@vellumai/assistant 0.11.2-dev.202608051933.deffc0f → 0.11.2-dev.202608052033.7272f57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608051933.deffc0f",
+  "version": "0.11.2-dev.202608052033.7272f57",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/top-level-renderer.test.ts

@@ -1,5 +1,5 @@
 import { homedir, userInfo } from "node:os";
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 
 import { renderWorkspaceTopLevelContext } from "../workspace/top-level-renderer.js";
 import type { TopLevelSnapshot } from "../workspace/top-level-scanner.js";
@@ -214,4 +214,57 @@ describe("renderWorkspaceTopLevelContext", () => {
     expect(result).toContain("Host home directory: /Users/alice");
     expect(result).toContain(`Host username: ${userInfo().username}`);
   });
+
+  describe("containerized daemon", () => {
+    // In a container the daemon's own homedir/username describe the
+    // container, not the user's machine. Reporting them as the HOST values
+    // is what leads a host_bash command to write to a path that exists
+    // nowhere on the user's machine.
+    const priorIsContainerized = process.env.IS_CONTAINERIZED;
+
+    afterEach(() => {
+      if (priorIsContainerized === undefined) {
+        delete process.env.IS_CONTAINERIZED;
+      } else {
+        process.env.IS_CONTAINERIZED = priorIsContainerized;
+      }
+    });
+
+    const snapshot: TopLevelSnapshot = {
+      rootPath: "/workspace",
+      directories: ["src"],
+      files: ["package.json"],
+      truncated: false,
+    };
+
+    test("does not pass off the container's own home dir as the host's", () => {
+      process.env.IS_CONTAINERIZED = "true";
+
+      const result = renderWorkspaceTopLevelContext(snapshot, {});
+
+      expect(result).not.toContain(`Host home directory: ${homedir()}`);
+      // Name the way to find the real value rather than leaving a dead end.
+      expect(result.split("\n")).toEqual([
+        "<workspace>",
+        "Root: /workspace",
+        "Directories: src",
+        "Files: package.json",
+        "Host home directory: unknown (ask the host shell: `host_bash` with `echo $HOME`)",
+        "Host username: unknown",
+        "</workspace>",
+      ]);
+    });
+
+    test("still reports the client-supplied host env when it is known", () => {
+      process.env.IS_CONTAINERIZED = "true";
+
+      const result = renderWorkspaceTopLevelContext(snapshot, {
+        hostHomeDir: "/Users/alice",
+        hostUsername: "alice",
+      });
+
+      expect(result).toContain("Host home directory: /Users/alice");
+      expect(result).toContain("Host username: alice");
+    });
+  });
 });

package/src/oauth/seed-providers.ts

@@ -726,7 +726,15 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     availableScopes:
       "https://learn.microsoft.com/en-us/graph/permissions-reference",
-    authorizeParams: { prompt: "consent" },
+    // `select_account`, not `consent`: the Microsoft identity platform accepts
+    // a single prompt value, and `consent` honours an existing session cookie —
+    // it re-asks for consent but never for *which* account, so a user who
+    // already signed in cannot connect a second mailbox. `select_account`
+    // always shows the account picker with its "Use another account" option.
+    // Consent is still collected for an account that has not granted it, and
+    // refresh tokens come from the `offline_access` scope above, so nothing is
+    // lost by dropping `consent`.
+    authorizeParams: { prompt: "select_account" },
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17334,
     managedServiceConfigKey: "outlook-oauth",

package/src/tools/host-filesystem/edit.ts

@@ -25,7 +25,12 @@ import type {
  * a non-string (or empty) value means "untargeted".
  */
 export const hostFileEditInputSchema = z.looseObject({
-  path: z.string().min(1).describe("Absolute host path to the file to edit"),
+  path: z
+    .string()
+    .min(1)
+    .describe(
+      "Absolute path on the guardian's device, which is a separate filesystem from your workspace, to edit.",
+    ),
   old_string: z
     .string()
     .min(1, { message: "old_string must not be empty" })

package/src/tools/host-filesystem/read.ts

@@ -38,7 +38,12 @@ import type {
  * "untargeted".
  */
 export const hostFileReadInputSchema = z.looseObject({
-  path: z.string().min(1).describe("Absolute path to the host file to read"),
+  path: z
+    .string()
+    .min(1)
+    .describe(
+      "Absolute path on the guardian's device, which is a separate filesystem from your workspace, to read.",
+    ),
   offset: z
     .number()
     .describe("Line number to start reading from (1-indexed)")

package/src/tools/host-filesystem/write.ts

@@ -24,7 +24,12 @@ import type {
  * non-string (or empty) value means "untargeted".
  */
 export const hostFileWriteInputSchema = z.looseObject({
-  path: z.string().min(1).describe("Absolute host path to the file to write"),
+  path: z
+    .string()
+    .min(1)
+    .describe(
+      "Absolute path on the guardian's device, which is a separate filesystem from your workspace, to write.",
+    ),
   content: z.string().describe("The content to write to the file"),
   target_client_id: z
     .string()

package/src/tools/host-terminal/host-shell.ts

@@ -121,7 +121,7 @@ export const hostShellInputSchema = z.looseObject({
     z
       .string()
       .describe(
-        "Optional absolute host working directory (defaults to user home)",
+        "Optional absolute path on the host's filesystem, which is separate from your workspace (defaults to the host user's home).",
       ),
   ),
   timeout_seconds: z
@@ -150,7 +150,7 @@ export const hostShellInputSchema = z.looseObject({
 export const hostShellTool = {
   name: "host_bash",
   description:
-    "LAST RESORT — Execute a shell command directly on the host machine. You MUST strongly prefer the regular `bash` tool for all commands. Only use `host_bash` when you are absolutely certain the command MUST run on the host machine and CANNOT run in the workspace (e.g., managing host-level system services, accessing host-only peripherals, or interacting with host paths outside the workspace). If in doubt, use `bash` instead. Approval-gated: each invocation must be explicitly approved. Do not use for commands that require injected credentials or secrets.",
+    "LAST RESORT — Execute a shell command directly on the host machine. You MUST strongly prefer the regular `bash` tool for all commands. Only use `host_bash` when you are absolutely certain the command MUST run on the host machine and CANNOT run in the workspace (e.g., managing host-level system services, accessing host-only peripherals, or interacting with host paths outside the workspace). If in doubt, use `bash` instead. Paths resolve on the host's filesystem, which is separate from your workspace; write output somewhere on the host and read it back with `host_file_read`. Approval-gated: each invocation must be explicitly approved. Do not use for commands that require injected credentials or secrets.",
   category: "host-terminal",
   executionTarget: "host",
   defaultRiskLevel: RiskLevel.Medium,

package/src/workspace/top-level-renderer.ts

@@ -1,5 +1,6 @@
 import { homedir, userInfo } from "node:os";
 
+import { getIsContainerized } from "../config/env-registry.js";
 import type { TopLevelSnapshot } from "./top-level-scanner.js";
 
 // `os.userInfo()` throws `SystemError` when the current UID has no passwd
@@ -52,10 +53,22 @@ export function renderWorkspaceTopLevelContext(
   if (snapshot.truncated) {
     lines.push("(list truncated — more entries exist)");
   }
-  lines.push(`Host home directory: ${options.hostHomeDir ?? homedir()}`);
+  // The daemon's own `homedir()` / `userInfo()` describe the HOST only when
+  // the daemon runs on it. In a container they describe the container, and
+  // labelling them "Host …" invites host-side tools (`host_bash`,
+  // `host_file_*`, computer use) to be handed a path that exists nowhere on
+  // the user's machine. Fall back only when the two are the same machine;
+  // otherwise say the value is unknown and name the way to find it, which is
+  // cheaper than a failed write on the user's Mac.
+  const hostHomeDir =
+    options.hostHomeDir ?? (getIsContainerized() ? undefined : homedir());
+  const hostUsername =
+    options.hostUsername ??
+    (getIsContainerized() ? undefined : safeUserInfoUsername());
   lines.push(
-    `Host username: ${options.hostUsername ?? safeUserInfoUsername()}`,
+    `Host home directory: ${hostHomeDir ?? "unknown (ask the host shell: `host_bash` with `echo $HOME`)"}`,
   );
+  lines.push(`Host username: ${hostUsername ?? "unknown"}`);
   lines.push("</workspace>");
   return lines.join("\n");
 }