@vellumai/assistant 0.6.6 → 0.7.1

package/src/tools/permission-checker.ts

@@ -1,7 +1,5 @@
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getIsContainerized } from "../config/env-registry.js";
-import { getConfig } from "../config/loader.js";
-import { resolveThreshold } from "../permissions/approval-policy.js";
+import { mapApprovalProvenance } from "../permissions/approval-provenance.js";
 import {
   check,
   classifyRisk,
@@ -11,18 +9,8 @@ import {
 } from "../permissions/checker.js";
 import { getAutoApproveThreshold } from "../permissions/gateway-threshold-reader.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
-import { addRule } from "../permissions/trust-store.js";
+import type { ApprovalMode, ApprovalReason, RiskThreshold } from "../permissions/types.js";
 import { RiskLevel } from "../permissions/types.js";
-import {
-  CONVERSATION_HOST_ACCESS_PROMPT,
-  evaluateV2ConsentDisposition,
-  isConversationHostAccessDecision,
-} from "../permissions/v2-consent-policy.js";
-import {
-  getEffectiveMode,
-  setConversationMode,
-  setTimedMode,
-} from "../runtime/conversation-approval-overrides.js";
 import { getLogger } from "../util/logger.js";
 import { buildPolicyContext } from "./policy-context.js";
 import { isSideEffectTool } from "./side-effects.js";
@@ -37,26 +25,38 @@ export type PermissionDecision =
       decision: string;
       riskLevel: string;
       wasPrompted?: boolean;
+      /** ID of the trust rule that matched this invocation (if any). Always set when a rule matched, even for non-classifier tools where riskMeta is absent. */
+      matchedTrustRuleId?: string;
       /** Risk metadata from the classifier assessment cache (when available). */
       riskMeta?: {
         riskLevel: string;
         riskReason: string;
         riskScopeOptions: Array<{ pattern: string; label: string }>;
+        riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
         isContainerized?: boolean;
       };
+      approvalMode?: ApprovalMode;
+      approvalReason?: ApprovalReason;
+      riskThreshold?: RiskThreshold;
     }
   | {
       allowed: false;
       decision: string;
       riskLevel: string;
       content: string;
+      /** ID of the trust rule that matched this invocation (if any). Always set when a rule matched, even for non-classifier tools where riskMeta is absent. */
+      matchedTrustRuleId?: string;
       /** Risk metadata from the classifier assessment cache (when available). */
       riskMeta?: {
         riskLevel: string;
         riskReason: string;
         riskScopeOptions: Array<{ pattern: string; label: string }>;
+        riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
         isContainerized?: boolean;
       };
+      approvalMode?: ApprovalMode;
+      approvalReason?: ApprovalReason;
+      riskThreshold?: RiskThreshold;
     };
 
 export class PermissionChecker {
@@ -93,31 +93,6 @@ export class PermissionChecker {
         }
       | undefined,
   ): Promise<PermissionDecision> {
-    let v2ForcePrompt = false;
-    const cfg = getConfig();
-    const v2Enabled = isAssistantFeatureFlagEnabled(
-      "permission-controls-v2",
-      cfg,
-    );
-    if (v2Enabled) {
-      const v2Disposition = evaluateV2ConsentDisposition(name, input, context);
-      if (v2Disposition === "auto_allow") {
-        return {
-          allowed: true,
-          decision: "allow",
-          riskLevel: RiskLevel.Low,
-        };
-      }
-      if (v2Disposition === "prompt_host_access") {
-        // Host tool with hostAccess disabled — fall through to v1 so the
-        // interactive prompter is engaged (returning allowed:false here
-        // would surface an error string instead of a permission dialog).
-        // The v2ForcePrompt flag ensures check()'s allow decision is
-        // promoted to prompt so the user sees a permission dialog.
-        v2ForcePrompt = true;
-      }
-    }
-
     const { level: risk, reason: riskReason } = await classifyRisk(
       name,
       input,
@@ -137,6 +112,7 @@ export class PermissionChecker {
           riskLevel: cachedAssessment.riskLevel,
           riskReason: cachedAssessment.reason,
           riskScopeOptions: cachedAssessment.scopeOptions,
+          riskDirectoryScopeOptions: cachedAssessment.directoryScopeOptions,
           isContainerized: getIsContainerized(),
         }
       : undefined;
@@ -156,7 +132,20 @@ export class PermissionChecker {
         context.signal,
       );
 
-      // Private conversations force prompting for side-effect tools even when a
+      // Extract the matched rule ID for propagation. Returned as a top-level
+      // field on PermissionDecision so it reaches the executor even when
+      // riskMeta is absent (non-classifier tools like MCP don't populate it).
+      const matchedTrustRuleId = result.matchedRule?.id;
+
+      // Resolved threshold snapshot for provenance. getAutoApproveThreshold
+      // returns from cache (populated by check() above), so this is free.
+      const conversationThreshold = await getAutoApproveThreshold(
+        policyContext.conversationId,
+        policyContext.executionContext,
+      );
+      const riskThreshold = conversationThreshold as RiskThreshold;
+
+      // Some callers force prompting for side-effect tools even when a
       // trust/allow rule would auto-allow. Deny decisions are preserved -
       // only allow → prompt promotion happens here.
       if (
@@ -165,8 +154,7 @@ export class PermissionChecker {
         isSideEffectTool(name, input)
       ) {
         result.decision = "prompt";
-        result.reason =
-          "Private conversation: side-effect tools require explicit approval";
+        result.reason = "Side-effect tool requires explicit approval";
       }
 
       // requireFreshApproval independently promotes allow → prompt so that
@@ -180,14 +168,6 @@ export class PermissionChecker {
           "Fresh approval required: per-invocation human review enforced";
       }
 
-      // v2 host-access-disabled: the v2 gate fell through because
-      // hostAccess is off. Promote allow → prompt so the user sees an
-      // interactive permission dialog instead of an error string.
-      if (v2ForcePrompt && result.decision === "allow") {
-        result.decision = "prompt";
-        result.reason = "Host access disabled: requires explicit approval";
-      }
-
       if (result.decision === "deny") {
         const durationMs = Date.now() - startTime;
         emitLifecycleEvent({
@@ -200,16 +180,21 @@ export class PermissionChecker {
           requestId: context.requestId,
           riskLevel,
           riskReason,
+          matchedTrustRuleId,
           decision: "deny",
           reason: result.reason,
           durationMs,
         });
+        const provenance = mapApprovalProvenance("denied", { matchedTrustRuleId });
         return {
           allowed: false,
           decision: "denied",
           riskLevel,
           content: result.reason,
+          matchedTrustRuleId,
           riskMeta,
+          ...provenance,
+          riskThreshold,
         };
       }
 
@@ -234,7 +219,10 @@ export class PermissionChecker {
           allowed: true,
           decision: "platform_auto_approve",
           riskLevel,
+          matchedTrustRuleId,
           riskMeta,
+          ...mapApprovalProvenance("platform_auto_approve", {}),
+          riskThreshold,
         };
       }
 
@@ -258,20 +246,15 @@ export class PermissionChecker {
           context.isInteractive === false &&
           context.trustClass === "guardian" &&
           !context.requireFreshApproval &&
-          !isDynamicSkillLoad &&
-          !v2ForcePrompt
+          !isDynamicSkillLoad
         ) {
-          // Use gateway threshold when v3 is enabled, falling back to config.
           // getAutoApproveThreshold returns from cache (populated by check() above).
           // Deferred inside the non-interactive branch so interactive prompts
           // don't pay the gateway I/O cost.
-          const gatewayBgThreshold = await getAutoApproveThreshold(
+          const bgThreshold = await getAutoApproveThreshold(
             context.conversationId,
             "background",
           );
-          const bgThreshold =
-            gatewayBgThreshold ??
-            resolveThreshold(cfg.permissions.autoApproveUpTo, "background");
           const thresholdOrdinal: Record<string, number> = {
             none: -1,
             low: 0,
@@ -295,7 +278,10 @@ export class PermissionChecker {
               allowed: true,
               decision: "guardian_auto_approve",
               riskLevel,
+              matchedTrustRuleId,
               riskMeta,
+              ...mapApprovalProvenance("guardian_auto_approve", {}),
+              riskThreshold: bgThreshold as RiskThreshold,
             };
           }
         }
@@ -318,6 +304,7 @@ export class PermissionChecker {
             requestId: context.requestId,
             riskLevel,
             riskReason,
+            matchedTrustRuleId,
             decision: "deny",
             reason: "Non-interactive session: no client to approve prompt",
             durationMs,
@@ -327,67 +314,26 @@ export class PermissionChecker {
             decision: "denied",
             riskLevel,
             content: `Permission denied: tool "${name}" requires user approval but no interactive client is connected. The tool was not executed. To allow this tool in non-interactive sessions, add a trust rule via permission settings.`,
+            matchedTrustRuleId,
             riskMeta,
-          };
-        }
-
-        // Temporary approval override: if the guardian has enabled a
-        // conversation-scoped "allow all" mode (allow_10m or allow_conversation),
-        // skip the interactive prompt and auto-approve. Only applies to
-        // guardian actors - untrusted actors cannot leverage this to bypass
-        // guardian-required gates (those are enforced in pre-execution gates).
-        // Exception: requireFreshApproval tools must always show the prompt -
-        // cached temporary overrides cannot substitute for per-invocation
-        // human review.
-        if (
-          context.trustClass === "guardian" &&
-          getEffectiveMode(context.conversationId) !== undefined &&
-          !context.requireFreshApproval
-        ) {
-          log.info(
-            {
-              toolName: name,
-              riskLevel,
-              conversationId: context.conversationId,
-            },
-            "Temporary approval override active - auto-approving without prompt",
-          );
-          return {
-            allowed: true,
-            decision: "temporary_override",
-            riskLevel,
-            riskMeta,
+            // Do not pass matchedTrustRuleId here: an ask-rule match put us in
+            // the prompt path, but the *reason* for denial is no interactive
+            // client, not a deny rule. Always emit no_interactive_client.
+            ...mapApprovalProvenance("denied", {}),
+            riskThreshold,
           };
         }
 
         const previewDiff = computePreviewDiff(name, input, context.workingDir);
-        const promptOptions = v2ForcePrompt
-          ? CONVERSATION_HOST_ACCESS_PROMPT
-          : v2Enabled
-            ? {
-                allowlistOptions: [] as Awaited<
-                  ReturnType<typeof generateAllowlistOptions>
-                >,
-                scopeOptions: [] as ReturnType<typeof generateScopeOptions>,
-                persistentDecisionsAllowed: false,
-                temporaryOptionsAvailable: undefined,
-              }
-            : {
-                allowlistOptions: await generateAllowlistOptions(
-                  name,
-                  input,
-                  context.signal,
-                ),
-                scopeOptions: generateScopeOptions(context.workingDir, name),
-                persistentDecisionsAllowed: !context.requireFreshApproval,
-                temporaryOptionsAvailable:
-                  context.trustClass === "guardian" &&
-                  !context.requireFreshApproval
-                    ? (["allow_10m", "allow_conversation"] as Array<
-                        "allow_10m" | "allow_conversation"
-                      >)
-                    : undefined,
-              };
+        const promptOptions = {
+          allowlistOptions: await generateAllowlistOptions(
+            name,
+            input,
+            context.signal,
+          ),
+          scopeOptions: generateScopeOptions(context.workingDir, name),
+          persistentDecisionsAllowed: !context.requireFreshApproval,
+        };
 
         emitLifecycleEvent({
           type: "permission_prompt",
@@ -417,17 +363,13 @@ export class PermissionChecker {
           executionTarget,
           promptOptions.persistentDecisionsAllowed,
           context.signal,
-          promptOptions.temporaryOptionsAvailable,
           context.toolUseId,
-          v2ForcePrompt,
           riskReason,
           getIsContainerized(),
+          cachedAssessment?.directoryScopeOptions,
         );
 
-        const decision =
-          v2ForcePrompt && !isConversationHostAccessDecision(response.decision)
-            ? "deny"
-            : response.decision;
+        const decision = response.decision;
 
         if (decision === "deny") {
           const contextualDenial =
@@ -453,6 +395,7 @@ export class PermissionChecker {
             requestId: context.requestId,
             riskLevel,
             riskReason,
+            matchedTrustRuleId,
             decision: "deny",
             reason: denialReason,
             durationMs,
@@ -462,121 +405,42 @@ export class PermissionChecker {
             decision,
             riskLevel,
             content: denialMessage,
+            matchedTrustRuleId,
             riskMeta,
+            ...mapApprovalProvenance(decision, {
+              wasTimeout: response.wasTimeout,
+              wasSystemCancel: response.wasSystemCancel,
+              wasAbort: response.wasAbort,
+            }),
+            riskThreshold,
           };
         }
 
-        if (decision === "always_deny") {
-          // For non-scoped tools (empty scopeOptions), default to 'everywhere' since
-          // the client has no scope picker and will send undefined.
-          const effectiveDenyScope =
-            promptOptions.scopeOptions.length === 0
-              ? (response.selectedScope ?? "everywhere")
-              : response.selectedScope;
-          const ruleSaved = !!(
-            promptOptions.persistentDecisionsAllowed &&
-            response.selectedPattern &&
-            effectiveDenyScope
-          );
-          if (ruleSaved) {
-            addRule(
-              name,
-              response.selectedPattern!,
-              effectiveDenyScope!,
-              "deny",
-            );
-          }
-          const denialReason = ruleSaved
-            ? "Permission denied by user (rule saved)"
-            : "Permission denied by user";
-          const denialMessage = ruleSaved
-            ? `Permission denied by user, and a rule was saved to always deny the "${name}" tool for this pattern. Do NOT retry this tool call. Inform the user that this action has been permanently blocked by their preference. If the user wants to allow it in the future, they can update their permission rules.`
-            : `Permission denied by user. The user chose not to allow the "${name}" tool. Do NOT retry this tool call immediately. Instead, tell the user that the action was not performed because they denied permission, and ask if they would like you to try again or take a different approach. Wait for the user to explicitly respond before retrying.`;
-          const durationMs = Date.now() - startTime;
-          emitLifecycleEvent({
-            type: "permission_denied",
-            toolName: name,
-            executionTarget,
-            input,
-            workingDir: context.workingDir,
-            conversationId: context.conversationId,
-            requestId: context.requestId,
-            riskLevel,
-            riskReason,
-            decision: "always_deny",
-            reason: denialReason,
-            durationMs,
-          });
-          return {
-            allowed: false,
-            decision,
-            riskLevel,
-            content: denialMessage,
-            riskMeta,
-          };
-        }
-
-        if (
-          promptOptions.persistentDecisionsAllowed &&
-          decision === "always_allow" &&
-          response.selectedPattern
-        ) {
-          const ruleOptions: {
-            executionTarget?: string;
-          } = {};
-
-          if (policyContext?.executionTarget != null) {
-            ruleOptions.executionTarget = policyContext.executionTarget;
-          }
-
-          const hasOptions = Object.keys(ruleOptions).length > 0;
-          // Only default to 'everywhere' for non-scoped tools (empty scopeOptions).
-          // For scoped tools, require an explicit scope to prevent silent permission widening.
-          const effectiveScope =
-            promptOptions.scopeOptions.length === 0
-              ? (response.selectedScope ?? "everywhere")
-              : response.selectedScope;
-          if (effectiveScope) {
-            addRule(
-              name,
-              response.selectedPattern,
-              effectiveScope,
-              "allow",
-              100,
-              hasOptions ? ruleOptions : undefined,
-            );
-          }
-        }
-
-        // Activate temporary approval mode when the user chooses a
-        // time-limited or conversation-scoped override. Subsequent tool
-        // invocations in this conversation will auto-approve without
-        // prompting (checked above in the temporary override block).
-        if (decision === "allow_10m") {
-          setTimedMode(context.conversationId);
-          log.info(
-            { toolName: name, conversationId: context.conversationId },
-            "Activated timed (10m) temporary approval mode",
-          );
-        } else if (decision === "allow_conversation") {
-          setConversationMode(context.conversationId);
-          log.info(
-            { toolName: name, conversationId: context.conversationId },
-            "Activated conversation-scoped temporary approval mode",
-          );
-        }
-
         return {
           allowed: true,
           decision,
           riskLevel,
           wasPrompted: true,
+          matchedTrustRuleId,
           riskMeta,
+          ...mapApprovalProvenance(decision, { wasPrompted: true }),
+          riskThreshold,
         };
       }
 
       // result.decision === 'allow'
-      return { allowed: true, decision: "allow", riskLevel, riskMeta };
+      return {
+        allowed: true,
+        decision: "allow",
+        riskLevel,
+        matchedTrustRuleId,
+        riskMeta,
+        ...mapApprovalProvenance("allow", {
+          hasSandboxAutoApprove: result.hasSandboxAutoApprove,
+          matchedTrustRuleId,
+        }),
+        riskThreshold,
+      };
     } catch (err) {
       if (err instanceof Error) {
         (err as Error & { riskLevel?: string }).riskLevel = riskLevel;

package/src/tools/policy-context.ts

@@ -1,6 +1,5 @@
 import type { ExecutionContext } from "../permissions/approval-policy.js";
 import type { PolicyContext } from "../permissions/types.js";
-import { getTaskRunRules } from "../tasks/ephemeral-permissions.js";
 import type { Tool, ToolContext } from "./types.js";
 
 /**
@@ -28,25 +27,19 @@ export function buildPolicyContext(
   tool: Tool,
   context?: ToolContext,
 ): PolicyContext {
-  const ephemeralRules = context?.taskRunId
-    ? getTaskRunRules(context.taskRunId)
-    : undefined;
-
   const executionContext = deriveExecutionContext(context);
 
   const conversationId = context?.conversationId;
 
-  if (tool.origin === "skill") {
+  if (tool.origin === "skill" || tool.origin === "plugin") {
     return {
       executionTarget: tool.executionTarget,
-      ephemeralRules: ephemeralRules?.length ? ephemeralRules : undefined,
       executionContext,
       conversationId,
     };
   }
 
   return {
-    ephemeralRules: ephemeralRules?.length ? ephemeralRules : undefined,
     executionContext,
     conversationId,
   };

package/src/tools/registry.ts

@@ -5,6 +5,7 @@ import { registerAppTools } from "./apps/registry.js";
 import { allComputerUseTools } from "./computer-use/definitions.js";
 import { hostFileEditTool } from "./host-filesystem/edit.js";
 import { hostFileReadTool } from "./host-filesystem/read.js";
+import { hostFileTransferTool } from "./host-filesystem/transfer.js";
 import { hostFileWriteTool } from "./host-filesystem/write.js";
 import { hostShellTool } from "./host-terminal/host-shell.js";
 import { registerSystemTools } from "./system/register.js";
@@ -54,7 +55,7 @@ export function registerExternalTools(
 }
 
 /** Return all externally registered tools. */
-export function getExternalTools(): Tool[] {
+function getExternalTools(): Tool[] {
   return externalToolProviders.flatMap((provider) => provider());
 }
 
@@ -181,6 +182,8 @@ export function registerPluginTools(
     ownerPluginId: pluginName,
     ownerSkillId: undefined,
     ownerMcpServerId: undefined,
+    ownerSkillBundled: undefined,
+    ownerSkillVersionHash: undefined,
   }));
 
   const accepted: Tool[] = [];
@@ -436,6 +439,7 @@ export async function initializeTools(): Promise<void> {
     hostFileReadTool,
     hostFileWriteTool,
     hostFileEditTool,
+    hostFileTransferTool,
     hostShellTool,
   ];
   for (const tool of hostTools) {
@@ -517,3 +521,14 @@ export function __clearRegistryForTesting(): void {
   skillRefCount.clear();
   pluginRefCount.clear();
 }
+
+/**
+ * Drop every registered external-tool provider. Exposed exclusively for
+ * tests that want to verify a single `registerExternalTools()` call in
+ * isolation — the provider array otherwise accumulates across cases
+ * because ESM import caching prevents re-running the tool-manifest
+ * bootstrap.
+ */
+export function __clearExternalToolProvidersForTesting(): void {
+  externalToolProviders.length = 0;
+}

package/src/tools/shared/shell-output.ts

@@ -57,7 +57,10 @@ export function formatShellOutput(
   if (output.length > MAX_OUTPUT_LENGTH) {
     let fullOutputPath: string | undefined;
     try {
-      fullOutputPath = join(tmpdir(), `vellum-shell-output-${randomUUID()}.txt`);
+      fullOutputPath = join(
+        tmpdir(),
+        `vellum-shell-output-${randomUUID()}.txt`,
+      );
       writeFileSync(fullOutputPath, output, { encoding: "utf-8", mode: 0o600 });
       trackedTempFiles.add(fullOutputPath);
     } catch {

package/src/tools/side-effects.ts

@@ -1,8 +1,8 @@
 // Side-effect tool classification - single source of truth.
 // Tools that modify state outside the assistant (filesystem writes,
 // shell commands, network requests that trigger actions, etc.).
-// Used by private-conversation gating and permission simulation to decide
-// whether a tool invocation requires explicit approval.
+// Used by permission simulation and forced approval paths to decide whether
+// a tool invocation requires explicit approval.
 
 const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
   "file_write",

package/src/tools/skills/execute.ts

@@ -3,7 +3,7 @@ import type { ToolDefinition } from "../../providers/types.js";
 import { registerTool } from "../registry.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
-export class SkillExecuteTool implements Tool {
+class SkillExecuteTool implements Tool {
   name = "skill_execute";
   description =
     "Execute a tool provided by a loaded skill. Use this instead of calling skill tools directly. The skill's instructions (from skill_load) describe available tools and their parameters. For browser automation, use the `assistant browser` CLI commands instead.";

package/src/tools/skills/sandbox-runner.ts

@@ -6,7 +6,6 @@ import { join, resolve } from "node:path";
 import { computeSkillVersionHash } from "../../skills/version-hash.js";
 import { safeStringSlice } from "../../util/unicode.js";
 import { buildSanitizedEnv } from "../terminal/safe-env.js";
-import { wrapCommand } from "../terminal/sandbox.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -138,12 +137,8 @@ function spawnRunner(
     const stderrChunks: Buffer[] = [];
     let timedOut = false;
 
-    // The assistant runs exclusively in Docker or platform-managed
-    // environments where the container provides isolation.
-    const sandboxConfig = { enabled: false } as const;
-
     const bunRunCmd = "bun run __skill_runner.ts";
-    const wrapped = wrapCommand(bunRunCmd, runDir, sandboxConfig);
+    const wrapped = { command: "bash", args: ["-c", "--", bunRunCmd] };
 
     const env = buildSanitizedEnv();
     env.__SKILL_INPUT_JSON = JSON.stringify(input);

package/src/tools/skills/skill-tool-factory.ts

@@ -15,6 +15,31 @@ const riskMap: Record<SkillToolEntry["risk"], RiskLevel> = {
   high: RiskLevel.High,
 };
 
+/**
+ * Validate that all keys in `input` are declared in the tool's input_schema
+ * properties. Returns an error result listing unknown parameters, or undefined
+ * if validation passes.
+ */
+function validateNoUnknownParams(
+  toolName: string,
+  input: Record<string, unknown>,
+  schema: SkillToolEntry["input_schema"],
+): ToolExecutionResult | undefined {
+  const properties = schema?.properties;
+  if (!properties) return undefined;
+
+  const knownKeys = new Set(Object.keys(properties));
+  const unknownKeys = Object.keys(input).filter((k) => !knownKeys.has(k));
+  if (unknownKeys.length === 0) return undefined;
+
+  const listed = unknownKeys.map((k) => `"${k}"`).join(", ");
+  const supported = [...knownKeys].map((k) => `"${k}"`).join(", ");
+  return {
+    content: `Unknown parameter${unknownKeys.length > 1 ? "s" : ""} ${listed} for tool "${toolName}". Supported parameters: ${supported}. Remove unsupported parameters and retry.`,
+    isError: true,
+  };
+}
+
 /**
  * Create a runtime Tool object from a manifest entry.
  * Maps SkillToolEntry metadata to the Tool interface and routes execution
@@ -50,6 +75,13 @@ export function createSkillTool(
       input: Record<string, unknown>,
       context: ToolContext,
     ): Promise<ToolExecutionResult> {
+      const validationError = validateNoUnknownParams(
+        entry.name,
+        input,
+        entry.input_schema,
+      );
+      if (validationError) return validationError;
+
       return runSkillToolScript(skillDir, entry.executor, input, context, {
         target: entry.execution_target,
         expectedSkillVersionHash: versionHash,