@deepseek-ai/dsh-bash-sandbox 0.1.2-rc.1 → 0.1.5-alpha.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/bash-sandbox/README.md
-README.md: db0b280c595458873537479700a69120f2865994
-README.zh.md: db5019c9dc5b4e8f99caaad4374f6b83a7b4288f
+README.md: f28ecaefce8c2a5508fcee34473ffc00d7348d98
+README.zh.md: 996b0b0a21cf67c3087c76e06bd0115b88d2350c

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-`dsh-bash-sandbox` is the sandbox-consuming Bash executor: every command runs as a fresh `bash -c` process confined through the `ctx.sandbox` capability instead of with the harness process's full file authority. Each settled result carries the mode the command ran under, whether the sandbox denied a file operation, and how completely the selected runner enforced the requested mode. When no runner can enforce a confined mode, the call fails closed with a structured `SANDBOX_UNAVAILABLE` error rather than running unconfined. It is the confining sibling of `dsh-bash-local` — sharing its process mechanics — and the tool layer's escalation fields appear only while it is mounted.
+Use `dsh-bash-sandbox` to run each Bash command with file-access confinement instead of the harness process's full authority. Results report the selected mode, denied file operations, and whether the runner fully enforced that mode. If no runner can enforce a confined mode, the command fails with `SANDBOX_UNAVAILABLE` rather than running unconfined. Choose it when deployments need file isolation; network access and process visibility remain outside its guarantees.
 
 ## Table of Contents
 
@@ -61,7 +61,7 @@ A denied command is reported, not retried silently: the result carries `sandbox:
 
 ### Failures and recovery
 
-If no runner can enforce a confined mode, the foreground call fails with `SANDBOX_UNAVAILABLE` and a background process records a runner-failure fact — never a silent unconfined run. A runner-attributable spawn failure carries the original spawn error as detail; other spawn rejections keep the local executor's ordinary command-start semantics.
+If no runner can enforce a confined mode, the foreground call fails with `SANDBOX_UNAVAILABLE` and a background process records a runner-failure fact — never a silent unconfined run. A provider rejection is attributed to the confinement runner only when its `ENOENT`/`EACCES` path or syscall independently names `argv[0]`; otherwise it keeps the local executor's stage-neutral provider-failure semantics.
 
 -----
 
@@ -151,7 +151,7 @@ Append-only; newly visible content follows the reusable request prefix and does
 
 #### What the model sees
 
-If no runner can enforce a confined mode, the foreground call propagates the `SANDBOX_UNAVAILABLE` error from the sandbox seam. A runner-attributable spawn failure supplies the original spawn error as detail; a rejection without `ENOENT`/`EACCES` path or syscall evidence that names `argv[0]` remains an ordinary command-start error. A settled runner failure supplies the matched fatal stderr line and preserves the original stderr collection; the appended `Runner failure: <detail>` is the authoritative diagnosis over the generic `SANDBOX_UNAVAILABLE` prefix.
+If no runner can enforce a confined mode, the foreground call propagates the `SANDBOX_UNAVAILABLE` error from the sandbox seam. A provider rejection with `ENOENT`/`EACCES` path or syscall evidence that names `argv[0]` supplies the original error as runner-failure detail; another rejection remains a stage-neutral provider error. A settled runner failure supplies the matched fatal stderr line and preserves the original stderr collection; the appended `Runner failure: <detail>` is the authoritative diagnosis over the generic `SANDBOX_UNAVAILABLE` prefix.
 
 #### Token effect
 

package/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-`dsh-bash-sandbox` 是沙箱消费型 Bash 执行器：每条命令都以全新的 `bash -c` 进程运行，经 `ctx.sandbox` 能力隔离，而不是以 harness 进程的完整文件权限运行。每个已结算的结果都携带命令运行时的模式、沙箱是否拒绝了文件操作，以及所选 runner 对请求模式的强制执行完整度。当没有 runner 能强制执行受限模式时，调用按失败关闭原则抛结构化 `SANDBOX_UNAVAILABLE` 错误，绝不无隔离地运行。它是 `dsh-bash-local` 的受限兄弟包——共享其进程机制——工具层的升权字段也只在挂载它时才出现。
+使用 `dsh-bash-sandbox` 运行每条 Bash 命令，使其文件访问受到限制，而不是使用 harness 进程的完整权限。结果会报告所选模式、被拒绝的文件操作，以及 runner 是否完整实施该模式。如果没有 runner 能实施受限模式，命令会以 `SANDBOX_UNAVAILABLE` 失败，绝不会无隔离地运行。部署需要文件隔离时选择它；网络访问和进程可见性不在其保证范围内。
 
 ## 目录
 
@@ -61,7 +61,7 @@ kind: "package-reference"
 
 ### 失败与恢复
 
-如果没有 runner 能强制执行受限模式，前台调用以 `SANDBOX_UNAVAILABLE` 失败，后台进程则记录 runner 失败事实——绝不会静默无隔离运行。可归因于 runner 的 spawn 失败以原始 spawn 错误作为详情；其他 spawn 拒绝保持本地执行器普通的命令启动语义。
+如果没有 runner 能强制执行受限模式，前台调用以 `SANDBOX_UNAVAILABLE` 失败，后台进程则记录 runner 失败事实——绝不会静默无隔离运行。只有当 provider rejection 的 `ENOENT`/`EACCES` 路径或 syscall 独立指向 `argv[0]` 时，才把它归因于 confinement runner；其他 rejection 保持本地执行器不声明阶段的 provider-failure 语义。
 
 -----
 
@@ -151,7 +151,7 @@ kind: "package-reference"
 
 #### 模型看到的内容
 
-如果没有 runner 能强制执行受限模式，前台调用会传播来自 sandbox seam 的 `SANDBOX_UNAVAILABLE` 错误。可归因于 runner 的 spawn 失败以原始 spawn 错误作为详情；没有 `ENOENT`/`EACCES` 的 `path` 或 `syscall` 证据指明 `argv[0]` 的拒绝仍是普通的命令启动错误。已结算的 runner 失败以匹配到的致命 stderr 行作为详情，并保留原始 stderr 收集结果；追加的 `Runner failure: <detail>` 是权威诊断，优先于通用的 `SANDBOX_UNAVAILABLE` 前缀。
+如果没有 runner 能强制执行受限模式，前台调用会传播来自 sandbox seam 的 `SANDBOX_UNAVAILABLE` 错误。带有 `ENOENT`/`EACCES` 路径或 syscall 证据并指向 `argv[0]` 的 provider rejection 会把原始错误作为 runner-failure 详情；其他 rejection 保持不声明阶段的 provider error。已结算的 runner 失败以匹配到的致命 stderr 行作为详情，并保留原始 stderr 收集结果；追加的 `Runner failure: <detail>` 是权威诊断，优先于通用的 `SANDBOX_UNAVAILABLE` 前缀。
 
 #### Token 影响
 

package/lib/index.js

@@ -94,10 +94,11 @@ function matchesSignature(exitCode, stderr, signatures) {
 /**
 * Sandbox-consuming bash executor. It wraps the exact local bash argv through
 * `ctx.sandbox`, inherits local process mechanics, and reports the selected
-* mode, enforcement, and denial facts. Positive runner-launch evidence means
-* the command never ran: foreground calls throw `SANDBOX_UNAVAILABLE`, while
-* background processes carry `runnerFailed`; other spawn rejections retain
-* local-executor semantics. The tool owns approval and passes a complete per-call policy.
+* mode, enforcement, and denial facts. Positive runner-executable evidence
+* identifies a broken confinement runner: foreground calls throw
+* `SANDBOX_UNAVAILABLE`, while background processes carry `runnerFailed`;
+* other provider rejections retain stage-neutral local-executor semantics. The
+* tool owns approval and passes a complete per-call policy.
 * @module @deepseek-ai/dsh-bash-sandbox
 */
 /**
@@ -203,11 +204,11 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 	* Stamp per-process sandbox facts before `done` settles. Full-access processes
 	* have no facts; signal deaths are not denials.
 	*/
-	onProcessDone(proc, stderr, spawnFailed, spawnError) {
+	onProcessDone(proc, stderr, providerRejected, providerError) {
 		const facts = this.processFacts.get(proc);
 		if (facts !== void 0) {
 			this.processFacts.delete(proc);
-			const runnerFailed = spawnFailed ? isRunnerSpawnFailure(spawnError, facts.runnerProgram, facts.workdir) : classifyRunnerFailure(proc.exitCode, stderr, facts.runnerFailureRules) !== void 0;
+			const runnerFailed = providerRejected ? isRunnerSpawnFailure(providerError, facts.runnerProgram, facts.workdir) : classifyRunnerFailure(proc.exitCode, stderr, facts.runnerFailureRules) !== void 0;
 			proc.sandbox = {
 				mode: facts.mode,
 				denied: !runnerFailed && matchesSignature(proc.exitCode, stderr, facts.denialSignatures),
@@ -215,7 +216,7 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 				...runnerFailed ? { runnerFailed } : {}
 			};
 		}
-		super.onProcessDone(proc, stderr, spawnFailed, spawnError);
+		super.onProcessDone(proc, stderr, providerRejected, providerError);
 	}
 	/**
 	* Wrap one shell command via the `ctx.sandbox` provider. Provider errors

package/lib/types/index.d.ts

@@ -1,10 +1,11 @@
 /**
  * Sandbox-consuming bash executor. It wraps the exact local bash argv through
  * `ctx.sandbox`, inherits local process mechanics, and reports the selected
- * mode, enforcement, and denial facts. Positive runner-launch evidence means
- * the command never ran: foreground calls throw `SANDBOX_UNAVAILABLE`, while
- * background processes carry `runnerFailed`; other spawn rejections retain
- * local-executor semantics. The tool owns approval and passes a complete per-call policy.
+ * mode, enforcement, and denial facts. Positive runner-executable evidence
+ * identifies a broken confinement runner: foreground calls throw
+ * `SANDBOX_UNAVAILABLE`, while background processes carry `runnerFailed`;
+ * other provider rejections retain stage-neutral local-executor semantics. The
+ * tool owns approval and passes a complete per-call policy.
  * @module @deepseek-ai/dsh-bash-sandbox
  */
 import { Context } from '@deepseek-ai/cordis';
@@ -52,7 +53,7 @@ export declare class SandboxBashExecutor extends LocalBashExecutor {
      * Stamp per-process sandbox facts before `done` settles. Full-access processes
      * have no facts; signal deaths are not denials.
      */
-    protected onProcessDone(proc: ShellProcess, stderr: string, spawnFailed: boolean, spawnError?: unknown): void;
+    protected onProcessDone(proc: ShellProcess, stderr: string, providerRejected: boolean, providerError?: unknown): void;
     /**
      * Wrap one shell command via the `ctx.sandbox` provider. Provider errors
      * propagate unchanged; the returned argv is handed directly to the local

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-bash-sandbox",
   "description": "Sandbox-consuming implementation of the DeepSeek Harness bash executor seam (confines every command via ctx.sandbox, reports denial/enforcement result facts)",
-  "version": "0.1.2-rc.1",
+  "version": "0.1.5-alpha.1",
   "publishConfig": {
     "access": "public"
   },
@@ -27,21 +27,21 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-shell": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-bash-local": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-shell": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-bash-local": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.5-alpha.1",
     "@deepseek-ai/cordis": "^4.0.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-shell": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-bash-local": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-local": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-rc.1",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/node-addon-landlock-run": "^0.1.1",
-    "@deepseek-ai/dsh-session-projection": "^0.1.2-rc.1"
+    "@deepseek-ai/dsh-bash-local": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-sandbox-local": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-shell": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.5-alpha.1",
+    "@deepseek-ai/node-addon-system": "^0.1.2",
+    "@deepseek-ai/dsh-session-projection": "^0.1.5-alpha.1",
+    "@deepseek-ai/cordis": "^4.0.2"
   }
 }