@tensorlakeai/dsh-sandbox

Configuration

The bundle starts an ephemeral sandbox on profile boot and terminates it when dsh exits. The runtime module accepts these Cordis config fields:

Each run prints the sandbox ID at both lifecycle boundaries. The IDs should match:

Tensorlake sandbox created: 
Tensorlake sandbox terminated: 

Field	Default	Meaning
apiKey	TENSORLAKE_API_KEY	Tensorlake API credential used only by the host SDK
cwd	/home/tl-user/workspace	Absolute Linux working directory shared by file and process providers
timeoutSecs	600	Sandbox inactivity timeout
cpus	Tensorlake default	Virtual CPU allocation
memoryMb	Tensorlake default	Memory allocation in MiB
diskMb	Tensorlake default	Root disk allocation in MiB

The shipped bundle derives both the runtime cwd and policy workspace from DSH_TENSORLAKE_CWD. Prefer that single setting when changing the workspace so the Bash policy and remote providers cannot drift:

DSH_TENSORLAKE_CWD=/workspace/project dsh --profile headless "build and test this repo"

To configure the rows directly in the profile's cordis.patch.yml, override both together. A patch replaces the complete config, so restate every non-default field you need:

- id: sandbox-policy
  config:
    mode: danger-full-access
    workspaceRoot: /workspace/project

- id: tensorlake-runtime
  config:
    cwd: /workspace/project
    timeoutSecs: 1800
    cpus: 2
    memoryMb: 4096

apiKey is optional and should normally remain omitted. The package never copies TENSORLAKE_API_KEY, DEEPSEEK_API_KEY, other credential-shaped environment variables, or DSH_* variables into sandbox processes. A caller may still pass an explicit environment entry through a Harness tool or service request.