rolebox v2.2.0

2.2.0 makes graph workers use the declaring session's capabilities directly: they inherit the parent's authorized task tools with native schemas by default, load references through the same role-scoped loader as skills, receive each node's outcome contract on every dispatch, and get turn recall and session focus when their memory tools are authorized. On dsh, workers now run commands and file operations through the host's own tools — rolebox's graph_worker_exec runner, its sandbox seam and the per-attempt resource copy are gone — and the worker's role text moves into one agent-scoped system section. The release also ships the packaged rolebox-config skill, adds window targeting and geometry-verified image-pixel mapping to the computer_* family, fixes the dsh presentation-metadata and teammate-cleanup failures and classifies browse_eval page errors, and speeds up hashline reads and edits. The two behavior changes an existing declaration or automation may notice are recorded under Upgrade Notes.

Upgrade Notes

• A graph node's tools list no longer restricts worker task tools — the declaration still parses, but a list, including tools: [], is accepted as legacy metadata that neither restricts, grants nor registers anything. Every worker now inherits the parent session's authorized task tools and exposes their native schemas; parent permissions, role policy, host registration, approval handling and the execution guard still apply, and discovery or code presentation remains opt-in. A declaration that used a list to withhold a tool must express that restriction in the parent or role policy instead. Reference: docs/worker-tools.md.

• dsh graph workers run commands, file operations, builds and tests through the host's native tools, and graph_worker_exec is removed — the host's native command and file tools (for example bash) now carry the command surface, with the host owning the environment, working directory, sandbox policy, approvals, timeout and cancellation; the disposable environment that hid credentials and host state is gone. Role skills and references are no longer copied into a per-attempt private directory and load through load_role_skill and load_reference at their original paths. A worker keeps graph_submit_outcome alongside the parent-authorized native tools. A prompt or workflow that called graph_worker_exec must name the host's command tool instead. Reference: docs/graph-outcome-protocol.md; docs/worker-tools.md.

Features

• Graph workers inherit the parent's authorized task tools and load references by exact name — an omitted tools list used to inherit the catalog while tools: [] withheld every additional task tool; both now resolve to the parent's authorization, and the worker's default presentation exposes the inherited native schemas rather than a discovery surface. load_reference({ name }) loads a role, skill or visible nested sub-agent reference with the same visibility as load_role_skill, returns its full content and resolved path, lists only visible names on a miss, and prefers deeper sub-agent resources on a name collision; skill and reference listings now name their loader and search fallback, and prompts direct agents to the loaders instead of reading private copies through a command tool. native, discover and code presentation remain available explicitly, with up to 32 preloaded exact names. Reference: docs/worker-tools.md; docs/references.md.

• Every graph dispatch carries the node's compiled outcome contract — DSH, Pi and OpenCode 1/2 deliver the node's outcomes, each outcome's optional data.schema identity and exact version, its ordered acceptance gates and the declared completion policy in the attempt handoff. The runtime reads the contract from the immutable plan on initial, successor, retry and recovery dispatches, so a node prompt no longer has to restate the contract or the host's settlement rules. A schema reference names an executable host validator, not a field-level JSON Schema document — the shipped json-object@1, for example, accepts any non-null, non-array object — and roles still own their report fields, outcome meanings and evidence. Reference: docs/graph-outcome-protocol.md.

• A dsh graph worker receives turn recall and the session-focus block when its memory tools are authorized — the worker gets the same ## Relevant memory and ## Session focus contributions as an ordinary session when the role's tool policy and the inherited grant both allow the memory tools, and every hint names only the tools the worker actually holds. Previously all workers were skipped, even one whose parent had granted memory access, so worker continuity rested on the dispatch prompt alone. The LLM query scout remains excluded from worker sessions; deterministic recall still applies. Reference: docs/memory.md.

• The worker's role, active functions and resource guidance arrive as one agent-scoped system section — DSH registers them once in a rolebox:role system section before the child's first request, shadowing the inherited role section and preserving literal template text, while the dispatch message keeps only execution guidance, the task, the outcome contract, the attempt handoff and upstream inputs. Role text is never pasted into conversation content, the credential, task and accepted inputs stay out of the system prompt, and a worker without a scoped system-prompt registry now fails instead of falling back to role text in the message. OpenCode 1/2 replace the registered role text in their system hook with the worker-specific prompt and keep surrounding host instructions intact; Pi is unchanged. Worker guidance now separates a validation rejection — correct the reported issues before resubmitting — from a permission denial, which must never be retried or widened and is reported through a declared outcome, and JSON fallback applies only to explicit or unspecified completion, requires a normally completed final turn and settles nothing by itself. Reference: docs/graph-outcome-protocol.md.

• The package ships the built-in rolebox-config skill in every installed harness home — skills/rolebox-config and its five references are included in the npm package and linked into each existing harness home's global skills/ directory at install, rolebox sync <target> and host startup, so an agent can configure rolebox without a source checkout. User-owned files and directories at the destination are preserved and reported, a stale package link is refreshed after an upgrade, absent harness homes are not created, and one host's unavailable home never blocks installation or startup. The guide stays outside the rolebox-- role-skill namespace and can be added to a role's resource catalog explicitly with opencode_skills: [rolebox-config]. Reference: docs/skills.md.

• computer_* screenshots now map image pixels to the desktop, and all six input tools can target a window — every capture returns screenshot_id, screen_bounds, origin and per-axis pixel_scale_x/pixel_scale_y, and passing the id to computer_click, computer_move, computer_drag or the coordinate form of computer_scroll maps image pixels, rounds them inside the capture and refuses points outside the image or in monitor gaps. Captures sample window and display geometry before and after writing the image and guarded input re-checks it after focusing, so a moved or resized window, changed monitor layout or scale change rejects the stale screenshot before any input; ids are scoped to the session, workspace and platform, expire after ten minutes and hold at most 64 snapshots. window_id is accepted on macOS, Windows and X11 by all six input tools, and every targeted call brings the window forward and verifies focus in the same helper command — targeting is foreground focus, not background input, and no selection is remembered. Windows discovery now lists each visible top-level window and monitor directly, and X11 lists RandR monitors on the current DISPLAY screen. Reference: docs/computer-use.md and screenshots and coordinates.

Bug Fixes

• A dsh presentation callback that returns no display metadata no longer fails an otherwise successful call — the installed runtime validates a declared projector's meta as lossless JSON, so returning undefined rejected a plain-text web_fetch or interactive_terminal result at the host boundary even though the tool body had completed. Those tools now return null when a result has no display metadata and let presentResult use the host's generic row; the callback contract is documented and covered against the installed runtime for both tools, including their metadata-bearing actions and an argument-correction reply. Reference: docs/dsh-plugin-contract.md.

• Removing or deleting a teammate that DSH restored itself now releases the team identity instead of failing — forget() threw when a member had no adapter-owned handle, so removing a host-restored peer left its descriptor and lease in place. Cleanup now clears queued team deliveries and flushes while keeping the host's session and pending user input intact, still defers on a foreign lease, and can retry after a failed flush. Reference: docs/team-work.md.

• browse_eval classifies page script exceptions as correctable evaluation failures — an identifiable page exception or rejected Promise now reports metadata.code: "script_error" with guidance to fix the expression or the page/DOM state, while navigation and detached-frame interruptions report execution_context_destroyed; browser_closed, timeout, cancelled and protocol_error keep their existing meanings, and an ambiguous failure — including a thrown primitive without JavaScript error markers — is not reported as script_error. The original first error line is preserved, a script error leaves the page open, and a timeout or cancellation still closes it. Reference: docs/browser-use.md.

Performance

• hashline_read reuses a bounded read snapshot and hashes valid UTF-8 LF text directly — a warm read compares the freshly read text before reusing its snapshot, a window is indexed without splitting the whole file into lines, and the line-hash path avoids redundant normalization while preserving anchor encoding, canonical SHA-256 versions, CR/malformed-UTF-8 handling and line-ending restoration; a changed or unreadable file invalidates the cache.

• hashline_edit shares one line snapshot and one Myers diff per edit report — compact diff frontiers and reuse of the text validated by the fresh pre-write read avoid redundant work on large files while version rejection, reanchors, diff output and write behavior stay unchanged.