DOCX: decode paragraphs from the token stream at any depth, so text inside w:ins, w:hyperlink, w:fldSimple, w:sdt is kept; deleted/moved-from text, field codes and mc:Fallback are excluded; revised documents carry an explicit warning (SR-A5, no silent degradation).
Exec hard switch: Options.DisableExecTools (SurfaceVersion 2.5.0-experimental), CLI --disable-exec-tools, config disableExecTools, env AGENT_SYSTEM_DISABLE_EXEC_TOOLS. When on, run_shell/run_python/register_artifact are refused and hidden and the squad kernel gets no exec config; user setting runtime.exec cannot re-enable them. Zero value = current behavior.
Why
The previous decoder only read w:r runs that were direct children of w:p: tracked insertions and hyperlink text vanished with an empty warning list (probe: "周期1812个月" parsed as "周期个月").
runtime.exec is user-writable (PUT /api/settings/user), so multi-user deployments had no reliable off switch. This is the temporary safety posture until an isolated exec tier exists; exec capability is still needed later.
GOWORK=off go test ./... 32/32 packages ok; surface snapshot test passes.
Mock-mode binary with --disable-exec-tools: after PUT /api/settings/user {"runtime":{"exec":true}}, /api/tools lists none of the exec primitives; without the flag they reappear.
Refs
Agent-System-RDM docs/proposals/2026-10-09-V22-review-and-implementation-plan.md (G0-7, B-5①); part of the v0.2.0 release scope.
## Summary
- DOCX: decode paragraphs from the token stream at any depth, so text inside `w:ins`, `w:hyperlink`, `w:fldSimple`, `w:sdt` is kept; deleted/moved-from text, field codes and `mc:Fallback` are excluded; revised documents carry an explicit warning (SR-A5, no silent degradation).
- Exec hard switch: `Options.DisableExecTools` (SurfaceVersion 2.5.0-experimental), CLI `--disable-exec-tools`, config `disableExecTools`, env `AGENT_SYSTEM_DISABLE_EXEC_TOOLS`. When on, `run_shell`/`run_python`/`register_artifact` are refused and hidden and the squad kernel gets no exec config; user setting `runtime.exec` cannot re-enable them. Zero value = current behavior.
## Why
- The previous decoder only read `w:r` runs that were direct children of `w:p`: tracked insertions and hyperlink text vanished with an empty warning list (probe: "周期<ins>18</ins><del>12</del>个月" parsed as "周期个月").
- `runtime.exec` is user-writable (`PUT /api/settings/user`), so multi-user deployments had no reliable off switch. This is the temporary safety posture until an isolated exec tier exists; exec capability is still needed later.
## Tests (SELF; CI pending on this PR)
- Red→green: `TestParseDocxTrackedChangesAndHyperlinks`, `TestParseDocxNoRevisionNoWarning`, `TestExecHardDisabledOverridesSettings`, `TestDisableExecToolsLayers`.
- `GOWORK=off go test ./...` 32/32 packages ok; surface snapshot test passes.
- Mock-mode binary with `--disable-exec-tools`: after `PUT /api/settings/user {"runtime":{"exec":true}}`, `/api/tools` lists none of the exec primitives; without the flag they reappear.
## Refs
- Agent-System-RDM `docs/proposals/2026-10-09-V22-review-and-implementation-plan.md` (G0-7, B-5①); part of the v0.2.0 release scope.
Why: The DOCX parser only read w:r runs that were direct children of w:p, so
text inside w:ins, w:hyperlink and w:fldSimple was dropped with no warning,
violating the no-silent-degradation rule. Separately, runtime.exec is a
user-writable setting, so multi-user deployments could not reliably turn the
exec primitives off.
Evidence: SELF - red tests TestParseDocxTrackedChangesAndHyperlinks and
TestExecHardDisabledOverridesSettings failed before and pass after; backend
go test ./... (32 packages) passes; a mock-mode binary started with
--disable-exec-tools hides run_shell/run_python/register_artifact from
/api/tools even after the user sets runtime.exec=true.
Impact: DOCX paragraphs are decoded from the token stream at any depth;
deleted/moved-from text, field codes and mc:Fallback are excluded and
revised documents carry an explicit warning. New Options.DisableExecTools
(SurfaceVersion 2.5.0-experimental), CLI --disable-exec-tools, config key
disableExecTools and env AGENT_SYSTEM_DISABLE_EXEC_TOOLS; zero value keeps
current behavior.
Refs: Agent-System-RDM docs/proposals/2026-10-09-V22-review-and-implementation-plan.md (G0-7, B-5)
weichen
merged commit f1c9cc0644 into main2026-10-09 10:39:19 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
w:ins,w:hyperlink,w:fldSimple,w:sdtis kept; deleted/moved-from text, field codes andmc:Fallbackare excluded; revised documents carry an explicit warning (SR-A5, no silent degradation).Options.DisableExecTools(SurfaceVersion 2.5.0-experimental), CLI--disable-exec-tools, configdisableExecTools, envAGENT_SYSTEM_DISABLE_EXEC_TOOLS. When on,run_shell/run_python/register_artifactare refused and hidden and the squad kernel gets no exec config; user settingruntime.execcannot re-enable them. Zero value = current behavior.Why
w:rruns that were direct children ofw:p: tracked insertions and hyperlink text vanished with an empty warning list (probe: "周期1812个月" parsed as "周期个月").runtime.execis user-writable (PUT /api/settings/user), so multi-user deployments had no reliable off switch. This is the temporary safety posture until an isolated exec tier exists; exec capability is still needed later.Tests (SELF; CI pending on this PR)
TestParseDocxTrackedChangesAndHyperlinks,TestParseDocxNoRevisionNoWarning,TestExecHardDisabledOverridesSettings,TestDisableExecToolsLayers.GOWORK=off go test ./...32/32 packages ok; surface snapshot test passes.--disable-exec-tools: afterPUT /api/settings/user {"runtime":{"exec":true}},/api/toolslists none of the exec primitives; without the flag they reappear.Refs
docs/proposals/2026-10-09-V22-review-and-implementation-plan.md(G0-7, B-5①); part of the v0.2.0 release scope.