dsh-wsl-desktop 0.3.2 → 0.3.4

package/lib/client.js

@@ -446,7 +446,7 @@ window.__ModuleLoader__.load({
       function render() {
         const body = []
 
-        body.push(el('div', { fontSize: '15px', fontWeight: '600' }, '添加 WSL 工作区'))
+        body.push(el('div', { fontSize: '15px', fontWeight: '600' }, BUTTON_LABEL))
         body.push(el('div', { fontSize: '12px', color: T.dim },
           '新会话的 bash 与文件工具都会在该发行版里工作；Windows 文件可在 /mnt/<盘符> 下访问。'))
 
@@ -610,17 +610,28 @@ window.__ModuleLoader__.load({
       hostElement().append(overlay)
       render()
 
+      // The rejection handler only ever sees a refusal of listDistros itself; a
+      // throw INSIDE the continuation (a body the route did not expect,
+      // chooseDistro failing) would surface as an unhandled rejection —
+      // state.distros assigned without a render, the dialog stuck on its reading
+      // line, and nothing anywhere to read. One handler owns the whole chain.
       call('listDistros').then(async (names) => {
-        if (state.closed) return
-        state.distros = names
-        const fallback = await call('defaultDistro').catch(() => ({ distro: null }))
-        if (state.closed) return
-        const selected = names.includes(fallback.distro) ? fallback.distro : names[0] ?? null
-        if (selected === null) {
+        try {
+          if (state.closed) return
+          state.distros = names
+          const fallback = await call('defaultDistro').catch(() => ({ distro: null }))
+          if (state.closed) return
+          const selected = names.includes(fallback.distro) ? fallback.distro : names[0] ?? null
+          if (selected === null) {
+            render()
+            return
+          }
+          chooseDistro(selected)
+        } catch (failure) {
+          if (state.closed) return
+          state.error = message(failure)
           render()
-          return
         }
-        chooseDistro(selected)
       }, (failure) => {
         if (state.closed) return
         state.error = message(failure)
@@ -806,6 +817,30 @@ window.__ModuleLoader__.load({
       }
     }
 
+    /**
+     * Whether one observed mutation could have changed a workspace row's markup.
+     *
+     * Chat streaming mutates the transcript many times a second, and the icon scan
+     * is a whole-document `querySelectorAll` — running it at that rate is exactly
+     * the per-frame scan the trigger cache exists to avoid, and the comment on
+     * `sync` claimed it did not happen when it did. A row only changes when React
+     * writes inside one (add, remove, relabel, expand) or replaces its container,
+     * so a record whose target and nodes all sit outside every workspace row
+     * cannot have moved what the scan reads.
+     * @param {MutationRecord} record - one observed mutation.
+     * @returns {boolean} true when the icon scan has to re-run.
+     */
+    function touchesWorkspaceRow(record) {
+      const target = record.target
+      const anchor = target instanceof Element ? target : target.parentElement
+      if (anchor === null) return false
+      // Inside a row, IS a row, or IS an ancestor of the rows (the list container
+      // React re-renders rows into). The transcript pane satisfies none of the
+      // three, which is the whole point.
+      if (anchor.closest('[data-row-key^="workspace:"]') !== null) return true
+      return anchor.querySelector('[data-row-key^="workspace:"]') !== null
+    }
+
     /**
      * Re-attach the companion button when React replaced or reordered its anchor.
      *
@@ -814,8 +849,12 @@ window.__ModuleLoader__.load({
      * of feeding the observer a fresh mutation; hiding while connected is
      * expressed as `display`, which is not a childList mutation at all.
      * @param {object} ctx - the client plugin context.
+     * @param {boolean} [iconsDirty] - false skips the whole-document workspace-row
+     *   scan: the observer only asks for it when a mutation actually touched a
+     *   workspace row, so transcript churn (chat streaming) costs the cheap
+     *   placement checks below and nothing more.
      */
-    function sync(ctx) {
+    function sync(ctx, iconsDirty = true) {
       companion.scheduled = false
       // A frame queued before disposal must not run: it would re-mark the rows
       // the disposer just restored, with no observer left to converge it (see
@@ -823,7 +862,7 @@ window.__ModuleLoader__.load({
       if (companion.disposed === true) return
       // Runs before the companion's own early returns: marking workspace rows
       // is independent of whether the add-workspace trigger was found.
-      syncWorkspaceIcons(ctx)
+      if (iconsDirty) syncWorkspaceIcons(ctx)
       const { button } = companion
       if (button === null) return
       // Steady-state fast path: the cached trigger stays valid while it
@@ -902,12 +941,36 @@ window.__ModuleLoader__.load({
       // Cleared on every install: the flag is set by the disposer and this
       // companion object outlives a disable/enable cycle.
       companion.disposed = false
-      const observer = new MutationObserver(() => {
-        if (companion.scheduled) return
+      // Two independent things make the icon scan necessary, so they OR into one
+      // coalesced frame: the DOM actually changed inside the workspace rows, or the
+      // workspace LIST changed under them (a re-point edits the store, and the row
+      // markup may not move at all). Either trigger upgrades a scheduled
+      // transcript-only sync to a full pass; neither adds a timer.
+      let pendingIcons = false
+      const schedule = (iconsDirty) => {
+        if (companion.scheduled) {
+          if (iconsDirty) pendingIcons = true
+          return
+        }
         companion.scheduled = true
-        requestAnimationFrame(() => sync(ctx))
+        pendingIcons = iconsDirty
+        requestAnimationFrame(() => {
+          const dirty = pendingIcons
+          pendingIcons = false
+          sync(ctx, dirty)
+        })
+      }
+      const observer = new MutationObserver((mutations) => {
+        // The record list is the cheap discriminator: a transcript-only burst
+        // schedules a sync that skips the icon scan, while anything that touched a
+        // workspace row — or the container React renders rows into — schedules the
+        // full pass. Either way the placement checks below run as before.
+        schedule(mutations.some((record) => touchesWorkspaceRow(record)))
       })
       companion.observer = observer
+      const workspaceSource = ctx.workspaces?.list
+      const unsubscribe =
+        typeof workspaceSource?.subscribe === 'function' ? workspaceSource.subscribe(() => schedule(true)) : null
       sync(ctx)
       observer.observe(document.documentElement, { childList: true, subtree: true })
       const warning = setTimeout(() => {
@@ -920,6 +983,7 @@ window.__ModuleLoader__.load({
       return () => {
         clearTimeout(warning)
         observer.disconnect()
+        unsubscribe?.()
         // disconnect() does not cancel a callback already handed to
         // requestAnimationFrame, and that queued sync would re-inject the cloud
         // icons (and re-hide the shipped folder icons) after the loop below put

package/lib/index.js

@@ -513,30 +513,32 @@ const METHODS = {
         }
       }
 
-      // 0.1.7 moved serviceFor off the registry (now a standalone
-      // serviceForAgent in the package). The harness's own consumers use
-      // `agent.ctx.get(name)` — which resolves through the agent's scope chain
-      // into the realm — so that's the compatible form on both generations.
-      // 0.1.7 mounts preset services under the standing mount's own fiber —
-      // `agent.ctx.get` resolves the HOST services (the mount is not in the
-      // agent's scope chain). The harness's accessor is the exported
-      // serviceForAgent(ctx, agent, name); resolve it dynamically (the
-      // registry package lives in the host graph, not in this plugin's
-      // node_modules) and fall back to ctx.get on pre-0.1.7 hosts.
-      let realmService = null
-      try {
-        const registryModule = await import('@deepseek-ai/dsh-agent-preset-registry')
-        if (typeof registryModule.serviceForAgent === 'function') {
-          realmService = (name) => registryModule.serviceForAgent(hostCtx, agent, name)
-        }
-      } catch {
-        // Registry package not resolvable from this plugin — pre-0.1.7 host.
-      }
-      if (realmService === null) realmService = (name) => agent.ctx.get(name)
+      // A realm hides its services from the outside by design: the preset mount
+      // owns its own fiber, so `agent.ctx.get(name)` resolves the HOST plane.
+      // The registry is the only thing that can look inside, and it exposes
+      // that as the SERVICE METHOD `agentPresets.serviceFor(agent, name)`.
+      //
+      // This used to resolve the package-level `serviceForAgent(ctx, agent,
+      // name)` export dynamically. DSH 0.2.1-alpha.1 REMOVED that export
+      // (commit 2e3ab61940, "fix(presets): own composition mounts in registry
+      // service"; no upgrade-guide entry covers it), and the removal was
+      // silent here: the typeof probe simply missed, the ctx.get fallback then
+      // measured the HOST shell, and every step still reported success.
+      // `serviceFor` performs the same mount-fiber store scan the removed
+      // export did, reached through the service instead of the module.
+      //
+      // The ctx.get fallback stays for genuinely pre-0.1.7 hosts, but the
+      // accessor that answered travels WITH each observation, so a fallback
+      // can never again be read as a realm measurement.
+      const realmAccessor = typeof presets.serviceFor === 'function' ? 'agentPresets.serviceFor' : 'agent.ctx.get'
+      const realmService = realmAccessor === 'agentPresets.serviceFor'
+        ? (name) => presets.serviceFor(agent, name)
+        : (name) => agent.ctx.get(name)
 
       const shell = realmService('shell')
       record('shell.service', {
         found: shell !== undefined,
+        accessor: realmAccessor,
         sandboxMode: shell?.sandboxMode ?? null,
         proto: Object.getOwnPropertyNames(Object.getPrototypeOf(shell ?? {})).join(','),
         executeType: typeof shell?.execute,
@@ -561,7 +563,7 @@ const METHODS = {
       }
 
       const fs = realmService('fs')
-      record('fs.service', { found: fs !== undefined })
+      record('fs.service', { found: fs !== undefined, accessor: realmAccessor })
       if (fs !== undefined) {
         // A mutation is called the way the tool layer calls it: `tool-fs`
         // resolves a per-call policy and stamps the calling session's cwd as the
@@ -592,7 +594,7 @@ const METHODS = {
       }
 
       const subprocess = realmService('subprocess')
-      record('subprocess.service', { found: subprocess !== undefined })
+      record('subprocess.service', { found: subprocess !== undefined, accessor: realmAccessor })
       if (subprocess !== undefined) {
         try {
           const environment = await subprocess.terminalEnvironment()
@@ -722,10 +724,16 @@ const METHODS = {
    * @param {{ distro?: string, linuxPath?: string }} params - target directory.
    * @returns {Promise<object>} what each step observed.
    */
-  workspaceFlow: async ({ distro, linuxPath = '/tmp' }) => {
+  workspaceFlow: async ({ distro, linuxPath }) => {
     const registry = hostCtx.get('workspaceRegistry')
     if (registry === undefined) throw new Error('workspaceRegistry 服务不可用')
-    const target = await resolveLocation(linuxPath, distro)
+    // Default the same way the selftest does — the distribution home, never /tmp:
+    // the fence refuses a workspace root under /tmp (confinement mounts a private
+    // tmpfs over it after binding the workspace), so a workspace registered there
+    // could never be used as a writable root. This method's old default handed the
+    // registry exactly such a path.
+    const location = linuxPath ?? (await defaultWorkspaceUnc({ wslPath: routeWslPath })).uncPath
+    const target = await resolveLocation(location, distro)
     const listing = await listLinuxDir(target.distro, target.linuxPath, { wslPath: routeWslPath })
     const facts = await checkLinuxPath(target.distro, target.linuxPath, { wslPath: routeWslPath })
     const existing = await registry.resolveByPath(target.uncPath)
@@ -959,7 +967,11 @@ export function apply(ctx, config) {
   hostCtx = ctx
   routeWslPath = config.wslPath
   // Bound concurrent route methods: each discovery call spawns wsl.exe, and a
-  // misbehaving page could fan out without limit.
+  // misbehaving page could fan out without limit. Named because a bare "8" here
+  // was once mis-read as a wsl.exe SPAWN cap — it is not: one route method may
+  // fan out several children (a command plus its probes). The spawn cap is
+  // MAX_CONCURRENT_SPAWNS in lib/wsl/world.js.
+  const MAX_ROUTE_IN_FLIGHT = 8
   let routeInFlight = 0
   // The WSL providers start `wsl.exe`, an ordinary Windows process, through the
   // host's own subprocess provider. A realm that isolates `subprocess` shadows
@@ -1030,7 +1042,7 @@ export function apply(ctx, config) {
         sendRejection(res, admitted)
         return
       }
-      if (routeInFlight >= 8) {
+      if (routeInFlight >= MAX_ROUTE_IN_FLIGHT) {
         sendJson(res, 503, { ok: false, code: 'too-busy' })
         return
       }

package/lib/wsl/confinement.js

@@ -23,7 +23,7 @@ import { shellQuote } from './paths.js'
 import { fileURLToPath } from 'node:url'
 import { dirname, join } from 'node:path'
 
-/** Shipped helper script, installed by the operator (see README). */
+/** Shipped helper script, installed by the operator (see docs/CONFINEMENT.md). */
 export const HELPER_SOURCE = join(dirname(fileURLToPath(import.meta.url)), 'dsh-wsl-confine.sh')
 
 /** The direct runner: sudo-wrapped unshare with the fence built in-process. */
@@ -32,7 +32,7 @@ export const RUNNER_SUDO_UNSHARE = 'sudo-unshare'
 /** The hardened runner: a root-owned helper that always fences before exec. */
 export const RUNNER_HELPER = 'helper'
 
-/** Where the operator installs the confinement helper (see README). */
+/** Where the operator installs the confinement helper (see docs/CONFINEMENT.md). */
 export const HELPER_PATH = '/usr/local/sbin/dsh-wsl-confine'
 
 /**
@@ -193,7 +193,7 @@ function helperGateScript(helperPath) {
     // root under an argument-wildcarded grant), while the ancestor walk below
     // can only walk one of the two chains. Refusal is simpler, fail-closed, and
     // costs only the hardened runner: the probe falls back to the direct
-    // sudo-unshare runner, and the README's install is a real file copy.
+    // sudo-unshare runner, and docs/CONFINEMENT.md's install is a real file copy.
     // Today such a path is refused already — but only as collateral, because
     // 'stat' does NOT follow a link and reports the link's own fixed 0777 mode,
     // which fails the write-bit test below. Nothing in the script says so, so
@@ -421,7 +421,7 @@ export async function detectNoNewPrivs({ distro, username, run }) {
  * unconditionally (dsh-wsl-confine.sh), so on a setpriv without the flag setpriv
  * rejects the unknown option and exits 1 — the confined command simply does not
  * run, and that is an ordinary COMMAND failure, not the setup-failure marker
- * that reports an unavailable runner. README.md:129 records the measured exit 1;
+ * that reports an unavailable runner. docs/CONFINEMENT.md:33 records the measured exit 1;
  * this text previously contradicted it by recommending the helper as a remedy.
  *
  * The remedy names the PROBEABLE requirement, not a version: the util-linux release
@@ -576,6 +576,20 @@ function exemptPattern(keep) {
   return `^(${[...new Set([...keep, ...KERNEL_SURFACES])].map(escapeEre).join('|')})$`
 }
 
+/**
+ * The shared head of the read-only sweep and the post-condition: list the
+ * namespace's mount targets, decode findmnt's hex escapes, drop the exempt ones
+ * (a failing grep is a setup failure, not a command failure), and hand the rest
+ * to a per-target loop. The two callers differ only in the loop BODY, so the head
+ * lives in one place — a decode or quoting fix cannot land in one and be missed
+ * in the other, which is the drift the helper exists to make impossible.
+ * @param {string} pattern - the exemption ERE as DATA (the callers pass
+ *   exemptPattern(keep)'s output unquoted); this helper applies shellQuote.
+ * @returns {string} the pipeline up to the per-target loop.
+ */
+function sweepHead(pattern) {
+  return `findmnt -rno TARGET | while IFS= read -r raw; do printf '%b\\n' "$raw"; done | { grep -Ev ${shellQuote(pattern)} || fail ${shellQuote('exemption grep failed')}; } | while IFS= read -r target; do`
+}
 /**
  * The shell fragment that makes every remaining writable mount read-only.
  *
@@ -601,7 +615,7 @@ function readOnlySweep(keep) {
     // stay WRITABLE while the postcondition tested the bogus name. Decode
     // before matching: findmnt only ever emits \xNN for literal characters
     // (literal backslash arrives as \x5c), so bash's %b is lossless here.
-    `findmnt -rno TARGET | while IFS= read -r raw; do printf '%b\\n' "$raw"; done | { grep -Ev ${shellQuote(pattern)} || fail ${shellQuote('exemption grep failed')}; } | while IFS= read -r target; do`,
+    sweepHead(pattern),
     '  mount -o remount,ro,bind "$target" >/dev/null 2>&1 || true;',
     'done',
   ].join('\n')
@@ -631,7 +645,7 @@ function postConditions(keep) {
     // `fail` still exits 97 from inside the loop, which pipefail turns into
     // the script's own setup failure — the marker and exit code still
     // surface.
-    `findmnt -rno TARGET | while IFS= read -r raw; do printf '%b\\n' "$raw"; done | { grep -Ev ${shellQuote(pattern)} || fail ${shellQuote('exemption grep failed')}; } | while IFS= read -r target; do`,
+    sweepHead(pattern),
     '  [ -w "$target" ] && fail "$target is still writable";',
     '  true;',
     'done',

package/lib/wsl/fence.js

@@ -36,13 +36,38 @@ export function canonicalHostPath(path) {
   }
 }
 
+/**
+ * Whether two spellings name DIFFERENT distributions, both of them WSL UNCs.
+ *
+ * The rule behind the boolean: the Linux portion of a WSL UNC is ambiguous across
+ * distributions — 9P shares are not per-filesystem, so same-spelled paths on two
+ * distributions can carry the same content — and the distribution segment is a
+ * WINDOWS spelling, which folds case, so the comparison is case-insensitive while
+ * the Linux portion above it stays case-sensitive. One-sided answers (a drive
+ * path against a UNC root, either side not a WSL UNC at all) are NOT cross-distro:
+ * those compare by their own namespace rules.
+ *
+ * ONE owner, because this exact test stood in `isUnderHost` and in `contains()`
+ * (the fence's two containment consumers) and had to be kept in sync by hand.
+ * @param {string} a - one spelling.
+ * @param {string} b - the other spelling.
+ * @returns {boolean} true when both parse as WSL UNCs and the distribution
+ *   segments differ.
+ */
+export function crossDistroUnc(a, b) {
+  const aUnc = parseWslUnc(a)
+  const bUnc = parseWslUnc(b)
+  return aUnc !== null && bUnc !== null
+    && aUnc.distro.toLowerCase() !== bUnc.distro.toLowerCase()
+}
+
 /**
  * Lexical containment with a separator boundary. The boundary is what stops
  * `/proj` matching `/proj-secret`.
  *
  * Only the WINDOWS spellings fold. The UNC host and the distribution segment are
  * Windows spellings and compare case-insensitively; the Linux portion does not,
- * because the share resolves it with Linux semantics (README, "Measured fence
+ * because the share resolves it with Linux semantics (docs/FS-FENCE.md, "Measured fence
  * facts": `/TMP` is ENOENT where `/tmp` exists, so `PROJ` and `proj` are
  * different directories). Folding it judged a target under a case-variant
  * sibling of the writable root to be contained — and that escape needed no
@@ -203,7 +228,7 @@ export async function isUnderHost(targetKey, root) {
   // THROUGH THE TARGET'S OWN SHARE — so a foreign target's ancestors are compared
   // against a LOCAL root's identity. Inode numbers are per-filesystem, but the 9P
   // shares are not: this machine's `debian` and `debian-dev` report the SAME
-  // (dev,ino) for /, /tmp and /home (dev 0; ino 2, 1, 16386 — README, "Measured fence
+  // (dev,ino) for /, /tmp and /home (dev 0; ino 2, 1, 16386 — docs/FS-FENCE.md, "Measured fence
   // facts"), so an identity collision across two distributions read as containment, and
   // a workspace-write session could be authorized to write into another distribution's
   // /tmp — which `writableHostRootsFor` ALWAYS grants. `contains()` (./fs.js) already
@@ -222,10 +247,7 @@ export async function isUnderHost(targetKey, root) {
   // `wsl.exe -d DEBIAN` names the same distribution — so it is compared
   // case-insensitively, the way `isLexicallyUnderHost` folds the prefix and
   // `contains()` compares.
-  const targetUnc = parseWslUnc(targetKey)
-  const rootUnc = parseWslUnc(root)
-  if (targetUnc !== null && rootUnc !== null
-    && targetUnc.distro.toLowerCase() !== rootUnc.distro.toLowerCase()) return false
+  if (crossDistroUnc(targetKey, root)) return false
   const rootInfo = await statIfPresent(root)
   if (rootInfo === undefined) return false
   let ancestor = targetKey
@@ -274,7 +296,7 @@ export function writableHostRootsFor(policy, distro) {
   // coerces to the STRING "undefined", which matches the grammar — so an absent
   // distro used to produce a root spelled \\wsl.localhost\undefined\tmp. That
   // root can never match, silently dropping the distribution's /tmp from the
-  // allow-list (a write the README grants was refused), and it disguised the
+  // allow-list (a write docs/FS-FENCE.md grants was refused), and it disguised the
   // provider-side config bug that made the distro undefined in the first place.
   const distroTmp = typeof distro === 'string' && DISTRO_NAME.test(distro)
     ? joinWslUnc(distro, '/tmp')

package/lib/wsl/fs.js

@@ -23,7 +23,7 @@ import { pathToFileURL } from 'node:url'
 import { LocalFileSystem } from '@deepseek-ai/dsh-fs-local'
 import { FsError } from '@deepseek-ai/dsh-fs'
 import z from '@deepseek-ai/schemastery'
-import { isUnderHost, writableHostRootsFor } from './fence.js'
+import { crossDistroUnc, isUnderHost, writableHostRootsFor } from './fence.js'
 import { isWindowsPathShaped, joinWslUnc, mntToWindowsPath, parseWslUnc, windowsToMntPath } from './paths.js'
 import { publishReplace } from './publish.js'
 
@@ -210,7 +210,14 @@ export class WslFileSystem extends LocalFileSystem {
     for (const root of this.writableHostRoots(policy)) {
       if (await isUnderHost(fresh.targetKey, root)) return fresh
     }
-    throw new FsError(`cannot write "${target.displayPath}": file access denied under workspace-write mode`, 'FS_SANDBOX_DENIED')
+    // Any mode that is neither granted nor refused above still fails closed —
+    // writableHostRootsFor grants nothing it does not recognise — but the denial
+    // must name the mode it actually saw: a mode arriving here that this backend
+    // does not implement would otherwise be triaged as a workspace-write
+    // containment question, with the real question (who passed this mode in)
+    // left unasked.
+    const deniedUnder = mode === 'workspace-write' ? 'workspace-write mode' : `unsupported mode '${String(mode)}'`
+    throw new FsError(`cannot write "${target.displayPath}": file access denied under ${deniedUnder}`, 'FS_SANDBOX_DENIED')
   }
 
   /**
@@ -316,10 +323,9 @@ export class WslFileSystem extends LocalFileSystem {
    * @returns {boolean} true when child is parent or below it.
    */
   contains(parent, child) {
-    const parentDistro = parseWslUnc(parent.targetKey)?.distro
-    const childDistro = parseWslUnc(child.targetKey)?.distro
-    if (parentDistro !== undefined && childDistro !== undefined
-      && parentDistro.toLowerCase() !== childDistro.toLowerCase()) return false
+    // The SAME cross-distribution rule fence.js's identity walk applies, now one
+    // shared helper — the two fail-closed distro checks cannot drift apart.
+    if (crossDistroUnc(parent.targetKey, child.targetKey)) return false
     const relative = posix.relative(this.processPath(parent), this.processPath(child))
     return relative === '' || (relative !== '..' && !relative.startsWith('../'))
   }

package/lib/wsl/paths.js

@@ -12,8 +12,16 @@
 /** UNC hosts Windows uses for the WSL 9P share. */
 const UNC_HOSTS = new Set(['wsl.localhost', 'wsl$'])
 
-/** A distribution name that is safe to concatenate into a UNC path. */
-export const DISTRO_NAME = /^[A-Za-z0-9._-]+$/
+/**
+ * A distribution name that is safe to concatenate into a UNC path.
+ *
+ * A name made ENTIRELY of dots is refused even though every one of its characters
+ * is in the class: as a path segment `.` and `..` are the current and the parent
+ * directory, so `\\wsl.localhost\..\<path>` would hand the share a traversal
+ * spelling. No real distribution name is all dots, and `wsl.exe -d ..` cannot be
+ * a legal invocation, so the lookahead costs nothing legitimate.
+ */
+export const DISTRO_NAME = /^(?!\.+$)[A-Za-z0-9._-]+$/
 
 /** A Linux user name that is safe to pass as a single wsl.exe -u option value. */
 export const LINUX_USER = /^[A-Za-z0-9._][A-Za-z0-9._-]*\$?$/

package/lib/wsl/preset.js

@@ -133,7 +133,7 @@ export function buildWorldGroup({ subprocessPath, shellPath, fsPath, distro, inc
   // a Linux-only workdir fell back to the machine's DEFAULT distribution, and the
   // fs fence derived its distro `/tmp` writable root from the literal string
   // "undefined" (joinWslUnc(undefined, '/tmp') does not throw), so a write the
-  // README grants was refused.
+  // docs/FS-FENCE.md grants was refused.
   const distroConfig = distro === undefined ? {} : { config: { distro } }
   /** Re-mount one host-world tool row, keeping the operator's own config for it. */
   const toolRow = (id, name) => {

package/lib/wsl/pty.js

@@ -17,7 +17,7 @@
 
 import { appendFileSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
-import { homedir, tmpdir } from 'node:os'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { shellQuote } from './paths.js'
 import { buildWslExecArgv, runWslShell } from './world.js'

package/lib/wsl/shell.js

@@ -41,10 +41,7 @@ import {
   workspaceRootInLinux,
 } from './confinement.js'
 import { parseWslUnc, shellQuote, windowsToMntPath } from './paths.js'
-import { WSL_CHILD_ENV, planWsl, runWslShell, withWslEnvFlags } from './world.js'
-
-/** Model-readable environment overrides applied to every command. */
-const ENV_OVERRIDES = { ...WSL_CHILD_ENV, NO_COLOR: '1', TERM: 'dumb', PAGER: 'cat', GIT_PAGER: 'cat' }
+import { ENV_OVERRIDES, planWsl, runWslShell, withWslEnvFlags } from './world.js'
 
 /** Default foreground timeout in milliseconds. */
 const DEFAULT_TIMEOUT_MS = 120_000
@@ -253,7 +250,9 @@ export class WslShellExecutor extends ShellExecutor {
         linuxCwd: plan.linuxCwd,
         mode,
         runner,
-        workspaceLinuxRoot: workspaceLinuxRoot ?? undefined,
+        // Not `?? undefined`: the null case already threw above, so the fallback
+        // could never fire and the expression was a no-op read of the same value.
+        workspaceLinuxRoot,
         identity,
         noNewPrivs,
         isolateProcesses: this.config.isolateProcesses,

package/lib/wsl/subprocess.js

@@ -34,7 +34,7 @@ import { LoginShellUnresolvedError, WSL_CHILD_ENV, buildWslExecArgv, planWsl, re
 /**
  * The executable lookup's ceiling, on the documented probe policy.
  *
- * Was 15s and the shortest ceiling in the plugin. README.md:132 / README.en.md:132 name
+ * Was 15s and the shortest ceiling in the plugin. docs/CONFINEMENT.md:36 names
  * `resolveExecutable` in the same sentence as 探针超时 60s + 超时后一次透明重试, and it is an
  * output-parsed probe like the siblings that sentence lists (the comment on the probe below
  * says so), so it gets the same 60s as `listLinuxDir`/`checkLinuxPath`/`resolveDistroHome`

package/lib/wsl/terminal-bridge.py

@@ -21,6 +21,7 @@ Exits with the child's own exit status (128 + signal when it was killed).
 """
 
 import errno
+import atexit
 import fcntl
 import json
 import os
@@ -128,10 +129,22 @@ class Bridge:
         self.control_open = True
         self.revision = 0
         self.last_state = None
+        self.fifo = fifo
         self.control_fd = self._open_control(fifo)
         self._spawn()
         self.resize(cols, rows)
 
+    def remove_fifo(self):
+        """Unlink this bridge's control FIFO. Idempotent, and safe at any stage:
+        before the FIFO exists it raises FileNotFoundError, which is swallowed, and
+        after removal a second call does the same. The host runs a compensating
+        rm -f on every session-ending path, but that is a backstop for the paths
+        this process cannot catch (SIGKILL) — it is not the owner."""
+        try:
+            os.unlink(self.fifo)
+        except OSError:
+            pass
+
     def _open_control(self, fifo):
         """Create the control FIFO and hold its read end open."""
         try:
@@ -413,13 +426,37 @@ def main():
     cols, rows = sys.argv[2], sys.argv[3]
     argv = sys.argv[4:]
     bridge = Bridge(fifo, cols, rows, argv)
+
+    # The finally below covers every orderly path, but it does not run when the
+    # BRIDGE ITSELF is signalled — and the FIFO is the one thing this process owns
+    # exclusively, so the host's compensating rm -f must not be the only remover.
+    # SIGTERM and SIGINT therefore remove it first, then restore the default
+    # disposition and re-raise: a signalled bridge still reports 128+n, exactly the
+    # status it already had with no handler installed (an uncaught SIGTERM kills by
+    # default), so this changes what gets cleaned up and nothing else. SIGKILL is
+    # uncatchable by construction and stays the host's backstop.
+    atexit.register(bridge.remove_fifo)
+    for name in ("SIGTERM", "SIGINT"):
+        number = getattr(signal, name, None)
+        if number is None:
+            continue
+
+        def handler(signum, _frame, _default=number):
+            bridge.remove_fifo()
+            signal.signal(signum, signal.SIG_DFL)
+            os.kill(os.getpid(), signum)
+
+        try:
+            signal.signal(number, handler)
+        except (ValueError, OSError):
+            # Registered off the main thread, or the platform refuses it: the
+            # finally below still covers every orderly path.
+            pass
+
     try:
         code = bridge.run()
     finally:
-        try:
-            os.unlink(fifo)
-        except OSError:
-            pass
+        bridge.remove_fifo()
     return code