dsh-workflow-isolate: QuickJS/WASM-isolated workflows for DeepSeek Harness rc.7

[Linxiushen]

Independent community project / 非官方社区项目。 This project is independently developed and is not affiliated with or endorsed by DeepSeek. / 本项目由社区成员独立开发，与 DeepSeek 不存在隶属或官方背书关系。

I built dsh-workflow-isolate, an experimental WorkflowEngine provider for DeepSeek Harness 0.1.0-rc.7.

DeepSeek Harness's stock worker-thread engine uses node:vm to shape the model-facing workflow API, and its documentation explicitly notes that node:vm is not a security boundary. This project explores the same engine extension seam with a fresh QuickJS/WASM runtime for every workflow run.

我沿着 DeepSeek Harness 的 WorkflowEngine 扩展点实现了一个独立引擎：不改变模型看到的 workflow 工具，而是将模型生成的编排脚本放进每次运行新建的 QuickJS/WASM runtime 中。

What it provides / 主要能力

• Fresh Node worker, QuickJS runtime, and realm for each workflow / 每次 workflow 创建新的 Worker 与 QuickJS realm
• No intentionally exposed process, require, module loader, filesystem, network, or timers / Guest 不主动获得 Node 全局对象、模块加载、文件系统、网络或定时器
• Plain-JSON Host/Worker/Guest boundary and narrow child-agent RPC / Host、Worker、Guest 之间只传 plain JSON
• DSH-compatible agent, parallel, pipeline, phase, log, args, structured outputs, and lifecycle events
• Limits for QuickJS heap, stack, interrupt fuel, wall time, worker memory, source/result/request sizes, Agent concurrency and total calls, plus combinator fan-out
• Bounded cancellation and disposal, with forced worker termination after the configured grace period

The goal is to stop model-written orchestration JavaScript from automatically inheriting Node.js authority simply because the Harness host runs on Node.

Security scope / 安全边界

QuickJS/WASM is a stronger language-runtime boundary than node:vm, not a perfect or OS-level sandbox. The host-side subagent provider remains trusted and retains its configured model, tool, network, and credential access. Runtime vulnerabilities, dependencies, side channels, supply-chain risk, and host denial of service remain in scope.

The project has not received an independent security audit. High-risk or mutually hostile multi-tenant deployments should still add process/container isolation, OS quotas, and network policy. The repository includes a dedicated security model and threat model so these assumptions are explicit.

Compatibility and install / 兼容与安装

v0.1.0 deliberately targets the DSH 0.1.0-rc.7 workflow packages. QuickJS is not V8, so workflow bodies must use portable JavaScript and cannot rely on Node APIs, dynamic imports, ambient timers, or V8-specific behavior.

The package is not published to npm yet. Install the release tarball:

curl -L -o dsh-workflow-isolate-0.1.0.tgz \
  https://github.com/Linxiushen/dsh-workflow-isolate/releases/download/v0.1.0/dsh-workflow-isolate-0.1.0.tgz

dsh plugin --profile web add ./dsh-workflow-isolate-0.1.0.tgz
dsh --profile web --dump-config

• Source and bilingual docs: https://github.com/Linxiushen/dsh-workflow-isolate
• Release: https://github.com/Linxiushen/dsh-workflow-isolate/releases/tag/v0.1.0
• CI: https://github.com/Linxiushen/dsh-workflow-isolate/actions/runs/32051555052

The first release has 41 automated tests. Production-bundle and downloaded-release smoke tests pass, and CI is green on Ubuntu/Windows with Node.js 22.19 and 24. The repository also includes architecture and compatibility documents, a reproducible benchmark harness, examples, contribution guidance, and a security policy.

Feedback on real-world QuickJS compatibility, resource-policy defaults, cancellation behavior, and which upcoming DSH workflow API changes to track first would be especially useful.