Local-subprocess implementation of the @deepseek-ai/dsh-bash executor seam: LocalBashExecutor spawns bash -c <command> per call in its own process group, collects bounded output with full-stream spill files, and escalates kills SIGTERM→SIGKILL across the whole group.

Config

- id: bash
  name: '@deepseek-ai/dsh-bash-local'
  config:
    cwd: /path/to/workspace   # default: process.cwd()
    timeoutMs: 120000          # default foreground timeout
    maxTimeoutMs: 600000       # cap for per-call overrides
    maxOutputBytes: 64000      # per-stream in-memory cap; overflow spills to disk
    graceMs: 3000              # SIGTERM→SIGKILL escalation grace on kills

Behavior (and where it came from)

Design surveyed against the bash tools of Claude Code, OpenCode, Codex, and pi; the notable choices:

Spawn per call, no shell state — every call is a fresh non-login bash -c (deterministic; no rc files). All four surveyed tools spawn per call. XXX(stateful-shell) in src/run.ts records the two proven stateful designs (Claude Code's cwd-only persistence; Codex's PTY exec sessions) for when real workflows demand them.
Process-group kills with escalation — children are spawned detached (own process group); kills send SIGTERM to the group, then SIGKILL after the graceMs grace (default 3s — OpenCode's escalation; pipelines and subshells die with the parent). ESRCH is tolerated; daemons that re-parent away from the group can still survive — same caveat as the surveyed tools.
Tail-keep truncation + spill files — output beyond maxOutputBytes keeps the in-memory TAIL (errors/results cluster at the end — pi/OpenCode rationale) while the FULL stream is appended to a temp file whose path is reported when available. If the final spill close reports a delayed writeback failure, the executor still returns the tail but withholds the path rather than advertising a possibly incomplete file.
Model-friendly env + credential/namespace scrub — start with process.env minus credential-shaped vars (*KEY*/*SECRET*/*TOKEN*) and every DSH_*, then apply NO_COLOR=1 TERM=dumb PAGER=cat GIT_PAGER=cat. Ordinary spec env is merged next and may restore caller-held credential-shaped values, but is rejected if it tries to set reserved DSH_*; the trusted spec dshEnv snapshot is merged last. This keeps ambient secrets out and prevents a nested/previous harness identity from surviving when the current registry omits it. The spec's stdin, when supplied, is written to the child and closed; with none supplied, fd 0 is /dev/null. See the bash-stdin-env RFC and the session environment RFC.
Background tasks — start() returns immediately, no timeout applies (Claude Code detaches timeouts when backgrounding), readOutput() is incremental with whole-stream byte offsets, and disposal kills everything. The spec's opaque owner token is stored on the tracked task and returned by ownerOf(id) — the executor never interprets it (the consumer's access policy does), and because it lives with the task here it survives a tool-bash HMR reload.

Sandboxing

Execution policy does NOT belong in this package: this executor always runs commands unconfined. Confinement is dsh-bash-sandbox, which extends this executor verbatim and confines commands under the ctx.sandbox seam's bwrap/Landlock/Seatbelt backends (sandbox RFC); per-call allow/deny/ask policy belongs on the tools/pre-execute gate.