Sandbox, FS, shell, and one execution world
Real isolation is not a tool-layer warning; providers share an enforceable execution boundary
ctx.fs + ctx.subprocess + ctx.shell + ctx.sandboxWhy does replacing the subprocess provider move Bash, PTY, LSP, and external subagents together?
Do not hand every worker a 'stay inside' booklet. Put the whole crew on one fenced site with shared access control and the same material store.
Mechanism
ctx.fs abstracts file access and ctx.subprocess abstracts process creation; shell, terminals, and LSP consume them. E2B providers can point FS and subprocess to the same remote Linux world.
sandbox-policy owns one mode and workspace-root set. bash-sandbox, fs-sandbox, and terminal all read the same policy so capabilities cannot disagree on boundaries.
Fold session policy
Default mode plus event overrides produces current sandbox/mode.
What extensions must preserve
- FS and processes share one workspace-root policy
- Sandbox reporting must not misclassify partial enforcement as child failure
- Path policy accounts for symlinks and TOCTOU
The tempting wrong turns
- ×Using only string blacklists inside tool-bash
- ×Using cwd as workspace-root validation
- ×Pointing local FS and remote subprocess at different worlds
Do not trust the conclusion—verify it
These anchors are pinned to official deepseek-harness@47f9438; account for later breaking changes when reading current upstream.
Pause for ten seconds before revealing
Why can tool allow/deny not replace an OS sandbox?
Even safe execution can overwhelm model context with long sessions and tool output. Next: compaction, token metering, and spill.