@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/tools/tool-input-schemas.ts

@@ -0,0 +1,85 @@
+import type { z } from "zod";
+
+import { askQuestionInputSchema } from "./ask-question/ask-question-tool.js";
+import { fileEditInputSchema } from "./filesystem/edit.js";
+import { fileListInputSchema } from "./filesystem/list.js";
+import { fileReadInputSchema } from "./filesystem/read.js";
+import { fileWriteInputSchema } from "./filesystem/write.js";
+import { hostFileEditInputSchema } from "./host-filesystem/edit.js";
+import { hostFileReadInputSchema } from "./host-filesystem/read.js";
+import { hostFileWriteInputSchema } from "./host-filesystem/write.js";
+import { hostShellInputSchema } from "./host-terminal/host-shell.js";
+import { formatToolInputError } from "./shared/zod-tool-schema.js";
+import { notifyParentInputSchema } from "./subagent/notify-parent.js";
+import { requestSystemPermissionInputSchema } from "./system/request-permission.js";
+import { shellInputSchema } from "./terminal/shell.js";
+
+/**
+ * Per-tool Zod input schemas, keyed by tool name. Tool calls are a
+ * discriminated payload — the tool name determines the shape of `input` —
+ * but the model's JSON arrives untrusted, so the pre-execution gate
+ * (`ToolApprovalHandler.checkPreExecutionGates`) parses it against this
+ * registry (via {@link parseToolInput}) before any executor reads a field —
+ * and, crucially, before any one-time grant is consumed or guardian
+ * escalation starts, so a malformed call can never interrupt the guardian.
+ * Each schema is also the source the tool derives its advertised
+ * `input_schema` from (`toToolInputSchema` in `shared/zod-tool-schema.ts`),
+ * so the model-facing contract and the runtime validation cannot drift.
+ *
+ * Covers built-in (`default`-owned) tools only — skill / plugin / MCP /
+ * workspace tools own their schemas elsewhere, and the executor skips this
+ * registry for them (a workspace override of a built-in name must not be
+ * validated against the built-in's schema).
+ *
+ * Authoring rules, so validation never tightens behavior a tool already
+ * tolerates:
+ *
+ * - Top-level schemas are `z.looseObject` — unknown keys (including the
+ *   injected `activity` field, see `schema-transforms.ts`) pass through.
+ * - A field the tool silently ignores when malformed gets
+ *   `.optional().catch(undefined)` so a bad value degrades exactly as the
+ *   tool always degraded, instead of failing the call.
+ * - Fields the advertised schema requires only to guide the model (e.g.
+ *   `activity`, which is status-only and never read by the tool) stay
+ *   optional-with-`.catch(undefined)` here; the derivation marks them
+ *   required via `advertiseRequired`.
+ */
+export const TOOL_INPUT_SCHEMAS: Readonly<Record<string, z.ZodType>> = {
+  ask_question: askQuestionInputSchema,
+  bash: shellInputSchema,
+  file_edit: fileEditInputSchema,
+  file_list: fileListInputSchema,
+  file_read: fileReadInputSchema,
+  file_write: fileWriteInputSchema,
+  host_bash: hostShellInputSchema,
+  host_file_edit: hostFileEditInputSchema,
+  host_file_read: hostFileReadInputSchema,
+  host_file_write: hostFileWriteInputSchema,
+  notify_parent: notifyParentInputSchema,
+  request_system_permission: requestSystemPermissionInputSchema,
+};
+
+/**
+ * Validate model-supplied tool input against the registered schema for
+ * `name`, returning the parsed value (with `.catch()` recoveries applied) or
+ * a descriptive, model-correctable error message. A tool with no registered
+ * schema passes through unchanged.
+ */
+export function parseToolInput(
+  name: string,
+  input: Record<string, unknown>,
+):
+  | { ok: true; data: Record<string, unknown> }
+  | { ok: false; message: string } {
+  const schema = TOOL_INPUT_SCHEMAS[name];
+  if (!schema) {
+    return { ok: true, data: input };
+  }
+  const result = schema.safeParse(input);
+  if (!result.success) {
+    return { ok: false, message: formatToolInputError(name, result.error) };
+  }
+  // Every registry schema is an object schema, so the parsed value is a
+  // plain record; `z.ZodType`'s output is just too wide to say so statically.
+  return { ok: true, data: result.data as Record<string, unknown> };
+}

package/src/tools/tool-types.ts

@@ -240,6 +240,13 @@ export interface ToolContext {
    * equivalent instead of emitting a surface the channel silently drops.
    */
   supportsDynamicUi?: boolean;
+  /**
+   * Whether a parked `ask_question` on this turn's channel can be delivered as
+   * a guardian-request card with tappable answer options; `undefined`/`false`
+   * means no card delivery is possible. See the ToolContext field of the same
+   * name in `types.ts`.
+   */
+  supportsGuardianQuestionCards?: boolean;
   /** When true, tools with side effects should always prompt for confirmation. */
   forcePromptSideEffects?: boolean;
   /**

package/src/tools/types.ts

@@ -198,6 +198,14 @@ export interface ToolContext {
    * supported (desktop/web/app clients).
    */
   supportsDynamicUi?: boolean;
+  /**
+   * Whether a parked `ask_question` on this turn's channel can be delivered as
+   * a guardian-request card with tappable answer options (via the notification
+   * pipeline's channel adapters). `ask_question` parks when this is true even
+   * without dynamic UI; otherwise channel turns degrade to the plain-text
+   * fallback. `undefined`/`false` means no card delivery is possible.
+   */
+  supportsGuardianQuestionCards?: boolean;
   /**
    * When set, the tool execution is part of a task run. Used to retrieve ephemeral permission rules.
    * @legacy

package/src/tools/workflows/manage-workflows.ts

@@ -13,19 +13,45 @@
  * by the type checker.
  */
 
+import { z } from "zod";
+
 import { getEffectiveProfiles } from "../../config/default-profile-catalog.js";
 import { loadConfig } from "../../config/loader.js";
 import { callerOwnsWorkflowRun } from "../../workflows/capabilities.js";
 import type { WorkflowRun } from "../../workflows/journal-store.js";
 import { getWorkflowRunManager } from "../../workflows/run-manager.js";
+import {
+  invalidToolInputResult,
+  nullAsOmitted,
+} from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
+/**
+ * Model-input schema, `safeParse`d at the top of
+ * {@link executeManageWorkflows}. Same in-tool pattern and TOOLS.json drift
+ * guard as the other bundled-skill tools — see the schema block in
+ * `tools/document/document-tool.ts` for the framework.
+ *
+ * `action` is deliberately UNDECLARED (loose passthrough): the switch's
+ * default case owns the unknown-action error, and `executor.ts` reads
+ * `input.action` / `input.run_id` pre-execution for the requireFreshApproval
+ * promotion (those reads are already defensive and see the raw input either
+ * way).
+ */
+export const manageWorkflowsInputSchema = z.looseObject({
+  run_id: nullAsOmitted(z.string()),
+});
+
 export async function executeManageWorkflows(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
+  const parsedInput = manageWorkflowsInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    return invalidToolInputResult("manage_workflows", parsedInput.error);
+  }
   const action = input.action as string | undefined;
-  const runId = input.run_id as string | undefined;
+  const runId = parsedInput.data.run_id;
   const manager = getWorkflowRunManager();
 
   // Authorization scope ({@link callerOwnsWorkflowRun}, shared with the
@@ -104,7 +130,9 @@ export async function executeManageWorkflows(
       // Only signal a run the caller owns. A non-owned (or absent) run is a
       // no-op with the same response shape, so existence is never revealed.
       const run = manager.status(runId);
-      if (run && ownsRun(run)) manager.abort(runId);
+      if (run && ownsRun(run)) {
+        manager.abort(runId);
+      }
       return {
         content: JSON.stringify({
           runId,

package/src/tools/workflows/run-workflow.test.ts

@@ -27,7 +27,9 @@ mock.module("../../daemon/conversation-registry.js", () => ({
 let lastStartArgs: Record<string, unknown> | null = null;
 let startThrows: Error | null = null;
 const startMock = mock((opts: Record<string, unknown>) => {
-  if (startThrows) throw startThrows;
+  if (startThrows) {
+    throw startThrows;
+  }
   lastStartArgs = opts;
   return { runId: "run-123" };
 });
@@ -36,7 +38,9 @@ const abortMock = mock(() => {});
 const listMock = mock(() => [] as unknown[]);
 let resumeThrows: Error | null = null;
 const resumeMock = mock((runId: string) => {
-  if (resumeThrows) throw resumeThrows;
+  if (resumeThrows) {
+    throw resumeThrows;
+  }
   return { runId };
 });
 
@@ -421,3 +425,51 @@ describe("manage_workflows", () => {
     expect(abortMock).toHaveBeenCalledWith("mine");
   });
 });
+
+// ── model-input schema validation (LUM-2855) ────────────────────────
+
+describe("workflow tools — model-input schema validation", () => {
+  test("run_workflow rejects a non-string script", async () => {
+    const result = await executeRunWorkflow({ script: 42 }, makeContext());
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('Invalid input for tool "run_workflow"');
+    expect(result.content).toContain("script");
+    expect(startMock).not.toHaveBeenCalled();
+  });
+
+  test("run_workflow treats explicit null script/name as omitted (bespoke exactly-one error)", async () => {
+    const result = await executeRunWorkflow(
+      { script: null, name: null },
+      makeContext(),
+    );
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("exactly one");
+  });
+
+  test("run_workflow passes args through unvalidated (workflow runtime accepts any JSON)", async () => {
+    const result = await executeRunWorkflow(
+      { script: "export const meta = {}", args: ["positional"] },
+      makeContext(),
+    );
+    expect(result.isError).toBe(false);
+    expect(lastStartArgs?.args).toEqual(["positional"]);
+  });
+
+  test("manage_workflows rejects a non-string run_id", async () => {
+    const result = await executeManageWorkflows(
+      { action: "status", run_id: 42 },
+      makeContext(),
+    );
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      'Invalid input for tool "manage_workflows"',
+    );
+    expect(result.content).toContain("run_id");
+  });
+
+  test("manage_workflows keeps the bespoke unknown-action error", async () => {
+    const result = await executeManageWorkflows({ action: 42 }, makeContext());
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("Unknown action");
+  });
+});

package/src/tools/workflows/run-workflow.ts

@@ -15,13 +15,37 @@
  * of truth the model reads when generating the `script`.
  */
 
+import { z } from "zod";
+
 import { findConversation } from "../../daemon/conversation-registry.js";
 import { FALLBACK_TURN_TRUST } from "../../daemon/trust-context.js";
 import type { TrustContext } from "../../daemon/trust-context-types.js";
 import { CapabilityManifestSchema } from "../../workflows/capabilities.js";
 import { getWorkflowRunManager } from "../../workflows/run-manager.js";
+import {
+  invalidToolInputResult,
+  nullAsOmitted,
+} from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
+/**
+ * Model-input schema, `safeParse`d at the top of {@link executeRunWorkflow}.
+ * Same in-tool pattern and TOOLS.json drift guard as the other bundled-skill
+ * tools — see the schema block in `tools/document/document-tool.ts` for the
+ * framework.
+ *
+ * `args` (the workflow runtime accepts any JSON value) and `capabilities`
+ * (`CapabilityManifestSchema` is the single validation authority, and
+ * `executor.ts` reads it pre-execution for the requireFreshApproval
+ * promotion) are deliberately UNDECLARED — loose passthrough. The
+ * exactly-one-of script/name rule stays a bespoke check below.
+ */
+export const runWorkflowInputSchema = z.looseObject({
+  script: nullAsOmitted(z.string()),
+  name: nullAsOmitted(z.string()),
+  label: nullAsOmitted(z.string()),
+});
+
 /**
  * Resolve the {@link TrustContext} to forward to the run's leaves. Prefer the
  * originating conversation's per-turn snapshot (the same context the live turn
@@ -33,7 +57,9 @@ function resolveTrustContext(context: ToolContext): TrustContext {
   const conversation = findConversation(context.conversationId);
   const fromConversation =
     conversation?.currentTurnTrustContext ?? conversation?.trustContext;
-  if (fromConversation) return fromConversation;
+  if (fromConversation) {
+    return fromConversation;
+  }
   return { ...FALLBACK_TURN_TRUST, trustClass: context.trustClass };
 }
 
@@ -41,8 +67,11 @@ export async function executeRunWorkflow(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  const script = input.script as string | undefined;
-  const name = input.name as string | undefined;
+  const parsedInput = runWorkflowInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    return invalidToolInputResult("run_workflow", parsedInput.error);
+  }
+  const { script, name, label } = parsedInput.data;
 
   // Exactly one of script/name is required.
   if ((script == null) === (name == null)) {
@@ -54,7 +83,6 @@ export async function executeRunWorkflow(
   }
 
   const args = (input.args as Record<string, unknown> | undefined) ?? {};
-  const label = input.label as string | undefined;
   const trustContext = resolveTrustContext(context);
 
   try {

package/src/util/fs-symlinks.ts

@@ -0,0 +1,30 @@
+import { lstatSync, readlinkSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+/**
+ * Follow a trailing symlink chain manually so a DANGLING link reports its
+ * destination. `realpathSync` throws on a link whose destination does not
+ * exist, which makes canonicalization fall back to the benign link path —
+ * but a write through the link creates the destination, so containment and
+ * security checks must see it. The bound sits above every supported
+ * platform's own traversal limit (Linux follows at most 40 links per
+ * resolution, macOS 32), so any chain this loop cannot exhaust is one the
+ * filesystem itself refuses to follow (ELOOP) — the eventual operation
+ * fails rather than writing through an unchecked destination.
+ */
+export function resolveTrailingLinkTarget(path: string): string {
+  let current = path;
+  for (let depth = 0; depth < 64; depth++) {
+    let linkTarget: string;
+    try {
+      if (!lstatSync(current).isSymbolicLink()) {
+        return current;
+      }
+      linkTarget = readlinkSync(current);
+    } catch {
+      return current;
+    }
+    current = resolve(dirname(current), linkTarget);
+  }
+  return current;
+}

package/src/util/log-redact.ts

@@ -11,15 +11,19 @@
  */
 
 import { memoizePluginPatternDerivation } from "../security/plugin-secret-patterns.js";
-import { PREFIX_PATTERNS } from "../security/secret-patterns.js";
+import { REDACTION_PREFIX_PATTERNS } from "../security/secret-patterns.js";
 
 // ---------------------------------------------------------------------------
-// Sensitive-value patterns (derived from shared PREFIX_PATTERNS)
+// Sensitive-value patterns (derived from shared REDACTION_PREFIX_PATTERNS)
 // ---------------------------------------------------------------------------
 
 const BEARER_RE = /Bearer [A-Za-z0-9._\-]+/g;
 
-const STATIC_API_KEY_PATTERNS: RegExp[] = PREFIX_PATTERNS.map(
+// This serializer redacts by replacing the matched span in place, so it uses
+// the bounded whole-block private-key matcher (via REDACTION_PREFIX_PATTERNS):
+// the match must cover header → body → footer or the key body would survive
+// redaction. The body bound keeps it O(n) on large serialized strings.
+const STATIC_API_KEY_PATTERNS: RegExp[] = REDACTION_PREFIX_PATTERNS.map(
   (p) => new RegExp(p.regex.source, "g"),
 );
 

package/src/util/platform.ts

@@ -434,6 +434,21 @@ export function getWorkspacePromptPath(file: string): string {
   return join(getWorkspaceDir(), file);
 }
 
+/**
+ * Returns `<workspaceDir>/prompts/system` — the workspace override layer for
+ * system prompt sections. Layout: `prompts/system/<NN-name>.md`.
+ *
+ * The bundled section registry (`prompts/templates/system-sections.ts`) is
+ * the source of default truth; a file here with the same id replaces the
+ * bundled body (or, stripped to nothing, silences it), and a brand-new
+ * `<NN-name>` adds a workspace-only section. Because that includes the
+ * security-policy sections, writes under this directory are gated as a
+ * control-plane prompt surface (`permissions/workspace-policy.ts`).
+ */
+export function getWorkspaceSystemPromptDir(): string {
+  return join(getWorkspaceDir(), "prompts", "system");
+}
+
 // ── Profiler filesystem layout ──────────────────────────────────────────
 // Managed profiler runs live under <workspace>/data/profiler/. These
 // helpers enforce a single canonical layout so every runtime caller

package/src/vellum-assistant-namespace.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The single shape of `globalThis.vellumAssistant` — the per-process namespace
+ * that holds the assistant's process-global singletons.
+ *
+ * Several modules keep process-global state on `globalThis.vellumAssistant.*`
+ * (see the slots below). Each such slot is read/written by a production module
+ * AND, independently, by a test helper in `src/__tests__/` that must NOT import
+ * that production module (importing it would run its load-time side effects
+ * before the test preload establishes the per-process workspace override — the
+ * coupling behind the May 2026 DB-ghost incidents). This file is how both sides
+ * agree on the shape without a runtime import between them.
+ *
+ * It is an **ambient** declaration (no top-level `import`/`export`), so
+ * `VellumAssistantNamespace`, the slot types, and the `vellumAssistant` binding
+ * are global — every module and test helper refers to them by name with zero
+ * imports, and nothing here reaches into a `src/` module even at the type
+ * level. Referring to these types therefore never adds anything to any file's
+ * runtime import graph, so the test-machinery isolation invariant holds.
+ *
+ * Adding a slot: declare its value type here, add the optional property to
+ * `VellumAssistantNamespace`, and have the owning module + its test helper
+ * reference these globals instead of declaring their own copies.
+ */
+
+/** Slot value: the encrypted credential store path override. Managed by `security/store-path-override.ts`. */
+interface VellumStorePathOverride {
+  storePath: string | null;
+  storeKeyPath: string | null;
+}
+
+/** Which assistant DB connection a singleton slot holds. */
+type VellumDbSlotKey =
+  | "main"
+  | "main-readonly"
+  | "logs"
+  | "memory"
+  | "telemetry";
+
+/**
+ * Slot value: one lazily-opened DB connection and the closer that drops it.
+ * `db` is `unknown` so this shape never has to name a Drizzle type; callers in
+ * `persistence/db-connection.ts` narrow it via `getStoredDb<T>()`.
+ */
+interface VellumDbSlot {
+  db: unknown;
+  closer: (() => void) | null;
+}
+
+/** Slot value: the assistant DB connection singletons, keyed by connection. Managed by `persistence/db-singleton.ts`. */
+type VellumDbSlots = Record<VellumDbSlotKey, VellumDbSlot>;
+
+/** Slot value: the resolved feature-flag override cache. Managed by `config/feature-flag-cache.ts`. */
+interface VellumFeatureFlagCache {
+  overrides: Record<string, boolean | string> | null;
+  fromGateway: boolean;
+}
+
+/** The per-process `globalThis.vellumAssistant` namespace. */
+interface VellumAssistantNamespace {
+  /**
+   * Whether this OS process is the main assistant daemon. Set once by the
+   * daemon entrypoint; absent elsewhere. See `runtime/process-role.ts`.
+   */
+  mainDaemonProcess?: boolean;
+  /** See `security/store-path-override.ts`. */
+  storePathOverride?: VellumStorePathOverride;
+  /** See `persistence/db-singleton.ts`. */
+  dbSingletons?: VellumDbSlots;
+  /** See `config/feature-flag-cache.ts`. */
+  featureFlagCache?: VellumFeatureFlagCache;
+}
+
+/**
+ * Types `globalThis.vellumAssistant`. Undefined until the first slot accessor
+ * seeds it (`globalThis.vellumAssistant ??= {}`). Must be `var`: only `var`
+ * declarations at global scope become typed properties of `globalThis`
+ * (`let`/`const` do not), so this is the one idiomatic way to type the binding.
+ */
+// eslint-disable-next-line no-var
+declare var vellumAssistant: VellumAssistantNamespace | undefined;

package/src/watcher/watcher-store.ts

@@ -2,6 +2,7 @@ import { and, asc, desc, eq, gte, lte } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import { getDb } from "../persistence/db-connection.js";
+import { isLifecycleQuiesced } from "../persistence/lifecycle-quiesce.js";
 import { rawChanges } from "../persistence/raw-query.js";
 import { watcherEvents, watchers } from "../persistence/schema/index.js";
 import { truncate } from "../util/truncate.js";
@@ -158,6 +159,13 @@ export function deleteWatcher(id: string): boolean {
  * to 'polling' using optimistic locking on the current nextPollAt.
  */
 export function claimDueWatchers(now: number): Watcher[] {
+  // Drain gate: while a quiesce lease is active, claim nothing — a watcher
+  // poll runs provider requests that create no row the drain snapshot can
+  // see, so it must not start at all. Fail-open via the lease read.
+  if (isLifecycleQuiesced()) {
+    return [];
+  }
+
   const db = getDb();
   const candidates = db
     .select()

package/src/workflows/leaf-runner.test.ts

@@ -472,6 +472,105 @@ describe("runLeaf — tool path", () => {
     expect(countConversations()).toBe(before);
   });
 
+  test("rejects out-of-workspace paths for sandbox file tools", async () => {
+    // Leaf tool calls bypass the ToolExecutor permission lane, so the file
+    // tools' out-of-workspace host fallback must be unreachable from a leaf.
+    const calls: Array<Record<string, unknown>> = [];
+    const fileRead: Tool = {
+      name: "file_read",
+      description: "Tool file_read",
+      category: "filesystem",
+      defaultRiskLevel: "low" as never,
+      executionTarget: "sandbox",
+      input_schema: { type: "object", properties: {}, required: [] },
+      async execute(
+        input: Record<string, unknown>,
+      ): Promise<ToolExecutionResult> {
+        calls.push(input);
+        return { content: "read ok", isError: false };
+      },
+    };
+
+    responseQueue = [
+      {
+        content: [
+          {
+            type: "tool_use",
+            name: "file_read",
+            id: "tu-1",
+            input: { path: "/etc/hosts" },
+          },
+        ],
+        model: "test",
+        usage: { inputTokens: 5, outputTokens: 2 },
+        stopReason: "tool_use",
+      },
+      {
+        content: [{ type: "text", text: "done" }],
+        model: "test",
+        usage: { inputTokens: 2, outputTokens: 1 },
+        stopReason: "end_turn",
+      },
+    ];
+
+    const result = await runLeaf({
+      prompt: "read the file",
+      tools: [fileRead],
+      trustContext,
+    });
+    expect(result.output).toBe("done");
+    // The workspace-bound guard fired before execute — the tool never ran.
+    expect(calls).toEqual([]);
+  });
+
+  test("in-workspace file tool paths still execute from a leaf", async () => {
+    const calls: Array<Record<string, unknown>> = [];
+    const fileRead: Tool = {
+      name: "file_read",
+      description: "Tool file_read",
+      category: "filesystem",
+      defaultRiskLevel: "low" as never,
+      executionTarget: "sandbox",
+      input_schema: { type: "object", properties: {}, required: [] },
+      async execute(
+        input: Record<string, unknown>,
+      ): Promise<ToolExecutionResult> {
+        calls.push(input);
+        return { content: "read ok", isError: false };
+      },
+    };
+
+    responseQueue = [
+      {
+        content: [
+          {
+            type: "tool_use",
+            name: "file_read",
+            id: "tu-1",
+            input: { path: "notes.txt" },
+          },
+        ],
+        model: "test",
+        usage: { inputTokens: 5, outputTokens: 2 },
+        stopReason: "tool_use",
+      },
+      {
+        content: [{ type: "text", text: "done" }],
+        model: "test",
+        usage: { inputTokens: 2, outputTokens: 1 },
+        stopReason: "end_turn",
+      },
+    ];
+
+    const result = await runLeaf({
+      prompt: "read the file",
+      tools: [fileRead],
+      trustContext,
+    });
+    expect(result.output).toBe("done");
+    expect(calls).toEqual([{ path: "notes.txt" }]);
+  });
+
   test("a leaf with no schema and an empty tool set runs the tool path (no throw)", async () => {
     // An empty resolved tool set with no schema must NOT fall through to the
     // schema path (where schemaToInputSchema(undefined) throws) — it runs the
@@ -702,8 +801,11 @@ describe("runLeaf — persona path", () => {
       }>;
       expect(messages[0]?.content[0]?.text).not.toBe(MEMORY_BLOCK_TEXT);
     } finally {
-      if (savedAuth === undefined) delete process.env.DISABLE_HTTP_AUTH;
-      else process.env.DISABLE_HTTP_AUTH = savedAuth;
+      if (savedAuth === undefined) {
+        delete process.env.DISABLE_HTTP_AUTH;
+      } else {
+        process.env.DISABLE_HTTP_AUTH = savedAuth;
+      }
     }
   });
 });