dsh-wsl-desktop 0.2.0 → 0.2.1

package/README.md

@@ -63,7 +63,7 @@ harness 在会话**创建**时就把 preset 定下来（`SessionCreateRequest.ag
 两个实测前提：
 
 - **控制进程必须在桥报告会话之后才启动**，因为在桥创建 FIFO 之前 `open` 会直接失败。桥在 `_spawn()` 前先建 FIFO，靠 `started` 应答把这一点变成可观测的时序。
-- **rc 里向终端发查询的程序会挂住整个会话。** 这台机器的 `~/.bashrc` 末尾是 `oh-my-posh init` + `clear` + `fastfetch`；其中 `fastfetch` 会向终端发查询并等应答，而无头校验里没有终端模拟器应答，于是永远不出提示符。真实 Web 终端里 xterm.js 会应答，所以这是校验环境的问题而不是桥的缺陷 —— 但据此把校验用的 shell 固定为 `bash --noprofile --norc -i`，让校验测的是桥而不是用户的 rc。
+- **rc 里向终端发查询的程序会挂住整个会话。** 有的发行版用户的 `~/.bashrc` 末尾会启动向终端发查询的程序（如 `fastfetch`），它们要等只有终端模拟器才会给的应答，而无头校验里没有应答方，于是永远不出提示符。真实 Web 终端里 xterm.js 会应答，所以这是校验环境的问题而不是桥的缺陷 —— 但据此把校验用的 shell 固定为 `bash --noprofile --norc -i`，让校验测的是桥而不是用户的 rc。
 
 PTC 的 `stdio.control`（fd 通道）仍然明确拒绝：`wsl.exe` 无法转发任意描述符。
 

package/lib/client.js

@@ -528,7 +528,12 @@ window.__ModuleLoader__.load({
         renderedError = state.error
       }
 
-      teardown = close
+      // The uninstall teardown gets forceClose, not close: a plugin
+      // uninstalled mid-commit must still release the overlay, and the token
+      // bump makes the in-flight commit's settled result drop instead of
+      // creating a workspace on a dead context. The dialog's own cancel paths
+      // (overlay click, Escape) keep the guarded close below.
+      teardown = forceClose
       document.addEventListener('keydown', onKey)
       hostElement().append(overlay)
       render()
@@ -552,7 +557,7 @@ window.__ModuleLoader__.load({
     }
 
     /** The injected services the picker and its trigger read. */
-    const companion = { button: null, after: null, observer: null, scheduled: false }
+    const companion = { button: null, trigger: null, observer: null, scheduled: false }
 
     /** Find the shipped "add workspace" trigger by its icon geometry. */
     function findTrigger() {
@@ -608,10 +613,19 @@ window.__ModuleLoader__.load({
       companion.scheduled = false
       const { button } = companion
       if (button === null) return
-      const trigger = findTrigger()
+      // Steady-state fast path: the cached trigger stays valid while it
+      // remains connected inside the trailing action cluster, so chat
+      // streaming (a mutation every frame) re-runs only the cheap placement
+      // and visibility checks below instead of the whole-document icon scan.
+      // The cache self-heals: a replaced or relocated trigger is disconnected
+      // and forces one full rescan.
+      let trigger = companion.trigger
+      if (trigger === null || !trigger.isConnected || !hasHeaderActionsParent(trigger)) {
+        trigger = findTrigger()
+        companion.trigger = trigger
+      }
       if (trigger === null) {
         if (button.isConnected) button.remove()
-        companion.after = null
         return
       }
       const target = actionCluster(trigger)
@@ -622,7 +636,6 @@ window.__ModuleLoader__.load({
         button.className = trigger.className
         button.style.display = ''
         target.after(button)
-        companion.after = target
       }
       // Measure with the button rendered, then decide. The header row clips its
       // own overflow, and the shipped action cluster hides itself while the
@@ -693,7 +706,7 @@ window.__ModuleLoader__.load({
         observer.disconnect()
         button.remove()
         companion.button = null
-        companion.after = null
+        companion.trigger = null
         companion.observer = null
         teardown?.()
       }

package/lib/index.js

@@ -130,9 +130,6 @@ function sourceDirFor(id) {
   return undefined
 }
 
-/** Disposers of the variants this plugin registered; the plugin owns their lifecycle. */
-const variantDisposers = new Map()
-
 /**
  * Read a base preset's declared plugin rows as OBJECTS.
  *
@@ -159,14 +156,18 @@ function basePluginsOf(presets, id) {
  * variant cleanly.
  * @param {import('@deepseek-ai/cordis').Context} ctx - the plugin context.
  * @param {string | undefined} distro - distribution to pin.
- * @param {{ disposed: boolean }} generation - this registration generation's
- *   lifecycle token; the plugin's teardown flips `disposed` synchronously
- *   before draining, and the loop re-checks it around every await so a
- *   disable landing mid-registration cannot orphan a variant whose disposer
- *   nobody owns.
+ * @param {{ disposed: boolean, disposers: Map<string, Function> }} generation - this
+ *   registration generation's lifecycle token; the plugin's teardown flips
+ *   `disposed` synchronously before draining, and the loop re-checks it around
+ *   every await so a disable landing mid-registration cannot orphan a variant
+ *   whose disposer nobody owns. The disposer map lives ON the generation, so
+ *   one generation's teardown drains only the variants it registered.
+ * @param {{ disposers: Map<string, Function>} | null} previous - the generation
+ *   whose variants must be withdrawn before this one registers (register()
+ *   refuses duplicates).
  * @returns {Promise<object>} the registration outcome for the route.
  */
-async function materializePresets(ctx, distro, generation) {
+async function materializePresets(ctx, distro, generation, previous) {
   const presets = ctx.get('agentPresets')
   if (presets === undefined) throw new Error('agentPresets 服务不可用')
   // 版本门控：本插件的目标面是 0.1.7 的运行时注册架构。旧宿主（无
@@ -183,9 +184,9 @@ async function materializePresets(ctx, distro, generation) {
   const skipped = []
 
   // Withdraw the previous generation first: register() refuses duplicates.
-  for (const [id, dispose] of variantDisposers) {
+  for (const [id, dispose] of previous?.disposers ?? []) {
     try { await dispose() } catch { /* already gone */ }
-    variantDisposers.delete(id)
+    previous?.disposers.delete(id)
     if (generation?.disposed) return { status: 'ready', hostCompat, written: [], skipped: [{ id: '-', reason: '插件已卸载，放弃本轮注册' }] }
   }
 
@@ -236,7 +237,7 @@ async function materializePresets(ctx, distro, generation) {
         skipped.push({ id: variantId, reason: '插件已卸载，注册即撤回' })
         continue
       }
-      variantDisposers.set(variantId, dispose)
+      generation.disposers.set(variantId, dispose)
       written.push({ id: variantId, from: id, removed })
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
@@ -264,9 +265,17 @@ let currentGeneration = null
  */
 async function refreshPresets(ctx, distro, generation = currentGeneration) {
   const run = async () => {
+    // A caller may omit the generation (developer-token regenerate before the
+    // inject ran): mint a transient one so every disposer has an owner.
+    const gen = generation ?? { disposed: false, disposers: new Map() }
+    // Withdrawal targets the PREVIOUS generation's disposers; a self-refresh
+    // (developer-token regenerate) withdraws its own — the exact behaviour of
+    // the historical shared map, minus the cross-generation teardown theft.
+    const previous = currentGeneration === gen ? gen : currentGeneration
+    currentGeneration = gen
     presetState = { status: 'running' }
     try {
-      const result = await materializePresets(ctx, distro, generation)
+      const result = await materializePresets(ctx, distro, gen, previous)
       presetState = { status: 'ready', ...result }
     } catch (error) {
       presetState = { status: 'failed', error: error instanceof Error ? error.message : String(error) }
@@ -975,12 +984,15 @@ export function apply(ctx, config) {
     // await re-checks the flag around every register() and hands any
     // just-registered variant straight back to its disposer, so a disable
     // landing mid-registration cannot orphan a wsl-* preset in the registry.
-    const generation = { disposed: false }
-    currentGeneration = generation
+    // Per-generation disposer ownership: one generation's teardown drains only
+    // the variants ITS registration created, so a second generation mounted
+    // beside a running one (the documented same-process exercise path) can no
+    // longer have its variants torn down by the first generation's dispose.
+    const generation = { disposed: false, disposers: new Map() }
     scope.effect(() => () => {
       generation.disposed = true
-      for (const [, dispose] of variantDisposers) void dispose()
-      variantDisposers.clear()
+      for (const [, dispose] of generation.disposers) void dispose()
+      generation.disposers.clear()
     }, 'wsl-desktop: variant preset disposal')
     void defaultDistro().then(
       (distro) => refreshPresets(scope, distro, generation),

package/lib/wsl/confinement.js

@@ -405,12 +405,16 @@ export function buildConfinedCommand({ command, linuxCwd, mode, workspaceLinuxRo
   // fence itself and setpriv-exec's the command with NO_NEW_PRIVS — the
   // command text travels as argv after `--` and is never evaluated as root.
   if (runner === RUNNER_HELPER) {
+    // Mirrors the direct branch's mode guard: only workspace-write may hand
+    // the helper a writable root. workspaceRootInLinux() returns the command's
+    // cwd when the policy carries no root, so without this check a read-only
+    // command would arrive with a bound, WRITABLE workspace.
     const flags = [
       `--uid ${identity.uid}`,
       `--gid ${identity.gid}`,
       `--home ${shellQuote(identity.home)}`,
       `--cwd ${shellQuote(linuxCwd)}`,
-      ...(workspaceLinuxRoot !== undefined && workspaceLinuxRoot !== '' ? [`--workspace ${shellQuote(workspaceLinuxRoot)}`] : []),
+      ...(mode === 'workspace-write' && workspaceLinuxRoot !== undefined && workspaceLinuxRoot !== '' ? [`--workspace ${shellQuote(workspaceLinuxRoot)}`] : []),
       ...(isolateProcesses ? [] : ['--no-pidns']),
       '--',
       shellQuote(command),

package/lib/wsl/dsh-wsl-confine.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# dsh-wsl-confine v1 — DSH WSL confinement helper.
+# dsh-wsl-confine v1.1 — DSH WSL confinement helper.
 #
 # Root-owned fence executor: the ONLY thing this helper does is apply the
 # mount-namespace fence (workspace bind, tmpfs /tmp, read-only /, read-only
@@ -17,9 +17,13 @@
 # Contract: parameters are strictly validated (numeric uid/gid, absolute
 # paths); the caller's command travels as argv after `--` and is executed only
 # AFTER the setpriv drop (with NO_NEW_PRIVS) — root never evaluates caller text.
+# The drop identity is checked against the INVOKING user (SUDO_USER): the
+# sudoers grant is argument-wildcarded, and an unchecked --uid would let the
+# session user aim it at uid 0 — the fence is a WRITE boundary, so uid 0 inside
+# it still reads every root-only file. Root's own direct invocation has no
+# SUDO_USER and skips the check.
 set -euo pipefail
-VERSION='dsh-wsl-confine v1'
-SETUP_FAILURE_EXIT=97
+VERSION='dsh-wsl-confine v1.1'
 
 uid=; gid=; home=; cwd=; workspace=; pidns=1
 ARGS=()
@@ -40,7 +44,19 @@ done
 [[ "$uid" =~ ^[0-9]+$ && "$gid" =~ ^[0-9]+$ ]] || { echo 'dsh-wsl-confine: uid/gid must be numeric' >&2; exit 2; }
 [[ -n "$cwd" && "$cwd" = /* && -n "$home" && "$home" = /* ]] || { echo 'dsh-wsl-confine: --cwd/--home must be absolute Linux paths' >&2; exit 2; }
 [[ -z "$workspace" || "$workspace" = /* ]] || { echo 'dsh-wsl-confine: --workspace must be absolute' >&2; exit 2; }
-((${#ARGS[@]} >= 1)) || { echo 'dsh-wsl-confine: no command' >&2; exit 2 }
+((${#ARGS[@]} >= 1)) || { echo 'dsh-wsl-confine: no command' >&2; exit 2; }
+
+# Identity gate: the caller may only drop to the user sudo says is invoking.
+if [[ -n "${SUDO_USER:-}" ]]; then
+  CALLER_RECORD=$(getent passwd "$SUDO_USER" || true)
+  CALLER_UID=$(printf '%s' "$CALLER_RECORD" | cut -d: -f3)
+  CALLER_GID=$(printf '%s' "$CALLER_RECORD" | cut -d: -f4)
+  if [[ -z "$CALLER_UID" || "$uid" != "$CALLER_UID" || "$gid" != "$CALLER_GID" ]]; then
+    echo "dsh-wsl-confine: identity mismatch (refusing --uid/--gid for ${SUDO_USER})" >&2
+    exit 2
+  fi
+fi
+
 command -v unshare >/dev/null 2>&1 || { echo 'dsh-wsl-confine: unshare not found' >&2; exit 97; }
 command -v setpriv >/dev/null 2>&1 || { echo 'dsh-wsl-confine: setpriv not found' >&2; exit 97; }
 command -v findmnt >/dev/null 2>&1 || { echo 'dsh-wsl-confine: findmnt not found' >&2; exit 97; }
@@ -48,33 +64,38 @@ command -v findmnt >/dev/null 2>&1 || { echo 'dsh-wsl-confine: findmnt not found
 # The fence script is built HERE from the validated parameters — the caller
 # never supplies script text. It is identical in effect to the in-process
 # builder (bind workspace before ro, tmpfs /tmp, decoded sweep, postconditions,
-# NO_NEW_PRIVS drop).
+# NO_NEW_PRIVS drop). Parameters cross into `bash -c` as ENVIRONMENT
+# VARIABLES via env(1): bare KEY=VALUE words after the script name would be
+# positional parameters no variable reference can read, and $UID/$GID are
+# bash built-ins that would silently resolve to root's ids under sudo. The
+# exemption pattern anchors ONLY at the group end with an escaped trailing
+# `$` — a literal `/sys$")$"` tail is a bash parse error, not a regex.
 FENCE='set -euo pipefail
 fail() { printf "%s: %s\n" "dsh-wsl-confine" "$1" >&2; exit 97; }
-if [[ -n "${WORKSPACE:-}" ]]; then
-  mount --bind "$WORKSPACE" "$WORKSPACE"
-  KEEP=("/tmp" "$WORKSPACE")
+if [[ -n "${DROP_WORKSPACE:-}" ]]; then
+  mount --bind "$DROP_WORKSPACE" "$DROP_WORKSPACE"
+  KEEP=("/tmp" "$DROP_WORKSPACE")
 else
   KEEP=("/tmp")
 fi
 mount -t tmpfs tmpfs /tmp
 mount -o remount,ro,bind /
-findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | { grep -Ev "^($(printf "%s|" "${KEEP[@]}" | sed "s/|$//")|/dev$|/proc$|/sys$")$" || fail "exemption grep failed"; } | while IFS= read -r target; do
+findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | { grep -Ev "^($(printf "%s|" "${KEEP[@]}" | sed "s/|$//")|/dev|/proc|/sys)\$" || fail "exemption grep failed"; } | while IFS= read -r target; do
   mount -o remount,ro,bind "$target" >/dev/null 2>&1 || true
 done
 mountpoint -q /tmp || fail "/tmp is not a private tmpfs"
 findmnt -rno OPTIONS / | grep -q "^ro" || fail "/ is not read-only"
-findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | { grep -Ev "^($(printf "%s|" "${KEEP[@]}" | sed "s/|$//")|/dev$|/proc$|/sys$")$" || fail "exemption grep failed"; } | while IFS= read -r target; do
+findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | { grep -Ev "^($(printf "%s|" "${KEEP[@]}" | sed "s/|$//")|/dev|/proc|/sys)\$" || fail "exemption grep failed"; } | while IFS= read -r target; do
   [[ -w "$target" ]] && fail "$target is still writable"
   true
 done
-cd "$CWD"
-exec setpriv --no-new-privs --reuid="$UID" --regid="$GID" --init-groups env HOME="$HOME_DIR" USER="$USER_NAME" LOGNAME="$USER_NAME" bash -lc "$COMMAND"'
+cd "$DROP_CWD"
+exec setpriv --no-new-privs --reuid="$DROP_UID" --regid="$DROP_GID" --init-groups env HOME="$DROP_HOME" USER="$DROP_USER" LOGNAME="$DROP_USER" bash -lc "$DROP_COMMAND"'
 
 PID_FLAG=''
 [[ "$pidns" = 1 ]] && PID_FLAG='--pid --fork'
 
-exec unshare --mount --propagation private $PID_FLAG bash -c "$FENCE" \
-  dsh-wsl-confine \
-  UID="$uid" GID="$gid" HOME_DIR="$home" USER_NAME="${SUDO_USER:-user}" \
-  CWD="$cwd" WORKSPACE="$workspace" COMMAND="${ARGS[*]}"
+exec unshare --mount --propagation private $PID_FLAG env \
+  DROP_UID="$uid" DROP_GID="$gid" DROP_HOME="$home" DROP_USER="${SUDO_USER:-root}" \
+  DROP_CWD="$cwd" DROP_WORKSPACE="$workspace" DROP_COMMAND="${ARGS[*]}" \
+  bash -c "$FENCE" dsh-wsl-confine

package/lib/wsl/preset.js

@@ -4,36 +4,23 @@
  * A session's execution world is chosen by its preset, not by a global router:
  * the model also needs a different tool dialect (bash rather than PowerShell),
  * and one process-wide provider could not vary that per session. This module
- * therefore rewrites a shipped preset's entry list — it removes the rows that
- * name the host execution world and appends one `isolate` group that mounts the
- * WSL world plus the tools that consume it.
+ * therefore rewrites a shipped preset's plugin entry OBJECTS — it removes the
+ * rows that name the host execution world (by canonical id at the top level
+ * and by module name at every depth) and appends one `isolate` group that
+ * mounts the WSL world plus the tools that consume it.
  *
- * The transform is pure text over the loader's entry list, so it is unit
- * testable without the harness. Rows are matched by their top-level `- id:`
- * boundary; only top-level (two-space indented) keys are rewritten, so a nested
- * entry inside a group's `config:` is never touched.
+ * The transform is pure over the loader's entry objects, so it is unit
+ * testable without the harness (`scripts/verify-preset.mjs`). The historical
+ * 0.1.6 YAML-text renderer lived and died with the disk-generation pipeline:
+ * since 0.1.7 variants are registered programmatically via
+ * `agentPresets.register({ id, name, plugins })` and the registry, not a
+ * generated directory, is the source of truth.
  * @module dsh-wsl-desktop/wsl/preset
  */
 
 import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
-/**
- * Decide what happens to one directory inside this plugin's preset namespace.
- *
- * The namespace is a name prefix, so it is shared with anything a user chooses
- * to call `wsl-…`. Only a directory this plugin wrote — one carrying its marker
- * — may be withdrawn; an unmarked one is the user's and is reported instead of
- * deleted.
- * @param {{ name: string, prefix: string, expected: boolean, marked: boolean }} entry - one directory.
- * @returns {'ignore' | 'keep' | 'withdraw' | 'unmanaged'} the disposition.
- */
-export function sweepDecision({ name, prefix, expected, marked }) {
-  if (!name.startsWith(prefix)) return 'ignore'
-  if (expected) return 'keep'
-  return marked ? 'withdraw' : 'unmanaged'
-}
-
 /** Rows that name the host execution world and must not survive in a WSL preset. */
 export const WORLD_ROWS = new Set([
   'tool-bash',
@@ -113,6 +100,16 @@ export function buildWorldGroup({ subprocessPath, shellPath, fsPath, distro, inc
   }
 }
 
+/**
+ * The sentence appended to the preset's persona.
+ *
+ * A session's recorded cwd is the UNC spelling (`\\wsl.localhost\<distro>\…`)
+ * because that is the only form the Windows-side harness accepts, while the
+ * shell in that session reports a Linux path. Without this the model is told one
+ * spelling and observes another.
+ */
+export const WSL_PERSONA_SENTENCE = 'Paths under \\\\wsl.localhost\\<distro> are Windows spellings of directories inside that WSL distribution — \\\\wsl.localhost\\<distro>\\home\\me is /home/me there. Every command runs in the distribution, so use Linux paths, and reach Windows files as /mnt/<drive>/…'
+
 /**
  * Append the WSL path-dialect sentence to a persona row OBJECT.
  * @param {object} row - the persona entry.
@@ -130,22 +127,6 @@ function appendPersonaSuffixObject(row) {
   return true
 }
 
-/**
- * Transform a base preset's plugin ENTRY OBJECTS into the WSL variant's list.
- *
- * Same semantics as the historical YAML rewrite: drop the rows that name the
- * host execution world, amend the persona with the path-dialect sentence,
- * rewrite relative row names against the source directory, and append the
- * `wsl-world` isolate group.
- * @param {readonly object[]} basePlugins - the base preset's plugin rows.
- * @param {object} options - generation options.
- * @param {string} options.subprocessPath - module specifier of the WSL subprocess provider.
- * @param {string} options.shellPath - module specifier of the WSL shell executor.
- * @param {string} options.fsPath - module specifier of the WSL filesystem provider.
- * @param {string | undefined} options.distro - distribution for paths that do not name one.
- * @param {string | undefined} options.sourceDir - directory the source preset lives in.
- * @returns {{ plugins: object[], removed: string[] }} the variant rows and what was dropped.
- */
 /**
  * Clone one entry row deeply enough to transform it safely. Group rows carry
  * their children under `config` as an ARRAY (recursive tree), so the clone
@@ -165,6 +146,22 @@ function cloneRow(row) {
   return clone
 }
 
+/**
+ * Transform a base preset's plugin ENTRY OBJECTS into the WSL variant's list.
+ *
+ * Drop the rows that name the host execution world (id fast path, module-name
+ * match at every depth), amend the persona with the path-dialect sentence,
+ * rewrite relative row names against the source directory, and append the
+ * `wsl-world` isolate group.
+ * @param {readonly object[]} basePlugins - the base preset's plugin rows.
+ * @param {object} options - generation options.
+ * @param {string} options.subprocessPath - module specifier of the WSL subprocess provider.
+ * @param {string} options.shellPath - module specifier of the WSL shell executor.
+ * @param {string} options.fsPath - module specifier of the WSL filesystem provider.
+ * @param {string | undefined} options.distro - distribution for paths that do not name one.
+ * @param {string | undefined} options.sourceDir - directory the source preset lives in.
+ * @returns {{ plugins: object[], removed: string[] }} the variant rows and what was dropped.
+ */
 export function buildVariantPlugins(basePlugins, { subprocessPath, shellPath, fsPath, distro, sourceDir }) {
   const kept = []
   const removed = []
@@ -222,235 +219,3 @@ export function buildVariantPlugins(basePlugins, { subprocessPath, shellPath, fs
   kept.push(buildWorldGroup({ subprocessPath, shellPath, fsPath, distro, includeEditor }))
   return { plugins: kept, removed }
 }
-
-/**
- * The sentence appended to the preset's persona.
- *
- * A session's recorded cwd is the UNC spelling (`\\wsl.localhost\<distro>\…`)
- * because that is the only form the Windows-side harness accepts, while the
- * shell in that session reports a Linux path. Without this the model is told one
- * spelling and observes another.
- */
-export const WSL_PERSONA_SENTENCE = 'Paths under \\\\wsl.localhost\\<distro> are Windows spellings of directories inside that WSL distribution — \\\\wsl.localhost\\<distro>\\home\\me is /home/me there. Every command runs in the distribution, so use Linux paths, and reach Windows files as /mnt/<drive>/…'
-
-/**
- * Append the WSL sentence to a persona row's text field.
- *
- * Handles the three shapes a preset may use: an inline `suffix`, a block-scalar
- * `suffix`, and a persona that carries only `text`. A row with none of them
- * gains a `suffix` under `config:`.
- * @param {{ id: string | null, lines: string[] }} block - the persona block.
- * @returns {boolean} whether the block was amended.
- */
-export function appendPersonaSuffix(block) {
-  const lines = block.lines
-  const configIndex = lines.findIndex((line) => /^(\s*)config:\s*$/.test(line))
-  if (configIndex === -1) return false
-  const configIndent = (/^(\s*)config:\s*$/.exec(lines[configIndex])?.[1] ?? '').length
-  const childIndent = configIndent + 2
-  const child = new RegExp(`^ {${childIndent}}(suffix|text|prefix):(.*)$`)
-  for (const field of ['suffix', 'text', 'prefix']) {
-    const index = lines.findIndex((line, at) => at > configIndex && child.test(line) && new RegExp(`^ {${childIndent}}${field}:`).test(line))
-    if (index === -1) continue
-    const value = (new RegExp(`^ {${childIndent}}${field}:(.*)$`).exec(lines[index])?.[1] ?? '').trim()
-    // A block scalar (`>-`, `|`, `|-`, …) continues on the following lines.
-    if (value === '' || /^[|>][-+]?\d*$/.test(value)) {
-      lines.splice(index + 1, 0, `${' '.repeat(childIndent + 2)}${WSL_PERSONA_SENTENCE}`)
-    } else if ((value.startsWith("'") && value.endsWith("'") && value.length >= 2)
-      || (value.startsWith('"') && value.endsWith('"') && value.length >= 2)) {
-      // A quoted scalar must grow INSIDE its quotes; appending after a closing
-      // quote would produce invalid YAML.
-      const quote = value[0]
-      const sentence = quote === "'" ? WSL_PERSONA_SENTENCE.replace(/'/g, "''") : WSL_PERSONA_SENTENCE
-      lines[index] = `${lines[index].slice(0, -1)} ${sentence}${quote}`
-    } else {
-      lines[index] = `${lines[index]} ${WSL_PERSONA_SENTENCE}`
-    }
-    return true
-  }
-  // No text field of its own: gain one as the first key under `config:`.
-  lines.splice(configIndex + 1, 0, `${' '.repeat(childIndent)}suffix: ${WSL_PERSONA_SENTENCE}`)
-  return true
-}
-
-/**
- * Quote one scalar for a YAML single-quoted value.
- * @param {string} value - the raw value.
- * @returns {string} the quoted scalar.
- */
-function quote(value) {
-  return `'${value.replace(/'/g, "''")}'`
-}
-
-/**
- * Split an entry list into top-level blocks.
- * @param {string} source - the loader entry list.
- * @returns {Array<{ id: string | null, lines: string[] }>} the blocks in order.
- */
-export function splitBlocks(source) {
-  const blocks = []
-  let current = { id: null, lines: [] }
-  for (const line of source.split('\n')) {
-    const match = /^- id:\s*(.+?)\s*$/.exec(line)
-    if (match !== null) {
-      if (current.lines.length > 0 || current.id !== null) blocks.push(current)
-      // Normalise the captured id so every YAML spelling of the same row
-      // resolves to one canonical id for world-row removal: strip trailing
-      // comments, YAML anchors (`&a name`), and surrounding quotes.
-      let id = match[1].replace(/\s+#.*$/, '').trim()
-      if (id.startsWith('&')) id = id.replace(/^&\S+\s+/, '')
-      id = id.replace(/^"(.*)"$/, '$1').replace(/^'(.*)'$/, '$1')
-      current = { id, lines: [line] }
-      continue
-    }
-    current.lines.push(line)
-  }
-  blocks.push(current)
-  return blocks
-}
-
-/**
- * Build the `wsl-world` group that carries the WSL execution world.
- *
- * The group isolates every service a row inside it publishes, so one session
- * can run in a distribution while the process keeps serving Windows sessions.
- * `subprocess-wsl` precedes the consumers that inject it: the shell executor
- * hands it a Linux argv and lets the provider own the `wsl.exe` wrapper.
- * @param {object} options - generation options.
- * @param {string} options.subprocessPath - module specifier of the WSL subprocess provider.
- * @param {string} options.shellPath - module specifier of the WSL shell executor.
- * @param {string} options.fsPath - module specifier of the WSL filesystem provider.
- * @param {string | undefined} options.distro - distribution for paths that do not name one.
- * @param {boolean} options.includeEditor - whether the source preset mounted the string-replace editor.
- * @returns {string[]} the group's YAML lines.
- */
-function worldGroup({ subprocessPath, shellPath, fsPath, distro, includeEditor }) {
-  const distroConfig = distro === undefined ? [] : ['      config:', `        distro: ${quote(distro)}`]
-  return [
-    '- id: wsl-world',
-    '  name: cordis:group',
-    '  group: true',
-    '  isolate:',
-    '    shell: true',
-    '    fs: true',
-    '    subprocess: true',
-    '  config:',
-    '    - id: subprocess-wsl',
-    `      name: ${quote(subprocessPath)}`,
-    ...distroConfig,
-    '    - id: shell-wsl',
-    `      name: ${quote(shellPath)}`,
-    ...distroConfig,
-    '    - id: fs-wsl',
-    `      name: ${quote(fsPath)}`,
-    ...distroConfig,
-    // No terminal registry row: the Web terminal controller spawns through
-    // `agent.ctx.get('subprocess').spawnTerminal(...)`
-    // (packages/api/terminal-controller/src/index.ts:333,346), so the realm's
-    // subprocess provider already puts the PTY inside the distribution. A
-    // `terminals` realm would only serve the model's persistent-shell tool,
-    // which this preset does not mount.
-    '    - id: tool-bash',
-    "      name: '@deepseek-ai/dsh-tool-bash'",
-    '    - id: tool-fs',
-    "      name: '@deepseek-ai/dsh-tool-fs'",
-    ...includeEditor
-      ? ['    - id: str-replace-editor', "      name: '@deepseek-ai/dsh-tool-str-replace-editor'"]
-      : [],
-  ]
-}
-
-/**
- * Rewrite relative row names so they still resolve from the variant directory.
- *
- * A preset may name a row by a path relative to its own directory
- * (`./tool-bootstrap.mjs`). The variant lives in a different directory, so the
- * relative spelling would resolve against the wrong base and the preset would
- * fail to mount.
- * @param {{ lines: string[] }} block - one top-level entry.
- * @param {string} sourceDir - directory of the preset being derived from.
- * @returns {number} how many names were rewritten.
- */
-export function rewriteRelativeNames(block, sourceDir) {
-  let rewritten = 0
-  block.lines = block.lines.map((line) => {
-    const match = /^(\s*)name:\s*['"]?\.\/([^'"]+)['"]?\s*$/.exec(line)
-    if (match === null) return line
-    const absolute = join(sourceDir, match[2]).replace(/\\/g, '/')
-    rewritten += 1
-    return `${match[1]}name: '${absolute}'`
-  })
-  return rewritten
-}
-
-/**
- * Rewrite one shipped preset into its WSL variant.
- *
- * The whole preset is wrapped in the realm rather than sitting beside it. A
- * sibling group would leave every consumer outside it — a persistent-shell
- * group, a hand-written tool row — resolving the host's providers, which is the
- * Windows execution world; wrapping makes the realm the preset's own scope, so
- * every row resolves the WSL providers. Rows that hardcode Windows tooling are
- * dropped and re-mounted in their WSL form.
- * @param {string} source - the shipped preset's `agent.cordis.yml` text.
- * @param {object} options - generation options.
- * @param {string} options.subprocessPath - module specifier of the WSL subprocess provider.
- * @param {string} options.shellPath - module specifier of the WSL shell executor.
- * @param {string} options.fsPath - module specifier of the WSL filesystem provider.
- * @param {string} [options.distro] - distribution for paths that do not name one.
- * @param {string} [options.sourceDir] - directory the source preset lives in.
- * @returns {{ yaml: string, removed: string[], added: boolean }} the rewritten preset and what changed.
- */
-export function renderWslPreset(source, options) {
-  const blocks = splitBlocks(source)
-  const kept = []
-  const removed = []
-  let includeEditor = false
-  let personaAmended = false
-  for (const block of blocks) {
-    if (block.id !== null && WORLD_ROWS.has(block.id)) {
-      removed.push(block.id)
-      if (block.id === 'str-replace-editor') includeEditor = true
-      continue
-    }
-    if (block.id === 'persona') personaAmended = appendPersonaSuffix(block)
-    if (options.sourceDir !== undefined) rewriteRelativeNames(block, options.sourceDir)
-    kept.push(block)
-  }
-  // `split('\n')` consumed the separators, so blocks rejoin with one newline;
-  // joining with '' would glue the next `- id:` onto the previous line.
-  const body = kept.map((block) => block.lines.join('\n')).join('\n')
-  // One level down: the original entry list becomes the group's `config` list.
-  const nested = body
-    .split('\n')
-    .map((line) => (line.trim() === '' ? line : `    ${line}`))
-    .join('\n')
-  const group = worldGroup({
-    subprocessPath: options.subprocessPath,
-    shellPath: options.shellPath,
-    fsPath: options.fsPath,
-    distro: options.distro,
-    includeEditor,
-  })
-  return {
-    yaml: `${group.join('\n')}\n${nested}\n`,
-    removed,
-    added: true,
-  }
-}
-
-/**
- * Render the preset's display metadata.
- * @param {{ name: string, description: string }} metadata - display name and description.
- * @returns {string} the `preset.yml` text.
- */
-export function renderPresetMetadata(metadata) {
-  // Quote only when the value contains characters that YAML would
-  // misinterpret; plain alphanumeric + CJK + basic punctuation stays unquoted.
-  const scalar = (value) => {
-    const s = String(value)
-    if (/^[\w.\-\u4e00-\u9fff\u3000-\u303f\u00b7(): ]+$/u.test(s) && !/^\s|\s$/.test(s) && !s.includes(': ') && !s.startsWith('#')) return s
-    return `'${s.replace(/'/g, "''")}'`
-  }
-  return `name: ${scalar(metadata.name)}\ndescription: ${scalar(metadata.description)}\n`
-}

package/lib/wsl/shell.js

@@ -344,7 +344,12 @@ export class WslShellExecutor extends ShellExecutor {
       sandbox: { ...sandbox },
       readOutput() {
         const stdoutRead = stdout.readFrom(readOffset)
-        readOffset += stdoutRead.text.length
+        // Resume from the reader's own nextOffset, not `text.length`: the
+        // collect contract is BYTE-offset based (SubprocessOutputRead), and
+        // a UTF-16 code-unit count diverges from it for any non-ASCII
+        // output — the second read would resume mid-stream and duplicate or
+        // garble text. start() already advanced this way.
+        readOffset = stdoutRead.nextOffset
         const stderrRead = stderr.readFrom(0)
         return {
           delta: stderrRead.text !== '' ? `${stdoutRead.text}\n[stderr]\n${stderrRead.text}` : stdoutRead.text,

package/lib/wsl/terminal-bridge.py

@@ -159,8 +159,14 @@ class Bridge:
 
         op = request.get("op")
         if op == "resize":
-            self.resize(request.get("cols", 80), request.get("rows", 24))
-            ans({"ok": True})
+            try:
+                self.resize(request.get("cols", 80), request.get("rows", 24))
+                ans({"ok": True})
+            except (TypeError, ValueError, OSError) as error:
+                # A malformed payload must not kill the session: the bridge IS
+                # the terminal, so an unhandled exception in this dispatch
+                # would take down every later control op and the PTY itself.
+                ans({"ok": False, "error": str(error)})
         elif op == "foreground":
             pgrp = self.foreground_pgrp()
             ans({"ok": True, "pgrp": pgrp, "shellPgrp": self.shell_pgrp})
@@ -196,7 +202,11 @@ class Bridge:
                 break
             deadline = time.monotonic() + wait
             while time.monotonic() < deadline:
-                done, _ = os.waitpid(self.pid, os.WNOHANG)
+                try:
+                    done, _ = os.waitpid(self.pid, os.WNOHANG)
+                except ChildProcessError:
+                    # The pump loop already reaped the child: session gone.
+                    return True
                 if done == self.pid:
                     return True
                 time.sleep(0.05)

package/lib/wsl/world.js

@@ -176,16 +176,11 @@ export function hostExecutable(name) {
  * @returns {NodeJS.ProcessEnv} the environment for the `wsl.exe` process.
  */
 function bridgeEnv(extra) {
-  const env = { ...process.env, ...ENV_OVERRIDES, ...extra }
-  const flags = []
-  for (const [key, value] of Object.entries(extra ?? {})) {
-    if (key.toUpperCase() === 'WSLENV') continue
-    flags.push(isWindowsPathShaped(value) ? `${key}/p` : key)
-  }
-  const ambient = process.env.WSLENV
-  const merged = [ambient, flags.join(':')].filter((part) => part !== undefined && part !== '').join(':')
-  if (merged !== '') env.WSLENV = merged
-  return env
+  // Flag-building is shared with withWslEnvFlags so the WSLENV metacharacter
+  // filter cannot drift apart between the two call sites again (bridgeEnv
+  // used to accept `:`/`/`-bearing keys that withWslEnvFlags rejects). env is
+  // optional — the common probe path passes none.
+  return { ...process.env, ...ENV_OVERRIDES, ...withWslEnvFlags(extra ?? {}) }
 }
 
 /**
@@ -404,7 +399,7 @@ export async function resolveDistroHome(distro, username) {
   let user = typeof username === 'string' ? username.trim() : ''
   if (user === '') {
     // Non-login + trimmed on purpose: the parsed answer must be provably this
-    // probe's output ('zcluo'), never profile scripts'.
+    // probe's output (the login name), never profile scripts'.
     const who = await runWslShell({ distro, linuxCwd: '/', command: 'id -un', loginShell: false, timeoutMs: 30_000 })
     user = who.stdout.trim()
     if (user === '' || user.includes('\n')) {

package/package.json

@@ -1,35 +1,37 @@
-{
-  "name": "dsh-wsl-desktop",
-  "version": "0.2.0",
-  "type": "module",
-  "main": "lib/index.js",
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "LICENSE"
-  ],
-  "dependencies": null,
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "inject": [
-        "@deepseek-ai/dsh-api-workspace-controller",
-        "@deepseek-ai/dsh-client-ui-workspace"
-      ]
-    }
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/zcluo/dsh-wsl-desktop.git"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "manifestVersion": 1,
-  "license": "MIT",
-  "description": "DSH Desktop WSL execution world: add a WSL workspace and run every tool inside the distribution."
-}
+{
+  "name": "dsh-wsl-desktop",
+  "version": "0.2.1",
+  "type": "module",
+  "main": "lib/index.js",
+  "engines": {
+    "node": ">=22.19"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-api-workspace-controller",
+        "@deepseek-ai/dsh-client-ui-workspace"
+      ]
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zcluo/dsh-wsl-desktop.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "manifestVersion": 1,
+  "license": "MIT",
+  "description": "DSH Desktop WSL execution world: add a WSL workspace and run every tool inside the distribution."
+}