dsh-gitbash-shell 0.39.0 → 0.39.2

package/src/inline-tools.js

@@ -26,7 +26,7 @@
  *   1. `pwsh` present + `bash` absent  -> register the plugin's OWN `bash`
  *      tool (src/bash-tool.js) in an agent-owned scope. It executes through a
  *      PRIVATE GitBashSandboxExecutor instance (constructed once per process
- *      in a private cordis scope, never registered as a service), and mirrors
+ *      in a shell-isolated cordis scope, never registered as the ROOT shell), and mirrors
  *      the official tool's schema, background jobs, escalation and rendering
  *      call-for-call.
  *   2. `ops_*` tools present (dsh-ops installed) -> our FastCtx bridge stands
@@ -137,6 +137,43 @@ const HOST_MODULES = [
   ['llmModule', '@deepseek-ai/dsh-llm'],
 ]
 
+/**
+ * Mount the executor through the host class-plugin path. A plugin fiber owns
+ * effects, but does NOT create a service namespace: ShellExecutor's constructor
+ * still provides `shell`. Isolate ONLY that service, retaining the host's
+ * subprocess/sandbox/policy dependencies and leaving the official shell intact.
+ *
+ * The empty scope does not inject shell, so read its active provider through
+ * get(), not the property-access path that requires an inject declaration.
+ */
+export async function mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope, { timeoutMs = 8000 } = {}) {
+  const executorScope = createScope(ctx.isolate('shell'))
+  let timer
+  try {
+    const mountTimeout = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error('executor scope mount timed out (a required service may be absent in this composition)')), timeoutMs)
+    })
+    const executor = await Promise.race([
+      (async () => {
+        if (executorScope.fiber) await executorScope.fiber
+        const fiber = executorScope.ctx.plugin(GitBashSandboxExecutor)
+        await fiber
+        return executorScope.ctx.get('shell')
+      })(),
+      mountTimeout,
+    ])
+    if (!executor || typeof executor.resolve !== 'function' || typeof executor.execute !== 'function') {
+      throw new Error('executor instance did not expose resolve()/execute()')
+    }
+    return { executor, executorScope }
+  } catch (error) {
+    await executorScope.dispose()
+    throw error
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 /**
  * Mount the per-agent reconcile. `deps`:
  *   - tools(ctx)       -> the host tool registry (or undefined)
@@ -154,8 +191,25 @@ const HOST_MODULES = [
  */
 export function mountInlineTools(ctx, deps) {
   const { tools, agents, createScope, pwshEnabled, log } = deps
-  /** agent -> { timer, scope, denyPwsh }; named `tracked` because `agents` above is the host service */
+  /** Per-agent mounts, masks and cancellation; `agents` above is the host service. */
   const tracked = new Map()
+  const pending = new Set()
+  const controller = new AbortController()
+  let closed = false
+  const isLive = (agent, state) => !closed && tracked.get(agent) === state && !state.controller.signal.aborted
+  const newState = () => ({ timer: undefined, scope: undefined, denyPwsh: undefined, pending: undefined, controller: new AbortController() })
+  // Loader imports cannot be cancelled, but no continuation may outlive its
+  // owner. Join our cancelled continuations without waiting on a stuck loader.
+  const untilDisposed = async (promise, signal) => {
+    signal.throwIfAborted()
+    let abort
+    const cancelled = new Promise((_, reject) => {
+      abort = () => reject(signal.reason)
+      signal.addEventListener('abort', abort, { once: true })
+    })
+    try { return await Promise.race([promise, cancelled]) }
+    finally { signal.removeEventListener('abort', abort) }
+  }
   /** Resolved once per process: { executor, executorScope, module }. */
   let bashOnce
   /** Set as soon as any face shows ops_* tools (the call-layer guard reads it). */
@@ -177,71 +231,90 @@ export function mountInlineTools(ctx, deps) {
    * declarations — the §4k schemastery semantics come for free), so it never
    * touches the root `ctx.shell` service slot the official pwsh executor
    * owns. The executor scope lives for the plugin's lifetime and is disposed
-   * by the effect registered at the bottom of this function.
+   * by the ownership effect registered before lifecycle wiring.
    */
   const bashOncePromise = async () => {
+    controller.signal.throwIfAborted()
     if (bashOnce) return bashOnce
-    bashOnce = (async () => {
-      const { GitBashSandboxExecutor } = await import('./shell.js')
-      if (!GitBashSandboxExecutor) throw new Error('executor class unavailable')
-      if (!GitBashSandboxExecutor.Config) {
-        throw new Error('executor Config unavailable (schemastery unresolved; see the schemastery log lines above)')
-      }
-      if (typeof createScope !== 'function') throw new Error('no createScope seam')
-      const executorScope = createScope(ctx)
-      if (executorScope.fiber) { try { await executorScope.fiber } catch { /* disposed */ } }
-      const mountTimeout = new Promise((_, reject) => {
-        const timer = setTimeout(() => reject(new Error('executor scope mount timed out (a required service may be absent in this composition)')), 8000)
-        timer.unref?.()
-      })
-      const fiber = executorScope.ctx.plugin(GitBashSandboxExecutor)
-      const executor = await Promise.race([
-        (async () => { await fiber; return executorScope.ctx.shell })(),
-        mountTimeout,
-      ])
-      if (!executor || typeof executor.resolve !== 'function' || typeof executor.execute !== 'function') {
-        throw new Error('executor instance did not expose resolve()/execute()')
-      }
-      const hostModules = {}
-      for (const [key, name] of HOST_MODULES) {
-        try {
-          hostModules[key] = await resolveHostModule(ctx, name)
-        } catch { hostModules[key] = undefined }
+    const mounting = (async () => {
+      let executorScope
+      try {
+        const { GitBashSandboxExecutor } = await untilDisposed(import('./shell.js'), controller.signal)
+        if (!GitBashSandboxExecutor) throw new Error('executor class unavailable')
+        if (!GitBashSandboxExecutor.Config) {
+          throw new Error('executor Config unavailable (schemastery unresolved; see the schemastery log lines above)')
+        }
+        if (typeof createScope !== 'function') throw new Error('no createScope seam')
+        controller.signal.throwIfAborted()
+        const mounted = await mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope)
+        executorScope = mounted.executorScope
+        controller.signal.throwIfAborted()
+        const hostModules = {}
+        for (const [key, name] of HOST_MODULES) {
+          hostModules[key] = await untilDisposed(resolveHostModule(ctx, name), controller.signal)
+        }
+        const { createBashToolModule } = await untilDisposed(import('./bash-tool.js'), controller.signal)
+        const module = createBashToolModule({ executor: mounted.executor, log, ...hostModules })
+        return { executor: mounted.executor, executorScope, module }
+      } catch (error) {
+        if (executorScope) await executorScope.dispose()
+        throw error
       }
-      const { createBashToolModule } = await import('./bash-tool.js')
-      const module = createBashToolModule({ executor, log, ...hostModules })
-      return { executor, executorScope, module }
     })()
-    bashOnce.catch(() => { bashOnce = undefined })
-    return bashOnce
+    bashOnce = mounting
+    mounting.catch(() => { if (bashOnce === mounting) bashOnce = undefined })
+    return mounting
   }
 
   /** Register the own bash tool inside one agent-owned scope. */
   const provideBash = async (agent, state) => {
-    if (state.scope) return
+    let scope
+    let retained = false
     try {
-      const { executor, module } = await bashOncePromise()
+      const { executor, module } = await untilDisposed(bashOncePromise(), state.controller.signal)
+      if (!isLive(agent, state)) return
       log(`own bash tool ready (private Git Bash executor at ${executor.bashPath || '(unresolved)'}; official pwsh executor untouched)`)
-      const scope = createScope(agent.ctx)
+      scope = createScope(agent.ctx)
+      state.scope = scope // Own the scope BEFORE either asynchronous mount.
       // Same asynchronous-fiber shape the official module needed: wait for
       // the apply callback to capture scope.ctx before touching its tools.
-      if (scope.fiber) { try { await scope.fiber } catch { /* disposed */ } }
-      const registry = scope.ctx?.tools
-      if (!registry || typeof scope.ctx.plugin !== 'function') {
-        void scope.dispose().catch(() => {})
-        return
-      }
+      if (scope.fiber) await untilDisposed(scope.fiber, state.controller.signal)
+      if (!isLive(agent, state)) return
+      const registry = scope.ctx?.get('tools')
+      if (!registry || typeof scope.ctx.plugin !== 'function') return
       const fiber = scope.ctx.plugin(module)
-      await fiber
-      state.scope = scope
+      await untilDisposed(fiber, state.controller.signal)
+      if (!isLive(agent, state)) return
+      retained = true
       log('own bash tool activated for this agent (Git Bash execution; official pwsh tool real but hidden by default)')
     } catch (error) {
-      log(`own bash tool activation failed for this agent: ${error?.message ?? error}`)
+      if (isLive(agent, state)) log(`own bash tool activation failed for this agent: ${error?.message ?? error}`)
+    } finally {
+      if (scope && !retained) {
+        if (state.scope === scope) state.scope = undefined
+        await scope.dispose()
+      }
     }
   }
 
+  const startBash = (agent, state) => {
+    if (state.scope || state.pending || !isLive(agent, state)) return
+    const task = provideBash(agent, state)
+    state.pending = task
+    pending.add(task)
+    void task.finally(() => {
+      pending.delete(task)
+      if (state.pending === task) state.pending = undefined
+    }).catch((error) => log(`own bash tool cleanup failed: ${error?.message ?? error}`))
+  }
+
   const reconcile = (agent, { attempt = 0 } = {}) => {
-    if (!agent?.ctx) return
+    if (closed || !agent?.ctx) return
+    // Undo ONLY our mask before observing the face. schemas() filters a
+    // restricted-away pwsh, so it cannot tell us what an ON flip must restore.
+    const previous = tracked.get(agent)
+    if (previous?.timer) { clearTimeout(previous.timer); previous.timer = undefined }
+    if (previous?.denyPwsh) { previous.denyPwsh(); previous.denyPwsh = undefined }
     const names = faceNames(agent)
     // The composed face may not be wired yet at created-time. Retry bounded:
     // a face with NEITHER tool carries no verdict. Five tries at 250ms, then
@@ -251,7 +324,7 @@ export function mountInlineTools(ctx, deps) {
       timer.unref?.()
       const state = tracked.get(agent)
       if (state) state.timer = timer
-      else tracked.set(agent, { timer, scope: undefined, denyPwsh: undefined })
+      else tracked.set(agent, { ...newState(), timer })
       return
     }
     const pwshVisible = deps.pwshEnabled?.() === true
@@ -260,7 +333,7 @@ export function mountInlineTools(ctx, deps) {
     let state = tracked.get(agent)
     if (state?.timer) { clearTimeout(state.timer); state.timer = undefined }
     if (!state) {
-      state = { timer: undefined, scope: undefined, denyPwsh: undefined }
+      state = newState()
       tracked.set(agent, state)
     }
     // The pwsh face (route B): the host tool is REAL PowerShell now, so the
@@ -283,22 +356,46 @@ export function mountInlineTools(ctx, deps) {
       }
     }
     if (needs.needsBash && !state.scope) {
-      void provideBash(agent, state)
+      startBash(agent, state)
     }
   }
 
-  const teardown = (agent) => {
+  const teardown = async (agent) => {
     const state = tracked.get(agent)
     if (!state) return
     tracked.delete(agent)
+    state.controller.abort(new Error('inline bash agent disposed'))
     if (state.timer) clearTimeout(state.timer)
-    if (state.denyPwsh) { try { state.denyPwsh() } catch { /* already lifted */ } }
-    if (state.scope) { void state.scope.dispose().catch(() => {}) }
+    if (state.denyPwsh) { state.denyPwsh(); state.denyPwsh = undefined }
+    await Promise.all([state.scope?.dispose(), state.pending])
   }
 
+  // Register ownership before the sweep starts asynchronous work. A cancelled
+  // loader continuation and every per-agent mount must settle before disposal.
+  ctx.effect(() => async () => {
+    closed = true
+    const mounting = bashOnce
+    controller.abort(new Error('inline bash plugin disposed'))
+    await Promise.all([
+      ...[...tracked.keys()].map(teardown),
+      ...pending,
+      mounting?.then(({ executorScope }) => executorScope.dispose(), () => {}),
+    ])
+    tracked.clear()
+    bashOnce = undefined
+  }, 'dsh-gitbash-shell: inline tool patching')
+
   try {
     ctx.on('agent/created', ({ agent } = {}) => { try { reconcile(agent) } catch { /* never break agent creation */ } })
-    ctx.on('agent/disposed', ({ agent } = {}) => { try { teardown(agent) } catch { /* never break disposal */ } })
+    ctx.on('agent/disposed', ({ agent } = {}) => teardown(agent).catch((error) => {
+      log(`agent bash tool cleanup failed: ${error?.message ?? error}`)
+    }))
+    ctx.on('loader/volatile-update', (paths) => {
+      if (!Array.isArray(paths) || !paths.some((path) => Array.isArray(path) && path[0] === 'pwshTool')) return
+      for (const agent of tracked.keys()) {
+        try { reconcile(agent) } catch (error) { log(`pwsh switch update failed: ${error?.message ?? error}`) }
+      }
+    })
     // MOUNT-TIME SWEEP (v0.35.2): agents that already exist when this row
     // mounts never fire agent/created. Same shape the proven dsh-ops denial
     // uses.
@@ -322,16 +419,6 @@ export function mountInlineTools(ctx, deps) {
     return
   }
 
-  ctx.effect(() => () => {
-    for (const agent of [...tracked.keys()]) teardown(agent)
-    tracked.clear()
-    if (bashOnce) {
-      void Promise.resolve(bashOnce).then(({ executorScope } = {}) => {
-        try { executorScope?.dispose?.() } catch { /* already gone */ }
-      }).catch(() => {})
-      bashOnce = undefined
-    }
-  }, 'dsh-gitbash-shell: inline tool patching')
 }
 
 // The host-package resolution channel lives in bash-tool.js; import it for

package/src/shell.js

@@ -1,7 +1,7 @@
 /**
  * dsh-gitbash-shell/shell — the Git Bash executor INSTANCE (route B, v0.39.0).
  *
- * Since route B this class is NOT mounted as the host `ctx.shell` service:
+ * Since route B this class is NOT mounted as the ROOT `ctx.shell` service:
  * the official PowerShell executor keeps that slot untouched (the DSH-Store
  * catalog gate forbids bundle patches that disable official components, and
  * replacing the shell executor IS overriding one). Instead the plugin
@@ -36,8 +36,9 @@
  * executor did.
  *
  * Constructed as a cordis class plugin (static inject/Config honoured) —
- * inside the PRIVATE scope only, so the base class's service registration
- * lands there and never touches the root `ctx.shell` slot.
+ * inside an explicitly `ctx.isolate('shell')`-isolated scope, so the base
+ * class's service registration never touches the root `ctx.shell` slot.
+ * A plain child plugin fiber is NOT a service isolation boundary.
  */
 
 import { SandboxBashExecutor } from '@deepseek-ai/dsh-bash-sandbox'