Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

feat(mode): the access cap — plan mode composes with the sandbox instead of banning bash

Browse Source 
A ModeDefinition may declare access: the widest sandbox access shell
commands run under while the mode holds, on the SANDBOX_MODES ladder.
The bash seam gains the resolution point to hang it on: BashExecutor.
resolveMode(session) folds override ?? default and dispatches the new
bash/resolve-mode waterfall; dsh-tool-bash consults it at both the
stamping site and the escalation baseline; dsh-mode's clamp listener
takes the ladder minimum per call. Two independent log folds compose at
read time — the mode never writes the sandbox knob, so the two switch
in any order and the knob re-emerges intact on exit.

The built-in plan definition ships access: read-only with the bash trio
allowlisted CONDITIONALLY: both policy layers admit bash/bash_output/
bash_kill only while a confining executor is mounted (an unconfinable
shell cannot honor the cap), and a bash call carrying sandbox_permissions
under a cap is denied at the gate — no widening mid-mode; the widened
step belongs in the plan.

examples/plan-acp-agent swaps bash-local for sandbox-local +
bash-sandbox (workspace-write default, clamped read-only inside plan)
plus the approval seam; the re-recorded plan-mode arc runs a real cat
inside plan under the clamped sandbox, and modes-advertise now pins the
sandbox-mode and approval config options. RFC amended to the landed
shape (access cap section, orthogonality FAQ, deferred item resolved
into effects self-declaration).
This commit is contained in:
kingwl
2026-07-12 22:51:09 +08:00
parent 88db403d9f
commit 99650a201b
31 changed files with 1844 additions and 1237 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/plan-acp-agent/composition.md
+8 -2
View File
@@ -21,10 +21,14 @@ flowchart LR
bundle_agent_core --> spine_loop["ctx.agents + ctx.agentLoop"]
plugin_plan-acp_mode["mode<br/>@deepseek-ai/dsh-mode"]
cfg --> plugin_plan-acp_mode
plugin_plan-acp_bash["bash<br/>@deepseek-ai/dsh-bash-local"]
plugin_plan-acp_sandbox["sandbox<br/>@deepseek-ai/dsh-sandbox-local"]
cfg --> plugin_plan-acp_sandbox
plugin_plan-acp_bash["bash<br/>@deepseek-ai/dsh-bash-sandbox"]
cfg --> plugin_plan-acp_bash
plugin_plan-acp_tool_bash["tool-bash<br/>@deepseek-ai/dsh-tool-bash"]
cfg --> plugin_plan-acp_tool_bash
plugin_plan-acp_approval["approval<br/>@deepseek-ai/dsh-user-approval"]
cfg --> plugin_plan-acp_approval
plugin_plan-acp_tool_ask_user["tool-ask-user<br/>@deepseek-ai/dsh-tool-ask-user"]
cfg --> plugin_plan-acp_tool_ask_user
plugin_plan-acp_fs_local["fs-local<br/>@deepseek-ai/dsh-fs-local"]
@@ -42,8 +46,10 @@ flowchart LR
| `llm-deepseek` | `@deepseek-ai/dsh-llm-deepseek` |
| `acp-agent` | `@deepseek-ai/dsh-acp-agent` |
| `mode` | `@deepseek-ai/dsh-mode` |
| `bash` | `@deepseek-ai/dsh-bash-local` |
| `sandbox` | `@deepseek-ai/dsh-sandbox-local` |
| `bash` | `@deepseek-ai/dsh-bash-sandbox` |
| `tool-bash` | `@deepseek-ai/dsh-tool-bash` |
| `approval` | `@deepseek-ai/dsh-user-approval` |
| `tool-ask-user` | `@deepseek-ai/dsh-tool-ask-user` |
| `fs-local` | `@deepseek-ai/dsh-fs-local` |
| `fs-policy` | `@deepseek-ai/dsh-fs-policy` |