What we found
Commands catch a narrow, specific set — e.g. cat catches exactly FileNotFoundError/IsADirectoryError/PermissionError; across the command tree there are only a handful of except OSError. A custom backend that raises anything else — TimeoutError, ConnectionError, a plain OSError — propagates out of bash.exec() as a Python exception instead of a nonzero exit with stderr. For the AI-agent use case this breaks the containment property: a sandbox that raises through its own boundary isn't one, and the harness now needs its own try/except around every exec to avoid crashing on what should have been cat: /x: I/O error, exit 1.
(The redirect path already gets this right — redirection failures are wrapped broadly and become exit 1 — so the command path is the inconsistency.)
Ask
Either (a) catch OSError at the command-execution boundary and map it to exit code + <cmd>: <path>: <strerror> on stderr, or (b) document the required exception taxonomy for IFileSystem implementers ("only ever raise these three"). We worked around it by subclassing PermissionError for domain refusals, which is an ugly hack.
Context
Same remote-workspace backend: network faults and domain refusals (read-only mounts, revoked access) have no exception to arrive through.
What we found
Commands catch a narrow, specific set — e.g. cat catches exactly
FileNotFoundError/IsADirectoryError/PermissionError; across the command tree there are only a handful of except OSError. A custom backend that raises anything else —TimeoutError, ConnectionError, a plain OSError— propagates out ofbash.exec()as a Python exception instead of a nonzero exit with stderr. For the AI-agent use case this breaks the containment property: a sandbox that raises through its own boundary isn't one, and the harness now needs its own try/except around every exec to avoid crashing on what should have beencat: /x: I/O error, exit 1.(The redirect path already gets this right — redirection failures are wrapped broadly and become exit 1 — so the command path is the inconsistency.)
Ask
Either (a) catch OSError at the command-execution boundary and map it to
exit code + <cmd>: <path>: <strerror>on stderr, or (b) document the required exception taxonomy for IFileSystem implementers ("only ever raise these three"). We worked around it by subclassing PermissionError for domain refusals, which is an ugly hack.Context
Same remote-workspace backend: network faults and domain refusals (read-only mounts, revoked access) have no exception to arrive through.