dsh-wsl-desktop 0.7.3 → 0.7.5

package/lib/client.js

@@ -245,7 +245,7 @@ window.__ModuleLoader__.load({
       'unmeasured': '未测量',
       'not measured': '未测量',
       'not selected; the runner uses sudo-unshare': '未被选中；运行器使用 sudo-unshare',
-      'not installed or not v1.2': '未安装或版本不是 v1.2',
+      'not installed or not v1.3': '未安装或版本不是 v1.3',
     }
 
     /**
@@ -256,7 +256,7 @@ window.__ModuleLoader__.load({
     function localizeDetail(detail) {
       if (LOCALE !== 'zh' || typeof detail !== 'string') return detail
       if (detail.startsWith('missing: ')) return `${copy('missingPrefix')}${detail.slice('missing: '.length)}`
-      // Version strings carry their own identity (Python x.y, dsh-wsl-confine v1.2).
+      // Version strings carry their own identity (Python x.y, dsh-wsl-confine v1.3).
       if (detail.startsWith('Python ') || detail.startsWith('dsh-wsl-confine ')) return detail
       return DETAIL_ZH[detail] ?? detail
     }

package/lib/index.js

@@ -782,11 +782,17 @@ const METHODS = {
           // Created through the shell this block already runs its mutations with. A create
           // that FAILED must not read as a false green, so its outcome is reported in the
           // row: an absent path would notify from its arming baseline and pass on nothing.
-          const probeCreated = await runShellSpec(shell, shell.resolve({ command: `printf 'x\\n' > '${fs.processPath(fileTarget)}'`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
+          // The path is shellQuote'd, not interpolated inside hand-written quotes: the Linux
+          // path grammar refuses control characters and backslashes but NOT an apostrophe
+          // (measured), so `'${path}'` would end the word early and the remainder would run
+          // as shell syntax. Every other command in this file already goes through the
+          // helper; these four were the exception.
+          const probePath = shellQuote(fs.processPath(fileTarget))
+          const probeCreated = await runShellSpec(shell, shell.resolve({ command: `printf 'x\\n' > ${probePath}`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
             .then((execution) => execution.result())
             .catch((error) => ({ exitCode: null, stderr: { text: String(error?.message ?? error) } }))
           record('fs.watch.file', probeCreated.exitCode === 0
-            ? await observeWatch(fileTarget, `printf 'x\\n' >> '${fs.processPath(fileTarget)}'`)
+            ? await observeWatch(fileTarget, `printf 'x\\n' >> ${probePath}`)
             : {
               notified: 0,
               watchError: `the probe file could not be created: exit ${probeCreated.exitCode ?? 'null'} ${probeCreated.stderr?.text?.slice(0, 200) ?? ''}`.trim(),
@@ -794,9 +800,10 @@ const METHODS = {
             })
 
           const dirTarget = await fs.resolve('.', { cwd: workspaceCwd })
-          const dirCommand = `printf 'x\\n' > '${fs.processPath(dirTarget)}/dsh-wsl-watch-entry.txt'`
+          const dirEntry = shellQuote(`${fs.processPath(dirTarget)}/dsh-wsl-watch-entry.txt`)
+          const dirCommand = `printf 'x\\n' > ${dirEntry}`
           record('fs.watch.dir', await observeWatch(dirTarget, dirCommand))
-          await runShellSpec(shell, shell.resolve({ command: `rm -f '${fs.processPath(dirTarget)}/dsh-wsl-watch-entry.txt'`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
+          await runShellSpec(shell, shell.resolve({ command: `rm -f ${dirEntry}`, workdir: workspaceCwd, sandboxPolicy: workspaceWritePolicy }))
             .then((execution) => execution.result()).catch(() => {})
 
           // Why the override exists, recorded rather than assumed: if a future host or
@@ -847,6 +854,18 @@ const METHODS = {
       const tools = hostSession.ctx.get('tools')
       if (tools !== undefined && agent !== undefined) {
         const controller = new AbortController()
+        /**
+         * The text one tool outcome reports, capped for the receipt.
+         *
+         * The `.text`-first rule lives here rather than repeated at seven call sites: every
+         * row wants the tool's OWN output, and falls back to the serialized result only when
+         * the outcome carries no text (a failure has no `value` to serialize). The cap
+         * differs per row because the rows read different amounts of that output.
+         * @param {{ text?: string, result?: unknown }} outcome - one `invoke` result.
+         * @param {number} limit - maximum characters kept.
+         * @returns {string} the text to record.
+         */
+        const outcomeText = (outcome, limit) => (outcome.text ?? JSON.stringify(outcome.result ?? null)).slice(0, limit)
         /**
          * Execute one tool on the session's behalf.
          * @param {string} toolName - registered tool name.
@@ -875,18 +894,27 @@ const METHODS = {
             })
             const outcome = batch?.results?.[0]
             if (outcome === undefined) return { ok: false, error: 'the batch returned no result for this call' }
-            // `ToolCallResult` is `{ callId, result: ToolExecutionResult }`, and the
-            // execution result carries `value` (often a serialized JSON string). The
-            // rows below read `.text`, so the text is what this normalises: a string
-            // value is used as-is, anything else is serialized.
-            const execution = outcome.result ?? {}
-            const isError = execution.isError === true || execution.error !== undefined
+            // `ToolCallResult` is `{ callId, result: ToolExecutionResult }`, and
+            // `ToolExecutionResult` is a DISCRIMINATED UNION on `isError`: a success carries
+            // `{ isError: false, value }` and a failure carries `{ isError: true, error }`
+            // where `error` is a `ToolFailure { message, info? }` and `value` is `never`.
+            // Switching on the discriminant is the contract; probing for `error` on a
+            // success is reading a field the type says cannot be there.
+            const execution = outcome.result
+            if (execution === undefined || execution === null) {
+              return { ok: false, error: 'the batch returned a result-shaped null for this call', text: 'null' }
+            }
+            // Branch ONCE on the discriminant. A failure has no `value` to serialize, so its
+            // own message is what the row reports as text — which is also what makes a failed
+            // row readable instead of showing `"null"`.
+            if (execution.isError === true) {
+              const message = String(execution.error?.message ?? 'the tool reported an error')
+              return { ok: false, error: message, text: message }
+            }
             const text = typeof execution.value === 'string'
               ? execution.value
-              : JSON.stringify(execution.value ?? execution ?? null)
-            return isError
-              ? { ok: false, error: String(execution.error?.message ?? execution.error ?? 'the tool reported an error'), text }
-              : { ok: true, result: JSON.parse(JSON.stringify(execution ?? null)), text }
+              : JSON.stringify(execution.value ?? null)
+            return { ok: true, result: JSON.parse(JSON.stringify(execution)), text }
           } catch (error) {
             return { ok: false, error: error instanceof Error ? error.message : String(error) }
           }
@@ -895,7 +923,7 @@ const METHODS = {
         record('tools.bash', {
           ok: bashTool.ok,
           error: bashTool.error ?? null,
-          text: (bashTool.text ?? JSON.stringify(bashTool.result ?? null)).slice(0, 400),
+          text: outcomeText(bashTool, 400),
         })
         // Derived from the workspace, not hardcoded: the fixture used to live at
         // /tmp/dsh-wsl-selftest.txt, which only worked while the workspace was
@@ -913,13 +941,13 @@ const METHODS = {
         record('tools.read', {
           ok: readTool.ok,
           error: readTool.error ?? null,
-          text: (readTool.text ?? JSON.stringify(readTool.result ?? null)).slice(0, 400),
+          text: outcomeText(readTool, 400),
         })
         const pwshTool = await invoke('pwsh', { command: 'echo host-side', description: 'selftest: this tool must not exist in a WSL session' })
         record('tools.pwsh', {
           ok: pwshTool.ok,
           error: pwshTool.error ?? null,
-          text: (pwshTool.text ?? JSON.stringify(pwshTool.result ?? null)).slice(0, 200),
+          text: outcomeText(pwshTool, 200),
         })
 
         // The realm's own `grep`/`glob`: the host removes both names from a WSL world
@@ -995,13 +1023,13 @@ const METHODS = {
         record('tool.search.grep', {
           ok: grepSearch.ok && searchFixtureError === null,
           error: grepSearch.error ?? searchFixtureError,
-          text: (grepSearch.text ?? JSON.stringify(grepSearch.result ?? null)).slice(0, 800),
+          text: outcomeText(grepSearch, 800),
         })
         const globSearch = await invoke('glob', { pattern: 'src/**/*.ts' })
         record('tool.search.glob', {
           ok: globSearch.ok && searchFixtureError === null,
           error: globSearch.error ?? searchFixtureError,
-          text: (globSearch.text ?? JSON.stringify(globSearch.result ?? null)).slice(0, 800),
+          text: outcomeText(globSearch, 800),
         })
 
         // A tool resolves its policy from the session's logged permission state
@@ -1058,7 +1086,7 @@ const METHODS = {
         record('tools.bashPersist.a', {
           ok: persistA.ok,
           error: persistA.error ?? null,
-          text: (persistA.text ?? JSON.stringify(persistA.result ?? null)).slice(0, 400),
+          text: outcomeText(persistA, 400),
         })
         const persistB = await invoke('bash', {
           command: `pwd; echo "$DSH_WSL_PERSIST_PROBE"; echo probe > "$HOME/.dsh-wsl-persist-outside"; echo write-exit=$?`,
@@ -1067,7 +1095,7 @@ const METHODS = {
         record('tools.bashPersist.b', {
           ok: persistB.ok,
           error: persistB.error ?? null,
-          text: (persistB.text ?? JSON.stringify(persistB.result ?? null)).slice(0, 800),
+          text: outcomeText(persistB, 800),
         })
 
         // F8's guard, observed from the realm: once a persistent terminal session exists, a

package/lib/protocol.js

@@ -202,8 +202,8 @@ export const CHECK_REMEDIES = deepFreeze({
   },
   helper: {
     kind: 'text',
-    zh: 'helper 未安装或版本不是 v1.2；安装说明见 docs/CONFINEMENT.md。',
-    en: 'The helper is missing or not v1.2; see docs/CONFINEMENT.md for the install command.',
+    zh: 'helper 未安装或版本不是 v1.3；安装说明见 docs/CONFINEMENT.md。',
+    en: 'The helper is missing or not v1.3; see docs/CONFINEMENT.md for the install command.',
   },
   nnp: {
     kind: 'text',

package/lib/wsl/confinement.js

@@ -39,8 +39,20 @@ export const HELPER_PATH = '/usr/local/sbin/dsh-wsl-confine'
  * bypass. The probe below therefore refuses anything older, and the direct
  * sudo-unshare runner is used instead: its in-process builder always escaped, so
  * a stale install degrades to a correct fence rather than a silent hole.
+ *
+ * v1.3 is the first helper whose writability post-condition reads the MOUNT FLAG
+ * instead of `[ -w ]`. v1.2 asked `[ -w ]` about every swept target, which the
+ * kernel answers "writable" for any non-storage inode — a SOCKET, FIFO or device
+ * node — even on a mount that was successfully remounted read-only. With a
+ * unix-socket bind mount present (measured: `/mnt/wsl/podman-sockets` while
+ * `podman machine` runs) that refused EVERY confined command with exit 97,
+ * including a bare `true`, and the terminal path surfaced it only as
+ * "PTY shell exited during startup" (github issue #2). Refusing the old version
+ * is what makes the fix reach an installed helper: the requirement is an exact
+ * match, so an un-reinstalled v1.2 now falls back to the direct runner, whose
+ * in-process builder carries the corrected post-condition.
  */
-export const HELPER_VERSION = 'v1.2'
+export const HELPER_VERSION = 'v1.3'
 
 /** stderr text the kernel produces for a write blocked by the read-only root. */
 export const DENIAL_SIGNATURES = ['Read-only file system', 'read-only file system']
@@ -555,6 +567,40 @@ export const SETUP_FAILURE_MARKER = 'dsh-wsl-sandbox: setup failed'
  */
 export const KERNEL_SURFACES = new Set(['/dev', '/dev/pts', '/dev/mqueue', '/proc', '/sys'])
 
+/**
+ * Kernel surfaces exempt as SUBTREES, not as single mount points.
+ *
+ * A fresh procfs brings its own nested mounts with it, and the distribution's
+ * real ones are not theoretical: measured on a running WSL2 distribution,
+ * `findmnt` lists `/proc/sys/fs/binfmt_misc` AND
+ * `/proc/sys/fs/binfmt_misc/status` as separate mounts, plus a `/proc` record
+ * that is a re-mount of the root procfs. A nested kernel mount cannot be made
+ * read-only — measured: `mount -o remount,ro,bind /proc/sys/fs/binfmt_misc`
+ * answers exit **32** ("mount point not mounted or bad option") on this
+ * distribution, and `umount` answers EBUSY — so exact-entry matching left those
+ * children unexempt and the post-condition found the first one and refused
+ * EVERY confined command (measured: exit 97, `/proc/sys/fs/binfmt_misc is still
+ * writable`).
+ *
+ * This set must agree with `KERNEL_SUBTREE` in `dsh-wsl-confine.sh`, which has
+ * carried the same rule since the two fences were split. It did NOT before: the
+ * helper exempted these subtrees and the in-process builder matched exactly, so
+ * on a distribution with nested kernel mounts the TWO FENCES DISAGREED about
+ * whether the fence could be established at all — the helper's path worked while
+ * the direct `sudo-unshare` runner failed closed on every command. The direct
+ * runner is exactly what an operator gets when the helper is not installed or
+ * its version does not match, so that divergence was a whole-world outage for
+ * this distribution, not an edge case.
+ *
+ * Deliberately NARROWER than `KERNEL_SURFACES`: `/dev` and `/tmp` stay exact
+ * matches, so their writable children keep being swept. `/dev/shm` is shared
+ * memory that must end up READONLY (the post-condition asserts it), and a
+ * workspace under `/tmp` is refused outright. Only the two pseudo-filesystems
+ * whose children are kernel state by construction get the subtree rule, and the
+ * workspace is never one of them.
+ */
+export const KERNEL_SUBTREES = ['/proc', '/sys']
+
 /**
  * Escape ERE metacharacters so a path can only ever match itself.
  * @param {string} text - a mount target or exempt path.
@@ -567,11 +613,19 @@ function escapeEre(text) {
 /**
  * The assembled grep -E pattern for one sweep/postcondition: regex-escaped
  * entries joined with alternation, anchored both ends.
+ *
+ * The subtree entries are emitted the way the helper builds them — the escaped
+ * path followed by `/.*` — inside the same anchored group, so `/proc` exempts
+ * `/proc/sys/fs/binfmt_misc` while the trailing `$` still stops a sibling like
+ * `/procxyz` from matching. See {@link KERNEL_SUBTREES} for why the two fences
+ * must agree on this.
  * @param {string[]} keep - mount targets that stay writable.
  * @returns {string} the pattern, as data (the caller quotes it for the shell).
  */
 function exemptPattern(keep) {
-  return `^(${[...new Set([...keep, ...KERNEL_SURFACES])].map(escapeEre).join('|')})$`
+  const exact = [...new Set([...keep, ...KERNEL_SURFACES])].map(escapeEre)
+  const subtrees = KERNEL_SUBTREES.map((kernel) => `${escapeEre(kernel)}/.*`)
+  return `^(${[...exact, ...subtrees].join('|')})$`
 }
 
 /**
@@ -594,6 +648,12 @@ function sweepHead(pattern) {
  * Enumerated at run time from `findmnt` rather than from a fixed list, because a
  * list is only ever as complete as the machine it was written on: a new drvfs
  * drive or a runtime tmpfs would reopen the hole silently.
+ *
+ * A remount that fails is swallowed here and caught a step later by
+ * {@link postConditions}, which is deliberate: one unmountable target must not
+ * abort the sweep for the others, and a nested kernel mount legitimately cannot
+ * be remounted (measured: `remount,ro,bind /proc/sys/fs/binfmt_misc` answers
+ * exit 32) — those are exempted as subtrees instead, in both fences.
  * @param {string[]} keep - mount targets that stay writable.
  * @returns {string} the fragment.
  */
@@ -626,6 +686,36 @@ function readOnlySweep(keep) {
  * not abort the rest, which means the only trustworthy statement about the
  * boundary is one read back from inside it. A target that is still writable
  * outside the allow-list is a setup failure, not a command failure.
+ *
+ * The writability verdict pairs two tests, and each is load-bearing where the
+ * other is blind.
+ *
+ * **Storage inodes are judged by `[ -w ]`.** `access(W_OK)` answers about the
+ * mount a write would actually land on — including a STACKED target (findmnt
+ * lists one record per mount), where it lands on the topmost, visible layer.
+ * `remount,ro,bind` by path reaches only that top layer, so a covered record's
+ * `rw` flag is not a hole: measured on a running WSL2 distribution, after
+ * remounting the visible `/run/user` the covered record still reported
+ * `rw,relatime` while a write through the path failed `EROFS`. Judging by that
+ * covered flag was a false positive that refused every confined command.
+ *
+ * **Everything else is judged by the MOUNT FLAG.** On a socket, FIFO or device
+ * node `[ -w ]` says nothing about the mount: the kernel's read-only answer is
+ * deliberately narrowed to storage. `sb_permission()` returns `-EROFS` only for
+ * a regular file, directory or symlink (`fs/namei.c`: `S_ISREG || S_ISDIR ||
+ * S_ISLNK`), `do_faccessat()`'s own read-only re-check — the one `[ -w ]`
+ * reaches — repeats the exclusion with `special_file(inode->i_mode)`, and
+ * between them `generic_permission()` lets the check's uid (root, because this
+ * fragment runs before the setpriv drop) through `CAP_DAC_OVERRIDE` for a
+ * `MAY_WRITE`-only mask. A SOCKET therefore reports "writable" on a mount that
+ * was successfully remounted read-only — measured as fence exit 97 for a
+ * bind-mounted unix socket under `/mnt/wsl/podman-sockets` while `podman
+ * machine` was running, refusing every confined command including a bare `true`
+ * (github issue #2).
+ *
+ * Both read ONE `findmnt -rno TARGET,OPTIONS` enumeration, and `ro` is a comma
+ * member rather than a `^ro` prefix: a mount's VFS options are a comma list and
+ * nothing pins `ro` to a position.
  * @param {string[]} keep - mount targets that may stay writable.
  * @returns {string} the fragment.
  */
@@ -634,17 +724,62 @@ function postConditions(keep) {
   return [
     'mountpoint -q /tmp || fail "/tmp is not a private tmpfs"',
     'findmnt -rno OPTIONS / | grep -q "^ro" || fail "/ is not read-only"',
-    // Same line-driven loop, decode-before-match, and single-quoted pattern
-    // as the sweep (fail() is defined in the setup steps). The trailing
-    // `true` matters: the while is the LAST element of a pipeline, so a body
-    // that ends with a failing `[ -w ]` (the normal case — every swept target
-    // IS read-only) would otherwise fail the whole pipeline under
-    // `set -o pipefail` and abort the script before the command runs. A real
-    // `fail` still exits 97 from inside the loop, which pipefail turns into
-    // the script's own setup failure — the marker and exit code still
-    // surface.
-    sweepHead(pattern),
-    '  [ -w "$target" ] && fail "$target is still writable";',
+    // TARGET,OPTIONS in ONE enumeration, and the exemption test applies to the
+    // DECODED TARGET alone. `findmnt -r` escapes a space in a target as \x20, so
+    // the escaped target is a single space-free field and the options are the
+    // rest of the line; the split therefore happens BEFORE the decode, which is
+    // what keeps a spaced target one target (the sweep's own regression) while
+    // the options stay intact for the flag test. Test the target, not the whole
+    // line: the pattern is anchored, so a line carrying options would never
+    // match and every target — the workspace included — would be required to be
+    // read-only.
+    "findmnt -rno TARGET,OPTIONS | while IFS=' ' read -r raw opts; do",
+    // `\${raw}` is ESCAPED: this fragment is a JS template literal, and an
+    // unescaped `${raw}` is JS interpolation (a ReferenceError at build time),
+    // not the shell variable the fence needs.
+    '  target=$(printf \'%b\' "${raw}");',
+    // A failing grep is not a match: the sweep has already failed closed on a
+    // broken pattern (fail "exemption grep failed"), so an unreadable exemption
+    // here can only over-ask, never under-ask. `if ...; then continue; fi` and
+    // NOT `grep ... && continue`: the failing branch of an if returns 0, while
+    // a bare `&&` list would return 1 for every non-exempt target and `set -e`
+    // would abort the fence with status 1 instead of 97.
+    `  if printf '%s\\n' "$target" | grep -Eq ${shellQuote(pattern)}; then continue; fi;`,
+    // WHY THE FLAG TEST IS GATED ON REACHABILITY, and the measurement behind it.
+    // `findmnt` lists ONE RECORD PER MOUNT, and a target can be stacked: measured
+    // on a running WSL2 distribution, `/run/user` appears TWICE (a mode=755 layer
+    // and a relatime layer on top of it) and `/proc/sys/fs/binfmt_misc/status`
+    // is a second record under a first. `mount -o remount,ro,bind "$target"` by
+    // path can only ever reach the TOPMOST mount, so the covered record keeps
+    // `rw` no matter what the sweep does — measured: after remounting the visible
+    // `/run/user`, the other record still reported `rw,relatime` while a write
+    // through the path failed EROFS, i.e. the covered record is NOT a hole (it is
+    // unreachable storage). Failing on its flag was therefore a false positive
+    // that refused every confined command, which is precisely the defect class
+    // this whole change exists to remove.
+    //
+    // `[ -w ]` on the target answers about the mount a WRITE WOULD ACTUALLY
+    // LAND ON — the topmost, reachable one — which is the question the boundary
+    // is about. So the two tests are paired rather than redundant: `[ -w ]` is
+    // the reachability and writability fact, and the flag test is applied only
+    // where the flag is the authority, i.e. on a target that is not storage. For
+    // a socket/FIFO/device, `[ -w ]` says nothing about the mount (see
+    // {@link KERNEL_SURFACES} and the module note), so the flag is what decides.
+    '  if [ -d "$target" ] || [ -f "$target" ]; then',
+    // Storage inode: `[ -w ]` decides. It already covers a covered record (the
+    // write would land on the reachable mount) and needs no flag test.
+    '    if [ -w "$target" ]; then fail "$target is still writable"; fi;',
+    '  else',
+    // Not storage: the mount flag decides, and it must be `ro` as a comma member
+    // (a mount's VFS options are a comma list; `ro` is not pinned to a position).
+    '    case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac;',
+    '  fi;',
+    // The trailing `true` keeps the pipeline itself green: this while is the
+    // LAST element of a pipeline, and anything that ends the body with a
+    // non-zero status would fail the whole pipeline under `set -o pipefail` and
+    // abort the script before the command runs. A real `fail` still exits 97
+    // from inside the loop, which pipefail turns into the script's own setup
+    // failure — the marker and exit code still surface.
     '  true;',
     'done',
     'true',
@@ -776,6 +911,22 @@ export function buildConfinedCommand({ command, linuxCwd, mode, workspaceLinuxRo
   }
   const script = buildNamespaceScript({ command, linuxCwd, mode, workspaceLinuxRoot, identity, noNewPrivs })
   const flags = ['--mount', '--propagation', 'private']
-  if (isolateProcesses) flags.push('--pid', '--fork')
-  return `sudo -n unshare ${flags.join(' ')} bash -c ${shellQuote(script)}`
+  // A PID namespace re-parents the tree but the inherited procfs still lists the PARENT's
+  // pids, so /proc/<outer-pid>/root names the outer mount namespace — where nothing was
+  // remounted read-only. `--mount-proc` is what closes that, and it is one control with
+  // the pid namespace, not an option beside it.
+  if (isolateProcesses) flags.push('--pid', '--fork', '--mount-proc')
+  // The helper pins PATH and runs its fence under `bash -p` (see its own comments for the
+  // measurements). This runner emits the same fence body, so it must carry the same
+  // invariants: without the pin, a caller able to pass a sudo command-line assignment
+  // shadows mount/findmnt/mountpoint and the postconditions pass while the mounts stay
+  // writable — a fence that lies. `-p` skips BASH_ENV and the function import for the
+  // fence body, and the three `-u` removals close the interop door (a Windows program
+  // launched from here can start an unfenced `wsl.exe ... bash`, where NO_NEW_PRIVS does
+  // not apply and the retained sudo grant re-escalates normally).
+  const hardened = [
+    'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH;',
+    script,
+  ].join('\n')
+  return `sudo -n unshare ${flags.join(' ')} env -u BASH_ENV -u WSL_INTEROP -u WSLENV -u WSL_DISTRO_NAME bash -p -c ${shellQuote(hardened)}`
 }

package/lib/wsl/dsh-wsl-confine.sh

@@ -2,7 +2,7 @@
 # Privileged mode (-p): this script runs as root via sudo, and without -p bash would
 # source a caller-supplied BASH_ENV file BEFORE our first line, as root. The
 # startup-defence note below carries the measurement (bash 5.2.37).
-# dsh-wsl-confine v1.2 — DSH WSL confinement helper.
+# dsh-wsl-confine v1.3 — DSH WSL confinement helper.
 #
 # Root-owned fence executor: the ONLY thing this helper does is apply the
 # mount-namespace fence (workspace bind, tmpfs /tmp, read-only /, read-only
@@ -88,7 +88,7 @@ export PATH
 # purpose: it must not depend on the deployment's sudoers either way.
 
 set -euo pipefail
-VERSION='dsh-wsl-confine v1.2'
+VERSION='dsh-wsl-confine v1.3'
 
 uid=; gid=; home=; cwd=; workspace=; pidns=1
 ARGS=()
@@ -194,8 +194,24 @@ command -v findmnt >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: fin
 # form is not portable and the refusal above is what the fence relies on.)
 KEEP_ENTRIES=(/tmp /dev /dev/pts /dev/mqueue /proc /sys)
 [[ -z "$workspace" ]] || KEEP_ENTRIES+=("$workspace")
+
+# Kernel virtual filesystems are exempt as SUBTREES, not as single mount points. A fresh
+# `--mount-proc` brings /proc's own nested mounts with it (measured: /proc/sys/fs/binfmt_misc
+# is a separate mount record), and a nested kernel mount cannot be made read-only — it is
+# not backing storage. Exact-entry matching left those children unexempt, so the
+# postcondition found the first one writable and the fence refused every command.
+#
+# The subtree list is deliberately NARROWER than KEEP_ENTRIES. /dev and /tmp stay exact so
+# their writable children keep being swept: /dev/shm is shared memory that must end up
+# READONLY (the post-condition asserts it), and a workspace under /tmp is already refused
+# outright. The subtree rule applies only to the two pseudo-filesystems whose children are
+# kernel state by construction, and the workspace is never one of them.
+KERNEL_SUBTREE=(/proc /sys)
 EXEMPT_PATTERN=$(printf '%s\n' "${KEEP_ENTRIES[@]}" | sed 's/[][\\^$.*+?(){}|]/\\&/g' | tr '\n' '|')
 EXEMPT_PATTERN="${EXEMPT_PATTERN%|}"
+for kernel in "${KERNEL_SUBTREE[@]}"; do
+  EXEMPT_PATTERN="${EXEMPT_PATTERN}|$(printf '%s' "$kernel" | sed 's/[][\\^$.*+?(){}|]/\\&/g')/.*"
+done
 
 # The fence script is built HERE from the validated parameters — the caller
 # never supplies script text. It is identical in effect to the in-process
@@ -218,8 +234,30 @@ findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | {
 done
 mountpoint -q /tmp || fail "/tmp is not a private tmpfs"
 findmnt -rno OPTIONS / | grep -q "^ro" || fail "/ is not read-only"
-findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | { grep -Ev "^(${DROP_EXEMPT})\$" || fail "exemption grep failed"; } | while IFS= read -r target; do
-  [[ -w "$target" ]] && fail "$target is still writable"
+# The postcondition pairs two tests, and each is load-bearing where the other is
+# blind. A target can be STACKED — findmnt lists one record per mount — and
+# `remount,ro,bind` by path only ever reaches the TOPMOST one (measured: after
+# remounting /run/user, a covered record still reported rw while a write through
+# the path failed EROFS — unreachable storage, not a hole). So:
+#   * a REGULAR FILE or DIRECTORY is judged by `[ -w ]`: it answers about the
+#     mount a write would actually land on, covered record or not;
+#   * anything else (socket, FIFO, device) is judged by the MOUNT FLAG, because
+#     `[ -w ]` is meaningless there: access(W_OK) narrows the kernel's read-only
+#     answer to S_ISREG/S_ISDIR/S_ISLNK (sb_permission), do_faccessat() adds a
+#     special_file() exclusion, and this fragment runs as root (CAP_DAC_OVERRIDE)
+#     before the setpriv drop. A socket therefore reported "writable" on a mount
+#     that WAS remounted read-only: measured as exit 97 for the unix socket under
+#     /mnt/wsl/podman-sockets with podman machine running, refusing every
+#     confined command including a bare `true` (github issue #2).
+findmnt -rno TARGET,OPTIONS | while IFS=" " read -r raw opts; do
+  target=$(printf "%b" "$raw")
+  if printf "%s\n" "$target" | grep -Eq "^(${DROP_EXEMPT})\$"; then continue; fi
+  if [[ -d "$target" || -f "$target" ]]; then
+    if [[ -w "$target" ]]; then fail "$target is still writable"; fi
+  else
+    # Comma-delimited membership, not a ^ro prefix: ro is not pinned to a position.
+    case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac
+  fi
   true
 done
 cd "$DROP_CWD"
@@ -228,12 +266,28 @@ exec setpriv --no-new-privs --reuid="$DROP_UID" --regid="$DROP_GID" --init-group
 PID_FLAG=''
 [[ "$pidns" = 1 ]] && PID_FLAG='--pid --fork'
 
+# A PID namespace alone does NOT hide the outer processes: it re-parents this tree, but
+# the procfs it inherits still lists the PARENT's pids, so /proc/<outer-pid>/root keeps
+# naming the outer mount namespace — where / and /mnt/c were never remounted read-only,
+# because that remount is private to this fence. `--mount-proc` mounts a FRESH procfs over
+# /proc, so a magic link can only ever name a process inside this namespace. The two
+# halves are one control, which is why the flag is tied to the pid namespace and not
+# offered separately: a fresh procfs without a pid namespace would still list outer pids.
+PROC_FLAG=''
+[[ "$pidns" = 1 ]] && PROC_FLAG='--mount-proc'
+
+# WSL interop is a door OUT of the fence, and NO_NEW_PRIVS does not survive it: a confined
+# command can launch a WINDOWS program, and that program can start a fresh
+# `wsl.exe -d <distro> -e bash` — a new Linux process in the INITIAL mount namespace
+# carrying no NNP, free to use the passwordless sudo grant this runner itself requires.
+# The door is opened by environment variables, so they are removed on the one invocation
+# every root-phase descendant hangs off. /mnt/c stays mounted read-only under the fence
+# and interop was the way around that write fence, not a way through it.
+#
 # -p stops OUR bash from processing BASH_ENV, but it does NOT remove the variable from
 # the environment, and every descendant inherits it. The drop-side `bash -lc
 # "$DROP_COMMAND"` is NOT privileged and does process it (measured: it sourced the
-# caller's file as the session user, inside the fence). Drop it HERE, on the one
-# invocation every root-phase descendant hangs off, so no descendant can be made to
-# source a caller's file.
+# caller's file as the session user, inside the fence). Drop it HERE.
 #
 # -p on THIS file's bash also stops the import of functions from the environment
 # into THIS shell only. The fence body is a separate `bash -c`, so without -p there a
@@ -243,7 +297,8 @@ PID_FLAG=''
 # therefore launched with -p as well: the same privileged-mode rule that skips
 # BASH_ENV skips the function import, so a coordinated override becomes a no-op
 # instead of a fence that lies.
-exec unshare --mount --propagation private $PID_FLAG env -u BASH_ENV \
+exec unshare --mount --propagation private $PID_FLAG $PROC_FLAG \
+  env -u BASH_ENV -u WSL_INTEROP -u WSLENV -u WSL_DISTRO_NAME \
   DROP_UID="$uid" DROP_GID="$gid" DROP_HOME="$home" DROP_USER="${SUDO_USER:-root}" \
   DROP_CWD="$cwd" DROP_WORKSPACE="$workspace" DROP_COMMAND="${ARGS[*]}" \
   DROP_EXEMPT="$EXEMPT_PATTERN" \

package/lib/wsl/fs.js

@@ -162,7 +162,39 @@ export class WslFileSystem extends LocalFileSystem {
       // the share refuses that one step transiently (see ./publish.js for the
       // measurement). The publication is waited out rather than reported as a
       // failure the caller cannot tell apart from a real one.
+      //
+      // The containment re-test lives HERE, next to the syscall, because that is the only
+      // place it can see a component swapped after `checkedTarget`: the fence's own
+      // documentation records that a rename through such a component lands the file AT THE
+      // LINK'S TARGET, so the window is a content escape, not just an out-of-bounds
+      // directory. Refusing here reports the same structured denial the entry check uses.
       replaceFile: async (replaced, replacement) => {
+        // Resolve the policy HERE rather than carrying a snapshot. The primitive's signature
+        // is `(replaced: string, replacement: string)`, so no per-call context can reach it,
+        // and an instance field would be shared by every concurrent write — task B's roots
+        // would judge task A's publication. Resolving at the syscall is also the sounder
+        // semantic: the re-test answers "is this path inside a writable root RIGHT NOW",
+        // and a policy that changed since the entry check should narrow the write, not be
+        // ignored in favour of a stale grant.
+        const policy = this.ctx.sandboxPolicy.resolve()
+        if (policy.mode !== 'danger-full-access') {
+          // `replaced` is a HOST spelling (a UNC or a drive path), so its parent is a win32
+          // concern, not a POSIX one.
+          const parent = await this.resolve(win32.dirname(replaced))
+          let contained = false
+          for (const root of this.writableHostRoots(policy)) {
+            if (await isUnderHost(parent.targetKey, root)) {
+              contained = true
+              break
+            }
+          }
+          if (!contained) {
+            throw new FsError(
+              `cannot write "${replaced}": the destination left the writable roots between the check and the publication`,
+              'FS_SANDBOX_DENIED',
+            )
+          }
+        }
         await publishReplace(replaced, replacement)
       },
       // The share exposes no settable DACL, and staging is already private.

package/lib/wsl/sandbox.js

@@ -51,10 +51,17 @@ export const Config = z.object({
   /**
    * Add a PID namespace to the fence. OFF for this provider's consumers on purpose: the
    * argv it wraps is an INTERACTIVE shell on a PTY, and a PID namespace re-parents that
-   * shell to PID 1 with a process group the PTY's own foreground queries
-   * (`terminal-bridge.py`'s `tcgetpgrp`) can no longer address — the reason the shipped
-   * helper carries `--no-pidns` at all. The shell executor's one-shot commands keep the
-   * namespace (its own default); this is the terminal path only.
+   * shell to PID 1, which the PTY path cannot live with. Re-measured while closing the
+   * /proc escape: `tcgetpgrp` alone DOES still resolve under `--pid --fork --mount-proc`
+   * (TPGID names the shell's own pid), but driving the real `terminal-bridge.py` through
+   * the same namespace HANGS — it never completes its start, so the terminal is dead.
+   * The one-shot shell executor keeps the namespace (its own default); this is the
+   * terminal path only.
+   *
+   * The /proc consequence is accepted HERE and closed on the one-shot path: with the
+   * namespace off, a fresh procfs would still list the outer pids, so this arm carries no
+   * `--mount-proc` either — mounting one would buy nothing. What the terminal path cannot
+   * have, `shell.js` and the direct runner do have.
    */
   isolateProcesses: z.boolean().default(false),
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./lib/icon.svg",