deepseek-coordination 0.1.1 → 0.1.2

package/README.md

@@ -572,7 +572,7 @@ by a **later** case.
 
 That defect is **fixed**: the parser case in `tests/golden.ps1` now creates its own fixture
 (`$fixtureDir = Join-Path $sandbox 'parser\verify'`, then `New-Item` and `Set-Content`) and asserts
-against it. The current measurement is **49 passed, 0 failed**.
+against it. The current measurement is **50 passed, 0 failed**.
 
 ### Two real POSIX defects found by `tests/smoke-desktop-sh.sh`
 
@@ -638,10 +638,19 @@ stand-in tools exposed both:
   no acceptance step depends on it. (The plugin's *installation* path does: the package manager
   resolves the repository with `git ls-remote`, so a machine where the harness cannot find `git` on
   `PATH` cannot install the bundle.)
+* **PowerShell 7.6 is exercised, but not across the whole surface.** The 7.6 artefact definitely runs:
+  driving the plugin's real `resolveInvocation` path with `DSH_OS_POWERSHELL_EDITION=7.6` selects
+  `bin/dsh-os7.ps1` and the runtime that answers is **PowerShell 7.6.6**, while the default stays on
+  5.1.19041.3031 — that is what `tools/verify-editions.mjs` asserts and what the 14 cases measured here
+  confirm. What has *not* been done is a run of every verb against `dsh-os7.ps1`; its fidelity as a port
+  rests on the identical 82-verb dispatch sets, a per-module function-name comparison and the window
+  group's golden cases. That is a real gap in the evidence, not a claim of full parity.
 
 ### What is not proven
 
-* That the DSH loader composes this bundle and makes `dsh_os` appear in an active session.
+* That the loader composes the bundle **by the contract `tools/verify-bundle.mjs` checks**, rather than
+  by a path that happens to work on this machine. The weaker claim — that `dsh_os` and the five
+  `os_permission_*` tools appear and are callable in an active session — has since been observed.
 * Complete verb parity between the two platforms — in neither direction.
 * The enforcement effect of layer A on a machine where the harness and the delegate share one identity
   — by construction that case degrades to layer B.
@@ -665,7 +674,7 @@ npm run test:all        # runs everything below, in order
 |---|---|---|---|
 | Table conformance | `powershell -File tests/conformance.ps1` | 5 | **5 passed, 0 failed** |
 | Encoding contracts | `powershell -File tests/encoding.ps1` | 32 build modules | **all contracts hold** |
-| Windows golden | `powershell -File tests/golden.ps1` | 49 | **49 passed, 0 failed** |
+| Windows golden | `powershell -File tests/golden.ps1` | 50 | **50 passed, 0 failed** |
 | POSIX golden | `bash tests/golden-sh.sh` | 116 | **116 passed, 0 failed** |
 | POSIX desktop injection | `bash tests/smoke-desktop-sh.sh` | 52 | **52 passed, 0 failed** |
 | Plugin | `node tests/plugin.test.mjs` | 13 | **13 passed, 0 failed** |

package/README.zh-CN.md

@@ -410,7 +410,7 @@ bundle 解析校验把包以 junction 链接进一个一次性的 profile 沙箱
 
 此处曾记录：在干净检出上实测 `passed: 47 failed: 1`，失败用例是 `parser/one-two-three-token-verbs`，因为它断言 `file length` 作用于一个由**更晚**的用例才创建的夹具目录。
 
-该缺陷**已修复**：`tests/golden.ps1` 的解析器用例现在自己创建夹具（`$fixtureDir = Join-Path $sandbox 'parser\verify'`，随后 `New-Item` 与 `Set-Content`），再对其断言。当前实测为 **49 通过，0 失败**。
+该缺陷**已修复**：`tests/golden.ps1` 的解析器用例现在自己创建夹具（`$fixtureDir = Join-Path $sandbox 'parser\verify'`，随后 `New-Item` 与 `Set-Content`），再对其断言。当前实测为 **50 通过，0 失败**。
 
 ### `tests/smoke-desktop-sh.sh` 查出的两个 POSIX 真实缺陷
 
@@ -457,7 +457,7 @@ npm run test:all        # 按顺序跑下面全部
 |---|---|---|---|
 | 两表一致性 | `powershell -File tests/conformance.ps1` | 5 | **5 通过，0 失败** |
 | 编码契约 | `powershell -File tests/encoding.ps1` | 32 个构建模块 | **全部契约成立** |
-| Windows 黄金 | `powershell -File tests/golden.ps1` | 49 | **49 通过，0 失败** |
+| Windows 黄金 | `powershell -File tests/golden.ps1` | 50 | **50 通过，0 失败** |
 | POSIX 黄金 | `bash tests/golden-sh.sh` | 116 | **116 通过，0 失败** |
 | POSIX 桌面注入 | `bash tests/smoke-desktop-sh.sh` | 52 | **52 通过，0 失败** |
 | 插件 | `node tests/plugin.test.mjs` | 13 | **13 通过，0 失败** |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepseek-coordination",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": false,
   "type": "module",
   "description": "Cross-platform atomic OS-interaction surface for the DeepSeek Harness: one argument-stable verb set implemented natively on each OS, with byte-exact charset, BOM and line-ending handling.",
@@ -65,6 +65,8 @@
     "src/host/docs/command-original.txt",
     "cordis.patch.yml",
     "src/plugin/index.js",
+    "src/plugin/invoke.js",
+    "src/plugin/takeover.js",
     "src/permission/index.js",
     "README.md"
   ],

package/src/host/bin/dsh-os.ps1

@@ -3159,7 +3159,16 @@ function Invoke-PermissionList {
   return [ordered]@{
     path = $state.path
     exists = $state.exists
-    empty = $(if ($null -ne $state.empty) { $state.empty } else { $false })
+    # Read through PSObject.Properties, NOT as $state.empty.
+    #
+    # Under Set-StrictMode -Version Latest, READING a property that does not exist THROWS, so
+    #     if ($null -ne $state.empty) { ... }        # the test IS the throwing read
+    # is not a guard. A caller whose permission.json does not exist got
+    #     E_INTERNAL  The property 'empty' cannot be found on this object
+    # because one path returns a state without an `empty` key. PSObject.Properties is a dictionary
+    # lookup, so a missing name is simply absent and does not throw. Same fix as the 7.6 module, and
+    # the same idiom already used below for $state.document.PSObject.Properties['rules'].
+    empty = $(if ($null -ne $state.PSObject.Properties['empty']) { [bool]$state.empty } else { $false })
     trusted = $state.trusted
     count = $items.Count
     rules = $items.ToArray()

package/src/host/bin/dsh-os7.ps1

@@ -3512,7 +3512,22 @@ function Invoke-PermissionList {
   return [ordered]@{
     path = $state.path
     exists = $state.exists
-    empty = ($state.empty ?? $false)
+    # Read through PSObject.Properties, NOT as $state.empty.
+    #
+    # Under Set-StrictMode -Version Latest, READING a property that does not exist THROWS. So the obvious
+    # guard is not a guard at all:
+    #     empty = ($state.empty ?? $false)          # throws before ?? can help
+    # and neither is testing it first, because the test itself is the throwing read. That is exactly how
+    # this shipped broken: `permission list` returned
+    #     E_INTERNAL  The property 'empty' cannot be found on this object
+    # for every caller whose permission.json did not exist - which is every fresh install, because the
+    # package ships no permission.json. It worked in the repository, where the file is present, so no
+    # test here could see it.
+    #
+    # PSObject.Properties is a dictionary lookup rather than a property read, so a missing name is simply
+    # absent and returns $false without throwing. This is the same idiom already used above for
+    # `$doc.PSObject.Properties['updatedBy']`.
+    empty = $(if ($null -ne $state.PSObject.Properties['empty']) { [bool]$state.empty } else { $false })
     trusted = $state.trusted
     count = $items.Count
     rules = $items.ToArray()

package/src/plugin/index.js

@@ -18,224 +18,15 @@
  * core reason this surface exists.
  */
 
-import { spawn, spawnSync } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
+
+import { resolveInvocation, runScript, searchedDirectory } from './invoke.js'
 
 export const name = 'dsh-os'
 
 /** The plugin is inert without the tool registry. */
 export const inject = ['tools']
 
-/**
- * Whether a command can be started at all.
- *
- * Used only by the 'auto' edition choice, to decide between the two PowerShell artefacts. It asks the
- * command itself rather than searching PATH by hand, so a shim, an alias-resolved path and a
- * .exe-extension lookup on Windows all behave the way an actual spawn would. A failure to start is the
- * answer being sought, so any error means "not available" and never propagates.
- */
-function executableAvailable(command) {
-  try {
-    const probe = spawnSync(command, ['-NoLogo', '-NoProfile', '-Command', 'exit 0'], {
-      stdio: 'ignore',
-      timeout: 10000,
-      windowsHide: true,
-    })
-    return probe.error === undefined && probe.status === 0
-  } catch {
-    return false
-  }
-}
-
-/**
- * Find a PowerShell 7 executable.
- *
- * 'pwsh' alone is not enough. Installing PowerShell 7 does NOT put it on PATH for every process, and
- * in this very repository's own environment it is at the standard install location while `spawn pwsh`
- * fails with ENOENT. Requiring a PATH entry would therefore make the 7.6 artefact unreachable on a
- * machine where it is plainly installed, which is exactly the bug this selection was added to fix.
- *
- * So the search is: an explicit DSH_OS_POWERSHELL, then PATH, then the two standard install locations.
- * The first entry that starts wins, and null means 7.x is genuinely not available here.
- */
-function findPowerShell7() {
-  const explicit = process.env.DSH_OS_POWERSHELL
-  if (explicit) return executableAvailable(explicit) ? explicit : null
-
-  const candidates = ['pwsh']
-  if (process.platform === 'win32') {
-    const programFiles = process.env.ProgramFiles ?? 'C:\\Program Files'
-    const programFilesX86 = process.env['ProgramFiles(x86)']
-    const localAppData = process.env.LOCALAPPDATA
-    candidates.push(join(programFiles, 'PowerShell', '7', 'pwsh.exe'))
-    if (programFilesX86) candidates.push(join(programFilesX86, 'PowerShell', '7', 'pwsh.exe'))
-    if (localAppData) candidates.push(join(localAppData, 'Microsoft', 'PowerShell', '7', 'pwsh.exe'))
-  } else {
-    candidates.push('/usr/bin/pwsh', '/usr/local/bin/pwsh', '/opt/microsoft/powershell/7/pwsh')
-  }
-
-  for (const candidate of candidates) {
-    // A bare name is left to PATH resolution; an absolute path is checked for existence first so the
-    // probe does not pay for a spawn that cannot succeed.
-    if (candidate.includes('\\') || candidate.includes('/')) {
-      if (!existsSync(candidate)) continue
-    }
-    if (executableAvailable(candidate)) return candidate
-  }
-  return null
-}
-
-// src/plugin/index.js -> package root, which is THREE levels up from the file:
-//   file          <pkg>/src/plugin/index.js
-//   dirname       <pkg>/src/plugin
-//   dirname       <pkg>/src
-//   dirname       <pkg>            <- what the scripts are joined against
-// Getting this off by one is invisible until runtime, where it reports "no entry point" while the
-// file is present; tests/plugin.test.mjs pins it.
-const PKG_ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))))
-
-/**
- * Resolve how to invoke the implementation.
- *
- * Returns { command, prefix } where the final argv is [...prefix, ...verbArguments].
- *
- * A .bat cannot be executed directly: cmd.exe interprets it, so spawning it with shell:false fails
- * with EINVAL on Windows. The .ps1 is therefore preferred and launched through powershell.exe, which
- * is an executable and keeps the call shell-free. The .bat shim exists for a human at a cmd prompt,
- * not for this plugin. A .sh is executed by bash for the same reason: the script need not be marked
- * executable in the checkout for the plugin to work.
- *
- * TWO PowerShell artefacts exist and BOTH are selectable:
- *
- *   bin/dsh-os.ps1   built from src/host/lib/powershell5.1, run by powershell.exe   (Windows PowerShell 5.1)
- *   bin/dsh-os7.ps1  built from src/host/lib/powershell7.6, run by pwsh             (PowerShell 7)
- *
- * The 7.6 artefact was unreachable from here for a while: it existed, was built and was tested, but this
- * function only ever looked for dsh-os.ps1. The default is unchanged at 5.1 so a deployment that is
- * already working cannot change behaviour underneath itself; `powershellEdition: '7.6'` or `'auto'`
- * selects the other one, and DSH_OS_POWERSHELL still overrides the executable. `'auto'` uses 7.6 only
- * when both the artefact and a pwsh executable are present, and falls back to 5.1 otherwise.
- */
-function resolveInvocation(config) {
-  const explicit = config.scriptPath ? [config.scriptPath] : []
-  const dir = config.scriptPath
-    ? dirname(config.scriptPath)
-    : join(PKG_ROOT, config.scriptDir ?? 'src/host/bin')
-
-  // The edition may come from config or the environment; config wins because it is the more specific
-  // statement, and the environment is there for a deployment that cannot edit the profile.
-  const edition = String(config.powershellEdition ?? process.env.DSH_OS_POWERSHELL_EDITION ?? '5.1').toLowerCase()
-
-  const ps51 = { file: 'dsh-os.ps1', command: 'powershell.exe', edition: '5.1' }
-  const ps7 = { file: 'dsh-os7.ps1', command: 'pwsh', edition: '7.6' }
-
-  // The PowerShell 7 executable is located once, because the search probes processes and must not run
-  // per candidate.
-  const ps7Command = process.platform === 'win32' ? findPowerShell7() : null
-
-  // Build the candidate list for this platform. An explicit scriptPath disables the edition choice
-  // entirely: the caller has named a file, so that file is what runs.
-  let powershellCandidates = []
-  if (process.platform === 'win32') {
-    if (edition === '7.6' || edition === '7') {
-      powershellCandidates = ps7Command ? [{ ...ps7, command: ps7Command }, ps51] : [ps51]
-    } else if (edition === 'auto') {
-      const ps7Ready = ps7Command !== null && existsSync(join(dir, ps7.file))
-      powershellCandidates = ps7Ready ? [{ ...ps7, command: ps7Command }, ps51] : [ps51, ps7]
-    } else {
-      powershellCandidates = [ps51, ps7]
-    }
-  }
-
-  const candidates = explicit.concat(process.platform === 'win32'
-    ? powershellCandidates.map((c) => join(dir, c.file))
-    : [join(dir, 'dsh-os.sh')])
-
-  for (const candidate of candidates) {
-    if (!existsSync(candidate)) continue
-    if (candidate.toLowerCase().endsWith('.ps1')) {
-      // The edition is derived from the FILE that was found, not from the request, because the request
-      // may have named the other one and a fallback happened.
-      const chosen = powershellCandidates.find((c) => join(dir, c.file) === candidate)
-      const isSeven = chosen ? chosen.edition === '7.6' : false
-      // -ExecutionPolicy is a Windows PowerShell option. pwsh accepts it on Windows but not everywhere,
-      // so it is only passed to the 5.1 executable. The resolved command is used, not the literal name,
-      // because a located pwsh is an absolute path.
-      const base = ['-NoLogo', '-NoProfile', '-NonInteractive']
-      return {
-        script: candidate,
-        command: process.env.DSH_OS_POWERSHELL ?? (chosen ? chosen.command : ps51.command),
-        // -File passes the script and its arguments as separate argv entries. -Command would make
-        // PowerShell re-parse a single string, which is exactly the quoting layer this surface avoids.
-        prefix: isSeven
-          ? [...base, '-File', candidate]
-          : [...base, '-ExecutionPolicy', 'Bypass', '-File', candidate],
-        edition: chosen ? chosen.edition : '5.1',
-      }
-    }
-    if (candidate.toLowerCase().endsWith('.sh')) {
-      return {
-        script: candidate,
-        command: '/bin/bash',
-        prefix: [candidate],
-      }
-    }
-    if (candidate.toLowerCase().endsWith('.bat')) {
-      // Only reachable when a caller explicitly configures a .bat; cmd.exe must interpret it.
-      return {
-        script: candidate,
-        command: process.env.ComSpec ?? 'cmd.exe',
-        prefix: ['/d', '/c', candidate],
-      }
-    }
-  }
-  return null
-}
-
-/**
- * Run the script with an argv array and capture stdout/stderr as bytes.
- *
- * Streams are read to completion rather than awaited one at a time: reading one pipe fully before the
- * other deadlocks as soon as the unread pipe fills.
- */
-function runScript(invocation, verbArgs, timeoutMs, signal) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(invocation.command, [...invocation.prefix, ...verbArgs], {
-      windowsHide: true,
-      // No shell. The argv array is passed through as-is.
-      shell: false,
-    })
-    const out = []
-    const err = []
-    let timedOut = false
-    const timer = setTimeout(() => {
-      timedOut = true
-      try { child.kill() } catch { /* already gone */ }
-    }, timeoutMs)
-    const onAbort = () => { try { child.kill() } catch { /* already gone */ } }
-    if (signal) signal.addEventListener('abort', onAbort, { once: true })
-    child.stdout.on('data', (c) => out.push(c))
-    child.stderr.on('data', (c) => err.push(c))
-    child.on('error', (e) => {
-      clearTimeout(timer)
-      if (signal) signal.removeEventListener('abort', onAbort)
-      reject(e)
-    })
-    child.on('close', (code) => {
-      clearTimeout(timer)
-      if (signal) signal.removeEventListener('abort', onAbort)
-      resolve({
-        code,
-        timedOut,
-        stdout: Buffer.concat(out).toString('utf8'),
-        stderr: Buffer.concat(err).toString('utf8'),
-      })
-    })
-  })
-}
-
 export function apply(ctx, config = {}) {
   const timeoutMs = config.timeoutMs ?? 120000
 
@@ -289,7 +80,7 @@ export function apply(ctx, config = {}) {
         // The message names the directory that was actually searched, because the first version of
         // this code reported a plausible-looking path that was one level off and cost a debugging
         // round to find.
-        const searched = config.scriptPath ?? join(PKG_ROOT, config.scriptDir ?? 'src/host/bin')
+        const searched = searchedDirectory(config)
         throw new Error(
           `dsh-os has no entry point for platform "${process.platform}"; searched ${searched}` +
           ' (run tools/build.ps1 to generate it, or set the scriptPath config)',

package/src/plugin/invoke.js

@@ -0,0 +1,301 @@
+/**
+ * Shared invocation layer for the dsh-os entry points.
+ *
+ * Three consumers need to run a verb and get its envelope back:
+ *   * `src/plugin/index.js`  the model-facing `dsh_os` tool;
+ *   * `src/plugin/takeover.js` the `tools/execute` interception that forwards the built-in
+ *     `read`/`write`/`edit`/`pwsh` calls onto dsh-os verbs;
+ *   * `src/plugin/settings.js` the settings service the client panel drives, which probes
+ *     `selfcheck` and reads `permission list`.
+ *
+ * The resolution rules below (which artefact, which executable, which argv prefix) were originally
+ * inline in the tool plugin. They are extracted rather than copied because a second copy would drift:
+ * the 7.6 artefact was unreachable for a while precisely because one place knew about two files and
+ * another place did not.
+ *
+ * Nothing here writes anything. Every export is a pure read of the environment plus a spawn.
+ */
+
+import { spawn, spawnSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Whether a command can be started at all.
+ *
+ * Used only by the 'auto' edition choice, to decide between the two PowerShell artefacts. It asks the
+ * command itself rather than searching PATH by hand, so a shim, an alias-resolved path and a
+ * .exe-extension lookup on Windows all behave the way an actual spawn would. A failure to start is the
+ * answer being sought, so any error means "not available" and never propagates.
+ */
+export function executableAvailable(command) {
+  try {
+    const probe = spawnSync(command, ['-NoLogo', '-NoProfile', '-Command', 'exit 0'], {
+      stdio: 'ignore',
+      timeout: 10000,
+      windowsHide: true,
+    })
+    return probe.error === undefined && probe.status === 0
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Find a PowerShell 7 executable.
+ *
+ * 'pwsh' alone is not enough. Installing PowerShell 7 does NOT put it on PATH for every process, and
+ * in this repository's own environment it is at the standard install location while `spawn pwsh`
+ * fails with ENOENT. Requiring a PATH entry would therefore make the 7.6 artefact unreachable on a
+ * machine where it is plainly installed, which is exactly the bug this selection was added to fix.
+ *
+ * So the search is: an explicit DSH_OS_POWERSHELL, then PATH, then the two standard install locations.
+ * The first entry that starts wins, and null means 7.x is genuinely not available here.
+ */
+export function findPowerShell7() {
+  const explicit = process.env.DSH_OS_POWERSHELL
+  if (explicit) return executableAvailable(explicit) ? explicit : null
+
+  const candidates = ['pwsh']
+  if (process.platform === 'win32') {
+    const programFiles = process.env.ProgramFiles ?? 'C:\\Program Files'
+    const programFilesX86 = process.env['ProgramFiles(x86)']
+    const localAppData = process.env.LOCALAPPDATA
+    candidates.push(join(programFiles, 'PowerShell', '7', 'pwsh.exe'))
+    if (programFilesX86) candidates.push(join(programFilesX86, 'PowerShell', '7', 'pwsh.exe'))
+    if (localAppData) candidates.push(join(localAppData, 'Microsoft', 'PowerShell', '7', 'pwsh.exe'))
+  } else {
+    candidates.push('/usr/bin/pwsh', '/usr/local/bin/pwsh', '/opt/microsoft/powershell/7/pwsh')
+  }
+
+  for (const candidate of candidates) {
+    // A bare name is left to PATH resolution; an absolute path is checked for existence first so the
+    // probe does not pay for a spawn that cannot succeed.
+    if (candidate.includes('\\') || candidate.includes('/')) {
+      if (!existsSync(candidate)) continue
+    }
+    if (executableAvailable(candidate)) return candidate
+  }
+  return null
+}
+
+// src/plugin/invoke.js -> package root, which is THREE levels up from the file:
+//   file          <pkg>/src/plugin/invoke.js
+//   dirname       <pkg>/src/plugin
+//   dirname       <pkg>/src
+//   dirname       <pkg>            <- what the scripts are joined against
+// Getting this off by one is invisible until runtime, where it reports "no entry point" while the
+// file is present; tests/plugin.test.mjs pins it.
+export const PKG_ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))))
+
+/** Where the implementation lives inside the package, unless a caller overrides it. */
+export const DEFAULT_SCRIPT_DIR = 'src/host/bin'
+
+/**
+ * Resolve how to invoke the implementation.
+ *
+ * Returns { command, prefix, script, edition } where the final argv is [...prefix, ...verbArguments].
+ *
+ * A .bat cannot be executed directly: cmd.exe interprets it, so spawning it with shell:false fails
+ * with EINVAL on Windows. The .ps1 is therefore preferred and launched through powershell.exe, which
+ * is an executable and keeps the call shell-free. The .bat shim exists for a human at a cmd prompt,
+ * not for this plugin. A .sh is executed by bash for the same reason: the script need not be marked
+ * executable in the checkout for the plugin to work.
+ *
+ * TWO PowerShell artefacts exist and BOTH are selectable:
+ *
+ *   bin/dsh-os.ps1   built from src/host/lib/powershell5.1, run by powershell.exe   (Windows PowerShell 5.1)
+ *   bin/dsh-os7.ps1  built from src/host/lib/powershell7.6, run by pwsh             (PowerShell 7)
+ *
+ * The default is unchanged at 5.1 so a deployment that is already working cannot change behaviour
+ * underneath itself; `powershellEdition: '7.6'` or `'auto'` selects the other one, and
+ * DSH_OS_POWERSHELL still overrides the executable. `'auto'` uses 7.6 only when both the artefact and
+ * a pwsh executable are present, and falls back to 5.1 otherwise.
+ */
+export function resolveInvocation(config = {}) {
+  const explicit = config.scriptPath ? [config.scriptPath] : []
+  const dir = config.scriptPath
+    ? dirname(config.scriptPath)
+    : join(PKG_ROOT, config.scriptDir ?? DEFAULT_SCRIPT_DIR)
+
+  // The edition may come from config or the environment; config wins because it is the more specific
+  // statement, and the environment is there for a deployment that cannot edit the profile.
+  const edition = String(config.powershellEdition ?? process.env.DSH_OS_POWERSHELL_EDITION ?? '5.1').toLowerCase()
+
+  const ps51 = { file: 'dsh-os.ps1', command: 'powershell.exe', edition: '5.1' }
+  const ps7 = { file: 'dsh-os7.ps1', command: 'pwsh', edition: '7.6' }
+
+  // The PowerShell 7 executable is located once, because the search probes processes and must not run
+  // per candidate.
+  const ps7Command = process.platform === 'win32' ? findPowerShell7() : null
+
+  // Build the candidate list for this platform. An explicit scriptPath disables the edition choice
+  // entirely: the caller has named a file, so that file is what runs.
+  let powershellCandidates = []
+  if (process.platform === 'win32') {
+    if (edition === '7.6' || edition === '7') {
+      powershellCandidates = ps7Command ? [{ ...ps7, command: ps7Command }, ps51] : [ps51]
+    } else if (edition === 'auto') {
+      const ps7Ready = ps7Command !== null && existsSync(join(dir, ps7.file))
+      powershellCandidates = ps7Ready ? [{ ...ps7, command: ps7Command }, ps51] : [ps51, ps7]
+    } else {
+      powershellCandidates = [ps51, ps7]
+    }
+  }
+
+  const candidates = explicit.concat(process.platform === 'win32'
+    ? powershellCandidates.map((c) => join(dir, c.file))
+    : [join(dir, 'dsh-os.sh')])
+
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue
+    if (candidate.toLowerCase().endsWith('.ps1')) {
+      // The edition is derived from the FILE that was found, not from the request, because the request
+      // may have named the other one and a fallback happened.
+      const chosen = powershellCandidates.find((c) => join(dir, c.file) === candidate)
+      const isSeven = chosen ? chosen.edition === '7.6' : false
+      // -ExecutionPolicy is a Windows PowerShell option. pwsh accepts it on Windows but not everywhere,
+      // so it is only passed to the 5.1 executable. The resolved command is used, not the literal name,
+      // because a located pwsh is an absolute path.
+      const base = ['-NoLogo', '-NoProfile', '-NonInteractive']
+      return {
+        script: candidate,
+        command: process.env.DSH_OS_POWERSHELL ?? (chosen ? chosen.command : ps51.command),
+        // -File passes the script and its arguments as separate argv entries. -Command would make
+        // PowerShell re-parse a single string, which is exactly the quoting layer this surface avoids.
+        prefix: isSeven
+          ? [...base, '-File', candidate]
+          : [...base, '-ExecutionPolicy', 'Bypass', '-File', candidate],
+        edition: chosen ? chosen.edition : '5.1',
+      }
+    }
+    if (candidate.toLowerCase().endsWith('.sh')) {
+      return {
+        script: candidate,
+        command: '/bin/bash',
+        prefix: [candidate],
+        edition: 'posix',
+      }
+    }
+    if (candidate.toLowerCase().endsWith('.bat')) {
+      // Only reachable when a caller explicitly configures a .bat; cmd.exe must interpret it.
+      return {
+        script: candidate,
+        command: process.env.ComSpec ?? 'cmd.exe',
+        prefix: ['/d', '/c', candidate],
+        edition: 'bat',
+      }
+    }
+  }
+  return null
+}
+
+/** The directory an invocation would search, for error messages that name a real path. */
+export function searchedDirectory(config = {}) {
+  return config.scriptPath ?? join(PKG_ROOT, config.scriptDir ?? DEFAULT_SCRIPT_DIR)
+}
+
+/**
+ * Run the script with an argv array and capture stdout/stderr as bytes.
+ *
+ * Streams are read to completion rather than awaited one at a time: reading one pipe fully before the
+ * other deadlocks as soon as the unread pipe fills.
+ */
+export function runScript(invocation, verbArgs, timeoutMs = 120000, signal) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(invocation.command, [...invocation.prefix, ...verbArgs], {
+      windowsHide: true,
+      // No shell. The argv array is passed through as-is.
+      shell: false,
+    })
+    const out = []
+    const err = []
+    let timedOut = false
+    const timer = setTimeout(() => {
+      timedOut = true
+      try { child.kill() } catch { /* already gone */ }
+    }, timeoutMs)
+    const onAbort = () => { try { child.kill() } catch { /* already gone */ } }
+    if (signal) signal.addEventListener('abort', onAbort, { once: true })
+    child.stdout.on('data', (c) => out.push(c))
+    child.stderr.on('data', (c) => err.push(c))
+    child.on('error', (e) => {
+      clearTimeout(timer)
+      if (signal) signal.removeEventListener('abort', onAbort)
+      reject(e)
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      if (signal) signal.removeEventListener('abort', onAbort)
+      resolve({
+        code,
+        timedOut,
+        stdout: Buffer.concat(out).toString('utf8'),
+        stderr: Buffer.concat(err).toString('utf8'),
+      })
+    })
+  })
+}
+
+/**
+ * Run one verb and return its parsed envelope.
+ *
+ * The envelope is the contract, so it is parsed here once: `ok` decides the branch and `error.code`
+ * is authoritative, never `error.message`. A caller that needs the raw text uses `runVerb` instead.
+ *
+ * `options.allow` appends `--allow`, which is what every mutating verb requires. It is only ever set
+ * by a caller that has already resolved authorization: this function does not decide anything.
+ */
+export async function invokeVerb(invocation, verb, args = [], flags = [], options = {}) {
+  const verbArgs = [...String(verb).trim().split(/\s+/)]
+  for (const value of args) verbArgs.push(String(value))
+  for (const flag of flags) verbArgs.push(String(flag))
+  if (options.allow === true) verbArgs.push('--allow')
+
+  const result = await runScript(invocation, verbArgs, options.timeoutMs ?? 120000, options.signal)
+
+  if (result.timedOut) {
+    const error = new Error(`dsh-os verb "${verb}" timed out after ${options.timeoutMs ?? 120000}ms`)
+    error.code = 'E_TIMEOUT'
+    throw error
+  }
+  const text = result.stdout.trim()
+  if (text === '') {
+    const error = new Error(
+      `dsh-os verb "${verb}" produced no envelope (exit ${result.code})` +
+      (result.stderr.trim() ? `: ${result.stderr.trim()}` : ''),
+    )
+    error.code = 'E_NO_ENVELOPE'
+    error.stderr = result.stderr
+    throw error
+  }
+  let envelope
+  try {
+    envelope = JSON.parse(text)
+  } catch (cause) {
+    const error = new Error(`dsh-os verb "${verb}" emitted a non-JSON envelope: ${text.slice(0, 200)}`)
+    error.code = 'E_ENVELOPE_MALFORMED'
+    error.cause = cause
+    throw error
+  }
+  return { envelope, exitCode: result.code, stderr: result.stderr }
+}
+
+/**
+ * Run one verb and return only `result`, throwing a typed error for a failed envelope.
+ *
+ * The thrown error carries `code` from the envelope, so a caller branches on the same vocabulary it
+ * would have branched on in a shell, while the message stays human-readable for the tool result.
+ */
+export async function invokeForResult(invocation, verb, args = [], flags = [], options = {}) {
+  const { envelope, stderr } = await invokeVerb(invocation, verb, args, flags, options)
+  if (envelope.ok === true) return envelope.result
+  const code = envelope.error?.code ?? 'E_INTERNAL'
+  const error = new Error(envelope.error?.message ?? `dsh-os verb "${verb}" failed`)
+  error.code = code
+  error.hint = envelope.error?.hint
+  error.verb = envelope.verb ?? verb
+  error.stderr = stderr
+  throw error
+}

package/src/plugin/takeover.js

@@ -0,0 +1,392 @@
+/**
+ * dsh-os takeover: route the built-in file and shell tools onto dsh-os verbs.
+ *
+ * WHY THIS IS A SEPARATE PLUGIN ROW
+ *
+ * `dsh_os` is a tool the model has to be *told* to use. In practice it never is: the built-in
+ * `read`/`write`/`edit`/`pwsh` tools are right there, they overlap almost completely, and nothing in
+ * the prompt prefers one over the other. The result is that the byte-level guarantees this project
+ * exists for are never exercised — the plugin is installed and imperceptible.
+ *
+ * This row removes the choice. When a user enables takeover in the settings panel, the built-in calls
+ * are intercepted and answered by the same machinery, so the guarantees apply whether or not the model
+ * cooperates.
+ *
+ * WHY `tools/execute` AND NOT A SHADOWING REGISTRATION
+ *
+ * `@deepseek-ai/dsh-tools` lets a scoped registration shadow a global tool, which looks like the
+ * obvious mechanism. It does not work here. The Web/desktop composition disables the host-side
+ * `tool-fs`/`tool-pwsh` rows and remounts them inside every agent *preset* (`dsh-web-app`'s patch),
+ * so the built-ins live in a scope layer that is NEARER than any global registration this plugin could
+ * make — the preset would shadow us, not the other way round.
+ *
+ * `tools/execute` (dsh-tools `dispatchScheduledExecution`) is the around-dispatch waterfall:
+ *
+ *     ctx.waterfall(carrier, "tools/execute", mutableExec, () => this.dispatchToolBody(mutableExec))
+ *
+ * A handler that returns `{ value }` without calling `next()` replaces the tool body's value. The
+ * value is then validated against the BUILT-IN tool's own `output.schema` and rendered by the BUILT-IN
+ * `output.render` (`normalizeDispatchResult` -> `createSuccessResult`), so the model-facing text, the
+ * diff cards and the presentation metadata stay exactly what they were: the only thing that changes is
+ * where the bytes came from.
+ *
+ * WHAT IS DELIBERATELY NOT TAKEN OVER
+ *
+ *   * `glob` and `grep` stay built-in. dsh-os has no content-search verb at all, and `file search`
+ *     matches names rather than contents, so forwarding them would silently lose results.
+ *   * `run_in_background` command calls stay built-in: the built-in result for a background call is a
+ *     job id from the harness job system, and dsh-os's `--background` starts an unrelated process with
+ *     a pid. Claiming otherwise would hand the model a handle it cannot collect.
+ *   * Relative paths are not intercepted. The built-in `read`/`write`/`edit` resolve against the
+ *     session's workspace root through `ctx.fs`; an interception that used the process working
+ *     directory instead would silently read a different file. Interception requires an absolute path.
+ *   * `sandbox_permissions` escalation is not honoured. The built-in body asks `ctx.approval` for a
+ *     wider sandbox before touching the file; a redirected call runs the verb directly, so the file
+ *     sandbox is not what bounds it — dsh-os's own protected-path check is. This is a real reduction
+ *     in defence and is documented in README.md rather than hidden.
+ *
+ * FALLBACK IS THE CONTRACT
+ *
+ * Every interception is wrapped: anything unexpected — a verb this build does not have, an encoding
+ * dsh-os refuses, a malformed path — calls `next()` and lets the built-in tool do the work. Takeover
+ * can therefore only ever change HOW a call is answered, never whether it is answered. A model that
+ * cannot see the difference is the point.
+ */
+
+import { randomBytes } from 'node:crypto'
+import { existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { basename, dirname, isAbsolute, join } from 'node:path'
+
+import { invokeForResult, resolveInvocation } from './invoke.js'
+
+export const name = 'dsh-os-takeover'
+
+/** The interception needs the tool pipeline, and the switch lives in the settings service. */
+export const inject = ['tools', 'dsh-os-settings']
+
+/**
+ * Tools this row knows how to answer.
+ *
+ * The order is also the order the settings panel presents them in. Leaving a tool out is a supported
+ * configuration, not a degraded one: with `read` off, reads are the built-in implementation and writes
+ * still go through dsh-os.
+ */
+export const TAKEOVER_TOOLS = ['read', 'write', 'edit', 'pwsh']
+
+/** Defaults matching the "follow the built-in, preserve the target" policy chosen for this feature. */
+export const DEFAULT_CONFIG = {
+  read: true,
+  write: true,
+  edit: true,
+  pwsh: true,
+}
+
+// ---------------------------------------------------------------------------
+// target format detection
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the byte-level facts the built-in tools do not preserve.
+ *
+ * The built-in `write` always emits UTF-8 with no BOM and LF line endings. Rewriting a file that had a
+ * BOM or CRLF therefore produces a whole-file diff and can break a script that depended on the
+ * convention. Which of the two the target already had is only knowable from its bytes, so they are
+ * read here rather than guessed.
+ *
+ * A file that does not exist yields the built-in defaults, which is what makes a newly created file
+ * behave exactly as it did before takeover was enabled.
+ */
+export function readTargetFormat(path) {
+  let bytes
+  try {
+    bytes = readFileSync(path)
+  } catch {
+    return { exists: false, bom: false, eol: 'lf' }
+  }
+  const bom = bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf
+  let crlf = 0
+  let lf = 0
+  for (let index = 0; index < bytes.length; index += 1) {
+    if (bytes[index] !== 0x0a) continue
+    if (index > 0 && bytes[index - 1] === 0x0d) crlf += 1
+    else lf += 1
+  }
+  // A file with no line ending at all is treated as LF, which is the built-in default and therefore
+  // changes nothing about how it will be written.
+  const eol = crlf > lf ? 'crlf' : 'lf'
+  return { exists: true, bom, eol }
+}
+
+/** Decode a text file's bytes the way the built-in `read` does: BOM stripped, CRLF normalised to LF. */
+export function decodeTextFile(bytes) {
+  const hasBom = bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf
+  const body = hasBom ? bytes.subarray(3) : bytes
+  return body.toString('utf8').replace(/\r\n/g, '\n')
+}
+
+/** Encode text back into a target's convention, so the write preserves what was already there. */
+export function encodeTextForTarget(text, format) {
+  const body = format.eol === 'crlf' ? text.replace(/\r\n/g, '\n').replace(/\n/g, '\r\n') : text.replace(/\r\n/g, '\n')
+  const payload = Buffer.from(body, 'utf8')
+  if (!format.bom) return payload
+  return Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), payload])
+}
+
+/**
+ * Replace a file's bytes atomically.
+ *
+ * Same-directory temporary file then `rename`, which is the same shape dsh-os's own `Write-Atomic`
+ * uses. A cross-volume rename would not be atomic, and this is never one: the temporary file is a
+ * sibling of its target by construction.
+ *
+ * The temporary name is random rather than sequential so two concurrent interceptions of the same
+ * path cannot collide, and it is removed on any failure so a failed write leaves no debris behind.
+ */
+export function writeFileAtomic(path, bytes) {
+  const temporary = join(dirname(path), `.${basename(path)}.dsh-os-${randomBytes(6).toString('hex')}.tmp`)
+  try {
+    writeFileSync(temporary, bytes)
+    renameSync(temporary, path)
+  } catch (error) {
+    try { rmSync(temporary, { force: true }) } catch { /* the failure that matters is the original */ }
+    throw error
+  }
+}
+
+// ---------------------------------------------------------------------------
+// per-tool handlers
+// ---------------------------------------------------------------------------
+
+/** Split an `output.text` slice into the `{ number, text }` records the built-in `read` reports. */
+function windowFromSlice(sliceText, offset, totalLines) {
+  const all = sliceText.split('\n')
+  // dsh-os splits on LF and a file ending in a newline therefore yields a final empty element. The
+  // built-in `read` does not report that trailing element as a line, so it is dropped here rather than
+  // inflating totalLines by one.
+  if (all.length > 0 && all[all.length - 1] === '') all.pop()
+  const lines = []
+  for (let index = 0; index < all.length; index += 1) {
+    const number = offset + index
+    if (number > totalLines) break
+    lines.push({ number, text: all[index] })
+  }
+  return lines
+}
+
+/** Run `file view` and return its envelope result. */
+async function viewFile(invocation, path, flags = []) {
+  return invokeForResult(invocation, 'file view', [path], flags)
+}
+
+/**
+ * Answer a built-in `read` call.
+ *
+ * The value must satisfy the built-in schema exactly (`path`, `offset`, `lines[{number,text}]`,
+ * `totalLines`, additionalProperties false), because that value is what the built-in renderer formats
+ * and what the built-in presentation metadata is derived from.
+ */
+async function handleRead(args, invocation) {
+  const path = String(args.file_path)
+  const offset = Number.isInteger(args.offset) && args.offset > 0 ? args.offset : 1
+  const limit = Number.isInteger(args.limit) && args.limit > 0 ? args.limit : 2000
+
+  const view = await viewFile(invocation, path)
+  // `lineCount` counts the trailing empty element the same way `split` does, so the reported total is
+  // taken from the slice arithmetic instead: the verb's own text is authoritative.
+  const text = String(view.text ?? '')
+  const endsWithNewline = text.endsWith('\n')
+  const allLines = text.split('\n')
+  if (endsWithNewline) allLines.pop()
+  const totalLines = allLines.length
+
+  const selected = allLines.slice(offset - 1, offset - 1 + limit)
+  const lines = selected.map((lineText, index) => ({ number: offset + index, text: lineText }))
+
+  return { path: view.path ?? path, offset, lines, totalLines }
+}
+
+/**
+ * Answer a built-in `write` call.
+ *
+ * `before` and `after` are the decoded text, matching what the built-in `read` reports for the same
+ * file, while the bytes actually landing on disk keep the target's original BOM and line endings. That
+ * split is deliberate: the values are compared by the model and diffed by the UI (both of which work in
+ * normalised text), and only the byte-level write needs the file's convention.
+ */
+async function handleWrite(args, invocation) {
+  const path = String(args.file_path)
+  const content = String(args.content ?? '')
+
+  const before = existsSync(path) ? decodeTextFile(readFileSync(path)) : null
+  const format = readTargetFormat(path)
+
+  writeFileAtomic(path, encodeTextForTarget(content, format))
+
+  // The verb is still consulted for the write itself only when the target did not exist: `file create`
+  // refuses to overwrite by contract, so an existing target is replaced here. A new target goes through
+  // the verb, which is where the parent-directory creation and the protected-path check live.
+  if (before === null) {
+    const created = await invokeForResult(invocation, 'file create', [path, content, format.bom ? 'utf-8-bom' : 'utf-8'], [], { allow: true })
+    return {
+      path: created.path ?? path,
+      operation: 'create',
+      before: null,
+      after: content,
+    }
+  }
+
+  return {
+    path,
+    operation: 'update',
+    before,
+    after: content,
+  }
+}
+
+/**
+ * Answer a built-in `edit` call.
+ *
+ * The literal replacement is performed on the decoded text — the same text the model was shown by
+ * `read` — and the result is written back in the target's own convention. Match counting mirrors the
+ * built-in contract: one match is required unless `replace_all` is set, and a violation throws so the
+ * caller falls back to the built-in tool rather than inventing a different answer.
+ */
+async function handleEdit(args, invocation) {
+  const path = String(args.file_path)
+  const oldString = String(args.old_string ?? '')
+  const newString = String(args.new_string ?? '')
+  const replaceAll = args.replace_all === true
+
+  if (oldString === '') throw new Error('old_string must be a non-empty string')
+  if (oldString === newString) throw new Error('old_string and new_string must differ')
+
+  const format = readTargetFormat(path)
+  if (!format.exists) throw new Error(`cannot edit '${path}': it does not exist`)
+  const before = decodeTextFile(readFileSync(path))
+
+  const occurrences = before.split(oldString).length - 1
+  if (occurrences === 0) throw new Error(`old_string was not found in ${path}`)
+  if (occurrences > 1 && !replaceAll) {
+    throw new Error(`old_string appears ${occurrences} times in ${path}; pass replace_all to replace every occurrence`)
+  }
+
+  const after = replaceAll
+    ? before.split(oldString).join(newString)
+    : before.replace(oldString, newString)
+
+  writeFileAtomic(path, encodeTextForTarget(after, format))
+
+  return { path, before, after }
+}
+
+/**
+ * Answer a built-in `pwsh` call.
+ *
+ * The value must satisfy the built-in foreground variant of the `oneOf` output schema, including
+ * `kind: "foreground"`, both stream objects with their `truncated` flags, and the null-able
+ * `exitCode`/`signal` pair.
+ *
+ * `signal` is always null: dsh-os reports a numeric exit status and does not surface the terminating
+ * signal separately, and inventing a value there would be a claim the envelope does not support.
+ */
+async function handlePwsh(args, invocation, timeoutMs) {
+  const command = String(args.command ?? '')
+  const workdir = typeof args.workdir === 'string' && args.workdir !== '' ? args.workdir : undefined
+  const requestedTimeout = Number.isFinite(args.timeoutMs) && args.timeoutMs > 0 ? args.timeoutMs : timeoutMs
+
+  // `pwsh -Command <command>` is what the built-in tool runs, so the same argv shape is handed to
+  // execute.command: the arguments are passed as separate argv elements and never spliced into a
+  // shell string.
+  const flags = ['--timeout', String(Math.round(requestedTimeout))]
+  if (workdir !== undefined) flags.push('--workdir', workdir)
+
+  const result = await invokeForResult(invocation, 'execute.command', ['pwsh', '-NoLogo', '-NoProfile', '-Command', command], flags, { allow: true, timeoutMs: requestedTimeout + 5000 })
+
+  const stdoutText = String(result.stdout ?? '')
+  const stderrText = String(result.stderr ?? '')
+
+  return {
+    kind: 'foreground',
+    exitCode: Number.isInteger(result.exitCode) ? result.exitCode : null,
+    signal: null,
+    timedOut: result.timedOut === true,
+    aborted: false,
+    timeoutMs: Math.round(requestedTimeout),
+    stdout: { text: stdoutText, truncated: result.stdoutTruncated === true },
+    stderr: { text: stderrText, truncated: result.stderrTruncated === true },
+  }
+}
+
+// ---------------------------------------------------------------------------
+// plugin
+// ---------------------------------------------------------------------------
+
+/**
+ * Whether a path can be forwarded at all.
+ *
+ * An absolute path is required because the built-in tools resolve relative paths against the session
+ * workspace root through `ctx.fs`, and this plugin has no equivalent of that resolution. Guessing the
+ * process working directory would read a different file than the one the model named, which is worse
+ * than not taking the call over.
+ */
+function forwardablePath(value) {
+  return typeof value === 'string' && value.trim() !== '' && isAbsolute(value)
+}
+
+/** Whether the call is one this row can answer without changing what the result means. */
+function eligible(tool, args) {
+  switch (tool) {
+    case 'read':
+    case 'write':
+    case 'edit':
+      return forwardablePath(args.file_path)
+    case 'pwsh':
+      // A background call's result is a harness job id, and this surface cannot produce one. The
+      // session-scoped sandbox escalation arguments are likewise the harness's own seam.
+      if (args.run_in_background === true) return false
+      if (args.sandbox_permissions !== undefined) return false
+      return typeof args.command === 'string' && args.command.trim() !== ''
+    default:
+      return false
+  }
+}
+
+export function apply(ctx, config = {}) {
+  const toolTimeoutMs = config.timeoutMs ?? 120000
+
+  ctx.on('tools/execute', async (exec, next) => {
+    const settings = ctx['dsh-os-settings']
+    if (settings === undefined || !settings.enabled()) return next()
+
+    const tool = exec?.name
+    if (!TAKEOVER_TOOLS.includes(tool)) return next()
+    if (!settings.toolEnabled(tool)) return next()
+
+    const args = exec.arguments ?? {}
+    if (!eligible(tool, args)) return next()
+
+    const invocation = resolveInvocation(config)
+    if (invocation === null) return next()
+
+    try {
+      let value
+      if (tool === 'read') value = await handleRead(args, invocation)
+      else if (tool === 'write') value = await handleWrite(args, invocation)
+      else if (tool === 'edit') value = await handleEdit(args, invocation)
+      else value = await handlePwsh(args, invocation, toolTimeoutMs)
+
+      settings.record(tool, exec, value)
+      // Returning without calling next() is what replaces the built-in body. The value still travels
+      // through the built-in output schema and renderer.
+      return { value }
+    } catch (error) {
+      // Fallback is the contract: a redirected call may change how a result is produced, never whether
+      // the caller gets one. The reason is recorded so the settings panel can show why.
+      settings.recordFallback(tool, exec, error)
+      return next()
+    }
+  })
+}
+
+/** Exported for tests: the mapping from built-in arguments onto dsh-os argv. */
+export const __internals = { eligible, handleRead, handleWrite, handleEdit, handlePwsh, windowFromSlice, statSync }