v0.4.1

中文 | English

0.4.1 补丁版本，汇总了自 v0.4.0 以来的主要变更。

问题修复

• 更新锁释放时由持有者删除 .dsh-ops-update-*.lock 边车：先重新打开名字并比较 (device, inode)，只有绑定成功的持有者才能发布，并且只在仍持锁且名字仍指向自己的 inode 时 unlink；成功写入、拿锁后被拒的请求与整目录 replace 都不再留下文件，被硬杀留下的边车会被下一次同名写入复用并清除。 @T-Auto
• 恢复 ops_bash 的后台任务：run_in_background 不再必然报 EXECUTOR_UNAVAILABLE，改为经 ctx.inject(['jobs'], …) 绑定一次宿主 jobs 注册表并传入工具定义，前台超时也能提升为后台。 @T-Auto
• 面板采集恢复时先计入已有追加日志或新会话头部的字节，再接纳排队事件；恢复已封顶日志不再追加事件或重复的封顶标记，日志初始化失败即停止该会话采集，JSON 解析丢失记录时标记采集降级与用量不完整并保留有效记录。 @ccch1mneyyy
• PTC 批量审计不再为审计记录创建前的已确认校验失败、或工作进程创建前的同步失败返回不存在的引用，同时保留 worker 返回的引用、已有 resume 标识与执行中断或状态不明时的恢复标识，且不增加 worker 调用。 @ccch1mneyyy

The 0.4.1 patch release summarizes the main changes since v0.4.0.

Bug Fixes

• The .dsh-ops-update-*.lock sidecar is now removed on release by the writer that holds it: the holder reopens the name and compares the (device, inode) identity, only a bound holder publishes, and it unlinks only while still holding the lock on the inode the name carries. Published writes, requests refused after the lock and directory-wide replace calls leave nothing behind, and a sidecar left by a killed writer is reused and removed by the next write of that name. by @T-Auto
• Restore ops_bash background jobs: run_in_background no longer always fails with EXECUTOR_UNAVAILABLE. The host jobs registry is bound once through ctx.inject(['jobs'], …) and passed into the tool definition, and a foreground timeout can now promote the command to the background. by @T-Auto
• Panel capture recovery now counts the bytes already written to the append log or the new-session header before admitting queued events. Recovering a capped log no longer appends events or duplicate cap markers, a failed log open stops that capture, and JSON parse losses now mark the capture degraded and usage incomplete while preserving valid records. by @ccch1mneyyy
• PTC batch audits no longer return references for confirmed validation failures that occur before the audit record is created, or for synchronous failures before the worker starts. Worker-provided references, existing resume identities and recovery ids for interrupted or ambiguous execution are preserved, and no additional worker calls are made. by @ccch1mneyyy

Full Changelog: v0.4.0...v0.4.1

v0.4.0

中文 | English

作为 0.4.0 系列的首个正式版本，本版本汇总了自 v0.3.0 以来的主要用户和开发者相关变更，包含 0.3.1、0.3.2 中已发布的修复。

新增功能

• 支持三个发布目标：win32-x64、linux-x64 与 Apple Silicon 的 darwin-arm64，发布门禁对三个平台的 worker 与载荷做闭包校验。 @null-characters, @Thatgfsj
• 原生文件工具面从四项扩至十一项：新增 write_file、edit_file、diff、stat、copy、move 与 remove，并补齐参数 schema 与单一 path、SHA-256 修订检查的 CAS/dryRun 契约。 @Thatgfsj
• 新增写出安全与原子性层：修订检查、原子发布、元数据保留、协作锁，以及如实报告 effectState 的部分副作用。 @Thatgfsj
• 新增可选 hide-official 组件：按 replaceTools 逐项用 ops_* 工具替换官方 read、glob 或 grep，默认关闭，未选中的官方工具保持可见。 @Thatgfsj, @Haoming9527
• 新增凭据围栏：默认拒绝读取 ~/.ssh、~/.aws 等凭据位置与密钥材料，遍历按身份跳过这些目录；路径级围栏同时覆盖读、写、copy/move 目标与 remove，临时写根从共享系统临时目录收窄到会话私有目录（mode 0700）。 @WTStarMark, @Thatgfsj
• 新增可选只读 TUI 侧栏：有界会话活动投影、全会话异常徽标、聚焦筛选与本地活动页。 @ccch1mneyyy
• Native 文件结果改为带物理行号的有界文本：转义后上限 64 KiB，截断时给出恢复提示，非法编码返回 ERR_INVALID_ENCODING。 @Haoming9527
• 新增批量文件能力：一次读取 1–32 个 UTF-8 范围，以及单文件内的原子多段编辑（ops_read_files 与 ops_edit_file）。 @Haoming9527
• 会话私有结果引用：ref://session/tool/uuid、单结果 10 MiB 与会话 100 MiB 配额、序列化 LRU 与独立审计，Native 侧提供引用分页与释放。 @Haoming9527
• PTC 返回可收窄的完成/部分/失败结果信封，并按需加载由同一份 schema 生成的 dsh-ops/ptc-sdk 类型声明。 @Haoming9527
• 新增 dsh-ops/discovery 组件与 ops_discover_tools：允许池、单次 1–5 项上限、始终加载选择，高级工具只在下一个模型步骤边界发布。 @Haoming9527
• 新增有界 CSV/TSV、DOCX 正文段落与经典 PDF 文本页读取，按需通过 Native 与 PTC 暴露，并保留精确的行/页/字节预算与安全前缀。 @Haoming9527
• bundle 增至七行（含 discovery 行），并提供可选双语浏览器设置页与经校验的持久化表单，覆盖运行时清单、Bash 选择、逐工具替换与发现池。 @Haoming9527
• ops_bash 复用宿主的单次审批、后台作业、超时提升与子进程治理，要求命令描述，并支持前台超时提升为后台任务。 @Haoming9527
• 新增可选数据采集组件 dsh-ops/panel：「启动数据检测」开关默认关闭，开启后把会话事件写入 <cwd>/.dsh-ops/panel/，可配合查看器离线阅读。 @Thatgfsj
• 新增 dsh-ops panel [--serve] [dir] [--port <n>]：在回环地址服务一个采集目录与随包查看器，默认选中最新有效报告，拒绝格式错误的报告与目录外路径。 @ccch1mneyyy
• 新增仓库内基准框架与数据面板，用于比较插件相对干净基线的工具级与模型级成本；它不参与发布，也不在默认 CI 中运行。 @Thatgfsj, @OldLigant, @Richeir

体验优化

• Native 启动只常驻多文件读取器，单文件/hex、搜索、修改与引用分页按需发现，路由只描述已发布的工具。 @Haoming9527
• 单文件与多文件重读在上一轮请求包含准确正文且逐文件重新验证后省略重复行，压缩、脱敏、权限变化或证据不足时恢复全文。 @Haoming9527
• 搜索区分扫描覆盖与分页结果，统计跳过原因；缺口存在时不提供全量总数，续取会校验查询、权限与观察到的文件状态。 @Haoming9527
• 渐进式工具发布在会话提交步骤结束后、宿主捕获下一次供应商 schema 之前完成，避免多延迟一轮。 @Haoming9527
• PTC 结果页提供过期时间、来源总数与稳定排序的 contentHash；过期引用返回 REFERENCE_EXPIRED 与释放或重新观察的指引。 @T-Auto
• 文件工具的 schema 与描述对齐真实契约，grep 分页不再声称前缀是完整搜索结果，inspect 的紧凑渲染共享同页路径。 @Haoming9527, @T-Auto
• 表格与文档读取在文件结束和元数据变化后只报告实际覆盖，保留安全前缀且不伪造续取。 @Haoming9527

问题修复

• ops_bash 参数错误恢复为明确拒绝（INVALID_BASH_ARGUMENT），运行失败仍返回符合输出 schema 的结构化值。 @Thatgfsj
• 相对 workdir 锚定到会话工作区；工作区消失或 spawn ENOENT 时给出准确诊断，而不再默默在错误目录执行。 @Y-fyan, @Thatgfsj, @ViscaOwO
• ops_glob 的 details.modified 改为真实修改时间（Unix 毫秒），sort: "modified" 按最新优先稳定排序。 @Thatgfsj
• 单文件请求在创建更新锁边车前完成快照检查，write_file 与 edit_file 预演不再取锁。 @WTStarMark
• hide-official 的 strict 不再因范围外工具缺少等价物阻塞会话就绪，只在其三个面内隐藏有审阅替代项的工具。 @Thatgfsj
• pwsh 接管改为原地写入 volatile 引用，不再重挂 pwsh-sandbox 行并重启宿主执行器。 @little3tar
• 配置更新标记写入 profile 的 patch 层，不再回写整个合成树而破坏主题、字号与其他插件行。 @Thatgfsj, @Nicholas023
• ops_replace 保留文件 mode、owner、POSIX ACL 与扩展属性，替换后不再意外改变权限或丢失执行位。 @Thatgfsj, @T-Auto
• ops_grep 的 multiline 真正跨行匹配，长行匹配改为两遍有界处理，不再因内存上限中止整次调用。 @Thatgfsj
• ops_replace 在读取-检查-发布窗口持有独占锁，并发写入返回 REVISION_CONFLICT 而不是静默丢失一次修改。 @Thatgfsj
• Windows 更新锁改为通过锁句柄读取当前字节，普通 replace 不再因自身读取被锁拒绝。 @Thatgfsj
• 工作区准备失败给出可诊断原因，继承的 PSModulePath 不再传给 Windows PowerShell 5.1 进程。 @Haoming9527, @CNyaotian-Lunar
• 文件工具读写上报宿主的文件观察表，native 工具不再传递空的占位参数。 @Haoming9527
• 恢复 ops_bash 后台任务：run_in_background 经宿主 jobs 注册表受理，前台超时可提升为后台。 @T-Auto
• 安装与卸载在预演和执行前统一校验 profile CLI 启动器，拒绝缺失或不可用的启动文件与 Node bin 入口。 @ccch1mneyyy
• 修复生成的 ops_load_sdk 声明（构建脚本仍按改名前的 sdk 判定），并覆盖改名别名与 select:、SDK 请求路径。 @Thatgfsj

其他变更

• 移除 FastCtx 后台组件及其工具、CLI 命令与打包；遗留的 dsh-ops/background 行以 no-op 存根加载并给出删除提示。 @Haoming9527
• 一次性 worker 请求升级为带版本的 v1 协议：逐调用 ID、组件来源与执行/输出预算，副作用前拒绝格式错误的信封。 @Haoming9527
• hide-official 配置改为 replaceTools 逐项选择，旧 strict、scope 与 additionalOfficialTools 保留校验但不再生效。 @Haoming9527, @T-Auto
• PTC 增强默认启用；Native/hybrid 会话不受影响，也不会获得批处理或引用工具。 @T-Auto
• 首次安装的默认值：shell 行在三个受支持平台默认开启，panel、TUI 与逐项替换默认关闭；Windows 使用主包声明的固定 Bash npm 载荷，Linux 与 macOS 使用发行版 Bash。 @Thatgfsj
• PowerShell 交回宿主管理：移除 PowerShell 载荷依赖与执行器覆盖，新增 upgrade-host-pwsh 命令（默认预览、显式执行）。 @Haoming9527
• 0.4.0 工具统一重命名为 verb_noun 形式（如 read_files、load_sdk、discover_tools），用户配置中的旧名会静默迁移。 @Nicholas023
• 插件源码迁入 src/，lib/ 成为构建产物；全部插件源码完成严格 TypeScript 迁移，打包时拒绝未导入的 JavaScript 源码。 @Haoming9527
• 更新 windows-sys 与 GitHub Actions 依赖到兼容版本。 @dependabot

As the first stable release in the 0.4.0 series, this version summarizes the major user- and developer-facing changes since v0.3.0, including the fixes published in 0.3.1 and 0.3.2.

New Features

• Support three release targets: win32-x64, linux-x64 and darwin-arm64 for Apple Silicon, with release gating that closes over the workers and payloads of all three platforms. by @null-characters, @Thatgfsj
• Grow the native file tool surface from four to eleven tools by adding write_file, edit_file, diff, stat, copy, move and remove, with complete parameter schemas and a single-path, SHA-256 revision-checked CAS/dryRun contract. by @Thatgfsj
• Add a write-safety and atomicity layer: revision checks, atomic publication, metadata preservation, cooperative locks, and honest effectState reporting for partial effects. by @Thatgfsj
• Add an optional hide-official component that replaces official read, glob or grep per tool with ops_* counterparts through replaceTools; it is disabled by default and unselected official tools stay visible. by @Thatgfsj, @Haoming9527
• Add a credential fence: reads of credential locations such as ~/.ssh and ~/.aws and of key material are refused by default, traversals skip those directories by identity, and the path-level fence also covers writes, copy/move destinations and remove; the temporary write root narrows from the shared system temp directory to the session's private directory (mode 0700). by @WTStarMark, @Thatgfsj
• Add an optional read-only TUI sidebar with a bounded session activity projection, all-session anomaly badges, focused filters and local activity pages. by @ccch1mneyyy
• Render Native file results as bounded text with physical line numbers: content is capped at 64 KiB after escaping, clipping carries recovery guidance, and invalid encodings return ERR_INVALID_ENCODING. by @Haoming9527
• Add batch file capabilities: 1–32 UTF-8 ranges in one read, and atomic multi-range edits within one file (ops_read_files and ops_edit_file). by @Haoming9527
• Add private session result references (ref://session/tool/uuid) with a 10 MiB per-result and 100 MiB per-session quota, a serialized LRU and separate durable audits, plus Native-side reference paging and release. by @Haoming9527
• PTC returns discriminated completed/partial/failure outcome envelopes and loads dsh-ops/ptc-sdk type declarations generated from the same schemas on demand. by @Haoming9527
• Add the dsh-ops/discovery component and ops_discover_tools with an allowed pool, a 1–5 per-call cap and always-loaded selections; advanced tools publish only at the next model-step boundary. by @Haoming9527
• Add bounded CSV/TSV, DOCX main-body paragraph and classic PDF text-page readers, exposed on demand through Native and PTC with exact row, page and byte budgets and safe prefixes. by @Haoming9527
• Grow the bundle to seven rows with a discovery row, and add optional bilingual browser settings pages plus validated persistent forms covering runtime inventory, Bash selection, per-tool replacements and discovery pools. by @Haoming9527
• Make ops_bash reuse host per-call approvals, background jobs, timeout promotion and subprocess governance, require a command description, and let a foreground timeout promote the command to the background. by @Haoming9527
• Add an optional dsh-ops/panel data-capture component: the “start data detection” switch is off by default, and once enabled it writes session events to <cwd>/.dsh-ops/panel/ for offline reading with the viewer. by @Thatgfsj
• Add dsh-ops panel [--serve] [dir] [--port <n>]: serve one capture directory and the shipped viewer on loopback, preselect the newest valid report, and refuse malformed reports and paths outside the directory. by @ccch1mneyyy
• Add a repository-only benchmark harness and data panel that compare the plugin's tool-level and model-level cost against a clean baseline; it is not part of a release and does not run in default CI. by @Thatgfsj, @OldLigant, @Richeir

Improvements

• Keep the Native startup surface to the multi-file reader; the single-file/hex reader, search, mutations and reference paging become discoverable, and routing describes only published tools. by @Haoming9527
• Omit repeated line bodies on single- and multi-file re-reads when the latest completed request carries the exact prior text and every file revalidates, restoring full output after compaction, redaction, authority changes or uncertain evidence. by @Haoming9527
• Report search scan coverage separately from page delivery and count skip reasons; totals are withheld when gaps exist, and continuations revalidate the query, authority and observed filesystem state. by @Haoming9527
• Publish progressive tools after the session commits a step and before the host captures the next provider schema, avoiding an extra delayed round. by @Haoming9527
• PTC result pages expose expiry, source totals and a stable content hash in row order; expired references return REFERENCE_EXPIRED with release/reobserve guidance. by @T-Auto
• Align file-tool schemas and descriptions with the real contracts, stop grep pages from claiming a prefix is a complete search result, and share a homogeneous page's path in compact inspect rendering. by @Haoming9527, @T-Auto
• Report only actual table and document coverage beyond EOF and after metadata changes, keeping safe prefixes w...

v0.4.0-alpha1

中文 | English

作为 0.4.0 系列的首个预览版本，本版本汇总了自 v0.3.2 以来的主要用户和开发者相关变更。

新增功能

• 新增统一的能力目录与类型化契约：工具名称、归属、呈现方式、并发与 schema 集中在一处，并加入 Outcome、搜索覆盖与结果引用类型以及明确的错误/重试策略。 @Haoming9527
• Rust 内核拆分为 ops-protocol、ops-files、ops-search、ops-batch、ops-results 与 ops-documents 等 workspace crate，仍按调用启动一次性 worker，并保留原有的权限、元数据、no-follow 与审计规则。 @Haoming9527
• 一次性 worker 请求升级为带版本的 v1 协议：逐调用 ID、组件来源与执行/输出预算，副作用前拒绝格式错误的信封。 @Haoming9527
• Native 文件结果改为带物理行号的有界文本：转义后上限 64 KiB，截断时给出恢复提示，非法编码返回 ERR_INVALID_ENCODING。 @Haoming9527
• 新增 ops_read_many 多文件范围读取（单次 1–32 个 UTF-8 范围，逐文件报告版本与错误）与 ops_edit_many 对单个文件的原子多段编辑（与 ops_edit_file 同语义）。 @Haoming9527
• 搜索区分扫描覆盖与分页结果，统计跳过原因；存在读取、编码、大小或预算缺口时不再提供全量总数，续取会校验查询、权限与观察到的文件状态。 @Haoming9527
• 新增会话私有结果引用 ref://session/tool/uuid：单结果 10 MiB、单会话 100 MiB 配额、序列化 LRU 与独立审计，超大输出以可无损重建的分块快照保存。 @Haoming9527
• Native 文件工具新增引用分页与释放，绑定当前会话目录、权限与可见的生产工具。 @Haoming9527
• PTC 返回可收窄的完成/部分/失败结果信封，并按需加载由同一份 schema 生成的 dsh-ops/ptc-sdk 类型声明。 @Haoming9527
• 新增 dsh-ops/discovery 组件与 ops_discover：允许池、单次 1–5 项上限与始终加载选择，高级工具只在下一个模型步骤边界发布。 @Haoming9527
• 新增有界 CSV/TSV、DOCX 正文段落与经典 PDF 文本页读取，通过 Native 与 PTC 按需暴露，并保留精确的行/页/字节预算与安全前缀。 @Haoming9527
• bundle 增至七行并新增 discovery 行；提供可选双语浏览器设置页与经校验的持久化表单，覆盖运行时清单、Bash 选择、逐工具替换与发现池。 @Haoming9527
• ops_bash 改为接入宿主的单次审批与子进程治理，并要求命令描述；Bash 成为可选运行时。 @Haoming9527

体验优化

• Native 启动只常驻多文件读取器，单文件/hex、搜索、修改与引用分页按需发现，路由只描述已发布的工具。 @Haoming9527
• 单文件与多文件重读在上一轮请求包含准确正文且逐文件重新验证后省略重复行，压缩、脱敏、权限变化或证据不足时恢复全文。 @Haoming9527
• 渐进式工具发布在会话提交步骤结束后、宿主捕获下一次供应商 schema 之前完成，避免多延迟一轮。 @Haoming9527
• 完整返回的 Native 范围使用紧凑行号、共享父目录与逐文件完整版本/续读回执，截断、失败与不确定覆盖仍保留诊断信息。 @Haoming9527
• 表格读取在文件结束与元数据变化后只报告实际覆盖，解析缺口保留安全前缀且不伪造续取。 @Haoming9527

问题修复

• 修复 Native 源文本中字面反斜杠与制表符、控制字符、Unicode 分隔符的混淆，紧凑与通用输出共用可逆编码。 @Haoming9527
• 凭据预检拒绝信息不再返回被拒路径与匹配规则，保留拒绝代码、无副作用状态与禁止重试指引。 @Haoming9527
• Shell 失败改为诚实的返回值：参数失败返回结构化失败值，运行后的未知副作用禁止自动重试。 @Haoming9527

其他变更

• 插件源码迁入 src/ 并构建到既有 lib/ 路径，lib/ 成为构建产物，发布包仍只包含 lib/。 @Haoming9527
• 完成严格 TypeScript 源码迁移并关闭 JavaScript 编译：插件源码全部为 TypeScript/TSX，打包时拒绝未导入的 JavaScript 源码。 @Haoming9527
• Windows Bash 不再自动安装 npm 载荷，改为状态/安装/删除与 Git/受管理副本选择命令；删除默认预览，只移除带收据的非链接副本。 @Haoming9527
• PowerShell 交回宿主：移除 PowerShell 载荷依赖与自动执行器覆盖，新增 upgrade-host-pwsh 命令，默认预览、显式执行，并说明取消后的未知副作用与重启要求。 @Haoming9527

As the first preview of the 0.4.0 series, this version summarizes the major user- and developer-facing changes since v0.3.2.

New Features

• Add a unified capability catalogue and typed contracts: tool names, ownership, presentation, concurrency and schemas live in one place, with Outcome, search-coverage and result-reference types plus explicit error and retry policies. by @Haoming9527
• Split the Rust kernel into ops-protocol, ops-files, ops-search, ops-batch, ops-results and ops-documents workspace crates, keeping the one-shot worker and the existing authority, metadata, no-follow and audit rules. by @Haoming9527
• Version the one-shot worker request as a strict v1 protocol with per-call IDs, component provenance and execution/output budgets, rejecting malformed envelopes before any effect. by @Haoming9527
• Render Native file results as bounded text with physical line numbers: content is capped at 64 KiB after escaping, clipping carries recovery guidance, and invalid encodings return ERR_INVALID_ENCODING. by @Haoming9527
• Add ops_read_many multi-range reads (1–32 UTF-8 ranges per call, with per-file revisions and errors) and ops_edit_many atomic multi-range edits within a single file (the same semantics as ops_edit_file). by @Haoming9527
• Report search scan coverage separately from page delivery and count skip reasons; totals are withheld when reads, encodings, sizes or budgets leave gaps, and continuations revalidate the query, authority and observed filesystem state. by @Haoming9527
• Add private session result references (ref://session/tool/uuid) with a 10 MiB per-result and 100 MiB per-session quota, a serialized LRU and separate durable audits, storing oversized output as losslessly reconstructable chunks. by @Haoming9527
• Add reference paging and release to the Native file tools, bound to the current session directory, authority and the visible producing tool. by @Haoming9527
• PTC returns discriminated completed/partial/failure outcome envelopes and loads dsh-ops/ptc-sdk type declarations generated from the same schemas on demand. by @Haoming9527
• Add the dsh-ops/discovery component and ops_discover with an allowed pool, a 1–5 per-call cap and always-loaded selections; advanced tools publish only at the next model-step boundary. by @Haoming9527
• Add bounded CSV/TSV, DOCX main-body paragraph and classic PDF text-page readers, exposed on demand through Native and PTC with exact row, page and byte budgets and safe prefixes. by @Haoming9527
• Grow the bundle to seven rows with a new discovery row, and add optional bilingual browser settings pages plus validated persistent forms covering runtime inventory, Bash selection, per-tool replacements and discovery pools. by @Haoming9527
• Make ops_bash use host per-call approvals and subprocess governance, require a command description, and treat Bash as an optional runtime. by @Haoming9527

Improvements

• Keep the Native startup surface to the multi-file reader; the single-file/hex reader, search, mutations and reference paging become discoverable, and routing describes only published tools. by @Haoming9527
• Omit repeated line bodies on single- and multi-file re-reads when the latest completed request carries the exact prior text and every file revalidates, restoring full output after compaction, redaction, authority changes or uncertain evidence. by @Haoming9527
• Publish progressive tools after the session commits a step and before the host captures the next provider schema, avoiding an extra delayed round. by @Haoming9527
• Show fully returned Native ranges with compact line numbers, shared parent paths and one per-file revision/continuation receipt, while clipped, failed and uncertain coverage keeps its diagnostics. by @Haoming9527
• Report only actual table coverage beyond EOF and after metadata changes, keeping safe prefixes beside parse gaps without inventing continuations. by @Haoming9527

Bug Fixes

• Fix confusion between literal backslashes and tabs, control characters or Unicode separators in Native source text by sharing one reversible encoder across compact and general output. by @Haoming9527
• Stop credential preflight refusals from exposing denied paths or matching policy roots, while retaining rejection codes, effect-free state and no-retry guidance. by @Haoming9527
• Make shell failures honest: invalid arguments return structured failure values, and an unknown effect after a running command forbids automatic replay. by @Haoming9527

Chores

• Move plugin sources to src/ and build into the existing lib/ paths; lib/ becomes a build product, and published packages still ship lib/ only. by @Haoming9527
• Complete the strict TypeScript source migration and disable JavaScript compilation, so the plugin sources are all TypeScript/TSX and packaging rejects unimported JavaScript sources. by @Haoming9527
• Stop installing the Windows Bash npm payload automatically and add status/install/remove commands with Git or managed-copy selection; removal previews by default and only removes receipt-marked, non-linked copies. by @Haoming9527
• Return PowerShell to the host: remove the PowerShell payload dependency and the automatic executor overlay, and add an upgrade-host-pwsh command that previews by default and documents unknown effects and restart requirements when cancelled. by @Haoming9527

Full Changelog: v0.3.2...v0.4.0-alpha1

v0.3.2

中文 | English

0.3.2 补丁版本，汇总了自 v0.3.1 以来的主要变更，包括原生文件工具面扩展、安全与原子性层、可选的官方工具接管以及 PTC 与平台默认值调整。

新增功能

• 原生文件工具面从四项扩到十一项：新增 ops_write_file、ops_edit_file、ops_diff、ops_stat、ops_copy、ops_move 与 ops_remove，统一使用单一 path 和 SHA-256 revision/expectedRevision 的 CAS 契约，写文件与编辑支持 dryRun 预览。 @Thatgfsj
• 新增安全与原子性层：替换回执基于实际观察到的字节，合作写者共享持久路径锁，Windows 保留 owner/group/有序 DACL 与受支持属性，Darwin 非空扩展 ACL 在 staging 前以 METADATA_UNSUPPORTED fail-closed，并用 CREDENTIAL_DENIED、PATH_RESTRICTED、AUTHORITY_CHANGED、EXECUTION_RESTRICTED 区分拒绝来源。 @Thatgfsj, @T-Auto
• 新增默认关闭的 dsh-ops/hide-official 组件：只接管 shell/file/ptc 三个面，隐藏有经审查 OPS 等价物的官方工具（read、glob、grep），其余官方工具保持可见并汇总为一条告警。 @Thatgfsj
• PTC 分页与发现性：结果页在投影或过滤之前暴露过期时间、sourceTotal 与稳定有序的 contentHash，过期引用返回 REFERENCE_EXPIRED 并带释放或重新观察的指引，batch 审计页只读且不可释放，执行前重新核对当前权限。 @T-Auto
• 平台默认值调整：PTC 增强默认启用（仍只在纯 PTC 会话发布 ops_batch/ops_result），shell 在三个平台保持启用，严格官方工具隐藏仍保持 opt-in，已有显式配置不会被迁移或覆盖。 @T-Auto
• 新增可选只读 OPS 侧栏 dsh-ops/tui（默认关闭，基于 TUI panel API v1）与数据采集 dsh-ops/panel（所在行默认启用、「启动数据检测」开关默认关闭，写入 <cwd>/.dsh-ops/panel/）；侧栏只浏览有界保留元数据，不打开面板、不执行工具、不获取结果页。 @ccch1mneyyy, @Thatgfsj, @T-Auto
• 新增只读活动投影：内部有界地投影 OPS 原生与 PTC 工具事件，不保存参数或结果体、按会话隔离，只把传输返回标为中性而不宣称业务成功。 @ccch1mneyyy

体验优化

• 文件工具参数 schema 在固定宿主 SDK 中渲染具体类型，SDK 不支持的边界写成描述并由原生校验兜底；ops_glob 执行声明的 limit，ops_grep 拒绝未知 outputMode，inspect 保留 legacy offset 0。 @T-Auto
• ops_grep 的分页改为诚实统计：即使页已填满也继续统计候选集，只物化请求窗口，total/matched/omitted/complete 不再把前缀当成完整结果，非 UTF-8 或超大文件计入 skippedFiles。 @T-Auto
• ops_inspect_local_file 的模型视图对同质页只在顶部共享一次 path，且不修改原始执行/PTC 结果、不删除 revision、分页与截断元数据。 @T-Auto
• 文件工具路由与指导对齐真实原生能力：不再宣传多 range、任意编码或 PDF 文本，summary/count/content 分别对应聚合总量、单文件计数与匹配文本。 @T-Auto
• hide-official 的 strict 不再因为范围外工具缺少等价物而阻塞会话就绪，范围外工具保持可见并汇总告警；只有显式请求范围内无等价物的工具时才以 READINESS_BLOCKED fail-closed。 @Thatgfsj
• hide-official 新增 scope: takeover | extended | off，把接管范围数据化为 63 个固定官方工具名与两个动态前缀；takeover 为默认值，extended 把 additionalOfficialTools 纳入范围，off 让该行不接管任何工具。 @Thatgfsj, @T-Auto
• pwsh 接管改为把 pwshPath 写入官方行的 volatile 配置引用，不再通过 Entry.update() 重挂 pwsh-sandbox，避免重建 permission-presets 后拖垮整个权限服务。 @little3tar
• 配置迁移标记改走 configEditor.edit() 落到 profile 的 patch 层，不再把完整 composed tree 写回 profile 根文件，修复主题/字号回弹以及下次启动整包静默挂载失败。 @Thatgfsj, @Nicholas023
• 凭据围栏按实际覆盖面文档化并扩展：路径级同时覆盖读、写、copy/move 目标与 remove，.env 也不能通过这些工具创建。 @WTStarMark, @Thatgfsj

问题修复

• ops_bash 的参数错误恢复为拒绝：非法参数抛出 BashArgumentError（INVALID_BASH_ARGUMENT）并点名字段，运行时失败仍折叠为携带完整输出 schema 的值。 @Thatgfsj
• 相对 workdir 锚定到会话工作区（绝对路径不变，空或纯空白回退会话目录，Windows 盘符相对路径按会话盘解析或拒绝），工作区已消失时给出 invalid workdir 而不是 Bash 载荷提示。 @Y-fyan, @Thatgfsj
• ops_glob 的 details.modified 改为真正的修改时间（Unix epoch 毫秒，与 ops_stat 的 modifiedMs 同量纲），sort: "modified" 按时间倒序稳定排序，时间戳相同则保持遍历顺序。 @Thatgfsj
• 可被纯快照检查直接拒绝的单文件请求现在在取锁之前失败，write_file/edit_file 的 dry run 完全跳过锁；持久 .dsh-ops-update-<sha256>.lock sidecar 作为声明行为记录并保留。 @WTStarMark

其他变更

• 破坏性变更：移除 dsh-ops/background 组件与只为它存在的 FastCtx 运行时，ops_run、ops_run_background、ops_job_output、ops_job_list 与 ops_job_kill 不再提供；长任务改用宿主 pwsh 的 run_in_background，或在 ops_bash 命令内用 nohup ... & disown 脱离。 @Haoming9527
• 旧 profile 里残留的 dsh-ops/background 行继续加载为 no-op stub：接受任意配置、不发布工具、只记录一条可删除该行的警告；configUpdateVersion: 2 会从已保存的 dsh-ops、dsh-ops/shell 与 dsh-ops/file 行中移除 serverName、enableShellTools、toolCallTimeoutMs。 @Haoming9527
• CLI 精简：resolve、不带 --profile 的 status、build 与 provision 移除并以 exit 2 指向替代命令，ladder 改为报告原生 worker 和 { files, bash, pwsh } 三档；打包不再包含 vendor/fastctx/、FastCtx 平台包与相关脚本。 @Haoming9527
• 公共 dsh-ops/policy 导出随之调整：移除 BACKGROUND_TOOLS 与 SHELL_TOOLS，ladderLevels() 返回 { files, bash, pwsh }，renderToolingPolicy() 不再接受 enableShellTools；许可证与 FastCtx 致谢原文移到 licenses/fastctx/ 并保持原样。 @Haoming9527
• 仓库结构调整：CHANGELOG.md 与 PROVENANCE.md 移入 docs/，新增双语 CONTRIBUTING、issue/PR 模板以及维护者与贡献者章节，图标和头图移入 docs/assets/。 @T-Auto, @Haoming9527, @baobaolaodie
• 发布流程改为门禁化的 GitHub Release：release.yml 重写为带验证的发布工作流，并补充发布流程文档。 @Thatgfsj
• 新增仓库内基准框架与数据面板：比较插件相对干净基线的工具级与模型级成本；它不进入发布包，也不在默认 CI 中运行。 @Thatgfsj, @OldLigant, @Richeir

The 0.3.2 patch release summarizes the main changes since v0.3.1, including the expanded native file surface, the safety and atomicity layer, opt-in official-tool hiding, and PTC and platform-default changes.

New Features

• The native file surface grows from four to eleven tools with ops_write_file, ops_edit_file, ops_diff, ops_stat, ops_copy, ops_move and ops_remove, all sharing one path and a SHA-256 revision/expectedRevision CAS contract, and writes and edits support dryRun previews. by @Thatgfsj
• Add a safety and atomicity layer: replacement receipts hash the bytes actually observed, cooperating writers share a persistent path lock, Windows preserves owner/group/ordered DACL and supported attributes, Darwin fails closed with METADATA_UNSUPPORTED before staging a nonempty extended ACL, and CREDENTIAL_DENIED, PATH_RESTRICTED, AUTHORITY_CHANGED and EXECUTION_RESTRICTED distinguish refusal sources. by @Thatgfsj, @T-Auto
• Add the disabled-by-default dsh-ops/hide-official component: it takes over only the shell/file/ptc faces, hides official tools that have a reviewed OPS equivalent (read, glob, grep), and leaves every other official tool visible with one aggregated warning. by @Thatgfsj
• PTC paging and discoverability: result pages expose expiry, sourceTotal and a stable ordered contentHash before projection or filtering, expired references return REFERENCE_EXPIRED with release or reobserve guidance, batch audit pages are read-only and cannot be released, and current authority is rechecked before execution. by @T-Auto
• Platform defaults change: PTC enhancement is enabled by default (tools still publish only in pure PTC sessions), shell stays enabled on all three platforms, strict official-tool hiding remains opt-in, and existing explicit profile choices are neither migrated nor overwritten. by @T-Auto
• Add the optional read-only OPS sidebar dsh-ops/tui (off by default, built on TUI panel API v1) and data capture dsh-ops/panel (row on by default, capture off by default, writing under <cwd>/.dsh-ops/panel/); the sidebar browses only bounded retained metadata, never opens itself, runs tools or fetches result pages. by @ccch1mneyyy, @Thatgfsj, @T-Auto
• Add a read-only activity projection: an internal bounded projection of live OPS native and PTC tool events that stores no arguments or result bodies, isolates sessions, and labels transport returns neutrally rather than claiming business success. by @ccch1mneyyy

Improvements

• File-tool argument schemas render concrete types in the pinned host SDK, with SDK-unsupported bounds expressed as descriptions backed by native validation; ops_glob enforces its advertised limit, ops_grep rejects unknown outputMode values, and inspect keeps legacy offset 0 working. by @T-Auto
• ops_grep paging now counts honestly: it keeps counting the candidate set after a page fills while materializing only the requested window, total/matched/omitted/complete no longer claim a prefix is a complete result, and non-UTF-8 or oversized files are reported through skippedFiles. by @T-Auto
• The ops_inspect_local_file model view shares a homogeneous page's path once at the top level without mutating the raw execution/PTC result or dropping revision, paging and truncation metadata. by @T-Auto
• File-tool routing and guidance now match the real native surface: multiple ranges, arbitrary encodings and PDF text are no longer advertised, and summary/count/content mean aggregate totals, per-file counts and matching text. by @T-Auto
• hide-official with strict no longer blocks session readiness for out-of-scope tools without an equivalent; those stay visible with an aggregated warning, and only an explicit request for an in-scope tool without an equivalent fails closed with READINESS_BLOCKED. by @Thatgfsj
• hide-official gains scope: takeover | extended | off, making the takeover scope data-driven over 63 pinned official tool names and two dynamic prefixes; takeover is the default, extended promotes additionalOfficialTools into the scope, and off takes over nothing. by @Thatgfsj, @T-Auto
• The pwsh takeover now commits pwshPath into the official row's volatile config reference instead of remounting pwsh-sandbox through Entry.update(), avoiding a rebuilt permission-presets that would break the whole permission service. by @little3tar
• The config-update marker now goes through configEditor.edit() into the profile's patch layer instead of writing the whole composed tree back into the profile root file, fixing theme/font-size bounce and a silent whole-bundle mount failure on the next start. by @Thatgfsj, @Nicholas023
• The credential fence is documented and extended to its real reach: path-based coverage includes reads, writes, copy/move destinations and remove, and a .env cannot be created through these tools either. by @WTStarMark, @Thatgfsj

Bug Fixes

• ops_bash argument errors are refusals again: an invalid argument raises BashArgumentError (INVALID_BASH_ARGUMENT) naming the field, while a runtime failure is still folded into a value carrying the full output schema. by @Thatgfsj
• A relative workdir now anchors to the session workspace (absolute paths unchanged, empty or whitespace falls back to the session directory, and a Windows drive-relative path resolves against the session's drive or is refused), and a vanished workspace reports invalid workdir instead of the missing-payload remedy. by @Y-fyan, @Thatgfsj
• ops_glob's details.modified now reports a real modification time (milliseconds since the Unix epoch, the same quantity as ops_stat's modifiedMs), and sort: "modified" orders n...

v0.3.1

中文 | English

0.3.1 补丁版本，汇总了自 v0.3.0 以来的主要变更，并新增 Linux x64 与 macOS Apple Silicon 支持。

新增功能

• 原生 worker 与运行时扩展到 Linux x64：以 x86_64-unknown-linux-gnu 为一等目标构建、测试与打包，npm run build:ptc 同时 stage Linux worker 及其独立 receipt，POSIX 目录 fsync 与 Windows MoveFileExW 发布按平台分别实现。 @Thatgfsj, @T-Auto
• 新增 macOS Apple Silicon（darwin-arm64）支持：随包提供带版本、目标、可执行位与 SHA-256 receipt 的 Mach-O worker。 @null-characters
• 文件工具在解析操作路径时规范化父链，使 /tmp、/var 等系统别名下的路径可用，而直接命名符号链接的最后一段仍然 fail-closed。 @liuchunyi-buaa
• Linux 与 macOS 的 ops_bash 使用宿主发行版自带的 bash（bashPath → PATH → /bin/bash 等常见位置），不再分发第二份 shell；受限调用先经宿主沙箱，无法围栏时直接拒绝而不是无隔离运行。 @Thatgfsj, @WTStarMark
• 文件工具默认拒绝读取凭据路径（~/.ssh、~/.aws、~/.config/gcloud、~/.kube、.npmrc、.git-credentials、DSH 凭据存储等），遍历按目录身份跳过且匹配文本不会进入结果；可用 denyCredentialReads: false 关闭，DSH_OPS_DENY_READ 只能加宽。 @WTStarMark, @Thatgfsj
• workspace-write 与 replace/batch 的写根改为会话私有临时目录（dsh-ops-session-<id>，惰性创建、mode 0700），共享系统临时目录不再被当作可写根。 @WTStarMark

体验优化

• Windows 工作区准备改为通过目录自身句柄写 DACL（SetKernelObjectSecurity），50,000 文件实测从 18.65 s 降到 4.30 s，根 DACL 与后代 ACL 保持不变；超时从 10 s 提到 120 s 安全网，失败按执行策略、前置条件、执行器或退出码分类；准备脚本显式以 -ExecutionPolicy Bypass 启动 PowerShell 5.1（仅作用于该子进程，组策略仍优先）。 @Haoming9527
• 文件工具描述与结果契约对齐真实行为：ops_glob.pattern 与 glob 过滤器是相对路径数组（*.md 仅顶层、**/*.md 任意深度、! 排除、ops_glob 至少一个正向项），ops_grep 没有 include，ops_replace.pattern 是字面量与 maxReplacements 超限拒绝，失败以 status: error|rejected 值返回而不抛出；ops_bash 只在参数非法或执行器不可用时抛出，并新增 status: completed|failed。 @Haoming9527
• 子进程不再隐式继承宿主环境，改为允许列表（路径、身份、临时空间、locale 与代理保留，SSH_AUTH_SOCK、DATABASE_URL 等不再泄漏），probeBinary 同样使用清理后的环境；缓存受限 Bash 运行时分开校验包内 receipt 锚点与域内一致性，校验失败的 generation 被隔离并重建（不再永久拒绝），隔离副本最多保留两代。 @Haoming9527, @CNyaotian-Lunar
• bashPath 与任意系统 bash 只在 danger-full-access 下工作，受限模式只运行经 IPC 代理校验的固定 MSYS；错误信息点名可执行文件、来源、拒绝原因与真实可行的下一步。 @Haoming9527
• 宿主提供 fs 服务时，ops_inspect_local_file 的读取与真实 ops_replace 写入会记录到 fs/observed，与宿主 read/edit 一致，ops 读过的文件可直接用宿主 edit 编辑。 @Haoming9527

问题修复

• ops_replace 在换 inode 时保留目标文件的 mode、owner、POSIX ACL 与用户扩展属性；mode 或 POSIX ACL 无法恢复时整次调用中止且不发布，owner 与扩展属性恢复失败则以 items[].metadataWarnings 报告后继续发布；元数据恢复后再执行 fsync。 @Thatgfsj
• ops_grep 的 multiline 真正跨行匹配，含 \n 的模式不再静默返回 0 匹配；^/$ 仍保持按行语义，上下文行照常生效。 @Thatgfsj
• 所有响应同时按编码字节与行数限界，超长单行不再让读取直接失败；ops_inspect_local_file 的 hex 视图从文件第一行读起。 @Thatgfsj
• ops_replace 在读-校验-发布窗口持有排他更新锁，并发替换返回 REVISION_CONFLICT 而不是丢掉写入；硬杀进程留下的本插件碎片由下一个写者按完整形状回收。 @Thatgfsj
• ops_bash 在 spawn 前校验 workdir 必须是已存在目录，缺失、文件型与不可访问分别报 invalid workdir；空或纯空白 workdir 按省略处理解析到会话目录。 @ViscaOwO
• Windows 8.3 短名工作区根不再被误判为 junction 或符号链接，判定改为检查给定路径及其祖先的实际 reparse point。 @baobaolaodie
• 继承的 LC_ALL 不再解掉英文消息 pin：POSIX 下中和该覆盖并以 LC_CTYPE 保留编码意图，沙箱拒绝不会被误报成普通命令失败。 @Thatgfsj, @T-Auto
• 原生文件工具在插件执行入口丢弃可选字段的 null/""/[] 占位符，严格填满 schema 的适配器不再触发 path/encoding/view 校验错误。 @Haoming9527
• Windows 工作区准备不再向 PowerShell 5.1 继承 PSModulePath，避免 pwsh 7 宿主下准备脚本加载不到 Get-Acl/Set-Acl，从而导致 workspace-write 会话的所有 shell 工具失败。 @CNyaotian-Lunar

其他变更

• README 重写并把参考手册内容移入 docs/，补齐组件参考、配置参考、使用指南与常见问题，以及 Linux 构建、macOS arm64、Windows 验证等平台文档。 @PPPPetermosaic, @Thatgfsj, @null-characters

The 0.3.1 patch release summarizes the main changes since v0.3.0, adding Linux x64 and macOS Apple Silicon support.

New Features

• The native worker and runtime extend to Linux x64: x86_64-unknown-linux-gnu is a first-class build, test and packaging target, npm run build:ptc stages the Linux worker with its own receipt, and POSIX directory fsync versus Windows MoveFileExW publication are implemented per platform. by @Thatgfsj, @T-Auto
• macOS Apple Silicon (darwin-arm64) is now supported, with a Mach-O worker shipped alongside version, target, executable-bit and SHA-256 receipts. by @null-characters
• File tools canonicalize the parent chain of an operation path so paths under system aliases such as /tmp and /var work, while a directly named final symlink still fails closed. by @liuchunyi-buaa
• On Linux and macOS, ops_bash uses the host distribution's own bash (bashPath, then PATH, then well-known locations such as /bin/bash) and ships no second shell; confined calls reach the host sandbox first and are refused rather than run unconfined when confinement is unavailable. by @Thatgfsj, @WTStarMark
• File tools now refuse to read credential locations by default (~/.ssh, ~/.aws, ~/.config/gcloud, ~/.kube, .npmrc, .git-credentials, the DSH credential stores and similar), traversals skip those directories by identity, and match text never enters a result; a row can opt out with denyCredentialReads: false, and DSH_OPS_DENY_READ can only widen the list. by @WTStarMark, @Thatgfsj
• The workspace-write and replace/batch write root becomes the session's own temporary directory (dsh-ops-session-<id>, created lazily with mode 0700), and the shared system temp directory is no longer endorsed as a write root. by @WTStarMark

Improvements

• Windows workspace preparation writes the root DACL through the directory's own handle (SetKernelObjectSecurity), measured at 18.65 s → 4.30 s on 50,000 files, with the root DACL and descendant ACLs unchanged; the timeout becomes a 120 s safety net and failures are classified by execution policy, prerequisite, executor or exit code; the preparation script explicitly starts PowerShell 5.1 with -ExecutionPolicy Bypass (that child process only, Group Policy still wins). by @Haoming9527
• File-tool descriptions and the result contract now match real behaviour: ops_glob.pattern and glob filters are arrays of relative-path globs (*.md top level only, **/*.md any depth, ! excludes, and ops_glob needs at least one positive entry), ops_grep has no include, ops_replace.pattern is literal text and exceeding maxReplacements refuses the whole operation, and failures resolve as status: error|rejected values instead of throwing; ops_bash throws only for invalid arguments or an unavailable executor and gains status: completed|failed. by @Haoming9527
• Spawned children no longer inherit the host environment implicitly but receive an allow-list (paths, identity, scratch space, locale and proxies survive, while SSH_AUTH_SOCK, DATABASE_URL and similar no longer leak), probeBinary uses the scrubbed environment too, and the cached confined-Bash runtime verifies in-package receipt anchors separately from in-domain consistency, quarantining a generation that fails verification and rebuilding it instead of refusing it forever, with at most two quarantined generations kept. by @Haoming9527, @CNyaotian-Lunar
• bashPath and any system bash now work only under danger-full-access, while restricted modes run only the pinned MSYS whose IPC proxies were verified; the error names the executable, its source, the refusal reason and a real next step. by @Haoming9527
• When the host provides its fs service, ops_inspect_local_file reads and real ops_replace writes are recorded in fs/observed like host read/edit, so a file read through ops can be edited with host edit directly. by @Haoming9527

Bug Fixes

• ops_replace preserves the target's mode, owner, POSIX ACL and user extended attributes across the inode replacement; when the mode or POSIX ACL cannot be restored the call aborts with nothing published, while a failed owner or extended-attribute restore is reported in items[].metadataWarnings and publication continues, with fsync after metadata restoration. by @Thatgfsj
• ops_grep's multiline now actually matches across lines, so a pattern containing \n no longer silently returns zero matches; ^ and $ keep their per-line meaning and context lines still apply. by @Thatgfsj
• Every response is bounded by encoded bytes as well as lines, so a single long line can no longer fail a read outright, and the ops_inspect_local_file hex view starts at the file's first row. by @Thatgfsj
• ops_replace holds an exclusive update lock across the read-check-publish window, so concurrent replacement returns REVISION_CONFLICT instead of losing a write, and leftovers from a hard kill are reclaimed by the next writer only when they have the full shape it creates. by @Thatgfsj
• ops_bash validates workdir as an existing directory before spawning, reporting invalid workdir for a missing, file-valued or inaccessible path, and empty or whitespace-only workdir falls back to the session directory as if omitted. by @ViscaOwO
• A Windows 8.3 short-name workspace root is no longer refused as a junction or symlink; the check now judges the given path and its ancestors for actual reparse points. by @baobaolaodie
• An inherited LC_ALL no longer unpins the English message locale: on POSIX the override is neutralized and its encoding intent carried as LC_CTYPE, so a sandbox refusal is not misreported as a generic command failure. by @Thatgfsj, @T-Auto
• Native file tools drop null/""/[] placeholders for optional fields at the plugin's own execute entry, so adapters that fill every schema field no longer trip path/encoding/view validation. by @Haoming9527
• Windows workspace preparation no longer passes an inherited PSModulePath to PowerShell 5.1, so the preparation script can still load Get-Acl/Set-Acl under a pwsh 7 host, where every shell tool in a workspace-write session used to fail. by @CNyaotian-Lunar

Chores

• Rewrite the README and move the reference manual into docs/, adding component and configuration references, the usage guide and troubleshooting, plus platform documents for Linux builds, macOS arm64 and Windows verification. by @PPPPetermosaic, @Thatgfsj, @null-characters

Full Changelog: v0.3.0...v0.3.1

v0.3.0

中文 | English

作为 0.3.0 系列的首个正式版本，本版本汇总了自 v0.2.0 以来的主要用户和开发者相关变更，并包含 0.2.1–0.2.9 中已发布的主要修复。

新增功能

• 文件组件改用插件自有的 Rust worker 发布 ops_inspect_local_file、ops_grep、ops_glob 与 ops_replace，提供有界 UTF-8/hex 读取、glob 遍历、Rust 正则搜索，以及带预检计数、内容修订校验与原子替换的 ops_replace。 @T-Auto
• 固定信任的文件操作接入 DSH 原生的策略、沙箱与子进程治理：只读会话可以查看但不能替换，workspace-write 把写入限制在工作区，完全权限不额外附加写入范围，失败时不会退化为无隔离执行。 @T-Auto
• 新增 opt-in 的 dsh-ops/ptc 组件，发布 ops_batch（预检、copy/move/remove、保护路径、写前逐项清单、保守续跑与审计）和 ops_result（有界结果引用、分页、字段/相等过滤、投影与释放）。 @T-Auto
• 受限 Windows x64 会话的 Bash 初始化改用安装目录内、按摘要校验的私有 IPC 兼容副本，只适配新增的信号/匿名/数据管道与 pagefile 进程跟踪；原载荷、DSH 令牌身份与文件系统围栏保持不变，摘要不匹配即拒绝。 @T-Auto
• Windows 工作区在 run_code 或 pwsh 启动前自动补齐目录级、仅当前用户的 WRITE_OWNER 前提，原 DACL 备份到 DSH_HOME/dsh-ops/acl-backups，不递归、不改 owner、不移除显式 deny。 @T-Auto
• ops_bash 新增 script_path，长脚本、heredoc 与转义密集脚本不必塞进单个 JSON 字符串，command 继续用于短命令和管道。 @T-Auto
• 文件、shell、后台三个市场组件可独立开关，另有单独的可选 PTC 组件；每个市场组件各自导出标题、描述、图标与中英文本地化，默认发布五个工具，启用后台组件后发布九个。 @T-Auto
• 每个组件拥有独立的提示词段，关闭或卸载某个组件时只撤回对应的工具与指引，不向 AGENTS.md 追加内容。 @T-Auto
• Windows x64 运行时载荷改为完整包：@dsh-ops/bash-win32-x64 与 @dsh-ops/pwsh-win32-x64 携带经摘要核验的 PortableGit bash 与 PowerShell 7，主包发布时注入三个运行时依赖。 @T-Auto

体验优化

• 缺 Bash 载荷时按 no-manifest、not-declared、not-installed、incomplete-tree 给出机器可读原因与对应动作，缺失载荷会指向 dsh-ops provision-shells --bash，而不是笼统的“修复 profile 安装”。 @baobaolaodie
• 执行阶梯与重复提示段合并为一张紧凑路由表，明确 bash 优先、PowerShell 7 只用于必要的 Windows 原生操作。 @T-Auto
• 后台任务按会话与连接记录归属，拒绝查询或终止其他会话的任务，并对自有任务列表做计数与分页。 @T-Auto
• 工具定义与清理器全部限定在插件自有作用域，连接断开时撤回工具；不改写共享工具注册表，也不在加载期导入宿主值。 @T-Auto
• allowSystemShellFallback 默认改为 false，从环境 PATH 或常见安装位置发现 bash 需要显式开启；启动时执行一次配置迁移并写入 configUpdateVersion，之后的手动选择会被保留。 @T-Auto
• 共享 FastCtx 运行时按执行器策略分键，避免一个组件的回退选择泄漏到其他组件；没有获批执行器时不发布后台命令。 @T-Auto
• 用运行期配置生命周期覆盖替代 bundle 里无条件的 pwshPath 覆写，关闭 shell 组件时按当前配置重算执行器且不落盘。 @T-Auto
• 受限会话照常发布 ops_bash 并在每次执行重新解析策略；授权拒绝返回 POLICY_DENIED，给出当前/所需权限与用户操作指引，并与执行器初始化失败分开报告。 @T-Auto

问题修复

• ops_bash 在运行时执行闭合参数 schema，拒绝 run_in_background 等未声明键，避免参数被静默忽略后整次调用一直挂到超时。 @Arutoria2024
• 后台工具的缺失或拼错参数按参数错误报告，而不是误报为该任务不是本会话启动。 @WTStarMark
• ops_bash 参数改为带 properties、required 与 additionalProperties: false 的 JSON Schema 对象根，修复参数被宿主原样转发后遭模型 API 拒绝的问题。 @T-Auto
• Windows 系统 PATH 回退跳过 %SystemRoot%\System32\bash.exe 这个 WSL 发行版启动器，显式开启回退时会选中真正的 Git for Windows/MSYS bash。 @T-Auto
• 一次性旧版 shell 回退迁移改为不调用 Entry.update()、不重挂插件即可持久化，避免与 Desktop 的 profile 重载相互竞争。 @T-Auto
• 缺 Bash 载荷时把 spawn 期的 ENOENT 转成可执行的诊断结果，不再向模型暴露原始进程异常。 @T-Auto
• PTC 组件的图标移入其导出的元数据目录，修复 Plugin Manager 因父级相对图标路径报出的元数据错误。 @T-Auto
• 只跟踪插件自有的 MCP 客户端并在显式退出时终止对应 serve 进程，关闭对并发调用幂等，共享 runtime 租约保留到最后一个组件释放。 @T-Auto
• 空、纯空白或 null 的 command/script_path 视为未提供，严格填充可选输入的适配器不再阻塞有效命令，同时仍拒绝两个非空输入和未知参数键。 @T-Auto

其他变更

• 本版只按 Windows x64 一个目标构建与发布，package.json 的 os/cpu、manifest 目标声明、运行时解析与发布门禁同步收窄，非目标平台被明确拒绝。 @T-Auto
• 源码构建拆成 npm run build:ptc 与 npm run build:bash-ipc，发布包直接携带 worker、IPC 代理、receipt 与匹配源码，安装期不下载也不编译。 @T-Auto
• 插件安装、状态与卸载改为委托官方 DSH 管理器，tui 映射到 dsh-tui 并优先使用 Desktop 自带 CLI，同时修复 Windows 下委派安装的 cmd 引号。 @T-Auto
• @dsh-ops/pwsh-win32-x64 在 pnpm 隔离目录下从插件包内解析，避免提升布局差异。 @T-Auto

As the first stable release in the 0.3.0 series, this version summarizes the major user- and developer-facing changes since v0.2.0 and includes the main fixes published in 0.2.1–0.2.9.

New Features

• The file component now publishes ops_inspect_local_file, ops_grep, ops_glob and ops_replace from a plugin-owned Rust worker, with bounded UTF-8/hex reads, glob traversal, Rust-regex search, and an ops_replace that does preflight counting, revision checks and atomic replacement. by @T-Auto
• Fixed trusted file operations now go through DSH policy, sandbox and subprocess governance: read-only sessions can inspect but not replace, workspace-write fences writes to the workspace, full access adds no extra write fence, and a failure never degrades into unconfined execution. by @T-Auto
• Add the opt-in dsh-ops/ptc component, publishing ops_batch (preflight, copy/move/remove, protected paths, write-ahead per-item manifests, conservative resume and audit) and ops_result (bounded result references, paging, field/equality filtering, projection and release). by @T-Auto
• Confined Windows x64 Bash initialization now uses a private, digest-verified IPC-compatible copy inside the installation tree that adapts only the new signal/anonymous/data pipes and the pagefile process tracker; original payloads, DSH token identities and filesystem confinement are unchanged, and a digest mismatch is refused. by @T-Auto
• Before an outer run_code or pwsh launch, Windows workspaces automatically receive the directory-only, current-user WRITE_OWNER prerequisite; the original DACL is backed up under DSH_HOME/dsh-ops/acl-backups, with no recursion, ownership changes or removal of explicit denials. by @T-Auto
• ops_bash gains script_path, so long, heredoc-heavy and escape-heavy scripts no longer have to be embedded in one JSON string, while command remains for short commands and pipelines. by @T-Auto
• The file, shell and background market components can be toggled independently alongside the separate optional PTC component, and each market component exports its own title, description, icon and Chinese/English locales; five tools are published by default and nine when the background component is enabled. by @T-Auto
• Each component owns its prompt section, so disabling or unloading one withdraws only its own tools and guidance, and nothing is appended to AGENTS.md. by @T-Auto
• Windows x64 runtime payloads now ship complete packages: @dsh-ops/bash-win32-x64 and @dsh-ops/pwsh-win32-x64 carry digest-verified PortableGit bash and PowerShell 7, and the main package injects all three runtime dependencies when released. by @T-Auto

Improvements

• A missing Bash payload is now classified as no-manifest, not-declared, not-installed or incomplete-tree with a matching remedy, and a missing payload points at dsh-ops provision-shells --bash instead of a blanket “repair the profile installation”. by @baobaolaodie
• The execution ladder and duplicated prompt sections are merged into one compact routing table that makes bash the default and uses PowerShell 7 only for necessary Windows-native work. by @T-Auto
• Background jobs are now owned per session and connection: queries or kills for another session's jobs are refused, and listings of owned jobs are counted and paged. by @T-Auto
• Tool definitions and disposers are scoped to the plugin's own ownership and withdraw tools on disconnect, without rewriting the shared tool registry or importing host values at load time. by @T-Auto
• allowSystemShellFallback now defaults to false, so discovering bash from the ambient PATH or well-known installs requires an explicit opt-in; a one-time startup migration records configUpdateVersion and later manual choices are preserved. by @T-Auto
• Shared FastCtx runtimes are keyed by executor policy so one component's fallback choice cannot leak into another, and no background commands are published when no executor is approved. by @T-Auto
• The bundle's unconditional pwshPath override is replaced by a runtime-only config lifecycle overlay, so disabling the shell component recomputes the executor from its current config without persisting anything. by @T-Auto
• Confined sessions still publish ops_bash and resolve policy on every execution; an authorization denial returns POLICY_DENIED with the current and required modes plus user-action guidance, reported separately from executor initialization failures. by @T-Auto

Bug Fixes

• ops_bash enforces its closed argument schema at runtime and rejects undeclared keys such as run_in_background, so a silently ignored argument can no longer hold a call until its timeout. by @Arutoria2024
• Missing or misspelled background-tool arguments are reported as argument errors instead of being misreported as a job that this session did not start. by @WTStarMark
• ops_bash parameters now use a JSON Schema object root with properties, required and additionalProperties: false, fixing the rejection by the model API after the host forwarded the old field map unchanged. by @T-Auto
• The Windows system-PATH fallback now skips the %SystemRoot%\System32\bash.exe WSL distribution launcher, so an explicitly enabled fallback selects a real Git for Windows/MSYS bash. by @T-Auto
• The one-time legacy shell-fallback migration now persists without calling Entry.update() or remounting the plugin, avoiding contention with Desktop profile reloads. by @T-Auto
• A spawn-time ENOENT for a missing Bash payload becomes an actionable diagnostic result instead of a raw process exception reaching the model. by @T-Auto
• The PTC component icon now lives inside its exported metadata directory, fixing the Plugin Manager metadata error caused by a parent-relative icon path. by @T-Auto
• Only plugin-owned MCP clients are tracked and their exact serve processes terminated on explicit exit; close is idempotent for concurrent callers, and shared-runtime leases last until the final component releases them. by @T-Auto
• Empty, whitespace-only or null command/script_path values are treated as absent, so adapters that fill optional inputs no longer block a valid command, while two non-empty inputs and unknown argument keys are still rejected. by @T-Auto

Chores

• This release is built and published for the Windows x64 target only; the package.json os/cpu fields, manifest target declarations, runtime resolution and release gate are narrowed together, and non-target platforms are explicitly refused. by @T-Auto
• Source builds are split into npm run build:ptc and npm run build:bash-ipc, and the release package directly carries the worker, IPC proxies, receipts and matching sources with no download or compilation at...

v0.2.9

中文 | English

0.2.9 补丁版本，汇总了自 v0.2.8 以来的主要变更，仅包含问题修复，不新增工具、组件或配置键。

体验优化

• ops_bash 的工具说明明确其只前台执行，没有 run_in_background 与 job id；服务、监听器、watch 等常驻进程应改用宿主 pwsh 工具的 run_in_background，或在命令内部自行脱离。 @Arutoria2024

问题修复

• ops_bash 现在在 spawn 前拒绝 schema 未声明的参数，错误信息同时点出未知键与可接受的键，避免宿主 bash 与 pwsh 才接受的 run_in_background 被静默忽略后，常驻命令被当前台执行并一直占用到 timeoutMs。 @Arutoria2024
• Windows 系统 PATH 回退现在跳过 %SystemRoot%\System32\bash.exe 这个 WSL 发行版启动器，显式启用回退时会选择真正的 Git for Windows/MSYS bash，避免命令被静默送进 WSL。 @T-Auto
• 一次性旧 shell 回退配置迁移不再调用 Entry.update() 重挂载插件，而是直接更新所属原始配置行并安排写盘，避免多个组件迁移时与 Desktop profile 重载竞争造成的配置修改卡顿。 @T-Auto

The 0.2.9 patch release summarizes the main changes since v0.2.8 and contains bug fixes only, with no new tools, components, or configuration keys.

Improvements

• The ops_bash tool description now states that it runs in the foreground only, with no run_in_background and no job id; long-lived processes such as servers, listeners and watchers should use the host pwsh tool's run_in_background or detach inside the command itself. by @Arutoria2024

Bug Fixes

• ops_bash now refuses arguments the schema does not declare before spawning, naming both the unknown keys and the accepted ones, so a run_in_background accepted only by the host bash and pwsh tools can no longer be silently ignored while a long-lived command runs in the foreground and occupies the call until timeoutMs. by @Arutoria2024
• The Windows system PATH fallback now skips %SystemRoot%\System32\bash.exe, the WSL distribution launcher, so an explicitly enabled fallback selects a real Git for Windows/MSYS bash instead of silently moving commands into WSL. by @T-Auto
• Persist the one-time legacy shell-fallback migration by updating the owning raw configuration row and scheduling its tree write instead of calling Entry.update(), which needlessly remounted the plugin and made configuration edits stall while component migrations competed with Desktop profile reloads. by @T-Auto

Full Changelog: v0.2.8...v0.2.9

v0.2.8

中文 | English

0.2.8 补丁版本，汇总了自 v0.2.7 以来的主要变更。

体验优化

• ops_bash 的结果新增 error 字段，并在文本输出中显示 [error: ...] 标记，使 bash 启动失败与命令自身的退出码、信号可以区分。 @T-Auto

问题修复

• 修复随包 bash 载荷在 profile 声明中存在、但实际已被宿主包管理器清理时，ops_bash 把裸 spawn 异常抛给模型的问题；现在返回可读的 ENOENT 诊断，指出缺失的可执行文件与来源并提示恢复 profile 依赖，其它启动失败也会说明 bash could not be started，且不会静默回退到未授权的系统 bash。 @T-Auto

The 0.2.8 patch release summarizes the main changes since v0.2.7.

Improvements

• ops_bash results now carry an error field and a rendered [error: ...] marker, so a bash startup failure can be told apart from the command's own exit code or signal. by @T-Auto

Bug Fixes

• Fix ops_bash throwing a raw spawn exception at the model when the bundled bash payload is declared in the profile but has been pruned from disk; it now returns a readable ENOENT diagnostic naming the missing executable and its source, with a pointer to restore the profile's dependencies, and other startup failures report bash could not be started. The fail-closed policy is unchanged: it never silently falls back to an unapproved system bash. by @T-Auto

Full Changelog: v0.2.7...v0.2.8

v0.2.7

中文 | English

0.2.7 补丁版本，汇总了自 v0.2.6 以来的主要变更。

新增功能

• ops_bash 新增 script_path 参数，可直接执行已存在的脚本文件；command 改为只承载短命令与管道，两者必须二选一。 @T-Auto

体验优化

• 提示词与工具说明引导模型对超过约 1 KB、或含 heredoc、引号、反斜杠与非 ASCII 文本的脚本先写入文件再通过 script_path 执行，减少在工具调用 JSON 中多层转义造成的调用失败。 @T-Auto

The 0.2.7 patch release summarizes the main changes since v0.2.6.

New Features

• Add an ops_bash.script_path parameter that runs an existing script file; command now carries only short commands and pipelines, and exactly one of the two must be provided. by @T-Auto

Improvements

• Prompt and tool-description guidance directs the model to write scripts longer than about 1 KB, or containing heredocs, quotes, backslashes or non-ASCII text, to a file first and run them through script_path, reducing failed calls caused by multi-layer escaping in tool-call JSON. by @T-Auto

Full Changelog: v0.2.6...v0.2.7

v0.2.6

中文 | English

0.2.6 补丁版本，汇总了自 v0.2.4 以来的主要变更，包含未单独发布为 GitHub Release 的 0.2.5 安全与配置迁移修复。

问题修复

• 修复 FastCtx 客户端进程生命周期：只跟踪并回收插件自己启动的 serve 客户端，宿主正常退出时终止自有子进程，并强制启用 FastCtx 的身份感知父进程监控作为宿主被强杀时的兜底；连接关闭立即拒绝待处理请求，并发关闭共用同一退出流程且强制终止有截止时间，共享运行时租约保留到最后一个组件释放。 @T-Auto
• 修复系统 shell 回退的执行器绑定：FastCtx 只绑定到已解析的 bash，未获得批准执行器时不发布命令与后台工具；共享运行时按执行器策略分别建立，避免一个组件的回退选择泄漏到另一个组件。 @T-Auto

其他变更

• allowSystemShellFallback 默认值改为 false，代码与随包配置一致，系统 PATH 与常见目录中的 bash 探测需要显式开启。 @T-Auto
• 新增一次性升级配置自检：首次启动把未迁移的旧 allowSystemShellFallback: true 改为 false，在执行器解析与工具发布前生效，通过宿主 loader 写回自有配置行并记录 configUpdateVersion: 1，之后手动改回 true 不会被重启或热重载反复覆盖。 @T-Auto

The 0.2.6 patch release summarizes the main changes since v0.2.4, including the 0.2.5 security and configuration-migration fixes that were not published as a standalone GitHub Release.

Bug Fixes

• Fix the FastCtx client process lifecycle: track and reclaim only the serve clients this plugin starts, terminate its own child processes when the host exits normally, and force FastCtx's identity-aware parent watcher on as the backstop when the host is killed; closing a connection rejects pending requests immediately, concurrent closes share one shutdown with a bounded force-kill escalation, and shared-runtime leases are kept until the last component releases them. by @T-Auto
• Fix executor binding for the system shell fallback: FastCtx is bound only to the resolved bash, and no command or background tools are published without an approved executor; shared runtimes are keyed by executor policy so one component's fallback choice cannot leak into another. by @T-Auto

Chores

• Change the allowSystemShellFallback default to false in both code and the shipped configuration; probing PATH and common directories for bash now requires an explicit opt-in. by @T-Auto
• Add a one-time upgrade configuration self-check: on first startup, an unmigrated legacy allowSystemShellFallback: true is changed to false before executor resolution and tool publication, written back to the component's own configuration row through the host loader with configUpdateVersion: 1, and a later manual opt-in to true is not overwritten by restarts or hot reloads. by @T-Auto

Full Changelog: v0.2.4...v0.2.6