@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/platform/consent-cache.test.ts

@@ -34,9 +34,9 @@ import {
   __setCachedShareAnalyticsForTest,
   __setCachedShareDiagnosticsForTest,
   __setCachedShareDiagnosticsVersionForTest,
-  getCachedShareAnalytics,
   getCachedShareDiagnostics,
   getCachedShareDiagnosticsVersion,
+  getRawShareAnalytics,
   refreshConsentCache,
   startConsentRefresh,
   stopConsentRefresh,
@@ -69,8 +69,9 @@ describe("consent-cache", () => {
     // Legacy fail-closed opt-out marker read via getConfigReadOnly(). Default
     // off so existing behavior is unchanged.
     setConfig("legacyTelemetryOptOut", false);
-    __setCachedShareAnalyticsForTest(false);
-    __setCachedShareDiagnosticsForTest(false);
+    // Boot state: no confirmed consent yet.
+    __setCachedShareAnalyticsForTest("unknown");
+    __setCachedShareDiagnosticsForTest("unknown");
     __setCachedShareDiagnosticsVersionForTest("");
   });
 
@@ -78,63 +79,107 @@ describe("consent-cache", () => {
     await stopConsentRefresh();
   });
 
-  test("defaults to false before any refresh", () => {
-    expect(getCachedShareAnalytics()).toBe(false);
+  test("boot state is unknown", () => {
+    expect(getRawShareAnalytics()).toBe("unknown");
   });
 
-  test("stays false when no platform client is available", async () => {
+  test("no platform client available → unknown", async () => {
     mockClient = null;
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(false);
+    expect(getRawShareAnalytics()).toBe("unknown");
+  });
+
+  test("platform features disabled → confirmed false, not unknown", async () => {
+    // A config-level platform opt-out is permanent, not a cold cache: no
+    // flush will ever drain the outbox, so record-time gates must stay
+    // closed (confirmed false) instead of accumulating rows forever.
+    __setCachedShareAnalyticsForTest(true);
+    process.env.VELLUM_DISABLE_PLATFORM = "1";
+    try {
+      await refreshConsentCache();
+    } finally {
+      delete process.env.VELLUM_DISABLE_PLATFORM;
+    }
+    expect(getRawShareAnalytics()).toBe(false);
+    expect(getCachedShareDiagnostics()).toBe(false);
+    expect(getCachedShareDiagnosticsVersion()).toBe("");
   });
 
   test("becomes true after a successful fetch reporting shareAnalytics: true", async () => {
     mockClient = makeClient(makeConsent({ shareAnalytics: true }));
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(true);
+    expect(getRawShareAnalytics()).toBe(true);
   });
 
   test("a null fetch keeps the last known value", async () => {
     mockClient = makeClient(makeConsent({ shareAnalytics: true }));
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(true);
+    expect(getRawShareAnalytics()).toBe(true);
 
     // Transient failure: consent endpoint returns null.
     mockClient = makeClient(null);
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(true);
+    expect(getRawShareAnalytics()).toBe(true);
   });
 
-  test("a missing client flips a prior opt-in back to false", async () => {
+  test("a null fetch keeps a confirmed opt-out", async () => {
+    mockClient = makeClient(makeConsent({ shareAnalytics: false }));
+    await refreshConsentCache();
+    expect(getRawShareAnalytics()).toBe(false);
+
+    mockClient = makeClient(null);
+    await refreshConsentCache();
+    expect(getRawShareAnalytics()).toBe(false);
+  });
+
+  test("a null fetch keeps the boot unknown state", async () => {
+    mockClient = makeClient(null);
+    await refreshConsentCache();
+    expect(getRawShareAnalytics()).toBe("unknown");
+    expect(getCachedShareDiagnostics()).toBe(false);
+  });
+
+  test("a missing client demotes a prior opt-in to unknown", async () => {
     __setCachedShareAnalyticsForTest(true);
     mockClient = null;
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(false);
+    expect(getRawShareAnalytics()).toBe("unknown");
   });
 
-  test("a client without a resolvable assistant identity fails closed", async () => {
+  test("a client without a resolvable assistant identity demotes to unknown", async () => {
     __setCachedShareAnalyticsForTest(true);
     // Identity cleared mid-session (e.g. assistantId emptied while base URL +
     // API key persist). getOwnerConsent must not be relied upon to preserve the
-    // prior opt-in here — fail closed instead.
+    // prior opt-in here — losing the owner mapping is not an opt-out, but the
+    // stale opt-in must not keep riding either.
     mockClient = makeClient(makeConsent({ shareAnalytics: true }), "");
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(false);
+    expect(getRawShareAnalytics()).toBe("unknown");
+  });
+
+  test("legacy opt-out marker is honored at boot, before any refresh", () => {
+    // The marker is read live from config: a workspace carrying
+    // legacyTelemetryOptOut=true must gate recording in the window between
+    // daemon start and the first consent refresh (unknown-consent recording
+    // would otherwise leak events in that window).
+    setConfig("legacyTelemetryOptOut", true);
+    expect(getRawShareAnalytics()).toBe(false);
   });
 
   test("legacy opt-out marker keeps analytics off despite platform opt-in", async () => {
     setConfig("legacyTelemetryOptOut", true);
     mockClient = makeClient(makeConsent({ shareAnalytics: true }));
     await refreshConsentCache();
-    // Platform reports opt-in, but the fail-closed marker forces off.
-    expect(getCachedShareAnalytics()).toBe(false);
+    // Platform reports opt-in, but the fail-closed marker forces off. The raw
+    // accessor folds the marker into a confirmed false, not an unknown.
+    expect(getRawShareAnalytics()).toBe(false);
   });
 
   test("a fetch reporting shareAnalytics: false turns the cache off", async () => {
     __setCachedShareAnalyticsForTest(true);
     mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
     await refreshConsentCache();
-    expect(getCachedShareAnalytics()).toBe(false);
+    expect(getRawShareAnalytics()).toBe(false);
   });
 
   test("startConsentRefresh is idempotent and runs an immediate refresh", async () => {
@@ -145,7 +190,7 @@ describe("consent-cache", () => {
     // Let the fire-and-forget immediate refresh settle.
     await new Promise((resolve) => setTimeout(resolve, 0));
 
-    expect(getCachedShareAnalytics()).toBe(true);
+    expect(getRawShareAnalytics()).toBe(true);
     // One immediate refresh from the first call; the second is a no-op.
     expect(createCallCount).toBe(1);
   });
@@ -157,12 +202,12 @@ describe("consent-cache", () => {
     mockClient = makeClient(makeConsent({ shareAnalytics: true }));
     startConsentRefresh();
     await new Promise((resolve) => setTimeout(resolve, 0));
-    expect(getCachedShareAnalytics()).toBe(true);
+    expect(getRawShareAnalytics()).toBe(true);
   });
 
   // share_diagnostics tracks the same refresh as share_analytics; Sentry's
   // beforeSend re-reads it per event so a revocation is honored within a cycle.
-  test("diagnostics defaults to false before any refresh", () => {
+  test("diagnostics reads false at boot (unknown collapses to false)", () => {
     expect(getCachedShareDiagnostics()).toBe(false);
   });
 
@@ -192,14 +237,14 @@ describe("consent-cache", () => {
     expect(getCachedShareDiagnostics()).toBe(true);
   });
 
-  test("a missing client flips a prior diagnostics opt-in back to false", async () => {
+  test("a missing client demotes a prior diagnostics opt-in", async () => {
     __setCachedShareDiagnosticsForTest(true);
     mockClient = null;
     await refreshConsentCache();
     expect(getCachedShareDiagnostics()).toBe(false);
   });
 
-  test("a client without a resolvable assistant identity fails diagnostics closed", async () => {
+  test("a client without a resolvable assistant identity demotes diagnostics", async () => {
     __setCachedShareDiagnosticsForTest(true);
     mockClient = makeClient(makeConsent({ shareDiagnostics: true }), "");
     await refreshConsentCache();
@@ -251,4 +296,25 @@ describe("consent-cache", () => {
     await refreshConsentCache();
     expect(getCachedShareDiagnosticsVersion()).toBe("2026-06-18");
   });
+
+  test("diagnostics accessor collapses unknown to false; raw analytics exposes the tri-state", async () => {
+    // Refresh once so the module's legacy opt-out marker reflects the
+    // beforeEach config (the marker is only re-read during a refresh).
+    mockClient = null;
+    await refreshConsentCache();
+
+    for (const state of [true, false, "unknown"] as const) {
+      __setCachedShareAnalyticsForTest(state);
+      __setCachedShareDiagnosticsForTest(state);
+      expect(getRawShareAnalytics()).toBe(state);
+      expect(getCachedShareDiagnostics()).toBe(state === true);
+    }
+  });
+
+  test("legacy opt-out marker folds the raw analytics state to false", async () => {
+    setConfig("legacyTelemetryOptOut", true);
+    mockClient = null;
+    await refreshConsentCache();
+    expect(getRawShareAnalytics()).toBe(false);
+  });
 });

package/src/platform/consent-cache.ts

@@ -14,48 +14,73 @@
  * synchronous, I/O-free read, so this module owns the values and refreshes them
  * periodically in the background. Consent is opt-out — an owner who never made
  * an explicit choice reports as consented (the client maps a never-chose wire
- * value to `true`) — but UNKNOWN consent stays off: an absent session, a
- * disabled platform, or a transient fetch failure all leave the values
- * untouched (initial `false`), so we never report analytics or send crash
- * diagnostics without a confirmed consent state.
+ * value to `true`).
+ *
+ * The consent values are tri-state (`ConsentState`): `true`/`false` are
+ * confirmed states from a successful platform fetch; `"unknown"` means no
+ * confirmed state exists — boot before the first refresh, no platform session,
+ * or no resolvable owner identity. A transient fetch failure keeps the
+ * previous value so a known opt-in is not flipped mid-session. Analytics
+ * exposes only the raw tri-state accessor (gates drop solely on a confirmed
+ * opt-out); the diagnostics boolean accessors collapse `"unknown"` to `false`
+ * — diagnostics gates are deliberately fail-closed, so no raw diagnostics
+ * accessor exists.
  */
 
 import { getConfigReadOnly } from "../config/loader.js";
 import { getLogger } from "../util/logger.js";
 import { VellumPlatformClient } from "./client.js";
+import { arePlatformFeaturesEnabled } from "./feature-gate.js";
 
 const log = getLogger("consent-cache");
 
 const REFRESH_INTERVAL_MS = 5 * 60_000; // refresh consent every 5 min
 
-let cachedShareAnalytics = false; // default-off until first success
-let cachedShareDiagnostics = false; // default-off until first success
+/** Cached consent value: a confirmed boolean, or `"unknown"` when no confirmed state exists. */
+export type ConsentState = boolean | "unknown";
+
+let cachedShareAnalytics: ConsentState = "unknown"; // no confirmed state until first success
+let cachedShareDiagnostics: ConsentState = "unknown"; // no confirmed state until first success
 let cachedShareDiagnosticsVersion = ""; // "" fails the trace disclosure gate
 // Fail-closed marker for a workspace that locally opted out of usage data
 // before telemetry moved to platform `share_analytics` consent (migration 106).
 // While set, telemetry stays off regardless of platform consent. Cleared by a
 // future cross-repo reconciliation once the platform exposes an explicit
-// re-consent signal; not auto-cleared here.
-let legacyOptOut = false;
+// re-consent signal; not auto-cleared here. Read live from config (an
+// in-memory cached read, safe on the hot path): a boot-time default would
+// leave the record-time gates open between daemon start and the first
+// consent refresh, exactly the window unknown-consent recording now keeps
+// events flowing in.
+function isLegacyOptedOut(): boolean {
+  try {
+    return getConfigReadOnly().legacyTelemetryOptOut === true;
+  } catch {
+    // Config not yet loaded — no marker to honor yet.
+    return false;
+  }
+}
 let refreshTimer: ReturnType<typeof setInterval> | null = null;
 
 /**
- * Synchronous hot-path accessor for the effective `share_analytics` consent.
- * Never does I/O; returns `false` until a successful refresh proves otherwise,
- * and stays `false` while the legacy fail-closed opt-out marker is set.
+ * Raw tri-state `share_analytics` consent — the ONLY analytics accessor:
+ * every gate distinguishes a confirmed opt-out (`false`, the only state that
+ * drops or purges) from a not-yet-known one. The legacy fail-closed opt-out
+ * marker folds into `false` — a workspace-level opt-out is a confirmed
+ * opt-out, not an unknown. Never does I/O; hot-path safe.
  */
-export function getCachedShareAnalytics(): boolean {
-  return cachedShareAnalytics && !legacyOptOut;
+export function getRawShareAnalytics(): ConsentState {
+  return isLegacyOptedOut() ? false : cachedShareAnalytics;
 }
 
 /**
  * Synchronous hot-path accessor for the `share_diagnostics` consent (read by
- * Sentry `beforeSend`). Never does I/O; returns `false` until a successful
- * refresh proves otherwise. Because every Sentry event re-reads this, a
- * mid-session opt-out is honored within one refresh cycle.
+ * Sentry `beforeSend`). Never does I/O; returns `false` unless a successful
+ * refresh confirmed an opt-in (`"unknown"` reads as `false`). Because every
+ * Sentry event re-reads this, a mid-session opt-out is honored within one
+ * refresh cycle.
  */
 export function getCachedShareDiagnostics(): boolean {
-  return cachedShareDiagnostics;
+  return cachedShareDiagnostics === true;
 }
 
 /**
@@ -70,28 +95,35 @@ export function getCachedShareDiagnosticsVersion(): string {
 /**
  * Refresh the cached consent from the platform.
  *
- * No platform session / features disabled (`create()` is null) → default-off.
+ * No platform session / features disabled (`create()` is null) → `"unknown"`.
  * No resolvable assistant identity (no owner whose consent we can attest to) →
- * fail closed. A successful fetch adopts the reported values. A `null` fetch
- * (transient failure / undeployed endpoint) leaves the previous values
- * unchanged so a known opt-in is not flipped off mid-session.
+ * `"unknown"` — losing the owner mapping is not an opt-out, but it also isn't
+ * a confirmed opt-in, so we stop riding a stale one. A successful fetch adopts
+ * the reported values. A `null` fetch (transient failure / undeployed
+ * endpoint) leaves the previous values unchanged so a known opt-in is not
+ * flipped off mid-session.
  */
 export async function refreshConsentCache(): Promise<void> {
-  legacyOptOut = getConfigReadOnly().legacyTelemetryOptOut === true;
-
-  const client = await VellumPlatformClient.create();
-  if (!client) {
+  // Platform features disabled is a PERMANENT condition (config-level), not a
+  // cold-cache transient: telemetry can never ship, so confirmed-off keeps the
+  // record-time gates closed and the outbox from accumulating rows that no
+  // flush will ever drain.
+  if (!arePlatformFeaturesEnabled()) {
     setCachedShareAnalytics(false);
     setCachedShareDiagnostics(false);
     setCachedShareDiagnosticsVersion("");
     return;
   }
 
-  // No resolvable owner identity → fail closed (don't ride a stale opt-in).
+  const client = await VellumPlatformClient.create();
+  if (!client) {
+    resetConsentToUnknown();
+    return;
+  }
+
+  // No resolvable owner identity → unknown (don't ride a stale opt-in).
   if (!client.platformAssistantId) {
-    setCachedShareAnalytics(false);
-    setCachedShareDiagnostics(false);
-    setCachedShareDiagnosticsVersion("");
+    resetConsentToUnknown();
     return;
   }
 
@@ -103,7 +135,13 @@ export async function refreshConsentCache(): Promise<void> {
   }
 }
 
-function setCachedShareAnalytics(value: boolean): void {
+function resetConsentToUnknown(): void {
+  setCachedShareAnalytics("unknown");
+  setCachedShareDiagnostics("unknown");
+  setCachedShareDiagnosticsVersion("");
+}
+
+function setCachedShareAnalytics(value: ConsentState): void {
   if (value !== cachedShareAnalytics) {
     log.debug(
       { from: cachedShareAnalytics, to: value },
@@ -113,7 +151,7 @@ function setCachedShareAnalytics(value: boolean): void {
   }
 }
 
-function setCachedShareDiagnostics(value: boolean): void {
+function setCachedShareDiagnostics(value: ConsentState): void {
   if (value !== cachedShareDiagnostics) {
     log.debug(
       { from: cachedShareDiagnostics, to: value },
@@ -161,12 +199,12 @@ export async function stopConsentRefresh(): Promise<void> {
 }
 
 /** Test-only: override the cached analytics value without going through a refresh. */
-export function __setCachedShareAnalyticsForTest(value: boolean): void {
+export function __setCachedShareAnalyticsForTest(value: ConsentState): void {
   cachedShareAnalytics = value;
 }
 
 /** Test-only: override the cached diagnostics value without going through a refresh. */
-export function __setCachedShareDiagnosticsForTest(value: boolean): void {
+export function __setCachedShareDiagnosticsForTest(value: ConsentState): void {
   cachedShareDiagnostics = value;
 }
 

package/src/plugin-api/constants.ts

@@ -36,3 +36,15 @@ export const HOOKS = {
 
 /** Union of every hook name declared in {@link HOOKS}. */
 export type HookName = (typeof HOOKS)[keyof typeof HOOKS];
+
+/**
+ * Appended (inside the `<system_notice>` wrapper) to the internal continuation /
+ * completion nudge strings that re-query the model. Those notices are injected
+ * as user-role turns; weaker models without a separate reasoning channel
+ * otherwise narrate or answer the notice as visible text, leaking agent-loop
+ * scaffolding into the user-facing reply. This clause forbids that narration
+ * without licensing an empty reply — each nudge's own instruction still drives
+ * the expected output (summary / final reply / continuation).
+ */
+export const INTERNAL_NUDGE_OUTPUT_SUPPRESSION =
+  " This notice is internal: do not repeat, quote, describe, or acknowledge it, and do not narrate whether you will continue or whether the turn is done. Reply with only the content the user should see.";

package/src/plugin-api/conversation-turn.ts

@@ -45,6 +45,15 @@ export interface RunConversationTurnOptions {
    * controller fires, terminating the in-flight agent loop.
    */
   signal?: AbortSignal;
+  /**
+   * Conversation type for newly created conversations. When omitted,
+   * defaults to `"standard"` (visible in the sidebar). Set to
+   * `"background"` for plugin-driven conversations that should not
+   * appear in the sidebar's Recents grouping.
+   *
+   * Ignored when `conversationId` references an existing conversation.
+   */
+  conversationType?: "standard" | "background";
 }
 
 export interface RunConversationTurnResult {
@@ -71,7 +80,9 @@ export interface RunConversationTurnResult {
  */
 function extractContentAndAttachments(
   blocks: ContentBlock[],
-  resolveMedia: (source: MediaSource) => { data: string; media_type: string } | null,
+  resolveMedia: (
+    source: MediaSource,
+  ) => { data: string; media_type: string } | null,
 ): { text: string; attachments: UserMessageAttachment[] } {
   const textParts: string[] = [];
   const attachments: UserMessageAttachment[] = [];
@@ -126,21 +137,33 @@ export async function runConversationTurn(
   options: RunConversationTurnOptions,
 ): Promise<RunConversationTurnResult> {
   const { v7: uuidv7 } = await import("uuid");
-  const { getOrCreateConversation } = await import(
-    "../daemon/conversation-store.js"
-  );
-  const { broadcastMessage } = await import(
-    "../runtime/assistant-event-hub.js"
-  );
-  const { resolveMediaSourceData } = await import(
-    "../providers/media-resolve.js"
-  );
-  const { getMessageById, getMessages } = await import(
-    "../persistence/conversation-crud.js"
-  );
+  const { getOrCreateConversation } =
+    await import("../daemon/conversation-store.js");
+  const { broadcastMessage } =
+    await import("../runtime/assistant-event-hub.js");
+  const { resolveMediaSourceData } =
+    await import("../providers/media-resolve.js");
+  const { getConversation, getMessageById, getMessages } =
+      await import("../persistence/conversation-crud.js");
+  const { publishConversationListAndMetadataChanged } =
+      await import("../runtime/sync/resource-sync-events.js");
 
   const conversationId = options.conversationId ?? uuidv7();
-  const conversation = await getOrCreateConversation(conversationId);
+  const rowExisted = getConversation(conversationId) != null;
+  const conversation = await getOrCreateConversation(conversationId, {
+    ...(options.conversationType
+      ? { conversationType: options.conversationType }
+      : {}),
+  });
+
+  // `getOrCreateConversation` creates the DB row (with conversationType if
+  // provided) before hydrating. The normal send-message route emits a
+  // "created" list invalidation so sibling clients/sidebars learn about new
+  // conversations — emit it here too, but only when the row is actually new
+  // so we don't spam invalidations for existing conversations.
+  if (!rowExisted) {
+    publishConversationListAndMetadataChanged("created", conversationId);
+  }
 
   // Wire the external abort signal to the conversation's internal abort
   // controller so aborting the signal terminates the in-flight agent loop.

package/src/plugin-api/index.ts

@@ -67,7 +67,7 @@
  */
 
 export type { HookName } from "./constants.js";
-export { HOOKS } from "./constants.js";
+export { HOOKS, INTERNAL_NUDGE_OUTPUT_SUPPRESSION } from "./constants.js";
 // Conversation message/content shapes. A hook receives the live message
 // history (e.g. `PostToolUseContext.latestMessages: Message[]`), so plugins
 // that inspect or narrow content blocks — reading a `tool_use` block's input,
@@ -150,6 +150,16 @@ export { getModelProfiles } from "./model-profiles.js";
 // looks up the model catalog's `supportsVision` flag (mix profiles are
 // vision-capable if any arm is). Returns false when nothing resolves.
 export { doesSupportVision } from "./vision-support.js";
+// Resolve a stored credential to its plaintext value — the same value
+// `assistant credentials reveal` prints — from a UUID or a "service/field"
+// reference. When a plugin is in context, resolution is scoped to credentials
+// whose `field` matches the plugin's manifest name; outside any plugin it is
+// unscoped. Throws CredentialResolutionError when the ref does not resolve, the
+// store is unreachable, or the credential is out of the plugin's scope.
+export {
+  CredentialResolutionError,
+  resolveCredential,
+} from "./resolve-credential.js";
 // Resolve a provider for a call site (optionally overriding the profile) so a
 // plugin can run inference through the workspace's configured profiles and
 // credentials — managed-proxy or BYOK — without supplying its own API key.

package/src/plugin-api/resolve-credential.ts

@@ -0,0 +1,75 @@
+/**
+ * Plugin-facing credential resolution.
+ *
+ * {@link resolveCredential} returns a stored credential's plaintext value — the
+ * same value `assistant credentials reveal` prints — resolving a reference that
+ * is either a credential UUID or a `"service/field"` string, exactly as the
+ * reveal path does (see {@link ../tools/credentials/resolve.resolveCredentialRef}
+ * and the `credentials/reveal` route).
+ *
+ * ## Plugin scoping
+ *
+ * When a plugin is in context — its hook or tool is executing, tracked by
+ * {@link ../plugins/plugin-execution-context.getCurrentPluginName} — resolution
+ * is restricted: the plugin may only resolve credentials whose `field` equals
+ * the plugin's own manifest name. A plugin named `acme` can therefore read
+ * `openai/acme` or `stripe/acme` but not `openai/api_key`. Outside any plugin
+ * context (host-internal callers, CLI, tests) the resolver is unscoped and
+ * behaves like a direct reveal.
+ */
+
+import { getCurrentPluginName } from "../plugins/plugin-execution-context.js";
+import { getSecureKeyResultAsync } from "../security/secure-keys.js";
+import { resolveCredentialRef } from "../tools/credentials/resolve.js";
+
+/**
+ * Raised when a credential cannot be resolved: the reference does not match a
+ * stored credential, the store is unreachable, or the calling plugin is not
+ * permitted to resolve the requested credential.
+ */
+export class CredentialResolutionError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "CredentialResolutionError";
+  }
+}
+
+/**
+ * Resolve a credential reference to its plaintext value.
+ *
+ * @param ref A credential UUID or a `"service/field"` string.
+ * @returns The plaintext credential value.
+ * @throws {CredentialResolutionError} when the reference does not resolve, the
+ *   store is unreachable, or a plugin in context is not scoped to the credential.
+ */
+export async function resolveCredential(ref: string): Promise<string> {
+  const resolved = resolveCredentialRef(ref);
+  if (!resolved) {
+    throw new CredentialResolutionError(`Credential not found: ${ref}`);
+  }
+
+  // Scope the resolution to the plugin in context, if any. The field-name gate
+  // is enforced before the plaintext is read so an out-of-scope plugin never
+  // touches the secure backend.
+  const pluginName = getCurrentPluginName();
+  if (pluginName !== undefined && resolved.field !== pluginName) {
+    throw new CredentialResolutionError(
+      `Plugin "${pluginName}" may only resolve credentials whose field matches its name; ` +
+        `"${resolved.service}/${resolved.field}" is out of scope.`,
+    );
+  }
+
+  const { value, unreachable } = await getSecureKeyResultAsync(
+    resolved.storageKey,
+  );
+  if (value == null || value.length === 0) {
+    if (unreachable) {
+      throw new CredentialResolutionError(
+        "Credential store is unreachable — ensure the assistant is running",
+      );
+    }
+    throw new CredentialResolutionError(`Credential not found: ${ref}`);
+  }
+
+  return value;
+}

package/src/plugin-api/vision-support.test.ts

@@ -14,10 +14,6 @@ interface MockProfileEntry {
 }
 
 let mockProfiles: Record<string, MockProfileEntry> = {};
-let mockDefault: { provider?: string; model?: string } = {
-  provider: "anthropic",
-  model: "claude-opus-4-6",
-};
 
 // Real model catalog — don't mock it, the test exercises real catalog lookups.
 const { doesSupportVision } = await import("./vision-support.js");
@@ -44,21 +40,16 @@ function profile(key: string): ModelProfileInfo {
 function applyConfig(): void {
   setConfig("llm", { profiles: {} });
   const config = getConfig() as { llm: unknown };
-  config.llm = { profiles: mockProfiles, default: mockDefault };
+  config.llm = { profiles: mockProfiles };
 }
 
-function setMockConfig(
-  profiles: Record<string, MockProfileEntry>,
-  def: { provider?: string; model?: string } = {},
-) {
+function setMockConfig(profiles: Record<string, MockProfileEntry>) {
   mockProfiles = profiles;
-  mockDefault = { provider: "anthropic", model: "claude-opus-4-6", ...def };
   applyConfig();
 }
 
 beforeEach(() => {
   mockProfiles = {};
-  mockDefault = { provider: "anthropic", model: "claude-opus-4-6" };
   applyConfig();
 });
 
@@ -94,18 +85,16 @@ describe("doesSupportVision", () => {
     expect(doesSupportVision(profile("unknown-model"))).toBe(false);
   });
 
-  test("inherits provider from llm.default when profile only sets model", () => {
-    setMockConfig(
-      { "model-only": { model: "claude-opus-4-6" } },
-      { provider: "anthropic" },
-    );
+  test("implies the provider from the catalog when profile only sets model", () => {
+    setMockConfig({ "model-only": { model: "claude-opus-4-6" } });
     expect(doesSupportVision(profile("model-only"))).toBe(true);
   });
 
-  test("inherits model from llm.default when profile only sets provider", () => {
-    // llm.default → anthropic/claude-opus-4-6 (vision-capable)
+  test("fails safe to false for a profile without a model", () => {
+    // A model-less entry is not a usable resolution target, so vision
+    // resolution treats it as "can't show images" (caption instead).
     setMockConfig({ "provider-only": { provider: "anthropic" } });
-    expect(doesSupportVision(profile("provider-only"))).toBe(true);
+    expect(doesSupportVision(profile("provider-only"))).toBe(false);
   });
 
   test("mix profile returns true when any arm supports vision", () => {