dsh-sandbox-mxc: An MXC Process Confinement Sandbox Provider for DeepSeek Harness
bitsmug/dsh-sandbox-mxc
A DeepSeek Harness sandbox provider backed by MXC that confines spawned processes in Windows containers with policy-based read/write and network limits.
dsh-sandbox-mxc is a sandbox provider for DeepSeek Harness that uses MXC (Microsoft eXecution Containers) to build a controlled boundary around commands about to launch on Windows. It implements the harness's process-confinement seam, handing the caller's argv to wxc-exec as-is, while read and write roots reuse the policy semantics exported by the sandbox service instead of being re-implemented. The plugin only locates the executable and never loads the SDK's native bindings, so it runs on the Node bundled with the harness, drops paths missing on the machine, and degrades gracefully on the DACL tier.
How to Install
dsh plugin --profile web add github:bitsmug/dsh-sandbox-mxc- Category
- Development & Operations
- Platform
- DSH Plugin
- Author
- bitsmug
- Distribution
- Plugin
dsh-sandbox-mxc Key Features
dsh-sandbox-mxc Repo Summary
What Does It Do?
bitsmug/dsh-sandbox-mxc is a DSH plugin for DeepSeek Harness that provides process confinement through MXC (Microsoft eXecution Containers). It implements the harness's sandbox seam (ctx.sandbox) by wrapping the exact argv the caller is about to spawn in wxc-exec, giving Windows hosts a controlled read, write, and network boundary. Because it never loads the MXC SDK's native bindings and only locates the wxc-exec executable, the SDK's native stdio Node version restriction does not apply and it runs on the Node bundled with the harness.
Core Features
- Process confinement: hands the pending argv to wxc-exec so commands run inside MXC's Windows backends (ProcessContainer / AppContainer).
- Shared policy semantics: read and write roots come from the sandbox service's writableRoots and canonicalPath exports, so read-only and workspace-write keep a single meaning instead of being re-implemented.
- Path existence filtering: every path list is checked before the policy is built, and paths missing on the machine are dropped so MXC does not reject the whole policy.
- DACL fallback handling: on the appcontainer-dacl tier, a path the account cannot write a DACL for is dropped with a printed reason and a cached verdict, rather than failing the command.
- Configurable wxc-exec resolution: the executable is located from the installed MXC SDK, then the wxcExecPath config value, then an environment variable.
How to Use This Plugin?
Once enabled in DSH, it acts as a sibling provider to the local sandbox provider and is selected through the harness's normal bundle-patch layer, after which every command launched through the sandbox seam runs in an MXC container. It requires Windows and a harness that mounts the sandbox service. If the pwsh tool points at a Store/MSIX build, point the executor's pwshPath at an unpackaged PowerShell (for example the official ZIP extracted to a stable directory) and list that shell's own install directory in readonlyPaths, otherwise the container fails to resolve the current executable path. Workspace writes are allowed, writes and reads outside the policy are denied, and outbound network is blocked by default; the base-container tier needs Windows 11, while Windows 10 can only use the DACL tier.
How to Troubleshoot This Plugin?
- The target executable appears to be a packaged (MSIX) app: MXC containers cannot launch packaged apps, so switch to an unpackaged PowerShell as described in the official notes and add its install directory to the read-only path list.
- Failed to resolve full path of the current executable: the shell's install directory is not readable inside the container; add it to readonlyPaths and retry.
- DACL fallback requires write-DACL permission: this is a permission limit of the appcontainer-dacl tier; the plugin drops that path and prints why, so check whether the volume belongs to another SID or move to the base-container tier, which needs no DACL work.
- The whole policy is rejected: this usually means a path that does not exist on the machine was included; the plugin already filters for existence, so review paths added by hand in the configuration.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: bitsmug/dsh-sandbox-mxc. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.
DSH Plugin FAQ
