@vellumai/assistant 0.12.2-dev.202609171017.61d51c8 → 0.12.2-dev.202609171418.b9a2adf

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.2-dev.202609171017.61d51c8",
+  "version": "0.12.2-dev.202609171418.b9a2adf",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/plugin-api-resolve-credential.test.ts

@@ -14,6 +14,7 @@ import {
 
 import { credentialKey } from "@vellumai/credential-storage";
 
+import { PLUGIN_NAME_ENV } from "../plugin-api/plugin-name-env.js";
 import {
   CredentialResolutionError,
   resolveCredential,
@@ -22,8 +23,10 @@ import { runInPluginContext } from "../plugins/plugin-execution-context.js";
 import * as secureKeys from "../security/secure-keys.js";
 import {
   _setMetadataPath,
+  type CredentialMetadata,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
+import * as metadataStore from "../tools/credentials/metadata-store.js";
 
 // Real metadata store backed by a temp file (no module mocking — a mock.module
 // on metadata-store / secure-keys would replace the whole module namespace and
@@ -65,6 +68,7 @@ beforeEach(() => {
 
 afterEach(() => {
   getSpy.mockRestore();
+  delete process.env[PLUGIN_NAME_ENV];
 });
 
 afterAll(() => {
@@ -145,5 +149,98 @@ describe("resolveCredential", () => {
         ),
       ).resolves.toBe("proj-id");
     });
+
+    test("scopes resolution from VELLUM_PLUGIN_NAME when ALS is empty", async () => {
+      seedCredential("sms", "account_sid", "sid-secret");
+      process.env[PLUGIN_NAME_ENV] = "sms";
+      await expect(resolveCredential("sms/account_sid")).resolves.toBe(
+        "sid-secret",
+      );
+    });
+
+    test("blocks another service when identity comes from VELLUM_PLUGIN_NAME", async () => {
+      seedCredential("openai", "api_key", "sk-secret");
+      process.env[PLUGIN_NAME_ENV] = "sms";
+      await expect(resolveCredential("openai/api_key")).rejects.toThrow(
+        /out of scope/,
+      );
+    });
+  });
+
+  describe("live catalog on cache miss", () => {
+    function liveRecord(
+      service: string,
+      field: string,
+    ): CredentialMetadata {
+      return {
+        credentialId: `${service}-${field}`,
+        service,
+        field,
+        allowedTools: [],
+        allowedDomains: [],
+        createdAt: 1,
+        updatedAt: 1,
+      };
+    }
+
+    test("consults the live catalog when plugin context is set and the cache misses", async () => {
+      const liveSpy = spyOn(
+        metadataStore,
+        "listCredentialRecordsLive",
+      ).mockResolvedValue({
+        records: [liveRecord("sms", "account_sid")],
+        unreachable: false,
+      });
+      secureStore.set(credentialKey("sms", "account_sid"), "live-sid");
+      process.env[PLUGIN_NAME_ENV] = "sms";
+
+      try {
+        await expect(resolveCredential("sms/account_sid")).resolves.toBe(
+          "live-sid",
+        );
+        expect(liveSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        liveSpy.mockRestore();
+      }
+    });
+
+    test("does not list live records when no plugin is in context", async () => {
+      const liveSpy = spyOn(
+        metadataStore,
+        "listCredentialRecordsLive",
+      ).mockResolvedValue({
+        records: [liveRecord("sms", "account_sid")],
+        unreachable: false,
+      });
+      secureStore.set(credentialKey("sms", "account_sid"), "live-sid");
+
+      try {
+        await expect(resolveCredential("sms/account_sid")).rejects.toThrow(
+          /Credential not found/,
+        );
+        expect(liveSpy).not.toHaveBeenCalled();
+      } finally {
+        liveSpy.mockRestore();
+      }
+    });
+
+    test("reports an unreachable live catalog instead of not found", async () => {
+      const liveSpy = spyOn(
+        metadataStore,
+        "listCredentialRecordsLive",
+      ).mockResolvedValue({
+        records: [],
+        unreachable: true,
+      });
+      process.env[PLUGIN_NAME_ENV] = "sms";
+
+      try {
+        await expect(resolveCredential("sms/account_sid")).rejects.toThrow(
+          /unreachable/,
+        );
+      } finally {
+        liveSpy.mockRestore();
+      }
+    });
   });
 });

package/src/__tests__/skill-script-runner-sandbox.test.ts

@@ -67,6 +67,19 @@ beforeAll(async () => {
     `export async function run() {
   await new Promise(resolve => setTimeout(resolve, 120_000));
   return { content: 'should not reach', isError: false };
+}`,
+    "utf-8",
+  );
+
+  await writeFile(
+    join(tempDir, "plugin-name-echo.ts"),
+    `export async function run() {
+  return {
+    content: JSON.stringify({
+      pluginName: process.env.VELLUM_PLUGIN_NAME ?? null,
+    }),
+    isError: false,
+  };
 }`,
     "utf-8",
   );
@@ -113,6 +126,25 @@ describe("runSkillToolScript sandbox — success", () => {
     expect(parsed.workingDir).toBe("/my/project");
     expect(parsed.conversationId).toBe("sess-42");
   }, 15_000);
+
+  test("sets VELLUM_PLUGIN_NAME for a plugin-owned skill tool", async () => {
+    const result = await runSkillToolScript(
+      tempDir,
+      "plugin-name-echo.ts",
+      {},
+      makeContext(),
+      {
+        target: "sandbox",
+        pluginOwner: "psk-demo",
+      },
+    );
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content) as {
+      pluginName: string | null;
+    };
+    expect(parsed.pluginName).toBe("psk-demo");
+  }, 15_000);
 });
 
 // ---------------------------------------------------------------------------

package/src/cli/lib/bundled-marketplace.json

@@ -232,7 +232,7 @@
       "source": {
         "source": "github",
         "repo": "vellum-ai/imessage",
-        "ref": "41b8e9ad87b4975bf3fbdc9a8e46deda489d3d51"
+        "ref": "af3d9f79903817358084de74e056422e6ca91fe4"
       },
       "description": "iMessage and SMS channel for the Vellum assistant, backed by a Photon line.",
       "category": "productivity",

package/src/daemon/conversation-skill-tools.ts

@@ -463,6 +463,7 @@ export function projectSkillTools(
       skill.directoryPath,
       currentHash,
       skill.bundled,
+      skill.owner?.kind === "plugin" ? skill.owner.id : undefined,
     );
 
     if (tools.length > 0) {

package/src/plugin-api/__tests__/plugin-name-env.test.ts

@@ -0,0 +1,249 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { runInPluginContext } from "../../plugins/plugin-execution-context.js";
+import {
+  derivePluginNameFromProcess,
+  derivePluginNameFromSkillScriptPath,
+  PLUGIN_NAME_ENV,
+  readPluginNameFromEnv,
+  resolveCallingPluginName,
+} from "../plugin-name-env.js";
+
+const pluginsDir = "/tmp/vellum-workspace/plugins";
+
+describe("readPluginNameFromEnv", () => {
+  test("returns a trimmed install name", () => {
+    expect(readPluginNameFromEnv({ [PLUGIN_NAME_ENV]: "  sms  " })).toBe("sms");
+  });
+
+  test("ignores empty or whitespace-only values", () => {
+    expect(readPluginNameFromEnv({ [PLUGIN_NAME_ENV]: "" })).toBeUndefined();
+    expect(readPluginNameFromEnv({ [PLUGIN_NAME_ENV]: "   " })).toBeUndefined();
+    expect(readPluginNameFromEnv({})).toBeUndefined();
+  });
+});
+
+describe("derivePluginNameFromSkillScriptPath", () => {
+  test("returns the plugin install name for a scripts path", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts"),
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("returns the plugin install name for a tools path", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/sms-setup/tools/list.ts"),
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("accepts a file URL", () => {
+    const filePath = join(
+      pluginsDir,
+      "sms/skills/sms-setup/scripts/twilio-numbers.ts",
+    );
+    expect(
+      derivePluginNameFromSkillScriptPath(`file://${filePath}`, pluginsDir),
+    ).toBe("sms");
+  });
+
+  test("rejects a path outside plugins/", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        "/tmp/other/skills/sms-setup/scripts/twilio-numbers.ts",
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+  });
+
+  test("rejects a plugin file that is not under scripts/ or tools/", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/sms-setup/SKILL.md"),
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/register.ts"),
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+  });
+
+  test("rejects a truncated plugins path", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/scripts/too-short.ts"),
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+  });
+});
+
+describe("derivePluginNameFromProcess", () => {
+  test("scans argv for a plugin-resident skill script", () => {
+    expect(
+      derivePluginNameFromProcess(
+        ["bun", join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts")],
+        "/tmp",
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("resolves a relative argv path against cwd", () => {
+    expect(
+      derivePluginNameFromProcess(
+        ["bun", "sms/skills/sms-setup/scripts/twilio-numbers.ts"],
+        pluginsDir,
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("skips flags", () => {
+    expect(
+      derivePluginNameFromProcess(
+        ["bun", "--hot", join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts")],
+        "/tmp",
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+});
+
+describe("resolveCallingPluginName", () => {
+  const prior = process.env[PLUGIN_NAME_ENV];
+
+  afterEach(() => {
+    if (prior === undefined) {
+      delete process.env[PLUGIN_NAME_ENV];
+    } else {
+      process.env[PLUGIN_NAME_ENV] = prior;
+    }
+  });
+
+  test("prefers AsyncLocalStorage over env", () => {
+    process.env[PLUGIN_NAME_ENV] = "from-env";
+    const name = runInPluginContext("from-als", () =>
+      resolveCallingPluginName(process.env, [], "/tmp"),
+    );
+    expect(name).toBe("from-als");
+  });
+
+  test("uses VELLUM_PLUGIN_NAME when ALS is empty", () => {
+    expect(
+      resolveCallingPluginName({ [PLUGIN_NAME_ENV]: "sms" }, [], "/tmp"),
+    ).toBe("sms");
+  });
+
+  test("falls back to the process entry path", () => {
+    expect(
+      resolveCallingPluginName(
+        {},
+        ["bun", join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts")],
+        "/tmp",
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+});
+
+describe("resolveCallingPluginName real child", () => {
+  test("recovers the plugin name from a scripts path without env", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "plugin-name-child-"));
+    const scriptDir = join(
+      workspace,
+      "plugins/sms/skills/sms-setup/scripts",
+    );
+    mkdirSync(scriptDir, { recursive: true });
+    const helper = join(
+      import.meta.dir,
+      "..",
+      "plugin-name-env.ts",
+    );
+    const scriptPath = join(scriptDir, "echo-plugin-name.ts");
+    writeFileSync(
+      scriptPath,
+      `import { resolveCallingPluginName } from ${JSON.stringify(helper)};
+console.log(JSON.stringify({ name: resolveCallingPluginName() ?? null }));
+`,
+    );
+
+    try {
+      const child = Bun.spawn(
+        ["bun", scriptPath],
+        {
+          cwd: scriptDir,
+          env: {
+            PATH: process.env.PATH,
+            HOME: process.env.HOME,
+            VELLUM_WORKSPACE_DIR: workspace,
+          },
+          stdout: "pipe",
+          stderr: "pipe",
+        },
+      );
+      const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(child.stdout).text(),
+        new Response(child.stderr).text(),
+        child.exited,
+      ]);
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+      expect(JSON.parse(stdout.trim())).toEqual({ name: "sms" });
+    } finally {
+      rmSync(workspace, { recursive: true, force: true });
+    }
+  }, 15_000);
+
+  test("recovers the plugin name from VELLUM_PLUGIN_NAME without a plugin path", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "plugin-name-env-child-"));
+    const scriptDir = join(workspace, "scratch");
+    mkdirSync(scriptDir, { recursive: true });
+    const helper = join(import.meta.dir, "..", "plugin-name-env.ts");
+    const scriptPath = join(scriptDir, "echo-plugin-name.ts");
+    writeFileSync(
+      scriptPath,
+      `import { resolveCallingPluginName } from ${JSON.stringify(helper)};
+console.log(JSON.stringify({ name: resolveCallingPluginName() ?? null }));
+`,
+    );
+
+    try {
+      const child = Bun.spawn(
+        ["bun", scriptPath],
+        {
+          cwd: scriptDir,
+          env: {
+            PATH: process.env.PATH,
+            HOME: process.env.HOME,
+            VELLUM_WORKSPACE_DIR: workspace,
+            VELLUM_PLUGIN_NAME: "sms",
+          },
+          stdout: "pipe",
+          stderr: "pipe",
+        },
+      );
+      const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(child.stdout).text(),
+        new Response(child.stderr).text(),
+        child.exited,
+      ]);
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+      expect(JSON.parse(stdout.trim())).toEqual({ name: "sms" });
+    } finally {
+      rmSync(workspace, { recursive: true, force: true });
+    }
+  }, 15_000);
+});

package/src/plugin-api/index.ts

@@ -169,10 +169,12 @@ export { publishEvent } from "./publish-event.js";
 // `inputModalities.image` override winning when set (mix profiles are
 // vision-capable if any arm is). Returns false when nothing resolves.
 export { doesSupportVision } from "./vision-support.js";
-// Resolve a stored credential to its plaintext value — the same value
-// `assistant credentials reveal` prints — from a UUID or a "service/field"
+// Resolve a stored credential to its plaintext value (the same value
+// `assistant credentials reveal` prints) from a UUID or a "service/field"
 // reference. When a plugin is in context, resolution is scoped to credentials
-// whose service matches the plugin's manifest name; outside any plugin it is
+// whose service matches the plugin's runtime name. A plugin-resident skill
+// script or skill-tool child presents a daemon-issued invocation grant and is
+// scoped the same way. Outside any plugin context or grant the resolver is
 // unscoped. Throws CredentialResolutionError when the ref does not resolve, the
 // store is unreachable, or the credential is out of the plugin's scope.
 export {

package/src/plugin-api/plugin-name-env.ts

@@ -0,0 +1,125 @@
+/**
+ * How a child process learns which plugin it is running as.
+ *
+ * In-process plugin hooks, tools, and routes use AsyncLocalStorage
+ * ({@link getCurrentPluginName}). A bash or skill-sandbox child does not
+ * inherit that store. Those children recover the install-directory basename
+ * from `VELLUM_PLUGIN_NAME` (injected after env sanitization) or from the
+ * entry script path under `plugins/<service>/skills/<skill>/{scripts,tools}/`.
+ */
+
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { getCurrentPluginName } from "../plugins/plugin-execution-context.js";
+import { getWorkspacePluginsDir } from "../util/platform.js";
+
+export const PLUGIN_NAME_ENV = "VELLUM_PLUGIN_NAME";
+
+const SKILL_SCRIPT_ROOTS = new Set(["scripts", "tools"]);
+
+/**
+ * Read a plugin install-directory name from the process environment.
+ * Empty or whitespace-only values are ignored.
+ */
+export function readPluginNameFromEnv(
+  env: NodeJS.ProcessEnv = process.env,
+): string | undefined {
+  const raw = env[PLUGIN_NAME_ENV];
+  if (typeof raw !== "string") {
+    return undefined;
+  }
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+/**
+ * If `filePath` is a skill script or tool under an installed plugin, return
+ * that plugin's install-directory basename (the runtime service name).
+ *
+ * Expected layout:
+ * `plugins/<service>/skills/<skill-id>/scripts|tools/<file>`.
+ */
+export function derivePluginNameFromSkillScriptPath(
+  filePath: string,
+  pluginsDir: string = getWorkspacePluginsDir(),
+): string | undefined {
+  if (filePath.length === 0) {
+    return undefined;
+  }
+  let resolved = filePath;
+  if (filePath.startsWith("file:")) {
+    try {
+      resolved = fileURLToPath(filePath);
+    } catch {
+      return undefined;
+    }
+  }
+  if (!isAbsolute(resolved)) {
+    resolved = resolve(process.cwd(), resolved);
+  }
+  const pluginsRoot = resolve(pluginsDir);
+  const rel = relative(pluginsRoot, resolved);
+  if (rel.length === 0 || rel.startsWith("..") || isAbsolute(rel)) {
+    return undefined;
+  }
+  const parts = rel.split(sep).filter((part) => part.length > 0);
+  if (parts.length < 5) {
+    return undefined;
+  }
+  const [service, skillsSeg, skillId, root] = parts;
+  if (
+    service === undefined ||
+    skillsSeg !== "skills" ||
+    skillId === undefined ||
+    root === undefined ||
+    !SKILL_SCRIPT_ROOTS.has(root)
+  ) {
+    return undefined;
+  }
+  return service;
+}
+
+/**
+ * Scan argv for a plugin-resident skill script path, resolving relative
+ * entries against `cwd`.
+ */
+export function derivePluginNameFromProcess(
+  argv: readonly string[] = process.argv,
+  cwd: string = process.cwd(),
+  pluginsDir: string = getWorkspacePluginsDir(),
+): string | undefined {
+  for (const candidate of argv.slice(1)) {
+    if (typeof candidate !== "string" || candidate.length === 0) {
+      continue;
+    }
+    if (candidate.startsWith("-")) {
+      continue;
+    }
+    const absolute = isAbsolute(candidate)
+      ? candidate
+      : resolve(cwd, candidate);
+    const name = derivePluginNameFromSkillScriptPath(absolute, pluginsDir);
+    if (name !== undefined) {
+      return name;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Plugin identity for credential scoping: in-process AsyncLocalStorage,
+ * then the injected env var, then the process entry script path.
+ */
+export function resolveCallingPluginName(
+  env: NodeJS.ProcessEnv = process.env,
+  argv: readonly string[] = process.argv,
+  cwd: string = process.cwd(),
+  pluginsDir: string = getWorkspacePluginsDir(),
+): string | undefined {
+  return (
+    getCurrentPluginName() ??
+    readPluginNameFromEnv(env) ??
+    derivePluginNameFromProcess(argv, cwd, pluginsDir)
+  );
+}

package/src/plugin-api/resolve-credential.ts

@@ -1,28 +1,42 @@
 /**
  * Plugin-facing credential resolution.
  *
- * {@link resolveCredential} returns a stored credential's plaintext value — the
- * same value `assistant credentials reveal` prints — resolving a reference that
- * is either a credential UUID or a `"service/field"` string, exactly as the
- * reveal path does (see {@link ../tools/credentials/resolve.resolveCredentialRef}
- * and the `credentials/reveal` route).
+ * {@link resolveCredential} returns a stored credential's plaintext value
+ * (the same value `assistant credentials reveal` prints), resolving a
+ * reference that is either a credential UUID or a `"service/field"` string,
+ * exactly as the reveal path does (see
+ * {@link ../tools/credentials/resolve.resolveCredentialRef} and the
+ * `credentials/reveal` route).
  *
  * ## Plugin scoping
  *
- * When a plugin is in context (its hook, tool, or one of its own
- * `/x/plugins/<name>/` routes is executing, tracked by
- * {@link ../plugins/plugin-execution-context.getCurrentPluginName}), resolution
- * is restricted: the plugin may only resolve credentials whose `service`
- * equals its manifest name (`imessage/api_key` for plugin `imessage`). It
- * cannot read another service (`openai/api_key`, `openai/imessage`). Outside
- * any plugin context (host-internal callers, CLI, tests) the resolver is
- * unscoped and behaves like a direct reveal.
+ * When a plugin is in context, resolution is restricted to credentials
+ * whose `service` equals the plugin's runtime install-directory name
+ * (`sms/account_sid` for plugin `sms`). Context is:
+ *
+ * 1. In-process AsyncLocalStorage from `runInPluginContext` (hooks, plugin
+ *    tools, plugin routes).
+ * 2. `VELLUM_PLUGIN_NAME` on a bash or skill-sandbox child.
+ * 3. The process entry path, when it sits under
+ *    `plugins/<service>/skills/<skill>/{scripts,tools}/`.
+ *
+ * Outside any plugin context the resolver is unscoped and behaves like a
+ * direct reveal. A standalone child has an empty in-process metadata
+ * cache; when plugin context is set, a cache miss consults the live
+ * credential catalog so an empty cache is not reported as "not found".
  */
 
-import { getCurrentPluginName } from "../plugins/plugin-execution-context.js";
+import { credentialKey } from "@vellumai/credential-storage";
+
 import { getSecureKeyResultAsync } from "../security/secure-keys.js";
+import {
+  type CredentialMetadata,
+  listCredentialRecordsLive,
+} from "../tools/credentials/metadata-store.js";
+import { parseServiceFieldRef } from "../tools/credentials/ref-parse.js";
 import { resolveCredentialRef } from "../tools/credentials/resolve.js";
 import { credentialInPluginScope } from "./credential-scope.js";
+import { resolveCallingPluginName } from "./plugin-name-env.js";
 
 /**
  * Raised when a credential cannot be resolved: the reference does not match a
@@ -36,6 +50,50 @@ export class CredentialResolutionError extends Error {
   }
 }
 
+interface ResolvedRef {
+  service: string;
+  field: string;
+  storageKey: string;
+}
+
+function findLiveRecord(
+  records: CredentialMetadata[],
+  ref: string,
+): CredentialMetadata | undefined {
+  const byId = records.find((record) => record.credentialId === ref);
+  if (byId) {
+    return byId;
+  }
+  const parsed = parseServiceFieldRef(ref);
+  if (!parsed) {
+    return undefined;
+  }
+  return records.find(
+    (record) =>
+      record.service === parsed.service && record.field === parsed.field,
+  );
+}
+
+async function resolveCredentialRefLive(
+  ref: string,
+): Promise<ResolvedRef | undefined> {
+  const live = await listCredentialRecordsLive();
+  if (live.unreachable) {
+    throw new CredentialResolutionError(
+      "Credential store is unreachable.",
+    );
+  }
+  const record = findLiveRecord(live.records, ref);
+  if (!record) {
+    return undefined;
+  }
+  return {
+    service: record.service,
+    field: record.field,
+    storageKey: credentialKey(record.service, record.field),
+  };
+}
+
 /**
  * Resolve a credential reference to its plaintext value.
  *
@@ -45,15 +103,16 @@ export class CredentialResolutionError extends Error {
  *   store is unreachable, or a plugin in context is not scoped to the credential.
  */
 export async function resolveCredential(ref: string): Promise<string> {
-  const resolved = resolveCredentialRef(ref);
+  const pluginName = resolveCallingPluginName();
+
+  let resolved: ResolvedRef | undefined = resolveCredentialRef(ref);
+  if (!resolved && pluginName !== undefined) {
+    resolved = await resolveCredentialRefLive(ref);
+  }
   if (!resolved) {
     throw new CredentialResolutionError(`Credential not found: ${ref}`);
   }
 
-  // Scope the resolution to the plugin in context, if any. The ownership gate
-  // is enforced before the plaintext is read so an out-of-scope plugin never
-  // touches the secure backend.
-  const pluginName = getCurrentPluginName();
   if (
     pluginName !== undefined &&
     !credentialInPluginScope(pluginName, resolved.service)
@@ -70,7 +129,7 @@ export async function resolveCredential(ref: string): Promise<string> {
   if (value == null || value.length === 0) {
     if (unreachable) {
       throw new CredentialResolutionError(
-        "Credential store is unreachable — ensure the assistant is running",
+        "Credential store is unreachable.",
       );
     }
     throw new CredentialResolutionError(`Credential not found: ${ref}`);

package/src/plugins/__tests__/active-plugin-env.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+
+import type { SkillSummary } from "../../config/skills.js";
+import * as skills from "../../config/skills.js";
+import type { Conversation } from "../../daemon/conversation.js";
+import * as conversationRegistry from "../../daemon/conversation-registry.js";
+import { PLUGIN_NAME_ENV } from "../../plugin-api/plugin-name-env.js";
+import {
+  applyActivePluginName,
+  uniqueActivePluginOwner,
+} from "../active-plugin-env.js";
+
+function pluginSkill(id: string, pluginId: string): SkillSummary {
+  return {
+    id,
+    name: id,
+    displayName: id,
+    description: id,
+    directoryPath: `/tmp/${id}`,
+    skillFilePath: `/tmp/${id}/SKILL.md`,
+    source: "plugin",
+    owner: { kind: "plugin", id: pluginId },
+  };
+}
+
+function bundledSkill(id: string): SkillSummary {
+  return {
+    id,
+    name: id,
+    displayName: id,
+    description: id,
+    directoryPath: `/tmp/${id}`,
+    skillFilePath: `/tmp/${id}/SKILL.md`,
+    source: "bundled",
+  };
+}
+
+function conversationWithSkills(skillIds: string[]): Conversation {
+  return {
+    skillProjectionState: new Map(skillIds.map((id) => [id, "v1:hash"])),
+  } as Conversation;
+}
+
+describe("uniqueActivePluginOwner", () => {
+  let catalogSpy: ReturnType<typeof spyOn>;
+  let conversationSpy: ReturnType<typeof spyOn>;
+
+  afterEach(() => {
+    catalogSpy?.mockRestore();
+    conversationSpy?.mockRestore();
+  });
+
+  function stub(skillIds: string[], catalog: SkillSummary[]): void {
+    conversationSpy = spyOn(
+      conversationRegistry,
+      "findConversationOrSubagent",
+    ).mockReturnValue(conversationWithSkills(skillIds));
+    catalogSpy = spyOn(skills, "loadSkillCatalog").mockReturnValue(catalog);
+  }
+
+  test("returns the owner when exactly one plugin skill is active", () => {
+    stub(["sms-setup", "bash"], [
+      pluginSkill("sms-setup", "sms"),
+      bundledSkill("bash"),
+    ]);
+    expect(uniqueActivePluginOwner("conv-1")).toBe("sms");
+  });
+
+  test("returns undefined when no plugin skill is active", () => {
+    stub(["bash"], [bundledSkill("bash")]);
+    expect(uniqueActivePluginOwner("conv-1")).toBeUndefined();
+  });
+
+  test("returns undefined when two plugin owners are active", () => {
+    stub(
+      ["sms-setup", "linear-inbox"],
+      [
+        pluginSkill("sms-setup", "sms"),
+        pluginSkill("linear-inbox", "linear"),
+      ],
+    );
+    expect(uniqueActivePluginOwner("conv-1")).toBeUndefined();
+  });
+
+  test("treats two skills from the same plugin as a single owner", () => {
+    stub(
+      ["sms-setup", "sms-send"],
+      [pluginSkill("sms-setup", "sms"), pluginSkill("sms-send", "sms")],
+    );
+    expect(uniqueActivePluginOwner("conv-1")).toBe("sms");
+  });
+
+  test("returns undefined without a conversation id", () => {
+    expect(uniqueActivePluginOwner(undefined)).toBeUndefined();
+    expect(uniqueActivePluginOwner("")).toBeUndefined();
+  });
+});
+
+describe("applyActivePluginName", () => {
+  let catalogSpy: ReturnType<typeof spyOn>;
+  let conversationSpy: ReturnType<typeof spyOn>;
+
+  afterEach(() => {
+    catalogSpy?.mockRestore();
+    conversationSpy?.mockRestore();
+  });
+
+  test("sets VELLUM_PLUGIN_NAME when a unique plugin owner is active", () => {
+    conversationSpy = spyOn(
+      conversationRegistry,
+      "findConversationOrSubagent",
+    ).mockReturnValue(conversationWithSkills(["sms-setup"]));
+    catalogSpy = spyOn(skills, "loadSkillCatalog").mockReturnValue([
+      pluginSkill("sms-setup", "sms"),
+    ]);
+
+    const env: NodeJS.ProcessEnv = {};
+    applyActivePluginName(env, "conv-1");
+    expect(env[PLUGIN_NAME_ENV]).toBe("sms");
+  });
+
+  test("leaves the env unchanged when no unique plugin owner is active", () => {
+    conversationSpy = spyOn(
+      conversationRegistry,
+      "findConversationOrSubagent",
+    ).mockReturnValue(conversationWithSkills(["sms-setup", "linear-inbox"]));
+    catalogSpy = spyOn(skills, "loadSkillCatalog").mockReturnValue([
+      pluginSkill("sms-setup", "sms"),
+      pluginSkill("linear-inbox", "linear"),
+    ]);
+
+    const env: NodeJS.ProcessEnv = {};
+    applyActivePluginName(env, "conv-1");
+    expect(env[PLUGIN_NAME_ENV]).toBeUndefined();
+  });
+});

package/src/plugins/active-plugin-env.ts

@@ -0,0 +1,51 @@
+/**
+ * Inject the owning plugin name into a sanitized child environment when
+ * exactly one plugin-resident skill is active in the conversation.
+ *
+ * Identity comes from the skill catalog `owner` (install-directory
+ * basename), not from the child command or package.json `name`.
+ */
+
+import { loadSkillCatalog } from "../config/skills.js";
+import { findConversationOrSubagent } from "../daemon/conversation-registry.js";
+import { PLUGIN_NAME_ENV } from "../plugin-api/plugin-name-env.js";
+
+/**
+ * Unique catalog owner id among plugin-resident skills active in this
+ * conversation, or undefined when none or more than one plugin is active.
+ */
+export function uniqueActivePluginOwner(
+  conversationId: string | undefined,
+): string | undefined {
+  if (conversationId === undefined || conversationId.length === 0) {
+    return undefined;
+  }
+  const conversation = findConversationOrSubagent(conversationId);
+  if (!conversation) {
+    return undefined;
+  }
+  const owners = new Set<string>();
+  const catalog = loadSkillCatalog();
+  for (const skillId of conversation.skillProjectionState.keys()) {
+    const skill = catalog.find((entry) => entry.id === skillId);
+    if (skill?.owner?.kind === "plugin" && skill.owner.id.length > 0) {
+      owners.add(skill.owner.id);
+    }
+  }
+  if (owners.size !== 1) {
+    return undefined;
+  }
+  return [...owners][0];
+}
+
+/** Set `VELLUM_PLUGIN_NAME` on `env` when a single plugin owner is active. */
+export function applyActivePluginName(
+  env: NodeJS.ProcessEnv,
+  conversationId: string | undefined,
+): void {
+  const owner = uniqueActivePluginOwner(conversationId);
+  if (owner === undefined) {
+    return;
+  }
+  env[PLUGIN_NAME_ENV] = owner;
+}

package/src/tools/host-terminal/host-shell.ts

@@ -17,6 +17,7 @@ import { supportsHostProxy } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
+import { applyActivePluginName } from "../../plugins/active-plugin-env.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
@@ -92,8 +93,9 @@ function buildHostBashProxyEnv(conversationId: string): Record<string, string> {
   // Keep nested `assistant` CLI calls in host_bash aligned with the
   // originating conversation so browser IPC can resolve live proxy context.
   env.__CONVERSATION_ID = conversationId;
-  // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+  // Secret binding for reveal-derived chat authority. See reveal-nonce.ts.
   env.__REVEAL_NONCE = conversationRevealNonce(conversationId);
+  applyActivePluginName(env, conversationId);
   return env;
 }
 
@@ -438,6 +440,7 @@ export const hostShellTool = {
     // the active conversation when running through host_bash.
     hostEnv.__CONVERSATION_ID = context.conversationId;
     hostEnv.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
+    applyActivePluginName(hostEnv, context.conversationId);
 
     if (background) {
       // Check the registry limit BEFORE spawning so we never leak an

package/src/tools/skills/sandbox-runner.ts

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
+import { PLUGIN_NAME_ENV } from "../../plugin-api/plugin-name-env.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import {
@@ -74,6 +75,7 @@ export async function runSkillToolScriptSandbox(
     timeoutMs?: number;
     expectedSkillVersionHash?: string;
     skillDirHashResolver?: (skillDir: string) => string;
+    pluginOwner?: string;
   },
 ): Promise<ToolExecutionResult> {
   const scriptPath = resolve(join(skillDir, executorPath));
@@ -117,7 +119,9 @@ export async function runSkillToolScriptSandbox(
       "utf-8",
     );
 
-    return await spawnRunner(runDir, input, context, timeoutMs, executorPath);
+    return await spawnRunner(runDir, input, context, timeoutMs, executorPath, {
+      pluginOwner: options?.pluginOwner,
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return {
@@ -139,6 +143,7 @@ function spawnRunner(
   context: ToolContext,
   timeoutMs: number,
   executorPath: string,
+  pluginContext?: { pluginOwner?: string },
 ): Promise<ToolExecutionResult> {
   return new Promise<ToolExecutionResult>((resolve) => {
     const stdoutChunks: Buffer[] = [];
@@ -156,9 +161,13 @@ function spawnRunner(
       conversationId: context.conversationId,
     });
     env.__CONVERSATION_ID = context.conversationId;
-    // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+    // Secret binding for reveal-derived chat authority. See reveal-nonce.ts.
     env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
 
+    if (pluginContext?.pluginOwner) {
+      env[PLUGIN_NAME_ENV] = pluginContext.pluginOwner;
+    }
+
     const child = spawn(wrapped.command, wrapped.args, {
       cwd: runDir,
       env,

package/src/tools/skills/skill-script-runner.ts

@@ -24,6 +24,12 @@ export interface RunSkillToolScriptOptions {
    *  with `execution_target: host` (in-process); non-bundled skills are forced to
    *  execute in the sandbox. */
   bundled?: boolean;
+  /**
+   * Catalog owner id when this skill is plugin-resident. The sandbox runner
+   * sets VELLUM_PLUGIN_NAME so the child can resolve credentials under
+   * that plugin's service.
+   */
+  pluginOwner?: string;
 }
 
 /**
@@ -42,6 +48,7 @@ export async function runSkillToolScript(
       timeoutMs: options.timeoutMs,
       expectedSkillVersionHash: options.expectedSkillVersionHash,
       skillDirHashResolver: options.skillDirHashResolver,
+      pluginOwner: options.pluginOwner,
     });
   }
 

package/src/tools/skills/skill-tool-factory.ts

@@ -32,6 +32,7 @@ export function createSkillTool(
   skillDir: string,
   versionHash: string,
   bundled?: boolean,
+  pluginOwner?: string,
 ): Tool {
   return {
     name: entry.name,
@@ -96,6 +97,7 @@ export function createSkillTool(
           target: entry.execution_target,
           expectedSkillVersionHash: versionHash,
           bundled,
+          pluginOwner,
         },
       );
     },
@@ -113,8 +115,9 @@ export function createSkillToolsFromManifest(
   skillDir: string,
   versionHash: string,
   bundled?: boolean,
+  pluginOwner?: string,
 ): Tool[] {
   return entries.map((entry) =>
-    createSkillTool(entry, skillDir, versionHash, bundled),
+    createSkillTool(entry, skillDir, versionHash, bundled, pluginOwner),
   );
 }

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -50,6 +50,17 @@ describe("safe-env Qdrant forwarding", () => {
   });
 });
 
+describe("safe-env plugin name stripping", () => {
+  test("does not forward a parent-supplied VELLUM_PLUGIN_NAME", () => {
+    expect(SAFE_ENV_VARS).not.toContain("VELLUM_PLUGIN_NAME");
+
+    const env = buildSanitizedEnv("linux", {
+      VELLUM_PLUGIN_NAME: "forged-plugin",
+    });
+    expect(env.VELLUM_PLUGIN_NAME).toBeUndefined();
+  });
+});
+
 describe("safe-env CES child forwarding", () => {
   test("forwards CES IPC discovery env and CES HTTP credentials", () => {
     expect(SAFE_ENV_VARS).toContain("CES_BOOTSTRAP_SOCKET_DIR");

package/src/tools/terminal/safe-env.ts

@@ -86,6 +86,10 @@ export const SAFE_ENV_VARS = [
   "VELLUM_MINIKUBE_STORAGE_SIZE",
   "VELLUM_BACKUP_DIR",
   "VELLUM_BACKUP_KEY_PATH",
+  // VELLUM_PLUGIN_NAME is intentionally absent. The daemon injects the
+  // owning plugin install name after sanitizing the child environment.
+  // Inheriting a parent-supplied value would let an arbitrary process
+  // claim another plugin's credential scope.
 ] as const;
 
 export const WINDOWS_SAFE_ENV_VARS = [

package/src/tools/terminal/shell.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 import type { BackgroundToolCompletedEvent } from "../../api/events/background-tool-completed.js";
 import { getConfig } from "../../config/loader.js";
 import { RiskLevel } from "../../permissions/types.js";
+import { applyActivePluginName } from "../../plugins/active-plugin-env.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
@@ -290,6 +291,7 @@ export const shellTool = {
 
     const env = buildSanitizedEnv();
     env.__CONVERSATION_ID = context.conversationId;
+    applyActivePluginName(env, context.conversationId);
     // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
     env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
     // Surface the resolving model to assistant CLI commands so they can tailor