dsh-plugin-wsl-env 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -12,8 +12,173 @@ reference below points at that record's numbering.
 
 ## [Unreleased]
 
+### Added
+
+- **`maskWindowsDrive` on `wsl-shell` and `wsl-fs`** — the mitigation knob for
+  the interop hole the sandbox has always documented. The confined profile
+  mounts an empty tmpfs over `/mnt`, so the Windows drive's files cannot be
+  read or exfiltrated by a "sandboxed" command and its executables cannot be
+  launched through interop (the path by which such a command reaches your full
+  Windows token). Honest limits, stated wherever the key is: binfmt interop
+  dispatches on file content, so a command that can write the workspace can
+  still write an executable there and run it — enforcement stays `partial`,
+  the result's sandbox fact now carries `windowsDrive: "masked" | "visible"`
+  so the model can see which posture it runs under, and the only complete
+  closure is distro-level (`[interop] enabled=false` in `wsl.conf`). Default
+  `false`: the drive stays visible unless you ask for the mask.
+
+## [0.3.0] - 2026-10-03
+
+One theme: the file tools move into the distro. The `substrate: "agent"` I/O
+substrate and its kernel-enforced confined writes land together with the
+enterprise review that hardened them — the watchdog that killed the shared
+agent for a queue it never chose to join, the output captures nothing bounded,
+a root listing that sheared the first character off every child's name, and an
+overwrite guard that stopped at the host.
+
+### Fixed
+
+- **One file carries one version string, whichever op answered.** `stat` and
+  `list` built their versions from different producers: the stat op used the
+  distro's `stat` directives (uutils `stat` rounds timestamps to microseconds)
+  while the list walk used `find -printf` (nanosecond-exact), so the same file
+  yielded two different version strings and a list-derived guard failed
+  against its own stat. `fs_stat` now reads through the same `find -printf`
+  the list walk uses — one producer, one string — and `find -L`'s habit of
+  reporting a dangling link as the link itself is refused the way the `stat`
+  it replaced was, so a dangling link still stats to null like the peer's.
+
+- **An overwrite or edit now re-verifies its version distro-side, one syscall
+  before the rename.** The module header claimed the mutation guard "survives
+  to the write", but the no-replace link guarded only `createIfAbsent`: an
+  overwrite or edit checked the version host-side and then published with an
+  unconditional `mv -f`, so a concurrent writer (an editor save, `git stash`,
+  another session) that landed between the model's stat and the publish was
+  silently clobbered with no `FS_STALE_VERSION`. The `write` op now carries
+  the version the write was based on (a `replaceIfVersion` guard's version,
+  or the stat an edit was read against), and the agent re-verifies it with a
+  fresh stat from the SAME producer `fs_stat` uses — refusing with
+  `FS_STALE_VERSION` ("file changed since it was read", or "file no longer
+  exists") while the concurrent writer's content stays untouched and no
+  staging debris is left behind. The window narrows from a host round trip to
+  kernel-adjacent — the honest wording, here and in the module headers,
+  LIMITATIONS.md and ARCHITECTURE.md, is that only the create case is closed
+  outright.
+
+- **The agent command path now enforces the output budget it always
+  advertised.** `maxOutputBytes` rode the config schema but nothing else: the
+  agent captured a command's whole stdout and stderr and base64ed both into
+  one RES line — multi-gigabyte output meant multi-gigabyte dash command
+  substitutions in the distro and a multi-gigabyte host line, with the result
+  claiming `truncated: false` all the way. The EXEC frame now carries the
+  caller's per-stream budget (`wsl-shell`'s `maxOutputBytes`, wired from the
+  agent execution path); the agent cuts each stream at it — only the first
+  bytes are encoded, so distro AND host memory are bounded — and the RES line
+  reports which streams were cut, which the handle surfaces as honest
+  per-stream `truncated` flags (a guarded-create synthesis and frames without
+  a budget still read `false`). The host also defends itself against a broken
+  or hostile agent: the unbounded readline accumulator is replaced with a
+  bounded line splitter that kills the transport when one stdout line exceeds
+  the protocol cap instead of buffering it whole.
+
+- **A short-budget request queued behind a long one no longer kills the shared
+  agent — and an in-flight command is never silently re-run.** Two defects
+  shared one root: the host armed each request's watchdog at SUBMISSION and
+  let it kill the one `wsl.exe` carrying every pending request, and the
+  rebuild relay then replayed all carried frames verbatim. In the default
+  configuration the 10 s `DSH_WSL_PORTS` poller (8 s budget, shared agent) did
+  exactly this against any command longer than ~21 s: the poll's watchdog
+  killed the transport, the command died mid-flight, and the rebuild
+  **re-executed it from scratch** — both callers seeing success (measured: a
+  killed `sleep 40` ran twice). Three changes close it: the agent answers
+  `ACK|<id>` when it dequeues a request and the host arms the watchdog there,
+  so queue time never spends a budget (wire protocol v3 — sync the runtime
+  copy and restart the app, an old agent fails the handshake loudly instead of
+  misbehaving quietly); the rebuild relays only provably read-only FS frames
+  (`stat`/`lstat`/`list`/`realpath`/`read`), failing an in-flight EXEC or
+  `write` with "its state is unknown — inspect the distro before retrying"
+  instead of re-running it; and an abort now addresses the request's CURRENT
+  id, so a relayed request's KILL (and map cleanup) can no longer miss. The
+  watchdog-vs-queue experiment now ends with the long command executed exactly
+  once and the transport alive.
+- **A root listing kept every child's name whole.** `listChildren` sliced each
+  `find` record at `parent.length + 1`, which against the bare `/` parent
+  sheared the first character off every name (`/etc` → `tc`), and a write to a
+  listed child then created `/tc`. The exact prefix is stripped instead, and
+  the child join owes its own slash, so `listDir` on
+  `\\wsl.localhost\<distro>\` names `/etc`, `/home`, `/usr` correctly.
+
+### Added
+
+- **`substrate: "agent"` — the filesystem's in-distro I/O substrate.** `wsl-fs`
+  gains a `substrate` key, default `agent`: the file tools are served through
+  the resident in-distro agent instead of the 9p share — identities are
+  distro-side `realpath`s, symlinks resolve where they live (no retry
+  machinery, `/etc/os-release` just works), mode bits are native, and a
+  mutation guard survives to the write's no-replace publication — the
+  check-then-write window the share documents closes, exactly as on a Linux
+  host. `substrate: "share"` is the opt-out that keeps the previous behaviour
+  byte for byte. Both substrates fence writes with the same host-side policy
+  check, so this changes fidelity and posture, not enforcement. Known
+  differences are in LIMITATIONS.md (notably: new files publish at 0600, the
+  peer's own POSIX semantics, where the share took the umask 0644), and an
+  agent outage fails with `FS_IO_ERROR` naming the substrate rather than
+  degrading to share semantics. Layers: FS operation frames on the agent wire
+  protocol (v3, `agent/wsl-agent.sh`), fsio-over-agent mechanics
+  (`lib/fsio-agent.js`), provider-shaped orchestration (`lib/fs-substrate.js`),
+  and the provider branch (`lib/index.js`). The pure text mechanics are
+  replicated from upstream pending the fsio export proposed in
+  docs/UPSTREAM-FSIO-EXPORT.md. Probed live: `npm run probe:substrate`.
+- **Stage two: kernel-enforced confined writes.** On the agent substrate, a
+  mutation under a confined policy rides its own long-lived resident — one
+  agent per (distro, mode, workspace), spawned inside the bwrap profile that
+  binds exactly what the mode grants (`lib/agent-confined.js`, `argvPrefix` on
+  the agent wire). The kernel now refuses what the host-side check would have,
+  so a check bug cannot become a write outside the workspace; a mount-table
+  refusal surfaces as `FS_SANDBOX_DENIED`, the command path's dialect, and a
+  distro without usable bwrap refuses confined writes with the bootstrap
+  command instead of downgrading. Escalated (`danger-full-access`) writes ride
+  the plain resident, and a policy change simply addresses a different key —
+  the previous resident retires through its idle timer. Probed live: the
+  confined write inside the workspace lands, and the one outside it is refused
+  by the kernel (`probe:substrate`).
+
 ### Fixed
 
+- **Every mutation on the agent substrate failed: the confined resident's command
+  had no program** — `confinedAgent()` built the resident's `argvPrefix` from the
+  raw profile arguments, so the transport handed `wsl.exe` a command beginning at
+  `--ro-bind` instead of `bwrap --ro-bind`. The resident exited 1 during its
+  handshake, and every write, edit and guarded create on `substrate: "agent"`
+  failed with `FS_IO_ERROR: the distro file substrate is unavailable: agent exited
+  during handshake (code=1 signal=none)` while reads kept working. Both confinement
+  sites now assemble the command through the import-free `lib/bwrap.js`, which is
+  what `test/agent.test.mjs` asserts; the same bug stayed invisible because
+  `test/probe/substrate.sh` inlined a *third*, correct copy of those arguments —
+  it now imports the production builder, so the probe fails with the provider.
+- **`WslFileSystem` could not build its agent substrate at all: a constructor
+  field shadowed the method of the same name** — the constructor's
+  `this.agentSubstrate = undefined` (the cache) overwrote the prototype's
+  `async agentSubstrate()` (the accessor), so the first file operation that needed
+  the agent threw `this.agentSubstrate is not a function`, which is how a GUI
+  session failed its turn in the Desktop app. The cache is now
+  `this.agentSubstrateInstance`, named after the sibling `this.agentInstance`, and
+  `lib/index.js`'s instance fields no longer collide with any class member.
+- **A schemastery member the pinned peer does not publish took the `wsl` preset
+  down in the Desktop app** — `WslFileSystem.Config` declared
+  `substrate: z.enum(["share", "agent"])`, and `@deepseek-ai/schemastery` 3.18.4
+  (what every `@deepseek-ai/dsh-*` peer pins as `~3.18.4`) publishes no `enum`. A
+  Config schema is a class field, so the call ran while `lib/index.js` was still
+  being imported: the loader logs the `TypeError` and leaves that row with no
+  fiber, which the preset audit renders as `never started` — naming neither the
+  member nor the file, and only for `wsl-shell` and `wsl-fs`, the two rows that
+  load `lib/index.js`. The preset therefore failed to activate, so the app
+  reported `2 row(s) did not activate` for those two ids. Now
+  `z.union(["share", "agent"])`: same `agent` default, and a bad value still
+  fails with `expected "share" | "agent" but got "bogus"`. Measured against the
+  app's own runtime, both entries import; `test/syntax.mjs` now checks every
+  `z.<member>` in `lib/` against the pinned peer's surface, which fails on
+  `z.enum` and passes on `z.union`.
 - **`truncated` missing from the agent path's output streams** — the bash tool's
   canonical result copies the field unconditionally (`canonicalBashResult`), so an
   `undefined` failed the wire's lossless-JSON snapshot and EVERY shell tool call

package/README.md

@@ -56,6 +56,7 @@ Override a row by id in `$DSH_HOME/profiles/<name>/cordis.patch.yml`. The keys w
 | `wsl-fs` | `distro` | `''` | as above |
 | | `restrictToDistro` | `true` | refuse a path in **another distro**'s share; `/mnt/c` is inside this distro and is not affected. Refused with `FS_OUTSIDE_DISTRO`, which is not a sandbox denial and cannot be lifted by wider permissions |
 | | `sandbox` | `true` | check `writeText` and `editText` against the policy |
+| | `substrate` | `agent` | which I/O substrate serves the file tools: `agent` — the resident in-distro agent, where reads, writes and identities run on ext4 (native symlinks and mode bits; the write guard survives to publication, kernel-enforced under a confined policy); `share` — the opt-out: the Windows-side host stack over the 9p share. Both fence writes with the same policy; see [LIMITATIONS.md](docs/LIMITATIONS.md) for what changes |
 | `directory-picker-wsl` | `includeHostHome` | `true` | also list the Windows home directory |
 | `subprocess-wsl` | `distro` | `''` | which distro the GUI terminal opens in |
 
@@ -118,6 +119,7 @@ npm run probe:sandbox        # measure inside the distro what bubblewrap does an
 npm run probe                # filesystem probe against a real distro (Windows + WSL only)
 npm run probe:sandbox-shell  # boot a real harness and drive the confined executor
 npm run probe:terminal       # open a PTY through the terminal provider
+npm run probe:substrate      # drive the agent filesystem substrate over a real wsl.exe transport (from inside the distro)
 npm run probe:missing-wsl    # boot a profile whose wslPath cannot start (Windows + WSL only)
 npm run probe:picker         # list the picker's root level, refusals and its cap (Windows + WSL only)
 npm run probe:mode           # which POSIX-mode facts survive the share (Windows node only)

package/agent/wsl-agent.sh

@@ -18,10 +18,31 @@
 #   SHUTDOWN                      -> exits 0
 #   KILL|<id>                     -> SIGTERM the in-flight request with that id
 #   SETENV|<key>|<b64 value>      -> export the variable for later requests
-#   EXEC|<id>|<b64 cwd>|<timeout seconds|0>|<n args>
+#   EXEC|<id>|<b64 cwd>|<timeout seconds|0>|<n args>|<output cap bytes|0>
 #       followed by <n args> lines of base64, one argv word each
-#       -> RES|<id>|<exit code>|<b64 stdout>|<b64 stderr>
+#       -> ACK|<id> the moment the request is dequeued for execution — the host
+#          arms its stuck-request watchdog on this line, so time spent queued
+#          behind an earlier request never counts against a budget
+#       -> RES|<id>|<exit code>|<b64 stdout>|<b64 stderr>|<stdout cut?1:0>|<stderr cut?1:0>
+#          With a cap, stdout and stderr are each cut at that many bytes and
+#          the flags say which streams were cut; 0 means the whole capture.
 #          or ERR|<id>|<reason>|<b64 message>   (reason: cwd)
+#   FS|<id>|<op>|<timeout seconds|0>|<n args>
+#       followed by <n args> lines of base64, one argument each — arguments
+#       arrive still base64 so a write's content never passes through a shell
+#       variable as bytes
+#       ops:  stat <path> · lstat <path> · list <dir> · realpath <path>
+#             read <path> <offset> <maxbytes> · write <path> <mode|->
+#                  <replace|no-replace> <expected version|-> <content-b64>
+#       -> ACK|<id> at dequeue, then the same RES|<id>|<exit code>|<b64
+#          stdout>|<b64 stderr> line as EXEC.
+#          A failed op writes `dsh-fs|<reason>|<b64 message>` as the FIRST line
+#          of its stderr (reason: notfound notdir perm loop exists stale io),
+#          which the host's adapter maps onto the FsError codes the tool layer
+#          knows. A `replace` write carrying an expected version re-verifies it
+#          against a fresh stat one syscall before the rename and refuses with
+#          `stale` on a mismatch — the concurrent writer wins, the model's
+#          stale write does not land.
 #
 # Confinement is NOT this script's business: the host wraps argv in the bwrap
 # profile (lib/sandbox.js) before the frame is sent, so the agent executes
@@ -32,7 +53,7 @@
 
 set -u
 
-PROTO_VERSION=1
+PROTO_VERSION=3
 TMPDIR_AGENT=$(mktemp -d "${TMPDIR:-/tmp}/wsl-agent.XXXXXX")
 OUT_FILE="$TMPDIR_AGENT/out"
 ERR_FILE="$TMPDIR_AGENT/err"
@@ -76,6 +97,320 @@ timeout_watcher() {
   kill -KILL "$2" 2>/dev/null
 }
 
+# Capture one request's output and answer with RES. $1 = request id, $2 =
+# timeout seconds ('' or 0 = none), $3 = per-stream output cap in bytes (0 or
+# empty = unlimited), $4 = launch mode: `exec` runs "$@" (argv words) as the
+# request process; `subshell` runs ( "$@" ) in a forked subshell, which is how
+# the FS handlers — shell functions, not executables — run.
+run_capture() {
+  local req_id timeout_s maxout mode rc watcher_pid out_cut err_cut
+  req_id=$1
+  timeout_s=$2
+  maxout=$3
+  mode=$4
+  shift 4
+  case $maxout in
+    ''|*[!0-9]*) maxout=0 ;;
+  esac
+  : >"$OUT_FILE"
+  : >"$ERR_FILE"
+  CURRENT_ID=$req_id
+  if [ "$mode" = subshell ]; then
+    ( "$@" ) >"$OUT_FILE" 2>"$ERR_FILE" &
+  else
+    "$@" >"$OUT_FILE" 2>"$ERR_FILE" &
+  fi
+  CURRENT_PID=$!
+  watcher_pid=
+  case $timeout_s in
+    ''|0) ;;
+    *)
+      timeout_watcher "$timeout_s" "$CURRENT_PID" 3 &
+      watcher_pid=$!
+      ;;
+  esac
+  wait "$CURRENT_PID"
+  rc=$?
+  CURRENT_PID=
+  CURRENT_ID=
+  if [ -n "$watcher_pid" ]; then
+    kill "$watcher_pid" 2>/dev/null
+    wait "$watcher_pid" 2>/dev/null
+  fi
+  # The cap is what keeps a chatty command from becoming a multi-gigabyte
+  # base64 blob inside THIS shell's command substitution: only the first
+  # $maxout bytes of each stream are encoded, and the flags tell the host
+  # which streams were cut. FS frames pass 0 — their payloads are the host's
+  # own read windows, already bounded by the protocol.
+  out_cut=0
+  err_cut=0
+  if [ "$maxout" -gt 0 ]; then
+    [ "$(wc -c <"$OUT_FILE" 2>/dev/null || printf 0)" -gt "$maxout" ] && out_cut=1
+    [ "$(wc -c <"$ERR_FILE" 2>/dev/null || printf 0)" -gt "$maxout" ] && err_cut=1
+    printf 'RES|%s|%s|%s|%s|%s|%s\n' "$req_id" "$rc" \
+      "$(head -c "$maxout" -- "$OUT_FILE" | base64 | tr -d '\n')" \
+      "$(head -c "$maxout" -- "$ERR_FILE" | base64 | tr -d '\n')" \
+      "$out_cut" "$err_cut"
+  else
+    printf 'RES|%s|%s|%s|%s|%s|%s\n' "$req_id" "$rc" \
+      "$(b64enc_file "$OUT_FILE")" "$(b64enc_file "$ERR_FILE")" 0 0
+  fi
+}
+
+# --- filesystem substrate (FS frames) -------------------------------------
+#
+# The model's file tools run HERE, against ext4, instead of through the 9p
+# share. Every handler reports failure as `dsh-fs|<reason>|<b64 message>` on
+# stderr with a nonzero exit; reasons classify the coreutils error text, which
+# is why the handlers pin LC_ALL=C.
+
+fs_fail() {
+  # $1 = reason token, $2 = message. Exits 1 (the caller's RES carries it).
+  # Stderr is the op's error channel; stdout stays pure payload.
+  printf 'dsh-fs|%s|%s\n' "$1" "$(printf '%s' "$2" | base64 | tr -d '\n')" >&2
+  exit 1
+}
+
+fs_classify() {
+  # $1 = captured command stderr -> one reason token on stdout. Message
+  # matching across coreutils vintages: newer gettext says "Already exists"
+  # where older said "File exists".
+  case $1 in
+    *"No such file"*|*"not found"*) printf 'notfound' ;;
+    *"Not a directory"*) printf 'notdir' ;;
+    *"Permission denied"*) printf 'perm' ;;
+    *"Too many levels"*|*"Too many symbolic links"*) printf 'loop' ;;
+    *"File exists"*|*"Already exists"*) printf 'exists' ;;
+    *) printf 'io' ;;
+  esac
+}
+
+fs_stat() {
+  # $1 = `-L` (follow) or empty (lstat), $2 = base64 path. Emits one
+  # TAB-separated record: type mode size dev ino mtime ctime, produced by the
+  # SAME `find -printf` directives the list walk uses — `stat`'s own %.9Y
+  # rounds timestamps to microseconds where find is ns-exact, and one file
+  # then carried TWO different version strings depending on which op answered
+  # (a uutils distro). The host normalizes them into the version string.
+  local p out ftype
+  p=$(b64dec "$2")
+  out=$(find $1 "$p" -maxdepth 0 -printf '%y\t%m\t%s\t%D\t%i\t%T@\t%C@' 2>"$ERR_FILE") || {
+    fs_fail "$(fs_classify "$(cat "$ERR_FILE")")" "$(cat "$ERR_FILE")"
+  }
+  if [ "$1" = "-L" ]; then
+    # `find -L` reports a link it cannot resolve (dangling) as the link
+    # itself; the `stat -L` this op replaces failed on it with ENOENT, and
+    # the peer's probe is null for exactly that — so refuse the same way.
+    if [ "$(printf '%s' "$out" | cut -f1)" = l ]; then
+      fs_fail notfound "cannot stat \"$p\": the link does not resolve"
+    fi
+  fi
+  printf '%s\n' "$out"
+}
+
+fs_list() {
+  # $1 = base64 directory. One `find` pass, NUL-delimited records of
+  # `type size dev ino mtime ctime path`. No `-L`: the type is the entry's own
+  # (lstat), so a symlink is VISIBLE as `l` and the host resolves its target's
+  # stat and identity with one follow-up per link — the peer lists follow-stats
+  # but has to know which entries are links all the same. Names are safe inside
+  # records (records split on NUL, names taken after the 6th TAB).
+  local d err
+  d=$(b64dec "$1")
+  find "$d" -mindepth 1 -maxdepth 1 -printf '%y\t%s\t%D\t%i\t%T@\t%C@\t%p\0' 2>"$ERR_FILE" || {
+    err=$(cat "$ERR_FILE")
+    fs_fail "$(fs_classify "$err")" "$err"
+  }
+}
+
+fs_realpath() {
+  # $1 = base64 path. The distro-side identity: the strict realpath, and on
+  # ENOENT the nearest existing ancestor with the missing suffix appended —
+  # fsio's `resolveLocalTarget` walk, run where the symlinks actually live.
+  local p anc r suffix err
+  p=$(b64dec "$1")
+  if r=$(realpath -e -- "$p" 2>/dev/null); then
+    printf '%s' "$r"
+    return 0
+  fi
+  anc=$(dirname -- "$p")
+  while : ; do
+    if r=$(realpath -e -- "$anc" 2>/dev/null); then
+      suffix=${p#"$anc"}
+      case $suffix in
+        # Mirrors fsio's substring check, ".." inside the missing suffix is a
+        # traversal across a missing directory, refused rather than joined.
+        *..*) fs_fail notfound "cannot resolve \"$p\": parent traversal crosses a missing directory" ;;
+      esac
+      printf '%s' "$r$suffix"
+      return 0
+    fi
+    err=$(dirname -- "$anc")
+    [ "$err" = "$anc" ] && break
+    anc=$err
+  done
+  err=$(realpath -e -- "$p" 2>&1)
+  fs_fail "$(fs_classify "$err")" "$err"
+}
+
+fs_read() {
+  # $1 = base64 path, $2 = base64 byte offset, $3 = base64 max bytes. The
+  # window is the bound: at most $3 bytes leave the distro per request; the
+  # host loops.
+  local p offset max rd err
+  p=$(b64dec "$1")
+  offset=$(b64dec "$2")
+  max=$(b64dec "$3")
+  [ "$max" -gt 0 ] || return 0
+  rd="$TMPDIR_AGENT/read"
+  tail -c +"$(( offset + 1 ))" -- "$p" >"$rd" 2>"$ERR_FILE" || {
+    err=$(cat "$ERR_FILE")
+    fs_fail "$(fs_classify "$err")" "$err"
+  }
+  head -c "$max" -- "$rd"
+}
+
+norm_time() {
+  # `seconds.fraction` in the host's 19-digit spelling: the fraction padded to
+  # nine digits (truncated beyond), whole seconds padded when the distro's
+  # stat has no fraction at all. This is what the host's `nanoseconds()`
+  # produces from fs_stat's directives, so the strings compare equal.
+  local s=${1%%.*} f=${1#*.}
+  if [ "$f" = "$1" ]; then
+    f=""
+  fi
+  while [ ${#f} -lt 9 ]; do
+    f="${f}0"
+  done
+  printf '%s%.9s' "$s" "$f"
+}
+
+fs_version() {
+  # One path's version string from the SAME producer the stat and list ops
+  # use (`find -printf`), joined the way the host joins a stat record's five
+  # ingredients. Empty output (non-zero) means the path is gone.
+  local out dev ino size mtime ctime
+  out=$(find "$1" -maxdepth 0 -printf '%D\t%i\t%s\t%T@\t%C@' 2>/dev/null) || return 1
+  dev=$(printf '%s' "$out" | cut -f1)
+  ino=$(printf '%s' "$out" | cut -f2)
+  size=$(printf '%s' "$out" | cut -f3)
+  mtime=$(printf '%s' "$out" | cut -f4)
+  ctime=$(printf '%s' "$out" | cut -f5)
+  printf '%s:%s:%s:%s:%s' "$dev" "$ino" "$size" "$(norm_time "$mtime")" "$(norm_time "$ctime")"
+}
+
+fs_write() {
+  # $1 = base64 path, $2 = base64 mode (`-` keeps none), $3 = base64
+  # `replace` or `no-replace`, $4 = expected version (`-` for none) — the
+  # version string this write was based on, re-verified one syscall before the
+  # rename so a concurrent writer wins instead of being clobbered — and $5 =
+  # content STILL base64. Mirrors fsio's POSIX publication: a private 0700
+  # sibling staging dir, a 0600 temp, fsync, chmod, then an atomic rename — or
+  # a hard link that refuses to replace for guarded creates.
+  local path mode publish expected dir base staging tmp u err version
+  path=$(b64dec "$1")
+  mode=$(b64dec "$2")
+  publish=$(b64dec "$3")
+  expected=$(b64dec "$4")
+  dir=$(dirname -- "$path")
+  base=$(basename -- "$path")
+  [ -n "$base" ] && [ "$base" != "/" ] || fs_fail notfound "empty file name"
+  mkdir -p -- "$dir" 2>"$ERR_FILE" || {
+    err=$(cat "$ERR_FILE")
+    fs_fail "$(fs_classify "$err")" "$err"
+  }
+  u=$(head -c 8 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n')
+  staging="$dir/.$base.$$.${u:-0}.tmpdir"
+  mkdir -- "$staging" 2>"$ERR_FILE" || {
+    # A read-only bind names itself here — the kernel refusing what the policy
+    # granted — so the real stderr travels, not a paraphrase of it.
+    err=$(cat "$ERR_FILE")
+    fs_fail "$(fs_classify "$err")" "$err"
+  }
+  chmod 700 -- "$staging" 2>/dev/null
+  tmp="$staging/$base.tmp"
+  # Decode straight to the file: the base64 text is the one form that crosses
+  # a shell variable without a NUL-byte or quoting hazard.
+  printf '%s' "$5" | base64 -d >"$tmp" 2>/dev/null || {
+    rm -rf -- "$staging"
+    fs_fail io "cannot stage content"
+  }
+  chmod 600 -- "$tmp"
+  sync -f -- "$tmp" 2>/dev/null || :
+  if [ "$mode" != "-" ]; then
+    chmod "$mode" -- "$tmp" 2>"$ERR_FILE" || {
+      err=$(cat "$ERR_FILE")
+      rm -rf -- "$staging"
+      fs_fail io "$err"
+    }
+  fi
+  if [ "$publish" = "replace" ] && [ -n "$expected" ] && [ "$expected" != "-" ]; then
+    # The version the overwrite/edit was based on is re-verified HERE — one
+    # syscall before the rename, where the host's round-trip-wide window was.
+    # The producer is fs_stat's own stat directives, so this comparison never
+    # trips the stat/find skew a list-derived version would.
+    version=$(fs_version "$path")
+    if [ "$version" != "$expected" ]; then
+      rm -rf -- "$staging"
+      if [ -n "$version" ]; then
+        fs_fail stale "cannot write \"$path\": file changed since it was read"
+      fi
+      fs_fail stale "cannot write \"$path\": file no longer exists"
+    fi
+  fi
+  if [ "$publish" = "no-replace" ]; then
+    # Coreutils `ln` resolves an existing DIRECTORY destination (linking beside
+    # it) where the peer's link(2) refuses any existing path, so the existence
+    # guard is checked before the call and the landing spot verified after it.
+    if [ -e "$path" ] || [ -L "$path" ]; then
+      rm -rf -- "$staging"
+      fs_fail exists "cannot write \"$path\": it already exists"
+    fi
+    ln -- "$tmp" "$path" 2>"$ERR_FILE" || {
+      err=$(cat "$ERR_FILE")
+      rm -rf -- "$staging"
+      # A concurrent creator wins the race; classify by what is on disk now.
+      if [ -e "$path" ] || [ -L "$path" ]; then
+        fs_fail exists "$err"
+      fi
+      fs_fail "$(fs_classify "$err")" "$err"
+    }
+    if ! [ "$tmp" -ef "$path" ]; then
+      # ln linked BESIDE the target (a directory appeared under us): undo the
+      # stray link and refuse, the guarded create did not publish.
+      rm -f -- "$path/${base}.tmp"
+      rm -rf -- "$staging"
+      fs_fail exists "cannot write \"$path\": it was created concurrently"
+    fi
+  else
+    mv -f -- "$tmp" "$path" 2>"$ERR_FILE" || {
+      err=$(cat "$ERR_FILE")
+      rm -rf -- "$staging"
+      fs_fail "$(fs_classify "$err")" "$err"
+    }
+  fi
+  rm -rf -- "$staging"
+}
+
+fs_dispatch() {
+  # $1 = op, $2.. = raw base64 arguments (handlers decode what they need to
+  # treat as a path; write's content stays base64 until it hits the file).
+  local op
+  op=$1
+  shift
+  LC_ALL=C
+  export LC_ALL=C
+  case $op in
+    stat)     fs_stat -L "$1" ;;
+    lstat)    fs_stat "" "$1" ;;
+    list)     fs_list "$1" ;;
+    realpath) fs_realpath "$1" ;;
+    read)     fs_read "$1" "$2" "$3" ;;
+    write)    fs_write "$1" "$2" "$3" "$4" "$5" ;;
+    *)        fs_fail notfound "unknown fs op" ;;
+  esac
+}
+
 printf 'HELLO|wsl-agent|%s\n' "$PROTO_VERSION"
 
 while IFS= read -r line; do
@@ -108,7 +443,9 @@ while IFS= read -r line; do
       cwd_b64=${rest%%|*}
       rest=${rest#*|}
       timeout_s=${rest%%|*}
-      nargs=${rest#*|}
+      rest=${rest#*|}
+      nargs=${rest%%|*}
+      maxout=${rest#*|}
       cwd=$(b64dec "$cwd_b64")
       if ! cd "$cwd" 2>/dev/null; then
         printf 'ERR|%s|cwd|%s\n' "$req_id" "$(printf '%s' "$cwd" | base64 | tr -d '\n')"
@@ -123,28 +460,33 @@ while IFS= read -r line; do
         n=$((n + 1))
         set -- "$@" "$(b64dec "$arg_b64")"
       done
-      : >"$OUT_FILE"
-      : >"$ERR_FILE"
-      CURRENT_ID=$req_id
-      "$@" >"$OUT_FILE" 2>"$ERR_FILE" &
-      CURRENT_PID=$!
-      watcher_pid=
-      case $timeout_s in
-        ''|0) ;;
-        *)
-          timeout_watcher "$timeout_s" "$CURRENT_PID" 3 &
-          watcher_pid=$!
-          ;;
-      esac
-      wait "$CURRENT_PID"
-      rc=$?
-      CURRENT_PID=
-      CURRENT_ID=
-      if [ -n "$watcher_pid" ]; then
-        kill "$watcher_pid" 2>/dev/null
-        wait "$watcher_pid" 2>/dev/null
-      fi
-      printf 'RES|%s|%s|%s|%s\n' "$req_id" "$rc" "$(b64enc_file "$OUT_FILE")" "$(b64enc_file "$ERR_FILE")"
+      # Dispatched: tell the host now, so its watchdog measures execution and
+      # not the queue wait this request just went through.
+      printf 'ACK|%s\n' "$req_id"
+      run_capture "$req_id" "$timeout_s" "$maxout" exec "$@"
+      ;;
+    FS\|*)
+      header=${line#FS|}
+      req_id=${header%%|*}
+      rest=${header#*|}
+      op=${rest%%|*}
+      rest=${rest#*|}
+      timeout_s=${rest%%|*}
+      nargs=${rest#*|}
+      # Arguments stay base64 (write's content must never become a shell
+      # variable of raw bytes); handlers decode what they treat as a path.
+      set --
+      n=0
+      while [ "$n" -lt "$nargs" ]; do
+        IFS= read -r arg_b64 || break
+        n=$((n + 1))
+        set -- "$@" "$arg_b64"
+      done
+      # Same dispatch signal as EXEC: the FS budget starts at the op, not at
+      # the queue position. No capture cap — the payloads are the host's own
+      # read windows, bounded by the protocol.
+      printf 'ACK|%s\n' "$req_id"
+      run_capture "$req_id" "$timeout_s" 0 subshell fs_dispatch "$op" "$@"
       ;;
     *)
       printf 'ERR||protocol|%s\n' "$(printf '%s' "unrecognized request" | base64 | tr -d '\n')"

package/cordis.patch.yml

@@ -168,6 +168,13 @@
                 config:
                   distro: ''
                   restrictToDistro: true
+                  # agent (the default): reads/writes/identities run inside the
+                  # distro over the resident agent (lib/fs-substrate.js) —
+                  # native symlinks and mode bits, the write guard survives to
+                  # publication, and confined mutations are kernel-enforced.
+                  # share: the opt-out — the Windows-side host fs stack over
+                  # the 9p share.
+                  substrate: agent
               - id: persona
                 name: '@deepseek-ai/dsh-persona'
                 config: