bashkit 0.5.0__tar.gz → 0.6.0__tar.gz

{bashkit-0.5.0 → bashkit-0.6.0}/Cargo.lock

@@ -345,11 +345,12 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bashkit"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "base64",
+ "bigdecimal",
  "chrono",
  "clap",
  "criterion",
@@ -359,6 +360,7 @@ dependencies = [
  "flate2",
  "futures-core",
  "futures-util",
+ "getrandom 0.4.2",
  "hmac 0.13.0",
  "insta",
  "jaq-core",
@@ -366,6 +368,8 @@ dependencies = [
  "jaq-std",
  "md-5",
  "monty",
+ "num-traits",
+ "os_display",
  "pretty_assertions",
  "proptest",
  "rand 0.10.1",
@@ -386,6 +390,7 @@ dependencies = [
  "tower",
  "tracing",
  "turso_core",
+ "unit-prefix",
  "url",
  "zapcode-core",
  "zeroize",
@@ -393,7 +398,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-bench"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -407,7 +412,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-cli"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -423,18 +428,21 @@ dependencies = [
 
 [[package]]
 name = "bashkit-coreutils-port"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "prettyplease",
  "proc-macro2",
  "quote",
+ "serde",
  "syn",
+ "tempfile",
+ "toml",
 ]
 
 [[package]]
 name = "bashkit-eval"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -451,7 +459,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-js"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bashkit",
  "napi",
@@ -464,7 +472,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-python"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "bashkit",
  "num-bigint",
@@ -1813,11 +1821,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
  "wasip2",
  "wasip3",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -3045,6 +3055,15 @@ dependencies = [
  "indexmap",
 ]
 
+[[package]]
+name = "os_display"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad5fd71b79026fb918650dde6d125000a233764f1c2f1659a1c71118e33ea08f"
+dependencies = [
+ "unicode-width 0.2.2",
+]
+
 [[package]]
 name = "owo-colors"
 version = "3.5.0"
@@ -4781,6 +4800,15 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "serdect"
 version = "0.4.2"
@@ -5363,9 +5391,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.1"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
  "libc",
@@ -5433,6 +5461,45 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -5755,6 +5822,12 @@ dependencies = [
  "rand 0.8.6",
 ]
 
+[[package]]
+name = "unit-prefix"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
+
 [[package]]
 name = "universal-hash"
 version = "0.5.1"
@@ -6237,6 +6310,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "winnow"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee1708bef14716a11bae175f579062d4554d95be2c6829f518df847b7b3fdd0"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"

{bashkit-0.5.0 → bashkit-0.6.0}/Cargo.toml

@@ -7,7 +7,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.5.0"
+version = "0.6.0"
 edition = "2024"
 license = "MIT"
 authors = ["Everruns"]
@@ -69,7 +69,19 @@ ed25519-dalek = { version = "2", features = ["rand_core"] }
 rand = "0.10"
 zeroize = "1"
 
+# CSPRNG for placeholder token generation (security-grade randomness).
+# Important decision: enable `wasm_js` so the public `wasm32-unknown-unknown`
+# build gate stays green; bashkit targets JS-backed wasm for that triple.
+# Used by the credential placeholder generator; getrandom is the lowest-level
+# CSPRNG primitive and is already transitively in the dep tree via reqwest/rustls.
+getrandom = { version = "0.4", features = ["wasm_js"] }
+
 # CLI
+# Intentionally NOT enabling clap's `env` feature: it makes `Arg::env(...)`
+# read defaults from `std::env`, which would tunnel host process state into
+# the bashkit sandbox (TM-INF-023). The coreutils-args-port codegen strips
+# `.env(...)` chains from vendored Arg builders; dropping the feature here
+# is defence-in-depth so any re-introduction fails to compile.
 clap = { version = "4", features = ["derive"] }
 
 # Testing

{bashkit-0.5.0 → bashkit-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bashkit
-Version: 0.5.0
+Version: 0.6.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -41,6 +41,8 @@ Project-URL: Repository, https://github.com/everruns/bashkit
 
 Sandboxed bash interpreter for Python. Native bindings to the `bashkit` Rust core for fast, in-process execution with a virtual filesystem.
 
+Homepage: [bashkit.sh](https://bashkit.sh)
+
 ## Features
 
 - Sandboxed execution in-process, without containers or subprocess orchestration

{bashkit-0.5.0/crates/bashkit-python → bashkit-0.6.0}/README.md

@@ -4,6 +4,8 @@
 
 Sandboxed bash interpreter for Python. Native bindings to the `bashkit` Rust core for fast, in-process execution with a virtual filesystem.
 
+Homepage: [bashkit.sh](https://bashkit.sh)
+
 ## Features
 
 - Sandboxed execution in-process, without containers or subprocess orchestration

{bashkit-0.5.0 → bashkit-0.6.0}/crates/bashkit/Cargo.toml

@@ -68,6 +68,9 @@ ed25519-dalek = { workspace = true, optional = true }
 rand = { workspace = true, optional = true }
 zeroize = { workspace = true, optional = true }
 
+# CSPRNG for credential placeholder generation
+getrandom = { workspace = true }
+
 # Checksums (for md5sum, sha1sum, sha256sum builtins)
 md-5 = { workspace = true }
 sha1 = { workspace = true }
@@ -81,6 +84,15 @@ tracing = { workspace = true, optional = true }
 # argument surfaces. Always on — see specs/coreutils-args-port.md.
 clap = { workspace = true }
 
+# Pinned to uutils' workspace versions. Used by the vendored
+# uucore::format module (see crates/bashkit/src/builtins/generated/format)
+# that backs `printf`. Kept platform-clean — no rustix / errno
+# transitive deps — so wasm32 stays buildable.
+bigdecimal = "0.4"
+num-traits = "0.2"
+unit-prefix = "0.5"
+os_display = "0.1.3"
+
 # Embedded Python interpreter (optional)
 monty = { git = "https://github.com/pydantic/monty", rev = "49faa4c", optional = true }
 

{bashkit-0.5.0 → bashkit-0.6.0}/crates/bashkit/README.md

@@ -8,6 +8,8 @@
 
 Awesomely fast virtual sandbox with bash and file system. Written in Rust.
 
+Homepage: [bashkit.sh](https://bashkit.sh)
+
 ## Features
 
 - **Secure by default** - No process spawning, no filesystem access, no network access unless explicitly enabled. [250+ threats](specs/threat-model.md) analyzed and mitigated
@@ -21,7 +23,6 @@ Awesomely fast virtual sandbox with bash and file system. Written in Rust.
 - **LLM tool contract** - `BashTool` with discovery metadata, streaming output, and system prompts
 - **Snapshotting** - Serialize shell state and VFS contents for checkpoint/resume workflows
 - **Scripted tool orchestration** - Compose ToolDef+callback pairs into multi-tool bash scripts (`scripted_tool` feature)
-- **MCP server** - Model Context Protocol endpoint via `bashkit mcp`
 - **Async-first** - Built on tokio
 - **Language bindings** - Python (PyO3) and JavaScript/TypeScript (NAPI-RS) for Node.js, Bun, and Deno
 - **Experimental: Git support** - Virtual git operations on the virtual filesystem (`git` feature)
@@ -372,17 +373,15 @@ mountable.mount("/data", Arc::new(InMemoryFs::new()));
 
 ```bash
 # Run a script
-bashkit run script.sh
+bashkit script.sh
 
 # Interactive REPL
-bashkit repl
+bashkit
 
-# MCP server (Model Context Protocol)
-bashkit mcp
 
 # Mount real filesystem (read-only or read-write)
-bashkit run script.sh --mount-ro /data
-bashkit run script.sh --mount-rw /workspace
+bashkit --mount-ro /data script.sh
+bashkit --mount-rw /workspace script.sh
 ```
 
 ## Development

bashkit-0.6.0/crates/bashkit/src/builtins/clap_env.rs

@@ -0,0 +1,255 @@
+//! Virtual-env shim for clap-based ported builtins.
+//!
+//! uutils' `uu_app()` ships `Arg::env("FOO")` to default options like
+//! `TIME_STYLE` / `BLOCK_SIZE` / `LS_COLORS` from the host process
+//! environment. bashkit sandboxes scripts inside `ctx.env`, so codegen
+//! strips `.env(...)` from the runtime Arg chain (TM-INF-024) and
+//! instead emits a sidecar `<UTIL>_ENV_DEFAULTS: &[EnvDefault]` table
+//! recording what was stripped.
+//!
+//! `apply_env_defaults` reads that table plus the caller's virtual
+//! `ctx.env` and rewrites argv before clap sees it, emulating clap's
+//! own "argv > env > default" precedence — but sourced from the
+//! sandbox, never `std::env`. One bashkit-side seam, one audit point.
+
+use std::collections::HashMap;
+use std::ffi::OsString;
+
+/// How an `Arg`'s value materialises on the command line. Mirrors the
+/// shape of the clap chain we found `.env(...)` next to.
+//
+// `Multi` and (later) other variants are reserved for upcoming codegen
+// emissions — current ported utils only exercise `Single`. Allow dead
+// code so the surface stays committed without forcing a port that
+// uses it on day one.
+#[allow(dead_code)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EnvKind {
+    /// `--<long> <value>`. The default for value-bearing options
+    /// (uutils' `TIME_STYLE`, `TABSIZE`, `BLOCK_SIZE`, …).
+    Single,
+    /// `--<long>` with no value. uutils sets `.action(SetTrue)` for
+    /// boolean env-defaulted toggles (none ported yet but reserved
+    /// so codegen can emit them without shim changes). Truthy iff
+    /// the env value is non-empty (matches clap's behaviour).
+    Bool,
+    /// Multi-value, comma-or-delim-separated. uutils uses
+    /// `.value_delimiter(',')` for things like
+    /// `LS_COLORS`-adjacent lists. We push `--<long>` once with the
+    /// raw value; clap re-splits it via its own delimiter setting.
+    Multi,
+}
+
+/// One stripped `.env(...)` annotation, harvested at codegen time.
+///
+/// Lives in `static`-friendly form so generated files can place these
+/// in a `&'static [EnvDefault]` slice without any runtime allocation.
+#[derive(Debug, Clone, Copy)]
+pub struct EnvDefault {
+    /// `Arg::new(arg_id)` — matches `ArgMatches::ids()` post-parse.
+    /// Carried so callers / round-trip diagnostics can correlate a
+    /// default back to its clap option even though the shim itself
+    /// only needs `long`. Held intentionally; suppress the unused-field
+    /// warning until a consumer reaches for it.
+    #[allow(dead_code)]
+    pub arg_id: &'static str,
+    /// `Arg::long(long)` — the long flag we synthesise into argv.
+    pub long: &'static str,
+    /// The env-var name uutils originally pulled from `std::env`.
+    /// We read this from `ctx.env` instead.
+    pub env_var: &'static str,
+    /// Drives the argv shape we synthesise.
+    pub kind: EnvKind,
+}
+
+/// Inject env-sourced defaults into argv before handing it to clap.
+///
+/// Precedence (matches clap's own `Arg::env`):
+///   1. argv (if user already passed `--<long>` or `--<long>=…`, leave it).
+///   2. ctx.env[env_var] (if set, synthesise `--<long> <value>`).
+///   3. clap's `.default_value(...)` (untouched).
+///
+/// `argv[0]` is the program name (clap convention); we never inspect or
+/// modify it. Synthesised entries are appended *after* the existing
+/// argv; clap doesn't care about positional order for flags. Positional
+/// arguments are unaffected — none of the env-bound uutils args are
+/// positional.
+///
+/// Empty env value = unset, intentionally:
+///   - For `Single`/`Multi`, clap would reject an empty value via
+///     `NonEmptyStringValueParser` anyway (uutils' default for these).
+///   - For `Bool`, clap's own `Arg::env` matches "non-empty" as truthy.
+pub fn apply_env_defaults(
+    mut argv: Vec<OsString>,
+    defaults: &[EnvDefault],
+    env: &HashMap<String, String>,
+) -> Vec<OsString> {
+    for d in defaults {
+        if argv_has_long(&argv, d.long) {
+            continue;
+        }
+        let Some(val) = env.get(d.env_var) else {
+            continue;
+        };
+        if val.is_empty() {
+            continue;
+        }
+        let long_flag = format!("--{}", d.long);
+        match d.kind {
+            EnvKind::Bool => argv.push(OsString::from(long_flag)),
+            EnvKind::Single | EnvKind::Multi => {
+                argv.push(OsString::from(long_flag));
+                argv.push(OsString::from(val));
+            }
+        }
+    }
+    argv
+}
+
+/// Returns `true` iff argv already specifies `--<long>` (with or
+/// without an attached `=value`). Matches clap's own
+/// "is-this-flag-already-set" check shape, modulo short flags — uutils
+/// only env-defaults options that have a `.long(...)`, so we only check
+/// the long form. Skips index 0 (program name).
+fn argv_has_long(argv: &[OsString], long: &str) -> bool {
+    let exact = format!("--{long}");
+    let prefix = format!("--{long}=");
+    argv.iter().skip(1).any(|a| {
+        let Some(s) = a.to_str() else {
+            return false;
+        };
+        s == exact || s.starts_with(&prefix)
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn argv(parts: &[&str]) -> Vec<OsString> {
+        parts.iter().map(OsString::from).collect()
+    }
+
+    fn env(pairs: &[(&str, &str)]) -> HashMap<String, String> {
+        pairs
+            .iter()
+            .map(|(k, v)| ((*k).to_string(), (*v).to_string()))
+            .collect()
+    }
+
+    const TIME_STYLE: EnvDefault = EnvDefault {
+        arg_id: "time-style",
+        long: "time-style",
+        env_var: "TIME_STYLE",
+        kind: EnvKind::Single,
+    };
+    const TABSIZE: EnvDefault = EnvDefault {
+        arg_id: "tab-size",
+        long: "tabsize",
+        env_var: "TABSIZE",
+        kind: EnvKind::Single,
+    };
+    const COLOR_TOGGLE: EnvDefault = EnvDefault {
+        arg_id: "color",
+        long: "color",
+        env_var: "CLICOLOR",
+        kind: EnvKind::Bool,
+    };
+
+    #[test]
+    fn single_value_env_synthesised_when_argv_silent() {
+        let out = apply_env_defaults(
+            argv(&["ls"]),
+            &[TIME_STYLE],
+            &env(&[("TIME_STYLE", "long-iso")]),
+        );
+        assert_eq!(out, argv(&["ls", "--time-style", "long-iso"]));
+    }
+
+    #[test]
+    fn argv_long_overrides_env_default() {
+        let out = apply_env_defaults(
+            argv(&["ls", "--time-style", "iso"]),
+            &[TIME_STYLE],
+            &env(&[("TIME_STYLE", "long-iso")]),
+        );
+        // ctx.env value not appended; original argv preserved verbatim.
+        assert_eq!(out, argv(&["ls", "--time-style", "iso"]));
+    }
+
+    #[test]
+    fn argv_long_equals_form_overrides_env_default() {
+        let out = apply_env_defaults(
+            argv(&["ls", "--time-style=iso"]),
+            &[TIME_STYLE],
+            &env(&[("TIME_STYLE", "long-iso")]),
+        );
+        assert_eq!(out, argv(&["ls", "--time-style=iso"]));
+    }
+
+    #[test]
+    fn missing_env_var_leaves_argv_alone() {
+        let out = apply_env_defaults(argv(&["ls"]), &[TIME_STYLE], &env(&[]));
+        assert_eq!(out, argv(&["ls"]));
+    }
+
+    #[test]
+    fn empty_env_value_is_treated_as_unset() {
+        // Matches clap::Arg::env behaviour: empty == not set for value
+        // options (NonEmptyStringValueParser would reject anyway).
+        let out = apply_env_defaults(argv(&["ls"]), &[TIME_STYLE], &env(&[("TIME_STYLE", "")]));
+        assert_eq!(out, argv(&["ls"]));
+    }
+
+    #[test]
+    fn bool_kind_appends_flag_only() {
+        let out = apply_env_defaults(argv(&["ls"]), &[COLOR_TOGGLE], &env(&[("CLICOLOR", "1")]));
+        assert_eq!(out, argv(&["ls", "--color"]));
+    }
+
+    #[test]
+    fn multiple_defaults_processed_independently() {
+        let out = apply_env_defaults(
+            argv(&["ls"]),
+            &[TIME_STYLE, TABSIZE],
+            &env(&[("TIME_STYLE", "iso"), ("TABSIZE", "4")]),
+        );
+        assert_eq!(out, argv(&["ls", "--time-style", "iso", "--tabsize", "4"]));
+    }
+
+    #[test]
+    fn does_not_read_std_env() {
+        // Sanity: a var present on the host process but absent from
+        // ctx.env must NOT leak through. Belt-and-braces against
+        // future regressions of TM-INF-024; the fn signature already
+        // forbids std::env access (no &std::env::Vars argument).
+        // SAFETY: `std::env::set_var` is unsafe in 2024 edition; this
+        // test reads its own var only, doesn't race with anything.
+        unsafe { std::env::set_var("TIME_STYLE_HOST_LEAK_PROBE", "leaked") };
+        let out = apply_env_defaults(
+            argv(&["ls"]),
+            &[EnvDefault {
+                arg_id: "probe",
+                long: "probe",
+                env_var: "TIME_STYLE_HOST_LEAK_PROBE",
+                kind: EnvKind::Single,
+            }],
+            &env(&[]), // empty virtual env
+        );
+        unsafe { std::env::remove_var("TIME_STYLE_HOST_LEAK_PROBE") };
+        assert_eq!(out, argv(&["ls"]));
+    }
+
+    #[test]
+    fn argv_program_name_is_never_matched_as_flag() {
+        // If someone passes argv[0] = "--time-style" by mistake, we
+        // must still inject the env default — argv[0] is the program
+        // name slot per clap convention.
+        let out = apply_env_defaults(
+            argv(&["--time-style"]),
+            &[TIME_STYLE],
+            &env(&[("TIME_STYLE", "iso")]),
+        );
+        assert_eq!(out, argv(&["--time-style", "--time-style", "iso"]));
+    }
+}

{bashkit-0.5.0 → bashkit-0.6.0}/crates/bashkit/src/builtins/export.rs

@@ -27,6 +27,9 @@ impl Builtin for Export {
             return Ok(ExecResult::ok(output));
         }
 
+        let mut stderr = String::new();
+        let mut exit_code = 0;
+
         for arg in ctx.args {
             // Handle NAME=VALUE format
             if let Some(eq_pos) = arg.find('=') {
@@ -34,17 +37,19 @@ impl Builtin for Export {
                 let value = &arg[eq_pos + 1..];
                 // Validate variable name
                 if !is_valid_var_name(name) {
-                    return Ok(ExecResult::err(
-                        format!("export: `{}': not a valid identifier\n", arg),
-                        1,
-                    ));
+                    stderr.push_str(&format!("export: `{arg}': not a valid identifier\n"));
+                    exit_code = 1;
+                    continue;
                 }
                 // THREAT[TM-INJ-015]: Block internal variable prefix injection via export
                 if is_internal_variable(name) {
                     continue;
                 }
-                // THREAT[TM-INJ-021]: Refuse to overwrite readonly variables
+                // THREAT[TM-INJ-021]: Refuse to overwrite readonly variables and
+                // surface the error so callers cannot mistake a silent skip for success.
                 if ctx.variables.contains_key(&format!("_READONLY_{}", name)) {
+                    stderr.push_str(&format!("bash: export: {name}: readonly variable\n"));
+                    exit_code = 1;
                     continue;
                 }
                 ctx.variables.insert(name.to_string(), value.to_string());
@@ -54,6 +59,10 @@ impl Builtin for Export {
             }
         }
 
-        Ok(ExecResult::ok(String::new()))
+        Ok(ExecResult {
+            stderr,
+            exit_code,
+            ..Default::default()
+        })
     }
 }