@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/tools/mcp/mcp-tool-factory.ts

@@ -27,24 +27,59 @@ export interface McpToolMetadata {
   annotations?: McpToolAnnotations;
 }
 
+/** Risk levels ordered low to high, so a hint can step one place along it. */
+const RISK_LADDER: readonly RiskLevel[] = [
+  RiskLevel.Low,
+  RiskLevel.Medium,
+  RiskLevel.High,
+];
+
+function stepRisk(risk: RiskLevel, direction: -1 | 1): RiskLevel {
+  const index = RISK_LADDER.indexOf(risk);
+  if (index === -1) {
+    return risk;
+  }
+  const next = Math.min(Math.max(index + direction, 0), RISK_LADDER.length - 1);
+  return RISK_LADDER[next] ?? risk;
+}
+
 /**
  * Resolve the risk level a tool carries.
  *
- * `readOnlyHint` is self-reported by the server, so it only refines risk
- * downward and only for servers the user has already configured below the
- * high-trust ceiling. Servers left at the default "high" are unaffected, and
- * the hint never raises risk above the server default.
+ * The server's configured level is the anchor, and a tool's own MCP
+ * annotations move it at most one step along {@link RISK_LADDER}.
+ *
+ * `destructiveHint` steps up. Raising is the safe direction, so it applies at
+ * any server level.
+ *
+ * `readOnlyHint` steps down, and only from {@link RiskLevel.Medium}. Medium is
+ * the schema default, so a server sitting at High got there because the user
+ * put it there. A hint is self-reported by the server, and letting one lower a
+ * deliberately pinned server would hand a lying server the auto-approval the
+ * user withheld: under the Relaxed preset Medium carries no prompt at all. High
+ * is therefore the floor for downward hints.
+ *
+ * `destructiveHint` wins when a server sends both, since a tool that both reads
+ * and destroys is a tool that destroys.
+ *
+ * The MCP spec defaults `destructiveHint` to true when it is absent. This
+ * deliberately does not, because the server's configured level already answers
+ * that question: choosing a level for a server is the user's statement about
+ * what its unlabeled tools are worth. Honoring the spec default instead would
+ * put every tool of every unannotated server back at High, which is the
+ * behavior this replaces.
  */
 function resolveRiskLevel(
   metadata: McpToolMetadata,
   serverConfig: McpServerConfig,
 ): RiskLevel {
   const serverRisk = riskMap[serverConfig.defaultRiskLevel] ?? RiskLevel.High;
-  if (
-    metadata.annotations?.readOnlyHint === true &&
-    serverRisk !== RiskLevel.High
-  ) {
-    return RiskLevel.Low;
+  const annotations = metadata.annotations;
+  if (annotations?.destructiveHint === true) {
+    return stepRisk(serverRisk, 1);
+  }
+  if (annotations?.readOnlyHint === true && serverRisk === RiskLevel.Medium) {
+    return stepRisk(serverRisk, -1);
   }
   return serverRisk;
 }

package/src/tools/permission-checker.ts

@@ -25,11 +25,15 @@ import type {
 import { RiskLevel } from "../permissions/types.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
 import {
+  type PermissionPromptOutcome,
+  type PermissionPromptTelemetry,
   recordToolDenied,
+  recordToolPermissionDecided,
   recordToolPermissionPrompted,
 } from "../telemetry/tool-audit.js";
 import { getLogger } from "../util/logger.js";
 import { resolveExecutionTarget } from "./execution-target.js";
+import { getHostShell } from "./host-shell.js";
 import { buildPolicyContext } from "./policy-context.js";
 import { isSideEffectTool } from "./side-effects.js";
 import type { Tool, ToolContext } from "./types.js";
@@ -124,6 +128,7 @@ export class PermissionChecker {
       undefined,
       undefined,
       context.signal,
+      getHostShell(context, input),
     );
     const { level: risk, reason: riskReason } = classification;
     const riskLevel: string = risk;
@@ -168,6 +173,7 @@ export class PermissionChecker {
         policyContext.conversationId,
         policyContext.executionContext,
         cellQuery,
+        policyContext.requesterContactId,
       );
       const riskThreshold = conversationThreshold as RiskThreshold;
 
@@ -210,7 +216,6 @@ export class PermissionChecker {
           reason: result.reason,
           riskLevel,
           durationMs: Date.now() - startTime,
-          wasPrompted: false,
         });
         const provenance = mapApprovalProvenance("denied", {});
         return {
@@ -249,7 +254,6 @@ export class PermissionChecker {
             "Inline-command skill load requires human approval; no interactive client connected",
           riskLevel,
           durationMs: Date.now() - startTime,
-          wasPrompted: false,
         });
         return {
           allowed: false,
@@ -316,6 +320,7 @@ export class PermissionChecker {
             context.conversationId,
             "background",
             cellQuery,
+            context.requesterContactId,
           );
           const thresholdOrdinal: Record<string, number> = {
             none: -1,
@@ -361,7 +366,6 @@ export class PermissionChecker {
             reason: "Non-interactive session: no client to approve prompt",
             riskLevel,
             durationMs: Date.now() - startTime,
-            wasPrompted: false,
           });
           return {
             allowed: false,
@@ -385,27 +389,76 @@ export class PermissionChecker {
           persistentDecisionsAllowed: !context.requireFreshApproval,
         };
 
-        recordToolPermissionPrompted(name);
-
-        const response = await this.prompter.prompt(
-          name,
-          input,
+        // Grouping dimensions shared by this prompt and its decision, so the
+        // two series can be diffed by risk and by access preset without
+        // parsing anything out of the event name.
+        const promptTelemetry: PermissionPromptTelemetry = {
+          toolName: name,
           riskLevel,
-          promptOptions.allowlistOptions,
-          promptOptions.scopeOptions,
-          previewDiff,
-          context.conversationId,
-          executionTarget,
-          promptOptions.persistentDecisionsAllowed,
-          context.signal,
-          context.toolUseId,
-          riskReason,
-          getIsContainerized(),
-          classification.directoryScopeOptions,
-        );
+          riskThreshold,
+          surface: context.executionChannel,
+          conversationId: context.conversationId,
+        };
+        // An already-aborted signal makes the prompter return without
+        // registering or sending a confirmation request, so nothing reaches
+        // the user and neither half of the pair is recorded. `prompt()` reads
+        // the same signal synchronously on entry, with no await in between, so
+        // this check and its check always agree.
+        const promptIsSurfaced = context.signal?.aborted !== true;
+        if (promptIsSurfaced) {
+          recordToolPermissionPrompted(promptTelemetry);
+        }
+
+        let response: Awaited<ReturnType<PermissionPrompter["prompt"]>>;
+        try {
+          response = await this.prompter.prompt(
+            name,
+            input,
+            riskLevel,
+            promptOptions.allowlistOptions,
+            promptOptions.scopeOptions,
+            previewDiff,
+            context.conversationId,
+            executionTarget,
+            promptOptions.persistentDecisionsAllowed,
+            context.signal,
+            context.toolUseId,
+            riskReason,
+            getIsContainerized(),
+            classification.directoryScopeOptions,
+          );
+        } catch (err) {
+          // The prompter rejected rather than resolved: it was disposed while
+          // this prompt was outstanding (client disconnect, conversation
+          // teardown). Nobody answered, so the prompt is abandoned.
+          if (promptIsSurfaced) {
+            recordToolPermissionDecided(promptTelemetry, "abandoned");
+          }
+          throw err;
+        }
 
         const decision = response.decision;
 
+        // A prompt that ends without a human answer is abandoned, not denied.
+        // The daemon resolves a timeout, a superseding user message, and a
+        // turn abort to `deny` so the agent loop stops, but none of the three
+        // is a decision the user made.
+        let outcome: PermissionPromptOutcome;
+        if (
+          response.wasTimeout === true ||
+          response.wasSystemCancel === true ||
+          response.wasAbort === true
+        ) {
+          outcome = "abandoned";
+        } else if (decision === "deny") {
+          outcome = "deny";
+        } else {
+          outcome = "allow";
+        }
+        if (promptIsSurfaced) {
+          recordToolPermissionDecided(promptTelemetry, outcome);
+        }
+
         if (decision === "deny") {
           const contextualDenial =
             typeof response.decisionContext === "string"
@@ -426,7 +479,6 @@ export class PermissionChecker {
             reason: denialReason,
             riskLevel,
             durationMs: Date.now() - startTime,
-            wasPrompted: true,
           });
           return {
             allowed: false,

package/src/tools/policy-context.ts

@@ -62,6 +62,7 @@ export function buildPolicyContext(
   const originSignals = {
     requestOrigin: context?.requestOrigin,
     ...channelCoordinatesFromToolContext(context),
+    requesterContactId: context?.requesterContactId,
     // Precompute the proc-to-skills gate — the v3 tier being active, i.e.
     // memory on AND v3 live — here so the permission checker, a leaf module
     // that must not read config, can deny the memory-retrospective

package/src/tools/shared/filesystem/image-read.ts

@@ -76,7 +76,7 @@ async function buildImageToolResult(
   }
 
   // Detect actual format from magic bytes - never trust the file extension
-  // alone, since sips converts to JPEG and files can be misnamed.
+  // alone, since conversion produces JPEG and files can be misnamed.
   const detectedType = detectMediaType(buffer);
   if (!detectedType) {
     return {

package/src/tools/skills/find-similar-skills.ts

@@ -3,6 +3,10 @@ import { loadSkillCatalog } from "../../config/skills.js";
 import { nearestExistingSkills } from "../../plugins/defaults/memory/v3/candidate-match.js";
 import { readInstallMeta } from "../../skills/install-meta.js";
 import { getManagedSkillDir } from "../../skills/managed-store.js";
+import {
+  filterSkillsByPlatform,
+  type SkillPlatform,
+} from "../../skills/platform-compatibility.js";
 import type { OwnerInfo, ToolContext, ToolExecutionResult } from "../types.js";
 
 /**
@@ -45,6 +49,7 @@ export async function executeFindSimilarSkills(
       description: string;
       source: SkillSource;
       owner?: OwnerInfo;
+      platforms?: SkillPlatform[];
     }[];
   } = {},
 ): Promise<ToolExecutionResult> {
@@ -92,8 +97,11 @@ export async function executeFindSimilarSkills(
   // slices only those. Filtering after the limit would let out-of-scope
   // high-rank matches consume slots and starve usable in-scope skills out of
   // the result. `null` set = pass the catalog through unchanged.
-  const scopedCatalog =
-    enabledPluginSet === null ? catalog : catalog.filter((s) => !outOfScope(s));
+  const scopedCatalog = filterSkillsByPlatform(
+    enabledPluginSet === null
+      ? catalog
+      : catalog.filter((skill) => !outOfScope(skill)),
+  );
 
   const hits = await findNearest(goal, {
     limit,

package/src/tools/skills/load.ts

@@ -21,10 +21,15 @@ import {
   validateIncludeCycles,
 } from "../../skills/include-graph.js";
 import { renderInlineCommands } from "../../skills/inline-command-render.js";
+import {
+  isSkillCompatibleWithPlatform,
+  skillPlatformUnavailableMessage,
+} from "../../skills/platform-compatibility.js";
 import { parseToolManifestFile } from "../../skills/tool-manifest.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDirDisplay } from "../../util/platform.js";
+import { supportsClientOsForSkillTool } from "../client-os.js";
 import type {
   ToolContext,
   ToolDefinition,
@@ -83,8 +88,23 @@ function loadToolManifest(
  */
 function formatToolSchemas(
   manifest: SkillToolManifest,
+  context: Pick<
+    ToolContext,
+    "clientOs" | "transportInterface" | "sourceActorPrincipalId"
+  >,
   childSkillName?: string,
-): string {
+): string | undefined {
+  const tools = manifest.tools.filter((tool) =>
+    supportsClientOsForSkillTool(tool.supported_client_os, tool.name, {
+      clientOs: context.clientOs,
+      transportInterface: context.transportInterface,
+      sourceActorPrincipalId: context.sourceActorPrincipalId,
+    }),
+  );
+  if (tools.length === 0) {
+    return undefined;
+  }
+
   const lines: string[] = childSkillName
     ? [`### Tools from ${childSkillName}`, ""]
     : [
@@ -96,7 +116,7 @@ function formatToolSchemas(
 
   const toolHeadingLevel = childSkillName ? "####" : "###";
 
-  for (const tool of manifest.tools) {
+  for (const tool of tools) {
     lines.push(`${toolHeadingLevel} ${tool.name}`);
     lines.push(
       tool.description.replaceAll("{workspaceDir}", getWorkspaceDirDisplay()),
@@ -211,6 +231,13 @@ export const skillLoadTool = {
 
     const skill = loaded.skill;
 
+    if (!isSkillCompatibleWithPlatform(skill)) {
+      return {
+        content: `Error: ${skillPlatformUnavailableMessage(skill.id, skill)}`,
+        isError: true,
+      };
+    }
+
     // Per-chat plugin scope gate: a plugin-owned skill whose owning plugin is
     // outside the conversation's effective set must not have its instructions
     // loaded. Mirrors the projection/tools filter's owner-id lookup
@@ -403,7 +430,7 @@ export const skillLoadTool = {
     // Load tool schemas for the main skill
     const mainManifest = loadToolManifest(skill.directoryPath);
     const toolSchemasSection = mainManifest
-      ? formatToolSchemas(mainManifest)
+      ? formatToolSchemas(mainManifest, context)
       : undefined;
 
     // Build immediate children metadata section and load included skill bodies
@@ -422,6 +449,9 @@ export const skillLoadTool = {
         if (childOutOfPluginScope(child)) {
           continue;
         }
+        if (!isSkillCompatibleWithPlatform(child)) {
+          continue;
+        }
         const childFlagKey = skillFlagKey(child);
         if (
           childFlagKey &&
@@ -518,10 +548,15 @@ export const skillLoadTool = {
             childLoaded.skill.directoryPath,
           );
           if (childManifest) {
-            anyChildHasTools = true;
-            includedBodies.push(
-              formatToolSchemas(childManifest, childLoaded.skill.displayName),
+            const childSchemas = formatToolSchemas(
+              childManifest,
+              context,
+              childLoaded.skill.displayName,
             );
+            if (childSchemas) {
+              anyChildHasTools = true;
+              includedBodies.push(childSchemas);
+            }
           }
         }
       }

package/src/tools/skills/sandbox-runner.ts

@@ -5,6 +5,10 @@ import { join, resolve } from "node:path";
 
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
 import { safeStringSlice } from "../../util/unicode.js";
 import { buildSanitizedEnv } from "../terminal/safe-env.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
@@ -139,7 +143,7 @@ function spawnRunner(
     let timedOut = false;
 
     const bunRunCmd = "bun run __skill_runner.ts";
-    const wrapped = { command: "bash", args: ["-c", "--", bunRunCmd] };
+    const wrapped = buildShellInvocation(bunRunCmd);
 
     const env = buildSanitizedEnv();
     env.__SKILL_INPUT_JSON = JSON.stringify(input);
@@ -161,28 +165,16 @@ function spawnRunner(
 
     const timer = setTimeout(() => {
       timedOut = true;
-      try {
-        process.kill(-child.pid!, "SIGKILL");
-      } catch {
-        // Process group may have already exited.
-      }
+      terminateProcessTree(child);
     }, timeoutMs);
 
     // Cooperative cancellation via AbortSignal
     const onAbort = () => {
-      try {
-        process.kill(-child.pid!, "SIGKILL");
-      } catch {
-        // Process group may have already exited.
-      }
+      terminateProcessTree(child);
     };
     if (context.signal) {
       if (context.signal.aborted) {
-        try {
-          process.kill(-child.pid!, "SIGKILL");
-        } catch {
-          // Process group may have already exited.
-        }
+        terminateProcessTree(child);
       } else {
         context.signal.addEventListener("abort", onAbort, { once: true });
       }

package/src/tools/skills/skill-tool-factory.ts

@@ -39,6 +39,7 @@ export function createSkillTool(
     category: entry.category,
     defaultRiskLevel: riskMap[entry.risk],
     executionTarget: entry.execution_target as ExecutionTarget,
+    supportedClientOs: entry.supported_client_os,
 
     input_schema: entry.input_schema as object,
 

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -1,6 +1,10 @@
 import { afterEach, describe, expect, test } from "bun:test";
 
-import { buildSanitizedEnv, SAFE_ENV_VARS } from "../safe-env.js";
+import {
+  buildSanitizedEnv,
+  SAFE_ENV_VARS,
+  WINDOWS_SAFE_ENV_VARS,
+} from "../safe-env.js";
 
 describe("safe-env Qdrant forwarding", () => {
   const priorPort = process.env.QDRANT_HTTP_PORT;
@@ -35,3 +39,62 @@ describe("safe-env Qdrant forwarding", () => {
     expect(env.QDRANT_URL).toBeUndefined();
   });
 });
+
+describe("safe-env Windows forwarding", () => {
+  test("forwards runtime paths only to Windows children", () => {
+    const keys = [
+      "SystemRoot",
+      "COMSPEC",
+      "USERPROFILE",
+      "LOCALAPPDATA",
+      "PATHEXT",
+    ] as const;
+    const previous = Object.fromEntries(
+      keys.map((key) => [key, process.env[key]]),
+    );
+
+    try {
+      process.env.SystemRoot = "C:\\Windows";
+      process.env.COMSPEC = "C:\\Windows\\System32\\cmd.exe";
+      process.env.USERPROFILE = "C:\\Users\\Alice";
+      process.env.LOCALAPPDATA = "C:\\Users\\Alice\\AppData\\Local";
+      process.env.PATHEXT = ".COM;.EXE;.BAT;.CMD";
+
+      expect(WINDOWS_SAFE_ENV_VARS).toContain("SystemRoot");
+      const windowsEnv = buildSanitizedEnv("win32");
+      expect(windowsEnv.SystemRoot).toBe("C:\\Windows");
+      expect(windowsEnv.COMSPEC).toBe("C:\\Windows\\System32\\cmd.exe");
+      expect(windowsEnv.USERPROFILE).toBe("C:\\Users\\Alice");
+      expect(windowsEnv.LOCALAPPDATA).toBe("C:\\Users\\Alice\\AppData\\Local");
+      expect(windowsEnv.PATHEXT).toBe(".COM;.EXE;.BAT;.CMD");
+
+      const posixEnv = buildSanitizedEnv("linux");
+      expect(posixEnv.SystemRoot).toBeUndefined();
+      expect(posixEnv.COMSPEC).toBeUndefined();
+      expect(posixEnv.USERPROFILE).toBeUndefined();
+    } finally {
+      for (const key of keys) {
+        const value = previous[key];
+        if (value == null) {
+          delete process.env[key];
+        } else {
+          process.env[key] = value;
+        }
+      }
+    }
+  });
+
+  test("matches Windows environment names case-insensitively", () => {
+    const windowsEnv = buildSanitizedEnv("win32", {
+      Path: "C:\\Windows\\System32;C:\\Program Files\\Vellum",
+      systemroot: "C:\\Windows",
+      ComSpec: "C:\\Windows\\System32\\cmd.exe",
+    });
+
+    expect(windowsEnv.PATH).toBe(
+      "C:\\Windows\\System32;C:\\Program Files\\Vellum",
+    );
+    expect(windowsEnv.SystemRoot).toBe("C:\\Windows");
+    expect(windowsEnv.COMSPEC).toBe("C:\\Windows\\System32\\cmd.exe");
+  });
+});

package/src/tools/terminal/safe-env.ts

@@ -7,6 +7,8 @@
  */
 import { readdirSync } from "node:fs";
 
+import { pathListDelimiter } from "@vellumai/environments/shell";
+
 import { getGatewayInternalBaseUrl } from "../../config/env.js";
 import { getDataDir, getWorkspaceDir } from "../../util/platform.js";
 
@@ -76,6 +78,18 @@ export const SAFE_ENV_VARS = [
   "VELLUM_BACKUP_KEY_PATH",
 ] as const;
 
+export const WINDOWS_SAFE_ENV_VARS = [
+  "SystemRoot",
+  "COMSPEC",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "TEMP",
+  "TMP",
+  "PATHEXT",
+  "SystemDrive",
+] as const;
+
 export const KATA_SAFE_ENV_VARS = [
   "VELLUM_APT_DATA_ROOT",
   "VELLUM_APT_DATA_SUITE",
@@ -165,26 +179,42 @@ export const ALWAYS_INJECTED_ENV_VARS = [
 function appendUniquePathEntries(
   value: string | undefined,
   entries: readonly string[],
+  separator = pathListDelimiter(),
 ): string {
-  const parts = value ? value.split(":").filter(Boolean) : [];
+  const parts = value ? value.split(separator).filter(Boolean) : [];
   for (const entry of entries) {
     if (!parts.includes(entry)) {
       parts.push(entry);
     }
   }
-  return parts.join(":");
+  return parts.join(separator);
 }
 
-export function buildSanitizedEnv(): Record<string, string> {
+export function buildSanitizedEnv(
+  hostPlatform: NodeJS.Platform = process.platform,
+  sourceEnv: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
   const env: Record<string, string> = {};
-  const isKataRuntime = isKataFamilyRuntime(process.env.VELLUM_SANDBOX_RUNTIME);
+  const isKataRuntime = isKataFamilyRuntime(sourceEnv.VELLUM_SANDBOX_RUNTIME);
+  const platformVars =
+    hostPlatform === "win32" ? WINDOWS_SAFE_ENV_VARS : ([] as const);
   const safeEnvVars = isKataRuntime
-    ? [...SAFE_ENV_VARS, ...KATA_SAFE_ENV_VARS]
-    : SAFE_ENV_VARS;
+    ? [...SAFE_ENV_VARS, ...platformVars, ...KATA_SAFE_ENV_VARS]
+    : [...SAFE_ENV_VARS, ...platformVars];
 
+  const windowsEnv =
+    hostPlatform === "win32"
+      ? new Map(
+          Object.entries(sourceEnv).map(([key, value]) => [
+            key.toLowerCase(),
+            value,
+          ]),
+        )
+      : null;
   for (const key of safeEnvVars) {
-    if (process.env[key] != null) {
-      env[key] = process.env[key]!;
+    const value = windowsEnv?.get(key.toLowerCase()) ?? sourceEnv[key];
+    if (value != null) {
+      env[key] = value;
     }
   }
   if (isKataRuntime) {
@@ -207,7 +237,7 @@ export function buildSanitizedEnv(): Record<string, string> {
       env.BUN_INSTALL = `${env.HOME}/.bun`;
       env.PATH = appendUniquePathEntries(
         `${env.PYTHONUSERBASE}/bin:${env.BUN_INSTALL}/bin`,
-        env.PATH.split(":").filter(Boolean),
+        env.PATH.split(pathListDelimiter()).filter(Boolean),
       );
     }
   }