Greptile Summary

This PR adds two new operator-facing subcommands to the bin/baudbot CLI dispatcher: baudbot sessions (lists active tmux and pi sessions for the baudbot_agent user) and baudbot attach [name] (attaches the caller's terminal to a named or auto-selected tmux session). Both commands follow the existing pattern of delegating to sudo -u baudbot_agent but have a few issues that should be addressed before merging.

Key findings:

• Missing require_root guard (logic): Both sessions and attach invoke sudo -u baudbot_agent without first calling require_root, unlike every other privileged command in this file (start, stop, restart, setup, deploy, update, uninstall). Without root, the sudo calls will fail silently (the tmux ls errors are suppressed with 2>/dev/null) or prompt interactively, producing confusing output. The PR description itself shows both commands being run with sudo, so the intent is root-required — that just needs to be enforced in code.
• Inaccurate usage text (syntax): The help text at line 51 describes the attach default as control-agent, but the implementation selects the first available tmux session via tmux ls | head -1, which can be any session (e.g. slack-bridge or baudbot).
• False-positive "running" status for pi sessions (style): The sessions command marks a pi session as running if control.sock exists, regardless of whether the socket is connectable. A crashed pi process can leave a stale socket, causing incorrect status reporting. The pid-based check below correctly uses kill -0; the socket check should be similarly validated.

Confidence Score: 3/5

• Safe to merge after fixing the missing require_root guards in both new commands; other issues are minor.
• The two new commands are self-contained additions that do not touch security-critical paths. However, omitting require_root from commands that rely on sudo -u baudbot_agent is an inconsistency that causes silent failure or confusing UX for non-root callers and deviates from the established pattern in this very file. The usage text inaccuracy is a minor doc bug. The stale-socket liveness issue is cosmetic for an operator tool. None of these are security vulnerabilities given the operational context.
• bin/baudbot — both new case blocks need require_root added and the usage string corrected

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Admin as Admin User (root)
    participant Baudbot as bin/baudbot
    participant Tmux as tmux (baudbot_agent)
    participant PiFS as ~/.pi/agent/sessions/

    Note over Admin,PiFS: baudbot sessions
    Admin->>Baudbot: sudo baudbot sessions
    Baudbot->>Tmux: sudo -u baudbot_agent tmux ls
    Tmux-->>Baudbot: session list (or empty)
    Baudbot->>PiFS: stat ~/.pi/agent/sessions/*/
    PiFS-->>Baudbot: sess_dir entries
    loop each session dir
        Baudbot->>PiFS: check control.sock / pid file
        PiFS-->>Baudbot: status = running / stopped
        Baudbot->>PiFS: read name file
        PiFS-->>Baudbot: session name
    end
    Baudbot-->>Admin: formatted session list

    Note over Admin,Tmux: baudbot attach [name]
    Admin->>Baudbot: sudo baudbot attach [name]
    alt no name given
        Baudbot->>Tmux: sudo -u baudbot_agent tmux ls -F #{session_name}
        Tmux-->>Baudbot: first session name
    end
    Baudbot-->>Admin: print attach instructions
    Baudbot->>Tmux: exec sudo -u baudbot_agent tmux attach-session -t TARGET
    Tmux-->>Admin: interactive tmux session

_{Last reviewed commit: 5113760}