Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sandbox): Windows ACL write-restriction sandbox (restricted-token runner)

Browse Source 
Confine Windows command execution through a WRITE_RESTRICTED token whose restricting SIDs carry an orphan-SID write allowlist, ported from https://github.com/huoyaoyuan/windows-acl-restrict-poc (@ 10e4dfb). Every Win32 call is checked and fails closed - the POC silently ran children with the FULL token when CreateRestrictedToken failed.

- @deepseek-ai/dsh-sandbox-windows-acl: koffi primitives verified against the MinGW Windows headers (verify/abi-probe.cpp) plus the confinement runner ([node, runner, --workspace, --temp, --mode, --, argv...]: kill-on-close job, stdio passthrough, exit-code mirroring, windows-acl-run: failure signature, grant revocation). read-only = strict zero grants (NUL device not writable; documented). Windows-only execution: exempted from the Linux coverage lane (windowsOnlyCoverageExclusions).
- @deepseek-ai/dsh-sandbox-local: PLATFORM_CHAINS.win32 filled with the windows-acl runner (full enforcement, ACL denial dialect, runner-failure rules).
- @deepseek-ai/dsh-pwsh-sandbox: sandbox-consuming pwsh executor (call-for-call mirror of dsh-bash-sandbox) over a new argv-level seam in dsh-pwsh-local; per-file coverage complete via the fake-provider spec.
- bundle/base: the Windows platform layer mounts the confined pwsh roster - sandbox/policy/fs-sandbox/permission/approval re-enabled, the POSIX bash stack stays disabled.

Co-authored-by: Huo Yaoyuan <huoyaoyuan@hotmail.com>
This commit is contained in:
Huanqi Cao
2026-08-08 01:24:33 +08:00
parent 4c2d20dbf7
commit f64ba40f43
38 changed files with 3230 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tsconfig.host.json
View File

@@ -164,10 +164,12 @@
{ "path": "./packages/bash/bash-local" },
{ "path": "./packages/bash/bash-env" },
{ "path": "./packages/bash/pwsh-local" },
{ "path": "./packages/bash/pwsh-sandbox" },
{ "path": "./packages/bash/tool-pwsh" },
{ "path": "./packages/sandbox/sandbox" },
{ "path": "./packages/sandbox/sandbox-local" },
{ "path": "./packages/sandbox/sandbox-policy" },
{ "path": "./packages/sandbox/sandbox-windows-acl" },
{ "path": "./packages/bash/bash-sandbox" },
{ "path": "./packages/bash/tool-bash" },
{ "path": "./packages/fs/fs" },