dsh-sandbox-mxc: MXC-Based DeepSeek Harness Sandbox Provider

Introduction¶

DeepSeek Harness (DSH) relies on plugins to implement process isolation. On Windows, native sandboxes typically require kernel patches or strict container support. dsh-sandbox-mxc provides a Microsoft eXecution Containers (MXC)-based solution that wraps process arguments with wxc-exec.exe to achieve sandbox isolation without kernel patches.

What Is This¶

This is a DeepSeek Harness sandbox provider implementation, maintained by dsh-sandbox-mxc-dev and licensed under the MIT License.

It implements the Harness process isolation seam (ctx.sandbox, specifically the SandboxProvider in @deepseek-ai/dsh-sandbox) by wrapping the argv that a caller is about to launch into the following form:

wxc-exec.exe --config-base64 <policy-json> -- <original argv...>

The plugin has only one runtime dependency: @microsoft/mxc-sdk. The SDK is used only to locate the wxc-exec.exe executable and is not imported in code, so the plugin is not subject to the SDK’s strict Node.js version constraints (24.21.0 or 26.8.0) and can run on Node.js 22 or later.

Installation and Configuration¶

Installation¶

Use the official install command to add the plugin to a specified Profile:

dsh plugin --profile <profile> add dsh-sandbox-mxc

After installation, the plugin’s cordis.patch.yml becomes effective, disabling the default @deepseek-ai/dsh-sandbox-local provider and inserting this plugin as the sandbox service provider.

Prerequisites¶

Operating System: Windows only.
Node.js: version >= 22 is required.
Executable: wxc-exec.exe is required. Resolution precedence is config.wxcExecPath > environment variable DSH_MXC_WXC > path derived from the installed @microsoft/mxc-sdk.
PowerShell: the pwsh referenced in the Profile must be the unpackaged version. MXC containers cannot launch MSIX-packaged apps (such as Store-version PowerShell); otherwise, an error occurs.
Readability: the Shell installation directory must be readable inside the container; otherwise, the container cannot resolve its own path.

Configuration Options¶

Option	Default	Description
`wxcExecPath`	`''`	Absolute path to `wxc-exec.exe`. If empty, the environment variable or SDK export path is attempted.
`readonlyPaths`	`[]`	Additional root directories that the container can read.
`extraWritablePaths`	`[]`	Additional root directories that the container can write to.
`deniedPaths`	`[]`	Root directories strictly forbidden from container access.
`network`	omitted	If unset, the MXC default policy blocks outbound network access.
`timeoutMs`	`0`	Timeout for a single execution (milliseconds); 0 means no timeout.
`containerIdPrefix`	`'dsh-mxc'`	Prefix for diagnostic container names.
`sandboxEnv`	`[]`	`KEY=VALUE` entries injected into the container process environment.
`injectNodePipeShim`	`true`	Inject a Node pipe shim so Node inside the container can capture child-process output through file handles.

Important Notes¶

Windows 10 limitation: On Windows 10, MXC uses the appcontainer-dacl level. If a path’s DACL cannot be modified (for example, a volume belonging to another SID), the plugin automatically drops that path and prints the reason instead of causing the command to fail. Nonexistent paths are also filtered automatically.
Permission isolation: The default policy blocks outbound network access and isolates the clipboard from the host.
SDK restriction exemption: Because the plugin does not import the SDK native bindings, it avoids the SDK’s specific Node.js version requirements.

Summary¶

dsh-sandbox-mxc provides a lightweight MXC-based sandbox solution for DeepSeek Harness on Windows. It achieves isolation through the standard wxc-exec tool, requires no kernel patches, and has a default policy that blocks outbound network access.

GitHub Repository