Huanqi Cao
acac2149a5
The Windows platform layer previously kept fs path-rule confinement (sandbox-policy + fs-sandbox) next to the unconfined pwsh shell. Windows has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the shell can bypass fs-only path rules with one command — the policy was theater. The layer now removes the whole sandbox stack (sandbox, sandbox-policy, fs-sandbox disabled), mounts the unconfined dsh-fs-local, and degrades to danger-full-access: permission/ui-permission leave the roster and the approval policy is 'never'. dsh-base declares dsh-fs-local so the profile module fallback links it for cold starts; base.spec.ts pins the shipped Windows roster (disables, inserts, approval policy); the Agent Note records the rejected fs-only confinement alternative.
@deepseek-ai/dsh-base
English | 中文
The shared dsh core as a profile bundle: cordis.patch.yml inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's dsh.profile.bundles list. Later bundle layers (e.g. dsh-web-app) and the user's profile cordis.patch.yml override these rows by id; a patch replaces a row's whole config, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the universal patch through the dsh.bundle.patch manifest field, and the launcher reads the Windows platform layer below from code on win32 hosts.
Windows hosts booting a shipped profile additionally receive windows.cordis.patch.yml: it disables the POSIX-only sandboxed stacks — the bash executor/tool, the permission switcher (dsh-permission requires a confining executor), and the sandbox/fs-policy stack — and inserts the PowerShell executor and tool (@deepseek-ai/dsh-pwsh-local, @deepseek-ai/dsh-tool-pwsh) plus the unconfined dsh-fs-local, with the approval policy set to never. Windows has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the shipped posture is honest danger-full-access rather than a boundary only the fs tools pretend to enforce. The launcher applies the layer between the bundle layers and the user layers on win32 hosts; a Windows host that prefers the bash stack overrides these rows through its profile or home cordis.patch.yml. POSIX hosts never receive it.
The row set and its rationale are documented inline in the patch file; the generated composition graph renders it.
Model Experience
Indirectly, through the inserted rows: this bundle selects the shipped persona-less prompt base, tool set, and DeepSeek adapter that mode bundles specialize, and contributes no model-visible text of its own.
KV Cache effect
None directly; each inserted row's package owns its effect.
Known Limitations and Deferred Work
- A patch replaces whole row configs — profile overrides must restate every field a row keeps; there is no deep-merge layer.
- Windows has no sandbox — no OS runner exists on win32 (landlock/bwrap/seatbelt are POSIX-only), so the Windows platform layer removes the whole sandbox stack:
sandbox/sandbox-policy/fs-sandboxare disabled,dsh-fs-localprovidesctx.fs, the permission switcher leaves the roster, and the approval policy isnever. Everything degrades to danger-full-access: the shell is unconfined and the fs tools make no confinement claims.