@vellumai/assistant 0.6.6 → 0.7.0

package/src/approvals/guardian-decision-primitive.ts

@@ -5,26 +5,22 @@
  * legacy parser, requester self-cancel) call through this module instead of
  * inlining the decision-application logic.  This centralizes:
  *
- *   1. `approve_always` downgrade for guardian-on-behalf requests (time-bounded
- *      modes like `approve_10m` and `approve_conversation` are preserved)
- *   2. Identity validation (actor must match assigned guardian)
- *   3. Approval-info capture before the pending interaction is consumed
- *   4. Atomic decision application via `handleChannelDecision`
- *   5. Guardian approval record update
- *   6. Scoped grant minting on approve
+ *   1. Identity validation (actor must match assigned guardian)
+ *   2. Approval-info capture before the pending interaction is consumed
+ *   3. Atomic decision application via `handleChannelDecision`
+ *   4. Guardian approval record update
+ *   5. Scoped grant minting on approve
  *
  * The canonical path (`applyCanonicalGuardianDecision`) adds:
- *   7. Canonical request lookup and status validation
- *   8. CAS resolution via `resolveCanonicalGuardianRequest`
- *   9. Kind-specific resolver dispatch via the resolver registry
+ *   6. Canonical request lookup and status validation
+ *   7. CAS resolution via `resolveCanonicalGuardianRequest`
+ *   8. Kind-specific resolver dispatch via the resolver registry
  *
  * Security invariants enforced here:
  *   - Decision authorization is purely principal-based:
  *     actor.guardianPrincipalId === request.guardianPrincipalId (strict equality)
  *   - Decisions are first-response-wins (CAS-like stale protection)
- *   - `approve_always` is downgraded to `approve_once` for guardian-on-behalf
- *     requests; time-bounded modes (`approve_10m`, `approve_conversation`) are
- *     preserved since grants are scoped via `scopeMode: "tool_signature"`
+ *   - Only `approve_once` and `reject` are valid actions
  *   - Scoped grant minting only on explicit approve for requests with tool metadata
  */
 
@@ -64,26 +60,13 @@ const log = getLogger("guardian-decision-primitive");
 /** TTL for scoped approval grants minted on guardian approve_once decisions. */
 export const GRANT_TTL_MS = 5 * 60 * 1000;
 
-/** TTL for scoped approval grants minted on guardian approve_10m decisions. */
-export const GRANT_TTL_10M_MS = 10 * 60 * 1000;
-
 /**
  * Compute the grant `expiresAt` timestamp for a given approval action.
  *
- * - `approve_10m` → 10 minutes from now
- * - `approve_conversation` → no wall-clock expiry (far-future sentinel;
- *   conversation lifecycle manages cleanup)
- * - All others (`approve_once`, etc.) → 5 minutes from now (default)
+ * All approvals use the default 5-minute TTL.
  */
-export function computeGrantExpiresAt(action: ApprovalAction): number {
-  switch (action) {
-    case "approve_10m":
-      return Date.now() + GRANT_TTL_10M_MS;
-    case "approve_conversation":
-      return Number.MAX_SAFE_INTEGER;
-    default:
-      return Date.now() + GRANT_TTL_MS;
-  }
+function computeGrantExpiresAt(_action: ApprovalAction): number {
+  return Date.now() + GRANT_TTL_MS;
 }
 
 // ---------------------------------------------------------------------------
@@ -99,15 +82,20 @@ export function computeGrantExpiresAt(action: ApprovalAction): number {
  * Fails silently on error -- grant minting is best-effort and must never block
  * the approval flow.
  */
-export function tryMintToolApprovalGrant(params: {
+function tryMintToolApprovalGrant(params: {
   approvalInfo: PendingApprovalInfo;
   approval: GuardianApprovalRequest;
   decisionChannel: ChannelId;
   guardianExternalUserId: string;
   effectiveAction: ApprovalAction;
 }): void {
-  const { approvalInfo, approval, decisionChannel, guardianExternalUserId, effectiveAction } =
-    params;
+  const {
+    approvalInfo,
+    approval,
+    decisionChannel,
+    guardianExternalUserId,
+    effectiveAction,
+  } = params;
 
   if (!approvalInfo.toolName) {
     return;
@@ -191,19 +179,16 @@ export interface ApplyGuardianDecisionParams {
  * across callback, conversational engine, legacy parser, and requester
  * self-cancel paths:
  *
- *   1. Downgrade `approve_always` to `approve_once` (guardians cannot
- *      permanently allowlist tools on behalf of requesters). Time-bounded
- *      modes (`approve_10m`, `approve_conversation`) are preserved.
- *   2. Capture pending approval info before resolution
- *   3. Apply the decision atomically via `handleChannelDecision`
- *   4. Update the guardian approval record
- *   5. Mint a scoped grant on approve
+ *   1. Capture pending approval info before resolution
+ *   2. Apply the decision atomically via `handleChannelDecision`
+ *   3. Update the guardian approval record
+ *   4. Mint a scoped grant on approve
  *
  * Returns a structured result so callers can handle stale/race outcomes.
  */
-export function applyGuardianDecision(
+export async function applyGuardianDecision(
   params: ApplyGuardianDecisionParams,
-): ApplyGuardianDecisionResult {
+): Promise<ApplyGuardianDecisionResult> {
   const {
     approval,
     decision,
@@ -213,13 +198,7 @@ export function applyGuardianDecision(
     decisionContext,
   } = params;
 
-  // Guardians cannot grant permanent allow modes on behalf of requesters.
-  // Time-bounded modes (approve_10m, approve_conversation) are safe because
-  // grants are scoped to the tool+input signature via scopeMode: "tool_signature".
-  const effectiveDecision: ApprovalDecisionResult =
-    decision.action === "approve_always"
-      ? { ...decision, action: "approve_once" }
-      : decision;
+  const effectiveDecision: ApprovalDecisionResult = decision;
 
   // Capture pending approval info before handleChannelDecision resolves
   // (and removes) the pending interaction. Needed for grant minting.
@@ -229,7 +208,7 @@ export function applyGuardianDecision(
     : approvalInfo[0];
 
   // Apply the decision to the underlying session
-  const result = handleChannelDecision(
+  const result = await handleChannelDecision(
     approval.conversationId,
     effectiveDecision,
     decisionContext,
@@ -297,7 +276,8 @@ export function mintCanonicalRequestGrant(params: {
   guardianExternalUserId?: string;
   effectiveAction: ApprovalAction;
 }): { minted: boolean } {
-  const { request, actorChannel, guardianExternalUserId, effectiveAction } = params;
+  const { request, actorChannel, guardianExternalUserId, effectiveAction } =
+    params;
 
   if (!request.toolName || !request.inputDigest) {
     return { minted: false };
@@ -349,9 +329,6 @@ export function mintCanonicalRequestGrant(params: {
 /** Valid actions for canonical guardian decisions. */
 const VALID_CANONICAL_ACTIONS: ReadonlySet<ApprovalAction> = new Set([
   "approve_once",
-  "approve_10m",
-  "approve_conversation",
-  "approve_always",
   "reject",
 ]);
 
@@ -400,11 +377,9 @@ export type CanonicalDecisionResult =
  * Steps:
  *   1. Look up the canonical request by ID
  *   2. Validate: exists, pending status, identity match, valid action
- *   3. Downgrade `approve_always` to `approve_once` (guardian-on-behalf invariant;
- *      time-bounded modes like `approve_10m`/`approve_conversation` are preserved)
- *   4. CAS resolve the canonical request atomically
- *   5. Dispatch to kind-specific resolver
- *   6. Mint grant if applicable
+ *   3. CAS resolve the canonical request atomically
+ *   4. Dispatch to kind-specific resolver
+ *   5. Mint grant if applicable
  */
 export async function applyCanonicalGuardianDecision(
   params: ApplyCanonicalGuardianDecisionParams,
@@ -521,14 +496,8 @@ export async function applyCanonicalGuardianDecision(
     return { applied: false, reason: "expired" };
   }
 
-  // 3. Downgrade approve_always to approve_once for guardian-on-behalf requests.
-  // Time-bounded modes (approve_10m, approve_conversation) are permitted.
-  const effectiveAction: ApprovalAction =
-    action === "approve_always"
-      ? "approve_once"
-      : action;
-
-  // 4. CAS resolve: atomically transition from 'pending' to terminal status
+  // 3. CAS resolve: atomically transition from 'pending' to terminal status
+  const effectiveAction: ApprovalAction = action;
   const targetStatus: CanonicalRequestStatus =
     effectiveAction === "reject" ? "denied" : "approved";
 
@@ -548,7 +517,7 @@ export async function applyCanonicalGuardianDecision(
     return { applied: false, reason: "already_resolved" };
   }
 
-  // 5. Dispatch to kind-specific resolver
+  // 4. Dispatch to kind-specific resolver
   let resolverFailed = false;
   let resolverFailureReason: string | undefined;
   let resolverReplyText: string | undefined;
@@ -592,7 +561,7 @@ export async function applyCanonicalGuardianDecision(
     );
   }
 
-  // 6. Mint grant if the decision is an approval with tool metadata.
+  // 5. Mint grant if the decision is an approval with tool metadata.
   // Skip when the resolver failed — minting a grant on a failed side effect
   // would allow the tool to execute without the intended resolver action
   // (e.g. answerCall) having succeeded.

package/src/approvals/guardian-request-resolvers.ts

@@ -12,7 +12,6 @@
  */
 
 import { answerCall } from "../calls/call-domain.js";
-import { getGatewayInternalBaseUrl } from "../config/env.js";
 import { findContactChannel } from "../contacts/contact-store.js";
 import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { emitFeedEvent } from "../home/emit-feed-event.js";
@@ -25,16 +24,12 @@ import {
   isNotificationSourceChannel,
   type NotificationSourceChannel,
 } from "../notifications/signal.js";
-import { addRule } from "../permissions/trust-store.js";
 import type { UserDecision } from "../permissions/types.js";
-import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
-import { mintDaemonDeliveryToken } from "../runtime/auth/token-service.js";
 import type { ApprovalAction } from "../runtime/channel-approval-types.js";
 import { createOutboundSession } from "../runtime/channel-verification-service.js";
 import { deliverChannelReply } from "../runtime/gateway-client.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
-import { getTool } from "../tools/registry.js";
 import { TC_GRANT_WAIT_MAX_MS } from "../tools/tool-approval-handler.js";
 import { getLogger } from "../util/logger.js";
 
@@ -78,7 +73,7 @@ export interface ActorContext {
 
 /** The decision being applied. */
 export interface ResolverDecision {
-  /** The effective action after any downgrade (e.g. approve_always -> approve_once). */
+  /** The effective action (approve_once or reject). */
   action: ApprovalAction;
   /** Optional user-supplied text (e.g. answer text for pending questions). */
   userText?: string;
@@ -132,7 +127,7 @@ function resolveDeliverCallbackUrlForChannel(channel: string): string | null {
     case "telegram":
     case "whatsapp":
     case "slack":
-      return `${getGatewayInternalBaseUrl()}/deliver/${channel}`;
+      return `/deliver/${channel}`;
     default:
       return null;
   }
@@ -191,36 +186,6 @@ const pendingInteractionResolver: GuardianRequestResolver = {
       return { ok: false, reason: "pending_interaction_not_found" };
     }
 
-    // Handle approve_always: persist a trust rule when the confirmation
-    // explicitly allows persistence and provides explicit options.
-    if (
-      !isPermissionControlsV2Enabled() &&
-      (decision.action === "approve_always" ||
-        decision.action === "approve_once")
-    ) {
-      const details = interaction.confirmationDetails;
-      if (
-        decision.action === "approve_always" &&
-        details &&
-        details.persistentDecisionsAllowed !== false &&
-        details.allowlistOptions?.length
-      ) {
-        const pattern = details.allowlistOptions[0].pattern;
-        // Non-scoped tools (web_fetch, network_request, etc.) have empty
-        // scopeOptions — default to 'everywhere' so approve_always still
-        // persists a trust rule instead of silently degrading to one-time.
-        const scope = details.scopeOptions?.length
-          ? details.scopeOptions[0].scope
-          : "everywhere";
-        const tool = getTool(details.toolName);
-        const executionTarget =
-          tool?.origin === "skill" ? details.executionTarget : undefined;
-        addRule(details.toolName, pattern, scope, "allow", 100, {
-          executionTarget,
-        });
-      }
-    }
-
     // Resolve the interaction: remove from tracker and get the session.
     const resolved = pendingInteractions.resolve(request.id);
     if (!resolved) {
@@ -236,28 +201,8 @@ const pendingInteractionResolver: GuardianRequestResolver = {
     }
 
     // Map action to the permission system's UserDecision type and notify session.
-    // Mirrors mapApprovalActionToUserDecision from channel-approvals.ts so
-    // temporal modes (approve_10m, approve_conversation) reach the session with
-    // the correct UserDecision instead of collapsing to plain "allow".
-    let userDecision: UserDecision;
-    if (isPermissionControlsV2Enabled()) {
-      userDecision = decision.action === "reject" ? "deny" : "allow";
-    } else {
-      switch (decision.action) {
-        case "reject":
-          userDecision = "deny";
-          break;
-        case "approve_10m":
-          userDecision = "allow_10m";
-          break;
-        case "approve_conversation":
-          userDecision = "allow_conversation";
-          break;
-        default:
-          userDecision = "allow";
-          break;
-      }
-    }
+    const userDecision: UserDecision =
+      decision.action === "reject" ? "deny" : "allow";
     resolved.conversation!.handleConfirmationResponse(
       request.id,
       userDecision,
@@ -274,6 +219,7 @@ const pendingInteractionResolver: GuardianRequestResolver = {
       summary: `${approved ? "Approved" : "Denied"} access to ${request.toolName ?? "unknown tool"}.`,
       dedupKey: `guardian-approval:${request.id}`,
       urgency: approved ? undefined : "medium",
+      detailPanel: { kind: "toolPermission" },
     }).catch((err) => {
       log.warn(
         { err, requestId: request.id },
@@ -416,7 +362,6 @@ const accessRequestResolver: GuardianRequestResolver = {
     const decidedByExternalUserId = ctx.actor.actorExternalUserId ?? "";
     const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
     const desktopDeliverUrl = resolveDeliverCallbackUrlForChannel(channel);
-    const desktopBearerToken = mintDaemonDeliveryToken();
 
     // Resolve display names from the contacts database for enriched payloads
     const requesterContactResult = requesterExternalUserId
@@ -462,7 +407,6 @@ const accessRequestResolver: GuardianRequestResolver = {
           await deliverChannelReply(
             channelDeliveryContext.replyCallbackUrl,
             denialPayload,
-            channelDeliveryContext.bearerToken,
           );
         } catch (err) {
           log.error(
@@ -516,15 +460,11 @@ const accessRequestResolver: GuardianRequestResolver = {
             ? requesterExternalUserId
             : requesterChatId;
         try {
-          await deliverChannelReply(
-            desktopDeliverUrl,
-            {
-              chatId: targetChatId,
-              text: "Your access request has been denied.",
-              assistantId,
-            },
-            desktopBearerToken,
-          );
+          await deliverChannelReply(desktopDeliverUrl, {
+            chatId: targetChatId,
+            text: "Your access request has been denied.",
+            assistantId,
+          });
         } catch (err) {
           log.error(
             { err, requesterChatId },
@@ -539,6 +479,7 @@ const accessRequestResolver: GuardianRequestResolver = {
         summary: `Denied access request.`,
         dedupKey: `guardian-access:${request.id}`,
         urgency: "medium",
+        detailPanel: { kind: "permissionChat" },
       }).catch((err) => {
         log.warn(
           { err, requestId: request.id },
@@ -592,6 +533,7 @@ const accessRequestResolver: GuardianRequestResolver = {
         summary: `Granted access request.`,
         dedupKey: `guardian-access:${request.id}`,
         urgency: undefined,
+        detailPanel: { kind: "permissionChat" },
       }).catch((err) => {
         log.warn(
           { err, requestId: request.id },
@@ -653,7 +595,6 @@ const accessRequestResolver: GuardianRequestResolver = {
         await deliverChannelReply(
           channelDeliveryContext.replyCallbackUrl,
           codePayload,
-          channelDeliveryContext.bearerToken,
         );
       } catch (err) {
         log.error(
@@ -685,15 +626,11 @@ const accessRequestResolver: GuardianRequestResolver = {
         }
 
         try {
-          await deliverChannelReply(
-            dmCallbackUrl,
-            {
-              chatId: guardianUserId,
-              text: codeText,
-              assistantId,
-            },
-            channelDeliveryContext.bearerToken,
-          );
+          await deliverChannelReply(dmCallbackUrl, {
+            chatId: guardianUserId,
+            text: codeText,
+            assistantId,
+          });
         } catch (err) {
           // Best-effort: the code was already delivered in the shared channel
           log.warn(
@@ -737,11 +674,7 @@ const accessRequestResolver: GuardianRequestResolver = {
             approvalPayload.ephemeral = true;
             approvalPayload.user = requesterExternalUserId;
           }
-          await deliverChannelReply(
-            requesterCallbackUrl,
-            approvalPayload,
-            channelDeliveryContext.bearerToken,
-          );
+          await deliverChannelReply(requesterCallbackUrl, approvalPayload);
           requesterNotified = true;
         } catch (err) {
           log.error(
@@ -765,11 +698,7 @@ const accessRequestResolver: GuardianRequestResolver = {
             failurePayload.ephemeral = true;
             failurePayload.user = requesterExternalUserId;
           }
-          await deliverChannelReply(
-            requesterCallbackUrl,
-            failurePayload,
-            channelDeliveryContext.bearerToken,
-          );
+          await deliverChannelReply(requesterCallbackUrl, failurePayload);
         } catch (err) {
           log.error(
             { err, requesterChatId },
@@ -810,17 +739,13 @@ const accessRequestResolver: GuardianRequestResolver = {
           ? requesterExternalUserId
           : requesterChatId;
       try {
-        await deliverChannelReply(
-          desktopDeliverUrl,
-          {
-            chatId: targetChatId,
-            text:
-              "Your access request has been approved! " +
-              "Please enter the 6-digit verification code you receive from the guardian.",
-            assistantId,
-          },
-          desktopBearerToken,
-        );
+        await deliverChannelReply(desktopDeliverUrl, {
+          chatId: targetChatId,
+          text:
+            "Your access request has been approved! " +
+            "Please enter the 6-digit verification code you receive from the guardian.",
+          assistantId,
+        });
         requesterNotified = true;
       } catch (err) {
         log.error(
@@ -840,6 +765,7 @@ const accessRequestResolver: GuardianRequestResolver = {
       summary: `Granted access request.`,
       dedupKey: `guardian-access:${request.id}`,
       urgency: undefined,
+      detailPanel: { kind: "permissionChat" },
     }).catch((err) => {
       log.warn(
         { err, requestId: request.id },
@@ -911,7 +837,6 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
           await deliverChannelReply(
             channelDeliveryContext.replyCallbackUrl,
             grantDenialPayload,
-            channelDeliveryContext.bearerToken,
           );
         } catch (err) {
           log.error(
@@ -927,6 +852,7 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
         summary: `Denied grant request for ${request.toolName ?? "unknown tool"}.`,
         dedupKey: `guardian-grant:${request.id}`,
         urgency: "medium",
+        detailPanel: { kind: "toolPermission" },
       }).catch((err) => {
         log.warn(
           { err, requestId: request.id },
@@ -1022,7 +948,6 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
         await deliverChannelReply(
           channelDeliveryContext.replyCallbackUrl,
           grantApprovalPayload,
-          channelDeliveryContext.bearerToken,
         );
       } catch (err) {
         log.error(
@@ -1038,6 +963,7 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
       summary: `Approved grant request for ${request.toolName ?? "unknown tool"}.`,
       dedupKey: `guardian-grant:${request.id}`,
       urgency: undefined,
+      detailPanel: { kind: "toolPermission" },
     }).catch((err) => {
       log.warn(
         { err, requestId: request.id },

package/src/avatar/character-components.ts

@@ -1,34 +1,34 @@
-export interface BodyShapeDefinition {
+interface BodyShapeDefinition {
   id: string;
   viewBox: { width: number; height: number };
   faceCenter: { x: number; y: number };
   svgPath: string;
 }
 
-export interface EyePathDefinition {
+interface EyePathDefinition {
   svgPath: string;
   color: string; // hex e.g. "#F2F2F2"
 }
 
-export interface EyeStyleDefinition {
+interface EyeStyleDefinition {
   id: string;
   sourceViewBox: { width: number; height: number };
   eyeCenter: { x: number; y: number };
   paths: EyePathDefinition[];
 }
 
-export interface ColorDefinition {
+interface ColorDefinition {
   id: string;
   hex: string; // e.g. "#4C9B50"
 }
 
-export interface FaceCenterOverride {
+interface FaceCenterOverride {
   bodyShape: string;
   eyeStyle: string;
   faceCenter: { x: number; y: number };
 }
 
-export interface CharacterComponents {
+interface CharacterComponents {
   bodyShapes: BodyShapeDefinition[];
   eyeStyles: EyeStyleDefinition[];
   colors: ColorDefinition[];

package/src/{config/bundled-skills/settings/tools → avatar}/identity-avatar.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { getWorkspaceDir } from "../../../../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
 
 /**
  * Update the `## Avatar` section in IDENTITY.md with a plain-text description.

package/src/backup/__tests__/backup-worker.test.ts

@@ -178,8 +178,6 @@ describe("runBackupTick — gating", () => {
       workspaceDir: ROOT,
       localDir,
       snapshotLockPath: join(ROOT, ".snapshot.lock"),
-      // Explicit plaintext to avoid touching the key file
-      trustPath: join(ROOT, "trust.json"),
     });
 
     expect(result).toBeNull();

package/src/backup/__tests__/paths.test.ts

@@ -88,8 +88,9 @@ describe("VELLUM_BACKUP_DIR override", () => {
 describe("deriveSafeAncestor", () => {
   test("iCloud Drive subtree anchors on the iCloud Drive root", () => {
     const iCloudRoot = getICloudDriveRoot();
-    expect(deriveSafeAncestor(join(iCloudRoot, "VellumAssistant", "backups")))
-      .toBe(iCloudRoot);
+    expect(
+      deriveSafeAncestor(join(iCloudRoot, "VellumAssistant", "backups")),
+    ).toBe(iCloudRoot);
     // The default offsite path specifically — this is the regression the
     // feature exists to fix.
     expect(deriveSafeAncestor(getDefaultOffsiteBackupsDir())).toBe(iCloudRoot);

package/src/backup/backup-worker.ts

@@ -26,7 +26,6 @@
  * surface against temp directories with tiny fake bundles.
  */
 
-import { join } from "node:path";
 import { Database } from "bun:sqlite";
 
 import { getConfig } from "../config/loader.js";
@@ -38,11 +37,7 @@ import {
 import type { StreamExportVBundleResult } from "../runtime/migrations/vbundle-builder.js";
 import { streamExportVBundle as realStreamExportVBundle } from "../runtime/migrations/vbundle-builder.js";
 import { getLogger } from "../util/logger.js";
-import {
-  getDbPath,
-  getProtectedDir,
-  getWorkspaceDir,
-} from "../util/platform.js";
+import { getDbPath, getWorkspaceDir } from "../util/platform.js";
 import { ensureBackupKey as realEnsureBackupKey } from "./backup-key.js";
 import type { SnapshotEntry } from "./list-snapshots.js";
 import { pruneLocalSnapshots, writeLocalSnapshot } from "./local-writer.js";
@@ -109,8 +104,6 @@ export interface BackupDeps {
   workspaceDir?: string;
   /** Override for the local backup directory (tests). */
   localDir?: string;
-  /** Override for the trust.json path (tests). */
-  trustPath?: string;
   /** Override for the backup key file path (tests). */
   backupKeyPath?: string;
   /**
@@ -178,7 +171,6 @@ async function performBackup(
   const ensureKey = deps.ensureBackupKey ?? realEnsureBackupKey;
   const workspaceDir = deps.workspaceDir ?? getWorkspaceDir();
   const localDir = deps.localDir ?? getLocalBackupsDir(config.localDirectory);
-  const trustPath = deps.trustPath ?? join(getProtectedDir(), "trust.json");
   const backupKeyPath = deps.backupKeyPath ?? getBackupKeyPath();
 
   const startTimestamp = Date.now();
@@ -195,7 +187,6 @@ async function performBackup(
   // best-effort — the export still proceeds with whatever is on disk.
   const result = await streamExport({
     workspaceDir,
-    trustPath,
     source: "backup-worker",
     description: "Automated backup snapshot",
     checkpoint: () => {

package/src/backup/paths.ts

@@ -8,24 +8,13 @@ import {
 import type { BackupDestination } from "../config/schema.js";
 import { getProtectedDir } from "../util/platform.js";
 
-/**
- * Computes the root ~/.vellum directory without introducing a new export from
- * `platform.ts`. `getProtectedDir()` returns `join(vellumRoot(), "protected")`,
- * so its parent directory is the vellum root. Using `dirname(getProtectedDir())`
- * keeps this module self-contained and avoids expanding the platform.ts surface
- * area just for backups.
- */
-function vellumRootFromProtected(): string {
-  return dirname(getProtectedDir());
-}
-
 /**
  * Returns the backup root directory. Respects the `VELLUM_BACKUP_DIR`
  * environment variable override (used in containerized deployments where
  * backups must be on a persistent volume); falls back to `~/.vellum/backups`.
  */
 export function getBackupRootDir(): string {
-  return getBackupDirOverride() ?? join(vellumRootFromProtected(), "backups");
+  return getBackupDirOverride() ?? join(homedir(), ".vellum", "backups");
 }
 
 /**
@@ -69,12 +58,7 @@ function safeUserInfoHomedir(): string {
  */
 export function getICloudDriveRoot(): string {
   const home = process.env.HOME || safeUserInfoHomedir() || homedir();
-  const root = join(
-    home,
-    "Library",
-    "Mobile Documents",
-    "com~apple~CloudDocs",
-  );
+  const root = join(home, "Library", "Mobile Documents", "com~apple~CloudDocs");
   if (!isAbsolute(root)) {
     throw new Error(
       `getICloudDriveRoot resolved to a relative path: ${root}. ` +