Skip to content

fix: 缓解 DSH rc.2 Auto Mode 冗余沙箱请求 #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
LonelyHerbivore wants to merge 1 commit into from
Closed

fix: 缓解 DSH rc.2 Auto Mode 冗余沙箱请求 #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion DESIGN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

`dsh-auto-mode` adds an `Auto` permission preset, a Host policy on the official `ctx.tools` pipeline, and a small Web UI decorator. It does not provide its own executor or sandbox. Calls outside a Session whose durable preset is `auto` retain the official Read Only, Workspace Write, or Full access behavior.

The implementation targets the official DeepSeek Harness checkout at `47f943859bef60e4160492346772ded9b24f765a` and is built and tested against the public `0.1.0-rc.6` packages. The relevant upstream seams are:
The implementation targets the official DeepSeek Harness checkout at `47f943859bef60e4160492346772ded9b24f765a` and is built and tested against the public `0.1.1-rc.2` packages. The relevant upstream seams are:

- `@deepseek-ai/dsh-permission-presets` for durable preset selection;
- `@deepseek-ai/dsh-sandbox-policy` and the sandboxed shell/filesystem providers for per-call file authority;
Expand All @@ -25,6 +25,10 @@ The bundle inserts Auto between Workspace Write and Full access:

Auto and Workspace Write share a standing file boundary but not behavior. Auto automatically reviews semantic risks and may bridge one approved `danger-full-access` retry into the official approval seam. Full access remains the explicit unsandboxed mode and bypasses this plugin.

### rc.2 same-mode mitigation

The rc.2 official executor rejects a requested `workspace-write` when the effective standing mode is already `workspace-write`; the request is not strictly wider. Auto therefore classifies the raw request as `redundant-standing` and returns a stable recoverable denial before classifier, approval, grant, or tool-body activity. The instruction requires a new call with both sandbox fields omitted, after which the ordinary policy path runs. Auto never mutates the original `ToolExecution.arguments`, wraps the official executor, or claims transparent execution. This is a detection-and-retry mitigation for rc.2, not an upstream fix; Issue #8 remains open.

Normal Agent calls derive `workspaceRoot` from the Session's immutable canonical cwd. A command-level `workdir` can change process cwd but cannot change the sandbox write root. The official sandbox limits filesystem writes only: reads, sockets, process visibility, external services, and destructive changes inside the workspace require separate policy where their semantics matter. Linux bwrap/Landlock and macOS Seatbelt provide OS enforcement; the Windows restricted-token/ACL runner reports `partial` enforcement because of its documented `Everyone`, hard-link, and non-ACL-volume boundaries.

The Web decorator registers English and Chinese copy with the official locale service. English keeps the Auto label and Chinese renders it as “自动审批” across both permission selectors, the active-mode control, and the `/permission` picker; the acknowledgement follows the same live locale. The decorator also supplies the missing glyph. It explains the standing workspace sandbox, exact wider approval, read/network limitations, Windows partial enforcement, and out-of-pipeline plugin boundary. This UI is explanatory, not an authorization boundary.
Expand Down
6 changes: 5 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<p align="center">
<a href="https://www.npmjs.com/package/@nanmicoder/dsh-auto-mode"><img src="https://img.shields.io/npm/v/@nanmicoder/dsh-auto-mode.svg" alt="npm version"></a>
<a href="./LICENSE"><img src="https://img.shields.io/npm/l/@nanmicoder/dsh-auto-mode.svg" alt="MIT license"></a>
<img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.0--rc.6-202724" alt="Tested with DeepSeek Harness 0.1.0-rc.6">
<img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.1--rc.2-202724" alt="Tested with DeepSeek Harness 0.1.1-rc.2">
</p>

## Why Auto?
Expand Down Expand Up @@ -64,6 +64,10 @@ The Web client registers its copy with DSH's official locale service. English ke
| **Auto** | `workspace-write` | ask | **active** |
| Full access | `danger-full-access` | never | inactive |

### DSH 0.1.1-rc.2 same-mode requests

The rc.2 official executor accepts only a strictly wider sandbox request. Auto already stands at `workspace-write`, so a model-generated `sandbox_permissions: "workspace-write"` request is not transparently normalized or executed. The plugin detects it before classifier, approval, and tool execution, then returns a recoverable instruction to retry the same call with both `sandbox_permissions` and `justification` removed. This is an rc.2 detection-and-retry mitigation; it does not close the upstream strict-widening limitation, and Issue #8 remains open.

Ordinary Auto work stays inside Workspace Write. Only an explicit one-shot widening may be approved automatically:

| Decision | Typical effect |
Expand Down
6 changes: 5 additions & 1 deletion README_ZH.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<p align="center">
<a href="https://www.npmjs.com/package/@nanmicoder/dsh-auto-mode"><img src="https://img.shields.io/npm/v/@nanmicoder/dsh-auto-mode.svg" alt="npm 版本"></a>
<a href="./LICENSE"><img src="https://img.shields.io/npm/l/@nanmicoder/dsh-auto-mode.svg" alt="MIT 许可证"></a>
<img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.0--rc.6-202724" alt="已针对 DeepSeek Harness 0.1.0-rc.6 测试">
<img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.1--rc.2-202724" alt="已针对 DeepSeek Harness 0.1.1-rc.2 测试">
</p>

## 为什么需要 Auto？
Expand Down Expand Up @@ -64,6 +64,10 @@ dsh web
| **自动审批（Auto）** | `workspace-write` | ask | **启用** |
| Full access | `danger-full-access` | never | 不启用 |

### DSH 0.1.1-rc.2 同值请求

rc.2 官方执行器只接受严格更宽的沙箱请求。Auto 常驻的就是 `workspace-write`，因此模型生成的 `sandbox_permissions: "workspace-write"` 不会被透明改写或执行。插件会在分类器、审批和工具主体之前检测到它，并返回可恢复的指引，要求用完全移除 `sandbox_permissions` 与 `justification` 的同一调用重试。这是针对 rc.2 的“检测 + 无字段重试”缓解，不是修复上游严格扩权限制；Issue #8 仍保持开放。

Auto 的普通操作保留在 Workspace Write 边界内，只有明确的一次性越权请求才可能被自动批准：

| 决策 | 典型效果 |
Expand Down
62 changes: 39 additions & 23 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,11 +64,11 @@
},
"peerDependencies": {
"@deepseek-ai/cordis": "^4.0.1",
"@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
"@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
"@deepseek-ai/dsh-permission-presets": "^0.1.0-rc.6",
"@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
"@deepseek-ai/dsh-user-approval": "^0.1.0-rc.6"
"@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
"@deepseek-ai/dsh-llm": "^0.1.1-rc.2",
"@deepseek-ai/dsh-permission-presets": "^0.1.1-rc.2",
"@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
"@deepseek-ai/dsh-user-approval": "^0.1.1-rc.2"
},
"peerDependenciesMeta": {
"@deepseek-ai/cordis": {
Expand Down Expand Up @@ -97,24 +97,40 @@
"@deepseek-ai/cordis": "^4.0.1",
"@deepseek-ai/cordis-plugin-include": "^1.0.6",
"@deepseek-ai/cordis-plugin-loader": "^1.0.2",
"@deepseek-ai/dsh": "0.1.0-rc.6",
"@deepseek-ai/dsh-bash-sandbox": "0.1.0-rc.6",
"@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
"@deepseek-ai/dsh-fs-sandbox": "0.1.0-rc.6",
"@deepseek-ai/dsh-llm": "0.1.0-rc.6",
"@deepseek-ai/dsh-permission-presets": "0.1.0-rc.6",
"@deepseek-ai/dsh-pwsh-sandbox": "0.1.0-rc.6",
"@deepseek-ai/dsh-sandbox": "0.1.0-rc.6",
"@deepseek-ai/dsh-sandbox-local": "0.1.0-rc.6",
"@deepseek-ai/dsh-sandbox-policy": "0.1.0-rc.6",
"@deepseek-ai/dsh-shell-env": "0.1.0-rc.6",
"@deepseek-ai/dsh-subprocess-local": "0.1.0-rc.6",
"@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6",
"@deepseek-ai/dsh-tool-bash": "0.1.0-rc.6",
"@deepseek-ai/dsh-tool-pwsh": "0.1.0-rc.6",
"@deepseek-ai/dsh-tool-str-replace-editor": "0.1.0-rc.6",
"@deepseek-ai/dsh-tools": "0.1.0-rc.6",
"@deepseek-ai/dsh-user-approval": "0.1.0-rc.6",
"@deepseek-ai/dsh": "0.1.1-rc.2",
"@deepseek-ai/dsh-anonymous-user-id": "0.1.1-rc.2",
"@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
"@deepseek-ai/dsh-bash-local": "0.1.1-rc.2",
"@deepseek-ai/dsh-bash-sandbox": "0.1.1-rc.2",
"@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
"@deepseek-ai/dsh-code-runtime": "0.1.1-rc.2",
"@deepseek-ai/dsh-compaction": "0.1.1-rc.2",
"@deepseek-ai/dsh-fs": "0.1.1-rc.2",
"@deepseek-ai/dsh-fs-sandbox": "0.1.1-rc.2",
"@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
"@deepseek-ai/dsh-llm": "0.1.1-rc.2",
"@deepseek-ai/dsh-output-retention": "0.1.1-rc.2",
"@deepseek-ai/dsh-permission-presets": "0.1.1-rc.2",
"@deepseek-ai/dsh-pwsh-sandbox": "0.1.1-rc.2",
"@deepseek-ai/dsh-sandbox": "0.1.1-rc.2",
"@deepseek-ai/dsh-sandbox-local": "0.1.1-rc.2",
"@deepseek-ai/dsh-sandbox-policy": "0.1.1-rc.2",
"@deepseek-ai/dsh-scope": "0.1.1-rc.2",
"@deepseek-ai/dsh-session-telemetry": "0.1.1-rc.2",
"@deepseek-ai/dsh-session-title-llm": "0.1.1-rc.2",
"@deepseek-ai/dsh-shell": "0.1.1-rc.2",
"@deepseek-ai/dsh-shell-env": "0.1.1-rc.2",
"@deepseek-ai/dsh-spill": "0.1.1-rc.2",
"@deepseek-ai/dsh-subagent-in-process-driver": "0.1.1-rc.2",
"@deepseek-ai/dsh-subprocess-local": "0.1.1-rc.2",
"@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
"@deepseek-ai/dsh-timeout": "0.1.1-rc.2",
"@deepseek-ai/dsh-tool-bash": "0.1.1-rc.2",
"@deepseek-ai/dsh-tool-pwsh": "0.1.1-rc.2",
"@deepseek-ai/dsh-tool-str-replace-editor": "0.1.1-rc.2",
"@deepseek-ai/dsh-tools": "0.1.1-rc.2",
"@deepseek-ai/dsh-user-approval": "0.1.1-rc.2",
"@deepseek-ai/dsh-workflow": "0.1.1-rc.2",
"@types/node": "^24.10.0",
"jsdom": "^26.1.0",
"tsdown": "0.22.2",
Expand Down
Loading