mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00

Files

kingwl 2dc62497ce feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity

Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.

- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
  deployment default mode + workspaceRoot and the per-session override event,
  renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
  Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
  write/edit by the per-call mode (read-only denies, workspace-write contains to
  the workspace + temp roots via the shared writableRoots, danger passes
  through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
  re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
  ladder, denial/hint markers, approveEscalation) both tool families use;
  approveEscalation takes a structural approver so dsh-sandbox gains no
  approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
  confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
  and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
  that disabled the fs stack under confined modes.

RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.

2026-07-14 20:05:57 +08:00

4.4 KiB

Raw Blame History

ACP Agent App Composition

The ACP demo exposes the same agent spine over JSON-RPC stdio, with no stdout logger and no pre-created agent; clients create sessions through the ACP bridge.

flowchart LR
  cfg["examples/acp-agent<br/>cordis.yml"]
  plugin_acp_llm_deepseek["llm-deepseek<br/>@deepseek-ai/dsh-llm-deepseek"]
  cfg --> plugin_acp_llm_deepseek
  plugin_acp_sandbox["sandbox<br/>@deepseek-ai/dsh-sandbox-local"]
  cfg --> plugin_acp_sandbox
  plugin_acp_sandbox_policy["sandbox-policy<br/>@deepseek-ai/dsh-sandbox-policy"]
  cfg --> plugin_acp_sandbox_policy
  plugin_acp_bash["bash<br/>@deepseek-ai/dsh-bash-sandbox"]
  cfg --> plugin_acp_bash
  plugin_acp_approval["approval<br/>@deepseek-ai/dsh-user-approval"]
  cfg --> plugin_acp_approval
  plugin_acp_permission["permission<br/>@deepseek-ai/dsh-permission"]
  cfg --> plugin_acp_permission
  plugin_acp_acp_agent["acp-agent<br/>@deepseek-ai/dsh-acp-agent"]
  cfg --> plugin_acp_acp_agent
  plugin_acp_acp_agent --> bundle_agent_core["@deepseek-ai/dsh-agent-core"]
  plugin_acp_acp_agent --> bundle_jsonl["@deepseek-ai/dsh-session-persistence-jsonl"]
  plugin_acp_acp_agent --> frontdoor_acp["@deepseek-ai/dsh-acp<br/>JSON-RPC stdio bridge<br/>sessions created by client"]
  bundle_agent_core --> spine_llm["ctx.llm"]
  bundle_agent_core --> spine_sessions["ctx.sessions"]
  bundle_agent_core --> spine_tools["ctx.tools + tool-bash"]
  bundle_agent_core --> spine_loop["ctx.agents + ctx.agentLoop"]
  plugin_acp_subagent["subagent<br/>@deepseek-ai/dsh-subagent"]
  cfg --> plugin_acp_subagent
  plugin_acp_subagent_spawn["subagent-spawn<br/>@deepseek-ai/dsh-subagent-spawn"]
  cfg --> plugin_acp_subagent_spawn
  plugin_acp_subagent_fork["subagent-fork<br/>@deepseek-ai/dsh-subagent-fork"]
  cfg --> plugin_acp_subagent_fork
  plugin_acp_tool_subagent["tool-subagent<br/>@deepseek-ai/dsh-tool-subagent"]
  cfg --> plugin_acp_tool_subagent
  plugin_acp_tool_subagent_fork["tool-subagent-fork<br/>@deepseek-ai/dsh-tool-subagent"]
  cfg --> plugin_acp_tool_subagent_fork
  plugin_acp_workflow_workerthread["workflow-workerthread<br/>@deepseek-ai/dsh-workflow-workerthread"]
  cfg --> plugin_acp_workflow_workerthread
  plugin_acp_tool_workflow["tool-workflow<br/>@deepseek-ai/dsh-tool-workflow"]
  cfg --> plugin_acp_tool_workflow
  plugin_acp_tool_todo["tool-todo<br/>@deepseek-ai/dsh-tool-todo"]
  cfg --> plugin_acp_tool_todo
  plugin_acp_repeat_tool_guard["repeat-tool-guard<br/>@deepseek-ai/dsh-repeat-tool-guard"]
  cfg --> plugin_acp_repeat_tool_guard
  plugin_acp_fs_sandbox["fs-sandbox<br/>@deepseek-ai/dsh-fs-sandbox"]
  cfg --> plugin_acp_fs_sandbox
  plugin_acp_fs_policy["fs-policy<br/>@deepseek-ai/dsh-fs-policy"]
  cfg --> plugin_acp_fs_policy
  plugin_acp_tool_fs["tool-fs<br/>@deepseek-ai/dsh-tool-fs"]
  cfg --> plugin_acp_tool_fs
  plugin_acp_hooks_claude["hooks-claude<br/>@deepseek-ai/dsh-hooks-claude"]
  cfg --> plugin_acp_hooks_claude
  plugin_acp_hooks_codex["hooks-codex<br/>@deepseek-ai/dsh-hooks-codex"]
  cfg --> plugin_acp_hooks_codex

Plugin id	Package / module
`llm-deepseek`	`@deepseek-ai/dsh-llm-deepseek`
`sandbox`	`@deepseek-ai/dsh-sandbox-local`
`sandbox-policy`	`@deepseek-ai/dsh-sandbox-policy`
`bash`	`@deepseek-ai/dsh-bash-sandbox`
`approval`	`@deepseek-ai/dsh-user-approval`
`permission`	`@deepseek-ai/dsh-permission`
`acp-agent`	`@deepseek-ai/dsh-acp-agent`
`subagent`	`@deepseek-ai/dsh-subagent`
`subagent-spawn`	`@deepseek-ai/dsh-subagent-spawn`
`subagent-fork`	`@deepseek-ai/dsh-subagent-fork`
`tool-subagent`	`@deepseek-ai/dsh-tool-subagent`
`tool-subagent-fork`	`@deepseek-ai/dsh-tool-subagent`
`workflow-workerthread`	`@deepseek-ai/dsh-workflow-workerthread`
`tool-workflow`	`@deepseek-ai/dsh-tool-workflow`
`tool-todo`	`@deepseek-ai/dsh-tool-todo`
`repeat-tool-guard`	`@deepseek-ai/dsh-repeat-tool-guard`
`fs-sandbox`	`@deepseek-ai/dsh-fs-sandbox`
`fs-policy`	`@deepseek-ai/dsh-fs-policy`
`tool-fs`	`@deepseek-ai/dsh-tool-fs`
`hooks-claude`	`@deepseek-ai/dsh-hooks-claude`
`hooks-codex`	`@deepseek-ai/dsh-hooks-codex`

Source config: examples/acp-agent/cordis.yml.

Maintenance mode: hybrid: the leaf plugin list is parsed from its cordis.yml; app package expansion is curated from package source.

4.4 KiB Raw Blame History

ACP Agent App Composition

4.4 KiB

Raw Blame History