@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/tools/subagent/spawn.ts

@@ -5,20 +5,18 @@ import { validateInferenceProfileKey } from "../../config/inference-profile-vali
 import { getConfig } from "../../config/loader.js";
 import { profileSupportsTools } from "../../config/profile-tool-support.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
-import { getMessages } from "../../persistence/conversation-crud.js";
 import {
   countRecentSimilarSpawns,
   normalizeSpawnObjective,
   type RecentSimilarSpawns,
   type SimilarSpawnTally,
 } from "../../persistence/subagent-store.js";
-import type { ContentBlock, Message } from "../../providers/types.js";
+import type { Message } from "../../providers/types.js";
 import { buildAdvisorContext } from "../../subagent/consult-context.js";
 import {
   advisorRequestText,
   buildAdvisorSystem,
 } from "../../subagent/consult-prompt.js";
-import { sanitizeConsultTranscript } from "../../subagent/consult-transcript.js";
 import {
   getSubagentManager,
   SubagentAbortedError,
@@ -49,7 +47,7 @@ const log = getLogger("subagent-spawn");
  * reasoning while it works, so a fixed wall-clock ceiling would kill it
  * mid-thought; an idle window instead fires only when the consult is genuinely
  * stalled (or never starts). Generous enough to also span time-to-first-token
- * over a large inherited transcript.
+ * on a slow reasoning profile.
  */
 const ADVISOR_IDLE_TIMEOUT_MS = 60_000;
 
@@ -540,13 +538,19 @@ function inFlightGuardResult(
 // ── Advisor consult ──────────────────────────────────────────────────
 
 /**
- * Run the `advisor` role as a synchronous, context-inheriting, stronger-model
- * consult and return its guidance as the tool result.
+ * Run the `advisor` role as a synchronous, stronger-model consult and return
+ * its guidance as the tool result.
  *
- * Inherits the parent transcript (sanitized), frames it as advice via
- * `buildAdvisorSystem`, and runs on `llm.advisorProfile` (unless the caller
- * passed an explicit `inference_profile`) under both the advisor role allowlist
- * and `denySideEffectTools`, so the only tools it can reach are the first-party
+ * The consult sees only what it is handed: the spawning agent's own `objective`
+ * as a written brief, plus the situational context pack from
+ * `buildAdvisorContext`. Nothing of the parent conversation's transcript or
+ * system prompt travels with it, so a consult costs the brief rather than a
+ * re-prefill of the whole chat at premium rates.
+ *
+ * It is framed as advice via `buildAdvisorSystem` and runs on
+ * `llm.advisorProfile` (unless the caller passed an explicit
+ * `inference_profile`) under both the advisor role allowlist and
+ * `denySideEffectTools`, so the only tools it can reach are the first-party
  * built-in readers. It is bounded on two axes, because the consult holds up the
  * user-facing turn while it runs: a progress-aware deadline (an idle window,
  * `ADVISOR_IDLE_TIMEOUT_MS`, reset on every streamed token and every tool event
@@ -562,7 +566,7 @@ function inFlightGuardResult(
 async function runAdvisorConsult(args: {
   context: ToolContext;
   label: string;
-  /** The agent's own `objective` — its framing of what it wants advised on. */
+  /** The agent's own `objective`: the brief the advisor advises off. */
   objective: string;
   sendToClient: (msg: AssistantEvent) => void;
   requestedOverrideProfile: string | undefined;
@@ -576,35 +580,16 @@ async function runAdvisorConsult(args: {
   let profileNote: string | undefined;
 
   try {
+    // The parent conversation is looked up only for its warm skill catalog, so
+    // an unresolvable one (e.g. evicted) costs the skills section of the pack
+    // and nothing else: the consult itself runs off the brief.
     const parentConversation = findConversation(context.conversationId);
-    if (!parentConversation) {
-      return {
-        content:
-          "(advisor unavailable: parent conversation could not be resolved)",
-        isError: false,
-      };
-    }
-
-    // Snapshot the parent's in-memory transcript and system prompt, then append
-    // the in-flight assistant turn (the plan/text the model wrote THIS turn,
-    // before calling the advisor). The in-memory array does not yet hold that
-    // turn — the agent loop only writes it back to `conversation.messages` after
-    // the turn settles — but it is already persisted to the DB (the assistant
-    // row is finalized at `message_complete`, which fires before tool execution).
-    // `sanitizeConsultTranscript` then strips the dangling advisor `tool_use`
-    // off that final assistant turn so the inherited transcript is provider-safe.
-    const parentSystemPrompt = parentConversation.getCurrentSystemPrompt();
-    const withInFlight = appendInFlightAssistantTurn(
-      [...parentConversation.messages],
-      context.conversationId,
-    );
-    const sanitizedMessages = sanitizeConsultTranscript(withInFlight);
 
     // Situational awareness for the advisor: the parent's live tool set, the
     // full skill catalog, and its workspace. Assembled off the per-turn
     // ToolContext snapshot (trust, channel) so the personal-memory sections
     // are gated exactly like the runtime injectors. Best-effort: a null pack
-    // just means the consult runs on transcript + system prompt alone.
+    // just means the consult runs on the brief alone.
     const situationalContext = await buildAdvisorContext({
       conversationId: context.conversationId,
       workingDir: context.workingDir,
@@ -614,7 +599,7 @@ async function runAdvisorConsult(args: {
       enabledPluginSet: context.enabledPluginSet,
       // The parent's warm per-turn catalog keeps the synchronous on-disk
       // catalog scan out of the consult path.
-      skillCatalog: parentConversation.skillProjectionCache?.catalog,
+      skillCatalog: parentConversation?.skillProjectionCache?.catalog,
     });
 
     // Default to the stronger advisor profile when the caller did not pin one;
@@ -623,7 +608,7 @@ async function runAdvisorConsult(args: {
     let overrideProfile = requestedOverrideProfile ?? config.llm.advisorProfile;
     // The advisor carries read tools, so a profile the catalog states cannot
     // call them is handed a surface it can never use and answers from the
-    // transcript alone. Fall back to the call site's own default and say so
+    // brief alone. Fall back to the call site's own default and say so
     // alongside the guidance, the way a regular spawn reports it. The check is
     // unconditional, matching the tools it protects, and only a catalog `false`
     // redirects, so a model the catalog has never heard of is left alone.
@@ -697,16 +682,15 @@ async function runAdvisorConsult(args: {
         {
           parentConversationId: context.conversationId,
           label,
-          // Carry the agent's own objective into the consult request — the
-          // agent states the task here, and the inherited transcript can be
-          // thin. The situational pack rides in the model request only
-          // (`requestText`), keeping the system prompt minimal and the
-          // display-facing `objective` free of bulky internal context.
+          // The agent's own objective IS the brief the consult runs on, so it
+          // carries into the request verbatim. The situational pack rides in
+          // the model request only (`requestText`), keeping the system prompt
+          // minimal and the display-facing `objective` free of bulky internal
+          // context.
           objective: advisorRequestText(objective),
           requestText: advisorRequestText(objective, situationalContext),
           sendResultToUser: false,
           role: "advisor",
-          fork: true,
           // The advisor's read-only guarantee cannot rest on tool NAMES. A
           // workspace tool may register under `file_read` (registerWorkspaceTools
           // stashes the built-in and installs its own implementation), and a
@@ -718,10 +702,9 @@ async function runAdvisorConsult(args: {
           //
           // The advisor is a ROLE, not an `LLMCallSiteEnum` value, so its usage
           // lands under `subagentSpawn` like any other subagent. This is what
-          // makes advisor consults separable from regular forks in telemetry.
+          // makes advisor consults separable from regular spawns in telemetry.
           spawnMode: "advisor_consult",
-          parentMessages: sanitizedMessages,
-          systemPromptOverride: buildAdvisorSystem(parentSystemPrompt),
+          systemPromptOverride: buildAdvisorSystem(),
           ...(overrideProfile ? { overrideProfile } : {}),
           ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
           // A consult is delegated work of the invoking turn, so its spend
@@ -817,46 +800,3 @@ function withAdvisorNote(
   }
   return `${guidance}\n\n${present.map((note) => `_(${note})_`).join("\n")}`;
 }
-
-/**
- * Append the in-flight assistant turn (persisted this turn before the advisor
- * tool ran) to an in-memory message snapshot, unless the snapshot already ends
- * with it. The latest persisted assistant row carries the plan/text the model
- * wrote immediately before calling the advisor plus the dangling advisor
- * `tool_use`; `sanitizeConsultTranscript` strips the dangling call.
- *
- * Best-effort: a malformed or missing row leaves the snapshot unchanged so the
- * consult still runs over the in-memory history.
- */
-function appendInFlightAssistantTurn(
-  messages: Message[],
-  conversationId: string,
-): Message[] {
-  // When the snapshot already ends on an assistant turn, the in-flight turn is
-  // present (or there is none to add) — appending the latest row would duplicate it.
-  if (messages[messages.length - 1]?.role === "assistant") {
-    return messages;
-  }
-
-  let rows;
-  try {
-    rows = getMessages(conversationId);
-  } catch {
-    return messages;
-  }
-  if (!rows || rows.length === 0) {
-    return messages;
-  }
-
-  const lastRow = rows[rows.length - 1];
-  if (lastRow.role !== "assistant") {
-    return messages;
-  }
-
-  const blocks: ContentBlock[] = lastRow.content;
-
-  if (blocks.length === 0) {
-    return messages;
-  }
-  return [...messages, { role: "assistant", content: blocks }];
-}

package/src/tools/tool-types.ts

@@ -5,9 +5,10 @@
  * Pure type-level declarations only (+ the `RiskLevel` enum, which is a
  * value). No runtime helpers live here — the assistant keeps all behavior
  * functions in `assistant/src/tools/` and re-exports the types from this
- * file. This module imports nothing, so it can sit at the bottom of the
- * import graph and be consumed by `tools/types.ts`, `providers/types.ts`,
- * and `permissions/types.ts` without creating cycles.
+ * file. This module imports nothing from `assistant/src` (only type-only
+ * wire shapes from `@vellumai/gateway-client`), so it can sit at the bottom
+ * of the import graph and be consumed by `tools/types.ts`,
+ * `providers/types.ts`, and `permissions/types.ts` without creating cycles.
  *
  * Heavy daemon-internal references (CES client, host-proxy classes, trust
  * classifications, interface IDs, content blocks, CES `ApprovalRequired`)
@@ -25,6 +26,12 @@
 // Simple type-level declarations — moved in full
 // ---------------------------------------------------------------------------
 
+import type {
+  RiskAllowlistOption,
+  RiskDirectoryScopeOption,
+  RiskPatternScopeOption,
+} from "@vellumai/gateway-client";
+
 export type ExecutionTarget = "sandbox" | "host";
 
 /** The kind of extension that owns a tool. Core tools have no owner. */
@@ -49,6 +56,14 @@ export enum RiskLevel {
   High = "high",
 }
 
+/**
+ * `riskLevel` recorded on a `tool_invocations` audit row when the call's risk
+ * was never classified (classification aborted, or the gateway was
+ * unreachable, before any decision was reached). Distinct from every
+ * {@link RiskLevel} so a reader can tell "not assessed" from "assessed as low".
+ */
+export const RISK_LEVEL_UNCLASSIFIED = "unclassified";
+
 export interface ToolDefinition {
   name: string;
   description: string;
@@ -162,7 +177,7 @@ export interface ToolExecutionResult {
   /** Whether the daemon is running in a containerized (Docker) environment. */
   isContainerized?: boolean;
   /** Scope options ladder for the rule editor (narrowest to broadest). */
-  riskScopeOptions?: Array<{ pattern: string; label: string }>;
+  riskScopeOptions?: RiskPatternScopeOption[];
 }
 
 export type ProxyToolResolver = (
@@ -174,16 +189,14 @@ export type ProxyToolResolver = (
 // Permission prompt option ladders
 // ---------------------------------------------------------------------------
 
-export interface AllowlistOption {
-  label: string;
-  description: string;
-  pattern: string;
-}
+/** The prompt's "always allow" ladder entry: the gateway's wire shape. */
+export type AllowlistOption = RiskAllowlistOption;
 
-export interface ScopeOption {
-  label: string;
-  scope: string;
-}
+/**
+ * A directory-scope ladder entry (`scope` is a path glob or `everywhere`);
+ * the same wire shape the gateway emits as `directoryScopeOptions`.
+ */
+export type ScopeOption = RiskDirectoryScopeOption;
 
 // ---------------------------------------------------------------------------
 // Tool context

package/src/tools/types.ts

@@ -1,3 +1,7 @@
+import type {
+  RiskAllowlistOption,
+  RiskDirectoryScopeOption,
+} from "@vellumai/gateway-client";
 import { z } from "zod";
 
 import type { AnsweredQuestion } from "../api/events/question-answered.js";
@@ -124,13 +128,9 @@ export interface ToolExecutionResult {
    * wildcards) — what the gateway actually matches against. Mirrors
    * the `allowlistOptions` field on `ConfirmationRequest` SSE events.
    */
-  riskAllowlistOptions?: Array<{
-    label: string;
-    description: string;
-    pattern: string;
-  }>;
+  riskAllowlistOptions?: RiskAllowlistOption[];
   /** Directory scope ladder for the rule editor (narrowest to broadest). */
-  riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+  riskDirectoryScopeOptions?: RiskDirectoryScopeOption[];
   /** Structured activity metadata for client rendering (web search, web fetch, etc).
    *  Populated by daemon-internal tools; plugins must not set this. */
   activityMetadata?: ToolActivityMetadata;

package/src/tools/ui-surface/surface-shape-docs.ts

@@ -123,7 +123,7 @@ export const SURFACE_SHAPE_DOCS: Record<string, SurfaceShapeDoc> = {
   work_result: {
     purpose: "structured receipt after completed work",
     shape:
-      '{ eyebrow?, status?: "completed"|"partial"|"failed"|"in_progress", summary?, metrics?: [{ label, value, detail?, tone?: "neutral"|"positive"|"warning"|"negative" }], sections?: [{ id?, title, description?, type?: "items"|"timeline"|"diff"|"artifacts"|"warnings", items?: [{ id?, title, description?, status?, tone?, metadata?: [{ label, value }], href? }], diffs?: [{ label?, before?, after? }] }] } — structured receipt after real work; keep display-only unless follow-up buttons are needed',
+      '{ eyebrow?, status?: "completed"|"partial"|"failed"|"in_progress", summary?, metrics?: [{ label, value, detail?, tone?: "neutral"|"positive"|"warning"|"negative" }], sections?: [{ id?, title, description?, type?: "items"|"timeline"|"diff"|"artifacts"|"warnings", items?: [{ id?, title, description?, status?, tone?, metadata?: [{ label, value }], href? }], diffs?: [{ label?, before?, after? }] }] }: structured receipt after real work; keep display-only unless follow-up buttons are needed. An item `href` makes the row a link: an in-app path (e.g. "/assistant/skills/<skillId>?tab=history") opens in place, an https URL opens externally; other schemes are ignored',
     missingContent: (data) =>
       hasContent(data)
         ? null
@@ -211,6 +211,17 @@ export const SURFACE_SHAPE_DOCS: Record<string, SurfaceShapeDoc> = {
         ? null
         : '`data.channel` must be one of "slack", "telegram", "phone"',
   },
+  voice_picker: {
+    // The steering lives in `purpose` because that is the only part of a cold
+    // type the model ever sees: `shape` ships solely inside a teaching error,
+    // and an empty payload has no missing-content state to raise one. The
+    // surface exists to replace prose voice tours, so losing the directive
+    // would leave nothing but a renderer nobody invokes.
+    purpose:
+      "inline picker for the voice the assistant speaks in; show it when the user asks to change, hear, or pick a voice rather than describing voices in prose or sending them to Settings; attach no actions and never set await_action; during a live voice call answer in speech instead, the room already carries its own picker",
+    shape:
+      "{}: no payload, the card reads the current voice and the catalog itself. Selecting a voice applies on the assistant's next spoken turn",
+  },
 };
 
 /** Model-facing surface_type enum, derived so docs and schema cannot drift. */

package/src/tools/workflows/run-workflow.ts

@@ -55,8 +55,7 @@ export const runWorkflowInputSchema = z.looseObject({
  */
 function resolveTrustContext(context: ToolContext): TrustContext {
   const conversation = findConversation(context.conversationId);
-  const fromConversation =
-    conversation?.currentTurnTrustContext ?? conversation?.trustContext;
+  const fromConversation = conversation?.getTurnOrRestingTrust();
   if (fromConversation) {
     return fromConversation;
   }

package/src/tts/__tests__/reasoning-tag-filter.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from "bun:test";
+
+import { createReasoningTagFilter } from "../reasoning-tag-filter.js";
+
+function run(chunks: string[]): string {
+  const filter = createReasoningTagFilter();
+  let out = "";
+  for (const chunk of chunks) {
+    out += filter.push(chunk);
+  }
+  out += filter.flush();
+  return out;
+}
+
+describe("ReasoningTagFilter", () => {
+  test("passes plain text through unchanged", () => {
+    expect(run(["Hello ", "there."])).toBe("Hello there.");
+  });
+
+  test("drops a complete think span within one delta", () => {
+    expect(run(["<think>hm, let me reason</think>Answer."])).toBe("Answer.");
+  });
+
+  test("drops a reasoning span crossing many deltas", () => {
+    expect(
+      run(["<thi", "nk>step one", " step two", "</th", "ink>Spoken reply"]),
+    ).toBe("Spoken reply");
+  });
+
+  test("drops thinking-tag variant and is case-insensitive", () => {
+    expect(run(["<Thinking>inner</Thinking>ok"])).toBe("ok");
+  });
+
+  test("keeps text before and after the span", () => {
+    expect(run(["Sure. <think>secret</think> Done."])).toBe("Sure.  Done.");
+  });
+
+  test("handles multiple spans in one turn", () => {
+    expect(run(["a<think>x</think>b", "<think>y", "z</think>c"])).toBe("abc");
+  });
+
+  test("an unclosed span at end of stream stays dropped", () => {
+    expect(run(["ok<think>never closes"])).toBe("ok");
+  });
+
+  test("a dangling partial open tag is released as literal text at flush", () => {
+    expect(run(["price <th"])).toBe("price <th");
+  });
+
+  test("a false partial that disambiguates to text is released", () => {
+    expect(run(["a <th", "ree-step plan"])).toBe("a <three-step plan");
+  });
+
+  test("does not touch angle brackets that are not think tags", () => {
+    expect(run(["use <b>bold</b> and x < y"])).toBe(
+      "use <b>bold</b> and x < y",
+    );
+  });
+
+  test("holds back nothing across an empty stream", () => {
+    expect(run([""])).toBe("");
+  });
+
+  test("does not shift indexes for characters whose lowercase form is longer", () => {
+    // U+0130 (dotted capital I) lowers to two code units; positional
+    // scanning must never lowercase the haystack wholesale.
+    expect(run(["\u0130stanbul rocks. <think>hidden</think> Done."])).toBe(
+      "\u0130stanbul rocks.  Done.",
+    );
+    expect(run(["\u0130\u0130\u0130<THINK>x</THINK>ok"])).toBe(
+      "\u0130\u0130\u0130ok",
+    );
+  });
+
+  test("prefers the longer tag when both match at one index", () => {
+    expect(run(["a<thinking>x</thinking>b"])).toBe("ab");
+  });
+});

package/src/tts/reasoning-tag-filter.ts

@@ -0,0 +1,89 @@
+/**
+ * Streaming reasoning-tag filter for the TTS pipelines.
+ *
+ * Some OpenAI-compatible reasoning models emit their chain of thought inline
+ * in the content stream as `<think>...</think>` (or `<thinking>...</thinking>`)
+ * spans. When a profile has not opted into the chat-completions provider's
+ * `parseThinkTags` (which re-routes those spans to `thinking_delta`), the raw
+ * reasoning rides `text_delta`, and anything downstream that speaks text
+ * deltas would read the model's inner monologue aloud and delay real speech
+ * by the full length of the reasoning.
+ *
+ * This filter is the TTS-boundary guard: voice output must never speak
+ * reasoning regardless of profile configuration. It is stateful because a
+ * tag or a reasoning span routinely crosses delta boundaries; feed every
+ * delta through {@link ReasoningTagFilter.push} and call
+ * {@link ReasoningTagFilter.flush} when the turn's stream ends.
+ *
+ * Display paths are deliberately untouched: `assistant_text_delta` frames
+ * keep the raw text, exactly like the markdown handling in
+ * `calls/tts-text-sanitizer.ts`.
+ *
+ * Tag scanning lives in `util/think-tag-stream.ts`, shared with the
+ * chat-completions provider's think-tag router, and is positionally exact
+ * on the original string (no full-string lowercasing, which shifts indexes
+ * for characters like the dotted capital I).
+ */
+
+import { indexOfTag, partialTagSuffix } from "../util/think-tag-stream.js";
+
+const OPEN_TAGS = ["<think>", "<thinking>"] as const;
+const CLOSE_TAGS = ["</think>", "</thinking>"] as const;
+
+export class ReasoningTagFilter {
+  private insideReasoning = false;
+  private pending = "";
+
+  /**
+   * Feed one streamed delta; returns the speakable text it releases.
+   * Reasoning spans are dropped; a partial tag at the end of the buffer is
+   * held back until the next delta disambiguates it.
+   */
+  push(text: string): string {
+    this.pending += text;
+    let out = "";
+    for (;;) {
+      if (this.insideReasoning) {
+        const close = indexOfTag(this.pending, CLOSE_TAGS, true);
+        if (close) {
+          this.pending = this.pending.slice(close.index + close.tag.length);
+          this.insideReasoning = false;
+          continue;
+        }
+        // Everything buffered is reasoning except a possible partial close
+        // tag at the end; drop the reasoning, keep the partial.
+        const partial = partialTagSuffix(this.pending, CLOSE_TAGS, true);
+        this.pending = partial > 0 ? this.pending.slice(-partial) : "";
+        return out;
+      }
+      const open = indexOfTag(this.pending, OPEN_TAGS, true);
+      if (open) {
+        out += this.pending.slice(0, open.index);
+        this.pending = this.pending.slice(open.index + open.tag.length);
+        this.insideReasoning = true;
+        continue;
+      }
+      const partial = partialTagSuffix(this.pending, OPEN_TAGS, true);
+      const safeLength = this.pending.length - partial;
+      out += this.pending.slice(0, safeLength);
+      this.pending = partial > 0 ? this.pending.slice(safeLength) : "";
+      return out;
+    }
+  }
+
+  /**
+   * End of stream: release any held-back partial. Outside a reasoning span a
+   * dangling "<thin" was ordinary text after all; inside one, the span never
+   * closed and its content stays dropped.
+   */
+  flush(): string {
+    const rest = this.insideReasoning ? "" : this.pending;
+    this.pending = "";
+    this.insideReasoning = false;
+    return rest;
+  }
+}
+
+export function createReasoningTagFilter(): ReasoningTagFilter {
+  return new ReasoningTagFilter();
+}

package/src/util/__tests__/worker-process-command.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+
+import { resolveWorkerCommand } from "../worker-process.js";
+
+const entry = new URL("file:///source/monitoring/worker.ts");
+
+describe("resolveWorkerCommand", () => {
+  test("uses the packaged Windows worker executable when present", () => {
+    expect(
+      resolveWorkerCommand(entry, "monitoring", {
+        platform: "win32",
+        execPath: "/runtime/vellum-daemon.exe",
+        executableExists: () => true,
+      }),
+    ).toEqual(["/runtime/vellum-worker.exe", "monitoring"]);
+  });
+
+  test("routes integrity checks through the packaged worker", () => {
+    expect(
+      resolveWorkerCommand(entry, "db-integrity", {
+        platform: "win32",
+        execPath: "/runtime/vellum-worker.exe",
+        executableExists: () => true,
+      }),
+    ).toEqual(["/runtime/vellum-worker.exe", "db-integrity"]);
+  });
+
+  test("falls back to the source entry outside a packaged runtime", () => {
+    expect(
+      resolveWorkerCommand(entry, "monitoring", {
+        platform: "win32",
+        execPath: "/runtime/vellum-daemon.exe",
+        executableExists: () => false,
+      }),
+    ).toEqual(["bun", "--smol", "run", "/source/monitoring/worker.ts"]);
+  });
+});

package/src/util/logger.ts

@@ -19,6 +19,16 @@ import { logSerializers } from "./log-redact.js";
 import { getLogsDir } from "./platform.js";
 
 const loadModule = createRequire(import.meta.url);
+let bundledPino: typeof import("pino") | undefined;
+let bundledPinoPretty: typeof import("pino-pretty") | undefined;
+
+export function setBundledLoggerModules(
+  pino: typeof import("pino"),
+  pinoPretty: typeof import("pino-pretty"),
+): void {
+  bundledPino = pino;
+  bundledPinoPretty = pinoPretty;
+}
 
 /**
  * pino loads on first logger construction, not import, so CLI processes that
@@ -26,11 +36,17 @@ const loadModule = createRequire(import.meta.url);
  * the real dual-export and ESM-shaped test mocks.
  */
 function loadPino(): typeof import("pino") {
+  if (bundledPino) {
+    return bundledPino;
+  }
   const mod = loadModule("pino") as { default?: unknown };
   return (mod.default ?? mod) as typeof import("pino");
 }
 
 function loadPinoPretty(): typeof import("pino-pretty") {
+  if (bundledPinoPretty) {
+    return bundledPinoPretty;
+  }
   const mod = loadModule("pino-pretty") as { default?: unknown };
   return (mod.default ?? mod) as typeof import("pino-pretty");
 }