feat: add bash tool

[bobrykov]

No description provided.

[coderabbitai]

Warning

Review limit reached

@bobrykov, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 299f96d4-22bf-4d5e-a6ca-4bfa5a043e10

📥 Commits

Reviewing files that changed from the base of the PR and between 4a39c96 and ab9ad78.

📒 Files selected for processing (1)

• crates/dch-tools/src/bash.rs

📝 Walkthrough

Walkthrough

Changes

The PR adds a Bash tool for foreground and background shell execution, with bounded output, timeouts, process-group cleanup, job operations, public exports, builtin registration, and comprehensive tests.

Bash Tool

Layer / File(s)	Summary
Execution contract and dependencies crates/dch-tools/Cargo.toml, crates/dch-tools/src/bash.rs	Defines tool inputs, timeout and output limits, concurrency classification, and process dependencies.
Background job lifecycle crates/dch-tools/src/bash.rs	Tracks background commands by ID, exposes status/list/cleanup operations, and validates operation inputs.
Process execution and cancellation crates/dch-tools/src/bash.rs	Runs bash -c commands, captures bounded stdout and stderr, reports exit metadata, enforces timeouts, and kills Unix process groups.
Public registration and validation crates/dch-tools/src/lib.rs, crates/dch-tools/src/registry.rs, crates/dch-tools/src/bash.rs	Exports and registers BashTool, with tests covering schemas, safety checks, execution, truncation, timeouts, and job lifecycle behavior.

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant BashTool
  participant BashProcess
  participant JobTable
  Caller->>BashTool: Submit command
  alt Foreground execution
    BashTool->>BashProcess: Run bash -c command
    BashProcess-->>BashTool: Output and exit status
    BashTool-->>Caller: Bounded result and metadata
  else Background execution
    BashTool->>JobTable: Create and track job
    JobTable-->>BashTool: Job ID
    BashTool-->>Caller: Running job ID
    Caller->>BashTool: Request job status
    BashTool->>JobTable: Read job state
    JobTable-->>BashTool: Job status
    BashTool-->>Caller: Status result
  end

Loading

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely matches the main change: adding a Bash tool.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/bash-tool

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

crates/dch-tools/src/bash.rs (1)

30-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Doc comment promises a combined cap; implementation caps each stream independently.

The constant doc says "Truncate captured stdout + stderr beyond this many bytes." but truncate_string is applied separately to stdout and stderr, each allowed up to MAX_OUTPUT_BYTES (Lines 426-427), so combined output can reach ~2× the documented cap when both streams are large. Either track a shared byte budget across both streams, or update the doc/constant name to reflect the per-stream semantics.

Also applies to: 426-433

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/dch-tools/src/bash.rs` around lines 30 - 31, The output limit
documentation does not match the per-stream truncation performed around
truncate_string. Either implement a shared MAX_OUTPUT_BYTES budget across stdout
and stderr, or rename and update the constant documentation to explicitly
describe the per-stream limit, preserving the existing truncation behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/dch-tools/src/bash.rs`:
- Around line 417-420: Replace the unbounded child.wait_with_output() usage in
the command execution flow with bounded streaming reads for stdout and stderr,
limiting retained data to MAX_OUTPUT_BYTES per stream while continuing to drain
both pipes until the child exits. Preserve the existing timeout and ToolError
handling, and apply truncate_string only to the bounded captured output.
- Around line 98-140: Thread the requested timeout through the background-job
path: update call_inner to read the timeout before its background branch and
pass it to spawn_background_job, then update spawn_background_job to enforce it
with tokio::time::timeout around execute_foreground and mark timed-out jobs as
failed with a clear timeout message. Replace the unused _timeout_secs parameter
in execute_foreground only as needed to preserve the existing timeout behavior.
- Around line 33-61: Harden is_read_only_command, used by
is_safe_for_concurrent_execution, against destructive command false negatives:
detect shell redirections such as >, >>, and < as unsafe, reject mutating find
actions including -delete and -exec, and remove git branch/git remote from
READ_ONLY_PREFIXES or add denylist checks for mutating subcommands and flags
before prefix matching. Preserve read-only classification only for commands that
pass these safety checks.

---

Nitpick comments:
In `@crates/dch-tools/src/bash.rs`:
- Around line 30-31: The output limit documentation does not match the
per-stream truncation performed around truncate_string. Either implement a
shared MAX_OUTPUT_BYTES budget across stdout and stderr, or rename and update
the constant documentation to explicitly describe the per-stream limit,
preserving the existing truncation behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ef0ed71-d146-4ef6-9958-fced88bc12c9

📥 Commits

Reviewing files that changed from the base of the PR and between d308045 and 87056ae.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• crates/dch-tools/Cargo.toml
• crates/dch-tools/src/bash.rs
• crates/dch-tools/src/lib.rs
• crates/dch-tools/src/registry.rs