@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/schedule/scheduler.ts

@@ -19,6 +19,7 @@ import { runSequencesOnce } from "../sequence/engine.js";
 import type { TurnFailure } from "../telemetry/turn-outcome.js";
 import { recordWatchdogEvent } from "../telemetry/watchdog-events-store.js";
 import { getLogger } from "../util/logger.js";
+import { describeScheduleSource } from "../util/schedule-source-key.js";
 import {
   createWorkerSupervisor,
   type WorkerSupervisor,
@@ -26,6 +27,8 @@ import {
 import { runWatchersOnce } from "../watcher/engine.js";
 import { normalizeCapabilityManifest } from "../workflows/capabilities.js";
 import { getWorkflowRunManager } from "../workflows/run-manager.js";
+import { declarationExistsOnDisk } from "./plugin-schedule-declarations.js";
+import { isPluginSchedulesEnabled } from "./plugin-schedules-gate.js";
 import { hasSetConstructs } from "./recurrence-engine.js";
 import { applyRetryDecision, decideRetry } from "./retry-policy.js";
 import { runScript, type ScriptResult } from "./run-script.js";
@@ -37,6 +40,7 @@ import {
   deferClaimedSchedule,
   failOneShotPermanently,
   getLastScheduleConversationId,
+  recordAdministrativeSkipRun,
   resetRetryCount,
   resolveScheduleConversationGroupId,
   retryOneShot,
@@ -523,6 +527,40 @@ export async function runDueSchedulesOnce(
       continue;
     }
 
+    // Fire-time gate for plugin-sourced rows, covering every way the source
+    // can go away under an armed row. `declarationExistsOnDisk` is the probe
+    // the run-now route and the enable path use, and it answers for all of
+    // them: a `.disabled` sentinel, a plugin directory a local uninstall
+    // removed, a manifest that no longer parses, and a declaration that is
+    // simply gone. Turning the feature flag off retires the whole surface.
+    // The reconciler is what disarms the rows any of these own, and it runs
+    // on its own schedule, so re-reading here is what makes the change take
+    // effect immediately: a row still armed (or already claimed) at that
+    // moment cannot run the plugin's code. The probe costs a stat and a
+    // manifest read, paid only when a sourced row fires.
+    const sourceKey = job.sourceKey;
+    if (
+      sourceKey !== null &&
+      (!isPluginSchedulesEnabled() ||
+        !(await declarationExistsOnDisk(sourceKey)))
+    ) {
+      const sourcePlugin = describeScheduleSource(sourceKey) ?? sourceKey;
+      log.info(
+        { jobId: job.id, name: job.name, plugin: sourcePlugin },
+        "Schedule not run: its plugin schedule source is unavailable",
+      );
+      // cron_runs has no skip status, so the skip is recorded as an error run
+      // to stay visible in the schedule's history. It is an administrative
+      // skip, not an attempt: the retry budget is left alone and no retry is
+      // scheduled, so the row stays on its normal cadence.
+      await recordAdministrativeSkipRun(
+        job.id,
+        `Schedule not run: plugin "${sourcePlugin}" is disabled, uninstalled, or no longer declares this schedule.`,
+      );
+      mark("skipped");
+      continue;
+    }
+
     const isOneShot = job.expression == null;
 
     // ── Notify mode (one-shot or recurring) ─────────────────────────

package/src/security/credential-backend.ts

@@ -4,7 +4,8 @@
  * is in use.
  */
 
-import { deleteKey, getKey, listKeys, setKey } from "./encrypted-store.js";
+import { getIsContainerized } from "../config/env-registry.js";
+import { deleteKey, listKeys, readKey, setKey } from "./encrypted-store.js";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -62,14 +63,21 @@ class EncryptedStoreBackend implements CredentialBackend {
   readonly name = "encrypted-store";
 
   isAvailable(): boolean {
-    return true;
+    // The local encrypted store is the legitimate backend only outside
+    // containers. On a pod `keys.enc` does not exist and CES owns credentials,
+    // so reporting available here would pin reads to a store that can never
+    // hold the key. Returning false lets the resolver recover to CES.
+    return !getIsContainerized();
   }
 
   async get(account: string): Promise<CredentialGetResult> {
     try {
-      return { value: getKey(account), unreachable: false };
+      return { value: readKey(account), unreachable: false };
     } catch {
-      return { value: undefined, unreachable: false };
+      // A thrown error means the store exists but could not be read or
+      // decrypted, so it is unavailable, not absent. A genuinely-missing store
+      // or key returns undefined from readKey without throwing.
+      return { value: undefined, unreachable: true };
     }
   }
 
@@ -98,6 +106,41 @@ class EncryptedStoreBackend implements CredentialBackend {
   }
 }
 
+// ---------------------------------------------------------------------------
+// UnavailableBackend
+// ---------------------------------------------------------------------------
+
+/**
+ * A backend whose every operation reports the store as unreachable. Used on
+ * containerized pods when no CES path is ready: resolving to the (nonexistent)
+ * local encrypted store would report provisioned credentials as absent, but
+ * the correct state is "temporarily unreachable" (presence indeterminate),
+ * which callers retry rather than treating as a missing key.
+ */
+class UnavailableBackend implements CredentialBackend {
+  readonly name = "unavailable";
+
+  isAvailable(): boolean {
+    return false;
+  }
+
+  async get(): Promise<CredentialGetResult> {
+    return { value: undefined, unreachable: true };
+  }
+
+  async set(): Promise<boolean> {
+    return false;
+  }
+
+  async delete(): Promise<DeleteResult> {
+    return "error";
+  }
+
+  async list(): Promise<CredentialListResult> {
+    return { accounts: [], unreachable: true };
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Factory functions
 // ---------------------------------------------------------------------------
@@ -105,3 +148,7 @@ class EncryptedStoreBackend implements CredentialBackend {
 export function createEncryptedStoreBackend(): EncryptedStoreBackend {
   return new EncryptedStoreBackend();
 }
+
+export function createUnavailableBackend(): UnavailableBackend {
+  return new UnavailableBackend();
+}

package/src/security/encrypted-store.ts

@@ -418,58 +418,80 @@ function decrypt(entry: EncryptedEntry, key: Buffer): string {
   return decrypted.toString("utf-8");
 }
 
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+
+/**
+ * Thrown by `readKey()` when the store is UNAVAILABLE: the store file exists
+ * but cannot be read, the key material is missing, or an entry fails to
+ * decrypt. Distinct from a credential being ABSENT (no store file, or the
+ * store reads cleanly but lacks the requested key), which returns `undefined`.
+ *
+ * Mirrors the CES-side `StoreUnavailableError` so managed pods and local mode
+ * report the same absent-vs-unavailable distinction: an unavailable store must
+ * surface as `unreachable` (presence indeterminate), never as "no key".
+ */
+export class StoreUnavailableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StoreUnavailableError";
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
 
 /**
- * Retrieve a secret from the encrypted store.
- * Returns `undefined` if the key doesn't exist or decryption fails.
+ * Retrieve a secret, distinguishing a genuinely-absent credential (returns
+ * `undefined`) from a store that exists but cannot be read or decrypted
+ * (throws {@link StoreUnavailableError}).
  */
-export function getKey(account: string): string | undefined {
-  try {
-    const store = readStore();
-    if (!store) {
-      return undefined;
-    }
+export function readKey(account: string): string | undefined {
+  // `readStore()` returns null for a missing store (or a corrupt store it has
+  // just reset) and throws on transient I/O errors (EACCES, EMFILE, EIO). A
+  // missing store is genuinely absent; a transient read error is unavailable
+  // and propagates.
+  const store = readStore();
+  if (!store) {
+    return undefined;
+  }
 
-    // If v1, trigger migration
-    if (store.version === 1) {
-      const migrated = migrateV1ToV2(store);
-      if (migrated) {
-        writeStore(migrated);
-        const entry = migrated.entries[account];
-        if (!entry) {
-          return undefined;
-        }
-        const key = getKeyForStore(migrated);
-        if (!key) {
-          return undefined;
-        }
-        return decrypt(entry, key);
-      }
-      // Migration failed -- try reading with legacy key
-      const entry = store.entries[account];
-      if (!entry) {
-        return undefined;
-      }
-      const key = getKeyForStore(store);
-      if (!key) {
-        return undefined;
-      }
-      return decrypt(entry, key);
+  let effectiveStore: StoreFile = store;
+  if (store.version === 1) {
+    const migrated = migrateV1ToV2(store);
+    if (migrated) {
+      writeStore(migrated);
+      effectiveStore = migrated;
     }
+    // Migration failed: fall through and read with the legacy PBKDF2 key.
+  }
 
-    const entry = store.entries[account];
-    if (!entry) {
-      return undefined;
-    }
+  const entry = effectiveStore.entries[account];
+  if (!entry) {
+    return undefined;
+  }
 
-    const key = getKeyForStore(store);
-    if (!key) {
-      return undefined;
-    }
-    return decrypt(entry, key);
+  const key = getKeyForStore(effectiveStore);
+  if (!key) {
+    throw new StoreUnavailableError(
+      "credential store entry present but key material is unavailable",
+    );
+  }
+  // A decrypt failure means corrupt data or wrong key material, so the credential
+  // exists but its value cannot be produced. Let it propagate as unavailable
+  // rather than swallowing it into a false "not found".
+  return decrypt(entry, key);
+}
+
+/**
+ * Retrieve a secret from the encrypted store.
+ * Returns `undefined` if the key doesn't exist or decryption fails.
+ */
+export function getKey(account: string): string | undefined {
+  try {
+    return readKey(account);
   } catch (err) {
     log.debug({ err, account }, "Failed to read from encrypted store");
     return undefined;

package/src/security/secure-keys.ts

@@ -50,7 +50,10 @@ import type {
   CredentialListResult,
   DeleteResult,
 } from "./credential-backend.js";
-import { createEncryptedStoreBackend } from "./credential-backend.js";
+import {
+  createEncryptedStoreBackend,
+  createUnavailableBackend,
+} from "./credential-backend.js";
 import { credentialKey } from "./credential-key.js";
 
 export type {
@@ -148,6 +151,10 @@ export function setCesClient(client: CesClient | undefined): void {
   _resolvedBackend = undefined;
   _resolvePromise = undefined;
   _cesHttpUnreachable = false;
+  log.info(
+    { hasClient: !!client },
+    "CES client updated; resetting resolved credential backend cache",
+  );
   _cesClientListener?.(client);
 }
 
@@ -238,6 +245,21 @@ async function resolveBackendAsync(
         // backends.
         return _resolvedBackend;
       }
+    } else if (
+      _resolvedBackend.name === "encrypted-store" &&
+      _cesClient?.isReady()
+    ) {
+      // A CES client became ready after we fell back to the encrypted store
+      // (e.g. a worker/CLI whose handshake completed post-fallback, or a
+      // client injected before its handshake finished). No reconnect callback
+      // is needed, since the live client already exists. Drop the fallback and
+      // re-resolve so the CES RPC path wins.
+      log.info(
+        "CES client is ready; upgrading credential backend from encrypted store to CES RPC",
+      );
+      _resolvedBackend = undefined;
+      _resolvePromise = undefined;
+      // Fall through to re-resolve.
     } else if (
       _cesReconnect &&
       (_resolvedBackend.name === "encrypted-store" ||
@@ -264,7 +286,16 @@ async function resolveBackendAsync(
     }
   }
   if (!_resolvePromise) {
-    _resolvePromise = doResolveBackend();
+    _resolvePromise = doResolveBackend().then((backend) => {
+      // The containerized guard returns an unreachable backend without caching
+      // it (`_resolvedBackend` stays unset). Clear the memoized promise so the
+      // next credential op re-attempts CES rather than pinning the unreachable
+      // result to a pod whose CES may since have come up.
+      if (backend.name === "unavailable") {
+        _resolvePromise = undefined;
+      }
+      return backend;
+    });
   }
   return _resolvePromise;
 }
@@ -456,10 +487,11 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     const cesRpc = new CesRpcCredentialBackend(_cesClient);
     if (cesRpc.isAvailable()) {
       _resolvedBackend = cesRpc;
+      log.info("Resolved credential backend: ces-rpc");
       return cesRpc;
     }
     log.warn(
-      "CES RPC client is set but not ready — falling back to local credential store",
+      "CES RPC client is set but not ready; trying the next credential backend",
     );
   }
 
@@ -468,11 +500,12 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     const ces = createCesCredentialBackend();
     if (ces.isAvailable()) {
       _resolvedBackend = ces;
+      log.info("Resolved credential backend: ces-http");
       return ces;
     }
     log.warn(
-      "CES_CREDENTIAL_URL is set but CES backend is not available — " +
-        "falling back to local credential store",
+      "CES_CREDENTIAL_URL is set but CES backend is not available; " +
+        "trying the next credential backend",
     );
   }
 
@@ -488,14 +521,29 @@ async function doResolveBackend(): Promise<CredentialBackend> {
       const cesRpc = new CesRpcCredentialBackend(lazyClient);
       if (cesRpc.isAvailable()) {
         _resolvedBackend = cesRpc;
+        log.info("Resolved credential backend: ces-rpc (lazy connect)");
         return cesRpc;
       }
     }
-    // Lazy connect failed — fall through to encrypted file store.
+    // Lazy connect failed; fall through.
+  }
+
+  // 3. On a containerized pod the local encrypted store does not exist and CES
+  //    owns credentials. Never resolve to the encrypted store here; it would
+  //    report a provisioned credential as absent. Return an unreachable backend
+  //    (presence indeterminate, which callers retry) WITHOUT caching it, so the
+  //    next credential op re-attempts CES rather than pinning the dead answer.
+  if (getIsContainerized()) {
+    log.error(
+      "No CES credential backend is ready on a containerized pod; reporting credentials as unreachable (indeterminate). The local encrypted store is not used in managed mode.",
+    );
+    return createUnavailableBackend();
   }
 
-  // 3. Encrypted file store — fallback when CES is unavailable
+  // 4. Encrypted file store: the legitimate backend for local / self-hosted
+  //    mode when CES is unavailable.
   _resolvedBackend = getEncryptedStoreBackend();
+  log.info("Resolved credential backend: encrypted-store (local mode)");
   return _resolvedBackend;
 }
 

package/src/skills/catalog-install.ts

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import {
   cpSync,
   existsSync,
@@ -395,15 +395,28 @@ function assertStagedSkillRoot(skillId: string, stagedDir: string): void {
   }
 }
 
-export function installSkillDependenciesIfPresent(skillDir: string): void {
-  if (existsSync(join(skillDir, "package.json"))) {
-    const bunPath = `${homedir()}/.bun/bin`;
-    execSync("bun install", {
+export async function installSkillDependenciesIfPresent(
+  skillDir: string,
+): Promise<void> {
+  if (!existsSync(join(skillDir, "package.json"))) {
+    return;
+  }
+  const bunPath = `${homedir()}/.bun/bin`;
+  await new Promise<void>((resolve, reject) => {
+    const child = spawn("bun", ["install"], {
       cwd: skillDir,
       stdio: "inherit",
       env: { ...process.env, PATH: `${bunPath}:${process.env.PATH}` },
     });
-  }
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`bun install exited with code ${code}`));
+      }
+    });
+  });
 }
 
 function restoreOrRemoveFailedSkillInstall(
@@ -518,7 +531,7 @@ export async function installSkillLocally(
       contentHash: computeSkillHash(stagedDir) ?? undefined,
     });
 
-    installSkillDependenciesIfPresent(stagedDir);
+    await installSkillDependenciesIfPresent(stagedDir);
     commitStagedSkillInstall(skillId, stagedDir);
 
     log.info(

package/src/skills/inline-command-runner.ts

@@ -24,6 +24,7 @@
 import { spawn } from "node:child_process";
 
 import { buildSanitizedEnv } from "../tools/terminal/safe-env.js";
+import { stripAnsiSequences } from "../util/ansi.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("inline-command-runner");
@@ -45,12 +46,6 @@ const MAX_OUTPUT_CHARS = 20_000;
  */
 const MAX_STDOUT_BUFFER_BYTES = MAX_OUTPUT_CHARS * 4;
 
-/**
- * ANSI escape sequence pattern (covers SGR, cursor movement, erase, etc.).
- * Matches: ESC[ ... final_byte  and  ESC] ... ST  (OSC sequences).
- */
-const ANSI_RE = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*(?:\x07|\x1b\\)/g;
-
 /**
  * Heuristic for binary output: if more than 10% of the characters are
  * non-printable (control chars excluding \t, \n, \r) then reject.
@@ -198,7 +193,7 @@ export async function runInlineCommand(
       // Strip ANSI sequences first — these are terminal artifacts, not
       // binary data. Stripping before the binary check prevents legitimate
       // color-coded tool output from being rejected.
-      let cleaned = raw.replace(ANSI_RE, "");
+      let cleaned = stripAnsiSequences(raw);
 
       // Reject binary-ish output (after ANSI stripping)
       if (isBinaryish(cleaned)) {