feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification

Browse Source

dsh-bash grows the per-call policy carrier: BashExecRequest.sandboxMode
(request-optional, spec required-but-nullable — the owner pattern; resolve()
is the one explicit defaulting step) and the BashExecutor.sandboxMode
capability fact (undefined in the base class — composition truth the tool
layer can read). dsh-bash-local carries the field verbatim and confines
nothing.

dsh-bash-sandbox extends LocalBashExecutor and hands ctx.sandbox the exact
argv it is about to spawn. A denial is a RESULT FACT (the command RAN;
result.sandbox.denied is orthogonal to exitCode/signal), classified
conservatively against the wrap own dialect; a RUNNER failure outranks
denial — foreground re-throws the structured SANDBOX_UNAVAILABLE, a settled
background task stamps sandbox.runnerFailed — so a broken sandbox never
reads as a failing command and the command never runs unconfined.
dsh-tool-bash renders the markers and teaches the model not to retry around
a policy denial; escalation and per-session switching are staged follow-ups.

...

This commit is contained in:

kingwl

2026-07-09 16:05:44 +08:00

parent 7b8c3a9b40

commit 2eed448acf

38 changed files with 1529 additions and 40 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

2

examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl

File diff suppressed because one or more lines are too long

2

examples/acp-agent/tests/snapshots/code-mode-turn/session.jsonl

File diff suppressed because one or more lines are too long

2

examples/acp-agent/tests/snapshots/text-turn/session.jsonl

File diff suppressed because one or more lines are too long