DeepSeek Harness: Sandbox and Approval

# dsh.config.yaml
approval:
  default: ask

  tools:
    file_edit:
      read: always
      create: ask
      edit: ask
      delete: ask_with_confirm

    shell:
      safe: always
      moderate: ask
      dangerous: ask_with_confirm
      forbidden: deny

    search:
      default: always

    sandbox:
      default: ask

approval:
  tools:
    file_edit:
      # Path whitelist auto-allow
      auto_allow_paths:
        - /tmp/**
        - /workspace/**
      # Path blacklist auto-deny
      auto_deny_paths:
        - /etc/**
        - /var/**

    shell:
      # Command whitelist
      auto_allow_commands:
        - ls
        - cat
        - grep
        - head
        - wc
        - git status
        - git log
      # Command blacklist
      auto_deny_commands:
        - rm -rf /*
        - mkfs
        - dd if=*

import { defineTool } from '@deepseek-ai/dsh'

export default defineTool({
  name: 'db_query',
  description: 'Execute SQL query',
  parameters: { /* ... */ },
  approval: {
    level: 'ask',
    rules: [
      { match: { query: /^SELECT/i }, level: 'always' },
      { match: { query: /^DROP/i }, level: 'deny' },
      { match: { query: /^INSERT|^UPDATE|^DELETE/i }, level: 'ask_with_confirm' }
    ]
  },
  async execute({ query }, ctx) {
    return await ctx.database.query(query)
  }
})

# trusted — Trust mode
approval:
  tools:
    file_edit: always
    shell: always
    search: always

# standard — Standard mode
approval:
  tools:
    file_edit:
      read: always
      create: ask
      edit: ask
      delete: ask_with_confirm
    shell: ask

# restricted — Restricted mode
approval:
  tools:
    file_edit: ask_with_confirm
    shell: deny
    search: ask

# Select preset at startup
pnpm dsh web --preset trusted
pnpm dsh web --preset standard
pnpm dsh web --preset restricted

# dsh.config.yaml
approval:
  presets:
    my-team:
      tools:
        file_edit:
          read: always
          create: ask
          edit: ask
          delete: deny
        shell: ask

⚠️ Approval Required: Execute shell command

  Command: npm install bcryptjs
  Working directory: /home/alice/project
  Risk level: MODERATE
  
  [Allow] [Always for npm] [Deny]

⚠️ Batch Approval Required: 3 operations

  1. file_edit: create src/utils.ts
  2. file_edit: edit src/app.ts
  3. shell: npm install bcryptjs

  [Allow All] [Review Each] [Deny All]

[approval] ALLOWED: file_edit(read, src/config.ts) — policy: always
[approval] ASKED: file_edit(create, src/utils.ts) — user: allowed
[approval] DENIED: shell(rm -rf /tmp/test) — policy: deny

interface SandboxBackend {
  name: string
  execute(command: string, options: ShellOptions): Promise<ShellResult>
  readFile(path: string): Promise<string>
  writeFile(path: string, content: string): Promise<void>
  stat(path: string): Promise<FileStat>
  readdir(path: string): Promise<DirEntry[]>
}

import { Service, Context } from '@deepseek-ai/cordis'

export default class DockerSandboxBackend extends Service {
  constructor(ctx: Context) {
    super(ctx, 'sandbox')
    
    ctx.implement(SandboxCapability, {
      name: 'docker-sandbox',
      
      async execute(command, options) {
        const container = await this.getContainer()
        const result = await container.exec(command, options)
        return result
      },

      async readFile(path) {
        const container = await this.getContainer()
        return await container.readFile(path)
      },

      async writeFile(path, content) {
        const container = await this.getContainer()
        await container.writeFile(path, content)
      },

      // ...
    })
  }
}

# dsh.config.yaml
sandbox:
  backend: docker
  config:
    image: dsh-sandbox:latest
    workdir: /workspace
    memory: 512m
    cpus: 1
    timeout: 30000
    network: none

export const inject = ['sandbox']

export function apply(ctx: Context) {
  ctx.tools.register(defineTool({
    name: 'sandbox_read',
    description: 'Read file in sandbox',
    parameters: {
      type: 'object',
      properties: {
        path: { type: 'string', description: 'File path in sandbox' }
      },
      required: ['path']
    },
    async execute({ path }, ctx) {
      const content = await ctx.sandbox.readFile(path)
      return { content }
    }
  }))
}

export const inject = ['shell']

export function apply(ctx: Context) {
  ctx.tools.register(defineTool({
    name: 'sandbox_exec',
    description: 'Execute command in sandbox',
    parameters: {
      type: 'object',
      properties: {
        command: { type: 'string', description: 'Command to execute' }
      },
      required: ['command']
    },
    async execute({ command }, ctx) {
      const result = await ctx.shell.execute(command, {
        cwd: '/workspace',
        timeout: 30000
      })
      return {
        stdout: result.stdout,
        stderr: result.stderr,
        exitCode: result.exitCode
      }
    }
  }))
}

// ❌ Direct host filesystem access
import { readFileSync } from 'fs'
const content = readFileSync('/etc/passwd')

// ✅ Through sandbox
const content = await ctx.sandbox.readFile('/etc/passwd')
// → If sandbox has filesystem isolation, this call will be restricted

# dsh.config.yaml
sandbox:
  backend: remote
  config:
    endpoint: http://sandbox-server:8080
    apiKey: sk-sandbox-xxx
    defaultImage: dsh-sandbox:latest
    maxContainers: 10
    containerTimeout: 3600
    allowedImages:
      - dsh-sandbox:latest
      - dsh-sandbox-python:latest

export default class RemoteSandboxBackend extends Service {
  private endpoint: string
  private apiKey: string

  constructor(ctx: Context) {
    super(ctx, 'sandbox')
    this.endpoint = ctx.config.endpoint
    this.apiKey = ctx.config.apiKey
  }

  async execute(command: string, options: ShellOptions): Promise<ShellResult> {
    const response = await fetch(`${this.endpoint}/execute`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Authorization': `Bearer ${this.apiKey}`
      },
      body: JSON.stringify({ command, ...options })
    })
    return await response.json()
  }

  async readFile(path: string): Promise<string> {
    const response = await fetch(`${this.endpoint}/read`, {
      method: 'POST',
      headers: { 'Authorization': `Bearer ${this.apiKey}` },
      body: JSON.stringify({ path })
    })
    const data = await response.json()
    return data.content
  }

  // ...
}

1. Agent session created → Request sandbox container
2. Sandbox API creates container → Return container ID
3. Agent operations execute inside container
4. Agent session destroyed → Request container destruction
5. Sandbox API destroys container → Release resources