fix(pi): correct switch coercion for draft and tidy Babysit reporting

- `draft` had the same string-coercion bug that `babysitMode` was fixed for one
  line above it. A switch arrives as `'true'`/`'false'` when its value came
  through a variable reference, an API trigger payload, or a legacy serialized
  workflow, and `inputs.draft !== false` read `'false'` as truthy — opening a
  draft PR against the user's explicit setting. Both now go through one
  `isSwitchEnabled` helper that handles either polarity and takes the field's
  default, because the bug is opposite on each.
- `mergePhaseDiffs` joined two separately-capped diffs without re-capping, so
  the combined output could reach twice MAX_DIFF_BYTES.
- The cancellation poller's `logger.warn` was the one message in these files
  emitted unscrubbed. A Redis poll error is unlikely to carry a run credential,
  but a uniform invariant is easier to keep than a per-call-site argument.
- Renamed `waitWithSandboxKeepalive` to `waitWithSandboxProbe`. E2B's `timeoutMs`
  counts down from create and is reset only by `Sandbox.setTimeout`, never by
  running a command, so `true` every four minutes proves liveness and buys no
  time. The old name invited raising the round wait on the assumption that waits
  extend the sandbox, which would let E2B reap it mid-wait.
- Dropped a `{@link}` to a symbol in another module that was never imported.

Author: icecrasher321

apps/sim/executor/handlers/pi/babysit-backend.ts

@@ -110,7 +110,7 @@ const MIN_BABYSIT_BUDGET_MS = MIN_PI_TIMEOUT_MS
  */
 const MIN_ROUND_BUDGET_MS = 5 * 60 * 1000
 const ROUND_FINALIZATION_RESERVE_MS = 2 * FINALIZE_TIMEOUT_MS
-const SANDBOX_KEEPALIVE_INTERVAL_MS = 4 * 60 * 1000
+const SANDBOX_PROBE_INTERVAL_MS = 4 * 60 * 1000
 
 const BABYSIT_GUIDANCE =
   'You are fixing an existing pull request in a long-lived automated sandbox. Make only minimal ' +
@@ -431,7 +431,8 @@ function buildRoundPrompt(
 function createCancellationSignal(
   parent: AbortSignal | undefined,
   executionId: string | undefined,
-  pollMs: number
+  pollMs: number,
+  secrets: readonly string[]
 ): { signal: AbortSignal; cleanup: () => void } {
   const controller = new AbortController()
   const onAbort = () => controller.abort(parent?.reason ?? 'workflow_abort')
@@ -451,9 +452,12 @@ function createCancellationSignal(
               }
             })
             .catch((error) => {
+              // Scrubbed like every other message this file emits. A Redis poll
+              // error is unlikely to carry a run credential, but the invariant is
+              // easier to keep than to reason about per call site.
               logger.warn('Failed to poll Babysit execution cancellation', {
                 executionId,
-                error: getErrorMessage(error),
+                error: scrubPiSecrets(getErrorMessage(error), secrets),
               })
             })
             .finally(() => {
@@ -655,21 +659,30 @@ async function waitForHeadConvergence(
   return 'lagging'
 }
 
-async function waitWithSandboxKeepalive(
+/**
+ * Sleeps in slices, checking the sandbox is still answering between them.
+ *
+ * Named a probe rather than a keepalive because it cannot extend anything: E2B's
+ * `timeoutMs` counts down from create and is reset only by `Sandbox.setTimeout`,
+ * never by running a command, so `true` proves liveness and buys no time. The wait
+ * is safe today only because {@link runBabysitPiWithOptions} starts its clock
+ * before the sandbox is created, so the budget always expires first — a reordering,
+ * or a `roundWaitMs` raised past the remaining lifetime, would let E2B reap the
+ * sandbox mid-wait. Extending the lifetime would need `setTimeout` plumbed through
+ * {@link PiSandboxRunner}.
+ */
+async function waitWithSandboxProbe(
   runner: PiSandboxRunner,
   durationMs: number,
   signal: AbortSignal
 ): Promise<void> {
   let remainingMs = durationMs
   while (remainingMs > 0) {
-    const intervalMs = Math.min(remainingMs, SANDBOX_KEEPALIVE_INTERVAL_MS)
+    const intervalMs = Math.min(remainingMs, SANDBOX_PROBE_INTERVAL_MS)
     await sleepUntilAborted(intervalMs, signal)
     if (signal.aborted) throw new Error('Pi run aborted')
-    const keepalive = await raceAbort(
-      runner.run('true', { timeoutMs: FINALIZE_TIMEOUT_MS }),
-      signal
-    )
-    if (keepalive.exitCode !== 0) throw new Error('Babysit sandbox keepalive failed')
+    const probe = await raceAbort(runner.run('true', { timeoutMs: FINALIZE_TIMEOUT_MS }), signal)
+    if (probe.exitCode !== 0) throw new Error('Babysit sandbox stopped responding')
     remainingMs -= intervalMs
   }
 }
@@ -721,7 +734,8 @@ export async function runBabysitPiWithOptions(
   const cancellation = createCancellationSignal(
     context.signal,
     params.executionId,
-    options.cancellationPollMs
+    options.cancellationPollMs,
+    secrets
   )
   const { signal } = cancellation
   const startedAt = Date.now()
@@ -878,7 +892,7 @@ export async function runBabysitPiWithOptions(
             )
             return resultFor(totals, reason, progress, threadsClean, latestChecks!.checksGreen)
           }
-          await waitWithSandboxKeepalive(runner, options.roundWaitMs, signal)
+          await waitWithSandboxProbe(runner, options.roundWaitMs, signal)
           snapshot = await fetchBabysitSnapshot(params, signal)
           assertBabysitPinned(
             { headSha: pinnedHeadSha, headRef: pinnedHeadRef, baseRef: pinnedBaseRef },
@@ -1221,7 +1235,7 @@ export async function runBabysitPiWithOptions(
           remainingBeforeWait >
             options.roundWaitMs + MIN_ROUND_BUDGET_MS + ROUND_FINALIZATION_RESERVE_MS
         ) {
-          await waitWithSandboxKeepalive(runner, options.roundWaitMs, signal)
+          await waitWithSandboxProbe(runner, options.roundWaitMs, signal)
         }
 
         snapshot = await fetchBabysitSnapshot(params, signal)

apps/sim/executor/handlers/pi/babysit-github.ts

@@ -545,7 +545,7 @@ async function fetchCheckDiagnostic(
  *
  * Fanned out in small batches rather than one at a time: each Actions log is a separate
  * HTTP read of a body that can approach the executor's response cap, and a round may
- * carry up to {@link MAX_FAILING_CHECKS_IN_PROMPT} of them. Serialized, that put minutes
+ * carry up to the caller's per-round check bound of them. Serialized, that put minutes
  * of avoidable wall clock inside a budget the round loop is carefully rationing. The
  * batch size stays small so a wide matrix cannot burst GitHub's rate limiter.
  */

apps/sim/executor/handlers/pi/cloud-backend.ts

@@ -170,8 +170,15 @@ function mergeChangedFiles(
   return [...new Set([...(createFiles ?? []), ...(babysitFiles ?? [])])]
 }
 
+/**
+ * Joins both phases' diffs under the same ceiling each already respects
+ * individually — without the re-cap, two 200 KB diffs produced a 400 KB output.
+ */
 function mergePhaseDiffs(createDiff: string | undefined, babysitDiff: string | undefined): string {
-  return [createDiff, babysitDiff].filter((diff): diff is string => !!diff).join('\n')
+  const merged = [createDiff, babysitDiff].filter((diff): diff is string => !!diff).join('\n')
+  return merged.length > MAX_DIFF_BYTES
+    ? `${merged.slice(0, MAX_DIFF_BYTES)}\n[diff truncated]`
+    : merged
 }
 
 function combineCreateAndBabysit(created: CreatePrPhaseResult, babysit: PiRunResult): PiRunResult {

apps/sim/executor/handlers/pi/pi-handler.test.ts

@@ -353,6 +353,43 @@ describe('PiBlockHandler', () => {
     expect(mockRunCloud.mock.calls[0][0]).not.toHaveProperty('babysit')
   })
 
+  // A `switch` arrives as a string when its value came through a variable reference,
+  // an API trigger payload, or a legacy serialized workflow.
+  it('enables Babysit when the toggle arrives as the string "true"', async () => {
+    await handler.execute(ctx(), block, {
+      mode: 'cloud',
+      task: 'build it',
+      model: 'claude',
+      owner: 'o',
+      repo: 'r',
+      githubToken: 'ghp',
+      babysitMode: 'true',
+      reviewMentions: '@greptile',
+    })
+
+    expect(mockRunCloud.mock.calls[0][0].babysit).toMatchObject({
+      reviewMentions: ['@greptile'],
+    })
+  })
+
+  // The negative polarity is the one `draft` needs: it defaults on, so a strict
+  // `!== false` read the string 'false' as truthy and opened a draft PR against
+  // the user's explicit setting.
+  it('honours a draft toggle supplied as the string "false"', async () => {
+    await handler.execute(ctx(), block, {
+      mode: 'cloud',
+      task: 'build it',
+      model: 'claude',
+      owner: 'o',
+      repo: 'r',
+      githubToken: 'ghp',
+      babysitMode: false,
+      draft: 'false',
+    })
+
+    expect(mockRunCloud.mock.calls[0][0].draft).toBe(false)
+  })
+
   it('parses review mentions as a bounded, trimmed list', () => {
     expect(parsePiReviewMentions(' @one, , @two ')).toEqual(['@one', '@two'])
     expect(parsePiReviewMentions('')).toEqual([])

apps/sim/executor/handlers/pi/pi-handler.ts

@@ -73,6 +73,21 @@ function isReviewEvent(value: string): value is PiCloudReviewRunParams['reviewEv
   return REVIEW_EVENTS.some((event) => event === value)
 }
 
+/**
+ * Reads a `switch` subblock, tolerating the string form.
+ *
+ * A switch reaches a handler as `'true'`/`'false'` when its value arrived through
+ * a variable reference, an API trigger payload, or a legacy serialized workflow —
+ * `wait-handler` coerces the same way. Both polarities need it: a strict `=== true`
+ * silently disables an enabled toggle, and a strict `!== false` silently enables a
+ * disabled one.
+ */
+function isSwitchEnabled(value: unknown, defaultValue = false): boolean {
+  if (value === true || value === 'true') return true
+  if (value === false || value === 'false') return false
+  return defaultValue
+}
+
 function parsePiMode(value: unknown): PiRunParams['mode'] {
   if (value === 'cloud' || value === 'cloud_review' || value === 'local') {
     return value
@@ -246,7 +261,7 @@ export class PiBlockHandler implements BlockHandler {
     // workflow (see the same coercion in `wait-handler`). A strict boolean compare
     // silently opened a draft PR and skipped Babysit entirely while the editor showed
     // the toggle on and Reviewer Mentions as required.
-    const babysitMode = inputs.babysitMode === true || inputs.babysitMode === 'true'
+    const babysitMode = isSwitchEnabled(inputs.babysitMode)
     const reviewMentions = babysitMode ? parsePiReviewMentions(inputs.reviewMentions) : []
     if (babysitMode && reviewMentions.length === 0) {
       throw new Error('Create PR Babysit Mode requires at least one reviewer mention')
@@ -266,7 +281,10 @@ export class PiBlockHandler implements BlockHandler {
       githubToken,
       baseBranch: asOptString(inputs.baseBranch),
       branchName: asOptString(inputs.branchName),
-      draft: babysitMode ? false : inputs.draft !== false,
+      // `draft` defaults on, so the negative form is the one that must tolerate the
+      // string: `'false'` from a variable reference would otherwise read as truthy
+      // and open a draft PR against the user's explicit setting.
+      draft: babysitMode ? false : isSwitchEnabled(inputs.draft, true),
       prTitle: asOptString(inputs.prTitle),
       prBody: asOptString(inputs.prBody),
       ...(babysitMode