Files limited to the session's folders, network only through the allow-list proxy, no secrets in the environment.
A folder granted while a session runs restarts the sandbox and tells the agent (both providers).
On macOS the executor finds a timed-out command's children without pgrep.
Direct mode stays the default and is unchanged; the runner serves the same Executor contract.
A cut stream resumes, a restarted runner fails running commands, a request id runs once.
Shell tests now run on both paths; runner-local is a developer provider with no confinement.
Per review: drain output greedily (consume anything already buffered with no
sleep) and only sleep between EMPTY reads, stopping after two consecutive empties
(robust to a one-tick gap between chunks). Bound cut 2.0s -> 0.5s. Common case is
now a couple of reads rather than a 0.02s poll that could, worst case, read up to
~100 times; also removes the break-on-first-empty fragility. Verified 20/20.
The background-shell poll helper (_poll_output) returned the instant it saw
status=='exited', but shell_task_output reads are incremental and the final
output chunk can still be draining into the task buffer on the same tick the
status flips to exited. Under load the first post-exit read returns empty and
the helper returns acc='', failing 'quick_done' in acc. This is a harness race,
not a shell bug (the incremental-read contract is correct). Keep reading until a
read yields nothing new (bounded 2s) after the terminal status so the tail is
captured deterministically. Verified 15/15.
Imported from andrewyng/aisuite@1b4bbf303e
(contents of its platform/ directory, hoisted to the repo root).
Development history prior to this commit lives in that repository.
Co-authored-by: Devika <devikaverma11@gmail.com>
Devika Verma