Merge remote-tracking branch 'origin/master' into worktree/web-textarea-refactor-991614

.agents/notes/implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.md
-2026-07-10-single-file-executable-sdk-runtime-distribution.md: 2a39409c7db2bf1de75843e3642ef27051ccfb17
-2026-07-10-single-file-executable-sdk-runtime-distribution.zh.md: 0f4bb7cf3e1914c008ae23590a3a26fdb87f0842
+2026-07-10-single-file-executable-sdk-runtime-distribution.md: e5438fc01fdd634cd4d8535dfa37a1de356da04d
+2026-07-10-single-file-executable-sdk-runtime-distribution.zh.md: 218133f077bed7584b6a26fea5f939b64d4fd670

.agents/notes/implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.md

@@ -36,7 +36,7 @@ Config discovery has two channels and fails loudly when both are missing: the `D
 
 Inside the exe's VFS sits a **real package tree in build-artifact form** (each package's `lib/` plus a real `node_modules`). The packaged JSON-RPC entry supplies its installed harness base to app-boot's root Include: relative plugin specifiers resolve from the external configuration directory, while bare package names resolve from the VFS, so a configuration inside another Node project cannot shadow the packaged plugin set. The ordinary development bin leaves bare packages configuration-owned. Bare specifiers in the packaged entry resolve upward along `node_modules` from the entry's position inside the VFS and land inside the VFS naturally. The closed set needs no allowlist code — the set is whatever the VFS has installed, and importing a name outside the set fails.
 
-The deploy root is [`python/sdk-runtime/package.json`](../../../../python/sdk-runtime/package.json) (`dsh-sdk-python-runtime-closure`, a pnpm workspace member and a zero-code pure dependency manifest) — the unified source of truth for "which plugins the exe ships" and "what the Python runtime distributes". Adding a plugin to the exe = adding one dependency line to the manifest and repackaging. [`scripts/verify-runtime-closure.ts`](../../../../scripts/verify-runtime-closure.ts) reads every shipped `apps/cli/config/agent-presets/*/agent.cordis.yml`, evaluates `disabled` conditions that compare `process.platform` for every target in `python/sdk-runtime/platforms.json`, and requires each active workspace plugin at the runtime root through an explicit `workspace:` dependency. It also traverses every workspace package covered by that manifest and requires every non-optional workspace peer, reporting the complete preset or referencing-package → missing-dependency chain; unknown platform conditions remain active so a plugin cannot be omitted by an unsupported expression. `pnpm run hygiene`, CI static, and the single-exe build run it before packaging. Deploy also packs by each package's `files`, so the shared chunks tsdown splits out must be covered by `files`.
+The deploy root is [`python/sdk-runtime/package.json`](../../../../python/sdk-runtime/package.json) (`dsh-sdk-python-runtime-closure`, a pnpm workspace member and a zero-code pure dependency manifest) — the unified source of truth for "which plugins the exe ships" and "what the Python runtime distributes". Adding a plugin to the exe = adding one dependency line to the manifest and repackaging. [`scripts/verify-runtime-closure.ts`](../../../../scripts/verify-runtime-closure.ts) reads every shipped `packages/preset/agent-presets/presets/*/agent.cordis.yml`, evaluates `disabled` conditions that compare `process.platform` for every target in `python/sdk-runtime/platforms.json`, and requires each active workspace plugin at the runtime root through an explicit `workspace:` dependency. It also traverses every workspace package covered by that manifest and requires every non-optional workspace peer, reporting the complete preset or referencing-package → missing-dependency chain; unknown platform conditions remain active so a plugin cannot be omitted by an unsupported expression. `pnpm run hygiene`, CI static, and the single-exe build run it before packaging. Deploy also packs by each package's `files`, so the shared chunks tsdown splits out must be covered by `files`.
 
 The deploy root includes `@deepseek-ai/dsh-mcp-client` as an explicitly supported custom-configuration plugin even though no shipped preset mounts it. An external config can therefore connect to user-supplied stdio and Streamable HTTP MCP servers and register their tools; the distribution does not carry those servers or extend the bridge to MCP Resources and Prompts. The executable and installed-wheel smokes start a temporary stdio server, discover its tool, and complete one model-requested call.
 

.agents/notes/implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.zh.md

@@ -36,7 +36,7 @@ exe 使用 [@yao-pkg/pkg](https://github.com/yao-pkg/pkg)（vercel/pkg 归档后
 
 exe 的 VFS 内是**构建产物形态的真实包树**（各包的 `lib/` + 真实 `node_modules`）。打包专用 JSON-RPC 入口会向 app-boot 的根 Include 提供自身已安装 harness 的基准位置：相对插件说明符从外部配置目录解析，裸包名则从 VFS 解析，因此位于另一个 Node 项目内的配置无法遮蔽已打包的插件集合。普通开发 bin 仍由配置项目提供裸包。打包入口中的裸包名从该入口在 VFS 内的位置沿 `node_modules` 向上解析，自然落在 VFS 内。封闭集不需要白名单代码——VFS 中安装了什么，集合中就有什么；`import()` 集合外的名称会失败。
 
-部署根目录是 [`python/sdk-runtime/package.json`](../../../../python/sdk-runtime/package.json)（`dsh-sdk-python-runtime-closure`，pnpm 工作区成员、零代码纯依赖 manifest），也是「exe 安装哪些插件」与「Python 运行时分发什么」的统一真源。向 exe 添加插件，就是在 manifest 中增加一行依赖后重新打包。[`scripts/verify-runtime-closure.ts`](../../../../scripts/verify-runtime-closure.ts) 读取每个已发布的 `apps/cli/config/agent-presets/*/agent.cordis.yml`，针对 `python/sdk-runtime/platforms.json` 中的每个目标解析比较 `process.platform` 的 `disabled` 条件，并要求该目标启用的每个工作区插件都通过显式的 `workspace:` 依赖列在运行时根目录。它还遍历该 manifest 覆盖的全部工作区包，要求每个非可选的工作区对等依赖（peer dependency）都显式列出，并报告“preset 或引用包 → 缺失依赖”的完整链路；无法识别的平台条件会保持启用，避免因不支持的表达式遗漏插件。`pnpm run hygiene`、CI 静态检查与 single-exe 构建都会在打包前运行该门禁。部署还会依据各包的 `files` 字段打包，因此 tsdown 拆出的共享分片必须被 `files` 覆盖。
+部署根目录是 [`python/sdk-runtime/package.json`](../../../../python/sdk-runtime/package.json)（`dsh-sdk-python-runtime-closure`，pnpm 工作区成员、零代码纯依赖 manifest），也是「exe 安装哪些插件」与「Python 运行时分发什么」的统一真源。向 exe 添加插件，就是在 manifest 中增加一行依赖后重新打包。[`scripts/verify-runtime-closure.ts`](../../../../scripts/verify-runtime-closure.ts) 读取每个已发布的 `packages/preset/agent-presets/presets/*/agent.cordis.yml`，针对 `python/sdk-runtime/platforms.json` 中的每个目标解析比较 `process.platform` 的 `disabled` 条件，并要求该目标启用的每个工作区插件都通过显式的 `workspace:` 依赖列在运行时根目录。它还遍历该 manifest 覆盖的全部工作区包，要求每个非可选的工作区对等依赖（peer dependency）都显式列出，并报告“preset 或引用包 → 缺失依赖”的完整链路；无法识别的平台条件会保持启用，避免因不支持的表达式遗漏插件。`pnpm run hygiene`、CI 静态检查与 single-exe 构建都会在打包前运行该门禁。部署还会依据各包的 `files` 字段打包，因此 tsdown 拆出的共享分片必须被 `files` 覆盖。
 
 部署根目录显式包含 `@deepseek-ai/dsh-mcp-client`，将其作为自定义配置可用的插件，即使随附 preset 均未挂载该插件。外部配置因此可以连接由用户提供的 stdio 与 Streamable HTTP MCP server 并注册其工具；分发物不包含这些 server，也不将桥接范围扩展到 MCP Resources 和 Prompts。可执行程序与已安装 wheel 包的冒烟测试会启动临时 stdio server，发现其工具，并完成一次由模型请求的调用。
 

.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md
-2026-08-03-per-session-agent-presets.md: 9999d0125de87c43a8aa3b6b6b7c9bc90a81da77
-2026-08-03-per-session-agent-presets.zh.md: 514f2d40c95b608cb8512fd27a56ddba222d3173
+2026-08-03-per-session-agent-presets.md: b2195004580e1f4bf4be5527c61a8ee9b816c964
+2026-08-03-per-session-agent-presets.zh.md: 9f689c74dd570d6ec9aaa7cd1274618326a836dd

.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md

@@ -23,7 +23,7 @@ Composition splits into two planes, decided by what must be shared rather than b
 
 Model routing stays out of presets. `installAgentLlmTarget` is already the per-agent seam for provider, model, and reasoning effort, and an LLM adapter mounted inside a preset would never be resolved by `agent-loop`, which lives in the host plane.
 
-The presets the deployment ships are the directories under `apps/cli/config/agent-presets/`; the roster is that listing, not a list restated here.
+The presets the deployment ships are the directories under `packages/preset/agent-presets/presets/`; the roster is that listing, not a list restated here.
 
 Mounting is per-session by default. Measured cost for a twelve-row composition is ~3ms and ~600KB per session, so isolation is the cheaper default than any sharing scheme, and a preset authored by a user or by an agent then has the smallest possible blast radius. A preset that genuinely owns an expensive singleton opts into sharing with Cordis's own `isolate` vocabulary: a named realm label is process-global, so two subtrees naming the same label resolve one instance.
 

.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.zh.md

@@ -23,7 +23,7 @@ Status: implemented
 
 模型路由不进 preset。`installAgentLlmTarget` 已经是 provider、model 与 reasoning effort 的按 agent 可替换点；而挂在 preset 内部的 LLM 适配器永远不会被 `agent-loop` 解析到，因为后者位于宿主平面。
 
-部署交付哪些 preset，取决于 `apps/cli/config/agent-presets/` 下有哪些目录；清单是那份目录列表，而不是在此另抄一份。
+部署交付哪些 preset，取决于 `packages/preset/agent-presets/presets/` 下有哪些目录；清单是那份目录列表，而不是在此另抄一份。
 
 挂载默认按会话进行。实测一份十二行组装每会话约 3ms、约 600KB，因此隔离比任何共享方案都更划算；而由用户或 agent 写出的 preset 也因此拥有尽可能小的影响面。确实自带昂贵单例的 preset，可以用 Cordis 自身的 `isolate` 词汇显式选择共享：命名 realm 的 label 是进程级全局的，因此两棵子树只要写同一个 label 就解析到同一个实例。
 

.agents/notes/implemented/architecture/2026-08-20-webworker-node-face.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-20-webworker-node-face.md
-2026-08-20-webworker-node-face.md: 08119cce96eff244f8e9ada3462ce5d35c1b538d
-2026-08-20-webworker-node-face.zh.md: 573c0be055d066d2d6d0db11a2476ba528517727
+2026-08-20-webworker-node-face.md: 41a30dedc7df9a882fbc1d8d3e3583c0a3602d81
+2026-08-20-webworker-node-face.zh.md: b57481335808f3e1a764da123a11ea74ba6cf371

.agents/notes/implemented/architecture/2026-08-20-webworker-node-face.md

@@ -6,21 +6,21 @@ English | [中文](2026-08-20-webworker-node-face.zh.md)
 
 ## Problem
 
-The worker runs the web profile's Cordis configuration byte for byte — no worker-specific rows — so a browser's missing platform must be replaced at the module layer, where a proxied module keeps its identity and changes its implementation. That covers three fronts: the Node builtins the tree imports, the filesystem those builtins answer from, and a process layer for the bash tool, which mounted, advertised itself to the model, and then failed on every call while `node:child_process` was a structural stub.
+The worker runs the web profile's Cordis configuration byte for byte — no worker-specific rows — so a browser's missing platform must be replaced at the module layer, where a proxied module keeps its identity and changes its implementation. That covers three fronts: the Node builtins the tree imports, the filesystem those builtins answer from, and a process layer for the bash tool. A structural `node:child_process` stub would let that tool mount and advertise itself to the model while every call fails.
 
 ## Decision
 
-**Builtins.** The proxy table replaces Node builtins and external npm packages, never workspace or vendored modules. `./implemented/<module>.ts` carries real semantics over a worker data source; `./mock/<module>.ts` mounts silently and reports the missing capability when a call reaches it. The loader's table holds one memoized thunk per specifier — evaluation happens at first `require`, not at assembly — and each shim's exported face typechecks against Node's own module type, with the narrow, documented exceptions where structural identity (a real class) cannot be satisfied. The worker installs the `process` global itself and fills it into the table at assembly.
+**Builtins.** The proxy table replaces Node builtins and external npm packages, never workspace or vendored modules. `./implemented/<module>.ts` carries real semantics over a worker data source; `./mock/<module>.ts` mounts silently and reports the missing capability when a call reaches it. The loader's table holds one memoized thunk per specifier — evaluation happens at first `require`, not at assembly — and each shim's exported face typechecks against Node's own module type, with the narrow, documented exceptions where structural identity (a real class) cannot be satisfied. Its `createRequire` face supplies both `resolve()` and `resolve.paths()` against the image's package root, allowing unchanged packages to discover manifests without loading targets. The worker installs the `process` global itself and fills it into the table at assembly.
 
-**VFS.** Memory is the truth. `statSync(path, { bigint: true })` returns Node's BigInt shape, and two fields carry real information because `dsh-fs-local`'s stale-write guard depends on them: `ino` is per-path identity from a monotonic counter (a recreated path reports a new identity), and `mtimeMs` is strictly increasing per entry (`max(now, previous + 1)`), because in-memory writes routinely land in one millisecond and an equal timestamp would let a stale overwrite pass. The hunt that produced this also fixed the silence around it: cordis's logger verbosity counts UP, so an exporter that declares no level drops every warning — `startWorkerHost` installs a console exporter with `levels: { default: 2 }` before any entry mounts.
+**VFS.** Memory is the truth. `statSync(path, { bigint: true })` returns Node's BigInt shape, and two fields carry real information because `dsh-fs-local`'s stale-write guard depends on them: `ino` is per-path identity from a monotonic counter (a recreated path reports a new identity), and `mtimeMs` is strictly increasing per entry (`max(now, previous + 1)`), because in-memory writes routinely land in one millisecond and an equal timestamp would let a stale overwrite pass. Committed mutations also drive the [Node-compatible watcher and confinement implementation](2026-08-23-webworker-vfs-watch-and-landlock.md). Boot diagnostics remain visible because cordis logger verbosity counts UP: `startWorkerHost` installs a console exporter with `levels: { default: 2 }` before any entry mounts, while an exporter with no declared level drops every warning.
 
-**Shell.** `node:child_process` is a real implementation over the VFS. The grammar is bought — `@yarnpkg/parsers`' `parseShell` — and the evaluator and command table are owned, because every candidate interpreter brings its own filesystem: pipelines are strings handed along, and each program is a function over the VFS. The table is the machine's whole `/bin`; an absent name reports `command not found` (127). Each `spawn` starts a child Web Worker from this same bundle, its first frame declaring the shell-process role, so the termination ladder is real: `SIGTERM` asks at the next command boundary, `SIGKILL` terminates the worker mid-loop — the preemption an in-thread interpreter can never have. The filesystem face is asynchronous end to end (child frames to the host VFS); `execSync`, `execFileSync`, and `fork` refuse, and `node-pty` stays a stub.
+**Shell.** `node:child_process` is a real implementation over the VFS. The grammar is bought — `@yarnpkg/parsers`' `parseShell` — and the evaluator and command table are owned, because every candidate interpreter brings its own filesystem: pipelines are strings handed along, and each program is a function over the VFS. Ordinary commands resolve from that table; native-package protocols may contribute Worker-owned virtual executable wrappers through the [watcher and confinement decision](2026-08-23-webworker-vfs-watch-and-landlock.md). A name in neither set reports `ENOENT` at direct spawn or `command not found` (127) inside shell source. Each `spawn` starts a child Web Worker from this same bundle, its first frame declaring the shell-process role, so the termination ladder is real: `SIGTERM` asks at the next command boundary, `SIGKILL` terminates the worker mid-loop — the preemption an in-thread interpreter can never have. The filesystem face is asynchronous end to end (child frames to the host VFS); `execSync`, `execFileSync`, and `fork` refuse, and `node-pty` stays a stub.
 
 ## Alternatives considered
 
 **Replacing `dsh-subprocess-local` or the bash executor.** The first would let the proxy table replace a workspace package against its own classification and invert the layering; the second trips `dsh-permission-presets`' boot-time `sandboxMode` validation and drops tested timeout/output behavior.
 
-**`@yarnpkg/shell`, WASM shells, WebContainer.** The matching interpreter is built on real Node streams (~1.5 MB closure to own); WASM was removed from this deployment by decision and WASI has no `fork`; all of them arrive with their own filesystem, the one part that cannot be reused.
+**`@yarnpkg/shell`, WASM shells, WebContainer.** The matching interpreter is built on real Node streams (~1.5 MB closure to own); this deployment excludes WASM and WASI has no `fork`; all of them arrive with their own filesystem, the one part that cannot be reused.
 
 **`SharedArrayBuffer` + `Atomics.wait` for a synchronous child filesystem.** Measured on the deployment target: without COOP/COEP headers `SharedArrayBuffer` is not defined, and GitHub Pages cannot set response headers. The asynchronous face is a superset; a SAB backend can slot under it later without touching a program.
 
@@ -28,7 +28,7 @@ The worker runs the web profile's Cordis configuration byte for byte — no work
 
 ## Consequences
 
-- Sandbox modes other than `danger-full-access` fail loud: `SandboxEnforcement` has no "nothing was enforced" value and a browser has no kernel, so `ctx.sandbox.confine` fails closed and the command never starts. Real enforcement at the VFS frame gate is a designed follow-up, not this note.
+- `read-only` and `workspace-write` interpret the native Landlock launcher protocol and enforce per-process grants at the VFS frame gate; `danger-full-access` keeps the direct process path. The [watcher and confinement decision](2026-08-23-webworker-vfs-watch-and-landlock.md) owns the narrower meaning of `full` in this execution world.
 - The Node-host ladder test (`tests/node/child-process.spec.ts`) is registered windows-unsupported: the ladder's win32 kill rung is taskkill-by-real-pid, undeliverable to a process-table pid, while the worker itself always reports `linux`.
 - Output is incremental but not streamed: programs write into sinks forwarded as `data` events, and a pipeline stage completes before the next starts.
 - The runtime's tests mirror `src/` (`tests/node/`, `tests/shell/`, `tests/storage/`, …), so each shim family owns its behavior cases beside the oracle-diff suites.

.agents/notes/implemented/architecture/2026-08-20-webworker-node-face.zh.md

@@ -6,21 +6,21 @@
 
 ## 问题
 
-worker 逐字节运行 web profile 的 Cordis 配置——没有 worker 专属行——因此浏览器缺失的平台必须在模块层被替换：被代理的模块保持身份、更换实现。这覆盖三条战线：树所 import 的 Node builtin、这些 builtin 背后应答的文件系统，以及 bash 工具的进程层——在 `node:child_process` 还是结构桩的时期，工具照常挂载、向模型自我宣告，然后每次调用都失败。
+worker 逐字节运行 web profile 的 Cordis 配置——没有 worker 专属行——因此浏览器缺失的平台必须在模块层被替换：被代理的模块保持身份、更换实现。这覆盖三条战线：树所 import 的 Node builtin、这些 builtin 背后应答的文件系统，以及 bash 工具的进程层。如果 `node:child_process` 只是结构桩，工具仍会照常挂载并向模型自我宣告，但每次调用都会失败。
 
 ## 决定
 
-**Builtin。** 代理表只替换 Node builtin 与外部 npm 包，绝不替换 workspace 或 vendored 模块。`./implemented/<module>.ts` 在 worker 数据源之上承载真语义；`./mock/<module>.ts` 静默挂载、在调用真正抵达时报告缺失的能力。装载器的表按 specifier 各持一个 memoized thunk——求值发生在首次 `require` 而非装配期——且每个垫片的导出面对 Node 自身的模块类型作类型检查，仅在结构身份（真实类）确不可满足处留最窄的、有说明的例外。`process` 全局由 worker 自装，装配期填入表中。
+**Builtin。** 代理表只替换 Node builtin 与外部 npm 包，绝不替换 workspace 或 vendored 模块。`./implemented/<module>.ts` 在 worker 数据源之上承载真语义；`./mock/<module>.ts` 静默挂载、在调用真正抵达时报告缺失的能力。装载器的表按 specifier 各持一个 memoized thunk——求值发生在首次 `require` 而非装配期——且每个垫片的导出面对 Node 自身的模块类型作类型检查，仅在结构身份（真实类）确不可满足处留最窄的、有说明的例外。它的 `createRequire` 面在镜像 package 根之上同时提供 `resolve()` 与 `resolve.paths()`，使未修改的包无需加载目标即可发现 manifest。`process` 全局由 worker 自装，装配期填入表中。
 
-**VFS。** 内存为真相。`statSync(path, { bigint: true })` 返回 Node 的 BigInt 形状，其中两个字段承载真实信息，因为 `dsh-fs-local` 的 stale-write guard 依赖它们：`ino` 是按路径的身份（单调计数器分配，路径重建即新身份），`mtimeMs` 按条目严格递增（`max(now, previous + 1)`）——内存写例行落在同一毫秒内，相等的时间戳会放过陈旧覆写。这场排查同时修掉了它周围的静默：cordis 日志器的详细度数值向上计数，未声明等级的 exporter 会丢掉所有 warning——`startWorkerHost` 在任何 entry 挂载前安装 `levels: { default: 2 }` 的 console exporter。
+**VFS。** 内存为真相。`statSync(path, { bigint: true })` 返回 Node 的 BigInt 形状，其中两个字段承载真实信息，因为 `dsh-fs-local` 的 stale-write guard 依赖它们：`ino` 是按路径的身份（单调计数器分配，路径重建即新身份），`mtimeMs` 按条目严格递增（`max(now, previous + 1)`）——内存写例行落在同一毫秒内，相等的时间戳会放过陈旧覆写。已提交的 mutation 还会驱动 [Node 兼容 watcher 与 confinement 实现](2026-08-23-webworker-vfs-watch-and-landlock.zh.md)。Cordis 日志器的详细度数值向上计数，因此 `startWorkerHost` 会在任何 entry 挂载前安装 `levels: { default: 2 }` 的 console exporter，避免未声明等级的 exporter 丢掉所有 warning。
 
-**Shell。** `node:child_process` 是 VFS 之上的真实现。语法是买来的——`@yarnpkg/parsers` 的 `parseShell`——求值器与命令表是自有的，因为每个候选解释器都自带文件系统：管道是逐段传递的字符串，每个程序是 VFS 上的一个函数。命令表就是这台机器的全部 `/bin`；不存在的名字报告 `command not found`（127）。每次 `spawn` 从同一个 bundle 起一个子 Web Worker，首帧声明 shell 进程角色，因此终止梯是真的：`SIGTERM` 在下一命令边界处请求停止，`SIGKILL` 在任意时刻终止 worker——这是线程内解释器永远没有的抢占。文件系统面端到端异步（子进程经帧到宿主 VFS）；`execSync`、`execFileSync`、`fork` 拒绝，`node-pty` 保持桩。
+**Shell。** `node:child_process` 是 VFS 之上的真实现。语法是买来的——`@yarnpkg/parsers` 的 `parseShell`——求值器与命令表是自有的，因为每个候选解释器都自带文件系统：管道是逐段传递的字符串，每个程序是 VFS 上的一个函数。普通命令从该表解析；native 包协议可以通过 [watcher 与 confinement 决策](2026-08-23-webworker-vfs-watch-and-landlock.zh.md)提供 Worker 自有的虚拟 executable wrapper。两处都没有的名字在直接 spawn 时报告 `ENOENT`，在 shell source 中则报告 `command not found`（127）。每次 `spawn` 从同一个 bundle 起一个子 Web Worker，首帧声明 shell 进程角色，因此终止梯是真的：`SIGTERM` 在下一命令边界处请求停止，`SIGKILL` 在任意时刻终止 worker——这是线程内解释器永远没有的抢占。文件系统面端到端异步（子进程经帧到宿主 VFS）；`execSync`、`execFileSync`、`fork` 拒绝，`node-pty` 保持桩。
 
 ## 曾考虑的替代方案
 
 **整包替换 `dsh-subprocess-local` 或替换 bash 执行器。** 前者让代理表首次替换 workspace 包、违背其自身分类并倒置分层；后者撞上 `dsh-permission-presets` 对 `sandboxMode` 的 boot 期硬校验，并丢掉执行器已被测试钉住的超时/输出行为。
 
-**`@yarnpkg/shell`、WASM shell、WebContainer。** 配套解释器建立在真实 Node streams 之上（约 1.5 MB 闭包要自养）；WASM 已被本部署的决定排除，WASI 没有 `fork`；且它们全都自带文件系统——恰是无法复用的那部分。
+**`@yarnpkg/shell`、WASM shell、WebContainer。** 配套解释器建立在真实 Node streams 之上（约 1.5 MB 闭包要自养）；本部署排除 WASM，WASI 没有 `fork`；且它们全都自带文件系统——恰是无法复用的那部分。
 
 **`SharedArrayBuffer` + `Atomics.wait` 给子进程同步文件系统。** 在部署目标实测：无 COOP/COEP 头时 `SharedArrayBuffer` 未定义，而 GitHub Pages 无法设置响应头。异步面是超集；SAB 后端将来可垫入其下而不动任何程序。
 
@@ -28,7 +28,7 @@ worker 逐字节运行 web profile 的 Cordis 配置——没有 worker 专属
 
 ## 后果
 
-- `danger-full-access` 之外的沙箱档 fail loud：`SandboxEnforcement` 没有「未执法」值、浏览器没有内核，`ctx.sandbox.confine` 落闭、命令零启动。在 VFS 帧闸口做真执法是设计中的后续，不属本条。
+- `read-only` 与 `workspace-write` 解释 native Landlock launcher 协议，并在 VFS 帧闸口执行逐进程授权；`danger-full-access` 保持直接进程路径。[Watcher 与 confinement 决策](2026-08-23-webworker-vfs-watch-and-landlock.zh.md)拥有该执行世界中 `full` 的更窄含义。
 - Node 宿主的阶梯测试（`tests/node/child-process.spec.ts`）登记为 windows 不支持：阶梯的 win32 kill 梯级是按真 pid 的 taskkill，对进程表 pid 不可投递，而 worker 自身恒报 `linux`。
 - 输出增量但不流式：程序写入的 sink 以 `data` 事件转发，一个管道阶段完成后下一阶段才开始。
 - 运行时的测试镜像 `src/`（`tests/node/`、`tests/shell/`、`tests/storage/`……），每个垫片族在 oracle-diff 套件旁拥有自己的行为用例。

.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.md
-2026-08-20-webworker-pack-lowering-and-preview.md: 37c7730c5da664560156a8e4bd9ba594c78369ee
-2026-08-20-webworker-pack-lowering-and-preview.zh.md: 09d9356ee8744ba2406bd765a6ca6a060f93853a
+2026-08-20-webworker-pack-lowering-and-preview.md: 72a6ccf856c95f835e103bd355223bf3cf42f692
+2026-08-20-webworker-pack-lowering-and-preview.zh.md: 074d44833c34a2999a5c47da809533065201b580

.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.md

@@ -14,6 +14,8 @@ The browser worker can neither compile modules at load nor be served by the prod
 
 **The preview is the served page plus one tag.** One Vite build emits `dist/index.html` and `dist/preview.html` sharing every chunk; the only difference is a prepended bootstrap entry whose module connects the worker host. Startup then converges on one protocol: whichever side applies the injection table settles the `__DSH_BOOT_READY__` deferred — the served renderer resolves it in a tail script after the rendered rows, the worker bootstrap installs it before its first await and settles it after the last row — and the client entry awaits it before reading any injected state, so the chain from the stock entry onward is the served chain verbatim. The build uses a relative base so the output mounts under any static directory; the served form anchors deep SPA-fallback paths by rendering `<base href="/">` at serve time, keeping the on-disk pages byte-shared.
 
+**The repository preview carries selectable filesystem sources.** The packer emits one base image and a small overlay archive for each named built-in fixture. Without a source query, `preview.html` waits at a chooser for an empty filesystem, the built-in fixtures, or the separately owned WebFS provider. A valid `preview-fixture=none|<built-in-id>` query selects directly and skips the chooser for deterministic browser runs; its distinct name avoids the Client's existing `fixture` transport switch. The Worker mounts the base and then applies the selected overlays in order, restricted to `home/` and `workspace/`, before it validates the base manifest or boots Cordis. `packages/experimental/webworker-runtime/tests/fixtures/vfs-example/` supplies one built-in overlay without giving the packer Session or Workspace knowledge. Its plaintext JSONL logs use the persistence backend's real project/session directory layout, so Session Persistence reads them cold and Workspace Registry derives the Workspace from their `/dsh/workspace` headers. The main Session exceeds the Client's 50-message page and keeps representative tool results at its tail; persisted one-shot and continuable children exercise the subagent catalog. WebFS authorization and user data remain a separate provider and never share this fixture tree.
+
 Both packages live in `packages/experimental/` as `@deepseek-ai/dsh-experimental-*`, private and outside official releases. The boundary that carries product promises stays in the product packages: the injection table, `__DSH_TRANSPORT__`, and the `/plugins` bundle bytes are owned by `dsh-host-webserver`, `dsh-client-modules`, and `dsh-client-connection`.
 
 ## Alternatives considered
@@ -26,6 +28,12 @@ Both packages live in `packages/experimental/` as `@deepseek-ai/dsh-experimental
 
 **Gating the stock entry on top-level await ordering instead of a deferred.** Sibling module scripts do not wait for one another's top-level awaits; the `??=`-installed deferred makes the handshake order-independent and lets a failed handshake reject into the boot page's failure rendering.
 
+**Generate example state in the Worker at startup.** A preview-only Session or Workspace creation branch would bypass cold persistence loading and make the runtime own test data. Static image files exercise the same discovery and pagination path as existing user data.
+
+**Seed the example through WebFS.** WebFS owns user-selected durable storage and its lifecycle. Coupling the built-in demonstration to it would make a static preview depend on browser persistence state and would blur which bytes came from the deployment.
+
+**Pack one complete base image per fixture.** Full-image variants duplicate the runtime package closure and make combinations quadratic. Restricted overlays keep one immutable base, let the chooser compose zero or more data sources, and give future WebFS hydration the same pre-boot application point.
+
 ## Consequences
 
 - `lib/worker.js` contains no parser (423.5 kB → 246.3 kB at the time of the cut, before the shell process layer landed).
@@ -33,3 +41,4 @@ Both packages live in `packages/experimental/` as `@deepseek-ai/dsh-experimental
 - The transform corpus imports every built bundle through Node before comparing its lowered exports. Its pinned exemptions name the actual non-importable bundle and fail when one becomes importable: after Win32 process primitives became the Koffi type owner, `win32-process` carries the duplicate-type exemption and `sandbox-windows-acl` does not.
 - The served `<base href="/">` anchor exists because relative asset URLs would resolve under the request directory on SPA-fallback paths; remove it only together with the relative build base.
 - The image ships as a deterministically gzip-compressed tar (`vfs-image.tar.gz`; MTIME 0, OS byte 0xff): static hosts do not compress binary content types (type allowlists, CDN size caps), so the compression rides the artifact, and the worker inflates the fetch body through the browser's native `DecompressionStream` while it downloads.
+- The preview waits at a pre-boot source chooser. Its built-in example opens a reproducible Workspace and cold Session corpus suitable for inspecting tool cards, subagent navigation, and backward pagination without credentials or model calls; the empty selection preserves first-run coverage. Fixture tests validate the physical logs through production readers, and browser acceptance verifies both selections.

.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.zh.md

@@ -14,6 +14,8 @@
 
 **preview 就是服务页面加一个标签。** 一次 Vite 构建产出共享全部 chunk 的 `dist/index.html` 与 `dist/preview.html`；唯一差异是前插的一个引导入口，其模块负责连接 worker host。启动随之汇于一个协议：应用注入表的一方 settle `__DSH_BOOT_READY__` deferred——served 渲染器在渲染完的行之后用尾部脚本 resolve，worker 引导段在首个 await 之前安装、末行生效后 settle——client 入口在读取任何注入状态前 await 它，因此从标准入口起的链路逐字就是 served 链路。构建使用相对 base，产物可挂载于任意静态目录；served 形态在 serve 期渲染 `<base href="/">` 锚定深层 SPA fallback 路径，磁盘上的两个页面保持字节共享。
 
+**仓库 preview 携带可选择的文件系统来源。** Packer 产出一份基础镜像，并为每套具名内置 fixture 产出一份小型 overlay 归档。没有来源 query 时，`preview.html` 会停在选择面板，可选择空文件系统、内置 fixtures，或归另一实现所有的 WebFS provider。合法的 `preview-fixture=none|<built-in-id>` query 会直接选择并跳过面板，供确定性的浏览器流程使用；该独立名称避开 Client 既有的 `fixture` transport 开关。Worker 先挂载基础镜像，再按顺序把所选 overlays 应用到仅限 `home/` 和 `workspace/` 的路径，随后才校验基础 manifest 并启动 Cordis。`packages/experimental/webworker-runtime/tests/fixtures/vfs-example/` 提供其中一套内置 overlay，Packer 无需理解 Session 或 Workspace。明文 JSONL 日志使用 persistence backend 的真实 project/session 目录布局，因此 Session Persistence 会冷读取它们，Workspace Registry 则根据其 `/dsh/workspace` header 派生 Workspace。主 Session 超过 Client 的 50-message page，并把代表性工具结果留在尾页；持久化的 one-shot 与 continuable child 用于验证 subagent catalog。WebFS 授权与用户数据仍属于独立 provider，绝不与该 fixture 共用目录。
+
 两个包以 `@deepseek-ai/dsh-experimental-*` 名义放在 `packages/experimental/`，私有且在官方发布之外。承载产品承诺的边界仍在产品包里：注入表、`__DSH_TRANSPORT__` 与 `/plugins` bundle 字节由 `dsh-host-webserver`、`dsh-client-modules`、`dsh-client-connection` 拥有。
 
 ## 曾考虑的替代方案
@@ -26,6 +28,12 @@
 
 **用顶层 await 顺序而非 deferred 去闸标准入口。** 兄弟 module script 互不等待对方的顶层 await；`??=` 安装的 deferred 使握手与求值顺序无关，且失败的握手能 reject 进 boot 页的失败呈现。
 
+**在 Worker 启动时生成示例状态。** Preview 专用的 Session 或 Workspace 创建分支会绕过冷 persistence 读取，还会让 runtime 拥有测试数据。静态镜像文件与既有用户数据经过相同的发现和分页路径。
+
+**通过 WebFS 注入示例。** WebFS 拥有用户选定的 durable storage 及其生命周期。让内置演示依赖它，会使静态 preview 受浏览器持久化状态影响，并模糊哪些字节来自部署。
+
+**每套 fixture 各打一份完整基础镜像。** 完整镜像变体会重复 runtime package closure，并使组合数量平方增长。受限 overlay 只保留一个不可变基础镜像，选择面板可组合零到多个数据源，未来 WebFS 水合也能复用同一个 pre-boot 应用点。
+
 ## 后果
 
 - `lib/worker.js` 不含解析器（当刀落时为 423.5 kB → 246.3 kB，早于 shell 进程层落地）。
@@ -33,3 +41,4 @@
 - 转换 corpus 会先通过 Node 导入每个已构建 bundle，再比较 lowered export。固定豁免会点名真正不可导入的 bundle，并在其恢复可导入时失败：`win32-process` 是 Koffi 类型 owner 并承担重复类型豁免；`sandbox-windows-acl` 可正常导入，不承担该豁免。
 - served 的 `<base href="/">` 锚存在的原因是：相对资产 URL 在 SPA fallback 深路径下会解析进请求目录；只有与相对构建 base 一起才可移除它。
 - 镜像以确定性 gzip 压缩的 tar 交付（`vfs-image.tar.gz`；MTIME 0、OS 字节 0xff）：静态托管不压缩二进制 content-type（类型白名单、CDN 尺寸帽），压缩必须随制品走；worker 用浏览器原生 `DecompressionStream` 在下载的同时解压 fetch body。
+- Preview 会停在 pre-boot 来源选择面板。内置示例提供可复现的 Workspace 与冷 Session 语料，无凭据、零模型调用即可检查工具卡、subagent 导航和向前分页；空白选项保留首次启动覆盖。Fixture 测试通过生产 reader 校验物理日志，浏览器验收同时验证两种选择。

.agents/notes/implemented/architecture/2026-08-23-webworker-vfs-watch-and-landlock.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-23-webworker-vfs-watch-and-landlock.md
+2026-08-23-webworker-vfs-watch-and-landlock.md: 2705c63aa6bf0f2e2de33d00029a4f41e1b1d4af
+2026-08-23-webworker-vfs-watch-and-landlock.zh.md: 4470720e1ff968aa06578b231b054c9053f27283

.agents/notes/implemented/architecture/2026-08-23-webworker-vfs-watch-and-landlock.md

@@ -0,0 +1,80 @@
+# Agent Note: Web Worker VFS watching and CLI-compatible confinement
+
+Status: implemented
+
+English | [中文](2026-08-23-webworker-vfs-watch-and-landlock.zh.md)
+
+## Problem
+
+The Web Worker preview boots the same Web profile and Agent presets as the Node host. Without a VFS change source, refusing `node:fs.watchFile` makes `skill-filesystem` return an incomplete observation and re-scan on every lookup, while an inert success leaves an existing root waiting forever for Chokidar's `ready`. Settings and credentials likewise need real external-edit events rather than a package-specific fake.
+
+The same composition mounts `sandbox-local`, whose Linux chain probes bwrap and then `@deepseek-ai/node-addon-landlock-run`. A Worker cannot execute either binary. Ending the selection there makes `workspace-write` and `read-only` unusable even though every shell filesystem operation already crosses a Host-side VFS call point.
+
+The filesystem compatibility boundary follows the [Worker Node face decision](2026-08-20-webworker-node-face.md): pure JavaScript watcher packages run unchanged over Node-compatible modules. Native or binary packages may keep their public JavaScript API and executable protocol while replacing the backend. An API that cannot preserve its caller-visible Node behavior remains explicitly unavailable; `node:vm` is outside this decision.
+
+## Decision
+
+### VFS mutation source and filesystem watchers
+
+`MemoryVfs` publishes committed `write`, `mkdir`, `remove`, and `chmod` mutations to any number of subscribers. Publication happens after state changes, failed operations publish nothing, image seeding stays silent, and one throwing subscriber cannot fail the filesystem operation or starve another subscriber. Rename is a source removal plus complete destination mkdir/write records; destination writes mark the directory entry as changed, so watchers report `rename` while a future durable sink receives the bytes needed to materialize the destination. Directory mtimes advance when their immediate entry set changes, so polling detects child creation and removal as Node does.
+
+The mutation record is shared with WebFS persistence rather than defining a second notification path. Writes carry their complete post-commit bytes and virtual permission bits, plus an append offset when only a tail changed. `MemoryVfs` accepts an optional asynchronous `VfsMutationSink`, sends the same records to that sink and live watcher subscribers, and exposes `flush()` through file-handle `sync()` and `datasync()`. Hydration supplies `{ mode, mtimeMs }` explicitly, so image permissions and durable timestamps cannot occupy the same positional argument. This change mounts no durable sink; it keeps the synchronous in-memory tree authoritative so an OPFS or user-directory mirror can hydrate before publication and write behind without changing `node:fs`.
+
+The `node:fs` implementation provides callback `stat` and `lstat`, `watch`, `watchFile`, `unwatchFile`, `FSWatcher`, and `StatWatcher`; `node:fs/promises.watch` provides the abortable async iterator. One path shares one `StatWatcher` across listeners, listener-specific unwatching leaves peers active, and missing paths report zero-valued Stats before later creation, deletion, and recreation transitions. Callback dispatch captures the registration-time async context and checks closure before every queued delivery. A pre-aborted callback watch returns its watcher before asynchronously closing it, while a pre-aborted promise watch rejects its first iterator read with `AbortError`.
+
+`fs.watch` maps entry creation, removal, and rename destinations to `rename`, and maps content or mode changes to `change`. Non-recursive directory watches report immediate child names; recursive watches report paths relative to the watched directory. The VFS has no symlinks, so this implementation does not invent symlink events.
+
+### Streams and unchanged npm packages
+
+`node:stream` uses the maintained `readable-stream` browser implementation for `Readable`, `Writable`, `Duplex`, `Transform`, `PassThrough`, pipeline helpers, async iteration, backpressure, aborts, and teardown ordering. The compatibility module sets the byte high-water default to the 64 KiB value used by the repository's Node 22+ engines. VFS-backed `ReadStream` and `WriteStream` supply file descriptors, inclusive ranges, encoding, append or replace behavior, byte accounting, AbortSignal handling, and `open`/`ready`/`finish`/`end`/`close` ordering. Descriptors retain their opened file identity and access mode across rename, replacement, and unlink; hard links share that identity and subsequent content or mode changes, while truncation zero-fills growth.
+
+Chokidar and readdirp are ordinary image dependencies, not module replacements. Their package code runs unchanged and imports the Worker implementations of `node:fs`, `node:fs/promises`, `node:stream`, `node:events`, `node:path`, and `node:os`. Chokidar therefore retains its own initial scan, `ready`, polling, atomic-write normalization, write-settle delay, shared watcher, and close behavior.
+
+### Landlock CLI over per-process VFS grants
+
+`@deepseek-ai/node-addon-landlock-run` is an ordinary image dependency, not a module replacement. Its unchanged JavaScript entry runs through the Worker implementations of `node:child_process`, `node:module`, `node:path`, and `node:url`, so the package remains the sole owner of `LAUNCHER_BIN`, `LAUNCHER_FAILURE_EXIT`, `launcherPath()`, `grantArgs()`, and `probe()`. The image may include the matching Linux optional package, but package resolution does not decide whether the Worker platform supplies Landlock: the entry package's deterministic fallback path reaches the same platform executable implementation when that optional package is absent.
+
+The process layer has a table of Worker platform executables identified by logical executable name rather than one package-manager path. Its `landlock-run` provider accepts a bare command or an absolute launcher path, parses the native package's unchanged CLI, validates every grant root, and delegates the inner argv to the existing shell process runner. `node:child_process` performs only generic executable lookup, output delivery, and settlement. The unchanged package's synchronous `probe()` therefore observes the provider through `spawnSync` and reports `full`. A usage error, missing grant root, or unknown inner executable prints one `landlock-run: ...` line, exits `125`, and never runs the inner command. The bwrap probe remains unavailable, so the unmodified `sandbox-local` Linux chain selects this Landlock backend.
+
+Each launched process receives its own `ShellFileSystem` guard. `stat`, `list`, and `readText` require a read-only or read-write grant; `writeText`, `mkdir`, and `remove` require a read-write grant; `rename` requires both source and destination to be writable. Grant roots normalize trailing separators before containment checks. Denials carry `EACCES` and `permission denied`, preserving `bash-sandbox` denial classification. `/tmp` maps to the VFS `/dsh/tmp`, while `/dev/null` is a virtual empty-read and discarded-write file that stores no bytes.
+
+The Worker's `full` verdict covers every file operation expressible through its shell command table and Host-served VFS protocol. It does not claim Linux kernel Landlock, arbitrary native executable support, or protection against a future shell program that bypasses `ShellFileSystem`.
+
+### Explicitly deferred behavior
+
+`node:vm`, `node:worker_threads`, `node:net`, `node:sqlite`, native PTY, Sharp, and ripgrep remain outside this change. The VFS remains POSIX-only, in-memory, and symlink-free. Browser Workers have no libuv-style ref-counted event loop, so watcher `persistent`, `ref()`, and `unref()` preserve the API and observable state but cannot decide Worker lifetime.
+
+## Alternatives considered
+
+**Disable watcher and sandbox rows in the Worker profile.** A smaller composition would stop testing the same Host tree and would hide package integration failures specific to preview deployment.
+
+**Make `watchFile` an inert success.** Missing roots would never advance, and an existing root would wait forever for Chokidar `ready`.
+
+**Notify watchers only from `node:fs`.** Shell process requests and any direct VFS writer would bypass the notification point. The commit owner, `MemoryVfs`, is the only complete source.
+
+**Keep a VFS-specific Chokidar replacement.** This duplicates directory scans, ready accounting, write settling, atomic replacement, shared watcher ownership, and teardown already maintained upstream.
+
+**Replace the Landlock entry package with a Worker module.** Reimplementing its exported constants, grant builder, launcher resolution, and probe would create a second copy of a package contract that already runs over the Worker Node compatibility layer. Only the platform executable implementation differs.
+
+**Recognize one exact launcher path.** Optional-dependency installation and the entry package's documented fallback produce different absolute paths for the same executable. Package-manager layout is not the identity of a platform capability, so executable dispatch uses the logical `landlock-run` name.
+
+**Add a Worker branch to `sandbox-local`.** This would copy policy-to-grant mapping into a business package. Interpreting the existing launcher protocol preserves the provider, consumer, configuration, diagnostics, and native package API.
+
+**Store one active policy on the global VFS.** Concurrent foreground, background, and escalated commands would overwrite one another's authority. Grants belong to one process handle and its filesystem adapter.
+
+## Verification
+
+- `fs-watch-stream.spec.ts` compares missing/create/change/remove `watchFile` transitions and file-stream lifecycle, chunking, range, backpressure, byte count, defaults, and abort identity with the running Node version.
+- `chokidar.spec.ts` loads both lockfile-selected Chokidar and readdirp dependency pairs through the Worker transformer and module loader, then proves `ready`, callback watching, polling, missing-file creation, removal, and quiescent close over `MemoryVfs`.
+- `image-loadable.spec.ts` packs and loads the real `@deepseek-ai/node-addon-landlock-run` JavaScript, proves it is absent from the replacement table, and runs its fallback `launcherPath()` and `probe()` through the Worker platform executable. `child-process.spec.ts` and `sandbox-stack.spec.ts` then prove the launcher failure code, malformed argv and grant failures, `/tmp` and `/dev/null`, rename denial, all three permission modes, and concurrent process-local grants through the production sandbox and subprocess packages.
+- `preview-boot.e2e.ts` builds and boots the packed browser deployment, creates a Workspace and Session, advances missing skill roots into a live Chokidar watch, lists the catalog, and completes settings and credential writes without watcher warnings.
+
+## Consequences
+
+The preview now runs npm watcher consumers without source forks, and filesystem mutations observed from Host code or shell process Workers share one ordered commit source. A WebFS/OPFS integration remains an asynchronous mirror around this synchronous authority and consumes that same source; it does not add another Chokidar implementation or a competing mutation protocol.
+
+Worker `read-only` and `workspace-write` preserve the product's permission vocabulary and denial reporting without forking the Landlock npm package. Their security claim is narrower than native Landlock but complete inside the Worker execution world; any new filesystem message or shell program must continue through the guarded `ShellFileSystem`. Native-backed packages follow the same ownership rule: their JavaScript remains upstream, while the Worker platform replaces only the native artifact behind it.
+
+The worker bundle gains `readable-stream` and its small browser dependency closure. In return, stream state and backpressure remain maintained upstream instead of becoming local compatibility code.
+
+Watcher event timing is deterministic from VFS commits rather than inherited from an operating-system backend. This stays within Node's watcher contract, which does not guarantee native event coalescing, while tests pin every event distinction the current consumers require.

.agents/notes/implemented/architecture/2026-08-23-webworker-vfs-watch-and-landlock.zh.md

@@ -0,0 +1,80 @@
+# Agent Note: Web Worker VFS 监听与 CLI 兼容 confinement
+
+Status: implemented
+
+[English](2026-08-23-webworker-vfs-watch-and-landlock.md) | 中文
+
+## Problem
+
+Web Worker preview 启动与 Node host 相同的 Web profile 和 Agent preset。缺少 VFS 变更源时，拒绝 `node:fs.watchFile` 会让 `skill-filesystem` 返回不完整观测并在每次查询时重新扫描，而无事件的成功调用会让已有根永远等待 Chokidar 的 `ready`。Settings 和 credentials 同样需要真实的外部编辑事件，而不是包专用 fake。
+
+同一组合挂载 `sandbox-local`，其 Linux 选择链依次探测 bwrap 和 `@deepseek-ai/node-addon-landlock-run`。Worker 无法执行这两个二进制文件。如果选择链到此结束，`workspace-write` 与 `read-only` 将不可用，尽管 shell 的每项文件系统操作已经经过 Host 侧 VFS 调用点。
+
+文件系统兼容边界遵循 [Worker Node face 决策](2026-08-20-webworker-node-face.zh.md)：纯 JavaScript watcher 包在 Node 兼容模块之上保持原样运行。Native 或 binary 包可以保持公开 JavaScript API 与可执行文件协议，同时替换执行后端。无法维持调用方可见 Node 行为的 API 继续明确标记为不可用；`node:vm` 不属于本决策范围。
+
+## Decision
+
+### VFS mutation source 与文件 watcher
+
+`MemoryVfs` 向任意数量的订阅方发布已提交的 `write`、`mkdir`、`remove` 和 `chmod` mutation。状态改变后才发布，失败操作不发布，镜像 seed 保持无事件，一个抛错的订阅方也不能让文件系统操作失败或阻止其他订阅方。Rename 被表达为源路径删除与包含完整状态的目标 mkdir/write 记录；目标 write 会标记目录项已改变，因此 watcher 报告 `rename`，未来的 durable sink 同时拿到物化目标所需的字节。目录的直接条目集合改变时，其 mtime 会推进，因此 polling 能像 Node 一样发现子项创建和删除。
+
+Mutation record 与 WebFS 持久化共用，而不建立第二条通知路径。Write 记录携带提交后的完整字节与虚拟权限位，并在只有尾部变化时携带 append offset。`MemoryVfs` 接受可选的异步 `VfsMutationSink`，把同一批记录交给 sink 与实时 watcher 订阅方，并通过文件句柄的 `sync()` 和 `datasync()` 暴露 `flush()`。水合通过显式的 `{ mode, mtimeMs }` 传入元数据，因此镜像权限与持久化时间戳不会占用同一个位置参数。本次变更不挂载 durable sink；同步内存树继续作为权威，因此 OPFS 或用户目录 mirror 可以先水合、再异步写回，而无需改变 `node:fs`。
+
+`node:fs` 实现 callback `stat` 和 `lstat`、`watch`、`watchFile`、`unwatchFile`、`FSWatcher` 与 `StatWatcher`；`node:fs/promises.watch` 提供可由 abort 取消的异步迭代器。同一路径的 listener 共享一个 `StatWatcher`，按 listener 取消监听不会影响其他 listener；缺失路径先报告零值 Stats，随后再报告创建、删除和重建状态。Callback 分发捕获注册时的异步上下文，并在每次排队交付前检查 watcher 是否已经关闭。预先 abort 的 callback watcher 先返回对象、再异步关闭；预先 abort 的 promise watcher 在第一次读取 iterator 时以 `AbortError` 拒绝。
+
+`fs.watch` 把条目创建、删除和 rename 目标映射为 `rename`，把内容或 mode 变化映射为 `change`。非递归目录 watcher 报告直接子项名，递归 watcher 报告相对被监听目录的路径。VFS 没有符号链接，因此该实现不会制造符号链接事件。
+
+### Stream 与未修改的 NPM 包
+
+`node:stream` 使用维护中的 `readable-stream` 浏览器实现来提供 `Readable`、`Writable`、`Duplex`、`Transform`、`PassThrough`、pipeline helper、异步迭代、backpressure、abort 和 teardown 顺序。兼容模块把字节流 high-water mark 默认值设为仓库 Node 22+ 引擎使用的 64 KiB。VFS 支持的 `ReadStream` 与 `WriteStream` 提供文件描述符、闭区间范围、encoding、追加或替换行为、字节计数、AbortSignal 处理，以及 `open`、`ready`、`finish`、`end`、`close` 顺序。Descriptor 在 rename、replacement 和 unlink 后仍保留打开时的文件身份与访问模式；hard link 共享该身份及后续内容和 mode 变化，truncate 增长则用零字节填充。
+
+Chokidar 和 readdirp 作为普通镜像依赖运行，不属于模块 replacement。它们的包代码保持原样，并导入 Worker 实现的 `node:fs`、`node:fs/promises`、`node:stream`、`node:events`、`node:path` 与 `node:os`。因此，初次扫描、`ready`、polling、原子写归一化、写入稳定等待、共享 watcher 与关闭行为仍由 Chokidar 自己负责。
+
+### 基于逐进程 VFS 授权的 Landlock CLI
+
+`@deepseek-ai/node-addon-landlock-run` 是普通镜像依赖，不是模块 replacement。其未经修改的 JavaScript 入口通过 Worker 实现的 `node:child_process`、`node:module`、`node:path` 与 `node:url` 运行，因此该包仍是 `LAUNCHER_BIN`、`LAUNCHER_FAILURE_EXIT`、`launcherPath()`、`grantArgs()` 和 `probe()` 的唯一所有者。镜像可以包含匹配的 Linux optional package，但包解析不决定 Worker 平台是否提供 Landlock；缺少该 optional package 时，入口包产生的确定性 fallback 路径仍到达同一个平台可执行文件实现。
+
+进程层持有按逻辑可执行文件名识别的 Worker 平台可执行文件表，而不依赖某一个包管理器路径。其 `landlock-run` provider 接受裸命令或绝对 launcher 路径，解析 native 包未经修改的 CLI、校验每个授权根，并把内部 argv 交给既有 shell 进程 runner。`node:child_process` 只负责通用的可执行文件查找、输出投递与结束处理。因此，原包的同步 `probe()` 会通过 `spawnSync` 观察到该 provider 并报告 `full`。用法错误、缺失的授权根或未知内部可执行文件只输出一行 `landlock-run: ...`，以 `125` 退出，并且绝不运行内部命令。bwrap 仍探测为不可用，因此未修改的 `sandbox-local` Linux 选择链会选中该 Landlock 后端。
+
+每个已启动进程分别获得一个 `ShellFileSystem` guard。`stat`、`list` 和 `readText` 需要只读或读写授权；`writeText`、`mkdir` 和 `remove` 需要读写授权；`rename` 要求源和目标都可写。Grant root 在 containment 检查前去除尾部分隔符。拒绝错误包含 `EACCES` 与 `permission denied`，从而保持 `bash-sandbox` 的拒绝分类。`/tmp` 映射到 VFS 的 `/dsh/tmp`，`/dev/null` 则是空读、丢弃写入且不保存任何字节的虚拟文件。
+
+Worker 的 `full` 结论覆盖 shell 命令表和 Host 服务 VFS 协议能够表达的全部文件操作。它不表示 Linux 内核 Landlock、不支持任意 native 可执行文件，也无法约束未来绕过 `ShellFileSystem` 的 shell 程序。
+
+### 明确延后的行为
+
+`node:vm`、`node:worker_threads`、`node:net`、`node:sqlite`、native PTY、Sharp 和 ripgrep 不属于本次变更。VFS 仍然只支持 POSIX、内存存储且没有符号链接。Browser Worker 没有 libuv 风格的引用计数事件循环，因此 watcher 的 `persistent`、`ref()` 和 `unref()` 保留 API 与可观察状态，但不能决定 Worker 生存期。
+
+## Alternatives considered
+
+**在 Worker profile 中禁用 watcher 与 sandbox 配置项。** 缩减组合后将不再测试相同的 Host tree，还会隐藏 preview 部署特有的包集成故障。
+
+**让 `watchFile` 成为无事件的成功调用。** 缺失根永远无法推进，已有根则会永久等待 Chokidar `ready`。
+
+**只从 `node:fs` 通知 watcher。** Shell 进程请求以及直接写 VFS 的实现可以绕过通知点。只有提交状态的 `MemoryVfs` 才是完整真源。
+
+**保留 VFS 专用的 Chokidar replacement。** 这会重复实现上游已经维护的目录扫描、ready 计数、写入稳定等待、原子替换、共享 watcher 所有权和 teardown。
+
+**用 Worker 模块替换 Landlock 入口包。** 重新实现其导出常量、授权参数构造、launcher 解析和 probe，会为一个已经能在 Worker Node 兼容层上运行的包约定建立第二份副本。只有平台可执行文件实现需要不同。
+
+**只识别一个精确 launcher 路径。** Optional dependency 的安装状态与入口包已有的 fallback 会为同一个可执行文件产生不同的绝对路径。包管理器布局不是平台能力的身份，因此可执行文件分发使用逻辑名称 `landlock-run`。
+
+**在 `sandbox-local` 中增加 Worker 分支。** 这会把策略到授权的映射复制到业务包中。解释现有 launcher 协议可以保持 provider、consumer、配置、诊断和 native 包 API 不变。
+
+**在全局 VFS 上保存一个当前策略。** 并发前台、后台和升权命令会覆盖彼此的权限。授权必须归属于单个进程句柄及其文件系统适配器。
+
+## Verification
+
+- `fs-watch-stream.spec.ts` 对照当前 Node 版本验证缺失、创建、修改、删除的 `watchFile` 状态转换，以及文件流生命周期、分片、范围、backpressure、字节计数、默认值和 abort 身份。
+- `chokidar.spec.ts` 通过 Worker transformer 与模块 loader 加载 lockfile 选定的两组 Chokidar 和 readdirp 依赖，并在 `MemoryVfs` 上验证 `ready`、callback watcher、polling、缺失文件创建、删除和完全停稳的关闭。
+- `image-loadable.spec.ts` 打包并加载真实的 `@deepseek-ai/node-addon-landlock-run` JavaScript，验证它不在 replacement 表中，并让其 fallback `launcherPath()` 与 `probe()` 经过 Worker 平台可执行文件。`child-process.spec.ts` 与 `sandbox-stack.spec.ts` 随后通过生产 sandbox 和 subprocess 包验证 launcher 失败码、错误 argv 与授权失败、`/tmp` 与 `/dev/null`、rename 拒绝、三种权限模式和逐进程并发授权。
+- `preview-boot.e2e.ts` 构建并启动打包后的浏览器部署，创建 Workspace 与 Session，把缺失的 skill 根逐级推进到可用的 Chokidar watch，读取 catalog，并在没有 watcher 警告的情况下完成 settings 与 credential 写入。
+
+## Consequences
+
+Preview 现在可以在不 fork 源码的情况下运行 NPM watcher 消费方；Host 代码与 shell 进程 Worker 产生的文件系统 mutation 共享同一个有序提交源。WebFS/OPFS 集成仍是围绕该同步权威的异步 mirror，并消费同一个变更源；它不会增加另一份 Chokidar 实现或互相竞争的 mutation 协议。
+
+Worker `read-only` 与 `workspace-write` 在不 fork Landlock NPM 包的情况下保留产品权限词汇和拒绝报告。其安全结论比 native Landlock 更窄，但完整覆盖 Worker 执行世界；任何新的文件系统消息或 shell 程序都必须继续经过受 guard 保护的 `ShellFileSystem`。Native-backed 包遵循同一所有权规则：其 JavaScript 保持上游实现，Worker 平台只替换背后的 native artifact。
+
+Worker bundle 增加 `readable-stream` 及其少量浏览器依赖。相应地，stream 状态和 backpressure 继续由上游维护，不成为本地兼容代码。
+
+Watcher 事件时序由 VFS 提交确定，而不是继承操作系统后端。Node watcher 约定本身不保证 native 事件合并方式，因此该实现仍符合约定；测试固定当前消费方依赖的每一种事件区别。

.agents/notes/implemented/bug-fix/2026-08-20-plugin-owned-shipped-preset-root.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-08-20-plugin-owned-shipped-preset-root.md
+2026-08-20-plugin-owned-shipped-preset-root.md: 43bcc685c2edfa5d125139b998d75ce8b308f60d
+2026-08-20-plugin-owned-shipped-preset-root.zh.md: c2cc586a7a17d7cdb818523a74320fae106eb773

.agents/notes/implemented/bug-fix/2026-08-20-plugin-owned-shipped-preset-root.md

@@ -0,0 +1,33 @@
+# Agent Note: The shipped preset root is the plugin's own
+
+Status: implemented
+
+English | [中文](2026-08-20-plugin-owned-shipped-preset-root.zh.md)
+
+## Problem
+
+`composeProfile` delivered the shipped agent-preset root by pushing a boot-time overlay whose `config` spread the composed roster row and then hard-set `roots` to the shipped root alone. Because an id-targeted patch replaces the whole `config` value, the overlay squashed every root the profile's `cordis.patch.yml` (or the home layer, or a `--patch` overlay) had configured: a deployment pointing `agent-presets` at a shared preset directory booted with only the shipped root plus the roster's writable home root, and every custom preset vanished from the Web picker. `dsh --dump-config` composes only the file-backed layers, so the dump showed the configured roots intact while the boot dropped them. The overlay also froze the row's boot-time `config` above every live reload, so no `cordis.patch.yml` edit to the row took effect until restart. Externally reported with an accurate root cause in discussion #3636.
+
+Under the whole-`config`-replacement patch semantics, any "must survive user layers" value needs enforcement after composition — and review rejected keeping that enforcement in the launcher: `apps/cli` special-casing one plugin's row id, config keys, and precedence is coupling the composition machinery should not carry.
+
+## Decision
+
+The shipped presets are the plugin's own. The four built-in compositions moved from `apps/cli/config/agent-presets/` into `packages/preset/agent-presets/presets/`, listed in the package's `files`, and `dsh-agent-presets` resolves `SHIPPED_PRESET_ROOT` relative to its own module — the Loader imports the plugin by package name at runtime, so the directory exists on disk in both the source and installed layouts, the same mechanism that lets the `cordis` preset carry its skills inside its directory. `resolvedRoots` becomes shipped root (`system` trust) unless `includeShippedRoot` is false, then `config.roots` in order, then the derived writable home root unless `includeUserRoot` is false — prepended, so the shipped set always mounts and wins a duplicate id.
+
+This completes the [per-session preset roster](../architecture/2026-08-03-per-session-agent-presets.md) direction that #2278 started for the writable root: both non-configured roots are now the package's, the launcher composes patch layers with no plugin knowledge, and the squash, the reload freeze, and the dump divergence stop being possible rather than being corrected. The always-load guarantee no longer rides patch ordering: `includeShippedRoot` defaults true in the schema, so a user layer replacing the row's whole `config` keeps the shipped set, and only an explicit `false` — as deliberate as disabling the row — drops it. The compositions bind to the host's agent-plane services, not to the Web surface: no preset row names a client or web plugin, and a host lacking an injected service leaves that row waiting exactly as under any other root.
+
+## Testing
+
+`shipped-root.spec.ts` covers the plugin ownership directly: a bare roster lists the four shipped presets healthy and `system`-trusted (proving the moved files resolve from the package), the shipped root precedes configured roots and the derived user root with a fixture directory claiming a shipped id shadowed, and `includeShippedRoot: false` mounts the roster without the set. Existing suites that pin exact rosters opt out, which the option's documentation names as its second purpose. The Web composition e2e boots the real bundles with no roots anywhere in config and asserts the shipped four plus a configured shared root's preset, shipped-id shadowing, and a configured-root preset composing an agent; running it against the built `lib/` verifies the bundled layout resolves the directory too. Gate scripts (`verify-cordis-config`, `verify-runtime-closure`) scan the new location.
+
+## Alternatives considered
+
+**Keep the launcher patch but derive it per composition, prepending instead of replacing.** The first merged-nowhere iteration of this fix: correct on the squash, the reload freeze, and the dump (which gained the derived layer as a labeled dump layer), with the reporter's overlay-prepend shape as its core. Superseded in review because every variant keeps `apps/cli` special-casing the roster row; the coupling, not the mechanics, was the objection.
+
+**Have the bundle declare the shipped root itself (`!!js` package-relative path).** Removes the launcher coupling but hangs the always-load guarantee back on patch ordering: a user layer replacing the row's `config` drops the bundle's entry — the reported bug's shape again.
+
+**Provide the root out of band (a launcher-provided context value the plugin prepends).** The launcher still has to know to provide a preset fact; the special case survives in a different channel.
+
+## Consequences
+
+`config.roots` is purely deployment-added directories; the dump shows exactly that, and the shipped root is documented plugin behavior surfaced at runtime through `agentPresets.roots`. `apps/cli` ships no `config/` directory and its `files` entry is gone. Any composition that mounts the roster — and any embedder of the package — gets the shipped set by default and turns it off with one config line; embedders wanting bare machinery set `includeShippedRoot: false`. The presets' bare plugin names still resolve through the boot's flat installation fallback, unchanged by the move.

.agents/notes/implemented/bug-fix/2026-08-20-plugin-owned-shipped-preset-root.zh.md

@@ -0,0 +1,33 @@
+# Agent Note: The shipped preset root is the plugin's own
+
+Status: implemented
+
+[English](2026-08-20-plugin-owned-shipped-preset-root.md) | 中文
+
+## 问题
+
+`composeProfile` 交付内置 agent-preset 根目录的方式，是在启动时推入一个 overlay：其 `config` 展开已组合的 roster 行后，把 `roots` 硬设为仅含内置根。由于 id 定向补丁整体替换 `config` 值，这个 overlay 压掉了 profile 的 `cordis.patch.yml`（以及 home 层、`--patch` overlay）配置的全部根目录：把 `agent-presets` 指向共享 preset 目录的部署，启动后只剩内置根加 roster 的可写 home 根，所有自定义 preset 从 Web 选择器中消失。`dsh --dump-config` 只组合文件承载的层，dump 显示配置的根目录完好而启动却丢弃了它们。该 overlay 还把行的启动时 `config` 冻结在所有热重载之上，重启前对该行的任何 `cordis.patch.yml` 编辑都不生效。外部报告 discussion #3636 给出了准确根因。
+
+在"补丁整体替换 `config`"的语义下，任何"必须在用户层之后存活"的值都需要组合后的强制注入——而评审否决了把这份强制留在启动器里：`apps/cli` 对某一个插件的行 id、config 键与优先级做特判，是组合机器不应携带的耦合。
+
+## 决定
+
+内置 preset 归插件自有。四套内置组合从 `apps/cli/config/agent-presets/` 搬入 `packages/preset/agent-presets/presets/`，列入包的 `files`；`dsh-agent-presets` 相对自己的模块解析 `SHIPPED_PRESET_ROOT`——Loader 在运行时按包名导入插件，目录在源码与安装两种布局中都真实存在于磁盘上，与 `cordis` preset 目录内随行携带 skill 依赖的是同一机制。`resolvedRoots` 变为：除非 `includeShippedRoot` 为 false，先是内置根（`system` 信任），再按序 `config.roots`，最后除非 `includeUserRoot` 为 false 追加推导的可写 home 根——前置，因此内置集合始终挂载并赢得重复 id。
+
+这补全了 #2278 为可写根开启的[会话级 preset roster](../architecture/2026-08-03-per-session-agent-presets.zh.md) 方向：两个非配置根现在都属于本包，启动器不带任何插件知识地组合补丁层，压掉、重载冻结与 dump 分叉从"被修复"变为"不再可能发生"。"一定加载"的保证不再依赖补丁顺序：`includeShippedRoot` 在 schema 中默认 true，用户层整体替换该行 `config` 后内置集合依然保留，只有显式 `false`——与整行 disable 同级的故意行为——才会去掉它。组合绑定的是宿主的 agent-plane 服务而非 Web 表面：没有任何 preset 行引用 client 或 web 插件；宿主缺少被注入的服务时，该行保持等待，与任何其他根目录下的 preset 无异。
+
+## 测试
+
+`shipped-root.spec.ts` 直接覆盖插件所有权：裸 roster 列出四套内置 preset 且健康、`system` 信任（证明搬移后的文件能从包内解析）；内置根前置于配置根与推导用户根之前，fixture 目录占用内置 id 时被遮蔽；`includeShippedRoot: false` 挂载不含内置集合的 roster。钉住确切 roster 的既有套件选择关闭，这正是该选项文档命名的第二用途。Web 组合 e2e 以 config 中零 roots 启动真实 bundle，断言内置四套加配置共享根的 preset、内置 id 遮蔽、以及配置根 preset 组合出 agent；对 built `lib/` 运行验证打包布局同样解析得到目录。门禁脚本（`verify-cordis-config`、`verify-runtime-closure`）扫描新位置。
+
+## 曾考虑的替代方案
+
+**保留启动器补丁但按组合派生、前置而非替换。** 本修复未曾合入的第一版：对压掉、重载冻结与 dump（曾以带标签层渲染派生补丁）判断均正确，核心即报告者的 overlay 前置形状。在评审中被替代，因为每个变体都让 `apps/cli` 对 roster 行做特判；被否决的是耦合而非机制。
+
+**由 bundle 自己声明内置根（`!!js` 包相对路径）。** 去掉启动器耦合，但把"一定加载"的保证重新挂回补丁顺序：用户层整体替换该行 `config` 时 bundle 的条目被丢弃——又回到所报 bug 的形状。
+
+**带外提供根目录（启动器提供的上下文值，由插件前置）。** 启动器仍需知道"要为 preset 提供一个事实"；特判换了通道继续存在。
+
+## 后果
+
+`config.roots` 纯粹是部署追加的目录；dump 展示的正是它，内置根成为文档化的插件行为，运行时经 `agentPresets.roots` 呈现。`apps/cli` 不再携带 `config/` 目录，其 `files` 条目移除。任何挂载 roster 的组合——以及任何嵌入本包的使用方——默认获得内置集合，一行配置即可关闭；只要纯机制的嵌入方设 `includeShippedRoot: false`。preset 里的裸插件名仍经启动的扁平安装后备解析，搬移不改变这一点。

.agents/notes/implemented/feature/2026-07-29-persistent-bash-str-replace-editor.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-29-persistent-bash-str-replace-editor.md
-2026-07-29-persistent-bash-str-replace-editor.md: 982b0b87553e15fab8fd6a2718dbe2462cfb3bd9
-2026-07-29-persistent-bash-str-replace-editor.zh.md: 05935f8164018d0c476f85ccc5e6c0e87890f979
+2026-07-29-persistent-bash-str-replace-editor.md: e8e37b7e534773429a9c6fe0f63bb8d5460de364
+2026-07-29-persistent-bash-str-replace-editor.zh.md: 71034ba615e09e09ec03212b6d5535959df73f4a

.agents/notes/implemented/feature/2026-07-29-persistent-bash-str-replace-editor.md

@@ -18,7 +18,7 @@ Some deployments need a one-call Bash schema whose shell state survives across m
 
 Both plugins are included in the Python runtime closure. The persistent Bash closure also includes the PTY service/local backend and the sandbox services required by that backend. Because `node-pty` executes a native `spawn-helper` on macOS, each packaged macOS runtime executable ships with a `-spawn-helper` sibling; Linux uses `forkpty` directly. A pinned `node-pty` patch checks `DSH_NODE_PTY_SPAWN_HELPER` first, so it remains a true override for a current external consumer that supplies a non-sibling helper. When the override is unset, the patch resolves the packaged executable sibling if present and otherwise preserves upstream lookup in ordinary Node runs. The macOS builders fail before publication when the helper is absent or not executable.
 
-The shipped [`minimal` agent preset](../../../../apps/cli/config/agent-presets/minimal/agent.cordis.yml) composes both plugins for the Claude SWE-compatible RL contract. Its entry-local PTY realm carries the registry, local backend, and persistent Bash tool; the editor registers beside that realm against the host filesystem. The preset fixes the complete system prompt, follows the deployment tool-presentation mode, omits every other model-facing consumer, and leaves browser, Workspace, persistence, sandbox, and permission services on the shared Web host. The local PTY backend resolves the effective session sandbox mode when it creates the shell. While that owner has an open shell or a spawn in progress, a different permission mode is rejected before its session event commits; the editor continues through the Web filesystem sandbox. The [minimal-preset decision](../bug-fix/2026-08-10-minimal-preset-owns-rl-composition.md) owns this composition boundary.
+The shipped [`minimal` agent preset](../../../../packages/preset/agent-presets/presets/minimal/agent.cordis.yml) composes both plugins for the Claude SWE-compatible RL contract. Its entry-local PTY realm carries the registry, local backend, and persistent Bash tool; the editor registers beside that realm against the host filesystem. The preset fixes the complete system prompt, follows the deployment tool-presentation mode, omits every other model-facing consumer, and leaves browser, Workspace, persistence, sandbox, and permission services on the shared Web host. The local PTY backend resolves the effective session sandbox mode when it creates the shell. While that owner has an open shell or a spawn in progress, a different permission mode is rejected before its session event commits; the editor continues through the Web filesystem sandbox. The [minimal-preset decision](../bug-fix/2026-08-10-minimal-preset-owns-rl-composition.md) owns this composition boundary.
 
 ## Alternatives considered
 

.agents/notes/implemented/feature/2026-07-29-persistent-bash-str-replace-editor.zh.md

@@ -18,7 +18,7 @@ Status: implemented
 
 两个插件都进入 Python runtime 闭包。持久 Bash 的闭包还包含 PTY 服务／本地后端，以及该后端要求的沙箱服务。由于 `node-pty` 在 macOS 上会执行原生 `spawn-helper`，每个打包后的 macOS 运行时可执行文件都会携带一个 `-spawn-helper` 伴随文件；Linux 直接使用 `forkpty`。固定版本的 `node-pty` 补丁会先检查 `DSH_NODE_PTY_SPAWN_HELPER`，因此对当前提供非伴随 helper 的外部消费方而言，该变量仍是真正的覆盖项。未设置该覆盖时，补丁会在打包可执行文件的伴随文件存在时解析它，否则在普通 Node 运行中保留上游查找方式。若 helper 缺失或不可执行，macOS 构建器会在发布前失败。
 
-随附的 [`minimal` agent preset](../../../../apps/cli/config/agent-presets/minimal/agent.cordis.yml) 会组合这两个插件，以满足与 Claude SWE 兼容的 RL 约定。其 entry 本地 PTY realm 持有注册表、本地后端和持久 Bash 工具；编辑器在该 realm 旁注册，并使用宿主文件系统。preset 会固定完整系统提示词、跟随部署的工具呈现模式，省略其他所有面向模型的消费方，并将浏览器、Workspace、持久化、沙箱与权限服务留在共享 Web 宿主上。本地 PTY 后端会在创建 shell 时解析会话的有效沙箱模式。只要该所有者仍有打开的 shell 或仍在进行中的 spawn，另一种权限模式就会在对应的会话事件提交前遭到拒绝；编辑器则继续经由 Web 文件系统沙箱运行。这一组合边界由 [minimal-preset 决策](../bug-fix/2026-08-10-minimal-preset-owns-rl-composition.zh.md)负责说明。
+随附的 [`minimal` agent preset](../../../../packages/preset/agent-presets/presets/minimal/agent.cordis.yml) 会组合这两个插件，以满足与 Claude SWE 兼容的 RL 约定。其 entry 本地 PTY realm 持有注册表、本地后端和持久 Bash 工具；编辑器在该 realm 旁注册，并使用宿主文件系统。preset 会固定完整系统提示词、跟随部署的工具呈现模式，省略其他所有面向模型的消费方，并将浏览器、Workspace、持久化、沙箱与权限服务留在共享 Web 宿主上。本地 PTY 后端会在创建 shell 时解析会话的有效沙箱模式。只要该所有者仍有打开的 shell 或仍在进行中的 spawn，另一种权限模式就会在对应的会话事件提交前遭到拒绝；编辑器则继续经由 Web 文件系统沙箱运行。这一组合边界由 [minimal-preset 决策](../bug-fix/2026-08-10-minimal-preset-owns-rl-composition.zh.md)负责说明。
 
 ## 考虑过的替代方案
 

THIRD_PARTY_NOTICES.md

@@ -92,6 +92,7 @@ External packages that a workspace package resolves at runtime. The tier covers
 | [`picomatch`](https://github.com/micromatch/picomatch) | MIT |
 | [`react`](https://github.com/facebook/react) | MIT |
 | [`react-dom`](https://github.com/facebook/react) | MIT |
+| [`readable-stream`](https://github.com/nodejs/readable-stream) | MIT |
 | [`sharp`](https://github.com/lovell/sharp) | Apache-2.0 |
 | [`shiki`](https://github.com/shikijs/shiki) | MIT |
 | [`supports-color`](https://github.com/chalk/supports-color) | MIT |
@@ -146,6 +147,7 @@ External packages **directly declared** only by repository tooling, test infrast
 | [`@types/picomatch`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
 | [`@types/react`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
 | [`@types/react-dom`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/readable-stream`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
 | [`@types/spdx-expression-parse`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
 | [`@types/turndown`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
 | [`@types/use-sync-external-store`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |

apps/cli/package.json

@@ -15,12 +15,11 @@
     "dsh": "lib/bin.js"
   },
   "files": [
-    "lib/*.js",
-    "config"
+    "lib/*.js"
   ],
   "dsh": {
     "configTrees": [
-      { "mount": "config/agent-presets", "path": "config/agent-presets", "scanRoster": true }
+      { "mount": "config/agent-presets", "path": "../../packages/preset/agent-presets/presets", "scanRoster": true }
     ]
   },
   "license": "MIT",

apps/cli/src/profile-boot.ts

@@ -30,10 +30,6 @@ import {
   type Profile,
 } from '@deepseek-ai/dsh-app-boot'
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
-
-/** Shipped agent-preset root: beside this app's own config, in both source and built layouts. */
-const SHIPPED_PRESET_ROOT = fileURLToPath(new URL('../config/agent-presets/', import.meta.url))
-
 import { DSH_LAUNCH_ENVIRONMENT_KEY, type LaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment'
 import { provideCmdline, type AppReady } from '@deepseek-ai/dsh-cmdline'
 import { createProcessShutdown, type ProcessShutdown } from './process-shutdown.ts'
@@ -126,7 +122,7 @@ export function prepareProfile(name: string, userLayer = true): Profile {
   return profile
 }
 
-/** One profile's patch layers (application order) and the row index of its pre-flag composition. */
+/** One profile's patch layers, in application order. */
 interface ComposedProfile {
   profile: Profile
   /** Bundle layers concatenated — the part below the user layers on a live reload. */
@@ -135,11 +131,6 @@ interface ComposedProfile {
   homePatches: PatchOptions[]
   /** Layers above the user layers on a live reload: `--patch` overlays and the telemetry switch. */
   overlays: PatchOptions[]
-  /**
-   * id → row of the composed tree (bundles + user layers + overlays), for the
-   * launcher's own row checks.
-   */
-  rows: ReadonlyMap<string, EntryOptions>
 }
 
 /** The full patch stack of one composed profile, in application order. */
@@ -161,7 +152,7 @@ function allPatches(composed: ComposedProfile): PatchOptions[] {
  * then the telemetry switch.
  * @param name - the profile name.
  * @param patchFiles - `--patch` overlay paths, in argv order.
- * @returns the profile, its patch layers, and the composed row index.
+ * @returns the profile and its patch layers.
  */
 function composeProfile(
   name: string,
@@ -176,22 +167,9 @@ function composeProfile(
     if (typeof row.id === 'string') rows.set(row.id, row)
   }
   const composedOverlays = [...overlays]
-  // The SHIPPED root is the part of the roster only this app can resolve: it
-  // sits beside this app's own config, in both the source and built layouts.
-  // The writable root the roster appends is `dsh-agent-presets`' own, so a
-  // launcher that never reaches this patch still finds a person's presets.
-  if (rows.has('agent-presets')) {
-    composedOverlays.push({
-      id: 'agent-presets',
-      config: {
-        ...(rows.get('agent-presets')?.config ?? {}) as Record<string, unknown>,
-        roots: [{ path: SHIPPED_PRESET_ROOT, trust: 'system' }],
-      },
-    })
-  }
   const telemetryPatch = resolveTelemetryPatch(process.env.DSH_TELEMETRY_DISABLED, rows.has(TELEMETRY_ROW_ID))
   if (telemetryPatch !== undefined) composedOverlays.push(telemetryPatch)
-  return { profile, bundlePatches, homePatches, overlays: composedOverlays, rows }
+  return { profile, bundlePatches, homePatches, overlays: composedOverlays }
 }
 
 /** Options for {@link runProfile}. */

apps/cli/tests/web-agent-presets.e2e.ts

@@ -11,7 +11,7 @@ import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import { settingsNamespace } from '@deepseek-ai/dsh-settings'
-import { resolveSessionPreset, SETTINGS_NAMESPACE } from '@deepseek-ai/dsh-agent-presets'
+import { resolveSessionPreset, SETTINGS_NAMESPACE, SHIPPED_PRESET_ROOT } from '@deepseek-ai/dsh-agent-presets'
 import { applyChildComposition, childSessionMeta } from '@deepseek-ai/dsh-subagent'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import type {} from '@deepseek-ai/dsh-compaction-basic'
@@ -21,7 +21,6 @@ import type {} from '@deepseek-ai/dsh-tools'
 import type {} from '@deepseek-ai/dsh-session-projection'
 import type {} from '@deepseek-ai/dsh-token-meter'
 
-const CONFIG_DIR = fileURLToPath(new URL('../config/', import.meta.url))
 const REPO_ROOT = fileURLToPath(new URL('../../..', import.meta.url))
 /** The shipped Web surface: the dsh-base and dsh-web-app bundle patches over an empty preset root. */
 const BASE_PATCH = join(REPO_ROOT, 'packages/bundle/base/cordis.patch.yml')
@@ -56,8 +55,8 @@ async function bootWeb(
     // The settings row defaults to `$DSH_HOME/settings.yaml`. Left alone it
     // reads the developer's own document — and since the default preset is a
     // setting, a stored `agent-presets.default` would decide this file's
-    // outcome. Point it at a temp file for the same reason the roster below
-    // names only the shipped root.
+    // outcome. Point it at a temp file for the same reason the roster row
+    // below pins `includeUserRoot` off.
     { id: 'settings', config: { path: settingsFile, watch: false } },
     // storage-json's root is anchored to the real $DSH_HOME. Unpinned, this
     // file writes the developer's own `~/.dsh/storages/` — and then reads it
@@ -95,18 +94,12 @@ async function bootWeb(
       { id: 'directory-picker-browse', name: '@deepseek-ai/dsh-host-directory-picker-browse' },
       { id: 'ui-directory-picker-browse', name: '@deepseek-ai/dsh-client-ui-directory-picker-browse' },
     ] },
-    // The roster AppCLIEntry would patch in; only the shipped root, so a
-    // developer's own `~/.dsh/.preset` cannot change this test's outcome.
+    // Pin the roster away from the developer's machine: `includeUserRoot`
+    // false keeps `~/.dsh/.agent-presets` from changing a test's outcome.
     // `default` here is the COMPOSITION default — the base layer the settings
-    // document overrides.
-    {
-      id: 'agent-presets',
-      config: {
-        default: 'standard',
-        roots: [{ path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' }],
-        includeUserRoot: false,
-      },
-    },
+    // document overrides. No `roots` entry: the plugin bundles the shipped
+    // presets itself and prepends their root.
+    { id: 'agent-presets', config: { default: 'standard', includeUserRoot: false } },
     ...extra,
   ]
   // The surface is patch layers over an empty preset root, so the root sits
@@ -369,7 +362,7 @@ describe('the shipped Web composition', () => {
     // The preset's skill root is derived from its own `baseUrl`, so the skill
     // travels with the directory wherever the preset is installed.
     const skill = join(
-      CONFIG_DIR, 'agent-presets', 'cordis', 'skills', 'editing-cordis-compositions', 'SKILL.md',
+      SHIPPED_PRESET_ROOT, 'cordis', 'skills', 'editing-cordis-compositions', 'SKILL.md',
     )
 
     expect((await readFile(skill, 'utf8')).startsWith('---\nname: editing-cordis-compositions')).toBe(true)
@@ -441,7 +434,7 @@ describe('the shipped Web composition', () => {
     // agent down disposes its whole subtree. Inherited, that rewrote the
     // shipped composition — truncating it to `[]` the first time a session
     // ended — so `PresetTree` refuses to write at all.
-    const path = join(CONFIG_DIR, 'agent-presets', 'standard', 'agent.cordis.yml')
+    const path = join(SHIPPED_PRESET_ROOT, 'standard', 'agent.cordis.yml')
     const before = await readFile(path, 'utf8')
 
     const handle = await ctx.agents.create({
@@ -469,7 +462,7 @@ describe('product Bundle and user-preset intersection', () => {
     const root = await mkdtemp(join(tmpdir(), 'dsh-product-presets-'))
     const userRoot = join(root, 'presets')
     const settingsFile = join(root, 'settings.yaml')
-    const standard = await readFile(join(CONFIG_DIR, 'agent-presets', 'standard', 'agent.cordis.yml'), 'utf8')
+    const standard = await readFile(join(SHIPPED_PRESET_ROOT, 'standard', 'agent.cordis.yml'), 'utf8')
     await writeFile(settingsFile, '{}\n')
     for (const id of presetIds) {
       let composition = standard
@@ -496,10 +489,8 @@ describe('product Bundle and user-preset intersection', () => {
         id: 'agent-presets',
         config: {
           default: 'standard',
-          roots: [
-            { path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' },
-            { path: userRoot, trust: 'user' },
-          ],
+          // The shipped root is the plugin's own, prepended before this.
+          roots: [{ path: userRoot, trust: 'user' }],
           includeUserRoot: false,
         },
       },
@@ -736,15 +727,11 @@ describe('a launcher that configures no writable root', () => {
     )
     const settingsFile = join(await mkdtemp(join(tmpdir(), 'dsh-preset-derived-settings-')), 'settings.yaml')
     await writeFile(settingsFile, '{}\n')
-    // Only the shipped root, exactly what `composeProfile` supplies; the
+    // No configured roots: the shipped one is the plugin's own, and the
     // writable one is the roster's own default rather than this patch's job.
     derivedCtx = await bootWeb(settingsFile, [{
       id: 'agent-presets',
-      config: {
-        default: 'standard',
-        roots: [{ path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' }],
-        includeUserRoot: true,
-      },
+      config: { default: 'standard', includeUserRoot: true },
     }])
   }, 120_000)
 
@@ -787,12 +774,10 @@ describe('authoring a preset on the shipped composition', () => {
       id: 'agent-presets',
       config: {
         default: 'standard',
-        roots: [
-          { path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' },
-          // The root does not exist yet: a deployment whose user has authored
-          // nothing is the normal first-run state.
-          { path: userRoot, trust: 'user' },
-        ],
+        // The root does not exist yet: a deployment whose user has authored
+        // nothing is the normal first-run state. The shipped root is the
+        // plugin's own, prepended before this.
+        roots: [{ path: userRoot, trust: 'user' }],
         includeUserRoot: false,
       },
     }])
@@ -899,3 +884,64 @@ describe('a session keeps the preset it was created with', () => {
     }
   })
 })
+
+describe('a composition that configures its own preset roots', () => {
+  let rootsCtx: Context
+  let teamRoot: string
+
+  beforeAll(async () => {
+    const home = await mkdtemp(join(tmpdir(), 'dsh-preset-roots-'))
+    const settingsFile = join(home, 'settings.yaml')
+    await writeFile(settingsFile, '{}\n')
+    // A workspace-shared root beside the deployment: one preset of its own,
+    // plus a directory that claims a shipped id.
+    teamRoot = join(home, 'team-presets')
+    const minimalComposition = await readFile(join(SHIPPED_PRESET_ROOT, 'minimal', 'agent.cordis.yml'), 'utf8')
+    for (const id of ['team-spec', 'minimal']) {
+      await mkdir(join(teamRoot, id), { recursive: true })
+      await writeFile(join(teamRoot, id, 'agent.cordis.yml'), minimalComposition)
+    }
+    // The user layer of the reported regression: a profile's cordis.patch.yml
+    // configuring a shared preset root. The plugin must EXTEND it with its
+    // own shipped root, never lose it.
+    rootsCtx = await bootWeb(settingsFile, [{
+      id: 'agent-presets',
+      config: {
+        default: 'standard',
+        roots: [{ path: teamRoot, trust: 'user' }],
+        includeUserRoot: false,
+      },
+    }])
+  }, 120_000)
+
+  afterAll(async () => {
+    await rootsCtx.fiber.dispose()
+  })
+
+  it('keeps configured roots alongside the always-prepended shipped root', async () => {
+    expect(rootsCtx.agentPresets.roots.map(root => root.path)).toEqual([
+      SHIPPED_PRESET_ROOT,
+      teamRoot,
+    ])
+
+    const listed = await rootsCtx.agentPresets.list()
+    expect(listed.map(preset => preset.id).sort()).toEqual(['code', 'cordis', 'minimal', 'standard', 'team-spec'])
+    expect(listed.every(preset => preset.broken === undefined)).toBe(true)
+    // The shipped root comes first: a configured directory claiming a shipped
+    // id is shadowed, never the other way around.
+    expect(listed.find(preset => preset.id === 'minimal')?.trust).toBe('system')
+    expect(listed.find(preset => preset.id === 'team-spec')?.trust).toBe('user')
+  })
+
+  it('composes an agent from a configured-root preset', async () => {
+    const handle = await rootsCtx.agents.create({
+      sessionId: SessionId('preset-team-spec'),
+      setup: agentCtx => rootsCtx.agentPresets.mount(agentCtx, 'team-spec').then(() => undefined),
+    })
+    try {
+      expect(toolNames(rootsCtx, handle.agent)).toEqual(['bash', 'str_replace_editor'])
+    } finally {
+      await handle.dispose()
+    }
+  })
+})

apps/cli/tests/windows-shell.spec.ts

@@ -13,11 +13,12 @@
 import { afterEach, describe, expect, it } from 'vitest'
 import { mkdtempSync, rmSync, readFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
+import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import yaml from 'js-yaml'
 import { entryListSchema } from '@deepseek-ai/cordis-plugin-include'
 import { evaluate } from '@deepseek-ai/cordis-plugin-loader'
+import { SHIPPED_PRESET_ROOT } from '@deepseek-ai/dsh-agent-presets'
 import { composeEntries, initProfile, loadProfile, PROFILES_DIR } from '@deepseek-ai/dsh-app-boot'
 
 /**
@@ -101,7 +102,7 @@ describe('the shipped shell composition (real bundle layers)', () => {
 })
 
 describe('shipped agent presets gate both shell tools by platform', () => {
-  const presetRoot = resolve(fileURLToPath(new URL('../package.json', import.meta.url)), '..', 'config', 'agent-presets')
+  const presetRoot = SHIPPED_PRESET_ROOT
 
   it.each(['standard', 'code', 'cordis'])('preset %s gates its shell tool rows by platform', (preset) => {
     const entries: unknown = yaml.load(

apps/web/src/preview.ts

@@ -1,12 +1,14 @@
 /**
  * Worker-preview bootstrap: the one module preview.html adds ahead of the
- * stock entry tag. Connecting the worker host installs the boot globals and
- * settles `__DSH_BOOT_READY__`, where the stock entry's pre-boot await holds,
- * so everything after this module is the served startup chain verbatim. A
- * failed handshake rejects the deferred into the boot page's failure
- * rendering; this module owns no page painting.
+ * stock entry tag. The runtime's optional source stage owns the pre-Cordis
+ * chooser; the unchanged Host connector then owns the Worker handshake.
+ * Everything after those calls is the served startup chain verbatim.
  */
 import DshWorker from '@deepseek-ai/dsh-experimental-webworker-runtime/worker?worker'
-import { connectWorkerHost, IMAGE_FILE_NAME } from '@deepseek-ai/dsh-experimental-webworker-runtime/client'
+import {
+  chooseWorkerHostSource, connectWorkerHost, IMAGE_FILE_NAME,
+} from '@deepseek-ai/dsh-experimental-webworker-runtime/client'
 
-await connectWorkerHost(new DshWorker({ name: 'dsh-host' }), { image: `preview/${IMAGE_FILE_NAME}` })
+const image = `preview/${IMAGE_FILE_NAME}`
+const source = await chooseWorkerHostSource({ image })
+await connectWorkerHost(new DshWorker({ name: 'dsh-host' }), { image, overlays: source.overlays })

apps/web/tests/agent-preset-authoring.e2e.ts

@@ -27,8 +27,8 @@ const SECTION_EXPECTED = join(SNAPSHOT_DIR, 'section.expected.md')
 const COPY_DIALOG_EXPECTED = join(SNAPSHOT_DIR, 'copy-dialog.expected.md')
 const CREATED_EXPECTED = join(SNAPSHOT_DIR, 'created.expected.md')
 const DAMAGED_EXPECTED = join(SNAPSHOT_DIR, 'damaged.expected.md')
-/** The shipped roster, beside the composition that names it. */
-const SHIPPED_PRESETS = fileURLToPath(new URL('../../cli/config/agent-presets', import.meta.url))
+/** The shipped roster, bundled inside the `dsh-agent-presets` package. */
+const SHIPPED_PRESETS = fileURLToPath(new URL('../../../packages/preset/agent-presets/presets', import.meta.url))
 const OVERLAY = fileURLToPath(new URL('./agent-preset-authoring.overlay.yml', import.meta.url))
 const MODE = webSnapshotMode()
 
@@ -60,10 +60,8 @@ describe('web e2e: agent-preset authoring is a host-side copy', () => {
     scaffold = await launchWebScaffold({
       extraOverlayPath: OVERLAY,
       agentPresets: {
-        roots: [
-          { path: SHIPPED_PRESETS, trust: 'system' },
-          { path: userRoot, trust: 'user' },
-        ],
+        // The shipped root is the plugin's own, prepended before this.
+        roots: [{ path: userRoot, trust: 'user' }],
         default: 'standard',
       },
     })

apps/web/tests/agent-preset-selection.e2e.ts

@@ -1,7 +1,5 @@
-// Web e2e scenario: agent-preset selection. The roster's `roots` is an
-// assembly fact the CLI entry resolves and patches in, so every other lane
-// boots with an empty roster and no preset surface at all; this is the one
-// lane that mounts the SHIPPED presets and puts them in front of a browser.
+// Web e2e scenario: agent-preset selection. Every lane mounts the plugin's
+// own shipped presets; this is the lane that puts them in front of a browser.
 //
 // Two surfaces, one host rule: a session's composition is fixed when the
 // session starts. Before that, the new-session chip stages the choice beside
@@ -30,8 +28,6 @@ const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/agent-preset-selection',
 const HERO_EXPECTED = join(SNAPSHOT_DIR, 'hero.expected.md')
 const MENU_EXPECTED = join(SNAPSHOT_DIR, 'menu.expected.md')
 const HEADER_EXPECTED = join(SNAPSHOT_DIR, 'header.expected.md')
-/** The shipped roster, beside the composition that names it. */
-const SHIPPED_PRESETS = fileURLToPath(new URL('../../cli/config/agent-presets', import.meta.url))
 const MODE = webSnapshotMode()
 const SEED_ID = 'agent-preset-selection-web-e2e'
 /** A project skill only a preset that mounts `skill-filesystem` can discover. */
@@ -173,9 +169,9 @@ describe('web e2e: agent-preset selection', () => {
   let tripwire: ReturnType<typeof watchConsole>
 
   beforeAll(async () => {
-    scaffold = await launchWebScaffold({
-      agentPresets: { roots: [{ path: SHIPPED_PRESETS, trust: 'system' }], default: 'standard' },
-    })
+    // The scaffold's default roster pin is exactly this scenario's shape: the
+    // plugin's shipped presets, default `standard`.
+    scaffold = await launchWebScaffold({})
     // A resumed session runs what it was created with; seeding one that
     // records `minimal` is what makes the header label a claim about the
     // session rather than an echo of the current default.

apps/web/tests/preview-boot.e2e.ts

@@ -8,25 +8,33 @@
  * Two milestones prove that happened — the host's `tree active` boot line,
  * whose lowering contract must be the one this checkout's packer emits, and the
  * workspace hero, which paints only after the client tree comes up over the
- * tunnel.
+ * tunnel. The same page opens the seeded Workspace and showcase Session,
+ * verifies its tool/subagent/history examples, then writes through the
+ * settings and credentials providers. That keeps the upstream Chokidar
+ * instances exercised over the Worker filesystem implementation.
  *
  * The site is served the way a static host serves it: bytes from `dist/` with
  * no rewrite rules, so a missing file is a 404 rather than the index page.
  */
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { tmpdir } from 'node:os'
-import { extname, join, normalize } from 'node:path'
+import { dirname, extname, join, normalize } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { chromium } from 'playwright'
 import type { Browser } from 'playwright'
 import { expect, it } from 'vitest'
 import {
-  composeProfile, configTrees, indexWorkspacePackages, packVfsImage, WRAPPER_CONTRACT,
+  composeProfile, configTrees, indexWorkspacePackages, packVfsImage, packVfsOverlay,
+  previewFixtures, WRAPPER_CONTRACT,
 } from '@deepseek-ai/dsh-experimental-webworker-packer'
-import { IMAGE_FILE_NAME } from '@deepseek-ai/dsh-experimental-webworker-runtime'
+import {
+  IMAGE_FILE_NAME, PREVIEW_FIXTURE_MANIFEST_FILE, PREVIEW_FIXTURE_MANIFEST_VERSION,
+  type PreviewFixtureManifest,
+} from '@deepseek-ai/dsh-experimental-webworker-runtime'
+import { captureStableAria, compareOrRefreshGolden, webSnapshotMode } from './scaffold.ts'
 import { newEnglishPage, REPO_ROOT, saveFailureShot } from './support.ts'
 
 const DIST_ROOT = fileURLToPath(new URL('../dist', import.meta.url))
@@ -34,9 +42,22 @@ const DIST_ROOT = fileURLToPath(new URL('../dist', import.meta.url))
 /** Where the client looks for the image: the runtime's own name, beside the page. */
 const IMAGE_FILE = join(DIST_ROOT, 'preview', IMAGE_FILE_NAME)
 
+/** Built-in source catalog read by the pre-boot chooser. */
+const FIXTURE_MANIFEST_FILE = join(DIST_ROOT, 'preview', PREVIEW_FIXTURE_MANIFEST_FILE)
+
+/** Keyless browser golden for the pre-Worker source chooser. */
+const SOURCE_CHOOSER_EXPECTED = fileURLToPath(new URL('./snapshots/preview-boot/source-chooser.expected.md', import.meta.url))
+
+const SNAPSHOT_MODE = webSnapshotMode()
+
 /** Profile the preview deployment composes; `build:preview` packs the same one. */
 const PROFILE = 'web'
 
+/** Stable labels authored by the deterministic VFS example fixture. */
+const SHOWCASE_TITLE = 'WebWorker Preview Showcase'
+const SHOWCASE_TAIL = 'Preview tour complete'
+const SHOWCASE_OLDEST = 'History checkpoint 01: verify deterministic preview state.'
+
 /** Pages the preview needs; the Vite build emits both. */
 const PAGES = ['index.html', 'preview.html']
 
@@ -75,6 +96,12 @@ interface Site {
   close(): Promise<void>
 }
 
+interface PreviewAssets {
+  /** Static-host-relative path to a generated file outside `dist/`. */
+  readonly overrides: ReadonlyMap<string, string>
+  cleanup(): void
+}
+
 /**
  * Fail before the browser opens a page the build never produced.
  * @throws When either preview page is missing from `dist/`.
@@ -87,20 +114,25 @@ function requirePreviewPages(): void {
 }
 
 /**
- * The image file to serve, packed here when `dist/` carries none: `pnpm run
- * build` emits the pages but only `build:preview` packs, so this lane packs
- * for itself rather than skipping the deployment it is here to accept. An
- * image already in place is used as it stands — the worker refuses one lowered
- * against another wrapper contract, and that refusal names the rebuild. A
- * self-packed image lands in a temp directory, never in `dist/`: the
+ * The base image, fixture manifest, and overlays to serve, packed here when
+ * `dist/` does not carry the complete set: `pnpm run build` emits the pages but
+ * only `build:preview` packs these files, so this lane packs for itself rather
+ * than skipping the deployment it accepts. A complete built set is used as it
+ * stands — the worker refuses a base lowered against another wrapper contract.
+ * Self-packed files land in a temp directory, never in `dist/`: the
  * client-artifact digest record treats `dist/` as build-owned, so a test write
  * there fails the record check for every later consumer.
- * @returns The file to answer `preview/<image>` with, and its teardown.
+ * @returns Static-path overrides and their teardown.
  * @throws When the closure leaves dependencies unresolved, which would pack an
  * incomplete image the tree fails on later and further from the cause.
  */
-function requireVfsImage(): { path: string; cleanup(): void } {
-  if (existsSync(IMAGE_FILE)) return { path: IMAGE_FILE, cleanup: () => {} }
+function requireVfsAssets(): PreviewAssets {
+  const fixtureDefinitions = previewFixtures(REPO_ROOT)
+  const fixtureFiles = fixtureDefinitions.map(fixture =>
+    join(DIST_ROOT, 'preview', 'fixtures', `${fixture.id}.tar.gz`))
+  if ([IMAGE_FILE, FIXTURE_MANIFEST_FILE, ...fixtureFiles].every(existsSync)) {
+    return { overrides: new Map(), cleanup: () => {} }
+  }
   const packed = packVfsImage({
     config: composeProfile(REPO_ROOT, PROFILE),
     profile: PROFILE,
@@ -112,23 +144,48 @@ function requireVfsImage(): { path: string; cleanup(): void } {
     throw new Error(`preview boot: ${String(packed.missing.length)} dependencies did not resolve: ${packed.missing.join(', ')}`)
   }
   const directory = mkdtempSync(join(tmpdir(), 'dsh-preview-boot-'))
-  const path = join(directory, IMAGE_FILE_NAME)
-  writeFileSync(path, packed.image)
-  return { path, cleanup: () => { rmSync(directory, { recursive: true, force: true }) } }
+  const overrides = new Map<string, string>()
+  const writeAsset = (relativePath: string, bytes: Uint8Array | string): void => {
+    const path = join(directory, relativePath)
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileSync(path, bytes)
+    overrides.set(relativePath, path)
+  }
+  writeAsset(`preview/${IMAGE_FILE_NAME}`, packed.image)
+  const fixtures = fixtureDefinitions.map((fixture) => {
+    const relativePath = `preview/fixtures/${fixture.id}.tar.gz`
+    writeAsset(relativePath, packVfsOverlay(fixture.trees).image)
+    return {
+      id: fixture.id,
+      label: fixture.label,
+      description: fixture.description,
+      overlays: [`fixtures/${fixture.id}.tar.gz`],
+    }
+  })
+  const manifest: PreviewFixtureManifest = {
+    version: PREVIEW_FIXTURE_MANIFEST_VERSION,
+    defaultFixture: fixtures[0]?.id ?? null,
+    fixtures,
+  }
+  writeAsset(`preview/${PREVIEW_FIXTURE_MANIFEST_FILE}`, `${JSON.stringify(manifest, null, 2)}\n`)
+  return { overrides, cleanup: () => { rmSync(directory, { recursive: true, force: true }) } }
 }
 
 /**
- * Answer one request with the file it names under `dist/`; the image path
- * answers from wherever {@link requireVfsImage} put the file.
+ * Answer one request with its generated override or the file under `dist/`.
  * @param request - Incoming request; only its path is read.
  * @param response - Response to write the bytes or the 404 to.
- * @param imagePath - File behind `preview/<image>`.
+ * @param overrides - Generated deployment files used when `dist/` has none.
  */
-async function respond(request: IncomingMessage, response: ServerResponse, imagePath: string): Promise<void> {
+async function respond(
+  request: IncomingMessage,
+  response: ServerResponse,
+  overrides: ReadonlyMap<string, string>,
+): Promise<void> {
   const path = new URL(request.url ?? '/', 'http://127.0.0.1').pathname
   const relative = normalize(decodeURIComponent(path)).replace(/^\/+/, '')
   try {
-    const body = await readFile(relative === `preview/${IMAGE_FILE_NAME}` ? imagePath : join(DIST_ROOT, relative))
+    const body = await readFile(overrides.get(relative) ?? join(DIST_ROOT, relative))
     response.writeHead(200, { 'content-type': MIME[extname(relative)] ?? 'application/octet-stream' })
     response.end(body)
   } catch {
@@ -142,11 +199,11 @@ async function respond(request: IncomingMessage, response: ServerResponse, image
 
 /**
  * Serve `dist/` over loopback with static-host semantics.
- * @param imagePath - File behind `preview/<image>`.
+ * @param overrides - Generated deployment files used when `dist/` has none.
  * @returns The origin to navigate, and its teardown.
  */
-async function serveDist(imagePath: string): Promise<Site> {
-  const server = createServer((request, response) => { void respond(request, response, imagePath) })
+async function serveDist(overrides: ReadonlyMap<string, string>): Promise<Site> {
+  const server = createServer((request, response) => { void respond(request, response, overrides) })
   await new Promise<void>((listening) => { server.listen(0, '127.0.0.1', listening) })
   const address = server.address()
   if (address === null || typeof address === 'string') throw new Error('preview boot: the static server bound no port')
@@ -186,12 +243,13 @@ async function within<T>(work: Promise<T>, ms: number, stalled: string): Promise
 
 it('boots the packed worker deployment to an interactive page', async () => {
   requirePreviewPages()
-  const image = requireVfsImage()
+  const assets = requireVfsAssets()
   try {
-    const site = await serveDist(image.path)
+    const site = await serveDist(assets.overrides)
     try {
       const browser = await chromium.launch({ headless: true, args: ['--no-sandbox', '--disable-dev-shm-usage'] })
       try {
+        await bootEmptyPreview(site.origin, browser)
         await bootPreview(site.origin, browser)
       } finally {
         await browser.close()
@@ -200,7 +258,7 @@ it('boots the packed worker deployment to an interactive page', async () => {
       await site.close()
     }
   } finally {
-    image.cleanup()
+    assets.cleanup()
   }
 }, 600_000)
 
@@ -212,6 +270,7 @@ it('boots the packed worker deployment to an interactive page', async () => {
 async function bootPreview(origin: string, browser: Browser): Promise<void> {
   const page = await newEnglishPage(browser)
   const pageErrors: Error[] = []
+  const consoleErrors: string[] = []
   page.on('pageerror', (error) => { pageErrors.push(error) })
   // Registered before navigation: the worker reports its tree long before the
   // tunnel serves the client, so a listener added later would miss the line.
@@ -219,20 +278,136 @@ async function bootPreview(origin: string, browser: Browser): Promise<void> {
     page.on('console', (message) => {
       const text = message.text()
       if (text.includes(TREE_ACTIVE)) reported(text)
+      if (message.type() === 'error' || message.type() === 'warning') consoleErrors.push(text)
     })
   })
   try {
     await page.goto(`${origin}/preview.html`, { waitUntil: 'domcontentloaded' })
+    await page.getByRole('heading', { name: 'Choose Preview data' }).waitFor()
+    expect(await page.locator('input[name="preview-source"][value="vfs-example"]').isChecked()).toBe(true)
+    expect(await page.getByText('Empty environment', { exact: true }).count()).toBe(1)
+    expect(await page.getByText('WebFS directory', { exact: true }).count()).toBe(1)
+    expect(await page.locator('input[name="preview-source"][value="webfs"]').isDisabled()).toBe(true)
+    expect(await page.getByRole('textbox', { name: 'Choose workspace' }).count()).toBe(0)
+    await compareOrRefreshGolden(
+      SOURCE_CHOOSER_EXPECTED,
+      await captureStableAria(page, '[data-preview-source-card]', '/__preview_no_workspace__'),
+      SNAPSHOT_MODE,
+    )
+    await page.getByRole('button', { name: 'Start Preview' }).click()
+    await page.getByText('Loading plugins…', { exact: true }).waitFor({ timeout: 10_000 })
     const bootLine = await within(treeActive, BOOT_TIMEOUT_MS, `preview boot: the worker never reported "${TREE_ACTIVE}"`)
     // The activated tree ran bodies lowered against the contract this
     // checkout's packer emits; a dist built before a contract change would
     // report the older one.
     expect(bootLine).toContain(`image lowering=${WRAPPER_CONTRACT}`)
+    expect(bootLine).toContain('data overlays=1')
     // The hero's workspace picker is the client tree's first interactive
     // surface, so it appears only once the startup chain completed over the
     // tunnel.
     await page.getByRole('textbox', { name: 'Choose workspace' }).waitFor({ timeout: HERO_TIMEOUT_MS })
+    const continueButton = page.getByRole('button', { name: 'Continue' })
+    await continueButton.waitFor({ timeout: 30_000 })
+    await continueButton.click()
+    const configureLater = page.getByRole('button', { name: 'Configure later' })
+    await configureLater.waitFor({ timeout: 30_000 })
+    await configureLater.click()
+    await page.locator('textarea:enabled[placeholder="Describe what you want to build"]')
+      .waitFor({ timeout: 30_000 })
+
+    const exercised = await page.evaluate(async () => {
+      type Result<T> = { result: { ok: true; value: T } | { ok: false; error: { code: string; message: string } } }
+      interface PreviewApi {
+        host: { createDirectory(payload: { path: string; name: string }): Promise<Result<{ path: string }>> }
+        skills: { list(payload: { sessionId: string }): Promise<Result<{ skills: unknown[] }>> }
+        settings: {
+          describe(payload: object): Promise<Result<{ namespaces: Array<{ ns: string; revision: number }> }>>
+          update(payload: { ns: string; patch: object; expectedRevision: number }): Promise<Result<unknown>>
+        }
+        credentials: {
+          set(payload: { ref: string; value: string }): Promise<Result<unknown>>
+          unset(payload: { ref: string }): Promise<Result<unknown>>
+          describe(payload: { refs: string[] }): Promise<Result<{
+            credentials: Record<string, { configured: boolean }>
+          }>>
+        }
+      }
+      interface PreviewTransport {
+        fetch(input: string, init: RequestInit): Promise<Response>
+        createApiClient(): PreviewApi
+      }
+      const transport = (globalThis as typeof globalThis & { __DSH_TRANSPORT__?: PreviewTransport }).__DSH_TRANSPORT__
+      if (transport === undefined) throw new Error('preview transport is absent after boot')
+      const response = await transport.fetch('/api/session/list', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          type: 'client-request', rpcId: 'preview-session-list', method: 'session/list',
+          payload: { args: { _request: {} } },
+        }),
+      })
+      const sessions = await response.json() as Result<{ items: Array<{ sessionId: string }> }>
+      if (!sessions.result.ok) throw new Error(`session/list failed: ${sessions.result.error.message}`)
+      const sessionId = sessions.result.value.items[0]?.sessionId
+      if (sessionId === undefined) throw new Error('workspace adoption created no Session')
+
+      const api = transport.createApiClient()
+      const skills = await api.skills.list({ sessionId })
+      if (!skills.result.ok) throw new Error(`skill.list failed: ${skills.result.error.message}`)
+      const createDirectory = async (path: string, name: string): Promise<void> => {
+        const created = await api.host.createDirectory({ path, name })
+        if (!created.result.ok) throw new Error(`host.createDirectory failed: ${created.result.error.message}`)
+        await new Promise((resolve) => { setTimeout(resolve, 250) })
+        const refreshed = await api.skills.list({ sessionId })
+        if (!refreshed.result.ok) throw new Error(`skill.list refresh failed: ${refreshed.result.error.message}`)
+      }
+      await createDirectory('/dsh/workspace/.agents/skills', 'runtime-created')
+      const settings = await api.settings.describe({})
+      if (!settings.result.ok) throw new Error(`settings.describe failed: ${settings.result.error.message}`)
+      const shell = settings.result.value.namespaces.find(namespace => namespace.ns === 'shell')
+      if (shell === undefined) throw new Error('settings.describe omitted the shell namespace')
+      const updated = await api.settings.update({ ns: 'shell', patch: { timeoutMs: 61_000 }, expectedRevision: shell.revision })
+      if (!updated.result.ok) throw new Error(`settings.update failed: ${updated.result.error.message}`)
+      const stored = await api.credentials.set({ ref: 'PREVIEW_TEST_SECRET', value: 'worker-only' })
+      if (!stored.result.ok) throw new Error(`credentials.set failed: ${stored.result.error.message}`)
+      const credentials = await api.credentials.describe({ refs: ['PREVIEW_TEST_SECRET'] })
+      if (!credentials.result.ok) throw new Error(`credentials.describe failed: ${credentials.result.error.message}`)
+      const removed = await api.credentials.unset({ ref: 'PREVIEW_TEST_SECRET' })
+      if (!removed.result.ok) throw new Error(`credentials.unset failed: ${removed.result.error.message}`)
+      await new Promise((resolve) => { setTimeout(resolve, 250) })
+      return {
+        skillCount: skills.result.value.skills.length,
+        credentialConfigured: credentials.result.value.credentials.PREVIEW_TEST_SECRET?.configured,
+      }
+    })
+    expect(exercised.skillCount).toBeGreaterThan(0)
+    expect(exercised.credentialConfigured).toBe(true)
+
+    const sessions = page.getByRole('tree', { name: 'Sessions' })
+    const showcase = sessions.getByRole('treeitem').filter({ hasText: SHOWCASE_TITLE })
+    await expect.poll(() => showcase.count(), { timeout: 15_000 }).toBe(1)
+    await showcase.click()
+    await page.getByText(SHOWCASE_TAIL, { exact: true }).waitFor({ timeout: 30_000 })
+
+    expect(await page.getByText(SHOWCASE_OLDEST, { exact: true }).count()).toBe(0)
+    await page.getByText('PREVIEW.md', { exact: true }).waitFor()
+    await page.getByText('src/preview.ts', { exact: true }).waitFor()
+    await page.getByText('Update to-do list', { exact: true }).waitFor()
+    await page.getByText('Error: ENOENT: no such file, open missing.txt', { exact: true }).waitFor()
+
+    const subagents = page.getByRole('button', { name: '2 subagents' })
+    await subagents.waitFor({ timeout: 15_000 })
+    await subagents.hover()
+    const catalog = page.getByRole('tree', { name: 'Subagent sessions' })
+    await catalog.getByRole('treeitem', { name: /Review preview architecture/ }).waitFor()
+    await catalog.getByRole('treeitem', { name: /Continue preview verification/ }).waitFor()
+    await catalog.press('Escape')
+
+    await page.getByRole('button', { name: 'Load earlier', exact: true }).click()
+    await page.getByText(SHOWCASE_OLDEST, { exact: true }).waitFor({ timeout: 15_000 })
     expect(pageErrors.map(error => error.message)).toEqual([])
+    expect(consoleErrors.filter(line =>
+      /watchFile|failed to watch|node-addon-landlock-run\.probe|sandbox backend is usable|SANDBOX_UNAVAILABLE/i.test(line))).toEqual([])
   } catch (error) {
     await saveFailureShot(page, 'preview-boot')
     throw pageErrors.length === 0
@@ -240,3 +415,65 @@ async function bootPreview(origin: string, browser: Browser): Promise<void> {
       : new AggregateError([error, ...pageErrors], 'preview boot failed, with uncaught page errors')
   }
 }
+
+/** Verify the chooser can boot the untouched base image and reach first-run UI. */
+async function bootEmptyPreview(origin: string, browser: Browser): Promise<void> {
+  const page = await newEnglishPage(browser)
+  const pageErrors: Error[] = []
+  const consoleErrors: string[] = []
+  const failedResponses: string[] = []
+  page.on('pageerror', (error) => { pageErrors.push(error) })
+  page.on('response', (response) => {
+    if (response.status() >= 400) failedResponses.push(new URL(response.url()).pathname)
+  })
+  const treeActive = new Promise<string>((reported) => {
+    page.on('console', (message) => {
+      const text = message.text()
+      if (text.includes(TREE_ACTIVE)) reported(text)
+      if (message.type() === 'error' || message.type() === 'warning') consoleErrors.push(text)
+    })
+  })
+  try {
+    await page.goto(`${origin}/preview.html?preview-fixture=none`, { waitUntil: 'domcontentloaded' })
+    expect(await page.getByRole('heading', { name: '选择 Preview 数据源' }).count()).toBe(0)
+    const bootLine = await within(
+      treeActive,
+      BOOT_TIMEOUT_MS,
+      `empty preview boot: the worker never reported "${TREE_ACTIVE}"`,
+    )
+    expect(bootLine).toContain(`image lowering=${WRAPPER_CONTRACT}`)
+    expect(bootLine).toContain('data overlays=0')
+    await page.getByRole('textbox', { name: 'Choose workspace' }).waitFor({ timeout: HERO_TIMEOUT_MS })
+    const sessionCount = await page.evaluate(async () => {
+      const transport = (globalThis as typeof globalThis & {
+        __DSH_TRANSPORT__?: { fetch(input: string, init: RequestInit): Promise<Response> }
+      }).__DSH_TRANSPORT__
+      if (transport === undefined) throw new Error('empty preview transport is absent after boot')
+      const response = await transport.fetch('/api/session/list', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          type: 'client-request', rpcId: 'empty-preview-session-list', method: 'session/list',
+          payload: { args: { _request: {} } },
+        }),
+      })
+      const body = await response.json() as {
+        result: { ok: true; value: { items: unknown[] } } | { ok: false; error: { message: string } }
+      }
+      if (!body.result.ok) throw new Error(`empty session/list failed: ${body.result.error.message}`)
+      return body.result.value.items.length
+    })
+    expect(sessionCount).toBe(0)
+    expect(pageErrors.map(error => error.message)).toEqual([])
+    expect(failedResponses).toEqual(['/plugins/events'])
+    expect(consoleErrors.filter(line => !line.includes('Failed to load resource: the server responded with a status of 404')))
+      .toEqual([])
+  } catch (error) {
+    await saveFailureShot(page, 'preview-boot-empty')
+    throw pageErrors.length === 0
+      ? error
+      : new AggregateError([error, ...pageErrors], 'empty preview boot failed, with uncaught page errors')
+  } finally {
+    await page.close()
+  }
+}

apps/web/tests/scaffold.ts

@@ -105,8 +105,6 @@ const BASE_PATCH_PATH = join(REPO_ROOT, 'packages/bundle/base/cordis.patch.yml')
 const WEB_PATCH_PATH = join(REPO_ROOT, 'packages/bundle/web-app/cordis.patch.yml')
 /** The installation anchor whose dependency surface the profile module fallback mirrors. */
 const INSTALL_ANCHOR = join(REPO_ROOT, 'apps/cli/package.json')
-/** The deployment's own agent-preset root, shipped beside the app's config. */
-const SHIPPED_PRESET_DIR = join(REPO_ROOT, 'apps/cli/config/agent-presets')
 
 // Replay publishes the provider catalog the gateway routes to (providers
 // mode, never catch-all: with llm-deepseek disabled no adapter exists, so a
@@ -272,15 +270,14 @@ export interface LaunchOptions {
     apiKeyEnv: string
   }
   /**
-   * Replace the roster the scaffold mounts by default (the shipped directory
-   * at `system` trust, default `standard`). Supply this only to change WHICH
-   * presets a scenario sees — a writable user root, a different default —
-   * never to turn the roster on: without one every session composes an agent
-   * with no tools, no persona, and no token meter, which is not a shape the
-   * product ever boots in. The patch lands after the default, so it wins.
+   * Replace the roster row the scaffold pins by default (no configured roots,
+   * default `standard` — the plugin's own shipped presets). Supply this only
+   * to change WHICH presets a scenario sees beyond the shipped set — a
+   * writable user root, a different default. The patch lands after the
+   * default, so it wins.
    */
   agentPresets?: {
-    /** Roots to discover, in precedence order; the shipped directory is `system`. */
+    /** Roots to discover after the plugin's shipped root, in precedence order. */
     roots: { path: string; trust: 'system' | 'user' }[]
     /** The preset a session that names none is composed from. */
     default: string
@@ -405,19 +402,14 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
     ...basePatches,
     ...surfacePatches,
     ...extraOverlayPatches,
-    // The roster's `roots` is an assembly fact AppCLIEntry resolves and patches
-    // in, exactly like `distIndex` on the webserver row — the shipped preset
-    // directory sits beside the composition that names it, and no config author
-    // chooses it. This lane boots the shipped tree WITHOUT AppCLIEntry, so it
-    // has to supply the same fact or the roster resolves nothing and every
-    // session composes an agent with no tools, no persona, and no token meter.
-    // Only the shipped root: a developer's own `~/.dsh/.agent-presets` must not be
-    // able to change a golden.
+    // The roster's shipped presets are the plugin's own, bundled inside
+    // `dsh-agent-presets` and prepended by it. Pin only the machine-local
+    // root away: a developer's own `~/.dsh/.agent-presets` must not be able
+    // to change a golden.
     {
       id: 'agent-presets',
       config: {
         default: 'standard',
-        roots: [{ path: SHIPPED_PRESET_DIR, trust: 'system' }],
         includeUserRoot: false,
       },
     },

apps/web/tests/snapshots/preview-boot/source-chooser.expected.md

@@ -0,0 +1,15 @@
+- form "Choose Preview data":
+  - heading "Choose Preview data" [level=1]
+  - paragraph: Data mounts before the Worker and application start. Refresh to choose again.
+  - group "Filesystem source":
+    - text: Filesystem source
+    - radio "Empty environment Load only the base runtime to verify first launch and workspace creation."
+    - strong: Empty environment
+    - text: Load only the base runtime to verify first launch and workspace creation.
+    - radio "Built-in showcase Sample workspace, tool cards, subagents, and paged history." [checked]
+    - strong: Built-in showcase
+    - text: Sample workspace, tool cards, subagents, and paged history.
+    - radio "WebFS directory Requires directory access and will be available after the WebFS provider lands." [disabled]
+    - strong: WebFS directory
+    - text: Requires directory access and will be available after the WebFS provider lands.
+  - button "Start Preview"

apps/web/tests/subagent-interrupt-ui.e2e.ts

@@ -203,6 +203,7 @@ describe.skipIf(MODE === 'record')('web e2e: composer interrupt for a running co
         name: 'Parent session offline; sending is unavailable but you can still stop the run',
       })
       await input.waitFor({ timeout: 15_000 })
+      await page.getByText(INITIAL, { exact: true }).waitFor({ timeout: 15_000 })
       expect(await input.isDisabled()).toBe(true)
       const stop = page.getByRole('button', { name: 'Stop generating' })
       expect(await stop.count()).toBe(1)
@@ -247,7 +248,7 @@ describe.skipIf(MODE === 'record')('web e2e: composer interrupt for a running co
       await waitFor(() => existsSync(rearmedReadyFile), 'the re-armed child turn to open')
       expect(scaffold.ctx.agents.get(childId)?.status).toBe('running')
     } finally {
-      await page.unroute(pattern)
+      await page.unrouteAll({ behavior: 'wait' })
     }
   }, 60_000)
 

docs/config-catalog.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/config-catalog.md
-config-catalog.md: 8d03e3757388d4f2d317afb4c06537905a9f3688
-config-catalog.zh.md: 81dce53256071fdb3b0059552bca85569c53a3db
+config-catalog.md: a845fe22e13ed085765668c7ec8d54d6bbdf129a
+config-catalog.zh.md: 39ba9d48368f99483733292f997609ba3a8aa43e

docs/config-catalog.md

@@ -124,9 +124,17 @@ export interface Config {
   default: string
   /** Scanned roots in precedence order; an earlier root wins a duplicate id. */
   roots: PresetRoot[]
+  /**
+   * Prepend this package's bundled shipped presets as a `system` root, before
+   * every configured root, so the shipped set always mounts and wins a
+   * duplicate id. The default survives a whole-`config` patch replacement;
+   * only an explicit `false` — a deployment supplying purely its own presets,
+   * or an embedder using the roster as bare machinery — drops the set.
+   */
+  includeShippedRoot: boolean
   /**
    * Append the harness home's `USER_PRESET_DIR` as a `user` root, after every
-   * configured root. False mounts a roster over `roots` alone.
+   * configured root. False mounts a roster without the derived writable root.
    */
   includeUserRoot: boolean
 }

docs/config-catalog.zh.md

@@ -126,9 +126,17 @@ export interface Config {
   default: string
   /** Scanned roots in precedence order; an earlier root wins a duplicate id. */
   roots: PresetRoot[]
+  /**
+   * Prepend this package's bundled shipped presets as a `system` root, before
+   * every configured root, so the shipped set always mounts and wins a
+   * duplicate id. The default survives a whole-`config` patch replacement;
+   * only an explicit `false` — a deployment supplying purely its own presets,
+   * or an embedder using the roster as bare machinery — drops the set.
+   */
+  includeShippedRoot: boolean
   /**
    * Append the harness home's `USER_PRESET_DIR` as a `user` root, after every
-   * configured root. False mounts a roster over `roots` alone.
+   * configured root. False mounts a roster without the derived writable root.
    */
   includeUserRoot: boolean
 }

docs/subsystems/client-modules.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/client-modules.md
-client-modules.md: ae767c6a098cb1b7188c06e61efd2798eb93ff66
-client-modules.zh.md: 710453e3e10c298ed8c2b87bbab6e8e9eb154a87
+client-modules.md: 84d673669825495b7e22933da238daba24ec7b13
+client-modules.zh.md: 7cc353007732188f06738a745b750161a11366a5

docs/subsystems/client-modules.md

@@ -14,11 +14,10 @@ The graph is the wire single source between the Node and browser halves: the hos
 /**
  * One composed client entry pushed by the host (a graph row). Wire
  * single source: the host node half (package root) produces this same shape.
- * `immediately` marks stage-one prefetch; `inject` is informational graph
- * metadata (the authoritative edges live in each package's `dsh.client`
- * declaration and reach fibers through entry creation). `external` carries
- * module-graph edges: unlike `inject`, they constrain code arrival because
- * `require` is synchronous (see {@link WebBootGraph.entries}).
+ * `immediately` marks stage-one prefetch. `inject` names package rows whose
+ * factories must arrive before this row materializes, while Cordis separately
+ * uses the same package edges to compose entries. `external` carries exact
+ * non-inject module requests (see {@link WebBootGraph.entries}).
  */
 interface WebBootEntry {
   /** Entry name == package name. */
@@ -27,7 +26,7 @@ interface WebBootEntry {
   url: string
   /** Bundle content hash (cache-busting consistency anchor). */
   rev: string
-  /** Package-name dependency edges, informational (preflight display / HMR diffing). */
+  /** Package-name dependency edges used for factory arrival and plugin composition. */
   inject?: string[]
   /** Stage-one prefetch mark: load the script for factory registration during module-face boot. */
   immediately?: boolean

docs/subsystems/client-modules.zh.md

@@ -14,11 +14,10 @@ Web 插件表：[dsh-client-modules](../../packages/client/modules) 中 client
 /**
  * One composed client entry pushed by the host (a graph row). Wire
  * single source: the host node half (package root) produces this same shape.
- * `immediately` marks stage-one prefetch; `inject` is informational graph
- * metadata (the authoritative edges live in each package's `dsh.client`
- * declaration and reach fibers through entry creation). `external` carries
- * module-graph edges: unlike `inject`, they constrain code arrival because
- * `require` is synchronous (see {@link WebBootGraph.entries}).
+ * `immediately` marks stage-one prefetch. `inject` names package rows whose
+ * factories must arrive before this row materializes, while Cordis separately
+ * uses the same package edges to compose entries. `external` carries exact
+ * non-inject module requests (see {@link WebBootGraph.entries}).
  */
 interface WebBootEntry {
   /** Entry name == package name. */
@@ -27,7 +26,7 @@ interface WebBootEntry {
   url: string
   /** Bundle content hash (cache-busting consistency anchor). */
   rev: string
-  /** Package-name dependency edges, informational (preflight display / HMR diffing). */
+  /** Package-name dependency edges used for factory arrival and plugin composition. */
   inject?: string[]
   /** Stage-one prefetch mark: load the script for factory registration during module-face boot. */
   immediately?: boolean

examples/acp-agent/tests/acp.snapshot.ts

@@ -39,7 +39,7 @@ const AGENT = {
   tsconfigPath: fileURLToPath(new URL('../../../tsconfig.json', import.meta.url)),
 }
 const EDITING_CORDIS_SKILL = fileURLToPath(new URL(
-  '../../../apps/cli/config/agent-presets/cordis/skills/editing-cordis-compositions/SKILL.md',
+  '../../../packages/preset/agent-presets/presets/cordis/skills/editing-cordis-compositions/SKILL.md',
   import.meta.url,
 ))
 

knip.json

@@ -241,7 +241,8 @@
     "packages/experimental/webworker-runtime": {
       "entry": [
         "tests/**/*.spec.ts",
-        "tests/compile/transform-corpus-check.ts"
+        "tests/compile/transform-corpus-check.ts",
+        "tests/fixtures/vfs-example/workspace/src/preview.ts"
       ],
       "project": [
         "src/**/*.ts",

packages/bundle/web-app/cordis.patch.yml

@@ -435,16 +435,13 @@
 - id: tool-web
   disabled: true
 
-# The preset roster. `config/agent-presets/` ships with the deployment and is
-# read-only (its entries carry `system` trust); `$DSH_HOME/.agent-presets` is
-# where a person — or an agent — authors their own, and carries the same trust
-# as shell access because a preset IS a composition.
-#
-# Only the SHIPPED root is an assembly fact: it sits beside the installed app's
-# own config, so `apps/cli`'s `composeProfile` resolves and patches it in — the
-# same treatment `distIndex` gets on the webserver row. The writable root is
-# `dsh-agent-presets`' own default (`includeUserRoot`), so a composition that
-# never reaches that patch still finds a person's presets.
+# The preset roster. The shipped presets are bundled inside
+# `dsh-agent-presets` itself and prepended as a read-only `system` root
+# (`includeShippedRoot`); `$DSH_HOME/.agent-presets` is where a person — or an
+# agent — authors their own, appended by the same package (`includeUserRoot`),
+# and carries the same trust as shell access because a preset IS a
+# composition. This row only names the default and any deployment-added
+# `roots`; no launcher patching is involved.
 - insert:
     - id: agent-presets
       name: '@deepseek-ai/dsh-agent-presets'

packages/client/modules/src/client/manifest.ts

@@ -42,11 +42,10 @@ declare module '@deepseek-ai/cordis' {
 /**
  * One composed client entry pushed by the host (a graph row). Wire
  * single source: the host node half (package root) produces this same shape.
- * `immediately` marks stage-one prefetch; `inject` is informational graph
- * metadata (the authoritative edges live in each package's `dsh.client`
- * declaration and reach fibers through entry creation). `external` carries
- * module-graph edges: unlike `inject`, they constrain code arrival because
- * `require` is synchronous (see {@link WebBootGraph.entries}).
+ * `immediately` marks stage-one prefetch. `inject` names package rows whose
+ * factories must arrive before this row materializes, while Cordis separately
+ * uses the same package edges to compose entries. `external` carries exact
+ * non-inject module requests (see {@link WebBootGraph.entries}).
  */
 export interface WebBootEntry {
   /** Entry name == package name. */
@@ -55,7 +54,7 @@ export interface WebBootEntry {
   url: string
   /** Bundle content hash (cache-busting consistency anchor). */
   rev: string
-  /** Package-name dependency edges, informational (preflight display / HMR diffing). */
+  /** Package-name dependency edges used for factory arrival and plugin composition. */
   inject?: string[]
   /** Stage-one prefetch mark: load the script for factory registration during module-face boot. */
   immediately?: boolean
@@ -83,6 +82,8 @@ export interface BootModuleRow {
   url: string
   /** Bundle content hash. */
   rev: string
+  /** Injected package rows whose factories arrive before this row materializes. */
+  inject: string[]
   /** Module specifiers this row requests from the module table ([] when the wire omits them). */
   external: string[]
 }
@@ -176,6 +177,7 @@ export function parseBootManifest(wire: unknown): BootManifest {
       id: row.id,
       url: row.url,
       rev: row.rev,
+      inject: inject === undefined ? [] : [...inject],
       external: external === undefined ? [] : [...external],
     })
     plugins.push({

packages/client/modules/src/client/system.ts

@@ -124,8 +124,12 @@ export class ClientModuleSystem implements ClientModuleLoader {
     return task
   }
 
-  /** Register each unresolved dynamic request before registering its consumer. */
-  private async arriveGraphRow(row: BootModuleRow, open: readonly string[] = []): Promise<void> {
+  /** Register each injected package and unresolved dynamic request before its consumer. */
+  private async arriveGraphRow(
+    row: BootModuleRow,
+    open: readonly string[] = [],
+    visited = new Set<string>(),
+  ): Promise<void> {
     const cycleStart = open.indexOf(row.id)
     if (cycleStart !== -1) {
       throw new Error(
@@ -133,12 +137,18 @@ export class ClientModuleSystem implements ClientModuleLoader {
         + '(the host must reject this graph before serving it)',
       )
     }
+    if (visited.has(row.id)) return
+    visited.add(row.id)
     const next = [...open, row.id]
     for (const request of row.external) {
       const id = stripClientSuffix(request)
       if (this.seed.has(request) || this.loadCache.has(id)) continue
       const dependency = this.graphRows.get(id)
-      if (dependency !== undefined) await this.arriveGraphRow(dependency, next)
+      if (dependency !== undefined) await this.arriveGraphRow(dependency, next, visited)
+    }
+    for (const packageName of row.inject) {
+      const dependency = this.graphRows.get(packageName)
+      if (dependency !== undefined) await this.arriveGraphRow(dependency, [], visited)
     }
     await this.arrive(row)
   }

packages/client/modules/tests/loader.client.spec.ts

@@ -20,7 +20,7 @@ afterEach(() => {
 })
 
 const row = (id: string, fields: Partial<BootModuleRow> = {}): BootModuleRow =>
-  ({ id, url: `/plugins/${id}/client.js?rev=0`, rev: '0', external: [], ...fields })
+  ({ id, url: `/plugins/${id}/client.js?rev=0`, rev: '0', inject: [], external: [], ...fields })
 
 interface Bench {
   loader: ClientModuleLoader
@@ -147,6 +147,22 @@ describe('lazy CJS arrival', () => {
     expect(exports.react.marker).toBe('react')
   })
 
+  it('registers injected package factories before materializing a consumer', async () => {
+    const b = bench([
+      row('consumer', { inject: ['provider'] }),
+      row('provider', { inject: ['consumer'] }),
+    ], {
+      consumer: req => ({ provider: req('provider/client') }),
+      provider: () => ({ marker: 'provider' }),
+    })
+    const exports = await b.loader.import('consumer', '', {}) as { provider: { marker: string } }
+    expect(b.fetched).toEqual([
+      '/plugins/provider/client.js?rev=0',
+      '/plugins/consumer/client.js?rev=0',
+    ])
+    expect(exports.provider.marker).toBe('provider')
+  })
+
   it('concurrent callers share one in-flight arrival and materialize once', async () => {
     const ran: string[] = []
     const url = '/plugins/a/client.js?rev=0'
@@ -306,13 +322,13 @@ describe('boot manifest wire', () => {
     const manifest = parseBootManifest({
       rev: 'graph',
       entries: [
-        { id: 'a', url: '/plugins/a/client.js', rev: '1' },
+        { id: 'a', url: '/plugins/a/client.js', rev: '1', inject: ['b'] },
         { id: 'b', url: '/plugins/b/client.js', rev: '2', external: ['react'] },
       ],
     })
     expect(manifest.modules).toEqual([
-      { id: 'a', url: '/plugins/a/client.js', rev: '1', external: [] },
-      { id: 'b', url: '/plugins/b/client.js', rev: '2', external: ['react'] },
+      { id: 'a', url: '/plugins/a/client.js', rev: '1', inject: ['b'], external: [] },
+      { id: 'b', url: '/plugins/b/client.js', rev: '2', inject: [], external: ['react'] },
     ])
   })
 

packages/experimental/webworker-packer/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/experimental/webworker-packer/README.md
-README.md: eb6c4c60106ebb7f6bb123116a749f152dea79a0
-README.zh.md: defa06c048125d627002c445aca491b4a33c4026
+README.md: 39d084bc631db387a3b6e526a3a374bc9f766577
+README.zh.md: 11aa04f3db36c09525bc4d4945f77e278602cc0f

packages/experimental/webworker-packer/README.md

@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-The VFS image packer: turns one composed profile into the single gzip-compressed tar the browser worker inflates and mounts as its filesystem ([experimental stance](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.md)). Nothing is compiled from source — the image carries the repository's real build products, so a preview deployment debugs exactly what the served deployment ships.
+The VFS image packer: turns one composed profile into the gzip-compressed base tar the browser worker mounts as its filesystem, and opaque data trees into ordered overlay tars ([experimental stance](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.md)). Nothing is compiled from source — the base image carries the repository's real build products, so a preview deployment debugs exactly what the served deployment ships.
 
 The pack is a three-layer standard stack:
 
@@ -10,7 +10,9 @@ The pack is a three-layer standard stack:
 2. **Publish view** — each workspace package contributes the slice npm would publish (`files` through picomatch) minus the rule tables in `src/rules.ts` (no sources, no workspace `dist/`; external packages keep their trees minus the same exclude globs).
 3. **Reachability sweep** — the runtime loader's own resolution walks from every workspace export face plus the worker assembly's seeds (`IMAGE_ENTRY_SEEDS`), lowering each reached module to the wrapper contract at pack time. Page assets (`lib/client.js` behind `./client` exports) ship verbatim; an unresolvable request from our own code fails the pack, third-party ones are tolerated to fail loud at require time.
 
-`repository.ts` owns the repo-shaped inputs (workspace scan of `vendor/`, `packages/`, `apps/`; profile composition through the real CLI dump path); `pack.ts` owns none of them, so the same library packs a different tree by being called differently. The CLI is `dsh-pack-vfs-image --out <file> [--profile web]`; `apps/web`'s `build:preview` runs it after the preview shell build.
+`repository.ts` owns the repo-shaped inputs (workspace scan of `vendor/`, `packages/`, `native/landlock-run/packages/`, and `apps/`; profile composition through the real CLI dump path); `pack.ts` owns none of them, so the same library packs a different tree by being called differently. The native scan makes the Landlock entry package an ordinary published-view dependency while its executable remains a Worker platform implementation. The CLI is `dsh-pack-vfs-image --out <file> [--profile web]`; `apps/web`'s `build:preview` runs it after the preview shell build.
+
+The repository adapter also declares the preview-only fixture trees under `webworker-runtime/tests/fixtures/`. The CLI packs each named fixture into a separate deterministic overlay archive plus a browser-readable manifest. Overlay files bypass npm publish-view and module-reachability exclusions, so dot directories and example source files remain intact; their mounts are limited to `home/` and `workspace/`. `pack.ts` treats them as opaque bytes, and Session and Workspace interpretation stays in the runtime packages that own those formats.
 
 ## Model Experience
 

packages/experimental/webworker-packer/README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-VFS 镜像打包器：把一份合成 profile 变成浏览器 worker 解压后当文件系统挂载的单个 gzip 压缩 tar（[experimental 定位](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.zh.md)）。不做任何源码编译——镜像携带仓库真实构建产物，预览部署调试的正是 served 部署交付的字节。
+VFS 镜像打包器：把一份合成 profile 变成浏览器 worker 挂载为文件系统的 gzip 压缩基础 tar，并把不透明数据目录变成按序应用的 overlay tar（[experimental 定位](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.zh.md)）。不做任何源码编译——基础镜像携带仓库真实构建产物，预览部署调试的正是 served 部署交付的字节。
 
 打包是三层标准栈：
 
@@ -10,7 +10,9 @@ VFS 镜像打包器：把一份合成 profile 变成浏览器 worker 解压后
 2. **发布视图**——每个 workspace 包贡献 npm 会发布的切片（`files` 走 picomatch），再减去 `src/rules.ts` 的规则表（无源码、无 workspace `dist/`；外部包保留整棵减同一套 exclude glob）。
 3. **可达性 sweep**——用运行时加载器自己的解析，从全部 workspace 导出面加 worker 装配种子（`IMAGE_ENTRY_SEEDS`）出发，pack 时把每个可达模块降低到包装契约。页面资产（`./client` 导出背后的 `lib/client.js`）原样直发；自家代码的不可解析请求打包即失败，第三方的容忍到 require 时 fail loud。
 
-`repository.ts` 拥有仓库形态输入（`vendor/`、`packages/`、`apps/` 的 workspace 扫描；经真 CLI dump 路径合成 profile）；`pack.ts` 一概不拥有，同一库换参即可打另一棵树。CLI 为 `dsh-pack-vfs-image --out <file> [--profile web]`；`apps/web` 的 `build:preview` 在预览壳构建后运行它。
+`repository.ts` 拥有仓库形态输入（`vendor/`、`packages/`、`native/landlock-run/packages/` 与 `apps/` 的 workspace 扫描；经真 CLI dump 路径合成 profile）；`pack.ts` 一概不拥有，同一库换参即可打另一棵树。Native 扫描使 Landlock 入口包成为普通发布视图依赖，其可执行文件仍由 Worker 平台实现。CLI 为 `dsh-pack-vfs-image --out <file> [--profile web]`；`apps/web` 的 `build:preview` 在预览壳构建后运行它。
+
+仓库适配层还声明 `webworker-runtime/tests/fixtures/` 下仅用于 preview 的 fixture tree。CLI 会把每套具名 fixture 打成一份独立的确定性 overlay 归档，并写出浏览器可读的 manifest。Overlay 文件绕过 NPM 发布视图和模块可达性排除规则，因此点目录与示例源码会完整保留；其挂载位置仅限 `home/` 与 `workspace/`。`pack.ts` 把它们视为不透明字节；Session 与 Workspace 的解释仍归拥有这些格式的 runtime 包。
 
 ## 模型体验
 

packages/experimental/webworker-packer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepseek-ai/dsh-experimental-webworker-packer",
-  "description": "Build-time packer for the browser runtime's VFS image: materializes a profile's package closure into one gzip-compressed tar the worker mounts, with every module body pre-transformed",
+  "description": "Build-time packer for the browser runtime's base VFS image and ordered data-overlay archives",
   "version": "0.1.1-rc.2",
   "private": true,
   "repository": {

packages/experimental/webworker-packer/src/bin.ts

@@ -1,17 +1,23 @@
 #!/usr/bin/env node
 /**
- * Pack a VFS image from this repository: compose the profile, materialize the
- * closure, lower every module body, write the gzip-compressed tar.
+ * Pack a Preview deployment from this repository: compose and lower the base
+ * image, then write each named fixture overlay and their manifest.
  *
  * Usage: dsh-pack-vfs-image --out <file> [--profile web] [--root /dsh]
  *        node --import tsx/esm src/bin.ts --out ../../apps/web/dist/preview/vfs-image.tar.gz
  * @module @deepseek-ai/dsh-experimental-webworker-packer/src/bin
  */
 import { mkdirSync, writeFileSync } from 'node:fs'
-import { dirname, isAbsolute, resolve } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { packVfsImage } from './pack.ts'
-import { composeProfile, configTrees, describePack, indexWorkspacePackages } from './repository.ts'
+import {
+  PREVIEW_FIXTURE_MANIFEST_FILE, PREVIEW_FIXTURE_MANIFEST_VERSION,
+  type PreviewFixtureManifest,
+} from '@deepseek-ai/dsh-experimental-webworker-runtime'
+import { packVfsImage, packVfsOverlay } from './pack.ts'
+import {
+  composeProfile, configTrees, describePack, indexWorkspacePackages, previewFixtures,
+} from './repository.ts'
 
 /**
  * Read one `--flag value` pair.
@@ -54,4 +60,30 @@ if (result.missing.length > 0) {
 
 mkdirSync(dirname(outputFile), { recursive: true })
 writeFileSync(outputFile, result.image)
-process.stdout.write(describePack(result, repoRoot, outputFile).join('\n'))
+
+const fixtureDefinitions = previewFixtures(repoRoot)
+const fixtureDirectory = join(dirname(outputFile), 'fixtures')
+mkdirSync(fixtureDirectory, { recursive: true })
+const fixtureLines: string[] = []
+const fixtures = fixtureDefinitions.map((fixture) => {
+  const packed = packVfsOverlay(fixture.trees)
+  const file = `fixtures/${fixture.id}.tar.gz`
+  writeFileSync(join(dirname(outputFile), file), packed.image)
+  fixtureLines.push(`  fixture overlay     ${fixture.id} (${String(packed.image.byteLength)} B compressed)`)
+  return {
+    id: fixture.id,
+    label: fixture.label,
+    description: fixture.description,
+    overlays: [file],
+  }
+})
+const manifest: PreviewFixtureManifest = {
+  version: PREVIEW_FIXTURE_MANIFEST_VERSION,
+  defaultFixture: fixtures[0]?.id ?? null,
+  fixtures,
+}
+writeFileSync(
+  join(dirname(outputFile), PREVIEW_FIXTURE_MANIFEST_FILE),
+  `${JSON.stringify(manifest, null, 2)}\n`,
+)
+process.stdout.write([...describePack(result, repoRoot, outputFile), ...fixtureLines, ''].join('\n'))

packages/experimental/webworker-packer/src/index.ts

@@ -7,9 +7,10 @@ export {
   type ImageFiles, type TransformOutcome,
 } from './transform-image.ts'
 export {
-  CONFIG_PATH, DEFAULT_ROOT, MANIFEST_PATH, packVfsImage,
-  type ConfigTree, type PackOptions, type PackResult,
+  CONFIG_PATH, DEFAULT_ROOT, MANIFEST_PATH, packVfsImage, packVfsOverlay,
+  type ConfigTree, type ImageTree, type PackOptions, type PackOverlayResult, type PackResult,
 } from './pack.ts'
 export {
-  composeProfile, configTrees, describePack, indexWorkspacePackages,
+  composeProfile, configTrees, describePack, indexWorkspacePackages, previewFixtures,
+  type PreviewFixture,
 } from './repository.ts'

packages/experimental/webworker-packer/src/pack.ts

@@ -19,6 +19,7 @@ import { gzipSync } from 'node:zlib'
 import {
   lowerModuleSource, MemoryVfs, packTar, WorkerModuleLoader,
   DEFAULT_ROOT, IMAGE_CONFIG_PATH, IMAGE_EMPTY_DIRECTORIES, IMAGE_MANIFEST_PATH,
+  IMAGE_OVERLAY_DIRECTORIES,
 } from '@deepseek-ai/dsh-experimental-webworker-runtime'
 import picomatch from 'picomatch'
 import yaml from 'js-yaml'
@@ -52,12 +53,16 @@ const workspaceExcluded = picomatch([...EXCLUDE, ...EXCLUDE_WORKSPACE], { dot: t
 /** Page-asset matcher over image paths ({@link PAGE_ASSETS}). */
 const pageAsset = picomatch([...PAGE_ASSETS], { dot: true })
 
-/** One directory tree to copy in verbatim beside the composition. */
-export interface ConfigTree {
+/** One directory tree to copy into the image at a caller-selected mount. */
+export interface ImageTree {
   /** Image path to mount it at, relative to the virtual root. */
   readonly mount: string
   /** Absolute source directory. */
   readonly directory: string
+}
+
+/** One configuration tree whose plugin rows may extend the package roster. */
+export interface ConfigTree extends ImageTree {
   /**
    * Whether plugin names inside its `.yml` files join the materialization closure.
    * An agent preset mounts plugins the base composition never lists, and creating a
@@ -119,6 +124,14 @@ export interface PackResult {
   readonly contract: string
 }
 
+/** One deterministic data-overlay archive and its uncompressed entries. */
+export interface PackOverlayResult {
+  /** Gzip-compressed ustar bytes consumed by the Worker host. */
+  readonly image: Uint8Array
+  /** Every path in the overlay before compression. */
+  readonly files: ImageFiles
+}
+
 const readJson = (file: string): Record<string, unknown> =>
   JSON.parse(readFileSync(file, 'utf8')) as Record<string, unknown>
 
@@ -204,20 +217,28 @@ function resolveDependency(fromDirectory: string, name: string): string | undefi
 
 /**
  * Collect files under one directory. Traversal mechanics live here — nested
- * `node_modules` never mounts (the image is flat) and dot directories are
- * tooling residue at any depth — while every judgement call comes in through
- * `keep` (the {@link EXCLUDE} tables and the npm publish view).
+ * package/config collection flattens nested `node_modules` and prunes dot
+ * directories, while seed collection preserves every directory. Every file
+ * judgement comes in through `keep` (the {@link EXCLUDE} tables and the npm
+ * publish view, or an unconditional seed predicate).
  * @param root - Source directory.
  * @param into - Image entries to add to.
  * @param prefix - Image path prefix.
  * @param keep - Filter over root-relative paths.
+ * @param preserveDirectories - Whether dot directories and nested `node_modules`
+ *   are ordinary fixture content rather than package-manager residue.
  */
-function collectTree(root: string, into: ImageFiles, prefix: string, keep: (relativePath: string) => boolean): void {
+function collectTree(
+  root: string,
+  into: ImageFiles,
+  prefix: string,
+  keep: (relativePath: string) => boolean,
+  preserveDirectories = false,
+): void {
   const walk = (directory: string): void => {
     for (const entry of readdirSync(directory, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        if (entry.name === 'node_modules') continue
-        if (entry.name.startsWith('.')) continue
+        if (!preserveDirectories && (entry.name === 'node_modules' || entry.name.startsWith('.'))) continue
         walk(join(directory, entry.name))
         continue
       }
@@ -621,3 +642,32 @@ export function packVfsImage(options: PackOptions): PackResult {
     contract: WRAPPER_CONTRACT,
   }
 }
+
+/**
+ * Pack opaque data trees into one ordered VFS overlay.
+ *
+ * Overlay mounts are restricted to the runtime-owned data directories, so an
+ * overlay cannot replace configuration, the lowering manifest, or modules.
+ * Files bypass package excludes and module reachability processing; later
+ * trees replace earlier files at the same path.
+ * @param trees - Absolute source directories and their data-directory mounts.
+ * @returns Deterministic compressed archive plus its uncompressed entries.
+ */
+export function packVfsOverlay(trees: readonly ImageTree[]): PackOverlayResult {
+  const files: ImageFiles = {}
+  for (const tree of trees) {
+    if (!existsSync(tree.directory)) {
+      throw new Error(`vfs overlay: tree ${tree.mount} is missing at ${tree.directory}`)
+    }
+    const mount = tree.mount.replace(/^\.\//, '').replace(/\/$/, '')
+    const first = mount.split('/')[0]
+    if (mount === '' || first === undefined || !IMAGE_OVERLAY_DIRECTORIES.includes(first)
+      || mount.split('/').some(segment => segment === '' || segment === '.' || segment === '..')) {
+      throw new Error(
+        `vfs overlay: mount ${JSON.stringify(tree.mount)} must stay under ${IMAGE_OVERLAY_DIRECTORIES.join(' or ')}`,
+      )
+    }
+    collectTree(tree.directory, files, mount, () => true, true)
+  }
+  return { image: compressImage(packTar(files)), files }
+}

packages/experimental/webworker-packer/src/repository.ts

@@ -12,15 +12,15 @@ import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node
 import { tmpdir } from 'node:os'
 import { join, relative } from 'node:path'
 import { DSH_HOME_ENV } from '@deepseek-ai/dsh-home-paths'
-import type { ConfigTree, PackResult } from './pack.ts'
+import type { ConfigTree, ImageTree, PackResult } from './pack.ts'
 
 /**
  * Repository directories scanned for workspace and vendored packages. The
- * image only ever materializes runtime packages, which all live here;
- * examples, python, and native are never on a roster's dependency chain (the
- * native addon is a replaced external).
+ * image only ever materializes runtime packages, which live here. The Landlock
+ * package family contributes its unchanged JavaScript entry from `native/`;
+ * examples and python never occur on a roster's dependency chain.
  */
-const WORKSPACE_SCAN_ROOTS = ['vendor', 'packages', 'apps']
+const WORKSPACE_SCAN_ROOTS = ['vendor', 'packages', 'native/landlock-run/packages', 'apps']
 
 /** Composition entry point package: the `dsh` CLI, run from source. */
 const CLI_PACKAGE = 'apps/cli'
@@ -28,6 +28,21 @@ const CLI_PACKAGE = 'apps/cli'
 /** Composition entry point: the `dsh` CLI, run from source. */
 const CLI_ENTRY = `${CLI_PACKAGE}/src/bin.ts`
 
+/** Repository-owned deterministic filesystem content offered by the preview. */
+const PREVIEW_EXAMPLE_ROOT = 'packages/experimental/webworker-runtime/tests/fixtures/vfs-example'
+
+/** One built-in Preview source and the trees packed into its overlay. */
+export interface PreviewFixture {
+  /** URL/query-safe identifier. */
+  readonly id: string
+  /** User-facing chooser label. */
+  readonly label: string
+  /** User-facing chooser detail. */
+  readonly description: string
+  /** Opaque trees packed into this fixture's overlay archive. */
+  readonly trees: readonly ImageTree[]
+}
+
 /**
  * Index every workspace and vendored package by name.
  * @param repoRoot - Absolute repository root.
@@ -130,6 +145,23 @@ export function configTrees(repoRoot: string): ConfigTree[] {
   })
 }
 
+/**
+ * Built-in filesystem fixtures offered by the repository preview.
+ * Session and Workspace semantics remain opaque here; the owning runtime tests
+ * validate those files through their production readers.
+ * @param repoRoot - Absolute repository root.
+ * @returns Named chooser entries and their overlay trees.
+ */
+export function previewFixtures(repoRoot: string): PreviewFixture[] {
+  const root = join(repoRoot, PREVIEW_EXAMPLE_ROOT)
+  return [{
+    id: 'vfs-example',
+    label: 'Built-in showcase',
+    description: 'Sample workspace, tool cards, subagents, and paged history.',
+    trees: ['home', 'workspace'].map(mount => ({ mount, directory: join(root, mount) })),
+  }]
+}
+
 /**
  * Render one pack as the lines a build log should carry.
  *

packages/experimental/webworker-packer/tests/image-loadable.spec.ts

@@ -20,20 +20,52 @@ import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
+import { FiberState } from '@deepseek-ai/cordis'
 import { createNodeBuiltins, REPLACED_PREFIXES } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/node/builtins.ts'
-import { WorkerModuleLoader } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/module-system/module-loader.ts'
+import {
+  setActiveModuleLoader, WorkerModuleLoader,
+} from '@deepseek-ai/dsh-experimental-webworker-runtime/src/module-system/module-loader.ts'
 import { inflateImage } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/storage/image-gzip.ts'
 import { loadVfsImage } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/storage/memory.ts'
-import { indexWorkspacePackages } from '../src/repository.ts'
-import { DEFAULT_ROOT, MANIFEST_PATH, packVfsImage } from '../src/pack.ts'
+import { setActiveVfs } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/storage/active.ts'
+import { indexWorkspacePackages, previewFixtures } from '../src/repository.ts'
+import { DEFAULT_ROOT, MANIFEST_PATH, packVfsImage, packVfsOverlay } from '../src/pack.ts'
 
 const repoRoot = fileURLToPath(new URL('../../../../', import.meta.url))
 
 /** A leaf workspace package: real build output, no dependencies to drag in. */
 const SUBJECT = '@deepseek-ai/dsh-timeout'
+const LANDLOCK = '@deepseek-ai/node-addon-landlock-run'
+const PLUGIN_INVENTORY = '@deepseek-ai/dsh-plugin-package-inventory-deepseek'
 
 const workspaces = indexWorkspacePackages(repoRoot)
 
+describe('preview example overlays', () => {
+  it('packs source-looking paths and dot directories into a separate overlay', () => {
+    const fixture = previewFixtures(repoRoot)[0]
+    expect(fixture?.id).toBe('vfs-example')
+    const result = packVfsOverlay(fixture?.trees ?? [])
+    expect(new TextDecoder().decode(result.files['workspace/src/preview.ts']))
+      .toContain("previewStatus = 'ready'")
+    expect(new TextDecoder().decode(result.files['workspace/.agents/skills/preview-tour/SKILL.md']))
+      .toContain('name: preview-tour')
+    expect(Object.keys(result.files).filter(path => path.endsWith('/session.jsonl'))).toHaveLength(3)
+  })
+
+  it('fails loud when a declared seed tree is absent', () => {
+    expect(() => packVfsOverlay([
+      { mount: 'workspace', directory: join(repoRoot, 'missing-preview-seed') },
+    ])).toThrow(/tree workspace is missing/)
+  })
+
+  it('refuses overlays that could replace runtime files', () => {
+    const fixture = previewFixtures(repoRoot)[0]
+    expect(() => packVfsOverlay([
+      { mount: 'config', directory: fixture?.trees[0]?.directory ?? repoRoot },
+    ])).toThrow(/must stay under home or workspace/)
+  })
+})
+
 /**
  * The pack consumes built `lib/` output. An unbuilt checkout (the unit
  * coverage lane runs before any build) self-skips; the built lanes and every
@@ -53,6 +85,24 @@ const packed = (): ReturnType<typeof packVfsImage> => memo ??= packVfsImage({
   entries: [],
 })
 
+let landlockMemo: ReturnType<typeof packVfsImage> | undefined
+const packedLandlock = (): ReturnType<typeof packVfsImage> => landlockMemo ??= packVfsImage({
+  config: `- id: subject\n  name: '${LANDLOCK}'\n`,
+  profile: 'landlock-package-check',
+  workspaces,
+  resolveFrom: repoRoot,
+  entries: [],
+})
+
+let pluginInventoryMemo: ReturnType<typeof packVfsImage> | undefined
+const packedPluginInventory = (): ReturnType<typeof packVfsImage> => pluginInventoryMemo ??= packVfsImage({
+  config: `- id: subject\n  name: '${PLUGIN_INVENTORY}'\n`,
+  profile: 'plugin-inventory-check',
+  workspaces,
+  resolveFrom: repoRoot,
+  entries: [],
+})
+
 /** The image's archive, inflated once: mounting reads the tar, not the gzip member. */
 let archiveMemo: Uint8Array | undefined
 const archive = async (): Promise<Uint8Array> =>
@@ -138,6 +188,95 @@ const archive = async (): Promise<Uint8Array> =>
     expect(loader.usage().modules).toBeGreaterThan(0)
   })
 
+  it('runs the unchanged Landlock entry package over the Worker platform executable', async () => {
+    const result = packedLandlock()
+    expect(workspaces.has(LANDLOCK)).toBe(true)
+    expect(result.packages.has(LANDLOCK)).toBe(true)
+    expect(result.missing).toEqual([])
+    expect(Object.hasOwn(result.files, `node_modules/${LANDLOCK}/lib/index.js`)).toBe(true)
+    expect(createNodeBuiltins()[LANDLOCK]).toBeUndefined()
+
+    const vfs = loadVfsImage(await inflateImage(result.image, 'the packed Landlock package'), DEFAULT_ROOT)
+    const loader = new WorkerModuleLoader({
+      vfs,
+      root: DEFAULT_ROOT,
+      staticModules: createNodeBuiltins(),
+      staticModulePrefixes: REPLACED_PREFIXES,
+    })
+    setActiveVfs(vfs)
+    setActiveModuleLoader(loader)
+    const landlock = loader.requireFrom(`${DEFAULT_ROOT}/workspace`)(LANDLOCK) as {
+      LAUNCHER_BIN: string
+      LAUNCHER_FAILURE_EXIT: number
+      launcherPath(): string
+      grantArgs(grants: { readOnly?: readonly string[]; readWrite?: readonly string[] }): string[]
+      probe(): string
+    }
+
+    expect(landlock.LAUNCHER_BIN).toBe('landlock-run')
+    expect(landlock.LAUNCHER_FAILURE_EXIT).toBe(125)
+    expect(landlock.grantArgs({ readOnly: ['/'], readWrite: ['/tmp'] })).toEqual([
+      '--ro', '/', '--rw', '/tmp',
+    ])
+    expect(landlock.launcherPath()).toBe(
+      `${DEFAULT_ROOT}/node_modules/${LANDLOCK}/node_modules/${LANDLOCK}-${process.platform}-${process.arch}/bin/landlock-run`,
+    )
+    expect(landlock.probe()).toBe('full')
+  })
+
+  it('prepares the unchanged plugin-package inventory through Worker createRequire paths', async () => {
+    const result = packedPluginInventory()
+    expect(result.missing).toEqual([])
+
+    const vfs = loadVfsImage(await inflateImage(result.image, 'the packed plugin inventory'), DEFAULT_ROOT)
+    const loader = new WorkerModuleLoader({
+      vfs,
+      root: DEFAULT_ROOT,
+      staticModules: createNodeBuiltins(),
+      staticModulePrefixes: REPLACED_PREFIXES,
+    })
+    setActiveVfs(vfs)
+    setActiveModuleLoader(loader)
+    const inventory = loader.requireFrom(`${DEFAULT_ROOT}/workspace`)(PLUGIN_INVENTORY) as {
+      apply(ctx: unknown, config: unknown): void
+    }
+
+    type Prepared = { readonly value: { readonly version: number; readonly packages: readonly unknown[] } }
+    type Prepare = (request: { readonly body: object; readonly signal: AbortSignal }) => Promise<Prepared>
+    let prepare: Prepare | undefined
+    const baseUrl = `file://${DEFAULT_ROOT}/config/cordis.yml`
+    const tree: { readonly ctx: { readonly baseUrl: string }; entries(): readonly unknown[] } = {
+      ctx: { baseUrl },
+      entries: () => [entry],
+    }
+    const entry = {
+      options: { name: PLUGIN_INVENTORY },
+      disabled: false,
+      fiber: { state: FiberState.ACTIVE },
+      parent: { tree },
+    }
+    inventory.apply({
+      baseUrl,
+      loader: tree,
+      deepseekLlmApiExtensions: {
+        register: (field: string, contribution: { readonly prepare: Prepare }): void => {
+          expect(field).toBe('dsh_plugin_packages')
+          prepare = contribution.prepare
+        },
+      },
+    }, {})
+
+    if (prepare === undefined) throw new Error('packed plugin inventory did not register its request contribution')
+    const prepared = await prepare({ body: {}, signal: new AbortController().signal })
+    const manifest = JSON.parse(vfs.readFileSync(
+      `${DEFAULT_ROOT}/node_modules/${PLUGIN_INVENTORY}/package.json`, 'utf8',
+    ) as string) as { version: string }
+    expect(prepared.value).toEqual({
+      version: 1,
+      packages: [{ name: PLUGIN_INVENTORY, version: manifest.version }],
+    })
+  })
+
   it('refuses a body the packer did not lower, naming the image', async () => {
     // The case above only proves the packed bytes are wrappable. This is the
     // other half: the loader has no transform to fall back on, so an entry the

packages/experimental/webworker-runtime/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/experimental/webworker-runtime/README.md
-README.md: b82c65b981be6a9405ae72e3a24a42c68b52696e
-README.zh.md: 97160641a38095026d5103f2e423846bfb41d5a6
+README.md: 3e9b4fffe0b97a97adf218aa12fd1f4342d3bc6c
+README.zh.md: 2552c659d1b735b0cf28b9b0d0808276d31d0a2a

packages/experimental/webworker-runtime/README.md

@@ -6,12 +6,12 @@ The browser worker host: the whole harness plugin tree runs inside one dedicated
 
 Three artifacts from one tsdown pipeline:
 
-- **`lib/index.js` (assembly library)** — `createWorkerHost`/`startWorkerHost` mount the image (`storage/`), install the module loader (`module-system/`) and the `process` shim, boot the tree through the image's own `dsh-app-boot`, and hand the tunnel its serving seams. The image layout contract (`image-layout.ts`: virtual root, config/manifest paths, empty directories, the `lowered` wrapper-contract gate) is shared with the packer. Boot patches force the deployment-shaped rows: frontend serving off, JSONL session logs on the plaintext path, preset roots onto the image's `config/agent-presets`.
-- **`lib/worker.js` (worker bundle)** — the assembly plus this package's Node-compatibility layer as one self-contained ES module. The module proxy table (`module-proxies.ts`) is the only platform fork: `node:*` builtins over VFS/tunnel/browser primitives, structural stubs that fail loud on the console for what a browser cannot do, and replaced externals. AsyncLocalStorage carries sync-stack causality across `await` through the snapshot/restore faces the pack-time lowering injects. The worker holds no compiler: an image the packer did not lower is refused at mount ([note](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.md)).
-- **`src/shell/` (the worker's own process layer)** — a browser worker cannot fork, so `node:child_process` is not a stub but an implementation: `spawn` starts the command in its own Web Worker — this same bundle, told by its first frame to be a shell process — and reports it through the `ChildProcess` surface the subprocess service consumes. The command runs off the host's thread, `SIGKILL` terminates it whatever it is doing, and it reaches the VFS only by message (the host serves those frames). The grammar is `@yarnpkg/parsers`' `parseShell`; this package owns the evaluator (pipelines, `&&`/`||`, subshells, redirections, expansion, globs) and the command table, which is the only `/bin` that exists — a name it does not hold reports `command not found`, and `execSync`/`fork` still refuse, because they need a real process.
-- **`lib/client.js` (page half)** — `connectWorkerHost(worker, { image? })` completes the pre-Cordis handshake: the opening `init` frame carries the image URL (the one deployment-shaped input), the boot payload delivers the structured index-injection table, and `applyIndexInjections` executes it before the shell entry runs. The tunnel exposes fetch-shaped transport, the API client, and `loadBundle` for the shell's boot seam.
+- **`lib/index.js` (assembly library)** — `createWorkerHost`/`startWorkerHost` mount the base image and any ordered data overlays (`storage/`), install the module loader (`module-system/`) and the `process` shim, boot the tree through the image's own `dsh-app-boot`, and hand the tunnel its serving seams. Overlays may replace files only under `home/` and `workspace/`; they cannot replace the base manifest, configuration, or modules. The image layout contract (`image-layout.ts`: virtual root, config/manifest paths, empty directories, the `lowered` wrapper-contract gate) is shared with the packer. Boot patches force the deployment-shaped rows: frontend serving off, JSONL session logs on the plaintext path, preset roots onto the image's `config/agent-presets`.
+- **`lib/worker.js` (worker bundle)** — the assembly plus this package's Node-compatibility layer as one self-contained ES module. The module proxy table (`module-proxies.ts`) is the only platform fork: `node:*` builtins over VFS/tunnel/browser primitives, structural stubs that fail loud on the console for what a browser cannot do, and native/binary package replacements. `node:module` supplies `createRequire().resolve` and `.resolve.paths()` over the image package root, so unchanged packages can discover manifests without evaluating their modules. VFS mutations drive `node:fs` callback, polling, and promise watchers; open descriptors retain file identity and access mode across rename, replacement, and unlink; `readable-stream` supplies the stream state machine used by file streams and unchanged image packages such as Chokidar and readdirp. AsyncLocalStorage carries sync-stack causality across `await` through the snapshot/restore faces the pack-time lowering injects. The worker holds no compiler: an image the packer did not lower is refused at mount ([note](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.md)).
+- **`src/shell/` (the worker's own process layer)** — a browser worker cannot fork, so `node:child_process` is not a stub but an implementation: `spawn` starts the command in its own Web Worker — this same bundle, told by its first frame to be a shell process — and reports it through the `ChildProcess` surface the subprocess service consumes. The command runs off the host's thread, `SIGKILL` terminates it whatever it is doing, and it reaches the VFS only by message (the host serves those frames). Worker platform executables preserve native-package protocols such as Landlock without replacing their JavaScript packages or coupling their implementations to `node:child_process`; ordinary commands use the package's evaluator and coreutils command table. The grammar is `@yarnpkg/parsers`' `parseShell`, while `execSync`/`fork` still refuse because they need a real process.
+- **`lib/client.js` (page half)** — startup has two independent stages. `chooseWorkerHostSource({ image?, fixtureManifest? })` optionally owns the boot barrier and fixture manifest: without `preview-fixture` it waits at the source chooser, while a valid query selects directly; either path returns ordered overlays. `connectWorkerHost(worker, { image?, overlays? })` remains the public base-runtime connector; callers that skip the chooser get an empty overlay list. `apps/web` invokes both and supplies its statically bundled Worker. The opening `init` frame carries the base and ordered overlay URLs, the boot payload delivers the structured index-injection table, and `applyIndexInjections` executes it before the shell entry runs. The tunnel exposes fetch-shaped transport, the API client, and `loadBundle` for the shell's boot seam.
 
-Acceptance lives in `apps/web/tests/preview-boot.e2e.ts`, which serves the real built pages and drives the worker boot in headless Chromium.
+Acceptance lives in `apps/web/tests/preview-boot.e2e.ts`, which serves the real built pages and drives the pre-boot chooser plus Worker activation in headless Chromium. The empty selection exercises first-run startup. The `vfs-example` overlay supplies ordinary workspace files and plaintext persistence artifacts for cold Workspace/Session discovery, tool presentation, subagent navigation, and history paging without a model request. The chooser reserves WebFS as a separate user-authorized source; that provider does not read the built-in fixture.
 
 ## Model Experience
 
@@ -24,9 +24,9 @@ None; this package neither assembles nor sends a provider request.
 ## Known Limitations and Deferred Work
 
 - **The worker composition writes plaintext session logs** (`compression: 'none'` boot patch): it carries no Zstandard codec, so exported logs are `.jsonl`, never `.jsonl.zstd`.
-- **The skill catalog is never cached in the worker** — `skill-filesystem` watches its roots through `node:fs.watchFile`, which this package refuses, so every discovery pass returns an incomplete observation and re-scans. Discovery itself stays correct; the cost is a re-scan on every pass.
 - **`node:vm`, `node:net`, `node:sqlite`, `node:worker_threads` are structural stubs**: every call reports its refusal on the console and throws. Rows needing a real process or realm isolation cannot run here.
-- **The bash tool runs only under `danger-full-access`**: a browser has no kernel to confine a command with, so `ctx.sandbox.confine` fails loud in every other permission preset and the command never starts. The mode is the deployment's own user-facing switch, not a worker-specific composition.
+- **Filesystem watchers observe only the mounted VFS**: image seeding is silent and the VFS has no symlinks or external writers. `persistent`, `ref()`, and `unref()` preserve the Node API but cannot control a dedicated Worker's lifetime because browsers expose no ref-counted event loop.
+- **Worker confinement is a VFS boundary, not kernel Landlock**: `read-only` and `workspace-write` run the unchanged `@deepseek-ai/node-addon-landlock-run` JavaScript and launcher argv, but the process layer implements the logical `landlock-run` executable and enforces its grants on every shell filesystem request. `full` therefore covers the Worker command table and mounted VFS only; it does not claim arbitrary native-process execution or Linux kernel isolation.
 - **The worker bundle pins a path inside `@yarnpkg/parsers`** — the build resolves the package's own `lib/shell.js` instead of its root, whose barrel also re-exports the Syml parser and so drags js-yaml into a bundle that never parses that format (around 175 kB, plus its module body at worker start). The path is derived from the package manifest, so a layout change fails the build rather than reinstating the barrel; upgrading the dependency means re-checking that the shell parser still lives there.
 - **The shell is not bash**: no loops, functions, `case`, job control, or process substitution — the grammar stops at pipelines, `&&`/`||`, subshells, groups, redirections, and expansion. `&` runs its command to completion in place, `sed` accepts only substitution scripts, patterns are JavaScript regular expressions, and the command table holds coreutils only (no `git`, no network tools).
 - **A shell process has no synchronous filesystem**: it reads and writes the host's VFS by message, because blocking on a reply would need `SharedArrayBuffer`, which requires a cross-origin isolation GitHub Pages cannot grant. Directory-walking commands therefore cost one round trip per entry, and two concurrent commands can interleave their writes.

packages/experimental/webworker-runtime/README.zh.md

@@ -6,12 +6,12 @@
 
 一条 tsdown 管线出三个产物：
 
-- **`lib/index.js`（装配库）**——`createWorkerHost`/`startWorkerHost` 挂载镜像（`storage/`）、安装模块加载器（`module-system/`）与 `process` shim、经镜像自带的 `dsh-app-boot` 启动插件树，并把服务缝隙交给隧道。镜像布局契约（`image-layout.ts`：虚拟根、config/manifest 路径、空目录、`lowered` 包装契约门）与 packer 共享。boot patch 强制部署形态行：关前端静态服务、JSONL 会话日志走明文、preset 根指向镜像内 `config/agent-presets`。
-- **`lib/worker.js`（worker 束）**——装配库加本包的 Node 兼容层，合成一个自含 ES module。模块代理表（`module-proxies.ts`）是唯一平台叉口：`node:*` 内建走 VFS/隧道/浏览器原语，浏览器做不到的走结构化 stub（调用即 console 报错并抛出），外部包整体替换。AsyncLocalStorage 经 pack 时降低注入的 snapshot/restore 面在 `await` 间携带同步栈因果。worker 不带编译器：packer 未降低的镜像在挂载时被拒（[note](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.zh.md)）。
-- **`src/shell/`（worker 自己的进程层）**——浏览器 worker 无法 fork，所以 `node:child_process` 不是 stub 而是实现：`spawn` 把命令放进它自己的 Web Worker——就是这同一个束，由首帧告诉它「你是 shell 进程」——并以 subprocess 服务消费的 `ChildProcess` 面报告结果。命令不占宿主线程，`SIGKILL` 不管它在干什么都能终止它，而它只能靠消息触达 VFS（由宿主应答这些帧）。语法来自 `@yarnpkg/parsers` 的 `parseShell`；求值器（管道、`&&`/`||`、子 shell、重定向、展开、glob）与命令表由本包自持，而命令表就是这里唯一存在的 `/bin`——表里没有的名字报 `command not found`，`execSync`/`fork` 依然拒绝，因为它们需要真进程。
-- **`lib/client.js`（页面半）**——`connectWorkerHost(worker, { image? })` 完成 pre-Cordis 握手：开局 `init` 帧携带镜像 URL（唯一部署形态输入），boot 载荷送达结构化 index 注入表，`applyIndexInjections` 在壳入口运行前逐行执行。隧道暴露 fetch 形传输、API 客户端与壳启动缝隙用的 `loadBundle`。
+- **`lib/index.js`（装配库）**——`createWorkerHost`/`startWorkerHost` 挂载基础镜像和按序排列的数据 overlays（`storage/`）、安装模块加载器（`module-system/`）与 `process` shim、经镜像自带的 `dsh-app-boot` 启动插件树，并把服务缝隙交给隧道。Overlay 只能替换 `home/` 与 `workspace/` 下的文件，不能替换基础 manifest、配置或模块。镜像布局契约（`image-layout.ts`：虚拟根、config/manifest 路径、空目录、`lowered` 包装契约门）与 packer 共享。boot patch 强制部署形态行：关前端静态服务、JSONL 会话日志走明文、preset 根指向镜像内 `config/agent-presets`。
+- **`lib/worker.js`（worker 束）**——装配库加本包的 Node 兼容层，合成一个自含 ES module。模块代理表（`module-proxies.ts`）是唯一平台叉口：`node:*` 内建走 VFS、隧道和浏览器原语，浏览器做不到的走结构化 stub（调用即在 console 报错并抛出），native/binary 包则替换执行后端。`node:module` 在镜像 package 根之上提供 `createRequire().resolve` 与 `.resolve.paths()`，使未修改的包无需执行目标模块即可发现 manifest。VFS mutation 驱动 `node:fs` 的 callback、polling 和 promise watcher；打开的 descriptor 在 rename、replacement 和 unlink 后仍保留文件身份与访问模式；`readable-stream` 提供文件流以及 Chokidar、readdirp 等未修改镜像包所用的流状态机。AsyncLocalStorage 经 pack 时降低注入的 snapshot/restore 面在 `await` 间携带同步栈因果。worker 不带编译器：packer 未降低的镜像在挂载时被拒（[note](../../../.agents/notes/implemented/architecture/2026-08-20-webworker-pack-lowering-and-preview.zh.md)）。
+- **`src/shell/`（worker 自己的进程层）**——浏览器 worker 无法 fork，所以 `node:child_process` 不是 stub 而是实现：`spawn` 把命令放进它自己的 Web Worker——就是这同一个束，由首帧告诉它「你是 shell 进程」——并以 subprocess 服务消费的 `ChildProcess` 面报告结果。命令不占宿主线程，`SIGKILL` 不管它在干什么都能终止它，而它只能靠消息触达 VFS（由宿主应答这些帧）。Worker 平台 executable 在不替换 JavaScript 包、也不把具体实现耦合进 `node:child_process` 的情况下保持 Landlock 等 native 包协议；普通命令使用本包的求值器与 coreutils 命令表。语法来自 `@yarnpkg/parsers` 的 `parseShell`，而 `execSync`/`fork` 依然拒绝，因为它们需要真进程。
+- **`lib/client.js`（页面半）**——启动分为相互独立的两段。`chooseWorkerHostSource({ image?, fixtureManifest? })` 可选地拥有 boot barrier 与 fixture manifest：没有 `preview-fixture` 时停在来源选择面板，合法 query 则直接选择；两条路径都返回按序排列的 overlays。`connectWorkerHost(worker, { image?, overlays? })` 仍是公开的基础运行态连接器；调用方跳过选择器时 overlay 列表为空。`apps/web` 调用这两段并提供静态打包的 Worker。开局 `init` 帧携带基础镜像与按序排列的 overlay URL，boot 载荷送达结构化 index 注入表，`applyIndexInjections` 在壳入口运行前逐行执行。隧道暴露 fetch 形传输、API 客户端与壳启动缝隙用的 `loadBundle`。
 
-验收在 `apps/web/tests/preview-boot.e2e.ts`：静态服务真实构建页面，在 headless Chromium 里驱动 worker 启动。
+验收在 `apps/web/tests/preview-boot.e2e.ts`：静态服务真实构建页面，在 headless Chromium 里驱动 pre-boot 选择面板与 Worker 激活。空白选择验证首次启动；`vfs-example` overlay 提供普通 workspace 文件与明文 persistence 产物，无需模型请求即可验证 Workspace/Session 冷发现、工具呈现、subagent 导航和历史分页。选择面板为 WebFS 保留独立的用户授权来源；该 provider 不读取内置 fixture。
 
 ## 模型体验
 
@@ -24,9 +24,9 @@
 ## Known Limitations and Deferred Work
 
 - **worker 组合写明文会话日志**（`compression: 'none'` boot patch）：不带 Zstandard 编解码器，导出日志是 `.jsonl`，不会是 `.jsonl.zstd`。
-- **worker 里的技能目录从不缓存**——`skill-filesystem` 用 `node:fs.watchFile` 监听各个根，而本包拒绝该调用，于是每轮发现都返回不完整观测并重新扫描。发现本身仍然正确，代价是每轮都要重扫。
 - **`node:vm`、`node:net`、`node:sqlite`、`node:worker_threads` 是结构化 stub**：每次调用在 console 报告拒绝并抛出。需要真进程或真 realm 隔离的行在此无法运行。
-- **bash 工具只在 `danger-full-access` 下可用**：浏览器没有内核可以约束命令，因此在其余权限档位下 `ctx.sandbox.confine` 会响亮失败、命令根本不会启动。该档位是部署本身的用户面开关，不是 worker 特有的组合差异。
+- **文件 watcher 只能观察已挂载的 VFS**：镜像 seed 不产生事件，VFS 也没有符号链接或外部写入方。`persistent`、`ref()` 和 `unref()` 保留 Node API，但浏览器没有引用计数事件循环，因此这些接口不能控制 dedicated Worker 的生存期。
+- **Worker confinement 是 VFS 边界，不是内核 Landlock**：`read-only` 和 `workspace-write` 运行未经修改的 `@deepseek-ai/node-addon-landlock-run` JavaScript 与 launcher argv，进程层则实现逻辑 `landlock-run` 可执行文件，并在 shell 的每次文件系统请求上执行其授权。`full` 仅覆盖 Worker 命令表和已挂载 VFS，不表示能够执行任意 native 进程，也不表示 Linux 内核隔离。
 - **worker 束钉住了 `@yarnpkg/parsers` 的包内路径**——构建解析到该包自己的 `lib/shell.js` 而非包根，因为包根 barrel 还 re-export 了 Syml 解析器，会把 js-yaml 拖进一个从不解析该格式的束（约 175 kB，外加 worker 启动时的模块体求值）。该路径由包 manifest 派生，包内布局一变即构建期失败、不会静默退回 barrel；升级这个依赖时须复核 shell 解析器是否仍在那里。
 - **这个 shell 不是 bash**：没有循环、函数、`case`、作业控制或进程替换——语法止步于管道、`&&`/`||`、子 shell、group、重定向与展开。`&` 会就地把命令跑完，`sed` 只接受替换脚本，模式是 JavaScript 正则，命令表只有 coreutils（没有 `git`，没有网络工具）。
 - **shell 进程没有同步文件面**：它靠消息读写宿主的 VFS，因为阻塞等待回帧需要 `SharedArrayBuffer`，而那要求 GitHub Pages 给不了的跨源隔离。因此目录遍历类命令每个条目一次往返，并发的两条命令写入可以交错。

packages/experimental/webworker-runtime/package.json

@@ -35,7 +35,8 @@
     "@yarnpkg/parsers": "^3.1.0",
     "acorn": "^8.17.0",
     "buffer": "^6.0.3",
-    "picomatch": "^4.0.4"
+    "picomatch": "^4.0.4",
+    "readable-stream": "^4.7.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "workspace:^",
@@ -49,12 +50,21 @@
     "@deepseek-ai/cordis": "workspace:^",
     "@deepseek-ai/cordis-plugin-loader": "workspace:^",
     "@deepseek-ai/dsh-api-gateway": "workspace:^",
+    "@deepseek-ai/dsh-bash-sandbox": "workspace:^",
     "@deepseek-ai/dsh-client-modules": "workspace:^",
     "@deepseek-ai/dsh-host-apiproxy": "workspace:^",
     "@deepseek-ai/dsh-host-webserver": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-sandbox-local": "workspace:^",
+    "@deepseek-ai/dsh-sandbox-policy": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "workspace:^",
+    "@deepseek-ai/dsh-subagent": "workspace:^",
     "@deepseek-ai/dsh-subprocess-local": "workspace:^",
-    "@types/picomatch": "^3.0.2"
+    "@deepseek-ai/node-addon-landlock-run": "workspace:^",
+    "@types/picomatch": "^3.0.2",
+    "@types/readable-stream": "^4.0.24",
+    "chokidar": "^5.0.0"
   },
   "files": [
     "lib/index.js",

packages/experimental/webworker-runtime/src/client/client.ts

@@ -156,9 +156,10 @@ export class WorkerTunnel {
   /**
    * Open the tunnel: the worker assembles its host from this frame.
    * @param image - VFS image URL the worker fetches.
+   * @param overlays - Ordered data overlay URLs applied before boot.
    */
-  init(image: string): void {
-    this.worker.postMessage({ t: 'init', image })
+  init(image: string, overlays: readonly string[] = []): void {
+    this.worker.postMessage({ t: 'init', image, overlays })
   }
 
   /** Fetch-shaped entry: one request frame, one Response (streamed when the worker streams). */

packages/experimental/webworker-runtime/src/client/index.ts

@@ -9,14 +9,20 @@
  * @module @deepseek-ai/dsh-experimental-webworker-runtime/client
  */
 import { IMAGE_FILE_NAME } from '../image-layout.ts'
+import { PREVIEW_FIXTURE_MANIFEST_FILE } from '../fixture-manifest.ts'
 import { WorkerApiClient } from './api-client.ts'
 import { WorkerTunnel, type TunnelFetch } from './client.ts'
 import { applyIndexInjections } from './apply-injections.ts'
+import { choosePreviewSource } from './source-chooser.ts'
 
 export { WorkerApiClient } from './api-client.ts'
 export { WorkerTunnel, type TunnelFetch } from './client.ts'
 export { applyIndexInjections } from './apply-injections.ts'
 export { IMAGE_FILE_NAME } from '../image-layout.ts'
+export {
+  parsePreviewFixtureManifest, PREVIEW_FIXTURE_MANIFEST_FILE, PREVIEW_FIXTURE_MANIFEST_VERSION,
+  type PreviewFixtureManifest, type PreviewFixtureManifestEntry,
+} from '../fixture-manifest.ts'
 
 /** Transport global the connection plugin reads instead of building an HTTP carrier. */
 interface ClientTransportGlobal {
@@ -35,9 +41,25 @@ export interface WorkerHostConnectOptions {
   /**
    * VFS image URL, the one deployment-shaped input. Defaults to
    * {@link IMAGE_FILE_NAME} beside the page; a deployment that packs the
-   * image elsewhere passes its own URL.
+   * image elsewhere passes its own URL. Data overlays are independent.
    */
   readonly image?: string | URL
+  /** Ordered data overlay URLs, resolved against the page like the base image. */
+  readonly overlays?: readonly (string | URL)[]
+}
+
+/** Inputs for the optional pre-boot filesystem-source chooser. */
+export interface WorkerHostSourceOptions {
+  /** Base VFS image URL; defaults to {@link IMAGE_FILE_NAME} beside the page. */
+  readonly image?: string | URL
+  /** Fixture catalog URL; defaults to {@link PREVIEW_FIXTURE_MANIFEST_FILE} beside the image. */
+  readonly fixtureManifest?: string | URL
+}
+
+/** Filesystem inputs selected before {@link connectWorkerHost}. */
+export interface WorkerHostSource {
+  /** Ordered data overlays to pass through unchanged to the Host connection. */
+  readonly overlays: readonly URL[]
 }
 
 /** A page connected to a worker-hosted harness, ready to run a shell entry. */
@@ -53,12 +75,51 @@ interface BootReadyGlobal {
   __DSH_BOOT_READY__?: PromiseWithResolvers<void>
 }
 
+function bootReadyGate(): PromiseWithResolvers<void> {
+  return (globalThis as BootReadyGlobal).__DSH_BOOT_READY__ ??= Promise.withResolvers<void>()
+}
+
+/**
+ * Install the page boot barrier before an asynchronous source chooser waits
+ * for user input. The later {@link connectWorkerHost} call settles the same
+ * barrier.
+ */
+function holdWorkerHostBoot(): void {
+  const ready = bootReadyGate()
+  // A chooser may remain open indefinitely; if a later connection fails before
+  // the stock entry subscribes, retain the rejection without browser noise.
+  void ready.promise.catch(() => {})
+}
+
+/**
+ * Run the optional pre-boot source-selection stage. Calling this stage holds
+ * the stock shell until the caller passes its result to {@link connectWorkerHost};
+ * callers that need no chooser call `connectWorkerHost` directly and receive
+ * the base image with an empty overlay list.
+ * @param options - Base image and optional fixture-catalog locations.
+ * @returns The ordered overlays selected by the user.
+ */
+export async function chooseWorkerHostSource(
+  options: WorkerHostSourceOptions = {},
+): Promise<WorkerHostSource> {
+  holdWorkerHostBoot()
+  const image = new URL(options.image ?? IMAGE_FILE_NAME, document.baseURI)
+  const manifest = new URL(options.fixtureManifest ?? PREVIEW_FIXTURE_MANIFEST_FILE, image)
+  try {
+    const overlays = await choosePreviewSource(manifest)
+    return { overlays }
+  } catch (reason) {
+    bootReadyGate().reject(reason)
+    throw reason
+  }
+}
+
 /**
  * Connect a spawned host worker and complete the pre-Cordis handshake.
  *
  * The caller constructs the Worker so its bundler resolves the bundle URL
- * statically; the opening `init` frame then carries the image location, the
- * only input the worker takes from outside.
+ * statically; the opening `init` frame then carries the base image and ordered
+ * overlay locations.
  *
  * Order is fixed by the web boot protocol: the transport global must exist
  * before any bundle executes; the injection table then reproduces the served
@@ -70,17 +131,20 @@ interface BootReadyGlobal {
  * row has taken effect, and surfaces a failed handshake instead of
  * proceeding on missing globals.
  * @param worker - The host worker.
- * @param options - Image location override.
+ * @param options - Base-image and overlay location overrides.
  * @returns The connection; hand `loadBundle` to the shell entry's boot seam.
  */
 export async function connectWorkerHost(worker: Worker, options?: WorkerHostConnectOptions): Promise<WorkerHostConnection> {
-  const ready = (globalThis as BootReadyGlobal).__DSH_BOOT_READY__ ??= Promise.withResolvers<void>()
+  const ready = bootReadyGate()
   // The handshake may fail before any entry awaits the promise; this no-op
   // subscription keeps that from surfacing as an unhandled rejection.
   void ready.promise.catch(() => {})
   try {
     const tunnel = new WorkerTunnel(worker)
-    tunnel.init(new URL(options?.image ?? IMAGE_FILE_NAME, document.baseURI).href)
+    tunnel.init(
+      new URL(options?.image ?? IMAGE_FILE_NAME, document.baseURI).href,
+      (options?.overlays ?? []).map(overlay => new URL(overlay, document.baseURI).href),
+    )
     const payload = await tunnel.bootPayload()
     ;(globalThis as ClientTransportGlobal).__DSH_TRANSPORT__ = {
       createApiClient: () => new WorkerApiClient(tunnel),

packages/experimental/webworker-runtime/src/client/source-chooser.ts

@@ -0,0 +1,264 @@
+/** Pre-boot filesystem-source chooser for static WebWorker previews. */
+
+import {
+  parsePreviewFixtureManifest, type PreviewFixtureManifestEntry,
+} from '../fixture-manifest.ts'
+
+const EMPTY_SOURCE = 'none'
+const WEBFS_SOURCE = 'webfs'
+const PREVIEW_FIXTURE_QUERY = 'preview-fixture'
+
+interface PreviewSourceChoice {
+  readonly id: string
+  readonly label: string
+  readonly description: string
+  readonly overlays: readonly URL[]
+  readonly disabled?: boolean
+}
+
+const CHOOSER_STYLE = `
+  [data-preview-source-chooser] {
+    position: fixed;
+    inset: 0;
+    z-index: 1200;
+    display: grid;
+    place-items: center;
+    overflow: auto;
+    padding: 24px;
+    box-sizing: border-box;
+    color: #0f1115;
+    background: #fff;
+    font-size: 14px;
+    line-height: 22px;
+  }
+  [data-preview-source-card] {
+    width: min(600px, 100%);
+    max-height: calc(100dvh - 48px);
+    box-sizing: border-box;
+    padding: 28px;
+    overflow-y: auto;
+    border: 1px solid transparent;
+    border-radius: 24px;
+    background: #fff;
+    box-shadow: 0 0 1px rgb(0 0 0 / 20%), 0 12px 32px rgb(0 0 0 / 8%);
+  }
+  [data-preview-source-card] h1 {
+    margin: 0;
+    font-size: 20px;
+    line-height: 28px;
+    font-weight: 500;
+  }
+  [data-preview-source-card] > p {
+    margin: 8px 0 0;
+    color: #61666b;
+  }
+  [data-preview-source-card] fieldset {
+    display: flex;
+    flex-direction: column;
+    gap: 1px;
+    margin: 24px 0 0;
+    padding: 0;
+    border: 0;
+  }
+  [data-preview-source-card] legend {
+    margin: 0 0 8px;
+    padding: 0 4px;
+    color: #61666b;
+    font-size: 13px;
+    line-height: 20px;
+    font-weight: 500;
+  }
+  [data-preview-source-option] {
+    position: relative;
+    display: flex;
+    align-items: flex-start;
+    gap: 8px;
+    min-height: 56px;
+    padding: 8px 12px 8px 8px;
+    box-sizing: border-box;
+    border: 1px solid transparent;
+    border-radius: 12px;
+    background: transparent;
+    cursor: pointer;
+    transition: background-color 120ms ease, border-color 120ms ease;
+  }
+  [data-preview-source-option]:hover:not(:has(input:disabled)),
+  [data-preview-source-option]:has(input:checked) {
+    background: rgb(38 49 72 / 6%);
+  }
+  [data-preview-source-option]:has(input:checked) {
+    border-color: rgb(0 0 0 / 10%);
+  }
+  [data-preview-source-option]:has(input:disabled) {
+    cursor: default;
+    opacity: 0.4;
+  }
+  [data-preview-source-option] input {
+    flex: none;
+    width: 16px;
+    height: 16px;
+    margin: 4px 0 0;
+    accent-color: #0f1115;
+  }
+  [data-preview-source-option] > span { flex: 1; min-width: 0; }
+  [data-preview-source-option] strong {
+    display: block;
+    font-size: 14px;
+    line-height: 24px;
+    font-weight: 500;
+  }
+  [data-preview-source-option] strong + span {
+    display: block;
+    color: #81858c;
+    font-size: 14px;
+    line-height: 24px;
+  }
+  [data-preview-source-submit] {
+    display: block;
+    min-width: 120px;
+    height: 36px;
+    margin: 24px 0 0 auto;
+    padding: 0 14px;
+    border: 0;
+    border-radius: 18px;
+    color: #fff;
+    background: #0f1115;
+    font-size: 14px;
+    line-height: 22px;
+    cursor: pointer;
+    transition: background-color 120ms ease;
+  }
+  [data-preview-source-submit]:hover:not(:disabled) {
+    background: #43454a;
+  }
+  [data-preview-source-submit]:focus-visible {
+    outline: 2px solid rgb(0 0 0 / 16%);
+    outline-offset: 2px;
+  }
+  [data-preview-source-submit]:disabled { cursor: not-allowed; opacity: 0.5; }
+  @media (prefers-color-scheme: dark) {
+    [data-preview-source-chooser] {
+      color: #f9fafb;
+      background: #151517;
+    }
+    [data-preview-source-card] { border-color: rgb(255 255 255 / 6%); background: #2c2c2e; }
+    [data-preview-source-card] > p, [data-preview-source-card] legend { color: #cfd3d6; }
+    [data-preview-source-option] strong + span { color: #adb2b8; }
+    [data-preview-source-option]:hover:not(:has(input:disabled)),
+    [data-preview-source-option]:has(input:checked) { background: rgb(255 255 255 / 8%); }
+    [data-preview-source-option]:has(input:checked) { border-color: rgb(255 255 255 / 12%); }
+    [data-preview-source-option] input { accent-color: #f9fafb; }
+    [data-preview-source-submit] { color: #0f1115; background: #f9fafb; }
+    [data-preview-source-submit]:hover:not(:disabled) { background: #ebeef2; }
+    [data-preview-source-submit]:focus-visible { outline-color: rgb(255 255 255 / 20%); }
+  }
+  @media (max-width: 560px) {
+    [data-preview-source-card] { padding: 24px; }
+    [data-preview-source-submit] { width: 100%; }
+  }
+  @media (prefers-reduced-motion: reduce) {
+    [data-preview-source-option], [data-preview-source-submit] { transition: none; }
+  }
+`
+
+const ENTITIES: Readonly<Record<string, string>> = {
+  '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+}
+
+function escapeMarkup(value: string): string {
+  return value.replace(/[&<>"']/g, character => ENTITIES[character] ?? character)
+}
+
+function optionMarkup(choice: PreviewSourceChoice, selected: string): string {
+  return `<label data-preview-source-option>
+    <input type="radio" name="preview-source" value="${choice.id}"${choice.id === selected ? ' checked' : ''}${choice.disabled === true ? ' disabled' : ''}>
+    <span>
+      <strong>${escapeMarkup(choice.label)}</strong>
+      <span>${escapeMarkup(choice.description)}</span>
+    </span>
+  </label>`
+}
+
+function fixtureChoices(entries: readonly PreviewFixtureManifestEntry[], manifestUrl: URL): PreviewSourceChoice[] {
+  return entries.map(entry => ({
+    id: entry.id,
+    label: entry.label,
+    description: entry.description,
+    overlays: entry.overlays.map(overlay => new URL(overlay, manifestUrl)),
+  }))
+}
+
+/**
+ * Render the source chooser and wait for an enabled selection.
+ * @param manifestUrl - Built-in fixture catalog URL.
+ * @returns Ordered overlay URLs selected for the Worker mount.
+ */
+export async function choosePreviewSource(manifestUrl: URL): Promise<readonly URL[]> {
+  const requested = new URL(location.href).searchParams.get(PREVIEW_FIXTURE_QUERY)
+  if (requested === EMPTY_SOURCE) return []
+
+  const response = await fetch(manifestUrl)
+  if (!response.ok) {
+    throw new Error(`preview source chooser: fixture manifest returned ${String(response.status)}`)
+  }
+  const manifest = parsePreviewFixtureManifest(await response.json())
+  const choices: PreviewSourceChoice[] = [
+    {
+      id: EMPTY_SOURCE,
+      label: 'Empty environment',
+      description: 'Load only the base runtime to verify first launch and workspace creation.',
+      overlays: [],
+    },
+    ...fixtureChoices(manifest.fixtures, manifestUrl),
+    {
+      id: WEBFS_SOURCE,
+      label: 'WebFS directory',
+      description: 'Requires directory access and will be available after the WebFS provider lands.',
+      overlays: [],
+      disabled: true,
+    },
+  ]
+  if (requested !== null) {
+    const requestedChoice = choices.find(choice => choice.id === requested && choice.disabled !== true)
+    if (requestedChoice === undefined) {
+      throw new Error(`preview source chooser: unknown or interactive source "${requested}"`)
+    }
+    return requestedChoice.overlays
+  }
+
+  const root = document.getElementById('root')
+  if (root === null) throw new Error('preview source chooser: missing #root')
+  const selected = manifest.defaultFixture ?? EMPTY_SOURCE
+  const style = document.createElement('style')
+  style.dataset.previewSourceStyle = ''
+  style.textContent = CHOOSER_STYLE
+  document.head.append(style)
+
+  const chooser = document.createElement('main')
+  chooser.dataset.previewSourceChooser = ''
+  chooser.innerHTML = `<form data-preview-source-card aria-labelledby="preview-source-title">
+      <h1 id="preview-source-title">Choose Preview data</h1>
+      <p>Data mounts before the Worker and application start. Refresh to choose again.</p>
+      <fieldset>
+        <legend>Filesystem source</legend>
+        ${choices.map(choice => optionMarkup(choice, selected)).join('')}
+      </fieldset>
+      <button data-preview-source-submit type="submit">Start Preview</button>
+    </form>`
+  root.prepend(chooser)
+  const form = chooser.querySelector<HTMLFormElement>('[data-preview-source-card]')
+  if (form === null) throw new Error('preview source chooser: form was not rendered')
+  const sourceId = await new Promise<string>((resolve, reject) => {
+    form.addEventListener('submit', (event) => {
+      event.preventDefault()
+      const value = new FormData(form).get('preview-source')
+      if (typeof value === 'string') resolve(value)
+      else reject(new Error('preview source chooser: no source selected'))
+    }, { once: true })
+  })
+  const choice = choices.find(candidate => candidate.id === sourceId && candidate.disabled !== true)
+  if (choice === undefined) throw new Error(`preview source chooser: unavailable source "${sourceId}"`)
+  chooser.remove()
+  style.remove()
+  return choice.overlays
+}

packages/experimental/webworker-runtime/src/fixture-manifest.ts

@@ -0,0 +1,68 @@
+/** Browser-readable catalog of built-in Preview filesystem overlays. */
+
+/** Manifest format version emitted beside the base VFS image. */
+export const PREVIEW_FIXTURE_MANIFEST_VERSION = 1
+
+/** Leaf name resolved beside the base image. */
+export const PREVIEW_FIXTURE_MANIFEST_FILE = 'fixtures.json'
+
+/** One selectable built-in fixture and its ordered overlay archives. */
+export interface PreviewFixtureManifestEntry {
+  readonly id: string
+  readonly label: string
+  readonly description: string
+  readonly overlays: readonly string[]
+}
+
+/** Complete built-in fixture catalog consumed before Worker startup. */
+export interface PreviewFixtureManifest {
+  readonly version: number
+  /** Required default fixture id, or null when the chooser should default to an empty overlay. */
+  readonly defaultFixture: string | null
+  readonly fixtures: readonly PreviewFixtureManifestEntry[]
+}
+
+function recordOf(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined
+}
+
+/**
+ * Validate the static fixture catalog before it controls Worker fetches.
+ * @param value - Parsed JSON response.
+ * @returns A detached manifest with unique ids and non-empty overlay lists.
+ */
+export function parsePreviewFixtureManifest(value: unknown): PreviewFixtureManifest {
+  const record = recordOf(value)
+  if (record?.version !== PREVIEW_FIXTURE_MANIFEST_VERSION || !Array.isArray(record.fixtures)) {
+    throw new Error(`preview fixture manifest must use version ${String(PREVIEW_FIXTURE_MANIFEST_VERSION)}`)
+  }
+  const fixtures: PreviewFixtureManifestEntry[] = []
+  const ids = new Set<string>()
+  for (const value of record.fixtures) {
+    const fixture = recordOf(value)
+    const id = fixture?.id
+    const label = fixture?.label
+    const description = fixture?.description
+    const overlays = fixture?.overlays
+    const overlayUrls = Array.isArray(overlays)
+      ? overlays.filter((overlay): overlay is string => typeof overlay === 'string' && overlay.length > 0)
+      : []
+    if (typeof id !== 'string' || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(id)
+      || id === 'none' || id === 'webfs'
+      || typeof label !== 'string' || label.length === 0
+      || typeof description !== 'string' || description.length === 0
+      || !Array.isArray(overlays) || overlays.length === 0 || overlayUrls.length !== overlays.length) {
+      throw new Error('preview fixture manifest contains an invalid fixture entry')
+    }
+    if (ids.has(id)) throw new Error(`preview fixture manifest repeats id "${id}"`)
+    ids.add(id)
+    fixtures.push({ id, label, description, overlays: overlayUrls })
+  }
+  const defaultFixture = record.defaultFixture
+  if (defaultFixture !== null && (typeof defaultFixture !== 'string' || !ids.has(defaultFixture))) {
+    throw new Error('preview fixture manifest defaultFixture does not name a fixture')
+  }
+  return { version: PREVIEW_FIXTURE_MANIFEST_VERSION, defaultFixture, fixtures }
+}

packages/experimental/webworker-runtime/src/image-layout.ts

@@ -9,9 +9,9 @@
 export const DEFAULT_ROOT = '/dsh'
 
 /**
- * Leaf name of the packed image: one gzip member holding the ustar archive. The
- * app build writes it beside the page and the page's boot fetches it from there,
- * so the extension is part of what a deployment serves.
+ * Leaf name of the packed base image: one gzip member holding the ustar archive.
+ * The app build writes it beside the page and the page's boot fetches it from
+ * there, so the extension is part of what a deployment serves.
  */
 export const IMAGE_FILE_NAME = 'vfs-image.tar.gz'
 
@@ -27,6 +27,12 @@ export const IMAGE_HOME_DIRECTORY = 'home'
 /** Working directories the host tree expects to exist, empty. */
 export const IMAGE_EMPTY_DIRECTORIES: readonly string[] = ['home/', 'workspace/', 'tmp/']
 
+/**
+ * Top-level directories an overlay archive may populate. Runtime code,
+ * configuration, and the lowering manifest remain owned by the base image.
+ */
+export const IMAGE_OVERLAY_DIRECTORIES: readonly string[] = ['home', 'workspace']
+
 /**
  * Identity of the lowered code shape, recorded in the image manifest by the
  * packer and required by the worker host: an image lowered by an older transform

packages/experimental/webworker-runtime/src/index.ts

@@ -34,9 +34,13 @@ export {
 } from './worker-host.ts'
 export {
   DEFAULT_ROOT, IMAGE_CONFIG_PATH, IMAGE_EMPTY_DIRECTORIES, IMAGE_FILE_NAME, IMAGE_HOME_DIRECTORY,
-  IMAGE_MANIFEST_PATH, LOWERING_VERSION, WRAPPER_PARAMS,
+  IMAGE_MANIFEST_PATH, IMAGE_OVERLAY_DIRECTORIES, LOWERING_VERSION, WRAPPER_PARAMS,
 } from './image-layout.ts'
-export { loadVfsImage, MemoryVfs } from './storage/memory.ts'
+export {
+  parsePreviewFixtureManifest, PREVIEW_FIXTURE_MANIFEST_FILE, PREVIEW_FIXTURE_MANIFEST_VERSION,
+  type PreviewFixtureManifest, type PreviewFixtureManifestEntry,
+} from './fixture-manifest.ts'
+export { loadVfsImage, loadVfsOverlay, MemoryVfs } from './storage/memory.ts'
 export { inflateImage, inflateImageStream } from './storage/image-gzip.ts'
 export { packTar, parseTar, type TarEntry } from './storage/tar.ts'
 export { requireActiveVfs, setActiveVfs } from './storage/active.ts'

packages/experimental/webworker-runtime/src/module-proxies.ts

@@ -56,7 +56,7 @@ export const MODULE_PROXIES: Record<string, string> = {
   'node:child_process': './node/builtin_modules/implemented/child_process.ts',
   // Structural mocks: every symbol exists, every call throws.
   'node:net': './node/builtin_modules/mock/net.ts',
-  'node:stream': './node/builtin_modules/mock/stream.ts',
+  'node:stream': './node/builtin_modules/implemented/stream.ts',
   'node:vm': './node/builtin_modules/mock/vm.ts',
   'node:worker_threads': './node/builtin_modules/mock/worker_threads.ts',
   'node:sqlite': './node/builtin_modules/mock/sqlite.ts',
@@ -66,10 +66,8 @@ export const MODULE_PROXIES: Record<string, string> = {
   'node-pty': './node/external_packages/node-pty.ts',
   '@vscode/ripgrep': './node/external_packages/ripgrep.ts',
   '@earendil-works/pi-ai': './node/external_packages/pi-ai.ts',
-  '@deepseek-ai/node-addon-landlock-run': './node/external_packages/node-addon-landlock-run.ts',
   // Constructible fakes whose methods are never reached.
   'ws': './node/external_packages/ws.ts',
-  'chokidar': './node/external_packages/chokidar.ts',
 }
 
 

packages/experimental/webworker-runtime/src/module-system/module-loader.ts

@@ -1,8 +1,8 @@
 /**
  * CommonJS module loader over the worker VFS. It fills the `loader.internal`
  * seam Cordis uses for every entry import, and backs the `node:module`
- * `createRequire` proxy that `typert-loader` and `client-modules` resolve
- * package metadata through.
+ * `createRequire` proxy that `typert-loader`, `client-modules`, and the plugin
+ * package inventory resolve package metadata through.
  *
  * Resolution is a narrowed Node `require` algorithm: `exports` walk with a
  * fixed condition order, extension probing, and one cache keyed by resolved
@@ -49,10 +49,26 @@ interface ModuleRecord {
   readonly module: { exports: unknown }
 }
 
+/** Resolution helpers carried by a Worker-backed CommonJS require. */
+export interface WorkerRequireResolve {
+  /**
+   * Resolve one specifier without evaluating its module.
+   * @param specifier - Module request relative to the require base.
+   * @returns Static or VFS-backed module identity.
+   */
+  (specifier: string): string
+  /**
+   * Return the directories this loader's Node-style package discovery searches.
+   * @param specifier - Module request whose lookup roots are requested.
+   * @returns Search roots, or null for a Worker-provided module.
+   */
+  paths(specifier: string): string[] | null
+}
+
 /** The `require` function shape the roster consumes through `createRequire`. */
 export interface WorkerRequire {
   (specifier: string): unknown
-  resolve(specifier: string): string
+  readonly resolve: WorkerRequireResolve
 }
 
 /** Construction inputs for {@link WorkerModuleLoader}. */
@@ -226,6 +242,16 @@ export class WorkerModuleLoader {
     return this.fail(`cannot resolve "${specifier}": no file at ${candidates.join(', ')}`)
   }
 
+  /** @returns The Worker-provided implementation of a static specifier. */
+  private staticModule(specifier: string): StaticModuleFactory | undefined {
+    const exact = this.staticModules.get(specifier)
+    if (exact !== undefined) return exact
+    for (const [prefix, factory] of this.staticPrefixes) {
+      if (specifier.startsWith(prefix)) return factory
+    }
+    return this.staticModules.get(`node:${specifier}`)
+  }
+
   /**
    * Resolve a specifier the way the module that requested it would.
    * @param specifier - Bare name, relative path, absolute path, or file URL.
@@ -233,11 +259,8 @@ export class WorkerModuleLoader {
    * @returns Static module or the resolved VFS path.
    */
   resolve(specifier: string, fromDirectory: string): Resolution {
-    const exact = this.staticModules.get(specifier)
-    if (exact !== undefined) return { kind: 'static', specifier, factory: exact }
-    for (const [prefix, factory] of this.staticPrefixes) {
-      if (specifier.startsWith(prefix)) return { kind: 'static', specifier, factory }
-    }
+    const staticModule = this.staticModule(specifier)
+    if (staticModule !== undefined) return { kind: 'static', specifier, factory: staticModule }
     if (specifier.startsWith('cordis:') || specifier.startsWith('node:')) {
       return this.fail(`no static module is registered for "${specifier}"`)
     }
@@ -250,9 +273,6 @@ export class WorkerModuleLoader {
     if (isAbsolute(specifier)) {
       return { kind: 'file', path: this.probe(specifier, specifier) }
     }
-    // Node resolves `fs` and `node:fs` to the same builtin; the proxy table may register either.
-    const prefixed = this.staticModules.get(`node:${specifier}`)
-    if (prefixed !== undefined) return { kind: 'static', specifier, factory: prefixed }
     const segments = specifier.split('/')
     const packageName = specifier.startsWith('@') ? segments.slice(0, 2).join('/') : segments[0] ?? specifier
     const rest = specifier.slice(packageName.length).replace(/^\//, '')
@@ -356,15 +376,20 @@ export class WorkerModuleLoader {
    * @returns Callable require with `resolve`.
    */
   requireFrom(fromDirectory: string): WorkerRequire {
-    const require = ((specifier: string): unknown => this.load(this.resolve(specifier, fromDirectory))) as WorkerRequire
-    require.resolve = (specifier: string): string => {
+    const require = (specifier: string): unknown => this.load(this.resolve(specifier, fromDirectory))
+    const resolve = ((specifier: string): string => {
       const resolution = this.resolve(specifier, fromDirectory)
       if (resolution.kind === 'static') {
         return this.fail(`"${specifier}" is a worker-provided module and has no VFS path`)
       }
       return resolution.path
+    }) as WorkerRequireResolve
+    resolve.paths = (specifier: string): string[] | null => {
+      if (this.staticModule(specifier) !== undefined || specifier.startsWith('node:')) return null
+      if (specifier.startsWith('.')) return [resolvePath(fromDirectory, '.')]
+      return [join(this.root, 'node_modules')]
     }
-    return require
+    return Object.assign(require, { resolve })
   }
 
   /**

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/abort-error.ts

@@ -0,0 +1,14 @@
+/** Build the Node-style cancellation error shared by abortable builtin APIs. */
+
+/**
+ * Create an `AbortError` carrying Node's stable error code.
+ * @param reason - Optional AbortSignal reason exposed as the error cause.
+ * @returns A Node-compatible abort error.
+ */
+export function abortError(reason?: unknown): Error & { code: string; cause?: unknown } {
+  const error = new Error('The operation was aborted') as Error & { code: string; cause?: unknown }
+  error.name = 'AbortError'
+  error.code = 'ABORT_ERR'
+  if (reason !== undefined) error.cause = reason
+  return error
+}

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/child_process.ts

@@ -5,9 +5,10 @@
  * `spawn` starts the argv as a shell process (`src/shell/process/`) — its own
  * Web Worker, off this thread — and reports it through the `ChildProcess`
  * surface the subprocess service consumes: pipes, `exit`/`close`, pid, and
- * signals, with `SIGKILL` terminating the worker for real. The command table
- * is the only `/bin` that exists, so a name it does not hold fails with
- * `ENOENT`, exactly as a missing binary does on a real host.
+ * signals, with `SIGKILL` terminating the worker for real. Worker-owned
+ * executable wrappers resolve before the shell's command table; anything in
+ * neither set fails with `ENOENT`, exactly as a missing binary does on a real
+ * host.
  *
  * What stays impossible is what needs a real process: synchronous execution
  * (`execSync`, and `spawnSync` for a known program) and `fork`.
@@ -19,7 +20,11 @@ import { EventEmitter } from './events.ts'
 import { notImplementedFail } from '../../notImplementedFail.ts'
 import { registerProcess, releaseProcess, signalProcess } from '../../process-table.ts'
 import { startProcess } from '../../../shell/process/host.ts'
+import { hostFileSystem } from '../../../shell/fs-access.ts'
+import { virtualExecutable } from '../../../shell/process/virtual-executables.ts'
+import type { VirtualExecutableExit } from '../../../shell/process/virtual-executables.ts'
 import { standardPrograms } from '../../../shell/programs/index.ts'
+import type { ShellFileSystem } from '../../../shell/types.ts'
 import { DSH_ROOT } from '../../../storage/paths.ts'
 
 const MODULE = 'node:child_process'
@@ -219,9 +224,6 @@ export function spawn(
   const entry = registerProcess()
   const child = new WorkerChildProcess(entry.pid, stdio)
 
-  const script = shellScriptOf(argv)
-  const known = script !== undefined || standardPrograms().has(program)
-
   const emit = (stream: 'stdout' | 'stderr', text: string): void => {
     if (text === '') return
     const pipe = stream === 'stdout' ? child.stdout : child.stderr
@@ -236,7 +238,10 @@ export function spawn(
     }
   }
 
+  let settled = false
   const settle = (exitCode: number): void => {
+    if (settled) return
+    settled = true
     releaseProcess(entry.pid)
     // A signalled command reports no exit code, which is what makes the
     // subprocess service classify it as killed rather than finished.
@@ -248,31 +253,68 @@ export function spawn(
     child.emit('exit', child.exitCode, signal)
     child.emit('close', child.exitCode, signal)
   }
+  const failSpawn = (error: Error): void => {
+    if (settled) return
+    settled = true
+    releaseProcess(entry.pid)
+    child.emit('error', error)
+  }
 
   // The command starts on a microtask, so a caller that attaches listeners and
   // writes standard input right after `spawn()` — the subprocess service does
   // exactly that — is never racing the first output.
   queueMicrotask(() => {
-    if (!known) {
-      releaseProcess(entry.pid)
-      child.emit('error', spawnEnoent(program))
-      return
-    }
-    entry.process = startProcess({
-      script,
-      argv,
-      cwd: options.cwd ?? DSH_ROOT,
-      env: environmentOf(options.env),
-      stdin: child.stdin?.contents() ?? '',
-      onOutput: emit,
-      onExit: settle,
+    void (async () => {
+      const cwd = options.cwd ?? DSH_ROOT
+      let commandArgv: readonly string[] = argv
+      let filesystem: ShellFileSystem | undefined
+      let missingExecutable: VirtualExecutableExit | undefined
+      const executable = virtualExecutable(program)
+      if (executable !== undefined) {
+        const prepared = await executable.prepare(args, { cwd, filesystem: hostFileSystem() })
+        if (prepared.kind === 'exit') {
+          emit('stdout', prepared.stdout)
+          emit('stderr', prepared.stderr)
+          settle(prepared.exitCode)
+          return
+        }
+        commandArgv = prepared.argv
+        filesystem = prepared.filesystem
+        missingExecutable = prepared.missingExecutable
+      }
+
+      const command = commandArgv[0] as string
+      const script = shellScriptOf(commandArgv)
+      const known = script !== undefined || standardPrograms().has(command)
+      if (!known) {
+        if (missingExecutable !== undefined) {
+          emit('stdout', missingExecutable.stdout)
+          emit('stderr', missingExecutable.stderr)
+          settle(missingExecutable.exitCode)
+        } else {
+          failSpawn(spawnEnoent(program))
+        }
+        return
+      }
+      entry.process = startProcess({
+        script,
+        argv: commandArgv,
+        cwd,
+        env: environmentOf(options.env),
+        stdin: child.stdin?.contents() ?? '',
+        onOutput: emit,
+        onExit: settle,
+        ...filesystem === undefined ? {} : { fs: filesystem },
+      })
+      // A signal that arrived while the process was still starting has to reach
+      // it now; the table recorded it but had nothing to deliver it to.
+      if (entry.signal !== undefined) {
+        if (entry.signal === 'SIGKILL') entry.process.destroy()
+        else entry.process.interrupt()
+      }
+    })().catch((error: unknown) => {
+      failSpawn(error instanceof Error ? error : new Error(String(error)))
     })
-    // A signal that arrived while the process was still starting has to reach
-    // it now; the table recorded it but had nothing to deliver it to.
-    if (entry.signal !== undefined) {
-      if (entry.signal === 'SIGKILL') entry.process.destroy()
-      else entry.process.interrupt()
-    }
   })
 
   return child
@@ -298,10 +340,22 @@ export interface WorkerSpawnSyncResult {
  * answers in the same shape: absent programs report `ENOENT`, and a program
  * this shell *does* have reports that only the asynchronous path can run it.
  * @param program - the program name.
+ * @param args - arguments passed to the virtual launcher probe.
  * @returns the Node-shaped synchronous result carrying the failure.
  */
-export function spawnSync(program: string): WorkerSpawnSyncResult {
+export function spawnSync(program: string, args: readonly string[] = []): WorkerSpawnSyncResult {
   const empty = Buffer.alloc(0)
+  const executable = virtualExecutable(program)
+  if (executable !== undefined) {
+    const result = executable.runSync(args)
+    if (result.kind === 'asynchronous') {
+      const error = new Error(`${MODULE}.spawnSync cannot run ${program} in the worker host: commands run asynchronously`)
+      return { pid: -1, status: null, signal: null, stdout: empty, stderr: empty, output: [null, empty, empty], error }
+    }
+    const stdout = Buffer.from(result.stdout)
+    const stderr = Buffer.from(result.stderr)
+    return { pid: -1, status: result.exitCode, signal: null, stdout, stderr, output: [null, stdout, stderr] }
+  }
   const error = standardPrograms().has(program)
     ? new Error(`${MODULE}.spawnSync cannot run ${program} in the worker host: commands run asynchronously`)
     : spawnEnoent(program)

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/fs-watch.ts

@@ -0,0 +1,428 @@
+/** Node filesystem watching over the active in-memory VFS. */
+import { Buffer } from 'buffer'
+import { EventEmitter } from './events.ts'
+import { captureAsyncContext, runWithAsyncContext } from './async_hooks.ts'
+import { basename, relative, resolve, sep } from './path.ts'
+import { requireActiveVfs } from '../../../storage/active.ts'
+import type { VfsBigIntStats, VfsMutation, VfsStats } from '../../../storage/types.ts'
+import { abortError } from './abort-error.ts'
+
+type PathArg = string | URL | Uint8Array
+type WatchListener = (eventType: 'rename' | 'change', filename: string | Buffer | null) => void
+type WatchStats = VfsStats | VfsBigIntStats
+type StatListener = (current: WatchStats, previous: WatchStats) => void
+
+/** Options shared by the callback and promise watch faces. */
+export interface WatchOptions {
+  persistent?: boolean
+  recursive?: boolean
+  encoding?: BufferEncoding | 'buffer'
+  signal?: AbortSignal
+}
+/** Poll-style watch options. */
+export interface WatchFileOptions {
+  persistent?: boolean
+  interval?: number
+  bigint?: boolean
+}
+
+const asPath = (path: PathArg): string => {
+  if (typeof path === 'string') return resolve(path)
+  if (path instanceof URL) return resolve(decodeURIComponent(path.pathname))
+  return resolve(new TextDecoder().decode(path))
+}
+
+const missingStats = (bigint: boolean): WatchStats => ({
+  size: bigint ? 0n : 0,
+  ino: bigint ? 0n : 0,
+  mtimeMs: bigint ? 0n : 0,
+  ctimeMs: bigint ? 0n : 0,
+  atimeMs: bigint ? 0n : 0,
+  birthtimeMs: bigint ? 0n : 0,
+  mtime: new Date(0),
+  mode: bigint ? 0n : 0,
+  ...bigint ? {
+    dev: 0n,
+    nlink: 0n,
+    mtimeNs: 0n,
+    ctimeNs: 0n,
+    atimeNs: 0n,
+    birthtimeNs: 0n,
+    ctime: new Date(0),
+    atime: new Date(0),
+    birthtime: new Date(0),
+  } : {},
+  isFile: () => false,
+  isDirectory: () => false,
+  isSymbolicLink: () => false,
+  isFIFO: () => false,
+  isSocket: () => false,
+  isBlockDevice: () => false,
+  isCharacterDevice: () => false,
+}) as WatchStats
+
+const statOrMissing = (path: string, bigint: boolean): WatchStats => {
+  try {
+    return requireActiveVfs().statSync(path, { bigint })
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return missingStats(bigint)
+    throw error
+  }
+}
+
+const statsChanged = (left: WatchStats, right: WatchStats): boolean =>
+  left.size !== right.size
+  || left.mtimeMs !== right.mtimeMs
+  || left.mode !== right.mode
+  || left.ino !== right.ino
+  || left.isFile() !== right.isFile()
+  || left.isDirectory() !== right.isDirectory()
+
+const contains = (parent: string, child: string): boolean =>
+  parent === '/' || child === parent || child.startsWith(`${parent}${sep}`)
+
+const overlaps = (left: string, right: string): boolean => contains(left, right) || contains(right, left)
+
+/** `fs.FSWatcher` over VFS mutations. */
+export class FSWatcher extends EventEmitter {
+  private readonly disposeMutation: () => void
+  private readonly signal: AbortSignal | undefined
+  private readonly onAbort: (() => void) | undefined
+  private closed = false
+  private referenced: boolean
+
+  constructor(
+    private readonly target: string,
+    private readonly directory: boolean,
+    private readonly options: WatchOptions,
+    listener?: WatchListener,
+  ) {
+    super()
+    this.referenced = options.persistent ?? true
+    const context = captureAsyncContext()
+    if (listener !== undefined) this.on('change', listener as (...args: unknown[]) => void)
+    this.disposeMutation = requireActiveVfs().subscribe((mutation) => {
+      if (!this.matches(mutation)) return
+      const eventType = mutation.kind === 'write' && !mutation.entryChanged || mutation.kind === 'chmod'
+        ? 'change'
+        : 'rename'
+      const filename = this.filename(mutation.path)
+      queueMicrotask(() => {
+        if (this.closed) return
+        runWithAsyncContext(context, () => { this.emit('change', eventType, filename) })
+      })
+    })
+    this.signal = options.signal
+    this.onAbort = options.signal === undefined ? undefined : () => { this.close() }
+    if (options.signal?.aborted === true) {
+      this.close()
+      return
+    }
+    options.signal?.addEventListener('abort', this.onAbort as () => void, { once: true })
+  }
+
+  private matches(mutation: VfsMutation): boolean {
+    if (mutation.path === this.target) return true
+    if (mutation.kind === 'remove' && contains(mutation.path, this.target)) return true
+    if (!this.directory || !contains(this.target, mutation.path)) return false
+    if (this.options.recursive === true) return true
+    const child = relative(this.target, mutation.path)
+    return child !== '' && !child.startsWith('..') && !child.includes(sep)
+  }
+
+  private filename(path: string): string | Buffer {
+    const relativePath = relative(this.target, path)
+    const value = this.directory && contains(this.target, path)
+      ? this.options.recursive === true ? relativePath : relativePath.split(sep)[0] ?? ''
+      : basename(this.target)
+    return this.options.encoding === 'buffer' ? Buffer.from(value) : value
+  }
+
+  /** Stop observing and publish `close` once. */
+  close(): void {
+    if (this.closed) return
+    this.closed = true
+    this.disposeMutation()
+    if (this.onAbort !== undefined) this.signal?.removeEventListener('abort', this.onAbort)
+    queueMicrotask(() => { this.emit('close') })
+  }
+
+  /**
+   * Mark this watcher as process-liveness-bearing.
+   * @returns This watcher.
+   */
+  ref(): this {
+    this.referenced = true
+    return this
+  }
+
+  /**
+   * Clear the process-liveness flag; dedicated Workers have no ref-counted event loop.
+   * @returns This watcher.
+   */
+  unref(): this {
+    this.referenced = false
+    return this
+  }
+
+  /**
+   * Read the retained process-liveness flag.
+   * @returns Whether this watcher is marked as keeping its owner alive.
+   */
+  hasRef(): boolean {
+    return this.referenced
+  }
+}
+
+/**
+ * Watch one path through the active VFS.
+ * @param path - File or directory path.
+ * @param optionsOrListener - Watch options, encoding, or the change listener.
+ * @param maybeListener - Change listener when the second argument carries options.
+ * @returns The closeable watcher.
+ */
+export function watch(
+  path: PathArg,
+  optionsOrListener?: WatchOptions | BufferEncoding | 'buffer' | WatchListener,
+  maybeListener?: WatchListener,
+): FSWatcher {
+  const options: WatchOptions = typeof optionsOrListener === 'object'
+    ? optionsOrListener
+    : typeof optionsOrListener === 'string' ? { encoding: optionsOrListener } : {}
+  const listener = typeof optionsOrListener === 'function' ? optionsOrListener : maybeListener
+  const target = asPath(path)
+  const stats = requireActiveVfs().statSync(target)
+  return new FSWatcher(target, stats.isDirectory(), options, listener)
+}
+
+/** `fs.StatWatcher` returned from `watchFile`. */
+export class StatWatcher extends EventEmitter {
+  private readonly disposeMutation: () => void
+  private timer: ReturnType<typeof setTimeout> | undefined
+  private previous: WatchStats
+  private stopped = false
+  private referenced: boolean
+  private readonly context: ReturnType<typeof captureAsyncContext>
+  private readonly interval: number
+  private readonly bigint: boolean
+
+  constructor(readonly path: string, options: WatchFileOptions) {
+    super()
+    this.referenced = options.persistent ?? true
+    this.interval = options.interval ?? 5007
+    this.bigint = options.bigint ?? false
+    this.previous = statOrMissing(path, this.bigint)
+    this.context = captureAsyncContext()
+    this.disposeMutation = requireActiveVfs().subscribe((mutation) => {
+      if (overlaps(path, mutation.path)) this.schedule()
+    })
+    if (!this.previous.isFile() && !this.previous.isDirectory()) this.schedule(true)
+  }
+
+  private schedule(initialMissing = false): void {
+    if (this.stopped || this.timer !== undefined) return
+    this.timer = setTimeout(() => {
+      this.timer = undefined
+      if (this.stopped) return
+      const current = statOrMissing(this.path, this.bigint)
+      const previous = this.previous
+      this.previous = current
+      if (initialMissing || statsChanged(current, previous)) {
+        runWithAsyncContext(this.context, () => { this.emit('change', current, previous) })
+      }
+    }, this.interval)
+    if (!this.referenced) timerUnref(this.timer)
+  }
+
+  /** Stop polling and release the VFS subscription. */
+  stop(): void {
+    if (this.stopped) return
+    this.stopped = true
+    this.disposeMutation()
+    if (this.timer !== undefined) clearTimeout(this.timer)
+    this.timer = undefined
+    this.emit('stop')
+  }
+
+  /** Alias used by callers treating the watcher as a closeable handle. */
+  close(): void {
+    this.stop()
+  }
+
+  /**
+   * Mark this watcher as process-liveness-bearing.
+   * @returns This watcher.
+   */
+  ref(): this {
+    this.referenced = true
+    if (this.timer !== undefined) timerRef(this.timer)
+    return this
+  }
+
+  /**
+   * Mark this watcher as not keeping its owner alive.
+   * @returns This watcher.
+   */
+  unref(): this {
+    this.referenced = false
+    if (this.timer !== undefined) timerUnref(this.timer)
+    return this
+  }
+
+  /**
+   * Read the retained process-liveness flag.
+   * @returns Whether this watcher is marked as keeping its owner alive.
+   */
+  hasRef(): boolean {
+    return this.referenced
+  }
+
+}
+
+type RefTimer = { ref?: () => unknown; unref?: () => unknown }
+
+/** Browser timers are numeric; Node timers expose optional liveness methods. */
+const timerRef = (timer: ReturnType<typeof setTimeout>): void => {
+  ;(timer as unknown as RefTimer).ref?.()
+}
+
+/** Browser timers are numeric; Node timers expose optional liveness methods. */
+const timerUnref = (timer: ReturnType<typeof setTimeout>): void => {
+  ;(timer as unknown as RefTimer).unref?.()
+}
+
+const statWatchers = new Map<string, StatWatcher>()
+
+/**
+ * Register a stat-poll watcher for one path.
+ * @param path - File or directory path, including a currently missing path.
+ * @param optionsOrListener - Polling options or the change listener.
+ * @param maybeListener - Change listener when the second argument carries options.
+ * @returns The path's shared stat watcher.
+ */
+export function watchFile(
+  path: PathArg,
+  optionsOrListener: WatchFileOptions | StatListener,
+  maybeListener?: StatListener,
+): StatWatcher {
+  const options = typeof optionsOrListener === 'function' ? {} : optionsOrListener
+  const listener = typeof optionsOrListener === 'function' ? optionsOrListener : maybeListener
+  if (listener === undefined) throw new TypeError('The "listener" argument must be of type function')
+  const target = asPath(path)
+  let watcher = statWatchers.get(target)
+  if (watcher === undefined) {
+    watcher = new StatWatcher(target, options)
+    statWatchers.set(target, watcher)
+    watcher.once('stop', () => { statWatchers.delete(target) })
+  }
+  watcher.on('change', listener as (...args: unknown[]) => void)
+  return watcher
+}
+
+/**
+ * Remove one listener or every listener for a path.
+ * @param path - Watched path.
+ * @param listener - Specific registration to remove; omission removes all registrations.
+ */
+export function unwatchFile(path: PathArg, listener?: StatListener): void {
+  const target = asPath(path)
+  const watcher = statWatchers.get(target)
+  if (watcher === undefined) return
+  if (listener === undefined) watcher.removeAllListeners('change')
+  else watcher.removeListener('change', listener as (...args: unknown[]) => void)
+  if (watcher.listenerCount('change') === 0) watcher.stop()
+}
+
+/**
+ * Create the promise-based watch iterator over the callback watcher.
+ * @param path - File or directory path.
+ * @param options - Watch options and cancellation signal.
+ * @returns An iterator of change records that closes its watcher on return or failure.
+ */
+export function watchAsync(
+  path: PathArg,
+  options: WatchOptions = {},
+): AsyncIterableIterator<{ eventType: 'rename' | 'change'; filename: string | Buffer | null }> {
+  type WatchEvent = { eventType: 'rename' | 'change'; filename: string | Buffer | null }
+  type Waiting = {
+    resolve(result: IteratorResult<WatchEvent>): void
+    reject(reason: unknown): void
+  }
+  const queued: WatchEvent[] = []
+  const waiting: Waiting[] = []
+  let watcher: FSWatcher | undefined
+  let failure: Error | undefined
+  let closed = false
+
+  const stopWatcher = (): void => {
+    options.signal?.removeEventListener('abort', onAbort)
+    watcher?.close()
+  }
+  const settleFailure = (reason: unknown): void => {
+    if (closed) return
+    const error = reason instanceof Error ? reason : new Error(String(reason))
+    closed = true
+    queued.length = 0
+    stopWatcher()
+    const failed = waiting.shift()
+    if (failed === undefined) failure = error
+    else failed.reject(error)
+    for (const pending of waiting.splice(0)) pending.resolve({ done: true, value: undefined })
+  }
+  const onAbort = (): void => { settleFailure(abortError(options.signal?.reason)) }
+  const start = (): void => {
+    if (watcher !== undefined || closed || failure !== undefined) return
+    if (options.signal?.aborted === true) {
+      settleFailure(abortError(options.signal.reason))
+      return
+    }
+    try {
+      watcher = watch(path, options, (eventType, filename) => {
+        const event = { eventType, filename }
+        const pending = waiting.shift()
+        if (pending === undefined) queued.push(event)
+        else pending.resolve({ done: false, value: event })
+      })
+      watcher.on('error', settleFailure)
+      options.signal?.addEventListener('abort', onAbort, { once: true })
+    } catch (error) {
+      settleFailure(error)
+    }
+  }
+  const close = (): void => {
+    const alreadyClosed = closed
+    closed = true
+    queued.length = 0
+    failure = undefined
+    if (!alreadyClosed) stopWatcher()
+    for (const pending of waiting.splice(0)) pending.resolve({ done: true, value: undefined })
+  }
+
+  return {
+    [Symbol.asyncIterator]() {
+      return this
+    },
+    next(): Promise<IteratorResult<WatchEvent>> {
+      start()
+      if (failure !== undefined) {
+        const reason = failure
+        failure = undefined
+        return Promise.reject(reason)
+      }
+      const event = queued.shift()
+      if (event !== undefined) return Promise.resolve({ done: false, value: event })
+      if (closed) return Promise.resolve({ done: true, value: undefined })
+      return new Promise<IteratorResult<WatchEvent>>((resolve, reject) => { waiting.push({ resolve, reject }) })
+    },
+    return(): Promise<IteratorResult<WatchEvent>> {
+      close()
+      return Promise.resolve({ done: true, value: undefined })
+    },
+    throw(reason?: unknown): Promise<IteratorResult<WatchEvent>> {
+      close()
+      // AsyncIterator.throw forwards the caller's exact reason, including non-Error values.
+      // oxlint-disable-next-line typescript/prefer-promise-reject-errors
+      return Promise.reject(reason)
+    },
+  }
+}

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/fs.ts

@@ -2,19 +2,23 @@
  * `node:fs` bridge over the worker's in-memory VFS. `MemoryVfs` owns paths,
  * bytes, the directory tree, and Node's error codes; this module adds only what
  * is Node-API-shaped and not VFS business: Buffer results, `Dirent` objects,
- * file descriptors, `mkdtemp`, access checks, inert watches, and the promise face.
+ * file descriptors, `mkdtemp`, access checks, watchers, streams, and the promise face.
  */
 import { requireActiveVfs } from '../../../storage/active.ts'
-import type { MemoryVfs } from '../../../storage/memory.ts'
-import type { VfsBigIntStats, VfsStatOptions, VfsStats, VfsWriteOptions } from '../../../storage/types.ts'
+import type {
+  Vfs, VfsBigIntStats, VfsOpenFile, VfsStatOptions, VfsStats, VfsWriteOptions,
+} from '../../../storage/types.ts'
 import { Buffer } from 'buffer'
+import { Readable, Writable } from './stream.ts'
 import { dirname } from './path.ts'
+import { abortError } from './abort-error.ts'
+import {
+  FSWatcher, StatWatcher, unwatchFile, watch, watchAsync, watchFile,
+} from './fs-watch.ts'
 
-const vfs = (): MemoryVfs => requireActiveVfs()
+const vfs = (): Vfs => requireActiveVfs()
 
-const notImplemented = (method: string, subject: string): never => {
-  throw new Error(`web-preview: node:fs.${method} is not implemented in the worker host (${subject})`)
-}
+export { FSWatcher, StatWatcher, unwatchFile, watch, watchFile }
 
 type PathArg = string | URL | Uint8Array
 
@@ -150,6 +154,32 @@ export function statSync(path: PathArg, options?: VfsStatOptions): VfsStats | Vf
   return vfs().statSync(asPath(path), options)
 }
 
+/**
+ * Read stats through Node's callback form.
+ * @param path - Path to stat.
+ * @param optionsOrCallback - Stat options or the completion callback.
+ * @param maybeCallback - Completion callback when options are present.
+ */
+export function stat(
+  path: PathArg,
+  optionsOrCallback: VfsStatOptions | ((error: NodeJS.ErrnoException | null, stats?: VfsStats | VfsBigIntStats) => void),
+  maybeCallback?: (error: NodeJS.ErrnoException | null, stats?: VfsStats | VfsBigIntStats) => void,
+): void {
+  const options = typeof optionsOrCallback === 'function' ? undefined : optionsOrCallback
+  const callback = typeof optionsOrCallback === 'function' ? optionsOrCallback : maybeCallback
+  if (callback === undefined) throw new TypeError('The "callback" argument must be of type function')
+  queueMicrotask(() => {
+    let result: VfsStats | VfsBigIntStats
+    try {
+      result = statSync(path, options)
+    } catch (error) {
+      callback(error as NodeJS.ErrnoException)
+      return
+    }
+    callback(null, result)
+  })
+}
+
 /**
  * Change an entry's permission bits; stat reads back exactly what was set.
  * @param path - the path.
@@ -169,6 +199,20 @@ export function lstatSync(path: PathArg, options?: VfsStatOptions): VfsStats | V
   return statSync(path, options)
 }
 
+/**
+ * Read link stats through Node's callback form; this symlink-free VFS delegates to stat.
+ * @param path - Path to stat.
+ * @param optionsOrCallback - Stat options or the completion callback.
+ * @param maybeCallback - Completion callback when options are present.
+ */
+export function lstat(
+  path: PathArg,
+  optionsOrCallback: VfsStatOptions | ((error: NodeJS.ErrnoException | null, stats?: VfsStats | VfsBigIntStats) => void),
+  maybeCallback?: (error: NodeJS.ErrnoException | null, stats?: VfsStats | VfsBigIntStats) => void,
+): void {
+  stat(path, optionsOrCallback, maybeCallback)
+}
+
 /**
  * Canonical path (normalization only: the image is symlink-free).
  * @param path - the path.
@@ -252,9 +296,8 @@ export function accessSync(path: PathArg): void {
 }
 
 interface OpenFile {
-  path: string
+  file: VfsOpenFile
   position: number
-  append: boolean
 }
 
 const openFiles = new Map<number, OpenFile>()
@@ -265,27 +308,27 @@ let nextFd = 3
  * @param path - file path.
  * @param flags - Node flag string: 'r', 'w', 'a', with optional '+' and the
  * exclusive 'x' (create-only) modifier.
+ * @param mode - creation permission bits.
  * @returns the descriptor.
  */
-export function openSync(path: PathArg, flags = 'r'): number {
+export function openSync(path: PathArg, flags = 'r', mode?: number): number {
   const target = asPath(path)
-  const exists = vfs().existsSync(target)
-  if (flags.includes('x') && exists) {
-    const error = new Error(`EEXIST: file already exists, open '${target}'`) as Error & { code: string; path: string }
-    error.code = 'EEXIST'
-    error.path = target
-    throw error
-  }
-  if (flags.startsWith('r')) vfs().realpathSync(target)
-  else if (flags.startsWith('w') || !exists) vfs().writeFileSync(target, new Uint8Array(0))
+  const file = vfs().openFileSync(target, flags, mode)
   const fd = nextFd++
-  openFiles.set(fd, { path: target, position: 0, append: flags.startsWith('a') })
+  openFiles.set(fd, { file, position: 0 })
   return fd
 }
 
+const badFileDescriptor = (syscall: string): never => {
+  const error = new Error(`EBADF: bad file descriptor, ${syscall}`) as Error & { code: string; syscall: string }
+  error.code = 'EBADF'
+  error.syscall = syscall
+  throw error
+}
+
 const fileOf = (fd: number, syscall: string): OpenFile => {
   const file = openFiles.get(fd)
-  if (file === undefined) throw new Error(`EBADF: bad file descriptor, ${syscall}`)
+  if (file === undefined) return badFileDescriptor(syscall)
   return file
 }
 
@@ -306,9 +349,8 @@ export function readSync(
   position: number | null = null,
 ): number {
   const file = fileOf(fd, 'read')
-  const bytes = bytesOf(file.path)
   const from = position ?? file.position
-  const slice = bytes.subarray(from, from + length)
+  const slice = file.file.read(from, length)
   buffer.set(slice, offset)
   if (position === null) file.position = from + slice.byteLength
   return slice.byteLength
@@ -323,17 +365,10 @@ export function readSync(
 export function writeSync(fd: number, data: string | Uint8Array): number {
   const file = fileOf(fd, 'write')
   const bytes = typeof data === 'string' ? new TextEncoder().encode(data) : data
-  if (file.append) {
-    vfs().appendFileSync(file.path, bytes)
-    return bytes.byteLength
-  }
-  const existing = vfs().existsSync(file.path) ? bytesOf(file.path) : new Uint8Array(0)
-  const merged = new Uint8Array(Math.max(existing.byteLength, file.position + bytes.byteLength))
-  merged.set(existing, 0)
-  merged.set(bytes, file.position)
-  vfs().writeFileSync(file.path, merged)
-  file.position += bytes.byteLength
-  return bytes.byteLength
+  const position = file.file.append ? file.file.stat().size : file.position
+  const bytesWritten = file.file.write(position, bytes)
+  file.position = position + bytesWritten
+  return bytesWritten
 }
 
 /**
@@ -341,23 +376,22 @@ export function writeSync(fd: number, data: string | Uint8Array): number {
  * @param fd - descriptor.
  */
 export function closeSync(fd: number): void {
-  openFiles.delete(fd)
+  if (!openFiles.delete(fd)) fileOf(fd, 'close')
 }
 
 /**
- * Create a second name for one file's contents. Hard links do not exist in the
- * VFS, so the bytes are copied.
+ * Create a second name for one file identity.
  * @param from - existing path.
  * @param to - new path.
  */
 export function linkSync(from: PathArg, to: PathArg): void {
-  writeFileSync(to, bytesOf(asPath(from)))
+  vfs().linkSync(asPath(from), asPath(to))
 }
 
 /**
  * Open file handle (`fs.FileHandle` subset): the atomic-write and durability
- * pair the storage backends use. `sync`/`datasync` are no-ops — an in-memory
- * filesystem has nothing to flush, and a worker reload loses it either way.
+ * pair the storage backends use. `sync`/`datasync` settle the active VFS's
+ * optional write-behind sink.
  */
 export interface FileHandle {
   readonly fd: number
@@ -377,82 +411,310 @@ export interface FileHandle {
  * helpers do before an fsync.
  * @param path - file or directory path.
  * @param flags - Node flag string.
+ * @param mode - creation permission bits.
  * @returns the handle.
  */
-export function openHandleSync(path: PathArg, flags = 'r'): FileHandle {
+export function openHandleSync(path: PathArg, flags = 'r', mode?: number): FileHandle {
   const target = asPath(path)
   const directory = vfs().existsSync(target) && vfs().statSync(target).isDirectory()
-  const append = flags.startsWith('a')
-  const fd = directory ? -1 : openSync(target, flags)
+  const fd = directory ? -1 : openSync(target, flags, mode)
+  let closed = false
+  const descriptor = (syscall: string): OpenFile => fileOf(fd, syscall)
   return {
     fd,
-    readFile: async (options?: EncodingOption) => readFileSync(target, options),
-    // Node appends when the handle was opened with 'a'. The JSONL session log
-    // depends on it — `open(path, 'a')` then `writeFile(batch)` — and replacing
-    // the file there destroys the header frame its reader requires.
+    readFile: async (options?: EncodingOption) => {
+      if (directory) return readFileSync(target, options)
+      const open = descriptor('read')
+      const bytes = open.file.read(open.position, Math.max(0, open.file.stat().size - open.position))
+      open.position += bytes.length
+      const encoding = encodingOf(options)
+      return encoding === undefined || encoding === 'utf8' || encoding === 'utf-8'
+        ? (encoding === undefined ? asBuffer(bytes) : new TextDecoder().decode(bytes))
+        : asBuffer(bytes).toString(encoding)
+    },
     writeFile: async (data: string | Uint8Array) => {
-      if (append) appendFileSync(target, data)
-      else writeFileSync(target, data)
+      if (directory) writeFileSync(target, data)
+      else writeSync(fd, data)
     },
     write: async (data: string | Uint8Array) => ({ bytesWritten: writeSync(fd, data) }),
     read: async (buffer: Uint8Array, offset = 0, length = buffer.byteLength, position: number | null = null) => ({
       bytesRead: readSync(fd, buffer, offset, length, position),
       buffer,
     }),
-    stat: async () => statSync(target) as VfsStats,
+    stat: async () => directory ? statSync(target) as VfsStats : descriptor('fstat').file.stat(),
     truncate: async (length = 0) => {
-      writeFileSync(target, bytesOf(target).subarray(0, length))
+      if (directory) writeFileSync(target, new Uint8Array(length))
+      else descriptor('ftruncate').file.truncate(length)
     },
-    sync: async () => { /* memory-backed: nothing to flush */ },
-    datasync: async () => { /* memory-backed: nothing to flush */ },
+    sync: async () => { await vfs().flush() },
+    datasync: async () => { await vfs().flush() },
     close: async () => {
+      if (closed) return
+      closed = true
       if (fd !== -1) closeSync(fd)
     },
   }
 }
 
-/**
- * Watch registration refuses loudly, and NOT because watching is hard.
- *
- * An inert watcher would not serve this caller. `skill-filesystem` does not
- * merely register a listener — `openStableWatcher` opens a watcher and then
- * loops until two consecutive mode probes agree, so a watcher that reports
- * success and never fires leaves `observeRoots()` awaiting forever: the skill
- * catalog RPC never answers and the worker's single thread stops serving `/api`
- * for the rest of the session. A refusal instead fails that path fast, which the
- * provider already handles by returning an incomplete observation.
- *
- * So the family split is about what the CALLER does with the capability, not
- * about the capability: a listener registration tolerates absence, a watcher
- * whose progress is awaited does not.
- * @param path - the path a caller wanted watched, named in the refusal.
- * @returns Never — it throws naming the unavailable member.
- */
-export function watchFile(path: PathArg): never {
-  return notImplemented('watchFile', asPath(path))
+/** Options supported by the VFS-backed read stream. */
+export interface ReadStreamOptions {
+  flags?: string
+  encoding?: BufferEncoding | null
+  autoClose?: boolean
+  emitClose?: boolean
+  start?: number
+  end?: number
+  highWaterMark?: number
+  signal?: AbortSignal
+}
+
+/** Options supported by the VFS-backed write stream. */
+export interface WriteStreamOptions {
+  flags?: string
+  encoding?: BufferEncoding | null
+  mode?: number
+  autoClose?: boolean
+  emitClose?: boolean
+  start?: number
+  highWaterMark?: number
+  signal?: AbortSignal
+}
+
+/** Node implements file-stream `autoClose` through the stream's `autoDestroy` state. */
+const streamAutoDestroy = (autoClose: boolean | undefined): boolean => autoClose ?? true
+
+interface FileStreamState {
+  fd: number | null
+  pending: boolean
+}
+
+/** Release the descriptor and abort listener shared by both file-stream directions. */
+function destroyFileStream(
+  stream: FileStreamState,
+  signal: AbortSignal | undefined,
+  onAbort: (() => void) | undefined,
+  error: Error | null,
+  callback: (error: Error | null) => void,
+): void {
+  signal?.removeEventListener('abort', onAbort as () => void)
+  if (stream.fd !== null) closeSync(stream.fd)
+  stream.fd = null
+  stream.pending = false
+  callback(error)
+}
+
+interface ClosableFileStream {
+  once(event: string, listener: () => void): unknown
+  destroy(): unknown
+}
+
+/** Register an optional completion callback and explicitly destroy a file stream. */
+function closeFileStream(
+  stream: ClosableFileStream,
+  callback?: (error?: NodeJS.ErrnoException | null) => void,
+): void {
+  if (callback !== undefined) stream.once('close', () => { callback(null) })
+  stream.destroy()
+}
+
+/** Read stream over one VFS file. */
+export class ReadStream extends Readable {
+  /** Resolved path opened by this stream. */
+  readonly path: string
+  /** Open descriptor, or null before open and after close. */
+  fd: number | null = null
+  /** Whether the descriptor is still waiting to open. */
+  pending = true
+  /** Bytes delivered by this stream. */
+  bytesRead = 0
+  private readonly start: number
+  private readonly end: number
+  private readonly flags: string
+  private readonly signal: AbortSignal | undefined
+  private readonly onAbort: (() => void) | undefined
+  private position: number
+
+  constructor(path: PathArg, options: ReadStreamOptions = {}) {
+    super({
+      autoDestroy: streamAutoDestroy(options.autoClose),
+      emitClose: options.emitClose ?? true,
+      highWaterMark: options.highWaterMark ?? 64 * 1024,
+    })
+    this.path = asPath(path)
+    this.start = options.start ?? 0
+    this.end = options.end ?? Number.POSITIVE_INFINITY
+    this.flags = options.flags ?? 'r'
+    this.position = this.start
+    this.signal = options.signal
+    this.onAbort = options.signal === undefined ? undefined : () => { this.destroy(abortError(options.signal?.reason)) }
+    if (options.encoding !== undefined && options.encoding !== null) this.setEncoding(options.encoding)
+    options.signal?.addEventListener('abort', this.onAbort as () => void, { once: true })
+  }
+
+  override _construct(callback: (error?: Error | null) => void): void {
+    if (this.start < 0 || this.end < this.start) {
+      callback(new RangeError('The value of "start" is out of range'))
+      return
+    }
+    if (this.signal?.aborted === true) {
+      callback(abortError(this.signal.reason))
+      return
+    }
+    let fd: number
+    try {
+      fd = openSync(this.path, this.flags)
+    } catch (error) {
+      callback(error as Error)
+      return
+    }
+    this.fd = fd
+    this.pending = false
+    callback()
+    this.emit('open', fd)
+    this.emit('ready')
+  }
+
+  override _read(size: number): void {
+    if (this.fd === null) return
+    const remaining = this.end === Number.POSITIVE_INFINITY ? size : Math.min(size, this.end - this.position + 1)
+    if (remaining <= 0) {
+      this.push(null)
+      return
+    }
+    const buffer = Buffer.allocUnsafe(remaining)
+    let count: number
+    try {
+      count = readSync(this.fd, buffer, 0, remaining, this.position)
+    } catch (error) {
+      this.destroy(error as Error)
+      return
+    }
+    if (count === 0) {
+      this.push(null)
+      return
+    }
+    this.position += count
+    this.bytesRead += count
+    this.push(buffer.subarray(0, count))
+  }
+
+  override _destroy(error: Error | null, callback: (error?: Error | null) => void): void {
+    destroyFileStream(this, this.signal, this.onAbort, error, callback)
+  }
+
+  /**
+   * Close the stream and release its descriptor.
+   * @param callback - Optional completion callback after `close`.
+   */
+  close(callback?: (error?: NodeJS.ErrnoException | null) => void): void {
+    closeFileStream(this, callback)
+  }
 }
 
-/** Watch removal; teardown paths call it unconditionally, and nothing was watched. */
-export function unwatchFile(): void {
-  // No watch was ever established.
+/** Writable stream committing chunks through the VFS file-descriptor face. */
+export class WriteStream extends Writable {
+  /** Resolved path opened by this stream. */
+  readonly path: string
+  /** Open descriptor, or null before open and after close. */
+  fd: number | null = null
+  /** Whether the descriptor is still waiting to open. */
+  pending = true
+  /** Bytes committed by this stream. */
+  bytesWritten = 0
+  private readonly flags: string
+  private readonly mode: number | undefined
+  private readonly start: number | undefined
+  private readonly signal: AbortSignal | undefined
+  private readonly onAbort: (() => void) | undefined
+
+  constructor(path: PathArg, options: WriteStreamOptions = {}) {
+    super({
+      autoDestroy: streamAutoDestroy(options.autoClose),
+      decodeStrings: true,
+      defaultEncoding: options.encoding ?? 'utf8',
+      emitClose: options.emitClose ?? true,
+      highWaterMark: options.highWaterMark ?? 64 * 1024,
+    })
+    this.path = asPath(path)
+    this.flags = options.flags ?? 'w'
+    this.mode = options.mode
+    this.start = options.start
+    this.signal = options.signal
+    this.onAbort = options.signal === undefined ? undefined : () => { this.destroy(abortError(options.signal?.reason)) }
+    options.signal?.addEventListener('abort', this.onAbort as () => void, { once: true })
+  }
+
+  override _construct(callback: (error?: Error | null) => void): void {
+    if (this.start !== undefined && this.start < 0) {
+      callback(new RangeError('The value of "start" is out of range'))
+      return
+    }
+    if (this.signal?.aborted === true) {
+      callback(abortError(this.signal.reason))
+      return
+    }
+    let fd: number
+    try {
+      fd = openSync(this.path, this.flags, this.mode)
+    } catch (error) {
+      callback(error as Error)
+      return
+    }
+    this.fd = fd
+    if (this.start !== undefined) fileOf(fd, 'write').position = this.start
+    this.pending = false
+    callback()
+    this.emit('open', fd)
+    this.emit('ready')
+  }
+
+  override _write(
+    chunk: string | Uint8Array,
+    encoding: BufferEncoding,
+    callback: (error?: Error | null) => void,
+  ): void {
+    try {
+      const fd = this.fd
+      if (fd === null) return badFileDescriptor('write')
+      const data = typeof chunk === 'string' ? Buffer.from(chunk, encoding) : chunk
+      this.bytesWritten += writeSync(fd, data)
+      callback()
+    } catch (error) {
+      callback(error as Error)
+    }
+  }
+
+  override _destroy(error: Error | null, callback: (error: Error | null) => void): void {
+    destroyFileStream(this, this.signal, this.onAbort, error, callback)
+  }
+
+  /**
+   * Close the stream and release its descriptor.
+   * @param callback - Optional completion callback after `close`.
+   */
+  close(callback?: (error?: NodeJS.ErrnoException | null) => void): void {
+    closeFileStream(this, callback)
+  }
 }
 
 /**
- * Streaming read is unavailable: node:stream has no implementation here.
- * @param path - the path a caller wanted streamed, named in the refusal.
- * @returns Never — it throws naming the unavailable member.
+ * Create a Node-compatible readable file stream over the VFS.
+ * @param path - File path.
+ * @param options - Encoding, range, open, buffer, and abort options.
+ * @returns The readable file stream.
  */
-export function createReadStream(path: PathArg): never {
-  return notImplemented('createReadStream', asPath(path))
+export function createReadStream(path: PathArg, options?: ReadStreamOptions | BufferEncoding): ReadStream {
+  return new ReadStream(path, typeof options === 'string' ? { encoding: options } : options)
 }
 
 /**
- * Streaming write counterpart of {@link createReadStream}.
- * @param path - the path a caller wanted streamed, named in the refusal.
- * @returns Never — it throws naming the unavailable member.
+ * Create a Node-compatible writable file stream over the VFS.
+ * @param path - File path.
+ * @param options - Encoding, open, buffer, and abort options.
+ * @returns The writable file stream.
  */
-export function createWriteStream(path: PathArg): never {
-  return notImplemented('createWriteStream', asPath(path))
+export function createWriteStream(path: PathArg, options?: WriteStreamOptions | BufferEncoding): WriteStream {
+  return new WriteStream(path, typeof options === 'string' ? { encoding: options } : options)
 }
 
 /** Open directory handle (`fs.Dir` subset): iteration plus the close pair. */
@@ -535,14 +797,14 @@ export const promises = {
     mkdirSync(dirname(target), { recursive: true })
     writeFileSync(target, bytesOf(source))
   },
-  // The VFS has no inodes, so a hard link is a byte copy: the caller's contract
-  // is only that both names read the same content until one is removed.
+  // The VFS keeps both names attached to one file identity until either name is removed.
   link: async (from: PathArg, to: PathArg): Promise<void> => { linkSync(from, to) },
-  open: async (path: PathArg, flags?: string): Promise<FileHandle> => openHandleSync(path, flags),
+  open: async (path: PathArg, flags?: string, mode?: number): Promise<FileHandle> => openHandleSync(path, flags, mode),
   opendir: async (path: PathArg): Promise<Dir> => opendirSync(path),
   truncate: async (path: PathArg, length = 0): Promise<void> => {
-    writeFileSync(path, bytesOf(asPath(path)).subarray(0, length))
+    vfs().truncateSync(asPath(path), length)
   },
+  watch: watchAsync,
   constants,
 } satisfies Partial<Record<keyof typeof import('node:fs/promises'), unknown>>
 
@@ -559,10 +821,11 @@ export const __esModule = true
  * the subsets the host tree reads.
  */
 type OwnSignature =
-  | 'constants' | 'promises' | 'Dirent'
+  | 'constants' | 'promises' | 'Dirent' | 'FSWatcher' | 'StatWatcher' | 'ReadStream' | 'WriteStream'
   | 'readFileSync' | 'writeFileSync' | 'appendFileSync' | 'statSync' | 'lstatSync' | 'realpathSync'
   | 'readdirSync' | 'mkdirSync' | 'mkdtempSync' | 'rmSync' | 'opendirSync'
-  | 'openSync' | 'readSync' | 'writeSync'
+  | 'openSync' | 'readSync' | 'writeSync' | 'stat' | 'lstat' | 'watch' | 'watchFile' | 'unwatchFile'
+  | 'createReadStream' | 'createWriteStream'
 
 /**
  * The `node:fs` declarations this module stands in for. Every other member is
@@ -574,10 +837,10 @@ type NodeFace = Partial<Omit<typeof import('node:fs'), OwnSignature>>
 
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 export default {
-  constants, promises, Dirent,
-  readFileSync, writeFileSync, appendFileSync, existsSync, statSync, lstatSync, realpathSync, chmodSync,
+  constants, promises, Dirent, FSWatcher, StatWatcher, ReadStream, WriteStream,
+  readFileSync, writeFileSync, appendFileSync, existsSync, statSync, stat, lstatSync, lstat, realpathSync, chmodSync,
   readdirSync, mkdirSync, mkdtempSync, rmSync, unlinkSync, renameSync, accessSync, opendirSync,
   openHandleSync, linkSync,
-  openSync, readSync, writeSync, closeSync, watchFile, unwatchFile,
+  openSync, readSync, writeSync, closeSync, watch, watchFile, unwatchFile,
   createReadStream, createWriteStream,
 } satisfies NodeFace

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/fs/promises.ts

@@ -9,7 +9,7 @@ import { Dirent, promises } from '../fs.ts'
 /** The promise members of the VFS bridge, as `node:fs/promises` names them. */
 export const {
   readFile, writeFile, appendFile, mkdir, mkdtemp, readdir, stat, lstat, realpath, rm, unlink,
-  rename, access, chmod, cp, link, open, opendir, truncate, constants,
+  rename, access, chmod, cp, link, open, opendir, truncate, watch, constants,
 } = promises
 
 export { Dirent }

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/module.ts

@@ -1,7 +1,8 @@
 /**
  * `node:module` for the worker: `createRequire` hands out the worker module
- * loader's synchronous require, so typert's `require.resolve('<pkg>/package.json')
- * + readFileSync + import()` bypass runs unmodified over the VFS.
+ * loader's synchronous require. Typert can resolve package exports, and package
+ * inventory can discover manifests through `require.resolve.paths()` without
+ * either consumer changing for the Worker.
  */
 import { requireActiveModuleLoader, type WorkerRequire } from '../../../module-system/module-loader.ts'
 
@@ -11,7 +12,7 @@ export type NodeRequire = WorkerRequire
 /**
  * Build a `require` bound to a base path or file URL.
  * @param base - directory, file path, or file URL the resolution starts from.
- * @returns the synchronous require face.
+ * @returns the synchronous require face, including `resolve()` and `resolve.paths()`.
  */
 export function createRequire(base: string | URL): NodeRequire {
   return requireActiveModuleLoader().createRequire(base)

packages/experimental/webworker-runtime/src/node/builtin_modules/implemented/stream.ts

@@ -0,0 +1,84 @@
+/**
+ * `node:stream` compatibility backed by readable-stream's browser build.
+ *
+ * readable-stream is the userland copy of Node's stream implementation. The
+ * worker owns only platform adapters such as VFS file streams; stream state,
+ * backpressure, async iteration, abort handling, and event ordering stay in
+ * that maintained implementation.
+ */
+import Stream from 'readable-stream'
+
+type StreamRuntime = typeof import('node:stream') & {
+  compose(...streams: unknown[]): unknown
+  destroy(stream: unknown, error?: Error): void
+  isDisturbed(stream: unknown): boolean
+}
+
+type StreamStatics = typeof import('node:stream').Stream & {
+  getDefaultHighWaterMark(objectMode: boolean): number
+  isDestroyed(stream: unknown): boolean | null
+  isWritable(stream: unknown): boolean | null
+  setDefaultHighWaterMark(objectMode: boolean, value: number): void
+}
+
+const nodeStream = Stream as unknown as StreamRuntime
+
+/* oxlint-disable typescript/unbound-method -- readable-stream's namespace statics do not read `this`. */
+const {
+  Duplex, PassThrough, Readable, Stream: StreamBase, Transform, Writable,
+  addAbortSignal, compose, destroy, finished, isDisturbed, isErrored, isReadable, pipeline, promises,
+} = nodeStream
+const streamStatics = StreamBase as unknown as StreamStatics
+const {
+  getDefaultHighWaterMark, isDestroyed, isWritable, setDefaultHighWaterMark,
+} = streamStatics
+/* oxlint-enable typescript/unbound-method */
+
+// readable-stream tracks Node 18's 16 KiB byte default; this repository runs
+// Node 22+, whose generic and file streams use 64 KiB.
+if (getDefaultHighWaterMark(false) !== 64 * 1024) setDefaultHighWaterMark(false, 64 * 1024)
+
+/**
+ * Test whether a value is an ArrayBuffer view.
+ * @param value - Candidate value.
+ * @returns Whether the value is a typed-array or DataView instance.
+ */
+const _isArrayBufferView = (value: unknown): value is ArrayBufferView => ArrayBuffer.isView(value)
+
+/** Default-import namespace carrying Node's stream class and static helpers. */
+const streamDefault = Object.assign(StreamBase, {
+  _isArrayBufferView,
+  getDefaultHighWaterMark,
+  isDestroyed,
+  isWritable,
+  setDefaultHighWaterMark,
+})
+
+export {
+  Duplex,
+  PassThrough,
+  Readable,
+  StreamBase as Stream,
+  Transform,
+  Writable,
+  addAbortSignal,
+  compose,
+  destroy,
+  finished,
+  getDefaultHighWaterMark,
+  _isArrayBufferView,
+  isDestroyed,
+  isDisturbed,
+  isErrored,
+  isReadable,
+  isWritable,
+  pipeline,
+  promises,
+  setDefaultHighWaterMark,
+}
+
+/** CommonJS interop marker consumed by the worker module loader. */
+export const __esModule = true
+
+/** CommonJS-compatible namespace for default imports. */
+export default streamDefault

packages/experimental/webworker-runtime/src/node/builtin_modules/mock/stream.ts

@@ -1,38 +0,0 @@
-/**
- * `node:stream` stub. Every harness import of this module in the reachable tree
- * is type-only (`Duplex`/`Readable`/`Writable` annotations), so nothing here runs
- * unless a value import appears; then it says so.
- */
-import { notImplementedFail } from '../../notImplementedFail.ts'
-
-const MODULE = 'node:stream'
-
-/** Readable stream (unavailable; use WHATWG ReadableStream). */
-export const Readable: typeof import('node:stream').Readable = notImplementedFail(MODULE, 'Readable')
-
-/** Writable stream (unavailable). */
-export const Writable: typeof import('node:stream').Writable = notImplementedFail(MODULE, 'Writable')
-
-/** Duplex stream (unavailable). */
-export const Duplex: typeof import('node:stream').Duplex = notImplementedFail(MODULE, 'Duplex')
-
-/** Transform stream (unavailable). */
-export const Transform: typeof import('node:stream').Transform = notImplementedFail(MODULE, 'Transform')
-
-/** PassThrough stream (unavailable). */
-export const PassThrough: typeof import('node:stream').PassThrough = notImplementedFail(MODULE, 'PassThrough')
-
-/** Pipeline helper (unavailable). */
-export const pipeline: typeof import('node:stream').pipeline = notImplementedFail(MODULE, 'pipeline')
-
-/** Finished helper (unavailable). */
-export const finished: typeof import('node:stream').finished = notImplementedFail(MODULE, 'finished')
-
-/** CommonJS interop marker: the worker loader hands `default` to default imports (see ./builtins.ts). */
-export const __esModule = true
-
-/** The `node:stream` declarations this module stands in for. */
-type NodeFace = Partial<typeof import('node:stream')>
-
-/** CommonJS default export: the members `require()` hands a caller of this module. */
-export default { Readable, Writable, Duplex, Transform, PassThrough, pipeline, finished } satisfies NodeFace

packages/experimental/webworker-runtime/src/node/builtins.ts

@@ -32,6 +32,7 @@ import * as nodeModule from './builtin_modules/implemented/module.ts'
 import * as nodeOs from './builtin_modules/implemented/os.ts'
 import * as nodePath from './builtin_modules/implemented/path.ts'
 import * as nodePerfHooks from './builtin_modules/implemented/perf_hooks.ts'
+import * as nodeStream from './builtin_modules/implemented/stream.ts'
 import * as nodeTimersPromises from './builtin_modules/implemented/timers/promises.ts'
 import * as nodeUrl from './builtin_modules/implemented/url.ts'
 import * as nodeUtil from './builtin_modules/implemented/util.ts'
@@ -40,12 +41,9 @@ import * as nodeZlib from './builtin_modules/implemented/zlib.ts'
 import * as nodeChildProcess from './builtin_modules/implemented/child_process.ts'
 import * as nodeNet from './builtin_modules/mock/net.ts'
 import * as nodeSqlite from './builtin_modules/mock/sqlite.ts'
-import * as nodeStream from './builtin_modules/mock/stream.ts'
 import * as nodeVm from './builtin_modules/mock/vm.ts'
 import * as nodeWorkerThreads from './builtin_modules/mock/worker_threads.ts'
-import * as chokidar from './external_packages/chokidar.ts'
 import * as koffi from './external_packages/koffi.ts'
-import * as landlockRun from './external_packages/node-addon-landlock-run.ts'
 import * as nodePty from './external_packages/node-pty.ts'
 import * as piAi from './external_packages/pi-ai.ts'
 import * as ripgrep from './external_packages/ripgrep.ts'
@@ -83,14 +81,12 @@ const BUILTINS: Record<string, StaticModuleFactory> = {
 
 /** External npm packages replaced wholesale (structural not-implemented stubs and fakes). */
 const EXTERNALS: Record<string, StaticModuleFactory> = {
-  'chokidar': () => chokidar,
   'koffi': () => koffi,
   'sharp': () => sharp,
   'node-pty': () => nodePty,
   'ws': () => ws,
   '@vscode/ripgrep': () => ripgrep,
   '@earendil-works/pi-ai': () => piAi,
-  '@deepseek-ai/node-addon-landlock-run': () => landlockRun,
 }
 
 /**

packages/experimental/webworker-runtime/src/node/external_packages/chokidar.ts

@@ -1,68 +0,0 @@
-/**
- * `chokidar` stub: a constructible watcher that never fires. Settings and
- * credentials call `watch()` unconditionally in `[Service.init]`, and the
- * in-memory VFS has no external writer, so "no events" is the truth here rather
- * than a degradation.
- */
-
-/** No-op watcher with chokidar's chainable face. */
-export class FSWatcher {
-  /**
-   * Register a listener; no event is ever emitted.
-   * @returns this watcher.
-   */
-  on(): this {
-    return this
-  }
-
-  /**
-   * Register a one-shot listener; no event is ever emitted.
-   * @returns this watcher.
-   */
-  once(): this {
-    return this
-  }
-
-  /**
-   * Add paths to the (inert) watch set.
-   * @returns this watcher.
-   */
-  add(): this {
-    return this
-  }
-
-  /**
-   * Remove paths from the (inert) watch set.
-   * @returns this watcher.
-   */
-  unwatch(): this {
-    return this
-  }
-
-  /**
-   * Watched paths, as chokidar reports them.
-   * @returns An empty record; nothing is ever watched.
-   */
-  getWatched(): Record<string, string[]> {
-    return {}
-  }
-
-  /** Close the watcher. */
-  async close(): Promise<void> {
-    // Nothing was ever watched.
-  }
-}
-
-/**
- * Create an inert watcher.
- * @returns the watcher.
- */
-export function watch(): FSWatcher {
-  return new FSWatcher()
-}
-
-/** CommonJS interop marker: the worker loader hands `default` to default imports (see ./builtins.ts). */
-export const __esModule = true
-
-/** CommonJS default export: the members `require()` hands a caller of this module. */
-export default { watch, FSWatcher }

packages/experimental/webworker-runtime/src/node/external_packages/node-addon-landlock-run.ts

@@ -1,31 +0,0 @@
-/**
- * `@deepseek-ai/node-addon-landlock-run` stub: the Landlock launcher. Sandboxing
- * is part of the declared excluded surface, so `sandbox-local` mounts with the
- * launcher path and probe present and fails when it tries to confine a process.
- */
-import { notImplementedFail } from '../notImplementedFail.ts'
-
-const MODULE = '@deepseek-ai/node-addon-landlock-run'
-
-/** Launcher executable name, read at module scope by sandbox-local. */
-export const LAUNCHER_BIN = 'landlock-run'
-
-/** Exit code the launcher reports when confinement itself fails. */
-export const LAUNCHER_FAILURE_EXIT = 126
-
-/**
- * Path of the launcher binary; nothing in a browser can execute it.
- * @returns The image path consumers read before failing on their own terms.
- */
-export function launcherPath(): string {
-  return `/dsh/bin/${LAUNCHER_BIN}`
-}
-
-/** Landlock availability probe (unavailable). */
-export const probe = notImplementedFail(MODULE, 'probe')
-
-/** CommonJS interop marker: the worker loader hands `default` to default imports (see ./builtins.ts). */
-export const __esModule = true
-
-/** CommonJS default export: the members `require()` hands a caller of this module. */
-export default { LAUNCHER_BIN, LAUNCHER_FAILURE_EXIT, launcherPath, probe }

packages/experimental/webworker-runtime/src/node/external_packages/replaced-externals.ts

@@ -8,10 +8,8 @@
 
 /** External packages served from the worker bundle instead of the VFS. */
 export const REPLACED_EXTERNAL_PACKAGES: readonly string[] = [
-  '@deepseek-ai/node-addon-landlock-run',
   '@earendil-works/pi-ai',
   '@vscode/ripgrep',
-  'chokidar',
   'koffi',
   'node-pty',
   'sharp',

packages/experimental/webworker-runtime/src/shell/fs-access.ts

@@ -57,7 +57,8 @@ export function describeFailure(program: string, path: string, error: unknown):
  * @returns the error to throw.
  */
 export function filesystemError(code: string, syscall: string, path: string): VfsError {
-  const error = new Error(`${code}: ${syscall} failed, ${syscall} '${path}'`) as VfsError
+  const reason = code === 'EACCES' ? 'permission denied' : `${syscall} failed`
+  const error = new Error(`${code}: ${reason}, ${syscall} '${path}'`) as VfsError
   error.code = code
   error.path = path
   error.syscall = syscall
@@ -75,19 +76,17 @@ function statsOf(stats: VfsStats): ShellStats {
  */
 export function hostFileSystem(): ShellFileSystem {
   const vfs = (): ReturnType<typeof requireActiveVfs> => requireActiveVfs()
-  // oxlint-disable-next-line typescript/require-await -- async face, in-memory backend; see the note below.
-  const stat = async (path: string): Promise<ShellStats | undefined> => {
+  const stat = (path: string): Promise<ShellStats | undefined> => {
     try {
-      return statsOf(vfs().statSync(path) as VfsStats)
+      return Promise.resolve(statsOf(vfs().statSync(path) as VfsStats))
     } catch {
       // Absence is the answer callers branch on; every other failure mode of
       // the in-memory backend is also "this path holds nothing readable".
-      return undefined
+      return Promise.resolve(undefined)
     }
   }
   // Several members take no await: the face is asynchronous because a process
   // worker's filesystem is, while this backend answers from memory.
-  /* oxlint-disable typescript/require-await -- see the note above. */
   return {
     stat,
     list: async (path: string): Promise<ShellDirent[]> => {
@@ -102,19 +101,22 @@ export function hostFileSystem(): ShellFileSystem {
       if ((await stat(path))?.directory === true) throw filesystemError('EISDIR', 'read', path)
       return vfs().readFileSync(path, 'utf8') as string
     },
-    writeText: async (path: string, text: string, append = false): Promise<void> => {
+    writeText: (path: string, text: string, append = false): Promise<void> => {
       if (append) vfs().appendFileSync(path, text)
       else vfs().writeFileSync(path, text)
+      return Promise.resolve()
     },
-    mkdir: async (path: string, recursive: boolean): Promise<void> => {
+    mkdir: (path: string, recursive: boolean): Promise<void> => {
       vfs().mkdirSync(path, { recursive })
+      return Promise.resolve()
     },
-    remove: async (path: string, options: { recursive: boolean; force: boolean }): Promise<void> => {
+    remove: (path: string, options: { recursive: boolean; force: boolean }): Promise<void> => {
       vfs().rmSync(path, options)
+      return Promise.resolve()
     },
-    rename: async (from: string, to: string): Promise<void> => {
+    rename: (from: string, to: string): Promise<void> => {
       vfs().renameSync(from, to)
+      return Promise.resolve()
     },
   }
-  /* oxlint-enable typescript/require-await */
 }

packages/experimental/webworker-runtime/src/shell/process/landlock.ts

@@ -0,0 +1,194 @@
+/** Landlock launcher parsing and per-process VFS enforcement for the worker shell. */
+import { resolve } from '../../module-system/posix-path.ts'
+import { DSH_TMP } from '../../storage/paths.ts'
+import { filesystemError } from '../fs-access.ts'
+import type { ShellDirent, ShellFileSystem, ShellStats } from '../types.ts'
+import type { VirtualExecutable, VirtualExecutableExit } from './virtual-executables.ts'
+
+/** Parsed invocation of the native launcher's unchanged argv grammar. */
+export type LandlockInvocation =
+  | { readonly kind: 'probe' }
+  | {
+    readonly kind: 'run'
+    readonly readOnly: readonly string[]
+    readonly readWrite: readonly string[]
+    readonly argv: readonly string[]
+  }
+
+/** Launcher-owned failure; callers print its message with the `landlock-run:` prefix. */
+export class LandlockLauncherError extends Error {}
+
+/**
+ * Parse the native launcher's argv grammar.
+ * @param args - Arguments after the launcher executable.
+ * @returns A probe or confined-run request.
+ */
+export function parseLandlockArguments(args: readonly string[]): LandlockInvocation {
+  const readOnly: string[] = []
+  const readWrite: string[] = []
+  for (let index = 0; index < args.length;) {
+    const argument = args[index] as string
+    if (argument === '--probe') {
+      if (args.length !== 1) throw new LandlockLauncherError('usage error: --probe takes no other arguments')
+      return { kind: 'probe' }
+    }
+    if (argument === '--ro' || argument === '--rw') {
+      const path = args[index + 1]
+      if (path === undefined) throw new LandlockLauncherError(`usage error: ${argument} requires a path`)
+      ;(argument === '--ro' ? readOnly : readWrite).push(path)
+      index += 2
+      continue
+    }
+    if (argument === '--') {
+      const argv = args.slice(index + 1)
+      if (argv.length === 0) throw new LandlockLauncherError('usage error: missing `-- <argv>...` command')
+      return { kind: 'run', readOnly, readWrite, argv }
+    }
+    throw new LandlockLauncherError(`usage error: unknown argument: ${argument}`)
+  }
+  throw new LandlockLauncherError('usage error: missing `-- <argv>...` command')
+}
+
+/** Map the host launcher's temp path into the Worker VFS. */
+function vfsPath(path: string, cwd: string): string {
+  const resolved = resolve(cwd, path)
+  const absolute = resolved.length > 1 ? resolved.replace(/\/+$/u, '') : resolved
+  if (absolute === '/tmp') return DSH_TMP
+  if (absolute.startsWith('/tmp/')) return `${DSH_TMP}${absolute.slice('/tmp'.length)}`
+  return absolute
+}
+
+/** Whether a normalized path is the root itself or one of its descendants. */
+function contains(root: string, path: string): boolean {
+  return root === '/' || path === root || path.startsWith(`${root}/`)
+}
+
+/** Throw the denial dialect consumed by `dsh-bash-sandbox`. */
+function deny(syscall: string, path: string): never {
+  throw filesystemError('EACCES', syscall, path)
+}
+
+/** Stats for the virtual `/dev/null` file. */
+const NULL_STATS: ShellStats = { directory: false, size: 0, mtimeMs: 0 }
+const DEV_ROOT = '/dev'
+const NULL_PATH = '/dev/null'
+
+/** Build one launcher-owned terminal result. */
+function launcherExit(exitCode: number, stdout = '', stderr = ''): VirtualExecutableExit {
+  return { kind: 'exit', exitCode, stdout, stderr }
+}
+
+/** Convert a parser or grant failure into the native launcher's fatal dialect. */
+function launcherFailure(error: unknown): VirtualExecutableExit {
+  const detail = error instanceof LandlockLauncherError ? error.message : String(error)
+  return launcherExit(125, '', `landlock-run: ${detail}\n`)
+}
+
+/**
+ * Validate grant roots and create one process-local filesystem guard.
+ * @param base - Host-side VFS adapter all permitted calls delegate to.
+ * @param invocation - Parsed confined-run request.
+ * @param cwd - Launcher's working directory for relative grant paths.
+ * @returns A filesystem enforcing only this invocation's grants.
+ */
+export async function landlockFileSystem(
+  base: ShellFileSystem,
+  invocation: Extract<LandlockInvocation, { kind: 'run' }>,
+  cwd: string,
+): Promise<ShellFileSystem> {
+  const normalizeGrant = async (path: string): Promise<string> => {
+    if (path === '') throw new LandlockLauncherError('cannot open rule path: : No such file or directory')
+    const target = vfsPath(path, cwd)
+    if (target !== DEV_ROOT && target !== NULL_PATH && await base.stat(target) === undefined) {
+      throw new LandlockLauncherError(`cannot open rule path: ${path}: No such file or directory`)
+    }
+    return target
+  }
+  const readOnly = await Promise.all(invocation.readOnly.map(normalizeGrant))
+  const readWrite = await Promise.all(invocation.readWrite.map(normalizeGrant))
+  const readable = [...readOnly, ...readWrite]
+
+  const checkedPath = (path: string, syscall: string): string => {
+    const target = vfsPath(path, cwd)
+    if (target.startsWith(`${NULL_PATH}/`)) throw filesystemError('ENOTDIR', syscall, path)
+    return target
+  }
+  const readPath = (path: string, syscall: string): string => {
+    const target = checkedPath(path, syscall)
+    if (!readable.some(root => contains(root, target))) deny(syscall, path)
+    return target
+  }
+  const writePath = (path: string, syscall: string): string => {
+    const target = checkedPath(path, syscall)
+    if (!readWrite.some(root => contains(root, target))) deny(syscall, path)
+    return target
+  }
+
+  return {
+    stat: async (path: string): Promise<ShellStats | undefined> => {
+      const target = readPath(path, 'stat')
+      if (target === NULL_PATH) return NULL_STATS
+      if (target === DEV_ROOT && !await base.stat(target)) return { directory: true, size: 0, mtimeMs: 0 }
+      return await base.stat(target)
+    },
+    list: async (path: string): Promise<ShellDirent[]> => {
+      const target = readPath(path, 'scandir')
+      if (target === DEV_ROOT) return [{ name: 'null', directory: false }]
+      if (target === NULL_PATH) throw filesystemError('ENOTDIR', 'scandir', path)
+      return await base.list(target)
+    },
+    readText: async (path: string): Promise<string> => {
+      const target = readPath(path, 'open')
+      return target === NULL_PATH ? '' : await base.readText(target)
+    },
+    writeText: async (path: string, text: string, append = false): Promise<void> => {
+      const target = writePath(path, 'open')
+      if (target !== NULL_PATH) await base.writeText(target, text, append)
+    },
+    mkdir: async (path: string, recursive: boolean): Promise<void> => {
+      const target = writePath(path, 'mkdir')
+      if (target === NULL_PATH) throw filesystemError('EEXIST', 'mkdir', path)
+      await base.mkdir(target, recursive)
+    },
+    remove: async (path: string, options: { recursive: boolean; force: boolean }): Promise<void> => {
+      const target = writePath(path, 'rm')
+      if (target === NULL_PATH) deny('rm', path)
+      await base.remove(target, options)
+    },
+    rename: async (from: string, to: string): Promise<void> => {
+      const source = writePath(from, 'rename')
+      const destination = writePath(to, 'rename')
+      if (source === NULL_PATH || destination === NULL_PATH) deny('rename', source === NULL_PATH ? from : to)
+      await base.rename(source, destination)
+    },
+  }
+}
+
+/** Virtual executable implementing the native launcher's CLI over VFS grants. */
+export const LANDLOCK_EXECUTABLE: VirtualExecutable = {
+  name: 'landlock-run',
+  async prepare(args, context) {
+    try {
+      const invocation = parseLandlockArguments(args)
+      if (invocation.kind === 'probe') return launcherExit(0, 'landlock: fully enforced\n')
+      return {
+        kind: 'delegate',
+        argv: invocation.argv,
+        filesystem: await landlockFileSystem(context.filesystem, invocation, context.cwd),
+        missingExecutable: launcherExit(125, '', 'landlock-run: exec failed: No such file or directory\n'),
+      }
+    } catch (error) {
+      return launcherFailure(error)
+    }
+  },
+  runSync(args) {
+    try {
+      const invocation = parseLandlockArguments(args)
+      return invocation.kind === 'probe'
+        ? launcherExit(0, 'landlock: fully enforced\n')
+        : { kind: 'asynchronous' }
+    } catch (error) {
+      return launcherFailure(error)
+    }
+  },
+}

packages/experimental/webworker-runtime/src/shell/process/virtual-executables.ts

@@ -0,0 +1,61 @@
+/** Virtual executable registry used by the Worker process launcher. */
+import { basename } from '../../module-system/posix-path.ts'
+import type { ShellFileSystem } from '../types.ts'
+import { LANDLOCK_EXECUTABLE } from './landlock.ts'
+
+/** Completed virtual executable invocation. */
+export interface VirtualExecutableExit {
+  readonly kind: 'exit'
+  readonly exitCode: number
+  readonly stdout: string
+  readonly stderr: string
+}
+
+/** Invocation delegated to the normal Worker command runner after preparation. */
+export interface VirtualExecutableDelegate {
+  readonly kind: 'delegate'
+  readonly argv: readonly string[]
+  readonly filesystem: ShellFileSystem
+  readonly missingExecutable: VirtualExecutableExit
+}
+
+/** Result of preparing an asynchronous virtual executable invocation. */
+export type VirtualExecutablePreparation = VirtualExecutableExit | VirtualExecutableDelegate
+
+/** Result available to the synchronous child-process face. */
+export type VirtualExecutableSyncResult = VirtualExecutableExit | { readonly kind: 'asynchronous' }
+
+/** One executable implemented by the Worker instead of an operating-system binary. */
+export interface VirtualExecutable {
+  /** Platform executable name, independent of package-manager installation path. */
+  readonly name: string
+  /**
+   * Prepare an invocation or complete it without entering the command runner.
+   * @param args - Arguments after the executable path.
+   * @param context - Working directory and ambient Worker filesystem.
+   * @returns The completed result or delegated command and filesystem.
+   */
+  prepare(
+    args: readonly string[],
+    context: { readonly cwd: string; readonly filesystem: ShellFileSystem },
+  ): Promise<VirtualExecutablePreparation>
+  /**
+   * Handle the subset that can complete synchronously.
+   * @param args - Arguments after the executable path.
+   * @returns A completed result or the asynchronous marker.
+   */
+  runSync(args: readonly string[]): VirtualExecutableSyncResult
+}
+
+const EXECUTABLES: ReadonlyMap<string, VirtualExecutable> = new Map([
+  [LANDLOCK_EXECUTABLE.name, LANDLOCK_EXECUTABLE],
+])
+
+/**
+ * Resolve a Worker platform executable by logical name.
+ * @param path - Bare name or executable path passed to `spawn`.
+ * @returns Its implementation, or undefined for the normal command table.
+ */
+export function virtualExecutable(path: string): VirtualExecutable | undefined {
+  return EXECUTABLES.get(basename(path))
+}

packages/experimental/webworker-runtime/src/storage/active.ts

@@ -4,15 +4,15 @@
  * which backend the worker entry mounted.
  * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/storage/active
  */
-import type { MemoryVfs } from './memory.ts'
+import type { Vfs } from './types.ts'
 
-let active: MemoryVfs | undefined
+let active: Vfs | undefined
 
 /**
  * Publish the filesystem the `node:fs` proxy reads.
  * @param vfs - Filesystem mounted by the worker entry.
  */
-export function setActiveVfs(vfs: MemoryVfs): void {
+export function setActiveVfs(vfs: Vfs): void {
   active = vfs
 }
 
@@ -20,7 +20,7 @@ export function setActiveVfs(vfs: MemoryVfs): void {
  * Read the mounted filesystem.
  * @returns The active filesystem.
  */
-export function requireActiveVfs(): MemoryVfs {
+export function requireActiveVfs(): Vfs {
   if (active === undefined) {
     throw new Error('webworker vfs: no filesystem is mounted; the worker entry must call setActiveVfs before any node:fs access')
   }

packages/experimental/webworker-runtime/src/storage/memory.ts

@@ -1,14 +1,15 @@
 /**
  * In-memory filesystem behind the worker's `node:fs` proxy. Contents come from
- * the build-time image (see {@link loadVfsImage}); writes stay in memory and
- * vanish with the worker.
+ * the build-time image (see {@link loadVfsImage}); this remains the synchronous
+ * authority when an asynchronous durable sink mirrors selected subtrees.
  * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/storage/memory
  */
 import { dirname, join, normalize, resolve, SEP } from '../module-system/posix-path.ts'
+import { IMAGE_OVERLAY_DIRECTORIES } from '../image-layout.ts'
 import { parseTar } from './tar.ts'
 import type {
-  VfsBigIntStats, VfsDir, VfsDirent, VfsEncoding, VfsError, VfsFileHandle, VfsReadOptions, VfsStatOptions,
-  VfsStats, VfsWriteOptions,
+  Vfs, VfsBigIntStats, VfsDir, VfsDirent, VfsEncoding, VfsError, VfsFileHandle, VfsMutation, VfsOpenFile,
+  VfsMutationListener, VfsMutationSink, VfsReadOptions, VfsSeedOptions, VfsStatOptions, VfsStats, VfsWriteOptions,
 } from './types.ts'
 
 const decoder = new TextDecoder()
@@ -19,6 +20,10 @@ interface FileNode {
   mtimeMs: number
   /** Permission bits (`0o777` mask), set at creation and changed only by `chmod`. */
   mode: number
+  /** Stable identity shared by hard links and retained by open descriptors. */
+  identity?: bigint
+  /** One path normally, a Set only for hard links, or undefined after the final unlink. */
+  paths: string | Set<string> | undefined
 }
 
 /** Creation default for files, Node's `0o666` under the classic `022` umask. */
@@ -46,10 +51,14 @@ function encodingOf(options: VfsReadOptions): VfsEncoding | undefined {
 // stored value — the round-trip consumers like dsh-credentials-local's
 // owner-only check rely on. The bits are never enforced: a single-owner
 // filesystem reads and writes as its owner regardless, like root.
-function statsOf(size: number, mtimeMs: number, directory: boolean, mode: number): VfsStats {
+function statsOf(size: number, mtimeMs: number, directory: boolean, ino: bigint, mode: number): VfsStats {
   return {
     size,
+    ino: Number(ino),
     mtimeMs,
+    ctimeMs: mtimeMs,
+    atimeMs: mtimeMs,
+    birthtimeMs: mtimeMs,
     mtime: new Date(mtimeMs),
     mode: (directory ? 0o040000 : 0o100000) | (mode & 0o777),
     isFile: () => !directory,
@@ -75,7 +84,14 @@ function statsOf(size: number, mtimeMs: number, directory: boolean, mode: number
  * @param mode - Stored permission bits of the entry.
  * @returns Stats in the shape Node returns under `{ bigint: true }`.
  */
-function bigIntStatsOf(size: number, mtimeMs: number, directory: boolean, ino: bigint, mode: number): VfsBigIntStats {
+function bigIntStatsOf(
+  size: number,
+  mtimeMs: number,
+  directory: boolean,
+  ino: bigint,
+  mode: number,
+  nlink = 1,
+): VfsBigIntStats {
   const milliseconds = BigInt(Math.trunc(mtimeMs))
   const nanoseconds = milliseconds * 1_000_000n
   const time = new Date(mtimeMs)
@@ -84,7 +100,7 @@ function bigIntStatsOf(size: number, mtimeMs: number, directory: boolean, ino: b
     mode: BigInt((directory ? 0o040000 : 0o100000) | (mode & 0o777)),
     dev: 1n,
     ino,
-    nlink: 1n,
+    nlink: BigInt(nlink),
     mtimeMs: milliseconds,
     mtimeNs: nanoseconds,
     ctimeMs: milliseconds,
@@ -107,23 +123,116 @@ function bigIntStatsOf(size: number, mtimeMs: number, directory: boolean, ino: b
   }
 }
 
+interface OpenMode {
+  readonly readable: boolean
+  readonly writable: boolean
+  readonly append: boolean
+  readonly create: boolean
+  readonly truncate: boolean
+  readonly exclusive: boolean
+}
+
+/** Parse the Node string flags supported by the compatibility filesystem. */
+function openMode(flags: string): OpenMode {
+  const base = flags[0]
+  const suffix = flags.slice(1).split('')
+  const validSuffix = suffix.every(flag => flag === '+' || flag === 'x' || flag === 's')
+  const uniqueSuffix = new Set(suffix).size === suffix.length
+  if ((base !== 'r' && base !== 'w' && base !== 'a') || !validSuffix || !uniqueSuffix
+    || base === 'r' && flags.includes('x')) {
+    const error = new TypeError(`The argument 'flags' is invalid. Received '${flags}'`) as TypeError & { code: string }
+    error.code = 'ERR_INVALID_ARG_VALUE'
+    throw error
+  }
+  return {
+    readable: base === 'r' || flags.includes('+'),
+    writable: base !== 'r' || flags.includes('+'),
+    append: base === 'a',
+    create: base === 'w' || base === 'a',
+    truncate: base === 'w',
+    exclusive: flags.includes('x'),
+  }
+}
+
+/** Resize bytes exactly, preserving the prefix and zero-filling growth. */
+function resize(bytes: Uint8Array, length: number): Uint8Array {
+  if (!Number.isSafeInteger(length) || length < 0) {
+    const error = new RangeError(`The value of "len" is out of range. It must be >= 0. Received ${String(length)}`) as RangeError & { code: string }
+    error.code = 'ERR_OUT_OF_RANGE'
+    throw error
+  }
+  const resized = new Uint8Array(length)
+  resized.set(bytes.subarray(0, length))
+  return resized
+}
+
+/** Construction inputs for {@link MemoryVfs}. */
+export interface MemoryVfsOptions {
+  /** Durable write-behind observer; absent leaves the filesystem ephemeral. */
+  readonly sink?: VfsMutationSink
+}
+
 /**
  * Filesystem held in two maps: one for file bytes, one for directories.
  * Every path is normalized to an absolute POSIX path without a trailing
  * separator, so callers may pass either form.
  */
-export class MemoryVfs {
+export class MemoryVfs implements Vfs {
   private readonly files = new Map<string, FileNode>()
   private readonly directories = new Set<string>([SEP])
   /** Directory permission bits; absence means {@link DEFAULT_DIRECTORY_MODE}. */
   private readonly directoryModes = new Map<string, number>()
+  /** Directory mtimes advance when their immediate entry set changes. */
+  private readonly directoryMtimes = new Map<string, number>()
+  private readonly mutationListeners = new Set<VfsMutationListener>()
+  private readonly sink: VfsMutationSink | undefined
   private temporaries = 0
-  // Identity per path, assigned on first stat and dropped when the path goes:
-  // the filesystem service builds its version token from `ino` plus the
-  // timestamp, so a recreated path must not look like the entry it replaced.
+  // Directories retain path identities. File identities live on FileNode so
+  // descriptors, renames, and hard links continue to address the same file.
   private readonly identities = new Map<string, bigint>()
   private lastIdentity = 0n
 
+  /**
+   * Build the synchronous filesystem authority.
+   * @param options - Optional durable write-behind sink.
+   */
+  constructor(options: MemoryVfsOptions = {}) {
+    this.sink = options.sink
+  }
+
+  /**
+   * Settle the durable sink without changing in-memory success.
+   * @returns A promise that resolves when all recorded mutations are stored.
+   */
+  async flush(): Promise<void> {
+    await this.sink?.flush()
+  }
+
+  /**
+   * Observe committed runtime mutations. Image seeding is deliberately silent.
+   * @param listener - Consumer called after each successful mutation.
+   * @returns A disposer that prevents future calls.
+   */
+  subscribe(listener: VfsMutationListener): () => void {
+    this.mutationListeners.add(listener)
+    return () => { this.mutationListeners.delete(listener) }
+  }
+
+  /** Publish after state changes; one faulty observer cannot roll back a write. */
+  private publish(mutation: VfsMutation): void {
+    const observers: VfsMutationListener[] = [
+      ...(this.sink === undefined ? [] : [(change: VfsMutation): void => { this.sink?.record(change) }]),
+      ...this.mutationListeners,
+    ]
+    for (const listener of observers) {
+      try {
+        listener(mutation)
+      } catch (error) {
+        console.error('webworker vfs: mutation observer failed', error)
+      }
+    }
+  }
+
   /** Promise face mirroring `node:fs/promises` for the methods the roster uses. */
   readonly promises = {
     readFile: async (path: string, options?: VfsReadOptions): Promise<string | Uint8Array> => this.readFileSync(path, options),
@@ -198,11 +307,12 @@ export class MemoryVfs {
     const [size, mtimeMs, directory, mode] = node !== undefined
       ? [node.bytes.length, node.mtimeMs, false, node.mode] as const
       : this.directories.has(target)
-        ? [0, 0, true, this.directoryModes.get(target) ?? DEFAULT_DIRECTORY_MODE] as const
+        ? [0, this.directoryMtimes.get(target) ?? 0, true, this.directoryModes.get(target) ?? DEFAULT_DIRECTORY_MODE] as const
         : fail('ENOENT', 'stat', target)
+    const identity = node === undefined ? this.identityOf(target) : this.identityOfFile(node)
     return options?.bigint === true
-      ? bigIntStatsOf(size, mtimeMs, directory, this.identityOf(target), mode)
-      : statsOf(size, mtimeMs, directory, mode)
+      ? bigIntStatsOf(size, mtimeMs, directory, identity, mode, node === undefined ? 1 : this.fileLinkCount(node))
+      : statsOf(size, mtimeMs, directory, identity, mode)
   }
 
   /** @returns Stats in the plain shape, for internal callers that read `size`/`mtimeMs`. */
@@ -219,7 +329,109 @@ export class MemoryVfs {
     return this.lastIdentity
   }
 
-  /** Forget a removed path's identity, so a recreated path reports a new one. */
+  /** @returns The inode-like identity retained by a file node across names. */
+  private identityOfFile(node: FileNode): bigint {
+    if (node.identity !== undefined) return node.identity
+    this.lastIdentity += 1n
+    node.identity = this.lastIdentity
+    return node.identity
+  }
+
+  /** @returns The number of names currently linked to one file node. */
+  private fileLinkCount(node: FileNode): number {
+    return typeof node.paths === 'string' ? 1 : node.paths?.size ?? 0
+  }
+
+  /** Add one map name, promoting the rare hard-link case to a Set. */
+  private addFilePath(node: FileNode, path: string): void {
+    if (node.paths === undefined) {
+      node.paths = path
+    } else if (typeof node.paths === 'string') {
+      node.paths = new Set([node.paths, path])
+    } else {
+      node.paths.add(path)
+    }
+  }
+
+  /** Remove one map name, collapsing a remaining single link back to a string. */
+  private removeFilePath(node: FileNode, path: string): void {
+    if (typeof node.paths === 'string') {
+      node.paths = undefined
+      return
+    }
+    if (node.paths === undefined) return
+    node.paths.delete(path)
+    if (node.paths.size === 1) {
+      const [remaining] = node.paths
+      node.paths = remaining
+    }
+  }
+
+  /** Set one file-map entry while maintaining both nodes' reverse path indexes. */
+  private setFile(path: string, node: FileNode): void {
+    const previous = this.files.get(path)
+    if (previous === node) return
+    if (previous !== undefined) this.removeFilePath(previous, path)
+    this.files.set(path, node)
+    this.addFilePath(node, path)
+  }
+
+  /** Delete one file-map entry while retaining an unlinked node held by a descriptor. */
+  private deleteFile(path: string): FileNode | undefined {
+    const node = this.files.get(path)
+    if (node === undefined) return undefined
+    this.files.delete(path)
+    this.removeFilePath(node, path)
+    return node
+  }
+
+  /** Publish one linked name after a content or metadata write. */
+  private publishFilePath(node: FileNode, path: string, appendedFrom?: number): void {
+    this.publish({
+      kind: 'write', path, bytes: node.bytes, mode: node.mode, entryChanged: false,
+      ...appendedFrom === undefined ? {} : { appendedFrom },
+    })
+  }
+
+  /** Publish a content or metadata write for every hard link to one node. */
+  private publishFile(node: FileNode, appendedFrom?: number): void {
+    if (typeof node.paths === 'string') {
+      this.publishFilePath(node, node.paths, appendedFrom)
+      return
+    }
+    if (node.paths === undefined) return
+    for (const path of node.paths) this.publishFilePath(node, path, appendedFrom)
+  }
+
+  /** Replace bytes on one file identity and notify all linked paths. */
+  private replaceFile(node: FileNode, bytes: Uint8Array, appendedFrom?: number): void {
+    node.bytes = bytes
+    node.mtimeMs = this.touchNode(node)
+    this.publishFile(node, appendedFrom)
+  }
+
+  /** Write at one offset, zero-filling any gap. */
+  private writeFileNode(node: FileNode, position: number, data: Uint8Array): number {
+    const offset = Math.max(0, position)
+    const previousLength = node.bytes.length
+    const bytes = new Uint8Array(Math.max(previousLength, offset + data.length))
+    bytes.set(node.bytes)
+    bytes.set(data, offset)
+    this.replaceFile(node, bytes, offset === previousLength ? previousLength : undefined)
+    return data.length
+  }
+
+  /** Resize one file identity and notify all linked paths. */
+  private truncateFile(node: FileNode, length: number): void {
+    this.replaceFile(node, resize(node.bytes, length))
+  }
+
+  /** @returns Plain stats for an open file, including after its last name is removed. */
+  private fileStats(node: FileNode): VfsStats {
+    return statsOf(node.bytes.length, node.mtimeMs, false, this.identityOfFile(node), node.mode)
+  }
+
+  /** Forget removed directory identities, so recreated paths report new ones. */
   private forgetIdentity(target: string): void {
     this.identities.delete(target)
     const prefix = `${target}${SEP}`
@@ -239,11 +451,23 @@ export class MemoryVfs {
    * @returns Now, or one millisecond past the entry's current time.
    */
   private touch(target: string): number {
-    const previous = this.files.get(target)?.mtimeMs
+    return this.touchNode(this.files.get(target))
+  }
+
+  /** @returns A modification time strictly newer than one file node's current value. */
+  private touchNode(node?: FileNode): number {
+    const previous = node?.mtimeMs
     const now = Date.now()
     return previous === undefined ? now : Math.max(now, previous + 1)
   }
 
+  /** Advance a directory's mtime after its immediate children change. */
+  private touchDirectory(target: string): void {
+    const previous = this.directoryMtimes.get(target)
+    const now = Date.now()
+    this.directoryMtimes.set(target, previous === undefined ? now : Math.max(now, previous + 1))
+  }
+
   /**
    * List a directory.
    * @param path - Directory path.
@@ -312,7 +536,11 @@ export class MemoryVfs {
       this.mkdirSync(parent, options)
     }
     this.directories.add(target)
-    if (options?.mode !== undefined) this.directoryModes.set(target, options.mode & 0o777)
+    this.touchDirectory(target)
+    this.touchDirectory(parent)
+    const mode = (options?.mode ?? DEFAULT_DIRECTORY_MODE) & 0o777
+    if (mode !== DEFAULT_DIRECTORY_MODE) this.directoryModes.set(target, mode)
+    this.publish({ kind: 'mkdir', path: target, mode })
     return target
   }
 
@@ -331,8 +559,17 @@ export class MemoryVfs {
     if (flag.startsWith('a')) {  this.appendFileSync(target, data); return }
     // POSIX open(O_CREAT): the mode applies at creation only; a rewrite keeps
     // the entry's bits.
-    const mode = this.files.get(target)?.mode ?? (options?.mode !== undefined ? options.mode & 0o777 : DEFAULT_FILE_MODE)
-    this.files.set(target, { bytes: typeof data === 'string' ? encoder.encode(data) : data, mtimeMs: this.touch(target), mode })
+    const previous = this.files.get(target)
+    const mode = previous?.mode ?? (options?.mode !== undefined ? options.mode & 0o777 : DEFAULT_FILE_MODE)
+    const bytes = typeof data === 'string' ? encoder.encode(data) : data
+    if (previous !== undefined) {
+      this.replaceFile(previous, bytes)
+      return
+    }
+    const node: FileNode = { bytes, mtimeMs: this.touch(target), mode, paths: undefined }
+    this.setFile(target, node)
+    this.touchDirectory(dirname(target))
+    this.publish({ kind: 'write', path: target, bytes, mode, entryChanged: true })
   }
 
   /**
@@ -379,52 +616,97 @@ export class MemoryVfs {
         ...this.handleTail(target),
       }
     }
-    const exists = this.files.has(target)
-    if (flags.startsWith('r') && !exists) fail('ENOENT', 'open', target)
-    if (flags.startsWith('wx') && exists) fail('EEXIST', 'open', target)
-    if (!flags.startsWith('r') && !this.directories.has(dirname(target))) fail('ENOENT', 'open', target)
-    const creation = mode === undefined ? {} : { mode }
-    if (flags.startsWith('w') && !flags.startsWith('wx')) this.writeFileSync(target, new Uint8Array(), creation)
-    if (flags.startsWith('wx')) this.writeFileSync(target, new Uint8Array(), { flag: 'wx', ...creation })
-    if (flags.startsWith('a') && !exists) this.writeFileSync(target, new Uint8Array(), creation)
-    const appending = flags.startsWith('a')
+    const file = this.openFileSync(target, flags, mode)
+    let position = 0
+    let closed = false
+    const current = (syscall: string): VfsOpenFile => {
+      if (closed) fail('EBADF', syscall, target)
+      return file
+    }
     return {
       write: async (data: string | Uint8Array): Promise<{ bytesWritten: number }> => {
         const bytes = typeof data === 'string' ? encoder.encode(data) : data
-        this.appendFileSync(target, bytes)
-        return { bytesWritten: bytes.length }
+        const descriptor = current('write')
+        const offset = descriptor.append ? descriptor.stat().size : position
+        const bytesWritten = descriptor.write(offset, bytes)
+        position = offset + bytesWritten
+        return { bytesWritten }
       },
-      // A handle opened for append must append here too: session persistence
-      // opens the log with `a` and writes each batch through this method, so a
-      // truncating write would replace the whole log with the newest batch.
       writeFile: async (data: string | Uint8Array): Promise<void> => {
-        if (appending) this.appendFileSync(target, data)
-        else this.writeFileSync(target, data)
+        const bytes = typeof data === 'string' ? encoder.encode(data) : data
+        const descriptor = current('write')
+        const offset = descriptor.append ? descriptor.stat().size : position
+        position = offset + descriptor.write(offset, bytes)
+      },
+      readFile: async (options?: VfsReadOptions): Promise<string | Uint8Array> => {
+        const descriptor = current('read')
+        const bytes = descriptor.read(position, Math.max(0, descriptor.stat().size - position))
+        position += bytes.length
+        return encodingOf(options) === undefined ? bytes : decoder.decode(bytes)
       },
-      readFile: async (options?: VfsReadOptions): Promise<string | Uint8Array> => this.readFileSync(target, options),
       truncate: async (length = 0): Promise<void> => {
-        const node = this.files.get(target)
-        if (node === undefined) fail('ENOENT', 'ftruncate', target)
-        this.files.set(target, { bytes: node.bytes.slice(0, length), mtimeMs: this.touch(target), mode: node.mode })
+        current('ftruncate').truncate(length)
       },
-      ...this.handleTail(target),
+      stat: async (): Promise<VfsStats> => current('fstat').stat(),
+      sync: async (): Promise<void> => { current('fsync'); await this.flush() },
+      datasync: async (): Promise<void> => { current('fdatasync'); await this.flush() },
+      close: async (): Promise<void> => { closed = true },
     }
   }
 
   /**
-   * The handle members that do not depend on how the file was opened.
-   *
-   * `sync`/`datasync` have nothing to flush — the bytes are already the stored
-   * ones — and `close` releases nothing, so both directory and file handles
-   * share this tail.
+   * Open one synchronous descriptor over a stable file identity.
+   * @param path - File path.
+   * @param flags - Node open flags.
+   * @param mode - Permission bits applied only when a file is created.
+   * @returns An open file that survives path rename, replacement, and unlink.
+   */
+  openFileSync(path: string, flags = 'r', mode?: number): VfsOpenFile {
+    const target = this.key(path)
+    const access = openMode(flags)
+    const existing = this.files.get(target)
+    if (this.directories.has(target)) fail('EISDIR', 'open', target)
+    if (access.exclusive && existing !== undefined) fail('EEXIST', 'open', target)
+    if (!access.create && existing === undefined) fail('ENOENT', 'open', target)
+    if (access.create && existing === undefined) {
+      this.writeFileSync(target, new Uint8Array(), mode === undefined ? undefined : { mode })
+    } else if (access.truncate && existing !== undefined) {
+      this.truncateFile(existing, 0)
+    }
+    const node = this.files.get(target)
+    if (node === undefined) fail('ENOENT', 'open', target)
+    return {
+      readable: access.readable,
+      writable: access.writable,
+      append: access.append,
+      read: (position, length) => {
+        if (!access.readable) fail('EBADF', 'read', target)
+        return node.bytes.subarray(position, position + length)
+      },
+      write: (position, data) => {
+        if (!access.writable) fail('EBADF', 'write', target)
+        return this.writeFileNode(node, access.append ? node.bytes.length : position, data)
+      },
+      truncate: (length) => {
+        if (!access.writable) fail('EINVAL', 'ftruncate', target)
+        this.truncateFile(node, length)
+      },
+      stat: () => this.fileStats(node),
+    }
+  }
+
+  /**
+   * Directory-handle members for metadata, durability, and release.
+   * `sync`/`datasync` settle an attached durable sink; an ephemeral filesystem
+   * resolves immediately and `close` releases nothing.
    * @param target - Normalized path the handle was opened on.
    * @returns Metadata plus the no-op durability and release calls.
    */
   private handleTail(target: string): Pick<VfsFileHandle, 'stat' | 'sync' | 'datasync' | 'close'> {
     return {
       stat: async (): Promise<VfsStats> => this.plainStats(target),
-      sync: async (): Promise<void> => {},
-      datasync: async (): Promise<void> => {},
+      sync: async (): Promise<void> => { await this.flush() },
+      datasync: async (): Promise<void> => { await this.flush() },
       close: async (): Promise<void> => {},
     }
   }
@@ -439,10 +721,7 @@ export class MemoryVfs {
     const existing = this.files.get(target)
     const addition = typeof data === 'string' ? encoder.encode(data) : data
     if (existing === undefined) {  this.writeFileSync(target, addition); return }
-    const merged = new Uint8Array(existing.bytes.length + addition.length)
-    merged.set(existing.bytes)
-    merged.set(addition, existing.bytes.length)
-    this.files.set(target, { bytes: merged, mtimeMs: this.touch(target), mode: existing.mode })
+    this.writeFileNode(existing, existing.bytes.length, addition)
   }
 
   /**
@@ -453,22 +732,41 @@ export class MemoryVfs {
   renameSync(from: string, to: string): void {
     const source = this.key(from)
     const destination = this.key(to)
+    if (source === destination) return
     const node = this.files.get(source)
     if (node !== undefined) {
+      if (this.directories.has(destination)) fail('EISDIR', 'rename', destination)
       if (!this.directories.has(dirname(destination))) fail('ENOENT', 'rename', destination)
-      this.files.delete(source)
-      this.files.set(destination, node)
+      if (this.files.get(destination) === node) return
+      this.deleteFile(source)
+      this.setFile(destination, node)
       this.forgetIdentity(source)
       this.forgetIdentity(destination)
+      this.touchDirectory(dirname(source))
+      this.touchDirectory(dirname(destination))
+      this.publish({ kind: 'remove', path: source })
+      this.publish({ kind: 'write', path: destination, bytes: node.bytes, mode: node.mode, entryChanged: true })
       return
     }
     if (!this.directories.has(source)) fail('ENOENT', 'rename', source)
+    if (this.files.has(destination)) fail('ENOTDIR', 'rename', destination)
+    if (!this.directories.has(dirname(destination))) fail('ENOENT', 'rename', destination)
+    if (this.directories.has(destination)) {
+      if (this.readdirSync(destination).length > 0) fail('ENOTEMPTY', 'rename', destination)
+      this.directories.delete(destination)
+      this.directoryModes.delete(destination)
+      this.directoryMtimes.delete(destination)
+    }
     const prefix = `${source}${SEP}`
+    const movedFiles: Array<{ path: string; bytes: Uint8Array; mode: number }> = []
     for (const [candidate, value] of [...this.files]) {
       if (!candidate.startsWith(prefix)) continue
-      this.files.delete(candidate)
-      this.files.set(join(destination, candidate.slice(prefix.length)), value)
+      this.deleteFile(candidate)
+      const target = join(destination, candidate.slice(prefix.length))
+      this.setFile(target, value)
+      movedFiles.push({ path: target, bytes: value.bytes, mode: value.mode })
     }
+    const movedDirectories: Array<{ path: string; mode: number }> = []
     for (const candidate of [...this.directories]) {
       if (!candidate.startsWith(prefix) && candidate !== source) continue
       const moved = candidate === source ? destination : join(destination, candidate.slice(prefix.length))
@@ -477,17 +775,31 @@ export class MemoryVfs {
       const bits = this.directoryModes.get(candidate)
       this.directoryModes.delete(candidate)
       if (bits !== undefined) this.directoryModes.set(moved, bits)
+      movedDirectories.push({ path: moved, mode: bits ?? DEFAULT_DIRECTORY_MODE })
+      const mtime = this.directoryMtimes.get(candidate)
+      this.directoryMtimes.delete(candidate)
+      if (mtime !== undefined) this.directoryMtimes.set(moved, mtime)
     }
     this.forgetIdentity(source)
     this.forgetIdentity(destination)
+    this.touchDirectory(dirname(source))
+    this.touchDirectory(dirname(destination))
+    this.publish({ kind: 'remove', path: source })
+    for (const directory of movedDirectories) {
+      this.publish({ kind: 'mkdir', path: directory.path, mode: directory.mode })
+    }
+    for (const entry of movedFiles) {
+      this.publish({
+        kind: 'write', path: entry.path, bytes: entry.bytes, mode: entry.mode, entryChanged: true,
+      })
+    }
   }
 
   /**
    * Give existing bytes a second name.
    *
-   * There are no inodes here, so the two names share the bytes present at link
-   * time and diverge on the next write through either name; session persistence
-   * links a finished file to a stable name, which this satisfies.
+   * Both names retain one file identity, so writes and metadata changes through
+   * either name remain visible through the other until that name is removed.
    * @param existing - Source file path.
    * @param next - Additional path; its parent must exist and it must be free.
    */
@@ -498,7 +810,9 @@ export class MemoryVfs {
     if (node === undefined) fail('ENOENT', 'link', source)
     if (this.files.has(target) || this.directories.has(target)) fail('EEXIST', 'link', target)
     if (!this.directories.has(dirname(target))) fail('ENOENT', 'link', target)
-    this.files.set(target, node)
+    this.setFile(target, node)
+    this.touchDirectory(dirname(target))
+    this.publish({ kind: 'write', path: target, bytes: node.bytes, mode: node.mode, entryChanged: true })
   }
 
   /**
@@ -510,7 +824,7 @@ export class MemoryVfs {
     const target = this.key(path)
     const node = this.files.get(target)
     if (node === undefined) fail('ENOENT', 'truncate', target)
-    this.files.set(target, { bytes: node.bytes.slice(0, length), mtimeMs: this.touch(target), mode: node.mode })
+    this.truncateFile(node, length)
   }
 
   /**
@@ -523,10 +837,17 @@ export class MemoryVfs {
     const node = this.files.get(target)
     if (node !== undefined) {
       node.mode = mode & 0o777
+      if (typeof node.paths === 'string') {
+        this.publish({ kind: 'chmod', path: node.paths, mode: node.mode })
+      } else if (node.paths !== undefined) {
+        for (const path of node.paths) this.publish({ kind: 'chmod', path, mode: node.mode })
+      }
       return
     }
     if (this.directories.has(target)) {
-      this.directoryModes.set(target, mode & 0o777)
+      const bits = mode & 0o777
+      this.directoryModes.set(target, bits)
+      this.publish({ kind: 'chmod', path: target, mode: bits })
       return
     }
     fail('ENOENT', 'chmod', target)
@@ -538,8 +859,10 @@ export class MemoryVfs {
    */
   unlinkSync(path: string): void {
     const target = this.key(path)
-    if (!this.files.delete(target)) fail('ENOENT', 'unlink', target)
+    if (this.deleteFile(target) === undefined) fail('ENOENT', 'unlink', target)
     this.forgetIdentity(target)
+    this.touchDirectory(dirname(target))
+    this.publish({ kind: 'remove', path: target })
   }
 
   /**
@@ -549,22 +872,28 @@ export class MemoryVfs {
    */
   rmSync(path: string, options?: { recursive?: boolean; force?: boolean }): void {
     const target = this.key(path)
-    if (this.files.delete(target)) {
+    if (this.deleteFile(target) !== undefined) {
       this.forgetIdentity(target)
+      this.touchDirectory(dirname(target))
+      this.publish({ kind: 'remove', path: target })
       return
     }
     if (this.directories.has(target)) {
       if (options?.recursive !== true) fail('ERR_FS_EISDIR', 'rm', target)
       const prefix = `${target}${SEP}`
-      for (const candidate of [...this.files.keys()]) if (candidate.startsWith(prefix)) this.files.delete(candidate)
+      for (const candidate of [...this.files.keys()]) if (candidate.startsWith(prefix)) this.deleteFile(candidate)
       for (const candidate of [...this.directories]) {
         if (!candidate.startsWith(prefix)) continue
         this.directories.delete(candidate)
         this.directoryModes.delete(candidate)
+        this.directoryMtimes.delete(candidate)
       }
       this.directories.delete(target)
       this.directoryModes.delete(target)
+      this.directoryMtimes.delete(target)
       this.forgetIdentity(target)
+      this.touchDirectory(dirname(target))
+      this.publish({ kind: 'remove', path: target })
       return
     }
     if (options?.force !== true) fail('ENOENT', 'rm', target)
@@ -586,23 +915,37 @@ export class MemoryVfs {
    * Seed a file and its parent directories, for image loading and tests.
    * @param path - File path.
    * @param data - Text or bytes.
-   * @param mode - Permission bits recorded for the entry.
+   * @param options - Permission bits and modification time supplied by the image or durable store.
    */
-  seed(path: string, data: string | Uint8Array, mode = DEFAULT_FILE_MODE): void {
+  seed(path: string, data: string | Uint8Array, options: VfsSeedOptions = {}): void {
     const target = this.key(path)
-    this.mkdirSync(dirname(target), { recursive: true })
-    this.files.set(target, { bytes: typeof data === 'string' ? encoder.encode(data) : data, mtimeMs: this.touch(target), mode: mode & 0o777 })
+    this.seedDirectory(dirname(target))
+    this.setFile(target, {
+      bytes: typeof data === 'string' ? encoder.encode(data) : data,
+      mtimeMs: options.mtimeMs ?? this.touch(target),
+      mode: (options.mode ?? DEFAULT_FILE_MODE) & 0o777,
+      paths: undefined,
+    })
+    this.touchDirectory(dirname(target))
   }
 
   /**
    * Create a directory and its parents.
    * @param path - Directory path.
-   * @param mode - Permission bits recorded for the directory itself.
+   * @param options - Permission bits and modification time supplied by the image or durable store.
    */
-  seedDirectory(path: string, mode = DEFAULT_DIRECTORY_MODE): void {
+  seedDirectory(path: string, options: VfsSeedOptions = {}): void {
     const target = this.key(path)
-    this.mkdirSync(target, { recursive: true })
-    if (mode !== DEFAULT_DIRECTORY_MODE) this.directoryModes.set(target, mode & 0o777)
+    if (!this.directories.has(target)) {
+      const parent = dirname(target)
+      if (parent !== target) this.seedDirectory(parent)
+      if (this.files.has(target)) fail('EEXIST', 'mkdir', target)
+      this.directories.add(target)
+      this.directoryMtimes.set(target, options.mtimeMs ?? Date.now())
+      this.touchDirectory(parent)
+    }
+    if (options.mode !== undefined) this.directoryModes.set(target, options.mode & 0o777)
+    if (options.mtimeMs !== undefined) this.directoryMtimes.set(target, options.mtimeMs)
   }
 
   /**
@@ -636,10 +979,45 @@ export function loadVfsImage(image: Uint8Array, root = '/dsh', vfs = new MemoryV
     }
     const target = join(root, relativeName)
     if (entry.directory) {
-      vfs.seedDirectory(target, entry.mode)
+      vfs.seedDirectory(target, { mode: entry.mode })
+      continue
+    }
+    vfs.seed(target, entry.bytes, { mode: entry.mode })
+  }
+  return vfs
+}
+
+/**
+ * Apply one ordered data overlay to an already mounted base image.
+ *
+ * Overlay entries may replace files only under the layout's data directories;
+ * module code, configuration, and the lowering manifest cannot be shadowed.
+ * Paths containing traversal segments are refused before normalization. Later
+ * overlays win for files, while file/directory type conflicts fail loud.
+ * @param image - Uncompressed ustar overlay archive.
+ * @param root - Virtual root shared with the base image.
+ * @param vfs - Mounted filesystem to update.
+ * @returns The same filesystem after applying the overlay.
+ */
+export function loadVfsOverlay(image: Uint8Array, root: string, vfs: MemoryVfs): MemoryVfs {
+  for (const entry of parseTar(image)) {
+    const relativeName = entry.name.startsWith('./') ? entry.name.slice(2) : entry.name
+    const path = relativeName.endsWith('/') ? relativeName.slice(0, -1) : relativeName
+    const segments = path.split('/')
+    if (path === '' || relativeName.startsWith(SEP)
+      || segments.some(segment => segment === '' || segment === '.' || segment === '..')
+      || !IMAGE_OVERLAY_DIRECTORIES.includes(segments[0] ?? '')) {
+      throw new Error(`webworker vfs: overlay entry must stay under ${IMAGE_OVERLAY_DIRECTORIES.join('/ or ')}, received "${entry.name}"`)
+    }
+    const target = join(root, path)
+    if (entry.directory) {
+      vfs.seedDirectory(target, { mode: entry.mode })
       continue
     }
-    vfs.seed(target, entry.bytes, entry.mode)
+    if (vfs.existsSync(target) && vfs.statSync(target).isDirectory()) {
+      throw new Error(`webworker vfs: overlay file cannot replace directory "${target}"`)
+    }
+    vfs.seed(target, entry.bytes, { mode: entry.mode })
   }
   return vfs
 }

packages/experimental/webworker-runtime/src/storage/types.ts

@@ -1,8 +1,8 @@
 /**
  * Filesystem interfaces shared by every VFS backend. The shipped implementation
- * is in memory; a browser-persistent backend would implement the same faces. Errors carry
- * Node's `code` values because roster plugins branch on them (`ENOENT` for
- * optional files, `EACCES` for read-only trees).
+ * is in memory; browser persistence hydrates it and consumes its committed
+ * mutation stream. Errors carry Node's `code` values because roster plugins
+ * branch on them (`ENOENT` for optional files, `EACCES` for read-only trees).
  * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/storage/types
  */
 
@@ -22,7 +22,12 @@ export interface VfsError extends Error {
 /** Subset of `fs.Stats` the roster reads. */
 export interface VfsStats {
   readonly size: number
+  /** Stable file identity across rename and hard links; recreation receives another value. */
+  readonly ino: number
   readonly mtimeMs: number
+  readonly ctimeMs: number
+  readonly atimeMs: number
+  readonly birthtimeMs: number
   readonly mtime: Date
   readonly mode: number
   isFile(): boolean
@@ -49,7 +54,7 @@ export interface VfsBigIntStats {
   readonly mode: bigint
   /** One virtual device holds the whole image. */
   readonly dev: bigint
-  /** Identity of the entry at this path; a removed and recreated path gets a new one. */
+  /** File identity retained across rename and hard links; recreation gets a new one. */
   readonly ino: bigint
   readonly nlink: bigint
   readonly mtimeMs: bigint
@@ -85,6 +90,12 @@ export interface VfsWriteOptions {
   readonly flag?: string
 }
 
+/** Explicit metadata for image or durable-store hydration. */
+export interface VfsSeedOptions {
+  readonly mode?: number
+  readonly mtimeMs?: number
+}
+
 /** Directory entry as `readdir` with `withFileTypes` reports it. */
 export interface VfsDirent {
   readonly name: string
@@ -113,3 +124,126 @@ export interface VfsFileHandle {
   datasync(): Promise<void>
   close(): Promise<void>
 }
+
+/** Open-file identity used by synchronous Node-style descriptors. */
+export interface VfsOpenFile {
+  /** Whether reads are allowed by the flags used at open time. */
+  readonly readable: boolean
+  /** Whether writes and truncation are allowed by the flags used at open time. */
+  readonly writable: boolean
+  /** Whether each write targets the current end of the opened file. */
+  readonly append: boolean
+  /**
+   * Read bytes from the opened file identity.
+   * @param position - Absolute byte offset.
+   * @param length - Maximum byte count.
+   * @returns A view of the available bytes.
+   */
+  read(position: number, length: number): Uint8Array
+  /**
+   * Write bytes to the opened file identity.
+   * @param position - Absolute byte offset, ignored for append descriptors.
+   * @param data - Bytes to write.
+   * @returns Number of bytes written.
+   */
+  write(position: number, data: Uint8Array): number
+  /**
+   * Resize the opened file, zero-filling growth.
+   * @param length - Target byte length.
+   */
+  truncate(length: number): void
+  /**
+   * Read metadata from the opened file identity.
+   * @returns Current file metadata, including after rename or unlink.
+   */
+  stat(): VfsStats
+}
+
+/**
+ * One completed change to the authoritative in-memory filesystem.
+ *
+ * A durable mirror receives the post-write bytes, virtual permission bits, and optional append offset;
+ * live watchers use `entryChanged` to distinguish directory-entry replacement
+ * from content writes. Rename is represented as source removal plus complete
+ * destination mkdir/write records, so a sink never receives a path without the
+ * state needed to materialize it.
+ */
+export type VfsMutation =
+  | {
+    readonly kind: 'write'
+    readonly path: string
+    readonly bytes: Uint8Array
+    readonly mode: number
+    readonly entryChanged: boolean
+    readonly appendedFrom?: number
+  }
+  | { readonly kind: 'mkdir'; readonly path: string; readonly mode: number }
+  | { readonly kind: 'remove'; readonly path: string }
+  | { readonly kind: 'chmod'; readonly path: string; readonly mode: number }
+
+/** Receives one committed VFS mutation. */
+export type VfsMutationListener = (mutation: VfsMutation) => void
+
+/** Durable observer attached to the synchronous VFS. */
+export interface VfsMutationSink {
+  /**
+   * Record one completed mutation without delaying its caller.
+   * @param mutation - Post-commit state to mirror.
+   */
+  record(mutation: VfsMutation): void
+  /**
+   * Settle all previously recorded mutations.
+   * Implementations report persistence failures and stop mirroring rather than
+   * rejecting, because the in-memory mutation has already committed.
+   * @returns A promise that resolves when the sink has no pending work.
+   */
+  flush(): Promise<void>
+}
+
+/** Synchronous filesystem used by the worker's Node compatibility modules. */
+export interface Vfs {
+  readonly promises: {
+    readFile(path: string, options?: VfsReadOptions): Promise<string | Uint8Array>
+    writeFile(path: string, data: string | Uint8Array, options?: VfsWriteOptions): Promise<void>
+    appendFile(path: string, data: string | Uint8Array): Promise<void>
+    mkdir(path: string, options?: { recursive?: boolean; mode?: number }): Promise<string | undefined>
+    readdir(path: string, options?: { withFileTypes?: boolean }): Promise<string[] & VfsDirent[]>
+    stat(path: string, options?: VfsStatOptions): Promise<VfsStats | VfsBigIntStats>
+    lstat(path: string, options?: VfsStatOptions): Promise<VfsStats | VfsBigIntStats>
+    realpath(path: string): Promise<string>
+    rename(from: string, to: string): Promise<void>
+    unlink(path: string): Promise<void>
+    rm(path: string, options?: { recursive?: boolean; force?: boolean }): Promise<void>
+    mkdtemp(prefix: string): Promise<string>
+    link(existing: string, next: string): Promise<void>
+    truncate(path: string, length?: number): Promise<void>
+    chmod(path: string, mode: number): Promise<void>
+    opendir(path: string): Promise<VfsDir>
+    open(path: string, flags?: string, mode?: number): Promise<VfsFileHandle>
+    access(path: string): Promise<void>
+  }
+  readFileSync(path: string, options?: VfsReadOptions): string | Uint8Array
+  existsSync(path: string): boolean
+  statSync(path: string, options?: VfsStatOptions): VfsStats | VfsBigIntStats
+  readdirSync(path: string, options?: { withFileTypes?: boolean }): string[] & VfsDirent[]
+  realpathSync(path: string): string
+  mkdirSync(path: string, options?: { recursive?: boolean; mode?: number }): string | undefined
+  writeFileSync(path: string, data: string | Uint8Array, options?: VfsWriteOptions): void
+  appendFileSync(path: string, data: string | Uint8Array): void
+  renameSync(from: string, to: string): void
+  linkSync(existing: string, next: string): void
+  truncateSync(path: string, length?: number): void
+  chmodSync(path: string, mode: number): void
+  unlinkSync(path: string): void
+  rmSync(path: string, options?: { recursive?: boolean; force?: boolean }): void
+  mkdtempSync(prefix: string): string
+  /** Open and retain one file identity until its Node descriptor closes. */
+  openFileSync(path: string, flags?: string, mode?: number): VfsOpenFile
+  seed(path: string, data: string | Uint8Array, options?: VfsSeedOptions): void
+  seedDirectory(path: string, options?: VfsSeedOptions): void
+  usage(): { files: number; directories: number; bytes: number }
+  /** Register one observer and return its synchronous disposer. */
+  subscribe(listener: VfsMutationListener): () => void
+  /** Settle the attached durable mutation sink, if any. */
+  flush(): Promise<void>
+}

packages/experimental/webworker-runtime/src/transport/frames.ts

@@ -33,12 +33,13 @@ export interface TunnelAbortFrame {
 
 /** Frames the worker accepts. */
 /**
- * First inbound frame: the image URL, the one input the worker assembly
- * takes from outside.
+ * First inbound frame: the base image URL and ordered data overlays selected
+ * before the worker assembly starts.
  */
 export interface TunnelInitFrame {
   readonly t: 'init'
   readonly image: string
+  readonly overlays: readonly string[]
 }
 
 /** Every frame the page sends the worker. */
@@ -142,7 +143,10 @@ export function parseInboundFrame(data: unknown): TunnelInboundFrame {
     if (typeof frame.image !== 'string') {
       throw new Error('webworker tunnel: init frame needs a string image url')
     }
-    return { t: 'init', image: frame.image }
+    if (!Array.isArray(frame.overlays) || frame.overlays.some(overlay => typeof overlay !== 'string')) {
+      throw new Error('webworker tunnel: init frame needs an array of string overlay urls')
+    }
+    return { t: 'init', image: frame.image, overlays: frame.overlays as string[] }
   }
   const id = frame.id
   if (typeof id !== 'string' && typeof id !== 'number') {

packages/experimental/webworker-runtime/src/worker-host.ts

@@ -29,7 +29,7 @@ import { installProcessGlobal } from './node/globals/process.ts'
 import type { RequestListener } from './transport/synthetic-http.ts'
 import { TunnelServer, type TunnelPort } from './transport/tunnel.ts'
 import { inflateImage, inflateImageStream } from './storage/image-gzip.ts'
-import { loadVfsImage, MemoryVfs } from './storage/memory.ts'
+import { loadVfsImage, loadVfsOverlay, MemoryVfs } from './storage/memory.ts'
 import { setActiveVfs } from './storage/active.ts'
 import {
   DEFAULT_ROOT, IMAGE_CONFIG_PATH, IMAGE_EMPTY_DIRECTORIES, IMAGE_HOME_DIRECTORY, IMAGE_MANIFEST_PATH,
@@ -87,6 +87,8 @@ export interface WorkerHostOptions {
   readonly requestListener: () => Promise<RequestListener>
   /** Image bytes, or the URL the worker fetches them from. */
   readonly image: Uint8Array | string
+  /** Ordered data overlays applied after the base image and before boot. */
+  readonly overlays?: readonly (Uint8Array | string)[]
   /** Virtual root; defaults to {@link DEFAULT_ROOT}. */
   readonly root?: string
   /** Composed configuration inside the image; defaults to `<root>/config/cordis.yml`. */
@@ -182,8 +184,12 @@ export function createWorkerHost(options: WorkerHostOptions): WorkerHost {
       const home = join(root, IMAGE_HOME_DIRECTORY)
       installProcessGlobal({ cwd: root, env: { DSH_HOME: home, HOME: home, ...options.env } })
 
-      const bytes = await readImage(options.image)
+      const [bytes, overlays] = await Promise.all([
+        readImage(options.image),
+        Promise.all((options.overlays ?? []).map(readImage)),
+      ])
       const mounted = loadVfsImage(bytes, root)
+      for (const overlay of overlays) loadVfsOverlay(overlay, root, mounted)
       // Belt and braces over the image's own empty-directory entries: a hand
       // -built image without them still boots.
       for (const directory of IMAGE_EMPTY_DIRECTORIES) {
@@ -248,7 +254,7 @@ export function createWorkerHost(options: WorkerHostOptions): WorkerHost {
       const shared = ctx.get('connection') !== undefined
       const handler = directFetchHandler(ctx, toFetchHandler(apiProxy))
       const usage = loader.usage()
-      console.info(`webworker host: tree active (modules=${String(usage.modules)}, preset root overlay=${presetOverlay ? 'applied' : 'already in roster'}, direct lane=${shared ? 'connection.createSharedFetchHandler (interceptors kept)' : 'api surface only'}, als causality=${options.alsCausality === undefined ? 'inert' : 'snapshot/restore'}, image lowering=${LOWERING_VERSION})`)
+      console.info(`webworker host: tree active (modules=${String(usage.modules)}, data overlays=${String(overlays.length)}, preset root overlay=${presetOverlay ? 'applied' : 'already in roster'}, direct lane=${shared ? 'connection.createSharedFetchHandler (interceptors kept)' : 'api surface only'}, als causality=${options.alsCausality === undefined ? 'inert' : 'snapshot/restore'}, image lowering=${LOWERING_VERSION})`)
 
       tunnel.serve({
         directFetch: (request: Request) => handler.fetch(request),

packages/experimental/webworker-runtime/src/worker.ts

@@ -4,9 +4,9 @@
  * listener; the assembly owns everything else (process global, VFS image,
  * Cordis tree, tunnel server).
  *
- * The assembly needs the image location before it can exist, and it arrives in
- * the tunnel's opening `init` frame — this bundle reads nothing from its own
- * URL, so the deployment decides where both the bundle and the image live.
+ * The assembly needs the base image and selected overlays before it can exist;
+ * they arrive in the tunnel's opening `init` frame. This bundle reads nothing
+ * from its own URL, so the deployment decides where every archive lives.
  * Messages before `init` queue here; requests during boot queue inside the
  * host, which attaches its handler before its first await.
  */
@@ -52,12 +52,16 @@ self.addEventListener('message', (event: MessageEvent) => {
     if (typeof data.image !== 'string') {
       throw new Error('webworker: init frame needs a string image url')
     }
+    if (!Array.isArray(data.overlays) || data.overlays.some(overlay => typeof overlay !== 'string')) {
+      throw new Error('webworker: init frame needs an array of string overlay urls')
+    }
     const created = createWorkerHost({
       staticModules: createNodeBuiltins(),
       staticModulePrefixes: REPLACED_PREFIXES,
       requestListener: whenRequestListener,
       alsCausality,
       image: data.image,
+      overlays: data.overlays as string[],
     })
     host = created
     for (const queued of pending) {

packages/experimental/webworker-runtime/tests/client/source-chooser.spec.ts

@@ -0,0 +1,158 @@
+// @vitest-environment jsdom
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PreviewFixtureManifest } from '../../src/fixture-manifest.ts'
+import { choosePreviewSource } from '../../src/client/source-chooser.ts'
+
+const MANIFEST_URL = new URL('https://preview.test/preview/fixtures.json')
+
+const MANIFEST: PreviewFixtureManifest = {
+  version: 1,
+  defaultFixture: 'example',
+  fixtures: [{
+    id: 'example',
+    label: 'Example & <demo> "quoted" \'single\'',
+    description: 'A deterministic example.',
+    overlays: ['fixtures/base.tar.gz', 'fixtures/tail.tar.gz'],
+  }],
+}
+
+function setLocation(search = ''): void {
+  history.replaceState({}, '', `/preview.html${search}`)
+}
+
+function installManifest(manifest: PreviewFixtureManifest = MANIFEST): ReturnType<typeof vi.fn> {
+  const fetch = vi.fn(async () => Response.json(manifest))
+  vi.stubGlobal('fetch', fetch)
+  return fetch
+}
+
+function submitChooser(): void {
+  const form = document.querySelector<HTMLFormElement>('[data-preview-source-card]')
+  if (form === null) throw new Error('test chooser form was not rendered')
+  form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }))
+}
+
+describe('Preview source chooser', () => {
+  beforeEach(() => {
+    document.head.replaceChildren()
+    document.body.innerHTML = '<div id="root"></div>'
+    setLocation()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+    vi.unstubAllGlobals()
+  })
+
+  it('bypasses the chooser and manifest for an explicit empty source', async () => {
+    setLocation('?preview-fixture=none')
+    const fetch = installManifest()
+
+    await expect(choosePreviewSource(MANIFEST_URL)).resolves.toEqual([])
+    expect(fetch).not.toHaveBeenCalled()
+    expect(document.querySelector('[data-preview-source-chooser]')).toBeNull()
+  })
+
+  it('bypasses the chooser and resolves an explicit built-in fixture', async () => {
+    document.body.replaceChildren()
+    setLocation('?preview-fixture=example')
+    const fetch = installManifest()
+
+    await expect(choosePreviewSource(MANIFEST_URL)).resolves.toEqual([
+      new URL('https://preview.test/preview/fixtures/base.tar.gz'),
+      new URL('https://preview.test/preview/fixtures/tail.tar.gz'),
+    ])
+    expect(fetch).toHaveBeenCalledOnce()
+    expect(document.querySelector('[data-preview-source-chooser]')).toBeNull()
+  })
+
+  it.each(['', 'missing', 'webfs'])(
+    'fails loud for the explicit unavailable source %j without opening the chooser',
+    async (source) => {
+      setLocation(`?preview-fixture=${source}`)
+      installManifest()
+
+      await expect(choosePreviewSource(MANIFEST_URL)).rejects.toThrow(/unknown or interactive source/)
+      expect(document.querySelector('[data-preview-source-chooser]')).toBeNull()
+    },
+  )
+
+  it('shows the chooser only when the query is absent and returns its default selection', async () => {
+    installManifest()
+    const root = document.getElementById('root')
+    if (root === null) throw new Error('test root is missing')
+    const bootPage = document.createElement('div')
+    bootPage.dataset.dshBoot = ''
+    root.append(bootPage)
+
+    const selected = choosePreviewSource(MANIFEST_URL)
+    await vi.waitFor(() => {
+      expect(document.querySelector('[data-preview-source-chooser]')).not.toBeNull()
+    })
+    expect(document.querySelector<HTMLInputElement>('input[value="example"]')?.checked).toBe(true)
+    expect(document.querySelector<HTMLInputElement>('input[value="webfs"]')?.disabled).toBe(true)
+    expect(document.querySelector('[data-preview-source-card]')?.textContent)
+      .toContain(MANIFEST.fixtures[0]?.label)
+    expect(document.querySelector('[data-preview-source-card] script')).toBeNull()
+
+    submitChooser()
+
+    await expect(selected).resolves.toEqual([
+      new URL('https://preview.test/preview/fixtures/base.tar.gz'),
+      new URL('https://preview.test/preview/fixtures/tail.tar.gz'),
+    ])
+    expect(root.contains(bootPage)).toBe(true)
+    expect(root.childElementCount).toBe(1)
+    expect(document.querySelector('[data-preview-source-chooser]')).toBeNull()
+    expect(document.querySelector('[data-preview-source-style]')).toBeNull()
+  })
+
+  it('selects the empty source when the manifest has no default', async () => {
+    installManifest({ ...MANIFEST, defaultFixture: null })
+
+    const selected = choosePreviewSource(MANIFEST_URL)
+    await vi.waitFor(() => {
+      expect(document.querySelector<HTMLInputElement>('input[value="none"]')?.checked).toBe(true)
+    })
+    submitChooser()
+
+    await expect(selected).resolves.toEqual([])
+  })
+
+  it('reports manifest, mount, form, selection, and catalog failures', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => new Response('missing', { status: 404 })))
+    await expect(choosePreviewSource(MANIFEST_URL)).rejects.toThrow(/returned 404/)
+
+    installManifest()
+    document.body.replaceChildren()
+    await expect(choosePreviewSource(MANIFEST_URL)).rejects.toThrow(/missing #root/)
+
+    document.body.innerHTML = '<div id="root"></div>'
+    const root = document.getElementById('root')
+    if (root === null) throw new Error('test root is missing')
+    const querySelector = vi.spyOn(HTMLElement.prototype, 'querySelector').mockReturnValueOnce(null)
+    await expect(choosePreviewSource(MANIFEST_URL)).rejects.toThrow(/form was not rendered/)
+    querySelector.mockRestore()
+
+    document.head.replaceChildren()
+    document.body.innerHTML = '<div id="root"></div>'
+    const missingSelection = choosePreviewSource(MANIFEST_URL)
+    await vi.waitFor(() => { expect(document.querySelector('form')).not.toBeNull() })
+    document.querySelectorAll('input[name="preview-source"]').forEach((input) => {
+      input.removeAttribute('name')
+    })
+    submitChooser()
+    await expect(missingSelection).rejects.toThrow(/no source selected/)
+
+    document.head.replaceChildren()
+    document.body.innerHTML = '<div id="root"></div>'
+    const unavailableSelection = choosePreviewSource(MANIFEST_URL)
+    await vi.waitFor(() => { expect(document.querySelector('form')).not.toBeNull() })
+    const selected = document.querySelector<HTMLInputElement>('input:checked')
+    if (selected === null) throw new Error('test selection is missing')
+    selected.value = 'missing'
+    submitChooser()
+    await expect(unavailableSelection).rejects.toThrow(/unavailable source/)
+  })
+})

packages/experimental/webworker-runtime/tests/fixture-manifest.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest'
+import {
+  parsePreviewFixtureManifest, PREVIEW_FIXTURE_MANIFEST_VERSION,
+} from '../src/fixture-manifest.ts'
+
+describe('Preview fixture manifest', () => {
+  it('accepts a unique named fixture with ordered overlays', () => {
+    expect(parsePreviewFixtureManifest({
+      version: PREVIEW_FIXTURE_MANIFEST_VERSION,
+      defaultFixture: 'example',
+      fixtures: [{
+        id: 'example',
+        label: 'Example',
+        description: 'A deterministic example.',
+        overlays: ['fixtures/base.tar.gz', 'fixtures/tail.tar.gz'],
+      }],
+    })).toEqual({
+      version: PREVIEW_FIXTURE_MANIFEST_VERSION,
+      defaultFixture: 'example',
+      fixtures: [{
+        id: 'example',
+        label: 'Example',
+        description: 'A deterministic example.',
+        overlays: ['fixtures/base.tar.gz', 'fixtures/tail.tar.gz'],
+      }],
+    })
+  })
+
+  it.each([
+    [{ version: 2, defaultFixture: null, fixtures: [] }, /must use version/],
+    [{ version: 1, defaultFixture: 'missing', fixtures: [] }, /defaultFixture/],
+    [{
+      version: 1,
+      defaultFixture: 'duplicate',
+      fixtures: [
+        { id: 'duplicate', label: 'One', description: 'First.', overlays: ['one.tar.gz'] },
+        { id: 'duplicate', label: 'Two', description: 'Second.', overlays: ['two.tar.gz'] },
+      ],
+    }, /repeats id/],
+    [{
+      version: 1,
+      defaultFixture: 'none',
+      fixtures: [{ id: 'none', label: 'None', description: 'Reserved.', overlays: ['none.tar.gz'] }],
+    }, /invalid fixture entry/],
+  ])('rejects malformed catalogs', (value, error) => {
+    expect(() => parsePreviewFixtureManifest(value)).toThrow(error)
+  })
+})

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/home/sessions/--dsh-workspace--/preview-architecture-review/session.jsonl

@@ -0,0 +1,178 @@
+{"type":"session","version":0,"id":"preview-architecture-review","createdAt":1787472100000,"cwd":"/dsh/workspace","parentSession":"preview-showcase","seedLength":169,"origin":"subagent","delegationDepth":1,"agentPreset":"standard"}
+{"type":"turn/start","data":{"turn":1},"seq":0,"time":1787472000000}
+{"type":"user/message","data":{"id":"preview-user-01","role":"user","content":[{"type":"text","text":"History checkpoint 01: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":1,"time":1787472000001}
+{"type":"session/title","data":{"title":"WebWorker Preview Showcase","messageSeqs":[],"source":{"kind":"user"}},"seq":2,"time":1787472000002}
+{"type":"step/start","data":{"turn":1,"step":1},"seq":3,"time":1787472000003}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"id":"preview-assistant-01","role":"assistant","content":[{"type":"text","text":"Checkpoint 01 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":4,"time":1787472000004}
+{"type":"step/end","data":{"turn":1,"step":1},"seq":5,"time":1787472000005}
+{"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}},"seq":6,"time":1787472000006}
+{"type":"turn/start","data":{"turn":2},"seq":7,"time":1787472000007}
+{"type":"user/message","data":{"id":"preview-user-02","role":"user","content":[{"type":"text","text":"History checkpoint 02: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":8,"time":1787472000008}
+{"type":"step/start","data":{"turn":2,"step":1},"seq":9,"time":1787472000009}
+{"type":"assistant/message","data":{"turn":2,"step":1,"message":{"id":"preview-assistant-02","role":"assistant","content":[{"type":"text","text":"Checkpoint 02 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":10,"time":1787472000010}
+{"type":"step/end","data":{"turn":2,"step":1},"seq":11,"time":1787472000011}
+{"type":"turn/end","data":{"turn":2,"reason":{"kind":"completed"}},"seq":12,"time":1787472000012}
+{"type":"turn/start","data":{"turn":3},"seq":13,"time":1787472000013}
+{"type":"user/message","data":{"id":"preview-user-03","role":"user","content":[{"type":"text","text":"History checkpoint 03: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":14,"time":1787472000014}
+{"type":"step/start","data":{"turn":3,"step":1},"seq":15,"time":1787472000015}
+{"type":"assistant/message","data":{"turn":3,"step":1,"message":{"id":"preview-assistant-03","role":"assistant","content":[{"type":"text","text":"Checkpoint 03 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":16,"time":1787472000016}
+{"type":"step/end","data":{"turn":3,"step":1},"seq":17,"time":1787472000017}
+{"type":"turn/end","data":{"turn":3,"reason":{"kind":"completed"}},"seq":18,"time":1787472000018}
+{"type":"turn/start","data":{"turn":4},"seq":19,"time":1787472000019}
+{"type":"user/message","data":{"id":"preview-user-04","role":"user","content":[{"type":"text","text":"History checkpoint 04: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":20,"time":1787472000020}
+{"type":"step/start","data":{"turn":4,"step":1},"seq":21,"time":1787472000021}
+{"type":"assistant/message","data":{"turn":4,"step":1,"message":{"id":"preview-assistant-04","role":"assistant","content":[{"type":"text","text":"Checkpoint 04 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":22,"time":1787472000022}
+{"type":"step/end","data":{"turn":4,"step":1},"seq":23,"time":1787472000023}
+{"type":"turn/end","data":{"turn":4,"reason":{"kind":"completed"}},"seq":24,"time":1787472000024}
+{"type":"turn/start","data":{"turn":5},"seq":25,"time":1787472000025}
+{"type":"user/message","data":{"id":"preview-user-05","role":"user","content":[{"type":"text","text":"History checkpoint 05: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":26,"time":1787472000026}
+{"type":"step/start","data":{"turn":5,"step":1},"seq":27,"time":1787472000027}
+{"type":"assistant/message","data":{"turn":5,"step":1,"message":{"id":"preview-assistant-05","role":"assistant","content":[{"type":"text","text":"Checkpoint 05 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":28,"time":1787472000028}
+{"type":"step/end","data":{"turn":5,"step":1},"seq":29,"time":1787472000029}
+{"type":"turn/end","data":{"turn":5,"reason":{"kind":"completed"}},"seq":30,"time":1787472000030}
+{"type":"turn/start","data":{"turn":6},"seq":31,"time":1787472000031}
+{"type":"user/message","data":{"id":"preview-user-06","role":"user","content":[{"type":"text","text":"History checkpoint 06: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":32,"time":1787472000032}
+{"type":"step/start","data":{"turn":6,"step":1},"seq":33,"time":1787472000033}
+{"type":"assistant/message","data":{"turn":6,"step":1,"message":{"id":"preview-assistant-06","role":"assistant","content":[{"type":"text","text":"Checkpoint 06 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":34,"time":1787472000034}
+{"type":"step/end","data":{"turn":6,"step":1},"seq":35,"time":1787472000035}
+{"type":"turn/end","data":{"turn":6,"reason":{"kind":"completed"}},"seq":36,"time":1787472000036}
+{"type":"turn/start","data":{"turn":7},"seq":37,"time":1787472000037}
+{"type":"user/message","data":{"id":"preview-user-07","role":"user","content":[{"type":"text","text":"History checkpoint 07: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":38,"time":1787472000038}
+{"type":"step/start","data":{"turn":7,"step":1},"seq":39,"time":1787472000039}
+{"type":"assistant/message","data":{"turn":7,"step":1,"message":{"id":"preview-assistant-07","role":"assistant","content":[{"type":"text","text":"Checkpoint 07 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":40,"time":1787472000040}
+{"type":"step/end","data":{"turn":7,"step":1},"seq":41,"time":1787472000041}
+{"type":"turn/end","data":{"turn":7,"reason":{"kind":"completed"}},"seq":42,"time":1787472000042}
+{"type":"turn/start","data":{"turn":8},"seq":43,"time":1787472000043}
+{"type":"user/message","data":{"id":"preview-user-08","role":"user","content":[{"type":"text","text":"History checkpoint 08: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":44,"time":1787472000044}
+{"type":"step/start","data":{"turn":8,"step":1},"seq":45,"time":1787472000045}
+{"type":"assistant/message","data":{"turn":8,"step":1,"message":{"id":"preview-assistant-08","role":"assistant","content":[{"type":"text","text":"Checkpoint 08 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":46,"time":1787472000046}
+{"type":"step/end","data":{"turn":8,"step":1},"seq":47,"time":1787472000047}
+{"type":"turn/end","data":{"turn":8,"reason":{"kind":"completed"}},"seq":48,"time":1787472000048}
+{"type":"turn/start","data":{"turn":9},"seq":49,"time":1787472000049}
+{"type":"user/message","data":{"id":"preview-user-09","role":"user","content":[{"type":"text","text":"History checkpoint 09: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":50,"time":1787472000050}
+{"type":"step/start","data":{"turn":9,"step":1},"seq":51,"time":1787472000051}
+{"type":"assistant/message","data":{"turn":9,"step":1,"message":{"id":"preview-assistant-09","role":"assistant","content":[{"type":"text","text":"Checkpoint 09 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":52,"time":1787472000052}
+{"type":"step/end","data":{"turn":9,"step":1},"seq":53,"time":1787472000053}
+{"type":"turn/end","data":{"turn":9,"reason":{"kind":"completed"}},"seq":54,"time":1787472000054}
+{"type":"turn/start","data":{"turn":10},"seq":55,"time":1787472000055}
+{"type":"user/message","data":{"id":"preview-user-10","role":"user","content":[{"type":"text","text":"History checkpoint 10: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":56,"time":1787472000056}
+{"type":"step/start","data":{"turn":10,"step":1},"seq":57,"time":1787472000057}
+{"type":"assistant/message","data":{"turn":10,"step":1,"message":{"id":"preview-assistant-10","role":"assistant","content":[{"type":"text","text":"Checkpoint 10 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":58,"time":1787472000058}
+{"type":"step/end","data":{"turn":10,"step":1},"seq":59,"time":1787472000059}
+{"type":"turn/end","data":{"turn":10,"reason":{"kind":"completed"}},"seq":60,"time":1787472000060}
+{"type":"turn/start","data":{"turn":11},"seq":61,"time":1787472000061}
+{"type":"user/message","data":{"id":"preview-user-11","role":"user","content":[{"type":"text","text":"History checkpoint 11: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":62,"time":1787472000062}
+{"type":"step/start","data":{"turn":11,"step":1},"seq":63,"time":1787472000063}
+{"type":"assistant/message","data":{"turn":11,"step":1,"message":{"id":"preview-assistant-11","role":"assistant","content":[{"type":"text","text":"Checkpoint 11 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":64,"time":1787472000064}
+{"type":"step/end","data":{"turn":11,"step":1},"seq":65,"time":1787472000065}
+{"type":"turn/end","data":{"turn":11,"reason":{"kind":"completed"}},"seq":66,"time":1787472000066}
+{"type":"turn/start","data":{"turn":12},"seq":67,"time":1787472000067}
+{"type":"user/message","data":{"id":"preview-user-12","role":"user","content":[{"type":"text","text":"History checkpoint 12: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":68,"time":1787472000068}
+{"type":"step/start","data":{"turn":12,"step":1},"seq":69,"time":1787472000069}
+{"type":"assistant/message","data":{"turn":12,"step":1,"message":{"id":"preview-assistant-12","role":"assistant","content":[{"type":"text","text":"Checkpoint 12 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":70,"time":1787472000070}
+{"type":"step/end","data":{"turn":12,"step":1},"seq":71,"time":1787472000071}
+{"type":"turn/end","data":{"turn":12,"reason":{"kind":"completed"}},"seq":72,"time":1787472000072}
+{"type":"turn/start","data":{"turn":13},"seq":73,"time":1787472000073}
+{"type":"user/message","data":{"id":"preview-user-13","role":"user","content":[{"type":"text","text":"History checkpoint 13: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":74,"time":1787472000074}
+{"type":"step/start","data":{"turn":13,"step":1},"seq":75,"time":1787472000075}
+{"type":"assistant/message","data":{"turn":13,"step":1,"message":{"id":"preview-assistant-13","role":"assistant","content":[{"type":"text","text":"Checkpoint 13 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":76,"time":1787472000076}
+{"type":"step/end","data":{"turn":13,"step":1},"seq":77,"time":1787472000077}
+{"type":"turn/end","data":{"turn":13,"reason":{"kind":"completed"}},"seq":78,"time":1787472000078}
+{"type":"turn/start","data":{"turn":14},"seq":79,"time":1787472000079}
+{"type":"user/message","data":{"id":"preview-user-14","role":"user","content":[{"type":"text","text":"History checkpoint 14: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":80,"time":1787472000080}
+{"type":"step/start","data":{"turn":14,"step":1},"seq":81,"time":1787472000081}
+{"type":"assistant/message","data":{"turn":14,"step":1,"message":{"id":"preview-assistant-14","role":"assistant","content":[{"type":"text","text":"Checkpoint 14 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":82,"time":1787472000082}
+{"type":"step/end","data":{"turn":14,"step":1},"seq":83,"time":1787472000083}
+{"type":"turn/end","data":{"turn":14,"reason":{"kind":"completed"}},"seq":84,"time":1787472000084}
+{"type":"turn/start","data":{"turn":15},"seq":85,"time":1787472000085}
+{"type":"user/message","data":{"id":"preview-user-15","role":"user","content":[{"type":"text","text":"History checkpoint 15: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":86,"time":1787472000086}
+{"type":"step/start","data":{"turn":15,"step":1},"seq":87,"time":1787472000087}
+{"type":"assistant/message","data":{"turn":15,"step":1,"message":{"id":"preview-assistant-15","role":"assistant","content":[{"type":"text","text":"Checkpoint 15 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":88,"time":1787472000088}
+{"type":"step/end","data":{"turn":15,"step":1},"seq":89,"time":1787472000089}
+{"type":"turn/end","data":{"turn":15,"reason":{"kind":"completed"}},"seq":90,"time":1787472000090}
+{"type":"turn/start","data":{"turn":16},"seq":91,"time":1787472000091}
+{"type":"user/message","data":{"id":"preview-user-16","role":"user","content":[{"type":"text","text":"History checkpoint 16: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":92,"time":1787472000092}
+{"type":"step/start","data":{"turn":16,"step":1},"seq":93,"time":1787472000093}
+{"type":"assistant/message","data":{"turn":16,"step":1,"message":{"id":"preview-assistant-16","role":"assistant","content":[{"type":"text","text":"Checkpoint 16 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":94,"time":1787472000094}
+{"type":"step/end","data":{"turn":16,"step":1},"seq":95,"time":1787472000095}
+{"type":"turn/end","data":{"turn":16,"reason":{"kind":"completed"}},"seq":96,"time":1787472000096}
+{"type":"turn/start","data":{"turn":17},"seq":97,"time":1787472000097}
+{"type":"user/message","data":{"id":"preview-user-17","role":"user","content":[{"type":"text","text":"History checkpoint 17: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":98,"time":1787472000098}
+{"type":"step/start","data":{"turn":17,"step":1},"seq":99,"time":1787472000099}
+{"type":"assistant/message","data":{"turn":17,"step":1,"message":{"id":"preview-assistant-17","role":"assistant","content":[{"type":"text","text":"Checkpoint 17 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":100,"time":1787472000100}
+{"type":"step/end","data":{"turn":17,"step":1},"seq":101,"time":1787472000101}
+{"type":"turn/end","data":{"turn":17,"reason":{"kind":"completed"}},"seq":102,"time":1787472000102}
+{"type":"turn/start","data":{"turn":18},"seq":103,"time":1787472000103}
+{"type":"user/message","data":{"id":"preview-user-18","role":"user","content":[{"type":"text","text":"History checkpoint 18: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":104,"time":1787472000104}
+{"type":"step/start","data":{"turn":18,"step":1},"seq":105,"time":1787472000105}
+{"type":"assistant/message","data":{"turn":18,"step":1,"message":{"id":"preview-assistant-18","role":"assistant","content":[{"type":"text","text":"Checkpoint 18 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":106,"time":1787472000106}
+{"type":"step/end","data":{"turn":18,"step":1},"seq":107,"time":1787472000107}
+{"type":"turn/end","data":{"turn":18,"reason":{"kind":"completed"}},"seq":108,"time":1787472000108}
+{"type":"turn/start","data":{"turn":19},"seq":109,"time":1787472000109}
+{"type":"user/message","data":{"id":"preview-user-19","role":"user","content":[{"type":"text","text":"History checkpoint 19: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":110,"time":1787472000110}
+{"type":"step/start","data":{"turn":19,"step":1},"seq":111,"time":1787472000111}
+{"type":"assistant/message","data":{"turn":19,"step":1,"message":{"id":"preview-assistant-19","role":"assistant","content":[{"type":"text","text":"Checkpoint 19 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":112,"time":1787472000112}
+{"type":"step/end","data":{"turn":19,"step":1},"seq":113,"time":1787472000113}
+{"type":"turn/end","data":{"turn":19,"reason":{"kind":"completed"}},"seq":114,"time":1787472000114}
+{"type":"turn/start","data":{"turn":20},"seq":115,"time":1787472000115}
+{"type":"user/message","data":{"id":"preview-user-20","role":"user","content":[{"type":"text","text":"History checkpoint 20: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":116,"time":1787472000116}
+{"type":"step/start","data":{"turn":20,"step":1},"seq":117,"time":1787472000117}
+{"type":"assistant/message","data":{"turn":20,"step":1,"message":{"id":"preview-assistant-20","role":"assistant","content":[{"type":"text","text":"Checkpoint 20 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":118,"time":1787472000118}
+{"type":"step/end","data":{"turn":20,"step":1},"seq":119,"time":1787472000119}
+{"type":"turn/end","data":{"turn":20,"reason":{"kind":"completed"}},"seq":120,"time":1787472000120}
+{"type":"turn/start","data":{"turn":21},"seq":121,"time":1787472000121}
+{"type":"user/message","data":{"id":"preview-user-21","role":"user","content":[{"type":"text","text":"History checkpoint 21: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":122,"time":1787472000122}
+{"type":"step/start","data":{"turn":21,"step":1},"seq":123,"time":1787472000123}
+{"type":"assistant/message","data":{"turn":21,"step":1,"message":{"id":"preview-assistant-21","role":"assistant","content":[{"type":"text","text":"Checkpoint 21 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":124,"time":1787472000124}
+{"type":"step/end","data":{"turn":21,"step":1},"seq":125,"time":1787472000125}
+{"type":"turn/end","data":{"turn":21,"reason":{"kind":"completed"}},"seq":126,"time":1787472000126}
+{"type":"turn/start","data":{"turn":22},"seq":127,"time":1787472000127}
+{"type":"user/message","data":{"id":"preview-user-22","role":"user","content":[{"type":"text","text":"History checkpoint 22: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":128,"time":1787472000128}
+{"type":"step/start","data":{"turn":22,"step":1},"seq":129,"time":1787472000129}
+{"type":"assistant/message","data":{"turn":22,"step":1,"message":{"id":"preview-assistant-22","role":"assistant","content":[{"type":"text","text":"Checkpoint 22 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":130,"time":1787472000130}
+{"type":"step/end","data":{"turn":22,"step":1},"seq":131,"time":1787472000131}
+{"type":"turn/end","data":{"turn":22,"reason":{"kind":"completed"}},"seq":132,"time":1787472000132}
+{"type":"turn/start","data":{"turn":23},"seq":133,"time":1787472000133}
+{"type":"user/message","data":{"id":"preview-user-23","role":"user","content":[{"type":"text","text":"History checkpoint 23: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":134,"time":1787472000134}
+{"type":"step/start","data":{"turn":23,"step":1},"seq":135,"time":1787472000135}
+{"type":"assistant/message","data":{"turn":23,"step":1,"message":{"id":"preview-assistant-23","role":"assistant","content":[{"type":"text","text":"Checkpoint 23 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":136,"time":1787472000136}
+{"type":"step/end","data":{"turn":23,"step":1},"seq":137,"time":1787472000137}
+{"type":"turn/end","data":{"turn":23,"reason":{"kind":"completed"}},"seq":138,"time":1787472000138}
+{"type":"turn/start","data":{"turn":24},"seq":139,"time":1787472000139}
+{"type":"user/message","data":{"id":"preview-user-24","role":"user","content":[{"type":"text","text":"History checkpoint 24: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":140,"time":1787472000140}
+{"type":"step/start","data":{"turn":24,"step":1},"seq":141,"time":1787472000141}
+{"type":"assistant/message","data":{"turn":24,"step":1,"message":{"id":"preview-assistant-24","role":"assistant","content":[{"type":"text","text":"Checkpoint 24 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":142,"time":1787472000142}
+{"type":"step/end","data":{"turn":24,"step":1},"seq":143,"time":1787472000143}
+{"type":"turn/end","data":{"turn":24,"reason":{"kind":"completed"}},"seq":144,"time":1787472000144}
+{"type":"turn/start","data":{"turn":25},"seq":145,"time":1787472000145}
+{"type":"user/message","data":{"id":"preview-user-25","role":"user","content":[{"type":"text","text":"History checkpoint 25: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":146,"time":1787472000146}
+{"type":"step/start","data":{"turn":25,"step":1},"seq":147,"time":1787472000147}
+{"type":"assistant/message","data":{"turn":25,"step":1,"message":{"id":"preview-assistant-25","role":"assistant","content":[{"type":"text","text":"Checkpoint 25 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":148,"time":1787472000148}
+{"type":"step/end","data":{"turn":25,"step":1},"seq":149,"time":1787472000149}
+{"type":"turn/end","data":{"turn":25,"reason":{"kind":"completed"}},"seq":150,"time":1787472000150}
+{"type":"turn/start","data":{"turn":26},"seq":151,"time":1787472000151}
+{"type":"user/message","data":{"id":"preview-user-26","role":"user","content":[{"type":"text","text":"History checkpoint 26: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":152,"time":1787472000152}
+{"type":"step/start","data":{"turn":26,"step":1},"seq":153,"time":1787472000153}
+{"type":"assistant/message","data":{"turn":26,"step":1,"message":{"id":"preview-assistant-26","role":"assistant","content":[{"type":"text","text":"Checkpoint 26 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":154,"time":1787472000154}
+{"type":"step/end","data":{"turn":26,"step":1},"seq":155,"time":1787472000155}
+{"type":"turn/end","data":{"turn":26,"reason":{"kind":"completed"}},"seq":156,"time":1787472000156}
+{"type":"turn/start","data":{"turn":27},"seq":157,"time":1787472000157}
+{"type":"user/message","data":{"id":"preview-user-27","role":"user","content":[{"type":"text","text":"History checkpoint 27: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":158,"time":1787472000158}
+{"type":"step/start","data":{"turn":27,"step":1},"seq":159,"time":1787472000159}
+{"type":"assistant/message","data":{"turn":27,"step":1,"message":{"id":"preview-assistant-27","role":"assistant","content":[{"type":"text","text":"Checkpoint 27 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":160,"time":1787472000160}
+{"type":"step/end","data":{"turn":27,"step":1},"seq":161,"time":1787472000161}
+{"type":"turn/end","data":{"turn":27,"reason":{"kind":"completed"}},"seq":162,"time":1787472000162}
+{"type":"turn/start","data":{"turn":28},"seq":163,"time":1787472000163}
+{"type":"user/message","data":{"id":"preview-user-28","role":"user","content":[{"type":"text","text":"History checkpoint 28: verify deterministic preview state."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":164,"time":1787472000164}
+{"type":"step/start","data":{"turn":28,"step":1},"seq":165,"time":1787472000165}
+{"type":"assistant/message","data":{"turn":28,"step":1,"message":{"id":"preview-assistant-28","role":"assistant","content":[{"type":"text","text":"Checkpoint 28 is recorded."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":166,"time":1787472000166}
+{"type":"step/end","data":{"turn":28,"step":1},"seq":167,"time":1787472000167}
+{"type":"turn/end","data":{"turn":28,"reason":{"kind":"completed"}},"seq":168,"time":1787472000168}
+{"type":"session/end-seed","data":{},"seq":169,"time":1787472100000}
+{"type":"turn/start","data":{"turn":29},"seq":170,"time":1787472100001}
+{"type":"user/message","data":{"id":"preview-review-user","role":"user","content":[{"type":"text","text":"Review whether the preview fixture is isolated from future WebFS data."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":171,"time":1787472100002}
+{"type":"subagent/descriptor","data":{"version":2,"mode":"one-shot","provider":"fork","label":"Review preview architecture"},"seq":172,"time":1787472100003}
+{"type":"step/start","data":{"turn":29,"step":1},"seq":173,"time":1787472100004}
+{"type":"assistant/message","data":{"turn":29,"step":1,"message":{"id":"preview-review-assistant","role":"assistant","content":[{"type":"text","text":"The bundled fixture is static image content; future WebFS state remains user-owned."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":174,"time":1787472100005}
+{"type":"step/end","data":{"turn":29,"step":1},"seq":175,"time":1787472100006}
+{"type":"turn/end","data":{"turn":29,"reason":{"kind":"completed"}},"seq":176,"time":1787472100007}

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/home/sessions/--dsh-workspace--/preview-follow-up-builder/session.jsonl

@@ -0,0 +1,8 @@
+{"type":"session","version":0,"id":"preview-follow-up-builder","createdAt":1787472200000,"cwd":"/dsh/workspace","parentSession":"preview-showcase","origin":"subagent","delegationDepth":1,"agentPreset":"standard"}
+{"type":"turn/start","data":{"turn":1},"seq":0,"time":1787472200000}
+{"type":"user/message","data":{"id":"preview-builder-user","role":"user","content":[{"type":"text","text":"Check that the Preview workspace can support follow-up tasks."}],"source":{"kind":"user"}},"surfaceOp":"append","seq":1,"time":1787472200001}
+{"type":"subagent/descriptor","data":{"version":2,"mode":"continuable","provider":"spawn","label":"Continue preview verification"},"seq":2,"time":1787472200002}
+{"type":"step/start","data":{"turn":1,"step":1},"seq":3,"time":1787472200003}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"id":"preview-builder-assistant","role":"assistant","content":[{"type":"text","text":"This child is continuable and ready for another verification turn."}],"source":{"kind":"model","provider":"preview-fixture","model":"deterministic"}}},"sourceEventSeqs":[],"surfaceOp":"append","seq":4,"time":1787472200004}
+{"type":"step/end","data":{"turn":1,"step":1},"seq":5,"time":1787472200005}
+{"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}},"seq":6,"time":1787472200006}

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/home/storages/session_projcache.json

@@ -0,0 +1,24 @@
+{
+  "unit": {
+    "name": "session_projcache",
+    "version": 3
+  },
+  "global": null,
+  "tables": {
+    "sessions": {
+      "preview-showcase": {
+        "identity": {
+          "createdAt": 1787472000000,
+          "cwd": "/dsh/workspace"
+        },
+        "rows": {
+          "title": {
+            "ver": 1,
+            "seq": 198,
+            "val": "WebWorker Preview Showcase"
+          }
+        }
+      }
+    }
+  }
+}

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/workspace/.agents/skills/preview-tour/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: preview-tour
+description: Inspect the bundled Preview workspace and its deterministic Session examples.
+---
+
+# Preview tour
+
+Read the workspace files, inspect the tool gallery, open both subagent histories, and load the earlier conversation page.

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/workspace/PREVIEW.md

@@ -0,0 +1,9 @@
+# Preview Workspace
+
+This deterministic workspace is bundled with the browser-only preview.
+
+- `src/preview.ts` is the file changed by the example write result.
+- `data/tasks.json` mirrors the completed preview checklist.
+- `.agents/skills/preview-tour/SKILL.md` proves dot directories survive image packing.
+
+Refresh the preview to restore these image bytes.

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/workspace/data/tasks.json

@@ -0,0 +1,17 @@
+{
+  "title": "Preview verification",
+  "tasks": [
+    {
+      "name": "Inspect tool cards",
+      "status": "completed"
+    },
+    {
+      "name": "Open both subagents",
+      "status": "completed"
+    },
+    {
+      "name": "Load earlier history",
+      "status": "completed"
+    }
+  ]
+}

packages/experimental/webworker-runtime/tests/fixtures/vfs-example/workspace/src/preview.ts

@@ -0,0 +1,3 @@
+export const previewStatus = 'ready'
+
+export const previewFeatures = ['tools', 'subagents', 'pagination'] as const

packages/experimental/webworker-runtime/tests/node/builtins-table.spec.ts

@@ -15,11 +15,11 @@
  */
 import { describe, expect, it } from 'vitest'
 import { createNodeBuiltins, REPLACED_PREFIXES } from '../../src/node/builtins.ts'
-import { WorkerModuleLoader } from '../../src/module-system/module-loader.ts'
+import { WorkerModuleLoader, type WorkerRequire } from '../../src/module-system/module-loader.ts'
 import { MemoryVfs } from '../../src/storage/memory.ts'
 
 /** A loader over an empty image: every specifier below resolves from the table. */
-function loaderRequire(): (specifier: string) => unknown {
+function loaderRequire(): WorkerRequire {
   const vfs = new MemoryVfs()
   vfs.seedDirectory('/dsh')
   const loader = new WorkerModuleLoader({ vfs, root: '/dsh', staticModules: createNodeBuiltins() })
@@ -84,4 +84,12 @@ describe('module identity through the loader', () => {
     const require = loaderRequire()
     expect(() => require('node:dns')).toThrow()
   })
+
+  it('exposes the package search paths used by the VFS resolver', () => {
+    const require = loaderRequire()
+    expect(require.resolve.paths('node:fs')).toBeNull()
+    expect(require.resolve.paths('node:dns')).toBeNull()
+    expect(require.resolve.paths('workspace-package')).toEqual(['/dsh/node_modules'])
+    expect(require.resolve.paths('./local.js')).toEqual(['/dsh'])
+  })
 })

packages/experimental/webworker-runtime/tests/node/child-process.spec.ts

@@ -16,13 +16,22 @@ import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { MemoryVfs } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/storage/memory.ts'
 import { setActiveVfs } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/storage/active.ts'
 import { spawn, spawnSync } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/node/builtin_modules/implemented/child_process.ts'
+import {
+  LAUNCHER_FAILURE_EXIT, grantArgs, launcherPath, probe,
+} from '@deepseek-ai/node-addon-landlock-run'
 import { processAlive, signalProcess } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/node/process-table.ts'
+import { hostFileSystem } from '@deepseek-ai/dsh-experimental-webworker-runtime/src/shell/fs-access.ts'
+import {
+  LANDLOCK_EXECUTABLE, landlockFileSystem, parseLandlockArguments,
+} from '@deepseek-ai/dsh-experimental-webworker-runtime/src/shell/process/landlock.ts'
 import { spawnSubprocess } from '@deepseek-ai/dsh-subprocess-local/src/spawn.ts'
 
 vi.mock('node:child_process', async () =>
   await import('@deepseek-ai/dsh-experimental-webworker-runtime/src/node/builtin_modules/implemented/child_process.ts'))
 
 const WORKSPACE = '/dsh/workspace'
+const HOME = '/dsh/home'
+const TMP = '/dsh/tmp'
 
 let vfs: MemoryVfs
 
@@ -30,6 +39,8 @@ beforeEach(() => {
   vfs = new MemoryVfs()
   setActiveVfs(vfs)
   vfs.mkdirSync(WORKSPACE, { recursive: true })
+  vfs.mkdirSync(HOME, { recursive: true })
+  vfs.mkdirSync(TMP, { recursive: true })
   vi.spyOn(process, 'kill').mockImplementation((pid: number, signal?: string | number): true => {
     if (signal === 0) {
       if (processAlive(pid)) return true
@@ -91,6 +102,191 @@ it('refuses a command name that is not a string, as Node does', () => {
 it('reports that a synchronous run cannot happen, without throwing at the probe', () => {
   expect(spawnSync('bwrap').error?.code).toBe('ENOENT')
   expect(spawnSync('echo').error?.message).toContain('commands run asynchronously')
+  expect(spawnSync(launcherPath(), ['--probe'])).toMatchObject({
+    status: 0,
+    stdout: Buffer.from('landlock: fully enforced\n'),
+  })
+  expect(spawnSync(launcherPath(), ['--ro', '/', '--', 'echo', 'x']).error?.message)
+    .toContain('commands run asynchronously')
+  const failedProbe = spawnSync(launcherPath(), ['--probe', '--'])
+  expect(failedProbe.status).toBe(LAUNCHER_FAILURE_EXIT)
+  expect(Buffer.isBuffer(failedProbe.stderr)).toBe(true)
+})
+
+it('keeps the native Landlock package API and CLI failure contract', async () => {
+  expect(probe()).toBe('full')
+  expect(probe('/not-the-worker-launcher')).toBe('unusable')
+  expect(probe('/another-package-layout/bin/landlock-run')).toBe('full')
+  expect(launcherPath(() => '/ignored/package.json')).toBe('/ignored/bin/landlock-run')
+  expect(LAUNCHER_FAILURE_EXIT).toBe(125)
+  expect(await collect(spawn(launcherPath(), ['--probe']))).toEqual({
+    stdout: 'landlock: fully enforced\n', stderr: '', code: 0,
+  })
+  const malformed = spawn(launcherPath(), ['--rw'], { cwd: WORKSPACE })
+  expect(await collect(malformed)).toEqual({
+    stdout: '',
+    stderr: 'landlock-run: usage error: --rw requires a path\n',
+    code: 125,
+  })
+  const missingGrant = spawn(launcherPath(), ['--rw', '/dsh/missing', '--', 'touch', `${WORKSPACE}/never`], { cwd: WORKSPACE })
+  expect(await collect(missingGrant)).toEqual({
+    stdout: '',
+    stderr: 'landlock-run: cannot open rule path: /dsh/missing: No such file or directory\n',
+    code: 125,
+  })
+  expect(vfs.existsSync(`${WORKSPACE}/never`)).toBe(false)
+  const missingCommand = spawn(launcherPath(), ['--ro', '/', '--', 'not-a-program'], { cwd: WORKSPACE })
+  expect(await collect(missingCommand)).toEqual({
+    stdout: '',
+    stderr: 'landlock-run: exec failed: No such file or directory\n',
+    code: 125,
+  })
+})
+
+it('enforces every ShellFileSystem operation and virtual device edge', async () => {
+  vfs.writeFileSync(`${HOME}/private.txt`, 'private\n')
+  const invocation = parseLandlockArguments([
+    ...grantArgs({ readOnly: ['/dev'], readWrite: [WORKSPACE, '/dev/null'] }), '--', 'true',
+  ])
+  if (invocation.kind !== 'run') throw new Error('expected a confined run invocation')
+  const guarded = await landlockFileSystem(hostFileSystem(), invocation, WORKSPACE)
+
+  expect(await guarded.stat('/dev/null')).toEqual({ directory: false, size: 0, mtimeMs: 0 })
+  expect(await guarded.stat('/dev')).toEqual({ directory: true, size: 0, mtimeMs: 0 })
+  expect(await guarded.list('/dev')).toEqual([{ name: 'null', directory: false }])
+  await expect(guarded.list('/dev/null')).rejects.toMatchObject({ code: 'ENOTDIR' })
+  expect(await guarded.readText('/dev/null')).toBe('')
+  await guarded.writeText('/dev/null', 'discarded')
+  await expect(guarded.mkdir('/dev/null', false)).rejects.toMatchObject({ code: 'EEXIST' })
+  await expect(guarded.remove('/dev/null', { recursive: false, force: false })).rejects.toMatchObject({ code: 'EACCES' })
+  await expect(guarded.rename('/dev/null', `${WORKSPACE}/null`)).rejects.toMatchObject({ code: 'EACCES' })
+  await expect(guarded.stat('/dev/null/child')).rejects.toMatchObject({ code: 'ENOTDIR' })
+  await expect(guarded.writeText('/dev/null/child', 'not written')).rejects.toMatchObject({ code: 'ENOTDIR' })
+  await expect(guarded.mkdir('/dev/null/child', true)).rejects.toMatchObject({ code: 'ENOTDIR' })
+  expect(vfs.existsSync('/dev')).toBe(false)
+  await expect(guarded.readText(`${HOME}/private.txt`)).rejects.toMatchObject({ code: 'EACCES' })
+
+  await guarded.mkdir('created', false)
+  await guarded.writeText('created/file', 'one')
+  await guarded.writeText('created/file', ' two', true)
+  expect(await guarded.readText(`${WORKSPACE}/created/file`)).toBe('one two')
+  expect(await guarded.list(`${WORKSPACE}/created`)).toEqual([{ name: 'file', directory: false }])
+  await guarded.rename('created/file', 'created/moved')
+  await expect(guarded.rename('created/moved', '/dev/null')).rejects.toMatchObject({ code: 'EACCES' })
+  await guarded.remove('created', { recursive: true, force: false })
+  expect(vfs.existsSync(`${WORKSPACE}/created`)).toBe(false)
+})
+
+it('turns an unexpected virtual-launcher preparation failure into exit 125', async () => {
+  const base = hostFileSystem()
+  const result = await LANDLOCK_EXECUTABLE.prepare(
+    ['--ro', '/', '--', 'true'],
+    {
+      cwd: WORKSPACE,
+      filesystem: { ...base, stat: () => Promise.reject(new Error('storage unavailable')) },
+    },
+  )
+  expect(result).toEqual({
+    kind: 'exit', exitCode: 125, stdout: '', stderr: 'landlock-run: Error: storage unavailable\n',
+  })
+})
+
+it.each([
+  { args: [], message: 'missing `-- <argv>...` command' },
+  { args: ['--unknown', '--', 'true'], message: 'unknown argument: --unknown' },
+  { args: ['--probe', '--'], message: '--probe takes no other arguments' },
+  { args: ['--'], message: 'missing `-- <argv>...` command' },
+  { args: ['--rw', '', '--', 'true'], message: 'cannot open rule path' },
+])('rejects malformed Landlock argv before execution: $message', async ({ args, message }) => {
+  const child = spawn(launcherPath(), args, { cwd: WORKSPACE })
+  const result = await collect(child)
+  expect(result.code).toBe(LAUNCHER_FAILURE_EXIT)
+  expect(result.stderr).toContain(message)
+})
+
+it('enforces read-only and workspace-write grants over the VFS', async () => {
+  vfs.writeFileSync(`${HOME}/readable.txt`, 'visible\n')
+  const readOnly = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: ['/'], readWrite: ['/dev/null'] }),
+    '--', 'bash', '-c', `cat ${HOME}/readable.txt; echo discarded > /dev/null; echo denied > ${WORKSPACE}/denied.txt`,
+  ], { cwd: WORKSPACE })
+  const strict = await collect(readOnly)
+  expect(strict.code).toBe(1)
+  expect(strict.stdout).toBe('visible\n')
+  expect(strict.stderr.toLowerCase()).toContain('permission denied')
+  expect(vfs.existsSync(`${WORKSPACE}/denied.txt`)).toBe(false)
+
+  const workspaceWrite = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: ['/'], readWrite: ['/dev/null', '/tmp', WORKSPACE] }),
+    '--', 'bash', '-c', `echo workspace > ${WORKSPACE}/allowed.txt; echo temporary > /tmp/temp.txt; cat /tmp/temp.txt`,
+  ], { cwd: WORKSPACE })
+  expect(await collect(workspaceWrite)).toEqual({ stdout: 'temporary\n', stderr: '', code: 0 })
+  expect(vfs.readFileSync(`${WORKSPACE}/allowed.txt`, 'utf8')).toBe('workspace\n')
+  expect(vfs.readFileSync(`${TMP}/temp.txt`, 'utf8')).toBe('temporary\n')
+  expect(vfs.existsSync('/dev/null')).toBe(false)
+})
+
+it('normalizes relative grants and denies sibling-prefix escapes and unreadable paths', async () => {
+  vfs.mkdirSync(`${WORKSPACE}/nested`)
+  vfs.mkdirSync(`${WORKSPACE}-other`)
+  vfs.writeFileSync(`${HOME}/private.txt`, 'private\n')
+  const child = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: [WORKSPACE], readWrite: ['.'] }),
+    '--', 'bash', '-c', `echo kept > nested/relative.txt; echo escaped > ${WORKSPACE}-other/escape.txt; cat ${HOME}/private.txt`,
+  ], { cwd: WORKSPACE })
+  const result = await collect(child)
+  expect(result.code).toBe(1)
+  expect(result.stderr.toLowerCase()).toContain('permission denied')
+  expect(vfs.readFileSync(`${WORKSPACE}/nested/relative.txt`, 'utf8')).toBe('kept\n')
+  expect(vfs.existsSync(`${WORKSPACE}-other/escape.txt`)).toBe(false)
+  expect(result.stdout).not.toContain('private')
+})
+
+it('treats trailing-slash grants as the same subtree', async () => {
+  const invocation = parseLandlockArguments(['--rw', '/tmp/', '--', 'true'])
+  if (invocation.kind !== 'run') throw new Error('expected a confined run invocation')
+  const guarded = await landlockFileSystem(hostFileSystem(), invocation, WORKSPACE)
+  await guarded.writeText('/tmp/nested.txt', 'allowed')
+  expect(vfs.readFileSync(`${TMP}/nested.txt`, 'utf8')).toBe('allowed')
+})
+
+it('presents the virtual device directory without storing it in the VFS', async () => {
+  const child = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: ['/'], readWrite: ['/dev/null'] }),
+    '--', 'bash', '-c', 'ls /dev; cat /dev/null',
+  ], { cwd: WORKSPACE })
+  expect(await collect(child)).toEqual({ stdout: 'null\n', stderr: '', code: 0 })
+  expect(vfs.existsSync('/dev')).toBe(false)
+})
+
+it('requires both rename paths to be writable', async () => {
+  vfs.writeFileSync(`${WORKSPACE}/source.txt`, 'kept\n')
+  const child = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: ['/'], readWrite: [WORKSPACE] }),
+    '--', 'mv', `${WORKSPACE}/source.txt`, `${HOME}/moved.txt`,
+  ], { cwd: WORKSPACE })
+  const result = await collect(child)
+  expect(result.code).toBe(1)
+  expect(result.stderr.toLowerCase()).toContain('permission denied')
+  expect(vfs.readFileSync(`${WORKSPACE}/source.txt`, 'utf8')).toBe('kept\n')
+  expect(vfs.existsSync(`${HOME}/moved.txt`)).toBe(false)
+})
+
+it('keeps concurrent Landlock grants process-local', async () => {
+  const strict = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: ['/'], readWrite: ['/dev/null'] }),
+    '--', 'bash', '-c', `sleep 0.02; echo denied > ${WORKSPACE}/strict.txt`,
+  ], { cwd: WORKSPACE })
+  const writable = spawn(launcherPath(), [
+    ...grantArgs({ readOnly: ['/'], readWrite: ['/dev/null', WORKSPACE] }),
+    '--', 'bash', '-c', `echo allowed > ${WORKSPACE}/writable.txt`,
+  ], { cwd: WORKSPACE })
+  const [strictResult, writableResult] = await Promise.all([collect(strict), collect(writable)])
+  expect(strictResult.code).toBe(1)
+  expect(strictResult.stderr.toLowerCase()).toContain('permission denied')
+  expect(writableResult).toEqual({ stdout: '', stderr: '', code: 0 })
+  expect(vfs.existsSync(`${WORKSPACE}/strict.txt`)).toBe(false)
+  expect(vfs.readFileSync(`${WORKSPACE}/writable.txt`, 'utf8')).toBe('allowed\n')
 })
 
 it('carries a command through the real local subprocess service', async () => {

packages/experimental/webworker-runtime/tests/node/chokidar.spec.ts

@@ -0,0 +1,210 @@
+/** Upstream Chokidar running unchanged through the shipped Worker module loader. */
+import { existsSync, readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { lowerModuleSource } from '../../src/compile/transform.ts'
+import { WorkerModuleLoader } from '../../src/module-system/module-loader.ts'
+import { createNodeBuiltins } from '../../src/node/builtins.ts'
+import { MemoryVfs } from '../../src/storage/memory.ts'
+import { setActiveVfs } from '../../src/storage/active.ts'
+
+const ROOT = '/dsh/workspace/skills'
+let vfs: MemoryVfs
+let chokidar: typeof import('chokidar')
+const openWatchers: import('chokidar').FSWatcher[] = []
+
+interface ChokidarFixture {
+  readonly label: string
+  readonly consumerManifest: string
+  readonly chokidarFiles: readonly string[]
+  readonly readdirpFiles: readonly string[]
+}
+
+const CHOKIDAR_FIXTURES: readonly ChokidarFixture[] = [
+  {
+    label: 'Chokidar 4 from settings and credentials',
+    consumerManifest: 'packages/settings/settings-file/package.json',
+    chokidarFiles: ['package.json', 'esm/package.json', 'esm/index.js', 'esm/handler.js'],
+    readdirpFiles: ['package.json', 'esm/package.json', 'esm/index.js'],
+  },
+  {
+    label: 'Chokidar 5 from skill-filesystem',
+    consumerManifest: 'packages/skill/skill-filesystem/package.json',
+    chokidarFiles: ['package.json', 'index.js', 'handler.js'],
+    readdirpFiles: ['package.json', 'index.js'],
+  },
+]
+
+/** Copy one installed JavaScript package into the VFS exactly as the packer does. */
+function packageRoot(name: string, entry: string): string {
+  for (let directory = dirname(entry);;) {
+    const manifest = join(directory, 'package.json')
+    if (existsSync(manifest)) {
+      const parsed = JSON.parse(readFileSync(manifest, 'utf8')) as { name?: unknown }
+      if (parsed.name === name) return directory
+    }
+    const parent = dirname(directory)
+    if (parent === directory) throw new Error(`cannot locate package root for ${name}`)
+    directory = parent
+  }
+}
+
+/** Copy the package files selected by the packer's import condition. */
+function mountPackage(name: string, directory: string, files: readonly string[]): void {
+  for (const file of files) {
+    const source = readFileSync(join(directory, file), 'utf8')
+    const path = `/dsh/node_modules/${name}/${file}`
+    vfs.seed(path, file.endsWith('.js') ? lowerModuleSource({ filename: path, source }).code : source)
+  }
+}
+
+/** Load one consumer's exact Chokidar and readdirp versions through the Worker loader. */
+function loadChokidar(fixture: ChokidarFixture): typeof import('chokidar') {
+  const consumerManifest = join(process.cwd(), fixture.consumerManifest)
+  const chokidarEntry = createRequire(consumerManifest).resolve('chokidar')
+  const readdirpEntry = createRequire(chokidarEntry).resolve('readdirp')
+  mountPackage('chokidar', packageRoot('chokidar', chokidarEntry), fixture.chokidarFiles)
+  mountPackage('readdirp', packageRoot('readdirp', readdirpEntry), fixture.readdirpFiles)
+  const loader = new WorkerModuleLoader({ vfs, staticModules: createNodeBuiltins() })
+  return loader.createRequire('/dsh/')('chokidar') as typeof import('chokidar')
+}
+
+beforeEach(() => {
+  vfs = new MemoryVfs()
+  setActiveVfs(vfs)
+  vfs.mkdirSync(ROOT, { recursive: true })
+})
+
+afterEach(async () => {
+  await Promise.all(openWatchers.splice(0).map(async (watcher) => { await watcher.close() }))
+})
+
+/** Await one emitter event while rejecting hangs deterministically. */
+function onceEvent<T>(watcher: import('chokidar').FSWatcher, event: string): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timeout = setTimeout(() => { reject(new Error(`timed out waiting for chokidar ${event}`)) }, 2_000)
+    const emitter = watcher as unknown as {
+      once(name: string, listener: (...args: unknown[]) => void): void
+    }
+    emitter.once(event, (...args: unknown[]) => {
+      clearTimeout(timeout)
+      resolve(args[0] as T)
+    })
+  })
+}
+
+/** Let watcher timers and promise-based stats reach a stable point. */
+async function delay(ms: number): Promise<void> {
+  await new Promise<void>((resolve) => { setTimeout(resolve, ms) })
+}
+
+/** Construct one tracked watcher with deterministic event normalization. */
+function watchPath(path: string, options: import('chokidar').ChokidarOptions = {}): import('chokidar').FSWatcher {
+  const watcher = chokidar.watch(path, {
+    ignoreInitial: true,
+    atomic: false,
+    awaitWriteFinish: false,
+    ...options,
+  })
+  openWatchers.push(watcher)
+  return watcher
+}
+
+describe.each(CHOKIDAR_FIXTURES)('$label running unchanged', (fixture) => {
+  beforeEach(() => {
+    chokidar = loadChokidar(fixture)
+  })
+
+  it('reaches ready and reports a file lifecycle through fs.watch', async () => {
+    const watcher = watchPath(ROOT, { depth: 1 })
+    await onceEvent(watcher, 'ready')
+
+    const directory = `${ROOT}/sample`
+    const file = `${directory}/SKILL.md`
+    const addDirectory = onceEvent<string>(watcher, 'addDir')
+    const addFile = onceEvent<string>(watcher, 'add')
+    vfs.mkdirSync(directory)
+    vfs.writeFileSync(file, '# sample\n')
+    await expect(addDirectory).resolves.toBe(directory)
+    await expect(addFile).resolves.toBe(file)
+
+    const changed = onceEvent<string>(watcher, 'change')
+    vfs.writeFileSync(file, '# changed\n')
+    await expect(changed).resolves.toBe(file)
+
+    await new Promise((resolve) => { setTimeout(resolve, 10) })
+    const removed = onceEvent<string>(watcher, 'unlink')
+    vfs.rmSync(file)
+    await expect(removed).resolves.toBe(file)
+  })
+
+  it('watches a missing file through its existing parent', async () => {
+    const path = '/dsh/home/settings.yaml'
+    vfs.mkdirSync('/dsh/home', { recursive: true })
+    const watcher = watchPath(path)
+    await onceEvent(watcher, 'ready')
+
+    const added = onceEvent<string>(watcher, 'add')
+    vfs.writeFileSync(path, 'theme: dark\n')
+    await expect(added).resolves.toBe(path)
+
+    const removed = onceEvent<string>(watcher, 'unlink')
+    vfs.rmSync(path)
+    await expect(removed).resolves.toBe(path)
+  })
+
+  it('discovers directory children through watchFile polling mode', async () => {
+    const watcher = watchPath(ROOT, { usePolling: true, interval: 5 })
+    await onceEvent(watcher, 'ready')
+    const path = `${ROOT}/standalone.md`
+    const added = onceEvent<string>(watcher, 'add')
+    vfs.writeFileSync(path, '# standalone\n')
+    await expect(added).resolves.toBe(path)
+  })
+
+  it('normalizes a short unlink/add replacement into one atomic change', async () => {
+    const path = `${ROOT}/atomic.md`
+    vfs.writeFileSync(path, 'before')
+    const watcher = watchPath(path, { atomic: 40 })
+    await onceEvent(watcher, 'ready')
+    const events: string[] = []
+    watcher.on('all', (event) => { events.push(event) })
+    const changed = onceEvent<string>(watcher, 'change')
+    vfs.rmSync(path)
+    await delay(5)
+    vfs.writeFileSync(path, 'after')
+    await expect(changed).resolves.toBe(path)
+    await delay(60)
+    expect(events).toEqual(['change'])
+  })
+
+  it('waits for a write burst to stabilize before publishing one add', async () => {
+    const path = `${ROOT}/settling.md`
+    const watcher = watchPath(ROOT, {
+      awaitWriteFinish: { stabilityThreshold: 30, pollInterval: 5 },
+    })
+    await onceEvent(watcher, 'ready')
+    const events: string[] = []
+    watcher.on('all', (event) => { events.push(event) })
+    const added = onceEvent<string>(watcher, 'add')
+    vfs.writeFileSync(path, 'a')
+    await delay(10)
+    vfs.appendFileSync(path, 'b')
+    await delay(10)
+    vfs.appendFileSync(path, 'c')
+    await expect(added).resolves.toBe(path)
+    expect(events).toEqual(['add'])
+  })
+
+  it('emits nothing after close has reached quiescence', async () => {
+    const watcher = watchPath(ROOT)
+    const events: string[] = []
+    watcher.on('all', (event) => { events.push(event) })
+    await onceEvent(watcher, 'ready')
+    await watcher.close()
+    vfs.writeFileSync(`${ROOT}/after.md`, '# after\n')
+    await Promise.resolve()
+    expect(events).toEqual([])
+  })
+})