mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
f1deffeccb
The source-through-tsx fallback in windowsAclRunnerInvocation was only reachable while sandbox-windows-acl/lib/runner.js was absent, so the per-file 100% gate failed wherever a gate had already built it. In ci-primary and ci-windows-complete the typert-contracts gate runs build:lib:host ahead of test:coverage in one workspace, leaving both fallback statements uncovered; the sharded coverage job never builds first and stayed green. Cover the fallback through an injected entry path that is guaranteed not to exist, and keep the uninjected case asserting only the verdict that holds under either arm. Verified at 100% statements/branches/functions/ lines with lib/runner.js both present and absent.
sandbox/ — process-sandbox capability family
English | 中文
This family applies per-session confinement policy to process execution. It covers same-world subprocesses; isolated environments replace complete capability implementations instead of registering here.
| Package | Role | ctx key |
|---|---|---|
sandbox/ |
Defines the process-sandbox service and shared escalation vocabulary | ctx.sandbox |
sandbox-local/ |
Provides local platform confinement backends | registers on ctx.sandbox |
sandbox-policy/ |
Resolves durable per-session sandbox policy | ctx.sandboxPolicy |
See the sandbox decision for the capability boundary and the filesystem integration decision for cross-family policy use.
The subsystem reference — modes and enforcement, per-call policy, wrapped-argv dialects, fail-closed errors — is docs/subsystems/sandbox.md; the boundary and the cross-family phase live in the sandbox and cross-family fs sandbox Agent Notes.