English | 中文
dsh-win-multi-bash
A Windows multi-bash plugin for DeepSeek Harness. git_bash (Git for Windows / MSYS) is on by default. wsl_bash (WSL), msys2_bash (MSYS2 UCRT64) and ssh_bash (a remote shell over the OpenSSH client) are opt-in. terminal keeps a real PTY session alive between calls.
Every dialect owns its own executor, and no tool registers as ctx.shell — that seat stays with the base bundle's pwsh, so pwsh behaves exactly as it does without this plugin.
Tools
| Tool | Backend | Notes |
|---|
git_bash | Git for Windows (MSYS) | On by default; owns a GitBashExecutor |
wsl_bash | WSL Linux | Opt-in; owns a WslBashExecutor; its first load probes the distro |
msys2_bash | MSYS2 UCRT64 | Opt-in; owns a Msys2BashExecutor; MSYS2's own $MSYSTEM and pacman |
ssh_bash | Remote (SSH) | Opt-in; owns a SshBashExecutor; one command per call; the target is deployment configuration |
terminal | any of the above | Persistent PTY sessions: open / send / read / signal / close / list |
pwsh | dsh's own | Untouched; served by the base bundle's pwsh-sandbox row |
Only git_bash and terminal are enabled by default. The other three rows are switched off because each mounts a toolchain (or a host) a machine may not have; enable them on the Plugins page. On many Git for Windows hosts the windows-acl runner cannot launch MSYS bash, so git_bash runs unconfined and says so — for confinement use wsl_bash (bwrap) or dsh's pwsh. See Sandbox behavior.
Requirements
- dsh
0.1.7-rc.2 through 0.2.x — the window package.json's engines.dsh declares. A newer dsh refuses this plugin until a release is re-verified for that line.
- Windows, and a dsh deployment that provides the published
@deepseek-ai base packages.
- Git Bash and/or WSL and/or MSYS2 only for the backends you enable; a missing backend never affects pwsh.
- For
ssh_bash: an OpenSSH client, a reachable host and a credential that needs no interactive prompt.
- Node
^22.19.0 || >=24.0.0 (the range this package declares), and pnpm for installation.
Install
Install through dsh plugin, the pnpm forwarder: it applies this package's own cordis.patch.yml bundle layer, which inserts the rows.
dsh plugin --profile web add dsh-win-multi-bash # npm package (recommended)
dsh plugin --profile web add github:@Dinosaur-MC/dsh-win-multi-bash # GitHub source
dsh plugin --profile web remove dsh-win-multi-bash # remove
Requires pnpm. The bundle layer is assembled at boot, so restart dsh web for a change to take effect. Do not also hand-write the same rows into the profile's cordis.patch.yml: the loader rejects duplicate entry ids. Details and the manual equivalent are in Configuration.
Quick start
git_bash is ready after install. It runs a fresh MSYS bash per call; workdir accepts native, MSYS (/c/...) and WSL automount (/mnt/c/...) forms.wsl_bash / msys2_bash: enable win-mb-tool-wsl / win-mb-tool-msys2 on the Plugins page. Pin wslBash.wslDistro or msys2Bash.bashPath only when discovery is not enough.ssh_bash: enable win-mb-tool-ssh and pin sshBash.sshHost (a host or a ~/.ssh/config alias), plus sshUser / sshPort when needed. The target is never a tool argument; a row with no host refuses every call. A one-shot call uses BatchMode=yes, so authenticate with a key; a terminal session with shell: "ssh_bash" is the form that can answer a first-connect prompt.terminal: open a session, send commands with submit: true, read the reply, then close. The working directory, exported variables and aliases survive between calls. Sessions are process-local, capped, idle-reclaimed and not jobs; the Session header lists running and finished sessions and can stop one.- Every row has a Configure page on the Plugins page: paths, timeouts, sandbox stance, session limits and the deployment-wide self-heal switch. Changes are live unless a knob shapes the tool schema.
Design at a glance
- Honest facts, not guesses. A successful confined run says
denied: false; a failed one matching the backend's denial dialect says denied: true; a failed one matching nothing says no denied at all. An unwrapped run says unconfined: true. A remote SSH run reports sandbox: { mode, remote: true } and never borrows a local verdict.
- Platform-native calls. Our tool calls render as the platform's own shell card, with the full terminal label set, the seat's
useDisclosure, a header-only background card, and the platform's exit capsule. See Conversation rows.
- One declaration per dialect. A dialect is one executor file plus one registry declaration; the tool modules, prompt membership, patch rows, config partition, package exports and client rows are derived from it. A declaration that does not hold together throws at load. See Architecture and Principles.
- One shared prompt section. The core row owns a single
tool:win-mb-bash section whose text follows the mounted tools; each tool description keeps only its own dialect facts.
- Live configuration, user input wins. Knobs are
.volatile() where they can be live; the page never rewrites or deletes a value, and a save is revision-fenced. See Configuration.
Documentation
| Document | What it covers |
|---|
| Architecture | Rows, executors, the dialect registry, the prompt section, the client half and the call flow |
| Design principles | The rules the implementation is held to: honest facts, derived surfaces, parity, live vs schema knobs |
| Sandbox behavior | Per-backend capabilities, Windows caveats, bwrap, self-heal, SSH's remote scope |
| Terminal sessions | PTY lifecycle, signals, limits, SSH sessions, measured defaults |
| Conversation rows | How a call becomes the platform shell card |
| Configuration | The Plugins page, every row's knobs, live semantics, staged saves |
| Verification | Dev runtime, both test entries, the live SSH round trip |
| Troubleshooting | Symptom → fix |
The detailed documents are maintained in English; this README is the bilingual entry point and release summary.
Verification
npm ci # once: the pinned 0.2.1-rc.2 dev runtime
pnpm test # boot a composition; run real commands; a verdict
pnpm run test:audit # the full audit suite
DSH_AUDIT_SSH_HOST=ubuntu_tx node smoke/prepare.mjs audit # optional live SSH
Both entries are development tools: the published tarball ships no smoke/. pnpm test fails on a missing tool, a wrong description, a lost ctx.shell seat or a failed command; the audit announces and counts its skips. Details in Verification.
Layout
dsh-win-multi-bash/
├── package.json # dsh.bundle + dsh.client + engines.dsh; exports for every tool subpath
├── cordis.patch.yml # the composition wiring (documented inline)
├── lib/ # plain ESM implementation (no build step)
├── smoke/ # development verification (not published)
├── docs/ # architecture, principles, sandbox, terminal, rows, config, verification, troubleshooting
└── LICENSE / THIRD_PARTY_NOTICES
docs/ and smoke/ are repository-only; npm pack ships only the files listed in package.json.
License
MIT. See LICENSE; upstream notices are in THIRD_PARTY_NOTICES.
