@herenfor/dsh-wsl 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,51 @@
+MIT License
+
+Copyright (c) 2026 HeRenFor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+Third-party notice
+
+ids.mjs adapts the list of identity-bearing fields from
+dsh-ssh-workspaces (https://github.com/czp0312/dsh-ssh-workspace), under the following license:
+
+MIT License
+
+Copyright (c) 2026 czp0312
+Copyright (c) 2026 dsh-ssh-workspaces contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,76 @@
-# Temporary Holding Version
+# DSH WSL run mode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+English | [中文](README.zh.md)
+
+Lets DeepSeek Harness Desktop on Windows run tasks in WSL. For a task set to WSL, the agent, its commands, file access and plugins all run in a DSH inside WSL, while you keep using the Desktop window.
+
+> Beta. Tested only with DSH 0.2.2-rc.1 so far. Please report problems on [GitHub](https://github.com/herenfor/dsh-wsl/issues).
+
+## What it does
+
+- **Choose where each task runs**: on the new-task page, pick "Windows" or "WSL (distribution)" under the input box. Folders inside WSL (`\\wsl.localhost\…`) always run in WSL.
+- **Add WSL folders**: when adding a folder, choose a Windows folder or a WSL folder. A WSL folder is picked by browsing the Linux file system right in Desktop.
+- **Both sides in one list**: the sidebar lists the folders and tasks of Windows and WSL together, with a small penguin on WSL ones. Approvals, questions, subagents and live titles work as in any task.
+- **WSL plugins on their own tab**: the Plugins page gets a "WSL (distribution)" tab to install, enable, disable and uninstall plugins in WSL, with a page per plugin showing its description and the state of each component. The official Installed tab still covers Windows only; the two sides do not affect each other. Plugins installed only in WSL, including ones that change the interface, work in the Desktop window too.
+- **Desktop's model credentials**: when a WSL task calls a model, it asks Desktop for the credentials; API keys and sign-ins are never written to the WSL disk. An API key you entered in WSL yourself takes precedence.
+- **Desktop's settings win**: settings you can change in Desktop (model, theme, language and so on) are copied one way into WSL; settings only WSL plugins have stay in WSL.
+- **Starts and stops with Desktop**: the WSL side starts when Desktop opens and exits about 5 seconds after Desktop closes.
+- **Follows DSH's language**: Chinese and English for now; other languages show English.
+
+## Requirements
+
+- DSH Desktop 0.2.x on Windows 10 or 11.
+- WSL 2 with a Linux distribution: Ubuntu, Debian or whichever you have.
+- A DSH in WSL whose version matches Desktop in its first two parts (for example both 0.2.x). Without one, the plugin lists the install commands; it can run them for you or hand them to the Windows DSH (step 3 below).
+
+## Install
+
+1. Desktop → Plugins → Add plugin → Install a third-party plugin, enter `@herenfor/dsh-wsl` and install.
+2. Quit Desktop completely (if it keeps running in the system tray, quit it there too), wait at least 5 seconds, then open it again. Until then the plugin does not start working, and the bottom of the sidebar says to restart Desktop.
+3. On the new-task page, switch the run location under the input box to WSL. The first time, "Set up the WSL environment" opens; choose one way:
+   - **Reuse your dsh**: offered when WSL already has dsh. Desktop shares data with the dsh you use in WSL yourself, so tasks show up on both; updates update both.
+   - **A separate copy for this plugin**: installed in `~/.dsh-wsl/dsh` with its data in `~/.dsh-wsl/home`, leaving your own dsh alone. About 250 MB to download, about 900 MB installed.
+
+   If Node.js or DSH is missing, the window lists the commands to run. Click "Install automatically", click "Let DSH install it" to have the Windows DSH run them, or run them yourself in a WSL terminal. The plugin never downloads anything in the background on its own.
+4. Once connected, the loading note at the bottom of the sidebar goes away and the WSL folders and tasks appear in the sidebar.
+
+### Other ways to install
+
+The install box in step 1 also takes these, but a plugin installed this way does not update itself:
+
+- From GitHub: `github:herenfor/dsh-wsl#path:/experiments/mirror/mirror`, or for a given version `github:herenfor/dsh-wsl#v0.1.0&path:/experiments/mirror/mirror`.
+- From a local folder: download the repository to Windows and enter the full path of its `experiments/mirror/mirror` folder.
+
+## Installing plugins in WSL
+
+Plugins → "WSL (distribution)" → enter an npm package name, git URL or local folder path in the install box → Check → Install. Windows paths are turned into WSL paths. When it says a restart is needed, quit Desktop completely, wait at least 5 seconds and open it again.
+
+## Updates
+
+- The plugin itself: published on npm and updated by DSH's own plugin updates. The bottom of the setup window shows its version and lets you turn automatic updates off.
+- The DSH in WSL follows Desktop's version. After Desktop updates, the setup window offers to update the WSL side.
+
+## Uninstall
+
+1. Desktop → Plugins → Installed → uninstall "WSL run mode", then restart Desktop.
+2. Remove what is left in WSL by hand:
+   - `~/.dsh-wsl`: connection files, logs, and in the separate-copy mode its DSH and data.
+   - In the reuse mode also `~/.dsh/profiles/desktop-wsl`, the profile the plugin created. Task data lives in `~/.dsh`, shared with your own dsh: **do not delete all of `~/.dsh`**.
+
+## When something goes wrong
+
+- When the bottom of the sidebar says the WSL side failed to start, click it to see the error.
+- The WSL side's log is `~/.dsh-wsl/run/desktop-wsl/daemon.log`.
+- Feedback: <https://github.com/herenfor/dsh-wsl/issues>
+
+## Known limitations
+
+- Tested only with DSH 0.2.2-rc.1. Desktop and the DSH in WSL must match in the first two parts of their versions.
+- In the separate-copy mode, WSL tasks are not shared with your own dsh, and tasks cannot be moved between the two ways yet.
+- When a WSL plugin's patch changes the configuration of an official component (rather than switching it off), that change does not apply in the Desktop window.
+- The interface of WSL plugins loads into the whole Desktop window, not only into WSL tasks.
+- Closing Desktop stops the WSL side as well; WSL tasks do not keep running in the background.
+
+## License
+
+MIT. The session ID field table is adapted from [dsh-ssh-workspaces](https://github.com/czp0312/dsh-ssh-workspace) (MIT); see `LICENSE` for its notice.

package/README.zh.md

@@ -0,0 +1,76 @@
+# DSH WSL 运行模式
+
+[English](README.md) | 中文
+
+让 Windows 版 DeepSeek Harness（Desktop）在 WSL 里运行任务。选了 WSL 的任务，agent、命令、文件读写和插件都在 WSL 里的 DSH 中运行，界面仍然是 Desktop 的窗口。
+
+> 测试版。目前只在 DSH 0.2.2-rc.1 上测试过。遇到问题欢迎到 [GitHub](https://github.com/herenfor/dsh-wsl/issues) 反馈。
+
+## 能做什么
+
+- **每个任务自己选在哪里运行**：在新任务页的输入框下方选「Windows」或「WSL（发行版名）」。WSL 里的文件夹（`\\wsl.localhost\…`）总是在 WSL 中运行。
+- **添加 WSL 文件夹**：添加文件夹时先选 Windows 文件夹或 WSL 文件夹。选 WSL 文件夹会在 Desktop 里直接浏览 Linux 文件系统。
+- **两边的任务列在一起**：侧栏同时列出 Windows 和 WSL 的文件夹和任务，WSL 的带小企鹅标记。审批、提问、子智能体、标题实时更新，都和普通任务一样。
+- **WSL 里的插件单独管理**：插件页多一个「WSL（发行版名）」标签页，可以安装、启用、停用、卸载 WSL 里的插件，点进去能看说明和每个组件的运行状态。官方的「已安装」页仍然只管 Windows，两边互不影响。只装在 WSL 里的插件，包括改界面的插件，也能在 Desktop 窗口里使用。
+- **用 Desktop 的模型凭据**：WSL 里的任务调用模型时，向 Desktop 取凭据，API Key 和登录信息不会写进 WSL 的磁盘。在 WSL 里自己填过 API Key 的，用 WSL 自己的。
+- **设置以 Desktop 为准**：模型、主题、语言等 Desktop 上能调的设置，单向同步到 WSL；只有 WSL 里的插件才有的设置，留在 WSL。
+- **跟着 Desktop 启停**：打开 Desktop 时自动启动 WSL 端，关闭 Desktop 约 5 秒后 WSL 端退出。
+- **界面语言跟随 DSH**：目前有中文和英文，其他语言显示英文。
+
+## 需要什么
+
+- Windows 10 或 11 上的 DSH Desktop 0.2.x。
+- WSL 2 和一个 Linux 发行版。Ubuntu、Debian 等都可以，用你装的那个。
+- WSL 里一份 DSH，版本号前两段要和 Desktop 相同（例如都是 0.2.x）。没有的话，插件会列出安装命令，可以一键安装，也可以交给 Windows 端的 DSH 去装，见下面第 3 步。
+
+## 安装
+
+1. Desktop → 插件 → 添加插件 → 安装第三方插件，填 `@herenfor/dsh-wsl`，然后安装。
+2. 完全退出 Desktop（如果它还在系统托盘里运行，也要在托盘里退出），等 5 秒以上再打开。不重启的话插件不会开始工作，侧栏底部会提示「重启 Desktop 后生效」。
+3. 在新任务页，把输入框下方的运行位置切到 WSL。第一次会弹出「设置 WSL 运行环境」，选一种方式：
+   - **复用你装的 dsh**：WSL 里已经装了 dsh 时可以选。Desktop 和你在 WSL 里自己用的 dsh 共用数据，任务互相看得到；更新时两边一起更新。
+   - **插件专用一份**：装在 `~/.dsh-wsl/dsh`，数据放在 `~/.dsh-wsl/home`，不影响你自己的 dsh。要下载约 250 MB，装好后约占 900 MB。
+
+   缺 Node.js 或 DSH 时，窗口里会列出要运行的命令。你可以点「自动安装」，点「交给 DSH 安装」让 Windows 端的 DSH 去执行，或者自己在 WSL 终端里运行。插件不会自己在后台下载。
+4. 连上之后，侧栏底部的加载提示会消失，WSL 的文件夹和任务出现在侧栏里。
+
+### 其他安装方式
+
+第 1 步的安装框也接受下面两种写法，但这样装的不会自动更新：
+
+- 从 GitHub 安装：`github:herenfor/dsh-wsl#path:/experiments/mirror/mirror`。指定版本时写成 `github:herenfor/dsh-wsl#v0.1.0&path:/experiments/mirror/mirror`。
+- 从本地文件夹安装：把仓库下载到 Windows 上，填 `experiments/mirror/mirror` 文件夹的完整路径。
+
+## 在 WSL 里装插件
+
+插件 →「WSL（发行版名）」→ 在安装框里填 npm 包名、git 地址或本地文件夹路径 → 检查 → 安装。Windows 路径会自动换成 WSL 路径。提示需要重启的，完全退出 Desktop，等 5 秒以上再打开。
+
+## 更新
+
+- 插件本身：发布在 npm 上，用 DSH 自带的插件更新。设置窗口底部会显示插件版本，也可以在那里关闭自动更新。
+- WSL 里的 DSH：版本跟着 Desktop。Desktop 升级后，设置窗口会提示更新 WSL 端。
+
+## 卸载
+
+1. Desktop → 插件 → 已安装 → 卸载「WSL 运行模式」，然后重启 Desktop。
+2. WSL 里留下的文件需要手动删除：
+   - `~/.dsh-wsl`：连接文件、日志，以及插件专用模式下的 DSH 和数据。
+   - 复用模式下还有 `~/.dsh/profiles/desktop-wsl`，这是插件建的 profile。任务数据在 `~/.dsh` 里，和你自己的 dsh 共用，**不要删整个 `~/.dsh`**。
+
+## 出问题时
+
+- 侧栏底部显示「启动失败」时，点它可以看到错误信息。
+- WSL 端日志在 `~/.dsh-wsl/run/desktop-wsl/daemon.log`。
+- 反馈：<https://github.com/herenfor/dsh-wsl/issues>
+
+## 已知限制
+
+- 只在 DSH 0.2.2-rc.1 上测试过。Desktop 和 WSL 里的 DSH，版本号前两段必须相同。
+- 插件专用模式下，WSL 的任务和你自己的 dsh 不互通，目前也不能在两种方式之间搬任务。
+- WSL 里的插件如果用补丁改了官方组件的配置（而不是关掉它），这个改动在 Desktop 窗口里不生效。
+- WSL 里插件的界面加载在整个 Desktop 窗口里，不只出现在 WSL 任务中。
+- 关闭 Desktop 后 WSL 端也会退出，WSL 任务不会在后台继续运行。
+
+## 许可证
+
+MIT。会话 ID 字段表改编自 [dsh-ssh-workspaces](https://github.com/czp0312/dsh-ssh-workspace)（MIT），版权声明见 `LICENSE`。

package/agent/broker.mjs

@@ -0,0 +1,107 @@
+// Credential broker, WSL half (docs/credentials.md, option 3). The WSL DSH Host keeps its own credential service
+// (credentials-local); this wraps its read methods so that a credential the person did not set in WSL is asked of
+// Desktop, through the bridge daemon (transport/daemon.mjs, "broker" connections). Nothing from Desktop is stored here.
+//
+// - resolve / describe / readRecord / describeRecord: WSL's own first, then Desktop's.
+// - listRecords: both, WSL's own winning on the same key.
+// - modifyRecord on a record only Desktop has (an account token refresh): read Desktop's, run the update here, write
+//   it back to Desktop as a compare-and-swap, retrying if Desktop's changed meanwhile. Desktop keeps the only copy.
+// - set / unset / deleteRecord: WSL's own store only.
+import { connect } from 'node:net'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export class BrokerClient {
+  constructor(runDir) {
+    this.socketPath = join(runDir, 'rpc.sock')
+    this.tokenPath = join(runDir, 'daemon.token')
+    this.pending = new Map()
+    this.next = 1
+  }
+  connection() {
+    if (this.socket && !this.socket.destroyed) return this.socket
+    const socket = connect(this.socketPath)
+    socket.write(`${readFileSync(this.tokenPath, 'utf8').trim()} broker\n`)
+    let buffer = ''
+    socket.on('data', (chunk) => {
+      buffer += chunk.toString('utf8')
+      let nl
+      while ((nl = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, nl); buffer = buffer.slice(nl + 1)
+        let answer
+        try { answer = JSON.parse(line) } catch { continue }
+        const waiter = this.pending.get(answer.id)
+        if (!waiter) continue
+        this.pending.delete(answer.id)
+        if (answer.error) waiter.reject(new Error(answer.error)); else waiter.resolve(answer.value)
+      }
+    })
+    const fail = (error) => { for (const w of this.pending.values()) w.reject(error ?? new Error('broker connection closed')); this.pending.clear() }
+    socket.on('error', fail)
+    socket.on('close', () => fail())
+    socket.unref()
+    return (this.socket = socket)
+  }
+  /** One request to Desktop; rejects when Desktop is not connected or does not answer. */
+  ask(op, args = {}, timeoutMs = 15_000) {
+    return new Promise((resolve, reject) => {
+      const id = this.next++
+      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error('Desktop did not answer')) }, timeoutMs)
+      timer.unref?.()
+      this.pending.set(id, { resolve: (v) => { clearTimeout(timer); resolve(v) }, reject: (e) => { clearTimeout(timer); reject(e) } })
+      try { this.connection().write(`${JSON.stringify({ id, op, ...args })}\n`) } catch (error) { this.pending.delete(id); clearTimeout(timer); reject(error) }
+    })
+  }
+  close() { this.socket?.destroy() }
+}
+
+/** Wrap the credential service instance; returns the restore function. */
+export function brokerCredentials(credentials, client, logger) {
+  const own = {}
+  const orig = {}
+  for (const name of ['resolve', 'describe', 'readRecord', 'describeRecord', 'listRecords', 'modifyRecord']) {
+    own[name] = Object.hasOwn(credentials, name)
+    orig[name] = credentials[name].bind(credentials)
+  }
+  const desktop = async (op, args, fallback) => {
+    try { return await client.ask(op, args) } catch (error) { logger?.debug?.('wsl-agent: Desktop credentials %s: %s', op, error.message); return fallback }
+  }
+  credentials.resolve = async (ref) => (await orig.resolve(ref)) ?? (await desktop('resolve', { ref }, null)) ?? undefined
+  credentials.describe = async (ref) => {
+    const local = await orig.describe(ref)
+    if (local.configured) return local
+    const theirs = await desktop('describe', { ref })
+    return theirs?.configured ? { configured: true, source: `desktop${theirs.source ? `-${theirs.source}` : ''}`, writable: local.writable } : local
+  }
+  credentials.readRecord = async (key) => (await orig.readRecord(key)) ?? (await desktop('readRecord', { key }, null)) ?? undefined
+  credentials.describeRecord = async (key) => {
+    const local = await orig.describeRecord(key)
+    if (local.configured) return local
+    const theirs = await desktop('describeRecord', { key })
+    return theirs?.configured ? { ...theirs, writable: local.writable } : local
+  }
+  credentials.listRecords = async () => {
+    const local = await orig.listRecords()
+    const theirs = (await desktop('listRecords', {}, [])) ?? []
+    const keys = new Set(local.map((e) => e.key))
+    return [...local, ...theirs.filter((e) => !keys.has(e.key))]
+  }
+  credentials.modifyRecord = async (key, mutate) => {
+    if ((await orig.readRecord(key)) !== undefined) return orig.modifyRecord(key, mutate)
+    let current = await desktop('readRecord', { key }, null)
+    if (current === null) return orig.modifyRecord(key, mutate)
+    for (let attempt = 0; attempt < 5; attempt++) {
+      const next = await mutate(current)
+      if (next === undefined) return current
+      const result = await client.ask('swapRecord', { key, expected: current, next })
+      if (result.swapped) return result.record ?? undefined
+      current = result.record
+      if (current === null) return orig.modifyRecord(key, mutate)
+    }
+    throw new Error('wsl-agent: Desktop credential record kept changing; giving up')
+  }
+  return () => {
+    for (const name of Object.keys(orig)) { if (own[name]) credentials[name] = orig[name]; else delete credentials[name] }
+    client.close()
+  }
+}

package/agent/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: wsl-agent
+      name: dsh-wsl-agent

package/agent/index.mjs

@@ -0,0 +1,130 @@
+// WSL side of the UI mirror experiment. Serves GET /wsl-bridge/events: a server-sent event stream that sends
+// { graph, origin } on connect and after every graph change. `graph` is this Host's client module graph as is;
+// `origin[id]` is 'builtin' when the row's bundle ships inside the DSH installation, 'user' otherwise.
+import { readFileSync, realpathSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { homedir } from 'node:os'
+import { dirname, join, sep } from 'node:path'
+import { BrokerClient, brokerCredentials } from './broker.mjs'
+
+export const name = 'wsl-agent'
+export const inject = ['clientModules', 'webServer']
+export const EVENTS = '/wsl-bridge/events'
+const MODULES_ID = '@deepseek-ai/dsh-client-modules'
+
+const real = (p) => { try { return realpathSync(p) } catch { return p } }
+
+// The node_modules directory the DSH installation keeps its own packages in, found from the client-modules bundle:
+// <root>/@deepseek-ai/dsh-client-modules/lib/client.js
+export function builtinRoot(modulesClientPath) {
+  return dirname(dirname(dirname(dirname(real(modulesClientPath)))))
+}
+
+// The WSL Host's HTTP route table (path names only), read from the web server's private maps, and the exact Fetch
+// routes plugins register under /api (`ctx.connection.fetch.register`, e.g. DS Bot's /api/bot), with their methods.
+export function routeTable(ws, connection) {
+  const fetch = [...(connection?.fetchRoutes ?? [])].map(([path, route]) => ({ path, methods: [...(route.methods ?? [])] }))
+  return { exact: [...(ws.exact?.keys() ?? [])], prefix: [...(ws.prefixes?.keys() ?? [])], upgrade: [...(ws.upgrades?.keys() ?? [])], fetch }
+}
+
+/**
+ * Entries that the bundle patches of third-party plugins switch off: top-level patch items `{ id, disabled: true }`
+ * (no insert). `patches` is [{ bundle, items }] with each bundle's parsed cordis.patch.yml; `names` maps an entry id to
+ * its package name (the client graph row id). Returns [{ id, name, by }] for the ids that have a name.
+ */
+export function disabledByPatches(patches, names) {
+  const out = []
+  for (const { bundle, items } of patches) {
+    for (const item of Array.isArray(items) ? items : []) {
+      if (item === null || typeof item !== 'object' || typeof item.id !== 'string' || item.disabled !== true || 'insert' in item) continue
+      const name = names.get(item.id)
+      if (typeof name === 'string') out.push({ id: item.id, name, by: bundle })
+    }
+  }
+  return out
+}
+
+/**
+ * The parsed cordis.patch.yml of each enabled third-party bundle of a profile: [{ bundle, items }]. Enabled bundles are
+ * the profile manifest's `dsh.profile.bundles`; official ones (@deepseek-ai/) are skipped.
+ */
+export function bundlePatches(profileDir, parseYaml) {
+  let pkg
+  try { pkg = JSON.parse(readFileSync(join(profileDir, 'package.json'), 'utf8')) } catch { return [] }
+  const out = []
+  for (const bundle of pkg.dsh?.profile?.bundles ?? []) {
+    if (typeof bundle !== 'string' || bundle.startsWith('@deepseek-ai/')) continue
+    try {
+      const dir = join(profileDir, 'node_modules', bundle)
+      const patch = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).dsh?.bundle?.patch
+      if (typeof patch === 'string') out.push({ bundle, items: parseYaml(readFileSync(join(dir, patch), 'utf8')) })
+    } catch {}
+  }
+  return out
+}
+
+/** This Host's profile folder: <DSH home>/profiles/<--profile>. */
+function profileDir() {
+  const i = process.argv.indexOf('--profile')
+  const profile = i >= 0 ? process.argv[i + 1] : undefined
+  return profile ? join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'profiles', profile) : undefined
+}
+
+export function snapshot(cm, root, ws, connection, disabled) {
+  const graph = cm.graph()
+  const origin = {}
+  for (const row of graph.entries) {
+    const path = cm.clientPath(row.id)
+    origin[row.id] = path !== undefined && real(path).startsWith(root + sep) ? 'builtin' : 'user'
+  }
+  return { graph, origin, routes: ws ? routeTable(ws, connection) : undefined, disabled, distro: process.env.WSL_DISTRO_NAME }
+}
+
+export function apply(ctx) {
+  const cm = ctx.clientModules
+  const root = builtinRoot(cm.clientPath(MODULES_ID))
+  const clients = new Set()
+  const connection = () => { try { return ctx.get('connection') } catch { return undefined } }
+  // Official entries that WSL plugins' bundle patches switch off: Desktop drops their client rows from the page too.
+  let parseYaml
+  try {
+    // DSH's own `!!js` expressions (a `disabled:` decided at run time) are kept as opaque values: they are not the literal
+    // `disabled: true` looked for here, and leaving the tag unknown printed a YAML warning on every read.
+    const { parse } = createRequire(join(root, 'wsl-agent.js'))('yaml')
+    const customTags = [{ tag: 'tag:yaml.org,2002:js', resolve: (source) => ({ $js: source }) }]
+    parseYaml = (text) => parse(text, { customTags })
+  } catch (error) { ctx.logger.warn('wsl-agent: no YAML parser: %s', error.message) }
+  const disabled = () => {
+    const dir = profileDir()
+    if (!dir || !parseYaml) return []
+    const names = new Map()
+    try { for (const entry of ctx.get('loader').entries()) if (typeof entry.options?.id === 'string' && typeof entry.options?.name === 'string') names.set(entry.options.id, entry.options.name) } catch {}
+    return disabledByPatches(bundlePatches(dir, parseYaml), names)
+  }
+  const frame = () => `data: ${JSON.stringify(snapshot(cm, root, ctx.webServer, connection(), disabled()))}\n\n`
+  const push = () => { const f = frame(); for (const res of clients) res.write(f) }
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: EVENTS,
+    handler(req, res) {
+      if (req.method !== 'GET') { res.writeHead(405); res.end(); return }
+      res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' })
+      res.write(frame())
+      clients.add(res)
+      res.on('close', () => clients.delete(res))
+    },
+  }), 'wsl-agent: events route')
+  ctx.effect(() => cm.onGraphChanged(push), 'wsl-agent: graph changes')
+  // Routes change when plugins start or stop and the web server announces nothing, so compare every two seconds.
+  ctx.effect(() => {
+    let last = JSON.stringify(routeTable(ctx.webServer, connection()))
+    const timer = setInterval(() => { const now = JSON.stringify(routeTable(ctx.webServer, connection())); if (now !== last) { last = now; push() } }, 2000)
+    timer.unref()
+    return () => clearInterval(timer)
+  }, 'wsl-agent: route changes')
+  ctx.effect(() => () => { for (const res of clients) res.destroy(); clients.clear() }, 'wsl-agent: close streams')
+  ctx.logger.info('wsl-agent: builtin root %s', root)
+  // Started by the bridge daemon (which sets DSH_WSL_RUN): credentials not set in WSL are asked of Desktop.
+  const runDir = process.env.DSH_WSL_RUN
+  if (runDir) ctx.inject(['credentials'], (c) => brokerCredentials(c.credentials, new BrokerClient(runDir), c.logger))
+}

package/agent/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "dsh-wsl-agent",
+  "version": "0.0.0-experiment",
+  "private": true,
+  "type": "module",
+  "description": "Experiment: runs in the WSL DSH Host and publishes its client module graph, marking which rows come from user-installed plugins.",
+  "exports": { ".": "./index.mjs" },
+  "dsh": { "bundle": { "patch": "./cordis.patch.yml" }, "manifestVersion": 1 }
+}