dsh-plugin-wsl-env 0.1.0

package/cordis.patch.yml

@@ -0,0 +1,306 @@
+# The bundle layer this package contributes:
+#
+#     "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
+#
+# `dsh plugin --profile <name> add dsh-plugin-wsl-env` installs the package and
+# appends this file as one layer — there is nothing to merge by hand. It is
+# still an ordinary patch layer: a top-level YAML array of loader patch entries
+# (id-targeted config overrides, disables, and insert lists; `!!js` expressions
+# allowed).
+#
+# Layers compose in the order bundles, the profile's own `cordis.patch.yml`,
+# the home-level `cordis.patch.yml`, then `--patch` overlays, and later layers
+# win per row. A row's `config` is replaced whole, never deep-merged, so a user
+# who wants a different value overrides that row by id in their own layer —
+# examples/profile.cordis.patch.yml shows what such a layer looks like.
+#
+# ═════════════════════════════════════════════════════════════════════════════
+# The GUI terminal window is a COMPOSITION-level environment, not a preset one.
+#
+# The right-sidebar terminal is dsh-api-terminal-controller. It resolves its
+# execution world from the Session's own context —
+#     agent.ctx.get("subprocess")
+# — and that context is created by the agent loop under the ROOT realm
+# (dsh-agent-loop: `createScope(loopCtx, …)`, loopCtx = the root `ctx.agents`),
+# while a preset's isolate realms are created by dsh-agent-preset-registry under
+# the REGISTRY's context (`createScope(this.owner, …)`). The two subtrees never
+# meet, so a `subprocess` provider mounted inside preset-wsl — the natural-looking
+# design, since `shell` and `fs` live there — is invisible to the terminal
+# window. The registry ships `agentPresets.serviceFor(agent, name)` for exactly
+# that gap; the terminal controller does not use it.
+#
+# So the terminal is bound here, once, for the whole composition:
+#
+#   1. the shipped local provider is disabled and replaced by a subclass whose
+#      ONLY override is `spawnTerminal`, which rewrites a `wsl.exe` launch into
+#      `wsl.exe -d <distro> --cd <linux dir>` for the directory the Session
+#      supplies. Ordinary `spawn()` — every command, the host ripgrep search,
+#      every other consumer — reaches the shipped implementation untouched;
+#   2. the controller is given the one shell profile it should resolve, so the
+#      window's default is a distro shell rather than `cmd.exe` inside a UNC
+#      workspace. Its shell menu is reduced to that single entry on purpose:
+#      shell discovery also runs against the root provider and receives no
+#      directory, so offering host executables there would advertise shells this
+#      terminal never starts.
+#
+# Consequence: the terminal follows the composition, not the Session. A Session
+# whose workspace is a Windows folder gets the same distro terminal, started in
+# that folder as `/mnt/<drive>/…`. That is the honest limit of a per-session
+# execution world that no Session identity reaches.
+# ═════════════════════════════════════════════════════════════════════════════
+- id: subprocess
+  disabled: true
+
+- id: terminal-controller
+  name: '@deepseek-ai/dsh-api-terminal-controller'
+  config:
+    shell:
+      path: wsl.exe
+      name: WSL
+      args: []
+    shellCandidates: []
+
+- insert:
+    - id: subprocess-wsl
+      name: 'dsh-plugin-wsl-env/subprocess'
+      config:
+        distro: ''
+
+# ═════════════════════════════════════════════════════════════════════════════
+# Environment is per-session, not per-process.
+#
+# There is no DSH_WSL switch any more. The profile keeps the SHIPPED environment
+# for host workspaces — sandboxed PowerShell executor, ACL-confined filesystem,
+# and therefore the Permissions selector — while the wsl agent preset (appended
+# below) supplies the WSL environment to agents that select it, isolated to that
+# preset's own service realm. Both can run at the same time in one process.
+#
+# dsh-plugin-wsl-env/auto-preset binds the WSL preset automatically when a new
+# session's workspace directory is inside a distro, and leaves an explicit
+# operator choice alone.
+# ═════════════════════════════════════════════════════════════════════════════
+
+# ── The workspace picker serves BOTH worlds ──────────────────────────────────
+#
+# Kept from the previous design: the shipped chooser resolves to the native OS
+# dialog on Windows, which cannot browse a distro. This one lists the Windows home
+# directory and every installed distro in its root level, so it is the single
+# picker for host and WSL workspaces alike — and the directory it returns is what
+# auto-preset reads to choose the environment.
+- id: directory-picker
+  disabled: true
+
+- insert:
+    - id: directory-picker-wsl
+      name: 'dsh-plugin-wsl-env/picker'
+      config:
+        preferredDistro: ''
+        includeHostHome: true
+        maxEntries: 1000
+
+    - id: directory-picker-browse-surface
+      name: '@deepseek-ai/dsh-client-ui-directory-picker-browse'
+    # Contributes the WSL environment's facts (distro / real shell / home) to the
+    # managed DSH_* namespace that dsh-shell-env injects into every model shell
+    # call. That is DSH's sanctioned channel for shell-environment facts.
+    - id: wsl-shell-env
+      name: 'dsh-plugin-wsl-env/shell-env'
+
+    # Per-session environment selection from the workspace directory. It only
+    # rewrites a preset that still equals the registry default, so an operator's
+    # explicit choice is never overridden.
+    - id: auto-preset
+      name: 'dsh-plugin-wsl-env/auto-preset'
+
+- insert:
+    # ═════════════════════════════════════════════════════════════════════════════
+    # preset-wsl — the WSL environment, scoped to agents that select this preset.
+    #
+    # This is what makes environments per-session instead of per-process: the shell
+    # and fs services are isolated to this preset's realm, so an agent on the host
+    # preset keeps the profile's global sandboxed PowerShell executor and ACL-confined
+    # filesystem while an agent on this preset gets the distro's login shell and its
+    # UNC-backed filesystem — concurrently, in one process.
+    #
+    # The wrapping group is required by dsh-agent-preset-registry, which audits every
+    # preset mount and rejects a provider that is not behind an isolate realm:
+    #     "Preset services require isolate realms: shell, fs"
+    # Because a preset's plugins mount under a REGISTRY-owned scope (not this row's
+    # ctx), the realm has to be declared here, inside config.plugins.
+    #
+    # Generated from the shipped standard preset by build-preset-wsl.mjs so the
+    # embedded plan-mode section and every nested group survive byte-for-byte.
+    # Re-run it after an app update that changes the preset.
+    # ═════════════════════════════════════════════════════════════════════════════
+    - id: preset-wsl
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: wsl
+        order: 2
+        plugins:
+          - id: wsl-env
+            name: cordis:group
+            group: true
+            isolate:
+              shell: true
+              fs: true
+            config:
+              # ── the WSL environment for this preset only ────────────────────
+              # No `cwd`: an empty default workdir means the distro user's home,
+              # asked of the distro itself. Pin a directory here to override it —
+              # a value that is right on one machine is wrong on every other.
+              #
+              # Each command is confined inside the distro by bubblewrap, in the
+              # policy's mode, and the file tools are fenced by the same policy.
+              # Install bubblewrap there (`sudo apt install bubblewrap`); without
+              # it the providers fail closed rather than run unconfined. Add
+              # `sandbox: false` to either provider for the old, unconfined
+              # posture.
+              - id: wsl-shell
+                name: 'dsh-plugin-wsl-env'
+                config:
+                  distro: ''
+                  loginShell: true
+                  timeoutMs: 120000
+                  maxTimeoutMs: 600000
+              - id: wsl-fs
+                name: 'dsh-plugin-wsl-env/fs'
+                config:
+                  distro: ''
+                  restrictToDistro: true
+              - id: persona
+                name: '@deepseek-ai/dsh-persona'
+                config:
+                  suffix: Your working directory is {{cwd}}.
+                  prefix: You are a coding agent powered by the {{model}} model.
+              - id: agent-instructions
+                name: '@deepseek-ai/dsh-agent-instructions'
+                config:
+                  maxBytes: 65536
+              - id: tool-bash
+                name: '@deepseek-ai/dsh-tool-bash'
+                disabled: false
+              - id: tool-pwsh
+                name: '@deepseek-ai/dsh-tool-pwsh'
+                disabled: true
+              - id: tool-fs
+                name: '@deepseek-ai/dsh-tool-fs'
+              - id: tool-fs-search
+                name: '@deepseek-ai/dsh-tool-fs-search'
+                config:
+                  sampleOverCapGlobResults: false
+              - id: tool-jobs
+                name: '@deepseek-ai/dsh-tool-jobs'
+              - id: skill-filesystem
+                name: '@deepseek-ai/dsh-skill-filesystem'
+              - id: tool-skill
+                name: '@deepseek-ai/dsh-tool-skill'
+              - id: command-goal
+                name: '@deepseek-ai/dsh-command-goal'
+              - id: tool-goal
+                name: '@deepseek-ai/dsh-tool-goal'
+              - id: planning
+                name: cordis:group
+                group: true
+                isolate:
+                  planMode: true
+                config:
+                  - id: plan-mode
+                    name: '@deepseek-ai/dsh-plan-mode'
+                    config:
+                      section: |
+                        You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                        Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+                        The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+                        Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+                        Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+                        When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+              - id: compaction
+                name: cordis:group
+                group: true
+                isolate:
+                  compaction: true
+                  toolResultPruner: true
+                config:
+                  - id: compaction-basic
+                    name: '@deepseek-ai/dsh-compaction-basic'
+                  - id: command-compact
+                    name: '@deepseek-ai/dsh-command-compact'
+                  - id: tool-result-pruner
+                    name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                    config:
+                      thresholdChars: 8192
+                      headChars: 4096
+                      tailChars: 1024
+              - id: delegation
+                name: cordis:group
+                group: true
+                isolate:
+                  workflowEngine: true
+                config:
+                  - id: tool-subagent-control
+                    name: '@deepseek-ai/dsh-tool-subagent-control'
+                  - id: tool-subagent-list-agents
+                    name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+                  - id: tool-subagent
+                    name: '@deepseek-ai/dsh-tool-subagent'
+                    config:
+                      provider: spawn
+                      toolName: subagent
+                      modelSelectionSettings: true
+                      backgroundMode: continuable
+                  - id: tool-subagent-fork
+                    name: '@deepseek-ai/dsh-tool-subagent'
+                    config:
+                      provider: fork
+                      toolName: subagent_fork
+                      backgroundMode: continuable
+                  - id: tool-subagent-codex
+                    name: '@deepseek-ai/dsh-tool-subagent'
+                    disabled: true
+                    config:
+                      provider: codex
+                      toolName: subagent_codex
+                      backgroundMode: one-shot
+                      maxDepth: provider-managed
+                  - id: tool-subagent-claude-code
+                    name: '@deepseek-ai/dsh-tool-subagent'
+                    disabled: true
+                    config:
+                      provider: claude-code
+                      toolName: subagent_claude_code
+                      backgroundMode: one-shot
+                      maxDepth: provider-managed
+                  - id: workflow-ptc
+                    name: '@deepseek-ai/dsh-workflow-ptc'
+                    config:
+                      provider: spawn
+                  - id: tool-workflow
+                    name: '@deepseek-ai/dsh-tool-workflow'
+                  - id: tool-ralph
+                    name: '@deepseek-ai/dsh-tool-ralph'
+                    disabled: true
+                    config:
+                      subagentProvider: spawn
+                      maxRounds: 64
+              - id: tool-ask-user
+                name: '@deepseek-ai/dsh-tool-ask-user'
+              - id: tool-todo
+                name: '@deepseek-ai/dsh-tool-todo'
+                config:
+                  allowParallelInProgress: true
+              - id: tool-web
+                name: '@deepseek-ai/dsh-tool-web'
+                config:
+                  fetch: true
+                  searchTimeoutMs: 60000
+              - id: present
+                name: '@deepseek-ai/dsh-tool-present'
+              - id: tool-plugin-manager
+                name: '@deepseek-ai/dsh-plugin-manager/tools'
+                disabled: true

package/examples/profile.cordis.patch.yml

@@ -0,0 +1,36 @@
+# A PROFILE patch layer — `$DSH_HOME/profiles/<name>/cordis.patch.yml` — not part
+# of this plugin's bundle. It is applied after every bundle layer, so it is where
+# a machine's own preferences and row overrides belong.
+#
+# This copy is the author's own machine: account/model defaults and the UI
+# verbosity that suits it. Copy the rows you want, not the file, and expect the
+# values to differ on your machine. The plugin's rows are NOT repeated here —
+# they arrive with the bundle (see the package's cordis.patch.yml).
+- id: agent-default-model
+  name: "@deepseek-ai/dsh-agent-default-model"
+  config:
+    provider: deepseek-account
+    model: deepseek-flash
+    reasoningEffort: high
+
+- id: ui-settings-account
+  name: "@deepseek-ai/dsh-client-ui-settings-account"
+  config:
+    version: 1
+    step: done
+    purpose: development
+    process: detailed
+    completion: completed
+    usage: detailed
+    developerTools: true
+
+- id: ui-chat
+  name: "@deepseek-ai/dsh-client-ui-chat"
+  config:
+    transcriptView: detailed
+    performanceUsage: detailed
+
+- id: ui-settings
+  name: "@deepseek-ai/dsh-client-ui-settings"
+  config:
+    enabled: true

package/lib/auto-preset.js

@@ -0,0 +1,198 @@
+/**
+ * Auto-preset: bind an agent to the WSL preset when its workspace directory
+ * lives inside a distro.
+ *
+ * Why an event hook and not configuration: the environment is chosen in
+ * `dsh-api-session-controller`'s `composeAgent(presetId)`, whose signature has no
+ * working directory — the cwd only exists one frame up in
+ * `ensureSession(sessionId, cwd, ...)`. So the path-aware decision has to be made
+ * where the path IS available. `agent/created` carries it:
+ *
+ *     ctx.serial(carrier, "agent/created", { agent, source, signal })
+ *
+ * and `agent.session.header.cwd` is the session's workspace directory.
+ *
+ * Two details are load-bearing, both established by experiment:
+ *
+ *  1. **Respect an explicit choice.** By the time the event fires, the resolved
+ *     preset is already mounted (`composeAgent` mounts request-or-default in
+ *     `setup`). We cannot tell which of the two it was — so we only ever rewrite
+ *     when the mounted preset equals the registry default, which means the client
+ *     omitted it. An operator's pick is never overridden.
+ *
+ *  2. **Switch after creation, not during.** Switching inside the listener
+ *     collides with the previous generation's tools:
+ *         Error: tool "subagent" is already registered in this scope
+ *     Deferring past the creating call fixes it — the session is still blank
+ *     (no turn has started), so `select()` remains legal. A short retry loop
+ *     absorbs the remaining ordering slack instead of relying on one timer.
+ *
+ * @module dsh-plugin-wsl/auto-preset
+ */
+
+import { appendFileSync } from "node:fs";
+import z from "@deepseek-ai/schemastery";
+import { isWslUnc } from "./paths.js";
+
+/**
+ * Set `DSH_WSL_TRACE` to a file path to record every decision this plugin makes.
+ *
+ * `ctx.logger` is not an injected service here, so a failure inside it would
+ * swallow the message — and a silently-swallowed decision is exactly how a real
+ * bug in this plugin stayed invisible once already.
+ */
+const TRACE = process.env.DSH_WSL_TRACE;
+function trace(message) {
+  if (TRACE === void 0 || TRACE === "") return;
+  try {
+    appendFileSync(TRACE, `${new Date().toISOString()} ${message}\n`);
+  } catch {
+    /* a trace is never worth failing a session over */
+  }
+}
+
+export const name = "auto-preset";
+
+export const inject = ["agents", "agentPresets"];
+
+export const Config = z.object({
+  /** Preset to bind for a WSL workspace. */
+  preset: z.string().default("wsl"),
+  /** Attempts before giving up; each waits `retryMs`. */
+  attempts: z.natural().min(1).default(6),
+  /** Gap between attempts, in milliseconds. */
+  retryMs: z.natural().default(150),
+});
+
+export async function apply(ctx, config = {}) {
+  const target = config.preset ?? "wsl";
+  const attempts = config.attempts ?? 6;
+  const retryMs = config.retryMs ?? 150;
+  const warn = (message) => {
+    trace(`WARN ${message}`);
+    // `logger` is not injectable here, so an unavailable or throwing logger must
+    // not turn this into a silent no-op: fall back to stderr.
+    let logged = false;
+    try {
+      ctx.logger?.warn?.(`auto-preset: ${message}`);
+      logged = ctx.logger !== void 0;
+    } catch {
+      logged = false;
+    }
+    if (!logged) {
+      try {
+        process.stderr.write(`auto-preset: ${message}\n`);
+      } catch {
+        /* logging is never worth failing a session over */
+      }
+    }
+  };
+
+  const consider = (agent) => {
+    if (agent === void 0) return;
+
+    let cwd;
+    let current;
+    try {
+      cwd = agent.session?.header?.cwd;
+      current = ctx.agentPresets.composedPreset(agent.ctx);
+    } catch (error) {
+      warn(`cannot inspect the new agent: ${error?.message ?? error}`);
+      return;
+    }
+    trace(`consider agent=${agent.id} cwd=${JSON.stringify(cwd)} current=${String(current)}`);
+
+    // Only a workspace inside a distro, and only when the preset is still the
+    // registry default (i.e. the operator did not ask for one). `undefined` means
+    // the creating caller mounted nothing at all — the headless runner does this
+    // — which is likewise "no explicit choice".
+    if (!isWslUnc(cwd)) return;
+    let fallback;
+    try {
+      fallback = ctx.agentPresets.defaultId;
+    } catch {
+      fallback = void 0;
+    }
+    if (current !== fallback && current !== void 0) return;
+    trace(`  -> acting: fallback=${String(fallback)} isWsl=${isWslUnc(cwd)}`);
+
+    // Deferred on purpose — see the module comment.
+    void (async () => {
+      for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        try {
+          const chosen = await ctx.agentPresets.select(agent, target);
+          ctx.logger?.debug?.(`auto-preset: "${cwd}" -> preset "${chosen}"`);
+          return;
+        } catch (error) {
+          const code = error?.code;
+          // The session already started a turn: its preset is fixed, and that is
+          // a legitimate outcome (the operator drove it before we got here).
+          if (code === "agent-preset/locked") {
+            warn(`"${cwd}" already began its first turn; leaving the preset as "${String(current)}"`);
+            return;
+          }
+          if (code === "agent-preset/not-found") {
+            warn(`preset "${target}" is not composed in this profile; skipping "${cwd}"`);
+            return;
+          }
+          if (attempt === attempts) {
+            warn(`could not bind preset "${target}" for "${cwd}": ${code ?? error?.name}: ${error?.message}`);
+            return;
+          }
+          await new Promise((resolve) => setTimeout(resolve, retryMs));
+        }
+      }
+    })();
+  };
+
+  ctx.on("agent/created", (payload) => consider(payload?.agent));
+
+  // ── Make the INITIAL preset correct, instead of correcting it afterwards ────
+  //
+  // A WSL workspace mounted on the HOST preset puts the Windows ACL sandbox in
+  // front of a `\\wsl.localhost` path, which cannot carry security descriptors:
+  // the shell tool then dies in sandbox preparation (`GetNamedSecurityInfoW
+  // failed (Win32 1)`) and the workspace is unusable — not merely mis-labelled.
+  // Correcting the preset after creation loses whenever the first turn does not
+  // wait, so the choice is made where the cwd still exists: the controller
+  // resolves the preset in `composeAgent(presetId)`, which has no cwd, but it
+  // calls `agents.ensureSession(sessionId, cwd, …, presetId)` — and that frame
+  // holds both. Filling the preset there makes the very first mount already
+  // correct, so the host sandbox never meets the distro path at all.
+  ctx.inject(["sessionController"], (controllerCtx) => {
+    const facade = controllerCtx.sessionController?.agents;
+    if (facade === void 0 || typeof facade.ensureSession !== "function") {
+      warn("sessionController exposes no agents.ensureSession(); the creation-time preset fix is inactive");
+      return;
+    }
+    const original = facade.ensureSession;
+    facade.ensureSession = async function (sessionId, cwd, checkPersistedIdentity, presetId) {
+      // An explicit choice always wins, and only a distro workspace is affected.
+      if (presetId !== void 0 || !isWslUnc(cwd)) {
+        return original.call(this, sessionId, cwd, checkPersistedIdentity, presetId);
+      }
+      try {
+        return await original.call(this, sessionId, cwd, checkPersistedIdentity, target);
+      } catch (error) {
+        // A session already stored under another preset rejects a different one.
+        // Fall back rather than turn adoption into a new failure mode.
+        if (!String(error?.message ?? "").includes("agent preset")) throw error;
+        trace(`creation-time preset "${target}" refused for ${sessionId}; falling back to the recorded one`);
+        return original.call(this, sessionId, cwd, checkPersistedIdentity, presetId);
+      }
+    };
+    trace("creation-time preset fix installed");
+    controllerCtx.effect(() => () => {
+      facade.ensureSession = original;
+    });
+  });
+  // Mount order is not a guarantee: a runner that creates its session during
+  // startup can finish before this plugin mounts and miss the event entirely
+  // (dsh-headless does exactly that). Sweep the agents already live so the
+  // decision never depends on who mounted first.
+  try {
+    for (const agent of ctx.agents.list()) consider(agent);
+  } catch (error) {
+    warn(`could not sweep already-live agents: ${error?.message ?? error}`);
+  }
+}

package/lib/fs.js

@@ -0,0 +1,5 @@
+/**
+ * `ctx.fs` entrypoint — load as `dsh-plugin-wsl/fs` in a profile patch.
+ * @module dsh-plugin-wsl/fs
+ */
+export { WslFileSystem as default, WslFileSystem } from "./index.js";