kevchess15/deepseek-harness
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
deepseek-harness/packages/sandbox
History
Huanqi Cao 0a17575040 fix(sandbox): address review: leak FIXME, legal ACL fixture, stronger offset test, prose
2026-08-10 19:34:01 +08:00
..
sandbox Merge branch 'feat/windows-pwsh-default' into feat/windows-acl-sandbox 2026-08-09 17:50:55 +08:00
sandbox-local docs: make technical prose concrete 2026-08-10 16:34:20 +08:00
sandbox-policy docs: make technical prose concrete 2026-08-10 16:34:20 +08:00
sandbox-windows-acl fix(sandbox): address review: leak FIXME, legal ACL fixture, stronger offset test, prose 2026-08-10 19:34:01 +08:00
README.i18n.yaml docs: anchor each subsystem page to its package group; make group READMEs thin tables 2026-08-09 01:32:39 +08:00
README.md docs: anchor each subsystem page to its package group; make group READMEs thin tables 2026-08-09 01:32:39 +08:00
README.zh.md docs: anchor each subsystem page to its package group; make group READMEs thin tables 2026-08-09 01:32:39 +08:00

README.md

sandbox/ — process-sandbox capability family

English | 中文

This family applies per-session confinement policy to process execution. It covers same-world subprocesses; isolated environments replace complete capability implementations instead of registering here.

Package Role ctx key
sandbox/ Defines the process-sandbox service and shared escalation vocabulary ctx.sandbox
sandbox-local/ Provides local platform confinement backends registers on ctx.sandbox
sandbox-policy/ Resolves durable per-session sandbox policy ctx.sandboxPolicy

See the sandbox decision for the capability boundary and the filesystem integration decision for cross-family policy use.

The subsystem reference — modes and enforcement, per-call policy, wrapped-argv dialects, fail-closed errors — is docs/subsystems/sandbox.md; the boundary and the cross-family phase live in the sandbox and cross-family fs sandbox Agent Notes.