@dharma-ai-labs/agent-fabric 0.2.197 → 0.2.199

package/dist/wslRelayHost.js

@@ -0,0 +1,269 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstat, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { userInfo } from 'node:os';
+import { join, resolve } from 'node:path';
+import { captureBootstrapHostChild, currentBootstrapHostScope } from './bootstrapHostScope.js';
+const fail = (conflict = false) => {
+    throw new Error(conflict
+        ? 'autostart_conflict: the WSL host task is not owned by this installation.' : 'wsl_host_startup_unavailable');
+};
+const receiptPath = (home) => join(home, 'relay', 'wsl-host.json');
+const literal = (value) => `'${value.replace(/'/g, "''")}'`;
+const object = (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value));
+const digest = (home, context) => createHash('sha256').update(JSON.stringify([home, context.distribution, context.linuxUser])).digest('hex');
+const windowsArgs = (script) => ['/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe',
+    '-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')];
+export function resolveWslRelayContext(distribution, linuxUser, installed = null) {
+    if (!distribution) {
+        if (!object(installed) || installed.schema !== 'dharma.wsl-relay-host/v1'
+            || installed.linuxUser !== linuxUser || typeof installed.distribution !== 'string')
+            return fail();
+        distribution = installed.distribution;
+    }
+    if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$/.test(distribution) || distribution.trim() !== distribution
+        || !/^[a-z_][a-z0-9_-]{0,31}$/.test(linuxUser))
+        return fail();
+    return { distribution, linuxUser };
+}
+async function privateParent(options) {
+    for (const path of [options.home, join(options.home, 'relay')]) {
+        const stat = await lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(path) !== resolve(path)
+            || process.platform !== 'win32' && ((stat.mode & 0o077) !== 0 || stat.uid !== process.getuid()))
+            return fail(true);
+    }
+}
+async function windows(script) {
+    const scope = currentBootstrapHostScope();
+    const operation = () => new Promise((accept, reject) => {
+        const child = execFile('/init', windowsArgs(script), { cwd: '/mnt/c/Windows/System32', timeout: 15000, maxBuffer: 16384, signal: scope?.signal }, (error, stdout) => error ? reject(error) : accept({ stdout }));
+        if (scope)
+            captureBootstrapHostChild(scope, child);
+    });
+    return operation();
+}
+async function context(options) {
+    let value;
+    if (options.wslHost)
+        value = await options.wslHost.context();
+    else {
+        if (process.platform !== 'linux')
+            return null;
+        for (const marker of ['/.dockerenv', '/run/.containerenv']) {
+            try {
+                await lstat(marker);
+                return null;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    return fail();
+            }
+        }
+        const kernel = await readFile('/proc/sys/kernel/osrelease', 'utf8');
+        if (!/microsoft/i.test(kernel))
+            return null;
+        if (!process.getuid?.())
+            return fail();
+        value = resolveWslRelayContext(process.env.WSL_DISTRO_NAME, userInfo().username, process.env.WSL_DISTRO_NAME ? null : await saved(options));
+    }
+    if (value === null)
+        return null;
+    if (!object(value) || Object.keys(value).sort().join(',') !== 'distribution,linuxUser'
+        || typeof value.distribution !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$/.test(value.distribution)
+        || value.distribution.trim() !== value.distribution || typeof value.linuxUser !== 'string'
+        || !/^[a-z_][a-z0-9_-]{0,31}$/.test(value.linuxUser))
+        return fail();
+    return value;
+}
+async function invoke(options, script) {
+    const scope = currentBootstrapHostScope();
+    try {
+        if (windowsArgs(script).at(-1).length > 28000)
+            return fail();
+        const run = options.wslHost?.run || (options.run
+            ? value => options.run('/init', windowsArgs(value)) : windows);
+        const result = await (scope ? scope.step(() => run(script)) : run(script));
+        if (Buffer.byteLength(result.stdout) > 16384)
+            return fail();
+        return JSON.parse(result.stdout.replace(/^\uFEFF/, '').trim());
+    }
+    catch {
+        await scope?.assert();
+        return fail();
+    }
+}
+async function expected(options, current) {
+    const identity = await invoke(options, '# dharma-wsl-host:identity\n$ErrorActionPreference="Stop"; '
+        + '$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; '
+        + '$exe=Join-Path $env:SystemRoot "System32\\wsl.exe"; '
+        + '@{sid=$sid;executable=$exe}|ConvertTo-Json -Compress');
+    if (!object(identity) || Object.keys(identity).sort().join(',') !== 'executable,sid'
+        || typeof identity.sid !== 'string' || !/^S-1-5-21-(?:\d{1,10}-){2}\d{1,10}-\d{1,10}$/.test(identity.sid)
+        || typeof identity.executable !== 'string' || !/^[A-Za-z]:\\Windows\\System32\\wsl\.exe$/i.test(identity.executable))
+        return fail();
+    const hash = digest(options.home, current);
+    return { ...current, schema: 'dharma.wsl-relay-host/v1', windowsSid: identity.sid,
+        executable: identity.executable, taskName: `DharmaAgentFabric-WSL-${hash.slice(0, 24)}`,
+        arguments: `--distribution "${current.distribution}" --user "${current.linuxUser}" --cd / --exec /usr/bin/systemctl --user start --wait dharma-agent-fabric.service`,
+        description: `Dharma Agent Fabric owned WSL host ${hash}` };
+}
+async function saved(options) {
+    try {
+        const path = receiptPath(options.home), stat = await lstat(path);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 8192
+            || process.platform !== 'win32' && ((stat.mode & 0o077) !== 0 || stat.uid !== process.getuid()))
+            return fail(true);
+        await privateParent(options);
+        const value = JSON.parse(await readFile(path, 'utf8'));
+        if (!object(value))
+            return fail(true);
+        return value;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        return fail(true);
+    }
+}
+function sameReceipt(value, target) {
+    const keys = Object.keys(target);
+    return Object.keys(value).length === keys.length && keys.every(key => Reflect.get(value, key) === Reflect.get(target, key));
+}
+function lookup(receipt, required = false) {
+    const query = `$task=Get-ScheduledTask -TaskPath '\\' -TaskName ${literal(receipt.taskName)} -ErrorAction Stop; `;
+    return required ? query : `$task=$null; try { ${query} } catch { `
+        + `if ($_.FullyQualifiedErrorId -cne 'CmdletizationQuery_NotFound,Get-ScheduledTask' `
+        + `-or [string]$_.CategoryInfo.Category -ne 'ObjectNotFound') {throw} }; `;
+}
+function taskAction(receipt) {
+    // Direct WSL scheduled actions can exit before Linux starts. Preserve the
+    // same limited identity while hosting the fixed native command in PowerShell.
+    const script = `$ErrorActionPreference='Stop'; & ${literal(receipt.executable)} `
+        + `--distribution ${literal(receipt.distribution)} --user ${literal(receipt.linuxUser)} `
+        + `--cd / --exec /usr/bin/systemctl --user start --wait dharma-agent-fabric.service; exit $LASTEXITCODE`;
+    return { executable: receipt.executable.replace(/wsl\.exe$/i, 'WindowsPowerShell\\v1.0\\powershell.exe'),
+        arguments: `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(script, 'utf16le').toString('base64')}` };
+}
+function taskPreamble(receipt, operation) {
+    const action = taskAction(receipt);
+    return `# dharma-wsl-host:${operation}\n$ErrorActionPreference="Stop"; `
+        + `$current=[System.Security.Principal.WindowsIdentity]::GetCurrent(); `
+        + `if ($current.User.Value -cne ${literal(receipt.windowsSid)}) {throw 'wsl_host_identity_conflict'}; `
+        + lookup(receipt)
+        + `function Assert-OwnedTask($value) { $actions=@($value.Actions); $triggers=@($value.Triggers); `
+        + `$definition=[xml](Export-ScheduledTask -TaskPath '\\' -TaskName ${literal(receipt.taskName)} -ErrorAction Stop); `
+        + `$principals=@($definition.Task.Principals.Principal); `
+        + `if ($value.Description -cne ${literal(receipt.description)} -or $actions.Count -ne 1 `
+        + `-or $actions[0].Execute -cne ${literal(action.executable)} -or $actions[0].Arguments -cne ${literal(action.arguments)} `
+        + `-or $principals.Count -ne 1 -or $principals[0].UserId -cne $current.User.Value `
+        + `-or [string]$value.Principal.LogonType -ne 'Interactive' -or [string]$value.Principal.RunLevel -ne 'Limited' `
+        + `-or $triggers.Count -ne 1 -or $triggers[0].CimClass.CimClassName -ne 'MSFT_TaskLogonTrigger' -or !$triggers[0].Enabled `
+        + `-or ($triggers[0].UserId -cne $current.User.Value -and $triggers[0].UserId -cne $current.Name) `
+        + `-or [string]$value.Settings.MultipleInstances -ne 'IgnoreNew' `
+        + `-or $value.Settings.ExecutionTimeLimit -ne 'PT0S' -or $value.Settings.RestartCount -ne 0 `
+        + `-or $value.Settings.DisallowStartIfOnBatteries -or $value.Settings.StopIfGoingOnBatteries) {throw 'wsl_host_task_conflict'} }; `;
+}
+const renderState = `if ($null -eq $task) { @{exists=$false;enabled=$false;running=$false}|ConvertTo-Json -Compress } `
+    + `else { Assert-OwnedTask $task; @{exists=$true;enabled=($task.State -ne 'Disabled');running=($task.State -eq 'Running')}|ConvertTo-Json -Compress }`;
+async function query(options, receipt) {
+    const value = await invoke(options, taskPreamble(receipt, 'status') + renderState);
+    if (!object(value) || Object.keys(value).sort().join(',') !== 'enabled,exists,running'
+        || Object.values(value).some(field => typeof field !== 'boolean'))
+        return fail();
+    if (!value.exists && (value.enabled || value.running) || value.running && !value.enabled)
+        return fail();
+    return value;
+}
+export async function assertWslHostPreflight(options) {
+    const current = await context(options);
+    if (!current)
+        return;
+    const target = await expected(options, current), previous = await saved(options);
+    if (previous && !sameReceipt(previous, target))
+        return fail(true);
+    const state = await query(options, target);
+    if (state.exists && !previous)
+        return fail(true);
+}
+export async function enableWslRelayHost(options) {
+    const current = await context(options);
+    if (!current)
+        return;
+    const target = await expected(options, current), previous = await saved(options);
+    if (previous && !sameReceipt(previous, target))
+        return fail(true);
+    const before = await query(options, target);
+    if (before.exists && !previous)
+        return fail(true);
+    await privateParent(options);
+    if (!previous)
+        await writeFile(receiptPath(options.home), `${JSON.stringify(target, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    if (before.exists && before.enabled)
+        return;
+    // Preserve ownership before external mutation. Lost responses require readback,
+    // not replacement of a possibly foreign task.
+    const action = taskAction(target);
+    await invoke(options, taskPreamble(target, 'register')
+        + `if ($null -ne $task) { Assert-OwnedTask $task; Enable-ScheduledTask -TaskPath '\\' -TaskName ${literal(target.taskName)}|Out-Null } else { `
+        + `$action=New-ScheduledTaskAction -Execute ${literal(action.executable)} -Argument ${literal(action.arguments)}; `
+        + `$trigger=New-ScheduledTaskTrigger -AtLogOn -User $current.Name; `
+        + `$principal=New-ScheduledTaskPrincipal -UserId $current.Name -LogonType Interactive -RunLevel Limited; `
+        + `$settings=New-ScheduledTaskSettingsSet -MultipleInstances IgnoreNew -ExecutionTimeLimit ([TimeSpan]::Zero) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; `
+        + `Register-ScheduledTask -TaskPath '\\' -TaskName ${literal(target.taskName)} -Description ${literal(target.description)} `
+        + `-Action $action -Trigger $trigger -Principal $principal -Settings $settings|Out-Null }; `
+        + lookup(target, true) + renderState);
+    const after = await query(options, target);
+    if (!after.exists || !after.enabled)
+        return fail();
+}
+export async function wslRelayHostStatus(options) {
+    const current = await context(options);
+    if (!current)
+        return null;
+    const previous = await saved(options);
+    if (!previous)
+        return fail();
+    const target = await expected(options, current);
+    if (!sameReceipt(previous, target))
+        return fail(true);
+    return query(options, target);
+}
+export async function startWslRelayHost(options) {
+    const current = await context(options);
+    if (!current)
+        return;
+    const target = await expected(options, current), previous = await saved(options);
+    if (!previous || !sameReceipt(previous, target))
+        return fail(true);
+    const before = await query(options, target);
+    if (!before.exists || !before.enabled)
+        return fail();
+    if (before.running)
+        return;
+    await invoke(options, taskPreamble(target, 'start') + `if ($null -eq $task) {throw 'wsl_host_missing'}; Assert-OwnedTask $task; `
+        + `Start-ScheduledTask -TaskPath '\\' -TaskName ${literal(target.taskName)}; `
+        + `for ($attempt=0; $attempt -lt 40; $attempt++) { ` + lookup(target, true)
+        + `Assert-OwnedTask $task; if ($task.State -eq 'Running') {break}; Start-Sleep -Milliseconds 100 }; ` + renderState);
+    if (!(await query(options, target)).running)
+        return fail();
+}
+export async function disableWslRelayHost(options) {
+    const previous = await saved(options);
+    if (!previous)
+        return;
+    const current = await context(options);
+    if (!current)
+        return fail(true);
+    const target = await expected(options, current);
+    if (!sameReceipt(previous, target))
+        return fail(true);
+    await query(options, target);
+    await invoke(options, taskPreamble(target, 'disable') + `if ($null -ne $task) { Assert-OwnedTask $task; `
+        + `Unregister-ScheduledTask -TaskPath '\\' -TaskName ${literal(target.taskName)} -Confirm:$false }; `
+        + lookup(target) + renderState);
+    if ((await query(options, target)).exists)
+        return fail();
+    await rm(receiptPath(options.home));
+}
+//# sourceMappingURL=wslRelayHost.js.map

package/dist/wslRelayHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wslRelayHost.js","sourceRoot":"","sources":["../src/wslRelayHost.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAC,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAC,QAAQ,EAAC,MAAM,SAAS,CAAC;AACjC,OAAO,EAAC,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AACxC,OAAO,EAAC,yBAAyB,EAAE,yBAAyB,EAAC,MAAM,yBAAyB,CAAC;AAY7F,MAAM,IAAI,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAS,EAAE;IAAE,MAAM,IAAI,KAAK,CAAC,QAAQ;QACjE,CAAC,CAAC,0EAA0E,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;AAAA,CAAC,CAAC;AACnH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AAC3E,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACpE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1I,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9J,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,+DAA+D;IACtG,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEpH,MAAM,UAAU,sBAAsB,CAAC,YAAgC,EAAE,SAAiB,EAAE,YAAqB,IAAI;IACnH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,0BAA0B;eACpE,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAC;QACpG,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,YAAY;WAC/F,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAChE,OAAO,EAAC,YAAY,EAAE,SAAS,EAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAuB;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;eACrF,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACxH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc;IACnC,MAAM,KAAK,GAAG,yBAAyB,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,OAAO,CAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EACnD,EAAC,GAAG,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAC,EACzF,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK;YAAE,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAuB;IAC5C,IAAI,KAAqB,CAAC;IAC1B,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;SACxD,CAAC;QACJ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC;gBAAA,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAA,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAA,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,EAAE,CAAC;YAAA,CAAC;QAChI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,OAAO,IAAI,EAAE,CAAC;QACvC,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,wBAAwB;WACjF,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;WACxG,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACvF,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,yBAAyB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAW,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAI,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QAAA,MAAM,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;IAAA,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAuB,EAAE,OAAgB;IAC/D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,6DAA6D;UAChG,6EAA6E;UAC7E,sDAAsD;UACtD,sDAAsD,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,gBAAgB;WAC/E,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;WACtG,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACtI,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAC,GAAG,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG;QAC9E,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACvF,SAAS,EAAE,mBAAmB,OAAO,CAAC,YAAY,aAAa,OAAO,CAAC,SAAS,oFAAoF;QACpK,WAAW,EAAE,sCAAsC,IAAI,EAAE,EAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAuB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;eAC1D,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACtH,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAgB,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,MAAe;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB,EAAE,QAAQ,GAAG,KAAK;IAChD,MAAM,KAAK,GAAG,oDAAoD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAClH,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,KAAK,aAAa;UAC9D,oFAAoF;UACpF,wEAAwE,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,oCAAoC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG;UAC7E,kBAAkB,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;UACvF,sGAAsG,CAAC;IAC3G,OAAO,EAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,yCAAyC,CAAC;QACrG,SAAS,EAAE,0EAA0E,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAC,CAAC;AAC9I,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,SAAiB;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,qBAAqB,SAAS,mCAAmC;UACpE,sEAAsE;UACtE,gCAAgC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,0CAA0C;UACrG,MAAM,CAAC,OAAO,CAAC;UACf,gGAAgG;UAChG,mEAAmE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;UACnH,wDAAwD;UACxD,+BAA+B,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B;UACvF,gCAAgC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,mCAAmC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;UACzH,iFAAiF;UACjF,+GAA+G;UAC/G,yHAAyH;UACzH,iGAAiG;UACjG,gEAAgE;UAChE,2FAA2F;UAC3F,iIAAiI,CAAC;AACxI,CAAC;AAED,MAAM,WAAW,GAAG,mGAAmG;MACnH,oJAAoJ,CAAC;AAEzJ,KAAK,UAAU,KAAK,CAAC,OAAuB,EAAE,OAAgB;IAC5D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,WAAW,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,wBAAwB;WACjF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACnF,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IACxG,OAAO,KAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAuB;IAClE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO;QAAE,OAAO;IAC7D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAuB;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO;QAAE,OAAO;IAC7D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC5C,gFAAgF;IAChF,8CAA8C;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC;UAClD,gGAAgG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB;UAC7I,4CAA4C,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;UACjH,kEAAkE;UAClE,wGAAwG;UACxG,mKAAmK;UACnK,mDAAmD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG;UAC1H,0FAA0F;UAC1F,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAuB;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,OAAO,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAuB;IAC7D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO;QAAE,OAAO;IAC7D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IAClG,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,2EAA2E;UAC7H,gDAAgD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;UAC5E,kDAAkD,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;UACzE,mGAAmG,GAAG,WAAW,CAAC,CAAC;IACvH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAuB;IAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ;QAAE,OAAO;IAC7D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,iDAAiD;UACrG,qDAAqD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB;UACnG,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,EAAE,CAAC;IACzD,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/wslRelayHost.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=wslRelayHost.test.d.ts.map

package/dist/wslRelayHost.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wslRelayHost.test.d.ts","sourceRoot":"","sources":["../src/wslRelayHost.test.ts"],"names":[],"mappings":""}

package/dist/wslRelayHost.test.js

@@ -0,0 +1,308 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { compileFunction } from 'node:vm';
+import test from 'node:test';
+import ts from 'typescript';
+import { enableRelayAutostart, relayAutostartStatus, disableRelayAutostart, startRelayAutostart, assertRelayStartupOwnership } from './relayAutostart.js';
+import { resolveWslRelayContext } from './wslRelayHost.js';
+import { validateContract } from '@dharma-ai-labs/agent-fabric-contracts';
+import { prepareCodexBootstrapHost, runCodexBootstrapHostScope } from './bootstrapHostScope.js';
+test('real WSL Windows launch uses a fixed Windows cwd rather than the Linux caller directory', async () => {
+    const source = await readFile(new URL('../src/wslRelayHost.ts', import.meta.url), 'utf8');
+    const ast = ts.createSourceFile('wslRelayHost.ts', source, ts.ScriptTarget.Latest, true);
+    const declaration = ast.statements.find(node => ts.isFunctionDeclaration(node) && node.name?.text === 'windows');
+    assert.ok(declaration && ts.isFunctionDeclaration(declaration));
+    const compiled = ts.transpileModule(declaration.getText(ast), { compilerOptions: {
+            target: ts.ScriptTarget.ES2023, module: ts.ModuleKind.CommonJS
+        } }).outputText;
+    let calls = 0;
+    const launch = compileFunction(compiled + '\nreturn windows;', ['currentBootstrapHostScope', 'execFile', 'windowsArgs', 'captureBootstrapHostChild'])(() => undefined, (file, args, options, done) => {
+        calls++;
+        assert.equal(file, '/init');
+        assert.deepEqual(args, ['public-arguments']);
+        assert.equal(options.cwd, '/mnt/c/Windows/System32', 'Linux cwd must not become a Windows UNC current directory');
+        assert.equal(options.timeout, 15000);
+        assert.equal(options.maxBuffer, 16384);
+        done(null, '{"public":true}');
+        return {};
+    }, () => ['public-arguments'], () => { throw new Error('no setup scope in this fixture'); });
+    assert.deepEqual(await launch('public-script'), { stdout: '{"public":true}' });
+    assert.equal(calls, 1);
+});
+async function fixture(t) {
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'dharma-wsl-host-')));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const scripts = [];
+    let exists = false;
+    let running = false;
+    let loseRegistrationResponse = false;
+    const options = { platform: 'linux', home: join(root, 'device'), userHome: root,
+        workspace: '/fixtures/repo', launcher: '/fixtures/repo/.dharma/bin/dharma',
+        policy: '/fixtures/repo/.dharma/approved-policy.json', version: '0.2.198',
+        run: async () => ({ stdout: 'enabled\n' }),
+        wslHost: {
+            context: async () => ({ distribution: 'Ubuntu', linuxUser: 'maatru' }),
+            run: async (script) => {
+                scripts.push(script);
+                if (script.includes('dharma-wsl-host:identity'))
+                    return { stdout: JSON.stringify({
+                            sid: 'S-1-5-21-123-456-789-1001', executable: 'C:\\Windows\\System32\\wsl.exe'
+                        }) };
+                if (script.includes('dharma-wsl-host:register')) {
+                    exists = true;
+                    if (loseRegistrationResponse)
+                        throw new Error('registration response lost');
+                }
+                if (script.includes('dharma-wsl-host:start'))
+                    running = true;
+                if (script.includes('dharma-wsl-host:disable')) {
+                    exists = false;
+                    running = false;
+                }
+                return { stdout: JSON.stringify({ exists, enabled: exists, running }) };
+            },
+        },
+    };
+    return { options, scripts, foreignTask: () => { exists = true; }, loseResponse: () => { loseRegistrationResponse = true; } };
+}
+function registeredTaskAction(scripts) {
+    const registration = scripts.find(script => script.includes('dharma-wsl-host:register'));
+    const match = /New-ScheduledTaskAction -Execute '([^']+)' -Argument '([^']+)'/.exec(registration);
+    assert.ok(match, 'expected one fixed task action');
+    return { execute: match[1], arguments: match[2] };
+}
+test('WSL task uses the verified PowerShell host for its fixed native wait action', async (t) => {
+    const f = await fixture(t);
+    await enableRelayAutostart(f.options);
+    const action = registeredTaskAction(f.scripts);
+    assert.equal(action.execute, 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe');
+    assert.match(action.arguments, /^-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand [A-Za-z0-9+/=]+$/);
+    const script = Buffer.from(action.arguments.split(' ').at(-1), 'base64').toString('utf16le');
+    assert.equal(script, "$ErrorActionPreference='Stop'; & 'C:\\Windows\\System32\\wsl.exe' --distribution 'Ubuntu' --user 'maatru' --cd / --exec /usr/bin/systemctl --user start --wait dharma-agent-fabric.service; exit $LASTEXITCODE");
+    assert.doesNotMatch(script, /ExecutionPolicy|credential|password|token|grant|Start-Process|Invoke-Expression/i);
+});
+test('optional WSL task lookup distinguishes exact absence from a failed scheduler read', async () => {
+    const source = await readFile(new URL('../src/wslRelayHost.ts', import.meta.url), 'utf8');
+    const ast = ts.createSourceFile('wslRelayHost.ts', source, ts.ScriptTarget.Latest, true);
+    const declaration = ast.statements.find(node => ts.isFunctionDeclaration(node) && node.name?.text === 'lookup');
+    assert.ok(declaration && ts.isFunctionDeclaration(declaration));
+    const compiled = ts.transpileModule(declaration.getText(ast), { compilerOptions: {
+            target: ts.ScriptTarget.ES2023, module: ts.ModuleKind.CommonJS
+        } }).outputText;
+    const lookup = compileFunction(compiled + '\nreturn lookup;', ['literal'])((s) => `'${s.replaceAll("'", "''")}'`);
+    const query = lookup({ taskName: 'SyntheticFixture' });
+    assert.doesNotMatch(query, /SilentlyContinue/);
+    assert.match(query, /-ErrorAction Stop/);
+    assert.match(query, /CmdletizationQuery_NotFound,Get-ScheduledTask/);
+    assert.match(query, /ObjectNotFound/);
+    if (process.platform === 'win32') {
+        for (const id of ['CmdletizationQuery_NotFound,Get-ScheduledTask', 'AccessDenied', 'SchedulerUnavailable']) {
+            const script = `function Get-ScheduledTask { throw [System.Management.Automation.ErrorRecord]::new(`
+                + `[Exception]::new('synthetic'), '${id}', [System.Management.Automation.ErrorCategory]::ObjectNotFound, $null) }; `
+                + `try { ${query}; if($null -eq $task){[Console]::Out.Write('absent')} } catch {[Console]::Out.Write('failed')} `;
+            const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand',
+                Buffer.from(script, 'utf16le').toString('base64')], { encoding: 'utf8', timeout: 15000, windowsHide: true });
+            assert.equal(result.status, 0, result.stderr);
+            assert.equal(result.stdout, id.startsWith('CmdletizationQuery_NotFound,') ? 'absent' : 'failed');
+        }
+    }
+});
+test('WSL startup registers an exact user-logon host action instead of relying on systemd lifetime', async (t) => {
+    const { options, scripts } = await fixture(t);
+    await enableRelayAutostart(options);
+    assert(scripts.some(script => script.includes('dharma-wsl-host:register')), 'an enabled Linux service alone cannot keep the WSL distro alive');
+    const receipt = await readFile(join(options.home, 'relay', 'wsl-host.json'), 'utf8');
+    assert.doesNotMatch(receipt, /password|token|grant|credential/i);
+    const action = scripts.find(script => script.includes('dharma-wsl-host:register'));
+    const nativeAction = registeredTaskAction(scripts);
+    assert.match(Buffer.from(nativeAction.arguments.split(' ').at(-1), 'base64').toString('utf16le'), /start --wait dharma-agent-fabric\.service/);
+    assert.match(action, /-LogonType Interactive -RunLevel Limited/);
+    assert.match(action, /New-ScheduledTaskTrigger -AtLogOn -User \$current\.Name/);
+    assert.match(action, /New-ScheduledTaskPrincipal -UserId \$current\.Name/);
+    assert.match(action, /Export-ScheduledTask -TaskPath/);
+    assert.match(action, /\$principals\[0\]\.UserId -cne \$current\.User\.Value/);
+    assert.doesNotMatch(action, /-Force|ExecutionPolicy|wsl.*--shutdown|sleep infinity/);
+    const status = await relayAutostartStatus(options);
+    assert.equal(status.state, 'enabled');
+    assert.equal(Reflect.get(status, 'restartCoverage'), 'wsl-host-logon');
+    assert.equal(Reflect.get(status, 'hostLifecycle'), 'registered');
+    await startRelayAutostart(options);
+    assert.equal(Reflect.get(await relayAutostartStatus(options), 'hostLifecycle'), 'running');
+    const registrationCalls = scripts.filter(script => script.includes('dharma-wsl-host:register')).length;
+    await enableRelayAutostart(options);
+    assert.equal(scripts.filter(script => script.includes('dharma-wsl-host:register')).length, registrationCalls);
+    await disableRelayAutostart(options);
+    assert(scripts.some(script => script.includes('dharma-wsl-host:disable')));
+    await assert.rejects(readFile(join(options.home, 'relay', 'wsl-host.json')), { code: 'ENOENT' });
+});
+test('the actual WSL guard validates the persisted SID rather than a normalized account alias', { skip: process.platform !== 'win32' }, async (t) => {
+    const f = await fixture(t);
+    await enableRelayAutostart(f.options);
+    const preamble = f.scripts.find(s => s.includes('dharma-wsl-host:status'));
+    const start = preamble.indexOf('function '), end = preamble.indexOf('if ($null -eq $task)');
+    assert.ok(start > 0 && end > start);
+    const guard = preamble.slice(start, end);
+    const task = { Description: 'synthetic', Actions: [{ Execute: 'C:\\Windows\\System32\\wsl.exe', Arguments: 'synthetic' }],
+        Principal: { UserId: '', LogonType: 'Interactive', RunLevel: 'Limited' },
+        Triggers: [{ CimClass: { CimClassName: 'MSFT_TaskLogonTrigger' }, Enabled: true, UserId: '' }],
+        Settings: { MultipleInstances: 'IgnoreNew', ExecutionTimeLimit: 'PT0S', RestartCount: 0, DisallowStartIfOnBatteries: false, StopIfGoingOnBatteries: false } };
+    const receipt = JSON.parse(await readFile(join(f.options.home, 'relay', 'wsl-host.json'), 'utf8'));
+    const action = registeredTaskAction(f.scripts);
+    task.Description = receipt.description;
+    task.Actions[0].Execute = action.execute;
+    task.Actions[0].Arguments = action.arguments;
+    for (const { foreign, legacyDirectAction } of [{ foreign: false, legacyDirectAction: false },
+        { foreign: true, legacyDirectAction: false }, { foreign: false, legacyDirectAction: true }]) {
+        const rejected = foreign || legacyDirectAction;
+        const taskFixture = structuredClone(task);
+        if (legacyDirectAction) {
+            taskFixture.Actions[0].Execute = receipt.executable;
+            taskFixture.Actions[0].Arguments = receipt.arguments;
+        }
+        const script = `$ErrorActionPreference='Stop';$current=[System.Security.Principal.WindowsIdentity]::GetCurrent(); `
+            + `$fixturePrincipalSid=${foreign ? "'S-1-5-18'" : '$current.User.Value'}; `
+            + `function Export-ScheduledTask { '<Task><Principals><Principal><UserId>'+$fixturePrincipalSid+'</UserId></Principal></Principals></Task>' }; `
+            + `$task=ConvertFrom-Json ([Console]::In.ReadToEnd());$task.Principal.UserId=($current.Name -split '\\\\')[-1]; `
+            + `$task.Triggers[0].UserId=$current.Name; ${guard}; `
+            + `try{Assert-OwnedTask $task;[Console]::Out.Write('owned')}catch{[Console]::Out.Write('refused');`
+            + `if(!${rejected ? '$true' : '$false'}){[Console]::Error.Write($_.Exception.Message)}}`;
+        const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { input: JSON.stringify(taskFixture), encoding: 'utf8', timeout: 15000, windowsHide: true });
+        assert.equal(result.status, 0, result.stderr);
+        assert.equal(result.stdout, rejected ? 'refused' : 'owned', result.stderr);
+    }
+});
+test('a foreign WSL host task is refused before startup registration writes', async (t) => {
+    const f = await fixture(t);
+    f.foreignTask();
+    await assert.rejects(assertRelayStartupOwnership(f.options), /autostart_conflict/);
+    await assert.rejects(enableRelayAutostart(f.options), /autostart_conflict/);
+    assert(!f.scripts.some(script => script.includes('dharma-wsl-host:register')));
+    await assert.rejects(readFile(join(f.options.home, 'relay', 'autostart.json')), { code: 'ENOENT' });
+});
+test('a lost registration response preserves ownership and readback reconciles without replacement', async (t) => {
+    const f = await fixture(t);
+    f.loseResponse();
+    await assert.rejects(enableRelayAutostart(f.options), /wsl_host_startup_unavailable/);
+    assert.equal((await relayAutostartStatus(f.options)).state, 'enabled');
+    const before = f.scripts.filter(script => script.includes('dharma-wsl-host:register')).length;
+    await enableRelayAutostart(f.options);
+    assert.equal(f.scripts.filter(script => script.includes('dharma-wsl-host:register')).length, before);
+});
+test('changed WSL recipient and injected host fields cannot be adopted, started or disabled', async (t) => {
+    const f = await fixture(t);
+    await enableRelayAutostart(f.options);
+    const path = join(f.options.home, 'relay', 'wsl-host.json');
+    const original = await readFile(path, 'utf8');
+    const record = JSON.parse(original);
+    for (const delta of [{ windowsSid: 'S-1-5-21-123-456-789-9001' }, { arguments: 'arbitrary.exe' },
+        { distribution: 'foreign' }, { extra: 'CANARY_PRIVATE_MATERIAL' }]) {
+        await writeFile(path, JSON.stringify({ ...record, ...delta }));
+        f.scripts.length = 0;
+        assert.equal((await relayAutostartStatus(f.options)).state, 'unavailable');
+        await assert.rejects(startRelayAutostart(f.options), /autostart_conflict|unavailable/);
+        await assert.rejects(disableRelayAutostart(f.options), /autostart_conflict|unavailable/);
+        assert(!f.scripts.some(script => /dharma-wsl-host:(register|start|disable)/.test(script)));
+    }
+});
+test('unavailable WSL interop and malformed distro metadata fail before startup writes', async (t) => {
+    const f = await fixture(t);
+    const badContexts = [{ distribution: 'Ubuntu"; cmd', linuxUser: 'maatru' },
+        { distribution: 'Ubuntu\n', linuxUser: 'maatru' }, { distribution: 'Ubuntu', linuxUser: 'maatru;cmd' }];
+    for (const current of badContexts) {
+        await assert.rejects(enableRelayAutostart({ ...f.options, wslHost: { ...f.options.wslHost,
+                context: async () => current } }), /wsl_host_startup_unavailable/);
+    }
+    await assert.rejects(enableRelayAutostart({ ...f.options, wslHost: { ...f.options.wslHost,
+            run: async () => { throw new Error('interop unavailable'); } } }), /wsl_host_startup_unavailable/);
+    await assert.rejects(readFile(join(f.options.home, 'relay', 'autostart.json')), { code: 'ENOENT' });
+    assert.deepEqual(f.scripts, []);
+});
+test('WSL cannot report complete startup coverage after its host receipt is lost', async (t) => {
+    const { options } = await fixture(t);
+    await enableRelayAutostart(options);
+    await rm(join(options.home, 'relay', 'wsl-host.json'), { force: true });
+    const status = await relayAutostartStatus(options);
+    assert.equal(status.state, 'unavailable');
+    assert.equal(status.reason, 'wsl_host_startup_unavailable');
+});
+test('bare Linux startup does not query or register any Windows host task', async (t) => {
+    const { options, scripts } = await fixture(t);
+    const bare = { ...options, wslHost: { ...options.wslHost, context: async () => null } };
+    await enableRelayAutostart(bare);
+    assert.equal((await relayAutostartStatus(bare)).state, 'enabled');
+    assert.deepEqual(scripts, []);
+});
+test('injected OS controls also contain Windows interop instead of escaping through a real runner', async (t) => {
+    const f = await fixture(t);
+    const seen = [];
+    const options = { ...f.options, wslHost: { context: f.options.wslHost.context },
+        run: async (file, args) => {
+            seen.push(file);
+            if (file === 'systemctl')
+                return { stdout: 'enabled\n' };
+            assert.equal(file, '/init');
+            return f.options.wslHost.run(Buffer.from(args.at(-1), 'base64').toString('utf16le'));
+        } };
+    await enableRelayAutostart(options);
+    assert(seen.includes('/init'));
+});
+test('withdrawal during WSL registration preserves the receipt but admits no later OS action', async (t) => {
+    const f = await fixture(t), controller = new AbortController(), now = Date.now();
+    const prepared = prepareCodexBootstrapHost({ workspace: f.options.userHome, signal: controller.signal, current: async () => true,
+        intent: { schema: 'dharma.codex-setup-intent/v1', operationId: '11111111-1111-4111-8111-111111111111',
+            setupReference: '22222222-2222-4222-8222-222222222222', organizationId: 'org_demo',
+            recipientMembershipId: '33333333-3333-4333-8333-333333333333', origin: 'https://hq.example',
+            repositoryFingerprint: `sha256:${'a'.repeat(64)}`, policyRevision: 'policy-v1',
+            scopeDigest: `sha256:${'a'.repeat(64)}`, contractDigest: `sha256:${'b'.repeat(64)}`,
+            hostContextId: '44444444-4444-4444-8444-444444444444', issuedAt: new Date(now - 1000).toISOString(),
+            expiresAt: new Date(now + 60000).toISOString() } });
+    t.after(() => prepared.scope.close());
+    const options = { ...f.options, wslHost: { ...f.options.wslHost, run: async (script) => {
+                const result = await f.options.wslHost.run(script);
+                if (script.includes('dharma-wsl-host:register'))
+                    controller.abort();
+                return result;
+            } } };
+    await assert.rejects(runCodexBootstrapHostScope(prepared.scope, () => enableRelayAutostart(options)), /scope_unavailable/);
+    assert(f.scripts.at(-1)?.includes('dharma-wsl-host:register'));
+    assert.equal(JSON.parse(await readFile(join(options.home, 'relay', 'wsl-host.json'), 'utf8')).schema, 'dharma.wsl-relay-host/v1');
+});
+test('WSL systemd startup resolves missing session metadata only from its owned binding', () => {
+    const installed = { schema: 'dharma.wsl-relay-host/v1', distribution: 'Ubuntu', linuxUser: 'maatru' };
+    assert.deepEqual(resolveWslRelayContext(undefined, 'maatru', installed), { distribution: 'Ubuntu', linuxUser: 'maatru' });
+    for (const value of [null, {}, { ...installed, linuxUser: 'other' }, { ...installed, distribution: 'Ubuntu\n' }]) {
+        assert.throws(() => resolveWslRelayContext(undefined, 'maatru', value), /wsl_host_startup_unavailable/);
+    }
+});
+test('WSL host receipt schema excludes secrets and unbounded command authority', async (t) => {
+    const f = await fixture(t);
+    await enableRelayAutostart(f.options);
+    const record = JSON.parse(await readFile(join(f.options.home, 'relay', 'wsl-host.json'), 'utf8'));
+    const schema = 'https://schemas.dharma-ai.io/wsl-relay-host/v1';
+    const validate = (value) => validateContract(join(import.meta.dirname, 'schemas'), schema, value);
+    assert.equal((await validate(record)).ok, true);
+    for (const delta of [{ token: 'CANARY_NEVER_ALLOWED' }, { password: 'CANARY_NEVER_ALLOWED' },
+        { arguments: 'arbitrary.exe' }, { windowsSid: '*' }, { linuxUser: 'user;cmd' }]) {
+        assert.equal((await validate({ ...record, ...delta })).ok, false);
+    }
+});
+test('generated WSL host commands pass the actual Windows PowerShell parser without execution', { skip: process.platform !== 'win32' }, async (t) => {
+    const f = await fixture(t);
+    await enableRelayAutostart(f.options);
+    await startRelayAutostart(f.options);
+    await disableRelayAutostart(f.options);
+    const script = `$items=ConvertFrom-Json ([Console]::In.ReadToEnd()); `
+        + `foreach($item in $items) {$tokens=$null;$errors=$null; `
+        + `[System.Management.Automation.Language.Parser]::ParseInput($item,[ref]$tokens,[ref]$errors)|Out-Null; `
+        + `if ($errors.Count -gt 0) {[Console]::Error.Write('generated_wsl_host_parse_error');exit 1}}; `
+        + `[Console]::Out.Write($items.Count)`;
+    const result = spawnSync('powershell.exe', ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand',
+        Buffer.from(script, 'utf16le').toString('base64')], { input: JSON.stringify(f.scripts), encoding: 'utf8', timeout: 15000, windowsHide: true, maxBuffer: 16384 });
+    assert.equal(result.error, undefined);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(Number(result.stdout), f.scripts.length);
+});
+//# sourceMappingURL=wslRelayHost.test.js.map