dsh-plugin-wsl-env 0.13.1 → 0.14.0

package/CHANGELOG.md

@@ -16,6 +16,135 @@ were part of the record.
 
 ## [Unreleased]
 
+## [0.14.0] - 2026-10-27
+
+This release fixes the first-run trap the compatibility-matrix run found on a
+freshly imported distro, and ships the measured support table the run produced.
+
+### Fixed
+
+- **WSL-305: the confined resident now creates the workspace root before its
+  first spawn.** The bwrap profile binds the workspace root and bwrap refuses
+  a missing bind source, so on a freshly imported distro the first confined
+  write failed with a bare `FS_IO_ERROR: agent exited during handshake
+  (code=1)` and a misleading remedy. `agent-confined.js` gained a `prepare`
+  hook (workspace-write only — the only mode that binds the root) that runs
+  `mkdir -p` on the Linux-spelled root before bwrap runs, idempotently and
+  ignoring its own outcome: bwrap stays the authority, and a refusal still
+  reaches the caller. That refusal now carries evidence: the handshake
+  failure's message includes a bounded tail of the resident's stderr (the
+  half-day of diagnosis this cost came from it being swallowed). Three new
+  checks cover the prepare hook, its argv, and the stderr ride-on; a
+  fresh-root leg in `substrate.sh` exercises the absent-root spawn end to
+  end on a real distro.
+
+### Changed
+
+- **Debian is verified end to end, and the run found a first-run trap.**
+  The four harness-level probes pass against a `wslfs-debian` profile on a
+  freshly imported Debian 13.5, completing the full stack on top of the
+  distro-internal suite (`docs/COMPATIBILITY.md`). Getting there surfaced one
+  real finding: the confined resident refuses to start when the workspace
+  root does not exist yet — the bwrap profile binds the root, bwrap requires
+  the bind source to exist, and a fresh distro has nothing to bind. Creating
+  the root first turns all ten failing steps green; prior Ubuntu runs had it
+  left over from earlier probes. The finding is documented in the matrix page
+  with the suggested spawn-preparation fix.
+
+- **The compatibility matrix moves from prose to a measured page.**
+  `docs/COMPATIBILITY.md` records the WSL-202 evidence: six real WSL2 distros
+  (Ubuntu, Debian 13.5, Fedora 44, openSUSE Tumbleweed, Arch, Alpine 3.22)
+  executed the distro-internal probe suite on one machine on 2026-10-26, and
+  the page explains the two observed differences instead of hiding them — the
+  `session-sandbox` background-survival leg races WSL session teardown on
+  three systemd distros (probe artifact, not a plugin claim), and on Alpine
+  the same leg fails by declaration, because non-systemd distros get the
+  narrower `sessionSandbox: auto` scope exactly as P1.1/WSL-201 promises. The
+  page also records the per-distro import traps (Debian OOBE wedge, Alpine
+  minirootfs defaulting to root, busybox mktemp, zypper's interactive prompt)
+  and the reproduction commands. Not yet measured: real aarch64 hardware, the
+  container-image matrix.
+
+- **The aarch64 native agent is executed in CI, not only built.** The
+  `native packages` job installs qemu's user-mode emulator and binfmt
+  registration (`qemu-user` + `qemu-user-binfmt`; noble has no real
+  `qemu-user-static` package) and runs the full
+  18-check spike suite under qemu-user against both the freshly built aarch64
+  musl binary and the committed `agent/native/linux-aarch64/dsh-wsl-agent` —
+  the binary a Windows-on-ARM session would load. User-mode emulation
+  exercises every check (the static musl binary and the v5 frames are
+  host-OS-free), verified locally first: 18/18 under `qemu-aarch64`, with
+  `/proc/self/exe` resolving to the target so the HELLO digest binding holds
+  unchanged. This closes the "build-tested only" gap on WSL-202; a run on
+  real aarch64 hardware remains open.
+
+## [0.13.2] - 2026-10-26
+
+This release tracks DeepSeek Harness `0.2.1-rc.3`: the peer declarations become
+floor ranges so a newer harness installs the plugin unchanged, and the
+lockfile's transitive `undici` moves past a security advisory that Dependabot
+could not clear on its own.
+
+### Fixed
+
+- **`undici` in the lockfile moves to the security-fixed `8.12.3` via a pnpm
+  override.** `undici` rides in only as an exact transitive pin of
+  `@deepseek-ai/dsh-http-proxy` — a package upstream controls — so Dependabot's
+  security job could resolve no patched version (it reports "the latest
+  possible version … is 8.11.2" and fails). `pnpm-workspace.yaml` now carries
+  `overrides: { undici: '>=8.12.3' }` (the pnpm 11 settings home; the
+  `package.json` `pnpm` field is no longer read), the lockfile swaps the one
+  package, and the override comment records that it is retired when upstream
+  moves the pin. Nothing under `src/` reads `undici`; the check chain is
+  unaffected.
+
+### Changed
+
+- **The peer declarations become floor ranges, so a newer harness installs
+  the plugin unchanged.** The `@deepseek-ai/dsh-*` entries in
+  `peerDependencies` move from the exact pin to `>=0.2.1-rc.3`, and
+  `@deepseek-ai/cordis` / `@deepseek-ai/schemastery` widen from `~` to `^`
+  (`^4.0.5`, `^3.18.5`). An app that ships a newer harness release now
+  satisfies the peers without waiting for a plugin release — same-line rc
+  bumps and every stable release install cleanly; only a brand-new
+  prerelease line (`0.2.2-rc.1` against `>=0.2.1-rc.3`) still warns, because
+  semver admits a prerelease only against a comparator on its own tuple and
+  no range can promise an unpublished line. That residue is what the weekly
+  peer-canary is for: it still resolves the `next` dist-tag into a scratch
+  tree and flags when the line moves past a floor — the signal to re-run the
+  `docs/PEER-PARITY.md` comparison and raise the floor in the commit that
+  matches the harness release. The devDependencies keep their exact pins, so
+  the gates stay reproducible and the parity audit keeps naming one line.
+  `scripts/doctor.mjs` learned the new shapes (`peerSatisfied` now reads `>=`
+  and `^`, and its `compareVersions` orders prerelease identifiers by semver
+  §11 — `rc.10` above `rc.9`), `scripts/peer-canary.mjs` parses and preserves
+  the shapes, and `AGENTS.md`, `CONTRIBUTING.md`, `SUPPORT.md` and
+  `docs/PEER-PARITY.md` state the new policy.
+
+- **The dev pin line moves to DeepSeek Harness `0.2.1-rc.3`.** Every
+  `@deepseek-ai/dsh-*` pin in `devDependencies` goes from `0.2.1-rc.2` to
+  `0.2.1-rc.3` — the release the `next` dist-tag resolves to — and
+  `pnpm-lock.yaml` refreshes with it. `@deepseek-ai/cordis` and
+  `@deepseek-ai/schemastery` stay at `4.0.5` / `3.18.5`: upstream's `vendor/`
+  did not change on this line.
+
+  No module under `src/` changed, and that is the finding. The three peers
+  this plugin subclasses or replicates ship byte-identical `lib/index.js`
+  files on rc.3 — `dsh-fs-local` (the fsio dialect, still 909 lines), `dsh-fs`
+  (the `FsVersion` brand) and `dsh-bash-local` (the spill machinery) — so
+  every line reference in `docs/PEER-PARITY.md` still names the same code;
+  only the tarballs' digests changed, and the parity doc now carries the
+  `0.2.1-rc.3` ones with the re-check dated 2026-10-26. That byte-identity is
+  also the evidence behind the new peer floor: the same code answers above
+  rc.3. Upstream's release notes for the line are UI- and LLM-side
+  (navigation entry customization, analytics, the official `/models`
+  listing): the one composition-visible change is a new `entry-customization`
+  UI row in the app's own `cordis.patch.yml`, which rides with the app's
+  bundle rather than this plugin's layer. `preset-wsl` needed no
+  regeneration — `packages/bundle/web-app/presets/standard.patch.yml` is
+  byte-identical on rc.3 — and the provenance comment in `cordis.patch.yml`
+  now names the rc.3 tree.
+
 ## [0.13.1] - 2026-10-19
 
 A patch release restoring `wsl-shell-env`: the component mounts again, and the

package/CONTRIBUTING.md

@@ -23,13 +23,24 @@ Developing and running the gates do have dependencies. The tests import pinned
 algorithm, and the boot test starts a row through the real Loader — so a fresh
 checkout needs one `pnpm install` before the gates pass.
 
-Those pins are deliberate, and they move with the harness rather than on their
-own: the `@deepseek-ai/dsh-*` peers sit at `0.2.1-rc.2`, `@deepseek-ai/cordis`
-at `~4.0.5` and `@deepseek-ai/schemastery` at `~3.18.5`. The plugin subclasses
-peer classes and mirrors peer protocol, so raising one pin alone is how the
-seams drift: bump them in the commit that matches a harness release, re-run the
-comparison `docs/PEER-PARITY.md` describes, and let the gate chain and the
-probes confirm the result.
+Those pins are deliberate, and they split by role. The `devDependencies` stay
+exact so the gates and the `docs/PEER-PARITY.md` audit name one reproducible
+line. The `peerDependencies` are floors — `>=` for the `@deepseek-ai/dsh-*`
+packages, caret for `@deepseek-ai/cordis` and `@deepseek-ai/schemastery` — so
+an app that ships a newer harness keeps installing the plugin without waiting
+for a plugin release. A floor is still raised on purpose, not by drift: it
+moves in the commit that matches a harness release, with the parity comparison
+and the gate chain re-run, and the weekly peer-canary
+(`.github/workflows/peer-canary.yml`) resolves the `next` dist-tag into a
+scratch tree and flags when the line has moved past the floor. One semver
+limit is worth knowing: a floor range cannot name future prerelease lines —
+`0.2.2-rc.1` does not satisfy `>=0.2.1-rc.3`, because the spec admits a
+prerelease only against a comparator on its own `[major, minor, patch]` tuple
+— so a brand-new rc line warns until the floor rises; same-line rcs and every
+stable release never do.
+
+The plugin subclasses peer classes and mirrors peer protocol, so the range
+says nothing about the parity claims: those are re-verified per floor raise.
 
 pnpm runs the scripts in this repository, pinned through the `packageManager`
 field (corepack resolves it). Treat `pnpm run <script>` as the reference

package/SUPPORT.md

@@ -6,7 +6,7 @@
 |---|---|
 | Operating system | Windows 10 and Windows 11 |
 | Linux side | WSL2 with at least one distro, and systemd as PID 1 with a lingering user manager (`loginctl enable-linger`) for the shipped session runtime. Set `sessionSandbox: false` on the preset's `wsl-shell` to keep the per-command sandbox instead |
-| DSH packages | the `0.2.1-rc.2`-era packages listed in `peerDependencies` |
+| DSH packages | the `0.2.1-rc.3`-or-newer packages the `peerDependencies` floors declare; an app on a newer harness installs unchanged |
 
 The DSH row is checked weekly: `.github/workflows/peer-canary.yml` resolves the
 `next` dist-tag of every pinned peer, installs that line into a scratch copy and

package/cordis.patch.yml

@@ -185,7 +185,8 @@
     # Generated from the shipped standard preset so the embedded plan-mode
     # section and every nested group survive byte-for-byte: this copy is
     # `packages/bundle/web-app/presets/standard.patch.yml` of the
-    # `dsh-v0.2.1-rc.2` source tree, changed in exactly three ways —
+    # `dsh-v0.2.1-rc.3` source tree (unchanged since `0.2.1-rc.2`), changed
+    # in exactly three ways —
     #   1. every shipped row mounts inside `wsl-env`, so the preset's tools see
     #      the distro's shell and fs (the realm is declared on the group);
     #   2. `tool-bash` is enabled and `tool-pwsh` disabled outright, where the

package/docs/PEER-PARITY.md

@@ -7,18 +7,20 @@ same refusal dialect on both substrates. The **read path** holds end to end;
 the **edit path** carries two declared divergences, listed at the end. This
 file records the verification against the real peers.
 
-- Peers: `@deepseek-ai/dsh-fs-local@0.2.1-rc.2` (the exact version
-  `package.json` pins), plus `@deepseek-ai/dsh-fs@0.2.1-rc.2` for the
+- Peers: `@deepseek-ai/dsh-fs-local@0.2.1-rc.3` (the exact version the
+  devDependencies pin, and the floor the peer range `>=0.2.1-rc.3` was
+  verified against), plus `@deepseek-ai/dsh-fs@0.2.1-rc.3` for the
   `FsVersion` brand the local package imports. Divergence 2 is measured
-  against a third peer, `@deepseek-ai/dsh-bash-local@0.2.1-rc.2` — the shell
+  against a third peer, `@deepseek-ai/dsh-bash-local@0.2.1-rc.3` — the shell
   executor carries the collect-budget/spill machinery; `spill` and
   `maxSpillBytes` do not appear in `dsh-fs-local` at all.
-- The `0.2.1-rc.2` move leaves every line reference below intact: all three
-  peers' shipped `lib/index.js` are **byte-identical** to the `0.2.0-rc.2`
+- The `0.2.1-rc.3` move leaves every line reference below intact: all three
+  peers' shipped `lib/index.js` are **byte-identical** to the `0.2.1-rc.2`
   ones (`cmp` clean; `dsh-fs-local`'s is still 909 lines), so only the
-  tarballs' digests changed. `dsh-fs@0.2.1-rc.2` did drop its unpublished
-  `./invariant` export subpath; this plugin imports neither it nor
-  `dsh-invariants`.
+  tarballs' digests changed — upstream shipped the manifests' version fields
+  and nothing else in these packages. `dsh-fs@0.2.1-rc.3` still has no
+  `./invariant` export subpath (dropped back at `0.2.1-rc.2`); this plugin
+  imports neither it nor `dsh-invariants`.
 - What "not imported" means: the peer's **fsio module** is not reachable from
   the package's exports, so `lib/fsio-text.js` reimplements it and imports
   nothing from it (the export is proposed in `docs/UPSTREAM-FSIO-EXPORT.md`).
@@ -33,24 +35,24 @@ file records the verification against the real peers.
 
 ```sh
 mkdir -p /tmp/peer-audit && cd /tmp/peer-audit
-npm pack @deepseek-ai/dsh-fs-local@0.2.1-rc.2 @deepseek-ai/dsh-fs@0.2.1-rc.2 --pack-destination .
-openssl dgst -sha512 -binary deepseek-ai-dsh-fs-local-0.2.1-rc.2.tgz | base64 -w0
-tar xzf deepseek-ai-dsh-fs-local-0.2.1-rc.2.tgz   # -> package/lib/index.js
+npm pack @deepseek-ai/dsh-fs-local@0.2.1-rc.3 @deepseek-ai/dsh-fs@0.2.1-rc.3 --pack-destination .
+openssl dgst -sha512 -binary deepseek-ai-dsh-fs-local-0.2.1-rc.3.tgz | base64 -w0
+tar xzf deepseek-ai-dsh-fs-local-0.2.1-rc.3.tgz   # -> package/lib/index.js
 wc -l package/lib/index.js                        # expect 909
 ```
 
 The tarballs this audit compared, by content — the same values
-`npm view <pkg>@0.2.1-rc.2 dist.integrity` reports:
+`npm view <pkg>@0.2.1-rc.3 dist.integrity` reports:
 
 ```
-@deepseek-ai/dsh-fs-local@0.2.1-rc.2  sha512-IZPJ12/EpV6fu3CCWtW4w4GthXAKLFjplm4Feoep2HAum7J1aGzHZwiw7ipsPCZiA5/TyK3lDUUAGZ/pcXgRcw==
-@deepseek-ai/dsh-fs@0.2.1-rc.2        sha512-Z6d2ZKsAiJc0FaiES8wC66vuUQMGohl9tCc2p3bAsPFYkJ0+L2zTViQ9Y5BArtRe9Br8qhNjNgLlN0jb/uwv1g==
+@deepseek-ai/dsh-fs-local@0.2.1-rc.3  sha512-bB2CwCqvYAdAKl28+5XXMRRq1NBtRmYX3wNOpJ2JlGBm7uj2Aix9Vl9rFig4AQcXXd5Bk738b5KNsOIkbXy+XQ==
+@deepseek-ai/dsh-fs@0.2.1-rc.3        sha512-tENLWe471WlAXMc13J4cns8xU6lFyu1smwpkSKR85vhGr6FyWZhTlpVohZYm66LbwKTmSWiDhd9Urk7VxN9B9w==
 ```
 
 Each row of the table below names the peer's `lib/index.js` line and the
 literal both sides must produce. Verified 2026-10-03; the read/edit split
 re-verified 2026-10-06; the whole table re-checked against `0.2.1-rc.2`,
-2026-10-17.
+2026-10-17 and against `0.2.1-rc.3`, 2026-10-26.
 
 ## Verdict
 
@@ -93,7 +95,7 @@ declared extensions, listed at the end.
 2. **Per-stream truncation flags.** The EXEC frame carries an output budget;
    the RES line reports which streams the agent cut, surfaced as honest
    `truncated` flags. The collect-budget/spill machinery of the shell peer,
-   `@deepseek-ai/dsh-bash-local@0.2.1-rc.2` (`lib/index.js:30`, `:110`), is the
+   `@deepseek-ai/dsh-bash-local@0.2.1-rc.3` (`lib/index.js:30`, `:110`), is the
    spill-file path we deliberately do not run.
 3. **The transport around the ops** (ACK, KILL, the confined resident) is
    protocol this package owns; the peer has no agent.
@@ -120,9 +122,12 @@ declared extensions, listed at the end.
 
 ## Maintenance
 
-When `package.json` bumps the peer pins, re-run the comparison above — pack the
-new tarballs, check the sha512, and walk the table's peer line references
-against the replicas. The fastest canary: stat a file, list its directory, and
+When a peer floor or dev pin moves in `package.json`, re-run the comparison
+above — pack the new tarballs, check the sha512, and walk the table's peer line
+references against the replicas. The weekly peer-canary resolves the `next`
+dist-tag into a scratch tree and runs the gate chain against it, so the signal
+to raise the floor arrives before a user reports a drift. The fastest canary:
+stat a file, list its directory, and
 compare the versions (`test/fsio-agent.test.mjs` asserts the intra-distro half
 of this); the strings above are the other half. The split dialect has its own
 regression: `test/fs-substrate.test.mjs` asserts the missing-file refusal, and

package/lib/agent-confined.d.ts

@@ -1,4 +1,36 @@
 import { WslAgent } from "./agent.js";
+/**
+ * The spawn function `ensureWorkspaceRoot` uses; injectable so a unit test can
+ * observe the argv without a real `wsl.exe`.
+ */
+type SpawnLike = (file: string, args: string[], options: {
+    stdio: "ignore";
+    windowsHide: boolean;
+    env: NodeJS.ProcessEnv;
+}) => {
+    on: (event: string, handler: (...args: unknown[]) => void) => void;
+};
+/**
+ * Make sure the workspace root exists in the distro before the confined
+ * resident's first spawn: the bwrap profile binds the root
+ * (`--bind <root> <root>`) and bwrap refuses a missing bind source — on a
+ * freshly imported distro the first write's workspace may not exist yet, and
+ * the resident would exit during its handshake with a bare code 1 and no
+ * hint (WSL-305). Idempotent (`mkdir -p`), and its outcome is deliberately
+ * ignored here: bwrap remains the authority on whether the profile can be
+ * built, and its refusal now reaches the caller through the handshake
+ * error's stderr tail.
+ *
+ * @param options - the transport, distro, root, and an injectable spawn.
+ * @returns resolves once the `mkdir -p` has been issued (settled, whatever
+ * its result — bwrap decides).
+ */
+export declare function ensureWorkspaceRoot({ wslPath, distro, root, spawnFn }: {
+    wslPath: string;
+    distro: string;
+    root: string;
+    spawnFn?: SpawnLike;
+}): Promise<void>;
 /** One confinement request. */
 export interface ConfinedAgentRequest {
     /** The distro to run in. */

package/lib/agent-confined.js

@@ -31,11 +31,39 @@
  *
  * @module dsh-plugin-wsl/agent-confined
  */
+import { spawn } from "node:child_process";
 import { bwrapArgvPrefix } from "./bwrap.js";
 import { toLinuxPath } from "./paths.js";
 import { agentScriptDigest, agentScriptPath } from "./agent-shared.js";
-import { WslAgent } from "./agent.js";
+import { pinnedWindowsEnv, WslAgent } from "./agent.js";
 const confinedAgents = new Map();
+/**
+ * Make sure the workspace root exists in the distro before the confined
+ * resident's first spawn: the bwrap profile binds the root
+ * (`--bind <root> <root>`) and bwrap refuses a missing bind source — on a
+ * freshly imported distro the first write's workspace may not exist yet, and
+ * the resident would exit during its handshake with a bare code 1 and no
+ * hint (WSL-305). Idempotent (`mkdir -p`), and its outcome is deliberately
+ * ignored here: bwrap remains the authority on whether the profile can be
+ * built, and its refusal now reaches the caller through the handshake
+ * error's stderr tail.
+ *
+ * @param options - the transport, distro, root, and an injectable spawn.
+ * @returns resolves once the `mkdir -p` has been issued (settled, whatever
+ * its result — bwrap decides).
+ */
+export function ensureWorkspaceRoot({ wslPath, distro, root, spawnFn }) {
+    return new Promise((resolve) => {
+        const doSpawn = spawnFn ?? ((file, args, options) => spawn(file, args, options));
+        const child = doSpawn(wslPath, ["-d", distro, "--exec", "mkdir", "-p", root], {
+            stdio: "ignore",
+            windowsHide: true,
+            env: pinnedWindowsEnv(process.env),
+        });
+        child.on("error", () => resolve());
+        child.on("exit", () => resolve());
+    });
+}
 /**
  * The confined agent for one distro and one resolved policy, created on first
  * use and shared for the process lifetime. A success is remembered; a failed
@@ -48,6 +76,7 @@ export function confinedAgent({ distro, wslPath = "wsl.exe", policy, maskWindows
     const key = `${wslPath}\0${distro}\0${policy.mode}\0${policy.workspaceRoot}\0${maskWindowsDrive ? "masked" : "visible"}\0${realTmp ? "real" : "ephemeral"}`;
     let agent = confinedAgents.get(key);
     if (agent === undefined) {
+        const linuxRoot = toLinuxPath(policy.workspaceRoot, { distro });
         agent = new WslAgent({
             distro,
             wslPath,
@@ -58,7 +87,15 @@ export function confinedAgent({ distro, wslPath = "wsl.exe", policy, maskWindows
             // `wsl.exe --exec` and the `sh <script>` pair (`lib/agent.js`'s
             // `spawnDefault`). Both confinement sites share that assembly in
             // `lib/bwrap.js`, whose module doc records what happened when they did not.
-            argvPrefix: bwrapArgvPrefix({ mode: policy.mode, workspaceRoot: toLinuxPath(policy.workspaceRoot, { distro }) }, { maskWindowsDrive, realTmp }),
+            argvPrefix: bwrapArgvPrefix({ mode: policy.mode, workspaceRoot: linuxRoot }, { maskWindowsDrive, realTmp }),
+            // workspace-write is the only mode that binds the workspace root, and
+            // bwrap refuses a missing bind source (WSL-305): on a freshly imported
+            // distro the first write's workspace may not exist yet, and the resident
+            // used to exit during its handshake with a bare code 1. Create the root
+            // before the first spawn; every later start re-runs it harmlessly.
+            prepare: policy.mode === "workspace-write"
+                ? () => ensureWorkspaceRoot({ wslPath, distro, root: linuxRoot }).then(() => undefined)
+                : undefined,
         });
         confinedAgents.set(key, agent);
     }

package/lib/agent.js

@@ -352,6 +352,14 @@ export class WslAgent {
             // reflected in the state/pending requests; an unhandled stream error
             // would crash the host process instead.
             child.stdin?.on("error", () => { });
+            // The resident's own stderr is the only diagnostic a handshake failure
+            // carries (bwrap's refusal names the missing bind source, a libc
+            // mismatch names itself); surface a bounded tail on the lastError
+            // instead of leaving the caller a bare exit code.
+            let hsErr = "";
+            child.stderr?.on("data", (chunk) => {
+                hsErr += String(chunk);
+            });
             child.on("exit", (code, signalName) => {
                 if (!current()) {
                     // A stale child's exit: release its pipes, but never touch the
@@ -360,7 +368,7 @@ export class WslAgent {
                     return;
                 }
                 if (this.state === "starting") {
-                    this.lastError = `agent exited during handshake (code=${code} signal=${signalName ?? "none"})`;
+                    this.lastError = `agent exited during handshake (code=${code} signal=${signalName ?? "none"})${hsErr ? ` stderr=${hsErr.trim().slice(-400)}` : ""}`;
                     settleStart(new Error(this.lastError));
                 }
                 this.handleProcessExit(child, code, signalName);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-wsl-env",
-  "version": "0.13.1",
-  "description": "\u8ba9 DeepSeek Harness \u4ee5 WSL \u5b50\u7cfb\u7edf\u4f5c\u4e3a\u4f1a\u8bdd\u7684\u6267\u884c\u73af\u5883\uff1ashell\u3001\u6587\u4ef6\u8bfb\u5199\u4e0e\u547d\u4ee4\u6267\u884c\u5747\u5728\u5b50\u7cfb\u7edf\u5185\u5b8c\u6210\uff0c\u76ee\u5f55\u9009\u62e9\u5668\u4e0e GUI \u7ec8\u7aef\u540c\u6837\u5b9a\u4f4d\u5230\u5b50\u7cfb\u7edf\u8def\u5f84\uff0c\u5e76\u901a\u8fc7\u5b50\u7cfb\u7edf\u5185\u7684 bubblewrap \u5bf9\u547d\u4ee4\u8fdb\u884c\u6c99\u7bb1\u9694\u79bb",
+  "version": "0.14.0",
+  "description": "让 DeepSeek Harness 以 WSL 子系统作为会话的执行环境：shell、文件读写与命令执行均在子系统内完成，目录选择器与 GUI 终端同样定位到子系统路径，并通过子系统内的 bubblewrap 对命令进行沙箱隔离",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -179,32 +179,32 @@
     "@deepseek-ai/cordis": "4.0.5",
     "@deepseek-ai/cordis-plugin-include": "*",
     "@deepseek-ai/cordis-plugin-loader": "*",
-    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.3",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "~22.20.5",
     "js-yaml": "4.3.2",
     "typescript": "~6.0.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.5"
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-bash-local": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs-local": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-host-directory-picker": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-sandbox": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess-local": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.2.1-rc.3",
+    "@deepseek-ai/schemastery": "^3.18.5"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {

package/scripts/doctor.mjs

@@ -145,19 +145,24 @@ function parseArgs(argv) {
 }
 
 /**
- * Whether an installed version satisfies one peer range. The plugin's pins are
- * exact or tilde ranges, so those two shapes are all this understands; anything
- * else is reported as unchecked rather than guessed at.
+ * Whether an installed version satisfies one peer range. The manifest's peer
+ * ranges are floor ranges (`>=`) and caret ranges (`^`), and the
+ * devDependencies carry exact pins — those three shapes are all this
+ * understands; anything else is reported as unchecked rather than guessed at.
+ * The floor is the plugin's own compatibility claim, so it compares plainly
+ * against the floor version; the semver gate that excludes other lines'
+ * prereleases is an installer concern, not this check's.
  * @param {string} installed - the installed version.
  * @param {string} range - the declared peer range.
  * @returns {boolean | undefined} true/false, or undefined for an unsupported shape.
  */
 export function peerSatisfied(installed, range) {
-  if (range.startsWith("~")) {
+  if (range.startsWith(">=")) return compareVersions(installed, range.slice(2)) >= 0;
+  if (range.startsWith("^")) {
     const [major, minor, patch] = range.slice(1).split(".");
     return compareVersions(installed, `${major}.${minor}.${patch ?? "0"}`) >= 0
       && installed.split(".")[0] === major
-      && installed.split(".")[1] === minor;
+      && (major !== "0" || installed.split(".")[1] === minor);
   }
   if (/^[0-9]/.test(range)) return installed === range;
   return undefined;
@@ -188,7 +193,35 @@ export function compareVersions(left, right) {
   if (a.pre === b.pre) return 0;
   if (a.pre === "") return 1;
   if (b.pre === "") return -1;
-  return a.pre.localeCompare(b.pre);
+  return comparePrerelease(a.pre, b.pre);
+}
+
+/**
+ * Compare two prerelease strings by semver §11: dot-separated identifiers,
+ * numeric ones numerically and below alphanumeric ones, the rest lexically,
+ * a longer list above its own prefix. Plain `localeCompare` would order
+ * `rc.10` below `rc.9`.
+ * @param {string} left - the first prerelease.
+ * @param {string} right - the second prerelease.
+ * @returns {number} negative, zero or positive like a comparator.
+ */
+function comparePrerelease(left, right) {
+  const a = left.split(".");
+  const b = right.split(".");
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    const x = a[i];
+    const y = b[i];
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    if (x === y) continue;
+    const numericX = /^\d+$/.test(x);
+    const numericY = /^\d+$/.test(y);
+    if (numericX && numericY) return Number(x) - Number(y);
+    if (numericX) return -1;
+    if (numericY) return 1;
+    return x < y ? -1 : 1;
+  }
+  return 0;
 }
 
 /**