@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/tools/credentials/broker.ts

@@ -1,23 +1,14 @@
-import { v4 as uuid } from "uuid";
-
 import { credentialKey } from "../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import type {
-  AuthorizeRequest,
-  AuthorizeResult,
   BrowserFillRequest,
   BrowserFillResult,
-  ConsumeResult,
-  ServerUseByIdRequest,
-  ServerUseByIdResult,
   ServerUseRequest,
   ServerUseResult,
-  UsageToken,
 } from "./broker-types.js";
 import { isDomainAllowed } from "./domain-policy.js";
 import { getCredentialMetadata } from "./metadata-store.js";
-import { resolveById } from "./resolve.js";
 import {
   isToolAllowed,
   serverUseDenialReason,
@@ -26,21 +17,17 @@ import {
 
 const log = getLogger("credential-broker");
 
-/** Tokens expire after 5 minutes to limit the window for using stale/revoked credentials. */
-const TOKEN_TTL_MS = 5 * 60 * 1000;
-
 /**
- * Credential broker that issues single-use tokens for policy-checked credential access.
+ * Credential broker that mediates policy-checked credential access.
  *
- * The broker never exposes plaintext secret values. Instead, it:
+ * The broker never exposes plaintext secret values to callers. It:
  * 1. Checks that a credential exists and has metadata
- * 2. Issues a single-use token for the authorized usage
- * 3. On consumption, returns the storage key so the caller can read the secret internally
+ * 2. Enforces tool and domain policy
+ * 3. Reads the secret internally and passes it to an opaque callback
  *
- * Tool policy is enforced at authorize/fill time; domain policy is enforced at fill time.
+ * Tool policy is enforced at fill/use time; domain policy is enforced at fill time.
  */
 export class CredentialBroker {
-  private tokens = new Map<string, UsageToken>();
   /** Transient values for one-time send: consumed on first read, never persisted.
    *  Values are wrapped in objects so post-await guards use reference identity
    *  (not string value equality) to detect concurrent replacements. */
@@ -48,7 +35,7 @@ export class CredentialBroker {
 
   /**
    * Inject a value for one-time use. The value is consumed on the next
-   * browserFill or consume call for this service/field pair, then discarded.
+   * browserFill or serverUse call for this service/field pair, then discarded.
    */
   injectTransient(service: string, field: string, value: string): void {
     const key = credentialKey(service, field);
@@ -59,113 +46,6 @@ export class CredentialBroker {
     );
   }
 
-  /**
-   * Authorize the use of a credential for a specific tool and optional domain.
-   * Returns a single-use token on success, or a denial reason on failure.
-   */
-  authorize(request: AuthorizeRequest): AuthorizeResult {
-    const metadata = getCredentialMetadata(request.service, request.field);
-    if (!metadata) {
-      return {
-        authorized: false,
-        reason: `No credential found for ${request.service}/${request.field}`,
-      };
-    }
-
-    // Tool policy enforcement - deny if tool is not in the credential's allowed list
-    if (!isToolAllowed(request.toolName, metadata.allowedTools)) {
-      return {
-        authorized: false,
-        reason: toolNotAllowedReason(
-          request.toolName,
-          request.service,
-          request.field,
-          metadata.allowedTools,
-        ),
-      };
-    }
-
-    const token: UsageToken = {
-      tokenId: uuid(),
-      credentialId: metadata.credentialId,
-      service: request.service,
-      field: request.field,
-      toolName: request.toolName,
-      createdAt: Date.now(),
-      consumed: false,
-    };
-
-    this.tokens.set(token.tokenId, token);
-    log.info(
-      {
-        tokenId: token.tokenId,
-        service: request.service,
-        field: request.field,
-        tool: request.toolName,
-      },
-      "Usage token issued",
-    );
-
-    return { authorized: true, token: { ...token } };
-  }
-
-  /**
-   * Consume a previously issued token. Returns the storage key on success.
-   * Each token can only be consumed once.
-   */
-  consume(tokenId: string): ConsumeResult {
-    const token = this.tokens.get(tokenId);
-    if (!token) {
-      return { success: false, reason: "Token not found or already revoked" };
-    }
-    if (token.consumed) {
-      return { success: false, reason: "Token already consumed" };
-    }
-    if (Date.now() - token.createdAt > TOKEN_TTL_MS) {
-      this.tokens.delete(tokenId);
-      log.info({ tokenId }, "Token expired (TTL exceeded)");
-      return { success: false, reason: "Token expired" };
-    }
-
-    token.consumed = true;
-    const storageKey = credentialKey(token.service, token.field);
-    // Check for transient value first (one-time send) - consume and return the value
-    // directly since transient values are never persisted to secure storage.
-    const transient = this.transientValues.get(storageKey);
-    if (transient !== undefined) {
-      this.transientValues.delete(storageKey);
-      log.info(
-        { tokenId, storageKey, transient: true },
-        "Usage token consumed (transient)",
-      );
-      return { success: true, storageKey, value: transient.value };
-    }
-
-    log.info({ tokenId, storageKey }, "Usage token consumed");
-    return { success: true, storageKey };
-  }
-
-  /**
-   * Revoke a token, removing it from the active set.
-   * Returns true if the token existed and was revoked.
-   */
-  revoke(tokenId: string): boolean {
-    const existed = this.tokens.delete(tokenId);
-    if (existed) {
-      log.info({ tokenId }, "Usage token revoked");
-    }
-    return existed;
-  }
-
-  /** Revoke all tokens (e.g. on conversation teardown). */
-  revokeAll(): void {
-    const count = this.tokens.size;
-    this.tokens.clear();
-    if (count > 0) {
-      log.info({ count }, "All usage tokens revoked");
-    }
-  }
-
   /**
    * Fill a browser field using a credential without exposing plaintext to the caller.
    *
@@ -317,81 +197,6 @@ export class CredentialBroker {
       return { success: false, reason: "Credential use failed" };
     }
   }
-
-  /**
-   * Look up a credential by its opaque ID for proxy injection.
-   *
-   * Returns metadata and injection templates so the proxy knows how to
-   * inject the credential into outbound requests. The secret value is
-   * never included in the result - the proxy reads it separately via
-   * the secure key backend at injection time.
-   */
-  async serverUseById(
-    request: ServerUseByIdRequest,
-  ): Promise<ServerUseByIdResult> {
-    const resolved = resolveById(request.credentialId);
-    if (!resolved) {
-      return {
-        success: false,
-        reason: `No credential found for id "${request.credentialId}"`,
-      };
-    }
-
-    const { metadata } = resolved;
-
-    // Shared server-use policy: the ID lookup above is the only by-ID-specific
-    // gate, so tool and domain enforcement come from the same helper serverUse
-    // uses.
-    const denialReason = serverUseDenialReason(
-      metadata,
-      request.requestingTool,
-      metadata.service,
-      metadata.field,
-    );
-    if (denialReason) {
-      return { success: false, reason: denialReason };
-    }
-
-    // Fail-closed: verify the secret value actually exists in secure storage.
-    // Without this, downstream proxy code would attempt unauthenticated requests.
-    const value = await getSecureKeyAsync(resolved.storageKey);
-    if (!value) {
-      return {
-        success: false,
-        reason: `Credential metadata exists but no stored value for ${metadata.service}/${metadata.field}`,
-      };
-    }
-
-    log.info(
-      {
-        credentialId: request.credentialId,
-        service: metadata.service,
-        field: metadata.field,
-        tool: request.requestingTool,
-      },
-      "Server-side credential lookup by ID completed",
-    );
-
-    return {
-      success: true,
-      credentialId: resolved.credentialId,
-      service: resolved.service,
-      field: resolved.field,
-      injectionTemplates: resolved.injectionTemplates,
-    };
-  }
-
-  /** Return the number of active (non-consumed, non-revoked, non-expired) tokens. */
-  get activeTokenCount(): number {
-    const now = Date.now();
-    let count = 0;
-    for (const token of this.tokens.values()) {
-      if (!token.consumed && now - token.createdAt <= TOKEN_TTL_MS) {
-        count++;
-      }
-    }
-    return count;
-  }
 }
 
 /** Shared singleton broker instance used by vault and browser tools. */

package/src/tools/credentials/metadata-store.ts

@@ -1,24 +1,29 @@
 /**
  * Credential metadata store.
  *
- * Thin wrapper around the portable StaticCredentialMetadataStore from
- * @vellumai/credential-storage. Wires in the platform-specific data
- * directory and preserves the existing module-level API so that call
- * sites throughout the assistant daemon do not need to change.
+ * Reads stay on the workspace `metadata.json` file (sync). When a CES
+ * record backend is injected, upserts and deletes also write-through to
+ * CES so the CES catalog stays current.
  *
- * OAuth-specific fields (expiresAt, grantedScopes, oauth2TokenUrl,
- * oauth2ClientId, oauth2TokenEndpointAuthMethod, hasRefreshToken) are now
- * exclusively managed by the SQLite oauth-store and have been removed
- * from this interface as of v5.
+ * Tests: `_setMetadataPath` keeps the file-backed store and skips CES
+ * write-through.
  */
 
 import { join } from "node:path";
 
-import { StaticCredentialMetadataStore } from "@vellumai/credential-storage";
+import {
+  credentialKey,
+  StaticCredentialMetadataStore,
+} from "@vellumai/credential-storage";
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
 
+import type { CredentialRecordBackend } from "../../security/ces-rpc-record-backend.js";
+import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
 
+const log = getLogger("credential-metadata-store");
+
 /**
  * CredentialMetadata extends the shared StaticCredentialRecord with
  * assistant-specific injection template fields (composeWith, valueTransform).
@@ -43,12 +48,9 @@ export interface CredentialMetadata {
 // Singleton store instance
 // ---------------------------------------------------------------------------
 
-/**
- * Lazily initialised store instance. The path is determined on first access
- * (or overridden via `_setMetadataPath` for tests).
- */
 let _store: StaticCredentialMetadataStore | undefined;
 let _overridePath: string | null = null;
+let _recordBackend: CredentialRecordBackend | undefined;
 
 function getStore(): StaticCredentialMetadataStore {
   if (!_store) {
@@ -59,6 +61,48 @@ function getStore(): StaticCredentialMetadataStore {
   return _store;
 }
 
+function toRecord(metadata: CredentialMetadata): CredentialRecord {
+  return {
+    credentialId: metadata.credentialId,
+    service: metadata.service,
+    field: metadata.field,
+    allowedTools: metadata.allowedTools,
+    allowedDomains: metadata.allowedDomains,
+    usageDescription: metadata.usageDescription,
+    alias: metadata.alias,
+    injectionTemplates: metadata.injectionTemplates,
+    createdAt: metadata.createdAt,
+    updatedAt: metadata.updatedAt,
+  };
+}
+
+async function persistRecord(metadata: CredentialMetadata): Promise<void> {
+  if (!_recordBackend || _overridePath) {
+    return;
+  }
+  const account = credentialKey(metadata.service, metadata.field);
+  const ok = await _recordBackend.set(account, toRecord(metadata));
+  if (!ok) {
+    log.warn(
+      { service: metadata.service, field: metadata.field },
+      "Failed to persist credential record to CES",
+    );
+  }
+}
+
+/** Await CES write-through for a record already in the local file store. */
+export async function persistCredentialMetadata(
+  metadata: CredentialMetadata,
+): Promise<void> {
+  await persistRecord(metadata);
+}
+
+export function setCredentialRecordBackend(
+  backend: CredentialRecordBackend | undefined,
+): void {
+  _recordBackend = backend;
+}
+
 // ---------------------------------------------------------------------------
 // Public API - unchanged signatures, delegates to shared store
 // ---------------------------------------------------------------------------
@@ -89,7 +133,9 @@ export function upsertCredentialMetadata(
     injectionTemplates?: CredentialInjectionTemplate[] | null;
   },
 ): CredentialMetadata {
-  return getStore().upsert(service, field, policy) as CredentialMetadata;
+  const record = getStore().upsert(service, field, policy) as CredentialMetadata;
+  void persistRecord(record);
+  return record;
 }
 
 /**
@@ -127,13 +173,16 @@ export function deleteCredentialMetadata(
   service: string,
   field: string,
 ): boolean {
-  return getStore().delete(service, field);
+  const deleted = getStore().delete(service, field);
+  if (deleted && _recordBackend && !_overridePath) {
+    void _recordBackend.delete(credentialKey(service, field));
+  }
+  return deleted;
 }
 
 /** @internal Test-only: override the metadata file path. */
 export function _setMetadataPath(path: string | null): void {
   _overridePath = path;
-  // Reset the store so it picks up the new path
   if (_store) {
     if (path) {
       _store.setPath(path);

package/src/tools/credentials/store.ts

@@ -37,6 +37,7 @@ import {
 import { getLogger } from "../../util/logger.js";
 import {
   assertMetadataWritable,
+  persistCredentialMetadata,
   upsertCredentialMetadata,
 } from "./metadata-store.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
@@ -161,6 +162,7 @@ export async function storeCredentialValue(
     allowedDomains: input.allowedDomains,
     injectionTemplates: input.injectionTemplates,
   });
+  await persistCredentialMetadata(metadata);
   const { syncManualTokenConnection } =
     await import("../../oauth/manual-token-connection.js");
   await syncManualTokenConnection(service);

package/src/tools/executor.ts

@@ -33,6 +33,7 @@ import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { fileEditInputSchema } from "./filesystem/edit.js";
 import { fileWriteInputSchema } from "./filesystem/write.js";
+import { getHostShell } from "./host-shell.js";
 import { PermissionChecker } from "./permission-checker.js";
 import { getToolOwner } from "./registry.js";
 import { extractAndSanitize } from "./sensitive-output-placeholders.js";
@@ -89,6 +90,7 @@ export class ToolExecutor {
         undefined,
         undefined,
         context.signal,
+        getHostShell(context, input),
       );
     } catch {
       // Stays undefined; the audit row records RISK_LEVEL_UNCLASSIFIED.
@@ -108,12 +110,6 @@ export class ToolExecutor {
     let permApprovalMode: string | undefined;
     let permApprovalReason: string | undefined;
     let permRiskThreshold: string | undefined;
-    // Whether THIS invocation was interactively prompted. Distinct from the
-    // turn-level `context.approvedViaPrompt` (seeded from
-    // `approvedViaPromptThisTurn`, which stays true for later auto-approved
-    // tools in the same turn): the `permission_decided` telemetry must reflect
-    // a prompt for this specific call, not any prompt earlier in the turn.
-    let wasPromptedThisInvocation = false;
     // Run pre-execution approval gates (abort, guardian policy,
     // allowed-tool-set, task-run preflight, tool registry lookup). The gate
     // resolves the tool's sandbox/host target internally.
@@ -253,7 +249,6 @@ export class ToolExecutor {
 
         if (permResult.wasPrompted) {
           context.approvedViaPrompt = true;
-          wasPromptedThisInvocation = true;
         }
       } else {
         // Grant consumed — permission check was skipped. Set provenance explicitly
@@ -324,7 +319,6 @@ export class ToolExecutor {
         matchedTrustRuleId: permMatchedTrustRuleId,
         durationMs,
         attribution: context.attribution ?? null,
-        wasPrompted: wasPromptedThisInvocation,
       });
       recordToolCompletion(
         context.conversationId,

package/src/tools/host-shell.test.ts

@@ -0,0 +1,75 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
+import { getHostShell } from "./host-shell.js";
+
+const subscriptions: Array<{ dispose(): void }> = [];
+
+afterEach(() => {
+  for (const subscription of subscriptions.splice(0)) {
+    subscription.dispose();
+  }
+});
+
+function connectHostBashClient(
+  clientId: string,
+  interfaceId: "macos" | "windows",
+): void {
+  subscriptions.push(
+    assistantEventHub.subscribe({
+      type: "client",
+      clientId,
+      interfaceId,
+      capabilities: ["host_bash"],
+      actorPrincipalId: "actor-1",
+      callback: () => {},
+    }),
+  );
+}
+
+describe("getHostShell", () => {
+  test("uses the explicitly targeted Windows client's shell", () => {
+    connectHostBashClient("windows-client", "windows");
+
+    expect(
+      getHostShell(
+        {
+          clientOs: "web",
+          transportInterface: "web",
+          sourceActorPrincipalId: "actor-1",
+        },
+        { target_client_id: "windows-client" },
+      ),
+    ).toBe("powershell");
+  });
+
+  test("uses the single same-user Windows client's shell", () => {
+    connectHostBashClient("windows-client", "windows");
+
+    expect(
+      getHostShell(
+        {
+          clientOs: "web",
+          transportInterface: "web",
+          sourceActorPrincipalId: "actor-1",
+        },
+        {},
+      ),
+    ).toBe("powershell");
+  });
+
+  test("keeps Bash classification for a targeted macOS client", () => {
+    connectHostBashClient("mac-client", "macos");
+
+    expect(
+      getHostShell(
+        {
+          clientOs: "web",
+          transportInterface: "web",
+          sourceActorPrincipalId: "actor-1",
+        },
+        { target_client_id: "mac-client" },
+      ),
+    ).toBeUndefined();
+  });
+});

package/src/tools/host-shell.ts

@@ -0,0 +1,24 @@
+import type { ClassifyRiskIpcParams } from "@vellumai/gateway-client";
+
+import { resolveInvocationHostClientOs } from "./client-os.js";
+import type { ToolContext } from "./types.js";
+
+export function getHostShell(
+  context: Pick<
+    ToolContext,
+    "clientOs" | "transportInterface" | "sourceActorPrincipalId"
+  >,
+  input: Record<string, unknown>,
+): ClassifyRiskIpcParams["shell"] {
+  const targetClientOs = resolveInvocationHostClientOs(
+    "host_bash",
+    input,
+    context,
+  );
+  return targetClientOs === "windows" ||
+    (targetClientOs === undefined &&
+      (context.clientOs === "windows" ||
+        context.transportInterface === "windows"))
+    ? "powershell"
+    : undefined;
+}

package/src/tools/host-terminal/host-shell.ts

@@ -9,7 +9,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute } from "node:path";
+import { isAbsolute, join } from "node:path";
 
 import { z } from "zod";
 
@@ -24,6 +24,11 @@ import {
 } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
+import {
+  buildShellInvocation,
+  prependUniquePathEntries,
+  terminateProcessTree,
+} from "../../util/host-process.js";
 import { getLogger } from "../../util/logger.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
 import {
@@ -67,15 +72,10 @@ const HOST_BASH_PROXY_ENV_KEYS = [
 function buildHostShellEnv(): Record<string, string> {
   const env = buildSanitizedEnv();
   // Ensure ~/.local/bin and ~/.bun/bin are in PATH so `vellum` and `bun` are
-  // always reachable, even when the daemon is launched from a macOS app
-  // bundle that inherits a minimal PATH.
+  // reachable when a desktop app launches the assistant with a minimal PATH.
   const home = homedir();
-  const extraDirs = [`${home}/.local/bin`, `${home}/.bun/bin`];
-  const currentPath = env.PATH ?? "";
-  const missing = extraDirs.filter((d) => !currentPath.split(":").includes(d));
-  if (missing.length > 0) {
-    env.PATH = [...missing, currentPath].filter(Boolean).join(":");
-  }
+  const extraDirs = [join(home, ".local", "bin"), join(home, ".bun", "bin")];
+  env.PATH = prependUniquePathEntries(env.PATH, extraDirs);
   return env;
 }
 
@@ -466,7 +466,8 @@ export const hostShellTool = {
       const bgId = generateBackgroundToolId();
       const startedAt = Date.now();
 
-      const child = spawn("bash", ["-c", "--", command], {
+      const wrapped = buildShellInvocation(command);
+      const child = spawn(wrapped.command, wrapped.args, {
         cwd: workingDir,
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
@@ -480,21 +481,7 @@ export const hostShellTool = {
       // event reports "cancelled" rather than "failed".
       let aborted = false;
 
-      const killTree = () => {
-        if (child.pid != null) {
-          try {
-            process.kill(-child.pid, "SIGKILL");
-            return;
-          } catch {
-            // Process group may have already exited — fall through.
-          }
-        }
-        try {
-          child.kill("SIGKILL");
-        } catch {
-          // Child may have already exited.
-        }
-      };
+      const killTree = () => terminateProcessTree(child);
 
       const timer = setTimeout(() => {
         timedOut = true;
@@ -666,31 +653,15 @@ export const hostShellTool = {
       const stderrChunks: Buffer[] = [];
       let timedOut = false;
 
-      const child = spawn("bash", ["-c", "--", command], {
+      const wrapped = buildShellInvocation(command);
+      const child = spawn(wrapped.command, wrapped.args, {
         cwd: workingDir,
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
         detached: true,
       });
 
-      // Kill the entire process tree. Tries the process group first
-      // (negative PID), then falls back to killing the direct child if the
-      // PID is unavailable or the group kill fails.
-      const killTree = () => {
-        if (child.pid != null) {
-          try {
-            process.kill(-child.pid, "SIGKILL");
-            return;
-          } catch {
-            // Process group may have already exited — fall through.
-          }
-        }
-        try {
-          child.kill("SIGKILL");
-        } catch {
-          // Child may have already exited.
-        }
-      };
+      const killTree = () => terminateProcessTree(child);
 
       const timer = setTimeout(() => {
         timedOut = true;