向/串联、或首词不是 `binaries` 之一——按设计只回答纯调用。读取根本不会走到审批，所以那里没有要修的 |
+| Agent 自己的 `hypatia` 写入仍要审批 | `autoApprove: false`、命令在单引号外有管道/重定向/串联（双引号内的 `$(…)`/反引号也算）、或首词不是 `binaries` 之一——按设计只回答纯调用。读取根本不会走到审批，所以那里没有要修的 |
 | Agent 拿到了一份教它手动记录消息的记忆协议 | 另一个插件先注册了 `hypatia-memory`（profile 里还有 `dsh-hypatia`），或磁盘上有 `hypatia-memory`——通常是 `hypatia skill install --agent codex` 写的 `~/.agents/skills/hypatia-memory`。Agent 预设会在比插件更近的一层加载磁盘技能，所以它在会话里胜出，尽管技能中心可能列出本插件。删掉启动告警指出的那份拷贝 |
 | 不知道实际用了哪个模型 | 列表是优先级顺序：一个任务的第一次尝试就是 `consolidation.models` 的队首，重试则是它降级到的那条。每次尝试都落在 `~/.dsh/storages/hypatia_auto_memory_diag.json`（`model_calls`），带 purpose、provider/model、**实际发出的 `effort`**、outcome、耗时以及路由自己上报的 token 拆分——把同一个任务的几行按序读下来，就能确认备选确实被用上了，而 `effort` 是确认配置的思考档位真的生效了的依据。usage ledger 答不了这个问题——它只折算 Agent 的 turn（`assistant/message`），看不见插件直连的 `llm.stream`。`pending` 行表示调用仍在进行中，或进程在调用中途死了：记录在调用前先落盘、调用结束后回填 |
 | 配了 `reasoningEffort` 却像没生效 | 该路由没有声明这个档位，于是调用把它丢掉了，以免撞上核心的 `UNSUPPORTED_REASONING_EFFORT`。会有一条警告点名路由、值和该路由实际声明的档位，此后这些尝试的 `model_calls.effort` 是空的。卡片只提供模型声明的档位，所以这通常只发生在手改 profile、或把这条路由换成了别的模型之后 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-hypatia-auto-memory",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Event-driven Hypatia memory for DSH: automatic conversation logging via session events, queued background consolidation (span summaries + work-unit extraction) with a dedicated model route, and recall injection — zero per-call model work in the main session.",
   "icon": "./icon.svg",
   "type": "module",

package/src/auto-approve.js

@@ -8,10 +8,13 @@
  * prompt every single time and, in practice, stops the agent from retrieving at
  * all.
  *
- * The matcher is narrow on purpose: a bash call whose executable word is a
- * trusted basename AND that contains no shell composition outside quotes. A
- * command that pipes, redirects, chains or substitutes is a command that can do
- * something other than talk to hypatia, so it goes to the human.
+ * The matcher is narrow on purpose: a shell call whose executable word is a
+ * trusted basename AND that contains no shell composition outside single
+ * quotes. A command that pipes, redirects, chains or substitutes is a command
+ * that can do something other than talk to hypatia, so it goes to the human.
+ * Only single quotes are trusted to make a payload literal: `$(…)` and
+ * backticks are expanded inside double quotes, so a double-quoted payload is
+ * still a payload that runs.
  *
  * Ported from `dsh-hypatia`'s auto-approve (same repository, MIT), which this
  * plugin replaces — see README.
@@ -21,6 +24,11 @@
 
 /**
  * True when the command's executable word (after env assignments) is trusted.
+ *
+ * Windows shapes are accepted too — an optional `.exe` suffix and backslash
+ * separators, as the pwsh tool produces them on a Windows host
+ * (`C:\Users\me\bin\hypatia.exe`, `hypatia.exe`).
+ *
  * @param {string} command
  * @param {string[]} binaries - trusted basenames, e.g. `['hypatia']`.
  */
@@ -34,15 +42,30 @@ export function invokesTrustedBinary(command, binaries) {
   }
   const word = /^([^\s"']+)/.exec(rest)?.[1]
   if (word === undefined) return false
-  return binaries.some((binary) => word === binary || word.endsWith(`/${binary}`))
+  // The suffix is tried on both separators and on the bare word, so `hypatia.exe`
+  // and `C:/bin/hypatia.exe` match without a second regex.
+  return binaries.some((binary) =>
+    word === binary
+    || word === `${binary}.exe`
+    || word.endsWith(`/${binary}`)
+    || word.endsWith(`/${binary}.exe`)
+    || word.endsWith(`\\${binary}`)
+    || word.endsWith(`\\${binary}.exe`))
 }
 
 /**
- * True when the command contains shell composition OUTSIDE quotes.
+ * True when the command contains shell composition outside SINGLE quotes.
  *
  * Quote tracking matters: a JSE query argument routinely contains `|` or `>`
  * inside a quoted string (`'["$knowledge",[["$gt","x",1]]]'`), and treating
  * those as composition would send every structured query to the human.
+ *
+ * Double quotes are different, and that difference is the whole point: a shell
+ * expands `$(…)` and backticks inside them, so `hypatia query "$(id)"` still
+ * runs something else and must reach the human. Only single quotes make a
+ * payload literal. Everything else (`|`, `>`, `&&`, `;`) stays non-composition
+ * inside double quotes, which is what keeps `--data="a | b"` prompt-free.
+ *
  * @param {string} command
  */
 export function hasShellComposition(command) {
@@ -67,7 +90,13 @@ export function hasShellComposition(command) {
       double = double === false
       continue
     }
-    if (single || double) continue
+    if (single) continue
+    if (double) {
+      // Substitution survives double quoting; nothing else does.
+      if (char === '`') return true
+      if (char === '$' && command[index + 1] === '(') return true
+      continue
+    }
     if (char === '&' || char === ';' || char === '|' || char === '<' || char === '>' || char === '`' || char === '\n') {
       return true
     }
@@ -78,11 +107,17 @@ export function hasShellComposition(command) {
 
 /**
  * True when this tool execution is a plain call to a trusted binary.
+ *
+ * `pwsh` and `powershell` qualify because that is how a Windows host runs its
+ * shell tool; the command string gets the same conservative scan, so widening
+ * this gate changes only which tool name may ask, not what may pass.
+ *
  * @param {{name?: string, arguments?: {command?: unknown}}} exec
  * @param {string[]} binaries
  */
 export function isPureTrustedCall(exec, binaries) {
-  if (exec?.name !== 'bash') return false
+  const name = exec?.name
+  if (name !== 'bash' && name !== 'pwsh' && name !== 'powershell') return false
   const command = exec.arguments?.command
   if (typeof command !== 'string') return false
   return invokesTrustedBinary(command, binaries) && hasShellComposition(command) === false