@vellumai/assistant 0.12.1-staging.1 → 0.12.1

package/src/daemon/__tests__/conversation-tool-setup.test.ts

@@ -1,7 +1,30 @@
 /**
- * Tests for host-tool schema visibility. Host tool definitions stay stable
- * across interactive and background turns. Chrome extension remains limited
- * to host_browser because it is the only host capability it implements.
+ * Tests for `isToolActiveForContext` host-tool capability gating.
+ *
+ * Scenarios verified:
+ * - chrome-extension is its own executor and is exempt from the hasNoClient
+ *   gate (the extension's own popup UI gates commands; there is no SSE
+ *   interactive approval channel, and chrome-extension turns intentionally
+ *   run with `hasNoClient: true` because chrome-extension is not in
+ *   `INTERACTIVE_INTERFACES`).
+ * - macos requires a connected SSE client for host tools that flow through
+ *   the proxy (e.g. host_bash, host_file_*, host_browser), so
+ *   `hasNoClient: true` denies those on macos.
+ * - host_browser IS in the macos capability set — the proxy routes
+ *   host_browser_request frames to the desktop client via SSE (or via the
+ *   Chrome extension registry when an extension connection is present).
+ *
+ * The per-capability check (`supportsHostProxy(transport, capability)`) runs
+ * first and is authoritative for structural support, so host_bash and
+ * host_file_* are filtered out for chrome-extension regardless of the
+ * hasNoClient flag.
+ *
+ * Cross-client exception: tools whose capabilities are in
+ * CROSS_CLIENT_EXPOSED_CAPABILITIES (host_bash, host_file, host_browser)
+ * are allowed for non-host-proxy interactive interfaces ("web", "ios")
+ * when at least one capable client is connected via the event hub.
+ * chrome-extension is excluded as a security boundary, regardless of
+ * whether the capability is technically supported elsewhere.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -237,7 +260,7 @@ describe("isToolActiveForContext - Slack task_progress UI exception", () => {
     expect(isToolActiveForContext("ui_update", ctx)).toBe(true);
   });
 
-  test("ui_dismiss stays active for Slack without dynamic UI support", () => {
+  test("ui_dismiss remains hidden for Slack without dynamic UI support", () => {
     expect(
       isToolActiveForContext(
         "ui_dismiss",
@@ -249,45 +272,42 @@ describe("isToolActiveForContext - Slack task_progress UI exception", () => {
           },
         }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
 
-  test("Slack UI tools stay active for a clientless turn", () => {
-    for (const name of ["ui_show", "ui_update", "ui_dismiss"]) {
-      expect(
-        isToolActiveForContext(
-          name,
-          makeCtx({
-            hasNoClient: true,
-            channelCapabilities: {
-              channel: "slack",
-              supportsDynamicUi: false,
-            },
-          }),
-        ),
-      ).toBe(true);
-    }
+  test("Slack task_progress UI tools still require a connected client path", () => {
+    expect(
+      isToolActiveForContext(
+        "ui_show",
+        makeCtx({
+          hasNoClient: true,
+          channelCapabilities: {
+            channel: "slack",
+            supportsDynamicUi: false,
+          },
+        }),
+      ),
+    ).toBe(false);
   });
 
-  test("other non-dynamic channels keep UI surface tools on the wire", () => {
-    for (const name of ["ui_show", "ui_update", "ui_dismiss"]) {
-      expect(
-        isToolActiveForContext(
-          name,
-          makeCtx({
-            hasNoClient: false,
-            channelCapabilities: {
-              channel: "telegram",
-              supportsDynamicUi: false,
-            },
-          }),
-        ),
-      ).toBe(true);
-    }
+  test("other non-dynamic channels still hide UI surface tools", () => {
+    expect(
+      isToolActiveForContext(
+        "ui_show",
+        makeCtx({
+          hasNoClient: false,
+          channelCapabilities: {
+            channel: "telegram",
+            supportsDynamicUi: false,
+          },
+        }),
+      ),
+    ).toBe(false);
   });
 });
 
 describe("isToolActiveForContext — host tool capability gating", () => {
+  // macOS transport: SSE-based interactive approval required.
   test("host_bash is active for macOS with a connected client", () => {
     expect(
       isToolActiveForContext(
@@ -297,22 +317,27 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(true);
   });
 
-  test("host_bash remains active for a background macOS turn", () => {
+  test("host_bash is NOT active for macOS when hasNoClient is true (security invariant)", () => {
+    // macOS uses an SSE-based interactive approval channel. Without a
+    // connected client the guardian auto-approve path could execute host
+    // commands unattended, so host tools must be denied.
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
-  test("host_file_read remains active for a background macOS turn", () => {
+
+  test("host_file_read is NOT active for macOS when hasNoClient is true", () => {
     expect(
       isToolActiveForContext(
         "host_file_read",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
+
   test("host_browser is active for macOS with a connected client", () => {
     // macOS supports host_browser — the proxy routes host_browser_request
     // frames to the desktop client via SSE (or via the Chrome extension
@@ -325,14 +350,19 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(true);
   });
 
-  test("host_browser remains active for a background macOS turn", () => {
+  test("host_browser is NOT active for macOS when hasNoClient is true", () => {
+    // macOS supports host_browser structurally, but without a connected
+    // client the host_browser_request frames have no consumer, so the tool
+    // is denied.
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
+
+  // chrome-extension transport: the extension is its own executor.
   test("host_browser is active for chrome-extension even when hasNoClient is true", () => {
     // chrome-extension turns run with `hasNoClient: true` by design because
     // chrome-extension is not in `INTERACTIVE_INTERFACES` — it is not an
@@ -388,7 +418,10 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(false);
   });
 
-  test("host_bash remains active without transport metadata for a connected turn", () => {
+  // Backwards-compat fallback: no transport plumbed through.
+  test("host_bash falls back to hasNoClient gate when transport is undefined (client connected)", () => {
+    // Without a transport interface we cannot run the per-capability check,
+    // so we fall back to the coarse-grained `hasNoClient` behavior.
     expect(
       isToolActiveForContext(
         "host_bash",
@@ -397,18 +430,20 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(true);
   });
 
-  test("host_bash remains active without transport metadata for a background turn", () => {
+  test("host_bash falls back to hasNoClient gate when transport is undefined (no client)", () => {
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: undefined }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
 });
 
 describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)", () => {
   test("host_bash is active for web transport when a host_bash-capable client is connected", () => {
+    // Cross-client path: a web turn should see host_bash when a macOS client
+    // with host_bash capability is connected via the event hub.
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
@@ -418,24 +453,30 @@ describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)
     ).toBe(true);
   });
 
-  test("host_bash remains active for web when no capable client is connected", () => {
+  test("host_bash is NOT active for web transport when no capable client is connected", () => {
+    // No cross-client fallback: hub has no host_bash-capable subscribers.
     mockClientCountByCapability.set("host_bash", 0);
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
-  test("host_file_read remains active for web without host_file clients", () => {
+
+  test("host_file_read is NOT active for web transport when only a host_bash client is connected", () => {
+    // The cross-client exception is per-capability: a host_bash-capable
+    // client in the hub does not satisfy host_file's exposure check, since
+    // listClientsByCapability is queried with the tool's actual capability.
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
         "host_file_read",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
+
   test("host_bash for macos transport is unaffected by the cross-client exception", () => {
     // macos natively supports host_bash via host proxy — the supportsHostProxy
     // check passes, so the cross-client branch is never reached.
@@ -448,15 +489,19 @@ describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)
     ).toBe(true);
   });
 
-  test("host_bash remains active for a background macOS turn", () => {
+  test("host_bash for macos with no client is still denied (security invariant unaffected)", () => {
+    // Even with a capable client in the hub, the macos SSE path takes
+    // precedence — it passes the supportsHostProxy check, bypasses the
+    // cross-client branch, and reaches the hasNoClient gate.
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
+
   test("host_bash is NOT active for chrome-extension even when a capable client is connected", () => {
     // Security boundary: chrome-extension only gets host_browser. The
     // cross-client exception explicitly excludes chrome-extension transport
@@ -470,14 +515,16 @@ describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)
     ).toBe(false);
   });
 
-  test("host_bash remains active for a background web turn", () => {
+  test("host_bash is NOT active for web transport when hasNoClient is true (no approval UI)", () => {
+    // hasNoClient gate: no interactive approval UI available for this turn.
+    // Cross-client exception must not bypass this gate.
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: "web" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
 });
 
@@ -500,14 +547,14 @@ describe("isToolActiveForContext — cross-client exposure for host_file_*", ()
       ).toBe(true);
     });
 
-    test(`${tool} remains active for web when no host_file client is connected`, () => {
+    test(`${tool} is NOT exposed for web when no host_file client is connected`, () => {
       mockClientCountByCapability.set("host_file", 0);
       expect(
         isToolActiveForContext(
           tool,
           makeCtx({ hasNoClient: false, transportInterface: "web" }),
         ),
-      ).toBe(true);
+      ).toBe(false);
     });
 
     test(`${tool} is NOT exposed for chrome-extension (security boundary)`, () => {
@@ -523,19 +570,20 @@ describe("isToolActiveForContext — cross-client exposure for host_file_*", ()
       ).toBe(false);
     });
 
-    test(`${tool} remains active for a background web turn`, () => {
+    test(`${tool} is NOT exposed when hasNoClient is true (no approval UI)`, () => {
       mockClientCountByCapability.set("host_file", 1);
       expect(
         isToolActiveForContext(
           tool,
           makeCtx({ hasNoClient: true, transportInterface: "web" }),
         ),
-      ).toBe(true);
+      ).toBe(false);
     });
   }
 
-  test("host_file_transfer does not depend on the live host_file roster", () => {
-    mockClientCountByCapability.set("host_file", 0);
+  test("listClientsByCapability is queried with the actual capability, not host_bash (regression guard for D5 latent bug)", () => {
+    mockClientCountByCapability.set("host_bash", 0);
+    mockClientCountByCapability.set("host_file", 1);
     expect(
       isToolActiveForContext(
         "host_file_transfer",
@@ -574,33 +622,37 @@ describe("isToolActiveForContext — cross-client exposure for host_browser", ()
     ).toBe(true);
   });
 
-  test("host_browser remains active for web when no host_browser client is connected", () => {
+  test("host_browser is NOT exposed for web when no host_browser client is connected", () => {
     mockClientCountByCapability.set("host_browser", 0);
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
-  test("host_browser remains active for ios when no host_browser client is connected", () => {
+
+  test("host_browser is NOT exposed for ios when no host_browser client is connected", () => {
     mockClientCountByCapability.set("host_browser", 0);
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: false, transportInterface: "ios" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
-  test("host_browser remains active for a background web turn", () => {
+
+  test("host_browser is NOT exposed when hasNoClient is true (no approval UI)", () => {
+    // hasNoClient gate: cross-client exception must not bypass this.
     mockClientCountByCapability.set("host_browser", 1);
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: true, transportInterface: "web" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
+
   test("host_browser for macos transport is unaffected by the cross-client exception", () => {
     // macos natively supports host_browser via host proxy — the
     // supportsHostProxy check passes, so the cross-client branch is never
@@ -629,7 +681,10 @@ describe("isToolActiveForContext — cross-client exposure for host_browser", ()
     ).toBe(true);
   });
 
-  test("host_browser does not depend on the live host_browser roster", () => {
+  test("listClientsByCapability is queried with host_browser, not host_bash or host_file (per-capability invariant)", () => {
+    // Defense against any future regression that hardcodes a different
+    // capability in the cross-client check. Only host_browser-capable
+    // clients should satisfy host_browser exposure.
     mockClientCountByCapability.set("host_bash", 1);
     mockClientCountByCapability.set("host_file", 1);
     mockClientCountByCapability.set("host_browser", 0);
@@ -638,7 +693,7 @@ describe("isToolActiveForContext — cross-client exposure for host_browser", ()
         "host_browser",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(true);
+    ).toBe(false);
   });
 });
 

package/src/daemon/__tests__/plugin-mcp-reconcile.test.ts

@@ -41,13 +41,10 @@ mock.module("../../mcp/mcp-header-store.js", () => ({
 }));
 
 mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({ mcp: { servers: {} } }),
   invalidateConfigCache: () => {},
 }));
 
-mock.module("../../mcp/workspace-mcp-config.js", () => ({
-  loadWorkspaceMcpConfig: () => ({ servers: {} }),
-}));
-
 mock.module("../../tools/registry.js", () => ({
   registerMcpTools: () => [],
   unregisterAllMcpTools: () => {},

package/src/daemon/app-source-watcher.ts

@@ -0,0 +1,218 @@
+/**
+ * Filesystem watcher for app source directories.
+ *
+ * Watches the apps root directory recursively using fs.watch (FSEvents on
+ * macOS). When a source file changes, debounces per app ID and calls the
+ * provided callback so the server can recompile + refresh surfaces.
+ *
+ * This catches ALL modification sources (file_edit, file_write, bash, etc.)
+ * without relying on individual tool hooks.
+ */
+
+import { existsSync, type FSWatcher, watch } from "node:fs";
+
+import {
+  getApp,
+  getAppDirPath,
+  getAppsDir,
+  resolveAppIdByDirName,
+} from "../apps/app-store.js";
+import { compileApp } from "../bundler/app-compiler.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
+import { publishAppsChanged } from "../runtime/sync/resource-sync-events.js";
+import { updatePublishedAppDeployment } from "../services/published-app-updater.js";
+import { DebouncerMap } from "../util/debounce.js";
+import { attachFsWatcherErrorHandler } from "../util/fs-watcher-error.js";
+import { getLogger } from "../util/logger.js";
+import { allConversations } from "./conversation-registry.js";
+import { refreshSurfacesForApp } from "./conversation-surfaces.js";
+
+const log = getLogger("app-source-watcher");
+
+const APP_REFRESH_DEBOUNCE_MS = 500;
+
+export type AppSourceChangeCallback = (appId: string) => void;
+
+/** Process-level singleton; created by {@link startAppSourceWatcher}. */
+let instance: AppSourceWatcher | null = null;
+
+/**
+ * Ensure the watcher is running. Called by tool-side-effects after the apps
+ * directory may have been created (e.g. on first app_create), since the
+ * watcher is skipped at startup when the directory doesn't exist yet.
+ */
+export function ensureAppSourceWatcher(): void {
+  instance?.ensureStarted();
+}
+
+/**
+ * Resolve app ID from a relative path within the apps directory.
+ * Returns null if the path is not an app source file (e.g. dist/, records/).
+ */
+function resolveAppIdFromRelPath(relPath: string): string | null {
+  const slashIdx = relPath.indexOf("/");
+  if (slashIdx === -1) {
+    return null;
+  } // file directly in apps/ (e.g. .json definition)
+
+  const dirName = relPath.slice(0, slashIdx);
+  const innerPath = relPath.slice(slashIdx + 1);
+
+  // Skip a git repo at the root of the apps directory. Older installs may
+  // still carry a legacy .git there; its objects/index/refs churn constantly,
+  // and each event would otherwise hit resolveAppIdByDirName -> existsSync,
+  // which is needless work on a path that can never be an app.
+  if (dirName === ".git") {
+    return null;
+  }
+
+  // Skip non-source directories (include bare directory names for fs.watch events)
+  if (
+    innerPath === "records" ||
+    innerPath.startsWith("records/") ||
+    innerPath === "dist" ||
+    innerPath.startsWith("dist/")
+  ) {
+    return null;
+  }
+
+  return resolveAppIdByDirName(dirName);
+}
+
+export class AppSourceWatcher {
+  private watcher: FSWatcher | null = null;
+  private onChange: AppSourceChangeCallback | null = null;
+  private debouncer = new DebouncerMap({
+    defaultDelayMs: APP_REFRESH_DEBOUNCE_MS,
+    maxEntries: 50,
+  });
+
+  start(onChange: AppSourceChangeCallback): void {
+    this.onChange = onChange;
+    this.tryWatch();
+  }
+
+  /**
+   * Ensure the watcher is running. Call after app creation so the watcher
+   * starts if the apps directory was created after daemon startup.
+   */
+  ensureStarted(): void {
+    if (this.watcher || !this.onChange) {
+      return;
+    }
+    this.tryWatch();
+  }
+
+  private tryWatch(): void {
+    if (this.watcher) {
+      return;
+    }
+
+    let appsDir: string;
+    try {
+      appsDir = getAppsDir();
+    } catch {
+      log.warn(
+        "Could not resolve apps directory; app source watching disabled",
+      );
+      return;
+    }
+
+    if (!existsSync(appsDir)) {
+      log.info("Apps directory does not exist yet; skipping source watcher");
+      return;
+    }
+
+    const onChange = this.onChange;
+    if (!onChange) {
+      return;
+    }
+
+    try {
+      this.watcher = watch(
+        appsDir,
+        { recursive: true },
+        (_eventType, filename) => {
+          if (!filename) {
+            return;
+          }
+
+          const appId = resolveAppIdFromRelPath(filename);
+          if (!appId) {
+            return;
+          }
+
+          this.debouncer.schedule(`app:${appId}`, () => {
+            onChange(appId);
+          });
+        },
+      );
+      // Recursive watches over app trees (incl. node_modules) can exhaust the
+      // inotify watch limit and emit ENOSPC asynchronously. Without an 'error'
+      // listener that unhandled emitter error crashes the daemon.
+      attachFsWatcherErrorHandler(this.watcher, log, appsDir);
+      log.info("App source watcher started");
+    } catch (err) {
+      log.warn(
+        { err },
+        "Failed to watch apps directory; source watching disabled",
+      );
+    }
+  }
+
+  stop(): void {
+    this.debouncer.cancelAll();
+    if (this.watcher) {
+      this.watcher.close();
+      this.watcher = null;
+    }
+  }
+}
+
+/**
+ * Handle a detected app source file change. Recompiles the app and refreshes
+ * surfaces across ALL conversations.
+ */
+function handleAppSourceChange(appId: string): void {
+  const app = getApp(appId);
+  if (!app) {
+    return;
+  }
+
+  const doRefresh = () => {
+    for (const conversation of allConversations()) {
+      refreshSurfacesForApp(conversation, appId, { fileChange: true });
+    }
+    broadcastMessage({ type: "app_files_changed", appId });
+    publishAppsChanged();
+    void updatePublishedAppDeployment(appId);
+  };
+
+  const appDir = getAppDirPath(appId);
+  void compileApp(appDir)
+    .then((result) => {
+      if (!result.ok) {
+        log.warn(
+          { appId, errors: result.errors },
+          "Recompile failed on app source change",
+        );
+      }
+      doRefresh();
+    })
+    .catch((err) => {
+      log.warn({ appId, err }, "Recompile threw on app source change");
+      doRefresh();
+    });
+}
+
+/** Start watching app source directories for the life of the daemon. */
+export function startAppSourceWatcher(): void {
+  instance = new AppSourceWatcher();
+  instance.start(handleAppSourceChange);
+}
+
+/** Stop the app source watcher during daemon shutdown. */
+export function stopAppSourceWatcher(): void {
+  instance?.stop();
+  instance = null;
+}