deepseek-harness/website/zh-CN/api/harness/sandbox.md

ctx.sandbox

SandboxProvider (abstract seam) — provided by @deepseek-ai/dsh-sandbox.

Abstract process-sandbox service. confine must return enforcing argv or fail closed at wrap or runner-execution time; silent unconfined passthrough is forbidden. Functional probes arbitrate multi-runner chains and may be skipped for a sole candidate, whose own refusal remains the fail-closed end.

Source

ctx.sandbox.confine(argv, policy)

/**
 * Wrap `argv` so it executes confined under `policy` on this host; the
 * caller spawns the returned argv in place of its own.
 * @param argv - the exact argv the caller is about to spawn (program plus
 *   arguments), NOT a shell string — a shell-shaped consumer passes
 *   `['bash', '-c', command]`.
 * @param policy - the file-effect policy this execution runs under,
 *   carried per call (see {@link SandboxPolicy}).
 * @returns the argv to spawn instead, plus the enforcement completeness
 *   the selected backend achieves for it.
 */
abstract confine(argv: readonly string[], policy: SandboxPolicy): ConfinedArgv

Wrap argv so it executes confined under policy on this host; the caller spawns the returned argv in place of its own.

• argv — the exact argv the caller is about to spawn (program plus arguments), NOT a shell string — a shell-shaped consumer passes ['bash', '-c', command].
• policy — the file-effect policy this execution runs under, carried per call (see SandboxPolicy).

Returns the argv to spawn instead, plus the enforcement completeness the selected backend achieves for it.

Source