ca39fd89b0
The three-entry cordis.yml (dsh-sandbox-local + dsh-bash-sandbox at a read-only default + dsh-approval) served over ACP: the first live approval composition. Recorded snapshot scenarios pin the wire end to end — config-options advertisement, the mode-switching arc as the suite pinned header (both switches, the prompt-section delta, one changed-by-the-user notice per knob, a confined write landing under the switched mode), and both escalation branches over scripted permissionAnswers (a grant runs confined under workspace-write; a rejection executes nothing and pins the fail-closed text). The with-key escalation e2e drives a real model + real runner + the real bridge answerer, world-verified; ci.yml snapshot lane and e2e.yml install bubblewrap so the confined replays actually execute. Both RFCs move to implemented/ (Decision/Consequences form, deferred phases tracked in their own sections), with every cross-reference flipped.
@deepseek-ai/dsh-sandbox
Abstract process-sandbox seam. Owns the ctx.sandbox service contract (SandboxProvider) and the confinement vocabulary the harness shares: SandboxMode (read-only / workspace-write / danger-full-access, file effects only), SandboxEnforcement (full / partial, per kernel ABI), SandboxPolicy (per-CALL policy — mode + workspace root), and the fail-closed SANDBOX_UNAVAILABLE error. Interface package of the capability-seam split: depends only on cordis (+ the harness error base), never on a backend.
The contract in one line: ctx.sandbox.confine(argv, policy) returns the argv to spawn INSTEAD of your own — wrapped so the process (and everything it spawns) runs confined — plus two facts about the selected backend: the enforcement completeness it achieves and its denial dialect (denialSignatures, the stderr substrings its kernel prints on a denied file effect — what stderr-inferring consumers match instead of a cross-backend union); when no backend is usable it throws rather than passing the argv through unconfined.
Policy rides the call, not the provider: two consumers may confine under different policies at the same instant (bash under read-only while a confined child agent keeps its state directory writable), and an approved escalated retry is just a new call with a wider policy.
Same-world confinement only. A backend shares the host's filesystem and kernel (bwrap, Landlock, Seatbelt); workspaceRoot names a real host path. Containers, microVMs, and remote executors are NOT backends of this seam — they replace whole capability implementations (ctx.bash, ctx.fs) as environment-coherent groups. The boundary and its rationale: the sandbox RFC.
Implementations: @deepseek-ai/dsh-sandbox-local (Linux: bwrap, else the per-platform Landlock launcher; macOS: sandbox-exec/Seatbelt). Consumers: @deepseek-ai/dsh-bash-sandbox (wraps ['bash', '-c', command]).