@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/tools/terminal/shell.ts

@@ -1,4 +1,3 @@
-import type { ChildProcess } from "node:child_process";
 import { spawn } from "node:child_process";
 
 import { z } from "zod";
@@ -10,6 +9,10 @@ import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
 import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
@@ -296,7 +299,7 @@ export const shellTool = {
       Object.assign(env, proxyEnv);
     }
 
-    const wrapped = { command: "bash", args: ["-c", "--", command] };
+    const wrapped = buildShellInvocation(command);
 
     // -----------------------------------------------------------------------
     // Background mode: spawn and return immediately. The process output is
@@ -644,12 +647,11 @@ export const shellTool = {
 
 /**
  * Structured teardown log. Pairs with the `"Executing shell command"`
- * start log: every shell invocation now produces a start/exit pair so
+ * start log: every shell invocation produces a start/exit pair so
  * orphan-leak post-mortems can correlate command + exitCode + signal +
  * timedOut + duration without spelunking through prose hints. The
- * `signal === "SIGKILL"` + `timedOut === true` combination is the
- * fingerprint left by the timeout watcher SIGKILLing the process group
- * — i.e. the moment that creates the orphans.
+ * `signal === "SIGKILL"` + `timedOut === true` combination identifies a
+ * timeout-driven process termination.
  */
 function logShellExit(args: {
   toolName: string;
@@ -681,19 +683,10 @@ function logShellExit(args: {
 }
 
 /**
- * Kill the entire process tree of a child process. Tries the process group
- * first (negative PID), then falls back to killing the direct child if the
- * PID is unavailable or the group kill fails.
- *
- * Emits a structured `warn` log on every invocation: this is the
- * ground-truth event that creates orphaned subprocesses (the SIGKILL hits
- * the entire group, so the immediate bash child has no chance to reap its
- * grandchildren; under bun-as-PID-1 they accumulate as `<defunct>`).
- * `reason` lets the next zombie report point at a specific call site (the
- * timeout watcher in the foreground/background branches, or an abort).
+ * Terminate the process tree and record the call site for timeout diagnostics.
  */
 function buildKillTree(
-  child: ChildProcess,
+  child: ReturnType<typeof spawn>,
   context: {
     toolName: string;
     conversationId: string;
@@ -715,20 +708,8 @@ function buildKillTree(
         groupPid,
         invocationId: context.invocationId,
       },
-      "Shell process group SIGKILL'd — orphans expected to reparent to PID 1",
+      "Shell process group SIGKILL'd",
     );
-    if (groupPid != null) {
-      try {
-        process.kill(-groupPid, "SIGKILL");
-        return;
-      } catch {
-        // Process group may have already exited — fall through.
-      }
-    }
-    try {
-      child.kill("SIGKILL");
-    } catch {
-      // Child may have already exited.
-    }
+    terminateProcessTree(child);
   };
 }

package/src/tools/tool-approval-handler.ts

@@ -18,6 +18,7 @@ import {
 } from "../permissions/checker.js";
 import {
   channelNoCellDefault,
+  getContactAutoApproveThreshold,
   resolveChannelPermissionCell,
 } from "../permissions/gateway-threshold-reader.js";
 import {
@@ -525,6 +526,11 @@ function reachesPrivateNetwork(
  * Each stays on the capability floor, so a channel actor escalates to the
  * guardian for them at every level. None of this touches the guardian's own
  * lane — it decides what a *cell* may delegate, not how risk is classified.
+ *
+ * A contact-level ceiling is a different grant: the owner named this person,
+ * not a room. That ceiling may lift sandbox `bash`. It still cannot lift
+ * host reach, control-plane writes, unvetted tools, or private-network
+ * fetches; those stay on the floor regardless of the contact's threshold.
  */
 function isChannelLiftable(
   reach: SensitiveToolReach,
@@ -558,16 +564,54 @@ function isChannelLiftable(
 }
 
 /**
- * Threshold of the approval-matrix cell governing this invocation, read only
- * when it can change the outcome: a channel-liftable invocation whose actor
- * sits on the escalate floor. Guardians, non-sensitive tools, host reach,
- * everything {@link isChannelLiftable} excludes, and identity-less actors
- * return early, so the gateway lookup never lands on the paths where it could
+ * Whether a contact-level ceiling may lift the floor for this invocation.
+ *
+ * Same sandbox-only rule as {@link isChannelLiftable}, except sandbox `bash`
+ * is included: the owner set a per-person ceiling, and that ceiling is what
+ * authorizes code execution in the workspace. Host reach, control-plane
+ * writes, unvetted tools, and private-network fetches stay unliftable.
+ */
+function isContactCeilingLiftable(
+  reach: SensitiveToolReach,
+  toolName: string,
+  input: Record<string, unknown>,
+  workingDir: string | undefined,
+): boolean {
+  if (reach !== "sandbox") {
+    return false;
+  }
+  if (
+    isWorkspaceWriteTool(toolName) &&
+    (!workingDir || isControlPlaneWorkspaceWrite(toolName, input, workingDir))
+  ) {
+    return false;
+  }
+  if (isUnvettedExtensionTool(toolName)) {
+    return false;
+  }
+  if (reachesPrivateNetwork(toolName, input)) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Threshold governing this invocation's floor lift, read only when it can
+ * change the outcome: an escalate-floor actor whose invocation a cell or a
+ * contact ceiling may lift. Guardians, non-sensitive tools, host reach,
+ * everything those lift paths exclude, and identity-less actors return
+ * early, so the gateway lookup never lands on the paths where it could
  * only add latency — grant consumption for an already-approved call, and voice
  * abort handling.
  *
- * The permission checker reads this same cell later in the turn, within the
- * reader's cache window, so the lift costs at most one lookup per turn.
+ * A non-null contact ceiling wins over the matrix cell. It is the owner's
+ * override for that person and is not collapsed to the channel's two
+ * levels, so `medium` / `high` can lift sandbox `bash`. Cells still cannot
+ * lift bash.
+ *
+ * The permission checker reads this same contact ceiling / cell later in
+ * the turn, within the reader's cache window, so the lift costs at most
+ * one lookup per turn.
  *
  * Returns `undefined` when the turn has no channel coordinates or a lookup
  * fails — nothing lifts the floor then. A successful walk that finds no cell
@@ -583,10 +627,21 @@ async function resolveApprovalCellThreshold(
   sensitiveToolApproval: SensitiveToolApproval,
   context: ToolContext,
 ): Promise<ApprovalCellThreshold | undefined> {
+  if (sensitiveToolApproval !== "escalate-and-wait") {
+    return undefined;
+  }
+
+  const contactCeiling = await getContactAutoApproveThreshold(
+    context.requesterContactId,
+  );
   if (
-    sensitiveToolApproval !== "escalate-and-wait" ||
-    !isChannelLiftable(reach, toolName, input, context.workingDir)
+    contactCeiling !== null &&
+    isContactCeilingLiftable(reach, toolName, input, context.workingDir)
   ) {
+    return contactCeiling;
+  }
+
+  if (!isChannelLiftable(reach, toolName, input, context.workingDir)) {
     return undefined;
   }
   const query = buildChannelPermissionCellQuery(
@@ -708,7 +763,6 @@ export class ToolApprovalHandler {
       reason,
       riskLevel,
       durationMs: Date.now() - startTime,
-      wasPrompted: false,
     });
   }
 

package/src/tools/tool-types.ts

@@ -348,6 +348,8 @@ export interface ToolContext {
    * `InterfaceId` union.
    */
   transportInterface?: string;
+  /** Operating system reported by the client for the current turn. */
+  clientOs?: "web" | "ios" | "macos" | "windows" | "android";
   /**
    * True when the host browser proxy's sender was overridden by an
    * extension connection (WebSocket browser-relay).
@@ -374,6 +376,14 @@ export interface Tool {
   /** Declared execution target from the skill manifest. Used by resolveExecutionTarget
    * to accurately label lifecycle events for skill-provided tools. */
   executionTarget?: ExecutionTarget;
+  /** Client operating systems that may expose this tool. Unset means all. */
+  supportedClientOs?: readonly (
+    | "web"
+    | "ios"
+    | "macos"
+    | "windows"
+    | "android"
+  )[];
   getDefinition(): ToolDefinition;
   execute(
     input: Record<string, unknown>,

package/src/tools/types.ts

@@ -6,7 +6,11 @@ import type {
 import { z } from "zod";
 
 import type { AnsweredQuestion } from "../api/events/question-answered.js";
-import type { InterfaceId } from "../channels/types.js";
+import {
+  CLIENT_OS_VALUES,
+  type ClientOs,
+  type InterfaceId,
+} from "../channels/types.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { ToolActivityMetadata } from "../daemon/message-types/web-activity.js";
 import type { SecretPromptResult } from "../permissions/secret-prompt-types.js";
@@ -367,6 +371,12 @@ export interface ToolContext {
    * @legacy
    */
   requesterIdentifier?: string;
+  /**
+   * Contact ID of the requester's member record. Approval resolution looks
+   * up this contact's auto-approve ceiling from the gateway at use time.
+   * @legacy
+   */
+  requesterContactId?: string;
   /**
    * Preferred display name for the requester.
    * @legacy
@@ -406,6 +416,8 @@ export interface ToolContext {
    * @legacy
    */
   transportInterface?: InterfaceId;
+  /** Operating system reported by the client for the current turn. */
+  clientOs?: ClientOs;
   /**
    * The per-turn inference-profile override the agent loop is currently
    * running under, propagated through tool context so subagent-spawn tools
@@ -504,6 +516,8 @@ export const ToolDefinitionSchema = z.object({
   category: z.string().min(1).optional(),
   /** Where the tool runs — sandbox (assistant container) or host (guardian device via proxy). Resolved by `resolveExecutionTarget` if omitted. */
   executionTarget: z.enum(["sandbox", "host"]).optional(),
+  /** Client operating systems that may expose this tool. Unset means all. */
+  supportedClientOs: z.array(z.enum(CLIENT_OS_VALUES)).optional(),
   /**
    * Implementation invoked when the model calls the tool. Optional
    * because some `ToolDefinition` instances are schema-only (e.g.
@@ -551,8 +565,10 @@ export type ToolDefinition = z.infer<typeof ToolDefinitionSchema>;
  * it, and the agent loop reads it as `?.exclusive === true`, so forcing every
  * hand-built `Tool` (MCP/meet/test fixtures) to carry it would be noise.
  */
-export type Tool = Required<Omit<ToolDefinition, "exclusive">> &
-  Pick<ToolDefinition, "exclusive">;
+export type Tool = Required<
+  Omit<ToolDefinition, "exclusive" | "supportedClientOs">
+> &
+  Pick<ToolDefinition, "exclusive" | "supportedClientOs">;
 
 /**
  * The kind of entity that owns a tool. `"default"` is the built-in tool set

package/src/tools/ui-surface/surface-shape-docs.ts

@@ -202,14 +202,15 @@ export const SURFACE_SHAPE_DOCS: Record<string, SurfaceShapeDoc> = {
       "{ html, height? } — one self-contained HTML/SVG fragment (no DOCTYPE/html/head/body, no external resources); every colour comes from the injected design-token CSS variables, so hex/rgb literals and invented `var()` names are rejected. Load the `visualize` skill with `skill_load` for the full contract and the token vocabulary",
   },
   channel_setup: {
-    purpose: "open the Slack/Telegram/Phone setup panel",
-    shape: '{ channel: "slack" | "telegram" | "phone" }',
+    purpose: "open the Slack/Telegram/Discord/Phone setup panel",
+    shape: '{ channel: "slack" | "telegram" | "discord" | "phone" }',
     missingContent: (data) =>
       data.channel === "slack" ||
       data.channel === "telegram" ||
+      data.channel === "discord" ||
       data.channel === "phone"
         ? null
-        : '`data.channel` must be one of "slack", "telegram", "phone"',
+        : '`data.channel` must be one of "slack", "telegram", "discord", "phone"',
   },
   voice_picker: {
     // The steering lives in `purpose` because that is the only part of a cold

package/src/tools/workflows/manage-workflows.ts

@@ -15,7 +15,7 @@
 
 import { z } from "zod";
 
-import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { loadConfig } from "../../config/loader.js";
 import { callerOwnsWorkflowRun } from "../../workflows/capabilities.js";
 import type { WorkflowRun } from "../../workflows/journal-store.js";
@@ -192,7 +192,7 @@ export async function executeManageWorkflows(
       // workspace-wide active profile. Read-only — leaves use this to pick a
       // valid `profile` for `run_workflow` (an unknown profile throws).
       const { llm } = loadConfig();
-      const profiles = getEffectiveProfilesForProvider(
+      const profiles = getUserSelectableProfilesForProvider(
         llm?.profiles,
         llm?.defaultProvider ?? null,
       );

package/src/tools/workflows/run-workflow.test.ts

@@ -338,7 +338,8 @@ describe("manage_workflows", () => {
     );
     expect(res.isError).toBe(false);
     const parsed = JSON.parse(res.content);
-    // The effective view always includes the code-catalog defaults.
+    // The user-selectable view includes the code-catalog defaults and omits
+    // managed backup routes.
     expect(parsed.profiles).toEqual([
       "balanced",
       "cost-optimized",

package/src/util/__tests__/file-use.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test";
+
+import { isFileUnheld } from "../file-use.js";
+
+describe("isFileUnheld", () => {
+  test("returns false when a process holds the file", async () => {
+    expect(
+      await isFileUnheld("lock", "linux", async () => ({ stdout: "123\n" })),
+    ).toBe(false);
+  });
+
+  test("uses an exclusive-open probe on Windows", async () => {
+    let invocation: { command: string; args: string[] } | undefined;
+    expect(
+      await isFileUnheld(
+        "C:\\Example Workspace\\.git\\index.lock",
+        "win32",
+        async (command, args) => {
+          invocation = { command, args };
+          return { stdout: "" };
+        },
+      ),
+    ).toBe(true);
+    expect(invocation?.command).toBe("powershell.exe");
+    expect(invocation?.args.at(-1)).toBe(
+      "C:\\Example Workspace\\.git\\index.lock",
+    );
+  });
+
+  test("returns false when Windows reports a sharing violation", async () => {
+    expect(
+      await isFileUnheld("lock", "win32", async () => {
+        throw Object.assign(new Error("held"), { code: 1 });
+      }),
+    ).toBe(false);
+  });
+
+  test("fails closed when the Windows probe errors", async () => {
+    expect(
+      await isFileUnheld("lock", "win32", async () => {
+        throw Object.assign(new Error("probe failed"), { code: 2 });
+      }),
+    ).toBe(false);
+  });
+
+  test("returns true when lsof reports no holder", async () => {
+    expect(
+      await isFileUnheld("lock", "linux", async () => {
+        throw Object.assign(new Error("no matches"), { code: 1 });
+      }),
+    ).toBe(true);
+  });
+
+  test("treats lsof errors as unheld to match prior behavior", async () => {
+    expect(
+      await isFileUnheld("lock", "linux", async () => {
+        throw Object.assign(new Error("missing"), { code: "ENOENT" });
+      }),
+    ).toBe(true);
+  });
+});

package/src/util/__tests__/process-table.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  parsePsProcessTable,
+  parseWindowsProcessTable,
+} from "../process-table.js";
+
+describe("parsePsProcessTable", () => {
+  test("preserves command lines while parsing process relationships", () => {
+    expect(
+      parsePsProcessTable(
+        "  10     1 /usr/bin/bun run worker.ts arg\n  11    10 helper\n",
+      ),
+    ).toEqual([
+      { pid: 10, ppid: 1, command: "/usr/bin/bun run worker.ts arg" },
+      { pid: 11, ppid: 10, command: "helper" },
+    ]);
+  });
+});
+
+describe("parseWindowsProcessTable", () => {
+  test("parses PowerShell JSON and falls back to the image name", () => {
+    expect(
+      parseWindowsProcessTable(
+        JSON.stringify([
+          {
+            ProcessId: 100,
+            ParentProcessId: 4,
+            CommandLine: "C:\\Program Files\\Bun\\bun.exe worker.ts",
+            Name: "bun.exe",
+            WorkingSetSize: 4096,
+            HandleCount: 42,
+          },
+          {
+            ProcessId: 101,
+            ParentProcessId: 100,
+            CommandLine: null,
+            Name: "helper.exe",
+          },
+        ]),
+      ),
+    ).toEqual([
+      {
+        pid: 100,
+        ppid: 4,
+        command: "C:\\Program Files\\Bun\\bun.exe worker.ts",
+        rssBytes: 4096,
+        handleCount: 42,
+      },
+      { pid: 101, ppid: 100, command: "helper.exe" },
+    ]);
+  });
+
+  test("handles the single-object shape emitted for one process", () => {
+    expect(
+      parseWindowsProcessTable(
+        JSON.stringify({
+          ProcessId: 100,
+          ParentProcessId: 4,
+          CommandLine: "worker.exe",
+          Name: "worker.exe",
+        }),
+      ),
+    ).toEqual([{ pid: 100, ppid: 4, command: "worker.exe" }]);
+  });
+});

package/src/util/__tests__/process-tree.test.ts

@@ -9,6 +9,7 @@ import { describe, expect, test } from "bun:test";
 
 import {
   buildProcessTree,
+  buildSystemProcessTree,
   deriveName,
   deriveOrigin,
   type ProcInfo,
@@ -20,6 +21,14 @@ describe("deriveName", () => {
     expect(deriveName("qdrant")).toBe("qdrant");
   });
 
+  test("handles quoted Windows executable and script paths", () => {
+    expect(
+      deriveName(
+        '"C:\\Program Files\\Bun\\bun.exe" run "C:\\Example App\\jobs\\worker.ts"',
+      ),
+    ).toBe("jobs-worker");
+  });
+
   test("summarizes the script path as <parent>-<file> for interpreter invocations", () => {
     expect(deriveName("bun run /home/u/app/jobs/worker.ts")).toBe(
       "jobs-worker",
@@ -67,6 +76,12 @@ describe("deriveOrigin", () => {
     ).toBe("plugin:cognee");
   });
 
+  test("tags a plugin from a Windows command path", () => {
+    expect(
+      deriveOrigin("bun run C:\\Vellum\\workspace\\plugins\\cognee\\server.ts"),
+    ).toBe("plugin:cognee");
+  });
+
   test("tags a bundled default plugin as default-<name>", () => {
     expect(
       deriveOrigin("bun --smol run /app/src/plugins/defaults/memory/worker.ts"),
@@ -195,3 +210,34 @@ describe("buildProcessTree", () => {
     expect(tree.children[0].children).toEqual([]);
   });
 });
+
+describe("buildSystemProcessTree", () => {
+  test("includes every process under a synthetic system root", () => {
+    const procs: ProcInfo[] = [
+      { pid: 4, ppid: 0, command: "System", origin: "workspace" },
+      { pid: 100, ppid: 4, command: "assistant.exe", origin: "workspace" },
+      { pid: 200, ppid: 100, command: "worker.exe", origin: "workspace" },
+      { pid: 300, ppid: 999, command: "orphan.exe", origin: "workspace" },
+    ];
+
+    const tree = buildSystemProcessTree(procs);
+    const allPids = (node: typeof tree): number[] => [
+      node.pid,
+      ...node.children.flatMap(allPids),
+    ];
+
+    expect(tree.name).toBe("system");
+    expect(allPids(tree)).toEqual([0, 4, 100, 200, 300]);
+  });
+
+  test("includes processes trapped in a parent cycle", () => {
+    const procs: ProcInfo[] = [
+      { pid: 10, ppid: 20, command: "a", origin: "workspace" },
+      { pid: 20, ppid: 10, command: "b", origin: "workspace" },
+    ];
+
+    const tree = buildSystemProcessTree(procs);
+    expect(tree.children.map((child) => child.pid)).toEqual([10]);
+    expect(tree.children[0].children.map((child) => child.pid)).toEqual([20]);
+  });
+});

package/src/util/errors.ts

@@ -118,6 +118,7 @@ export type ProviderErrorReason =
   | "overloaded"
   | "context_overflow"
   | "vision_unsupported"
+  | "request_shape_unsupported"
   | "bad_request"
   | "server_error"
   | "network_error"

package/src/util/file-use.ts

@@ -0,0 +1,91 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+const WINDOWS_EXCLUSIVE_OPEN_SCRIPT = String.raw`
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class FileUseProbe {
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern SafeFileHandle CreateFile(
+    string fileName,
+    uint desiredAccess,
+    uint shareMode,
+    IntPtr securityAttributes,
+    uint creationDisposition,
+    uint flagsAndAttributes,
+    IntPtr templateFile);
+}
+'@
+
+$handle = [FileUseProbe]::CreateFile($args[0], 0, 0, [IntPtr]::Zero, 3, 128, [IntPtr]::Zero)
+if (-not $handle.IsInvalid) {
+  $handle.Dispose()
+  exit 0
+}
+
+$errorCode = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
+if ($errorCode -eq 2) {
+  exit 0
+}
+if ($errorCode -eq 32 -or $errorCode -eq 33) {
+  exit 1
+}
+
+[Console]::Error.WriteLine($errorCode)
+exit 2
+`;
+
+type ExecFileResult = { stdout: string };
+type ExecFileRunner = (
+  command: string,
+  args: string[],
+  options: { encoding: "utf8"; timeout: number },
+) => Promise<ExecFileResult>;
+
+const runExecFile: ExecFileRunner = async (command, args, options) => {
+  const { stdout } = await execFileAsync(command, args, options);
+  return { stdout };
+};
+
+/** Whether no process holds `path` open. Windows fails closed on probe errors. */
+export async function isFileUnheld(
+  path: string,
+  platform: NodeJS.Platform = process.platform,
+  run: ExecFileRunner = runExecFile,
+): Promise<boolean> {
+  if (platform === "win32") {
+    try {
+      await run(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          WINDOWS_EXCLUSIVE_OPEN_SCRIPT,
+          path,
+        ],
+        { encoding: "utf8", timeout: 3000 },
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  try {
+    const { stdout } = await run("lsof", ["-t", path], {
+      encoding: "utf8",
+      timeout: 3000,
+    });
+    return stdout.length === 0;
+  } catch {
+    // lsof exits non-zero when no process holds the file. On hosts without
+    // lsof this degrades to unconditional removal, matching prior behavior.
+    return true;
+  }
+}

package/src/util/host-process.test.ts

@@ -0,0 +1,17 @@
+import { expect, mock, test } from "bun:test";
+
+import { terminateProcessTree } from "./host-process.js";
+
+test("Windows process trees use taskkill and fall back to the direct child", () => {
+  const kill = mock(() => true);
+  let taskkillPid: number | undefined;
+
+  terminateProcessTree({ pid: 1234, kill }, "win32", (pid, onFailure) => {
+    taskkillPid = pid;
+    onFailure();
+  });
+
+  expect(taskkillPid).toBe(1234);
+  expect(kill).toHaveBeenCalledTimes(1);
+  expect(kill).toHaveBeenCalledWith();
+});