@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/tools/executor.ts

@@ -1,41 +1,32 @@
 import { readFileSync } from "node:fs";
 
 import { getConfig } from "../config/loader.js";
-import { bridgeCesApproval } from "../credential-execution/approval-bridge.js";
-import { isCesShellLockdownEnabled } from "../credential-execution/feature-gates.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { RiskLevel } from "../permissions/types.js";
-import { isUntrustedShellLockdownActive } from "../runtime/effective-capabilities.js";
-import { redactSensitiveFields } from "../security/redaction.js";
-import { getCesClient } from "../security/secure-keys.js";
 import { TokenExpiredError } from "../security/token-manager.js";
+import {
+  recordToolError,
+  recordToolExecuted,
+} from "../telemetry/tool-audit.js";
 import { type AbortReason, isAbortReason } from "../util/abort-reasons.js";
 import { PermissionDeniedError, ToolError } from "../util/errors.js";
 import { pathExists, safeStatSync } from "../util/fs.js";
-import { getLogger, truncateForLog } from "../util/logger.js";
+import { truncateForLog } from "../util/logger.js";
 import {
   callerOwnsWorkflowRun,
   manifestGrantsSideEffects,
 } from "../workflows/capabilities.js";
 import { getWorkflowRunManager } from "../workflows/run-manager.js";
-import { resolveExecutionTarget } from "./execution-target.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { PermissionChecker } from "./permission-checker.js";
-import { getTool } from "./registry.js";
 import { extractAndSanitize } from "./sensitive-output-placeholders.js";
 import { applyEdit } from "./shared/filesystem/edit-engine.js";
 import { sandboxPolicy } from "./shared/filesystem/path-policy.js";
 import { MAX_FILE_SIZE_BYTES } from "./shared/filesystem/size-guard.js";
 import { ToolApprovalHandler } from "./tool-approval-handler.js";
 import { resolveToolInvocationAlias } from "./tool-name-aliases.js";
-import {
-  stringifyToolInput,
-  type ToolContext,
-  type ToolExecutionResult,
-  type ToolLifecycleEvent,
-} from "./types.js";
-
-const log = getLogger("tool-executor");
+import { recordToolCompletion } from "./tool-profiler.js";
+import { type ToolContext, type ToolExecutionResult } from "./types.js";
 
 export class ToolExecutor {
   private prompter: PermissionPrompter;
@@ -84,33 +75,21 @@ export class ToolExecutor {
     let permApprovalMode: string | undefined;
     let permApprovalReason: string | undefined;
     let permRiskThreshold: string | undefined;
-    // Registered tools have `executionTarget` stamped at load time; the
-    // `resolveExecutionTarget` fallback only fires for unknown tools (the
-    // executor's name-aliased lookup can race against late registration).
-    const executionTarget =
-      getTool(name)?.executionTarget ?? resolveExecutionTarget({ name });
-
-    emitLifecycleEvent(context, {
-      type: "start",
-      toolName: name,
-      executionTarget,
-      input,
-      workingDir: context.workingDir,
-      conversationId: context.conversationId,
-      requestId: context.requestId,
-      startedAtMs: startTime,
-    });
-
+    // Whether THIS invocation was interactively prompted. Distinct from the
+    // turn-level `context.approvedViaPrompt` (seeded from
+    // `approvedViaPromptThisTurn`, which stays true for later auto-approved
+    // tools in the same turn): the `permission_decided` telemetry must reflect
+    // a prompt for this specific call, not any prompt earlier in the turn.
+    let wasPromptedThisInvocation = false;
     // Run pre-execution approval gates (abort, guardian policy,
-    // allowed-tool-set, task-run preflight, tool registry lookup).
+    // allowed-tool-set, task-run preflight, tool registry lookup). The gate
+    // resolves the tool's sandbox/host target internally.
     const gateResult = await this.approvalHandler.checkPreExecutionGates(
       name,
       input,
       context,
-      executionTarget,
       riskLevel,
       startTime,
-      (event) => emitLifecycleEvent(context, event),
     );
 
     if (!gateResult.allowed) {
@@ -120,32 +99,6 @@ export class ToolExecutor {
     const tool = gateResult.tool;
 
     try {
-      // CES shell lockdown: set forcePromptSideEffects BEFORE both the
-      // grantConsumed short-circuit and the permission check. This ensures
-      // the flag is visible to all downstream consumers regardless of
-      // whether a scoped grant was consumed. Previously this was nested
-      // inside the `!grantConsumed` block, meaning untrusted host_bash
-      // calls that arrived with a consumed guardian-approval grant would
-      // skip this assignment entirely - defeating the lockdown.
-      if (
-        name === "host_bash" &&
-        isUntrustedShellLockdownActive({
-          trustClass: context.trustClass,
-          lockdownEnabled: isCesShellLockdownEnabled(getConfig()),
-        })
-      ) {
-        context.forcePromptSideEffects = true;
-      }
-
-      // Secure command tool installation always requires fresh per-invocation
-      // approval - no persistent grants. This is unconditional (not gated on
-      // CES lockdown or trust class) because installing secure tools is
-      // inherently high-impact.
-      if (name === "manage_secure_command_tool") {
-        context.forcePromptSideEffects = true;
-        context.requireFreshApproval = true;
-      }
-
       // A workflow run whose capability manifest grants side-effecting tools or
       // host functions (beyond the read-only baseline) must prompt at LAUNCH.
       // The manifest is authored and declared by the model, and the run's
@@ -223,8 +176,6 @@ export class ToolExecutor {
           input,
           tool,
           context,
-          executionTarget,
-          (event) => emitLifecycleEvent(context, event),
           startTime,
           computePreviewDiff,
         );
@@ -256,6 +207,7 @@ export class ToolExecutor {
 
         if (permResult.wasPrompted) {
           context.approvedViaPrompt = true;
+          wasPromptedThisInvocation = true;
         }
       } else {
         // Grant consumed — permission check was skipped. Set provenance explicitly
@@ -277,119 +229,12 @@ export class ToolExecutor {
         name,
       );
 
-      // CES approval bridge: if the tool returned an approval_required
-      // indicator, present the proposal to the guardian via the existing
-      // confirmation transport, commit the decision to CES, and retry
-      // the original tool invocation with the granted grantId.
-      const cesClient = getCesClient();
-      if (execResult.cesApprovalRequired && !cesClient) {
-        const msg = `CES approval required for "${name}" but no CES client is available. Ensure the Credential Execution Service is running.`;
-        const durationMs = Date.now() - startTime;
-        emitLifecycleEvent(context, {
-          type: "error",
-          toolName: name,
-          executionTarget,
-          input,
-          workingDir: context.workingDir,
-          conversationId: context.conversationId,
-          requestId: context.requestId,
-          riskLevel,
-          matchedTrustRuleId: permMatchedTrustRuleId,
-          decision: "error",
-          durationMs,
-          errorMessage: msg,
-          isExpected: true,
-          errorCategory: "tool_failure",
-        });
-        return { content: msg, isError: true };
-      }
-      if (execResult.cesApprovalRequired && cesClient) {
-        const bridgeResult = await bridgeCesApproval(
-          execResult.cesApprovalRequired,
-          this.prompter,
-          cesClient,
-          {
-            isInteractive: context.isInteractive,
-            conversationId: context.conversationId,
-            signal: context.signal,
-          },
-        );
-
-        if (bridgeResult.outcome === "approved") {
-          // Retry the original tool invocation with the grantId attached.
-          // The CES tool implementations accept grantId in the input to
-          // bypass the approval check on the retry.
-          const retryInput = { ...input, grantId: bridgeResult.grantId };
-
-          log.info(
-            {
-              toolName: name,
-              grantId: bridgeResult.grantId,
-              conversationId: context.conversationId,
-            },
-            "CES approval granted - retrying tool invocation with grantId",
-          );
-
-          execResult = await executeWithTimeout(
-            tool.execute(retryInput, execContext),
-            toolTimeoutMs,
-            name,
-          );
-        } else if (
-          bridgeResult.outcome === "denied" ||
-          bridgeResult.outcome === "timeout"
-        ) {
-          const denialReason =
-            bridgeResult.outcome === "timeout"
-              ? `CES approval timed out for "${name}". The tool was not executed.`
-              : `CES approval denied for "${name}". The tool was not executed.`;
-          const durationMs = Date.now() - startTime;
-          emitLifecycleEvent(context, {
-            type: "permission_denied",
-            toolName: name,
-            executionTarget,
-            input,
-            workingDir: context.workingDir,
-            conversationId: context.conversationId,
-            requestId: context.requestId,
-            riskLevel,
-            matchedTrustRuleId: permMatchedTrustRuleId,
-            decision: "deny",
-            reason: denialReason,
-            durationMs,
-          });
-          return { content: denialReason, isError: true };
-        } else {
-          // bridgeResult.outcome === "error"
-          const errorMsg = `CES approval bridge error for "${name}": ${bridgeResult.message}`;
-          const durationMs = Date.now() - startTime;
-          emitLifecycleEvent(context, {
-            type: "error",
-            toolName: name,
-            executionTarget,
-            input,
-            workingDir: context.workingDir,
-            conversationId: context.conversationId,
-            requestId: context.requestId,
-            riskLevel,
-            matchedTrustRuleId: permMatchedTrustRuleId,
-            decision: "error",
-            durationMs,
-            errorMessage: errorMsg,
-            isExpected: true,
-            errorCategory: "tool_failure",
-          });
-          return { content: errorMsg, isError: true };
-        }
-      }
-
       // Sized from the RAW pre-sanitization result — sensitive-output
       // extraction below strips directives and swaps raw values for
       // placeholders, which changes the content length, and telemetry must
       // report the true payload size. Only the size leaves the device,
-      // never the payload. Stamped here (not centrally in
-      // emitLifecycleEvent) because only this site sees the content before
-      // extractAndSanitize() rewrites it.
+      // never the payload. Measured here because only this site sees the
+      // content before extractAndSanitize() rewrites it.
       const rawResultBytes = Buffer.byteLength(execResult.content, "utf8");
 
       // Sensitive output extraction: strip directives, replace raw values
@@ -406,25 +251,27 @@ export class ToolExecutor {
       }
 
       const durationMs = Date.now() - startTime;
-      // Strip sensitiveBindings from lifecycle event to prevent raw values leaking
+      // Strip sensitiveBindings before auditing to prevent raw values leaking.
       const { sensitiveBindings: _sb, ...safeResult } = execResult;
-      emitLifecycleEvent(context, {
-        type: "executed",
+      recordToolExecuted({
+        conversationId: context.conversationId,
         toolName: name,
-        executionTarget,
         input,
-        workingDir: context.workingDir,
-        conversationId: context.conversationId,
-        requestId: context.requestId,
+        resultContent: safeResult.content,
+        resultBytes: rawResultBytes,
+        decision,
         riskLevel,
         matchedTrustRuleId: permMatchedTrustRuleId,
-        approvalMode: permApprovalMode,
-        approvalReason: permApprovalReason,
-        decision,
         durationMs,
-        result: safeResult,
-        resultBytes: rawResultBytes,
+        attribution: context.attribution ?? null,
+        wasPrompted: wasPromptedThisInvocation,
       });
+      recordToolCompletion(
+        context.conversationId,
+        name,
+        durationMs,
+        safeResult.isError,
+      );
 
       // Merge risk metadata from the classifier assessment cache onto the
       // tool result so downstream consumers (AgentEvent → handleToolResult →
@@ -490,34 +337,21 @@ export class ToolExecutor {
         err instanceof ToolError ||
         err instanceof TokenExpiredError;
 
-      const errorCategory = isAbort
-        ? ("tool_failure" as const)
-        : err instanceof PermissionDeniedError
-          ? ("permission_denied" as const)
-          : err instanceof TokenExpiredError
-            ? ("auth" as const)
-            : err instanceof ToolError
-              ? ("tool_failure" as const)
-              : ("unexpected" as const);
-
-      emitLifecycleEvent(context, {
-        type: "error",
-        toolName: name,
-        executionTarget,
-        input,
-        workingDir: context.workingDir,
+      recordToolError({
         conversationId: context.conversationId,
         requestId: context.requestId,
-        riskLevel,
-        matchedTrustRuleId: permMatchedTrustRuleId,
-        decision: "error",
-        durationMs,
+        toolName: name,
+        input,
         errorMessage: msg,
         isExpected,
-        errorCategory,
         errorName: err instanceof Error ? err.name : undefined,
         errorStack: err instanceof Error ? err.stack : undefined,
+        riskLevel,
+        matchedTrustRuleId: permMatchedTrustRuleId,
+        durationMs,
+        attribution: context.attribution ?? null,
       });
+      recordToolCompletion(context.conversationId, name, durationMs, true);
 
       if (isExpected) {
         return { content: msg, isError: true };
@@ -619,67 +453,6 @@ export function computePerToolTimeoutMs(
   return safeTimeoutMs(rawTimeoutSec);
 }
 
-/**
- * Sanitize tool inputs before they are emitted in lifecycle events.
- * Applies recursive field-level redaction for known-sensitive keys.
- */
-function sanitizeToolInput(
-  _toolName: string,
-  input: Record<string, unknown>,
-): Record<string, unknown> {
-  return redactSensitiveFields(input);
-}
-
-function emitLifecycleEvent(
-  context: ToolContext,
-  event: ToolLifecycleEvent,
-): void {
-  const handler = context.onToolLifecycleEvent;
-  if (!handler) return;
-
-  // Redact sensitive fields from tool inputs before they reach audit listeners
-  const sanitizedEvent = {
-    ...event,
-    input: sanitizeToolInput(event.toolName, event.input),
-  };
-
-  // Stamp telemetry fields centrally so every executed/error event carries
-  // them — including the pre-execution gate failures (aborted, disk
-  // pressure, unknown/inactive tool) emitted from checkPreExecutionGates(),
-  // whose emission sites don't have to remember to copy them. This is the
-  // sole writer of both fields. (`resultBytes` is the exception: it is
-  // stamped at the executed emission site in executeInternal, the only
-  // place that sees the result content before sensitive-output extraction
-  // rewrites it; the spread above passes it through untouched.)
-  if (sanitizedEvent.type === "executed" || sanitizedEvent.type === "error") {
-    sanitizedEvent.attribution = context.attribution ?? null;
-    // Sized from the RAW pre-sanitization input — redaction changes the
-    // serialized length, and telemetry must report the true payload size.
-    // Only the size leaves the device, never the payload.
-    sanitizedEvent.inputBytes = Buffer.byteLength(
-      stringifyToolInput(event.input),
-      "utf8",
-    );
-  }
-
-  try {
-    const maybePromise = handler(sanitizedEvent as ToolLifecycleEvent);
-    if (maybePromise) {
-      void maybePromise.catch((err) => {
-        log.warn(
-          { err, eventType: event.type, toolName: event.toolName },
-          "Tool lifecycle event handler failed (non-fatal, tool execution was not affected)",
-        );
-      });
-    }
-  } catch (err) {
-    log.warn(
-      { err, eventType: event.type, toolName: event.toolName },
-      "Tool lifecycle event handler failed (non-fatal, tool execution was not affected)",
-    );
-  }
-}
-
 /**
  * Compute a preview diff for file tools so the confirmation prompt can show
  * what will change. Returns undefined for non-file tools or on any error.
@@ -700,16 +473,22 @@ function computePreviewDiff(
     if (toolName === "file_write") {
       const rawPath = input.path as string;
       const content = input.content as string;
-      if (!rawPath || typeof content !== "string") return undefined;
+      if (!rawPath || typeof content !== "string") {
+        return undefined;
+      }
       const pathCheck = sandboxPolicy(rawPath, workingDir, {
         mustExist: false,
       });
-      if (!pathCheck.ok) return undefined;
+      if (!pathCheck.ok) {
+        return undefined;
+      }
       const filePath = pathCheck.resolved;
       const isNewFile = !pathExists(filePath);
       if (!isNewFile) {
         const stat = safeStatSync(filePath);
-        if (!stat || stat.size > MAX_FILE_SIZE_BYTES) return undefined;
+        if (!stat || stat.size > MAX_FILE_SIZE_BYTES) {
+          return undefined;
+        }
       }
       const oldContent = isNewFile ? "" : readFileSync(filePath, "utf-8");
       return { filePath, oldContent, newContent: content, isNewFile };
@@ -724,18 +503,27 @@ function computePreviewDiff(
         typeof oldString !== "string" ||
         typeof newString !== "string" ||
         oldString.length === 0
-      )
+      ) {
         return undefined;
+      }
       const pathCheck = sandboxPolicy(rawPath, workingDir);
-      if (!pathCheck.ok) return undefined;
+      if (!pathCheck.ok) {
+        return undefined;
+      }
       const filePath = pathCheck.resolved;
       const stat = safeStatSync(filePath);
-      if (!stat) return undefined;
-      if (stat.size > MAX_FILE_SIZE_BYTES) return undefined;
+      if (!stat) {
+        return undefined;
+      }
+      if (stat.size > MAX_FILE_SIZE_BYTES) {
+        return undefined;
+      }
       const content = readFileSync(filePath, "utf-8");
       const replaceAll = input.replace_all === true;
       const result = applyEdit(content, oldString, newString, replaceAll);
-      if (!result.ok) return undefined;
+      if (!result.ok) {
+        return undefined;
+      }
       return {
         filePath,
         oldContent: content,

package/src/tools/filesystem/write.ts

@@ -3,7 +3,6 @@ import { join, resolve, sep } from "node:path";
 import { getAppsDir } from "../../apps/app-store.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { enqueuePkbIndexJob } from "../../plugins/defaults/memory/jobs/embed-pkb-file.js";
-import { PKB_WORKSPACE_SCOPE } from "../../plugins/defaults/memory/pkb/types.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir } from "../../util/platform.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
@@ -160,7 +159,6 @@ export const fileWriteTool = {
         enqueuePkbIndexJob({
           pkbRoot,
           absPath: filePath,
-          memoryScopeId: PKB_WORKSPACE_SCOPE,
         });
       }
     } catch (err) {

package/src/tools/host-terminal/host-shell.test.ts

@@ -104,13 +104,6 @@ mock.module("../../config/loader.js", () => ({
   setNestedValue: () => {},
 }));
 
-mock.module("../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 // Mock HostBashProxy singleton — proxy delegation tests configure this.
 let mockProxyAvailable = false;
 let mockProxyRequestImpl: (

package/src/tools/host-terminal/host-shell.ts

@@ -2,16 +2,9 @@
  * Host shell tool - `host_bash`.
  *
  * Unlike the sandboxed `bash` tool, `host_bash` runs commands directly on the
- * host machine without the OS-level sandbox. Under CES shell lockdown for
- * untrusted actors, `host_bash` remains available as a user-approved escape
- * hatch - the guardian must explicitly approve each invocation. It is NOT part
- * of the strong CES secrecy guarantee because it runs unsandboxed and could
- * access protected paths or credential material on disk.
- *
- * To mitigate risk, when CES shell lockdown is active for untrusted sessions:
- * - Persistent approvals are disabled (every invocation requires fresh approval).
- * - The VELLUM_UNTRUSTED_SHELL=1 env flag is set so CLI commands self-deny
- *   raw-token/secret reveal flows.
+ * host machine without the OS-level sandbox. Each invocation is approval-gated -
+ * the guardian must explicitly approve it. It runs unsandboxed and could access
+ * protected paths or credential material on disk.
  */
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -20,7 +13,6 @@ import { isAbsolute } from "node:path";
 
 import { supportsHostProxy } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
-import { isCesShellLockdownEnabled } from "../../credential-execution/feature-gates.js";
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
@@ -28,7 +20,6 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../../runtime/assistant-event-hub.js";
-import { isUntrustedShellLockdownActive } from "../../runtime/effective-capabilities.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
@@ -80,10 +71,7 @@ function buildHostShellEnv(): Record<string, string> {
   return env;
 }
 
-function buildHostBashProxyEnv(
-  hostLockdownActive: boolean,
-  conversationId: string,
-): Record<string, string> {
+function buildHostBashProxyEnv(conversationId: string): Record<string, string> {
   const env: Record<string, string> = {};
 
   for (const key of HOST_BASH_PROXY_ENV_KEYS) {
@@ -93,10 +81,6 @@ function buildHostBashProxyEnv(
     }
   }
 
-  if (hostLockdownActive) {
-    env.VELLUM_UNTRUSTED_SHELL = "1";
-  }
-
   // Keep nested `assistant` CLI calls in host_bash aligned with the
   // originating conversation so browser IPC can resolve live proxy context.
   env.__CONVERSATION_ID = conversationId;
@@ -109,9 +93,6 @@ export const hostShellTool = {
     "LAST RESORT — Execute a shell command directly on the host machine. You MUST strongly prefer the regular `bash` tool for all commands. Only use `host_bash` when you are absolutely certain the command MUST run on the host machine and CANNOT run in the workspace (e.g., managing host-level system services, accessing host-only peripherals, or interacting with host paths outside the workspace). If in doubt, use `bash` instead. Approval-gated: each invocation must be explicitly approved. Do not use for commands that require injected credentials or secrets.",
   category: "host-terminal",
   executionTarget: "host",
-  // host_bash is a weaker-tier escape hatch under CES lockdown. It remains
-  // Medium risk by default but persistent approvals are disabled for
-  // untrusted sessions (see execute()).
   defaultRiskLevel: RiskLevel.Medium,
 
   input_schema: {
@@ -202,21 +183,6 @@ export const hostShellTool = {
     const config = getConfig();
     const { shellDefaultTimeoutSec, shellMaxTimeoutSec } = config.timeouts;
 
-    // CES shell lockdown: host_bash is the weaker-tier escape hatch. When
-    // lockdown is active for untrusted actors, persistent approvals are
-    // disabled (every invocation requires fresh guardian approval) and the
-    // VELLUM_UNTRUSTED_SHELL flag is injected to self-deny raw-secret CLI
-    // commands. This does NOT provide the strong CES secrecy guarantee -
-    // the subprocess runs unsandboxed and could access protected paths.
-    //
-    // NOTE: forcePromptSideEffects is set in executor.ts BEFORE the
-    // permission check runs, not here. Setting it here would be too late
-    // because execute() is called after permissions have already been evaluated.
-    const hostLockdownActive = isUntrustedShellLockdownActive({
-      trustClass: context.trustClass,
-      lockdownEnabled: isCesShellLockdownEnabled(config),
-    });
-
     // Guard: non-host-proxy interfaces need an explicit target when multiple
     // capable clients are connected to avoid ambiguous untargeted broadcasts.
     const transportInterface = context.transportInterface;
@@ -271,11 +237,8 @@ export const hostShellTool = {
       );
       // Forward instance-routing env vars so nested `assistant` CLI commands
       // executed on a proxied host machine can still resolve the correct
-      // daemon IPC socket and workspace, plus lockdown marker when required.
-      const proxyEnv = buildHostBashProxyEnv(
-        hostLockdownActive,
-        context.conversationId,
-      );
+      // daemon IPC socket and workspace.
+      const proxyEnv = buildHostBashProxyEnv(context.conversationId);
 
       if (background) {
         // Check the registry limit BEFORE starting the proxy request so we
@@ -466,18 +429,12 @@ export const hostShellTool = {
         cwd: workingDir,
         timeoutSec,
         conversationId: context.conversationId,
-        hostLockdownActive,
         background,
       },
       "Executing host shell command",
     );
 
     const hostEnv = buildHostShellEnv();
-    // Inject VELLUM_UNTRUSTED_SHELL=1 so assistant CLI commands self-deny
-    // raw-token/secret reveal flows when invoked from an untrusted shell.
-    if (hostLockdownActive) {
-      hostEnv.VELLUM_UNTRUSTED_SHELL = "1";
-    }
     // Match `bash` tool behavior so nested assistant CLI calls can bind to
     // the active conversation when running through host_bash.
     hostEnv.__CONVERSATION_ID = context.conversationId;