fix(cli): resolve the pwsh-sandbox layer row from the cold-start module closure

The launcher's healProfilesModuleFallback BFS-links the apps/cli dependency closure into the profile's node_modules (the pwsh-local precedent): without dsh-pwsh-sandbox in apps/cli dependencies, a fresh Windows host cannot resolve the inserted row. Assert the closure reaches both inserted packages in the real-layers composition; rewrap the windows-shell layer comment.

apps/cli/package.json

@@ -25,6 +25,7 @@
     "@deepseek-ai/dsh-pty": "workspace:^",
     "@deepseek-ai/dsh-pty-local": "workspace:^",
     "@deepseek-ai/dsh-pwsh-local": "workspace:^",
+    "@deepseek-ai/dsh-pwsh-sandbox": "workspace:^",
     "@deepseek-ai/dsh-session-reference": "workspace:^",
     "@deepseek-ai/dsh-tmux-context": "workspace:^",
     "@deepseek-ai/dsh-tool-ask-user": "workspace:^",

apps/cli/src/windows-shell.ts

@@ -2,7 +2,7 @@
  * The Windows shell platform layer: on win32 hosts the shipped profile
  * compositions swap the POSIX-only bash stack for the sandbox-confined
  * PowerShell stack (`@deepseek-ai/dsh-pwsh-sandbox` +
- * `@deepseek-ai/dsh-tool-pwsh`), matching the Windows-pwsh-default roadmap. The layer is the base bundle's
+ * `@deepseek-ai/dsh-tool-pwsh`). The layer is the base bundle's
  * `windows.cordis.patch.yml`, injected by the launcher between the bundle
  * layers and the user layers so a user patch can still override it — the
  * only override channel is composition config, like every other roster

apps/cli/tests/windows-shell.spec.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it } from 'vitest'
-import { mkdtempSync, writeFileSync, rmSync, mkdirSync } from 'node:fs'
+import { mkdtempSync, writeFileSync, rmSync, mkdirSync, readFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -97,6 +97,13 @@ describe('the shipped Windows composition (real bundle layers)', () => {
     for (const id of ['pwsh-sandbox', 'tool-pwsh']) {
       expect(byId.has(id), `inserted row ${id}`).toBe(true)
     }
+    // The launcher's cold-start module fallback BFS-links the apps/cli
+    // dependency closure into the profile's node_modules (the pwsh-local
+    // precedent), so every inserted bare plugin must resolve from there.
+    const cliManifest = JSON.parse(readFileSync(anchor, 'utf8')) as { dependencies?: Record<string, string> }
+    for (const name of ['@deepseek-ai/dsh-pwsh-sandbox', '@deepseek-ai/dsh-tool-pwsh']) {
+      expect(cliManifest.dependencies?.[name], `cold-start closure must reach ${name}`).toBeDefined()
+    }
     // The patch touches only base-owned rows plus inserts, so the full web
     // profile composes without any no-match warning.
     expect(warnings).toEqual([])

pnpm-lock.yaml

@@ -164,6 +164,9 @@ importers:
       '@deepseek-ai/dsh-pwsh-local':
         specifier: workspace:^
         version: link:../../packages/bash/pwsh-local
+      '@deepseek-ai/dsh-pwsh-sandbox':
+        specifier: workspace:^
+        version: link:../../packages/bash/pwsh-sandbox
       '@deepseek-ai/dsh-session-reference':
         specifier: workspace:^
         version: link:../../packages/context/session-reference