v0.2.2-rc.1 - Runtime Fingerprinting, Finite Recovery, Mutation Policy & Soft Tool Requirements / 运行时指纹、有限恢复、文件写改控制与软工具要求

[English]

1. Zero-Disruption Replacement & Runtime Fingerprinting

• Official Core Preserved: Keeps official DSH 0.2.2-rc.1 agent loop core byte-identical, seamlessly replacing it via cordis.patch.yml and profile bundle linkage.
• Deterministic Tool Fingerprinting: Computes 16-hex hashes (tool_name | op_class | norm_path | status_code | size_bucket) and invocation keys with normalized arguments to track repeat streaks without false positives.
• Enforce Mode by Default: Defaults runtimePolicy.mode to enforce, intercepting unprogressive tool loops with structured rejection responses (NO_PROGRESS) and actionable nextAction guidance.
• Windows Anti-ENAMETOOLONG Guard: Pre-execution interceptor for bash tool invocations blocking oversized command arguments (> 4KB) or embedded multiline heredocs/scripts, proactively preventing Node.js spawn ENAMETOOLONG crashes.

2. Finite Failure Recovery (No Model Regeneration)

• Safe Literal Re-dispatch: Encapsulates failed large write calls into single-use memory RecoveryRecords, stripping invalid keys and retrying directly through the official execution pipeline.
• Finite Attempt Limits: Strictly caps retries to 1 attempt; automatically invalidates recovery on mutating operations, turn endings, or cwd changes, eliminating infinite retry loops.

3. Smart File Mutation Policy

• Observe & Enforce Modes: Intelligently categorizes filesystem operations; safely allows new files, small writes, and generator builds while detecting risky full-file rewrites on known existing files.
• Host Callback Authorization: Provides an extensible callback interface to explicitly authorize whole-file replacements or generated build artifacts.

4. Two-Stage Soft Tool Requirements

• Low-Cost Steering: Injects a single efficiency reminder on the first tool detour; blocks side-effecting detours on subsequent violations while permitting read-only exploration.
• Clean State Isolation: Two-stage satisfaction tracking (staged on dispatch, committed on success) with guaranteed state clearance on turn end.

---

[中文]

1. 官方内核零侵入替换与运行时调用指纹

• 官方核心字节级纯洁：保留官方 DSH 0.2.2-rc.1 循环实现完全不变，通过 cordis.patch.yml 补丁编排与 Profile 本地软链接无缝接管运行时。
• 确定性工具指纹与调用哈希：基于 tool_name | op_class | norm_path | status_code | size_bucket 计算 16 位 Hex 指纹，并结合参数归一化哈希精准识别真实重复调用，杜绝跨命令误判。
• 默认启用 Enforce 阻断：runtimePolicy.mode 默认启用 enforce，在持续无进展循环时输出标准结构化错误（NO_PROGRESS）并明确提供下一步行动指引。
• Windows 防 ENAMETOOLONG 预执行拦截：在 tools/pre-execute 阶段对 bash 命令参数做安全阈值拦截（> 4KB 超长命令或内联 heredoc/大段脚本），彻底杜绝系统级 spawn ENAMETOOLONG 崩溃。

2. 内存级有限恢复（消除模型无谓重生成）

• 字面量参数安全重放：大段 write 发生参数校验错误时，自动提炼为内存单次有效的 RecoveryRecord，通过现有流水线直接重放，无需模型再次消耗思考轮次生成相同大文本。
• 有限尝试与生命周期强约束：严格限制单次恢复尝试；遇到产生副作用的工具、轮次结束或工作目录变更时自动失效，彻底杜绝死循环。

3. 文件写改策略（先观察后强制）

• 观察与拦截双模式：智能识别新文件创建、小型编辑与构建生成产物并安全放行，精准监测针对已有大文件的整文件全量重写风险。
• 宿主显式放行接口：提供可靠的 Host Callback 扩展契约，支持在特定构建与全量重写场景下显式放行。

4. 两阶段软工具要求约束

• 低成本单次引导：模型首次偏离推荐工具时仅在必要请求中注入单次软提醒；二次违规时严格拦截产生副作用的绕路工具，同时放行只读证据收集。
• 严格状态隔离与清理：执行前暂存、执行成功后提交，并在轮次结束时完整回收状态，确保跨会话、跨轮次零污染。