dsh-wsl-desktop 0.3.7 → 0.5.0

package/lib/wsl/preset.js

@@ -35,9 +35,19 @@ export const WORLD_ROWS = new Set([
  * depth. Beyond the five canonical rows, the persistent/terminal family ships
  * NESTED in the minimal preset's `persistent-shell` group with non-canonical
  * ids — an enabled host PowerShell persistent tool inside a preset whose name
- * and persona assert distro-contained execution. `tool-bash`/`tool-fs` are
- * deliberately absent: those names are re-mounted in their WSL form inside
- * the wsl-world group; their host-world forms are removed by id.
+ * and persona assert distro-contained execution.
+ *
+ * `tool-bash` and `tool-fs` are deliberately absent, and the reason is NOT "their
+ * WSL forms are re-mounted under the same package name". `tool-fs` IS re-mounted
+ * from `@deepseek-ai/dsh-tool-fs`; the realm's shell is
+ * `@deepseek-ai/dsh-tool-bash-persistent`, so a base row naming
+ * `@deepseek-ai/dsh-tool-bash` under a non-canonical id SURVIVES this transform
+ * (reported through `unclassified`, not removed, because the transform must not
+ * guess a row away) and would register a second `bash` beside the realm's own.
+ * What actually keeps exactly one owner is the row set in `buildWorldGroup`
+ * below, which mounts no one-shot shell row — not this list. Widening this set
+ * is therefore a separate decision with its own cost (it would also drop such a
+ * row from presets where it is the only shell), and it is not made here.
  */
 export const WORLD_MODULE_NAMES = new Set([
   '@deepseek-ai/dsh-tool-pwsh',
@@ -191,6 +201,25 @@ export function hasClassifierVerdict(name) {
   ))
 }
 
+/**
+ * The persistent `bash` tool's model-facing description, restated LITERALLY.
+ *
+ * Nothing carries it into the variant: `prune()` records `toolConfig` only for the five
+ * canonical `WORLD_ROWS` ids plus `str-replace-editor`, while the persistent row is removed
+ * by MODULE NAME — so a bare re-mount would silently answer with the package default instead
+ * of the text the deployment declares. Source of truth for the text:
+ * `packages/bundle/web-app/presets/minimal.patch.yml:52-59`.
+ */
+export const PERSISTENT_BASH_DESCRIPTION = [
+  'Run commands in a bash shell',
+  '* When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.',
+  '* Network access depends on the task environment. Prefer configured mirrors/proxies when they are available.',
+  '* State is persistent across command calls and discussions with the user.',
+  "* To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.",
+  '* Please avoid commands that may produce a very large amount of output.',
+  "* Please run long lived commands in the background, e.g. 'sleep 10 &' or start a server in the background.",
+].join('\n')
+
 /**
  * Build the `wsl-world` isolate group as a plugin-entry OBJECT.
  *
@@ -202,12 +231,14 @@ export function hasClassifierVerdict(name) {
  * @param {string} options.subprocessPath - module specifier of the WSL subprocess provider.
  * @param {string} options.shellPath - module specifier of the WSL shell executor.
  * @param {string} options.fsPath - module specifier of the WSL filesystem provider.
+ * @param {string} options.sandboxPath - module specifier of the WSL confinement provider.
+ * @param {string} options.searchPath - module specifier of this plugin's WSL search tools.
  * @param {string | undefined} options.distro - distribution for paths that do not name one.
  * @param {boolean} options.includeEditor - whether the source preset mounted the string-replace editor.
  * @param {Map<string, object>} [options.toolConfig] - config the pruned host-world rows carried, keyed by row id.
  * @returns {object} the group entry.
  */
-export function buildWorldGroup({ subprocessPath, shellPath, fsPath, distro, includeEditor, toolConfig }) {
+export function buildWorldGroup({ subprocessPath, shellPath, fsPath, sandboxPath, searchPath, distro, includeEditor, toolConfig }) {
   // The pin belongs under `config`, NOT as a sibling row key. The loader hands a
   // plugin ONLY `options.config` (`registry.plugin(plugin, this.options.config, …)`),
   // and nothing relocates row keys into it — so as a bare `distro` key every
@@ -226,22 +257,101 @@ export function buildWorldGroup({ subprocessPath, shellPath, fsPath, distro, inc
     { id: 'subprocess-wsl', name: subprocessPath, ...distroConfig },
     { id: 'shell-wsl', name: shellPath, ...distroConfig },
     { id: 'fs-wsl', name: fsPath, ...distroConfig },
-    // No terminal registry row: the Web terminal controller spawns through
-    // `agent.ctx.get('subprocess').spawnTerminal(...)`, so the realm's
-    // subprocess provider already puts the PTY inside the distribution.
-    // The operator's config for these rows travels with them: re-declaring them
-    // bare silently dropped settings the base preset had set (a non-default
-    // maxOutputChars on the editor, enableRunInBackground on tool-bash, …), so a
-    // value honoured in the host world vanished in the WSL world.
-    toolRow('tool-bash', '@deepseek-ai/dsh-tool-bash'),
+    // The realm's own confinement provider, and the reason this group isolates `sandbox`
+    // (below). Two things are settled by mounting it HERE:
+    //
+    //   - the realm stops asking the HOST. `ctx.get('sandbox')` inside an unisolated group
+    //     resolved to `@deepseek-ai/dsh-sandbox-local`, whose Windows rung wraps the argv in
+    //     an ACL restricted-token runner and grants the workspace root — an ACL grant on a
+    //     9P UNC spelling fails with `GetNamedSecurityInfoW … (Win32 1)`, so every terminal
+    //     spawn in the realm died there rather than starting a shell;
+    //   - the terminal stack gets the SAME in-distro fence the realm's shell executor
+    //     already applies. `terminal-bash`'s `spawnArgv` wraps its argv through
+    //     `ctx.get('sandbox')` for every mode but `danger-full-access`, and this provider
+    //     builds that wrapper from `./confinement.js` + the distribution's own
+    //     `dsh-wsl-confine` helper — not a second mechanism. Without this row the caller's
+    //     argv reaches the PTY UNFENCED, which is the security face Task 1 measured.
+    { id: 'sandbox-wsl', name: sandboxPath, ...distroConfig },
+    // The realm's terminal stack, HAND-WRITTEN — never a copy of the harness's rows: those
+    // carry `disabled: !!js process.platform === 'win32'` (`minimal.patch.yml:44,49`), which
+    // is evaluated in THIS host process and would mount the row DISABLED on this Windows
+    // desktop (F12). The removal rule and `prune` are untouched: these entries are appended
+    // inside the group AFTER the prune pass, so WORLD_MODULE_NAMES still owns their
+    // BASE-preset twins (design §3's two directions).
+    //
+    // `dsh-terminal` provides the `terminals` service; an unisolated service provider lands
+    // in the ROOT realm and the mount is refused, so the group declares `terminals: true`
+    // below (F11). The backend registers its PTY mechanism into that registry and spawns
+    // through `ctx.subprocess` — which inside this realm IS this plugin's distribution-side
+    // PTY provider (`lib/wsl/subprocess.js:269`), so the shell really is a PTY inside the
+    // distribution (F7).
+    { id: 'pty', name: '@deepseek-ai/dsh-terminal' },
+    { id: 'terminal-bash', name: '@deepseek-ai/dsh-terminal-bash' },
+    // ONE owner of the model-facing name `bash`. The persistent row registers `bash`, and so
+    // did the one-shot row that used to stand further down; the harness's own minimal preset
+    // resolves the same question the same way — it mounts no one-shot shell row BECAUSE it
+    // mounts the persistent stack (`apps/cli/tests/windows-shell.spec.ts:127-134`).
+    //
+    // WHICH of the two answered here was MEASURED before the one-shot row was removed: the
+    // live probe read M1 = P2 — the persistent shell completed `tools.bashPersist.b` and read
+    // back the cwd the first call made — so the persistent row is the realm's `bash` owner.
+    // The one-shot row was NOT inert, though: the pre-change inventory showed BOTH `bash`
+    // rows `fiberState: 2` with no `broken`, so re-registration did not throw in this realm
+    // (the store's duplicate contract at `packages/core/scope/src/store.ts:43-45` describes
+    // the store, not the observed mount — ruling R33). It was a second live registrant that
+    // could re-win the name on a registration-order change, which is why it had to go.
+    //
+    // Removing it also removes what that package provided and this one does not: the
+    // `tool:bash` systemPrompt section (`packages/shell/tool-bash/src/index.ts:251-255`) and
+    // the jobs-backed background path. The harness's minimal preset makes the same trade
+    // (`packages/bundle/web-app/presets/minimal.patch.yml`), so this is parity, stated rather
+    // than discovered later.
+    //
+    // Sources for the measurement: the ledger's 活体验证 section (ruling R29) and
+    // `artifacts/live-M1-M3-c1.txt:1550`. NOT this brief and not Task 1's report — neither
+    // recorded a measurement.
+    //
+    // The config is restated literally: `toolRow()` cannot carry it (see
+    // PERSISTENT_BASH_DESCRIPTION above), and the operator-visible timeout is part of the
+    // contract the model lives with (the harness's own row sets `timeoutMs: 300000`).
+    { id: 'persistent-bash', name: '@deepseek-ai/dsh-tool-bash-persistent', config: {
+      timeoutMs: 300_000,
+      description: PERSISTENT_BASH_DESCRIPTION,
+    } },
+    // The Web terminal controller spawns through
+    // `agent.ctx.get('subprocess').spawnTerminal(...)`, so it needs no terminal row of its
+    // own: the realm's subprocess provider already puts its PTY inside the distribution.
+    // The operator's config for these rows travels with them: re-declaring them bare
+    // silently dropped settings the base preset had set (a non-default maxOutputChars on
+    // the editor, …), so a value honoured in the host world vanished in the WSL world.
     toolRow('tool-fs', '@deepseek-ai/dsh-tool-fs'),
     ...(includeEditor ? [toolRow('str-replace-editor', '@deepseek-ai/dsh-tool-str-replace-editor')] : []),
+    // Searching is re-mounted the same way fs is: the two NAMES the model already knows,
+    // over a module of THIS plugin. It cannot be a carried host row — the host's
+    // search package is removed by WORLD_MODULE_NAMES, so naming it back would recreate the
+    // row the transform exists to drop (its argv[0] is a packaged Windows ripgrep binary).
+    //
+    // Both rows name ONE module, so the row's config is what tells that instance which tool
+    // to register: toolRow() is deliberately NOT used here — it would reapply the pruned
+    // host search row's config (a `sampleOverCapGlobResults`/caps shape this module does not
+    // read, and whose `tool` field would be absent), failing the row at mount time instead of
+    // mounting it. The tool name is also exactly `grep`/`glob`: callers invoke tools by name,
+    // and the row id is a separate thing that happens to spell the same.
+    { id: 'grep', name: searchPath, config: { tool: 'grep' } },
+    { id: 'glob', name: searchPath, config: { tool: 'glob' } },
   ]
   return {
     id: 'wsl-world',
     name: 'cordis:group',
     group: true,
-    isolate: { shell: true, fs: true, subprocess: true },
+    // `terminals` and `sandbox` are both required keys, for the same reason: the rows above
+    // PROVIDE those services, and the loader refuses a provider inside a group that does not
+    // isolate it (`mount.ts:213`) — but the isolation is also what makes each service answer
+    // from inside the realm. `sandbox` is the one that changes an observable: isolated, the
+    // terminal stack can no longer reach the host's sandbox provider and its Windows ACL
+    // runner, which fails on this realm's UNC workspace. `shell`, `fs` and `subprocess` are
+    // the realm's own execution seams.
+    isolate: { shell: true, fs: true, subprocess: true, terminals: true, sandbox: true },
     config,
   }
 }
@@ -306,11 +416,13 @@ function cloneRow(row) {
  * @param {string} options.subprocessPath - module specifier of the WSL subprocess provider.
  * @param {string} options.shellPath - module specifier of the WSL shell executor.
  * @param {string} options.fsPath - module specifier of the WSL filesystem provider.
+ * @param {string} options.sandboxPath - module specifier of the WSL confinement provider.
+ * @param {string} options.searchPath - module specifier of this plugin's WSL search tools.
  * @param {string | undefined} options.distro - distribution for paths that do not name one.
  * @param {string | undefined} options.sourceDir - directory the source preset lives in.
  * @returns {{ plugins: object[], removed: string[], unclassified: { id: string | null, name: unknown }[] }} the variant rows, what was dropped, and the rows kept without a classifier verdict — an unreadable specifier, or a tool-family module that is neither removed nor verdicted-kept.
  */
-export function buildVariantPlugins(basePlugins, { subprocessPath, shellPath, fsPath, distro, sourceDir }) {
+export function buildVariantPlugins(basePlugins, { subprocessPath, shellPath, fsPath, sandboxPath, searchPath, distro, sourceDir }) {
   const kept = []
   const removed = []
   /** Rows kept without a classifier verdict — both shapes the prune() branches record. */
@@ -392,6 +504,6 @@ export function buildVariantPlugins(basePlugins, { subprocessPath, shellPath, fs
     const pruned = prune(row)
     if (pruned !== null) kept.push(pruned)
   }
-  kept.push(buildWorldGroup({ subprocessPath, shellPath, fsPath, distro, includeEditor, toolConfig }))
+  kept.push(buildWorldGroup({ subprocessPath, shellPath, fsPath, sandboxPath, searchPath, distro, includeEditor, toolConfig }))
   return { plugins: kept, removed, unclassified }
 }