dsh-gitbash-shell 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KannaKuron
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,133 @@
+# dsh-gitbash-shell
+
+> 让 DeepSeek Harness (dsh) 在 Windows 上**全部使用 Git Bash** 的官方风格插件
+> —— 以 Git for Windows 的 `bash.exe` 替换 PowerShell 执行器,并为所有模式
+> 物化对应的 Git Bash 版 agent preset。
+
+## 它解决什么
+
+官方 Windows 组合默认把 `dsh-pwsh-sandbox` 作为 `ctx.shell`(PowerShell 执行器),
+且各 preset 的 `tool-bash` 行在 win32 上被禁用——因为在 Windows 上裸 `bash`
+会解析到 `C:\Windows\System32\bash.exe`(WSL 占位),本插件直接指定
+`C:/Program Files/Git/bin/bash.exe` 并保留官方沙箱语义。
+
+安装本插件后:
+
+| 模式 | preset id | 说明 |
+| --- | --- | --- |
+| 标准模式 · Git Bash | `standard-gitbash` | 完整编码 Agent,shell 为 Git Bash |
+| 极简模式 · Git Bash | `minimal-gitbash` | 持久 Git Bash 终端 + str_replace_editor |
+| PTC 模式 · Git Bash | `code-gitbash` | PTC(Code Mode SDK)+ Git Bash |
+| 创造模式 · Git Bash | `cordis-gitbash` | 自引用 Cordis 工具集 + Git Bash |
+
+原有的 `标准模式`/`极简模式`/`PTC 模式`/`创造模式`(shipped,不可修改)在
+Git Bash host 下会拿到"暗示 PowerShell 语法的工具",请改用上面的变体;
+已装 dsh-ptc-cordis-preset 的话,`PTC 创造模式` 用户 preset 不受影响。
+
+## 安装(公开 GitHub 插件,推荐)
+
+仓库: <https://github.com/KannaKuron/dsh-gitbash-shell>
+
+```sh
+# web 图形界面
+dsh plugin --profile web add github:KannaKuron/dsh-gitbash-shell
+
+# 可选:TUI / 自定义 TUI 也启用(命令行各 profile 需要)
+dsh plugin --profile tui add github:KannaKuron/dsh-gitbash-shell
+dsh plugin --profile cc-tui add github:KannaKuron/dsh-gitbash-shell
+```
+
+`dsh plugin add` 会自动:① pnpm 安装 `github:KannaKuron/dsh-gitbash-shell`;
+② 检测到包声明的 `dsh.bundle` 后把它追加进该 profile 的
+`dsh.profile.bundles`。**重启该 profile 的 host 后生效。**
+
+TUI/cc-tui 额外:在其 `cordis.patch.yml` 里翻转 host 工具行(web 不需要):
+
+```yaml
+- id: tool-bash
+  disabled: false
+- id: tool-pwsh
+  disabled: true
+```
+
+## 它做了什么
+
+bundle patch(`cordis.patch.yml`)应用三个改动:
+
+1. `pwsh-sandbox` 行 `disabled: true` —— 每进程只允许一个 `ctx.shell`;
+2. 插入 `gitbash-executor`(`dsh-gitbash-shell/shell`):继承官方
+   `@deepseek-ai/dsh-bash-sandbox`,仅把内层 argv 换成
+   `<git-bash.exe> -c <command>`。沙箱策略/拒绝分类/后台任务/超时/设置节
+   全部沿用官方实现;full-access 分支单独接 Git Bash(父类那里硬编码裸 `bash`);
+3. 插入 `gitbash-presets`(`dsh-gitbash-shell/presets`):启动时把上表 4 个
+   preset 物化到首个 user-trust preset 根目录,并写
+   `.plugin-managed.json`(逐文件哈希)——未改动则随版本刷新;被用户改过就
+   不再碰;卸载时(且仅当未改动)会清理。
+
+**环境变量**:`bash.exe` 是 host 进程的直接子进程(不经 git-bash 登录壳),完整继承
+系统环境变量与 `DSH_*` 快照,和原来 pwsh 拿到的完全一致。
+
+## 配置
+
+`gitbash-presets` 行支持 `presets` 数组,只物化你常用的模式(未列出的旧物化目录、
+且未被用户修改过的,会自动清理):
+
+```yaml
+- id: gitbash-presets
+  config:
+    presets: [standard-gitbash, minimal-gitbash]   # 默认物化全部 4 个
+```
+
+配合 `agent-presets` 的 `default`,新会话直接落在 Git Bash 模式,免去每次在
+模式选择器里翻找(原版 shipped 模式无法替换或隐藏——部署级、只读):
+
+```yaml
+- id: agent-presets
+  config:
+    default: ptc-cordis   # 或 standard-gitbash / minimal-gitbash
+```
+
+## 配置
+
+`gitbash-executor` 行支持:
+
+```yaml
+config:
+  bashPath: "D:/Tools/Git/bin/bash.exe"   # 默认 C:/Program Files/Git/bin/bash.exe
+  timeoutMs: 60000                         # 默认 60s,可继续用 shell 设置节调整
+```
+
+## 验证
+
+```sh
+npm test
+```
+
+重启 host 后新会话:
+- 工具列表里出现 `bash`(不再有 `pwsh`),描述为 Git Bash;
+- `echo \$BASH_VERSION` 有输出、`command -v bash` 指向 Git 安装目录。
+
+## 卸载
+
+```sh
+dsh plugin --profile web remove dsh-gitbash-shell
+```
+
+或删除 profile`package.json` 中依赖 + `dsh.profile.bundles` 中的条目后
+`dsh plugin --profile web install`。卸载并重启后,未改过的 `* -gitbash`
+preset 会被插件自动清理;宿主 shell 回退为 PowerShell。
+
+## 与 dsh-ptc-cordis-preset 联动
+
+本插件在 host 上发布 `gitBash` 能力服务(`{ active, bashPath }`,仅 Windows 为 active)。
+[dsh-ptc-cordis-preset](https://github.com/KannaKuron/dsh-ptc-cordis-preset) v0.5.0+ 在物化
+`PTC 创造模式` 时会检测该信号:两个插件都安装时,**PTC 创造模式自动物化为 Git Bash 版**
+(`tool-bash` 启用、`tool-pwsh` 禁用),无需新增模式、无需手工修改 preset;
+只装本插件时 PTC 创造模式保持原样(由它自己的插件管理)。
+
+> 切换生效后若 `ptc-cordis` 目录已存在且被旧版本物化,删除
+> `~/.dsh/.agent-presets/ptc-cordis` 并重启,即由新逻辑重新物化。
+
+## 许可
+
+MIT © KannaKuron。参考与致敬:[dsh-ptc-cordis-preset](https://github.com/KannaKuron/dsh-ptc-cordis-preset)。

package/README_EN.md

@@ -0,0 +1,58 @@
+# dsh-gitbash-shell
+
+> Run **every agent shell command through Git Bash** on Windows with DeepSeek
+> Harness (dsh) — replaces the PowerShell executor and materializes Git Bash
+> variants of all four agent presets.
+
+## Install (public GitHub plugin)
+
+```sh
+dsh plugin --profile web add github:KannaKuron/dsh-gitbash-shell
+# optional TUI surfaces
+dsh plugin --profile tui add github:KannaKuron/dsh-gitbash-shell
+dsh plugin --profile cc-tui add github:KannaKuron/dsh-gitbash-shell
+```
+
+`dsh plugin add` installs the dependency via pnpm and, seeing the
+`dsh.bundle` declaration, appends the package to `dsh.profile.bundles`.
+**Restart the profile's host to activate.**
+
+## What it does
+
+The bundle patch (`cordis.patch.yml`):
+
+1. disables `pwsh-sandbox` (one `ctx.shell` provider per process);
+2. mounts `dsh-gitbash-shell/shell` — a subclass of the shipped
+   `@deepseek-ai/dsh-bash-sandbox` whose inner argv is
+   `<git-bash.exe> -c <command>` (sandbox policy, denial classification,
+   background jobs, and settings behavior all inherited);
+3. mounts `dsh-gitbash-shell/presets`, which materializes
+   `standard-gitbash`, `minimal-gitbash`, `code-gitbash`,
+   `cordis-gitbash` into the first user-trust preset root, guarded by
+   per-file `.plugin-managed.json` hashes (user edits are never overwritten;
+   unmodified trees are cleaned on uninstall).
+
+Environment: `bash.exe` is spawned as a direct child of the host, so it
+inherits the full system environment plus the `DSH_*` snapshot, exactly like
+the pwsh executor did.
+
+## Config
+
+```yaml
+config:
+  bashPath: "D:/Tools/Git/bin/bash.exe"   # default C:/Program Files/Git/bin/bash.exe
+```
+
+## Cooperation with dsh-ptc-cordis-preset
+
+This plugin publishes a `gitBash` host capability (`{ active, bashPath }`,
+active only on Windows). [dsh-ptc-cordis-preset](https://github.com/KannaKuron/dsh-ptc-cordis-preset)
+v0.5.0+ detects it while materializing `PTC 创造模式`: with both installed,
+the PTC preset is materialized as Git Bash automatically (tool-bash on,
+tool-pwsh off) — no extra mode, no manual edits. Without this plugin the PTC
+preset stays as its own plugin manages it.
+
+## License
+
+MIT © KannaKuron. Inspired by
+[dsh-ptc-cordis-preset](https://github.com/KannaKuron/dsh-ptc-cordis-preset).

package/assets/code-gitbash/agent.cordis.yml

@@ -0,0 +1,264 @@
+# The `code` agent preset: the standard coding agent, presented as Code Mode.
+#
+# Everything in `standard` is here unchanged. What is added is the `tool-presentation`
+# row: instead of one tool call per action, the model writes a TypeScript
+# program against a generated SDK and `run_code` executes it, so a sequence
+# that would be five round trips becomes one.
+#
+# The registry itself stays on the host plane — the agent loop's scheduler and
+# the API proxy's presenters are its consumers — so what this preset owns is
+# the PRESENTATION of that registry for this agent alone. Native sessions run
+# beside this one in the same process, each seeing its own catalog.
+#
+# This file is an AGENT-PLANE composition. It is mounted under one agent's
+# scope context, so every tool and prompt section it registers belongs to that
+# session alone. The host composition (`base.cordis.yml` + `web.cordis.yml`)
+# keeps everything a preset must not own: the registries themselves, the
+# sandbox and approval stack, persistence, and the model route.
+#
+# A service row here MUST sit inside a group carrying an `isolate` realm.
+# Without one it publishes into the root realm, where it is process-global
+# rather than per-session and the second session mounting this preset collides
+# with the first; `dsh-agent-presets` rejects that at mount. `true` means an
+# entry-local realm — one private instance per mounted session, which is the
+# default this deployment wants. A shared label would instead pool one instance
+# across every session naming it.
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# The preset's own persona, shadowing the deployment default for this agent.
+# `{{model}}` and `{{cwd}}` resolve from the agent's own route and workspace.
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: >-
+      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+# `shell-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
+# publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
+# the criterion for host-plane ownership — injection resolves before any session
+# exists, so there is no agent to key by. Behind a preset realm those variables
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; the host executor is the Git Bash provider (`dsh-gitbash-shell`)
+# host-plane too.
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  # Git Bash on Windows: the host executor is dsh-gitbash-shell (see $DSH_HOME/cordis.patch.yml).
+  disabled: false
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: true
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+# Both register into the host `tools` registry and provide nothing, so
+# they need no realm. The `fs` service and its policy stay in the host.
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background jobs
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-filesystem` contributes local-root discovery for agents on this preset, and
+# `tool-skill` gives them the catalog and loader; the merged catalog also
+# carries whatever the deployment registered globally (repository plugins).
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+# Only the model-facing tool. The goal SERVICE, its session driver, and the
+# `/goal` command stay on the host plane: the Gateway serves the goal domain as
+# Remote endpoints whose receiver comes from a generated descriptor, so it
+# resolves `goals` on the host and an entry-local realm here would hide it. The
+# registry is keyed by session anyway, so one host instance serves every
+# session. What a preset chooses is whether its agent can call the goal tool.
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+# Plan state is per-agent by nature, so an entry-local realm is not a
+# workaround here — it is the correct lifetime.
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+# `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+# share this realm rather than sit outside it.
+#
+# `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+# plane, and the rows here resolve that one instance. It takes no configuration,
+# keys every fold by Session, and owns the context-meter projection units the
+# browser reads for every session — behind a realm those units would come and go
+# with whichever presets happen to be mounted. What a preset chooses is whether
+# its agent compacts at all, which is `compaction-basic` below.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+# The `subagents` registry and its spawn/fork backends live in the HOST
+# composition: the registry is a process singleton whose cross-session queries
+# the api-proxy serves to the browser, and a provider name may only be
+# registered once. This preset contributes the delegation TOOLS, which resolve
+# that host registry.
+#
+# `workflows` is different — nothing outside an agent reads it — so every row
+# that reaches it shares one entry-local realm here, and a consumer left
+# outside would resolve a host registry this preset does not populate.
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    # Production dsh does not install these optional providers. Install the
+    # matching Bundle in this Profile and restart the Host, then copy this
+    # preset and remove `disabled` from the matching tool row. Host availability
+    # alone grants no tool.
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        backgroundMode: one-shot
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        backgroundMode: one-shot
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+# The `web` service and its search provider stay in the host composition; only
+# the model-facing tool is per-session.
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000
+
+# ── presentation ────────────────────────────────────────────────────────────
+
+# Code Mode for this agent alone. The row waits for the host's `codeRuntime`
+# rather than assuming it: a deployment that composes no TypeScript runtime
+# fails this preset at mount, naming this id, instead of at the first request.
+- id: tool-presentation
+  name: '@deepseek-ai/dsh-agent-tool-presentation'
+  config:
+    mode: code

package/assets/code-gitbash/preset.yml

@@ -0,0 +1,3 @@
+name: PTC 模式 · Git Bash
+description: 具备标准模式的全部能力，并通过 Code Mode SDK 呈现工具，让模型用一个 TypeScript 程序组合多步操作。（Shell 使用 Git Bash）
+order: 2