Sandbox & Safety Rails

🛡️ Sandbox & Safety Rails

Pentest work means running commands whose blast radius matters. The harness ships a layered containment model — deny by default, escalate with a named approval.

The three modes

Mode	Reads	Writes	Use it for
read-only	✅ anywhere	❌ nothing (even /dev/null is refused)	Recon against live targets from a clean seat
workspace-write	✅ anywhere	✅ the workspace root + a backend temp area	Engagements scoped to one project directory
danger-full-access	✅	✅ everywhere	Lab VMs, throwaway machines, your call

Network access policy rides on the same policy object, so a read-only recon session can be allowed HTTP while its filesystem stays frozen.

How confinement reaches the process

• Local executors spawn every command inside the confinement wrapper for the active mode (workspace-write writes are audited per-file).
• Windows confines through the Windows ACL backend (sandbox-windows-acl) — deny-ACL entries on the workspace tree, not an emulation layer.
• Linux/macOS use the platform-native backend (Landlock-style rules where the kernel supports it).
• A denial reads as [sandbox: file access denied under <mode> mode] in tool output — a policy answer, not a stack trace to debug.

Escalation, not surgery

When a task legitimately needs to leave the box, the agent asks:

1. The tool call names an escalation target (ESCALATION_TARGETS are validated arguments — no free-form paths).
2. The user-approval surface renders the request and waits for a human yes/no.
3. On approval the confined spawn is replaced by the unconfined one for that call; the sandbox layer records the admission.

Nothing auto-escalates. There is no "sudo" inside a session without a human in the loop.

Approval & permissions

• Every mutating tool call passes the pre-execute policy before reaching an executor.
• Permission presets bundle the common postures (read-only recon, scoped pentest, full-access lab) so a profile sets one line instead of per-tool switches.
• The Web UI shows an approval card for anything the active policy requires a human on.

Secrets hygiene

• API keys live in $DSH_HOME/.credentials.yaml with owner-only file permissions.
• Settings files hold only credential references — never the literal secret.
• The subprocess layer scrubs credential-shaped values out of any environment it passes to a child process.
• A leaked-looking value in a log or transcript is a bug; the harness treats references as the only valid long-lived form.

---

Checklist for a clean engagement seat: start the session in read-only or workspace-write, mount only the tools the engagement needs, and keep approvals on. Full-access is for the lab machine, not the research seat.