dsh-plugin-wsl-env 0.9.0 → 0.10.0

package/lib/watcher.js

@@ -8,21 +8,33 @@
  * whenever something under `target` may have changed. That is cheap to honor
  * from inside the distro, where the kernel does know.
  *
- * The watcher is a long-lived `wsl.exe` shell loop: periodically
+ * When `inotifywait` is installed and the target is an unbounded directory,
+ * the watcher uses inotify: recursive kernel watches, one `C` per 0.5s of
+ * events (a build's event storm is coalesced, the first event is immediate).
+ * Otherwise it falls back to the long-lived polling loop: every cadence,
  * `find <dir> -newer <stamp>` — the directory itself is in the scan, so
  * creations AND deletions (which bump the parent's mtime) are both seen — and
- * one `C` line per hit. No `inotifywait` dependency; the mtime walk is exact
- * for interactive-paced edits, which is the only pace a session watch serves.
+ * one `C` line per hit. A FILE target uses the `mtime:size` fingerprint (so a
+ * rename-over or an in-place write is seen), and a positive `maxDepth` keeps
+ * the polling scan because inotify cannot bound its own walk.
  *
  * The loop speaks three one-letter lines, the watcher protocol:
  *
  *   - `R` — READY: the activation barrier; the host resolves the watch promise
  *     on it, never before.
- *   - `C` — CHANGED: something under the target may have changed.
- *   - `E` — ERROR: the watched directory no longer exists, and the loop has
+ *   - `C` — CHANGED: the target may have changed.
+ *   - `E` — ERROR: the watched path no longer exists, and the loop has
  *     exited. Without it a vanished target would sit armed forever — `find`
  *     over a missing directory prints nothing, indistinguishable from "no
  *     changes" — so the loop says so and the host reports it.
+ *   - `P <pid>` — the loop shell's PID, sent before READY. The host uses it to
+ *     stop the loop with a second `wsl.exe` on close: killing the transport
+ *     alone does not reliably close the distro-side pipe.
+ *   - `H` — HEARTBEAT: liveness only, ignored by the host. It exists so the
+ *     loop notices a closed stdout pipe: the host's close kills `wsl.exe` but
+ *     cannot signal the distro-side shell, and without a write that shell
+ *     would sleep and poll forever. The `PIPE` trap turns that write's
+ *     SIGPIPE into a clean exit through the stamp-removing EXIT trap.
  *
  * Known blind spot, accepted and documented: a file created with an mtime
  * older than the stamp (`cp -p`, `tar -x`) is not seen until something else
@@ -38,14 +50,15 @@ import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 /**
  * The shell loop the watcher runs, parameterised by argv so no path can break
- * quoting: `$1` is the Linux directory, `$2` the poll interval in seconds.
- * Pure text, so it is unit-testable.
+ * quoting: `$1` is the Linux path (a directory or a file), `$2` the poll
+ * interval in seconds. Pure text, so it is unit-testable.
  *
  * @param intervalSeconds - poll cadence; must be >= 1.
- * @param maxDepth - bound the scan's depth, 1 = the directory
- *   itself and its direct children; 0 (the default) scans the whole tree,
- *   which is the contract's semantics but a real cost over a tree with a
- *   `node_modules` in it.
+ * @param maxDepth - bound the scan's depth for a DIRECTORY target, 1 = the
+ *   directory itself and its direct children; 0 (the default) scans the whole
+ *   tree, which is the contract's semantics. Positive values select the
+ *   polling scan (inotify is used only for the unbounded walk). A file target
+ *   ignores it.
  * @returns the `sh -c` script body.
  */
 export function watchLoopScript(intervalSeconds = 2, maxDepth = 0) {
@@ -56,37 +69,90 @@ export function watchLoopScript(intervalSeconds = 2, maxDepth = 0) {
     const depthArgs = depth > 0 ? ` -maxdepth ${depth}` : "";
     // `find` lists the directory itself first: a child's creation or deletion
     // bumps the parent's mtime, so both edges are seen, not just modifications.
+    // A FILE target has no tree to walk; its `mtime:size` fingerprint answers the
+    // same one-way question ("may have changed") and covers a rename-over too,
+    // since the path is re-stat'ed each tick.
     return [
         'D="$1"',
         'S="${TMPDIR:-/tmp}/wsl-watch.$$.stamp"',
+        'FIFO="${TMPDIR:-/tmp}/wsl-watch.$$.fifo"',
+        'IW=""',
         'touch "$S"',
-        // The stamp is the loop's private state, so every way out removes it. The
-        // EXIT trap covers plain exits; a signal alone would end the shell WITHOUT
-        // running it, so TERM/INT/HUP are trapped to a plain exit first.
-        "trap 'rm -f \"$S\"' EXIT",
-        "trap 'exit 0' TERM INT HUP",
-        // The READY line is the activation barrier: everything changed BEFORE it
-        // predates the stamp, so the host must not resolve the watch promise until
-        // it arrives — otherwise a write racing the first tick is invisible forever.
+        // The stamp/FIFO are the loop's private state, so every way out removes
+        // them. The EXIT trap covers plain exits; a signal alone would end the
+        // shell WITHOUT running it, so TERM/INT/HUP/PIPE are trapped to a plain
+        // exit first. `pkill -P $$` also reaps inotifywait/sleep/find.
+        "trap 'kill \"$IW\" 2>/dev/null; pkill -P $$ 2>/dev/null; exec 3>&- 2>/dev/null; rm -f \"$FIFO\" \"$S\" 2>/dev/null' EXIT",
+        "trap 'exit 0' TERM INT HUP PIPE",
+        'F=""',
+        '[ -f "$D" ] && F=$(stat -c "%Y:%s" -- "$D" 2>/dev/null || :)',
+        // Prefer inotify for an unbounded DIRECTORY watch: events are immediate and
+        // the kernel does the walking. A file target uses the fingerprint loop
+        // (it also reports a removal as E), and a bounded scan (maxDepth > 0)
+        // keeps the polling loop, which honors the bound.
+        `if [ -d "$D" ] && [ ${depth} -eq 0 ] && command -v inotifywait >/dev/null 2>&1; then`,
+        '  if mkfifo "$FIFO" 2>/dev/null; then',
+        '    exec 3<>"$FIFO"',
+        '    inotifywait -m -q -r -e create,delete,modify,move,attrib --format "%e" "$D" >"$FIFO" 2>/dev/null &',
+        '    IW=$!',
+        '  fi',
+        'fi',
+        // The PID precedes READY so a close can stop the loop even if the pipe
+        // stays open; killing wsl.exe alone does not close it reliably.
+        "printf 'P %s\\n' \"$$\"",
         "printf 'R\\n'",
-        // Check first, sleep second: a change made right after activation is seen
-        // on the first cadence, not one cadence later.
+        // One C per half second: a build's event storm becomes a coarse
+        // invalidation, while the first event is immediate. A quiet tree blocks
+        // in read; the close stops the shell through the P line, not the pipe.
+        'if [ -n "$IW" ]; then',
+        // A one-second marker on the same FIFO wakes the blocking read so the
+        // TERM trap and the vanished-target check run even on a quiet tree. The
+        // marker is not an event: it is skipped, and only checked against the
+        // target's existence.
+        '  ( while :; do sleep 1; printf \'H\\n\' >"$FIFO" 2>/dev/null; done ) &',
+        '  while read -r ev <&3; do',
+        '    if [ "$ev" = "H" ]; then',
+        '      [ -d "$D" ] || { printf \'E\\n\'; exit 1; }',
+        '      continue',
+        '    fi',
+        '    [ -d "$D" ] || { printf \'E\\n\'; exit 1; }',
+        "    printf 'C\\n'",
+        '    sleep 0.5',
+        '  done',
+        '  exec 3>&-',
+        'fi',
+        // Polling fallback: no inotifywait, a bounded scan, or inotifywait exited
+        // (a vanished target or an inotify limit). The stamp is the baseline.
         "while :; do",
-        '  if [ ! -d "$D" ]; then',
-        // Say so and die: silence here is the armed-forever, fires-never trap.
+        '  if [ -d "$D" ]; then',
+        `    if [ -n "$(find "$D"${depthArgs} -newer "$S" -print -quit 2>/dev/null)" ]; then`,
+        '      touch "$S"',
+        "      printf 'C\\n'",
+        '    fi',
+        '  elif [ -f "$D" ]; then',
+        '    cur=$(stat -c "%Y:%s" -- "$D" 2>/dev/null || :)',
+        '    if [ -z "$cur" ]; then',
+        // The file was removed (or became unreadable): the target is gone.
+        "      printf 'E\\n'",
+        '      exit 1',
+        '    fi',
+        '    if [ "$cur" != "$F" ]; then',
+        '      F="$cur"',
+        "      printf 'C\\n'",
+        '    fi',
+        '  else',
+        // Neither a directory nor a file: say so and die, rather than spin.
         "    printf 'E\\n'",
-        "    exit 1",
-        "  fi",
-        `  if [ -n "$(find "$D"${depthArgs} -newer "$S" -print -quit 2>/dev/null)" ]; then`,
-        '    touch "$S"',
-        "    printf 'C\\n'",
-        "  fi",
+        '    exit 1',
+        '  fi',
+        // Liveness: the host ignores H; the write dies with the pipe.
+        "  printf 'H\\n'",
         `  sleep ${seconds}`,
-        "done",
+        'done',
     ].join("\n");
 }
 /**
- * Arm one in-distro watcher over a Linux directory.
+ * Arm one in-distro watcher over a Linux directory or file.
  *
  * @param options - the watch request.
  * @returns resolves once observation is active, with the async close function
@@ -118,8 +184,15 @@ export function armDistroWatcher({ wslPath, distro, linuxPath, onChange, onError
             const detail = stderrTail.trim();
             return detail.length > 0 ? `${message}: ${detail}` : message;
         };
+        let loopPid;
         const lines = createInterface({ input: child.stdout });
         lines.on("line", (line) => {
+            if (line.startsWith("P ")) {
+                const pid = Number.parseInt(line.slice(2), 10);
+                if (Number.isInteger(pid) && pid > 0)
+                    loopPid = pid;
+                return;
+            }
             if (line === "R") {
                 if (!settled && !signal?.aborted) {
                     settled = true;
@@ -128,7 +201,7 @@ export function armDistroWatcher({ wslPath, distro, linuxPath, onChange, onError
                 return;
             }
             if (line === "E") {
-                fail(new Error(describe(`the watched directory "${linuxPath}" no longer exists inside "${distro}", so the watch has ended`)));
+                fail(new Error(describe(`the watched path "${linuxPath}" no longer exists inside "${distro}", so the watch has ended`)));
                 return;
             }
             if (line === "C") {
@@ -139,10 +212,25 @@ export function armDistroWatcher({ wslPath, distro, linuxPath, onChange, onError
             if (closed)
                 return;
             closed = true;
+            const pid = loopPid;
             child.removeAllListeners("exit");
             lines.close();
             child.stdout?.destroy();
             child.kill();
+            if (pid !== undefined) {
+                // A second wsl.exe reaches the same distro namespace; the loop's TERM
+                // trap exits through the EXIT cleanup, which removes the stamp.
+                try {
+                    const stopper = doSpawn(wslPath, ["-d", distro, "--exec", "sh", "-c", 'kill -TERM "$1" 2>/dev/null', "sh", String(pid)]);
+                    stopper.stdout?.destroy();
+                    stopper.stderr?.destroy();
+                    stopper.on("error", () => { });
+                    stopper.unref?.();
+                }
+                catch {
+                    // Best effort: the transport kill already happened.
+                }
+            }
             await new Promise((resolveClose) => {
                 if (child.exitCode !== null || child.signalCode !== null)
                     return resolveClose();

package/lib/workspace-files-route.d.ts

@@ -42,12 +42,14 @@ export declare function linuxJoin(linuxRoot: string, path: string): string;
 /**
  * The record invocation for one path: line 1 is the no-follow kind (the
  * upstream lstat gate), line 2 the follow-stat fields (the upstream final
- * stat), tab-joined.
+ * stat), tab-joined. The path is resolved and contained first — the GUI's
+ * workspace is a boundary for every read, not just for listings.
  *
  * @param file - absolute Linux path.
+ * @param root - the workspace root in Linux form (containment boundary).
  * @returns the agent argv.
  */
-export declare function statRecordArgv(file: string): string[];
+export declare function statRecordArgv(file: string, root: string): string[];
 /**
  * Parse one stat record (kind + follow fields, tab-joined).
  *
@@ -77,9 +79,10 @@ export declare function wireKind(kind: string): string;
  * @param file - absolute Linux path.
  * @param offset - first line to return (1-based).
  * @param limit - maximum lines to return.
+ * @param root - the workspace root in Linux form (containment boundary).
  * @returns the agent argv.
  */
-export declare function pageArgv(file: string, offset: number, limit: number): string[];
+export declare function pageArgv(file: string, offset: number, limit: number, root: string): string[];
 /**
  * The byte-window invocation: the stat record rides stderr, the window rides
  * stdout. `$1` is the file, `$2` the byte offset, `$3` the byte count.
@@ -87,9 +90,10 @@ export declare function pageArgv(file: string, offset: number, limit: number): s
  * @param file - absolute Linux path.
  * @param offset - byte offset (0-based).
  * @param length - byte count.
+ * @param root - the workspace root in Linux form (containment boundary).
  * @returns the agent argv.
  */
-export declare function bytesArgv(file: string, offset: number, length: number): string[];
+export declare function bytesArgv(file: string, offset: number, length: number, root: string): string[];
 /**
  * Parse the stat record a read or byte-window relayed on stderr.
  *

package/lib/workspace-files-route.js

@@ -64,21 +64,43 @@ export function linuxJoin(linuxRoot, path) {
     const joined = text.length === 0 ? base : `${base}/${text}`.replace(/\/\.(?=\/|$)/gu, "");
     return joined.length === 0 ? "/" : joined;
 }
+/**
+ * The containment guard every distro-side workspace read shares. `$1` is the
+ * requested file, `$2` the workspace root; both are canonicalized with
+ * `realpath -L`, and a target that is neither the root itself nor below it is
+ * refused with exit 3 (the `workspace-file/outside-workspace` refusal). The
+ * resolved file is left in `real` for the rest of the script.
+ *
+ * A root of `/` admits every absolute path: the workspace IS the distro. The
+ * `-L` spelling matches the listing guard's, so symlinked workspace roots and
+ * `..` segments resolve the same way on both sides.
+ */
+const CONTAIN_FN = [
+    'contain() {',
+    '  real=$(realpath -L -- "$1") || exit 2',
+    '  root=$(realpath -L -- "$2") || exit 2',
+    '  case "$root" in /) ;; *) case "$real" in "$root"|"$root"/*) ;; *) echo "OUTSIDE:$real" >&2; exit 3;; esac;; esac',
+    '}',
+].join("\n");
 /**
  * The record invocation for one path: line 1 is the no-follow kind (the
  * upstream lstat gate), line 2 the follow-stat fields (the upstream final
- * stat), tab-joined.
+ * stat), tab-joined. The path is resolved and contained first — the GUI's
+ * workspace is a boundary for every read, not just for listings.
  *
  * @param file - absolute Linux path.
+ * @param root - the workspace root in Linux form (containment boundary).
  * @returns the agent argv.
  */
-export function statRecordArgv(file) {
+export function statRecordArgv(file, root) {
     const script = [
-        'k=$(stat -c %F -- "$1") || exit 2',
-        's=$(stat -L -c %s\\t%D\\t%i\\t%Y\\t%Z -- "$1") || exit 2',
+        CONTAIN_FN,
+        'contain "$1" "$2"',
+        'k=$(stat -c %F -- "$real") || exit 2',
+        's=$(stat -L -c %s\\t%D\\t%i\\t%Y\\t%Z -- "$real") || exit 2',
         "printf '%s\\t%s\\n' \"$k\" \"$s\"",
     ].join("\n");
-    return ["sh", "-c", script, "sh", file];
+    return ["sh", "-c", script, "sh", file, root];
 }
 /**
  * Parse one stat record (kind + follow fields, tab-joined).
@@ -115,16 +137,19 @@ export function wireKind(kind) {
  * @param file - absolute Linux path.
  * @param offset - first line to return (1-based).
  * @param limit - maximum lines to return.
+ * @param root - the workspace root in Linux form (containment boundary).
  * @returns the agent argv.
  */
-export function pageArgv(file, offset, limit) {
+export function pageArgv(file, offset, limit, root) {
     const script = [
-        'k=$(stat -c %F -- "$1") || exit 2',
-        's=$(stat -L -c %s\\t%D\\t%i\\t%Y\\t%Z -- "$1") || exit 2',
+        CONTAIN_FN,
+        'contain "$1" "$4"',
+        'k=$(stat -c %F -- "$real") || exit 2',
+        's=$(stat -L -c %s\\t%D\\t%i\\t%Y\\t%Z -- "$real") || exit 2',
         "printf '%s\\t%s\\n' \"$k\" \"$s\" >&2",
-        'sed -n "${2},$(( $2 + $3 ))p" -- "$1"',
+        'sed -n "${2},$(( $2 + $3 ))p" -- "$real"',
     ].join("\n");
-    return ["sh", "-c", script, "sh", file, String(offset), String(limit)];
+    return ["sh", "-c", script, "sh", file, String(offset), String(limit), root];
 }
 /**
  * The byte-window invocation: the stat record rides stderr, the window rides
@@ -133,15 +158,18 @@ export function pageArgv(file, offset, limit) {
  * @param file - absolute Linux path.
  * @param offset - byte offset (0-based).
  * @param length - byte count.
+ * @param root - the workspace root in Linux form (containment boundary).
  * @returns the agent argv.
  */
-export function bytesArgv(file, offset, length) {
+export function bytesArgv(file, offset, length, root) {
     const script = [
-        's=$(stat -L -c %s\\t%D\\t%i\\t%Y\\t%Z -- "$1") || exit 2',
+        CONTAIN_FN,
+        'contain "$1" "$4"',
+        's=$(stat -L -c %s\\t%D\\t%i\\t%Y\\t%Z -- "$real") || exit 2',
         "printf '%s\\n' \"$s\" >&2",
-        'tail -c "+$(( $2 + 1 ))" -- "$1" | head -c "$3"',
+        'tail -c "+$(( $2 + 1 ))" -- "$real" | head -c "$3"',
     ].join("\n");
-    return ["sh", "-c", script, "sh", file, String(offset), String(length)];
+    return ["sh", "-c", script, "sh", file, String(offset), String(length), root];
 }
 /**
  * Parse the stat record a read or byte-window relayed on stderr.

package/lib/workspace-files-wsl.js

@@ -162,11 +162,13 @@ export async function distroStat({ runner, distro, linuxRoot, path, distroWorksp
     const linuxFile = linuxJoin(linuxRoot, path);
     const result = await runner.exec({
         cwd: "/",
-        argv: statRecordArgv(linuxFile),
+        argv: statRecordArgv(linuxFile, linuxRoot),
         maxOutputBytes: 4096,
         timeoutMs: 30_000,
         signal,
     });
+    if (result.exitCode === 3)
+        throw outsideWorkspace(path);
     if (result.exitCode !== 0)
         throw notFound(path);
     const record = parseStatRecord(result.stdout);
@@ -186,11 +188,13 @@ export async function distroRead({ runner, distro, linuxRoot, path, offset, limi
     const linuxFile = linuxJoin(linuxRoot, path);
     const result = await runner.exec({
         cwd: "/",
-        argv: pageArgv(linuxFile, offset, limit),
+        argv: pageArgv(linuxFile, offset, limit, linuxRoot),
         maxOutputBytes: (maxBytes + 1) * 4,
         timeoutMs: 60_000,
         signal,
     });
+    if (result.exitCode === 3)
+        throw outsideWorkspace(path);
     if (result.exitCode === 2)
         throw notFound(path);
     if (result.exitCode !== 0 && result.exitCode !== 1) {
@@ -213,16 +217,27 @@ export async function distroRead({ runner, distro, linuxRoot, path, offset, limi
     catch {
         throw notText(path);
     }
-    const lines = text.length === 0 ? 0 : text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
-    const bytes = Buffer.byteLength(text, "utf8") + lines;
+    // `pageArgv` reads one line past the page so EOF is decidable from the
+    // yield; that line is a probe, not part of the answer. Split it off before
+    // counting, and count bytes on the page the caller actually receives (a
+    // CRLF file's line count is not a byte budget).
+    const parts = text.length === 0 ? [] : text.split("\n");
+    if (text.endsWith("\n"))
+        parts.pop();
+    const count = parts.length;
+    const truncated = count > limit;
+    const kept = truncated ? parts.slice(0, limit) : parts;
+    const pageText = truncated ? `${kept.join("\n")}\n` : text;
+    const lines = kept.length;
+    const bytes = Buffer.byteLength(pageText, "utf8");
     if (bytes > maxBytes) {
         throw new RemoteError("workspace-file/too-large", `lines ${offset}-${offset + limit - 1} of "${path}" exceed the ${maxBytes} byte cap`, { path, limit: maxBytes });
     }
-    if (text.includes(String.fromCharCode(0)))
+    if (pageText.includes(String.fromCharCode(0)))
         throw notText(path);
-    const eof = lines < limit;
+    const eof = !truncated;
     const stat = { absolutePath: posixToUnc(distro, linuxFile), version: record.version };
-    return { ...stat, offset, text, lines, eof };
+    return { ...stat, offset, text: pageText, lines, eof };
 }
 /**
  * Read one byte window (or the capped whole file) through the runner.
@@ -248,11 +263,13 @@ export async function distroReadBytes({ runner, distro, linuxRoot, path, offset,
         throw windowTooLarge(path, window.length, maxBytes);
     const result = await runner.exec({
         cwd: "/",
-        argv: bytesArgv(linuxFile, window.offset, window.length),
+        argv: bytesArgv(linuxFile, window.offset, window.length, linuxRoot),
         maxOutputBytes: window.length + 1024,
         timeoutMs: 60_000,
         signal,
     });
+    if (result.exitCode === 3)
+        throw outsideWorkspace(path);
     const record = parseStatRecordFromStderr(result.stderr);
     if (record === undefined)
         throw notFound(path);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-wsl-env",
-  "version": "0.9.0",
-  "description": "让 DeepSeek Harness 以 WSL 子系统作为会话的执行环境：shell、文件读写与命令执行均在子系统内完成，目录选择器与 GUI 终端同样定位到子系统路径，并通过子系统内的 bubblewrap 对命令进行沙箱隔离",
+  "version": "0.10.0",
+  "description": "\u8ba9 DeepSeek Harness \u4ee5 WSL \u5b50\u7cfb\u7edf\u4f5c\u4e3a\u4f1a\u8bdd\u7684\u6267\u884c\u73af\u5883\uff1ashell\u3001\u6587\u4ef6\u8bfb\u5199\u4e0e\u547d\u4ee4\u6267\u884c\u5747\u5728\u5b50\u7cfb\u7edf\u5185\u5b8c\u6210\uff0c\u76ee\u5f55\u9009\u62e9\u5668\u4e0e GUI \u7ec8\u7aef\u540c\u6837\u5b9a\u4f4d\u5230\u5b50\u7cfb\u7edf\u8def\u5f84\uff0c\u5e76\u901a\u8fc7\u5b50\u7cfb\u7edf\u5185\u7684 bubblewrap \u5bf9\u547d\u4ee4\u8fdb\u884c\u6c99\u7bb1\u9694\u79bb",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -93,6 +93,7 @@
     "lib/**/*.js",
     "lib/**/*.d.ts",
     "agent/*.sh",
+    "agent/native/linux-*/dsh-wsl-agent",
     "locale/**/*.json",
     "cordis.patch.yml",
     "examples/**/*.yml",
@@ -118,9 +119,9 @@
     "lint:types": "tsc --noEmit",
     "build": "node scripts/build.mjs",
     "lint:build": "node test/build-freshness.mjs",
-    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs",
+    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs",
     "test:syntax": "node test/syntax.mjs",
-    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/fsio-text.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs",
+    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/workspace-files-wsl.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/fsio-text.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs",
     "lint:style": "node test/style.mjs",
     "prepublishOnly": "pnpm test",
     "probe": "bash test/probe/run.sh",
@@ -161,40 +162,45 @@
     "url": "https://github.com/Big-Dao/dsh-plugin-wsl-env/issues"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/cordis": "4.0.5",
     "@deepseek-ai/cordis-plugin-include": "*",
     "@deepseek-ai/cordis-plugin-loader": "*",
-    "@deepseek-ai/dsh-api-workspace-files": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-bash-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-api-workspace-files": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "~22.20.5",
     "js-yaml": "4.3.2",
     "typescript": "~6.0.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-bash-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.4"
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-api-workspace-files": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.5"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
       "optional": true
     },
+    "@deepseek-ai/dsh-api-workspace-files": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-bash-local": {
       "optional": true
     },
@@ -216,6 +222,9 @@
     "@deepseek-ai/dsh-subprocess-local": {
       "optional": true
     },
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    },
     "@deepseek-ai/schemastery": {
       "optional": true
     }