Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: align prose with runtime contracts

Browse Source
This commit is contained in:
Tianyi Cui
2026-07-14 16:21:41 +08:00
parent 26b4b036fc
commit f0fc20ca42
84 changed files with 162 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/rfc/implemented/feature/2026-07-06-sandbox.md
View File

@@ -84,7 +84,7 @@ When a confining executor is mounted, `bash` advertises paired `sandbox_permissi
Escalation is a same-turn retry of the denied command with the narrowest sufficient `sandbox_permissions` and a `justification`; the approval prompt is the consent step. It must be grounded in an actual denial, except when the session already observed the same denied access, and a disabled or rejected approval ends that command. The retry, approval decision, and result use existing tool and approval events. `dsh-tool-bash` owns the ask because the executor seam has neither the agent nor call id required for user interaction.
Left open, recorded for the phase that picks them up: what a grant's scope identity is beyond the sandbox mode — the exact call, a path, a command prefix, the session, a time window — the question `allow_always` grant storage must answer before that option can be advertised; how cancellation behaves while an approval prompt is pending; and how escalation is defined for `run_in_background` denials that arrive via `bash_output`.
Left open, recorded for the phase that picks them up: what a grant's scope identity is beyond the sandbox mode — the exact call, a path, a command prefix, the session, a time window — the question `allow_always` grant storage must answer before that option can be advertised; and how escalation is defined for `run_in_background` denials that arrive via `bash_output`.
#### Per-session modes: the session log as the store