@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/monitoring/__tests__/plugin-auto-update.test.ts

@@ -10,6 +10,11 @@
  *     stamp survives restarts;
  *   - only plugins that can actually move reach the daemon — up-to-date and
  *     disabled installs cost it nothing;
+ *   - only curated marketplace installs are swept: a plugin installed straight
+ *     from a GitHub URL, or one whose recorded source disagrees with the
+ *     catalog entry claiming its name, is left for a human to upgrade, and
+ *     every request the daemon does get carries `marketplaceOnly` so it
+ *     enforces that boundary against its own inspection;
  *   - one plugin's refusal does not stop the sweep, an unreachable daemon
  *     abandons it without stamping (so it retries), and a timed-out upgrade
  *     abandons it *with* a stamp (so the retry cannot race the handler that
@@ -56,6 +61,25 @@ afterAll(() => {
 let inspectStatus = new Map<string, string>();
 let inspectThrowsFor = new Set<string>();
 
+/** GitHub coordinates, as both the provenance sidecar and the catalog carry them. */
+interface Coordinates {
+  /** `owner/repo`. */
+  readonly repo: string;
+  /** Repo-relative plugin root; absent = repo root. */
+  readonly path?: string;
+}
+
+/**
+ * Provenance `inspectPlugin` reports per plugin name: where the installed copy
+ * says it came from, and where the catalog entry claiming that name points.
+ * Absent for a plugin that declares neither, which is what an older install
+ * with no sidecar looks like.
+ */
+let inspectProvenance = new Map<
+  string,
+  { readonly source?: Coordinates; readonly marketplace?: Coordinates }
+>();
+
 type UpgradeReply = {
   ok: boolean;
   result?: { outcome?: string; toCommit?: string };
@@ -68,6 +92,8 @@ let upgradeReply: (name: string) => UpgradeReply = () => ({
   result: { outcome: "upgraded", toCommit: "abc1234" },
 });
 const upgradeCalls: Array<{ name: string; strategy: unknown }> = [];
+/** Full request bodies, for the assertions that care about more than strategy. */
+const upgradeBodies: Array<Record<string, unknown>> = [];
 
 const realInspect = await import("../../cli/lib/inspect-plugin.js");
 const realIpcClient = await import("../../ipc/cli-client.js");
@@ -78,7 +104,20 @@ mock.module("../../cli/lib/inspect-plugin.js", () => ({
     if (inspectThrowsFor.has(name)) {
       throw new Error("marketplace unreachable");
     }
-    return { name, status: inspectStatus.get(name) ?? "up-to-date" };
+    const provenance = inspectProvenance.get(name);
+    const source = provenance?.source;
+    const marketplace = provenance?.marketplace;
+    const [owner = "", repo = ""] = source?.repo.split("/") ?? [];
+    return {
+      name,
+      status: inspectStatus.get(name) ?? "up-to-date",
+      local: source
+        ? { source: { kind: "github", owner, repo, path: source.path } }
+        : null,
+      remote: marketplace
+        ? { repo: marketplace.repo, path: marketplace.path ?? "" }
+        : null,
+    };
   },
 }));
 
@@ -86,12 +125,16 @@ mock.module("../../ipc/cli-client.js", () => ({
   ...realIpcClient,
   cliIpcCall: async (
     _method: string,
-    params: { pathParams: { name: string }; body: { strategy: unknown } },
+    params: {
+      pathParams: { name: string };
+      body: Record<string, unknown>;
+    },
   ) => {
     upgradeCalls.push({
       name: params.pathParams.name,
       strategy: params.body.strategy,
     });
+    upgradeBodies.push(params.body);
     return upgradeReply(params.pathParams.name);
   },
 }));
@@ -110,7 +153,14 @@ function writeConfig(pluginUpdates: Record<string, unknown>): void {
 /** Materialize an installed plugin and declare what inspect says about it. */
 function installPlugin(
   name: string,
-  opts: { status?: string; disabled?: boolean } = {},
+  opts: {
+    status?: string;
+    disabled?: boolean;
+    /** Coordinates the install's provenance sidecar records. */
+    source?: Coordinates;
+    /** Coordinates the catalog entry claiming this name points at. */
+    marketplace?: Coordinates;
+  } = {},
 ): void {
   const dir = join(PLUGINS_DIR, name);
   mkdirSync(dir, { recursive: true });
@@ -122,6 +172,12 @@ function installPlugin(
     writeFileSync(join(dir, ".disabled"), "");
   }
   inspectStatus.set(name, opts.status ?? "update-available");
+  if (opts.source || opts.marketplace) {
+    inspectProvenance.set(name, {
+      source: opts.source,
+      marketplace: opts.marketplace,
+    });
+  }
 }
 
 /** Backdate the stamp so the sweep is (or is not) due again. */
@@ -134,11 +190,13 @@ function stampAgedBy(ms: number): void {
 beforeEach(() => {
   inspectStatus = new Map();
   inspectThrowsFor = new Set();
+  inspectProvenance = new Map();
   upgradeReply = () => ({
     ok: true,
     result: { outcome: "upgraded", toCommit: "abc1234" },
   });
   upgradeCalls.length = 0;
+  upgradeBodies.length = 0;
   rmSync(STAMP, { force: true });
   rmSync(PLUGINS_DIR, { recursive: true, force: true });
   mkdirSync(PLUGINS_DIR, { recursive: true });
@@ -203,6 +261,111 @@ describe("plugin auto-update sweep", () => {
     expect(upgradeCalls.map((c) => c.name)).toEqual(["beta"]);
   });
 
+  test("a plugin installed straight from a GitHub URL is never swept", async () => {
+    writeConfig({ mode: "auto" });
+    // No catalog entry claims the name, so its only upgrade target is whatever
+    // the recorded upstream ref points at right now. Nobody reviewed that.
+    installPlugin("alpha", { status: "not-in-marketplace" });
+    installPlugin("beta", { status: "update-available" });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["beta"]);
+    expect(result.skippedUntrusted).toEqual(["alpha"]);
+    expect(result.failed).toEqual([]);
+  });
+
+  test("every request asks the daemon to enforce the curated boundary itself", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha", { status: "update-available" });
+    installPlugin("beta", { status: "unknown-provenance" });
+
+    await runPluginAutoUpdateSweepIfDue();
+
+    // The daemon re-inspects before it moves anything, so a catalog entry that
+    // disappears after the inspection above would flip it to the direct path.
+    // `marketplaceOnly` makes the daemon refuse instead of following the
+    // install's mutable ref.
+    expect(upgradeBodies).toEqual([
+      { strategy: "theirs", marketplaceOnly: true },
+      { strategy: "theirs", marketplaceOnly: true },
+    ]);
+  });
+
+  test("a whole workspace of untrusted installs stamps instead of retrying every minute", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha", { status: "not-in-marketplace" });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.skipped).toBe("no-candidates");
+    expect(result.skippedUntrusted).toEqual(["alpha"]);
+    expect(upgradeCalls).toEqual([]);
+    expect(await runPluginAutoUpdateSweepIfDue()).toMatchObject({
+      skipped: "not-due",
+    });
+  });
+
+  test("an install whose source disagrees with the catalog is left alone", async () => {
+    writeConfig({ mode: "auto" });
+    // A direct install sitting on a curated plugin's name: only the name lines
+    // up, so the sweep must not swap it for the catalog's code.
+    installPlugin("alpha", {
+      status: "update-available",
+      source: { repo: "someone-else/alpha" },
+      marketplace: { repo: "vellum-ai/alpha" },
+    });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls).toEqual([]);
+    expect(result.skippedUntrusted).toEqual(["alpha"]);
+  });
+
+  test("an install from the catalog's own repo is upgraded", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha", {
+      status: "update-available",
+      source: { repo: "vellum-ai/plugins", path: "alpha" },
+      marketplace: { repo: "vellum-ai/plugins", path: "alpha" },
+    });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["alpha"]);
+    expect(result.skippedUntrusted).toEqual([]);
+  });
+
+  test("a matching repo with a different plugin root is left alone", async () => {
+    writeConfig({ mode: "auto" });
+    // Same monorepo, different directory: not the plugin the catalog pins.
+    installPlugin("alpha", {
+      status: "update-available",
+      source: { repo: "vellum-ai/plugins", path: "experimental/alpha" },
+      marketplace: { repo: "vellum-ai/plugins", path: "alpha" },
+    });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls).toEqual([]);
+    expect(result.skippedUntrusted).toEqual(["alpha"]);
+  });
+
+  test("an install with no recorded source is still re-pinned to the curated commit", async () => {
+    writeConfig({ mode: "auto" });
+    // An older or manually-copied copy: nothing about it contradicts the
+    // catalog, and the upgrade is what gives it provenance.
+    installPlugin("alpha", {
+      status: "unknown-provenance",
+      marketplace: { repo: "vellum-ai/alpha" },
+    });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["alpha"]);
+    expect(result.upgraded).toEqual(["alpha"]);
+  });
+
   test("a disabled plugin is left alone", async () => {
     writeConfig({ mode: "auto" });
     installPlugin("alpha");

package/src/monitoring/plugin-auto-update.ts

@@ -8,6 +8,22 @@
  * (default hourly), inspects which ones can actually move, and upgrades those
  * with the configured merge strategy (default `theirs`).
  *
+ * Only plugins that come from the curated marketplace are swept. The catalog
+ * pins every entry to an immutable commit that a curator reviewed, so an
+ * unattended upgrade can only land code that passed that review. A plugin
+ * installed straight from a GitHub URL has no such gate: it tracks a mutable
+ * ref (a branch, a tag, or the repo's default branch), so upgrading it means
+ * fetching and executing whatever upstream pushed since. That is a decision
+ * for a human at a terminal, not for an hourly background sweep, so untrusted
+ * installs are filtered out here and left for `assistant plugins upgrade`.
+ *
+ * The filter is applied twice, in both processes. Inspecting here keeps the
+ * daemon from being asked about plugins the sweep would never accept, but the
+ * daemon re-inspects before it moves anything, so this side's verdict cannot be
+ * the one that matters: a catalog entry that disappears in between would flip
+ * the daemon to the direct path. Every request therefore carries
+ * `marketplaceOnly`, which the daemon enforces against its own inspection.
+ *
  * The monitor drives it — not the daemon — for the same reason it drives the
  * plugin source watch and crash recovery: the work is periodic, network-bound,
  * and must not compete with the daemon's turn loop. Drift detection happens
@@ -30,7 +46,10 @@
 import { statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { inspectPlugin } from "../cli/lib/inspect-plugin.js";
+import {
+  inspectPlugin,
+  type PluginInspection,
+} from "../cli/lib/inspect-plugin.js";
 import { listInstalledPlugins } from "../cli/lib/list-installed-plugins.js";
 import { getConfigReadOnly } from "../config/loader.js";
 import type { PluginUpdatesConfig } from "../config/schemas/plugin-updates.js";
@@ -67,22 +86,20 @@ const STAMP_FILENAME = "plugin-auto-update-last-run-at";
 /**
  * Inspection verdicts worth asking the daemon about.
  *
- * `update-available` is the obvious one. `unknown-provenance` (an older or
- * manually-copied install with no recorded commit) is included because an
- * upgrade re-pins it, which is how it stops being unknown. So is
- * `not-in-marketplace`: a plugin installed straight from a GitHub URL has no
- * catalog entry to compare against, but it still tracks a ref upstream may
- * have moved — only the daemon's upgrade can resolve that, and it no-ops when
- * the ref still points at the installed commit.
+ * Both resolve to a curated marketplace pin, which is the only revision this
+ * sweep is willing to move an install to. `update-available` is the obvious
+ * one. `unknown-provenance` (an older or manually-copied install with no
+ * recorded commit) is included because an upgrade re-pins it to that same
+ * curated commit, which is how it stops being unknown.
  *
- * Everything else is skipped: `up-to-date` has nowhere to move, and
- * `remote-unavailable` means the catalog could not be read, so an upgrade
- * would fail on the same outage a moment later.
+ * Everything else is skipped: `up-to-date` has nowhere to move,
+ * `remote-unavailable` means the catalog could not be read so an upgrade would
+ * fail on the same outage a moment later, and `not-in-marketplace` is the
+ * untrusted direct install whose only upgrade target is a mutable upstream ref.
  */
 const UPGRADABLE_STATUSES: ReadonlySet<string> = new Set([
   "update-available",
   "unknown-provenance",
-  "not-in-marketplace",
 ]);
 
 /** Outcome the daemon reports for one plugin; mirrors `PluginUpgradeResult`. */
@@ -113,31 +130,83 @@ function stampSweep(): void {
   }
 }
 
+/**
+ * Whether an installed copy actually tracks the curated source the sweep would
+ * upgrade it to.
+ *
+ * The provenance sidecar records the owner/repo/path the install was
+ * materialized from. When that names a different repository than the catalog
+ * entry claiming the plugin's name, the install is a direct (untrusted) one
+ * sitting on a curated name, and only its name lines up with the catalog. The
+ * sweep leaves it alone: the user picked that source, and swapping it for
+ * someone else's code is a call for a human running `assistant plugins
+ * upgrade`, not for an unattended hourly pass.
+ *
+ * An install with no recorded source at all (an older or manually-copied copy)
+ * is not disqualified. Nothing about it contradicts the catalog, and re-pinning
+ * it to the curated commit is exactly how it gains provenance.
+ */
+function tracksCuratedSource(inspection: PluginInspection): boolean {
+  const source = inspection.local?.source;
+  if (!source) {
+    return true;
+  }
+  const remote = inspection.remote;
+  if (!remote) {
+    return false;
+  }
+  return (
+    `${source.owner}/${source.repo}`.toLowerCase() ===
+      remote.repo.toLowerCase() && (source.path ?? "") === remote.path
+  );
+}
+
+/** What one pass of inspection concluded about the installed plugins. */
+interface UpgradeCandidates {
+  /** Names the daemon should be asked to upgrade. */
+  readonly candidates: readonly string[];
+  /** Names left alone because they do not come from the curated marketplace. */
+  readonly untrusted: readonly string[];
+}
+
 /**
  * Installed plugins this sweep should ask the daemon to upgrade.
  *
  * Only user-installed plugins are listed (defaults ship with the assistant and
  * have no upstream to advance to). A disabled plugin is deliberately left
- * alone — the user switched it off, and upgrading it would re-materialize code
+ * alone: the user switched it off, and upgrading it would re-materialize code
  * and re-declare schedules for something that isn't running. What survives
  * that is inspected, so the daemon is only asked about plugins that can
- * actually move (see {@link UPGRADABLE_STATUSES}).
+ * actually move (see {@link UPGRADABLE_STATUSES}) and whose move lands on a
+ * curated pin (see {@link tracksCuratedSource}).
  */
-async function listUpgradableNames(): Promise<string[]> {
+async function listUpgradableNames(): Promise<UpgradeCandidates> {
   const installed = listInstalledPlugins()
     .map((plugin) => plugin.name)
     .filter((name) => !isPluginDisabled(name));
 
   const candidates: string[] = [];
+  const untrusted: string[] = [];
   for (const name of installed) {
     try {
       const inspection = await inspectPlugin(
         { name },
         { fetch: globalThis.fetch.bind(globalThis) },
       );
-      if (UPGRADABLE_STATUSES.has(inspection.status)) {
-        candidates.push(name);
+      if (inspection.status === "not-in-marketplace") {
+        // No catalog entry claims the name, so the only thing to upgrade to is
+        // whatever the recorded upstream ref points at right now.
+        untrusted.push(name);
+        continue;
+      }
+      if (!UPGRADABLE_STATUSES.has(inspection.status)) {
+        continue;
+      }
+      if (!tracksCuratedSource(inspection)) {
+        untrusted.push(name);
+        continue;
       }
+      candidates.push(name);
     } catch (err) {
       // An install whose drift cannot be classified (source unreachable,
       // rate-limited) is skipped rather than handed to the daemon, which
@@ -145,10 +214,19 @@ async function listUpgradableNames(): Promise<string[]> {
       log.debug({ err, name }, "Plugin auto-update could not inspect plugin");
     }
   }
-  return candidates;
+  return { candidates, untrusted };
 }
 
-/** Ask the daemon to upgrade one plugin. */
+/**
+ * Ask the daemon to upgrade one plugin.
+ *
+ * `marketplaceOnly` restates this sweep's boundary as something the daemon
+ * enforces rather than something it trusts the caller to have checked. The
+ * daemon re-inspects before it moves anything, so a catalog entry that
+ * disappears between the inspection above and the daemon's own would otherwise
+ * turn a curated upgrade into a direct one against the install's mutable ref.
+ * With the flag set the daemon refuses instead.
+ */
 function requestUpgrade(
   name: string,
   strategy: PluginUpdatesConfig["strategy"],
@@ -157,7 +235,7 @@ function requestUpgrade(
     UPGRADE_IPC_METHOD,
     // The target revision is never caller-supplied — the daemon resolves it
     // from the plugin's own source, exactly as an interactive upgrade does.
-    { pathParams: { name }, body: { strategy } },
+    { pathParams: { name }, body: { strategy, marketplaceOnly: true } },
     { timeoutMs: UPGRADE_TIMEOUT_MS },
   );
 }
@@ -174,6 +252,12 @@ export interface PluginAutoUpdateSweepResult {
   readonly upgraded: readonly string[];
   readonly unchanged: readonly string[];
   readonly failed: readonly string[];
+  /**
+   * Installs the sweep refused to touch because they do not come from the
+   * curated marketplace. They are not failures: a human can still upgrade them
+   * with `assistant plugins upgrade`.
+   */
+  readonly skippedUntrusted: readonly string[];
   /** True when the daemon could not be reached, so the sweep stays due. */
   readonly daemonUnreachable: boolean;
 }
@@ -182,6 +266,7 @@ const NOTHING: Omit<PluginAutoUpdateSweepResult, "skipped"> = {
   upgraded: [],
   unchanged: [],
   failed: [],
+  skippedUntrusted: [],
   daemonUnreachable: false,
 };
 
@@ -214,18 +299,29 @@ export async function runPluginAutoUpdateSweepIfDue(): Promise<PluginAutoUpdateS
     return { skipped: "not-due", ...NOTHING };
   }
 
-  let names: string[];
+  let inspected: UpgradeCandidates;
   try {
-    names = await listUpgradableNames();
+    inspected = await listUpgradableNames();
   } catch (err) {
     log.warn({ err }, "Plugin auto-update could not list installed plugins");
     return { skipped: "no-candidates", ...NOTHING };
   }
+  const { candidates: names, untrusted } = inspected;
+  if (untrusted.length > 0) {
+    log.info(
+      { plugins: untrusted },
+      "Plugin auto-update skipped plugins that are not from the curated marketplace",
+    );
+  }
   if (names.length === 0) {
     // Stamp anyway: a workspace with nothing to move is a completed sweep, and
     // re-inspecting every plugin a minute later would be pure churn.
     stampSweep();
-    return { skipped: "no-candidates", ...NOTHING };
+    return {
+      skipped: "no-candidates",
+      ...NOTHING,
+      skippedUntrusted: untrusted,
+    };
   }
 
   const upgraded: string[] = [];
@@ -302,13 +398,21 @@ export async function runPluginAutoUpdateSweepIfDue(): Promise<PluginAutoUpdateS
         upgraded: upgraded.length,
         unchanged: unchanged.length,
         failed: failed.length,
+        skippedUntrusted: untrusted.length,
         strategy: config.strategy,
       },
       "Plugin auto-update sweep complete",
     );
   }
 
-  return { skipped: null, upgraded, unchanged, failed, daemonUnreachable };
+  return {
+    skipped: null,
+    upgraded,
+    unchanged,
+    failed,
+    skippedUntrusted: untrusted,
+    daemonUnreachable,
+  };
 }
 
 /** Handle for the running auto-update loop. */

package/src/notifications/signal.ts

@@ -26,6 +26,7 @@ export const NOTIFICATION_SOURCE_CHANNELS = [
   { id: "platform", description: "Platform-managed channel" },
   { id: "a2a", description: "Agent-to-agent protocol channel" },
   { id: "discord", description: "Discord channel" },
+  { id: "plugin", description: "Channel brought by an installed plugin" },
   { id: "scheduler", description: "Scheduled task runner (reminders, cron)" },
   { id: "watcher", description: "File/event watcher subsystem" },
 ] as const;

package/src/permissions/confirmation-guardian-request.test.ts

@@ -19,17 +19,19 @@ mock.module("../util/logger.js", () => ({
 }));
 
 mock.module("../daemon/conversation-registry.js", () => ({
-  findConversation: () => ({
-    assistantId: "self",
-    trustContext: {
-      sourceChannel: "telegram",
-      requesterExternalUserId: "tg-user-1",
-      requesterChatId: "tg-chat-1",
-      guardianExternalUserId: "tg-guardian-1",
-      guardianPrincipalId: "principal-1",
-    },
-    hasPendingConfirmation: () => confirmationPending,
-  }),
+  findConversation: () =>
+    asConversation({
+      assistantId: "self",
+      trustContext: {
+        trustClass: "trusted_contact",
+        sourceChannel: "telegram",
+        requesterExternalUserId: "tg-user-1",
+        requesterChatId: "tg-chat-1",
+        guardianExternalUserId: "tg-guardian-1",
+        guardianPrincipalId: "principal-1",
+      } satisfies TrustContext,
+      hasPendingConfirmation: () => confirmationPending,
+    }),
 }));
 
 mock.module("../channels/gateway-guardian-requests.js", () => ({
@@ -50,7 +52,9 @@ mock.module("../runtime/confirmation-request-guardian-bridge.js", () => ({
   },
 }));
 
+import { asConversation } from "../__tests__/helpers/mock-conversation.js";
 import type { AssistantEvent } from "../api/index.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 import { createGuardianRequestForConfirmation } from "./confirmation-guardian-request.js";
 
 const MSG = {

package/src/permissions/confirmation-guardian-request.ts

@@ -66,8 +66,8 @@ export async function createGuardianRequestForConfirmation(
 
     const conversation = findConversation(conversationId);
     const trustContext = opts?.preferTurnSnapshot
-      ? (conversation?.currentTurnTrustContext ?? conversation?.trustContext)
-      : conversation?.trustContext;
+      ? conversation?.getTurnOrRestingTrust()
+      : conversation?.getTrustContext();
     const sourceChannel = trustContext?.sourceChannel ?? "vellum";
     const inputRecord = msg.input as Record<string, unknown>;
     const activityRaw =

package/src/permissions/question-guardian-request.test.ts

@@ -7,7 +7,10 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { mockTrustContext } from "../__tests__/helpers/mock-actor-context.js";
+import { asConversation } from "../__tests__/helpers/mock-conversation.js";
 import type { QuestionRequestEvent } from "../api/events/question-request.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 
 const createGuardianRequestMock = mock(
   (params: Record<string, unknown>): Promise<Record<string, unknown>> =>
@@ -21,13 +24,18 @@ const withdrawCardsMock = mock((_params: Record<string, unknown>) =>
   Promise.resolve(),
 );
 
-let trustContext: Record<string, unknown> | undefined;
+let trustContext: TrustContext | undefined;
 let pendingInteraction: { kind: string } | undefined;
 let rowAfterExpire: Record<string, unknown> | null = null;
 
 mock.module("../daemon/conversation-registry.js", () => ({
   findConversation: (_id: string) =>
-    trustContext ? { trustContext, assistantId: "self" } : undefined,
+    trustContext
+      ? asConversation({
+          trustContext,
+          assistantId: "self",
+        })
+      : undefined,
 }));
 mock.module("../channels/gateway-guardian-requests.js", () => ({
   createGuardianRequest: (params: Record<string, unknown>) =>
@@ -77,9 +85,9 @@ function makeEvent(
 }
 
 function guardianTrustContext(
-  overrides: Record<string, unknown> = {},
-): Record<string, unknown> {
-  return {
+  overrides: Partial<TrustContext> = {},
+): TrustContext {
+  return mockTrustContext({
     trustClass: "guardian",
     sourceChannel: "telegram",
     guardianPrincipalId: "prin-guardian",
@@ -87,7 +95,7 @@ function guardianTrustContext(
     requesterExternalUserId: "tg-guardian",
     requesterChatId: "chat-1",
     ...overrides,
-  };
+  });
 }
 
 beforeEach(() => {

package/src/permissions/question-guardian-request.ts

@@ -107,8 +107,7 @@ export async function createGuardianRequestForQuestion(
     const conversation = findConversation(conversationId);
     // The prompter runs inside the emitting turn — bind to the turn's trust
     // snapshot so a concurrent context mutation can't repoint the request.
-    const trustContext =
-      conversation?.currentTurnTrustContext ?? conversation?.trustContext;
+    const trustContext = conversation?.getTurnOrRestingTrust();
     if (!conversation || !trustContext) {
       return;
     }

package/src/persistence/attachments-store.ts

@@ -137,6 +137,9 @@ function getAttachmentRow(attachmentId: string): AttachmentRow | null {
 function getMessageConversationContext(
   messageId: string,
 ): { conversationId: string; conversationCreatedAt: number } | null {
+  // Any-state read, deliberately: the id names a message the caller is
+  // already linking an attachment to, and a rendered row may still be
+  // streaming. Existence and ownership are the question, not completeness.
   return (
     rawGet<{ conversationId: string; conversationCreatedAt: number }>(
       "attachments:getMessageConversationContext",
@@ -474,6 +477,11 @@ const ALLOWED_MIME_TYPES = new Set([
   // Source code
   "text/javascript",
   "text/typescript",
+  // Shell scripts (browsers and OS file pickers report these for .sh files)
+  "application/x-sh",
+  "application/x-shellscript",
+  "text/x-sh",
+  "text/x-shellscript",
   // Archives
   "application/zip",
   "application/gzip",
@@ -501,7 +509,6 @@ const ALLOWED_MIME_TYPES = new Set([
  */
 const DANGEROUS_EXTENSIONS = new Set([
   "exe",
-  "sh",
   "bat",
   "cmd",
   "com",