finsafe (windows)
finogeeks/finsafe/integrations/dsh/windows
Windows sandbox for DSH Desktop: once set up, the Host is launched through FinSAFE inside an AppContainer sandbox for protection against what agents can reach on the machine. Windows x64 only; on first activation it downloads and installs the matching FinSAFE native runtime (SHA256-checked, with Windows consent) and leaves an updater process running.
Install
dsh plugin --profile web add github:finogeeks/finsafeThis plugin lives in the integrations/dsh/windows subdirectory of the repository.
README
FinShield
Agents can put your computer at risk. Adding a sandbox can be simple.
FinShield gives Agents a sandbox on Windows, macOS, and Linux, so they work within the permissions you grant.
简体中文 · FinShield on finaios.ai
Agent Safety Evaluation · Agent Safety Arena — Compare Agent built-in sandboxes with FinShield through published recordings, test conditions, and results. 中文.
Install: on Windows, download the install assistant and double-click it. For macOS, Linux, offline packages, and full instructions, see the latest release.
What happens without a sandbox? Watch real recordings
100-window storm: Windows overlap the ordinary desktop; private-desktop protection keeps the storm off the user's desktop.
Window shaking: The ordinary run moves a test window; protected control calls are refused and its state stays unchanged.
Clipboard replacement: Copied text changes in the ordinary run; protected clipboard access is refused and no replacement is observed.
Select a recording for its full case. These are separate Windows/DSH 0.9.79 runs, not synchronized footage. See source and scope notes for configuration differences.
Feature comparison
Reproduced from the original Windows technical proposal. Detailed evaluation will follow.
| Product | Runtime | Agent integration | Risky System Operations | File permissions | PII detection | Data retention |
|---|---|---|---|---|---|---|
| FinShield | Native Windows | Supported | Supported | Supported | Supported | Supported |
| SRT (Anthropic) | Native Windows | CLI Agents only | Partially supported | Supported | Unsupported | Unsupported |
| Codex (OpenAI) | Native Windows | DSH task execution failed | Partially supported | Partially supported | Unsupported | Unsupported |
| MXC (Microsoft) | Windows execution backend | DSH failed to start | — | — | — | — |
| Docker Sandboxes | Linux microVM | Windows Agents unsupported | Isolates the host system | Supported | Unsupported | Unsupported |
| OpenShell | WSL2 + Linux container | Windows Agents unsupported | Isolates the host system | Supported | Unsupported | Unsupported |
“—” means Agent startup failed and subsequent tests were not performed.
Explore
- Install and get started: downloads, installation, first launch, and permission checks.
- Windows illustrated overview: capabilities, architecture, and integration.
- Documentation and whitepaper: Windows, Linux/macOS, and the complete product approach.
- Agent Safety Evaluation: recordings, test conditions, and results comparing Agent built-in sandboxes with FinShield.
- Report a problem · Release history.
Protection depends on the launch entry, effective permissions, and version. Content checks cover integrated, inspectable requests. Published by Finogeeks; use is subject to the supplied license terms.