kingwl 2eed448acf feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification ... dsh-bash grows the per-call policy carrier: BashExecRequest.sandboxMode (request-optional, spec required-but-nullable — the owner pattern; resolve() is the one explicit defaulting step) and the BashExecutor.sandboxMode capability fact (undefined in the base class — composition truth the tool layer can read). dsh-bash-local carries the field verbatim and confines nothing. dsh-bash-sandbox extends LocalBashExecutor and hands ctx.sandbox the exact argv it is about to spawn. A denial is a RESULT FACT (the command RAN; result.sandbox.denied is orthogonal to exitCode/signal), classified conservatively against the wrap own dialect; a RUNNER failure outranks denial — foreground re-throws the structured SANDBOX_UNAVAILABLE, a settled background task stamps sandbox.runnerFailed — so a broken sandbox never reads as a failing command and the command never runs unconfined. dsh-tool-bash renders the markers and teaches the model not to retry around a policy denial; escalation and per-session switching are staged follow-ups.		2026-07-10 15:43:02 +08:00
..
codec.spec.ts	refactor(hooks): tighten the hook-protocol contract surface	2026-07-04 15:44:26 +08:00
detached.spec.ts	fix(hooks): drain detached hook runs on bridge dispose	2026-07-06 23:27:54 +08:00
events.spec.ts	restore hook/result durationMs — review keeps wall-clock audit timing durable	2026-07-04 22:00:12 +08:00
matcher.spec.ts	feat(hooks): dsh-hook-protocol — shared Claude Code / Codex hook wire-protocol core	2026-07-01 00:41:53 +08:00
merge.spec.ts	fix(hooks): merge surfaces the WINNING decision's reason, not only deny's	2026-07-01 02:20:12 +08:00
runner.spec.ts	feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification	2026-07-10 15:43:02 +08:00