{"_id":"@buckeyestudio/toh-pwsh-sandbox","name":"@buckeyestudio/toh-pwsh-sandbox","dist-tags":{"next":"0.1.1-rc.2","latest":"0.1.1-rc.2"},"versions":{"0.1.1-rc.2":{"name":"@buckeyestudio/toh-pwsh-sandbox","description":"Sandbox-consuming implementation of the TheOpen Harness PowerShell executor seam (confines every command via ctx.sandbox, reports denial/enforcement result facts)","version":"0.1.1-rc.2","publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/dustinwloring1988/theopen-harness.git","directory":"packages/shell/pwsh-sandbox"},"type":"module","main":"lib/index.js","types":"lib/types/index.d.ts","exports":{".":{"types":"./lib/types/index.d.ts","default":"./lib/index.js"},"./invariant":{"types":"./lib/types/invariant.d.ts","default":"./lib/invariant.js"},"./src/*":"./src/*","./package.json":"./package.json"},"license":"MIT","author":{"name":"buckeyestudio"},"peerDependencies":{"@buckeyestudio/toh-shell":"^0.1.1-rc.2","@buckeyestudio/toh-invariants":"^0.1.1-rc.2","@buckeyestudio/toh-pwsh-local":"^0.1.1-rc.2","@buckeyestudio/toh-sandbox-policy":"^0.1.1-rc.2","@buckeyestudio/cordis":"^4.0.1","@buckeyestudio/toh-sandbox":"^0.1.1-rc.2"},"devDependencies":{"@buckeyestudio/toh-shell":"^0.1.1-rc.2","@buckeyestudio/toh-pwsh-local":"^0.1.1-rc.2","@buckeyestudio/toh-invariants":"^0.1.1-rc.2","@buckeyestudio/toh-sandbox-local":"^0.1.1-rc.2","@buckeyestudio/toh-sandbox-policy":"^0.1.1-rc.2","@buckeyestudio/toh-sandbox":"^0.1.1-rc.2","@buckeyestudio/cordis":"^4.0.1","@buckeyestudio/toh-subprocess-local":"^0.1.1-rc.2"},"_id":"@buckeyestudio/toh-pwsh-sandbox@0.1.1-rc.2","bugs":{"url":"https://github.com/dustinwloring1988/theopen-harness/issues"},"homepage":"https://github.com/dustinwloring1988/theopen-harness#readme","_integrity":"sha512-KAAKQGW4t2BMArs+FTZ0DtUW8UTNFwJm2ya5yo3xJvtNubvvPZXEqRgo3Tj09EDWbo13hO4vtXSJy9tuX8aThg==","_resolved":"/home/runner/work/theopen-harness/theopen-harness/dist/npm/buckeyestudio-toh-pwsh-sandbox-0.1.1-rc.2.tgz","_from":"file:/home/runner/work/theopen-harness/theopen-harness/dist/npm/buckeyestudio-toh-pwsh-sandbox-0.1.1-rc.2.tgz","_nodeVersion":"24.19.0","_npmVersion":"11.17.0","dist":{"integrity":"sha512-KAAKQGW4t2BMArs+FTZ0DtUW8UTNFwJm2ya5yo3xJvtNubvvPZXEqRgo3Tj09EDWbo13hO4vtXSJy9tuX8aThg==","shasum":"48d3f198842597b576e2ef9707c3482a1c812563","tarball":"https://registry.npmjs.org/@buckeyestudio/toh-pwsh-sandbox/-/toh-pwsh-sandbox-0.1.1-rc.2.tgz","fileCount":10,"unpackedSize":27584,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCICRQV48KQ/jTV4WPTj65TcSw/s6BfmppCK1W4AHgdBBdAiBO7haPNFCpa8HeMJmLVMzSC36Hab2b7KoTmoGvP3roZw=="}]},"_npmUser":{"name":"buckeyestudio","email":"dustinwloring1988@gmail.com"},"directories":{},"maintainers":[{"name":"buckeyestudio","email":"dustinwloring1988@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/toh-pwsh-sandbox_0.1.1-rc.2_1787489270126_0.6724878329346069"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-23T12:47:49.964Z","0.1.1-rc.2":"2026-08-23T12:47:50.272Z","modified":"2026-08-23T12:47:50.503Z"},"maintainers":[{"name":"buckeyestudio","email":"dustinwloring1988@gmail.com"}],"description":"Sandbox-consuming implementation of the TheOpen Harness PowerShell executor seam (confines every command via ctx.sandbox, reports denial/enforcement result facts)","homepage":"https://github.com/dustinwloring1988/theopen-harness#readme","repository":{"type":"git","url":"git+https://github.com/dustinwloring1988/theopen-harness.git","directory":"packages/shell/pwsh-sandbox"},"author":{"name":"buckeyestudio"},"bugs":{"url":"https://github.com/dustinwloring1988/theopen-harness/issues"},"license":"MIT","readme":"# @buckeyestudio/toh-pwsh-sandbox\n\n[English](README.md) | 中文\n\n沙盒消费型的 [`ctx.shell` 执行器 seam](../shell/) 的 PowerShell 实现：每条命令以 `pwsh -NoLogo -NoProfile -NonInteractive -Command <command>` 运行，**经 `ctx.sandbox` 隔离**，选定模式、强制完整性、拒绝事实都盖在每次结算的结果上。它是 [`@buckeyestudio/toh-bash-sandbox`](../bash-sandbox/) 的 pwsh 孪生，按 [pwsh 执行器与工具决策](../../../.agents/notes/implemented/feature/2026-08-01-pwsh-tool-and-executor.zh.md) 逐调用镜像——隔离实体本身是平台无关的：Windows 上沙盒 seam 解析到 ACL 受限令牌 runner 链（[`@buckeyestudio/toh-sandbox-windows-acl`](../../sandbox/sandbox-windows-acl/)），Linux/macOS 上解析到 bwrap/Landlock/Seatbelt。\n\n执行器继承 [`@buckeyestudio/toh-pwsh-local`](../pwsh-local/) 的进程机制，并消费其 argv 级 seam（`argv()` / `runArgv()` / `startArgv()` / `onProcessDone()`）把精确的 pwsh 调用经 provider 包装。沙盒策略（模式 + 工作区根目录）不是本包的配置：每次调用由 `ctx.sandboxPolicy` 随行（工具层传调用会话解析后的策略；直接调用回退到部署策略）。\n\n## 行为\n\n- `danger-full-access`：命令经本地执行器原样运行；结果携带 `sandbox: { mode, denied: false }`。\n- 受限模式（`read-only`、`workspace-write`）：pwsh argv 由 `ctx.sandbox.confine()` 包装；runner 启动失败按 fail-closed 抛 `SANDBOX_UNAVAILABLE`（前台抛错、后台记 `runnerFailed` 事实），被拒绝的写按所选后端的 `denialSignatures` 分类为 `sandbox.denied`。\n\n## 模型体验\n\n### 隔离生效，拒绝以命令失败呈现\n\n#### 模型看到什么\n\n受限命令自身的 stderr（Windows ACL runner 下如 `Access to the path '...' is denied.`）；工具层把分类后的拒绝转成标准权限拒绝面，与 bash 工具完全一致。\n\n#### Token 影响\n\n除命令 stderr 与工具层标准拒绝面外，无额外模型可见文本。\n\n#### KV Cache 影响\n\n无直接影响；拒绝呈现面属于工具层。\n\n## 已知限制与后续工作\n\n- **Windows 上读不受限**（ACL runner 只限写）；读边界文档在 `@buckeyestudio/toh-sandbox-windows-acl`。\n- **Windows workspace-write 的临时权限按每个活跃的会话/工作区对私有**；无 agent（智能体）的调用每次都获得一个新的私有目录。环境临时根目录绝不会被授权，runner 会在 spawn 前将 TMP/TEMP 重写为该私有目录。\n- **Windows read-only 不授予任何显式可写根目录，但仍为部分强制执行**，因为受限令牌必须保留 Everyone。DACL 向 Everyone 授予写访问的对象——包括以兼容方式打开的 NUL 设备——仍构成环境权限来源；PowerShell 的 `> $null` 重定向仍可工作，且不会打开 NUL。\n","readmeFilename":"README.zh.md","_rev":"1-1152440feab419c9754343a0ed370fe0"}