Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

Merge remote-tracking branch 'origin/master' into codex/session-scoped-sandbox-roots

Browse Source 
# Conflicts:
#	examples/acp-agent/tests/acp.snapshot.ts
#	packages/examples/agent-spine-demo/package.json
#	pnpm-lock.yaml
This commit is contained in:
Tianyi Cui
2026-07-21 20:00:55 +08:00
parent ae98294ec5 8672fa881a
commit c1d3036274
635 changed files with 21527 additions and 3332 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/sandbox/sandbox-policy/README.md
+2
View File
@@ -19,6 +19,8 @@ Two families enforce the same mode vocabulary: the sandboxed bash executor (`@de
- `setSandboxMode(session, mode)` — THE write path for a per-session override: appends exactly one `sandbox/mode` event. The switch IS its event; nothing mutates the mode out of band.
- `SANDBOX_MODES` — every mode, for option advertisement and runtime validation.
The optional `./invariant` companion rejects a forged durable `sandbox/mode` event whose value falls outside that closed vocabulary; Session and its companion own the surrounding storage and turn-enclosure rules.
## The per-session store
A runtime switch (an ACP `session/set_config_option`, a test scenario) is one log-only `sandbox/mode` event on the session it applies to. `effective = explicit grant ?? fold(events) ?? deployment default`, so an override survives restart by replay and two sessions never see each other's state. Workspace identity does not need another event: the immutable `SessionHeader.cwd` recorded at creation is the root for every call in that session. The event is log-only (the `approval/*` precedent): the model learns the mode from the enforcing tools' denial markers, never from the event.