Function Bash

internal/tools/bash.go:38–96

Bash runs one shell command through /bin/sh -c and returns combined stdout+stderr. Non-zero exit is not an error; the model sees the failure and reacts. A pre-cancelled parent (Ctrl+C raced the dispatch) returns "(cancelled)" before the blank-command check, so a trivially-cancelled call isn't mista

(parent context.Context, command string, timeout time.Duration)

//
// A pre-cancelled parent (Ctrl+C raced the dispatch) returns "(cancelled)"
// before the blank-command check, so a trivially-cancelled call isn't
// mistaken for a valid empty-args invocation.
func Bash(parent context.Context, command string, timeout time.Duration) string {
	if parent.Err() != nil {
		return "(cancelled)"
	}
	if strings.TrimSpace(command) == "" {
		return "(empty command)"
	}
	ctxT, cancel := context.WithTimeout(parent, timeout)
	defer cancel()

	cmd := exec.CommandContext(ctxT, "/bin/sh", "-c", command)
	// Shell gets its own process group + a Cancel that kills the whole group
	// on cancel/timeout (Unix; no-op on Windows). Without it, backgrounded
	// children (`cmd &`) outlive the parent shell and leak.
	setProcessGroup(cmd)
	// Cap the wait for stdout/stderr pipes to close after /bin/sh exits.
	// Backgrounded children inherit those pipe fds, so without this Run's
	// pipe-copy goroutine blocks for the full timeout even though the shell
	// is gone.
	cmd.WaitDelay = 100 * time.Millisecond
	// Bounded combined output instead of CombinedOutput's unbounded buffer: a
	// high-throughput command (`cat big.iso`, `grep -r "" /`) can emit hundreds
	// of MB/s and OOM-kill the whole TUI well before the timeout or Ctrl+C
	// react. ctx.Truncate keeps only head+tail anyway, so nothing the model
	// would see is lost. Stdout and Stderr get the SAME writer value, which
	// os/exec detects and funnels through one pipe: no locking needed.
	buf := &headTailBuffer{}
	cmd.Stdout = buf
	cmd.Stderr = buf
	err := cmd.Run()
	s := buf.String()
	// Name the capture drop at the END of the output, where ctx.Truncate's
	// tail keep guarantees the model sees it: the in-band seam marker sits at
	// the ~1MB offset, always inside Truncate's dropped middle, and Truncate's
	// own "total" would count the collapsed string, under-reporting the real
	// size by orders of magnitude.
	if d := buf.droppedBytes(); d > 0 {
		s += fmt.Sprintf("\n(output capped at capture: %d bytes total, %d bytes dropped mid-stream)", buf.totalBytes(), d)
	}
	if err != nil {
		switch {
		case ctxT.Err() == context.DeadlineExceeded:
			// Name the recovery in the result string rather than the system
			// prompt: a foreground server is the common cause and it never
			// exits on its own, so re-firing it with a bigger timeout just
			// burns the turn again.
			return s + fmt.Sprintf("\n(timeout after %s - if this command never exits on its own it is a server or watcher: re-run it backgrounded, `cmd >/tmp/x.log 2>&1 & echo $! >/tmp/x.pid`, then poll the log. If it was legitimately slow, re-issue it once with a larger timeout_seconds.)", timeout)
		case parent.Err() == context.Canceled || ctxT.Err() == context.Canceled:
			// User Ctrl+C; name it rather than leak "signal: killed" noise.
			return s + "\n(cancelled)"
		case errors.Is(err, exec.ErrWaitDelay):
			// Shell exited 0; err is non-nil only because a backgrounded child
			// held the pipes past WaitDelay, not a failure. Return output as-is
			// so it isn't mislabeled with a spurious (exit: ...). After the
			// cancel/timeout cases so those signals win over a coincident delay.
			return s