@skydiveai/pi-extensions 0.1.0-beta.1233 → 0.1.0-beta.1235

package/dist/index.mjs

@@ -19,11 +19,11 @@ import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { Resource } from "@opentelemetry/resources";
 import { BatchSpanProcessor, NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME } from "@opentelemetry/semantic-conventions";
-import { hc } from "hono/client";
-import { parse } from "yaml";
 import { execFile } from "node:child_process";
 import { availableParallelism } from "node:os";
 import { promisify } from "node:util";
+import { hc } from "hono/client";
+import { parse } from "yaml";
 import { quote } from "shell-quote";
 import { createWriteStream } from "node:fs";
 import { finished } from "node:stream/promises";
@@ -259,7 +259,7 @@ function createHealthHandler({ metadata }) {
 * read on the hot path before every LLM call), it falls back to the default
 * for that knob and logs once.
 */
-const log$14 = logger.child({ module: "context-management-config" });
+const log$15 = logger.child({ module: "context-management-config" });
 const DEFAULT_CONTEXT_MANAGEMENT_CONFIG = {
 	enabled: false,
 	perResultMaxBytes: 16 * 1024,
@@ -307,7 +307,7 @@ function resolveContextManagementConfig(env = process.env) {
 		maxModelCallsPerTurn: env.SKYDIVE_CTX_MAX_MODEL_CALLS
 	});
 	if (!parsed.success) {
-		log$14.warn({
+		log$15.warn({
 			event: "context_management_config_invalid",
 			err: parsed.error
 		}, "falling back to default context-management config");
@@ -441,7 +441,7 @@ const CAPABILITY_SOUL_NUDGE = "New capability gained — once the current task i
 * or `ToolDefinition[]`. Files starting with `_` or `.` are skipped, so
 * `tools/_example.ts` documents the shape without registering.
 */
-const log$13 = logger.child({ module: "local-tools-extension" });
+const log$14 = logger.child({ module: "local-tools-extension" });
 const TOOLS_DIRNAME = "tools";
 const fileState = /* @__PURE__ */ new Map();
 let pendingLocalToolsUpdate = null;
@@ -585,7 +585,7 @@ async function reconcileAndQueue({ pi, dir, reason }) {
 		dir
 	});
 	if (reason !== "session_start" && summaryHasChanges$1(summary)) pendingLocalToolsUpdate = summary;
-	log$13.info({
+	log$14.info({
 		event: "local_tools_reconcile",
 		reason,
 		total_tools: summary.totalTools,
@@ -607,7 +607,7 @@ const localToolsExtension = (pi) => {
 				reason: "session_start"
 			});
 		} catch (err) {
-			log$13.error({
+			log$14.error({
 				err,
 				event: "local_tools_reconcile_failed"
 			}, "local tools reconcile failed");
@@ -619,7 +619,7 @@ const localToolsExtension = (pi) => {
 		try {
 			current = await listToolFiles(dir);
 		} catch (err) {
-			log$13.warn({
+			log$14.warn({
 				err,
 				event: "local_tools_listing_failed"
 			}, "tools/ listing failed");
@@ -641,7 +641,7 @@ const localToolsExtension = (pi) => {
 				reason: "auto_reload"
 			});
 		} catch (err) {
-			log$13.error({
+			log$14.error({
 				err,
 				event: "local_tools_auto_reload_failed"
 			}, "auto-reload after tools/ change failed");
@@ -879,7 +879,7 @@ async function loadMcpConfig(path) {
 * Clients are keyed by JSON-stringified config and reused across
 * reloads — only changed configs reconnect.
 */
-const log$12 = logger.child({ module: "mcp-extension" });
+const log$13 = logger.child({ module: "mcp-extension" });
 async function closeConnected(connected) {
 	try {
 		await connected.client.close();
@@ -1301,7 +1301,7 @@ var McpExtension = class {
 		});
 		this.lastConfigMtimeMs = await readConfigMtimeMs(configPath);
 		if (reason !== "session_start" && summaryHasChanges(summary)) this.pendingMcpUpdate = summary;
-		log$12.info({
+		log$13.info({
 			event: "mcp_reconcile",
 			reason,
 			total_tools: summary.totalTools,
@@ -1324,7 +1324,7 @@ var McpExtension = class {
 						reason: "session_start"
 					});
 				} catch (err) {
-					log$12.error({
+					log$13.error({
 						err,
 						event: "mcp_reconcile_failed"
 					}, "MCP reconcile failed");
@@ -1336,7 +1336,7 @@ var McpExtension = class {
 				try {
 					mtime = await readConfigMtimeMs(configPath);
 				} catch (err) {
-					log$12.warn({
+					log$13.warn({
 						err,
 						event: "mcp_mtime_check_failed"
 					}, "mtime check on mcp.config.json failed");
@@ -1350,7 +1350,7 @@ var McpExtension = class {
 						reason: "auto_reload"
 					});
 				} catch (err) {
-					log$12.error({
+					log$13.error({
 						err,
 						event: "mcp_auto_reload_failed"
 					}, "auto-reload after mcp.config.json change failed");
@@ -1713,6 +1713,370 @@ const bashDefaultTimeoutExtension = (pi) => {
 	});
 };
 //#endregion
+//#region src/extensions/resource-pressure-warning.ts
+/**
+* Mid-run resource-pressure warning to the agent.
+*
+* The sandbox already detects pressure — the boot scripts cap the
+* user-workload cgroup (memory.high/memory.max) and watchers log warn/crit
+* edges for memory and disk — but nothing told the *agent*, so a turn burned
+* straight to the OOM kill (or a full disk) and only learned about it from
+* the post-mortem notice. This extension closes that gap in-process: while a
+* turn is active it polls the agent cgroup and the root filesystem and, the
+* first time usage crosses a warn threshold, folds a system notification into
+* the open turn so the agent can checkpoint, shed work (constrain
+* parallelism, kill a background hog, clean scratch space), or request a
+* bigger tier BEFORE the kill.
+*
+* The notification is triggered by the two conditions that actually kill
+* work — memory near the cgroup hard cap, disk near full — and reports a
+* snapshot of all the relevant stats (memory, CPU utilization, disk) so the
+* agent can tell which resource is the problem and how much headroom the
+* others have.
+*
+* Edge-triggered, once per trigger per turn: the fired flags reset on
+* agent_start, so a turn that rides a threshold gets one warning per
+* resource, not a stream. Polling only runs while the agent is active — an
+* idle sandbox's resource usage is not the agent's problem and there is no
+* open turn to deliver into anyway.
+*
+* Best-effort throughout: any read failure (cgroup absent, controller not
+* delegated, non-cgroup-v2 host, df missing) reads as "no signal" for that
+* stat and the extension warns on what it can see — it must never break a
+* turn over an observability feature.
+*/
+const execFileAsync = promisify(execFile);
+const log$12 = logger.child({ module: "resource-pressure-warning" });
+const POLL_INTERVAL_MS = 1e4;
+function envOverride(name) {
+	for (const prefix of ["SKYDIVE_", "ANYONE_"]) {
+		const value = process.env[`${prefix}${name}`];
+		if (value != null && value !== "") return value;
+	}
+	return null;
+}
+function cgroupDir() {
+	return envOverride("AGENT_CGROUP") ?? "/sys/fs/cgroup/agent";
+}
+function diskRoot() {
+	return envOverride("DISK_ROOT") ?? "/";
+}
+/**
+* Read a cgroup v2 scalar file. Returns a number, or null for "max"
+* (uncapped), an empty/absent file, or any read/parse error — an uncapped or
+* unreadable limit means there is nothing meaningful to warn against.
+*/
+async function readScalar(file) {
+	try {
+		const raw = (await readFile(`${cgroupDir()}/${file}`, "utf8")).trim();
+		if (raw === "" || raw === "max") return null;
+		const n = Number(raw);
+		return Number.isFinite(n) ? n : null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* Read a cgroup v2 "flat keyed" file (one `key value` pair per line, e.g.
+* cpu.stat) and return the counter for `key`, or null when absent.
+*/
+async function readKeyedCounter(file, key) {
+	try {
+		const raw = await readFile(`${cgroupDir()}/${file}`, "utf8");
+		for (const line of raw.split("\n")) {
+			const [k, v] = line.trim().split(/\s+/);
+			if (k === key) {
+				const n = Number(v);
+				return Number.isFinite(n) ? n : null;
+			}
+		}
+		return null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* Live memory usage as an integer percent of the hard cap, or null when
+* either side is unreadable/uncapped. Exported for tests.
+*/
+async function readMemUsePct() {
+	const [current, max] = await Promise.all([readScalar("memory.current"), readScalar("memory.max")]);
+	if (current === null || max === null || max <= 0) return null;
+	return {
+		pct: Math.floor(current / max * 100),
+		currentBytes: current,
+		maxBytes: max
+	};
+}
+/**
+* Root filesystem used% (df -P Capacity column), or null on any failure.
+* Exported for tests.
+*/
+async function readDiskUsePct() {
+	try {
+		const { stdout } = await execFileAsync("df", ["-P", diskRoot()]);
+		const dataRow = stdout.trim().split("\n")[1];
+		if (dataRow == null) return null;
+		const capacity = dataRow.trim().split(/\s+/)[4];
+		if (capacity == null) return null;
+		const pct = Number(capacity.replace("%", ""));
+		return Number.isFinite(pct) ? pct : null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* CPU utilization sampler. cgroup v2 exposes cumulative CPU time
+* (cpu.stat usage_usec); utilization is the delta between two samples over
+* the wall time between them, normalized by core count. The first call after
+* construction has no previous sample and returns null.
+*/
+function createCpuSampler() {
+	let prevUsageUsec = null;
+	let prevAtMs = null;
+	return async () => {
+		const usage = await readKeyedCounter("cpu.stat", "usage_usec");
+		const now = Date.now();
+		const prev = prevUsageUsec;
+		const prevAt = prevAtMs;
+		prevUsageUsec = usage;
+		prevAtMs = now;
+		if (usage === null || prev === null || prevAt === null) return null;
+		const wallUsec = (now - prevAt) * 1e3;
+		if (wallUsec <= 0) return null;
+		const cores = availableParallelism();
+		const pct = Math.round((usage - prev) / (wallUsec * cores) * 100);
+		return Math.max(0, Math.min(100, pct));
+	};
+}
+function fmtMb(bytes) {
+	return Math.round(bytes / 1024 / 1024);
+}
+/** The model-facing warning text. Exported for tests. */
+function resourcePressureWarningText(trigger, { mem, cpuPct, diskPct }) {
+	const stats = [];
+	if (mem) stats.push(`memory ${mem.pct}% of cap (${fmtMb(mem.currentBytes)}/${fmtMb(mem.maxBytes)} MB)`);
+	if (cpuPct !== null) stats.push(`CPU ${cpuPct}%`);
+	if (diskPct !== null) stats.push(`disk ${diskPct}% full`);
+	const lead = trigger === "memory" ? `Your sandbox is at ${mem?.pct}% of its memory cap. If usage keeps climbing, the kernel will kill the offending process and this turn may die with it.` : `Your sandbox's disk is ${diskPct}% full. If it fills completely, writes will start failing and this turn may die with them.`;
+	const remedy = trigger === "memory" ? "checkpoint in-flight work (commit and push), then reduce the footprint — constrain parallelism, run heavy steps sequentially, or kill background processes you no longer need." : "checkpoint in-flight work (commit and push), then free space — clean build artifacts, caches, and scratch files you no longer need.";
+	return `<system_notification>${lead} Current usage: ${stats.join(", ")}. Act now: ${remedy} If the workload genuinely needs more resources, request a bigger sandbox with \`platform compute request\`. This is an automated resource warning, not a message from the user; continue the task, adjusted.</system_notification>`;
+}
+const resourcePressureWarningExtension = (pi) => {
+	let agentActive = false;
+	let warnedMemThisTurn = false;
+	let warnedDiskThisTurn = false;
+	let timer = null;
+	const sampleCpu = createCpuSampler();
+	async function checkOnce() {
+		if (!agentActive || warnedMemThisTurn && warnedDiskThisTurn) return;
+		const [mem, cpuPct, diskPct] = await Promise.all([
+			readMemUsePct(),
+			sampleCpu(),
+			readDiskUsePct()
+		]);
+		let trigger = null;
+		if (!warnedMemThisTurn && mem !== null && mem.pct >= 80) {
+			trigger = "memory";
+			warnedMemThisTurn = true;
+		} else if (!warnedDiskThisTurn && diskPct !== null && diskPct >= 80) {
+			trigger = "disk";
+			warnedDiskThisTurn = true;
+		}
+		if (trigger === null) return;
+		log$12.warn({
+			trigger,
+			mem,
+			cpuPct,
+			diskPct
+		}, "resource pressure warning delivered to agent");
+		await pi.sendMessage({
+			customType: "anyone-resource-pressure-warning",
+			content: resourcePressureWarningText(trigger, {
+				mem,
+				cpuPct,
+				diskPct
+			}),
+			display: false
+		}, {
+			triggerTurn: true,
+			deliverAs: "followUp"
+		});
+	}
+	pi.on("agent_start", async () => {
+		agentActive = true;
+		warnedMemThisTurn = false;
+		warnedDiskThisTurn = false;
+		if (!timer) {
+			timer = setInterval(() => {
+				checkOnce().catch((err) => {
+					log$12.error({ err }, "resource pressure check failed");
+				});
+			}, POLL_INTERVAL_MS);
+			timer.unref?.();
+		}
+	});
+	pi.on("agent_end", async () => {
+		agentActive = false;
+		if (timer) {
+			clearInterval(timer);
+			timer = null;
+		}
+	});
+};
+//#endregion
+//#region src/extensions/disk-guard.ts
+const log$11 = logger.child({ module: "disk-guard" });
+/**
+* In-band bypass. The guard is a safety net, not a jail: when the agent knows
+* a flagged command is genuinely safe (writing to a different mount, a tiny
+* bounded download, a delete-then-clone one-liner, an emergency it accepts the
+* risk on) it can force the command through by appending this marker as a
+* trailing shell comment. Kept as a comment so it never changes what the
+* command does, and matched case-insensitively with flexible spacing so the
+* agent doesn't have to reproduce it byte-for-byte.
+*/
+const BYPASS_MARKER = /#\s*disk-guard:\s*allow\b/i;
+/** The exact marker text the block message tells the agent to append. */
+const BYPASS_HINT = "# disk-guard: allow";
+/**
+* Harness-level kill switch: set DISK_GUARD_DISABLE=1 to turn the guard off
+* entirely. This is the "I own my harness, let me opt out" knob — an agent
+* that boots its own harness can disable the guard for its whole process
+* without a code roll, and it's also the fleet-wide escape hatch if the
+* classifier ever misfires and blocks real work. The bare name is honored
+* first; the SKYDIVE_/ANYONE_ prefixes are accepted too for consistency with
+* the other env overrides. Empty/unset/"0"/"false" leave the guard on.
+*/
+function guardDisabledByEnv() {
+	for (const name of [
+		"DISK_GUARD_DISABLE",
+		"SKYDIVE_DISK_GUARD_DISABLE",
+		"ANYONE_DISK_GUARD_DISABLE"
+	]) {
+		const value = process.env[name];
+		if (value != null && value !== "" && value !== "0" && value !== "false") return true;
+	}
+	return false;
+}
+/** True when the command carries the in-band bypass marker. */
+function hasBypassMarker(command) {
+	return BYPASS_MARKER.test(command);
+}
+/**
+* Commands that reclaim space or merely inspect it. If any of these verbs
+* appears in the command line, we never block — otherwise the guard would trap
+* the agent by blocking the exact command it needs to dig out. Matched as
+* whole words so `remove-item` etc. don't accidentally match `rm`.
+*/
+const RECLAIM_PATTERNS = [
+	/\brm\b/,
+	/\brmdir\b/,
+	/\bdf\b/,
+	/\bdu\b/,
+	/\bncdu\b/,
+	/\bfind\b[^|]*\s-delete\b/,
+	/\btruncate\b/,
+	/\bgit\s+(gc|prune|clean|worktree\s+remove|worktree\s+prune)\b/,
+	/\b(yarn|npm|pnpm|bun)\s+.*\b(cache\s+clean|cache\s+clear|store\s+prune)\b/,
+	/\bcache\s+(clean|clear|prune)\b/,
+	/\b(docker|podman)\s+.*\bprune\b/,
+	/\bapt(-get)?\s+clean\b/,
+	/\bjournalctl\b[^|]*--vacuum/
+];
+/**
+* File extensions that mean a download is actually LARGE — archives, disk
+* images, compiled/binary artifacts, model weights, media. A curl/wget is only
+* gated when it writes one of these; an API/page fetch to a `.json`/`.html`/
+* `.txt` file is tiny and must not be blocked. Derived from 4,144 real
+* commands: ~64% of `curl -o` uses were tiny fetches, only ~4% large.
+*/
+const BIG_DOWNLOAD_EXT = "(?:tar\\.gz|tgz|tar|zip|iso|gz|bz2|xz|zst|deb|rpm|pkg|dmg|whl|jar|7z|img|mp4|mov|avi|mkv|onnx|gguf|safetensors|bin|node)";
+/**
+* Commands that consume a meaningful amount of disk. Kept deliberately tight
+* and high-precision: validated against 4,144 real commands from the last 7
+* days, the earlier "writes a file" heuristic flagged 82% of everything (a
+* `curl -o /tmp/x.json` API call is not a disk event). This set flags ~33%,
+* almost all genuinely large — real installs, clones, big-archive downloads,
+* extractions. What was DROPPED and why:
+*   - `git fetch` / `git pull` — incremental on an existing clone, usually tiny.
+*   - `git checkout` — overwhelmingly `git checkout <ref> -- <file>` or a
+*     branch switch, ~zero net growth; the rare full materialization isn't
+*     worth the false-positive rate.
+*   - bare `curl -o` / `wget -o` — see BIG_DOWNLOAD_EXT above.
+*   - loose `… build` — matched `--mode=skip-build`, `oxfmt … build`, prose.
+* The remaining big-disk op in escher is `git clone` and `git worktree add`
+* (which is really a checkout), both kept.
+*/
+const SPACE_HUNGRY_PATTERNS = [
+	/\bgit\s+clone\b/,
+	/\bgit\s+worktree\s+add\b/,
+	/\b(yarn|npm|pnpm|bun)\s+(install|add|ci)\b/,
+	/\byarn\s*$/,
+	/\byarn\s+--(?!version|help)\S/,
+	/\bpip3?\s+install\b/,
+	/\bapt(-get)?\s+install\b/,
+	/\bnpm\s+pack\b/,
+	/\bdocker\s+(build|pull)\b/,
+	new RegExp(`\\b(?:curl|wget)\\b[^\\n]*\\s-[a-zA-Z]*[oO]\\b[^\\n]*\\.${BIG_DOWNLOAD_EXT}\\b`, "i"),
+	new RegExp(`\\b(?:curl|wget)\\b[^\\n]*\\.${BIG_DOWNLOAD_EXT}\\b[^\\n]*\\s-[a-zA-Z]*[oO]\\b`, "i"),
+	/\btar\s+[^\n|]*x[^\n|]*f/,
+	/\bunzip\b/,
+	/\bdd\b[^\n|]*\bof=/
+];
+/**
+* True when the command reclaims or inspects space — these are always allowed,
+* even on a 100%-full box, so the agent can dig itself out.
+*/
+function isReclaimCommand(command) {
+	return RECLAIM_PATTERNS.some((re) => re.test(command));
+}
+/**
+* True when the command is likely to consume a meaningful amount of disk.
+* A reclaim/inspect command is never space-hungry — the reclaim check wins so a
+* `git worktree remove` or a `yarn cache clean` is never mistaken for growth.
+*/
+function isSpaceHungryCommand(command) {
+	if (isReclaimCommand(command)) return false;
+	return SPACE_HUNGRY_PATTERNS.some((re) => re.test(command));
+}
+/**
+* The decision, factored out and pure so it's exhaustively testable without a
+* real filesystem. Block only when we have a disk reading, it's at/above the
+* critical threshold, the command is space-hungry (and not a reclaim), and the
+* agent hasn't explicitly opted out with the bypass marker.
+*/
+function shouldBlockForDisk(command, diskPct) {
+	if (diskPct === null) return false;
+	if (diskPct < 95) return false;
+	if (hasBypassMarker(command)) return false;
+	return isSpaceHungryCommand(command);
+}
+/** The agent-facing explanation returned as the blocked tool result. */
+function diskBlockReason(command, diskPct) {
+	return `Blocked: the sandbox disk is ${diskPct}% full and this command (\`${command.trim().slice(0, 120)}\`) writes a large amount, so it would fail partway with ENOSPC and leave a corrupt result. Reclaim space FIRST, then retry. Free ONLY what THIS conversation created — scratch/build output you wrote this run, downloads you're done with, and worktrees/branches whose work you've already committed and pushed (\`git worktree remove\`, \`yarn cache clean\`, delete your own scratch). Do NOT blindly wipe /tmp or delete a clone/worktree you don't recognize — other conversations share this box. Check headroom with \`df -h /\` and \`du -sh ~/workspace/* 2>/dev/null\`. If you genuinely can't free enough, stop and tell the user you're blocked on disk rather than retrying the write. If you're certain this command is safe anyway (writes elsewhere, tiny bounded size, delete-then-write), force it through by appending \` ${BYPASS_HINT}\` to the command.`;
+}
+const diskGuardExtension = (pi) => {
+	pi.on("tool_call", async (event) => {
+		if (event.toolName !== "bash") return;
+		if (guardDisabledByEnv()) return;
+		const command = event.input.command;
+		if (typeof command !== "string" || command.length === 0) return;
+		if (hasBypassMarker(command)) return;
+		if (!isSpaceHungryCommand(command)) return;
+		const diskPct = await readDiskUsePct();
+		if (!shouldBlockForDisk(command, diskPct)) return;
+		log$11.warn({
+			diskPct,
+			command: command.slice(0, 200)
+		}, "blocked space-hungry bash command on near-full disk");
+		return {
+			block: true,
+			reason: diskBlockReason(command, diskPct)
+		};
+	});
+};
+//#endregion
 //#region src/channel-context-ref.ts
 /**
 * The worker injects a small reference — `{ channel, messageId, runId }` —
@@ -1775,7 +2139,7 @@ const HEARTBEAT_THROTTLE_MS = 6e4;
 const TOOL_HEARTBEAT_INTERVAL_MS = 5e3;
 const MAX_TOOL_HEARTBEATS = 1440 * 60 * 1e3 / TOOL_HEARTBEAT_INTERVAL_MS;
 const DAEMON_URL = "http://localhost:38994";
-const log$11 = logger.child({ module: "platform-ext" });
+const log$10 = logger.child({ module: "platform-ext" });
 function sandboxClient() {
 	const apiUrl = apiBaseUrl();
 	if (!apiUrl) return null;
@@ -1843,7 +2207,7 @@ async function fetchHarnessFlags() {
 	try {
 		const res = await client["feature-flags"].$get();
 		if (!res.ok) {
-			log$11.debug({
+			log$10.debug({
 				status: res.status,
 				event: "feature_flags_fetch_failed"
 			}, "feature-flags fetch failed");
@@ -1851,7 +2215,7 @@ async function fetchHarnessFlags() {
 		}
 		return { contextManagement: (await res.json()).contextManagement ?? null };
 	} catch (err) {
-		log$11.debug({
+		log$10.debug({
 			err,
 			event: "feature_flags_fetch_error"
 		}, "feature-flags request errored");
@@ -1862,7 +2226,7 @@ function postHeartbeat({ messageId }) {
 	const client = sandboxClient();
 	if (!client) return;
 	client.heartbeat.$post({ json: { messageId } }).catch((err) => {
-		log$11.debug({
+		log$10.debug({
 			err,
 			event: "heartbeat_failed"
 		}, "heartbeat failed");
@@ -1874,7 +2238,7 @@ async function resolveConversationFromApi(messageId) {
 	try {
 		const res = await client["message-conversation"].$get({ query: { messageId } });
 		if (!res.ok) {
-			log$11.warn({
+			log$10.warn({
 				status: res.status,
 				messageId,
 				event: "resolve_conversation_failed"
@@ -1883,7 +2247,7 @@ async function resolveConversationFromApi(messageId) {
 		}
 		return (await res.json()).conversationId ?? null;
 	} catch (err) {
-		log$11.warn({
+		log$10.warn({
 			err,
 			messageId,
 			event: "resolve_conversation_error"
@@ -1968,7 +2332,7 @@ function createToolHeartbeat({ messageId }) {
 			}
 			heartbeatCount++;
 			if (heartbeatCount > MAX_TOOL_HEARTBEATS) {
-				log$11.warn({
+				log$10.warn({
 					heartbeatCount,
 					activeToolCalls: [...activeToolCalls]
 				}, "tool heartbeat max reached, stopping");
@@ -1999,7 +2363,7 @@ function postToDaemon(path, body) {
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify(body)
 	}).catch((err) => {
-		log$11.debug({
+		log$10.debug({
 			err,
 			path,
 			event: "daemon_post_failed"
@@ -2008,7 +2372,7 @@ function postToDaemon(path, body) {
 }
 function createPlatformExtensions({ sessionId, channelContext }) {
 	return (pi) => {
-		log$11.info({
+		log$10.info({
 			sessionId,
 			hasChannelContext: Boolean(channelContext)
 		}, "platform extension initialized");
@@ -2057,7 +2421,7 @@ function createPlatformExtensions({ sessionId, channelContext }) {
 			});
 		});
 		pi.on("agent_end", () => {
-			log$11.info({ sessionId }, "session ending");
+			log$10.info({ sessionId }, "session ending");
 			postToDaemon("/session/end", { sessionId });
 		});
 	};
@@ -2083,7 +2447,7 @@ function createPlatformExtensions({ sessionId, channelContext }) {
 * alive and an indeterminate result (no api url / transient failure) leaves the
 * last-known values untouched so a blip can't silently flip behavior.
 */
-const log$10 = logger.child({ module: "feature-flags-poll" });
+const log$9 = logger.child({ module: "feature-flags-poll" });
 const FLAG_POLL_INTERVAL_MS = 6e4;
 let contextManagement = null;
 const subscribers = { contextManagement: /* @__PURE__ */ new Set() };
@@ -2118,7 +2482,7 @@ function apply(name, next) {
 	if (next !== prev) for (const cb of subscribers[name]) try {
 		cb(next);
 	} catch (err) {
-		log$10.warn({
+		log$9.warn({
 			err,
 			flag: name
 		}, "flag subscriber threw");
@@ -2130,7 +2494,7 @@ async function pollOnce() {
 		if (!flags) return;
 		apply("contextManagement", flags.contextManagement ?? null);
 	} catch (err) {
-		log$10.debug({ err }, "feature-flag poll threw");
+		log$9.debug({ err }, "feature-flag poll threw");
 	}
 }
 /**
@@ -2237,7 +2601,7 @@ function transformContextMessages(messages, config, now) {
 }
 //#endregion
 //#region src/extensions/context-management.ts
-const log$9 = logger.child({ module: "context-management-extension" });
+const log$8 = logger.child({ module: "context-management-extension" });
 function isAnthropicMessagesPayload(payload) {
 	if (typeof payload !== "object" || payload === null) return false;
 	const candidate = payload;
@@ -2302,13 +2666,13 @@ function createContextManagementExtension() {
 		setContextManagementFlagOverride(getPolledFlag("contextManagement"));
 		onFlagChange("contextManagement", (enabled) => {
 			setContextManagementFlagOverride(enabled);
-			log$9.info({
+			log$8.info({
 				event: "context_management_flag_update",
 				enabled
 			}, "context-management flag updated from platform");
 		});
 		startFeatureFlagPoller();
-		log$9.info({
+		log$8.info({
 			event: "context_management_registered",
 			enabled: initial.enabled,
 			flagSource: hasFlagSource(),
@@ -2320,13 +2684,13 @@ function createContextManagementExtension() {
 			const { messages } = event;
 			try {
 				const result = transformContextIfEnabled(messages, getContextManagementConfig(), Date.now());
-				if (result.stats && (result.stats.clearedResults > 0 || result.stats.trimmedResults > 0)) log$9.info({
+				if (result.stats && (result.stats.clearedResults > 0 || result.stats.trimmedResults > 0)) log$8.info({
 					event: "context_management_applied",
 					...result.stats
 				}, "trimmed/cleared tool output before LLM call");
 				return { messages: result.messages };
 			} catch (err) {
-				log$9.error({
+				log$8.error({
 					err,
 					event: "context_management_transform_failed"
 				}, "context transform failed; passing messages through unchanged");
@@ -2338,7 +2702,7 @@ function createContextManagementExtension() {
 }
 //#endregion
 //#region src/extensions/current-time.ts
-const log$8 = logger.child({ module: "current-time-extension" });
+const log$7 = logger.child({ module: "current-time-extension" });
 const PI_DATE_LINE = /^Current date:.*$/m;
 function formatCurrentTimeLine(now) {
 	return `Current date: ${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}-${String(now.getUTCDate()).padStart(2, "0")} (${new Intl.DateTimeFormat("en-US", {
@@ -2351,7 +2715,7 @@ const currentTimeExtension = (pi) => {
 		const line = formatCurrentTimeLine(/* @__PURE__ */ new Date());
 		const base = event.systemPrompt;
 		if (PI_DATE_LINE.test(base)) {
-			log$8.info({ event: "pi_date_line_present" }, "pi base prompt carries its own 'Current date:' line again; replacing it in place (pi prompt format may have changed)");
+			log$7.info({ event: "pi_date_line_present" }, "pi base prompt carries its own 'Current date:' line again; replacing it in place (pi prompt format may have changed)");
 			return { systemPrompt: base.replace(PI_DATE_LINE, line) };
 		}
 		return { systemPrompt: `${base}\n${line}` };
@@ -2588,7 +2952,7 @@ function renderIndex(entries) {
 }
 //#endregion
 //#region src/extensions/memory.ts
-const log$7 = logger.child({ module: "memory-extension" });
+const log$6 = logger.child({ module: "memory-extension" });
 /**
 * The standing instructions for the memory system. Always injected (even with
 * an empty `.memory/`) so the agent knows it can persist notes. `users/` is
@@ -2622,7 +2986,7 @@ const memoryExtension = (pi) => {
 				index
 			});
 		} catch (err) {
-			log$7.warn({
+			log$6.warn({
 				err,
 				event: "memory_index_failed"
 			}, "memory index build failed; injecting instructions only");
@@ -2636,7 +3000,7 @@ const memoryExtension = (pi) => {
 };
 //#endregion
 //#region src/extensions/platform-memory.ts
-const log$6 = logger.child({ module: "platform-memory-extension" });
+const log$5 = logger.child({ module: "platform-memory-extension" });
 /**
 * Resolve the human on this turn via the API, keyed by the message id.
 * `/sandbox/channel-context` only returns a sender for a platform-known
@@ -2649,13 +3013,13 @@ const log$6 = logger.child({ module: "platform-memory-extension" });
 async function resolveTurnUser(messageId) {
 	const client = sandboxClient();
 	if (!client) {
-		log$6.debug({ event: "resolve_turn_user_no_api_url" }, "no API url in env; withholding user memory");
+		log$5.debug({ event: "resolve_turn_user_no_api_url" }, "no API url in env; withholding user memory");
 		return null;
 	}
 	try {
 		const res = await client["channel-context"].$get({ query: { messageId } });
 		if (!res.ok) {
-			log$6.warn({
+			log$5.warn({
 				event: "resolve_turn_user_failed",
 				status: res.status
 			}, "channel-context returned non-ok; withholding user memory");
@@ -2668,7 +3032,7 @@ async function resolveTurnUser(messageId) {
 			displayName: sender.displayName
 		};
 	} catch (err) {
-		log$6.warn({
+		log$5.warn({
 			err,
 			event: "resolve_turn_user_failed"
 		}, "failed to resolve current user; withholding user memory");
@@ -2715,7 +3079,7 @@ function createPlatformMemoryExtension({ channelContext }) {
 					user
 				});
 			} catch (err) {
-				log$6.warn({
+				log$5.warn({
 					err,
 					event: "user_memory_index_failed"
 				}, "user memory index build failed; skipping injection");
@@ -2730,7 +3094,7 @@ function createPlatformMemoryExtension({ channelContext }) {
 }
 //#endregion
 //#region src/extensions/self-trace.ts
-const log$5 = logger.child({ module: "self-trace-extension" });
+const log$4 = logger.child({ module: "self-trace-extension" });
 /**
 * Reports the agent's own execution as OpenTelemetry spans:
 * agent.session → agent.run → agent.turn.N → tool.NAME, with token/cost
@@ -2755,7 +3119,7 @@ const selfTraceExtension = (pi) => {
 		sessionSpan = tracer.startSpan("agent.session", { attributes: { "agent.model": modelId } }, remoteCtx);
 		sessionCtx = trace.setSpan(remoteCtx, sessionSpan);
 		const sc = sessionSpan.spanContext();
-		log$5.info({
+		log$4.info({
 			event: "self_trace_session_start",
 			trace_id: sc.traceId,
 			span_id: sc.spanId,
@@ -2867,13 +3231,13 @@ const selfTraceExtension = (pi) => {
 * Lives in the harness package — soul.md is content from the agent's
 * own git repo, not from the platform — so its handling stays here.
 */
-const log$4 = logger.child({ module: "soul-extension" });
+const log$3 = logger.child({ module: "soul-extension" });
 async function readSoul(cwd) {
 	try {
 		return (await readFile(join(cwd, "soul.md"), "utf8")).trim() || null;
 	} catch (err) {
 		if (err?.code === "ENOENT") return null;
-		log$4.warn({
+		log$3.warn({
 			err,
 			event: "soul_read_failed"
 		}, "soul.md read failed");
@@ -2905,7 +3269,7 @@ const soulExtension = (pi) => {
 };
 //#endregion
 //#region src/extensions/subagent/index.ts
-const log$3 = logger.child({ module: "subagent-ext" });
+const log$2 = logger.child({ module: "subagent-ext" });
 const MAX_TASKS = 8;
 const TaskItem = Type.Object({
 	task: Type.String({ description: "The task to delegate to a subagent run." }),
@@ -2965,7 +3329,7 @@ function buildTool(messageId) {
 					tasks: spawnTasks
 				});
 				const { taskIds } = spawned;
-				log$3.info({
+				log$2.info({
 					event: "subagent_spawned",
 					count: taskIds.length
 				}, "subagent tasks queued");
@@ -2988,7 +3352,7 @@ function buildTool(messageId) {
 				};
 			} catch (err) {
 				const message = err instanceof Error ? err.message : String(err);
-				log$3.warn({
+				log$2.warn({
 					err,
 					event: "subagent_spawn_failed"
 				}, "subagent spawn failed");
@@ -3019,7 +3383,7 @@ function createSubagentExtension({ channelContext }) {
 			if (registered) return;
 			registered = true;
 			pi.registerTool(buildTool(messageId));
-			log$3.info({ event: "subagent_enabled" }, "subagent tool registered");
+			log$2.info({ event: "subagent_enabled" }, "subagent tool registered");
 		};
 		pi.on("session_start", () => {
 			registerOnce();
@@ -3027,218 +3391,6 @@ function createSubagentExtension({ channelContext }) {
 	};
 }
 //#endregion
-//#region src/extensions/resource-pressure-warning.ts
-/**
-* Mid-run resource-pressure warning to the agent.
-*
-* The sandbox already detects pressure — the boot scripts cap the
-* user-workload cgroup (memory.high/memory.max) and watchers log warn/crit
-* edges for memory and disk — but nothing told the *agent*, so a turn burned
-* straight to the OOM kill (or a full disk) and only learned about it from
-* the post-mortem notice. This extension closes that gap in-process: while a
-* turn is active it polls the agent cgroup and the root filesystem and, the
-* first time usage crosses a warn threshold, folds a system notification into
-* the open turn so the agent can checkpoint, shed work (constrain
-* parallelism, kill a background hog, clean scratch space), or request a
-* bigger tier BEFORE the kill.
-*
-* The notification is triggered by the two conditions that actually kill
-* work — memory near the cgroup hard cap, disk near full — and reports a
-* snapshot of all the relevant stats (memory, CPU utilization, disk) so the
-* agent can tell which resource is the problem and how much headroom the
-* others have.
-*
-* Edge-triggered, once per trigger per turn: the fired flags reset on
-* agent_start, so a turn that rides a threshold gets one warning per
-* resource, not a stream. Polling only runs while the agent is active — an
-* idle sandbox's resource usage is not the agent's problem and there is no
-* open turn to deliver into anyway.
-*
-* Best-effort throughout: any read failure (cgroup absent, controller not
-* delegated, non-cgroup-v2 host, df missing) reads as "no signal" for that
-* stat and the extension warns on what it can see — it must never break a
-* turn over an observability feature.
-*/
-const execFileAsync = promisify(execFile);
-const log$2 = logger.child({ module: "resource-pressure-warning" });
-const POLL_INTERVAL_MS = 1e4;
-function envOverride(name) {
-	for (const prefix of ["SKYDIVE_", "ANYONE_"]) {
-		const value = process.env[`${prefix}${name}`];
-		if (value != null && value !== "") return value;
-	}
-	return null;
-}
-function cgroupDir() {
-	return envOverride("AGENT_CGROUP") ?? "/sys/fs/cgroup/agent";
-}
-function diskRoot() {
-	return envOverride("DISK_ROOT") ?? "/";
-}
-/**
-* Read a cgroup v2 scalar file. Returns a number, or null for "max"
-* (uncapped), an empty/absent file, or any read/parse error — an uncapped or
-* unreadable limit means there is nothing meaningful to warn against.
-*/
-async function readScalar(file) {
-	try {
-		const raw = (await readFile(`${cgroupDir()}/${file}`, "utf8")).trim();
-		if (raw === "" || raw === "max") return null;
-		const n = Number(raw);
-		return Number.isFinite(n) ? n : null;
-	} catch (_error) {
-		return null;
-	}
-}
-/**
-* Read a cgroup v2 "flat keyed" file (one `key value` pair per line, e.g.
-* cpu.stat) and return the counter for `key`, or null when absent.
-*/
-async function readKeyedCounter(file, key) {
-	try {
-		const raw = await readFile(`${cgroupDir()}/${file}`, "utf8");
-		for (const line of raw.split("\n")) {
-			const [k, v] = line.trim().split(/\s+/);
-			if (k === key) {
-				const n = Number(v);
-				return Number.isFinite(n) ? n : null;
-			}
-		}
-		return null;
-	} catch (_error) {
-		return null;
-	}
-}
-/**
-* Live memory usage as an integer percent of the hard cap, or null when
-* either side is unreadable/uncapped. Exported for tests.
-*/
-async function readMemUsePct() {
-	const [current, max] = await Promise.all([readScalar("memory.current"), readScalar("memory.max")]);
-	if (current === null || max === null || max <= 0) return null;
-	return {
-		pct: Math.floor(current / max * 100),
-		currentBytes: current,
-		maxBytes: max
-	};
-}
-/**
-* Root filesystem used% (df -P Capacity column), or null on any failure.
-* Exported for tests.
-*/
-async function readDiskUsePct() {
-	try {
-		const { stdout } = await execFileAsync("df", ["-P", diskRoot()]);
-		const dataRow = stdout.trim().split("\n")[1];
-		if (dataRow == null) return null;
-		const capacity = dataRow.trim().split(/\s+/)[4];
-		if (capacity == null) return null;
-		const pct = Number(capacity.replace("%", ""));
-		return Number.isFinite(pct) ? pct : null;
-	} catch (_error) {
-		return null;
-	}
-}
-/**
-* CPU utilization sampler. cgroup v2 exposes cumulative CPU time
-* (cpu.stat usage_usec); utilization is the delta between two samples over
-* the wall time between them, normalized by core count. The first call after
-* construction has no previous sample and returns null.
-*/
-function createCpuSampler() {
-	let prevUsageUsec = null;
-	let prevAtMs = null;
-	return async () => {
-		const usage = await readKeyedCounter("cpu.stat", "usage_usec");
-		const now = Date.now();
-		const prev = prevUsageUsec;
-		const prevAt = prevAtMs;
-		prevUsageUsec = usage;
-		prevAtMs = now;
-		if (usage === null || prev === null || prevAt === null) return null;
-		const wallUsec = (now - prevAt) * 1e3;
-		if (wallUsec <= 0) return null;
-		const cores = availableParallelism();
-		const pct = Math.round((usage - prev) / (wallUsec * cores) * 100);
-		return Math.max(0, Math.min(100, pct));
-	};
-}
-function fmtMb(bytes) {
-	return Math.round(bytes / 1024 / 1024);
-}
-/** The model-facing warning text. Exported for tests. */
-function resourcePressureWarningText(trigger, { mem, cpuPct, diskPct }) {
-	const stats = [];
-	if (mem) stats.push(`memory ${mem.pct}% of cap (${fmtMb(mem.currentBytes)}/${fmtMb(mem.maxBytes)} MB)`);
-	if (cpuPct !== null) stats.push(`CPU ${cpuPct}%`);
-	if (diskPct !== null) stats.push(`disk ${diskPct}% full`);
-	const lead = trigger === "memory" ? `Your sandbox is at ${mem?.pct}% of its memory cap. If usage keeps climbing, the kernel will kill the offending process and this turn may die with it.` : `Your sandbox's disk is ${diskPct}% full. If it fills completely, writes will start failing and this turn may die with them.`;
-	const remedy = trigger === "memory" ? "checkpoint in-flight work (commit and push), then reduce the footprint — constrain parallelism, run heavy steps sequentially, or kill background processes you no longer need." : "checkpoint in-flight work (commit and push), then free space — clean build artifacts, caches, and scratch files you no longer need.";
-	return `<system_notification>${lead} Current usage: ${stats.join(", ")}. Act now: ${remedy} If the workload genuinely needs more resources, request a bigger sandbox with \`platform compute request\`. This is an automated resource warning, not a message from the user; continue the task, adjusted.</system_notification>`;
-}
-const resourcePressureWarningExtension = (pi) => {
-	let agentActive = false;
-	let warnedMemThisTurn = false;
-	let warnedDiskThisTurn = false;
-	let timer = null;
-	const sampleCpu = createCpuSampler();
-	async function checkOnce() {
-		if (!agentActive || warnedMemThisTurn && warnedDiskThisTurn) return;
-		const [mem, cpuPct, diskPct] = await Promise.all([
-			readMemUsePct(),
-			sampleCpu(),
-			readDiskUsePct()
-		]);
-		let trigger = null;
-		if (!warnedMemThisTurn && mem !== null && mem.pct >= 80) {
-			trigger = "memory";
-			warnedMemThisTurn = true;
-		} else if (!warnedDiskThisTurn && diskPct !== null && diskPct >= 80) {
-			trigger = "disk";
-			warnedDiskThisTurn = true;
-		}
-		if (trigger === null) return;
-		log$2.warn({
-			trigger,
-			mem,
-			cpuPct,
-			diskPct
-		}, "resource pressure warning delivered to agent");
-		await pi.sendMessage({
-			customType: "anyone-resource-pressure-warning",
-			content: resourcePressureWarningText(trigger, {
-				mem,
-				cpuPct,
-				diskPct
-			}),
-			display: false
-		}, {
-			triggerTurn: true,
-			deliverAs: "followUp"
-		});
-	}
-	pi.on("agent_start", async () => {
-		agentActive = true;
-		warnedMemThisTurn = false;
-		warnedDiskThisTurn = false;
-		if (!timer) {
-			timer = setInterval(() => {
-				checkOnce().catch((err) => {
-					log$2.error({ err }, "resource pressure check failed");
-				});
-			}, POLL_INTERVAL_MS);
-			timer.unref?.();
-		}
-	});
-	pi.on("agent_end", async () => {
-		agentActive = false;
-		if (timer) {
-			clearInterval(timer);
-			timer = null;
-		}
-	});
-};
-//#endregion
 //#region src/extensions/tool-call-env.ts
 const TOOL_CALL_ID_VAR = "TOOL_CALL_ID";
 function shellQuoteValue(value) {
@@ -3994,6 +4146,7 @@ const all = [
 	localToolsExtension,
 	toolCallEnvExtension,
 	bashDefaultTimeoutExtension,
+	diskGuardExtension,
 	toolCallSummaryExtension
 ];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skydiveai/pi-extensions",
-  "version": "0.1.0-beta.1233",
+  "version": "0.1.0-beta.1235",
   "homepage": "https://skydive.com",
   "license": "MIT",
   "author": "Create, Inc.",