@deepseek-ai/dsh-sandbox-ssh 0.1.6-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/ssh/sandbox-ssh/README.md
+README.md: e8f6cb8d47288e92fe8082ae23d550dff344324d
+README.zh.md: 694ff99cb0a5df0c45392de0211df2dfa223070d

package/README.md

@@ -0,0 +1,78 @@
+---
+description: "Remote file-effect confinement for compositions using SSH filesystem and subprocess providers."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-sandbox-ssh
+
+English | [中文](README.zh.md)
+
+## Summary
+
+`dsh-sandbox-ssh` supplies `ctx.sandbox` for processes launched by the SSH subprocess provider. The remote host selects its installed local sandbox backend and applies each call’s policy there. Bash and Node receive the same backend’s enforcement level, denial signatures and runner-failure classification.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Mount this provider with the shared [`SSH connection`](../ssh/README.md), SSH filesystem and SSH subprocess providers. It has no package-specific configuration. Await `confine(argv, policy, signal)` to resolve each policy and command through the running remote helper.
+
+Pass a complete `read-only` or `workspace-write` policy. The workspace is interpreted and canonicalized on the remote host. Consumers bypass `confine()` for `danger-full-access`; the connection does not invent an additional local/remote policy flag.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals — click to expand</summary>
+
+The running helper canonicalizes the policy root and asks its loaded sandbox provider for the enforcing argv, enforcement level and runner-failure evidence. The SSH subprocess provider executes that returned argv directly and owns fd 7 transport and managed process lifetime. Cancellation or an unavailable backend rejects before the caller receives a command to launch.
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+- [Process sandbox subsystem](../../../docs/subsystems/sandbox.md) — policy meanings and enforcement disclosure.
+- [Local sandbox provider](../../sandbox/sandbox-local/README.md) — backends and platform limitations inherited on the remote host.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+Indirectly, through existing sandbox consumers, which report mode, denial and enforcement and own approval presentation and model arguments.
+
+#### KV Cache effect
+
+This provider contributes no request-prefix content. Its consumers own model-visible tools and results.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- File-effect modes do not restrict network access or process visibility. A remote `partial` backend remains partial.
+- The SSH host and installed helper are trusted infrastructure. Digest checks and file-effect confinement do not establish a hostile-host security boundary.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+No invariant companion is published. Wire validation and the owning filesystem, subprocess and sandbox providers enforce the observable obligations; this adapter adds no independently observed state relation.
+
+</details>

package/README.zh.md

@@ -0,0 +1,78 @@
+---
+description: "面向使用 SSH 文件系统和子进程提供方的组合，说明远端文件效果限制。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-sandbox-ssh
+
+[English](README.md) | 中文
+
+## 概述
+
+`dsh-sandbox-ssh` 为 SSH 子进程提供方启动的进程提供 `ctx.sandbox`。远端主机选择其已安装的本地沙箱后端，并在远端执行每次调用的策略。Bash 与 Node 获得同一后端的执行完整性等级、拒绝特征及运行器失败分类。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [进一步探索](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与延后工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+将本提供方与共享 [SSH 连接](../ssh/README.zh.md)、SSH 文件系统及 SSH 子进程提供方一同挂载。本包没有专用配置。等待 `confine(argv, policy, signal)`，由正在运行的远端辅助程序解析每次调用的策略与命令。
+
+传入完整的 `read-only` 或 `workspace-write` 策略。工作区路径在远端主机解释并规范化。消费方在 `danger-full-access` 模式下绕过 `confine()`；连接不额外引入本地／远端策略标记。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+<details>
+<summary>实现细节 — 点击展开</summary>
+
+正在运行的辅助程序规范化策略根路径，再向已加载的沙箱提供方获取强制执行限制的 argv、执行完整性等级与运行器失败证据。SSH 子进程提供方直接执行返回的 argv，并负责 fd 7 传输及托管进程生命周期。取消请求或后端不可用时，会在调用方取得可启动命令之前拒绝请求。
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 进一步探索
+
+- [进程沙箱子系统](../../../docs/subsystems/sandbox.zh.md) — 策略含义及执行完整性披露。
+- [本地沙箱提供方](../../sandbox/sandbox-local/README.zh.md) — 远端主机继承的后端及平台限制。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+间接通过现有沙箱消费方产生影响，由它们报告模式、拒绝及执行完整性，并负责审批展示及模型参数。
+
+#### KV Cache 影响
+
+本提供方不贡献请求前缀内容。面向模型的工具与结果由消费方负责。
+
+## 已知限制与延后工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- 文件效果模式不限制网络访问或进程可见性。远端 `partial` 后端仍属于部分执行。
+- SSH 主机与已安装辅助程序属于可信基础设施。摘要检查与文件效果限制不构成对抗恶意主机的安全边界。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者工作上下文 — 点击展开</summary>
+
+本包不发布不变式伴随入口。消息校验及所属文件系统、子进程和沙箱提供方执行可观察的约束；此适配器没有增加可独立观察的状态关系。
+
+</details>

package/lib/index.js

@@ -0,0 +1,41 @@
+import { SandboxProvider, SandboxUnavailableError } from "@deepseek-ai/dsh-sandbox";
+import { z } from "zod";
+//#region lib/types/index.js
+/** Remote argv wrapper that selects and applies the sandbox on the SSH host. */
+const factsSchema = z.object({
+	argv: z.array(z.string()).min(1),
+	enforcement: z.enum(["full", "partial"]),
+	denialSignatures: z.array(z.string()),
+	runnerFailureRules: z.array(z.object({
+		allowedExitCodes: z.array(z.number().int()).optional(),
+		fatalSignatures: z.array(z.string()),
+		informationalLines: z.array(z.string()).optional()
+	}).strict())
+}).strict();
+/** Resolve each confinement request on the same host as its filesystem and subprocess providers. */
+var SshSandboxProvider = class extends SandboxProvider {
+	static inject = ["ssh"];
+	async confine(argv, policy, signal) {
+		signal?.throwIfAborted();
+		try {
+			const confined = await this.ctx.ssh.request("sandbox", {
+				argv,
+				policy
+			}, factsSchema, signal);
+			signal?.throwIfAborted();
+			return {
+				...confined,
+				runnerFailureRules: confined.runnerFailureRules.map((rule) => ({
+					fatalSignatures: rule.fatalSignatures,
+					...rule.allowedExitCodes === void 0 ? {} : { allowedExitCodes: rule.allowedExitCodes },
+					...rule.informationalLines === void 0 ? {} : { informationalLines: rule.informationalLines }
+				}))
+			};
+		} catch (error) {
+			signal?.throwIfAborted();
+			throw new SandboxUnavailableError(policy.mode, error instanceof Error ? error.message : String(error));
+		}
+	}
+};
+//#endregion
+export { SshSandboxProvider, SshSandboxProvider as default };

package/lib/types/index.d.ts

@@ -0,0 +1,10 @@
+/** Remote argv wrapper that selects and applies the sandbox on the SSH host. */
+import { SandboxProvider } from '@deepseek-ai/dsh-sandbox';
+import type { ConfinedArgv, SandboxPolicy } from '@deepseek-ai/dsh-sandbox';
+/** Resolve each confinement request on the same host as its filesystem and subprocess providers. */
+export declare class SshSandboxProvider extends SandboxProvider {
+    static inject: string[];
+    confine(argv: readonly string[], policy: SandboxPolicy, signal?: AbortSignal): Promise<ConfinedArgv>;
+}
+export default SshSandboxProvider;
+//# sourceMappingURL=index.d.ts.map

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@deepseek-ai/dsh-sandbox-ssh",
+  "description": "Remote POSIX sandbox argv provider over the shared SSH helper",
+  "version": "0.1.6-alpha.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/ssh/sandbox-ssh"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-ssh": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.6-alpha.1"
+  },
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@deepseek-ai/schemastery": "^3.18.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-ssh": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.6-alpha.1"
+  }
+}