kingwl
2dc62497ce
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox RFC's deferred cross-family phase. - dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the deployment default mode + workspaceRoot and the per-session override event, renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter. Decouples the bash seam from dsh-session. - dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences write/edit by the per-call mode (read-only denies, workspace-write contains to the workspace + temp roots via the shared writableRoots, danger passes through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent re-canonicalization. A policy fence in trusted code, not a kernel boundary. - dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider ladder, denial/hint markers, approveEscalation) both tool families use; approveEscalation takes a structural approver so dsh-sandbox gains no approval/agent dependency, and both tools stay duplication-free. - tool-fs: write/edit advertise sandbox_permissions/justification under a confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker, and resolve the same one-approved-wider retry. - examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating that disabled the fs stack under confined modes. RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
69 lines
3.2 KiB
TypeScript
69 lines
3.2 KiB
TypeScript
/**
|
|
* Per-session sandbox-mode override: the session log as the store. A runtime
|
|
* switch (an ACP `session/set_config_option`, a test scenario) is recorded as
|
|
* one `sandbox/mode` event on the session it applies to;
|
|
* `effective = fold(events) ?? the deployment default`, so an override
|
|
* survives restart by replay, two sessions can never see each other's state,
|
|
* and there is no external config store. The event is log-only (the
|
|
* `approval/*` precedent): the model learns the mode from the boundary
|
|
* markers in the enforcing tools, never from the event itself. EXECUTION
|
|
* honors the fold in each tool layer — it stamps the effective mode onto the
|
|
* per-call policy carrier (a bash request's `sandboxMode`, an fs mutation's
|
|
* `sandboxMode`), weakest-precedence beneath an escalation grant.
|
|
*
|
|
* The override is policy state shared by every enforcing family (bash and
|
|
* filesystem alike), so it lives here in the policy package rather than in any
|
|
* one capability's seam.
|
|
*
|
|
* @module dsh-sandbox-policy/session-mode
|
|
*/
|
|
|
|
import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
|
|
import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
|
|
|
|
declare module '@deepseek-ai/dsh-session' {
|
|
interface SessionEventMap {
|
|
/**
|
|
* The session's sandbox mode was switched — log-only (like `approval/*`;
|
|
* NOT a surface event, carries no `surfaceOp`): durable and replayable,
|
|
* never in the model transcript. The LAST such event is the session's
|
|
* override ({@link effectiveSandboxMode}); who asked for it is derivable
|
|
* from position (an event after the log's last `request/header*` was a
|
|
* runtime switch by the user; see the tool layer's narrator).
|
|
*/
|
|
'sandbox/mode': { mode: SandboxMode }
|
|
}
|
|
}
|
|
|
|
/** Every {@link SandboxMode}, for option advertisement and runtime validation of untrusted mode strings. */
|
|
export const SANDBOX_MODES: readonly SandboxMode[] = ['read-only', 'workspace-write', 'danger-full-access']
|
|
|
|
/**
|
|
* The session's sandbox-mode override: the last `sandbox/mode` event in the
|
|
* log, or undefined when the session never switched (callers apply the
|
|
* deployment default). The pure fold — resume needs no catch-up machinery
|
|
* because replaying the log IS the state.
|
|
* @param events - session events in log order (other event types are skipped).
|
|
* @returns the mode of the last switch event, or undefined without one.
|
|
*/
|
|
export function effectiveSandboxMode(events: readonly SessionEvent[]): SandboxMode | undefined {
|
|
for (let index = events.length - 1; index >= 0; index -= 1) {
|
|
const event = events[index] as SessionEvent
|
|
if (event.type === 'sandbox/mode') return event.data.mode
|
|
}
|
|
return undefined
|
|
}
|
|
|
|
/**
|
|
* THE write path for a session's sandbox-mode override: appends exactly one
|
|
* `sandbox/mode` event — the switch IS its event; nothing mutates mode state
|
|
* out of band. Takes effect on the session's next confined call (bash or fs)
|
|
* — the consumers fold on every read.
|
|
* @param session - the session the override belongs to.
|
|
* @param mode - the mode every subsequent confined call in this session runs
|
|
* under (until the next switch).
|
|
*/
|
|
export function setSandboxMode(session: Session, mode: SandboxMode): void {
|
|
session.append('sandbox/mode', { mode })
|
|
}
|