@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/__tests__/plugin-event-hub-facade.test.ts

@@ -0,0 +1,323 @@
+/**
+ * Guard test: the event hub exposed to workspace plugins through
+ * `@vellumai/plugin-api` must not let an in-process plugin drive privileged
+ * host execution. It refuses to publish daemon-to-client host-proxy control
+ * events (`host_*`), withholds methods that hand out live subscriber callbacks
+ * (a direct delivery primitive), and snapshots published events so a mutating
+ * getter cannot slip a host event past the guard. Subscription and non-host
+ * publishing must still work and share state with the real hub.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { assistantEventHub as pluginHub } from "../plugin-api/index.js";
+import type { AssistantEvent } from "../runtime/assistant-event.js";
+import { assistantEventHub as rawHub } from "../runtime/assistant-event-hub.js";
+
+/** Minimal event envelope; the facade guard keys only off `message.type`. */
+function envelope(type: string): AssistantEvent {
+  return { message: { type } } as unknown as AssistantEvent;
+}
+
+function eventType(event: unknown): unknown {
+  return (event as { message?: { type?: unknown } }).message?.type;
+}
+
+/** Register a host-capable desktop client subscriber on the raw hub. */
+function subscribeHostClient(clientId: string, sink: AssistantEvent[]) {
+  return rawHub.subscribe({
+    type: "client",
+    clientId,
+    interfaceId: "macos",
+    capabilities: ["host_bash"],
+    callback: (event) => {
+      sink.push(event);
+    },
+  } as Parameters<typeof rawHub.subscribe>[0]);
+}
+
+describe("plugin-facing assistantEventHub facade", () => {
+  test("rejects publishing host-proxy control events", async () => {
+    for (const type of [
+      "host_bash_request",
+      "host_bash_cancel",
+      "host_file_request",
+      "host_transfer_request",
+      "host_browser_request",
+      "host_cu_request",
+      "host_app_control_request",
+    ]) {
+      let rejected: unknown;
+      try {
+        await pluginHub.publish(envelope(type));
+      } catch (err) {
+        rejected = err;
+      }
+      expect(rejected).toBeInstanceOf(Error);
+      expect((rejected as Error).message).toMatch(/host-proxy control events/);
+    }
+  });
+
+  test("does not expose the raw hub publish via the prototype chain (Codex P1)", async () => {
+    // A plain frozen object: its prototype is Object.prototype, which has no
+    // `publish`, so `Object.getPrototypeOf(...).publish` / `.constructor` cannot
+    // reach the unguarded `AssistantEventHub.prototype.publish`.
+    const proto = Object.getPrototypeOf(pluginHub) as { publish?: unknown };
+    expect(typeof proto?.publish).not.toBe("function");
+
+    const received: AssistantEvent[] = [];
+    const sub = subscribeHostClient("facade-proto-client", received);
+    try {
+      const p = Object.getPrototypeOf(pluginHub) as {
+        publish?: (event: AssistantEvent, options?: unknown) => Promise<void>;
+      } | null;
+      await p?.publish?.call(pluginHub, envelope("host_bash_request"), {
+        targetClientId: "facade-proto-client",
+        targetCapability: "host_bash",
+      });
+      expect(received).toHaveLength(0);
+    } finally {
+      sub.dispose();
+    }
+  });
+
+  test("withholds methods that leak subscriber callbacks (Codex P1)", () => {
+    const facade = pluginHub as unknown as Record<string, unknown>;
+    for (const method of [
+      "listClients",
+      "listClientsByCapability",
+      "listClientsByInterface",
+      "getClientById",
+      "getMostRecentClientByCapability",
+      "disposeClient",
+      "touchClient",
+    ]) {
+      expect(facade[method]).toBeUndefined();
+    }
+  });
+
+  test("snapshots the event so a mutating type getter cannot bypass the guard (Codex P1)", async () => {
+    const received: AssistantEvent[] = [];
+    const sub = subscribeHostClient("facade-toctou-client", received);
+    try {
+      // `message.type` reads benign first (what the guard would see) then turns
+      // into a host event — the classic time-of-check/time-of-use trick.
+      let reads = 0;
+      const message: Record<string, unknown> = {};
+      Object.defineProperty(message, "type", {
+        enumerable: true,
+        get() {
+          reads += 1;
+          return reads === 1 ? "sync_changed" : "host_bash_request";
+        },
+      });
+      const sneaky = { message } as unknown as AssistantEvent;
+
+      await pluginHub.publish(sneaky, {
+        targetClientId: "facade-toctou-client",
+        targetCapability: "host_bash",
+      });
+
+      // The client only ever sees the inert snapshot, never the host type.
+      expect(received).toHaveLength(1);
+      expect(eventType(received[0])).toBe("sync_changed");
+    } finally {
+      sub.dispose();
+    }
+  });
+
+  test("freezes the published snapshot so a subscriber cannot mutate it mid-fanout (Codex P1)", async () => {
+    const hostReceived: AssistantEvent[] = [];
+    // A malicious subscriber registered first tries to turn the in-flight event
+    // into a host request before the host-capable client (registered after)
+    // receives the same fanned-out object.
+    const attacker = rawHub.subscribe({
+      type: "process",
+      callback: (event) => {
+        try {
+          (event as { message: { type: string } }).message.type =
+            "host_bash_request";
+        } catch {
+          // Frozen snapshot — the mutation is rejected.
+        }
+      },
+    });
+    const hostSub = subscribeHostClient("facade-fanout-client", hostReceived);
+    try {
+      await pluginHub.publish(envelope("sync_changed"));
+      expect(hostReceived).toHaveLength(1);
+      expect(eventType(hostReceived[0])).toBe("sync_changed");
+    } finally {
+      attacker.dispose();
+      hostSub.dispose();
+    }
+  });
+
+  test("rejects host events disguised as boxed strings (Codex P1)", async () => {
+    const received: AssistantEvent[] = [];
+    const sub = subscribeHostClient("facade-boxed-client", received);
+    try {
+      // `new String(...)` is typeof "object" (slipping a naive string guard) but
+      // JSON-serializes to the primitive the client acts on. The canonical wire
+      // snapshot coerces it so the guard still blocks it.
+
+      const boxedType = new String("host_bash_request");
+      const boxed = {
+        message: { type: boxedType },
+      } as unknown as AssistantEvent;
+      let rejected: unknown;
+      try {
+        await pluginHub.publish(boxed, {
+          targetClientId: "facade-boxed-client",
+          targetCapability: "host_bash",
+        });
+      } catch (err) {
+        rejected = err;
+      }
+      expect(rejected).toBeInstanceOf(Error);
+      expect((rejected as Error).message).toMatch(/host-proxy control events/);
+      expect(received).toHaveLength(0);
+    } finally {
+      sub.dispose();
+    }
+  });
+
+  test("delegates non-host publish to the shared singleton", async () => {
+    const received: AssistantEvent[] = [];
+    // Subscribe on the RAW hub, publish through the FACADE: delivery proves the
+    // facade delegates to the same instance (shared subscriber state). The
+    // delivered event is a snapshot, so it is compared by value, not identity.
+    const sub = rawHub.subscribe({
+      type: "process",
+      callback: (event) => {
+        received.push(event);
+      },
+    });
+    try {
+      await pluginHub.publish(envelope("sync_changed"));
+      expect(received.some((e) => eventType(e) === "sync_changed")).toBe(true);
+    } finally {
+      sub.dispose();
+    }
+  });
+
+  test("delegates subscribe and hasSubscribersForEvent", () => {
+    const sub = pluginHub.subscribe({ type: "process", callback: () => {} });
+    try {
+      expect(typeof sub.dispose).toBe("function");
+      expect(
+        typeof pluginHub.hasSubscribersForEvent({ conversationId: undefined }),
+      ).toBe("boolean");
+    } finally {
+      sub.dispose();
+    }
+  });
+
+  test("downgrades plugin client subscriptions to in-process (no host-event interception) (Codex P1)", async () => {
+    const received: AssistantEvent[] = [];
+    // Ask for a host-capable client subscription; the facade must register a
+    // process subscriber, which never receives capability-targeted host events.
+    const sub = pluginHub.subscribe({
+      type: "client",
+      clientId: "plugin-fake-client",
+      interfaceId: "macos",
+      capabilities: ["host_bash"],
+      callback: (event) => {
+        received.push(event);
+      },
+    } as Parameters<typeof pluginHub.subscribe>[0]);
+    try {
+      await rawHub.publish(envelope("host_bash_request"), {
+        targetCapability: "host_bash",
+      });
+      expect(received).toHaveLength(0);
+    } finally {
+      sub.dispose();
+    }
+  });
+
+  test("isolates plugin callbacks so they cannot mutate the in-flight fanout event (Codex P1)", async () => {
+    const hostReceived: AssistantEvent[] = [];
+    // The plugin subscribes first and, from its callback, tries to rewrite the
+    // shared in-flight event into a host request. It must only see an isolated
+    // copy, leaving the real client's event untouched.
+    const pluginSub = pluginHub.subscribe({
+      type: "process",
+      callback: (event) => {
+        try {
+          (event as { message: { type: string } }).message.type =
+            "host_bash_request";
+        } catch {
+          // Isolated frozen copy — the mutation is rejected.
+        }
+      },
+    });
+    const hostSub = subscribeHostClient(
+      "facade-isolation-client",
+      hostReceived,
+    );
+    try {
+      // Daemon-published untargeted event (not via the facade): the plugin runs
+      // first in the fanout but only receives an isolated copy.
+      await rawHub.publish(envelope("sync_changed"));
+      expect(hostReceived).toHaveLength(1);
+      expect(eventType(hostReceived[0])).toBe("sync_changed");
+    } finally {
+      pluginSub.dispose();
+      hostSub.dispose();
+    }
+  });
+
+  test("snapshots plugin subscription filters so a filter getter never runs during fanout (Codex P1)", async () => {
+    let getterCalls = 0;
+    const filter = {};
+    Object.defineProperty(filter, "conversationId", {
+      enumerable: true,
+      get() {
+        getterCalls += 1;
+        return undefined;
+      },
+    });
+    const pluginSub = pluginHub.subscribe({
+      type: "process",
+      filter: filter as { conversationId?: string },
+      callback: () => {},
+    });
+    const hostSub = subscribeHostClient("facade-filter-client", []);
+    try {
+      const callsAfterSubscribe = getterCalls;
+      // A conversation-scoped event makes the hub read `entry.filter.conversationId`
+      // during fanout; with an inert snapshot the plugin's getter never fires.
+      await rawHub.publish(
+        {
+          message: { type: "host_bash_request" },
+          conversationId: "conv-1",
+        } as unknown as AssistantEvent,
+        { targetCapability: "host_bash" },
+      );
+      expect(getterCalls).toBe(callsAfterSubscribe);
+    } finally {
+      pluginSub.dispose();
+      hostSub.dispose();
+    }
+  });
+
+  test("guard survives String.prototype.startsWith being monkey-patched (Codex P1)", async () => {
+    const originalStartsWith = String.prototype.startsWith;
+    // Simulate a malicious plugin neutering the prototype method the guard reads.
+
+    String.prototype.startsWith = () => false;
+    try {
+      let rejected: unknown;
+      try {
+        await pluginHub.publish(envelope("host_bash_request"));
+      } catch (err) {
+        rejected = err;
+      }
+      expect(rejected).toBeInstanceOf(Error);
+      expect((rejected as Error).message).toMatch(/host-proxy control events/);
+    } finally {
+      String.prototype.startsWith = originalStartsWith;
+    }
+  });
+});

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -40,7 +40,7 @@ const DEFAULTS_ABS = join(process.cwd(), DEFAULTS_REL);
  * specifiers it reaches for outside itself. These are host-internal couplings
  * with no `@vellumai/plugin-api` equivalent (memory/daemon/context/config
  * internals, runtime builtins, third-party packages). `providers/types.js`
- * appears only for `ToolDefinition` (a `@vellumai/skill-host-contracts` type
+ * appears only for `ToolDefinition` (a `tools/tool-types.js` type
  * distinct from plugin-api's), which the anti-backslide guard enforces.
  *
  * Regenerate after an intentional change with:
@@ -81,7 +81,9 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../../config/types.js",
     "../../../../../messaging/providers/slack/message-metadata.js",
     "../../../../../persistence/auto-analysis-constants.js",
+    "../../../../../persistence/checkpoints.js",
     "../../../../../persistence/conversation-queries.js",
+    "../../../../../persistence/conversation-search-lexical.js",
     "../../../../../persistence/db-connection.js",
     "../../../../../persistence/embeddings/embed.js",
     "../../../../../persistence/embeddings/embedding-backend.js",
@@ -106,6 +108,7 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../daemon/conversation-notices.js",
     "../../../../daemon/conversation-registry.js",
     "../../../../daemon/conversation-runtime-assembly.js",
+    "../../../../daemon/embedding-reconcile.js",
     "../../../../daemon/identity-helpers.js",
     "../../../../daemon/message-protocol.js",
     "../../../../daemon/message-types/memory.js",
@@ -131,10 +134,7 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../persistence/schema/conversations.js",
     "../../../../persistence/schema/index.js",
     "../../../../prompts/system-prompt.js",
-    "../../../../providers/cache-control.js",
-    "../../../../providers/provider-send-message.js",
-    "../../../../providers/types.js",
-    "../../../../runtime/actor-trust-resolver.js",
+    "../../../../providers/platform-proxy/context.js",
     "../../../../runtime/assistant-event-hub.js",
     "../../../../runtime/auth/route-policy.js",
     "../../../../runtime/background-job-runner.js",
@@ -142,9 +142,9 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../runtime/routes/types.js",
     "../../../../security/secret-scanner.js",
     "../../../../skills/catalog-cache.js",
-    "../../../../skills/frontmatter.js",
     "../../../../skills/install-meta.js",
     "../../../../skills/skill-memory.js",
+    "../../../../telemetry/watchdog-events-store.js",
     "../../../../tools/skills/delete-managed.js",
     "../../../../util/abort-reasons.js",
     "../../../../util/errors.js",
@@ -159,18 +159,24 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../config/assistant-feature-flags.js",
     "../../../config/loader.js",
     "../../../config/memory-v3-gate.js",
+    "../../../config/schema.js",
     "../../../config/schemas/memory-v2.js",
     "../../../config/types.js",
     "../../../contacts/guardian-delivery-reader.js",
     "../../../context/compactor.js",
     "../../../context/strip-injections.js",
     "../../../context/token-estimator.js",
+    "../../../conversations/job-handlers/summarization.js",
     "../../../daemon/date-context.js",
     "../../../daemon/disk-pressure-background-gate.js",
+    "../../../daemon/embedding-reconcile.js",
     "../../../daemon/pkb-context-tracker.js",
     "../../../daemon/pkb-reminder-builder.js",
+    "../../../daemon/skill-memory-refresh.js",
     "../../../daemon/tool-setup-types.js",
     "../../../daemon/trust-context.js",
+    "../../../home/job-handlers/conversation-starters.js",
+    "../../../media/job-handlers/media-processing.js",
     "../../../permissions/types.js",
     "../../../persistence/checkpoints.js",
     "../../../persistence/conversation-crud.js",
@@ -178,7 +184,15 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../persistence/embeddings/embedding-backend.js",
     "../../../persistence/embeddings/embedding-runtime-manager.js",
     "../../../persistence/embeddings/embedding-types.js",
+    "../../../persistence/embeddings/messages-lexical-index.js",
+    "../../../persistence/embeddings/qdrant-client.js",
+    "../../../persistence/embeddings/qdrant-manager.js",
+    "../../../persistence/job-handlers/cleanup.js",
+    "../../../persistence/job-handlers/message-lexical-backfill.js",
+    "../../../persistence/job-handlers/message-lexical.js",
+    "../../../persistence/job-utils.js",
     "../../../persistence/jobs-store.js",
+    "../../../persistence/jobs-worker.js",
     "../../../persistence/memory-lifecycle-hooks.js",
     "../../../persistence/message-content.js",
     "../../../persistence/raw-query.js",
@@ -191,6 +205,7 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../runtime/capabilities.js",
     "../../../runtime/services/auto-analysis-enqueue.js",
     "../../../runtime/services/auto-analysis-guard.js",
+    "../../../runtime/services/conversation-analyze-job.js",
     "../../../tools/types.js",
     "../../../types.js",
     "../../../util/logger.js",
@@ -248,7 +263,7 @@ const BASELINE: Record<string, readonly string[]> = {
  * Symbols that `@vellumai/plugin-api` re-exports from `providers/types.js`. A
  * plugin must import these from the public API, not the host module. NOT
  * listed (and therefore allowed from `providers/types.js`): `ToolDefinition`,
- * which `providers/types.js` re-exports from `@vellumai/skill-host-contracts`
+ * which `providers/types.js` re-exports from `tools/tool-types.js`
  * — a different type than plugin-api's own `ToolDefinition`.
  */
 const PLUGIN_API_PROVIDER_TYPES: ReadonlySet<string> = new Set([
@@ -298,13 +313,19 @@ function collectPluginFiles(): PluginFile[] {
       cwd: process.cwd(),
     })) {
       const norm = rel.split("/").join(sep);
-      if (norm.endsWith(".test.ts") || norm.endsWith(".test.tsx")) continue;
-      if (norm.split(sep).includes("__tests__")) continue;
+      if (norm.endsWith(".test.ts") || norm.endsWith(".test.tsx")) {
+        continue;
+      }
+      if (norm.split(sep).includes("__tests__")) {
+        continue;
+      }
       const underDefaults = relative(DEFAULTS_REL, norm);
       const segments = underDefaults.split(sep);
       // A file directly under defaults/ (e.g. index.ts) is the registry, not a
       // plugin — it has no plugin directory segment.
-      if (segments.length < 2) continue;
+      if (segments.length < 2) {
+        continue;
+      }
       const absPath = join(process.cwd(), norm);
       files.push({
         plugin: segments[0]!,
@@ -332,11 +353,15 @@ function collectEscapes(files: PluginFile[]): Escape[] {
     let match: RegExpExecArray | null;
     while ((match = regex.exec(file.source)) !== null) {
       const specifier = match[1] ?? match[2] ?? match[3];
-      if (!specifier || specifier === "@vellumai/plugin-api") continue;
+      if (!specifier || specifier === "@vellumai/plugin-api") {
+        continue;
+      }
       if (specifier.startsWith(".")) {
         const resolved = resolve(dirname(file.absPath), specifier);
         // Stays inside the plugin's own directory → allowed.
-        if (!relative(pluginRoot, resolved).startsWith("..")) continue;
+        if (!relative(pluginRoot, resolved).startsWith("..")) {
+          continue;
+        }
       }
       escapes.push({ plugin: file.plugin, specifier, relPath: file.relPath });
     }
@@ -349,7 +374,9 @@ function escapesByPlugin(escapes: Escape[]): Map<string, string[]> {
   const sets = new Map<string, Set<string>>();
   for (const e of escapes) {
     let set = sets.get(e.plugin);
-    if (!set) sets.set(e.plugin, (set = new Set()));
+    if (!set) {
+      sets.set(e.plugin, (set = new Set()));
+    }
     set.add(e.specifier);
   }
   return new Map(
@@ -372,24 +399,61 @@ function parseNamedSymbols(clause: string): string[] {
     .filter((name) => name.length > 0);
 }
 
+/** Sentinel returned by {@link symbolsImportedFrom} for a namespace import
+ *  (`import * as NS from "X"` / `import type * as NS from "X"`): it binds the
+ *  module's entire export surface, so it counts as importing every re-exported
+ *  symbol. `*` cannot collide with a real named-import identifier. */
+const NAMESPACE_IMPORT = "*";
+
 /** Symbols a plugin file imports from a host module whose specifier ends with
- *  `hostPathSuffix` (e.g. `providers/types.js`), across multi-line clauses. */
+ *  `hostPathSuffix` (e.g. `providers/types.js`), across multi-line clauses. A
+ *  namespace import yields the {@link NAMESPACE_IMPORT} sentinel — it reaches
+ *  the whole surface, so it must not slip past the anti-backslide check. */
 function symbolsImportedFrom(source: string, hostPathSuffix: string): string[] {
   const escaped = hostPathSuffix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const regex = new RegExp(
-    String.raw`import\s+(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]*` +
-      escaped +
-      String.raw`)['"]`,
+  const from = String.raw`\s*from\s*['"]([^'"]*` + escaped + String.raw`)['"]`;
+  const namedRegex = new RegExp(
+    String.raw`import\s+(?:type\s+)?\{([^}]*)\}` + from,
+    "g",
+  );
+  const namespaceRegex = new RegExp(
+    String.raw`import\s+(?:type\s+)?\*\s+as\s+\w+` + from,
     "g",
   );
   const symbols: string[] = [];
   let match: RegExpExecArray | null;
-  while ((match = regex.exec(source)) !== null) {
+  while ((match = namedRegex.exec(source)) !== null) {
     symbols.push(...parseNamedSymbols(match[1]!));
   }
+  while (namespaceRegex.exec(source) !== null) {
+    symbols.push(NAMESPACE_IMPORT);
+  }
   return symbols;
 }
 
+/** Anti-backslide violations for one plugin file against one guarded host
+ *  module: any re-exported symbol imported by name, plus any namespace import
+ *  (which binds the whole surface, and thus every guarded symbol). */
+function guardedImportViolations(
+  file: PluginFile,
+  hostPathSuffix: string,
+  guarded: ReadonlySet<string>,
+): string[] {
+  const violations: string[] = [];
+  for (const symbol of symbolsImportedFrom(file.source, hostPathSuffix)) {
+    if (symbol === NAMESPACE_IMPORT) {
+      violations.push(
+        `  - ${file.relPath}: "import * as … from ${hostPathSuffix}" reaches all re-exported symbols`,
+      );
+    } else if (guarded.has(symbol)) {
+      violations.push(
+        `  - ${file.relPath}: "${symbol}" from ${hostPathSuffix}`,
+      );
+    }
+  }
+  return violations;
+}
+
 describe("plugin import boundary", () => {
   const files = collectPluginFiles();
   const escapes = collectEscapes(files);
@@ -426,7 +490,9 @@ describe("plugin import boundary", () => {
         }
       }
       for (const spec of [...allowed].sort()) {
-        if (!found.has(spec)) stale.push(`  - ${plugin}: "${spec}"`);
+        if (!found.has(spec)) {
+          stale.push(`  - ${plugin}: "${spec}"`);
+        }
       }
     }
 
@@ -444,7 +510,9 @@ describe("plugin import boundary", () => {
       );
     }
     if (stale.length > 0) {
-      if (problems.length > 0) problems.push("");
+      if (problems.length > 0) {
+        problems.push("");
+      }
       problems.push(
         "Stale baseline entries (no longer imported — tighten the baseline):",
         ...stale,
@@ -459,26 +527,18 @@ describe("plugin import boundary", () => {
   test("plugins import plugin-api-provided types from @vellumai/plugin-api, not host modules", () => {
     const violations: string[] = [];
     for (const file of files) {
-      for (const symbol of symbolsImportedFrom(
-        file.source,
-        "providers/types.js",
-      )) {
-        if (PLUGIN_API_PROVIDER_TYPES.has(symbol)) {
-          violations.push(
-            `  - ${file.relPath}: "${symbol}" from providers/types.js`,
-          );
-        }
-      }
-      for (const symbol of symbolsImportedFrom(
-        file.source,
-        "config/schemas/llm.js",
-      )) {
-        if (PLUGIN_API_LLM_TYPES.has(symbol)) {
-          violations.push(
-            `  - ${file.relPath}: "${symbol}" from config/schemas/llm.js`,
-          );
-        }
-      }
+      violations.push(
+        ...guardedImportViolations(
+          file,
+          "providers/types.js",
+          PLUGIN_API_PROVIDER_TYPES,
+        ),
+        ...guardedImportViolations(
+          file,
+          "config/schemas/llm.js",
+          PLUGIN_API_LLM_TYPES,
+        ),
+      );
     }
 
     const message = [
@@ -487,9 +547,63 @@ describe("plugin import boundary", () => {
       ...violations,
       "",
       "(ToolDefinition from providers/types.js is allowed — it is a distinct",
-      "@vellumai/skill-host-contracts type, not plugin-api's ToolDefinition.)",
+      "tools/tool-types.js type, not plugin-api's ToolDefinition.)",
     ].join("\n");
 
     expect(violations, message).toEqual([]);
   });
 });
+
+describe("anti-backslide symbol extraction", () => {
+  const fileWith = (source: string): PluginFile => ({
+    plugin: "compaction",
+    relPath: "src/plugins/defaults/compaction/example.ts",
+    absPath: "/example.ts",
+    source,
+  });
+
+  test("a re-exported type imported by name is flagged", () => {
+    const file = fileWith(
+      `import type { Message } from "../../../providers/types.js";`,
+    );
+    expect(
+      guardedImportViolations(
+        file,
+        "providers/types.js",
+        PLUGIN_API_PROVIDER_TYPES,
+      ),
+    ).not.toEqual([]);
+  });
+
+  test("the allowed ToolDefinition named import stays clean", () => {
+    const file = fileWith(
+      `import type { ToolDefinition } from "../../../providers/types.js";`,
+    );
+    expect(
+      guardedImportViolations(
+        file,
+        "providers/types.js",
+        PLUGIN_API_PROVIDER_TYPES,
+      ),
+    ).toEqual([]);
+  });
+
+  // A namespace import binds the whole surface (`NS.Message`), so it must be
+  // caught even though the anti-backslide check extracts no named symbols and
+  // the specifier is already in the ratchet baseline.
+  test("a namespace import of a guarded module is flagged", () => {
+    for (const source of [
+      `import * as ProviderTypes from "../../../providers/types.js";`,
+      `import type * as ProviderTypes from "../../../providers/types.js";`,
+    ]) {
+      expect(
+        guardedImportViolations(
+          fileWith(source),
+          "providers/types.js",
+          PLUGIN_API_PROVIDER_TYPES,
+        ),
+        source,
+      ).not.toEqual([]);
+    }
+  });
+});