dsh-gitbash-shell 0.39.0 → 0.39.1

package/CHANGELOG.md

@@ -3,6 +3,46 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## v0.39.1 — 2026-10-13
+
+**类型**:fix(route B 私有执行器的真实服务隔离与读取授权) / test / ci。
+
+- **根因**:普通 `ctx.plugin()` 子 fiber 只隔离副作用所有权,不隔离服务命名空间。
+  `GitBashSandboxExecutor` 仍经 `SandboxBashExecutor → LocalBashExecutor → ShellExecutor → Service`
+  注册 `shell`,与 route B 保留的 `SandboxPwshExecutor` 冲突,报
+  `service "shell" has been registered at <SandboxPwshExecutor>`;bash 工具尚未注册即中断。
+  Git Bash 路径已成功解析时同样发生,不是工具发现或路径探测问题。
+- **修复**:`mountPrivateExecutor` 仅对 `shell` 调用 `ctx.isolate('shell')`,其余宿主依赖原样继承;
+  类插件仍走官方 `plugin()` 通道,Config/volatile/static inject 与生命周期不变。
+  空 scope 通过 `get('shell')` 读取活跃私有实例,工具就绪检查用 `get('tools')`,避免
+  缺少 inject 声明的属性访问再度中断补位。失败时销毁已建 scope,成功/失败均清理挂载计时器。
+- **边界**:不撤官方 PowerShell 执行器、不改 bundle patch、不改 shell 执行/沙箱/后台协议,
+  不抬 Core 兼容下限,不发版、不触发 npm 发布。
+- **回归**:新增 5 项真实 Cordis 测试,覆盖普通子 scope 冲突、显式隔离后的 Config/inject 与
+  根 shell 保留、卸载、构造失败清理/再挂载、缺服务失败与挂载超时清理;不是仅正则源码检查。
+  既有 minimal PTY 测试的非 Windows 断言现在显式模拟 Linux,不再在恢复 win32 后误断言 `/bin/bash`。
+  首轮远端 CI 发现两项独立 error-content 测试误嵌套在父测试中,Node 22 会取消未等待的子测试;
+  恢复独立结构并保留全部断言,不跳过测试、不移除 Node 22 矩阵。
+- **验证入口**:`npm test` 合并 smoke 与真实 Cordis 回归;新增 `npm run test:preview`,通过
+  显式 `DSH_PREVIEW_HOST_DIR` 只读解析目标宿主包,在新 Context + 临时 cwd 做无头运行时 preview。
+  Windows 本机已通过:Core **0.2.1-alpha.2**,宿主 Cordis **4.0.5-alpha.1**,Node **24.13.0**;
+  原路径真实重现服务冲突,修复后 bash 出现在实际 ToolRuntime schema 中并执行
+  `command -v bash`/`uname -s`/sentinel(退出码 0),官方 pwsh 执行 `Get-Process`,
+  `pwshTool` 开/关两态与卸载恢复均通过。**不等同于完整 GUI、PTY、后台任务或受限模式验收**。
+- **CI**:新增非发布 `ci` 工作流(push 修复分支 / PR / 手动触发),Windows/Linux × Node 22/24,
+  锁定依赖、禁止生命周期脚本与可选载荷、完整测试及 `npm pack --dry-run --ignore-scripts`。
+  本机完整测试 **127/127 通过**,打包预检与 `git diff --check` 通过;远端矩阵结果见对应 PR 检查。
+  复验命令和覆盖边界见 `tests/README.md`。
+- **gb_glob 守卫封杀了上游主用法([#21](https://github.com/KannaKuron/dsh-gitbash-shell/issues/21),同日报告)**:
+  上游 `tools/list` 的 glob `pattern` 是 `string | string[]` 的 untagged enum——**数组才是主形态**
+  (schema 示例本身就是数组),v0.38.5 的只认字符串守卫把它一并拒绝;且模型常把数组 JSON 序列化后
+  传入(实测 25 次调用 24 次为 `["*.txt"]` 字符串),上游按**一个字面 glob** 匹配 → 静默返回空
+  ——恰好是守卫要防的「静默错误答案」。修法(`validateFastctxPattern`,提取为纯导出函数):
+  glob 接受非空字符串或非空字符串数组;**字符串化数组响亮报错并给出正确形状**(绝不代模型反序列化
+  ——那会掩盖错误);replace 维持单正则字符串契约;其他类型报错带类型名。gb_glob 的 description
+  增补 pattern 形状声明(模型侧修正源)。**教训**:给上游加防御守卫必须从 `tools/list` 的
+  `inputSchema` 原文出发,单一探针会误判(v0.38.5 的「静默当全部文件」实测即单一探针结论)。
+
 ## v0.39.0 — 2026-10-13
 
 **类型**:feat(架构转向:route B——插件自带 bash 工具,不再替换宿主执行器;DSH STORE 收录合规)。

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.39.0",
+  "version": "0.39.1",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:自带 bash 工具(私有 Git Bash 执行器实例,官方 PowerShell 执行器原样保留),官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0 起;v0.39.0 起不再替换宿主执行器),四个 *·Git Bash 变体 preset 可开关;官方 pwsh 工具默认隐藏、开关可见(真 PowerShell);附带 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.39.0",
+  "version": "0.39.1",
   "description": "Windows 上给 agent 一个真正的 Git Bash 命令工具:私有 Git Bash 执行器实例(官方 PowerShell 执行器原样保留),统一 MSYS 盘根路径方言,官方 pwsh 工具默认隐藏可开关,物化四个内置预设的 Git Bash 变体,侧栏终端接管可开关。· Give agents a real Git Bash tool on Windows: a private Git Bash executor instance (the official PowerShell executor stays untouched), a unified MSYS drive-root path dialect, an opt-in official pwsh tool, and four Git Bash preset variants.",
   "type": "module",
   "repository": {
@@ -52,7 +52,8 @@
     "icon.svg"
   ],
   "scripts": {
-    "test": "node --test tests/smoke.mjs",
+    "test": "node --test tests/smoke.mjs tests/private-executor.mjs",
+    "test:preview": "node --import ./tests/host-loader.mjs --test tests/preview.mjs",
     "version": "node -e \"const fs=require('fs');const m=JSON.parse(fs.readFileSync('dsh.plugin.json','utf8'));const v=JSON.parse(fs.readFileSync('package.json','utf8')).version;m.version=v;fs.writeFileSync('dsh.plugin.json',JSON.stringify(m,null,2)+'\\n')\" && git add dsh.plugin.json"
   },
   "keywords": [

package/src/bash-tool.js

@@ -11,8 +11,8 @@
  * instead ships an OWN tool:
  *
  *   - the executor is a private `GitBashSandboxExecutor` instance constructed
- *     through cordis's own plugin path in a PRIVATE scope (never registered as
- *     `ctx.shell`, which stays the official PowerShell executor); it inherits
+ *     through cordis's own plugin path in a `shell`-isolated scope (never
+ *     registered as the ROOT `ctx.shell`, which stays PowerShell); it inherits
  *     the shipped bash-sandbox semantics (deadline, output capture, argv
  *     execution) and points them at Git for Windows' bash.exe;
  *   - the tool definition mirrors `@deepseek-ai/dsh-tool-bash` call-for-call

package/src/fastctx-bridge.js

@@ -209,6 +209,42 @@ export class McpStdio {
  * the fastctx shapes: `path`, `file_path`, `files[].path`, and an absolute
  * glob `pattern`. Pure.
  */
+/**
+ * Validate one pattern argument BEFORE dispatch (v0.38.5 guard, reshaped in
+ * v0.39.1 around the upstream SCHEMA — issue #21). glob's `pattern` is an
+ * untagged enum of string | string[] in tools/list (the array is the PRIMARY
+ * form — the schema's own example is an array), so a string-only check bans
+ * the main usage; and a JSON-stringified array ("[\"*.txt\"]") is matched by
+ * the upstream as ONE literal glob and silently returns nothing — the exact
+ * silent-wrong-answer this guard exists to prevent. replace's pattern is a
+ * single regex string. Pure; returns an error message or undefined.
+ * @param {string} rawName - upstream tool name ('glob' | 'replace' | ...).
+ * @param {unknown} pattern - the raw pattern argument.
+ * @returns {string|undefined}
+ */
+export function validateFastctxPattern(rawName, pattern) {
+  if (rawName !== 'glob' && rawName !== 'replace') return undefined
+  const describe = (v) => (v === null ? 'null' : Array.isArray(v) ? 'array' : typeof v)
+  if (rawName === 'replace') {
+    if (typeof pattern !== 'string' || pattern.trim() === '') {
+      return `invalid arguments: ${gbName(rawName)} pattern must be a non-empty string (got ${describe(pattern)})`
+    }
+    return undefined
+  }
+  // A stringified array would match as one literal glob and return an empty
+  // set: name the mistake, never guess the intent (un-serializing on the
+  // model's behalf would hide the error this guard is here to surface).
+  if (typeof pattern === 'string' && pattern.length >= 2 && pattern.startsWith('[') && pattern.endsWith(']')) {
+    return `invalid arguments: ${gbName(rawName)} pattern looks like a JSON-stringified array (${String(pattern).slice(0, 60)}). Pass a real array of strings (e.g. ["*.js","*.py"]) or one plain glob string — a stringified array matches nothing.`
+  }
+  const ok = (typeof pattern === 'string' && pattern.trim() !== '')
+    || (Array.isArray(pattern) && pattern.length > 0 && pattern.every((p) => typeof p === 'string' && p.trim() !== ''))
+  if (!ok) {
+    return `invalid arguments: ${gbName(rawName)} pattern must be a non-empty string or a non-empty array of non-empty strings (got ${describe(pattern)})`
+  }
+  return undefined
+}
+
 export function translateFastctxArgs(args, msysToWin) {
   if (!msysToWin || !args || typeof args !== 'object') return args
   const translate = (value) => (typeof value === 'string' ? msysToWin(value) : value)
@@ -334,25 +370,28 @@ export function mountFastctx(ctx, deps) {
         : rawName === 'grep'
           ? '\nIgnore rules: this tool honors .gitignore and skips .git — unlike gb_glob (bare .ignore only) and the official glob (ignores nothing).'
           : ''
+      // Pattern-shape transparency (v0.39.1, issue #21): models keep
+      // JSON-stringifying the glob array (24 of 25 measured calls), which the
+      // upstream matches as one literal glob -> silent empty. State the
+      // accepted shapes on the tool.
+      const patternNote = rawName === 'glob'
+        ? '\npattern accepts one glob string OR an array of glob strings (e.g. ["**/*.rs", "!tests/**"]). Pass a real array — never a JSON-stringified array.'
+        : ''
       try {
         const dispose = registry.register({
           name: gbName(rawName),
-          description: `${String(tool.description ?? rawName)}\n${FASTCTX_SANDBOX_NOTE}${ignoreNote}`,
+          description: `${String(tool.description ?? rawName)}\n${FASTCTX_SANDBOX_NOTE}${ignoreNote}${patternNote}`,
           parameters: schema,
           output: {
             schema: TOOL_OUTPUT_SCHEMA,
             render: (_args, value) => renderTextContent(value),
           },
           async execute(args) {
-            // Fail LOUD on malformed patterns (v0.38.5, the field smoke
-            // report): the upstream server silently treats a non-string
-            // pattern as "everything", which turns a typo into a full-tree
-            // result set — a silent wrong answer is worse than an error.
-            if ((rawName === 'glob' || rawName === 'replace') && args !== null && typeof args === 'object' && 'pattern' in args) {
-              const pattern = args.pattern
-              if (typeof pattern !== 'string' || pattern.trim() === '') {
-                throw new Error(`invalid arguments: ${gbName(rawName)} pattern must be a non-empty string (got ${pattern === null ? 'null' : typeof pattern})`)
-              }
+            // Fail LOUD on malformed patterns (v0.38.5; reshaped v0.39.1,
+            // issue #21 — see validateFastctxPattern).
+            if (args !== null && typeof args === 'object' && 'pattern' in args) {
+              const invalid = validateFastctxPattern(rawName, args.pattern)
+              if (invalid) throw new Error(invalid)
             }
             const translated = translateFastctxArgs(args, msysToWin)
             const result = await callWithReconnect(rawName, translated)

package/src/inline-tools.js

@@ -26,7 +26,7 @@
  *   1. `pwsh` present + `bash` absent  -> register the plugin's OWN `bash`
  *      tool (src/bash-tool.js) in an agent-owned scope. It executes through a
  *      PRIVATE GitBashSandboxExecutor instance (constructed once per process
- *      in a private cordis scope, never registered as a service), and mirrors
+ *      in a shell-isolated cordis scope, never registered as the ROOT shell), and mirrors
  *      the official tool's schema, background jobs, escalation and rendering
  *      call-for-call.
  *   2. `ops_*` tools present (dsh-ops installed) -> our FastCtx bridge stands
@@ -137,6 +137,43 @@ const HOST_MODULES = [
   ['llmModule', '@deepseek-ai/dsh-llm'],
 ]
 
+/**
+ * Mount the executor through the host class-plugin path. A plugin fiber owns
+ * effects, but does NOT create a service namespace: ShellExecutor's constructor
+ * still provides `shell`. Isolate ONLY that service, retaining the host's
+ * subprocess/sandbox/policy dependencies and leaving the official shell intact.
+ *
+ * The empty scope does not inject shell, so read its active provider through
+ * get(), not the property-access path that requires an inject declaration.
+ */
+export async function mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope, { timeoutMs = 8000 } = {}) {
+  const executorScope = createScope(ctx.isolate('shell'))
+  let timer
+  try {
+    const mountTimeout = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error('executor scope mount timed out (a required service may be absent in this composition)')), timeoutMs)
+    })
+    const executor = await Promise.race([
+      (async () => {
+        if (executorScope.fiber) await executorScope.fiber
+        const fiber = executorScope.ctx.plugin(GitBashSandboxExecutor)
+        await fiber
+        return executorScope.ctx.get('shell')
+      })(),
+      mountTimeout,
+    ])
+    if (!executor || typeof executor.resolve !== 'function' || typeof executor.execute !== 'function') {
+      throw new Error('executor instance did not expose resolve()/execute()')
+    }
+    return { executor, executorScope }
+  } catch (error) {
+    await executorScope.dispose()
+    throw error
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 /**
  * Mount the per-agent reconcile. `deps`:
  *   - tools(ctx)       -> the host tool registry (or undefined)
@@ -188,20 +225,7 @@ export function mountInlineTools(ctx, deps) {
         throw new Error('executor Config unavailable (schemastery unresolved; see the schemastery log lines above)')
       }
       if (typeof createScope !== 'function') throw new Error('no createScope seam')
-      const executorScope = createScope(ctx)
-      if (executorScope.fiber) { try { await executorScope.fiber } catch { /* disposed */ } }
-      const mountTimeout = new Promise((_, reject) => {
-        const timer = setTimeout(() => reject(new Error('executor scope mount timed out (a required service may be absent in this composition)')), 8000)
-        timer.unref?.()
-      })
-      const fiber = executorScope.ctx.plugin(GitBashSandboxExecutor)
-      const executor = await Promise.race([
-        (async () => { await fiber; return executorScope.ctx.shell })(),
-        mountTimeout,
-      ])
-      if (!executor || typeof executor.resolve !== 'function' || typeof executor.execute !== 'function') {
-        throw new Error('executor instance did not expose resolve()/execute()')
-      }
+      const { executor, executorScope } = await mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope)
       const hostModules = {}
       for (const [key, name] of HOST_MODULES) {
         try {
@@ -226,7 +250,7 @@ export function mountInlineTools(ctx, deps) {
       // Same asynchronous-fiber shape the official module needed: wait for
       // the apply callback to capture scope.ctx before touching its tools.
       if (scope.fiber) { try { await scope.fiber } catch { /* disposed */ } }
-      const registry = scope.ctx?.tools
+      const registry = scope.ctx?.get('tools')
       if (!registry || typeof scope.ctx.plugin !== 'function') {
         void scope.dispose().catch(() => {})
         return

package/src/shell.js

@@ -1,7 +1,7 @@
 /**
  * dsh-gitbash-shell/shell — the Git Bash executor INSTANCE (route B, v0.39.0).
  *
- * Since route B this class is NOT mounted as the host `ctx.shell` service:
+ * Since route B this class is NOT mounted as the ROOT `ctx.shell` service:
  * the official PowerShell executor keeps that slot untouched (the DSH-Store
  * catalog gate forbids bundle patches that disable official components, and
  * replacing the shell executor IS overriding one). Instead the plugin
@@ -36,8 +36,9 @@
  * executor did.
  *
  * Constructed as a cordis class plugin (static inject/Config honoured) —
- * inside the PRIVATE scope only, so the base class's service registration
- * lands there and never touches the root `ctx.shell` slot.
+ * inside an explicitly `ctx.isolate('shell')`-isolated scope, so the base
+ * class's service registration never touches the root `ctx.shell` slot.
+ * A plain child plugin fiber is NOT a service isolation boundary.
  */
 
 import { SandboxBashExecutor } from '@deepseek-ai/dsh-bash-sandbox'