@deepseek-ai/dsh-base
作为配置文件捆绑包的共享 dsh 核心：基于基础配置文件的配置文件的第一补丁层，将核心行插入空配置文件根中
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @deepseek-ai/dsh-base@0.0.1-rc.1Base 以 @deepseek-ai/dsh-base 发布，当前版本为 0.0.1-rc.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
@deepseek-ai/dsh-baseEnglish | 中文
The shared dsh core as a profile bundle: cordis.patch.yml inserts every base plugin row — model adapters, the shared agent-default-model selection, tools, persistence, policy, settings/credentials, telemetry, and host-level subagent providers — over the empty profile root, as the first layer of every profile's dsh.profile.bundles list. Codex and Claude Code providers load dormant; Agent Presets independently decide whether their agent contributes either model-facing delegation tool. Later bundle layers (e.g. dsh-web-app) and the user's profile cordis.patch.yml override these rows by id; a patch replaces a row's whole config, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the patch through the dsh.bundle.patch manifest field, never through code.
Windows hosts booting a shipped profile additionally receive windows.cordis.patch.yml: it disables the POSIX-only bash stack (bash-sandbox/tool-bash) and inserts the sandbox-confined PowerShell stack (@deepseek-ai/dsh-pwsh-sandbox, @deepseek-ai/dsh-tool-pwsh). The permission surface stays exactly as on POSIX: sandbox/sandbox-policy enforce the file-effect policy through the Windows ACL restricted-token runner (the win32 chain of dsh-sandbox-local → @deepseek-ai/dsh-sandbox-windows-acl), the permission switcher and the approval service run unchanged, and fs-sandbox keeps fencing ctx.fs writes — mounting dsh-fs-local alongside it would double-register ctx.fs and fail the load. The launcher applies the layer between the bundle layers and the user layers on win32 hosts; a Windows host that prefers the unconfined local pwsh executor or full access overrides these rows through its profile or home cordis.patch.yml (the bash-restore recipe must be complete: disable pwsh-sandbox/tool-pwsh AND re-enable bash-sandbox/tool-bash — both executor families register the same bash service, so an incomplete recipe fails loud at load). POSIX hosts never receive it.
The row set and its rationale are documented inline in the patch file; the generated composition graph renders it.
Indirectly, through the inserted rows: this bundle selects the shipped persona-less prompt base, tool set, and DeepSeek adapter that mode bundles specialize, and contributes no model-visible text of its own.
None directly; each inserted row's package owns its effect.
claude; removing the SDK's unused optional payload is deferred to the product installation-closure follow-up.workspace-write confines writes to the workspace plus the session's own temp subdirectory (<temp>\dsh-<hash>, TMP/TEMP rewritten for confined children); read-only grants nothing. See @deepseek-ai/dsh-sandbox-windows-acl.