v0.1.8

• fix(dsh): judge a git command in the directory it actually runs in — the DSH adapter resolved the repository and current branch from the session directory (exec.agent.session.header.cwd) only, so a bash / pwsh call that ran elsewhere was judged against the wrong checkout: from a session rooted on main, git merge develop with workdir set to a feature worktree, cd <worktree> && git merge develop and git -C <worktree> merge develop were refused as "Merging into archive branch(main)", and the reverse (session on a feature worktree, command aimed at the main checkout) was allowed; apply() now starts from the tool's workdir (or cwd) argument, applies leading cd / pushd steps and the gated git command's -C options (new pure resolveSegmentCwds in src/classify.ts, see the next entry for the per-segment rules), and falls back to the session directory's repository when the resolved directory is not inside one; covered by tests/classify.spec.ts and a real-git main checkout + linked worktree suite in tests/index.spec.ts —— DSH 适配层按命令实际运行的目录判定：此前仓库与当前分支只取会话目录（exec.agent.session.header.cwd），在别处运行的 bash / pwsh 调用会按错误的检出判定——会话停在 main 时，workdir 指向 feature worktree 的 git merge develop、cd <worktree> && git merge develop 与 git -C <worktree> merge develop 被误拒为「合并进归档分支 main」，反向（会话在 feature worktree、命令打到 main 检出）则被放行；现 apply() 以工具的 workdir（兼容 cwd）参数为起点，依次应用前导 cd / pushd 与受门禁 git 段的 -C（新增纯函数 src/classify.ts 的 resolveSegmentCwds，逐段规则见下一条），推演出的目录不在任何仓库内时回落到会话目录的仓库；由 tests/classify.spec.ts 与 tests/index.spec.ts 的真实 git 主检出 + linked worktree 用例覆盖。
• fix(dsh): judge every gated segment in its own directory — the first fix resolved one directory (the first gated git segment's -C) and judged the whole command against it, so a later segment that runs elsewhere was never judged where it really runs: from a session on a feature worktree, git -C <archive checkout> merge develop && git push origin feature/x was allowed, and so were git push origin feature/wt && git -C <archive checkout> merge develop and, from a session on the archive checkout, git -C <worktree> merge develop && git merge develop; a step that cannot be resolved statically (cd $VAR, cd ~, cd -, popd, globs, git -C "$D", a subshell or command group) used to fall back to the starting directory, which let cd $VAR && git merge develop through from a feature worktree; resolveSegmentCwds (replaces resolveCommandCwd) now derives the directory of each gated segment separately (workdir / cwd → leading cd / pushd → that segment's own git -C), and apply() denies the command (audited, in the repository's configured locale, and only when a candidate repository has the guard enabled — otherwise it passes through as before) when the gated segments resolve to different directories or when any gated segment's directory cannot be determined statically, and otherwise judges all of them in the one shared directory; a step that cannot be resolved only matters when a gated segment follows it (git merge develop && cd $VAR is still judged as before). Out of scope, unchanged: cd scoping inside command groups and subshells, directories inside wrappers (env / sudo / sh -c / command / builtin) and nested contexts ($(...), backticks, shell keywords such as then / do), --git-dir / --work-tree / GIT_DIR redirection, allowing different subdirectories of one repository, and unifying the command-line hook channels (tracked separately) —— 受门禁段各自按其实际运行的目录判定：上一条修复只推演一个目录（首个受门禁 git 段的 -C）并拿它判定整条命令，后面在别处运行的段从未按真实目录判定——会话在功能工作树时，git -C <归档检出> merge develop && git push origin feature/x、git push origin feature/wt && git -C <归档检出> merge develop 被放行，会话在归档检出时 git -C <工作树> merge develop && git merge develop 同样被放行；无法静态确定的步骤（cd $VAR、cd ~、cd -、popd、通配符、git -C "$D"、子 shell 与命令组）此前回落到起点目录，使功能工作树会话里的 cd $VAR && git merge develop 被放行；现 resolveSegmentCwds（取代 resolveCommandCwd）为每个受门禁段分别推演目录（workdir / cwd → 前导 cd / pushd → 该段自身的 git -C），apply() 在各受门禁段目录不一致、或任一受门禁段的目录无法静态确定时拒绝整条命令（写审计、按仓库配置的语言出文案，且仅当候选仓库中有启用守卫的仓库时才拒绝，否则与此前一样放行），全部一致时按这一个共同目录判定；无法静态确定的步骤只有其后仍有受门禁段时才触发拒绝（git merge develop && cd $VAR 判定不变）。本次不做、行为不变：命令组与子 shell 内 cd 的作用域推演、包装器（env / sudo / sh -c / command / builtin）内部与嵌套语境（$(...)、反引号、then / do 等 shell 关键字）里的目录、--git-dir / --work-tree / GIT_DIR 重定向、同一仓库内不同子目录的跨目录放行、命令行钩子通道的统一（另开议题）；由 tests/classify.spec.ts 与 tests/index.spec.ts 的真实 git 主检出 + linked worktree 用例覆盖（双向不一致 / 同目录不误伤 / 无法确定即拒绝）。