{"record":{"id":"80e7cba9a139907f","repo":"deepseek-ai/deepseek-harness","slug":"sandbox-unavailable","errorCode":"SANDBOX_UNAVAILABLE","errorMessage":"sandbox mode \"${mode}\" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS), or ensure the ACL restricted-token runner can start (Windows) — otherwise switch the consumer to danger-full-access.","messagePattern":"sandbox mode \"(.+?)\" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined\\. Install bubblewrap or run a Landlock-enforcing kernel \\(Linux\\), ensure sandbox-exec is usable \\(macOS\\), or ensure the ACL restricted-token runner can start \\(Windows\\) — otherwise switch the consumer to danger-full-access\\.","errorType":"exception","errorClass":"SandboxUnavailableError","httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-local/src/index.ts","lineNumber":494,"sourceCode":"    }\n  }\n\n  /** Remove one provider-owned private temp directory (injectable for cleanup tests). */\n  private removeTempDir(dir: string): void {\n    const remove = this.internals.rmTempDir ?? ((path: string) => { rmSync(path, { recursive: true, force: true }) })\n    remove(dir)\n  }\n\n  /**\n   * Resolve which runner confines commands, once, for the provider's\n   * lifetime: this platform's chain ({@link PLATFORM_CHAINS}), its sole\n   * candidate selected directly, multiple candidates arbitrated by\n   * functional probes in chain order. Fail closed when the platform has no\n   * chain or no candidate passes — the command never runs.\n   */\n  private selectRunner(mode: ConfinedSandboxMode): SelectedRunner {\n    this.selectedRunner ??= this.chainVerdict()\n    if (this.selectedRunner === 'unavailable') throw new SandboxUnavailableError(mode)\n    return this.selectedRunner\n  }\n\n  /** Walk this platform's chain: sole candidate unprobed, several probed in order, none usable → unavailable. */\n  private chainVerdict(): SelectedRunner | 'unavailable' {\n    const chain = this.internals.chain ?? PLATFORM_CHAINS[this.internals.platform ?? process.platform] ?? []\n    const [first, ...rest] = chain\n    if (first === undefined) return 'unavailable'\n    // A sole candidate needs no arbitration; its execution-time refusal still fails closed.\n    if (rest.length === 0) return { runner: first, enforcement: STATIC_ENFORCEMENT[first] }\n    for (const runner of chain) {\n      const enforcement = this.probeRunner(runner)\n      if (enforcement !== 'unusable') return { runner, enforcement }\n    }\n    return 'unavailable'\n  }\n\n  /** One rung's functional probe (each at most once, via the chain walk). */","sourceCodeStart":476,"sourceCodeEnd":512,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-local/src/index.ts#L476-L512","documentation":"Error \"sandbox mode \"${mode}\" is requested but no sandbox backend is usable on this host; refusing to run the command unconfined. Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS), or ensure the ACL restricted-token runner can start (Windows) — otherwise switch the consumer to danger-full-access.\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-local/src/index.ts:494 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Install bubblewrap or run a Landlock-enforcing kernel (Linux), ensure sandbox-exec is usable (macOS), or ensure the ACL restricted-token runner can start (Windows); otherwise switch the consumer to danger-full-access."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}