feat(core): stop a hung tool from hanging the whole turn

[oratis]

Third implementation PR from docs/DSH_ADOPTION_PLAN.md §1.3.

The gap

Only Bash bounded itself. Every other tool could hang the agent turn forever — a Grep against a stalled network mount, a fetch wedged before its own timer arms — and what the user sees is a blinking cursor with no way to distinguish a slow command from a dead one.

Backstop, not primary timeout

This is the part worth reviewing, because it is the opposite of how a timeout usually gets added. The opponent case in the plan was that most tools already bound themselves and a second layer creates ambiguous "which timeout fired" semantics.

That argument is correct, so the design concedes to it: the default is 10 minutes, deliberately far above every inner limit, and the inner limit is supposed to win. [killed by timeout after 120000ms] is a better error than a generic backstop message. This layer only covers the case where the inner limit does not fire at all.

A caller-requested timeout in the tool's own arguments always wins when it is longer. Bash({ timeout: 900000 }) is an explicit request for a 15-minute command; a 10-minute backstop killing it would make the parameter a lie. The resolver adds 30s of grace on top so the tool's own limit still fires first.

It does not claim the work stopped

For Bash, Edit, Write, NotebookEdit the message says the effect is unknown — "may still be running… check the current state before retrying" — rather than implying nothing happened. Abandoning the wait does not abort the work. The process may well still be going, and reporting otherwise would be a guess presented as a fact. Read-only tools get the more useful "narrow the request and try again" instead.

One bug the tests caught

The first implementation aborted the signal and then settled the race. A well-behaved tool resolves synchronously from its abort listener, so its own "stopped" result won the race — and the deadline message vanished, including its warning that a side effect might be half-applied. The order is now settle-then-abort, with a comment saying why, because the correct order looks arbitrary until it bites.

Verification

pnpm typecheck, lint, format:check clean. Full suite green — core 1076 passed / 28 skipped, plus cli 242, desktop 104, server 49, protocol 34, lsp 13, vscode 12, scripts 42.

13 new tests: 10 unit over the resolver and message (per-tool overrides, requested-timeout precedence, the 30s grace, unusable timeout arguments, side-effect wording) and 3 through the real loop — a tool that never returns on its own, proof its signal is actually aborted, and proof a tool returning in time is untouched.

Off by toolDeadlines: { disabled: true }; default and per-tool values are configurable.