@yusukeshib/pi-babysit 0.3.0 → 0.3.2

package/README.md

@@ -49,7 +49,7 @@ programs** (installers, wizards, REPLs): type with `babysit_send`
 
 | Tool | What it does |
 | ---- | ------------ |
-| `babysit_run` | Run any command (`command`, optional `name`/`pty`/`timeout`/`idleTimeout`) or start a subagent (`profile: "subagent"`, `task`, optional `agent`/`model`/`tools`). Quick commands return inline; longer ones continue in the background |
+| `babysit_run` | Run any command (`command`, optional `name`/`pty`/`timeout`/`idleTimeout`/`retryOnWorkerDeath`) or start a subagent (`profile: "subagent"`, `task`, optional `agent`/`model`/`tools`). Quick commands return inline; longer ones continue in the background |
 | `babysit_check` | List all sessions, or inspect one: process → state + log tail (or `screen: true` for TUIs); subagent → live progress (turns, recent tool calls, partial answer) |
 | `babysit_send` | Process: type `text` / press `keys` into the PTY. Subagent: steer mid-run, or send a follow-up task when idle (`mode: auto/steer/task`) |
 | `babysit_wait` | Block until done: process exit (or `expect: "regex"` readiness marker), subagent task completion. Multi-wait: `ids` + `mode: "any"\|"all"` |
@@ -84,6 +84,22 @@ rg -n 'FAIL|ERROR' /path/to/output.log
 `babysit_check { id, lines }` remains available as a convenient bounded tail.
 Do not read a potentially large log file in full.
 
+To enforce this policy, the extension blocks direct `bash` except for `pwd`,
+short Git status/branch checks, and `head`/`tail`/`rg` reads of `.log` files that
+are explicitly bounded to at most 100 lines. Broad searches, diffs, API calls,
+multiple commands, redirects, and shell wrappers are redirected to
+`babysit_run`. Set `PI_BABYSIT_ALLOW_BASH=1` only as an emergency escape hatch
+to disable this gate.
+
+## External worker death
+
+If endpoint security or another external actor kills the babysit supervisor,
+pi-babysit normalizes the stale `running` state to `worker-dead`, returns
+immediately instead of hanging, and explains that the command may have started.
+For commands known to be safe and idempotent, set `retryOnWorkerDeath: true` to
+retry once with a new session id. It is opt-in because blindly rerunning an
+arbitrary command can duplicate side effects.
+
 ## How completion detection works
 
 - **Process**: a 2.5s poller watches for running→exited transitions and injects

package/index.ts

@@ -1047,6 +1047,7 @@ async function waitForExit(
 	}
 	suppressNotify(id); // the agent sees the exit here; don't notify again
 	const meta = readMeta(id);
+	const workerDead = st.state === "dead" && st.exit_code == null;
 	const ok = st.exit_code === 0;
 	const output = await inlineOutput(id, st);
 	return {
@@ -1055,8 +1056,13 @@ async function waitForExit(
 		ok,
 		text:
 			`Process ${id}${meta?.command ? ` (${meta.command})` : ""} ` +
-			`${ok ? "completed successfully" : `exited with code ${st.exit_code ?? "?"}`}` +
+			(workerDead
+				? "worker-dead: the babysit supervisor disappeared without an exit status"
+				: ok ? "completed successfully" : `exited with code ${st.exit_code ?? "?"}`) +
 			`${expectPattern ? ` before /${expectPattern}/ appeared` : ""}.` +
+			(workerDead
+				? " This commonly indicates an external kill (for example endpoint security). The command may have started, so retry only if it is safe and idempotent."
+				: "") +
 			`\nLog: ${logPath(id)}` + output,
 		status: st,
 	};
@@ -1086,6 +1092,30 @@ function backgroundsItself(command: string): boolean {
 	return false;
 }
 
+function boundedLineCount(command: string): number | null {
+	const matches = [...command.matchAll(/(?:^|\|)\s*(?:head|tail)\s+(?:-n\s+|--lines(?:=|\s+)|-)(\d+)\b/g)];
+	if (matches.length === 0) return null;
+	return Math.max(...matches.map((m) => Number(m[1])));
+}
+
+/** Commands allowed to bypass babysit: tiny scalar observations and strictly
+ * bounded reads of captured log files. This is deliberately conservative;
+ * uncertain shell syntax belongs in babysit_run where output is capped. */
+export function isAllowedDirectBash(command: string): boolean {
+	if (process.env.PI_BABYSIT_ALLOW_BASH === "1") return true;
+	const s = command.trim();
+	if (/^(pwd|git status --short|git branch --show-current)$/.test(s)) return true;
+	if (!s || /[;&`\n\r]|\$\(|>|\b(?:bash|sh|zsh)\s+-c\b/.test(s)) return false;
+	if (!/(?:output\.log|\/(?:tmp|var\/tmp)\/[^\s'\"]*\.log)\b/.test(s)) return false;
+	if (/^wc\s+-(?:l|c)\s+/.test(s) && !s.includes("|")) return true;
+	if (!/^(?:tail|head|rg)\b/.test(s)) return false;
+	const limit = boundedLineCount(s);
+	if (limit == null || limit > 100) return false;
+	// rg must feed a bounded head/tail; direct head/tail is already bounded.
+	if (/^rg\b/.test(s) && !/\|\s*(?:head|tail)\b/.test(s)) return false;
+	return true;
+}
+
 // ---------------------------------------------------------------------------
 // extension
 // ---------------------------------------------------------------------------
@@ -1222,17 +1252,27 @@ export default function (pi: ExtensionAPI) {
 		pollTimer = undefined;
 	});
 
-	// Block bash commands that background themselves — they belong in
-	// babysit_run (which supervises, logs, and notifies on exit).
+	// Keep unpredictable command output out of model context. Direct bash is
+	// reserved for tiny scalar observations and tightly bounded log inspection;
+	// everything else belongs in babysit_run.
 	pi.on("tool_call", async (event) => {
 		if (event.toolName !== "bash") return;
 		const command = String((event.input as { command?: unknown }).command ?? "");
-		if (!backgroundsItself(command)) return;
+		if (backgroundsItself(command)) {
+			return {
+				block: true,
+				reason:
+					`This bash command tries to run in the background. Use babysit_run instead, e.g. ` +
+					`babysit_run({ name: "background-process", command: ${JSON.stringify(command.replace(/\s*&\s*$/, ""))} })`,
+			};
+		}
+		if (isAllowedDirectBash(command)) return;
 		return {
 			block: true,
 			reason:
-				`This bash command tries to run in the background. Use babysit_run instead, e.g. ` +
-				`babysit_run({ name: "background-process", command: ${JSON.stringify(command.replace(/\s*&\s*$/, ""))} })`,
+				"Use babysit_run for this command so potentially large output is captured outside model context. " +
+				"Direct bash is allowed only for pwd, short git status/branch checks, or log-file tail/rg commands explicitly bounded to at most 100 lines. " +
+				`Retry as babysit_run({ command: ${JSON.stringify(command)} }).`,
 		};
 	});
 
@@ -1248,8 +1288,8 @@ export default function (pi: ExtensionAPI) {
 			"In non-interactive mode (`pi -p`, no UI), process mode blocks until exit because there is no " +
 			"notification loop. Two modes: (1) `command` — run any shell command, including builds, tests, " +
 			"dev servers, watchers, and interactive TUIs; you can type into it with babysit_send and read " +
-			"its screen with babysit_check. " +
-			"you can type into it with babysit_send and read its screen with babysit_check. " +
+			"its screen with babysit_check. If endpoint security kills a worker at startup, " +
+			"`retryOnWorkerDeath` can retry one idempotent command once. " +
 			"(2) `profile: \"subagent\"` + `task` — spawn a pi subagent that works on the task in the " +
 			"background; poll with babysit_check, steer with babysit_send, block with babysit_wait, " +
 			"stop with babysit_kill.",
@@ -1259,7 +1299,7 @@ export default function (pi: ExtensionAPI) {
 			"Use babysit_run as the default for shell commands, not only long-running work. Small output is returned directly; large stdout/stderr stays out of model context in the returned log path. Give meaningful commands a clear stable `name`.",
 			"Inspect a babysit log only with explicitly bounded commands such as `tail -n N` or focused `rg`; never read or cat a potentially large log in full. Those small inspection commands may use bash directly to avoid recursively creating babysit sessions.",
 			"After babysit_run { command } starts a process, end your response immediately so the automatic process-end notification can resume you; NEVER poll with babysit_check or sleep. Set continueAfterStart: true only when you have immediate, specific, non-polling work to do next. Call babysit_wait when you must consume the result inside the current turn (optionally with `expect` to wait for a readiness line like 'listening on').",
-			"babysit_run returns only minimal lifecycle information and a path to the complete log. Inspect that file with bounded shell commands such as `tail` or `rg`; never read a potentially large log in full.",
+			"If a babysit worker is killed externally, babysit_run reports it as worker-dead rather than hanging. Set retryOnWorkerDeath: true only for safe, idempotent commands; it retries at most once and may otherwise duplicate side effects.",
 			"babysit_run gives full PTY control: drive interactive programs (installers, wizards, REPLs) with babysit_send (text or named keys) and read the rendered screen with babysit_check { screen: true }.",
 			"Delegate self-contained tasks (codebase recon, a parallelizable subtask, work that would pollute your context) with babysit_run { profile: \"subagent\", task }. Launch several for independent subtasks; they run concurrently.",
 			"After spawning subagents, do not idle-wait and do not end your turn to wait for them: keep making progress, then call babysit_wait (ids + mode any/all) when you need their results. Steer or send follow-up tasks with babysit_send; kill runaways with babysit_kill.",
@@ -1319,6 +1359,12 @@ export default function (pi: ExtensionAPI) {
 						"Process mode only. Default false: starting a process ENDS the current turn (you are resumed by the exit notification). Set true only when you have immediate, specific, non-polling work to do after starting.",
 				}),
 			),
+			retryOnWorkerDeath: Type.Optional(
+				Type.Boolean({
+					description:
+						"Process mode only. Retry once if the babysit worker is killed externally during startup. Use only for safe, idempotent commands because the first attempt may have produced side effects.",
+				}),
+			),
 
 		}),
 		async execute(_id, params, _signal, _onUpdate, ctx) {
@@ -1348,14 +1394,15 @@ export default function (pi: ExtensionAPI) {
 
 			// --- process mode ---
 			if (!isSubagent) {
-				const res = await spawnProcess({
+				const spawnOpts: ProcOpts = {
 					name: params.name,
 					command: params.command as string,
 					cwd: ctx.cwd,
 					timeout: params.timeout,
 					idleTimeout: params.idleTimeout,
 					pty: params.pty ?? true,
-					});
+				};
+				let res = await spawnProcess(spawnOpts);
 				if ("error" in res) {
 					return {
 						content: [{ type: "text", text: `Failed to start process: ${res.error}` }],
@@ -1373,11 +1420,20 @@ export default function (pi: ExtensionAPI) {
 				// outcome in THIS turn. The process still runs under babysit (logged,
 				// killable), we just wait for it here instead of fire-and-forget.
 				if (!ctx.hasUI) {
-					const outcome = await waitForExit(res.id, parseDurMs(params.timeout), _signal);
+					let outcome = await waitForExit(res.id, parseDurMs(params.timeout), _signal);
+					let retried = false;
+					if (params.retryOnWorkerDeath && outcome.status?.state === "dead" && outcome.status.exit_code == null) {
+						const retry = await spawnProcess(spawnOpts);
+						if (!("error" in retry)) {
+							res = retry;
+							retried = true;
+							outcome = await waitForExit(res.id, parseDurMs(params.timeout), _signal);
+						}
+					}
 					return {
-						content: [{ type: "text", text: outcome.text }],
+						content: [{ type: "text", text: `${retried ? "Retried once after external worker death.\n" : ""}${outcome.text}` }],
 						isError: !outcome.ok,
-						details: { id: res.id, kind: "process", command: params.command, logPath: logPath(res.id) },
+						details: { id: res.id, kind: "process", command: params.command, logPath: logPath(res.id), retried },
 					};
 				}
 
@@ -1386,14 +1442,24 @@ export default function (pi: ExtensionAPI) {
 				// A timeout means it is genuinely background work and follows the normal
 				// parked-turn / automatic-notification contract below.
 				await bs(["wait", "-s", res.id, "--timeout", QUICK_COMMAND_GRACE], { signal: _signal });
-				const quickStatus = await statusOf(res.id);
+				let quickStatus = await statusOf(res.id);
+				let retried = false;
+				if (params.retryOnWorkerDeath && quickStatus?.state === "dead" && quickStatus.exit_code == null) {
+					const retry = await spawnProcess(spawnOpts);
+					if (!("error" in retry)) {
+						res = retry;
+						retried = true;
+						await bs(["wait", "-s", res.id, "--timeout", QUICK_COMMAND_GRACE], { signal: _signal });
+						quickStatus = await statusOf(res.id);
+					}
+				}
 				if (quickStatus && quickStatus.state !== "running") {
 					const outcome = await waitForExit(res.id, null, _signal);
 					await refreshWidget(ctx);
 					return {
-						content: [{ type: "text", text: outcome.text }],
+						content: [{ type: "text", text: `${retried ? "Retried once after external worker death.\n" : ""}${outcome.text}` }],
 						isError: !outcome.ok,
-						details: { id: res.id, kind: "process", command: params.command, logPath: logPath(res.id) },
+						details: { id: res.id, kind: "process", command: params.command, logPath: logPath(res.id), retried },
 					};
 				}
 
@@ -1406,13 +1472,14 @@ export default function (pi: ExtensionAPI) {
 						{
 							type: "text",
 							text:
+								`${retried ? "Retried once after external worker death.\n" : ""}` +
 								`Process started (id: ${res.id}). ${NOTIFY_MARKER}\nLog: ${logPath(res.id)}\n${nextStep}\n` +
 								`Inspect: babysit_check { id: "${res.id}" } (screen: true for TUIs) · ` +
 								`Wait: babysit_wait { id: "${res.id}" } · Kill: babysit_kill { id: "${res.id}" }\n` +
 								`Human can watch/take over: /babysit`,
 						},
 					],
-					details: { id: res.id, kind: "process", command: params.command, logPath: logPath(res.id) },
+					details: { id: res.id, kind: "process", command: params.command, logPath: logPath(res.id), retried },
 					// Do not return `terminate: true` here. In RPC/subagent hosts that hint
 					// can shut down the hosting pi worker, whose process-tree cleanup then
 					// kills the otherwise detached babysit supervisor and closes its PTY

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yusukeshib/pi-babysit",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Run any shell command and pi subagents under babysit, with context-safe captured output.",
   "keywords": [
     "pi-package",