minimal-agent 0.12.0 → 0.14.0

package/src/tools/applypatch/applyPatch.ts

@@ -0,0 +1,428 @@
+import { existsSync } from 'node:fs';
+import { readFile, realpath, rm } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { z } from 'zod';
+
+import { getWorkingDir } from '../../bootstrap/workingDir.js';
+import type {
+  FileActivityMetadata,
+  Tool,
+  ToolCallContext,
+  ToolResult,
+} from '../../types.js';
+import { buildPatchSummary } from '../shared/diffSummary.js';
+import { fileActivityMetadata } from '../shared/fileActivity.js';
+import { emitFileMutation } from '../shared/fileMutationBus.js';
+import { hashFileBytes, recordRead } from '../shared/fileState.js';
+import {
+  type FileBomEncoding,
+  applyLineEnding,
+  atomicWriteFile,
+  encodeTextFile,
+  hasBinaryExtension,
+  readTextFile,
+} from '../shared/fileUtils.js';
+import { DEFAULT_MAX_RESULT_SIZE_CHARS } from '../types.js';
+
+interface PatchHunk {
+  header: string;
+  oldStart?: number;
+  lines: Array<{ kind: 'context' | 'add' | 'delete'; text: string }>;
+}
+
+type PatchOperation =
+  | { kind: 'add'; path: string; content: string }
+  | { kind: 'delete'; path: string }
+  | { kind: 'update'; path: string; moveTo?: string; hunks: PatchHunk[] };
+
+const schema = z.object({
+  patch: z.string().min(1).max(10_000_000),
+});
+type ApplyPatchInput = z.infer<typeof schema>;
+
+function fail(message: string): never {
+  throw new Error(message);
+}
+
+/** Parse the Codex apply_patch envelope without invoking a platform patch binary. */
+export function parseApplyPatch(input: string): PatchOperation[] {
+  const lines = input.replaceAll('\r\n', '\n').split('\n');
+  if (lines[0] !== '*** Begin Patch') fail('补丁必须以 *** Begin Patch 开始');
+  const operations: PatchOperation[] = [];
+  let index = 1;
+  while (index < lines.length) {
+    const line = lines[index]!;
+    if (line === '*** End Patch') {
+      if (lines.slice(index + 1).some((item) => item.trim()))
+        fail('*** End Patch 后不能再有内容');
+      if (!operations.length) fail('补丁中没有文件操作');
+      return operations;
+    }
+    if (line.startsWith('*** Add File: ')) {
+      const path = line.slice('*** Add File: '.length);
+      index += 1;
+      const added: string[] = [];
+      while (index < lines.length && !lines[index]!.startsWith('*** ')) {
+        const contentLine = lines[index]!;
+        if (!contentLine.startsWith('+'))
+          fail(`Add File ${path} 的内容行必须以 + 开头（第 ${index + 1} 行）`);
+        added.push(contentLine.slice(1));
+        index += 1;
+      }
+      operations.push({
+        kind: 'add',
+        path,
+        content: added.length ? `${added.join('\n')}\n` : '',
+      });
+      continue;
+    }
+    if (line.startsWith('*** Delete File: ')) {
+      operations.push({
+        kind: 'delete',
+        path: line.slice('*** Delete File: '.length),
+      });
+      index += 1;
+      continue;
+    }
+    if (line.startsWith('*** Update File: ')) {
+      const path = line.slice('*** Update File: '.length);
+      index += 1;
+      let moveTo: string | undefined;
+      if (lines[index]?.startsWith('*** Move to: ')) {
+        moveTo = lines[index]!.slice('*** Move to: '.length);
+        index += 1;
+      }
+      const hunks: PatchHunk[] = [];
+      while (index < lines.length && !lines[index]!.startsWith('*** ')) {
+        const headerLine = lines[index]!;
+        if (!headerLine.startsWith('@@'))
+          fail(`Update File ${path} 缺少 @@ hunk 头（第 ${index + 1} 行）`);
+        const match = /^@@(?: -(\d+)(?:,\d+)? \+\d+(?:,\d+)?)? @@\s*(.*)$/.exec(
+          headerLine,
+        );
+        const header = match
+          ? match[2]!
+          : headerLine.slice(2).replace(/^\s+|\s+$/g, '');
+        const oldStart = match?.[1] ? Number(match[1]) : undefined;
+        index += 1;
+        const hunkLines: PatchHunk['lines'] = [];
+        while (
+          index < lines.length &&
+          !lines[index]!.startsWith('@@') &&
+          (!lines[index]!.startsWith('*** ') ||
+            lines[index] === '*** End of File')
+        ) {
+          const hunkLine = lines[index]!;
+          if (hunkLine === '*** End of File') {
+            index += 1;
+            continue;
+          }
+          const prefix = hunkLine[0];
+          if (prefix !== ' ' && prefix !== '+' && prefix !== '-')
+            fail(`hunk 内容行必须以空格、+ 或 - 开头（第 ${index + 1} 行）`);
+          hunkLines.push({
+            kind:
+              prefix === ' ' ? 'context' : prefix === '+' ? 'add' : 'delete',
+            text: hunkLine.slice(1),
+          });
+          index += 1;
+        }
+        if (!hunkLines.length) fail(`Update File ${path} 包含空 hunk`);
+        hunks.push({ header, oldStart, lines: hunkLines });
+      }
+      if (!hunks.length && !moveTo) fail(`Update File ${path} 没有 hunk`);
+      operations.push({
+        kind: 'update',
+        path,
+        ...(moveTo ? { moveTo } : {}),
+        hunks,
+      });
+      continue;
+    }
+    fail(`无法识别补丁指令（第 ${index + 1} 行）：${line}`);
+  }
+  fail('补丁缺少 *** End Patch');
+}
+
+function within(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+  return (
+    rel === '' ||
+    (!isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${sep}`))
+  );
+}
+
+async function nearestExistingAncestor(path: string): Promise<string> {
+  let current = path;
+  while (!existsSync(current)) {
+    const parent = dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return realpath(current);
+}
+
+async function workspacePath(raw: string, cwd: string): Promise<string> {
+  if (!raw || isAbsolute(raw) || raw.includes('\0'))
+    fail(`补丁路径必须是非空的工作区相对路径：${raw}`);
+  const absolute = resolve(cwd, raw);
+  const rel = relative(resolve(cwd), absolute);
+  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+    fail(`补丁路径越过工作区边界：${raw}`);
+  const physicalRoot = await realpath(resolve(cwd)).catch(() => resolve(cwd));
+  const physicalBoundary = existsSync(absolute)
+    ? await realpath(absolute)
+    : await nearestExistingAncestor(dirname(absolute));
+  if (!within(physicalRoot, physicalBoundary))
+    fail(`补丁路径通过符号链接越过工作区边界：${raw}`);
+  if (hasBinaryExtension(absolute)) fail(`ApplyPatch 不支持二进制文件：${raw}`);
+  return absolute;
+}
+
+export function applyHunks(original: string, hunks: PatchHunk[]): string {
+  const normalized = original.replaceAll('\r\n', '\n');
+  const trailingNewline = normalized.endsWith('\n');
+  const lines = normalized.split('\n');
+  if (trailingNewline) lines.pop();
+  let cursor = 0;
+  for (const hunk of hunks) {
+    if (hunk.header) {
+      const anchor = lines.findIndex(
+        (line, index) => index >= cursor && line.includes(hunk.header),
+      );
+      if (anchor < 0) fail(`找不到 hunk 锚点：${hunk.header}`);
+      cursor = anchor;
+    }
+    const before = hunk.lines
+      .filter((line) => line.kind !== 'add')
+      .map((line) => line.text);
+    const after = hunk.lines
+      .filter((line) => line.kind !== 'delete')
+      .map((line) => line.text);
+    const matchesAt = (start: number) =>
+      before.every((line, offset) => lines[start + offset] === line);
+    let at = -1;
+    if (!before.length) {
+      at =
+        hunk.oldStart === undefined
+          ? cursor
+          : Math.max(cursor, Math.min(lines.length, hunk.oldStart - 1));
+    } else {
+      for (
+        let index = cursor;
+        index <= lines.length - before.length;
+        index += 1
+      ) {
+        if (matchesAt(index)) {
+          at = index;
+          break;
+        }
+      }
+      if (at < 0 && cursor > 0) {
+        const matches: number[] = [];
+        for (let index = 0; index <= lines.length - before.length; index += 1)
+          if (matchesAt(index)) matches.push(index);
+        if (matches.length === 1) at = matches[0]!;
+      }
+    }
+    if (at < 0)
+      fail(`hunk 上下文与当前文件不匹配：${before.join('\n').slice(0, 240)}`);
+    lines.splice(at, before.length, ...after);
+    cursor = at + after.length;
+  }
+  return `${lines.join('\n')}${trailingNewline ? '\n' : ''}`;
+}
+
+interface StagedFile {
+  path: string;
+  label: string;
+  before?: Buffer;
+  beforeText: string;
+  after?: string;
+  encoding: FileBomEncoding;
+  activity: 'created' | 'modified' | 'deleted';
+}
+
+async function stagePatch(
+  operations: PatchOperation[],
+  cwd: string,
+): Promise<StagedFile[]> {
+  const staged: StagedFile[] = [];
+  const touched = new Set<string>();
+  const claim = (path: string) => {
+    if (touched.has(path)) fail(`同一补丁不能重复操作同一路径：${path}`);
+    touched.add(path);
+  };
+  for (const operation of operations) {
+    const path = await workspacePath(operation.path, cwd);
+    claim(path);
+    if (operation.kind === 'add') {
+      if (existsSync(path)) fail(`Add File 目标已存在：${operation.path}`);
+      staged.push({
+        path,
+        label: operation.path,
+        beforeText: '',
+        after: operation.content,
+        encoding: 'utf8',
+        activity: 'created',
+      });
+      continue;
+    }
+    if (!existsSync(path))
+      fail(
+        `${operation.kind === 'delete' ? 'Delete' : 'Update'} File 不存在：${operation.path}`,
+      );
+    const snapshot = await readTextFile(path);
+    if (operation.kind === 'delete') {
+      staged.push({
+        path,
+        label: operation.path,
+        before: snapshot.bytes,
+        beforeText: snapshot.content,
+        encoding: snapshot.encoding,
+        activity: 'deleted',
+      });
+      continue;
+    }
+    const updated = applyLineEnding(
+      applyHunks(snapshot.content, operation.hunks),
+      snapshot.lineEnding,
+    );
+    if (operation.moveTo) {
+      const target = await workspacePath(operation.moveTo, cwd);
+      claim(target);
+      if (existsSync(target)) fail(`Move to 目标已存在：${operation.moveTo}`);
+      staged.push({
+        path,
+        label: operation.path,
+        before: snapshot.bytes,
+        beforeText: snapshot.content,
+        encoding: snapshot.encoding,
+        activity: 'deleted',
+      });
+      staged.push({
+        path: target,
+        label: operation.moveTo,
+        beforeText: '',
+        after: updated,
+        encoding: snapshot.encoding,
+        activity: 'created',
+      });
+    } else {
+      staged.push({
+        path,
+        label: operation.path,
+        before: snapshot.bytes,
+        beforeText: snapshot.content,
+        after: updated,
+        encoding: snapshot.encoding,
+        activity: 'modified',
+      });
+    }
+  }
+  return staged;
+}
+
+async function commit(staged: StagedFile[]): Promise<void> {
+  const committed: StagedFile[] = [];
+  try {
+    for (const file of staged) {
+      if (file.after === undefined) await rm(file.path);
+      else await atomicWriteFile(file.path, file.after, file.encoding);
+      committed.push(file);
+    }
+  } catch (error) {
+    const rollbackErrors: string[] = [];
+    for (const file of committed.reverse()) {
+      try {
+        if (file.before) await atomicWriteFile(file.path, file.before);
+        else await rm(file.path, { force: true });
+      } catch (rollbackError) {
+        rollbackErrors.push(
+          `${file.label}: ${(rollbackError as Error).message}`,
+        );
+      }
+    }
+    const suffix = rollbackErrors.length
+      ? `；回滚也有失败：${rollbackErrors.join('；')}`
+      : '；已回滚本次已落盘文件';
+    throw new Error(`${(error as Error).message}${suffix}`);
+  }
+}
+
+async function call(
+  input: ApplyPatchInput,
+  context?: ToolCallContext,
+): Promise<ToolResult> {
+  const cwd = context?.cwd ?? getWorkingDir();
+  let operations: PatchOperation[];
+  let staged: StagedFile[];
+  try {
+    operations = parseApplyPatch(input.patch);
+    staged = await stagePatch(operations, cwd);
+    await commit(staged);
+  } catch (error) {
+    return { ok: false, error: `ApplyPatch 失败：${(error as Error).message}` };
+  }
+
+  const files: FileActivityMetadata['files'] = [];
+  const summaries: string[] = [];
+  for (const file of staged) {
+    const afterText = file.after ?? '';
+    const patch = buildPatchSummary(file.beforeText, afterText, file.label);
+    const metadata = await fileActivityMetadata(
+      file.path,
+      file.activity,
+      'not_run',
+      'support',
+      cwd,
+      patch,
+    );
+    if (metadata) files.push(...metadata.files);
+    if (file.after === undefined)
+      context?.sessionState?.fileReads.entries.delete(file.path);
+    else
+      recordRead(
+        file.path,
+        {
+          contentHash: hashFileBytes(encodeTextFile(file.after, file.encoding)),
+        },
+        context?.sessionState?.fileReads,
+      );
+    emitFileMutation(file.path);
+    summaries.push(
+      `${file.activity}: ${file.label} (+${patch.additions} -${patch.deletions})`,
+    );
+  }
+  return {
+    ok: true,
+    content: `已应用补丁：\n${summaries.map((line) => `- ${line}`).join('\n')}`,
+    ...(files.length
+      ? { metadata: { kind: 'file_activity', files } as FileActivityMetadata }
+      : {}),
+  };
+}
+
+export const applyPatchTool: Tool<ApplyPatchInput> = {
+  name: 'ApplyPatch',
+  description:
+    'Applies one Codex-style *** Begin Patch / *** End Patch transaction across text files. ' +
+    'Supports Add File, Update File, Delete File and Move to. All operations are parsed and validated before writing; runtime failures roll back files already changed by this call. Paths must stay inside the workspace.',
+  inputSchema: schema,
+  parameters: {
+    type: 'object',
+    properties: {
+      patch: {
+        type: 'string',
+        description: 'Complete Codex-style patch envelope',
+      },
+    },
+    required: ['patch'],
+  },
+  isReadOnly: false,
+  isConcurrencySafe: false,
+  maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
+  interruptBehavior: () => 'block',
+  call: (input) => call(input),
+  callWithContext: (input, _signal, context) => call(input, context),
+};

package/src/tools/bash/bash.js

@@ -56,7 +56,7 @@ import { requestUserChoice } from '../../askBridge.js';
 import { classifyCommand } from '../../irreversible/rules.js';
 import { startBackgroundTask } from '../tasks/backgroundTaskService.js';
 import { processExecutionMetadata } from '../tasks/processEvidence.js';
-import { permanentDeleteReason } from '../shared/permanentDeleteGuard.js';
+import { permanentDeleteReason, } from '../shared/permanentDeleteGuard.js';
 import { ToolOutputStore } from '../shared/toolOutputStore.js';
 // ---------------- 0. 常量 ----------------
 const DEFAULT_TIMEOUT_MS = 120_000; // 2 min
@@ -105,6 +105,36 @@ function detectWindowsBash() {
     return null;
 }
 const WIN_BASH = detectWindowsBash();
+/**
+ * 本工具这一刻**真正**把命令交给谁执行。
+ *
+ * 单一出处：description（告诉模型该写哪种语法）与 permanentDeleteGuard（按哪套动词
+ * 匹配删除命令）必须看同一个判断，否则就会出现「description 说这是 cmd、守卫却按
+ * bash 匹配」这种两头对不上的裂缝 —— del / rd 会因此直接穿过全部三层防护。
+ */
+function effectiveShellKind() {
+    return process.platform === 'win32' && !WIN_BASH ? 'cmd' : 'bash';
+}
+/**
+ * 每台机器不同、只能运行时探测的 shell 方言警告（K1 事故修复的核心内容）。
+ * 单一出处：完整 description（下方）和 toolPromptGuides.ts 的压缩 override
+ * 都调这个函数，不允许各自抄一份文案——否则「压缩省 token」的那份会在
+ * 无 Git Bash 的机器上悄悄丢掉这条警告，模型照抄 POSIX 语法必挂
+ * （`mkdir -p` 在 cmd.exe 下不生成中间目录、`$VAR`/`export` 不存在）。
+ */
+export function bashShellNotice() {
+    if (process.platform !== 'win32')
+        return '';
+    return WIN_BASH
+        ? `# Shell (this machine)
+Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
+        : `# Shell (this machine) — IMPORTANT
+No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
+ - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
+ - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
+ - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
+\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`;
+}
 /**
  * G1：stdout / stderr 即时缓冲上限（各自）。命令狂输出（如 cat 大文件 / yes）时，
  * 在最终统一截断之前先把内存封顶，防 OOM。取最终展示截断阈值的 2 倍 —— 正常输出不受影响，
@@ -268,6 +298,7 @@ const parameters = toToolParameters(inputSchema);
 //   - 先点明"专用工具优先"的原则，把每类操作映射到对应工具
 //   - 再列 Bash 自身的使用规范（绝对路径 / 不 cd / 超时 / 多命令并行...）
 //   - 最后强调安全黑名单（让模型知道哪些命令会被拒，避免反复试）
+const shellNotice = bashShellNotice();
 const description = `Executes a given bash command and returns its output.
 
 The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile.
@@ -311,8 +342,11 @@ Some commands return non-zero exit codes for informational (non-error) reasons.
  - \`test\` / \`[\` exit 1 → condition is false (the answer to a question, not a failure)
 Only exit codes ≥ 2 from these commands indicate a real failure. For all other commands, non-zero exit codes are treated as failures normally.
 
-# Safety
-The following command patterns are blocked at the tool level and will fail before execution (no need to try them):
+# Safety - three levels, from strict to lenient
+
+## 1. Blocked outright (fails before execution - do NOT retry with variants)
+
+Catastrophic commands (no legitimate use):
  - \`rm -rf /\` and variants targeting root, $HOME, ~, or system directories (/etc, /usr, /bin, /Windows, /Users, /home, ...)
  - Filesystem destruction: \`mkfs\`, \`format X:\`, \`dd of=/dev/sdX\`, redirects to raw block devices
  - Power management: \`shutdown\`, \`reboot\`, \`halt\`, \`poweroff\`, \`init 0/6\`
@@ -320,23 +354,37 @@ The following command patterns are blocked at the tool level and will fail befor
  - Pipe-to-shell from network: \`curl ... | sh\`, \`wget ... | bash\`, etc.
  - \`chmod 777 /\`, Windows full-disk \`del /s\` / \`rmdir /s\`, \`diskpart\`
 
-If you have a legitimate use case that requires one of the above patterns, ask the user to run the command themselves in their terminal — do not try to bypass the check.
+Permanent deletion (bypasses the OS Trash / Recycle Bin - use the Trash tool instead):
+ - \`rm\`, \`unlink\`, \`rmdir\` (any shell-level file/dir deletion, any target)
+ - \`find ... -delete\`
+ - \`git clean -f\` / \`git clean --force\` (\`-n\` / \`--dry-run\` is fine)
 
-Separately, Bash scans for common destructive-but-recoverable patterns (\`git reset --hard\`, \`git push -f\` / \`--force\` / \`--force-with-lease\`, \`git checkout .\`, \`git restore .\`, \`git clean -f\`, \`git stash drop/clear\`, \`git branch -D\`, \`git commit --amend\` / \`--no-verify\`, \`rm -rf <path>\`, \`DROP TABLE\`, \`TRUNCATE\`, \`DELETE FROM\`, \`kubectl delete\`, \`terraform destroy\`, etc.) and prepends a \`⚠️ 警告:\` line to the output. These commands are NOT blocked — the warning is informational. Treat it as a signal to double-check intent and surface the warning to the user when relevant.${process.platform !== 'win32'
-    ? ''
-    : WIN_BASH
-        ? `
+To delete files or directories use the **Trash** tool (\`action: "move"\` - recoverable); to clean Git untracked files use Trash with \`action: "git-clean"\`.
+Do NOT work around this by switching to \`find -delete\`, Python \`os.remove\`, Node \`fs.rm\`, or other shell variants - they are blocked the same way.
+If a permanent deletion is truly required, ask the user to run it themselves in their terminal.
 
-# Shell (this machine)
-Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
-        : `
+## 2. Requires user confirmation (irreversible)
 
-# Shell (this machine) — IMPORTANT
-No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
- - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
- - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
- - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
-\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`}`;
+These have legitimate uses but destroy the last copy - execution pauses and asks the user to confirm. In non-interactive contexts (sub-agents, cron, batch mode) they are automatically cancelled.
+ - \`git push --force\` / \`-f\`, and \`git push origin +branch\` (+refspec = force push)
+ - \`git push --delete <branch>\` / \`git push :<branch>\` (deleting remote branches)
+ - \`git filter-branch\` / \`git filter-repo\` (rewriting history)
+ - \`git reflog expire --expire=now\` / \`git gc --prune=now\` (destroying reflog)
+ - \`shred -u\` / \`shred --remove\` (overwrite and delete - unrecoverable)
+ - SQL data destruction: \`DROP DATABASE\`, \`DROP TABLE\`, \`TRUNCATE TABLE\`
+
+## 3. Warning only (command still runs)
+
+These execute normally; a \`⚠️ 警告:\` line is prepended to the output as a reminder. They are NOT blocked.
+ - \`git reset --hard\` (reflog keeps it recoverable)
+ - \`git push --force-with-lease\` (rejects if the remote has unseen commits - the safe force-push form)
+ - \`git checkout -- .\` / \`git restore .\` (discards uncommitted changes)
+ - \`git branch -D\`, \`git stash drop\` / \`git stash clear\` (local, recoverable via reflog in most cases)
+ - \`git commit --amend\`, \`git commit --no-verify\`
+ - \`DELETE FROM ...\` (SQL row deletion; DROP/TRUNCATE are in level 2)
+ - \`kubectl delete\`, \`terraform destroy\`
+
+Regular Git operations (commit, add, status, log, diff, pull, fetch, checkout <branch>, merge, rebase, etc.) run without extra restrictions.${shellNotice ? `\n\n${shellNotice}` : ''}`;
 // ---------------- 4. call() —— 真正干活 ----------------
 async function call(input, signal, context) {
     const command = input.command;
@@ -349,7 +397,11 @@ async function call(input, signal, context) {
             error: `安全检查拒绝执行：${forbiddenReason}\n命令：${command}`,
         };
     }
-    const permanentDelete = permanentDeleteReason(command, 'bash');
+    // 传**实际执行命令的 shell**，不是工具名：win32 上找不到 Git Bash 时下面走的是
+    // cmd.exe（见 WIN_BASH 探测），description 也会告诉模型「这里是 cmd」，模型于是写
+    // del / rd —— 按 'bash' 匹配的话这两个词一个都拦不住（黑名单与 irreversible 规则表
+    // 同样只认 POSIX 形态），等于三层全空。
+    const permanentDelete = permanentDeleteReason(command, effectiveShellKind());
     if (permanentDelete)
         return { ok: false, error: `永久删除检查拒绝执行：${permanentDelete}\n命令：${command}` };
     // 4a-1. 不可逆动作闸门：毁掉「最后一份副本」的命令要**停下来问人**。