dsh-plugin-wsl-env 0.9.0 → 0.10.0

package/cordis.patch.yml

@@ -187,9 +187,20 @@
     # Because a preset's plugins mount under a REGISTRY-owned scope (not this row's
     # ctx), the realm has to be declared here, inside config.plugins.
     #
-    # Generated from the shipped standard preset by build-preset-wsl.mjs so the
-    # embedded plan-mode section and every nested group survive byte-for-byte.
-    # Re-run it after an app update that changes the preset.
+    # Generated from the shipped standard preset so the embedded plan-mode
+    # section and every nested group survive byte-for-byte: this copy is
+    # `packages/bundle/web-app/presets/standard.patch.yml` of the
+    # `dsh-v0.2.1-rc.2` source tree, changed in exactly three ways —
+    #   1. every shipped row mounts inside `wsl-env`, so the preset's tools see
+    #      the distro's shell and fs (the realm is declared on the group);
+    #   2. `tool-bash` is enabled and `tool-pwsh` disabled outright, where the
+    #      shipped copy derives the choice from `process.platform`;
+    #   3. the identity: row `preset-wsl`, preset `wsl`, `order: 2`.
+    # Regenerate it when an app update changes the preset: take
+    # `packages/bundle/web-app/presets/standard.patch.yml` from the harness tree
+    # the peer pins track and run `node scripts/build-preset-wsl.mjs <that
+    # file>`, then replace this row to the end of the file. The script applies
+    # changes 1 and 2 itself, so only change 3 is yours.
     # ═════════════════════════════════════════════════════════════════════════════
     - id: preset-wsl
       name: '@deepseek-ai/dsh-agent-preset'
@@ -209,12 +220,15 @@
               # asked of the distro itself. Pin a directory here to override it —
               # a value that is right on one machine is wrong on every other.
               #
-              # Each command is confined inside the distro by bubblewrap, in the
-              # policy's mode, and the file tools are fenced by the same policy.
-              # Install bubblewrap there (`sudo apt install bubblewrap`); without
-              # it the providers fail closed rather than run unconfined. Add
-              # `sandbox: false` to either provider for the old, unconfined
-              # posture.
+              # Commands run in one persistent systemd user scope per session
+              # (ADR 0001): a background dev server survives the command that
+              # started it, `/tmp` is the distro's real `/tmp`, and `ps` sees the
+              # session. This needs systemd as PID 1 (`[boot] systemd=true` in
+              # /etc/wsl.conf) and a lingering user manager (`loginctl
+              # enable-linger <user>`); the preflight refuses with those remedies
+              # when one is missing. Set `sessionSandbox: false` for the old
+              # per-command shape. Bubblewrap is still required for the mount
+              # profile; without it the providers fail closed.
               - id: wsl-shell
                 name: 'dsh-plugin-wsl-env'
                 config:
@@ -222,6 +236,13 @@
                   loginShell: true
                   timeoutMs: 120000
                   maxTimeoutMs: 600000
+                  sessionSandbox: true
+                  # auto: the native session-runtime agent when a verified
+                  # source is available (packaged binary, or the
+                  # DSH_WSL_AGENT_NATIVE development override); otherwise the
+                  # shipped shell agent. native fails the first command instead
+                  # of falling back; shell forces the shell agent.
+                  agentBackend: auto
               - id: wsl-fs
                 name: 'dsh-plugin-wsl-env/fs'
                 config:
@@ -234,15 +255,19 @@
                   # share: the opt-out — the Windows-side host fs stack over
                   # the 9p share.
                   substrate: agent
+                  # Confined writes ride the session runtime (ADR 0001), so they
+                  # share the command's real /tmp and workspace mounts.
+                  sessionSandbox: true
               - id: persona
                 name: '@deepseek-ai/dsh-persona'
                 config:
-                  suffix: Your working directory is {{cwd}}.
                   prefix: You are a coding agent powered by the {{model}} model.
               - id: agent-instructions
                 name: '@deepseek-ai/dsh-agent-instructions'
                 config:
                   maxBytes: 65536
+              - id: time-context
+                name: '@deepseek-ai/dsh-time-context'
               - id: tool-bash
                 name: '@deepseek-ai/dsh-tool-bash'
                 disabled: false
@@ -257,6 +282,8 @@
                   sampleOverCapGlobResults: false
               - id: tool-jobs
                 name: '@deepseek-ai/dsh-tool-jobs'
+              - id: tool-schedule
+                name: '@deepseek-ai/dsh-tool-schedule'
               - id: skill-filesystem
                 name: '@deepseek-ai/dsh-skill-filesystem'
               - id: tool-skill
@@ -275,7 +302,7 @@
                     name: '@deepseek-ai/dsh-plan-mode'
                     config:
                       section: |
-                        You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+                        You are in plan mode. Stay in plan mode until the user approves your plan through exit_plan_mode or switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
 
                         Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
 
@@ -319,41 +346,17 @@
                       provider: spawn
                       toolName: subagent
                       modelSelectionSettings: true
-                      backgroundMode: continuable
                   - id: tool-subagent-fork
                     name: '@deepseek-ai/dsh-tool-subagent'
                     config:
                       provider: fork
                       toolName: subagent_fork
-                      backgroundMode: continuable
-                  - id: tool-subagent-codex
-                    name: '@deepseek-ai/dsh-tool-subagent'
-                    disabled: true
-                    config:
-                      provider: codex
-                      toolName: subagent_codex
-                      backgroundMode: one-shot
-                      maxDepth: provider-managed
-                  - id: tool-subagent-claude-code
-                    name: '@deepseek-ai/dsh-tool-subagent'
-                    disabled: true
-                    config:
-                      provider: claude-code
-                      toolName: subagent_claude_code
-                      backgroundMode: one-shot
-                      maxDepth: provider-managed
                   - id: workflow-ptc
                     name: '@deepseek-ai/dsh-workflow-ptc'
                     config:
                       provider: spawn
                   - id: tool-workflow
                     name: '@deepseek-ai/dsh-tool-workflow'
-                  - id: tool-ralph
-                    name: '@deepseek-ai/dsh-tool-ralph'
-                    disabled: true
-                    config:
-                      subagentProvider: spawn
-                      maxRounds: 64
               - id: tool-ask-user
                 name: '@deepseek-ai/dsh-tool-ask-user'
               - id: tool-todo
@@ -370,3 +373,6 @@
               - id: tool-plugin-manager
                 name: '@deepseek-ai/dsh-plugin-manager/tools'
                 disabled: true
+              - id: tool-plugin-market
+                name: '@deepseek-ai/dsh-plugin-market/tools'
+                disabled: true

package/docs/ARCHITECTURE.md

@@ -198,6 +198,14 @@ wsl.exe -d <distro> --cd <linux dir> --exec bwrap \
   [--tmpfs /tmp --bind <workspace> <workspace>]  [--tmpfs /mnt]  --  <shell> -lc <cmd>
 ```
 
+By default the profile wraps the session's resident agent ONCE, under
+`systemd-run --user --scope`, and the command argv is the shell line itself:
+`bwrap … --die-with-parent --bind /tmp /tmp --bind <workspace> <workspace> -- sh agent.sh`.
+There is no `--unshare-pid` and no per-command tmpfs, so background processes
+survive, `/tmp` is the distro's real `/tmp`, and `ps` sees the session. The
+per-command argv above is what `sessionSandbox: false` (and the one-shot
+fallback) still runs.
+
 These are the same arguments DSH's Linux runner uses (`dsh-sandbox-local`), so the
 behaviour and the error messages match a Linux host. The function
 `bwrapProfileArgs` in [`lib/bwrap.js`](../lib/bwrap.js) builds them — the
@@ -211,7 +219,7 @@ the row keys, and `lib/sandbox-core.js` states its honest ceiling.
 | Mode | What a command inside the distro can do |
 |---|---|
 | `read-only` | read the whole distro; a fresh `/dev` is mounted writable, so `/dev/null` and `/dev/shm` work, and nothing else does |
-| `workspace-write` | the above, plus the session workspace is writable and `/tmp` is a temporary mount |
+| `workspace-write` | the above, plus the session workspace is writable; `/tmp` is the distro's real `/tmp` in the session runtime, and a fresh tmpfs in the per-command profile (`sessionSandbox: false`) |
 | `danger-full-access` | no sandbox; used for an approved wider-permission request |
 
 `WslFileSystem` checks writes against the same policy and the same writable list,

package/docs/CONFIGURATION.md

@@ -26,6 +26,8 @@ has its own table at the end of this page.
 | | `shell` | `''` | pin a shell inside the distro; empty means the user's login shell |
 | | `loginShell` | `true` *(shipped)* | use `<shell> -lc`, which sources your profile, instead of a bare `-c`. Applies only to the POSIX family; a non-POSIX shell (fish, csh) still gets a bare `-c` |
 | | `agent` | `true` | run commands over the resident in-distro agent (one long-lived process; in-distro timeout); the one-shot `wsl.exe` path is fallen back to only when the agent is out of service. Anything else — a cwd refusal, a sandbox refusal — is the command's own verdict and is raised, not retried on the other path |
+| | `sessionSandbox` | `true` *(shipped)* | run this session's commands in one persistent systemd user scope (ADR 0001): a background dev server survives the command that started it, `/tmp` is the distro's real `/tmp` under `workspace-write`, and `ps` sees the session. The executor holds the runtime for the session and stops the scope from the preset's disposer, which reaps the cgroup. Requires `agent: true`, systemd as PID 1, a reachable user manager and `Linger` (`loginctl enable-linger <user>`); the preflight refuses with the remedy when systemd, the user manager, `systemd-run` or `Linger` is missing (a success is cached; a failure is re-probed, so following the remedy needs no app restart). On in the shipped preset; set `false` for the per-command shape |
+| | `agentBackend` | `auto` | the session runtime's in-distro agent. `auto` uses the native agent when a verified source is available — the packaged per-arch static-musl binary at `agent/native/linux-<arch>/dsh-wsl-agent` (x86_64 and aarch64; runs on glibc and musl distros), or the `DSH_WSL_AGENT_NATIVE` development override — and otherwise the shipped shell agent; `native` fails the first command when it cannot prepare instead of silently falling back; `shell` forces the shell agent. Confined writes share the runtime, so they follow the same selection. The native backend is the default (static musl x86_64/aarch64); the shell agent is the fallback, and `native` refuses instead of falling back |
 | | `sandbox` | `true` | confine commands with `bubblewrap`; `false` disables the sandbox. Needs a usable `bwrap` inside the distro and fails closed without one (`SANDBOX_UNAVAILABLE`, never an unconfined run) — see [Turning the sandbox off](#turning-the-sandbox-off) |
 | | `maskWindowsDrive` | `false` | shadow `/mnt` with an empty tmpfs in every confined profile: the Windows drive's files cannot be read or exfiltrated and its executables cannot be launched through interop — the hole that lets a "sandboxed" command reach your full Windows token. A narrowing, not a closure (a command can still write an executable into the workspace and run it — binfmt dispatches on content, not location), so enforcement stays `partial` and the result's sandbox fact reports `windowsDrive: "masked"`. The complete closure is distro-level: `[interop] enabled=false` in `wsl.conf` |
 | | `cwd` | `''` | default working directory; empty means the distro user's home |
@@ -34,15 +36,16 @@ has its own table at the end of this page.
 | | `restrictToDistro` | `true` *(shipped)* | refuse a path in **another distro**'s share. `/mnt/c` is a directory *inside* the pinned distro, so it is not affected. The refusal carries `FS_OUTSIDE_DISTRO`; that is not a sandbox decision, so the file tools do not offer a wider permission for it. Set `false` to allow another distro's share |
 | | `sandbox` | `true` | check `writeText` and `editText` against the policy. Needs a usable `bwrap` in the distro too, and fails closed the same way: a distro without one refuses confined mutations (`FS_IO_ERROR`, with the install guidance) rather than downgrading them |
 | | `maskWindowsDrive` | `false` | as on `wsl-shell`: confined fs mutations publish through a resident whose profile shadows `/mnt` (same honest limits) |
+| | `sessionSandbox` | `true` *(shipped)* | run confined mutations in the same session runtime the shell uses for the same `(distro, workspace, policy)` — one agent, one real `/tmp`, one workspace mount view; requires the same systemd/linger setup and the preflight refuses with the remedy. Set `false` for the per-policy confined resident. The app-level `fs-routing` backend is not session-owned and keeps this off |
 | | `substrate` | `agent` *(shipped)* | which I/O substrate serves the file tools. Only the resident in-distro agent (`lib/fs-substrate.js`) exists: reads, writes and identities run on ext4 — native symlinks, native mode bits, and the mutation guard survives to the write's atomic publication, kernel-enforced by the confined resident when the policy is confined. The former `share` opt-out (the Windows-side host stack over the 9p share) is refused at boot; delete the line. The comment shipped beside this key in `cordis.patch.yml` still calls `share` the opt-out — that comment is out of date, and the boot refusal is what runs |
 | | `cwd` | `''` | base directory for relative paths; empty means the distro user's home |
-| | `watchMaxDepth` | `0` | how deep the in-distro watch scan walks; `0` walks the whole tree. Bound it (e.g. `4`) when the watched tree holds a `node_modules` — a change below the bound is seen only when another change above it fires the same callback |
+| | `watchMaxDepth` | `0` | how deep the in-distro watch scan walks; `0` walks the whole tree and enables the inotify backend. A positive value keeps the polling scan (inotify cannot bound its walk); a change below the bound is seen only when another change above it fires the same callback |
 | `fs-routing` | `distro` | `''` *(shipped)* | which distro the root-plane filesystem routes to; empty resolves WSL's default. **A row of its own**, with its own copy of the distro knobs — changing `wsl-fs` does not change this one, nor the other way round |
 | | `wslPath` | `wsl.exe` *(shipped)* | path to `wsl.exe`; used here only to resolve the default distro |
 | | `sandbox` | `true` *(shipped)* | fence routed mutations by `ctx.sandboxPolicy`; same `bwrap` requirement and fail-closed refusal as `wsl-fs`. The routing row reports no `sandboxMode` — `undefined` whether the fence is on or off |
 | | `maskWindowsDrive` | `false` *(shipped)* | as on `wsl-shell`, for routed mutations |
 | | `restrictToDistro` | `true` *(shipped)* | refuse a path in another distro's share (`FS_OUTSIDE_DISTRO`) |
-| | `watchMaxDepth` | `0` *(shipped)* | how deep the routed watch scan walks; `0` walks the whole tree |
+| | `watchMaxDepth` | `0` *(shipped)* | how deep the routed watch scan walks; `0` walks the whole tree and enables the inotify backend; a positive value keeps the polling scan |
 | | `distroCwd` | `''` | the routed backend's default workdir; empty means the distro user's home. `cwd` belongs to the host backend only — the distro side reads `distroCwd` — while `diffBasisMaxBytes` is shared: it bounds the overwrite diff on both sides |
 | `workspace-files-wsl` | `maxBytes` | `2097152` *(shipped)* | byte cap on one page of a text read, and the default byte window of a byte read |
 | | `maxFileBytes` | `33554432` *(shipped)* | full-file byte cap for the byte reader |
@@ -138,7 +141,7 @@ above. They all keep their defaults:
 |---|---|---|---|
 | `wsl-shell` (in `preset-wsl`) | `wslPath` | `wsl.exe` | path to `wsl.exe`, for an installation that is not on `PATH` |
 | | `hostCwd` | unset → `%SystemRoot%` | the Windows directory the `wsl.exe` process itself starts in |
-| | `forwardEnv` | `[]` | extra host environment variable names to forward into the distro through `WSLENV`. This is the one key here that widens what crosses the boundary: `NO_COLOR`, `TERM`, `PAGER`, `GIT_PAGER`, `LANG`, `LC_ALL` and every managed `DSH_*` name ride along without it, and `PATH` is deliberately never forwarded |
+| | `forwardEnv` | `[]` | extra host environment variable names to forward into the distro through `WSLENV`. This is the one key here that widens what crosses the boundary: `NO_COLOR`, `TERM`, `PAGER`, `GIT_PAGER`, `LANG`, `LC_ALL` and every managed `DSH_*` name ride along without it, and `PATH` is deliberately never forwarded. It applies to the **one-shot `wsl.exe` path**; the resident agent's environment stays pinned to the managed `DSH_*` namespace and deliberately does not forward these names, so a secret listed here does not widen every model command in the session |
 | `wsl-fs` (in `preset-wsl`) | `wslPath` | `wsl.exe` | as above; used only to resolve the default distro |
 | | `diffBasisMaxBytes` | `10485760` | UTF-8 byte limit per side of an overwrite diff; a larger file publishes without a diff |
 | `fs-routing` | `cwd`, `diffBasisMaxBytes` | `process.cwd()`, `10485760` | `cwd` configures the host side only (the distro side reads `distroCwd`); `diffBasisMaxBytes` is shared by both — it also bounds the routed backend's overwrite diff |
@@ -226,4 +229,4 @@ behind the fail-closed choices above are in [LIMITATIONS.md](LIMITATIONS.md).
 | Key | Default | Meaning |
 | --- | --- | --- |
 | `distro` | `''` | the distro the `DSH_WSL_*` facts describe |
-| `portsRefreshMs` | `10000` | how often the `DSH_WSL_PORTS` listening-port snapshot refreshes through the resident agent |
+| `portsRefreshMs` | `10000` | how often the `DSH_WSL_PORTS` listening-port snapshot refreshes through the resident agent. A failed scan keeps the last successful list (and a debug line), so a transient agent outage does not read as “no ports”; only a successful empty scan means none were listening |

package/docs/LIMITATIONS.md

@@ -71,14 +71,20 @@ crosses the 9p share. What to know about the one substrate there is:
   when `bubblewrap` itself is missing, so a distro that has bwrap but not rg
   needs the printed line run by hand. A search whose directory is a Windows
   folder keeps the host binary, which is native there.
-- **`watch()` is one poll loop** (a `find -newer` scan inside the distro), so
-  the coarse-invalidation caveats below apply. An inotify backend is planned,
-  not shipped.
-- **A confined command's `/tmp` is not the write tool's `/tmp`.** `workspace-write`
-  mounts a fresh tmpfs at `/tmp` for the command — that is what makes it ephemeral —
-  while the file tools' fence grants the distro's *real* `/tmp`. Both are writable, so
-  neither side is refused, but a file the write tool puts in `/tmp` is invisible to
-  `bash` and vice versa. Hand a file between them through the session workspace.
+- **`watch()` prefers inotify, with a polling fallback.** When `inotifywait`
+  is installed and the target is an unbounded directory, the watcher uses
+  recursive inotify watches and coalesces events to one callback per 0.5s.
+  Otherwise — a file target, a positive `maxDepth`, or no `inotify-tools` — it
+  is the `find -newer` poll loop (a `stat` fingerprint for a file), so the
+  coarse-invalidation caveats below apply.
+- **With `sessionSandbox: false`, a confined command's `/tmp` is not the write
+  tool's `/tmp`.** `workspace-write` mounts a fresh tmpfs at `/tmp` for the
+  command — that is what makes it ephemeral — while the file tools' fence grants
+  the distro's *real* `/tmp`. Both are writable, so neither side is refused, but a
+  file the write tool puts in `/tmp` is invisible to `bash` and vice versa. Hand
+  a file between them through the session workspace. The shipped preset turns
+  the session runtime on, and `wsl-fs` shares it for confined writes, so
+  commands and writes bind the same real `/tmp` and workspace.
 - A distro that is stopped or unregistered while the app runs takes the file
   tools' substrate with it: reads and writes report the substrate-unavailable
   error naming the cause. A death with nothing in flight costs nothing — the
@@ -87,20 +93,49 @@ crosses the 9p share. What to know about the one substrate there is:
   rebuild, and when that rebuild cannot complete — the distro is still down, or
   gone — the resident is permanently out: every later file operation fails the
   same way until the app restarts.
-- `watch()` observes from inside the distro (a `find -newer` poll loop, see
-  `lib/watcher.js`), so events are coarse invalidation, not per-file notifications,
-  and they arrive on the poll cadence, not instantly. A creation is seen even when
-  the new file's own mtime is old: creating it bumps the containing directory's
-  mtime, and the scan includes the watched directory itself (deletions are seen the
-  same way). What escapes the stamp is a change that leaves every scanned mtime
-  older than it — an in-place `cp -p` onto an existing file (new content, a
-  copied-back mtime), or a `tar -x` whose archive restores the containing
-  directory's own mtime. Watching a 9p share from the Windows side remains
-  unsupported — the loop runs where the kernel can actually report change.
+- `watch()` observes from inside the distro, so callbacks are coarse
+  invalidation, not per-file notifications. With inotify they arrive as events
+  (coalesced to 0.5s); with the polling fallback they arrive on the poll
+  cadence, not instantly. In the polling path a creation is seen even when the
+  new file's own mtime is old: creating it bumps the containing directory's
+  mtime, and the scan includes the watched directory itself (deletions are seen
+  the same way). What escapes the polling stamp is a change that leaves every
+  scanned mtime older than it — an in-place `cp -p` onto an existing file (new
+  content, a copied-back mtime), or a `tar -x` whose archive restores the
+  containing directory's own mtime. That blind spot does not apply to the
+  inotify path. A FILE target is watched by its `mtime:size` fingerprint: a
+  rename-over or an in-place write fires, a removal reports the target as gone,
+  and a change that preserves both mtime and size escapes it. Watching a 9p
+  share from the Windows side remains unsupported — the loop runs where the
+  kernel can actually report change.
 - `editText` reads the whole file into memory before writing it back.
 
 ## The sandbox
 
+- **The one-shot fallback has only the host deadline.** With `agent: false`, or
+  when the resident is out of service, a command runs through a fresh
+  `wsl.exe`. The host kills `wsl.exe` at the timeout, but WSL does not relay
+  that kill into the distro, so the Linux-side process tree can outlive the
+  call. The session runtime path — the shipped default — is cleaned by its
+  scope. A systemd-scoped one-shot (with explicit environment pass-through) is
+  not shipped; prefer `agent: true` and the session runtime for long commands.
+- **The native backend is the default; aarch64 is build-tested only.** The
+  packaged x86_64 musl binary runs the 18-check suite in CI. The same job
+  builds the aarch64 binary, but the runner cannot execute it, so its
+  functional validation on real aarch64 hardware (or qemu) is still pending.
+  `agentBackend: auto` still selects it on an aarch64 distro; `native` refuses
+  if preparation fails, and `shell` forces the shell agent.
+- **The session runtime needs systemd and a lingering user manager.** The
+  shipped preset sets `sessionSandbox: true`; a distro without systemd as PID 1,
+  a reachable `systemd --user`, `systemd-run`, or `Linger` is refused on the
+  first command with the remedy. Set `sessionSandbox: false` on the preset's
+  `wsl-shell` to keep the per-command shape. A **hard crash** of the app can
+  leave a stale `dsh-wsl-*.scope` and its background processes behind; a
+  graceful session end stops the scope (validated). The session preflight
+  sweeps stale scopes when the next WSL session opens: it stops a
+  `dsh-wsl-*.scope` only when its cgroup has no agent process (`wsl-agent.sh`
+  or the native `dsh-wsl-agent`), so another live session's runtime is never
+  touched.
 - **The sandbox does not govern WSL interop.** A confined command can still run a
   Windows program, which escapes the Linux-side boundary. The plugin reports this as
   `enforcement: partial`. See [ARCHITECTURE.md](ARCHITECTURE.md#reported-enforcement).

package/docs/PARITY.md

@@ -7,7 +7,9 @@ deviation, if any, still stands.
 
 Verified against: `dsh-plugin-wsl-env@0.8.0` / peer `0.2.0-rc.2` / agent
 protocol v4, 2026-10-06. Update this line when the peer pin or the agent
-protocol moves.
+protocol moves. The peer pin moved to `0.2.1-rc.2` on 2026-10-17 with every
+seam package's shipped artifact byte-identical to the ones these rows were
+measured against; the real-machine probes were not re-run in that move.
 
 ## What parity means here
 

package/docs/PEER-PARITY.md

@@ -7,12 +7,18 @@ same refusal dialect on both substrates. The **read path** holds end to end;
 the **edit path** carries two declared divergences, listed at the end. This
 file records the verification against the real peers.
 
-- Peers: `@deepseek-ai/dsh-fs-local@0.2.0-rc.2` (the exact version
-  `package.json` pins), plus `@deepseek-ai/dsh-fs@0.2.0-rc.2` for the
+- Peers: `@deepseek-ai/dsh-fs-local@0.2.1-rc.2` (the exact version
+  `package.json` pins), plus `@deepseek-ai/dsh-fs@0.2.1-rc.2` for the
   `FsVersion` brand the local package imports. Divergence 2 is measured
-  against a third peer, `@deepseek-ai/dsh-bash-local@0.2.0-rc.2` — the shell
+  against a third peer, `@deepseek-ai/dsh-bash-local@0.2.1-rc.2` — the shell
   executor carries the collect-budget/spill machinery; `spill` and
   `maxSpillBytes` do not appear in `dsh-fs-local` at all.
+- The `0.2.1-rc.2` move leaves every line reference below intact: all three
+  peers' shipped `lib/index.js` are **byte-identical** to the `0.2.0-rc.2`
+  ones (`cmp` clean; `dsh-fs-local`'s is still 909 lines), so only the
+  tarballs' digests changed. `dsh-fs@0.2.1-rc.2` did drop its unpublished
+  `./invariant` export subpath; this plugin imports neither it nor
+  `dsh-invariants`.
 - What "not imported" means: the peer's **fsio module** is not reachable from
   the package's exports, so `lib/fsio-text.js` reimplements it and imports
   nothing from it (the export is proposed in `docs/UPSTREAM-FSIO-EXPORT.md`).
@@ -27,23 +33,24 @@ file records the verification against the real peers.
 
 ```sh
 mkdir -p /tmp/peer-audit && cd /tmp/peer-audit
-npm pack @deepseek-ai/dsh-fs-local@0.2.0-rc.2 @deepseek-ai/dsh-fs@0.2.0-rc.2 --pack-destination .
-openssl dgst -sha512 -binary deepseek-ai-dsh-fs-local-0.2.0-rc.2.tgz | base64 -w0
-tar xzf deepseek-ai-dsh-fs-local-0.2.0-rc.2.tgz   # -> package/lib/index.js
+npm pack @deepseek-ai/dsh-fs-local@0.2.1-rc.2 @deepseek-ai/dsh-fs@0.2.1-rc.2 --pack-destination .
+openssl dgst -sha512 -binary deepseek-ai-dsh-fs-local-0.2.1-rc.2.tgz | base64 -w0
+tar xzf deepseek-ai-dsh-fs-local-0.2.1-rc.2.tgz   # -> package/lib/index.js
 wc -l package/lib/index.js                        # expect 909
 ```
 
 The tarballs this audit compared, by content — the same values
-`npm view <pkg>@0.2.0-rc.2 dist.integrity` reports:
+`npm view <pkg>@0.2.1-rc.2 dist.integrity` reports:
 
 ```
-@deepseek-ai/dsh-fs-local@0.2.0-rc.2  sha512-lDzh5VlQsXf3nI+E0+T0weYdH1VAoo+htj6Kwc62P7/Lx+xjnYSLQYTeGeaJR1d8H2iQv2FvlwaDKv60AorKdA==
-@deepseek-ai/dsh-fs@0.2.0-rc.2        sha512-PuVcI7drTwa19Key54DROoqnDFTTFkl8TPlyrTnS3BSnykm+jKbB13ES/PQEJoRunNdQkNZa12jtbUI4BP/EHw==
+@deepseek-ai/dsh-fs-local@0.2.1-rc.2  sha512-IZPJ12/EpV6fu3CCWtW4w4GthXAKLFjplm4Feoep2HAum7J1aGzHZwiw7ipsPCZiA5/TyK3lDUUAGZ/pcXgRcw==
+@deepseek-ai/dsh-fs@0.2.1-rc.2        sha512-Z6d2ZKsAiJc0FaiES8wC66vuUQMGohl9tCc2p3bAsPFYkJ0+L2zTViQ9Y5BArtRe9Br8qhNjNgLlN0jb/uwv1g==
 ```
 
 Each row of the table below names the peer's `lib/index.js` line and the
 literal both sides must produce. Verified 2026-10-03; the read/edit split
-re-verified 2026-10-06.
+re-verified 2026-10-06; the whole table re-checked against `0.2.1-rc.2`,
+2026-10-17.
 
 ## Verdict
 
@@ -86,7 +93,7 @@ declared extensions, listed at the end.
 2. **Per-stream truncation flags.** The EXEC frame carries an output budget;
    the RES line reports which streams the agent cut, surfaced as honest
    `truncated` flags. The collect-budget/spill machinery of the shell peer,
-   `@deepseek-ai/dsh-bash-local@0.2.0-rc.2` (`lib/index.js:30`, `:110`), is the
+   `@deepseek-ai/dsh-bash-local@0.2.1-rc.2` (`lib/index.js:30`, `:110`), is the
    spill-file path we deliberately do not run.
 3. **The transport around the ops** (ACK, KILL, the confined resident) is
    protocol this package owns; the peer has no agent.