dsh-wsl-desktop 0.3.2 → 0.3.4

package/lib/wsl/world.js

@@ -62,8 +62,16 @@ const LXSS_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss'
  */
 export const WSL_CHILD_ENV = { WSL_UTF8: '1' }
 
-/** Environment overrides that keep command output model-readable. */
-const ENV_OVERRIDES = { ...WSL_CHILD_ENV, NO_COLOR: '1', TERM: 'dumb', PAGER: 'cat', GIT_PAGER: 'cat' }
+/**
+ * Environment overrides that keep command output model-readable.
+ *
+ * ONE owner, shared with the shell executor (which spreads it into every
+ * command it runs) — an override added to one copy and not the other used to be
+ * a silent divergence two modules could not see. Frozen so a shared object stays
+ * shared on purpose: an accidental write now throws instead of leaking into the
+ * other consumer's environment.
+ */
+export const ENV_OVERRIDES = Object.freeze({ ...WSL_CHILD_ENV, NO_COLOR: '1', TERM: 'dumb', PAGER: 'cat', GIT_PAGER: 'cat' })
 
 /**
  * Decode `wsl.exe` output.
@@ -398,6 +406,52 @@ export function buildWslExecArgv(plan, argv, options = {}) {
   ]
 }
 
+/** The most wsl.exe processes this module runs at once.
+ *
+ * Every spawn here lands on ONE shared WSL2 VM, and this file's own notes record it
+ * stalling under load (a cold start clears a 30 s ceiling, and a busy sibling
+ * distribution stalled probes past theirs). The HTTP route bounds its own methods
+ * (lib/index.js `routeInFlight`), but one route call can fan out several wsl.exe
+ * children — a command plus its confinement probes, executable lookup and
+ * login-shell probe — so the route counter is not a spawn cap. This is.
+ *
+ * Deliberately a plain FIFO queue rather than a pool: no caller holds a slot while
+ * awaiting another wsl.exe call, so a hand-off can never deadlock, and FIFO order
+ * keeps an early caller from starving behind later ones.
+ */
+const MAX_CONCURRENT_SPAWNS = 8
+
+/** Spawns currently in flight. */
+let activeSpawns = 0
+
+/** Callers waiting for a slot; each holds a resolve that hands the slot over. */
+const spawnQueue = []
+
+/**
+ * Take one spawn slot, waiting for a release when the module is at its cap.
+ * @returns {Promise<void>} settled once the caller may spawn.
+ */
+function acquireSpawnSlot() {
+  if (activeSpawns < MAX_CONCURRENT_SPAWNS) {
+    activeSpawns += 1
+    return Promise.resolve()
+  }
+  return new Promise((resolve) => { spawnQueue.push(resolve) })
+}
+
+/**
+ * Give a spawn slot back — to the head of the queue when one waits (the count
+ * stays at the cap), otherwise back to the pool.
+ */
+function releaseSpawnSlot() {
+  const next = spawnQueue.shift()
+  if (next !== undefined) {
+    next()
+    return
+  }
+  activeSpawns -= 1
+}
+
 /**
  * Run one command inside a distribution.
  *
@@ -436,7 +490,11 @@ export function runWslShell({ distro, linuxCwd, command, username, loginShell =
     '--cd', linuxCwd,
     '-e', 'bash', loginShell ? '-lc' : '-c', script,
   ]
-  return new Promise((resolve, reject) => {
+  // Validation stays SYNCHRONOUS: callers rely on a bad distro/username throwing
+  // before anything is awaited. Only the spawn itself waits for a slot, so the cap
+  // never turns a grammar rejection into a rejected promise.
+  return acquireSpawnSlot()
+    .then(() => new Promise((resolve, reject) => {
     let child
     try {
       child = spawn(wslPath, argv, {
@@ -511,7 +569,8 @@ export function runWslShell({ distro, linuxCwd, command, username, loginShell =
     child.on('close', (code) => {
       settle(code, undefined)
     })
-  })
+    }))
+    .finally(releaseSpawnSlot)
 }
 
 /** The documented probe ceiling: 60s, because a cold VM's first spawn can exceed 30s. */
@@ -520,7 +579,7 @@ const PROBE_TIMEOUT_MS = 60_000
 /**
  * Ceiling for one parsed-output probe, and the retry that goes with it.
  *
- * README.md states this policy for exactly these probes — 探针超时 60s + 超时后一次透明
+ * docs/CONFINEMENT.md states this policy for exactly these probes — 探针超时 60s + 超时后一次透明
  * 重试：桌面重启后的首个 wsl.exe 冷启动可以超过短上限 — and it names `listLinuxDir`,
  * `checkLinuxPath` and `resolveDistroHome` in the same sentence as the probes that
  * already had it (`resolveIdentity`, `detectRunner`, the NO_NEW_PRIVS probe, the PTY's
@@ -569,7 +628,11 @@ export async function listLinuxDir(distro, linuxPath, { wslPath, run = runWslShe
   // directory that is not empty.
   const result = await probeWithRetry(run, { distro, linuxCwd: '/', command: script, loginShell: false, raw: true, wslPath })
   if (result.exitCode !== 0) {
-    throw new Error(`无法列出 ${path}：${result.stderr.toString('utf8').trim() || `退出码 ${String(result.exitCode)}`}`)
+    // The probe's own evidence goes into the message: a twice-retried cold-VM stall
+    // (exit code null) must read as a timeout, not as "退出码 null" — the transient
+    // failure a reader can act on by waking the distribution.
+    const stderr = result.stderr.toString('utf8').trim()
+    throw new Error(`无法列出 ${path}：${stderr || probeEvidence(result)}`)
   }
   const entries = result.stdout.toString('utf8')
     .split('\0')
@@ -656,7 +719,10 @@ export async function resolveDistroHome(distro, username, { wslPath, run = runWs
     const who = await probeWithRetry(run, { distro, linuxCwd: '/', command: 'id -un', loginShell: false, wslPath })
     user = who.stdout.trim()
     if (user === '' || user.includes('\n')) {
-      throw new Error(`无法确定发行版 ${distro} 的默认用户：${who.stderr.trim() || `退出码 ${String(who.exitCode)}`}`)
+      // probeEvidence, not a bare exit code: a twice-retried stall reports
+      // exitCode null, and "null" is not something a reader can act on. The
+      // sibling home probe below already does this for the same reason.
+      throw new Error(`无法确定发行版 ${distro} 的默认用户：${who.stderr.trim() || probeEvidence(who)}`)
     }
   }
   // `getent` reads the distro's own NSS user database. The pipeline's exit
@@ -768,7 +834,7 @@ export class LoginShellUnresolvedError extends Error {
  *
  * A probe that did not complete is NOT the empty-field case either. It used to
  * return `/bin/bash` like a real answer, so a stalled relay — the machine
- * transient README.md's probe policy exists for — silently pinned the session's
+ * transient docs/CONFINEMENT.md's probe policy exists for — silently pinned the session's
  * shell with a value the caller could not tell from the distribution's own. The
  * ceiling and the repeat are `probeWithRetry`'s (探针超时 60s + 超时后一次透明重试),
  * the same ruling `listLinuxDir`/`checkLinuxPath`/`resolveDistroHome` follow, and a
@@ -814,13 +880,29 @@ export async function resolveLoginShell(distro, username, { wslPath, run = runWs
     const stderr = typeof shell.stderr === 'string' ? shell.stderr.trim() : ''
     throw new LoginShellUnresolvedError(`无法确定发行版 ${distro} 的登录 shell：${stderr || probeEvidence(shell)}`)
   }
-  const resolved = shell.stdout.trim().split('\n')[0]?.trim() ?? ''
-  // EMPTY is the fallback; an ANSWERED value is returned as measured, so the test is
-  // deliberately `=== ''` and not `startsWith('/')`. A non-path answer such as
-  // `nologin` is the distribution's own ruling that this account has no interactive
-  // shell, and both callers SPAWN the value (subprocess.js hands it back as the
-  // resolved executable, and uses it as spawnTerminal's whole argv), so swapping in an
-  // unmeasured /bin/bash would open exactly the shell the account's passwd entry
-  // refuses — a value the caller cannot tell from one the probe measured.
+  // A MULTI-LINE answer is refused, not truncated to line 1: resolveDistroHome runs
+  // the same getent-passwd shape and refuses it because a name getent misparses can
+  // dump the whole database — taking line 1 would silently elect the FIRST entry's
+  // shell for whichever user the caller asked about. Exactly one line is the only
+  // unambiguous answer, and an unresolvable login shell is a SKIP for the terminal
+  // controller, while a wrong shell is a session that does not work. The refusal is
+  // on the LINE COUNT: a single line that trims to empty is NOT this case — that is
+  // the documented /bin/bash fallback below.
+  const lines = shell.stdout.trim().split('\n')
+  if (lines.length > 1) {
+    throw new LoginShellUnresolvedError(
+      `无法确定发行版 ${distro} 的登录 shell：getent 返回了 ${lines.length} 行，唯一一行才是无歧义答案`,
+    )
+  }
+  const resolved = lines[0].trim()
+  // EMPTY is the fallback (the only way `resolved` is empty past the refusal above
+  // is a single line that trims to nothing); an ANSWERED value is returned as
+  // measured, so the test is deliberately `=== ''` and not `startsWith('/')`. A
+  // non-path answer such as `nologin` is the distribution's own ruling that this
+  // account has no interactive shell, and both callers SPAWN the value
+  // (subprocess.js hands it back as the resolved executable, and uses it as
+  // spawnTerminal's whole argv), so swapping in an unmeasured /bin/bash would open
+  // exactly the shell the account's passwd entry refuses — a value the caller
+  // cannot tell from one the probe measured.
   return resolved === '' ? '/bin/bash' : resolved
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "main": "lib/index.js",
   "exports": {