@morlay/dsh-sandbox-local 0.0.3-alpha.8 → 0.0.3-alpha.9

package/README.md

@@ -43,6 +43,11 @@
 
 ## 配置
 
+六个字段都上设置页：`access` 可改（**改完规则当场重算**，不用重挂这一行）；其余五个是**装配事实**，页面上只读
+可见——它们在 `Config` 上标了 `.volatile().disabled()`，所以能看清「这一行现在装配成什么样」而改不了。`volatile`
+会让解析后的值变成**引用**，而官方 `LocalSandboxProvider` / `LocalFileSystem` 在构造时读一次这些字段并做装配期
+校验，所以交给基类的那份配置先由 `upstreamConfigOf` 解包成值（`src/config.ts`）。
+
 | 字段                      | 默认            | 含义                                                                                          |
 | ------------------------- | --------------- | --------------------------------------------------------------------------------------------- |
 | `access`                  | `[]`            | 规则条目：`rw <path>` 可写根 / `r- <path>` 只读 / `-- <pattern>` 拒绝访问；数组或一段多行文本 |
@@ -94,10 +99,10 @@
 （schema 默认是空规则），patch 内容见该文件。
 
 **本部署走的就是这条路径**：示例 app 的 `dsh.profile.bundles` 列出了本包（排在
-[`@morlay/dsh-profile`](../../profile/dsh-profile/README.md) 之前），因此"禁用官方两行 + 插入本行"由这份
+[`@morlay/dsh-profile`](../../bundles/sandbox-profile/README.md) 之前），因此"禁用官方两行 + 插入本行"由这份
 patch 负责；`access` 规则的值由 `dsh-profile` 按 id 做 config 覆盖——装配与配置各归一处
 （`@morlay/dsh-profile` 已在 `dependencies` 声明本包）。patch 层级的合并顺序与放置理由见
-[设计 host 层部署配置](../../profile/dsh-profile/.agents/designs/20260917-host层部署配置.md)。
+[设计 host 层部署配置](../../bundles/sandbox-profile/README.md)。
 两种采用方式互斥：同时上线会重复插入同一行。
 
 ## 接管 `sandbox:policy`

package/dist/client.cjs

@@ -0,0 +1,55 @@
+window.__ModuleLoader__.load({
+	id: "@morlay/dsh-sandbox-local",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		//#region src/client/locales.ts
+		/** 本包在配置页上的字段文案（命名空间 `settings.sandbox-local`）。 */
+		const zh = {
+			access: "额外可写根与拒绝项",
+			accessHint: "一行一条：`rw:<路径>` 追加可写根，`r-:<路径>` 只读，`--:<路径>` 拒绝；支持 `~`、环境变量与 glob。改完当场生效。"
+		};
+		const en = {
+			access: "Extra writable roots and refusals",
+			accessHint: "One entry per line: `rw:<path>` grants a writable root, `r-:<path>` makes it read-only, `--:<path>` denies it; `~`, env templates, and globs work. Edits apply immediately."
+		};
+		//#endregion
+		//#region src/client/index.ts
+		/** 本包 host 行 id：行配置页读的就是这个命名空间。 */
+		const SANDBOX_NS = "sandbox-local";
+		/** 这一行里需要中文文案的字段。 */
+		const FIELDS = ["access"];
+		/** 本页字典的命名空间。 */
+		const NS = "settings.sandbox-local";
+		/** 需要的服务：槽位（字段槽）与字典。 */
+		const inject = ["locale"];
+		/**
+		* 给 `access` 补文案。
+		* @param ctx - 浏览器插件上下文。
+		*/
+		function apply(ctx) {
+			const t = ctx.locale.bind(NS);
+			ctx.effect(() => ctx.locale.register(NS, {
+				zh,
+				en
+			}), "sandbox-local: field locale");
+			ctx.inject(["schemaFormHints"], (scope) => scope.effect(() => {
+				const hints = scope.schemaFormHints;
+				const offs = FIELDS.map((key) => hints.describe(SANDBOX_NS, [key], () => ({
+					label: t(key),
+					hint: t("accessHint")
+				})));
+				return () => {
+					for (const off of offs) off();
+				};
+			}, "sandbox-local: field wording"));
+		}
+		//#endregion
+		exports.NS = NS;
+		exports.SANDBOX_NS = SANDBOX_NS;
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});

package/dist/client.d.cts

@@ -0,0 +1,29 @@
+import { Context } from "@deepseek-ai/cordis";
+//#region src/client/locales.d.ts
+/** 本包在配置页上的字段文案（命名空间 `settings.sandbox-local`）。 */
+declare const zh: {
+  readonly access: "额外可写根与拒绝项";
+  readonly accessHint: "一行一条：`rw:<路径>` 追加可写根，`r-:<路径>` 只读，`--:<路径>` 拒绝；支持 `~`、环境变量与 glob。改完当场生效。";
+};
+type SandboxFieldLocaleKey = keyof typeof zh;
+//#endregion
+//#region src/client/index.d.ts
+/** 本包 host 行 id：行配置页读的就是这个命名空间。 */
+declare const SANDBOX_NS = "sandbox-local";
+/** 本页字典的命名空间。 */
+declare const NS = "settings.sandbox-local";
+declare module "@deepseek-ai/dsh-client-ui-slots" {
+  interface LocaleNamespaceMap {
+    /** 设置页里这一行的字段文案。 */
+    "settings.sandbox-local": SandboxFieldLocaleKey;
+  }
+}
+/** 需要的服务：槽位（字段槽）与字典。 */
+declare const inject: string[];
+/**
+ * 给 `access` 补文案。
+ * @param ctx - 浏览器插件上下文。
+ */
+declare function apply(ctx: Context): void;
+//#endregion
+export { NS, SANDBOX_NS, apply, inject };

package/dist/client.d.mts

@@ -0,0 +1,29 @@
+import { Context } from "@deepseek-ai/cordis";
+//#region src/client/locales.d.ts
+/** 本包在配置页上的字段文案（命名空间 `settings.sandbox-local`）。 */
+declare const zh: {
+  readonly access: "额外可写根与拒绝项";
+  readonly accessHint: "一行一条：`rw:<路径>` 追加可写根，`r-:<路径>` 只读，`--:<路径>` 拒绝；支持 `~`、环境变量与 glob。改完当场生效。";
+};
+type SandboxFieldLocaleKey = keyof typeof zh;
+//#endregion
+//#region src/client/index.d.ts
+/** 本包 host 行 id：行配置页读的就是这个命名空间。 */
+declare const SANDBOX_NS = "sandbox-local";
+/** 本页字典的命名空间。 */
+declare const NS = "settings.sandbox-local";
+declare module "@deepseek-ai/dsh-client-ui-slots" {
+  interface LocaleNamespaceMap {
+    /** 设置页里这一行的字段文案。 */
+    "settings.sandbox-local": SandboxFieldLocaleKey;
+  }
+}
+/** 需要的服务：槽位（字段槽）与字典。 */
+declare const inject: string[];
+/**
+ * 给 `access` 补文案。
+ * @param ctx - 浏览器插件上下文。
+ */
+declare function apply(ctx: Context): void;
+//#endregion
+export { NS, SANDBOX_NS, apply, inject };

package/dist/index.d.cts

@@ -0,0 +1,32 @@
+import { Context } from "@deepseek-ai/cordis";
+import { Volatile } from "@deepseek-ai/cosmokit";
+import z from "@deepseek-ai/schemastery";
+import { Config as Config$1 } from "@deepseek-ai/dsh-fs-local";
+import { Config as Config$2 } from "@deepseek-ai/dsh-sandbox-local";
+//#region src/config.d.ts
+interface Config extends Config$2, Config$1 {
+  access?: string | string[];
+}
+/**
+ * schema 解析之后的形状：`access` 是 **volatile 稳定引用**（页面可改的那一项），读它要过 `.get()`。
+ *
+ * 其余字段也是 volatile，但页面把它们画成**只读**（schema 上的 `disabled()`）：它们是装配事实——runner 命令、
+ * 进程 cwd、上游基类读一次的超时与差额上限——放在页面上是为了看清「这一行现在装配成什么样」，改它们要重挂
+ * 这一行。所以给上游基类的那份配置是**解包后的值**（{@link upstreamConfigOf}）：基类读的是值，不是引用。
+ */
+interface ResolvedConfig extends Omit<Config, "access" | "runnerCommand" | "runnerFailureSignatures" | "probeTimeoutMs" | "cwd" | "diffBasisMaxBytes"> {
+  readonly access: Volatile<string | string[]>;
+  readonly runnerCommand: Volatile<readonly string[]>;
+  readonly runnerFailureSignatures: Volatile<readonly string[]>;
+  readonly probeTimeoutMs: Volatile<number>;
+  readonly cwd: Volatile<string>;
+  readonly diffBasisMaxBytes: Volatile<number>;
+}
+declare const Config: z<Config, ResolvedConfig>;
+//#endregion
+//#region src/index.d.ts
+declare const name = "sandbox-local";
+declare const inject: string[];
+declare function apply(ctx: Context, config: ResolvedConfig): void;
+//#endregion
+export { Config, type ResolvedConfig, apply, inject, name };

package/dist/index.d.mts

@@ -1,16 +1,32 @@
 import { Config as Config$1 } from "@deepseek-ai/dsh-fs-local";
-import { Config as Config$2 } from "@deepseek-ai/dsh-sandbox-local";
 import z from "@deepseek-ai/schemastery";
+import { Config as Config$2 } from "@deepseek-ai/dsh-sandbox-local";
 import { Context } from "@deepseek-ai/cordis";
+import { Volatile } from "@deepseek-ai/cosmokit";
 //#region src/config.d.ts
 interface Config extends Config$2, Config$1 {
   access?: string | string[];
 }
-declare const Config: z<Config>;
+/**
+ * schema 解析之后的形状：`access` 是 **volatile 稳定引用**（页面可改的那一项），读它要过 `.get()`。
+ *
+ * 其余字段也是 volatile，但页面把它们画成**只读**（schema 上的 `disabled()`）：它们是装配事实——runner 命令、
+ * 进程 cwd、上游基类读一次的超时与差额上限——放在页面上是为了看清「这一行现在装配成什么样」，改它们要重挂
+ * 这一行。所以给上游基类的那份配置是**解包后的值**（{@link upstreamConfigOf}）：基类读的是值，不是引用。
+ */
+interface ResolvedConfig extends Omit<Config, "access" | "runnerCommand" | "runnerFailureSignatures" | "probeTimeoutMs" | "cwd" | "diffBasisMaxBytes"> {
+  readonly access: Volatile<string | string[]>;
+  readonly runnerCommand: Volatile<readonly string[]>;
+  readonly runnerFailureSignatures: Volatile<readonly string[]>;
+  readonly probeTimeoutMs: Volatile<number>;
+  readonly cwd: Volatile<string>;
+  readonly diffBasisMaxBytes: Volatile<number>;
+}
+declare const Config: z<Config, ResolvedConfig>;
 //#endregion
 //#region src/index.d.ts
 declare const name = "sandbox-local";
 declare const inject: string[];
-declare function apply(ctx: Context, config: Config): void;
+declare function apply(ctx: Context, config: ResolvedConfig): void;
 //#endregion
-export { Config, apply, inject, name };
+export { Config, type ResolvedConfig, apply, inject, name };

package/dist/index.mjs

@@ -1,10 +1,60 @@
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
+import z from "@deepseek-ai/schemastery";
 import { stat } from "node:fs/promises";
 import { dirname, isAbsolute, resolve, sep } from "node:path";
 import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
-import z from "@deepseek-ai/schemastery";
+//#region src/config.ts
+/**
+* 本地化说明：`description()` 的类型签名只声明 `string`，而 meta 本身接受 `Dict<string>`
+* （`vendor/schemastery/src/index.ts` 的 `mergeDesc` 就是按字典合并的），所以这里只做一次类型放行。
+*/
+const localized = (text) => text;
+const Config = z.object({
+	access: z.union([z.array(z.string()), z.string()]).default([]).description(localized({
+		zh: "额外可写根与拒绝项，一行一条：`rw:<路径>` 追加可写根，`r-:<路径>` 只读，`--:<路径>` 拒绝；支持 `~`、环境变量与 glob。改它当场生效（沙箱规则每次按当前值重算），不用重挂这一行。",
+		en: "Extra writable roots and refusals, one entry per line: `rw:<path>` grants a writable root, `r-:<path>` makes it read-only, `--:<path>` denies it; `~`, env templates, and globs are supported. Edits take effect on the next rule compile without remounting the row."
+	})).volatile(),
+	runnerCommand: z.array(z.string()).default([]).disabled().description(localized({
+		zh: "沙箱 runner 的启动命令；空数组表示按平台自带的链去选。改它要重挂这一行。",
+		en: "Runner command for confined subprocesses; an empty array picks the platform chain. Edits apply on remount."
+	})).volatile(),
+	runnerFailureSignatures: z.array(z.string()).default([]).disabled().description(localized({
+		zh: "runner 命令「用不了」的判定片段，与 `runnerCommand` 成对出现。",
+		en: "Fragments that mark the runner command unusable; declared together with `runnerCommand`."
+	})).volatile(),
+	probeTimeoutMs: z.natural().default(5e3).disabled().description(localized({
+		zh: "探测 runner 可用性的超时（毫秒）。",
+		en: "Timeout in ms for probing whether the runner works."
+	})).volatile(),
+	cwd: z.string().default(process.cwd()).disabled().description(localized({
+		zh: "相对路径的基准目录；默认是启动这个进程时的工作目录。",
+		en: "Base directory for relative paths; defaults to the process working directory."
+	})).volatile(),
+	diffBasisMaxBytes: z.number().default(10485760).disabled().description(localized({
+		zh: "覆盖写差异的单侧字节上限（默认 10 MiB）。",
+		en: "Per-side byte cap for overwrite diffs (10 MiB by default)."
+	})).volatile()
+});
+/**
+* 交给上游基类的那份配置：装配事实取当前值。
+*
+* 上游 `LocalSandboxProvider` / `LocalFileSystem` 在构造时读一次这些字段并做装配期校验，所以它们要的是值；
+* 设置页改它们走的是「写盘 → Loader 重挂这一行 → 重新解析」这条路。
+* @param config - 本行解析后的配置。
+* @returns 上游两个基类认的普通配置对象。
+*/
+function upstreamConfigOf(config) {
+	return {
+		runnerCommand: [...config.runnerCommand.get()],
+		runnerFailureSignatures: [...config.runnerFailureSignatures.get()],
+		probeTimeoutMs: config.probeTimeoutMs.get(),
+		cwd: config.cwd.get(),
+		diffBasisMaxBytes: config.diffBasisMaxBytes.get()
+	};
+}
+//#endregion
 //#region src/containment.ts
 const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
 async function statIfPresent(path) {
@@ -122,8 +172,8 @@ function parseAccess(input) {
 		deny
 	};
 }
-function ruleSourceOf(config, env) {
-	const parsed = parseAccess(config.access);
+function ruleSourceOf(access, env) {
+	const parsed = parseAccess(access);
 	const expand = (values) => values.map((value) => expandEnvTemplates(value, env));
 	return {
 		allowWrite: expand(parsed.allowWrite),
@@ -191,12 +241,16 @@ function isReadOnly(rules, canonicalTarget) {
 var ConfigurableFileSystem = class extends LocalFileSystem {
 	static inject = ["sandboxPolicy"];
 	defaultMode;
-	source;
+	access;
 	compiled = /* @__PURE__ */ new Map();
 	constructor(ctx, config) {
-		super(ctx, config);
+		super(ctx, upstreamConfigOf(config));
 		this.defaultMode = ctx.sandboxPolicy.defaultMode;
-		this.source = ruleSourceOf(config, process.env);
+		this.access = config.access;
+	}
+	/** 规则源现场重算：`access` 是 volatile 引用，页面改完下一次编译就是新规则。 */
+	get source() {
+		return ruleSourceOf(this.access.get(), process.env);
 	}
 	get sandboxMode() {
 		return this.defaultMode;
@@ -233,11 +287,14 @@ var ConfigurableFileSystem = class extends LocalFileSystem {
 		for (const root of writableRootsWith(rules, policy)) if (await isPathUnder(fresh.targetKey, root)) return fresh;
 		throw new FsError(`cannot write "${target.displayPath}": file access denied under workspace-write mode`, "FS_SANDBOX_DENIED");
 	}
+	/** 编译结果按「工作区 + 当前 access」缓存：access 是页面可改的引用，改了就是另一份规则。 */
 	rulesFor(workspaceRoot) {
-		const cached = this.compiled.get(workspaceRoot);
+		const access = this.access.get();
+		const key = `${workspaceRoot}\u0000${JSON.stringify(access ?? null)}`;
+		const cached = this.compiled.get(key);
 		if (cached !== void 0) return cached;
-		const compiled = compileRules(this.source, workspaceRoot);
-		this.compiled.set(workspaceRoot, compiled);
+		const compiled = compileRules(ruleSourceOf(access, process.env), workspaceRoot);
+		this.compiled.set(key, compiled);
 		return compiled;
 	}
 };
@@ -385,11 +442,15 @@ function extendConfinedArgv(argv, rules) {
 //#endregion
 //#region src/sandbox.ts
 var ConfigurableSandboxProvider = class extends LocalSandboxProvider {
-	source;
+	access;
 	compiled = /* @__PURE__ */ new Map();
 	constructor(ctx, config) {
-		super(ctx, config);
-		this.source = ruleSourceOf(config, process.env);
+		super(ctx, upstreamConfigOf(config));
+		this.access = config.access;
+	}
+	/** 规则源现场重算：`access` 是 volatile 引用，页面改完下一次编译就是新规则。 */
+	get source() {
+		return ruleSourceOf(this.access.get(), process.env);
 	}
 	async confine(argv, policy, signal) {
 		const confined = await super.confine(argv, policy, signal);
@@ -401,25 +462,18 @@ var ConfigurableSandboxProvider = class extends LocalSandboxProvider {
 			argv: extendConfinedArgv(confined.argv, effective)
 		};
 	}
+	/** 编译结果按「工作区 + 当前 access」缓存：access 是页面可改的引用，改了就是另一份规则。 */
 	rulesFor(workspaceRoot) {
-		const cached = this.compiled.get(workspaceRoot);
+		const access = this.access.get();
+		const key = `${workspaceRoot}\u0000${JSON.stringify(access ?? null)}`;
+		const cached = this.compiled.get(key);
 		if (cached !== void 0) return cached;
-		const compiled = compileRules(this.source, workspaceRoot);
-		this.compiled.set(workspaceRoot, compiled);
+		const compiled = compileRules(ruleSourceOf(access, process.env), workspaceRoot);
+		this.compiled.set(key, compiled);
 		return compiled;
 	}
 };
 //#endregion
-//#region src/config.ts
-const Config = z.object({
-	access: z.union([z.array(z.string()), z.string()]).default([]),
-	runnerCommand: z.array(z.string()).default([]),
-	runnerFailureSignatures: z.array(z.string()).default([]),
-	probeTimeoutMs: z.natural().default(5e3),
-	cwd: z.string().default(process.cwd()),
-	diffBasisMaxBytes: z.number().default(10485760)
-});
-//#endregion
 //#region src/index.ts
 const name = "sandbox-local";
 const inject = ["sandboxPolicy"];
@@ -433,7 +487,7 @@ function warnAboutDegradedRules(ctx, rules) {
 	if (grants && process.platform === "win32") ctx.logger.warn("sandbox-local: \"rw\" entries cannot be granted to confined subprocesses on win32; ctx.fs covers the extra roots, the Windows ACL runner does not");
 }
 function apply(ctx, config) {
-	const rules = ruleSourceOf(config, process.env);
+	const rules = ruleSourceOf(config.access.get(), process.env);
 	warnAboutDegradedRules(ctx, rules);
 	new ConfigurableSandboxProvider(ctx, config);
 	new ConfigurableFileSystem(ctx, config);

package/dist/rows.d.cts

@@ -0,0 +1,23 @@
+//#region src/rows.d.ts
+/**
+ * 本包作为能力包发布的**装配数据**：行本身在部署那一层装（`packages/bundles/sandbox-profile` 引用它渲染 patch）。
+ *
+ * 官方 `sandbox`（进程沙箱）与 `fs-sandbox`（文件围栏）两个服务只能有一份实现，所以那两行禁掉、换成
+ * 本包那一行；`config.access` 的值由部署那层给（schema 默认是空规则）。
+ */
+/** 一行装配条目：与 `cordis.patch.yml` 的顶层结构同形。 */
+interface PatchRow {
+  readonly id?: string;
+  readonly disabled?: boolean;
+  readonly insert?: readonly RowEntry[];
+}
+/** `insert` 里的一个条目。 */
+interface RowEntry {
+  readonly id: string;
+  readonly name: string;
+  readonly config?: Readonly<Record<string, unknown>>;
+}
+/** 沙箱替换的装配行：禁官方两行 + 插本包一行（值由部署那层按 id 覆盖）。 */
+declare function sandboxRows(): readonly PatchRow[];
+//#endregion
+export { PatchRow, RowEntry, sandboxRows };

package/dist/rows.d.mts

@@ -0,0 +1,23 @@
+//#region src/rows.d.ts
+/**
+ * 本包作为能力包发布的**装配数据**：行本身在部署那一层装（`packages/bundles/sandbox-profile` 引用它渲染 patch）。
+ *
+ * 官方 `sandbox`（进程沙箱）与 `fs-sandbox`（文件围栏）两个服务只能有一份实现，所以那两行禁掉、换成
+ * 本包那一行；`config.access` 的值由部署那层给（schema 默认是空规则）。
+ */
+/** 一行装配条目：与 `cordis.patch.yml` 的顶层结构同形。 */
+interface PatchRow {
+  readonly id?: string;
+  readonly disabled?: boolean;
+  readonly insert?: readonly RowEntry[];
+}
+/** `insert` 里的一个条目。 */
+interface RowEntry {
+  readonly id: string;
+  readonly name: string;
+  readonly config?: Readonly<Record<string, unknown>>;
+}
+/** 沙箱替换的装配行：禁官方两行 + 插本包一行（值由部署那层按 id 覆盖）。 */
+declare function sandboxRows(): readonly PatchRow[];
+//#endregion
+export { PatchRow, RowEntry, sandboxRows };

package/dist/rows.mjs

@@ -0,0 +1,20 @@
+//#region src/rows.ts
+/** 沙箱替换的装配行：禁官方两行 + 插本包一行（值由部署那层按 id 覆盖）。 */
+function sandboxRows() {
+	return [
+		{
+			id: "sandbox",
+			disabled: true
+		},
+		{
+			id: "fs-sandbox",
+			disabled: true
+		},
+		{ insert: [{
+			id: "sandbox-local",
+			name: "@morlay/dsh-sandbox-local"
+		}] }
+	];
+}
+//#endregion
+export { sandboxRows };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morlay/dsh-sandbox-local",
-  "version": "0.0.3-alpha.8",
+  "version": "0.0.3-alpha.9",
   "description": "Configurable sandbox bundle: replaces the shipped process-sandbox provider and filesystem fence with implementations that add extra writable roots, read-only roots and access denials on top of the upstream semantics.",
   "keywords": [
     "dsh",
@@ -18,45 +18,61 @@
     "locale/*.json",
     "dist",
     "src",
-    "cordis.patch.yml",
     "!**/__tests__"
   ],
   "type": "module",
   "exports": {
     ".": "./dist/index.mjs",
+    "./rows": "./dist/rows.mjs",
     "./package.json": "./package.json",
-    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./client": {
+      "types": "./dist/client.d.cts",
+      "default": "./dist/client.cjs"
+    },
     "./locale/*.json": "./locale/*.json"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.4",
-    "@deepseek-ai/dsh-agent": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-fs": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-fs-sandbox": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "0.1.7-rc.1"
+    "@deepseek-ai/cosmokit": "1.8.5",
+    "@deepseek-ai/dsh-agent": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-fs": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-scope": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.7-rc.2",
+    "@morlay/dsh-client-ui-primitives": "0.0.2-alpha.9"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
-    "@deepseek-ai/dsh-agent": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-fs": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-fs-sandbox": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.7-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "0.1.7-rc.1",
-    "@deepseek-ai/schemastery": "3.18.4"
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/cosmokit": "^1.8.5",
+    "@deepseek-ai/dsh-agent": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-fs": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-fs-local": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-fs-sandbox": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-sandbox": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.7-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.4",
+    "@morlay/dsh-client-ui-primitives": "0.0.2-alpha.9"
   },
   "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@morlay/dsh-client-ui-primitives"
+      ]
     }
   },
   "scripts": {

package/src/client/index.ts

@@ -0,0 +1,52 @@
+/**
+ * client 半：这一行的配置页由通用 schema 表单按 volatile 字段生成（`access` 是页面可改的那一项，改完规则
+ * 当场重算），本包只把键名换成中文标签与说明。
+ */
+
+import type { Context } from "@deepseek-ai/cordis";
+import type {} from "@deepseek-ai/dsh-client-locale/client";
+import type {} from "@deepseek-ai/dsh-client-ui-slots";
+import { en, zh, type SandboxFieldLocaleKey } from "./locales.ts";
+
+/** 本包 host 行 id：行配置页读的就是这个命名空间。 */
+export const SANDBOX_NS = "sandbox-local";
+
+/** 这一行里需要中文文案的字段。 */
+const FIELDS = ["access"] as const;
+
+/** 本页字典的命名空间。 */
+export const NS = "settings.sandbox-local";
+
+declare module "@deepseek-ai/dsh-client-ui-slots" {
+  interface LocaleNamespaceMap {
+    /** 设置页里这一行的字段文案。 */
+    "settings.sandbox-local": SandboxFieldLocaleKey;
+  }
+}
+
+/** 需要的服务：槽位（字段槽）与字典。 */
+export const inject = ["locale"];
+
+/**
+ * 给 `access` 补文案。
+ * @param ctx - 浏览器插件上下文。
+ */
+export function apply(ctx: Context): void {
+  const t = ctx.locale.bind(NS);
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), "sandbox-local: field locale");
+  // 提示面由行配置表单提供：等它可用再注册（`ctx.get` 在它还没提供时拿不到，注册会被静静跳过）。
+  ctx.inject(["schemaFormHints"], (scope) =>
+    scope.effect(() => {
+      const hints = scope.schemaFormHints;
+      const offs = FIELDS.map((key) =>
+        hints.describe(SANDBOX_NS, [key], () => ({
+          label: t(key),
+          hint: t("accessHint"),
+        })),
+      );
+      return () => {
+        for (const off of offs) off();
+      };
+    }, "sandbox-local: field wording"),
+  );
+}

package/src/client/locales.ts

@@ -0,0 +1,15 @@
+/** 本包在配置页上的字段文案（命名空间 `settings.sandbox-local`）。 */
+
+export const zh = {
+  access: "额外可写根与拒绝项",
+  accessHint:
+    "一行一条：`rw:<路径>` 追加可写根，`r-:<路径>` 只读，`--:<路径>` 拒绝；支持 `~`、环境变量与 glob。改完当场生效。",
+} as const;
+
+export const en: Record<keyof typeof zh, string> = {
+  access: "Extra writable roots and refusals",
+  accessHint:
+    "One entry per line: `rw:<path>` grants a writable root, `r-:<path>` makes it read-only, `--:<path>` denies it; `~`, env templates, and globs work. Edits apply immediately.",
+};
+
+export type SandboxFieldLocaleKey = keyof typeof zh;

package/src/config.ts

@@ -1,3 +1,4 @@
+import type { Volatile } from "@deepseek-ai/cosmokit";
 import z from "@deepseek-ai/schemastery";
 import type { Config as UpstreamFsConfig } from "@deepseek-ai/dsh-fs-local";
 import type { Config as UpstreamSandboxConfig } from "@deepseek-ai/dsh-sandbox-local";
@@ -6,11 +7,123 @@ export interface Config extends UpstreamSandboxConfig, UpstreamFsConfig {
   access?: string | string[];
 }
 
-export const Config: z<Config> = z.object({
-  access: z.union([z.array(z.string()), z.string()]).default([]),
-  runnerCommand: z.array(z.string()).default([]),
-  runnerFailureSignatures: z.array(z.string()).default([]),
-  probeTimeoutMs: z.natural().default(5_000),
-  cwd: z.string().default(process.cwd()),
-  diffBasisMaxBytes: z.number().default(10 * 1024 * 1024),
+/**
+ * schema 解析之后的形状：`access` 是 **volatile 稳定引用**（页面可改的那一项），读它要过 `.get()`。
+ *
+ * 其余字段也是 volatile，但页面把它们画成**只读**（schema 上的 `disabled()`）：它们是装配事实——runner 命令、
+ * 进程 cwd、上游基类读一次的超时与差额上限——放在页面上是为了看清「这一行现在装配成什么样」，改它们要重挂
+ * 这一行。所以给上游基类的那份配置是**解包后的值**（{@link upstreamConfigOf}）：基类读的是值，不是引用。
+ */
+export interface ResolvedConfig extends Omit<
+  Config,
+  | "access"
+  | "runnerCommand"
+  | "runnerFailureSignatures"
+  | "probeTimeoutMs"
+  | "cwd"
+  | "diffBasisMaxBytes"
+> {
+  readonly access: Volatile<string | string[]>;
+  readonly runnerCommand: Volatile<readonly string[]>;
+  readonly runnerFailureSignatures: Volatile<readonly string[]>;
+  readonly probeTimeoutMs: Volatile<number>;
+  readonly cwd: Volatile<string>;
+  readonly diffBasisMaxBytes: Volatile<number>;
+}
+
+/**
+ * 本地化说明：`description()` 的类型签名只声明 `string`，而 meta 本身接受 `Dict<string>`
+ * （`vendor/schemastery/src/index.ts` 的 `mergeDesc` 就是按字典合并的），所以这里只做一次类型放行。
+ */
+const localized = (text: { zh: string; en: string }): string => text as unknown as string;
+
+export const Config: z<Config, ResolvedConfig> = z.object({
+  access: z
+    .union([z.array(z.string()), z.string()])
+    .default([])
+    .description(
+      localized({
+        zh:
+          "额外可写根与拒绝项，一行一条：`rw:<路径>` 追加可写根，`r-:<路径>` 只读，`--:<路径>` 拒绝；" +
+          "支持 `~`、环境变量与 glob。改它当场生效（沙箱规则每次按当前值重算），不用重挂这一行。",
+        en:
+          "Extra writable roots and refusals, one entry per line: `rw:<path>` grants a writable root, " +
+          "`r-:<path>` makes it read-only, `--:<path>` denies it; `~`, env templates, and globs are supported. " +
+          "Edits take effect on the next rule compile without remounting the row.",
+      }),
+    )
+    .volatile(),
+  runnerCommand: z
+    .array(z.string())
+    .default([])
+    .disabled()
+    .description(
+      localized({
+        zh: "沙箱 runner 的启动命令；空数组表示按平台自带的链去选。改它要重挂这一行。",
+        en: "Runner command for confined subprocesses; an empty array picks the platform chain. Edits apply on remount.",
+      }),
+    )
+    .volatile(),
+  runnerFailureSignatures: z
+    .array(z.string())
+    .default([])
+    .disabled()
+    .description(
+      localized({
+        zh: "runner 命令「用不了」的判定片段，与 `runnerCommand` 成对出现。",
+        en: "Fragments that mark the runner command unusable; declared together with `runnerCommand`.",
+      }),
+    )
+    .volatile(),
+  probeTimeoutMs: z
+    .natural()
+    .default(5_000)
+    .disabled()
+    .description(
+      localized({
+        zh: "探测 runner 可用性的超时（毫秒）。",
+        en: "Timeout in ms for probing whether the runner works.",
+      }),
+    )
+    .volatile(),
+  cwd: z
+    .string()
+    .default(process.cwd())
+    .disabled()
+    .description(
+      localized({
+        zh: "相对路径的基准目录；默认是启动这个进程时的工作目录。",
+        en: "Base directory for relative paths; defaults to the process working directory.",
+      }),
+    )
+    .volatile(),
+  diffBasisMaxBytes: z
+    .number()
+    .default(10 * 1024 * 1024)
+    .disabled()
+    .description(
+      localized({
+        zh: "覆盖写差异的单侧字节上限（默认 10 MiB）。",
+        en: "Per-side byte cap for overwrite diffs (10 MiB by default).",
+      }),
+    )
+    .volatile(),
 });
+
+/**
+ * 交给上游基类的那份配置：装配事实取当前值。
+ *
+ * 上游 `LocalSandboxProvider` / `LocalFileSystem` 在构造时读一次这些字段并做装配期校验，所以它们要的是值；
+ * 设置页改它们走的是「写盘 → Loader 重挂这一行 → 重新解析」这条路。
+ * @param config - 本行解析后的配置。
+ * @returns 上游两个基类认的普通配置对象。
+ */
+export function upstreamConfigOf(config: ResolvedConfig): UpstreamSandboxConfig & UpstreamFsConfig {
+  return {
+    runnerCommand: [...config.runnerCommand.get()],
+    runnerFailureSignatures: [...config.runnerFailureSignatures.get()],
+    probeTimeoutMs: config.probeTimeoutMs.get(),
+    cwd: config.cwd.get(),
+    diffBasisMaxBytes: config.diffBasisMaxBytes.get(),
+  };
+}

package/src/fs.ts

@@ -9,7 +9,7 @@ import type {
   FsWriteOutcome,
 } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
-import type { Config } from "./config.ts";
+import { upstreamConfigOf, type ResolvedConfig } from "./config.ts";
 import type { SandboxExecutionPolicy, SandboxMode } from "@deepseek-ai/dsh-sandbox";
 import type {} from "@deepseek-ai/dsh-sandbox-policy";
 import { isPathUnder } from "./containment.ts";
@@ -27,14 +27,19 @@ export class ConfigurableFileSystem extends LocalFileSystem {
   static inject = ["sandboxPolicy"];
 
   private readonly defaultMode: SandboxMode;
-  private readonly source: RuleSource;
+  private readonly access: ResolvedConfig["access"];
 
   private readonly compiled = new Map<string, CompiledRules>();
 
-  constructor(ctx: Context, config: Config) {
-    super(ctx, config);
+  constructor(ctx: Context, config: ResolvedConfig) {
+    super(ctx, upstreamConfigOf(config));
     this.defaultMode = ctx.sandboxPolicy.defaultMode;
-    this.source = ruleSourceOf(config, process.env);
+    this.access = config.access;
+  }
+
+  /** 规则源现场重算：`access` 是 volatile 引用，页面改完下一次编译就是新规则。 */
+  private get source(): RuleSource {
+    return ruleSourceOf(this.access.get(), process.env);
   }
 
   override get sandboxMode(): SandboxMode {
@@ -129,11 +134,14 @@ export class ConfigurableFileSystem extends LocalFileSystem {
     );
   }
 
+  /** 编译结果按「工作区 + 当前 access」缓存：access 是页面可改的引用，改了就是另一份规则。 */
   private rulesFor(workspaceRoot: string): CompiledRules {
-    const cached = this.compiled.get(workspaceRoot);
+    const access = this.access.get();
+    const key = `${workspaceRoot}\u0000${JSON.stringify(access ?? null)}`;
+    const cached = this.compiled.get(key);
     if (cached !== undefined) return cached;
-    const compiled = compileRules(this.source, workspaceRoot);
-    this.compiled.set(workspaceRoot, compiled);
+    const compiled = compileRules(ruleSourceOf(access, process.env), workspaceRoot);
+    this.compiled.set(key, compiled);
     return compiled;
   }
 }

package/src/index.ts

@@ -1,11 +1,12 @@
 import type { Context } from "@deepseek-ai/cordis";
-import type { Config } from "./config.ts";
+import type { ResolvedConfig } from "./config.ts";
 import { ConfigurableFileSystem } from "./fs.ts";
 import { installPolicyContext } from "./policy.ts";
 import { ruleSourceOf, type RuleSource } from "./rules.ts";
 import { ConfigurableSandboxProvider } from "./sandbox.ts";
 
 export { Config } from "./config.ts";
+export type { ResolvedConfig } from "./config.ts";
 
 export const name = "sandbox-local";
 
@@ -33,8 +34,8 @@ function warnAboutDegradedRules(ctx: Context, rules: RuleSource): void {
   }
 }
 
-export function apply(ctx: Context, config: Config): void {
-  const rules = ruleSourceOf(config, process.env);
+export function apply(ctx: Context, config: ResolvedConfig): void {
+  const rules = ruleSourceOf(config.access.get(), process.env);
   warnAboutDegradedRules(ctx, rules);
   new ConfigurableSandboxProvider(ctx, config);
   new ConfigurableFileSystem(ctx, config);

package/src/rows.ts

@@ -0,0 +1,29 @@
+/**
+ * 本包作为能力包发布的**装配数据**：行本身在部署那一层装（`packages/bundles/sandbox-profile` 引用它渲染 patch）。
+ *
+ * 官方 `sandbox`（进程沙箱）与 `fs-sandbox`（文件围栏）两个服务只能有一份实现，所以那两行禁掉、换成
+ * 本包那一行；`config.access` 的值由部署那层给（schema 默认是空规则）。
+ */
+
+/** 一行装配条目：与 `cordis.patch.yml` 的顶层结构同形。 */
+export interface PatchRow {
+  readonly id?: string;
+  readonly disabled?: boolean;
+  readonly insert?: readonly RowEntry[];
+}
+
+/** `insert` 里的一个条目。 */
+export interface RowEntry {
+  readonly id: string;
+  readonly name: string;
+  readonly config?: Readonly<Record<string, unknown>>;
+}
+
+/** 沙箱替换的装配行：禁官方两行 + 插本包一行（值由部署那层按 id 覆盖）。 */
+export function sandboxRows(): readonly PatchRow[] {
+  return [
+    { id: "sandbox", disabled: true },
+    { id: "fs-sandbox", disabled: true },
+    { insert: [{ id: "sandbox-local", name: "@morlay/dsh-sandbox-local" }] },
+  ];
+}

package/src/rules.ts

@@ -132,10 +132,10 @@ export function parseAccess(input: string | readonly string[] | undefined): Rule
 }
 
 export function ruleSourceOf(
-  config: { access?: string | readonly string[] },
+  access: string | readonly string[] | undefined,
   env: NodeJS.ProcessEnv,
 ): RuleSource {
-  const parsed = parseAccess(config.access);
+  const parsed = parseAccess(access);
   const expand = (values: readonly string[]): string[] =>
     values.map((value) => expandEnvTemplates(value, env));
   return {

package/src/sandbox.ts

@@ -1,7 +1,7 @@
 import type { Context } from "@deepseek-ai/cordis";
 import type { ConfinedArgv, SandboxPolicy } from "@deepseek-ai/dsh-sandbox";
 import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
-import type { Config } from "./config.ts";
+import { upstreamConfigOf, type ResolvedConfig } from "./config.ts";
 import { extendConfinedArgv } from "./dialects.ts";
 import {
   compileRules,
@@ -13,13 +13,19 @@ import {
 } from "./rules.ts";
 
 export class ConfigurableSandboxProvider extends LocalSandboxProvider {
-  private readonly source: RuleSource;
+  private readonly access: ResolvedConfig["access"];
 
   private readonly compiled = new Map<string, CompiledRules>();
 
-  constructor(ctx: Context, config: Config) {
-    super(ctx, config);
-    this.source = ruleSourceOf(config, process.env);
+  constructor(ctx: Context, config: ResolvedConfig) {
+    // 上游基类读的是**值**：装配事实在页面上只读可见，改它们要重挂这一行（重挂后重新解析）。
+    super(ctx, upstreamConfigOf(config));
+    this.access = config.access;
+  }
+
+  /** 规则源现场重算：`access` 是 volatile 引用，页面改完下一次编译就是新规则。 */
+  private get source(): RuleSource {
+    return ruleSourceOf(this.access.get(), process.env);
   }
 
   override async confine(
@@ -34,11 +40,14 @@ export class ConfigurableSandboxProvider extends LocalSandboxProvider {
     return { ...confined, argv: extendConfinedArgv(confined.argv, effective) };
   }
 
+  /** 编译结果按「工作区 + 当前 access」缓存：access 是页面可改的引用，改了就是另一份规则。 */
   private rulesFor(workspaceRoot: string): CompiledRules {
-    const cached = this.compiled.get(workspaceRoot);
+    const access = this.access.get();
+    const key = `${workspaceRoot}\u0000${JSON.stringify(access ?? null)}`;
+    const cached = this.compiled.get(key);
     if (cached !== undefined) return cached;
-    const compiled = compileRules(this.source, workspaceRoot);
-    this.compiled.set(workspaceRoot, compiled);
+    const compiled = compileRules(ruleSourceOf(access, process.env), workspaceRoot);
+    this.compiled.set(key, compiled);
     return compiled;
   }
 }

package/cordis.patch.yml

@@ -1,24 +0,0 @@
-# @morlay/dsh-sandbox-local bundle patch：把官方沙箱栈换成可配置实现。
-#
-# - `sandbox`：官方 `@deepseek-ai/dsh-sandbox-local` 注册 `ctx.sandbox`；本包用它的
-#   子类注册同名服务（复用官方 probe / runner 选择 / Windows ACL 流程，只在
-#   选中的 runner 参数上追加 `access` 规则）。
-# - `fs-sandbox`：官方 `@deepseek-ai/dsh-fs-sandbox` 注册 `ctx.fs`；本包用继承
-#   `LocalFileSystem` 的实现注册同名服务（复用同一套写围栏，并让 `--` 条目同时
-#   拦住读与写、`r-` / `rw` 条目参与写判定）。
-#
-# 这组 patch 供把本包作为独立 bundle 采用的部署使用：行不带 config，schema 默认是空规则。
-# 行不带 config（schema 默认是空规则）：规则的**值**由配置层给——本部署由 `@morlay/dsh-profile`
-# 按 id 做 config 覆盖。两层都住 app 的 `dsh.profile.bundles`，本包排在前面（配置层要能找到这一行）。
-#
-# 若别处再自行"禁官方两行 + 插入本行"，就会与本 bundle 重复插入同一行——采用方式二选一。
-
-- id: sandbox
-  disabled: true
-
-- id: fs-sandbox
-  disabled: true
-
-- insert:
-    - id: sandbox-local
-      name: "@morlay/dsh-sandbox-local"