@vellumai/assistant 0.12.2-dev.202609171820.9ecfa87 → 0.12.2-dev.202609172017.3da279e

package/node_modules/@vellumai/slack-text/src/index.ts

@@ -127,7 +127,7 @@ export async function buildSlackUserLabelMap(
     ids.map(async (id): Promise<[string, string] | undefined> => {
       try {
         const label = await resolveLabel(id);
-        const sanitized = sanitizeOptionalLabel(label ?? undefined);
+        const sanitized = sanitizeSlackLabel(label ?? undefined);
         if (!sanitized || sanitized === id) return undefined;
         return [id, sanitized];
       } catch {
@@ -166,7 +166,7 @@ export async function buildSlackChannelLabelMap(
     ids.map(async (id): Promise<[string, string] | undefined> => {
       try {
         const label = await resolveLabel(id);
-        const sanitized = sanitizeOptionalLabel(label ?? undefined);
+        const sanitized = sanitizeSlackLabel(label ?? undefined);
         if (!sanitized || sanitized === id) return undefined;
         return [id, sanitized];
       } catch {
@@ -222,7 +222,7 @@ function renderChannelReference(
     return `#${embeddedLabel}`;
   }
 
-  const resolvedLabel = sanitizeOptionalLabel(
+  const resolvedLabel = sanitizeSlackLabel(
     options.channelLabels?.[channelId],
   );
   if (resolvedLabel && resolvedLabel !== channelId) {
@@ -320,15 +320,11 @@ export function sanitizeSlackLabel(
 function sanitizeEmbeddedSlackLabel(
   label: string | undefined,
 ): string | undefined {
-  return sanitizeOptionalLabel(
+  return sanitizeSlackLabel(
     label === undefined ? undefined : decodeSlackHtmlEntities(label),
   );
 }
 
-function sanitizeOptionalLabel(label: string | undefined): string | undefined {
-  return sanitizeSlackLabel(label);
-}
-
 function isSlackUserId(value: string): boolean {
   return /^[UW][A-Z0-9]+$/.test(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.2-dev.202609171820.9ecfa87",
+  "version": "0.12.2-dev.202609172017.3da279e",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/btw-routes.test.ts

@@ -338,7 +338,7 @@ describe("POST /v1/btw", () => {
     expect(options!.config!.modelIntent).toBeUndefined();
   });
 
-  test("greeting requests pass callSite: 'emptyStateGreeting'", async () => {
+  test("greeting requests pass callSite: 'emptyStateGreeting' and send no tools", async () => {
     const provider = makeMockProvider();
     const session = makeMockSession(provider);
     mockGetOrCreateConversation.mockImplementationOnce(async () => session);
@@ -352,6 +352,9 @@ describe("POST /v1/btw", () => {
     expect(provider.sendMessage).toHaveBeenCalledTimes(1);
     const [, options] = provider.sendMessage.mock.calls[0];
     expect(options!.config!.callSite).toBe("emptyStateGreeting");
+    // The greeting targets no real conversation, so there is no cache prefix
+    // for tool definitions to share; they would only cost tokens.
+    expect(options!.tools).toEqual([]);
   });
 
   test("greeting requests include fresh turn context using the client timezone", async () => {

package/src/__tests__/conversation-runtime-assembly.test.ts

@@ -673,6 +673,35 @@ describe("injectChannelCapabilityContext", () => {
     const text = (result.content[0] as { type: "text"; text: string }).text;
     expect(text).not.toContain("Do NOT use markdown tables");
   });
+
+  test("injects email send CLI constraint for email channel", () => {
+    const caps: ChannelCapabilities = {
+      channel: "email",
+      dashboardCapable: false,
+      supportsDynamicUi: false,
+      supportsVoiceInput: false,
+    };
+
+    const result = injectChannelCapabilityContext(baseUserMessage, caps);
+    const text = (result.content[0] as { type: "text"; text: string }).text;
+    expect(text).toContain("Conversation text is not emailed");
+    expect(text).toContain("assistant email send");
+    expect(text).toContain("--reply-to");
+  });
+
+  test("does NOT inject email send CLI constraint for non-email channels", () => {
+    const caps: ChannelCapabilities = {
+      channel: "telegram",
+      dashboardCapable: false,
+      supportsDynamicUi: false,
+      supportsVoiceInput: false,
+    };
+
+    const result = injectChannelCapabilityContext(baseUserMessage, caps);
+    const text = (result.content[0] as { type: "text"; text: string }).text;
+    expect(text).not.toContain("Conversation text is not emailed");
+    expect(text).not.toContain("assistant email send");
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/credential-execution-client.test.ts

@@ -95,7 +95,7 @@ function withBootstrapDir(dir: string): () => void {
   };
 }
 
-describe("managed CES discovery", () => {
+describe("CES discovery", () => {
   test("returns unavailable when bootstrap socket does not exist", () => {
     const bootstrapDir = mkdtempSync(join(tmpdir(), "ces-missing-"));
     const restore = withBootstrapDir(bootstrapDir);

package/src/__tests__/secure-keys.test.ts

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { createServer, type Server } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -11,6 +12,8 @@ import {
   test,
 } from "bun:test";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
+
 // ---------------------------------------------------------------------------
 // Mock logger (no-op — compatible with other test files' identical mock)
 // ---------------------------------------------------------------------------
@@ -602,4 +605,43 @@ describe("secure-keys", () => {
       expect(result.unreachable).toBe(true);
     });
   });
+
+  // -----------------------------------------------------------------------
+  // Session ownership: boot claims reconnect before identity reads
+  // -----------------------------------------------------------------------
+  describe("CES session owner skips a second open", () => {
+    test("a registered reconnect owner does not handshake a live CES socket", async () => {
+      const dir = mkdtempSync(join(tmpdir(), "ces-owner-"));
+      const socketPath = resolveIpcEndpoint("ces", { workspaceDir: dir }).path;
+      const savedDir = process.env.CES_BOOTSTRAP_SOCKET_DIR;
+      process.env.CES_BOOTSTRAP_SOCKET_DIR = dir;
+
+      const connections: Array<import("node:net").Socket> = [];
+      const server: Server = createServer((socket) => {
+        connections.push(socket);
+        socket.on("error", () => {});
+      });
+      await new Promise<void>((resolve) => server.listen(socketPath, resolve));
+
+      try {
+        setCesReconnect(async () => undefined);
+        const start = Date.now();
+        await getSecureKeyAsync("openai");
+        expect(Date.now() - start).toBeLessThan(1_000);
+        expect(getActiveBackendName()).toBe("encrypted-store");
+        expect(connections.length).toBe(0);
+      } finally {
+        for (const sock of connections) {
+          sock.destroy();
+        }
+        await new Promise<void>((resolve) => server.close(() => resolve()));
+        if (savedDir !== undefined) {
+          process.env.CES_BOOTSTRAP_SOCKET_DIR = savedDir;
+        } else {
+          delete process.env.CES_BOOTSTRAP_SOCKET_DIR;
+        }
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+  });
 });

package/src/config/__tests__/memory-retrospective-schema.test.ts

@@ -12,10 +12,11 @@ import { describe, expect, test } from "bun:test";
 import { MemoryRetrospectiveConfigSchema } from "../schemas/memory-retrospective.js";
 
 describe("memory.retrospective config schema", () => {
-  test("an empty block leaves retrospectives and skill improvement on", () => {
+  test("an empty block leaves skill improvement on and monitoring off", () => {
     const parsed = MemoryRetrospectiveConfigSchema.parse({});
     expect(parsed.enabled).toBe(true);
     expect(parsed.skillImprovement).toBe(true);
+    expect(parsed.skillImprovementMonitoring).toBe(false);
     expect(parsed).not.toHaveProperty("forkStrategy");
   });
 
@@ -41,6 +42,18 @@ describe("memory.retrospective config schema", () => {
     ).toBe(false);
   });
 
+  test("skillImprovementMonitoring is a boolean-only opt-in", () => {
+    const parsed = MemoryRetrospectiveConfigSchema.parse({
+      skillImprovementMonitoring: true,
+    });
+    expect(parsed.skillImprovementMonitoring).toBe(true);
+    expect(
+      MemoryRetrospectiveConfigSchema.safeParse({
+        skillImprovementMonitoring: "true",
+      }).success,
+    ).toBe(false);
+  });
+
   test("a leftover forkStrategy key is ignored", () => {
     const parsed = MemoryRetrospectiveConfigSchema.parse({
       forkStrategy: "cloning",

package/src/config/bundled-skills/sequences/TOOLS.json

@@ -165,11 +165,7 @@
             },
             "description": "Replacement steps (replaces all existing steps)"
           }
-        },
-        "oneOf": [
-          { "required": ["id"] },
-          { "required": ["enrollment_id", "enrollment_action"] }
-        ]
+        }
       },
       "executor": "tools/sequence-update.ts",
       "execution_target": "host"

package/src/config/schemas/memory-retrospective.ts

@@ -11,14 +11,23 @@ export const MemoryRetrospectiveConfigSchema = z
 
     skillImprovement: z
       .boolean({
-        error:
-          "memory.retrospective.skillImprovement must be a boolean",
+        error: "memory.retrospective.skillImprovement must be a boolean",
       })
       .default(true)
       .describe(
         "Whether retrospectives may discover, refine, and create managed skills from observed procedures. When false, retrospectives still capture ordinary memories through `remember`, but cannot load skill management, search for similar skills, or scaffold managed skills.",
       ),
 
+    skillImprovementMonitoring: z
+      .boolean({
+        error:
+          "memory.retrospective.skillImprovementMonitoring must be a boolean",
+      })
+      .default(false)
+      .describe(
+        "Reserved opt-in for monitoring retrospective skill-improvement decisions. This setting currently has no effect.",
+      ),
+
     timeThresholdMs: z
       .number({
         error: "memory.retrospective.timeThresholdMs must be a number",

package/src/credential-execution/ces-connect.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Tests for the shared CES RPC session helper used by assistant boot and
+ * child-process credential resolution.
+ */
+import { describe, expect, test } from "bun:test";
+
+import { openCesRpcSession, reconnectCesRpcSession } from "./ces-connect.js";
+import { createCesProcessManager } from "./process-manager.js";
+
+describe("openCesRpcSession", () => {
+  test("returns undefined when discovery fails without polling", async () => {
+    const start = Date.now();
+    const pm = createCesProcessManager({
+      discover: async () => ({
+        mode: "unavailable",
+        reason: "missing test socket",
+      }),
+    });
+
+    const session = await openCesRpcSession({ processManager: pm });
+
+    expect(session).toBeUndefined();
+    expect(pm.isRunning()).toBe(false);
+    expect(Date.now() - start).toBeLessThan(1_000);
+  });
+
+  test("returns undefined when the abort signal is already fired", async () => {
+    const abort = new AbortController();
+    abort.abort();
+    const pm = createCesProcessManager({
+      discover: async () => {
+        throw new Error("discover should not run after abort");
+      },
+    });
+
+    const session = await openCesRpcSession({
+      processManager: pm,
+      signal: abort.signal,
+    });
+
+    expect(session).toBeUndefined();
+    expect(pm.isRunning()).toBe(false);
+  });
+
+  test("creates a process manager when none is provided", async () => {
+    const session = await openCesRpcSession({
+      discover: async () => ({
+        mode: "unavailable",
+        reason: "missing test socket",
+      }),
+    });
+
+    expect(session).toBeUndefined();
+  });
+
+  test("reconnectCesRpcSession stops the manager and returns undefined when discovery fails", async () => {
+    const pm = createCesProcessManager({
+      discover: async () => ({
+        mode: "unavailable",
+        reason: "missing test socket",
+      }),
+    });
+
+    const client = await reconnectCesRpcSession(pm);
+
+    expect(client).toBeUndefined();
+    expect(pm.isRunning()).toBe(false);
+  });
+});

package/src/credential-execution/ces-connect.ts

@@ -0,0 +1,115 @@
+/**
+ * Open a CES RPC client over the shared bootstrap socket.
+ *
+ * Assistant boot and child-process credential reads use this helper. Both
+ * are CES API clients: discover `ces.sock`, connect, handshake, reconnect.
+ *
+ * They stay two entry points because boot must load handshake identity
+ * without talking to CES, then hand that identity to CES. Children open a
+ * session only when this process has not already claimed one (no live
+ * client and no reconnect owner).
+ */
+
+import type { AssistantConfig } from "../config/schema.js";
+import { getLogger } from "../util/logger.js";
+import {
+  type CesClient,
+  type CesClientHandshakeOptions,
+  createCesClient,
+} from "./client.js";
+import {
+  type CesProcessManager,
+  type CesProcessManagerConfig,
+  CesUnavailableError,
+  createCesProcessManager,
+} from "./process-manager.js";
+
+const log = getLogger("ces-connect");
+
+export interface CesRpcSession {
+  client: CesClient;
+  processManager: CesProcessManager;
+}
+
+export interface OpenCesRpcSessionOptions {
+  /**
+   * Reuse an existing process manager (reconnect after `stop()`). When
+   * omitted, a new manager is created.
+   */
+  processManager?: CesProcessManager;
+  handshake?: CesClientHandshakeOptions;
+  signal?: AbortSignal;
+  assistantConfig?: AssistantConfig;
+  discover?: CesProcessManagerConfig["discover"];
+}
+
+/**
+ * Discover the CES socket, connect, and complete the RPC handshake.
+ *
+ * Returns undefined when CES is missing, the handshake is rejected, the
+ * abort signal fires, or the transport fails. The process manager is
+ * stopped on those paths so a later reconnect can call `start()` again.
+ */
+export async function openCesRpcSession(
+  options: OpenCesRpcSessionOptions = {},
+): Promise<CesRpcSession | undefined> {
+  const pm =
+    options.processManager ??
+    createCesProcessManager({
+      assistantConfig: options.assistantConfig,
+      discover: options.discover,
+    });
+
+  const fail = async (): Promise<undefined> => {
+    await pm.stop().catch(() => {});
+    return undefined;
+  };
+
+  if (options.signal?.aborted) {
+    return fail();
+  }
+
+  try {
+    const transport = await pm.start();
+    if (options.signal?.aborted) {
+      return fail();
+    }
+
+    const client = createCesClient(transport);
+    const { accepted, reason } = await client.handshake(options.handshake);
+    if (options.signal?.aborted) {
+      client.close();
+      return fail();
+    }
+    if (!accepted) {
+      log.warn({ reason }, "CES handshake rejected");
+      client.close();
+      return fail();
+    }
+
+    return { client, processManager: pm };
+  } catch (err) {
+    if (err instanceof CesUnavailableError) {
+      log.info({ reason: err.message }, "CES is not available");
+    } else {
+      log.warn(
+        { error: err instanceof Error ? err.message : String(err) },
+        "Failed to open CES RPC session",
+      );
+    }
+    return fail();
+  }
+}
+
+/**
+ * Stop the current transport and open a new session on the same process
+ * manager. Used by assistant boot and child-process reconnect callbacks.
+ */
+export async function reconnectCesRpcSession(
+  processManager: CesProcessManager,
+  handshake?: CesClientHandshakeOptions,
+): Promise<CesClient | undefined> {
+  await processManager.stop();
+  const session = await openCesRpcSession({ processManager, handshake });
+  return session?.client;
+}

package/src/credential-execution/ces-runtime.ts

@@ -9,10 +9,16 @@ import {
   setCesReconnect,
 } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
-import { type CesClient, createCesClient } from "./client.js";
+import {
+  openCesRpcSession,
+  reconnectCesRpcSession,
+} from "./ces-connect.js";
+import {
+  type CesClient,
+  type CesClientHandshakeOptions,
+} from "./client.js";
 import {
   type CesProcessManager,
-  CesUnavailableError,
   createCesProcessManager,
 } from "./process-manager.js";
 import {
@@ -45,70 +51,69 @@ interface CesStartupResult {
 }
 
 /**
- * Start the CES process and perform the RPC handshake. Returns immediately with
- * handles to the in-flight initialization — callers don't need to await this
- * for startup to continue.
+ * Open the assistant's CES RPC client and perform the handshake. Returns
+ * immediately with handles to the in-flight initialization: callers don't
+ * need to await this for startup to continue.
  *
- * CES serves a multi-connection Unix socket, so this is called at the
- * process level and child processes may open their own connections.
+ * Claims reconnect ownership before any credential read so boot identity
+ * loading cannot open a second, identity-less session through the child
+ * entry point. CES serves a multi-connection Unix socket, so child
+ * processes in other address spaces still open their own connections.
  */
 function startCesProcess(config: AssistantConfig): CesStartupResult {
   const pm = createCesProcessManager({ assistantConfig: config });
   const abortController = new AbortController();
   let currentClient: CesClient | undefined;
+  let handshake: CesClientHandshakeOptions = {};
+
+  // Own this process's CES session before resolveManagedProxyContext()
+  // reads the API key. That read must not take the child open path.
+  setCesReconnect(async () => {
+    const client = await reconnectCesRpcSession(pm, handshake);
+    if (client) {
+      log.info("CES reconnection handshake accepted");
+    }
+    return client;
+  });
 
   const handshakePromise = (async (): Promise<CesClient | undefined> => {
     try {
-      const transport = await pm.start();
-      if (abortController.signal.aborted) {
-        throw new Error("CES initialization aborted during shutdown");
-      }
-      const client = createCesClient(transport);
-      currentClient = client;
       // Resolve the assistant API key so CES can use it for platform
       // credential materialisation. In managed mode the key is provisioned
-      // after hatch and stored in the credential store — CES can't read
-      // the env var, so we pass it via the handshake.
+      // after hatch and stored in the credential store. CES can't read
+      // the env var, so we pass it via the handshake. Reconnect ownership
+      // is already claimed, so this read uses HTTP or the encrypted store,
+      // not a second RPC session.
       const proxyCtx = await resolveManagedProxyContext();
+      if (abortController.signal.aborted) {
+        return undefined;
+      }
       const assistantId = getPlatformAssistantId();
-      const { accepted, reason } = await client.handshake({
+      handshake = {
         ...(proxyCtx.assistantApiKey
           ? { assistantApiKey: proxyCtx.assistantApiKey }
           : {}),
         ...(assistantId ? { assistantId } : {}),
+      };
+      const session = await openCesRpcSession({
+        processManager: pm,
+        signal: abortController.signal,
+        handshake,
       });
-      if (abortController.signal.aborted) {
-        client.close();
-        throw new Error("CES initialization aborted during shutdown");
-      }
-      if (accepted) {
+      currentClient = session?.client;
+      if (session) {
         log.info(
           "CES client initialized and handshake accepted (server-level)",
         );
-        return client;
       }
+      return session?.client;
+    } catch (err) {
       log.warn(
-        { reason },
-        "CES handshake rejected — CES tools will be unavailable",
+        { error: err instanceof Error ? err.message : String(err) },
+        "Failed to initialize CES client",
       );
-      client.close();
       currentClient = undefined;
-      await pm.stop();
-      return undefined;
-    } catch (err) {
-      if (err instanceof CesUnavailableError) {
-        log.info(
-          { reason: err.message },
-          "CES is not available — CES tools will be unavailable",
-        );
-      } else {
-        log.warn(
-          { error: err instanceof Error ? err.message : String(err) },
-          "Failed to initialize CES client — CES tools will be unavailable",
-        );
-      }
       await pm.stop().catch(() => {});
-      currentClient = undefined;
       return undefined;
     }
   })();
@@ -154,11 +159,11 @@ function updateClientRef(client: CesClient | undefined): void {
 }
 
 /**
- * Bring up the daemon's CES connection: start the process, run the handshake
- * (blocking up to a 20s timeout so credential reads can route through CES
- * before provider init), register the reconnection callback, and keep the live
- * client reference in sync. Non-fatal — on failure the daemon falls back to the
- * direct credential store.
+ * Open the assistant's CES RPC client: handshake (blocking up to a 20s
+ * timeout so credential reads can route through CES before provider init)
+ * and keep the live client reference in sync. Reconnect ownership is
+ * claimed before the identity read. Non-fatal: on failure the assistant
+ * falls back to the direct credential store.
  */
 export async function startCes(config: AssistantConfig): Promise<void> {
   const cesResult = startCesProcess(config);
@@ -171,7 +176,7 @@ export async function startCes(config: AssistantConfig): Promise<void> {
       timeoutMs: DEFAULT_CES_STARTUP_TIMEOUT_MS,
       onTimeout: () => {
         log.warn(
-          "CES handshake timed out after 20s — falling back to direct credential store",
+          "CES handshake timed out after 20s, falling back to direct credential store",
         );
       },
     });
@@ -193,56 +198,13 @@ export async function startCes(config: AssistantConfig): Promise<void> {
     }
   }
 
-  // Register CES reconnection callback so the credential layer can re-establish
-  // the connection when the transport dies, instead of falling back to the
-  // encrypted file store.
+  // Reconnect ownership is claimed inside startCesProcess before the
+  // identity read. Snapshotting the API key there (not here) avoids a
+  // second resolveManagedProxyContext() after setCesClient, which would
+  // read the key through CES while reconnecting.
   if (cesResult.processManager) {
     const pm = cesResult.processManager;
 
-    // Snapshot the managed-proxy context and assistant ID at CES startup so the
-    // reconnect closure below never calls back into `resolveManagedProxyContext()`.
-    // That function reads the assistant API key via `getSecureKeyAsync()`, which
-    // — once `setCesClient()` has resolved the backend to CES RPC — routes the
-    // read through CES itself. During a reconnect the old transport is dead and
-    // a new one is being set up by this very closure, so the nested credential
-    // read recursively awaits its own in-flight reconnection and deadlocks until
-    // `CREDENTIAL_OP_TIMEOUT_MS` (45s) fires. That 45-second stall delays every
-    // CES restart and causes dependent credential reads (e.g. Meet's STT
-    // provider resolution) to return `undefined` during the window. API key
-    // rotation uses the `updateAssistantApiKey` RPC on the live client, not a
-    // reconnect, so caching at startup is safe.
-    const startupProxyCtx = await resolveManagedProxyContext();
-    const startupAssistantId = getPlatformAssistantId();
-
-    setCesReconnect(async () => {
-      try {
-        await pm.stop();
-        const transport = await pm.start();
-        const newClient = createCesClient(transport);
-        const { accepted, reason } = await newClient.handshake({
-          ...(startupProxyCtx.assistantApiKey
-            ? { assistantApiKey: startupProxyCtx.assistantApiKey }
-            : {}),
-          ...(startupAssistantId ? { assistantId: startupAssistantId } : {}),
-        });
-        if (accepted) {
-          log.info("CES reconnection handshake accepted");
-          return newClient;
-        }
-        log.warn({ reason }, "CES reconnection handshake rejected");
-        newClient.close();
-        await pm.stop().catch(() => {});
-        return undefined;
-      } catch (err) {
-        log.warn(
-          { error: err instanceof Error ? err.message : String(err) },
-          "CES reconnection attempt failed",
-        );
-        await pm.stop().catch(() => {});
-        return undefined;
-      }
-    });
-
     // Proactive reconnect: when the transport dies (socket close, process
     // exit), start a retry-with-backoff loop immediately instead of waiting
     // for the next credential operation to trigger the lazy reconnect path.

package/src/daemon/conversation-runtime-assembly.ts

@@ -903,6 +903,11 @@ export function buildChannelCapabilityBlock(
         "- Do NOT use markdown tables — use bullet lists instead. No markdown headers — use **bold** or CAPS for emphasis.",
       );
     }
+    if (caps.channel === "email") {
+      lines.push(
+        "- Conversation text is not emailed. To reply, run `assistant email send` (see `assistant email send --help`). Use `--reply-to` to keep the thread. Skip a reply only when none is needed.",
+      );
+    }
   }
 
   // Inject group chat etiquette only when the chat type indicates a multi-party
@@ -2035,20 +2040,6 @@ export async function composeInjectorChain(ctx: TurnContext): Promise<string> {
  */
 const DEFAULT_PLACEMENT: InjectionPlacement = "append-user-tail";
 
-/**
- * Count leading memory-prefix blocks on a user message's `content`.
- *
- * Delegates to {@link countMemoryPrefixBlocks} from
- * `memory/graph/conversation-graph-memory.js` — the canonical state-machine
- * for locating the memory-prefix boundary. Reusing it here keeps the
- * PKB-context / PKB-reminder / NOW splice rules aligned on a single source
- * of truth so their ordering relative to any memory prefix is stable and
- * testable.
- */
-function countMemoryPrefixBlocksOnContent(content: ContentBlock[]): number {
-  return countMemoryPrefixBlocks(content);
-}
-
 /**
  * Apply one injector block to a `runMessages` array according to its
  * declared {@link InjectionPlacement}:
@@ -2101,9 +2092,7 @@ function applyInjectionBlock(
         { ...userTail, content: [...userTail.content, textBlock] },
       ];
     case "after-memory-prefix": {
-      const memoryPrefixCount = countMemoryPrefixBlocksOnContent(
-        userTail.content,
-      );
+      const memoryPrefixCount = countMemoryPrefixBlocks(userTail.content);
       return [
         ...runMessages.slice(0, -1),
         {
@@ -2161,7 +2150,7 @@ function stripTailV2DynamicMemoryPrefix(
   if (!last || last.role !== "user") {
     return messages;
   }
-  const prefixCount = countMemoryPrefixBlocksOnContent(last.content);
+  const prefixCount = countMemoryPrefixBlocks(last.content);
   if (prefixCount === 0) {
     return messages;
   }

package/src/daemon/lifecycle.ts

@@ -673,11 +673,11 @@ export async function runDaemon(): Promise<void> {
   // blocked.
   startConsentRefresh();
 
-  // Bring up the assistant's CES connection (process + handshake + reconnect
-  // wiring). Blocks up to a 20s timeout so credential reads route through CES
-  // before provider init; non-fatal, falls back to the direct credential store
-  // on failure. CES serves a multi-connection bootstrap socket, so this
-  // happens at the process level and child processes can connect independently.
+  // Open the assistant's CES RPC client (handshake + reconnect wiring).
+  // Blocks up to a 20s timeout so credential reads route through CES before
+  // provider init; non-fatal, falls back to the direct credential store on
+  // failure. CES serves a multi-connection bootstrap socket, so child
+  // processes can open the same `openCesRpcSession` path independently.
   await startCes(config);
 
   // Bring up the plugin layer: install the runtime bridge, register the

package/src/persistence/conversation-crud.ts

@@ -577,6 +577,12 @@ export function isProviderErrorMetadata(
  * assistant rows, and turn grouping closes on them, so display merging and
  * the turn resolver agree on boundaries. Takes the raw persisted `metadata`
  * JSON string; malformed JSON and non-assistant roles are never standalone.
+ *
+ * The web folds adjacent assistant rows again after pagination and reads the
+ * same rule off the wire projection in its own `isStandaloneAssistantMessage`
+ * (clients/web/src/domains/chat/utils/is-standalone-assistant-message.ts). A
+ * kind added here without a matching flag and check there merges on the
+ * client anyway.
  */
 export function isStandaloneAssistantMessage(
   role: string,

package/src/persistence/conversation-queries.ts

@@ -955,19 +955,6 @@ function likeContainsPattern(query: string): string {
     .replace(/_/g, "\\_")}%`;
 }
 
-/**
- * Whether the sparse Qdrant `messages_lexical` index — the only source of
- * message-content matches — is a safe read source. Content matching is
- * unavailable (title matches only) until the one-time upgrade backfill has
- * fully drained: a partially populated collection would silently miss older
- * content (an empty result — not a throw). Indexing itself is unconditional
- * host infrastructure, so completion is the only gate; the recall read site
- * applies the same one via the shared {@link isLexicalBackfillComplete}.
- */
-function isMessageContentSearchAvailable(): boolean {
-  return isLexicalBackfillComplete();
-}
-
 /**
  * Full-text search across message content.
  *
@@ -976,9 +963,9 @@ function isMessageContentSearchAvailable(): boolean {
  * merged with a `LIKE` match on conversation titles; matching conversations
  * return with their relevant messages, ordered by most recently updated.
  *
- * Content matching is index-only — there is no `messages.content` scan
+ * Content matching is index-only: there is no `messages.content` scan
  * fallback and no other content source. Only the title arm can match while
- * the index is not a safe read source ({@link isMessageContentSearchAvailable}),
+ * the index is not a safe read source ({@link isLexicalBackfillComplete}),
  * for a query that tokenizes to nothing under the shared tokenizer (non-ASCII
  * or single-char input like "你", "é", "C++"), or when the Qdrant lexical
  * lookup fails (logged). An unindexed or unreachable index yields fewer
@@ -1017,7 +1004,7 @@ export async function searchConversations(
   const maxMsgsPerConv = opts?.maxMessagesPerConversation ?? 3;
 
   const hasTokens = hasLexicalTokens(trimmed);
-  const contentSearchAvailable = isMessageContentSearchAvailable();
+  const contentSearchAvailable = isLexicalBackfillComplete();
 
   // LIKE pattern for title matching (message-content indexes don't cover titles).
   const titlePattern = likeContainsPattern(query);

package/src/runtime/guardian-reply-router.ts

@@ -388,7 +388,7 @@ export async function routeGuardianReply(
       const request = await getGuardianRequestOrNull(answerTap.requestId);
       if (
         request &&
-        resolveRequestInstructionMode(request) === "answer" &&
+        resolveGuardianInstructionModeForRequest(request) === "answer" &&
         parseQuestionAnswerActionId(answerTap.token) &&
         !request.callSessionId &&
         hasLiveQuestionInteraction(request.id)
@@ -581,7 +581,7 @@ export async function routeGuardianReply(
   if (messageText.length > 0 && pendingRequests.length === 1) {
     const soleRequest = pendingRequests[0];
     if (
-      resolveRequestInstructionMode(soleRequest) === "answer" &&
+      resolveGuardianInstructionModeForRequest(soleRequest) === "answer" &&
       !soleRequest.callSessionId &&
       soleRequest.sourceConversationId === conversationId &&
       hasLiveQuestionInteraction(soleRequest.id)
@@ -1005,12 +1005,6 @@ function inferActionFromText(
   return "approve_once";
 }
 
-function resolveRequestInstructionMode(
-  request?: Pick<GuardianRequestWire, "kind" | "toolName"> | null,
-): "approval" | "answer" {
-  return resolveGuardianInstructionModeForRequest(request);
-}
-
 // ---------------------------------------------------------------------------
 // Failure reason reply text
 // ---------------------------------------------------------------------------
@@ -1044,7 +1038,7 @@ function failureReplyText(
       return "Something went wrong with this request on our end, so I couldn't apply your decision.";
     case "invalid_action":
       return buildGuardianInvalidActionReply(
-        resolveRequestInstructionMode(request),
+        resolveGuardianInstructionModeForRequest(request),
         requestCode ?? undefined,
       );
     default:
@@ -1063,7 +1057,7 @@ function failureReplyText(
  */
 function composeCodeOnlyClarification(request: GuardianRequestWire): string {
   const code = request.requestCode ?? "unknown";
-  const mode = resolveRequestInstructionMode(request);
+  const mode = resolveGuardianInstructionModeForRequest(request);
   return buildGuardianCodeOnlyClarification(mode, {
     requestCode: code,
     questionText: request.questionText,
@@ -1087,7 +1081,7 @@ function composeDisambiguationReply(
   const lines: string[] = [];
   const requestsWithMode = pendingRequests.map((request) => ({
     request,
-    mode: resolveRequestInstructionMode(request),
+    mode: resolveGuardianInstructionModeForRequest(request),
   }));
 
   if (engineReplyText) {

package/src/runtime/routes/btw-routes.ts

@@ -2,9 +2,10 @@
  * Route handler for the POST /v1/btw SSE-streaming side-chain endpoint.
  *
  * Runs an ephemeral LLM call that reuses the conversation's provider, tool
- * definitions, and message history for prompt-cache efficiency. Uses the
- * conversation's system prompt when a conversation-specific override is active;
- * otherwise builds a fresh prompt excluding BOOTSTRAP.md so first-run
+ * definitions, and message history for prompt-cache efficiency; the
+ * empty-state greeting targets no real conversation and sends no tools. Uses
+ * the conversation's system prompt when a conversation-specific override is
+ * active; otherwise builds a fresh prompt excluding BOOTSTRAP.md so first-run
  * onboarding instructions don't leak into cosmetic UI calls like identity
  * intro generation. The response is streamed as SSE events (`btw_text_delta`,
  * `btw_complete`, `btw_error`).
@@ -145,7 +146,11 @@ async function handleBtw({
           const result = await runBtwSidechain({
             content: effectiveContent,
             conversation,
-            tools: getAllToolDefinitions(),
+            // The side-chain forces `tool_choice: none`, so tool definitions
+            // only earn their tokens as a shared cache prefix with a real
+            // conversation. The greeting runs against an ephemeral one with its
+            // own system prompt, so it shares nothing and sends no tools.
+            tools: isGreeting ? [] : getAllToolDefinitions(),
             signal: abortSignal,
             ...(isGreeting ? { callSite: "emptyStateGreeting" as const } : {}),
             onEvent: (event) => {

package/src/runtime/routes/identity-routes.ts

@@ -228,7 +228,7 @@ function getIdentity() {
 
   const version = APP_VERSION;
 
-  const createdAt = resolveIdentityCreatedAt(identityPath);
+  const createdAt = resolveHatchedAtReadOnly(identityPath);
 
   return {
     name: fields.name ?? "",
@@ -241,10 +241,6 @@ function getIdentity() {
   };
 }
 
-function resolveIdentityCreatedAt(identityPath: string): string | undefined {
-  return resolveHatchedAtReadOnly(identityPath);
-}
-
 // ---------------------------------------------------------------------------
 // Zod schemas for profiler health metadata
 // ---------------------------------------------------------------------------

package/src/security/secure-keys.ts

@@ -1,22 +1,18 @@
 /**
- * Unified secure key storage — single-backend routing through CredentialBackend
+ * Unified secure key storage: single-backend routing through CredentialBackend
  * adapters.
  *
  * Backend selection (`resolveBackendAsync`) is the single async decision point:
- *   1. CES RPC (primary) - injected via `setCesClient()`: delegates credential
- *      operations to the CES process over Unix socket RPC. This is the default
- *      path for the assistant (which calls startCes() at boot) and for
- *      child processes that lazily connect to the CES socket (see below).
- *   2. Lazy CES RPC connect - non-assistant processes (workers, CLI
- *      subprocesses) that never call startCes(). On first credential
- *      resolution they discover the CES bootstrap socket
- *      (`CES_BOOTSTRAP_SOCKET_DIR`) and cache
- *      the connection.
- *   3. CES HTTP - containerized failover when IPC is unavailable
+ *   1. CES RPC (primary) - connect to the CES bootstrap socket and talk RPC.
+ *      `openCesRpcSession` is the one client constructor. The assistant
+ *      claims session ownership at boot (`startCes`) and hands CES the
+ *      assistant API key. Child processes open a session on first credential
+ *      read only when this process has no client and no reconnect owner.
+ *   2. CES HTTP - containerized failover when IPC is unavailable
  *      (`IS_CONTAINERIZED` + `CES_CREDENTIAL_URL`). Used if the assistant's
  *      bootstrap RPC transport is down, or if a process with HTTP env could
  *      not open the socket.
- *   4. Encrypted file store (fallback) - used when CES is unavailable locally.
+ *   3. Encrypted file store (fallback) - used when CES is unavailable locally.
  *
  * All operations (reads, writes, lists, deletes) go to exactly one backend.
  * There are no cross-store fallbacks or merges. The only transport failover is
@@ -35,14 +31,11 @@ import type {
 
 import { getIsContainerized } from "../config/env-registry.js";
 import {
-  type CesClient,
-  createCesClient,
-} from "../credential-execution/client.js";
+  openCesRpcSession,
+  reconnectCesRpcSession,
+} from "../credential-execution/ces-connect.js";
+import { type CesClient } from "../credential-execution/client.js";
 import { discoverCes } from "../credential-execution/executable-discovery.js";
-import {
-  CesUnavailableError,
-  createCesProcessManager,
-} from "../credential-execution/process-manager.js";
 import { getAnyProviderEnvVar } from "../providers/provider-env-vars.js";
 import { getLogger } from "../util/logger.js";
 import { getProtectedDir } from "../util/platform.js";
@@ -85,11 +78,11 @@ let _resolvedBackend: CredentialBackend | undefined;
 let _resolvePromise: Promise<CredentialBackend> | undefined;
 
 /**
- * In-flight lazy CES connection promise for non-daemon processes.
+ * In-flight CES RPC session promise for processes that did not call startCes().
  *
  * Workers and CLI subprocesses never call startCes(). When they hit
  * resolveBackendAsync() with no _cesClient and no _cesReconnect
- * (daemon-only), this promise memoizes a direct CES connection attempt so
+ * (assistant-boot only), this promise memoizes `openCesRpcSession` so
  * concurrent credential reads in the same process share a single
  * connect+handshake rather than racing.
  */
@@ -206,10 +199,9 @@ function getEncryptedStoreBackend(): CredentialBackend {
  * Resolve the primary credential backend for this process (async).
  *
  * Priority:
- *   1. CES RPC client: primary path in every environment.
- *   2. Lazy CES RPC connect: child processes discover the CES socket.
- *   3. Containerized + CES_CREDENTIAL_URL: CES HTTP, only if IPC is down.
- *   4. Encrypted file store: local fallback when CES is unavailable.
+ *   1. CES RPC: live client, or open one via `openCesRpcSession`.
+ *   2. Containerized + CES_CREDENTIAL_URL: CES HTTP, only if IPC is down.
+ *   3. Encrypted file store: local fallback when CES is unavailable.
  *
  * Once resolved, the backend is cached. If it becomes unavailable (e.g. the
  * CES transport dies), we attempt to reconnect via `_cesReconnect` rather
@@ -415,19 +407,19 @@ export async function attemptCesReconnection(
 }
 
 /**
- * Lazily connect to a CES sibling socket from a non-daemon process.
+ * Open a CES RPC session from a process that did not call startCes().
  *
  * Workers and CLI subprocesses never call startCes(). This function
- * establishes a direct CES connection on first credential resolution,
+ * opens the same `openCesRpcSession` path the assistant uses at boot,
  * memoizing the in-flight promise so concurrent callers share a single
  * connect+handshake. Discovery uses the shared CES bootstrap socket; a
  * missing socket fails immediately so callers can fall through without
  * polling.
  *
  * On success, the client is injected via setCesClient() so subsequent
- * resolveBackendAsync() calls take the fast CES RPC path (step 1). A
- * reconnect callback is also registered so the lazy connection can heal
- * if the transport drops mid-process.
+ * resolveBackendAsync() calls take the live CES RPC path. A reconnect
+ * callback is also registered so the session can heal if the transport
+ * drops mid-process.
  *
  * Returns undefined on any failure (socket not found, handshake rejected,
  * timeout) so the caller falls through to the encrypted file store.
@@ -438,70 +430,30 @@ async function tryLazyCesConnect(): Promise<CesClient | undefined> {
   }
 
   _lazyConnectPromise = (async () => {
-    try {
-      const discovery = discoverCes();
-      if (discovery.mode === "unavailable") {
-        log.info(
-          { reason: discovery.reason },
-          "CES socket not reachable for lazy connect, falling back to encrypted file store",
-        );
-        return undefined;
-      }
-      const pm = createCesProcessManager({});
-      const transport = await pm.start();
-      const client = createCesClient(transport);
-      const { accepted, reason } = await client.handshake();
-      if (!accepted) {
-        log.warn(
-          { reason },
-          "Lazy CES connection handshake rejected — falling back to encrypted file store",
-        );
-        client.close();
-        await pm.stop().catch(() => {});
-        return undefined;
-      }
+    const discovery = discoverCes();
+    if (discovery.mode === "unavailable") {
       log.info(
-        "Lazy CES connection established — credential operations routed through CES RPC",
+        { reason: discovery.reason },
+        "CES socket not reachable for lazy connect, falling back to encrypted file store",
       );
-      setCesClient(client);
-      // Register a reconnect callback so the lazy connection self-heals
-      // if the transport drops, mirroring the daemon's proactive reconnect.
-      setCesReconnect(async () => {
-        try {
-          await pm.stop();
-          const newTransport = await pm.start();
-          const newClient = createCesClient(newTransport);
-          const { accepted: ok } = await newClient.handshake();
-          if (ok) {
-            log.info("Lazy CES reconnection successful");
-            return newClient;
-          }
-          newClient.close();
-          await pm.stop().catch(() => {});
-          return undefined;
-        } catch (err) {
-          log.warn(
-            { error: err instanceof Error ? err.message : String(err) },
-            "Lazy CES reconnection failed",
-          );
-          return undefined;
-        }
-      });
-      return client;
-    } catch (err) {
-      if (err instanceof CesUnavailableError) {
-        log.info(
-          { reason: err.message },
-          "CES socket not reachable for lazy connect — falling back to encrypted file store",
-        );
-      } else {
-        log.warn(
-          { error: err instanceof Error ? err.message : String(err) },
-          "Lazy CES connection failed — falling back to encrypted file store",
-        );
-      }
       return undefined;
     }
+    const session = await openCesRpcSession();
+    if (!session) {
+      return undefined;
+    }
+    log.info(
+      "CES RPC session established; credential operations route through CES RPC",
+    );
+    setCesClient(session.client);
+    setCesReconnect(async () => {
+      const client = await reconnectCesRpcSession(session.processManager);
+      if (client) {
+        log.info("CES RPC reconnection successful");
+      }
+      return client;
+    });
+    return session.client;
   })();
 
   try {
@@ -512,7 +464,10 @@ async function tryLazyCesConnect(): Promise<CesClient | undefined> {
 }
 
 async function doResolveBackend(): Promise<CredentialBackend> {
-  // 1. CES RPC. Primary credential backend in every environment.
+  // 1. CES RPC. Primary credential backend in every environment. Boot
+  //    claims reconnect ownership before it reads handshake identity, so
+  //    that read cannot open a second session. Children open here only
+  //    when this process has no client and no reconnect owner.
   if (_cesClient) {
     const cesRpc = new CesRpcCredentialBackend(_cesClient);
     if (cesRpc.isAvailable()) {
@@ -525,24 +480,19 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     );
   }
 
-  // 2. Lazy CES RPC connect. Child processes never call startCes(). When
-  //    the assistant's setCesReconnect() is NOT registered, attempt a
-  //    direct connection to the CES bootstrap socket. On success, inject
-  //    the client via setCesClient()
-  //    and re-resolve through the CES RPC path. On failure, fall through.
   if (!_cesClient && !_cesReconnect) {
-    const lazyClient = await tryLazyCesConnect();
-    if (lazyClient) {
-      const cesRpc = new CesRpcCredentialBackend(lazyClient);
+    const client = await tryLazyCesConnect();
+    if (client) {
+      const cesRpc = new CesRpcCredentialBackend(client);
       if (cesRpc.isAvailable()) {
         _resolvedBackend = cesRpc;
-        log.info("Resolved credential backend: ces-rpc (lazy connect)");
+        log.info("Resolved credential backend: ces-rpc");
         return cesRpc;
       }
     }
   }
 
-  // 3. CES HTTP. Managed failover when IPC is unavailable.
+  // 2. CES HTTP. Managed failover when IPC is unavailable.
   if (getIsContainerized() && process.env.CES_CREDENTIAL_URL) {
     const ces = createCesCredentialBackend();
     if (ces.isAvailable()) {
@@ -556,7 +506,7 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     );
   }
 
-  // 4. On a containerized pod the local encrypted store does not exist and CES
+  // 3. On a containerized pod the local encrypted store does not exist and CES
   //    owns credentials. Never resolve to the encrypted store here; it would
   //    report a provisioned credential as absent. Return an unreachable backend
   //    (presence indeterminate, which callers retry) WITHOUT caching it, so the
@@ -568,7 +518,7 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     return createUnavailableBackend();
   }
 
-  // 5. Encrypted file store: the legitimate backend for local / self-hosted
+  // 4. Encrypted file store: the legitimate backend for local / self-hosted
   //    mode when CES is unavailable.
   _resolvedBackend = getEncryptedStoreBackend();
   log.info("Resolved credential backend: encrypted-store (local mode)");

package/src/tools/__tests__/tool-schema-root-combinator-guard.test.ts

@@ -0,0 +1,81 @@
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "bun:test";
+
+import { parseToolManifestFile } from "../../skills/tool-manifest.js";
+import { explicitTools } from "../tool-manifest.js";
+
+/**
+ * Tool input schemas must be plain objects at the root.
+ *
+ * Anthropic's Messages API rejects a tool whose `input_schema` carries
+ * `oneOf`, `anyOf`, or `allOf` at the top level ("input_schema does not
+ * support oneOf, allOf, or anyOf at the top level"). The rejection is a 400
+ * for the whole request, so one offending definition takes down every call
+ * that advertises it. Other hosts accept the same schema, which lets the
+ * mistake hide until a request routes to Anthropic directly. Either/or rules
+ * between fields belong in the tool description and the tool's own input
+ * validation instead.
+ *
+ * Covers the core manifest and every bundled skill's `TOOLS.json`.
+ * Combinators nested under `properties` are accepted by Anthropic and stay
+ * out of scope.
+ */
+
+const ROOT_COMBINATORS = ["oneOf", "anyOf", "allOf"] as const;
+
+const BUNDLED_SKILLS_DIR = resolve(
+  dirname(fileURLToPath(import.meta.url)),
+  "../../config/bundled-skills",
+);
+
+interface SchemaCase {
+  /** Tool name, prefixed with the skill directory for bundled skill tools. */
+  label: string;
+  schema: Record<string, unknown>;
+}
+
+function bundledSkillSchemas(): SchemaCase[] {
+  const cases: SchemaCase[] = [];
+  for (const relative of new Bun.Glob("*/TOOLS.json").scanSync({
+    cwd: BUNDLED_SKILLS_DIR,
+  })) {
+    const manifest = parseToolManifestFile(join(BUNDLED_SKILLS_DIR, relative));
+    for (const tool of manifest.tools) {
+      cases.push({
+        label: `${dirname(relative)}/${tool.name}`,
+        schema: tool.input_schema,
+      });
+    }
+  }
+  return cases;
+}
+
+function coreSchemas(): SchemaCase[] {
+  return explicitTools.map((tool) => {
+    if (!tool.name) {
+      throw new Error("core manifest entries carry explicit names");
+    }
+    return {
+      label: tool.name,
+      schema: tool.input_schema as Record<string, unknown>,
+    };
+  });
+}
+
+const CASES: SchemaCase[] = [...coreSchemas(), ...bundledSkillSchemas()];
+
+describe("tool input schema root", () => {
+  test("covers the core manifest and the bundled skills", () => {
+    expect(CASES.length).toBeGreaterThan(explicitTools.length);
+  });
+
+  for (const { label, schema } of CASES) {
+    test(`${label} keeps combinators out of the schema root`, () => {
+      for (const keyword of ROOT_COMBINATORS) {
+        expect(schema).not.toHaveProperty(keyword);
+      }
+      expect(schema.type).toBe("object");
+    });
+  }
+});

package/src/tools/ask-question/ask-question-tool.ts

@@ -124,6 +124,8 @@ const DESCRIPTION = [
   "For logins, use saved credentials first. Securely collect missing credentials",
   "with assistant credentials prompt, then fill the login form yourself.",
   "",
+  "Every call passes exactly one of `questions` or `desktopHelp`.",
+  "",
   "Use this tool whenever a request is ambiguous and can be resolved",
   "by 2–4 plausible interpretations or discrete choices. Prefer it over",
   "plain-text clarification — structured options are faster to answer and",
@@ -255,10 +257,10 @@ export const askQuestionTool = {
   category: "interaction",
   executionTarget: "sandbox",
   defaultRiskLevel: RiskLevel.Low,
-  input_schema: {
-    ...toToolInputSchema(askQuestionInputSchema),
-    oneOf: [{ required: ["questions"] }, { required: ["desktopHelp"] }],
-  },
+  // Anthropic rejects `oneOf` / `anyOf` / `allOf` at the root of a tool
+  // schema, so the either/or rule between `questions` and `desktopHelp` lives
+  // in the description and the Zod refine, not in the wire schema.
+  input_schema: toToolInputSchema(askQuestionInputSchema),
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/document/document-tool.ts

@@ -23,10 +23,6 @@ import {
 } from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
-function isPrivilegedDocumentActor(context: ToolContext): boolean {
-  return canActOnPrivilegedDocuments(context);
-}
-
 export function documentNotFound(surfaceId: string): ToolExecutionResult {
   return {
     content: JSON.stringify({
@@ -43,7 +39,7 @@ export function canAccessDocument(
   context: ToolContext,
 ): boolean {
   return (
-    isPrivilegedDocumentActor(context) ||
+    canActOnPrivilegedDocuments(context) ||
     isDocumentAssociatedWithConversation(surfaceId, context.conversationId)
   );
 }
@@ -522,7 +518,7 @@ export function executeDocumentList(
   const docs = query
     ? searchDocumentsByTitle(
         query,
-        isPrivilegedDocumentActor(context)
+        canActOnPrivilegedDocuments(context)
           ? {}
           : { conversationId: context.conversationId },
       )