@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/telemetry/usage-telemetry-reporter.ts

@@ -28,7 +28,7 @@
 
 import { getPlatformOrganizationId, getPlatformUserId } from "../config/env.js";
 import { VellumPlatformClient } from "../platform/client.js";
-import { getCachedShareAnalytics } from "../platform/consent-cache.js";
+import { getRawShareAnalytics } from "../platform/consent-cache.js";
 import { arePlatformFeaturesEnabled } from "../platform/feature-gate.js";
 import { getDeviceId } from "../util/device-id.js";
 import { getLogger } from "../util/logger.js";
@@ -45,6 +45,10 @@ import {
   TOOL_EXECUTED_SOURCE_ID,
   watermarkKeysForSource,
 } from "./telemetry-event-sources.js";
+import {
+  deleteTelemetryOutboxEventsBefore,
+  OUTBOX_MAX_ROW_AGE_MS,
+} from "./telemetry-events-outbox.js";
 import { useReadOnlyMainDbForTelemetry } from "./telemetry-main-db.js";
 import { validateWireEvents } from "./telemetry-wire-validation.js";
 
@@ -65,6 +69,43 @@ const BATCH_SIZE = 500;
 const MAX_CONSECUTIVE_BATCHES = 10;
 const TELEMETRY_PATH = "/v1/telemetry/ingest/";
 
+/**
+ * Outcome of a {@link UsageTelemetryReporter.flush} call. `flushed: true` means
+ * at least one batch reached the platform (2xx). `sent` is the count the daemon
+ * POSTed; `persisted` is the count the platform confirmed written; `dropped` is
+ * `sent - persisted` — folding server-side drops (opt-out, unauthenticated) and
+ * events silently skipped at ingest validation (unknown/invalid type) into one
+ * "did not land" number. `flushed: false` carries a kebab-case skip reason.
+ */
+export type TelemetryFlushSummary =
+  | { flushed: true; sent: number; persisted: number; dropped: number }
+  | { flushed: false; reason: string };
+
+interface FlushAccumulator {
+  sent: number;
+  persisted: number;
+}
+
+/**
+ * Read `persisted` from an ingest response body. Falls back to `fallback`
+ * (the POSTed count — assume all landed) on a malformed body or an older
+ * platform that omits the field. Never throws.
+ */
+function parsePersistedCount(body: string, fallback: number): number {
+  try {
+    const parsed: unknown = JSON.parse(body);
+    if (parsed && typeof parsed === "object") {
+      const p = (parsed as { persisted?: unknown }).persisted;
+      if (typeof p === "number" && Number.isFinite(p) && p >= 0) {
+        return p;
+      }
+    }
+  } catch {
+    // Malformed/empty body — assume everything persisted.
+  }
+  return fallback;
+}
+
 // ---------------------------------------------------------------------------
 // Singleton access
 // ---------------------------------------------------------------------------
@@ -193,7 +234,7 @@ export function initToolExecutedWatermarkIfAbsent(
 export class UsageTelemetryReporter {
   private initialFlushTimer: ReturnType<typeof setTimeout> | null = null;
   private timer: ReturnType<typeof setInterval> | null = null;
-  private activeFlush: Promise<void> | null = null;
+  private activeFlush: Promise<TelemetryFlushSummary> | null = null;
   private readonly sources: readonly TelemetryEventSource[];
   private readonly checkpoints: FlushCheckpointStore;
 
@@ -248,22 +289,53 @@ export class UsageTelemetryReporter {
     await this.flush();
   }
 
-  async flush(): Promise<void> {
+  async flush(): Promise<TelemetryFlushSummary> {
     if (this.activeFlush) {
-      return; // overlap guard
+      return this.activeFlush; // overlap guard — share the in-flight result
     }
     this.activeFlush = this._doFlush();
     try {
-      await this.activeFlush;
+      return await this.activeFlush;
     } finally {
       this.activeFlush = null;
     }
   }
 
-  private async _doFlush(batchCount = 0): Promise<void> {
+  private async _doFlush(
+    batchCount = 0,
+    acc: FlushAccumulator = { sent: 0, persisted: 0 },
+  ): Promise<TelemetryFlushSummary> {
+    // Once any batch has shipped (acc.sent > 0), a later skip/defer/error is
+    // just the natural end of the flush — report what landed, not a failure.
+    const flushed = (): TelemetryFlushSummary => ({
+      flushed: true,
+      sent: acc.sent,
+      persisted: acc.persisted,
+      dropped: Math.max(0, acc.sent - acc.persisted),
+    });
+    const settle = (reason: string): TelemetryFlushSummary =>
+      acc.sent > 0 ? flushed() : { flushed: false, reason };
+
     try {
       if (batchCount >= MAX_CONSECUTIVE_BATCHES) {
-        return;
+        return flushed();
+      }
+
+      // Age-bound the ack-mode outbox before any skip gate (platform,
+      // checkpoint store, consent three-way), so the bound holds in every
+      // state — including the unknown-consent deferral below. Only the
+      // reporter partition that flushes the outbox (ack-mode sources)
+      // prunes it.
+      if (batchCount === 0 && this.sources.some((source) => source.ack)) {
+        const prunedCount = deleteTelemetryOutboxEventsBefore(
+          Date.now() - OUTBOX_MAX_ROW_AGE_MS,
+        );
+        if (prunedCount > 0) {
+          log.debug(
+            { prunedCount },
+            "Telemetry flush: pruned expired outbox rows",
+          );
+        }
       }
 
       // Skip when platform features are disabled (VELLUM_DISABLE_PLATFORM in
@@ -272,7 +344,7 @@ export class UsageTelemetryReporter {
       // is a deployment/local-mode toggle, not a privacy opt-out, so the unsent
       // backlog ships once the flag is cleared.
       if (!arePlatformFeaturesEnabled()) {
-        return;
+        return settle("disabled");
       }
 
       // Skip when the flush-checkpoint store (telemetry DB) is unreachable.
@@ -283,10 +355,29 @@ export class UsageTelemetryReporter {
         log.warn(
           "Telemetry flush: flush-checkpoint store unavailable — skipping, will retry next cycle",
         );
-        return;
+        return settle("checkpoint-unavailable");
+      }
+
+      // Tri-state consent gate: `true` ships, `false` purges, `"unknown"`
+      // defers.
+      const shareAnalytics = getRawShareAnalytics();
+
+      // `"unknown"` (boot before the first successful consent refresh, no
+      // platform session, no resolvable owner) is not an opt-out: nothing is
+      // sent, acked, discarded, or advanced — the same shape as the
+      // checkpoint-unavailable skip above. Purging here would silently
+      // destroy events recorded before the cache warmed up; instead the
+      // backlog ships (or is purged) on a later cycle once the 5-minute
+      // refresh loop resolves the cache to a confirmed value. Bounded by
+      // the age prune above.
+      if (shareAnalytics === "unknown") {
+        log.debug(
+          "Telemetry flush: share_analytics consent unknown — skipping, will retry next cycle",
+        );
+        return settle("unknown-consent");
       }
 
-      // Respect opt-out: if the platform owner has not granted
+      // Respect a confirmed opt-out: if the platform owner declined
       // `share_analytics` consent, skip the flush and advance watermarks so
       // events recorded during the opt-out window are never sent
       // retroactively. The daemon runs the reporter even when opted out
@@ -302,7 +393,7 @@ export class UsageTelemetryReporter {
       // under builds predating the audit listener's write-time gate — new
       // opted-out tool_invocations rows persist NULL telemetry columns and
       // are unreportable by construction regardless of watermark timing.
-      if (!getCachedShareAnalytics()) {
+      if (shareAnalytics === false) {
         // Ack-mode sources drop their pending rows outright. Watermark-mode
         // sources advance the timestamp watermarks and pin the ID watermarks
         // to a sentinel that sorts above any real UUID. The sentinel (rather
@@ -322,7 +413,7 @@ export class UsageTelemetryReporter {
           this.checkpoints.set(keys.at, now);
           this.checkpoints.set(keys.id, OPT_OUT_WATERMARK_ID_SENTINEL);
         }
-        return;
+        return settle("opted-out");
       }
 
       // Read each source's watermark (compound cursor: createdAt + id) and
@@ -371,7 +462,7 @@ export class UsageTelemetryReporter {
       }
 
       if (batches.every(({ batch }) => batch.events.length === 0)) {
-        return;
+        return settle("nothing-pending");
       }
 
       // Resolve auth context. We send authenticated-only: if no platform
@@ -388,7 +479,7 @@ export class UsageTelemetryReporter {
           },
           "Telemetry flush: no platform credentials — skipping, will retry next cycle",
         );
-        return;
+        return settle("no-credentials");
       }
       log.debug(
         {
@@ -437,9 +528,14 @@ export class UsageTelemetryReporter {
           { status: resp.status, body },
           "Usage telemetry POST failed — will retry next cycle",
         );
-        return;
+        return settle("post-failed");
       }
-      await resp.text(); // consume body to release connection
+
+      // Read the ingest response so `persisted` reflects what actually landed;
+      // consuming the body also releases the connection.
+      const body = await resp.text();
+      acc.sent += typedEvents.length;
+      acc.persisted += parsePersistedCount(body, typedEvents.length);
 
       // Acknowledge each source's shipped rows: ack-mode sources delete them
       // (never touching flush_checkpoints), watermark-mode sources advance
@@ -456,12 +552,15 @@ export class UsageTelemetryReporter {
         }
       }
 
-      // If any source produced a full batch, there may be more — recurse.
+      // If any source produced a full batch, there may be more — recurse,
+      // threading the accumulator so counts span every batch in this flush.
       if (batches.some(({ batch }) => batch.fullBatch)) {
-        await this._doFlush(batchCount + 1);
+        return this._doFlush(batchCount + 1, acc);
       }
+      return flushed();
     } catch (err) {
       log.warn({ err }, "Usage telemetry flush error — non-fatal, will retry");
+      return settle("error");
     }
   }
 }

package/src/telemetry/watchdog-direct-emit.test.ts

@@ -8,9 +8,11 @@
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-let shareAnalytics = true;
+import type { ConsentState } from "../platform/consent-cache.js";
+
+let shareAnalytics: ConsentState = true;
 mock.module("../platform/consent-cache.js", () => ({
-  getCachedShareAnalytics: () => shareAnalytics,
+  getRawShareAnalytics: () => shareAnalytics,
 }));
 
 let platformEnabled = true;
@@ -84,12 +86,18 @@ describe("emitWatchdogEventDirect", () => {
     });
   });
 
-  test("sends nothing when share_analytics is opted out", async () => {
+  test("sends nothing when share_analytics is a confirmed opt-out", async () => {
     shareAnalytics = false;
     await emitWatchdogEventDirect("sqlite_corrupted", { database: "main" });
     expect(fetchCalls).toHaveLength(0);
   });
 
+  test("emits while consent is unknown (no buffer to defer into)", async () => {
+    shareAnalytics = "unknown";
+    await emitWatchdogEventDirect("sqlite_corrupted", { database: "main" });
+    expect(fetchCalls).toHaveLength(1);
+  });
+
   test("sends nothing when platform features are disabled", async () => {
     platformEnabled = false;
     await emitWatchdogEventDirect("sqlite_corrupted", { database: "main" });

package/src/telemetry/watchdog-direct-emit.ts

@@ -20,7 +20,7 @@ import { v4 as uuid } from "uuid";
 
 import { getPlatformOrganizationId, getPlatformUserId } from "../config/env.js";
 import { VellumPlatformClient } from "../platform/client.js";
-import { getCachedShareAnalytics } from "../platform/consent-cache.js";
+import { getRawShareAnalytics } from "../platform/consent-cache.js";
 import { arePlatformFeaturesEnabled } from "../platform/feature-gate.js";
 import { getDeviceId } from "../util/device-id.js";
 import { getLogger } from "../util/logger.js";
@@ -35,9 +35,11 @@ const TELEMETRY_INGEST_PATH = "/v1/telemetry/ingest/";
 
 /**
  * POST one `watchdog` event directly to the platform, bypassing the SQLite
- * buffer. Honors the `share_analytics` opt-out and the platform-features gate,
- * matching the batched reporter. Never throws — the caller is on a query hot
- * path.
+ * buffer. Honors a confirmed `share_analytics` opt-out and the
+ * platform-features gate. An unknown consent state emits: this path reports
+ * SQLite corruption and has no outbox to defer into, and platform ingest
+ * re-gates on consent authoritatively server-side. Never throws — the caller
+ * is on a query hot path.
  */
 export async function emitWatchdogEventDirect(
   checkName: string,
@@ -45,8 +47,11 @@ export async function emitWatchdogEventDirect(
   value: number | null = null,
 ): Promise<void> {
   try {
-    // Opt-out and deployment gates, mirroring the batched reporter's flush.
-    if (!getCachedShareAnalytics()) return;
+    // Drop only on a confirmed opt-out; unknown emits (no buffer to defer
+    // into, and platform ingest re-gates on consent server-side).
+    if (getRawShareAnalytics() === false) {
+      return;
+    }
     if (!arePlatformFeaturesEnabled()) return;
 
     // Authenticated-only. Null before the CES handshake resolves credentials;

package/src/tools/apps/executors.ts

@@ -43,7 +43,6 @@ export interface AppStoreWriter {
     icon?: string;
     schemaJson: string;
     htmlDefinition: string;
-    formatVersion?: number;
   }): AppDefinition;
   updateApp(
     id: string,
@@ -217,7 +216,6 @@ export async function executeAppCreate(
     icon,
     schemaJson,
     htmlDefinition: "",
-    formatVersion: 2,
   });
 
   // Associate the app with its conversation at creation so subsequent
@@ -407,28 +405,17 @@ export async function executeAppRefresh(
   // the client side.
   const updated = store.updateApp(input.app_id, {});
 
-  // Multifile apps need an explicit compile so the LLM sees any errors
-  // (bad imports, syntax issues, etc.) instead of silently serving the
-  // stale scaffold placeholder from the initial app_create.
-  if (app.formatVersion === 2) {
-    const appDir = getAppDirPath(input.app_id);
-    const compileResult = await compileApp(appDir);
-    return {
-      content: JSON.stringify({
-        refreshed: true,
-        appId: updated.id,
-        name: updated.name,
-        ...compileResultPayload(compileResult),
-      }),
-      isError: false,
-    };
-  }
-
+  // Compile explicitly so the LLM sees any errors (bad imports, syntax
+  // issues, etc.) instead of silently serving the stale scaffold placeholder
+  // from the initial app_create.
+  const appDir = getAppDirPath(input.app_id);
+  const compileResult = await compileApp(appDir);
   return {
     content: JSON.stringify({
       refreshed: true,
       appId: updated.id,
       name: updated.name,
+      ...compileResultPayload(compileResult),
     }),
     isError: false,
   };
@@ -485,29 +472,17 @@ export async function executeAppUpdate(
   // An empty update still bumps updatedAt, triggering a client surface refresh.
   const updated = store.updateApp(input.app_id, updates);
 
-  // Multifile apps recompile so the agent sees any errors from the edited
-  // source instead of serving a stale dist (mirrors app_refresh).
-  if (app.formatVersion === 2) {
-    const appDir = getAppDirPath(input.app_id);
-    const compileResult = await compileApp(appDir);
-    return {
-      content: JSON.stringify({
-        updated: true,
-        appId: updated.id,
-        name: updated.name,
-        description: updated.description,
-        ...compileResultPayload(compileResult),
-      }),
-      isError: false,
-    };
-  }
-
+  // Recompile so the agent sees any errors from the edited source instead of
+  // serving a stale dist (mirrors app_refresh).
+  const appDir = getAppDirPath(input.app_id);
+  const compileResult = await compileApp(appDir);
   return {
     content: JSON.stringify({
       updated: true,
       appId: updated.id,
       name: updated.name,
       description: updated.description,
+      ...compileResultPayload(compileResult),
     }),
     isError: false,
   };

package/src/tools/executor.ts

@@ -3,6 +3,7 @@ import { readFileSync } from "node:fs";
 import { getConfig } from "../config/loader.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { RiskLevel } from "../permissions/types.js";
+import { runInPluginContext } from "../plugins/plugin-execution-context.js";
 import { TokenExpiredError } from "../security/token-manager.js";
 import {
   recordToolError,
@@ -19,6 +20,7 @@ import {
 import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { PermissionChecker } from "./permission-checker.js";
+import { getToolOwner } from "./registry.js";
 import { extractAndSanitize } from "./sensitive-output-placeholders.js";
 import { applyEdit } from "./shared/filesystem/edit-engine.js";
 import { sandboxPolicy } from "./shared/filesystem/path-policy.js";
@@ -223,8 +225,19 @@ export class ToolExecutor {
       const toolTimeoutMs = computePerToolTimeoutMs(name, input);
       const execContext = context;
 
+      // Mark the owning plugin as in context (via AsyncLocalStorage) so host
+      // APIs the tool reaches — e.g. resolveCredential — can scope to it. The
+      // context must be established around the `execute()` call itself so the
+      // returned promise carries the binding across its awaits. Non-plugin
+      // tools (default/skill/mcp/workspace) establish no context.
+      const owner = getToolOwner(name);
+      const execPromise =
+        owner?.kind === "plugin"
+          ? runInPluginContext(owner.id, () => tool.execute(input, execContext))
+          : tool.execute(input, execContext);
+
       let execResult: ToolExecutionResult = await executeWithTimeout(
-        tool.execute(input, execContext),
+        execPromise,
         toolTimeoutMs,
         name,
       );

package/src/tools/host-terminal/host-shell.ts

@@ -20,6 +20,7 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../../runtime/assistant-event-hub.js";
+import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
@@ -84,6 +85,8 @@ function buildHostBashProxyEnv(conversationId: string): Record<string, string> {
   // Keep nested `assistant` CLI calls in host_bash aligned with the
   // originating conversation so browser IPC can resolve live proxy context.
   env.__CONVERSATION_ID = conversationId;
+  // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+  env.__REVEAL_NONCE = conversationRevealNonce(conversationId);
   return env;
 }
 
@@ -438,6 +441,7 @@ export const hostShellTool = {
     // Match `bash` tool behavior so nested assistant CLI calls can bind to
     // the active conversation when running through host_bash.
     hostEnv.__CONVERSATION_ID = context.conversationId;
+    hostEnv.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
 
     if (background) {
       // Check the registry limit BEFORE spawning so we never leak an
@@ -496,7 +500,7 @@ export const hostShellTool = {
       let completed = false;
 
       child.on("close", (code) => {
-        if (completed) return;
+        if (completed) {return;}
         completed = true;
         clearTimeout(timer);
         const stdout = Buffer.concat(stdoutChunks).toString();
@@ -568,7 +572,7 @@ export const hostShellTool = {
       });
 
       child.on("error", (err) => {
-        if (completed) return;
+        if (completed) {return;}
         completed = true;
         clearTimeout(timer);
         const status = aborted ? "cancelled" : "failed";

package/src/tools/network/__tests__/web-fetch-firecrawl.test.ts

@@ -7,7 +7,7 @@ let mockFirecrawlSecureKey: string | undefined;
 
 /** Seed the active web-fetch provider into the workspace config for real. */
 function seedWebFetch(provider: string): void {
-  setConfig("services", { "web-fetch": { mode: "your-own", provider } });
+  setConfig("services", { "web-fetch": { provider } });
 }
 
 mock.module("../../../security/secure-keys.js", () => ({

package/src/tools/network/__tests__/web-fetch-metadata.test.ts

@@ -212,6 +212,31 @@ describe("web_fetch activityMetadata", () => {
     expect(result.status ?? "").not.toContain("JavaScript-rendered");
   });
 
+  test("does not flag mayRequireJavaScript for markup-heavy pages that still yield substantial text", async () => {
+    // Mirrors a server-rendered GitHub PR page: <5% text-to-byte ratio, yet
+    // the extraction is complete — thousands of chars of real content.
+    const paragraph =
+      "<p>" +
+      "The quick brown fox jumps over the lazy dog. ".repeat(140) +
+      "</p>";
+    const scriptPayload = `var x = ${JSON.stringify("a".repeat(200_000))};`;
+    const body =
+      "<!doctype html><html><head><title>Article</title></head>" +
+      `<body>${paragraph}<script>${scriptPayload}</script></body></html>`;
+    globalThis.fetch = (async () =>
+      new Response(body, {
+        status: 200,
+        headers: { "content-type": "text/html; charset=utf-8" },
+      })) as unknown as typeof globalThis.fetch;
+
+    const result = await executeWithMockFetch({ url: "https://example.com/" });
+    expect(result.isError).toBe(false);
+
+    const meta = result.activityMetadata?.webFetch;
+    expect(meta?.mayRequireJavaScript).toBeUndefined();
+    expect(result.status ?? "").not.toContain("JavaScript-rendered");
+  });
+
   test("populates metadata for blocked private-network targets", async () => {
     const result = await executeWithMockFetch({
       url: "http://127.0.0.1/admin",

package/src/tools/network/web-fetch.ts

@@ -945,10 +945,14 @@ export async function executeWebFetch(
     }
     // Detect likely JS-rendered SPAs: text is absolutely tiny, or a non-trivial
     // HTML payload compresses to almost nothing (a shell page whose meaningful
-    // content is painted after fetch + document.body rewrite).
+    // content is painted after fetch + document.body rewrite). The ratio arm
+    // also requires a small absolute yield — markup-heavy pages (e.g. GitHub)
+    // extract at <5% while still producing thousands of chars of complete text.
     const lowAbsolute = processed.length < 200;
     const lowRatio =
-      body.bytesRead >= 10_000 && processed.length / body.bytesRead < 0.05;
+      processed.length < 5_000 &&
+      body.bytesRead >= 10_000 &&
+      processed.length / body.bytesRead < 0.05;
     const mayRequireJavaScript = html && !rawMode && (lowAbsolute || lowRatio);
     if (mayRequireJavaScript) {
       const pct =

package/src/tools/skills/sandbox-runner.ts

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
+import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import { safeStringSlice } from "../../util/unicode.js";
 import { buildSanitizedEnv } from "../terminal/safe-env.js";
@@ -148,6 +149,8 @@ function spawnRunner(
       conversationId: context.conversationId,
     });
     env.__CONVERSATION_ID = context.conversationId;
+    // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+    env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
 
     const child = spawn(wrapped.command, wrapped.args, {
       cwd: runDir,
@@ -255,7 +258,7 @@ function parseSkillResult(
   let searchFrom = stdout.length;
   while (searchFrom > 0) {
     const markerIdx = stdout.lastIndexOf("__skill_result", searchFrom - 1);
-    if (markerIdx === -1) break;
+    if (markerIdx === -1) {break;}
 
     const lineStart = stdout.lastIndexOf("\n", markerIdx) + 1;
     const lineEnd = stdout.indexOf("\n", markerIdx);
@@ -279,7 +282,7 @@ function parseSkillResult(
   searchFrom = stdout.length;
   while (searchFrom > 0) {
     const markerIdx = stdout.lastIndexOf("__skill_error", searchFrom - 1);
-    if (markerIdx === -1) break;
+    if (markerIdx === -1) {break;}
 
     const lineStart = stdout.lastIndexOf("\n", markerIdx) + 1;
     const lineEnd = stdout.indexOf("\n", markerIdx);

package/src/tools/subagent/spawn.ts

@@ -153,20 +153,16 @@ export async function executeSubagentSpawn(
   // profile of the call site that invoked us. That last fallback is what makes
   // a subagent match its invoker when the invoking turn ran purely on its
   // call-site default — the workspace `activeProfile` for `mainAgent`, or the
-  // call site's own catalog default (e.g. `cost-optimized`) for a
-  // heartbeat/background invoker. `resolveDefaultProfileKey` does not reflect a
-  // static `llm.callSites.<callSite>` profile override (only the
-  // activeProfile-for-mainAgent path plus the catalog default), a narrow gap
-  // that only surfaces with no `activeProfile` set and a hand-tuned call-site
-  // profile.
+  // call site's own winning default (a `llm.callSites.<callSite>` pin or the
+  // catalog intent, e.g. `cost-optimized`) for a heartbeat/background
+  // invoker (`resolveDefaultProfileKey` runs the same winner selection as
+  // dispatch, minus a per-turn override).
   //
   // An explicit `llm.callSites.subagentSpawn` profile must still win over
   // the invoker-default tier: that tier is a matching heuristic, not a user
-  // choice, and any override outranks the call-site pin under
-  // override-or-default resolution — so the heuristic is only forwarded
-  // when no explicit pin exists. (Under the legacy cascade a non-forced
-  // override already lost to the pin, so this guard is behavior-identical
-  // there.) An explicit `inference_profile` argument keeps
+  // choice, and any override outranks the call-site pin under single-winner
+  // resolution — so the heuristic is only forwarded when no explicit pin
+  // exists. An explicit `inference_profile` argument keeps
   // `forceOverrideProfile` and wins outright; the row read short-circuits
   // to `undefined` for the background subagent conversation and for tool
   // calls outside an agent-loop turn.

package/src/tools/terminal/shell.ts

@@ -6,6 +6,7 @@ import type { BackgroundToolCompleted } from "../../daemon/message-types/backgro
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
+import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
@@ -271,6 +272,8 @@ export const shellTool = {
 
     const env = buildSanitizedEnv();
     env.__CONVERSATION_ID = context.conversationId;
+    // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+    env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
     // Surface the resolving model to assistant CLI commands so they can tailor
     // remediation guidance for weak open models (see isWeakOpenModel).
     if (context.attribution?.resolvedModel) {
@@ -337,7 +340,7 @@ export const shellTool = {
       let completed = false;
 
       child.on("close", (code, signal) => {
-        if (completed) return;
+        if (completed) {return;}
         completed = true;
         clearTimeout(timer);
         removeBackgroundTool(bgId);
@@ -427,7 +430,7 @@ export const shellTool = {
       });
 
       child.on("error", (err) => {
-        if (completed) return;
+        if (completed) {return;}
         completed = true;
         clearTimeout(timer);
         removeBackgroundTool(bgId);

package/src/tools/tool-manifest.ts

@@ -7,7 +7,6 @@
  */
 
 import { recallTool, rememberTool } from "../plugins/defaults/memory/tools.js";
-import { appOpenTool } from "./apps/definitions.js";
 import { askQuestionTool } from "./ask-question/ask-question-tool.js";
 import { fileEditTool } from "./filesystem/edit.js";
 import { fileListTool } from "./filesystem/list.js";
@@ -69,5 +68,4 @@ export const explicitTools: ToolDefinition[] = [
   uiShowTool,
   uiUpdateTool,
   uiDismissTool,
-  appOpenTool,
 ];