@vellumai/assistant 0.7.2 → 0.8.0

package/src/runtime/routes/memory-item-routes.test.ts

@@ -13,7 +13,8 @@ mock.module("../../util/logger.js", () => ({
     }),
 }));
 
-// Stub config loader — returns a config with memory enabled by default
+// Stub config loader — return a config with memory.v2.enabled=false so the
+// v1 paths under test stay active.
 mock.module("../../config/loader.js", () => ({
   loadConfig: () => mockConfig,
   getConfig: () => mockConfig,
@@ -21,7 +22,7 @@ mock.module("../../config/loader.js", () => ({
 }));
 
 // ── Controllable mocks for semantic search ─────────────────────────────
-const mockConfig: unknown = {};
+const mockConfig: unknown = { memory: { v2: { enabled: false } } };
 
 let mockBackendStatus: {
   enabled: boolean;
@@ -68,11 +69,7 @@ import { eq } from "drizzle-orm";
 import { getDb } from "../../memory/db-connection.js";
 import { initializeDb } from "../../memory/db-init.js";
 import { memoryGraphNodes, memoryJobs } from "../../memory/schema.js";
-import {
-  BadRequestError,
-  ConflictError,
-  NotFoundError,
-} from "./errors.js";
+import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
 import { ROUTES } from "./memory-item-routes.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -269,7 +266,9 @@ describe("Memory Item Routes", () => {
         content: "s2\nst2",
       });
 
-      const res = await callHandler(route, { queryParams: { kind: "semantic" } });
+      const res = await callHandler(route, {
+        queryParams: { kind: "semantic" },
+      });
       const body = (await res.json()) as {
         items: Array<{ id: string }>;
         total: number;
@@ -319,7 +318,9 @@ describe("Memory Item Routes", () => {
         lastAccessed: 3000,
       });
 
-      const res = await callHandler(route, { queryParams: { limit: "1", offset: "1" } });
+      const res = await callHandler(route, {
+        queryParams: { limit: "1", offset: "1" },
+      });
       const body = (await res.json()) as {
         items: Array<{ id: string }>;
         total: number;
@@ -344,7 +345,9 @@ describe("Memory Item Routes", () => {
         created: 1000,
       });
 
-      const res = await callHandler(route, { queryParams: { sort: "firstSeenAt", order: "asc" } });
+      const res = await callHandler(route, {
+        queryParams: { sort: "firstSeenAt", order: "asc" },
+      });
       const body = (await res.json()) as {
         items: Array<{ id: string }>;
       };
@@ -366,7 +369,9 @@ describe("Memory Item Routes", () => {
         significance: 0.9,
       });
 
-      const res = await callHandler(route, { queryParams: { sort: "importance", order: "desc" } });
+      const res = await callHandler(route, {
+        queryParams: { sort: "importance", order: "desc" },
+      });
       const body = (await res.json()) as {
         items: Array<{ id: string }>;
       };
@@ -418,7 +423,9 @@ describe("Memory Item Routes", () => {
         },
       ];
 
-      const res = await callHandler(route, { queryParams: { search: "alice" } });
+      const res = await callHandler(route, {
+        queryParams: { search: "alice" },
+      });
       const body = (await res.json()) as {
         items: Array<{ id: string }>;
         total: number;
@@ -503,7 +510,9 @@ describe("Memory Item Routes", () => {
       ];
 
       // Request page 2 (offset=1, limit=1)
-      const res = await callHandler(route, { queryParams: { search: "item", limit: "1", offset: "1" } });
+      const res = await callHandler(route, {
+        queryParams: { search: "item", limit: "1", offset: "1" },
+      });
       const body = (await res.json()) as {
         items: Array<{ id: string }>;
         total: number;
@@ -563,7 +572,10 @@ describe("Memory Item Routes", () => {
         content: "dark mode\nPrefers dark mode",
       });
 
-      const res = await callHandler(route, { queryParams: {}, pathParams: { id: "i1" } });
+      const res = await callHandler(route, {
+        queryParams: {},
+        pathParams: { id: "i1" },
+      });
       expect(res.status).toBe(200);
       const body = (await res.json()) as {
         item: { id: string; subject: string };
@@ -573,7 +585,10 @@ describe("Memory Item Routes", () => {
     });
 
     test("returns 404 for non-existent item", async () => {
-      const res = await callHandler(route, { queryParams: {}, pathParams: { id: "nonexistent" } });
+      const res = await callHandler(route, {
+        queryParams: {},
+        pathParams: { id: "nonexistent" },
+      });
       expect(res.status).toBe(404);
     });
 
@@ -584,7 +599,10 @@ describe("Memory Item Routes", () => {
         content: "some content\nsome statement",
       });
 
-      const res = await callHandler(route, { queryParams: {}, pathParams: { id: "i1" } });
+      const res = await callHandler(route, {
+        queryParams: {},
+        pathParams: { id: "i1" },
+      });
       const body = (await res.json()) as {
         item: { supersedes: unknown; supersededBy: unknown };
       };
@@ -862,7 +880,9 @@ describe("Memory Item Routes", () => {
     });
 
     test("returns 404 for non-existent item", async () => {
-      const res = await callHandler(route, { pathParams: { id: "nonexistent" } });
+      const res = await callHandler(route, {
+        pathParams: { id: "nonexistent" },
+      });
       expect(res.status).toBe(404);
     });
 

package/src/runtime/routes/memory-item-routes.ts

@@ -25,7 +25,6 @@ import {
 import { z } from "zod";
 
 import { getConfig } from "../../config/loader.js";
-import { isMemoryV2ReadActive } from "../../memory/context-search/sources/memory-v2.js";
 import { getDb } from "../../memory/db-connection.js";
 import {
   embedWithBackend,
@@ -176,11 +175,11 @@ async function searchNodesSemantic(
 ): Promise<{ ids: string[]; total: number } | null> {
   try {
     const config = getConfig();
-    // v2 owns the read path when both gates are on. Fall back to SQL search
-    // (the caller's `null` branch) instead of querying the v1 collection,
-    // which is in active retirement and a corrupted sparse segment can
-    // OOM-crash the shared Qdrant process.
-    if (isMemoryV2ReadActive(config)) return null;
+    // v2 owns the read path when enabled. Fall back to SQL search (the
+    // caller's `null` branch) instead of querying the v1 collection, which
+    // is in active retirement and a corrupted sparse segment can OOM-crash
+    // the shared Qdrant process.
+    if (config.memory.v2.enabled) return null;
     const backendStatus = await getMemoryBackendStatus(config);
     if (!backendStatus.provider) return null;
 

package/src/runtime/routes/memory-v2-routes.ts

@@ -4,9 +4,11 @@
  * Migrated from `ipc/routes/memory-v2-backfill.ts` and
  * `ipc/routes/memory-v2-validate.ts` into the shared ROUTES array.
  */
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+
 import { z } from "zod";
 
-import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { loadConfig } from "../../config/loader.js";
 import {
   applyCorrectionIfCalibrated,
@@ -22,12 +24,17 @@ import {
   enqueueMemoryJob,
   type MemoryJobType,
 } from "../../memory/jobs-store.js";
+import {
+  type ConceptFrequencyResponse,
+  getConceptFrequencySummary,
+} from "../../memory/memory-v2-concept-frequency.js";
 import {
   getEdgeIndex,
   totalEdgeCount,
   validateEdgeTargets,
 } from "../../memory/v2/edge-index.js";
 import {
+  getConceptsDir,
   listPages,
   readPage,
   renderPageContent,
@@ -43,11 +50,37 @@ import {
   getConceptPageCorpusStats,
   rebuildConceptPageCorpusStats,
 } from "../../memory/v2/sparse-bm25.js";
+import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir } from "../../util/platform.js";
 import { RouteError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 import type { RouteHandlerArgs } from "./types.js";
 
+const log = getLogger("memory-v2-routes");
+
+/**
+ * Wire-format error code emitted when v2 routes reject a request because
+ * `memory.v2.enabled` is false. Exported so tests and the macOS client can
+ * reference the same string without drift.
+ */
+export const MEMORY_V2_DISABLED_CODE = "MEMORY_V2_DISABLED";
+
+/**
+ * Reject the request when memory v2 is not active. Returning 409 (rather
+ * than serving a partial response) keeps clients honest — the desktop
+ * Memories panel reads this code to render an explicit "disabled in
+ * config" empty state.
+ */
+function requireMemoryV2Enabled(): void {
+  if (!loadConfig().memory.v2.enabled) {
+    throw new RouteError(
+      "Memory v2 is not enabled — set memory.v2.enabled to true to use this command.",
+      MEMORY_V2_DISABLED_CODE,
+      409,
+    );
+  }
+}
+
 // ── Backfill ────────────────────────────────────────────────────────────
 
 const MemoryV2BackfillParams = z
@@ -72,6 +105,7 @@ const OP_TO_JOB_TYPE: Record<MemoryV2BackfillOp, MemoryJobType> = {
 async function handleBackfill({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2BackfillResult> {
+  requireMemoryV2Enabled();
   const { op, force } = MemoryV2BackfillParams.parse(body);
   const payload: Record<string, unknown> =
     op === "migrate" && force === true ? { force: true } : {};
@@ -98,6 +132,7 @@ export type MemoryV2ValidateResult = {
 async function handleValidate({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2ValidateResult> {
+  requireMemoryV2Enabled();
   MemoryV2ValidateParams.parse(body);
 
   const workspaceDir = getWorkspaceDir();
@@ -154,6 +189,7 @@ export type MemoryV2GetConceptPageResult = {
 async function handleGetConceptPage({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2GetConceptPageResult> {
+  requireMemoryV2Enabled();
   const { slug } = MemoryV2GetConceptPageParams.parse(body);
   const workspaceDir = getWorkspaceDir();
   let page;
@@ -176,6 +212,59 @@ async function handleGetConceptPage({
   return { slug, rendered: renderPageContent(page) };
 }
 
+// ── List concept pages ──────────────────────────────────────────────────
+
+const MemoryV2ListConceptPagesParams = z.object({}).strict();
+
+export type MemoryV2ListConceptPagesResult = {
+  pages: Array<{
+    slug: string;
+    bodyBytes: number;
+    edgeCount: number;
+    updatedAtMs: number;
+  }>;
+};
+
+async function handleListConceptPages({
+  body = {},
+}: RouteHandlerArgs): Promise<MemoryV2ListConceptPagesResult> {
+  requireMemoryV2Enabled();
+  MemoryV2ListConceptPagesParams.parse(body);
+
+  const workspaceDir = getWorkspaceDir();
+  const conceptsDir = getConceptsDir(workspaceDir);
+  const slugs = await listPages(workspaceDir);
+
+  const settled = await Promise.all(
+    slugs.map(async (slug) => {
+      try {
+        const page = await readPage(workspaceDir, slug);
+        if (!page) return null;
+        const stats = await stat(join(conceptsDir, `${slug}.md`));
+        return {
+          slug,
+          bodyBytes: Buffer.byteLength(page.body, "utf8"),
+          edgeCount: page.frontmatter.edges.length,
+          updatedAtMs: Math.floor(stats.mtimeMs),
+        };
+      } catch (err) {
+        // A single corrupt page (bad YAML, schema mismatch, etc.) shouldn't
+        // poison the whole listing — the validate route is the place to
+        // surface those; this one is read-only and best-effort.
+        log.warn(
+          `Skipping concept page '${slug}' in list-concept-pages: ${err instanceof Error ? err.message : String(err)}`,
+        );
+        return null;
+      }
+    }),
+  );
+  const pages = settled.filter(
+    (p): p is MemoryV2ListConceptPagesResult["pages"][number] => p !== null,
+  );
+
+  return { pages };
+}
+
 // ── Rebuild BM25 corpus stats ───────────────────────────────────────────
 
 const MemoryV2RebuildCorpusStatsParams = z.object({}).strict();
@@ -190,6 +279,7 @@ export interface MemoryV2RebuildCorpusStatsResult {
 async function handleRebuildCorpusStats({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2RebuildCorpusStatsResult> {
+  requireMemoryV2Enabled();
   MemoryV2RebuildCorpusStatsParams.parse(body);
   const workspaceDir = getWorkspaceDir();
   await rebuildConceptPageCorpusStats(workspaceDir);
@@ -221,23 +311,9 @@ export type MemoryV2ReembedSkillsResult = {
 async function handleReembedSkills({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2ReembedSkillsResult> {
+  requireMemoryV2Enabled();
   MemoryV2ReembedSkillsParams.parse(body);
 
-  // Gate the route on both the feature flag and the per-workspace config
-  // toggle so the v2 skill collection never gets re-seeded against a
-  // workspace whose v2 subsystem is intentionally off.
-  const config = loadConfig();
-  if (
-    !isAssistantFeatureFlagEnabled("memory-v2-enabled", config) ||
-    !config.memory.v2.enabled
-  ) {
-    throw new RouteError(
-      "Memory v2 is not enabled — flip both the memory-v2-enabled feature flag and memory.v2.enabled to use this command.",
-      "MEMORY_V2_DISABLED",
-      409,
-    );
-  }
-
   // Unlike the queued backfill jobs above, this is a CLI-driven sync
   // request: the operator wants the cache replaced before the next prompt
   // assembly, so we await the seed inline rather than enqueueing it.
@@ -412,6 +488,7 @@ async function scoreChannel(
 async function handleExplainSimilarity({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2ExplainSimilarityResult> {
+  requireMemoryV2Enabled();
   const params = MemoryV2ExplainSimilarityParams.parse(body);
   const config = loadConfig();
   const { dense_weight: denseWeight, sparse_weight: sparseWeight } =
@@ -459,6 +536,25 @@ async function handleExplainSimilarity({
   };
 }
 
+// ── Concept injection frequency (debug-only) ────────────────────────────
+
+const MemoryV2ConceptFrequencyParams = z
+  .object({
+    conversationId: z.string().min(1).optional(),
+    sinceMs: z.number().int().nonnegative().optional(),
+  })
+  .strict();
+
+async function handleConceptFrequency({
+  body = {},
+}: RouteHandlerArgs): Promise<ConceptFrequencyResponse> {
+  requireMemoryV2Enabled();
+  const { conversationId, sinceMs } =
+    MemoryV2ConceptFrequencyParams.parse(body);
+  const workspaceDir = getWorkspaceDir();
+  return getConceptFrequencySummary(workspaceDir, { conversationId, sinceMs });
+}
+
 // ── Fit anisotropy calibration ──────────────────────────────────────────
 
 const MemoryV2FitAnisotropyParams = z
@@ -495,6 +591,7 @@ export interface MemoryV2FitAnisotropyResult {
 async function handleFitAnisotropy({
   body = {},
 }: RouteHandlerArgs): Promise<MemoryV2FitAnisotropyResult> {
+  requireMemoryV2Enabled();
   const { k, sample } = MemoryV2FitAnisotropyParams.parse(body);
   const config = loadConfig();
 
@@ -581,6 +678,17 @@ export const ROUTES: RouteDefinition[] = [
     tags: ["memory"],
     requestBody: MemoryV2GetConceptPageParams,
   },
+  {
+    operationId: "memory_v2_list_concept_pages",
+    method: "POST",
+    endpoint: "memory/v2/list-concept-pages",
+    handler: handleListConceptPages,
+    summary: "List all memory v2 concept pages with metadata",
+    description:
+      "Returns slugs, body sizes, edge counts, and last-modified timestamps for every concept page on disk. Read-only; used by the desktop About → Memories surface to render a browse-able list.",
+    tags: ["memory"],
+    requestBody: MemoryV2ListConceptPagesParams,
+  },
   {
     operationId: "memory_v2_reembed_skills",
     method: "POST",
@@ -588,7 +696,7 @@ export const ROUTES: RouteDefinition[] = [
     handler: handleReembedSkills,
     summary: "Re-seed v2 skill entries from the current skill catalog",
     description:
-      "Synchronously re-runs seedV2SkillEntries against the current skill catalog. Gated on memory-v2-enabled flag and config.memory.v2.enabled.",
+      "Synchronously re-runs seedV2SkillEntries against the current skill catalog. Gated on config.memory.v2.enabled.",
     tags: ["memory"],
     requestBody: MemoryV2ReembedSkillsParams,
   },
@@ -614,6 +722,17 @@ export const ROUTES: RouteDefinition[] = [
     tags: ["memory"],
     requestBody: MemoryV2RebuildCorpusStatsParams,
   },
+  {
+    operationId: "memory_v2_concept_frequency",
+    method: "POST",
+    endpoint: "memory/v2/concept-frequency",
+    handler: handleConceptFrequency,
+    summary: "Aggregate per-concept injection frequency from activation logs",
+    description:
+      "Debug-only. Aggregates the existing memory_v2_activation_logs table by (slug, status) and cross-references on-disk concept pages so an operator can see which concepts get injected often, which get scored but rejected, and which on-disk pages never even surface as candidates. Optional filters: conversationId narrows to a single conversation; sinceMs restricts to logs created at-or-after the given epoch ms timestamp.",
+    tags: ["memory"],
+    requestBody: MemoryV2ConceptFrequencyParams,
+  },
   {
     operationId: "memory_v2_fit_anisotropy",
     method: "POST",

package/src/runtime/routes/oauth-connect-routes.ts

@@ -0,0 +1,153 @@
+/**
+ * Internal routes for daemon-owned OAuth connect flows (CLI gateway transport fix).
+ *
+ * POST internal/oauth/connect/start   — starts the flow in the daemon, returns auth URL
+ * GET  internal/oauth/connect/status/:state — polls current flow status
+ */
+
+import { z } from "zod";
+
+import { orchestrateOAuthConnect } from "../../oauth/connect-orchestrator.js";
+import {
+  getOAuthConnectState,
+  setOAuthConnectComplete,
+  setOAuthConnectError,
+  setOAuthConnectPending,
+} from "../../oauth/oauth-connect-state.js";
+import { getLogger } from "../../util/logger.js";
+import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
+import type { RouteDefinition } from "./types.js";
+
+const log = getLogger("oauth-connect-routes");
+
+async function handleOAuthConnectStart({
+  body,
+}: {
+  body?: Record<string, unknown>;
+}): Promise<{ auth_url: string; state: string }> {
+  const {
+    service,
+    clientId,
+    clientSecret,
+    callbackTransport,
+    requestedScopes,
+  } = (body ?? {}) as {
+    service: string;
+    clientId: string;
+    clientSecret?: string;
+    callbackTransport?: string;
+    requestedScopes?: string[];
+  };
+
+  if (!service) throw new BadRequestError("service is required");
+  if (!clientId) throw new BadRequestError("clientId is required");
+  if (callbackTransport !== "loopback" && callbackTransport !== "gateway") {
+    throw new BadRequestError(
+      'callbackTransport must be "loopback" or "gateway"',
+    );
+  }
+
+  // Capture resolvedState separately so the onDeferredComplete closure can
+  // reference it without a reference-before-assignment risk (the fire-and-forget
+  // tail only fires after the await resolves, by which point resolvedState is set).
+  // eslint-disable-next-line prefer-const -- intentional forward-declared binding
+  let resolvedState: string | undefined;
+
+  let result: Awaited<ReturnType<typeof orchestrateOAuthConnect>>;
+  try {
+    result = await orchestrateOAuthConnect({
+      service,
+      clientId,
+      clientSecret,
+      callbackTransport,
+      ...(requestedScopes ? { requestedScopes } : {}),
+      isInteractive: false,
+      onDeferredComplete: (r) => {
+        if (!resolvedState) return;
+        if (r.success) {
+          setOAuthConnectComplete(resolvedState, r.service, r.accountInfo, r.grantedScopes);
+        } else {
+          setOAuthConnectError(resolvedState, r.service, r.error ?? "OAuth connect failed");
+        }
+      },
+    });
+  } catch (err) {
+    throw new InternalError(err instanceof Error ? err.message : String(err));
+  }
+
+  if (!result.success) {
+    throw new InternalError(result.error);
+  }
+  if (!result.deferred) {
+    throw new InternalError("Orchestrator returned non-deferred result");
+  }
+
+  resolvedState = result.state;
+  setOAuthConnectPending(result.state, service);
+  log.info({ state: result.state, service }, "oauth connect flow started");
+  return { auth_url: result.authorizeUrl, state: result.state };
+}
+
+function handleOAuthConnectStatus({
+  pathParams,
+}: {
+  pathParams?: Record<string, string>;
+}): {
+  status: "pending" | "complete" | "error";
+  service: string;
+  account_info?: string;
+  granted_scopes?: string[];
+  error?: string;
+} {
+  const { state } = pathParams as { state: string };
+  const flowState = getOAuthConnectState(state);
+
+  if (flowState === null) {
+    throw new NotFoundError(`No active OAuth connect flow for state "${state}"`);
+  }
+
+  if (flowState.status === "pending") return { status: "pending", service: flowState.service };
+  if (flowState.status === "complete") {
+    return {
+      status: "complete",
+      service: flowState.service,
+      ...(flowState.accountInfo ? { account_info: flowState.accountInfo } : {}),
+      ...(flowState.grantedScopes ? { granted_scopes: flowState.grantedScopes } : {}),
+    };
+  }
+  return { status: "error", service: flowState.service, error: flowState.error };
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "internal_oauth_connect_start",
+    endpoint: "internal/oauth/connect/start",
+    method: "POST",
+    summary: "Start daemon-owned OAuth connect flow",
+    description:
+      "Starts an OAuth connect flow in the daemon and returns the authorization URL for the CLI to open in the browser.",
+    tags: ["internal"],
+    requestBody: z.object({
+      service: z.string(),
+      clientId: z.string(),
+      clientSecret: z.string().optional(),
+      callbackTransport: z.enum(["loopback", "gateway"]),
+      requestedScopes: z.array(z.string()).optional(),
+    }),
+    handler: handleOAuthConnectStart,
+  },
+  {
+    operationId: "internal_oauth_connect_status",
+    endpoint: "internal/oauth/connect/status/:state",
+    method: "GET",
+    summary: "Poll daemon OAuth connect flow status",
+    description:
+      "Returns the current status of an in-flight daemon-owned OAuth connect flow (pending/complete/error).",
+    tags: ["internal"],
+    pathParams: [{ name: "state" }],
+    additionalResponses: {
+      "404": { description: "No active OAuth connect flow for the given state token" },
+    },
+    handler: handleOAuthConnectStatus,
+  },
+];

package/src/runtime/verification-outbound-actions.ts

@@ -79,7 +79,7 @@ export function normalizeTelegramDestination(destination: string): string {
 // Input / output types
 // ---------------------------------------------------------------------------
 
-export interface StartOutboundParams {
+interface StartOutboundParams {
   channel: ChannelId;
   destination?: string;
   rebind?: boolean;
@@ -87,13 +87,13 @@ export interface StartOutboundParams {
   originConversationId?: string;
 }
 
-export interface ResendOutboundParams {
+interface ResendOutboundParams {
   channel: ChannelId;
   /** Origin conversation ID so completion/failure pointers can route back on resend. */
   originConversationId?: string;
 }
 
-export interface CancelOutboundParams {
+interface CancelOutboundParams {
   channel: ChannelId;
 }
 
@@ -102,7 +102,7 @@ export interface CancelOutboundParams {
  * Maps 1:1 with the fields in ChannelVerificationSessionResponse minus the
  * `type` discriminant.
  */
-export interface OutboundActionResult {
+interface OutboundActionResult {
   success: boolean;
   error?: string;
   message?: string;

package/src/schedule/run-script.ts

@@ -38,21 +38,53 @@ export async function runScript(
     env: buildSanitizedEnv(),
   });
 
-  // Race process completion against a timeout
+  // Start consuming streams immediately so buffered output is available even on timeout.
+  // When the process is killed the pipe fds close and these promises resolve on their own.
+  const stdoutPromise = new Response(proc.stdout).text();
+  const stderrPromise = new Response(proc.stderr).text();
+
+  let timedOut = false;
+
   const timeoutPromise = new Promise<never>((_, reject) => {
     const timer = setTimeout(() => {
+      timedOut = true;
       proc.kill("SIGKILL");
       reject(new Error(`Script timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     timer.unref();
-    // Clean up timer if process finishes first
     proc.exited.then(() => clearTimeout(timer));
   });
 
-  const exitCode = await Promise.race([proc.exited, timeoutPromise]);
+  /** How long to wait for pipes to drain after SIGKILL before giving up. */
+  const DRAIN_TIMEOUT_MS = 5_000;
+
+  let exitCode: number;
+  try {
+    exitCode = await Promise.race([proc.exited, timeoutPromise]);
+  } catch (err) {
+    if (!timedOut) throw err;
+    // Collect whatever the process wrote before it was killed.
+    // Race each stream against a short drain window — if a background child
+    // process inherited the pipe fd, the stream would otherwise never reach
+    // EOF and block the scheduler tick indefinitely.
+    const empty = (ms: number): Promise<string> =>
+      new Promise((resolve) => setTimeout(() => resolve(""), ms));
+    const [stdoutStr, stderrStr] = await Promise.all([
+      Promise.race([stdoutPromise, empty(DRAIN_TIMEOUT_MS)]),
+      Promise.race([stderrPromise, empty(DRAIN_TIMEOUT_MS)]),
+    ]);
+    const stdout = truncate(stdoutStr);
+    const timeoutMsg = `Script timed out after ${timeoutMs}ms`;
+    const stderr = truncate(stderrStr ? `${timeoutMsg}\n${stderrStr}` : timeoutMsg);
+    log.info(
+      { command, timedOut: true, stdoutLen: stdout.length },
+      "Script timed out",
+    );
+    return { exitCode: 124, stdout, stderr };
+  }
 
-  const stdout = truncate(await new Response(proc.stdout).text());
-  const stderr = truncate(await new Response(proc.stderr).text());
+  const stdout = truncate(await stdoutPromise);
+  const stderr = truncate(await stderrPromise);
 
   log.info(
     { command, exitCode, stdoutLen: stdout.length, stderrLen: stderr.length },