@tekmidian/pai 0.66.6 → 0.66.7

package/dist/hooks/worker-guard.mjs

@@ -7490,6 +7490,7 @@ var DEFAULTS = {
     connectionTimeoutMs: 5e3
   },
   embeddingModel: "Snowflake/snowflake-arctic-embed-m-v1.5",
+  embedding: { backend: "transformers-cpu-q8", ollama: { baseUrl: "http://127.0.0.1:11434" } },
   logLevel: "info",
   notifications: DEFAULT_NOTIFICATION_CONFIG,
   tasks: DEFAULT_TASK_CONFIG,
@@ -7497,6 +7498,7 @@ var DEFAULTS = {
   // guess here is an address that can be mailed without review.
   identity: { selfEmails: [] },
   sessions: { cacheKeepalive: { ...DEFAULT_SESSIONS_CACHE_KEEPALIVE } },
+  dashboard: { enabled: true, port: 8770, bind: "127.0.0.1" },
   search: {
     mode: "keyword",
     rerank: true,
@@ -7519,7 +7521,48 @@ var CONFIG_DIR = dirname2(CONFIG_FILE);
 // src/workers/workers-config.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 
+// src/workers/status.ts
+var SLEEP_FLOOR_SECS = 60;
+function sleepUnitMultiplier(unit) {
+  return unit === "m" ? 60 : unit === "h" ? 3600 : unit === "d" ? 86400 : 1;
+}
+var SLEEP_SEGMENT_RE = /(?:^|[;&|\n(){]|\bdo\b|\bthen\b)\s*sleep\s+([0-9]+(?:\.[0-9]+)?)([smhd]?)(?=\s*(?:$|[;&|)\n]))/g;
+var LOOP_RE = /\b(for|while|until)\b([^;\n]*)[;\n]\s*do\b([\s\S]*?)\bdone\b/g;
+function sleepSum(text) {
+  let sum = 0;
+  for (const m of text.matchAll(SLEEP_SEGMENT_RE)) {
+    const secs = Number(m[1]) * sleepUnitMultiplier(m[2]);
+    if (Number.isFinite(secs)) sum += secs;
+  }
+  return sum;
+}
+function forIterations(header) {
+  const words = header.replace(/^\s*\w+\s+in\s+/, "").trim();
+  if (words === header.trim() || /[$`*?]/.test(words)) return null;
+  const range = /^\{(-?\d+)\.\.(-?\d+)\}$/.exec(words);
+  if (range) return Math.abs(Number(range[2]) - Number(range[1])) + 1;
+  return words ? words.split(/\s+/).length : 0;
+}
+function totalSleepSecs(command) {
+  let total = sleepSum(command);
+  for (const m of command.matchAll(LOOP_RE)) {
+    const body = sleepSum(m[3]);
+    if (body === 0) continue;
+    if (m[1] === "for") {
+      const n = forIterations(m[2]);
+      total += n === null ? Math.max(SLEEP_FLOOR_SECS, body) : body * (n - 1);
+    } else if (!/\bkill\s+-0\b/.test(m[2])) {
+      total += SLEEP_FLOOR_SECS;
+    }
+  }
+  return total;
+}
+
+// src/workers/wait-on.ts
+var WAIT_RECIPE = "`nohup sh -c 'CMD; echo $? > /tmp/job.rc' > /tmp/job.log 2>&1 & echo $! > /tmp/job.pid`, then repeat `pai worker wait-on $(cat /tmp/job.pid) --log /tmp/job.log` (each call returns within 2 min; do other work between calls) until it exits 0";
+
 // src/hooks/ts/lib/sleep-poll-gate.ts
+var BACKGROUND_WORKER_REASON = "run_in_background is blocked in a worker: ending your turn ends this process and kills the job, there is no completion notification. Run a long job detached: " + WAIT_RECIPE + ".";
 function renderDecision(d) {
   if (d.decision === "allow") {
     return JSON.stringify({
@@ -7715,7 +7758,7 @@ function gitSub(args) {
 }
 var PATTERN_KILL = /* @__PURE__ */ new Set(["pkill", "killall"]);
 var PATTERN_KILL_REASON = "pattern-based process kill blocked: kill only what you started, by PID (`cmd & echo $! > /tmp/x.pid`, then `kill $(cat /tmp/x.pid)`), never by name or pattern; other workers' command lines contain your spec text";
-function decideSegment(seg, st, ctx) {
+function decideSegment(seg, st, ctx, detached = false) {
   const words = stripPrefix(seg.words);
   const [cmd, ...args] = words;
   const boundary = ctx.worktreeRoot ?? ctx.cwd;
@@ -7726,7 +7769,7 @@ function decideSegment(seg, st, ctx) {
   }
   if (!cmd) return ALLOW;
   if ((cmd === "bash" || cmd === "sh" || cmd === "zsh") && args[0] === "-c" && args[1]) {
-    return decideCommand(args[1], { ...ctx, cwd: st.cwd });
+    return decideCommand(args[1], { ...ctx, cwd: st.cwd }, detached);
   }
   const pos = args.filter((a) => !isFlag(a));
   if (PATTERN_KILL.has(cmd) || cmd === "xargs" && args.includes("kill") || cmd === "kill" && /pgrep|pidof/.test(args.join(" "))) {
@@ -7796,10 +7839,41 @@ function decideSegment(seg, st, ctx) {
   }
   return ALLOW;
 }
-function decideCommand(command, ctx) {
+var MAX_FOREGROUND_SECS = 120;
+var WAIT_REASON_TAIL = "calls longer than 2 min block operator messages and supervision; long jobs run fine detached: " + WAIT_RECIPE + ".";
+var unitSecs = (u) => u === "m" ? 60 : u === "h" ? 3600 : u === "d" ? 86400 : 1;
+function longestTimeoutSecs(segs) {
+  let longest = 0;
+  for (const seg of segs) {
+    const [cmd, ...args] = stripPrefix(seg.words);
+    if (cmd !== "timeout" && cmd !== "gtimeout") continue;
+    for (let i = 0; i < args.length; i++) {
+      if (/^-[sk]$/.test(args[i])) i++;
+      else if (!isFlag(args[i])) {
+        const m = /^(\d+(?:\.\d+)?)([smhd]?)$/.exec(args[i]);
+        if (m) longest = Math.max(longest, Number(m[1]) * unitSecs(m[2]));
+        break;
+      }
+    }
+  }
+  return longest;
+}
+function longWaitReason(command, segs) {
+  const fg = segs.filter((s2) => s2.words[0] !== "nohup");
+  const t = longestTimeoutSecs(fg);
+  if (t > MAX_FOREGROUND_SECS) return `timeout ${t}s blocked: ${WAIT_REASON_TAIL}`;
+  const bare = command.replace(/'[^']*'|"[^"]*"/g, "''").replace(/\bnohup\b[^;&|\n]*/g, "");
+  const s = totalSleepSecs(bare);
+  if (s > MAX_FOREGROUND_SECS) return `sleep ${s}s blocked: ${WAIT_REASON_TAIL}`;
+  return null;
+}
+function decideCommand(command, ctx, detached = false) {
   const st = { cwd: ctx.cwd, raw: command };
-  for (const seg of parseCommand(command)) {
-    const d = decideSegment(seg, st, ctx);
+  const segs = parseCommand(command);
+  const long = detached ? null : longWaitReason(command, segs);
+  if (long) return deny(long);
+  for (const seg of segs) {
+    const d = decideSegment(seg, st, ctx, seg.words[0] === "nohup");
     if (d.decision === "deny") return d;
   }
   return ALLOW;
@@ -7812,6 +7886,9 @@ function decideWorkerGuard(input, env, ctx) {
     return deny(`${tool} blocked: this worker runs with --no-browser`);
   }
   if (tool === "Bash") {
+    if (typeof ti.timeout === "number" && ti.timeout > MAX_FOREGROUND_SECS * 1e3) {
+      return deny(`Bash timeout ${ti.timeout} ms blocked: ${WAIT_REASON_TAIL}`);
+    }
     return typeof ti.command === "string" ? decideCommand(ti.command, ctx()) : ALLOW;
   }
   if (tool === "Edit" || tool === "Write" || tool === "MultiEdit" || tool === "NotebookEdit") {