mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-08-29 04:26:38 +00:00
kingwl
ca39fd89b0
The three-entry cordis.yml (dsh-sandbox-local + dsh-bash-sandbox at a read-only default + dsh-approval) served over ACP: the first live approval composition. Recorded snapshot scenarios pin the wire end to end — config-options advertisement, the mode-switching arc as the suite pinned header (both switches, the prompt-section delta, one changed-by-the-user notice per knob, a confined write landing under the switched mode), and both escalation branches over scripted permissionAnswers (a grant runs confined under workspace-write; a rejection executes nothing and pins the fail-closed text). The with-key escalation e2e drives a real model + real runner + the real bridge answerer, world-verified; ci.yml snapshot lane and e2e.yml install bubblewrap so the confined replays actually execute. Both RFCs move to implemented/ (Decision/Consequences form, deferred phases tracked in their own sections), with every cross-reference flipped.
1.4 KiB
1.4 KiB
approval/ — approval family
The asking half of permission handling: one seam through which the harness puts a one-shot question — "may this specific action proceed?" — to whatever answerers a deployment composes, with a closed outcome vocabulary and a fail-closed default. The full design: the approval-seam RFC. All product packages.
| Package | Role | ctx key |
|---|---|---|
approval/ |
The ApprovalService mechanism (waterfall dispatch, cancellation, audit events) + the vocabulary (ApprovalRequest, ApprovalOutcome, ApprovalRequestId) + the per-session policy tier (ApprovalPolicy 'ask'/'never', the 'approval/policy' event fold, the prepend gate — sandbox RFC § Per-session mode switching) |
ctx.approval |
Answerers live with their owners, not here: the ACP bridge (ui/acp) answers for the editor sessions it owns (and switches each session's policy over ACP config options); tests answer with inline scripted listeners. Consumers today: core/tools routes tools/pre-execute's ask through the seam (degrading to deny when it is not mounted), and the bash tool's sandbox escalation gate (bash/tool-bash, sandbox RFC § Escalation).