dsh-context-guard 0.1.1

English

Highlights

• DSH Web foreground bash checks can now provide successful evidence when the pinned renderer completes cleanly without emitting an [exit code: 0] marker.
• Fail-closed boundaries are unchanged: background execution, negative terminal facts, unsupported command syntax, and the unverified generic shell alias still cannot certify completion.

Changes

• Clean foreground bash results are treated as success only when there is no error, timeout, sandbox denial, signal, interruption, or non-zero exit marker.
• Command parsing remains independent from execution outcome, so a successful unsupported command still receives no certifiable operation or subject.

Validation

• The release suite contains 106 tests, including 86 domain/core tests.
• The macOS candidate runtime replayed a genuine durable DSH Web log and certified the matching scope contracts; Windows native acceptance re-verified the existing bounded PowerShell write-plus-read model without expanding the Windows Bash claim.
• The exact release commit passed the full Ubuntu, macOS, and Windows CI matrix on Node.js 22 and 24 for both main and v0.1.1.

Full changelog

简体中文

重点

• 当前台 bash 检查在固定 DSH 渲染器中干净完成但没有输出 [exit code: 0] marker 时，DSH Web 现在也能派生成功证据。
• fail-closed 边界保持不变：后台执行、负面终端事实、不受支持的命令语法以及未经验证的通用 shell 别名仍不能认证完成。

变更

• 只有不存在 error、超时、沙箱拒绝、信号、中断或非零退出 marker 时，前台 bash 的干净结果才会判定为成功。
• 命令解析与执行 outcome 仍然分离，因此成功执行但语法不受支持的命令依旧不会获得可认证的 operation 或 subject。

验证

• 本版本包含 106 项测试，其中 domain/core 86 项。
• macOS 候选运行时重放了真实、durable 的 DSH Web 日志并认证匹配的 scope 合同；Windows 原生验收重新确认既有的受限 PowerShell 写入加独立读取模型，未扩张 Windows Bash 声明。
• 同一 release commit 在 main 与 v0.1.1 上均通过 Ubuntu、macOS、Windows × Node.js 22、24 的完整 CI 矩阵。

完整更新日志