@vellumai/assistant 0.4.26 → 0.4.30

package/src/tools/filesystem/view-image.ts

@@ -1,16 +1,20 @@
-import { execFileSync } from 'node:child_process';
-import { readFileSync, statSync, unlinkSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { extname, join } from 'node:path';
+import { execFileSync } from "node:child_process";
+import { readFileSync, statSync, unlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { extname, join } from "node:path";
 
-import { RiskLevel } from '../../permissions/types.js';
-import type { ImageContent, ToolDefinition } from '../../providers/types.js';
-import { registerTool } from '../registry.js';
-import { sandboxPolicy } from '../shared/filesystem/path-policy.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
+import { RiskLevel } from "../../permissions/types.js";
+import type { ImageContent, ToolDefinition } from "../../providers/types.js";
+import { registerTool } from "../registry.js";
+import { sandboxPolicy } from "../shared/filesystem/path-policy.js";
+import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
 const SUPPORTED_EXTENSIONS = new Set([
-  '.jpg', '.jpeg', '.png', '.gif', '.webp',
+  ".jpg",
+  ".jpeg",
+  ".png",
+  ".gif",
+  ".webp",
 ]);
 
 const MAX_SIZE_BYTES = 20 * 1024 * 1024; // 20 MB
@@ -29,23 +33,39 @@ function detectMediaType(buf: Buffer): string | null {
   if (buf.length < 12) return null;
 
   // JPEG: FF D8 FF
-  if (buf[0] === 0xFF && buf[1] === 0xD8 && buf[2] === 0xFF) {
-    return 'image/jpeg';
+  if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {
+    return "image/jpeg";
   }
   // PNG: 89 50 4E 47 0D 0A 1A 0A
-  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4E && buf[3] === 0x47) {
-    return 'image/png';
+  if (
+    buf[0] === 0x89 &&
+    buf[1] === 0x50 &&
+    buf[2] === 0x4e &&
+    buf[3] === 0x47
+  ) {
+    return "image/png";
   }
   // GIF: 47 49 46 38
-  if (buf[0] === 0x47 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x38) {
-    return 'image/gif';
+  if (
+    buf[0] === 0x47 &&
+    buf[1] === 0x49 &&
+    buf[2] === 0x46 &&
+    buf[3] === 0x38
+  ) {
+    return "image/gif";
   }
   // WebP: RIFF....WEBP
   if (
-    buf[0] === 0x52 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x46 &&
-    buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50
+    buf[0] === 0x52 &&
+    buf[1] === 0x49 &&
+    buf[2] === 0x46 &&
+    buf[3] === 0x46 &&
+    buf[8] === 0x57 &&
+    buf[9] === 0x45 &&
+    buf[10] === 0x42 &&
+    buf[11] === 0x50
   ) {
-    return 'image/webp';
+    return "image/webp";
   }
 
   return null;
@@ -58,13 +78,23 @@ function detectMediaType(buf: Buffer): string | null {
 function optimizeWithSips(srcPath: string): string | null {
   const tmpPath = join(tmpdir(), `vellum-view-image-${Date.now()}.jpg`);
   try {
-    execFileSync('sips', [
-      '--resampleHeightWidthMax', String(OPTIMIZE_MAX_DIMENSION),
-      '-s', 'format', 'jpeg',
-      '-s', 'formatOptions', String(OPTIMIZE_JPEG_QUALITY),
-      srcPath,
-      '--out', tmpPath,
-    ], { stdio: 'pipe', timeout: 15_000 });
+    execFileSync(
+      "sips",
+      [
+        "--resampleHeightWidthMax",
+        String(OPTIMIZE_MAX_DIMENSION),
+        "-s",
+        "format",
+        "jpeg",
+        "-s",
+        "formatOptions",
+        String(OPTIMIZE_JPEG_QUALITY),
+        srcPath,
+        "--out",
+        tmpPath,
+      ],
+      { stdio: "pipe", timeout: 15_000 },
+    );
     return tmpPath;
   } catch {
     return null;
@@ -72,10 +102,10 @@ function optimizeWithSips(srcPath: string): string | null {
 }
 
 class ViewImageTool implements Tool {
-  name = 'view_image';
+  name = "view_image";
   description =
-    'Read an image file from the filesystem and return it for visual analysis. Supports JPEG, PNG, GIF, and WebP.';
-  category = 'filesystem';
+    "Read an image file from the filesystem and return it for visual analysis. Supports JPEG, PNG, GIF, and WebP.";
+  category = "filesystem";
   defaultRiskLevel = RiskLevel.Low;
 
   getDefinition(): ToolDefinition {
@@ -83,15 +113,20 @@ class ViewImageTool implements Tool {
       name: this.name,
       description: this.description,
       input_schema: {
-        type: 'object',
+        type: "object",
         properties: {
           path: {
-            type: 'string',
+            type: "string",
+            description:
+              "The path to the image file (absolute or relative to working directory)",
+          },
+          reason: {
+            type: "string",
             description:
-              'The path to the image file (absolute or relative to working directory)',
+              "Brief non-technical explanation of what you are viewing and why, shown to the user as a status update. Use simple language a non-technical person would understand.",
           },
         },
-        required: ['path'],
+        required: ["path"],
       },
     };
   }
@@ -101,8 +136,11 @@ class ViewImageTool implements Tool {
     context: ToolContext,
   ): Promise<ToolExecutionResult> {
     const rawPath = input.path as string;
-    if (!rawPath || typeof rawPath !== 'string') {
-      return { content: 'Error: path is required and must be a string', isError: true };
+    if (!rawPath || typeof rawPath !== "string") {
+      return {
+        content: "Error: path is required and must be a string",
+        isError: true,
+      };
     }
 
     const pathCheck = sandboxPolicy(rawPath, context.workingDir);
@@ -113,7 +151,7 @@ class ViewImageTool implements Tool {
 
     const ext = extname(resolved).toLowerCase();
     if (!SUPPORTED_EXTENSIONS.has(ext)) {
-      const supported = [...SUPPORTED_EXTENSIONS].join(', ');
+      const supported = [...SUPPORTED_EXTENSIONS].join(", ");
       return {
         content: `Error: unsupported image format "${ext}". Supported: ${supported}`,
         isError: true,
@@ -160,7 +198,11 @@ class ViewImageTool implements Tool {
       return { content: `Error reading file: ${msg}`, isError: true };
     } finally {
       if (tmpPath) {
-        try { unlinkSync(tmpPath); } catch { /* ignore cleanup errors */ }
+        try {
+          unlinkSync(tmpPath);
+        } catch {
+          /* ignore cleanup errors */
+        }
       }
     }
 
@@ -174,20 +216,22 @@ class ViewImageTool implements Tool {
       };
     }
 
-    const base64Data = buffer.toString('base64');
+    const base64Data = buffer.toString("base64");
 
     const imageBlock: ImageContent = {
-      type: 'image' as const,
+      type: "image" as const,
       source: {
-        type: 'base64' as const,
+        type: "base64" as const,
         media_type: detectedType,
         data: base64Data,
       },
     };
 
     const sizeSuffix = optimized
-      ? ` (optimized from ${(stat.size / 1024).toFixed(0)} KB to ${(buffer.length / 1024).toFixed(0)} KB)`
-      : '';
+      ? ` (optimized from ${(stat.size / 1024).toFixed(0)} KB to ${(
+          buffer.length / 1024
+        ).toFixed(0)} KB)`
+      : "";
 
     return {
       content: `Image loaded: ${resolved} (${buffer.length} bytes, ${detectedType})${sizeSuffix}`,

package/src/tools/filesystem/write.ts

@@ -1,15 +1,15 @@
-import { RiskLevel } from '../../permissions/types.js';
-import type { ToolDefinition } from '../../providers/types.js';
-import { registerTool } from '../registry.js';
-import { FileSystemOps } from '../shared/filesystem/file-ops-service.js';
-import { formatWriteSummary } from '../shared/filesystem/format-diff.js';
-import { sandboxPolicy } from '../shared/filesystem/path-policy.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
+import { RiskLevel } from "../../permissions/types.js";
+import type { ToolDefinition } from "../../providers/types.js";
+import { registerTool } from "../registry.js";
+import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
+import { formatWriteSummary } from "../shared/filesystem/format-diff.js";
+import { sandboxPolicy } from "../shared/filesystem/path-policy.js";
+import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
 class FileWriteTool implements Tool {
-  name = 'file_write';
-  description = 'Write content to a file, creating it if it does not exist';
-  category = 'filesystem';
+  name = "file_write";
+  description = "Write content to a file, creating it if it does not exist";
+  category = "filesystem";
   defaultRiskLevel = RiskLevel.Medium;
 
   getDefinition(): ToolDefinition {
@@ -17,59 +17,80 @@ class FileWriteTool implements Tool {
       name: this.name,
       description: this.description,
       input_schema: {
-        type: 'object',
+        type: "object",
         properties: {
           path: {
-            type: 'string',
-            description: 'The path to the file to write (absolute or relative to working directory)',
+            type: "string",
+            description:
+              "The path to the file to write (absolute or relative to working directory)",
           },
           content: {
-            type: 'string',
-            description: 'The content to write to the file',
+            type: "string",
+            description: "The content to write to the file",
           },
           reason: {
-            type: 'string',
-            description: 'Brief human-readable explanation of why this file is being written, shown to the user in the permission prompt',
+            type: "string",
+            description:
+              "Brief non-technical explanation of why this file is being written, shown to the user as a status update. Use simple language a non-technical person would understand.",
           },
         },
-        required: ['path', 'content', 'reason'],
+        required: ["path", "content", "reason"],
       },
     };
   }
 
-  async execute(input: Record<string, unknown>, context: ToolContext): Promise<ToolExecutionResult> {
+  async execute(
+    input: Record<string, unknown>,
+    context: ToolContext,
+  ): Promise<ToolExecutionResult> {
     const rawPath = input.path as string;
-    if (!rawPath || typeof rawPath !== 'string') {
-      return { content: 'Error: path is required and must be a string', isError: true };
+    if (!rawPath || typeof rawPath !== "string") {
+      return {
+        content: "Error: path is required and must be a string",
+        isError: true,
+      };
     }
 
     const fileContent = input.content;
-    if (typeof fileContent !== 'string') {
-      return { content: 'Error: content is required and must be a string', isError: true };
+    if (typeof fileContent !== "string") {
+      return {
+        content: "Error: content is required and must be a string",
+        isError: true,
+      };
     }
 
-    const ops = new FileSystemOps(
-      (path, opts) => sandboxPolicy(path, context.workingDir, opts),
+    const ops = new FileSystemOps((path, opts) =>
+      sandboxPolicy(path, context.workingDir, opts),
     );
 
     const result = ops.writeFileSafe({ path: rawPath, content: fileContent });
 
     if (!result.ok) {
       const { error } = result;
-      if (error.code === 'IO_ERROR') {
+      if (error.code === "IO_ERROR") {
         const msg = error.message;
-        const hint = msg.includes('ENOENT') ? ' (parent directory does not exist)'
-          : msg.includes('EACCES') ? ' (permission denied)'
-          : msg.includes('EROFS') ? ' (read-only file system)'
-          : '';
-        return { content: `Error writing file "${rawPath}"${hint}: ${msg}`, isError: true };
+        const hint = msg.includes("ENOENT")
+          ? " (parent directory does not exist)"
+          : msg.includes("EACCES")
+            ? " (permission denied)"
+            : msg.includes("EROFS")
+              ? " (read-only file system)"
+              : "";
+        return {
+          content: `Error writing file "${rawPath}"${hint}: ${msg}`,
+          isError: true,
+        };
       }
       return { content: `Error: ${error.message}`, isError: true };
     }
 
     const { filePath, oldContent, newContent, isNewFile } = result.value;
     return {
-      content: `Successfully wrote to ${filePath} ${formatWriteSummary(oldContent, newContent, isNewFile)}`,
+      content: `Successfully wrote to ${filePath} ${formatWriteSummary(
+        oldContent,
+        newContent,
+        isNewFile,
+      )}`,
       isError: false,
       diff: { filePath, oldContent, newContent, isNewFile },
     };

package/src/tools/followups/followup_create.ts

@@ -1,7 +1,8 @@
-import { getContact } from '../../contacts/contact-store.js';
-import { createFollowUp } from '../../followups/followup-store.js';
-import type { FollowUp } from '../../followups/types.js';
-import type { ToolContext, ToolExecutionResult } from '../types.js';
+import { getContact } from "../../contacts/contact-store.js";
+import { createFollowUp } from "../../followups/followup-store.js";
+import type { FollowUp } from "../../followups/types.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../../runtime/assistant-scope.js";
+import type { ToolContext, ToolExecutionResult } from "../types.js";
 
 function formatFollowUp(f: FollowUp): string {
   const lines = [
@@ -13,10 +14,13 @@ function formatFollowUp(f: FollowUp): string {
   ];
   if (f.contactId) lines.push(`  Contact ID: ${f.contactId}`);
   if (f.expectedResponseBy) {
-    lines.push(`  Expected response by: ${new Date(f.expectedResponseBy).toISOString()}`);
+    lines.push(
+      `  Expected response by: ${new Date(f.expectedResponseBy).toISOString()}`,
+    );
   }
-  if (f.reminderScheduleId) lines.push(`  Reminder schedule: ${f.reminderScheduleId}`);
-  return lines.join('\n');
+  if (f.reminderScheduleId)
+    lines.push(`  Reminder schedule: ${f.reminderScheduleId}`);
+  return lines.join("\n");
 }
 
 export async function executeFollowupCreate(
@@ -24,30 +28,52 @@ export async function executeFollowupCreate(
   _context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const channel = input.channel as string | undefined;
-  if (!channel || typeof channel !== 'string' || channel.trim().length === 0) {
-    return { content: 'Error: channel is required and must be a non-empty string', isError: true };
+  if (!channel || typeof channel !== "string" || channel.trim().length === 0) {
+    return {
+      content: "Error: channel is required and must be a non-empty string",
+      isError: true,
+    };
   }
 
   const threadId = input.thread_id as string | undefined;
-  if (!threadId || typeof threadId !== 'string' || threadId.trim().length === 0) {
-    return { content: 'Error: thread_id is required and must be a non-empty string', isError: true };
+  if (
+    !threadId ||
+    typeof threadId !== "string" ||
+    threadId.trim().length === 0
+  ) {
+    return {
+      content: "Error: thread_id is required and must be a non-empty string",
+      isError: true,
+    };
   }
 
   const contactId = input.contact_id as string | undefined;
-  const expectedResponseHours = input.expected_response_hours as number | undefined;
+  const expectedResponseHours = input.expected_response_hours as
+    | number
+    | undefined;
   // Canonical: reminder_schedule_id; deprecated alias: reminder_cron_id
-  const reminderScheduleId = (input.reminder_schedule_id ?? input.reminder_cron_id) as string | undefined;
+  const reminderScheduleId = (input.reminder_schedule_id ??
+    input.reminder_cron_id) as string | undefined;
 
   // Validate contact exists if provided
   if (contactId) {
-    const contact = getContact(contactId);
+    const contact = getContact(contactId, DAEMON_INTERNAL_ASSISTANT_ID);
     if (!contact) {
-      return { content: `Error: Contact "${contactId}" not found`, isError: true };
+      return {
+        content: `Error: Contact "${contactId}" not found`,
+        isError: true,
+      };
     }
   }
 
-  if (expectedResponseHours !== undefined && (typeof expectedResponseHours !== 'number' || expectedResponseHours <= 0)) {
-    return { content: 'Error: expected_response_hours must be a positive number', isError: true };
+  if (
+    expectedResponseHours !== undefined &&
+    (typeof expectedResponseHours !== "number" || expectedResponseHours <= 0)
+  ) {
+    return {
+      content: "Error: expected_response_hours must be a positive number",
+      isError: true,
+    };
   }
 
   try {

package/src/tools/followups/followup_list.ts

@@ -1,19 +1,26 @@
-import { getOverdueFollowUps,listFollowUps } from '../../followups/followup-store.js';
-import type { FollowUp, FollowUpStatus } from '../../followups/types.js';
-import type { ToolContext, ToolExecutionResult } from '../types.js';
+import {
+  getOverdueFollowUps,
+  listFollowUps,
+} from "../../followups/followup-store.js";
+import type { FollowUp, FollowUpStatus } from "../../followups/types.js";
+import type { ToolContext, ToolExecutionResult } from "../types.js";
 
-const VALID_STATUSES = ['pending', 'resolved', 'overdue', 'nudged'] as const;
+const VALID_STATUSES = ["pending", "resolved", "overdue", "nudged"] as const;
 
 function formatFollowUpSummary(f: FollowUp): string {
   const parts = [`- **${f.channel}** thread:${f.threadId} (ID: ${f.id})`];
-  parts.push(`  Status: ${f.status} | Sent: ${new Date(f.sentAt).toISOString()}`);
+  parts.push(
+    `  Status: ${f.status} | Sent: ${new Date(f.sentAt).toISOString()}`,
+  );
   if (f.contactId) parts.push(`  Contact: ${f.contactId}`);
   if (f.expectedResponseBy) {
     const deadline = new Date(f.expectedResponseBy);
-    const isOverdue = f.status === 'pending' && deadline.getTime() < Date.now();
-    parts.push(`  Expected by: ${deadline.toISOString()}${isOverdue ? ' (OVERDUE)' : ''}`);
+    const isOverdue = f.status === "pending" && deadline.getTime() < Date.now();
+    parts.push(
+      `  Expected by: ${deadline.toISOString()}${isOverdue ? " (OVERDUE)" : ""}`,
+    );
   }
-  return parts.join('\n');
+  return parts.join("\n");
 }
 
 export async function executeFollowupList(
@@ -25,9 +32,14 @@ export async function executeFollowupList(
   const contactId = input.contact_id as string | undefined;
   const overdueOnly = input.overdue_only as boolean | undefined;
 
-  if (status && !VALID_STATUSES.includes(status as typeof VALID_STATUSES[number])) {
+  if (
+    status &&
+    !VALID_STATUSES.includes(status as (typeof VALID_STATUSES)[number])
+  ) {
     return {
-      content: `Error: Invalid status "${status}". Must be one of: ${VALID_STATUSES.join(', ')}`,
+      content: `Error: Invalid status "${status}". Must be one of: ${VALID_STATUSES.join(
+        ", ",
+      )}`,
       isError: true,
     };
   }
@@ -35,7 +47,7 @@ export async function executeFollowupList(
   try {
     let results: FollowUp[];
 
-    if (overdueOnly || status === 'overdue') {
+    if (overdueOnly || status === "overdue") {
       results = getOverdueFollowUps();
       if (channel) results = results.filter((f) => f.channel === channel);
       if (contactId) results = results.filter((f) => f.contactId === contactId);
@@ -44,7 +56,10 @@ export async function executeFollowupList(
     }
 
     if (results.length === 0) {
-      return { content: 'No follow-ups found matching the criteria.', isError: false };
+      return {
+        content: "No follow-ups found matching the criteria.",
+        isError: false,
+      };
     }
 
     const lines = [`Found ${results.length} follow-up(s):\n`];
@@ -52,7 +67,7 @@ export async function executeFollowupList(
       lines.push(formatFollowUpSummary(followUp));
     }
 
-    return { content: lines.join('\n'), isError: false };
+    return { content: lines.join("\n"), isError: false };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { content: `Error: ${msg}`, isError: true };

package/src/tools/followups/followup_resolve.ts

@@ -1,6 +1,9 @@
-import { resolveByThread,resolveFollowUp } from '../../followups/followup-store.js';
-import type { FollowUp } from '../../followups/types.js';
-import type { ToolContext, ToolExecutionResult } from '../types.js';
+import {
+  resolveByThread,
+  resolveFollowUp,
+} from "../../followups/followup-store.js";
+import type { FollowUp } from "../../followups/types.js";
+import type { ToolContext, ToolExecutionResult } from "../types.js";
 
 function formatFollowUp(f: FollowUp): string {
   const lines = [
@@ -10,7 +13,7 @@ function formatFollowUp(f: FollowUp): string {
     `  Status: ${f.status}`,
   ];
   if (f.contactId) lines.push(`  Contact ID: ${f.contactId}`);
-  return lines.join('\n');
+  return lines.join("\n");
 }
 
 export async function executeFollowupResolve(
@@ -23,7 +26,7 @@ export async function executeFollowupResolve(
 
   if (!id && !(channel && threadId)) {
     return {
-      content: 'Error: Either id or both channel and thread_id are required',
+      content: "Error: Either id or both channel and thread_id are required",
       isError: true,
     };
   }
@@ -43,7 +46,7 @@ export async function executeFollowupResolve(
           isError: false,
         };
       }
-      const summaries = resolved.map(formatFollowUp).join('\n\n');
+      const summaries = resolved.map(formatFollowUp).join("\n\n");
       return {
         content: `Resolved ${resolved.length} follow-up(s):\n${summaries}`,
         isError: false,

package/src/tools/guardian-control-plane-policy.ts

@@ -12,11 +12,11 @@
  */
 
 const GUARDIAN_ENDPOINT_PATHS = [
-  '/v1/integrations/guardian/challenge',
-  '/v1/integrations/guardian/status',
-  '/v1/integrations/guardian/outbound/start',
-  '/v1/integrations/guardian/outbound/resend',
-  '/v1/integrations/guardian/outbound/cancel',
+  "/v1/integrations/guardian/challenge",
+  "/v1/integrations/guardian/status",
+  "/v1/integrations/guardian/outbound/start",
+  "/v1/integrations/guardian/outbound/resend",
+  "/v1/integrations/guardian/outbound/cancel",
 ] as const;
 
 /**
@@ -27,10 +27,10 @@ const GUARDIAN_ENDPOINT_PATHS = [
 const GUARDIAN_PATH_REGEX = /\/v1\/integrations\/guardian\//;
 
 /** Tools whose `input.command` (string) may contain guardian endpoint paths. */
-const COMMAND_TOOLS = new Set(['bash', 'host_bash']);
+const COMMAND_TOOLS = new Set(["bash", "host_bash"]);
 
 /** Tools whose `input.url` (string) may contain guardian endpoint paths. */
-const URL_TOOLS = new Set(['network_request', 'web_fetch', 'browser_navigate']);
+const URL_TOOLS = new Set(["network_request", "web_fetch", "browser_navigate"]);
 
 /**
  * Normalize a string to defeat common URL obfuscation techniques before matching:
@@ -43,7 +43,7 @@ function normalizeForMatching(value: string): string {
   // Iteratively decode percent-encoding to handle double-encoding (%252F → %2F → /)
   // Use per-sequence replacement instead of decodeURIComponent to avoid a single
   // malformed sequence (e.g. %ZZ) preventing all other valid sequences from decoding.
-  let prev = '';
+  let prev = "";
   while (prev !== normalized) {
     prev = normalized;
     normalized = normalized.replace(/%[0-9a-fA-F]{2}/g, (match) => {
@@ -55,7 +55,7 @@ function normalizeForMatching(value: string): string {
     });
   }
   // Collapse consecutive slashes (but preserve the double slash in protocol e.g. https://)
-  normalized = normalized.replace(/(?<!:)\/{2,}/g, '/');
+  normalized = normalized.replace(/(?<!:)\/{2,}/g, "/");
   return normalized.toLowerCase();
 }
 
@@ -86,7 +86,7 @@ function containsGuardianEndpointPath(value: string): boolean {
  */
 function containsGuardianFragments(command: string): boolean {
   const lower = command.toLowerCase();
-  return lower.includes('/v1/integrations') && lower.includes('guardian');
+  return lower.includes("/v1/integrations") && lower.includes("guardian");
 }
 
 /**
@@ -99,7 +99,7 @@ export function isGuardianControlPlaneInvocation(
 ): boolean {
   if (COMMAND_TOOLS.has(toolName)) {
     const command = input.command;
-    if (typeof command === 'string') {
+    if (typeof command === "string") {
       // Primary: exact/normalized path matching
       if (containsGuardianEndpointPath(command)) return true;
       // Fallback: detect shell-expanded construction of guardian paths
@@ -109,7 +109,7 @@ export function isGuardianControlPlaneInvocation(
 
   if (URL_TOOLS.has(toolName)) {
     const url = input.url;
-    if (typeof url === 'string' && containsGuardianEndpointPath(url)) {
+    if (typeof url === "string" && containsGuardianEndpointPath(url)) {
       return true;
     }
   }
@@ -130,12 +130,13 @@ export function enforceGuardianOnlyPolicy(
     return { denied: false };
   }
 
-  if (trustClass === 'guardian') {
+  if (trustClass === "guardian") {
     return { denied: false };
   }
 
   return {
     denied: true,
-    reason: 'Guardian verification control-plane actions are restricted to guardian users. This is a security restriction \u2014 please wait for the designated guardian to perform this action.',
+    reason:
+      "Guardian verification control-plane actions are restricted to guardian users. This is a security restriction \u2014 please wait for the designated guardian to perform this action.",
   };
 }