Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

fix(sandbox): revoke post-apply grant failures, free init SID allocations, and name the Windows runner in SANDBOX_UNAVAILABLE

Browse Source
This commit is contained in:
Huanqi Cao
2026-08-08 17:39:25 +08:00
parent 43d53d339d
commit 07c7e2f0bd
6 changed files with 45 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/sandbox/sandbox/README.i18n.yaml
+2 -2
View File
@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write packages/sandbox/sandbox/README.md
README.md: 1b522b2c72d00bfed89650aa7f22b65a72d26085
README.zh.md: adccd4421a74ef073ad3ffc3a23bccb0354d99aa
README.md: d6bf873d559fe0933e7e7ee7d966e2f27053ca05
README.zh.md: a618fe435d0c9d862c8dab4ded390de45e1e5d74
packages/sandbox/sandbox/README.md
+1 -1
View File
@@ -23,7 +23,7 @@ Through [`dsh-bash-sandbox`](../../bash/bash-sandbox/README.md) and [`dsh-tool-b
##### Exact error
```markdown
sandbox mode "<mode>" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS) — Windows has no confinement backend yet — or switch the consumer to danger-full-access.
sandbox mode "<mode>" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS), or ensure the ACL restricted-token runner can start (Windows) — otherwise switch the consumer to danger-full-access.
```
#### Token effect
packages/sandbox/sandbox/README.zh.md
+1 -1
View File
@@ -23,7 +23,7 @@
##### 精确错误
```markdown
sandbox mode "<mode>" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS) — Windows has no confinement backend yet — or switch the consumer to danger-full-access.
sandbox mode "<mode>" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS), or ensure the ACL restricted-token runner can start (Windows) — otherwise switch the consumer to danger-full-access.
```
#### Token 影响
packages/sandbox/sandbox/src/index.ts
+3 -2
View File
@@ -131,8 +131,9 @@ export class SandboxUnavailableError extends HarnessError {
super(
`sandbox mode "${mode}" is requested but no sandbox backend is usable on this host; `
+ 'refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing '
+ 'kernel (Linux), ensure sandbox-exec is usable (macOS) — Windows has no confinement '
+ 'backend yet — or switch the consumer to danger-full-access.'
+ 'kernel (Linux), ensure sandbox-exec is usable (macOS), or ensure the ACL '
+ 'restricted-token runner can start (Windows) — otherwise switch the consumer to '
+ 'danger-full-access.'
+ (detail === undefined ? '' : ` Runner failure: ${detail}`),
SANDBOX_UNAVAILABLE,
)