bug(python): external_handler deadlocks when callback re-enters same Bash instance

[chaliy]

Split from #1312.

Summary

In Python bindings, using external_handler with Bash(python=True, external_functions=[...]) can deadlock if the handler callback calls back into the same Bash instance, e.g. via bash.read_file(...) or bash.fs().

This is related to #1312 as motivation, but it is a separate issue from exposing persistent custom builtins on Bash/BashTool.

Repro

from bashkit import Bash

async def read_memory(ctx) -> str:
    return ctx["bash"].read_file("/workspace/memory.md")

actions = {"read__memory": read_memory}

bash = Bash(
    python=True,
    external_functions=["read__memory"],
    external_handler=handler,
)

async def handler(fn_name: str, _args: list, kwargs: dict):
    ctx = {"bash": bash}
    method = actions[fn_name]
    return await method(ctx)

Calling the external function from python3 -c ... deadlocks when the callback reaches back into the same Bash instance.

Expected

One of:

• this pattern is explicitly documented as unsupported, with guidance for the intended workflow
• or the Python binding prevents/rejects the re-entrant call cleanly instead of deadlocking
• or the underlying re-entrancy issue is fixed

Notes

• feat(python): add add_tool() to Bash #1312 is about adding persistent callback-backed commands to Bash/BashTool
• this issue is specifically about re-entering the same shell from an external_handler callback
• comment that motivated the split: feat(python): add add_tool() to Bash #1312 (comment)

[oliverlambson]

Found the same family of bug on the JS side while working on #1309 - not sure if you want to broaden this one to include node too?

Bash / BashTool onOutput callbacks are not re-entrant-safe against the same instance. If the callback calls back into the same shell instance (for example via readFile, fs(), or execute*), it reproduces the same underlying problem.

In my repro:

• await bash.execute(..., { onOutput }) hangs
• bash.executeSync(..., { onOutput }) panics with Tokio Cannot block the current thread from within a runtime

So this looks like the same callback re-entry limitation, now exposed on the Node streaming-output API too. If you want to keep this issue Python-only, we should open a sibling JS issue and cross-link it; otherwise I think broadening this one to cover Node as well would make sense.