Timed Python child execution
ChildHarbor is a Windows AI coding client for reviewing a trusted Python child-process wrapper. Discuss timeout validation and direct-child cleanup with a compatible endpoint; running code still requires your own trust decision.
import math, os, subprocess, sys
from pathlib import Path
def run_trusted_python(script, seconds, folder):
if type(script) is not str or len(script) > 4096:
raise ValueError("child.script")
if type(seconds) not in (int, float) or not .05 <= seconds <= 5 or not math.isfinite(seconds):
raise ValueError("child.timeout")
if not isinstance(folder, (str, Path)) or not Path(folder).is_dir():
raise ValueError("child.folder")
return subprocess.run([sys.executable, "-I", "-S", "-X", "utf8", "-c", script],
cwd=folder, timeout=seconds, capture_output=True, text=True,
encoding="utf-8", check=False,
creationflags=subprocess.CREATE_NO_WINDOW if os.name == "nt" else 0)| Review before applying | Compare actual behavior with the expected result. If a check fails, investigate it before applying more changes. |
|---|---|
| Connection | Base URL, credentials and a reachable server. |
| Project | Check Unicode output, failed exits and direct-child termination on timeout, rejecting invalid limits without claiming sandboxing or descendant cleanup. |
import math, os, subprocess, sys
from pathlib import Path
def run_trusted_python(script, seconds, folder):
if type(script) is not str or len(script) > 4096:
raise ValueError("child.script")
if type(seconds) not in (int, float) or not .05 <= seconds <= 5 or not math.isfinite(seconds):
raise ValueError("child.timeout")
if not isinstance(folder, (str, Path)) or not Path(folder).is_dir():
raise ValueError("child.folder")
return subprocess.run([sys.executable, "-I", "-S", "-X", "utf8", "-c", script],
cwd=folder, timeout=seconds, capture_output=True, text=True,
encoding="utf-8", check=False,
creationflags=subprocess.CREATE_NO_WINDOW if os.name == "nt" else 0)Review a process wrapper with its trust boundary intact
ChildHarbor is a Windows AI coding client for examining process-management code in a project conversation. Begin by stating which code is trusted to run and what the caller needs to observe. Ask your connected model to inspect the existing wrapper before suggesting changes, so the proposal preserves both its purpose and its limits.
A concrete task is a trusted Python child-process wrapper with an existing working directory and a bounded timeout. Discuss Unicode output, failed exits and what happens when the direct child exceeds the time limit. Keep those requirements separate from security isolation: accepting trusted code for execution does not make the wrapper a sandbox for arbitrary input.
Review the proposed edit against your own process fixtures. Check captured output, exit status and the direct-child timeout path in your development environment. If descendant processes matter, define and investigate that additional requirement explicitly. A successful timeout test on one child is not evidence that an entire process tree is cleaned up, so retain that distinction in the review.
ChildHarbor supports OpenAI-compatible or Anthropic endpoint connections, with credentials when required. An unfiltered AI model can be selected where your endpoint provides it. The server and model determine context, available tools and restrictions; choosing a model does not authorize running untrusted code or validate the proposed wrapper.
Questions before changing process-launch code
What should I say about trusted input?
Identify who supplies the script and why the application permits it to run. Keep that assumption explicit in the task. If scripts can come from untrusted users, the security problem is broader than adding a timeout to the existing wrapper.
Does a timeout imply all descendants are terminated?
No. Review exactly which process the implementation controls and test that behavior in your environment. If the application requires process-tree cleanup, make it a separate explicit requirement and inspect the platform-specific implementation rather than infer it from direct-child handling.
Why test Unicode output as well as failed exits?
They exercise different parts of the wrapper's caller contract. Include expected text and exit behavior so the proposal preserves both. A process may run correctly while output decoding or error reporting still gives the application an unusable result.
Should I execute every script suggested in the conversation?
Review the code and its effects before running it. The workspace conversation can help explain a proposal, but the trust decision belongs to you. Use appropriate project fixtures and avoid treating model-generated text as authorization to execute arbitrary operations.
ChildHarbor · Updated 2026-10-25