@vellumai/assistant 0.12.2-dev.202609171225.565e464 → 0.12.2-dev.202609171516.2acdfd4

package/src/plugins/active-plugin-env.ts

@@ -0,0 +1,51 @@
+/**
+ * Inject the owning plugin name into a sanitized child environment when
+ * exactly one plugin-resident skill is active in the conversation.
+ *
+ * Identity comes from the skill catalog `owner` (install-directory
+ * basename), not from the child command or package.json `name`.
+ */
+
+import { loadSkillCatalog } from "../config/skills.js";
+import { findConversationOrSubagent } from "../daemon/conversation-registry.js";
+import { PLUGIN_NAME_ENV } from "../plugin-api/plugin-name-env.js";
+
+/**
+ * Unique catalog owner id among plugin-resident skills active in this
+ * conversation, or undefined when none or more than one plugin is active.
+ */
+export function uniqueActivePluginOwner(
+  conversationId: string | undefined,
+): string | undefined {
+  if (conversationId === undefined || conversationId.length === 0) {
+    return undefined;
+  }
+  const conversation = findConversationOrSubagent(conversationId);
+  if (!conversation) {
+    return undefined;
+  }
+  const owners = new Set<string>();
+  const catalog = loadSkillCatalog();
+  for (const skillId of conversation.skillProjectionState.keys()) {
+    const skill = catalog.find((entry) => entry.id === skillId);
+    if (skill?.owner?.kind === "plugin" && skill.owner.id.length > 0) {
+      owners.add(skill.owner.id);
+    }
+  }
+  if (owners.size !== 1) {
+    return undefined;
+  }
+  return [...owners][0];
+}
+
+/** Set `VELLUM_PLUGIN_NAME` on `env` when a single plugin owner is active. */
+export function applyActivePluginName(
+  env: NodeJS.ProcessEnv,
+  conversationId: string | undefined,
+): void {
+  const owner = uniqueActivePluginOwner(conversationId);
+  if (owner === undefined) {
+    return;
+  }
+  env[PLUGIN_NAME_ENV] = owner;
+}

package/src/plugins/defaults/memory/__tests__/worker-control.test.ts

@@ -231,18 +231,26 @@ describe("spawnMemoryWorkerProcess", () => {
     }
   });
 
-  test("reuses an already-running worker without spawning", async () => {
-    // A live PID file (this test process) makes the probe report running.
+  test("spawns when the PID file names an unrelated live process", async () => {
     writeFileSync(pidPath, String(process.pid));
     let spawned = false;
     const restore = stubBunSpawn(() => {
       spawned = true;
-      return { unref: () => {}, kill: () => {}, pid: 1, exited: neverExits() };
+      writeFileSync(pidPath, "4242");
+      return {
+        unref: () => {},
+        kill: () => {},
+        pid: 4242,
+        exited: neverExits(),
+      };
     });
     try {
-      const result = await spawnMemoryWorkerProcess({ pidWaitTimeoutMs: 100 });
-      expect(result).toEqual({ pid: process.pid, alreadyRunning: true });
-      expect(spawned).toBe(false);
+      const result = await spawnMemoryWorkerProcess({
+        pidWaitTimeoutMs: 1_000,
+        pidPollIntervalMs: 10,
+      });
+      expect(result).toEqual({ pid: 4242, alreadyRunning: false });
+      expect(spawned).toBe(true);
     } finally {
       restore();
     }
@@ -250,6 +258,11 @@ describe("spawnMemoryWorkerProcess", () => {
 });
 
 describe("probeMemoryWorker", () => {
+  test("reports not_running when the PID file names a live process that is not this worker", () => {
+    writeFileSync(pidPath, String(process.pid));
+    expect(probeMemoryWorker()).toEqual({ status: "not_running" });
+  });
+
   test("reports running (not throws) when the process exists but is not signalable (EPERM)", () => {
     writeFileSync(pidPath, "4321");
     const restore = stubProcessKill(new Set(), new Set([4321]));

package/src/plugins/defaults/memory/worker-control.ts

@@ -18,13 +18,19 @@ import {
   type WorkerProcessStatus,
 } from "../../../util/worker-process.js";
 
+const MEMORY_WORKER_ENTRY = new URL("./worker.ts", import.meta.url);
+
 /**
  * Inspect the PID file to determine whether the worker process is alive.
- * A stale PID file (pointing at a dead process) is cleaned up and reported
- * as not_running.
+ * A stale PID file (pointing at a dead process, or at a live process that
+ * is not this worker) is cleaned up and reported as not_running.
  */
 export function probeMemoryWorker(): WorkerProcessStatus {
-  return probeWorkerPidFile(getMemoryWorkerPidPath());
+  return probeWorkerPidFile(
+    getMemoryWorkerPidPath(),
+    MEMORY_WORKER_ENTRY,
+    "memory",
+  );
 }
 
 export class MemoryWorkerSpawnError extends WorkerProcessSpawnError {}
@@ -50,7 +56,7 @@ export async function spawnMemoryWorkerProcess(
   try {
     return await spawnWorkerProcess({
       pidPath: getMemoryWorkerPidPath(),
-      entry: new URL("./worker.ts", import.meta.url),
+      entry: MEMORY_WORKER_ENTRY,
       packagedEntry: "memory",
       workerLabel: "Memory worker",
       options: opts,
@@ -71,5 +77,9 @@ export async function spawnMemoryWorkerProcess(
  * (e.g. EPERM) — a not-running worker is a no-op.
  */
 export function stopMemoryWorkerProcess(): WorkerProcessStatus {
-  return stopWorkerProcess(getMemoryWorkerPidPath());
+  return stopWorkerProcess(
+    getMemoryWorkerPidPath(),
+    MEMORY_WORKER_ENTRY,
+    "memory",
+  );
 }

package/src/routes/control.ts

@@ -44,13 +44,15 @@ function routeHostPidPath(): string {
   return getProcPidPath(ROUTE_HOST_PROC_NAME);
 }
 
+const ROUTE_HOST_ENTRY = new URL("./worker.ts", import.meta.url);
+
 /**
  * Read the PID file and report liveness. A missing or malformed file reports
- * not_running; a file pointing at a dead process is cleaned up and reported as
- * not_running.
+ * not_running; a file pointing at a dead process, or at a live process that
+ * is not this worker, is cleaned up and reported as not_running.
  */
 export function probeRouteHostWorker(): WorkerProcessStatus {
-  return probeWorkerPidFile(routeHostPidPath());
+  return probeWorkerPidFile(routeHostPidPath(), ROUTE_HOST_ENTRY, "routes");
 }
 
 export class RouteHostSpawnError extends WorkerProcessSpawnError {}
@@ -67,7 +69,7 @@ export async function spawnRouteHostWorkerProcess(
   try {
     return await spawnWorkerProcess({
       pidPath: routeHostPidPath(),
-      entry: new URL("./worker.ts", import.meta.url),
+      entry: ROUTE_HOST_ENTRY,
       packagedEntry: "routes",
       workerLabel: "Route host",
       options: opts,
@@ -86,7 +88,7 @@ export async function spawnRouteHostWorkerProcess(
  * (e.g. EPERM) — a not-running host is a no-op.
  */
 export function stopRouteHostWorkerProcess(): WorkerProcessStatus {
-  return stopWorkerProcess(routeHostPidPath());
+  return stopWorkerProcess(routeHostPidPath(), ROUTE_HOST_ENTRY, "routes");
 }
 
 /**

package/src/schedule/__tests__/worker-control.test.ts

@@ -206,19 +206,26 @@ describe("spawnScheduleWorkerProcess", () => {
     }
   });
 
-  test("reuses an already-running worker without spawning", async () => {
+  test("spawns when the PID file names an unrelated live process", async () => {
     writeFileSync(pidPath, String(process.pid));
     let spawned = false;
     const restore = stubBunSpawn(() => {
       spawned = true;
-      return { unref: () => {}, kill: () => {}, pid: 1, exited: neverExits() };
+      writeFileSync(pidPath, "4242");
+      return {
+        unref: () => {},
+        kill: () => {},
+        pid: 4242,
+        exited: neverExits(),
+      };
     });
     try {
       const result = await spawnScheduleWorkerProcess({
-        pidWaitTimeoutMs: 100,
+        pidWaitTimeoutMs: 1_000,
+        pidPollIntervalMs: 10,
       });
-      expect(result).toEqual({ pid: process.pid, alreadyRunning: true });
-      expect(spawned).toBe(false);
+      expect(result).toEqual({ pid: 4242, alreadyRunning: false });
+      expect(spawned).toBe(true);
     } finally {
       restore();
     }
@@ -240,6 +247,11 @@ describe("probeScheduleWorker", () => {
     }
   });
 
+  test("reports not_running when the PID file names a live process that is not this worker", () => {
+    writeFileSync(pidPath, String(process.pid));
+    expect(probeScheduleWorker()).toEqual({ status: "not_running" });
+  });
+
   test("reports running (not throws) when the process exists but is not signalable (EPERM)", () => {
     writeFileSync(pidPath, "4321");
     const restore = stubProcessKill(new Set(), new Set([4321]));
@@ -256,6 +268,25 @@ describe("stopScheduleWorkerProcess", () => {
     expect(stopScheduleWorkerProcess()).toEqual({ status: "not_running" });
   });
 
+  test("does not signal a recycled PID that is not this worker", () => {
+    writeFileSync(pidPath, String(process.pid));
+    const signalled: Array<[number, string | number | undefined]> = [];
+    const original = process.kill.bind(process);
+    process.kill = ((pid: number, signal?: string | number) => {
+      if ((signal ?? 0) === 0) {
+        return original(pid, signal);
+      }
+      signalled.push([pid, signal]);
+      return true;
+    }) as typeof process.kill;
+    try {
+      expect(stopScheduleWorkerProcess()).toEqual({ status: "not_running" });
+      expect(signalled).toEqual([]);
+    } finally {
+      process.kill = original;
+    }
+  });
+
   test("signals a running worker and reports its prior state", () => {
     writeFileSync(pidPath, "4321");
     const signalled: Array<[number, string | number | undefined]> = [];

package/src/schedule/worker-control.ts

@@ -19,6 +19,8 @@ import {
   type WorkerProcessStatus,
 } from "../util/worker-process.js";
 
+const SCHEDULE_WORKER_ENTRY = new URL("./worker.ts", import.meta.url);
+
 const log = getLogger("schedule-worker-control");
 
 /**
@@ -42,11 +44,15 @@ export function setScheduleWorkerAdministrativelyStopped(value: boolean): void {
 
 /**
  * Inspect the PID file to determine whether the schedule worker process is
- * alive. A stale PID file (pointing at a dead process) is cleaned up and
- * reported as not_running.
+ * alive. A stale PID file (pointing at a dead process, or at a live process
+ * that is not this worker) is cleaned up and reported as not_running.
  */
 export function probeScheduleWorker(): WorkerProcessStatus {
-  return probeWorkerPidFile(getScheduleWorkerPidPath());
+  return probeWorkerPidFile(
+    getScheduleWorkerPidPath(),
+    SCHEDULE_WORKER_ENTRY,
+    "schedule",
+  );
 }
 
 export class ScheduleWorkerSpawnError extends WorkerProcessSpawnError {}
@@ -95,7 +101,7 @@ async function spawnScheduleWorkerProcessUncoalesced(
   try {
     return await spawnWorkerProcess({
       pidPath: getScheduleWorkerPidPath(),
-      entry: new URL("./worker.ts", import.meta.url),
+      entry: SCHEDULE_WORKER_ENTRY,
       packagedEntry: "schedule",
       workerLabel: "Schedule worker",
       options: opts,
@@ -114,7 +120,11 @@ async function spawnScheduleWorkerProcessUncoalesced(
  * `process.kill` itself fails (e.g. EPERM) — a not-running worker is a no-op.
  */
 export function stopScheduleWorkerProcess(): WorkerProcessStatus {
-  return stopWorkerProcess(getScheduleWorkerPidPath());
+  return stopWorkerProcess(
+    getScheduleWorkerPidPath(),
+    SCHEDULE_WORKER_ENTRY,
+    "schedule",
+  );
 }
 
 /**

package/src/skills/clawhub.ts

@@ -11,11 +11,6 @@ import {
 
 const log = getLogger("clawhub");
 
-// Managed skills directory — where installed skill folders live
-function getManagedSkillsDir(): string {
-  return getWorkspaceSkillsDir();
-}
-
 // ClaWHub project root — clawhub creates a `skills/` subdir inside its cwd,
 // so we use the parent of the managed skills dir as the project root.
 function getClawhubProjectRoot(): string {
@@ -39,7 +34,7 @@ interface IntegrityRecord {
 type IntegrityManifest = Record<string, IntegrityRecord>;
 
 function getIntegrityPath(): string {
-  return join(getManagedSkillsDir(), ".integrity.json");
+  return join(getWorkspaceSkillsDir(), ".integrity.json");
 }
 
 function loadIntegrityManifest(): IntegrityManifest {
@@ -66,7 +61,7 @@ function loadIntegrityManifest(): IntegrityManifest {
  * from skills that haven't been migrated yet.
  */
 export function verifyAndRecordSkillHash(slug: string): void {
-  const skillDir = join(getManagedSkillsDir(), slug);
+  const skillDir = join(getWorkspaceSkillsDir(), slug);
   const hash = computeSkillHash(skillDir);
   if (!hash) {
     log.warn({ slug }, "Could not compute content hash for installed skill");
@@ -232,7 +227,7 @@ function getSkillNameFromSlug(slug: string): string {
 }
 
 function getClawhubSkillsDir(projectRoot?: string): string {
-  return projectRoot ? join(projectRoot, "skills") : getManagedSkillsDir();
+  return projectRoot ? join(projectRoot, "skills") : getWorkspaceSkillsDir();
 }
 
 function hasRootSkillFile(skillDir: string): boolean {

package/src/skills/managed-store.ts

@@ -44,13 +44,9 @@ export function validateManagedSkillId(id: string): string | null {
 
 // ─── Path helpers ────────────────────────────────────────────────────────────
 
-function getManagedSkillsDir(): string {
-  return getWorkspaceSkillsDir();
-}
-
 /** Absolute path of a managed skill's directory (whether or not it exists). */
 export function getManagedSkillDir(id: string): string {
-  return join(getManagedSkillsDir(), id);
+  return join(getWorkspaceSkillsDir(), id);
 }
 
 interface ResolvedCompanionPath {

package/src/tools/host-terminal/host-shell.ts

@@ -17,6 +17,7 @@ import { supportsHostProxy } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
+import { applyActivePluginName } from "../../plugins/active-plugin-env.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
@@ -92,8 +93,9 @@ function buildHostBashProxyEnv(conversationId: string): Record<string, string> {
   // Keep nested `assistant` CLI calls in host_bash aligned with the
   // originating conversation so browser IPC can resolve live proxy context.
   env.__CONVERSATION_ID = conversationId;
-  // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+  // Secret binding for reveal-derived chat authority. See reveal-nonce.ts.
   env.__REVEAL_NONCE = conversationRevealNonce(conversationId);
+  applyActivePluginName(env, conversationId);
   return env;
 }
 
@@ -438,6 +440,7 @@ export const hostShellTool = {
     // the active conversation when running through host_bash.
     hostEnv.__CONVERSATION_ID = context.conversationId;
     hostEnv.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
+    applyActivePluginName(hostEnv, context.conversationId);
 
     if (background) {
       // Check the registry limit BEFORE spawning so we never leak an

package/src/tools/skills/sandbox-runner.ts

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
+import { PLUGIN_NAME_ENV } from "../../plugin-api/plugin-name-env.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import {
@@ -74,6 +75,7 @@ export async function runSkillToolScriptSandbox(
     timeoutMs?: number;
     expectedSkillVersionHash?: string;
     skillDirHashResolver?: (skillDir: string) => string;
+    pluginOwner?: string;
   },
 ): Promise<ToolExecutionResult> {
   const scriptPath = resolve(join(skillDir, executorPath));
@@ -117,7 +119,9 @@ export async function runSkillToolScriptSandbox(
       "utf-8",
     );
 
-    return await spawnRunner(runDir, input, context, timeoutMs, executorPath);
+    return await spawnRunner(runDir, input, context, timeoutMs, executorPath, {
+      pluginOwner: options?.pluginOwner,
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return {
@@ -139,6 +143,7 @@ function spawnRunner(
   context: ToolContext,
   timeoutMs: number,
   executorPath: string,
+  pluginContext?: { pluginOwner?: string },
 ): Promise<ToolExecutionResult> {
   return new Promise<ToolExecutionResult>((resolve) => {
     const stdoutChunks: Buffer[] = [];
@@ -156,9 +161,13 @@ function spawnRunner(
       conversationId: context.conversationId,
     });
     env.__CONVERSATION_ID = context.conversationId;
-    // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
+    // Secret binding for reveal-derived chat authority. See reveal-nonce.ts.
     env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
 
+    if (pluginContext?.pluginOwner) {
+      env[PLUGIN_NAME_ENV] = pluginContext.pluginOwner;
+    }
+
     const child = spawn(wrapped.command, wrapped.args, {
       cwd: runDir,
       env,

package/src/tools/skills/skill-script-runner.ts

@@ -24,6 +24,12 @@ export interface RunSkillToolScriptOptions {
    *  with `execution_target: host` (in-process); non-bundled skills are forced to
    *  execute in the sandbox. */
   bundled?: boolean;
+  /**
+   * Catalog owner id when this skill is plugin-resident. The sandbox runner
+   * sets VELLUM_PLUGIN_NAME so the child can resolve credentials under
+   * that plugin's service.
+   */
+  pluginOwner?: string;
 }
 
 /**
@@ -42,6 +48,7 @@ export async function runSkillToolScript(
       timeoutMs: options.timeoutMs,
       expectedSkillVersionHash: options.expectedSkillVersionHash,
       skillDirHashResolver: options.skillDirHashResolver,
+      pluginOwner: options.pluginOwner,
     });
   }
 

package/src/tools/skills/skill-tool-factory.ts

@@ -32,6 +32,7 @@ export function createSkillTool(
   skillDir: string,
   versionHash: string,
   bundled?: boolean,
+  pluginOwner?: string,
 ): Tool {
   return {
     name: entry.name,
@@ -96,6 +97,7 @@ export function createSkillTool(
           target: entry.execution_target,
           expectedSkillVersionHash: versionHash,
           bundled,
+          pluginOwner,
         },
       );
     },
@@ -113,8 +115,9 @@ export function createSkillToolsFromManifest(
   skillDir: string,
   versionHash: string,
   bundled?: boolean,
+  pluginOwner?: string,
 ): Tool[] {
   return entries.map((entry) =>
-    createSkillTool(entry, skillDir, versionHash, bundled),
+    createSkillTool(entry, skillDir, versionHash, bundled, pluginOwner),
   );
 }

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -50,6 +50,17 @@ describe("safe-env Qdrant forwarding", () => {
   });
 });
 
+describe("safe-env plugin name stripping", () => {
+  test("does not forward a parent-supplied VELLUM_PLUGIN_NAME", () => {
+    expect(SAFE_ENV_VARS).not.toContain("VELLUM_PLUGIN_NAME");
+
+    const env = buildSanitizedEnv("linux", {
+      VELLUM_PLUGIN_NAME: "forged-plugin",
+    });
+    expect(env.VELLUM_PLUGIN_NAME).toBeUndefined();
+  });
+});
+
 describe("safe-env CES child forwarding", () => {
   test("forwards CES IPC discovery env and CES HTTP credentials", () => {
     expect(SAFE_ENV_VARS).toContain("CES_BOOTSTRAP_SOCKET_DIR");

package/src/tools/terminal/safe-env.ts

@@ -86,6 +86,10 @@ export const SAFE_ENV_VARS = [
   "VELLUM_MINIKUBE_STORAGE_SIZE",
   "VELLUM_BACKUP_DIR",
   "VELLUM_BACKUP_KEY_PATH",
+  // VELLUM_PLUGIN_NAME is intentionally absent. The daemon injects the
+  // owning plugin install name after sanitizing the child environment.
+  // Inheriting a parent-supplied value would let an arbitrary process
+  // claim another plugin's credential scope.
 ] as const;
 
 export const WINDOWS_SAFE_ENV_VARS = [

package/src/tools/terminal/shell.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 import type { BackgroundToolCompletedEvent } from "../../api/events/background-tool-completed.js";
 import { getConfig } from "../../config/loader.js";
 import { RiskLevel } from "../../permissions/types.js";
+import { applyActivePluginName } from "../../plugins/active-plugin-env.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
@@ -290,6 +291,7 @@ export const shellTool = {
 
     const env = buildSanitizedEnv();
     env.__CONVERSATION_ID = context.conversationId;
+    applyActivePluginName(env, context.conversationId);
     // Secret binding for reveal-derived chat authority — see reveal-nonce.ts.
     env.__REVEAL_NONCE = conversationRevealNonce(context.conversationId);
     // Surface the resolving model to assistant CLI commands so they can tailor

package/src/util/__tests__/worker-process-command.test.ts

@@ -205,11 +205,12 @@ describe("decideWorkerSlot", () => {
     ).toEqual({ action: "adopt", pid: WORKER });
   });
 
-  // The cases below are the ones that must never reach a kill.
+  // The cases below must never reach a kill. Unmatched command lines spawn
+  // a new worker without signalling the stranger holding the recycled PID.
   test("never signals an unrelated process on a recycled PID", () => {
     expect(
       decide({ pid: WORKER, ppid: 1, command: "/usr/bin/postgres -D /data" }),
-    ).toEqual({ action: "adopt", pid: WORKER });
+    ).toEqual({ action: "spawn" });
   });
 
   test("never signals another project's worker.ts on a recycled PID", () => {
@@ -219,7 +220,7 @@ describe("decideWorkerSlot", () => {
         ppid: 1,
         command: "bun run /home/dev/side-project/worker.ts",
       }),
-    ).toEqual({ action: "adopt", pid: WORKER });
+    ).toEqual({ action: "spawn" });
   });
 
   test("never signals a different worker kind holding this slot", () => {
@@ -229,7 +230,7 @@ describe("decideWorkerSlot", () => {
         ppid: 1,
         command: "bun --smol run /app/runtime/0.10.11/src/monitoring/worker.ts",
       }),
-    ).toEqual({ action: "adopt", pid: WORKER });
+    ).toEqual({ action: "spawn" });
   });
 
   test("never signals when the process table could not be read", () => {