fix(bundle): drop the approval service from the Windows layer entirely

The Windows layer previously kept the approval service with policy 'never',
which made the approval plugin inject 'Approval prompts are disabled in
this session: actions that require approval are rejected automatically'
into the model context. On Windows nothing asks for approval — the
escalation surfaces (sandbox_permissions) do not exist — so the sentence
described a rejection surface that is not there. The layer now disables
the approval row too: the service is absent, the model is never told
approval exists, and the danger-full-access degradation is complete.

base.spec.ts pins approval among the Windows disables; the Agent Note and
bundle README record the absent service.
This commit is contained in:
Huanqi Cao
2026-08-07 01:41:32 +08:00
parent acac2149a5
commit 73c6f35171
9 changed files with 31 additions and 26 deletions

3
pnpm-lock.yaml generated
View File

@@ -898,6 +898,9 @@ importers:
'@deepseek-ai/dsh-credentials-local':
specifier: workspace:^
version: link:../../credentials/credentials-local
'@deepseek-ai/dsh-fs-local':
specifier: workspace:^
version: link:../../fs/fs-local
'@deepseek-ai/dsh-fs-policy':
specifier: workspace:^
version: link:../../fs/fs-policy