@deepseek-ai/dsh-bash-sandbox 0.1.5-rc.1 → 0.1.6-alpha.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/shell/bash-sandbox/README.md
-README.md: f28ecaefce8c2a5508fcee34473ffc00d7348d98
-README.zh.md: 996b0b0a21cf67c3087c76e06bd0115b88d2350c
+README.md: d9dbc85252a202dc7800eb727abd7700f5989fae
+README.zh.md: 23ca4b5c59da2998b2b0aa546954591bf62da546

package/README.md

@@ -75,7 +75,7 @@ This section explains the design of the executor and points at the code that rea
 
 ### Design concept
 
-The executor is the sandboxing Service Provider for the `ctx.shell` seam: it inherits `dsh-bash-local`'s process mechanics and re-wraps each command's exact `['bash', '-c', command]` argv through `ctx.sandbox.confine()`, spawning the returned argv directly. Which platform runner confines the command — and whether one is usable at all — is the provider's concern; this package owns the bash side only: the selected mode, enforcement completeness, and denial classification on results.
+The executor is the sandboxing Service Provider for the `ctx.shell` seam: it inherits `dsh-bash-local`'s process mechanics and awaits confinement of each command's exact `['bash', '-c', command]` argv through `ctx.sandbox.confine()`, spawning the returned argv directly. Foreground preparation uses the local executor’s shared command deadline; timeout before spawn carries no enforcement claim. Background preparation follows only the caller signal. Both paths recheck cancellation before spawn. Which platform runner confines the command — and whether one is usable at all — is the provider's concern; this package owns the bash side only: the selected mode, enforcement completeness, and denial classification on results.
 
 ### Source map
 
@@ -83,7 +83,7 @@ The executor is the sandboxing Service Provider for the `ctx.shell` seam: it inh
 |---|---|
 | [`src/index.ts`](src/index.ts) | Plugin entry: `SandboxBashExecutor`, per-process fact retention, run/start wrapping |
 | [`src/helpers.ts`](src/helpers.ts) | Denial, runner-failure, and runner-spawn-failure classification |
-| — | No runtime invariant companion is published; this package exposes no independent event sequence or mutable data relation beyond contracts enforced at its owning seam. |
+| — | No runtime invariant companion is published; classification is observable in results, and this package exposes no independent event sequence or mutable data relation beyond contracts enforced at its owning seam. |
 | `tests/` | Exercised behavior across the bwrap, Landlock, and Seatbelt runners |
 
 ### Main flow
@@ -92,7 +92,7 @@ For a confined mode, `resolve()` stamps the per-call policy (the session's mode
 
 ### Invariants
 
-- **Fail closed** — a confined mode with no usable runner throws `SANDBOX_UNAVAILABLE`; unconfined passthrough never happens for a confined policy.
+- **Fail closed** — a confined mode with no usable runner rejects with `SANDBOX_UNAVAILABLE`; unconfined passthrough never happens for a confined policy.
 - **Deny-only at the seam** — this executor never grants permission; the approval flow lives in the tool layer.
 - **Per-process facts** — confinement facts are retained per handle until settlement, because a provider may vary enforcement between overlapping calls.
 - **File effects only** — the mode vocabulary claims only file effects.
@@ -170,7 +170,7 @@ These limits define when this executor is not a general security boundary. They
 
 - **Confinement covers file effects only** — network restriction and a uniform process-visibility guarantee are absent, so the modes are not a general-purpose security sandbox.
 - **Denials are inferred from failed-command stderr** — backend signatures make the inference portable, but a matching application error can be classified as a denial and a denial omitted from the retained tail can be missed.
-- **An asynchronously observed background runner failure has no immediate error channel** — it is recorded on the settled process and surfaces when the caller reads the generic task with `job_output`; a synchronous subprocess throw that names the runner path instead fails `start()` immediately.
+- **An asynchronously observed background runner failure has no immediate error channel** — it is recorded on the settled process and surfaces when the caller reads the generic task with `job_output`; a synchronous subprocess throw that names the runner path rejects `start()` before a handle is published.
 - **`danger-full-access` deliberately bypasses `ctx.sandbox`** — it is an explicit unconfined mode, not a wider sandbox profile.
 
 <a id="dev-note"></a>

package/README.zh.md

@@ -25,7 +25,7 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用本包
 
-当命令不得以 harness 进程的完整文件权限运行时，用本执行器替代 `dsh-bash-local`。它注册为 `ctx.shell`，并要求一个 `ctx.sandbox` 提供方加上 `ctx.sandboxPolicy`；面向模型的 `bash` 工具基于它不加改动地工作，并公布 `sandbox_permissions`/`justification` 升权字段。
+当命令不得以 harness 进程的完整文件权限运行时，用本执行器替代 `dsh-bash-local`。它注册为 `ctx.shell`，并要求一个 `ctx.sandbox` 提供方加上 `ctx.sandboxPolicy`；面向模型的 `bash` 工具基于它不加改动地工作，并公布 `sandbox_permissions` 与 `justification` 升权字段。
 
 ### 何时选择
 
@@ -71,11 +71,11 @@ kind: "package-reference"
 <details>
 <summary>实现细节——点击展开</summary>
 
-本节解释执行器的设计并指出实现它们的代码位置；可观察行为已在[使用本包](#use-this-package)中完整说明。
+本节解释执行器的设计并指出实现该设计的代码位置；可观察行为已在[使用本包](#use-this-package)中完整说明。
 
 ### 设计概念
 
-本执行器是 `ctx.shell` seam 的沙箱 Service Provider：它继承 `dsh-bash-local` 的进程机制，把每条命令的精确 `['bash', '-c', command]` argv 经 `ctx.sandbox.confine()` 重新包装，并直接 spawn 返回的 argv。由哪种平台 runner 限制命令、以及是否有 runner 可用，属于提供方职责；本包只负责 bash 侧：所选模式、强制执行完整度，以及结果上的拒绝分类。
+本执行器是 `ctx.shell` seam 的沙箱 Service Provider：它继承 `dsh-bash-local` 的进程机制，通过 `ctx.sandbox.confine()` 等待每条命令的精确 `['bash', '-c', command]` argv 完成限制准备，再直接 spawn 返回的 argv。前台准备使用本地执行器与命令共享的 deadline；在 spawn 前超时不会声明 enforcement 事实。后台准备只跟随调用方信号。两条路径都在 spawn 前重新检查取消状态。由哪种平台 runner 限制命令、以及是否有 runner 可用，属于提供方职责；本包只负责 bash 侧：所选模式、强制执行完整度，以及结果上的拒绝分类。
 
 ### 源码地图
 
@@ -83,7 +83,7 @@ kind: "package-reference"
 |---|---|
 | [`src/index.ts`](src/index.ts) | 插件入口：`SandboxBashExecutor`、按进程保留事实、run/start 包装 |
 | [`src/helpers.ts`](src/helpers.ts) | 拒绝、runner 失败与 runner spawn 失败分类 |
-| — | 不发布运行时不变式伴生入口；分类在结果中可观察。 |
+| — | 不发布运行时不变式伴生入口；分类可在结果中观察，且除归属 seam 所强制执行的约定外，本包不公开独立事件序列或可变数据关系。 |
 | `tests/` | 跨 bwrap、Landlock 与 Seatbelt runner 演练的行为 |
 
 ### 主要流程
@@ -92,7 +92,7 @@ kind: "package-reference"
 
 ### 不变式
 
-- **失败关闭**——受限模式没有可用 runner 时抛 `SANDBOX_UNAVAILABLE`；受限策略绝不会出现无隔离直通。
+- **失败关闭**——受限模式没有可用 runner 时以 `SANDBOX_UNAVAILABLE` 拒绝；受限策略绝不会出现无隔离直通。
 - **seam 只报告拒绝**——本执行器从不授予权限；批准流程位于工具层。
 - **按进程保留事实**——隔离事实在结算前按句柄保留，因为提供方可能在重叠调用之间改变强制执行方式。
 - **只约束文件影响**——模式词汇只声称文件影响。
@@ -141,7 +141,7 @@ kind: "package-reference"
 
 #### Token 影响
 
-除普通输出外，正常允许的运行不会增加 token。拒绝或失败会增加上述有条件标记，并保留到上下文压缩。
+除普通输出外，正常允许的运行不会增加 token。拒绝或失败会增加上述有条件标记，并保留到上下文压缩（context compaction）。
 
 #### KV Cache 影响
 
@@ -151,7 +151,7 @@ kind: "package-reference"
 
 #### 模型看到的内容
 
-如果没有 runner 能强制执行受限模式，前台调用会传播来自 sandbox seam 的 `SANDBOX_UNAVAILABLE` 错误。带有 `ENOENT`/`EACCES` 路径或 syscall 证据并指向 `argv[0]` 的 provider rejection 会把原始错误作为 runner-failure 详情；其他 rejection 保持不声明阶段的 provider error。已结算的 runner 失败以匹配到的致命 stderr 行作为详情，并保留原始 stderr 收集结果；追加的 `Runner failure: <detail>` 是权威诊断，优先于通用的 `SANDBOX_UNAVAILABLE` 前缀。
+如果没有 runner 能强制执行受限模式，前台调用会传播来自 sandbox seam 的 `SANDBOX_UNAVAILABLE` 错误。当提供方拒绝带有 `ENOENT`／`EACCES` 路径或 syscall 证据并指向 `argv[0]` 时，会把原始错误作为 runner 失败详情；其他拒绝仍是与阶段无关的提供方错误。已结算的 runner 失败以匹配到的致命 stderr 行作为详情，并保留原始 stderr 收集结果；追加的 `Runner failure: <detail>` 是权威诊断，优先于通用的 `SANDBOX_UNAVAILABLE` 前缀。
 
 #### Token 影响
 
@@ -170,7 +170,7 @@ kind: "package-reference"
 
 - **限制只覆盖文件影响**——不提供网络限制和统一的进程可见性保证，因此这些模式不是通用安全沙箱。
 - **拒绝从失败命令的 stderr 推断**——后端特征使该推断可跨平台使用，但包含相同特征的应用错误可能被分类为拒绝，也可能遗漏未出现在保留尾部中的拒绝。
-- **异步观测到的后台 runner 失败没有即时错误通道**——它记录在已结算进程上，并在调用方用 `job_output` 读取通用任务时呈现；同步抛出且指明 runner 路径的 subprocess 错误则会让 `start()` 立即失败。
+- **异步观测到的后台 runner 失败没有即时错误通道**——它记录在已结算进程上，并在调用方用 `job_output` 读取通用任务时呈现；同步 subprocess throw 若指明 runner 路径，则会在发布句柄前拒绝 `start()`。
 - **`danger-full-access` 有意绕过 `ctx.sandbox`**——它是显式无约束模式，不是更宽的沙箱 profile。
 
 <a id="dev-note"></a>
@@ -179,6 +179,6 @@ kind: "package-reference"
 <details>
 <summary>维护者的工作上下文——点击展开</summary>
 
-None.
+无。
 
 </details>

package/lib/index.js

@@ -1,50 +1,7 @@
-import { SandboxUnavailableError } from "@deepseek-ai/dsh-sandbox";
+import { SandboxUnavailableError, classifyRunnerFailure, isRunnerSpawnFailure, matchesSignature, matchesSignature as matchesSignature$1 } from "@deepseek-ai/dsh-sandbox";
 import { LocalBashExecutor } from "@deepseek-ai/dsh-bash-local";
-import { accessSync, constants, statSync } from "node:fs";
 //#region lib/types/helpers.js
 /**
-* Internal sandbox-result classification helpers.
-*
-* @module @deepseek-ai/dsh-bash-sandbox/helpers
-*/
-/** Node-local spawn codes proven to identify executable resolution or permission failure. */
-const EXECUTABLE_SPAWN_CODES = new Set(["EACCES", "ENOENT"]);
-/** Whether the caller-owned spawn cwd can be entered. */
-function isUsableWorkdir(path) {
-	try {
-		if (!statSync(path).isDirectory()) return false;
-		accessSync(path, constants.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Attribute only Node ENOENT/EACCES failures whose error path equals argv[0]
-* after independently ruling out the caller-owned cwd. A supplied error path
-* must exactly identify the runner; without one, the syscall must. With a
-* usable cwd, these codes describe resolution or execute permission for that
-* argv[0] or its shebang interpreter.
-* The workdir is checked at classification time, not atomically with spawn;
-* concurrent path replacement may change attribution but cannot permit an
-* unconfined execution.
-* @param error - the original spawn rejection.
-* @param runnerProgram - provider argv[0], the executable that establishes confinement.
-* @param workdir - the caller-owned spawn cwd, checked independently for usability.
-* @returns whether the rejection has executable-specific runner evidence.
-*/
-function isRunnerSpawnFailure(error, runnerProgram, workdir) {
-	if (runnerProgram === void 0 || !isUsableWorkdir(workdir)) return false;
-	if (typeof error !== "object" || error === null) return false;
-	const { code, path, syscall } = error;
-	if (typeof code !== "string" || !EXECUTABLE_SPAWN_CODES.has(code)) return false;
-	if (typeof syscall !== "string") return false;
-	const exactSyscall = `spawn ${runnerProgram}`;
-	if (path === void 0) return syscall === exactSyscall;
-	if (typeof path !== "string" || path.length === 0 || path !== runnerProgram) return false;
-	return syscall === "spawn" || syscall === exactSyscall;
-}
-/**
 * Classify a failed run against the selected backend's denial dialect.
 * @param result - settled foreground run.
 * @param signatures - case-insensitive denial substrings from the active wrap.
@@ -53,42 +10,6 @@ function isRunnerSpawnFailure(error, runnerProgram, workdir) {
 function classifyDenial(result, signatures) {
 	return matchesSignature(result.exitCode, result.stderr.text, signatures);
 }
-/**
-* Classify one settled process against the selected backend's structured
-* runner-failure rules. Each rule requires a nonzero exit, its optional
-* exit-code gate, and a fatal signature on one stderr line after exact
-* informational lines are excluded.
-* @param exitCode - process exit code; null means signal termination.
-* @param stderr - collected stderr text, left unchanged.
-* @param rules - structured runner-failure rules from the active wrap.
-* @returns the first matching fatal line, or undefined when evidence is insufficient.
-*/
-function classifyRunnerFailure(exitCode, stderr, rules) {
-	if (exitCode === null || exitCode === 0) return void 0;
-	const lines = stderr.split(/\r?\n/);
-	for (const rule of rules) {
-		if (rule.allowedExitCodes !== void 0 && !rule.allowedExitCodes.includes(exitCode)) continue;
-		const informationalLines = new Set((rule.informationalLines ?? []).map((line) => line.toLowerCase()));
-		const fatalSignatures = rule.fatalSignatures.filter((signature) => signature.trim().length > 0).map((signature) => signature.toLowerCase());
-		for (const line of lines) {
-			const lowered = line.toLowerCase();
-			if (informationalLines.has(lowered)) continue;
-			if (fatalSignatures.some((signature) => lowered.includes(signature))) return { detail: line };
-		}
-	}
-}
-/**
-* Match a non-zero exit against case-insensitive stderr signatures.
-* @param exitCode - process exit code; null means signal termination.
-* @param stderr - collected stderr text.
-* @param signatures - substrings identifying the selected backend's dialect.
-* @returns whether this is a non-zero exit whose stderr matches a signature.
-*/
-function matchesSignature(exitCode, stderr, signatures) {
-	if (exitCode === null || exitCode === 0) return false;
-	const lowered = stderr.toLowerCase();
-	return signatures.some((signature) => lowered.includes(signature.toLowerCase()));
-}
 //#endregion
 //#region lib/types/index.js
 /**
@@ -151,37 +72,52 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 				denied: false
 			}
 		};
-		const confined = this.confine(spec.command, {
-			...policy,
-			mode
-		});
+		let confined;
 		let result;
+		let spawnRequested;
 		try {
-			result = await this.runArgv(spec, confined.argv);
+			({result, spawnRequested} = await this.runArgv(spec, async (signal) => {
+				const prepared = await this.confine(spec.command, {
+					...policy,
+					mode
+				}, signal);
+				signal.throwIfAborted();
+				confined = prepared;
+				return prepared.argv;
+			}));
 		} catch (error) {
 			if (spec.signal?.aborted === true) spec.signal.throwIfAborted();
-			if (isRunnerSpawnFailure(error, confined.argv[0], spec.workdir)) throw new SandboxUnavailableError(mode, String(error));
+			if (confined !== void 0 && isRunnerSpawnFailure(error, confined.argv[0], spec.workdir)) throw new SandboxUnavailableError(mode, String(error));
 			throw error;
 		}
-		const runnerFailure = classifyRunnerFailure(result.exitCode, result.stderr.text, confined.runnerFailureRules);
+		if (!spawnRequested) return {
+			...result,
+			sandbox: {
+				mode,
+				denied: false
+			}
+		};
+		const facts = confined;
+		const runnerFailure = classifyRunnerFailure(result.exitCode, result.stderr.text, facts.runnerFailureRules);
 		if (runnerFailure !== void 0) throw new SandboxUnavailableError(mode, runnerFailure.detail);
 		return {
 			...result,
 			sandbox: {
 				mode,
-				denied: classifyDenial(result, confined.denialSignatures),
-				enforcement: confined.enforcement
+				denied: classifyDenial(result, facts.denialSignatures),
+				enforcement: facts.enforcement
 			}
 		};
 	}
-	start(spec) {
+	async start(spec) {
 		const policy = spec.sandboxPolicy;
 		const { mode } = policy;
 		if (mode === "danger-full-access") return super.start(spec);
-		const confined = this.confine(spec.command, {
+		const confined = await this.confine(spec.command, {
 			...policy,
 			mode
-		});
+		}, spec.signal);
+		spec.signal?.throwIfAborted();
 		let proc;
 		try {
 			proc = this.startArgv(spec, confined.argv);
@@ -211,7 +147,7 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 			const runnerFailed = providerRejected ? isRunnerSpawnFailure(providerError, facts.runnerProgram, facts.workdir) : classifyRunnerFailure(proc.exitCode, stderr, facts.runnerFailureRules) !== void 0;
 			proc.sandbox = {
 				mode: facts.mode,
-				denied: !runnerFailed && matchesSignature(proc.exitCode, stderr, facts.denialSignatures),
+				denied: !runnerFailed && matchesSignature$1(proc.exitCode, stderr, facts.denialSignatures),
 				enforcement: facts.enforcement,
 				...runnerFailed ? { runnerFailed } : {}
 			};
@@ -224,14 +160,15 @@ var SandboxBashExecutor = class extends LocalBashExecutor {
 	* executor's subprocess path.
 	* @param command - shell source for the confined inner `bash -c`.
 	* @param policy - resolved confined execution policy.
+	* @param signal - cancellation of confinement preparation.
 	* @returns the provider's exact argv and settlement-classification facts.
 	*/
-	confine(command, policy) {
+	confine(command, policy, signal) {
 		return this.ctx.sandbox.confine([
 			"bash",
 			"-c",
 			command
-		], policy);
+		], policy, signal);
 	}
 };
 //#endregion

package/lib/types/helpers.d.ts

@@ -1,30 +1,6 @@
-/**
- * Internal sandbox-result classification helpers.
- *
- * @module @deepseek-ai/dsh-bash-sandbox/helpers
- */
+/** Shell-result projection over shared sandbox diagnostics. */
 import type { ShellRunResult } from '@deepseek-ai/dsh-shell';
-import type { RunnerFailureRule } from '@deepseek-ai/dsh-sandbox';
-/**
- * Attribute only Node ENOENT/EACCES failures whose error path equals argv[0]
- * after independently ruling out the caller-owned cwd. A supplied error path
- * must exactly identify the runner; without one, the syscall must. With a
- * usable cwd, these codes describe resolution or execute permission for that
- * argv[0] or its shebang interpreter.
- * The workdir is checked at classification time, not atomically with spawn;
- * concurrent path replacement may change attribution but cannot permit an
- * unconfined execution.
- * @param error - the original spawn rejection.
- * @param runnerProgram - provider argv[0], the executable that establishes confinement.
- * @param workdir - the caller-owned spawn cwd, checked independently for usability.
- * @returns whether the rejection has executable-specific runner evidence.
- */
-export declare function isRunnerSpawnFailure(error: unknown, runnerProgram: string | undefined, workdir: string): boolean;
-/** Fatal runner evidence retained for infrastructure-error detail. */
-interface RunnerFailureMatch {
-    /** The original stderr line that matched a fatal signature. */
-    detail: string;
-}
+export { isRunnerSpawnFailure, classifyRunnerFailure, matchesSignature } from '@deepseek-ai/dsh-sandbox';
 /**
  * Classify a failed run against the selected backend's denial dialect.
  * @param result - settled foreground run.
@@ -32,24 +8,4 @@ interface RunnerFailureMatch {
  * @returns whether the failed run matches that denial dialect.
  */
 export declare function classifyDenial(result: ShellRunResult, signatures: readonly string[]): boolean;
-/**
- * Classify one settled process against the selected backend's structured
- * runner-failure rules. Each rule requires a nonzero exit, its optional
- * exit-code gate, and a fatal signature on one stderr line after exact
- * informational lines are excluded.
- * @param exitCode - process exit code; null means signal termination.
- * @param stderr - collected stderr text, left unchanged.
- * @param rules - structured runner-failure rules from the active wrap.
- * @returns the first matching fatal line, or undefined when evidence is insufficient.
- */
-export declare function classifyRunnerFailure(exitCode: number | null, stderr: string, rules: readonly RunnerFailureRule[]): RunnerFailureMatch | undefined;
-/**
- * Match a non-zero exit against case-insensitive stderr signatures.
- * @param exitCode - process exit code; null means signal termination.
- * @param stderr - collected stderr text.
- * @param signatures - substrings identifying the selected backend's dialect.
- * @returns whether this is a non-zero exit whose stderr matches a signature.
- */
-export declare function matchesSignature(exitCode: number | null, stderr: string, signatures: readonly string[]): boolean;
-export {};
 //# sourceMappingURL=helpers.d.ts.map

package/lib/types/index.d.ts

@@ -48,7 +48,7 @@ export declare class SandboxBashExecutor extends LocalBashExecutor {
      */
     resolve(request: ShellExecRequest): ShellExecSpec;
     run(spec: ShellExecSpec): Promise<ShellRunResult>;
-    start(spec: ShellExecSpec): ShellProcess;
+    start(spec: ShellExecSpec): Promise<ShellProcess>;
     /**
      * Stamp per-process sandbox facts before `done` settles. Full-access processes
      * have no facts; signal deaths are not denials.
@@ -60,6 +60,7 @@ export declare class SandboxBashExecutor extends LocalBashExecutor {
      * executor's subprocess path.
      * @param command - shell source for the confined inner `bash -c`.
      * @param policy - resolved confined execution policy.
+     * @param signal - cancellation of confinement preparation.
      * @returns the provider's exact argv and settlement-classification facts.
      */
     private confine;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-bash-sandbox",
   "description": "Sandbox-consuming implementation of the DeepSeek Harness bash executor seam (confines every command via ctx.sandbox, reports denial/enforcement result facts)",
-  "version": "0.1.5-rc.1",
+  "version": "0.1.6-alpha.1",
   "publishConfig": {
     "access": "public"
   },
@@ -27,21 +27,21 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-shell": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-bash-local": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-shell": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-bash-local": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.6-alpha.1",
     "@deepseek-ai/cordis": "^4.0.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-shell": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox-local": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-bash-local": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-shell": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-bash-local": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox-local": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.6-alpha.1",
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/node-addon-system": "^0.1.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.5-rc.1"
+    "@deepseek-ai/dsh-session-projection": "^0.1.6-alpha.1"
   }
 }