From 0dce05f39c0965baee93103c30113ed38393c7e3 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 27 Oct 2026 23:01:59 -0700 Subject: [PATCH] docs(dsh): confined mode works from CLI 0.1.196 Replace the "use a CLI release that carries this fix" sentence with the version and the 10-28 live confined turn. Join the line that split "Use a" from the rest of the sentence. Co-Authored-By: Claude Haiku 5.5 Co-authored-by: wren Agent-Model: claude/claude-haiku-5-5/max --- docs/cli/dsh.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/cli/dsh.md b/docs/cli/dsh.md index 274bfbd26f..72ccad9a22 100644 --- a/docs/cli/dsh.md +++ b/docs/cli/dsh.md @@ -90,8 +90,8 @@ run to its 900 s timeout. The profile denied the macOS resolver's configuration service, and node's DNS resolver, which dsh builds as it loads, can block forever on that denial. The profile now admits that one service, which returns configuration only and opens no network route of its own, so resolution fails -fast. Use a -CLI release that carries this fix before running a seat confined. +fast. Confined mode works from CLI 0.1.196. A live confined turn on 2026-10-28 +replied in about 35 s, and requests to hosts outside the allowlist were refused. A seat that declares exactly this, and nothing else under `sandbox`, runs confined: