@vellumai/assistant 0.12.2 → 0.12.3-staging.2

package/src/tools/skills/load.ts

@@ -90,12 +90,13 @@ function formatToolSchemas(
   manifest: SkillToolManifest,
   context: Pick<
     ToolContext,
-    "clientOs" | "transportInterface" | "sourceActorPrincipalId"
+    "clientOs" | "transportInterface" | "sourceActorPrincipalId" | "trustClass"
   >,
   childSkillName?: string,
 ): string | undefined {
   const tools = manifest.tools.filter((tool) =>
     supportsClientOsForSkillTool(tool.supported_client_os, tool.name, {
+      trustClass: context.trustClass,
       clientOs: context.clientOs,
       transportInterface: context.transportInterface,
       sourceActorPrincipalId: context.sourceActorPrincipalId,

package/src/tools/skills/sandbox-runner.ts

@@ -3,13 +3,17 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
+import { PLUGIN_NAME_ENV } from "../../plugin-api/plugin-name-env.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import {
   buildShellInvocation,
+  buildShellSpawnFlags,
   terminateProcessTree,
+  watchShellProcessStart,
 } from "../../util/host-process.js";
 import { safeStringSlice } from "../../util/unicode.js";
+import { SHELL_DID_NOT_START_MESSAGE } from "../shared/shell-output.js";
 import { buildSanitizedEnv } from "../terminal/safe-env.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
@@ -71,6 +75,7 @@ export async function runSkillToolScriptSandbox(
     timeoutMs?: number;
     expectedSkillVersionHash?: string;
     skillDirHashResolver?: (skillDir: string) => string;
+    pluginOwner?: string;
   },
 ): Promise<ToolExecutionResult> {
   const scriptPath = resolve(join(skillDir, executorPath));
@@ -114,7 +119,9 @@ export async function runSkillToolScriptSandbox(
       "utf-8",
     );
 
-    return await spawnRunner(runDir, input, context, timeoutMs, executorPath);
+    return await spawnRunner(runDir, input, context, timeoutMs, executorPath, {
+      pluginOwner: options?.pluginOwner,
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return {
@@ -136,6 +143,7 @@ function spawnRunner(
   context: ToolContext,
   timeoutMs: number,
   executorPath: string,
+  pluginContext?: { pluginOwner?: string },
 ): Promise<ToolExecutionResult> {
   return new Promise<ToolExecutionResult>((resolve) => {
     const stdoutChunks: Buffer[] = [];
@@ -153,16 +161,20 @@ function spawnRunner(
       conversationId: context.conversationId,
     });
     env.__CONVERSATION_ID = context.conversationId;
-    // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+    // Secret binding for reveal-derived chat authority. See reveal-nonce.ts.
     env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
 
+    if (pluginContext?.pluginOwner) {
+      env[PLUGIN_NAME_ENV] = pluginContext.pluginOwner;
+    }
+
     const child = spawn(wrapped.command, wrapped.args, {
       cwd: runDir,
       env,
       stdio: ["ignore", "pipe", "pipe"],
-      detached: true,
-      windowsHide: true,
+      ...buildShellSpawnFlags(),
     });
+    const launch = watchShellProcessStart(child);
 
     const timer = setTimeout(() => {
       timedOut = true;
@@ -188,6 +200,14 @@ function spawnRunner(
       clearTimeout(timer);
       context.signal?.removeEventListener("abort", onAbort);
 
+      if (!launch.didStart()) {
+        resolve({
+          content: `Failed to spawn skill tool script "${executorPath}": ${SHELL_DID_NOT_START_MESSAGE}`,
+          isError: true,
+        });
+        return;
+      }
+
       if (timedOut) {
         resolve({
           content: `Skill tool script "${executorPath}" timed out after ${timeoutMs}ms`,

package/src/tools/skills/scaffold-managed.ts

@@ -134,7 +134,8 @@ function notifyBackgroundSkillUpdate(args: {
     sourceEventName: "activity.complete",
     dedupeKey: `skill-updated:${args.skillId}:${day}`,
     contextPayload: {
-      // `summary` feeds the copy composer; `title`/`body` are the home feed's
+      // `summary` feeds the copy composer and `title` is the headline both
+      // it and the home feed keep; `title`/`body` are also the feed's
       // fallback when no channel copy was rendered. Without them a fully
       // suppressed delivery (the intended shape for this signal: low urgency,
       // background, no interruption) leaves the feed writer with no summary

package/src/tools/skills/skill-script-runner.ts

@@ -24,6 +24,12 @@ export interface RunSkillToolScriptOptions {
    *  with `execution_target: host` (in-process); non-bundled skills are forced to
    *  execute in the sandbox. */
   bundled?: boolean;
+  /**
+   * Catalog owner id when this skill is plugin-resident. The sandbox runner
+   * sets VELLUM_PLUGIN_NAME so the child can resolve credentials under
+   * that plugin's service.
+   */
+  pluginOwner?: string;
 }
 
 /**
@@ -42,6 +48,7 @@ export async function runSkillToolScript(
       timeoutMs: options.timeoutMs,
       expectedSkillVersionHash: options.expectedSkillVersionHash,
       skillDirHashResolver: options.skillDirHashResolver,
+      pluginOwner: options.pluginOwner,
     });
   }
 

package/src/tools/skills/skill-tool-factory.ts

@@ -1,4 +1,7 @@
+import { join, resolve } from "node:path";
+
 import type { SkillToolEntry } from "../../config/skills.js";
+import { getBundledSkillsDir } from "../../config/skills.js";
 import { RiskLevel } from "../../permissions/types.js";
 import {
   coerceArrayShapes,
@@ -6,6 +9,7 @@ import {
   coerceStringNumbers,
   validateInputAgainstSchema,
 } from "../../skills/validate-input.js";
+import { computerUseExecutionTarget } from "../computer-use/target.js";
 import { withActivityProperty } from "../schema-transforms.js";
 import { bundledToolInputMisuseMessage } from "../shared/input-misuse.js";
 import { bundledToolInputRepairs } from "../shared/input-repairs.js";
@@ -32,13 +36,21 @@ export function createSkillTool(
   skillDir: string,
   versionHash: string,
   bundled?: boolean,
+  pluginOwner?: string,
 ): Tool {
+  const isComputerUse =
+    bundled &&
+    !pluginOwner &&
+    resolve(skillDir) === resolve(join(getBundledSkillsDir(), "computer-use"));
   return {
     name: entry.name,
     description: entry.description,
     category: entry.category,
     defaultRiskLevel: riskMap[entry.risk],
     executionTarget: entry.execution_target as ExecutionTarget,
+    ...(isComputerUse
+      ? { getExecutionTarget: computerUseExecutionTarget }
+      : {}),
     supportedClientOs: entry.supported_client_os,
 
     input_schema: entry.input_schema as object,
@@ -96,6 +108,7 @@ export function createSkillTool(
           target: entry.execution_target,
           expectedSkillVersionHash: versionHash,
           bundled,
+          pluginOwner,
         },
       );
     },
@@ -113,8 +126,9 @@ export function createSkillToolsFromManifest(
   skillDir: string,
   versionHash: string,
   bundled?: boolean,
+  pluginOwner?: string,
 ): Tool[] {
   return entries.map((entry) =>
-    createSkillTool(entry, skillDir, versionHash, bundled),
+    createSkillTool(entry, skillDir, versionHash, bundled, pluginOwner),
   );
 }

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -50,20 +50,31 @@ describe("safe-env Qdrant forwarding", () => {
   });
 });
 
+describe("safe-env plugin name stripping", () => {
+  test("does not forward a parent-supplied VELLUM_PLUGIN_NAME", () => {
+    expect(SAFE_ENV_VARS).not.toContain("VELLUM_PLUGIN_NAME");
+
+    const env = buildSanitizedEnv("linux", {
+      VELLUM_PLUGIN_NAME: "forged-plugin",
+    });
+    expect(env.VELLUM_PLUGIN_NAME).toBeUndefined();
+  });
+});
+
 describe("safe-env CES child forwarding", () => {
-  test("forwards CES HTTP credentials so sanitized children can resolve managed connections", () => {
+  test("forwards CES IPC discovery env and CES HTTP credentials", () => {
+    expect(SAFE_ENV_VARS).toContain("CES_BOOTSTRAP_SOCKET_DIR");
     expect(SAFE_ENV_VARS).toContain("CES_SERVICE_TOKEN");
     expect(SAFE_ENV_VARS).toContain("CES_CREDENTIAL_URL");
-    expect(SAFE_ENV_VARS).toContain("CES_LOCAL_SOCKET");
 
     const env = buildSanitizedEnv("linux", {
+      CES_BOOTSTRAP_SOCKET_DIR: "/run/ces-bootstrap",
       CES_SERVICE_TOKEN: "vault-bearer",
       CES_CREDENTIAL_URL: "http://127.0.0.1:8090",
-      CES_LOCAL_SOCKET: "/tmp/ces.sock",
     });
+    expect(env.CES_BOOTSTRAP_SOCKET_DIR).toBe("/run/ces-bootstrap");
     expect(env.CES_SERVICE_TOKEN).toBe("vault-bearer");
     expect(env.CES_CREDENTIAL_URL).toBe("http://127.0.0.1:8090");
-    expect(env.CES_LOCAL_SOCKET).toBe("/tmp/ces.sock");
   });
 });
 
@@ -111,6 +122,35 @@ describe("safe-env Windows forwarding", () => {
     }
   });
 
+  test("prepends the Windows assistant binary directory when it sits beside the runtime", () => {
+    const dir = mkdtempSync(join(tmpdir(), "win-assistant-"));
+    writeFileSync(join(dir, "assistant.exe"), "");
+    try {
+      const env = buildSanitizedEnv(
+        "win32",
+        { Path: "C:\\Windows\\System32" },
+        { execPath: join(dir, "vellum-daemon.exe") },
+      );
+      expect(env.PATH).toBe(`${dir};C:\\Windows\\System32`);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("does not invent a Windows assistant path when the sibling binary is absent", () => {
+    const dir = mkdtempSync(join(tmpdir(), "win-no-assistant-"));
+    try {
+      const env = buildSanitizedEnv(
+        "win32",
+        { Path: "C:\\Windows\\System32" },
+        { execPath: join(dir, "vellum-daemon.exe") },
+      );
+      expect(env.PATH).toBe("C:\\Windows\\System32");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("matches Windows environment names case-insensitively", () => {
     const windowsEnv = buildSanitizedEnv("win32", {
       Path: "C:\\Windows\\System32;C:\\Program Files\\Vellum",

package/src/tools/terminal/__tests__/sanitized-bash.test.ts

@@ -4,7 +4,6 @@ import { runSanitizedBash } from "../sanitized-bash.js";
 
 describe("runSanitizedBash", () => {
   const priorToken = process.env.CES_SERVICE_TOKEN;
-  const priorSocket = process.env.CES_LOCAL_SOCKET;
 
   afterEach(() => {
     if (priorToken == null) {
@@ -12,11 +11,6 @@ describe("runSanitizedBash", () => {
     } else {
       process.env.CES_SERVICE_TOKEN = priorToken;
     }
-    if (priorSocket == null) {
-      delete process.env.CES_LOCAL_SOCKET;
-    } else {
-      process.env.CES_LOCAL_SOCKET = priorSocket;
-    }
   });
 
   test("runs a command and returns stdout", async () => {
@@ -35,14 +29,6 @@ describe("runSanitizedBash", () => {
     expect(result.stdout.trim()).toBe("vault-bearer");
   });
 
-  test("forwards CES_LOCAL_SOCKET to the child", async () => {
-    process.env.CES_LOCAL_SOCKET = "/tmp/ces.sock";
-    const result = await runSanitizedBash("printenv CES_LOCAL_SOCKET", 5_000);
-    expect(result.error).toBeUndefined();
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout.trim()).toBe("/tmp/ces.sock");
-  });
-
   test("times out a hung command", async () => {
     const result = await runSanitizedBash("sleep 5", 200);
     expect(result.error).toBeUndefined();

package/src/tools/terminal/safe-env.ts

@@ -7,8 +7,12 @@
  */
 import { readdirSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 
-import { pathListDelimiter } from "@vellumai/environments/shell";
+import {
+  pathListDelimiter,
+  prependUniquePathEntries,
+} from "@vellumai/environments/shell";
 
 import { getGatewayInternalBaseUrl } from "../../config/env.js";
 import { getDataDir, getWorkspaceDir } from "../../util/platform.js";
@@ -55,34 +59,16 @@ export const SAFE_ENV_VARS = [
   "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
   "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
   "CES_MANAGED_MODE",
-  "CES_LOCAL_SOCKET",
-  // Child processes (bash, skill sandbox, scheduled scripts) run
-  // `assistant oauth request` in-process and resolve managed connections
-  // through CES HTTP (`getSecureKeyAsync` / platform client). They need
-  // both the credential URL and the service token. CES_LOCAL_SOCKET alone
-  // is not enough on managed pods: the socket is often absent or does not
-  // complete the lazy RPC path those children use, so a connected account
-  // looks disconnected from sanitized children while the daemon still
-  // reports healthy.
-  //
-  // To drop these later, children must resolve the same ACTIVE managed
-  // connections without inheriting a reusable vault bearer. That means
-  // CES RPC over CES_LOCAL_SOCKET works on managed pods (present,
-  // reachable, and sufficient for secure-key / platform-client reads), or
-  // a narrower grant protocol issues a one-shot provider token.
-  //
-  // Before removing them again, reproduce from a sanitized child on a
-  // platform-managed pod. After `buildSanitizedEnv()`,
-  // `assistant oauth request --provider <key> --json <provider-url>` must
-  // succeed for an ACTIVE connection and match a direct terminal
-  // invocation. Unit tests that only assert the vars are absent are not
-  // enough: also cover skill sandbox and scheduled-script children.
   "CES_CREDENTIAL_URL",
   "CES_SERVICE_TOKEN",
+  // Child processes (bash, skill sandbox, scheduled scripts) reach CES
+  // over IPC via `CES_BOOTSTRAP_SOCKET_DIR`. CES HTTP credentials are
+  // forwarded so children can fail over to CES HTTP while that transport
+  // still exists.
   // Per-instance port of the assistant-managed Qdrant sidecar, so skill and
   // bash-tool subprocesses that use the vector helpers (e.g. embed/search over
   // `@vellumai/plugin-api`) resolve the same local sidecar as the daemon
-  // (127.0.0.1:<port>). `QDRANT_URL` is intentionally excluded — it flips
+  // (127.0.0.1:<port>). `QDRANT_URL` is intentionally excluded: it flips
   // QdrantManager into external mode and bypasses the local managed lifecycle.
   "QDRANT_HTTP_PORT",
   "IS_CONTAINERIZED",
@@ -100,6 +86,10 @@ export const SAFE_ENV_VARS = [
   "VELLUM_MINIKUBE_STORAGE_SIZE",
   "VELLUM_BACKUP_DIR",
   "VELLUM_BACKUP_KEY_PATH",
+  // VELLUM_PLUGIN_NAME is intentionally absent. The daemon injects the
+  // owning plugin install name after sanitizing the child environment.
+  // Inheriting a parent-supplied value would let an arbitrary process
+  // claim another plugin's credential scope.
 ] as const;
 
 export const WINDOWS_SAFE_ENV_VARS = [
@@ -284,6 +274,7 @@ function appendUniquePathEntries(
 export function buildSanitizedEnv(
   hostPlatform: NodeJS.Platform = process.platform,
   sourceEnv: NodeJS.ProcessEnv = process.env,
+  options?: { execPath?: string },
 ): Record<string, string> {
   const env: Record<string, string> = {};
   const isKataRuntime = isKataFamilyRuntime(sourceEnv.VELLUM_SANDBOX_RUNTIME);
@@ -360,5 +351,29 @@ export function buildSanitizedEnv(
   if (!env.LC_ALL) {
     env.LC_ALL = utf8Locale;
   }
+  prependWindowsAssistantDir(
+    env,
+    hostPlatform,
+    options?.execPath ?? process.execPath,
+  );
   return env;
 }
+
+function prependWindowsAssistantDir(
+  env: Record<string, string>,
+  hostPlatform: NodeJS.Platform,
+  execPath: string,
+): void {
+  if (hostPlatform !== "win32") {
+    return;
+  }
+  const execDir = dirname(execPath);
+  try {
+    if (!statSync(join(execDir, "assistant.exe")).isFile()) {
+      return;
+    }
+  } catch {
+    return;
+  }
+  env.PATH = prependUniquePathEntries(env.PATH, [execDir], hostPlatform);
+}

package/src/tools/terminal/sanitized-bash.ts

@@ -11,9 +11,12 @@ import { spawn } from "node:child_process";
 
 import {
   buildShellInvocation,
+  buildShellSpawnFlags,
   terminateProcessTree,
+  watchShellProcessStart,
 } from "../../util/host-process.js";
 import { getWorkspaceDir } from "../../util/platform.js";
+import { SHELL_DID_NOT_START_MESSAGE } from "../shared/shell-output.js";
 import { buildSanitizedEnv } from "./safe-env.js";
 
 export const DEFAULT_SANITIZED_BASH_TIMEOUT_MS = 30_000;
@@ -63,10 +66,10 @@ export function runSanitizedBash(
     const child = spawn(wrapped.command, wrapped.args, {
       cwd: getWorkspaceDir(),
       stdio: ["ignore", "pipe", "pipe"],
-      detached: true,
       env: buildSanitizedEnv(),
-      windowsHide: true,
+      ...buildShellSpawnFlags(),
     });
+    const launch = watchShellProcessStart(child);
 
     const timer = setTimeout(() => {
       timedOut = true;
@@ -83,6 +86,16 @@ export function runSanitizedBash(
 
     child.on("close", (code) => {
       clearTimeout(timer);
+      if (!launch.didStart()) {
+        finish({
+          stdout: "",
+          stderr: "",
+          exitCode: null,
+          timedOut: false,
+          error: SHELL_DID_NOT_START_MESSAGE,
+        });
+        return;
+      }
       finish({
         stdout: Buffer.concat(stdoutChunks).toString(),
         stderr: Buffer.concat(stderrChunks).toString(),

package/src/tools/terminal/shell-launch.test.ts

@@ -0,0 +1,162 @@
+import * as realChildProcess from "node:child_process";
+import { EventEmitter } from "node:events";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { setConfig } from "../../__tests__/helpers/set-config.js";
+import { SHELL_DID_NOT_START_MESSAGE } from "../shared/shell-output.js";
+import type { ToolContext } from "../types.js";
+
+const originalSpawn = realChildProcess.spawn;
+
+type FakeChild = EventEmitter & {
+  pid?: number;
+  stdout: EventEmitter;
+  stderr: EventEmitter;
+  kill: () => boolean;
+};
+
+type SpawnImpl = (
+  ...args: Parameters<typeof realChildProcess.spawn>
+) => ReturnType<typeof realChildProcess.spawn>;
+
+const spawnCalls: {
+  command: string;
+  args: unknown;
+  options: realChildProcess.SpawnOptions;
+}[] = [];
+
+let spawnImpl: SpawnImpl = originalSpawn as SpawnImpl;
+
+const spawnSpy = mock((...args: Parameters<typeof realChildProcess.spawn>) => {
+  spawnCalls.push({
+    command: args[0] as string,
+    args: args[1],
+    options: (args[2] ?? {}) as realChildProcess.SpawnOptions,
+  });
+  return spawnImpl(...args);
+});
+
+mock.module("node:child_process", () => ({
+  ...realChildProcess,
+  spawn: spawnSpy,
+}));
+
+const realLogger = await import("../../util/logger.js");
+mock.module("../../util/logger.js", () => ({
+  ...realLogger,
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+setConfig("timeouts", { shellDefaultTimeoutSec: 30, shellMaxTimeoutSec: 60 });
+
+const realHub = await import("../../runtime/assistant-event-hub.js");
+mock.module("../../runtime/assistant-event-hub.js", () => ({
+  ...realHub,
+  broadcastMessage: () => {},
+}));
+
+const realWake = await import("../../runtime/agent-wake.js");
+mock.module("../../runtime/agent-wake.js", () => ({
+  ...realWake,
+  wakeAgentForOpportunity: async () => ({}),
+}));
+
+const { shellTool } = await import("./shell.js");
+
+function makeContext(workingDir: string): ToolContext {
+  return {
+    workingDir,
+    conversationId: "conv-xyz",
+    trustClass: "guardian",
+  };
+}
+
+function fakeChild(): FakeChild {
+  const child = new EventEmitter() as FakeChild;
+  child.stdout = new EventEmitter();
+  child.stderr = new EventEmitter();
+  child.kill = () => true;
+  return child;
+}
+
+function closeWithoutStart(): ReturnType<typeof realChildProcess.spawn> {
+  const child = fakeChild();
+  queueMicrotask(() => {
+    child.emit("close", 0, null);
+  });
+  return child as unknown as ReturnType<typeof realChildProcess.spawn>;
+}
+
+function spawnError(
+  err: NodeJS.ErrnoException,
+): ReturnType<typeof realChildProcess.spawn> {
+  const child = fakeChild();
+  queueMicrotask(() => {
+    child.emit("error", err);
+  });
+  return child as unknown as ReturnType<typeof realChildProcess.spawn>;
+}
+
+describe("bash launch failures are not success", () => {
+  let workingDir = "";
+
+  beforeEach(() => {
+    spawnCalls.length = 0;
+    spawnImpl = originalSpawn as SpawnImpl;
+    workingDir = mkdtempSync(join(tmpdir(), "bash-launch-"));
+  });
+
+  afterEach(() => {
+    spawnImpl = originalSpawn as SpawnImpl;
+    rmSync(workingDir, { recursive: true, force: true });
+  });
+
+  test("a close with exit 0 and no process start is an error, not command_completed", async () => {
+    spawnImpl = () => closeWithoutStart();
+    const proof = join(workingDir, "proof.txt");
+
+    const result = await shellTool.execute(
+      {
+        command: "printf ran > proof.txt",
+        activity: "test",
+      },
+      makeContext(workingDir),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toBe(SHELL_DID_NOT_START_MESSAGE);
+    expect(result.content).not.toContain("<command_completed />");
+    expect(existsSync(proof)).toBe(false);
+    expect(spawnCalls).toHaveLength(1);
+  });
+
+  test("a failed spawn of the shell is an error", async () => {
+    spawnImpl = () => {
+      const err = new Error(
+        "spawn powershell.exe ENOENT",
+      ) as NodeJS.ErrnoException;
+      err.code = "ENOENT";
+      return spawnError(err);
+    };
+
+    const result = await shellTool.execute(
+      {
+        command: "assistant browser --help",
+        activity: "test",
+      },
+      makeContext(workingDir),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("Error spawning command");
+    expect(result.content).toContain("The command was not found");
+    expect(result.content).not.toContain("<command_completed />");
+    expect(existsSync(join(workingDir, "help.txt"))).toBe(false);
+  });
+});

package/src/tools/terminal/shell.test.ts

@@ -7,6 +7,7 @@ import { setConfig } from "../../__tests__/helpers/set-config.js";
 import {
   MAX_OUTPUT_LENGTH,
   OUTPUT_TRUNCATED_TAG,
+  SHELL_DID_NOT_START_MESSAGE,
 } from "../shared/shell-output.js";
 import type { ToolContext } from "../types.js";
 
@@ -207,6 +208,34 @@ describe("foreground stdin handling", () => {
   });
 });
 
+describe("foreground command execution", () => {
+  let tmpDir = "";
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(join(tmpdir(), "bash-exec-"));
+  });
+
+  afterEach(async () => {
+    if (tmpDir) {
+      await rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  test("a command that writes a file must actually create it", async () => {
+    const result = await shellTool.execute(
+      {
+        command: "printf ran > proof.txt",
+        activity: "test",
+      },
+      { ...makeContext(), workingDir: tmpDir },
+    );
+
+    expect(result.isError).toBeFalsy();
+    expect(result.content).not.toBe(SHELL_DID_NOT_START_MESSAGE);
+    expect(await readFile(join(tmpDir, "proof.txt"), "utf-8")).toBe("ran");
+  });
+});
+
 describe("streaming stdout cap", () => {
   let tmpDir = "";