7606a99813
The credential store is 0600 under a 0700 directory, which stops other OS users but not the model: tool processes run as the same user, so under the shipped danger-full-access default they read it like any other file. SandboxExecutionPolicy grows readDenyPaths, and sandbox-policy defaults it to $DSH_HOME/.env — the exact file rather than the harness home, so the model keeps its documented access to its own session log. Seatbelt appends a trailing deny (last matching rule wins) and bwrap maps /dev/null over each path after any workspace bind; Landlock grants are a pure allow-list that cannot subtract from its own / read grant, so confine() reports partial enforcement there instead of claiming a boundary the process does not have. A real-kernel Seatbelt e2e proves the shape: the same read succeeds unconfined and fails under the denial, while a sibling file in the same directory stays readable. Both READMEs state the residual boundary plainly — no confining mode means no boundary — and record the OS keychain provider as the real answer.
47 lines
1.3 KiB
JSON
47 lines
1.3 KiB
JSON
{
|
|
"name": "@deepseek-ai/dsh-sandbox-policy",
|
|
"description": "Per-call sandbox policy resolver (ctx.sandboxPolicy): deployment fallbacks plus each session's mode and workspace root, shared by every enforcing capability family",
|
|
"version": "0.0.1",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "lib/index.js",
|
|
"types": "lib/types/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./lib/types/index.d.ts",
|
|
"default": "./lib/index.js"
|
|
},
|
|
"./invariant": {
|
|
"types": "./lib/types/invariant.d.ts",
|
|
"default": "./lib/invariant.js"
|
|
},
|
|
"./src/*": "./src/*",
|
|
"./package.json": "./package.json"
|
|
},
|
|
"files": [
|
|
"lib/index.js",
|
|
"lib/invariant.js",
|
|
"lib/types/**/*.d.ts",
|
|
"lib/types/**/*.d.ts.map",
|
|
"src"
|
|
],
|
|
"license": "BSD-3-Clause",
|
|
"peerDependencies": {
|
|
"@deepseek-ai/dsh-invariants": "^0.0.1",
|
|
"@deepseek-ai/dsh-paths": "^0.0.1",
|
|
"@deepseek-ai/dsh-sandbox": "^0.0.1",
|
|
"@deepseek-ai/dsh-session": "^0.0.1",
|
|
"cordis": "^4.0.0-rc.7"
|
|
},
|
|
"dependencies": {
|
|
"schemastery": "^3.18.0"
|
|
},
|
|
"devDependencies": {
|
|
"@deepseek-ai/dsh-invariants": "workspace:^",
|
|
"@deepseek-ai/dsh-paths": "workspace:^",
|
|
"@deepseek-ai/dsh-sandbox": "workspace:^",
|
|
"@deepseek-ai/dsh-session": "workspace:^",
|
|
"cordis": "^4.0.0-rc.7"
|
|
}
|
|
}
|