dsh-wsl-desktop 0.7.1 → 0.7.2

package/lib/client.js

@@ -38,6 +38,34 @@ window.__ModuleLoader__.load({
       'M5.54492 2.06738',           // post-refactor ProjectAddOutlineArtwork
     ]
 
+    /**
+     * The same trigger, named by sprite symbol instead of path data.
+     *
+     * Desktop 0.2.1-rc3 (ui-primitives `c3eead771d`) moved every product icon
+     * into the document icon sprite: the header button now renders
+     * `<svg data-icon="dsw-icon-project-add-outline-regular"><use href="#…"/></svg>`
+     * with NO `<path>` child anywhere. The geometry scan above therefore matched
+     * nothing, the anchor read as absent, and the W button stood down on every
+     * 0.2.1-rc3 desktop. The glyph name is the locale-independent identity in
+     * that generation, exactly as the path prefix was in the previous one, and a
+     * theme may replace the artwork without renaming the symbol — so the name
+     * survives the change that broke the geometry.
+     */
+    const TRIGGER_ICON_GLYPHS = ['project-add-outline']
+
+    /** Sprite symbol id shape, as `iconSymbolId` composes it: `dsw-icon-<glyph>-<weight>`. */
+    const SPRITE_ICON_ID = /^#?dsw-icon-(.+)-(?:regular|medium)$/
+
+    /**
+     * The row glyphs whose artwork is FILL-only, as sprite names.
+     *
+     * Only the fallback for a sprite symbol that is not in the document yet; the
+     * live read (`isSolidIcon`) prefers the symbol's own geometry. Versions
+     * qualify the id (`symbolId(glyph, weight)`), so the suffix is not part of a
+     * glyph name and the match is on the glyph alone.
+     */
+    const SOLID_GLYPHS = ['folder-open']
+
     /** Namespace of every SVG node this half creates. */
     const SVG_NS = 'http://www.w3.org/2000/svg'
 
@@ -1476,15 +1504,68 @@ window.__ModuleLoader__.load({
     /** Whether the missing-workspace-source warning was already printed. */
     let warnedWorkspaceSource = false
 
-    /** Find the shipped "add workspace" trigger by its icon geometry. */
-    function findTrigger() {
+    /**
+     * The sprite glyph one `<use>` reference names, or null.
+     *
+     * Accepts both the bare symbol id and the `#`-prefixed href form, and both
+     * `href` and the legacy `xlink:href` spelling, because an icon may render
+     * either. Returning the GLYPH (not the whole id) lets the trigger list stay
+     * a list of glyph names, which is what a desktop generation actually fixes.
+     * @param {Element} node - a `<use>` element.
+     * @returns {string | null} the glyph name, or null when it is not a sprite ref.
+     */
+    function spriteGlyphOf(node) {
+      const ref = node.getAttribute('href')
+        ?? node.getAttributeNS('http://www.w3.org/1999/xlink', 'href')
+      if (ref === null) return null
+      return SPRITE_ICON_ID.exec(ref)?.[1] ?? null
+    }
+
+    /**
+     * The candidate trigger buttons carrying one generation's icon identity.
+     *
+     * Each generation is ONE document-level selector rather than a walk over
+     * every button: `findTrigger` re-runs on every animation frame whenever the
+     * anchor is missing, so a per-button subtree query would turn a single scan
+     * into N of them exactly when the header is already in trouble.
+     * @param {string} selector - the icon nodes this generation renders.
+     * @param {(node: Element) => boolean} identifies - whether one icon is the trigger's.
+     * @returns {HTMLElement[]} the distinct buttons owning a matching icon.
+     */
+    function triggerCandidates(selector, identifies) {
       const matches = []
-      for (const path of document.querySelectorAll('svg > path[d]')) {
-        const d = path.getAttribute('d')
-        if (!TRIGGER_ICON_PATHS.some((geometry) => d.startsWith(geometry))) continue
-        const trigger = path.closest('button')
+      for (const icon of document.querySelectorAll(selector)) {
+        if (!identifies(icon)) continue
+        const trigger = icon.closest('button')
         if (trigger !== null && !matches.includes(trigger)) matches.push(trigger)
       }
+      return matches
+    }
+
+    /** Whether one inline path carries the add-workspace geometry. */
+    function isTriggerPath(path) {
+      const d = path.getAttribute('d')
+      return TRIGGER_ICON_PATHS.some((geometry) => d.startsWith(geometry))
+    }
+
+    /**
+     * Whether one icon node is the add-workspace artwork, in either generation.
+     *
+     * A sprite icon is identified by `data-icon` (the id the component was
+     * CONSTRUCTED with, which a theme replacement does not change) and, failing
+     * that, by the `<use>` reference it renders.
+     * @param {Element} icon - an inline path or a sprite `<svg>`/`<use>`.
+     * @returns {boolean} true when it is the trigger's artwork.
+     */
+    function isTriggerIcon(icon) {
+      if (icon.tagName === 'path') return isTriggerPath(icon)
+      const declared = icon.tagName === 'svg' ? icon.getAttribute('data-icon') : null
+      const glyph = declared !== null ? SPRITE_ICON_ID.exec(declared)?.[1] : spriteGlyphOf(icon)
+      return glyph !== undefined && glyph !== null && TRIGGER_ICON_GLYPHS.includes(glyph)
+    }
+
+    /** Pick the trigger out of one generation's candidates, or null. */
+    function pickTrigger(matches) {
       if (matches.length <= 1) return matches[0] ?? null
       // More than one control carries the geometry. The shipped trigger is the
       // one inside a `*_headerActions` cluster — the CSS-module local name is
@@ -1494,6 +1575,24 @@ window.__ModuleLoader__.load({
       return matches.find((trigger) => hasHeaderActionsParent(trigger)) ?? null
     }
 
+    /**
+     * Find the shipped "add workspace" trigger in either desktop generation.
+     *
+     * The sprite generation is scanned FIRST because it is the newer one: on a
+     * desktop that renders it, that single scan is the whole cost. Only a
+     * desktop with no sprite icon anywhere falls through to the geometry scan,
+     * which is what every release before 0.2.1-rc3 needed.
+     * @returns {HTMLElement | null} the anchor, or null when this desktop has none.
+     */
+    function findTrigger() {
+      const sprite = triggerCandidates('svg[data-icon], use', isTriggerIcon)
+      // A non-empty sprite result is this desktop's answer even when it is
+      // ambiguous: `pickTrigger` returns null there to mean "stand down", and
+      // falling through would let an unrelated inline icon pick the anchor.
+      if (sprite.length > 0) return pickTrigger(sprite)
+      return pickTrigger(triggerCandidates('svg > path[d]', isTriggerIcon))
+    }
+
     /**
      * Whether one trigger sits in the shipped trailing action cluster.
      * @param {HTMLElement} trigger - a candidate trigger button.
@@ -1637,7 +1736,7 @@ window.__ModuleLoader__.load({
         // artwork fills its paths, the collapsed one strokes them. A rebuild is
         // owed whenever that flips, which is exactly what expanding a workspace
         // does to this span.
-        const solid = shipped !== null && shipped.querySelector('path[stroke]') === null
+        const solid = isSolidIcon(shipped)
         const weight = solid ? 'solid' : 'outline'
         if (mine !== null && mine.dataset.wslCloudWeight !== weight) {
           mine.remove()
@@ -1648,6 +1747,56 @@ window.__ModuleLoader__.load({
       }
     }
 
+    /**
+     * The sprite symbol an icon element references, as a bare symbol id.
+     *
+     * `data-icon` is the id the icon COMPONENT was built with, so it keeps the
+     * shipped symbol even when a theme points the `<use>` href at its own
+     * artwork; the href is the fallback for markup that omits `data-icon`.
+     * @param {Element} icon - one icon `<svg>`.
+     * @returns {string | null} the symbol id without `#`, or null.
+     */
+    function spriteSymbolOf(icon) {
+      const declared = icon.getAttribute('data-icon')
+      if (typeof declared === 'string' && declared !== '') return declared.replace(/^#/, '')
+      for (const use of icon.querySelectorAll('use')) {
+        const ref = use.getAttribute('href')
+          ?? use.getAttributeNS('http://www.w3.org/1999/xlink', 'href')
+        if (typeof ref === 'string' && ref !== '') return ref.replace(/^#/, '')
+      }
+      return null
+    }
+
+    /**
+     * Whether one workspace row icon renders the FILL-only artwork.
+     *
+     * The collapsed row strokes its folder outline and the expanded one fills
+     * it, and the cloud has to match whichever is showing. Up to 0.2.1-rc2 the
+     * artwork was inline, so a stroked `<path>` was the tell. From 0.2.1-rc3 the
+     * icon is a sprite reference with NO path child anywhere: the weight then
+     * belongs to the SYMBOL in the document sprite, not to the `<svg>` naming
+     * it. Reading only the inline shape (as this did) made every sprite row look
+     * fill-only, so a collapsed row got the solid cloud.
+     * @param {Element | null} icon - the shipped folder icon, if the row renders one.
+     * @returns {boolean} true when the icon is the fill-only artwork.
+     */
+    function isSolidIcon(icon) {
+      if (icon === null) return false
+      // Inline generation: the artwork declares its own weight.
+      if (icon.querySelector('path[d]') !== null) return icon.querySelector('path[stroke]') === null
+      const symbolId = spriteSymbolOf(icon)
+      if (symbolId === null) return false
+      const symbol = document.getElementById(symbolId)
+      // Sprite generation, symbol present: judge the artwork the browser paints,
+      // so a theme's own geometry is measured rather than assumed.
+      if (symbol !== null) return symbol.querySelector('path[stroke]') === null
+      // Sprite generation, symbol not in the document (a theme may mount its
+      // own sprite later): fall back to the glyph name, which is the fill-only
+      // identity in the shipped table.
+      const glyph = SPRITE_ICON_ID.exec(`#${symbolId}`)?.[1]
+      return glyph !== undefined && glyph !== null && SOLID_GLYPHS.includes(glyph)
+    }
+
     /**
      * Whether one observed mutation could have changed a workspace row's markup.
      *

package/lib/wsl/paths.js

@@ -20,8 +20,19 @@ const UNC_HOSTS = new Set(['wsl.localhost', 'wsl$'])
  * directory, so `\\wsl.localhost\..\<path>` would hand the share a traversal
  * spelling. No real distribution name is all dots, and `wsl.exe -d ..` cannot be
  * a legal invocation, so the lookahead costs nothing legitimate.
+ *
+ * A LEADING HYPHEN is refused for a different reason: the value becomes the token
+ * after `wsl.exe -d`, and an argv element that begins with `-` is not a provably
+ * safe option VALUE. Measured on wsl.exe: `-d --cd --cd /x` and `-d -dfoo` both
+ * fail with WSL_E_DISTRO_NOT_FOUND rather than re-reading the token as an option,
+ * so the practical outcome is a clean refusal and no command — but the invariant
+ * `buildWslExecArgv` states (option values validated against our own grammars, so
+ * exec-path safety never depends on wsl.exe's undocumented tokenization) was not
+ * actually enforced for this value. The sibling grammar LINUX_USER below already
+ * forces a safe first character, so `-u` was refused while `-d` was not; this
+ * lookahead makes the pair agree. No real distribution name begins with `-`.
  */
-export const DISTRO_NAME = /^(?!\.+$)[A-Za-z0-9._-]+$/
+export const DISTRO_NAME = /^(?!-)(?!\.+$)[A-Za-z0-9._-]+$/
 
 /** A Linux user name that is safe to pass as a single wsl.exe -u option value. */
 export const LINUX_USER = /^[A-Za-z0-9._][A-Za-z0-9._-]*\$?$/

package/lib/wsl/pty.js

@@ -15,7 +15,7 @@
  * @module dsh-wsl-desktop/wsl/pty
  */
 
-import { appendFileSync } from 'node:fs'
+import { appendFileSync, renameSync, statSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
@@ -48,9 +48,25 @@ const DEFAULT_ROWS = 24
 const verifiedDistros = new Set()
 
 /**
- * Append one diagnostic line to the terminal debug log (bounded). Temporary
- * instrumentation for the live GUI-path terminal failure; harmless if the
- * file cannot be written.
+ * Ceiling for the opt-in terminal debug log, and the size at which it rotates.
+ *
+ * The doc comment on `termLog` used to call the sink "bounded" while the body was a
+ * bare `appendFileSync` with no cap, no rotation and no redaction: a host that left
+ * `WSL_DESKTOP_TERMINAL_DEBUG=1` set grew the file without limit. Rotation is
+ * one-generation (`.1`), which bounds the pair at ~2x this figure and needs no
+ * bookkeeping beyond a `statSync`.
+ */
+const TERMINAL_LOG_MAX_BYTES = 5 * 1024 * 1024
+
+/**
+ * Append one diagnostic line to the terminal debug log (bounded and rotated).
+ * Temporary instrumentation for the live GUI-path terminal failure; harmless if
+ * the file cannot be written.
+ *
+ * Callers must NOT hand this full argv vectors. A command line can carry a secret
+ * (`tool --token=…`), and this file is plaintext under `$DSH_HOME`, readable by any
+ * host-side reader of the profile. Describe the argv by its length and program
+ * name instead — see `describeArgv`.
  * @param {string} message - the diagnostic line.
  */
 export function termLog(message) {
@@ -58,12 +74,40 @@ export function termLog(message) {
   // without bound on every terminal allocation.
   if (process.env.WSL_DESKTOP_TERMINAL_DEBUG !== '1') return
   try {
-    appendFileSync(join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'wsl-desktop-terminal-debug.log'), `${new Date().toISOString()} ${message}\n`)
+    const path = join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'wsl-desktop-terminal-debug.log')
+    // Rotate BEFORE appending, so the file cannot cross the ceiling even by one
+    // line: the check is "would this write exceed it", not "has it already".
+    try {
+      const { size } = statSync(path)
+      if (size >= TERMINAL_LOG_MAX_BYTES) renameSync(path, `${path}.1`)
+    } catch {
+      // Absent (first write) or unreadable: appending is still safe.
+    }
+    appendFileSync(path, `${new Date().toISOString()} ${message}\n`)
   } catch {
     // Diagnostics must never break allocation.
   }
 }
 
+/**
+ * Describe an argv vector without reproducing it.
+ *
+ * The program name (argv[0]) and the element count are enough to tell "the bridge
+ * got the right shape" from "it got a different one", which is what these log lines
+ * exist for. The remaining elements are where secrets live, so they are never
+ * written: the count preserves the shape evidence and nothing else is lost that the
+ * log was actually used for.
+ * @param {readonly string[] | undefined} argv - the vector to describe.
+ * @returns {string} a redacted description, e.g. `bash (3 args)`.
+ */
+export function describeArgv(argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return '(no argv)'
+  const program = String(argv[0])
+  // The program itself may be a full path; its basename is the informative part.
+  const name = program.split(/[\\/]/).pop() ?? program
+  return `${name} (${argv.length - 1} args)`
+}
+
 /**
  * Report a diagnostic that must be VISIBLE without the opt-in debug log.
  *
@@ -782,7 +826,7 @@ export async function spawnWslTerminal({
       return false
     },
   ))
-  termLog(`allocate: distro=${plan.distro} linuxCwd=${JSON.stringify(plan.linuxCwd)} windowsCwd=${JSON.stringify(plan.windowsCwd)} argv0=${JSON.stringify(argv[0])} cols=${String(size.cols)} rows=${String(size.rows)} fifo=${fifo}`)
+  termLog(`allocate: distro=${plan.distro} linuxCwd=${JSON.stringify(plan.linuxCwd)} windowsCwd=${JSON.stringify(plan.windowsCwd)} argv=${describeArgv(argv)} cols=${String(size.cols)} rows=${String(size.rows)} fifo=${fifo}`)
   await requireBridgeRuntime(plan, select)
   termLog('allocate: bridge runtime ok')
   // The other generation's orphans, swept at the one moment this process can classify them:
@@ -943,10 +987,46 @@ export async function spawnWslTerminal({
     termLog(`announce ok: pid=${String(announce.pid)} pgrp=${String(announce.pgrp)} fifo=${fifo}`)
 
     control = local.spawn({
+      // The writer must NOT be able to outlive the reader it exists for.
+      //
+      // Measured defect (2026-10-24, twice on one host): when the bridge died, the
+      // data-done handler below called `control.terminate()`, which kills this
+      // wsl.exe CLIENT — but the writer runs inside the distribution and was
+      // reparented to /init, where its blocking `exec 3>"$1"` never returned. It
+      // then held the FIFO forever, and because every allocation mints a fresh
+      // random name no later session could reclaim it. The next terminal send
+      // waited for a readiness signal that never came and surfaced as
+      // `PTY send aborted before write`.
+      //
+      // A `bash` formulation CANNOT fix this, and that was measured rather than
+      // assumed: `test -w` on a FIFO reports the permission BITS, not a live
+      // reader, so a `[ -w ]` liveness loop passes immediately and then blocks
+      // forever in `exec 3>"$fifo"` (measured: hung until an outer timeout at
+      // 12004ms). Shell has no non-blocking open.
+      //
+      // So the open goes through python3, which IS already a hard prerequisite of
+      // this path — requireBridgeRuntime refuses an allocation without it, so
+      // using it here adds no new dependency. O_WRONLY|O_NONBLOCK turns "no reader
+      // yet" and "no reader any more" into an ENXIO/CleanIO failure instead of an
+      // indefinite block, which is exactly the property the orphan lacked.
+      //
+      // Measured on the shipped formulation: no reader -> exits in 15ms; live
+      // reader -> both control lines delivered; reader vanishing mid-stream ->
+      // exits within ~3.5s. The FIFO is also 0600 and created before the announce,
+      // so a reader normally exists before this process starts.
       argv: buildWslExecArgv(plan, [
-        'bash', '-c',
-        'exec 3>"$1" || exit 1; while IFS= read -r line; do printf \'%s\\n\' "$line" >&3; done',
-        'bash', fifo,
+        'python3', '-c',
+        'import os,sys\n'
+          + 'try:\n'
+          + '    fd=os.open(sys.argv[1],os.O_WRONLY|os.O_NONBLOCK)\n'
+          + 'except OSError:\n'
+          + '    sys.exit(0)\n'
+          + 'try:\n'
+          + '    for line in sys.stdin:\n'
+          + '        os.write(fd,line.encode())\n'
+          + 'finally:\n'
+          + '    os.close(fd)\n',
+        fifo,
       ], select),
       cwd: plan.windowsCwd,
       stdio: { stdin: 'pipe', stdout: 'ignore', stderr: 'pipe' },

package/lib/wsl/subprocess.js

@@ -29,7 +29,7 @@ import { SubprocessExecutableNotFoundError, SubprocessRuntime } from '@deepseek-
 import z from '@deepseek-ai/schemastery'
 import { requireLocalSubprocess } from './host-refs.js'
 import { shellQuote } from './paths.js'
-import { spawnWslTerminal, termLog } from './pty.js'
+import { describeArgv, spawnWslTerminal, termLog } from './pty.js'
 import { LoginShellUnresolvedError, WSL_CHILD_ENV, buildWslExecArgv, planWsl, resolveLoginShell, runWslShell, withWslEnvFlags } from './world.js'
 
 /**
@@ -287,7 +287,7 @@ export class WslSubprocessRuntime extends SubprocessRuntime {
       const terminalArgv = WINDOWS_SHELLS.has(base0)
         ? [await resolveLoginShell(plan.distro, this.config.username, { wslPath: this.config.wslPath })]
         : spec.argv
-      termLog(`spawnTerminal: distro=${plan.distro} linuxCwd=${JSON.stringify(plan.linuxCwd)} terminalArgv=${JSON.stringify(terminalArgv)} terminalType=${String(spec.terminalType)} username=${JSON.stringify(this.config.username ?? null)}`)
+      termLog(`spawnTerminal: distro=${plan.distro} linuxCwd=${JSON.stringify(plan.linuxCwd)} terminalArgv=${describeArgv(terminalArgv)} terminalType=${String(spec.terminalType)} username=${JSON.stringify(this.config.username ?? null)}`)
       const handle = await spawnWslTerminal({
         local: requireLocalSubprocess(),
         plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./lib/icon.svg",