sandbox 45

Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent decides allow/deny on the approval answerer chain, with fail-closed fallback and full session-log audit.

Fix and diagnose DeepSeek Harness on native Windows. Official PowerShell, Workspace Write, shortcuts, and legacy preset repair. No WSL.

DeepSeek Harness 自动审批门控（兼容加固版）：Flash 模型预判写/命令是否不可回补，安全自动批准、危险转人工（fail-safe），最小人工介入，听人工审查 UI。基于 dsh-approval-gate 0.5.2，修复 DSH 0.1.2-rc.1 API 兼容与插件路由鉴权；0.2.2 补齐 Windows/PowerShell 拒绝词表与路径处理、原子写与配置损坏备份、diff 复杂度、事件/审计日志轮转、CSRF 防线；0.2.3 修复并发丢失更新（审批串行化）、下游异常终态

Session-aware sandbox escalation compatibility plugin for DeepSeek Harness

DeepSeek Harness provider that runs the subprocess seam inside a remote Upstash Box

Rule-gated automatic approval for DeepSeek Harness sandbox escalations with an optional LLM reviewer and native human fallback.

Use Git for Windows Bash as the default DSH shell with restricted-mode support

为 DeepSeek Harness 增加介于 Workspace Write 与 Full access 之间的自动批准权限档：例行沙箱升级由分类模型一次性放行，危险或不确定的操作仍转人工审批。An auto-approval permission preset for DeepSeek Harness between workspace-write and full access: routine sandbox escalations are granted once by a classifier

dsh-bash-native: a Windows-native POSIX bash executor for the DSH shell seam, with engine resolution and DSH's three-tier file sandbox honored.

Audit deepseek-harness (DSH) plugins before install, guard them at runtime. Static verdict + pre-install audit protocol; supply-chain checks (typosquat, OSV); exfiltration & ransomware detection, honeypot canaries, integrity baseline. Alarm-only; blocks c

A middle permission tier for DeepSeek Harness between workspace-write and danger-full-access: auto-approves harmless commands and operations targeting configured trusted areas, beyond the current workspace.

DSH sandbox extension: keep declared workspace subpaths (e.g. .git) read-only, honor a read-only rules file at the workspace root, grant extra writable roots under workspace-write, and let the model request session-scoped write access; enforced for sandbo

dsh-yolo-mode —— DeepSeek Harness 双面包插件：当会话处于可写沙箱模式且审批策略为 ask 时，用大模型自动裁决沙箱升权申请，支持内置预设与自定义权限层级，并提供宿主 settings + 自发布设置桥（/yolo-mode）与 Web 客户端 UI。

DSH permission-gate for the DeepSeek Harness 0.1.5 line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with

Native Auto Review for DeepSeek Harness with automatic host compatibility selection

Blaxel sandbox execution plugin for DeepSeek Harness (DSH)

Independent Codex Guardian-style approval reviewer for DSH.

NeevSandbox execution providers for DeepSeek Harness

Fail-closed DSH compatibility guard for redundant GPT/Codex sandbox escalation arguments

Turns five sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: twelve reports (#7538, #7622, #7646, #7720, #7750, #7735, #7771, #7804, #7816, #8232, #8272, #827

Net Access permission preset for DeepSeek Harness (Windows): HTTPS works inside the sandbox while file writes stay confined like workspace-write.

Consequence analysis for DeepSeek Harness: it says what an extra-permission call costs you — the device, your delegated authority, your wider interests. State-based, not guessed.

Render agent-authored ```dsh-card HTML as sandboxed interactive iframes inline in the conversation

Strip sandbox_permissions / justification from model tool-call arguments so sandbox escalation is never triggered when the session already has sufficient permission.

Configurable sandbox bundle: replaces the shipped process-sandbox provider and filesystem fence with implementations that add extra writable roots and access denials on top of the upstream semantics.

Require a real, immediately preceding sandbox denial before DSH Bash can request wider permissions.

DSH plugin: automatic approval for configured directories and commands — stop the sandbox-escalation popups you already trust, keep the rest. · DSH 自动权限审批插件：按允许目录与「以某命令开头」的允许命令自动放行工作区写模式下的越权审批弹窗，并在审批卡片上提供「始终允许」按钮。

Pre-dispatch guard for dsh writes whose path leaves the granted write area through a link. Every write confinement in the harness canonicalizes first and then refuses, which is the right enforcement answer and a poor diagnostic one: `<workspace>/link/out.

Four-mode file-permission fence for DeepSeek Harness (workspace read/write x outside read/write), enforced at the tool layer, with a read-only composer mode indicator and a locale-aware UI.

Run DeepSeek Harness command execution in OpenSandbox containers: an OpenSandbox-backed ctx.subprocess and container-world ctx.sandbox for dsh.

Remote SSH Ubuntu sandbox for DeepSeek Harness: run bash on a remote host with a persistent (tmux) session plus remote read/write/list tools, sharing the host store of @linxin666/dsh-ssh.

Independent AI reviewer for one-shot DeepSeek Harness approval requests

Runtime security guard for DeepSeek Harness (DSH) — blocks command injection, SSRF, credential exfiltration, and destructive operations at runtime.

Per-session workspace visibility scopes for DeepSeek Harness.

隔离箱：DSH 插件调试隔离框架（进程隔离/看门狗/熔断/验收/启动守卫/发布预检）

DSH 临时任务模式：为 DSH 增加「任务」分组——不绑定任何长期工作空间，自动在任务根目录下创建隔离的临时工作目录并开启会话，即开即用、用完即弃。Temporary task mode for DeepSeek Harness.

Docker-container (WSL2 backend) shell executor for the DeepSeek Harness bash capability seam on Windows: every bash tool call runs in a disposable Linux container with the workspace bind-mounted.

The dual-axis access-mode bundle: the file sandbox's read and write axes, custom allow/deny paths included, as an installable profile layer

One-line DeepSeek Harness bundle that moves the execution world into a crash-resilient, heartbeat-kept, workspace-synced E2B sandbox.

Time-Machine-backed autonomous agent permission gate for DeepSeek Harness (dsh). Safe defaults on install (protect cwd, deny network/system, block sensitive reads). Configure protectedPaths/extraAllowTools to unlock subagent/workflow/web — see README.

Escalation-only LLM reviewer: reviews sandbox escapes only, keeps the sandbox, fails closed.

Con's 自动审查（DCAR）：确定性规则优先、LLM 按需升级的 DeepSeek Harness 工具审查插件，提供 CAutoR 权限模式。Deterministic-first auto review for DeepSeek Harness.

Codex-inspired managed approval for DeepSeek Harness: risk-based MCP review, one-time grants, explicit denials, and human fallback on reviewer failure.

在 DSH Web GUI 的审批弹窗里追加中文说明：这次审批会做什么、有什么风险、依据是什么。原英文理由与命令原文保留显示。

Deterministic DeepSeek Harness Web client plugin that explains the Windows-sandbox `spawn EPERM` failure as a distinct Conversation Node.