dsh-sandbox-audit: static sandbox-policy consistency audit (links #2066 / #951 / #149)

[zoahdev]

中文

dsh-sandbox-audit —— DeepSeek Harness 沙箱策略一致性静态审计。

把散落在三个讨论里的沙箱不一致问题，做成一个能直接跑、能接 CI 门禁的工具。

它审计什么

读 cordis.patch.yml / agent.cordis.yml，逐工具检查「接线」与「它声称执行的策略」是否一致：

• HIGH：会写文件的工具（str_replace_editor / tool-fs）挂在裸 fs-local 后端上，而裸后端静默忽略策略 → 关联 #2066。
• MEDIUM：搜索工具（glob / grep）不挂 fs，读范围不受写策略约束 → 关联 #951。
• MEDIUM：shell 无操作级破坏门禁，rm -rf <workspace> 与删 build 目录无法区分 → 关联 #149。

为什么有用

同一个 preset 形状，在 dsh-fs-sandbox 下安全，在裸 fs-local 下不安全。这个工具把差别显式化，并溯源到源码模型。对 minimal 预设它报 1 个 HIGH，对 base bundle 报 0 个 HIGH——正好说明差异在哪。

仓库：https://github.com/zoahdev/dsh-sandbox-audit

---

English

dsh-sandbox-audit — static sandbox-policy consistency audit for DeepSeek Harness.

A runnable tool that turns three scattered sandbox-inconsistency discussions into a CI-gateable check.

• HIGH: a mutating fs tool (str_replace_editor / tool-fs) over a bare fs-local backend that silently ignores the policy → #2066.
• MEDIUM: search tools (glob / grep) mount no fs, reads unconstrained by the write policy → #951.
• MEDIUM: shell without an operation-level destructive gate → #149.

The same preset shape is safe under dsh-fs-sandbox and unsafe under bare fs-local; this tool makes that divergence visible and traceable to a source line and a discussion.

Repo: https://github.com/zoahdev/dsh-sandbox-audit