Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sandbox): the confinement seam and the per-platform native runner chains

Browse Source 
ctx.sandbox (dsh-sandbox): confine(argv, policy) returns the argv to spawn
instead — wrapped so the process and its children run confined — plus the
enforcement completeness and the backend denial/runner-failure dialects;
no usable backend throws the fail-closed SANDBOX_UNAVAILABLE. Policy rides
per call. dsh-sandbox-local selects by platform and caches the verdict:
multi-candidate chains probe FUNCTIONALLY in preference order (Linux:
bwrap → the registry-installed node-addon-landlock-run launcher), a sole
candidate is selected unprobed (darwin: sandbox-exec/Seatbelt) and fails
closed at execution via runnerFailureSignatures; win32 is a reserved empty
chain. Profile parity is honest per backend (documented temp-area and ABI
differences; enforcement full|partial is a structured result fact).

CI: the sandbox-e2e matrix proves real-kernel confinement per rung (bwrap,
Landlock per architecture through the registry-installed launcher,
Seatbelt), failing on a silent all-skip; the packed-install rehearsal
installs the launcher family from the registry and asserts the binary
executable apart from kernel enforcement.
This commit is contained in:
kingwl
2026-07-09 15:42:37 +08:00
parent 80d8726601
commit 7b8c3a9b40
30 changed files with 2007 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
pnpm-lock.yaml generated
View File

@@ -626,6 +626,34 @@ importers:
specifier: ^4.0.0-rc.6
version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
packages/sandbox/sandbox:
devDependencies:
'@deepseek-ai/dsh-llm':
specifier: workspace:^
version: link:../../llm/llm
cordis:
specifier: ^4.0.0-rc.6
version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
packages/sandbox/sandbox-local:
dependencies:
node-addon-landlock-run:
specifier: 0.0.0-test.0
version: 0.0.0-test.0
schemastery:
specifier: ^3.18.0
version: 3.18.0
devDependencies:
'@deepseek-ai/dsh-llm':
specifier: workspace:^
version: link:../../llm/llm
'@deepseek-ai/dsh-sandbox':
specifier: workspace:^
version: link:../sandbox
cordis:
specifier: ^4.0.0-rc.6
version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
packages/session-persistence/session-persistence:
devDependencies:
'@deepseek-ai/dsh-session':
@@ -3780,6 +3808,22 @@ packages:
natural-compare@1.4.0:
resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
node-addon-landlock-run-linux-arm64@0.0.0-test.0:
resolution: {integrity: sha512-oJsXcC33qKl9mWYx0n9YPJ2pUAoY39PoIX0Gx4lDrSCTEvENFrEaODAsQYNY+eEGpn9YMN7E+FOftvea3/1FqQ==}
engines: {node: '>=20'}
cpu: [arm64]
os: [linux]
node-addon-landlock-run-linux-x64@0.0.0-test.0:
resolution: {integrity: sha512-eXvdfnH/UV55MTZzroKvM3CD68SP5OlCsuth908YOcJOnn0LPD5KJjmBz6ToDlBYjF52NNK62+g7TvmUWjbKWQ==}
engines: {node: '>=20'}
cpu: [x64]
os: [linux]
node-addon-landlock-run@0.0.0-test.0:
resolution: {integrity: sha512-c5qopltRonjW6+VinXYMp4FVi9Sxf8eQEb/9G82EksQQ+JC4CDprv+ko5URWmtyZ3wD4GFdeRTyw1AG5yCwJhQ==}
engines: {node: '>=20'}
node-domexception@1.0.0:
resolution: {integrity: sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==}
engines: {node: '>=10.5.0'}
@@ -6786,6 +6830,17 @@ snapshots:
natural-compare@1.4.0: {}
node-addon-landlock-run-linux-arm64@0.0.0-test.0:
optional: true
node-addon-landlock-run-linux-x64@0.0.0-test.0:
optional: true
node-addon-landlock-run@0.0.0-test.0:
optionalDependencies:
node-addon-landlock-run-linux-arm64: 0.0.0-test.0
node-addon-landlock-run-linux-x64: 0.0.0-test.0
node-domexception@1.0.0: {}
node-fetch@3.3.2: