docs: correct member isolation and DSH SDK guidance after review

CHANGELOG.md

@@ -17,7 +17,7 @@
 
 ### Workspaces and conversations
 
-- Optional member file isolation resolves personal files by member identity with shared-file fallback; existing workspace roles and default sharing still apply (#644).
+- Member file isolation is an opt-in strict sandbox. With `MATECLAW_WORKSPACE_SANDBOX_MEMBER_ISOLATION_ENABLED=true`, authenticated user and workspace identities determine the file root; missing identity denies access without shared-directory fallback. Only six audited builtin file/code tools are available; DSH, MCP/plugin tools, shared skill scripts and unauthenticated channel identities are unavailable. This differs from personal memory-file fallback. (#644).
 - Persistent channel conversations expire stale query context. Uploaded images resolve from conversation storage; directory uploads retain directory metadata and validate containment.
 - Employee drafts accept JSON following reasoning blocks, and explicit tool opt-out is respected even for general capabilities (#648, #655).
 

mateclaw-server/src/main/resources/docs/en/changelog.md

@@ -8,7 +8,7 @@ Development snapshot; no stable 3.0.0 release has been published.
 
 ### Workspaces and conversations
 
-- Optional member file isolation resolves personal files by member identity with shared-file fallback; existing workspace roles and default sharing still apply (#644).
+- Member file isolation is an opt-in strict sandbox. With `MATECLAW_WORKSPACE_SANDBOX_MEMBER_ISOLATION_ENABLED=true`, authenticated user and workspace identities determine the file root; missing identity denies access without shared-directory fallback. Only six audited builtin file/code tools are available; DSH, MCP/plugin tools, shared skill scripts and unauthenticated channel identities are unavailable. This differs from personal memory-file fallback. (#644).
 - Persistent channel conversations expire stale query context. Uploaded images resolve from conversation storage; directory uploads retain directory metadata and validate containment.
 - Employee drafts accept JSON following reasoning blocks, and explicit tool opt-out is respected even for general capabilities (#648, #655).
 

mateclaw-server/src/main/resources/docs/en/intro.md

@@ -14,7 +14,7 @@ head:
 
 # MateClaw — Self-hosted Multi-Agent AI Operating System
 
-**v2.3.0 (released 2026-09-20) — JSON acceptance and execution evidence for persistent Goals.** Users can configure required JSON fields and bind checks to current requirements and immutable artifact versions. This release also adds controlled worker intervention and skill document/folder uploads, with fixes for DSH history and output budgets, vLLM reasoning, and SSE framing. [v2.3.0](./releases/2.3.0)
+**Previous stable release v2.3.0 (released 2026-09-20) — JSON acceptance and execution evidence for persistent Goals.** Users can configure required JSON fields and bind checks to current requirements and immutable artifact versions. This release also adds controlled worker intervention and skill document/folder uploads, with fixes for DSH history and output budgets, vLLM reasoning, and SSE framing. [v2.3.0](./releases/2.3.0)
 
 **Your multi-agent AI. On your hardware. Under your rules.**
 

mateclaw-server/src/main/resources/docs/en/workspaces.md

@@ -318,4 +318,4 @@ curl -X PUT http://localhost:18088/api/v1/workspaces/1/members/42 \
 
 ## Member file isolation (3.0.0)
 
-Personal files can be isolated by member identity with shared-file fallback. This is opt-in and does not change default sharing; workspace roles and tool permissions still apply.
+Member file isolation is an opt-in strict sandbox. With `MATECLAW_WORKSPACE_SANDBOX_MEMBER_ISOLATION_ENABLED=true`, authenticated user and workspace identities determine the file root; missing identity denies access without shared-directory fallback. Only six audited builtin file/code tools are available; DSH, MCP/plugin tools, shared skill scripts and unauthenticated channel identities are unavailable. This differs from personal memory-file fallback.

mateclaw-server/src/main/resources/docs/zh/changelog.md

@@ -8,7 +8,7 @@
 
 ### 工作空间与会话
 
-- 可选成员文件隔离：共享工作空间中按成员身份解析个人文件，保留共享文件回退；默认共享策略与工作空间角色权限仍适用（#644）。
+- 成员文件隔离为可选严格沙箱模式，开启 `MATECLAW_WORKSPACE_SANDBOX_MEMBER_ISOLATION_ENABLED=true` 后按已认证用户和工作空间划定文件根目录；身份缺失即拒绝访问，不回退到共享目录。当前仅开放六个经审查的内置文件/代码工具；DSH、MCP/plugin 工具、共享技能脚本和未认证渠道身份不可用。它与个人记忆文件的共享回退是不同机制。 (#644).
 - 持久渠道会话过期查询上下文清理，避免旧请求影响新任务。上传图片从会话存储解析，目录附件保留目录信息并校验上传边界。
 - 员工创建时兼容推理块后的 JSON；显式关闭工具的员工不再因通用能力被重新赋予工具（#648、#655）。
 

mateclaw-server/src/main/resources/docs/zh/intro.md

@@ -14,7 +14,7 @@ head:
 
 # MateClaw — 自部署多智能体 AI 操作系统
 
-**v2.3.0（2026-09-20 发布）——持久目标的 JSON 验收与执行证据。** 用户可配置 JSON 必需字段，将检查结果绑定到当前要求和不可变产物版本；同时加入团队成员受控干预、技能文档及文件夹上传，并修复 DSH 历史与输出预算、vLLM 推理内容和 SSE 分帧。 [v2.3.0](./releases/2.3.0)
+**上一正式版 v2.3.0（2026-09-20 发布）——持久目标的 JSON 验收与执行证据。** 用户可配置 JSON 必需字段，将检查结果绑定到当前要求和不可变产物版本；同时加入团队成员受控干预、技能文档及文件夹上传，并修复 DSH 历史与输出预算、vLLM 推理内容和 SSE 分帧。 [v2.3.0](./releases/2.3.0)
 
 **你的多智能体 AI，跑在你自己的机器上，按你自己的规则。**
 

mateclaw-server/src/main/resources/docs/zh/workspaces.md

@@ -323,4 +323,4 @@ curl -X PUT http://localhost:18088/api/v1/workspaces/1/members/42 \
 
 ## 成员文件隔离（3.0.0）
 
-可按成员身份隔离个人文件，保留共享文件回退。此能力是可选配置，不改变默认共享模式；个人文件访问仍受工作空间角色与工具权限控制。
+成员文件隔离为可选严格沙箱模式，开启 `MATECLAW_WORKSPACE_SANDBOX_MEMBER_ISOLATION_ENABLED=true` 后按已认证用户和工作空间划定文件根目录；身份缺失即拒绝访问，不回退到共享目录。当前仅开放六个经审查的内置文件/代码工具；DSH、MCP/plugin 工具、共享技能脚本和未认证渠道身份不可用。它与个人记忆文件的共享回退是不同机制。