The filesystem stack: a provider contract (execution-world paths, bounded text IO, and atomic mutation with an optional version guard), a local implementation, a policy gate plugin (observed-state + read-before-edit + version-guarded write/edit), the model-facing file tools + executor, and the ripgrep-backed discovery tools. All product packages.

Package	Role	ctx key
`fs/`	Service Definition: canonical process paths/file URIs/containment, text IO, and atomic mutation primitives; owns the `fs/*` policy events	`ctx.fs`
`fs-local/`	Local-filesystem `FileSystem` implementation	(registers `ctx.fs`)
`e2b/fs-e2b`	E2B-backed `FileSystem` implementation sharing the remote runtime owned by `ctx.e2b`	(registers `ctx.fs`)
`fs-sandbox/`	Sandbox-enforcing `FileSystem`: extends `fs-local` and fences write/edit by the per-call mode + workspace root policy (read-only denies, workspace-write contains to the session workspace + temp roots), reads pass through	(registers `ctx.fs`)
`fs-policy/`	Policy gate plugin: observed-state + read-before-edit + version-guarded write/edit, via the `fs/*` event gate	(no service — `fs/*` listeners)
`tool-fs/`	Model-facing `read`/`write`/`edit` tools AND the executor (reads via `ctx.fs`, owns read windowing, dispatches `fs/*`); preserves filesystem semantics for session-cwd-relative paths and advertises sandbox escalation fields when the mounted `ctx.fs` confines	(registers on `ctx.tools`)
`tool-fs-search/`	Model-facing `glob`/`grep` discovery tools backed by the packaged `@vscode/ripgrep` binary spawned through `ctx.subprocess`, NOT by `ctx.fs` provider methods	(registers on `ctx.tools`)

The Service Definition lives at fs/fs/. A sandboxed, remote, or project-scoped filesystem backend can replace fs-local without touching the Service Definition, policy gate, or model-facing tool schemas: fs-sandbox provides an in-process path fence over the shared sandbox mode (decision), while fs-e2b places file state in the remote execution world shared with the E2B subprocess provider (decision). The policy (fs-policy/) is a plugin that participates only through the fs/* event gate, not a service the tool injects — so dropping it gracefully loses the policy and leaves the unconstrained bare provider rather than breaking the tool. A deployment that loads tool-fs/ is expected to also load it. The mode fence and the read-before-edit gate are orthogonal and compose. Discovery (tool-fs-search/) deliberately does NOT extend the provider contract: search is a process-backed rg workflow (the packaged @vscode/ripgrep binary spawned through ctx.subprocess), so filesystem backends stay free of a universal search contract; its tools register unconditionally, and its results are follow-up-readable when the search workdir and the read root are the same workspace (the co-located deployment its README documents).

No timeouts on file IO

read/write/edit take no timeoutMs and the provider contract arms no deadline: file IO here runs untimed because a deadline would kill work the OS will still finish — see the filesystem subsystem page. Cancellation still propagates through the tool-execution signal for best-effort abort at syscall boundaries.

The subsystem reference — targets, outcomes, guards, policy events, the error taxonomy, and why file IO takes no timeout — is docs/subsystems/filesystem.md; the sandbox fence in the cross-family fs sandbox Agent Note.