ARCHITECTURE

dsh-TUI Architecture and Security Boundaries

dsh-TUI owns interaction and presentation. DeepSeek Harness services continue to own session logs, model calls, tools, forks, compaction, and persistence.

Plugin mounting pipeline

dsh profile
  → dsh-base
  → dsh-TUI Cordis patch
  → Agent preset + DSH services
  → session / event
  → Channel projection
  → React components
  → Ink / Yoga renderer
  → terminal

Event-driven rendering

The session/event stream is projected into incremental UI state. Terminal output is differential while scrolling and selection remain independent.

Layout-level virtualization

Off-screen messages become measured-height placeholders and their child trees leave Yoga layout, keeping per-frame work close to O(visible window).

Security boundary

dsh-TUI does not implement a separate sandbox. It inherits file, shell, sandbox, and approval policy from the active DSH profile. Review that profile before opening untrusted code or credential-rich environments.