dsh-gitbash-shell 0.35.0 → 0.35.2

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## v0.35.2 — 2026-10-12
+
+**类型**:fix(Windows 真机报告;行内补位的时序洞 + 调用层兜底)。
+
+- **修复:已存在的 agent 拿不到补位(用户 Windows 真机报告)**。症状:AI 调 `pwsh` 工具收到 `/usr/bin/bash: line 1: Select-String: command not found`——假 pwsh 的执行器在本机就是 `ctx.shell`(Git Bash),PowerShell 命令进了 bash。根因:补位判定此前**只挂在 `agent/created`** 上,本插件行**激活晚于 agent 存在**时(插件热重载、宿主先恢复会话后本 bundle 行才挂完),全部已存在的 agent 保持假 pwsh 且没有 bash,且永不再触发判定。修复为 **dsh-ops 验证过的双重独立层**(`installHostShellDenial` 同款形态):
+  - **层 1 — 挂载时补扫**:`mountInlineTools` 新增 `agents(ctx)` 依赖(index.js 传入 `ctx.get('agents')`),挂载那一刻对 `agents.list()` 里的每个**已存活 agent** 跑一遍 `reconcile`——与 created 事件同一条路径,250ms×5 有界重试等同样生效;
+  - **层 2 — 调用层守卫**:新增 `tools/pre-execute` 监听,凡 `pwsh` 调用到达分发层一律 deny,理由句直接指路替换品(bash 工具 / `gitbash_pwsh`)。两层层层独立:即便 per-agent 的 `restrict({ deny })` 输了竞态,谎工具也到不了执行器。
+- **顺手修复:重名声明 SyntaxError**。v0.35.2 开发中引入的 `agents` 依赖与 `mountInlineTools` 内部的 agent 状态 Map 同名(`const` 重复声明,模块整体加载失败)。内部 Map 改名 `tracked`;冒烟加防回归断言(源码不得再现 `const agents = new Map()`)。
+- **冒烟**:新增「inline tools: the mount-time sweep and the call-layer guard exist (v0.35.2)」;「…wires the patch…」补 `agents` 依赖接线断言。合计 114 项(113 过 + 1 跳)。
+- **Windows 真机复验清单(升级后)**:①官方模式新会话有 bash 工具;②假 pwsh 调用被拒(deny 理由指路);③`gitbash_pwsh` 跑真 pwsh 7;④`gb_grep` 出参 /c/ 方言。v0.35.0 的真机验证项(见该条目)顺延至此版一起验。
+
+## v0.35.1 — 2026-10-12
+
+**类型**:fix(dsh-ptc-cordis-preset 联动显示;真机反馈)。
+
+- **`gitBash` 能力加法字段 `inlinePatched`**(win32 恒 true):v0.35.0 的行内补位使**官方四个模式全部自带 Git Bash**,对端名录里 `PTC 创造模式 · Git Bash` 这类后缀不再有区分意义,反而与已下线的变体命名风格混淆(用户真机反馈)。对端(≥ v0.17.3)读到该字段即用普通名称;旧对端忽略该字段,行为不变。加法字段演进,同 §4f 的 `pythonBackend` 先例。
+
 ## v0.35.0 — 2026-10-12
 
 **类型**:feat(重大行为变更)。官方四个模式**默认直接获得 Git Bash**——四个「·Git Bash」变体 preset 转为可选开关(默认关);新增真正的 `gitbash_pwsh` 工具与 `gb_*` FastCtx 文件工具;与 dsh-ops 自动共存。

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:用 Git for Windows bash 替换 PowerShell 执行器;官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0,默认),四个 *·Git Bash 变体 preset 可开关;附带 gitbash_pwsh(系统 PowerShell 7)与 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "description": "Windows 上让 agent 的每条 shell 命令改经 Git for Windows bash 执行;物化四个内置预设的 Git Bash 变体,统一 MSYS 盘根路径方言,侧栏终端接管可开关。· Run every agent shell command through Git for Windows bash on Windows; materialize Git Bash variants of the built-in presets, unify the MSYS drive-root path dialect, and adopt the sidebar terminal behind a switch.",
   "type": "module",
   "repository": {

package/src/index.js

@@ -1987,6 +1987,11 @@ export async function apply(ctx, config = {}) {
     // official presets too. Peers (dsh-ptc-cordis-preset) key their roster
     // wording and dedupe on exactly this fact.
     active: process.platform === 'win32',
+    // Additive (v0.35.1): the inline tool patch gives EVERY OFFICIAL preset
+    // Git Bash, so a roster suffix like "· Git Bash" no longer distinguishes
+    // anything — peers reading this flag drop the suffix (dsh-ptc-cordis-preset
+    // v0.17.3+); older peers ignore it and keep the v0.34 wording.
+    get inlinePatched() { return process.platform === 'win32' },
     // Kept for existing consumers (peer plugins read `bashPath`): the resolved
     // interpreter. When resolution failed we report the explicit value (or the
     // historical default) so the ENOENT a consumer may hit names a real path —
@@ -2603,6 +2608,7 @@ export async function apply(ctx, config = {}) {
     try {
       mountInlineTools(ctx, {
         tools: (c) => { try { return c.get('tools') } catch { return undefined } },
+        agents: (c) => { try { return c.get('agents') } catch { return undefined } },
         createScope: (agentCtx) => {
           let childCtx
           const fiber = agentCtx.plugin((c) => { childCtx = c })

package/src/inline-tools.js

@@ -223,6 +223,7 @@ export async function activateOfficialBash(agent, toolBashHref, createScopeFn, l
 /**
  * Mount the per-agent reconcile. `deps`:
  *   - tools(ctx)       -> the host tool registry (or undefined)
+ *   - agents(ctx)      -> the host agents service (or undefined)
  *   - createScope(fn)  -> cordis createScope
  *   - allowed(session) -> danger-full-access verdict for the pwsh channel
  *   - echo(text)       -> result dialect echo (Windows -> MSYS), or undefined
@@ -231,15 +232,20 @@ export async function activateOfficialBash(agent, toolBashHref, createScopeFn, l
  *   - pwshEnabled()    -> the row switch for publishing the pwsh tool
  *   - log(message)     -> the plugin's tagged logger
  *
- * Registration decisions re-run on EVERY agent creation: a per-agent tool
- * face is per-agent truth, and the observed state (variant presets on, a
- * future official change, dsh-ops appearing) is absorbed automatically
- * instead of being encoded as a boot-time snapshot.
+ * Registration decisions re-run on EVERY agent creation AND once at mount
+ * time for every ALREADY-LIVE agent (the dsh-ops-proven shape,
+ * `installHostShellDenial`): this row can activate long after agents exist —
+ * a plugin hot-reload, or a host whose sessions resumed before this bundle
+ * row finished mounting — and an agent/created-only listener leaves every
+ * such agent with the fake pwsh and no bash, which is exactly the Windows
+ * field report behind this block. A second, INDEPENDENT layer guards the
+ * call itself through `tools/pre-execute`: visibility restriction can lose a
+ * race, and a lying pwsh that reaches its executor still runs Git Bash.
  */
 export function mountInlineTools(ctx, deps) {
-  const { tools, createScope, allowed, spawn, pwshPath, echo, log } = deps
-  /** agent -> { timer, scope, denyPwsh } */
-  const agents = new Map()
+  const { tools, agents, createScope, allowed, spawn, pwshPath, echo, log } = deps
+  /** agent -> { timer, scope, denyPwsh }; named `tracked` because `agents` above is the host service */
+  const tracked = new Map()
   let pwshPublished = false
   let pwshDisposer = undefined
   let toolBashHrefPromise
@@ -287,17 +293,17 @@ export function mountInlineTools(ctx, deps) {
     if (attempt < 5 && !names.includes('bash') && !names.includes('pwsh')) {
       const timer = setTimeout(() => { try { reconcile(agent, { attempt: attempt + 1 }) } catch { /* never crash on a timer */ } }, 250)
       timer.unref?.()
-      const state = agents.get(agent)
+      const state = tracked.get(agent)
       if (state) state.timer = timer
-      else agents.set(agent, { timer, scope: undefined, denyPwsh: undefined })
+      else tracked.set(agent, { timer, scope: undefined, denyPwsh: undefined })
       return
     }
     const needs = inlineNeeds(names)
-    let state = agents.get(agent)
+    let state = tracked.get(agent)
     if (state?.timer) { clearTimeout(state.timer); state.timer = undefined }
     if (!state) {
       state = { timer: undefined, scope: undefined, denyPwsh: undefined }
-      agents.set(agent, state)
+      tracked.set(agent, state)
     }
     if (needs.denyPwsh && !state.denyPwsh) {
       // Deny the fake pwsh first: restrict is per-agent and idempotent, and
@@ -318,7 +324,7 @@ export function mountInlineTools(ctx, deps) {
           return
         }
         const scope = await activateOfficialBash(agent, href, createScope, log)
-        if (scope && agents.get(agent) === state) {
+        if (scope && tracked.get(agent) === state) {
           state.scope = scope
           log('official bash tool activated for this agent (Git Bash host; fake pwsh denied)')
         }
@@ -334,9 +340,9 @@ export function mountInlineTools(ctx, deps) {
   }
 
   const teardown = (agent) => {
-    const state = agents.get(agent)
+    const state = tracked.get(agent)
     if (!state) return
-    agents.delete(agent)
+    tracked.delete(agent)
     if (state.timer) clearTimeout(state.timer)
     if (state.denyPwsh) { try { state.denyPwsh() } catch { /* already lifted */ } }
     if (state.scope) { void state.scope.dispose().catch(() => {}) }
@@ -345,14 +351,34 @@ export function mountInlineTools(ctx, deps) {
   try {
     ctx.on('agent/created', ({ agent } = {}) => { try { reconcile(agent) } catch { /* never break agent creation */ } })
     ctx.on('agent/disposed', ({ agent } = {}) => { try { teardown(agent) } catch { /* never break disposal */ } })
+    // MOUNT-TIME SWEEP (v0.35.2, the Windows field report): agents that
+    // already exist when this row mounts never fire agent/created — a plugin
+    // hot-reload or a host that resumed sessions before this bundle row
+    // finished mounting would otherwise keep the fake pwsh and no bash on
+    // every live agent. Same shape the proven dsh-ops denial uses.
+    for (const agent of agents?.(ctx)?.list?.() ?? []) {
+      try { reconcile(agent) } catch { /* one broken agent never blocks the rest */ }
+    }
+    // CALL-LAYER GUARD (v0.35.2, second independent layer): even when the
+    // per-agent visibility restriction loses a race, a `pwsh` call that
+    // reaches its executor runs Git Bash (ctx.shell IS Git Bash on this
+    // host). Deny at dispatch and name the replacements.
+    ctx.on('tools/pre-execute', (exec, next) => {
+      try {
+        if (exec?.name === 'pwsh') {
+          return { kind: 'deny', reason: 'the host pwsh tool would run Git Bash on this host (its executor was replaced). Use the bash tool for commands, or gitbash_pwsh for Windows-native work (registry, services, WMI).' }
+        }
+      } catch { /* never block the waterfall */ }
+      return next()
+    })
   } catch (error) {
     log(`agent lifecycle wiring failed: ${error?.message ?? error}`)
     return
   }
 
   ctx.effect(() => () => {
-    for (const agent of [...agents.keys()]) teardown(agent)
-    agents.clear()
+    for (const agent of [...tracked.keys()]) teardown(agent)
+    tracked.clear()
     unpublishPwsh()
   }, 'dsh-gitbash-shell: inline tool patching')
 }