@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/tools/document/document-tool.ts

@@ -447,13 +447,20 @@ export function executeDocumentUpdate(
     };
   }
 
-  // Fallback if no client is connected
+  // No client is connected to render the edit, but the write landed, so this is
+  // a success. Reporting it as an error would strand a headless turn (a
+  // schedule, SMS, or Telegram channel): post-execution hooks are skipped for
+  // errored tools, so the documents-changed broadcast that tells clients about
+  // the edit would never fire, and the model would be told to retry a write
+  // that already succeeded.
   return {
     content: JSON.stringify({
-      success: false,
-      error: "No client connected to update document",
+      success: true,
+      surface_id: surfaceId,
+      mode,
+      message: "Document content updated (no client connected to render it)",
     }),
-    isError: true,
+    isError: false,
   };
 }
 

package/src/tools/execution-timeout.ts

@@ -6,11 +6,18 @@ const TIMEOUT_SENTINEL = Symbol("tool-timeout");
 /**
  * Convert a config-provided seconds value to a safe milliseconds value,
  * falling back to the default if the input is NaN, non-finite, zero, or negative.
+ *
+ * `fallbackMs` lets callers governed by a different budget (e.g. the inline
+ * grant wait) keep their own floor instead of inheriting the tool-execution
+ * default.
  */
-export function safeTimeoutMs(sec: unknown): number {
+export function safeTimeoutMs(
+  sec: unknown,
+  fallbackMs: number = DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC * 1000,
+): number {
   const n = Number(sec);
   if (!Number.isFinite(n) || n <= 0) {
-    return DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC * 1000;
+    return fallbackMs;
   }
   return n * 1000;
 }

package/src/tools/executor.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 
 import { getConfig } from "../config/loader.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
@@ -484,18 +484,19 @@ export function computePerToolTimeoutMs(
  * confirmation payload — ahead of approval. Host file tools have no preview
  * for the same reason.
  */
-function computePreviewDiff(
+async function computePreviewDiff(
   toolName: string,
   input: Record<string, unknown>,
   workingDir: string,
-):
+): Promise<
   | {
       filePath: string;
       oldContent: string;
       newContent: string;
       isNewFile: boolean;
     }
-  | undefined {
+  | undefined
+> {
   try {
     if (toolName === "file_write") {
       // Parse with the tool's own schema so the preview reads the same shape
@@ -519,7 +520,7 @@ function computePreviewDiff(
           return undefined;
         }
       }
-      const oldContent = isNewFile ? "" : readFileSync(filePath, "utf-8");
+      const oldContent = isNewFile ? "" : await readFile(filePath, "utf-8");
       return { filePath, oldContent, newContent: content, isNewFile };
     }
 
@@ -545,7 +546,7 @@ function computePreviewDiff(
       if (stat.size > MAX_FILE_SIZE_BYTES) {
         return undefined;
       }
-      const content = readFileSync(filePath, "utf-8");
+      const content = await readFile(filePath, "utf-8");
       const replaceAll = parsed.data.replace_all === true;
       const result = applyEdit(content, oldString, newString, replaceAll);
       if (!result.ok) {

package/src/tools/filesystem/edit.ts

@@ -88,7 +88,7 @@ export const fileEditTool = {
       sandboxPolicyWithHostFallback(path, context.workingDir, opts),
     );
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: rawPath,
       oldString,
       newString,

package/src/tools/filesystem/list.ts

@@ -61,7 +61,7 @@ export const fileListTool = {
       sandboxPolicy(path, context.workingDir, opts),
     );
 
-    const result = ops.listDirSafe({ path: rawPath, glob });
+    const result = await ops.listDirSafe({ path: rawPath, glob });
 
     if (!result.ok) {
       const { error } = result;

package/src/tools/filesystem/read.ts

@@ -12,7 +12,7 @@ import {
   IMAGE_EXTENSIONS,
   readImageFile,
 } from "../shared/filesystem/image-read.js";
-import { sandboxPolicyWithHostFallback } from "../shared/filesystem/path-policy.js";
+import { sandboxReadPolicy } from "../shared/filesystem/path-policy.js";
 import {
   invalidToolInputResult,
   toToolInputSchema,
@@ -43,7 +43,7 @@ export const fileReadInputSchema = z.looseObject({
     .catch(undefined),
   limit: z
     .number()
-    .describe("Maximum number of lines to read")
+    .describe("Maximum number of lines to read (defaults to 2000)")
     .optional()
     .catch(undefined),
   activity: z
@@ -58,7 +58,7 @@ export const fileReadInputSchema = z.looseObject({
 export const fileReadTool = {
   name: "file_read",
   description:
-    "Read the contents of a file on your own machine. For image files (JPEG, PNG, GIF, WebP), returns the image for visual analysis. For audio files (MP3, WAV, OGG, FLAC, AAC, M4A), returns the audio for listening. Use host_file_read for files on your guardian's device instead.",
+    "Read the contents of a file on your own machine. Text reads return the first 2000 lines unless you pass `limit`; when a read stops short the result says so, and `offset` pages on from there. For image files (JPEG, PNG, GIF, WebP), returns the image for visual analysis. For audio files (MP3, WAV, OGG, FLAC, AAC, M4A), returns the audio for listening. Use host_file_read for files on your guardian's device instead.",
   category: "filesystem",
   executionTarget: "sandbox",
   defaultRiskLevel: RiskLevel.Low,
@@ -80,10 +80,7 @@ export const fileReadTool = {
     // For image files, delegate to the shared image reader.
     const ext = extname(rawPath).toLowerCase();
     if (IMAGE_EXTENSIONS.has(ext)) {
-      const pathCheck = sandboxPolicyWithHostFallback(
-        rawPath,
-        context.workingDir,
-      );
+      const pathCheck = sandboxReadPolicy(rawPath, context.workingDir);
       if (!pathCheck.ok) {
         return {
           content: `Error: ${pathCheck.error}. To read files outside the workspace, use the host_file_read tool instead.`,
@@ -95,10 +92,7 @@ export const fileReadTool = {
 
     // For audio files, delegate to the shared audio reader.
     if (AUDIO_EXTENSIONS.has(ext)) {
-      const pathCheck = sandboxPolicyWithHostFallback(
-        rawPath,
-        context.workingDir,
-      );
+      const pathCheck = sandboxReadPolicy(rawPath, context.workingDir);
       if (!pathCheck.ok) {
         return {
           content: `Error: ${pathCheck.error}. To read files outside the workspace, use the host_file_read tool instead.`,
@@ -109,10 +103,10 @@ export const fileReadTool = {
     }
 
     const ops = new FileSystemOps((path, opts) =>
-      sandboxPolicyWithHostFallback(path, context.workingDir, opts),
+      sandboxReadPolicy(path, context.workingDir, opts),
     );
 
-    const result = ops.readFileSafe({ path: rawPath, offset, limit });
+    const result = await ops.readFileSafe({ path: rawPath, offset, limit });
 
     if (!result.ok) {
       const { error } = result;

package/src/tools/filesystem/search.ts

@@ -1,4 +1,4 @@
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
 import { basename, join, relative } from "node:path";
 
 import { minimatch } from "minimatch";
@@ -48,11 +48,10 @@ const MAX_DISPLAY_LINE_LENGTH = 2000;
 // report the result as truncated.
 const MAX_OUTPUT_BYTES = 4 * 1024 * 1024; // 4 MiB
 
-// Wall-clock deadline for the whole search. The synchronous scan never yields,
-// so the promise-based tool timeout / abort signal can't fire mid-scan. Checking
-// this deadline (and the abort signal) once per line bounds how long a search
-// over a very large tree can block the event loop and lets an external abort
-// stop the walk promptly.
+// Wall-clock deadline for the whole search. File I/O yields between files,
+// but the per-file line loop is CPU-bound; checking this deadline (and the
+// abort signal) once per line bounds how long a search over a very large tree
+// can occupy the event loop and lets an external abort stop the walk promptly.
 const MAX_SEARCH_MS = 10_000; // 10 s
 
 const DEFAULT_MAX_RESULTS = 200;
@@ -150,7 +149,7 @@ export const codeSearchTool = {
     // Match with the linear-time RE2 engine (via re2js) instead of V8's
     // backtracking RegExp. RE2 guarantees linear-time matching, so a
     // user/subagent-supplied pattern cannot trigger catastrophic backtracking
-    // and block the synchronous scan. The trade-off is that RE2 rejects
+    // and pin the event loop inside the per-file line loop. The trade-off is that RE2 rejects
     // backreferences and lookarounds; compile() throws on those, surfaced as a
     // clean error below.
     let regex: RE2JS;
@@ -189,7 +188,7 @@ export const codeSearchTool = {
     // NOT_FOUND / NOT_A_DIRECTORY reporting in file_list.
     let rootStat: import("node:fs").Stats;
     try {
-      rootStat = statSync(root);
+      rootStat = await stat(root);
     } catch {
       return {
         content: `Error: path not found: ${rawPath}`,
@@ -198,8 +197,8 @@ export const codeSearchTool = {
     }
 
     // Start the wall-clock deadline before walking so a pathological regex
-    // (or an external abort) can stop the synchronous scan mid-flight instead
-    // of blocking the event loop until the whole tree is exhausted.
+    // (or an external abort) can stop the scan mid-flight instead of running
+    // until the whole tree is exhausted.
     const searchStart = Date.now();
 
     const lines: string[] = [];
@@ -228,7 +227,7 @@ export const codeSearchTool = {
     let totalBytes = 0;
     // Number of directory entries visited during the walk (files + subdirs),
     // bounded by MAX_ENTRIES_TRAVERSED so a pathological tree can't run the
-    // synchronous readdir/stat work unbounded even when no file is ever read.
+    // readdir/stat work unbounded even when no file is ever read.
     let entriesTraversed = 0;
     // Set when an EXPLICIT file root (not a child discovered mid-walk) can't be
     // read — e.g. EACCES/EPERM. A child file's read failure is optional and
@@ -264,7 +263,10 @@ export const codeSearchTool = {
 
     // Scan a single regular file for matches. Applies the denied-basename guard
     // and per-file size caps. Returns nothing; mutates the shared accumulators.
-    const scanFile = (full: string, isExplicitRoot = false): void => {
+    const scanFile = async (
+      full: string,
+      isExplicitRoot = false,
+    ): Promise<void> => {
       if (truncated) {
         return;
       }
@@ -306,7 +308,7 @@ export const codeSearchTool = {
 
       let size: number;
       try {
-        size = statSync(full).size;
+        size = (await stat(full)).size;
       } catch {
         return;
       }
@@ -323,7 +325,7 @@ export const codeSearchTool = {
 
       let buf: Buffer;
       try {
-        buf = readFileSync(full);
+        buf = await readFile(full);
       } catch (err) {
         // A child file discovered mid-walk is optional — skip it silently. But
         // an explicit file root that can't be read was never searched, so record
@@ -407,13 +409,13 @@ export const codeSearchTool = {
       }
     };
 
-    const walk = (dir: string, isExplicitRoot = false): void => {
+    const walk = async (dir: string, isExplicitRoot = false): Promise<void> => {
       if (truncated) {
         return;
       }
       // Bound the traversal itself, not just file reads: a deep/wide tree of
       // directories (or many entries that never get read) could otherwise run
-      // the synchronous readdir/stat work far past the advertised deadline.
+      // the readdir/stat work far past the advertised deadline.
       if (Date.now() - searchStart > MAX_SEARCH_MS || context.signal?.aborted) {
         truncated = true;
         timedOut = true;
@@ -421,7 +423,7 @@ export const codeSearchTool = {
       }
       let entries: import("node:fs").Dirent[];
       try {
-        entries = readdirSync(dir, { withFileTypes: true });
+        entries = await readdir(dir, { withFileTypes: true });
       } catch (err) {
         // A child directory discovered mid-walk is optional — skip it silently.
         // But an explicit directory root that can't be read (e.g. EACCES/EPERM)
@@ -458,18 +460,18 @@ export const codeSearchTool = {
           if (IGNORED_DIRS.has(entry.name)) {
             continue;
           }
-          walk(full);
+          await walk(full);
           continue;
         }
         if (!entry.isFile()) {
           continue;
         }
-        scanFile(full);
+        await scanFile(full);
       }
     };
 
     if (rootStat.isDirectory()) {
-      walk(root, true);
+      await walk(root, true);
       // An explicit directory root that statSync sees but readdirSync can't read
       // (EACCES/EPERM) was never searched — surface a hard error instead of a
       // false "No matches found", mirroring the unreadable explicit-file root.
@@ -487,7 +489,7 @@ export const codeSearchTool = {
           isError: true,
         };
       }
-      scanFile(root, true);
+      await scanFile(root, true);
       if (rootReadError) {
         return { content: rootReadError, isError: true };
       }

package/src/tools/filesystem/write.ts

@@ -129,7 +129,10 @@ export const fileWriteTool = {
       sandboxPolicyWithHostFallback(path, context.workingDir, opts),
     );
 
-    const result = ops.writeFileSafe({ path: rawPath, content: fileContent });
+    const result = await ops.writeFileSafe({
+      path: rawPath,
+      content: fileContent,
+    });
 
     if (!result.ok) {
       const { error } = result;

package/src/tools/host-filesystem/edit.ts

@@ -25,7 +25,12 @@ import type {
  * a non-string (or empty) value means "untargeted".
  */
 export const hostFileEditInputSchema = z.looseObject({
-  path: z.string().min(1).describe("Absolute host path to the file to edit"),
+  path: z
+    .string()
+    .min(1)
+    .describe(
+      "Absolute path on the guardian's device, which is a separate filesystem from your workspace, to edit.",
+    ),
   old_string: z
     .string()
     .min(1, { message: "old_string must not be empty" })
@@ -158,7 +163,7 @@ export const hostFileEditTool = {
 
     const ops = new FileSystemOps(hostPolicy);
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: rawPath,
       oldString,
       newString,

package/src/tools/host-filesystem/read.ts

@@ -10,7 +10,10 @@ import {
   AUDIO_EXTENSIONS,
   readAudioFile,
 } from "../shared/filesystem/audio-read.js";
-import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
+import {
+  DEFAULT_READ_LINE_LIMIT,
+  FileSystemOps,
+} from "../shared/filesystem/file-ops-service.js";
 import {
   IMAGE_EXTENSIONS,
   readImageFile,
@@ -30,12 +33,17 @@ import type {
  * Model-input schema, the single source for both runtime validation (via
  * `TOOL_INPUT_SCHEMAS`) and the advertised `input_schema` below — mirrors
  * `filesystem/read.ts`. `offset`/`limit` catch to `undefined` so a
- * non-numeric value reads the whole file instead of failing the call;
- * `target_client_id` catches so a non-string (or empty) value means
+ * non-numeric value falls back to the default line window instead of failing
+ * the call; `target_client_id` catches so a non-string (or empty) value means
  * "untargeted".
  */
 export const hostFileReadInputSchema = z.looseObject({
-  path: z.string().min(1).describe("Absolute path to the host file to read"),
+  path: z
+    .string()
+    .min(1)
+    .describe(
+      "Absolute path on the guardian's device, which is a separate filesystem from your workspace, to read.",
+    ),
   offset: z
     .number()
     .describe("Line number to start reading from (1-indexed)")
@@ -43,7 +51,7 @@ export const hostFileReadInputSchema = z.looseObject({
     .catch(undefined),
   limit: z
     .number()
-    .describe("Maximum number of lines to read")
+    .describe("Maximum number of lines to read (defaults to 2000)")
     .optional()
     .catch(undefined),
   target_client_id: z
@@ -58,7 +66,7 @@ export const hostFileReadInputSchema = z.looseObject({
 export const hostFileReadTool = {
   name: "host_file_read",
   description:
-    "Read the contents of a file on your guardian's device, including images (JPEG, PNG, GIF, WebP) and audio (MP3, WAV, OGG, FLAC, AAC, M4A). For files on your own machine, use file_read instead.",
+    "Read the contents of a file on your guardian's device, including images (JPEG, PNG, GIF, WebP) and audio (MP3, WAV, OGG, FLAC, AAC, M4A). Text reads return the first 2000 lines unless you pass `limit`; when a read stops short the result says so, and `offset` pages on from there. For files on your own machine, use file_read instead.",
   category: "host-filesystem",
   executionTarget: "host",
   defaultRiskLevel: RiskLevel.Medium,
@@ -73,7 +81,12 @@ export const hostFileReadTool = {
     if (!parsed.success) {
       return invalidToolInputResult("host_file_read", parsed.error);
     }
-    const { path: rawPath, offset, limit } = parsed.data;
+    const { path: rawPath, offset } = parsed.data;
+    // Resolve the default here rather than leaving it to the read, so the
+    // proxied branch below is bounded by the same window as the local one. A
+    // proxied read that sent no limit would stream a whole host file across
+    // the bridge before anything could trim it.
+    const limit = parsed.data.limit ?? DEFAULT_READ_LINE_LIMIT;
 
     const targetClientId =
       parsed.data.target_client_id !== ""
@@ -170,7 +183,7 @@ export const hostFileReadTool = {
 
     const ops = new FileSystemOps(hostPolicy);
 
-    const result = ops.readFileSafe({ path: rawPath, offset, limit });
+    const result = await ops.readFileSafe({ path: rawPath, offset, limit });
 
     if (!result.ok) {
       const { error } = result;

package/src/tools/host-filesystem/write.ts

@@ -24,7 +24,12 @@ import type {
  * non-string (or empty) value means "untargeted".
  */
 export const hostFileWriteInputSchema = z.looseObject({
-  path: z.string().min(1).describe("Absolute host path to the file to write"),
+  path: z
+    .string()
+    .min(1)
+    .describe(
+      "Absolute path on the guardian's device, which is a separate filesystem from your workspace, to write.",
+    ),
   content: z.string().describe("The content to write to the file"),
   target_client_id: z
     .string()
@@ -131,7 +136,10 @@ export const hostFileWriteTool = {
 
     const ops = new FileSystemOps(hostPolicy);
 
-    const result = ops.writeFileSafe({ path: rawPath, content: fileContent });
+    const result = await ops.writeFileSafe({
+      path: rawPath,
+      content: fileContent,
+    });
 
     if (!result.ok) {
       const { error } = result;

package/src/tools/host-terminal/host-shell.ts

@@ -121,7 +121,7 @@ export const hostShellInputSchema = z.looseObject({
     z
       .string()
       .describe(
-        "Optional absolute host working directory (defaults to user home)",
+        "Optional absolute path on the host's filesystem, which is separate from your workspace (defaults to the host user's home).",
       ),
   ),
   timeout_seconds: z
@@ -150,7 +150,7 @@ export const hostShellInputSchema = z.looseObject({
 export const hostShellTool = {
   name: "host_bash",
   description:
-    "LAST RESORT — Execute a shell command directly on the host machine. You MUST strongly prefer the regular `bash` tool for all commands. Only use `host_bash` when you are absolutely certain the command MUST run on the host machine and CANNOT run in the workspace (e.g., managing host-level system services, accessing host-only peripherals, or interacting with host paths outside the workspace). If in doubt, use `bash` instead. Approval-gated: each invocation must be explicitly approved. Do not use for commands that require injected credentials or secrets.",
+    "LAST RESORT — Execute a shell command directly on the host machine. You MUST strongly prefer the regular `bash` tool for all commands. Only use `host_bash` when you are absolutely certain the command MUST run on the host machine and CANNOT run in the workspace (e.g., managing host-level system services, accessing host-only peripherals, or interacting with host paths outside the workspace). If in doubt, use `bash` instead. Paths resolve on the host's filesystem, which is separate from your workspace; write output somewhere on the host and read it back with `host_file_read`. Approval-gated: each invocation must be explicitly approved. Do not use for commands that require injected credentials or secrets.",
   category: "host-terminal",
   executionTarget: "host",
   defaultRiskLevel: RiskLevel.Medium,

package/src/tools/mcp/mcp-tool-factory.ts

@@ -1,4 +1,5 @@
 import type { McpServerConfig } from "../../config/schemas/mcp.js";
+import type { McpToolAnnotations } from "../../mcp/client.js";
 import type { McpServerManager } from "../../mcp/manager.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { toProviderSafeToolName } from "../provider-tool-name.js";
@@ -23,6 +24,29 @@ export interface McpToolMetadata {
   name: string;
   description: string;
   inputSchema: Record<string, unknown>;
+  annotations?: McpToolAnnotations;
+}
+
+/**
+ * Resolve the risk level a tool carries.
+ *
+ * `readOnlyHint` is self-reported by the server, so it only refines risk
+ * downward and only for servers the user has already configured below the
+ * high-trust ceiling. Servers left at the default "high" are unaffected, and
+ * the hint never raises risk above the server default.
+ */
+function resolveRiskLevel(
+  metadata: McpToolMetadata,
+  serverConfig: McpServerConfig,
+): RiskLevel {
+  const serverRisk = riskMap[serverConfig.defaultRiskLevel] ?? RiskLevel.High;
+  if (
+    metadata.annotations?.readOnlyHint === true &&
+    serverRisk !== RiskLevel.High
+  ) {
+    return RiskLevel.Low;
+  }
+  return serverRisk;
 }
 
 /**
@@ -36,7 +60,7 @@ export function createMcpTool(
   manager: McpServerManager,
 ): Tool {
   const namespacedName = mcpToolName(serverId, metadata.name);
-  const riskLevel = riskMap[serverConfig.defaultRiskLevel] ?? RiskLevel.High;
+  const riskLevel = resolveRiskLevel(metadata, serverConfig);
   const serverDefinesActivity = schemaDefinesProperty(
     metadata.inputSchema,
     "activity",

package/src/tools/permission-checker.ts

@@ -104,14 +104,15 @@ export class PermissionChecker {
       toolName: string,
       input: Record<string, unknown>,
       workingDir: string,
-    ) =>
+    ) => Promise<
       | {
           filePath: string;
           oldContent: string;
           newContent: string;
           isNewFile: boolean;
         }
-      | undefined,
+      | undefined
+    >,
   ): Promise<PermissionDecision> {
     // Sandbox/host routing for the prompt comes from the tool's manifest.
     const executionTarget = resolveExecutionTarget(tool);
@@ -378,7 +379,11 @@ export class PermissionChecker {
           };
         }
 
-        const previewDiff = computePreviewDiff(name, input, context.workingDir);
+        const previewDiff = await computePreviewDiff(
+          name,
+          input,
+          context.workingDir,
+        );
         const promptOptions = {
           allowlistOptions: await generateAllowlistOptions(
             name,

package/src/tools/schedule/delete.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { deleteSchedule, getSchedule } from "../../schedule/schedule-store.js";
+import { UserError } from "../../util/errors.js";
 import {
   invalidToolInputResult,
   nullAsOmitted,
@@ -35,7 +36,18 @@ export async function executeScheduleDelete(
     return { content: `Error: Schedule not found: ${jobId}`, isError: true };
   }
 
-  const deleted = await deleteSchedule(jobId);
+  let deleted: boolean;
+  try {
+    deleted = await deleteSchedule(jobId);
+  } catch (err) {
+    // The store refuses to delete plugin-sourced rows with a UserError. That
+    // refusal is an expected outcome for the model to relay, not a daemon
+    // fault to classify as unexpected.
+    if (err instanceof UserError) {
+      return { content: `Error: ${err.message}`, isError: true };
+    }
+    throw err;
+  }
   if (!deleted) {
     return {
       content: `Error: Failed to delete schedule: ${jobId}`,

package/src/tools/schedule/list.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { formatScheduleInferenceProfile } from "../../schedule/inference-profile.js";
 import { hasSetConstructs } from "../../schedule/recurrence-engine.js";
 import {
   describeCronExpression,
@@ -8,6 +9,7 @@ import {
   getScheduleRuns,
   listSchedules,
 } from "../../schedule/schedule-store.js";
+import { describeScheduleSource } from "../../util/schedule-source-key.js";
 import {
   invalidToolInputResult,
   nullAsOmitted,
@@ -77,6 +79,13 @@ export async function executeScheduleList(
       `  Description: ${describeAuthoredPurpose(job)}`,
     ];
 
+    const detailPlugin = describeScheduleSource(job.sourceKey);
+    if (detailPlugin) {
+      lines.push(
+        `  Managed by plugin: ${detailPlugin} (definition read-only; only enabled can be changed)`,
+      );
+    }
+
     if (oneShot) {
       lines.push(`  Fire at: ${formatLocalDate(job.nextRunAt)}`);
     } else {
@@ -93,7 +102,7 @@ export async function executeScheduleList(
       `  Enabled: ${job.enabled}`,
       `  Quiet: ${job.quiet}`,
       `  Reuse conversation: ${job.reuseConversation}`,
-      `  Inference profile: ${job.inferenceProfile ?? "default (mainAgent)"}`,
+      `  Inference profile: ${formatScheduleInferenceProfile(job.inferenceProfile)}`,
       `  Message: ${job.message}`,
     );
 
@@ -142,18 +151,20 @@ export async function executeScheduleList(
   for (const job of jobs) {
     const status = job.enabled ? "enabled" : "disabled";
     const oneShot = isOneShot(job);
+    const plugin = describeScheduleSource(job.sourceKey);
+    const managed = plugin ? ` (managed by plugin ${plugin})` : "";
 
     if (oneShot) {
       const fireTime = formatLocalDate(job.nextRunAt);
       lines.push(
-        `  - [${status}] ${job.name} (id: ${job.id}) (one-shot, ${job.mode}) [${job.status}]`,
+        `  - [${status}] ${job.name} (id: ${job.id}) (one-shot, ${job.mode}) [${job.status}]${managed}`,
         `    Description: ${describeAuthoredPurpose(job)}`,
         `    fire at: ${fireTime}`,
       );
     } else {
       const next = job.enabled ? formatLocalDate(job.nextRunAt) : "n/a";
       lines.push(
-        `  - [${status}] ${job.name} (id: ${job.id}) (${job.mode})`,
+        `  - [${status}] ${job.name} (id: ${job.id}) (${job.mode})${managed}`,
         `    Description: ${describeAuthoredPurpose(job)}`,
         `    Schedule: [${job.syntax}] ${describeSchedule(job)}`,
         `    Next: ${next}`,