Add a Pi-style `bash` tool for isolated chat workspaces #63

Context

Pi's bash tool gives the model a small contract while handling the operational details that make shell execution usable: streamed output, process-tree cancellation, explicit timeouts, bounded previews, complete output artifacts, and exit metadata.

OpenAgents already has computer_run for typed argument vectors on a paired user computer. The new /chat surface needs a shell-oriented tool, but it must not execute on the Phoenix web node or bypass the existing computer and authority controls.

Build this on #61. Related work: #37, #38, and #55.

Tool contract

Expose a model tool named bash with these arguments:

• command: A shell command string.
• timeout_seconds: An optional positive timeout within the workspace policy maximum.

Run the command from the selected conversation workspace and return:

• The exit code or terminating signal.
• Whether the command timed out or was cancelled.
• The elapsed time.
• A bounded interleaved output preview.
• A durable reference to the complete output when the preview was truncated.
• The execution workspace and effect receipt identifiers.

Execution behavior

• Stream stdout and stderr as ordered tool-output events, with throttling and backpressure.
• Cancel the entire process group, not only the parent shell process.
• Enforce both a default timeout and a policy maximum. Do not accept Pi's effectively unbounded host execution model.
• Keep the visible output to the last 2,000 lines or 50 KiB. Store the complete output as a bounded-lifetime artifact when truncation occurs.
• Report command-not-found, nonzero exit, signal, timeout, cancellation, output-limit, and workspace-loss conditions distinctly.
• Preserve the original Responses API function-call item and append the structured function-call output before the next model request.

Safety and authority

• Run only in an isolated cloud computer workspace or an explicitly selected paired computer workspace. Never fall back to the web node, release filesystem, Forge storage, or an ambient developer checkout.
• Reuse the computer_run transport, process control, and receipt machinery where appropriate. Keep its typed-argv API available for internal callers.
• Require explicit execution authority and the workspace's current consent and host-policy receipts.
• Apply per-user, per-conversation, and per-workspace concurrency, CPU, memory, disk, process, network, and wall-clock limits.
• Start with network access denied unless the selected workspace policy grants it.
• Strip or redact platform credentials and secrets from the environment, streamed output, persisted previews, and artifacts.
• Require approval for commands classified as destructive or for policy expansions such as network access.
• Preserve a restorable workspace snapshot before a command with filesystem mutation authority runs.

User experience and API

• Render the command, workspace, approval state, live output, elapsed time, exit state, truncation notice, artifact link, and receipt with the shared tool components.
• Keep each reasoning segment, shell call, result, retry, and final response as a separate ordered conversation item.
• Publish the same lifecycle through the account API so programmatic clients can test the exact behavior shown in the browser.
• Let a user cancel a running command from either client and observe the same final cancelled state.

Acceptance criteria

• Tests cover success, stderr, nonzero exit, command-not-found, timeout, cancellation, process-tree cleanup, output truncation, full-output artifact expiry, secret redaction, and network denial.
• A scope test proves that the command cannot execute on or access the Phoenix web node.
• A concurrency test proves that quotas apply when one conversation starts multiple computers or commands.
• A real or captured Ox Alpha Responses sequence invokes bash, receives its result, and produces a final response without falling back because of tool-loop decoding.
• Browser and API integration tests observe the same ordered stream, exit metadata, artifact reference, cancellation, and final response.

References

• Pi source: packages/coding-agent/src/core/tools/bash.ts, truncate.ts, and output-accumulator.ts at commit a1f955e9f47fd3379b44f4aace65ab916c80519a
• OpenAgentsInc/openagents.com: lib/openagents/tools/computer_run.ex and the shared runner and receipt modules
• OpenAgentsInc/openagents: docs/teardowns/2026-07-21-pi-agent-teardown.md and docs/omega-agent/2026-07-27-slim-agent-spec.md