@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/runtime/routes/settings-routes.ts

@@ -17,6 +17,11 @@ import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import { loadSkillCatalog } from "../../config/skills.js";
 import { getGuardianDelivery } from "../../contacts/guardian-delivery-reader.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
+import {
+  createResolveToolsCallback,
+  DEFAULT_PREACTIVATED_SKILL_IDS,
+  type SkillProjectionContext,
+} from "../../daemon/conversation-tool-setup.js";
 import {
   computeGatewayTarget,
   getIngressConfigResult,
@@ -39,11 +44,18 @@ import { resolveGuardianPersonaPath } from "../../prompts/persona-resolver.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { parseToolManifestFile } from "../../skills/tool-manifest.js";
+import { getSubagentManager } from "../../subagent/index.js";
+import { mergeSkillIds } from "../../subagent/manager.js";
+import {
+  SUBAGENT_ROLE_REGISTRY,
+  type SubagentRole,
+} from "../../subagent/types.js";
 import {
   type ManifestOverride,
   resolveExecutionTarget,
 } from "../../tools/execution-target.js";
 import {
+  getAllToolDefinitions,
   getAllTools,
   getEnabledTools,
   getTool,
@@ -112,8 +124,9 @@ async function handleGenerateAvatar({ body = {}, headers }: RouteHandlerArgs) {
 
     return { ok: true, avatarPath };
   } catch (err) {
-    if (err instanceof InternalError || err instanceof BadRequestError)
+    if (err instanceof InternalError || err instanceof BadRequestError) {
       throw err;
+    }
     const message = err instanceof Error ? err.message : String(err);
     log.error({ error: message }, "Avatar generation failed unexpectedly");
     throw new InternalError(message);
@@ -230,7 +243,9 @@ async function handleOAuthConnectStart({ body = {} }: RouteHandlerArgs) {
         let accountInfo = deferredResult.accountInfo;
         try {
           const conn = getConnectionByProvider(service);
-          if (conn?.accountInfo) accountInfo = conn.accountInfo;
+          if (conn?.accountInfo) {
+            accountInfo = conn.accountInfo;
+          }
         } catch {
           // DB not ready — use orchestrator value
         }
@@ -285,7 +300,9 @@ async function handleOAuthConnectStart({ body = {} }: RouteHandlerArgs) {
     let responseAccountInfo = result.accountInfo;
     try {
       const conn = getConnectionByProvider(service);
-      if (conn?.accountInfo) responseAccountInfo = conn.accountInfo;
+      if (conn?.accountInfo) {
+        responseAccountInfo = conn.accountInfo;
+      }
     } catch {
       // DB not ready — use orchestrator value
     }
@@ -297,8 +314,9 @@ async function handleOAuthConnectStart({ body = {} }: RouteHandlerArgs) {
       ...(authorizeUrl ? { authUrl: authorizeUrl } : {}),
     };
   } catch (err) {
-    if (err instanceof InternalError || err instanceof BadRequestError)
+    if (err instanceof InternalError || err instanceof BadRequestError) {
       throw err;
+    }
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err, service }, "OAuth connect flow failed");
     throw new InternalError(sanitizeOAuthError(message));
@@ -350,8 +368,9 @@ function handleWorkspaceFileRead({ queryParams = {} }: RouteHandlerArgs) {
     const content = readFileSync(resolved, "utf-8");
     return { path: filePath, content };
   } catch (err) {
-    if (err instanceof NotFoundError || err instanceof BadRequestError)
+    if (err instanceof NotFoundError || err instanceof BadRequestError) {
       throw err;
+    }
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err, path: filePath }, "Failed to read workspace file");
     throw new InternalError(message);
@@ -365,11 +384,15 @@ function handleWorkspaceFileRead({ queryParams = {} }: RouteHandlerArgs) {
 function resolveManifestOverride(
   toolName: string,
 ): ManifestOverride | undefined {
-  if (getTool(toolName)) return undefined;
+  if (getTool(toolName)) {
+    return undefined;
+  }
   try {
     const catalog = loadSkillCatalog();
     for (const skill of catalog) {
-      if (!skill.toolManifest?.present || !skill.toolManifest.valid) continue;
+      if (!skill.toolManifest?.present || !skill.toolManifest.valid) {
+        continue;
+      }
       try {
         const manifest = parseToolManifestFile(
           join(skill.directoryPath, "TOOLS.json"),
@@ -409,7 +432,13 @@ interface ToolNamesListResponse {
  * scopes the inventory to the tools available to that conversation as of
  * its most recent turn — see {@link handleConversationToolList}.
  */
-function handleToolNamesList(conversationId?: string): ToolNamesListResponse {
+function handleToolNamesList(
+  conversationId?: string,
+  agent?: string,
+): ToolNamesListResponse {
+  if (agent) {
+    return handleAgentToolList(agent);
+  }
   if (conversationId) {
     return handleConversationToolList(conversationId);
   }
@@ -428,13 +457,17 @@ function handleToolNamesList(conversationId?: string): ToolNamesListResponse {
   try {
     const catalog = loadSkillCatalog();
     for (const skill of catalog) {
-      if (!skill.toolManifest?.present || !skill.toolManifest.valid) continue;
+      if (!skill.toolManifest?.present || !skill.toolManifest.valid) {
+        continue;
+      }
       try {
         const manifest = parseToolManifestFile(
           join(skill.directoryPath, "TOOLS.json"),
         );
         for (const entry of manifest.tools) {
-          if (nameSet.has(entry.name)) continue;
+          if (nameSet.has(entry.name)) {
+            continue;
+          }
           nameSet.add(entry.name);
           schemas[entry.name] = entry.input_schema as unknown as SchemaShape;
         }
@@ -450,6 +483,98 @@ function handleToolNamesList(conversationId?: string): ToolNamesListResponse {
   return { names, schemas, tools: buildRegisteredToolEntries() };
 }
 
+/**
+ * Resolve the tool surface a subagent would receive, identified either by a
+ * role name (e.g. "researcher") or a live subagent id.
+ *
+ * For a role name: build a {@link SkillProjectionContext} matching what the
+ * {@link SubagentManager} sets up at spawn time (isSubagent, allowedTools,
+ * preactivated skill ids, no client), then run the exact same
+ * {@link createResolveToolsCallback} the real subagent uses to project tools
+ * for its first turn. This ensures the diagnostic reports the same tool set
+ * a live subagent would actually see — including skill-projected tools —
+ * rather than a hand-rolled approximation.
+ *
+ * For a subagent id: resolve it via the SubagentManager to its conversationId,
+ * then delegate to {@link handleConversationToolList} for the live snapshot.
+ */
+function handleAgentToolList(agent: string): ToolNamesListResponse {
+  // Try subagent id first — if the manager has it, use the live conversation.
+  const state = getSubagentManager().getState(agent);
+  if (state?.conversationId) {
+    return handleConversationToolList(state.conversationId);
+  }
+
+  // Otherwise, treat as a role name.
+  const role = agent as SubagentRole;
+  const roleConfig = SUBAGENT_ROLE_REGISTRY[role];
+  if (!roleConfig) {
+    throw new NotFoundError(
+      `Unknown agent "${agent}". Expected a subagent role ` +
+        `(general, researcher, coder, planner, investigator, advisor) ` +
+        `or a live subagent id.`,
+    );
+  }
+
+  // Build the same context the SubagentManager creates at spawn time:
+  //   - isSubagent: true (gates subagent-only tools like notify_parent)
+  //   - subagentAllowedTools: the role's allowlist (wire gate mode by default)
+  //   - preactivatedSkillIds: role skill ids merged with defaults
+  //   - hasNoClient: true (subagents have no direct client)
+  //   - no channel capabilities, no disk pressure, tools enabled
+  const toolDefs = getAllToolDefinitions();
+  const coreToolNames = new Set(toolDefs.map((d) => d.name));
+  const mergedSkillIds = mergeSkillIds(
+    roleConfig.skillIds,
+    DEFAULT_PREACTIVATED_SKILL_IDS,
+  );
+  const ctx: SkillProjectionContext = {
+    isSubagent: true,
+    subagentAllowedTools: roleConfig.allowedTools
+      ? new Set(roleConfig.allowedTools)
+      : undefined,
+    subagentToolGateMode: undefined,
+    toolsDisabledDepth: 0,
+    diskPressureCleanupModeActive: false,
+    skillProjectionState: new Map<string, string>(),
+    skillProjectionCache: {},
+    coreToolNames,
+    hasNoClient: true,
+    preactivatedSkillIds: mergedSkillIds,
+  };
+
+  // Run the real tool resolver — the same callback a subagent conversation
+  // uses each turn. An empty message history simulates the first turn before
+  // any skill activations have been recorded.
+  const resolveTools = createResolveToolsCallback(toolDefs, ctx);
+  if (!resolveTools) {
+    return { names: [], schemas: {}, tools: [] };
+  }
+  const resolvedDefs = resolveTools([]);
+  const names = resolvedDefs
+    .map((d) => d.name)
+    .sort((a, b) => a.localeCompare(b));
+
+  const schemaByName = new Map<string, SchemaShape>(
+    injectActivityField(getAllTools(), ACTIVITY_SKIP_SET).map((d) => [
+      d.name,
+      d.input_schema as SchemaShape,
+    ]),
+  );
+
+  const schemas: Record<string, SchemaShape> = {};
+  const tools: ToolListEntry[] = [];
+  for (const name of names) {
+    const schema = schemaByName.get(name);
+    if (schema) {
+      schemas[name] = schema;
+    }
+    tools.push(toolEntryForName(name));
+  }
+
+  return { names, schemas, tools };
+}
+
 /**
  * Scope the tool inventory to a single conversation. Conversations gain
  * tools over their lifecycle (skill loads, MCP reloads), so the global
@@ -483,7 +608,9 @@ function handleConversationToolList(
   const tools: ToolListEntry[] = [];
   for (const name of names) {
     const schema = schemaByName.get(name);
-    if (schema) schemas[name] = schema;
+    if (schema) {
+      schemas[name] = schema;
+    }
     tools.push(toolEntryForName(name));
   }
 
@@ -495,7 +622,7 @@ interface ToolListEntry {
   description: string;
   riskLevel: string;
   category: string;
-  /** Tool origin: "core" for built-ins, otherwise "<kind>:<id>" (e.g. "plugin:echo"). */
+  /** Tool origin as "<kind>:<id>" (e.g. "default:default" for built-ins, "plugin:echo"). */
   source: string;
 }
 
@@ -503,9 +630,10 @@ interface ToolListEntry {
  * Build a catalog entry for one tool name, reading metadata and ownership
  * from the registry (the single source of truth) rather than off any
  * caller-supplied object, so `source` cannot be spoofed by a manifest
- * field. `source` is `core` for built-ins, `<kind>:<id>` for an owned tool
- * (e.g. `plugin:echo`), and `unknown` for a name no longer in the registry
- * (e.g. a conversation snapshot referencing a since-unloaded skill tool).
+ * field. `source` is `<kind>:<id>` for a registered tool (e.g.
+ * `default:default` for a built-in, `plugin:echo` for an owned tool), and
+ * `unknown` for a name no longer in the registry (e.g. a conversation snapshot
+ * referencing a since-unloaded skill tool).
  */
 function toolEntryForName(name: string): ToolListEntry {
   const tool = getTool(name);
@@ -515,7 +643,7 @@ function toolEntryForName(name: string): ToolListEntry {
     description: tool?.description ?? "",
     riskLevel: tool?.defaultRiskLevel ?? "unknown",
     category: tool?.category ?? "",
-    source: owner ? `${owner.kind}:${owner.id}` : tool ? "core" : "unknown",
+    source: owner ? `${owner.kind}:${owner.id}` : "unknown",
   };
 }
 
@@ -616,11 +744,12 @@ async function handleToolPermissionSimulate({ body = {} }: RouteHandlerArgs) {
       riskLevel,
       reason: result.reason,
       executionTarget,
-      matchedTrustRuleId: result.matchedRule?.id,
       promptPayload,
     };
   } catch (err) {
-    if (err instanceof BadRequestError) throw err;
+    if (err instanceof BadRequestError) {
+      throw err;
+    }
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err }, "Failed to simulate tool permission");
     throw new InternalError(message);
@@ -740,7 +869,9 @@ function handleUpdateIngressConfig({ body = {} }: RouteHandlerArgs) {
       success: true,
     };
   } catch (err) {
-    if (err instanceof InternalError) throw err;
+    if (err instanceof InternalError) {
+      throw err;
+    }
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err }, "Failed to update ingress config");
     throw new InternalError(message);
@@ -880,7 +1011,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "List registered tools with metadata and schemas",
     description:
-      "Return registered tools. Without `conversationId`, returns every tool in the global registry; `tools` carries per-tool metadata (description, author-asserted risk level, category, and contributing source: core, skill, plugin, or MCP server) and `names`/`schemas` additionally cover skill tools whose manifests are present but not yet loaded, for the permission-simulator catalog. With `conversationId`, scopes the result to the tools available to that conversation as of its most recent turn (including skill/MCP tools registered over its lifecycle); 404 if no such conversation is active.",
+      "Return registered tools. Without `conversationId`, returns every tool in the global registry; `tools` carries per-tool metadata (description, author-asserted risk level, category, and contributing source: default (built-in), skill, plugin, or MCP server) and `names`/`schemas` additionally cover skill tools whose manifests are present but not yet loaded, for the permission-simulator catalog. With `conversationId`, scopes the result to the tools available to that conversation as of its most recent turn (including skill/MCP tools registered over its lifecycle); 404 if no such conversation is active. With `agent`, simulates the subagent tool projection for a given role or resolves a live subagent's conversation.",
     tags: ["tools"],
     queryParams: [
       {
@@ -890,6 +1021,13 @@ export const ROUTES: RouteDefinition[] = [
         description:
           "When set, scope the tool inventory to this conversation's most recent turn instead of the global registry.",
       },
+      {
+        name: "agent",
+        type: "string",
+        required: false,
+        description:
+          "A subagent role name or a live subagent id. Simulates the subagent tool projection for that role or resolves the live subagent's conversation.",
+      },
     ],
     responseBody: z.object({
       names: z.array(z.string()),
@@ -903,13 +1041,13 @@ export const ROUTES: RouteDefinition[] = [
           source: z
             .string()
             .describe(
-              'Tool origin: "core" for built-ins, otherwise "<kind>:<id>" (e.g. "plugin:echo", "skill:my-skill", "mcp:server").',
+              'Tool origin as "<kind>:<id>" (e.g. "default:default" for built-ins, "plugin:echo", "skill:my-skill", "mcp:server").',
             ),
         }),
       ),
     }),
     handler: ({ queryParams }) =>
-      handleToolNamesList(queryParams?.conversationId),
+      handleToolNamesList(queryParams?.conversationId, queryParams?.agent),
   },
   {
     operationId: "tools_simulate_permission_post",

package/src/runtime/routes/skills-routes.ts

@@ -142,6 +142,12 @@ const skillDetailSchema = z.discriminatedUnion("origin", [
   z.object({
     ...slimSkillBaseWithOwner,
     origin: z.literal("assistant-memory"),
+    sourceConversationId: z
+      .string()
+      .optional()
+      .describe(
+        "Conversation whose trace the retrospective distilled this skill from. Present only when recorded in install-meta.",
+      ),
   }),
 ]);
 

package/src/runtime/routes/subagents-routes.ts

@@ -65,14 +65,11 @@ export function parseSubagentMessages(
   const firstUser = messages.find((m) => m.role === "user");
   if (firstUser) {
     try {
-      const parsed = JSON.parse(firstUser.content);
-      if (Array.isArray(parsed)) {
-        const textBlock = parsed.find(
-          (b: Record<string, unknown>) => isRecord(b) && b.type === "text",
-        );
-        if (textBlock && typeof textBlock.text === "string") {
-          objective = stripForkDirectiveFraming(textBlock.text);
-        }
+      const textBlock = firstUser.content.find(
+        (b) => b.type === "text" && typeof b.text === "string",
+      );
+      if (textBlock && "text" in textBlock) {
+        objective = stripForkDirectiveFraming(textBlock.text);
       }
     } catch {
       /* ignore */
@@ -83,17 +80,15 @@ export function parseSubagentMessages(
   const events: SubagentDetailResult["events"] = [];
   const pendingTools = new Map<string, string>();
   for (const m of messages) {
-    if (m.role !== "assistant" && m.role !== "user") continue;
-    let content: unknown[];
-    try {
-      const parsed = JSON.parse(m.content);
-      content = Array.isArray(parsed) ? parsed : [];
-    } catch {
+    if (m.role !== "assistant" && m.role !== "user") {
       continue;
     }
+    const content: unknown[] = m.content;
 
     for (const block of content) {
-      if (!isRecord(block) || typeof block.type !== "string") continue;
+      if (!isRecord(block) || typeof block.type !== "string") {
+        continue;
+      }
       if (
         m.role === "assistant" &&
         block.type === "text" &&
@@ -117,7 +112,9 @@ export function parseSubagentMessages(
           toolUseId: id || undefined,
           input,
         });
-        if (id) pendingTools.set(id, name);
+        if (id) {
+          pendingTools.set(id, name);
+        }
       } else if (
         block.type === "tool_result" ||
         block.type === "web_search_tool_result" ||
@@ -132,13 +129,15 @@ export function parseSubagentMessages(
               ? (block.content as unknown[])
                   .filter((b): b is Record<string, unknown> => isRecord(b))
                   .map((b) => {
-                    if (b.type === "text" && typeof b.text === "string")
+                    if (b.type === "text" && typeof b.text === "string") {
                       return b.text;
+                    }
                     if (
                       b.type === "web_search_result" &&
                       typeof b.title === "string"
-                    )
+                    ) {
                       return `${b.title}\n${typeof b.url === "string" ? b.url : ""}`;
+                    }
                     return null;
                   })
                   .filter((s): s is string => s != null)

package/src/runtime/routes/surface-action-routes.ts

@@ -10,7 +10,7 @@
 import { z } from "zod";
 
 import { isHttpAuthDisabled } from "../../config/env.js";
-import type { TrustContext } from "../../daemon/trust-context.js";
+import type { TrustContext } from "../../daemon/trust-context-types.js";
 import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { processGuardianDecision } from "../guardian-action-service.js";
@@ -181,7 +181,9 @@ async function handleSurfaceAction({
   // the SSE host-proxy client's registered principal; otherwise CU/app-control
   // same-actor checks reject the turn. Real principals pass through unchanged.
   const resolvedActorPrincipalId =
-    await resolveActorPrincipalIdForLocalGuardian(actorPrincipalId ?? undefined);
+    await resolveActorPrincipalIdForLocalGuardian(
+      actorPrincipalId ?? undefined,
+    );
 
   try {
     const raw = await conversation.handleSurfaceAction(

package/src/runtime/routes/theme-routes.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+
+import {
+  readWorkspaceTheme,
+  WorkspaceThemeSchema,
+} from "../../theme/workspace-theme.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import type { RouteDefinition } from "./types.js";
+
+function handleGetWorkspaceTheme() {
+  return readWorkspaceTheme();
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "workspace_theme_get",
+    endpoint: "workspace/theme",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: handleGetWorkspaceTheme,
+    summary: "Get workspace theme",
+    description:
+      "Return validated design-token overrides from the workspace ui/theme.json. " +
+      "Absent or rejected files yield theme: null with the rejection reasons in issues; " +
+      "clients fall back to built-in theme defaults.",
+    tags: ["workspace"],
+    responseBody: z.object({
+      theme: WorkspaceThemeSchema.nullable(),
+      source: z.enum(["workspace", "invalid", "none"]),
+      issues: z.array(z.string()),
+    }),
+  },
+];

package/src/runtime/routes/types.ts

@@ -72,7 +72,8 @@ export type RouteResponseContentType =
   | "application/octet-stream"
   | "application/gzip"
   | "application/pdf"
-  | "application/zip";
+  | "application/zip"
+  | "image/png";
 
 /**
  * A route's success response body. Either:

package/src/runtime/routes/workflow-routes.ts

@@ -9,7 +9,7 @@
 
 import { z } from "zod";
 
-import type { TrustContext } from "../../daemon/trust-context.js";
+import type { TrustContext } from "../../daemon/trust-context-types.js";
 import { buildChannelPermissionCellQuery } from "../../permissions/channel-permission-query.js";
 import { getAutoApproveThreshold } from "../../permissions/gateway-threshold-reader.js";
 import { isFullAccessThreshold } from "../../permissions/threshold.js";

package/src/runtime/services/__tests__/auto-analysis-guard.test.ts

@@ -1,16 +1,6 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, test } from "bun:test";
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
-import {
-  AUTO_ANALYSIS_GROUP_ID,
-  AUTO_ANALYSIS_SOURCE,
-} from "../../../persistence/auto-analysis-constants.js";
+import { AUTO_ANALYSIS_SOURCE } from "../../../persistence/auto-analysis-constants.js";
 import { createConversation } from "../../../persistence/conversation-crud.js";
 import { getDb } from "../../../persistence/db-connection.js";
 import { initializeDb } from "../../../persistence/db-init.js";
@@ -27,10 +17,6 @@ describe("auto-analysis constants", () => {
   test("AUTO_ANALYSIS_SOURCE is the canonical 'auto-analysis' string", () => {
     expect(AUTO_ANALYSIS_SOURCE).toBe("auto-analysis");
   });
-
-  test("AUTO_ANALYSIS_GROUP_ID is 'system:background' so reflections render as a background sub-group", () => {
-    expect(AUTO_ANALYSIS_GROUP_ID).toBe("system:background");
-  });
 });
 
 describe("isAutoAnalysisConversation", () => {

package/src/runtime/services/__tests__/conversation-serializer.test.ts

@@ -34,7 +34,6 @@ function makeConversationRow(
     slackContextCompactionWatermarkAt: null,
     conversationType: "background",
     source: "task",
-    memoryScopeId: "default",
     originChannel: null,
     originInterface: null,
     forkParentConversationId: null,

package/src/runtime/services/auto-analysis-guard.ts

@@ -2,11 +2,11 @@ import { AUTO_ANALYSIS_SOURCE } from "../../persistence/auto-analysis-constants.
 import { getConversationSource } from "../../persistence/conversation-crud.js";
 
 /**
- * Returns true if the conversation's `source` column is `"auto-analysis"`,
- * meaning it was produced by the auto-analysis loop. Callers use this to
- * skip both `graph_extract` and `conversation_analyze` enqueues so we
- * never (a) analyze our own analysis output or (b) extract memory from
- * reflective musings (the analysis agent writes memory directly via tools).
+ * Returns true if the conversation's `source` column is `"auto-analysis"`.
+ * The retired auto-analysis feature produced such conversations; rows
+ * persist on existing installs. Callers skip memory/graph extraction for
+ * them — the analysis agent wrote memory directly via tools, so extracting
+ * from its reflective musings would double-count.
  */
 export function isAutoAnalysisConversation(conversationId: string): boolean {
   return getConversationSource(conversationId) === AUTO_ANALYSIS_SOURCE;

package/src/runtime/services/conversation-serializer.ts

@@ -2,9 +2,8 @@
  * Standalone helpers for serializing conversation summaries and detail
  * responses.
  *
- * Extracted from RuntimeHttpServer so that route handlers (e.g.
- * conversation-analysis-routes) can build detail responses without
- * depending on the server class.
+ * Extracted from RuntimeHttpServer so that route handlers can build
+ * detail responses without depending on the server class.
  */
 
 import { parseChannelId } from "../../channels/types.js";

package/src/runtime/sync/resource-sync-events.ts

@@ -57,6 +57,10 @@ export function publishSchedulesChanged(originClientId?: string): void {
   void publishSyncInvalidation([SYNC_TAGS.assistantSchedules], originClientId);
 }
 
+export function publishWorkspaceThemeChanged(originClientId?: string): void {
+  void publishSyncInvalidation([SYNC_TAGS.assistantTheme], originClientId);
+}
+
 export function publishAppsChanged(originClientId?: string): void {
   void publishSyncInvalidation([SYNC_TAGS.appsList], originClientId);
 }

package/src/runtime/trust-context-resolver.ts

@@ -1,16 +1,16 @@
 /**
- * Shared inbound trust resolution for channel actors.
+ * Routing-state helpers plus the residual sync trust entry point.
  *
- * Provides routing-state helpers and a convenience wrapper
- * ({@link resolveTrustContext}) around {@link resolveActorTrust} that
- * converts the result to a {@link TrustContext}.
- *
- * Trust resolution itself lives in `actor-trust-resolver.ts`; the resolved
- * {@link ActorTrustContext} is converted to {@link TrustContext} via
- * {@link toTrustContext}.
+ * {@link resolveTrustContext} wraps {@link resolveActorTrust} (a sync,
+ * IO-free guardian-or-unknown view — see `actor-trust-resolver.ts`) and
+ * converts the result to a {@link TrustContext}. Its sole production caller
+ * is the vellum reset-drift re-resolution in `guardian-vellum-migration.ts`,
+ * which runs exactly when the gateway verdict came back `unknown` and so
+ * cannot consume a verdict. Verdict-stamped ingress uses
+ * `trustContextFromVerdict` in `trust-verdict-consumer.ts` instead.
  */
 import type { ChannelId } from "../channels/types.js";
-import type { TrustContext } from "../daemon/trust-context.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 import {
   resolveActorTrust,
   type ResolveActorTrustInput,