{"_id":"dsh-deltabox","_rev":"4-95a7917a17ada76ef00cfc4d11024961","name":"dsh-deltabox","dist-tags":{"latest":"0.1.2"},"versions":{"0.0.0-stage":{"name":"dsh-deltabox","version":"0.0.0-stage","_id":"dsh-deltabox@0.0.0-stage","stub":true,"maintainers":[{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"}],"dist":{"shasum":"06f731abce418aefaa12b3a3eacdbf4ac752da0f","tarball":"https://registry.npmjs.org/dsh-deltabox/-/dsh-deltabox-0.0.0-stage.tgz","fileCount":2,"integrity":"sha512-06UvLb8A1oh995p0lIjL8djhNqjGOU9i0rI36oLec7GtSEjPfiYtIMka/EvJ2SeKZm60wNpg0CKColUkd58Kog==","signatures":[{"sig":"MEQCID7RA6uB0eMNTJnjF5kqjRuR/lsIaCI5TvheO6ZaeqIXAiA7O3PUVCG9ICJhD20Ns3/Q7IeIhzeUlSEcDAEvZpf0Pg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":334},"_npmUser":{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"},"description":"Temporary package placeholder for staged publishing","directories":{}},"0.1.0":{"name":"dsh-deltabox","version":"0.1.0","license":"MIT","_id":"dsh-deltabox@0.1.0","maintainers":[{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"}],"homepage":"https://github.com/delta-box/dsh-deltabox#readme","bugs":{"url":"https://github.com/delta-box/dsh-deltabox/issues"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"ae2a8736ff161bfffa58637257f6f62bf29fd1b4","tarball":"https://registry.npmjs.org/dsh-deltabox/-/dsh-deltabox-0.1.0.tgz","fileCount":16,"integrity":"sha512-9ghCYCPQDJWEF+AenGPTToT1o1ZZb8CGUtA+902I2cOB7Ux0OW+ZJ5t1LGD14Yvyy2kXrZHZfnlXEMg/b793Ng==","signatures":[{"sig":"MEYCIQC2+st9QnHleJLQ6+nDPJLg9H3CIV15uYmJcFJBzD5hEgIhAPJgR5viw29mKWWoJfmodHVe6mxxZDlhwJ5QKv3HsTjS","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQD1knug+51f5CJkeJki5tcZhsU27x7sRvZeN+r6WStFAwIhAK+ZmBE5zHvQzZ9bsJeV2yx/DEbBh2YokoLWtwwFVk2D","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":129978},"main":"lib/index.js","type":"module","_from":"file:/home/runner/work/dsh-deltabox/dsh-deltabox/dist/dsh-deltabox-0.1.0.tgz","types":"lib/index.d.ts","engines":{"node":"^22.19.0 || >=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./fs":{"types":"./lib/fs.d.ts","default":"./lib/fs.js"},"./bash":{"types":"./lib/bash.d.ts","default":"./lib/bash.js"},"./view":{"types":"./lib/view.d.ts","default":"./lib/view.js"},"./runtime":{"types":"./lib/runtime.d.ts","default":"./lib/runtime.js"},"./package.json":"./package.json","./review-policy":{"types":"./lib/review-policy.d.ts","default":"./lib/review-policy.js"},"./cordis.patch.yml":"./cordis.patch.yml"},"_npmUser":{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"},"_resolved":"/home/runner/work/dsh-deltabox/dsh-deltabox/dist/dsh-deltabox-0.1.0.tgz","_integrity":"sha512-9ghCYCPQDJWEF+AenGPTToT1o1ZZb8CGUtA+902I2cOB7Ux0OW+ZJ5t1LGD14Yvyy2kXrZHZfnlXEMg/b793Ng==","repository":{"url":"git+https://github.com/delta-box/dsh-deltabox.git","type":"git"},"_npmVersion":"11.19.0","description":"Agent-owned Deltabox filesystem, Bash, and turn-review providers for DeepSeek Harness","directories":{},"_nodeVersion":"24.21.0","dependencies":{"deltabox-lite":"0.1.0","@deepseek-ai/schemastery":"^3.18.4"},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/cordis":"^4.0.4","@deepseek-ai/dsh-fs":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-agent":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-shell":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-sandbox":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-session":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-home-paths":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-system-prompt":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-user-approval":"0.2.0-rc.2 || 0.2.1-alpha.2"},"_npmOperationalInternal":{"tmp":"tmp/dsh-deltabox_0.1.0_1791948819677_0.14043210111524096","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"dsh-deltabox","version":"0.1.1","license":"MIT","_id":"dsh-deltabox@0.1.1","maintainers":[{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"}],"homepage":"https://github.com/delta-box/dsh-deltabox#readme","bugs":{"url":"https://github.com/delta-box/dsh-deltabox/issues"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"11f6ea61a49e0c48731b1021ab3096552c295a4e","tarball":"https://registry.npmjs.org/dsh-deltabox/-/dsh-deltabox-0.1.1.tgz","fileCount":16,"integrity":"sha512-0H/k34Y0hNEi8eN64qJpxRagWbqE98y1V5dtGb643a8yoE3aDdlm44l0KGjRTc+VH2bIKQOT801P1L01vDG9lg==","signatures":[{"sig":"MEUCIQCZodQaIdUhiRk/88egonzQTUpLAtK8zxo6cfQSf4M98QIgSLkfw88xvqgliytbQ3HdZwkCHmrStrcBR4YAN0Cq4wQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQDwcTvdMa9z9QFTAgCiuJUyV2lVLV017/lwbAZsrgxaSwIgEGbEKOVTzY97iQ6YgXKsU+tqjNmmhA1qLT4TcCUYw28=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":130022},"main":"lib/index.js","type":"module","_from":"file:/home/runner/work/dsh-deltabox/dsh-deltabox/dist/dsh-deltabox-0.1.1.tgz","types":"lib/index.d.ts","engines":{"node":"^22.19.0 || >=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./fs":{"types":"./lib/fs.d.ts","default":"./lib/fs.js"},"./bash":{"types":"./lib/bash.d.ts","default":"./lib/bash.js"},"./view":{"types":"./lib/view.d.ts","default":"./lib/view.js"},"./runtime":{"types":"./lib/runtime.d.ts","default":"./lib/runtime.js"},"./package.json":"./package.json","./review-policy":{"types":"./lib/review-policy.d.ts","default":"./lib/review-policy.js"},"./cordis.patch.yml":"./cordis.patch.yml"},"_npmUser":{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"},"_resolved":"/home/runner/work/dsh-deltabox/dsh-deltabox/dist/dsh-deltabox-0.1.1.tgz","_integrity":"sha512-0H/k34Y0hNEi8eN64qJpxRagWbqE98y1V5dtGb643a8yoE3aDdlm44l0KGjRTc+VH2bIKQOT801P1L01vDG9lg==","repository":{"url":"git+https://github.com/delta-box/dsh-deltabox.git","type":"git"},"_npmVersion":"11.19.0","description":"Agent-owned Deltabox filesystem, Bash, and turn-review providers for DeepSeek Harness","directories":{},"_nodeVersion":"24.21.0","dependencies":{"deltabox-lite":"0.1.0","@deepseek-ai/schemastery":"^3.18.4"},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/cordis":"^4.0.4","@deepseek-ai/dsh-fs":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-agent":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-shell":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-sandbox":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-session":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-home-paths":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-system-prompt":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-user-approval":"0.2.0-rc.2 || 0.2.1-alpha.2"},"_npmOperationalInternal":{"tmp":"tmp/dsh-deltabox_0.1.1_1791949784697_0.8123311823263779","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"_id":"dsh-deltabox@0.1.2","dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"bugs":{"url":"https://github.com/delta-box/dsh-deltabox/issues"},"dist":{"shasum":"e93e26e210b55f1285a66bebee13657a247b1f47","tarball":"https://registry.npmjs.org/dsh-deltabox/-/dsh-deltabox-0.1.2.tgz","fileCount":16,"integrity":"sha512-SsBISEHE1A1ESzKajJhuinAa0exVhFINMe6r8EcJfP1E+WDI0vkIcrCbwWsnQ2NgIIC+K86iGpz/mhQ7RFHGtw==","signatures":[{"sig":"MEYCIQCPoYXbqP4l+c8wOf1WIembMLRjAusXebF1F88Rwp3B9wIhAKXkY5dB20I+9tx4rKvb2sfue1e4zpStqvgVN6Zm8XZN","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCID4ckOSpBK0ulTjk9A/k8FlEmUgyGCwmzpHnxP5EtUVPAiAa7YFqLTJJ55URmacx2fLI9UCcNu45FO+WhS62e3ghHg=="}],"unpackedSize":128651},"main":"lib/index.js","name":"dsh-deltabox","type":"module","_from":"file:/home/runner/work/dsh-deltabox/dsh-deltabox/dist/dsh-deltabox-0.1.2.tgz","types":"lib/index.d.ts","engines":{"node":"^22.19.0 || >=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./fs":{"types":"./lib/fs.d.ts","default":"./lib/fs.js"},"./bash":{"types":"./lib/bash.d.ts","default":"./lib/bash.js"},"./view":{"types":"./lib/view.d.ts","default":"./lib/view.js"},"./runtime":{"types":"./lib/runtime.d.ts","default":"./lib/runtime.js"},"./package.json":"./package.json","./review-policy":{"types":"./lib/review-policy.d.ts","default":"./lib/review-policy.js"},"./cordis.patch.yml":"./cordis.patch.yml"},"license":"MIT","version":"0.1.2","_npmUser":{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"},"homepage":"https://github.com/delta-box/dsh-deltabox#readme","_resolved":"/home/runner/work/dsh-deltabox/dsh-deltabox/dist/dsh-deltabox-0.1.2.tgz","_integrity":"sha512-SsBISEHE1A1ESzKajJhuinAa0exVhFINMe6r8EcJfP1E+WDI0vkIcrCbwWsnQ2NgIIC+K86iGpz/mhQ7RFHGtw==","repository":{"url":"git+https://github.com/delta-box/dsh-deltabox.git","type":"git"},"_npmVersion":"11.19.0","description":"Agent-owned Deltabox filesystem, Bash, and turn-review providers for DeepSeek Harness","directories":{},"maintainers":[{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"}],"_nodeVersion":"24.21.0","dependencies":{"deltabox-lite":"0.1.1","@deepseek-ai/schemastery":"^3.18.4"},"_hasShrinkwrap":false,"peerDependencies":{"@deepseek-ai/cordis":"^4.0.4","@deepseek-ai/dsh-fs":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-agent":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-shell":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-sandbox":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-session":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-home-paths":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-system-prompt":"0.2.0-rc.2 || 0.2.1-alpha.2","@deepseek-ai/dsh-user-approval":"0.2.0-rc.2 || 0.2.1-alpha.2"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/dsh-deltabox_0.1.2_1791967155586_0.7831521068933569"}}},"time":{"created":"2026-10-14T03:32:43.282Z","modified":"2026-10-14T08:39:18.002Z","0.0.0-stage":"2026-10-14T03:32:43.282Z","0.1.0":"2026-10-14T03:33:39.766Z","0.1.1":"2026-10-14T03:49:44.773Z","0.1.2":"2026-10-14T08:39:15.712Z"},"bugs":{"url":"https://github.com/delta-box/dsh-deltabox/issues"},"license":"MIT","homepage":"https://github.com/delta-box/dsh-deltabox#readme","repository":{"url":"git+https://github.com/delta-box/dsh-deltabox.git","type":"git"},"description":"Agent-owned Deltabox filesystem, Bash, and turn-review providers for DeepSeek Harness","maintainers":[{"name":"xeonliu","email":"5bxtqrabi@mozmail.com"}],"readme":"# dsh-deltabox\n\n`dsh-deltabox` supplies Agent-owned Deltabox sessions, foreground Bash and filesystem providers, and a turn-stopping review policy for DeepSeek Harness Web and Desktop (`0.2.0-rc.2` and `0.2.1-alpha.2`). It contains no browser code or `dsh.client` entry. Harness still owns Host, API, Mux, session, Agent, Shell, FS, permission, and approval services; this bundle fixes the execution providers to Deltabox.\n\n## Install\n\n### npm package (Web)\n\nAfter the first npm release, install the package into the Harness Web profile\nwith the `dsh` plugin CLI:\n\n```sh\ndsh plugin --profile web add dsh-deltabox\n```\n\nThe CLI resolves `dsh-deltabox` from npm and installs its matching\n`deltabox-lite` runtime and platform package dependencies. See\n[RELEASING.md](https://github.com/delta-box/dsh-deltabox/blob/main/RELEASING.md)\nfor this repository's independent plugin release workflow.\n\n\nInstall a pinned commit into a Harness profile:\n\n```sh\ndsh plugin --profile web add github:delta-box/dsh-deltabox#<commit>\n```\n\nA local checkout installs from its path instead: `dsh plugin --profile web add /path/to/dsh-deltabox`. Git dependencies run this package's `prepare` script. The default native transport also requires the matching `deltabox-lite` npm package, which supplies both the Node-API addon and the companion `deltabox` helper. CB-CoW uses FUSE on Linux (`/dev/fuse` plus `fusermount3` or `fusermount`) and APFS/FSEvents on macOS; Linux Git mode instead requires Git and Bubblewrap. Set `transport: stdio` only for compatibility with an installation that has the executable but no native addon.\n\n### Desktop (app mode)\n\nOpen Desktop, go to **Plugins → Add plugin**, enter `dsh-deltabox`, and install it.\n\n## Environment\n\n| Variable | Role | Meaning |\n|---|---|---|\n| `DELTABOX_BINARY` | user | Optional helper executable override. Native mode otherwise resolves the matching helper from `deltabox-lite`; stdio mode uses the value directly. |\n| `DEEPSEEK_API_KEY` | user | Harness model credential required to run agents; the repo root `.env` is also read. |\n| `DEEPSEEK_BASE_URL` | user | Optional non-default model endpoint. |\n| `DSH_HOME` | user | Harness home, default `~/.dsh`; the default `stateRoot` is `<DSH_HOME>/deltabox/v1`. |\n| `DELTABOX_STATE_DIR` | stdio runtime | State root for the compatibility `deltabox serve` child. |\n| `DELTABOX_RUNTIME_DIR` | stdio runtime | Ephemeral root for the compatibility `deltabox serve` child. |\n\nNative options are frozen once and the Rust coordinator is shared through an immutable `Arc`, so hot operations do not take a configuration lock. `deltabox` isolation uses the platform worker, `bubblewrap` scrubs the environment and denies network, and `none` inherits the complete DSH process environment. Native state and runtime roots are passed directly to the addon; the two environment variables above apply only to stdio compatibility mode.\n\n```sh\ncd /path/to/deepseek-harness\nexport DELTABOX_BINARY=/path/to/deltabox\nexport DEEPSEEK_API_KEY=...\ndsh plugin --profile web add github:delta-box/dsh-deltabox#<commit>\ndsh --profile web \"your task\"\n```\n\n## Composition\n\nThe bundle patch follows `dsh-base` and `dsh-web-app`. It disables Agent presets, local subprocess and sandbox runners, PowerShell, the background-job registry and tools, and filesystem-search tools, and the local Bash/FS providers. Disabled rows mount no effects; a later profile or home patch can explicitly replace a row and enable it. The bundle leaves Harness approval, the sandbox-policy home, the permission-preset selector, Host, API, Mux, session, Agent, Shell, FS, the Web approval panel, and other unrelated Web UI rows available.\n\n`sandbox-policy` stays enabled while every enforcing runner (`sandbox`, `bash-sandbox`, `pwsh-sandbox`, `fs-sandbox`) stays disabled. Deltabox owns confinement, so mounting a second runner would stack two isolators; the policy home is only the vocabulary. `tool-bash` reads `ctx.shell.sandboxMode` from the Deltabox executor, advertises `sandbox_permissions` from it, and routes an approved escalation through `ctx.sandboxPolicy` and `ctx.approval` before the command reaches Deltabox.\n\n| Entry | Role |\n|---|---|\n| `deltabox-runtime` | Owns lightweight Agent handles and hands off one warm native project session after idle or disposal. |\n| `deltabox-bash` | Implements foreground `ctx.shell` calls through `session.exec`. |\n| `deltabox-fs` | Implements `ctx.fs`; isolated native modes use zero-Base64 `Buffer` I/O and `none` may use the controlled mount directly. |\n| `deltabox-review-policy` | Checks active reviews at `agent/turn-stopping` and uses Harness approval to commit or abort them. |\n| `deltabox-view` | Contributes the project-view path guidance the model reads before it picks a path. |\n\n`tool-bash` is configured with `enableRunInBackground: false`, and the `jobs` registry is disabled so the current Bash tool uses its foreground path. The preset registry and each shipped preset declaration are disabled. The retired Harness invariant registry and companion entry are no longer installed; the runtime registers Agent handles through the awaited `agent/created` event. No `dsh.client` or extra transport row is installed.\n\n## Runtime\n\n`ctx.deltabox.sessionFor(agent)` returns one handle for the exact Agent instance. `agent.session.header.cwd` selects the project root; a missing cwd uses `projectRoot`. Agent creation registers only a lightweight handle. The first filesystem or Bash operation constructs the native coordinator with one validated storage/isolation pair. Defaults are `cbcow-through+deltabox` with fast durability; `git+bubblewrap` is the zero-FUSE alternative and `cbcow-through+none` is the explicit unsandboxed path. An Agent becoming `idle` is not disposed: after `agent.whenIdle()` confirms that no follow-up slipped in, its queue drains and any open review aborts before the live project session is parked. The next Agent for the same project receives a fresh handle and identity backed by those warm resources, eliminating another native coordinator and `session.start`; stale handles and filesystem targets remain invalid.\n\nThe handle serializes Deltabox operations. Blocking Rust work runs on the addon's Tokio blocking runtime instead of Node's libuv worker pool. The embedded coordinator retains its route, policy, journal, filesystem state, and active review in memory for the session lifetime. Reads start a session without opening a review. Mutations call `review.begin` before a write or command. `review.commit` and `review.abort` increment the target generation, so targets obtained before either operation fail with `FS_STALE_VERSION`. Idle or disposed Agents may park reusable sessions; runtime unload stops active, parking, and warm sessions after admitted work settles. Handoff is guaranteed only inside one DSH/Web process; another process cannot reattach and reports the project as busy. Filesystem targets from before a handoff must always be resolved again.\n\nEach session still receives the standing file/review policy for provider operations; a Bash command may additionally request a wider per-command profile (see below). `deltabox` isolation applies the platform policy worker. Bubblewrap commands receive a scrubbed environment, deny network, and can access the whole project bind mount; policy deny paths still apply to native byte reads/writes but are not translated into Bubblewrap submounts. Select `none` only when inherited credentials, ambient variables, and unrestricted network are intentional.\n\n### Runtime configuration\n\n| Field | Default | Meaning |\n|---|---:|---|\n| `transport` | `native` | `native` embeds the coordinator; `stdio` starts `deltabox serve`. |\n| `binary` | `deltabox` | Helper override; native mode resolves the packaged helper when this stays at its default. |\n| `projectRoot` | `process.cwd()` | Fallback project root for Agents without a session cwd. |\n| `stateRoot` | `<DSH_HOME>/deltabox/v1` | Private state and per-session directory root. |\n| `stopGraceMs` | `2000` | Grace before TERM and again before KILL during teardown. |\n| `fsMode` | `cbcow-through` | `cbcow-through` or the Linux-only zero-FUSE `git` engine. |\n| `isolation` | from `fsMode` | `deltabox` for CB-CoW, `bubblewrap` for Git, or explicit `none` with native CB-CoW. |\n| `durability` | `fast` | `fast` avoids strict persistence barriers; `strict` retains them. |\n| `projectSessionReuse` | native mode | Keep one idle or disposed session warm per project for the next Agent; set `false` to retain eager teardown on disposal and disable idle parking. |\n\n## Providers\n\nThe Bash provider runs `bash -c` in the initiating Agent's Deltabox session. `none` mode keeps one Bash worker alive and executes every command in an isolated subshell; the isolated modes use their respective command providers. It rejects stdin and background execution. The current Shell `execute()` interface returns a settled handle after the batch RPC completes, with result and output readers; it does not provide live streaming or mid-command cancellation. The command deadline is fixed at 600 seconds; each captured stream is bounded at 8 MiB.\n\nThe bundle also contributes one runtime-context line (`deltabox:view`, order 115) so the model addresses paths the way the providers do. It names the view the Agent's commands start in, states that the host project directory is deliberately unreachable from those commands and is not escalatable, gives the path form each tool family takes (relative or view paths for shell commands; the project path, the view path, or a relative path for the file tools, all naming the same reviewed copy), and states that a path outside the project is read from the host directly but written only under `danger-full-access` and never rolled back. The mount point is quoted once the Agent has opened a session, because the core assigns it at `session.start`.\n\n### Per-command filesystem profiles\n\n`sandboxMode` reports `workspace-write`, so the Harness Bash tool advertises `sandbox_permissions` and runs the pre-execution approval. The approved mode is translated into a Deltabox execution profile for that one command:\n\n| Harness mode | Deltabox profile | Effect |\n|---|---|---|\n| `workspace-write` (standing) | `workspace-write` | Writes stay inside the session workspace |\n| `danger-full-access` (approved) | `read-write` | Writes also reach the rest of the host filesystem |\n\nThe same mode is selectable without a per-command denial, through the Harness permission-preset surfaces (`permission` + `ui-permission`): the composer permission chip and the General-settings default each write the session's `sandbox/mode` knob, so a session parked on `danger-full-access` runs every command under `read-write`. Both presets keep `approval: ask`; the stock `danger-full-access` bundle pins `never`, and `never` auto-rejects every ask, which would silently roll back the turn-stopping Deltabox review instead of prompting.\n\nEscalation is a one-shot retry: after a denial the model may repeat the exact command with `sandbox_permissions: \"danger-full-access\"` and a `justification`, and Harness asks the user before anything runs. A rejection is final for that command and no Deltabox session is touched.\n\nThe profile widens access, not the deny set. The workspace still routes through Deltabox, so its changes remain visible to diff, checkpoint, commit, and abort, while engine state and helper endpoints stay denied. Linux FUSE and private-workspace modes also deny direct backing-project access; macOS through mode tracks writes directly in the real project. Host writes outside the workspace are outside DeltaFS and cannot be rolled back. Linux FUSE and private-workspace modes require their working view outside the denied backing project for `read-write`. macOS `cbcow-through` supports `read-write` in the real project while protecting its rollback baseline, metadata, tokens, and helper endpoints.\n\nThe two approvals are complementary: the sandbox escalation decides whether a command may acquire wider access *before* it runs, and the review policy decides *after* the turn whether the workspace changes it produced are kept.\n\n### Filesystem writes and the execution level\n\n`ctx.fs.sandboxMode` reports `workspace-write` too, so `tool-fs` (and `tool-str-replace-editor`) advertise `sandbox_permissions` for `write` and `edit` and resolve the same per-call policy, approved one-shot escalation included. The provider then fences the mutation against the target's path space:\n\n| Target | `workspace-write` (standing) | `danger-full-access` (approved or session preset) |\n|---|---|---|\n| Project file, named by the project path, the mount path, or a relative path | Allowed; the write stays on the DeltaFS view, so it is versioned, reviewed, and rollback-able | Same |\n| A path outside the project | Denied with `FS_SANDBOX_DENIED`, which `tool-fs` renders as the shared `[sandbox: …]` marker plus the escalation hint | Written straight to the host filesystem |\n\nResolution never refuses an outside path: it maps to the host path space and the fence decides at mutation time, so a refusal carries the model-facing escalation marker instead of failing during `resolve` (which the tool layer cannot map). Both accepted forms of a project file canonicalize to the same view target, so a model that names the absolute project path still gets the reviewed copy rather than an unreviewed host write. `read` is unfenced at every level, matching the Harness convention that the sandbox governs writes.\n\nHost writes are deliberately outside DeltaFS: they land on the host immediately, never enter a review, and cannot be rolled back, so a turn whose only changes are host writes auto-commits with no review card. Nothing outside the project is exempt from this: `danger-full-access` reaches the engine's own state and the backing project tree as well, which is the price of the level being a true full access.\n\n`read-only` is deliberately not a Deltabox profile. Deltabox's unit of work is a writable, rollback-able workspace, so a session narrowed to `read-only` still runs `workspace-write`; a deployment that needs read-only command execution should keep a Harness sandbox runner mounted for that session instead.\n\nThe filesystem provider keeps display paths under the logical project root for view targets and uses the host path for host targets. Targets encode Agent/session identity, generation, path space, display path, and process path. `resolve`, `stat`, `lstat`, and `listDir` use canonical local metadata; Git mode uses the project root because it has no mount. Isolated native reads and writes use Node `Buffer` without Base64 or an extra JS-to-Rust copy. `none` uses the validated mount directly and registers exact changed paths; stdio retains the Base64 protocol.\n\nThe profile does not provide `glob`, `grep`, terminal, Code Runtime, or background jobs. It also does not add cumulative diff UI or another transport.\n\n## Review policy\n\nAt `agent/turn-stopping`, Agents without a started session or without an active review are ignored. An active review calls `review.diff` and reads `pending_changes` and the change-file summary. Empty reviews commit silently. A non-empty review asks:\n\n```text\nDeltabox 检测到尚未处置的文件改动（5 个文件）：src/index.ts（修改 +2 -1）、README.md（新增 +18）、docs/old.md（删除 -12）、assets/logo.png（修改，二进制）、empty.txt（新增）。Allow once 保留自本次 review 开始以来的全部改动；Reject 撤回这些改动。\n```\n\nThe request uses `toolName: 'deltabox-review'` and the existing `ctx.approval.request()` service. `allowed-once` commits and `rejected` aborts. `cancelled` and `unavailable` leave the review active for a later turn or session disposal. Approval and Deltabox errors propagate through the existing turn-stopping error path; the policy does not guess after an ambiguous commit or abort. 完整 diff 文本留在 Node 插件内；仅每文件摘要（路径、类型、行数）进入 approval reason，由 Web 审批面板展示并记录在 session log。\n\n## Model Experience\n\nThe model sees the existing Bash and filesystem tool schemas and their normal foreground results, plus one runtime-context line naming the view the Agent's commands start in. 完整 diff 文本、RPC 字段、审批传输细节不进入模型视野；approval reason 只携带改动文件摘要。\n\n#### KV Cache effect\n\nNone directly. The Harness tool packages own their schemas and prompt sections; review runs after the turn's tool work has settled.\n\n## Known Limitations and Deferred Work\n\n- **Foreground execution only** - No background jobs, PTY, stdin channel, persistent terminal, incremental output, or per-command cancellation RPC is exposed.\n- **Fixed command deadline** - Deltabox does not accept a shorter tool timeout, so the provider uses its fixed 600-second deadline.\n- **Whole-file reads** - `streamText` yields one complete bounded native read; there is no streaming file API yet.\n- **Platform provider required** - CB-CoW needs FUSE on Linux or APFS/FSEvents on macOS; Git mode needs Linux, Git, and Bubblewrap.\n- **Explicit `none` is unsandboxed** - It shares credentials, network, and process environment with executed commands.\n- **Git ignores ignored files** - `.gitignore` matches are outside GitGhost diff and rollback coverage.\n- **Bubblewrap policy gap** - Command isolation covers the whole project bind mount; deny paths are enforced only by native byte operations in v1.\n- **No search provider** - `glob` and `grep` are unavailable until a Deltabox search provider is added.\n\n## Development\n\nThe development dependencies use Harness `0.2.1-alpha.2`. The `overrides` in\n`pnpm-workspace.yaml` pin transitive Harness and Cordis packages as well as\nauto-installed peers; npm's top-level `package.json.overrides` does not apply to\nthis pnpm workspace. Update the workspace pins and lockfile together. The plugin\nuses host peers when installed, rather than bundling a second Harness runtime.\n\nByte-range reads preserve target generations and the coordinator's deny policy.\nHost and `none` reads use bounded file windows. Isolated native and stdio reads\nuse the existing coordinator read API, then slice the result: its 16 MiB whole-file\nlimit still applies, even when the requested window is smaller. Large-file range\nstreaming requires a future Deltabox protocol extension.\n\n```sh\npnpm install\npnpm run typecheck\npnpm test\npnpm run build\npnpm run bench:native -- --binary /path/to/deltabox --warmups 5 --runs 30\npnpm run bench:native:commit -- --binary /path/to/deltabox --warmups 5 --runs 30\npnpm run bench:batch -- --binary /path/to/deltabox --files 100 --bytes 1024 --warmups 1 --runs 5\npnpm run pack:release\n```\n\nAfter building the matching addon and helper, verify the providers and Harness\napproval service under Desktop's actual Electron runtime (temporary projects only):\n\n```sh\npnpm run prepare\nELECTRON_RUN_AS_NODE=1 \"/Applications/DeepSeek Harness.app/Contents/MacOS/DeepSeek Harness\" \\\n  tests/desktop/native-smoke.mjs /path/to/deltabox /path/to/deltabox.node\n```\n\nThe smoke test exercises both `deltabox` and `none` isolation: native module and\nhelper resolution, filesystem reads/writes, byte windows, Bash, approval commit,\napproval rollback, stale targets, and native deny-policy preservation. macOS\nrequires FSEvents access, so a restricted test runner may need to execute it\noutside its own sandbox. Use a matching rebuilt helper and addon: fast `none`\nexecution needs the post-command FSEvents marker barrier to include newly created\nfiles in an immediate rollback.\n\n`bench:native` defaults to the abort lifecycle. `bench:native:commit` measures\nthe same native phases while repeatedly committing updates to one fixed 1 KiB\nfile, so the project size remains constant across warm-ups and measured runs.\n\n`prepare` uses `tsdown.prepare.config.ts` directly and does not depend on a DeepSeek Harness TypeScript project reference.\n\n### Desktop tool activation check\n\nRun `pnpm run test:desktop` to boot the composed execution-plane rows and verify that the model-facing `bash`, `read`, `write`, and `edit` tools register. No model or credentials are required. The tool rows explicitly inject `sandboxPolicy` and `approval`: without this dependency, Desktop can activate confined tools before the policy service is ready, leaving them absent from the model catalog even though the plugin is enabled.\n","readmeFilename":"README.md"}