dsh-sandbox-audit

Static sandbox-policy consistency audit for DeepSeek Harness presets and profiles.

It reads a cordis.patch.yml / agent.cordis.yml and reports every tool whose
sandbox wiring is inconsistent with the policy it claims to enforce — before you
ship the profile, not after an agent writes outside its workspace.

Community security tool. Not an official DeepSeek project and not a
replacement for the runtime sandbox; it audits the configuration that wires
tools to that sandbox.

The three families it catches

The audit is grounded in the upstream sandbox model (packages/sandbox,
packages/bundle/base/cordis.patch.yml), not in guessed rules:

Severity	Finding	Upstream discussion
HIGH	A mutating filesystem tool (str_replace_editor, tool-fs) shares a bare fs-local backend. A bare backend silently ignores the policy, so read-only / workspace-write are only enforced if the tool self-enforces ctx.sandboxPolicy.	#2066
MEDIUM	A search tool (tool-fs-search / glob / grep) mounts no fs and reads outside the write policy ("co-located requirement, not runtime-validated").	#951
MEDIUM	A shell tool has no operation-level destructive guard, so rm -rf <workspace> is indistinguishable from deleting a build dir.	#149

Install / run

git clone https://github.com/zoahdev/dsh-sandbox-audit
cd dsh-sandbox-audit
pnpm install

node bin/dsh-sandbox-audit.mjs path/to/agent.cordis.yml
node bin/dsh-sandbox-audit.mjs path/to/cordis.patch.yml --json

Exit code is 1 when any HIGH finding is present, so it can gate CI.

Real output

Against the shipped minimal preset:

# dsh-sandbox-audit report
- default sandbox mode: read-only (default)
- findings: 1 high, 2 medium

## [HIGH] Mutating filesystem tool `str-replace-editor` shares a bare `fs-local` backend
- realm: root/filesystem
- ... enforce at the tool layer (upstream fix for #2066) ...

Against the base bundle (standard presets) it reports 0 high — the mutating
tools there are fenced by dsh-fs-sandbox, which is exactly the point: the tool
shows where a preset diverges from the confined baseline.

Why this exists

DeepSeek Harness's policy is a path-space, not an operation-space, and tools
join realms in composable ways. The same preset shape can be safe under a
confining backend and unsafe under a bare one. This tool makes that difference
visible and traceable to a source line and a discussion.

中文说明

dsh-sandbox-audit 是 DeepSeek Harness 的沙箱策略一致性静态审计工具：读取
cordis.patch.yml / agent.cordis.yml，找出「工具接线」与「它声称执行的策略」不一致的地方。

它只审计配置，不替代运行时沙箱；规则全部溯源到上游源码模型，覆盖三类问题：

• HIGH：会写文件的工具（str_replace_editor / tool-fs）挂在一个裸 fs-local 后端上，
  而裸后端会静默忽略策略（read-only / workspace-write 只有工具自己 ctx.sandboxPolicy
  自执行时才生效）。见 #2066。
• MEDIUM：搜索工具（tool-fs-search / glob / grep）不挂 fs，读范围不受写策略约束。见
  #951。
• MEDIUM：shell 工具没有操作级破坏性门禁，rm -rf <workspace> 与删 build 目录无法区分。见
  #149。

有 HIGH 结果时退出码为 1，可直接接入 CI 门禁。这是社区安全工具，非官方项目。

License

MIT