fix(bundle): drop the approval service from the Windows layer entirely
The Windows layer previously kept the approval service with policy 'never', which made the approval plugin inject 'Approval prompts are disabled in this session: actions that require approval are rejected automatically' into the model context. On Windows nothing asks for approval — the escalation surfaces (sandbox_permissions) do not exist — so the sentence described a rejection surface that is not there. The layer now disables the approval row too: the service is absent, the model is never told approval exists, and the danger-full-access degradation is complete. base.spec.ts pins approval among the Windows disables; the Agent Note and bundle README record the absent service.
This commit is contained in:
Huanqi Cao
@@ -2,5 +2,5 @@
|
||||
# side as of the last confirmed-consistent state. Both languages carry equal authority;
|
||||
# after editing either side, bring the other along and re-record with:
|
||||
# pnpm run verify-translation-pairing --write packages/bundle/base/README.md
|
||||
README.md: 81932442fe9e2edac82bda88bbe28ce56fd8b6c1
|
||||
README.zh.md: b0af307b7655a8729a8face324a2750e2e480651
|
||||
README.md: 84e7f43aaa6cfead0ff28e30063e71062d358f0a
|
||||
README.zh.md: 30c7c259f8893ebd34da6cab362dedac067ce099
|
||||
|
||||
@@ -4,7 +4,7 @@ English | [中文](README.zh.md)
|
||||
|
||||
The shared dsh core as a profile bundle: [`cordis.patch.yml`](cordis.patch.yml) inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's `dsh.profile.bundles` list. Later bundle layers (e.g. [`dsh-web-app`](../web-app/README.md)) and the user's profile `cordis.patch.yml` override these rows by id; a patch replaces a row's whole `config`, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the universal patch through the `dsh.bundle.patch` manifest field, and the launcher reads the Windows platform layer below from code on win32 hosts.
|
||||
|
||||
Windows hosts booting a shipped profile additionally receive [`windows.cordis.patch.yml`](windows.cordis.patch.yml): it disables the POSIX-only sandboxed stacks — the bash executor/tool, the permission switcher (dsh-permission requires a confining executor), and the sandbox/fs-policy stack — and inserts the PowerShell executor and tool (`@deepseek-ai/dsh-pwsh-local`, `@deepseek-ai/dsh-tool-pwsh`) plus the unconfined `dsh-fs-local`, with the approval policy set to `never`. Windows has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the shipped posture is honest danger-full-access rather than a boundary only the fs tools pretend to enforce. The launcher applies the layer between the bundle layers and the user layers on win32 hosts; a Windows host that prefers the bash stack overrides these rows through its profile or home `cordis.patch.yml`. POSIX hosts never receive it.
|
||||
Windows hosts booting a shipped profile additionally receive [`windows.cordis.patch.yml`](windows.cordis.patch.yml): it disables the POSIX-only sandboxed stacks — the bash executor/tool, the permission switcher (dsh-permission requires a confining executor), the sandbox/fs-policy stack, and the approval service — and inserts the PowerShell executor and tool (`@deepseek-ai/dsh-pwsh-local`, `@deepseek-ai/dsh-tool-pwsh`) plus the unconfined `dsh-fs-local`. Windows has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the shipped posture is honest danger-full-access rather than a boundary only the fs tools pretend to enforce; nothing in the roster asks for approval, so the approval service is absent. The launcher applies the layer between the bundle layers and the user layers on win32 hosts; a Windows host that prefers the bash stack overrides these rows through its profile or home `cordis.patch.yml`. POSIX hosts never receive it.
|
||||
|
||||
The row set and its rationale are documented inline in the patch file; the [generated composition graph](../../../apps/cli/composition.md) renders it.
|
||||
|
||||
@@ -19,4 +19,4 @@ None directly; each inserted row's package owns its effect.
|
||||
## Known Limitations and Deferred Work
|
||||
|
||||
- **A patch replaces whole row configs** — profile overrides must restate every field a row keeps; there is no deep-merge layer.
|
||||
- **Windows has no sandbox** — no OS runner exists on win32 (landlock/bwrap/seatbelt are POSIX-only), so the Windows platform layer removes the whole sandbox stack: `sandbox`/`sandbox-policy`/`fs-sandbox` are disabled, `dsh-fs-local` provides `ctx.fs`, the permission switcher leaves the roster, and the approval policy is `never`. Everything degrades to danger-full-access: the shell is unconfined and the fs tools make no confinement claims.
|
||||
- **Windows has no sandbox and no approval** — no OS runner exists on win32 (landlock/bwrap/seatbelt are POSIX-only), so the Windows platform layer removes the whole sandbox stack (`sandbox`/`sandbox-policy`/`fs-sandbox` disabled, `dsh-fs-local` provides `ctx.fs`), the permission switcher leaves the roster, and the approval service is disabled — nothing on Windows asks for approval, so the model is never told approval exists. Everything degrades to danger-full-access: the shell is unconfined and the fs tools make no confinement claims.
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
以 profile 组合包形式交付的共享 dsh 核心：[`cordis.patch.yml`](cordis.patch.yml) 在空的 profile 根之上插入全部基础插件行——模型适配器、工具、持久化、策略、settings／credentials、repository 插件、遥测——作为每个 profile 的 `dsh.profile.bundles` 列表中的第一层。后续的组合包层（例如 [`dsh-web-app`](../web-app/README.md)）和用户 profile 的 `cordis.patch.yml` 按 id 覆盖这些行；patch 会替换目标行的整个 `config`，因此模式专属的值放在各模式组合包中，而不是这里。该包没有运行时 API；profile 组合器通过 manifest（元数据清单）的 `dsh.bundle.patch` 字段解析通用 patch，启动器在 win32 主机上通过代码读取下面的 Windows 平台层。
|
||||
|
||||
启动交付 profile 的 Windows 主机还会额外收到 [`windows.cordis.patch.yml`](windows.cordis.patch.yml)：它禁用仅 POSIX 的受限栈——bash 执行器/工具、权限切换器（dsh-permission 要求有限权能力的执行器）与 sandbox/fs 策略栈——并插入 PowerShell 执行器与工具（`@deepseek-ai/dsh-pwsh-local`、`@deepseek-ai/dsh-tool-pwsh`）以及不限权的 `dsh-fs-local`，`approval` 策略设为 `never`。Windows 上没有 OS 级 sandbox runner（landlock/bwrap/seatbelt 均为 POSIX 专属），因此交付姿态是诚实的 danger-full-access，而不是一个只有 fs 工具假装执行的边界。启动器在 win32 主机上把它应用于 bundle 层与用户层之间；偏好 bash 栈的 Windows 主机通过其 profile 或 home 的 `cordis.patch.yml` 覆盖这些行。POSIX 主机永远不会收到它。
|
||||
启动交付 profile 的 Windows 主机还会额外收到 [`windows.cordis.patch.yml`](windows.cordis.patch.yml)：它禁用仅 POSIX 的受限栈——bash 执行器/工具、权限切换器（dsh-permission 要求有限权能力的执行器）、sandbox/fs 策略栈与 approval 服务——并插入 PowerShell 执行器与工具（`@deepseek-ai/dsh-pwsh-local`、`@deepseek-ai/dsh-tool-pwsh`）以及不限权的 `dsh-fs-local`。Windows 上没有 OS 级 sandbox runner（landlock/bwrap/seatbelt 均为 POSIX 专属），因此交付姿态是诚实的 danger-full-access，而不是一个只有 fs 工具假装执行的边界；清单里没有任何动作需要审批，因此 approval 服务缺席。启动器在 win32 主机上把它应用于 bundle 层与用户层之间；偏好 bash 栈的 Windows 主机通过其 profile 或 home 的 `cordis.patch.yml` 覆盖这些行。POSIX 主机永远不会收到它。
|
||||
|
||||
行集合及其设计依据以行内注释写在 patch 文件里；[生成的组合图](../../../apps/cli/composition.md)负责渲染它。
|
||||
|
||||
@@ -19,4 +19,4 @@
|
||||
## 已知限制与延期工作
|
||||
|
||||
- **patch 会替换整行 `config`**：profile 覆盖必须重述该行需要保留的每个字段；不存在深度合并层。
|
||||
- **Windows 上没有沙箱**：win32 上不存在 OS 级 runner（landlock/bwrap/seatbelt 均为 POSIX 专属），因此 Windows 平台层移除整个 sandbox 栈——`sandbox`/`sandbox-policy`/`fs-sandbox` 被禁用，由 `dsh-fs-local` 提供 `ctx.fs`，权限切换器离开清单，`approval` 策略为 `never`。一切退化为 danger-full-access：shell 不限权，fs 工具也不做任何限权声明。
|
||||
- **Windows 上没有沙箱、没有 approval**：win32 上不存在 OS 级 runner（landlock/bwrap/seatbelt 均为 POSIX 专属），因此 Windows 平台层移除整个 sandbox 栈——`sandbox`/`sandbox-policy`/`fs-sandbox` 被禁用，由 `dsh-fs-local` 提供 `ctx.fs`——权限切换器离开清单，approval 服务也被禁用：Windows 上没有任何动作需要审批，模型也不会被告知审批存在。一切退化为 danger-full-access：shell 不限权，fs 工具也不做任何限权声明。
|
||||
|
||||
@@ -46,7 +46,9 @@ describe('dsh-base bundle', () => {
|
||||
.map(patch => patch.id)
|
||||
// The POSIX-only sandboxed stacks leave the Windows roster as one unit:
|
||||
// shell (bash-sandbox/tool-bash), the permission switcher it requires,
|
||||
// and the fs/sandbox policy stack whose OS runners do not exist on win32.
|
||||
// the fs/sandbox policy stack whose OS runners do not exist on win32,
|
||||
// and the approval service — nothing on Windows asks for approval, so
|
||||
// the model is never told approval exists or that asks auto-reject.
|
||||
expect(disables).toEqual(
|
||||
expect.arrayContaining([
|
||||
'bash-sandbox',
|
||||
@@ -56,6 +58,7 @@ describe('dsh-base bundle', () => {
|
||||
'sandbox',
|
||||
'sandbox-policy',
|
||||
'fs-sandbox',
|
||||
'approval',
|
||||
]),
|
||||
)
|
||||
const inserted = parsed
|
||||
@@ -64,9 +67,7 @@ describe('dsh-base bundle', () => {
|
||||
expect(inserted).toEqual(
|
||||
expect.arrayContaining(['pwsh-local', 'tool-pwsh', 'fs-local']),
|
||||
)
|
||||
// Full danger-full-access degradation: no approval prompts on Windows.
|
||||
expect(parsed.find(patch => patch.id === 'approval')?.config).toEqual({
|
||||
policy: 'never',
|
||||
})
|
||||
// Full danger-full-access degradation: no approval surface at all.
|
||||
expect(parsed.find(patch => patch.id === 'approval')?.config).toBeUndefined()
|
||||
})
|
||||
})
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
# The dsh-base Windows platform layer: applied by the dsh launcher on win32
|
||||
# hosts, between the bundle layers and the user layers. Windows cannot run
|
||||
# the POSIX-only sandboxed stacks, so this layer swaps the shipped bash stack
|
||||
# for the PowerShell stack AND drops the sandbox entirely: no OS runner
|
||||
# exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any policy
|
||||
# would be theater — the unconfined shell could bypass fs-only path rules
|
||||
# with one command. Windows therefore degrades to danger-full-access:
|
||||
# for the PowerShell stack AND drops the whole permission surface: no OS
|
||||
# runner exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any
|
||||
# policy would be theater — the unconfined shell could bypass fs-only path
|
||||
# rules with one command. Windows therefore degrades to danger-full-access:
|
||||
# unconfined pwsh + unconfined fs (`dsh-fs-local`), no permission switcher
|
||||
# (dsh-permission requires a confining executor), approval policy `never`.
|
||||
# (dsh-permission requires a confining executor), and no approval service —
|
||||
# nothing in the roster asks for approval, and the model is never told
|
||||
# approval exists or that requests are auto-rejected.
|
||||
# The launcher reads THIS file from the base bundle package (never through
|
||||
# dsh.bundle.patch — that field names the one universal layer). A Windows
|
||||
# host that prefers bash or confinement overrides these rows through its
|
||||
@@ -34,8 +36,7 @@
|
||||
disabled: true
|
||||
|
||||
- id: approval
|
||||
config:
|
||||
policy: never
|
||||
disabled: true
|
||||
|
||||
- insert:
|
||||
- id: pwsh-local
|
||||
|
||||
Reference in New Issue
Block a user