feat(tools): extend cancellation to browser, web, and process tools

docs/plans/analysis/2026-02-16-codebase-audit-report.md

@@ -16,7 +16,7 @@ Scope: Production-risk-first audit of bugs, code improvements, and feature oppor
 - ✅ F-008 addressed: WhatsApp Chromium launch is now sandboxed by default; no-sandbox mode is behind explicit `whatsapp.no_sandbox: true` opt-in.
 - ✅ F-014 addressed: `ModelRouter.setOnTierChange` now preserves existing listeners instead of replacing them, removing destructive listener-setter behavior.
 - ✅ F-002 addressed: `config.patch` now supports durable persistence via atomic write + backup when daemon has a concrete config path, and response includes `persisted`/`persistError` so UI can distinguish runtime-only vs disk-persisted updates.
-- ◑ F-003 partially addressed: tool execution now has an `AbortSignal` contract and executor triggers abort on timeout; host `shell.exec` and sandbox docker exec now respond to cancellation. Additional high-risk tools still need explicit cancellation coverage for full closure.
+- ◑ F-003 partially addressed: tool execution now has an `AbortSignal` contract and executor triggers abort on timeout; host `shell.exec`, sandbox docker exec, `process.start`, browser tools (`browser.navigate/click/type/content/eval/screenshot`), and web tools (`web.fetch`, `web.search`) now respond to cancellation. Remaining closure work is timeout-side-effect regression coverage.
 - ✅ F-015 addressed: retry defaults no longer classify timeout-style failures as non-retryable, improving resilience for transient timeout conditions.
 
 ## Executive Summary
@@ -24,7 +24,7 @@ Scope: Production-risk-first audit of bugs, code improvements, and feature oppor
 Current health snapshot:
 - `pnpm typecheck`: passing
 - `pnpm build`: passing
-- `pnpm test:run`: passing (`137/137` files, `1735/1735` tests)
+- `pnpm test:run`: passing (`140/140` files, `1765/1765` tests)
 - `pnpm lint`: failing (`148 errors`, `530 warnings`)
 
 Top conclusions:
@@ -113,6 +113,10 @@ Non-goals:
   - Timeout + cancellation conformance tests for cancellable tools.
   - Regression tests verifying no post-timeout side effects.
 
+Remediation update (2026-02-16):
+- Abort propagation now covers executor -> context signal -> `process.start`, browser tools, and web fetch/search tools.
+- Added aborted-signal regression tests for these tool paths.
+
 ### F-004 Medium: Lint quality gate is broken and concentrated in key runtime files
 
 - Severity: Medium

docs/plans/state.json

@@ -2552,19 +2552,27 @@
       "status": "in_progress",
       "date": "2026-02-16",
       "updated": "2026-02-16",
-      "summary": "Started timeout-cancellation hardening: added ToolExecutionContext AbortSignal contract, executor abort-on-timeout propagation, and cancellation-aware shell execution for host and sandbox docker exec paths. Remaining work: migrate additional high-risk tools and add post-timeout side-effect regression coverage.",
+      "summary": "Expanded timeout-cancellation hardening: executor AbortSignal propagation now reaches process.start, browser tools (navigate/screenshot/click/type/content/eval), and web tools (fetch/search), with pre-abort regression tests. Remaining work: add explicit post-timeout side-effect regression coverage.",
       "files_modified": [
         "src/tools/types.ts",
         "src/tools/executor.ts",
         "src/tools/executor.test.ts",
         "src/tools/builtin/shell.ts",
+        "src/tools/builtin/browser/tools.ts",
+        "src/tools/builtin/browser/tools.test.ts",
+        "src/tools/builtin/web-fetch.ts",
+        "src/tools/builtin/web-fetch.test.ts",
+        "src/tools/builtin/web-search.ts",
+        "src/tools/builtin/web-search.test.ts",
+        "src/tools/builtin/process/start.ts",
+        "src/tools/builtin/process/manager.test.ts",
         "src/sandbox/docker.ts",
         "src/sandbox/tools.ts",
         "docs/api/TOOLS.md",
         "docs/architecture/CONTRIBUTOR_MAP.md",
         "docs/plans/analysis/2026-02-16-codebase-audit-report.md"
       ],
-      "test_status": "pnpm test:run src/tools/executor.test.ts src/tools/builtin/shell.test.ts + pnpm typecheck passing"
+      "test_status": "pnpm test:run src/tools/builtin/browser/tools.test.ts src/tools/builtin/web-fetch.test.ts src/tools/builtin/web-search.test.ts src/tools/builtin/process/manager.test.ts + pnpm typecheck passing"
     },
     "audit-followup-retry-timeout-defaults": {
       "status": "completed",
@@ -2580,7 +2588,7 @@
     }
   },
   "overall_progress": {
-    "total_test_count": 1703,
+    "total_test_count": 1765,
     "all_tests_passing": true,
     "p0_completion": "3/3 (100%)",
     "p1_completion": "4/4 (100%)",