@vellumai/assistant 0.11.6 → 0.11.7-staging.1

package/src/tools/permission-checker.ts

@@ -25,11 +25,15 @@ import type {
 import { RiskLevel } from "../permissions/types.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
 import {
+  type PermissionPromptOutcome,
+  type PermissionPromptTelemetry,
   recordToolDenied,
+  recordToolPermissionDecided,
   recordToolPermissionPrompted,
 } from "../telemetry/tool-audit.js";
 import { getLogger } from "../util/logger.js";
 import { resolveExecutionTarget } from "./execution-target.js";
+import { getHostShell } from "./host-shell.js";
 import { buildPolicyContext } from "./policy-context.js";
 import { isSideEffectTool } from "./side-effects.js";
 import type { Tool, ToolContext } from "./types.js";
@@ -124,6 +128,7 @@ export class PermissionChecker {
       undefined,
       undefined,
       context.signal,
+      getHostShell(context, input),
     );
     const { level: risk, reason: riskReason } = classification;
     const riskLevel: string = risk;
@@ -168,6 +173,7 @@ export class PermissionChecker {
         policyContext.conversationId,
         policyContext.executionContext,
         cellQuery,
+        policyContext.requesterContactId,
       );
       const riskThreshold = conversationThreshold as RiskThreshold;
 
@@ -210,7 +216,6 @@ export class PermissionChecker {
           reason: result.reason,
           riskLevel,
           durationMs: Date.now() - startTime,
-          wasPrompted: false,
         });
         const provenance = mapApprovalProvenance("denied", {});
         return {
@@ -249,7 +254,6 @@ export class PermissionChecker {
             "Inline-command skill load requires human approval; no interactive client connected",
           riskLevel,
           durationMs: Date.now() - startTime,
-          wasPrompted: false,
         });
         return {
           allowed: false,
@@ -316,6 +320,7 @@ export class PermissionChecker {
             context.conversationId,
             "background",
             cellQuery,
+            context.requesterContactId,
           );
           const thresholdOrdinal: Record<string, number> = {
             none: -1,
@@ -361,7 +366,6 @@ export class PermissionChecker {
             reason: "Non-interactive session: no client to approve prompt",
             riskLevel,
             durationMs: Date.now() - startTime,
-            wasPrompted: false,
           });
           return {
             allowed: false,
@@ -385,27 +389,76 @@ export class PermissionChecker {
           persistentDecisionsAllowed: !context.requireFreshApproval,
         };
 
-        recordToolPermissionPrompted(name);
-
-        const response = await this.prompter.prompt(
-          name,
-          input,
+        // Grouping dimensions shared by this prompt and its decision, so the
+        // two series can be diffed by risk and by access preset without
+        // parsing anything out of the event name.
+        const promptTelemetry: PermissionPromptTelemetry = {
+          toolName: name,
           riskLevel,
-          promptOptions.allowlistOptions,
-          promptOptions.scopeOptions,
-          previewDiff,
-          context.conversationId,
-          executionTarget,
-          promptOptions.persistentDecisionsAllowed,
-          context.signal,
-          context.toolUseId,
-          riskReason,
-          getIsContainerized(),
-          classification.directoryScopeOptions,
-        );
+          riskThreshold,
+          surface: context.executionChannel,
+          conversationId: context.conversationId,
+        };
+        // An already-aborted signal makes the prompter return without
+        // registering or sending a confirmation request, so nothing reaches
+        // the user and neither half of the pair is recorded. `prompt()` reads
+        // the same signal synchronously on entry, with no await in between, so
+        // this check and its check always agree.
+        const promptIsSurfaced = context.signal?.aborted !== true;
+        if (promptIsSurfaced) {
+          recordToolPermissionPrompted(promptTelemetry);
+        }
+
+        let response: Awaited<ReturnType<PermissionPrompter["prompt"]>>;
+        try {
+          response = await this.prompter.prompt(
+            name,
+            input,
+            riskLevel,
+            promptOptions.allowlistOptions,
+            promptOptions.scopeOptions,
+            previewDiff,
+            context.conversationId,
+            executionTarget,
+            promptOptions.persistentDecisionsAllowed,
+            context.signal,
+            context.toolUseId,
+            riskReason,
+            getIsContainerized(),
+            classification.directoryScopeOptions,
+          );
+        } catch (err) {
+          // The prompter rejected rather than resolved: it was disposed while
+          // this prompt was outstanding (client disconnect, conversation
+          // teardown). Nobody answered, so the prompt is abandoned.
+          if (promptIsSurfaced) {
+            recordToolPermissionDecided(promptTelemetry, "abandoned");
+          }
+          throw err;
+        }
 
         const decision = response.decision;
 
+        // A prompt that ends without a human answer is abandoned, not denied.
+        // The daemon resolves a timeout, a superseding user message, and a
+        // turn abort to `deny` so the agent loop stops, but none of the three
+        // is a decision the user made.
+        let outcome: PermissionPromptOutcome;
+        if (
+          response.wasTimeout === true ||
+          response.wasSystemCancel === true ||
+          response.wasAbort === true
+        ) {
+          outcome = "abandoned";
+        } else if (decision === "deny") {
+          outcome = "deny";
+        } else {
+          outcome = "allow";
+        }
+        if (promptIsSurfaced) {
+          recordToolPermissionDecided(promptTelemetry, outcome);
+        }
+
         if (decision === "deny") {
           const contextualDenial =
             typeof response.decisionContext === "string"
@@ -426,7 +479,6 @@ export class PermissionChecker {
             reason: denialReason,
             riskLevel,
             durationMs: Date.now() - startTime,
-            wasPrompted: true,
           });
           return {
             allowed: false,

package/src/tools/policy-context.ts

@@ -62,6 +62,7 @@ export function buildPolicyContext(
   const originSignals = {
     requestOrigin: context?.requestOrigin,
     ...channelCoordinatesFromToolContext(context),
+    requesterContactId: context?.requesterContactId,
     // Precompute the proc-to-skills gate — the v3 tier being active, i.e.
     // memory on AND v3 live — here so the permission checker, a leaf module
     // that must not read config, can deny the memory-retrospective

package/src/tools/shared/filesystem/image-read.ts

@@ -76,7 +76,7 @@ async function buildImageToolResult(
   }
 
   // Detect actual format from magic bytes - never trust the file extension
-  // alone, since sips converts to JPEG and files can be misnamed.
+  // alone, since conversion produces JPEG and files can be misnamed.
   const detectedType = detectMediaType(buffer);
   if (!detectedType) {
     return {

package/src/tools/skills/find-similar-skills.ts

@@ -3,6 +3,10 @@ import { loadSkillCatalog } from "../../config/skills.js";
 import { nearestExistingSkills } from "../../plugins/defaults/memory/v3/candidate-match.js";
 import { readInstallMeta } from "../../skills/install-meta.js";
 import { getManagedSkillDir } from "../../skills/managed-store.js";
+import {
+  filterSkillsByPlatform,
+  type SkillPlatform,
+} from "../../skills/platform-compatibility.js";
 import type { OwnerInfo, ToolContext, ToolExecutionResult } from "../types.js";
 
 /**
@@ -45,6 +49,7 @@ export async function executeFindSimilarSkills(
       description: string;
       source: SkillSource;
       owner?: OwnerInfo;
+      platforms?: SkillPlatform[];
     }[];
   } = {},
 ): Promise<ToolExecutionResult> {
@@ -92,8 +97,11 @@ export async function executeFindSimilarSkills(
   // slices only those. Filtering after the limit would let out-of-scope
   // high-rank matches consume slots and starve usable in-scope skills out of
   // the result. `null` set = pass the catalog through unchanged.
-  const scopedCatalog =
-    enabledPluginSet === null ? catalog : catalog.filter((s) => !outOfScope(s));
+  const scopedCatalog = filterSkillsByPlatform(
+    enabledPluginSet === null
+      ? catalog
+      : catalog.filter((skill) => !outOfScope(skill)),
+  );
 
   const hits = await findNearest(goal, {
     limit,

package/src/tools/skills/load.ts

@@ -21,10 +21,15 @@ import {
   validateIncludeCycles,
 } from "../../skills/include-graph.js";
 import { renderInlineCommands } from "../../skills/inline-command-render.js";
+import {
+  isSkillCompatibleWithPlatform,
+  skillPlatformUnavailableMessage,
+} from "../../skills/platform-compatibility.js";
 import { parseToolManifestFile } from "../../skills/tool-manifest.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDirDisplay } from "../../util/platform.js";
+import { supportsClientOsForSkillTool } from "../client-os.js";
 import type {
   ToolContext,
   ToolDefinition,
@@ -83,8 +88,23 @@ function loadToolManifest(
  */
 function formatToolSchemas(
   manifest: SkillToolManifest,
+  context: Pick<
+    ToolContext,
+    "clientOs" | "transportInterface" | "sourceActorPrincipalId"
+  >,
   childSkillName?: string,
-): string {
+): string | undefined {
+  const tools = manifest.tools.filter((tool) =>
+    supportsClientOsForSkillTool(tool.supported_client_os, tool.name, {
+      clientOs: context.clientOs,
+      transportInterface: context.transportInterface,
+      sourceActorPrincipalId: context.sourceActorPrincipalId,
+    }),
+  );
+  if (tools.length === 0) {
+    return undefined;
+  }
+
   const lines: string[] = childSkillName
     ? [`### Tools from ${childSkillName}`, ""]
     : [
@@ -96,7 +116,7 @@ function formatToolSchemas(
 
   const toolHeadingLevel = childSkillName ? "####" : "###";
 
-  for (const tool of manifest.tools) {
+  for (const tool of tools) {
     lines.push(`${toolHeadingLevel} ${tool.name}`);
     lines.push(
       tool.description.replaceAll("{workspaceDir}", getWorkspaceDirDisplay()),
@@ -211,6 +231,13 @@ export const skillLoadTool = {
 
     const skill = loaded.skill;
 
+    if (!isSkillCompatibleWithPlatform(skill)) {
+      return {
+        content: `Error: ${skillPlatformUnavailableMessage(skill.id, skill)}`,
+        isError: true,
+      };
+    }
+
     // Per-chat plugin scope gate: a plugin-owned skill whose owning plugin is
     // outside the conversation's effective set must not have its instructions
     // loaded. Mirrors the projection/tools filter's owner-id lookup
@@ -403,7 +430,7 @@ export const skillLoadTool = {
     // Load tool schemas for the main skill
     const mainManifest = loadToolManifest(skill.directoryPath);
     const toolSchemasSection = mainManifest
-      ? formatToolSchemas(mainManifest)
+      ? formatToolSchemas(mainManifest, context)
       : undefined;
 
     // Build immediate children metadata section and load included skill bodies
@@ -422,6 +449,9 @@ export const skillLoadTool = {
         if (childOutOfPluginScope(child)) {
           continue;
         }
+        if (!isSkillCompatibleWithPlatform(child)) {
+          continue;
+        }
         const childFlagKey = skillFlagKey(child);
         if (
           childFlagKey &&
@@ -518,10 +548,15 @@ export const skillLoadTool = {
             childLoaded.skill.directoryPath,
           );
           if (childManifest) {
-            anyChildHasTools = true;
-            includedBodies.push(
-              formatToolSchemas(childManifest, childLoaded.skill.displayName),
+            const childSchemas = formatToolSchemas(
+              childManifest,
+              context,
+              childLoaded.skill.displayName,
             );
+            if (childSchemas) {
+              anyChildHasTools = true;
+              includedBodies.push(childSchemas);
+            }
           }
         }
       }

package/src/tools/skills/sandbox-runner.ts

@@ -5,6 +5,10 @@ import { join, resolve } from "node:path";
 
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
 import { safeStringSlice } from "../../util/unicode.js";
 import { buildSanitizedEnv } from "../terminal/safe-env.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
@@ -139,7 +143,7 @@ function spawnRunner(
     let timedOut = false;
 
     const bunRunCmd = "bun run __skill_runner.ts";
-    const wrapped = { command: "bash", args: ["-c", "--", bunRunCmd] };
+    const wrapped = buildShellInvocation(bunRunCmd);
 
     const env = buildSanitizedEnv();
     env.__SKILL_INPUT_JSON = JSON.stringify(input);
@@ -161,28 +165,16 @@ function spawnRunner(
 
     const timer = setTimeout(() => {
       timedOut = true;
-      try {
-        process.kill(-child.pid!, "SIGKILL");
-      } catch {
-        // Process group may have already exited.
-      }
+      terminateProcessTree(child);
     }, timeoutMs);
 
     // Cooperative cancellation via AbortSignal
     const onAbort = () => {
-      try {
-        process.kill(-child.pid!, "SIGKILL");
-      } catch {
-        // Process group may have already exited.
-      }
+      terminateProcessTree(child);
     };
     if (context.signal) {
       if (context.signal.aborted) {
-        try {
-          process.kill(-child.pid!, "SIGKILL");
-        } catch {
-          // Process group may have already exited.
-        }
+        terminateProcessTree(child);
       } else {
         context.signal.addEventListener("abort", onAbort, { once: true });
       }

package/src/tools/skills/skill-tool-factory.ts

@@ -39,6 +39,7 @@ export function createSkillTool(
     category: entry.category,
     defaultRiskLevel: riskMap[entry.risk],
     executionTarget: entry.execution_target as ExecutionTarget,
+    supportedClientOs: entry.supported_client_os,
 
     input_schema: entry.input_schema as object,
 

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -1,6 +1,10 @@
 import { afterEach, describe, expect, test } from "bun:test";
 
-import { buildSanitizedEnv, SAFE_ENV_VARS } from "../safe-env.js";
+import {
+  buildSanitizedEnv,
+  SAFE_ENV_VARS,
+  WINDOWS_SAFE_ENV_VARS,
+} from "../safe-env.js";
 
 describe("safe-env Qdrant forwarding", () => {
   const priorPort = process.env.QDRANT_HTTP_PORT;
@@ -35,3 +39,62 @@ describe("safe-env Qdrant forwarding", () => {
     expect(env.QDRANT_URL).toBeUndefined();
   });
 });
+
+describe("safe-env Windows forwarding", () => {
+  test("forwards runtime paths only to Windows children", () => {
+    const keys = [
+      "SystemRoot",
+      "COMSPEC",
+      "USERPROFILE",
+      "LOCALAPPDATA",
+      "PATHEXT",
+    ] as const;
+    const previous = Object.fromEntries(
+      keys.map((key) => [key, process.env[key]]),
+    );
+
+    try {
+      process.env.SystemRoot = "C:\\Windows";
+      process.env.COMSPEC = "C:\\Windows\\System32\\cmd.exe";
+      process.env.USERPROFILE = "C:\\Users\\Alice";
+      process.env.LOCALAPPDATA = "C:\\Users\\Alice\\AppData\\Local";
+      process.env.PATHEXT = ".COM;.EXE;.BAT;.CMD";
+
+      expect(WINDOWS_SAFE_ENV_VARS).toContain("SystemRoot");
+      const windowsEnv = buildSanitizedEnv("win32");
+      expect(windowsEnv.SystemRoot).toBe("C:\\Windows");
+      expect(windowsEnv.COMSPEC).toBe("C:\\Windows\\System32\\cmd.exe");
+      expect(windowsEnv.USERPROFILE).toBe("C:\\Users\\Alice");
+      expect(windowsEnv.LOCALAPPDATA).toBe("C:\\Users\\Alice\\AppData\\Local");
+      expect(windowsEnv.PATHEXT).toBe(".COM;.EXE;.BAT;.CMD");
+
+      const posixEnv = buildSanitizedEnv("linux");
+      expect(posixEnv.SystemRoot).toBeUndefined();
+      expect(posixEnv.COMSPEC).toBeUndefined();
+      expect(posixEnv.USERPROFILE).toBeUndefined();
+    } finally {
+      for (const key of keys) {
+        const value = previous[key];
+        if (value == null) {
+          delete process.env[key];
+        } else {
+          process.env[key] = value;
+        }
+      }
+    }
+  });
+
+  test("matches Windows environment names case-insensitively", () => {
+    const windowsEnv = buildSanitizedEnv("win32", {
+      Path: "C:\\Windows\\System32;C:\\Program Files\\Vellum",
+      systemroot: "C:\\Windows",
+      ComSpec: "C:\\Windows\\System32\\cmd.exe",
+    });
+
+    expect(windowsEnv.PATH).toBe(
+      "C:\\Windows\\System32;C:\\Program Files\\Vellum",
+    );
+    expect(windowsEnv.SystemRoot).toBe("C:\\Windows");
+    expect(windowsEnv.COMSPEC).toBe("C:\\Windows\\System32\\cmd.exe");
+  });
+});

package/src/tools/terminal/safe-env.ts

@@ -7,6 +7,8 @@
  */
 import { readdirSync } from "node:fs";
 
+import { pathListDelimiter } from "@vellumai/environments/shell";
+
 import { getGatewayInternalBaseUrl } from "../../config/env.js";
 import { getDataDir, getWorkspaceDir } from "../../util/platform.js";
 
@@ -76,6 +78,18 @@ export const SAFE_ENV_VARS = [
   "VELLUM_BACKUP_KEY_PATH",
 ] as const;
 
+export const WINDOWS_SAFE_ENV_VARS = [
+  "SystemRoot",
+  "COMSPEC",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "TEMP",
+  "TMP",
+  "PATHEXT",
+  "SystemDrive",
+] as const;
+
 export const KATA_SAFE_ENV_VARS = [
   "VELLUM_APT_DATA_ROOT",
   "VELLUM_APT_DATA_SUITE",
@@ -165,26 +179,42 @@ export const ALWAYS_INJECTED_ENV_VARS = [
 function appendUniquePathEntries(
   value: string | undefined,
   entries: readonly string[],
+  separator = pathListDelimiter(),
 ): string {
-  const parts = value ? value.split(":").filter(Boolean) : [];
+  const parts = value ? value.split(separator).filter(Boolean) : [];
   for (const entry of entries) {
     if (!parts.includes(entry)) {
       parts.push(entry);
     }
   }
-  return parts.join(":");
+  return parts.join(separator);
 }
 
-export function buildSanitizedEnv(): Record<string, string> {
+export function buildSanitizedEnv(
+  hostPlatform: NodeJS.Platform = process.platform,
+  sourceEnv: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
   const env: Record<string, string> = {};
-  const isKataRuntime = isKataFamilyRuntime(process.env.VELLUM_SANDBOX_RUNTIME);
+  const isKataRuntime = isKataFamilyRuntime(sourceEnv.VELLUM_SANDBOX_RUNTIME);
+  const platformVars =
+    hostPlatform === "win32" ? WINDOWS_SAFE_ENV_VARS : ([] as const);
   const safeEnvVars = isKataRuntime
-    ? [...SAFE_ENV_VARS, ...KATA_SAFE_ENV_VARS]
-    : SAFE_ENV_VARS;
+    ? [...SAFE_ENV_VARS, ...platformVars, ...KATA_SAFE_ENV_VARS]
+    : [...SAFE_ENV_VARS, ...platformVars];
 
+  const windowsEnv =
+    hostPlatform === "win32"
+      ? new Map(
+          Object.entries(sourceEnv).map(([key, value]) => [
+            key.toLowerCase(),
+            value,
+          ]),
+        )
+      : null;
   for (const key of safeEnvVars) {
-    if (process.env[key] != null) {
-      env[key] = process.env[key]!;
+    const value = windowsEnv?.get(key.toLowerCase()) ?? sourceEnv[key];
+    if (value != null) {
+      env[key] = value;
     }
   }
   if (isKataRuntime) {
@@ -207,7 +237,7 @@ export function buildSanitizedEnv(): Record<string, string> {
       env.BUN_INSTALL = `${env.HOME}/.bun`;
       env.PATH = appendUniquePathEntries(
         `${env.PYTHONUSERBASE}/bin:${env.BUN_INSTALL}/bin`,
-        env.PATH.split(":").filter(Boolean),
+        env.PATH.split(pathListDelimiter()).filter(Boolean),
       );
     }
   }

package/src/tools/terminal/shell.ts

@@ -1,4 +1,3 @@
-import type { ChildProcess } from "node:child_process";
 import { spawn } from "node:child_process";
 
 import { z } from "zod";
@@ -10,6 +9,10 @@ import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
 import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
@@ -296,7 +299,7 @@ export const shellTool = {
       Object.assign(env, proxyEnv);
     }
 
-    const wrapped = { command: "bash", args: ["-c", "--", command] };
+    const wrapped = buildShellInvocation(command);
 
     // -----------------------------------------------------------------------
     // Background mode: spawn and return immediately. The process output is
@@ -644,12 +647,11 @@ export const shellTool = {
 
 /**
  * Structured teardown log. Pairs with the `"Executing shell command"`
- * start log: every shell invocation now produces a start/exit pair so
+ * start log: every shell invocation produces a start/exit pair so
  * orphan-leak post-mortems can correlate command + exitCode + signal +
  * timedOut + duration without spelunking through prose hints. The
- * `signal === "SIGKILL"` + `timedOut === true` combination is the
- * fingerprint left by the timeout watcher SIGKILLing the process group
- * — i.e. the moment that creates the orphans.
+ * `signal === "SIGKILL"` + `timedOut === true` combination identifies a
+ * timeout-driven process termination.
  */
 function logShellExit(args: {
   toolName: string;
@@ -681,19 +683,10 @@ function logShellExit(args: {
 }
 
 /**
- * Kill the entire process tree of a child process. Tries the process group
- * first (negative PID), then falls back to killing the direct child if the
- * PID is unavailable or the group kill fails.
- *
- * Emits a structured `warn` log on every invocation: this is the
- * ground-truth event that creates orphaned subprocesses (the SIGKILL hits
- * the entire group, so the immediate bash child has no chance to reap its
- * grandchildren; under bun-as-PID-1 they accumulate as `<defunct>`).
- * `reason` lets the next zombie report point at a specific call site (the
- * timeout watcher in the foreground/background branches, or an abort).
+ * Terminate the process tree and record the call site for timeout diagnostics.
  */
 function buildKillTree(
-  child: ChildProcess,
+  child: ReturnType<typeof spawn>,
   context: {
     toolName: string;
     conversationId: string;
@@ -715,20 +708,8 @@ function buildKillTree(
         groupPid,
         invocationId: context.invocationId,
       },
-      "Shell process group SIGKILL'd — orphans expected to reparent to PID 1",
+      "Shell process group SIGKILL'd",
     );
-    if (groupPid != null) {
-      try {
-        process.kill(-groupPid, "SIGKILL");
-        return;
-      } catch {
-        // Process group may have already exited — fall through.
-      }
-    }
-    try {
-      child.kill("SIGKILL");
-    } catch {
-      // Child may have already exited.
-    }
+    terminateProcessTree(child);
   };
 }