dsh-flutter-sandbox
A DeepSeek Harness (dsh) plugin that lets Flutter and Dart run inside dsh's workspace-write sandbox.
Out of the box, dsh only lets sandboxed commands write the session workspace and /tmp. Flutter also writes outside the project on every run, so even flutter --version fails:
update_engine_version.sh: line 71: .../flutter/bin/cache/engine.stamp.tmp: Read-only file system
This plugin replaces dsh's stock sandbox provider with one that also grants write access to these directories (only those that exist):
| Directory | Why |
|---|
Flutter SDK ($FLUTTER_ROOT, or found from flutter on PATH) | The tool updates bin/cache on every run |
$PUB_CACHE or ~/.pub-cache | Package downloads |
~/.dart-tool, ~/.dartServer | Telemetry state and analysis-server cache |
~/.flutter, $XDG_CONFIG_HOME/flutter (~/.config/flutter) | Flutter settings |
$GRADLE_USER_HOME or ~/.gradle, ~/.android | Android builds |
Everything else stays protected, and read-only and danger-full-access modes are unchanged. The model is told about the extra directories in its context.
Install
dsh plugin --profile tui add github:liyuqian/dsh-flutter-sandbox
Use --profile web (or any other profile name) for other profiles. Remove it with dsh plugin --profile tui remove dsh-flutter-sandbox.
Configure
The defaults need no configuration. To turn off the Flutter directories or add your own, override the plugin row in your profile's cordis.patch.yml (~/.dsh/profiles/<profile>/cordis.patch.yml):
- id: sandbox-flutter
config:
flutter: true # grant the Flutter/Dart/Gradle/Android directories above
extraWritableRoots: # additional absolute directories
- /home/me/.cocoapods
The stock provider's options (runnerCommand, runnerFailureSignatures, probeTimeoutMs) are accepted too.
How it works
The plugin's bundle patch disables dsh-base's sandbox row (@deepseek-ai/dsh-sandbox-local) and inserts sandbox-flutter, a subclass of that provider. For each workspace-write call it lets the stock provider build the runner command, then inserts one grant per existing directory before the -- that precedes your command:
- bubblewrap (Linux):
--bind <dir> <dir>
- Landlock (Linux):
--rw <dir>
- Seatbelt (macOS):
(allow file-write* (subpath "<dir>"))
Limitations
- Shell commands only. dsh's own file write/edit tools check writable paths separately and still deny these directories; the model can ask for approval as usual. Flutter, pub and Gradle write through the shell, so this does not affect them.
- Windows is not supported. The ACL runner cannot grant extra directories, so confined commands fail with a clear error instead of silently running without the grants.
- Depends on the stock runner's argument layout. A dsh release that changes it makes the plugin fail loudly with "unexpected sandbox argv layout" rather than run unconfined. Tested with dsh 0.1.1-rc.2.
- Pub workspaces.
flutter pub get in a package of a pub workspace writes to the workspace root; start the dsh session at that root.
Develop
npm test
The tests cover root discovery and each runner's grant insertion without a dsh installation.
License
MIT
