dsh-pwsh-plugin 0.2.17 → 0.2.19

package/README.md

@@ -1,6 +1,8 @@
 # dsh-pwsh-plugin
 
-[English](README.md) · [简体中文](README.zh-CN.md)
+**English** · [简体中文](README.zh-CN.md)
+
+[![npm](https://img.shields.io/npm/v/dsh-pwsh-plugin)](https://www.npmjs.com/package/dsh-pwsh-plugin) [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE) [![DSH plugin](https://img.shields.io/badge/DSH%20plugin-%E2%89%A50.2.0--rc.2-blue)](https://github.com/topics/dsh-plugin)
 
 A `pwsh_run` tool for DeepSeek Harness: PowerShell script text goes to a **persistent** pwsh 7 process
 over stdin, so nothing is escaped on the way in, there is no 32K command-line cap, the ~400 ms cold start
@@ -114,24 +116,25 @@ Three constraints that cost real time to find:
   will hold two of them; registration is keyed by name, and a second `pwsh_run` is a hard error at boot.
   `--dump-config` shows the duplicate plainly — that is the check to run after switching.
 
-The three files in `plugin/` (`index.mjs`, `session.mjs`, `session-server.ps1`) must stay together —
+The files in `plugin/` (`index.mjs`, `config.mjs`, `native-pwsh-guard.mjs`, `session.mjs`, `session-server.ps1`) must stay together —
 `index.mjs` reads the `.ps1` at load time and ships it to the child as `-EncodedCommand`.
 
 ## The tools
 
-`pwsh_run` runs a script. Versions are managed by DSH itself — see [Updates](#updates).
+`pwsh_run` runs a script. Versions are managed by DSH itself — see [Updating](#updating).
 
 | Argument | Required | Meaning |
 |---|---|---|
 | `script` | yes | PowerShell script text. Reaches the server **verbatim** — do not escape `$`, do not wrap it in `pwsh -c`, do not add outer quotes. |
 | `workdir` | no | `Set-Location` first. The session is stateful, so later calls inherit it. An invalid path fails this call without running the script. |
-| `timeoutMs` | no | Per-call timeout, default 120000. |
+| `timeoutMs` | no | Execution timeout, excluding queue waiting; default 120000. Integer milliseconds from 1 to 2147478647. |
 
-Output: stdout as-is, warnings prefixed `WARNING: `, verbose prefixed `VERBOSE: `, a thrown exception
-carries `[script threw]` plus the innermost message. Errors (`Write-Error`, a child process's stderr)
-come **after** stdout — the server merges every stream through `*>&1` and tags lines by type, so
-**line-by-line interleaving of stdout and stderr is not preserved** (the built-in tool keeps two columns).
-When order matters, merge them yourself: `2>&1` or `*>&1`.
+Output uses PowerShell formatting at width 200; objects appear as tables or lists. Use `ConvertTo-Json`
+when structured fields are needed. Warning, Verbose, Information and Debug have separate labels; errors
+and innermost exceptions follow ordinary output. Streams are grouped by type, so cross-stream order is
+not preserved; merge them in the script with `2>&1` or `*>&1` when needed. The script stays at top level
+for `using` and `param`. `#requires` is checked before the body; unsupported `-ShellId` / `-Assembly`
+requirements are explicitly refused.
 
 ## Configuration
 
@@ -140,9 +143,10 @@ When order matters, merge them yourself: `2>&1` or `*>&1`.
 | `pwshPath` | `pwsh` | Executable; resolved through `PATH` by default. |
 | `timeoutMs` | `120000` | Default per-call timeout. |
 | `idleMs` | `1800000` | Recycle an idle session (30 minutes). |
-| `maxSessions` | `4` | How many sessions may live at once (one per agent workspace). |
-| `maxOutputBytes` | `8388608` | Output collection cap per call (8 MB). Truncation is reported honestly, never silently. |
+| `maxSessions` | `4` | Per-plugin process limit, isolated by DSH session ID. If all are busy, new sessions are refused with a retry message. |
+| `maxOutputBytes` | `8388608` | UTF-8 payload budget per call, including record separators; errors have a separate 65536-byte budget. Framing and display labels are excluded. Truncation is reported. |
 | `allowUnconfined` | `false` | `true` = start a session even when the sandbox policy service is missing. |
+| `enforcePwshRun` | `false` | Refuse ordinary native `pwsh` calls before execution and direct the model to `pwsh_run`. |
 
 `allowUnconfined` is the one deliberate escape hatch. In a normal deployment `ctx.sandboxPolicy` is always
 present; when it is missing the composition is incomplete, and the plugin **refuses to start** rather than
@@ -151,6 +155,39 @@ quietly running an unconstrained session.
 Hot reload (`patchReload: live`) re-runs `apply`. Tool registration and process cleanup both hang off
 `ctx.effect`, so it does not trip `tool "pwsh_run" is already registered`.
 
+### Enforce pwsh_run
+
+This is a profile-wide plugin setting. Configure it once for all presets and sessions in that profile;
+do not add it to each preset or insert a second `pwsh-run` entry when the bundle already provides one.
+
+Open **pwsh settings** in the settings sidebar, enable **Require pwsh_run**, then select **Save**. The plugin row's configuration button opens the same form. Changes stay as a draft until saved; leaving the page discards the draft. **Restore configuration default** removes the profile override.
+
+Saving updates only the routing switch through DSH's settings service and preserves running PowerShell processes and session state. The page reports the value accepted by the host, protects against conflicting writes, and disables editing on read-only deployments. It follows the host's Chinese or English language setting.
+
+For hosts without the settings UI, override the existing plugin entry in the profile's `cordis.patch.yml`:
+
+```yaml
+- id: pwsh-run
+  config:
+    enforcePwshRun: true
+```
+
+Ordinary native `pwsh` calls are refused before execution. The response tells the model to move
+`command` into `pwsh_run`'s `script` and preserve `workdir` and `timeoutMs`.
+The command is neither executed first nor replayed automatically. Both native dispatch and
+PTC's `tools.pwsh(...)` pass through this check.
+
+Three native entry points remain available: read-only sessions (unsupported by the persistent
+session), jobs with `run_in_background: true`, and per-call escalation requests with a nonempty
+`justification` and a requested mode strictly wider than the current one. Escalation still needs
+host approval; a same-mode flag does not qualify. The guard resolves the actual session policy
+on each call, so mode changes take effect on the next invocation.
+
+Disabling the option, removing the guard through hot reload, or uninstalling restores native
+`pwsh` behavior. The option defaults to off. Live configuration requires `ctx.tools.guard()`;
+a host without this API is rejected explicitly so enabling the setting cannot silently go unprotected.
+The guard covers the DSH `pwsh` tool entry, not PowerShell launched inside bash, Node or other scripts.
+
 ## Sandbox
 
 The persistent process is wrapped **once, at launch**, in the restricted argv that `ctx.sandbox.confine`
@@ -158,9 +195,12 @@ returns. The Windows ACL sandbox uses a `WRITE_RESTRICTED` token, and a token is
 after that single confine, every later read and write in the session obeys the same workspace boundary as
 the built-in `pwsh` tool.
 
-Policy is resolved against the **real session at launch time** (`session` must be passed into
-`sandboxPolicy.resolve`): the session's `sandbox/mode` wins, and the boundary root comes from the
-session's `header.cwd`.
+Every call resolves policy against the **current real session** (`session` must reach
+`sandboxPolicy.resolve`) and checks the effective policy, workspace and sandbox backend. A change
+disposes the old process before any new script; read-only refuses the body. Permission or workspace
+changes therefore clear persistent state too. Working-directory service errors are surfaced instead
+of falling back to stale paths. Creation and execution share one queue per ID; only sessions with no
+executing, queued or starting requests can be evicted.
 
 A trap worth knowing: passing the ToolExecution instead (`agent` lives on `exec.agent`) means `resolve`
 never sees a session and **silently falls back to the deployment default** (mode + configured
@@ -176,7 +216,7 @@ Under `danger-full-access` nothing is confined, exactly like the built-in tool.
 **`read-only` does not start.** In that mode pwsh runs in ConstrainedLanguage and cannot even create a
 runspace. The tool reports that clearly and points at the built-in `pwsh` tool, which works there.
 
-## Updates
+## Updating
 
 This plugin carries no updater of its own. It is an ordinary registry package, so **DSH manages its
 version**: the Plugins page lists it, shows when a newer release exists, and installs it — the same
@@ -244,9 +284,12 @@ your own machine — it derives every path from its own location and re-checks t
 | Output looks reordered | stdout and stderr are merged by type, not by time. Merge them yourself with `2>&1`. |
 | `exit N` code is not reported | Runspace semantics — use `Write-Output` or read `$LASTEXITCODE`. |
 | A child process keeps a file locked after the call | The session holds the `Process` object. Wait for `idleMs`, or force a rebuild with a timeout. |
-| `Program 'node.exe' failed to run: Access is denied.` (or `拒绝访问`) | Expected under `workspace-write`: the restricted token cannot create anonymous pipes, so **any** launch that captures a child's stdio fails — `& exe` included. Use `Start-Process -RedirectStandardOutput/-RedirectStandardError <file>` (captures output, no exit code), `[Diagnostics.Process]::Start` with `UseShellExecute=$false` and no redirection (exit code, child inherits stdout), or a `.cmd` wrapper that writes stdout, stderr and `%ERRORLEVEL%` to three files. The tool appends this same advice to the output. |
+| `Program 'node.exe' failed to run: Access is denied.` (or `拒绝访问`) | The current Windows restricted token cannot create some child pipes, so `& exe` can fail. For output and an exit code, use `[Diagnostics.Process]::Start` on `cmd.exe /c "<exe> <args> > out.txt 2> err.txt"` with `UseShellExecute=$false`; or `Start-Process -NoNewWindow -PassThru -Wait -RedirectStandardOutput/-RedirectStandardError <file>` (the exit code may be empty). Avoid a new console; directly inherited output goes to `NUL`. |
+
+## Known limitations
 
-## Known limits
+The [audit and local fix record](docs/pwsh-run-audit.zh-CN.md) covers the nine issue groups.
+The host TLS failure has a separate [Schannel investigation](docs/dsh-windows-schannel.zh-CN.md).
 
 The full list — session semantics, detached child std handles, UAC differences, and what an update does to a
 session — lives in **[docs/runtime-notes.md](docs/runtime-notes.md)**. The short version:
@@ -262,10 +305,17 @@ session — lives in **[docs/runtime-notes.md](docs/runtime-notes.md)**. The sho
 ```
 plugin/
   index.mjs           tool registration, sandbox wiring, timeouts
+  config.mjs          native schema; the routing switch is volatile
+  native-pwsh-guard.mjs  optional native pwsh invocation guard
   session.mjs         the session object: framing, queue, base64 encode, boot argv
   session-server.ps1  the PowerShell side: runspace, stream tagging, sentinels
+client/index.js      localized settings page using DSH native controls
 test/
+  settingstest.mjs    persistence, conflicts, live routing and process preservation
   support.mjs         locates a DSH install; converts Windows paths to /mnt form
+  routingtest.mjs     native/PTC routing, exceptions, unload and reload
+  protocoltest.mjs    frame limits, UTF-8 budgets, startup cleanup
+  lifecycletest.mjs   policy changes, session pool, cancellation
   itest.mjs           protocol and session core
   plugintest.mjs      the whole plugin path against a mock context
   e2e-real-subprocess.mjs  real DSH subprocess runtime
@@ -285,20 +335,26 @@ FINDINGS.md          every measurement and the reasoning behind the design
 
 ```bash
 cd <checkout>
-PWSH_BIN='pwsh' node test/itest.mjs          # 17: protocol and session core
+pnpm install --ignore-scripts --config.auto-install-peers=false
+node test/settingstest.mjs                  # 19: native settings form, persistence, routing and state
+node test/routingtest.mjs                   # 30: native/PTC routing, exceptions, disable and unload
+node test/protocoltest.mjs                  #  6: frame limits, UTF-8 budgets, startup cleanup
+node test/lifecycletest.mjs                 # 16: policy, pool, concurrency, cancellation, unload
+PWSH_BIN='pwsh' node test/itest.mjs          # 30: protocol and session core
 PWSH_BIN='pwsh' node test/plugintest.mjs     # 15: full plugin path
 node test/e2e-real-subprocess.mjs            #  8: real DSH subprocess
-node test/sandboxtest.mjs                    #  7: real sandbox boundary + fail-closed
+node test/sandboxtest.mjs                    # 12: real sandbox, downgrade, root switch, first concurrency
 node test/bashtest.mjs                       # 31: custom-bash fence triage, bash fallback, exec-bit repair
 node test/bash-e2e.mjs                       # 11: custom-bash end to end
 node test/denialtest.mjs                     # 11: sandbox-denial hint (no spawn, runs anywhere)
 node test/metatest.mjs                       # 23: plugin-page metadata (no spawn, runs anywhere)
 ```
 
-Eight scripts, **123 assertions**, none of which needs DSH to be running — just node 24, PowerShell 7 and a
+Twelve scripts, **212 assertions**, none of which needs DSH to be running — just node 24, PowerShell 7 and a
 DSH install to borrow `node_modules` from. Tests that need a DSH runtime locate one automatically
 (`DSH_MODULES`, `DSH_MODULES_ASAR`, or by walking up from the working directory) and print a `SKIP` hint
-instead of failing when none is found.
+when none is found. The settings integration test exits unsuccessfully if its host modules are unavailable;
+a release validation must complete every suite without skips.
 
 ### Releasing
 
@@ -327,6 +383,19 @@ new content). With no tag on HEAD it prints the exact name to create.
 Use the Windows-side npm. In WSL, `/usr/local/bin/npm` resolves to a bun symlink and `npm version` fails
 with `Script not found "version"`.
 
+## Related projects
+
+More DeepSeek Harness (DSH) projects from [@citydirector](https://github.com/citydirector):
+
+| Project | Kind | What it does |
+|---|---|---|
+| [DSH-build](https://github.com/citydirector/DSH-build) | Build | Portable and desktop Windows builds of DSH, patched, smoke-tested and released daily |
+| [dsh-remote-access-proxy](https://github.com/citydirector/dsh-remote-access-proxy) | Plugin | Use the DSH Web GUI from your phone, tablet, or another computer |
+| [deepinfra-fusion-proxy](https://github.com/citydirector/deepinfra-fusion-proxy) | Plugin | DeepInfra Standard / Flex switching with automatic fallback, per session |
+| [dsh-loop-rescue](https://github.com/citydirector/dsh-loop-rescue) | Plugin | Cut model repetition loops mid-stream, prune them from the log, and resume |
+| [ui-locate-mcp](https://github.com/citydirector/ui-locate-mcp) | MCP plugin | Pixel-exact coordinates for on-screen text and icons, for desktop automation |
+| [dsh-session-manager](https://github.com/citydirector/dsh-session-manager) | Offline tool | Upgrade, archive, trash, loop cleanup and repair for DSH sessions |
+
 ## License
 
-MIT — see [LICENSE](LICENSE).
+[MIT](LICENSE)

package/README.zh-CN.md

@@ -2,6 +2,8 @@
 
 [English](README.md) · **简体中文**
 
+[![npm](https://img.shields.io/npm/v/dsh-pwsh-plugin)](https://www.npmjs.com/package/dsh-pwsh-plugin) [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE) [![DSH plugin](https://img.shields.io/badge/DSH%20plugin-%E2%89%A50.2.0--rc.2-blue)](https://github.com/topics/dsh-plugin)
+
 给 DeepSeek Harness 的 `pwsh_run` 工具：PowerShell 脚本正文**经 stdin** 送进一个常驻 pwsh 7 进程 ——
 路上不做任何转义、没有 32K 命令行上限、~400ms 冷启动只付一次，变量 / 当前目录 / 已加载模块跨调用保留。
 
@@ -99,7 +101,7 @@ $env:DSH_HOME = '<DSH_HOME>'        # 桌面 App 自己用的那个数据根
   合成后的配置树里就有两条；注册按名字查重，第二个 `pwsh_run` 在启动时是硬错误。`--dump-config` 一眼就能看出重复 ——
   切换后跑这一条。
 
-`plugin/` 下三个文件（`index.mjs`、`session.mjs`、`session-server.ps1`）必须放在一起：
+`plugin/` 下的 `index.mjs`、`config.mjs`、`native-pwsh-guard.mjs`、`session.mjs`、`session-server.ps1` 必须放在一起：
 `index.mjs` 在加载时读那个 `.ps1`，再以 `-EncodedCommand` 送给子进程。
 
 ## 工具接口
@@ -110,12 +112,12 @@ $env:DSH_HOME = '<DSH_HOME>'        # 桌面 App 自己用的那个数据根
 |---|---|---|
 | `script` | 是 | PowerShell 脚本正文。**原样**送达 —— 不要转义 `$`，不要包 `pwsh -c`，不要加外层引号。 |
 | `workdir` | 否 | 先 `Set-Location` 过去。会话有状态，后续调用会继承。路径无效则本次脚本不执行。 |
-| `timeoutMs` | 否 | 单次超时，默认 120000。 |
+| `timeoutMs` | 否 | 实际执行的超时，默认 120000；不含排队等待。必须为 1–2147478647 的整数毫秒。 |
 
-输出：stdout 原样，warning 前缀 `WARNING: `，verbose 前缀 `VERBOSE: `，抛出的异常带 `[script threw]`
-与最内层消息。错误（`Write-Error`、子进程的 stderr）排在 stdout **之后** —— 服务端用 `*>&1` 合并全部
-流并按类型打标，所以 **stdout 与 stderr 的逐行时序不保留**（内置工具是分开两栏的）。需要顺序时自己
-合并：`2>&1` 或 `*>&1`。
+输出使用 PowerShell 标准格式化（宽度 200），对象按表格或列表显示；需要结构化字段时显式 `ConvertTo-Json`。
+Warning、Verbose、Information、Debug 分别带类型前缀，错误和最内层异常排在普通输出之后。各流按类型分组，
+不保留跨流时序；需要合并时在脚本中使用 `2>&1` 或 `*>&1`。正文保持顶层执行，支持 `using`、`param`；
+`#requires` 会在正文前核验，暂不支持的 `-ShellId` / `-Assembly` 会明确拒绝。
 
 ## 配置
 
@@ -124,9 +126,10 @@ $env:DSH_HOME = '<DSH_HOME>'        # 桌面 App 自己用的那个数据根
 | `pwshPath` | `pwsh` | 可执行文件；默认经 `PATH` 解析。 |
 | `timeoutMs` | `120000` | 单次调用默认超时。 |
 | `idleMs` | `1800000` | 空闲会话回收（30 分钟）。 |
-| `maxSessions` | `4` | 同时存活的会话上限（每个 agent 工作区一个）。 |
-| `maxOutputBytes` | `8388608` | 单次调用的输出收集上限（8MB）。截断会明确报出来，不静默。 |
+| `maxSessions` | `4` | 每个插件实例的会话上限，以 DSH session ID 隔离；全部忙时拒绝新会话并提示重试。 |
+| `maxOutputBytes` | `8388608` | 每次调用普通输出正文的 UTF-8 字节预算（含记录换行）；错误另留 65536 字节。协议与显示标签不计入，截断会明确提示。 |
 | `allowUnconfined` | `false` | `true` = 沙箱策略服务缺席时也起会话。 |
+| `enforcePwshRun` | `false` | 开启后，在执行前拒绝普通原生 `pwsh` 调用，提示改用 `pwsh_run`。 |
 
 `allowUnconfined` 是唯一一条「明知故犯」的开关。正常部署下 `ctx.sandboxPolicy` 一定在；缺席说明组合
 不完整，这时插件**拒绝启动**，而不是悄悄跑一个不受约束的会话。
@@ -134,14 +137,45 @@ $env:DSH_HOME = '<DSH_HOME>'        # 桌面 App 自己用的那个数据根
 热重载（`patchReload: live`）会重新 `apply`。工具注册与进程清理都挂在 `ctx.effect` 上，不会触发
 `tool "pwsh_run" is already registered`。
 
+### 强制使用 pwsh_run
+
+这是 profile 的公共插件配置：同一 profile 只需设置一次，覆盖其中不同 preset 和会话，
+不需要在每个 preset 中重复添加。插件已由 bundle 加载时，也不要重复插入 `pwsh-run` 条目。
+
+在设置侧栏打开 **pwsh 设置**，开启 **强制使用 pwsh_run**，再点 **保存**。插件列表的配置按钮也会打开同一张表单。编辑只产生草稿，离开页面会丢弃未保存的修改；**恢复配置默认值** 会移除当前 profile 的覆盖。
+
+保存通过 DSH 设置服务热更新路由开关，保留正在运行的 PowerShell 进程和会话状态。页面显示宿主确认的已保存值，校验配置修订冲突，并在只读部署下禁用修改。页面随宿主语言显示中文或英文。
+
+没有设置界面的宿主仍可在 profile 的 `cordis.patch.yml` 中覆盖已有插件条目：
+
+```yaml
+- id: pwsh-run
+  config:
+    enforcePwshRun: true
+```
+
+守卫会在命令执行前拒绝普通原生 `pwsh` 调用，并提示模型把 `command` 改为
+`pwsh_run` 的 `script`；`workdir` 和 `timeoutMs` 保持原值。原生命令不会先执行一次，
+也不会自动重放。原生工具和 PTC 中的 `tools.pwsh(...)` 都经过同一道检查。
+
+三个必要入口仍交给原生工具：只读会话（常驻会话不支持）、`run_in_background: true`
+的后台任务、以及带非空 `justification` 且申请权限确实高于当前模式的逐次提权请求。
+提权仍需宿主审批；同级权限标记不放行。每次按实际会话读取模式，切换权限后立即按新模式判断。
+
+配置关闭、热重载移除守卫或卸载插件后，原生 `pwsh` 恢复原有行为。
+开关默认关闭。热更新配置需要宿主提供 `ctx.tools.guard()`；缺少此 API 时会明确拒绝加载，避免设置开启后实际没有拦截。
+它只管理 DSH 的 `pwsh` 工具入口，不解析 `bash`、Node 或其他脚本内启动的 PowerShell。
+
 ## 沙箱
 
 常驻进程在**启动时**整体包进 `ctx.sandbox.confine` 返回的受限 argv。Windows ACL 沙箱用的是
 `WRITE_RESTRICTED` 受限令牌，而令牌是**进程级**的 —— 所以 confine 一次之后，该会话的每一次读 / 写都
 受同一个 workspace 边界约束，与内置 `pwsh` 工具等价。
 
-策略按**启动会话时的真实 session** 解析（`session` 必须传进 `sandboxPolicy.resolve`）：会话的
-`sandbox/mode` 优先，边界根取会话的 `header.cwd`。
+每次调用先按**当前真实 session** 重新解析策略（`session` 必须传进 `sandboxPolicy.resolve`），并核对
+有效策略、工作区和沙箱后端。任一项变化就销毁旧进程，再按新边界创建；切到只读时拒绝正文。
+因此权限或工作区切换也会清空常驻状态。工作目录服务出错时直接报错，不回退到旧目录。
+同一 ID 的创建与执行共用队列；只淘汰没有执行、排队或启动请求的空闲会话。
 
 一个值得记住的坑：早先传的是 ToolExecution（`agent` 挂在 `exec.agent` 上），`resolve` 拿不到
 session，**静默退回部署默认值**（mode + 配置里的 `workspaceRoot`），边界于是跑到 profile 目录去了 ——
@@ -214,10 +248,13 @@ Windows 上打，那份文件到手时是 `0644` —— 探测发现它属于当
 | 输出顺序看着不对 | stdout 与 stderr 按类型合并，不按时间。自己用 `2>&1` 合。 |
 | `exit N` 的退出码拿不到 | runspace 语义 —— 用 `Write-Output` 或读 `$LASTEXITCODE`。 |
 | 调用结束后子进程还占着文件 | 会话持有 `Process` 对象。等 `idleMs`，或者用一次超时强制重建。 |
-| `Program 'node.exe' failed to run: 拒绝访问。` | `workspace-write` 下的正常现象：受限令牌建不了匿名管道，凡是「捕获子进程 stdio」的起法都失败，`& exe` 也在其中。改用 `Start-Process -RedirectStandardOutput/-RedirectStandardError <文件>`（能拿到输出，拿不到退出码）、`[Diagnostics.Process]::Start`（`UseShellExecute=$false`、不重定向，能拿退出码但子进程继承 stdout），或一个把 stdout / stderr / `%ERRORLEVEL%` 分别写进三个文件的 `.cmd` 包装器。工具也会把这段说明附在输出末尾。 |
+| `Program 'node.exe' failed to run: 拒绝访问。` | 当前 Windows 受限令牌无法创建部分子进程管道，`& exe` 可能失败。需要输出和退出码时，用 `[Diagnostics.Process]::Start` 执行 `cmd.exe /c "<exe> <参数> > out.txt 2> err.txt"` 且 `UseShellExecute=$false`；或 `Start-Process -NoNewWindow -PassThru -Wait -RedirectStandardOutput/-RedirectStandardError <文件>`（退出码可能为空）。不要新建控制台；直接继承的输出会送往 `NUL`。 |
 
 ## 已知边界
 
+九组问题及修复验收见[审计报告](docs/pwsh-run-audit.zh-CN.md)；宿主 HTTPS 问题单独记在
+[Schannel 兼容性记录](docs/dsh-windows-schannel.zh-CN.md)。
+
 完整清单（会话语义、已断开的子进程 std handle、UAC 差异、升级对会话的影响）见
 **[docs/runtime-notes.zh-CN.md](docs/runtime-notes.zh-CN.md)**。要点：
 
@@ -232,10 +269,17 @@ Windows 上打，那份文件到手时是 `0644` —— 探测发现它属于当
 ```
 plugin/
   index.mjs           工具注册、沙箱接线、超时
+  config.mjs          宿主配置 schema；路由开关支持热更新
+  native-pwsh-guard.mjs  可选的原生 pwsh 调用守卫
   session.mjs         会话对象：分帧、队列、base64、启动 argv
   session-server.ps1  PowerShell 侧：runspace、流打标、哨兵
+client/index.js      使用宿主原生控件的双语设置页
 test/
+  settingstest.mjs    配置持久化、冲突、即时路由与进程保留
   support.mjs         定位 DSH 安装；Windows 路径转 /mnt 形式
+  routingtest.mjs     原生与 PTC 路由、必要例外及卸载恢复
+  protocoltest.mjs    分帧、UTF-8 预算、启动清理
+  lifecycletest.mjs   权限切换、会话池与取消
   itest.mjs           协议与会话本体
   plugintest.mjs      插件完整路径（mock 上下文）
   e2e-real-subprocess.mjs  真 DSH subprocess 运行时
@@ -255,19 +299,25 @@ FINDINGS.md          全部实测数据与设计理由
 
 ```bash
 cd <检出目录>
-PWSH_BIN='pwsh' node test/itest.mjs          # 17：协议与会话本体
+pnpm install --ignore-scripts --config.auto-install-peers=false
+node test/settingstest.mjs                  # 19：原生设置表单、持久化、路由和进程保留
+node test/routingtest.mjs                   # 30：原生/PTC 路由、例外、关闭与卸载
+node test/protocoltest.mjs                  #  6：帧边界、字节预算、启动清理
+node test/lifecycletest.mjs                 # 16：权限切换、池、并发、取消、卸载
+PWSH_BIN='pwsh' node test/itest.mjs          # 30：协议与会话本体
 PWSH_BIN='pwsh' node test/plugintest.mjs     # 15：插件完整路径
 node test/e2e-real-subprocess.mjs            #  8：真 DSH subprocess
-node test/sandboxtest.mjs                    #  7：真沙箱边界 + fail-closed
+node test/sandboxtest.mjs                    # 12：真沙箱边界、降权、切根、首次并发
 node test/bashtest.mjs                       # 31：custom-bash 围栏分诊、bash 后备、执行位自修复、SSH agent
 node test/bash-e2e.mjs                       # 11：custom-bash 端到端
 node test/denialtest.mjs                     # 11：沙箱拒绝提示（不起子进程，哪儿都能跑）
 node test/metatest.mjs                       # 23：插件页元数据（不起子进程，哪儿都能跑）
 ```
 
-八份脚本合计 **123 项**，都不需要 DSH 在跑 —— 只要 node 24、PowerShell 7，以及一个能借
+十二份脚本合计 **212 项**，都不需要 DSH 在跑 —— 只要 node 24、PowerShell 7，以及一个能借
 `node_modules` 的 DSH 安装。需要 DSH 运行时的测试会自动找（`DSH_MODULES`、`DSH_MODULES_ASAR`，
-或从工作目录逐级向上），找不到时打一行 `SKIP` 提示而不是失败。
+或从工作目录逐级向上），找不到时打印 `SKIP` 提示。设置集成测试缺少宿主模块时会非零退出；
+发版验收必须跑完全部测试，不能有跳过。
 
 ### 发版
 
@@ -293,6 +343,19 @@ HEAD 上还没有 tag 时，它把该打的标签名打印出来。
 npm 要用 Windows 侧那份。WSL 里 `/usr/local/bin/npm` 指向 bun 的软链，`npm version` 会报
 `Script not found "version"`。
 
-## 许可
+## 相关项目
+
+[@citydirector](https://github.com/citydirector) 的其它 DeepSeek Harness（DSH）项目：
+
+| 项目 | 类型 | 用途 |
+|---|---|---|
+| [DSH-build](https://github.com/citydirector/DSH-build) | 构建 | DSH 的 Windows 便携版 / 桌面版绿色构建，每天跟随上游打补丁、冒烟、发布 |
+| [dsh-remote-access-proxy](https://github.com/citydirector/dsh-remote-access-proxy) | 插件 | 在手机、平板或其它电脑上用浏览器访问 DSH Web GUI |
+| [deepinfra-fusion-proxy](https://github.com/citydirector/deepinfra-fusion-proxy) | 插件 | DeepInfra Standard / Flex 按会话切换与自动回退 |
+| [dsh-loop-rescue](https://github.com/citydirector/dsh-loop-rescue) | 插件 | 模型复读时从流内切断、剪掉循环并自动续跑 |
+| [ui-locate-mcp](https://github.com/citydirector/ui-locate-mcp) | MCP 插件 | 按界面文字和图标给出精确像素坐标，用于桌面操作 |
+| [dsh-session-manager](https://github.com/citydirector/dsh-session-manager) | 离线工具 | 离线升级、归档、回收站、清洗循环、修复烂尾 / 隐藏会话 |
+
+## 许可证
 
-MIT —— 见 [LICENSE](LICENSE)。
+[MIT](LICENSE)

package/client/index.js

@@ -0,0 +1,94 @@
+window.__ModuleLoader__.load({
+  id: 'dsh-pwsh-plugin',
+  factory: (require) => {
+    const React = require('react')
+    const { SettingsForm, SettingsFormModel, Switch, Button } = require('@deepseek-ai/dsh-client-ui-primitives')
+    const h = React.createElement
+    const NS = 'pwsh-run'
+    const FIELD = 'enforcePwshRun'
+    const COPY = {
+      zh: {
+        title: 'pwsh 设置', group: '工具路由', label: '强制使用 pwsh_run',
+        summary: '控制模型是否必须使用常驻 PowerShell 工具。',
+        intro: '统一管理当前 profile 的 PowerShell 调用方式。',
+        hint: '开启后，普通 pwsh 调用会在执行前被拒绝，并提示模型改用 pwsh_run。',
+        scope: '对当前 profile 的所有预设和会话生效。保存后立即应用，正在运行的 pwsh_run 任务和常驻状态会保留。',
+        exceptions: '只读会话、明确的后台任务和需要宿主审批的有效提权请求，仍可使用原生 pwsh。',
+        on: '已开启', off: '已关闭', pending: '有尚未保存的修改', inherited: '恢复配置默认值',
+        form: { unavailable: '配置暂不可用，请确认插件已在当前主机加载。', readOnly: '当前部署的配置只读，无法保存修改。', saveFailed: '保存失败，请刷新配置后重试。', save: '保存', saving: '保存中…' },
+      },
+      en: {
+        title: 'pwsh settings', group: 'Tool routing', label: 'Require pwsh_run',
+        summary: 'Choose whether models must use persistent PowerShell.',
+        intro: 'Manage PowerShell routing for the current profile.',
+        hint: 'When enabled, ordinary pwsh calls are blocked before execution and the model is directed to pwsh_run.',
+        scope: 'Applies to every preset and session in this profile. Saving takes effect immediately and preserves running pwsh_run tasks and session state.',
+        exceptions: 'Read-only sessions, explicit background jobs, and valid elevation requests that require Host approval retain native pwsh.',
+        on: 'Enabled', off: 'Disabled', pending: 'Unsaved changes', inherited: 'Restore configuration default',
+        form: { unavailable: 'Configuration unavailable. Check that the plugin is loaded on this Host.', readOnly: 'Configuration is read-only in this deployment.', saveFailed: 'Not saved. Refresh the configuration and try again.', save: 'Save', saving: 'Saving…' },
+      },
+    }
+    const copy = () => (document.documentElement.lang || navigator.language || 'en').toLowerCase().startsWith('zh') ? COPY.zh : COPY.en
+    const style = {
+      page: { display: 'grid', gap: 24, width: '100%', maxWidth: 680, padding: '8px 0' },
+      title: { margin: 0, fontSize: 21, fontWeight: 600, lineHeight: 1.4 },
+      intro: { margin: '8px 0 0', fontSize: 13, opacity: 0.65, lineHeight: 1.65 },
+      section: { display: 'grid', gap: 16 },
+      group: { margin: 0, fontSize: 12, fontWeight: 600, opacity: 0.65 },
+      row: { display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: 24 },
+      field: { display: 'grid', gap: 6 },
+      label: { fontSize: 14, fontWeight: 500 },
+      note: { margin: 0, fontSize: 13, lineHeight: 1.7, opacity: 0.65 },
+      status: { display: 'flex', alignItems: 'center', flexWrap: 'wrap', gap: 12, fontSize: 12, opacity: 0.65 },
+      reset: { marginLeft: 'auto' },
+    }
+    function SettingsPage(props) {
+      const t = copy()
+      if (props.view === 'summary') return t.summary
+      const state = props.usePwshSettings((value) => value)
+      const disabled = !state.writable || state.saving
+      return h('div', { style: style.page, 'data-pwsh-settings': '' },
+        h('header', null, h('h2', { style: style.title }, t.title), h('p', { style: style.intro }, t.intro)),
+        h(SettingsForm, { labels: t.form, state, onSave: props.save, onDiscard: props.discard },
+          h('section', { style: style.section },
+            h('h3', { style: style.group }, t.group),
+            h('div', { style: style.row },
+              h('div', { style: style.field }, h('span', { style: style.label }, t.label), h('p', { style: style.note }, t.hint)),
+              h(Switch, { label: t.label, checked: state.field.text === 'true', disabled, onChange: (value) => props.edit(FIELD, value ? 'true' : 'false') })),
+            h('div', { style: style.status, role: 'status' },
+              h('span', null, state.accepted ? t.on : t.off),
+              state.dirty ? h('span', null, t.pending) : null,
+              state.field.overridden ? h(Button, { style: style.reset, variant: 'ghost', size: 'sm', disabled, onClick: () => props.resetField(FIELD) }, t.inherited) : null),
+            h('p', { style: style.note }, t.scope),
+            h('p', { style: style.note }, t.exceptions))))
+    }
+    function apply(ctx) {
+      const scope = ctx.configForms.get(NS)
+      const form = new SettingsFormModel(scope, [{
+        field: FIELD,
+        format: (value) => value === true ? 'true' : 'false',
+        parse: (text) => text === 'true' || text === 'false' ? { kind: 'set', value: text === 'true' } : undefined,
+      }])
+      const store = form.bind(() => ({ ...form.shell(), field: form.field(FIELD), accepted: scope.getSnapshot().value?.[FIELD] === true }))
+      const inject = () => ({ hooks: { pwshSettings: store }, ...form.actions() })
+      ctx.effect(() => () => form.dispose(), 'pwsh-run.form')
+      ctx.effect(() => {
+        let dispose = () => {}
+        const register = () => {
+          dispose()
+          dispose = ctx.configForms.whileServed([NS], () => {
+            const section = ctx.slots.inject('settings.section', () => ctx.slots.register({ name: 'settings.section', id: 'pwsh-run', order: 43, label: copy().title, inject }, SettingsPage))
+            const row = ctx.slots.inject('plugins.row.config', () => ctx.slots.register({ name: 'plugins.row.config', key: 'dsh-pwsh-plugin#pwsh-run', inject }, SettingsPage))
+            return () => { row(); section() }
+          })
+        }
+        register()
+        // 导航文字由注册项持有，语言改变时重新登记，让宿主刷新入口标题。
+        const observer = new MutationObserver(register)
+        observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] })
+        return () => { observer.disconnect(); dispose() }
+      }, 'pwsh-run.settings-page')
+    }
+    return { name: 'pwsh-run-settings', inject: ['slots', 'configForms'], apply }
+  },
+})

package/cordis.patch.yml

@@ -13,6 +13,7 @@
         timeoutMs: 120000
         idleMs: 1800000
         maxSessions: 4
+        enforcePwshRun: false
 
     # Windows 上的 bash：官方 persistent bash 依赖 PTY，PTY 后端只支持 linux/darwin，
     # 而官方 bash 工具在 win32 上被禁用，Windows 会话因此没有 bash。这一行补上它，

package/docs/dsh-windows-schannel.zh-CN.md

@@ -0,0 +1,118 @@
+# DSH Windows 沙箱与 Schannel 兼容性记录
+
+记录日期：2026-11-12。来源为本机隔离实验及上游代码追溯；与本插件九组修复分开维护。
+
+## 补充核实：curl 联网与 Windows PATH（2026-11-11）
+
+本段核实 DSH 沙箱里的 curl 联网与 Windows PATH 是否符合既定语义。本段所有网络请求均为公开站点的只读请求，未修改网络、凭据、PATH 或沙箱配置。
+
+### 结论
+
+1. **不是全面断网。** 当前 workspace-write 的 Windows 沙箱可以建立 TCP，也能使用 HTTP；HTTPS 故障发生在系统 curl / Invoke-WebRequest 使用的 Windows Schannel 凭据获取阶段。
+2. **这是当前沙箱令牌与 Schannel 的兼容性问题，不是设计上禁止联网。** 已安装的 `@deepseek-ai/dsh-sandbox-windows-acl` 0.2.2-rc.1 的中文边界说明（第 127 行）明确写“写入与删除受限；读取、网络与进程可见性不受限”。
+3. **当前 Windows PATH 正常。** 旧的 Machine PATH 整段丢失没有复现。
+4. **WSL 围栏禁止执行 Windows exe 是预期限制。** 借 cmd.exe / pwsh.exe 从 WSL 查询 Windows 环境会被拦，与 Windows 侧读取 PATH 的问题不同。
+
+### 本轮对照矩阵
+
+| 环境 / 工具 | 请求 | 结果 |
+|---|---|---|
+| workspace-write，pwsh_run，系统 curl 8.22.0 / Schannel | http://example.com/ | HTTP 200，exit 0 |
+| 同上 | https://example.com/ | TCP 约 0.048s 建立；TLS 未建立，HTTP 000，exit 35 |
+| 同上 | https://registry.npmjs.org/ | TCP 约 0.053s 建立；TLS 未建立，HTTP 000，exit 35 |
+| workspace-write，原生 pwsh，系统 curl | https://example.com/ | 同样 exit 35，排除本插件独有故障 |
+| workspace-write，pwsh_run，Invoke-WebRequest | https://example.com/ | 最内层 Win32Exception：安全包中没有可用的凭证 |
+| 正常令牌，原生 pwsh，**同一系统 curl** | https://example.com/ | HTTP 200，exit 0 |
+| 正常令牌，Invoke-WebRequest | https://example.com/ | HTTP 200 |
+| workspace-write，Windows Node.js 的 https 模块 | https://example.com/ | HTTP 200，exit 0，未关闭证书校验 |
+| 当前 WSL 围栏内，Linux curl 8.14.1 / OpenSSL 3.5.6 | https://example.com/ | HTTP 200，exit 0 |
+
+Windows curl 的原始错误：
+
+> curl: (35) schannel: AcquireCredentialsHandle failed: SEC_E_NO_CREDENTIALS (0x8009030e)
+
+受限进程的完整性 SID 为 S-1-16-4096（Low），正常对照为 S-1-16-12288（High）。这个对照确认问题随当前 Windows 沙箱令牌出现；本轮没有进一步分离 Low 完整性和 WRITE_RESTRICTED 各自的贡献，也没有证明所有 Windows 主机必然如此。此前记忆中有类似结论，本段以本轮本机实测为依据。
+
+### PATH 核对
+
+- 当前 PowerShell 7.6.8。Process PATH 长 1087，Machine PATH 长 471，User PATH 长 588；三者可读取。
+- 逐项展开 Machine PATH 中的变量，再与进程 PATH 忽略大小写和尾斜杠比对：**缺失项 0**，没有未展开的变量引用。
+- System32 存在；Get-Command 能解析 curl.exe、cmd.exe、wsl.exe、git.exe。curl 落在 Windows System32，后端是 Schannel。
+- WSL 自己的 PATH 也含 System32，但执行 Windows cmd.exe 返回 126 / Permission denied。这是 llrun 阻止 Windows interop 的既定行为，不能据此判定 PATH 缺失。
+
+### 目前可用的路径与范围
+
+Windows 沙箱内需要 HTTPS 时，Windows Node.js 的 https 已验证可用；纯 Linux 网络操作可使用 WSL curl；读取网页也可以用宿主提供的抓取工具。Windows 路径与文件操作仍走 Windows 工具。
+
+如果程序必须依赖 Schannel，应作为 Windows 沙箱后端的兼容性问题单独处理，不能通过修改 PATH 解决，也不应默认放开全部文件权限来掩盖。只读模式的独立进程、本机其它 curl 构建、UAC 标准用户和其它主机未在本段补测；不把这张矩阵扩大成所有环境的保证。
+
+## 归因追溯：Schannel 故障由谁引入（2026-11-12）
+
+本段追溯预期外 HTTPS 故障的引入层与来源提交。本段只做归因、记录与一次性对照，不修改生产沙箱或插件实现。
+
+### 归属结论
+
+**故障触发点在 DSH 上游 Windows ACL 后端的受限令牌构造。** 当前系统 curl 使用 Schannel，在带 restricting SIDs 的 WRITE_RESTRICTED 令牌下无法取得出站 TLS 凭据。这是该安全机制在本机暴露的兼容性缺陷；不能解释成产品有意禁止联网。
+
+- pwsh_run 只是委托宿主：plugin/index.mjs:204 解析策略，:226 调用 sandbox.confine(plain, policy, signal)，:230 使用返回的 confined.argv 启动。它没有实现 CreateRestrictedToken。
+- 原生 pwsh 在同一策略下同样失败，排除插件独有的会话协议或编码处理。
+- 当前桌面归档的 dsh/node_modules/@deepseek-ai/dsh-sandbox-windows-acl/lib/types-Cl07j3lG.js 中，createRestrictedToken 函数与本轮测试使用的便携包逐字相同；两者包版本均为 0.2.2-rc.1，桌面 VERSION 为 fcc0ad462172522aaf5c93a7b2e01f6b9f0b0159。
+- 本地 DSH-build 的 portable/patch-windows-acl-runner-console.mjs 只调整 ffi.ts / runner.ts 的控制台处理，没有改 token.ts。本轮直接调用 AclSandbox 的进程启动接口也能复现，未经过本插件的 PowerShell 服务端。
+
+### 隔离变量，而非只比较高低完整性
+
+同一台 Windows、同一个 System32 curl.exe、同一个 https://example.com/，均为公开页面只读请求。探针父进程经审批使用正常令牌；仅在该一次性进程中调整 Win32 API 的实参，测试后恢复。所有 AclSandbox 实例均设 manageDacls:false，未改变磁盘 ACL、注册表或生产配置。
+
+| 对照令牌 | 完整性 | CreateRestrictedToken flags / SID 数 | curl 结果 |
+|---|---|---|---|
+| 正常父进程 | High | 不创建受限令牌 | HTTP 200 / exit 0 |
+| 仅降完整性，不加 restricting SID | Low | 0 / 0 | HTTP 200 / exit 0 |
+| 仅裁剪特权，不加 restricting SID | High | DISABLE_MAX_PRIVILEGE = 1 / 0 | HTTP 200 / exit 0 |
+| 写限制与 restricting SID，不裁剪特权 | High | WRITE_RESTRICTED = 8 / 2 | HTTP 000 / exit 35 |
+| 当前正式构造，仅保留 High | High | 9 / 2 | HTTP 000 / exit 35 |
+| 当前正式构造 | Low | 9 / 2 | HTTP 000 / exit 35 |
+| 恢复 Authenticated Users | High | 9 / 3 | HTTP 000 / exit 35 |
+| 重建初版广 SID 列表和 flags | High | 13 / 6 | HTTP 000 / exit 35 |
+
+flags 9 = DISABLE_MAX_PRIVILEGE | WRITE_RESTRICTED；flags 13 另含历史 LUA_TOKEN。当前 read-only 的两个 SID 是 logon SID、Everyone；初版广列表另含 Authenticated Users、INTERACTIVE、LOCAL 与一个写能力 SID。
+
+所有 exit 35 的有效对照均返回：
+
+> curl: (35) schannel: AcquireCredentialsHandle failed: SEC_E_NO_CREDENTIALS (0x8009030e)
+
+由此排除“只要 Low 就不能用 Schannel”和“仅因裁剪特权而失败”；恢复 Authenticated Users 也不能修复。这里定位到的是**写限制令牌与 restricting SID 的组合**，没有声称限制 SID 中某一个成员是单独根因，也没有定位 Windows 内部哪个访问检查返回拒绝。
+
+额外尝试进一步拆开该组合时，WRITE_RESTRICTED / 零限制 SID 的进程退出 3221225794（0xC0000142），flags 0 / 两个限制 SID 的进程退出 3221225781（0xC0000135）。这两组连 whoami / curl 都未正常启动，**属于无效 TLS 对照，不计为网络失败证据**；本轮不继续扩大这些变体。随后查询 System / Application Popup，最近 12 分钟没有新事件。
+
+### 来源提交链
+
+以下日期均为 UTC；作者为 Git 提交记录中的 author，不把提交元数据解释成人为故障责任。
+
+| 上游提交 | 日期 | 内容及本轮判断 |
+|---|---|---|
+| [f64ba40](https://github.com/deepseek-ai/deepseek-harness/commit/f64ba40f43961fc65b7e1724132708a0b6d163cf) | 2026-08-07 17:24:33 | Huanqi Cao，feat(sandbox): Windows ACL write-restriction sandbox (restricted-token runner)。首次加入该后端及受限令牌构造；本机重建初版参数也复现同一 TLS 错误，是可追溯的机制来源。 |
+| [441927c](https://github.com/deepseek-ai/deepseek-harness/commit/441927c5268e1abd2be024d3b5bb69e3869b6f06) | 2026-08-08 | 为封堵 C 盘根的越界写入而移除 Authenticated Users；本轮恢复该 SID 仍失败，不能把本次故障归给这一处收紧。 |
+| [d5ad3ba](https://github.com/deepseek-ai/deepseek-harness/commit/d5ad3baeb5d531e31da5e586c3ec3ebedd825169) | 2026-09-18 | 增加 Low 完整性及目录标签，堵 FILE_DELETE_CHILD 删除旁路；仅 Low 的 TLS 对照成功，不能把它当作本次故障引入点。 |
+| [bdd75ca](https://github.com/deepseek-ai/deepseek-harness/commit/bdd75ca1a0ce122a4801fa0e24d26f19159c071b) | 2026-10-26 | Huo Yaoyuan，去掉 LUA_TOKEN 以支持内置 Administrator / WDAGUtilityAccount；带/不带 LUA 的已测组合均失败，不是该修补造成。 |
+
+首次提交的父提交为 4c2d20dbf7709ce88da5f01b163c8daaa1f087aa。初版 token.ts 的关键调用是 DISABLE_MAX_PRIVILEGE | LUA_TOKEN | WRITE_RESTRICTED，列表为 world / logonSid / authUser / interactive / local / writeSid。当前桌面编译件的调用为 flags 9，read-only 列表为 logonSid / world，workspace-write 另加写能力 SID。
+
+这是一条**代码来源 + 本机参数复现**的归因链；未安装并运行全部历史 DSH 版本，不能宣称已证明每个旧版本在当时 Windows 系统上的表现。当前版本上游 runner.spec.ts 中未检出 curl / Schannel / HTTPS / Invoke-WebRequest 用例；这只能说明该测试文件未覆盖，不能扩大成全仓所有测试都没有。
+
+### 记录更正与后续方向
+
+此前记忆 dsh-sandbox-lowil-schannel-no-credentials 将完整沙箱与 High 的差异直接归因于 Low，证据不成立。本轮仅 Low 成功、High + 写限制失败，已据此更正；前段“未分离变量”的观察保留为历史记录，以本段为进一步结论。
+
+后续应在 DSH Windows ACL 后端增加 Schannel / curl / Invoke-WebRequest 回归，并研究保留文件写入与删除边界的兼容方案。不能直接撤 Low（会回开删除旁路，且本轮 High + 写限制仍然失败），也不能恢复宽 SID 列表（本轮无效，历史上还会回开越界写入）。Node.js HTTPS / WSL OpenSSL 的可用性已在前段实测，可作为沙箱内现有的网络路径。
+
+本轮没有修改上游、应用归档、生产权限或系统网络配置，没有创建公开 issue / PR；归因实验只覆盖本机 Windows 构建，其他系统及 UAC 标准用户仍需独立验证。
+
+## 新版上游复核（2026-11-12）
+
+联网核对时，最新标签为 [dsh-v0.2.2-rc.2](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.2.2-rc.2)，commit ddac96760b6edf8fa0fe17cbdcf0b512f4c12b2c；master 为 e8f7b93a344964de3dca1ace9e72b6e4d6de87cb，提交时间2026-11-11T02:49:46Z。发布标签与master的Windows ACL后端src树相同。
+
+与本机fcc0ad462172522aaf5c93a7b2e01f6b9f0b0159相比，token.ts、runner.ts、spawn.ts、ffi.ts、acl.ts、grant.ts均为相同Git blob；tests树也完全相同。src仅index.ts新增导出isTempRootInsideWorkspace，path-boundary.ts把既有临时目录包含关系判断抽成该函数；没有改变Schannel、令牌、进程启动或凭据处理。token.ts仍为DISABLE_MAX_PRIVILEGE | WRITE_RESTRICTED加logon SID / Everyone / 写能力SID。
+
+结论：截至该次核对，最新发布与master中没有针对此故障的修复，不能指望升级到rc.2恢复系统curl/IWR。此为源码与历史差异核对，没有安装新版运行；仍不泛化所有Windows主机。API查询dev分支失败，未对不存在或不可取的dev分支作结论。
+
+上游已有相同现象报告：[讨论3207](https://github.com/deepseek-ai/deepseek-harness/discussions/3207)（2026-08-18）及[讨论4163](https://github.com/deepseek-ai/deepseek-harness/discussions/4163)（2026-08-23；2026-10-02回复建议OpenSSL）。帖子是旁证，结论以实际源码差异为主；不沿用帖子里未经隔离的特权归因或把pip/git一概判定为Schannel客户端。