dsh-root-planner-preset 1.3.1 → 1.3.2

package/INSTALL.md

@@ -62,7 +62,14 @@ of writing "...\report.md" directly.
 
 **一个仍然存在的限制**：shell 命令能在运行时拼出路径（`$env:X` 拼 `'..'`、脚本内部写、Here-String），参数扫描看不见。要真正关住子代理的 shell 需要给它更窄的沙箱写域，而 DSH 给不了（`sandboxPolicy.resolve()` 只接受 `{session, mode}`，`workspaceRoot` 恒等于不可变的会话 cwd）。所以父 agent 的时间戳核验仍是兜底——人设里已经写了。
 
-> 守卫以**预设行**形式挂载，所以只有用 `root-planner` 预设的 agent 才受约束：`_agents/` 这套约定只有这个预设的人设定义过。
+> 守卫是以**profile 级条目**挂载的（不是预设内的一行）。这意味着它约束**这个 profile 里的每个被委派 agent**——包括用着别的预设、从没被告知 `_agents/` 的子代理。如果你在同一个 profile 里也用别的预设加子代理，可以在 profile 补丁里关掉它：
+>
+> ```yaml
+> - id: root-planner-guard
+>   disabled: true
+> ```
+>
+> 为什么不做成预设行（那样就只约束本预设）？试过了，**实测不生效**：配置里那一行存在且看起来正常，但真实会话上六步探针全部放行。所以 `verify-patch.mjs` 现在会在有人改回预设行时直接失败。
 
 ### 方式 2：GitHub 源码
 

package/README.md

@@ -36,11 +36,11 @@ the root decides which to copy in — merging into an existing file where that i
 change means, keeping them separate where it is not. `_agents/` stays (and belongs in
 `.gitignore`) so the same agent can be continued later.
 
-**The boundary is enforced, not just agreed.** This preset ships the fence as its own
-plugin row (`dsh-root-planner-preset/guard`), so one install carries the protocol and its
-enforcement together. It refuses a `write`, `edit` or `ops_replace` whose target resolves
-outside `<workspace>/_agents/`, and refuses a shell call whose `workdir` is outside it or
-whose command names an absolute path into your files:
+**The boundary is enforced, not just agreed.** This preset's package also ships the fence
+as a profile-level entry (`dsh-root-planner-preset/guard`), so one install carries the
+protocol and its enforcement together. It refuses a `write`, `edit` or `ops_replace` whose
+target resolves outside `<workspace>/_agents/`, and refuses a shell call whose `workdir` is
+outside it or whose command names an absolute path into your files:
 
 ```
 write: outside your workspace. You may write only inside "...\_agents"; everything else
@@ -51,9 +51,25 @@ of writing "...\report.md" directly.
 The root session is never fenced: it owns the workspace and has to be able to write
 anywhere in it to integrate a child's artifacts.
 
+**Being profile-level, it fences every delegated agent in this profile** — including
+subagents under a different preset, which were never told about `_agents/`. If that matters
+on your machine, turn the entry off in your profile patch:
+
+```yaml
+- id: root-planner-guard
+  disabled: true
+```
+
+Declaring the guard as a row *inside* the preset would scope it to this preset only, and
+that was tried first: measured against a live session it registered nothing — six probe
+steps all came back allowed while the composed config looked correct. `verify-patch.mjs`
+now fails if anyone declares it as a preset row again.
+
 One limitation survives, and it is worth knowing before you rely on this: a shell command
 can build a path at runtime (`$env:X` + `'..'`, a script that writes, a Here-String), and
-no argument scan can see it. Confining a child's shell properly would need a narrower
+no argument scan can see it. The command scan matches **drive-letter** paths, so on POSIX
+it detects nothing at all — the two CI cases for it are skipped there rather than pretending
+otherwise. Confining a child's shell properly would need a narrower
 sandbox write root, which DSH cannot give a child — `sandboxPolicy.resolve()` accepts only
 `{ session, mode }` and derives `workspaceRoot` from the immutable, inherited
 `session.header.cwd`. So keep the parent's check as the backstop:

package/README.zh.md

@@ -30,7 +30,7 @@
 
 并发问题是用**隔离**解决的，不是用协调。派活之前，根创建 `_agents/<label>/` 并把**绝对路径**写进任务；子代理**只往那里写**，父目录的文件随便读，要改就发申请。完成后它报告产物清单，由根决定复制哪些进自己的工作区——该合并进现有文件的就合并，该保持独立的就独立。`_agents/` 会保留（并应进 `.gitignore`），以便日后继续使用同一个子代理。
 
-**这条边界是强制执行的，不只是约定。** 预设自带围栏（自己的插件行 `dsh-root-planner-preset/guard`），一次安装同时得到协议和它的执行。它拒绝目标落在 `<工作区>/_agents/` 之外的 `write`、`edit`、`ops_replace`；也拒绝 `workdir` 在工作区之外的 shell 调用，以及命令里写着你文件的绝对路径：
+**这条边界是强制执行的，不只是约定。** 预设所在的包同时提供围栏，作为一条**profile 级条目**（`dsh-root-planner-preset/guard`），一次安装同时得到协议和它的执行。它拒绝目标落在 `<工作区>/_agents/` 之外的 `write`、`edit`、`ops_replace`；也拒绝 `workdir` 在工作区之外的 shell 调用，以及命令里写着你文件的绝对路径：
 
 ```
 write: outside your workspace. You may write only inside "...\_agents"; everything else
@@ -40,7 +40,16 @@ of writing "...\report.md" directly.
 
 根会话**不受围栏限制**——它必须能在自己工作区任意位置写，才能把子代理的产物并入。
 
-**有一个限制必须知道**：shell 命令能在运行时拼出路径（`$env:X` 拼 `'..'`、脚本内部写、Here-String），参数扫描看不见。要真正关住子代理的 shell，需要给它一个更窄的沙箱写域，而 DSH 给不了——`sandboxPolicy.resolve()` 只接受 `{ session, mode }`，`workspaceRoot` 恒等于不可变、从父会话继承的 `session.header.cwd`。所以父 agent 的核验仍然是兜底：
+**因为它是 profile 级的，它约束这个 profile 里的每个被委派 agent**——包括用着别的预设、从没被告知 `_agents/` 的子代理。如果这会影响到你，在 profile 补丁里把这条关掉：
+
+```yaml
+- id: root-planner-guard
+  disabled: true
+```
+
+把守卫声明成**预设内的一行**可以只约束本预设，但那是先试过的做法：在真实会话上实测，它什么都注册不上——六步探针全部放行，而 composed 配置看起来完全正常。现在 `verify-patch.mjs` 会在有人把它改回预设行时直接失败。
+
+**还有一个限制必须知道**：shell 命令能在运行时拼出路径（`$env:X` 拼 `'..'`、脚本内部写、Here-String），参数扫描看不见。而且命令扫描只认**盘符路径**，所以在 POSIX 上它**什么也检测不到**——CI 里那两条用例在 Linux 上是**显式跳过**的，而不是假装通过。要真正关住子代理的 shell，需要给它一个更窄的沙箱写域，而 DSH 给不了——`sandboxPolicy.resolve()` 只接受 `{ session, mode }`，`workspaceRoot` 恒等于不可变、从父会话继承的 `session.header.cwd`。所以父 agent 的核验仍然是兜底：
 
 ```sh
 # 派活前

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "type": "module",
   "description": "DSH agent preset: the root agent plans and decides, subagent workers read, write and run commands inside their own _agents/ workspace, and nothing outlives its task.",
   "license": "MIT",