dsh-gitbash-shell 0.39.3 → 0.40.0

package/src/index.js

@@ -46,6 +46,7 @@ import {
   cpSync,
   existsSync,
   mkdirSync,
+  mkdtempSync,
   readFileSync,
   readdirSync,
   rmSync,
@@ -57,7 +58,7 @@ import { fileURLToPath } from 'node:url'
 
 import { PRESET_META, minimalPluginsFor, pluginsFor } from './compositions.js'
 import { loadSchemastery } from './schemastery.js'
-import { GITBASH_MSYS_ADDENDUM, GITBASH_ROUTE_ADDENDUM, GITBASH_ROUTE_ADDENDUM_NO_PWSH, mountInlineTools } from './inline-tools.js'
+import { applyToolRouting, mountInlineTools } from './inline-tools.js'
 import { mountFastctx } from './fastctx-bridge.js'
 
 /**
@@ -512,12 +513,14 @@ export const Config = Schema === null ? undefined : Schema.object({
    * now controls the real thing.
    */
   pwshTool: live(Schema.boolean().default(false)),
+  // Maintainer PR #26 decision: one live opt-out for refusal and companions.
+  experimentalNative: live(Schema.boolean().default(true)),
   /**
    * Publish the FastCtx file tools (`gb_*`) through the local MCP bridge.
    * Default ON; Windows-only payload, stands down entirely when dsh-ops is
    * present (its ops_* tools already cover the same ground).
    */
-  fastctxTools: live(Schema.boolean().default(true)),
+  fastctxTools: live(Schema.boolean().default(false)),
 })
 
 /** Read one Config value across eras: Volatile ref (>= 0.1.7) or plain value. */
@@ -582,8 +585,8 @@ function makeLiveReader(ctx, config) {
       variantPresets: valueOf(config.variantPresets) === true,
       // Default ON (v0.35.0): the pwsh replacement fills the denied host tool.
       pwshTool: valueOf(config.pwshTool) !== false,
-      // Default ON (v0.35.0): the FastCtx bridge stands down when dsh-ops is present.
-      fastctxTools: valueOf(config.fastctxTools) !== false,
+      // Default OFF (v0.39.4, dsh-ops 0.3.0): FastCtx is dead upstream and dsh-ops ships stronger native ops_* file tools; an explicit true re-enables the bridge. It still stands down when dsh-ops is present.
+      fastctxTools: valueOf(config.fastctxTools) === true,
     }
   }
   return {
@@ -593,7 +596,8 @@ function makeLiveReader(ctx, config) {
     autoTerminalShell: () => dialect().autoTerminalShell !== false,
     variantPresets: () => (hasConfig ? valueOf(config.variantPresets) === true : false),
     pwshTool: () => (hasConfig ? valueOf(config.pwshTool) !== false : true),
-    fastctxTools: () => (hasConfig ? valueOf(config.fastctxTools) !== false : true),
+    experimentalNative: () => (hasConfig ? valueOf(config.experimentalNative) !== false : true),
+    fastctxTools: () => (hasConfig ? valueOf(config.fastctxTools) === true : false),
     // Default OFF: only an explicit true asks for deduplication.
     suppressPeerCordis: () => (hasConfig ? valueOf(config.suppressPeerCordis) === true : false),
   }
@@ -773,7 +777,9 @@ function pathEcho(value, env) {
  * content VERBATIM: output is data, never rewritten (the same red line as
  * file content in successful results).
  */
-const ERROR_CONTENT_TOOLS = new Set(['read', 'read_image', 'write', 'edit', 'glob', 'grep', 'present'])
+// ops_* six (v0.39.4, dsh-ops 0.3.0): their failures quote Windows paths too —
+// the error content and error.message must answer in the same /c/ dialect.
+const ERROR_CONTENT_TOOLS = new Set(['read', 'read_image', 'write', 'edit', 'glob', 'grep', 'present', 'ops_inspect_local_file', 'ops_glob', 'ops_grep', 'ops_replace', 'ops_batch', 'ops_result'])
 
 export function rewriteErrorContent(content, options) {
   if (!Array.isArray(content)) return content
@@ -868,6 +874,37 @@ export function rewriteResultPaths(name, value, env) {
     })
     return changed ? { ...value, files } : value
   }
+  // v0.39.4 (dsh-ops 0.3.0): ops_* tools answer with the same paths the
+  // model must keep speaking /c/ about. Their Rust worker names every path
+  // field `path` (items[] / matches[]) and ops_batch/ops_result echo the
+  // operation `root`; detailsRef ids are opaque, never rewritten.
+  if (name === 'ops_grep' && Array.isArray(value.matches)) {
+    let changed = false
+    const matches = value.matches.map((match) => {
+      if (!match || typeof match !== 'object' || typeof match.path !== 'string' || match.path === '') return match
+      const out = toMsys(match.path)
+      if (out === match.path) return match
+      changed = true
+      return { ...match, path: out }
+    })
+    return changed ? { ...value, matches } : value
+  }
+  if ((name === 'ops_inspect_local_file' || name === 'ops_glob' || name === 'ops_replace') && Array.isArray(value.items)) {
+    let changed = false
+    const items = value.items.map((item) => {
+      if (!item || typeof item !== 'object' || typeof item.path !== 'string' || item.path === '') return item
+      const out = toMsys(item.path)
+      if (out === item.path) return item
+      changed = true
+      return { ...item, path: out }
+    })
+    return changed ? { ...value, items } : value
+  }
+  if ((name === 'ops_batch' || name === 'ops_result') && typeof value.root === 'string' && value.root !== '') {
+    const out = toMsys(value.root)
+    if (out !== value.root) return { ...value, root: out }
+    return value
+  }
   if (name === 'glob' && Array.isArray(value.paths)) {
     let changed = false
     const paths = value.paths.map((p) => {
@@ -909,7 +946,9 @@ export function rewriteResultPaths(name, value, env) {
 
 const MSYS_DRIVE_ROOT = /^\/([a-z])\/(.*)$/i
 const MSYS_BARE_DRIVE = /^\/([a-z])$/i
-const TRANSLATABLE_PATH_FIELDS = new Set(['file_path', 'path', 'workdir'])
+// 'root' (v0.39.4): dsh-ops ops_batch/ops_result name their path argument `root`;
+// no official tool uses that key, so the extra alias is collision-free.
+const TRANSLATABLE_PATH_FIELDS = new Set(['file_path', 'path', 'workdir', 'root'])
 
 // ── virtual mounts + env (v0.17.0) ─────────────────────────────────────
 //
@@ -1143,6 +1182,37 @@ export function translatePathArguments(args, env) {
       changed = true
     }
   }
+  // v0.39.4 (dsh-ops 0.3.0): ops_batch carries its paths one level down —
+  // operations[] objects with path/to, and protect[] as a plain string
+  // array. Same deal as present's files[].path: the field-name whitelist
+  // only sees top-level keys. The model speaks /c/ everywhere; these
+  // arrive at the Rust worker as native absolute paths.
+  if (Array.isArray(next.operations)) {
+    const operations = next.operations.map((operation) => {
+      if (!operation || typeof operation !== 'object') return operation
+      let out = operation
+      for (const field of ['path', 'to']) {
+        if (typeof out[field] !== 'string') continue
+        const translated = translateMsysPath(out[field], env)
+        if (translated !== out[field]) out = { ...out, [field]: translated }
+      }
+      return out
+    })
+    if (operations.some((operation, index) => operation !== next.operations[index])) {
+      next.operations = operations
+      changed = true
+    }
+  }
+  if (Array.isArray(next.protect)) {
+    const protect = next.protect.map((entry) => {
+      if (typeof entry !== 'string') return entry
+      return translateMsysPath(entry, env)
+    })
+    if (protect.some((entry, index) => entry !== next.protect[index])) {
+      next.protect = protect
+      changed = true
+    }
+  }
   return changed ? next : args
 }
 
@@ -2153,25 +2223,15 @@ export async function apply(ctx, config = {}) {
              no run_code hint — so they meet the shell they were composed for. */
           const dialect = liveSettings.dialect()
           const applies = dialectApplies(dialect, assembleContext && assembleContext.agent)
-          // v0.35.0: shell-routing addendum on the `bash` tool's description.
-          // Description is schema-level text, so even the minimal preset's
-          // complete-persona cannot strip it; the ROUTING sentence applies to
-          // every agent (routing is dialect-independent), while the MSYS
-          // sentence only describes the world the dialect switch creates.
-          // Idempotent by marker: assemble may run more than once per agent.
-          // The routing sentence follows the pwsh switch (v0.37.0; route B
-          // v0.39.0): while the pwsh tool is hidden (the default) the sentence
-          // must NOT name it — a route to a tool the agent cannot see only
-          // teaches the model to call a hidden name.
-          if (assembly && typeof assembly === 'object' && Array.isArray(assembly.tools)) {
-            const routeSentence = liveSettings.pwshTool() === true ? GITBASH_ROUTE_ADDENDUM : GITBASH_ROUTE_ADDENDUM_NO_PWSH
-            for (const tool of assembly.tools) {
-              if (tool && tool.name === 'bash' && typeof tool.description === 'string'
-                && !tool.description.includes('Prefer this bash tool')) {
-                tool.description += '\n' + routeSentence
-                  + (applies && dialect.posixPaths === true ? '\n' + GITBASH_MSYS_ADDENDUM : '')
-              }
-            }
+          // Routing is dialect-independent and follows actual offered tools.
+          // PTC may expose only run_code here: its generic SDK decision rule
+          // relies on the registered bindings' own descriptions, not guessed
+          // hidden names. Replace our block on reassembly/visibility changes.
+          if (assembly && typeof assembly === 'object') {
+            applyToolRouting(assembly.tools, {
+              pwshVisible: liveSettings.pwshTool() === true,
+              msys: applies && dialect.posixPaths === true,
+            })
           }
           if (applies && dialect.posixPaths === true && assembly && typeof assembly === 'object') {
             for (const section of Array.isArray(assembly.sections) ? assembly.sections : []) {
@@ -2699,6 +2759,18 @@ export async function apply(ctx, config = {}) {
           }
         },
         pwshEnabled: () => liveSettings.pwshTool() === true,
+        experimentalEnabled: () => liveSettings.experimentalNative(),
+        // Explicit conversion does not rewrite source or change auto-dialect
+        // settings. The same lazy, verified mount facts are used each call.
+        translatePath: (value) => translateMsysPath(value, buildTranslateEnv(readConfiguredBashPath())),
+        // Trusted host-owned output storage, invoked only after the native
+        // executor's actual policy/argument/capability gate. Never model cwd.
+        // Completed bounded artifacts remain readable like Core spill files;
+        // this does not claim a cross-task quota or automatic retention purge.
+        createArtifactDirectory: (_request, _exec, signal) => {
+          signal?.throwIfAborted()
+          return mkdtempSync(join(tmpdir(), 'dsh-gitbash-native-'))
+        },
         log: (m) => console.log(TAG + ' ' + m),
       })
       console.log(TAG + ' inline tool patch armed (own bash tool over a private Git Bash executor; official pwsh executor untouched)')

package/src/inline-tools.js

@@ -101,14 +101,14 @@ export function inlineNeeds(names, { pwshVisible } = {}) {
  * routing. Both hold regardless of the path dialect a delegate sees.
  */
 export const GITBASH_ROUTE_ADDENDUM = [
-  'Prefer this bash tool for ALL commands; use the pwsh tool ONLY when a Windows-native capability (cmdlets, registry, services, WMI) is truly required.',
-  'Fix failed bash commands in bash — never switch shells mid-task, never embed `pwsh -Command` inside a bash command (variable expansion and output encoding break there).',
+  'Prefer this bash tool for shell syntax, scripts, pipelines, redirection, globbing and POSIX utilities; use the pwsh tool ONLY when PowerShell cmdlets, registry, services or WMI are truly required.',
+  'Fix failed bash syntax in bash; never embed `pwsh -Command` inside a bash command as a workaround (variable expansion and output encoding break there). Choose a separately offered native route for its documented purpose before execution, never as a policy-denial retry.',
 ].join('\n')
 
 /** The bash-only routing variant, used while the pwsh switch is off (the default). */
 export const GITBASH_ROUTE_ADDENDUM_NO_PWSH = [
-  'Prefer this bash tool for ALL commands — it is this host\'s shell.',
-  'Fix failed commands in bash; there is no PowerShell tool on this host.',
+  'Prefer this bash tool for shell syntax, scripts, pipelines, redirection, globbing and POSIX utilities — it is this host\'s shell.',
+  'Fix failed bash syntax in bash; no PowerShell tool is offered here. Do not invent a hidden tool or embed another interpreter as a workaround.',
 ].join('\n')
 
 /**
@@ -118,6 +118,38 @@ export const GITBASH_ROUTE_ADDENDUM_NO_PWSH = [
  */
 export const GITBASH_MSYS_ADDENDUM = 'This bash is Git for Windows (MSYS): paths use drive roots (/c/Users/...), and ~, /tmp, /dev/null and /usr/... resolve exactly as Git Bash resolves them.'
 
+const ROUTING_START = '\n[gitbash tool routing]\n'
+const ROUTING_END = '\n[/gitbash tool routing]'
+const ROUTING_SAFETY = 'Choose the execution route before running. A policy/access denial is a stop condition: never switch tools, shells or permissions to bypass it. A decoding/display failure does not mean the command failed to run; preserve its exit facts and never blindly repeat a side-effecting command. Do not guess unknown or mixed encodings.'
+const PTC_ROUTING = 'Inside run_code, call only bindings actually offered by the current SDK with await tools.<name>(...). Select by their descriptions: shell execution for shell syntax/pipelines; an offered typed native-executable binding for exact Windows argv or explicitly known per-stream encodings; an offered complete-path conversion binding before passing an MSYS value to Node fs/path. These are different operations, not substitutes for permissions. Never pass routes, search text or source code to a path converter. Program strings do not perform shell expansion. If a needed binding is absent, report the missing capability; do not invent its name. ' + ROUTING_SAFETY
+
+/** Model guidance names only tools in this assembly, not a switch's intent. */
+export function toolRoutingHintFor(tools, { pwshVisible = false } = {}) {
+  const names = new Set((Array.isArray(tools) ? tools : []).map(tool => tool?.name))
+  if (!names.has('bash')) return ''
+  const lines = [pwshVisible && names.has('pwsh') ? GITBASH_ROUTE_ADDENDUM : GITBASH_ROUTE_ADDENDUM_NO_PWSH]
+  if (names.has('gitbash_native')) lines.push('Use gitbash_native before execution when a Windows .exe needs exact literal argv such as /all or /c without MSYS conversion, or independently declared stdout/stderr encodings. Supply an absolute executable, mark each argument literal or path, and select only a known encoding (raw for unknown/mixed bytes). It does not implement shell pipelines, expansion or .cmd/.bat wrappers; only resolved danger-full-access can execute it.')
+  if (names.has('gitbash_to_native_path')) lines.push('Use gitbash_to_native_path only for a complete caller-declared MSYS filesystem path that a native Node fs/path API needs, especially a runtime-built value. Read native_path from the result. Never convert routes, search strings or shell/program source. Already-native or cwd-relative Node paths need no conversion; ordinary tool path fields already use their own translation. Conversion grants no access.')
+  lines.push(ROUTING_SAFETY)
+  return lines.join('\n')
+}
+
+/** Add a replaceable, idempotent block; a reused assembly follows visibility. */
+export function applyToolRouting(tools, { pwshVisible = false, msys = false } = {}) {
+  if (!Array.isArray(tools)) return
+  for (const tool of tools) {
+    if (!tool || typeof tool.description !== 'string' || !['bash', 'run_code'].includes(tool.name)) continue
+    let description = tool.description
+    const start = description.indexOf(ROUTING_START)
+    const end = start < 0 ? -1 : description.indexOf(ROUTING_END, start)
+    if (end >= 0) description = description.slice(0, start) + description.slice(end + ROUTING_END.length)
+    const hint = tool.name === 'bash'
+      ? toolRoutingHintFor(tools, { pwshVisible }) + (msys ? '\n' + GITBASH_MSYS_ADDENDUM : '')
+      : PTC_ROUTING
+    tool.description = description + ROUTING_START + hint + ROUTING_END
+  }
+}
+
 /** @deprecated composed form kept for tests: route + MSYS sentences. */
 export const GITBASH_BASH_ADDENDUM = GITBASH_ROUTE_ADDENDUM + '\n' + GITBASH_MSYS_ADDENDUM
 
@@ -158,7 +190,12 @@ export async function mountPrivateExecutor(ctx, GitBashSandboxExecutor, createSc
         if (executorScope.fiber) await executorScope.fiber
         const fiber = executorScope.ctx.plugin(GitBashSandboxExecutor)
         await fiber
-        return executorScope.ctx.get('shell')
+        const executor = executorScope.ctx.get('shell')
+        const sandboxModule = await resolveHostModule(executorScope.ctx, '@deepseek-ai/dsh-sandbox')
+        if (typeof sandboxModule?.SandboxUnavailableError === 'function') {
+          executor.unavailableErrorType = sandboxModule.SandboxUnavailableError
+        }
+        return executor
       })(),
       mountTimeout,
     ])
@@ -198,6 +235,7 @@ export function mountInlineTools(ctx, deps) {
   let closed = false
   const isLive = (agent, state) => !closed && tracked.get(agent) === state && !state.controller.signal.aborted
   const newState = () => ({ timer: undefined, scope: undefined, denyPwsh: undefined, pending: undefined, controller: new AbortController() })
+  const experimentalEnabled = () => deps.experimentalEnabled?.() !== false
   // Loader imports cannot be cancelled, but no continuation may outlive its
   // owner. Join our cancelled continuations without waiting on a stuck loader.
   const untilDisposed = async (promise, signal) => {
@@ -247,6 +285,7 @@ export function mountInlineTools(ctx, deps) {
         if (typeof createScope !== 'function') throw new Error('no createScope seam')
         controller.signal.throwIfAborted()
         const mounted = await mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope)
+        mounted.executor.experimentalEnabled = experimentalEnabled
         executorScope = mounted.executorScope
         controller.signal.throwIfAborted()
         const hostModules = {}
@@ -255,7 +294,33 @@ export function mountInlineTools(ctx, deps) {
         }
         const { createBashToolModule } = await untilDisposed(import('./bash-tool.js'), controller.signal)
         const module = createBashToolModule({ executor: mounted.executor, log, ...hostModules })
-        return { executor: mounted.executor, executorScope, module }
+        const extraModules = []
+        if (typeof deps.translatePath === 'function') {
+          const { createPathToolModule, PATH_TOOL_NAME } = await untilDisposed(import('./path-tool.js'), controller.signal)
+          extraModules.push({ name: PATH_TOOL_NAME, create: scope => createPathToolModule({
+            toolsModule: hostModules.toolsModule, translate: deps.translatePath, experimentalEnabled, log, scope,
+          }) })
+          try {
+            const localBashModule = await untilDisposed(resolveHostModule(ctx, '@deepseek-ai/dsh-bash-local'), controller.signal)
+            const outputModule = await untilDisposed(resolveHostModule(ctx, '@deepseek-ai/dsh-subprocess-local/output'), controller.signal)
+            if (typeof localBashModule?.LocalBashExecutor !== 'function'
+              || typeof outputModule?.OutputCollector !== 'function') {
+              throw new Error('public native executor/OutputCollector capability unavailable')
+            }
+            const { createNativeOutputAdapter } = await untilDisposed(import('./native-output.js'), controller.signal)
+            const { createNativeToolModule } = await untilDisposed(import('./native-tool.js'), controller.signal)
+            extraModules.push({ name: 'gitbash_native', create: scope => createNativeToolModule({
+              toolsModule: hostModules.toolsModule, sandboxModule: hostModules.sandboxModule,
+              localBashModule, createScope, translateMsysPath: deps.translatePath,
+              createNativeOutputAdapter, outputOptions: { OutputCollector: outputModule?.OutputCollector },
+              createArtifactDirectory: deps.createArtifactDirectory, experimentalEnabled, log, scope,
+            }) })
+          } catch (error) {
+            if (controller.signal.aborted) throw error
+            log(`native tool capability unavailable; bash/path tools remain available: ${error?.message ?? error}`)
+          }
+        }
+        return { executor: mounted.executor, executorScope, module, extraModules }
       } catch (error) {
         if (executorScope) await executorScope.dispose()
         throw error
@@ -271,7 +336,7 @@ export function mountInlineTools(ctx, deps) {
     let scope
     let retained = false
     try {
-      const { executor, module } = await untilDisposed(bashOncePromise(), state.controller.signal)
+      const { executor, module, extraModules } = await untilDisposed(bashOncePromise(), state.controller.signal)
       if (!isLive(agent, state)) return
       log(`own bash tool ready (private Git Bash executor at ${executor.bashPath || '(unresolved)'}; official pwsh executor untouched)`)
       scope = createScope(agent.ctx)
@@ -285,19 +350,42 @@ export function mountInlineTools(ctx, deps) {
       const fiber = scope.ctx.plugin(module)
       await untilDisposed(fiber, state.controller.signal)
       if (!isLive(agent, state)) return
-      retained = true
       // An INACTIVE fiber resolves its await() without ever running apply()
       // (issue #27): awaiting the plugin proves nothing, so read the registry
-      // back before claiming success. A miss gets an explicit failure line —
-      // never a silent no-tool session behind a success-shaped log.
+      // back before claiming success. A miss THROWS — the catch below logs the
+      // explicit activation failure and the finally disposes this half-mounted
+      // scope instead of leaking it for the agent's lifetime (shape credit:
+      // KouzakiUmi's PR #28).
       const registeredNames = scope.ctx.get !== undefined
         ? ((scope.ctx.get('tools')?.schemas?.(agent) ?? []).map((schema) => schema && typeof schema.name === 'string' ? schema.name : ''))
         : []
-      if (registeredNames.includes('bash')) {
-        log('own bash tool activated for this agent (Git Bash execution; official pwsh tool real but hidden by default)')
-      } else {
-        log('own bash tool did NOT register for this agent: the module fiber likely went INACTIVE (this host lacks an injected service the module requires) or the tools read-back is unavailable — bash is NOT available in this session; please report this with your dsh version (issue #27 pattern)')
+      if (registeredNames.includes('bash') === false) {
+        throw new Error('bash tool did not register for this agent (module fiber INACTIVE — this host lacks an injected service the module requires — or the tools read-back is unavailable); bash is NOT available in this session, please report this with your dsh version (issue #27)')
       }
+      for (const extra of extraModules ?? []) {
+        let extraFiber
+        try {
+          let applied = false
+          const module = extra.create(agent)
+          extraFiber = scope.ctx.plugin({ ...module, async apply(extraCtx, config) {
+            await module.apply(extraCtx, config)
+            applied = true
+          } })
+          await untilDisposed(extraFiber, state.controller.signal)
+          if (!isLive(agent, state)) return
+          if (!applied) {
+            throw new Error(`${extra.name} scope inactive (a required service may be missing)`)
+          }
+          // Registration/stand-down is reported by the shared live registrar.
+          log(`${extra.name} scope ready; registration follows experimentalNative and existing owners`)
+        } catch (error) {
+          if (!isLive(agent, state)) return
+          await extraFiber?.dispose()
+          log(`${extra.name} activation failed; bash remains available: ${error?.message ?? error}`)
+        }
+      }
+      retained = true
+      log('own bash tool activated for this agent (Git Bash execution; official pwsh tool real but hidden by default)')
     } catch (error) {
       if (isLive(agent, state)) log(`own bash tool activation failed for this agent: ${error?.message ?? error}`)
     } finally {
@@ -402,7 +490,7 @@ export function mountInlineTools(ctx, deps) {
       log(`agent bash tool cleanup failed: ${error?.message ?? error}`)
     }))
     ctx.on('loader/volatile-update', (paths) => {
-      if (!Array.isArray(paths) || !paths.some((path) => Array.isArray(path) && path[0] === 'pwshTool')) return
+      if (!Array.isArray(paths) || !paths.some((path) => Array.isArray(path) && ['pwshTool', 'experimentalNative'].includes(path[0]))) return
       for (const agent of tracked.keys()) {
         try { reconcile(agent) } catch (error) { log(`pwsh switch update failed: ${error?.message ?? error}`) }
       }