@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/skills/validate-input.ts

@@ -12,6 +12,7 @@
  * (e.g. `surface_id is required`, `mode must be one of "replace", "append"`).
  */
 
+import { parseJsonSafe } from "../util/json.js";
 import { isPlainObject } from "../util/object.js";
 
 export interface InputValidationSuccess {
@@ -67,22 +68,27 @@ function quoteList(values: readonly string[]): string {
 }
 
 /**
- * Coerce string-encoded booleans (`"true"`/`"false"`) to real booleans for
- * properties the schema declares as `type: "boolean"`.
+ * Walk the properties a schema declares as `declaredType`, offering each
+ * present value to `coerceValue`. A converter returns `{ value }` to replace
+ * the input's value, or `undefined` to leave it alone.
  *
- * Some providers' models serialize booleans as JSON strings. Rejecting those
- * loses the caller's intent: the model's typical recovery is to drop the field
- * and retry, at which point the field's default silently inverts what it asked
- * for (e.g. `app_create` with `auto_open: "false"` → retry omits the field →
- * default `true` opens a half-built app). Accepting the unambiguous string
- * forms preserves intent.
+ * The shared traversal is what keeps the coercions below agreeing on the
+ * details a caller depends on: union types (`["boolean", "null"]`) are skipped
+ * rather than coerced, an absent property is never introduced, and the input
+ * object is cloned lazily so an input with nothing to coerce comes back by
+ * reference.
  *
  * Pure: returns a new object when a coercion applies, otherwise returns
  * `input` unchanged. Never mutates `input` or `schema`.
  */
-export function coerceStringBooleans(
+function coercePropertiesOfType(
   input: Record<string, unknown>,
   schema: Record<string, unknown> | undefined,
+  declaredType: string,
+  coerceValue: (
+    value: unknown,
+    subSchema: Record<string, unknown>,
+  ) => { value: unknown } | undefined,
 ): Record<string, unknown> {
   if (!schema) {
     return input;
@@ -94,24 +100,47 @@ export function coerceStringBooleans(
 
   let coerced: Record<string, unknown> | undefined;
   for (const [key, rawSubSchema] of Object.entries(properties)) {
-    if (!isPlainObject(rawSubSchema)) {
+    if (!isPlainObject(rawSubSchema) || rawSubSchema.type !== declaredType) {
       continue;
     }
-    if (rawSubSchema.type !== "boolean") {
+    const result = coerceValue(input[key], rawSubSchema);
+    if (!result) {
       continue;
     }
-    const value = input[key];
+    coerced ??= { ...input };
+    coerced[key] = result.value;
+  }
+  return coerced ?? input;
+}
+
+/**
+ * Coerce string-encoded booleans (`"true"`/`"false"`) to real booleans for
+ * properties the schema declares as `type: "boolean"`.
+ *
+ * Some providers' models serialize booleans as JSON strings. Rejecting those
+ * loses the caller's intent: the model's typical recovery is to drop the field
+ * and retry, at which point the field's default silently inverts what it asked
+ * for (e.g. `app_create` with `auto_open: "false"` → retry omits the field →
+ * default `true` opens a half-built app). Accepting the unambiguous string
+ * forms preserves intent.
+ *
+ * Pure: returns a new object when a coercion applies, otherwise returns
+ * `input` unchanged. Never mutates `input` or `schema`.
+ */
+export function coerceStringBooleans(
+  input: Record<string, unknown>,
+  schema: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  return coercePropertiesOfType(input, schema, "boolean", (value) => {
     if (typeof value !== "string") {
-      continue;
+      return undefined;
     }
     const normalized = value.trim().toLowerCase();
     if (normalized !== "true" && normalized !== "false") {
-      continue;
+      return undefined;
     }
-    coerced ??= { ...input };
-    coerced[key] = normalized === "true";
-  }
-  return coerced ?? input;
+    return { value: normalized === "true" };
+  });
 }
 
 /**
@@ -141,36 +170,135 @@ export function coerceStringNumbers(
   input: Record<string, unknown>,
   schema: Record<string, unknown> | undefined,
 ): Record<string, unknown> {
-  if (!schema) {
-    return input;
-  }
-  const properties = schema.properties;
-  if (!isPlainObject(properties)) {
-    return input;
-  }
-
-  let coerced: Record<string, unknown> | undefined;
-  for (const [key, rawSubSchema] of Object.entries(properties)) {
-    if (!isPlainObject(rawSubSchema)) {
-      continue;
-    }
-    if (rawSubSchema.type !== "string") {
-      continue;
-    }
-    const value = input[key];
+  return coercePropertiesOfType(input, schema, "string", (value) => {
     if (typeof value !== "number" || !Number.isFinite(value)) {
-      continue;
+      return undefined;
     }
     // An integer beyond the safe range was already rounded by JSON.parse;
     // coercing it would lock in a corrupted identifier. Skip it so validation
     // fails and the model retries with a lossless quoted string.
     if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
-      continue;
+      return undefined;
     }
-    coerced ??= { ...input };
-    coerced[key] = String(value);
+    return { value: String(value) };
+  });
+}
+
+/**
+ * Repair the shapes a model sends for a property the schema declares as
+ * `type: "array"`, when the intent is unambiguous.
+ *
+ * Two shapes dominate what models actually send, and neither is recoverable
+ * from the model's side: it cannot see the difference between what it meant
+ * and what arrived, so the observed recovery is to drop the field and retry.
+ * That is how a skill gets scaffolded with no `activation_hints` (losing the
+ * intent-routing signal that makes it findable later) or with its companion
+ * `files` folded into the body instead.
+ *
+ * - **The JSON text of the array** (`"[\"a\",\"b\"]"`) rather than the array.
+ *   Decoded back into the array it spells.
+ * - **A single element where a list was expected**: a bare phrase for a
+ *   string-item array (`avoid_when: "when the repo is dirty"`), or one object
+ *   for an object-item array. Wrapped into a one-element array.
+ *
+ * A string is wrapped only when the schema declares string items and the text
+ * does not open a JSON structure it failed to close, and an object only when
+ * every key it carries is a declared property of the item schema. A shape that
+ * means something else (a truncated array, a map keyed by something the item
+ * schema does not name) is left for the validator to reject rather than
+ * silently reinterpreted. Per-element `items.type` checks still run on the
+ * repaired array, so a genuinely wrong element keeps its own error, and each
+ * element an array gains here is coerced against the item schema so a repaired
+ * element cannot carry a shape a natively-sent one could not.
+ *
+ * Pure: returns a new object when a repair applies, otherwise returns `input`
+ * unchanged. Never mutates `input` or `schema`.
+ */
+export function coerceArrayShapes(
+  input: Record<string, unknown>,
+  schema: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  return coercePropertiesOfType(input, schema, "array", (value, subSchema) => {
+    const items = isPlainObject(subSchema.items) ? subSchema.items : undefined;
+    const itemType = typeof items?.type === "string" ? items.type : undefined;
+
+    if (typeof value === "string") {
+      const decoded = parseJsonSafe(value);
+      if (Array.isArray(decoded)) {
+        return { value: coerceElements(decoded, items) };
+      }
+      if (itemType !== "string") {
+        return undefined;
+      }
+      if (typeof decoded === "string" && decoded.trim()) {
+        return { value: [decoded] };
+      }
+      // Text that opens a JSON structure and then fails to parse is a
+      // truncated or malformed array, not a phrase. Wrapping it would store
+      // the broken JSON as if it were the element the caller wrote.
+      const trimmed = value.trim();
+      if (!trimmed || trimmed.startsWith("[") || trimmed.startsWith("{")) {
+        return undefined;
+      }
+      return { value: [value] };
+    }
+
+    if (
+      itemType === "object" &&
+      isPlainObject(value) &&
+      matchesItemProperties(value, items)
+    ) {
+      return { value: coerceElements([value], items) };
+    }
+
+    return undefined;
+  });
+}
+
+/**
+ * Apply the scalar coercions to each object element against the item schema.
+ *
+ * Only top-level properties are coerced when a call arrives already in the
+ * declared shape, because that is the only level the validator type-checks.
+ * An array this function builds has no such level yet: its elements were text
+ * a moment ago, and their properties carry whatever the model serialized,
+ * including the string-encoded booleans this module exists to read. Coercing
+ * them here keeps a repaired element from reaching an executor in a shape a
+ * natively-sent one could not.
+ */
+function coerceElements(
+  elements: unknown[],
+  itemSchema: Record<string, unknown> | undefined,
+): unknown[] {
+  if (!isPlainObject(itemSchema?.properties)) {
+    return elements;
   }
-  return coerced ?? input;
+  return elements.map((element) =>
+    isPlainObject(element)
+      ? coerceStringNumbers(
+          coerceStringBooleans(element, itemSchema),
+          itemSchema,
+        )
+      : element,
+  );
+}
+
+/**
+ * Whether `value` reads as one element of `itemSchema`: every key it carries
+ * is a property that schema declares. An object that fails this is some other
+ * shape (most often a map keyed by data rather than by field name), which is
+ * not a single element and must not be wrapped as one.
+ */
+function matchesItemProperties(
+  value: Record<string, unknown>,
+  itemSchema: Record<string, unknown> | undefined,
+): boolean {
+  const properties = itemSchema?.properties;
+  if (!isPlainObject(properties)) {
+    return false;
+  }
+  const keys = Object.keys(value);
+  return keys.length > 0 && keys.every((key) => key in properties);
 }
 
 /**
@@ -241,6 +369,15 @@ export function validateInputAgainstSchema(
     }
     if (typeof declaredType === "string" && SUPPORTED_TYPES.has(declaredType)) {
       const type = declaredType as SupportedType;
+      if (
+        type === "array" &&
+        (typeof value === "string" || isPlainObject(value))
+      ) {
+        errors.push(
+          `${key} must be an array: pass a JSON array, not ${typeof value === "string" ? "a string" : "an object"}`,
+        );
+        continue;
+      }
       if (!matchesType(value, type)) {
         errors.push(
           type === "boolean" && typeof value === "string"

package/src/subagent/__tests__/consult-context-gating.test.ts

@@ -50,10 +50,9 @@ const sources = {
   // A path that does not exist, so the workspace-tree section stays empty and
   // the assertions isolate the gated surfaces.
   workingDir: "/tmp/does-not-exist-consult-gating",
-  // A remote, non-guardian per-turn snapshot: the case the live-state read
-  // could have wrongly elevated.
+  // A non-guardian per-turn snapshot: the case the live-state read could have
+  // wrongly elevated.
   trustClass: "unknown" as const,
-  sourceChannel: "telegram",
   allowedToolNames: new Set<string>(),
 };
 
@@ -87,12 +86,9 @@ describe("advisor context pack: personal-memory gating", () => {
   test("feeds the gate the per-turn trust snapshot, not live conversation state", async () => {
     personalAllowed = true;
     await buildAdvisorContext(sources);
-    // The gate must see exactly the snapshot threaded from ToolContext
-    // (trustClass + executionChannel) so a concurrent live-trust change can't
-    // elevate this invocation.
-    expect(gateArg).toEqual({
-      sourceChannel: "telegram",
-      trustClass: "unknown",
-    });
+    // The gate must see exactly the class threaded from the ToolContext
+    // snapshot, so a concurrent live-trust change cannot elevate this
+    // invocation.
+    expect(gateArg).toEqual({ trustClass: "unknown" });
   });
 });

package/src/subagent/consult-context.ts

@@ -33,7 +33,6 @@
 import { readdir } from "node:fs/promises";
 import { join } from "node:path";
 
-import type { ChannelId } from "../channels/types.js";
 import type { SkillSummary } from "../config/skills.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
@@ -46,16 +45,11 @@ export interface AdvisorContextSources {
   allowedToolNames?: ReadonlySet<string>;
   /**
    * Trust class of the turn's actor, from the per-turn `ToolContext.trustClass`
-   * snapshot. Gates (with {@link sourceChannel}) the personal-memory surfaces.
+   * snapshot. Gates the personal-memory surfaces, evaluated exactly as the
+   * injectors do and off the same per-turn snapshot rather than the mutable
+   * live conversation trust.
    */
   trustClass: TrustClass;
-  /**
-   * Channel the turn originates on, from the per-turn `ToolContext.executionChannel`
-   * snapshot. Combined with {@link trustClass} to evaluate personal-memory
-   * access exactly as the injectors do, off the same per-turn snapshot rather
-   * than the mutable live conversation trust.
-   */
-  sourceChannel?: string;
   /**
    * Per-chat plugin scope from `ToolContext.enabledPluginSet`: `null` means no
    * restriction; otherwise plugin-owned skills outside the set are omitted
@@ -263,18 +257,13 @@ export async function buildWorkspaceTree(
  */
 async function personalMemoryAllowedForAdvisor(
   trustClass: TrustClass,
-  sourceChannel: string | undefined,
 ): Promise<boolean> {
   try {
     const { isPersonalMemoryAllowed } =
       await import("../daemon/trust-context.js");
-    // `isPersonalMemoryAllowed` reads only `sourceChannel` + `trustClass`; build
-    // a minimal trust context from the per-turn snapshot. The channel may be
-    // absent (local/internal turns), which the gate treats as non-remote.
-    const snapshot = {
-      sourceChannel: sourceChannel as ChannelId | undefined,
-      trustClass,
-    } as TrustContext;
+    // The gate decides from the trust class alone, so the per-turn snapshot's
+    // class is the whole input.
+    const snapshot = { trustClass } as TrustContext;
     return isPersonalMemoryAllowed(snapshot);
   } catch {
     return false;
@@ -318,12 +307,7 @@ async function buildWorkspaceSection(
   // toggle) the runtime injectors use, evaluated off the per-turn trust
   // snapshot, so a low-risk advisor consult cannot forward private content the
   // main agent would never receive.
-  if (
-    await personalMemoryAllowedForAdvisor(
-      sources.trustClass,
-      sources.sourceChannel,
-    )
-  ) {
+  if (await personalMemoryAllowedForAdvisor(sources.trustClass)) {
     try {
       const [{ readNowScratchpad }, { getConfig }] = await Promise.all([
         import("../daemon/now-scratchpad.js"),

package/src/tools/credentials/broker.ts

@@ -18,37 +18,17 @@ import type {
 import { isDomainAllowed } from "./domain-policy.js";
 import { getCredentialMetadata } from "./metadata-store.js";
 import { resolveById } from "./resolve.js";
-import { isToolAllowed } from "./tool-policy.js";
+import {
+  isToolAllowed,
+  serverUseDenialReason,
+  toolNotAllowedReason,
+} from "./tool-policy.js";
 
 const log = getLogger("credential-broker");
 
 /** Tokens expire after 5 minutes to limit the window for using stale/revoked credentials. */
 const TOKEN_TTL_MS = 5 * 60 * 1000;
 
-/**
- * Remediation for a credential whose allowed_tools list is empty. Points at
- * `credentials prompt` (not inline `credentials set`, which agent shells
- * refuse): the secure prompt re-collects the value and sets allowed_tools.
- */
-const NO_TOOLS_ALLOWED_REMEDIATION =
-  "No tools are currently allowed - grant access via `assistant credentials prompt --service <service> --field <field> --label <label> --allowed-tools <tools>` (re-collects the value securely and sets allowed_tools).";
-
-/** Denial reason for a tool that is not in a credential's allowed_tools list. */
-function toolNotAllowedReason(
-  toolName: string,
-  service: string,
-  field: string,
-  allowedTools: string[] | undefined,
-): string {
-  const tools = allowedTools ?? [];
-  return (
-    `Tool "${toolName}" is not allowed to use credential ${service}/${field}. ` +
-    (tools.length === 0
-      ? NO_TOOLS_ALLOWED_REMEDIATION
-      : `Allowed tools: ${tools.join(", ")}.`)
-  );
-}
-
 /**
  * Credential broker that issues single-use tokens for policy-checked credential access.
  *
@@ -292,36 +272,14 @@ export class CredentialBroker {
     request: ServerUseRequest<T>,
   ): Promise<ServerUseResult<T>> {
     const metadata = getCredentialMetadata(request.service, request.field);
-    if (!metadata) {
-      return {
-        success: false,
-        reason: `No credential found for ${request.service}/${request.field}`,
-      };
-    }
-
-    if (!isToolAllowed(request.toolName, metadata.allowedTools)) {
-      return {
-        success: false,
-        reason: toolNotAllowedReason(
-          request.toolName,
-          request.service,
-          request.field,
-          metadata.allowedTools,
-        ),
-      };
-    }
-
-    // Domain policy enforcement - credentials with domain restrictions are
-    // scoped to browser use on those domains and cannot be used server-side.
-    const serverDomains = metadata.allowedDomains ?? [];
-    if (serverDomains.length > 0) {
-      return {
-        success: false,
-        reason:
-          `Credential ${request.service}/${request.field} has domain restrictions ` +
-          `(${serverDomains.join(", ")}) and cannot be used server-side. ` +
-          "Remove domain restrictions or use a separate credential without domain policy.",
-      };
+    const denialReason = serverUseDenialReason(
+      metadata,
+      request.toolName,
+      request.service,
+      request.field,
+    );
+    if (denialReason) {
+      return { success: false, reason: denialReason };
     }
 
     const storageKey = credentialKey(request.service, request.field);
@@ -381,30 +339,17 @@ export class CredentialBroker {
 
     const { metadata } = resolved;
 
-    // Tool policy enforcement
-    if (!isToolAllowed(request.requestingTool, metadata.allowedTools)) {
-      return {
-        success: false,
-        reason: toolNotAllowedReason(
-          request.requestingTool,
-          metadata.service,
-          metadata.field,
-          metadata.allowedTools,
-        ),
-      };
-    }
-
-    // Domain policy enforcement - credentials with domain restrictions are
-    // scoped to browser use on those domains and cannot be used server-side.
-    const domains = metadata.allowedDomains ?? [];
-    if (domains.length > 0) {
-      return {
-        success: false,
-        reason:
-          `Credential ${metadata.service}/${metadata.field} has domain restrictions ` +
-          `(${domains.join(", ")}) and cannot be used server-side. ` +
-          "Remove domain restrictions or use a separate credential without domain policy.",
-      };
+    // Shared server-use policy: the ID lookup above is the only by-ID-specific
+    // gate, so tool and domain enforcement come from the same helper serverUse
+    // uses.
+    const denialReason = serverUseDenialReason(
+      metadata,
+      request.requestingTool,
+      metadata.service,
+      metadata.field,
+    );
+    if (denialReason) {
+      return { success: false, reason: denialReason };
     }
 
     // Fail-closed: verify the secret value actually exists in secure storage.

package/src/tools/credentials/ref-parse.ts

@@ -0,0 +1,35 @@
+/**
+ * Credential reference parsing. Pure string work, no store access.
+ *
+ * `"service/field"` is the shared vocabulary of every credential entry point:
+ * the CLI, the reveal and set routes, and the plugin-facing read and write
+ * APIs all name credentials this way. The rules for what counts as a valid
+ * reference live here so each path applies the same ones.
+ *
+ * Deliberately separate from {@link ./resolve}, which reads the metadata store:
+ * a caller that only needs to split a reference should not import a module
+ * whose behavior depends on what is stored.
+ */
+
+/**
+ * Parse a `"service/field"` credential reference into its parts.
+ *
+ * Returns undefined for anything that is not exactly one non-empty segment on
+ * each side of a single slash: no slash, a leading or trailing slash, or more
+ * than one slash as in `"fal/api/key"`.
+ */
+export function parseServiceFieldRef(
+  ref: string,
+): { service: string; field: string } | undefined {
+  const slashIndex = ref.indexOf("/");
+  if (slashIndex <= 0 || slashIndex >= ref.length - 1) {
+    return undefined;
+  }
+  if (ref.indexOf("/", slashIndex + 1) !== -1) {
+    return undefined;
+  }
+  return {
+    service: ref.slice(0, slashIndex),
+    field: ref.slice(slashIndex + 1),
+  };
+}

package/src/tools/credentials/resolve.ts

@@ -16,6 +16,7 @@ import {
   listCredentialMetadata,
 } from "./metadata-store.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
+import { parseServiceFieldRef } from "./ref-parse.js";
 
 export interface ResolvedCredential {
   credentialId: string;
@@ -95,18 +96,11 @@ export function resolveCredentialRef(
   }
 
   // Try as service/field
-  const slashIndex = ref.indexOf("/");
-  if (slashIndex <= 0 || slashIndex >= ref.length - 1) {
+  const parsed = parseServiceFieldRef(ref);
+  if (!parsed) {
     return undefined;
   }
-  // Reject refs with more than one slash (e.g. "fal/api/key")
-  if (ref.indexOf("/", slashIndex + 1) !== -1) {
-    return undefined;
-  }
-
-  const service = ref.slice(0, slashIndex);
-  const field = ref.slice(slashIndex + 1);
-  return resolveByServiceField(service, field);
+  return resolveByServiceField(parsed.service, parsed.field);
 }
 
 /**