v0.3.2

中文 | English

0.3.2 补丁版本，汇总了自 v0.3.1 以来的主要变更，包括原生文件工具面扩展、安全与原子性层、可选的官方工具接管以及 PTC 与平台默认值调整。

新增功能

• 原生文件工具面从四项扩到十一项：新增 ops_write_file、ops_edit_file、ops_diff、ops_stat、ops_copy、ops_move 与 ops_remove，统一使用单一 path 和 SHA-256 revision/expectedRevision 的 CAS 契约，写文件与编辑支持 dryRun 预览。 @Thatgfsj
• 新增安全与原子性层：替换回执基于实际观察到的字节，合作写者共享持久路径锁，Windows 保留 owner/group/有序 DACL 与受支持属性，Darwin 非空扩展 ACL 在 staging 前以 METADATA_UNSUPPORTED fail-closed，并用 CREDENTIAL_DENIED、PATH_RESTRICTED、AUTHORITY_CHANGED、EXECUTION_RESTRICTED 区分拒绝来源。 @Thatgfsj, @T-Auto
• 新增默认关闭的 dsh-ops/hide-official 组件：只接管 shell/file/ptc 三个面，隐藏有经审查 OPS 等价物的官方工具（read、glob、grep），其余官方工具保持可见并汇总为一条告警。 @Thatgfsj
• PTC 分页与发现性：结果页在投影或过滤之前暴露过期时间、sourceTotal 与稳定有序的 contentHash，过期引用返回 REFERENCE_EXPIRED 并带释放或重新观察的指引，batch 审计页只读且不可释放，执行前重新核对当前权限。 @T-Auto
• 平台默认值调整：PTC 增强默认启用（仍只在纯 PTC 会话发布 ops_batch/ops_result），shell 在三个平台保持启用，严格官方工具隐藏仍保持 opt-in，已有显式配置不会被迁移或覆盖。 @T-Auto
• 新增可选只读 OPS 侧栏 dsh-ops/tui（默认关闭，基于 TUI panel API v1）与数据采集 dsh-ops/panel（所在行默认启用、「启动数据检测」开关默认关闭，写入 <cwd>/.dsh-ops/panel/）；侧栏只浏览有界保留元数据，不打开面板、不执行工具、不获取结果页。 @ccch1mneyyy, @Thatgfsj, @T-Auto
• 新增只读活动投影：内部有界地投影 OPS 原生与 PTC 工具事件，不保存参数或结果体、按会话隔离，只把传输返回标为中性而不宣称业务成功。 @ccch1mneyyy

体验优化

• 文件工具参数 schema 在固定宿主 SDK 中渲染具体类型，SDK 不支持的边界写成描述并由原生校验兜底；ops_glob 执行声明的 limit，ops_grep 拒绝未知 outputMode，inspect 保留 legacy offset 0。 @T-Auto
• ops_grep 的分页改为诚实统计：即使页已填满也继续统计候选集，只物化请求窗口，total/matched/omitted/complete 不再把前缀当成完整结果，非 UTF-8 或超大文件计入 skippedFiles。 @T-Auto
• ops_inspect_local_file 的模型视图对同质页只在顶部共享一次 path，且不修改原始执行/PTC 结果、不删除 revision、分页与截断元数据。 @T-Auto
• 文件工具路由与指导对齐真实原生能力：不再宣传多 range、任意编码或 PDF 文本，summary/count/content 分别对应聚合总量、单文件计数与匹配文本。 @T-Auto
• hide-official 的 strict 不再因为范围外工具缺少等价物而阻塞会话就绪，范围外工具保持可见并汇总告警；只有显式请求范围内无等价物的工具时才以 READINESS_BLOCKED fail-closed。 @Thatgfsj
• hide-official 新增 scope: takeover | extended | off，把接管范围数据化为 63 个固定官方工具名与两个动态前缀；takeover 为默认值，extended 把 additionalOfficialTools 纳入范围，off 让该行不接管任何工具。 @Thatgfsj, @T-Auto
• pwsh 接管改为把 pwshPath 写入官方行的 volatile 配置引用，不再通过 Entry.update() 重挂 pwsh-sandbox，避免重建 permission-presets 后拖垮整个权限服务。 @little3tar
• 配置迁移标记改走 configEditor.edit() 落到 profile 的 patch 层，不再把完整 composed tree 写回 profile 根文件，修复主题/字号回弹以及下次启动整包静默挂载失败。 @Thatgfsj, @Nicholas023
• 凭据围栏按实际覆盖面文档化并扩展：路径级同时覆盖读、写、copy/move 目标与 remove，.env 也不能通过这些工具创建。 @WTStarMark, @Thatgfsj

问题修复

• ops_bash 的参数错误恢复为拒绝：非法参数抛出 BashArgumentError（INVALID_BASH_ARGUMENT）并点名字段，运行时失败仍折叠为携带完整输出 schema 的值。 @Thatgfsj
• 相对 workdir 锚定到会话工作区（绝对路径不变，空或纯空白回退会话目录，Windows 盘符相对路径按会话盘解析或拒绝），工作区已消失时给出 invalid workdir 而不是 Bash 载荷提示。 @Y-fyan, @Thatgfsj
• ops_glob 的 details.modified 改为真正的修改时间（Unix epoch 毫秒，与 ops_stat 的 modifiedMs 同量纲），sort: "modified" 按时间倒序稳定排序，时间戳相同则保持遍历顺序。 @Thatgfsj
• 可被纯快照检查直接拒绝的单文件请求现在在取锁之前失败，write_file/edit_file 的 dry run 完全跳过锁；持久 .dsh-ops-update-<sha256>.lock sidecar 作为声明行为记录并保留。 @WTStarMark

其他变更

• 破坏性变更：移除 dsh-ops/background 组件与只为它存在的 FastCtx 运行时，ops_run、ops_run_background、ops_job_output、ops_job_list 与 ops_job_kill 不再提供；长任务改用宿主 pwsh 的 run_in_background，或在 ops_bash 命令内用 nohup ... & disown 脱离。 @Haoming9527
• 旧 profile 里残留的 dsh-ops/background 行继续加载为 no-op stub：接受任意配置、不发布工具、只记录一条可删除该行的警告；configUpdateVersion: 2 会从已保存的 dsh-ops、dsh-ops/shell 与 dsh-ops/file 行中移除 serverName、enableShellTools、toolCallTimeoutMs。 @Haoming9527
• CLI 精简：resolve、不带 --profile 的 status、build 与 provision 移除并以 exit 2 指向替代命令，ladder 改为报告原生 worker 和 { files, bash, pwsh } 三档；打包不再包含 vendor/fastctx/、FastCtx 平台包与相关脚本。 @Haoming9527
• 公共 dsh-ops/policy 导出随之调整：移除 BACKGROUND_TOOLS 与 SHELL_TOOLS，ladderLevels() 返回 { files, bash, pwsh }，renderToolingPolicy() 不再接受 enableShellTools；许可证与 FastCtx 致谢原文移到 licenses/fastctx/ 并保持原样。 @Haoming9527
• 仓库结构调整：CHANGELOG.md 与 PROVENANCE.md 移入 docs/，新增双语 CONTRIBUTING、issue/PR 模板以及维护者与贡献者章节，图标和头图移入 docs/assets/。 @T-Auto, @Haoming9527, @baobaolaodie
• 发布流程改为门禁化的 GitHub Release：release.yml 重写为带验证的发布工作流，并补充发布流程文档。 @Thatgfsj
• 新增仓库内基准框架与数据面板：比较插件相对干净基线的工具级与模型级成本；它不进入发布包，也不在默认 CI 中运行。 @Thatgfsj, @OldLigant, @Richeir

The 0.3.2 patch release summarizes the main changes since v0.3.1, including the expanded native file surface, the safety and atomicity layer, opt-in official-tool hiding, and PTC and platform-default changes.

New Features

• The native file surface grows from four to eleven tools with ops_write_file, ops_edit_file, ops_diff, ops_stat, ops_copy, ops_move and ops_remove, all sharing one path and a SHA-256 revision/expectedRevision CAS contract, and writes and edits support dryRun previews. by @Thatgfsj
• Add a safety and atomicity layer: replacement receipts hash the bytes actually observed, cooperating writers share a persistent path lock, Windows preserves owner/group/ordered DACL and supported attributes, Darwin fails closed with METADATA_UNSUPPORTED before staging a nonempty extended ACL, and CREDENTIAL_DENIED, PATH_RESTRICTED, AUTHORITY_CHANGED and EXECUTION_RESTRICTED distinguish refusal sources. by @Thatgfsj, @T-Auto
• Add the disabled-by-default dsh-ops/hide-official component: it takes over only the shell/file/ptc faces, hides official tools that have a reviewed OPS equivalent (read, glob, grep), and leaves every other official tool visible with one aggregated warning. by @Thatgfsj
• PTC paging and discoverability: result pages expose expiry, sourceTotal and a stable ordered contentHash before projection or filtering, expired references return REFERENCE_EXPIRED with release or reobserve guidance, batch audit pages are read-only and cannot be released, and current authority is rechecked before execution. by @T-Auto
• Platform defaults change: PTC enhancement is enabled by default (tools still publish only in pure PTC sessions), shell stays enabled on all three platforms, strict official-tool hiding remains opt-in, and existing explicit profile choices are neither migrated nor overwritten. by @T-Auto
• Add the optional read-only OPS sidebar dsh-ops/tui (off by default, built on TUI panel API v1) and data capture dsh-ops/panel (row on by default, capture off by default, writing under <cwd>/.dsh-ops/panel/); the sidebar browses only bounded retained metadata, never opens itself, runs tools or fetches result pages. by @ccch1mneyyy, @Thatgfsj, @T-Auto
• Add a read-only activity projection: an internal bounded projection of live OPS native and PTC tool events that stores no arguments or result bodies, isolates sessions, and labels transport returns neutrally rather than claiming business success. by @ccch1mneyyy

Improvements

• File-tool argument schemas render concrete types in the pinned host SDK, with SDK-unsupported bounds expressed as descriptions backed by native validation; ops_glob enforces its advertised limit, ops_grep rejects unknown outputMode values, and inspect keeps legacy offset 0 working. by @T-Auto
• ops_grep paging now counts honestly: it keeps counting the candidate set after a page fills while materializing only the requested window, total/matched/omitted/complete no longer claim a prefix is a complete result, and non-UTF-8 or oversized files are reported through skippedFiles. by @T-Auto
• The ops_inspect_local_file model view shares a homogeneous page's path once at the top level without mutating the raw execution/PTC result or dropping revision, paging and truncation metadata. by @T-Auto
• File-tool routing and guidance now match the real native surface: multiple ranges, arbitrary encodings and PDF text are no longer advertised, and summary/count/content mean aggregate totals, per-file counts and matching text. by @T-Auto
• hide-official with strict no longer blocks session readiness for out-of-scope tools without an equivalent; those stay visible with an aggregated warning, and only an explicit request for an in-scope tool without an equivalent fails closed with READINESS_BLOCKED. by @Thatgfsj
• hide-official gains scope: takeover | extended | off, making the takeover scope data-driven over 63 pinned official tool names and two dynamic prefixes; takeover is the default, extended promotes additionalOfficialTools into the scope, and off takes over nothing. by @Thatgfsj, @T-Auto
• The pwsh takeover now commits pwshPath into the official row's volatile config reference instead of remounting pwsh-sandbox through Entry.update(), avoiding a rebuilt permission-presets that would break the whole permission service. by @little3tar
• The config-update marker now goes through configEditor.edit() into the profile's patch layer instead of writing the whole composed tree back into the profile root file, fixing theme/font-size bounce and a silent whole-bundle mount failure on the next start. by @Thatgfsj, @Nicholas023
• The credential fence is documented and extended to its real reach: path-based coverage includes reads, writes, copy/move destinations and remove, and a .env cannot be created through these tools either. by @WTStarMark, @Thatgfsj

Bug Fixes

• ops_bash argument errors are refusals again: an invalid argument raises BashArgumentError (INVALID_BASH_ARGUMENT) naming the field, while a runtime failure is still folded into a value carrying the full output schema. by @Thatgfsj
• A relative workdir now anchors to the session workspace (absolute paths unchanged, empty or whitespace falls back to the session directory, and a Windows drive-relative path resolves against the session's drive or is refused), and a vanished workspace reports invalid workdir instead of the missing-payload remedy. by @Y-fyan, @Thatgfsj
• ops_glob's details.modified now reports a real modification time (milliseconds since the Unix epoch, the same quantity as ops_stat's modifiedMs), and sort: "modified" orders newest first, stably, so equal timestamps keep the walk order. by @Thatgfsj
• Single-file requests that a pure snapshot check can reject now fail before taking the lock, write_file/edit_file dry runs skip the lock entirely, and the persistent .dsh-ops-update-<sha256>.lock sidecar is documented and retained as declared behaviour. by @WTStarMark

Chores

• Breaking change: the dsh-ops/background component and the FastCtx runtime that existed only for it are removed, so ops_run, ops_run_background, ops_job_output, ops_job_list and ops_job_kill are gone; use the host pwsh tool's run_in_background or detach inside an ops_bash command with nohup ... & disown. by @Haoming9527
• A leftover dsh-ops/background row keeps loading as a no-op stub that accepts any config, publishes nothing and logs one warning that the row can be deleted, while configUpdateVersion: 2 removes serverName, enableShellTools and toolCallTimeoutMs once from saved dsh-ops, dsh-ops/shell and dsh-ops/file rows. by @Haoming9527
• The CLI shrinks: resolve, status without --profile, build and provision are removed and exit 2 with the command that replaces each, ladder reports the native worker and { files, bash, pwsh }, and packaging no longer includes vendor/fastctx/, the FastCtx platform packages or the related scripts. by @Haoming9527
• Public dsh-ops/policy exports change accordingly: BACKGROUND_TOOLS and SHELL_TOOLS are removed, ladderLevels() returns { files, bash, pwsh }, renderToolingPolicy() no longer takes enableShellTools, and the licence and FastCtx attribution move verbatim to licenses/fastctx/. by @Haoming9527
• Repository layout changes: CHANGELOG.md and PROVENANCE.md move into docs/, a bilingual CONTRIBUTING, issue/PR templates and maintainers/contributors sections are added, and the icon and header artwork move to docs/assets/. by @T-Auto, @Haoming9527, @baobaolaodie
• The release process becomes a gated GitHub Release: release.yml is rewritten as a verified release workflow, with release-process documentation added. by @Thatgfsj
• Add a repository-only benchmark harness and data panel that compare the plugin's tool-level and model-level cost against a clean baseline; it is not shipped and does not run in default CI. by @Thatgfsj, @OldLigant, @Richeir

Full Changelog: v0.3.1...v0.3.2