dsh-plugin-wsl-env 0.15.0 → 0.17.0

package/lib/index.d.ts

@@ -407,6 +407,8 @@ export declare class WslShellExecutor extends LocalBashExecutor {
     sessionRuntimes: SessionRuntimes;
     /** The runtimes this executor holds, by registry key. */
     sessionRuntimeEntries: Map<string, SessionRuntimeEntry>;
+    /** Isolates calls that have no session identity. */
+    sessionRuntimeOwner: string;
     /** The preflight's host runner; tests substitute it. */
     sessionScopeProbe: (argv: string[]) => Promise<string>;
     /** Distros whose session-runtime preflight has succeeded. */
@@ -491,7 +493,7 @@ export declare class WslShellExecutor extends LocalBashExecutor {
     executionAgent(distro: string): WslAgent;
     /**
      * The persistent session runtime for one policy, when `sessionSandbox` is
-     * on. The executor holds one reference per `(distro, workspace, policy)` and
+     * on. The executor holds one reference per `(session, distro, workspace, policy)` and
      * releases them when the session's scope disposes.
      *
      * @param policy - the resolved file-effect policy, when the executor has one.
@@ -502,6 +504,7 @@ export declare class WslShellExecutor extends LocalBashExecutor {
     sessionRuntimeFor(policy: {
         mode: string;
         workspaceRoot: string;
+        sessionId?: string;
     } | undefined, resolved: WslExecSpec, distro: string): SessionRuntimeEntry | undefined;
     /**
      * Run the session runtime's preflight once per executor. A failure is a
@@ -815,11 +818,11 @@ export declare class WslFileSystem extends LocalFileSystem {
         sandbox: z<boolean, boolean, "defined">;
         /**
          * Run confined mutations in the session's systemd user scope — the same
-         * runtime the shell executor acquires for the same (distro, workspace,
-         * policy) — instead of a per-policy confined resident. The kernel
-         * enforcement is the runtime's mount profile, so commands and writes see
-         * the same `/tmp` and workspace; the scope stops when the session's
-         * providers release it. Requires systemd + `Linger`, like `wsl-shell`'s
+         * runtime the shell executor acquires for the same session, distro,
+         * workspace and policy — instead of a per-policy confined resident. A
+         * missing session ID keeps the providers separate. The kernel enforcement
+         * is the runtime's mount profile; the scope stops when its providers
+         * release it. Requires systemd + `Linger`, like `wsl-shell`'s
          * `sessionSandbox`; the preflight refuses with the remedy. Off for direct
          * constructions; on in the shipped preset.
          */
@@ -890,11 +893,11 @@ export declare class WslFileSystem extends LocalFileSystem {
         sandbox: z<boolean, boolean, "defined">;
         /**
          * Run confined mutations in the session's systemd user scope — the same
-         * runtime the shell executor acquires for the same (distro, workspace,
-         * policy) — instead of a per-policy confined resident. The kernel
-         * enforcement is the runtime's mount profile, so commands and writes see
-         * the same `/tmp` and workspace; the scope stops when the session's
-         * providers release it. Requires systemd + `Linger`, like `wsl-shell`'s
+         * runtime the shell executor acquires for the same session, distro,
+         * workspace and policy — instead of a per-policy confined resident. A
+         * missing session ID keeps the providers separate. The kernel enforcement
+         * is the runtime's mount profile; the scope stops when its providers
+         * release it. Requires systemd + `Linger`, like `wsl-shell`'s
          * `sessionSandbox`; the preflight refuses with the remedy. Off for direct
          * constructions; on in the shipped preset.
          */
@@ -962,6 +965,8 @@ export declare class WslFileSystem extends LocalFileSystem {
     sessionRuntimes: SessionRuntimes;
     /** The runtimes this provider holds, by registry key. */
     sessionRuntimeEntries: Map<string, SessionRuntimeEntry>;
+    /** Isolates calls that have no session identity. */
+    sessionRuntimeOwner: string;
     /** The preflight's host runner; tests substitute it. */
     sessionScopeProbe: (argv: string[]) => Promise<string>;
     /** Distros whose session-runtime preflight has succeeded. */
@@ -1038,6 +1043,7 @@ export declare class WslFileSystem extends LocalFileSystem {
     sessionRuntimeFor(policy: {
         mode: string;
         workspaceRoot: string;
+        sessionId?: string;
     }, distro: string): SessionRuntimeEntry | undefined;
     /**
      * Run the session runtime's preflight once per provider. Only success is
@@ -1082,6 +1088,7 @@ export declare class WslFileSystem extends LocalFileSystem {
     mutationAgent(policy: {
         mode: string;
         workspaceRoot: string;
+        sessionId?: string;
     } | undefined, forDistro?: string): Promise<WslAgent>;
     /**
      * Map a substrate error onto the peer's `FsError`, so the tool layer reads
@@ -1292,8 +1299,8 @@ export declare class WslFileSystem extends LocalFileSystem {
      * Fence the write by the per-call policy, then publish through the
      * substrate. The fence's fresh target is the one checked and written, so a
      * refusal costs no I/O and cannot be raced by a swapped symlink; the guard
-     * rides the write op, where the agent re-verifies it one syscall before the
-     * rename and the confined resident enforces it in the kernel.
+     * rides the write op, where the agent re-verifies it before the rename;
+     * the confined resident enforces the mount boundary in the kernel.
      *
      * @param target - the resolved target.
      * @param content - the full new file content.

package/lib/index.js

@@ -40,6 +40,7 @@
  * @module dsh-plugin-wsl
  */
 import z from "@deepseek-ai/schemastery";
+import { randomUUID } from "node:crypto";
 import { LocalBashExecutor } from "@deepseek-ai/dsh-bash-local";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
 import { FsError } from "@deepseek-ai/dsh-fs";
@@ -355,6 +356,7 @@ export class WslShellExecutor extends LocalBashExecutor {
         this.processFacts = new Map();
         this.sessionRuntimes = sessionRuntimes;
         this.sessionRuntimeEntries = new Map();
+        this.sessionRuntimeOwner = randomUUID();
         this.sessionScopeProbe = (argv) => runCapture(argv);
         this.sessionRuntimePreflight = new Set();
         this.autoSessionScope = new Map();
@@ -485,7 +487,7 @@ export class WslShellExecutor extends LocalBashExecutor {
     }
     /**
      * The persistent session runtime for one policy, when `sessionSandbox` is
-     * on. The executor holds one reference per `(distro, workspace, policy)` and
+     * on. The executor holds one reference per `(session, distro, workspace, policy)` and
      * releases them when the session's scope disposes.
      *
      * @param policy - the resolved file-effect policy, when the executor has one.
@@ -499,11 +501,13 @@ export class WslShellExecutor extends LocalBashExecutor {
             return undefined;
         const mode = policy?.mode ?? "danger-full-access";
         const workspaceRoot = policy?.workspaceRoot ?? (configuredCwd(this.config) || resolved.workdir);
-        const key = SessionRuntimes.key({ distro, workspaceRoot, mode, maskWindowsDrive: effectiveMaskWindowsDrive(config) });
+        const sessionId = policy?.sessionId || resolved.dshEnv?.DSH_SESSION_ID || this.sessionRuntimeOwner;
+        const key = SessionRuntimes.key({ sessionId, distro, workspaceRoot, mode, maskWindowsDrive: effectiveMaskWindowsDrive(config) });
         const held = this.sessionRuntimeEntries.get(key);
         if (held !== undefined)
             return held;
         const entry = this.sessionRuntimes.acquire({
+            sessionId,
             distro,
             wslPath: config.wslPath,
             workspaceRoot,
@@ -876,7 +880,7 @@ export class WslShellExecutor extends LocalBashExecutor {
             : confined !== undefined ? confined.argv : this.distroArgv(resolved, shell);
         // The managed `DSH_*` snapshot merges last, exactly as the one-shot path's
         // spawn env does (`ShellExecSpec`: `dshEnv` wins over `env`). The agent
-        // applies these as SETENV frames immediately before the command's EXEC, so
+        // applies these to the individual command, so
         // the resident path now carries `DSH_HOME`, `DSH_SESSION_ID` and the
         // `DSH_WSL_*` facts too — without this the whole registry was invisible on
         // the default path while the one-shot fallback forwarded it.
@@ -1074,11 +1078,11 @@ export class WslFileSystem extends LocalFileSystem {
         sandbox: z.boolean().default(true),
         /**
          * Run confined mutations in the session's systemd user scope — the same
-         * runtime the shell executor acquires for the same (distro, workspace,
-         * policy) — instead of a per-policy confined resident. The kernel
-         * enforcement is the runtime's mount profile, so commands and writes see
-         * the same `/tmp` and workspace; the scope stops when the session's
-         * providers release it. Requires systemd + `Linger`, like `wsl-shell`'s
+         * runtime the shell executor acquires for the same session, distro,
+         * workspace and policy — instead of a per-policy confined resident. A
+         * missing session ID keeps the providers separate. The kernel enforcement
+         * is the runtime's mount profile; the scope stops when its providers
+         * release it. Requires systemd + `Linger`, like `wsl-shell`'s
          * `sessionSandbox`; the preflight refuses with the remedy. Off for direct
          * constructions; on in the shipped preset.
          */
@@ -1147,6 +1151,7 @@ export class WslFileSystem extends LocalFileSystem {
         this.agentInstances = new Map();
         this.sessionRuntimes = sessionRuntimes;
         this.sessionRuntimeEntries = new Map();
+        this.sessionRuntimeOwner = randomUUID();
         this.sessionScopeProbe = (argv) => runCapture(argv);
         this.sessionRuntimePreflight = new Set();
         this.autoSessionScope = new Map();
@@ -1263,11 +1268,13 @@ export class WslFileSystem extends LocalFileSystem {
         if (!config.sessionSandbox)
             return undefined;
         const workspaceRoot = policy.workspaceRoot || config.cwd;
-        const key = SessionRuntimes.key({ distro, workspaceRoot, mode: policy.mode, maskWindowsDrive: config.maskWindowsDrive });
+        const sessionId = policy.sessionId || this.sessionRuntimeOwner;
+        const key = SessionRuntimes.key({ sessionId, distro, workspaceRoot, mode: policy.mode, maskWindowsDrive: config.maskWindowsDrive });
         const held = this.sessionRuntimeEntries.get(key);
         if (held !== undefined)
             return held;
         const entry = this.sessionRuntimes.acquire({
+            sessionId,
             distro,
             wslPath: config.wslPath,
             workspaceRoot,
@@ -1751,8 +1758,8 @@ export class WslFileSystem extends LocalFileSystem {
      * Fence the write by the per-call policy, then publish through the
      * substrate. The fence's fresh target is the one checked and written, so a
      * refusal costs no I/O and cannot be raced by a swapped symlink; the guard
-     * rides the write op, where the agent re-verifies it one syscall before the
-     * rename and the confined resident enforces it in the kernel.
+     * rides the write op, where the agent re-verifies it before the rename;
+     * the confined resident enforces the mount boundary in the kernel.
      *
      * @param target - the resolved target.
      * @param content - the full new file content.

package/lib/session-runtime.d.ts

@@ -1,7 +1,7 @@
 /**
  * The session-scoped runtime registry (ADR 0001).
  *
- * One long-lived agent per `(distro, workspaceRoot, policy)`, shared by the
+ * One long-lived agent per `(sessionId, distro, workspaceRoot, policy)`, shared by the
  * providers that need it and refcounted: the first `acquire` spawns the agent
  * inside a systemd user scope, the last `release` closes the agent and stops
  * the scope (the cgroup then reaps any background dev server a command left
@@ -43,6 +43,8 @@ export declare function probeSessionRuntime({ wslPath, distro, run }: {
 }): Promise<string | null>;
 /** One request for a session runtime. */
 export interface SessionRuntimeRequest {
+    /** The session identity; absent requests each get a separate runtime. */
+    sessionId?: string;
     /** The distro the runtime lives in. */
     distro: string;
     /** The `wsl.exe` path; defaults to `wsl.exe`. */
@@ -125,14 +127,14 @@ export declare class SessionRuntimes {
      */
     constructor(options?: SessionRuntimeOptions);
     /**
-     * The key a request addresses: distro, workspace, mode and mask. A policy
+     * The key a request addresses: session, distro, workspace, mode and mask. A policy
      * change is a different runtime, because the mount profile is fixed for the
      * agent's lifetime.
      *
      * @param request - the runtime request.
      * @returns the registry key.
      */
-    static key(request: Pick<SessionRuntimeRequest, "distro" | "workspaceRoot" | "mode" | "maskWindowsDrive">): string;
+    static key(request: Pick<SessionRuntimeRequest, "distro" | "workspaceRoot" | "mode" | "maskWindowsDrive" | "sessionId">): string;
     /**
      * Acquire the runtime for one key, creating it on first use.
      *

package/lib/session-runtime.js

@@ -1,7 +1,7 @@
 /**
  * The session-scoped runtime registry (ADR 0001).
  *
- * One long-lived agent per `(distro, workspaceRoot, policy)`, shared by the
+ * One long-lived agent per `(sessionId, distro, workspaceRoot, policy)`, shared by the
  * providers that need it and refcounted: the first `acquire` spawns the agent
  * inside a systemd user scope, the last `release` closes the agent and stops
  * the scope (the cgroup then reaps any background dev server a command left
@@ -83,6 +83,7 @@ const spawnSessionAgent = (options) => {
             idleMs: options.idleMs,
             leaseMs: options.leaseMs,
             signalable: false,
+            serialRequests: false,
             spawnTransport: ({ wslPath, distro, argvPrefix }) => spawn(wslPath, ["-d", distro, "--exec", ...argvPrefix, native.path], {
                 stdio: ["pipe", "pipe", "pipe"],
                 windowsHide: true,
@@ -137,7 +138,7 @@ export class SessionRuntimes {
         this.token = options.token ?? defaultToken;
     }
     /**
-     * The key a request addresses: distro, workspace, mode and mask. A policy
+     * The key a request addresses: session, distro, workspace, mode and mask. A policy
      * change is a different runtime, because the mount profile is fixed for the
      * agent's lifetime.
      *
@@ -145,7 +146,7 @@ export class SessionRuntimes {
      * @returns the registry key.
      */
     static key(request) {
-        return [request.distro, request.workspaceRoot, request.mode, request.maskWindowsDrive === true ? "masked" : "visible"].join("\u0000");
+        return [request.sessionId ?? "", request.distro, request.workspaceRoot, request.mode, request.maskWindowsDrive === true ? "masked" : "visible"].join("\u0000");
     }
     /**
      * Acquire the runtime for one key, creating it on first use.
@@ -154,7 +155,7 @@ export class SessionRuntimes {
      * @returns the live entry; the caller holds one reference.
      */
     acquire(request) {
-        const key = SessionRuntimes.key(request);
+        const key = SessionRuntimes.key({ ...request, sessionId: request.sessionId || defaultToken() });
         const existing = this.runtimes.get(key);
         if (existing !== undefined) {
             existing.refs += 1;

package/lib/subprocess.d.ts

@@ -60,13 +60,17 @@
  *
  * ## What the operator must pair it with
  *
- * `terminalEnvironment()` and `resolveExecutable()` are also resolved from the
- * root realm, and neither receives a Session or a directory, so this provider
- * deliberately leaves them alone: rewriting them would change executable lookup
- * for every other root consumer (the pwsh executor, the LSP host, the file
- * search) to make the *shell menu* of one window prettier. The profile instead
- * configures the terminal controller with the single shell profile that matters:
- * `shell: { path: wsl.exe, name: WSL }` and `shellCandidates: []`.
+ * `terminalEnvironment()` is also resolved from the root realm and receives no
+ * Session or directory, so this provider deliberately leaves it alone:
+ * rewriting it would change environment lookup for every other root consumer
+ * to make the *shell menu* of one window prettier. `resolveExecutable()` gets
+ * ONE scoped exception — a git fallback when the host has none (see the
+ * override below); every other name's lookup is untouched. The profile also
+ * configures the terminal controller with the distro shell as the default
+ * profile plus deliberate host candidates: `shell: { path: wsl.exe, name: WSL }`
+ * and `shellCandidates: [wsl.exe, powershell, cmd]` — the first dedupes into
+ * the default's `wsl` kind, and the other two are launches this terminal really
+ * starts (host sessions, or an explicit user selection, titled after itself).
  *
  * Consequence worth stating plainly: the terminal is a property of the
  * composition, not of the Session. A Session whose workspace is a Windows folder
@@ -297,6 +301,16 @@ export declare class WslSubprocessRuntime extends LocalSubprocessRuntime {
      * @returns the live search handle.
      */
     spawn(spec: SubprocessSpawnSpec): SubprocessHandle;
+    /**
+     * Guarded git fallback: when the HOST has no git, resolve the name to the
+     * distro sentinel so the change-review pipeline's every spawn (discovery
+     * included) routes into the distro instead of dying at the executable
+     * lookup. Scoped to the one name — every other consumer's lookup (pwsh,
+     * LSP, ripgrep) is untouched — and only on the super's failure, so a
+     * machine with Windows git behaves exactly as shipped. See
+     * `git-route.ts`'s `DISTRO_GIT_SENTINEL` for the routing side.
+     */
+    resolveExecutable(command: string, env: Record<string, string> | undefined, signal: AbortSignal | undefined): Promise<string>;
     /**
      * The environment one `wsl.exe` launch forwards: the safe list plus every
      * managed `DSH_*` name, admitted through `WSLENV` and never `PATH` — see the

package/lib/subprocess.js

@@ -60,13 +60,17 @@
  *
  * ## What the operator must pair it with
  *
- * `terminalEnvironment()` and `resolveExecutable()` are also resolved from the
- * root realm, and neither receives a Session or a directory, so this provider
- * deliberately leaves them alone: rewriting them would change executable lookup
- * for every other root consumer (the pwsh executor, the LSP host, the file
- * search) to make the *shell menu* of one window prettier. The profile instead
- * configures the terminal controller with the single shell profile that matters:
- * `shell: { path: wsl.exe, name: WSL }` and `shellCandidates: []`.
+ * `terminalEnvironment()` is also resolved from the root realm and receives no
+ * Session or directory, so this provider deliberately leaves it alone:
+ * rewriting it would change environment lookup for every other root consumer
+ * to make the *shell menu* of one window prettier. `resolveExecutable()` gets
+ * ONE scoped exception — a git fallback when the host has none (see the
+ * override below); every other name's lookup is untouched. The profile also
+ * configures the terminal controller with the distro shell as the default
+ * profile plus deliberate host candidates: `shell: { path: wsl.exe, name: WSL }`
+ * and `shellCandidates: [wsl.exe, powershell, cmd]` — the first dedupes into
+ * the default's `wsl` kind, and the other two are launches this terminal really
+ * starts (host sessions, or an explicit user selection, titled after itself).
  *
  * Consequence worth stating plainly: the terminal is a property of the
  * composition, not of the Session. A Session whose workspace is a Windows folder
@@ -79,13 +83,15 @@
  * @module dsh-plugin-wsl/subprocess
  */
 import { randomUUID } from "node:crypto";
+import { Buffer } from "node:buffer";
 import z from "@deepseek-ai/schemastery";
 import { LocalSubprocessRuntime } from "@deepseek-ai/dsh-subprocess-local";
 import { isPosixAbsolute, toLinuxPath, uncToPosix, windowsToLinuxMount } from "./paths.js";
 import { DEFAULT_WSL_PATH, defaultDistro, wslEnvValue, wslTerminalArgv } from "./wsl.js";
 import { searchSpawnRewrite } from "./search-route.js";
-import { gitSpawnRewrite, translateGitEnv } from "./git-route.js";
+import { DISTRO_GIT_SENTINEL, gitSpawnRewrite, translateGitEnv } from "./git-route.js";
 import { searchExecutionHandle } from "./search-exec.js";
+import { gitExecutionHandle } from "./git-exec.js";
 import { sharedAgent } from "./agent-shared.js";
 import { parseTerminalActivity, TERMINAL_ID_ENV, terminalActivityProbe, wrapTerminalHandle } from "./terminal-activity.js";
 import { AgentUnavailableError } from "./agent-errors.js";
@@ -341,12 +347,40 @@ export class WslSubprocessRuntime extends LocalSubprocessRuntime {
             // object store, work tree, and refs stay untouched by design — the
             // snapshot runs in the tool's private scratch.
             const { env, wslenv } = translateGitEnv(spec.env);
-            return super.spawn({
+            const oneShot = () => super.spawn({
                 ...spec,
                 argv: gitRewrite.wslArgv,
                 cwd: this.hostCwd(),
                 env: wslenv.length > 0 ? { ...env, WSLENV: wslEnvValue(wslenv) } : env,
             });
+            // Agent-first: the warm resident answers a git call in ~2 ms where a
+            // one-shot `wsl.exe` spends ~230 ms of process startup, and a snapshot
+            // makes 6-8 of those calls plus per-file `cat-file`. Only the translated
+            // GIT_* names ride the agent's per-request environment — a host PATH
+            // must not leak into the distro, and the one-shot forwards exactly those
+            // names through WSLENV too. The agent being out falls back to the
+            // one-shot handle lazily (see git-exec.ts).
+            const agentEnv = {};
+            for (const [name, value] of Object.entries(env)) {
+                if (name.startsWith("GIT_") && typeof value === "string")
+                    agentEnv[name] = value;
+            }
+            const stdinSpec = spec.stdio.stdin;
+            const stdinData = typeof stdinSpec === "object" && stdinSpec !== null && typeof stdinSpec.data === "string" ? stdinSpec.data : undefined;
+            const stdoutCap = spec.stdio.stdout?.maxBytes ?? 0;
+            const stderrCap = spec.stdio.stderr?.maxBytes ?? 0;
+            return gitExecutionHandle({
+                agent: sharedAgent(gitRewrite.distro),
+                cwd: gitRewrite.linuxCwd,
+                argv: gitRewrite.gitArgv,
+                env: agentEnv,
+                stdin: stdinData === undefined ? undefined : Buffer.from(stdinData, "utf8"),
+                caps: { stdout: stdoutCap, stderr: stderrCap },
+                distro: gitRewrite.distro,
+                discovery: gitRewrite.discovery === true,
+                signal: spec.signal,
+                spawnFallback: oneShot,
+            });
         }
         const rewrite = searchSpawnRewrite({ argv: spec.argv, cwd: spec.cwd, wslPath: this.config.wslPath });
         if (rewrite === undefined)
@@ -372,6 +406,26 @@ export class WslSubprocessRuntime extends LocalSubprocessRuntime {
             }),
         });
     }
+    /**
+     * Guarded git fallback: when the HOST has no git, resolve the name to the
+     * distro sentinel so the change-review pipeline's every spawn (discovery
+     * included) routes into the distro instead of dying at the executable
+     * lookup. Scoped to the one name — every other consumer's lookup (pwsh,
+     * LSP, ripgrep) is untouched — and only on the super's failure, so a
+     * machine with Windows git behaves exactly as shipped. See
+     * `git-route.ts`'s `DISTRO_GIT_SENTINEL` for the routing side.
+     */
+    async resolveExecutable(command, env, signal) {
+        try {
+            return await super.resolveExecutable(command, env, signal);
+        }
+        catch (error) {
+            const base = command.slice(Math.max(command.lastIndexOf("/"), command.lastIndexOf("\\")) + 1).toLowerCase().replace(/\.exe$/u, "");
+            if (base === "git")
+                return DISTRO_GIT_SENTINEL;
+            throw error;
+        }
+    }
     /**
      * The environment one `wsl.exe` launch forwards: the safe list plus every
      * managed `DSH_*` name, admitted through `WSLENV` and never `PATH` — see the

package/locale/en.json

@@ -1,6 +1,6 @@
 {
   "meta": {
     "title": "WSL execution environment",
-    "description": "Runs a DeepSeek Harness session against a WSL distro: shell, file reads/writes and command execution happen inside the distro, the directory picker and the GUI terminal target distro paths, and commands are confined by in-distro bubblewrap."
+    "description": "Opens the project workspace inside a WSL Linux instance: command execution, shell scripts and file access all run in the Linux environment for the full Linux shell toolchain, with commands confined by bubblewrap."
   }
 }

package/locale/zh.json

@@ -1,6 +1,6 @@
 {
   "meta": {
     "title": "WSL 执行环境",
-    "description": "让 DeepSeek Harness 以 WSL 子系统作为会话的执行环境：shell、文件读写与命令执行均在子系统内完成，目录选择器与 GUI 终端同样定位到子系统路径，并通过子系统内的 bubblewrap 对命令进行沙箱隔离"
+    "description": "在 WSL 的 Linux 实例中打开项目工作区，在对应 Linux 空间中进行命令执行、运行 shell 脚本和文件访问，以获得全套 Linux Shell 工具链收益，并通过 bubblewrap 对命令进行沙箱隔离"
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-wsl-env",
-  "version": "0.15.0",
-  "description": "让 DeepSeek Harness 以 WSL 子系统作为会话的执行环境：shell、文件读写与命令执行均在子系统内完成，目录选择器与 GUI 终端同样定位到子系统路径，并通过子系统内的 bubblewrap 对命令进行沙箱隔离",
+  "version": "0.17.0",
+  "description": "\u5728 WSL \u7684 Linux \u5b9e\u4f8b\u4e2d\u6253\u5f00\u9879\u76ee\u5de5\u4f5c\u533a\uff0c\u5728\u5bf9\u5e94 Linux \u7a7a\u95f4\u4e2d\u8fdb\u884c\u547d\u4ee4\u6267\u884c\u3001\u8fd0\u884c shell \u811a\u672c\u548c\u6587\u4ef6\u8bbf\u95ee\uff0c\u4ee5\u83b7\u5f97\u5168\u5957 Linux Shell \u5de5\u5177\u94fe\u6536\u76ca\uff0c\u5e76\u901a\u8fc7 bubblewrap \u5bf9\u547d\u4ee4\u8fdb\u884c\u6c99\u7bb1\u9694\u79bb",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -96,9 +96,17 @@
     "README.md",
     "docs/README.zh.md",
     "docs/QUICKSTART.md",
+    "docs/screenshots/*.png",
     "docs/PERFORMANCE.md",
+    "docs/COMPATIBILITY.md",
     "docs/CONFIGURATION.md",
     "docs/LIMITATIONS.md",
+    "docs/RELEASING.md",
+    "docs/REQUIREMENTS.zh.md",
+    "docs/root-fs-routing.md",
+    "docs/VALUE.zh.md",
+    "docs/UPSTREAM-OPEN-IN-APP.md",
+    "docs/adr/0002-native-agent.md",
     "docs/PARITY.md",
     "docs/PEER-PARITY.md",
     "docs/UPSTREAM-FSIO-EXPORT.md",
@@ -125,9 +133,9 @@
     "lint:types": "tsc --noEmit",
     "build": "node scripts/build.mjs",
     "lint:build": "node test/build-freshness.mjs",
-    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 --test-coverage-exclude='scripts/**' test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/shell-env.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs",
+    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 --test-coverage-exclude='scripts/**' --test-coverage-exclude='test/**' test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/shell-env.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs test/probe-runner.test.mjs",
     "test:syntax": "node test/syntax.mjs",
-    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/shell-env.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs",
+    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/shell-env.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs test/probe-runner.test.mjs",
     "lint:style": "node test/style.mjs",
     "lint:links": "node scripts/check-links.mjs",
     "prepublishOnly": "pnpm test",
@@ -139,6 +147,7 @@
     "probe:terminal": "bash test/probe/terminal.sh",
     "probe:sandbox": "bash test/probe/sandbox.sh",
     "probe:sandbox-shell": "bash test/probe/sandbox-shell.sh",
+    "probe:interop-shell": "bash test/probe/interop-shell.sh",
     "sync:windows": "bash test/probe/sync-to-windows.sh",
     "probe:watch": "bash test/probe/watch.sh",
     "probe:agent": "bash test/probe/agent.sh",

package/scripts/diagnose.sh

@@ -3,7 +3,7 @@
 # to change the machine. `--fix`/`--install` are refused here on purpose —
 # diagnostics collected for a bug report must not repair anything.
 #
-#   pnpm run diagnose -- [distro] [--json]
+#   pnpm run diagnose [distro] [--json]
 #
 # Doctor is `scripts/doctor.mjs`; see its header for what it covers. Exit status
 # follows doctor: 0 when no check failed, 1 when one did.

package/scripts/doctor.mjs

@@ -255,7 +255,7 @@ function installRemedy(distro, family) {
  * @returns {number} the exit status.
  */
 function rejectReadOnly() {
-  console.error("doctor: --read-only refuses --fix/--install; run `pnpm run doctor -- --fix` instead");
+  console.error("doctor: --read-only refuses --fix/--install; run `pnpm run doctor --fix` instead");
   return 2;
 }
 
@@ -334,7 +334,7 @@ async function main(options) {
   const bwrapPath = (await inDistro(distro, "command -v bwrap")).stdout.trim();
   const install = installRemedy(distro, family);
   if (bwrapPath.length === 0) {
-    check("sandbox.bwrap", "fail", "bubblewrap", "missing; every confined command fails closed without it", `${install}, or run "pnpm run bootstrap -- ${distro} --install"`);
+    check("sandbox.bwrap", "fail", "bubblewrap", "missing; every confined command fails closed without it", `${install}, or run "pnpm run bootstrap ${distro} --install"`);
   } else {
     check("sandbox.bwrap", "ok", "bubblewrap", bwrapPath);
     const userns = await inDistro(distro, "bwrap --ro-bind / / -- true");
@@ -394,6 +394,26 @@ async function main(options) {
     if (m === null) return [];
     return (m[1] ?? "").trim().split(/\s+/).filter((p) => p.length > 0);
   });
+  // ---- Windows git trust (WSL change review) ------------------------------
+  // The change-review pipeline's discovery call runs the WINDOWS git against
+  // a \\wsl.localhost UNC when Windows git is installed; git's
+  // dubious-ownership check refuses the share unless it is whitelisted, and
+  // the pipeline silently degrades to "git is unavailable" (no diff cards for
+  // WSL workspaces). A machine without Windows git is fine too — the provider
+  // resolves git to a distro sentinel and routes everything. What the doctor
+  // can probe cheaply from here is interop git.exe and its whitelist.
+  const winGitVersion = await run(["git.exe", "--version"]);
+  if (!winGitVersion.ok) {
+    check("git.win-safe", "info", "Windows git trust", "Windows git not found through interop — WSL change review uses the distro fallback; host (C:\\...) workspaces would need git for their own review");
+  } else {
+    const entries = (await run(["git.exe", "config", "--global", "--get-all", "safe.directory"])).stdout.split(/\r?\n/).filter(Boolean);
+    const whitelisted = entries.some((entry) => /wsl\.localhost/i.test(entry));
+    check("git.win-safe", whitelisted ? "ok" : "warn", "Windows git trust",
+      whitelisted ? `the \\\\wsl.localhost share is whitelisted (${entries.length} entr${entries.length === 1 ? "y" : "ies"})`
+        : "Windows git does not trust the \\\\wsl.localhost share; WSL workspaces' change review silently degrades to file-tool edits",
+      whitelisted ? undefined : 'on Windows: git config --global --add safe.directory "//wsl.localhost/*", then restart the app');
+  }
+
   // ---- resident handshake --------------------------------------------------
   const agentScript = join(ROOT, "agent", "wsl-agent.sh");
   if (!agentScript.startsWith("/")) {
@@ -516,7 +536,7 @@ async function main(options) {
       if (/^\s*-\s*id:\s*(wsl-shell|wsl-fs)\s*$/m.test(text)) trapped.push(entry.name);
     }
     if (trapped.length > 0) {
-      check("config.preset-trap", "warn", "Profile patches", `nested rows patched by id in: ${trapped.join(", ")}`, "wsl-shell and wsl-fs live inside preset-wsl; an id patch matches nothing and is silently ignored. Run \"pnpm run preset -- --check <patch>\" to get the complete block, or see docs/CONFIGURATION.md#overriding-the-rows-inside-preset-wsl");
+      check("config.preset-trap", "warn", "Profile patches", `nested rows patched by id in: ${trapped.join(", ")}`, "wsl-shell and wsl-fs live inside preset-wsl; an id patch matches nothing and is ignored with a warning. Run \"pnpm run preset --check <patch>\" to get the complete block, or see docs/CONFIGURATION.md#configure-wsl-shell-and-wsl-fs");
     } else {
       check("config.profiles", "ok", "Profile patches", `${seen} profile patch(es) scanned`);
     }