@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/daemon/conversation-tool-setup.ts

@@ -8,12 +8,10 @@
 
 import {
   type HostProxyCapability,
-  type InterfaceId,
   supportsHostProxy,
 } from "../channels/types.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import { getConfig } from "../config/loader.js";
-import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import { getBindingByConversation } from "../persistence/external-conversation-store.js";
@@ -24,12 +22,14 @@ import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import type { ToolExecutor } from "../tools/executor.js";
 import {
+  getAllPluginToolDefinitions,
   getMcpToolDefinitions,
   getPluginToolDefinitions,
   getTool,
   getToolOwner,
   getWorkspaceToolDefinitions,
   getWorkspaceToolNames,
+  loadPluginTools,
 } from "../tools/registry.js";
 import {
   ACTIVITY_SKIP_SET,
@@ -56,10 +56,8 @@ import {
   type UsageAttributionSnapshot,
 } from "../usage/attribution.js";
 import { getLogger } from "../util/logger.js";
-import {
-  projectSkillTools,
-  type SkillProjectionCache,
-} from "./conversation-skill-tools.js";
+import type { Conversation } from "./conversation.js";
+import { projectSkillTools } from "./conversation-skill-tools.js";
 import { surfaceProxyResolver } from "./conversation-surfaces.js";
 import {
   isDoordashCommand,
@@ -71,11 +69,7 @@ import { FALLBACK_TURN_TRUST, resolveTrustClass } from "./trust-context.js";
 
 const log = getLogger("conversation-tool-setup");
 
-import type {
-  SubagentToolGateMode,
-  ToolSetupContext,
-  WakeToolContextPin,
-} from "./tool-setup-types.js";
+import type { ToolSetupContext } from "./tool-setup-types.js";
 export type {
   SubagentToolGateMode,
   ToolSetupContext,
@@ -478,83 +472,6 @@ export function createProxyApprovalCallback(
  */
 export const DEFAULT_PREACTIVATED_SKILL_IDS = ["notifications", "subagent"];
 
-/**
- * Subset of Conversation state that the resolveTools callback reads at each
- * agent turn. Properties are read lazily from this reference.
- */
-export interface SkillProjectionContext {
-  preactivatedSkillIds?: string[];
-  readonly skillProjectionState: Map<string, string>;
-  readonly skillProjectionCache: SkillProjectionCache;
-  readonly coreToolNames: Set<string>;
-  allowedToolNames?: Set<string>;
-  /**
-   * Durable copy of the full tool set resolved on the most recent turn, used
-   * by read-only inventory queries. Set alongside {@link allowedToolNames}
-   * but, unlike that per-turn execution gate, never cleared at turn teardown.
-   */
-  lastResolvedToolNames?: Set<string>;
-  /** When > 0, the resolveTools callback returns no tools at all. */
-  toolsDisabledDepth: number;
-  /** Channel capabilities — read lazily per turn for conditional tool filtering. */
-  readonly channelCapabilities?: {
-    channel: string;
-    supportsDynamicUi: boolean;
-    clientOS?: string;
-  };
-  /** True when no client is connected (HTTP-only). */
-  readonly hasNoClient?: boolean;
-  /** When set, only tools in this set are included in the resolved tool list (subagent delegation). */
-  subagentAllowedTools?: Set<string>;
-  /**
-   * How {@link subagentAllowedTools} is enforced — see
-   * {@link SubagentToolGateMode}. Absent means `"wire"`.
-   */
-  subagentToolGateMode?: SubagentToolGateMode;
-  /**
-   * When set (execution-gate-mode wakes), tool-definition resolution reads
-   * `hasNoClient` / `transportInterface` / `channelCapabilities` exclusively
-   * from this pin instead of the live conversation — see
-   * {@link WakeToolContextPin}.
-   */
-  readonly toolContextPin?: WakeToolContextPin;
-  /** True when the current turn is restricted to disk-pressure cleanup-safe tools. */
-  diskPressureCleanupModeActive?: boolean;
-  /** True when this conversation belongs to a subagent spawned by SubagentManager. */
-  readonly isSubagent?: boolean;
-  /**
-   * The interface id of the connected client driving the current turn (e.g.
-   * "macos", "chrome-extension"). Used to gate host tools by per-capability
-   * `supportsHostProxy(transport, capability)` so that interfaces which only
-   * support a subset of the host proxy set (e.g. chrome-extension supports
-   * `host_browser` but not `host_bash`/`host_file`) do not leak unsupported
-   * host tools into the LLM tool definitions.
-   */
-  readonly transportInterface?: InterfaceId;
-  /** Per-turn override profile. */
-  currentTurnOverrideProfile?: string;
-  /**
-   * The conversation's per-chat plugin scope (mirrors
-   * {@link Conversation.enabledPlugins}). `null`/absent means no per-chat
-   * restriction; otherwise plugin-owned tools and skills are intersected with
-   * the effective set (the scope unioned with the always-on first-party
-   * defaults) via {@link getEffectiveEnabledPluginSet}. Read per turn so a
-   * mid-conversation scope change is picked up.
-   */
-  readonly enabledPlugins?: string[] | null;
-  /**
-   * Conversation id for `skill_loaded` telemetry. Absent (e.g. minimal test
-   * contexts) disables telemetry recording in the skill projection.
-   */
-  readonly conversationId?: string;
-  /**
-   * The LLM call site driving the current turn (see
-   * {@link ToolSetupContext.currentCallSite}) — read per turn so skill_loaded
-   * telemetry attributes the provider/model/profile the turn actually ran on.
-   */
-  currentCallSite?: LLMCallSite;
-}
-
 // ── Conditional tool sets ────────────────────────────────────────────
 
 const UI_SURFACE_TOOL_NAMES = new Set(["ui_show", "ui_update", "ui_dismiss"]);
@@ -644,7 +561,7 @@ export const SUBAGENT_ONLY_TOOL_NAMES = new Set<string>([
  */
 export function isToolActiveForContext(
   name: string,
-  ctx: SkillProjectionContext,
+  ctx: Conversation,
 ): boolean {
   // Execution-gate-mode wakes pin the client-context inputs so the wire tool
   // surface matches the SOURCE conversation's live turns rather than the
@@ -778,7 +695,7 @@ export function isToolActiveForContext(
  */
 export function createResolveToolsCallback(
   toolDefs: ToolDefinition[],
-  ctx: SkillProjectionContext,
+  ctx: Conversation,
 ): ((history: Message[]) => ToolDefinition[]) | undefined {
   if (toolDefs.length === 0) {
     return undefined;
@@ -834,27 +751,33 @@ export function createResolveToolsCallback(
     // serialized, so the registry settles for a subsequent turn to read.
     void loadWorkspaceTools();
 
-    // Re-read plugin tool definitions from the registry each turn so a plugin
-    // installed/removed at runtime (activated by the per-turn scan in
-    // `plugins/mtime-cache.ts`) is picked up without recreating the
-    // conversation. Plugin tools share core's context filter + allowlist path,
-    // so combine them with the core snapshot before filtering.
-    const currentPluginDefs = getPluginToolDefinitions();
-
-    // Scope plugin tools to the conversation's per-chat plugin set. `null`
-    // leaves the list unchanged (no per-chat restriction); otherwise keep only
-    // tools whose owning plugin id is in the set, mirroring the
-    // `subagentAllowedTools` intersection below. Ownership lives in the registry
-    // (queried via getToolOwner), not on the Tool object.
-    const scopedPluginDefs =
-      effectiveEnabledPluginSet === null
-        ? currentPluginDefs
-        : currentPluginDefs.filter((d) => {
-            const ownerId = getToolOwner(d.name)?.id;
-            return (
-              ownerId !== undefined && effectiveEnabledPluginSet.has(ownerId)
-            );
-          });
+    // Same treatment for user-plugin tools: pull the plugin mtime-cache's
+    // active tool set into the registry (a no-op costs one sentinel stat +
+    // fingerprint compares), so a plugin installed/removed/edited at runtime
+    // is picked up without recreating the conversation.
+    void loadPluginTools();
+
+    // Read every registered plugin tool each turn (so runtime installs/edits
+    // are picked up) and let one filter decide visibility, making the two
+    // precedence rules explicit side by side. Plugin tools share core's context
+    // filter + allowlist path, so combine them with the core snapshot before
+    // filtering. Ownership lives in the registry (getToolOwner), not on the Tool.
+    //
+    //   - No per-chat scope (null): keep tools whose plugin is not disabled at
+    //     the workspace level (the `.disabled` sentinel gate).
+    //   - Explicit per-chat scope: the scope is the sole authority (rule 1 >
+    //     rule 2, see getEffectiveEnabledPluginSet) — keep tools the scope
+    //     enables, so a chat can re-enable a workspace-disabled plugin for
+    //     itself while a plugin the scope omits stays hidden.
+    const scopedPluginDefs = getAllPluginToolDefinitions().filter((d) => {
+      const ownerId = getToolOwner(d.name)?.id;
+      if (ownerId === undefined) {
+        return false;
+      }
+      return effectiveEnabledPluginSet === null
+        ? !isPluginDisabled(ownerId)
+        : effectiveEnabledPluginSet.has(ownerId);
+    });
 
     // Filter core + plugin tools based on current conversation context so that
     // tools irrelevant to this turn (e.g. UI tools when no client is connected)
@@ -947,7 +870,31 @@ export function createResolveToolsCallback(
     // any degraded-mode narrowing below — `allowedToolNames` is the per-turn
     // execution gate (cleared at teardown and restricted under disk pressure),
     // whereas this snapshot answers "what tools does this conversation have".
-    ctx.lastResolvedToolNames = turnAllowed;
+    // Reuse the definitions already resolved this turn (base + appended skill
+    // defs); only active-skill names that carry no appended definition (the
+    // cached skill-projection path returns names without defs) fall back to a
+    // registry lookup for their metadata.
+    const resolvedDefsByName = new Map<string, ToolDefinition>();
+    for (const def of allBaseDefs) {
+      resolvedDefsByName.set(def.name, def);
+    }
+    for (const def of projection.toolDefinitions) {
+      resolvedDefsByName.set(def.name, def);
+    }
+    ctx.registeredToolDefinitions = Array.from(turnAllowed)
+      .sort((a, b) => a.localeCompare(b))
+      .map((name) => {
+        const known = resolvedDefsByName.get(name);
+        if (known !== undefined) {
+          return known;
+        }
+        const tool = getTool(name);
+        return {
+          name,
+          description: tool?.description ?? "",
+          input_schema: tool?.input_schema ?? {},
+        };
+      });
     if (ctx.diskPressureCleanupModeActive === true) {
       const cleanupDefs = allBaseDefs.filter((d) =>
         isDiskPressureCleanupToolName(d.name),

package/src/daemon/conversation-turn-finalize.ts

@@ -34,6 +34,10 @@ import { enqueueLexicalIndexForMessage } from "../persistence/job-handlers/messa
 import { indexMessageNow } from "../plugins/defaults/memory/indexer.js";
 import type { Message } from "../providers/types.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
+import {
+  finalizeStrandedInflightContent,
+  type InflightContentWriter,
+} from "./inflight-message-content.js";
 import { conversationMetadataSyncTag } from "./message-types/sync.js";
 
 /** Minimal live-conversation surface the deferred tail reads and rewrites. */
@@ -46,6 +50,8 @@ interface TurnTailContext {
 interface TurnTailState {
   readonly deferredFinalizeEffects: ReadonlyArray<() => Promise<void>>;
   readonly lastAssistantMessageId: string | undefined;
+  /** In-flight content writers the turn left behind (see EventHandlerState). */
+  readonly inflightWriters: Map<string, InflightContentWriter>;
 }
 
 /**
@@ -180,6 +186,18 @@ export async function runDeferredTurnTail(params: {
     rlog.warn({ err }, "Post-turn tool result truncation failed (non-fatal)");
   }
 
+  // Fold any in-flight content writers the turn left behind (cancelled or
+  // aborted turns exit before their rows' finalize seams). Guarded like the
+  // steps below: a failure must not escape past the terminal SSE.
+  try {
+    await finalizeStrandedInflightContent(state.inflightWriters, rlog);
+  } catch (err) {
+    rlog.warn(
+      { err },
+      "Failed to finalize stranded in-flight content (non-fatal)",
+    );
+  }
+
   // Mirror the final assistant row into the JSONL disk view. Guarded like the
   // steps above: this runs AFTER the terminal SSE, so a throw here (e.g. a
   // SQLite read failure in `getConversation`) must not escape into the loop's

package/src/daemon/conversation.ts

@@ -18,6 +18,7 @@
 import type { AgentLoopConfig } from "../agent/loop.js";
 import { AgentLoop } from "../agent/loop.js";
 import type { AssistantActivityStateEvent } from "../api/events/assistant-activity-state.js";
+import { decideGuardianRequest } from "../channels/gateway-guardian-requests.js";
 import type {
   ChannelId,
   InterfaceId,
@@ -33,7 +34,6 @@ import {
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite, Speed } from "../config/schemas/llm.js";
-import { resolveCanonicalGuardianRequest } from "../contacts/canonical-guardian-store.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { UserDecision } from "../permissions/types.js";
@@ -88,7 +88,7 @@ import {
   isActivationMomentParam,
 } from "../telemetry/activation-funnel.js";
 import { ToolExecutor } from "../tools/executor.js";
-import { getAllToolDefinitions, getTool } from "../tools/registry.js";
+import { getAllToolDefinitions } from "../tools/registry.js";
 import type { OnboardingContext } from "../types/onboarding-context.js";
 import type { AbortReason } from "../util/abort-reasons.js";
 import { UserError } from "../util/errors.js";
@@ -184,9 +184,13 @@ const log = getLogger("conversation");
  * no text block. Used to verify the row→history boundary mapping in
  * {@link Conversation.summarizeUpToMessage}.
  */
-function firstPersistedTextBlockText(content: string): string | null {
+function firstPersistedTextBlockText(
+  content: string | ContentBlock[],
+): string | null {
   try {
-    const parsed: unknown = JSON.parse(content);
+    const parsed: unknown = Array.isArray(content)
+      ? content
+      : JSON.parse(content);
     if (Array.isArray(parsed)) {
       const block = parsed.find(
         (b): b is { type: "text"; text: string } =>
@@ -200,7 +204,7 @@ function firstPersistedTextBlockText(content: string): string | null {
   } catch {
     // Non-JSON content loads as a raw text block.
   }
-  return content;
+  return Array.isArray(content) ? null : content;
 }
 
 export interface CleanResult {
@@ -301,10 +305,12 @@ export class Conversation {
    * kept for read-only inventory queries. Unlike {@link allowedToolNames}
    * — the per-turn execution gate the agent loop clears at turn teardown —
    * this survives between turns so a query against an idle conversation
-   * still reports the skill/MCP tools it gained over its lifecycle.
+   * still reports the skill/MCP tools it gained over its lifecycle. Seeded in
+   * the constructor from the initial tool snapshot and overwritten by the
+   * `resolveTools` callback each turn.
    * @internal
    */
-  lastResolvedToolNames?: Set<string>;
+  registeredToolDefinitions: ToolDefinition[];
   /** @internal */ diskPressureCleanupModeActive?: boolean;
   /** @internal */ toolsDisabledDepth = 0;
   /** @internal */ preactivatedSkillIds?: string[];
@@ -324,7 +330,6 @@ export class Conversation {
    * @internal
    */
   toolContextPin?: WakeToolContextPin;
-  /** @internal */ coreToolNames: Set<string>;
   /** @internal */ readonly skillProjectionState = new Map<string, string>();
   /** @internal */ readonly skillProjectionCache: SkillProjectionCache = {};
   /** @internal */ usageStats: UsageStats = {
@@ -712,7 +717,7 @@ export class Conversation {
     this.executor = new ToolExecutor(this.prompter);
 
     const toolDefs = getAllToolDefinitions();
-    this.coreToolNames = new Set(toolDefs.map((d) => d.name));
+    this.registeredToolDefinitions = toolDefs;
     const toolExecutor = createToolExecutor(
       this.executor,
       this.prompter,
@@ -1037,19 +1042,7 @@ export class Conversation {
     const parsedMessages: Message[] = slicedDbMessages.map((m, index, arr) => {
       const isPreStripped = index < preStrippedCount;
       const role = m.role as "user" | "assistant";
-      let content: ContentBlock[];
-      try {
-        const parsed = JSON.parse(m.content);
-        content = Array.isArray(parsed)
-          ? parsed
-          : [{ type: "text", text: m.content }];
-      } catch {
-        log.warn(
-          { conversationId: this.conversationId, messageId: m.id },
-          "Invalid JSON in persisted message content, replacing with safe text block",
-        );
-        content = [{ type: "text", text: m.content }];
-      }
+      let content: ContentBlock[] = m.content;
 
       content = reinjectAttachmentPathAnnotations(content, role, m.metadata);
 
@@ -1731,17 +1724,22 @@ export class Conversation {
       statusText: "Resuming after approval",
     });
 
-    // Sync the canonical guardian request status so stale "pending" DB
-    // records don't get matched by later guardian reply routing. Best-effort:
-    // CAS may harmlessly fail if the canonical decision primitive already
-    // resolved the request (e.g. channel approval path).
-    try {
-      resolveCanonicalGuardianRequest(requestId, "pending", {
-        status: resolvedState,
-      });
-    } catch {
-      // Canonical request tracking should not break the primary approval flow.
-    }
+    // Sync the gateway request status so stale "pending" records don't get
+    // matched by later guardian reply routing. Fire-and-forget: this method
+    // is sync with many callers (HTTP handlers, /v1/confirm, channel
+    // bridges), the in-memory resolution above is authoritative, and a CAS
+    // miss (the decision primitive already resolved it, e.g. the channel
+    // approval path) is expected and harmless.
+    void decideGuardianRequest({
+      id: requestId,
+      expectedStatus: "pending",
+      status: resolvedState,
+    }).catch((err) => {
+      log.warn(
+        { err, requestId },
+        "Post-confirmation guardian request status sync failed",
+      );
+    });
   }
 
   handleSecretResponse(
@@ -2288,8 +2286,8 @@ export class Conversation {
   }
 
   /**
-   * Implements the `transportInterface` field of `SkillProjectionContext` so
-   * that `isToolActiveForContext` can gate host tools by per-capability
+   * The `transportInterface` the tool resolver reads so
+   * `isToolActiveForContext` can gate host tools by per-capability
    * `supportsHostProxy(transport, capability)`. Derived from the live turn
    * interface context so it tracks the connected client across turns.
    */
@@ -2362,38 +2360,9 @@ export class Conversation {
 
   // ── Tools ────────────────────────────────────────────────────────
 
-  /**
-   * The set of tool names available to this conversation as of its most
-   * recent turn — including skill/MCP tools registered over the
-   * conversation's lifecycle. Reads the durable {@link lastResolvedToolNames}
-   * snapshot the `resolveTools` callback records each turn (which, unlike the
-   * per-turn `allowedToolNames` gate, is not cleared at turn teardown); before
-   * the first turn it falls back to the core tool set. This is a pure read: it
-   * does not re-run `resolveTools`, which has registry/projection side effects
-   * that must not fire outside a turn.
-   */
-  getRegisteredToolNames(): Set<string> {
-    return new Set(this.lastResolvedToolNames ?? this.coreToolNames);
-  }
-
-  /**
-   * The {@link getRegisteredToolNames} inventory resolved to full definitions
-   * (name, description, input schema), sorted by name. Resolution reads the
-   * live registry so skill/MCP tools — whose definitions are not in the base
-   * turn snapshot — are included. Consumers (e.g. turn-trace telemetry) read
-   * this instead of reaching into the tool registry themselves.
-   */
+  /** The tool inventory resolved on this conversation's most recent turn. */
   getRegisteredToolDefinitions(): ToolDefinition[] {
-    return Array.from(this.getRegisteredToolNames())
-      .sort((a, b) => a.localeCompare(b))
-      .map((name) => {
-        const tool = getTool(name);
-        return {
-          name,
-          description: tool?.description ?? "",
-          input_schema: tool?.input_schema ?? {},
-        };
-      });
+    return this.registeredToolDefinitions;
   }
 
   // ── History ──────────────────────────────────────────────────────

package/src/daemon/event-loop-watchdog.test.ts

@@ -7,12 +7,7 @@
  * - `start`/`stop` must be idempotent and safe to call in any order so daemon
  *   startup and the two shutdown paths can call them unconditionally.
  */
-import { describe, expect, mock, test } from "bun:test";
-
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
-}));
+import { describe, expect, test } from "bun:test";
 
 const { evaluateTick, startEventLoopWatchdog, stopEventLoopWatchdog } =
   await import("./event-loop-watchdog.js");

package/src/daemon/external-plugins-bootstrap.ts

@@ -20,17 +20,16 @@
  *    {@link InitContext.pluginStorageDir}. For user plugins this is
  *    `<pluginDir>/data/`; for default plugins it is
  *    `<workspaceDir>/plugins-data/<plugin>/`.
- * 5. For each surviving plugin, registers its contributed tools and routes
- *    into their global registries via {@link registerPluginTools} and
- *    {@link registerSkillRoute}. Contributions land BEFORE `init()` so
- *    the plugin's hook can observe a registry where its own model-visible
- *    surface is already wired — useful for plugins that want to attach
- *    metadata, warm caches, or otherwise interact with their own
+ * 5. For each surviving plugin, registers its contributed tools into the
+ *    global tool registry via {@link registerPluginTools}. Contributions land
+ *    BEFORE `init()` so the plugin's hook can observe a registry where its own
+ *    model-visible surface is already wired — useful for plugins that want to
+ *    attach metadata, warm caches, or otherwise interact with their own
  *    contributions during initialization.
  * 6. Awaits `plugin.init(ctx)` sequentially. An init failure is contained to
- *    the offending plugin: its already-registered tools and routes are rolled
- *    back, it is dropped from the registry, the failure is logged, and
- *    bootstrap continues with the remaining plugins. A single plugin's failure
+ *    the offending plugin: its already-registered tools are rolled back, it is
+ *    dropped from the registry, the failure is logged, and bootstrap continues
+ *    with the remaining plugins. A single plugin's failure
  *    never deregisters plugins that already initialized — in particular the
  *    first-party defaults, which carry core turn behavior (memory retrieval,
  *    history repair, title generation) — so the daemon comes up with the
@@ -39,8 +38,8 @@
  * Plugin `shutdown` hooks fire through the unified `runHook(HOOKS.SHUTDOWN, …)`
  * pipeline that the daemon shutdown handler runs — the same path every other
  * lifecycle hook uses; this module does not register a shutdown hook of its own.
- * Surfaces (tools/routes/injectors) are not unregistered at daemon shutdown:
- * the process is exiting, so that in-memory registry state is discarded anyway.
+ * Surfaces (tools/injectors) are not unregistered at daemon shutdown: the
+ * process is exiting, so that in-memory registry state is discarded anyway.
  * Surfaces are only torn down when a single plugin is rolled back after a failed
  * bring-up, via {@link teardownPlugin}.
  */
@@ -67,11 +66,6 @@ import {
   type ShutdownContext,
 } from "../plugins/types.js";
 import { loadUserPlugins } from "../plugins/user-loader.js";
-import {
-  registerSkillRoute,
-  type SkillRouteHandle,
-  unregisterSkillRoute,
-} from "../runtime/skill-route-registry.js";
 import {
   registerPluginTools,
   unregisterPluginTools,
@@ -249,7 +243,7 @@ export async function bootstrapPlugins(): Promise<void> {
       await initializePlugin(plugin, assistantConfig);
     } catch (err) {
       // Contain the failure to this plugin. `initializePlugin` already rolled
-      // back its own partial tool/route contributions, so we just drop
+      // back its own partial tool contributions, so we just drop
       // its hooks from the hook registry and move on. A single plugin's init
       // failure must never deregister the plugins that already came up —
       // above all the first-party defaults, which carry core turn behavior.
@@ -264,23 +258,11 @@ export async function bootstrapPlugins(): Promise<void> {
   }
 }
 
-/**
- * One plugin that made it through the full init + contribution phase. Holds
- * every opaque {@link SkillRouteHandle} issued by `registerSkillRoute` so
- * teardown can revoke exactly the routes this plugin contributed, even when
- * the regex pattern text collides with another owner's registration.
- */
-interface ActivePlugin {
-  readonly plugin: Plugin;
-  readonly routeHandles: readonly SkillRouteHandle[];
-}
-
 async function initializePlugin(
   plugin: Plugin,
   assistantConfig: AssistantConfig,
-): Promise<ActivePlugin> {
+): Promise<void> {
   const name = plugin.manifest.name;
-  const routeHandles: SkillRouteHandle[] = [];
   let initCompleted = false;
 
   try {
@@ -315,16 +297,6 @@ async function initializePlugin(
       }
     }
 
-    if (plugin.routes && plugin.routes.length > 0) {
-      for (const route of plugin.routes) {
-        routeHandles.push(registerSkillRoute(route));
-      }
-      log.info(
-        { plugin: name, count: plugin.routes.length },
-        "plugin routes registered",
-      );
-    }
-
     if (plugin.injectors && plugin.injectors.length > 0) {
       registerPluginInjectors(name, plugin.injectors);
       log.info(
@@ -349,17 +321,13 @@ async function initializePlugin(
     initCompleted = true;
 
     log.info({ plugin: name }, "plugin initialized");
-    return { plugin, routeHandles };
   } catch (err) {
     if (initCompleted) {
-      await teardownPlugin(
-        { plugin, routeHandles },
-        { assistantVersion: APP_VERSION, reason: "disable" },
-      );
+      await teardownPlugin(plugin, {
+        assistantVersion: APP_VERSION,
+        reason: "disable",
+      });
     } else {
-      for (const handle of routeHandles) {
-        unregisterSkillRoute(handle);
-      }
       unregisterPluginTools(name);
       unregisterPluginInjectors(name);
     }
@@ -367,21 +335,11 @@ async function initializePlugin(
   }
 }
 
-/**
- * Unregister every initialized plugin's contributed routes and tools in reverse
- * registration order, clearing the model-visible surface before the shutdown
- * handler dispatches `shutdown` hooks via `runHook(HOOKS.SHUTDOWN, …)`. Reads
- * the snapshot captured by the most recent {@link bootstrapPlugins} run; a
- * no-op when no plugins initialized. Called by the daemon shutdown handler.
- */
 /**
  * Tear down a single fully-initialized plugin: unregister its model-visible
- * surfaces (contributed HTTP routes — keyed by the opaque handles retained at
- * registration time, since pattern text is not a stable key when two owners
- * register the same regex — plus its tools and runtime injectors), then invoke
- * its optional `shutdown` hook with the tools/routes already gone. Every step
- * swallows errors and logs with plugin attribution so one bad plugin can't
- * block teardown.
+ * surfaces (its tools and runtime injectors), then invoke its optional
+ * `shutdown` hook with those surfaces already gone. Every step swallows errors
+ * and logs with plugin attribution so one bad plugin can't block teardown.
  *
  * Used by the bootstrap-failure rollback path. The normal daemon shutdown path
  * does not unregister surfaces (the process is exiting, so that in-memory state
@@ -389,24 +347,12 @@ async function initializePlugin(
  * `runHook(HOOKS.SHUTDOWN, …)` pipeline.
  */
 async function teardownPlugin(
-  active: ActivePlugin,
+  plugin: Plugin,
   shutdownContext: ShutdownContext,
 ): Promise<void> {
-  const { plugin, routeHandles } = active;
   const name = plugin.manifest.name;
   const { reason } = shutdownContext;
 
-  for (const handle of routeHandles) {
-    try {
-      unregisterSkillRoute(handle);
-    } catch (err) {
-      log.warn(
-        { err, plugin: name },
-        "plugin route unregister failed (continuing)",
-      );
-    }
-  }
-
   try {
     unregisterPluginTools(name);
   } catch (err) {

package/src/daemon/handlers/__tests__/config-a2a-accept.test.ts

@@ -8,13 +8,6 @@
 
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 import {
   invalidateConfigCache,
   loadRawConfig,