@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/tools/host-terminal/host-shell.ts

@@ -24,14 +24,19 @@ import { isCesShellLockdownEnabled } from "../../credential-execution/feature-ga
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
-import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "../../runtime/assistant-event-hub.js";
 import { isUntrustedShellLockdownActive } from "../../runtime/effective-capabilities.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
+import type { CompletedBackgroundTool } from "../background-tool-registry.js";
 import {
   generateBackgroundToolId,
   isBackgroundToolLimitReached,
   MAX_BACKGROUND_TOOLS,
+  recordCompletedBackgroundTool,
   registerBackgroundTool,
   removeBackgroundTool,
 } from "../background-tool-registry.js";
@@ -284,6 +289,7 @@ export const hostShellTool = {
 
         const bgId = generateBackgroundToolId();
         const abortController = new AbortController();
+        const startedAt = Date.now();
         const proxyPromise = HostBashProxy.instance.request(
           {
             command,
@@ -299,16 +305,57 @@ export const hostShellTool = {
 
         proxyPromise
           .then((result) => {
-            const framing = result.isError
-              ? `Background host command failed (id=${bgId}):`
-              : `Background host command completed (id=${bgId}):`;
+            // request() swallows the aborted rejection and resolves with an
+            // "Aborted" result, so a tripped signal means the user cancelled.
+            const status = abortController.signal.aborted
+              ? "cancelled"
+              : result.isError
+                ? "failed"
+                : "completed";
+            // A cancelled command's proxy result carries SIGKILL/"failed"
+            // framing; surface the cancellation instead (see shell.ts).
+            const output =
+              status === "cancelled"
+                ? `Background host command cancelled (id=${bgId}).`
+                : result.content;
+            const completedAt = Date.now();
+            const completion: CompletedBackgroundTool = {
+              id: bgId,
+              toolName: "host_bash",
+              conversationId: context.conversationId,
+              command,
+              startedAt,
+              status,
+              exitCode: null,
+              output,
+              completedAt,
+            };
+            recordCompletedBackgroundTool(completion);
+            broadcastMessage(
+              {
+                type: "background_tool_completed",
+                id: bgId,
+                conversationId: context.conversationId,
+                status,
+                output,
+                completedAt,
+              },
+              context.conversationId,
+            );
+            const framing =
+              status === "cancelled"
+                ? `Background host command cancelled (id=${bgId}):`
+                : result.isError
+                  ? `Background host command failed (id=${bgId}):`
+                  : `Background host command completed (id=${bgId}):`;
             void wakeAgentForOpportunity({
               conversationId: context.conversationId,
               hint: framing,
               source: "background-tool",
               persistTriggerAsEvent: true,
+              backgroundToolCompletion: completion,
               untrustedOutput: {
-                content: result.content || "(no output)",
+                content: output || "(no output)",
                 source: "tool_result",
                 // Preserve formatShellOutput's recovery marker (see shell.ts).
                 maxChars: MAX_OUTPUT_LENGTH * 2,
@@ -316,11 +363,48 @@ export const hostShellTool = {
             });
           })
           .catch((err) => {
+            const status = abortController.signal.aborted
+              ? "cancelled"
+              : "failed";
+            const output =
+              status === "cancelled"
+                ? `Background host command cancelled (id=${bgId}).`
+                : err instanceof Error
+                  ? err.message
+                  : String(err);
+            const completedAt = Date.now();
+            const completion: CompletedBackgroundTool = {
+              id: bgId,
+              toolName: "host_bash",
+              conversationId: context.conversationId,
+              command,
+              startedAt,
+              status,
+              exitCode: null,
+              output,
+              completedAt,
+            };
+            recordCompletedBackgroundTool(completion);
+            broadcastMessage(
+              {
+                type: "background_tool_completed",
+                id: bgId,
+                conversationId: context.conversationId,
+                status,
+                output,
+                completedAt,
+              },
+              context.conversationId,
+            );
             void wakeAgentForOpportunity({
               conversationId: context.conversationId,
-              hint: `Background host command failed (id=${bgId}): ${err instanceof Error ? err.message : String(err)}`,
+              hint:
+                status === "cancelled"
+                  ? `Background host command cancelled (id=${bgId}):`
+                  : `Background host command failed (id=${bgId}): ${err instanceof Error ? err.message : String(err)}`,
               source: "background-tool",
               persistTriggerAsEvent: true,
+              backgroundToolCompletion: completion,
             });
           })
           .finally(() => removeBackgroundTool(bgId));
@@ -330,10 +414,22 @@ export const hostShellTool = {
           toolName: "host_bash",
           conversationId: context.conversationId,
           command,
-          startedAt: Date.now(),
+          startedAt,
           cancel: (reason?: string) => abortController.abort(reason),
         });
 
+        broadcastMessage(
+          {
+            type: "background_tool_started",
+            id: bgId,
+            toolName: "host_bash",
+            conversationId: context.conversationId,
+            command,
+            startedAt,
+          },
+          context.conversationId,
+        );
+
         return {
           content: JSON.stringify({ backgrounded: true, id: bgId }),
           isError: false,
@@ -397,6 +493,7 @@ export const hostShellTool = {
       }
 
       const bgId = generateBackgroundToolId();
+      const startedAt = Date.now();
 
       const child = spawn("bash", ["-c", "--", command], {
         cwd: workingDir,
@@ -408,6 +505,9 @@ export const hostShellTool = {
       const stdoutChunks: Buffer[] = [];
       const stderrChunks: Buffer[] = [];
       let timedOut = false;
+      // Set when cancelled via the registry's cancel callback so the completion
+      // event reports "cancelled" rather than "failed".
+      let aborted = false;
 
       const killTree = () => {
         if (child.pid != null) {
@@ -451,16 +551,57 @@ export const hostShellTool = {
           timedOut,
           timeoutSec,
         );
-        const framing = result.isError
-          ? `Background host command failed (id=${bgId}):`
-          : `Background host command completed (id=${bgId}):`;
+        // Cancel takes precedence over the SIGKILL-induced error result.
+        const status = aborted
+          ? "cancelled"
+          : result.isError
+            ? "failed"
+            : "completed";
+        // A cancelled command's SIGKILL output is framed as "failed";
+        // surface the cancellation instead (see shell.ts).
+        const output =
+          status === "cancelled"
+            ? `Background host command cancelled (id=${bgId}).`
+            : result.content;
+        const completedAt = Date.now();
+        const completion: CompletedBackgroundTool = {
+          id: bgId,
+          toolName: "host_bash",
+          conversationId: context.conversationId,
+          command,
+          startedAt,
+          status,
+          exitCode: code ?? null,
+          output,
+          completedAt,
+        };
+        recordCompletedBackgroundTool(completion);
+        broadcastMessage(
+          {
+            type: "background_tool_completed",
+            id: bgId,
+            conversationId: context.conversationId,
+            status,
+            exitCode: code,
+            output,
+            completedAt,
+          },
+          context.conversationId,
+        );
+        const framing =
+          status === "cancelled"
+            ? `Background host command cancelled (id=${bgId}):`
+            : result.isError
+              ? `Background host command failed (id=${bgId}):`
+              : `Background host command completed (id=${bgId}):`;
         void wakeAgentForOpportunity({
           conversationId: context.conversationId,
           hint: framing,
           source: "background-tool",
           persistTriggerAsEvent: true,
+          backgroundToolCompletion: completion,
           untrustedOutput: {
-            content: result.content || "(no output)",
+            content: output || "(no output)",
             source: "tool_result",
             // Preserve formatShellOutput's recovery marker (see shell.ts).
             maxChars: MAX_OUTPUT_LENGTH * 2,
@@ -473,11 +614,44 @@ export const hostShellTool = {
         if (completed) return;
         completed = true;
         clearTimeout(timer);
+        const status = aborted ? "cancelled" : "failed";
+        const output =
+          status === "cancelled"
+            ? `Background host command cancelled (id=${bgId}).`
+            : err.message;
+        const completedAt = Date.now();
+        const completion: CompletedBackgroundTool = {
+          id: bgId,
+          toolName: "host_bash",
+          conversationId: context.conversationId,
+          command,
+          startedAt,
+          status,
+          exitCode: null,
+          output,
+          completedAt,
+        };
+        recordCompletedBackgroundTool(completion);
+        broadcastMessage(
+          {
+            type: "background_tool_completed",
+            id: bgId,
+            conversationId: context.conversationId,
+            status,
+            output,
+            completedAt,
+          },
+          context.conversationId,
+        );
         void wakeAgentForOpportunity({
           conversationId: context.conversationId,
-          hint: `Background host command failed (id=${bgId}): ${err.message}`,
+          hint:
+            status === "cancelled"
+              ? `Background host command cancelled (id=${bgId}):`
+              : `Background host command failed (id=${bgId}): ${err.message}`,
           source: "background-tool",
           persistTriggerAsEvent: true,
+          backgroundToolCompletion: completion,
         });
         removeBackgroundTool(bgId);
       });
@@ -487,10 +661,25 @@ export const hostShellTool = {
         toolName: "host_bash",
         conversationId: context.conversationId,
         command,
-        startedAt: Date.now(),
-        cancel: killTree,
+        startedAt,
+        cancel: () => {
+          aborted = true;
+          killTree();
+        },
       });
 
+      broadcastMessage(
+        {
+          type: "background_tool_started",
+          id: bgId,
+          toolName: "host_bash",
+          conversationId: context.conversationId,
+          command,
+          startedAt,
+        },
+        context.conversationId,
+      );
+
       return {
         content: JSON.stringify({ backgrounded: true, id: bgId }),
         isError: false,

package/src/tools/skills/find-similar-skills.test.ts

@@ -18,6 +18,7 @@ import { basename } from "node:path";
 import { describe, expect, mock, test } from "bun:test";
 
 import type { SkillSource } from "../../config/skills.js";
+import type { OwnerInfo } from "../types.js";
 
 mock.module("../../util/logger.js", () => ({
   getLogger: () =>
@@ -40,11 +41,12 @@ mock.module("../../skills/install-meta.js", () => ({
 import type { ToolContext } from "../types.js";
 import { executeFindSimilarSkills } from "./find-similar-skills.js";
 
-function makeContext(): ToolContext {
+function makeContext(enabledPluginSet?: Set<string> | null): ToolContext {
   return {
     workingDir: "/tmp",
     conversationId: "test-conversation",
     trustClass: "guardian",
+    enabledPluginSet,
   };
 }
 
@@ -54,6 +56,7 @@ const catalog = (
     name: string;
     description: string;
     source: SkillSource;
+    owner?: OwnerInfo;
   }[]
 ) => skills;
 
@@ -220,6 +223,154 @@ describe("find_similar_skills — enrichment", () => {
   });
 });
 
+describe("find_similar_skills — per-chat plugin scope", () => {
+  const SHORTLIST = [
+    { skillId: "core-skill", score: 0.9 },
+    { skillId: "plug-skill", score: 0.8 },
+  ];
+  const CATALOG = () =>
+    catalog(
+      {
+        id: "core-skill",
+        name: "Core Skill",
+        description: "A bundled skill",
+        source: "bundled",
+      },
+      {
+        id: "plug-skill",
+        name: "Plugin Skill",
+        description: "Owned by plugin p",
+        source: "plugin",
+        owner: { kind: "plugin", id: "p" },
+      },
+    );
+
+  test("drops a plugin skill whose owner is outside the effective set", async () => {
+    const result = await executeFindSimilarSkills(
+      { goal: "do the thing" },
+      makeContext(new Set(["other"])),
+      {
+        nearestExistingSkills: async () => SHORTLIST,
+        loadCatalog: CATALOG,
+      },
+    );
+
+    const ids = (
+      JSON.parse(result.content).skills as { skill_id: string }[]
+    ).map((s) => s.skill_id);
+    expect(ids).toContain("core-skill");
+    expect(ids).not.toContain("plug-skill");
+  });
+
+  test("keeps a plugin skill whose owner is in the effective set", async () => {
+    const result = await executeFindSimilarSkills(
+      { goal: "do the thing" },
+      makeContext(new Set(["p"])),
+      {
+        nearestExistingSkills: async () => SHORTLIST,
+        loadCatalog: CATALOG,
+      },
+    );
+
+    const ids = (
+      JSON.parse(result.content).skills as { skill_id: string }[]
+    ).map((s) => s.skill_id);
+    expect(ids).toContain("core-skill");
+    expect(ids).toContain("plug-skill");
+  });
+
+  test("null set (no restriction) keeps every skill", async () => {
+    const result = await executeFindSimilarSkills(
+      { goal: "do the thing" },
+      makeContext(null),
+      {
+        nearestExistingSkills: async () => SHORTLIST,
+        loadCatalog: CATALOG,
+      },
+    );
+
+    const ids = (
+      JSON.parse(result.content).skills as { skill_id: string }[]
+    ).map((s) => s.skill_id);
+    expect(ids).toEqual(["core-skill", "plug-skill"]);
+  });
+
+  test("fills the limit with in-scope skills when top matches are out of scope", async () => {
+    // The two highest-scoring matches are owned by an out-of-scope plugin "q";
+    // the next two are in scope. With limit=2, a filter applied AFTER the limit
+    // would slice off plug-hi-1/plug-hi-2, then drop both → an empty result.
+    // The fix filters the candidate catalog BEFORE the limit, so the slice
+    // lands on the two in-scope skills instead.
+    const FULL_CATALOG = () =>
+      catalog(
+        {
+          id: "plug-hi-1",
+          name: "Plugin Hi 1",
+          description: "High-rank, out of scope",
+          source: "plugin",
+          owner: { kind: "plugin", id: "q" },
+        },
+        {
+          id: "plug-hi-2",
+          name: "Plugin Hi 2",
+          description: "High-rank, out of scope",
+          source: "plugin",
+          owner: { kind: "plugin", id: "q" },
+        },
+        {
+          id: "core-lo-1",
+          name: "Core Lo 1",
+          description: "Lower-rank, in scope",
+          source: "bundled",
+        },
+        {
+          id: "core-lo-2",
+          name: "Core Lo 2",
+          description: "Lower-rank, in scope",
+          source: "bundled",
+        },
+      );
+
+    // Mimics the real `nearestExistingSkills`: rank the candidate catalog the
+    // caller passes via `loadCatalog`, then slice to `limit`. Pre-fix the tool
+    // passed the full catalog (so the top-K limit hit out-of-scope skills);
+    // post-fix it passes a scope-filtered catalog.
+    const RANKED = [
+      { skillId: "plug-hi-1", score: 0.98 },
+      { skillId: "plug-hi-2", score: 0.97 },
+      { skillId: "core-lo-1", score: 0.5 },
+      { skillId: "core-lo-2", score: 0.4 },
+    ];
+    const rankThenLimit = async (
+      _goal: string,
+      opts?: { limit?: number; loadCatalog?: () => { id: string }[] },
+    ) => {
+      const candidateIds = new Set(
+        (opts?.loadCatalog?.() ?? FULL_CATALOG()).map((s) => s.id),
+      );
+      return RANKED.filter((h) => candidateIds.has(h.skillId)).slice(
+        0,
+        opts?.limit ?? RANKED.length,
+      );
+    };
+
+    const result = await executeFindSimilarSkills(
+      { goal: "do the thing", limit: 2 },
+      makeContext(new Set(["p"])), // plugin "q" is out of scope
+      {
+        nearestExistingSkills: rankThenLimit,
+        loadCatalog: FULL_CATALOG,
+      },
+    );
+
+    const ids = (
+      JSON.parse(result.content).skills as { skill_id: string }[]
+    ).map((s) => s.skill_id);
+    // The limit is honored AND filled with in-scope skills, not starved to empty.
+    expect(ids).toEqual(["core-lo-1", "core-lo-2"]);
+  });
+});
+
 describe("find_similar_skills — limit pass-through", () => {
   test("forwards an explicit limit to the shortlist", async () => {
     let seenLimit: number | undefined;

package/src/tools/skills/find-similar-skills.ts

@@ -3,7 +3,7 @@ import { loadSkillCatalog } from "../../config/skills.js";
 import { nearestExistingSkills } from "../../plugins/defaults/memory/v3/candidate-match.js";
 import { readInstallMeta } from "../../skills/install-meta.js";
 import { getManagedSkillDir } from "../../skills/managed-store.js";
-import type { ToolContext, ToolExecutionResult } from "../types.js";
+import type { OwnerInfo, ToolContext, ToolExecutionResult } from "../types.js";
 
 /**
  * A shortlisted skill enriched with its catalog name, description, and source.
@@ -36,7 +36,7 @@ interface EnrichedHit {
  */
 export async function executeFindSimilarSkills(
   input: Record<string, unknown>,
-  _context: ToolContext,
+  context: ToolContext,
   deps: {
     nearestExistingSkills?: typeof nearestExistingSkills;
     loadCatalog?: () => {
@@ -44,6 +44,7 @@ export async function executeFindSimilarSkills(
       name: string;
       description: string;
       source: SkillSource;
+      owner?: OwnerInfo;
     }[];
   } = {},
 ): Promise<ToolExecutionResult> {
@@ -73,15 +74,40 @@ export async function executeFindSimilarSkills(
   const findNearest = deps.nearestExistingSkills ?? nearestExistingSkills;
   const loadCatalog = deps.loadCatalog ?? (() => loadSkillCatalog());
 
-  const hits = await findNearest(goal, { limit });
-
   const catalog = loadCatalog();
   const byId = new Map(catalog.map((s) => [s.id, s]));
 
+  // Per-chat plugin scope: a plugin-owned skill whose owning plugin is outside
+  // the conversation's effective set must not be surfaced as a discovery
+  // result. `null` = no restriction; non-plugin skills are always retained
+  // (mirrors `filterSkillsByEnabledPlugins`).
+  const enabledPluginSet = context.enabledPluginSet ?? null;
+  const outOfScope = (skill: { owner?: OwnerInfo }): boolean =>
+    enabledPluginSet !== null &&
+    skill.owner?.kind === "plugin" &&
+    !enabledPluginSet.has(skill.owner.id);
+
+  // Apply the scope filter BEFORE the shortlist's top-K limit: restrict the
+  // candidate catalog to in-scope skills so the nearest-skill search ranks and
+  // slices only those. Filtering after the limit would let out-of-scope
+  // high-rank matches consume slots and starve usable in-scope skills out of
+  // the result. `null` set = pass the catalog through unchanged.
+  const scopedCatalog =
+    enabledPluginSet === null ? catalog : catalog.filter((s) => !outOfScope(s));
+
+  const hits = await findNearest(goal, {
+    limit,
+    loadCatalog: () => scopedCatalog,
+  });
+
   const enriched: EnrichedHit[] = [];
   for (const hit of hits) {
     const skill = byId.get(hit.skillId);
     if (!skill) continue;
+    // Defense in depth: the scoped catalog already excludes out-of-scope plugin
+    // skills, but re-check so a shortlist source that ignores the catalog seam
+    // still cannot leak one.
+    if (outOfScope(skill)) continue;
     enriched.push({
       skill_id: hit.skillId,
       name: skill.name,

package/src/tools/skills/load.ts

@@ -212,6 +212,35 @@ export const skillLoadTool = {
 
     const skill = loaded.skill;
 
+    // Per-chat plugin scope gate: a plugin-owned skill whose owning plugin is
+    // outside the conversation's effective set must not have its instructions
+    // loaded. Mirrors the projection/tools filter's owner-id lookup
+    // (`filterSkillsByEnabledPlugins`). `null` = no restriction; first-party
+    // defaults are always in the set, so bundled/workspace skills pass.
+    const enabledPluginSet = context.enabledPluginSet ?? null;
+    if (
+      enabledPluginSet !== null &&
+      skill.owner?.kind === "plugin" &&
+      !enabledPluginSet.has(skill.owner.id)
+    ) {
+      return {
+        content: `Error: skill "${skill.id}" is not available in this conversation — its plugin is not enabled here.`,
+        isError: true,
+      };
+    }
+
+    // Per-chat plugin scope gate for INCLUDED child skills. Mirrors the
+    // top-level owner-id check above: a child owned by a plugin outside the
+    // effective set (and not a first-party default — those ids are unioned into
+    // the set) must be omitted from include resolution entirely, so an in-scope
+    // parent cannot inject an out-of-scope plugin child's body or loaded-skill
+    // marker. `null` set = no restriction; bundled/core children (no plugin
+    // owner) always pass.
+    const childOutOfPluginScope = (child: SkillSummary): boolean =>
+      enabledPluginSet !== null &&
+      child.owner?.kind === "plugin" &&
+      !enabledPluginSet.has(child.owner.id);
+
     // Assistant feature flag gate: reject loading if the skill's flag is OFF
     const config = getConfig();
     const flagKey = skillFlagKey(skill);
@@ -381,6 +410,9 @@ export const skillLoadTool = {
       for (const childId of skill.includes) {
         const child = catalogIndex.get(childId);
         if (!child) continue;
+        // Skip a child whose owning plugin is outside this conversation's
+        // effective set — do not list it, load its body, or surface its tools.
+        if (childOutOfPluginScope(child)) continue;
         const childFlagKey = skillFlagKey(child);
         if (
           childFlagKey &&
@@ -520,6 +552,10 @@ export const skillLoadTool = {
       for (const childId of skill.includes) {
         const child = catalogIndex.get(childId);
         if (!child) continue;
+        // Same per-chat plugin scope gate as the body loop: never emit a
+        // loaded-skill marker (which projects the child's tools) for a child
+        // whose owning plugin is outside the effective set.
+        if (childOutOfPluginScope(child)) continue;
         const childFlagKey2 = skillFlagKey(child);
         if (
           childFlagKey2 &&