From 6128c7e61e32d5b496b7887c5e1f466e31cac404 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:22:10 -0700 Subject: [PATCH 1/3] docs(dsh): confined mode does not complete turns on CLI 0.1.191 The D146 prod walk ran dsh unconfined. SRE then ran a confined seat on CLI 0.1.191 with the shape this page documents, {mode: workspace, network: restricted}. It boots, and every turn times out because the loopback provider proxy does not deliver inference. The section now opens with that and says to run the private seat unconfined until a fix ships. The walked line is unchanged. Finding: SRE's confined run on CLI 0.1.191 (D106). Co-Authored-By: Claude Haiku 5.5 Co-authored-by: wren Agent-Model: claude/claude-haiku-5-5/max --- docs/cli/dsh.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/cli/dsh.md b/docs/cli/dsh.md index 42d391319c..a3d73c9b2b 100644 --- a/docs/cli/dsh.md +++ b/docs/cli/dsh.md @@ -85,6 +85,9 @@ macOS using CLI 0.1.117, then re-walked on CLI 0.1.122 on 2026-10-23. ## Confined mode (macOS) +Confined mode does not complete turns yet on CLI 0.1.191, so run the private +seat unconfined until a fix ships. + A seat that declares exactly this, and nothing else under `sandbox`, runs confined: From 46c33b325750419b1f75b9a2f86eaf13a2689131 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:31:47 -0700 Subject: [PATCH 2/3] docs(dsh): drop the one-turn sentence from confined limits Lumen HOLD on #2910 at 6128c7e61: the sentence implied a confined turn can complete. Co-Authored-By: Claude Haiku 5.5 Co-authored-by: wren Agent-Model: claude/claude-haiku-5-5/max --- docs/cli/dsh.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/cli/dsh.md b/docs/cli/dsh.md index a3d73c9b2b..883088c685 100644 --- a/docs/cli/dsh.md +++ b/docs/cli/dsh.md @@ -138,8 +138,7 @@ Limits to know: A request to a download host can still carry data in its URL. - A provider route that reports a different model name than the one requested (some gateways report the upstream name) fails every confined - turn. Check one turn before relying on it. -- `node cli/scripts/probe-seatbelt-confinement.mjs` checks the profile's + turn.- `node cli/scripts/probe-seatbelt-confinement.mjs` checks the profile's denials on your Mac: writes outside the workspace, opens of `~/.commonly`, `gh`'s `hosts.yml` and the login keychain file, other loopback ports, an outside address, and the keychain's Security service lookup. It never From b0dd055ef97c5ad7cf81ffd4781402fc28e7b241 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:32:15 -0700 Subject: [PATCH 3/3] docs(dsh): restore the line break the last commit lost The bullet's last line ran into the next bullet's marker. Co-Authored-By: Claude Haiku 5.5 Co-authored-by: wren Agent-Model: claude/claude-haiku-5-5/max --- docs/cli/dsh.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/cli/dsh.md b/docs/cli/dsh.md index 883088c685..aabe139359 100644 --- a/docs/cli/dsh.md +++ b/docs/cli/dsh.md @@ -138,7 +138,8 @@ Limits to know: A request to a download host can still carry data in its URL. - A provider route that reports a different model name than the one requested (some gateways report the upstream name) fails every confined - turn.- `node cli/scripts/probe-seatbelt-confinement.mjs` checks the profile's + turn. +- `node cli/scripts/probe-seatbelt-confinement.mjs` checks the profile's denials on your Mac: writes outside the workspace, opens of `~/.commonly`, `gh`'s `hosts.yml` and the login keychain file, other loopback ports, an outside address, and the keychain's Security service lookup. It never