dsh-wsl-desktop 0.7.3 → 0.7.4

package/lib/index.js

@@ -782,11 +782,17 @@ const METHODS = {
           // Created through the shell this block already runs its mutations with. A create
           // that FAILED must not read as a false green, so its outcome is reported in the
           // row: an absent path would notify from its arming baseline and pass on nothing.
-          const probeCreated = await runShellSpec(shell, shell.resolve({ command: `printf 'x\\n' > '${fs.processPath(fileTarget)}'`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
+          // The path is shellQuote'd, not interpolated inside hand-written quotes: the Linux
+          // path grammar refuses control characters and backslashes but NOT an apostrophe
+          // (measured), so `'${path}'` would end the word early and the remainder would run
+          // as shell syntax. Every other command in this file already goes through the
+          // helper; these four were the exception.
+          const probePath = shellQuote(fs.processPath(fileTarget))
+          const probeCreated = await runShellSpec(shell, shell.resolve({ command: `printf 'x\\n' > ${probePath}`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
             .then((execution) => execution.result())
             .catch((error) => ({ exitCode: null, stderr: { text: String(error?.message ?? error) } }))
           record('fs.watch.file', probeCreated.exitCode === 0
-            ? await observeWatch(fileTarget, `printf 'x\\n' >> '${fs.processPath(fileTarget)}'`)
+            ? await observeWatch(fileTarget, `printf 'x\\n' >> ${probePath}`)
             : {
               notified: 0,
               watchError: `the probe file could not be created: exit ${probeCreated.exitCode ?? 'null'} ${probeCreated.stderr?.text?.slice(0, 200) ?? ''}`.trim(),
@@ -794,9 +800,10 @@ const METHODS = {
             })
 
           const dirTarget = await fs.resolve('.', { cwd: workspaceCwd })
-          const dirCommand = `printf 'x\\n' > '${fs.processPath(dirTarget)}/dsh-wsl-watch-entry.txt'`
+          const dirEntry = shellQuote(`${fs.processPath(dirTarget)}/dsh-wsl-watch-entry.txt`)
+          const dirCommand = `printf 'x\\n' > ${dirEntry}`
           record('fs.watch.dir', await observeWatch(dirTarget, dirCommand))
-          await runShellSpec(shell, shell.resolve({ command: `rm -f '${fs.processPath(dirTarget)}/dsh-wsl-watch-entry.txt'`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
+          await runShellSpec(shell, shell.resolve({ command: `rm -f ${dirEntry}`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
             .then((execution) => execution.result()).catch(() => {})
 
           // Why the override exists, recorded rather than assumed: if a future host or
@@ -847,6 +854,18 @@ const METHODS = {
       const tools = hostSession.ctx.get('tools')
       if (tools !== undefined && agent !== undefined) {
         const controller = new AbortController()
+        /**
+         * The text one tool outcome reports, capped for the receipt.
+         *
+         * The `.text`-first rule lives here rather than repeated at seven call sites: every
+         * row wants the tool's OWN output, and falls back to the serialized result only when
+         * the outcome carries no text (a failure has no `value` to serialize). The cap
+         * differs per row because the rows read different amounts of that output.
+         * @param {{ text?: string, result?: unknown }} outcome - one `invoke` result.
+         * @param {number} limit - maximum characters kept.
+         * @returns {string} the text to record.
+         */
+        const outcomeText = (outcome, limit) => (outcome.text ?? JSON.stringify(outcome.result ?? null)).slice(0, limit)
         /**
          * Execute one tool on the session's behalf.
          * @param {string} toolName - registered tool name.
@@ -875,18 +894,27 @@ const METHODS = {
             })
             const outcome = batch?.results?.[0]
             if (outcome === undefined) return { ok: false, error: 'the batch returned no result for this call' }
-            // `ToolCallResult` is `{ callId, result: ToolExecutionResult }`, and the
-            // execution result carries `value` (often a serialized JSON string). The
-            // rows below read `.text`, so the text is what this normalises: a string
-            // value is used as-is, anything else is serialized.
-            const execution = outcome.result ?? {}
-            const isError = execution.isError === true || execution.error !== undefined
+            // `ToolCallResult` is `{ callId, result: ToolExecutionResult }`, and
+            // `ToolExecutionResult` is a DISCRIMINATED UNION on `isError`: a success carries
+            // `{ isError: false, value }` and a failure carries `{ isError: true, error }`
+            // where `error` is a `ToolFailure { message, info? }` and `value` is `never`.
+            // Switching on the discriminant is the contract; probing for `error` on a
+            // success is reading a field the type says cannot be there.
+            const execution = outcome.result
+            if (execution === undefined || execution === null) {
+              return { ok: false, error: 'the batch returned a result-shaped null for this call', text: 'null' }
+            }
+            // Branch ONCE on the discriminant. A failure has no `value` to serialize, so its
+            // own message is what the row reports as text — which is also what makes a failed
+            // row readable instead of showing `"null"`.
+            if (execution.isError === true) {
+              const message = String(execution.error?.message ?? 'the tool reported an error')
+              return { ok: false, error: message, text: message }
+            }
             const text = typeof execution.value === 'string'
               ? execution.value
-              : JSON.stringify(execution.value ?? execution ?? null)
-            return isError
-              ? { ok: false, error: String(execution.error?.message ?? execution.error ?? 'the tool reported an error'), text }
-              : { ok: true, result: JSON.parse(JSON.stringify(execution ?? null)), text }
+              : JSON.stringify(execution.value ?? null)
+            return { ok: true, result: JSON.parse(JSON.stringify(execution)), text }
           } catch (error) {
             return { ok: false, error: error instanceof Error ? error.message : String(error) }
           }
@@ -895,7 +923,7 @@ const METHODS = {
         record('tools.bash', {
           ok: bashTool.ok,
           error: bashTool.error ?? null,
-          text: (bashTool.text ?? JSON.stringify(bashTool.result ?? null)).slice(0, 400),
+          text: outcomeText(bashTool, 400),
         })
         // Derived from the workspace, not hardcoded: the fixture used to live at
         // /tmp/dsh-wsl-selftest.txt, which only worked while the workspace was
@@ -913,13 +941,13 @@ const METHODS = {
         record('tools.read', {
           ok: readTool.ok,
           error: readTool.error ?? null,
-          text: (readTool.text ?? JSON.stringify(readTool.result ?? null)).slice(0, 400),
+          text: outcomeText(readTool, 400),
         })
         const pwshTool = await invoke('pwsh', { command: 'echo host-side', description: 'selftest: this tool must not exist in a WSL session' })
         record('tools.pwsh', {
           ok: pwshTool.ok,
           error: pwshTool.error ?? null,
-          text: (pwshTool.text ?? JSON.stringify(pwshTool.result ?? null)).slice(0, 200),
+          text: outcomeText(pwshTool, 200),
         })
 
         // The realm's own `grep`/`glob`: the host removes both names from a WSL world
@@ -995,13 +1023,13 @@ const METHODS = {
         record('tool.search.grep', {
           ok: grepSearch.ok && searchFixtureError === null,
           error: grepSearch.error ?? searchFixtureError,
-          text: (grepSearch.text ?? JSON.stringify(grepSearch.result ?? null)).slice(0, 800),
+          text: outcomeText(grepSearch, 800),
         })
         const globSearch = await invoke('glob', { pattern: 'src/**/*.ts' })
         record('tool.search.glob', {
           ok: globSearch.ok && searchFixtureError === null,
           error: globSearch.error ?? searchFixtureError,
-          text: (globSearch.text ?? JSON.stringify(globSearch.result ?? null)).slice(0, 800),
+          text: outcomeText(globSearch, 800),
         })
 
         // A tool resolves its policy from the session's logged permission state
@@ -1058,7 +1086,7 @@ const METHODS = {
         record('tools.bashPersist.a', {
           ok: persistA.ok,
           error: persistA.error ?? null,
-          text: (persistA.text ?? JSON.stringify(persistA.result ?? null)).slice(0, 400),
+          text: outcomeText(persistA, 400),
         })
         const persistB = await invoke('bash', {
           command: `pwd; echo "$DSH_WSL_PERSIST_PROBE"; echo probe > "$HOME/.dsh-wsl-persist-outside"; echo write-exit=$?`,
@@ -1067,7 +1095,7 @@ const METHODS = {
         record('tools.bashPersist.b', {
           ok: persistB.ok,
           error: persistB.error ?? null,
-          text: (persistB.text ?? JSON.stringify(persistB.result ?? null)).slice(0, 800),
+          text: outcomeText(persistB, 800),
         })
 
         // F8's guard, observed from the realm: once a persistent terminal session exists, a

package/lib/wsl/confinement.js

@@ -776,6 +776,22 @@ export function buildConfinedCommand({ command, linuxCwd, mode, workspaceLinuxRo
   }
   const script = buildNamespaceScript({ command, linuxCwd, mode, workspaceLinuxRoot, identity, noNewPrivs })
   const flags = ['--mount', '--propagation', 'private']
-  if (isolateProcesses) flags.push('--pid', '--fork')
-  return `sudo -n unshare ${flags.join(' ')} bash -c ${shellQuote(script)}`
+  // A PID namespace re-parents the tree but the inherited procfs still lists the PARENT's
+  // pids, so /proc/<outer-pid>/root names the outer mount namespace — where nothing was
+  // remounted read-only. `--mount-proc` is what closes that, and it is one control with
+  // the pid namespace, not an option beside it.
+  if (isolateProcesses) flags.push('--pid', '--fork', '--mount-proc')
+  // The helper pins PATH and runs its fence under `bash -p` (see its own comments for the
+  // measurements). This runner emits the same fence body, so it must carry the same
+  // invariants: without the pin, a caller able to pass a sudo command-line assignment
+  // shadows mount/findmnt/mountpoint and the postconditions pass while the mounts stay
+  // writable — a fence that lies. `-p` skips BASH_ENV and the function import for the
+  // fence body, and the three `-u` removals close the interop door (a Windows program
+  // launched from here can start an unfenced `wsl.exe ... bash`, where NO_NEW_PRIVS does
+  // not apply and the retained sudo grant re-escalates normally).
+  const hardened = [
+    'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH;',
+    script,
+  ].join('\n')
+  return `sudo -n unshare ${flags.join(' ')} env -u BASH_ENV -u WSL_INTEROP -u WSLENV -u WSL_DISTRO_NAME bash -p -c ${shellQuote(hardened)}`
 }

package/lib/wsl/dsh-wsl-confine.sh

@@ -194,8 +194,24 @@ command -v findmnt >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: fin
 # form is not portable and the refusal above is what the fence relies on.)
 KEEP_ENTRIES=(/tmp /dev /dev/pts /dev/mqueue /proc /sys)
 [[ -z "$workspace" ]] || KEEP_ENTRIES+=("$workspace")
+
+# Kernel virtual filesystems are exempt as SUBTREES, not as single mount points. A fresh
+# `--mount-proc` brings /proc's own nested mounts with it (measured: /proc/sys/fs/binfmt_misc
+# is a separate mount record), and a nested kernel mount cannot be made read-only — it is
+# not backing storage. Exact-entry matching left those children unexempt, so the
+# postcondition found the first one writable and the fence refused every command.
+#
+# The subtree list is deliberately NARROWER than KEEP_ENTRIES. /dev and /tmp stay exact so
+# their writable children keep being swept: /dev/shm is shared memory that must end up
+# READONLY (the post-condition asserts it), and a workspace under /tmp is already refused
+# outright. The subtree rule applies only to the two pseudo-filesystems whose children are
+# kernel state by construction, and the workspace is never one of them.
+KERNEL_SUBTREE=(/proc /sys)
 EXEMPT_PATTERN=$(printf '%s\n' "${KEEP_ENTRIES[@]}" | sed 's/[][\\^$.*+?(){}|]/\\&/g' | tr '\n' '|')
 EXEMPT_PATTERN="${EXEMPT_PATTERN%|}"
+for kernel in "${KERNEL_SUBTREE[@]}"; do
+  EXEMPT_PATTERN="${EXEMPT_PATTERN}|$(printf '%s' "$kernel" | sed 's/[][\\^$.*+?(){}|]/\\&/g')/.*"
+done
 
 # The fence script is built HERE from the validated parameters — the caller
 # never supplies script text. It is identical in effect to the in-process
@@ -228,12 +244,28 @@ exec setpriv --no-new-privs --reuid="$DROP_UID" --regid="$DROP_GID" --init-group
 PID_FLAG=''
 [[ "$pidns" = 1 ]] && PID_FLAG='--pid --fork'
 
+# A PID namespace alone does NOT hide the outer processes: it re-parents this tree, but
+# the procfs it inherits still lists the PARENT's pids, so /proc/<outer-pid>/root keeps
+# naming the outer mount namespace — where / and /mnt/c were never remounted read-only,
+# because that remount is private to this fence. `--mount-proc` mounts a FRESH procfs over
+# /proc, so a magic link can only ever name a process inside this namespace. The two
+# halves are one control, which is why the flag is tied to the pid namespace and not
+# offered separately: a fresh procfs without a pid namespace would still list outer pids.
+PROC_FLAG=''
+[[ "$pidns" = 1 ]] && PROC_FLAG='--mount-proc'
+
+# WSL interop is a door OUT of the fence, and NO_NEW_PRIVS does not survive it: a confined
+# command can launch a WINDOWS program, and that program can start a fresh
+# `wsl.exe -d <distro> -e bash` — a new Linux process in the INITIAL mount namespace
+# carrying no NNP, free to use the passwordless sudo grant this runner itself requires.
+# The door is opened by environment variables, so they are removed on the one invocation
+# every root-phase descendant hangs off. /mnt/c stays mounted read-only under the fence
+# and interop was the way around that write fence, not a way through it.
+#
 # -p stops OUR bash from processing BASH_ENV, but it does NOT remove the variable from
 # the environment, and every descendant inherits it. The drop-side `bash -lc
 # "$DROP_COMMAND"` is NOT privileged and does process it (measured: it sourced the
-# caller's file as the session user, inside the fence). Drop it HERE, on the one
-# invocation every root-phase descendant hangs off, so no descendant can be made to
-# source a caller's file.
+# caller's file as the session user, inside the fence). Drop it HERE.
 #
 # -p on THIS file's bash also stops the import of functions from the environment
 # into THIS shell only. The fence body is a separate `bash -c`, so without -p there a
@@ -243,7 +275,8 @@ PID_FLAG=''
 # therefore launched with -p as well: the same privileged-mode rule that skips
 # BASH_ENV skips the function import, so a coordinated override becomes a no-op
 # instead of a fence that lies.
-exec unshare --mount --propagation private $PID_FLAG env -u BASH_ENV \
+exec unshare --mount --propagation private $PID_FLAG $PROC_FLAG \
+  env -u BASH_ENV -u WSL_INTEROP -u WSLENV -u WSL_DISTRO_NAME \
   DROP_UID="$uid" DROP_GID="$gid" DROP_HOME="$home" DROP_USER="${SUDO_USER:-root}" \
   DROP_CWD="$cwd" DROP_WORKSPACE="$workspace" DROP_COMMAND="${ARGS[*]}" \
   DROP_EXEMPT="$EXEMPT_PATTERN" \

package/lib/wsl/fs.js

@@ -162,7 +162,39 @@ export class WslFileSystem extends LocalFileSystem {
       // the share refuses that one step transiently (see ./publish.js for the
       // measurement). The publication is waited out rather than reported as a
       // failure the caller cannot tell apart from a real one.
+      //
+      // The containment re-test lives HERE, next to the syscall, because that is the only
+      // place it can see a component swapped after `checkedTarget`: the fence's own
+      // documentation records that a rename through such a component lands the file AT THE
+      // LINK'S TARGET, so the window is a content escape, not just an out-of-bounds
+      // directory. Refusing here reports the same structured denial the entry check uses.
       replaceFile: async (replaced, replacement) => {
+        // Resolve the policy HERE rather than carrying a snapshot. The primitive's signature
+        // is `(replaced: string, replacement: string)`, so no per-call context can reach it,
+        // and an instance field would be shared by every concurrent write — task B's roots
+        // would judge task A's publication. Resolving at the syscall is also the sounder
+        // semantic: the re-test answers "is this path inside a writable root RIGHT NOW",
+        // and a policy that changed since the entry check should narrow the write, not be
+        // ignored in favour of a stale grant.
+        const policy = this.ctx.sandboxPolicy.resolve()
+        if (policy.mode !== 'danger-full-access') {
+          // `replaced` is a HOST spelling (a UNC or a drive path), so its parent is a win32
+          // concern, not a POSIX one.
+          const parent = await this.resolve(win32.dirname(replaced))
+          let contained = false
+          for (const root of this.writableHostRoots(policy)) {
+            if (await isUnderHost(parent.targetKey, root)) {
+              contained = true
+              break
+            }
+          }
+          if (!contained) {
+            throw new FsError(
+              `cannot write "${replaced}": the destination left the writable roots between the check and the publication`,
+              'FS_SANDBOX_DENIED',
+            )
+          }
+        }
         await publishReplace(replaced, replacement)
       },
       // The share exposes no settable DACL, and staging is already private.

package/lib/wsl/sandbox.js

@@ -51,10 +51,17 @@ export const Config = z.object({
   /**
    * Add a PID namespace to the fence. OFF for this provider's consumers on purpose: the
    * argv it wraps is an INTERACTIVE shell on a PTY, and a PID namespace re-parents that
-   * shell to PID 1 with a process group the PTY's own foreground queries
-   * (`terminal-bridge.py`'s `tcgetpgrp`) can no longer address — the reason the shipped
-   * helper carries `--no-pidns` at all. The shell executor's one-shot commands keep the
-   * namespace (its own default); this is the terminal path only.
+   * shell to PID 1, which the PTY path cannot live with. Re-measured while closing the
+   * /proc escape: `tcgetpgrp` alone DOES still resolve under `--pid --fork --mount-proc`
+   * (TPGID names the shell's own pid), but driving the real `terminal-bridge.py` through
+   * the same namespace HANGS — it never completes its start, so the terminal is dead.
+   * The one-shot shell executor keeps the namespace (its own default); this is the
+   * terminal path only.
+   *
+   * The /proc consequence is accepted HERE and closed on the one-shot path: with the
+   * namespace off, a fresh procfs would still list the outer pids, so this arm carries no
+   * `--mount-proc` either — mounting one would buy nothing. What the terminal path cannot
+   * have, `shell.js` and the direct runner do have.
    */
   isolateProcesses: z.boolean().default(false),
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./lib/icon.svg",