v0.1.0

dsh-win-multi-bash v0.1.0

Windows multi-bash plugin for DeepSeek Harness: git_bash / wsl_bash model tools plus a shell-select executor routing the single ctx.shell seat across Git Bash, WSL and pwsh. Pwsh stays the default — existing behavior is unchanged until a bash-family tool is called.

Features

• git_bash tool — Git for Windows (MSYS) toolchain, auto-resolved (well-known locations → PATH → git.exe layout inference → GitForWindows registry), never the WSL launcher.
• wsl_bash tool — WSL distro Linux userland; commands ride as base64 payloads so quoting and paths pass verbatim.
• shell-select executor — routes request.shell ?? default across git-bash / wsl-bash / pwsh; pwsh stays the default.
• Sandboxing — pwsh: windows-acl restricted token (partial); wsl-bash: bwrap inside the distro (full); git-bash: windows-acl probe (typically unavailable with Git for Windows — CreateProcessAsUserW cannot launch MSYS bash).
• requireSandbox hardening (new) — when a backend's probe fails, refuse unconfined runs unless the effective mode is danger-full-access; escalation via sandbox_permissions stays available.
• bwrap denial classification (new) — denied file effects now report denied: true with the [sandbox: file access denied] marker (foreground and background paths).
• MSYS path-conversion guidance — tool descriptions and README document MSYS_NO_PATHCONV=1 for native exe calls (e.g. wsl.exe) from git_bash.

Install

# hot plug (no restart; recommended)
powershell -ExecutionPolicy Bypass -File .\install.ps1

# bundle install (restart dsh web)
dsh plugin --profile web add dsh-win-multi-bash
# or from source: dsh plugin --profile web add github:@Dinosaur-MC/dsh-win-multi-bash

Sandbox notes (read before use)

• wsl_bash sandboxing requires bubblewrap inside the distro (sudo apt-get install -y bubblewrap on Ubuntu/Debian); the probe verdict is cached for the host process lifetime — restart dsh web after installing.
• git_bash usually cannot be sandboxed in Git for Windows deployments — do not assume DSH sandbox protection for it; enable requireSandbox to refuse unconfined runs outside danger-full-access.
• Denials are only classified when the command exits non-zero (matching upstream bash-sandbox rules).

Verification

smoke/run.ps1 boots a real composition and verifies git_bash / wsl_bash register and execute real commands (default and pinned bashPath variants).