@vellumai/assistant 0.6.6 → 0.7.0

package/src/tools/permission-checker.ts

@@ -1,7 +1,4 @@
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getIsContainerized } from "../config/env-registry.js";
-import { getConfig } from "../config/loader.js";
-import { resolveThreshold } from "../permissions/approval-policy.js";
 import {
   check,
   classifyRisk,
@@ -11,18 +8,7 @@ import {
 } from "../permissions/checker.js";
 import { getAutoApproveThreshold } from "../permissions/gateway-threshold-reader.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
-import { addRule } from "../permissions/trust-store.js";
 import { RiskLevel } from "../permissions/types.js";
-import {
-  CONVERSATION_HOST_ACCESS_PROMPT,
-  evaluateV2ConsentDisposition,
-  isConversationHostAccessDecision,
-} from "../permissions/v2-consent-policy.js";
-import {
-  getEffectiveMode,
-  setConversationMode,
-  setTimedMode,
-} from "../runtime/conversation-approval-overrides.js";
 import { getLogger } from "../util/logger.js";
 import { buildPolicyContext } from "./policy-context.js";
 import { isSideEffectTool } from "./side-effects.js";
@@ -42,6 +28,7 @@ export type PermissionDecision =
         riskLevel: string;
         riskReason: string;
         riskScopeOptions: Array<{ pattern: string; label: string }>;
+        riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
         isContainerized?: boolean;
       };
     }
@@ -55,6 +42,7 @@ export type PermissionDecision =
         riskLevel: string;
         riskReason: string;
         riskScopeOptions: Array<{ pattern: string; label: string }>;
+        riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
         isContainerized?: boolean;
       };
     };
@@ -93,31 +81,6 @@ export class PermissionChecker {
         }
       | undefined,
   ): Promise<PermissionDecision> {
-    let v2ForcePrompt = false;
-    const cfg = getConfig();
-    const v2Enabled = isAssistantFeatureFlagEnabled(
-      "permission-controls-v2",
-      cfg,
-    );
-    if (v2Enabled) {
-      const v2Disposition = evaluateV2ConsentDisposition(name, input, context);
-      if (v2Disposition === "auto_allow") {
-        return {
-          allowed: true,
-          decision: "allow",
-          riskLevel: RiskLevel.Low,
-        };
-      }
-      if (v2Disposition === "prompt_host_access") {
-        // Host tool with hostAccess disabled — fall through to v1 so the
-        // interactive prompter is engaged (returning allowed:false here
-        // would surface an error string instead of a permission dialog).
-        // The v2ForcePrompt flag ensures check()'s allow decision is
-        // promoted to prompt so the user sees a permission dialog.
-        v2ForcePrompt = true;
-      }
-    }
-
     const { level: risk, reason: riskReason } = await classifyRisk(
       name,
       input,
@@ -137,6 +100,7 @@ export class PermissionChecker {
           riskLevel: cachedAssessment.riskLevel,
           riskReason: cachedAssessment.reason,
           riskScopeOptions: cachedAssessment.scopeOptions,
+          riskDirectoryScopeOptions: cachedAssessment.directoryScopeOptions,
           isContainerized: getIsContainerized(),
         }
       : undefined;
@@ -156,7 +120,7 @@ export class PermissionChecker {
         context.signal,
       );
 
-      // Private conversations force prompting for side-effect tools even when a
+      // Some callers force prompting for side-effect tools even when a
       // trust/allow rule would auto-allow. Deny decisions are preserved -
       // only allow → prompt promotion happens here.
       if (
@@ -165,8 +129,7 @@ export class PermissionChecker {
         isSideEffectTool(name, input)
       ) {
         result.decision = "prompt";
-        result.reason =
-          "Private conversation: side-effect tools require explicit approval";
+        result.reason = "Side-effect tool requires explicit approval";
       }
 
       // requireFreshApproval independently promotes allow → prompt so that
@@ -180,14 +143,6 @@ export class PermissionChecker {
           "Fresh approval required: per-invocation human review enforced";
       }
 
-      // v2 host-access-disabled: the v2 gate fell through because
-      // hostAccess is off. Promote allow → prompt so the user sees an
-      // interactive permission dialog instead of an error string.
-      if (v2ForcePrompt && result.decision === "allow") {
-        result.decision = "prompt";
-        result.reason = "Host access disabled: requires explicit approval";
-      }
-
       if (result.decision === "deny") {
         const durationMs = Date.now() - startTime;
         emitLifecycleEvent({
@@ -258,20 +213,15 @@ export class PermissionChecker {
           context.isInteractive === false &&
           context.trustClass === "guardian" &&
           !context.requireFreshApproval &&
-          !isDynamicSkillLoad &&
-          !v2ForcePrompt
+          !isDynamicSkillLoad
         ) {
-          // Use gateway threshold when v3 is enabled, falling back to config.
           // getAutoApproveThreshold returns from cache (populated by check() above).
           // Deferred inside the non-interactive branch so interactive prompts
           // don't pay the gateway I/O cost.
-          const gatewayBgThreshold = await getAutoApproveThreshold(
+          const bgThreshold = await getAutoApproveThreshold(
             context.conversationId,
             "background",
           );
-          const bgThreshold =
-            gatewayBgThreshold ??
-            resolveThreshold(cfg.permissions.autoApproveUpTo, "background");
           const thresholdOrdinal: Record<string, number> = {
             none: -1,
             low: 0,
@@ -331,63 +281,16 @@ export class PermissionChecker {
           };
         }
 
-        // Temporary approval override: if the guardian has enabled a
-        // conversation-scoped "allow all" mode (allow_10m or allow_conversation),
-        // skip the interactive prompt and auto-approve. Only applies to
-        // guardian actors - untrusted actors cannot leverage this to bypass
-        // guardian-required gates (those are enforced in pre-execution gates).
-        // Exception: requireFreshApproval tools must always show the prompt -
-        // cached temporary overrides cannot substitute for per-invocation
-        // human review.
-        if (
-          context.trustClass === "guardian" &&
-          getEffectiveMode(context.conversationId) !== undefined &&
-          !context.requireFreshApproval
-        ) {
-          log.info(
-            {
-              toolName: name,
-              riskLevel,
-              conversationId: context.conversationId,
-            },
-            "Temporary approval override active - auto-approving without prompt",
-          );
-          return {
-            allowed: true,
-            decision: "temporary_override",
-            riskLevel,
-            riskMeta,
-          };
-        }
-
         const previewDiff = computePreviewDiff(name, input, context.workingDir);
-        const promptOptions = v2ForcePrompt
-          ? CONVERSATION_HOST_ACCESS_PROMPT
-          : v2Enabled
-            ? {
-                allowlistOptions: [] as Awaited<
-                  ReturnType<typeof generateAllowlistOptions>
-                >,
-                scopeOptions: [] as ReturnType<typeof generateScopeOptions>,
-                persistentDecisionsAllowed: false,
-                temporaryOptionsAvailable: undefined,
-              }
-            : {
-                allowlistOptions: await generateAllowlistOptions(
-                  name,
-                  input,
-                  context.signal,
-                ),
-                scopeOptions: generateScopeOptions(context.workingDir, name),
-                persistentDecisionsAllowed: !context.requireFreshApproval,
-                temporaryOptionsAvailable:
-                  context.trustClass === "guardian" &&
-                  !context.requireFreshApproval
-                    ? (["allow_10m", "allow_conversation"] as Array<
-                        "allow_10m" | "allow_conversation"
-                      >)
-                    : undefined,
-              };
+        const promptOptions = {
+          allowlistOptions: await generateAllowlistOptions(
+            name,
+            input,
+            context.signal,
+          ),
+          scopeOptions: generateScopeOptions(context.workingDir, name),
+          persistentDecisionsAllowed: !context.requireFreshApproval,
+        };
 
         emitLifecycleEvent({
           type: "permission_prompt",
@@ -417,17 +320,13 @@ export class PermissionChecker {
           executionTarget,
           promptOptions.persistentDecisionsAllowed,
           context.signal,
-          promptOptions.temporaryOptionsAvailable,
           context.toolUseId,
-          v2ForcePrompt,
           riskReason,
           getIsContainerized(),
+          cachedAssessment?.directoryScopeOptions,
         );
 
-        const decision =
-          v2ForcePrompt && !isConversationHostAccessDecision(response.decision)
-            ? "deny"
-            : response.decision;
+        const decision = response.decision;
 
         if (decision === "deny") {
           const contextualDenial =
@@ -466,106 +365,6 @@ export class PermissionChecker {
           };
         }
 
-        if (decision === "always_deny") {
-          // For non-scoped tools (empty scopeOptions), default to 'everywhere' since
-          // the client has no scope picker and will send undefined.
-          const effectiveDenyScope =
-            promptOptions.scopeOptions.length === 0
-              ? (response.selectedScope ?? "everywhere")
-              : response.selectedScope;
-          const ruleSaved = !!(
-            promptOptions.persistentDecisionsAllowed &&
-            response.selectedPattern &&
-            effectiveDenyScope
-          );
-          if (ruleSaved) {
-            addRule(
-              name,
-              response.selectedPattern!,
-              effectiveDenyScope!,
-              "deny",
-            );
-          }
-          const denialReason = ruleSaved
-            ? "Permission denied by user (rule saved)"
-            : "Permission denied by user";
-          const denialMessage = ruleSaved
-            ? `Permission denied by user, and a rule was saved to always deny the "${name}" tool for this pattern. Do NOT retry this tool call. Inform the user that this action has been permanently blocked by their preference. If the user wants to allow it in the future, they can update their permission rules.`
-            : `Permission denied by user. The user chose not to allow the "${name}" tool. Do NOT retry this tool call immediately. Instead, tell the user that the action was not performed because they denied permission, and ask if they would like you to try again or take a different approach. Wait for the user to explicitly respond before retrying.`;
-          const durationMs = Date.now() - startTime;
-          emitLifecycleEvent({
-            type: "permission_denied",
-            toolName: name,
-            executionTarget,
-            input,
-            workingDir: context.workingDir,
-            conversationId: context.conversationId,
-            requestId: context.requestId,
-            riskLevel,
-            riskReason,
-            decision: "always_deny",
-            reason: denialReason,
-            durationMs,
-          });
-          return {
-            allowed: false,
-            decision,
-            riskLevel,
-            content: denialMessage,
-            riskMeta,
-          };
-        }
-
-        if (
-          promptOptions.persistentDecisionsAllowed &&
-          decision === "always_allow" &&
-          response.selectedPattern
-        ) {
-          const ruleOptions: {
-            executionTarget?: string;
-          } = {};
-
-          if (policyContext?.executionTarget != null) {
-            ruleOptions.executionTarget = policyContext.executionTarget;
-          }
-
-          const hasOptions = Object.keys(ruleOptions).length > 0;
-          // Only default to 'everywhere' for non-scoped tools (empty scopeOptions).
-          // For scoped tools, require an explicit scope to prevent silent permission widening.
-          const effectiveScope =
-            promptOptions.scopeOptions.length === 0
-              ? (response.selectedScope ?? "everywhere")
-              : response.selectedScope;
-          if (effectiveScope) {
-            addRule(
-              name,
-              response.selectedPattern,
-              effectiveScope,
-              "allow",
-              100,
-              hasOptions ? ruleOptions : undefined,
-            );
-          }
-        }
-
-        // Activate temporary approval mode when the user chooses a
-        // time-limited or conversation-scoped override. Subsequent tool
-        // invocations in this conversation will auto-approve without
-        // prompting (checked above in the temporary override block).
-        if (decision === "allow_10m") {
-          setTimedMode(context.conversationId);
-          log.info(
-            { toolName: name, conversationId: context.conversationId },
-            "Activated timed (10m) temporary approval mode",
-          );
-        } else if (decision === "allow_conversation") {
-          setConversationMode(context.conversationId);
-          log.info(
-            { toolName: name, conversationId: context.conversationId },
-            "Activated conversation-scoped temporary approval mode",
-          );
-        }
-
         return {
           allowed: true,
           decision,

package/src/tools/policy-context.ts

@@ -1,6 +1,5 @@
 import type { ExecutionContext } from "../permissions/approval-policy.js";
 import type { PolicyContext } from "../permissions/types.js";
-import { getTaskRunRules } from "../tasks/ephemeral-permissions.js";
 import type { Tool, ToolContext } from "./types.js";
 
 /**
@@ -28,25 +27,19 @@ export function buildPolicyContext(
   tool: Tool,
   context?: ToolContext,
 ): PolicyContext {
-  const ephemeralRules = context?.taskRunId
-    ? getTaskRunRules(context.taskRunId)
-    : undefined;
-
   const executionContext = deriveExecutionContext(context);
 
   const conversationId = context?.conversationId;
 
-  if (tool.origin === "skill") {
+  if (tool.origin === "skill" || tool.origin === "plugin") {
     return {
       executionTarget: tool.executionTarget,
-      ephemeralRules: ephemeralRules?.length ? ephemeralRules : undefined,
       executionContext,
       conversationId,
     };
   }
 
   return {
-    ephemeralRules: ephemeralRules?.length ? ephemeralRules : undefined,
     executionContext,
     conversationId,
   };

package/src/tools/registry.ts

@@ -5,6 +5,7 @@ import { registerAppTools } from "./apps/registry.js";
 import { allComputerUseTools } from "./computer-use/definitions.js";
 import { hostFileEditTool } from "./host-filesystem/edit.js";
 import { hostFileReadTool } from "./host-filesystem/read.js";
+import { hostFileTransferTool } from "./host-filesystem/transfer.js";
 import { hostFileWriteTool } from "./host-filesystem/write.js";
 import { hostShellTool } from "./host-terminal/host-shell.js";
 import { registerSystemTools } from "./system/register.js";
@@ -54,7 +55,7 @@ export function registerExternalTools(
 }
 
 /** Return all externally registered tools. */
-export function getExternalTools(): Tool[] {
+function getExternalTools(): Tool[] {
   return externalToolProviders.flatMap((provider) => provider());
 }
 
@@ -181,6 +182,8 @@ export function registerPluginTools(
     ownerPluginId: pluginName,
     ownerSkillId: undefined,
     ownerMcpServerId: undefined,
+    ownerSkillBundled: undefined,
+    ownerSkillVersionHash: undefined,
   }));
 
   const accepted: Tool[] = [];
@@ -436,6 +439,7 @@ export async function initializeTools(): Promise<void> {
     hostFileReadTool,
     hostFileWriteTool,
     hostFileEditTool,
+    hostFileTransferTool,
     hostShellTool,
   ];
   for (const tool of hostTools) {
@@ -517,3 +521,14 @@ export function __clearRegistryForTesting(): void {
   skillRefCount.clear();
   pluginRefCount.clear();
 }
+
+/**
+ * Drop every registered external-tool provider. Exposed exclusively for
+ * tests that want to verify a single `registerExternalTools()` call in
+ * isolation — the provider array otherwise accumulates across cases
+ * because ESM import caching prevents re-running the tool-manifest
+ * bootstrap.
+ */
+export function __clearExternalToolProvidersForTesting(): void {
+  externalToolProviders.length = 0;
+}

package/src/tools/secret-detection-handler.ts

@@ -1,7 +1,6 @@
 import { getConfig } from "../config/loader.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { RiskLevel } from "../permissions/types.js";
-import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import type { SecretPattern } from "../security/secret-scanner.js";
 import {
   compileCustomPatterns,
@@ -231,12 +230,12 @@ export class SecretDetectionHandler {
 
   private async handlePrompt(
     allMatches: Array<{ type: string; redactedValue: string }>,
-    execResult: ToolExecutionResult,
+    _execResult: ToolExecutionResult,
     name: string,
     input: Record<string, unknown>,
     context: ToolContext,
     executionTarget: ExecutionTarget,
-    riskLevel: string,
+    _riskLevel: string,
     _decision: string,
     startTime: number,
     emitLifecycleEvent: (
@@ -245,115 +244,26 @@ export class SecretDetectionHandler {
     ) => void,
   ): Promise<{ result: ToolExecutionResult; earlyReturn: boolean }> {
     const types = [...new Set(allMatches.map((m) => m.type))].join(", ");
-
-    if (isPermissionControlsV2Enabled()) {
-      const blockedContent = `Tool output blocked: detected ${allMatches.length} potential secret(s) (${types}). Secret-output approval cards are disabled under v2. Ask the user for confirmation conversationally before retrying.`;
-      const durationMs = Date.now() - startTime;
-
-      emitLifecycleEvent(context, {
-        type: "permission_denied",
-        toolName: name,
-        executionTarget,
-        input,
-        workingDir: context.workingDir,
-        conversationId: context.conversationId,
-        requestId: context.requestId,
-        riskLevel: RiskLevel.High,
-        decision: "deny",
-        reason: "Secret output blocked without deterministic prompt under v2",
-        durationMs,
-      });
-
-      return {
-        result: { content: blockedContent, isError: true },
-        earlyReturn: true,
-      };
-    }
-
-    // Non-interactive sessions: auto-block secret output instead of waiting for prompt
-    if (context.isInteractive === false) {
-      const blockedContent = `Tool output blocked: detected ${allMatches.length} potential secret(s) (${types}). No interactive client available to approve.`;
-      const durationMs = Date.now() - startTime;
-
-      emitLifecycleEvent(context, {
-        type: "permission_denied",
-        toolName: name,
-        executionTarget,
-        input,
-        workingDir: context.workingDir,
-        conversationId: context.conversationId,
-        requestId: context.requestId,
-        riskLevel: RiskLevel.High,
-        decision: "deny",
-        reason: "Non-interactive session: auto-blocked secret output",
-        durationMs,
-      });
-
-      return {
-        result: { content: blockedContent, isError: true },
-        earlyReturn: true,
-      };
-    }
-
-    const promptInput = {
-      _secretDetection: true,
-      summary: `Tool output contains ${allMatches.length} potential secret(s): ${types}`,
-      tool: name,
-    };
+    const blockedContent = `Tool output blocked: detected ${allMatches.length} potential secret(s) (${types}). Ask the user for confirmation conversationally before retrying.`;
+    const durationMs = Date.now() - startTime;
 
     emitLifecycleEvent(context, {
-      type: "permission_prompt",
+      type: "permission_denied",
       toolName: name,
       executionTarget,
-      input: promptInput,
+      input,
       workingDir: context.workingDir,
       conversationId: context.conversationId,
       requestId: context.requestId,
       riskLevel: RiskLevel.High,
-      reason: `Secret detected in tool output: ${types}`,
-      allowlistOptions: [],
-      scopeOptions: [],
-      persistentDecisionsAllowed: false,
+      decision: "deny",
+      reason: "Secret output blocked without deterministic prompt",
+      durationMs,
     });
 
-    const response = await this.prompter.prompt(
-      name,
-      promptInput,
-      RiskLevel.High,
-      [], // no allowlist options
-      [], // no scope options
-      undefined, // no diff
-      context.conversationId,
-      executionTarget,
-      false, // no persistent decisions
-      context.signal,
-    );
-
-    if (response.decision === "deny" || response.decision === "always_deny") {
-      const blockedContent = `Tool output blocked: user denied output containing ${allMatches.length} potential secret(s) (${types}).`;
-      const durationMs = Date.now() - startTime;
-
-      emitLifecycleEvent(context, {
-        type: "permission_denied",
-        toolName: name,
-        executionTarget,
-        input,
-        workingDir: context.workingDir,
-        conversationId: context.conversationId,
-        requestId: context.requestId,
-        riskLevel: RiskLevel.High,
-        decision: response.decision === "always_deny" ? "always_deny" : "deny",
-        reason: `User denied output containing secrets: ${types}`,
-        durationMs,
-      });
-
-      return {
-        result: { content: blockedContent, isError: true },
-        earlyReturn: true,
-      };
-    }
-
-    // User allowed - pass content through unchanged
-    return { result: execResult, earlyReturn: false };
+    return {
+      result: { content: blockedContent, isError: true },
+      earlyReturn: true,
+    };
   }
 }

package/src/tools/shared/shell-output.ts

@@ -57,7 +57,10 @@ export function formatShellOutput(
   if (output.length > MAX_OUTPUT_LENGTH) {
     let fullOutputPath: string | undefined;
     try {
-      fullOutputPath = join(tmpdir(), `vellum-shell-output-${randomUUID()}.txt`);
+      fullOutputPath = join(
+        tmpdir(),
+        `vellum-shell-output-${randomUUID()}.txt`,
+      );
       writeFileSync(fullOutputPath, output, { encoding: "utf-8", mode: 0o600 });
       trackedTempFiles.add(fullOutputPath);
     } catch {

package/src/tools/side-effects.ts

@@ -1,8 +1,8 @@
 // Side-effect tool classification - single source of truth.
 // Tools that modify state outside the assistant (filesystem writes,
 // shell commands, network requests that trigger actions, etc.).
-// Used by private-conversation gating and permission simulation to decide
-// whether a tool invocation requires explicit approval.
+// Used by permission simulation and forced approval paths to decide whether
+// a tool invocation requires explicit approval.
 
 const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
   "file_write",

package/src/tools/skills/execute.ts

@@ -3,7 +3,7 @@ import type { ToolDefinition } from "../../providers/types.js";
 import { registerTool } from "../registry.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
-export class SkillExecuteTool implements Tool {
+class SkillExecuteTool implements Tool {
   name = "skill_execute";
   description =
     "Execute a tool provided by a loaded skill. Use this instead of calling skill tools directly. The skill's instructions (from skill_load) describe available tools and their parameters. For browser automation, use the `assistant browser` CLI commands instead.";

package/src/tools/subagent/spawn.ts

@@ -1,4 +1,8 @@
+import { findConversation } from "../../daemon/conversation-store.js";
+import { getConversationOverrideProfile } from "../../memory/conversation-crud.js";
+import type { Message } from "../../providers/types.js";
 import { getSubagentManager } from "../../subagent/index.js";
+import type { SubagentRole } from "../../subagent/types.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
 export async function executeSubagentSpawn(
@@ -36,21 +40,21 @@ export async function executeSubagentSpawn(
   }
 
   // ── Fork mode: resolve parent context ────────────────────────────
-  let forkFields: {
-    fork: true;
-    parentMessages: import("../../providers/types.js").Message[];
-    parentSystemPrompt: string;
-  } | undefined;
+  let forkFields:
+    | {
+        fork: true;
+        parentMessages: Message[];
+        parentSystemPrompt: string;
+      }
+    | undefined;
 
   if (fork) {
-    const parentConversation = manager.resolveParentConversation?.(
-      context.conversationId,
-    );
+    const parentConversation = findConversation(context.conversationId);
     if (!parentConversation) {
       return {
         content:
           "Cannot fork: parent conversation could not be resolved. " +
-          "This may happen if the conversation was evicted or the resolveParentConversation callback is not wired.",
+          "This may happen if the conversation was evicted.",
         isError: true,
       };
     }
@@ -65,6 +69,25 @@ export async function executeSubagentSpawn(
     };
   }
 
+  // The subagent runs as its own background conversation, so the agent
+  // loop's background-skip rule would zero out any inherited profile.
+  // Pass the parent's profile explicitly via `SubagentConfig` so the
+  // PR 6 plumbing in `SubagentManager.spawn` forwards it back into the
+  // subagent's `runAgentLoop` call as `options.overrideProfile`.
+  //
+  // Prefer the per-turn `context.overrideProfile` (populated by
+  // `runAgentLoopImpl` from its resolved `turnOverrideProfile`) over a
+  // row read so nested spawns inherit correctly. The current subagent's
+  // own conversation row never has `inferenceProfile` set — its override
+  // arrived via in-memory `SubagentConfig.overrideProfile` — and even if it
+  // were set, `getConversationOverrideProfile` short-circuits for
+  // background conversations and returns `undefined`. Falling back to the
+  // row read preserves behavior for tool calls that originate outside an
+  // agent-loop turn.
+  const inheritedOverrideProfile =
+    context.overrideProfile ??
+    getConversationOverrideProfile(context.conversationId);
+
   try {
     const subagentId = await manager.spawn(
       {
@@ -75,8 +98,9 @@ export async function executeSubagentSpawn(
         sendResultToUser,
         // For fork mode, role is ignored by the manager (forced to general),
         // but we still omit it from the config to signal intent.
-        ...(!fork && role
-          ? { role: role as import("../../subagent/types.js").SubagentRole }
+        ...(!fork && role ? { role: role as SubagentRole } : {}),
+        ...(inheritedOverrideProfile
+          ? { overrideProfile: inheritedOverrideProfile }
           : {}),
         ...forkFields,
       },