dsh-wsl-desktop 0.3.3 → 0.3.4

package/lib/client.js

@@ -446,7 +446,7 @@ window.__ModuleLoader__.load({
       function render() {
         const body = []
 
-        body.push(el('div', { fontSize: '15px', fontWeight: '600' }, '添加 WSL 工作区'))
+        body.push(el('div', { fontSize: '15px', fontWeight: '600' }, BUTTON_LABEL))
         body.push(el('div', { fontSize: '12px', color: T.dim },
           '新会话的 bash 与文件工具都会在该发行版里工作；Windows 文件可在 /mnt/<盘符> 下访问。'))
 
@@ -610,17 +610,28 @@ window.__ModuleLoader__.load({
       hostElement().append(overlay)
       render()
 
+      // The rejection handler only ever sees a refusal of listDistros itself; a
+      // throw INSIDE the continuation (a body the route did not expect,
+      // chooseDistro failing) would surface as an unhandled rejection —
+      // state.distros assigned without a render, the dialog stuck on its reading
+      // line, and nothing anywhere to read. One handler owns the whole chain.
       call('listDistros').then(async (names) => {
-        if (state.closed) return
-        state.distros = names
-        const fallback = await call('defaultDistro').catch(() => ({ distro: null }))
-        if (state.closed) return
-        const selected = names.includes(fallback.distro) ? fallback.distro : names[0] ?? null
-        if (selected === null) {
+        try {
+          if (state.closed) return
+          state.distros = names
+          const fallback = await call('defaultDistro').catch(() => ({ distro: null }))
+          if (state.closed) return
+          const selected = names.includes(fallback.distro) ? fallback.distro : names[0] ?? null
+          if (selected === null) {
+            render()
+            return
+          }
+          chooseDistro(selected)
+        } catch (failure) {
+          if (state.closed) return
+          state.error = message(failure)
           render()
-          return
         }
-        chooseDistro(selected)
       }, (failure) => {
         if (state.closed) return
         state.error = message(failure)
@@ -806,6 +817,30 @@ window.__ModuleLoader__.load({
       }
     }
 
+    /**
+     * Whether one observed mutation could have changed a workspace row's markup.
+     *
+     * Chat streaming mutates the transcript many times a second, and the icon scan
+     * is a whole-document `querySelectorAll` — running it at that rate is exactly
+     * the per-frame scan the trigger cache exists to avoid, and the comment on
+     * `sync` claimed it did not happen when it did. A row only changes when React
+     * writes inside one (add, remove, relabel, expand) or replaces its container,
+     * so a record whose target and nodes all sit outside every workspace row
+     * cannot have moved what the scan reads.
+     * @param {MutationRecord} record - one observed mutation.
+     * @returns {boolean} true when the icon scan has to re-run.
+     */
+    function touchesWorkspaceRow(record) {
+      const target = record.target
+      const anchor = target instanceof Element ? target : target.parentElement
+      if (anchor === null) return false
+      // Inside a row, IS a row, or IS an ancestor of the rows (the list container
+      // React re-renders rows into). The transcript pane satisfies none of the
+      // three, which is the whole point.
+      if (anchor.closest('[data-row-key^="workspace:"]') !== null) return true
+      return anchor.querySelector('[data-row-key^="workspace:"]') !== null
+    }
+
     /**
      * Re-attach the companion button when React replaced or reordered its anchor.
      *
@@ -814,8 +849,12 @@ window.__ModuleLoader__.load({
      * of feeding the observer a fresh mutation; hiding while connected is
      * expressed as `display`, which is not a childList mutation at all.
      * @param {object} ctx - the client plugin context.
+     * @param {boolean} [iconsDirty] - false skips the whole-document workspace-row
+     *   scan: the observer only asks for it when a mutation actually touched a
+     *   workspace row, so transcript churn (chat streaming) costs the cheap
+     *   placement checks below and nothing more.
      */
-    function sync(ctx) {
+    function sync(ctx, iconsDirty = true) {
       companion.scheduled = false
       // A frame queued before disposal must not run: it would re-mark the rows
       // the disposer just restored, with no observer left to converge it (see
@@ -823,7 +862,7 @@ window.__ModuleLoader__.load({
       if (companion.disposed === true) return
       // Runs before the companion's own early returns: marking workspace rows
       // is independent of whether the add-workspace trigger was found.
-      syncWorkspaceIcons(ctx)
+      if (iconsDirty) syncWorkspaceIcons(ctx)
       const { button } = companion
       if (button === null) return
       // Steady-state fast path: the cached trigger stays valid while it
@@ -902,12 +941,36 @@ window.__ModuleLoader__.load({
       // Cleared on every install: the flag is set by the disposer and this
       // companion object outlives a disable/enable cycle.
       companion.disposed = false
-      const observer = new MutationObserver(() => {
-        if (companion.scheduled) return
+      // Two independent things make the icon scan necessary, so they OR into one
+      // coalesced frame: the DOM actually changed inside the workspace rows, or the
+      // workspace LIST changed under them (a re-point edits the store, and the row
+      // markup may not move at all). Either trigger upgrades a scheduled
+      // transcript-only sync to a full pass; neither adds a timer.
+      let pendingIcons = false
+      const schedule = (iconsDirty) => {
+        if (companion.scheduled) {
+          if (iconsDirty) pendingIcons = true
+          return
+        }
         companion.scheduled = true
-        requestAnimationFrame(() => sync(ctx))
+        pendingIcons = iconsDirty
+        requestAnimationFrame(() => {
+          const dirty = pendingIcons
+          pendingIcons = false
+          sync(ctx, dirty)
+        })
+      }
+      const observer = new MutationObserver((mutations) => {
+        // The record list is the cheap discriminator: a transcript-only burst
+        // schedules a sync that skips the icon scan, while anything that touched a
+        // workspace row — or the container React renders rows into — schedules the
+        // full pass. Either way the placement checks below run as before.
+        schedule(mutations.some((record) => touchesWorkspaceRow(record)))
       })
       companion.observer = observer
+      const workspaceSource = ctx.workspaces?.list
+      const unsubscribe =
+        typeof workspaceSource?.subscribe === 'function' ? workspaceSource.subscribe(() => schedule(true)) : null
       sync(ctx)
       observer.observe(document.documentElement, { childList: true, subtree: true })
       const warning = setTimeout(() => {
@@ -920,6 +983,7 @@ window.__ModuleLoader__.load({
       return () => {
         clearTimeout(warning)
         observer.disconnect()
+        unsubscribe?.()
         // disconnect() does not cancel a callback already handed to
         // requestAnimationFrame, and that queued sync would re-inject the cloud
         // icons (and re-hide the shipped folder icons) after the loop below put

package/lib/index.js

@@ -513,30 +513,32 @@ const METHODS = {
         }
       }
 
-      // 0.1.7 moved serviceFor off the registry (now a standalone
-      // serviceForAgent in the package). The harness's own consumers use
-      // `agent.ctx.get(name)` — which resolves through the agent's scope chain
-      // into the realm — so that's the compatible form on both generations.
-      // 0.1.7 mounts preset services under the standing mount's own fiber —
-      // `agent.ctx.get` resolves the HOST services (the mount is not in the
-      // agent's scope chain). The harness's accessor is the exported
-      // serviceForAgent(ctx, agent, name); resolve it dynamically (the
-      // registry package lives in the host graph, not in this plugin's
-      // node_modules) and fall back to ctx.get on pre-0.1.7 hosts.
-      let realmService = null
-      try {
-        const registryModule = await import('@deepseek-ai/dsh-agent-preset-registry')
-        if (typeof registryModule.serviceForAgent === 'function') {
-          realmService = (name) => registryModule.serviceForAgent(hostCtx, agent, name)
-        }
-      } catch {
-        // Registry package not resolvable from this plugin — pre-0.1.7 host.
-      }
-      if (realmService === null) realmService = (name) => agent.ctx.get(name)
+      // A realm hides its services from the outside by design: the preset mount
+      // owns its own fiber, so `agent.ctx.get(name)` resolves the HOST plane.
+      // The registry is the only thing that can look inside, and it exposes
+      // that as the SERVICE METHOD `agentPresets.serviceFor(agent, name)`.
+      //
+      // This used to resolve the package-level `serviceForAgent(ctx, agent,
+      // name)` export dynamically. DSH 0.2.1-alpha.1 REMOVED that export
+      // (commit 2e3ab61940, "fix(presets): own composition mounts in registry
+      // service"; no upgrade-guide entry covers it), and the removal was
+      // silent here: the typeof probe simply missed, the ctx.get fallback then
+      // measured the HOST shell, and every step still reported success.
+      // `serviceFor` performs the same mount-fiber store scan the removed
+      // export did, reached through the service instead of the module.
+      //
+      // The ctx.get fallback stays for genuinely pre-0.1.7 hosts, but the
+      // accessor that answered travels WITH each observation, so a fallback
+      // can never again be read as a realm measurement.
+      const realmAccessor = typeof presets.serviceFor === 'function' ? 'agentPresets.serviceFor' : 'agent.ctx.get'
+      const realmService = realmAccessor === 'agentPresets.serviceFor'
+        ? (name) => presets.serviceFor(agent, name)
+        : (name) => agent.ctx.get(name)
 
       const shell = realmService('shell')
       record('shell.service', {
         found: shell !== undefined,
+        accessor: realmAccessor,
         sandboxMode: shell?.sandboxMode ?? null,
         proto: Object.getOwnPropertyNames(Object.getPrototypeOf(shell ?? {})).join(','),
         executeType: typeof shell?.execute,
@@ -561,7 +563,7 @@ const METHODS = {
       }
 
       const fs = realmService('fs')
-      record('fs.service', { found: fs !== undefined })
+      record('fs.service', { found: fs !== undefined, accessor: realmAccessor })
       if (fs !== undefined) {
         // A mutation is called the way the tool layer calls it: `tool-fs`
         // resolves a per-call policy and stamps the calling session's cwd as the
@@ -592,7 +594,7 @@ const METHODS = {
       }
 
       const subprocess = realmService('subprocess')
-      record('subprocess.service', { found: subprocess !== undefined })
+      record('subprocess.service', { found: subprocess !== undefined, accessor: realmAccessor })
       if (subprocess !== undefined) {
         try {
           const environment = await subprocess.terminalEnvironment()
@@ -722,10 +724,16 @@ const METHODS = {
    * @param {{ distro?: string, linuxPath?: string }} params - target directory.
    * @returns {Promise<object>} what each step observed.
    */
-  workspaceFlow: async ({ distro, linuxPath = '/tmp' }) => {
+  workspaceFlow: async ({ distro, linuxPath }) => {
     const registry = hostCtx.get('workspaceRegistry')
     if (registry === undefined) throw new Error('workspaceRegistry 服务不可用')
-    const target = await resolveLocation(linuxPath, distro)
+    // Default the same way the selftest does — the distribution home, never /tmp:
+    // the fence refuses a workspace root under /tmp (confinement mounts a private
+    // tmpfs over it after binding the workspace), so a workspace registered there
+    // could never be used as a writable root. This method's old default handed the
+    // registry exactly such a path.
+    const location = linuxPath ?? (await defaultWorkspaceUnc({ wslPath: routeWslPath })).uncPath
+    const target = await resolveLocation(location, distro)
     const listing = await listLinuxDir(target.distro, target.linuxPath, { wslPath: routeWslPath })
     const facts = await checkLinuxPath(target.distro, target.linuxPath, { wslPath: routeWslPath })
     const existing = await registry.resolveByPath(target.uncPath)
@@ -959,7 +967,11 @@ export function apply(ctx, config) {
   hostCtx = ctx
   routeWslPath = config.wslPath
   // Bound concurrent route methods: each discovery call spawns wsl.exe, and a
-  // misbehaving page could fan out without limit.
+  // misbehaving page could fan out without limit. Named because a bare "8" here
+  // was once mis-read as a wsl.exe SPAWN cap — it is not: one route method may
+  // fan out several children (a command plus its probes). The spawn cap is
+  // MAX_CONCURRENT_SPAWNS in lib/wsl/world.js.
+  const MAX_ROUTE_IN_FLIGHT = 8
   let routeInFlight = 0
   // The WSL providers start `wsl.exe`, an ordinary Windows process, through the
   // host's own subprocess provider. A realm that isolates `subprocess` shadows
@@ -1030,7 +1042,7 @@ export function apply(ctx, config) {
         sendRejection(res, admitted)
         return
       }
-      if (routeInFlight >= 8) {
+      if (routeInFlight >= MAX_ROUTE_IN_FLIGHT) {
         sendJson(res, 503, { ok: false, code: 'too-busy' })
         return
       }

package/lib/wsl/confinement.js

@@ -576,6 +576,20 @@ function exemptPattern(keep) {
   return `^(${[...new Set([...keep, ...KERNEL_SURFACES])].map(escapeEre).join('|')})$`
 }
 
+/**
+ * The shared head of the read-only sweep and the post-condition: list the
+ * namespace's mount targets, decode findmnt's hex escapes, drop the exempt ones
+ * (a failing grep is a setup failure, not a command failure), and hand the rest
+ * to a per-target loop. The two callers differ only in the loop BODY, so the head
+ * lives in one place — a decode or quoting fix cannot land in one and be missed
+ * in the other, which is the drift the helper exists to make impossible.
+ * @param {string} pattern - the exemption ERE as DATA (the callers pass
+ *   exemptPattern(keep)'s output unquoted); this helper applies shellQuote.
+ * @returns {string} the pipeline up to the per-target loop.
+ */
+function sweepHead(pattern) {
+  return `findmnt -rno TARGET | while IFS= read -r raw; do printf '%b\\n' "$raw"; done | { grep -Ev ${shellQuote(pattern)} || fail ${shellQuote('exemption grep failed')}; } | while IFS= read -r target; do`
+}
 /**
  * The shell fragment that makes every remaining writable mount read-only.
  *
@@ -601,7 +615,7 @@ function readOnlySweep(keep) {
     // stay WRITABLE while the postcondition tested the bogus name. Decode
     // before matching: findmnt only ever emits \xNN for literal characters
     // (literal backslash arrives as \x5c), so bash's %b is lossless here.
-    `findmnt -rno TARGET | while IFS= read -r raw; do printf '%b\\n' "$raw"; done | { grep -Ev ${shellQuote(pattern)} || fail ${shellQuote('exemption grep failed')}; } | while IFS= read -r target; do`,
+    sweepHead(pattern),
     '  mount -o remount,ro,bind "$target" >/dev/null 2>&1 || true;',
     'done',
   ].join('\n')
@@ -631,7 +645,7 @@ function postConditions(keep) {
     // `fail` still exits 97 from inside the loop, which pipefail turns into
     // the script's own setup failure — the marker and exit code still
     // surface.
-    `findmnt -rno TARGET | while IFS= read -r raw; do printf '%b\\n' "$raw"; done | { grep -Ev ${shellQuote(pattern)} || fail ${shellQuote('exemption grep failed')}; } | while IFS= read -r target; do`,
+    sweepHead(pattern),
     '  [ -w "$target" ] && fail "$target is still writable";',
     '  true;',
     'done',

package/lib/wsl/fence.js

@@ -36,6 +36,31 @@ export function canonicalHostPath(path) {
   }
 }
 
+/**
+ * Whether two spellings name DIFFERENT distributions, both of them WSL UNCs.
+ *
+ * The rule behind the boolean: the Linux portion of a WSL UNC is ambiguous across
+ * distributions — 9P shares are not per-filesystem, so same-spelled paths on two
+ * distributions can carry the same content — and the distribution segment is a
+ * WINDOWS spelling, which folds case, so the comparison is case-insensitive while
+ * the Linux portion above it stays case-sensitive. One-sided answers (a drive
+ * path against a UNC root, either side not a WSL UNC at all) are NOT cross-distro:
+ * those compare by their own namespace rules.
+ *
+ * ONE owner, because this exact test stood in `isUnderHost` and in `contains()`
+ * (the fence's two containment consumers) and had to be kept in sync by hand.
+ * @param {string} a - one spelling.
+ * @param {string} b - the other spelling.
+ * @returns {boolean} true when both parse as WSL UNCs and the distribution
+ *   segments differ.
+ */
+export function crossDistroUnc(a, b) {
+  const aUnc = parseWslUnc(a)
+  const bUnc = parseWslUnc(b)
+  return aUnc !== null && bUnc !== null
+    && aUnc.distro.toLowerCase() !== bUnc.distro.toLowerCase()
+}
+
 /**
  * Lexical containment with a separator boundary. The boundary is what stops
  * `/proj` matching `/proj-secret`.
@@ -222,10 +247,7 @@ export async function isUnderHost(targetKey, root) {
   // `wsl.exe -d DEBIAN` names the same distribution — so it is compared
   // case-insensitively, the way `isLexicallyUnderHost` folds the prefix and
   // `contains()` compares.
-  const targetUnc = parseWslUnc(targetKey)
-  const rootUnc = parseWslUnc(root)
-  if (targetUnc !== null && rootUnc !== null
-    && targetUnc.distro.toLowerCase() !== rootUnc.distro.toLowerCase()) return false
+  if (crossDistroUnc(targetKey, root)) return false
   const rootInfo = await statIfPresent(root)
   if (rootInfo === undefined) return false
   let ancestor = targetKey

package/lib/wsl/fs.js

@@ -23,7 +23,7 @@ import { pathToFileURL } from 'node:url'
 import { LocalFileSystem } from '@deepseek-ai/dsh-fs-local'
 import { FsError } from '@deepseek-ai/dsh-fs'
 import z from '@deepseek-ai/schemastery'
-import { isUnderHost, writableHostRootsFor } from './fence.js'
+import { crossDistroUnc, isUnderHost, writableHostRootsFor } from './fence.js'
 import { isWindowsPathShaped, joinWslUnc, mntToWindowsPath, parseWslUnc, windowsToMntPath } from './paths.js'
 import { publishReplace } from './publish.js'
 
@@ -210,7 +210,14 @@ export class WslFileSystem extends LocalFileSystem {
     for (const root of this.writableHostRoots(policy)) {
       if (await isUnderHost(fresh.targetKey, root)) return fresh
     }
-    throw new FsError(`cannot write "${target.displayPath}": file access denied under workspace-write mode`, 'FS_SANDBOX_DENIED')
+    // Any mode that is neither granted nor refused above still fails closed —
+    // writableHostRootsFor grants nothing it does not recognise — but the denial
+    // must name the mode it actually saw: a mode arriving here that this backend
+    // does not implement would otherwise be triaged as a workspace-write
+    // containment question, with the real question (who passed this mode in)
+    // left unasked.
+    const deniedUnder = mode === 'workspace-write' ? 'workspace-write mode' : `unsupported mode '${String(mode)}'`
+    throw new FsError(`cannot write "${target.displayPath}": file access denied under ${deniedUnder}`, 'FS_SANDBOX_DENIED')
   }
 
   /**
@@ -316,10 +323,9 @@ export class WslFileSystem extends LocalFileSystem {
    * @returns {boolean} true when child is parent or below it.
    */
   contains(parent, child) {
-    const parentDistro = parseWslUnc(parent.targetKey)?.distro
-    const childDistro = parseWslUnc(child.targetKey)?.distro
-    if (parentDistro !== undefined && childDistro !== undefined
-      && parentDistro.toLowerCase() !== childDistro.toLowerCase()) return false
+    // The SAME cross-distribution rule fence.js's identity walk applies, now one
+    // shared helper — the two fail-closed distro checks cannot drift apart.
+    if (crossDistroUnc(parent.targetKey, child.targetKey)) return false
     const relative = posix.relative(this.processPath(parent), this.processPath(child))
     return relative === '' || (relative !== '..' && !relative.startsWith('../'))
   }

package/lib/wsl/paths.js

@@ -12,8 +12,16 @@
 /** UNC hosts Windows uses for the WSL 9P share. */
 const UNC_HOSTS = new Set(['wsl.localhost', 'wsl$'])
 
-/** A distribution name that is safe to concatenate into a UNC path. */
-export const DISTRO_NAME = /^[A-Za-z0-9._-]+$/
+/**
+ * A distribution name that is safe to concatenate into a UNC path.
+ *
+ * A name made ENTIRELY of dots is refused even though every one of its characters
+ * is in the class: as a path segment `.` and `..` are the current and the parent
+ * directory, so `\\wsl.localhost\..\<path>` would hand the share a traversal
+ * spelling. No real distribution name is all dots, and `wsl.exe -d ..` cannot be
+ * a legal invocation, so the lookahead costs nothing legitimate.
+ */
+export const DISTRO_NAME = /^(?!\.+$)[A-Za-z0-9._-]+$/
 
 /** A Linux user name that is safe to pass as a single wsl.exe -u option value. */
 export const LINUX_USER = /^[A-Za-z0-9._][A-Za-z0-9._-]*\$?$/

package/lib/wsl/pty.js

@@ -17,7 +17,7 @@
 
 import { appendFileSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
-import { homedir, tmpdir } from 'node:os'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { shellQuote } from './paths.js'
 import { buildWslExecArgv, runWslShell } from './world.js'

package/lib/wsl/shell.js

@@ -41,10 +41,7 @@ import {
   workspaceRootInLinux,
 } from './confinement.js'
 import { parseWslUnc, shellQuote, windowsToMntPath } from './paths.js'
-import { WSL_CHILD_ENV, planWsl, runWslShell, withWslEnvFlags } from './world.js'
-
-/** Model-readable environment overrides applied to every command. */
-const ENV_OVERRIDES = { ...WSL_CHILD_ENV, NO_COLOR: '1', TERM: 'dumb', PAGER: 'cat', GIT_PAGER: 'cat' }
+import { ENV_OVERRIDES, planWsl, runWslShell, withWslEnvFlags } from './world.js'
 
 /** Default foreground timeout in milliseconds. */
 const DEFAULT_TIMEOUT_MS = 120_000
@@ -253,7 +250,9 @@ export class WslShellExecutor extends ShellExecutor {
         linuxCwd: plan.linuxCwd,
         mode,
         runner,
-        workspaceLinuxRoot: workspaceLinuxRoot ?? undefined,
+        // Not `?? undefined`: the null case already threw above, so the fallback
+        // could never fire and the expression was a no-op read of the same value.
+        workspaceLinuxRoot,
         identity,
         noNewPrivs,
         isolateProcesses: this.config.isolateProcesses,

package/lib/wsl/terminal-bridge.py

@@ -21,6 +21,7 @@ Exits with the child's own exit status (128 + signal when it was killed).
 """
 
 import errno
+import atexit
 import fcntl
 import json
 import os
@@ -128,10 +129,22 @@ class Bridge:
         self.control_open = True
         self.revision = 0
         self.last_state = None
+        self.fifo = fifo
         self.control_fd = self._open_control(fifo)
         self._spawn()
         self.resize(cols, rows)
 
+    def remove_fifo(self):
+        """Unlink this bridge's control FIFO. Idempotent, and safe at any stage:
+        before the FIFO exists it raises FileNotFoundError, which is swallowed, and
+        after removal a second call does the same. The host runs a compensating
+        rm -f on every session-ending path, but that is a backstop for the paths
+        this process cannot catch (SIGKILL) — it is not the owner."""
+        try:
+            os.unlink(self.fifo)
+        except OSError:
+            pass
+
     def _open_control(self, fifo):
         """Create the control FIFO and hold its read end open."""
         try:
@@ -413,13 +426,37 @@ def main():
     cols, rows = sys.argv[2], sys.argv[3]
     argv = sys.argv[4:]
     bridge = Bridge(fifo, cols, rows, argv)
+
+    # The finally below covers every orderly path, but it does not run when the
+    # BRIDGE ITSELF is signalled — and the FIFO is the one thing this process owns
+    # exclusively, so the host's compensating rm -f must not be the only remover.
+    # SIGTERM and SIGINT therefore remove it first, then restore the default
+    # disposition and re-raise: a signalled bridge still reports 128+n, exactly the
+    # status it already had with no handler installed (an uncaught SIGTERM kills by
+    # default), so this changes what gets cleaned up and nothing else. SIGKILL is
+    # uncatchable by construction and stays the host's backstop.
+    atexit.register(bridge.remove_fifo)
+    for name in ("SIGTERM", "SIGINT"):
+        number = getattr(signal, name, None)
+        if number is None:
+            continue
+
+        def handler(signum, _frame, _default=number):
+            bridge.remove_fifo()
+            signal.signal(signum, signal.SIG_DFL)
+            os.kill(os.getpid(), signum)
+
+        try:
+            signal.signal(number, handler)
+        except (ValueError, OSError):
+            # Registered off the main thread, or the platform refuses it: the
+            # finally below still covers every orderly path.
+            pass
+
     try:
         code = bridge.run()
     finally:
-        try:
-            os.unlink(fifo)
-        except OSError:
-            pass
+        bridge.remove_fifo()
     return code
 
 

package/lib/wsl/world.js

@@ -62,8 +62,16 @@ const LXSS_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss'
  */
 export const WSL_CHILD_ENV = { WSL_UTF8: '1' }
 
-/** Environment overrides that keep command output model-readable. */
-const ENV_OVERRIDES = { ...WSL_CHILD_ENV, NO_COLOR: '1', TERM: 'dumb', PAGER: 'cat', GIT_PAGER: 'cat' }
+/**
+ * Environment overrides that keep command output model-readable.
+ *
+ * ONE owner, shared with the shell executor (which spreads it into every
+ * command it runs) — an override added to one copy and not the other used to be
+ * a silent divergence two modules could not see. Frozen so a shared object stays
+ * shared on purpose: an accidental write now throws instead of leaking into the
+ * other consumer's environment.
+ */
+export const ENV_OVERRIDES = Object.freeze({ ...WSL_CHILD_ENV, NO_COLOR: '1', TERM: 'dumb', PAGER: 'cat', GIT_PAGER: 'cat' })
 
 /**
  * Decode `wsl.exe` output.
@@ -398,6 +406,52 @@ export function buildWslExecArgv(plan, argv, options = {}) {
   ]
 }
 
+/** The most wsl.exe processes this module runs at once.
+ *
+ * Every spawn here lands on ONE shared WSL2 VM, and this file's own notes record it
+ * stalling under load (a cold start clears a 30 s ceiling, and a busy sibling
+ * distribution stalled probes past theirs). The HTTP route bounds its own methods
+ * (lib/index.js `routeInFlight`), but one route call can fan out several wsl.exe
+ * children — a command plus its confinement probes, executable lookup and
+ * login-shell probe — so the route counter is not a spawn cap. This is.
+ *
+ * Deliberately a plain FIFO queue rather than a pool: no caller holds a slot while
+ * awaiting another wsl.exe call, so a hand-off can never deadlock, and FIFO order
+ * keeps an early caller from starving behind later ones.
+ */
+const MAX_CONCURRENT_SPAWNS = 8
+
+/** Spawns currently in flight. */
+let activeSpawns = 0
+
+/** Callers waiting for a slot; each holds a resolve that hands the slot over. */
+const spawnQueue = []
+
+/**
+ * Take one spawn slot, waiting for a release when the module is at its cap.
+ * @returns {Promise<void>} settled once the caller may spawn.
+ */
+function acquireSpawnSlot() {
+  if (activeSpawns < MAX_CONCURRENT_SPAWNS) {
+    activeSpawns += 1
+    return Promise.resolve()
+  }
+  return new Promise((resolve) => { spawnQueue.push(resolve) })
+}
+
+/**
+ * Give a spawn slot back — to the head of the queue when one waits (the count
+ * stays at the cap), otherwise back to the pool.
+ */
+function releaseSpawnSlot() {
+  const next = spawnQueue.shift()
+  if (next !== undefined) {
+    next()
+    return
+  }
+  activeSpawns -= 1
+}
+
 /**
  * Run one command inside a distribution.
  *
@@ -436,7 +490,11 @@ export function runWslShell({ distro, linuxCwd, command, username, loginShell =
     '--cd', linuxCwd,
     '-e', 'bash', loginShell ? '-lc' : '-c', script,
   ]
-  return new Promise((resolve, reject) => {
+  // Validation stays SYNCHRONOUS: callers rely on a bad distro/username throwing
+  // before anything is awaited. Only the spawn itself waits for a slot, so the cap
+  // never turns a grammar rejection into a rejected promise.
+  return acquireSpawnSlot()
+    .then(() => new Promise((resolve, reject) => {
     let child
     try {
       child = spawn(wslPath, argv, {
@@ -511,7 +569,8 @@ export function runWslShell({ distro, linuxCwd, command, username, loginShell =
     child.on('close', (code) => {
       settle(code, undefined)
     })
-  })
+    }))
+    .finally(releaseSpawnSlot)
 }
 
 /** The documented probe ceiling: 60s, because a cold VM's first spawn can exceed 30s. */
@@ -569,7 +628,11 @@ export async function listLinuxDir(distro, linuxPath, { wslPath, run = runWslShe
   // directory that is not empty.
   const result = await probeWithRetry(run, { distro, linuxCwd: '/', command: script, loginShell: false, raw: true, wslPath })
   if (result.exitCode !== 0) {
-    throw new Error(`无法列出 ${path}：${result.stderr.toString('utf8').trim() || `退出码 ${String(result.exitCode)}`}`)
+    // The probe's own evidence goes into the message: a twice-retried cold-VM stall
+    // (exit code null) must read as a timeout, not as "退出码 null" — the transient
+    // failure a reader can act on by waking the distribution.
+    const stderr = result.stderr.toString('utf8').trim()
+    throw new Error(`无法列出 ${path}：${stderr || probeEvidence(result)}`)
   }
   const entries = result.stdout.toString('utf8')
     .split('\0')
@@ -656,7 +719,10 @@ export async function resolveDistroHome(distro, username, { wslPath, run = runWs
     const who = await probeWithRetry(run, { distro, linuxCwd: '/', command: 'id -un', loginShell: false, wslPath })
     user = who.stdout.trim()
     if (user === '' || user.includes('\n')) {
-      throw new Error(`无法确定发行版 ${distro} 的默认用户：${who.stderr.trim() || `退出码 ${String(who.exitCode)}`}`)
+      // probeEvidence, not a bare exit code: a twice-retried stall reports
+      // exitCode null, and "null" is not something a reader can act on. The
+      // sibling home probe below already does this for the same reason.
+      throw new Error(`无法确定发行版 ${distro} 的默认用户：${who.stderr.trim() || probeEvidence(who)}`)
     }
   }
   // `getent` reads the distro's own NSS user database. The pipeline's exit
@@ -814,13 +880,29 @@ export async function resolveLoginShell(distro, username, { wslPath, run = runWs
     const stderr = typeof shell.stderr === 'string' ? shell.stderr.trim() : ''
     throw new LoginShellUnresolvedError(`无法确定发行版 ${distro} 的登录 shell：${stderr || probeEvidence(shell)}`)
   }
-  const resolved = shell.stdout.trim().split('\n')[0]?.trim() ?? ''
-  // EMPTY is the fallback; an ANSWERED value is returned as measured, so the test is
-  // deliberately `=== ''` and not `startsWith('/')`. A non-path answer such as
-  // `nologin` is the distribution's own ruling that this account has no interactive
-  // shell, and both callers SPAWN the value (subprocess.js hands it back as the
-  // resolved executable, and uses it as spawnTerminal's whole argv), so swapping in an
-  // unmeasured /bin/bash would open exactly the shell the account's passwd entry
-  // refuses — a value the caller cannot tell from one the probe measured.
+  // A MULTI-LINE answer is refused, not truncated to line 1: resolveDistroHome runs
+  // the same getent-passwd shape and refuses it because a name getent misparses can
+  // dump the whole database — taking line 1 would silently elect the FIRST entry's
+  // shell for whichever user the caller asked about. Exactly one line is the only
+  // unambiguous answer, and an unresolvable login shell is a SKIP for the terminal
+  // controller, while a wrong shell is a session that does not work. The refusal is
+  // on the LINE COUNT: a single line that trims to empty is NOT this case — that is
+  // the documented /bin/bash fallback below.
+  const lines = shell.stdout.trim().split('\n')
+  if (lines.length > 1) {
+    throw new LoginShellUnresolvedError(
+      `无法确定发行版 ${distro} 的登录 shell：getent 返回了 ${lines.length} 行，唯一一行才是无歧义答案`,
+    )
+  }
+  const resolved = lines[0].trim()
+  // EMPTY is the fallback (the only way `resolved` is empty past the refusal above
+  // is a single line that trims to nothing); an ANSWERED value is returned as
+  // measured, so the test is deliberately `=== ''` and not `startsWith('/')`. A
+  // non-path answer such as `nologin` is the distribution's own ruling that this
+  // account has no interactive shell, and both callers SPAWN the value
+  // (subprocess.js hands it back as the resolved executable, and uses it as
+  // spawnTerminal's whole argv), so swapping in an unmeasured /bin/bash would open
+  // exactly the shell the account's passwd entry refuses — a value the caller
+  // cannot tell from one the probe measured.
   return resolved === '' ? '/bin/bash' : resolved
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "type": "module",
   "main": "lib/index.js",
   "exports": {