@vellumai/assistant 0.12.4-dev.202609232017.d454a3d → 0.12.4-dev.202609232115.73e8b74

package/docs/architecture/memory.md

@@ -214,7 +214,15 @@ static substrate context remain available. When the answer depends on a saved pe
 fact that is absent from that context, the front-door rule escalates instead of
 guessing.
 
-The escalated leg runs the ordinary memory pipeline before the quality model.
+The escalated leg normally runs the memory pipeline before the quality model.
+During screen sharing, the front door can emit `[ESCALATE_SCREEN]` for an
+annotation or immediate on-screen action answerable from the screen and
+current conversation. The bridge skips fresh retrieval only when that verdict
+and an active screen share are both present. This per-turn policy gates the
+legacy hook and both v3 injectors, including re-injection, and clears at turn
+release. Static context and historical memory blocks remain available.
+Requests needing saved facts or preferences absent from context, uncertain
+classifications, and ordinary `[ESCALATE]` verdicts retain retrieval.
 V3 retrieval routes on the latest visible caller message, ignoring the hidden
 continuation message used to start that leg. The selector uses low effort to
 keep retrieval latency bounded. This keeps current-turn memory work off the

package/docs/architecture/scheduling.md

@@ -2,6 +2,12 @@
 
 Recurring schedules, watchers, and queued task execution architecture.
 
+## Execute-mode completion and time limits
+
+An execute-mode run owns its automatic result notification, including results from background commands and subagents. The scheduler waits for the firing's own active turns, queued continuations, commands, child tasks, and command wakes to settle before marking the run successful and emitting `schedule.result`. Unrelated work in a reused conversation does not extend the wait. Ownership is recorded before asynchronous turn setup, covers dequeued messages while their processing claim and persistence are pending, and follows wakes through queueing, hydration, and execution. Dequeued dispatches retain a cancellation signal for teardown until the active turn takes over. User interrupts preserve accepted user prompts during that handoff; started turns remain cancellable. Background work retains its original timing through queueing, dispatch, active processing, and command wakes. The reply-notification gate and persisted-history check apply that timing to suppress stale kickoff alerts without hiding replies to newer user requests. Quiet runs skip this fallback, and explicit successful delivery suppresses duplicates.
+
+The wait shares the run's `timeouts.scheduleTurnTimeoutSec` budget. If delegated work exceeds that budget, the scheduler records an error, cancels only commands, child tasks, queued continuations, and the active turn owned by that run. User work and other runs in the same conversation remain intact. The attempt follows the existing retry and exhaustion-alert policy; partial output never emits a success notification. Scheduled command wakes carry `cronRunId`, check the persisted run status before starting, and observe cancellation while running, so a late callback cannot restart a failed attempt.
+
 ## Recurrence Schedules — Cron and RRULE Dual-Syntax Engine
 
 The scheduler supports two recurrence syntaxes for recurring tasks:
@@ -88,11 +94,13 @@ sequenceDiagram
 
 The `enforceRoutingIntent()` step runs after the LLM produces a channel selection but before deterministic checks. It acts as a post-decision guard:
 
-| Intent           | Enforcement Rule                                                                                  |
-| ---------------- | ------------------------------------------------------------------------------------------------- |
-| `single_channel` | No override. The LLM's channel selection stands.                                                  |
-| `multi_channel`  | If the LLM selected < 2 channels and 2+ are connected, expand to at least two connected channels. |
-| `all_channels`   | Replace the LLM's selection with all connected channels.                                          |
+| Intent           | Enforcement Rule                                                                                                             |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| `single_channel` | Cap delivery to one channel: the signal's source channel when it is connected, otherwise the first channel the LLM selected. |
+| `multi_channel`  | If the LLM selected < 2 channels and 2+ are connected, expand to at least two connected channels.                            |
+| `all_channels`   | Replace the LLM's selection with all connected channels.                                                                     |
+
+A decision the LLM suppressed (`shouldNotify: false`) is left alone under every intent. A signal with no routing intent keeps the LLM's selection.
 
 When enforcement changes the decision, the updated `selectedChannels` and annotated `reasoningSummary` are re-persisted to `notification_decisions` so the audit trail reflects what was actually dispatched.
 

package/docs/guardian-request-flow.md

@@ -24,7 +24,7 @@ anti-pattern was retired in #35642 and again in the ask_question redesign).
   (generic actions[] + plainTextFallback)         resolveQuestionContext)
         │
         ▼ per-channel rendering ONLY
-  channel adapters                               (notifications/adapters/{telegram,slack,macos,platform},
+  channel adapters                               (notifications/adapters/{telegram,slack,discord,macos,platform},
   telegram: inline keyboard; slack: blocks;       vellum: conversation card via approval-card-builder)
   card deliveries recorded per channel            (guardian-delivery-recorder.ts → guardian_request_deliveries)
         │

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/guardian-requests.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  GUARDIAN_DECISION_ACTION_IDS,
+  isDenyingGuardianAction,
+  isParkGuardianAction,
+} from "../guardian-requests.js";
+
+describe("guardian decision actions", () => {
+  test("reject, leave_unverified and block deny; every other action approves", () => {
+    const denying = GUARDIAN_DECISION_ACTION_IDS.filter(
+      isDenyingGuardianAction,
+    );
+    expect(denying).toEqual(["reject", "leave_unverified", "block"]);
+  });
+
+  test("only leave_unverified parks the sender", () => {
+    const parking = GUARDIAN_DECISION_ACTION_IDS.filter(isParkGuardianAction);
+    expect(parking).toEqual(["leave_unverified"]);
+  });
+
+  test("an absent or unknown action neither denies nor parks", () => {
+    expect(isDenyingGuardianAction(undefined)).toBe(false);
+    expect(isParkGuardianAction("approve_always")).toBe(false);
+  });
+});

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/guardian-requests.ts

@@ -1,7 +1,8 @@
 /**
- * Canonical vocabulary for a guardian request's lifecycle status, shared by
- * the gateway that owns the request rows, the daemon that decides and
- * projects them, and the web that renders the projection.
+ * Canonical vocabulary for guardian requests, shared by the gateway that owns
+ * the request rows, the daemon that decides and projects them, and the web
+ * that renders the projection: a request's lifecycle status, the actions a
+ * guardian can decide it with, and the weight a card gives each action.
  */
 import { z } from "zod";
 
@@ -16,3 +17,76 @@ export const GuardianRequestStatusSchema = z.enum(
   GUARDIAN_REQUEST_STATUS_VALUES,
 );
 export type GuardianRequestStatus = z.infer<typeof GuardianRequestStatusSchema>;
+
+/**
+ * The actions a guardian can decide a request with.
+ *
+ * `approve_once` / `reject` are the generic decision pair used by every
+ * request kind. `trust` / `verify_code` / `leave_unverified` / `block` are the
+ * introduction-card actions, valid only for `access_request` requests.
+ */
+export const GUARDIAN_DECISION_ACTION_IDS = [
+  "approve_once",
+  "reject",
+  "trust",
+  "verify_code",
+  "leave_unverified",
+  "block",
+] as const;
+export const GuardianDecisionActionIdSchema = z.enum(
+  GUARDIAN_DECISION_ACTION_IDS,
+);
+export type GuardianDecisionActionId = z.infer<
+  typeof GuardianDecisionActionIdSchema
+>;
+
+/** Actions that resolve a request to `denied`; every other one approves. */
+export const GUARDIAN_DENYING_ACTION_VALUES = [
+  "reject",
+  "leave_unverified",
+  "block",
+] as const satisfies readonly GuardianDecisionActionId[];
+
+/**
+ * The denying actions that park the sender at `unverified`: a neutral hold,
+ * not a rejection. A parked contact is still admitted under the permissive
+ * admission floors (`any_contact`, `strangers`) and can be trusted or verified
+ * later; contrast `block` (revoked, a hard keep-out) and `reject` (an explicit
+ * decline). All three resolve the request to `denied`, so a resolved card
+ * consults this to read a park neutrally rather than as a denial.
+ */
+export const GUARDIAN_PARK_ACTION_VALUES = [
+  "leave_unverified",
+] as const satisfies readonly GuardianDecisionActionId[];
+
+const DENYING_ACTIONS: ReadonlySet<string> = new Set(
+  GUARDIAN_DENYING_ACTION_VALUES,
+);
+const PARK_ACTIONS: ReadonlySet<string> = new Set(GUARDIAN_PARK_ACTION_VALUES);
+
+/** True when `action` resolves a request to `denied`. */
+export function isDenyingGuardianAction(action: string | undefined): boolean {
+  return action !== undefined && DENYING_ACTIONS.has(action);
+}
+
+/** True when `action` parks the sender at `unverified`. */
+export function isParkGuardianAction(action: string | undefined): boolean {
+  return action !== undefined && PARK_ACTIONS.has(action);
+}
+
+/**
+ * Surface-agnostic weight of a card action. Each renderer translates it to
+ * its own token (Slack primary/danger, a web button variant); absent means the
+ * renderer's default.
+ */
+export const GUARDIAN_ACTION_EMPHASIS_VALUES = [
+  "primary",
+  "secondary",
+  "destructive",
+] as const;
+export const GuardianActionEmphasisSchema = z.enum(
+  GUARDIAN_ACTION_EMPHASIS_VALUES,
+);
+export type GuardianActionEmphasis = z.infer<
+  typeof GuardianActionEmphasisSchema
+>;

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/guardian-requests.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  GUARDIAN_DECISION_ACTION_IDS,
+  isDenyingGuardianAction,
+  isParkGuardianAction,
+} from "../guardian-requests.js";
+
+describe("guardian decision actions", () => {
+  test("reject, leave_unverified and block deny; every other action approves", () => {
+    const denying = GUARDIAN_DECISION_ACTION_IDS.filter(
+      isDenyingGuardianAction,
+    );
+    expect(denying).toEqual(["reject", "leave_unverified", "block"]);
+  });
+
+  test("only leave_unverified parks the sender", () => {
+    const parking = GUARDIAN_DECISION_ACTION_IDS.filter(isParkGuardianAction);
+    expect(parking).toEqual(["leave_unverified"]);
+  });
+
+  test("an absent or unknown action neither denies nor parks", () => {
+    expect(isDenyingGuardianAction(undefined)).toBe(false);
+    expect(isParkGuardianAction("approve_always")).toBe(false);
+  });
+});

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/guardian-requests.ts

@@ -1,7 +1,8 @@
 /**
- * Canonical vocabulary for a guardian request's lifecycle status, shared by
- * the gateway that owns the request rows, the daemon that decides and
- * projects them, and the web that renders the projection.
+ * Canonical vocabulary for guardian requests, shared by the gateway that owns
+ * the request rows, the daemon that decides and projects them, and the web
+ * that renders the projection: a request's lifecycle status, the actions a
+ * guardian can decide it with, and the weight a card gives each action.
  */
 import { z } from "zod";
 
@@ -16,3 +17,76 @@ export const GuardianRequestStatusSchema = z.enum(
   GUARDIAN_REQUEST_STATUS_VALUES,
 );
 export type GuardianRequestStatus = z.infer<typeof GuardianRequestStatusSchema>;
+
+/**
+ * The actions a guardian can decide a request with.
+ *
+ * `approve_once` / `reject` are the generic decision pair used by every
+ * request kind. `trust` / `verify_code` / `leave_unverified` / `block` are the
+ * introduction-card actions, valid only for `access_request` requests.
+ */
+export const GUARDIAN_DECISION_ACTION_IDS = [
+  "approve_once",
+  "reject",
+  "trust",
+  "verify_code",
+  "leave_unverified",
+  "block",
+] as const;
+export const GuardianDecisionActionIdSchema = z.enum(
+  GUARDIAN_DECISION_ACTION_IDS,
+);
+export type GuardianDecisionActionId = z.infer<
+  typeof GuardianDecisionActionIdSchema
+>;
+
+/** Actions that resolve a request to `denied`; every other one approves. */
+export const GUARDIAN_DENYING_ACTION_VALUES = [
+  "reject",
+  "leave_unverified",
+  "block",
+] as const satisfies readonly GuardianDecisionActionId[];
+
+/**
+ * The denying actions that park the sender at `unverified`: a neutral hold,
+ * not a rejection. A parked contact is still admitted under the permissive
+ * admission floors (`any_contact`, `strangers`) and can be trusted or verified
+ * later; contrast `block` (revoked, a hard keep-out) and `reject` (an explicit
+ * decline). All three resolve the request to `denied`, so a resolved card
+ * consults this to read a park neutrally rather than as a denial.
+ */
+export const GUARDIAN_PARK_ACTION_VALUES = [
+  "leave_unverified",
+] as const satisfies readonly GuardianDecisionActionId[];
+
+const DENYING_ACTIONS: ReadonlySet<string> = new Set(
+  GUARDIAN_DENYING_ACTION_VALUES,
+);
+const PARK_ACTIONS: ReadonlySet<string> = new Set(GUARDIAN_PARK_ACTION_VALUES);
+
+/** True when `action` resolves a request to `denied`. */
+export function isDenyingGuardianAction(action: string | undefined): boolean {
+  return action !== undefined && DENYING_ACTIONS.has(action);
+}
+
+/** True when `action` parks the sender at `unverified`. */
+export function isParkGuardianAction(action: string | undefined): boolean {
+  return action !== undefined && PARK_ACTIONS.has(action);
+}
+
+/**
+ * Surface-agnostic weight of a card action. Each renderer translates it to
+ * its own token (Slack primary/danger, a web button variant); absent means the
+ * renderer's default.
+ */
+export const GUARDIAN_ACTION_EMPHASIS_VALUES = [
+  "primary",
+  "secondary",
+  "destructive",
+] as const;
+export const GuardianActionEmphasisSchema = z.enum(
+  GUARDIAN_ACTION_EMPHASIS_VALUES,
+);
+export type GuardianActionEmphasis = z.infer<
+  typeof GuardianActionEmphasisSchema
+>;

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -15,6 +15,7 @@
  */
 
 import type { KnownBlock } from "@slack/types";
+import { GuardianActionEmphasisSchema } from "@vellumai/service-contracts/guardian-requests";
 import { z } from "zod";
 
 // ---------------------------------------------------------------------------
@@ -41,10 +42,7 @@ export type AttachmentMetadata = z.infer<typeof AttachmentMetadataSchema>;
 export const ApprovalActionOptionSchema = z.object({
   id: z.string(),
   label: z.string(),
-  // Surface-agnostic button weight. Renderers translate it to their platform
-  // token (Slack primary/danger, Surface primary/destructive); absent means
-  // the renderer applies its own default styling.
-  emphasis: z.enum(["primary", "secondary", "destructive"]).optional(),
+  emphasis: GuardianActionEmphasisSchema.optional(),
 });
 
 export type ApprovalActionOption = z.infer<typeof ApprovalActionOptionSchema>;

package/node_modules/@vellumai/service-contracts/src/__tests__/guardian-requests.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  GUARDIAN_DECISION_ACTION_IDS,
+  isDenyingGuardianAction,
+  isParkGuardianAction,
+} from "../guardian-requests.js";
+
+describe("guardian decision actions", () => {
+  test("reject, leave_unverified and block deny; every other action approves", () => {
+    const denying = GUARDIAN_DECISION_ACTION_IDS.filter(
+      isDenyingGuardianAction,
+    );
+    expect(denying).toEqual(["reject", "leave_unverified", "block"]);
+  });
+
+  test("only leave_unverified parks the sender", () => {
+    const parking = GUARDIAN_DECISION_ACTION_IDS.filter(isParkGuardianAction);
+    expect(parking).toEqual(["leave_unverified"]);
+  });
+
+  test("an absent or unknown action neither denies nor parks", () => {
+    expect(isDenyingGuardianAction(undefined)).toBe(false);
+    expect(isParkGuardianAction("approve_always")).toBe(false);
+  });
+});

package/node_modules/@vellumai/service-contracts/src/guardian-requests.ts

@@ -1,7 +1,8 @@
 /**
- * Canonical vocabulary for a guardian request's lifecycle status, shared by
- * the gateway that owns the request rows, the daemon that decides and
- * projects them, and the web that renders the projection.
+ * Canonical vocabulary for guardian requests, shared by the gateway that owns
+ * the request rows, the daemon that decides and projects them, and the web
+ * that renders the projection: a request's lifecycle status, the actions a
+ * guardian can decide it with, and the weight a card gives each action.
  */
 import { z } from "zod";
 
@@ -16,3 +17,76 @@ export const GuardianRequestStatusSchema = z.enum(
   GUARDIAN_REQUEST_STATUS_VALUES,
 );
 export type GuardianRequestStatus = z.infer<typeof GuardianRequestStatusSchema>;
+
+/**
+ * The actions a guardian can decide a request with.
+ *
+ * `approve_once` / `reject` are the generic decision pair used by every
+ * request kind. `trust` / `verify_code` / `leave_unverified` / `block` are the
+ * introduction-card actions, valid only for `access_request` requests.
+ */
+export const GUARDIAN_DECISION_ACTION_IDS = [
+  "approve_once",
+  "reject",
+  "trust",
+  "verify_code",
+  "leave_unverified",
+  "block",
+] as const;
+export const GuardianDecisionActionIdSchema = z.enum(
+  GUARDIAN_DECISION_ACTION_IDS,
+);
+export type GuardianDecisionActionId = z.infer<
+  typeof GuardianDecisionActionIdSchema
+>;
+
+/** Actions that resolve a request to `denied`; every other one approves. */
+export const GUARDIAN_DENYING_ACTION_VALUES = [
+  "reject",
+  "leave_unverified",
+  "block",
+] as const satisfies readonly GuardianDecisionActionId[];
+
+/**
+ * The denying actions that park the sender at `unverified`: a neutral hold,
+ * not a rejection. A parked contact is still admitted under the permissive
+ * admission floors (`any_contact`, `strangers`) and can be trusted or verified
+ * later; contrast `block` (revoked, a hard keep-out) and `reject` (an explicit
+ * decline). All three resolve the request to `denied`, so a resolved card
+ * consults this to read a park neutrally rather than as a denial.
+ */
+export const GUARDIAN_PARK_ACTION_VALUES = [
+  "leave_unverified",
+] as const satisfies readonly GuardianDecisionActionId[];
+
+const DENYING_ACTIONS: ReadonlySet<string> = new Set(
+  GUARDIAN_DENYING_ACTION_VALUES,
+);
+const PARK_ACTIONS: ReadonlySet<string> = new Set(GUARDIAN_PARK_ACTION_VALUES);
+
+/** True when `action` resolves a request to `denied`. */
+export function isDenyingGuardianAction(action: string | undefined): boolean {
+  return action !== undefined && DENYING_ACTIONS.has(action);
+}
+
+/** True when `action` parks the sender at `unverified`. */
+export function isParkGuardianAction(action: string | undefined): boolean {
+  return action !== undefined && PARK_ACTIONS.has(action);
+}
+
+/**
+ * Surface-agnostic weight of a card action. Each renderer translates it to
+ * its own token (Slack primary/danger, a web button variant); absent means the
+ * renderer's default.
+ */
+export const GUARDIAN_ACTION_EMPHASIS_VALUES = [
+  "primary",
+  "secondary",
+  "destructive",
+] as const;
+export const GuardianActionEmphasisSchema = z.enum(
+  GUARDIAN_ACTION_EMPHASIS_VALUES,
+);
+export type GuardianActionEmphasis = z.infer<
+  typeof GuardianActionEmphasisSchema
+>;

package/openapi.yaml

@@ -14106,7 +14106,7 @@ paths:
     post:
       operationId: guardianactions_decision_post
       summary: Submit guardian decision
-      description: Submit a guardian action decision (approve/reject).
+      description: Submit a guardian decision on a pending request.
       tags:
         - guardian
       requestBody:
@@ -14118,9 +14118,17 @@ paths:
               properties:
                 requestId:
                   type: string
+                  minLength: 1
                   description: Guardian request ID
                 action:
                   type: string
+                  enum:
+                    - approve_once
+                    - reject
+                    - trust
+                    - verify_code
+                    - leave_unverified
+                    - block
                   description: Decision action
                 conversationId:
                   type: string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.4-dev.202609232017.d454a3d",
+  "version": "0.12.4-dev.202609232115.73e8b74",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/background-shell-bash.test.ts

@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { WakeOptions } from "../runtime/agent-wake.js";
 import type { BackgroundTool } from "../tools/background-tool-registry.js";
+import type { ToolContext } from "../tools/types.js";
 
 // ── Mock modules ────────────────────────────────────────────────────────────
 
@@ -239,4 +240,37 @@ describe("bash tool background mode", () => {
     expect(mockRegisterBackgroundTool).not.toHaveBeenCalled();
     expect(mockWakeAgentForOpportunity).not.toHaveBeenCalled();
   });
+
+  for (const cronRunId of [undefined, null, "cron-run-123"]) {
+    for (const outcome of ["completed", "failed", "cancelled"] as const) {
+      test(`preserves originating schedule ${String(cronRunId)} on ${outcome}`, async () => {
+        const context: ToolContext = {
+          ...baseContext,
+          cronRunId,
+        };
+        await shellTool.execute(
+          {
+            command:
+              outcome === "cancelled"
+                ? "sleep 30"
+                : `sleep 0.1; exit ${outcome === "failed" ? "1" : "0"}`,
+            activity: "test",
+            background: true,
+          },
+          context,
+        );
+        context.cronRunId = "cron-run-later";
+        expect(registeredTools[0]!.cronRunId).toBe(cronRunId ?? undefined);
+        if (outcome === "cancelled") {
+          registeredTools[0]!.cancel();
+        }
+        await waitForWake(mockWakeAgentForOpportunity);
+
+        expect(mockWakeAgentForOpportunity).toHaveBeenCalledTimes(1);
+        const wake = mockWakeAgentForOpportunity.mock.calls[0]![0];
+        expect(wake.cronRunId).toBe(cronRunId ?? undefined);
+        expect(wake.backgroundToolCompletion?.status).toBe(outcome);
+      });
+    }
+  }
 });

package/src/__tests__/background-shell-host-bash.test.ts

@@ -84,7 +84,11 @@ mock.module("../daemon/host-bash-proxy.js", () => ({
 // Import under test — MUST come after mock.module calls.
 // ---------------------------------------------------------------------------
 
-import type { CompletedBackgroundTool } from "../tools/background-tool-registry.js";
+import type { WakeOptions } from "../runtime/agent-wake.js";
+import type {
+  BackgroundTool,
+  CompletedBackgroundTool,
+} from "../tools/background-tool-registry.js";
 import { hostShellTool } from "../tools/host-terminal/host-shell.js";
 import type { ToolContext, ToolExecutionResult } from "../tools/types.js";
 
@@ -148,6 +152,56 @@ afterEach(() => {
 // ---------------------------------------------------------------------------
 
 describe("host_bash background mode — proxy path", () => {
+  for (const cronRunId of [undefined, null, "cron-run-123"]) {
+    for (const outcome of [
+      "completed",
+      "failed",
+      "rejected",
+      "cancelled",
+      "cancelled-rejection",
+    ] as const) {
+      test(`preserves originating schedule ${String(cronRunId)} on ${outcome}`, async () => {
+        mockProxyAvailable = true;
+        const result = Promise.withResolvers<ToolExecutionResult>();
+        mockProxyRequestImpl = () => result.promise;
+        const context = makeContext({ cronRunId });
+
+        await hostShellTool.execute(
+          { command: "echo bg-proxy", background: true },
+          context,
+        );
+        context.cronRunId = "cron-run-later";
+        const ownedCommand = (
+          mockRegisterBackgroundTool.mock.calls as unknown[][]
+        )[0]![0] as BackgroundTool;
+        expect(ownedCommand.cronRunId).toBe(cronRunId ?? undefined);
+        const cancelled =
+          outcome === "cancelled" || outcome === "cancelled-rejection";
+        if (cancelled) {
+          const registered = (
+            mockRegisterBackgroundTool.mock.calls as unknown[][]
+          )[0]![0] as BackgroundTool;
+          registered.cancel();
+        }
+        if (outcome === "rejected" || outcome === "cancelled-rejection") {
+          result.reject(new Error("proxy transport error"));
+        } else {
+          result.resolve({ content: "done", isError: outcome === "failed" });
+        }
+        await new Promise((resolve) => setTimeout(resolve, 10));
+
+        expect(mockWakeAgentForOpportunity).toHaveBeenCalledTimes(1);
+        const wake = (
+          mockWakeAgentForOpportunity.mock.calls as unknown[][]
+        )[0]![0] as WakeOptions;
+        expect(wake.cronRunId).toBe(cronRunId ?? undefined);
+        expect(wake.backgroundToolCompletion?.status).toBe(
+          cancelled ? "cancelled" : outcome === "rejected" ? "failed" : outcome,
+        );
+      });
+    }
+  }
+
   test("returns immediately with backgrounded response", async () => {
     const proxyResult: ToolExecutionResult = {
       content: "proxy output",
@@ -311,6 +365,49 @@ describe("host_bash background mode — proxy path", () => {
 // ---------------------------------------------------------------------------
 
 describe("host_bash background mode — direct execution path", () => {
+  for (const cronRunId of [undefined, null, "cron-run-123"]) {
+    for (const outcome of [
+      "completed",
+      "failed",
+      "spawn-error",
+      "cancelled",
+    ] as const) {
+      test(`preserves originating schedule ${String(cronRunId)} on ${outcome}`, async () => {
+        const context = makeContext({ cronRunId });
+        await hostShellTool.execute(
+          { command: "echo bg-local", background: true },
+          context,
+        );
+        context.cronRunId = "cron-run-later";
+        const ownedCommand = (
+          mockRegisterBackgroundTool.mock.calls as unknown[][]
+        )[0]![0] as BackgroundTool;
+        expect(ownedCommand.cronRunId).toBe(cronRunId ?? undefined);
+        if (outcome === "cancelled") {
+          const registered = (
+            mockRegisterBackgroundTool.mock.calls as unknown[][]
+          )[0]![0] as BackgroundTool;
+          registered.cancel();
+        }
+        if (outcome === "spawn-error") {
+          latestChild!.emit("error", new Error("spawn ENOENT"));
+          latestChild!.emit("close", null);
+        } else {
+          latestChild!.emit("close", outcome === "failed" ? 1 : 0);
+        }
+
+        expect(mockWakeAgentForOpportunity).toHaveBeenCalledTimes(1);
+        const wake = (
+          mockWakeAgentForOpportunity.mock.calls as unknown[][]
+        )[0]![0] as WakeOptions;
+        expect(wake.cronRunId).toBe(cronRunId ?? undefined);
+        expect(wake.backgroundToolCompletion?.status).toBe(
+          outcome === "spawn-error" ? "failed" : outcome,
+        );
+      });
+    }
+  }
+
   test("returns immediately with backgrounded response", async () => {
     const ctx = makeContext();