dsh-opsBLOCK

'.netrc',

'.git-credentials',

fs.writeFileSync(path.join(home, '.ssh', 'id_ed25519'), 'PRIVATE')

assert.equal(deny(path.join(home, '.ssh', 'id_ed25519')).denied, true)

for (const name of ['id_rsa', 'id_ed25519.pub', 'service-account-prod.json', 'app-credentials.yaml', '.env', '.env.local'])

import { applyComponent } from "../../index.js"

import { apply } from '../../official-tool-hiding.js'

import { apply as mount } from '../../ptc/index.js'

import { applyComponent } from "../../index.js"

import { createActivityStore, resolveActivityConfig } from '../../tui/activity.js'

set HTTPS_PROXY=http://127.0.0.1:<clash-port>

$env:HTTPS_PROXY = 'http://127.0.0.1:<clash-port>'

set HTTPS_PROXY=http://127.0.0.1:<clash-port>

$env:HTTPS_PROXY = 'http://127.0.0.1:<clash-port>'

url: 'https://127.0.0.1:9/forged-pwsh.zip',

for (const [name, bytes, lineCount] of [['crlf', Buffer.from('\ufeffα\r\nβ\r\n'), 2], ['empty', Buffer.alloc(0), 0], ['binary', Buffer.from([0xff, 0]), null]]) {

const created = await call('write_file', { path: target, expectedRevision: 'absent', content: 'α\r\nβ\n' }, root)

assert.equal(dry.changed, 0); assert.equal(dry.revision, hash('')); assert.equal(fs.readFileSync(target, 'utf8'), 'α\r\nβ\n')

const target = path.join(root, 'patch.txt'); const original = '\ufeffalpha\r\nβeta\r\nend\r\n'

const edits = [{ oldText: 'alpha', newText: 'βeta' }, { oldText: 'βeta', newText: 'DONE' }]

yaml

1 **Fixed file operations use a trusted-operation policy fence, matching DSH fs-sandbox, not arbitrary-code isolation.** OS-readable paths are readable in all modes; read-only rejects replacement, inc

- `publishBashTool`: publish `ops_bash` using current session policy; restricted modes require the host sandbox, full access uses the host subprocess service.

not new authority; full access permits external roots without confinement.

| Shell + file (default, full access) | 5 | 7,685 | 1,922 |