@vellumai/assistant 0.11.6 → 0.11.7-staging.1

package/src/tools/credentials/broker.ts

@@ -1,23 +1,14 @@
-import { v4 as uuid } from "uuid";
-
 import { credentialKey } from "../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import type {
-  AuthorizeRequest,
-  AuthorizeResult,
   BrowserFillRequest,
   BrowserFillResult,
-  ConsumeResult,
-  ServerUseByIdRequest,
-  ServerUseByIdResult,
   ServerUseRequest,
   ServerUseResult,
-  UsageToken,
 } from "./broker-types.js";
 import { isDomainAllowed } from "./domain-policy.js";
 import { getCredentialMetadata } from "./metadata-store.js";
-import { resolveById } from "./resolve.js";
 import {
   isToolAllowed,
   serverUseDenialReason,
@@ -26,21 +17,17 @@ import {
 
 const log = getLogger("credential-broker");
 
-/** Tokens expire after 5 minutes to limit the window for using stale/revoked credentials. */
-const TOKEN_TTL_MS = 5 * 60 * 1000;
-
 /**
- * Credential broker that issues single-use tokens for policy-checked credential access.
+ * Credential broker that mediates policy-checked credential access.
  *
- * The broker never exposes plaintext secret values. Instead, it:
+ * The broker never exposes plaintext secret values to callers. It:
  * 1. Checks that a credential exists and has metadata
- * 2. Issues a single-use token for the authorized usage
- * 3. On consumption, returns the storage key so the caller can read the secret internally
+ * 2. Enforces tool and domain policy
+ * 3. Reads the secret internally and passes it to an opaque callback
  *
- * Tool policy is enforced at authorize/fill time; domain policy is enforced at fill time.
+ * Tool policy is enforced at fill/use time; domain policy is enforced at fill time.
  */
 export class CredentialBroker {
-  private tokens = new Map<string, UsageToken>();
   /** Transient values for one-time send: consumed on first read, never persisted.
    *  Values are wrapped in objects so post-await guards use reference identity
    *  (not string value equality) to detect concurrent replacements. */
@@ -48,7 +35,7 @@ export class CredentialBroker {
 
   /**
    * Inject a value for one-time use. The value is consumed on the next
-   * browserFill or consume call for this service/field pair, then discarded.
+   * browserFill or serverUse call for this service/field pair, then discarded.
    */
   injectTransient(service: string, field: string, value: string): void {
     const key = credentialKey(service, field);
@@ -59,113 +46,6 @@ export class CredentialBroker {
     );
   }
 
-  /**
-   * Authorize the use of a credential for a specific tool and optional domain.
-   * Returns a single-use token on success, or a denial reason on failure.
-   */
-  authorize(request: AuthorizeRequest): AuthorizeResult {
-    const metadata = getCredentialMetadata(request.service, request.field);
-    if (!metadata) {
-      return {
-        authorized: false,
-        reason: `No credential found for ${request.service}/${request.field}`,
-      };
-    }
-
-    // Tool policy enforcement - deny if tool is not in the credential's allowed list
-    if (!isToolAllowed(request.toolName, metadata.allowedTools)) {
-      return {
-        authorized: false,
-        reason: toolNotAllowedReason(
-          request.toolName,
-          request.service,
-          request.field,
-          metadata.allowedTools,
-        ),
-      };
-    }
-
-    const token: UsageToken = {
-      tokenId: uuid(),
-      credentialId: metadata.credentialId,
-      service: request.service,
-      field: request.field,
-      toolName: request.toolName,
-      createdAt: Date.now(),
-      consumed: false,
-    };
-
-    this.tokens.set(token.tokenId, token);
-    log.info(
-      {
-        tokenId: token.tokenId,
-        service: request.service,
-        field: request.field,
-        tool: request.toolName,
-      },
-      "Usage token issued",
-    );
-
-    return { authorized: true, token: { ...token } };
-  }
-
-  /**
-   * Consume a previously issued token. Returns the storage key on success.
-   * Each token can only be consumed once.
-   */
-  consume(tokenId: string): ConsumeResult {
-    const token = this.tokens.get(tokenId);
-    if (!token) {
-      return { success: false, reason: "Token not found or already revoked" };
-    }
-    if (token.consumed) {
-      return { success: false, reason: "Token already consumed" };
-    }
-    if (Date.now() - token.createdAt > TOKEN_TTL_MS) {
-      this.tokens.delete(tokenId);
-      log.info({ tokenId }, "Token expired (TTL exceeded)");
-      return { success: false, reason: "Token expired" };
-    }
-
-    token.consumed = true;
-    const storageKey = credentialKey(token.service, token.field);
-    // Check for transient value first (one-time send) - consume and return the value
-    // directly since transient values are never persisted to secure storage.
-    const transient = this.transientValues.get(storageKey);
-    if (transient !== undefined) {
-      this.transientValues.delete(storageKey);
-      log.info(
-        { tokenId, storageKey, transient: true },
-        "Usage token consumed (transient)",
-      );
-      return { success: true, storageKey, value: transient.value };
-    }
-
-    log.info({ tokenId, storageKey }, "Usage token consumed");
-    return { success: true, storageKey };
-  }
-
-  /**
-   * Revoke a token, removing it from the active set.
-   * Returns true if the token existed and was revoked.
-   */
-  revoke(tokenId: string): boolean {
-    const existed = this.tokens.delete(tokenId);
-    if (existed) {
-      log.info({ tokenId }, "Usage token revoked");
-    }
-    return existed;
-  }
-
-  /** Revoke all tokens (e.g. on conversation teardown). */
-  revokeAll(): void {
-    const count = this.tokens.size;
-    this.tokens.clear();
-    if (count > 0) {
-      log.info({ count }, "All usage tokens revoked");
-    }
-  }
-
   /**
    * Fill a browser field using a credential without exposing plaintext to the caller.
    *
@@ -317,81 +197,6 @@ export class CredentialBroker {
       return { success: false, reason: "Credential use failed" };
     }
   }
-
-  /**
-   * Look up a credential by its opaque ID for proxy injection.
-   *
-   * Returns metadata and injection templates so the proxy knows how to
-   * inject the credential into outbound requests. The secret value is
-   * never included in the result - the proxy reads it separately via
-   * the secure key backend at injection time.
-   */
-  async serverUseById(
-    request: ServerUseByIdRequest,
-  ): Promise<ServerUseByIdResult> {
-    const resolved = resolveById(request.credentialId);
-    if (!resolved) {
-      return {
-        success: false,
-        reason: `No credential found for id "${request.credentialId}"`,
-      };
-    }
-
-    const { metadata } = resolved;
-
-    // Shared server-use policy: the ID lookup above is the only by-ID-specific
-    // gate, so tool and domain enforcement come from the same helper serverUse
-    // uses.
-    const denialReason = serverUseDenialReason(
-      metadata,
-      request.requestingTool,
-      metadata.service,
-      metadata.field,
-    );
-    if (denialReason) {
-      return { success: false, reason: denialReason };
-    }
-
-    // Fail-closed: verify the secret value actually exists in secure storage.
-    // Without this, downstream proxy code would attempt unauthenticated requests.
-    const value = await getSecureKeyAsync(resolved.storageKey);
-    if (!value) {
-      return {
-        success: false,
-        reason: `Credential metadata exists but no stored value for ${metadata.service}/${metadata.field}`,
-      };
-    }
-
-    log.info(
-      {
-        credentialId: request.credentialId,
-        service: metadata.service,
-        field: metadata.field,
-        tool: request.requestingTool,
-      },
-      "Server-side credential lookup by ID completed",
-    );
-
-    return {
-      success: true,
-      credentialId: resolved.credentialId,
-      service: resolved.service,
-      field: resolved.field,
-      injectionTemplates: resolved.injectionTemplates,
-    };
-  }
-
-  /** Return the number of active (non-consumed, non-revoked, non-expired) tokens. */
-  get activeTokenCount(): number {
-    const now = Date.now();
-    let count = 0;
-    for (const token of this.tokens.values()) {
-      if (!token.consumed && now - token.createdAt <= TOKEN_TTL_MS) {
-        count++;
-      }
-    }
-    return count;
-  }
 }
 
 /** Shared singleton broker instance used by vault and browser tools. */

package/src/tools/executor.ts

@@ -33,6 +33,7 @@ import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { fileEditInputSchema } from "./filesystem/edit.js";
 import { fileWriteInputSchema } from "./filesystem/write.js";
+import { getHostShell } from "./host-shell.js";
 import { PermissionChecker } from "./permission-checker.js";
 import { getToolOwner } from "./registry.js";
 import { extractAndSanitize } from "./sensitive-output-placeholders.js";
@@ -89,6 +90,7 @@ export class ToolExecutor {
         undefined,
         undefined,
         context.signal,
+        getHostShell(context, input),
       );
     } catch {
       // Stays undefined; the audit row records RISK_LEVEL_UNCLASSIFIED.
@@ -108,12 +110,6 @@ export class ToolExecutor {
     let permApprovalMode: string | undefined;
     let permApprovalReason: string | undefined;
     let permRiskThreshold: string | undefined;
-    // Whether THIS invocation was interactively prompted. Distinct from the
-    // turn-level `context.approvedViaPrompt` (seeded from
-    // `approvedViaPromptThisTurn`, which stays true for later auto-approved
-    // tools in the same turn): the `permission_decided` telemetry must reflect
-    // a prompt for this specific call, not any prompt earlier in the turn.
-    let wasPromptedThisInvocation = false;
     // Run pre-execution approval gates (abort, guardian policy,
     // allowed-tool-set, task-run preflight, tool registry lookup). The gate
     // resolves the tool's sandbox/host target internally.
@@ -253,7 +249,6 @@ export class ToolExecutor {
 
         if (permResult.wasPrompted) {
           context.approvedViaPrompt = true;
-          wasPromptedThisInvocation = true;
         }
       } else {
         // Grant consumed — permission check was skipped. Set provenance explicitly
@@ -324,7 +319,6 @@ export class ToolExecutor {
         matchedTrustRuleId: permMatchedTrustRuleId,
         durationMs,
         attribution: context.attribution ?? null,
-        wasPrompted: wasPromptedThisInvocation,
       });
       recordToolCompletion(
         context.conversationId,

package/src/tools/host-shell.test.ts

@@ -0,0 +1,75 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
+import { getHostShell } from "./host-shell.js";
+
+const subscriptions: Array<{ dispose(): void }> = [];
+
+afterEach(() => {
+  for (const subscription of subscriptions.splice(0)) {
+    subscription.dispose();
+  }
+});
+
+function connectHostBashClient(
+  clientId: string,
+  interfaceId: "macos" | "windows",
+): void {
+  subscriptions.push(
+    assistantEventHub.subscribe({
+      type: "client",
+      clientId,
+      interfaceId,
+      capabilities: ["host_bash"],
+      actorPrincipalId: "actor-1",
+      callback: () => {},
+    }),
+  );
+}
+
+describe("getHostShell", () => {
+  test("uses the explicitly targeted Windows client's shell", () => {
+    connectHostBashClient("windows-client", "windows");
+
+    expect(
+      getHostShell(
+        {
+          clientOs: "web",
+          transportInterface: "web",
+          sourceActorPrincipalId: "actor-1",
+        },
+        { target_client_id: "windows-client" },
+      ),
+    ).toBe("powershell");
+  });
+
+  test("uses the single same-user Windows client's shell", () => {
+    connectHostBashClient("windows-client", "windows");
+
+    expect(
+      getHostShell(
+        {
+          clientOs: "web",
+          transportInterface: "web",
+          sourceActorPrincipalId: "actor-1",
+        },
+        {},
+      ),
+    ).toBe("powershell");
+  });
+
+  test("keeps Bash classification for a targeted macOS client", () => {
+    connectHostBashClient("mac-client", "macos");
+
+    expect(
+      getHostShell(
+        {
+          clientOs: "web",
+          transportInterface: "web",
+          sourceActorPrincipalId: "actor-1",
+        },
+        { target_client_id: "mac-client" },
+      ),
+    ).toBeUndefined();
+  });
+});

package/src/tools/host-shell.ts

@@ -0,0 +1,24 @@
+import type { ClassifyRiskIpcParams } from "@vellumai/gateway-client";
+
+import { resolveInvocationHostClientOs } from "./client-os.js";
+import type { ToolContext } from "./types.js";
+
+export function getHostShell(
+  context: Pick<
+    ToolContext,
+    "clientOs" | "transportInterface" | "sourceActorPrincipalId"
+  >,
+  input: Record<string, unknown>,
+): ClassifyRiskIpcParams["shell"] {
+  const targetClientOs = resolveInvocationHostClientOs(
+    "host_bash",
+    input,
+    context,
+  );
+  return targetClientOs === "windows" ||
+    (targetClientOs === undefined &&
+      (context.clientOs === "windows" ||
+        context.transportInterface === "windows"))
+    ? "powershell"
+    : undefined;
+}

package/src/tools/host-terminal/host-shell.ts

@@ -9,7 +9,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute } from "node:path";
+import { isAbsolute, join } from "node:path";
 
 import { z } from "zod";
 
@@ -24,6 +24,11 @@ import {
 } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
+import {
+  buildShellInvocation,
+  prependUniquePathEntries,
+  terminateProcessTree,
+} from "../../util/host-process.js";
 import { getLogger } from "../../util/logger.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
 import {
@@ -67,15 +72,10 @@ const HOST_BASH_PROXY_ENV_KEYS = [
 function buildHostShellEnv(): Record<string, string> {
   const env = buildSanitizedEnv();
   // Ensure ~/.local/bin and ~/.bun/bin are in PATH so `vellum` and `bun` are
-  // always reachable, even when the daemon is launched from a macOS app
-  // bundle that inherits a minimal PATH.
+  // reachable when a desktop app launches the assistant with a minimal PATH.
   const home = homedir();
-  const extraDirs = [`${home}/.local/bin`, `${home}/.bun/bin`];
-  const currentPath = env.PATH ?? "";
-  const missing = extraDirs.filter((d) => !currentPath.split(":").includes(d));
-  if (missing.length > 0) {
-    env.PATH = [...missing, currentPath].filter(Boolean).join(":");
-  }
+  const extraDirs = [join(home, ".local", "bin"), join(home, ".bun", "bin")];
+  env.PATH = prependUniquePathEntries(env.PATH, extraDirs);
   return env;
 }
 
@@ -466,7 +466,8 @@ export const hostShellTool = {
       const bgId = generateBackgroundToolId();
       const startedAt = Date.now();
 
-      const child = spawn("bash", ["-c", "--", command], {
+      const wrapped = buildShellInvocation(command);
+      const child = spawn(wrapped.command, wrapped.args, {
         cwd: workingDir,
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
@@ -480,21 +481,7 @@ export const hostShellTool = {
       // event reports "cancelled" rather than "failed".
       let aborted = false;
 
-      const killTree = () => {
-        if (child.pid != null) {
-          try {
-            process.kill(-child.pid, "SIGKILL");
-            return;
-          } catch {
-            // Process group may have already exited — fall through.
-          }
-        }
-        try {
-          child.kill("SIGKILL");
-        } catch {
-          // Child may have already exited.
-        }
-      };
+      const killTree = () => terminateProcessTree(child);
 
       const timer = setTimeout(() => {
         timedOut = true;
@@ -666,31 +653,15 @@ export const hostShellTool = {
       const stderrChunks: Buffer[] = [];
       let timedOut = false;
 
-      const child = spawn("bash", ["-c", "--", command], {
+      const wrapped = buildShellInvocation(command);
+      const child = spawn(wrapped.command, wrapped.args, {
         cwd: workingDir,
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
         detached: true,
       });
 
-      // Kill the entire process tree. Tries the process group first
-      // (negative PID), then falls back to killing the direct child if the
-      // PID is unavailable or the group kill fails.
-      const killTree = () => {
-        if (child.pid != null) {
-          try {
-            process.kill(-child.pid, "SIGKILL");
-            return;
-          } catch {
-            // Process group may have already exited — fall through.
-          }
-        }
-        try {
-          child.kill("SIGKILL");
-        } catch {
-          // Child may have already exited.
-        }
-      };
+      const killTree = () => terminateProcessTree(child);
 
       const timer = setTimeout(() => {
         timedOut = true;

package/src/tools/mcp/mcp-tool-factory.ts

@@ -27,24 +27,59 @@ export interface McpToolMetadata {
   annotations?: McpToolAnnotations;
 }
 
+/** Risk levels ordered low to high, so a hint can step one place along it. */
+const RISK_LADDER: readonly RiskLevel[] = [
+  RiskLevel.Low,
+  RiskLevel.Medium,
+  RiskLevel.High,
+];
+
+function stepRisk(risk: RiskLevel, direction: -1 | 1): RiskLevel {
+  const index = RISK_LADDER.indexOf(risk);
+  if (index === -1) {
+    return risk;
+  }
+  const next = Math.min(Math.max(index + direction, 0), RISK_LADDER.length - 1);
+  return RISK_LADDER[next] ?? risk;
+}
+
 /**
  * Resolve the risk level a tool carries.
  *
- * `readOnlyHint` is self-reported by the server, so it only refines risk
- * downward and only for servers the user has already configured below the
- * high-trust ceiling. Servers left at the default "high" are unaffected, and
- * the hint never raises risk above the server default.
+ * The server's configured level is the anchor, and a tool's own MCP
+ * annotations move it at most one step along {@link RISK_LADDER}.
+ *
+ * `destructiveHint` steps up. Raising is the safe direction, so it applies at
+ * any server level.
+ *
+ * `readOnlyHint` steps down, and only from {@link RiskLevel.Medium}. Medium is
+ * the schema default, so a server sitting at High got there because the user
+ * put it there. A hint is self-reported by the server, and letting one lower a
+ * deliberately pinned server would hand a lying server the auto-approval the
+ * user withheld: under the Relaxed preset Medium carries no prompt at all. High
+ * is therefore the floor for downward hints.
+ *
+ * `destructiveHint` wins when a server sends both, since a tool that both reads
+ * and destroys is a tool that destroys.
+ *
+ * The MCP spec defaults `destructiveHint` to true when it is absent. This
+ * deliberately does not, because the server's configured level already answers
+ * that question: choosing a level for a server is the user's statement about
+ * what its unlabeled tools are worth. Honoring the spec default instead would
+ * put every tool of every unannotated server back at High, which is the
+ * behavior this replaces.
  */
 function resolveRiskLevel(
   metadata: McpToolMetadata,
   serverConfig: McpServerConfig,
 ): RiskLevel {
   const serverRisk = riskMap[serverConfig.defaultRiskLevel] ?? RiskLevel.High;
-  if (
-    metadata.annotations?.readOnlyHint === true &&
-    serverRisk !== RiskLevel.High
-  ) {
-    return RiskLevel.Low;
+  const annotations = metadata.annotations;
+  if (annotations?.destructiveHint === true) {
+    return stepRisk(serverRisk, 1);
+  }
+  if (annotations?.readOnlyHint === true && serverRisk === RiskLevel.Medium) {
+    return stepRisk(serverRisk, -1);
   }
   return serverRisk;
 }