dsh-ops 0.0.0-stage → 0.2.1

package/vendor/fastctx/src/shell/process.rs

@@ -0,0 +1,493 @@
+//! Cross-platform process-tree spawning for non-interactive bash commands.
+
+#[cfg(windows)]
+use process_wrap::std::CommandWrapper;
+use process_wrap::std::{ChildWrapper, CommandWrap};
+use std::io::PipeReader;
+use std::path::Path;
+#[cfg(windows)]
+use std::path::PathBuf;
+#[cfg(windows)]
+use std::process::Command;
+use std::process::{ExitStatus, Stdio};
+use std::time::{Duration, Instant};
+
+#[cfg(windows)]
+use std::os::windows::io::{AsRawHandle, FromRawHandle, OwnedHandle};
+#[cfg(windows)]
+use std::os::windows::process::CommandExt;
+
+const TERMINATION_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// Byte length of command text above which the command runs from a script file.
+///
+/// Windows CreateProcessW caps one command line at 32,767 UTF-16 units, and argument
+/// quoting can double the text in the worst case, so a long command passed straight to
+/// `bash -c` fails to spawn (os error 206). Commands over this threshold are written to
+/// a temp script instead, which has no length ceiling; 12,000 bytes doubles to well
+/// under the cap with room for the bash path and flags. Applied on every platform so
+/// behavior does not fork by OS (2026-08-08).
+const SCRIPT_SPAWN_THRESHOLD_BYTES: usize = 12_000;
+
+/// A spawned bash process whose kill operation covers the whole descendant tree.
+#[derive(Debug)]
+pub(crate) struct ManagedProcess {
+    child: Box<dyn ChildWrapper>,
+    output: Option<PipeReader>,
+    /// Keeps an over-threshold command's script file alive until the process is reaped.
+    _command_script: Option<tempfile::TempPath>,
+}
+
+impl ManagedProcess {
+    pub(crate) fn id(&self) -> u32 {
+        self.child.id()
+    }
+
+    pub(crate) fn take_output(&mut self) -> PipeReader {
+        self.output
+            .take()
+            .expect("the merged output pipe is taken exactly once")
+    }
+
+    pub(crate) fn try_wait(&mut self) -> std::io::Result<Option<ExitStatus>> {
+        self.child.try_wait()
+    }
+
+    pub(crate) fn kill_tree(&mut self) -> std::io::Result<()> {
+        match self.child.start_kill() {
+            Ok(()) => Ok(()),
+            Err(error)
+                if matches!(
+                    error.kind(),
+                    std::io::ErrorKind::InvalidInput | std::io::ErrorKind::NotFound
+                ) =>
+            {
+                Ok(())
+            }
+            Err(error) => Err(error),
+        }
+    }
+
+    /// Kills the whole tree and waits with a hard bound so an OS failure cannot hang the MCP call.
+    pub(crate) fn terminate_tree(&mut self) -> std::io::Result<ExitStatus> {
+        let kill_result = self.kill_tree();
+        let deadline = Instant::now() + TERMINATION_TIMEOUT;
+        loop {
+            match self.try_wait()? {
+                Some(status) => return Ok(status),
+                None if Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(10));
+                }
+                None => {
+                    return Err(kill_result.err().unwrap_or_else(|| {
+                        std::io::Error::new(
+                            std::io::ErrorKind::TimedOut,
+                            "the process tree did not exit within 5 seconds after termination",
+                        )
+                    }));
+                }
+            }
+        }
+    }
+}
+
+impl Drop for ManagedProcess {
+    fn drop(&mut self) {
+        let _ = self.kill_tree();
+    }
+}
+
+/// Spawns a login or clean non-login bash with one merged stdout/stderr pipe.
+pub(crate) fn spawn_bash(
+    bash: &Path,
+    command_text: &str,
+    cwd: &Path,
+    login_shell: bool,
+    environment: &crate::session::SessionEnvironment,
+    utf8_locale: &str,
+) -> std::io::Result<ManagedProcess> {
+    let (reader, writer) = std::io::pipe()?;
+    let mut command = crate::process_policy::noninteractive_command(bash);
+    environment.configure_command(&mut command);
+    let command_script = if command_text.len() > SCRIPT_SPAWN_THRESHOLD_BYTES {
+        let script = write_command_script(command_text)?;
+        if login_shell {
+            command.arg("-l");
+        } else {
+            command.args(["--noprofile", "--norc"]);
+        }
+        command.arg(script_operand(&script));
+        Some(script)
+    } else {
+        if login_shell {
+            command.arg("-lc");
+        } else {
+            command.args(["--noprofile", "--norc", "-c"]);
+        }
+        command.arg(command_text);
+        None
+    };
+    command
+        .current_dir(cwd)
+        .stdin(Stdio::null())
+        .stdout(writer.try_clone()?)
+        .stderr(writer)
+        .env("LANG", utf8_locale)
+        .env("LC_ALL", utf8_locale)
+        .env("TERM", "dumb")
+        .env("NO_COLOR", "1")
+        .env("CLICOLOR", "0")
+        .env("FORCE_COLOR", "0")
+        .env("PAGER", "cat")
+        .env("GIT_PAGER", "cat")
+        .env("GIT_EDITOR", "true")
+        .env("EDITOR", "true")
+        .env("VISUAL", "true")
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .env("PYTHONUNBUFFERED", "1")
+        .env("PYTHONIOENCODING", "utf-8");
+
+    #[cfg(windows)]
+    if !login_shell {
+        prepend_windows_toolset(&mut command, bash, environment);
+    }
+    #[cfg(windows)]
+    if login_shell && environment.var_os(MSYS_PATH_TYPE).is_none() {
+        command.env(MSYS_PATH_TYPE, "inherit");
+    }
+
+    let mut wrapped = CommandWrap::from(command);
+    #[cfg(unix)]
+    wrapped.wrap(process_wrap::std::ProcessSession);
+    #[cfg(windows)]
+    wrapped.wrap(KillOnCloseJobObject);
+    let child = wrapped.spawn()?;
+    drop(wrapped);
+    Ok(ManagedProcess {
+        child,
+        output: Some(reader),
+        _command_script: command_script,
+    })
+}
+
+/// Writes over-threshold command text to a private temp script deleted when dropped.
+fn write_command_script(command_text: &str) -> std::io::Result<tempfile::TempPath> {
+    use std::io::Write;
+
+    let mut script = tempfile::Builder::new()
+        .prefix("fastctx-command-")
+        .suffix(".sh")
+        .tempfile()?;
+    script.write_all(command_text.as_bytes())?;
+    script.flush()?;
+    Ok(script.into_temp_path())
+}
+
+/// Renders the script path as the bash operand.
+fn script_operand(script: &tempfile::TempPath) -> std::ffi::OsString {
+    #[cfg(windows)]
+    {
+        // The msys argument layer passes a native absolute path through cleanly only in
+        // forward-slash form; backslashes are exposed to POSIX escaping rules.
+        std::ffi::OsString::from(script.to_string_lossy().replace('\\', "/"))
+    }
+    #[cfg(not(windows))]
+    {
+        script.as_os_str().to_os_string()
+    }
+}
+
+/// Owns a Windows Job Object whose process tree dies even if the supervising process is killed.
+///
+/// `process-wrap`'s synchronous JobObject deliberately omits
+/// `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`. That is insufficient for persistent
+/// background jobs: an externally terminated supervisor would drop its handle
+/// without running Rust destructors and leave the bash tree orphaned. This
+/// wrapper keeps the child suspended until assignment and makes the kernel
+/// enforce the ownership invariant.
+#[cfg(windows)]
+#[derive(Debug)]
+struct KillOnCloseJobObject;
+
+#[cfg(windows)]
+impl CommandWrapper for KillOnCloseJobObject {
+    fn pre_spawn(&mut self, command: &mut Command, _core: &CommandWrap) -> std::io::Result<()> {
+        use windows_sys::Win32::System::Threading::CREATE_SUSPENDED;
+
+        command.creation_flags(crate::process_policy::noninteractive_creation_flags(
+            CREATE_SUSPENDED,
+        ));
+        Ok(())
+    }
+
+    fn wrap_child(
+        &mut self,
+        mut child: Box<dyn ChildWrapper>,
+        _core: &CommandWrap,
+    ) -> std::io::Result<Box<dyn ChildWrapper>> {
+        let process_handle = child.inner_child().as_raw_handle();
+        let job = match create_kill_on_close_job(process_handle) {
+            Ok(job) => job,
+            Err(error) => {
+                let _ = child.start_kill();
+                let _ = child.wait();
+                return Err(error);
+            }
+        };
+        if let Err(error) = resume_process_threads(child.id()) {
+            let _ = terminate_job(&job);
+            let _ = child.wait();
+            return Err(error);
+        }
+        Ok(Box::new(KillOnCloseJobChild {
+            inner: Some(child),
+            job,
+        }))
+    }
+}
+
+#[cfg(windows)]
+#[derive(Debug)]
+struct KillOnCloseJobChild {
+    inner: Option<Box<dyn ChildWrapper>>,
+    job: OwnedHandle,
+}
+
+#[cfg(windows)]
+impl ChildWrapper for KillOnCloseJobChild {
+    fn inner(&self) -> &dyn ChildWrapper {
+        self.inner
+            .as_deref()
+            .expect("the child wrapper is present until it is consumed")
+    }
+
+    fn inner_mut(&mut self) -> &mut dyn ChildWrapper {
+        self.inner
+            .as_deref_mut()
+            .expect("the child wrapper is present until it is consumed")
+    }
+
+    fn into_inner(mut self: Box<Self>) -> Box<dyn ChildWrapper> {
+        let _ = terminate_job(&self.job);
+        self.inner
+            .take()
+            .expect("the child wrapper is consumed exactly once")
+    }
+
+    fn start_kill(&mut self) -> std::io::Result<()> {
+        terminate_job(&self.job)
+    }
+}
+
+#[cfg(windows)]
+fn create_kill_on_close_job(
+    process_handle: std::os::windows::io::RawHandle,
+) -> std::io::Result<OwnedHandle> {
+    use std::ffi::c_void;
+    use windows_sys::Win32::System::JobObjects::{
+        AssignProcessToJobObject, CreateJobObjectW, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+        JOBOBJECT_EXTENDED_LIMIT_INFORMATION, JobObjectExtendedLimitInformation,
+        SetInformationJobObject,
+    };
+
+    // SAFETY: null security/name arguments request an unnamed job with default
+    // security. The returned owned handle is closed on every exit path.
+    let raw_job = unsafe { CreateJobObjectW(std::ptr::null(), std::ptr::null()) };
+    if raw_job.is_null() {
+        return Err(std::io::Error::last_os_error());
+    }
+    // SAFETY: CreateJobObjectW returned a fresh handle owned by this function.
+    let job = unsafe { OwnedHandle::from_raw_handle(raw_job.cast()) };
+    let mut limits = JOBOBJECT_EXTENDED_LIMIT_INFORMATION::default();
+    limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+    // SAFETY: both pointers remain valid for the duration of each synchronous
+    // call, and the buffer size exactly matches the declared information class.
+    let configured = unsafe {
+        SetInformationJobObject(
+            job.as_raw_handle().cast(),
+            JobObjectExtendedLimitInformation,
+            (&limits as *const JOBOBJECT_EXTENDED_LIMIT_INFORMATION).cast::<c_void>(),
+            std::mem::size_of_val(&limits) as u32,
+        )
+    };
+    if configured == 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+    // SAFETY: the process is still suspended, so no descendant can escape
+    // between assignment and resumption.
+    let assigned =
+        unsafe { AssignProcessToJobObject(job.as_raw_handle().cast(), process_handle.cast()) };
+    if assigned == 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+    Ok(job)
+}
+
+#[cfg(windows)]
+fn resume_process_threads(pid: u32) -> std::io::Result<()> {
+    use windows_sys::Win32::Foundation::{CloseHandle, INVALID_HANDLE_VALUE};
+    use windows_sys::Win32::System::Diagnostics::ToolHelp::{
+        CreateToolhelp32Snapshot, TH32CS_SNAPTHREAD, THREADENTRY32, Thread32First, Thread32Next,
+    };
+    use windows_sys::Win32::System::Threading::{OpenThread, ResumeThread, THREAD_SUSPEND_RESUME};
+
+    // SAFETY: the snapshot handle is closed below on every path after creation.
+    let snapshot = unsafe { CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0) };
+    if snapshot == INVALID_HANDLE_VALUE {
+        return Err(std::io::Error::last_os_error());
+    }
+    let mut entry = THREADENTRY32 {
+        dwSize: std::mem::size_of::<THREADENTRY32>() as u32,
+        ..Default::default()
+    };
+    // SAFETY: entry has the documented size and remains live while enumerated.
+    let mut has_entry = unsafe { Thread32First(snapshot, &mut entry) };
+    let mut result = if has_entry == 0 {
+        Err(std::io::Error::last_os_error())
+    } else {
+        Ok(())
+    };
+    let mut resumed_any = false;
+    while has_entry != 0 {
+        if entry.th32OwnerProcessID == pid {
+            // SAFETY: the thread id comes from the live system snapshot.
+            let thread = unsafe { OpenThread(THREAD_SUSPEND_RESUME, 0, entry.th32ThreadID) };
+            if thread.is_null() {
+                result = Err(std::io::Error::last_os_error());
+                break;
+            }
+            // SAFETY: the handle was opened with THREAD_SUSPEND_RESUME.
+            let resumed = unsafe { ResumeThread(thread) };
+            let resume_error = std::io::Error::last_os_error();
+            // SAFETY: this function owns the thread handle.
+            let closed = unsafe { CloseHandle(thread) };
+            if resumed == u32::MAX {
+                result = Err(resume_error);
+                break;
+            }
+            if closed == 0 {
+                result = Err(std::io::Error::last_os_error());
+                break;
+            }
+            resumed_any = true;
+        }
+        // SAFETY: snapshot and entry remain valid for the next enumeration step.
+        has_entry = unsafe { Thread32Next(snapshot, &mut entry) };
+    }
+    // SAFETY: this function owns the snapshot handle.
+    let closed = unsafe { CloseHandle(snapshot) };
+    if result.is_ok() && closed == 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+    if result.is_ok() && !resumed_any {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::NotFound,
+            format!("cannot find a suspended thread for process {pid}"),
+        ));
+    }
+    result
+}
+
+#[cfg(windows)]
+fn terminate_job(job: &OwnedHandle) -> std::io::Result<()> {
+    use windows_sys::Win32::System::JobObjects::TerminateJobObject;
+
+    // SAFETY: job is a live Job Object handle owned by the wrapper.
+    if unsafe { TerminateJobObject(job.as_raw_handle().cast(), 1) } == 0 {
+        Err(std::io::Error::last_os_error())
+    } else {
+        Ok(())
+    }
+}
+
+/// Selects how the msys `/etc/profile` composes PATH out of the Windows PATH it inherits.
+///
+/// Git for Windows defaults this to `inherit`, but an msys2 installation defaults to `minimal`,
+/// whose profile *replaces* the inherited PATH with four Windows system directories — so a login
+/// shell there resolves none of the user's own tools. `prepend_windows_toolset` is the non-login
+/// counterpart; a login shell needs this instead, because profile runs after we hand over the
+/// environment. An explicit value is always left alone: choosing `minimal` or `strict` is a
+/// deliberate isolation choice that belongs to whoever made it.
+#[cfg(windows)]
+const MSYS_PATH_TYPE: &str = "MSYS2_PATH_TYPE";
+
+/// Gives a non-login Windows bash the Git-for-Windows Unix toolset on PATH.
+///
+/// `--noprofile --norc` never sources `/etc/profile`, which is what normally puts
+/// `/usr/bin` (coreutils, sed, grep, awk) and `/mingw*/bin` (git) on PATH. Without
+/// them a clean shell resolves no external command and every one fails with 127 —
+/// whenever the server was launched from a host whose PATH lacks those directories
+/// (e.g. Codex started from PowerShell rather than Git Bash). We prepend the toolset
+/// directories in native Windows form; the msys runtime rewrites them to POSIX for
+/// the child. A login shell needs none of this — profile sets it up — so it is left
+/// untouched.
+#[cfg(windows)]
+fn prepend_windows_toolset(
+    command: &mut Command,
+    bash: &Path,
+    environment: &crate::session::SessionEnvironment,
+) {
+    let Some(usr_bin) = bash.parent() else { return };
+    let mut dirs: Vec<PathBuf> = vec![usr_bin.to_path_buf()];
+    // Auto-discovered bash is <GitRoot>\usr\bin\bash.exe; git lives in <GitRoot>\mingw*\bin.
+    if let Some(git_root) = usr_bin.parent().and_then(Path::parent) {
+        for arch in ["mingw64", "mingw32", "clangarm64"] {
+            let bin = git_root.join(arch).join("bin");
+            if bin.is_dir() {
+                dirs.push(bin);
+            }
+        }
+    }
+    let Ok(mut path) = std::env::join_paths(&dirs) else {
+        return;
+    };
+    if let Some(existing) = environment.var_os("PATH")
+        && !existing.is_empty()
+    {
+        path.push(";");
+        path.push(&existing);
+    }
+    command.env("PATH", path);
+}
+
+pub(crate) fn detect_utf8_locale(
+    bash: &Path,
+    environment: &crate::session::SessionEnvironment,
+) -> String {
+    let mut command = crate::process_policy::noninteractive_command(bash);
+    environment.configure_command(&mut command);
+    let available = command
+        .args(["-lc", "locale -a 2>/dev/null || true"])
+        .stdin(Stdio::null())
+        .output()
+        .ok()
+        .map(|output| String::from_utf8_lossy(&output.stdout).to_ascii_lowercase())
+        .unwrap_or_default();
+    select_utf8_locale(&available).to_string()
+}
+
+fn select_utf8_locale(available: &str) -> &'static str {
+    if available
+        .lines()
+        .any(|locale| matches!(locale.trim(), "c.utf8" | "c.utf-8"))
+    {
+        "C.UTF-8"
+    } else {
+        "en_US.UTF-8"
+    }
+}
+
+/// Converts signal exits to the bash-compatible `128 + signal` convention.
+pub(crate) fn exit_code(status: ExitStatus) -> i32 {
+    if let Some(code) = status.code() {
+        return code;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::ExitStatusExt;
+        if let Some(signal) = status.signal() {
+            return 128 + signal;
+        }
+    }
+    1
+}

package/vendor/fastctx/src/shell_server.rs

@@ -0,0 +1,156 @@
+// Modified by dsh-ops (https://github.com/T-Auto/dsh-ops): the run_background description no longer names Codex as a restart partner.
+//! Shell-tool routes merged into the single `fastctx` server.
+
+use crate::budget::{GLOBAL_TOKEN_BUDGET_ENV, JOB_OUTPUT_TOKEN_BUDGET_ENV, RUN_TOKEN_BUDGET_ENV};
+use crate::server::FastCtxServer;
+use crate::server_support::{BudgetRetry, run_blocking};
+use crate::shell::{
+    JobKillRequest, JobListRequest, JobOutputRequest, RunBackgroundRequest, RunRequest,
+};
+use rmcp::RoleServer;
+use rmcp::handler::server::wrapper::Parameters;
+use rmcp::model::CallToolResult;
+use rmcp::service::RequestContext;
+use rmcp::{tool, tool_router};
+use std::sync::Arc;
+
+#[tool_router(router = shell_tool_router, vis = "pub(crate)")]
+impl FastCtxServer {
+    #[tool(
+        name = "run",
+        description = "Use for non-interactive local CLI work, including Git, build/test tools,\npackage managers, database CLIs, and project scripts. Commands run with bash\n(Git Bash on Windows; system bash elsewhere) and return merged stdout+stderr\nwith the exit code. Write POSIX bash — never PowerShell. There is no TTY or\nstdin; use flags like -y or --no-edit. A non-zero exit code is a normal\nresult, not an error. Oversized output is truncated; for the full output,\nredirect it to a file (command > file 2>&1) and page that file with\ninspect_local_file.\nDefault timeout 120000 ms, ceiling 240000 — start anything that may outlast\nit with run_background. If output looks garbled (U+FFFD), pass encoding\n(e.g. \"gbk\"). The last line states Complete, Partial, or Killed.",
+        annotations(
+            title = "Run bash command",
+            read_only_hint = false,
+            destructive_hint = false,
+            open_world_hint = false
+        )
+    )]
+    async fn run(
+        &self,
+        Parameters(request): Parameters<RunRequest>,
+        context: RequestContext<RoleServer>,
+    ) -> CallToolResult {
+        let _activity = self.activity.request();
+        let shell = self.shell.clone();
+        let status_shell = self.shell.clone();
+        run_blocking(
+            Arc::clone(&self.session),
+            Arc::clone(&self.shell_permits),
+            RUN_TOKEN_BUDGET_ENV,
+            move || status_shell.background_status(None),
+            BudgetRetry::Never,
+            move || shell.run_until_cancelled(request.clone(), || context.ct.is_cancelled()),
+        )
+        .await
+    }
+
+    #[tool(
+        name = "run_background",
+        description = "Start a bash command as a background job and return its job_id\nimmediately. Use for builds, tests, servers, or anything that may outlast\nrun's four-minute maximum. Jobs survive server restarts; their\noutput and exit code stay retrievable by job_id. Check on it with\njob_output; stop with job_kill; rediscover past jobs with job_list. There\nis no timeout: a job runs until it exits or is killed. Everything it\nprints is kept in a plain log file whose path is returned here;\ninspect_local_file or grep that path for anything job_output does not show. While your jobs\nrun, every FastCtx result carries a one-line background status naming\neach job and how long it has run, just above the closing Complete or\nPartial line. It is a readout, not a notification: it refreshes only when\nyou call a tool, so keep working — nothing reaches you if you stop.",
+        annotations(
+            title = "Start background bash job",
+            read_only_hint = false,
+            destructive_hint = false,
+            open_world_hint = false
+        )
+    )]
+    async fn run_background(
+        &self,
+        Parameters(request): Parameters<RunBackgroundRequest>,
+    ) -> CallToolResult {
+        let _activity = self.activity.request();
+        let shell = self.shell.clone();
+        let status_shell = self.shell.clone();
+        run_blocking(
+            Arc::clone(&self.session),
+            Arc::clone(&self.shell_permits),
+            GLOBAL_TOKEN_BUDGET_ENV,
+            move || status_shell.background_status(None),
+            BudgetRetry::Never,
+            move || shell.run_background(request.clone()),
+        )
+        .await
+    }
+
+    #[tool(
+        name = "job_output",
+        description = "Query a background job: its status (running, exited with its code,\nkilled, or interrupted) plus output you have not been shown yet. Works for jobs\nstarted in earlier sessions. Long output is windowed: the newest lines\nthat fit, the start of the log on the first call, and a note naming the\nexact lines skipped. The job's whole output is a plain log file on disk\nwhose line numbers are the seq numbers used here, so inspect_local_file or\ngrep that path for anything not shown. The call blocks up to wait_ms, so raise it\nonly when you have nothing else to do. If output looks garbled (U+FFFD),\ncall again with encoding set to the source encoding (e.g. \"gbk\").\nComplete appears only once the job ends; servers and watchers never reach\nit. Take what you need and keep working — the background status on your\nnext result carries this job's state.",
+        annotations(
+            title = "Check background job output",
+            read_only_hint = true,
+            destructive_hint = false,
+            open_world_hint = false
+        )
+    )]
+    async fn job_output(
+        &self,
+        Parameters(request): Parameters<JobOutputRequest>,
+        context: RequestContext<RoleServer>,
+    ) -> CallToolResult {
+        let _activity = self.activity.request();
+        let shell = self.shell.clone();
+        let status_shell = self.shell.clone();
+        let excluded_job = request.job_id.clone();
+        run_blocking(
+            Arc::clone(&self.session),
+            Arc::clone(&self.shell_permits),
+            JOB_OUTPUT_TOKEN_BUDGET_ENV,
+            move || status_shell.background_status(Some(&excluded_job)),
+            BudgetRetry::Never,
+            move || shell.job_output_until_cancelled(request.clone(), || context.ct.is_cancelled()),
+        )
+        .await
+    }
+
+    #[tool(
+        name = "job_kill",
+        description = "Kill a background job's whole process tree. Killing a job that has\nalready exited is not an error.",
+        annotations(
+            title = "Kill background job",
+            read_only_hint = false,
+            destructive_hint = false,
+            open_world_hint = false
+        )
+    )]
+    async fn job_kill(&self, Parameters(request): Parameters<JobKillRequest>) -> CallToolResult {
+        let _activity = self.activity.request();
+        let shell = self.shell.clone();
+        let status_shell = self.shell.clone();
+        let excluded_job = request.job_id.clone();
+        run_blocking(
+            Arc::clone(&self.session),
+            Arc::clone(&self.shell_permits),
+            GLOBAL_TOKEN_BUDGET_ENV,
+            move || status_shell.background_status(Some(&excluded_job)),
+            BudgetRetry::Never,
+            move || shell.job_kill(request.clone()),
+        )
+        .await
+    }
+
+    #[tool(
+        name = "job_list",
+        description = "List background jobs across all FastCtx sessions for the current user. Use\nstatus=\"all\" only when both lifecycles are needed. Results are newest first\nwithin each lifecycle. Finished records remain available until the job\nstorage limit evicts the oldest.",
+        annotations(
+            title = "List background jobs",
+            read_only_hint = true,
+            destructive_hint = false,
+            open_world_hint = false
+        )
+    )]
+    async fn job_list(&self, Parameters(request): Parameters<JobListRequest>) -> CallToolResult {
+        let _activity = self.activity.request();
+        let shell = self.shell.clone();
+        let status_shell = self.shell.clone();
+        run_blocking(
+            Arc::clone(&self.session),
+            Arc::clone(&self.shell_permits),
+            GLOBAL_TOKEN_BUDGET_ENV,
+            move || status_shell.background_status(None),
+            BudgetRetry::Never,
+            move || shell.job_list(request.clone()),
+        )
+        .await
+    }
+}