dsh-plugin-wsl-env 0.8.0 → 0.10.0

package/lib/workspace-files-wsl.js

@@ -162,11 +162,13 @@ export async function distroStat({ runner, distro, linuxRoot, path, distroWorksp
     const linuxFile = linuxJoin(linuxRoot, path);
     const result = await runner.exec({
         cwd: "/",
-        argv: statRecordArgv(linuxFile),
+        argv: statRecordArgv(linuxFile, linuxRoot),
         maxOutputBytes: 4096,
         timeoutMs: 30_000,
         signal,
     });
+    if (result.exitCode === 3)
+        throw outsideWorkspace(path);
     if (result.exitCode !== 0)
         throw notFound(path);
     const record = parseStatRecord(result.stdout);
@@ -186,11 +188,13 @@ export async function distroRead({ runner, distro, linuxRoot, path, offset, limi
     const linuxFile = linuxJoin(linuxRoot, path);
     const result = await runner.exec({
         cwd: "/",
-        argv: pageArgv(linuxFile, offset, limit),
+        argv: pageArgv(linuxFile, offset, limit, linuxRoot),
         maxOutputBytes: (maxBytes + 1) * 4,
         timeoutMs: 60_000,
         signal,
     });
+    if (result.exitCode === 3)
+        throw outsideWorkspace(path);
     if (result.exitCode === 2)
         throw notFound(path);
     if (result.exitCode !== 0 && result.exitCode !== 1) {
@@ -213,16 +217,27 @@ export async function distroRead({ runner, distro, linuxRoot, path, offset, limi
     catch {
         throw notText(path);
     }
-    const lines = text.length === 0 ? 0 : text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
-    const bytes = Buffer.byteLength(text, "utf8") + lines;
+    // `pageArgv` reads one line past the page so EOF is decidable from the
+    // yield; that line is a probe, not part of the answer. Split it off before
+    // counting, and count bytes on the page the caller actually receives (a
+    // CRLF file's line count is not a byte budget).
+    const parts = text.length === 0 ? [] : text.split("\n");
+    if (text.endsWith("\n"))
+        parts.pop();
+    const count = parts.length;
+    const truncated = count > limit;
+    const kept = truncated ? parts.slice(0, limit) : parts;
+    const pageText = truncated ? `${kept.join("\n")}\n` : text;
+    const lines = kept.length;
+    const bytes = Buffer.byteLength(pageText, "utf8");
     if (bytes > maxBytes) {
         throw new RemoteError("workspace-file/too-large", `lines ${offset}-${offset + limit - 1} of "${path}" exceed the ${maxBytes} byte cap`, { path, limit: maxBytes });
     }
-    if (text.includes(String.fromCharCode(0)))
+    if (pageText.includes(String.fromCharCode(0)))
         throw notText(path);
-    const eof = lines < limit;
+    const eof = !truncated;
     const stat = { absolutePath: posixToUnc(distro, linuxFile), version: record.version };
-    return { ...stat, offset, text, lines, eof };
+    return { ...stat, offset, text: pageText, lines, eof };
 }
 /**
  * Read one byte window (or the capped whole file) through the runner.
@@ -248,11 +263,13 @@ export async function distroReadBytes({ runner, distro, linuxRoot, path, offset,
         throw windowTooLarge(path, window.length, maxBytes);
     const result = await runner.exec({
         cwd: "/",
-        argv: bytesArgv(linuxFile, window.offset, window.length),
+        argv: bytesArgv(linuxFile, window.offset, window.length, linuxRoot),
         maxOutputBytes: window.length + 1024,
         timeoutMs: 60_000,
         signal,
     });
+    if (result.exitCode === 3)
+        throw outsideWorkspace(path);
     const record = parseStatRecordFromStderr(result.stderr);
     if (record === undefined)
         throw notFound(path);

package/lib/wsl.js

@@ -104,8 +104,11 @@ export function parseDistroList(stdout) {
  */
 export async function defaultDistro(options = {}) {
     const [first] = await listDistros(options);
-    if (first === undefined)
-        throw new Error("dsh-plugin-wsl: no WSL distro is installed (`wsl.exe -l -q` returned nothing)");
+    if (first === undefined) {
+        throw new Error("dsh-plugin-wsl: no WSL distro is installed (`wsl.exe -l -q` returned nothing). " +
+            "Install one: `wsl.exe --list --online` lists the available names, then `wsl --install -d <name>`, " +
+            "or point this row's `distro` at an existing one.");
+    }
     return first;
 }
 /**
@@ -134,7 +137,8 @@ export async function linuxHomePath(distro, options = {}) {
 export function parseHomePath(distro, stdout) {
     const home = String(stdout).trim();
     if (home.length === 0 || !home.startsWith("/")) {
-        throw new Error(`dsh-plugin-wsl: distro "${distro}" reported no usable $HOME (got "${home}")`);
+        throw new Error(`dsh-plugin-wsl: distro "${distro}" reported no usable $HOME (got "${home}"). ` +
+            `Check the distro's default user in /etc/wsl.conf, and that the user's /etc/passwd entry carries a home directory.`);
     }
     return home;
 }
@@ -337,7 +341,9 @@ export async function defaultShell(distro, options = {}) {
 export async function runInDistro(distro, command, options = {}) {
     const shell = options.shell ?? (await defaultShell(distro, options));
     if (shell === undefined) {
-        throw new Error(`dsh-plugin-wsl: distro "${distro}" named no usable shell (passwd probe and $SHELL both failed)`);
+        throw new Error(`dsh-plugin-wsl: distro "${distro}" named no usable shell (passwd probe and $SHELL both failed). ` +
+            `Check the user's login shell in /etc/passwd (\`getent passwd "$(id -u)"\` inside the distro), ` +
+            `or point this row's \`shell\` at an existing absolute path.`);
     }
     return runCapture([options.wslPath ?? DEFAULT_WSL_PATH, "-d", distro, "--exec", shell, ...shellArgs(shell, options.loginShell !== false), command], options.signal);
 }

package/locale/preflight/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "WSL sandbox preflight",
+    "description": "Probes bubblewrap when a distro session opens and surfaces a missing or unusable bwrap as a warning with the exact remedy — instead of the first command's fail-closed error being the discovery moment. Advisory only; never installs anything."
+  }
+}

package/locale/preflight/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "WSL 沙箱预检",
+    "description": "发行版会话打开时探测 bubblewrap，把缺失或不可用的 bwrap 连同确切的修复指引作为警告提前给出——而不是让第一条命令的 fail-closed 报错充当发现时刻。纯建议性，绝不安装任何东西。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-wsl-env",
-  "version": "0.8.0",
-  "description": "让 DeepSeek Harness 以 WSL 子系统作为会话的执行环境：shell、文件读写与命令执行均在子系统内完成，目录选择器与 GUI 终端同样定位到子系统路径，并通过子系统内的 bubblewrap 对命令进行沙箱隔离",
+  "version": "0.10.0",
+  "description": "\u8ba9 DeepSeek Harness \u4ee5 WSL \u5b50\u7cfb\u7edf\u4f5c\u4e3a\u4f1a\u8bdd\u7684\u6267\u884c\u73af\u5883\uff1ashell\u3001\u6587\u4ef6\u8bfb\u5199\u4e0e\u547d\u4ee4\u6267\u884c\u5747\u5728\u5b50\u7cfb\u7edf\u5185\u5b8c\u6210\uff0c\u76ee\u5f55\u9009\u62e9\u5668\u4e0e GUI \u7ec8\u7aef\u540c\u6837\u5b9a\u4f4d\u5230\u5b50\u7cfb\u7edf\u8def\u5f84\uff0c\u5e76\u901a\u8fc7\u5b50\u7cfb\u7edf\u5185\u7684 bubblewrap \u5bf9\u547d\u4ee4\u8fdb\u884c\u6c99\u7bb1\u9694\u79bb",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -47,12 +47,18 @@
       "types": "./lib/paths.d.ts",
       "default": "./lib/paths.js"
     },
+    "./preflight": {
+      "types": "./lib/preflight.d.ts",
+      "default": "./lib/preflight.js"
+    },
     "./picker": {
       "types": "./lib/picker.d.ts",
       "default": "./lib/picker.js"
     },
     "./picker/locale/en.json": "./locale/picker/en.json",
     "./picker/locale/zh.json": "./locale/picker/zh.json",
+    "./preflight/locale/en.json": "./locale/preflight/en.json",
+    "./preflight/locale/zh.json": "./locale/preflight/zh.json",
     "./shell": {
       "types": "./lib/shell.d.ts",
       "default": "./lib/shell.js"
@@ -87,6 +93,7 @@
     "lib/**/*.js",
     "lib/**/*.d.ts",
     "agent/*.sh",
+    "agent/native/linux-*/dsh-wsl-agent",
     "locale/**/*.json",
     "cordis.patch.yml",
     "examples/**/*.yml",
@@ -104,16 +111,17 @@
     "SECURITY.md",
     "SUPPORT.md",
     "LICENSE",
-    "scripts/bootstrap.sh"
+    "scripts/bootstrap.sh",
+    "scripts/diagnose.sh"
   ],
   "scripts": {
     "test": "pnpm run lint:style && pnpm run test:syntax && pnpm run lint:build && pnpm run lint:types && pnpm run test:unit",
     "lint:types": "tsc --noEmit",
     "build": "node scripts/build.mjs",
     "lint:build": "node test/build-freshness.mjs",
-    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/fs.boot.test.mjs test/shell.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs",
+    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs",
     "test:syntax": "node test/syntax.mjs",
-    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/fsio-text.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs",
+    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/fsio-text.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs",
     "lint:style": "node test/style.mjs",
     "prepublishOnly": "pnpm test",
     "probe": "bash test/probe/run.sh",
@@ -129,7 +137,8 @@
     "probe:agent": "bash test/probe/agent.sh",
     "probe:substrate": "bash test/probe/substrate.sh",
     "probe:exec": "bash test/probe/exec.sh",
-    "bootstrap": "bash scripts/bootstrap.sh"
+    "bootstrap": "bash scripts/bootstrap.sh",
+    "diagnose": "bash scripts/diagnose.sh"
   },
   "packageManager": "pnpm@11.7.0",
   "engines": {
@@ -153,40 +162,45 @@
     "url": "https://github.com/Big-Dao/dsh-plugin-wsl-env/issues"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/cordis": "4.0.5",
     "@deepseek-ai/cordis-plugin-include": "*",
     "@deepseek-ai/cordis-plugin-loader": "*",
-    "@deepseek-ai/dsh-api-workspace-files": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-bash-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-api-workspace-files": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "~22.20.5",
     "js-yaml": "4.3.2",
     "typescript": "~6.0.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-bash-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.4"
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-api-workspace-files": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.5"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
       "optional": true
     },
+    "@deepseek-ai/dsh-api-workspace-files": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-bash-local": {
       "optional": true
     },
@@ -208,6 +222,9 @@
     "@deepseek-ai/dsh-subprocess-local": {
       "optional": true
     },
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    },
     "@deepseek-ai/schemastery": {
       "optional": true
     }

package/scripts/diagnose.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Collect a read-only diagnostic report for a bug report, in one command:
+#
+#     pnpm run diagnose -- [distro]     # distro optional; default distro otherwise
+#
+# Prints versions and probe verdicts as plain text that can be pasted into an
+# issue as-is. It runs NO installation, changes nothing in the distro, and reads
+# nothing secret: the report is tool versions, a kernel release and probe
+# verdicts. Exit code is always 0 — the report is informational; the verdict
+# lines carry the failures.
+#
+# Deeper sandbox probing lives in `npm run probe:sandbox` (run inside the
+# distro); this script answers "what is installed and does bwrap run at all".
+
+set -u
+export WSL_UTF8=1 # wsl.exe writes UTF-16LE without it; read as UTF-8 that is mojibake
+
+DISTRO="${1:-}"
+
+ok()    { printf 'ok        %s\n' "$1"; }
+miss()  { printf 'MISSING   %s\n' "$1"; }
+info()  { printf 'info      %s\n' "$1"; }
+header(){ printf '\n== %s ==\n' "$1"; }
+
+echo "# dsh-plugin-wsl-env diagnose report"
+
+header "host"
+winver="$(cmd.exe /c ver 2>/dev/null | tr -d '\r' | grep -o '[0-9][0-9.]*' | head -1)"
+if [ -n "$winver" ]; then ok "windows build $winver"; else info "windows build unknown (cmd.exe not reachable through interop)"; fi
+wsl_ver="$(wsl.exe --version 2>/dev/null | tr -d '\0\r' | head -2 | tr '\n' ' ')"
+if [ -n "$wsl_ver" ]; then ok "wsl: $wsl_ver"; else info "wsl --version unsupported on this WSL build"; fi
+wsl_status="$(wsl.exe --status 2>/dev/null | tr -d '\0\r' | tr '\n' ' ')"
+[ -n "$wsl_status" ] && info "wsl status: $wsl_status"
+wsl.exe -l -v 2>/dev/null | tr -d '\0\r' | grep -v '^$' | sed 's/^/          /'
+
+header "plugin"
+echo "          plugin version: $(node -p "require('./package.json').version" 2>/dev/null || echo unknown)"
+echo "          dsh version: $(dsh --version 2>/dev/null || echo unknown)"
+
+if [ -z "$DISTRO" ]; then
+  DISTRO="$(wsl.exe -l -q 2>/dev/null | tr -d '\0\r' | grep -v '^$' | head -1)"
+fi
+if [ -z "$DISTRO" ]; then
+  header "distro"
+  miss "no distro installed — 'wsl.exe --list --online' lists names, 'wsl --install -d <name>' installs one"
+  exit 0
+fi
+
+header "distro: $DISTRO"
+in_distro() { wsl.exe -d "$DISTRO" --exec sh -c "$1" 2>/dev/null; }
+
+info "kernel: $(in_distro 'uname -r')"
+family="$(in_distro 'for m in apt-get dnf pacman zypper; do command -v $m && break; done' | tr -d '\r')"
+case "$family" in
+  *apt-get) info "package family: apt" ;;
+  *dnf)     info "package family: dnf" ;;
+  *pacman)  info "package family: pacman" ;;
+  *zypper)  info "package family: zypper" ;;
+  *)        info "package family: unknown" ;;
+esac
+
+for tool in bwrap rg git inotifywait; do
+  if in_distro "command -v $tool" | grep -q .; then
+    case "$tool" in
+      bwrap)       ver="$(in_distro 'bwrap --version' | tr -d '\r' | head -1)" ;;
+      rg)          ver="$(in_distro 'rg --version' | tr -d '\r' | head -1)" ;;
+      git)         ver="$(in_distro 'git --version' | tr -d '\r' | head -1)" ;;
+      inotifywait) ver="inotifywait (no version flag)" ;;
+    esac
+    ok "$ver"
+  else
+    case "$tool" in
+      bwrap)       miss "bwrap — REQUIRED; every confined command fails closed without it. Install: wsl.exe -d $DISTRO -u root -- apt-get install -y bubblewrap (or: pnpm run bootstrap -- $DISTRO --install)" ;;
+      rg)          miss "ripgrep — the search tool falls back to slower matching without it" ;;
+      git)         miss "git — snapshot and diff baselines degrade without it" ;;
+      inotifywait) miss "inotify-tools — file watching falls back to polling without it" ;;
+    esac
+  fi
+done
+
+if in_distro 'command -v bwrap' | grep -q .; then
+  if in_distro 'bwrap --ro-bind / / -- true'; then
+    ok "bwrap runs a read-only profile (the usability probe passes)"
+  else
+    miss "bwrap is installed but FAILED the read-only profile probe — likely the kernel (unprivileged user namespaces disabled) or an unusable build; reinstalling will not help"
+  fi
+fi
+
+header "notes"
+info "trace file: set DSH_WSL_TRACE=<path> to record the auto-preset decisions, then re-run the scenario"
+info "paste this report into the issue's Output section; redact anything you would rather not publish"
+exit 0