dsh-gitbash-shell 0.39.1 → 0.39.2

package/CHANGELOG.md

@@ -3,6 +3,44 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## v0.39.2 — 2026-10-13
+
+**类型**:fix(route B 工具/预设生命周期、动态配置与客户端回归) / test。
+
+- **复现与裁定**:两名 Sol 分区审查、Grok 交叉反证与主代理隔离复验确认了工具面、生命周期、
+  组合、代码扫描和客户端状态转换的问题;普通子 scope 的原始冲突仍由 v0.39.1 的 `shell` 隔离修复。
+  FastCtx 全文路径回显是既定策略,不误当文件工具替换问题;minimal 的 persistent PTY 不与全工具
+  变体的执行器来源混为一谈。只修既有功能,不新增功能、改 root shell 或市场 patch。
+- **变体接线**:Windows 全工具 Git Bash 变体不再启用依赖 root PowerShell 的官方 `tool-bash`;
+  保留官方 pwsh 面,经同一行内补位通道接入私有 Git Bash 工具。minimal 的 persistent 通道保持。
+- **工具生命周期**:存活 agent 的 `pwshTool` 双向翻转同步解除/重建自身的 restrict;异步导入/
+  挂载在插件或 agent 退役后不再迟到注册;jobs 服务卸载按真实 Cordis 活跃状态恢复前台 bash。
+- **降级分支**:plain definition 的 required 标志递归转换为合法 JSON Schema;升级助手不可用
+  时仍解析并传递每会话 standing policy,不错误回退部署默认。两项为模块解析降级的受控复现,
+  不宣称本机生产已发生导入失败,也不改变 Windows 受限模式明示 unconfined 的既定取舍。
+- **预设与默认值**:串行 reconcile 退役时关闭新任务、清理晚到 register 并等待 unregister;
+  动态关闭变体在退役前迁回部署默认,避免后续新会话引用不存在的 preset。既有钉住会话不迁移。
+- **路径与终端**:run_code 扫描辨认关键字后的正则并在不确定时整份 no-op,不改正则数据;
+  FastCtx 入/出参获得 execution 上下文并服从总方言、委托与虚拟挂载开关;better-sidebar 的
+  adoptSidebar 动态翻转恢复接管前值并保护接管后的用户手选,不改变官方 autoTerminalShell
+  关后只停止未来写入的独立语义。
+- **FastCtx 错误**:子进程/写管道 error 进入初始化 Promise,失败清理 pending 计时器与连接;
+  MCP `isError:true` 按官方桥约定抛错,不再把失败包装成宿主成功 value。
+  发现与连接启动采用 single-flight,拥有在途连接并在卸载时取消/等待,不让并发 agent 的发现流程
+  覆盖已在使用的 lazy client。该丢失所有权链已用受控 MCP 传输复现,并新增关闭/晚注册回归。
+- **客户端**:设置卡所有 Hooks 在 readiness early-return 前调用;工具链进度轮询在网络/HTTP
+  暂态失败后重试,卸载或失效时取消,不因单次请求失败永久卡在忙碌状态。
+- **回归入口**:新增可移植客户端/桥/运行时/宿主回归与实际 Core preview 集成用例,接入现有
+  `npm test`/`npm run test:preview`;不新增依赖、不跳过旧断言或 Node 22 矩阵。对齐上游 v0.39.1
+  (`521be01`)后完整测试 **156/156**、实际 Core 无头 preview **14/14**、打包 dry-run 和 diff 检查
+  通过。新增执行级回归保留 #21 的 real-array glob 契约与 stringified-array 响亮拒绝;不改已发布
+  版本号、历史记录或 npm 发布流程。Grok 对修复 diff 的只读反证未发现确定遗漏。
+  首轮全量检查发现三条旧源码正则仍锁旧实现,改为对应新保护条件并补同值/手选行为测试,没有删掉
+  保护断言。原 [Issue #19](https://github.com/KannaKuron/dsh-gitbash-shell/issues/19) 和
+  [PR #20](https://github.com/KannaKuron/dsh-gitbash-shell/pull/20) 已完成;这些后续修复由新 PR 承载,
+  Windows/Linux × Node 22/24 的远端结果见其检查。preview 不等同于完整 Electron GUI 或真 MCP
+  exe 并发验收,模块解析降级使用受控夹具复现。
+
 ## v0.39.1 — 2026-10-13
 
 **类型**:fix(route B 私有执行器的真实服务隔离与读取授权) / test / ci。

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.39.1",
+  "version": "0.39.2",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:自带 bash 工具(私有 Git Bash 执行器实例,官方 PowerShell 执行器原样保留),官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0 起;v0.39.0 起不再替换宿主执行器),四个 *·Git Bash 变体 preset 可开关;官方 pwsh 工具默认隐藏、开关可见(真 PowerShell);附带 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.39.1",
+  "version": "0.39.2",
   "description": "Windows 上给 agent 一个真正的 Git Bash 命令工具:私有 Git Bash 执行器实例(官方 PowerShell 执行器原样保留),统一 MSYS 盘根路径方言,官方 pwsh 工具默认隐藏可开关,物化四个内置预设的 Git Bash 变体,侧栏终端接管可开关。· Give agents a real Git Bash tool on Windows: a private Git Bash executor instance (the official PowerShell executor stays untouched), a unified MSYS drive-root path dialect, an opt-in official pwsh tool, and four Git Bash preset variants.",
   "type": "module",
   "repository": {
@@ -52,8 +52,8 @@
     "icon.svg"
   ],
   "scripts": {
-    "test": "node --test tests/smoke.mjs tests/private-executor.mjs",
-    "test:preview": "node --import ./tests/host-loader.mjs --test tests/preview.mjs",
+    "test": "node --test tests/smoke.mjs tests/private-executor.mjs tests/client-regressions.mjs tests/bridge-regressions.mjs tests/runtime-regressions.mjs tests/host-regressions.mjs",
+    "test:preview": "node --import ./tests/host-loader.mjs --test tests/preview.mjs tests/bridge-preview.mjs tests/runtime-preview.mjs tests/host-preview.mjs",
     "version": "node -e \"const fs=require('fs');const m=JSON.parse(fs.readFileSync('dsh.plugin.json','utf8'));const v=JSON.parse(fs.readFileSync('package.json','utf8')).version;m.version=v;fs.writeFileSync('dsh.plugin.json',JSON.stringify(m,null,2)+'\\n')\" && git add dsh.plugin.json"
   },
   "keywords": [

package/src/bash-tool.js

@@ -248,20 +248,29 @@ function outputSchemaSpec() {
   }
 }
 
-/** Plain JSON-schema variant of the same union (fallback when defineTool is absent). */
-function outputSchemaJson() {
-  const convert = (item) => {
-    const out = { type: item.type, additionalProperties: item.additionalProperties, properties: {} }
-    const required = []
-    for (const [key, value] of Object.entries(item.properties)) {
-      if (value.required === true) { required.push(key) }
-      const { required: _drop, ...rest } = value
-      if (rest.oneOf !== undefined) delete rest.required
-      out.properties[key] = rest
+/** Convert key-level spec flags at every depth, including union branches. */
+function schemaSpecToJson(spec) {
+  const { required: marker, ...out } = spec
+  if (Array.isArray(marker)) out.required = [...marker]
+  if (spec.properties !== undefined) {
+    const required = Array.isArray(marker) ? [...marker] : []
+    out.properties = {}
+    for (const [key, value] of Object.entries(spec.properties)) {
+      if (value.required === true && !required.includes(key)) required.push(key)
+      out.properties[key] = schemaSpecToJson(value)
     }
-    return required.length > 0 ? { ...out, required } : out
+    if (required.length > 0) out.required = required
   }
-  return { oneOf: outputSchemaSpec().oneOf.map(convert) }
+  for (const key of ['oneOf', 'anyOf', 'allOf']) {
+    if (Array.isArray(spec[key])) out[key] = spec[key].map(schemaSpecToJson)
+  }
+  if (spec.items !== undefined) out.items = schemaSpecToJson(spec.items)
+  return out
+}
+
+/** Plain JSON-schema variant of the same union (fallback when defineTool is absent). */
+function outputSchemaJson() {
+  return schemaSpecToJson(outputSchemaSpec())
 }
 
 /** The official args validation (index.ts:73). */
@@ -320,8 +329,9 @@ export function createBashToolModule({ executor, toolsModule, sandboxModule, llm
       const defaultMode = executor.sandboxMode
       const escalationReady = defaultMode !== undefined && typeof approveEscalation === 'function'
       const escalationModes = escalationReady ? ESCALATION_TARGETS : []
+      // Missing approval helpers narrow escalation, not the session's standing policy.
       const resolveSandboxPolicy = (exec) => {
-        if (!escalationReady) return undefined
+        if (defaultMode === undefined) return undefined
         const policy = ctx.get('sandboxPolicy')
         return policy ? policy.resolve(exec?.agent === undefined ? {} : { session: exec.agent.session }) : undefined
       }
@@ -548,7 +558,7 @@ export function createBashToolModule({ executor, toolsModule, sandboxModule, llm
           // keys reach execute too, where enableRunInBackground enforces them
           // ("Undeclared keys are allowed, so schema omission also needs
           // enforcement", index.ts:498).
-          parameters: { type: 'object', properties: parametersSpec(), required: ['description', 'command'] },
+          parameters: schemaSpecToJson({ type: 'object', properties: parametersSpec() }),
           output: {
             schema: outputSchemaJson(),
             render: (_args, value) => [{
@@ -580,7 +590,8 @@ export function createBashToolModule({ executor, toolsModule, sandboxModule, llm
         jobCtx.effect(() => () => {
           unregister()
           try {
-            if (ctx.fiber?.state === 'active') foregroundOnly = ctx.tools.register(bashTool(undefined))
+            // Cordis FiberState.ACTIVE is the numeric enum member 2.
+            if (ctx.fiber?.state === 2) foregroundOnly = ctx.tools.register(bashTool(undefined))
           } catch { /* the scope is going away */ }
         })
       })

package/src/client.js

@@ -2063,6 +2063,42 @@ window.__ModuleLoader__.load({
 				if (scope && typeof scope.getSnapshot === "function") snap = scope.getSnapshot();
 			} catch (error_) { /* keep unavailable */ }
 
+			var pageView = props.view === "page";
+
+			// Hooks run for every snapshot state; readiness only gates their work.
+			useEffect(function () {
+				if (snap.status !== "ready" || (!open && !pageView)) return undefined;
+				if (toolsLoaded || toolBusy) return undefined;
+				loadTools();
+				return undefined;
+			}, [open, pageView, snap.status]);
+
+			/* Poll ONLY while a job is unfinished, and through the cheap ?job=1
+			   form. A transient failure retries without discarding progress. */
+			useEffect(function () {
+				if (snap.status !== "ready" || toolJob === null || toolJob.finished) return undefined;
+				var alive = true;
+				var timer;
+				function schedule() {
+					timer = setTimeout(function () {
+						fetch(TOOLS_URL + "?job=1", { headers: { accept: "application/json" } })
+							.then(function (res) {
+								if (!res.ok) throw new Error("HTTP " + res.status);
+								return res.json();
+							})
+							.then(function (data) {
+								if (!alive) return;
+								var next = data !== null && typeof data === "object" && data.job ? data.job : null;
+								setToolJob(next);
+								if (next !== null && next.finished) loadTools();
+							})
+							.catch(function () { if (alive) schedule(); });
+					}, 1200);
+				}
+				schedule();
+				return function () { alive = false; clearTimeout(timer); };
+			}, [toolJob, snap.status]);
+
 			if (snap.status !== "ready") return null;
 
 			var value = snap.value || {};
@@ -2135,7 +2171,6 @@ window.__ModuleLoader__.load({
 			// dsh 0.1.6-alpha.2: the Plugins page renders this card through the
 			// `plugins.bundle.config` slot with view="page" — the page draws the
 			// title itself; the collapsible shell only shows on the popup seat.
-			var pageView = props.view === "page";
 
 			var mounts = snap.value.virtualMounts !== false;
 			var errs = snap.value.errorDialect !== false;
@@ -2469,30 +2504,6 @@ window.__ModuleLoader__.load({
 					.then(function () { setToolBusy(false); });
 			}
 
-			useEffect(function () {
-				if (!open && !pageView) return undefined;
-				if (toolsLoaded || toolBusy) return undefined;
-				loadTools();
-				return undefined;
-			}, [open]);
-
-			/* Poll ONLY while a job is unfinished, and through the cheap ?job=1
-			   form: a full probe re-runs three winget commands per second. */
-			useEffect(function () {
-				if (toolJob === null || toolJob.finished) return undefined;
-				var timer = setTimeout(function () {
-					fetch(TOOLS_URL + "?job=1", { headers: { accept: "application/json" } })
-						.then(function (res) { return res.json(); })
-						.then(function (data) {
-							var next = data !== null && typeof data === "object" && data.job ? data.job : null;
-							setToolJob(next);
-							if (next !== null && next.finished) loadTools();
-						})
-						.catch(function () { /* keep the last known progress */ });
-				}, 1200);
-				return function () { clearTimeout(timer); };
-			}, [toolJob]);
-
 			var toolsSection = fold("sec.tools",
 					toolsData === null && toolErr === "" ? E("p", { className: "gb-hint" }, t("tools.loading")) : null,
 					toolErr !== "" ? E("p", { className: "gb-error" }, toolErr) : null,

package/src/compositions.js

@@ -9,10 +9,10 @@
  *
  * Every variant mirrors the official 0.1.7 preset it replaces (packages/
  * bundle/web-app/presets/{standard,minimal,ptc,cordis}.patch.yml) with the
- * one Git Bash delta: the bash rows are always on and the pwsh rows are
- * always off (the plugin ships its OWN bash tool over a private executor —
- * on non-Windows hosts the official stack is native anyway, which is exactly
- * what the old materialized variants encoded). A second, conditional delta exists while
+ * Git Bash routing: full variants keep the official platform-gated shell
+ * rows, and the inline patch adds OUR bash over a private executor on Windows.
+ * The minimal variant instead keeps its persistent Git Bash terminal rows.
+ * On non-Windows hosts the official stack stays native. A conditional delta exists while
  * dsh-ptc-cordis-preset reports its experimental-CPython backend ACTIVE: the
  * two workflow rows follow the official Python composition and go off (see
  * `pythonActive` below). While that backend is off — the default, and also
@@ -56,7 +56,8 @@ const planSectionFor = (hostEra021) => hostEra021
  * @param {'standard'|'ptc'|'cordis'} input.kind - which official preset this
  *   variant mirrors (workflow rows follow it: enabled on standard/cordis,
  *   disabled on ptc).
- * @param {boolean} input.gitBash - bash rows always on, pwsh rows always off.
+ * @param {boolean} input.gitBash - retained for composition-call compatibility;
+ *   full variants obtain Git Bash from the per-agent inline patch on Windows.
  * @param {string|undefined} input.skillsDir - Creation authoring skills
  *   directory (cordis variant only; resolved beside the agent-preset package).
  * @param {boolean} [input.pythonActive] - whether the experimental CPython
@@ -75,8 +76,11 @@ const planSectionFor = (hostEra021) => hostEra021
  */
 export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hostExtras = {} }) {
   const win = typeof process !== 'undefined' && process.platform === 'win32'
-  const bashDisabled = gitBash ? false : win
-  const pwshDisabled = gitBash ? true : !win
+  // Route B preserves the root PowerShell executor. On Windows the official
+  // tool-bash would execute through that executor, so full variants retain the
+  // official pwsh face and let the same per-agent inline patch add OUR bash.
+  const bashDisabled = win
+  const pwshDisabled = !win
   const workflowOn = kind !== 'ptc' && pythonActive !== true
   // dsh 0.2.1 added two rows to every full-tool official preset — time-context
   // (durable clock readings) and tool-schedule (the reminder tools) — plus a

package/src/fastctx-bridge.js

@@ -106,20 +106,21 @@ export class McpStdio {
     this.child.stderr.on('data', (chunk) => {
       this.stderrTail = (this.stderrTail + chunk).slice(-2000)
     })
-    this.child.on('exit', (code) => {
-      this.dead = true
-      for (const [, { reject }] of [...this.pending]) {
-        reject(new Error(`the FastCtx server exited (code ${code ?? 'null'})`))
-      }
-      this.pending.clear()
-    })
-    await this.#request('initialize', {
-      protocolVersion: '2024-11-05',
-      capabilities: {},
-      clientInfo: { name: 'dsh-gitbash-shell', version: '0.35.0' },
-    })
-    this.#notify('notifications/initialized')
-    return this
+    this.child.on('error', (error) => this.#fail(error))
+    this.child.stdin.on('error', (error) => this.#fail(error))
+    this.child.on('exit', (code) => this.#fail(new Error(`the FastCtx server exited (code ${code ?? 'null'})`)))
+    try {
+      await this.#request('initialize', {
+        protocolVersion: '2024-11-05',
+        capabilities: {},
+        clientInfo: { name: 'dsh-gitbash-shell', version: '0.35.0' },
+      })
+      this.#notify('notifications/initialized')
+      return this
+    } catch (error) {
+      await this.close()
+      throw error
+    }
   }
 
   /** List the server's tools: [{ name, description, inputSchema }]. */
@@ -140,15 +141,21 @@ export class McpStdio {
     this.dead = true
     const child = this.child
     this.child = undefined
-    for (const [, { reject }] of [...this.pending]) {
-      reject(new Error('the FastCtx bridge was stopped'))
-    }
-    this.pending.clear()
+    this.#fail(new Error('the FastCtx bridge was stopped'))
     if (child && child.exitCode === null && !child.killed) {
       try { child.kill() } catch { /* already gone */ }
     }
   }
 
+  #fail(error) {
+    this.dead = true
+    for (const { reject, timer } of this.pending.values()) {
+      clearTimeout(timer)
+      reject(error)
+    }
+    this.pending.clear()
+  }
+
   #onChunk(chunk) {
     this.buffer += chunk
     let at = this.buffer.indexOf('\n')
@@ -310,6 +317,10 @@ export function mountFastctx(ctx, deps) {
   let client = undefined
   let decided = false
   let withdrawnByOps = false
+  let closed = false
+  let publishing
+  let connecting
+  const starting = new Set()
 
   const unpublish = (reason) => {
     if (disposer) {
@@ -320,16 +331,34 @@ export function mountFastctx(ctx, deps) {
   }
 
   const callWithReconnect = async (rawName, args) => {
+    if (closed || withdrawnByOps) throw new Error('the FastCtx bridge was stopped')
     if (client === undefined || client.isDead) {
-      const { file } = resolveFastctx(ctx, createRequireFrom)
-      if (file === '') throw new Error('the FastCtx payload is not installed; repair the profile dependencies (frozen install) and retry')
-      client = await new McpStdio({ file, log }).start()
+      if (!connecting) {
+        connecting = (async () => {
+          const { file } = resolveFastctx(ctx, createRequireFrom)
+          if (file === '') throw new Error('the FastCtx payload is not installed; repair the profile dependencies (frozen install) and retry')
+          const fresh = new McpStdio({ file, log })
+          starting.add(fresh)
+          try {
+            await fresh.start()
+            if (closed || withdrawnByOps) throw new Error('the FastCtx bridge was stopped')
+            client = fresh
+          } catch (error) {
+            await fresh.close()
+            throw error
+          } finally {
+            starting.delete(fresh)
+          }
+        })().finally(() => { connecting = undefined })
+      }
+      await connecting
     }
+    if (closed || withdrawnByOps) throw new Error('the FastCtx bridge was stopped')
     return client.callTool(rawName, args)
   }
 
-  const publish = async () => {
-    if (disposer || decided && withdrawnByOps) return
+  const publishOnce = async () => {
+    if (closed || disposer || decided && withdrawnByOps) return
     const registry = tools(ctx)
     if (!registry || typeof registry.register !== 'function') return
     const { file, source } = resolveFastctx(ctx, createRequireFrom)
@@ -340,6 +369,7 @@ export function mountFastctx(ctx, deps) {
       return
     }
     const fresh = new McpStdio({ file, log })
+    starting.add(fresh)
     let toolList
     try {
       await fresh.start()
@@ -350,9 +380,12 @@ export function mountFastctx(ctx, deps) {
       decided = true
       withdrawnByOps = true
       return
+    } finally {
+      starting.delete(fresh)
     }
     await fresh.close()
-    client = undefined // the first call re-launches lazily; boot stays cheap
+    if (closed || withdrawnByOps) return
+    // Discovery never overwrites the independently owned lazy call client.
     const wanted = toolList.filter((tool) => FASTCTX_FILE_TOOLS.includes(String(tool?.name)))
     const registered = []
     const registeredNames = []
@@ -386,16 +419,20 @@ export function mountFastctx(ctx, deps) {
             schema: TOOL_OUTPUT_SCHEMA,
             render: (_args, value) => renderTextContent(value),
           },
-          async execute(args) {
-            // Fail LOUD on malformed patterns (v0.38.5; reshaped v0.39.1,
-            // issue #21 — see validateFastctxPattern).
+          async execute(args, execution) {
+            // Preserve v0.39.1 / #21: glob accepts real string arrays,
+            // while stringified arrays and malformed patterns fail loudly.
             if (args !== null && typeof args === 'object' && 'pattern' in args) {
               const invalid = validateFastctxPattern(rawName, args.pattern)
               if (invalid) throw new Error(invalid)
             }
-            const translated = translateFastctxArgs(args, msysToWin)
+            const translated = translateFastctxArgs(args, msysToWin ? (path) => msysToWin(path, execution) : undefined)
             const result = await callWithReconnect(rawName, translated)
-            return { content: [{ type: 'text', text: renderFastctxResult(rawName, result, echo) }] }
+            const text = renderFastctxResult(rawName, result, echo ? (value) => echo(value, execution) : undefined)
+            // The host treats a returned value as success; MCP failures must
+            // throw, just as its official MCP client does.
+            if (result?.isError === true) throw new Error(text)
+            return { content: [{ type: 'text', text }] }
           },
         })
         if (typeof dispose === 'function') {
@@ -416,7 +453,13 @@ export function mountFastctx(ctx, deps) {
     log(`FastCtx bridge active (${source}): ${registeredNames.join(', ')}`)
   }
 
+  const publish = () => {
+    if (!publishing) publishing = publishOnce().finally(() => { publishing = undefined })
+    return publishing
+  }
+
   const reconcile = (agent) => {
+    if (closed) return
     if (!enabled()) { unpublish('FastCtx bridge disabled by the fastctxTools switch'); decided = true; withdrawnByOps = true; return }
     if (decided && withdrawnByOps) return
     let names = []
@@ -440,8 +483,12 @@ export function mountFastctx(ctx, deps) {
     log(`FastCtx bridge wiring failed: ${error?.message ?? error}`)
     return
   }
-  ctx.effect(() => () => {
+  ctx.effect(() => async () => {
+    closed = true
     unpublish()
-    if (client) { void client.close().catch(() => {}) }
+    const owned = new Set([...starting, client].filter(Boolean))
+    await Promise.allSettled([...owned].map((connection) => connection.close()))
+    await Promise.allSettled([publishing, connecting].filter(Boolean))
+    client = undefined
   }, 'dsh-gitbash-shell: FastCtx bridge')
 }

package/src/index.js

@@ -1168,7 +1168,13 @@ const CODE_LITERAL_SAFE = /^[A-Za-z0-9._@+~\-/ ]+$/
 /** Previous significant character that lets a '/' start a regex literal. */
 function regexCanStart(previous) {
   if (previous === '') return true
-  return '(,=:[!&|?{};+-*%<>~^'.indexOf(previous) >= 0
+  if (['return', 'throw', 'yield', 'await', 'case', 'delete', 'void', 'typeof', 'in', 'instanceof', 'of', 'else', 'do', 'break', 'continue', 'debugger'].includes(previous)) return true
+  return previous.length === 1 && '(,=:[!&|?{;+-*%<>~^'.includes(previous)
+}
+
+/** Read an identifier as ONE token: keyword-led regexes are not division. */
+function codeWordAt(code, index) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*/.exec(code.slice(index))?.[0]
 }
 
 /** Index after the closing quote of the literal at `index`, or -1. */
@@ -1239,6 +1245,15 @@ function skipBracedExpression(code, index) {
       last = 'x'
       continue
     }
+    // A slash after a closing group may start a statement regex OR division.
+    // Without a parser that distinction is uncertain: abort the WHOLE scan.
+    if (c === '/' && (last === ')' || last === '}')) return -1
+    const word = codeWordAt(code, i)
+    if (word) {
+      last = last === '.' ? 'x' : word
+      i += word.length
+      continue
+    }
     if (c === '/' && regexCanStart(last)) {
       const end = skipRegexLiteral(code, i)
       if (end === -1) return -1
@@ -1320,6 +1335,15 @@ export function scanCodeLiterals(code) {
       last = 'x'
       continue
     }
+    // A slash after a closing group may start a statement regex OR division.
+    // Without a parser that distinction is uncertain: abort the WHOLE scan.
+    if (c === '/' && (last === ')' || last === '}')) return null
+    const word = codeWordAt(code, i)
+    if (word) {
+      last = last === '.' ? 'x' : word
+      i += word.length
+      continue
+    }
     if (c === '/' && regexCanStart(last)) {
       const end = skipRegexLiteral(code, i)
       if (end === -1) return null
@@ -1380,8 +1404,8 @@ export function rewriteCodePaths(code, env) {
     // is written into, and a quote inside it (a home directory with an
     // apostrophe) would end that literal early — refuse rather than corrupt.
     const quote = code[span.start - 1]
-    if (translated.indexOf(quote) >= 0) continue
-    if (quote === '`' && translated.indexOf('${') >= 0) continue
+    if (translated.indexOf(quote) >= 0) return code
+    if (quote === '`' && translated.indexOf('${') >= 0) return code
     const source = translated.replace(/\\/g, '\\\\')
     out += code.slice(cursor, span.start) + source
     cursor = span.end
@@ -1469,9 +1493,6 @@ const SIDEBAR_NS = 'dsh-better-sidebar'
 const SIDEBAR_TRIES = 12
 const SIDEBAR_RETRY_MS = 1500
 
-// Reconciler installed by adoptSidebarShell; a no-op until then.
-let reconcileSidebar = () => {}
-
 /**
  * Reconcile the better-sidebar `terminalShell` takeover with the adoptSidebar
  * setting (v0.15.0, default ON). ON writes our bashPath (remembering what was
@@ -1491,95 +1512,69 @@ function adoptSidebarShell(ctx, bashPath, readAdopt) {
   let previous = ''
   let tried = 0
   let timer = null
-  ctx.effect(() => () => { if (timer) clearTimeout(timer) }, 'dsh-gitbash-shell: sidebar adoption polling')
-
+  let closed = false
+  let serial = Promise.resolve()
   const readShell = () => {
     const settings = ctx.get('settings')
     if (!settings || typeof settings.update !== 'function') return null
     try {
-      // The sidebar's value lives in ITS row Config, projected into the
-      // settings describe() list; the service exposes describe/update only
-      // (the old `get(ns)` reader died with dsh 0.1.6).
-      if (typeof settings.describe === 'function') {
-        const entry = settings.describe().find((row) => row !== null && typeof row === 'object' && row.ns === SIDEBAR_NS)
-        const value = entry === undefined ? undefined : entry.value
-        return value && typeof value === 'object' && typeof value.terminalShell === 'string' ? value.terminalShell : ''
-      }
-      return null
-    } catch {
-      return null // namespace not registered yet / sidebar absent
+      if (typeof settings.describe !== 'function') return null
+      const entry = settings.describe().find((row) => row && row.ns === SIDEBAR_NS)
+      const value = entry?.value
+      return value && typeof value.terminalShell === 'string' ? value.terminalShell : ''
+    } catch { return null }
+  }
+  const restore = async () => {
+    if (!adopted) return
+    const now = readShell()
+    if (now === null) return
+    // The user may have selected another shell since our takeover.
+    if (now === bashPath) {
+      await ctx.get('settings').update(SIDEBAR_NS, { terminalShell: previous })
+      console.log(TAG + " better-sidebar shell restored ('" + previous + "')")
     }
+    adopted = false
   }
-
-  reconcileSidebar = (desired) => {
+  const reconcileSidebar = async (desired) => {
     const current = readShell()
     if (current === null) return false
-    const settings = ctx.get('settings')
-    if (desired && current !== bashPath) {
-      const was = current
-      settings.update(SIDEBAR_NS, { terminalShell: bashPath })
-        .then(() => {
-          previous = was
-          adopted = true
-          console.log(
-            `${TAG} dsh-better-sidebar terminal shell -> Git Bash (${bashPath})` +
-              (was ? ` (took over from '${was}')` : ''),
-          )
-        })
-        .catch((error) => {
-          console.log(`${TAG} better-sidebar shell adoption unavailable: ${error?.message ?? error}`)
-        })
-      return true
-    }
-    if (desired && current === bashPath) {
-      adopted = true
-      return true
-    }
-    if (!desired && adopted && current === bashPath) {
-      settings.update(SIDEBAR_NS, { terminalShell: previous })
-        .then(() => {
-          adopted = false
-          console.log(`${TAG} dsh-better-sidebar terminal shell restored ('${previous || 'sidebar default'}') — adoptSidebar off`)
-        })
-        .catch(() => {})
-      return true
-    }
+    if (!desired) { await restore(); return true }
+    if (adopted || current === bashPath) return true
+    previous = current
+    await ctx.get('settings').update(SIDEBAR_NS, { terminalShell: bashPath })
+    adopted = true
+    console.log(TAG + ' dsh-better-sidebar terminal shell -> Git Bash (' + bashPath + ')')
     return true
   }
-
   const run = () => {
-    tried += 1
-    const ok = reconcileSidebar(readAdopt())
-    if (ok) return
-    if (tried < SIDEBAR_TRIES) {
-      timer = setTimeout(run, SIDEBAR_RETRY_MS)
-      return
-    }
-    console.log(`${TAG} better-sidebar shell adoption skipped: settings service unavailable after ${tried} tries`)
-  }
-  run.watched = false
-  void run()
-
-  // Dispose: while we still hold the value, restore what was there before.
-  let reverted = false
-  ctx.effect(
-    () => () => {
-      if (reverted || !adopted) return
-      reverted = true
-      const s = ctx.get('settings')
-      if (!s || typeof s.update !== 'function') return
-      // Era-aware read (v0.25.1): `settings.get(ns)` is gone on dsh >= 0.1.7, so
-      // the old call threw straight into the catch and the takeover was NEVER
-      // reverted when this plugin unloaded — same missed-era-read class as
-      // issue #8 (readShell above carries both branches).
-      const now = readShell()
-      if (now === null) return
-      if (String(now) === bashPath) {
-        s.update(SIDEBAR_NS, { terminalShell: previous }).catch(() => {})
-      }
-    },
-    'dsh-gitbash-shell: sidebar shell revert',
-  )
+    if (closed) return serial
+    if (timer) { clearTimeout(timer); timer = null }
+    serial = serial.then(async () => {
+      if (closed) return
+      tried += 1
+      const ok = await reconcileSidebar(readAdopt())
+      if (ok || closed) return
+      if (tried < SIDEBAR_TRIES) timer = setTimeout(run, SIDEBAR_RETRY_MS)
+      else console.log(TAG + ' better-sidebar shell adoption skipped: settings unavailable')
+    }).catch((error) => {
+      console.log(TAG + ' better-sidebar shell adoption unavailable: ' + (error?.message ?? error))
+    })
+    return serial
+  }
+  try {
+    ctx.on('loader/volatile-update', (paths) => {
+      if (!Array.isArray(paths) || !paths.some((path) => Array.isArray(path) && path[0] === 'adoptSidebar')) return
+      tried = 0
+      void run()
+    })
+  } catch { /* a diagnostic context may have no event service */ }
+  ctx.effect(() => async () => {
+    closed = true
+    if (timer) clearTimeout(timer)
+    await serial
+    await restore()
+  }, 'dsh-gitbash-shell: sidebar shell revert')
+  return run()
 }
 
 // ── plugin ──────────────────────────────────────────────────────────────────
@@ -1759,6 +1754,38 @@ export function minimalPtyBashPath(readResolution) {
  * failures stay visible through the roster's broken diagnostic instead of
  * failing the boot.
  */
+async function migrateVariantDefault(ctx, readVariants) {
+  if (readVariants() === true) return true
+  const readDefault = () => { try { return ctx.agentPresets.defaultId } catch { return undefined } }
+  const current = readDefault()
+  if (typeof current !== 'string' || !PRESET_IDS.includes(current)) return true
+  const target = VARIANT_DEFAULT_SUCCESSORS[current]
+  try {
+    const settings = ctx.get('settings')
+    if (!settings || typeof settings.update !== 'function') return false
+    const roster = await ctx.agentPresets.list()
+    if (!Array.isArray(roster) || !roster.some((row) => row && row.id === target)) {
+      console.warn(TAG + ' default-preset migration stood down: successor "' + target + '" is not registered. Set an OFFICIAL default or turn variantPresets on.')
+      return false
+    }
+    // A roster read is asynchronous: never overwrite a newer user selection.
+    if (readVariants() === true || readDefault() !== current) return true
+    await settings.update('agent-preset-registry', { selectedDefault: target })
+    const after = readDefault()
+    if (after !== target) {
+      console.warn(TAG + ' default-preset migration did not stick (read back "' + after + '"). Set an OFFICIAL default or turn variantPresets on.')
+      return false
+    }
+    console.log(TAG + ' deployment default migrated: "' + current + '" -> "' + target
+      + '" (variantPresets is off). Pinned sessions are unchanged; agent-preset/locked still requires a NEW session.')
+    return true
+  } catch (error) {
+    console.warn(TAG + ' default-preset migration failed: ' + (error?.message ?? error)
+      + '. Set an OFFICIAL default or turn variantPresets on; variants were not retired.')
+    return false
+  }
+}
+
 async function registerVariant(ctx, presetId, { gitBashActive, skillsDir, pythonActive, hostExtras = {}, readBashResolution }) {
   const meta = PRESET_META[presetId]
   if (!meta) return undefined
@@ -1811,6 +1838,17 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
   /** The CPython fact the LIVE registrations were built with. */
   let registeredPython = false
   let serial = Promise.resolve()
+  let closed = false
+  ctx.effect(() => async () => {
+    closed = true
+    await serial
+    const failures = []
+    for (const [presetId, off] of [...live]) {
+      live.delete(presetId)
+      try { await off() } catch (error) { failures.push(error) }
+    }
+    if (failures.length) throw new AggregateError(failures, 'Git Bash preset cleanup failed')
+  }, 'dsh-gitbash-shell: declarative preset registrations')
 
   // v0.35.0: the variant roster is opt-in (`variantPresets`, default OFF).
   // OFF means an EMPTY desired set — the cleanup above still runs, so a
@@ -1820,8 +1858,16 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
     : [])
 
   const reconcile = () => {
+    if (closed) return serial
     serial = serial.then(async () => {
+      if (closed) return
       const want = desired()
+      const pythonActive = peerPython
+      // Dynamic OFF repairs the deployment default BEFORE retiring its id.
+      // Keep registrations if the official migration cannot be verified.
+      if (live.size > 0 && readVariants() !== true
+        && !await migrateVariantDefault(ctx, readVariants)) return
+      if (closed) return
       // The peer's EFFECTIVE CPython backend rewrites the workflow rows of
       // EVERY variant (the official Python composition disables them, and
       // workflow-ptc refuses a non-TypeScript backend), so a flip re-registers
@@ -1829,14 +1875,16 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
       // as the backend swap itself: the peer's patch is evaluated at boot. A
       // bare INTENT without the effective backend changes nothing here — the
       // composition still runs Node, so the workflow rows must stay live.
-      if (live.size > 0 && registeredPython !== peerPython) {
+      if (live.size > 0 && registeredPython !== pythonActive) {
         for (const [presetId, off] of [...live]) {
           live.delete(presetId)
           try {
             await off()
             console.log(TAG + " preset '" + presetId + "' retired (peer CPython backend changed; rows are rebuilt)")
           } catch (error) {
+            live.set(presetId, off)
             console.log(TAG + " preset '" + presetId + "' retirement failed: " + (error && error.message ? error.message : error))
+            return // never register replacements after an unverified retirement
           }
         }
       }
@@ -1847,14 +1895,18 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
           await off()
           console.log(TAG + " preset '" + presetId + "' retired (dsh-ptc-cordis-preset covers Creation mode on Git Bash)")
         } catch (error) {
+          live.set(presetId, off)
           console.log(TAG + " preset '" + presetId + "' retirement failed: " + (error && error.message ? error.message : error))
+          return
         }
       }
       for (const presetId of want) {
+        if (closed) break
         if (live.has(presetId)) continue
         try {
-          const unregister = await registerVariant(ctx, presetId, { gitBashActive, skillsDir, pythonActive: peerPython, hostExtras, readBashResolution })
+          const unregister = await registerVariant(ctx, presetId, { gitBashActive, skillsDir, pythonActive, hostExtras, readBashResolution })
           if (unregister) {
+            if (closed) { await unregister(); break }
             live.set(presetId, unregister)
             console.log(TAG + " preset '" + presetId + "' registered declaratively")
           }
@@ -1862,7 +1914,7 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
           console.log(TAG + " preset '" + presetId + "' registration failed: " + (error && error.message ? error.message : error))
         }
       }
-      registeredPython = peerPython
+      registeredPython = pythonActive
     }).catch((error) => {
       console.log(TAG + ' preset reconcile failed: ' + (error && error.message ? error.message : error))
     })
@@ -1870,6 +1922,7 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
   }
 
   await reconcile()
+  if (closed) return
   console.log(TAG + ' registered ' + live.size + ' preset(s) declaratively (' + [...live.keys()].join(', ') + ')'
     + (live.size === 0 ? ' — variantPresets is off: the official presets carry Git Bash through the inline tool patch (see the CHANGELOG)'
       : '')
@@ -1932,7 +1985,8 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
     console.log(TAG + ' dedupe switch wiring failed: ' + (error && error.message ? error.message : error))
   }
 
-  ctx.effect(() => () => { for (const off of live.values()) void off() }, 'dsh-gitbash-shell: declarative preset registrations')
+  // If settings appears after an OFF transition failed closed, retry it.
+  ctx.inject(['settings'], () => { void reconcile() })
 }
 
 export async function apply(ctx, config = {}) {
@@ -2611,8 +2665,8 @@ export async function apply(ctx, config = {}) {
   // official tool surface mirrored call-for-call) plus a HIDE on the real pwsh
   // tool while the pwsh switch is off (route B: the official executor stays in
   // place, so pwsh is real PowerShell and hiding it is a product choice). The
-  // variantPresets switch is honored BY OBSERVATION — a variant agent's face
-  // already has bash, so this patch never fires there.
+  // Full Windows variants keep the same pwsh-only face as official presets,
+  // so they receive this same private-executor patch. Minimal stays persistent.
   if (process.platform === 'win32') {
     try {
       mountInlineTools(ctx, {
@@ -2661,55 +2715,10 @@ export async function apply(ctx, config = {}) {
   // With variantPresets ON nothing here runs: the variants stay registered,
   // so a variant default keeps working as-is.
   try {
-    if (ctx.agentPresets && typeof ctx.agentPresets.register === 'function') {
-      ctx.inject(['settings'], (settingsCtx) => {
-        void (async () => {
-          try {
-            const settings = settingsCtx.settings
-            if (!settings || typeof settings.update !== 'function') return
-            // The switch is the whole contract: keep-old-modes ON means a
-            // variant default is a legitimate choice and stays untouched.
-            if (liveSettings.variantPresets() === true) return
-            const readDefault = () => { try { return ctx.agentPresets.defaultId } catch { return undefined } }
-            const current = readDefault()
-            if (typeof current !== 'string' || !PRESET_IDS.includes(current)) return
-            const target = VARIANT_DEFAULT_SUCCESSORS[current]
-            if (typeof target !== 'string') return
-            // The successor must exist in the CURRENT roster: official ids
-            // renamed once already (code→ptc), and writing an unknown id
-            // would trade a known failure for a worse one.
-            const roster = await ctx.agentPresets.list()
-            if (!Array.isArray(roster) || !roster.some((row) => row && row.id === target)) {
-              console.warn(TAG + ' default-preset migration stood down: the deployment default is the variant "'
-                + current + '" but the successor "' + target + '" is not registered on this host.'
-                + ' Set the default manually among the OFFICIAL presets, or turn variantPresets on.')
-              return
-            }
-            try {
-              await settings.update('agent-preset-registry', { selectedDefault: target })
-            } catch (error) {
-              console.warn(TAG + ' default-preset migration write failed (' + (error?.message ?? error)
-                + '): the deployment default is still the variant "' + current
-                + '" — NEW sessions would fail with agent-preset/not-found.'
-                + ' Fix: set an OFFICIAL default in the preset picker, or turn variantPresets on.')
-              return
-            }
-            const after = readDefault()
-            if (after === target) {
-              console.log(TAG + ' deployment default migrated: "' + current + '" -> "' + target
-                + '" (variantPresets is off). Old sessions pinned to a variant still need a NEW'
-                + ' session — the official agent-preset/locked rule blocks a mid-session switch.')
-            } else {
-              console.warn(TAG + ' default-preset migration did not stick (read back "'
-                + (after === undefined ? 'unreadable' : after) + '"). Set the default manually in'
-                + ' Settings -> agent preset, or turn variantPresets on.')
-            }
-          } catch (error) {
-            console.log(TAG + ' default-preset migration failed: ' + (error?.message ?? error))
-          }
-        })()
-      })
-    }
+    ctx.inject(['settings'], () => {
+      // Boot migration is detached: registry.list() may await the Loader boot.
+      void migrateVariantDefault(ctx, () => liveSettings.variantPresets())
+    })
   } catch (error) {
     console.log(TAG + ' default-preset migration wiring failed: ' + (error?.message ?? error))
   }
@@ -2727,8 +2736,21 @@ export async function apply(ctx, config = {}) {
         enabled: () => liveSettings.fastctxTools(),
         createRequireFrom: (base) => createRequire(base ?? import.meta.url),
         tools: (c) => { try { return c.get('tools') } catch { return undefined } },
-        msysToWin: (p) => translateMsysPath(p, buildTranslateEnv(readConfiguredBashPath())),
-        echo: (text) => (liveSettings.dialect().posixPaths === true ? windowsToMsys(text) : text),
+        msysToWin: (p, execution) => {
+          const dialect = liveSettings.dialect()
+          if (dialect.posixPaths !== true || !dialectApplies(dialect, execution?.agent)) return p
+          if (!dialect.virtualMounts) {
+            return typeof p === 'string' && (MSYS_DRIVE_ROOT.test(p) || MSYS_BARE_DRIVE.test(p))
+              ? translateMsysPath(p, null) : p
+          }
+          return translateMsysPath(p, buildTranslateEnv(readConfiguredBashPath()))
+        },
+        echo: (text, execution) => {
+          const dialect = liveSettings.dialect()
+          if (dialect.posixPaths !== true || !dialectApplies(dialect, execution?.agent)) return text
+          const env = dialect.virtualMounts ? buildTranslateEnv(readConfiguredBashPath()) : null
+          return env ? msysEcho(text, env) : windowsToMsys(text)
+        },
         log: (m) => console.log(TAG + ' ' + m),
       })
     } catch (error) {

package/src/inline-tools.js

@@ -191,8 +191,25 @@ export async function mountPrivateExecutor(ctx, GitBashSandboxExecutor, createSc
  */
 export function mountInlineTools(ctx, deps) {
   const { tools, agents, createScope, pwshEnabled, log } = deps
-  /** agent -> { timer, scope, denyPwsh }; named `tracked` because `agents` above is the host service */
+  /** Per-agent mounts, masks and cancellation; `agents` above is the host service. */
   const tracked = new Map()
+  const pending = new Set()
+  const controller = new AbortController()
+  let closed = false
+  const isLive = (agent, state) => !closed && tracked.get(agent) === state && !state.controller.signal.aborted
+  const newState = () => ({ timer: undefined, scope: undefined, denyPwsh: undefined, pending: undefined, controller: new AbortController() })
+  // Loader imports cannot be cancelled, but no continuation may outlive its
+  // owner. Join our cancelled continuations without waiting on a stuck loader.
+  const untilDisposed = async (promise, signal) => {
+    signal.throwIfAborted()
+    let abort
+    const cancelled = new Promise((_, reject) => {
+      abort = () => reject(signal.reason)
+      signal.addEventListener('abort', abort, { once: true })
+    })
+    try { return await Promise.race([promise, cancelled]) }
+    finally { signal.removeEventListener('abort', abort) }
+  }
   /** Resolved once per process: { executor, executorScope, module }. */
   let bashOnce
   /** Set as soon as any face shows ops_* tools (the call-layer guard reads it). */
@@ -214,58 +231,90 @@ export function mountInlineTools(ctx, deps) {
    * declarations — the §4k schemastery semantics come for free), so it never
    * touches the root `ctx.shell` service slot the official pwsh executor
    * owns. The executor scope lives for the plugin's lifetime and is disposed
-   * by the effect registered at the bottom of this function.
+   * by the ownership effect registered before lifecycle wiring.
    */
   const bashOncePromise = async () => {
+    controller.signal.throwIfAborted()
     if (bashOnce) return bashOnce
-    bashOnce = (async () => {
-      const { GitBashSandboxExecutor } = await import('./shell.js')
-      if (!GitBashSandboxExecutor) throw new Error('executor class unavailable')
-      if (!GitBashSandboxExecutor.Config) {
-        throw new Error('executor Config unavailable (schemastery unresolved; see the schemastery log lines above)')
-      }
-      if (typeof createScope !== 'function') throw new Error('no createScope seam')
-      const { executor, executorScope } = await mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope)
-      const hostModules = {}
-      for (const [key, name] of HOST_MODULES) {
-        try {
-          hostModules[key] = await resolveHostModule(ctx, name)
-        } catch { hostModules[key] = undefined }
+    const mounting = (async () => {
+      let executorScope
+      try {
+        const { GitBashSandboxExecutor } = await untilDisposed(import('./shell.js'), controller.signal)
+        if (!GitBashSandboxExecutor) throw new Error('executor class unavailable')
+        if (!GitBashSandboxExecutor.Config) {
+          throw new Error('executor Config unavailable (schemastery unresolved; see the schemastery log lines above)')
+        }
+        if (typeof createScope !== 'function') throw new Error('no createScope seam')
+        controller.signal.throwIfAborted()
+        const mounted = await mountPrivateExecutor(ctx, GitBashSandboxExecutor, createScope)
+        executorScope = mounted.executorScope
+        controller.signal.throwIfAborted()
+        const hostModules = {}
+        for (const [key, name] of HOST_MODULES) {
+          hostModules[key] = await untilDisposed(resolveHostModule(ctx, name), controller.signal)
+        }
+        const { createBashToolModule } = await untilDisposed(import('./bash-tool.js'), controller.signal)
+        const module = createBashToolModule({ executor: mounted.executor, log, ...hostModules })
+        return { executor: mounted.executor, executorScope, module }
+      } catch (error) {
+        if (executorScope) await executorScope.dispose()
+        throw error
       }
-      const { createBashToolModule } = await import('./bash-tool.js')
-      const module = createBashToolModule({ executor, log, ...hostModules })
-      return { executor, executorScope, module }
     })()
-    bashOnce.catch(() => { bashOnce = undefined })
-    return bashOnce
+    bashOnce = mounting
+    mounting.catch(() => { if (bashOnce === mounting) bashOnce = undefined })
+    return mounting
   }
 
   /** Register the own bash tool inside one agent-owned scope. */
   const provideBash = async (agent, state) => {
-    if (state.scope) return
+    let scope
+    let retained = false
     try {
-      const { executor, module } = await bashOncePromise()
+      const { executor, module } = await untilDisposed(bashOncePromise(), state.controller.signal)
+      if (!isLive(agent, state)) return
       log(`own bash tool ready (private Git Bash executor at ${executor.bashPath || '(unresolved)'}; official pwsh executor untouched)`)
-      const scope = createScope(agent.ctx)
+      scope = createScope(agent.ctx)
+      state.scope = scope // Own the scope BEFORE either asynchronous mount.
       // Same asynchronous-fiber shape the official module needed: wait for
       // the apply callback to capture scope.ctx before touching its tools.
-      if (scope.fiber) { try { await scope.fiber } catch { /* disposed */ } }
+      if (scope.fiber) await untilDisposed(scope.fiber, state.controller.signal)
+      if (!isLive(agent, state)) return
       const registry = scope.ctx?.get('tools')
-      if (!registry || typeof scope.ctx.plugin !== 'function') {
-        void scope.dispose().catch(() => {})
-        return
-      }
+      if (!registry || typeof scope.ctx.plugin !== 'function') return
       const fiber = scope.ctx.plugin(module)
-      await fiber
-      state.scope = scope
+      await untilDisposed(fiber, state.controller.signal)
+      if (!isLive(agent, state)) return
+      retained = true
       log('own bash tool activated for this agent (Git Bash execution; official pwsh tool real but hidden by default)')
     } catch (error) {
-      log(`own bash tool activation failed for this agent: ${error?.message ?? error}`)
+      if (isLive(agent, state)) log(`own bash tool activation failed for this agent: ${error?.message ?? error}`)
+    } finally {
+      if (scope && !retained) {
+        if (state.scope === scope) state.scope = undefined
+        await scope.dispose()
+      }
     }
   }
 
+  const startBash = (agent, state) => {
+    if (state.scope || state.pending || !isLive(agent, state)) return
+    const task = provideBash(agent, state)
+    state.pending = task
+    pending.add(task)
+    void task.finally(() => {
+      pending.delete(task)
+      if (state.pending === task) state.pending = undefined
+    }).catch((error) => log(`own bash tool cleanup failed: ${error?.message ?? error}`))
+  }
+
   const reconcile = (agent, { attempt = 0 } = {}) => {
-    if (!agent?.ctx) return
+    if (closed || !agent?.ctx) return
+    // Undo ONLY our mask before observing the face. schemas() filters a
+    // restricted-away pwsh, so it cannot tell us what an ON flip must restore.
+    const previous = tracked.get(agent)
+    if (previous?.timer) { clearTimeout(previous.timer); previous.timer = undefined }
+    if (previous?.denyPwsh) { previous.denyPwsh(); previous.denyPwsh = undefined }
     const names = faceNames(agent)
     // The composed face may not be wired yet at created-time. Retry bounded:
     // a face with NEITHER tool carries no verdict. Five tries at 250ms, then
@@ -275,7 +324,7 @@ export function mountInlineTools(ctx, deps) {
       timer.unref?.()
       const state = tracked.get(agent)
       if (state) state.timer = timer
-      else tracked.set(agent, { timer, scope: undefined, denyPwsh: undefined })
+      else tracked.set(agent, { ...newState(), timer })
       return
     }
     const pwshVisible = deps.pwshEnabled?.() === true
@@ -284,7 +333,7 @@ export function mountInlineTools(ctx, deps) {
     let state = tracked.get(agent)
     if (state?.timer) { clearTimeout(state.timer); state.timer = undefined }
     if (!state) {
-      state = { timer: undefined, scope: undefined, denyPwsh: undefined }
+      state = newState()
       tracked.set(agent, state)
     }
     // The pwsh face (route B): the host tool is REAL PowerShell now, so the
@@ -307,22 +356,46 @@ export function mountInlineTools(ctx, deps) {
       }
     }
     if (needs.needsBash && !state.scope) {
-      void provideBash(agent, state)
+      startBash(agent, state)
     }
   }
 
-  const teardown = (agent) => {
+  const teardown = async (agent) => {
     const state = tracked.get(agent)
     if (!state) return
     tracked.delete(agent)
+    state.controller.abort(new Error('inline bash agent disposed'))
     if (state.timer) clearTimeout(state.timer)
-    if (state.denyPwsh) { try { state.denyPwsh() } catch { /* already lifted */ } }
-    if (state.scope) { void state.scope.dispose().catch(() => {}) }
+    if (state.denyPwsh) { state.denyPwsh(); state.denyPwsh = undefined }
+    await Promise.all([state.scope?.dispose(), state.pending])
   }
 
+  // Register ownership before the sweep starts asynchronous work. A cancelled
+  // loader continuation and every per-agent mount must settle before disposal.
+  ctx.effect(() => async () => {
+    closed = true
+    const mounting = bashOnce
+    controller.abort(new Error('inline bash plugin disposed'))
+    await Promise.all([
+      ...[...tracked.keys()].map(teardown),
+      ...pending,
+      mounting?.then(({ executorScope }) => executorScope.dispose(), () => {}),
+    ])
+    tracked.clear()
+    bashOnce = undefined
+  }, 'dsh-gitbash-shell: inline tool patching')
+
   try {
     ctx.on('agent/created', ({ agent } = {}) => { try { reconcile(agent) } catch { /* never break agent creation */ } })
-    ctx.on('agent/disposed', ({ agent } = {}) => { try { teardown(agent) } catch { /* never break disposal */ } })
+    ctx.on('agent/disposed', ({ agent } = {}) => teardown(agent).catch((error) => {
+      log(`agent bash tool cleanup failed: ${error?.message ?? error}`)
+    }))
+    ctx.on('loader/volatile-update', (paths) => {
+      if (!Array.isArray(paths) || !paths.some((path) => Array.isArray(path) && path[0] === 'pwshTool')) return
+      for (const agent of tracked.keys()) {
+        try { reconcile(agent) } catch (error) { log(`pwsh switch update failed: ${error?.message ?? error}`) }
+      }
+    })
     // MOUNT-TIME SWEEP (v0.35.2): agents that already exist when this row
     // mounts never fire agent/created. Same shape the proven dsh-ops denial
     // uses.
@@ -346,16 +419,6 @@ export function mountInlineTools(ctx, deps) {
     return
   }
 
-  ctx.effect(() => () => {
-    for (const agent of [...tracked.keys()]) teardown(agent)
-    tracked.clear()
-    if (bashOnce) {
-      void Promise.resolve(bashOnce).then(({ executorScope } = {}) => {
-        try { executorScope?.dispose?.() } catch { /* already gone */ }
-      }).catch(() => {})
-      bashOnce = undefined
-    }
-  }, 'dsh-gitbash-shell: inline tool patching')
 }
 
 // The host-package resolution channel lives in bash-tool.js; import it for