@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/tools/run-standalone.ts

@@ -20,11 +20,7 @@ import { v4 as uuid } from "uuid";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { getWorkspaceDir } from "../util/platform.js";
 import { ToolExecutor } from "./executor.js";
-import {
-  areCoreToolsInitialized,
-  getTool,
-  initializeTools,
-} from "./registry.js";
+import { resolveTool } from "./registry.js";
 import type { ToolContext } from "./types.js";
 
 /** Thrown when the requested tool is not present in the registry. */
@@ -59,14 +55,11 @@ export async function runToolStandalone(
   input: Record<string, unknown>,
   opts?: { workingDir?: string; signal?: AbortSignal },
 ): Promise<StandaloneToolResult> {
-  // Populate the registry from the filesystem. The daemon does this at
-  // startup; a short-lived CLI process has to do it itself. Guarded so a
-  // repeat call in the same process is a no-op.
-  if (!areCoreToolsInitialized()) {
-    await initializeTools();
-  }
-
-  if (!getTool(toolName)) {
+  // `resolveTool` lazily initializes the registry on first access (the daemon
+  // does this at startup; a short-lived CLI process relies on the same lazy
+  // ensure).
+  const tool = await resolveTool(toolName);
+  if (!tool) {
     throw new UnknownToolError(toolName);
   }
 

package/src/tools/side-effects.ts

@@ -18,7 +18,6 @@ const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
   "schedule_create",
   "schedule_update",
   "schedule_delete",
-  "manage_secure_command_tool",
 ]);
 
 /**

package/src/tools/skills/find-similar-skills.test.ts

@@ -20,13 +20,6 @@ import { describe, expect, mock, test } from "bun:test";
 import type { SkillSource } from "../../config/skills.js";
 import type { OwnerInfo } from "../types.js";
 
-mock.module("../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 // Map managed skill id → recorded author, consulted by the mocked
 // `readInstallMeta` below. Tests set entries to drive the author join.
 const installMetaAuthors: Record<string, "assistant" | "user" | undefined> = {};
@@ -343,10 +336,13 @@ describe("find_similar_skills — per-chat plugin scope", () => {
     ];
     const rankThenLimit = async (
       _goal: string,
-      opts?: { limit?: number; loadCatalog?: () => { id: string }[] },
+      opts?: {
+        limit?: number;
+        loadCatalog?: () => { id: string }[] | Promise<{ id: string }[]>;
+      },
     ) => {
       const candidateIds = new Set(
-        (opts?.loadCatalog?.() ?? FULL_CATALOG()).map((s) => s.id),
+        (await (opts?.loadCatalog?.() ?? FULL_CATALOG())).map((s) => s.id),
       );
       return RANKED.filter((h) => candidateIds.has(h.skillId)).slice(
         0,

package/src/tools/skills/scaffold-managed.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import type { SkillSource } from "../../config/skills.js";
 import { loadSkillCatalog } from "../../config/skills.js";
 import { refreshSkillCapabilityMemories } from "../../daemon/skill-memory-refresh.js";
+import { getConversation } from "../../persistence/conversation-crud.js";
 import { MEMORY_RETROSPECTIVE_ORIGIN } from "../../plugins/defaults/memory/memory-retrospective-constants.js";
 import { readInstallMeta } from "../../skills/install-meta.js";
 import {
@@ -57,14 +58,19 @@ function normalizeOptionalStringArray(
  * Core execution logic for scaffold_managed_skill.
  * Exported so bundled-skill executors and tests can call it directly.
  *
- * `deps` injects the catalog seam so the ownership backstop's non-managed
- * collision check can be exercised without standing up a real bundled/plugin
- * catalog.
+ * `deps` injects the catalog and conversation-lookup seams so the ownership
+ * backstop's non-managed collision check and the lineage resolution can be
+ * exercised without standing up a real bundled/plugin catalog or a live DB.
  */
 export async function executeScaffoldManagedSkill(
   input: Record<string, unknown>,
   context: ToolContext,
-  deps: { loadCatalog?: () => { id: string; source: SkillSource }[] } = {},
+  deps: {
+    loadCatalog?: () => { id: string; source: SkillSource }[];
+    getConversation?: (
+      id: string,
+    ) => { forkParentConversationId: string | null } | null;
+  } = {},
 ): Promise<ToolExecutionResult> {
   const skillId = input.skill_id;
   if (typeof skillId !== "string" || !skillId.trim()) {
@@ -230,6 +236,25 @@ export async function executeScaffoldManagedSkill(
     }
   }
 
+  // Conversation lineage (retrospective origin only). The retrospective runs
+  // in a background fork of the conversation it distilled the procedure from,
+  // so the fork's parent is this skill's durable source conversation.
+  // Resolution is best-effort: a missing or unresolvable parent must never
+  // fail the scaffold.
+  let sourceConversationId: string | undefined;
+  let retrospectiveConversationId: string | undefined;
+  if (fromRetrospective && context.conversationId) {
+    retrospectiveConversationId = context.conversationId;
+    try {
+      const lookupConversation = deps.getConversation ?? getConversation;
+      sourceConversationId =
+        lookupConversation(context.conversationId)?.forkParentConversationId ??
+        undefined;
+    } catch {
+      // Lineage stays unset; the scaffold itself still proceeds.
+    }
+  }
+
   const result = createManagedSkill({
     id,
     name: sanitizeFrontmatterValue(name),
@@ -246,6 +271,8 @@ export async function executeScaffoldManagedSkill(
     category,
     files,
     author,
+    sourceConversationId,
+    retrospectiveConversationId,
   });
 
   if (!result.created) {

package/src/tools/skills/skill-script-runner.ts

@@ -1,12 +1,8 @@
-import { basename, join, resolve } from "node:path";
+import { join, resolve } from "node:path";
 
-import { bundledToolRegistry } from "../../config/bundled-tool-registry.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
-import type {
-  ExecutionTarget,
-  ToolContext,
-  ToolExecutionResult,
-} from "../types.js";
+import type { ExecutionTarget } from "../tool-types.js";
+import type { ToolContext, ToolExecutionResult } from "../types.js";
 import { runSkillToolScriptSandbox } from "./sandbox-runner.js";
 import type { SkillToolScript } from "./script-contract.js";
 
@@ -23,9 +19,9 @@ export interface RunSkillToolScriptOptions {
    *  to `computeSkillVersionHash` from the version-hash module. Provided as an
    *  option to support testing and custom resolution strategies. */
   skillDirHashResolver?: (skillDir: string) => string;
-  /** Whether this is a bundled (first-party) skill. When true and running inside
-   *  a compiled binary, the runner uses the pre-imported bundled tool registry
-   *  instead of a dynamic filesystem import. */
+  /** Whether this is a bundled (first-party) skill. Only bundled skills may run
+   *  with `execution_target: host` (in-process); non-bundled skills are forced to
+   *  execute in the sandbox. */
   bundled?: boolean;
 }
 
@@ -95,28 +91,18 @@ export async function runSkillToolScript(
     }
   }
 
-  // For bundled skills, use the pre-imported registry instead of dynamic import.
-  // In compiled binaries the scripts' relative imports (e.g. ../../../../tools/...)
-  // can't resolve because those modules are inside the virtual /$bunfs/ filesystem.
-  let module: SkillToolScript | undefined;
-  if (options?.bundled) {
-    const registryKey = `${basename(skillDir)}:${executorPath}`;
-    module = bundledToolRegistry.get(registryKey);
-  }
-
-  if (!module) {
-    try {
-      module = await import(scriptPath);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return {
-        content: `Failed to load skill tool script "${executorPath}": ${message}`,
-        isError: true,
-      };
-    }
+  let module: SkillToolScript;
+  try {
+    module = await import(scriptPath);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      content: `Failed to load skill tool script "${executorPath}": ${message}`,
+      isError: true,
+    };
   }
 
-  if (typeof module!.run !== "function") {
+  if (typeof module.run !== "function") {
     return {
       content: `Skill tool script "${executorPath}" does not export a "run" function`,
       isError: true,
@@ -124,7 +110,7 @@ export async function runSkillToolScript(
   }
 
   try {
-    return await module!.run(input, context);
+    return await module.run(input, context);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return {

package/src/tools/skills/skill-tool-factory.ts

@@ -5,12 +5,8 @@ import {
   coerceStringNumbers,
   validateInputAgainstSchema,
 } from "../../skills/validate-input.js";
-import type {
-  ExecutionTarget,
-  Tool,
-  ToolContext,
-  ToolExecutionResult,
-} from "../types.js";
+import type { ExecutionTarget } from "../tool-types.js";
+import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 import { runSkillToolScript } from "./skill-script-runner.js";
 
 const riskMap: Record<SkillToolEntry["risk"], RiskLevel> = {

package/src/tools/subagent/read.ts

@@ -1,4 +1,5 @@
 import { getMessages } from "../../persistence/conversation-crud.js";
+import { extractTextFromStoredMessageContent } from "../../persistence/message-content.js";
 import { getSubagentManager, TERMINAL_STATUSES } from "../../subagent/index.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 import { resolveSubagentId } from "./resolve.js";
@@ -58,10 +59,12 @@ export async function executeSubagentRead(
   // Group text blocks by message so last_n slices messages, not blocks.
   const messageTexts: string[] = [];
   for (const msg of dbMessages) {
-    if (msg.role !== "assistant") continue;
+    if (msg.role !== "assistant") {
+      continue;
+    }
     const blocks: string[] = [];
     try {
-      const content = JSON.parse(msg.content);
+      const content = msg.content;
       if (Array.isArray(content)) {
         for (const block of content) {
           if (block.type === "text" && typeof block.text === "string") {
@@ -72,8 +75,7 @@ export async function executeSubagentRead(
         blocks.push(content);
       }
     } catch {
-      // Content might be plain text.
-      blocks.push(msg.content);
+      blocks.push(extractTextFromStoredMessageContent(msg.content));
     }
     if (blocks.length > 0) {
       messageTexts.push(blocks.join("\n\n"));

package/src/tools/subagent/spawn.ts

@@ -160,21 +160,25 @@ export async function executeSubagentSpawn(
   // that only surfaces with no `activeProfile` set and a hand-tuned call-site
   // profile.
   //
-  // The fallback is forwarded NON-forced, so an explicit
-  // `llm.callSites.subagentSpawn` profile still wins; an explicit
-  // `inference_profile` argument keeps `forceOverrideProfile` and wins
-  // outright. (The row read short-circuits to `undefined` for the background
-  // subagent conversation and for tool calls outside an agent-loop turn.)
+  // An explicit `llm.callSites.subagentSpawn` profile must still win over
+  // the invoker-default tier: that tier is a matching heuristic, not a user
+  // choice, and any override outranks the call-site pin under
+  // override-or-default resolution — so the heuristic is only forwarded
+  // when no explicit pin exists. (Under the legacy cascade a non-forced
+  // override already lost to the pin, so this guard is behavior-identical
+  // there.) An explicit `inference_profile` argument keeps
+  // `forceOverrideProfile` and wins outright; the row read short-circuits
+  // to `undefined` for the background subagent conversation and for tool
+  // calls outside an agent-loop turn.
   let inheritedOverrideProfile = requestedOverrideProfile;
   if (inheritedOverrideProfile === undefined) {
-    const inheritedCandidate =
+    const llm = getConfig().llm;
+    inheritedOverrideProfile =
       context.overrideProfile ??
       getConversationOverrideProfile(context.conversationId) ??
-      resolveDefaultProfileKey(
-        context.invokingCallSite ?? "mainAgent",
-        getConfig().llm,
-      );
-    inheritedOverrideProfile = inheritedCandidate;
+      (llm.callSites?.subagentSpawn?.profile == null
+        ? resolveDefaultProfileKey(context.invokingCallSite ?? "mainAgent", llm)
+        : undefined);
   }
 
   try {
@@ -366,7 +370,9 @@ function appendInFlightAssistantTurn(
 ): Message[] {
   // When the snapshot already ends on an assistant turn, the in-flight turn is
   // present (or there is none to add) — appending the latest row would duplicate it.
-  if (messages[messages.length - 1]?.role === "assistant") return messages;
+  if (messages[messages.length - 1]?.role === "assistant") {
+    return messages;
+  }
 
   let rows;
   try {
@@ -374,26 +380,19 @@ function appendInFlightAssistantTurn(
   } catch {
     return messages;
   }
-  if (!rows || rows.length === 0) return messages;
+  if (!rows || rows.length === 0) {
+    return messages;
+  }
 
   const lastRow = rows[rows.length - 1];
-  if (lastRow.role !== "assistant") return messages;
-
-  let blocks: ContentBlock[];
-  try {
-    const parsed = JSON.parse(lastRow.content);
-    if (Array.isArray(parsed)) {
-      blocks = parsed as ContentBlock[];
-    } else if (typeof parsed === "string") {
-      blocks = [{ type: "text", text: parsed }];
-    } else {
-      return messages;
-    }
-  } catch {
-    // Plain-text content (no JSON envelope).
-    blocks = [{ type: "text", text: lastRow.content }];
+  if (lastRow.role !== "assistant") {
+    return messages;
   }
 
-  if (blocks.length === 0) return messages;
+  const blocks: ContentBlock[] = lastRow.content;
+
+  if (blocks.length === 0) {
+    return messages;
+  }
   return [...messages, { role: "assistant", content: blocks }];
 }

package/src/tools/terminal/safe-env.ts

@@ -34,6 +34,7 @@ export const SAFE_ENV_VARS = [
   "VELLUM_DEVICE_ID",
   "VELLUM_DISABLE_PLATFORM",
   "VELLUM_ENVIRONMENT",
+  "VELLUM_TEST_LOG_LEVEL",
 
   "VELLUM_WORKSPACE_DIR",
   "CES_BOOTSTRAP_SOCKET_DIR",
@@ -45,10 +46,10 @@ export const SAFE_ENV_VARS = [
   "VELLUM_PLATFORM_URL",
   "VELLUM_ASSISTANT_PLATFORM_URL",
   "VELLUM_DOCS_BASE_URL",
+  "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
   "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
   "CES_CREDENTIAL_URL",
   "CES_MANAGED_MODE",
-  "CES_STANDALONE",
   "CES_LOCAL_SOCKET",
   "IS_CONTAINERIZED",
   "IS_PLATFORM",
@@ -170,7 +171,11 @@ export function buildSanitizedEnv(): Record<string, string> {
   // arrows, etc.) survive piping through tools like pbcopy without corruption.
   // macOS (Darwin) does not provide C.UTF-8, so use en_US.UTF-8 there.
   const utf8Locale = process.platform === "darwin" ? "en_US.UTF-8" : "C.UTF-8";
-  if (!env.LANG) env.LANG = utf8Locale;
-  if (!env.LC_ALL) env.LC_ALL = utf8Locale;
+  if (!env.LANG) {
+    env.LANG = utf8Locale;
+  }
+  if (!env.LC_ALL) {
+    env.LC_ALL = utf8Locale;
+  }
   return env;
 }

package/src/tools/terminal/shell.test.ts

@@ -25,12 +25,6 @@ mock.module("../../config/loader.js", () => ({
     }) as unknown as ReturnType<typeof realLoader.getConfig>,
 }));
 
-const realGates = await import("../../credential-execution/feature-gates.js");
-mock.module("../../credential-execution/feature-gates.js", () => ({
-  ...realGates,
-  isCesShellLockdownEnabled: () => false,
-}));
-
 // Capture lifecycle events broadcast by the tool.
 type CapturedEvent = { type: string } & Record<string, unknown>;
 const events: CapturedEvent[] = [];

package/src/tools/terminal/shell.ts

@@ -2,12 +2,10 @@ import type { ChildProcess } from "node:child_process";
 import { spawn } from "node:child_process";
 
 import { getConfig } from "../../config/loader.js";
-import { isCesShellLockdownEnabled } from "../../credential-execution/feature-gates.js";
 import type { BackgroundToolCompleted } from "../../daemon/message-types/background-tools.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
-import { isUntrustedShellLockdownActive } from "../../runtime/effective-capabilities.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
@@ -31,8 +29,8 @@ import {
   formatShellOutput,
   MAX_OUTPUT_LENGTH,
 } from "../shared/shell-output.js";
+import type { ProxyEnvVars } from "../tool-types.js";
 import type {
-  ProxyEnvVars,
   ToolContext,
   ToolDefinition,
   ToolExecutionResult,
@@ -123,33 +121,10 @@ export const shellTool = {
     }
 
     const config = getConfig();
-    const shellLockdownActive = isUntrustedShellLockdownActive({
-      trustClass: context.trustClass,
-      lockdownEnabled: isCesShellLockdownEnabled(config),
-    });
 
     const networkMode: "off" | "proxied" =
       input.network_mode === "proxied" ? "proxied" : "off";
 
-    // -----------------------------------------------------------------------
-    // CES shell lockdown - reject proxied credential sessions for untrusted
-    // actors when the lockdown flag is active. Proxied sessions grant the
-    // subprocess access to credentials through the egress proxy, which
-    // violates the secrecy guarantee.
-    // -----------------------------------------------------------------------
-    if (shellLockdownActive && networkMode === "proxied") {
-      log.warn(
-        { trustClass: context.trustClass },
-        "CES shell lockdown: rejecting proxied credential session for untrusted actor",
-      );
-      return {
-        content:
-          "Error: proxied credential sessions are not available in untrusted shell mode. " +
-          "Use the credential grant workflow to request access through a guardian.",
-        isError: true,
-      };
-    }
-
     const rawCredentialRefs: string[] = [];
     if (Array.isArray(input.credential_ids)) {
       for (const id of input.credential_ids) {
@@ -159,24 +134,6 @@ export const shellTool = {
       }
     }
 
-    // -----------------------------------------------------------------------
-    // CES shell lockdown - reject non-empty credential-ref mode for untrusted
-    // actors. Even when network_mode is "off", passing credential_ids could
-    // allow the model to probe stored credential metadata.
-    // -----------------------------------------------------------------------
-    if (shellLockdownActive && rawCredentialRefs.length > 0) {
-      log.warn(
-        { trustClass: context.trustClass, refCount: rawCredentialRefs.length },
-        "CES shell lockdown: rejecting credential-ref mode for untrusted actor",
-      );
-      return {
-        content:
-          "Error: credential references are not available in untrusted shell mode. " +
-          "Use the credential grant workflow to request access through a guardian.",
-        isError: true,
-      };
-    }
-
     // Resolve credential refs (UUID or service/field) to canonical UUIDs.
     // Fail fast if any ref is unresolvable - partial execution with missing
     // credentials is worse than a clear error.
@@ -323,12 +280,6 @@ export const shellTool = {
       Object.assign(env, proxyEnv);
     }
 
-    // Inject VELLUM_UNTRUSTED_SHELL=1 so assistant CLI commands can self-deny
-    // raw-token/secret reveal flows when invoked from an untrusted shell.
-    if (shellLockdownActive) {
-      env.VELLUM_UNTRUSTED_SHELL = "1";
-    }
-
     const wrapped = { command: "bash", args: ["-c", "--", command] };
 
     // -----------------------------------------------------------------------