@vellumai/assistant 0.12.2-dev.202609171225.565e464 → 0.12.2-dev.202609171516.2acdfd4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.2-dev.202609171225.565e464",
+  "version": "0.12.2-dev.202609171516.2acdfd4",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/config-watcher.test.ts

@@ -315,6 +315,30 @@ describe("ConfigWatcher workspace file handlers", () => {
     expect(evictCallCount).toBe(1);
   });
 
+  test("config.json change reloads MCP when tools.mcpGlobalMaxTools changes", async () => {
+    watcher.initFingerprint({
+      tools: { exclude: [], mcpGlobalMaxTools: 50 },
+    } as never);
+    watcher.refreshConfigFromSources = async () => true;
+    watcher.start();
+    simulateFileChange(WORKSPACE_DIR, "config.json");
+    await new Promise((r) => setTimeout(r, WAIT_MS));
+    expect(mcpReloadCallCount).toBe(1);
+    expect(evictCallCount).toBe(1);
+  });
+
+  test("config.json change does not reload MCP when the global max is unchanged", async () => {
+    watcher.initFingerprint({
+      tools: { exclude: [] },
+    } as never);
+    watcher.refreshConfigFromSources = async () => true;
+    watcher.start();
+    simulateFileChange(WORKSPACE_DIR, "config.json");
+    await new Promise((r) => setTimeout(r, WAIT_MS));
+    expect(mcpReloadCallCount).toBe(0);
+    expect(evictCallCount).toBe(1);
+  });
+
   test("config.json change is suppressed when suppressConfigReload is true", async () => {
     let refreshCalled = false;
     watcher.refreshConfigFromSources = async () => {

package/src/__tests__/credential-execution-client.test.ts

@@ -31,8 +31,8 @@ import {
   createCesClient,
 } from "../credential-execution/client.js";
 import {
+  discoverCes,
   discoverCesWithRetry,
-  discoverManagedCes,
 } from "../credential-execution/executable-discovery.js";
 
 // ---------------------------------------------------------------------------
@@ -100,7 +100,7 @@ describe("managed CES discovery", () => {
     const bootstrapDir = mkdtempSync(join(tmpdir(), "ces-missing-"));
     const restore = withBootstrapDir(bootstrapDir);
     try {
-      const result = discoverManagedCes();
+      const result = discoverCes();
       expect(result.mode).toBe("unavailable");
       expect((result as { reason: string }).reason).toContain(
         "CES bootstrap socket not found",
@@ -115,7 +115,7 @@ describe("managed CES discovery", () => {
     const bootstrapDir = mkdtempSync(join(tmpdir(), "ces-missing-"));
     const restore = withBootstrapDir(bootstrapDir);
     try {
-      const result = discoverManagedCes();
+      const result = discoverCes();
       expect(["managed", "unavailable"]).toContain(result.mode);
     } finally {
       restore();
@@ -132,7 +132,7 @@ describe("CES bootstrap socket discovery", () => {
       const socketPath = resolveIpcEndpoint("ces", {
         workspaceDir: bootstrapDir,
       }).path;
-      const result = discoverManagedCes();
+      const result = discoverCes();
       expect(result.mode).toBe("unavailable");
       expect((result as { reason: string }).reason).toContain(socketPath);
     } finally {
@@ -145,7 +145,7 @@ describe("CES bootstrap socket discovery", () => {
     const bootstrapDir = mkdtempSync(join(tmpdir(), "ces-bootstrap-"));
     const restore = withBootstrapDir(bootstrapDir);
     try {
-      const result = discoverManagedCes();
+      const result = discoverCes();
       const workspaceDir = process.env.VELLUM_WORKSPACE_DIR;
       expect(workspaceDir).toBeDefined();
       const workspaceSocket = resolveIpcEndpoint("ces", {

package/src/__tests__/plugin-api-resolve-credential.test.ts

@@ -14,6 +14,7 @@ import {
 
 import { credentialKey } from "@vellumai/credential-storage";
 
+import { PLUGIN_NAME_ENV } from "../plugin-api/plugin-name-env.js";
 import {
   CredentialResolutionError,
   resolveCredential,
@@ -22,8 +23,10 @@ import { runInPluginContext } from "../plugins/plugin-execution-context.js";
 import * as secureKeys from "../security/secure-keys.js";
 import {
   _setMetadataPath,
+  type CredentialMetadata,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
+import * as metadataStore from "../tools/credentials/metadata-store.js";
 
 // Real metadata store backed by a temp file (no module mocking — a mock.module
 // on metadata-store / secure-keys would replace the whole module namespace and
@@ -65,6 +68,7 @@ beforeEach(() => {
 
 afterEach(() => {
   getSpy.mockRestore();
+  delete process.env[PLUGIN_NAME_ENV];
 });
 
 afterAll(() => {
@@ -145,5 +149,98 @@ describe("resolveCredential", () => {
         ),
       ).resolves.toBe("proj-id");
     });
+
+    test("scopes resolution from VELLUM_PLUGIN_NAME when ALS is empty", async () => {
+      seedCredential("sms", "account_sid", "sid-secret");
+      process.env[PLUGIN_NAME_ENV] = "sms";
+      await expect(resolveCredential("sms/account_sid")).resolves.toBe(
+        "sid-secret",
+      );
+    });
+
+    test("blocks another service when identity comes from VELLUM_PLUGIN_NAME", async () => {
+      seedCredential("openai", "api_key", "sk-secret");
+      process.env[PLUGIN_NAME_ENV] = "sms";
+      await expect(resolveCredential("openai/api_key")).rejects.toThrow(
+        /out of scope/,
+      );
+    });
+  });
+
+  describe("live catalog on cache miss", () => {
+    function liveRecord(
+      service: string,
+      field: string,
+    ): CredentialMetadata {
+      return {
+        credentialId: `${service}-${field}`,
+        service,
+        field,
+        allowedTools: [],
+        allowedDomains: [],
+        createdAt: 1,
+        updatedAt: 1,
+      };
+    }
+
+    test("consults the live catalog when plugin context is set and the cache misses", async () => {
+      const liveSpy = spyOn(
+        metadataStore,
+        "listCredentialRecordsLive",
+      ).mockResolvedValue({
+        records: [liveRecord("sms", "account_sid")],
+        unreachable: false,
+      });
+      secureStore.set(credentialKey("sms", "account_sid"), "live-sid");
+      process.env[PLUGIN_NAME_ENV] = "sms";
+
+      try {
+        await expect(resolveCredential("sms/account_sid")).resolves.toBe(
+          "live-sid",
+        );
+        expect(liveSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        liveSpy.mockRestore();
+      }
+    });
+
+    test("does not list live records when no plugin is in context", async () => {
+      const liveSpy = spyOn(
+        metadataStore,
+        "listCredentialRecordsLive",
+      ).mockResolvedValue({
+        records: [liveRecord("sms", "account_sid")],
+        unreachable: false,
+      });
+      secureStore.set(credentialKey("sms", "account_sid"), "live-sid");
+
+      try {
+        await expect(resolveCredential("sms/account_sid")).rejects.toThrow(
+          /Credential not found/,
+        );
+        expect(liveSpy).not.toHaveBeenCalled();
+      } finally {
+        liveSpy.mockRestore();
+      }
+    });
+
+    test("reports an unreachable live catalog instead of not found", async () => {
+      const liveSpy = spyOn(
+        metadataStore,
+        "listCredentialRecordsLive",
+      ).mockResolvedValue({
+        records: [],
+        unreachable: true,
+      });
+      process.env[PLUGIN_NAME_ENV] = "sms";
+
+      try {
+        await expect(resolveCredential("sms/account_sid")).rejects.toThrow(
+          /unreachable/,
+        );
+      } finally {
+        liveSpy.mockRestore();
+      }
+    });
   });
 });

package/src/__tests__/skill-script-runner-sandbox.test.ts

@@ -67,6 +67,19 @@ beforeAll(async () => {
     `export async function run() {
   await new Promise(resolve => setTimeout(resolve, 120_000));
   return { content: 'should not reach', isError: false };
+}`,
+    "utf-8",
+  );
+
+  await writeFile(
+    join(tempDir, "plugin-name-echo.ts"),
+    `export async function run() {
+  return {
+    content: JSON.stringify({
+      pluginName: process.env.VELLUM_PLUGIN_NAME ?? null,
+    }),
+    isError: false,
+  };
 }`,
     "utf-8",
   );
@@ -113,6 +126,25 @@ describe("runSkillToolScript sandbox — success", () => {
     expect(parsed.workingDir).toBe("/my/project");
     expect(parsed.conversationId).toBe("sess-42");
   }, 15_000);
+
+  test("sets VELLUM_PLUGIN_NAME for a plugin-owned skill tool", async () => {
+    const result = await runSkillToolScript(
+      tempDir,
+      "plugin-name-echo.ts",
+      {},
+      makeContext(),
+      {
+        target: "sandbox",
+        pluginOwner: "psk-demo",
+      },
+    );
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content) as {
+      pluginName: string | null;
+    };
+    expect(parsed.pluginName).toBe("psk-demo");
+  }, 15_000);
 });
 
 // ---------------------------------------------------------------------------

package/src/config/schemas/__tests__/tools.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+
+import { MCP_GLOBAL_MAX_TOOLS } from "../mcp.js";
+import { ToolsConfigSchema } from "../tools.js";
+
+describe("ToolsConfigSchema.mcpGlobalMaxTools", () => {
+  test("omits the override so the shipped MCP cap remains in force", () => {
+    const parsed = ToolsConfigSchema.parse({});
+    expect(parsed.mcpGlobalMaxTools).toBeUndefined();
+    expect(parsed.exclude).toEqual([]);
+  });
+
+  test("accepts a workspace override", () => {
+    expect(
+      ToolsConfigSchema.parse({ mcpGlobalMaxTools: 80 }).mcpGlobalMaxTools,
+    ).toBe(80);
+    expect(
+      ToolsConfigSchema.parse({
+        mcpGlobalMaxTools: MCP_GLOBAL_MAX_TOOLS,
+      }).mcpGlobalMaxTools,
+    ).toBe(MCP_GLOBAL_MAX_TOOLS);
+    expect(
+      ToolsConfigSchema.parse({ mcpGlobalMaxTools: 1000 }).mcpGlobalMaxTools,
+    ).toBe(1000);
+  });
+
+  test("rejects zero and fractions", () => {
+    expect(() => ToolsConfigSchema.parse({ mcpGlobalMaxTools: 0 })).toThrow();
+    expect(() => ToolsConfigSchema.parse({ mcpGlobalMaxTools: 1.5 })).toThrow();
+  });
+});

package/src/config/schemas/mcp.ts

@@ -18,7 +18,8 @@ export const PLUGIN_MCP_RISK_LEVEL = "low" as const;
 export const MCP_MAX_TOOLS_PER_SERVER = 20;
 
 /**
- * Cap on tools registered across every MCP server. Selection is a
+ * Cap on tools registered across every MCP server when the workspace
+ * does not set `tools.mcpGlobalMaxTools` in config.json. Selection is a
  * deterministic round-robin by server id (see `mcp/tool-caps.ts`), so a
  * later server is not emptied just because earlier ones filled the budget.
  */

package/src/config/schemas/tools.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 
+import { MCP_GLOBAL_MAX_TOOLS } from "./mcp.js";
+
 export const ToolsConfigSchema = z
   .object({
     exclude: z
@@ -8,6 +10,14 @@ export const ToolsConfigSchema = z
       .describe(
         "Tool names to suppress. Excluded tools are not sent to the LLM. Names match `ToolDefinition.name` exactly (e.g. `bash`, `mcp__server__tool`).",
       ),
+    mcpGlobalMaxTools: z
+      .number({ error: "tools.mcpGlobalMaxTools must be a number" })
+      .int("tools.mcpGlobalMaxTools must be an integer")
+      .min(1, "tools.mcpGlobalMaxTools must be >= 1")
+      .optional()
+      .describe(
+        `Override the code-owned cap on MCP tools registered across every server. Omit to use the shipped default of ${MCP_GLOBAL_MAX_TOOLS}. Selection is a fair round-robin by server id.`,
+      ),
   })
   .describe("Tool visibility configuration");
 

package/src/config/skills.ts

@@ -225,10 +225,6 @@ export interface SkillToolManifestMeta {
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
-function getSkillsDir(): string {
-  return getWorkspaceSkillsDir();
-}
-
 export function getBundledSkillsDir(): string {
   const dir = import.meta.dir;
 
@@ -1114,7 +1110,7 @@ export function loadSkillCatalog(
   }
 
   // Load managed (user) skills, which take precedence over bundled skills with the same ID
-  const skillsDir = getSkillsDir();
+  const skillsDir = getWorkspaceSkillsDir();
   const directories = discoverSkillDirectories(skillsDir);
 
   for (const directory of directories) {
@@ -1354,7 +1350,7 @@ function loadSkillDefinition(skill: SkillSummary): SkillLookupResult {
   } else {
     loaded = readSkillFromDirectory(
       skill.directoryPath,
-      getSkillsDir(),
+      getWorkspaceSkillsDir(),
       skill.source,
     );
   }

package/src/credential-execution/executable-discovery.ts

@@ -53,9 +53,7 @@ export type DiscoveryResult = ManagedDiscoverySuccess | DiscoveryFailure;
  * processes can each connect. The actual connection is made later by
  * `CesProcessManager.start()`.
  */
-export function discoverManagedCes():
-  | ManagedDiscoverySuccess
-  | DiscoveryFailure {
+export function discoverCes(): DiscoveryResult {
   const socketPath = getCesSocketPath();
 
   if (!isNamedPipePath(socketPath) && !existsSync(socketPath)) {
@@ -68,14 +66,6 @@ export function discoverManagedCes():
   return { mode: "managed", socketPath };
 }
 
-/**
- * Discover CES for the current process. Local and managed topologies use
- * the same bootstrap socket path.
- */
-export function discoverCes(): DiscoveryResult {
-  return discoverManagedCes();
-}
-
 /** How long to poll for the CES socket before giving up. */
 const MANAGED_DISCOVERY_TIMEOUT_MS = 3_000;
 

package/src/daemon/config-watcher.ts

@@ -190,12 +190,22 @@ export class ConfigWatcher {
         if (this.suppressReload) {
           return;
         }
+        const prevMcpGlobalMax = this.lastConfig?.tools.mcpGlobalMaxTools;
         try {
           const changed = await this.refreshConfigFromSources();
           if (changed) {
             evictConversationsForReload();
             refreshAuthenticatedApiRateLimit();
             publishConfigChanged();
+            const nextMcpGlobalMax = getConfig().tools.mcpGlobalMaxTools;
+            if (prevMcpGlobalMax !== nextMcpGlobalMax) {
+              reloadMcpServers().catch((err: unknown) => {
+                log.error(
+                  { err },
+                  "MCP reload after tools.mcpGlobalMaxTools change failed",
+                );
+              });
+            }
           }
         } catch (err) {
           log.error(

package/src/daemon/conversation-skill-tools.ts

@@ -463,6 +463,7 @@ export function projectSkillTools(
       skill.directoryPath,
       currentHash,
       skill.bundled,
+      skill.owner?.kind === "plugin" ? skill.owner.id : undefined,
     );
 
     if (tools.length > 0) {

package/src/mcp/__tests__/manager-tool-caps.test.ts

@@ -11,6 +11,13 @@ import type { ResolvedMcpConfig } from "../../config/schemas/mcp.js";
 
 const toolsByServer = new Map<string, Array<{ name: string }>>();
 const connectDelays = new Map<string, number>();
+let mcpGlobalMaxTools: number | undefined;
+
+mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({
+    tools: { exclude: [], mcpGlobalMaxTools },
+  }),
+}));
 
 mock.module("../client.js", () => ({
   McpClient: class {
@@ -60,6 +67,7 @@ describe("McpServerManager tool selection", () => {
   beforeEach(() => {
     toolsByServer.clear();
     connectDelays.clear();
+    mcpGlobalMaxTools = undefined;
   });
 
   test("later servers keep tools when eight servers exceed the global cap", async () => {
@@ -108,4 +116,29 @@ describe("McpServerManager tool selection", () => {
     ).toBe(true);
     await manager.stop();
   });
+
+  test("a workspace global-max override raises how many tools are kept", async () => {
+    const ids = Array.from(
+      { length: 8 },
+      (_, i) => `server-${String(i + 1).padStart(2, "0")}`,
+    );
+    for (const id of ids) {
+      toolsByServer.set(
+        id,
+        Array.from({ length: 10 }, (_, i) => ({ name: `tool_${i}` })),
+      );
+    }
+
+    mcpGlobalMaxTools = 80;
+    const manager = new McpServerManager();
+    const started = await manager.start(configWith(ids));
+
+    expect(started.discoveredToolCount).toBe(80);
+    expect(started.keptToolCount).toBe(80);
+    expect(started.droppedToolCount).toBe(0);
+    expect(started.servers.every((server) => server.tools.length === 10)).toBe(
+      true,
+    );
+    await manager.stop();
+  });
 });

package/src/mcp/__tests__/tool-caps.test.ts

@@ -10,7 +10,7 @@ import {
   MCP_GLOBAL_MAX_TOOLS,
   MCP_MAX_TOOLS_PER_SERVER,
 } from "../../config/schemas/mcp.js";
-import { applyMcpToolCaps } from "../tool-caps.js";
+import { applyMcpToolCaps, resolveMcpGlobalMaxTools } from "../tool-caps.js";
 
 function toolsNamed(prefix: string, count: number): string[] {
   return Array.from({ length: count }, (_, i) => `${prefix}-tool-${i}`);
@@ -104,4 +104,31 @@ describe("applyMcpToolCaps", () => {
       4,
     );
   });
+
+  test("honors a workspace global-max override", () => {
+    const servers = Array.from({ length: 8 }, (_, i) => ({
+      serverId: `server-${String(i + 1).padStart(2, "0")}`,
+      tools: toolsNamed(`s${i + 1}`, 10),
+    }));
+
+    const result = applyMcpToolCaps(servers, { globalMax: 80, perServerMax: 20 });
+
+    expect(result.keptToolCount).toBe(80);
+    expect(result.droppedToolCount).toBe(0);
+    expect(result.servers.every((server) => server.tools.length === 10)).toBe(
+      true,
+    );
+  });
+});
+
+describe("resolveMcpGlobalMaxTools", () => {
+  test("uses the shipped default when the workspace omits the override", () => {
+    expect(resolveMcpGlobalMaxTools()).toBe(MCP_GLOBAL_MAX_TOOLS);
+    expect(resolveMcpGlobalMaxTools({})).toBe(MCP_GLOBAL_MAX_TOOLS);
+  });
+
+  test("uses tools.mcpGlobalMaxTools from config.json when set", () => {
+    expect(resolveMcpGlobalMaxTools({ mcpGlobalMaxTools: 80 })).toBe(80);
+    expect(resolveMcpGlobalMaxTools({ mcpGlobalMaxTools: 1 })).toBe(1);
+  });
 });

package/src/mcp/manager.ts

@@ -1,3 +1,4 @@
+import { getConfig } from "../config/loader.js";
 import type {
   ResolvedMcpConfig,
   ResolvedMcpServerConfig,
@@ -6,6 +7,7 @@ import { getLogger } from "../util/logger.js";
 import { McpClient, type McpToolInfo } from "./client.js";
 import {
   applyMcpToolCaps,
+  resolveMcpGlobalMaxTools,
   truncatedServerIdsFromCaps,
 } from "./tool-caps.js";
 
@@ -78,6 +80,7 @@ export class McpServerManager {
         serverId: result.serverId,
         tools: result.tools,
       })),
+      { globalMax: resolveMcpGlobalMaxTools(getConfig().tools) },
     );
     const keptByServer = new Map(
       capped.servers.map((server) => [server.serverId, server.tools]),

package/src/mcp/tool-caps.ts

@@ -1,10 +1,11 @@
 /**
  * Code-owned MCP tool-count caps and the selection used when they bind.
  *
- * Caps live here, not in workspace config: migration 153 strips
- * `maxTools` / `globalMaxTools` from `config.json`. The numbers are a
- * context-window budget, not a permission gate. Allowlists and risk
- * still decide what a turn may call.
+ * The shipped global cap is {@link MCP_GLOBAL_MAX_TOOLS}. A workspace may
+ * raise or lower it with `tools.mcpGlobalMaxTools` in config.json. The
+ * per-server cap stays code-owned. These numbers are a context-window
+ * budget, not a permission gate. Allowlists and risk still decide what
+ * a turn may call.
  *
  * The global cap is applied by a deterministic round-robin across
  * servers sorted by id. Insertion order must not empty a later server
@@ -15,6 +16,7 @@ import {
   MCP_GLOBAL_MAX_TOOLS,
   MCP_MAX_TOOLS_PER_SERVER,
 } from "../config/schemas/mcp.js";
+import type { ToolsConfig } from "../config/schemas/tools.js";
 
 export interface McpServerToolSet<T> {
   serverId: string;
@@ -39,6 +41,12 @@ export interface McpToolCapResult<T> {
   decisions: McpToolCapDecision[];
 }
 
+export function resolveMcpGlobalMaxTools(
+  tools?: Pick<ToolsConfig, "mcpGlobalMaxTools">,
+): number {
+  return tools?.mcpGlobalMaxTools ?? MCP_GLOBAL_MAX_TOOLS;
+}
+
 export function applyMcpToolCaps<T>(
   servers: ReadonlyArray<McpServerToolSet<T>>,
   options?: { globalMax?: number; perServerMax?: number },

package/src/monitoring/__tests__/control.test.ts

@@ -167,19 +167,26 @@ describe("spawnMonitoringWorkerProcess", () => {
     }
   });
 
-  test("reuses an already-running monitor without spawning", async () => {
+  test("spawns when the PID file names an unrelated live process", async () => {
     writeFileSync(pidPath, String(process.pid));
     let spawned = false;
     const restore = stubBunSpawn(() => {
       spawned = true;
-      return { unref: () => {}, kill: () => {}, pid: 1, exited: neverExits() };
+      writeFileSync(pidPath, "4242");
+      return {
+        unref: () => {},
+        kill: () => {},
+        pid: 4242,
+        exited: neverExits(),
+      };
     });
     try {
       const result = await spawnMonitoringWorkerProcess({
-        pidWaitTimeoutMs: 100,
+        pidWaitTimeoutMs: 1_000,
+        pidPollIntervalMs: 10,
       });
-      expect(result).toEqual({ pid: process.pid, alreadyRunning: true });
-      expect(spawned).toBe(false);
+      expect(result).toEqual({ pid: 4242, alreadyRunning: false });
+      expect(spawned).toBe(true);
     } finally {
       restore();
     }
@@ -201,6 +208,11 @@ describe("probeMonitoringWorker", () => {
     }
   });
 
+  test("reports not_running when the PID file names a live process that is not this worker", () => {
+    writeFileSync(pidPath, String(process.pid));
+    expect(probeMonitoringWorker()).toEqual({ status: "not_running" });
+  });
+
   test("reports running (not throws) when the process exists but is not signalable (EPERM)", () => {
     writeFileSync(pidPath, "4321");
     const restore = stubProcessKill(new Set(), new Set([4321]));

package/src/monitoring/control.ts

@@ -19,15 +19,21 @@ import {
   type WorkerProcessStatus,
 } from "../util/worker-process.js";
 
+const MONITORING_WORKER_ENTRY = new URL("./worker.ts", import.meta.url);
+
 const log = getLogger("monitoring-control");
 
 /**
  * Read the PID file and report liveness. A missing or malformed file reports
- * not_running; a file pointing at a dead process is cleaned up and reported as
- * not_running.
+ * not_running; a file pointing at a dead process, or at a live process that
+ * is not this worker, is cleaned up and reported as not_running.
  */
 export function probeMonitoringWorker(): WorkerProcessStatus {
-  return probeWorkerPidFile(getMonitoringPidPath());
+  return probeWorkerPidFile(
+    getMonitoringPidPath(),
+    MONITORING_WORKER_ENTRY,
+    "monitoring",
+  );
 }
 
 export class MonitoringWorkerSpawnError extends WorkerProcessSpawnError {}
@@ -44,7 +50,7 @@ export async function spawnMonitoringWorkerProcess(
   try {
     return await spawnWorkerProcess({
       pidPath: getMonitoringPidPath(),
-      entry: new URL("./worker.ts", import.meta.url),
+      entry: MONITORING_WORKER_ENTRY,
       packagedEntry: "monitoring",
       workerLabel: "Resource monitor",
       options: opts,
@@ -63,7 +69,11 @@ export async function spawnMonitoringWorkerProcess(
  * (e.g. EPERM) — a not-running monitor is a no-op.
  */
 export function stopMonitoringWorkerProcess(): WorkerProcessStatus {
-  return stopWorkerProcess(getMonitoringPidPath());
+  return stopWorkerProcess(
+    getMonitoringPidPath(),
+    MONITORING_WORKER_ENTRY,
+    "monitoring",
+  );
 }
 
 /**