feat(harness): keep oversized bash output inside the sandbox - #56

Third of three stacked PRs — based on #55. Merge #54 and #55 first.

What

• The bash tool's full output used to go to a temp file on the harness host, which a remote sandbox (and the model's tools in it) cannot read. The command now runs in a POSIX sh wrapper (tool/output.ts) that writes its combined output to a file under the mount's spill path, created 0600 and exclusively, kept only when the raw output exceeds the display limits.
  • Streaming backends (host, Vercel) tee it; output still flows back live.
  • Buffered backends (Daytona, just-bash) return only a header (size, newline count, kept flag) and a tail window, so a huge output never crosses to the harness; the skipped bytes are counted (Accumulator.skip).
• spillPath on the mount identity (SandboxIO.Current): /tmp by default; Daytona and Vercel define SPILL_PATH and record it in their runtime config like DEFAULT_CWD, so it can become configurable later.
• The host sandbox shell now streams and, when a command is cut short, escalates SIGTERM → SIGKILL for the whole process group. This replaces ToolShell.local, which no plugin used since bash moved onto SandboxIO.Shell.
• A timed-out or cancelled call removes the files its wrapper never got to clean up.

Testing

• test/tools.output.test.ts: the bash tool end to end over the host shell (streaming), the host shell without streaming (buffered under a real sh) and just-bash — no file for small output, complete file + correct tail/line numbers for large output (with non-ASCII), 0600, ) in a comment and exit, background jobs still writing, a huge final line, invalid UTF-8, a trailing NUL, deadlines, cancellation, and an orphaned child that ignores SIGTERM.
• Faults injected for each fix fail the suite.
• Full non-live suite: 548 passed. The full-harness bash spec now reads the spill file through a mount of the sandbox; the full live suite (Daytona + Vercel, 42 tests) passes on the final code.

🤖 Generated with Claude Code