deepseek-harness/website/zh-CN/api/harness/sandbox.md

ctx.sandbox

SandboxProvider (abstract seam) — provided by @deepseek-ai/dsh-sandbox.

Abstract process-sandbox service. confine must return enforcing argv or fail closed at wrap or runner-execution time; silent unconfined passthrough is forbidden. Functional probes arbitrate multi-runner chains and may be skipped for a sole candidate, whose own refusal remains the fail-closed end.

Source

ctx.sandbox.confine(argv, policy)

abstract confine(argv: readonly string[], policy: SandboxPolicy): ConfinedArgv

Wrap argv so it executes confined under policy on this host; the caller spawns the returned argv in place of its own.

• argv — the exact argv the caller is about to spawn (program plus arguments), NOT a shell string — a shell-shaped consumer passes ['bash', '-c', command].
• policy — the file-effect policy this execution runs under, carried per call (see SandboxPolicy).

Returns the argv to spawn instead, plus the enforcement completeness the selected backend achieves for it.

Source