kevchess15/deepseek-harness
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
deepseek-harness/packages/bash/tool-bash/package.json

50 lines
1.6 KiB
JSON
Raw Normal View History

Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
{
"name": "@deepseek-ai/dsh-tool-bash",
"description": "Model-facing bash tools (bash, bash_output, bash_kill) over the DeepSeek Harness bash executor seam",
"version": "0.0.1",
"private": true,
"type": "module",
"main": "lib/index.js",
refactor: rename build typings dir to types
2026-06-20 00:26:02 +08:00
"types": "lib/types/index.d.ts",
Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
"exports": {
".": {
refactor: rename build typings dir to types
2026-06-20 00:26:02 +08:00
"types": "./lib/types/index.d.ts",
Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
"default": "./lib/index.js"
},
"./src/*": "./src/*",
"./package.json": "./package.json"
},
"files": [
refactor: packages/tsconfig.json in packages use lib/typings/ as output subfolder
2026-06-17 23:20:04 +08:00
"lib/index.js",
refactor: rename build typings dir to types
2026-06-20 00:26:02 +08:00
"lib/types/**/*.d.ts",
"lib/types/**/*.d.ts.map",
Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
"src"
],
"license": "BSD-3-Clause",
"peerDependencies": {
"@deepseek-ai/dsh-agent": "^0.0.1",
fix(review): reconcile sandbox and approval contracts
2026-07-11 21:37:38 +08:00
"@deepseek-ai/dsh-user-approval": "^0.0.1",
Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
"@deepseek-ai/dsh-bash": "^0.0.1",
"@deepseek-ai/dsh-llm": "^0.0.1",
feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification dsh-bash grows the per-call policy carrier: BashExecRequest.sandboxMode (request-optional, spec required-but-nullable — the owner pattern; resolve() is the one explicit defaulting step) and the BashExecutor.sandboxMode capability fact (undefined in the base class — composition truth the tool layer can read). dsh-bash-local carries the field verbatim and confines nothing. dsh-bash-sandbox extends LocalBashExecutor and hands ctx.sandbox the exact argv it is about to spawn. A denial is a RESULT FACT (the command RAN; result.sandbox.denied is orthogonal to exitCode/signal), classified conservatively against the wrap own dialect; a RUNNER failure outranks denial — foreground re-throws the structured SANDBOX_UNAVAILABLE, a settled background task stamps sandbox.runnerFailed — so a broken sandbox never reads as a failing command and the command never runs unconfined. dsh-tool-bash renders the markers and teaches the model not to retry around a policy denial; escalation and per-session switching are staged follow-ups.
2026-07-09 16:05:44 +08:00
"@deepseek-ai/dsh-sandbox": "^0.0.1",
feat(system-prompt): prompt variables, persona-as-section, tool-guidance ownership One principle: every fact in the assembled prompt has exactly one owner. - dsh-system-prompt: merge-extensible AssembleContext on assemble(); a variable(name, provider) registry; {{name}} interpolation in renderPrompt, strict (unknown/valueless/malformed references throw); duplicate section and variable names rejected; assembly carries resolved section text + variables through the assemble waterfall. - dsh-agent declares AssembleContext.agent; dsh-agent-loop registers the agent:persona section (order 0 - identity renders before tool guidance) and the model/cwd variables, and drops its string join: renderPrompt(assembly) IS the full prompt. - Tool guidance moves to its owners: descriptions carry per-tool semantics; sections only cross-call habits (tool:bash exit-code habit at order 105; read's not-shell nudge). todo/subagent need no section - their descriptions already carry the contract. - SubagentProvider.inheritsParentContext (spawn/acp false, fork true); dsh-tool-subagent derives truthful per-provider wording and resolves the provider at load (backend must be listed first). - Example personas shrink to identity + behavior with {{model}} (and {{cwd}} in the ACP tree); the welcome banner stops enumerating tools. RFC: docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md
2026-07-05 01:54:46 +08:00
"@deepseek-ai/dsh-system-prompt": "^0.0.1",
Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
"@deepseek-ai/dsh-tools": "^0.0.1",
"cordis": "^4.0.0-rc.6"
},
"devDependencies": {
feat: migrate to pnpm
2026-06-16 14:55:37 +08:00
"@deepseek-ai/dsh-agent": "workspace:^",
"@deepseek-ai/dsh-agent-loop": "workspace:^",
fix(review): reconcile sandbox and approval contracts
2026-07-11 21:37:38 +08:00
"@deepseek-ai/dsh-user-approval": "workspace:^",
feat: migrate to pnpm
2026-06-16 14:55:37 +08:00
"@deepseek-ai/dsh-bash": "workspace:^",
"@deepseek-ai/dsh-bash-local": "workspace:^",
feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification dsh-bash grows the per-call policy carrier: BashExecRequest.sandboxMode (request-optional, spec required-but-nullable — the owner pattern; resolve() is the one explicit defaulting step) and the BashExecutor.sandboxMode capability fact (undefined in the base class — composition truth the tool layer can read). dsh-bash-local carries the field verbatim and confines nothing. dsh-bash-sandbox extends LocalBashExecutor and hands ctx.sandbox the exact argv it is about to spawn. A denial is a RESULT FACT (the command RAN; result.sandbox.denied is orthogonal to exitCode/signal), classified conservatively against the wrap own dialect; a RUNNER failure outranks denial — foreground re-throws the structured SANDBOX_UNAVAILABLE, a settled background task stamps sandbox.runnerFailed — so a broken sandbox never reads as a failing command and the command never runs unconfined. dsh-tool-bash renders the markers and teaches the model not to retry around a policy denial; escalation and per-session switching are staged follow-ups.
2026-07-09 16:05:44 +08:00
"@deepseek-ai/dsh-bash-sandbox": "workspace:^",
feat: migrate to pnpm
2026-06-16 14:55:37 +08:00
"@deepseek-ai/dsh-llm": "workspace:^",
feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification dsh-bash grows the per-call policy carrier: BashExecRequest.sandboxMode (request-optional, spec required-but-nullable — the owner pattern; resolve() is the one explicit defaulting step) and the BashExecutor.sandboxMode capability fact (undefined in the base class — composition truth the tool layer can read). dsh-bash-local carries the field verbatim and confines nothing. dsh-bash-sandbox extends LocalBashExecutor and hands ctx.sandbox the exact argv it is about to spawn. A denial is a RESULT FACT (the command RAN; result.sandbox.denied is orthogonal to exitCode/signal), classified conservatively against the wrap own dialect; a RUNNER failure outranks denial — foreground re-throws the structured SANDBOX_UNAVAILABLE, a settled background task stamps sandbox.runnerFailed — so a broken sandbox never reads as a failing command and the command never runs unconfined. dsh-tool-bash renders the markers and teaches the model not to retry around a policy denial; escalation and per-session switching are staged follow-ups.
2026-07-09 16:05:44 +08:00
"@deepseek-ai/dsh-sandbox": "workspace:^",
"@deepseek-ai/dsh-sandbox-local": "workspace:^",
feat(tool-bash): sandbox escalation — one approved wider retry after a denial The tool gate advertises sandbox_permissions (an enum of exactly the modes STRICTLY WIDER than the mounted executor default — the schema makes a non-widening request inexpressible) plus a required justification, exactly when ctx.bash.sandboxMode reports a confining mode at registration: composition truth, never a dead lever. An escalating call resolves ctx.approval BEFORE anything executes with the audit-self-contained reason "escalate sandbox to <mode>: <justification>"; allowed-once stamps the granted mode onto that one bash request (the seam-level per-call override), while rejected / cancelled / unavailable and the no-service / no-agent paths each fail closed with their own error text and execute nothing. The description teaches the flow only when the fields exist: retry the SAME command once after a real denial, never preemptively; a rejected escalation is final. No new session events: the attempt is an ordinary tool/call, the decision is the approval audit pair, the outcome an ordinary tool/result whose facts name the mode it ran under.
2026-07-09 16:37:10 +08:00
"@deepseek-ai/dsh-session": "workspace:^",
feat: migrate to pnpm
2026-06-16 14:55:37 +08:00
"@deepseek-ai/dsh-system-prompt": "workspace:^",
"@deepseek-ai/dsh-tools": "workspace:^",
Add bash execution: dsh-bash seam, dsh-bash-local impl, dsh-tool-bash tools Three packages following the new capability-seam pattern (interface / implementation / consumer, now documented in docs/architecture.md): - dsh-bash: abstract BashExecutor service (ctx.bash) + vocabulary types. - dsh-bash-local: local subprocesses — bash -c per call in a detached process group, SIGTERM→SIGKILL group kills, tail-keep truncation with full-stream spill files, model-friendly env, background task registry. - dsh-tool-bash: the bash / bash_output / bash_kill tool schemas with runtime arg validation and background completion notices via agent.inject(). Non-zero exits are reported, not errored. Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi (notes in the package READMEs). Permissions/sandbox stay TODO on the tools/execute waterfall seam; stateful-shell alternatives recorded in run.ts.
2026-06-12 23:28:44 +08:00
"cordis": "^4.0.0-rc.6"
}
}
Reference in a new issue Copy permalink