The ruleIf worker-thread Code Mode is enabled, treat the program body as host-trusted until an authoritative outer boundary proves otherwise.

Read both switches together.

Tools modenative

Ordinary tools route through their registered policy and sandbox seams.

Tools modecode / both

run_code executes a TypeScript body in the loaded code runtime.

Permission moderead-only / workspace-write

Constrains capability paths that call the sandbox policy.

Missing proofworker OS confinement

A fresh thread is still inside the Host process and user authority.

Make one explicit deployment choice.

Preferred defaultReturn to native tools

Unset DSH_TOOLS_MODE, restart the Host, and verify that run_code is absent.

When Code Mode is requiredIsolate the complete Host

Use a disposable VM or constrained container with only the intended workspace, no host secrets or sockets, and independent egress policy.

Inspect; do not run an escape proof.

  1. EnvironmentRecord DSH_TOOLS_MODE and DSH_PERMISSION_MODE.
  2. CompositionRun dsh --profile web --dump-config.
  3. RuntimeIdentify whether the loaded backend is worker-thread.
  4. CatalogConfirm whether run_code is visible in a fresh Session.

Do not mistake reliability controls for authority.

env: {}removes inherited variables

≠

filesystem isolation

heap + time capsbound resource use

≠

process policy

approval promptsgate registered effects

≠

kernel enforcement

If untrusted input already reached Code Mode.

Stop→Preserve Session→Review telemetry→Rotate reachable credentials→Rebuild if integrity is unknown

Primary evidence.

Keep the deployment checklist.

The canonical guide includes shell and PowerShell checks, outer-boundary requirements, incident response, and a reusable decision record.

Read and star on GitHub