mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
7b8c3a9b40
ctx.sandbox (dsh-sandbox): confine(argv, policy) returns the argv to spawn instead — wrapped so the process and its children run confined — plus the enforcement completeness and the backend denial/runner-failure dialects; no usable backend throws the fail-closed SANDBOX_UNAVAILABLE. Policy rides per call. dsh-sandbox-local selects by platform and caches the verdict: multi-candidate chains probe FUNCTIONALLY in preference order (Linux: bwrap → the registry-installed node-addon-landlock-run launcher), a sole candidate is selected unprobed (darwin: sandbox-exec/Seatbelt) and fails closed at execution via runnerFailureSignatures; win32 is a reserved empty chain. Profile parity is honest per backend (documented temp-area and ABI differences; enforcement full|partial is a structured result fact). CI: the sandbox-e2e matrix proves real-kernel confinement per rung (bwrap, Landlock per architecture through the registry-installed launcher, Seatbelt), failing on a silent all-skip; the packed-install rehearsal installs the launcher family from the registry and asserts the binary executable apart from kernel enforcement.
39 lines
1.0 KiB
JSON
39 lines
1.0 KiB
JSON
{
|
|
"name": "@deepseek-ai/dsh-sandbox-local",
|
|
"description": "Local process-sandbox backends for the DeepSeek Harness sandbox seam: bwrap, the npm-distributed landlock-run launcher, or macOS Seatbelt — functionally probed, fail-closed",
|
|
"version": "0.0.1",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "lib/index.js",
|
|
"types": "lib/types/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./lib/types/index.d.ts",
|
|
"default": "./lib/index.js"
|
|
},
|
|
"./src/*": "./src/*",
|
|
"./package.json": "./package.json"
|
|
},
|
|
"files": [
|
|
"lib/index.js",
|
|
"lib/types/**/*.d.ts",
|
|
"lib/types/**/*.d.ts.map",
|
|
"src"
|
|
],
|
|
"license": "BSD-3-Clause",
|
|
"peerDependencies": {
|
|
"@deepseek-ai/dsh-llm": "^0.0.1",
|
|
"@deepseek-ai/dsh-sandbox": "^0.0.1",
|
|
"cordis": "^4.0.0-rc.6"
|
|
},
|
|
"dependencies": {
|
|
"node-addon-landlock-run": "0.0.0-test.0",
|
|
"schemastery": "^3.18.0"
|
|
},
|
|
"devDependencies": {
|
|
"@deepseek-ai/dsh-llm": "workspace:^",
|
|
"@deepseek-ai/dsh-sandbox": "workspace:^",
|
|
"cordis": "^4.0.0-rc.6"
|
|
}
|
|
}
|