packages/bash/README.md

# bash/ — bash capability family

English | [中文](README.zh.md)

The canonical three-package capability seam (see [capability seams](../../.agents/notes/implemented/architecture/2026-06-13-capability-seams.md)): an abstract executor interface, concrete implementations, and the model-facing tool that consumes it. All **product** packages.

| Package | Role | ctx key |
|---|---|---|
| `bash/` | Abstract bash executor seam (interface + vocabulary; sandbox result facts carry the [`sandbox/`](../sandbox/README.md) seam's mode/enforcement vocabulary) | `ctx.bash` |
| `bash-local/` | Local-subprocess `BashExecutor` implementation | (registers `ctx.bash`) |
| `bash-sandbox/` | Sandbox-consuming `BashExecutor` (wraps every command argv via `ctx.sandbox`, stamps denial/enforcement facts; extends `bash-local`'s mechanics) | (registers `ctx.bash`) |
| `tool-bash/` | Model-facing `bash` schema; background processes register with the generic [`tasks/`](../tasks/README.md) runtime | (registers on `ctx.tools`) |

The interface lives at `bash/bash/`. `bash-sandbox` replacing `bash-local` without touching the interface or the tool is the split doing exactly what it exists for — a leaf `cordis.yml` picks one executor entry, plus a `ctx.sandbox` provider entry for the confined one (see [the acp-agent example's default composition](../../examples/acp-agent/)).
Document the package hierarchy and finalize the RFC 2026-06-20 23:25:33 +08:00			`# bash/ — bash capability family`

docs: translate remaining READMEs 2026-07-26 05:03:53 +08:00			`English \| [中文](README.zh.md)`

Rename RFCs to Agent Notes 2026-07-19 22:50:49 +08:00			`The canonical three-package capability seam (see [capability seams](../../.agents/notes/implemented/architecture/2026-06-13-capability-seams.md)): an abstract executor interface, concrete implementations, and the model-facing tool that consumes it. All product packages.`
Document the package hierarchy and finalize the RFC 2026-06-20 23:25:33 +08:00
			`\| Package \| Role \| ctx key \|`
			`\|---\|---\|---\|`
feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification 2026-07-09 16:05:44 +08:00			\| `bash/` \| Abstract bash executor seam (interface + vocabulary; sandbox result facts carry the [`sandbox/`](../sandbox/README.md) seam's mode/enforcement vocabulary) \| `ctx.bash` \|
Document the package hierarchy and finalize the RFC 2026-06-20 23:25:33 +08:00			\| `bash-local/` \| Local-subprocess `BashExecutor` implementation \| (registers `ctx.bash`) \|
feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification 2026-07-09 16:05:44 +08:00			\| `bash-sandbox/` \| Sandbox-consuming `BashExecutor` (wraps every command argv via `ctx.sandbox`, stamps denial/enforcement facts; extends `bash-local`'s mechanics) \| (registers `ctx.bash`) \|
Merge remote-tracking branch 'origin/master' into codex/rfc-subagent-background-tasks 2026-07-11 23:04:27 +08:00			\| `tool-bash/` \| Model-facing `bash` schema; background processes register with the generic [`tasks/`](../tasks/README.md) runtime \| (registers on `ctx.tools`) \|
Document the package hierarchy and finalize the RFC 2026-06-20 23:25:33 +08:00
fix(permission): address human review feedback 2026-07-14 01:09:44 +08:00			The interface lives at `bash/bash/`. `bash-sandbox` replacing `bash-local` without touching the interface or the tool is the split doing exactly what it exists for — a leaf `cordis.yml` picks one executor entry, plus a `ctx.sandbox` provider entry for the confined one (see [the acp-agent example's default composition](../../examples/acp-agent/)).