# dsh-silent-pwsh

A **DeepSeek-Harness plugin** for Windows that makes sandboxed (confined) `pwsh` / `bash` calls spawn their console window **hidden** (`SW_HIDE`) — no black console window flashes on every command.

![dsh](https://img.shields.io/badge/DeepSeek--Harness-plugin-4b6bff)

## Problem

Every sandboxed pwsh call in DeepSeek-Harness runs through the windows-acl runner (`dsh-sandbox-windows-acl/lib/runner.js`), which spawns the confined child with a fresh console window unless `STARTF_USESHOWWINDOW | SW_HIDE` is set in the child's `STARTUPINFOW`. The shipped package omits it, so **every confined command flashes a black console window** on the desktop. (`CREATE_NO_WINDOW` is not an option: under the restricted token it makes the child die with `STATUS_DLL_INIT_FAILED` (`0xC0000142`) — verified by the DSH maintainers. `SW_HIDE` keeps the console alive and simply never shows it.)

Two related flashes are also fixed: the process-tree `taskkill` termination and the one-time sandbox capability probe, whose spawns lacked `windowsHide`.

## How it works

DSH's plugin model is loader-config patches plus Cordis plugins; no config seam can change those native spawn flags. So this plugin is a **self-healing patch plugin**: on every host start (before any confined command runs) it idempotently checks and re-applies a three-file patch:

| File (under `<host>\node_modules`) | Patch |
|---|---|
| `@deepseek-ai/dsh-sandbox-windows-acl/lib/types-CNjZgO4h.js` | both `encodeStartupInfo` calls: `dwFlags: 256` → `257` (+`STARTF_USESHOWWINDOW`), add `wShowWindow: 0` (`SW_HIDE`) |
| `@deepseek-ai/dsh-subprocess-local/lib/index.js` | `taskkill` `spawnSync` gets `windowsHide: true` |
| `@deepseek-ai/dsh-sandbox-local/lib/index.js` | windows-acl capability probe `spawnSync` gets `windowsHide: true` |

The patch only rewrites files that are in the expected pre-patch shape; if an upgrade changes them, it warns and skips instead of corrupting them. **Reinstall or upgrade the app and the patch is re-applied automatically on the next boot.**

## Install

Requirements: DeepSeek-Harness desktop app, `node` and `pnpm` on `PATH`.

### From GitHub (recommended)

```powershell
dsh plugin --profile web add github:chengyimingvb/dsh-silent-pwsh
# or with a full URL
dsh plugin --profile web add https://github.com/chengyimingvb/dsh-silent-pwsh
```

### From a local folder / zip

```powershell
# extract the zip, cd into dsh-silent-pwsh, then:
.\install.ps1                      # installs into the 'web' profile
.\install.ps1 -Profile headless    # or another profile
# if blocked by execution policy:  powershell -ExecutionPolicy Bypass -File .\install.ps1
```

Then **restart DeepSeek Harness**. The host log will show `[silent-pwsh] up to date` (or `[silent-pwsh] patched …` when it had to heal).

> **Gotcha:** if pnpm fails with a supply-chain policy error (`minimumReleaseAge`), add the reported `package@version` to the profile's `pnpm-workspace.yaml` `minimumReleaseAgeExclude` list and re-run.

## Uninstall

```powershell
dsh plugin --profile web remove dsh-silent-pwsh
```

The patched files are left as-is. To restore the shipped files manually:

```powershell
$chunk = "$env:ProgramFiles\DeepSeek Harness\resources\host\node_modules\@deepseek-ai\dsh-sandbox-windows-acl\lib\types-CNjZgO4h.js"
(Get-Content $chunk -Raw) -replace 'dwFlags: 257,`n`t`twShowWindow: 0,', 'dwFlags: 256,' | Set-Content $chunk -NoNewline -Encoding utf8
# likewise remove ', windowsHide: true' from the taskkill and probe spawnSync calls.
```

## Configuration

- `DSH_INSTALL_ROOT` — point at the directory containing `node_modules` when the host root cannot be auto-detected. Default detection: `<app dir>\resources\host` derived from `process.execPath`, with `cwd` and plugin-location fallbacks.

## Development / verification

```powershell
node test.mjs   # idempotence against the real host files + heal-a-reverted-copy round trip
```

Verified: confined pwsh still executes correctly through the runner (exit 0, output flows through inherited stdio, no `0xC0000142` regression).

## Notes for maintainers

The packaged app already ships a fixed-but-unused chunk (`types-C1ecepac.js`); wiring the entry imports to it is the upstream fix. This plugin exists so users on shipped builds get the behavior now, self-healing across reinstalls.

## License

MIT