mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
acac2149a5
The Windows platform layer previously kept fs path-rule confinement (sandbox-policy + fs-sandbox) next to the unconfined pwsh shell. Windows has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the shell can bypass fs-only path rules with one command — the policy was theater. The layer now removes the whole sandbox stack (sandbox, sandbox-policy, fs-sandbox disabled), mounts the unconfined dsh-fs-local, and degrades to danger-full-access: permission/ui-permission leave the roster and the approval policy is 'never'. dsh-base declares dsh-fs-local so the profile module fallback links it for cold starts; base.spec.ts pins the shipped Windows roster (disables, inserts, approval policy); the Agent Note records the rejected fs-only confinement alternative.
49 lines
1.4 KiB
YAML
49 lines
1.4 KiB
YAML
# The dsh-base Windows platform layer: applied by the dsh launcher on win32
|
|
# hosts, between the bundle layers and the user layers. Windows cannot run
|
|
# the POSIX-only sandboxed stacks, so this layer swaps the shipped bash stack
|
|
# for the PowerShell stack AND drops the sandbox entirely: no OS runner
|
|
# exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any policy
|
|
# would be theater — the unconfined shell could bypass fs-only path rules
|
|
# with one command. Windows therefore degrades to danger-full-access:
|
|
# unconfined pwsh + unconfined fs (`dsh-fs-local`), no permission switcher
|
|
# (dsh-permission requires a confining executor), approval policy `never`.
|
|
# The launcher reads THIS file from the base bundle package (never through
|
|
# dsh.bundle.patch — that field names the one universal layer). A Windows
|
|
# host that prefers bash or confinement overrides these rows through its
|
|
# profile or home cordis.patch.yml.
|
|
|
|
- id: bash-sandbox
|
|
disabled: true
|
|
|
|
- id: tool-bash
|
|
disabled: true
|
|
|
|
- id: permission
|
|
disabled: true
|
|
|
|
- id: ui-permission
|
|
disabled: true
|
|
|
|
- id: sandbox
|
|
disabled: true
|
|
|
|
- id: sandbox-policy
|
|
disabled: true
|
|
|
|
- id: fs-sandbox
|
|
disabled: true
|
|
|
|
- id: approval
|
|
config:
|
|
policy: never
|
|
|
|
- insert:
|
|
- id: pwsh-local
|
|
name: '@deepseek-ai/dsh-pwsh-local'
|
|
|
|
- id: tool-pwsh
|
|
name: '@deepseek-ai/dsh-tool-pwsh'
|
|
|
|
- id: fs-local
|
|
name: '@deepseek-ai/dsh-fs-local'
|