dsh-python-tempfile-shim

简体中文

Temporary plugin that works around one Windows sandbox incompatibility until
DeepSeek Harness ships an upstream fix. It is not published to npm; install it
from a local clone. Read SECURITY.md before installing.

The plugin lets Python (including pytest) use temporary directories inside the
DSH Windows sandbox. Background: CPython on Windows builds a directory DACL
from os.mkdir's mode argument; 0o700 produces an owner-only directory.
tempfile.mkdtemp and pytest's basetemp chain both use 0o700. The DSH
Windows sandbox runs commands under a WRITE_RESTRICTED token whose
restricting-SID list excludes the user's own SID, so the confined process
cannot read or write the directories it just created. pytest tmp_path/
tmpdir tests fail with [Errno 13] / WinError 5 and the
[sandbox: file access denied under workspace-write mode] marker.

How it works — fully automatic, no extra tools

The plugin patches the mounted shell executor's resolve() — the single
chokepoint every shell consumer passes through (the pwsh tool, background
jobs, in-process plugin bridges) — so that every confined command
(workspace-write / read-only) inherits PYTHONPATH=<plugin assets dir>.
The bundled assets/sitecustomize.py then makes os.mkdir ignore the mode
argument, so new directories inherit the parent ACL (which carries the
sandbox's workspace/temp write ACEs) instead of CPython's owner-only DACL.

Because the injection happens at the executor level:

• No extra tools to remember — python, pytest, pip, tox, nox,
  venvs, and any child Python process all get the fix automatically.
• No extra model context — the agent just runs Python normally through
  pwsh. A compact always-on system-prompt section tells it the fix is
  automatic so it never reaches for workarounds.
• Zero escalation — the sandbox boundary is untouched: token, ACEs,
  policy, and escalation surface are all left alone.

PYTHONPATH is inert for non-Python commands, so adding it to every confined
command is safe; a command that sets $env:PYTHONPATH itself still overrides
it. The shim is deliberately not injected for unsandboxed compositions or
danger-full-access runs (the bug does not exist there, and 0o700 is
CPython's privacy hardening that unconfined runs should keep).

A python-tempfile-shim skill is also registered for humans and for the rare
case where a failure still appears (diagnose + report).

Scope

• All 0o700 directory creation routes through os.mkdir: tempfile.mkdtemp,
  tempfile.TemporaryDirectory, os.makedirs(mode=0o700),
  pathlib.Path.mkdir(mode=0o700), pytest, tox/nox (the shim propagates to
  subprocesses via PYTHONPATH).
• Windows only; on other platforms apply() registers nothing.
• File creation (os.open/mkstemp modes) is not affected and needs no patch.

Install

git clone https://github.com/AngelosZou/dsh-python-tempfile-shim.git
dsh plugin --profile web add link:<local repository path>

Restart DSH afterwards.

Uninstall: remove the plugin from the DSH settings page, then restart DSH.

Verification

• Environment: Windows, DSH workspace-write sandbox, Python 3.11.15 / 3.13.14,
  pytest 9.1.1.
  • Without the plugin: tmp_path test fails with PermissionError: [WinError 5].
  • With the plugin: 1 passed; mkdtemp, TemporaryDirectory, mkstemp,
    and basetemp cleanup work — run through the ordinary pwsh tool, no
    special arguments.
• Subprocess propagation: parent Python process to child Python process
  (inherited PYTHONPATH) works.
• Smoke test: npm test covers the resolve-patch contract (confined modes
  injected, danger-full-access/unsandboxed left alone, idempotency,
  disposal, no spec mutation) plus prompt-section and skill registration.

Security

See SECURITY.md. Note: do not install
assets/sitecustomize.py into global site-packages or a machine-wide
PYTHONPATH; 0o700 is CPython's privacy hardening and unsandboxed runs should
keep it.

Upstream status

Uninstall this plugin once an upstream fix ships.

License

MIT