dsh-agentenv-sandbox

By default, DeepSeek Harness executes Bash commands, file operations, persistent terminals, and LSP processes directly on the host filesystem, effectively granting the model full system access. dsh-agentenv-sandbox relocates this entire execution layer into an AgentENV Firecracker microVM. Through the official E2B adapters, Bash, file tools, PTY, and LSP all share a single remote Linux world, while local filesystem and subprocess providers are permanently disabled. Any failure in AgentENV creation or workspace upload hard-rejects the session instead of falling back to host execution.

On first launch the plugin performs a bounded initial upload of the selected workspace into the microVM (default caps: 50,000 files, 512 MiB aggregate). After that, every model-facing file and process operation goes through the remote providers, and there is no automatic write-back channel to the host. The microVM can be configured to pause rather than destroy on Harness exit, allowing the next session to reconnect by recorded ID, which suits iterative debugging across sessions. The MVP requires WSL 2 or Linux, Node.js 22.19 or later, a running AgentENV 0.1.0 or 0.1.3 instance with a pre-built template, and binds each Harness process to one sandbox and one fixed working directory.

This plugin suits developers or teams who run Harness on Linux or WSL 2, have AgentENV deployed, and want a non-bypassable hard isolation boundary around model operations. It does not fit native Windows setups, environments without a pre-existing AgentENV deployment, or workflows expecting a single process to auto-switch between multiple workspaces.