runseal-labs/dsh-tool-runseal

README 摘要

dsh-tool-runseal English 中文 A standalone DeepSeek Harness plugin: replaces the built-in sandbox with RunSeal — an OS-native, policy-governed execution environment with enforceable filesystem, process, resource, and network boundaries, plus structured audit events and environment-credential scrubbing. Fully out-of-tree: depends only on published dsh base packages. Registers as ctx.sandbox , so every existing sandbox consumer (bash, jobs, fs) confines through RunSeal automatically. What it provides Item Description ctx.sandbox provider Subclasses SandboxProvider ; confine() wraps argv through a thin Node wrapper that runs the command under runseal rpc Policy mapping dsh read-only / workspace-write / danger-full-access → same-named RunSeal sandbox levels Network modes unmanaged (default), disabled , proxy (enterprise routing + credential redaction) Streaming output execution.stdout / execution.stderr RPC events forwarded to the consumer's stdio; exit code propagates Fail closed Missing setup or an unavailable backend rejects with runseal: on stderr and a non-zero exit, never silent passthrough Audit Every execution emits execution.requested → policy.resolved → execution.finished event…

分类