Marc-André Moreau (mamoreau-devolutions) · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
@@ -130,9 +130,13 @@ jobs:
           ) | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
 
   build:
-    name: Build and test
+    name: Build and test (PowerShell ${{ matrix.powershell }})
     runs-on: windows-latest
     needs: release-metadata
+    strategy:
+      fail-fast: false
+      matrix:
+        powershell: ['7.4.6', '7.5.11', '7.6.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -162,10 +166,12 @@ jobs:
 
       - name: Test
         # Engine tests resolve the separately installed runtime; it is not a DT package payload.
-        run: pwsh -NoLogo -NoProfile -File scripts/Install-IsebergTestPowerShell.ps1
+        run: pwsh -NoLogo -NoProfile -File scripts/Install-IsebergTestPowerShell.ps1 -Version ${{ matrix.powershell }}
 
       - name: Run tests
-        timeout-minutes: 60
+        # Hosted Windows runners can spend several seconds starting each isolated pwsh.
+        # Keep the per-test hang guard below; budget the complete sequential UI suite separately.
+        timeout-minutes: 120
         run: >-
           dotnet test Devolutions.Terminal.slnx -c Release --no-build -m:1
           -p:EnablePowerShellIse=true -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
@@ -177,7 +183,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: windows-test-diagnostics
+          name: windows-test-diagnostics-${{ matrix.powershell }}
           path: artifacts/test-results/windows
           if-no-files-found: ignore
           retention-days: 7
@@ -266,20 +272,19 @@ jobs:
           -c Release
           -r ${{ matrix.rid }}
           --self-contained
-          -p:EnablePowerShellIse=false
           -p:PublishAot=true
           -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
           -o artifacts/${{ matrix.rid }}
 
-      - name: Check opt-in managed Iseberg desktop
+      - name: Check terminal-only NativeAOT desktop
         run: >
           dotnet publish src/Devolutions.Terminal/Devolutions.Terminal.csproj
           -c Release
           -r ${{ matrix.rid }}
           --self-contained
-          -p:EnablePowerShellIse=true
+          -p:EnablePowerShellIse=false
           -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
-          -o artifacts/iseberg-validation/${{ matrix.rid }}
+          -o artifacts/terminal-only-validation/${{ matrix.rid }}
 
       - name: Upload NativeAOT desktop
         uses: actions/upload-artifact@v4
@@ -289,9 +294,13 @@ jobs:
           if-no-files-found: error
 
   linux-managed:
-    name: Linux managed and metadata tests
+    name: Linux managed and metadata tests (PowerShell ${{ matrix.powershell }})
     runs-on: ubuntu-24.04
     needs: release-metadata
+    strategy:
+      fail-fast: false
+      matrix:
+        powershell: ['7.4.6', '7.5.11', '7.6.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -316,7 +325,7 @@ jobs:
         run: dotnet restore Devolutions.Terminal.slnx -p:Configuration=Release -p:EnablePowerShellIse=true -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
 
       - name: Run managed tests
-        run: pwsh -NoLogo -NoProfile -File scripts/Install-IsebergTestPowerShell.ps1
+        run: pwsh -NoLogo -NoProfile -File scripts/Install-IsebergTestPowerShell.ps1 -Version ${{ matrix.powershell }}
 
       - name: Test managed projects
         run: dotnet test Devolutions.Terminal.slnx -c Release --no-restore -p:EnablePowerShellIse=true -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
@@ -325,9 +334,13 @@ jobs:
         run: bash scripts/Test-LinuxPackagingMetadata.sh
 
   macos-managed:
-    name: macOS managed and metadata tests
+    name: macOS managed and metadata tests (PowerShell ${{ matrix.powershell }})
     runs-on: macos-26
     needs: release-metadata
+    strategy:
+      fail-fast: false
+      matrix:
+        powershell: ['7.4.6', '7.5.11', '7.6.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -352,7 +365,7 @@ jobs:
         run: dotnet restore Devolutions.Terminal.slnx -p:Configuration=Release -p:EnablePowerShellIse=true -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
 
       - name: Run managed tests
-        run: pwsh -NoLogo -NoProfile -File scripts/Install-IsebergTestPowerShell.ps1
+        run: pwsh -NoLogo -NoProfile -File scripts/Install-IsebergTestPowerShell.ps1 -Version ${{ matrix.powershell }}
 
       - name: Test managed projects
         run: dotnet test Devolutions.Terminal.slnx -c Release --no-restore -p:EnablePowerShellIse=true -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
@@ -407,7 +420,6 @@ jobs:
           -c Release
           -r ${{ matrix.rid }}
           --self-contained true
-          -p:EnablePowerShellIse=false
           -p:PublishAot=true
           -p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}
           -p:DebugSymbols=false
@@ -696,7 +708,6 @@ jobs:
             "-c", "Release",
             "-r", "${{ matrix.rid }}",
             "--self-contained", "true",
-            "-p:EnablePowerShellIse=false",
             "-p:PublishAot=true",
             "-p:VersionPrefix=${{ needs.release-metadata.outputs.release_version }}",
             "-p:DebugSymbols=false",
@@ -1329,8 +1340,8 @@ jobs:
         env:
           EXPECTED_PUBLISHER: ${{ steps.signing-mode.outputs.publisher }}
         run: |
-          ./src/Devolutions.Terminal.Package/Scripts/Test-WindowsPayloadSignatures.ps1 -PayloadDirectory artifacts/msi/layout/win-x64 -ExpectedPublisher $env:EXPECTED_PUBLISHER
-          ./src/Devolutions.Terminal.Package/Scripts/Test-WindowsPayloadSignatures.ps1 -PayloadDirectory artifacts/msi/layout/win-arm64 -ExpectedPublisher $env:EXPECTED_PUBLISHER
+          ./src/Devolutions.Terminal.Package/Scripts/Test-WindowsPayloadSignatures.ps1 -PayloadDirectory artifacts/msi/layout/win-x64 -RequireIsebergModule -ExpectedPublisher $env:EXPECTED_PUBLISHER
+          ./src/Devolutions.Terminal.Package/Scripts/Test-WindowsPayloadSignatures.ps1 -PayloadDirectory artifacts/msi/layout/win-arm64 -RequireIsebergModule -ExpectedPublisher $env:EXPECTED_PUBLISHER
 
       - name: Upload Windows x64 NuGet payload
         uses: actions/upload-artifact@v4

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -23,20 +23,22 @@ The browser never supplies a command line, and the host does not send one back.
 Elevated profiles are listed and refused.
 
 Warnings are errors. Keep the default NativeAOT desktop publish green.
-Iseberg is disabled by default; its managed developer build and regression suite
-require `-p:EnablePowerShellIse=true`. See [Iseberg](docs/iseberg.md) for the
-installed-engine boundary.
+Iseberg is enabled by default; its engine and regression suite require separately
+installed PowerShell 7.4.6+ within 7.4.x, 7.5.x or 7.6.x with its bundled runtime.
+See [Iseberg](docs/iseberg.md) for the
+subprocess/module boundary.
 
 ## Desktop publish
 
 ```powershell
 dotnet publish src/Devolutions.Terminal -c Release -r win-x64 --self-contained
 ```
 
-The default desktop and release packages use NativeAOT and exclude Iseberg.
-Add `-p:EnablePowerShellIse=true` only for an optional managed, untrimmed
-Iseberg developer build. Use the same flag for restore/build/test/run commands
-when working on Iseberg. The CLI remains NativeAOT in both variants.
+The default desktop and release packages use NativeAOT and include Iseberg.
+Only the private PowerShell bridge is managed: it is imported by the installed
+`pwsh` subprocess, never loaded into DT. Use `-p:EnablePowerShellIse=false`
+consistently across build/test/publish commands for a terminal-only configuration.
+The CLI remains NativeAOT in both variants.
 
 Linux packages:
 

diff --git a/Devolutions.Terminal.slnx b/Devolutions.Terminal.slnx
@@ -17,8 +17,10 @@
     <Project Path="src/Devolutions.Terminal/Devolutions.Terminal.csproj" />
   </Folder>
   <Folder Name="/src/Devolutions.Terminal.Ise/">
+    <Project Path="src/Devolutions.Terminal.Ise/Iseberg.Contracts/Iseberg.Contracts.csproj" />
     <Project Path="src/Devolutions.Terminal.Ise/Iseberg.Core/Iseberg.Core.csproj" />
     <Project Path="src/Devolutions.Terminal.Ise/Iseberg.Editor/Iseberg.Editor.csproj" />
+    <Project Path="src/Devolutions.Terminal.Ise/Iseberg.PowerShell/Iseberg.PowerShell.csproj" />
     <Project Path="src/Devolutions.Terminal.Ise/Iseberg/Iseberg.csproj" />
   </Folder>
   <Folder Name="/tests/">

diff --git a/Directory.Build.props b/Directory.Build.props
@@ -18,7 +18,7 @@
     <InvariantGlobalization>false</InvariantGlobalization>
     <NuGetAudit>true</NuGetAudit>
     <NuGetAuditMode>direct</NuGetAuditMode>
-    <EnablePowerShellIse Condition="'$(EnablePowerShellIse)' == ''">false</EnablePowerShellIse>
+    <EnablePowerShellIse Condition="'$(EnablePowerShellIse)' == ''">true</EnablePowerShellIse>
     <DevolutionsTerminalWindowsIcon>$(MSBuildThisFileDirectory)assets\icons\terminal.ico</DevolutionsTerminalWindowsIcon>
   </PropertyGroup>
 </Project>
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -12,7 +12,7 @@
     <PackageVersion Include="Avalonia.Skia" Version="12.1.1" />
     <PackageVersion Include="AvaloniaUI.DiagnosticsSupport" Version="2.2.3" />
     <PackageVersion Include="Avalonia.AvaloniaEdit" Version="12.0.0" />
-    <PackageVersion Include="Microsoft.PowerShell.SDK" Version="7.6.6" />
+    <PackageVersion Include="Microsoft.PowerShell.SDK" Version="7.4.20" />
     <PackageVersion Include="SkiaSharp" Version="3.119.4" />
     <PackageVersion Include="SkiaSharp.HarfBuzz" Version="3.119.4" />
     <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />

diff --git a/README.md b/README.md
@@ -7,8 +7,8 @@ as a self-contained **NativeAOT** desktop app, and rendered with **Avalonia 12**
 - Azure Cloud Shell for remote Azure sessions
 - selectable built-in or **Ghostty** VT engine
 - Windows Terminal-compatible `settings.json`, actions, keybindings, and `dt` CLI
-- optional source-integrated **Iseberg** PowerShell ISE profiles in managed
-  developer builds only (disabled in default NativeAOT builds and release packages)
+- source-integrated **Iseberg** PowerShell ISE profiles, with execution in an
+  owned PowerShell subprocess and a NativeAOT desktop
 
 This is the [Devolutions Terminal](https://github.com/Devolutions/devolutions-terminal)
 source tree. Projects, namespaces, and the GUI host use `Devolutions.Terminal.*`.
@@ -40,11 +40,11 @@ dotnet publish src/Devolutions.Terminal -c Release -r win-x64 --self-contained
 The executable is written to
 `src/Devolutions.Terminal/bin/Release/net10.0/win-x64/publish/Devolutions.Terminal.exe`.
 
-The default desktop and `dt` CLI are NativeAOT. Release packages exclude Iseberg.
-An explicitly opted-in `-p:EnablePowerShellIse=true` developer build uses a
-managed, untrimmed desktop and separately installed compatible PowerShell; see
-[docs/iseberg.md](docs/iseberg.md). Saved Iseberg profiles remain intact, but
-cannot launch in the default build.
+The default desktop and `dt` CLI are NativeAOT. Desktop release packages include
+Iseberg and its private managed bridge module; PowerShell itself must be installed
+separately and is required only when opening an Iseberg profile. See
+[docs/iseberg.md](docs/iseberg.md). Use `-p:EnablePowerShellIse=false` for an explicit
+terminal-only build; saved Iseberg profiles remain intact but cannot launch there.
 
 macOS app bundles (Darwin only):
 

diff --git a/docs/iseberg-parity.md b/docs/iseberg-parity.md
@@ -1,8 +1,8 @@
 # Original Windows PowerShell ISE feature comparison
 
-DT's source-integrated Iseberg in an explicitly enabled managed developer build
-already covers the main edit/run/debug workflow. Default NativeAOT builds and
-release packages disable Iseberg; saved profile settings are preserved.
+DT's source-integrated Iseberg covers the main edit/run/debug workflow in the
+NativeAOT desktop, with PowerShell execution isolated in an owned `pwsh`
+subprocess. Default desktop releases include the workbench and its private bridge.
 The integration now matches additional portable ISE features, but this is **not a
 drop-in replacement for the original `$psISE` object model, WPF add-ons, or
 Windows PowerShell 5.1**. Several features exist in the imported workbench but
@@ -78,14 +78,14 @@ Evidence codes in the matrices refer to these concrete implementation surfaces:
 | Code | DT / imported source |
 | --- | --- |
 | `L` | [DT tab creation and closing](../src/Devolutions.Terminal.App/Views/MainWindow.PowerShellIse.cs), [tab host options](../src/Devolutions.Terminal.App/Views/PowerShellIseTab.cs) |
-| `R` | `src\Devolutions.Terminal.Ise\Iseberg.Core\PowerShellSession*.cs`, `WorkbenchHost.cs` |
+| `R` | [parent IPC session](../src/Devolutions.Terminal.Ise/Iseberg.Core/PowerShellSession.cs), [child execution/custom host](../src/Devolutions.Terminal.Ise/Iseberg.PowerShell) |
 | `C` | [native console adapter](../src/Devolutions.Terminal.App/Connections/IsebergTerminalConnection.cs), [console control bridge](../src/Devolutions.Terminal.App/Views/DtIsebergConsole.cs) |
-| `E` | [editor control](../src/Devolutions.Terminal.Ise/Iseberg.Editor/PowerShellEditorControl.cs), [analysis](../src/Devolutions.Terminal.Ise/Iseberg.Core/EditorAnalysis.cs), [rendering](../src/Devolutions.Terminal.Ise/Iseberg/EditorRendering.cs) |
+| `E` | [editor control](../src/Devolutions.Terminal.Ise/Iseberg.Editor/PowerShellEditorControl.cs), [analysis contracts/helpers](../src/Devolutions.Terminal.Ise/Iseberg.Contracts), [child parser](../src/Devolutions.Terminal.Ise/Iseberg.PowerShell), [rendering](../src/Devolutions.Terminal.Ise/Iseberg/EditorRendering.cs) |
 | `W` | [workbench editor, commands, help, and snippet actions](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.axaml.cs) |
-| `F` | [persistence/recovery integration](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.Persistence.cs), `Iseberg.Core\ScriptRecovery.cs`, `ScriptFile.cs` |
-| `N` | [snippet service](../src/Devolutions.Terminal.Ise/Iseberg.Core/IseSnippetService.cs), `Iseberg.Core\SnippetCatalog.cs` |
-| `B` | [debugger UI](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.Debugger.cs), `Iseberg.Core\PowerShellSession.Debugger.cs`, `DebuggerModels.cs` |
-| `O` | [ISE scripting wrappers](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.Scripting.cs) |
+| `F` | [persistence/recovery integration](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.Persistence.cs), `Iseberg.Core\ScriptRecovery.cs`, shared file models in [contracts](../src/Devolutions.Terminal.Ise/Iseberg.Contracts) |
+| `N` | [snippet service](../src/Devolutions.Terminal.Ise/Iseberg.Core/IseSnippetService.cs), shared catalog models in [contracts](../src/Devolutions.Terminal.Ise/Iseberg.Contracts), cmdlets in [the child module](../src/Devolutions.Terminal.Ise/Iseberg.PowerShell) |
+| `B` | [debugger UI](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.Debugger.cs), [child debugger](../src/Devolutions.Terminal.Ise/Iseberg.PowerShell), DTOs in [contracts](../src/Devolutions.Terminal.Ise/Iseberg.Contracts) |
+| `O` | [ISE scripting UI wrappers](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.Scripting.cs), [typed reverse dispatch](../src/Devolutions.Terminal.Ise/Iseberg/WorkbenchControl.ScriptingBridge.cs), child proxies in [the module](../src/Devolutions.Terminal.Ise/Iseberg.PowerShell) |
 | `P` | [DT themes](../src/Devolutions.Terminal.Settings/IsebergThemes.cs), `Iseberg\OptionsWindow.axaml.cs`, `Iseberg.Core\UserSettings.cs` |
 | `A` | [editor accessibility peer](../src/Devolutions.Terminal.Ise/Iseberg.Editor/AccessibleTextEditor.cs), installed AvaloniaEdit editing handlers |