dsh-wsl-desktop 0.3.0 → 0.3.1

package/lib/wsl/confinement.js

@@ -135,16 +135,32 @@ export async function resolveIdentity({ distro, username, run }) {
  * answered yes, i.e. it would have selected a file the model owns.
  *
  * The gate therefore requires, before the version is even asked for:
- * - the path holds an executable file (the pre-existing 'test -x' — which also
- *   requires the INVOKING user's execute bit, so a 0700 root:root helper is not
- *   selected; that is fail-closed and deliberately unchanged here);
+ * - a REGULAR FILE at the path ('[ -f ]'), because 'test -x' alone also accepts
+ *   a directory — measured: a drwxr-xr-x root:root directory satisfied every
+ *   other test and the ownership predicate answered yes for it. Only the version
+ *   half refused it, and only because sudo cannot exec a directory;
+ * - NOT a SYMLINK ('[ -L ]' refuses; it is not resolved). Which tests resolve a
+ *   link is not uniform, and that asymmetry is the reason for the explicit test:
+ *   'test -x' and '[ -w ]' follow the link, while 'stat -c %u/%a' do NOT follow
+ *   it. A link is therefore refused today as collateral (stat reports the link's
+ *   own fixed 0777 mode, which fails the write-bit test) with nothing in the
+ *   script stating that this is intended. Resolving instead would demand
+ *   checking BOTH chains — the link's own directory is decisive, since
+ *   re-pointing it at any root-owned binary gives the caller that binary as
+ *   root under an argument-wildcarded grant — so refusal stays the choice;
+ * - the INVOKING user's execute bit ('test -x'), so a 0700 root:root helper is
+ *   not selected; that is fail-closed and deliberately unchanged here;
  * - owner uid 0 ('stat -c %u'), so a session-user-owned file can never be the
  *   grant's target;
  * - no group or other WRITE bit ('stat -c %a' & 022 == 0). The '-w' test alone
  *   would miss a mode a later group membership could widen; the mode bits alone
  *   would miss an ACL. Both are checked;
  * - not writable by the invoking user ('[ -w ]', which also sees ACLs);
- * - no writable ancestor up to '/'.
+ * - no writable ancestor up to '/'. Measured for the resolved case too: with the
+ *   helper reached through a symlinked ANCESTOR (/opt/.../linkdir ->
+ *   /home/<user>/...), '[ -w ]' follows that component and answers no, so the
+ *   ancestor half has no lexical-vs-resolved gap — the walk tests each lexical
+ *   component, and each test sees through it.
  *
  * Deliberately NOT a literal '0:755': a stricter mode must never be refused for
  * being stricter, and what has to be pinned is replaceability. The '-w' test
@@ -163,6 +179,30 @@ function helperGateScript(helperPath) {
   return [
     'f=' + target,
     'ok=yes',
+    // TYPE FIRST, and by an explicit test rather than by 'test -x': a root:root
+    // 0755 DIRECTORY satisfies -x, uid 0, no write bits and every ancestor test,
+    // so the ownership predicate answered yes for a directory — measured, as
+    // zcluo, with /opt/.../dir-helper (drwxr-xr-x root root). Only the version
+    // half refused it, and only because sudo cannot exec a directory. The gate
+    // claims to require an executable FILE; this is where it measures that.
+    '[ -f "$f" ] || ok=no',
+    // A symlink is REFUSED, not resolved. The grant names a PATH, so the link
+    // and its target are both part of the trust decision: resolving would have
+    // to check the link's own directory too (re-pointing it at any other
+    // root-owned binary such as /bin/bash is enough to run the caller's argv as
+    // root under an argument-wildcarded grant), while the ancestor walk below
+    // can only walk one of the two chains. Refusal is simpler, fail-closed, and
+    // costs only the hardened runner: the probe falls back to the direct
+    // sudo-unshare runner, and the README's install is a real file copy.
+    // Today such a path is refused already — but only as collateral, because
+    // 'stat' does NOT follow a link and reports the link's own fixed 0777 mode,
+    // which fails the write-bit test below. Nothing in the script says so, so
+    // any later edit that made the stat calls follow (-L) would silently turn
+    // that accident into an accepted, replaceable helper. This makes the
+    // refusal the measured intent instead of a side effect.
+    '[ -L "$f" ] && ok=no',
+    // The invoking user's execute bit (this follows the link, hence the tests
+    // above): a 0700 root:root helper is not selected — fail-closed, unchanged.
     'test -x "$f" || ok=no',
     'u=$(stat -c %u "$f" 2>/dev/null) || u=',
     'm=$(stat -c %a "$f" 2>/dev/null) || m=',

package/lib/wsl/pty.js

@@ -179,7 +179,8 @@ async function requireBridgeRuntime(plan, options) {
  * Hence a host-side rm -f, which is the only cleanup that survives a SIGKILL.
  * Best effort and bounded (a distribution that is going down must not hang a
  * teardown) and idempotent (safe on every path that ends a session). The cost is
- * one extra wsl.exe spawn per closed session; the alternative — inferring from
+ * one wsl.exe spawn per closed session, memoized in cleanupFifo() so the two end
+ * paths cannot each pay it; the alternative — inferring from
  * the session outcome whether the bridge's finally ran — is not portable: on
  * Windows a killed process reports no signal, and a non-zero exit code is also
  * the ordinary shape of a session whose command failed.
@@ -241,6 +242,23 @@ export async function spawnWslTerminal({
   let size = boundSize(cols, rows, { cols: DEFAULT_COLS, rows: DEFAULT_ROWS })
   const fifo = `/tmp/dsh-pty-${randomUUID().slice(0, 12)}.fifo`
   const select = { ...(wslPath !== undefined ? { wslPath } : {}), ...(username !== undefined ? { username } : {}) }
+  /**
+   * The session's ONE host-side FIFO removal, shared by every path that can end it.
+   *
+   * Both end paths reach here — the data-done handler (a bridge that exited or
+   * was killed) and terminate()/the failed-allocation catch — and each used to
+   * call removeFifo itself. Measured with a call counter across a full
+   * verify-pty-handle run: EVERY one of the five sessions it drives called
+   * removeFifo exactly TWICE, so "one extra wsl.exe spawn per closed session"
+   * was wrong by a factor of two, on the killed and failed paths as much as on
+   * terminate. Memoizing the promise makes the first caller the owner and every
+   * other caller await the same settlement: one rm per session, no end path left
+   * uncovered, and a path that throws before its own call still gets the
+   * handler's.
+   * @returns {Promise<void>} settlement of the single removal.
+   */
+  let fifoCleanup
+  const cleanupFifo = () => (fifoCleanup ??= removeFifo(plan, fifo, select))
   termLog(`allocate: distro=${plan.distro} linuxCwd=${JSON.stringify(plan.linuxCwd)} windowsCwd=${JSON.stringify(plan.windowsCwd)} argv0=${JSON.stringify(argv[0])} cols=${String(size.cols)} rows=${String(size.rows)} fifo=${fifo}`)
   await requireBridgeRuntime(plan, select)
   termLog('allocate: bridge runtime ok')
@@ -338,9 +356,9 @@ export async function spawnWslTerminal({
       // distribution-side bash, holding the FIFO.
       control?.terminate()
       // The bridge is gone, so its own finally either ran or was preempted by a
-      // kill — and only this side can answer that by looking. Runs on every
-      // session end (idempotent), which is what covers the killed case.
-      void removeFifo(plan, fifo, select)
+      // kill — and only this side can answer that by looking. Reaches the shared
+      // removal on every session end, which is what covers the killed case.
+      void cleanupFifo()
     },
     (error) => {
       bridgeDown = true
@@ -351,7 +369,7 @@ export async function spawnWslTerminal({
       // Same host-side cleanup as the exited-bridge branch above: a FAILED data
       // process is the case where the bridge's own finally is least likely to
       // have run.
-      void removeFifo(plan, fifo, select)
+      void cleanupFifo()
     },
   )
 
@@ -466,7 +484,7 @@ export async function spawnWslTerminal({
         await Promise.allSettled([data.waitForExit?.() ?? waitForHandle(data), waitForHandle(control)])
         // AFTER both processes have settled, from the host side: the bridge's
         // own finally lost this race often enough to leave orphans behind.
-        await removeFifo(plan, fifo, select)
+        await cleanupFifo()
       },
     }
   } catch (error) {
@@ -491,7 +509,7 @@ export async function spawnWslTerminal({
     // A session that never came up can still have created its FIFO (the bridge
     // makes it before it announces), so the failed-allocation path cleans up too:
     // rm -f is a no-op when it was never created.
-    await removeFifo(plan, fifo, select)
+    await cleanupFifo()
     throw error
   }
 }

package/lib/wsl/shell.js

@@ -235,6 +235,14 @@ export class WslShellExecutor extends ShellExecutor {
       if (refusal !== null) throw new SandboxUnavailableError(mode, refusal)
       noNewPrivs = true
     }
+    // What the RESULT reports is the boundary the run actually gets, not the
+    // builder input. The helper's own drop sets NO_NEW_PRIVS unconditionally
+    // (`setpriv --no-new-privs`, dsh-wsl-confine.sh), so a helper run that
+    // reported `noNewPrivs: false` understated its own boundary; the direct
+    // runner reaches this line only with a MEASURED flag (the refusal above).
+    // Both runners therefore report true, and the field means one thing again:
+    // this run's drop carried NO_NEW_PRIVS.
+    const noNewPrivsApplied = runner === RUNNER_HELPER || noNewPrivs === true
     const workspaceLinuxRoot = workspaceRootInLinux(spec.sandboxPolicy?.workspaceRoot, plan.linuxCwd, toLinux)
     if (workspaceLinuxRoot === null) {
       throw new SandboxUnavailableError(mode, 'wsl-sandbox: 工作区根目录无法映射到发行版内')
@@ -258,11 +266,15 @@ export class WslShellExecutor extends ShellExecutor {
       // interop — a confined command may still ask `wsl.exe` to run a Windows
       // program that writes files; and privilege re-escalation — the session
       // user keeps the passwordless sudo grant the confinement runner itself
-      // requires. When the distro's setpriv supports NO_NEW_PRIVS the drop
-      // sets it and sudo inside the fence fails loudly; on distros without
-      // that flag a deliberately non-compliant command can void the file
-      // fence via retained sudo (see README). Reporting `full` here was wrong.
-      sandbox: { mode, denied: false, enforcement: 'partial', noNewPrivs },
+      // requires. That route is closed on BOTH runners, which is why no
+      // reachable path here runs a confined command without the flag: the direct
+      // runner REFUSES unless --no-new-privs was MEASURED present (so its drop
+      // always carries it and sudo inside the fence fails loudly), and the
+      // helper's own drop sets it unconditionally. A distribution whose setpriv
+      // lacks the flag therefore never runs a direct-runner command at all —
+      // the refusal above is what used to be described here as "the fence can be
+      // voided via retained sudo". Reporting `full` here was wrong.
+      sandbox: { mode, denied: false, enforcement: 'partial', noNewPrivs: noNewPrivsApplied },
     }
   }
 

package/lib/wsl/world.js

@@ -514,14 +514,49 @@ export function runWslShell({ distro, linuxCwd, command, username, loginShell =
   })
 }
 
+/** The documented probe ceiling: 60s, because a cold VM's first spawn can exceed 30s. */
+const PROBE_TIMEOUT_MS = 60_000
+
+/**
+ * Ceiling for one parsed-output probe, and the retry that goes with it.
+ *
+ * README.md states this policy for exactly these probes — 探针超时 60s + 超时后一次透明
+ * 重试：桌面重启后的首个 wsl.exe 冷启动可以超过短上限 — and it names `listLinuxDir`,
+ * `checkLinuxPath` and `resolveDistroHome` in the same sentence as the probes that
+ * already had it (`resolveIdentity`, `detectRunner`, the NO_NEW_PRIVS probe, the PTY's
+ * python3 probe). These three were the only parsed-output probes still on a 30s ceiling
+ * with no retry, so a single wsl.exe stall longer than 30s threw straight out of
+ * `checkLinuxPath` — and the stall is a property of the machine, not of the path: the
+ * distribution shares one VM with every other one, and measured while that VM ran at
+ * load ~11 with its swap 95% full, this probe answered in ~300ms and then timed out at
+ * 30.4s and 30.5s on two consecutive calls. The retry is the same ruling the identity
+ * probe follows: repeat the SAME probe once, immediately, and let a persistent stall
+ * still fail loudly with the second attempt's evidence.
+ *
+ * Retrying is safe here because all three probes are READS: the listing protocol frames
+ * its own output and the check prints one of three tokens, so a repeat cannot duplicate
+ * a side effect. The trigger is deliberately `timedOut` alone and not "any bad answer":
+ * a non-zero exit from the listing script is the ordinary answer for a directory that is
+ * not there, and doubling the latency of that case would slow the interactive picker for
+ * no measured benefit.
+ * @param {(request: object) => Promise<object>} run - the probe runner.
+ * @param {object} request - the probe, without its ceiling.
+ * @returns {Promise<object>} the first conclusive attempt, or the second after a timeout.
+ */
+async function probeWithRetry(run, request) {
+  const first = await run({ ...request, timeoutMs: PROBE_TIMEOUT_MS })
+  if (first.timedOut !== true) return first
+  return await run({ ...request, timeoutMs: PROBE_TIMEOUT_MS })
+}
+
 /**
  * List one directory inside a distribution.
  * @param {string} distro - distribution name.
  * @param {string} linuxPath - absolute Linux directory.
- * @param {{ wslPath?: string }} [options] - the configured `wsl.exe` path.
+ * @param {{ wslPath?: string, run?: (options: object) => Promise<object> }} [options] - the configured `wsl.exe` path, and the probe runner (injectable so the retry policy below can be driven without a distribution — the same seam `resolveIdentity`/`detectRunner` expose).
  * @returns {Promise<{ path: string, parent: string | null, entries: Array<{ name: string, kind: 'directory' | 'file' }> }>} the listing.
  */
-export async function listLinuxDir(distro, linuxPath, { wslPath } = {}) {
+export async function listLinuxDir(distro, linuxPath, { wslPath, run = runWslShell } = {}) {
   const path = linuxPath.startsWith('/') ? linuxPath : `/${linuxPath}`
   // Entries are NUL-terminated so a filename containing a newline survives the
   // round trip; `..?*` covers names like `..keep` that `.[!.]*` misses.
@@ -532,7 +567,7 @@ export async function listLinuxDir(distro, linuxPath, { wslPath } = {}) {
   // UTF-16LE — with one-character entry names every NUL lands on exactly the
   // byte positions UTF-16LE uses — and guessing wrong returned [] for a
   // directory that is not empty.
-  const result = await runWslShell({ distro, linuxCwd: '/', command: script, loginShell: false, timeoutMs: 30_000, raw: true, wslPath })
+  const result = await probeWithRetry(run, { distro, linuxCwd: '/', command: script, loginShell: false, raw: true, wslPath })
   if (result.exitCode !== 0) {
     throw new Error(`无法列出 ${path}：${result.stderr.toString('utf8').trim() || `退出码 ${String(result.exitCode)}`}`)
   }
@@ -553,13 +588,13 @@ export async function listLinuxDir(distro, linuxPath, { wslPath } = {}) {
  * Check whether one Linux path exists.
  * @param {string} distro - distribution name.
  * @param {string} linuxPath - absolute Linux path.
- * @param {{ wslPath?: string }} [options] - the configured `wsl.exe` path.
+ * @param {{ wslPath?: string, run?: (options: object) => Promise<object> }} [options] - the configured `wsl.exe` path, and the probe runner (injectable so the retry policy below can be driven without a distribution).
  * @returns {Promise<{ exists: boolean, isDirectory: boolean }>} existence facts.
  */
-export async function checkLinuxPath(distro, linuxPath, { wslPath } = {}) {
+export async function checkLinuxPath(distro, linuxPath, { wslPath, run = runWslShell } = {}) {
   const script = `if [ -d ${shellQuote(linuxPath)} ]; then echo dir; `
     + `elif [ -e ${shellQuote(linuxPath)} ]; then echo other; else echo missing; fi`
-  const result = await runWslShell({ distro, linuxCwd: '/', command: script, loginShell: false, timeoutMs: 30_000, wslPath })
+  const result = await probeWithRetry(run, { distro, linuxCwd: '/', command: script, loginShell: false, wslPath })
   // A probe that could not RUN is not "the path is missing". When the script runs
   // at all it exits 0 and prints exactly one of its three answers, so a non-zero
   // code, a timeout, or an unreadable answer means the DISTRIBUTION failed
@@ -609,16 +644,16 @@ export function probeEvidence(entry) {
  * exactly one path.
  * @param {string} distro - distribution name.
  * @param {string} [username] - user to resolve; absent resolves the default user.
- * @param {{ wslPath?: string }} [options] - the configured `wsl.exe` path.
+ * @param {{ wslPath?: string, run?: (options: object) => Promise<object> }} [options] - the configured `wsl.exe` path, and the probe runner (injectable so the retry policy below can be driven without a distribution).
  * @returns {Promise<{ user: string, home: string }>} the user and their home.
  * @throws Error when the user or a usable home cannot be resolved.
  */
-export async function resolveDistroHome(distro, username, { wslPath } = {}) {
+export async function resolveDistroHome(distro, username, { wslPath, run = runWslShell } = {}) {
   let user = typeof username === 'string' ? username.trim() : ''
   if (user === '') {
     // Non-login + trimmed on purpose: the parsed answer must be provably this
     // probe's output (the login name), never profile scripts'.
-    const who = await runWslShell({ distro, linuxCwd: '/', command: 'id -un', loginShell: false, timeoutMs: 30_000, wslPath })
+    const who = await probeWithRetry(run, { distro, linuxCwd: '/', command: 'id -un', loginShell: false, wslPath })
     user = who.stdout.trim()
     if (user === '' || user.includes('\n')) {
       throw new Error(`无法确定发行版 ${distro} 的默认用户：${who.stderr.trim() || `退出码 ${String(who.exitCode)}`}`)
@@ -629,12 +664,11 @@ export async function resolveDistroHome(distro, username, { wslPath } = {}) {
   // output, not by the exit code. Exactly one passwd line is the only
   // unambiguous answer: a name getent misparses can dump the whole database,
   // and a multi-line "home" would only fail later and confusingly at listDir.
-  const entry = await runWslShell({
+  const entry = await probeWithRetry(run, {
     distro,
     linuxCwd: '/',
     command: `getent passwd ${shellQuote(user)} | cut -d: -f6`,
     loginShell: false,
-    timeoutMs: 30_000,
     wslPath,
   })
   const lines = entry.stdout.trim().split('\n')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "main": "lib/index.js",
   "exports": {