A GitHub repository for just-bash, a TypeScript library providing a sandboxed bash environment for AI agents. The content demonstrates incidental structural alignment with human rights principles through privacy-by-design (default-deny network access, file system isolation), open-source publication enabling information access, and educational documentation, though human rights principles are not primary project concerns.
At this point why not make the agents use a restricted subset of python, typescript or lua or something.
Bash has been unchanged for decades but its not a very nice language.
I know pydantic has been experimenting with https://github.com/pydantic/monty (restricted python) and I think Cloudflare and co were experimenting with giving typescript to agents.
We just released a driver that allows users of just-bash to attach a full Archil file system, synced to S3. This would let you run just-bash in an enrivonment where you don't have a full VM and get high-performance access to data that's in your S3 bucket already to do like greps or edits.
I have been playing around with something like this.
I'm not going for compatibility, but something that is a bit hackable. Deliberately not having /lib /share and /etc to avoid confusion that it might be posix
This ends up reading files into node.js and then running a command like grep but implemented in JS. I love the concept but isn’t this incredibly slow compared to native cli tools? Building everything in JS on top of just readFile and writeFile interfaces seems pretty limited in what you can do for performance.
Interesting concept but I think the issue is to make the tools compatible with the official tools otherwise you will get odd behaviour. I think it is useful for very specific scenarios where you want to control the environment with a subset of tools only while benefiting from some form of scripts.
Why couldn’t they name it `agent-bash` then? What’s with all the “just-this”, “super-that” naming?
Like developer lost the last remaining brain cells developing it, and when it’s came to name it, used the first meaningless word that came up.
After all you’re limiting discovery with name like that.
The unix commandline tools being the most efficient way to use an LLM has been a surprise.
I wonder the reason.
Maybe 'do one thing well'? The piping? The fact that the tools have been around so long so there are so many examples in the training data? Simplicity? All of it?
The success of this project depends on the answer.
Even so, I suspect that something like this will be a far too leaky abstraction.
But Vercel must try because they see the writing on the wall.
Trying to secure the sandbox the harness is running in seems like the hard way to do things. It's not a bad idea, but I think it'd be easier to focus on isolating the sandbox and securing resources the harness sandbox accesses, since true security requires that anyhow.
It’s cool to see this project and others pop up. Virtualizing os primitives like bash and even file systems
You can interface around the nodejs files system interface and have access to some nice tools, like git isomorphic for instance. Then obviously everything couples nicely with agents.
Agents really do not care at all how "nice" a language is. You only need to be picky with language if a human is going to be working with the code. I get the impression that is not the use case here though
Incompatibilities don't matter much provided your error messages are actionable - an LLM can hit a problem, read the error message and try again. They'll also remember that solution for the rest of that session.
This is a really interesting idea. I wonder if something like Luau would be a good solution here - it's a typed version of Lua meant for sandboxing (built for Roblox scripting) that has a lot of guardrails on it.
I did a slightly less ambitious prototype a few weeks ago where I created added lazy loading of GCS files into the just-bash file-systems, as well as lots of other on-demand files. Was a lot of fun.
I would not over-read into that doc. In practice, the only missing stuff are extreme edge cases of the type that is actually not consistent between other implementations of bash.
In practice it works great. I haven't seen a failed command in a while
I'll add that agents (CC/Codex) very often screw up escaping/quoting with their bash scripts and waste tokens figuring out what happened. It's worse when it's a script they save and re use because it's often a code injection vulnerability.
If you want a better guess: It's because of the man pages for all the tools are likely duplicated across so many media for the LLM training that there's just an efficient pipeline. They go back to the 70s or whatever.
So, mostly re-enforcement along multiple vectors.
Editorial Channel
What the content says
+0.10
Article 26Education
Low Framing Coverage
Editorial
+0.10
SETL
0.00
Documentation is comprehensive and educationally structured with examples and clear instructions, supporting learning and understanding.
Observable Facts
README includes Table of Contents providing structured learning progression.
Multiple code examples with explanations demonstrate usage patterns.
Installation, configuration, API, and CLI sections provide step-by-step guidance.
Inferences
Structured documentation lowers barriers to learning for developers.
Clear examples support understanding and adoption of the software.
ND
PreamblePreamble
No content addressing foundational human dignity or universal rights principles.
ND
Article 1Freedom, Equality, Brotherhood
No content addressing equal dignity and rights.
ND
Article 2Non-Discrimination
No content addressing freedom from discrimination.
ND
Article 3Life, Liberty, Security
No content addressing human right to life, liberty, and security.
ND
Article 4No Slavery
No content addressing slavery or servitude.
ND
Article 5No Torture
No content addressing torture or cruel treatment.
ND
Article 6Legal Personhood
No content addressing right to legal personality.
ND
Article 7Equality Before Law
No content addressing equality before law.
ND
Article 8Right to Remedy
No content addressing remedy for rights violations.
ND
Article 9No Arbitrary Detention
No content addressing arbitrary arrest or detention.
ND
Article 10Fair Hearing
No content addressing fair and public trial.
ND
Article 11Presumption of Innocence
No content addressing presumption of innocence.
ND
Article 12Privacy
Medium Practice
No explicit editorial content addressing privacy as a human right.
Observable Facts
Documentation explicitly states 'The shell only has access to the provided file system.'
Documentation specifies 'There is no network access by default.'
Security model emphasizes execution protection against infinite loops and unauthorized resource access.
Inferences
Default lack of network access reduces unintended data transmission exposure.
File system sandboxing implements protective separation against unauthorized access.
ND
Article 13Freedom of Movement
No content addressing freedom of movement.
ND
Article 14Asylum
No content addressing asylum or refuge.
ND
Article 15Nationality
No content addressing nationality.
ND
Article 16Marriage & Family
No content addressing marriage or family.
ND
Article 17Property
No content addressing property rights.
ND
Article 18Freedom of Thought
No content addressing freedom of thought, conscience, and religion.
ND
Article 19Freedom of Expression
High Practice
No explicit editorial advocacy for freedom of expression.
Observable Facts
Repository is publicly accessible on GitHub without authentication barriers.
Project is licensed under Apache-2.0, a permissive open-source license.
Full source code and complete documentation are available for viewing and modification.
Inferences
Public availability facilitates free distribution and access to technical information.
Permissive licensing enables freedom to use, modify, and redistribute software.
ND
Article 20Assembly & Association
No content addressing peaceful assembly or association.
ND
Article 21Political Participation
No content addressing political participation.
ND
Article 22Social Security
No content addressing social security.
ND
Article 23Work & Equal Pay
No content addressing work and fair labor conditions.
ND
Article 24Rest & Leisure
No content addressing rest and leisure.
ND
Article 25Standard of Living
No content addressing health or adequate standard of living.
ND
Article 27Cultural Participation
Medium Practice
No explicit editorial content addressing scientific advancement as a right.
Observable Facts
Project is published as open-source software on public GitHub platform.
Repository includes development infrastructure files (.github/workflows, CLAUDE.md).
Source code is available for review, modification, and reuse.
Inferences
Open-source publication enables participation in technical knowledge advancement.
Development infrastructure supports collective participation in scientific/technical progress.
ND
Article 28Social & International Order
No content addressing social and international order.
ND
Article 29Duties to Community
No content addressing duties to community.
ND
Article 30No Destruction of Rights
No content addressing destruction of rights.
Structural Channel
What the site does
+0.20
Article 19Freedom of Expression
High Practice
Structural
+0.20
Context Modifier
ND
SETL
ND
Open-source publication on public platform enables free access to information. Apache-2.0 license permits unrestricted distribution and modification. Complete source code transparency supports verifiable information.
+0.15
Article 12Privacy
Medium Practice
Structural
+0.15
Context Modifier
ND
SETL
ND
Sandboxed file system architecture and default-deny network access implement privacy-by-design principles, preventing unauthorized data access or transmission.
+0.15
Article 27Cultural Participation
Medium Practice
Structural
+0.15
Context Modifier
ND
SETL
ND
Open-source publication enables collaborative participation in technical innovation. Repository infrastructure (CI/CD workflows, contribution guidelines) facilitates collective development and knowledge advancement.
+0.10
Article 26Education
Low Framing Coverage
Structural
+0.10
Context Modifier
ND
SETL
0.00
Repository organization with README, examples directory, and configuration files facilitates educational access and exploration.
ND
PreamblePreamble
No structural signals regarding human dignity or freedoms.
ND
Article 1Freedom, Equality, Brotherhood
No structural signals regarding equality.
ND
Article 2Non-Discrimination
No structural signals regarding discrimination.
ND
Article 3Life, Liberty, Security
Execution protection against infinite loops is technical safety, not human security.
ND
Article 4No Slavery
No structural signals regarding labor bondage.
ND
Article 5No Torture
No structural signals regarding harm prevention.
ND
Article 6Legal Personhood
No structural signals regarding recognition as person.
ND
Article 7Equality Before Law
No structural signals regarding legal protection.
ND
Article 8Right to Remedy
No structural signals regarding justice or remedies.
ND
Article 9No Arbitrary Detention
No structural signals regarding detention.
ND
Article 10Fair Hearing
No structural signals regarding judicial fairness.
ND
Article 11Presumption of Innocence
No structural signals regarding criminal process.
ND
Article 13Freedom of Movement
No structural signals regarding mobility.
ND
Article 14Asylum
No structural signals regarding protection from persecution.
ND
Article 15Nationality
No structural signals regarding national belonging.
ND
Article 16Marriage & Family
No structural signals regarding family life.
ND
Article 17Property
No structural signals regarding property ownership.
ND
Article 18Freedom of Thought
No structural signals regarding belief systems.
ND
Article 20Assembly & Association
No structural signals regarding group formation.
ND
Article 21Political Participation
No structural signals regarding governance participation.
ND
Article 22Social Security
No structural signals regarding welfare or protection.
ND
Article 23Work & Equal Pay
No structural signals regarding employment.
ND
Article 24Rest & Leisure
No structural signals regarding work-life balance.
ND
Article 25Standard of Living
No structural signals regarding health or welfare.
ND
Article 28Social & International Order
No structural signals regarding global systems.
ND
Article 29Duties to Community
No structural signals regarding communal responsibilities.
ND
Article 30No Destruction of Rights
No structural signals regarding right limitations.
Supplementary Signals
Epistemic Quality
0.76
Propaganda Flags
0techniques detected
Solution Orientation
No data
Emotional Tone
No data
Stakeholder Voice
No data
Temporal Framing
No data
Geographic Scope
No data
Complexity
No data
Transparency
No data
Event Timeline
20 events
2026-02-26 23:08
eval_success
Evaluated: Neutral (0.00)
--
2026-02-26 23:01
eval_success
Light evaluated: Neutral (0.00)
--
2026-02-26 22:41
rater_validation_fail
Light validation failed for model llama-4-scout-wai
--
2026-02-26 22:36
rater_validation_fail
Light validation failed for model llama-4-scout-wai
--
2026-02-26 22:36
rater_validation_fail
Light validation failed for model llama-4-scout-wai
--
2026-02-26 22:15
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 22:13
rate_limit
OpenRouter rate limited (429) model=llama-3.3-70b
--
2026-02-26 22:12
rate_limit
OpenRouter rate limited (429) model=llama-3.3-70b
--
2026-02-26 22:11
rate_limit
OpenRouter rate limited (429) model=llama-3.3-70b
--
2026-02-26 18:43
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:42
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:42
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:42
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:40
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:39
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:38
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:36
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:35
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:35
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents
--
2026-02-26 18:34
dlq
Dead-lettered after 1 attempts: just-bash: Bash for Agents