@yeaft/webchat-agent 1.0.313 → 1.0.315

package/yeaft/tools/bash.js

@@ -9,11 +9,15 @@
  */
 
 import { defineTool } from './types.js';
-import { spawn } from 'child_process';
 import { existsSync } from 'fs';
-import { resolve } from 'path';
+import { dirname, resolve } from 'path';
+import { fileURLToPath } from 'url';
 import { buildShellInvocation, getRuntimePlatformInfo } from '../runtime-platform.js';
-import { wrapInvocationInSystemdUserScope } from '../systemd-scope.js';
+import {
+  wrapInvocationInSystemdUserScope,
+  wrapInvocationInSystemdUserService,
+} from '../systemd-scope.js';
+import { runProcess } from './process-runner.js';
 
 export { buildShellInvocation };
 
@@ -25,117 +29,69 @@ const DEFAULT_TIMEOUT_MS = 120_000;
 
 /** Max timeout in ms (10 minutes). */
 const MAX_TIMEOUT_MS = 600_000;
+/**
+ * ToolRegistry must not preempt Bash's own process timeout. Bash terminates
+ * the process tree and waits for close before returning exit 124; the grace
+ * covers TERM/KILL escalation and the bounded close-confirmation window.
+ */
+const REGISTRY_TIMEOUT_MS = MAX_TIMEOUT_MS + 15_000;
+const LINUX_NAMESPACE_HELPER = resolve(
+  dirname(fileURLToPath(import.meta.url)),
+  '..',
+  'linux-process-namespace.js',
+);
 
 /**
  * Run a command in a child process.
  * @returns {Promise<{ stdout: string, stderr: string, exitCode: number, timedOut: boolean }>}
  */
 function runCommand(command, { cwd, timeout, signal, runtimePlatform }) {
-  return new Promise((resolve) => {
-    const platform = runtimePlatform || getRuntimePlatformInfo();
-    const env = { ...process.env, TERM: 'dumb', FORCE_COLOR: '0' };
-    const baseInvocation = buildShellInvocation(command, { runtimePlatform: platform });
-    const invocation = wrapInvocationInSystemdUserScope(baseInvocation, {
+  const platform = runtimePlatform || getRuntimePlatformInfo();
+  const env = { ...process.env, TERM: 'dumb', FORCE_COLOR: '0' };
+  const baseInvocation = buildShellInvocation(command, { runtimePlatform: platform });
+  let invocation = wrapInvocationInSystemdUserScope(baseInvocation, {
+    runtimePlatform: platform,
+    env,
+    scopeId: `foreground-${Date.now()}-${process.pid}`,
+  });
+  if (platform.isLinux && !invocation.systemdControl) {
+    invocation = wrapInvocationInSystemdUserService(baseInvocation, {
       runtimePlatform: platform,
       env,
-      scopeId: `foreground-${Date.now()}-${process.pid}`,
-    });
-    const proc = spawn(invocation.command, invocation.args, {
       cwd,
-      env,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      detached: !platform.isWindows,
-      windowsHide: true,
+      unitId: `foreground-${Date.now()}-${process.pid}`,
     });
-
-    let stdout = '';
-    let stderr = '';
-    let stdoutTruncated = false;
-    let stderrTruncated = false;
-    let timedOut = false;
-    let settled = false;
-    let timeoutId = null;
-
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      if (timeoutId) clearTimeout(timeoutId);
-      resolve(result);
-    };
-
-    const killProcess = () => {
-      try {
-        if (!platform.isWindows && proc.pid) {
-          process.kill(-proc.pid, 'SIGTERM');
-          return;
-        }
-      } catch {
-        // Fall back to killing the shell process below.
-      }
-      try {
-        proc.kill('SIGTERM');
-      } catch {
-        // ignore
-      }
-    };
-
-    proc.stdout.on('data', (chunk) => {
-      if (stdout.length < MAX_OUTPUT) {
-        stdout += chunk.toString();
-        if (stdout.length > MAX_OUTPUT) {
-          stdout = stdout.slice(0, MAX_OUTPUT);
-          stdoutTruncated = true;
-        }
-      }
-    });
-
-    proc.stderr.on('data', (chunk) => {
-      if (stderr.length < MAX_OUTPUT) {
-        stderr += chunk.toString();
-        if (stderr.length > MAX_OUTPUT) {
-          stderr = stderr.slice(0, MAX_OUTPUT);
-          stderrTruncated = true;
-        }
-      }
-    });
-
-    timeoutId = setTimeout(() => {
-      timedOut = true;
-      killProcess();
-      finish({
-        stdout,
-        stderr: stderr + `\nProcess timed out after ${timeout}ms`,
-        exitCode: 124,
-        timedOut: true,
-      });
-    }, timeout);
-
-    if (signal) {
-      signal.addEventListener('abort', () => {
-        killProcess();
-      }, { once: true });
+  }
+  if (platform.isLinux && !invocation.systemdControl) {
+    const unsharePath = env.YEAFT_UNSHARE_PATH || '/usr/bin/unshare';
+    if (!existsSync(unsharePath)) {
+      throw new Error(
+        'Foreground Bash requires systemd-run or unshare on Linux so timeout can guarantee complete process-tree cleanup. Use background=true or install util-linux.',
+      );
     }
-
-    proc.on('close', (code, signalName) => {
-      if (stdoutTruncated) stdout += '\n[Output truncated]';
-      if (stderrTruncated) stderr += '\n[Output truncated]';
-      finish({
-        stdout,
-        stderr,
-        exitCode: timedOut ? 124 : (code ?? (signalName ? 128 : 1)),
-        timedOut,
-      });
-    });
-
-    proc.on('error', (err) => {
-      finish({
-        stdout,
-        stderr: `Error spawning process: ${err.message}`,
-        exitCode: 1,
-        timedOut: false,
-      });
-    });
-  });
+    invocation = {
+      command: process.execPath,
+      args: [LINUX_NAMESPACE_HELPER, '--', baseInvocation.command, ...(baseInvocation.args || [])],
+      family: baseInvocation.family,
+      systemdControl: null,
+    };
+  }
+  return runProcess(invocation.command, invocation.args, {
+    cwd,
+    env,
+    signal,
+    timeoutMs: timeout,
+    maxBytes: MAX_OUTPUT,
+    requireExitConfirmation: true,
+    systemdScope: invocation.systemdControl,
+    onSettled: invocation.cleanup || null,
+    platform: platform.platform,
+  }).then(result => ({
+    stdout: result.stdout,
+    stderr: result.stderr,
+    exitCode: result.code,
+    timedOut: result.timedOut,
+  }));
 }
 
 export default defineTool({
@@ -211,6 +167,7 @@ Guidelines:
     required: ['command'],
   },
   errorOutput: null,
+  timeoutMs: REGISTRY_TIMEOUT_MS,
   isConcurrencySafe: () => false,
   isReadOnly: () => false,
   isDestructive: (input) => {
@@ -281,7 +238,8 @@ Guidelines:
       }
       return output || '(no output)';
     } catch (err) {
-      throw new Error(err.message);
+      if (err?.name === 'ProcessTerminationError') err.fatalToolTimeout = true;
+      throw err;
     }
   },
 });

package/yeaft/tools/process-runner.js

@@ -4,6 +4,16 @@ import { StringDecoder } from 'node:string_decoder';
 const DEFAULT_MAX_BYTES = 512 * 1024;
 const DEFAULT_KILL_GRACE_MS = 250;
 const DEFAULT_FORCE_SETTLE_MS = 1000;
+const CONFIRMATION_POLL_MS = 25;
+
+export class ProcessTerminationError extends Error {
+  constructor(command, forceSettleMs) {
+    super(`Process tree did not exit within ${forceSettleMs}ms after SIGKILL: ${command}`);
+    this.name = 'ProcessTerminationError';
+    this.command = command;
+    this.forceSettleMs = forceSettleMs;
+  }
+}
 
 function abortError(signal) {
   if (signal?.reason instanceof Error && signal.reason.name === 'AbortError') return signal.reason;
@@ -14,7 +24,54 @@ function abortError(signal) {
   return error;
 }
 
-function killProcessTree(proc, signal, platform, spawnProcessSync) {
+function signalSystemdScope(scope, signalName, spawnProcessSync) {
+  if (!scope?.unit || !scope?.systemctlPath) return false;
+  try {
+    const result = spawnProcessSync(scope.systemctlPath, [
+      '--user',
+      'kill',
+      `--signal=${signalName}`,
+      scope.unit,
+    ], {
+      env: scope.env || process.env,
+      encoding: 'utf8',
+      stdio: 'ignore',
+      timeout: 5000,
+      windowsHide: true,
+    });
+    return !result.error && result.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+function isSystemdScopeInactive(scope, spawnProcessSync) {
+  if (!scope?.unit || !scope?.systemctlPath) return true;
+  try {
+    const result = spawnProcessSync(scope.systemctlPath, [
+      '--user',
+      'show',
+      '--property=ActiveState',
+      '--value',
+      scope.unit,
+    ], {
+      env: scope.env || process.env,
+      encoding: 'utf8',
+      timeout: 5000,
+      windowsHide: true,
+    });
+    const state = String(result.stdout || '').trim();
+    if (!result.error && result.status === 0) {
+      return state === 'inactive' || state === 'failed';
+    }
+    return /(?:could not be found|not found|does not exist|not loaded)/i
+      .test(String(result.stderr || ''));
+  } catch {
+    return false;
+  }
+}
+
+function killProcessTree(proc, signalName, platform, spawnProcessSync, systemdScope) {
   if (!proc.pid) return false;
   if (platform === 'win32') {
     try {
@@ -25,14 +82,18 @@ function killProcessTree(proc, signal, platform, spawnProcessSync) {
       });
       if (!result.error && result.status === 0) return true;
     } catch {}
-    try { return proc.kill(signal) !== false; } catch { return false; }
+    try { return proc.kill(signalName) !== false; } catch { return false; }
   }
+
+  let signalled = signalSystemdScope(systemdScope, signalName, spawnProcessSync);
   try {
-    process.kill(-proc.pid, signal);
-    return true;
-  } catch {
-    try { return proc.kill(signal) !== false; } catch { return false; }
-  }
+    process.kill(-proc.pid, signalName);
+    signalled = true;
+  } catch {}
+  try {
+    if (proc.kill(signalName) !== false) signalled = true;
+  } catch {}
+  return signalled;
 }
 
 /**
@@ -40,10 +101,13 @@ function killProcessTree(proc, signal, platform, spawnProcessSync) {
  *
  * @param {string} command
  * @param {string[]} args
- * @param {{ cwd?: string, signal?: AbortSignal, timeoutMs?: number, maxBytes?: number, env?: NodeJS.ProcessEnv, preserveCarriageReturns?: boolean, killGraceMs?: number, forceSettleMs?: number, platform?: NodeJS.Platform, spawnProcess?: typeof spawn, spawnProcessSync?: typeof spawnSync }} [options]
+ * @param {{ cwd?: string, signal?: AbortSignal, timeoutMs?: number, maxBytes?: number, env?: NodeJS.ProcessEnv, preserveCarriageReturns?: boolean, killGraceMs?: number, forceSettleMs?: number, requireExitConfirmation?: boolean, systemdScope?: { unit: string, systemctlPath: string, env?: NodeJS.ProcessEnv } | null, onSettled?: (() => void) | null, platform?: NodeJS.Platform, spawnProcess?: typeof spawn, spawnProcessSync?: typeof spawnSync }} [options]
  */
 export function runProcess(command, args, options = {}) {
-  if (options.signal?.aborted) return Promise.reject(abortError(options.signal));
+  if (options.signal?.aborted) {
+    try { options.onSettled?.(); } catch {}
+    return Promise.reject(abortError(options.signal));
+  }
 
   return new Promise((resolve, reject) => {
     const platform = options.platform || process.platform;
@@ -58,13 +122,20 @@ export function runProcess(command, args, options = {}) {
     const forceSettleMs = Number.isFinite(options.forceSettleMs)
       ? Math.max(1, options.forceSettleMs)
       : DEFAULT_FORCE_SETTLE_MS;
-    const proc = spawnProcess(command, args, {
-      cwd: options.cwd,
-      env: options.env || process.env,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      windowsHide: true,
-      detached: platform !== 'win32',
-    });
+    let proc;
+    try {
+      proc = spawnProcess(command, args, {
+        cwd: options.cwd,
+        env: options.env || process.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        detached: platform !== 'win32',
+      });
+    } catch (error) {
+      try { options.onSettled?.(); } catch {}
+      reject(error);
+      return;
+    }
     const stdout = [];
     const stderr = [];
     let stdoutBytes = 0;
@@ -77,26 +148,35 @@ export function runProcess(command, args, options = {}) {
     let aborted = false;
     let stopRequested = false;
     let forceRequested = false;
+    let directClosed = false;
+    let directCode = null;
     let timer = null;
     let forceTimer = null;
     let forceSettleTimer = null;
+    let confirmationTimer = null;
 
     let onStdout;
     let onStderr;
     let onError;
     let onClose;
+    let cleanedUp = false;
     const cleanup = () => {
+      if (cleanedUp) return;
+      cleanedUp = true;
       if (timer) clearTimeout(timer);
       if (forceTimer) clearTimeout(forceTimer);
       if (forceSettleTimer) clearTimeout(forceSettleTimer);
+      if (confirmationTimer) clearInterval(confirmationTimer);
       timer = null;
       forceTimer = null;
       forceSettleTimer = null;
+      confirmationTimer = null;
       options.signal?.removeEventListener('abort', onAbort);
       if (onStdout) proc.stdout?.off('data', onStdout);
       if (onStderr) proc.stderr?.off('data', onStderr);
       if (onError) proc.off('error', onError);
       if (onClose) proc.off('close', onClose);
+      try { options.onSettled?.(); } catch {}
     };
     const decode = (chunks, wasTruncated, preserveCarriageReturns = false) => {
       const decoder = new StringDecoder('utf8');
@@ -104,10 +184,14 @@ export function runProcess(command, args, options = {}) {
       if (!wasTruncated) value += decoder.end();
       return preserveCarriageReturns ? value : value.replace(/\r/g, '');
     };
-    const finish = code => {
+    const finish = (code, error = null) => {
       if (settled) return;
       settled = true;
       cleanup();
+      if (error) {
+        reject(error);
+        return;
+      }
       if (aborted) {
         reject(abortError(options.signal));
         return;
@@ -120,12 +204,40 @@ export function runProcess(command, args, options = {}) {
         timedOut,
       });
     };
+    const terminationConfirmed = () => {
+      if (!options.requireExitConfirmation) return directClosed;
+      const scopeInactive = isSystemdScopeInactive(options.systemdScope, spawnProcessSync);
+      return directClosed && scopeInactive;
+    };
+    const maybeFinishStopped = () => {
+      if (settled || !stopRequested || !terminationConfirmed()) return false;
+      finish(directCode);
+      return true;
+    };
+    const startConfirmationPolling = () => {
+      if (!options.requireExitConfirmation || confirmationTimer) return;
+      confirmationTimer = setInterval(maybeFinishStopped, CONFIRMATION_POLL_MS);
+    };
     const forceStop = () => {
       if (settled || forceRequested) return;
       forceRequested = true;
-      killProcessTree(proc, 'SIGKILL', platform, spawnProcessSync);
-      forceSettleTimer = setTimeout(() => finish(null), forceSettleMs);
-      forceSettleTimer.unref?.();
+      killProcessTree(
+        proc,
+        'SIGKILL',
+        platform,
+        spawnProcessSync,
+        options.systemdScope,
+      );
+      if (maybeFinishStopped()) return;
+      forceSettleTimer = setTimeout(() => {
+        if (maybeFinishStopped()) return;
+        finish(
+          null,
+          options.requireExitConfirmation
+            ? new ProcessTerminationError(command, forceSettleMs)
+            : null,
+        );
+      }, forceSettleMs);
     };
     const stop = () => {
       if (settled || stopRequested) return;
@@ -134,14 +246,27 @@ export function runProcess(command, args, options = {}) {
         // taskkill must run while the parent PID still identifies the tree.
         // It is already forceful, so do not wait for the direct child to exit.
         forceRequested = true;
-        killProcessTree(proc, 'SIGKILL', platform, spawnProcessSync);
+        killProcessTree(proc, 'SIGKILL', platform, spawnProcessSync, null);
         if (!settled) {
-          forceSettleTimer = setTimeout(() => finish(null), forceSettleMs);
-          forceSettleTimer.unref?.();
+          forceSettleTimer = setTimeout(() => {
+            finish(
+              null,
+              options.requireExitConfirmation
+                ? new ProcessTerminationError(command, forceSettleMs)
+                : null,
+            );
+          }, forceSettleMs);
         }
         return;
       }
-      killProcessTree(proc, 'SIGTERM', platform, spawnProcessSync);
+      startConfirmationPolling();
+      killProcessTree(
+        proc,
+        'SIGTERM',
+        platform,
+        spawnProcessSync,
+        options.systemdScope,
+      );
       forceTimer = setTimeout(forceStop, killGraceMs);
       forceTimer.unref?.();
     };
@@ -174,10 +299,19 @@ export function runProcess(command, args, options = {}) {
 
     onStdout = chunk => capture(stdout, chunk, true);
     onStderr = chunk => capture(stderr, chunk, false);
+    const finishStoppedChild = () => {
+      if (!forceRequested) {
+        if (forceTimer) clearTimeout(forceTimer);
+        forceTimer = null;
+        forceStop();
+      }
+      maybeFinishStopped();
+    };
     onError = error => {
       if (settled) return;
       if (stopRequested) {
-        finish(null);
+        directClosed = true;
+        finishStoppedChild();
         return;
       }
       settled = true;
@@ -185,11 +319,11 @@ export function runProcess(command, args, options = {}) {
       reject(error);
     };
     onClose = code => {
-      if (stopRequested && !forceRequested) {
-        // The direct child is gone. Kill any process that remained in its
-        // detached group before releasing the tool call.
-        forceRequested = true;
-        killProcessTree(proc, 'SIGKILL', platform, spawnProcessSync);
+      directClosed = true;
+      directCode = code;
+      if (stopRequested) {
+        finishStoppedChild();
+        return;
       }
       finish(code);
     };

package/yeaft/tools/registry.js

@@ -134,15 +134,16 @@ function localizeParameters(parameters, language, toolName, parameterOverrides =
  * does nothing.
  *
  * Fix: race the tool's promise against a timer. On timeout we throw a
- * loud error — the engine's existing catch (engine.js: tool-execute path)
- * emits `tool_end{isError:true}` and the loop continues normally. Loud
- * failure beats silent stall.
+ * loud error and the engine emits `tool_end{isError:true}`. Read-only and
+ * run-scoped failures can continue normally; an external side-effecting tool
+ * is terminal because its detached promise may still be running and replaying
+ * or continuing beside it is unsafe. Either way the query emits a diagnostic
+ * terminal boundary instead of silently stalling.
  *
- * 90s is comfortably above the typical tool budget (most tools complete
- * in <1s; bash and web-fetch can run tens of seconds; web-search is
- * usually <10s) but well below the 120s bridge-level watchdog so the
- * tool-level signal fires first and surfaces a useful per-tool diagnosis
- * rather than an opaque "VP stalled" log.
+ * 90s is comfortably above the typical tool budget (most tools complete in
+ * <1s; web-fetch can run tens of seconds; web-search is usually <10s). Tools
+ * with a longer owned deadline, such as Bash and WaitAgent, override this so
+ * their own cancellation/timeout result reaches the model first.
  *
  * Override per-tool by setting `tool.timeoutMs` on the ToolDef. Set to
  * 0 (or a negative number) to disable the timeout for that tool — only

package/yeaft/web-bridge.js

@@ -1111,24 +1111,19 @@ function queryTimeoutMsForSession(sessionId = null) {
 /**
  * Secondary watchdog grace period (ms).
  *
- * After the active query timeout of silence the per-VP `vpAbort` is fired.
+ * After the active provider timeout of silence the per-VP `vpAbort` is fired.
  * Normal turns use {@link QUERY_TIMEOUT_MS}; high-reasoning session turns use
- * {@link HIGH_REASONING_QUERY_TIMEOUT_MS} because large tool-result arcs can
- * legitimately spend longer before the provider emits the first SSE event.
- * That's enough on its own when adapters / tools cooperate with the
- * AbortSignal — the engine throws `AbortError`, runVpTurn's catch emits
- * `result{stopped:true}`, the driver `finally` emits `vp_typing_end`, and
- * the user is unstuck.
+ * {@link HIGH_REASONING_QUERY_TIMEOUT_MS}. Tool execution and declared retry /
+ * async-task waits pause this watchdog because those phases own separate,
+ * explicit deadlines. Treating a long tool as silent provider work races the
+ * tool's own timeout and can abort the whole query before its error result is
+ * returned to the model.
  *
- * If a tool ignores `signal` and never resolves, the engine generator's
- * `await tool.execute(...)` is permanently blocked: the abort fires on a
- * controller it never observes, and runVpTurn never returns. The same
- * applies to an adapter `stream()` that ignores `signal` (e.g. a stuck
- * SSE connection) or to tools that legitimately opt out of the per-tool
- * timeout via `timeoutMs <= 0`. The per-tool timeout in
- * {@link import('./tools/registry.js').DEFAULT_TOOL_TIMEOUT_MS}
- * is the primary cure for the tool-ignore-signal case; this bridge-level
- * escalation strictly extends it to cover the adapter and opt-out cases.
+ * If an adapter ignores `signal`, runVpTurn still cannot return after the
+ * abort. The per-tool timeout in
+ * {@link import('./tools/registry.js').DEFAULT_TOOL_TIMEOUT_MS} independently
+ * protects tool execution; this bridge-level escalation covers the adapter
+ * and any other path that ignores the query abort.
  * Without a second-stage escalation the typing dots hang forever —
  * exactly the "halts mid-execution with no turn_end" symptom.
  *
@@ -3799,6 +3794,8 @@ export function __testHandleEngineEvent(event, hctx) {
 function handleEngineEvent(event, hctx) {
   const terminalTurnEnd = event.type === 'turn_end' && event.terminal === true;
   const managesQueryTimer = terminalTurnEnd
+    || event.type === 'tool_start'
+    || event.type === 'tool_end'
     || event.type === 'async_task_wait_start'
     || event.type === 'async_task_wait_end'
     || event.type === 'llm_retry';
@@ -3886,6 +3883,11 @@ function handleEngineEvent(event, hctx) {
       break;
 
     case 'tool_start':
+      // ToolRegistry and individual tools own their execution deadlines. The
+      // bridge watchdog only protects provider silence; leaving it armed here
+      // races legitimate long tools and can abort the whole query just before
+      // the tool returns a bounded error result for the model to handle.
+      if (typeof hctx.pauseQueryTimer === 'function') hctx.pauseQueryTimer();
       sendSessionEvent({
         type: 'tool_start',
         id: event.id,
@@ -3951,12 +3953,12 @@ function handleEngineEvent(event, hctx) {
           is_error: event.isError || false,
         }],
       }, envelope);
-      // Tool finished. Do NOT speculatively flip to 'thinking' — the
-      // engine may emit more text-deltas (→ 'streaming') OR go straight
-      // to end_turn (→ 'idle' via runVpTurn's finally). The old
-      // speculative transition caused a visible 'tool → thinking →
-      // streaming' flicker on every tool call. Hold the 'tool' state
-      // until the next real event arrives.
+      // Tool execution is over, so the next silent phase is provider work
+      // again. Re-arm the provider watchdog before waiting for the next event.
+      if (typeof hctx.resetQueryTimer === 'function') hctx.resetQueryTimer();
+      // Do NOT speculatively flip to 'thinking' — the engine may emit more
+      // text-deltas (→ 'streaming') OR go straight to end_turn (→ 'idle' via
+      // runVpTurn's finally). Hold the 'tool' state until a real event arrives.
       break;
     }
 

package/yeaft/work-center/runner.js

@@ -1134,6 +1134,7 @@ export class WorkItemRunner {
     let loopCount = 0;
     let toolCount = 0;
     let checkpoint = null;
+    let terminalEngineError = null;
     const toolInputs = new Map();
     const usageStats = {
       llmRequestCount: 0,
@@ -1298,9 +1299,19 @@ export class WorkItemRunner {
             resource: checkpointResource(event.name, input, workDir),
           });
         }
+        else if (event?.type === 'error' && !terminalEngineError) {
+          terminalEngineError = event.error instanceof Error
+            ? event.error
+            : new Error(String(event.error?.message || event.error || 'Work Center Engine failed'));
+        }
         if (event?.type === 'text_delta' && typeof event.text === 'string') text += event.text;
         reportProgress(event?.type === 'loop');
       }
+      // Engine.query owns the terminal protocol and converts unexpected faults
+      // into error + terminal turn_end. Consume that boundary completely, then
+      // preserve Work Center's historical rejection semantics so Run fencing,
+      // hazardous side-effect handling, and retry policy still see the failure.
+      if (terminalEngineError) throw terminalEngineError;
     } catch (error) {
       error.workItemExecutionStats = currentProgress();
       throw error;