Win 转 Linux 开发环境 — Intent Router
What this skill is
This file is a thin wrapper: an intent-recognition and routing layer
that sends the user's request to the correct deterministic pipeline. It
contains ONLY routing and judgment logic.
- Deterministic operations (probe, install, configure, undo) live in
scripts/— execute them, do not reimplement them. - Judgment support (decision trees, compatibility matrices,
troubleshooting playbooks, user-facing templates) lives in
references/— load the listed document when the route says so.
The skill's purpose: move the user's development pipeline from
PowerShell into a standard Linux environment — with local WSL as the
default provider — atomically, reversibly, and without fighting the
desktop client's own sandbox.
Two governing principles (read before routing)
Principle 1 — Respect the client's sandbox (execution planes)
Every command runs on exactly one of three planes:
| Plane | What runs there | Rule |
|---|---|---|
| S — client sandbox (default) | reads, edits, searches, allowlisted commands | If it CAN run in the sandbox, it MUST run there |
| L — standard Linux environment | dev pipeline: builds, git, npm/pip, project work | Route here ONLY when Linux semantics are genuinely required |
| H — host system level | DISM features, restore points, registry, WSL install | ONLY with elevation + explicit user consent; batched into one elevated run |
If the client's sandbox blocks a Plane H/L command (e.g. wsl.exe on a
program blacklist): STOP. Never bypass — no alternate shell, no
encoded command, no copying binaries. Surface the block to the user and
offer the manual path. Full rules R1–R6, conflict analysis, and the
hand-off message template: load references/sandbox_coexistence.md.
Principle 2 — WSL is one Linux provider, not the only one
The user's goal is a standard Linux environment. WSL is the default
local provider (zero infrastructure), but an existing SSH remote VM
or dev container is an equally valid target. When detection reports
linuxProviders.hasNonWslProvider=true and WSL is absent, do NOT
install WSL by default — ask the user whether to keep the remote
provider or add local WSL. Provider selection rules P1–P5 and the
per-provider differences: load references/linux_environment_providers.md.
Intent recognition
Identify the intent from the user's message. Signals are examples, not
an exhaustive list — judge by meaning.
| Intent | Trigger signals (zh / en) |
|---|---|
INT-DETECT |
检查环境、能不能装 WSL、看看我的系统 / check my system, detect environment, can I run WSL; ALSO the default entry when host state is unknown |
INT-INSTALL |
安装/搭建 WSL、Windows 上装 Linux / install WSL, set up Linux on Windows |
INT-INIT |
在 WSL 里装开发工具、初始化 node/python / install dev tools in WSL; also the continuation after install/reboot |
INT-EXPLORER |
资源管理器打开 WSL 文件、桌面快捷方式、右键菜单 / Explorer shortcuts to WSL, right-click open in WSL |
INT-ADAPT |
让 IDE/AI 客户端/终端 用 WSL、连接 WSL 工作区、pipeline 迁到 Linux / configure client to use WSL, connect IDE to WSL workspace, move pipeline to Linux |
INT-ROLLBACK |
卸载、回滚、恢复原样 / rollback, uninstall this setup |
INT-REPAIR |
WSL 坏了、命令被拦截、状态不对 / wsl blocked, something is broken; or any unexpected detection result |
Judgment rules:
1. Explicit provider mention beats everything (rule P1): "用我的远程
服务器" → provider = SSH remote; adapt-only pipelines, skip install.
2. State unknown → INT-DETECT first. Detection is read-only and
cheap; never install on a guess.
3. Compound requests run in canonical order:
INT-DETECT → INT-INSTALL → INT-INIT → INT-EXPLORER → INT-ADAPT.
INT-ROLLBACK and INT-REPAIR are always standalone.
4. Ambiguous after detection → present the recommendation summary
and ask the user (Chinese). Never infer consent for Plane H.
Pipelines (routing table)
Each pipeline lists: steps → verification. Script details and decision
trees: references/agent_execution_guide.md.
P-DETECT (INT-DETECT)
- Run
scripts/detect_env.ps1(no admin) → parse the single JSON stdout. - Interpret with
references/detection_guide.md; honor
recommendation.wslQueryBlockedandproviderHint. - Report to the user in Chinese (template:
references/onboarding_flow.md).
Verify: valid JSON, schemaVersion present, recommendation fields populated.
P-INSTALL (INT-INSTALL) — Plane H, elevated
- Fresh detection (reuse if < 15 min old). Apply Principle 2 first:
ifproviderHintis set, ASK before installing. scripts/install_wsl.ps1 -DryRun→ review the plan JSON.scripts/install_wsl.ps1(elevated). IfneedsReboot=true: tell the
user in Chinese; steps auto-resume at next logon (or-Resume).- Re-run detection to confirm the state transition.
Verify: final JSON success=true; state.jsonl contains
distro-install succeeded; detection shows the distro.
P-INIT (INT-INIT) — Plane L
- Confirm the distro exists (detection or
wsl -l -q). Get-Content -Raw scripts/init_wsl_env.sh | wsl -d <distro> -- bash -s- Spot-check:
wsl -d <distro> -- bash -lc "node -v; python3 --version; git --version".
Verify: stdout JSON success=true; ~/.win-to-linux-dev/manifest.json exists.
P-EXPLORER (INT-EXPLORER)
scripts/create_explorer_shortcuts.ps1 -Distro <distro>.- Optionally open Explorer at the resolved
wslHomefor visual proof.
Verify: JSON shortcutsCreated > 0; wslHome non-empty.
P-ADAPT (INT-ADAPT)
- Choose provider (Principle 2, rule P1). WSL is the default; for an
explicit remote choice use-Provider ssh-remote -SshHost <host>or
-Provider devcontainer— the adapter then installs the matching
remote extension and skips all WSL-specific config. scripts/setup_ai_client.ps1 -Provider <provider> -Distro <distro>
(no admin). For the WSL provider this also generates a filled
WSL-Dev-<distro>.code-workspaceon the Desktop — hand it to the user
as the one-click IDE-to-WSL entry point (Chinese template:
references/onboarding_flow.md). The workspace-file template is
inlined in the adapter (no.code-workspaceasset is bundled, since
some platforms filter non-standard file types). Adapter internals:
references/ai_client_adapter.md.
Verify: stdout JSON provider matches the choice; adapter.json
records provider (rule P5); for WSL: IDE settings.json contains the
WSL terminal profile AND workspaceFile is non-null; CLI wrappers exist
for detected CLI clients.
P-ROLLBACK (INT-ROLLBACK) — Plane H where flagged
scripts/rollback.ps1 -DryRun→ show the plan JSON to the user.- On consent:
scripts/rollback.ps1 -SkipConfirmation
(-RemoveDistro/-RemoveWSLFeaturesONLY if the user explicitly
approved those destructive scopes).
Verify: JSON executed list; failed empty; re-run detection if a
distro was removed.
P-REPAIR (INT-REPAIR)
- Run detection; read
wsl.queryBlocked,blockedActionHint,
providerHint, plusstate.jsonlfor the last failed step. - Match the symptom in
references/troubleshooting.md; apply the fix
or hand off per Principle 1. - Re-run detection to confirm recovery.
Verify: symptom's acceptance check in the troubleshooting playbook.
Result verification contract
Applies to every pipeline — use these before declaring success:
1. stdout JSON: every script emits exactly ONE JSON document; check
success and any error code. Nothing else is on stdout.
2. Event stream: state.jsonl (Windows: %USERPROFILE%\.win-to-linux-dev\;
WSL: ~/.win-to-linux-dev/) — one JSON event per line
{ts, step, status, level, detail}; the last event for each step
must be succeeded or an explained skipped.
3. State re-probe: for state-changing pipelines, re-run
detect_env.ps1 and diff the relevant fields.
4. Language: report outcomes to the user in Chinese; keep all
machine-facing artifacts (JSON, logs, manifests) in English.
Troubleshooting (route first, details in references)
| Symptom | Route |
|---|---|
wslQueryBlocked=true / "blocked for security" / "Program Blacklist" |
Principle 1 rule R4: NEVER bypass; show blockedActionHint; hand off → references/sandbox_coexistence.md |
error=admin_required |
Re-run elevated; if the sandbox blocks elevation, hand off to the user |
needsReboot=true |
Tell user to reboot (Chinese template); auto-resume at logon or -Resume |
error=sudo_password_required |
User runs sudo -v inside WSL once, then re-run (idempotent) |
exit code 97 (wsl_runner) |
cwd unreachable in WSL → -TranslatePaths or a Linux path |
error=confirmation_required |
Show -DryRun plan, get consent, re-run with -SkipConfirmation |
unparseable IDE settings.json |
Original preserved at .bak-<timestamp>; review, then re-run adapter |
providerHint non-null |
Existing remote Linux provider — ask before installing WSL (Principle 2) |
| anything else | references/troubleshooting.md error-code table + recovery procedures |
Resource map
scripts/ — deterministic operations (execute, never reimplement)
| Script | Plane | Admin | One-liner |
|---|---|---|---|
scripts/detect_env.ps1 |
S | No | Read-only host probe → single JSON (schema 2.1), includes linuxProviders |
scripts/install_wsl.ps1 |
H | Yes | Atomic/reversible/resumable WSL+distro install; -DryRun, -Resume |
scripts/init_wsl_env.sh |
L | No | Idempotent dev-tool install inside WSL; PEP 668 aware; sudo -n preflight |
scripts/create_explorer_shortcuts.ps1 |
H(HKCU) | No | Desktop/Quick-Access/context-menu entries; resolves the real WSL home |
scripts/setup_ai_client.ps1 |
S/H(HKCU) | No | Provider-aware adapter: IDE settings/extensions, CLI wrappers, Terminal profile, workspace file; -Provider, -Remove reverses |
scripts/wsl_runner.ps1 |
L | No | Pipeline transfer: stdin-delivered bash execution, exit-code propagation |
scripts/rollback.ps1 |
H | Yes* | Full reversal; -DryRun then -SkipConfirmation (*only for feature disable) |
references/ — judgment support (load per route)
| Document | Load when |
|---|---|
references/sandbox_coexistence.md |
ANY sandbox signal (blocks, blacklists, approval prompts); before ANY Plane H escalation |
references/linux_environment_providers.md |
Provider choice unclear; providerHint set; user mentions remote VM/container/IDE remote |
references/agent_execution_guide.md |
Executing P-INSTALL/P-INIT — full decision trees and per-step detail |
references/detection_guide.md |
Interpreting detection JSON (field meanings, decision tree, schema changelog) |
references/compatibility_matrix.md |
Any version-specific question — Win10/11 capabilities, PowerShell 5.1/7.x strategy, logging contract |
references/ai_client_adapter.md |
P-ADAPT — per-client config mechanics, auth passthrough, IDE workspace/profile connection |
references/onboarding_flow.md |
Talking to the user — Chinese templates for before/during/after, file locations, reboot messaging |
references/troubleshooting.md |
P-REPAIR — full error-code table and recovery procedures |
references/wsl_architecture.md |
User asks WHY WSL 1 vs 2 (architecture, performance, interop) |
assets/ — templates handed to the user (never loaded into context)
| Asset | Use |
|---|---|
assets/wsl_bashrc_extras.sh |
Optional shell extras inside WSL (aliases, interop helpers) |
assets/windows_terminal_profile.json |
Windows Terminal profile template |
The IDE-to-WSL workspace-file template is inlined inside
setup_ai_client.ps1 (no .code-workspace asset is bundled, since some
platforms filter non-standard file types).