Add support for intercepting bash #903
Conversation
mitsuhiko
force-pushed
the
intercept-bash
branch
2 times, most recently
from
8664526 to
1d70707
Compare
mitsuhiko
force-pushed
the
intercept-bash
branch
from
6f33501 to
4daf2d8
Compare
mitsuhiko
force-pushed
the
intercept-bash
branch
from
4daf2d8 to
15b9154
Compare
| const nextDetails = (resultResult.details ?? result.details) as T; | ||
| if (resultResult.isError) { | ||
| forcedError = true; | ||
| throw new Error(toolResultContentToErrorMessage(nextContent, "Tool execution failed.")); |
There was a problem hiding this comment.
I really cannot think of a better idea here.
|
Happy to modify/rewrite the examples/ssh.ts (and my own pi-ssh-remote) when this lands. |
|
@cv it should in theory work with it already, the question in a way is if ssh.ts can further benefit from the changes. |
|
This could be really nice for project purposes, instead of blowing agents.md and instructions on how to run sandboxed environment, we could just build custom extensions that are preparing env for tool, is that nix develop, or uv, or whatever else that someone uses. From architectural point of view i would prefer a middleware approach to tool wrapping, then dangling handlers. |
|
|
||
| **Examples:** [chalk-logger.ts](../examples/extensions/chalk-logger.ts), [permission-gate.ts](../examples/extensions/permission-gate.ts), [plan-mode/index.ts](../examples/extensions/plan-mode/index.ts), [protected-paths.ts](../examples/extensions/protected-paths.ts) | ||
|
|
||
| #### before_bash_exec |
There was a problem hiding this comment.
This would be very useful for direnv integration! I am currently doing this: https://github.com/Mic92/dotfiles/blob/main/home/.pi/agent/extensions/direnv.ts
One thing that is missing is knowing what directory the agent tries to access. Often the agent prepends cd but it feels a bit hacky. But maybe cd() could be replaced by a function with this.
4 participants
Discussion:
This allows hooking bash execution and it also allows
tool_resulthooks to manipulate error messages by "abusing" content to carry error messages. This feels somewhat consistent to how it works but a bit ugly.