@skydiveai/pi-extensions 0.1.254-beta.5 → 0.1.254-beta.51

package/dist/index.mjs

@@ -260,7 +260,7 @@ function createHealthHandler({ metadata }) {
 const CAPABILITY_SOUL_NUDGE = "New capability gained — once the current task is done, if this changes what you can do for the user, record it in `soul.md` so it carries into future conversations rather than being rediscovered from scratch (then commit and push).";
 //#endregion
 //#region src/extensions/tool-call-summary.ts
-const log$15 = logger.child({ module: "tool-call-summary-extension" });
+const log$17 = logger.child({ module: "tool-call-summary-extension" });
 /**
 * The injected parameter name. Deliberately markdown-safe: the previous wire
 * name (`__skydive_summary__`, now `TOOL_CALL_SUMMARY_FIELD_LEGACY`) carried
@@ -494,7 +494,7 @@ function withSummaryStrippedBeforeValidation(tool) {
 		try {
 			stripped = withoutInjectedSummary(args);
 		} catch (err) {
-			log$15.error({
+			log$17.error({
 				err,
 				event: "tool_call_summary_prepare_strip_failed",
 				toolName: tool.name
@@ -525,7 +525,7 @@ function stripInjectedSummary(pi, toolName, input) {
 		if (toolDeclaresSummaryParam(pi, toolName)) return;
 		for (const field of TOOL_CALL_SUMMARY_FIELDS) delete input[field];
 	} catch (err) {
-		log$15.error({
+		log$17.error({
 			err,
 			event: "tool_call_summary_strip_failed",
 			toolName
@@ -541,7 +541,7 @@ function buildInjectedPayload(pi, payload) {
 	try {
 		return injectToolCallSummary(payload, getStrictToolNames(pi));
 	} catch (err) {
-		log$15.error({
+		log$17.error({
 			err,
 			event: "tool_call_summary_injection_failed"
 		}, "tool_call_summary injection failed; passing payload through unchanged");
@@ -560,7 +560,7 @@ const toolCallSummaryExtension = (pi) => {
 			pi.registerTool(withSummaryStrippedBeforeValidation(createEditToolDefinition(ctx.cwd)));
 			editOverrideRegistered = true;
 		} catch (err) {
-			log$15.error({
+			log$17.error({
 				err,
 				event: "tool_call_summary_edit_override_failed"
 			}, "failed to register summary-tolerant edit tool; built-in remains active");
@@ -591,7 +591,7 @@ const toolCallSummaryExtension = (pi) => {
 * or `ToolDefinition[]`. Files starting with `_` or `.` are skipped, so
 * `tools/_example.ts` documents the shape without registering.
 */
-const log$14 = logger.child({ module: "local-tools-extension" });
+const log$16 = logger.child({ module: "local-tools-extension" });
 const TOOLS_DIRNAME = "tools";
 const fileState = /* @__PURE__ */ new Map();
 let pendingLocalToolsUpdate = null;
@@ -735,7 +735,7 @@ async function reconcileAndQueue({ pi, dir, reason }) {
 		dir
 	});
 	if (reason !== "session_start" && summaryHasChanges$1(summary)) pendingLocalToolsUpdate = summary;
-	log$14.info({
+	log$16.info({
 		event: "local_tools_reconcile",
 		reason,
 		total_tools: summary.totalTools,
@@ -757,7 +757,7 @@ const localToolsExtension = (pi) => {
 				reason: "session_start"
 			});
 		} catch (err) {
-			log$14.error({
+			log$16.error({
 				err,
 				event: "local_tools_reconcile_failed"
 			}, "local tools reconcile failed");
@@ -769,7 +769,7 @@ const localToolsExtension = (pi) => {
 		try {
 			current = await listToolFiles(dir);
 		} catch (err) {
-			log$14.warn({
+			log$16.warn({
 				err,
 				event: "local_tools_listing_failed"
 			}, "tools/ listing failed");
@@ -791,7 +791,7 @@ const localToolsExtension = (pi) => {
 				reason: "auto_reload"
 			});
 		} catch (err) {
-			log$14.error({
+			log$16.error({
 				err,
 				event: "local_tools_auto_reload_failed"
 			}, "auto-reload after tools/ change failed");
@@ -1356,7 +1356,7 @@ async function loadMcpConfig(path) {
 * Clients are keyed by JSON-stringified config and reused across
 * reloads — only changed configs reconnect.
 */
-const log$13 = logger.child({ module: "mcp-extension" });
+const log$15 = logger.child({ module: "mcp-extension" });
 async function closeConnected(connected) {
 	try {
 		await connected.client.close();
@@ -1928,7 +1928,7 @@ var McpExtension = class {
 		});
 		this.lastConfigMtimeMs = await readConfigMtimeMs(configPath);
 		if (reason !== "session_start" && summaryHasChanges(summary)) this.pendingMcpUpdate = summary;
-		log$13.info({
+		log$15.info({
 			event: "mcp_reconcile",
 			reason,
 			total_tools: summary.totalTools,
@@ -1955,7 +1955,7 @@ var McpExtension = class {
 						contextWindow: ctx.model?.contextWindow
 					});
 				} catch (err) {
-					log$13.error({
+					log$15.error({
 						err,
 						event: "mcp_reconcile_failed"
 					}, "MCP reconcile failed");
@@ -1969,7 +1969,7 @@ var McpExtension = class {
 				for (const legacy of renamed) {
 					if (this.loggedLegacyToolNames.has(legacy)) continue;
 					this.loggedLegacyToolNames.add(legacy);
-					log$13.info({
+					log$15.info({
 						event: "mcp_tool_legacy_name",
 						legacy_name: legacy,
 						tool_name: this.legacyToolNames.get(legacy)
@@ -1983,7 +1983,7 @@ var McpExtension = class {
 				try {
 					mtime = await readConfigMtimeMs(configPath);
 				} catch (err) {
-					log$13.warn({
+					log$15.warn({
 						err,
 						event: "mcp_mtime_check_failed"
 					}, "mtime check on mcp.config.json failed");
@@ -1998,7 +1998,7 @@ var McpExtension = class {
 						contextWindow: ctx.model?.contextWindow
 					});
 				} catch (err) {
-					log$13.error({
+					log$15.error({
 						err,
 						event: "mcp_auto_reload_failed"
 					}, "auto-reload after mcp.config.json change failed");
@@ -2329,7 +2329,7 @@ const HEARTBEAT_THROTTLE_MS = 6e4;
 const TOOL_HEARTBEAT_INTERVAL_MS = 5e3;
 const MAX_TOOL_HEARTBEATS = 1440 * 60 * 1e3 / TOOL_HEARTBEAT_INTERVAL_MS;
 const DAEMON_URL = "http://localhost:38994";
-const log$12 = logger.child({ module: "platform-ext" });
+const log$14 = logger.child({ module: "platform-ext" });
 function sandboxClient() {
 	const apiUrl = apiBaseUrl();
 	if (!apiUrl) return null;
@@ -2397,7 +2397,7 @@ async function fetchHarnessFlags() {
 	try {
 		const res = await client["feature-flags"].$get();
 		if (!res.ok) {
-			log$12.debug({
+			log$14.debug({
 				status: res.status,
 				event: "feature_flags_fetch_failed"
 			}, "feature-flags fetch failed");
@@ -2409,7 +2409,7 @@ async function fetchHarnessFlags() {
 			closingText: body.closingText ?? null
 		};
 	} catch (err) {
-		log$12.debug({
+		log$14.debug({
 			err,
 			event: "feature_flags_fetch_error"
 		}, "feature-flags request errored");
@@ -2420,7 +2420,7 @@ function postHeartbeat({ messageId }) {
 	const client = sandboxClient();
 	if (!client) return;
 	client.heartbeat.$post({ json: { messageId } }).catch((err) => {
-		log$12.debug({
+		log$14.debug({
 			err,
 			event: "heartbeat_failed"
 		}, "heartbeat failed");
@@ -2432,7 +2432,7 @@ async function resolveConversationFromApi(messageId) {
 	try {
 		const res = await client["message-conversation"].$get({ query: { messageId } });
 		if (!res.ok) {
-			log$12.warn({
+			log$14.warn({
 				status: res.status,
 				messageId,
 				event: "resolve_conversation_failed"
@@ -2441,7 +2441,7 @@ async function resolveConversationFromApi(messageId) {
 		}
 		return (await res.json()).conversationId ?? null;
 	} catch (err) {
-		log$12.warn({
+		log$14.warn({
 			err,
 			messageId,
 			event: "resolve_conversation_error"
@@ -2466,13 +2466,13 @@ async function putBackgroundTaskJournalSpec({ messageId, spec }) {
 			messageId,
 			spec
 		} });
-		if (!res.ok) log$12.warn({
+		if (!res.ok) log$14.warn({
 			status: res.status,
 			taskId: spec.id,
 			event: "bg_journal_put_failed"
 		}, "bg-task journal PUT failed");
 	} catch (err) {
-		log$12.warn({
+		log$14.warn({
 			err,
 			taskId: spec.id,
 			event: "bg_journal_put_failed"
@@ -2488,7 +2488,7 @@ async function deleteBackgroundTaskJournalSpec({ messageId, taskId }) {
 			taskId
 		} });
 	} catch (err) {
-		log$12.debug({
+		log$14.debug({
 			err,
 			taskId,
 			event: "bg_journal_delete_failed"
@@ -2503,7 +2503,7 @@ async function listBackgroundTaskJournalSpecs({ messageId }) {
 		if (!res.ok) return [];
 		return (await res.json()).specs ?? [];
 	} catch (err) {
-		log$12.debug({
+		log$14.debug({
 			err,
 			event: "bg_journal_list_failed"
 		}, "bg-task journal GET failed");
@@ -2517,7 +2517,7 @@ function postBackgroundTasksSnapshot({ messageId, tasks }) {
 		messageId,
 		tasks
 	} }).catch((err) => {
-		log$12.debug({
+		log$14.debug({
 			err,
 			event: "bg_tasks_snapshot_failed"
 		}, "bg-tasks snapshot publish failed");
@@ -2615,7 +2615,7 @@ function createToolHeartbeat({ messageId }) {
 			}
 			heartbeatCount++;
 			if (heartbeatCount > MAX_TOOL_HEARTBEATS) {
-				log$12.warn({
+				log$14.warn({
 					heartbeatCount,
 					activeToolCalls: [...activeToolCalls]
 				}, "tool heartbeat max reached, stopping");
@@ -2646,7 +2646,7 @@ function postToDaemon(path, body) {
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify(body)
 	}).catch((err) => {
-		log$12.debug({
+		log$14.debug({
 			err,
 			path,
 			event: "daemon_post_failed"
@@ -2655,7 +2655,7 @@ function postToDaemon(path, body) {
 }
 function createPlatformExtensions({ sessionId, channelContext }) {
 	return (pi) => {
-		log$12.info({
+		log$14.info({
 			sessionId,
 			hasChannelContext: Boolean(channelContext)
 		}, "platform extension initialized");
@@ -2704,7 +2704,7 @@ function createPlatformExtensions({ sessionId, channelContext }) {
 			});
 		});
 		pi.on("agent_end", () => {
-			log$12.info({ sessionId }, "session ending");
+			log$14.info({ sessionId }, "session ending");
 			postToDaemon("/session/end", { sessionId });
 		});
 	};
@@ -2731,7 +2731,7 @@ function createPlatformExtensions({ sessionId, channelContext }) {
 * read on the hot path before every LLM call), it falls back to the default
 * for that knob and logs once.
 */
-const log$11 = logger.child({ module: "context-management-config" });
+const log$13 = logger.child({ module: "context-management-config" });
 const DEFAULT_CONTEXT_MANAGEMENT_CONFIG = {
 	enabled: false,
 	perResultMaxBytes: 16 * 1024,
@@ -2776,7 +2776,7 @@ function resolveContextManagementConfig(env = process.env) {
 		clearAtLeastTokens: env.SKYDIVE_CTX_CLEAR_AT_LEAST_TOKENS
 	});
 	if (!parsed.success) {
-		log$11.warn({
+		log$13.warn({
 			event: "context_management_config_invalid",
 			err: parsed.error
 		}, "falling back to default context-management config");
@@ -2860,7 +2860,7 @@ function hasFlagSource(env = process.env) {
 * alive and an indeterminate result (no api url / transient failure) leaves the
 * last-known values untouched so a blip can't silently flip behavior.
 */
-const log$10 = logger.child({ module: "feature-flags-poll" });
+const log$12 = logger.child({ module: "feature-flags-poll" });
 const FLAG_POLL_INTERVAL_MS = 6e4;
 let contextManagement = null;
 let closingText = null;
@@ -2900,7 +2900,7 @@ function apply(name, next) {
 	if (next !== prev) for (const cb of subscribers[name]) try {
 		cb(next);
 	} catch (err) {
-		log$10.warn({
+		log$12.warn({
 			err,
 			flag: name
 		}, "flag subscriber threw");
@@ -2913,7 +2913,7 @@ async function pollOnce() {
 		apply("contextManagement", flags.contextManagement ?? null);
 		apply("closingText", flags.closingText ?? null);
 	} catch (err) {
-		log$10.debug({ err }, "feature-flag poll threw");
+		log$12.debug({ err }, "feature-flag poll threw");
 	}
 }
 /**
@@ -3166,7 +3166,7 @@ const bashDefaultTimeoutExtension = (pi) => {
 * turn over an observability feature.
 */
 const execFileAsync = promisify(execFile);
-const log$9 = logger.child({ module: "resource-pressure-warning" });
+const log$11 = logger.child({ module: "resource-pressure-warning" });
 const POLL_INTERVAL_MS = 1e4;
 function envOverride(name) {
 	for (const prefix of ["SKYDIVE_", "ANYONE_"]) {
@@ -3363,7 +3363,7 @@ const resourcePressureWarningExtension = (pi) => {
 			warnedDiskThisTurn = true;
 		}
 		if (trigger === null) return;
-		log$9.warn({
+		log$11.warn({
 			trigger,
 			mem,
 			cpuPct,
@@ -3401,7 +3401,7 @@ const resourcePressureWarningExtension = (pi) => {
 		if (!timer) {
 			timer = setInterval(() => {
 				checkOnce().catch((err) => {
-					log$9.error({ err }, "resource pressure check failed");
+					log$11.error({ err }, "resource pressure check failed");
 				});
 			}, POLL_INTERVAL_MS);
 			timer.unref?.();
@@ -3417,7 +3417,7 @@ const resourcePressureWarningExtension = (pi) => {
 };
 //#endregion
 //#region src/extensions/disk-guard.ts
-const log$8 = logger.child({ module: "disk-guard" });
+const log$10 = logger.child({ module: "disk-guard" });
 /**
 * In-band bypass. The guard is a safety net, not a jail: when the agent knows
 * a flagged command is genuinely safe (writing to a different mount, a tiny
@@ -3427,9 +3427,9 @@ const log$8 = logger.child({ module: "disk-guard" });
 * command does, and matched case-insensitively with flexible spacing so the
 * agent doesn't have to reproduce it byte-for-byte.
 */
-const BYPASS_MARKER = /#\s*disk-guard:\s*allow\b/i;
+const BYPASS_MARKER$1 = /#\s*disk-guard:\s*allow\b/i;
 /** The exact marker text the block message tells the agent to append. */
-const BYPASS_HINT = "# disk-guard: allow";
+const BYPASS_HINT$2 = "# disk-guard: allow";
 /**
 * Harness-level kill switch: set DISK_GUARD_DISABLE=1 to turn the guard off
 * entirely. This is the "I own my harness, let me opt out" knob — an agent
@@ -3439,7 +3439,7 @@ const BYPASS_HINT = "# disk-guard: allow";
 * first; the SKYDIVE_/ANYONE_ prefixes are accepted too for consistency with
 * the other env overrides. Empty/unset/"0"/"false" leave the guard on.
 */
-function guardDisabledByEnv() {
+function guardDisabledByEnv$2() {
 	for (const name of [
 		"DISK_GUARD_DISABLE",
 		"SKYDIVE_DISK_GUARD_DISABLE",
@@ -3451,8 +3451,8 @@ function guardDisabledByEnv() {
 	return false;
 }
 /** True when the command carries the in-band bypass marker. */
-function hasBypassMarker(command) {
-	return BYPASS_MARKER.test(command);
+function hasBypassMarker$2(command) {
+	return BYPASS_MARKER$1.test(command);
 }
 /**
 * Commands that reclaim space or merely inspect it. If any of these verbs
@@ -3540,24 +3540,24 @@ function isSpaceHungryCommand(command) {
 function shouldBlockForDisk(command, diskPct) {
 	if (diskPct === null) return false;
 	if (diskPct < 95) return false;
-	if (hasBypassMarker(command)) return false;
+	if (hasBypassMarker$2(command)) return false;
 	return isSpaceHungryCommand(command);
 }
 /** The agent-facing explanation returned as the blocked tool result. */
 function diskBlockReason(command, diskPct) {
-	return `Blocked: the sandbox disk is ${diskPct}% full and this command (\`${command.trim().slice(0, 120)}\`) writes a large amount, so it would fail partway with ENOSPC and leave a corrupt result. Reclaim space FIRST, then retry. Free ONLY what THIS conversation created — scratch/build output you wrote this run, downloads you're done with, and worktrees/branches whose work you've already committed and pushed (\`git worktree remove\`, \`yarn cache clean\`, delete your own scratch). Do NOT blindly wipe /tmp or delete a clone/worktree you don't recognize — other conversations share this box. Check headroom with \`df -h /\` and \`du -sh ~/workspace/* 2>/dev/null\`. If you genuinely can't free enough, stop and tell the user you're blocked on disk rather than retrying the write. If you're certain this command is safe anyway (writes elsewhere, tiny bounded size, delete-then-write), force it through by appending \` ${BYPASS_HINT}\` to the command.`;
+	return `Blocked: the sandbox disk is ${diskPct}% full and this command (\`${command.trim().slice(0, 120)}\`) writes a large amount, so it would fail partway with ENOSPC and leave a corrupt result. Reclaim space FIRST, then retry. Free ONLY what THIS conversation created — scratch/build output you wrote this run, downloads you're done with, and worktrees/branches whose work you've already committed and pushed (\`git worktree remove\`, \`yarn cache clean\`, delete your own scratch). Do NOT blindly wipe /tmp or delete a clone/worktree you don't recognize — other conversations share this box. Check headroom with \`df -h /\` and \`du -sh ~/workspace/* 2>/dev/null\`. If you genuinely can't free enough, stop and tell the user you're blocked on disk rather than retrying the write. If you're certain this command is safe anyway (writes elsewhere, tiny bounded size, delete-then-write), force it through by appending \` ${BYPASS_HINT$2}\` to the command.`;
 }
 const diskGuardExtension = (pi) => {
 	pi.on("tool_call", async (event) => {
 		if (event.toolName !== "bash") return;
-		if (guardDisabledByEnv()) return;
+		if (guardDisabledByEnv$2()) return;
 		const command = event.input.command;
 		if (typeof command !== "string" || command.length === 0) return;
-		if (hasBypassMarker(command)) return;
+		if (hasBypassMarker$2(command)) return;
 		if (!isSpaceHungryCommand(command)) return;
 		const diskPct = await readDiskUsePct();
 		if (!shouldBlockForDisk(command, diskPct)) return;
-		log$8.warn({
+		log$10.warn({
 			diskPct,
 			command: command.slice(0, 200)
 		}, "blocked space-hungry bash command on near-full disk");
@@ -3568,6 +3568,452 @@ const diskGuardExtension = (pi) => {
 	});
 };
 //#endregion
+//#region src/extensions/noop-loop-guard.ts
+const log$9 = logger.child({ module: "noop-loop-guard" });
+/** Bare shell no-op: `true` or `:` (case-insensitive). */
+const BARE_NOOP_RE = /^(true|:)\s*$/i;
+/**
+* Shell metacharacters that make an `echo` argument more than a literal:
+* variables, command substitution, redirection, pipes. A matching argument
+* means real (or at least unknown) work, so it is never a no-op.
+*/
+const ECHO_ARG_METACHARS = /[$`><|&(){}]/;
+/** Longest `echo` argument still treated as a pure no-op. */
+const ECHO_ARG_MAX_LEN = 64;
+/** Marker that forces a single command through the guard. */
+const BYPASS_HINT$1 = "noop-guard: allow";
+/** Env vars that turn the guard off for the process. */
+const KILL_SWITCH_KEYS = ["NOOP_LOOP_GUARD_DISABLE", "SKYDIVE_NOOP_LOOP_GUARD_DISABLE"];
+function guardDisabledByEnv$1() {
+	return KILL_SWITCH_KEYS.some((key) => {
+		const value = process.env[key];
+		return value !== void 0 && value !== "" && value !== "0";
+	});
+}
+function hasBypassMarker$1(command) {
+	return command.toLowerCase().includes(BYPASS_HINT$1);
+}
+/**
+* True when one `;`/`&&`/newline-separated segment is a pure no-op: a bare
+* `true`/`:`, a comment-only segment, or a bare/pure-`echo` call.
+*/
+function segmentIsNoop(segment) {
+	let s = segment.trim();
+	if (s.length === 0) return true;
+	if (s.startsWith("#")) return true;
+	const hash = s.indexOf("#");
+	if (hash > 0) s = s.slice(0, hash).trim();
+	if (s.length === 0) return true;
+	if (BARE_NOOP_RE.test(s)) return true;
+	return isEchoNoop(s);
+}
+/**
+* True when the command is an `echo` that only prints a short literal: no
+* shell metacharacters, argument at most ECHO_ARG_MAX_LEN characters. Bare
+* `echo` (no argument) is also a no-op. Anything with `$`, backticks,
+* redirection, or pipes is real work and never matches.
+*/
+function isEchoNoop(command) {
+	const m = /^echo\s*(.*)$/.exec(command.trim());
+	if (!m || m[1] === void 0) return false;
+	let arg = m[1].trim();
+	if (arg.endsWith(";")) arg = arg.slice(0, -1).trim();
+	if (arg.length === 0) return true;
+	if (arg.length > ECHO_ARG_MAX_LEN) return false;
+	const quoted = /^(?:"([^"]*)"|'([^']*)')$/.exec(arg);
+	if (quoted) arg = quoted[1] ?? quoted[2] ?? "";
+	return arg.length <= ECHO_ARG_MAX_LEN && !ECHO_ARG_METACHARS.test(arg);
+}
+/**
+* True when the whole command is a shell no-op: only bare `true`/`:`,
+* pure `echo` calls, and comments, joined by `;`, `&&`, or newlines. Commands
+* that merely CONTAIN a no-op (`git foo || true`) are real work and never
+* match — `||` is deliberately not a no-op separator, because the left side
+* of `||` runs.
+*/
+function isBareNoop(command) {
+	const trimmed = command.trim();
+	if (trimmed.length === 0) return false;
+	return trimmed.split(/;|&&|\n/).every(segmentIsNoop);
+}
+function noopBlockReason(streak, aborted) {
+	const stop = "No-op loop: a bare `true`/`:` or a pure `echo` does nothing; it only costs a model round trip. If you are holding silence (e.g. right after `platform channel suppress-reply`) or waiting on something, the right move is to END THE TURN: emitting nothing IS the silence, and it costs zero commands. If a real process needs the wait, use `bg_run` or schedule a wake (`platform automation create --at <time>`).";
+	const escalate = aborted ? ` This run has now fired ${streak} consecutive no-ops; the harness is aborting it.` : ` ${Math.max(25 - streak, 0)} more before the harness aborts the run.`;
+	const bypass = ` If this specific command genuinely needs to run, append \` # ${BYPASS_HINT$1}\`.`;
+	return stop + escalate + bypass;
+}
+/** Count one bash command against the streak; returns the new streak. */
+function recordNoopCommand(state, command) {
+	if (!isBareNoop(command) || hasBypassMarker$1(command)) {
+		state.streak = 0;
+		return 0;
+	}
+	state.streak += 1;
+	return state.streak;
+}
+const noopLoopGuardExtension = (pi) => {
+	const state = { streak: 0 };
+	pi.on("tool_call", async (event, ctx) => {
+		if (event.toolName !== "bash") return;
+		if (guardDisabledByEnv$1()) return;
+		const command = event.input.command;
+		if (typeof command !== "string" || command.length === 0) return;
+		const streak = recordNoopCommand(state, command);
+		if (streak < 3) return;
+		const aborted = streak >= 25;
+		log$9.warn({
+			streak,
+			aborted,
+			toolCallId: event.toolCallId
+		}, "no-op loop guard fired");
+		if (aborted) ctx.abort();
+		return {
+			block: true,
+			reason: noopBlockReason(streak, aborted)
+		};
+	});
+};
+//#endregion
+//#region src/extensions/sleep-guard.ts
+/**
+* Foreground sleep guard: block `sleep` commands that hold the turn open.
+*
+* A foreground `sleep N` blocks the whole turn loop for N seconds: steers queue
+* behind it, the user sees silence, and nothing productive happens — agents
+* reaching for it are usually trying to "guarantee a resume" (wait for CI, a
+* deploy, a background job) without trusting the wakeup paths they actually
+* have. The wakeup paths exist — `bg_run` wakes the agent on completion, and a
+* scheduled wake (`platform automation create --at`) fires at a chosen time —
+* so the harness enforces their use instead of asking prose to win.
+*
+* Detection follows the shape Claude Code ships for the same problem: a
+* STANDALONE or LEADING integer `sleep N` is the poll/wedge pattern and is
+* blocked at 2s and up; float durations (`sleep 0.5`) and sub-2s sleeps are
+* legitimate pacing and stay free, and sleeps buried inside pipelines,
+* subshells, or larger command sequences are left alone (they pace real work
+* rather than idle the turn). On top of that shape we keep a backstop for
+* sleeps buried mid-command: a total of MAX_FOREGROUND_SLEEP_SECONDS of
+* foreground sleep in one command is still blocked, because even buried it
+* holds the turn.
+*
+* When the blocked command is a PURE sleep (nothing but sleeps and shell
+* separators), the guard doesn't bounce the agent at all: it schedules the
+* one-shot wake itself (`platform automation create --at`) and returns a
+* synthetic result saying the wake is set — the agent ends its turn and is
+* resumed at the requested time, which is exactly the semantics it was trying
+* to buy with the sleep, without holding the turn open. Mixed commands (sleep
+* plus other statements) and poll loops get guidance instead, because a timed
+* wake can't reproduce them: the right shape there is `bg_run` on the actual
+* command being waited on. A bare `sleep` parked in `bg_run` is also fine —
+* it is the tool to reach for when an out-of-band process needs the sandbox
+* to stay awake — though a pure sleep task wakes the agent with an empty
+* result, so background the real command instead when one exists.
+*
+* Poll loops are caught separately: `while`/`until` re-execute their sleep, so
+* the literal sum undercounts a real wait — an unbounded `while true|:|1` loop
+* with any sleep is blocked (it can never end on its own).
+*
+* It is never a jail: appending `# sleep-guard: allow` forces a single command
+* through, and SLEEP_GUARD_DISABLE=1 turns the guard off for the process (same
+* conventions as disk-guard).
+*
+* Static analysis only: `sleep "$DURATION"` or a sleep behind an alias is not
+* caught (we can't know the value). False negatives just keep today's
+* behavior; the bypass marker covers the rare false positive (e.g. a heredoc
+* embedding a script).
+*/
+const execFileP = promisify(execFile);
+const log$8 = logger.child({ module: "sleep-guard" });
+/** How long the `platform automation create` call may take before we fall back to guidance. */
+const SCHEDULE_TIMEOUT_MS = 15e3;
+/** Title for the one-shot wakes this guard schedules. Visible in the Routines UI. */
+const WAKE_TITLE = "sleep wake (auto)";
+const WAKE_SUMMARY = "One-shot timer wake the sleep guard scheduled in place of a blocked foreground sleep.";
+/**
+* The current conversation id, so the wake can resume THIS conversation
+* instead of firing into a bare cron run that has none of the task's
+* context. A bare `--at` wake starts a fresh run whose only input is the
+* description; the platform pattern for resuming is to have the firing post
+* into the original conversation, which replays it with full context.
+*/
+async function currentConversationId() {
+	try {
+		const { stdout } = await execFileP("platform", [
+			"channel",
+			"info",
+			"--json"
+		], { timeout: SCHEDULE_TIMEOUT_MS });
+		const parsed = JSON.parse(stdout);
+		return typeof parsed.conversationId === "string" && parsed.conversationId ? parsed.conversationId : null;
+	} catch {
+		return null;
+	}
+}
+function wakeDescription(seconds, conversationId) {
+	const context = `Timer wake (auto-scheduled by the sleep guard, replacing a foreground sleep of ${Math.round(seconds)}s). `;
+	if (conversationId) return context + `First run \`platform conversations post ${conversationId} "sleep wake fired: continue the interrupted task from where it left off; read the recent messages for context, then proceed.\"\` and end your turn, so the original conversation resumes with its full context.`;
+	return context + "Continue the interrupted task; read the recent messages for context, then proceed.";
+}
+/** In-band bypass marker, matched like disk-guard's. */
+const BYPASS_MARKER = /#\s*sleep-guard:\s*allow\b/i;
+/** The exact marker text the block message tells the agent to append. */
+const BYPASS_HINT = "# sleep-guard: allow";
+/** Harness-level kill switch, same env conventions as disk-guard. */
+function guardDisabledByEnv() {
+	for (const name of [
+		"SLEEP_GUARD_DISABLE",
+		"SKYDIVE_SLEEP_GUARD_DISABLE",
+		"ANYONE_SLEEP_GUARD_DISABLE"
+	]) {
+		const value = process.env[name];
+		if (value != null && value !== "" && value !== "0" && value !== "false") return true;
+	}
+	return false;
+}
+/** True when the command carries the in-band bypass marker. */
+function hasBypassMarker(command) {
+	return BYPASS_MARKER.test(command);
+}
+/**
+* One `sleep <duration>` invocation, parsed permissively the way GNU sleep
+* reads args: one or more `number[unit]` tokens, summed. No unit means seconds
+* (s); m/h/d are minutes/hours/days. Deliberately matches ONLY the sleep and
+* its duration tokens, so everything after (including a backgrounding `&`)
+* stays in the remainder for the backgrounded check and for the pure-sleep
+* check below.
+*/
+const SLEEP_CALL = /\bsleep\s+((?:\d+(?:\.\d+)?[smhd]?[^\S\n]*)+)/gi;
+/**
+* A same-length copy of the command with quoted regions ('…', "…") and
+* comments (# to end of line) replaced by spaces, so offsets are unchanged.
+* Detection runs on this copy: prose and fixtures — `echo 'sleep 900'`, a
+* printed snippet, `grep -n 'while true' app.ts` — are not real sleep calls
+* and must not be counted. Backticks and $() are NOT blanked: they execute,
+* so a sleep inside them still holds the turn and stays detectable.
+*/
+function blankQuotedRegions(command) {
+	const chars = command.split("");
+	let quote = null;
+	for (let i = 0; i < chars.length; i++) {
+		const ch = chars[i];
+		if (quote !== null) if (ch === quote) quote = null;
+		else {
+			chars[i] = " ";
+			if (quote === "\"" && ch === "\\" && i + 1 < chars.length) chars[++i] = " ";
+		}
+		else if (ch === "'" || ch === "\"") quote = ch;
+		else if (ch === "#") {
+			while (i < chars.length && chars[i] !== "\n") chars[i++] = " ";
+			i--;
+		}
+	}
+	return chars.join("");
+}
+/**
+* Remove line-continuation backslash-newline pairs (an odd run of
+* backslashes before the newline), so a `&` on the continued line is
+* visible to checks that look at what follows a sleep.
+*/
+function stripLineContinuations(text) {
+	return text.replace(/(\\*)\\\n/g, (_m, run) => run.length % 2 === 0 ? run : _m);
+}
+function parseDurationTokens(args) {
+	let total = 0;
+	for (const token of args.trim().split(/\s+/)) {
+		const match = /^(\d+(?:\.\d+)?)([smhd]?)$/i.exec(token);
+		if (!match) continue;
+		const value = Number(match[1]);
+		if (!Number.isFinite(value) || value <= 0) continue;
+		const unit = match[2].toLowerCase();
+		total += value * (unit === "m" ? 60 : unit === "h" ? 3600 : unit === "d" ? 86400 : 1);
+	}
+	return total;
+}
+/**
+* Index of the end of the logical line that contains `start`: a trailing
+* backslash continues the line, so in
+*
+*   sleep 900 \
+*   & echo hi
+*
+* the `&` on the continued line backgrounds the sleep and must be seen.
+*/
+function logicalLineEnd(command, start) {
+	let end = command.indexOf("\n", start);
+	while (end !== -1) {
+		let backslashes = 0;
+		for (let i = end - 1; i >= 0 && command[i] === "\\"; i--) backslashes++;
+		if (backslashes % 2 === 1) end = command.indexOf("\n", end + 1);
+		else break;
+	}
+	return end === -1 ? command.length : end;
+}
+/**
+* A matched sleep is already backgrounded when a single `&` (not `&&`) appears
+* later on the same logical line — `sleep 900 &` and `(sleep 900; curl x) &`
+* never hold the turn, so they don't count toward the cap. A `&` on a LATER
+* physical line does not background the sleep (it backgrounds that line's
+* command), so the remainder stops at the logical line end.
+*/
+function isBackgrounded(remainderOfLine) {
+	return /(^|[^&])&(?!\&)/.test(remainderOfLine);
+}
+/** Sum of foreground (non-backgrounded) literal sleep seconds in the command. */
+function sumForegroundSleeps(command) {
+	let total = 0;
+	for (const match of command.matchAll(SLEEP_CALL)) {
+		const seconds = parseDurationTokens(match[1] ?? "");
+		if (seconds <= 0) continue;
+		const start = (match.index ?? 0) + match[0].length;
+		if (isBackgrounded(command.slice(start, logicalLineEnd(command, start)))) continue;
+		total += seconds;
+	}
+	return total;
+}
+/**
+* The Claude Code wedge shape: the command STARTS with a standalone
+* `sleep N` (optionally followed by more statements). Only a leading sleep can
+* be a pure wait; the first thing a command does decides what it is.
+*/
+function detectLeadingSleep(command) {
+	const trimmed = command.trimStart();
+	const match = /^sleep\s+((?:\d+(?:\.\d+)?[smhd]?\s*)+)/.exec(trimmed);
+	if (!match) return null;
+	const seconds = parseDurationTokens(match[1]);
+	if (seconds < 2) return null;
+	const rest = stripLineContinuations(trimmed.slice(match[0].length)).trim();
+	if (/^&(?!&)/.test(rest)) return null;
+	return {
+		seconds,
+		rest
+	};
+}
+/** True when the command is a `while`/`until` loop (sleep re-executes in it). */
+function isPollLoop(command) {
+	return /\b(while|until)\b/.test(command);
+}
+/** True when the loop condition can never become false on its own. */
+function isUnboundedLoop(command) {
+	return /\bwhile\s+(?:true|1|:)(?![\w])/.test(command);
+}
+/**
+* True when the command is nothing but sleep calls joined by shell separators
+* (`sleep 900`, `sleep 5 && sleep 10`, comments) — the only shape a timed wake
+* can reproduce exactly.
+*/
+function isPureSleepCommand(command) {
+	return command.replace(BYPASS_MARKER, "").replace(/#[^\n]*/g, "").replace(SLEEP_CALL, "").trim().replace(/[\s;&|]+/g, "") === "";
+}
+/** The decision, factored out and pure so it's exhaustively testable. */
+function shouldBlockForSleep(command) {
+	if (hasBypassMarker(command)) return null;
+	const scanned = blankQuotedRegions(command);
+	const leading = detectLeadingSleep(scanned);
+	if (leading) return {
+		seconds: leading.seconds,
+		leading: true,
+		unboundedLoop: false
+	};
+	const seconds = sumForegroundSleeps(scanned);
+	if (seconds === 0) return null;
+	if (seconds >= 10) return {
+		seconds,
+		leading: false,
+		unboundedLoop: false
+	};
+	if (isPollLoop(scanned) && isUnboundedLoop(scanned)) return {
+		seconds,
+		leading: false,
+		unboundedLoop: true
+	};
+	return null;
+}
+/**
+* Per-session ledger of auto-scheduled wakes. An agent that re-runs its
+* blocked sleep (ignoring the do-not-re-run message) must not mint a second
+* routine for the same resume time, and a stuck agent must not accumulate
+* routines without bound.
+*/
+var SleepWakeLedger = class {
+	claimed = /* @__PURE__ */ new Set();
+	claim(at) {
+		if (this.claimed.has(at)) return "duplicate";
+		if (this.claimed.size >= 10) return "capped";
+		this.claimed.add(at);
+		return "scheduled";
+	}
+};
+/**
+* Schedule the one-shot wake via the platform CLI. Best-effort: on failure the
+* caller falls back to the guidance block so a CLI hiccup can never wedge the
+* guard.
+*/
+async function scheduleSleepWake(seconds, ledger) {
+	const at = new Date(Date.now() + seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+	const claim = ledger.claim(at);
+	if (claim === "capped") return null;
+	if (claim === "duplicate") return at;
+	try {
+		await execFileP("platform", [
+			"automation",
+			"create",
+			"--at",
+			at,
+			"--title",
+			WAKE_TITLE,
+			"--summary",
+			WAKE_SUMMARY,
+			wakeDescription(seconds, await currentConversationId())
+		], { timeout: SCHEDULE_TIMEOUT_MS });
+		return at;
+	} catch (err) {
+		log$8.warn({ err }, "failed to auto-schedule sleep wake; falling back to guidance");
+		return null;
+	}
+}
+/** The agent-facing explanation when the wake was auto-scheduled. */
+function sleepWakeReason(seconds, at) {
+	return `Foreground sleep replaced: instead of holding the turn open for ${Math.round(seconds)}s, a one-shot wake is scheduled for ${at} (in ${Math.round(seconds)}s). End your turn now — the wake fires and resumes this conversation with its context. Do NOT re-run the sleep.`;
+}
+/** The agent-facing explanation returned as the blocked tool result. */
+function sleepBlockReason(command, violation) {
+	return `Blocked: ${violation.unboundedLoop ? "this poll loop re-runs its sleep forever, so it never ends on its own" : violation.leading ? `this starts with a standalone sleep of ${Math.round(violation.seconds)}s` : `this sleeps ${Math.round(violation.seconds)}s in total in the foreground`}, which holds the whole turn open — the user sees silence and queued messages just wait. Waiting by sleeping is the wrong primitive; use the wakeup paths instead: (1) run the actual long command you're waiting on with \`bg_run\` — the build, deploy, or watch — and you're woken when it finishes; \`bg_run "sleep N"\` is also fine when you need the sandbox to stay awake for a process running out of band, though a pure sleep task wakes you with an empty result. (2) if you need a resume at a specific time, schedule one (\`platform automation create --at <time>\`); (3) if nothing needs doing until then, just end the turn. Sub-2s pacing sleeps are fine. If this specific command genuinely needs the wait, force it through by appending \` ${BYPASS_HINT}\`.`;
+}
+const sleepGuardExtension = (pi) => {
+	const wakeLedger = new SleepWakeLedger();
+	pi.on("tool_call", async (event) => {
+		if (event.toolName !== "bash") return;
+		if (guardDisabledByEnv()) return;
+		const command = event.input.command;
+		if (typeof command !== "string" || command.length === 0) return;
+		const violation = shouldBlockForSleep(command);
+		if (!violation) return;
+		log$8.warn({
+			seconds: violation.seconds,
+			leading: violation.leading,
+			unboundedLoop: violation.unboundedLoop,
+			command: command.slice(0, 200)
+		}, "blocked foreground sleep in bash command");
+		if (!violation.unboundedLoop && violation.seconds <= 86400 && isPureSleepCommand(blankQuotedRegions(command))) {
+			const at = await scheduleSleepWake(violation.seconds, wakeLedger);
+			if (at) {
+				log$8.info({
+					at,
+					seconds: violation.seconds
+				}, "auto-scheduled sleep wake");
+				return {
+					block: true,
+					reason: sleepWakeReason(violation.seconds, at)
+				};
+			}
+		}
+		return {
+			block: true,
+			reason: sleepBlockReason(command, violation)
+		};
+	});
+};
+//#endregion
 //#region src/extensions/context-management-trim.ts
 const CLEARED_PLACEHOLDER = "[old tool result cleared to save context — re-run the tool or re-read the source to recover it]";
 /** Rough token estimate (~4 chars/token); good enough for trigger decisions. */
@@ -5601,6 +6047,8 @@ const all = [
 	toolCallEnvExtension,
 	bashDefaultTimeoutExtension,
 	diskGuardExtension,
+	noopLoopGuardExtension,
+	sleepGuardExtension,
 	toolCallSummaryExtension
 ];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skydiveai/pi-extensions",
-  "version": "0.1.254-beta.5",
+  "version": "0.1.254-beta.51",
   "homepage": "https://skydive.com",
   "license": "MIT",
   "author": "Create, Inc.",
@@ -48,12 +48,12 @@
     "@earendil-works/pi-coding-agent": "0.80.10",
     "@types/node": "^24.0.0",
     "@typescript/native-preview": "^7.0.0-dev.20260113.1",
-    "@vitest/coverage-v8": "^2.1.8",
+    "@vitest/coverage-v8": "^3.2.4",
     "msw": "^2.14.2",
     "pino-pretty": "^13.0.0",
     "tsdown": "^0.21.10",
-    "typescript": "^5.9.3",
-    "vitest": "^2.1.8"
+    "typescript": "^6.0.3",
+    "vitest": "^3.2.7"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0 <0.81.0"