@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/permissions/checker.ts

@@ -16,11 +16,12 @@ import {
   looksLikeHostPortShorthand,
   looksLikePathOnlyInput,
 } from "../tools/network/url-safety.js";
-import { getTool, getToolOwner } from "../tools/registry.js";
+import { getTool, getToolOwner, resolveTool } from "../tools/registry.js";
 import { resolveRealPath } from "../tools/shared/filesystem/path-policy.js";
 import type { Tool } from "../tools/types.js";
 import {
   getDeprecatedDir,
+  getMonitoringDataDir,
   getProtectedDir,
   getWorkspaceDir,
   getWorkspaceHooksDir,
@@ -147,7 +148,9 @@ function fileToolFsStateKey(
   input: Record<string, unknown>,
   workingDir?: string,
 ): string | undefined {
-  if (!FILE_TOOL_NAMES.has(toolName)) {return undefined;}
+  if (!FILE_TOOL_NAMES.has(toolName)) {
+    return undefined;
+  }
   const resolved = resolveFileToolPaths(toolName, input, workingDir);
   return `${resolved.resolvedPath ?? ""}\0${resolved.resolvedTransferDestPath ?? ""}`;
 }
@@ -167,7 +170,9 @@ function getStringField(
 ): string {
   for (const key of keys) {
     const value = input[key];
-    if (typeof value === "string") {return value;}
+    if (typeof value === "string") {
+      return value;
+    }
   }
   return "";
 }
@@ -181,7 +186,9 @@ function resolveSkillIdAndHash(
   selector: string,
 ): { id: string; versionHash?: string } | null {
   const resolved = resolveSkillSelector(selector);
-  if (!resolved.skill) {return null;}
+  if (!resolved.skill) {
+    return null;
+  }
 
   try {
     const hash = computeSkillVersionHash(resolved.skill.directoryPath);
@@ -201,9 +208,13 @@ function resolveSkillIdAndHash(
  * since ownership lives on the registry, not on the tool itself.
  */
 function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
-  if (!tool) {return false;}
+  if (!tool) {
+    return false;
+  }
   const owner = getToolOwner(tool.name);
-  if (owner?.kind !== "skill") {return false;}
+  if (owner?.kind !== "skill") {
+    return false;
+  }
   const skill = loadSkillCatalog().find((s) => s.id === owner.id);
   return skill?.bundled ?? false;
 }
@@ -221,6 +232,31 @@ function hasInlineExpansions(skillId: string): boolean {
   );
 }
 
+/**
+ * Whether this invocation is an inline-command ("dynamic") skill load: a
+ * `skill_load` whose resolved skill carries inline command expansions,
+ * which execute shell commands at load time via child_process.spawn.
+ * Exported for the non-interactive guardian gate in
+ * tools/permission-checker.ts — a prompted dynamic load must never be
+ * silently auto-approved without a human present. (A pinned trust rule
+ * that covers the load lowers its classified risk upstream, so covered
+ * loads resolve to "allow" before that gate is reached.)
+ */
+export function isDynamicSkillLoadInvocation(
+  toolName: string,
+  input: Record<string, unknown>,
+): boolean {
+  if (toolName !== "skill_load") {
+    return false;
+  }
+  const selector = getStringField(input, "skill").trim();
+  if (!selector) {
+    return false;
+  }
+  const resolved = resolveSkillIdAndHash(selector);
+  return resolved !== null && hasInlineExpansions(resolved.id);
+}
+
 /**
  * Compute the transitive version hash for a skill, returning `undefined`
  * when computation fails (missing includes, cycle, etc.). The permission
@@ -258,7 +294,9 @@ function canonicalizeWebFetchUrl(parsed: URL): URL {
 
 function normalizeWebFetchUrl(rawUrl: string): URL | null {
   const trimmed = rawUrl.trim();
-  if (!trimmed) {return null;}
+  if (!trimmed) {
+    return null;
+  }
 
   if (looksLikeHostPortShorthand(trimmed)) {
     try {
@@ -323,6 +361,7 @@ function buildFileContext(): FileContext {
     toolsDir: resolveRealPath(getWorkspaceToolsDir()),
     routesDir: resolveRealPath(getWorkspaceRoutesDir()),
     workflowsDir: resolveRealPath(getWorkspaceWorkflowsDir()),
+    monitoringDir: resolveRealPath(getMonitoringDataDir()),
     actorTokenSigningKeyPath: join(protectedDir, "actor-token-signing-key"),
     skillSourceDirs: getSkillRoots(config.skills.load.extraDirs).map(
       resolveRealPath,
@@ -371,7 +410,9 @@ function resolveClassificationPath(
   workingDir: string,
   isHostTool: boolean,
 ): string | undefined {
-  if (!filePath) {return undefined;}
+  if (!filePath) {
+    return undefined;
+  }
   // Mirror the gateway classifier's lexical base: host tools resolve the path
   // as absolute/relative-to-cwd; sandbox tools apply the /workspace remap and
   // resolve against workingDir. Then follow symlinks so a benign-looking name
@@ -463,7 +504,9 @@ function resolveFileToolPaths(
 
 function resolveSkillMetadata(selector: string): SkillMetadata | undefined {
   const resolved = resolveSkillIdAndHash(selector);
-  if (!resolved) {return undefined;}
+  if (!resolved) {
+    return undefined;
+  }
 
   const inlineExpansions = hasInlineExpansions(resolved.id);
 
@@ -708,7 +751,9 @@ export async function classifyRisk(
   // Cache the result.
   if (riskCache.size >= RISK_CACHE_MAX) {
     const oldest = riskCache.keys().next().value;
-    if (oldest !== undefined) {riskCache.delete(oldest);}
+    if (oldest !== undefined) {
+      riskCache.delete(oldest);
+    }
   }
   riskCache.set(cacheKey, result);
 
@@ -728,7 +773,9 @@ export async function classifyRisk(
   const aKey = assessmentCacheKey(toolName, input);
   if (assessmentCache.size >= RISK_CACHE_MAX) {
     const oldest = assessmentCache.keys().next().value;
-    if (oldest !== undefined) {assessmentCache.delete(oldest);}
+    if (oldest !== undefined) {
+      assessmentCache.delete(oldest);
+    }
   }
   assessmentCache.set(aKey, assessment);
 
@@ -767,8 +814,12 @@ function isRetrospectiveSkillAuthoringGrant(
   ) {
     return false;
   }
-  if (toolName === "scaffold_managed_skill") {return true;}
-  if (toolName === "find_similar_skills") {return true;}
+  if (toolName === "scaffold_managed_skill") {
+    return true;
+  }
+  if (toolName === "find_similar_skills") {
+    return true;
+  }
   if (toolName === "skill_load") {
     return (
       getStringField(input, "skill", "skill_id").trim() ===
@@ -811,7 +862,7 @@ export async function check(
   const hasSandboxAutoApprove = classification.sandboxAutoApprove ?? false;
 
   // Build approval context from local variables
-  const tool = getTool(toolName);
+  const tool = await resolveTool(toolName);
   const cellQuery = buildChannelPermissionCellQuery(policyContext);
   const threshold = await getAutoApproveThreshold(
     policyContext?.conversationId,
@@ -857,12 +908,32 @@ export async function check(
     }
   }
 
+  // Inline-command ("dynamic") skill loads execute embedded shell commands
+  // at load time, so a threshold-based allow is not enough: they run
+  // without asking only when the user's own trust rule covers them (the
+  // rule re-classifies the risk inside the gateway, arriving here as
+  // matchType "user_rule"). Everything else prompts — at every threshold
+  // and in every execution context. The non-interactive guardian gate in
+  // tools/permission-checker.ts then converts the prompt into a denial
+  // when no human is present to answer it.
+  if (
+    approvalDecision.decision === "allow" &&
+    isDynamicSkillLoadInvocation(toolName, input) &&
+    getCachedAssessment(toolName, input)?.matchType !== "user_rule"
+  ) {
+    approvalDecision = {
+      decision: "prompt",
+      reason:
+        "Inline-command skill load: executes embedded commands, requires explicit approval",
+    };
+  }
+
   // Enrich the reason with the classifier's explanation when available.
   // For risk-based fallback decisions (prompt/deny from High/Medium risk),
   // incorporate the classifier reason so the user sees *why* the command
   // was classified at that level (e.g. "High risk (Recursive force delete): requires approval").
   let enrichedReason = approvalDecision.reason;
-  if (riskReason && !approvalDecision.matchedRule) {
+  if (riskReason) {
     const riskLabelMatch = enrichedReason.match(
       /^(High|Medium|Low|high|medium|low) risk(.*)/i,
     );
@@ -877,7 +948,6 @@ export async function check(
   return {
     decision: approvalDecision.decision,
     reason: enrichedReason,
-    matchedRule: approvalDecision.matchedRule,
     hasSandboxAutoApprove:
       approvalDecision.reason ===
         "Workspace filesystem operation (sandbox auto-approve)" || undefined,
@@ -957,9 +1027,13 @@ function fileAllowlistStrategy(
       description: `Anything in ${dirName}/`,
       pattern: `${toolName}:${dir}/**`,
     });
-    if (dir === home) {break;}
+    if (dir === home) {
+      break;
+    }
     const parent = dirname(dir);
-    if (parent === dir) {break;}
+    if (parent === dir) {
+      break;
+    }
     dir = parent;
     levels++;
   }
@@ -1008,7 +1082,9 @@ function urlAllowlistStrategy(
 
   const seen = new Set<string>();
   return options.filter((o) => {
-    if (seen.has(o.pattern)) {return false;}
+    if (seen.has(o.pattern)) {
+      return false;
+    }
     seen.add(o.pattern);
     return true;
   });

package/src/permissions/confirmation-canonical-request.ts

@@ -0,0 +1,118 @@
+/**
+ * Promote a `confirmation_request` (tool approval) into a canonical guardian
+ * request and bridge it to the guardian's channels.
+ *
+ * Called fire-and-forget by the paths that emit a `confirmation_request`:
+ * the `PermissionPrompter` (interactive tool approvals) and the ACP route
+ * approval gate. Keeping the promotion at the emitter — rather than inside the
+ * generic event hub — lets the hub stay a pure pub/sub primitive with no
+ * dependency on the conversation registry or guardian bridge.
+ *
+ * Channel guardian decisions (reactions, buttons, text) all route through the
+ * canonical pipeline, so without this record none of them can resolve the
+ * confirmation.
+ *
+ * The heavy dependencies (conversation registry, canonical guardian store,
+ * guardian bridge) are loaded lazily so importing this module — and therefore
+ * the emitters — stays cheap and free of import-time database access.
+ */
+
+import type { ServerMessage } from "../daemon/message-protocol.js";
+import { IntegrityError } from "../util/errors.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("confirmation-canonical-request");
+
+function resolveCanonicalRequestSourceType(
+  sourceChannel: string,
+): "desktop" | "channel" | "voice" {
+  if (sourceChannel === "phone") return "voice";
+  if (sourceChannel === "vellum") return "desktop";
+  return "channel";
+}
+
+/**
+ * Create a canonical guardian request + bridge for a `confirmation_request`
+ * message. Safe to call fire-and-forget; failures are logged, never thrown.
+ */
+export async function createCanonicalRequestForConfirmation(
+  msg: ServerMessage & { type: "confirmation_request" },
+  conversationId: string,
+): Promise<void> {
+  try {
+    const [
+      { findConversation },
+      { createCanonicalGuardianRequest, generateCanonicalRequestCode },
+      { redactSecrets },
+      { summarizeToolInput },
+      { DAEMON_INTERNAL_ASSISTANT_ID },
+      { bridgeConfirmationRequestToGuardian },
+    ] = await Promise.all([
+      import("../daemon/conversation-registry.js"),
+      import("../contacts/canonical-guardian-store.js"),
+      import("../security/secret-scanner.js"),
+      import("../tools/tool-input-summary.js"),
+      import("../runtime/assistant-scope.js"),
+      import("../runtime/confirmation-request-guardian-bridge.js"),
+    ]);
+
+    const conversation = findConversation(conversationId);
+    const trustContext = conversation?.trustContext;
+    const sourceChannel = trustContext?.sourceChannel ?? "vellum";
+    const inputRecord = msg.input as Record<string, unknown>;
+    const activityRaw =
+      (typeof inputRecord.activity === "string"
+        ? inputRecord.activity
+        : undefined) ??
+      (typeof inputRecord.reason === "string" ? inputRecord.reason : undefined);
+    const canonicalRequest = createCanonicalGuardianRequest({
+      id: msg.requestId,
+      kind: "tool_approval",
+      sourceType: resolveCanonicalRequestSourceType(sourceChannel),
+      sourceChannel,
+      conversationId,
+      requesterExternalUserId: trustContext?.requesterExternalUserId,
+      requesterChatId: trustContext?.requesterChatId,
+      guardianExternalUserId: trustContext?.guardianExternalUserId,
+      guardianPrincipalId: trustContext?.guardianPrincipalId ?? undefined,
+      toolName: msg.toolName,
+      commandPreview:
+        redactSecrets(summarizeToolInput(msg.toolName, inputRecord)) ||
+        undefined,
+      riskLevel: msg.riskLevel,
+      activityText: activityRaw ? redactSecrets(activityRaw) : undefined,
+      executionTarget: msg.executionTarget,
+      status: "pending",
+      requestCode: generateCanonicalRequestCode(),
+      expiresAt: Date.now() + 5 * 60 * 1000,
+    });
+
+    if (trustContext && conversation) {
+      await bridgeConfirmationRequestToGuardian({
+        canonicalRequest,
+        trustContext,
+        conversationId,
+        toolName: msg.toolName,
+        assistantId: conversation.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
+      });
+    }
+  } catch (err) {
+    if (err instanceof IntegrityError) {
+      // The confirmation could not be promoted to a canonical guardian request
+      // (e.g. its trust context resolved no guardianPrincipalId). Channel
+      // guardian decisions — reactions, buttons, and text — all route through
+      // the canonical pipeline, so without this record none of them can resolve
+      // the confirmation. Surface it rather than swallowing: for a guardian's
+      // own confirmation a bound principal should always be present.
+      log.warn(
+        { err, conversationId, requestId: msg.requestId },
+        "Could not create canonical guardian request for confirmation; channel guardian decisions will not work for it",
+      );
+    } else {
+      log.debug(
+        { err, conversationId },
+        "Failed to create canonical request from broadcast",
+      );
+    }
+  }
+}

package/src/permissions/gateway-threshold-reader.test.ts

@@ -15,14 +15,6 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-// Silence logger output during tests.
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 // ── Controllable IPC mock ────────────────────────────────────────────────────
 
 type IpcHandler = (params?: Record<string, unknown>) => unknown;

package/src/permissions/ipc-risk-types.ts

@@ -66,6 +66,8 @@ export interface FileContext {
   toolsDir: string;
   routesDir: string;
   workflowsDir: string;
+  /** Monitoring data dir — sentinel lives here, writes are code-injection risk. */
+  monitoringDir: string;
   actorTokenSigningKeyPath: string;
   skillSourceDirs: string[];
 }

package/src/permissions/prompter.ts

@@ -4,9 +4,10 @@ import { getConfig } from "../config/loader.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { redactSensitiveFields } from "../security/redaction.js";
-import type { ExecutionTarget } from "../tools/types.js";
+import type { ExecutionTarget } from "../tools/tool-types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
+import { createCanonicalRequestForConfirmation } from "./confirmation-canonical-request.js";
 import type { AllowlistOption, ScopeOption, UserDecision } from "./types.js";
 
 const log = getLogger("permission-prompter");
@@ -142,7 +143,9 @@ export class PermissionPrompter {
         signal.addEventListener("abort", onAbort, { once: true });
       }
 
-      this.sendToClient({
+      const confirmationMsg: ServerMessage & {
+        type: "confirmation_request";
+      } = {
         type: "confirmation_request",
         requestId,
         toolName,
@@ -170,7 +173,17 @@ export class PermissionPrompter {
         executionTarget,
         persistentDecisionsAllowed: persistentDecisionsAllowed ?? true,
         toolUseId,
-      });
+      };
+      this.sendToClient(confirmationMsg);
+
+      // Promote the confirmation to a canonical guardian request so channel
+      // guardian decisions (reactions, buttons, text) can resolve it.
+      if (conversationId) {
+        void createCanonicalRequestForConfirmation(
+          confirmationMsg,
+          conversationId,
+        );
+      }
 
       this.onStateChanged?.(requestId, "pending", "system", toolUseId);
     });

package/src/permissions/secret-prompt-types.ts

@@ -0,0 +1,34 @@
+/**
+ * Result vocabulary for a secret prompt: how the value is delivered and the
+ * outcome of the prompt. Kept in a leaf module (no runtime dependencies) so
+ * type-only consumers can reference the shapes without importing the prompter
+ * implementation and its daemon-internal dependencies.
+ */
+
+export type SecretDelivery = "store" | "transient_send";
+
+export interface SecretPromptResult {
+  value: string | null;
+  delivery: SecretDelivery;
+  /** When set, the prompt could not be delivered and the value is null due to a delivery failure (not user cancellation). */
+  error?: "unsupported_channel";
+  /**
+   * Why `value` is null. `"cancelled"` = the user explicitly dismissed the
+   * prompt (a valid flow, not a failure); `"timed_out"` = no response within
+   * the permission-timeout window; `"superseded"` = a newer message in the
+   * conversation auto-denied the pending prompt before anyone answered it.
+   * Only meaningful when `value` is null and `error` is unset. Lets callers
+   * distinguish a deliberate cancel from a genuine failure instead of
+   * treating both as an error.
+   */
+  reason?: "cancelled" | "timed_out" | "superseded";
+  /**
+   * One-time collection URL minted when the channel cannot render the secure
+   * prompt. Set together with `error: "unsupported_channel"` — the caller
+   * relays the link so the user can supply the value out of band; the gateway
+   * stores the submitted value via the credential vault.
+   */
+  collectionUrl?: string;
+  /** Expiry (epoch ms) of {@link SecretPromptResult.collectionUrl}. */
+  collectionExpiresAt?: number;
+}

package/src/permissions/secret-prompter.ts

@@ -6,28 +6,15 @@ import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
+import type {
+  SecretDelivery,
+  SecretPromptResult,
+} from "./secret-prompt-types.js";
 
 type SecretRequestMessage = Extract<ServerMessage, { type: "secret_request" }>;
 
 const log = getLogger("secret-prompter");
 
-export type SecretDelivery = "store" | "transient_send";
-
-export interface SecretPromptResult {
-  value: string | null;
-  delivery: SecretDelivery;
-  /** When set, the prompt could not be delivered and the value is null due to a delivery failure (not user cancellation). */
-  error?: "unsupported_channel";
-  /**
-   * Why `value` is null. `"cancelled"` = the user explicitly dismissed the
-   * prompt (a valid flow, not a failure); `"timed_out"` = no response within
-   * the permission-timeout window. Only meaningful when `value` is null and
-   * `error` is unset. Lets callers distinguish a deliberate cancel from a
-   * genuine failure instead of treating both as an error.
-   */
-  reason?: "cancelled" | "timed_out";
-}
-
 export interface SecretPrompterChannelContext {
   /** The channel the conversation was initiated from (e.g. "slack", "macos"). */
   channel?: string;
@@ -72,6 +59,17 @@ export class SecretPrompter {
     allowedTools?: string[],
     allowedDomains?: string[],
   ): Promise<SecretPromptResult> {
+    // Channels without dynamic UI (e.g. slack, telegram) have no surface that
+    // renders the secure prompt dialog — fail fast with unsupported_channel
+    // instead of broadcasting a request that can only time out.
+    if (this.channelContext?.supportsDynamicUi === false) {
+      log.warn(
+        { service, field, channel: this.channelContext.channel },
+        "Secret prompt suppressed: channel does not support secure input",
+      );
+      return { value: null, delivery: "store", error: "unsupported_channel" };
+    }
+
     const requestId = uuid();
     const effectiveConversationId = conversationId ?? "unknown";
 
@@ -82,7 +80,7 @@ export class SecretPrompter {
         pendingInteractions.resolve(requestId, "cancelled");
         this.ownedIds.delete(requestId);
         log.warn({ requestId, service, field }, "Secret prompt timed out");
-        resolve({ value: null, delivery: "store" });
+        resolve({ value: null, delivery: "store", reason: "timed_out" });
       }, timeoutMs);
 
       const config = getConfig();
@@ -159,7 +157,11 @@ export class SecretPrompter {
     this.ownedIds.delete(requestId);
     (
       interaction?.rpcResolve as ((v: SecretPromptResult) => void) | undefined
-    )?.({ value: value ?? null, delivery: delivery ?? "store" });
+    )?.(
+      value === undefined
+        ? { value: null, delivery: delivery ?? "store", reason: "cancelled" }
+        : { value, delivery: delivery ?? "store" },
+    );
   }
 
   dispose(): void {

package/src/permissions/types.ts

@@ -32,19 +32,6 @@ export const THRESHOLD_ORDINAL: Record<string, number> = {
   high: 2,
 };
 
-/** A persistent trust rule stored on disk and used for permission matching. */
-export interface TrustRule {
-  id: string;
-  tool: string;
-  pattern: string;
-  decision: "allow" | "deny" | "ask";
-  priority: number;
-  createdAt: number;
-  scope?: string;
-  executionTarget?: string;
-  userModifiedAt?: number;
-}
-
 export type UserDecision = "allow" | "deny";
 
 export function isAllowDecision(decision: UserDecision): boolean {
@@ -54,7 +41,6 @@ export function isAllowDecision(decision: UserDecision): boolean {
 export interface PermissionCheckResult {
   decision: "allow" | "deny" | "prompt";
   reason: string;
-  matchedRule?: TrustRule;
   /** True when the decision was taken via the sandbox auto-approve path. */
   hasSandboxAutoApprove?: boolean;
 }