dsh-gitbash-shell 0.13.0 → 0.13.2

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.12.0",
+  "version": "0.13.2",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:用 Git for Windows bash 替换 PowerShell 执行器,并物化 standard/minimal/code/cordis 的 Git Bash 变体 preset。双 era 适配 dsh <= 0.1.1(内置 id 'code')与 >= 0.1.2(改名 'ptc'),启动探测自动选择,preset id 永不变。联动:dsh-ptc-cordis-preset(两者同装时 PTC 创造模式自动物化为 Git Bash 版)+ dsh-better-sidebar(终端 UI 标签与模型 terminal_* 工具自动切到 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "DSH plugin: run every agent shell command through Git for Windows bash on Windows instead of PowerShell. Replaces the pwsh executor with a Git Bash ctx.shell provider and materializes Git Bash variants of the standard/minimal/code/cordis agent presets into your user preset root at startup. On Windows it also adopts dsh-better-sidebar's terminal shell (UI tabs and the model-facing terminal_* tools) through the sidebar's official settings seam, and pairs with dsh-ptc-cordis-preset so the PTC Creation-mode preset materializes as its Git Bash variant. Ships both composition eras for dsh <= 0.1.1 (built-in preset id 'code') and dsh >= 0.1.2 (renamed id 'ptc') — the era is probed per boot and re-materialized automatically after a dsh upgrade, in either upgrade order; preset ids never change so pinned sessions stay valid.",
   "type": "module",
   "repository": {
@@ -41,7 +41,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test tests/smoke.mjs"
+    "test": "node --test tests/smoke.mjs",
+    "version": "node -e \"const fs=require('fs');const m=JSON.parse(fs.readFileSync('dsh.plugin.json','utf8'));const v=JSON.parse(fs.readFileSync('package.json','utf8')).version;m.version=v;fs.writeFileSync('dsh.plugin.json',JSON.stringify(m,null,2)+'\\n')\" && git add dsh.plugin.json"
   },
   "keywords": [
     "dsh",

package/src/index.js

@@ -205,6 +205,32 @@ export async function detectPersonaEra(agentPresets) {
   }
 }
 
+/**
+ * Does the SHIPPED composition already carry the official `present` row? The
+ * row (`@deepseek-ai/dsh-tool-present`, immutable file-delivery download
+ * cards) first shipped with dsh 0.1.5-alpha.2, and a composition row that
+ * cannot be imported rejects the WHOLE preset mount — so the row is injected
+ * only on hosts whose own shipped presets have it. The live roster is the
+ * authority: package resolution alone would lie on CLI installs (first-party
+ * packages live outside the profile) and on linked development trees.
+ * `minimal` never gains the row (single-tool preset). Never throws.
+ */
+async function detectPresentSupport(agentPresets) {
+  try {
+    const list = await agentPresets.list()
+    const entries = Array.isArray(list) ? list : []
+    const entry = ['ptc', 'standard', 'cordis']
+      .map((id) => entries.find((p) => p && p.id === id && typeof p.path === 'string'))
+      .find(Boolean)
+    if (!entry) return false
+    const file = /\.yml$/.test(entry.path) ? entry.path : join(entry.path, 'agent.cordis.yml')
+    return readFileSync(file, 'utf8').includes("'@deepseek-ai/dsh-tool-present'")
+  } catch (error) {
+    console.log(`${TAG} present-row probe failed (${error?.message ?? error}) — not injecting the row`)
+    return false
+  }
+}
+
 /**
  * Pick the committed composition asset inside one variant directory (pure).
  * The ptc-era twin is preferred when the roster says `ptc`; the persona-split
@@ -920,7 +946,11 @@ export async function apply(ctx, config = {}) {
   const skillsSource = await findSkillsSource(ctx.agentPresets)
   const base = await detectBase(ctx.agentPresets)
   const persona = await detectPersonaEra(ctx.agentPresets)
-  const present = await hostHasToolPresent()
+  // Two independent signals, either of which is sufficient: the shipped
+  // composition text (authoritative on every install layout) and the package
+  // resolving from this plugin's own tree (covers hosts where the roster
+  // probe is unavailable).
+  const present = (await detectPresentSupport(ctx.agentPresets)) || (await hostHasToolPresent())
   const userRootPath = userRoot.path
   purgeOrphans(userRootPath, presetIds)
 
@@ -965,4 +995,4 @@ export async function apply(ctx, config = {}) {
 }
 
 // Test surface: pure helpers, no Cordis context required.
-export const _internal = { PRESET_IDS, translateMsysPath, translatePathArguments, readPosixPaths, windowsToMsys, rewriteResultPaths, MARKER_FILE, classify, materialize, cleanupOnDispose, firstUserRoot, hashTree, skillsHashes, syncDecision, installRegisterShim, baseForRoster, detectBase, pickComposition, personaEraForText, detectPersonaEra, injectPresentRow, hostHasToolPresent }
+export const _internal = { PRESET_IDS, translateMsysPath, translatePathArguments, readPosixPaths, windowsToMsys, rewriteResultPaths, MARKER_FILE, classify, materialize, cleanupOnDispose, firstUserRoot, hashTree, skillsHashes, syncDecision, installRegisterShim, baseForRoster, detectBase, pickComposition, personaEraForText, detectPersonaEra, injectPresentRow, hostHasToolPresent, detectPresentSupport }

package/src/shell.js

@@ -15,7 +15,18 @@
  *   - overrides run/start ONLY for danger-full-access (the parent's
  *     full-access branch calls LocalBashExecutor.run, which hardcodes the
  *     bare `bash` name), routing through runArgv/startArgv with the same
- *     argv as the confined branch.
+ *     argv as the confined branch;
+ *   - on Windows ALSO overrides the confined branch itself (issue #1):
+ *     MSYS2 cannot start under the restricted-token sandbox — msys-2.0.dll
+ *     init creates its cygheap mapping and signal pipe with DACLs naming
+ *     only the user SID, a WRITE_RESTRICTED token's pass-2 write check
+ *     demands a restricting-SID ACE, so init dies with Win32 error 5 /
+ *     0xC0000142 before argv ever runs (silent fake-success or a hard
+ *     crash, every version since 0.6.0; cmd/pwsh are unaffected —
+ *     anonymous pipes). OS-level conflict with no in-plugin cure, so
+ *     confined Windows calls run Git Bash UNCONFINED, labelled as such in
+ *     the result (sandbox.enforcement === 'unconfined') plus a one-time
+ *     notice. The fs-tool sandbox policy still applies to file tools.
  *
  * Environment inheritance: bash.exe is spawned as a direct child of the host
  * process (never through the git-bash.exe login launcher), so it inherits the
@@ -32,6 +43,9 @@ import z from '@deepseek-ai/schemastery'
 /** Default Git for Windows bash (forward slashes work on Windows too). */
 export const DEFAULT_GIT_BASH = 'C:/Program Files/Git/bin/bash.exe'
 
+/** Log prefix, matching src/index.js. */
+const TAG = '[gitbash-shell]'
+
 /** Resolved configuration: the local executor's knobs, plus the Git Bash path. */
 export const Config = z.object({
   cwd: z.string(),
@@ -69,6 +83,11 @@ export class GitBashSandboxExecutor extends SandboxBashExecutor {
    * delegates to LocalBashExecutor.run, which hardcodes the bare `bash`
    * name, so override that branch here and keep everything else inherited.
    */
+  /**
+   * Confined Windows calls cannot use the restricted-token runner (issue
+   * #1, see the file header): route them through the unconfined argv path
+   * and label the result honestly so callers can tell.
+   */
   async run(spec) {
     const policy = spec.sandboxPolicy
     if (policy === undefined) return super.run(spec)
@@ -77,6 +96,11 @@ export class GitBashSandboxExecutor extends SandboxBashExecutor {
       const result = await this.runArgv(spec, [this.bashPath, '-c', spec.command])
       return { ...result, sandbox: { mode, denied: false } }
     }
+    if (process.platform === 'win32') {
+      this.warnConfinedUnconfined(mode)
+      const result = await this.runArgv(spec, [this.bashPath, '-c', spec.command])
+      return { ...result, sandbox: { mode, denied: false, enforcement: 'unconfined' } }
+    }
     return super.run(spec)
   }
 
@@ -89,8 +113,21 @@ export class GitBashSandboxExecutor extends SandboxBashExecutor {
       proc.sandbox = { mode, denied: false }
       return proc
     }
+    if (process.platform === 'win32') {
+      this.warnConfinedUnconfined(mode)
+      const proc = this.startArgv(spec, [this.bashPath, '-c', spec.command])
+      proc.sandbox = { mode, denied: false, enforcement: 'unconfined' }
+      return proc
+    }
     return super.start(spec)
   }
+
+  /** One-per-instance notice that confined Windows calls run unconfined. */
+  warnConfinedUnconfined(mode) {
+    if (this._warnedUnconfined) return
+    this._warnedUnconfined = true
+    console.log(TAG + ' Windows: MSYS2 cannot start under the restricted-token sandbox (msys-2.0.dll init: cygheap/signal-pipe DACLs carry no restricting-SID ACE -> Win32 error 5 / 0xC0000142; issue #1). Confined call (' + mode + ') ran Git Bash UNCONFINED; the fs-tool sandbox policy still applies.')
+  }
 }
 
 export default GitBashSandboxExecutor