2026-06-20rejectedsimplification

Drop bash full-output spill files

移除 bash 完整输出 spill 文件

`dsh-bash-local` keeps bounded in-memory output and spills large stdout/stderr streams into private temp files. That requires a private directory, random owner-only file creation, close-failure handling, byte-offset incremental reads, lossy read reporting, path rendering in model-facing text, and cleanup discipline. The tool then tells the model to read a local spill path when output was truncated. This solves a real

.agents/notes/rejected/simplification/2026-06-20-drop-bash-output-spill-files.md

English

Problem

dsh-bash-local keeps bounded in-memory output and spills large stdout/stderr streams into private temp files. That requires a private directory, random owner-only file creation, close-failure handling, byte-offset incremental reads, lossy read reporting, path rendering in model-facing text, and cleanup discipline. The tool then tells the model to read a local spill path when output was truncated.

This solves a real problem, but in a narrow and leaky way. A spill path is a process-local filesystem artifact exposed to model output, not a durable harness artifact with scoped access, retention, or UI affordances. It also complicates background-job reads because a lossy incremental read has to point at one or two spill files.

Proposal

Keep tail truncation, drop full-output spill files. A bash result contains the bounded tail plus a clear truncation marker; no path is emitted. If users need full-output recovery, add a generic artifact/blob service with explicit ownership, cleanup, and UI rendering, then let bash attach large outputs to that service.

This proposal can land independently of a generic long-running tool runtime. If background jobs stay, bash_output should still report that output was dropped, but without advertising a spill path.

Acceptance criteria

CollectedOutput no longer carries spill paths.
OutputCollector keeps bounded buffers only and deletes the temp-file machinery.
renderResult() reports truncation without a filesystem path.
Tests cover tail truncation and no longer assert full-output file contents.
Security guidance in docs/defensive-patterns.md stops treating private spill files as a model-visible interface.

What we give up

A model or user cannot recover the omitted prefix of a huge command output from a temp file. That is acceptable until there is a real artifact service. The current spill path is too much bespoke machinery for a feature whose lifecycle and permissions are not designed.

中文

问题

dsh-bash-local 在内存中保留有界的输出，并将大体量的 stdout/stderr 流写入私有临时 spill 文件。这要求一个私有目录、随机创建仅所有者可访问的文件、关闭失败处理、基于字节偏移的增量读取、有损读取报告、在面向模型的文本中渲染路径，以及清理纪律。当输出被截断时，该工具会告知模型去读取一个本地 spill 路径。

这解决了一个真实问题，但方式狭隘且有泄漏。spill 路径是一项暴露给模型的进程本地文件系统产物，而非具有作用域访问控制、保留策略或 UI 支持的持久化 harness 产物。它还使后台任务的读取变得复杂，因为有损增量读取必须指向一个或两个 spill 文件。

提案

保留尾部截断，移除完整输出 spill 文件。bash 结果包含有界的尾部内容加一个明确的截断标记；不输出路径。如果用户需要恢复完整输出，则添加一个通用的产物／blob 服务（具有明确的所有权、清理和 UI 渲染），然后让 bash 将大体量输出附加到该服务。

本提案可以独立于通用长时间运行工具运行时落地。如果后台任务保留，bash_output 仍应报告输出已被丢弃，但不再提供 spill 路径。

验收标准

CollectedOutput 不再携带 spill 路径。
OutputCollector 仅保留有界缓冲区，删除临时文件机制。
renderResult() 报告截断时不包含文件系统路径。
测试覆盖尾部截断，不再断言完整输出文件的内容。
docs/defensive-patterns.md 中的安全指导不再将私有 spill 文件视为面向模型的接口。

放弃的能力

模型或用户无法再从临时文件恢复大体量命令输出中被省略的前缀。在真正的产物服务出现之前，这是可以接受的。当前的 spill 路径为一个生命周期和权限均未经设计的功能引入了过多的专用机制。