docs(exec): remove the sh driver

.claude-plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
   "name": "heph-marketplace",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Claude Code plugins for the heph build system, co-located with the docs.",
   "owner": {
     "name": "hephbuild",

plugins/heph-expert/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin.json",
   "name": "heph-expert",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Expert assistance for the heph build system: author BUILD files, debug caching and sandbox issues, wire up CI, and explain the target graph.",
   "author": {
     "name": "hephbuild"

plugins/heph-expert/agents/heph-expert.md

@@ -64,7 +64,7 @@ exactly right and might have changed, fetch the live doc page (the docs expose a
    rebuild on unrelated changes.
 
 7. **Debug in the sandbox.** For failures, reach for `heph run <addr> --shell`
-   (bash/sh) to reproduce with the exact inputs/tools/env, rather than adding
+   (bash driver) to reproduce with the exact inputs/tools/env, rather than adding
    prints or loosening isolation.
 
 ## Output style

plugins/heph-expert/commands/heph-debug.md

@@ -15,7 +15,7 @@ Work through this, narrating findings concisely:
    outputs, tools and sandbox config are what you expect. `heph inspect spec
    <addr>` shows the raw provider spec if the resolved def looks wrong.
 
-2. **Reproduce in the sandbox.** `heph run <addr> --shell` (bash/sh drivers)
+2. **Reproduce in the sandbox.** `heph run <addr> --shell` (bash driver)
    drops you into the exact inputs/tools/env. Inside, inspect `$SRC_*`,
    `$TOOL_*`, `$OUT*`, `$LIST_SRC_*`, and re-run the `run` command by hand to see
    the real error.

plugins/heph-expert/commands/heph-target.md

@@ -15,7 +15,7 @@ Steps:
    `.hephconfig` `buildfile.patterns`). The package is the workspace-relative
    directory; the target address will be `//<package>:<name>`.
 
-2. **Pick the driver.** `bash`/`sh`/`exec` for shell actions, `nix` for a pinned
+2. **Pick the driver.** `bash`/`exec` for shell actions, `nix` for a pinned
    toolchain, `textfile` for a generated text file, `group` to bundle. For Go
    code, do NOT write `target()` — the `go` provider generates `:build`/`:test`
    automatically; hand the user off to the dedicated **`heph-go`** plugin

plugins/heph-expert/skills/heph/SKILL.md

@@ -6,13 +6,13 @@ description: >-
   .hephconfig, BUILD files with target()/glob()/file(), heph addresses like
   //pkg:name or //@heph/..., the heph CLI (heph run, heph inspect, heph query,
   heph validate, heph tool gc/gen-gitignore), heph caching/cache hits, target
-  sandboxes, codegen (copy / in_place), output groups, drivers (bash, sh, exec,
+  sandboxes, codegen (copy / in_place), output groups, drivers (bash, exec,
   nix, go_*) or providers (buildfile, go, query). Also use it for ANY task that
   involves writing, reading, debugging, or reviewing heph BUILD files, tuning
   .hephconfig, diagnosing why a target rebuilt or a cache missed, or setting up
   heph in CI — even when the user does not say the word "heph" explicitly but
   the files or commands make it clear.
-version: 0.1.1
+version: 0.1.2
 ---
 
 # heph build system
@@ -85,7 +85,7 @@ is self-contained and mirrors the official docs.
    show the resolved/raw definition. Nothing executes unless a provider must
    run to answer.
 4. **Debug failures in the sandbox.** `heph run <addr> --shell` drops into the
-   exact inputs/tools/env the target runs with (bash/sh drivers). Recommend this
+   exact inputs/tools/env the target runs with (bash driver). Recommend this
    over adding debug prints.
 5. **Distinguish the three dependency kinds** (`deps` / `hash_deps` /
    `runtime_deps`) and the three codegen-vs-cache choices — they are the most

plugins/heph-expert/skills/heph/references/authoring.md

@@ -43,13 +43,13 @@ Only these fields are interpreted by the engine/buildfile:
 | Field | Required | Meaning |
 |---|---|---|
 | `name` | yes | Target name within its package. |
-| `driver` | no* | Driver that executes it (`bash`, `sh`, `exec`, `nix`, `group`, …). Required when `defaultDriver` is not set in the buildfile provider options. |
+| `driver` | no* | Driver that executes it (`bash`, `exec`, `nix`, `group`, …). Required when `defaultDriver` is not set in the buildfile provider options. |
 | `labels` | no | Label or list of labels, used by `query` and matchers. |
 | `transitive` | no | Sandbox settings propagated to dependents. |
 
 **Everything else** (`run`, `deps`, `out`, `env`, `cache`, `codegen`, …) is
 **driver-defined**: buildfile forwards it verbatim to the named driver. For the
-exec drivers (`bash`/`sh`/`exec`) those fields are documented below.
+exec drivers (`bash`/`exec`) those fields are documented below.
 
 ```python title="BUILD"
 lib = target(name = "lib", driver = "bash", run = "go build -o $OUT .", out = "lib")
@@ -147,8 +147,8 @@ go_service(name = "api")
 
 ## Exec driver fields
 
-The `exec` plugin registers three drivers: `exec` (direct execution), `bash`
-(bash with job control), `sh` (POSIX shell). `bash`/`sh` support interactive
+The `exec` plugin registers two drivers: `exec` (direct execution), `bash`
+(bash with job control, `-o pipefail`). `bash` supports interactive
 `--shell` mode with PTY allocation. Target config keys:
 
 | Key | Meaning |

plugins/heph-expert/skills/heph/references/cli.md

@@ -23,7 +23,7 @@ heph run <LABEL> <PACKAGE_MATCHER>
 | Flag | Description |
 |---|---|
 | `--force` | Force execution, ignoring any cached result. |
-| `--shell` | Drop into an interactive shell in the target's sandbox instead of running it (bash/sh). |
+| `--shell` | Drop into an interactive shell in the target's sandbox instead of running it (bash driver). |
 | `--cat-out` | Print output artifacts to stdout. |
 | `--list-out` | Print the output file list to stdout. |
 | `-e`, `--exclude <ADDR>` | Exclude a target address (repeatable). |

plugins/heph-expert/skills/heph/references/concepts.md

@@ -81,7 +81,7 @@ present inputs through a FUSE overlay — opt-in via the `fuse` block in
 identical either way; only how the files get there differs.
 
 **Inspecting.** When a target fails, step inside with
-`heph run <addr> --shell` (bash/sh drivers): you get the exact inputs, tools and
+`heph run <addr> --shell` (bash driver): you get the exact inputs, tools and
 env, can list `$SRC_*`, and re-run the command by hand.
 
 ## Caching

plugins/heph-expert/skills/heph/references/configuration.md

@@ -51,7 +51,7 @@ plugins:
 
 **Built-in vs opt-in.** Some plugins are always available and need no
 registration: `group`, `fs`, `hostbin`, `query`. The exec drivers (`exec`,
-`bash`, `sh`) are built-in but should be listed under `plugins:` to use them.
+`bash`) are built-in but should be listed under `plugins:` to use them.
 The `nix` driver must also be registered. The `go` plugin is **external** — it
 is not compiled into the heph binary and must be loaded via `path:` or `url:`.
 Each plugin page states which.

plugins/heph-expert/skills/heph/references/plugins.md

@@ -19,7 +19,7 @@ own). Sources under `https://hephbuild.github.io/docs/plugins/` and
 
 | Plugin | Driver(s) | Purpose | Registration |
 |---|---|---|---|
-| Exec | `exec`, `bash`, `sh` | Run shell commands in sandboxed builds; interactive `--shell` debugging. | Built-in; list under `plugins:` as `builtin: exec` (or `bash`/`sh`). |
+| Exec | `exec`, `bash` | Run shell commands in sandboxed builds; interactive `--shell` debugging. | Built-in; list under `plugins:` as `builtin: exec` (or `bash`). |
 | Filesystem | `fs` | Reference workspace files/globs as inputs. | Built-in, always on. |
 | Group | `group` | Bundle targets transparently (pass-through); add `include`/`exclude`/`strip_prefix`/`prefix`/`rename` to re-export deps' outputs filtered and relocated, without copying. | Built-in, always on. |
 | Hostbin | `hostbin` | Wrap a host `PATH` binary as a target. | Built-in, always on. |
@@ -66,7 +66,7 @@ own). Sources under `https://hephbuild.github.io/docs/plugins/` and
 
 ## Per-plugin detail
 
-### Exec (`exec` / `bash` / `sh`)
+### Exec (`exec` / `bash`)
 Full field list, dependency kinds, output groups and sandbox env vars are in
 `authoring.md`. `path` option sets the `PATH` override (default
 `/usr/local/bin:/usr/bin:/bin`).

plugins/heph-go/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin.json",
   "name": "heph-go",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Set up and maintain Go in a heph workspace correctly: enable the go provider and drivers, wire generated code (go_src / go_codegen_root / go_codegen_deps) and test fixtures (go_test_data), and keep :build/:test green.",
   "author": {
     "name": "hephbuild"

plugins/heph-go/agents/heph-go-expert.md

@@ -71,7 +71,7 @@ Ground every claim in the actual graph:
 - `heph query all //pkg` — did the provider generate `:build`/`:test`?
 - `heph inspect deps //pkg:build` — did the `go_src` / `std` / `thirdparty` edges land?
 - `heph inspect hashin //pkg:build` — what is in the cache key?
-- `heph run //gen:target --shell` — (bash/sh codegen) reproduce the sandbox and
+- `heph run //gen:target --shell` — (bash codegen) reproduce the sandbox and
   see exactly which generated files arrived.
 
 When you explain a failure, name the specific missing input or mislabelled target

plugins/heph-go/commands/heph-go-codegen.md

@@ -73,7 +73,7 @@ target(
 heph inspect deps //<pkg>:build    # go_src edge present?
 heph run //<pkg>:build             # compiles with generated code
 heph run //<pkg>:test              # tests see code + fixtures
-heph run //<gen>:<name> --shell    # (bash/sh) inspect the codegen sandbox
+heph run //<gen>:<name> --shell    # (bash) inspect the codegen sandbox
 ```
 
 Produce the BUILD diff, state exactly which BUILD file each block goes in

plugins/heph-go/skills/heph-go/SKILL.md

@@ -13,7 +13,7 @@ description: >-
   package fails to find generated code, embeds, third-party modules, or testdata.
   Also use it when a go.mod / *.go file is present and the task is "make Go work
   under heph" even if the user does not say "heph" explicitly.
-version: 0.1.1
+version: 0.1.2
 ---
 
 # heph + Go setup
@@ -211,7 +211,7 @@ provider_state(provider = "go", test = {"skip": False})
    smallest subtree that covers the generator and its consumers.
 5. **Verify, don't assume.** `heph query all <pkg>` lists the generated targets;
    `heph inspect deps //pkg:build` shows whether the `go_src`/std/thirdparty edges
-   landed; `heph run //pkg:build --shell` (bash/sh codegen targets) reproduces the
+   landed; `heph run //pkg:build --shell` (bash codegen targets) reproduces the
    sandbox to see exactly which files arrived. Diagnose with these before editing.
 6. **Keep it reproducible.** Pin `gotool`; keep codegen deterministic; prefer
    `codegen = "copy"` + `gen-gitignore` for generated sources.

plugins/heph-go/skills/heph-go/references/go-plugin.md

@@ -546,5 +546,5 @@ heph inspect states //pkg --inherited # provider_state declarations this package
 heph run //pkg:build                 # compile
 heph run //pkg:test                  # in-package tests
 heph run //pkg:xtest                 # external tests
-heph run //gen:target --shell        # (bash/sh codegen) inspect the sandbox
+heph run //gen:target --shell        # (bash codegen) inspect the sandbox
 ```

website/docs/plugins/buildfile.md

@@ -109,7 +109,7 @@ A matching BUILD file defines targets by calling `target()` in Starlark:
 ```python title="BUILD"
 target(
     name = "hello",
-    driver = "sh",
+    driver = "bash",
     run = ["echo hello"],
 )
 ```
@@ -173,7 +173,7 @@ everything else is handed verbatim to the **driver**:
 Any other keyword (`run`, `deps`, `out`, `env`, `cache`, `codegen`, …) is
 **driver-defined**. buildfile does not interpret it — it forwards the value to
 the named driver, which decides what it means. For the fields a given driver
-accepts, see that driver's page, e.g. [Exec](./exec.md) for `bash`/`sh`/`exec`.
+accepts, see that driver's page, e.g. [Exec](./exec.md) for `bash`/`exec`.
 :::
 
 `target()` returns the new target's address, so you can bind it to a variable

website/docs/plugins/exec.md

@@ -6,8 +6,8 @@ description: Execution drivers for running shell commands in sandboxed target bu
 
 # Exec
 
-The `pluginexec` plugin provides three execution drivers — `exec`, `bash`,
-and `sh` — for running shell commands inside sandboxed target builds. It wires
+The `pluginexec` plugin provides two execution drivers — `exec` and `bash` —
+for running shell commands inside sandboxed target builds. It wires
 up dependency injection, sets up environment variables, resolves the tools a
 target needs on its `PATH`, and supports interactive shell debugging with PTY
 allocation. Whenever a target runs a command to produce its outputs, one of
@@ -16,13 +16,13 @@ these drivers is doing the work.
 ## Driver
 
 A **driver** is the component that knows how to execute a target's action and
-turn its inputs into outputs. This plugin registers the drivers named `exec`,
-`bash`, and `sh`.
+turn its inputs into outputs. This plugin registers the drivers named `exec`
+and `bash`.
 
 ## Enabling it
 
-Built-in. Register in `.hephconfig` under `plugins` with `builtin: exec`,
-`builtin: bash`, or `builtin: sh`. The optional `path` option sets the `PATH`
+Built-in. Register in `.hephconfig` under `plugins` with `builtin: exec` or
+`builtin: bash`. The optional `path` option sets the `PATH`
 override, which defaults to `/usr/local/bin:/usr/bin:/bin` if empty or unset.
 
 ## Configuration
@@ -41,12 +41,6 @@ plugins:
         - /usr/local/bin
         - /usr/bin
         - /bin
-  - builtin: sh
-    options:
-      path:
-        - /usr/local/bin
-        - /usr/bin
-        - /bin
 ```
 
 ## Usage
@@ -67,15 +61,14 @@ target(
 
 ## Notes
 
-There are three driver variants:
+There are two driver variants:
 
 | Driver | Behavior                                          |
 |--------|---------------------------------------------------|
 | `exec` | Direct command execution.                         |
-| `bash` | Bash shell with job control.                      |
-| `sh`   | POSIX shell, no bash-isms.                         |
+| `bash` | Bash shell with job control, run with `-o pipefail` so a failing stage in a pipeline fails the target. |
 
-The `bash` and `sh` drivers support an interactive `--shell` mode with PTY
+The `bash` driver supports an interactive `--shell` mode with PTY
 allocation, which is useful for debugging a target's sandbox.
 
 The following target config keys are available:
@@ -249,6 +242,6 @@ environment it would run with:
 heph run //app:server --shell
 ```
 
-The `bash` and `sh` drivers allocate a PTY and start an interactive shell inside
+The `bash` driver allocates a PTY and starts an interactive shell inside
 the prepared sandbox, so you can inspect `$SRC_*`, re-run the command by hand,
 and see why it broke.