@vellumai/assistant 0.7.3 → 0.8.1

package/AGENTS.md

@@ -34,6 +34,17 @@ Routes in `src/runtime/routes/` are being migrated to a **shared `ROUTES` array*
 - **Dual exposure is intentional.** Every route in the shared `ROUTES` array is served over both HTTP and IPC. This is by design — it enables the gateway to call the daemon over IPC instead of HTTP, eliminating JWT token exchange on those paths (ATL-309 → ATL-311). Do not flag IPC exposure of shared routes as unintentional surface area.
 - **`RouteDefinition` carries everything:** `operationId`, `endpoint`, `method`, `handler`, `policyKey?`, `summary?`, `description?`, `tags?`, `responseBody?`. The HTTP adapter reads all fields; the IPC adapter only needs `operationId` and `handler`.
 
+### CLI ↔ daemon communication protocol
+
+The CLI and daemon communicate over a Unix domain socket using **length-prefixed binary framing**: each frame is a 4-byte big-endian length followed by a payload. Messages use a JSON envelope `{ id, method, params?, headers? }` for requests and `{ id, result?, error?, headers? }` for responses.
+
+Three response shapes are supported:
+- **JSON-only**: a single JSON frame (no `content-length` or `transfer-encoding` header).
+- **Binary**: a JSON envelope with `headers: { "content-length": "<n>" }` followed by one binary frame of exactly `n` bytes.
+- **Chunked streaming**: a JSON envelope with `headers: { "transfer-encoding": "chunked" }` followed by one or more binary frames, terminated by a zero-length frame.
+
+The server auto-detects legacy newline-delimited JSON from old CLI clients and handles it transparently. New code must use length-prefixed framing via `writeMessage()` / `IpcFrameReader` in `src/ipc/ipc-framing.ts`.
+
 ### CLI ↔ daemon version skew
 
 The CLI and daemon are always shipped and upgraded together — there is no version skew between them. When migrating a route to the shared `ROUTES` array and updating the CLI to send structured params, backward compatibility with older CLI versions is **not required**. Do not add compat shims for flat-param callers that no longer exist.

package/ARCHITECTURE.md

@@ -1278,7 +1278,7 @@ graph TB
 - Managed-store writes are atomic (tmp file + rename) to prevent partial `SKILL.md` or `SKILLS.md` files.
 - After persist or delete, the file watcher triggers conversation eviction; the next turn runs in a fresh conversation. The model's system prompt instructs it to continue normally.
 - macOS UI shows Inspect and Delete controls for managed skills only (source = "managed").
-- `skill_load` validates the recursive include graph (via `include-graph.ts`) before emitting output. Missing children and cycles produce `isError: true` with no `<loaded_skill>` marker. Valid includes produce an "Included Skills (immediate)" metadata section showing child ID, name, description, and path.
+- `skill_load` resolves the recursive include graph (via `include-graph.ts`) before emitting output. Missing children are listed as suggested skills without child `<loaded_skill>` markers; cycles still produce `isError: true` with no marker. Valid includes produce an "Included Skills (immediate)" metadata section showing child ID, name, description, and path.
 
 ### Skills Authoring via HTTP
 
@@ -1289,32 +1289,33 @@ The Skills page in the macOS client can author managed skills through the daemon
 
 ### Include Graph Validation
 
-Skills can declare child relationships via the `includes` frontmatter field (a JSON array of skill IDs). When `skill_load` loads a parent skill, it validates the full recursive include graph before emitting output.
+Skills can declare child relationships via the `includes` frontmatter field (a JSON array of skill IDs). When `skill_load` loads a parent skill, it attempts to resolve and auto-install missing includes before emitting output. Available includes are appended to the loaded skill output; unavailable includes are surfaced as suggestions instead of blocking the parent skill.
 
 ```mermaid
 graph LR
     LOAD["skill_load(parent)"] --> CATALOG["loadSkillCatalog()"]
     CATALOG --> INDEX["indexCatalogById()"]
-    INDEX --> VALIDATE["validateIncludes(rootId, index)"]
-    VALIDATE -->|"ok"| OUTPUT["Emit output +<br/>Included Skills (immediate)<br/>+ loaded_skill marker"]
-    VALIDATE -->|"missing child"| ERR_MISSING["isError: true<br/>no loaded_skill marker"]
-    VALIDATE -->|"cycle detected"| ERR_CYCLE["isError: true<br/>no loaded_skill marker"]
+    INDEX --> AUTOINSTALL["Attempt catalog auto-install<br/>for missing includes"]
+    AUTOINSTALL --> RESOLVE["collectAllMissing(rootId, index)<br/>+ validateIncludeCycles(rootId, index)"]
+    RESOLVE -->|"ok + no missing child"| OUTPUT["Emit output +<br/>Included Skills (immediate)<br/>+ loaded_skill markers"]
+    RESOLVE -->|"ok + missing child"| OUTPUT_MISSING["Emit parent output +<br/>Suggested Included Skills<br/>without child markers"]
+    RESOLVE -->|"cycle detected"| ERR_CYCLE["isError: true<br/>no loaded_skill marker"]
 ```
 
 **Validation rules:**
 
-- **Missing children**: If any skill in the recursive graph references an `includes` ID not found in the catalog, validation fails with the full path from root to the missing reference.
+- **Missing children**: Missing includes trigger catalog auto-install attempts. Any include still unavailable is listed under "Suggested Included Skills (not loaded)" and does not receive a `<loaded_skill>` marker.
 - **Cycles**: Three-state DFS (unseen → visiting → done) detects direct and indirect cycles. The error includes the cycle path.
-- **Fail-closed**: On any validation error, `skill_load` returns `isError: true` with no `<loaded_skill>` marker, preventing the agent from using a skill with broken dependencies.
+- **Fail-closed cycles**: Circular include chains still return `isError: true` with no `<loaded_skill>` marker.
 
-**Key constraint**: Include metadata is metadata-only. Child skills are **not** auto-activated — the agent must explicitly call `skill_load` for each child. The `projectSkillTools()` function only projects tools for skills with explicit `<loaded_skill>` markers in conversation history.
+**Key constraint**: Include metadata is advisory. Available included skills are appended to the parent output and receive explicit `<loaded_skill>` markers; unavailable included skills remain suggestions so the agent can search for and install them if the task needs their guidance or tools.
 
-| Source File                             | Purpose                                                                                    |
-| --------------------------------------- | ------------------------------------------------------------------------------------------ |
-| `assistant/src/skills/include-graph.ts` | `indexCatalogById()`, `getImmediateChildren()`, `validateIncludes()`, `traverseIncludes()` |
-| `assistant/src/tools/skills/load.ts`    | Include validation integration in `skill_load` execute path                                |
-| `assistant/src/config/skills.ts`        | `includes` field parsing from SKILL.md frontmatter                                         |
-| `assistant/src/skills/managed-store.ts` | `includes` emission in `buildSkillMarkdown()`                                              |
+| Source File                             | Purpose                                                                                                               |
+| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `assistant/src/skills/include-graph.ts` | `indexCatalogById()`, `getImmediateChildren()`, `validateIncludes()`, `validateIncludeCycles()`, `traverseIncludes()` |
+| `assistant/src/tools/skills/load.ts`    | Include resolution integration in `skill_load` execute path                                                           |
+| `assistant/src/config/skills.ts`        | `includes` field parsing from SKILL.md frontmatter                                                                    |
+| `assistant/src/skills/managed-store.ts` | `includes` emission in `buildSkillMarkdown()`                                                                         |
 
 ---
 
@@ -1553,19 +1554,19 @@ Every layer in the pipeline defaults to rejection rather than silent degradation
 
 ### Key Source Files
 
-| File                                                | Role                                                                                       |
-| --------------------------------------------------- | ------------------------------------------------------------------------------------------ |
-| `assistant/src/config/skills.ts`                    | Skill catalog loading: bundled, managed, workspace, extra directories                      |
-| `assistant/src/config/bundled-skills/`              | Bundled skill directories (browser, gmail, computer-use, weather, etc.)                    |
-| `assistant/src/skills/tool-manifest.ts`             | `TOOLS.json` parser and validator                                                          |
-| `assistant/src/skills/active-skill-tools.ts`        | `deriveActiveSkills()` — scans history for `<loaded_skill>` markers                        |
-| `assistant/src/skills/include-graph.ts`             | Include graph builder: `indexCatalogById()`, `validateIncludes()`, cycle/missing detection |
-| `assistant/src/daemon/conversation-skill-tools.ts`  | `projectSkillTools()` — per-turn projection, register/unregister lifecycle                 |
-| `assistant/src/tools/skills/skill-tool-factory.ts`  | `createSkillToolsFromManifest()` — manifest entries to Tool objects                        |
-| `assistant/src/tools/skills/skill-script-runner.ts` | Host runner: dynamic import + `run()` call                                                 |
-| `assistant/src/tools/skills/sandbox-runner.ts`      | Sandbox runner: isolated subprocess execution                                              |
-| `assistant/src/tools/registry.ts`                   | `registerSkillTools()` / `unregisterSkillTools()` — global tool registry                   |
-| `assistant/src/permissions/checker.ts`              | Skill-origin default-ask permission policy                                                 |
+| File                                                | Role                                                                                         |
+| --------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| `assistant/src/config/skills.ts`                    | Skill catalog loading: bundled, managed, workspace, extra directories                        |
+| `assistant/src/config/bundled-skills/`              | Bundled skill directories (browser, gmail, computer-use, weather, etc.)                      |
+| `assistant/src/skills/tool-manifest.ts`             | `TOOLS.json` parser and validator                                                            |
+| `assistant/src/skills/active-skill-tools.ts`        | `deriveActiveSkills()` — scans history for `<loaded_skill>` markers                          |
+| `assistant/src/skills/include-graph.ts`             | Include graph builder: `indexCatalogById()`, `validateIncludes()`, `validateIncludeCycles()` |
+| `assistant/src/daemon/conversation-skill-tools.ts`  | `projectSkillTools()` — per-turn projection, register/unregister lifecycle                   |
+| `assistant/src/tools/skills/skill-tool-factory.ts`  | `createSkillToolsFromManifest()` — manifest entries to Tool objects                          |
+| `assistant/src/tools/skills/skill-script-runner.ts` | Host runner: dynamic import + `run()` call                                                   |
+| `assistant/src/tools/skills/sandbox-runner.ts`      | Sandbox runner: isolated subprocess execution                                                |
+| `assistant/src/tools/registry.ts`                   | `registerSkillTools()` / `unregisterSkillTools()` — global tool registry                     |
+| `assistant/src/permissions/checker.ts`              | Skill-origin default-ask permission policy                                                   |
 
 ---
 

package/Dockerfile

@@ -22,16 +22,18 @@ COPY packages/service-contracts ./packages/service-contracts
 COPY packages/credential-storage ./packages/credential-storage
 COPY packages/egress-proxy ./packages/egress-proxy
 COPY packages/gateway-client ./packages/gateway-client
+COPY packages/ipc-server-utils ./packages/ipc-server-utils
 COPY packages/skill-host-contracts ./packages/skill-host-contracts
 COPY packages/slack-text ./packages/slack-text
 COPY packages/twilio-client ./packages/twilio-client
 
-# Install deps for shared packages that have their own file: dependencies.
-# Without this, bun's module resolution at runtime walks up from e.g.
-# packages/ces-client/src/ and never finds the transitive dependency
-# (ces-contracts) because only assistant/node_modules gets populated.
+# Install deps for shared packages whose source is loaded at runtime.
+# Without this, bun's module resolution walks up from packages/<name>/src/
+# and can't find the package's own deps (zod, transitive file: refs)
+# because only assistant/node_modules gets populated.
 RUN cd /app/packages/ces-client && bun install --frozen-lockfile
 RUN cd /app/packages/gateway-client && bun install --frozen-lockfile
+RUN cd /app/packages/service-contracts && bun install --frozen-lockfile
 
 # Install assistant dependencies first for cache reuse
 COPY assistant/package.json assistant/bun.lock ./assistant/

package/README.md

@@ -47,9 +47,9 @@ cp .env.example .env
 
 ## Update Bulletin
 
-Release notes are surfaced via a background conversation dispatched at daemon startup. Workspace migrations write release notes to `<workspace>/UPDATES.md`; `runUpdateBulletinJobIfNeeded()` then spawns a `conversationType: "background"` conversation (via `wakeAgentForOpportunity()`) whenever the file's content hash changes. The agent uses judgment to surface updates to the user when relevant, and deletes the file when done.
+Release notes are surfaced via a background conversation dispatched at daemon startup. Workspace migrations write release notes to `<workspace>/UPDATES.md`; `runUpdateBulletinJobIfNeeded()` then spawns a `conversationType: "background"` conversation via `runBackgroundJob()` (see `runtime/background-job-runner.ts`) whenever the file's content hash changes. The agent uses judgment to surface updates to the user when relevant, and deletes the file when done.
 
-**For release maintainers:** Add a new migration under `assistant/src/workspace/migrations/0XX-release-notes-<slug>.ts` with the release notes inline as a string literal, and append the export to `WORKSPACE_MIGRATIONS` in `assistant/src/workspace/migrations/registry.ts`. Migrations are append-only. Idempotency is handled by the workspace-migration runner — `runWorkspaceMigrations()` records each migration's `WorkspaceMigration.id` in `<workspace>/data/.workspace-migrations.json` and never re-runs an ID that is already in the `applied` set, so release-notes migrations do not need an in-file guard. Skip the migration entirely for releases with no user/assistant-facing changes.
+**For release maintainers:** Add a new migration under `assistant/src/workspace/migrations/0XX-release-notes-<slug>.ts` with the release notes inline as a string literal, and append the export to `WORKSPACE_MIGRATIONS` in `assistant/src/workspace/migrations/registry.ts`. Migrations are append-only. Idempotency requires both the workspace-migration runner AND an in-file marker: `runWorkspaceMigrations()` records each migration's `WorkspaceMigration.id` in `<workspace>/data/.workspace-migrations.json` and skips IDs already in the `applied` set, but a crash between `UPDATES.md` append and checkpoint finalize can cause a duplicate append on next boot. Embed an HTML marker like `<!-- release-note-id:<migration-id> -->` in the appended block, and short-circuit when the marker is already present. See the root `AGENTS.md` "Release Update Hygiene" section for the full rationale. Skip the migration entirely for releases with no user/assistant-facing changes.
 
 ## Usage
 

package/__tests__/permissions/gateway-threshold-reader.test.ts

@@ -31,18 +31,70 @@ mock.module("../../src/ipc/gateway-client.js", () => ({
   },
 }));
 
-// Suppress logger output in tests
-mock.module("../../src/util/logger.js", () => ({
-  getLogger: () => ({
-    warn: () => {},
-    info: () => {},
-    error: () => {},
-    debug: () => {},
-  }),
-}));
+// Capture logger output so coalescing tests can assert on it. Existing
+// tests don't read the array, so capturing is invisible to them.
+//
+// Bun's `mock.module("../../src/util/logger.js", ...)` does not intercept
+// transitive imports (see comment in stt-hints.test.ts and avatar-e2e.test.ts).
+// Mocking `pino` at the package level works because getLogger uses pino
+// child loggers under the hood — intercepting pino captures everything.
+interface LogCall {
+  level: "warn" | "info" | "error" | "debug";
+  fields: Record<string, unknown>;
+  message: string;
+}
+const logCalls: LogCall[] = [];
+
+function makeLogFn(level: LogCall["level"]) {
+  return (
+    fieldsOrMsg: Record<string, unknown> | string,
+    maybeMsg?: string,
+  ) => {
+    if (typeof fieldsOrMsg === "string") {
+      logCalls.push({ level, fields: {}, message: fieldsOrMsg });
+    } else {
+      logCalls.push({
+        level,
+        fields: fieldsOrMsg,
+        message: maybeMsg ?? "",
+      });
+    }
+  };
+}
+
+const mockChildLogger = {
+  debug: () => {},
+  info: makeLogFn("info"),
+  warn: makeLogFn("warn"),
+  error: makeLogFn("error"),
+  fatal: () => {},
+  trace: () => {},
+  silent: () => {},
+  // pino loggers are themselves callable as a no-op shorthand; child() returns
+  // another logger.
+  child(): typeof mockChildLogger {
+    return mockChildLogger;
+  },
+  bindings: () => ({}),
+  level: "info",
+};
+
+const mockPinoLogger = Object.assign(() => mockChildLogger, {
+  destination: () => ({}),
+  multistream: () => ({}),
+  stdTimeFunctions: { isoTime: () => "" },
+  stdSerializers: {},
+  symbols: {},
+});
+
+mock.module("pino", () => ({ default: mockPinoLogger }));
+mock.module("pino-pretty", () => ({ default: () => ({}) }));
 
 import {
   _clearGlobalCacheForTesting,
+  _getFailureStateForTesting,
+  _resetFailureCoalesceForTesting,
+  _setFailureWarnIntervalForTesting,
   getAutoApproveThreshold,
 } from "../../src/permissions/gateway-threshold-reader.js";
 
@@ -51,7 +103,9 @@ import {
 function resetMocks(): void {
   ipcCallLog.length = 0;
   ipcHandler = () => undefined;
+  logCalls.length = 0;
   _clearGlobalCacheForTesting();
+  _resetFailureCoalesceForTesting();
 }
 
 afterEach(resetMocks);
@@ -221,3 +275,176 @@ describe("getAutoApproveThreshold", () => {
     expect(ipcCallLog).toEqual(["/v1/permissions/thresholds"]);
   });
 });
+
+// ── Failure coalescing ───────────────────────────────────────────────────────
+
+describe("failure-coalescing log behavior", () => {
+  test("first failure WARNs immediately and starts a streak", async () => {
+    ipcHandler = () => {
+      throw new Error("Connection refused");
+    };
+
+    expect(await getAutoApproveThreshold(undefined, "background")).toBe("none");
+
+    const warns = logCalls.filter((c) => c.level === "warn");
+    expect(warns.length).toBe(1);
+    expect(warns[0]?.fields).toMatchObject({
+      op: "global_thresholds",
+      consecutiveFailures: 1,
+      event: "ipc_threshold_failure",
+    });
+
+    const state = _getFailureStateForTesting("global_thresholds");
+    expect(state).toBeDefined();
+    expect(state?.consecutiveFailures).toBe(1);
+  });
+
+  test("subsequent failures within the WARN window do not log but still increment state", async () => {
+    // 1-hour window so the test never accidentally crosses it.
+    _setFailureWarnIntervalForTesting(60 * 60 * 1000);
+    ipcHandler = () => {
+      throw new Error("ENOENT");
+    };
+
+    for (let i = 0; i < 100; i++) {
+      _clearGlobalCacheForTesting(); // force re-fetch each call
+      await getAutoApproveThreshold(undefined, "background");
+    }
+
+    const warns = logCalls.filter((c) => c.level === "warn");
+    // At most one WARN — the very first call. All 99 follow-ups suppressed.
+    expect(warns.length).toBe(1);
+
+    const state = _getFailureStateForTesting("global_thresholds");
+    expect(state?.consecutiveFailures).toBe(100);
+  });
+
+  test("a fresh WARN fires once the cadence window elapses", async () => {
+    // 5ms window so the test runs fast.
+    _setFailureWarnIntervalForTesting(5);
+    ipcHandler = () => {
+      throw new Error("ENOENT");
+    };
+
+    await getAutoApproveThreshold(undefined, "background");
+    expect(logCalls.filter((c) => c.level === "warn").length).toBe(1);
+
+    // Wait past the window then fail again.
+    await new Promise((r) => setTimeout(r, 20));
+    _clearGlobalCacheForTesting();
+    await getAutoApproveThreshold(undefined, "background");
+
+    const warns = logCalls.filter((c) => c.level === "warn");
+    expect(warns.length).toBe(2);
+    // Second WARN includes the streak metadata so dashboards can see how
+    // many failures were swallowed in between.
+    expect(warns[1]?.fields).toMatchObject({
+      op: "global_thresholds",
+      consecutiveFailures: 2,
+      event: "ipc_threshold_failure",
+    });
+    expect(warns[1]?.fields.streakDurationMs).toBeDefined();
+  });
+
+  test("recovery emits an INFO with the swallowed-failure count and clears state", async () => {
+    _setFailureWarnIntervalForTesting(60 * 60 * 1000);
+    let working = false;
+    ipcHandler = (method) => {
+      if (working && method === "get_global_thresholds") {
+        return { interactive: "medium", autonomous: "low" };
+      }
+      throw new Error("ENOENT");
+    };
+
+    // Three failures, then it recovers.
+    for (let i = 0; i < 3; i++) {
+      _clearGlobalCacheForTesting();
+      await getAutoApproveThreshold(undefined, "background");
+    }
+    expect(_getFailureStateForTesting("global_thresholds")?.consecutiveFailures).toBe(
+      3,
+    );
+
+    working = true;
+    _clearGlobalCacheForTesting();
+    expect(await getAutoApproveThreshold(undefined, "background")).toBe("low");
+
+    const infos = logCalls.filter((c) => c.level === "info");
+    expect(infos.length).toBe(1);
+    expect(infos[0]?.fields).toMatchObject({
+      op: "global_thresholds",
+      swallowedFailures: 3,
+      event: "ipc_threshold_recovered",
+    });
+    expect(infos[0]?.fields.streakDurationMs).toBeDefined();
+
+    expect(_getFailureStateForTesting("global_thresholds")).toBeUndefined();
+  });
+
+  test("conversation and global ops have independent failure streaks", async () => {
+    _setFailureWarnIntervalForTesting(60 * 60 * 1000);
+    // conversation IPC fails (transport — returns undefined), global IPC works.
+    ipcHandler = (method) => {
+      if (method === "get_conversation_threshold") return undefined;
+      if (method === "get_global_thresholds") {
+        return { interactive: "medium", autonomous: "low" };
+      }
+      return undefined;
+    };
+
+    // First call: conversation transport fails, global succeeds.
+    expect(await getAutoApproveThreshold("conv-1", "conversation")).toBe(
+      "medium",
+    );
+
+    expect(
+      _getFailureStateForTesting("conversation_threshold")?.consecutiveFailures,
+    ).toBe(1);
+    expect(_getFailureStateForTesting("global_thresholds")).toBeUndefined();
+
+    const warns = logCalls.filter((c) => c.level === "warn");
+    expect(warns.length).toBe(1);
+    expect(warns[0]?.fields.op).toBe("conversation_threshold");
+  });
+
+  test("a successful conversation override clears the conversation streak even when the gateway returns null (no override)", async () => {
+    _setFailureWarnIntervalForTesting(60 * 60 * 1000);
+
+    // First two calls: conversation IPC returns undefined (transport failure).
+    let working = false;
+    ipcHandler = (method) => {
+      if (method === "get_conversation_threshold") {
+        return working ? null : undefined;
+      }
+      if (method === "get_global_thresholds") {
+        return { interactive: "low", autonomous: "none" };
+      }
+      return undefined;
+    };
+
+    // Force two transport failures.
+    await getAutoApproveThreshold("conv-2", "conversation");
+    await new Promise((r) => setTimeout(r, 6)); // bypass the 5s convo cache
+    _clearGlobalCacheForTesting();
+    // Convo cache is keyed on conversationId — change the id to bypass.
+    await getAutoApproveThreshold("conv-3", "conversation");
+    expect(
+      _getFailureStateForTesting("conversation_threshold")?.consecutiveFailures,
+    ).toBe(2);
+
+    // Now the IPC starts working — even a null "no override" response is a
+    // successful round-trip and must clear the streak.
+    working = true;
+    _clearGlobalCacheForTesting();
+    await getAutoApproveThreshold("conv-4", "conversation");
+
+    const infos = logCalls.filter((c) => c.level === "info");
+    expect(infos.length).toBe(1);
+    expect(infos[0]?.fields).toMatchObject({
+      op: "conversation_threshold",
+      swallowedFailures: 2,
+      event: "ipc_threshold_recovered",
+    });
+    expect(_getFailureStateForTesting("conversation_threshold")).toBeUndefined();
+  });
+});

package/bun.lock

@@ -18,6 +18,7 @@
         "@vellumai/credential-storage": "file:../packages/credential-storage",
         "@vellumai/egress-proxy": "file:../packages/egress-proxy",
         "@vellumai/gateway-client": "file:../packages/gateway-client",
+        "@vellumai/ipc-server-utils": "file:../packages/ipc-server-utils",
         "@vellumai/service-contracts": "file:../packages/service-contracts",
         "@vellumai/skill-host-contracts": "file:../packages/skill-host-contracts",
         "@vellumai/slack-text": "file:../packages/slack-text",
@@ -421,6 +422,8 @@
 
     "@vellumai/gateway-client": ["@vellumai/gateway-client@file:../packages/gateway-client", { "dependencies": { "@vellumai/service-contracts": "file:../service-contracts" }, "devDependencies": { "@types/bun": "1.3.10", "typescript": "5.9.3" } }],
 
+    "@vellumai/ipc-server-utils": ["@vellumai/ipc-server-utils@file:../packages/ipc-server-utils", { "devDependencies": { "@types/bun": "1.3.10", "typescript": "5.9.3" } }],
+
     "@vellumai/service-contracts": ["@vellumai/service-contracts@file:../packages/service-contracts", { "dependencies": { "zod": "4.3.6" }, "devDependencies": { "@types/bun": "1.2.4", "typescript": "5.7.3" } }],
 
     "@vellumai/skill-host-contracts": ["@vellumai/skill-host-contracts@file:../packages/skill-host-contracts", { "devDependencies": { "@types/bun": "1.3.10", "typescript": "5.9.3" } }],

package/docker-entrypoint.sh

@@ -1,11 +1,27 @@
 #!/usr/bin/env sh
 set -eu
 
+# Ensure /tmp has the standard sticky-bit world-writable mode so non-root
+# processes (the `assistant` user, bun's tmpdir, scratch writes) can use it.
+chmod 1777 /tmp 2>/dev/null || true
+
 if [ "$(id -u)" = "0" ] && [ "${VELLUM_WORKSPACE_DIR:-}" = "/workspace" ] && [ -d /workspace ]; then
   git config --global --add safe.directory /workspace >/dev/null 2>&1 || true
   git config --global --add safe.directory '/workspace/*' >/dev/null 2>&1 || true
 fi
 
+# Source executable scripts from /workspace/.entrypoint.d/ in lexicographic
+# order so an assistant can extend the daemon environment from its own
+# workspace volume — PATH additions, credential helpers, tooling symlinks.
+# Scripts are sourced so env mutations propagate to the daemon. Errors are
+# logged but non-fatal.
+if [ -d /workspace/.entrypoint.d ]; then
+  for hook in /workspace/.entrypoint.d/*.sh; do
+    [ -r "$hook" ] || continue
+    . "$hook" || echo "Warning: workspace hook $hook exited $?" >&2
+  done
+fi
+
 # ── Bun profiler bootstrap ──────────────────────────────────────────────
 # When VELLUM_PROFILER_RUN_ID and VELLUM_PROFILER_MODE are set, prepare the
 # run directory on the workspace volume and append the appropriate Bun