DEVELOPMENT DOCUMENTATION / FILESYSTEMS

Confined files, shared across agent frameworks.

A shared TypeScript client speaks 9P2000.L over an authenticated consumer WebSocket to a scoped filesystem export.

Framework adapters

These are export subpaths in the source package, not four independently published npm packages. The rebrand does not rename these identifiers. Use the checkout's package metadata rather than assuming a public registry release.

Ownership and authorization

The application owns the connection. Adapters borrow it and must not change its token, endpoint, root or grant. Closing one adapter must not close another adapter's handles. Cross-user connection sharing is prohibited.

Semantic boundaries

• Paths are virtual and constrained to the exported root.
• Write permission comes from server grants and local policy, not an SDK option.
• Symlink and no-follow behavior must be enforced by the provider; a string-only path check is not enough.
• Transport replay cannot establish whether a mutation completed.
• SDK-native retries must not turn an unknown write outcome into a duplicate write.

Integration caveats

Files SDK needs its own matching FilesError class instance so failures keep their intended retry semantics. The pinned just-bash API includes synchronous metadata helpers that cannot perform asynchronous remote enumeration. Consult the source adapter contract before assuming complete filesystem equivalence.

Verification scope

Four native adapters have compilation/contract evidence. The shared TypeScript client and one adapter have real relay/device socket evidence. That does not prove every adapter end to end on every host; Linux confinement and second-host acceptance remain separate gates.