feat(wsl): run codedash from WSL with Windows-host browser UI

src/data.js

@@ -66,10 +66,10 @@ const EXTRA_OPENCODE_DBS = ALL_HOMES.slice(1).map(h => path.join(h, 'AppData', '
 const EXTRA_KIRO_DBS = ALL_HOMES.slice(1).map(h => path.join(h, 'AppData', 'Roaming', 'kiro-cli', 'data.sqlite3')).filter(d => fs.existsSync(d));
 
 if (IS_WSL) {
-  console.log('  \x1b[36m[WSL]\x1b[0m Detected Windows homes:', ALL_HOMES.slice(1).join(', '));
-  if (EXTRA_CLAUDE_DIRS.length) console.log('  \x1b[36m[WSL]\x1b[0m Extra Claude dirs:', EXTRA_CLAUDE_DIRS.join(', '));
-  if (EXTRA_CODEX_DIRS.length) console.log('  \x1b[36m[WSL]\x1b[0m Extra Codex dirs:', EXTRA_CODEX_DIRS.join(', '));
-  if (EXTRA_CURSOR_DIRS.length) console.log('  \x1b[36m[WSL]\x1b[0m Extra Cursor dirs:', EXTRA_CURSOR_DIRS.join(', '));
+  console.log('  \x1b[36m[WSL]\x1b[0m Also scanning Windows host homes:', ALL_HOMES.slice(1).join(', '));
+  if (EXTRA_CLAUDE_DIRS.length) console.log('  \x1b[36m[WSL]\x1b[0m Windows-side Claude dirs:', EXTRA_CLAUDE_DIRS.join(', '));
+  if (EXTRA_CODEX_DIRS.length) console.log('  \x1b[36m[WSL]\x1b[0m Windows-side Codex dirs:', EXTRA_CODEX_DIRS.join(', '));
+  if (EXTRA_CURSOR_DIRS.length) console.log('  \x1b[36m[WSL]\x1b[0m Windows-side Cursor dirs:', EXTRA_CURSOR_DIRS.join(', '));
 }
 
 // ── Helpers ────────────────────────────────────────────────

src/frontend/app.js

@@ -1575,7 +1575,7 @@ function focusSession(sessionId) {
   fetch('/api/focus', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ pid: a.pid })
+    body: JSON.stringify({ pid: a.pid, sessionId: sessionId })
   }).then(function(r) { return r.json(); }).then(function(data) {
     if (data.ok) {
       var hint = data.terminal || 'terminal';

src/server.js

@@ -2,9 +2,9 @@
 const http = require('http');
 const https = require('https');
 const { URL } = require('url');
-const { exec, execFile } = require('child_process');
+const { exec, execFile, execFileSync } = require('child_process');
 const { loadSessions, loadSessionDetail, deleteSession, getGitCommits, exportSessionMarkdown, getSessionPreview, searchFullText, getActiveSessions, getSessionReplay, getCostAnalytics, computeSessionCost, getProjectGitInfo, getLeaderboardStats } = require('./data');
-const { detectTerminals, openInTerminal, focusTerminalByPid } = require('./terminals');
+const { detectTerminals, openInTerminal, focusTerminalByPid, isWSL } = require('./terminals');
 const { convertSession } = require('./convert');
 const { generateHandoff } = require('./handoff');
 const { CHANGELOG } = require('./changelog');
@@ -110,6 +110,9 @@ function startServer(host, port, openBrowser = true) {
       readBody(req, body => {
         try {
           const { sessionId, tool, flags, project, terminal } = JSON.parse(body);
+          if (!/^[A-Za-z0-9._-]{1,128}$/.test(String(sessionId || ''))) {
+            throw new Error('invalid sessionId');
+          }
           log('LAUNCH', `session=${sessionId} tool=${tool || 'claude'} terminal=${terminal || 'default'} project=${project || '(none)'} flags=${(flags || []).join(',') || '(none)'}`);
           openInTerminal(sessionId, tool || 'claude', flags || [], project || '', terminal || '');
           log('LAUNCH', 'ok');
@@ -198,11 +201,7 @@ function startServer(host, port, openBrowser = true) {
             target = require('path').dirname(target);
           }
           log('IDE', `ide=${ide} project=${project} target=${target}`);
-          if (ide === 'cursor') {
-            exec(`cursor "${target || '.'}"`);
-          } else if (ide === 'code') {
-            exec(`code "${target || '.'}"`);
-          }
+          openIDE(ide, target || '.');
           json(res, { ok: true });
         } catch (e) {
           json(res, { ok: false, error: e.message }, 400);
@@ -244,9 +243,15 @@ function startServer(host, port, openBrowser = true) {
     else if (req.method === 'POST' && pathname === '/api/focus') {
       readBody(req, body => {
         try {
-          const { pid } = JSON.parse(body);
-          log('FOCUS', `pid=${pid}`);
-          const result = focusTerminalByPid(pid);
+          const { pid, sessionId } = JSON.parse(body);
+          if (!Number.isInteger(pid) || pid <= 0) {
+            throw new Error('invalid pid');
+          }
+          if (sessionId && !/^[A-Za-z0-9._-]{1,128}$/.test(String(sessionId))) {
+            throw new Error('invalid sessionId');
+          }
+          log('FOCUS', `pid=${pid} sessionId=${sessionId || '(none)'}`);
+          const result = focusTerminalByPid(pid, sessionId);
           log('FOCUS', `result: terminal=${result.terminal || 'none'} ok=${result.ok}`);
           json(res, result);
         } catch (e) {
@@ -441,8 +446,14 @@ function startServer(host, port, openBrowser = true) {
     if (openBrowser) {
       if (process.platform === 'darwin') {
         execFile('open', [browserUrl]);
-      } else if (process.platform === 'linux') {
+      } else if (process.platform === 'linux' && !isWSL()) {
         execFile('xdg-open', [browserUrl]);
+      } else if (isWSL()) {
+        // In WSL the browser lives on the Windows host. xdg-open inside WSL
+        // typically fails or opens a Linux-side browser that nobody is looking
+        // at. Print the URL and let the user click it from Windows.
+        console.log('  \x1b[33mWSL detected — open this URL in your Windows browser:\x1b[0m');
+        console.log(`  \x1b[36m${browserUrl}\x1b[0m`);
       }
     }
 
@@ -453,6 +464,57 @@ function startServer(host, port, openBrowser = true) {
   });
 }
 
+function openIDE(ide, target) {
+  const bin = ide === 'cursor' ? 'cursor' : 'code';
+  const winBin = bin + '.exe';
+  const runLog = (err) => { if (err) log('ERROR', `${ide} open failed: ${err.message}`); };
+
+  if (!isWSL()) {
+    // execFile with argv — a project path containing quotes or spaces must not
+    // get re-parsed by /bin/sh.
+    execFile(bin, [target], runLog);
+    return;
+  }
+
+  // WSL: branch on whether the project lives on the Windows side or inside WSL.
+  const isWinSide = /^[A-Za-z]:[\\/]/.test(target) || target.includes('\\') || /^\/mnt\/[a-z]\//i.test(target);
+
+  if (isWinSide) {
+    // Translate /mnt/c/... back to C:\... and open natively on Windows.
+    let winTarget = target;
+    const m = target.match(/^\/mnt\/([a-z])\/(.*)$/i);
+    if (m) winTarget = m[1].toUpperCase() + ':\\' + m[2].replace(/\//g, '\\');
+    execFile(winBin, [winTarget], runLog);
+    return;
+  }
+
+  // WSL-side project: prefer the Linux wrapper installed by the Remote-WSL
+  // extension since it handles path translation. Probe via execFileSync('which')
+  // so a missing import would throw loudly instead of being swallowed.
+  let hasWrapper = false;
+  try {
+    execFileSync('which', [bin], { stdio: 'pipe' });
+    hasWrapper = true;
+  } catch (e) {
+    if (e.code !== 1 && !/not found|No such/.test(e.message || '')) {
+      log('WARN', `which ${bin} probe error: ${e.message}`);
+    }
+  }
+
+  if (hasWrapper) {
+    execFile(bin, [target], runLog);
+    return;
+  }
+
+  const distro = process.env.WSL_DISTRO_NAME || '';
+  if (!distro) {
+    log('WARN', `openIDE: no WSL_DISTRO_NAME, cannot build --remote URI for ${winBin}`);
+    execFile(winBin, [target], runLog);
+    return;
+  }
+  execFile(winBin, ['--remote', `wsl+${distro}`, target], runLog);
+}
+
 function sendHeartbeat() {
   try {
     const { getOrCreateAnonId } = require('./data');