bash

Existing NL2SH (natural language to Bash command) evaluation is severely hindered by low-quality test data and unreliable heuristic-based functional equivalence judgments. To address these limitations, this work proposes: (1) the first functional equivalence assessment framework integrating command execution verification with LLM-powered semantic judgment, achieving 95% accuracy; (2) the largest human-annotated NL2SH benchmark to date—comprising 600 high-quality test instances and 40,939 training samples; and (3) a model enhancement strategy combining instruction tuning, in-context learning, constrained decoding, and weight-intrinsic learning to improve generalization. Experiments demonstrate up to a 32% absolute improvement in NL2SH translation accuracy and a 16% increase in evaluation confidence over state-of-the-art methods. All data and code are publicly released.

The lack of formal specifications for opaque Unix commands hinders the practicality of program analysis systems. Method: This paper introduces the first automated specification mining approach that synergistically integrates large language models (LLMs) with system-level instrumentation: LLMs parse unstructured command documentation to generate structured syntactic and semantic constraints; concurrent system-call and filesystem instrumentation dynamically observes command behavior across diverse environments, extracting key properties—including input domains, side effects, and error modes. Contribution/Results: Our method achieves the first end-to-end, LLM-driven specification synthesis across commands and heterogeneous documentation formats, supports multiple standard specification outputs (e.g., SMT-LIB, JSON Schema), and integrates seamlessly with static analyzers. Evaluated on 60 commands—including GNU Coreutils, POSIX utilities, and third-party tools—it attains a 98.3% specification correctness rate, fully eliminating manual specification authoring.

This study investigates whether the GNU find command is Turing-complete, revealing the latent computational universality of this widely used Unix utility. By encoding computational states into directory structures or file contents and leveraging either regular expression backreferences or solely native find operations, the authors successfully simulate both a 2-tag system and a two-counter machine. The work establishes, for the first time, that GNU find achieves Turing completeness under three distinct configurations—differing in the availability of mkdir and the use of regex backreferences. These findings not only place find among the class of “accidentally Turing-complete” systems but also deepen our understanding of the computational foundations inherent in basic command-line tools.

Automated verification of interactive console I/O programs in Haskell education remains challenging due to the dynamic, history-dependent nature of student implementations. Method: We propose a lightweight, formal behavioral specification language that uniquely integrates global state and execution history, expressed via regex-like syntax; its trace-based semantics enable probabilistic testing and scalable verification through *sampleable validity*. Contribution/Results: Our system automatically validates student submissions against behavioral specifications and supports pedagogical closed-loop applications—including real-time feedback generation, example solution synthesis, and exercise randomization. Empirical evaluation demonstrates substantial improvements in test coverage and pedagogical adaptability while preserving formal rigor. To our knowledge, this is the first framework for verifying interactive behaviors in functional programming education that simultaneously achieves theoretical soundness and practical deployability.

Compositional systems lack a structured, rewriteable mathematical foundation. Method: This work proposes a category-theoretic rewriting framework wherein structured cospans serve as the fundamental syntactic units; it introduces, for the first time, the coupling of structured cospans with double-pushout (DPO) rewriting, yielding a unified theory supporting both traced and trace-free semantics. The framework enables inductive, structure-preserving decomposition of closed systems and establishes a sound correspondence between syntax (structured cospans) and semantics (DPO rewriting). Contribution/Results: It provides the first categorical integration of structured cospans with DPO rewriting; defines two distinct rewriting paradigms—traceable and trace-free; and delivers the first mathematically rigorous, compositional, and rewriteable foundation for systems science, enabling cross-disciplinary modeling and formal analysis of complex systems.

This work addresses the critical limitations of existing Bash code generation methods—namely, their lack of interpretability and insufficient robustness—which pose significant threats to system security. To overcome these challenges, the authors propose a novel framework that integrates continual pretraining (CPT), long chain-of-thought supervised fine-tuning (L-CoT SFT), and a new robustness-aware grouped relative policy optimization (R-GRPO). This approach uniquely unifies risk-aware reasoning with a robustness-oriented reward mechanism from reinforcement learning, simultaneously enhancing the correctness, robustness, and interpretability of generated code. Evaluated on the BashBench benchmark, the method achieves FullRate scores of 90.04% and 73.18% on single-line and multi-line tasks, respectively—outperforming the strongest baseline by 37.82% and 20.18%. Human evaluations further confirm its substantial advantages in functionality, robustness, and clarity.

Existing agent benchmarks struggle to effectively evaluate direct utilization of Unix system primitives, often conflating this capability with general programming skills. This work proposes an operational definition of Unix proficiency and introduces a procedurally generated CTF-style task environment: each task embeds a flag within an isolated Linux container by leveraging a single Unix feature, requiring agents to recover it using only shell interactions. High-fidelity, reusable tasks are efficiently synthesized through an LLM-assisted bidirectional contract generation pipeline that combines parameterized hide/seek script pairs with container isolation mechanisms. The resulting benchmark comprises 656 validated tasks (87.5% generation success rate), spanning 155 distinct techniques. Fine-tuning Qwen3-8B with LoRA and GRPO reinforcement learning boosts its solve rate on the holdout set from 11.6% to 43.6%, with Forensics subtasks showing a 33-percentage-point improvement.

This work addresses the challenge of automatically generating high-quality comments for Bash scripts, which are often difficult to understand due to their flexible syntax, structural complexity, and frequent lack of documentation. Existing approaches are hindered by scarce training data and limited semantic understanding of Bash by large language models. To overcome these limitations, the authors propose Bash-Commenter, built upon LLaMA-3.1-8B, leveraging the first large-scale, high-quality dataset of multi-line Bash comments. The method integrates continual pretraining (CPT), supervised fine-tuning (SFT), and a novel syntax-aware preference optimization (SAPO) mechanism that utilizes abstract syntax trees to generate minimal correct/incorrect script pairs for fine-grained semantic modeling. Experimental results demonstrate that Bash-Commenter achieves BLEU-4 scores of 33.40% and 22.15% on single-line and multi-line scripts, respectively, significantly outperforming baselines, with both human and automated evaluations confirming superior comment correctness, completeness, and fluency.

Existing symbolic execution approaches often lack a formal foundation aligned with the concrete semantics of programming languages, typically being constructed in an ad hoc and fragmented manner. This work proposes a symbolic Structural Operational Semantics (SOS) rule format that, for the first time, relies solely on the algebraic signature of the source language to uniformly capture both concrete and symbolic operational semantics, thereby enabling language-agnostic generation of symbolic execution semantics. Within this framework, we formally derive symbolic semantics and rigorously prove their soundness and completeness relative to the concrete semantics, demonstrating applicability to arbitrary programming languages.

This work addresses the security risks posed by AI agents frequently executing untrusted code on developer machines, where existing isolation mechanisms suffer from limitations in privilege requirements, performance overhead, and granularity of control. The authors propose a privilege-free, fine-grained process sandboxing architecture that compiles static security policies into kernel-enforced rules using Linux primitives such as seccomp and namespaces, while delegating dynamic decisions to a lightweight userspace supervisor. This approach enables rootless enforcement over filesystem, network, IPC, and system call access, supports time-of-check-to-time-of-use (TOCTOU)-safe validation and reversible file operations, and avoids dependencies on containers, cgroups, or images. Experimental results demonstrate a startup overhead of only ~5 ms, Redis performance matching bare-metal levels, and stage-based isolation of data, network, and untrusted content.