dsh-gitbash-shell 0.36.0 → 0.38.0

package/CHANGELOG.md

@@ -3,6 +3,30 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## v0.38.0 — 2026-10-13
+
+**类型**:feat(设置卡折叠分区;用户反馈「开关堆一列不知道主题」)。
+
+- **七分区全部改为可折叠卡片**:v0.36.0 只加了标题文字,视觉上仍是一列开关。现在每个分区是官方 `DisclosureRow`(seed `ui-primitives` 组件,client bundle 的 require 白名单内)**折叠卡**——默认全部收起,页面只剩七行分区标题(模式 / 行内工具 / 路径方言 / 执行器 / 终端 / 终端工具 / 插件联动),点哪行展开哪区,找设置 = 先认主题再点开(用户原话:「内部可以折叠,这样我找的时候就只需要去展开我大概知道的某个设置主题,然后去找更细节的按钮」)。
+- **视觉卡片化**:每分区带边框 + 圆角(`.gb-fold`),分区边界一眼可辨;不再依赖上一分区底部的分隔线。
+- **新增 `sec.mode` 分区标题 × 21 语言**(模式区此前借用变体开关的长文案做标题)。
+- **退化路径**:极简宿主没有 `DisclosureRow` 导出时,分区退化为静态标题+内容(v0.36.0 形态),卡片永不白屏。
+- 功能面零变化:所有开关的字段名、写入通道、默认值原样。
+- **冒烟**:117 项全绿;七分区断言改锁 fold 形态(官方 DisclosureRow 接线、默认收起、退化路径)。
+
+## v0.37.0 — 2026-10-13
+
+**类型**:feat(用户拍板的命名与开关重构;真机反馈驱动)。
+
+- **`gitbash_pwsh` 更名 `pwsh7`(破坏性:工具名变更)**:旧名读起来像「bash/pwsh 二选一的混合工具」,让人误解(用户真机反馈)。新名 `pwsh7` 语义直白(PowerShell 7),且**绝不占用宿主被污染的 `pwsh` 名**(那个名字的全局工具在本机执行 Git Bash,是假 pwsh,恒定拒绝)。真机已装旧版的会话在新版下自然看到 `pwsh7`。
+- **`pwshTool` 开关默认翻转为 `false`(破坏性:默认值变更)**:默认**不提供**专门的 PowerShell 工具——平时全部走 bash 工具,需要 Windows 原生操作的用户在设置卡自己打开。开关只在 gitbash-shell 一侧行上(ptc 创造模式零参与,装了本插件即自动适配,2026-10-13 拍板)。
+- **pwsh7 的提供方式改为 per-agent scope 注册**(原为全局注册):agent 独立 scope 内注册、随 agent 销毁回收;与 dsh-ops 共存时照旧让位(它的宿主 pwsh 故事优先)。
+- **路由提示词按开关分支**:`pwsh7` 关(默认)时 bash 工具的描述**不再提及任何 PowerShell 工具**(给模型指一条到不了的路只会教它调用被拒的名字);开时才出现「pwsh7 仅用于 Windows 原生能力」的路由句。新增 `GITBASH_ROUTE_ADDENDUM_NO_PWSH` 常量,assemble 处按 `pwshTool()` 现场选择。
+- **调用层守卫保持恒定 deny `pwsh`**:`pwsh7` 是纯加法名字,不会误杀;deny 理由句更新为指路 `pwsh7` 与设置卡开关。
+- **词典**:pwsh.label/pwsh.hint × 21 语言重写(名字 pwsh7、默认关、**必须已安装 PowerShell 7** 的提醒与下载地址);工具 description 与错误消息同步更名。
+- **冒烟**:117 项全绿;路由句测试加「OFF 变体不得出现 pwsh7 字样」与「 misleading 名绝迹」断言。
+- **待真机复验**:bash 工具补位仍未在标准模式出现(v0.35.3 观察)——`activateOfficialBash` 链路失败必有日志行("not resolvable"/"import failed"/"activation failed"),等宿主日志定位;与本版无耦合。
+
 ## v0.36.0 — 2026-10-13
 
 **类型**:feat(设置卡分组重排;用户反馈「一排按钮不知道分类」)。

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:用 Git for Windows bash 替换 PowerShell 执行器;官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0,默认),四个 *·Git Bash 变体 preset 可开关;附带 gitbash_pwsh(系统 PowerShell 7)与 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "Windows 上让 agent 的每条 shell 命令改经 Git for Windows bash 执行;物化四个内置预设的 Git Bash 变体,统一 MSYS 盘根路径方言,侧栏终端接管可开关。· Run every agent shell command through Git for Windows bash on Windows; materialize Git Bash variants of the built-in presets, unify the MSYS drive-root path dialect, and adopt the sidebar terminal behind a switch.",
   "type": "module",
   "repository": {

package/src/client.js

@@ -76,6 +76,7 @@ window.__ModuleLoader__.load({
 			"switch.off": "停用",
 			"error": "写入失败",
 			"hint": "启用后:所有工具(bash 命令与 workdir、read/write/edit/read_image/glob/grep 与 present 的路径参数)统一使用 MSYS 盘根 POSIX 路径(/c/Users/...);bash 的原生习惯——~ 家目录、/tmp 临时目录、/dev/null、/usr 等——在所有工具中同样有效(与 Git Bash 挂载表一致),路径参数由宿主自动翻译,模型无感。停用后恢复 dsh 原生行为(文件工具用 Windows 路径)。bash 始终是 Git Bash,不受此开关影响。",
+			"sec.mode": "模式",
 			"sec.inline": "行内工具",
 			"sec.executor": "执行器",
 			"sec.peer": "插件联动",
@@ -137,8 +138,8 @@ window.__ModuleLoader__.load({
 			"tools.updating": "更新中…",
 			"variant.label": "四个「·Git Bash」变体模式",
 			"variant.hint": "默认关闭:官方四个模式经行内工具补位直接获得 Git Bash,模式列表保持官方原样。开启后注册四个变体(standard/minimal/ptc/cordis · Git Bash)并停用官方模式的工具补位——两者互斥。钉在变体 id 上的旧会话在关闭升级后需重新选择模式;变更对新会话生效。",
-			"pwsh.label": "PowerShell 7 工具(gitbash_pwsh)",
-			"pwsh.hint": "默认开启:宿主 pwsh 工具在本机实际执行 Git Bash(名字是假的),会被自动遮蔽;本开关另发一个真正的 gitbash_pwsh,用系统安装的 PowerShell 7 执行 Windows 原生操作(注册表/服务/WMI),仅完全权限会话可用;机器没装 pwsh 7 时不发布。bash 能做的事一律优先 bash。",
+			"pwsh.label": "PowerShell 7 工具(pwsh7)",
+			"pwsh.hint": "默认关闭:开启后本插件在会话里提供真正的 pwsh7 工具,用系统安装的 PowerShell 7 执行 Windows 原生操作(注册表/服务/WMI),仅完全权限会话可用。前提:机器上已安装 PowerShell 7(https://aka.ms/powershell),没装则工具不会出现。宿主自带的 pwsh 工具在本机实际执行 Git Bash(名字是假的),无论开关一律拒绝——命令一律走 bash 工具。",
 			"fctx.label": "FastCtx 文件工具(gb_*)",
 			"fctx.hint": "默认开启:发布 gb_inspect_local_file / gb_grep / gb_glob / gb_replace(Rust 实现:批量读取带 token 预算、编码探测)。它们是官方 read/grep/glob/edit 的补充——官方工具接文件沙箱,仍是默认推荐;检测到 dsh-ops(ops_* 工具)时本组自动让位。",
 		};
@@ -153,6 +154,7 @@ window.__ModuleLoader__.load({
 			"switch.off": "Disable",
 			"error": "write failed",
 			"hint": "Enabled: every tool (bash commands and workdir, read/write/edit/read_image/glob/grep and present path arguments) uses MSYS drive-root POSIX paths (/c/Users/...); bash-native habits — the ~ home shorthand, /tmp, /dev/null, /usr — resolve in every tool exactly as bash itself resolves them, and the host translates the path fields automatically. Disabled restores dsh-native behavior (Windows paths for file tools). Bash is always Git Bash while the plugin is installed; this switch only governs the cross-tool path dialect.",
+			"sec.mode": "Mode",
 			"sec.inline": "Inline tools",
 			"sec.executor": "Executor",
 			"sec.peer": "Plugin integrations",
@@ -214,8 +216,8 @@ window.__ModuleLoader__.load({
 			"tools.updating": "Updating…",
 			"variant.label": "The four \"· Git Bash\" variant presets",
 			"variant.hint": "Off by default: the four OFFICIAL presets get Git Bash through the inline tool patch and the roster stays official. On: register the four variants (standard/minimal/ptc/cordis · Git Bash) and stop patching the official presets — the two are exclusive. A session pinned to a variant id must re-select a preset after upgrading with the switch off. Applies to new sessions.",
-			"pwsh.label": "PowerShell 7 tool (gitbash_pwsh)",
-			"pwsh.hint": "On by default: the host pwsh tool actually runs Git Bash on this machine (a lying name) and is denied automatically; this switch instead publishes a REAL gitbash_pwsh over the system-installed PowerShell 7 for Windows-native work (registry/services/WMI), danger-full-access sessions only. Never published without pwsh 7 on the machine. Prefer bash for everything bash can do.",
+			"pwsh.label": "PowerShell 7 tool (pwsh7)",
+			"pwsh.hint": "Off by default: when on, this plugin provides a REAL pwsh7 tool over the system-installed PowerShell 7 for Windows-native work (registry/services/WMI), danger-full-access sessions only. Requires PowerShell 7 installed (https://aka.ms/powershell) — without it the tool never appears. The host's own pwsh tool actually runs Git Bash on this machine (a lying name) and is denied regardless of this switch — route commands through the bash tool.",
 			"fctx.label": "FastCtx file tools (gb_*)",
 			"fctx.hint": "On by default: publishes gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: batched reads with a token budget, encoding detection). ADDITIONS to the official read/grep/glob/edit — the official tools keep the file sandbox and stay the default. Stands down automatically when dsh-ops is installed.",
 		};
@@ -240,6 +242,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "تعطيل",
 				"error": "فشل الكتابة",
 				"hint": "عند التفعيل: تستخدم كل الأدوات (أوامر bash و workdir، ومعاملات المسار في read/write/edit/read_image/glob/grep و present) مسارات POSIX من جذر قرص MSYS (/c/Users/...)؛ وعادات bash الأصلية — ~ للمجلد الرئيسي و /tmp و /dev/null و /usr — تعمل في كل أداة تمامًا كما تحلّها bash نفسها، ويتولّى المضيف ترجمة حقول المسار تلقائيًا. عند التعطيل يعود السلوك الأصلي لـ dsh (مسارات Windows لأدوات الملفات). يبقى bash دائمًا Git Bash ما دامت الإضافة مثبَّتة؛ هذا المفتاح لا يحكم سوى لهجة المسارات بين الأدوات.",
+				"sec.mode": "الوضع",
 				"sec.inline": "الأدوات المضمنة",
 				"sec.executor": "المنفّذ",
 				"sec.peer": "تكامل الإضافات",
@@ -301,8 +304,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "جارٍ الترقية…",
 			"variant.label": "الأنماط الأربعة «· Git Bash»",
 			"variant.hint": "معطَّل افتراضيًا: تحصل الأنماط الرسمية الأربعة على Git Bash عبر ترقيع الأدوات داخل العملية وتبقى القائمة رسمية. عند التفعيل تُسجَّل الأنماط الأربعة المتغيّرة وتتوقف ترقيع الأنماط الرسمية — الاثنان حصريان متباددان. الجلسة المثبَّتة على معرّف متغيّر تحتاج إعادة اختيار بعد الترقية مع بقاء المفتاح معطَّلًا.",
-			"pwsh.label": "أداة PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "مُفعَّلة افتراضيًا: أداة pwsh الرسمية تشغّل Git Bash فعليًا على هذا الجهاز (اسم كاذب) فتُحجب تلقائيًا؛ يصدر هذا المفتاح أداة gitbash_pwsh حقيقية عبر PowerShell 7 المثبَّت على النظام لأعمال Windows الأصلية (السجل/الخدمات/WMI)، وللجلسات كاملة الصلاحيات فقط. لا تُنشر دون pwsh 7. فضّل bash لكل ما يستطيع فعله.",
+			"pwsh.label": "أداة PowerShell 7 (pwsh7)",
+			"pwsh.hint": "مُعطَّلة افتراضيًا: عند التفعيل توفر هذه الإضافة أداة pwsh7 حقيقية عبر PowerShell 7 المثبَّت على النظام لأعمال Windows الأصلية (السجل/الخدمات/WMI)، وللجلسات كاملة الصلاحيات فقط. تتطلب تثبيت PowerShell 7 (https://aka.ms/powershell) — بدونها لن تظهر الأداة. أداة pwsh الرسمية تشغّل Git Bash فعليًا على هذا الجهاز (اسم كاذب) وتُرفض بغض النظر عن هذا المفتاح — مرّر الأوامر عبر أداة bash.",
 			"fctx.label": "أدوات ملفات FastCtx (gb_*)",
 			"fctx.hint": "مُفعَّلة افتراضيًا: تنشر gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: قراءات دفعية بميزانية رموز وكشف ترميز). إضافة إلى read/grep/glob/edit الرسمية التي تحتفظ بصندوق الرمل وتبقى الافتراض؛ تتوقف تلقائيًا عند تثبيت dsh-ops.",
 			},
@@ -317,6 +320,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Deaktivieren",
 				"error": "Schreiben fehlgeschlagen",
 				"hint": "Aktiviert: Alle Tools (bash-Befehle und workdir sowie Pfadargumente von read/write/edit/read_image/glob/grep und present) verwenden POSIX-Pfade ab der MSYS-Laufwerkswurzel (/c/Users/...); bash-eigene Gewohnheiten — ~ für das Home-Verzeichnis, /tmp, /dev/null, /usr — funktionieren in jedem Tool genau so, wie bash sie selbst auflöst, und der Host übersetzt die Pfadfelder automatisch. Deaktiviert stellt das dsh-native Verhalten wieder her (Windows-Pfade für Dateitools). Bash ist bei installiertem Plugin immer Git Bash; dieser Schalter steuert nur den Pfaddialekt zwischen den Tools.",
+				"sec.mode": "Modus",
 				"sec.inline": "Inline-Werkzeuge",
 				"sec.executor": "Executor",
 				"sec.peer": "Plugin-Integrationen",
@@ -378,8 +382,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Wird aktualisiert…",
 			"variant.label": "Die vier „· Git Bash“-Varianten",
 			"variant.hint": "Standardmäßig aus: Die vier OFFIZIELLEN Presets bekommen Git Bash durch den Inline-Tool-Patch, die Liste bleibt offiziell. Ein: Registriert die vier Varianten und stoppt das Patchen der offiziellen Presets — beides schließt sich aus. Eine am Varianten-Id festhängende Sitzung muss nach dem Upgrade neu wählen. Gilt für neue Sitzungen.",
-			"pwsh.label": "PowerShell-7-Werkzeug (gitbash_pwsh)",
-			"pwsh.hint": "Standardmäßig ein: Das pwsh-Werkzeug des Hosts läuft hier tatsächlich als Git Bash (ein täuschender Name) und wird automatisch abgelehnt; dieser Schalter veröffentlicht stattdessen ein ECHTES gitbash_pwsh über das installierte PowerShell 7 für Windows-natives Arbeiten (Registry/Dienste/WMI), nur mit voller Berechtigung. Ohne pwsh 7 wird nichts veröffentlicht. Bevorzuge bash für alles, was bash kann.",
+			"pwsh.label": "PowerShell-7-Werkzeug (pwsh7)",
+			"pwsh.hint": "Standardmäßig aus: Beim Einschalten stellt dieses Plugin ein ECHTES pwsh7-Werkzeug über das installierte PowerShell 7 bereit (Windows-natives Arbeiten: Registry/Dienste/WMI), nur mit voller Berechtigung. Erfordert installiertes PowerShell 7 (https://aka.ms/powershell) — ohne es erscheint das Werkzeug nie. Das pwsh-Werkzeug des Hosts läuft hier tatsächlich als Git Bash (täuschender Name) und wird unabhängig von diesem Schalter abgelehnt — Befehle laufen über das bash-Werkzeug.",
 			"fctx.label": "FastCtx-Dateiwerkzeuge (gb_*)",
 			"fctx.hint": "Standardmäßig ein: Veröffentlicht gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: stapelweise Lesevorgänge mit Token-Budget, Kodierungserkennung). ERGÄNZUNGEN zu read/grep/glob/edit — die offiziellen Werkzeuge behalten die Datei-Sandbox und bleiben Standard. Weicht automatisch zurück, wenn dsh-ops installiert ist.",
 			},
@@ -394,6 +398,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Désactiver",
 				"error": "échec de l'écriture",
 				"hint": "Activé : tous les outils (commandes bash et workdir, arguments de chemin de read/write/edit/read_image/glob/grep et de present) utilisent des chemins POSIX à racine de lecteur MSYS (/c/Users/...) ; les habitudes natives de bash — ~ pour le dossier personnel, /tmp, /dev/null, /usr — fonctionnent dans chaque outil exactement comme bash les résout lui-même, et l'hôte traduit les champs de chemin automatiquement. Désactivé rétablit le comportement natif de dsh (chemins Windows pour les outils de fichiers). Bash reste toujours Git Bash tant que le plugin est installé ; ce commutateur ne régit que le dialecte de chemins entre outils.",
+				"sec.mode": "Mode",
 				"sec.inline": "Outils en ligne",
 				"sec.executor": "Exécuteur",
 				"sec.peer": "Intégrations de plugins",
@@ -455,8 +460,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Mise à jour…",
 			"variant.label": "Les quatre variantes « · Git Bash »",
 			"variant.hint": "Désactivé par défaut : les quatre presets OFFICIELS obtiennent Git Bash via le correctif d’outils en ligne et la liste reste officielle. Activé : enregistre les quatre variantes et cesse de corriger les presets officiels — les deux s’excluent. Une session attachée à un id de variante doit être rechoisie après mise à niveau. S’applique aux nouvelles sessions.",
-			"pwsh.label": "Outil PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "Activé par défaut : l’outil pwsh de l’hôte exécute en réalité Git Bash ici (un nom mensonger) et est refusé automatiquement ; ce commutateur publie un VRAI gitbash_pwsh via le PowerShell 7 installé pour les opérations natives Windows (registre/services/WMI), sessions en accès complet uniquement. Jamais publié sans pwsh 7. Préférez bash pour tout ce que bash sait faire.",
+			"pwsh.label": "Outil PowerShell 7 (pwsh7)",
+			"pwsh.hint": "Désactivé par défaut : activé, ce plugin fournit un VRAI outil pwsh7 via le PowerShell 7 installé sur le système pour le travail Windows natif (registre/services/WMI), sessions en accès complet uniquement. Nécessite PowerShell 7 installé (https://aka.ms/powershell) — sans lui l'outil n'apparaît jamais. L'outil pwsh de l'hôte exécute en réalité Git Bash sur cette machine (nom trompeur) et est refusé quel que soit ce commutateur — passez par l'outil bash.",
 			"fctx.label": "Outils de fichiers FastCtx (gb_*)",
 			"fctx.hint": "Activé par défaut : publie gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust : lectures par lots avec budget de tokens, détection d’encodage). COMPLÉMENTS aux outils officiels read/grep/glob/edit — ceux-ci conservent le bac à sable fichiers et restent la valeur par défaut. Se retire automatiquement si dsh-ops est installé.",
 			},
@@ -471,6 +476,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "अक्षम करें",
 				"error": "लिखना विफल रहा",
 				"hint": "सक्षम होने पर: सभी टूल (bash कमांड और workdir, तथा read/write/edit/read_image/glob/grep और present के पथ तर्क) MSYS ड्राइव-रूट POSIX पथ (/c/Users/...) का उपयोग करते हैं; bash की मूल आदतें — होम के लिए ~, /tmp, /dev/null, /usr — हर टूल में ठीक वैसे काम करती हैं जैसे bash स्वयं उन्हें हल करता है, और होस्ट पथ फ़ील्ड स्वतः अनुवादित करता है। अक्षम करने पर dsh का मूल व्यवहार बहाल होता है (फ़ाइल टूल के लिए Windows पथ)। जब तक प्लगइन इंस्टॉल है bash हमेशा Git Bash रहता है; यह स्विच केवल टूल के बीच पथ शैली नियंत्रित करता है।",
+				"sec.mode": "मोड",
 				"sec.inline": "इनलाइन टूल्स",
 				"sec.executor": "एक्ज़ीक्यूटर",
 				"sec.peer": "प्लगइन एकीकरण",
@@ -532,8 +538,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "अपडेट हो रहा है…",
 			"variant.label": "चार «· Git Bash» वेरिएंट प्रीसेट",
 			"variant.hint": "डिफ़ॉल्ट रूप से बंद: चार आधिकारिक प्रीसेट को इनलाइन टूल पैच से Git Bash मिलता है और सूची आधिकारिक रहती है। चालू: चार वेरिएंट पंजीकृत होते हैं और आधिकारिक प्रीसेट पैचिंग रुक जाती है — दोनों परस्पर अनन्य हैं। वेरिएंट id पर बंधे सत्र को अपग्रेड के बाद दोबारा चुनना पड़ेगा। नए सत्रों पर लागू।",
-			"pwsh.label": "PowerShell 7 उपकरण (gitbash_pwsh)",
-			"pwsh.hint": "डिफ़ॉल्ट रूप से चालू: होस्ट का pwsh उपकरण इस मशीन पर वास्तव में Git Bash चलाता है (झूठा नाम) और स्वतः अवरुद्ध होता है; यह स्विच सिस्टम-इंस्टॉल्ड PowerShell 7 पर असली gitbash_pwsh प्रकाशित करता है — Windows-नेटिव कार्य (रजिस्ट्री/सेवाएँ/WMI) के लिए, केवल पूर्ण-अधिकार सत्रों में। pwsh 7 बिना कभी प्रकाशित नहीं। जो bash कर सकता है उसके लिए bash ही चुनें।",
+			"pwsh.label": "PowerShell 7 टूल (pwsh7)",
+			"pwsh.hint": "डिफ़ॉल्ट रूप से बंद: चालू करने पर यह प्लगइन सिस्टम-इंस्टॉल्ड PowerShell 7 पर एक असली pwsh7 टूल देता है (Windows-नेटिव काम: रजिस्ट्री/सेवाएँ/WMI), केवल पूर्ण-अनुमति सत्रों के लिए। PowerShell 7 इंस्टॉल होना ज़रूरी है (https://aka.ms/powershell) — बिना इसके टूल कभी नहीं दिखेगा। होस्ट का pwsh टूल इस मशीन पर असल में Git Bash चलाता है (झूठा नाम) और इस स्विच से इतर हमेशा अस्वीकृत रहता है — कमांड bash टूल से चलाएँ।",
 			"fctx.label": "FastCtx फ़ाइल उपकरण (gb_*)",
 			"fctx.hint": "डिफ़ॉल्ट रूप से चालू: gb_inspect_local_file / gb_grep / gb_glob / gb_replace प्रकाशित करता है (Rust: टोकन बजट के साथ बैच रीड, एनकोडिंग पहचान)। आधिकारिक read/grep/glob/edit के अतिरिक्त — आधिकारिक उपकरण फ़ाइल सैंडबॉक्स रखते हैं और डिफ़ॉल्ट बने रहते हैं। dsh-ops इंस्टॉल होने पर स्वतः पीछे हट जाता है।",
 			},
@@ -548,6 +554,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Nonaktifkan",
 				"error": "gagal menulis",
 				"hint": "Saat aktif: semua alat (perintah bash dan workdir, serta argumen path read/write/edit/read_image/glob/grep dan present) memakai path POSIX berakar drive MSYS (/c/Users/...); kebiasaan asli bash — ~ untuk direktori home, /tmp, /dev/null, /usr — bekerja di setiap alat persis seperti bash sendiri menyelesaikannya, dan host menerjemahkan bidang path secara otomatis. Saat nonaktif, perilaku asli dsh dipulihkan (path Windows untuk alat berkas). Bash selalu Git Bash selama plugin terpasang; sakelar ini hanya mengatur dialek path antaralat.",
+				"sec.mode": "Mode",
 				"sec.inline": "Alat inline",
 				"sec.executor": "Eksekutor",
 				"sec.peer": "Integrasi plugin",
@@ -609,8 +616,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Memperbarui…",
 			"variant.label": "Empat preset varian «· Git Bash»",
 			"variant.hint": "Nonaktif secara bawaan: empat preset RESMI mendapat Git Bash melalui patch alat inline dan daftar tetap resmi. Aktif: mendaftarkan empat varian dan berhenti mem-patch preset resmi — keduanya saling eksklusif. Sesi yang terikat pada id varian harus memilih ulang setelah peningkatan. Berlaku untuk sesi baru.",
-			"pwsh.label": "Alat PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "Aktif secara bawaan: alat pwsh host sebenarnya menjalankan Git Bash di mesin ini (nama palsu) dan otomatis ditolak; sakelar ini menerbitkan gitbash_pwsh ASLI melalui PowerShell 7 terinstal sistem untuk pekerjaan native Windows (registri/layanan/WMI), hanya sesi akses penuh. Tidak pernah diterbitkan tanpa pwsh 7. Utamakan bash untuk semua yang bisa dilakukan bash.",
+			"pwsh.label": "Alat PowerShell 7 (pwsh7)",
+			"pwsh.hint": "Nonaktif secara default: saat aktif, plugin ini menyediakan alat pwsh7 ASLI melalui PowerShell 7 yang terinstal di sistem untuk kerja native Windows (registry/layanan/WMI), hanya untuk sesi akses penuh. Butuh PowerShell 7 terinstal (https://aka.ms/powershell) — tanpanya alat tak akan muncul. Alat pwsh bawaan host sebenarnya menjalankan Git Bash di mesin ini (nama palsu) dan ditolak apa pun status sakelar ini — jalankan perintah lewat alat bash.",
 			"fctx.label": "Alat berkas FastCtx (gb_*)",
 			"fctx.hint": "Aktif secara bawaan: menerbitkan gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: pembacaan batch dengan anggaran token, deteksi enkode). TAMBAHAN untuk read/grep/glob/edit resmi — alat resmi tetap memiliki sandbox berkas dan menjadi bawaan. Mundur otomatis saat dsh-ops terinstal.",
 			},
@@ -625,6 +632,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Disattiva",
 				"error": "scrittura non riuscita",
 				"hint": "Attivato: tutti gli strumenti (comandi bash e workdir, argomenti di percorso di read/write/edit/read_image/glob/grep e di present) usano percorsi POSIX con radice di unità MSYS (/c/Users/...); le abitudini native di bash — ~ per la home, /tmp, /dev/null, /usr — funzionano in ogni strumento esattamente come le risolve bash stesso, e l'host traduce automaticamente i campi di percorso. Disattivato ripristina il comportamento nativo di dsh (percorsi Windows per gli strumenti per i file). Bash resta sempre Git Bash finché il plugin è installato; questo interruttore governa solo il dialetto dei percorsi tra gli strumenti.",
+				"sec.mode": "Modalità",
 				"sec.inline": "Strumenti inline",
 				"sec.executor": "Esecutore",
 				"sec.peer": "Integrazioni plugin",
@@ -686,8 +694,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Aggiornamento…",
 			"variant.label": "Le quattro varianti «· Git Bash»",
 			"variant.hint": "Disattivo per impostazione predefinita: i quattro preset UFFICIALI ottengono Git Bash tramite la patch inline degli strumenti e l’elenco resta ufficiale. Attivo: registra le quattro varianti e smette di correggere i preset ufficiali — i due si escludono. Una sessione legata a un id di variante va riscelta dopo l’aggiornamento. Vale per le nuove sessioni.",
-			"pwsh.label": "Strumento PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "Attivo per impostazione predefinita: lo strumento pwsh dell’host esegue davvero Git Bash su questa macchina (un nome ingannevole) e viene negato automaticamente; questo interruttore pubblica un VERO gitbash_pwsh tramite PowerShell 7 installato per il lavoro nativo Windows (registro/servizi/WMI), solo sessioni ad accesso completo. Mai pubblicato senza pwsh 7. Preferisci bash per tutto ciò che bash sa fare.",
+			"pwsh.label": "Strumento PowerShell 7 (pwsh7)",
+			"pwsh.hint": "Disattivo per impostazione predefinita: quando attivo, questo plugin fornisce un VERO strumento pwsh7 tramite il PowerShell 7 installato sul sistema per lavoro Windows nativo (registro/servizi/WMI), solo sessioni con accesso completo. Richiede PowerShell 7 installato (https://aka.ms/powershell) — senza di esso lo strumento non appare mai. Lo strumento pwsh dell'host esegue in realtà Git Bash su questa macchina (nome ingannevole) e viene rifiutato a prescindere da questo interruttore — instrada i comandi tramite lo strumento bash.",
 			"fctx.label": "Strumenti file FastCtx (gb_*)",
 			"fctx.hint": "Attivo per impostazione predefinita: pubblica gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: letture in batch con budget di token, rilevamento della codifica). AGGIUNTE ai read/grep/glob/edit ufficiali — quelli ufficiali mantengono la sandbox dei file e restano la scelta predefinita. Si ritira automaticamente con dsh-ops installato.",
 			},
@@ -702,6 +710,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "無効にする",
 				"error": "書き込みに失敗しました",
 				"hint": "有効にすると、すべてのツール(bash コマンドと workdir、read/write/edit/read_image/glob/grep と present のパス引数)が MSYS ドライブルートの POSIX パス(/c/Users/...)を使います。bash のネイティブな習慣——ホームの ~、/tmp、/dev/null、/usr——も、bash 自身が解決するのとまったく同じようにすべてのツールで動作し、パスフィールドはホストが自動的に変換します。無効にすると dsh 本来の動作(ファイルツールは Windows パス)に戻ります。bash はプラグインがインストールされている限り常に Git Bash で、このスイッチの影響を受けません。",
+				"sec.mode": "モード",
 				"sec.inline": "インラインツール",
 				"sec.executor": "実行エンジン",
 				"sec.peer": "プラグイン連携",
@@ -763,8 +772,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "更新中…",
 			"variant.label": "4 つの「· Git Bash」バリアント",
 			"variant.hint": "既定はオフ:公式 4 プリセットはインラインツールパッチで Git Bash を得られ、一覧は公式のまま。オンにすると 4 バリアントを登録し、公式プリセットへのパッチを停止(両者は排他)。バリアント id に固定されたセッションはアップグレード後に再選択が必要。新規セッションに適用。",
-			"pwsh.label": "PowerShell 7 ツール(gitbash_pwsh)",
-			"pwsh.hint": "既定はオン:ホストの pwsh ツールはこのマシンでは実際に Git Bash を実行する(偽の名前)ため自動で拒否されます。このスイッチは代わりに、システムの PowerShell 7 で Windows ネイティブ作業(レジストリ/サービス/WMI)を行う本物の gitbash_pwsh を公開します(完全権限セッションのみ)。pwsh 7 が無ければ公開しません。bash でできることは bash を優先。",
+			"pwsh.label": "PowerShell 7 ツール(pwsh7)",
+			"pwsh.hint": "既定はオフ:オンにすると、システムにインストールされた PowerShell 7 で本物の pwsh7 ツールを提供します(レジストリ/サービス/WMI など Windows ネイティブ作業用)。完全権限セッションのみ。PowerShell 7 のインストールが必要です(https://aka.ms/powershell)— 未インストールではツールは出現しません。ホスト純正の pwsh ツールはこのマシンでは実際には Git Bash を実行する(偽の名前)ため、このスイッチとは無関係に常に拒否されます — コマンドは bash ツールへ。",
 			"fctx.label": "FastCtx ファイルツール(gb_*)",
 			"fctx.hint": "既定はオン:gb_inspect_local_file / gb_grep / gb_glob / gb_replace を公開(Rust:トークン予算付き一括読み取り、エンコーディング検出)。公式 read/grep/glob/edit への追加であり、公式ツールはファイルサンドボックスを保ち既定の推奨のまま。dsh-ops が入ると自動で退きます。",
 			},
@@ -779,6 +788,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "사용 안 함",
 				"error": "쓰기 실패",
 				"hint": "켜면 모든 도구(bash 명령과 workdir, read/write/edit/read_image/glob/grep 및 present의 경로 인수)가 MSYS 드라이브 루트 POSIX 경로(/c/Users/...)를 사용합니다. bash 고유 습관——홈의 ~, /tmp, /dev/null, /usr——도 bash 자신이 해석하는 그대로 모든 도구에서 작동하며 호스트가 경로 필드를 자동 변환합니다. 끄면 dsh 기본 동작(파일 도구에 Windows 경로 사용)으로 돌아갑니다. 플러그인이 설치되어 있는 동안 bash는 항상 Git Bash이며 이 스위치의 영향을 받지 않습니다.",
+				"sec.mode": "모드",
 				"sec.inline": "인라인 도구",
 				"sec.executor": "실행기",
 				"sec.peer": "플러그인 연동",
@@ -840,8 +850,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "업데이트 중…",
 			"variant.label": "네 개의 «· Git Bash» 변형 프리셋",
 			"variant.hint": "기본 꺼짐: 공식 4개 프리셋이 인라인 도구 패치로 Git Bash를 얻으며 목록은 공식 그대로입니다. 켜면 4개 변형을 등록하고 공식 프리셋 패칭을 중단합니다(상호 배타). 변형 id 에 고정된 세션은 업그레이드 후 다시 선택해야 합니다. 새 세션에 적용.",
-			"pwsh.label": "PowerShell 7 도구(gitbash_pwsh)",
-			"pwsh.hint": "기본 켜짐: 호스트의 pwsh 도구는 이 머신에서 실제로 Git Bash를 실행합니다(거짓 이름), 자동으로 거부됩니다. 이 스위치는 시스템에 설치된 PowerShell 7으로 Windows 네이티브 작업(레지스트리/서비스/WMI)을 수행하는 진짜 gitbash_pwsh를 대신 공개합니다(전체 권한 세션 전용). pwsh 7이 없으면 공개하지 않습니다. bash 가 할 수 있는 일은 bash 우선.",
+			"pwsh.label": "PowerShell 7 도구(pwsh7)",
+			"pwsh.hint": "기본적으로 꺼짐: 켜면 이 플러그인이 시스템에 설치된 PowerShell 7으로 실제 pwsh7 도구를 제공합니다(레지스트리/서비스/WMI 등 Windows 네이티브 작업), 전체 권한 세션 전용. PowerShell 7 설치가 필요합니다(https://aka.ms/powershell) — 없으면 도구가 나타나지 않습니다. 호스트의 pwsh 도구는 이 머신에서 실제로 Git Bash를 실행하는(거짓 이름) 도구로, 이 스위치와 무관하게 항상 거부됩니다 — 명령은 bash 도구로 실행하세요.",
 			"fctx.label": "FastCtx 파일 도구(gb_*)",
 			"fctx.hint": "기본 켜짐: gb_inspect_local_file / gb_grep / gb_glob / gb_replace 를 공개합니다(Rust: 토큰 예산 기반 일괄 읽기, 인코딩 감지). 공식 read/grep/glob/edit 의 추가이며 공식 도구는 파일 샌드박스를 유지하고 기본 권장입니다. dsh-ops 가 설치되면 자동으로 물러납니다.",
 			},
@@ -856,6 +866,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Uitschakelen",
 				"error": "schrijven mislukt",
 				"hint": "Ingeschakeld: alle tools (bash-opdrachten en workdir, padargumenten van read/write/edit/read_image/glob/grep en present) gebruiken POSIX-paden vanaf de MSYS-schijfwortel (/c/Users/...); bash-eigen gewoonten — ~ voor de home-map, /tmp, /dev/null, /usr — werken in elke tool precies zoals bash ze zelf oplost, en de host vertaalt de padvelden automatisch. Uitgeschakeld herstelt het oorspronkelijke dsh-gedrag (Windows-paden voor bestandstools). Bash is altijd Git Bash zolang de plugin is geïnstalleerd; deze schakelaar bepaalt alleen het paddialect tussen de tools.",
+				"sec.mode": "Modus",
 				"sec.inline": "Inline tools",
 				"sec.executor": "Executor",
 				"sec.peer": "Plug-in-integraties",
@@ -917,8 +928,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Bijwerken…",
 			"variant.label": "De vier «· Git Bash»-varianten",
 			"variant.hint": "Standaard uit: de vier OFFICIËLE presets krijgen Git Bash via de inline-toolpatch en de lijst blijft officieel. Aan: registreert de vier varianten en stopt het patchen van de officiële presets — sluit elkaar uit. Een sessie die aan een variant-id vastzit moet na een upgrade opnieuw kiezen. Geldt voor nieuwe sessies.",
-			"pwsh.label": "PowerShell 7-hulpmiddel (gitbash_pwsh)",
-			"pwsh.hint": "Standaard aan: het pwsh-hulpmiddel van de host draait hier echt Git Bash (een leugenaam) en wordt automatisch geweigerd; deze schakelaar publiceert in plaats daarvan een ECHT gitbash_pwsh via de geïnstalleerde PowerShell 7 voor Windows-natief werk (register/services/WMI), alleen met volledige rechten. Nooit gepubliceerd zonder pwsh 7. Geef bash de voorkeur voor alles wat bash kan.",
+			"pwsh.label": "PowerShell 7-hulpmiddel (pwsh7)",
+			"pwsh.hint": "Standaard uit: ingeschakeld biedt deze plugin een ECHT pwsh7-hulpmiddel via de op het systeem geïnstalleerde PowerShell 7 voor Windows-natief werk (register/services/WMI), alleen sessies met volledige rechten. Vereist geïnstalleerde PowerShell 7 (https://aka.ms/powershell) — zonder verschijnt het hulpmiddel nooit. Het pwsh-hulpmiddel van de host draait hier feitelijk Git Bash (een misleidende naam) en wordt ongeacht deze schakelaar geweigerd — voer opdrachten uit via het bash-hulpmiddel.",
 			"fctx.label": "FastCtx-bestandshulpmiddelen (gb_*)",
 			"fctx.hint": "Standaard aan: publiceert gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: gelezen in batches met tokenbudget, coderingsdetectie). AANVULLINGEN op read/grep/glob/edit — de officiële hulpmiddelen houden de bestandssandbox en blijven de standaard. Trekt zich automatisch terug wanneer dsh-ops is geïnstalleerd.",
 			},
@@ -933,6 +944,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Wyłącz",
 				"error": "zapis nie powiódł się",
 				"hint": "Po włączeniu: wszystkie narzędzia (polecenia bash i workdir, argumenty ścieżek w read/write/edit/read_image/glob/grep i w present) używają ścieżek POSIX od korzenia dysku MSYS (/c/Users/...); natywne nawyki basha — ~ dla katalogu domowego, /tmp, /dev/null, /usr — działają w każdym narzędziu dokładnie tak, jak rozwiązuje je sam bash, a host automatycznie tłumaczy pola ścieżek. Wyłączenie przywraca natywne zachowanie dsh (ścieżki Windows dla narzędzi plikowych). Bash jest zawsze Git Bash, dopóki wtyczka jest zainstalowana; ten przełącznik reguluje wyłącznie dialekt ścieżek między narzędziami.",
+				"sec.mode": "Tryb",
 				"sec.inline": "Narzędzia wbudowane",
 				"sec.executor": "Egzekutor",
 				"sec.peer": "Integracje wtyczek",
@@ -994,8 +1006,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Aktualizowanie…",
 			"variant.label": "Cztery warianty «· Git Bash»",
 			"variant.hint": "Domyślnie wyłączone: cztery OFICJALNE presety dostają Git Bash przez inline-owy patch narzędzi, a lista pozostaje oficjalna. Włączenie rejestruje cztery warianty i zatrzymuje patchowanie oficjalnych presetów — opcje wykluczają się. Sesja przypięta do id wariantu musi zostać wybrana ponownie po aktualizacji. Dotyczy nowych sesji.",
-			"pwsh.label": "Narzędzie PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "Domyślnie włączone: narzędzie pwsh hosta uruchamia tutaj naprawdę Git Bash (okłamująca nazwa) i jest automatycznie odrzucane; ten przełącznik publikuje w zamian PRAWDZIWE gitbash_pwsh przez zainstalowany PowerShell 7 do natywnej pracy Windows (rejestr/usługi/WMI), tylko sesje z pełnymi uprawnieniami. Nigdy bez pwsh 7 na maszynie. Preferuj bash do wszystkiego, co bash potrafi.",
+			"pwsh.label": "Narzędzie PowerShell 7 (pwsh7)",
+			"pwsh.hint": "Domyślnie wyłączone: po włączeniu ta wtyczka udostępnia PRAWDZIWE narzędzie pwsh7 przez zainstalowany w systemie PowerShell 7 do natywnej pracy w Windows (rejestr/usługi/WMI), tylko sesje z pełnymi uprawnieniami. Wymaga zainstalowanego PowerShell 7 (https://aka.ms/powershell) — bez niego narzędzie nigdy się nie pojawi. Narzędzie pwsh hosta faktycznie uruchamia Git Bash na tej maszynie (myląca nazwa) i jest odrzucane niezależnie od tego przełącznika — polecenia wykonuj przez narzędzie bash.",
 			"fctx.label": "Narzędzia plików FastCtx (gb_*)",
 			"fctx.hint": "Domyślnie włączone: publikuje gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: odczyty wsadowe z budżetem tokenów, wykrywanie kodowania). DODATKI do oficjalnych read/grep/glob/edit — oficjalne narzędzia zachowują sandbox plików i pozostają domyślne. Wycofuje się automatycznie, gdy zainstalowano dsh-ops.",
 			},
@@ -1010,6 +1022,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Desativar",
 				"error": "falha ao gravar",
 				"hint": "Ativada: todas as ferramentas (comandos bash e workdir, argumentos de caminho de read/write/edit/read_image/glob/grep e de present) usam caminhos POSIX a partir da raiz da unidade MSYS (/c/Users/...); os hábitos nativos do bash — ~ para a pasta pessoal, /tmp, /dev/null, /usr — funcionam em cada ferramenta exatamente como o próprio bash os resolve, e o host traduz os campos de caminho automaticamente. Desativada restaura o comportamento nativo do dsh (caminhos Windows para as ferramentas de arquivo). O bash é sempre Git Bash enquanto o plugin estiver instalado; este interruptor rege apenas o dialeto de caminhos entre ferramentas.",
+				"sec.mode": "Modo",
 				"sec.inline": "Ferramentas inline",
 				"sec.executor": "Executor",
 				"sec.peer": "Integrações de plugins",
@@ -1071,8 +1084,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "A atualizar…",
 			"variant.label": "As quatro variantes «· Git Bash»",
 			"variant.hint": "Desativado por padrão: os quatro presets OFICIAIS recebem Git Bash pelo patch de ferramentas em linha e a lista permanece oficial. Ativado: registra as quatro variantes e deixa de corrigir os presets oficiais — mutuamente exclusivos. Uma sessão presa a um id de variante precisa ser reescolhida após a atualização. Vale para novas sessões.",
-			"pwsh.label": "Ferramenta PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "Ativado por padrão: a ferramenta pwsh do host realmente executa Git Bash nesta máquina (um nome mentiroso) e é negada automaticamente; este interruptor publica um gitbash_pwsh VERDADEIRO via PowerShell 7 instalado no sistema para trabalho nativo do Windows (registro/serviços/WMI), apenas em sessões de acesso total. Nunca publicado sem pwsh 7. Prefira bash para tudo o que o bash faz.",
+			"pwsh.label": "Ferramenta PowerShell 7 (pwsh7)",
+			"pwsh.hint": "Desativado por padrão: ao ativar, este plugin fornece uma ferramenta pwsh7 REAL via o PowerShell 7 instalado no sistema para trabalho nativo do Windows (registro/serviços/WMI), apenas sessões com acesso total. Requer o PowerShell 7 instalado (https://aka.ms/powershell) — sem ele a ferramenta nunca aparece. A ferramenta pwsh do host na verdade executa o Git Bash nesta máquina (nome enganoso) e é negada independentemente deste interruptor — encaminhe comandos pela ferramenta bash.",
 			"fctx.label": "Ferramentas de arquivos FastCtx (gb_*)",
 			"fctx.hint": "Ativado por padrão: publica gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: leituras em lote com orçamento de tokens, detecção de codificação). ADIÇÕES aos read/grep/glob/edit oficiais — os oficiais mantêm o sandbox de arquivos e continuam o padrão. Recua automaticamente quando o dsh-ops está instalado.",
 			},
@@ -1087,6 +1100,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Выключить",
 				"error": "не удалось записать",
 				"hint": "Включено: все инструменты (команды bash и workdir, аргументы путей read/write/edit/read_image/glob/grep и present) используют POSIX-пути от корня диска MSYS (/c/Users/...); собственные привычки bash — ~ для домашнего каталога, /tmp, /dev/null, /usr — работают в каждом инструменте ровно так, как их разрешает сам bash, а хост автоматически преобразует поля путей. Выключение возвращает исходное поведение dsh (пути Windows для файловых инструментов). Пока плагин установлен, bash всегда остаётся Git Bash; этот переключатель управляет только диалектом путей между инструментами.",
+				"sec.mode": "Режим",
 				"sec.inline": "Встроенные инструменты",
 				"sec.executor": "Исполнитель",
 				"sec.peer": "Интеграции плагинов",
@@ -1148,8 +1162,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Обновление…",
 			"variant.label": "Четыре варианта «· Git Bash»",
 			"variant.hint": "По умолчанию выключено: четыре ОФИЦИАЛЬНЫХ пресета получают Git Bash через встроенный патч инструментов, список остаётся официальным. Включено — регистрирует четыре варианта и прекращает патчить официальные пресеты (взаимоисключающе). Сессия, привязанная к id варианта, после обновления должна выбрать пресет заново. Действует для новых сессий.",
-			"pwsh.label": "Инструмент PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "По умолчанию включено: инструмент pwsh хоста здесь на самом деле запускает Git Bash (лживое имя) и автоматически отклоняется; этот переключатель вместо него публикует НАСТОЯЩИЙ gitbash_pwsh через установленный PowerShell 7 для нативной работы Windows (реестр/службы/WMI), только в сессиях с полным доступом. Без pwsh 7 не публикуется. Для всего, что умеет bash, предпочитайте bash.",
+			"pwsh.label": "Инструмент PowerShell 7 (pwsh7)",
+			"pwsh.hint": "По умолчанию выключено: при включении плагин предоставляет НАСТОЯЩИЙ инструмент pwsh7 через установленный в системе PowerShell 7 для нативной работы Windows (реестр/службы/WMI), только сессии с полным доступом. Требуется установленный PowerShell 7 (https://aka.ms/powershell) — без него инструмент не появится. Штатный pwsh-инструмент хоста на этой машине фактически запускает Git Bash (лживое имя) и отклоняется независимо от этого переключателя — команды выполняйте через инструмент bash.",
 			"fctx.label": "Файловые инструменты FastCtx (gb_*)",
 			"fctx.hint": "По умолчанию включено: публикует gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: пакетные чтения с бюджетом токенов, определение кодировки). ДОПОЛНЕНИЯ к официальным read/grep/glob/edit — официальные сохраняют файловую песочницу и остаются выбором по умолчанию. Автоматически отступает при установленном dsh-ops.",
 			},
@@ -1164,6 +1178,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Inaktivera",
 				"error": "skrivning misslyckades",
 				"hint": "Aktiverad: alla verktyg (bash-kommandon och workdir, sökvägsargument för read/write/edit/read_image/glob/grep och present) använder POSIX-sökvägar från MSYS-enhetsroten (/c/Users/...); bash egna vanor — ~ för hemkatalogen, /tmp, /dev/null, /usr — fungerar i varje verktyg exakt som bash själv löser dem, och värden översätter sökvägsfälten automatiskt. Inaktiverad återställer dsh:s ursprungliga beteende (Windows-sökvägar för filverktygen). Bash är alltid Git Bash så länge insticksprogrammet är installerat; den här växeln styr bara sökvägsdialekten mellan verktygen.",
+				"sec.mode": "Läge",
 				"sec.inline": "Inline-verktyg",
 				"sec.executor": "Exekutor",
 				"sec.peer": "Plugin-integrationer",
@@ -1225,8 +1240,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Uppdaterar…",
 			"variant.label": "De fyra «· Git Bash»-varianterna",
 			"variant.hint": "Av som standard: de fyra OFFICIELLA presetten får Git Bash via inline-verktygspatchen och listan förblir officiell. På: registrerar de fyra varianterna och slutar patcha de officiella presetten — ömsesidigt uteslutande. En session fastnåld på ett variant-id måste väljas om efter uppgradering. Gäller nya sessioner.",
-			"pwsh.label": "PowerShell 7-verktyg (gitbash_pwsh)",
-			"pwsh.hint": "På som standard: hostens pwsh-verktyg kör här i verkligheten Git Bash (ett lögnaktigt namn) och nekas automatiskt; denna switch publicerar i stället ett ÄKTA gitbash_pwsh via det installerade PowerShell 7 för Windows-inhemskt arbete (register/tjänster/WMI), endast sessioner med full behörighet. Publiceras aldrig utan pwsh 7. Föredra bash för allt bash kan.",
+			"pwsh.label": "PowerShell 7-verktyg (pwsh7)",
+			"pwsh.hint": "Av som standard: när den är på tillhandahåller denna plugin ett ÄKTA pwsh7-verktyg via systemets installerade PowerShell 7 för Windows-inbyggt arbete (register/tjänster/WMI), endast sessioner med full behörighet. Kräver installerad PowerShell 7 (https://aka.ms/powershell) — utan den visas verktyget aldrig. Hostens pwsh-verktyg kör i själva verket Git Bash på denna maskin (ett vilseledande namn) och nekas oavsett denna växel — kör kommandon via bash-verktyget.",
 			"fctx.label": "FastCtx-filverktyg (gb_*)",
 			"fctx.hint": "På som standard: publicerar gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: batchläsningar med tokenbudget, kodningsdetektering). TILLÄGG till de officiella read/grep/glob/edit — de officiella behåller filsandlådan och förblir standard. Drar sig automatiskt tillbaka när dsh-ops är installerat.",
 			},
@@ -1241,6 +1256,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "ปิดใช้งาน",
 				"error": "เขียนไม่สำเร็จ",
 				"hint": "เมื่อเปิดใช้งาน: เครื่องมือทั้งหมด (คำสั่ง bash และ workdir รวมถึงอาร์กิวเมนต์พาธของ read/write/edit/read_image/glob/grep และ present) ใช้พาธ POSIX จากรากไดรฟ์ของ MSYS (/c/Users/...); พฤติกรรมดั้งเดิมของ bash — ~ สำหรับโฮม, /tmp, /dev/null, /usr — ทำงานในทุกเครื่องมือเหมือนที่ bash แก้เองพอดี และโฮสต์แปลฟิลด์พาธให้อัตโนมัติ เมื่อปิดใช้งานจะกลับสู่พฤติกรรมดั้งเดิมของ dsh (เครื่องมือจัดการไฟล์ใช้พาธ Windows) bash เป็น Git Bash เสมอเมื่อติดตั้งปลั๊กอินนี้ สวิตช์นี้ควบคุมเฉพาะรูปแบบพาธระหว่างเครื่องมือเท่านั้น",
+				"sec.mode": "โหมด",
 				"sec.inline": "เครื่องมือแบบ inline",
 				"sec.executor": "ตัวรัน",
 				"sec.peer": "การเชื่อมต่อปลั๊กอิน",
@@ -1302,8 +1318,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "กำลังอัปเกรด…",
 			"variant.label": "พรีเซ็ตย่อย «· Git Bash» ทั้งสี่",
 			"variant.hint": "ปิดตามค่าเริ่มต้น: พรีเซ็ตทางการทั้งสี่ได้ Git Bash ผ่านแพตช์เครื่องมือในตัว และรายการยังเป็นทางการ เปิด: ลงทะเบียนสี่ตัวย่อยและหยุดแพตช์พรีเซ็ตทางการ — ทั้งสองไม่ใช้ร่วมกันได้ เซสชันที่ตรึงกับ id ย่อยต้องเลือกใหม่หลังอัปเกรด ใช้กับเซสชันใหม่",
-			"pwsh.label": "เครื่องมือ PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "เปิดตามค่าเริ่มต้น: เครื่องมือ pwsh ของโฮสต์บนเครื่องนี้รัน Git Bash จริง ๆ (ชื่อหลอก) และถูกปฏิเสธอัตโนมัติ; สวิตช์นี้เผยแพร่ gitbash_pwsh ตัวจริงผ่าน PowerShell 7 ที่ติดตั้งในระบบสำหรับงานเนทีฟของ Windows (รีจิสทรี/เซอร์วิส/WMI) เฉพาะเซสชันสิทธิ์เต็ม ไม่เผยแพร่หากไม่มี pwsh 7 ให้ใช้ bash เป็นอันดับแรกกับทุกอย่างที่ bash ทำได้",
+			"pwsh.label": "เครื่องมือ PowerShell 7 (pwsh7)",
+			"pwsh.hint": "ปิดอยู่โดยค่าเริ่มต้น: เมื่อเปิด ปลั๊กอินนี้จะให้เครื่องมือ pwsh7 จริงผ่าน PowerShell 7 ที่ติดตั้งในระบบสำหรับงาน Windows แบบเนทีฟ (registry/services/WMI) เฉพาะเซสชันสิทธิ์เต็มเท่านั้น ต้องติดตั้ง PowerShell 7 (https://aka.ms/powershell) — หากไม่มี เครื่องมือจะไม่ปรากฏ เครื่องมือ pwsh ของโฮสต์ที่จริงรัน Git Bash บนเครื่องนี้ (ชื่อหลอก) และจะถูกปฏิเสธไม่ว่าสวิตช์นี้ — ส่งคำสั่งผ่านเครื่องมือ bash",
 			"fctx.label": "เครื่องมือไฟล์ FastCtx (gb_*)",
 			"fctx.hint": "เปิดตามค่าเริ่มต้น: เผยแพร่ gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: อ่านเป็นชุดพร้อมงบ token, ตรวจจับ encoding) เป็นส่วนเสริมของ read/grep/glob/edit ทางการ — เครื่องมือทางการยังมี sandbox ไฟล์และเป็นค่าเริ่มต้น ถอยอัตโนมัติเมื่อติดตั้ง dsh-ops",
 			},
@@ -1318,6 +1334,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Devre dışı bırak",
 				"error": "yazma başarısız",
 				"hint": "Etkinleştirildiğinde: tüm araçlar (bash komutları ve workdir ile read/write/edit/read_image/glob/grep ve present yol bağımsız değişkenleri) MSYS sürücü kökünden POSIX yolları (/c/Users/...) kullanır; bash'e özgü alışkanlıklar — ev için ~, /tmp, /dev/null, /usr — her araçta tam bash'in kendisinin çözdüğü gibi çalışır ve ana süreç yol alanlarını otomatik olarak çevirir. Devre dışı bırakıldığında dsh yerel davranışına döner (dosya araçları için Windows yolları). Eklenti kurulu olduğu sürece bash her zaman Git Bash olarak kalır; bu anahtar yalnızca araçlar arası yol lehçesini yönetir.",
+				"sec.mode": "Mod",
 				"sec.inline": "Satır içi araçlar",
 				"sec.executor": "Yürütücü",
 				"sec.peer": "Eklenti entegrasyonları",
@@ -1379,8 +1396,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Güncelleniyor…",
 			"variant.label": "Dört «· Git Bash» varyantı",
 			"variant.hint": "Varsayılan olarak kapalı: dört RESMİ preset, satır içi araç yamasıyla Git Bash alır; liste resmi kalır. Açık: dört varyantı kaydeder ve resmi presetleri yamalamayı bırakır — ikisi birbirini dışlar. Bir varyant kimliğine bağlı oturum yükseltmeden sonra yeniden seçilmelidir. Yeni oturumlar için geçerlidir.",
-			"pwsh.label": "PowerShell 7 aracı (gitbash_pwsh)",
-			"pwsh.hint": "Varsayılan açık: ana makinenin pwsh aracı bu makinede aslında Git Bash çalıştırır (yalancı bir ad) ve otomatik olarak reddedilir; bu anahtar bunun yerine Windows-yerel işler (kayıt defteri/hizmetler/WMI) için sistemde kurulu PowerShell 7 üzerinden GERÇEK gitbash_pwsh yayımlar, yalnızca tam yetkili oturumlarda. pwsh 7 yoksa asla yayımlanmaz. bash’in yapabildiği her şey için bash’i tercih edin.",
+			"pwsh.label": "PowerShell 7 aracı (pwsh7)",
+			"pwsh.hint": "Varsayılan olarak kapalı: açıkken bu eklenti, sistemde kurulu PowerShell 7 üzerinden GERÇEK bir pwsh7 aracı sağlar (Windows-yerel işler: kayıt defteri/hizmetler/WMI), yalnızca tam yetkili oturumlar. PowerShell 7 kurulu olmalıdır (https://aka.ms/powershell) — yoksa araç asla görünmez. Ana makinenin pwsh aracı bu makinede aslında Git Bash çalıştırır (yanıltıcı ad) ve bu anahtar ne olursa olsun reddedilir — komutları bash aracıyla çalıştırın.",
 			"fctx.label": "FastCtx dosya araçları (gb_*)",
 			"fctx.hint": "Varsayılan açık: gb_inspect_local_file / gb_grep / gb_glob / gb_replace yayımlar (Rust: token bütçeli toplu okumalar, kodlama algılama). Resmî read/grep/glob/edit’e EKLER — resmî araçlar dosya kum havuzunu korur ve varsayılan kalır. dsh-ops kurulu olduğunda otomatik olarak geri çekilir.",
 			},
@@ -1395,6 +1412,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "Tắt",
 				"error": "ghi thất bại",
 				"hint": "Khi bật: mọi công cụ (lệnh bash và workdir, tham số đường dẫn của read/write/edit/read_image/glob/grep và present) dùng đường dẫn POSIX từ gốc ổ đĩa MSYS (/c/Users/...); thói quen gốc của bash — ~ cho thư mục home, /tmp, /dev/null, /usr — hoạt động trong mọi công cụ đúng như chính bash giải quyết chúng, và máy chủ tự động chuyển đổi trường đường dẫn. Khi tắt, hành vi gốc của dsh được khôi phục (công cụ tệp dùng đường dẫn Windows). bash luôn là Git Bash khi plugin được cài đặt; công tắc này chỉ điều khiển phương ngữ đường dẫn giữa các công cụ.",
+				"sec.mode": "Chế độ",
 				"sec.inline": "Công cụ nội tuyến",
 				"sec.executor": "Trình thực thi",
 				"sec.peer": "Tích hợp plugin",
@@ -1456,8 +1474,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "Đang nâng cấp…",
 			"variant.label": "Bốn biến thể «· Git Bash»",
 			"variant.hint": "Mặc định tắt: bốn preset CHÍNH THỨC nhận Git Bash qua bản vá công cụ nội tuyến và danh sách vẫn chính thức. Bật: đăng ký bốn biến thể và ngừng vá các preset chính thức — hai bên loại trừ nhau. Phiên đang ghim vào id biến thể cần chọn lại sau nâng cấp. Áp dụng cho phiên mới.",
-			"pwsh.label": "Công cụ PowerShell 7 (gitbash_pwsh)",
-			"pwsh.hint": "Mặc định bật: công cụ pwsh của host trên máy này thực chất chạy Git Bash (tên nói dối) và bị từ chối tự động; công tắc này thay vào đó phát hành gitbash_pwsh THẬT qua PowerShell 7 cài trong hệ thống cho công việc gốc Windows (registry/dịch vụ/WMI), chỉ phiên đầy đủ quyền. Không bao giờ phát hành khi thiếu pwsh 7. Ưu tiên bash cho mọi thứ bash làm được.",
+			"pwsh.label": "Công cụ PowerShell 7 (pwsh7)",
+			"pwsh.hint": "Mặc định tắt: khi bật, plugin này cung cấp công cụ pwsh7 THỰC qua PowerShell 7 đã cài trong hệ thống cho công việc Windows gốc (registry/services/WMI), chỉ dành cho phiên đầy đủ quyền. Cần PowerShell 7 đã cài (https://aka.ms/powershell) — không có thì công cụ không bao giờ xuất hiện. Công cụ pwsh của host trên máy này thực chất chạy Git Bash (tên gây hiểu lầm) và luôn bị từ chối bất kể công tắc này — chạy lệnh qua công cụ bash.",
 			"fctx.label": "Công cụ tệp FastCtx (gb_*)",
 			"fctx.hint": "Mặc định bật: phát hành gb_inspect_local_file / gb_grep / gb_glob / gb_replace (Rust: đọc theo lô có ngân sách token, phát hiện mã hóa). BỔ SUNG cho read/grep/glob/edit chính thức — công cụ chính thức giữ sandbox tệp và vẫn là mặc định. Tự rút khi dsh-ops được cài.",
 			},
@@ -1472,6 +1490,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "停用",
 				"error": "寫入失敗",
 				"hint": "啟用後:所有工具(bash 指令同 workdir、read/write/edit/read_image/glob/grep 同 present 嘅路徑參數)統一使用 MSYS 磁碟根 POSIX 路徑(/c/Users/...);bash 原生習慣——~ 家目錄、/tmp、/dev/null、/usr——喺所有工具一樣有效(同 Git Bash 掛載表一致),路徑參數由宿主自動翻譯,模型無感。停用後回復 dsh 原生行為(檔案工具用 Windows 路徑)。bash 永遠係 Git Bash,唔受呢個開關影響。",
+				"sec.mode": "模式",
 				"sec.inline": "行內工具",
 				"sec.executor": "執行器",
 				"sec.peer": "外掛聯動",
@@ -1533,8 +1552,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "升級緊…",
 			"variant.label": "四個「·Git Bash」變體模式",
 			"variant.hint": "預設關閉:官方四個模式經行內工具補位直接獲得 Git Bash,模式列表保持官方原樣。開啟後註冊四個變體並停用官方模式的工具補位——兩者互斥。釘在變體 id 的舊會話在關閉升級後需重新選擇模式;變更對新會話生效。",
-			"pwsh.label": "PowerShell 7 工具(gitbash_pwsh)",
-			"pwsh.hint": "預設開啟:宿主 pwsh 工具在本機實際執行 Git Bash(名字是假的),會被自動遮蔽;本開關另發一個真正的 gitbash_pwsh,用系統安裝的 PowerShell 7 執行 Windows 原生操作(登錄檔/服務/WMI),僅完全權限會話可用;機器沒裝 pwsh 7 時不發布。bash 能做的事一律優先 bash。",
+			"pwsh.label": "PowerShell 7 工具(pwsh7)",
+			"pwsh.hint": "預設關閉:開啟後本外掛在會話裡提供真正的 pwsh7 工具,用系統安裝的 PowerShell 7 執行 Windows 原生操作(登錄檔/服務/WMI),僅完全權限會話可用。前提:機器上已安裝 PowerShell 7(https://aka.ms/powershell),沒裝則工具不會出現。宿主自帶的 pwsh 工具在本機實際執行 Git Bash(名字是假的),無論開關一律拒絕——命令一律走 bash 工具。",
 			"fctx.label": "FastCtx 檔案工具(gb_*)",
 			"fctx.hint": "預設開啟:發布 gb_inspect_local_file / gb_grep / gb_glob / gb_replace(Rust 實現:批量讀取帶 token 預算、編碼探測)。它們是官方 read/grep/glob/edit 的補充——官方工具接檔案沙箱,仍是預設推薦;偵測到 dsh-ops 時本組自動讓位。",
 			},
@@ -1549,6 +1568,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "停用",
 				"error": "寫入失敗",
 				"hint": "啟用後:所有工具(bash 指令同 workdir、read/write/edit/read_image/glob/grep 同 present 嘅路徑參數)統一使用 MSYS 磁碟根 POSIX 路徑(/c/Users/...);bash 原生習慣——~ 家目錄、/tmp、/dev/null、/usr——喺所有工具一樣有效(同 Git Bash 掛載表一致),路徑參數由宿主自動翻譯,模型無感。停用後回復 dsh 原生行為(檔案工具用 Windows 路徑)。bash 永遠係 Git Bash,唔受呢個開關影響。",
+				"sec.mode": "模式",
 				"sec.inline": "行內工具",
 				"sec.executor": "執行器",
 				"sec.peer": "外掛聯動",
@@ -1610,8 +1630,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "升級緊…",
 			"variant.label": "四個「·Git Bash」變體模式",
 			"variant.hint": "預設關閉:官方四個模式經行內工具補位直接獲得 Git Bash,模式列表保持官方原樣。開啟後註冊四個變體並停用官方模式的工具補位——兩者互斥。釘在變體 id 的舊會話在關閉升級後需重新選擇模式;變更對新會話生效。",
-			"pwsh.label": "PowerShell 7 工具(gitbash_pwsh)",
-			"pwsh.hint": "預設開啟:宿主 pwsh 工具在本機實際執行 Git Bash(名字是假的),會被自動遮蔽;本開關另發一個真正的 gitbash_pwsh,用系統安裝的 PowerShell 7 執行 Windows 原生操作(登錄檔/服務/WMI),僅完全權限會話可用;機器沒裝 pwsh 7 時不發布。bash 能做的事一律優先 bash。",
+			"pwsh.label": "PowerShell 7 工具(pwsh7)",
+			"pwsh.hint": "預設關閉:開啟後本外掛在會話裡提供真正的 pwsh7 工具,用系統安裝的 PowerShell 7 執行 Windows 原生操作(登錄檔/服務/WMI),僅完全權限會話可用。前提:機器上已安裝 PowerShell 7(https://aka.ms/powershell),沒裝則工具不會出現。宿主自帶的 pwsh 工具在本機實際執行 Git Bash(名字是假的),無論開關一律拒絕——命令一律走 bash 工具。",
 			"fctx.label": "FastCtx 檔案工具(gb_*)",
 			"fctx.hint": "預設開啟:發布 gb_inspect_local_file / gb_grep / gb_glob / gb_replace(Rust 實現:批量讀取帶 token 預算、編碼探測)。它們是官方 read/grep/glob/edit 的補充——官方工具接檔案沙箱,仍是預設推薦;偵測到 dsh-ops 時本組自動讓位。",
 			},
@@ -1626,6 +1646,7 @@ window.__ModuleLoader__.load({
 				"switch.off": "停用",
 				"error": "寫入失敗",
 				"hint": "啟用後:所有工具(bash 指令與 workdir,以及 read/write/edit/read_image/glob/grep 與 present 的路徑參數)統一使用 MSYS 磁碟根 POSIX 路徑(/c/Users/...);bash 原生習慣——~ 家目錄、/tmp、/dev/null、/usr——在所有工具同樣有效(與 Git Bash 掛載表一致),路徑參數由宿主自動轉譯,模型無感。停用後恢復 dsh 原生行為(檔案工具使用 Windows 路徑)。bash 一律是 Git Bash,不受此開關影響。",
+				"sec.mode": "模式",
 				"sec.inline": "行內工具",
 				"sec.executor": "執行器",
 				"sec.peer": "外掛聯動",
@@ -1687,8 +1708,8 @@ window.__ModuleLoader__.load({
 				"tools.updating": "更新中…",
 			"variant.label": "四個「·Git Bash」變體模式",
 			"variant.hint": "預設關閉:官方四個模式經行內工具補位直接獲得 Git Bash,模式列表保持官方原樣。開啟後註冊四個變體並停用官方模式的工具補位——兩者互斥。釘在變體 id 的舊會話在關閉升級後需重新選擇模式;變更對新會話生效。",
-			"pwsh.label": "PowerShell 7 工具(gitbash_pwsh)",
-			"pwsh.hint": "預設開啟:宿主 pwsh 工具在本機實際執行 Git Bash(名字是假的),會被自動遮蔽;本開關另發一個真正的 gitbash_pwsh,用系統安裝的 PowerShell 7 執行 Windows 原生操作(登錄檔/服務/WMI),僅完全權限會話可用;機器沒裝 pwsh 7 時不發布。bash 能做的事一律優先 bash。",
+			"pwsh.label": "PowerShell 7 工具(pwsh7)",
+			"pwsh.hint": "預設關閉:開啟後本外掛在工作階段裡提供真正的 pwsh7 工具,用系統安裝的 PowerShell 7 執行 Windows 原生操作(登錄檔/服務/WMI),僅完全權限工作階段可用。前提:機器上已安裝 PowerShell 7(https://aka.ms/powershell),沒裝則工具不會出現。宿主自帶的 pwsh 工具在本機實際執行 Git Bash(名字是假的),無論開關一律拒絕——命令一律走 bash 工具。",
 			"fctx.label": "FastCtx 檔案工具(gb_*)",
 			"fctx.hint": "預設開啟:發布 gb_inspect_local_file / gb_grep / gb_glob / gb_replace(Rust 實現:批量讀取帶 token 預算、編碼探測)。它們是官方 read/grep/glob/edit 的補充——官方工具接檔案沙箱,仍是預設推薦;偵測到 dsh-ops 時本組自動讓位。",
 			},
@@ -1782,6 +1803,10 @@ window.__ModuleLoader__.load({
 			".gb-error{margin:0;font-size:12px;color:var(--dsw-alias-status-danger, #e5484d)}",
 			".gb-card{-webkit-backdrop-filter:var(--dsh-any-blur-card-panels,blur(12px) saturate(1.15));backdrop-filter:var(--dsh-any-blur-card-panels,blur(12px) saturate(1.15))}",
 			".gb-section+.gb-section{border-top:1px solid var(--dsw-alias-border-l2)}",
+			/* v0.38.0 foldable sections: each theme is its own bordered card —
+			   seven header rows at a glance, switches only visible on expand. */
+			".gb-fold{border:1px solid var(--dsw-alias-border-l2);border-radius:10px;padding:4px 12px 12px;background:var(--dsw-alias-bg-layer-1,transparent)}",
+			".gb-fold .gb-stack{padding-top:10px}",
 			/* Missing-Git-Bash popup (v0.28.0): a root-level modal, because the
 			   user may never be on the settings page when their shell dies. */
 			".gb-modalBackdrop{position:fixed;inset:0;z-index:2147483000;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.45)}",
@@ -2009,6 +2034,23 @@ window.__ModuleLoader__.load({
 			} catch (e) { /* keep empty draft */ }
 		}, []);
 
+			/* v0.38.0: the card's sections are FOLDERS. All seven stay collapsed
+			   by default — the user scans seven labelled header rows, expands the
+			   one theme they recognise, and finds the switch inside it (user
+			   request verbatim: "内部可以折叠,这样我找的时候就只需要去展开我大概
+			   知道的某个设置主题"). State must sit before the early return. */
+			var foldsState = useState({});
+			var folds = foldsState[0];
+			var setFolds = foldsState[1];
+			function toggleFold(key) {
+				setFolds(function (prev) {
+					var next = {};
+					for (var k in prev) next[k] = prev[k];
+					next[key] = !prev[key];
+					return next;
+				});
+			}
+
 			var scope = props.scope;
 
 			var snap = { status: "unavailable" };
@@ -2058,6 +2100,33 @@ window.__ModuleLoader__.load({
 
 			var Chevron = icon("IconChevronDownOutline14");
 
+			/* v0.38.0: one FOLDABLE section. The header row is the OFFICIAL
+			   `DisclosureRow` from the seed ui-primitives package (required at
+			   the top of this file, same seam as every icon). All sections stay
+			   collapsed by default — the user scans seven labelled header rows
+			   and expands the one theme they recognise. A stripped-down host
+			   without the export degrades to the static title+stack card. */
+			var DisclosureRowComponent = icon("DisclosureRow");
+			function fold(key, titleKey) {
+				var body = [];
+				for (var i = 1; i < arguments.length; i++) body.push(arguments[i]);
+				if (!DisclosureRowComponent || typeof DisclosureRowComponent !== "function") {
+					return E("div", { className: "gb-section" },
+						E("div", { className: "gb-sectionTitle" }, t(titleKey)),
+						E("div", { className: "gb-stack" }, body),
+					);
+				}
+				return E(DisclosureRowComponent, {
+					className: "gb-fold",
+					icon: null,
+					title: t(titleKey),
+					open: folds[key] === true,
+					expandable: true,
+					expandOnRowClick: true,
+					onToggle: function () { toggleFold(key); },
+				}, E("div", { className: "gb-stack" }, body));
+			}
+
 			// dsh 0.1.6-alpha.2: the Plugins page renders this card through the
 			// `plugins.bundle.config` slot with view="page" — the page draws the
 			// title itself; the collapsible shell only shows on the popup seat.
@@ -2074,9 +2143,7 @@ window.__ModuleLoader__.load({
 			var eolOn = snap.value.gitAutocrlf !== false;
 			var dedupe = snap.value.suppressPeerCordis === true;
 
-			var dialectSection = E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("sec.dialect")),
-				E("div", { className: "gb-stack" },
+			var dialectSection = fold("sec.dialect",
 				E("div", { className: "gb-row" },
 					E("span", { className: "gb-rowLabel" }, t("state.label") + ":"),
 					E("span", { className: "gb-rowValue" }, enabled ? t("state.on") : t("state.off")),
@@ -2131,7 +2198,6 @@ window.__ModuleLoader__.load({
 					E("button", { type: "button", className: "gb-segBtn" + (!subagents ? " gb-segActive" : ""), onClick: function () { if (subagents) writeField("subagentDialect", false); } }, t("switch.off")),
 				),
 				E("p", { className: "gb-hint" }, t("sub.hint")),
-				),
 			);
 
 			/* ── executor section (v0.36.0 regroup) ───────────────────────────
@@ -2139,9 +2205,7 @@ window.__ModuleLoader__.load({
 			   the executor injects. Split out of the dialect section — users
 			   hunting "why is my diff all red" or pasting a bash path should
 			   not scroll through six translation switches to find it. */
-			var executorSection = E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("sec.executor")),
-				E("div", { className: "gb-stack" },
+			var executorSection = fold("sec.executor",
 				E("div", { className: "gb-row" },
 					E("span", { className: "gb-rowLabel" }, t("eol.label") + ":"),
 					E("span", { className: "gb-rowValue" }, eolOn ? t("state.on") : t("state.off")),
@@ -2166,12 +2230,9 @@ window.__ModuleLoader__.load({
 					}, bashSaved ? t("bash.saved") : t("bash.save")),
 				),
 				E("p", { className: "gb-hint" }, t("bash.hint")),
-				),
 			);
 
-			var terminalSection = E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("sec.terminal")),
-				E("div", { className: "gb-stack" },
+			var terminalSection = fold("sec.terminal",
 				E("div", { className: "gb-row" },
 					E("span", { className: "gb-rowLabel" }, t("term.label") + ":"),
 					E("span", { className: "gb-rowValue" }, winshell ? t("state.on") : t("state.off")),
@@ -2190,7 +2251,6 @@ window.__ModuleLoader__.load({
 					E("button", { type: "button", className: "gb-segBtn" + (!adopt ? " gb-segActive" : ""), onClick: function () { if (adopt) writeField("adoptSidebar", false); } }, t("switch.off")),
 				),
 				E("p", { className: "gb-hint" }, t("adopt.hint")),
-				),
 			);
 
 			/* Peer-gated section: rendered only while dsh-ptc-cordis-preset serves
@@ -2201,9 +2261,7 @@ window.__ModuleLoader__.load({
 			var pwshOn = snap.value.pwshTool !== false;
 			var fctxOn = snap.value.fastctxTools !== false;
 
-			var modeSection = E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("variant.label")),
-				E("div", { className: "gb-stack" },
+			var modeSection = fold("sec.mode",
 				E("div", { className: "gb-row" },
 					E("span", { className: "gb-rowLabel" }, t("variant.label") + ":"),
 					E("span", { className: "gb-rowValue" }, variantOn ? t("state.on") : t("state.off")),
@@ -2213,12 +2271,9 @@ window.__ModuleLoader__.load({
 					E("button", { type: "button", className: "gb-segBtn" + (!variantOn ? " gb-segActive" : ""), onClick: function () { if (variantOn) writeField("variantPresets", false); } }, t("switch.off")),
 				),
 				E("p", { className: "gb-hint" }, t("variant.hint")),
-				),
 			);
 
-			var inlineSection = E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("sec.inline")),
-				E("div", { className: "gb-stack" },
+			var inlineSection = fold("sec.inline",
 				E("div", { className: "gb-row" },
 					E("span", { className: "gb-rowLabel" }, t("pwsh.label") + ":"),
 					E("span", { className: "gb-rowValue" }, pwshOn ? t("state.on") : t("state.off")),
@@ -2237,7 +2292,6 @@ window.__ModuleLoader__.load({
 					E("button", { type: "button", className: "gb-segBtn" + (!fctxOn ? " gb-segActive" : ""), onClick: function () { if (fctxOn) writeField("fastctxTools", false); } }, t("switch.off")),
 				),
 				E("p", { className: "gb-hint" }, t("fctx.hint")),
-				),
 			);
 
 			var peerSnap = { status: "unavailable" };
@@ -2293,9 +2347,7 @@ window.__ModuleLoader__.load({
 
 			/* The merged integrations section: dedupe row + python row under one
 			   heading (v0.36.0). Exists only while the peer serves its row. */
-			var peerSection = peerSnap.status === "ready" ? E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("sec.peer")),
-				E("div", { className: "gb-stack" },
+			var peerSection = peerSnap.status === "ready" ? fold("sec.peer",
 				E("div", { className: "gb-row" },
 					E("span", { className: "gb-rowLabel" }, t("dedupe.label") + ":"),
 					E("span", { className: "gb-rowValue" }, dedupe ? t("state.on") : t("state.off")),
@@ -2318,7 +2370,6 @@ window.__ModuleLoader__.load({
 				pythonOffered ? E("p", { className: "gb-hint" }, t("python.hint")) : null,
 				pythonOffered && winHost ? E("p", { className: "gb-error" }, t("python.blocked")) : null,
 				pythonDegraded ? E("p", { className: "gb-error" }, t("python.degraded")) : null,
-				),
 			) : null;
 
 			/* ── terminal toolchain (v0.30.0) ────────────────────────────────
@@ -2437,9 +2488,7 @@ window.__ModuleLoader__.load({
 				return function () { clearTimeout(timer); };
 			}, [toolJob]);
 
-			var toolsSection = E("div", { className: "gb-section" },
-				E("div", { className: "gb-sectionTitle" }, t("sec.tools")),
-				E("div", { className: "gb-stack" },
+			var toolsSection = fold("sec.tools",
 					toolsData === null && toolErr === "" ? E("p", { className: "gb-hint" }, t("tools.loading")) : null,
 					toolErr !== "" ? E("p", { className: "gb-error" }, toolErr) : null,
 					toolsData !== null && !wingetOk ? E("p", { className: "gb-error" }, t("tools.nowinget")) : null,
@@ -2511,7 +2560,6 @@ window.__ModuleLoader__.load({
 						),
 					) : null,
 					E("p", { className: "gb-hint" }, t("tools.hint")),
-				),
 			);
 
 			var bodyContent = E("div", { className: "gb-body" },

package/src/fastctx-bridge.js

@@ -43,7 +43,7 @@ export const GB_PREFIX = 'gb_'
 export const gbName = (raw) => GB_PREFIX + raw
 
 // The HOST registry rejects any tool without an `output` contract (issue #18,
-// root cause 2) — the frozen schema + text renderer the gitbash_pwsh
+// root cause 2) — the frozen schema + text renderer the pwsh7
 // definition ships, reused so both families speak one tool-result contract.
 import { TOOL_OUTPUT_SCHEMA, renderTextContent } from './inline-tools.js'
 

package/src/index.js

@@ -56,7 +56,7 @@ import { fileURLToPath } from 'node:url'
 
 import { PRESET_META, minimalPluginsFor, pluginsFor } from './compositions.js'
 import { loadSchemastery } from './schemastery.js'
-import { GITBASH_MSYS_ADDENDUM, GITBASH_ROUTE_ADDENDUM, mountInlineTools, resolveHostPwsh7 } from './inline-tools.js'
+import { GITBASH_MSYS_ADDENDUM, GITBASH_ROUTE_ADDENDUM, GITBASH_ROUTE_ADDENDUM_NO_PWSH, mountInlineTools, resolveHostPwsh7 } from './inline-tools.js'
 import { mountFastctx } from './fastctx-bridge.js'
 
 /**
@@ -503,12 +503,12 @@ export const Config = Schema === null ? undefined : Schema.object({
    */
   variantPresets: live(Schema.boolean().default(false)),
   /**
-   * Publish `gitbash_pwsh` — a REAL PowerShell 7 tool over ctx.subprocess —
+   * Publish `pwsh7` — a REAL PowerShell 7 tool over ctx.subprocess —
    * while the host `pwsh` tool is denied (its executor is Git Bash on this
    * host). Default ON; requires pwsh 7 on the machine (never a bundled
    * payload) and danger-full-access per session.
    */
-  pwshTool: live(Schema.boolean().default(true)),
+  pwshTool: live(Schema.boolean().default(false)),
   /**
    * Publish the FastCtx file tools (`gb_*`) through the local MCP bridge.
    * Default ON; Windows-only payload, stands down entirely when dsh-ops is
@@ -2091,11 +2091,16 @@ export async function apply(ctx, config = {}) {
           // every agent (routing is dialect-independent), while the MSYS
           // sentence only describes the world the dialect switch creates.
           // Idempotent by marker: assemble may run more than once per agent.
+          // The routing sentence follows the pwsh switch (v0.37.0): while the
+          // pwsh7 tool is off (the default) the sentence must NOT name it —
+          // a route to a tool the agent cannot see only teaches the model to
+          // call a denied name.
           if (assembly && typeof assembly === 'object' && Array.isArray(assembly.tools)) {
+            const routeSentence = liveSettings.pwshTool() === true ? GITBASH_ROUTE_ADDENDUM : GITBASH_ROUTE_ADDENDUM_NO_PWSH
             for (const tool of assembly.tools) {
               if (tool && tool.name === 'bash' && typeof tool.description === 'string'
                 && !tool.description.includes('Prefer this bash tool')) {
-                tool.description += '\n' + GITBASH_ROUTE_ADDENDUM
+                tool.description += '\n' + routeSentence
                   + (applies && dialect.posixPaths === true ? '\n' + GITBASH_MSYS_ADDENDUM : '')
               }
             }
@@ -2626,7 +2631,7 @@ export async function apply(ctx, config = {}) {
           return subprocess.spawn(spec)
         },
         pwshPath: resolveHostPwsh7({ exists: existsSync }),
-        pwshEnabled: () => liveSettings.pwshTool(),
+        pwshEnabled: () => liveSettings.pwshTool() === true,
         msysToWin: (p) => translateMsysPath(p, buildTranslateEnv(readConfiguredBashPath())),
         echo: (text) => (liveSettings.dialect().posixPaths === true ? windowsToMsys(text) : text),
         log: (m) => console.log(TAG + ' ' + m),

package/src/inline-tools.js

@@ -27,7 +27,7 @@
  *      executor is ctx.shell, which on this host IS Git Bash — a pwsh tool
  *      that runs bash is a lie to the model);
  *   2. `ops_*` tools present (dsh-ops installed) -> our FastCtx bridge and
- *      gitbash_pwsh stand down; the official bash activation still runs, the
+ *      pwsh7 stands down; the official bash activation still runs, the
  *      two command surfaces are complements, not duplicates;
  *   3. `bash` already present (variant presets on, or a future official
  *      change) -> touch nothing, so the variantPresets switch and this path
@@ -93,14 +93,24 @@ export function inlineNeeds(names) {
 
 /**
  * The routing addendum appended to the `bash` tool's description through the
- * system-prompt assemble waterfall. ALWAYS applied — it states shell routing,
- * which holds regardless of the path dialect a delegate sees.
+ * system-prompt assemble waterfall. TWO variants (v0.37.0, user decision):
+ * the pwsh tool is OFF by default, and a routing sentence that names a tool
+ * the agent cannot see only teaches the model to call a denied name. The ON
+ * variant names `pwsh` (the real PowerShell 7 tool that shadows the fake
+ * global one); the OFF variant states bash-only routing. Both hold regardless
+ * of the path dialect a delegate sees.
  */
 export const GITBASH_ROUTE_ADDENDUM = [
-  'Prefer this bash tool for ALL commands; use a PowerShell tool ONLY when a Windows-native capability (cmdlets, registry, services, WMI) is truly required.',
+  'Prefer this bash tool for ALL commands; use the pwsh7 tool ONLY when a Windows-native capability (cmdlets, registry, services, WMI) is truly required.',
   'Fix failed bash commands in bash — never switch shells mid-task, never embed `pwsh -Command` inside a bash command (variable expansion and output encoding break there).',
 ].join('\n')
 
+/** The bash-only routing variant, used while the pwsh switch is off (the default). */
+export const GITBASH_ROUTE_ADDENDUM_NO_PWSH = [
+  'Prefer this bash tool for ALL commands — it is this host\'s shell.',
+  'Fix failed commands in bash; there is no PowerShell tool on this host.',
+].join('\n')
+
 /**
  * The dialect addendum (MSYS facts) — appended ONLY while this plugin's path
  * dialect is on for the assembling agent, because it describes the /c/ world
@@ -158,7 +168,7 @@ export function resolveHostPwsh7({ env = process.env, exists, platform = process
   return ''
 }
 
-/** Arguments `gitbash_pwsh` accepts — strict: anything else is rejected. */
+/** Arguments `pwsh7` accepts — strict: anything else is rejected. */
 export const PWSH_ARGUMENTS = Object.freeze(['command', 'script_path', 'workdir', 'timeoutMs'])
 
 const PWSH_DEFAULT_TIMEOUT_MS = 120_000
@@ -185,7 +195,7 @@ export function pwshArgv(pwsh, args, { msysToWin } = {}) {
 }
 
 /**
- * Validate one gitbash_pwsh call's arguments. Strict like ops_bash: an
+ * Validate one pwsh7 call's arguments. Strict like ops_bash: an
  * undeclared key is a hard error (the host bash/pwsh tools accept
  * `run_in_background`; this tool does not, and a silent ignore would leave a
  * server occupying the call until timeout). Pure.
@@ -282,10 +292,8 @@ export async function activateOfficialBash(agent, toolBashHref, createScopeFn, l
  */
 export function mountInlineTools(ctx, deps) {
   const { tools, agents, createScope, allowed, spawn, pwshPath, echo, log } = deps
-  /** agent -> { timer, scope, denyPwsh }; named `tracked` because `agents` above is the host service */
+  /** agent -> { timer, scope, denyPwsh, pwshScope }; named `tracked` because `agents` above is the host service */
   const tracked = new Map()
-  let pwshPublished = false
-  let pwshDisposer = undefined
   let toolBashHrefPromise
 
   const faceNames = (agent) => {
@@ -297,27 +305,28 @@ export function mountInlineTools(ctx, deps) {
     }
   }
 
-  const unpublishPwsh = () => {
-    if (pwshDisposer) {
-      try { pwshDisposer() } catch { /* already gone */ }
-      pwshDisposer = undefined
-    }
-    pwshPublished = false
-  }
-
-  const publishPwsh = () => {
-    if (pwshPublished) return
+  /**
+   * Provide the additive `pwsh7` tool inside one agent-owned scope (v0.37.0).
+   * The name never collides with the host's fake global `pwsh`, so this is a
+   * pure ADDITION — it shadows nothing and requires no deny juggling. The
+   * scope keeps the registration revertible at agent disposal.
+   */
+  const providePwsh = (agent, state) => {
+    if (state.pwshScope) return
     if (typeof spawn !== 'function' || !pwshPath) return
-    if (deps.pwshEnabled && deps.pwshEnabled() !== true) return
-    const registry = tools(ctx)
-    if (!registry || typeof registry.register !== 'function') return
+    if (!createScope) return
     try {
-      const disposer = registry.register(gitbashPwshDefinition({ pwsh: pwshPath, spawn, allowed, msysToWin: deps.msysToWin, echo }))
-      pwshDisposer = typeof disposer === 'function' ? disposer : undefined
-      pwshPublished = true
-      log(`pwsh replacement published (pwsh 7 at ${pwshPath}; the host pwsh tool is denied on this host — its executor is Git Bash)`)
+      const scope = createScope(agent.ctx)
+      const registry = scope.ctx?.tools
+      if (!registry || typeof registry.register !== 'function') {
+        void scope.dispose().catch(() => {})
+        return
+      }
+      registry.register(gitbashPwshDefinition({ pwsh: pwshPath, spawn, allowed, msysToWin: deps.msysToWin, echo }))
+      state.pwshScope = scope
+      log(`pwsh7 tool provided for this agent (real PowerShell 7 at ${pwshPath})`)
     } catch (error) {
-      log(`pwsh replacement registration failed: ${error?.message ?? error}`)
+      log(`pwsh7 tool registration failed for this agent: ${error?.message ?? error}`)
     }
   }
 
@@ -340,21 +349,37 @@ export function mountInlineTools(ctx, deps) {
     let state = tracked.get(agent)
     if (state?.timer) { clearTimeout(state.timer); state.timer = undefined }
     if (!state) {
-      state = { timer: undefined, scope: undefined, denyPwsh: undefined }
+      state = { timer: undefined, scope: undefined, denyPwsh: undefined, pwshScope: undefined }
       tracked.set(agent, state)
     }
-    if (needs.denyPwsh && !state.denyPwsh) {
-      // Deny the fake pwsh first: restrict is per-agent and idempotent, and
-      // the lying tool must never be callable, not even for the milliseconds
-      // before the bash tool lands. The call MUST go through the AGENT's
-      // scoped context (`agent.ctx.tools`, the dsh-ops-proven shape): on the
-      // ROOT context the host throws "requires a scoped context" and the
-      // deny silently never exists (issue #18, root cause 3).
-      try {
-        const deny = agent.ctx?.tools?.restrict?.({ deny: ['pwsh'] })
-        if (typeof deny === 'function') state.denyPwsh = deny
-      } catch (error) {
-        log(`fake-pwsh deny failed: ${error?.message ?? error}`)
+    // The pwsh face has three facts (v0.37.0, user decision — the pwsh7 tool
+    // is OFF by default, and its switch lives ONLY on this plugin's row):
+    //   dsh-ops present  -> hands off entirely (their host-pwsh story stands;
+    //                       our pwsh7 and our deny would both be duplicates).
+    //   the fake global `pwsh` (executor = ctx.shell = Git Bash) is DENIED
+    //                       per agent in EVERY case — the lying name is never
+    //                       callable, and `pwsh7` cannot be caught by it.
+    //   switch ON        -> the REAL PowerShell 7 tool is ADDED as `pwsh7` in
+    //                       an agent-owned scope (pure addition, no shadowing).
+    // The row switch is re-read per reconcile, so a flip lands at the next
+    // agent (or on the next event after a hot toggle).
+    if (needs.denyPwsh) {
+      if (needs.opsPresent) {
+        // hands off
+      } else {
+        if (!state.denyPwsh) {
+          // The deny MUST go through the AGENT's scoped context
+          // (`agent.ctx.tools`, the dsh-ops-proven shape): on the ROOT context
+          // the host throws "requires a scoped context" and the deny silently
+          // never exists (issue #18, root cause 3).
+          try {
+            const deny = agent.ctx?.tools?.restrict?.({ deny: ['pwsh'] })
+            if (typeof deny === 'function') state.denyPwsh = deny
+          } catch (error) {
+            log(`fake-pwsh deny failed: ${error?.message ?? error}`)
+          }
+        }
+        if (deps.pwshEnabled && deps.pwshEnabled() === true) providePwsh(agent, state)
       }
     }
     if (needs.needsBash && !state.scope) {
@@ -371,13 +396,6 @@ export function mountInlineTools(ctx, deps) {
         }
       }).catch(() => { /* logged inside activateOfficialBash */ })
     }
-    // The pwsh replacement follows the ops_ presence: dsh-ops already ships a
-    // PowerShell story through the HOST pwsh tool — which our own deny would
-    // otherwise silence — so ours fills that gap instead of duplicating tools.
-    // The row switch is re-read per reconcile too, so a flip lands at the
-    // next agent (or on the next event after a hot toggle).
-    if (needs.opsPresent || (deps.pwshEnabled && deps.pwshEnabled() !== true)) unpublishPwsh()
-    else publishPwsh()
   }
 
   const teardown = (agent) => {
@@ -386,6 +404,7 @@ export function mountInlineTools(ctx, deps) {
     tracked.delete(agent)
     if (state.timer) clearTimeout(state.timer)
     if (state.denyPwsh) { try { state.denyPwsh() } catch { /* already lifted */ } }
+    if (state.pwshScope) { void state.pwshScope.dispose().catch(() => {}) }
     if (state.scope) { void state.scope.dispose().catch(() => {}) }
   }
 
@@ -400,14 +419,15 @@ export function mountInlineTools(ctx, deps) {
     for (const agent of agents?.(ctx)?.list?.() ?? []) {
       try { reconcile(agent) } catch { /* one broken agent never blocks the rest */ }
     }
-    // CALL-LAYER GUARD (v0.35.2, second independent layer): even when the
-    // per-agent visibility restriction loses a race, a `pwsh` call that
-    // reaches its executor runs Git Bash (ctx.shell IS Git Bash on this
-    // host). Deny at dispatch and name the replacements.
+    // CALL-LAYER GUARD (v0.35.2, second independent layer; v0.37.0 wording):
+    // a `pwsh` call ALWAYS reaches the fake global tool (executor = ctx.shell
+    // = Git Bash on this host) — our real tool is `pwsh7`, a different name —
+    // so the fake name is denied at dispatch unconditionally, with the
+    // replacement named.
     ctx.on('tools/pre-execute', (exec, next) => {
       try {
         if (exec?.name === 'pwsh') {
-          return { kind: 'deny', reason: 'the host pwsh tool would run Git Bash on this host (its executor was replaced). Use the bash tool for commands, or gitbash_pwsh for Windows-native work (registry, services, WMI).' }
+          return { kind: 'deny', reason: 'the host pwsh tool would run Git Bash on this host (its executor was replaced). Use the bash tool for commands. If you need Windows-native work (registry, services, WMI), the real PowerShell 7 tool is pwsh7 — enable it on the dsh-gitbash-shell settings card if it is not present.' }
         }
       } catch { /* never block the waterfall */ }
       return next()
@@ -420,7 +440,6 @@ export function mountInlineTools(ctx, deps) {
   ctx.effect(() => () => {
     for (const agent of [...tracked.keys()]) teardown(agent)
     tracked.clear()
-    unpublishPwsh()
   }, 'dsh-gitbash-shell: inline tool patching')
 }
 
@@ -441,7 +460,13 @@ export function mountInlineTools(ctx, deps) {
  */
 export function gitbashPwshDefinition({ pwsh, spawn, allowed, msysToWin, echo }) {
   return {
-    name: 'gitbash_pwsh',
+    // v0.37.0 (user decision): the tool is named `pwsh7` — NOT `pwsh` (that
+    // name belongs to the host's fake global tool, whose executor is
+    // ctx.shell = Git Bash on this host and stays denied) and NOT
+    // `gitbash_pwsh` (which read like a bash/pwsh hybrid). `pwsh7` is purely
+    // additive: it never shadows anything, and it exists only on hosts where
+    // a real PowerShell 7 is installed.
+    name: 'pwsh7',
     description: gitbashPwshDescription(),
     parameters: {
       type: 'object',
@@ -462,7 +487,7 @@ export function gitbashPwshDefinition({ pwsh, spawn, allowed, msysToWin, echo })
       const invalid = validatePwshArgs(args)
       if (invalid) throw new Error(invalid)
       if (!allowed(exec?.agent?.session)) {
-        throw new Error('gitbash_pwsh requires danger-full-access for this session; this channel has no file sandbox.')
+        throw new Error('pwsh7 requires danger-full-access for this session; this channel has no file sandbox.')
       }
       const built = pwshArgv(pwsh, args, { msysToWin })
       if (built.error) throw new Error(built.error)