@deepseek-ai/dsh-bash-sandbox 0.1.2-alpha.5 → 0.1.3-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/bash-sandbox/README.md
-README.md: db0b280c595458873537479700a69120f2865994
-README.zh.md: db5019c9dc5b4e8f99caaad4374f6b83a7b4288f
+README.md: 6d0e6aab3cd501c42be83e6da7a15ba0984fc114
+README.zh.md: 086fee202bdea39d3d80b6322ff1c0484b5d1ab9

package/README.md

@@ -61,7 +61,7 @@ A denied command is reported, not retried silently: the result carries `sandbox:
 
 ### Failures and recovery
 
-If no runner can enforce a confined mode, the foreground call fails with `SANDBOX_UNAVAILABLE` and a background process records a runner-failure fact — never a silent unconfined run. A runner-attributable spawn failure carries the original spawn error as detail; other spawn rejections keep the local executor's ordinary command-start semantics.
+If no runner can enforce a confined mode, the foreground call fails with `SANDBOX_UNAVAILABLE` and a background process records a runner-failure fact — never a silent unconfined run. A provider rejection is attributed to the confinement runner only when its `ENOENT`/`EACCES` path or syscall independently names `argv[0]`; otherwise it keeps the local executor's stage-neutral provider-failure semantics.
 
 -----
 
@@ -151,7 +151,7 @@ Append-only; newly visible content follows the reusable request prefix and does
 
 #### What the model sees
 
-If no runner can enforce a confined mode, the foreground call propagates the `SANDBOX_UNAVAILABLE` error from the sandbox seam. A runner-attributable spawn failure supplies the original spawn error as detail; a rejection without `ENOENT`/`EACCES` path or syscall evidence that names `argv[0]` remains an ordinary command-start error. A settled runner failure supplies the matched fatal stderr line and preserves the original stderr collection; the appended `Runner failure: <detail>` is the authoritative diagnosis over the generic `SANDBOX_UNAVAILABLE` prefix.
+If no runner can enforce a confined mode, the foreground call propagates the `SANDBOX_UNAVAILABLE` error from the sandbox seam. A provider rejection with `ENOENT`/`EACCES` path or syscall evidence that names `argv[0]` supplies the original error as runner-failure detail; another rejection remains a stage-neutral provider error. A settled runner failure supplies the matched fatal stderr line and preserves the original stderr collection; the appended `Runner failure: <detail>` is the authoritative diagnosis over the generic `SANDBOX_UNAVAILABLE` prefix.
 
 #### Token effect
 

package/README.zh.md

@@ -61,7 +61,7 @@ kind: "package-reference"
 
 ### 失败与恢复
 
-如果没有 runner 能强制执行受限模式，前台调用以 `SANDBOX_UNAVAILABLE` 失败，后台进程则记录 runner 失败事实——绝不会静默无隔离运行。可归因于 runner 的 spawn 失败以原始 spawn 错误作为详情；其他 spawn 拒绝保持本地执行器普通的命令启动语义。
+如果没有 runner 能强制执行受限模式，前台调用以 `SANDBOX_UNAVAILABLE` 失败，后台进程则记录 runner 失败事实——绝不会静默无隔离运行。只有当 provider rejection 的 `ENOENT`/`EACCES` 路径或 syscall 独立指向 `argv[0]` 时，才把它归因于 confinement runner；其他 rejection 保持本地执行器不声明阶段的 provider-failure 语义。
 
 -----
 
@@ -151,7 +151,7 @@ kind: "package-reference"
 
 #### 模型看到的内容
 
-如果没有 runner 能强制执行受限模式，前台调用会传播来自 sandbox seam 的 `SANDBOX_UNAVAILABLE` 错误。可归因于 runner 的 spawn 失败以原始 spawn 错误作为详情；没有 `ENOENT`/`EACCES` 的 `path` 或 `syscall` 证据指明 `argv[0]` 的拒绝仍是普通的命令启动错误。已结算的 runner 失败以匹配到的致命 stderr 行作为详情，并保留原始 stderr 收集结果；追加的 `Runner failure: <detail>` 是权威诊断，优先于通用的 `SANDBOX_UNAVAILABLE` 前缀。
+如果没有 runner 能强制执行受限模式，前台调用会传播来自 sandbox seam 的 `SANDBOX_UNAVAILABLE` 错误。带有 `ENOENT`/`EACCES` 路径或 syscall 证据并指向 `argv[0]` 的 provider rejection 会把原始错误作为 runner-failure 详情；其他 rejection 保持不声明阶段的 provider error。已结算的 runner 失败以匹配到的致命 stderr 行作为详情，并保留原始 stderr 收集结果；追加的 `Runner failure: <detail>` 是权威诊断，优先于通用的 `SANDBOX_UNAVAILABLE` 前缀。
 
 #### Token 影响
 

package/lib/index.js

@@ -94,10 +94,11 @@ function matchesSignature(exitCode, stderr, signatures) {
 /**
 * Sandbox-consuming bash executor. It wraps the exact local bash argv through
 * `ctx.sandbox`, inherits local process mechanics, and reports the selected
-* mode, enforcement, and denial facts. Positive runner-launch evidence means
-* the command never ran: foreground calls throw `SANDBOX_UNAVAILABLE`, while
-* background processes carry `runnerFailed`; other spawn rejections retain
-* local-executor semantics. The tool owns approval and passes a complete per-call policy.
+* mode, enforcement, and denial facts. Positive runner-executable evidence
+* identifies a broken confinement runner: foreground calls throw
+* `SANDBOX_UNAVAILABLE`, while background processes carry `runnerFailed`;
+* other provider rejections retain stage-neutral local-executor semantics. The
+* tool owns approval and passes a complete per-call policy.
 * @module @deepseek-ai/dsh-bash-sandbox
 */
 /**
@@ -203,11 +204,11 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 	* Stamp per-process sandbox facts before `done` settles. Full-access processes
 	* have no facts; signal deaths are not denials.
 	*/
-	onProcessDone(proc, stderr, spawnFailed, spawnError) {
+	onProcessDone(proc, stderr, providerRejected, providerError) {
 		const facts = this.processFacts.get(proc);
 		if (facts !== void 0) {
 			this.processFacts.delete(proc);
-			const runnerFailed = spawnFailed ? isRunnerSpawnFailure(spawnError, facts.runnerProgram, facts.workdir) : classifyRunnerFailure(proc.exitCode, stderr, facts.runnerFailureRules) !== void 0;
+			const runnerFailed = providerRejected ? isRunnerSpawnFailure(providerError, facts.runnerProgram, facts.workdir) : classifyRunnerFailure(proc.exitCode, stderr, facts.runnerFailureRules) !== void 0;
 			proc.sandbox = {
 				mode: facts.mode,
 				denied: !runnerFailed && matchesSignature(proc.exitCode, stderr, facts.denialSignatures),
@@ -215,7 +216,7 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 				...runnerFailed ? { runnerFailed } : {}
 			};
 		}
-		super.onProcessDone(proc, stderr, spawnFailed, spawnError);
+		super.onProcessDone(proc, stderr, providerRejected, providerError);
 	}
 	/**
 	* Wrap one shell command via the `ctx.sandbox` provider. Provider errors

package/lib/types/index.d.ts

@@ -1,10 +1,11 @@
 /**
  * Sandbox-consuming bash executor. It wraps the exact local bash argv through
  * `ctx.sandbox`, inherits local process mechanics, and reports the selected
- * mode, enforcement, and denial facts. Positive runner-launch evidence means
- * the command never ran: foreground calls throw `SANDBOX_UNAVAILABLE`, while
- * background processes carry `runnerFailed`; other spawn rejections retain
- * local-executor semantics. The tool owns approval and passes a complete per-call policy.
+ * mode, enforcement, and denial facts. Positive runner-executable evidence
+ * identifies a broken confinement runner: foreground calls throw
+ * `SANDBOX_UNAVAILABLE`, while background processes carry `runnerFailed`;
+ * other provider rejections retain stage-neutral local-executor semantics. The
+ * tool owns approval and passes a complete per-call policy.
  * @module @deepseek-ai/dsh-bash-sandbox
  */
 import { Context } from '@deepseek-ai/cordis';
@@ -52,7 +53,7 @@ export declare class SandboxBashExecutor extends LocalBashExecutor {
      * Stamp per-process sandbox facts before `done` settles. Full-access processes
      * have no facts; signal deaths are not denials.
      */
-    protected onProcessDone(proc: ShellProcess, stderr: string, spawnFailed: boolean, spawnError?: unknown): void;
+    protected onProcessDone(proc: ShellProcess, stderr: string, providerRejected: boolean, providerError?: unknown): void;
     /**
      * Wrap one shell command via the `ctx.sandbox` provider. Provider errors
      * propagate unchanged; the returned argv is handed directly to the local

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-bash-sandbox",
   "description": "Sandbox-consuming implementation of the DeepSeek Harness bash executor seam (confines every command via ctx.sandbox, reports denial/enforcement result facts)",
-  "version": "0.1.2-alpha.5",
+  "version": "0.1.3-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -27,21 +27,21 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-shell": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-bash-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.5",
+    "@deepseek-ai/dsh-shell": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-bash-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-shell": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-bash-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.5",
+    "@deepseek-ai/dsh-shell": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-bash-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/node-addon-landlock-run": "^0.1.1",
-    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.5"
+    "@deepseek-ai/dsh-session-projection": "^0.1.3-alpha.2"
   }
 }