Merge branch 'feat/windows-pwsh-default' into feat/windows-acl-sandbox

# Conflicts:
#	.agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.i18n.yaml
#	.agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.md
#	.agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.zh.md
#	docs/module-graph.i18n.yaml
#	docs/module-graph.md
#	docs/module-graph.zh.md
#	packages/bash/tool-pwsh/README.i18n.yaml
#	packages/bash/tool-pwsh/README.md
#	packages/bash/tool-pwsh/README.zh.md

packages/bash/bash-env/tests/bash-env.spec.ts

@@ -23,6 +23,7 @@ function execution(sessionId?: string): ToolExecution {
     signal: testToolSignal,
     token: Symbol('bash-env-test') as ToolExecution['token'],
     callId: CallId('bash-env-call'),
+    rootCallId: CallId('bash-env-call'),
     name: 'bash',
     arguments: { command: 'true' },
     ...(sessionId === undefined

packages/bash/bash-sandbox/src/index.ts

@@ -44,7 +44,7 @@ export type Config = LocalConfig
 export class SandboxBashExecutor extends LocalBashExecutor {
   static override inject = ['subprocess', 'sandbox', 'sandboxPolicy']
 
-  // No own Config: the sandbox default (mode + workspaceRoot) moved to
+  // No own Config: the sandbox default (mode + workspaceRoot) is owned by
   // ctx.sandboxPolicy, so this executor inherits LocalBashExecutor's Config
   // verbatim (the config catalog walks the inherited static).
 

packages/bash/bash/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bash/bash/README.md
-README.md: 1230149bd03d07cfb6208d82ea6ee8e81751b2c8
-README.zh.md: 168ac9f40e01dc786e29933afb0ebc4c3a745d0f
+README.md: 23b0acd096bb835ef57563337c91e5cf63b58677
+README.zh.md: 14ba749a0018bd6a63475bc0ab72c6fe6d26893a

packages/bash/bash/README.md

@@ -13,7 +13,7 @@ This package owns the Service Definition role of the bash capability, split so e
 | `@deepseek-ai/dsh-bash-sandbox` | Service provider: `dsh-bash-local`'s mechanics with every spawn confined via [`ctx.sandbox`](../../sandbox/sandbox/), denials reported as result facts |
 | `@deepseek-ai/dsh-tool-bash` | the model-facing tool schemas over `ctx.bash` |
 
-The split mirrors the LLM seam (`LlmService`/`LlmAdapter`) and the agent-tool survey: pi hides execution behind a `BashOperations` interface (local shell / SSH / VM backends), Codex behind an exec-server protocol. `dsh-bash-sandbox` is exactly that swap in action — a sandboxing executor behind the same Service Definition; the Consumer detects its `sandboxMode` capability and adds escalation fields without importing the provider. A containerized or remote executor slots in the same way.
+The split is a standard capability seam ([capability-seams Agent Note](../../../.agents/notes/implemented/architecture/2026-06-13-capability-seams.md)): `dsh-bash-sandbox` is a sandboxing executor behind the same Service Definition — the Consumer detects its `sandboxMode` capability and adds escalation fields without importing the provider — and a containerized or remote executor slots in the same way.
 
 ## Service API (`ctx.bash`)
 

packages/bash/bash/README.zh.md

@@ -13,7 +13,7 @@
 | `@deepseek-ai/dsh-bash-sandbox` | Service provider：沿用 `dsh-bash-local` 的机制，但通过 [`ctx.sandbox`](../../sandbox/sandbox/) 限制每次 spawn，并将拒绝报告为结果事实 |
 | `@deepseek-ai/dsh-tool-bash` | 基于 `ctx.bash`、面向模型的工具 schema |
 
-该拆分与 LLM（大语言模型） seam（`LlmService`／`LlmAdapter`）及 agent（智能体）工具调研结果一致：pi 将执行隐藏在 `BashOperations` 接口之后（本地 shell／SSH／VM 后端），Codex 则隐藏在 exec-server 协议之后。`dsh-bash-sandbox` 正是这种替换的实际应用：沙箱执行器位于同一 Service Definition 之后；Consumer 检测其 `sandboxMode` 能力并添加升权字段，无需导入提供方。容器化或远程执行器也可以同样接入。
+该拆分是一个标准的能力 seam（[capability-seams Agent Note](../../../.agents/notes/implemented/architecture/2026-06-13-capability-seams.md)）：`dsh-bash-sandbox` 是位于同一 Service Definition 之后的沙箱执行器——Consumer 检测其 `sandboxMode` 能力并添加升权字段，无需导入提供方——容器化或远程执行器也可以同样接入。
 
 ## 服务 API（`ctx.bash`）
 

packages/bash/pwsh-local/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bash/pwsh-local/README.md
-README.md: a06126e29ac5bf711bfbbb0d369e097b70918ba6
-README.zh.md: 947e994b59539d137cc1a332bb252a8325533747
+README.md: eb3365b009e3595230e5fb0f616079bd73c55840
+README.zh.md: d79201c756a26bbc343e2b284a803b0cf9aee69b

packages/bash/pwsh-local/README.md

@@ -23,7 +23,7 @@ The package root exports the default and named `PwshLocalExecutor` plugin, its `
     pwshPath: C:\Program Files\PowerShell\7\pwsh.exe  # explicit executable; else well-known locations, then PATH
 ```
 
-## Behavior (and where it came from)
+## Behavior
 
 The Windows counterpart of `dsh-bash-local`, deliberately mirroring its semantics call-for-call:
 

packages/bash/pwsh-local/README.zh.md

@@ -23,7 +23,7 @@
     pwshPath: C:\Program Files\PowerShell\7\pwsh.exe  # explicit executable; else well-known locations, then PATH
 ```
 
-## 行为（及其由来）
+## 行为
 
 作为 `dsh-bash-local` 的 Windows 对应物，逐调用地镜像其语义：
 

packages/bash/tool-bash/src/index.ts

@@ -206,9 +206,9 @@ export function apply(ctx: Context, config: Config = {}): void {
    * {@link approveEscalation}. This tool contributes only the composition
    * guard (the fields are unadvertised without a sandboxing executor, yet
    * schema validation checks advertised keys only, so an unadvertised
-   * `sandbox_permissions` still reaches execute) and the approval ingredients
-   * The shared policy resolver is required whenever the executor advertises
-   * confinement, so a split composition fails at tool-plugin load.
+   * `sandbox_permissions` still reaches execute) and the approval
+   * ingredients. The shared policy resolver is required whenever the executor
+   * advertises confinement, so a split composition fails at tool-plugin load.
    */
   const approveBashEscalation = (
     mode: string,