8ff75622c6
win32 hosts booting a shipped profile now get pwsh-local as the ctx.bash executor and tool-pwsh as the shell tool through the base bundle's new windows.cordis.patch.yml platform layer, injected by the launcher between the bundle layers and the user layers on win32. bash-sandbox, tool-bash, permission, and ui-permission are disabled there: the POSIX-only executor cannot run on Windows, and dsh-permission requires a confining executor. Overriding the default is a composition decision through the user's cordis.patch.yml; there is no environment override channel. apps/cli and dsh-base re-declare dsh-pwsh-local/dsh-tool-pwsh so the profile module fallback links them for cold starts (the profiles rework had dropped them from the CLI closure). Promotes the windows-pwsh-default Agent Note from proposed to implemented and documents the platform layer in the base bundle README.
@deepseek-ai/dsh-base
English | 中文
The shared dsh core as a profile bundle: cordis.patch.yml inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's dsh.profile.bundles list. Later bundle layers (e.g. dsh-web-app) and the user's profile cordis.patch.yml override these rows by id; a patch replaces a row's whole config, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the universal patch through the dsh.bundle.patch manifest field, and the launcher reads the Windows platform layer below from code on win32 hosts.
Windows hosts booting a shipped profile additionally receive windows.cordis.patch.yml: it disables the POSIX-only bash executor/tool and the permission stack (dsh-permission requires a confining executor), and inserts the PowerShell executor and tool (@deepseek-ai/dsh-pwsh-local, @deepseek-ai/dsh-tool-pwsh). The launcher applies it between the bundle layers and the user layers on win32 hosts; a Windows host that prefers the bash stack overrides these rows through its profile or home cordis.patch.yml. POSIX hosts never receive it.
The row set and its rationale are documented inline in the patch file; the generated composition graph renders it.
Model Experience
Indirectly, through the inserted rows: this bundle selects the shipped persona-less prompt base, tool set, and DeepSeek adapter that mode bundles specialize, and contributes no model-visible text of its own.
KV Cache effect
None directly; each inserted row's package owns its effect.
Known Limitations and Deferred Work
- A patch replaces whole row configs — profile overrides must restate every field a row keeps; there is no deep-merge layer.
- Windows loses the permission switcher —
dsh-permissionhard-requires a confiningctx.bashexecutor, so the Windows platform layer disablespermission/ui-permissionwith the bash stack. The fs tools keep the sandbox policy and the approval service, so file confinement and escalation still apply on Windows.