mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
1ee773317c
- apps/cli/reference/README: state the win32 permission/sandbox/approval degradation so the workspace-write promise no longer misleads Windows users - bundle README + agent note: give the complete bash-restore recipe (disable pwsh-local/tool-pwsh and re-enable bash-sandbox/tool-bash), since both executors register the same bash service and an incomplete recipe fails loud at load - windows.cordis.patch.yml: header comment notes the recipe and that the ui-permission row belongs to dsh-web-app (base-only profiles get a harmless no-match warning) - profile-boot.ts: rewrap composeProfile JSDoc - re-record i18n hashes for the touched bilingual pairs
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
# The dsh-base Windows platform layer: applied by the dsh launcher on win32
|
|
# hosts, between the bundle layers and the user layers. Windows cannot run
|
|
# the POSIX-only sandboxed stacks, so this layer swaps the shipped bash stack
|
|
# for the PowerShell stack AND drops the whole permission surface: no OS
|
|
# runner exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any
|
|
# policy would be theater — the unconfined shell could bypass fs-only path
|
|
# rules with one command. Windows therefore degrades to danger-full-access:
|
|
# unconfined pwsh + unconfined fs (`dsh-fs-local`), no permission switcher
|
|
# (dsh-permission requires a confining executor), and no approval service —
|
|
# nothing in the roster asks for approval, and the model is never told
|
|
# approval exists or that requests are auto-rejected.
|
|
# The launcher reads THIS file from the base bundle package (never through
|
|
# dsh.bundle.patch — that field names the one universal layer). A Windows
|
|
# host that prefers bash or confinement overrides these rows through its
|
|
# profile or home cordis.patch.yml.
|
|
# The bash-restore recipe must be complete: disable pwsh-local and tool-pwsh
|
|
# AND re-enable bash-sandbox and tool-bash (plus permission/ui-permission only
|
|
# if the switcher is wanted) — both executors register the same 'bash'
|
|
# service, so re-enabling the bash rows while pwsh-local stays inserted fails
|
|
# loud at load on a duplicate registration.
|
|
# The ui-permission disable targets a row owned by dsh-web-app, not dsh-base:
|
|
# a base-only profile (e.g. the `dsh plugin --profile` default template) has
|
|
# no such row, and the no-match logs a harmless warning on every load.
|
|
|
|
- id: bash-sandbox
|
|
disabled: true
|
|
|
|
- id: tool-bash
|
|
disabled: true
|
|
|
|
- id: permission
|
|
disabled: true
|
|
|
|
- id: ui-permission
|
|
disabled: true
|
|
|
|
- id: sandbox
|
|
disabled: true
|
|
|
|
- id: sandbox-policy
|
|
disabled: true
|
|
|
|
- id: fs-sandbox
|
|
disabled: true
|
|
|
|
- id: approval
|
|
disabled: true
|
|
|
|
- insert:
|
|
- id: pwsh-local
|
|
name: '@deepseek-ai/dsh-pwsh-local'
|
|
|
|
- id: tool-pwsh
|
|
name: '@deepseek-ai/dsh-tool-pwsh'
|
|
|
|
- id: fs-local
|
|
name: '@deepseek-ai/dsh-fs-local'
|