dsh-gitbash-shell 0.40.1 → 0.40.3

package/CHANGELOG.md

@@ -3,8 +3,33 @@
 > 倒序排列,新版本条目在最上面。条目格式:`## vX.Y.Z — YYYY-MM-DD` + 类型(feat / fix / docs / chore)+ 要点 + 相关链接。
 > 纪律见 AGENTS.md「变更记录纪律」:发版前先更新本文件并随版本提交;事故复盘、复现与真机验证记录也记在这里。
 
+## v0.40.3 — 2026-10-17
+
+### gitBash 能力服务新增 `pwshToolEnabled`(feat,additive——配对 dsh-ptc-cordis-preset v0.20.1)
+
+- **背景**:PTC 创造模式(ptc-cordis preset)的 pwsh 可见性矩阵有个残余不一致——gitbash-shell 单独安装且用户开启 `pwshTool` 开关时,官方 PTC/标准模式有 pwsh(遮蔽层放行、翻译层保护),而 ptc-cordis 组合仍禁(v0.20.0 只探测 dsh-ops 的 `opsPresent`,看不到本插件的私有设置)。跨插件没有读对方 config 的通道,唯一干净做法是把判定结果发布在已有的 `gitBash` 能力服务上。
+- **改动**:`gitBashCapability` 新增 `get pwshToolEnabled()` —— 返回 `liveSettings.pwshTool() === true`,与遮蔽层(`src/inline-tools.js` 的 `pwshVisible` 判定)**同一读取器、同一语义**:能力字段回答的就是「pwsh 行此刻对本机 agent 是否可见」。纯 additive(先例:`ok/source` v0.28.0、`inlinePatched` v0.35.1),老消费方忽略新字段。
+- **接线重排**:`const liveSettings = makeLiveReader(ctx, config)` 从能力服务之后提升到之前——getter 共享同一 reader,且声明先于能力对象构造,杜绝任何同步读取路径上的 TDZ。
+- **测试**:smoke 源码断言补 getter 形状 + liveSettings 必须先于 `gitBashCapability` 声明(防 TDZ 复发)。236 tests / 235 pass / 1 skip / 0 fail。
+- **消费方**:dsh-ptc-cordis-preset v0.20.1 起,组合条件从 `gitBashActive && !opsPresent` 扩为再 `&& !peerPwshTool`,「手动开 pwshTool、不装 dsh-ops」场景下 PTC 创造与官方模式一致放行。
+
+## v0.40.2 — 2026-10-17
+
+### 适配 dsh 0.2.1-alpha.5(0.2.1-rc.1 与其同码):组合对齐重跑 + exit-status 解析器跟齐(feat / fix / test)
+
+- **组合行集跟随官方 0.2.1-alpha.3..alpha.5**(行 id 零改名;`tests/align-official.mjs` 重 pin 四枚 SHA256 后全绿):
+  - 官方在 alpha.3 **删除**了 subagent/subagent_fork 的 `toolFilter.deny`(`schedule_*` 四项——官方提醒工具重新可达子代理):插件侧 `subagentDeny` 整体删除,任何探针组合都不再产出 deny,与官方逐字节一致。
+  - alpha.4 给三个全工具 preset 新增 `tool-plugin-market` 行(紧跟 `tool-plugin-manager`;standard/ptc `disabled: true`,cordis `!!js !ctx.get('profileContext')`):挂新探针 `pluginMarket`(探测 `@deepseek-ai/dsh-plugin-market/tools`),disabled 分法与 manager 相同。
+  - alpha.3 给 **minimal** 新增 image-only `tool-fs`(`{read:false, readImage:true, write:false, edit:false}`)与专属 compaction 组(`isolate` 仅 `{compaction:true}`,**无** tool-result-pruner 行):`minimalPluginsFor` 增加 `hostExtras` 参数,挂 `compaction` 探针(探测 `@deepseek-ai/dsh-compaction-basic`)——minimal 不再是「永不加行」。
+  - `probeHostExtras` 扩为四探针(新增 plugin-market/tools、compaction-basic),返回 `{ timeContext, toolSchedule, pluginMarket, compaction }`;注册日志行同步;缺包/旧宿主仍保持 0.1.7 逐字节行集。
+- **exit-status 解析器 null 感知(fix)**:`parseExitStatus` 的 exit 正则 `/(\d+)/` → `/(-?\d+|null)/`、`'null'` → `null`。官方 0.2.1-alpha.5 把 `TerminalResultView.exitCode` 放宽为 `number | null`(正常结束但无退出码),客户端卡模型(ui-tool `terminal-card-model.ts`)已解析 `[exit code: null]`,而本插件的移植解析器会把该标记当「未匹配」错落 `exitCode: 0`(读作成功)。本解析喂的是 terminal 卡(镜像 client 侧读法),故对齐 client 实现;官方服务端 `dsh-shell render.ts` 的同名解析器仍为 `(\d+)` 未跟(如实记录,不抄)。生产端 `renderResult` 对 `exitCode: null` 本就打出 `[exit code: null]`(与官方 background 断言一致),bash 工具 schema 早已允许 `integer|null`,均无需改。
+- **测试同步**:`smoke.mjs` era 测试重写(默认无行 + probe-on 官方槽位 + deny **不得再出现** + minimal 四行断言)、`probeHostExtras` deepEqual 四键形状、minimal 接线正则(现在传 `hostExtras`)、`parseExitStatus` 加 null 例;`compatibility-regressions.mjs` 加 producer/parser 的 null 往返;`host-preview.mjs` hostExtras 形状同步。
+- **元数据**:version 0.40.2;`dsh.compatibility.dshReleases` 增 `0.2.1-alpha.3`/`alpha.4`/`alpha.5`/`0.2.1-rc.1`(rc.1 于 2026-10-17 发布,与 alpha.5 同码——全仓 diff 仅 355 个 package.json 版本号 bump,align-official 对 rc.1 树复跑四 SHA 全绿;依据:静态对齐 + 全量回归;**Windows 双端真机验证待做**,发版前按家族纪律补)。
+- 相关:dsh v0.2.1-alpha.3/4/5 Release;`tests/align-official.mjs`(需 dsh checkout,不属于 `npm test`)。
+
 ## v0.40.1 — 2026-10-15
 
+
 ### 清理 gitbash_native 的两个死配置读取（chore）
 
 - 删除 `gitbash_native` 模块对 `config.enableRunInBackground`/`config.promoteOnTimeout` 的读取（[v0.40.0 已知项](#v0400--2026-10-15)就此销账）：该模块由 inline 接线**手动挂载在 agent scope**（`scope.ctx.plugin({...module})` 无参调用），行/执行器 Config 不可达，两个字段自 v0.40.0 起读到的恒为 undefined、按 `!== false` 恒开——是"没接线的开关面板"而非活门控。清理后行为一个字节不变：`background` 仅由 Jobs 注册表在场决定（这正是实际生效的逻辑），超时转 Job 跟随后台可用性；用户级开关仍是 `experimentalNative` 总闸（要关 native 后台只能整体关闭 native/path，官方 tool-bash 的同名活开关不受影响）。

package/README.md

@@ -70,10 +70,13 @@ Git Bash 增量;跟随 dsh 升级的对齐由冒烟测试
 **preset id 保持 `code-gitbash` 不变**——会话钉在 id 上,dsh 0.1.2 把内置 `code`
 改名 `ptc` 时本插件的变体 id 就没有跟随(改名会让已固定的会话报 preset not found)。
 
-**dsh 0.2.1 增量自动随行(v0.34.0)**:官方 0.2.1 给全工具 preset 加了时间上下文
-(`time-context`)与提醒工具(`schedule_*`,子代理不可用)——本插件在 0.2.1+ 宿主上
-探测到对应包即自动把这两行与 subagent 的 schedule_* deny 纳入三个全工具变体
-(极简变体不加,与官方一致);旧宿主行为逐字节不变,**无需为此升级 dsh**。
+**dsh 0.2.1 增量自动随行(v0.34.0 起,v0.40.2 对齐 alpha.5)**:官方 0.2.1 给全工具
+preset 加了时间上下文(`time-context`)与提醒工具(`schedule_*`);alpha.3 又把这两行
+从 subagent 的 `toolFilter.deny` 里移除(提醒工具重新可达子代理),给极简变体加了
+image-only `tool-fs` 与专属 compaction 组,alpha.4 给全工具 preset 加了插件市场
+(`tool-plugin-market`)。本插件在 0.2.1+ 宿主上探测到对应包即自动把上述行纳入变体
+(全工具三变体随探针取 `time-context`/`tool-schedule`/`tool-plugin-market`,极简
+变体只取 compaction 增量,与官方一致);旧宿主行为逐字节不变,**无需为此升级 dsh**。
 
 ## 安装(公开 npm 插件,推荐)
 

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-gitbash-shell",
-  "version": "0.40.1",
+  "version": "0.40.3",
   "main": "./src/index.js",
   "description": "Windows 全模式 Git Bash:自带 bash 工具(私有 Git Bash 执行器实例,官方 PowerShell 执行器原样保留),官方四个模式经行内工具补位直接获得 Git Bash(v0.35.0 起;v0.39.0 起不再替换宿主执行器),四个 *·Git Bash 变体 preset 可开关;官方 pwsh 工具默认隐藏、开关可见(真 PowerShell);附带 gb_* FastCtx 文件工具,检测到 dsh-ops 自动让位。联动:dsh-ptc-cordis-preset(PTC 创造模式带 Git Bash 行且可去重)+ dsh-better-sidebar(终端标签自动切 Git Bash)。",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-gitbash-shell",
-  "version": "0.40.1",
+  "version": "0.40.3",
   "description": "Windows 上给 agent 一个真正的 Git Bash 命令工具:私有 Git Bash 执行器实例(官方 PowerShell 执行器原样保留),统一 MSYS 盘根路径方言,官方 pwsh 工具默认隐藏可开关,物化四个内置预设的 Git Bash 变体,侧栏终端接管可开关。· Give agents a real Git Bash tool on Windows: a private Git Bash executor instance (the official PowerShell executor stays untouched), a unified MSYS drive-root path dialect, an opt-in official pwsh tool, and four Git Bash preset variants.",
   "type": "module",
   "repository": {
@@ -36,7 +36,11 @@
       "dshReleases": {
         "0.2.0-rc.2": "compatible",
         "0.2.1-alpha.1": "compatible",
-        "0.2.1-alpha.2": "compatible"
+        "0.2.1-alpha.2": "compatible",
+        "0.2.1-alpha.3": "compatible",
+        "0.2.1-alpha.4": "compatible",
+        "0.2.1-alpha.5": "compatible",
+        "0.2.1-rc.1": "compatible"
       }
     }
   },

package/src/bash-render.js

@@ -48,16 +48,21 @@ export function escalationHintMarker(subject) {
 export const ESCALATION_TARGETS = Object.freeze(['workspace-write', 'danger-full-access'])
 
 /**
- * The official exit-status parse (dsh-shell render.ts:37): the LAST marker
- * line anchors the split between the output body and the exit pill.
+ * The official exit-status parse (the producer twin is dsh-shell render.ts,
+ * the reader twin is ui-tool terminal-card-model.ts — the card reader, which
+ * is what this parse feeds): the LAST marker line anchors the split between
+ * the output body and the exit pill. `null` is the official 0.2.1-alpha.5
+ * widening — the process ENDED without reporting a code; the card model reads
+ * an explicit null as a failure, while the marker-less fallback below still
+ * reads as success.
  * @param {string} text - the rendered result text.
- * @returns {{ body: string, exitCode?: number, signal?: string }}
+ * @returns {{ body: string, exitCode?: number | null, signal?: string }}
  */
 export function parseExitStatus(text) {
   const signal = /\n\[killed by signal: ([^\]\n]+)\]$/.exec(text)
   if (signal && signal[1] !== undefined) return { body: text.slice(0, signal.index), signal: signal[1] }
-  const exit = /\n\[exit code: (\d+)\]$/.exec(text)
-  if (exit && exit[1] !== undefined) return { body: text.slice(0, exit.index), exitCode: Number(exit[1]) }
+  const exit = /\n\[exit code: (-?\d+|null)\]$/.exec(text)
+  if (exit && exit[1] !== undefined) return { body: text.slice(0, exit.index), exitCode: exit[1] === 'null' ? null : Number(exit[1]) }
   return { body: text, exitCode: 0 }
 }
 

package/src/compositions.js

@@ -7,12 +7,14 @@
  * of the committed assets/<variant>/agent.cordis*.yml texts the materializer
  * writes on older hosts.
  *
- * Every variant mirrors the official 0.1.7 preset it replaces (packages/
- * bundle/web-app/presets/{standard,minimal,ptc,cordis}.patch.yml) with the
- * Git Bash routing: full variants keep the official platform-gated shell
- * rows, and the inline patch adds OUR bash over a private executor on Windows.
- * The minimal variant instead keeps its persistent Git Bash terminal rows.
- * On non-Windows hosts the official stack stays native. A conditional delta exists while
+ * Every variant mirrors the official preset it replaces (packages/bundle/
+ * web-app/presets/{standard,minimal,ptc,cordis}.patch.yml) with the Git Bash
+ * routing: full variants keep the official platform-gated shell rows, and the
+ * inline patch adds OUR bash over a private executor on Windows. The minimal
+ * variant instead keeps its persistent Git Bash terminal rows. On non-Windows
+ * hosts the official stack stays native. Host-release deltas ride hostExtras
+ * probes (the block below the header rows) — each probe keeps the base set
+ * byte-identical to the 0.1.7 mirror. A conditional delta exists while
  * dsh-ptc-cordis-preset reports its experimental-CPython backend ACTIVE: the
  * two workflow rows follow the official Python composition and go off (see
  * `pythonActive` below). While that backend is off — the default, and also
@@ -82,18 +84,18 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
   const bashDisabled = win
   const pwshDisabled = !win
   const workflowOn = kind !== 'ptc' && pythonActive !== true
-  // dsh 0.2.1 added two rows to every full-tool official preset — time-context
-  // (durable clock readings) and tool-schedule (the reminder tools) — plus a
-  // toolFilter deny of the four schedule_* tools on the subagent/subagent_fork
-  // configs (reminders never reach a subagent). A preset row whose package is
-  // absent rejects the WHOLE mount, so these ride a host probe (index.js
-  // probeHostExtras, resolved from ctx.baseUrl — the base rows mount from);
-  // absent/older hosts keep the byte-identical 0.1.7 row set. The deny list
-  // follows toolSchedule alone: denying tools that do not exist is noise.
-  const { timeContext = false, toolSchedule = false } = hostExtras
-  const subagentDeny = toolSchedule
-    ? { toolFilter: { deny: ['schedule_create', 'schedule_delete', 'schedule_list', 'schedule_update'] } }
-    : {}
+  // dsh 0.2.1 grew the official full-tool presets across releases, all
+  // row-id-stable: alpha.2 added time-context (durable clock readings) and
+  // tool-schedule (the reminder tools); alpha.3 DELETED the schedule_*
+  // toolFilter deny from the subagent/subagent_fork configs (official
+  // reminders reach subagents again — the deny was never load-bearing,
+  // nothing replaces it); alpha.4 added a tool-plugin-market row to every
+  // full preset. A preset row whose package is absent rejects the WHOLE
+  // mount, so these ride a host probe (index.js probeHostExtras, resolved
+  // from ctx.baseUrl — the base rows mount from); absent/older hosts keep
+  // the byte-identical 0.1.7 row set. The minimal variant carries its own
+  // 0.2.1-alpha.3 delta (tool-fs + compaction) behind the compaction flag.
+  const { timeContext = false, toolSchedule = false, pluginMarket = false, compaction = false } = hostExtras
   const rows = [
     {
       id: 'persona',
@@ -170,12 +172,12 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
         {
           id: 'tool-subagent',
           name: '@deepseek-ai/dsh-tool-subagent',
-          config: { provider: 'spawn', toolName: 'subagent', modelSelectionSettings: true, ...(timeContext ? {} : { backgroundMode: 'continuable' }), ...subagentDeny },
+          config: { provider: 'spawn', toolName: 'subagent', modelSelectionSettings: true, ...(timeContext ? {} : { backgroundMode: 'continuable' }) },
         },
         {
           id: 'tool-subagent-fork',
           name: '@deepseek-ai/dsh-tool-subagent',
-          config: { provider: 'fork', toolName: 'subagent_fork', ...(timeContext ? {} : { backgroundMode: 'continuable' }), ...subagentDeny },
+          config: { provider: 'fork', toolName: 'subagent_fork', ...(timeContext ? {} : { backgroundMode: 'continuable' }) },
         },
         {
           id: 'workflow-ptc',
@@ -226,6 +228,14 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
     // on wherever a profile context exists (every web deployment does).
     ...off(kind !== 'cordis'),
   })
+  if (pluginMarket) {
+    rows.push({
+      // The official 0.2.1-alpha.4 rows: same disabled split as the manager.
+      id: 'tool-plugin-market',
+      name: '@deepseek-ai/dsh-plugin-market/tools',
+      ...off(kind !== 'cordis'),
+    })
+  }
   return rows
 }
 
@@ -241,9 +251,14 @@ export function pluginsFor({ kind, gitBash, skillsDir, pythonActive = false, hos
  *   pins the historical default, so a missing Git stays a VISIBLE spawn
  *   failure — never a substitute shell (issue #15: the hardcoded default
  *   broke every PTY spawn where Git lives outside `C:/Program Files/Git`).
+ * @param {object} [input.hostExtras] - the host probe (probeHostExtras):
+ *   `compaction` true adds the official 0.2.1-alpha.3 minimal rows (an
+ *   image-read-only tool-fs plus the pruner-less compaction group) ahead of
+ *   the terminal.
  * @returns {object[]} the declarative plugins list.
  */
-export function minimalPluginsFor({ bashPath } = {}) {
+export function minimalPluginsFor({ bashPath, hostExtras = {} } = {}) {
+  const { compaction = false } = hostExtras
   const win = typeof process !== 'undefined' && process.platform === 'win32'
   return [
     {
@@ -255,6 +270,27 @@ export function minimalPluginsFor({ bashPath } = {}) {
         includeRuntimeContext: false,
       },
     },
+    ...(compaction ? [
+      {
+        // Official 0.2.1-alpha.3 minimal: image reads ride the fs tool; every
+        // other fs verb stays with the persistent terminal.
+        id: 'tool-fs',
+        name: '@deepseek-ai/dsh-tool-fs',
+        config: { read: false, readImage: true, write: false, edit: false },
+      },
+      {
+        // Official 0.2.1-alpha.3 minimal compaction group: NO pruner row
+        // (isolate carries compaction alone, unlike the full presets).
+        id: 'compaction',
+        name: 'cordis:group',
+        group: true,
+        isolate: { compaction: true },
+        config: [
+          { id: 'compaction-basic', name: '@deepseek-ai/dsh-compaction-basic' },
+          { id: 'command-compact', name: '@deepseek-ai/dsh-command-compact' },
+        ],
+      },
+    ] : []),
     {
       id: 'persistent-shell',
       name: 'cordis:group',

package/src/index.js

@@ -1765,14 +1765,16 @@ function cleanupLegacyTrees(presetIds) {
  * package is absent rejects the WHOLE mount, so the rows ride this probe: each
  * is added only when its package resolves from the HOST's module base —
  * `ctx.baseUrl`, the exact base `prepareProfileEntries` mounts preset rows
- * from, so the probe can never disagree with the mounter. On dsh <= 0.2.0 both
+ * from, so the probe can never disagree with the mounter. On dsh <= 0.2.0 all
  * stay false and the row set stays byte-identical to the 0.1.7 mirror. Probed
  * once per boot; the profile's package set does not change under a running
- * host. minimal never gains the rows (the official minimal preset has none).
+ * host. `compaction` is the one flag minimal consumes (the official
+ * 0.2.1-alpha.3 minimal rows); the rest only shape the full variants.
  * @param {object} ctx - cordis context (any fiber of the running host).
  * @param {Function} [resolve] - predicate override for tests; receives a
  *   package specifier, resolves like `require.resolve`, returns boolean.
- * @returns {Promise<{timeContext: boolean, toolSchedule: boolean}>}
+ * @returns {Promise<{timeContext: boolean, toolSchedule: boolean,
+ *   pluginMarket: boolean, compaction: boolean}>}
  */
 export async function probeHostExtras(ctx, resolve) {
   let ok = resolve
@@ -1787,11 +1789,13 @@ export async function probeHostExtras(ctx, resolve) {
       ok = () => false
     }
   }
-  const [timeContext, toolSchedule] = await Promise.all([
+  const [timeContext, toolSchedule, pluginMarket, compaction] = await Promise.all([
     Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-time-context')).then(Boolean),
     Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-tool-schedule')).then(Boolean),
+    Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-plugin-market/tools')).then(Boolean),
+    Promise.resolve(safeProbe(ok, '@deepseek-ai/dsh-compaction-basic')).then(Boolean),
   ])
-  return { timeContext, toolSchedule }
+  return { timeContext, toolSchedule, pluginMarket, compaction }
 }
 
 /** Run one probe predicate; ANY failure reads as "absent" (a throwing
@@ -1871,7 +1875,7 @@ async function registerVariant(ctx, presetId, { gitBashActive, skillsDir, python
   const meta = PRESET_META[presetId]
   if (!meta) return undefined
   const plugins = meta.kind === 'minimal'
-    ? minimalPluginsFor({ bashPath: minimalPtyBashPath(readBashResolution) })
+    ? minimalPluginsFor({ bashPath: minimalPtyBashPath(readBashResolution), hostExtras })
     : pluginsFor({ kind: meta.kind, gitBash: gitBashActive, skillsDir, pythonActive, hostExtras })
   return ctx.agentPresets.register({
     id: presetId,
@@ -1908,9 +1912,10 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
   cleanupLegacyTrees(presetIds)
   const gitBashActive = process.platform === 'win32'
   const skillsDir = await resolveSkillsDir()
-  // The dsh 0.2.1 additions (time-context / tool-schedule rows) probe once per
-  // boot and ride every (re-)registration below — the profile's package set
-  // cannot change under a running host.
+  // The dsh 0.2.1 additions (time-context / tool-schedule / plugin-market /
+  // minimal compaction rows) probe once per boot and ride every
+  // (re-)registration below — the profile's package set cannot change under a
+  // running host.
   const hostExtras = await probeHostExtras(ctx)
   /** presetId -> unregister, i.e. exactly what is live right now. */
   const live = new Map()
@@ -2007,8 +2012,13 @@ async function runDeclarativeEra(ctx, presetIds, readSuppress, readBashResolutio
   console.log(TAG + ' registered ' + live.size + ' preset(s) declaratively (' + [...live.keys()].join(', ') + ')'
     + (live.size === 0 ? ' — variantPresets is off: the official presets carry Git Bash through the inline tool patch (see the CHANGELOG)'
       : '')
-    + (hostExtras.timeContext || hostExtras.toolSchedule
-    ? ' [dsh 0.2.1 additions: ' + (hostExtras.timeContext ? 'time-context' : '') + (hostExtras.timeContext && hostExtras.toolSchedule ? ' + ' : '') + (hostExtras.toolSchedule ? 'tool-schedule (subagents denied)' : '') + ']'
+    + (hostExtras.timeContext || hostExtras.toolSchedule || hostExtras.pluginMarket || hostExtras.compaction
+    ? ' [dsh 0.2.1 additions: ' + [
+        hostExtras.timeContext ? 'time-context' : '',
+        hostExtras.toolSchedule ? 'tool-schedule' : '',
+        hostExtras.pluginMarket ? 'plugin-market' : '',
+        hostExtras.compaction ? 'minimal compaction' : '',
+      ].filter(Boolean).join(' + ') + ']'
     : ''))
 
   // The peer's capability: `ctx.inject` makes this independent of row order,
@@ -2096,6 +2106,13 @@ export async function apply(ctx, config = {}) {
     console.log(`${TAG} inspect-registry shim wiring failed: ${error?.message ?? error}`)
   }
 
+  // Era-aware live settings: every consumer below re-reads the row Config
+  // refs on every use (volatile), so a flipped knob lands on the next
+  // dispatch with zero wiring. Declared BEFORE the cooperation capability so
+  // its getters share the same reader (v0.40.3 pwshToolEnabled) — the
+  // capability must answer with the exact value the masking layer sees.
+  const liveSettings = makeLiveReader(ctx, config)
+
   // ── cooperation capability ────────────────────────────────────────────────
   // Publish whether the Git Bash shell stack is active on this host so peer
   // plugins (e.g. dsh-ptc-cordis-preset) can adopt it in the presets they
@@ -2130,6 +2147,13 @@ export async function apply(ctx, config = {}) {
     // anything — peers reading this flag drop the suffix (dsh-ptc-cordis-preset
     // v0.17.3+); older peers ignore it and keep the v0.34 wording.
     get inlinePatched() { return process.platform === 'win32' },
+    // Additive (v0.40.3): whether the official pwsh row is VISIBLE for agents
+    // on this host — the exact `pwshTool() === true` verdict the masking layer
+    // reads (src/inline-tools.js hidePwsh), so peers composing the same row
+    // key off one signal instead of re-deriving the switch. Default OFF
+    // (bash-first); the switch is live, so a flip lands on the next read.
+    // Older peers ignore the field and keep the v0.20.0 ops-only behavior.
+    get pwshToolEnabled() { return liveSettings.pwshTool() === true },
     // Kept for existing consumers (peer plugins read `bashPath`): the resolved
     // interpreter. When resolution failed we report the explicit value (or the
     // historical default) so the ENOENT a consumer may hit names a real path —
@@ -2149,11 +2173,6 @@ export async function apply(ctx, config = {}) {
   const disposeGitBash = ctx.provide('gitBash', gitBashCapability)
   ctx.effect(() => disposeGitBash, 'dsh-gitbash-shell: gitBash capability')
 
-  // Era-aware live settings: every consumer below re-reads the row Config
-  // refs on every use (volatile), so a flipped knob lands on the next
-  // dispatch with zero wiring.
-  const liveSettings = makeLiveReader(ctx, config)
-
   // ── official shell-env fact: DSH_PATH_DIALECT (Windows only, gated; v0.11.0) ──
   // dsh-shell-env owns the model-visible $DSH_* facts (host-plane service;
   // the web composition injects it and publishes DSH_WEB_URL beside the