@vellumai/assistant 0.12.0 → 0.12.1-dev.202609141913.5e16607

package/src/tools/host-terminal/host-shell.ts

@@ -18,10 +18,7 @@ import { getConfig } from "../../config/loader.js";
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
-import {
-  assistantEventHub,
-  broadcastMessage,
-} from "../../runtime/assistant-event-hub.js";
+import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import {
@@ -39,7 +36,7 @@ import {
   registerBackgroundTool,
   removeBackgroundTool,
 } from "../background-tool-registry.js";
-import { desktopClientName } from "../client-os.js";
+import { formatDesktopAppRequired } from "../capability-offer.js";
 import {
   attachBoundedStdio,
   MAX_OUTPUT_LENGTH,
@@ -142,7 +139,7 @@ export const hostShellInputSchema = z.looseObject({
   target_client_id: z
     .string()
     .describe(
-      "ID of the specific client to execute this command on. Required when multiple clients support host_bash; omit when only one client is connected. Obtain IDs from `assistant clients list --capability host_bash`.",
+      "Optional ID of the specific client to execute this command on. Without it, the most recently active eligible client is used. Obtain IDs from `assistant clients list --capability host_bash`.",
     )
     .optional()
     .catch(undefined),
@@ -203,20 +200,7 @@ export const hostShellTool = {
     const config = getConfig();
     const { shellDefaultTimeoutSec, shellMaxTimeoutSec } = config.timeouts;
 
-    // Guard: non-host-proxy interfaces need an explicit target when multiple
-    // capable clients are connected to avoid ambiguous untargeted broadcasts.
     const transportInterface = context.transportInterface;
-    if (
-      targetClientId == null &&
-      transportInterface != null &&
-      !supportsHostProxy(transportInterface) &&
-      assistantEventHub.listClientsByCapability("host_bash").length > 1
-    ) {
-      return {
-        content: `Error: multiple clients support host_bash. Specify which client to use with \`target_client_id\`. Run \`assistant clients list --capability host_bash\` to see client IDs and labels.`,
-        isError: true,
-      };
-    }
 
     // Guard: non-host-proxy interfaces with no capable clients connected.
     if (
@@ -226,7 +210,7 @@ export const hostShellTool = {
       !HostBashProxy.instance.isAvailable()
     ) {
       return {
-        content: `Error: no client with host_bash capability is connected. Connect a ${desktopClientName(context)} client to use host_bash from a non-desktop interface.`,
+        content: formatDesktopAppRequired("shell"),
         isError: true,
       };
     }

package/src/tools/policy-context.ts

@@ -1,5 +1,5 @@
 import { getConfig } from "../config/loader.js";
-import { isV3TierActive } from "../config/memory-v3-gate.js";
+import { isSkillImprovementActive } from "../config/memory-v3-gate.js";
 import type { ExecutionContext } from "../permissions/approval-policy.js";
 import type { ChannelPermissionCoordinates } from "../permissions/channel-permission-query.js";
 import type { PolicyContext } from "../permissions/types.js";
@@ -63,12 +63,11 @@ export function buildPolicyContext(
     requestOrigin: context?.requestOrigin,
     ...channelCoordinatesFromToolContext(context),
     requesterContactId: context?.requesterContactId,
-    // Precompute the proc-to-skills gate — the v3 tier being active, i.e.
-    // memory on AND v3 live — here so the permission checker, a leaf module
-    // that must not read config, can deny the memory-retrospective
-    // skill-authoring grant whenever the feature is inactive just by reading
-    // this boolean.
-    procToSkillsActive: isV3TierActive(getConfig()),
+    // Precompute the retrospective skill-improvement gate here so the
+    // permission checker, a leaf module that must not read config, can deny
+    // the memory-retrospective skill-authoring grant whenever the feature is
+    // inactive just by reading this boolean.
+    procToSkillsActive: isSkillImprovementActive(getConfig()),
   };
 
   const ownerKind = getToolOwner(tool.name)?.kind;

package/src/tools/subagent/spawn.ts

@@ -484,9 +484,9 @@ function spawnCancelledResult(label: string): ToolExecutionResult {
  * repeat-spawn guard folds, so a consult has to record it the same way every
  * other spawn does or the guard could never match one consult against another.
  *
- * The context pack is best effort: the parent conversation is looked up only
- * for its warm skill catalog, so an unresolvable one (e.g. evicted) costs the
- * skills section of the pack and nothing else.
+ * The context pack is best effort: each section independently falls back to
+ * null on failure, so a missing workspace or empty catalog costs only that
+ * section, never the consult.
  *
  * The budget is the advisor's alone. It is the only spawn the agent may issue
  * unprompted and the only one that runs on the premium profile, so it is the
@@ -502,21 +502,18 @@ async function buildAdvisorFields(
   maxRuntimeMs: number;
   maxToolCalls: number;
 }> {
-  const parentConversation = findConversation(context.conversationId);
   // Situational awareness for the advisor: the parent's live tool set, the
   // full skill catalog, and its workspace. Assembled off the per-turn
   // ToolContext snapshot (trust, channel) so the personal-memory sections are
   // gated exactly like the runtime injectors. A null pack just means the
-  // consult runs on the brief alone.
+  // consult runs on the brief alone. Skills come from a fresh
+  // `loadSkillCatalog()` inside the context pack, not a conversation snapshot.
   const situationalContext = await buildAdvisorContext({
     conversationId: context.conversationId,
     workingDir: context.workingDir,
     allowedToolNames: context.allowedToolNames,
     trustClass: context.trustClass,
     enabledPluginSet: context.enabledPluginSet,
-    // The parent's warm per-turn catalog keeps the synchronous on-disk catalog
-    // scan out of the spawn path.
-    skillCatalog: parentConversation?.skillProjectionCache?.catalog,
   });
   return {
     requestText: advisorRequestText(objective, situationalContext),

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -50,10 +50,10 @@ describe("safe-env Qdrant forwarding", () => {
   });
 });
 
-describe("safe-env CES vault isolation", () => {
-  test("strips the CES HTTP bearer and credential URL from child shells", () => {
-    expect(SAFE_ENV_VARS).not.toContain("CES_SERVICE_TOKEN");
-    expect(SAFE_ENV_VARS).not.toContain("CES_CREDENTIAL_URL");
+describe("safe-env CES child forwarding", () => {
+  test("forwards CES HTTP credentials so sanitized children can resolve managed connections", () => {
+    expect(SAFE_ENV_VARS).toContain("CES_SERVICE_TOKEN");
+    expect(SAFE_ENV_VARS).toContain("CES_CREDENTIAL_URL");
     expect(SAFE_ENV_VARS).toContain("CES_LOCAL_SOCKET");
 
     const env = buildSanitizedEnv("linux", {
@@ -61,8 +61,8 @@ describe("safe-env CES vault isolation", () => {
       CES_CREDENTIAL_URL: "http://127.0.0.1:8090",
       CES_LOCAL_SOCKET: "/tmp/ces.sock",
     });
-    expect(env.CES_SERVICE_TOKEN).toBeUndefined();
-    expect(env.CES_CREDENTIAL_URL).toBeUndefined();
+    expect(env.CES_SERVICE_TOKEN).toBe("vault-bearer");
+    expect(env.CES_CREDENTIAL_URL).toBe("http://127.0.0.1:8090");
     expect(env.CES_LOCAL_SOCKET).toBe("/tmp/ces.sock");
   });
 });

package/src/tools/terminal/__tests__/sanitized-bash.test.ts

@@ -0,0 +1,57 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { runSanitizedBash } from "../sanitized-bash.js";
+
+describe("runSanitizedBash", () => {
+  const priorToken = process.env.CES_SERVICE_TOKEN;
+  const priorSocket = process.env.CES_LOCAL_SOCKET;
+
+  afterEach(() => {
+    if (priorToken == null) {
+      delete process.env.CES_SERVICE_TOKEN;
+    } else {
+      process.env.CES_SERVICE_TOKEN = priorToken;
+    }
+    if (priorSocket == null) {
+      delete process.env.CES_LOCAL_SOCKET;
+    } else {
+      process.env.CES_LOCAL_SOCKET = priorSocket;
+    }
+  });
+
+  test("runs a command and returns stdout", async () => {
+    const result = await runSanitizedBash("echo hello", 5_000);
+    expect(result.error).toBeUndefined();
+    expect(result.timedOut).toBe(false);
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("hello");
+  });
+
+  test("forwards CES_SERVICE_TOKEN to the child", async () => {
+    process.env.CES_SERVICE_TOKEN = "vault-bearer";
+    const result = await runSanitizedBash("printenv CES_SERVICE_TOKEN", 5_000);
+    expect(result.error).toBeUndefined();
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("vault-bearer");
+  });
+
+  test("forwards CES_LOCAL_SOCKET to the child", async () => {
+    process.env.CES_LOCAL_SOCKET = "/tmp/ces.sock";
+    const result = await runSanitizedBash("printenv CES_LOCAL_SOCKET", 5_000);
+    expect(result.error).toBeUndefined();
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("/tmp/ces.sock");
+  });
+
+  test("times out a hung command", async () => {
+    const result = await runSanitizedBash("sleep 5", 200);
+    expect(result.error).toBeUndefined();
+    expect(result.timedOut).toBe(true);
+  });
+
+  test("rejects an empty command", async () => {
+    const result = await runSanitizedBash("");
+    expect(result.error).toBe("command is required");
+    expect(result.exitCode).toBeNull();
+  });
+});

package/src/tools/terminal/safe-env.ts

@@ -55,10 +55,30 @@ export const SAFE_ENV_VARS = [
   "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
   "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
   "CES_MANAGED_MODE",
-  // Socket path only. The CES HTTP bearer (`CES_SERVICE_TOKEN`) and
-  // `CES_CREDENTIAL_URL` stay in the assistant process: child shells must
-  // not inherit a vault token they can printenv or log.
   "CES_LOCAL_SOCKET",
+  // Child processes (bash, skill sandbox, scheduled scripts) run
+  // `assistant oauth request` in-process and resolve managed connections
+  // through CES HTTP (`getSecureKeyAsync` / platform client). They need
+  // both the credential URL and the service token. CES_LOCAL_SOCKET alone
+  // is not enough on managed pods: the socket is often absent or does not
+  // complete the lazy RPC path those children use, so a connected account
+  // looks disconnected from sanitized children while the daemon still
+  // reports healthy.
+  //
+  // To drop these later, children must resolve the same ACTIVE managed
+  // connections without inheriting a reusable vault bearer. That means
+  // CES RPC over CES_LOCAL_SOCKET works on managed pods (present,
+  // reachable, and sufficient for secure-key / platform-client reads), or
+  // a narrower grant protocol issues a one-shot provider token.
+  //
+  // Before removing them again, reproduce from a sanitized child on a
+  // platform-managed pod. After `buildSanitizedEnv()`,
+  // `assistant oauth request --provider <key> --json <provider-url>` must
+  // succeed for an ACTIVE connection and match a direct terminal
+  // invocation. Unit tests that only assert the vars are absent are not
+  // enough: also cover skill sandbox and scheduled-script children.
+  "CES_CREDENTIAL_URL",
+  "CES_SERVICE_TOKEN",
   // Per-instance port of the assistant-managed Qdrant sidecar, so skill and
   // bash-tool subprocesses that use the vector helpers (e.g. embed/search over
   // `@vellumai/plugin-api`) resolve the same local sidecar as the daemon

package/src/tools/terminal/sanitized-bash.ts

@@ -0,0 +1,105 @@
+/**
+ * Spawn a shell command with the same sanitized environment the bash tool
+ * forwards to tool-call subprocesses.
+ *
+ * Used by `assistant bash` so a CLI invocation sees the same allowlisted
+ * env, workspace cwd, and platform shell as a bash tool call, without
+ * round-tripping through the assistant HTTP or IPC API.
+ */
+
+import { spawn } from "node:child_process";
+
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
+import { getWorkspaceDir } from "../../util/platform.js";
+import { buildSanitizedEnv } from "./safe-env.js";
+
+export const DEFAULT_SANITIZED_BASH_TIMEOUT_MS = 30_000;
+
+export interface SanitizedBashResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+  error?: string;
+}
+
+export function runSanitizedBash(
+  command: string,
+  timeoutMs: number = DEFAULT_SANITIZED_BASH_TIMEOUT_MS,
+): Promise<SanitizedBashResult> {
+  if (!command) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "command is required",
+    });
+  }
+
+  const effectiveTimeout =
+    typeof timeoutMs === "number" && timeoutMs > 0
+      ? timeoutMs
+      : DEFAULT_SANITIZED_BASH_TIMEOUT_MS;
+
+  return new Promise<SanitizedBashResult>((resolve) => {
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    let timedOut = false;
+    let settled = false;
+
+    const finish = (result: SanitizedBashResult) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve(result);
+    };
+
+    const wrapped = buildShellInvocation(command);
+    const child = spawn(wrapped.command, wrapped.args, {
+      cwd: getWorkspaceDir(),
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+      env: buildSanitizedEnv(),
+      windowsHide: true,
+    });
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      terminateProcessTree(child);
+    }, effectiveTimeout);
+
+    child.stdout.on("data", (data: Buffer) => {
+      stdoutChunks.push(data);
+    });
+
+    child.stderr.on("data", (data: Buffer) => {
+      stderrChunks.push(data);
+    });
+
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({
+        stdout: Buffer.concat(stdoutChunks).toString(),
+        stderr: Buffer.concat(stderrChunks).toString(),
+        exitCode: code,
+        timedOut,
+      });
+    });
+
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      finish({
+        stdout: "",
+        stderr: "",
+        exitCode: null,
+        timedOut: false,
+        error: err.message,
+      });
+    });
+  });
+}

package/src/tools/watch/watch-retro-report.ts

@@ -14,14 +14,6 @@ import type {
 /**
  * How a watch retrospective hands its report to the daemon.
  *
- * **The card cannot come from `ui_show`.** A retrospective runs as a
- * `clientless` wake, which pins the turn non-interactive, and
- * `conversation-tool-setup` gates the whole `ui_surface` tool family on a
- * client being present (`return channelCapabilities?.supportsDynamicUi ??
- * !hasNoClient`). So `ui_show` is not merely denied in this turn, it is absent
- * from the tool set, and a retrospective told to call it can only report that
- * it cannot. This tool is an ordinary one and passes that gate untouched.
- *
  * **It records; it does not render.** The executor validates the payload and
  * returns, and nothing here writes to the conversation. What makes the card is
  * `watch-retro.ts` reading this call back out of the turn's own history once

package/src/util/__tests__/language-subtag.test.ts

@@ -1,6 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
-import { baseLanguageSubtag, localizedOrDefault } from "../language-subtag.js";
+import {
+  baseLanguageSubtag,
+  fixedPhraseLanguage,
+  localizedOrDefault,
+} from "../language-subtag.js";
 
 describe("baseLanguageSubtag", () => {
   test("lowercases a bare tag", () => {
@@ -52,3 +56,21 @@ describe("localizedOrDefault", () => {
     expect(localizedOrDefault(table, "__proto__", "fallback")).toBe("fallback");
   });
 });
+
+describe("fixedPhraseLanguage", () => {
+  const table = { en: "one", es: "uno" };
+
+  test("pins English when the speaker's language has no table entry", () => {
+    expect(fixedPhraseLanguage(table, "ko")).toBe("en");
+    expect(fixedPhraseLanguage(table, "ar-EG")).toBe("en");
+  });
+
+  test("rides the speaker's language when the table covers it", () => {
+    expect(fixedPhraseLanguage(table, "es")).toBeUndefined();
+    expect(fixedPhraseLanguage(table, "es-419")).toBeUndefined();
+  });
+
+  test("carries no hint when the language is unknown", () => {
+    expect(fixedPhraseLanguage(table, undefined)).toBeUndefined();
+  });
+});

package/src/util/ca-bundle.ts

@@ -0,0 +1,13 @@
+import { readFile, writeFile } from "node:fs/promises";
+
+export async function writeCombinedCABundle(
+  systemBundlePath: string,
+  extraCAPath: string,
+  outputPath: string,
+): Promise<void> {
+  const [systemCAs, extraCAs] = await Promise.all([
+    readFile(systemBundlePath, "utf-8"),
+    readFile(extraCAPath, "utf-8"),
+  ]);
+  await writeFile(outputPath, `${systemCAs}\n${extraCAs}`, { mode: 0o644 });
+}

package/src/util/language-subtag.ts

@@ -41,3 +41,19 @@ export function localizedOrDefault<T>(
     ? (table[baseLanguageSubtag(language)!] as T)
     : fallback;
 }
+
+/**
+ * The TTS language hint for a fixed phrase picked from a localized table:
+ * "en" when the speaker has a language the table does not cover (the
+ * picker fell back to English text, which must not be synthesized under
+ * an ar/ko/ta hint), undefined otherwise (the phrase rides the speaker's
+ * language, or carries no hint at all when the language is unknown).
+ */
+export function fixedPhraseLanguage(
+  table: Readonly<Record<string, unknown>>,
+  language: string | undefined,
+): string | undefined {
+  return language !== undefined && !hasLocalizedEntry(table, language)
+    ? "en"
+    : undefined;
+}

package/src/util/platform.ts

@@ -470,6 +470,14 @@ export function getWorkspaceConfigPath(): string {
   return join(getWorkspaceDir(), "config.json");
 }
 
+/** Filename for the user-owned Agent Plugins MCP document. */
+export const WORKSPACE_MCP_FILENAME = "mcp.json";
+
+/** Returns $VELLUM_WORKSPACE_DIR/mcp.json */
+export function getWorkspaceMcpConfigPath(): string {
+  return join(getWorkspaceDir(), WORKSPACE_MCP_FILENAME);
+}
+
 /** Returns $VELLUM_WORKSPACE_DIR/skills */
 export function getWorkspaceSkillsDir(): string {
   return join(getWorkspaceDir(), "skills");

package/src/workspace/git-porcelain.ts

@@ -0,0 +1,66 @@
+/**
+ * NUL-terminated `git status --porcelain -z` parsing.
+ *
+ * Status reporting and batched staging share this parser so rename/copy
+ * origin paths cannot drift between the two readers.
+ */
+
+export interface PorcelainEntry {
+  /** Two-character XY status from porcelain v1. */
+  status: string;
+  /** Path git reports for this record (the destination for rename/copy). */
+  path: string;
+  /** Pre-rename/copy path. Present when the record is a rename or copy. */
+  origin?: string;
+}
+
+/**
+ * Parse NUL-terminated `git status --porcelain -z` output into status/path
+ * records. NUL termination is required so paths with special characters
+ * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
+ *
+ * A rename/copy record is followed by a bare origin-path entry, captured on
+ * {@link PorcelainEntry.origin}.
+ */
+export function parsePorcelainZ(stdout: string): PorcelainEntry[] {
+  const entries = stdout.split("\0");
+  const parsed: PorcelainEntry[] = [];
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i] ?? "";
+    if (entry.length < 4) {
+      continue;
+    }
+    const status = entry.substring(0, 2);
+    const path = entry.substring(3);
+    if (status[0] === "R" || status[0] === "C") {
+      i++;
+      const origin = entries[i];
+      if (origin && origin.length > 0) {
+        parsed.push({ status, path, origin });
+        continue;
+      }
+    }
+    parsed.push({ status, path });
+  }
+  return parsed;
+}
+
+/**
+ * Every path git status knows about, including rename/copy origins.
+ * Origins still need to be staged so a deletion is not left behind when a
+ * rename is split across add batches.
+ */
+export function collectDirtyPathsFromPorcelain(stdout: string): string[] {
+  const paths: string[] = [];
+  const seen = new Set<string>();
+  for (const entry of parsePorcelainZ(stdout)) {
+    for (const path of [entry.path, entry.origin]) {
+      if (!path || seen.has(path)) {
+        continue;
+      }
+      seen.add(path);
+      paths.push(path);
+    }
+  }
+  return paths;
+}

package/src/workspace/git-service.ts

@@ -17,6 +17,10 @@ import { getLogger } from "../util/logger.js";
 import { Mutex } from "../util/mutex.js";
 import { addToPathEnv, getExtraToolPathDirs } from "../util/platform.js";
 import { PromiseGuard } from "../util/promise-guard.js";
+import {
+  collectDirtyPathsFromPorcelain,
+  parsePorcelainZ,
+} from "./git-porcelain.js";
 
 const execFileAsync = promisify(execFile);
 const log = getLogger("workspace-git");
@@ -226,59 +230,6 @@ done
 exit 0
 `;
 
-/**
- * Parse NUL-terminated `git status --porcelain -z` output into status/path
- * pairs. NUL termination is required so paths with special characters
- * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
- * A rename/copy record is followed by a bare origin-path entry, which is
- * skipped.
- */
-function parsePorcelainZ(
-  stdout: string,
-): Array<{ status: string; path: string }> {
-  const entries = stdout.split("\0");
-  const parsed: Array<{ status: string; path: string }> = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    parsed.push({ status, path: entry.substring(3) });
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-    }
-  }
-  return parsed;
-}
-
-/**
- * Every path git status knows about, including rename/copy origins.
- * Origins are skipped by {@link parsePorcelainZ} (they have no status
- * prefix) but still need to be staged so a deletion is not left behind
- * when a rename is split across add batches.
- */
-function collectDirtyPathsFromPorcelain(stdout: string): string[] {
-  const entries = stdout.split("\0");
-  const paths: string[] = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    paths.push(entry.substring(3));
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-      const origin = entries[i];
-      if (origin && origin.length > 0) {
-        paths.push(origin);
-      }
-    }
-  }
-  return paths;
-}
-
 /** Properties added by Node's child_process errors. */
 interface ExecError extends Error {
   killed?: boolean;
@@ -433,7 +384,7 @@ export class WorkspaceGitService {
    *
    * This method is always called inside the mutex, so no git operation from
    * our code can be concurrently holding the lock. However, an external git
-   * process (user running `git add`, IDE tooling, etc.) could legitimately
+   * git process (user running `git add`, IDE tooling, etc.) could legitimately
    * hold the lock. We use `lsof` to check — if any process has the file
    * open, we leave it alone. If no process holds it, it's stale (crashed
    * process) and safe to remove.