finsafe (windows)
finogeeks/finsafe/integrations/dsh/windows
DSH Desktop 的 Windows 沙箱：设置完成后，Host 会经 FinSAFE 在 AppContainer 沙箱里启动，限制智能体能触及的本机范围。仅限 Windows x64；首次激活会下载并安装匹配的 FinSAFE 原生运行时（校验 SHA256，需 Windows 授权），并留下一个常驻的更新器进程。
安装
dsh plugin --profile web add github:finogeeks/finsafe该插件位于仓库的 integrations/dsh/windows 子路径下。
README
FinShield
Agents can put your computer at risk. Adding a sandbox can be simple.
FinShield gives Agents a sandbox on Windows, macOS, and Linux, so they work within the permissions you grant.
简体中文 · FinShield on finaios.ai
Agent Safety Evaluation · Agent Safety Arena — Compare Agent built-in sandboxes with FinShield through published recordings, test conditions, and results. 中文.
Install: on Windows, download the install assistant and double-click it. For macOS, Linux, offline packages, and full instructions, see the latest release.
What happens without a sandbox? Watch real recordings
100-window storm: Windows overlap the ordinary desktop; private-desktop protection keeps the storm off the user's desktop.
Window shaking: The ordinary run moves a test window; protected control calls are refused and its state stays unchanged.
Clipboard replacement: Copied text changes in the ordinary run; protected clipboard access is refused and no replacement is observed.
Select a recording for its full case. These are separate Windows/DSH 0.9.79 runs, not synchronized footage. See source and scope notes for configuration differences.
Feature comparison
Reproduced from the original Windows technical proposal. Detailed evaluation will follow.
| Product | Runtime | Agent integration | Risky System Operations | File permissions | PII detection | Data retention |
|---|---|---|---|---|---|---|
| FinShield | Native Windows | Supported | Supported | Supported | Supported | Supported |
| SRT (Anthropic) | Native Windows | CLI Agents only | Partially supported | Supported | Unsupported | Unsupported |
| Codex (OpenAI) | Native Windows | DSH task execution failed | Partially supported | Partially supported | Unsupported | Unsupported |
| MXC (Microsoft) | Windows execution backend | DSH failed to start | — | — | — | — |
| Docker Sandboxes | Linux microVM | Windows Agents unsupported | Isolates the host system | Supported | Unsupported | Unsupported |
| OpenShell | WSL2 + Linux container | Windows Agents unsupported | Isolates the host system | Supported | Unsupported | Unsupported |
“—” means Agent startup failed and subsequent tests were not performed.
Explore
- Install and get started: downloads, installation, first launch, and permission checks.
- Windows illustrated overview: capabilities, architecture, and integration.
- Documentation and whitepaper: Windows, Linux/macOS, and the complete product approach.
- Agent Safety Evaluation: recordings, test conditions, and results comparing Agent built-in sandboxes with FinShield.
- Report a problem · Release history.
Protection depends on the launch entry, effective permissions, and version. Content checks cover integrated, inspectable requests. Published by Finogeeks; use is subject to the supplied license terms.