mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
99650a201b
A ModeDefinition may declare access: the widest sandbox access shell commands run under while the mode holds, on the SANDBOX_MODES ladder. The bash seam gains the resolution point to hang it on: BashExecutor. resolveMode(session) folds override ?? default and dispatches the new bash/resolve-mode waterfall; dsh-tool-bash consults it at both the stamping site and the escalation baseline; dsh-mode's clamp listener takes the ladder minimum per call. Two independent log folds compose at read time — the mode never writes the sandbox knob, so the two switch in any order and the knob re-emerges intact on exit. The built-in plan definition ships access: read-only with the bash trio allowlisted CONDITIONALLY: both policy layers admit bash/bash_output/ bash_kill only while a confining executor is mounted (an unconfinable shell cannot honor the cap), and a bash call carrying sandbox_permissions under a cap is denied at the gate — no widening mid-mode; the widened step belongs in the plan. examples/plan-acp-agent swaps bash-local for sandbox-local + bash-sandbox (workspace-write default, clamped read-only inside plan) plus the approval seam; the re-recorded plan-mode arc runs a real cat inside plan under the clamped sandbox, and modes-advertise now pins the sandbox-mode and approval config options. RFC amended to the landed shape (access cap section, orthogonality FAQ, deferred item resolved into effects self-declaration).
bash/ — bash capability family
The canonical three-package capability seam (see capability seams): an abstract executor interface, concrete implementations, and the model-facing tool that consumes it. All product packages.
| Package | Role | ctx key |
|---|---|---|
bash/ |
Abstract bash executor seam (interface + vocabulary; sandbox result facts carry the sandbox/ seam's mode/enforcement vocabulary) |
ctx.bash |
bash-local/ |
Local-subprocess BashExecutor implementation |
(registers ctx.bash) |
bash-sandbox/ |
Sandbox-consuming BashExecutor (wraps every command argv via ctx.sandbox, stamps denial/enforcement facts; extends bash-local's mechanics) |
(registers ctx.bash) |
tool-bash/ |
Model-facing bash/bash_output/bash_kill tool schemas |
(registers on ctx.tools) |
The interface lives at bash/bash/. bash-sandbox replacing bash-local without touching the interface or the tool is the split doing exactly what it exists for — a leaf cordis.yml picks one executor entry, plus a ctx.sandbox provider entry for the confined one (see examples/sandbox-acp-agent).