@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/__tests__/scheduler-wake.test.ts

@@ -27,6 +27,11 @@ mock.module("../runtime/agent-wake.js", () => ({
   wakeAgentForOpportunity: mockWakeAgentForOpportunity,
 }));
 
+const mockProcessMessage = mock((..._args: unknown[]) => Promise.resolve());
+mock.module("../daemon/process-message.js", () => ({
+  processMessage: mockProcessMessage,
+}));
+
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { createSchedule } from "../schedule/schedule-store.js";
@@ -77,6 +82,7 @@ describe("scheduler wake mode", () => {
     db.run("DELETE FROM messages");
     db.run("DELETE FROM conversations");
     mockWakeAgentForOpportunity.mockClear();
+    mockProcessMessage.mockClear();
   });
 
   test("wake schedule calls wakeAgentForOpportunity with correct args", async () => {
@@ -90,10 +96,8 @@ describe("scheduler wake mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    const processMessage = mock(() => Promise.resolve());
-
     // WHEN the scheduler fires
-    const scheduler = startScheduler(processMessage, () => {});
+    const scheduler = startScheduler();
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler.stop();
 
@@ -107,7 +111,7 @@ describe("scheduler wake mode", () => {
     });
 
     // AND processMessage is never called (wake mode doesn't use it)
-    expect(processMessage).not.toHaveBeenCalled();
+    expect(mockProcessMessage).not.toHaveBeenCalled();
   });
 
   test("missing wakeConversationId logs warning and completes (not fails)", async () => {
@@ -127,10 +131,8 @@ describe("scheduler wake mode", () => {
     );
     forceScheduleDue(schedule.id);
 
-    const processMessage = mock(() => Promise.resolve());
-
     // WHEN the scheduler fires
-    const scheduler = startScheduler(processMessage, () => {});
+    const scheduler = startScheduler();
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler.stop();
 
@@ -161,10 +163,7 @@ describe("scheduler wake mode", () => {
     forceScheduleDue(schedule.id);
 
     // WHEN the scheduler fires
-    const scheduler = startScheduler(
-      mock(() => Promise.resolve()),
-      () => {},
-    );
+    const scheduler = startScheduler();
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler.stop();
 
@@ -189,10 +188,7 @@ describe("scheduler wake mode", () => {
     forceScheduleDue(schedule.id);
 
     // WHEN the scheduler fires
-    const scheduler = startScheduler(
-      mock(() => Promise.resolve()),
-      () => {},
-    );
+    const scheduler = startScheduler();
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler.stop();
 
@@ -225,10 +221,7 @@ describe("scheduler wake mode", () => {
     });
     forceScheduleDue(schedule.id);
 
-    const scheduler = startScheduler(
-      mock(() => Promise.resolve()),
-      () => {},
-    );
+    const scheduler = startScheduler();
 
     // WHEN the first tick runs (fires immediately from startScheduler)
     await new Promise((resolve) => origSetTimeout(resolve, 600));
@@ -277,10 +270,7 @@ describe("scheduler wake mode", () => {
     ]);
 
     // WHEN the scheduler fires (first tick runs immediately from startScheduler)
-    const scheduler = startScheduler(
-      mock(() => Promise.resolve()),
-      () => {},
-    );
+    const scheduler = startScheduler();
     await new Promise((resolve) => origSetTimeout(resolve, 600));
     scheduler.stop();
 

package/src/__tests__/scheduler-worker-standdown.test.ts

@@ -0,0 +1,220 @@
+/**
+ * Scheduler ↔ schedule-worker ownership: while `schedules.worker.enabled` is
+ * set, the daemon's in-process scheduler must leave every due schedule
+ * unclaimed (the worker process owns schedule execution), while
+ * `runDueSchedulesOnce` — the worker's tick — claims and executes them.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+  truncateForLog: (value: string) => value,
+}));
+
+mock.module("../background-wake/publisher.js", () => ({
+  refreshBackgroundWakeIntent: () => {},
+}));
+
+let workerEnabled = false;
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    schedules: { worker: { enabled: workerEnabled } },
+    timeouts: { scheduleTurnTimeoutSec: 1800 },
+  }),
+  loadConfig: () => ({}),
+  loadRawConfig: () => ({}),
+  saveRawConfig: () => {},
+  getConfigReadOnly: () => ({}),
+  applyNestedDefaults: (config: unknown) => config,
+  deepMergeOverwrite: (base: unknown) => base,
+  mergeDefaultWorkspaceConfig: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+  API_KEY_PROVIDERS: [],
+  _writeQuarantineNotice: () => {},
+  invalidateConfigCache: () => {},
+}));
+
+mock.module("../daemon/disk-pressure-background-gate.js", () => ({
+  checkDiskPressureBackgroundGate: () => ({
+    action: "allow",
+    status: {
+      enabled: false,
+      state: "disabled",
+      locked: false,
+      acknowledged: false,
+      overrideActive: false,
+      effectivelyLocked: false,
+      lockId: null,
+      usagePercent: null,
+      thresholdPercent: 95,
+      path: null,
+      lastCheckedAt: null,
+      blockedCapabilities: [],
+      error: null,
+    },
+  }),
+  diskPressureBackgroundSkipLogFields: () => ({}),
+  shouldLogDiskPressureBackgroundSkip: () => false,
+}));
+
+const mockEmitNotificationSignal = mock((..._args: unknown[]) =>
+  Promise.resolve(),
+);
+mock.module("../notifications/emit-signal.js", () => ({
+  emitNotificationSignal: mockEmitNotificationSignal,
+}));
+
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { createSchedule } from "../schedule/schedule-store.js";
+import {
+  runDueSchedulesOnce,
+  runScheduleDueWorkOnce,
+} from "../schedule/scheduler.js";
+
+await initializeDb();
+
+function rawDb(): import("bun:sqlite").Database {
+  return (getDb() as unknown as { $client: import("bun:sqlite").Database })
+    .$client;
+}
+
+beforeEach(() => {
+  workerEnabled = false;
+  mockEmitNotificationSignal.mockClear();
+  const db = getDb();
+  db.run("DELETE FROM cron_runs");
+  db.run("DELETE FROM cron_jobs");
+});
+
+/** One due recurring script schedule + one due recurring notify schedule. */
+async function createDueScriptAndNotifyJobs() {
+  const script = await createSchedule({
+    name: "Script job",
+    cronExpression: "* * * * *",
+    message: "run script",
+    mode: "script",
+    script: "echo ran",
+  });
+  const notify = await createSchedule({
+    name: "Notify job",
+    cronExpression: "* * * * *",
+    message: "ping",
+    mode: "notify",
+  });
+  rawDb().run("UPDATE cron_jobs SET next_run_at = ?", [Date.now() - 1000]);
+  return { script, notify };
+}
+
+function runsFor(jobId: string): Array<{ status: string }> {
+  return rawDb()
+    .query("SELECT status FROM cron_runs WHERE job_id = ?")
+    .all(jobId) as Array<{ status: string }>;
+}
+
+describe("scheduler stand-down for the schedule worker", () => {
+  test("flag on: leaves every due schedule unclaimed and reports none pending", async () => {
+    workerEnabled = true;
+    const { script } = await createDueScriptAndNotifyJobs();
+    const dueBefore = rawDb()
+      .query("SELECT id, next_run_at FROM cron_jobs")
+      .all() as Array<{ id: string; next_run_at: number }>;
+
+    const result = await runScheduleDueWorkOnce({
+      includeStillPending: true,
+    });
+
+    expect(result.claimed).toBe(0);
+    expect(result.stillPending).toBe(0);
+    expect(mockEmitNotificationSignal).not.toHaveBeenCalled();
+    expect(runsFor(script.id)).toHaveLength(0);
+    // Nothing advanced — every schedule stays due for the worker to claim.
+    const dueAfter = rawDb()
+      .query("SELECT id, next_run_at FROM cron_jobs")
+      .all() as Array<{ id: string; next_run_at: number }>;
+    expect(dueAfter).toEqual(dueBefore);
+  });
+
+  test("flag off: the in-process scheduler claims and runs due schedules itself", async () => {
+    workerEnabled = false;
+    const { script } = await createDueScriptAndNotifyJobs();
+
+    const result = await runScheduleDueWorkOnce();
+
+    expect(result.claimed).toBe(2);
+    const scriptRuns = runsFor(script.id);
+    expect(scriptRuns).toHaveLength(1);
+    expect(scriptRuns[0].status).toBe("ok");
+    expect(mockEmitNotificationSignal).toHaveBeenCalled();
+  });
+});
+
+describe("runDueSchedulesOnce (the schedule worker's tick)", () => {
+  test("claims and executes due schedules across modes", async () => {
+    // The worker runs with the flag on; runDueSchedulesOnce itself does not
+    // consult the flag — its caller owns schedule execution.
+    workerEnabled = true;
+    const { script } = await createDueScriptAndNotifyJobs();
+
+    const result = await runDueSchedulesOnce();
+
+    expect(result.claimed).toBe(2);
+    expect(result.completed).toBe(2);
+    const scriptRuns = runsFor(script.id);
+    expect(scriptRuns).toHaveLength(1);
+    expect(scriptRuns[0].status).toBe("ok");
+    // Notify mode fired through the notification pipeline.
+    expect(mockEmitNotificationSignal).toHaveBeenCalledTimes(1);
+  });
+
+  test("completes a one-shot script schedule after a successful run", async () => {
+    const oneShot = await createSchedule({
+      name: "One-shot script",
+      cronExpression: null,
+      message: "run once",
+      mode: "script",
+      script: "true",
+      nextRunAt: Date.now() - 1000,
+    });
+
+    const result = await runDueSchedulesOnce();
+
+    expect(result.completed).toBe(1);
+    const row = rawDb()
+      .query("SELECT status, enabled FROM cron_jobs WHERE id = ?")
+      .get(oneShot.id) as { status: string; enabled: number };
+    expect(row.status).toBe("fired");
+    expect(row.enabled).toBe(0);
+  });
+
+  test("records an error run and schedules a retry when a script fails", async () => {
+    const failing = await createSchedule({
+      name: "Failing script",
+      cronExpression: "* * * * *",
+      message: "fail",
+      mode: "script",
+      script: "echo boom >&2; exit 1",
+    });
+    rawDb().run("UPDATE cron_jobs SET next_run_at = ?", [Date.now() - 1000]);
+
+    const result = await runDueSchedulesOnce();
+
+    expect(result.failed).toBe(1);
+    const runs = rawDb()
+      .query("SELECT status, error FROM cron_runs WHERE job_id = ?")
+      .all(failing.id) as Array<{ status: string; error: string | null }>;
+    expect(runs).toHaveLength(1);
+    expect(runs[0].status).toBe("error");
+    expect(runs[0].error).toContain("boom");
+    const row = rawDb()
+      .query("SELECT retry_count, next_run_at FROM cron_jobs WHERE id = ?")
+      .get(failing.id) as { retry_count: number; next_run_at: number };
+    expect(row.retry_count).toBe(1);
+    expect(row.next_run_at).toBeGreaterThan(Date.now());
+  });
+});

package/src/__tests__/secret-routes-platform-proxy.test.ts

@@ -125,7 +125,7 @@ mock.module("../util/logger.js", () => ({
 // `handleAddSecret` fires this detached when a managed-proxy credential lands —
 // a v2-memory side effect outside this suite's provider-registry scope. Stub it
 // to a no-op; its behavior is covered by memory-v2-startup.test.ts.
-mock.module("../daemon/memory-v2-startup.js", () => ({
+mock.module("../plugins/defaults/memory/v2/memory-v2-startup.js", () => ({
   maybeReseedCapabilitiesAfterManagedCredential: async () => {},
 }));
 

package/src/__tests__/shell-observability.test.ts

@@ -105,6 +105,7 @@ mock.module("../tools/background-tool-registry.js", () => ({
     const idx = registeredTools.findIndex((t) => t.id === id);
     if (idx !== -1) registeredTools.splice(idx, 1);
   },
+  recordCompletedBackgroundTool: () => {},
   generateBackgroundToolId: () => "bg-obs-test",
   isBackgroundToolLimitReached: () => false,
   MAX_BACKGROUND_TOOLS: 20,

package/src/__tests__/skill-boundary-guard.test.ts

@@ -7,10 +7,9 @@ import { Glob } from "bun";
 /**
  * Guard tests for the skill-isolation boundary. See AGENTS.md "Skill
  * Isolation". Both directions are enforced: zero relative imports across
- * `assistant/` ↔ `skills/`. Skills wire into the daemon through the
- * `SkillHost` contract in `@vellumai/skill-host-contracts`; the daemon
- * loads first-party skills as separate processes via the manifest in
- * `meet-host-startup.ts`.
+ * `assistant/` ↔ `skills/`. Skills must not reach into `assistant/`
+ * internals via relative paths, and the assistant must not reach into
+ * `skills/`.
  *
  * Note: `assistant/src/skills/` is the internal skill-catalog loader and
  * is NOT a violation when referenced via `../skills/...` from within

package/src/__tests__/skill-load-plugin-scope.test.ts

@@ -0,0 +1,238 @@
+/**
+ * Tests that `skill_load` rejects loading a plugin-owned skill whose owning
+ * plugin is outside the conversation's effective per-chat plugin set, and lets
+ * it through when the plugin is in scope (or when there is no restriction).
+ *
+ * `loadSkillBySelector` is mocked to return a plugin-owned skill rooted at a
+ * real temp dir so the in-scope path can complete the full load.
+ */
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, mock, test } from "bun:test";
+
+import type { SkillDefinition, SkillSummary } from "../config/skills.js";
+
+const noopLogger = new Proxy({} as Record<string, unknown>, {
+  get: (_t, prop) => (prop === "child" ? () => noopLogger : () => {}),
+});
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => noopLogger,
+  getCliLogger: () => noopLogger,
+  truncateForLog: (s: unknown) => String(s),
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({}),
+  getConfigReadOnly: () => ({}),
+  loadConfig: () => ({}),
+  loadRawConfig: () => ({}),
+  saveRawConfig: () => {},
+  invalidateConfigCache: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+  deepMergeOverwrite: (a: unknown) => a,
+  mergeDefaultWorkspaceConfig: () => {},
+  API_KEY_PROVIDERS: [
+    "anthropic",
+    "openai",
+    "gemini",
+    "ollama",
+    "fireworks",
+    "openrouter",
+    "brave",
+    "perplexity",
+    "tavily",
+  ],
+}));
+
+// A real directory so the in-scope load's filesystem reads (reference listing,
+// version hash, tool manifest) succeed.
+const skillDir = mkdtempSync(join(tmpdir(), "skill-plugin-scope-"));
+writeFileSync(
+  join(skillDir, "SKILL.md"),
+  `---\nname: "plug-skill"\ndescription: "Owned by plugin p"\n---\n\nDo the plugin thing.\n`,
+);
+
+const pluginSkill: SkillDefinition = {
+  id: "plug-skill",
+  name: "plug-skill",
+  displayName: "Plugin Skill",
+  description: "Owned by plugin p",
+  directoryPath: skillDir,
+  skillFilePath: join(skillDir, "SKILL.md"),
+  source: "plugin",
+  owner: { kind: "plugin", id: "p" },
+  body: "Do the plugin thing.",
+  includes: [],
+};
+
+// ── Include-path scope fixtures ────────────────────────────────────────────
+// An in-scope parent (plugin "p") that includes three children: a bundled/core
+// child (always allowed), an in-scope plugin child (plugin "p"), and an
+// out-of-scope plugin child (plugin "q", not in the effective set).
+const childCoreSkill: SkillDefinition = {
+  id: "child-core",
+  name: "child-core",
+  displayName: "Child Core",
+  description: "Bundled child, always allowed",
+  directoryPath: skillDir,
+  skillFilePath: join(skillDir, "SKILL.md"),
+  source: "bundled",
+  body: "CHILD CORE BODY",
+  includes: [],
+};
+const childInSkill: SkillDefinition = {
+  id: "child-in",
+  name: "child-in",
+  displayName: "Child In",
+  description: "In-scope child owned by plugin p",
+  directoryPath: skillDir,
+  skillFilePath: join(skillDir, "SKILL.md"),
+  source: "plugin",
+  owner: { kind: "plugin", id: "p" },
+  body: "CHILD IN BODY",
+  includes: [],
+};
+const childOutSkill: SkillDefinition = {
+  id: "child-out",
+  name: "child-out",
+  displayName: "Child Out",
+  description: "Out-of-scope child owned by plugin q",
+  directoryPath: skillDir,
+  skillFilePath: join(skillDir, "SKILL.md"),
+  source: "plugin",
+  owner: { kind: "plugin", id: "q" },
+  body: "CHILD OUT BODY",
+  includes: [],
+};
+const parentSkill: SkillDefinition = {
+  id: "parent-skill",
+  name: "parent-skill",
+  displayName: "Parent Skill",
+  description: "In-scope parent including a child per plugin",
+  directoryPath: skillDir,
+  skillFilePath: join(skillDir, "SKILL.md"),
+  source: "plugin",
+  owner: { kind: "plugin", id: "p" },
+  body: "PARENT BODY",
+  includes: ["child-core", "child-in", "child-out"],
+};
+
+const skillsById: Record<string, SkillDefinition> = {
+  "plug-skill": pluginSkill,
+  "parent-skill": parentSkill,
+  "child-core": childCoreSkill,
+  "child-in": childInSkill,
+  "child-out": childOutSkill,
+};
+
+// Catalog summaries drive the include-path gate: `catalogIndex.get(childId)`
+// supplies each child's `owner`, so the gate must read owners from here.
+const catalogSummaries: SkillSummary[] = [
+  parentSkill,
+  childCoreSkill,
+  childInSkill,
+  childOutSkill,
+].map(({ body: _body, ...summary }) => summary);
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realSkills = require("../config/skills.js");
+mock.module("../config/skills.js", () => ({
+  ...realSkills,
+  loadSkillBySelector: (selector: string) => {
+    const skill = skillsById[selector];
+    return skill
+      ? { skill }
+      : {
+          skill: undefined,
+          error: `not found: ${selector}`,
+          errorCode: "not_found",
+        };
+  },
+  loadSkillCatalog: () => catalogSummaries,
+}));
+
+await import("../tools/skills/load.js");
+const { getTool } = await import("../tools/registry.js");
+
+const REJECTION = "not available in this conversation";
+
+async function loadWithScope(
+  enabledPluginSet: Set<string> | null | undefined,
+  selector = "plug-skill",
+): Promise<{ content: string; isError: boolean }> {
+  const tool = getTool("skill_load");
+  if (!tool) throw new Error("skill_load tool was not registered");
+  const result = await tool.execute(
+    { skill: selector },
+    {
+      workingDir: "/tmp",
+      conversationId: "conversation-1",
+      trustClass: "guardian",
+      enabledPluginSet,
+    },
+  );
+  return { content: result.content, isError: result.isError };
+}
+
+describe("skill_load — per-chat plugin scope", () => {
+  test("rejects a plugin skill whose owner is outside the effective set", async () => {
+    const result = await loadWithScope(new Set(["other"]));
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(REJECTION);
+    expect(result.content).toContain("plug-skill");
+  });
+
+  test("loads the plugin skill when its owner is in the effective set", async () => {
+    const result = await loadWithScope(new Set(["p"]));
+    expect(result.content).not.toContain(REJECTION);
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: Plugin Skill");
+  });
+
+  test("null set (no per-chat restriction) loads the plugin skill", async () => {
+    const result = await loadWithScope(null);
+    expect(result.content).not.toContain(REJECTION);
+    expect(result.isError).toBe(false);
+  });
+
+  test("absent set (no per-chat restriction) loads the plugin skill", async () => {
+    const result = await loadWithScope(undefined);
+    expect(result.content).not.toContain(REJECTION);
+    expect(result.isError).toBe(false);
+  });
+});
+
+describe("skill_load — per-chat plugin scope on included children", () => {
+  test("omits an out-of-scope plugin child's body + marker, keeps in-scope/core children", async () => {
+    // Chat scoped to plugin "p". Parent (plugin "p") includes a core child, an
+    // in-scope plugin child, and an out-of-scope plugin "q" child.
+    const result = await loadWithScope(new Set(["p"]), "parent-skill");
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("PARENT BODY");
+
+    // Core (bundled) and in-scope plugin children: body + loaded-skill marker.
+    expect(result.content).toContain("CHILD CORE BODY");
+    expect(result.content).toContain('<loaded_skill id="child-core"');
+    expect(result.content).toContain("CHILD IN BODY");
+    expect(result.content).toContain('<loaded_skill id="child-in"');
+
+    // Out-of-scope plugin "q" child: no body, no marker, not even listed.
+    expect(result.content).not.toContain("CHILD OUT BODY");
+    expect(result.content).not.toContain("child-out");
+  });
+
+  test("with no restriction (null set) the out-of-scope child is included", async () => {
+    const result = await loadWithScope(null, "parent-skill");
+
+    expect(result.isError).toBe(false);
+    // Without a per-chat restriction every included child is injected.
+    expect(result.content).toContain("CHILD OUT BODY");
+    expect(result.content).toContain('<loaded_skill id="child-out"');
+  });
+});

package/src/__tests__/skill-projection-feature-flag.test.ts

@@ -30,6 +30,8 @@ const DECLARED_FLAG_KEY = "contacts";
 
 mock.module("../config/skills.js", () => ({
   loadSkillCatalog: () => mockCatalog,
+  // Pass-through: these tests don't exercise per-chat plugin scoping.
+  filterSkillsByEnabledPlugins: (skills: unknown) => skills,
 }));
 
 mock.module("../config/loader.js", () => ({

package/src/__tests__/skill-script-runner-host.test.ts

@@ -176,6 +176,59 @@ describe("runSkillToolScript — errors", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Host execution is a bundled-only capability
+// ---------------------------------------------------------------------------
+
+describe("runSkillToolScript — host execution requires a bundled skill", () => {
+  test("refuses host execution for a non-bundled skill", async () => {
+    // A managed/workspace/plugin skill declaring execution_target: host must be
+    // denied before its executor is dynamically imported into the host process.
+    const result = await runSkillToolScript(
+      tempDir,
+      "success.ts",
+      { name: "world" },
+      makeContext(),
+      { target: "host" },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("only permitted for first-party bundled");
+    expect(result.content).toContain('execution_target: "sandbox"');
+    // The script must not have run — its success output never appears.
+    expect(result.content).not.toContain("hello from world");
+  });
+
+  test("refuses host execution even when bundled is explicitly false", async () => {
+    const result = await runSkillToolScript(
+      tempDir,
+      "echo.ts",
+      { foo: "bar" },
+      makeContext(),
+      { target: "host", bundled: false },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("only permitted for first-party bundled");
+  });
+
+  test("allows host execution for a bundled skill", async () => {
+    // Bundled (first-party) skills ship trusted in-repo executors and may run
+    // on the host. With no registry entry for this temp script, the runner
+    // falls back to a dynamic import and the script executes.
+    const result = await runSkillToolScript(
+      tempDir,
+      "success.ts",
+      { name: "world" },
+      makeContext(),
+      { target: "host", bundled: true },
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toBe("hello from world");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Host skill runner hash guard
 // ---------------------------------------------------------------------------

package/src/__tests__/skill-script-runner-sandbox.test.ts

@@ -230,13 +230,16 @@ describe("runSkillToolScript routing", () => {
     expect(result.content).toBe("sandbox hello from host");
   });
 
-  test("explicit target=host uses in-process execution", async () => {
+  test("explicit target=host uses in-process execution for a bundled skill", async () => {
+    // Host execution is a first-party capability — the runner only runs it
+    // in-process for bundled skills (non-bundled host execution is refused;
+    // see skill-script-runner-host.test.ts).
     const result = await runSkillToolScript(
       tempDir,
       "success.ts",
       { name: "explicit" },
       makeContext(),
-      { target: "host" },
+      { target: "host", bundled: true },
     );
 
     expect(result.isError).toBe(false);