@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/tools/schedule/update.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { resolveCapabilities } from "../../runtime/capabilities.js";
 import { validateScheduleInferenceProfile } from "../../schedule/inference-profile.js";
 import { validateRruleSetLines } from "../../schedule/recurrence-engine.js";
@@ -17,6 +19,10 @@ import {
   getSchedule,
   updateSchedule,
 } from "../../schedule/schedule-store.js";
+import {
+  invalidToolInputResult,
+  nullAsOmitted,
+} from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
 const VALID_MODES: ScheduleMode[] = ["notify", "execute", "script", "workflow"];
@@ -26,6 +32,44 @@ const VALID_ROUTING_INTENTS: RoutingIntent[] = [
   "all_channels",
 ];
 
+/**
+ * Model-input schema, `safeParse`d at the top of {@link executeScheduleUpdate}.
+ * Same in-tool pattern and drift guard as {@link scheduleCreateInputSchema}
+ * in `create.ts` — see that schema's doc comment for the framework.
+ *
+ * Update-specific tolerance notes:
+ *
+ * - Presence semantics matter here (`input.x !== undefined` gates every
+ *   update), so fields are plain `.optional()` — no null-to-omitted
+ *   preprocessing that would silently turn an explicit update into a no-op.
+ * - `timezone` and `script` are nullable at runtime though advertised as
+ *   plain strings: `updateSchedule` persists null as "clear this field".
+ * - `timeout_ms` / `inference_profile` advertise null (it reverts to the
+ *   default); the executor's bespoke handling stays.
+ * - `mode`, `routing_intent`, `workflow_name`, and `workflow_args` are
+ *   deliberately UNDECLARED (loose passthrough): the first two keep bespoke
+ *   `VALID_*` errors; `workflow_name` has bespoke coercion semantics in the
+ *   resolution below; `workflow_args` accepts any JSON value.
+ */
+export const scheduleUpdateInputSchema = z.looseObject({
+  job_id: nullAsOmitted(z.string()),
+  name: z.string().optional(),
+  description: z.string().optional(),
+  syntax: z.enum(["cron", "rrule"]).optional(),
+  expression: z.string().optional(),
+  timezone: z.string().nullable().optional(),
+  message: z.string().optional(),
+  script: z.string().nullable().optional(),
+  enabled: z.boolean().optional(),
+  routing_hints: z.looseObject({}).nullable().optional(),
+  quiet: z.boolean().optional(),
+  reuse_conversation: z.boolean().optional(),
+  max_retries: z.int().optional(),
+  retry_backoff_ms: z.int().optional(),
+  timeout_ms: z.int().nullable().optional(),
+  inference_profile: z.string().nullable().optional(),
+});
+
 export async function executeScheduleUpdate(
   input: Record<string, unknown>,
   context: ToolContext,
@@ -37,19 +81,26 @@ export async function executeScheduleUpdate(
       isError: true,
     };
   }
-  const jobId = input.job_id as string;
-  if (!jobId || typeof jobId !== "string") {
+  const parsedInput = scheduleUpdateInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    return invalidToolInputResult("schedule_update", parsedInput.error);
+  }
+  const parsed = parsedInput.data;
+
+  const jobId = parsed.job_id;
+  if (!jobId) {
     return { content: "Error: job_id is required", isError: true };
   }
 
-  // Prevent changing a one-shot to recurring or vice versa
-  if (input.expression !== undefined || input.fire_at !== undefined) {
+  // Prevent changing a one-shot to recurring or vice versa. (`fire_at` is
+  // not an advertised update field, so it stays a raw-input read.)
+  if (parsed.expression !== undefined || input.fire_at !== undefined) {
     const existing = getSchedule(jobId);
     if (!existing) {
       return { content: `Error: Schedule not found: ${jobId}`, isError: true };
     }
     const isExistingOneShot = existing.expression == null;
-    if (isExistingOneShot && input.expression !== undefined) {
+    if (isExistingOneShot && parsed.expression !== undefined) {
       return {
         content:
           "Error: Cannot change a one-shot schedule to recurring. Delete and recreate instead.",
@@ -66,10 +117,12 @@ export async function executeScheduleUpdate(
   }
 
   const updates: Record<string, unknown> = {};
-  if (input.name !== undefined) updates.name = input.name;
-  if (input.description !== undefined) {
-    const description = input.description as string;
-    if (typeof description !== "string" || description.trim().length === 0) {
+  if (parsed.name !== undefined) {
+    updates.name = parsed.name;
+  }
+  if (parsed.description !== undefined) {
+    const description = parsed.description;
+    if (description.trim().length === 0) {
       return {
         content: "Error: description must be a non-empty string when provided",
         isError: true,
@@ -77,10 +130,18 @@ export async function executeScheduleUpdate(
     }
     updates.description = description;
   }
-  if (input.timezone !== undefined) updates.timezone = input.timezone;
-  if (input.message !== undefined) updates.message = input.message;
-  if (input.script !== undefined) updates.script = input.script;
-  if (input.enabled !== undefined) updates.enabled = input.enabled;
+  if (parsed.timezone !== undefined) {
+    updates.timezone = parsed.timezone;
+  }
+  if (parsed.message !== undefined) {
+    updates.message = parsed.message;
+  }
+  if (parsed.script !== undefined) {
+    updates.script = parsed.script;
+  }
+  if (parsed.enabled !== undefined) {
+    updates.enabled = parsed.enabled;
+  }
 
   // Mode validation and pass-through
   if (input.mode !== undefined) {
@@ -118,81 +179,77 @@ export async function executeScheduleUpdate(
   }
 
   // Routing hints pass-through
-  if (input.routing_hints !== undefined) {
-    updates.routingHints = input.routing_hints;
+  if (parsed.routing_hints !== undefined) {
+    updates.routingHints = parsed.routing_hints;
   }
 
   // Quiet mode
-  if (input.quiet !== undefined) {
-    updates.quiet = input.quiet;
+  if (parsed.quiet !== undefined) {
+    updates.quiet = parsed.quiet;
   }
 
   // Conversation reuse
-  if (input.reuse_conversation !== undefined) {
-    updates.reuseConversation = input.reuse_conversation;
+  if (parsed.reuse_conversation !== undefined) {
+    updates.reuseConversation = parsed.reuse_conversation;
   }
 
   // Retry policy
-  if (input.max_retries !== undefined) {
-    updates.maxRetries = input.max_retries;
+  if (parsed.max_retries !== undefined) {
+    updates.maxRetries = parsed.max_retries;
   }
-  if (input.retry_backoff_ms !== undefined) {
-    updates.retryBackoffMs = input.retry_backoff_ms;
+  if (parsed.retry_backoff_ms !== undefined) {
+    updates.retryBackoffMs = parsed.retry_backoff_ms;
   }
 
   // Inference profile override (null clears it, reverting to the default
   // main-agent model selection)
-  if (input.inference_profile !== undefined) {
-    if (input.inference_profile === null) {
+  if (parsed.inference_profile !== undefined) {
+    if (parsed.inference_profile === null) {
       updates.inferenceProfile = null;
     } else {
-      const inferenceProfile = input.inference_profile;
-      if (typeof inferenceProfile !== "string") {
-        return {
-          content: "Error: inference_profile must be a string or null",
-          isError: true,
-        };
-      }
-      const profileError = validateScheduleInferenceProfile(inferenceProfile);
+      const profileError = validateScheduleInferenceProfile(
+        parsed.inference_profile,
+      );
       if (profileError) {
         return { content: `Error: ${profileError}`, isError: true };
       }
-      updates.inferenceProfile = inferenceProfile;
+      updates.inferenceProfile = parsed.inference_profile;
     }
   }
 
   // Script execution timeout override (null clears it, reverting to default)
-  if (input.timeout_ms !== undefined) {
-    if (input.timeout_ms === null) {
+  if (parsed.timeout_ms !== undefined) {
+    if (parsed.timeout_ms === null) {
       updates.timeoutMs = null;
     } else {
-      const timeoutMs = input.timeout_ms as number;
-      const timeoutError = validateScriptTimeoutMs(timeoutMs);
+      const timeoutError = validateScriptTimeoutMs(parsed.timeout_ms);
       if (timeoutError) {
         return { content: `Error: ${timeoutError}`, isError: true };
       }
-      updates.timeoutMs = timeoutMs;
+      updates.timeoutMs = parsed.timeout_ms;
     }
   }
 
   // Auto-detect syntax when expression changes without explicit syntax
-  if (input.expression !== undefined || input.syntax !== undefined) {
+  if (parsed.expression !== undefined || parsed.syntax !== undefined) {
     const resolved = normalizeScheduleSyntax({
-      syntax: input.syntax as "cron" | "rrule" | undefined,
-      expression: input.expression as string | undefined,
+      syntax: parsed.syntax,
+      expression: parsed.expression,
     });
     if (resolved) {
       updates.syntax = resolved.syntax;
       updates.expression = resolved.expression;
-    } else if (input.expression !== undefined) {
-      updates.expression = input.expression;
-      const detected = detectScheduleSyntax(input.expression as string);
-      if (detected) updates.syntax = detected;
+    } else if (parsed.expression !== undefined) {
+      updates.expression = parsed.expression;
+      const detected = detectScheduleSyntax(parsed.expression);
+      if (detected) {
+        updates.syntax = detected;
+      }
     }
     // When only syntax is provided (no expression), normalizeScheduleSyntax returns null
     // but we still need to persist the explicit syntax value.
-    if (input.syntax !== undefined && updates.syntax === undefined) {
-      updates.syntax = input.syntax;
+    if (parsed.syntax !== undefined && updates.syntax === undefined) {
+      updates.syntax = parsed.syntax;
     }
   }
 

package/src/tools/shared/filesystem/path-policy.ts

@@ -1,4 +1,5 @@
 import { realpathSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
 import {
   basename,
   dirname,
@@ -8,6 +9,10 @@ import {
   resolve,
 } from "node:path";
 
+import { getIsContainerized } from "../../../config/env-registry.js";
+import { resolveTrailingLinkTarget } from "../../../util/fs-symlinks.js";
+import { getDotEnvPath } from "../../../util/platform.js";
+
 /**
  * Result type shared by both sandbox and host path policies.
  */
@@ -48,12 +53,15 @@ const CONTAINER_WORKSPACE_EXACT = "/workspace";
 /**
  * Resolve symlinks in an absolute path.
  *
- * For an existing path, returns its `realpathSync`. For a path that does not
- * exist yet (e.g. a `file_write` target), walks up to the nearest existing
- * ancestor, resolves that ancestor via `realpathSync`, then re-appends the
- * trailing (non-existent) components — so a symlink anywhere in the existing
- * prefix is still followed. Falls back to the lexical input when nothing on
- * the path resolves (e.g. the path lives on a filesystem this process cannot
+ * A trailing (possibly dangling) symlink chain is followed first — see
+ * {@link resolveTrailingLinkTarget} — so a link whose destination does not
+ * exist yet still reports that destination. For an existing path, returns
+ * its `realpathSync`. For a path that does not exist yet (e.g. a
+ * `file_write` target), walks up to the nearest existing ancestor, resolves
+ * that ancestor via `realpathSync`, then re-appends the trailing
+ * (non-existent) components — so a symlink anywhere in the existing prefix
+ * is still followed. Falls back to the lexical input when nothing on the
+ * path resolves (e.g. the path lives on a filesystem this process cannot
  * see, as with host_file paths proxied to a remote client).
  *
  * Used both for sandbox-boundary enforcement and to canonicalize paths before
@@ -61,7 +69,7 @@ const CONTAINER_WORKSPACE_EXACT = "/workspace";
  * file operation.
  */
 export function resolveRealPath(absolutePath: string): string {
-  let current = absolutePath;
+  let current = resolveTrailingLinkTarget(absolutePath);
   const trailing: string[] = [];
   while (current !== dirname(current)) {
     try {
@@ -79,26 +87,25 @@ export function resolveRealPath(absolutePath: string): string {
 // Sandbox policy
 // ---------------------------------------------------------------------------
 
+interface SandboxTarget {
+  /** Lexically resolved absolute path (boundary-relative input resolved). */
+  resolved: string;
+  /** Symlink-canonicalized form of `resolved`. */
+  realResolved: string;
+  /** Symlink-canonicalized boundary directory. */
+  realBoundary: string;
+}
+
 /**
- * Resolve a user-supplied path against a boundary directory and verify
- * that the result stays within it.
- *
- * For existing paths, symlinks are resolved via realpathSync so a symlink
- * pointing outside the boundary is caught. For new paths (e.g. file_write),
- * pass `mustExist: false` - the nearest existing ancestor directory is
- * resolved via realpathSync to catch symlinks in parent dirs.
- *
- * Paths starting with `/workspace/` are treated as container-scoped and
- * remapped relative to the boundary directory (the Docker sandbox mounts
- * the host workspace at /workspace).
+ * Resolve a user-supplied path against the boundary directory: apply the
+ * container /workspace remap, resolve to an absolute path, and canonicalize
+ * symlinks on both the target and the boundary.
  */
-export function sandboxPolicy(
+function resolveSandboxTarget(
   rawPath: string,
   boundaryDir: string,
-  options?: { mustExist?: boolean },
-): PathResult {
-  const mustExist = options?.mustExist ?? true;
-
+  mustExist: boolean,
+): SandboxTarget {
   // Remap container-scoped /workspace paths to the host boundary dir.
   // Skip remapping if the path already starts with boundaryDir to avoid
   // double-nesting (e.g. /workspace/project/file.ts → /workspace/project/project/file.ts
@@ -114,19 +121,24 @@ export function sandboxPolicy(
 
   const resolved = resolve(boundaryDir, effectivePath);
 
+  // Follow a trailing (possibly dangling) symlink chain first — a write
+  // through a dangling link creates the link's destination, so the
+  // containment and denial checks below must run against it.
+  const linkTarget = resolveTrailingLinkTarget(resolved);
+
   // Resolve symlinks to catch symlink-based escapes.
   // For mustExist=false, walk up to the nearest existing ancestor and
   // resolve it, then re-append the trailing components.
-  let realResolved = resolved;
+  let realResolved = linkTarget;
   if (mustExist) {
     try {
-      realResolved = realpathSync(resolved);
+      realResolved = realpathSync(linkTarget);
     } catch {
       // File doesn't exist - will be caught by the tool's own existence check
-      realResolved = resolved;
+      realResolved = linkTarget;
     }
   } else {
-    realResolved = resolveRealPath(resolved);
+    realResolved = resolveRealPath(linkTarget);
   }
 
   // Resolve the boundary directory's real path too (in case it's a symlink)
@@ -137,26 +149,220 @@ export function sandboxPolicy(
     realBoundary = boundaryDir;
   }
 
-  const rel = relative(realBoundary, realResolved);
-  if (rel.startsWith("..") || resolve(realBoundary, rel) !== realResolved) {
-    return {
-      ok: false,
-      reason: "out_of_bounds",
-      error: `Path "${rawPath}" resolves to "${realResolved}" which is outside the working directory "${realBoundary}"`,
-    };
-  }
+  return { resolved, realResolved, realBoundary };
+}
 
-  // Check both the logical path and the symlink-resolved path so a symlink
-  // with a non-denied name pointing at a denied file is still caught.
-  if (isDeniedBasename(resolved) || isDeniedBasename(realResolved)) {
+/** Whether the canonicalized target escapes the canonicalized boundary. */
+function isOutOfBounds(target: SandboxTarget): boolean {
+  const rel = relative(target.realBoundary, target.realResolved);
+  return (
+    rel.startsWith("..") ||
+    resolve(target.realBoundary, rel) !== target.realResolved
+  );
+}
+
+function outOfBoundsFailure(
+  rawPath: string,
+  target: SandboxTarget,
+): PathResult {
+  return {
+    ok: false,
+    reason: "out_of_bounds",
+    error: `Path "${rawPath}" resolves to "${target.realResolved}" which is outside the working directory "${target.realBoundary}"`,
+  };
+}
+
+// The denied check covers both the logical path and the symlink-resolved
+// path so a symlink with a non-denied name pointing at a denied file is
+// still caught.
+function deniedFailure(target: SandboxTarget): PathResult | null {
+  if (
+    isDeniedBasename(target.resolved) ||
+    isDeniedBasename(target.realResolved)
+  ) {
     return {
       ok: false,
       reason: "denied",
-      error: `Access to "${basename(resolved)}" is denied`,
+      error: `Access to "${basename(target.resolved)}" is denied`,
     };
   }
+  return null;
+}
+
+function safeUserInfoHomedir(): string {
+  try {
+    return userInfo().homedir;
+  } catch {
+    return "";
+  }
+}
+
+const SECURITY_DIR_ENV_VARS = [
+  "GATEWAY_SECURITY_DIR",
+  "CREDENTIAL_SECURITY_DIR",
+] as const;
+
+/**
+ * Secret-bearing paths the file tools must never touch, in any policy:
+ *
+ * - Gateway trust material and token signing keys (GATEWAY_SECURITY_DIR)
+ *   and CES credential keys (CREDENTIAL_SECURITY_DIR — `keys.enc`,
+ *   `store.key`). The daemon must never read from or write to them — that
+ *   data flows through the gateway and CES APIs (root AGENTS.md). The
+ *   env-based resolution mirrors the owning services', since the
+ *   cross-package import boundary bars importing it; the shared bare-metal
+ *   default `<home>/.vellum/protected` is always denied. Only absolute
+ *   overrides join the set — a relative override is unmirrorable and
+ *   disables the host fallback outright (see
+ *   {@link securityDirConfigMirrorable}).
+ * - The daemon dotenv (`<vellumRoot>/.env`), which carries provider
+ *   secrets.
+ */
+function getProtectedServicePaths(): string[] {
+  const paths = new Set<string>();
+  paths.add(
+    join(
+      process.env.HOME || safeUserInfoHomedir() || homedir(),
+      ".vellum",
+      "protected",
+    ),
+  );
+  for (const name of SECURITY_DIR_ENV_VARS) {
+    const override = process.env[name]?.trim();
+    if (override && isAbsolute(override)) {
+      paths.add(resolve(override));
+    }
+  }
+  paths.add(getDotEnvPath());
+  return [...paths];
+}
+
+/**
+ * Whether the security-dir deny set can be mirrored faithfully. A relative
+ * override resolves against the owning service's cwd, which this process
+ * cannot know — the true directory would be absent from the deny set, so
+ * the host fallback fails closed to the hard boundary instead.
+ */
+function securityDirConfigMirrorable(): boolean {
+  return SECURITY_DIR_ENV_VARS.every((name) => {
+    const override = process.env[name]?.trim();
+    return !override || isAbsolute(override);
+  });
+}
 
-  return { ok: true, resolved };
+function isWithinDir(path: string, dir: string): boolean {
+  const normalized = dir !== "/" && dir.endsWith("/") ? dir.slice(0, -1) : dir;
+  if (normalized === "/") {
+    return isAbsolute(path);
+  }
+  return path === normalized || path.startsWith(normalized + "/");
+}
+
+/**
+ * Deny a target that lands in (or on) a protected service path. Both the
+ * lexical and symlink-resolved target are checked against both the lexical
+ * and symlink-resolved protected path, so neither a symlinked target nor a
+ * symlinked directory prefix can mask the hit.
+ */
+function securityDirDenial(target: SandboxTarget): PathResult | null {
+  for (const protectedPath of getProtectedServicePaths()) {
+    const realProtectedPath = resolveRealPath(protectedPath);
+    const hit = [target.resolved, target.realResolved].some(
+      (path) =>
+        isWithinDir(path, protectedPath) ||
+        isWithinDir(path, realProtectedPath),
+    );
+    if (hit) {
+      return {
+        ok: false,
+        reason: "denied",
+        error: "Access to the service security directory is denied",
+      };
+    }
+  }
+  return null;
+}
+
+function evaluateSandboxPolicy(
+  rawPath: string,
+  boundaryDir: string,
+  options: { mustExist?: boolean } | undefined,
+  allowOutOfBounds: boolean,
+): PathResult {
+  const target = resolveSandboxTarget(
+    rawPath,
+    boundaryDir,
+    options?.mustExist ?? true,
+  );
+
+  if (!allowOutOfBounds && isOutOfBounds(target)) {
+    return outOfBoundsFailure(rawPath, target);
+  }
+
+  // Applied unconditionally — even a boundary configured to contain a
+  // service security dir must not expose it through the file tools.
+  const securityDenied = securityDirDenial(target);
+  if (securityDenied) {
+    return securityDenied;
+  }
+
+  const denied = deniedFailure(target);
+  if (denied) {
+    return denied;
+  }
+
+  return { ok: true, resolved: target.resolved };
+}
+
+/**
+ * Resolve a user-supplied path against a boundary directory and verify
+ * that the result stays within it.
+ *
+ * For existing paths, symlinks are resolved via realpathSync so a symlink
+ * pointing outside the boundary is caught. For new paths (e.g. file_write),
+ * pass `mustExist: false` - the nearest existing ancestor directory is
+ * resolved via realpathSync to catch symlinks in parent dirs.
+ *
+ * Paths starting with `/workspace/` are treated as container-scoped and
+ * remapped relative to the boundary directory (the Docker sandbox mounts
+ * the host workspace at /workspace).
+ */
+export function sandboxPolicy(
+  rawPath: string,
+  boundaryDir: string,
+  options?: { mustExist?: boolean },
+): PathResult {
+  return evaluateSandboxPolicy(rawPath, boundaryDir, options, false);
+}
+
+/**
+ * Sandbox policy that permits out-of-workspace targets on non-containerized
+ * installs.
+ *
+ * Identical to {@link sandboxPolicy} for in-bounds targets. A target that
+ * escapes the boundary is allowed with host-style validation: the basename
+ * denylist still applies to both the logical and symlink-resolved paths, and
+ * the service security directories stay denied outright.
+ * The permission lane runs before tool execution and classifies
+ * out-of-workspace file operations as elevated risk (see the gateway
+ * FileRiskClassifier), so an escape reaching this policy has already been
+ * threshold-approved or user-approved.
+ *
+ * In containerized mode the boundary stays hard: the container filesystem is
+ * not the host, and the host_file_* proxy tools are the escape hatch for the
+ * guardian's device.
+ */
+export function sandboxPolicyWithHostFallback(
+  rawPath: string,
+  boundaryDir: string,
+  options?: { mustExist?: boolean },
+): PathResult {
+  return evaluateSandboxPolicy(
+    rawPath,
+    boundaryDir,
+    options,
+    !getIsContainerized() && securityDirConfigMirrorable(),
+  );
 }
 
 // ---------------------------------------------------------------------------