dsh-win32 v0.4.0

Two firsts.

The sandboxed persistent shell. MSYS bash dies under the workspace-write restricted token (cygheap TokenDefaultDacl 0xC0000022, measured), but busybox-w32 ash has no cygheap and survives. npx dsh-win32 setup --sandboxed installs the minimal-windows-sandboxed preset (busybox downloaded on consent, GPLv2, never bundled). Proven on windows-latest CI with a full send/read round-trip inside the restricted token, now a required CI job. The trade-off is ash, not bash.

Legacy-encoding reads (dsh-win32/fs). Stock DSH refuses GBK/UTF-16 files outright (FS_NOT_TEXT), locking agents out of Chinese-locale legacy projects. Both presets now mount a reader that sniffs and transparently decodes GBK and UTF-16 on reads. Writes stay UTF-8, so editing a legacy file converts it. Deliberate and documented.

Also documented. PTY output of legacy-codepage native tools is unfixable at the plugin layer (node-pty decodes UTF-8 before DSH sees bytes). Shipped presets are unaffected since Git Bash and busybox default to UTF-8.

Upgrade with dsh plugin --profile web add dsh-win32@0.4.0 && npx dsh-win32 setup --sandboxed