@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/runtime/routes/mcp-auth-routes.ts

@@ -19,6 +19,7 @@ import type { McpConfig, McpServerConfig } from "../../config/schemas/mcp.js";
 import { estimateToolDefinitionTokens } from "../../context/token-estimator.js";
 import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
 import { McpClient } from "../../mcp/client.js";
+import { getMcpServerManager } from "../../mcp/manager.js";
 import { orchestrateMcpOAuthConnect } from "../../mcp/mcp-auth-orchestrator.js";
 import { getMcpAuthState } from "../../mcp/mcp-auth-state.js";
 import {
@@ -30,6 +31,7 @@ import {
   deleteMcpOAuthCredentials,
   hasMcpOAuthTokens,
 } from "../../mcp/mcp-oauth-provider.js";
+import { readPluginMcpServers } from "../../plugins/mcp-servers.js";
 import { getMcpToolsByServer } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
@@ -224,8 +226,33 @@ interface McpServerEntry {
   authHeaderName?: string;
   allowedTools?: string[];
   blockedTools?: string[];
+  /**
+   * Where the definition came from: the workspace `config.json` or a
+   * plugin's `mcp.json`. A plugin server is read-only from the CLI's
+   * perspective, since `mcp remove` and `mcp update` act on the workspace
+   * config, so the caller needs to be able to tell the two apart.
+   */
+  source: "workspace" | "plugin";
+  /** Plugin that declared this server. Present only when `source` is `plugin`. */
+  pluginName?: string;
 }
 
+/**
+ * Status reported for a plugin-declared server the MCP manager holds no
+ * live client for — it has not been started yet, or its connection failed.
+ *
+ * A plugin server is never health-checked the way a workspace server is.
+ * `checkMachineReadableHealth` constructs its own `McpClient`, which
+ * resolves `mcp:<serverId>:headers` and `mcp:<serverId>:tokens` from the
+ * credential store, and a plugin controls both its server key and its URL,
+ * so probing one would send workspace-owned credentials to an endpoint the
+ * plugin chose whenever an id happens to match a stored key. Skipping the
+ * probe also avoids spawning a plugin's declared stdio command as a side
+ * effect of listing. The manager's own client — started with credentials
+ * isolated — is the only thing consulted instead.
+ */
+const PLUGIN_SERVER_STATUS = "declared";
+
 function detectAuthType(headers: Record<string, string>): "bearer" | "api-key" {
   const authValue = headers["Authorization"] ?? headers["authorization"];
   if (authValue?.startsWith("Bearer ")) {
@@ -240,65 +267,129 @@ async function handleMcpList(_args: {
   const raw = loadRawConfig();
   const mcpConfig = raw.mcp as Partial<McpConfig> | undefined;
   const servers = mcpConfig?.servers ?? {};
-  const entries = Object.entries(servers) as [string, McpServerConfig][];
-
-  const results: McpServerEntry[] = await Promise.all(
-    entries
-      .filter(([, config]) => config && typeof config === "object")
-      .map(async ([id, config]) => {
-        const enabled = config.enabled !== false;
-        let status: string;
-        if (!enabled) {
-          status = "disabled";
-        } else {
-          status = await checkMachineReadableHealth(id, config);
-        }
-        const hasOAuth =
-          config.transport.type !== "stdio"
-            ? await hasMcpOAuthTokens(id)
-            : false;
-
-        // Check credential store for stored static auth headers
-        const storedHeaders = await getMcpHeaders(id);
-        // Also check legacy config-level headers
-        const configHeaders =
-          config.transport.type !== "stdio"
-            ? config.transport.headers
-            : undefined;
-        const effectiveHeaders = storedHeaders ?? configHeaders;
-        const hasStaticAuth =
-          !!effectiveHeaders && Object.keys(effectiveHeaders).length > 0;
-        const authType: "none" | "bearer" | "api-key" = hasStaticAuth
-          ? detectAuthType(effectiveHeaders!)
-          : "none";
-        const authHeaderName =
-          authType === "api-key" && effectiveHeaders
-            ? Object.keys(effectiveHeaders).find(
-                (k) => k.toLowerCase() !== "authorization",
-              )
-            : undefined;
-
-        // Strip headers from transport — never return secrets
-        const { headers: _stripped, ...safeTransport } =
-          config.transport as Record<string, unknown>;
-
-        return {
-          id,
-          status,
-          transport: safeTransport as McpServerEntry["transport"],
-          enabled,
-          defaultRiskLevel: config.defaultRiskLevel ?? "high",
-          hasOAuth,
-          hasStaticAuth,
-          authType,
-          ...(authHeaderName && { authHeaderName }),
-          ...(config.allowedTools && { allowedTools: config.allowedTools }),
-          ...(config.blockedTools && { blockedTools: config.blockedTools }),
-        };
-      }),
+  const configEntries = (
+    Object.entries(servers) as [string, McpServerConfig][]
+  ).filter(([, config]) => config && typeof config === "object");
+
+  const workspaceEntries: McpServerEntry[] = await Promise.all(
+    configEntries.map(async ([id, config]) => {
+      const enabled = config.enabled !== false;
+      let status: string;
+      if (!enabled) {
+        status = "disabled";
+      } else {
+        status = await checkMachineReadableHealth(id, config);
+      }
+      const hasOAuth =
+        config.transport.type !== "stdio" ? await hasMcpOAuthTokens(id) : false;
+
+      // Check credential store for stored static auth headers
+      const storedHeaders = await getMcpHeaders(id);
+      // Also check legacy config-level headers
+      const configHeaders =
+        config.transport.type !== "stdio"
+          ? config.transport.headers
+          : undefined;
+      const effectiveHeaders = storedHeaders ?? configHeaders;
+      const hasStaticAuth =
+        !!effectiveHeaders && Object.keys(effectiveHeaders).length > 0;
+      const authType: "none" | "bearer" | "api-key" = hasStaticAuth
+        ? detectAuthType(effectiveHeaders!)
+        : "none";
+      const authHeaderName =
+        authType === "api-key" && effectiveHeaders
+          ? Object.keys(effectiveHeaders).find(
+              (k) => k.toLowerCase() !== "authorization",
+            )
+          : undefined;
+
+      // Strip headers from transport, never return secrets
+      const { headers: _stripped, ...safeTransport } =
+        config.transport as Record<string, unknown>;
+
+      return {
+        id,
+        status,
+        transport: safeTransport as McpServerEntry["transport"],
+        enabled,
+        defaultRiskLevel: config.defaultRiskLevel ?? "high",
+        hasOAuth,
+        hasStaticAuth,
+        authType,
+        ...(authHeaderName && { authHeaderName }),
+        ...(config.allowedTools && { allowedTools: config.allowedTools }),
+        ...(config.blockedTools && { blockedTools: config.blockedTools }),
+        source: "workspace" as const,
+      };
+    }),
   );
 
-  return { servers: results };
+  return {
+    servers: [...workspaceEntries, ...listPluginServerEntries(configEntries)],
+  };
+}
+
+/**
+ * Project plugin-declared servers onto listing entries.
+ *
+ * Nothing here touches the credential store or the network: a plugin
+ * server carries no auth state the assistant owns, and its status comes
+ * from the manager's in-memory client rather than a probe (see
+ * {@link PLUGIN_SERVER_STATUS}).
+ */
+function listPluginServerEntries(
+  configEntries: [string, McpServerConfig][],
+): McpServerEntry[] {
+  const { servers, issues } = readPluginMcpServers();
+  for (const issue of issues) {
+    log.warn(
+      {
+        plugin: issue.pluginName,
+        ...(issue.serverKey && { serverKey: issue.serverKey }),
+      },
+      `Plugin MCP declaration problem: ${issue.message}`,
+    );
+  }
+
+  // A workspace entry outranks a plugin's declaration of the same id: the
+  // user's own configuration is the more specific statement, and it is the
+  // one they can edit. `buildEffectiveMcpConfig` applies the same
+  // precedence, so this listing describes the set the daemon actually runs.
+  const workspaceIds = new Set(configEntries.map(([id]) => id));
+  const manager = getMcpServerManager();
+
+  return servers
+    .filter((server) => {
+      if (!workspaceIds.has(server.id)) {
+        return true;
+      }
+      log.warn(
+        { plugin: server.pluginName, serverId: server.id },
+        "Plugin MCP server shadowed by a workspace server of the same id; skipping",
+      );
+      return false;
+    })
+    .map((server) => {
+      const { headers: _stripped, ...safeTransport } = server.config
+        .transport as Record<string, unknown>;
+      return {
+        id: server.id,
+        status: manager.getClient(server.id)?.isConnected
+          ? "connected"
+          : PLUGIN_SERVER_STATUS,
+        transport: safeTransport as McpServerEntry["transport"],
+        enabled: true,
+        defaultRiskLevel: server.config.defaultRiskLevel,
+        // A plugin server has no assistant-owned credentials. Resolving
+        // these against `mcp:<id>:*` would report, and could disclose, a
+        // workspace credential that happens to share the id.
+        hasOAuth: false,
+        hasStaticAuth: false,
+        authType: "none" as const,
+        source: "plugin" as const,
+        pluginName: server.pluginName,
+      };
+    });
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/playground/__tests__/inject-failures.test.ts

@@ -47,6 +47,7 @@ interface MockConversation {
   contextCompactedAt: number | null;
   sentMessages: AssistantEvent[];
   sendToClient: (msg: AssistantEvent) => void;
+  emit: (msg: AssistantEvent) => void;
   getMessages: () => unknown[];
 }
 
@@ -64,6 +65,7 @@ function makeConversation(id = "conv-playground-test"): MockConversation {
     contextCompactedAt: null,
     sentMessages,
     sendToClient: (msg) => sentMessages.push(msg),
+    emit: (msg) => sentMessages.push(msg),
     getMessages: () => [],
   };
 }

package/src/runtime/routes/playground/__tests__/reset-circuit.test.ts

@@ -75,6 +75,9 @@ function makeFakeConversation(
     sendToClient: (msg: AssistantEvent) => {
       sent.push(msg);
     },
+    emit: (msg: AssistantEvent) => {
+      sent.push(msg);
+    },
   } as unknown as Conversation;
 
   return { conversation: fake, sent, state };

package/src/runtime/routes/playground/inject-failures.ts

@@ -72,7 +72,7 @@ export const ROUTES: RouteDefinition[] = [
         if (circuitOpenForMs === 0) {
           if (circuit.compactionCircuitOpenUntil !== null) {
             circuit.compactionCircuitOpenUntil = null;
-            conversation.sendToClient({
+            conversation.emit({
               type: "compaction_circuit_closed",
               conversationId: conversation.conversationId,
             });
@@ -80,7 +80,7 @@ export const ROUTES: RouteDefinition[] = [
         } else {
           const openUntil = Date.now() + circuitOpenForMs;
           circuit.compactionCircuitOpenUntil = openUntil;
-          conversation.sendToClient({
+          conversation.emit({
             type: "compaction_circuit_open",
             conversationId: conversation.conversationId,
             reason: "3_consecutive_failures",

package/src/runtime/routes/playground/reset-circuit.ts

@@ -52,7 +52,7 @@ export const ROUTES: RouteDefinition[] = [
       circuit.consecutiveCompactionFailures = 0;
       if (circuit.compactionCircuitOpenUntil !== null) {
         circuit.compactionCircuitOpenUntil = null;
-        conversation.sendToClient({
+        conversation.emit({
           type: "compaction_circuit_closed",
           conversationId: conversation.conversationId,
         });

package/src/runtime/routes/plugins-routes.ts

@@ -85,6 +85,7 @@ import {
 } from "../../cli/lib/uninstall-plugin.js";
 import {
   PluginMergeBaselineError,
+  PluginNotCuratedError,
   PluginNotUpgradableError,
   upgradePlugin,
 } from "../../cli/lib/upgrade-plugin.js";
@@ -606,6 +607,12 @@ const pluginUpgradeRequestSchema = z.object({
     .describe(
       "How to reconcile local edits with the pin. `overwrite` (default) discards local edits and re-installs the pin; `ours`/`theirs` three-way merge, resolving conflicting hunks toward the local edit or the pin respectively; `assistant` is not yet supported.",
     ),
+  marketplaceOnly: z
+    .boolean()
+    .optional()
+    .describe(
+      "Refuse the upgrade (409) when the marketplace does not claim this plugin, instead of advancing it to whatever its recorded GitHub ref now resolves to. Set by unattended callers such as the automatic update sweep, for which running code no curator reviewed is never an acceptable outcome. Defaults to false.",
+    ),
 });
 
 const pluginUpgradeResponseSchema = z.object({
@@ -1465,6 +1472,11 @@ async function handleUpgradePlugin({
     typeof body.strategy === "string"
       ? (body.strategy as PluginUpgradeStrategy)
       : undefined;
+  // Enforced here, not just by whoever decided to call: `upgradePlugin` fetches
+  // the catalog itself, so an entry that vanishes between a caller's own check
+  // and this handler would otherwise reroute a curated upgrade onto the
+  // install's mutable recorded ref.
+  const marketplaceOnly = body.marketplaceOnly === true;
 
   // Like install, the upgrade target ref is the curated marketplace pin
   // (resolved inside `upgradePlugin` via `inspectPlugin`), never a
@@ -1498,7 +1510,7 @@ async function handleUpgradePlugin({
     // upgraded revision adds is surfaced to the user by the schedule
     // reconciler's `schedule.declared` notification when it arms.
     const result = await upgradePlugin(
-      { name, dryRun, strategy },
+      { name, dryRun, strategy, marketplaceOnly },
       {
         fetch: globalThis.fetch.bind(globalThis),
         // Tear the old version down BEFORE the staged tree replaces its
@@ -1568,6 +1580,12 @@ async function handleUpgradePlugin({
     if (err instanceof PluginNotUpgradableError) {
       throw new ConflictError(err.message);
     }
+    // A `marketplaceOnly` caller asked about an install the catalog does not
+    // claim. Retrying changes nothing; only a human upgrading it deliberately
+    // (without the flag) can move it, so 409 rather than a retryable 503.
+    if (err instanceof PluginNotCuratedError) {
+      throw new ConflictError(err.message);
+    }
     // A rate-limited or temporarily-down source (the plugin repo or the
     // marketplace catalog) is a retryable outage, not a conflict — 503.
     if (err instanceof PluginSourceUnavailableError) {
@@ -1625,7 +1643,7 @@ function mapTogglePluginError(err: unknown): RouteError {
 
 /**
  * Converge plugin-declared schedules against the sentinel this route just
- * wrote, so a toggled plugin's rows disarm or re-arm now rather than at the
+ * wrote, so a disabled plugin's rows disarm now rather than at the
  * reconciler's next backstop sweep.
  *
  * Fire-and-forget: the toggle itself already succeeded on disk, so a reconcile
@@ -1653,15 +1671,27 @@ function reconcilePluginSchedulesInBackground(): void {
  * names WHICH resource is stale, not the new value. The origin client id is
  * threaded through for self-echo suppression.
  */
-function handleEnablePlugin({ pathParams = {}, headers }: RouteHandlerArgs) {
+async function handleEnablePlugin({
+  pathParams = {},
+  headers,
+}: RouteHandlerArgs) {
   try {
     enablePlugin(pathParams.name ?? "");
-    publishPluginsChanged(getOriginClientId(headers));
-    reconcilePluginSchedulesInBackground();
-    return { ok: true };
   } catch (err) {
     throw mapTogglePluginError(err);
   }
+  // A plugin the boot scan skipped for its sentinel has no hooks, tools or
+  // MCP servers in the caches, so clearing the sentinel is not enough to
+  // bring it up. Run the same imperative source reconcile the install and
+  // upgrade routes use, which activates the plugin and then converges its
+  // schedules and MCP servers. Awaited, like the install route, so a client
+  // that lists tools right after enabling sees the plugin up; the reconcile
+  // contains its own failures, so a broken plugin cannot turn a successful
+  // enable into a route error. The invalidation publishes after it for the
+  // same reason: refetching clients should see the post-activation state.
+  await reconcilePluginSourcesNow();
+  publishPluginsChanged(getOriginClientId(headers));
+  return { ok: true };
 }
 
 function handleDisablePlugin({ pathParams = {}, headers }: RouteHandlerArgs) {
@@ -2039,7 +2069,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Upgrade a plugin to its source's current revision",
     description:
-      'Move an installed plugin to its source\'s current revision, re-materializing it under `<workspaceDir>/plugins/<name>/`. A marketplace plugin advances to the curated pin; a plugin installed directly from a GitHub URL (untrusted, not in the marketplace) advances to whatever its recorded ref now resolves to — a pinned SHA is immutable (a no-op), a branch/tag/HEAD moves as upstream does — re-materialized verbatim with no curated adapter overlay, exactly as the original untrusted install was. The target ref is never taken from the request (no caller-supplied ref), mirroring `plugins install`\'s curation boundary. A no-op (`outcome: "already-up-to-date"`) when the installed commit already equals the target; pass `dryRun` to preview the move (`outcome: "would-upgrade"`) without touching the install. Installs lacking provenance are re-pinned to the current SHA. The upgraded code is picked up live on the next read (no restart required). `strategy` controls how local edits are reconciled: `overwrite` (default) discards them and re-installs the target wholesale; `ours`/`theirs`/`assistant` perform a three-way merge against the re-materialized install commit, carrying non-conflicting edits from both sides forward and resolving conflicting hunks toward the local edit (`ours`) or the target (`theirs`), or writing git conflict markers into the file and reporting them in `conflicts`/`binaryConflicts` for the assistant to resolve (`assistant`). A merge strategy whose install-time baseline cannot be reconstructed returns 409. Mirrors the CLI\'s `assistant plugins upgrade <name> [--strategy <s>]`.',
+      'Move an installed plugin to its source\'s current revision, re-materializing it under `<workspaceDir>/plugins/<name>/`. A marketplace plugin advances to the curated pin; a plugin installed directly from a GitHub URL (untrusted, not in the marketplace) advances to whatever its recorded ref now resolves to — a pinned SHA is immutable (a no-op), a branch/tag/HEAD moves as upstream does — re-materialized verbatim with no curated adapter overlay, exactly as the original untrusted install was. The target ref is never taken from the request (no caller-supplied ref), mirroring `plugins install`\'s curation boundary. A no-op (`outcome: "already-up-to-date"`) when the installed commit already equals the target; pass `dryRun` to preview the move (`outcome: "would-upgrade"`) without touching the install. Installs lacking provenance are re-pinned to the current SHA. The upgraded code is picked up live on the next read (no restart required). `strategy` controls how local edits are reconciled: `overwrite` (default) discards them and re-installs the target wholesale; `ours`/`theirs`/`assistant` perform a three-way merge against the re-materialized install commit, carrying non-conflicting edits from both sides forward and resolving conflicting hunks toward the local edit (`ours`) or the target (`theirs`), or writing git conflict markers into the file and reporting them in `conflicts`/`binaryConflicts` for the assistant to resolve (`assistant`). A merge strategy whose install-time baseline cannot be reconstructed returns 409. Pass `marketplaceOnly` to refuse the untrusted direct path outright (409), which is what the unattended auto-update sweep does. Mirrors the CLI\'s `assistant plugins upgrade <name> [--strategy <s>]`.',
     tags: ["plugins"],
     pathParams: [
       {
@@ -2062,7 +2092,7 @@ export const ROUTES: RouteDefinition[] = [
       },
       "409": {
         description:
-          "The install has neither a marketplace entry nor a recorded GitHub source to advance to, or a merge strategy was requested whose install-time baseline cannot be reconstructed.",
+          "The install has neither a marketplace entry nor a recorded GitHub source to advance to, a `marketplaceOnly` upgrade was requested for an install the marketplace does not claim, or a merge strategy was requested whose install-time baseline cannot be reconstructed.",
       },
       "503": {
         description:

package/src/runtime/routes/schedule-routes.ts

@@ -5,6 +5,9 @@
  * the shared ROUTES array.
  */
 
+import { statSync } from "node:fs";
+import { join } from "node:path";
+
 import { z } from "zod";
 
 import { getOrCreateConversation } from "../../daemon/conversation-store.js";
@@ -15,9 +18,10 @@ import {
   getUsageCostForRun,
   listRunConversationIds,
 } from "../../persistence/llm-usage-store.js";
+import { isPluginDisabled } from "../../plugins/disabled-state.js";
 import { isDeferSchedule } from "../../schedule/defer-provenance.js";
 import { validateScheduleInferenceProfile } from "../../schedule/inference-profile.js";
-import { declarationExistsOnDisk } from "../../schedule/plugin-schedule-declarations.js";
+import { pluginScheduleSourceAvailable } from "../../schedule/plugin-schedule-availability.js";
 import { isPluginSchedulesEnabled } from "../../schedule/plugin-schedules-gate.js";
 import {
   describeRRuleExpression,
@@ -38,6 +42,7 @@ import {
   getLastScheduleConversationId,
   getSchedule,
   getScheduleRuns,
+  isEngineLatched,
   listSchedules,
   resolveScheduleConversationGroupId,
   type ScheduleJob,
@@ -49,6 +54,7 @@ import { buildWakeScheduleOptions } from "../../schedule/wake-schedule-options.j
 import { initializeTools } from "../../tools/registry.js";
 import { UserError } from "../../util/errors.js";
 import { getLogger } from "../../util/logger.js";
+import { getWorkspacePluginsDir } from "../../util/platform.js";
 import { normalizeCapabilityManifest } from "../../workflows/capabilities.js";
 import { getWorkflowRunManager } from "../../workflows/run-manager.js";
 import { isOwnerCaller } from "../auth/owner-caller.js";
@@ -108,6 +114,76 @@ async function assertWakeMutationAllowed(
 // Response schemas (shared by all schedule routes)
 // ---------------------------------------------------------------------------
 
+const DISARM_REASONS = [
+  "user_disabled",
+  "plugin_removed",
+  "plugin_disabled",
+  "declaration_removed",
+  "declaration_disabled",
+] as const;
+
+type DisarmReason = (typeof DISARM_REASONS)[number];
+
+/**
+ * Why a plugin-sourced schedule sits disarmed, so a client can say so instead
+ * of showing an off row with no explanation.
+ *
+ * Only a sourced row that is off can have one, which also bounds the disk
+ * probes below to those rows. The first matching cause wins, ordered so the
+ * most specific answer comes first: the user's own override outranks anything
+ * the plugin's files say, a plugin that is gone outranks one that is merely
+ * disabled, and a declaration that is gone outranks one that is still there.
+ * `declaration_disabled` is the fallback the plugin's own files account for:
+ * a declared `enabled: false`, a declaration too broken to arm, or a manifest
+ * that no longer parses.
+ *
+ * Two off states never get a reason, because in neither did the plugin's files
+ * turn the schedule off. A row the engine latched (a fired or cancelled
+ * one-shot, a bounded recurrence the claim path exhausted) is a schedule that
+ * finished, not one that is paused. And when the `plugin-schedules` kill switch
+ * is off the reconciler disarms every sourced row regardless of what its
+ * declaration says, so no per-row cause is the true one. Both return null, and
+ * clients show the row like any other schedule that is off.
+ */
+function deriveDisarmReason(
+  job: Pick<
+    ScheduleJob,
+    | "sourceKey"
+    | "enabled"
+    | "userEnabled"
+    | "status"
+    | "nextRunAt"
+    | "lastRunAt"
+  >,
+): DisarmReason | null {
+  if (job.sourceKey === null || job.enabled) {
+    return null;
+  }
+  if (job.userEnabled === false) {
+    return "user_disabled";
+  }
+  if (isEngineLatched(job) || !isPluginSchedulesEnabled()) {
+    return null;
+  }
+  const match = /^plugin:([^/]+)\/(.+)$/.exec(job.sourceKey);
+  if (!match) {
+    return null;
+  }
+  const [, pluginName, scheduleName] = match;
+  const pluginDir = join(getWorkspacePluginsDir(), pluginName!);
+  if (!statSync(pluginDir, { throwIfNoEntry: false })?.isDirectory()) {
+    return "plugin_removed";
+  }
+  if (isPluginDisabled(pluginName!)) {
+    return "plugin_disabled";
+  }
+  const declarationDir = join(pluginDir, "schedules", scheduleName!);
+  if (!statSync(declarationDir, { throwIfNoEntry: false })?.isDirectory()) {
+    return "declaration_removed";
+  }
+  return "declaration_disabled";
+}
+
 const scheduleSchema = z.object({
   id: z.string(),
   name: z.string(),
@@ -150,6 +226,12 @@ const scheduleSchema = z.object({
     .describe(
       "User enable/disable override on a plugin-sourced schedule; null when the declaration's own enabled value applies. Always null for user-created schedules.",
     ),
+  disarmReason: z
+    .enum(DISARM_REASONS)
+    .nullable()
+    .describe(
+      "Why a plugin-sourced schedule is off: the user turned it off, the plugin is gone, the plugin is disabled, the declaration is gone, or the plugin's own files turned it off. Null whenever the schedule is on, and always null for user-created schedules.",
+    ),
   isOneShot: z.boolean(),
   // A deferred wake ("remind me about this tomorrow") is an ordinary schedule
   // row created by the defer path, distinguishable only by `createdBy`, which
@@ -302,6 +384,7 @@ function serializeSchedule(
     workflowName: j.workflowName,
     sourceKey: j.sourceKey,
     userEnabled: j.userEnabled,
+    disarmReason: deriveDisarmReason(j),
     isOneShot: isOneShotForDisplay(j),
     isDeferred: isDeferSchedule(j.createdBy),
   };
@@ -1240,15 +1323,19 @@ async function handleRunScheduleNow(
 
   // A plugin-sourced row runs the plugin's own script or prompt, so run-now is
   // only offered while that plugin is something the runtime would activate.
-  // `declarationExistsOnDisk` is the same probe the enable path uses: it covers
-  // a disabled plugin, an unreadable or invalid manifest, and a declaration
-  // that is simply gone. Turning the feature flag off retires the surface
-  // wholesale and takes the same path. The row can still be armed at this
-  // point, because the reconciler that disarms it runs on its own schedule.
+  // `pluginScheduleSourceAvailable` covers a plugin the daemon never
+  // activated, a disabled plugin, an unreadable or invalid manifest, and a
+  // declaration that is simply gone. Turning the feature flag off retires the
+  // surface wholesale and takes the same path. The row can still be armed at
+  // this point, because the reconciler that disarms it runs on its own
+  // schedule.
+  // Routes are served by the daemon, so the activation half of the probe reads
+  // a live ledger here. Paths that run in worker processes cannot ask that
+  // question and use the on-disk probe alone.
   if (
     schedule.sourceKey !== null &&
     (!isPluginSchedulesEnabled() ||
-      !(await declarationExistsOnDisk(schedule.sourceKey)))
+      !(await pluginScheduleSourceAvailable(schedule.sourceKey)))
   ) {
     throw new BadRequestError(
       "This schedule's plugin is disabled or no longer declares it, so it cannot be run.",

package/src/runtime/routes/settings-routes.ts

@@ -37,7 +37,6 @@ import {
 import {
   check,
   classifyRisk,
-  generateAllowlistOptions,
   generateScopeOptions,
 } from "../../permissions/checker.js";
 import { resolveGuardianPersonaPath } from "../../prompts/persona-resolver.js";
@@ -710,19 +709,22 @@ async function handleToolPermissionSimulate({ body = {} }: RouteHandlerArgs) {
       isInteractive === false ? "headless" : "conversation";
     const policyContext = { executionTarget, executionContext } as const;
 
-    const { level: riskLevel } = await classifyRisk(
+    const classification = await classifyRisk(
       toolName,
       input,
       workingDir,
       undefined,
       manifestOverride,
     );
+    const riskLevel = classification.level;
     const result = await check(
       toolName,
       input,
       workingDir,
       policyContext,
       manifestOverride,
+      undefined,
+      classification,
     );
 
     if (isInteractive === false && result.decision === "prompt") {
@@ -743,11 +745,9 @@ async function handleToolPermissionSimulate({ body = {} }: RouteHandlerArgs) {
       | undefined;
 
     if (result.decision === "prompt") {
-      const allowlistOptions = await generateAllowlistOptions(toolName, input);
-      const scopeOptions = generateScopeOptions(workingDir, toolName);
       promptPayload = {
-        allowlistOptions,
-        scopeOptions,
+        allowlistOptions: classification.allowlistOptions ?? [],
+        scopeOptions: generateScopeOptions(workingDir, toolName),
         persistentDecisionsAllowed: true,
       };
     }