v0.2.2

dsh-ptc-moejs 0.2.2 fixes run_code on dsh Desktop for Windows. In the read-only and workspace-write file modes, every run failed with invalid frame from the moejs sidecar: a frame came before the boot-ack.

• On Windows, dsh's sandbox runner is a script that dsh starts with its own executable, which in dsh Desktop is Electron. Electron runs that script as Node only while ELECTRON_RUN_AS_NODE is set, and since 0.1.3 the sidecar's environment had dropped that variable. The sidecar now keeps ELECTRON_RUN_AS_NODE too, as dsh's Node runtime does. It still drops the rest of dsh's environment, API keys included.
• danger-full-access, Linux and macOS were not affected.
• The sidecar binary is unchanged, and the platform packages stay at 0.2.1.

Thanks to @TomXPRIME, who reported this in #1 and fixed it in #2.

Upgrade with dsh plugin --profile <name> add dsh-ptc-moejs@latest. A new install is described in the README.

---

dsh-ptc-moejs 0.2.2 修复了 Windows 上 dsh 桌面版的 run_code。此前在 read-only 和 workspace-write 文件模式下，每次运行都以 invalid frame from the moejs sidecar: a frame came before the boot-ack 失败。

• 在 Windows 上，dsh 的沙箱 runner 是一个脚本，dsh 用自己的可执行文件启动它，桌面版里这个可执行文件是 Electron。只有设置了 ELECTRON_RUN_AS_NODE，Electron 才会以 Node 模式运行这个脚本，而从 0.1.3 起，sidecar 的环境里去掉了这个变量。现在 sidecar 也保留 ELECTRON_RUN_AS_NODE，和 dsh 的 Node 运行时一样。dsh 的其他环境变量仍然会去掉，API key 也不会进到 sidecar 里。
• danger-full-access、Linux 和 macOS 不受影响。
• sidecar 程序没有变，平台包仍是 0.2.1。

感谢 @TomXPRIME 在 #1 里报告了这个问题，并在 #2 里修复了它。

升级：dsh plugin --profile <name> add dsh-ptc-moejs@latest。新安装见 README。

v0.2.1

dsh-ptc-moejs now gives programs timers, imports and the console output of dsh's Node runtime, and it runs dsh's workflow tool.

• setTimeout, setInterval, setImmediate and their clear functions work as in Node, and node:timers/promises gives their promise forms. Timer callbacks count toward the run's memory budget and deadline, and timers still pending when the program returns never run. maxPendingTimers (default 65536) bounds how many a run keeps pending.
• await import("./helper.ts") loads the .ts, .mts, .js and .mjs files of the working directory, by a relative path, an absolute path or a file: URL. The sidecar reads them under the run's sandbox, no path or symbolic link leads out of the working directory, and a file compiles once for each content it has. Files load when dsh's execution world is this host.
• node:path, node:util, node:timers, node:timers/promises and node:vm are built in, and data: URLs of JavaScript import too.
• dsh's workflow tool runs on this runtime. Its guest, driving seven agents that answer at once, takes about 3.4 ms here and about 125 ms on the Node runtime.
• console and util.inspect render values with a port of Node 22's util.inspect, with the options dsh's Node runtime gives console: arrays grouped in columns, Promise { <pending> }, <ref *1> and the rest. util.inspect takes Node's options, and util.format is Node's.
• A promise that rejects with no handler now fails the run with Uncaught (in promise), as an unhandled rejection ends the Node runtime's process. A tool call that a program never awaits fails the run that way when the tool fails.
• The message of a failed run gives the program's own columns on its first line, and an uncaught binding error names its binding, as in ToolCallError (tools.write).
• A program with three tool calls still takes about 0.4 ms, and a first run about 16 ms under bubblewrap and about 6 ms without it.
• The sidecar speaks a new protocol, so the platform packages move to 0.2.1 with this version. 0.2.0 is not on npm: its platform packages went out without the sidecar binary and were withdrawn, and 0.2.1 releases the same code.

Install it with dsh plugin --profile <name> add dsh-ptc-moejs, then select it with the profile patch in the README.

---

dsh-ptc-moejs 现在给程序提供定时器、模块导入，以及和 dsh 的 Node 运行时一样的 console 输出，dsh 的 workflow 工具也能在它上面运行。

• setTimeout、setInterval、setImmediate 和对应的 clear 函数和 Node 里的一样，node:timers/promises 提供它们的 promise 形式。定时器回调算进这次运行的内存预算和截止时间，程序返回时还没触发的定时器不会再执行。maxPendingTimers（默认 65536）限制一次运行同时挂着的定时器数。
• await import("./helper.ts") 加载工作目录下的 .ts、.mts、.js 和 .mjs 文件，可以用相对路径、绝对路径或 file: URL。文件由 sidecar 在这次运行的沙箱里读取，任何路径和符号链接都出不了工作目录，同一份内容只编译一次。dsh 的执行环境就是本机时才能加载文件。
• 内置了 node:path、node:util、node:timers、node:timers/promises 和 node:vm，JavaScript 的 data: URL 也能导入。
• dsh 的 workflow 工具可以在这个运行时上运行。它的 guest 驱动七个立即应答的 agent，在这里约 3.4 ms，在 Node 运行时上约 125 ms。
• console 和 util.inspect 用移植自 Node 22 的 util.inspect 渲染值，选项和 dsh 的 Node 运行时给 console 的一样：数组分栏、Promise { <pending> }、<ref *1> 等等。util.inspect 接受 Node 的选项，util.format 就是 Node 的实现。
• 被拒绝却没有处理的 promise 现在会让运行以 Uncaught (in promise) 失败，就像未处理的拒绝会结束 Node 运行时的进程一样。程序没有 await 的工具调用在工具失败时也会这样让运行失败。
• 运行失败的消息里，程序第一行的列号是程序自己的列号；未捕获的绑定错误会写明是哪个绑定，例如 ToolCallError (tools.write)。
• 调用三次工具的程序仍约 0.4 ms，第一次运行在 bubblewrap 下约 16 ms，不加沙箱约 6 ms。
• sidecar 换用了新的协议，所以平台包随这个版本升到 0.2.1。npm 上没有 0.2.0：它的平台包发布时漏了 sidecar 程序，已经撤下，0.2.1 发布的是同一份代码。

v0.1.3

dsh-ptc-moejs now gives its sidecar the confinement that dsh's Node runtime gives a program.

• The sidecar runs under the file sandbox of each Session's policy: bubblewrap or Landlock on Linux, Seatbelt on macOS and the restricted-token runner on Windows. Danger-full-access starts it directly. When no runner can enforce a restricted mode, the run fails with sandbox-unavailable, as on the Node runtime, so a container where neither bubblewrap nor Landlock works needs danger-full-access.
• Of dsh's environment the sidecar keeps only PATH, PATHEXT, SYSTEMROOT, WINDIR, TEMP and TMP, so API keys stay out of it.
• run_code takes sandbox_permissions and justification as on the Node runtime. A program reaches files only through tools, so to widen a tool call that the sandbox denied, put sandbox_permissions on that call.
• A change of a Session's file mode stops that Session's runs, and each result carries the facts of its sandbox.
• On Linux the sandboxed sidecar runs from its open binary, so it starts wherever the plugin is installed, /tmp included. ps lists it as /proc/self/fd/3.
• A first run takes about 16 ms under bubblewrap and 7 ms without it, and a program costs about as much as in 0.1.2.
• In a long agent conversation each program takes 125 ms less than on the Node runtime. The README works out what that comes to over a day.
• The plugin now needs dsh's fs, sandbox and sandbox-policy services, which dsh's profiles mount.
• The sidecar binary is unchanged, and the platform packages stay at 0.1.0.

Install it with dsh plugin --profile <name> add dsh-ptc-moejs, then select it with the profile patch in the README.

---

dsh-ptc-moejs 现在给 sidecar 的限制和 dsh 的 Node 运行时给程序的一样。

• sidecar 在每个会话文件策略的沙箱里运行：Linux 上是 bubblewrap 或 Landlock，macOS 上是 Seatbelt，Windows 上是受限令牌 runner。danger-full-access 下直接启动。没有 runner 能执行受限模式时，运行以 sandbox-unavailable 失败，和 Node 运行时一样，所以在 bubblewrap 和 Landlock 都用不了的容器里要用 danger-full-access。
• dsh 进程的环境变量里，sidecar 只保留 PATH、PATHEXT、SYSTEMROOT、WINDIR、TEMP 和 TMP，API key 不会进到 sidecar 里。
• run_code 和在 Node 运行时上一样接受 sandbox_permissions 和 justification。程序只通过工具访问文件，所以沙箱拒绝某次工具调用时，要在那次调用上带 sandbox_permissions。
• 会话的文件模式改变时，这个会话里的运行会被停止，每个结果都带有它所在沙箱的情况。
• 在 Linux 上，加了沙箱的 sidecar 从打开的二进制文件运行，所以无论插件装在哪里（包括 /tmp）都能启动。它在 ps 里显示为 /proc/self/fd/3。
• 第一次运行在 bubblewrap 下约 16 ms，不加沙箱约 7 ms，每段程序的开销和 0.1.2 差不多。
• 在一次长的 agent 对话里，每段程序比 Node 运行时少用 125 ms。README 里算了一天下来能省多少。
• 插件现在需要 dsh 的 fs、沙箱和沙箱策略服务，dsh 的 profile 都会挂载这些服务。
• sidecar 程序没有变，平台包仍是 0.1.0。

安装：dsh plugin --profile <name> add dsh-ptc-moejs，再按 README 里的补丁启用。

v0.1.2

dsh-ptc-moejs now runs on Windows x64.

• The Windows sidecar binary is on npm as dsh-ptc-moejs-windows-x64. npm's spam filter rejected the name dsh-ptc-moejs-win32-x64, so the plugin looks for the new name on Windows.
• CI runs the tests on Linux x64, Linux arm64, macOS arm64 and Windows x64 for every push. macOS x64 is untested.
• Apart from the Windows package name, the code is the same as in 0.1.1. The other platform packages stay at 0.1.0.

Install it with dsh plugin --profile <name> add dsh-ptc-moejs, then select it with the profile patch in the README.

---

dsh-ptc-moejs 现在可以在 Windows x64 上用了。

• Windows 的 sidecar 程序以 dsh-ptc-moejs-windows-x64 发布在 npm 上。npm 的垃圾过滤拦下了 dsh-ptc-moejs-win32-x64 这个名字，所以插件在 Windows 上找这个新名字。
• CI 每次推送都在 Linux x64、Linux arm64、macOS arm64 和 Windows x64 上跑测试，macOS x64 还没测过。
• 除了 Windows 包的名字，代码和 0.1.1 相同。其他平台包仍是 0.1.0。

安装：dsh plugin --profile <name> add dsh-ptc-moejs，再按 README 里的补丁启用。

v0.1.1

dsh-ptc-moejs is a PTC runtime for the DeepSeek Harness. It runs the model's programs in moejs, a JavaScript engine written in Go.

• A program with three tool calls runs in 0.18 ms. dsh's Node runtime takes 95 ms for the same program.
• Everything a program does to the machine is a tool call, which dsh runs with that tool's own policy, approvals and sandbox.
• A run stops at its deadline, even in an endless loop, and when it goes past its memory budget.
• The sidecar is a static Go binary, so the runtime also works in containers where bubblewrap cannot run.

Install it with dsh plugin --profile <name> add dsh-ptc-moejs, then select it with the profile patch in the README.

npm has the sidecar packages for darwin-arm64, darwin-x64, linux-arm64 and linux-x64. npm's spam filter stopped the win32-x64 package name, and that package will follow once npm clears it.

0.1.1 updates the README on npm. Its code is the same as in 0.1.0.

---

dsh-ptc-moejs 是 DeepSeek Harness 的 PTC 运行时，用 Go 写的 JavaScript 引擎 moejs 运行模型写的程序。

• 调用三次工具的程序用时 0.18 ms，dsh 的 Node 运行时跑同样的程序用时 95 ms。
• 程序对机器的每次操作都是一次工具调用，dsh 按该工具自己的策略、审批和沙箱执行。
• 运行到了截止时间就会停下，死循环里也一样，内存超过预算时也会停下。
• sidecar 是静态链接的 Go 程序，在无法运行 bubblewrap 的容器里也能用。

安装：dsh plugin --profile <name> add dsh-ptc-moejs，再按 README 里的补丁启用。

npm 上已经有 darwin-arm64、darwin-x64、linux-arm64 和 linux-x64 的 sidecar 包。win32-x64 的包名被 npm 的垃圾过滤拦下了，npm 放行后补发。

0.1.1 更新了 npm 上的 README，代码和 0.1.0 相同。