dsh-gitbash-shell 0.40.5 → 0.41.1

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## v0.41.1 — 2026-10-19
+
+### fix:桌面版设置页「安装 / 升级选中」无反应(栅栏 no-origin 误伤 Electron + 前端静默吞 403)
+
+- 报告:[issue #33](https://github.com/KannaKuron/dsh-gitbash-shell/issues/33)(@AncherEven,报告自带完整根因定位,感谢)。dsh 桌面版(Electron)设置 → 插件 → 终端工具,点「安装 / 升级选中」不报错、不出进度、按钮复原。
+- **fix(栅栏侧,tool-runner.js)**:`fenceToolRequest` 原要求改写类请求必须携带同源 Origin/Referer,而桌面版 Electron 渲染进程的同源 fetch **不携带**这两个头 → 恒 403 `no-origin`。现改为:缺 Origin 时放行 origin 半(信任围栏的真防线是 loopback 限定,保持不变);**携带** Origin/Referer 时仍必须同源,跨站一律拒。安全性论证:浏览器对一切改写请求(同站与跨站)都附加 Origin,缺头请求不可能来自网页 CSRF,只能来自非浏览器客户端——而后者本就能伪造同源头,栅栏对其原本就不构成额外防线。
+- **fix(前端侧,client.js)**:`runTools()` 对非 2xx 响应直接 `res.json()` 解析错误体、取不到 `job` 静默吞掉;现与 `loadTools()` 一致先判 `res.ok`,栅栏拒绝等失败会显示「HTTP 403」类错误而不是无反应。
+- 验证:`npm test` 263 项全绿;栅栏测试矩阵更新(缺头 POST 放行 / 携带跨源 POST 仍拒 / LAN 携带同源头仍 not-loopback / 前端 res.ok 守卫断言)。
+
+## v0.41.0 — 2026-10-19
+
+### feat:官方「持久终端」实验包 Git Bash 化自动接管;dsh-ops 并存时剔除其 shell 工具;terminal_* 方言说明
+
+- **持久终端自动接管(v0.41.0 主特性)**:官方实验包 `@deepseek-ai/dsh-experimental-terminal-bundle` 在 win32 上默认 `optional-terminal-bash` 禁 / `optional-terminal-pwsh` 启——开启「持久终端」后终端是 PowerShell,与本插件的 bash-first 语义相反。v0.41 起检测到 bundle 挂载后,由插件维护 profile patch(bundle 组子行按 id 覆盖,官方 `applyEntryPatches` 通道):`optional-terminal-bash` → `disabled: false` + `shellPath` 指 Git Bash;`optional-terminal-pwsh` → `disabled: true`(仅当该行不存在时写入,已存在则不动并提示并存)。用户显式配置(bash 行 `disabled: true` 或 `shellPath` 指向别处)一律尊重,不覆盖。
+- **为什么直写 patch 文件**:官方 config-editor 两个硬限制(实测 packages/boot/config-editor)——`entries()` 只寻址 include 挂载的顶层行(bundle 组内子行不可见);`edit()` 只写 config 键,写不了行级 `disabled`。bundle 子行覆盖只能落在 profile patch 文件上。安全链:`parseDocument` 保注释保 `!!js` → 变更后 re-parse 自检 → 原子写(`@deepseek-ai/dsh-atomic-write` 优先,降级 tmp+rename,mode 0600)→ 回读验证 → 失败回滚原字节。守卫测试随之演进:index.js 豁免「no fs path to the profile patch」整版禁令(bundle 接管是有意的直写,安全特征有断言),**侧栏终端接管仍走 configEditor 不变**。
+- **terminal_* 方言说明**:bundle 接管生效后(`terminalDialect.gitBash`),工具路由说明进入持久终端通道——`terminal_send`/`terminal_signal` 的命令按 Git Bash/MSYS 方言书写,与单次 bash 工具同一套提示。
+- **dsh-ops 并存时的 shell 工具剔除(用户决策定案)**:安装了本插件 = bash 用本插件方案;`ops_bash` / `ops_run` 在本插件 bash 工具在场的 agent 上默认 deny(`tools.restrict` + `tools/pre-execute` 双层),不做设置开关;ops 的 file / 后台 / PTC 增强不受影响。
+- 验证:`npm test` 263 项全绿(新增 tests/terminal-bundle.mjs 26 项:plan 矩阵 12 + writer 12 + report + detect);守卫测试演进 2 处(compatibility assemble 段参数面补 `terminalDialect`;smoke 侧栏守卫按上述范围收窄)。
+
 ## v0.40.5 — 2026-10-18
 
 ### 工具行字号跟随宿主字体设置;半像素字号归整(fix)

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.40.5",
+  "version": "0.41.1",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:自带 bash 工具(私有 Git Bash 执行器实例,官方 PowerShell 执行器原样保留),官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0 起;v0.39.0 起不再替换宿主执行器),四个 *·Git Bash 变体 preset 可开关;官方 pwsh 工具默认隐藏、开关可见(真 PowerShell);附带 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.40.5",
+  "version": "0.41.1",
   "description": "Windows 上给 agent 一个真正的 Git Bash 命令工具:私有 Git Bash 执行器实例(官方 PowerShell 执行器原样保留),统一 MSYS 盘根路径方言,官方 pwsh 工具默认隐藏可开关,物化四个内置预设的 Git Bash 变体,侧栏终端接管可开关。· Give agents a real Git Bash tool on Windows: a private Git Bash executor instance (the official PowerShell executor stays untouched), a unified MSYS drive-root path dialect, an opt-in official pwsh tool, and four Git Bash preset variants.",
   "type": "module",
   "repository": {

package/src/client.js

@@ -2551,7 +2551,12 @@ window.__ModuleLoader__.load({
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify({ action: "auto", ids: ids }),
 				})
-					.then(function (res) { return res.json(); })
+					// Issue #33: a non-2xx answer (e.g. a 403 fence refusal) is a JSON
+					// body too — parsing it and finding no job silently ate the error.
+					.then(function (res) {
+						if (!res.ok) throw new Error("HTTP " + res.status);
+						return res.json();
+					})
 					.then(function (data) { setToolJob(data !== null && typeof data === "object" && data.job ? data.job : null); })
 					.catch(function (err) { setToolErr(String((err && err.message) || err)); })
 					.then(function () { setToolBusy(false); });

package/src/index.js

@@ -49,6 +49,7 @@ import {
   mkdtempSync,
   readFileSync,
   readdirSync,
+  renameSync,
   rmSync,
   writeFileSync,
 } from 'node:fs'
@@ -59,6 +60,8 @@ import { fileURLToPath } from 'node:url'
 import { PRESET_META, minimalPluginsFor, pluginsFor } from './compositions.js'
 import { loadSchemastery } from './schemastery.js'
 import { applyToolRouting, mountInlineTools } from './inline-tools.js'
+import { adoptTerminalBundlePatch, detectTerminalBundle, terminalBundleReport, terminalDialect } from './terminal-bundle.js'
+import { resolveHostModule } from './bash-tool.js'
 import { mountFastctx } from './fastctx-bridge.js'
 
 /**
@@ -2250,6 +2253,7 @@ export async function apply(ctx, config = {}) {
             applyToolRouting(assembly.tools, {
               pwshVisible: liveSettings.pwshTool() === true,
               msys: applies && dialect.posixPaths === true,
+              terminalGitBash: terminalDialect.gitBash === true,
             })
           }
           if (applies && dialect.posixPaths === true && assembly && typeof assembly === 'object') {
@@ -2726,6 +2730,69 @@ export async function apply(ctx, config = {}) {
     }
   }
 
+  // ── OFFICIAL persistent-terminal bundle adoption (v0.41.0) ─────────────
+  // The experimental terminal bundle mounts its shell backends behind a
+  // bundle patch that on Windows enables the pwsh backend and disables the
+  // bash one — exactly backwards for a Git Bash house. The fix is a
+  // PROFILE-PATCH row edit (the host patch algorithm addresses group
+  // children by id, and bundle patches are read before the profile patch
+  // file) because configEditor can neither see bundle children nor write a
+  // row-level `disabled`. See src/terminal-bundle.js for the full
+  // rationale and safety rails. The terminal_* dialect sentence rides the
+  // existing routing block once terminalDialect.gitBash turns true.
+  if (process.platform === 'win32') {
+    try {
+      ctx.inject(['profileContext'], (patchCtx) => {
+        const run = async () => {
+          const patchPath = patchCtx.get('profileContext')?.patchPath
+          if (typeof patchPath !== 'string' || patchPath.trim() === '') {
+            console.log(`${TAG} persistent terminal: no profile patch path — nothing to adopt`)
+            return
+          }
+          let mounted = false
+          try {
+            mounted = await detectTerminalBundle(ctx)
+          } catch (error) {
+            console.log(`${TAG} persistent terminal: bundle detection failed: ${error?.message ?? error}`)
+            return
+          }
+          const resolution = readBashResolution()
+          const result = await adoptTerminalBundlePatch(
+            {
+              readFile: (file) => readFileSync(file, 'utf8'),
+              writeFileAtomic: async (file, data) => {
+                // The host's atomic write when resolvable; a same-directory
+                // tmp+rename otherwise — never a torn patch file.
+                try {
+                  const atomic = await resolveHostModule(ctx, '@deepseek-ai/dsh-atomic-write')
+                  if (typeof atomic?.writeFileAtomic === 'function') return atomic.writeFileAtomic(file, data, { mode: 0o600 })
+                } catch { /* fallback below */ }
+                const tmp = `${file}.gitbash-${Date.now()}.tmp`
+                writeFileSync(tmp, data, { mode: 0o600 })
+                renameSync(tmp, file)
+              },
+              yaml: () => resolveHostModule(ctx, 'yaml'),
+            },
+            {
+              platform: process.platform,
+              enabled: liveSettings.autoTerminalShell(),
+              mounted,
+              resolved: resolution.ok ? resolution.path : '',
+              patchPath,
+            },
+          )
+          if (result.status === 'adopted' || result.status === 'updated' || result.status === 'unchanged') {
+            terminalDialect.gitBash = true
+          }
+          console.log(`${TAG} ${terminalBundleReport(result)}`)
+        }
+        run().catch((error) => console.log(`${TAG} persistent terminal adoption failed: ${error?.message ?? error}`))
+      })
+    } catch (error) {
+      console.log(`${TAG} persistent terminal adoption wiring failed: ${error?.message ?? error}`)
+    }
+  }
+
   // ── dsh-better-sidebar terminal adoption (Windows only) ────────────────
   // The sidebar resolves its terminal shell through the settings seam per
   // open; adopt it through that seam (see adoptSidebarShell for rationale).

package/src/inline-tools.js

@@ -91,6 +91,27 @@ export function inlineNeeds(names, { pwshVisible } = {}) {
   }
 }
 
+/**
+ * The dsh-ops shell pair (v0.41.0, owner decision): while this plugin's own
+ * bash owns a session, those two names are DENIED for the agent. The list is
+ * dsh-ops's own published surface - lib/policy.js builds every public name as
+ * TOOL_PREFIX + raw with TOOL_PREFIX = "ops_", and the shell-class raw names
+ * are "run" (one-shot shell) and "bash" (in-process shell). Their file/search
+ * (ops_inspect_local_file, ops_grep, ops_glob, ops_replace), background-job
+ * (ops_run_background, ops_job_*) and batch surfaces stay untouched - the
+ * owner's call: installing dsh-ops buys its enhancements, not a second bash.
+ */
+export const OPS_SHELL_TOOLS = Object.freeze(['ops_bash', 'ops_run'])
+
+/**
+ * The deny reason for an ops shell call on an agent our bash owns (route B
+ * wording): the tool exists, the host just routes shells elsewhere - the
+ * sentence names the owner and keeps the agent inside the offered face.
+ */
+export function deniedOpsShellReason() {
+  return 'the dsh-ops shell tools are denied on this host: dsh-gitbash-shell owns the shell (its own Git Bash bash tool). Use the bash tool for commands; the other ops_* tools (files, search, background jobs) are unaffected.'
+}
+
 /**
  * The routing addendum appended to the `bash` tool's description through the
  * system-prompt assemble waterfall. TWO variants (v0.37.0, user decision):
@@ -124,10 +145,16 @@ const ROUTING_SAFETY = 'Choose the execution route before running. A policy/acce
 const PTC_ROUTING = 'Inside run_code, call only bindings actually offered by the current SDK with await tools.<name>(...). Select by their descriptions: shell execution for shell syntax/pipelines; an offered typed native-executable binding for exact Windows argv or explicitly known per-stream encodings; an offered complete-path conversion binding before passing an MSYS value to Node fs/path. These are different operations, not substitutes for permissions. Never pass routes, search text or source code to a path converter. Program strings do not perform shell expansion. If a needed binding is absent, report the missing capability; do not invent its name. ' + ROUTING_SAFETY
 
 /** Model guidance names only tools in this assembly, not a switch's intent. */
-export function toolRoutingHintFor(tools, { pwshVisible = false } = {}) {
+export function toolRoutingHintFor(tools, { pwshVisible = false, terminalGitBash = false } = {}) {
   const names = new Set((Array.isArray(tools) ? tools : []).map(tool => tool?.name))
   if (!names.has('bash')) return ''
   const lines = [pwshVisible && names.has('pwsh') ? GITBASH_ROUTE_ADDENDUM : GITBASH_ROUTE_ADDENDUM_NO_PWSH]
+  // v0.41.0: the persistent-terminal dialect fact. Said ONLY when the host
+  // actually carries the terminal tools AND our terminal-bundle adoption has
+  // settled the rows to Git Bash (the caller passes the settled flag) - a
+  // bundle left at its official defaults runs pwsh there, and a sentence
+  // must never describe a shell the button will not start.
+  if (terminalGitBash === true && names.has('terminal_open')) lines.push('The persistent terminal tools (terminal_open/read/send/...) run Git Bash (MSYS) on this host: the same drive-root paths (/c/...) and MINGW64 semantics as this bash tool; they are NOT PowerShell.')
   if (names.has('gitbash_native')) lines.push('Use gitbash_native before execution when a Windows .exe needs exact literal argv such as /all or /c without MSYS conversion, or independently declared stdout/stderr encodings. Supply an absolute executable, mark each argument literal or path, and select only a known encoding (raw for unknown/mixed bytes). It does not implement shell pipelines, expansion or .cmd/.bat wrappers; only resolved danger-full-access can execute it.')
   if (names.has('gitbash_to_native_path')) lines.push('Use gitbash_to_native_path only for a complete caller-declared MSYS filesystem path that a native Node fs/path API needs, especially a runtime-built value. Read native_path from the result. Never convert routes, search strings or shell/program source. Already-native or cwd-relative Node paths need no conversion; ordinary tool path fields already use their own translation. Conversion grants no access.')
   lines.push(ROUTING_SAFETY)
@@ -135,7 +162,7 @@ export function toolRoutingHintFor(tools, { pwshVisible = false } = {}) {
 }
 
 /** Add a replaceable, idempotent block; a reused assembly follows visibility. */
-export function applyToolRouting(tools, { pwshVisible = false, msys = false } = {}) {
+export function applyToolRouting(tools, { pwshVisible = false, msys = false, terminalGitBash = false } = {}) {
   if (!Array.isArray(tools)) return
   for (const tool of tools) {
     if (!tool || typeof tool.description !== 'string' || !['bash', 'run_code'].includes(tool.name)) continue
@@ -144,7 +171,7 @@ export function applyToolRouting(tools, { pwshVisible = false, msys = false } =
     const end = start < 0 ? -1 : description.indexOf(ROUTING_END, start)
     if (end >= 0) description = description.slice(0, start) + description.slice(end + ROUTING_END.length)
     const hint = tool.name === 'bash'
-      ? toolRoutingHintFor(tools, { pwshVisible }) + (msys ? '\n' + GITBASH_MSYS_ADDENDUM : '')
+      ? toolRoutingHintFor(tools, { pwshVisible, terminalGitBash }) + (msys ? '\n' + GITBASH_MSYS_ADDENDUM : '')
       : PTC_ROUTING
     tool.description = description + ROUTING_START + hint + ROUTING_END
   }
@@ -234,7 +261,7 @@ export function mountInlineTools(ctx, deps) {
   const controller = new AbortController()
   let closed = false
   const isLive = (agent, state) => !closed && tracked.get(agent) === state && !state.controller.signal.aborted
-  const newState = () => ({ timer: undefined, scope: undefined, denyPwsh: undefined, pending: undefined, controller: new AbortController() })
+  const newState = () => ({ timer: undefined, scope: undefined, denyPwsh: undefined, denyOpsShell: undefined, pending: undefined, controller: new AbortController() })
   const experimentalEnabled = () => deps.experimentalEnabled?.() !== false
   // Loader imports cannot be cancelled, but no continuation may outlive its
   // owner. Join our cancelled continuations without waiting on a stuck loader.
@@ -384,6 +411,26 @@ export function mountInlineTools(ctx, deps) {
           log(`${extra.name} activation failed; bash remains available: ${error?.message ?? error}`)
         }
       }
+      // v0.41.0 (owner decision): while OUR bash owns the session, the ops
+      // shell pair is denied by name - installing dsh-ops buys its file,
+      // search and background enhancements, not a second bash. Through the
+      // AGENT's scoped context, the exact shape the pwsh hide uses (issue
+      // #18: the root context throws "requires a scoped context"). Only the
+      // names actually in the face are listed, so a future dsh-ops rename
+      // degrades to "no denial", never to a wrong deny list. On failure the
+      // ops tools stay - our bash remains the routing answer either way.
+      const opsShell = faceNames(agent).filter((name) => OPS_SHELL_TOOLS.includes(name))
+      if (opsShell.length > 0) {
+        try {
+          const deny = agent.ctx?.tools?.restrict?.({ deny: [...opsShell] })
+          if (typeof deny === 'function') {
+            state.denyOpsShell = deny
+            log('ops shell tools denied for this agent (' + opsShell.join(', ') + '): this host\'s bash is ours; their file/search/background tools stay')
+          }
+        } catch (error) {
+          log('ops shell denial failed (their shell tools stay available): ' + (error?.message ?? error))
+        }
+      }
       retained = true
       log('own bash tool activated for this agent (Git Bash execution; official pwsh tool real but hidden by default)')
     } catch (error) {
@@ -414,6 +461,7 @@ export function mountInlineTools(ctx, deps) {
     const previous = tracked.get(agent)
     if (previous?.timer) { clearTimeout(previous.timer); previous.timer = undefined }
     if (previous?.denyPwsh) { previous.denyPwsh(); previous.denyPwsh = undefined }
+    if (previous?.denyOpsShell) { previous.denyOpsShell(); previous.denyOpsShell = undefined }
     const names = faceNames(agent)
     // The composed face may not be wired yet at created-time. Retry bounded:
     // a face with NEITHER tool carries no verdict. Five tries at 250ms, then
@@ -457,6 +505,26 @@ export function mountInlineTools(ctx, deps) {
     if (needs.needsBash && !state.scope) {
       startBash(agent, state)
     }
+    // v0.41.0: keep the ops shell denial attached while our bash owns the
+    // agent. The mask was undone above for observation; an agent that is
+    // already owned (state.scope, including one still mounting - provideBash
+    // claims the scope before its asynchronous stages) gets the denial
+    // re-attached here, so a reconcile fired by a switch flip or a re-show
+    // never leaves the pair visible.
+    if (state.scope && !state.denyOpsShell) {
+      const opsShell = names.filter((name) => OPS_SHELL_TOOLS.includes(name))
+      if (opsShell.length > 0) {
+        try {
+          const deny = agent.ctx?.tools?.restrict?.({ deny: [...opsShell] })
+          if (typeof deny === 'function') {
+            state.denyOpsShell = deny
+            log('ops shell tools denied for this agent (' + opsShell.join(', ') + ')')
+          }
+        } catch (error) {
+          log('ops shell denial failed (their shell tools stay available): ' + (error?.message ?? error))
+        }
+      }
+    }
   }
 
   const teardown = async (agent) => {
@@ -466,6 +534,7 @@ export function mountInlineTools(ctx, deps) {
     state.controller.abort(new Error('inline bash agent disposed'))
     if (state.timer) clearTimeout(state.timer)
     if (state.denyPwsh) { state.denyPwsh(); state.denyPwsh = undefined }
+    if (state.denyOpsShell) { state.denyOpsShell(); state.denyOpsShell = undefined }
     await Promise.all([state.scope?.dispose(), state.pending])
   }
 
@@ -510,6 +579,13 @@ export function mountInlineTools(ctx, deps) {
         if (exec?.name === 'pwsh' && !opsSeen && deps.pwshEnabled?.() !== true) {
           return { kind: 'deny', reason: hiddenPwshDenyReason() }
         }
+        // v0.41.0, second independent layer for the ops shell pair: while our
+        // bash owns this agent, a call that slips past the visibility
+        // restriction is denied by name - same reasoning as the pwsh guard
+        // above.
+        if (OPS_SHELL_TOOLS.includes(exec?.name) && tracked.get(exec?.agent)?.scope) {
+          return { kind: 'deny', reason: deniedOpsShellReason() }
+        }
       } catch { /* never block the waterfall */ }
       return next()
     })

package/src/terminal-bundle.js

@@ -0,0 +1,346 @@
+/**
+ * dsh-gitbash-shell — OFFICIAL persistent-terminal bundle adoption (v0.41.0).
+ *
+ * The experimental terminal bundle (@deepseek-ai/dsh-experimental-terminal-bundle)
+ * ships its shell backends behind a bundle patch whose own win32 gating reads:
+ * the bash backend row is DISABLED on win32 and the pwsh backend row is enabled
+ * — its README states this verbatim ("POSIX 使用 Bash,Windows 使用 PowerShell").
+ * On a Git Bash house that is exactly backwards: the official terminal_* tools
+ * would open PowerShell while every other shell surface on this host runs Git
+ * Bash (session tool, sidebar terminal, PTC translation).
+ *
+ * Fixing it needs a PROFILE-PATCH edit, not the settings service:
+ *  - the bundle rows are group CHILDREN, and the host patch algorithm addresses
+ *    children by id (buildMap recurses into group config arrays), so a profile
+ *    patch row `- id: optional-terminal-bash {disabled: false, config:{...}}`
+ *    overrides the bundle row (bundle patches are read BEFORE the profile patch
+ *    file — packages/boot/app-boot/src/profile-context.ts:57);
+ *  - configEditor CANNOT do this (measured, packages/boot/config-editor):
+ *    entries() only sees include-mounted TOP-LEVEL rows, and edit() only
+ *    writes the config key, never a row-level `disabled`.
+ *
+ * So this module edits the profile patch file directly, with the same care the
+ * official editor takes: `yaml`'s parseDocument (comments and !!js expressions
+ * survive untouched), targeted setIn on the two rows, a re-parse self-check,
+ * an atomic write, a verify-by-reread and a rollback to the previous bytes on
+ * any mismatch. HARD RULES (inherited from terminal-shell.js): never overwrite
+ * an explicit user choice, only ever write a VERIFIED Git Bash path, and
+ * re-read after writing.
+ *
+ * The bundle not being mounted is the normal state for most hosts: nothing is
+ * written then, and the session-tool inline patch keeps owning the shell story.
+ *
+ * @module dsh-gitbash-shell/terminal-bundle
+ */
+
+import { normalizeBashPath } from './bash-path.js'
+
+/** Bundle row that mounts the terminal_* tool suite — its presence (enabled) IS the bundle. */
+export const TERMINAL_BUNDLE_TOOL_ROW = 'optional-tool-terminal'
+/** Bundle row for the persistent bash backend (disabled on win32 by the bundle itself). */
+export const TERMINAL_BUNDLE_BASH_ROW = 'optional-terminal-bash'
+/** Bundle row for the persistent pwsh backend (enabled on win32 by the bundle itself). */
+export const TERMINAL_BUNDLE_PWSH_ROW = 'optional-terminal-pwsh'
+
+/** Live dialect fact for the prompt-assembly waterfall (read by index.js).
+ * True only when the persistent terminal provably runs this host's Git Bash. */
+export const terminalDialect = { gitBash: false }
+
+/**
+ * Is the official terminal bundle mounted with its tool row active? The tool
+ * row's presence is what turns terminal_open on — the shell backends without
+ * it are inert. Reads through the loader service the same way the ops
+ * presence probe does (an async fiber, so this awaits).
+ * @param {object} ctx - host context carrying `inject`.
+ * @returns {Promise<boolean>}
+ */
+export async function detectTerminalBundle(ctx) {
+  let present = false
+  await ctx.inject(['loader'], (loaderCtx) => {
+    const entries = loaderCtx?.get?.('loader')?.entries?.()
+    if (typeof entries?.[Symbol.iterator] !== 'function') return
+    for (const entry of entries) {
+      if (entry?.options?.id !== TERMINAL_BUNDLE_TOOL_ROW) continue
+      if (entry.options.disabled === true) continue
+      present = true
+      break
+    }
+  })
+  return present
+}
+
+/**
+ * Read the plugin config entry for one patch row (the fields this module owns).
+ * Takes the RAW parsed patch entry (`config` wrapper included) and returns the
+ * FLATTENED facts; undefined when the input is not a row-shaped object.
+ * @param {unknown} row - a parsed patch entry.
+ * @returns {{disabled?: boolean, shellPath?: string}|undefined}
+ */
+export function readPatchRow(row) {
+  if (!row || typeof row !== 'object' || Array.isArray(row)) return undefined
+  const out = {}
+  if (row.disabled === true) out.disabled = true
+  else if (row.disabled === false) out.disabled = false
+  const config = row.config
+  if (config && typeof config === 'object' && !Array.isArray(config)) {
+    if (typeof config.shellPath === 'string') out.shellPath = config.shellPath
+  }
+  return out
+}
+
+/**
+ * Pure decision: should (and how exactly) the profile patch adopt the bundle's
+ * shell rows for this host? Mirrors terminal-shell's planTerminalAdopt shape —
+ * one action + one human reason, every state enumerable and testable.
+ * @param {{platform?: string, enabled?: boolean, mounted?: boolean, resolved?: string, rows?: {bash?: {disabled?: boolean, shellPath?: string}, pwsh?: {disabled?: boolean}}}} input - rows are the FLATTENED row facts (readPatchRow/currentBundleRows output).
+ * @returns {{action: string, reason: string, bash?: {disabled: boolean, shellPath?: string}, pwsh?: {disabled: boolean}}}
+ */
+export function planTerminalBundleAdopt(input) {
+  const { platform, enabled, mounted, resolved, rows } = input ?? {}
+  if (platform !== 'win32') {
+    return { action: 'skip-platform', reason: 'the persistent terminal bundle keeps its own POSIX bash backend; nothing to adopt off-Windows' }
+  }
+  if (mounted !== true) {
+    return { action: 'bundle-absent', reason: 'the persistent terminal bundle is not mounted (or its tool row is disabled) — nothing to adopt' }
+  }
+  if (enabled !== true) {
+    return { action: 'skip-disabled', reason: 'autoTerminalShell is off — the bundle keeps its official shell backends' }
+  }
+  if (typeof resolved !== 'string' || resolved.trim() === '') {
+    return { action: 'skip-unresolved', reason: 'no verified Git Bash executable on this host — the bundle keeps its official backends' }
+  }
+  const shellPath = resolved.trim()
+  // `rows` carries the FLATTENED facts (readPatchRow/currentBundleRows output):
+  // { disabled?, shellPath? } — not the raw patch row with its config wrapper.
+  const bash = rows?.bash
+  const pwsh = rows?.pwsh
+  if (bash === undefined) {
+    // No user/bundle override row yet: write ours, and disable the pwsh backend
+    // ONLY when no row of its own exists (a user-written row is never touched).
+    const pwshWrite = pwsh === undefined ? { disabled: true } : undefined
+    return {
+      action: 'adopt',
+      reason: pwshWrite
+        ? 'writing the persistent-terminal overrides: bash backend on the verified Git Bash, pwsh backend off'
+        : 'writing the persistent-terminal bash-backend override on the verified Git Bash; a pwsh-backend row already exists and is left alone',
+      bash: { disabled: false, shellPath },
+      ...(pwshWrite ? { pwsh: pwshWrite } : {}),
+    }
+  }
+  if (bash.disabled === true) {
+    return { action: 'kept-user-choice', reason: 'the profile patch explicitly disables the persistent bash backend — not touching an explicit user choice' }
+  }
+  const configured = typeof bash.shellPath === 'string' ? bash.shellPath.trim() : ''
+  if (configured === '') {
+    // Row exists, backend on, but shellPath left at the bundle's POSIX default
+    // (/bin/bash) — that cannot work on Windows. Completing it is not a user
+    // override: the field is EMPTY.
+    return {
+      action: 'update-shellpath',
+      reason: 'the bash backend row is enabled but shellPath is unset (the bundle default /bin/bash cannot work on Windows); completing it with the verified Git Bash',
+      bash: { disabled: false, shellPath },
+    }
+  }
+  if (normalizeBashPath(configured) !== normalizeBashPath(shellPath)) {
+    return { action: 'kept-user-choice', reason: `the persistent bash backend already points at "${configured}" — not overwriting an explicit user choice` }
+  }
+  if (pwsh !== undefined && pwsh.disabled !== true) {
+    return { action: 'unchanged', reason: 'the persistent terminal already runs the verified Git Bash; the pwsh backend row is also enabled (a user choice we do not touch)' }
+  }
+  return { action: 'unchanged', reason: 'the persistent terminal already runs the verified Git Bash (bash row on it, pwsh backend off)' }
+}
+
+/**
+ * Extract the current override rows for our two ids from a parsed patch document.
+ * @param {object} yaml - the eemeli yaml module (isMap/getIn surface).
+ * @param {object} document - a yaml parseDocument result.
+ * @returns {{bash?: object, pwsh?: object}}
+ */
+export function currentBundleRows(yaml, document) {
+  const out = {}
+  const items = document?.contents?.items
+  if (!Array.isArray(items)) return out
+  const read = (id) => {
+    const index = findRow(yaml, document, id)
+    if (index < 0) return undefined
+    const item = items[index]
+    const row = {}
+    const disabled = item.getIn?.(['disabled'])
+    if (disabled === true || disabled === false) row.disabled = disabled
+    const shellPath = item.getIn?.(['config', 'shellPath'])
+    if (typeof shellPath === 'string') row.shellPath = shellPath
+    return row
+  }
+  const bash = read(TERMINAL_BUNDLE_BASH_ROW)
+  if (bash !== undefined) out.bash = bash
+  const pwsh = read(TERMINAL_BUNDLE_PWSH_ROW)
+  if (pwsh !== undefined) out.pwsh = pwsh
+  return out
+}
+
+/**
+ * Last matching row index for an id (later rows win, mirroring the host patch
+ * algorithm); skips insert rows, same guards as config-editor's lookup.
+ * @returns {number} index or -1.
+ */
+export function findRow(yaml, document, id) {
+  const items = document?.contents?.items
+  if (!Array.isArray(items)) return -1
+  for (let i = items.length - 1; i >= 0; i -= 1) {
+    const item = items[i]
+    if (!yaml.isMap?.(item)) continue
+    if (item.getIn?.(['insert']) !== undefined) continue
+    if (item.getIn?.(['id']) !== id) continue
+    return i
+  }
+  return -1
+}
+
+/**
+ * Rewrite the profile patch file so the official persistent terminal runs the
+ * verified Git Bash. Reads, plans, writes ONLY on adopt/update-shellpath,
+ * re-parses its own output as a self-check, writes atomically, verifies by
+ * re-reading and rolls back to the previous bytes on any mismatch.
+ * @param {{readFile: Function, writeFileAtomic: Function, yaml: Function}} io - injected IO (fs + yaml loader).
+ * @param {{platform?: string, enabled?: boolean, mounted?: boolean, resolved?: string, patchPath: string}} input
+ * @returns {Promise<{action: string, status: string, reason?: string, shellPath?: string, pwshRowWritten?: boolean}>}
+ */
+export async function adoptTerminalBundlePatch(io, input) {
+  const done = (action, status, reason, extra = {}) => ({ action, status, reason, ...extra })
+  const { patchPath } = input
+  let yamlModule
+  try {
+    yamlModule = await io.yaml()
+  } catch (error) {
+    return done('skip-modules', 'skip-modules', undefined, { detail: `the yaml document module is unavailable (${error?.message ?? error})` })
+  }
+  if (typeof yamlModule?.parseDocument !== 'function' || typeof yamlModule?.isSeq !== 'function' || typeof yamlModule?.isMap !== 'function') {
+    return done('skip-modules', 'skip-modules', undefined, { detail: 'the yaml document module lacks parseDocument/isSeq/isMap' })
+  }
+
+  let before
+  try {
+    before = await io.readFile(patchPath)
+  } catch (error) {
+    if (error?.code !== 'ENOENT') return done('skip-read', 'skip-read', undefined, { detail: `the profile patch could not be read (${error?.message ?? error})` })
+    before = '[]\n'
+  }
+
+  const parse = (text) => yamlModule.parseDocument(text, {
+    customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value) => value }],
+  })
+
+  const document = parse(before)
+  if (Array.isArray(document?.errors) && document.errors.length > 0) {
+    return done('skip-parse', 'skip-parse', undefined, { detail: 'the profile patch has YAML errors; refusing to edit a broken document' })
+  }
+  if (!yamlModule.isSeq(document?.contents)) {
+    return done('skip-shape', 'skip-shape', undefined, { detail: 'the profile patch is not a YAML sequence; refusing to edit an unknown shape' })
+  }
+
+  // The plan runs AFTER the current rows are known: it decides between
+  // writing and standing down based on what the profile patch already says.
+  const rows = currentBundleRows(yamlModule, document)
+  const plan = planTerminalBundleAdopt({ ...input, rows })
+  if (plan.action !== 'adopt' && plan.action !== 'update-shellpath') {
+    return done(plan.action, plan.action, plan.reason)
+  }
+
+  // Explicit QUOTE_DOUBLE scalars: the patch stays human-readable and the
+  // path keeps its quotes (the plain style a bare createNode produces is
+  // valid but nothing like what a hand-written row looks like).
+  const quotedScalar = (value) => {
+    const node = new yamlModule.Scalar(value)
+    node.type = 'QUOTE_DOUBLE'
+    return node
+  }
+  const newMap = (...pairs) => {
+    const map = document.createNode({})
+    for (const [key, value] of pairs) map.set(key, value)
+    return map
+  }
+
+  // An empty patch file parses as a FLOW sequence ([]); once rows are added
+  // it must print in block style or every new row comes out one-line flow.
+  document.contents.flow = false
+
+  // A brand-new row is added by parsing a handwritten-looking FRAGMENT and
+  // pushing its node: what lands on disk then reads exactly like the row a
+  // careful human would write (block style, quoted path), instead of the
+  // flow-style shape a bare createNode serializes to.
+  const rowFromFragment = (text) => {
+    const fragment = parse(text)
+    if (Array.isArray(fragment?.errors) && fragment.errors.length > 0) return undefined
+    return fragment?.contents?.items?.[0]
+  }
+  const bashIndex = findRow(yamlModule, document, TERMINAL_BUNDLE_BASH_ROW)
+  const bashNode = plan.bash
+  if (bashIndex >= 0) {
+    document.setIn([bashIndex, 'disabled'], bashNode.disabled)
+    document.setIn([bashIndex, 'config'], newMap(['shellPath', quotedScalar(bashNode.shellPath)]))
+  } else {
+    const row = rowFromFragment(`- id: ${TERMINAL_BUNDLE_BASH_ROW}\n  disabled: ${bashNode.disabled}\n  config:\n    shellPath: ${JSON.stringify(bashNode.shellPath)}\n`)
+    if (row === undefined) {
+      return done(plan.action, 'write-failed', plan.reason, { detail: 'the new bash row fragment did not parse; nothing was written' })
+    }
+    document.add(row)
+  }
+  let pwshRowWritten = false
+  if (plan.pwsh && findRow(yamlModule, document, TERMINAL_BUNDLE_PWSH_ROW) < 0) {
+    const row = rowFromFragment(`- id: ${TERMINAL_BUNDLE_PWSH_ROW}\n  disabled: ${plan.pwsh.disabled}\n`)
+    if (row === undefined) {
+      return done(plan.action, 'write-failed', plan.reason, { detail: 'the new pwsh row fragment did not parse; nothing was written' })
+    }
+    document.add(row)
+    pwshRowWritten = true
+  }
+
+  // Self-check before touching disk: the serialized document must re-parse clean.
+  const serialized = String(document)
+  const check = parse(serialized)
+  if (Array.isArray(check?.errors) && check.errors.length > 0) {
+    return done(plan.action, 'write-failed', plan.reason, { detail: 'the edited patch did not re-parse cleanly; nothing was written' })
+  }
+  if (findRow(yamlModule, check, TERMINAL_BUNDLE_BASH_ROW) < 0) {
+    return done(plan.action, 'write-failed', plan.reason, { detail: 'the edited patch lost the bash row during serialization; nothing was written' })
+  }
+
+  try {
+    await io.writeFileAtomic(patchPath, serialized)
+  } catch (error) {
+    return done(plan.action, 'write-failed', plan.reason, { detail: `the atomic write failed (${error?.message ?? error}); the previous patch bytes stand` })
+  }
+
+  // Verify by re-reading what actually landed on disk.
+  try {
+    const reread = parse(await io.readFile(patchPath))
+    const rows = currentBundleRows(yamlModule, reread)
+    const bash = rows.bash
+    const pathOk = bash !== undefined
+      && bash.disabled === false
+      && typeof bash.shellPath === 'string'
+      && normalizeBashPath(bash.shellPath) === normalizeBashPath(bashNode.shellPath)
+    const pwshOk = !pwshRowWritten || readPatchRow(rows.pwsh)?.disabled === true
+    if (!pathOk || !pwshOk) {
+      await io.writeFileAtomic(patchPath, before)
+      return done(plan.action, 'write-failed', plan.reason, { detail: 'the written patch did not read back as intended; rolled back to the previous bytes' })
+    }
+  } catch (error) {
+    try { await io.writeFileAtomic(patchPath, before) } catch { /* report the primary failure */ }
+    return done(plan.action, 'write-failed', plan.reason, { detail: `the verification read failed (${error?.message ?? error}); rolled back to the previous bytes` })
+  }
+
+  return done(plan.action, plan.action === 'adopt' ? 'adopted' : 'updated', plan.reason, { shellPath: bashNode.shellPath, pwshRowWritten })
+}
+
+/**
+ * One line per outcome, terminal-shell style.
+ * @param {{action: string, status: string, reason?: string, detail?: string, shellPath?: string}} result
+ * @returns {string}
+ */
+export function terminalBundleReport(result) {
+  if (!result || typeof result !== 'object') return 'persistent terminal adoption returned nothing'
+  if (typeof result.detail === 'string' && result.detail !== '') return `persistent terminal: ${result.status} — ${result.detail}`
+  if (typeof result.reason === 'string' && result.reason !== '') return `persistent terminal: ${result.reason}`
+  return `persistent terminal: ${result.status}`
+}

package/src/tool-runner.js

@@ -290,9 +290,16 @@ export function isSameOriginValue(value, host) {
 /**
  * The fence for the tools route. Installing is a side effect, so:
  *   - the peer must be loopback (a LAN or tunnel client never gets to install);
- *   - a mutating request must carry an Origin or Referer that matches Host.
+ *   - a mutating request that CARRIES an Origin or Referer must match Host.
  * A same-origin GET from the settings page passes; a form/fetch posted by any
  * other page fails on the origin check.
+ * A mutating request with NO origin header passes the origin half (issue #33):
+ * the desktop Electron renderer's same-origin fetch sends no Origin/Referer,
+ * and browsers attach Origin to every mutating request — same-site and
+ * cross-site alike — so a missing header cannot be web-page CSRF; it can only
+ * come from a non-browser client, which could forge a same-origin header just
+ * as easily. The loopback requirement stays (the real fence) and a carried
+ * cross-origin value is still refused.
  * @param {{ method?: string, headers?: object, socket?: object }} req
  * @returns {{ ok: boolean, reason: string }}
  */
@@ -304,7 +311,7 @@ export function fenceToolRequest(req) {
   const headers = (req && req.headers) || {}
   const host = headers.host || ''
   const origin = headers.origin || headers.referer || ''
-  if (origin === '') return { ok: false, reason: 'no-origin' }
+  if (origin === '') return { ok: true, reason: '' }
   if (!isSameOriginValue(origin, host)) return { ok: false, reason: 'cross-origin' }
   return { ok: true, reason: '' }
 }