zerogterm 0.7.0-alpha2 → 0.8.0-alpha

package/dist/main/main/port-forward-service.js

@@ -0,0 +1,230 @@
+import { randomUUID } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { homedir } from 'node:os';
+import { FORWARD_SETTLE_MS, buildForwardArgs, describeForward, readForwardOutcome } from './port-forward-protocol.js';
+import { detectPrompt } from './sftp-protocol.js';
+// node-pty is a native addon with no ESM entry point, and this file is compiled
+// as a module. Same shim as session-service.ts and sftp-service.ts.
+const require = createRequire(import.meta.url);
+/** A ceiling on live tunnels, so a stuck panel cannot spawn clients forever. */
+const MAX_FORWARDS = 16;
+/** Nothing at all from the client within this long means the host never answered. */
+const FIRST_BYTE_MS = 20000;
+/** Kept small: this is a debug log, not a terminal, and only the tail matters. */
+const BUFFER_CHARS = 8000;
+/** How the client's own line endings behave, as with the transfer side. */
+const TERMINATOR = '\n';
+/**
+ * The `ssh -N` processes behind shared ports.
+ *
+ * One process per tunnel. It cannot be otherwise: a forward cannot be added to
+ * the connection a terminal pane already holds without either typing `~C`
+ * escapes into the pty the user is typing in, or ControlMaster, which Windows
+ * OpenSSH does not have. One process each also makes closing exact — kill that
+ * process and that tunnel is gone, with nothing else disturbed.
+ *
+ * The pty is not for a remote tty; `-N` runs no remote command. It is so `ssh`
+ * has a terminal to ask for a password on, the same reason the transfer side
+ * uses one, which is why prompt handling here is `detectPrompt` unchanged.
+ */
+export class PortForwardService {
+    forwards = new Map();
+    spawnPty;
+    onEvent;
+    settleMs;
+    constructor(options = {}) {
+        this.spawnPty = options.spawnPty ?? ((file, args, ptyOptions) => require('node-pty').spawn(file, args, ptyOptions));
+        this.onEvent = options.onEvent ?? (() => undefined);
+        this.settleMs = options.settleMs ?? FORWARD_SETTLE_MS;
+    }
+    list() {
+        return [...this.forwards.values()].map((forward) => ({ ...forward.info }));
+    }
+    /**
+     * Open a tunnel, resolving once it is actually listening.
+     *
+     * A password or host-key question arrives as an event while this is still
+     * pending, and is answered with answerPrompt() — the same shape as the
+     * transfer panel, because it is the same client asking.
+     */
+    async open(request) {
+        // Built before anything is spawned, so an invalid request is a sentence
+        // rather than a process that dies a moment later.
+        const { file, args, spec } = buildForwardArgs(request);
+        const existing = this.findConflict(request);
+        if (existing) {
+            throw new Error(`Port ${request.listenPort} is already shared ${existing.direction === 'local' ? 'from' : 'to'} ${existing.target}.`);
+        }
+        if (this.forwards.size >= MAX_FORWARDS) {
+            throw new Error('Too many shared ports. Close one and try again.');
+        }
+        const id = request.id ?? `forward:${randomUUID()}`;
+        // Logged because which client got picked, and with which spec, is the first
+        // thing worth knowing when a tunnel does not work on someone else's machine.
+        console.log('[zerog] forward open', { file, args });
+        const info = { ...request, id, status: 'connecting' };
+        const pty = this.spawnPty(file, args, {
+            name: 'xterm-256color',
+            cols: 120,
+            rows: 30,
+            cwd: homedir(),
+            env: process.env
+        });
+        const forward = { info, pty, buffer: '', settle: null, settleTimer: undefined, firstByteTimer: undefined, closed: false };
+        this.forwards.set(id, forward);
+        pty.onData((data) => this.receive(forward, data));
+        pty.onExit(() => this.handleExit(forward));
+        this.emitStatus(forward);
+        return new Promise((resolve, reject) => {
+            forward.settle = { resolve, reject };
+            forward.firstByteTimer = setTimeout(() => {
+                this.fail(forward, `${describeForward(request)} did not answer.`);
+            }, FIRST_BYTE_MS);
+        });
+    }
+    answerPrompt(forwardId, answer) {
+        const forward = this.forwards.get(forwardId);
+        if (!forward)
+            throw new Error('That shared port is no longer open.');
+        if (/[\r\n]/.test(answer))
+            throw new Error('An answer must be a single line.');
+        lastQuestion.delete(forwardId);
+        forward.pty.write(`${answer}${TERMINATOR}`);
+    }
+    /**
+     * Close a tunnel.
+     *
+     * There is no graceful handshake to attempt: `ssh -N` is doing nothing but
+     * holding the forward open, so killing it is the clean way to let it go.
+     */
+    close(forwardId) {
+        const forward = this.forwards.get(forwardId);
+        if (!forward)
+            return;
+        this.destroy(forward, 'Closed.');
+    }
+    closeAll() {
+        for (const id of [...this.forwards.keys()])
+            this.close(id);
+    }
+    /**
+     * A tunnel that already binds what this request wants.
+     *
+     * Checked here rather than only in the renderer because a second listener on
+     * the same port cannot work, and spawning a client to find that out gives the
+     * user an ssh error instead of a sentence. A local forward's port is bound on
+     * this machine and a remote forward's on the far host, so the two only
+     * conflict with their own kind — and a remote one only per host.
+     */
+    findConflict(request) {
+        return this.list().find((candidate) => {
+            if (candidate.id === request.id)
+                return false;
+            if (candidate.listenPort !== request.listenPort)
+                return false;
+            if (candidate.direction !== request.direction)
+                return false;
+            return request.direction === 'local' || candidate.target === request.target;
+        });
+    }
+    receive(forward, data) {
+        if (forward.closed)
+            return;
+        clearTimeout(forward.firstByteTimer);
+        forward.firstByteTimer = undefined;
+        forward.buffer = (forward.buffer + data).slice(-BUFFER_CHARS);
+        const question = detectPrompt(forward.buffer);
+        if (question) {
+            // Only once per question: a rejected password is followed by the very same
+            // prompt text, and the user has to be given the field again.
+            if (lastQuestion.get(forward.info.id) !== question.text) {
+                lastQuestion.set(forward.info.id, question.text);
+                this.onEvent({ type: 'prompt', forwardId: forward.info.id, prompt: question });
+            }
+            return;
+        }
+        const outcome = readForwardOutcome(forward.buffer, forward.info.direction);
+        if (!outcome)
+            return;
+        if (outcome.kind === 'failed') {
+            this.fail(forward, outcome.reason);
+            return;
+        }
+        if (outcome.kind === 'open') {
+            this.succeed(forward);
+            return;
+        }
+        // Authenticated but not yet listening. Give the client a moment to say it
+        // started, and take silence as success rather than failing a tunnel that an
+        // ssh build words differently from the one this was written against.
+        if (!forward.settleTimer) {
+            forward.settleTimer = setTimeout(() => {
+                if (!forward.closed && forward.info.status === 'connecting')
+                    this.succeed(forward);
+            }, this.settleMs);
+        }
+    }
+    succeed(forward) {
+        clearTimeout(forward.settleTimer);
+        forward.settleTimer = undefined;
+        forward.info.status = 'open';
+        delete forward.info.message;
+        this.emitStatus(forward);
+        const settle = forward.settle;
+        forward.settle = null;
+        settle?.resolve({ ...forward.info });
+    }
+    fail(forward, reason) {
+        const settle = forward.settle;
+        forward.settle = null;
+        forward.info.status = 'error';
+        forward.info.message = reason;
+        this.emitStatus(forward);
+        this.destroy(forward, reason, { keepStatus: true });
+        if (settle)
+            settle.reject(new Error(reason));
+    }
+    /**
+     * The client exited on its own.
+     *
+     * With ExitOnForwardFailure this is how a forward that could not bind reports
+     * itself, so the buffer is worth one more read before falling back to a
+     * generic message.
+     */
+    handleExit(forward) {
+        if (forward.closed)
+            return;
+        const outcome = readForwardOutcome(forward.buffer, forward.info.direction);
+        const reason = outcome?.kind === 'failed'
+            ? outcome.reason
+            : forward.info.status === 'open'
+                ? 'The connection closed.'
+                : `Could not share port ${forward.info.listenPort}.`;
+        this.fail(forward, reason);
+    }
+    destroy(forward, message, options = {}) {
+        if (forward.closed)
+            return;
+        forward.closed = true;
+        clearTimeout(forward.settleTimer);
+        clearTimeout(forward.firstByteTimer);
+        try {
+            forward.pty.kill();
+        }
+        catch {
+            /* already gone */
+        }
+        this.forwards.delete(forward.info.id);
+        lastQuestion.delete(forward.info.id);
+        if (!options.keepStatus) {
+            forward.info.status = 'idle';
+            this.emitStatus(forward);
+        }
+        this.onEvent({ type: 'closed', forwardId: forward.info.id, message });
+    }
+    emitStatus(forward) {
+        this.onEvent({ type: 'status', forward: { ...forward.info } });
+    }
+}
+/** The last question each tunnel asked, so it is only surfaced once. */
+const lastQuestion = new Map();

package/dist/main/main/port-forward-store.js

@@ -0,0 +1,133 @@
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+const SCHEMA_VERSION = 1;
+const MAX_FORWARDS = 64;
+/**
+ * Main-process-only, best-effort memory of which ports were shared.
+ *
+ * Stores where a tunnel went and how wide it was bound — never a credential, a
+ * cwd, or command arguments — the same guarantee SessionHistoryStore and
+ * WorkspaceStore make, and for the same reason: this is plain JSON in the user's
+ * profile.
+ *
+ * Nothing here reopens a tunnel. Restored forwards come back as rows waiting to
+ * be clicked, so launching the app never dials out to a host on its own.
+ */
+export class PortForwardStore {
+    filePath;
+    file = { version: SCHEMA_VERSION, forwards: [] };
+    loaded = false;
+    writeQueue = Promise.resolve();
+    constructor(options) {
+        this.filePath = options.filePath;
+    }
+    async load() {
+        await this.ensureLoaded();
+        return normalizeFile(this.file) ?? { version: SCHEMA_VERSION, forwards: [] };
+    }
+    async save(input) {
+        await this.ensureLoaded();
+        // Validated on the way in as well as out: the renderer is the only caller,
+        // but this is an IPC boundary, and a stored bad value would come back on
+        // every launch from then on.
+        const normalized = normalizeFile(input);
+        if (!normalized)
+            throw new Error('Invalid shared port list.');
+        this.file = normalized;
+        await this.persist();
+        return normalized;
+    }
+    async ensureLoaded() {
+        if (this.loaded)
+            return;
+        this.loaded = true;
+        try {
+            const parsed = JSON.parse(await readFile(this.filePath, 'utf8'));
+            const normalized = normalizeFile(parsed);
+            if (normalized)
+                this.file = normalized;
+        }
+        catch {
+            this.file = { version: SCHEMA_VERSION, forwards: [] };
+        }
+    }
+    async persist() {
+        const snapshot = this.file;
+        this.writeQueue = this.writeQueue.then(async () => {
+            try {
+                await mkdir(dirname(this.filePath), { recursive: true });
+                const temp = join(dirname(this.filePath), `.port-forwards.tmp-${process.pid}-${randomUUID()}`);
+                await writeFile(temp, JSON.stringify(snapshot, null, 2), { encoding: 'utf8', mode: 0o600 });
+                await rename(temp, this.filePath);
+            }
+            catch {
+                // Remembering a port must never affect terminal operation.
+            }
+        });
+        await this.writeQueue;
+    }
+}
+/** Strip control characters and cap length; the file is user-editable. */
+function safeText(value, limit = 256) {
+    return value.replace(/[\u0000-\u001f\u007f]/g, '').slice(0, limit);
+}
+function port(value) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > 65535)
+        return undefined;
+    return value;
+}
+function normalizeForward(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const item = value;
+    if (typeof item.id !== 'string' || typeof item.target !== 'string')
+        return undefined;
+    if (item.direction !== 'local' && item.direction !== 'remote')
+        return undefined;
+    // A missing or unrecognised bind reads as loopback, never as the wide one: a
+    // hand-edited or truncated file must not be able to widen a forward silently.
+    const bind = item.bind === 'all' ? 'all' : 'loopback';
+    const listenPort = port(item.listenPort);
+    const destinationPort = port(item.destinationPort);
+    const id = safeText(item.id, 64);
+    const target = safeText(item.target, 256);
+    if (!id || !target || listenPort === undefined || destinationPort === undefined)
+        return undefined;
+    const forward = { id, target, direction: item.direction, listenPort, destinationPort, bind };
+    // Left off entirely when absent, so the protocol's own default applies rather
+    // than an empty string reaching the forward spec.
+    const destinationHost = typeof item.destinationHost === 'string' ? safeText(item.destinationHost, 253) : '';
+    if (destinationHost)
+        forward.destinationHost = destinationHost;
+    return forward;
+}
+export function normalizeFile(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const item = value;
+    if (item.version !== SCHEMA_VERSION)
+        return undefined;
+    if (!Array.isArray(item.forwards))
+        return undefined;
+    const forwards = [];
+    const seen = new Set();
+    for (const raw of item.forwards) {
+        const forward = normalizeForward(raw);
+        if (!forward || seen.has(forward.id))
+            continue;
+        seen.add(forward.id);
+        forwards.push(forward);
+        if (forwards.length >= MAX_FORWARDS)
+            break;
+    }
+    return { version: SCHEMA_VERSION, forwards };
+}
+/** What is worth remembering about a live tunnel: everything but how it is doing. */
+export function forgetStatus(forward) {
+    const { status, message, ...rest } = forward;
+    return rest;
+}
+export function defaultPortForwardPath(userDataPath) {
+    return join(userDataPath, 'port-forwards.json');
+}

package/dist/main/main/preload.cjs

@@ -4,6 +4,23 @@ const api = {
   listSessions: () => ipcRenderer.invoke('sessions:list'),
   listHistory: () => ipcRenderer.invoke('sessions:history'),
   removeHistory: (entryId) => ipcRenderer.invoke('sessions:historyRemove', entryId),
+  listCommandHistory: () => ipcRenderer.invoke('commands:list'),
+  recordCommand: (record) => ipcRenderer.invoke('commands:record', record),
+  pickCommand: (id) => ipcRenderer.invoke('commands:pick', id),
+  clearCommandHistory: () => ipcRenderer.invoke('commands:clear'),
+  listForwards: () => ipcRenderer.invoke('forwards:list'),
+  openForward: (request) => ipcRenderer.invoke('forwards:open', request),
+  closeForward: (id) => ipcRenderer.invoke('forwards:close', id),
+  answerForwardPrompt: (id, answer) => ipcRenderer.invoke('forwards:answerPrompt', id, answer),
+  loadForwards: () => ipcRenderer.invoke('forwards:load'),
+  saveForwards: (file) => ipcRenderer.invoke('forwards:save', file),
+  onForwardEvent: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on('forwards:event', listener);
+    return () => ipcRenderer.removeListener('forwards:event', listener);
+  },
+  loadWorkspaces: () => ipcRenderer.invoke('workspaces:load'),
+  saveWorkspaces: (file) => ipcRenderer.invoke('workspaces:save', file),
   listBackends: () => ipcRenderer.invoke('sessions:backends'),
   listWslDistributions: () => ipcRenderer.invoke('sessions:wslDistributions'),
   createLocalSession: (request) => ipcRenderer.invoke('sessions:createLocal', request),
@@ -27,9 +44,17 @@ const api = {
     ipcRenderer.on('terminal:status', listener);
     return () => ipcRenderer.removeListener('terminal:status', listener);
   },
-  requestAiCommand: () => ipcRenderer.invoke('ai:suggest'),
+  requestAiCommand: (config, request) => ipcRenderer.invoke('ai:suggest', config, request),
+  listAiModels: (baseUrl) => ipcRenderer.invoke('ai:models', baseUrl),
+  testAiEndpoint: (config) => ipcRenderer.invoke('ai:test', config),
+  cancelAiRequest: () => ipcRenderer.invoke('ai:cancel'),
+  aiApiKeyStatus: () => ipcRenderer.invoke('aiKey:status'),
+  saveAiApiKey: (key) => ipcRenderer.invoke('aiKey:save', key),
+  clearAiApiKey: () => ipcRenderer.invoke('aiKey:clear'),
   listLocalDirectory: (path) => ipcRenderer.invoke('fs:listLocal', path),
+  appVersion: () => ipcRenderer.invoke('app:version'),
   localHome: () => ipcRenderer.invoke('fs:localHome'),
+  wslHome: (distribution) => ipcRenderer.invoke('fs:wslHome', distribution),
   createLocalDirectory: (path) => ipcRenderer.invoke('fs:mkdirLocal', path),
   renameLocalEntry: (from, to) => ipcRenderer.invoke('fs:renameLocal', from, to),
   removeLocalEntry: (path, kind) => ipcRenderer.invoke('fs:removeLocal', path, kind),
@@ -47,6 +72,10 @@ const api = {
     ipcRenderer.on('sftp:event', listener);
     return () => ipcRenderer.removeListener('sftp:event', listener);
   },
+  speechApiKeyStatus: () => ipcRenderer.invoke('speechKey:status'),
+  saveSpeechApiKey: (key) => ipcRenderer.invoke('speechKey:save', key),
+  clearSpeechApiKey: () => ipcRenderer.invoke('speechKey:clear'),
+  readSpeechApiKey: () => ipcRenderer.invoke('speechKey:read'),
   openExternal: (url) => ipcRenderer.invoke('links:openExternal', url),
   onLinkRefused: (callback) => {
     const listener = (_event, reason) => callback(reason);

package/dist/main/main/secret-store.js

@@ -0,0 +1,156 @@
+// Named secrets, encrypted at rest by the operating system.
+//
+// The renderer keeps its settings in localStorage, which is a plain file on
+// disk: fine for a font choice, wrong for an API key. So keys live here
+// instead, in the main process, encrypted through Electron's safeStorage —
+// DPAPI on Windows, Keychain on macOS, libsecret or kwallet on Linux. The
+// ciphertext file is useless to another user account on the same machine, and
+// nothing readable is written anywhere the renderer can reach.
+//
+// safeStorage can report that encryption is unavailable, which happens on a
+// Linux box with no keyring configured. When it does, storing is refused
+// rather than quietly downgraded to plaintext: a key the user believes is
+// protected must not be written in the clear. The caller is told, and can
+// offer to hold the key in memory for the session instead.
+//
+// The crypto is injected so this module can be tested without Electron.
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+const SCHEMA_VERSION = 1;
+/** Thrown when the platform cannot encrypt, so nothing was written. */
+export class EncryptionUnavailableError extends Error {
+    constructor() {
+        super('This system has no secret store available, so the key cannot be saved safely.');
+        this.name = 'EncryptionUnavailableError';
+    }
+}
+export class SecretStore {
+    filePath;
+    crypto;
+    /** Serialised so two saves in flight cannot interleave read-modify-write. */
+    writeQueue = Promise.resolve();
+    constructor(options) {
+        this.filePath = options.filePath;
+        this.crypto = options.crypto;
+    }
+    /** Can this platform encrypt at all? Asked before offering to store a key. */
+    encryptionAvailable() {
+        try {
+            return this.crypto.isEncryptionAvailable();
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Is a secret stored under this name? Does not decrypt it. */
+    async has(name) {
+        const secrets = await this.read();
+        return typeof secrets[name] === 'string';
+    }
+    /**
+     * The stored secret, or null when there is none.
+     *
+     * A value that will not decrypt is treated as absent: that is what a file
+     * copied from another machine or another user account looks like, and there
+     * is nothing to do with it but ask for the key again.
+     */
+    async get(name) {
+        const stored = (await this.read())[name];
+        if (typeof stored !== 'string')
+            return null;
+        try {
+            const value = this.crypto.decryptString(Buffer.from(stored, 'base64'));
+            return value || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Store a secret, replacing any previous one of that name. */
+    async set(name, value) {
+        if (!value) {
+            await this.clear(name);
+            return;
+        }
+        if (!this.encryptionAvailable())
+            throw new EncryptionUnavailableError();
+        const encrypted = this.crypto.encryptString(value).toString('base64');
+        await this.update((secrets) => ({ ...secrets, [name]: encrypted }));
+    }
+    /** Forget a secret. Returns whether there was one. */
+    async clear(name) {
+        let existed = false;
+        await this.update((secrets) => {
+            existed = typeof secrets[name] === 'string';
+            const next = { ...secrets };
+            delete next[name];
+            return next;
+        });
+        return existed;
+    }
+    async read() {
+        try {
+            const parsed = JSON.parse(await readFile(this.filePath, 'utf8'));
+            if (!isSecretsFile(parsed))
+                return {};
+            return parsed.secrets;
+        }
+        catch {
+            // No file yet, or one this version cannot read: no secrets stored.
+            return {};
+        }
+    }
+    async update(change) {
+        this.writeQueue = this.writeQueue.then(async () => {
+            const secrets = change(await this.read());
+            const snapshot = { version: SCHEMA_VERSION, secrets };
+            await mkdir(dirname(this.filePath), { recursive: true });
+            if (Object.keys(secrets).length === 0) {
+                // Nothing left to keep: remove the file rather than leaving an empty
+                // one behind, so "no key stored" looks the same as never having one.
+                await unlink(this.filePath).catch(() => undefined);
+                return;
+            }
+            const temp = join(dirname(this.filePath), `.secrets.tmp-${process.pid}-${randomUUID()}`);
+            // 0600, and written whole then renamed, so a crash cannot leave a
+            // half-written key behind for the next read to find.
+            await writeFile(temp, JSON.stringify(snapshot, null, 2), { encoding: 'utf8', mode: 0o600 });
+            try {
+                await rename(temp, this.filePath);
+            }
+            catch (error) {
+                // The temp file holds the same ciphertext under the same 0600 as the
+                // destination, so this is tidiness rather than a leak — but an orphan
+                // per failed write, each with a key the user may since have rotated,
+                // is not something to leave lying around.
+                await unlink(temp).catch(() => undefined);
+                throw error;
+            }
+        });
+        await this.writeQueue;
+    }
+}
+function isSecretsFile(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const file = value;
+    if (file.version !== SCHEMA_VERSION)
+        return false;
+    if (typeof file.secrets !== 'object' || file.secrets === null)
+        return false;
+    return Object.values(file.secrets).every((entry) => typeof entry === 'string');
+}
+export function defaultSecretsPath(userDataPath) {
+    return join(userDataPath, 'secrets.json');
+}
+/** The name the speech server key is stored under. */
+export const SPEECH_API_KEY = 'speech.serverApiKey';
+/**
+ * The name the AI endpoint key is stored under.
+ *
+ * Separate from the speech key: the two point at different services often
+ * enough — a local Ollama and a hosted transcription server, say — that sharing
+ * one key would be wrong more often than right.
+ */
+export const AI_API_KEY = 'ai.serverApiKey';

package/dist/main/main/session-service.js

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { promisify } from 'node:util';
-import { defaultShellBackend, findOpenSshTool, isLocalShellBackend, resolveShellBackend } from './shell-catalog.js';
+import { WSL_HOME, defaultShellBackend, findOpenSshTool, isLocalShellBackend, ptyStartDirectory, resolveShellBackend, withWslStartDirectory } from './shell-catalog.js';
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,48}$/;
@@ -136,6 +136,14 @@ function loadPty() {
 export class ScreenService {
     ptys = new Map();
     sshSessions = new Map();
+    /**
+     * The argv each fallback local session was started with.
+     *
+     * Held apart from SessionInfo because it is not session metadata anyone else
+     * needs, and because the reported cwd moves as the shell does — a reattach
+     * must not rebuild the arguments from a directory that has since changed.
+     */
+    launchArgs = new Map();
     fallbackLocalSessions = new Map();
     onEvent;
     /** Injectable so tests can exercise routing and teardown without a real shell. */
@@ -195,14 +203,20 @@ export class ScreenService {
             ? resolveShellBackend(request.backend, request.wslDistribution)
             : defaultShellBackend();
         const backend = shell.backend;
-        const requestedCwd = request.cwd ?? homedir();
+        // A WSL shell starts where its own `--cd` argument says, not where the pty
+        // was launched from, so its directory is a Linux path inside the distro
+        // rather than the Windows one this side would otherwise report. Every other
+        // backend does start where the pty does.
+        const requestedCwd = request.cwd ?? (backend === 'wsl' ? WSL_HOME : homedir());
+        const launch = request.cwd ? withWslStartDirectory(shell, request.cwd) : shell;
         if (!(await this.available())) {
             const fallback = { id: `local:${safeName}`, name: safeName, kind: 'local', host: 'local', cwd: requestedCwd, status: 'detached', lastSeen: new Date().toISOString(), persistence: 'process', backend, scope: 'local', source: 'active', wslDistribution: shell.wslDistribution };
             this.fallbackLocalSessions.set(fallback.id, fallback);
+            this.launchArgs.set(fallback.id, launch.args);
             this.onEvent?.('created', fallback, true);
             return fallback;
         }
-        await execFileAsync('screen', ['-dmS', safeName, shell.executable, ...shell.args], { cwd: requestedCwd });
+        await execFileAsync('screen', ['-dmS', safeName, launch.executable, ...launch.args], { cwd: ptyStartDirectory(requestedCwd) });
         const session = { id: `local:${safeName}`, name: safeName, kind: 'local', host: 'local', cwd: requestedCwd, status: 'detached', lastSeen: new Date().toISOString(), persistence: 'screen', backend: 'screen', scope: 'local', source: 'active', screenName: safeName, wslDistribution: shell.wslDistribution };
         this.onEvent?.('created', session, true);
         return session;
@@ -252,7 +266,10 @@ export class ScreenService {
                 const shell = isLocalShellBackend(fallback.backend)
                     ? resolveShellBackend(fallback.backend, fallback.wslDistribution)
                     : defaultShellBackend();
-                this.spawnCommand(id, shell.executable, shell.args, onData, onExit, fallback.cwd, size);
+                // The arguments this session was created with, so a WSL pane reattaches
+                // to the same directory rather than losing its `--cd`.
+                const args = this.launchArgs.get(id) ?? shell.args;
+                this.spawnCommand(id, shell.executable, args, onData, onExit, ptyStartDirectory(fallback.cwd), size);
                 this.onEvent?.('attached', fallback, true);
                 return { ...fallback };
             }
@@ -384,6 +401,7 @@ export class ScreenService {
         this.detach(sessionId);
         this.sshSessions.delete(sessionId);
         this.fallbackLocalSessions.delete(sessionId);
+        this.launchArgs.delete(sessionId);
         this.onEvent?.('closed', session, false);
     }
 }