diff --git a/apps/cli/package.json b/apps/cli/package.json
index 5e4f189517..4673e64bc4 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -25,6 +25,7 @@
     "@deepseek-ai/dsh-pty": "workspace:^",
     "@deepseek-ai/dsh-pty-local": "workspace:^",
     "@deepseek-ai/dsh-pwsh-local": "workspace:^",
+    "@deepseek-ai/dsh-pwsh-sandbox": "workspace:^",
     "@deepseek-ai/dsh-session-reference": "workspace:^",
     "@deepseek-ai/dsh-tmux-context": "workspace:^",
     "@deepseek-ai/dsh-tool-ask-user": "workspace:^",
diff --git a/apps/cli/src/windows-shell.ts b/apps/cli/src/windows-shell.ts
index 6bdca7b741..0058d89d38 100644
--- a/apps/cli/src/windows-shell.ts
+++ b/apps/cli/src/windows-shell.ts
@@ -2,7 +2,7 @@
  * The Windows shell platform layer: on win32 hosts the shipped profile
  * compositions swap the POSIX-only bash stack for the sandbox-confined
  * PowerShell stack (`@deepseek-ai/dsh-pwsh-sandbox` +
- * `@deepseek-ai/dsh-tool-pwsh`), matching the Windows-pwsh-default roadmap. The layer is the base bundle's
+ * `@deepseek-ai/dsh-tool-pwsh`). The layer is the base bundle's
  * `windows.cordis.patch.yml`, injected by the launcher between the bundle
  * layers and the user layers so a user patch can still override it — the
  * only override channel is composition config, like every other roster
diff --git a/apps/cli/tests/windows-shell.spec.ts b/apps/cli/tests/windows-shell.spec.ts
index 15f5e0521b..cc77619f8c 100644
--- a/apps/cli/tests/windows-shell.spec.ts
+++ b/apps/cli/tests/windows-shell.spec.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from 'vitest'
-import { mkdtempSync, writeFileSync, rmSync, mkdirSync } from 'node:fs'
+import { mkdtempSync, writeFileSync, rmSync, mkdirSync, readFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -97,6 +97,13 @@ describe('the shipped Windows composition (real bundle layers)', () => {
     for (const id of ['pwsh-sandbox', 'tool-pwsh']) {
       expect(byId.has(id), `inserted row ${id}`).toBe(true)
     }
+    // The launcher's cold-start module fallback BFS-links the apps/cli
+    // dependency closure into the profile's node_modules (the pwsh-local
+    // precedent), so every inserted bare plugin must resolve from there.
+    const cliManifest = JSON.parse(readFileSync(anchor, 'utf8')) as { dependencies?: Record<string, string> }
+    for (const name of ['@deepseek-ai/dsh-pwsh-sandbox', '@deepseek-ai/dsh-tool-pwsh']) {
+      expect(cliManifest.dependencies?.[name], `cold-start closure must reach ${name}`).toBeDefined()
+    }
     // The patch touches only base-owned rows plus inserts, so the full web
     // profile composes without any no-match warning.
     expect(warnings).toEqual([])
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b390c886a0..b06386f144 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -164,6 +164,9 @@ importers:
       '@deepseek-ai/dsh-pwsh-local':
         specifier: workspace:^
         version: link:../../packages/bash/pwsh-local
+      '@deepseek-ai/dsh-pwsh-sandbox':
+        specifier: workspace:^
+        version: link:../../packages/bash/pwsh-sandbox
       '@deepseek-ai/dsh-session-reference':
         specifier: workspace:^
         version: link:../../packages/context/session-reference