dsh-win-multi-bash 0.1.2 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.i18n.yaml +2 -2
- package/README.md +33 -21
- package/README.zh.md +32 -20
- package/THIRD_PARTY_NOTICES +2 -3
- package/cordis.patch.yml +48 -54
- package/lib/bash-git/index.js +115 -76
- package/lib/bash-wsl/index.js +71 -37
- package/lib/index.js +9 -6
- package/lib/tool-bash/types/backend.js +41 -0
- package/lib/tool-bash/types/background.js +66 -0
- package/lib/tool-bash/types/factory.js +55 -19
- package/lib/tool-bash/types/git-bash.js +14 -6
- package/lib/tool-bash/types/render.js +0 -29
- package/lib/tool-bash/types/wsl-bash.js +14 -6
- package/package.json +7 -20
- package/lib/bash-git/invariant.js +0 -23
- package/lib/bash-wsl/invariant.js +0 -23
- package/lib/shell-select/index.js +0 -169
- package/lib/shell-select/invariant.js +0 -23
- package/lib/tool-bash/index.js +0 -527
- package/lib/tool-bash/invariant.js +0 -23
- package/lib/tool-bash/types/index.js +0 -16
- package/lib/tool-bash/types/invariant.js +0 -22
package/lib/tool-bash/index.js
DELETED
|
@@ -1,527 +0,0 @@
|
|
|
1
|
-
import z from "@deepseek-ai/schemastery";
|
|
2
|
-
import { isAbsolute, resolve } from "node:path";
|
|
3
|
-
import { TOOL_ABORTED, defineTool } from "@deepseek-ai/dsh-tools";
|
|
4
|
-
import { HarnessError } from "@deepseek-ai/dsh-llm";
|
|
5
|
-
import { ESCALATION_TARGETS, approveEscalation, canonicalPath, escalationHintMarker, sandboxDenialMarker, validateEscalationArgs } from "@deepseek-ai/dsh-sandbox";
|
|
6
|
-
import { DSH_ENV_PREFIX, parseExitStatus } from "@deepseek-ai/dsh-shell";
|
|
7
|
-
//#region lib/types/background.js
|
|
8
|
-
/**
|
|
9
|
-
* Generic-task adaptation for background bash process handles.
|
|
10
|
-
*
|
|
11
|
-
* @module @deepseek-ai/dsh-tool-bash/background
|
|
12
|
-
*/
|
|
13
|
-
/**
|
|
14
|
-
* Map a settled background process onto the generic task-outcome vocabulary:
|
|
15
|
-
* `killed` stays `killed` (detail: the signal when one is known), everything
|
|
16
|
-
* else is `completed` with the exit code as detail. A nonzero command exit is
|
|
17
|
-
* reported, not failed, exactly like the foreground rendering.
|
|
18
|
-
* @param proc - the settled process handle.
|
|
19
|
-
* @returns the outcome for the `ctx.jobs` registration.
|
|
20
|
-
*/
|
|
21
|
-
function processOutcome(proc) {
|
|
22
|
-
if (proc.status === "killed") return {
|
|
23
|
-
status: "killed",
|
|
24
|
-
detail: proc.signal !== null ? `signal: ${proc.signal}` : "killed before exit"
|
|
25
|
-
};
|
|
26
|
-
return {
|
|
27
|
-
status: "completed",
|
|
28
|
-
detail: `exit code: ${proc.exitCode ?? 0}`
|
|
29
|
-
};
|
|
30
|
-
}
|
|
31
|
-
//#endregion
|
|
32
|
-
//#region lib/types/render.js
|
|
33
|
-
/**
|
|
34
|
-
* Model-facing result rendering for the bash tool.
|
|
35
|
-
*
|
|
36
|
-
* @module @deepseek-ai/dsh-tool-bash/render
|
|
37
|
-
*/
|
|
38
|
-
/** Append the truncation notice (with the full-output spill path) to a stream's text. */
|
|
39
|
-
function streamText(output) {
|
|
40
|
-
if (!output.truncated) return output.text;
|
|
41
|
-
return `${output.text}\n[output truncated; full output: ${output.spillPath ?? "(unavailable)"}]`;
|
|
42
|
-
}
|
|
43
|
-
/**
|
|
44
|
-
* Shape one finished run into the text the model sees: stdout, then a marked
|
|
45
|
-
* stderr section, then exit-status markers. Non-zero exits are reported, not
|
|
46
|
-
* errored — the model decides how to react; only infrastructure failures
|
|
47
|
-
* (spawn errors, aborts) surface as isError results.
|
|
48
|
-
* @param result - the completed foreground run from the executor.
|
|
49
|
-
* @param escalationModes - the escalation targets this composition advertises;
|
|
50
|
-
* non-empty adds the same-turn escalation hint after a denial marker
|
|
51
|
-
* (default `[]`: no hint).
|
|
52
|
-
* @returns the model-facing text: output body (or `(no output)`), then any timeout/signal/exit markers, each on its own line.
|
|
53
|
-
*/
|
|
54
|
-
function renderResult(result, escalationModes = []) {
|
|
55
|
-
const out = streamText(result.stdout);
|
|
56
|
-
const err = streamText(result.stderr);
|
|
57
|
-
let body = out;
|
|
58
|
-
if (err.length > 0) {
|
|
59
|
-
if (body.length > 0 && !body.endsWith("\n")) body += "\n";
|
|
60
|
-
body += `[stderr]\n${err}`;
|
|
61
|
-
}
|
|
62
|
-
if (body.length === 0) body = "(no output)";
|
|
63
|
-
const markers = [];
|
|
64
|
-
if (result.sandbox?.denied) {
|
|
65
|
-
markers.push(sandboxDenialMarker(result.sandbox.mode));
|
|
66
|
-
if (escalationModes.length > 0) markers.push(escalationHintMarker("command"));
|
|
67
|
-
}
|
|
68
|
-
if (result.timedOut) markers.push(`[timed out after ${result.timeoutMs}ms]`);
|
|
69
|
-
if (result.signal !== null) markers.push(`[killed by signal: ${result.signal}]`);
|
|
70
|
-
else if (result.exitCode !== 0) markers.push(`[exit code: ${result.exitCode}]`);
|
|
71
|
-
if (markers.length === 0) return body;
|
|
72
|
-
if (!body.endsWith("\n")) body += "\n";
|
|
73
|
-
return body + markers.join("\n");
|
|
74
|
-
}
|
|
75
|
-
/**
|
|
76
|
-
* Shape one background-process read into the `job_output` delta the model
|
|
77
|
-
* sees: the incremental delta, plus the lossy-read notice (with full-stream
|
|
78
|
-
* spill paths) when in-memory truncation dropped unread bytes. Empty-delta
|
|
79
|
-
* rendering (`(no new output)`) is the generic job controller's job.
|
|
80
|
-
* @param read - one incremental read from the process handle.
|
|
81
|
-
* @param sandbox - settled sandbox facts, when this was a confined process.
|
|
82
|
-
* @param escalationModes - escalation targets advertised by this composition.
|
|
83
|
-
* @returns the delta text with any loss or sandbox notice appended.
|
|
84
|
-
*/
|
|
85
|
-
function renderProcessRead(read, sandbox, escalationModes = []) {
|
|
86
|
-
const notices = [];
|
|
87
|
-
if (read.lossy) {
|
|
88
|
-
const paths = [read.stdoutSpillPath, read.stderrSpillPath].filter((path) => path !== void 0);
|
|
89
|
-
notices.push(`[some output was dropped from memory; full output: ${paths.length > 0 ? paths.join(", ") : "(unavailable)"}]`);
|
|
90
|
-
}
|
|
91
|
-
if (sandbox?.runnerFailed) notices.push(`[sandbox: the sandbox runner itself failed under ${sandbox.mode} mode — the command did not run; this is a sandbox problem, not a command failure]`);
|
|
92
|
-
else if (sandbox?.denied) {
|
|
93
|
-
notices.push(sandboxDenialMarker(sandbox.mode));
|
|
94
|
-
if (escalationModes.length > 0) notices.push(escalationHintMarker("command"));
|
|
95
|
-
}
|
|
96
|
-
if (notices.length === 0) return read.delta;
|
|
97
|
-
return `${read.delta}${read.delta.length > 0 && !read.delta.endsWith("\n") ? "\n" : ""}${notices.join("\n")}`;
|
|
98
|
-
}
|
|
99
|
-
//#endregion
|
|
100
|
-
//#region lib/types/factory.js
|
|
101
|
-
/**
|
|
102
|
-
* Model-facing Consumer of the `ctx.shell` capability seam. Background calls
|
|
103
|
-
* register process handles with `ctx.jobs`; their work uses job cancellation
|
|
104
|
-
* rather than the tool-call signal after an id is returned.
|
|
105
|
-
*
|
|
106
|
-
* TODO(permissions): deployment policy belongs in `tools/pre-execute` and
|
|
107
|
-
* sandboxing executors; see docs/architecture.md § Where new behavior goes.
|
|
108
|
-
* @module @deepseek-ai/dsh-tool-bash/factory
|
|
109
|
-
*/
|
|
110
|
-
const DIALECT_FACTS = {
|
|
111
|
-
posix: {
|
|
112
|
-
shell: "bash",
|
|
113
|
-
invoke: "bash -c",
|
|
114
|
-
paths: "POSIX paths",
|
|
115
|
-
env: "$VAR",
|
|
116
|
-
toolchain: "the full Unix toolchain"
|
|
117
|
-
},
|
|
118
|
-
msys: {
|
|
119
|
-
shell: "Git Bash (MSYS2)",
|
|
120
|
-
invoke: "bash -c",
|
|
121
|
-
paths: "MSYS form (`/d/WorkSpace` or `C:\\...`)",
|
|
122
|
-
env: "$VAR",
|
|
123
|
-
note: "MSYS paths work inside Git Bash only — dsh's file tools (`read`, `write`, `edit`) on Windows take native `C:\\...` paths"
|
|
124
|
-
},
|
|
125
|
-
wsl: {
|
|
126
|
-
shell: "WSL Linux",
|
|
127
|
-
invoke: "bash -c",
|
|
128
|
-
paths: "Linux paths (`/mnt/c/...`)",
|
|
129
|
-
env: "$VAR"
|
|
130
|
-
}
|
|
131
|
-
};
|
|
132
|
-
/** Runtime configuration schema for a shell tool instance. */
|
|
133
|
-
const Config$1 = z.object({ enableRunInBackground: z.boolean().default(true) });
|
|
134
|
-
/**
|
|
135
|
-
* The model-facing description of one shell tool instance. The POSIX variant
|
|
136
|
-
* keeps the legacy wording byte-for-byte (the ACP/headless tool-schema
|
|
137
|
-
* fixtures pin it); msys/wsl instances mirror the official tool-pwsh
|
|
138
|
-
* skeleton (fresh shell, paths/env, exit codes, sandbox, truncation,
|
|
139
|
-
* background, escalation) with only their dialect's shell/paths/env facts
|
|
140
|
-
* plus at most one short dialect note.
|
|
141
|
-
* @param dialect - the shell dialect the instance runs.
|
|
142
|
-
* @param backgroundEnabled - whether `run_in_background` is advertised.
|
|
143
|
-
* @param escalationModes - the escalation targets this composition advertises;
|
|
144
|
-
* empty adds no same-turn escalation guidance.
|
|
145
|
-
* @returns the tool description passed to `defineTool`.
|
|
146
|
-
*/
|
|
147
|
-
function shellDescription(dialect, backgroundEnabled, escalationModes) {
|
|
148
|
-
const background = backgroundEnabled ? "Set `run_in_background: true` for long-running commands: the call returns a job id immediately; read its output with `job_output` and stop it with `job_kill`." : "Background execution is not available; long-running commands must finish within the timeout.";
|
|
149
|
-
if (dialect === "posix") return `Execute a bash command (\`bash -c\`) and return its stdout/stderr. Each call runs in a fresh shell: no state (cwd, variables, functions) persists between calls — pass \`workdir\` instead of using \`cd\`. Non-zero exits are reported as \`[exit code: N]\`. Current harness environment facts are exposed through managed \`\$${DSH_ENV_PREFIX}*\` variables; inspect them when needed. Commands may run under a file sandbox; a blocked file operation is reported as \`[sandbox: file access denied under <mode> mode]\` — a policy denial, not a bug in the command; do not retry another way. Long output is truncated to its tail; the full output is saved to a file whose path is reported when available. ` + background + escalationTail(escalationModes);
|
|
150
|
-
const facts = DIALECT_FACTS[dialect];
|
|
151
|
-
const note = facts.note === void 0 ? "" : ` Note: ${facts.note}.`;
|
|
152
|
-
return `Execute a ${facts.shell} command (${facts.invoke}) and return its stdout/stderr. Each call runs in a fresh shell: no state (cwd, variables, functions) persists between calls — pass \`workdir\` instead of using \`cd\`. Paths use ${facts.paths}; read environment variables with ${facts.env}.` + note + ` Non-zero exits are reported as \`[exit code: N]\`. Current harness environment facts are exposed through managed \`\$${DSH_ENV_PREFIX}*\` variables; inspect them when needed. Commands may run under a file sandbox; a blocked file operation is reported as \`[sandbox: file access denied under <mode> mode]\` — a policy denial, not a bug in the command; do not retry another way. Long output is truncated to its tail; the full output is saved to a file whose path is reported when available. ` + background + escalationTail(escalationModes);
|
|
153
|
-
}
|
|
154
|
-
/**
|
|
155
|
-
* The same-turn escalation guidance appended after a denial marker. Kept in
|
|
156
|
-
* one place because every dialect shares the exact approval contract.
|
|
157
|
-
* @param escalationModes - the escalation targets this composition advertises.
|
|
158
|
-
* @returns the guidance sentence, or '' when no escalation is advertised.
|
|
159
|
-
*/
|
|
160
|
-
function escalationTail(escalationModes) {
|
|
161
|
-
if (escalationModes.length === 0) return "";
|
|
162
|
-
return " Attempting a command the sandbox may deny is safe and expected: run it and read the marker rather than assuming the denial. When a command is denied and a wider mode would let it succeed, escalate immediately in the same turn — the one sanctioned exception to a denial: retry the exact same command once with `sandbox_permissions` (the narrowest wider mode that suffices) plus a one-sentence `justification`. Do not detour through chat to ask permission first — the approval prompt raised by that retry is how the user consents. If the session states approval prompts are disabled, there is no exception: a denial is final — do not set `sandbox_permissions`. Never escalate speculatively: ground the request in a real denial — normally the one this command just hit; escalating up front is fine only when this session already denied the same access. A rejected escalation is final for that command — stop and explain, never work around it — but it does not forbid attempting or escalating other commands later.";
|
|
163
|
-
}
|
|
164
|
-
function validateShellArgs(args) {
|
|
165
|
-
if (args.command.trim().length === 0) throw new Error("invalid command: expected a non-empty string");
|
|
166
|
-
if (args.description.trim().length === 0) throw new Error("invalid description: expected a non-empty string");
|
|
167
|
-
if (args.timeoutMs !== void 0 && (!Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) throw new Error(`invalid timeoutMs: expected a positive number, got ${JSON.stringify(args.timeoutMs)}`);
|
|
168
|
-
validateEscalationArgs(args.sandbox_permissions, args.justification);
|
|
169
|
-
}
|
|
170
|
-
function presentShellCall(args) {
|
|
171
|
-
if (args.run_in_background === true) return {
|
|
172
|
-
card: "generic",
|
|
173
|
-
title: args.command,
|
|
174
|
-
kind: "execute",
|
|
175
|
-
rawInput: args.command,
|
|
176
|
-
content: [{
|
|
177
|
-
type: "text",
|
|
178
|
-
text: args.description
|
|
179
|
-
}]
|
|
180
|
-
};
|
|
181
|
-
return {
|
|
182
|
-
card: "terminal",
|
|
183
|
-
title: args.command,
|
|
184
|
-
description: args.description,
|
|
185
|
-
...args.workdir !== void 0 ? { cwd: args.workdir } : {}
|
|
186
|
-
};
|
|
187
|
-
}
|
|
188
|
-
/**
|
|
189
|
-
* Present completed foreground output as a terminal; background acknowledgements
|
|
190
|
-
* and execution errors use generic fenced output without an exit-status pill.
|
|
191
|
-
*/
|
|
192
|
-
function presentShellResult(args, result) {
|
|
193
|
-
const block = result.content.length === 1 ? result.content[0] : void 0;
|
|
194
|
-
if (block === void 0 || block.type !== "text") return void 0;
|
|
195
|
-
const raw = block.text;
|
|
196
|
-
if (typeof args === "object" && args !== null && args.run_in_background === true || result.isError) return {
|
|
197
|
-
card: "generic",
|
|
198
|
-
content: [{
|
|
199
|
-
type: "text",
|
|
200
|
-
text: `\`\`\`console\n${raw.replace(/\n+$/, "")}\n\`\`\``
|
|
201
|
-
}]
|
|
202
|
-
};
|
|
203
|
-
const { body, ...exit } = parseExitStatus(raw);
|
|
204
|
-
return {
|
|
205
|
-
card: "terminal",
|
|
206
|
-
output: body,
|
|
207
|
-
...exit
|
|
208
|
-
};
|
|
209
|
-
}
|
|
210
|
-
/**
|
|
211
|
-
* Resolve an explicit workdir first, making a relative one session-workspace-relative;
|
|
212
|
-
* otherwise use the filesystem identity of the session cwd and leave executor
|
|
213
|
-
* defaulting as the fallback. A resolved sandbox-policy root wins so workdir
|
|
214
|
-
* and confinement use the exact same per-call identity.
|
|
215
|
-
*/
|
|
216
|
-
function resolveWorkdir(modelWorkdir, exec, policyWorkspaceRoot) {
|
|
217
|
-
const headerCwd = exec.agent?.session.header.cwd;
|
|
218
|
-
const sessionCwd = policyWorkspaceRoot ?? (headerCwd === void 0 ? void 0 : canonicalPath(headerCwd));
|
|
219
|
-
if (modelWorkdir === void 0) return sessionCwd;
|
|
220
|
-
if (sessionCwd !== void 0 && !isAbsolute(modelWorkdir)) return resolve(sessionCwd, modelWorkdir);
|
|
221
|
-
return modelWorkdir;
|
|
222
|
-
}
|
|
223
|
-
/** Detach the executor DTO from readonly Service Definition types into plain JSON data. */
|
|
224
|
-
function canonicalShellResult(result) {
|
|
225
|
-
const output = (stream) => ({
|
|
226
|
-
text: stream.text,
|
|
227
|
-
truncated: stream.truncated,
|
|
228
|
-
...stream.spillPath !== void 0 ? { spillPath: stream.spillPath } : {}
|
|
229
|
-
});
|
|
230
|
-
return {
|
|
231
|
-
exitCode: result.exitCode,
|
|
232
|
-
signal: result.signal,
|
|
233
|
-
timedOut: result.timedOut,
|
|
234
|
-
aborted: result.aborted,
|
|
235
|
-
timeoutMs: result.timeoutMs,
|
|
236
|
-
stdout: output(result.stdout),
|
|
237
|
-
stderr: output(result.stderr),
|
|
238
|
-
...result.sandbox !== void 0 ? { sandbox: {
|
|
239
|
-
mode: result.sandbox.mode,
|
|
240
|
-
denied: result.sandbox.denied,
|
|
241
|
-
...result.sandbox.enforcement !== void 0 ? { enforcement: result.sandbox.enforcement } : {},
|
|
242
|
-
...result.sandbox.runnerFailed !== void 0 ? { runnerFailed: result.sandbox.runnerFailed } : {}
|
|
243
|
-
} } : {}
|
|
244
|
-
};
|
|
245
|
-
}
|
|
246
|
-
/** Canonical background-handle properties shared by the shell output union. */
|
|
247
|
-
const BACKGROUND_OUTPUT_PROPERTIES = {
|
|
248
|
-
kind: {
|
|
249
|
-
type: "string",
|
|
250
|
-
required: true,
|
|
251
|
-
const: "background"
|
|
252
|
-
},
|
|
253
|
-
jobId: {
|
|
254
|
-
type: "string",
|
|
255
|
-
required: true
|
|
256
|
-
}
|
|
257
|
-
};
|
|
258
|
-
/**
|
|
259
|
-
* Build a model-facing shell tool plugin. The instance name doubles as the
|
|
260
|
-
* tool name, the approval subject, the prompt section name (`tool:<toolName>`),
|
|
261
|
-
* and the `ctx.jobs` kind; the instance module declares its kind in
|
|
262
|
-
* {@link JobKindMap} via declaration merging.
|
|
263
|
-
* @param def - the instance definition: `toolName` (also the job kind),
|
|
264
|
-
* `shell` (routed to the selector executor when defined), and `dialect`.
|
|
265
|
-
* @returns the complete plugin object (name/inject/Config/apply).
|
|
266
|
-
*/
|
|
267
|
-
function defineShellTool(def) {
|
|
268
|
-
return {
|
|
269
|
-
name: `tool-${def.toolName}`,
|
|
270
|
-
inject: [
|
|
271
|
-
"tools",
|
|
272
|
-
"shell",
|
|
273
|
-
"systemPrompt",
|
|
274
|
-
"shellEnv"
|
|
275
|
-
],
|
|
276
|
-
Config: Config$1,
|
|
277
|
-
apply(ctx, config = {}) {
|
|
278
|
-
const backgroundEnabled = config.enableRunInBackground ?? true;
|
|
279
|
-
const defaultMode = ctx.shell.sandboxMode;
|
|
280
|
-
const escalationModes = defaultMode === void 0 ? [] : ESCALATION_TARGETS;
|
|
281
|
-
const sandboxPolicy = defaultMode === void 0 ? void 0 : ctx.get("sandboxPolicy");
|
|
282
|
-
if (defaultMode !== void 0 && sandboxPolicy === void 0) throw new Error(`tool-${def.toolName}: the mounted bash executor confines but ctx.sandboxPolicy is missing`);
|
|
283
|
-
/** Resolve the complete standing policy for this call when a confining executor is mounted. */
|
|
284
|
-
const resolveSandboxPolicy = (exec) => sandboxPolicy?.resolve(exec.agent === void 0 ? {} : { session: exec.agent.session });
|
|
285
|
-
/**
|
|
286
|
-
* Resolve a sandbox-escalation request through `ctx.approval` BEFORE
|
|
287
|
-
* anything executes, delegating the shared fail-closed sequence (strict
|
|
288
|
-
* widening, channel resolution, outcome mapping) to
|
|
289
|
-
* {@link approveEscalation}. This tool contributes only the composition
|
|
290
|
-
* guard (the fields are unadvertised without a sandboxing executor, yet
|
|
291
|
-
* schema validation checks advertised keys only, so an unadvertised
|
|
292
|
-
* `sandbox_permissions` still reaches execute) and the approval
|
|
293
|
-
* ingredients. The shared policy resolver is required whenever the executor
|
|
294
|
-
* advertises confinement, so a split composition fails at tool-plugin load.
|
|
295
|
-
*/
|
|
296
|
-
const approveShellEscalation = (mode, justification, exec, standingPolicy) => {
|
|
297
|
-
if (escalationModes.length === 0) throw new Error("sandbox_permissions is not available in this composition (no sandboxing executor to escalate)");
|
|
298
|
-
const effectiveMode = standingPolicy.mode;
|
|
299
|
-
return approveEscalation({
|
|
300
|
-
requestedMode: mode,
|
|
301
|
-
justification,
|
|
302
|
-
effectiveMode,
|
|
303
|
-
subject: "command"
|
|
304
|
-
}, {
|
|
305
|
-
approver: ctx.get("approval"),
|
|
306
|
-
agent: exec.agent,
|
|
307
|
-
callId: exec.callId,
|
|
308
|
-
toolName: def.toolName,
|
|
309
|
-
signal: exec.signal
|
|
310
|
-
});
|
|
311
|
-
};
|
|
312
|
-
ctx.systemPrompt.section({
|
|
313
|
-
name: `tool:${def.toolName}`,
|
|
314
|
-
order: 105,
|
|
315
|
-
text: "Check the [exit code: N] marker on every bash result; investigate failures before moving on."
|
|
316
|
-
});
|
|
317
|
-
ctx.tools.register(defineTool({
|
|
318
|
-
name: def.toolName,
|
|
319
|
-
description: shellDescription(def.dialect, backgroundEnabled, escalationModes),
|
|
320
|
-
parameters: {
|
|
321
|
-
command: {
|
|
322
|
-
type: "string",
|
|
323
|
-
required: true,
|
|
324
|
-
description: "The bash command to execute."
|
|
325
|
-
},
|
|
326
|
-
description: {
|
|
327
|
-
type: "string",
|
|
328
|
-
required: true,
|
|
329
|
-
description: "Clear, concise description of what this command does in active voice, 5-10 words (shown in the UI). Examples: \"ls\" → \"List files in current directory\"; \"git status\" → \"Show working tree status\"; \"npm install\" → \"Install package dependencies\"."
|
|
330
|
-
},
|
|
331
|
-
timeoutMs: {
|
|
332
|
-
type: "number",
|
|
333
|
-
description: "Timeout in milliseconds. The executor applies its configured default and cap, and kills the command on expiry."
|
|
334
|
-
},
|
|
335
|
-
workdir: {
|
|
336
|
-
type: "string",
|
|
337
|
-
description: "Working directory for this command. Defaults to the session workspace; a relative path is resolved against it."
|
|
338
|
-
},
|
|
339
|
-
...backgroundEnabled ? { run_in_background: {
|
|
340
|
-
type: "boolean",
|
|
341
|
-
description: "Run in the background and return a job id immediately (collect with job_output, stop with job_kill). No timeout applies."
|
|
342
|
-
} } : {},
|
|
343
|
-
...escalationModes.length > 0 ? {
|
|
344
|
-
sandbox_permissions: {
|
|
345
|
-
type: "string",
|
|
346
|
-
enum: [...escalationModes],
|
|
347
|
-
description: "The wider sandbox mode this command needs. Only valid as a one-shot retry of a command the sandbox just denied; requires justification and user approval."
|
|
348
|
-
},
|
|
349
|
-
justification: {
|
|
350
|
-
type: "string",
|
|
351
|
-
description: "Required with sandbox_permissions: one sentence for the user explaining why this exact command needs the wider access."
|
|
352
|
-
}
|
|
353
|
-
} : {}
|
|
354
|
-
},
|
|
355
|
-
output: {
|
|
356
|
-
schema: { oneOf: [{
|
|
357
|
-
type: "object",
|
|
358
|
-
additionalProperties: false,
|
|
359
|
-
properties: BACKGROUND_OUTPUT_PROPERTIES
|
|
360
|
-
}, {
|
|
361
|
-
type: "object",
|
|
362
|
-
additionalProperties: false,
|
|
363
|
-
properties: {
|
|
364
|
-
kind: {
|
|
365
|
-
type: "string",
|
|
366
|
-
required: true,
|
|
367
|
-
const: "foreground"
|
|
368
|
-
},
|
|
369
|
-
exitCode: {
|
|
370
|
-
required: true,
|
|
371
|
-
oneOf: [{ type: "integer" }, { type: "null" }]
|
|
372
|
-
},
|
|
373
|
-
signal: {
|
|
374
|
-
required: true,
|
|
375
|
-
oneOf: [{ type: "string" }, { type: "null" }]
|
|
376
|
-
},
|
|
377
|
-
timedOut: {
|
|
378
|
-
type: "boolean",
|
|
379
|
-
required: true
|
|
380
|
-
},
|
|
381
|
-
aborted: {
|
|
382
|
-
type: "boolean",
|
|
383
|
-
required: true
|
|
384
|
-
},
|
|
385
|
-
timeoutMs: {
|
|
386
|
-
type: "number",
|
|
387
|
-
required: true
|
|
388
|
-
},
|
|
389
|
-
stdout: {
|
|
390
|
-
type: "object",
|
|
391
|
-
additionalProperties: false,
|
|
392
|
-
required: true,
|
|
393
|
-
properties: {
|
|
394
|
-
text: {
|
|
395
|
-
type: "string",
|
|
396
|
-
required: true
|
|
397
|
-
},
|
|
398
|
-
truncated: {
|
|
399
|
-
type: "boolean",
|
|
400
|
-
required: true
|
|
401
|
-
},
|
|
402
|
-
spillPath: { type: "string" }
|
|
403
|
-
}
|
|
404
|
-
},
|
|
405
|
-
stderr: {
|
|
406
|
-
type: "object",
|
|
407
|
-
additionalProperties: false,
|
|
408
|
-
required: true,
|
|
409
|
-
properties: {
|
|
410
|
-
text: {
|
|
411
|
-
type: "string",
|
|
412
|
-
required: true
|
|
413
|
-
},
|
|
414
|
-
truncated: {
|
|
415
|
-
type: "boolean",
|
|
416
|
-
required: true
|
|
417
|
-
},
|
|
418
|
-
spillPath: { type: "string" }
|
|
419
|
-
}
|
|
420
|
-
},
|
|
421
|
-
sandbox: {
|
|
422
|
-
type: "object",
|
|
423
|
-
additionalProperties: false,
|
|
424
|
-
properties: {
|
|
425
|
-
mode: {
|
|
426
|
-
type: "string",
|
|
427
|
-
required: true
|
|
428
|
-
},
|
|
429
|
-
denied: {
|
|
430
|
-
type: "boolean",
|
|
431
|
-
required: true
|
|
432
|
-
},
|
|
433
|
-
enforcement: { type: "string" },
|
|
434
|
-
runnerFailed: { type: "boolean" }
|
|
435
|
-
}
|
|
436
|
-
}
|
|
437
|
-
}
|
|
438
|
-
}] },
|
|
439
|
-
render: (_args, value) => [{
|
|
440
|
-
type: "text",
|
|
441
|
-
text: value.kind === "background" ? `started background job ${value.jobId}` : renderResult(value, escalationModes)
|
|
442
|
-
}]
|
|
443
|
-
},
|
|
444
|
-
async execute(args, exec) {
|
|
445
|
-
validateShellArgs(args);
|
|
446
|
-
const standingPolicy = resolveSandboxPolicy(exec);
|
|
447
|
-
const approvedMode = args.sandbox_permissions !== void 0 && args.justification !== void 0 ? await approveShellEscalation(args.sandbox_permissions, args.justification, exec, standingPolicy) : void 0;
|
|
448
|
-
const policy = approvedMode === void 0 ? standingPolicy : {
|
|
449
|
-
...standingPolicy,
|
|
450
|
-
mode: approvedMode
|
|
451
|
-
};
|
|
452
|
-
const workdir = resolveWorkdir(args.workdir, exec, standingPolicy?.workspaceRoot);
|
|
453
|
-
const dshEnv = ctx.shellEnv.collect(exec);
|
|
454
|
-
const request = {
|
|
455
|
-
command: args.command,
|
|
456
|
-
...workdir !== void 0 ? { workdir } : {},
|
|
457
|
-
...args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {},
|
|
458
|
-
...def.shell !== void 0 ? { shell: def.shell } : {},
|
|
459
|
-
dshEnv,
|
|
460
|
-
...policy !== void 0 ? { sandboxPolicy: policy } : {}
|
|
461
|
-
};
|
|
462
|
-
if (args.run_in_background === true) {
|
|
463
|
-
if (!backgroundEnabled) throw new Error("run_in_background is disabled for this deployment (enableRunInBackground: false)");
|
|
464
|
-
const jobs = ctx.get("jobs");
|
|
465
|
-
if (jobs === void 0) throw new Error("background jobs unavailable: load @deepseek-ai/dsh-jobs and @deepseek-ai/dsh-tool-jobs");
|
|
466
|
-
if (exec.signal.aborted) {
|
|
467
|
-
const error = new HarnessError("tool call aborted", TOOL_ABORTED);
|
|
468
|
-
error.name = "AbortError";
|
|
469
|
-
throw error;
|
|
470
|
-
}
|
|
471
|
-
return {
|
|
472
|
-
kind: "background",
|
|
473
|
-
jobId: jobs.start({
|
|
474
|
-
kind: def.toolName,
|
|
475
|
-
label: args.command,
|
|
476
|
-
...exec.agent ? { owner: exec.agent } : {},
|
|
477
|
-
run: () => {
|
|
478
|
-
const proc = ctx.shell.start(ctx.shell.resolve(request));
|
|
479
|
-
return {
|
|
480
|
-
cancel: () => void proc.kill(),
|
|
481
|
-
done: proc.done.then(() => processOutcome(proc)),
|
|
482
|
-
readOutput: () => renderProcessRead(proc.readOutput(), proc.sandbox, escalationModes)
|
|
483
|
-
};
|
|
484
|
-
}
|
|
485
|
-
})
|
|
486
|
-
};
|
|
487
|
-
}
|
|
488
|
-
const result = await ctx.shell.run(ctx.shell.resolve({
|
|
489
|
-
...request,
|
|
490
|
-
signal: exec.signal
|
|
491
|
-
}));
|
|
492
|
-
if (result.aborted) {
|
|
493
|
-
const error = new HarnessError("tool call aborted", TOOL_ABORTED);
|
|
494
|
-
error.name = "AbortError";
|
|
495
|
-
throw error;
|
|
496
|
-
}
|
|
497
|
-
return {
|
|
498
|
-
kind: "foreground",
|
|
499
|
-
...canonicalShellResult(result)
|
|
500
|
-
};
|
|
501
|
-
},
|
|
502
|
-
presentCall: presentShellCall,
|
|
503
|
-
presentResult: presentShellResult
|
|
504
|
-
}));
|
|
505
|
-
}
|
|
506
|
-
};
|
|
507
|
-
}
|
|
508
|
-
//#endregion
|
|
509
|
-
//#region lib/types/index.js
|
|
510
|
-
/**
|
|
511
|
-
* The POSIX bash tool instance built by the shared shell-tool factory. Its
|
|
512
|
-
* tool contract is unchanged: no `shell` field, so a selector executor
|
|
513
|
-
* routes it to its configured default; single-backend compositions never
|
|
514
|
-
* notice the field.
|
|
515
|
-
* @module @deepseek-ai/dsh-tool-bash
|
|
516
|
-
*/
|
|
517
|
-
/** The POSIX bash tool (unchanged contract). */
|
|
518
|
-
const bashTool = defineShellTool({
|
|
519
|
-
toolName: "bash",
|
|
520
|
-
dialect: "posix"
|
|
521
|
-
});
|
|
522
|
-
const name = bashTool.name;
|
|
523
|
-
const inject = bashTool.inject;
|
|
524
|
-
const Config = bashTool.Config;
|
|
525
|
-
const apply = bashTool.apply;
|
|
526
|
-
//#endregion
|
|
527
|
-
export { Config, apply, defineShellTool, inject, name };
|
|
@@ -1,23 +0,0 @@
|
|
|
1
|
-
//#region lib/types/invariant.js
|
|
2
|
-
/**
|
|
3
|
-
* Package-owned invariant companion for `@deepseek-ai/dsh-tool-bash`.
|
|
4
|
-
* @module @deepseek-ai/dsh-tool-bash/invariant
|
|
5
|
-
*/
|
|
6
|
-
const PACKAGE_NAME = "@deepseek-ai/dsh-tool-bash";
|
|
7
|
-
/** Cordis companion plugin name. */
|
|
8
|
-
const name = "tool-bash-invariant";
|
|
9
|
-
/** Service required before the companion can reserve package ownership. */
|
|
10
|
-
const inject = ["invariants"];
|
|
11
|
-
/**
|
|
12
|
-
* No runtime invariant: the environment registry validates ownership and collected values at each
|
|
13
|
-
* mutation/read; it publishes no independent snapshot that a companion could cross-check.
|
|
14
|
-
*/
|
|
15
|
-
const install = () => {};
|
|
16
|
-
/**
|
|
17
|
-
* Register this package's invariant companion.
|
|
18
|
-
* @param ctx - Cordis context carrying the invariant service.
|
|
19
|
-
* @returns the installed registration's disposer after setup succeeds.
|
|
20
|
-
*/
|
|
21
|
-
const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
|
|
22
|
-
//#endregion
|
|
23
|
-
export { apply, inject, name };
|
|
@@ -1,16 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* The POSIX bash tool instance built by the shared shell-tool factory. Its
|
|
3
|
-
* tool contract is unchanged: no `shell` field, so a selector executor
|
|
4
|
-
* routes it to its configured default; single-backend compositions never
|
|
5
|
-
* notice the field.
|
|
6
|
-
* @module @deepseek-ai/dsh-tool-bash
|
|
7
|
-
*/
|
|
8
|
-
import { defineShellTool } from "./factory.js";
|
|
9
|
-
/** The POSIX bash tool (unchanged contract). */
|
|
10
|
-
const bashTool = defineShellTool({ toolName: 'bash', dialect: 'posix' });
|
|
11
|
-
export const name = bashTool.name;
|
|
12
|
-
export const inject = bashTool.inject;
|
|
13
|
-
export const Config = bashTool.Config;
|
|
14
|
-
export const apply = bashTool.apply;
|
|
15
|
-
export { defineShellTool } from "./factory.js";
|
|
16
|
-
//# sourceMappingURL=index.js.map
|
|
@@ -1,22 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Package-owned invariant companion for `@deepseek-ai/dsh-tool-bash`.
|
|
3
|
-
* @module @deepseek-ai/dsh-tool-bash/invariant
|
|
4
|
-
*/
|
|
5
|
-
const PACKAGE_NAME = '@deepseek-ai/dsh-tool-bash';
|
|
6
|
-
/** Cordis companion plugin name. */
|
|
7
|
-
export const name = 'tool-bash-invariant';
|
|
8
|
-
/** Service required before the companion can reserve package ownership. */
|
|
9
|
-
export const inject = ['invariants'];
|
|
10
|
-
/**
|
|
11
|
-
* No runtime invariant: the environment registry validates ownership and collected values at each
|
|
12
|
-
* mutation/read; it publishes no independent snapshot that a companion could cross-check.
|
|
13
|
-
*/
|
|
14
|
-
const install = () => { };
|
|
15
|
-
/**
|
|
16
|
-
* Register this package's invariant companion.
|
|
17
|
-
* @param ctx - Cordis context carrying the invariant service.
|
|
18
|
-
* @returns the installed registration's disposer after setup succeeds.
|
|
19
|
-
*/
|
|
20
|
-
export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
|
|
21
|
-
/* jscpd:ignore-end */
|
|
22
|
-
//# sourceMappingURL=invariant.js.map
|