kevchess15/deepseek-harness
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
deepseek-harness/packages/sandbox
History
kingwl 5e629f7004 test: fix packed install closure and macOS paths
2026-08-11 17:58:08 +08:00
..
sandbox Merge remote-tracking branch 'origin/master' into worktree/windows-acl-hardening-followup 2026-08-11 14:32:26 +08:00
sandbox-local test: fix packed install closure and macOS paths 2026-08-11 17:58:08 +08:00
sandbox-policy refactor: replace overloaded surface terminology 2026-08-11 15:23:05 +08:00
sandbox-windows-acl refactor: replace overloaded surface terminology 2026-08-11 15:23:05 +08:00
README.i18n.yaml docs: anchor each subsystem page to its package group; make group READMEs thin tables 2026-08-09 01:32:39 +08:00
README.md docs: anchor each subsystem page to its package group; make group READMEs thin tables 2026-08-09 01:32:39 +08:00
README.zh.md docs: anchor each subsystem page to its package group; make group READMEs thin tables 2026-08-09 01:32:39 +08:00

README.md

sandbox/ — process-sandbox capability family

English | 中文

This family applies per-session confinement policy to process execution. It covers same-world subprocesses; isolated environments replace complete capability implementations instead of registering here.

Package Role ctx key
sandbox/ Defines the process-sandbox service and shared escalation vocabulary ctx.sandbox
sandbox-local/ Provides local platform confinement backends registers on ctx.sandbox
sandbox-policy/ Resolves durable per-session sandbox policy ctx.sandboxPolicy

See the sandbox decision for the capability boundary and the filesystem integration decision for cross-family policy use.

The subsystem reference — modes and enforcement, per-call policy, wrapped-argv dialects, fail-closed errors — is docs/subsystems/sandbox.md; the boundary and the cross-family phase live in the sandbox and cross-family fs sandbox Agent Notes.