@yusukeshib/pi-babysit 0.3.4 → 0.3.7

package/README.md

@@ -13,8 +13,8 @@ It retires both `@mjakl/pi-processes` (the `process` tool) and the old
 pi install npm:@yusukeshib/pi-babysit
 ```
 
-Then install the [`babysit`](https://github.com/yusukeshib/babysit) binary
-(the extension does **not** auto-install it):
+Then install [`babysit`](https://github.com/yusukeshib/babysit) **0.13.0 or
+newer** (the extension does **not** auto-install it):
 
 ```sh
 cargo install --git https://github.com/yusukeshib/babysit
@@ -22,8 +22,8 @@ cargo install --git https://github.com/yusukeshib/babysit
 
 or grab a prebuilt binary from the
 [releases](https://github.com/yusukeshib/babysit/releases) and put it on your
-`PATH`. If it's missing, every tool and the `/babysit` command fail with these
-instructions.
+`PATH`. If it is missing or older than 0.13.0, every tool and the `/babysit`
+command fail with upgrade instructions.
 
 ## The model
 
@@ -50,14 +50,13 @@ programs** (installers, wizards, REPLs): type with `babysit_send`
 | Tool | What it does |
 | ---- | ------------ |
 | `babysit_run` | Run any command (`command`, optional `name`/`pty`/`timeout`/`idleTimeout`/`retryOnWorkerDeath`) or start a subagent (`profile: "subagent"`, `task`, optional `agent`/`model`/`tools`). Quick commands return inline; longer ones continue in the background |
-| `babysit_check` | List all sessions, or inspect one: process → state + log tail (or `screen: true` for TUIs); subagent → live progress (turns, recent tool calls, partial answer) |
+| `babysit_check` | List all sessions, inspect one, tail its bounded recent output, or search its raw log with `pattern`; `screen: true` captures TUIs and subagents otherwise show structured live progress |
 | `babysit_send` | Process: type `text` / press `keys` into the PTY. Subagent: steer mid-run, or send a follow-up task when idle (`mode: auto/steer/task`) |
 | `babysit_wait` | Block until done: process exit (or `expect: "regex"` readiness marker), subagent task completion. Multi-wait: `ids` + `mode: "any"\|"all"` |
-| `babysit_kill` | Terminate a session (suppresses the exit notification) |
+| `babysit_kill` | Terminate a session, verify terminal state, then suppress the exit notification |
 
-A `tool_call` hook also blocks bash commands that background themselves
-(`… &`, `nohup`, `setsid`, `disown`) and points the agent at `babysit_run`
-(carried over from pi-processes' `blockBackgroundCommands`).
+A `tool_call` hook blocks shell backgrounding (`… &`, `nohup`, `setsid`,
+`disown`) and redirects all direct `bash` commands to `babysit_run`.
 
 ## Commands (human)
 
@@ -72,33 +71,31 @@ A minimal widget above the editor shows live counts
 
 `babysit_run`, `babysit_wait`, and automatic completion notifications always
 return lifecycle metadata and the absolute path to the complete `output.log`.
-When the complete output is at most 8 KB it is returned inline; larger output
-stays out of model context. Inspect large logs on demand with bounded shell
-commands such as:
-
-```sh
-tail -n 50 /path/to/output.log
-rg -n 'FAIL|ERROR' /path/to/output.log
+Explicit run/wait results inline complete output up to 8 KB; unsolicited
+completion notifications use a stricter 2 KB cap. Larger output stays out of
+model context. Inspect it through the session id without creating another shell
+session:
+
+```text
+babysit_check { id: "cargo-test", lines: 50 }
+babysit_check { id: "cargo-test", pattern: "FAIL|ERROR", lines: 50 }
 ```
 
-`babysit_check { id, lines }` remains available as a convenient bounded tail.
-Do not read a potentially large log file in full.
+Tail and search results are capped at 200 lines and clipped to 8 KB. Pattern
+search returns the latest matching lines with line numbers. Do not read a
+potentially large log file in full.
 
-To enforce this policy, the extension blocks direct `bash` except for `pwd`,
-short Git status/branch checks, and `head`/`tail`/`rg` reads of `.log` files that
-are explicitly bounded to at most 100 lines. Broad searches, diffs, API calls,
-multiple commands, redirects, and shell wrappers are redirected to
-`babysit_run`. Set `PI_BABYSIT_ALLOW_BASH=1` only as an emergency escape hatch
-to disable this gate.
+All shell commands, including `pwd` and Git, are redirected to `babysit_run`.
+Set `PI_BABYSIT_ALLOW_BASH=1` only as an explicit emergency escape hatch.
 
-## External worker death
+## Unexpected worker loss
 
-If endpoint security or another external actor kills the babysit supervisor,
-pi-babysit normalizes the stale `running` state to `worker-dead`, returns
-immediately instead of hanging, and explains that the command may have started.
-For commands known to be safe and idempotent, set `retryOnWorkerDeath: true` to
-retry once with a new session id. It is opt-in because blindly rerunning an
-arbitrary command can duplicate side effects.
+If the babysit supervisor disappears without recording an exit, pi-babysit
+normalizes the stale `running` state to `worker-dead` and returns immediately
+instead of hanging. Possible causes include host process cleanup, endpoint
+security, or a supervisor crash. For commands known to be safe and idempotent,
+set `retryOnWorkerDeath: true` to retry once with a new session id. It is opt-in
+because blindly rerunning an arbitrary command can duplicate side effects.
 
 ## How completion detection works
 
@@ -127,12 +124,18 @@ rule, so a subagent waiting on a long build is never false-killed.
 | `PI_BABYSIT_CLI` | `babysit` | babysit binary |
 | `PI_BABYSIT_VIEW_CMD` | bundled `format-stream.mjs` | live-attach pretty printer for subagent JSONL (`""` disables) |
 | `PI_BABYSIT_REAP_AFTER` | `120s` | idle grace before a finished subagent self-exits (`off`/`none`/`0` disables) |
-
-Requires `babysit` and `pi` on `PATH`. The extension does **not** auto-install
-`babysit`: if the binary is missing, every tool and the `/babysit` command fail
-with install instructions (`cargo install --git https://github.com/yusukeshib/babysit`
-or a prebuilt release), and a warning is shown at session start. Point
-`$PI_BABYSIT_CLI` at a custom binary path if needed.
+| `PI_BABYSIT_TAIL_MAX_BYTES` | `8000` | cap for explicit log tails/screens returned by `babysit_check` |
+| `PI_BABYSIT_INLINE_OUTPUT_MAX_BYTES` | `8000` | cap for complete output in explicitly requested run/wait results |
+| `PI_BABYSIT_NOTIFY_OUTPUT_MAX_BYTES` | `2000` | smaller cap for unsolicited process-completion notifications (`0` omits all output) |
+| `PI_BABYSIT_NOTIFY_COMMAND_MAX_BYTES` | `240` | cap for the command preview in completion notifications |
+| `PI_BABYSIT_ALLOW_BASH` | unset | set to `1` to bypass direct-Bash redirection (emergency escape hatch) |
+
+Requires `babysit` 0.13.0 or newer and `pi` on `PATH`. The extension does **not**
+auto-install `babysit`: if the binary is missing or too old, every tool and the
+`/babysit` command fail with install instructions (`cargo install --git
+https://github.com/yusukeshib/babysit` or a prebuilt release), and a warning is
+shown at session start. Point `$PI_BABYSIT_CLI` at a custom binary path if
+needed.
 
 (No tmux dependency — `/babysit` renders inline; take over a live process
 manually with the `babysit attach` command it shows.)

package/index.ts

@@ -81,6 +81,7 @@ const SUBAGENT_GUIDANCE = [
 ].join(" ");
 const POLL_MS = 2500;
 const QUICK_COMMAND_GRACE = process.env.PI_BABYSIT_QUICK_GRACE ?? "1s";
+const KILL_CONFIRM_TIMEOUT = "4s";
 
 interface BsSession {
 	id: string;
@@ -154,27 +155,49 @@ function bs(
 // Every session shells out to `babysit`; without it the extension can do
 // nothing. We don't auto-install (that's the user's job) — we fail loudly with
 // install instructions the moment a tool or command is used.
-const INSTALL_HINT =
-	`The \`babysit\` binary was not found (tried "${BABYSIT_BIN}").\n` +
-	`Install it, then retry:\n` +
+const INSTALL_STEPS =
+	`Install babysit 0.13.0 or newer, then retry:\n` +
 	`  cargo install --git https://github.com/yusukeshib/babysit\n` +
 	`or download a prebuilt binary from https://github.com/yusukeshib/babysit/releases and put it on your PATH.\n` +
 	`(Override the binary path with $PI_BABYSIT_CLI.)`;
+const INSTALL_HINT =
+	`The \`babysit\` binary was not found (tried "${BABYSIT_BIN}").\n` + INSTALL_STEPS;
+const MIN_BABYSIT_VERSION = [0, 13, 0] as const;
+
+export function isSupportedBabysitVersion(output: string): boolean {
+	const match = /\b(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\b/.exec(output);
+	if (!match) return false;
+	const actual = [Number(match[1]), Number(match[2]), Number(match[3])] as const;
+	for (let i = 0; i < MIN_BABYSIT_VERSION.length; i++) {
+		if (actual[i] !== MIN_BABYSIT_VERSION[i]) return actual[i] > MIN_BABYSIT_VERSION[i];
+	}
+	return match[4] === undefined;
+}
 
 // Cached preflight — probe `babysit --version` exactly once per process.
-let babysitOk: boolean | undefined;
+// undefined = not probed, null = supported, string = actionable error.
+let babysitPreflightError: string | null | undefined;
 async function babysitAvailable(): Promise<boolean> {
-	if (babysitOk === undefined) {
-		const r = await bs(["--version"]);
-		babysitOk = r.code === 0;
+	// Cache only success. A missing or outdated binary may be installed while pi
+	// stays open, so subsequent tool calls must be able to recover without a restart.
+	if (babysitPreflightError === null) return true;
+	const r = await bs(["--version"]);
+	if (r.code !== 0) {
+		babysitPreflightError = INSTALL_HINT;
+	} else if (!isSupportedBabysitVersion(r.stdout)) {
+		babysitPreflightError =
+			`pi-babysit requires babysit 0.13.0 or newer; found ${r.stdout.trim() || "an unknown version"}.\n` +
+			INSTALL_STEPS;
+	} else {
+		babysitPreflightError = null;
 	}
-	return babysitOk;
+	return babysitPreflightError === null;
 }
 
 // Throwing form for tool `execute` handlers: a thrown error marks the tool
-// result isError and reports the install hint to the model.
+// result isError and reports the preflight error to the model.
 async function requireBabysit(): Promise<void> {
-	if (!(await babysitAvailable())) throw new Error(INSTALL_HINT);
+	if (!(await babysitAvailable())) throw new Error(babysitPreflightError ?? INSTALL_HINT);
 }
 
 // Error-aware: `babysit list` failing is NOT the same as "no sessions" —
@@ -219,6 +242,34 @@ async function statusOf(id: string): Promise<BsSession | null> {
 	}
 }
 
+export function isConfirmedTerminalState(state: string): boolean {
+	return state === "killed" || state === "exited";
+}
+
+export function validateKillResponse(stdout: string): string | null {
+	try {
+		const response = JSON.parse(stdout);
+		if (response.killed !== true || response.confirmed === false) {
+			return `Kill was not confirmed by babysit: ${stdout.trim()}`;
+		}
+		return null;
+	} catch {
+		return `Invalid kill response from babysit: ${stdout.trim() || "(empty)"}`;
+	}
+}
+
+async function awaitConfirmedTermination(id: string): Promise<BsSession | null> {
+	const initial = await statusOf(id);
+	if (!initial || isConfirmedTerminalState(initial.state) || initial.state === "dead") {
+		return initial;
+	}
+	// New babysit versions return only after persistence, so this is normally
+	// skipped. It is a bounded compatibility guard for older binaries that
+	// acknowledged signal delivery before the process actually exited.
+	await bs(["wait", "-s", id, "--timeout", KILL_CONFIRM_TIMEOUT]);
+	return statusOf(id);
+}
+
 // ---------------------------------------------------------------------------
 // per-session metadata
 // ---------------------------------------------------------------------------
@@ -232,6 +283,12 @@ interface Meta {
 	name?: string;
 	command?: string;
 	notified?: boolean;
+	// A confirmed kill permanently owns completion delivery. An interrupted
+	// concurrent wait must not re-enable the automatic notification afterward.
+	killNotificationSuppressed?: boolean;
+	// Temporary reservation while kill is in flight. Unlike `notified`, this
+	// must be cleared on failure so a real completion remains deliverable.
+	notificationPaused?: boolean;
 	completionObservedAt?: number;
 	startedAt?: number;
 	// subagent
@@ -367,8 +424,19 @@ function parseDurMs(s?: string): number | null {
 // megabytes, so we also cap bytes, eliding the middle so both the head and
 // the tail of the output stay visible.
 
-const TAIL_MAX_BYTES = 8_000; // explicit tails / screens
-const INLINE_OUTPUT_MAX_BYTES = 8_000; // complete output returned only below this threshold
+function byteLimitFromEnv(name: string, fallback: number): number {
+	const raw = process.env[name];
+	if (raw == null || raw.trim() === "") return fallback;
+	const value = Number(raw);
+	return Number.isSafeInteger(value) && value >= 0 ? value : fallback;
+}
+
+const TAIL_MAX_BYTES = byteLimitFromEnv("PI_BABYSIT_TAIL_MAX_BYTES", 8_000);
+// Direct run/wait results can carry more context because the caller explicitly
+// requested them. Unsolicited completion notifications default much smaller.
+const INLINE_OUTPUT_MAX_BYTES = byteLimitFromEnv("PI_BABYSIT_INLINE_OUTPUT_MAX_BYTES", 8_000);
+const NOTIFY_OUTPUT_MAX_BYTES = byteLimitFromEnv("PI_BABYSIT_NOTIFY_OUTPUT_MAX_BYTES", 2_000);
+const NOTIFY_COMMAND_MAX_BYTES = byteLimitFromEnv("PI_BABYSIT_NOTIFY_COMMAND_MAX_BYTES", 240);
 const ANSWER_MAX_BYTES = 24_000; // subagent answers / error messages
 
 function clip(s: string, maxBytes = TAIL_MAX_BYTES): string {
@@ -381,7 +449,77 @@ function clip(s: string, maxBytes = TAIL_MAX_BYTES): string {
 	return `${head}\n… [${buf.length - maxBytes} bytes elided] …\n${tail}`;
 }
 
-async function inlineOutput(id: string, status: BsSession): Promise<string> {
+async function searchLog(
+	id: string,
+	pattern: string,
+	maxLines: number,
+	signal?: AbortSignal,
+): Promise<{ text: string; error?: string }> {
+	const file = logPath(id);
+	if (!fs.existsSync(file)) return { text: "", error: `Log file is missing: ${file}` };
+	if (signal?.aborted) return { text: "", error: "Log search was interrupted." };
+
+	// Run regex evaluation out of process so catastrophic backtracking or a huge
+	// no-newline log cannot freeze or exhaust pi's main Node process. The helper
+	// clips each retained line; this parent also enforces a hard wall-clock limit.
+	return new Promise((resolve) => {
+		const helper = path.join(EXT_DIR, "search-log.mjs");
+		const nodeOptions = [process.env.NODE_OPTIONS, "--max-old-space-size=32"]
+			.filter(Boolean)
+			.join(" ");
+		const child = spawn(process.execPath, [helper, file, pattern, String(maxLines)], {
+			env: { ...process.env, NODE_OPTIONS: nodeOptions },
+		});
+		let stdout = "";
+		let stderr = "";
+		let finished = false;
+		let timedOut = false;
+		const finish = (result: { text: string; error?: string }) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		const onAbort = () => {
+			child.kill("SIGTERM");
+			finish({ text: "", error: "Log search was interrupted." });
+		};
+		const timer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGTERM");
+		}, 3_000);
+		signal?.addEventListener("abort", onAbort, { once: true });
+		child.stdout?.on("data", (data) => {
+			stdout += data.toString();
+		});
+		child.stderr?.on("data", (data) => {
+			stderr = clip(stderr + data.toString());
+		});
+		child.on("error", (error) => {
+			finish({ text: "", error: `Could not start log search: ${String(error)}` });
+		});
+		child.on("close", (code) => {
+			if (timedOut) {
+				finish({ text: "", error: "Log search timed out after 3s; narrow the pattern or log." });
+			} else if (code !== 0) {
+				finish({ text: "", error: stderr.trim() || `Log search failed (exit ${code ?? "?"}).` });
+			} else {
+				finish({ text: clip(stdout.trimEnd()) });
+			}
+		});
+	});
+}
+
+export function shouldInlineCompleteOutput(outputBytes: number, maxBytes: number): boolean {
+	return maxBytes > 0 && outputBytes <= maxBytes;
+}
+
+async function inlineOutput(
+	id: string,
+	status: BsSession,
+	maxBytes = INLINE_OUTPUT_MAX_BYTES,
+): Promise<string> {
 	let bytes = status.output_bytes;
 	if (bytes == null) {
 		try {
@@ -390,17 +528,38 @@ async function inlineOutput(id: string, status: BsSession): Promise<string> {
 			bytes = Number.POSITIVE_INFINITY;
 		}
 	}
-	if (bytes > INLINE_OUTPUT_MAX_BYTES) {
+	if (!shouldInlineCompleteOutput(bytes, maxBytes)) {
 		const size = Number.isFinite(bytes) ? `${bytes} bytes` : "size unavailable";
-		return `\nOutput omitted (${size}; inline limit ${INLINE_OUTPUT_MAX_BYTES}).`;
+		return `\nOutput omitted (${size}; inline limit ${maxBytes}).`;
 	}
 	const output = (await bs(["log", "-s", id])).stdout.trimEnd();
-	if (Buffer.byteLength(output) > INLINE_OUTPUT_MAX_BYTES) {
-		return `\nOutput omitted (exceeds inline limit ${INLINE_OUTPUT_MAX_BYTES} bytes).`;
+	if (Buffer.byteLength(output) > maxBytes) {
+		return `\nOutput omitted (exceeds inline limit ${maxBytes} bytes).`;
 	}
 	return output ? `\n\nOutput:\n${output}` : "";
 }
 
+export function summarizeNotificationCommand(command: string | undefined): string {
+	const preview =
+		(command ?? "?")
+			.trim()
+			.replace(/\r/g, "\\r")
+			.replace(/\n/g, "\\n")
+			.replace(/\t/g, "\\t") || "?";
+	const bytes = Buffer.from(preview, "utf8");
+	if (bytes.length <= NOTIFY_COMMAND_MAX_BYTES) return preview;
+	if (NOTIFY_COMMAND_MAX_BYTES === 0) return "";
+	const ellipsis = Buffer.from("…", "utf8");
+	if (NOTIFY_COMMAND_MAX_BYTES <= ellipsis.length) {
+		return ".".repeat(NOTIFY_COMMAND_MAX_BYTES);
+	}
+	const prefix = bytes
+		.subarray(0, NOTIFY_COMMAND_MAX_BYTES - ellipsis.length)
+		.toString("utf8")
+		.replace(/\uFFFD+$/, "");
+	return `${prefix}…`;
+}
+
 
 // ---------------------------------------------------------------------------
 // parked-turn detection (shared rule with self-reap.ts)
@@ -966,22 +1125,47 @@ async function waitForTask(
 
 // Mark a process session as already-reported so the exit-notification poller
 // doesn't send a duplicate message for something the agent just observed.
-function suppressNotify(id: string): void {
+function suppressNotify(id: string, reason: "observed" | "kill" = "observed"): void {
 	const meta = readMeta(id);
-	if (meta && meta.kind === "process" && !meta.notified) {
+	if (meta && meta.kind === "process") {
 		meta.notified = true;
+		if (reason === "kill") meta.killNotificationSuppressed = true;
+		delete meta.notificationPaused;
 		writeMeta(id, meta);
 	}
 }
 
+export function canRestoreNotificationAfterWait(meta: {
+	notified?: boolean;
+	killNotificationSuppressed?: boolean;
+}): boolean {
+	return meta.notified === true && meta.killNotificationSuppressed !== true;
+}
+
 function enableNotify(id: string): void {
 	const meta = readMeta(id);
-	if (meta && meta.kind === "process" && meta.notified) {
+	if (meta && meta.kind === "process" && canRestoreNotificationAfterWait(meta)) {
 		meta.notified = false;
 		writeMeta(id, meta);
 	}
 }
 
+function pauseNotify(id: string): void {
+	const meta = readMeta(id);
+	if (meta && meta.kind === "process" && !meta.notificationPaused) {
+		meta.notificationPaused = true;
+		writeMeta(id, meta);
+	}
+}
+
+function resumeNotify(id: string): void {
+	const meta = readMeta(id);
+	if (meta && meta.kind === "process" && meta.notificationPaused) {
+		delete meta.notificationPaused;
+		writeMeta(id, meta);
+	}
+}
+
 // Wait for a PROCESS session: either until a regex appears in its output
 // (`expect` — e.g. "server listening") or until the process exits.
 async function waitForExit(
@@ -1055,13 +1239,13 @@ async function waitForExit(
 		kind: "exited",
 		ok,
 		text:
-			`Process ${id}${meta?.command ? ` (${meta.command})` : ""} ` +
+			`Process ${id}${meta?.command ? ` (${summarizeNotificationCommand(meta.command)})` : ""} ` +
 			(workerDead
 				? "worker-dead: the babysit supervisor disappeared without an exit status"
 				: ok ? "completed successfully" : `exited with code ${st.exit_code ?? "?"}`) +
 			`${expectPattern ? ` before /${expectPattern}/ appeared` : ""}.` +
 			(workerDead
-				? " This commonly indicates an external kill (for example endpoint security). The command may have started, so retry only if it is safe and idempotent."
+				? " The supervisor disappeared without recording an exit; possible causes include host process cleanup, endpoint security, or a supervisor crash. The command may have started, so retry only if it is safe and idempotent."
 				: "") +
 			`\nLog: ${logPath(id)}` + output,
 		status: st,
@@ -1079,7 +1263,7 @@ const waitFor = (
 		: waitForExit(id, limitMs, signal, expectPattern);
 
 // ---------------------------------------------------------------------------
-// bash background-command blocker (carried over from pi-processes)
+// direct bash policy
 // ---------------------------------------------------------------------------
 
 // Heuristic (no shell AST): catch `... &` backgrounding (not `&&`), nohup,
@@ -1092,28 +1276,9 @@ function backgroundsItself(command: string): boolean {
 	return false;
 }
 
-function boundedLineCount(command: string): number | null {
-	const matches = [...command.matchAll(/(?:^|\|)\s*(?:head|tail)\s+(?:-n\s+|--lines(?:=|\s+)|-)(\d+)\b/g)];
-	if (matches.length === 0) return null;
-	return Math.max(...matches.map((m) => Number(m[1])));
-}
-
-/** Commands allowed to bypass babysit: tiny scalar observations and strictly
- * bounded reads of captured log files. This is deliberately conservative;
- * uncertain shell syntax belongs in babysit_run where output is capped. */
-export function isAllowedDirectBash(command: string): boolean {
-	if (process.env.PI_BABYSIT_ALLOW_BASH === "1") return true;
-	const s = command.trim();
-	if (/^(pwd|git status --short|git branch --show-current)$/.test(s)) return true;
-	if (!s || /[;&`\n\r]|\$\(|>|\b(?:bash|sh|zsh)\s+-c\b/.test(s)) return false;
-	if (!/(?:output\.log|\/(?:tmp|var\/tmp)\/[^\s'\"]*\.log)\b/.test(s)) return false;
-	if (/^wc\s+-(?:l|c)\s+/.test(s) && !s.includes("|")) return true;
-	if (!/^(?:tail|head|rg)\b/.test(s)) return false;
-	const limit = boundedLineCount(s);
-	if (limit == null || limit > 100) return false;
-	// rg must feed a bounded head/tail; direct head/tail is already bounded.
-	if (/^rg\b/.test(s) && !/\|\s*(?:head|tail)\b/.test(s)) return false;
-	return true;
+/** Emergency escape hatch only. All ordinary shell commands go through babysit_run. */
+export function isAllowedDirectBash(_command: string): boolean {
+	return process.env.PI_BABYSIT_ALLOW_BASH === "1";
 }
 
 // ---------------------------------------------------------------------------
@@ -1133,7 +1298,7 @@ export default function (pi: ExtensionAPI) {
 		for (const s of sessions) {
 			if (s.state === "running") continue;
 			const meta = readMeta(s.id);
-			if (!meta || meta.kind !== "process" || meta.notified) continue;
+			if (!meta || meta.kind !== "process" || meta.notified || meta.notificationPaused) continue;
 			// Delay delivery by one poll interval. This gives an agent that chose
 			// babysit_wait immediately after babysit_run enough time to claim the
 			// completion and suppress the otherwise duplicate automatic message.
@@ -1143,15 +1308,13 @@ export default function (pi: ExtensionAPI) {
 				continue;
 			}
 			if (Date.now() - meta.completionObservedAt < POLL_MS) continue;
-			meta.notified = true;
-			writeMeta(s.id, meta);
 			const ok = s.exit_code === 0;
 			const status: DisplayStatus = ok
 				? "success"
 				: s.state === "dead" || s.exit_code == null
 					? "terminated"
 					: "failed";
-			const output = await inlineOutput(s.id, s);
+			const output = await inlineOutput(s.id, s, NOTIFY_OUTPUT_MAX_BYTES);
 			const runtime = meta.startedAt
 				? `${Math.round((Date.now() - meta.startedAt) / 1000)}s`
 				: "?";
@@ -1160,24 +1323,43 @@ export default function (pi: ExtensionAPI) {
 				: s.state === "dead" || s.exit_code == null
 					? `Process "${s.id}" was terminated after ${runtime}.`
 					: `Process "${s.id}" exited with code ${s.exit_code} after ${runtime}.`;
-			pi.sendMessage(
-				{
-					customType: "pi-babysit-process-end",
-					content:
-						`${summary}\nCommand: ${meta.command ?? "?"}\nLog: ${logPath(s.id)}${output}` +
-						`\n\nThis is the automatic process-end notification. Do not call babysit_check just to re-verify. Inspect the log only when needed, using bounded commands such as tail or rg; never read it in full.`,
-					display: true,
-					details: {
-						id: s.id,
-						exitCode: s.exit_code,
-						success: ok,
-						status,
-						runtime,
-						logPath: logPath(s.id),
+			// Output loading is asynchronous. A kill/wait can claim completion in
+			// that window, so re-read metadata immediately before delivery.
+			const current = readMeta(s.id);
+			if (
+				!current ||
+				current.kind !== "process" ||
+				current.notified ||
+				current.notificationPaused
+			) {
+				continue;
+			}
+			try {
+				pi.sendMessage(
+					{
+						customType: "pi-babysit-process-end",
+						content:
+							`${summary}\nCommand: ${summarizeNotificationCommand(current.command)}\nLog: ${logPath(s.id)}${output}` +
+							"\n\nAutomatic completion notification. Inspect the bounded log with babysit_check only if needed.",
+						display: true,
+						details: {
+							id: s.id,
+							exitCode: s.exit_code,
+							success: ok,
+							status,
+							runtime,
+							logPath: logPath(s.id),
+						},
 					},
-				},
-				{ triggerTurn: true, deliverAs: "steer" },
-			);
+					{ triggerTurn: true, deliverAs: "steer" },
+				);
+			} catch {
+				// Leave it pending so the next poll can retry delivery.
+				continue;
+			}
+			current.notified = true;
+			delete current.notificationPaused;
+			writeMeta(s.id, current);
 		}
 	}
 
@@ -1282,7 +1464,9 @@ export default function (pi: ExtensionAPI) {
 		}
 		// Warn early if the binary is missing so the user isn't surprised only when
 		// a tool later fails. Tools/commands still enforce it via requireBabysit.
-		if (ctx.hasUI && !(await babysitAvailable())) ctx.ui.notify(INSTALL_HINT, "warn");
+		if (ctx.hasUI && !(await babysitAvailable())) {
+			ctx.ui.notify(babysitPreflightError ?? INSTALL_HINT, "warn");
+		}
 		if (pollTimer) clearInterval(pollTimer);
 		pollTimer = setInterval(() => {
 			// Skip if the previous (async) poll hasn't finished, so slow babysit
@@ -1304,9 +1488,6 @@ export default function (pi: ExtensionAPI) {
 		pollTimer = undefined;
 	});
 
-	// Keep unpredictable command output out of model context. Direct bash is
-	// reserved for tiny scalar observations and tightly bounded log inspection;
-	// everything else belongs in babysit_run.
 	pi.on("tool_call", async (event) => {
 		if (event.toolName !== "bash") return;
 		const command = String((event.input as { command?: unknown }).command ?? "");
@@ -1322,8 +1503,8 @@ export default function (pi: ExtensionAPI) {
 		return {
 			block: true,
 			reason:
-				"Use babysit_run for this command so potentially large output is captured outside model context. " +
-				"Direct bash is allowed only for pwd, short git status/branch checks, or log-file tail/rg commands explicitly bounded to at most 100 lines. " +
+				"Use babysit_run for shell commands so output is supervised and captured outside model context. " +
+				"Inspect an existing session log with babysit_check { id, lines, pattern? }. " +
 				`Retry as babysit_run({ command: ${JSON.stringify(command)} }).`,
 		};
 	});
@@ -1336,11 +1517,11 @@ export default function (pi: ExtensionAPI) {
 			"Run any shell command in a supervised babysit session. Commands that finish within a short " +
 			"grace period return completion metadata immediately; longer commands continue in the background " +
 			"and trigger an automatic notification on exit. Complete output is returned inline only when it is " +
-			"small; larger output stays in the log path for bounded inspection with tail or rg. " +
+			"small; larger output stays in the log path for bounded inspection with babysit_check. " +
 			"In non-interactive mode (`pi -p`, no UI), process mode blocks until exit because there is no " +
 			"notification loop. Two modes: (1) `command` — run any shell command, including builds, tests, " +
 			"dev servers, watchers, and interactive TUIs; you can type into it with babysit_send and read " +
-			"its screen with babysit_check. If endpoint security kills a worker at startup, " +
+			"its screen with babysit_check. If a worker disappears during startup without recording an exit, " +
 			"`retryOnWorkerDeath` can retry one idempotent command once. " +
 			"(2) `profile: \"subagent\"` + `task` — spawn a pi subagent that works on the task in the " +
 			"background; poll with babysit_check, steer with babysit_send, block with babysit_wait, " +
@@ -1349,7 +1530,7 @@ export default function (pi: ExtensionAPI) {
 			"Run any shell command with context-safe captured output; quick commands return metadata, longer ones continue in background",
 		promptGuidelines: [
 			"Use babysit_run as the default for shell commands, not only long-running work. Small output is returned directly; large stdout/stderr stays out of model context in the returned log path. Give meaningful commands a clear stable `name`.",
-			"Inspect a babysit log only with explicitly bounded commands such as `tail -n N` or focused `rg`; never read or cat a potentially large log in full. Those small inspection commands may use bash directly to avoid recursively creating babysit sessions.",
+			"Inspect a babysit log with babysit_check { id, lines, pattern? }; never read or cat a potentially large log file in full.",
 			"After babysit_run { command } starts a process, end your response immediately so the automatic process-end notification can resume you; NEVER poll with babysit_check or sleep. Set continueAfterStart: true only when you have immediate, specific, non-polling work to do next. Call babysit_wait when you must consume the result inside the current turn (optionally with `expect` to wait for a readiness line like 'listening on').",
 			"If a babysit worker is killed externally, babysit_run reports it as worker-dead rather than hanging. Set retryOnWorkerDeath: true only for safe, idempotent commands; it retries at most once and may otherwise duplicate side effects.",
 			"babysit_run gives full PTY control: drive interactive programs (installers, wizards, REPLs) with babysit_send (text or named keys) and read the rendered screen with babysit_check { screen: true }.",
@@ -1667,10 +1848,10 @@ export default function (pi: ExtensionAPI) {
 		label: "Babysit: check",
 		description:
 			"Inspect babysit session(s). Without an id: lists all sessions (processes + subagents). " +
-			"With an id: a process shows state + recent output (or the rendered screen with " +
-			"`screen: true` — use for TUIs that redraw in place); a subagent shows live progress " +
-			"(turns, recent tool calls, partial answer). Do NOT poll this while merely waiting for " +
-			"a process to end — the exit notification is automatic.",
+			"With an id: a process shows state + recent output, searches its log with `pattern`, " +
+			"or captures the rendered screen with `screen: true`; a subagent shows live progress " +
+			"(or raw log matches with `pattern`). Results are bounded by `lines` and clipped. " +
+			"Do NOT poll this while merely waiting for a process to end — the exit notification is automatic.",
 		promptSnippet: "Check status/progress of babysit sessions (processes and subagents)",
 		parameters: Type.Object({
 			id: Type.Optional(Type.String({ description: "Session id. Omit to list all sessions." })),
@@ -1678,7 +1859,13 @@ export default function (pi: ExtensionAPI) {
 				Type.Number({ description: "Subagent: how many recent tool calls to show (default 8, max 50)." }),
 			),
 			lines: Type.Optional(
-				Type.Number({ description: "Process: how many log lines to show (default 30, max 200)." }),
+				Type.Number({ description: "How many tail lines or latest matches to show (default 30, max 200)." }),
+			),
+			pattern: Type.Optional(
+				Type.String({
+					description:
+						"Search this session's raw log with a regular expression; returns the latest bounded matches.",
+				}),
 			),
 			screen: Type.Optional(
 				Type.Boolean({
@@ -1687,7 +1874,7 @@ export default function (pi: ExtensionAPI) {
 				}),
 			),
 		}),
-		async execute(_id, params) {
+		async execute(_id, params, signal) {
 			await requireBabysit();
 			if (!params.id) {
 				const { sessions, error } = await listSessions();
@@ -1722,6 +1909,40 @@ export default function (pi: ExtensionAPI) {
 				};
 			}
 			const meta = readMeta(params.id);
+			const nLines = Math.min(Math.max(1, Math.floor(params.lines ?? 30)), 200);
+			if (params.pattern !== undefined) {
+				if (params.screen) {
+					return {
+						content: [{ type: "text", text: "`pattern` and `screen` are mutually exclusive." }],
+						isError: true,
+						details: {},
+					};
+				}
+				if (params.pattern.length === 0) {
+					return {
+						content: [{ type: "text", text: "`pattern` must not be empty." }],
+						isError: true,
+						details: {},
+					};
+				}
+				const result = await searchLog(params.id, params.pattern, nLines, signal);
+				if (result.error) {
+					return {
+						content: [{ type: "text", text: result.error }],
+						isError: true,
+						details: {},
+					};
+				}
+				const kind = meta?.kind ?? "process";
+				const header = `[${kind}] state=${st.state}\nlog: ${logPath(params.id)}`;
+				const body = result.text
+					? `--- latest matches /${params.pattern}/ ---\n${result.text}`
+					: `(no output matching /${params.pattern}/)`;
+				return {
+					content: [{ type: "text", text: `${header}\n${body}` }],
+					details: { status: st, kind, logPath: logPath(params.id), pattern: params.pattern },
+				};
+			}
 
 			// --- process ---
 			if (meta?.kind !== "subagent") {
@@ -1740,7 +1961,6 @@ export default function (pi: ExtensionAPI) {
 					const sc = await bs(["screenshot", "-s", params.id, "--trim"]);
 					parts.push(`--- screen ---\n${clip(sc.stdout.trimEnd()) || "(blank screen)"}`);
 				} else {
-					const nLines = Math.min(Math.max(1, params.lines ?? 30), 200);
 					const tail = clip(
 						(await bs(["log", "-s", params.id, "--tail", String(nLines)])).stdout.trimEnd(),
 					);
@@ -2078,17 +2298,46 @@ export default function (pi: ExtensionAPI) {
 		parameters: Type.Object({ id: Type.String({ description: "Session id." }) }),
 		async execute(_id, params, _signal, _onUpdate, ctx) {
 			await requireBabysit();
-			suppressNotify(params.id); // tool-initiated kill → no end notification
-			const r = await bs(["kill", "-s", params.id, "--json"]);
-			await refreshWidget(ctx);
-			if (r.code !== 0) {
+			// Prevent the exit poller racing a requested kill, but restore delivery
+			// on every failure. Permanent suppression happens only after terminal
+			// state is independently confirmed.
+			pauseNotify(params.id);
+			const fail = async (message: string, status?: BsSession | null) => {
+				resumeNotify(params.id);
+				await refreshWidget(ctx);
 				return {
-					content: [{ type: "text", text: r.stderr || "kill failed" }],
+					content: [{ type: "text" as const, text: message }],
 					isError: true,
-					details: {},
+					details: { id: params.id, status: status?.state, logPath: logPath(params.id) },
 				};
+			};
+
+			const r = await bs(["kill", "-s", params.id, "--json"]);
+			if (r.code !== 0) return fail((r.stderr || r.stdout || "kill failed").trim());
+
+			const responseError = validateKillResponse(r.stdout);
+			if (responseError) return fail(responseError);
+
+			const status = await awaitConfirmedTermination(params.id);
+			if (!status) return fail(`Kill could not be verified: session ${params.id} disappeared.`);
+			if (!isConfirmedTerminalState(status.state)) {
+				return fail(
+					`Kill was acknowledged but ${params.id} is still ${status.state}; completion notifications were restored.`,
+					status,
+				);
 			}
-			return { content: [{ type: "text", text: `Killed ${params.id}.` }], details: {} };
+
+			suppressNotify(params.id, "kill");
+			await refreshWidget(ctx);
+			return {
+				content: [{ type: "text", text: `Killed ${params.id} (confirmed ${status.state}).` }],
+				details: {
+					id: params.id,
+					status: status.state,
+					exitCode: status.exit_code,
+					logPath: logPath(params.id),
+				},
+			};
 		},
 	});
 
@@ -2101,7 +2350,7 @@ export default function (pi: ExtensionAPI) {
 		description: "Pick a babysit session (↑/↓) to snapshot/inspect",
 		handler: async (_args, ctx) => {
 			if (!(await babysitAvailable())) {
-				ctx.ui.notify(INSTALL_HINT, "error");
+				ctx.ui.notify(babysitPreflightError ?? INSTALL_HINT, "error");
 				return;
 			}
 			const sessions = (await listSessions()).sessions.sort((a, b) =>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yusukeshib/pi-babysit",
-  "version": "0.3.4",
+  "version": "0.3.7",
   "description": "Run any shell command and pi subagents under babysit, with context-safe captured output.",
   "keywords": [
     "pi-package",
@@ -23,6 +23,7 @@
     "agents.ts",
     "self-reap.ts",
     "format-stream.mjs",
+    "search-log.mjs",
     "README.md",
     "LICENSE"
   ],

package/search-log.mjs

@@ -0,0 +1,42 @@
+import fs from "node:fs";
+import { createInterface } from "node:readline";
+
+const [file, source, maxLinesRaw] = process.argv.slice(2);
+const maxLines = Math.min(Math.max(1, Number.parseInt(maxLinesRaw ?? "30", 10) || 30), 200);
+const MAX_LINE_BYTES = 4_000;
+
+let pattern;
+try {
+	pattern = new RegExp(source);
+} catch (error) {
+	console.error(`Invalid pattern: ${String(error)}`);
+	process.exit(2);
+}
+
+function clipLine(line) {
+	const bytes = Buffer.from(line, "utf8");
+	if (bytes.length <= MAX_LINE_BYTES) return line;
+	const half = Math.floor(MAX_LINE_BYTES / 2);
+	const head = bytes.subarray(0, half).toString("utf8").replace(/\uFFFD+$/, "");
+	const tail = bytes.subarray(bytes.length - half).toString("utf8").replace(/^\uFFFD+/, "");
+	return `${head}… [line clipped] …${tail}`;
+}
+
+const matches = [];
+let lineNumber = 0;
+try {
+	const input = fs.createReadStream(file, { encoding: "utf8" });
+	const lines = createInterface({ input, crlfDelay: Infinity });
+	for await (const line of lines) {
+		lineNumber++;
+		pattern.lastIndex = 0;
+		if (!pattern.test(line)) continue;
+		matches.push(`${lineNumber}:${clipLine(line)}`);
+		if (matches.length > maxLines) matches.shift();
+	}
+} catch (error) {
+	console.error(`Could not search log: ${String(error)}`);
+	process.exit(1);
+}
+
+process.stdout.write(matches.join("\n"));