[sandbox] Denials reported on stdout are not classified, so the escalation hint never appears

[whyself]

Version: DSH 0.2.1-alpha.2, Linux (Docker container, Landlock runner, "partial enforcement (older Landlock ABI)"), workspace-write sandbox, ask approval policy, @deepseek-ai/dsh-tool-bash.

What happens

A bash tool call fails because the sandbox denies a write outside the writable roots, but the result has neither the [sandbox: file access denied under workspace-write mode] marker nor the escalation hint. The model therefore does not learn that this was a policy denial, and works around it (for example by overriding XDG_CONFIG_HOME) instead of retrying with sandbox_permissions.

Real example: running npx astro dev --help in a project. Astro's telemetry tries mkdir '/data/config/astro' (outside the writable roots) and prints the error on stdout:

EACCES: permission denied, mkdir '/data/config/astro'
  Location:
    .../node_modules/@astrojs/telemetry/dist/config.js:56:8
[stderr]
landlock-run: partial enforcement (older Landlock ABI)
[status: completed, exit code: 1]

stderr only contains the informational launcher line, so no denial is detected.

Why (from reading the code)

dsh-sandbox-local matches DENIAL_SIGNATURES (landlock: ["permission denied"], bwrap: ["read-only file system"], ...) against stderr only. Any program that reports file errors on stdout is missed, and so is any command that merges the streams with 2>&1, which agents do often.

Suggestion

Also classify a denial when the exit code is non-zero and the signature appears on stdout, or determine the denial from the attempted path (outside the writable roots) rather than from the output text, so the existing escalation hint reaches the model.

[argszero]

Your reading of the code is correct, and the gap is slightly narrower than "stderr only" — there are three places that would each have to learn about stdout, and only one of them decides whether the model is told.

1. The classifier is stderr-only by construction.

classifyDenial (packages/shell/bash-sandbox/src/helpers.ts:12) is a one-liner over matchesSignature(result.exitCode, result.stderr.text, signatures), and matchesSignature (packages/sandbox/sandbox/src/diagnostics.ts:96) takes exactly (exitCode, stderr, signatures). Same shape in the pwsh twin (packages/shell/pwsh-sandbox/src/helpers.ts:115) and in the PTC node runtime (packages/ptc-runtime/ptc-runtime-node/src/index.ts:300). The result of that call is stamped as sandbox: { mode, denied } on the run result, so denied is false for your Astro case — correctly, given what it was asked.

2. The marker and the hint are produced by the render layer, not by the classifier.

packages/shell/tool-bash/src/render.ts:46-49 (foreground) and background.ts:26-27 are the only places that call sandboxDenialMarker(mode) / escalationHintMarker('command'), and both are gated on result.sandbox?.denied. The hint has a second gate: it is emitted only when the composition passes a non-empty escalationModes into the renderer. So even if denied were flipped, the hint's presence is a property of the composition, not of the call.

That pairing is worth knowing because it splits the fix in two: the marker is a pure function of denied and will render itself in the canonical position (before the trailing [exit code: N], which parseExitStatus anchors on); the hint cannot be produced by any value change and needs the composition to expose escalation.

3. Why 2>&1 and stdout reporters both escape.

landlock: ['permission denied'] / bwrap: ['read-only file system'] / seatbelt: ['operation not permitted'] are matched against one stream. A program that reports the failing path on stdout (Astro here), or any command that merges the streams, produces a non-zero exit with an unrecognised stderr — indistinguishable from an ordinary command failure. Note the table also requires a non-zero exit, so a tool that swallows the failure and still exits 0 is invisible no matter which stream carries the text.

On the suggestion. "Determine the denial from the attempted path rather than from the output text" is strictly better in principle but needs a fact the current design does not carry to that point: the set of writable roots is the policy, while the matched signatures travel on the wrap (ConfinedArgv.denialSignatures) precisely because each runner speaks a different dialect. Path-based inference would have to reconstruct the mode's writable roots and reason about paths that failed for unrelated reasons (ENOENT, a full disk, a EACCES from the target's own permissions rather than from confinement) — which is why the signature table is the current evidence. The stdout classification you propose is the smaller, more conservative step, and it is the one that closes your actual report.

One correction to the write-up, since it changes what a fix has to touch: DENIAL_SIGNATURES (packages/sandbox/sandbox-local/src/index.ts:207) is a module-private const — it is not exported from the package, so any consumer outside dsh-sandbox-local that wants to classify must mirror the table (with a version-pinned calibration test) rather than import it.

The instance of this I would most want to be sure about is your landlock-run: partial enforcement (older Landlock ABI) line: that is the launcher's informational line, and it is also the thing that tells you the ABI is old enough that some effects were not confined. A denial that landed on stdout in that configuration is a denial you can trust; a non-denial is one you cannot conclude much from.

[argszero]

A plugin-shaped fix for the stdout half of this is now published, in case it is useful while the classifier itself is unchanged:

@argszero/dsh-stdout-denial-guard — https://www.npmjs.com/package/@argszero/dsh-stdout-denial-guard (source: https://github.com/argszero/dsh-stdout-denial-guard)

npm install @argszero/dsh-stdout-denial-guard

Mount it, or apply the bundle patch it ships:

- insert:
    - id: stdout-denial-guard
      name: '@argszero/dsh-stdout-denial-guard'

What it does, and what it deliberately does not do. It does not print a marker of its own. tools/post-execute accepts a replacement value, and the registry re-runs the tool's own output contract over it — so the plugin sets the one field tool-bash's renderer already reads (sandbox.denied) and lets the harness render [sandbox: file access denied under <mode> mode] in its own position, ahead of the exit marker. In the suite's harness this is observable rather than asserted: the renderer is invoked twice for one call, the second time seeing denied: true.

The one thing that cannot travel that way is the escalation hint, because it is gated on an escalationModes argument captured in the tool's own closure. That line rides the decision's additionalContexts, carrying the harness's own escalationHintMarker imported rather than paraphrased — and it is attached only when the tool actually advertises escalation (probed by the presence of sandbox_permissions in the registered definition's parameters.properties), so it never tells the model to retry with a parameter its tool does not have.

The predicate is deliberately narrow, because a false positive is worse here than a missed marker: a non-zero exit, a confining mode, not killed by a timeout/abort/signal, sandbox.denied exactly false, a dialect signature present on stdout and absent from stderr (the second half is what keeps it from second-guessing the harness when the harness already answered), and the value has to actually be a foreground shell result. It stands down rather than overriding when another listener blocked the call or replaced the result's content, and it fails open — a guard whose bug breaks working tool calls is worse than the failure it prevents.

mode: 'report' counts and logs the same denials and writes nothing, which is how you can measure how often your runner reports on stdout before trusting the repair; the read-only stdout_denial_report tool answers with the counters including the denominator, so "nothing was missed" can be told apart from "the listener never ran".

Two limits worth naming honestly: it inherits the harness's substring-matching limit (a runner whose dialect is not in the table is not recognised), and it classifies by dialect, so a command that swallowed its own failure and exited 0 stays unclassified. The underlying fix — matching stdout in matchesSignature, not stderr only — is still the right upstream change; this only closes the model's side of it for as long as it is mounted.