@vellumai/assistant 0.8.6 → 0.8.7

package/src/__tests__/schedule-store.test.ts

@@ -1034,6 +1034,73 @@ describe("routing and mode fields", () => {
   });
 });
 
+// ── Script timeout override ─────────────────────────────────────────
+
+describe("script timeout override", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM cron_runs");
+    db.run("DELETE FROM cron_jobs");
+  });
+
+  test("defaults timeoutMs to null when not provided", () => {
+    // GIVEN a schedule created without a timeout override
+    const job = createSchedule({
+      name: "No timeout",
+      cronExpression: "0 9 * * *",
+      message: "no timeout",
+      syntax: "cron",
+    });
+
+    // THEN the stored timeout is null (the runner falls back to the default)
+    expect(job.timeoutMs).toBeNull();
+    expect(getSchedule(job.id)!.timeoutMs).toBeNull();
+  });
+
+  test("persists a timeoutMs override through create/read", () => {
+    // GIVEN a script schedule created with a custom timeout
+    const job = createSchedule({
+      name: "Slow script",
+      cronExpression: "0 9 * * *",
+      message: "",
+      script: "sleep 5",
+      mode: "script",
+      syntax: "cron",
+      timeoutMs: 120_000,
+    });
+
+    // THEN the override round-trips through the store
+    expect(job.timeoutMs).toBe(120_000);
+    expect(getSchedule(job.id)!.timeoutMs).toBe(120_000);
+  });
+
+  test("updateSchedule sets and clears the timeout override", () => {
+    // GIVEN a schedule with a custom timeout
+    const job = createSchedule({
+      name: "Adjust timeout",
+      cronExpression: "0 9 * * *",
+      message: "",
+      script: "echo hi",
+      mode: "script",
+      syntax: "cron",
+      timeoutMs: 90_000,
+    });
+
+    // WHEN the timeout is changed
+    const updated = updateSchedule(job.id, { timeoutMs: 5_000 });
+
+    // THEN the new value is stored
+    expect(updated!.timeoutMs).toBe(5_000);
+
+    // AND WHEN the timeout is cleared back to the default
+    const cleared = updateSchedule(job.id, { timeoutMs: null });
+
+    // THEN it reverts to null
+    expect(cleared!.timeoutMs).toBeNull();
+    expect(getSchedule(job.id)!.timeoutMs).toBeNull();
+  });
+});
+
 // ── listSchedules filters ───────────────────────────────────────────
 
 describe("listSchedules filters", () => {

package/src/__tests__/schedule-tools.test.ts

@@ -316,6 +316,131 @@ describe("schedule_create with mode and routing", () => {
   });
 });
 
+// ── script timeout override ─────────────────────────────────────────
+
+describe("schedule_create / schedule_update timeout_ms", () => {
+  beforeEach(() => {
+    getRawDb().run("DELETE FROM cron_runs");
+    getRawDb().run("DELETE FROM cron_jobs");
+  });
+
+  test("persists timeout_ms when creating a script schedule", async () => {
+    // GIVEN a script schedule created with a custom timeout
+    const result = await executeScheduleCreate(
+      {
+        name: "Slow job",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "sleep 5",
+        timeout_ms: 120_000,
+      },
+      ctx,
+    );
+
+    // THEN the override is stored on the row
+    expect(result.isError).toBe(false);
+    const row = getRawDb()
+      .query("SELECT timeout_ms FROM cron_jobs LIMIT 1")
+      .get() as { timeout_ms: number | null };
+    expect(row.timeout_ms).toBe(120_000);
+  });
+
+  test("rejects an out-of-range timeout_ms on create", async () => {
+    // WHEN creating with a timeout below the minimum
+    const result = await executeScheduleCreate(
+      {
+        name: "Too short",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "echo hi",
+        timeout_ms: 10,
+      },
+      ctx,
+    );
+
+    // THEN the tool returns a validation error and stores nothing
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("timeout_ms must be between");
+    const count = getRawDb()
+      .query("SELECT COUNT(*) AS n FROM cron_jobs")
+      .get() as { n: number };
+    expect(count.n).toBe(0);
+  });
+
+  test("updates and clears timeout_ms", async () => {
+    // GIVEN an existing script schedule
+    await executeScheduleCreate(
+      {
+        name: "Adjustable",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "echo hi",
+        timeout_ms: 90_000,
+      },
+      ctx,
+    );
+    const { id } = getRawDb()
+      .query("SELECT id FROM cron_jobs LIMIT 1")
+      .get() as { id: string };
+
+    // WHEN the timeout is updated
+    const updated = await executeScheduleUpdate(
+      { job_id: id, timeout_ms: 5_000 },
+      ctx,
+    );
+
+    // THEN the new value is stored
+    expect(updated.isError).toBe(false);
+    const afterUpdate = getRawDb()
+      .query("SELECT timeout_ms FROM cron_jobs WHERE id = ?")
+      .get(id) as { timeout_ms: number | null };
+    expect(afterUpdate.timeout_ms).toBe(5_000);
+
+    // AND WHEN the timeout is cleared with null
+    const cleared = await executeScheduleUpdate(
+      { job_id: id, timeout_ms: null },
+      ctx,
+    );
+
+    // THEN the override reverts to null
+    expect(cleared.isError).toBe(false);
+    const afterClear = getRawDb()
+      .query("SELECT timeout_ms FROM cron_jobs WHERE id = ?")
+      .get(id) as { timeout_ms: number | null };
+    expect(afterClear.timeout_ms).toBeNull();
+  });
+
+  test("rejects an out-of-range timeout_ms on update", async () => {
+    // GIVEN an existing script schedule
+    await executeScheduleCreate(
+      {
+        name: "Guarded",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "echo hi",
+      },
+      ctx,
+    );
+    const { id } = getRawDb()
+      .query("SELECT id FROM cron_jobs LIMIT 1")
+      .get() as { id: string };
+
+    // WHEN updating with a timeout above the maximum
+    const result = await executeScheduleUpdate(
+      { job_id: id, timeout_ms: 60 * 60 * 1000 },
+      ctx,
+    );
+
+    // THEN the tool returns a validation error
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("timeout_ms must be between");
+  });
+});
+
 // ── schedule_list ───────────────────────────────────────────────────
 
 describe("schedule_list tool", () => {

package/src/__tests__/secret-ingress-http.test.ts

@@ -100,8 +100,8 @@ mock.module("../memory/conversation-crud.js", () => ({
     conversationId: string,
     role: string,
     content: string,
-    metadata?: Record<string, unknown>,
-  ) => addMessageMock(conversationId, role, content, metadata),
+    options?: { metadata?: Record<string, unknown> },
+  ) => addMessageMock(conversationId, role, content, options),
   getMessages: () => [],
   provenanceFromTrustContext: () => undefined,
   setConversationOriginChannelIfUnset: () => {},

package/src/__tests__/secret-prompt-log-hygiene.test.ts

@@ -1,9 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type {
-  SecretRequest,
-  ServerMessage,
-} from "../daemon/message-protocol.js";
+import type { SecretRequestEvent } from "../api/events/secret-request.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
 
 // Capture all logger calls so we can verify secret values never appear
 const logCalls: Array<{ level: string; args: unknown[] }> = [];
@@ -43,7 +41,11 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 const _piStore = new Map<string, object>();
 mock.module("../runtime/pending-interactions.js", () => ({
   register: (id: string, entry: object) => _piStore.set(id, entry),
-  resolve: (id: string) => { const e = _piStore.get(id); _piStore.delete(id); return e; },
+  resolve: (id: string) => {
+    const e = _piStore.get(id);
+    _piStore.delete(id);
+    return e;
+  },
   get: (id: string) => _piStore.get(id),
   getAll: () => [..._piStore.values()],
   getByConversation: () => [],
@@ -83,7 +85,7 @@ describe("secret prompt log hygiene", () => {
   test("resolveSecret never logs the secret value", async () => {
     const secret = "sv42";
     const promise = prompter.prompt("myservice", "apikey", "API Key");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, secret, "store");
     const result = await promise;
 
@@ -124,7 +126,9 @@ describe("secret prompt log hygiene", () => {
 
   test("sent message contains value=undefined (value flows through event, not logs)", async () => {
     const promise = prompter.prompt("svc", "tok", "Token");
-    const msg = broadcastedMessages[0] as SecretRequest & { value?: unknown };
+    const msg = broadcastedMessages[0] as SecretRequestEvent & {
+      value?: unknown;
+    };
     // The message should NOT contain a value field
     expect(msg.value).toBeUndefined();
     prompter.resolveSecret(msg.requestId, undefined);

package/src/__tests__/secret-prompter-channel-fallback.test.ts

@@ -1,9 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type {
-  SecretRequest,
-  ServerMessage,
-} from "../daemon/message-protocol.js";
+import type { SecretRequestEvent } from "../api/events/secret-request.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
 
 // Use a tiny timeout so the setTimeout branch fires quickly in tests
 const mockConfig = {
@@ -42,7 +40,11 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 const _piStore = new Map<string, object>();
 mock.module("../runtime/pending-interactions.js", () => ({
   register: (id: string, entry: object) => _piStore.set(id, entry),
-  resolve: (id: string) => { const e = _piStore.get(id); _piStore.delete(id); return e; },
+  resolve: (id: string) => {
+    const e = _piStore.get(id);
+    _piStore.delete(id);
+    return e;
+  },
   get: (id: string) => _piStore.get(id),
   getAll: () => [..._piStore.values()],
   getByConversation: () => [],
@@ -70,7 +72,7 @@ describe("secret prompter channel fallback", () => {
     expect(broadcastMessages).toHaveLength(1);
     expect(broadcastMessages[0]!.type).toBe("secret_request");
 
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-secret", "store");
     const result = await promise;
     expect(result.value).toBe("test-secret");
@@ -88,7 +90,7 @@ describe("secret prompter channel fallback", () => {
     expect(broadcastMessages).toHaveLength(1);
     expect(broadcastMessages[0]!.type).toBe("secret_request");
 
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-secret", "store");
     await promise;
   });
@@ -101,7 +103,7 @@ describe("secret prompter channel fallback", () => {
     expect(broadcastMessages).toHaveLength(1);
     expect(broadcastMessages[0]!.type).toBe("secret_request");
 
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "val", "store");
     await promise;
   });
@@ -110,7 +112,7 @@ describe("secret prompter channel fallback", () => {
     const prompter = new SecretPrompter();
 
     const promise = prompter.prompt("myservice", "apikey", "API Key");
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
 
     expect(prompter.hasPendingRequest(requestId)).toBe(true);
 

package/src/__tests__/secret-response-routing.test.ts

@@ -1,9 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type {
-  SecretRequest,
-  ServerMessage,
-} from "../daemon/message-protocol.js";
+import type { SecretRequestEvent } from "../api/events/secret-request.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
 import type { SecretPromptResult } from "../permissions/secret-prompter.js";
 
 let broadcastedMessages: ServerMessage[] = [];
@@ -15,7 +13,11 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 const _piStore = new Map<string, object>();
 mock.module("../runtime/pending-interactions.js", () => ({
   register: (id: string, entry: object) => _piStore.set(id, entry),
-  resolve: (id: string) => { const e = _piStore.get(id); _piStore.delete(id); return e; },
+  resolve: (id: string) => {
+    const e = _piStore.get(id);
+    _piStore.delete(id);
+    return e;
+  },
   get: (id: string) => _piStore.get(id),
   getAll: () => [..._piStore.values()],
   getByConversation: () => [],
@@ -36,7 +38,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret defaults delivery to store when omitted", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-value");
     const result: SecretPromptResult = await promise;
     expect(result.value).toBe("test-value");
@@ -45,7 +47,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret passes store delivery", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-value", "store");
     const result = await promise;
     expect(result.value).toBe("test-value");
@@ -54,7 +56,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret passes transient_send delivery", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "one-time-value", "transient_send");
     const result = await promise;
     expect(result.value).toBe("one-time-value");
@@ -63,7 +65,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret with cancelled value defaults delivery to store", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, undefined);
     const result = await promise;
     expect(result.value).toBeNull();
@@ -74,7 +76,7 @@ describe("secret response routing", () => {
     // We can't easily test the full timeout, but we verify the structure
     // by resolving immediately (the timeout path also returns { value: null, delivery: 'store' })
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, undefined, undefined);
     const result = await promise;
     expect(result.value).toBeNull();
@@ -91,7 +93,7 @@ describe("secret response routing", () => {
       "session-1",
     );
     expect(broadcastedMessages.length).toBe(1);
-    const msg = broadcastedMessages[0] as SecretRequest;
+    const msg = broadcastedMessages[0] as SecretRequestEvent;
     expect(msg.type).toBe("secret_request");
     expect(msg.service).toBe("github");
     expect(msg.field).toBe("token");

package/src/__tests__/send-endpoint-busy.test.ts

@@ -166,8 +166,9 @@ function makeCompletingConversation(): Conversation {
     runAgentLoop: async (
       _content: string,
       _messageId: string,
-      onEvent: (msg: ServerMessage) => void,
+      options?: { onEvent?: (msg: ServerMessage) => void },
     ) => {
+      const onEvent = options?.onEvent ?? (() => {});
       onEvent({ type: "assistant_text_delta", text: "Hello!" });
       onEvent({ type: "message_complete", conversationId: "test-session" });
       processing = false;

package/src/__tests__/shell-observability.test.ts

@@ -0,0 +1,249 @@
+/**
+ * Verifies the structured logs added to the `bash` tool by the
+ * subprocess-orphan observability change:
+ *
+ *   1. Every invocation emits a `"Shell command exited"` info log with
+ *      `command`, `mode`, `durationMs`, `exitCode`, `signal`, `timedOut`.
+ *   2. Every group-SIGKILL (timeout / abort) emits a `"Shell process
+ *      group SIGKILL'd"` warn log with `reason` so post-mortems can map
+ *      orphans back to the call site that orphaned them.
+ *
+ * These logs are the only ground-truth signal that lets the daemon
+ * trace zombie accumulation back to a specific shell command — the
+ * tests pin them in place so a future refactor can't quietly drop them.
+ */
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { WakeOptions } from "../runtime/agent-wake.js";
+import type { BackgroundTool } from "../tools/background-tool-registry.js";
+
+// ── Mock modules ────────────────────────────────────────────────────────────
+
+interface LogCall {
+  level: "info" | "warn" | "debug" | "error";
+  fields: Record<string, unknown>;
+  msg: string;
+}
+const logCalls: LogCall[] = [];
+
+function recordLog(level: LogCall["level"]) {
+  return (fields: Record<string, unknown> | string, msg?: string) => {
+    if (typeof fields === "string") {
+      logCalls.push({ level, fields: {}, msg: fields });
+    } else {
+      logCalls.push({ level, fields, msg: msg ?? "" });
+    }
+  };
+}
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => ({
+    info: recordLog("info"),
+    warn: recordLog("warn"),
+    debug: recordLog("debug"),
+    error: recordLog("error"),
+  }),
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+    // 1s timeout so the timeout-path test doesn't take forever.
+    timeouts: { shellDefaultTimeoutSec: 120, shellMaxTimeoutSec: 600 },
+    sandbox: {
+      enabled: false,
+      backend: "native",
+      docker: {
+        image: "vellum-sandbox:latest",
+        shell: "bash",
+        cpus: 1,
+        memoryMb: 512,
+        pidsLimit: 256,
+        network: "none",
+      },
+    },
+  }),
+  loadConfig: () => ({}),
+}));
+
+mock.module("../tools/network/script-proxy/index.js", () => ({
+  getOrStartSession: mock(() =>
+    Promise.resolve({ session: { id: "mock-session" } }),
+  ),
+  getSessionEnv: mock(() => ({})),
+  createSession: () => {},
+  startSession: () => {},
+  stopSession: () => {},
+  getActiveSession: () => null,
+  getSessionsForConversation: () => [],
+  stopAllSessions: () => {},
+  ensureLocalCA: () => {},
+  ensureCombinedCABundle: () => {},
+  issueLeafCert: () => {},
+  getCAPath: () => "",
+  getCombinedCAPath: () => "",
+}));
+
+const mockWakeAgentForOpportunity = mock(
+  (
+    _opts: WakeOptions,
+  ): Promise<{ invoked: boolean; producedToolCalls: boolean }> =>
+    Promise.resolve({ invoked: true, producedToolCalls: false }),
+);
+
+mock.module("../runtime/agent-wake.js", () => ({
+  wakeAgentForOpportunity: mockWakeAgentForOpportunity,
+}));
+
+const registeredTools: BackgroundTool[] = [];
+
+mock.module("../tools/background-tool-registry.js", () => ({
+  registerBackgroundTool: (tool: BackgroundTool) => {
+    registeredTools.push(tool);
+  },
+  removeBackgroundTool: (id: string) => {
+    const idx = registeredTools.findIndex((t) => t.id === id);
+    if (idx !== -1) registeredTools.splice(idx, 1);
+  },
+  generateBackgroundToolId: () => "bg-obs-test",
+  isBackgroundToolLimitReached: () => false,
+  MAX_BACKGROUND_TOOLS: 20,
+}));
+
+// ── Imports (after mocks) ───────────────────────────────────────────────────
+
+// `shellTool` is imported dynamically inside `beforeEach` so the logger
+// mock above lands before shell.ts evaluates and captures its `getLogger`
+// reference — static imports hoist past `mock.module()` and the test
+// would see the real pino logger instead of the in-memory `logCalls`
+// array. The shape type below mirrors the satisfies-narrowed export so
+// `shellTool.execute(...)` keeps its required-execute typing without a
+// `!` bang.
+let shellTool: (typeof import("../tools/terminal/shell.js"))["shellTool"];
+
+const baseContext = {
+  workingDir: process.env.VELLUM_WORKSPACE_DIR ?? "/tmp",
+  conversationId: "conv-obs-test",
+  trustClass: "guardian" as const,
+  onOutput: () => {},
+};
+
+type LogPredicate = (call: LogCall) => boolean;
+
+function findLog(predicate: LogPredicate): LogCall | undefined {
+  return logCalls.find(predicate);
+}
+
+function waitForLog(
+  predicate: LogPredicate,
+  label: string,
+  timeoutMs = 5_000,
+): Promise<LogCall> {
+  return new Promise<LogCall>((resolve, reject) => {
+    const timer = setTimeout(
+      () => reject(new Error(`timed out waiting for ${label}`)),
+      timeoutMs,
+    );
+    const check = () => {
+      const hit = findLog(predicate);
+      if (hit) {
+        clearTimeout(timer);
+        return resolve(hit);
+      }
+      setTimeout(check, 25);
+    };
+    check();
+  });
+}
+
+const isExit = (mode: "foreground" | "background") => (c: LogCall) =>
+  c.level === "info" &&
+  c.msg === "Shell command exited" &&
+  c.fields.mode === mode;
+
+const isKill = (reason: string) => (c: LogCall) =>
+  c.level === "warn" &&
+  c.msg.startsWith("Shell process group SIGKILL") &&
+  c.fields.reason === reason;
+
+describe("shell observability logs", () => {
+  beforeEach(async () => {
+    logCalls.length = 0;
+    registeredTools.length = 0;
+    const mod = await import("../tools/terminal/shell.js");
+    shellTool = mod.shellTool;
+  });
+
+  afterEach(() => {
+    logCalls.length = 0;
+    registeredTools.length = 0;
+  });
+
+  test("foreground exit emits structured 'Shell command exited' info log", async () => {
+    const result = await shellTool.execute(
+      { command: "echo obs-foreground", activity: "test" },
+      baseContext,
+    );
+    expect(result.isError).toBe(false);
+
+    const exit = findLog(isExit("foreground"));
+    expect(exit).toBeDefined();
+    expect(exit!.fields.exitCode).toBe(0);
+    expect(exit!.fields.signal).toBeNull();
+    expect(exit!.fields.timedOut).toBe(false);
+    expect(exit!.fields.conversationId).toBe("conv-obs-test");
+    expect(exit!.fields.command).toBe("echo obs-foreground");
+    expect(typeof exit!.fields.durationMs).toBe("number");
+  });
+
+  test("foreground timeout emits killTree warn + exit log with timedOut=true", async () => {
+    const result = await shellTool.execute(
+      { command: "sleep 30", activity: "test", timeout_seconds: 1 },
+      baseContext,
+    );
+    expect(result.isError).toBe(true);
+
+    const kill = findLog(isKill("timeout"));
+    expect(kill).toBeDefined();
+    expect(kill!.fields.command).toBe("sleep 30");
+    expect(kill!.fields.conversationId).toBe("conv-obs-test");
+    expect(typeof kill!.fields.groupPid).toBe("number");
+
+    const exit = findLog(
+      (c) => isExit("foreground")(c) && c.fields.timedOut === true,
+    );
+    expect(exit).toBeDefined();
+  }, 10_000);
+
+  test("background mode emits an exit log with mode='background' and the bg invocationId", async () => {
+    await shellTool.execute(
+      { command: "echo bg-obs", activity: "test", background: true },
+      baseContext,
+    );
+
+    const exit = await waitForLog(
+      (c) => isExit("background")(c) && c.fields.invocationId === "bg-obs-test",
+      "background exit log",
+    );
+    expect(exit.fields.exitCode).toBe(0);
+    expect(exit.fields.timedOut).toBe(false);
+  });
+
+  test("aborted foreground command emits killTree warn with reason='abort'", async () => {
+    const controller = new AbortController();
+    const execPromise = shellTool.execute(
+      { command: "sleep 30", activity: "test" },
+      { ...baseContext, signal: controller.signal },
+    );
+
+    // Abort once the child has been spawned. A microtask is enough; we
+    // poll the log buffer up to 2 s for the warn so the test isn't
+    // sensitive to scheduler jitter.
+    setTimeout(() => controller.abort(), 50);
+
+    await execPromise;
+
+    const kill = await waitForLog(isKill("abort"), "abort kill log", 2_000);
+    expect(kill.fields.command).toBe("sleep 30");
+  });
+});