dsh-plugin-wsl-env 0.1.8 → 0.1.10

package/CHANGELOG.md

@@ -12,6 +12,38 @@ reference below points at that record's numbering.
 
 ## [Unreleased]
 
+## [0.1.10] - 2026-10-02
+
+Metadata and one documentation addition. No behaviour change.
+
+### Changed
+
+- The package description now covers all four capabilities — commands, the file tools,
+  the folder picker, the GUI terminal — and the confinement, instead of naming only two
+  of them. It is the line npm shows under the package name in search results.
+
+### Documentation
+
+- The error table in `docs/ARCHITECTURE.md` states exactly what the model sees on a
+  filesystem denial: the denial marker and the escalation hint, line for line. It also
+  records why that makes `FS_OUTSIDE_DISTRO` worth its own code — a code the tool layer
+  does not decorate with those lines.
+
+
+## [0.1.9] - 2026-10-02
+
+The last test gap from the closure review: the documented opt-out. No runtime change.
+
+### Added
+
+- `npm run probe:sandbox-off` turns the sandbox off on **both** providers and asserts
+  what the documentation promises: `sandboxMode` disappears on each of them, a command
+  outside any workspace root runs, the shell result claims no sandbox, and a filesystem
+  write outside the workspace root is not fenced (`operation=create`). Without it the
+  opt-out and a backend that is merely broken would look alike from the outside — which
+  is what `probe:missing-wsl` covers. 5 checks.
+
+
 ## [0.1.8] - 2026-10-02
 
 A probe assertion for the one item the closure review had to record as unverifiable.

package/CONTRIBUTING.md

@@ -71,7 +71,8 @@ terminal if you would rather not see the prompt.
 | `npm run probe:terminal` | the terminal provider | yes |
 | `npm run probe:missing-wsl` | how a `wslPath` that cannot start is reported | yes |
 | `npm run probe:picker` | the picker's root level, its refusals and its cap | yes |
-| `npm run probe:mode` | which POSIX-mode facts survive the share | no; Windows Node | 
+| `npm run probe:mode` | which POSIX-mode facts survive the share | no; Windows Node |
+| `npm run probe:sandbox-off` | the documented opt-out on both providers | yes |
 
 Every script above is wired in `package.json`. `npm test` runs `lint:style`,
 `test:syntax` and `test:unit` in that order. `prepublishOnly` runs `npm test` again
@@ -150,8 +151,8 @@ On Windows 11 + WSL2 (Ubuntu 26.04) the following has been verified:
 Counts: 57 unit assertions on a bare checkout, plus 5 in `test/sandbox.test.mjs` which
 need the `dsh-sandbox` peer and skip themselves without it; 19 filesystem-probe
 assertions; 15 shell-probe checks; 9 picker checks; 6 missing-executable checks; 5 mode
-checks and 10 sandbox expectations plus the recorded escape; and 3 terminal
-assertions.
+checks; 5 opt-out checks and 10 sandbox expectations plus the recorded escape; and 3
+terminal assertions.
 
 ## Commit and pull request conventions
 

package/README.md

@@ -104,6 +104,7 @@ npm run probe:terminal       # open a PTY through the terminal provider
 npm run probe:missing-wsl    # boot a profile whose wslPath cannot start (Windows + WSL only)
 npm run probe:picker         # list the picker's root level, refusals and its cap (Windows + WSL only)
 npm run probe:mode           # which POSIX-mode facts survive the share (Windows node only)
+npm run probe:sandbox-off    # prove sandbox: false unconfines both providers (Windows + WSL only)
 ```
 
 There is nothing to install first: the package has no dependencies, and every module under test imports only Node builtins. CI runs `npm test` on Node 20, 22 and 24, on Linux and Windows, and `npm run test:coverage` on Node 24.

package/docs/ARCHITECTURE.md

@@ -189,6 +189,14 @@ to be invisible:
 | the distro is missing, stopped or unregistered | a `Wsl/Service/WSL_E_*` code on **stdout**, UTF-16 on some builds, with an empty stderr and exit 255 | `WslShellExecutor` reads the code with the NULs stripped and fails with the distro name and the remedy. Deliberately not a sandbox code: a wider permission cannot create a distro |
 | the working directory cannot be entered | a relay line on stderr, exit **0**, and the command runs in `/` | `WslShellExecutor` fails with the directory and the fallback, instead of reporting a success that acted on the wrong tree |
 
+
+What the model actually sees on a filesystem denial is two lines the tool layer
+prepends: `[sandbox: file access denied under <mode> mode]`, then
+`[sandbox: escalation available — retry this exact operation once with
+sandbox_permissions (the narrowest wider mode that suffices) + justification; the
+approval prompt asks the user]`. A code that is not `FS_SANDBOX_DENIED` gets neither
+line — which is the reason `FS_OUTSIDE_DISTRO` has its own code.
+
 ## The runtime mirror
 
 The checkout lives inside the distro. A DSH profile can only link a Windows path,
@@ -208,7 +216,7 @@ step with the checkout, and `npm run sync:windows` runs that script.
 | Syntax pass | [`test/syntax.mjs`](../test/syntax.mjs) | no |
 | Unit tests | `test/*.test.mjs` | no |
 | Sandbox probe | [`test/probe/sandbox.sh`](../test/probe/sandbox.sh) | no; it applies the profile arguments directly |
-| Harness probes | [`test/probe/run.sh`](../test/probe/run.sh), `terminal.sh`, `sandbox-shell.sh`, `picker.sh`, `missing-wsl.sh` | yes: Windows, WSL2, a mounted profile, and a linked checkout |
+| Harness probes | [`test/probe/run.sh`](../test/probe/run.sh), `terminal.sh`, `sandbox-shell.sh`, `picker.sh`, `missing-wsl.sh`, `sandbox-off.sh` | yes: Windows, WSL2, a mounted profile, and a linked checkout |
 | Host probes | [`test/probe/mode.sh`](../test/probe/mode.sh) | Windows Node, no harness |
 | Probe plugins | the `*-probe.mjs` and `*-probe.yml` files in `test/probe/` | loaded by the scripts above |
 

package/docs/README.zh.md

@@ -104,6 +104,7 @@ npm run probe:terminal       # 通过终端 provider 打开一个 PTY
 npm run probe:missing-wsl    # 启动一个 wslPath 无法启动的 profile（仅 Windows + WSL）
 npm run probe:picker         # 列出选择器的根级、拒绝路径与上限（仅 Windows + WSL）
 npm run probe:mode           # 哪些 POSIX 权限事实能穿过共享层（仅需 Windows node）
+npm run probe:sandbox-off    # 验证 sandbox: false 确实解除两侧约束（仅 Windows + WSL）
 ```
 
 这个包没有依赖，被测模块只 import Node 内置模块，所以不需要先安装任何东西。CI 在 Linux 和 Windows 上用 Node 20、22、24 运行 `npm test`，并在 Node 24 上运行 `npm run test:coverage`。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-wsl-env",
-  "version": "0.1.8",
-  "description": "Run a DeepSeek Harness session against a WSL distro: a ctx.shell executor that runs commands inside the distro and a ctx.fs backend over its UNC share",
+  "version": "0.1.10",
+  "description": "Run a DeepSeek Harness session against a WSL distro: commands and the model's file tools run inside it, the folder picker and the GUI terminal open there, and commands are confined by bubblewrap inside the distro",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -55,6 +55,7 @@
     "probe:missing-wsl": "bash test/probe/missing-wsl.sh",
     "probe:mode": "bash test/probe/mode.sh",
     "probe:picker": "bash test/probe/picker.sh",
+    "probe:sandbox-off": "bash test/probe/sandbox-off.sh",
     "probe:terminal": "bash test/probe/terminal.sh",
     "probe:sandbox": "bash test/probe/sandbox.sh",
     "probe:sandbox-shell": "bash test/probe/sandbox-shell.sh",