@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/schedule/schedule-store.ts

@@ -1,5 +1,5 @@
 import { Cron } from "croner";
-import { and, asc, desc, eq, isNull, lte, sql } from "drizzle-orm";
+import { and, asc, desc, eq, isNull, lt, lte, sql } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import { getDb } from "../memory/db-connection.js";
@@ -26,7 +26,12 @@ function notifySchedulesChanged(): void {
     );
 }
 
-export type ScheduleMode = "notify" | "execute" | "script" | "wake";
+export type ScheduleMode =
+  | "notify"
+  | "execute"
+  | "script"
+  | "wake"
+  | "workflow";
 export type RoutingIntent = "single_channel" | "multi_channel" | "all_channels";
 export type ScheduleStatus = "active" | "firing" | "fired" | "cancelled";
 
@@ -42,6 +47,12 @@ export interface ScheduleJob {
   message: string;
   script: string | null;
   wakeConversationId: string | null;
+  /** Saved workflow to trigger; only used when mode = 'workflow'. */
+  workflowName: string | null;
+  /** Args passed verbatim to the workflow run; only used when mode = 'workflow'. */
+  workflowArgs: unknown;
+  /** Capability manifest scoping the schedule's run; null = unconstrained. */
+  capabilities: unknown | null;
   nextRunAt: number;
   lastRunAt: number | null;
   lastStatus: string | null;
@@ -50,6 +61,11 @@ export interface ScheduleJob {
   retryBackoffMs: number;
   /** Script-mode execution timeout override (ms); null = use the default. */
   timeoutMs: number | null;
+  /**
+   * Inference profile (`llm.profiles` key) applied to the schedule's
+   * LLM-executed runs; null = default main-agent model selection.
+   */
+  inferenceProfile: string | null;
   createdFromConversationId: string | null;
   createdBy: string;
   mode: ScheduleMode;
@@ -92,6 +108,9 @@ export function createSchedule(params: {
   message: string;
   script?: string | null;
   wakeConversationId?: string | null;
+  workflowName?: string | null;
+  workflowArgs?: unknown;
+  capabilities?: unknown;
   enabled?: boolean;
   createdBy?: string;
   syntax?: ScheduleSyntax;
@@ -105,6 +124,7 @@ export function createSchedule(params: {
   maxRetries?: number;
   retryBackoffMs?: number;
   timeoutMs?: number | null;
+  inferenceProfile?: string | null;
   createdFromConversationId?: string | null;
 }): ScheduleJob {
   const expression = params.expression ?? params.cronExpression ?? null;
@@ -142,6 +162,7 @@ export function createSchedule(params: {
   const maxRetries = params.maxRetries ?? 3;
   const retryBackoffMs = params.retryBackoffMs ?? 60000;
   const timeoutMs = params.timeoutMs ?? null;
+  const inferenceProfile = params.inferenceProfile ?? null;
   const createdFromConversationId = params.createdFromConversationId ?? null;
   const description = normalizeDescription(
     params.description,
@@ -168,6 +189,13 @@ export function createSchedule(params: {
     message: params.message,
     script: params.script ?? null,
     wakeConversationId: params.wakeConversationId ?? null,
+    workflowName: params.workflowName ?? null,
+    workflowArgsJson:
+      params.workflowArgs === undefined
+        ? null
+        : JSON.stringify(params.workflowArgs),
+    capabilitiesJson:
+      params.capabilities != null ? JSON.stringify(params.capabilities) : null,
     nextRunAt,
     lastRunAt: null as number | null,
     lastStatus: null as string | null,
@@ -175,6 +203,7 @@ export function createSchedule(params: {
     maxRetries,
     retryBackoffMs,
     timeoutMs,
+    inferenceProfile,
     createdFromConversationId,
     createdBy: params.createdBy ?? "agent",
     mode,
@@ -273,9 +302,13 @@ export function updateSchedule(
     quiet?: boolean;
     reuseConversation?: boolean;
     wakeConversationId?: string | null;
+    workflowName?: string | null;
+    workflowArgs?: unknown;
+    capabilities?: unknown;
     maxRetries?: number;
     retryBackoffMs?: number;
     timeoutMs?: number | null;
+    inferenceProfile?: string | null;
     createdFromConversationId?: string | null;
   },
 ): ScheduleJob | null {
@@ -340,10 +373,28 @@ export function updateSchedule(
     set.reuseConversation = updates.reuseConversation;
   if (updates.wakeConversationId !== undefined)
     set.wakeConversationId = updates.wakeConversationId;
+  if (updates.workflowName !== undefined)
+    set.workflowName = updates.workflowName;
+  // `workflowArgs` may legitimately be any JSON value (including null), so
+  // detect presence by key rather than `!== undefined`.
+  if ("workflowArgs" in updates)
+    set.workflowArgsJson =
+      updates.workflowArgs === undefined
+        ? null
+        : JSON.stringify(updates.workflowArgs);
+  // `capabilities` may legitimately be any JSON value (including null), so
+  // detect presence by key rather than `!== undefined`.
+  if ("capabilities" in updates)
+    set.capabilitiesJson =
+      updates.capabilities == null
+        ? null
+        : JSON.stringify(updates.capabilities);
   if (updates.maxRetries !== undefined) set.maxRetries = updates.maxRetries;
   if (updates.retryBackoffMs !== undefined)
     set.retryBackoffMs = updates.retryBackoffMs;
   if (updates.timeoutMs !== undefined) set.timeoutMs = updates.timeoutMs;
+  if (updates.inferenceProfile !== undefined)
+    set.inferenceProfile = updates.inferenceProfile;
   if (updates.createdFromConversationId !== undefined)
     set.createdFromConversationId = updates.createdFromConversationId;
 
@@ -545,6 +596,41 @@ export function failOneShot(id: string): void {
   if (rawChanges() > 0) notifySchedulesChanged();
 }
 
+/**
+ * Re-arm a just-claimed schedule so it is due again on the very next tick,
+ * WITHOUT counting as a run or bumping the retry count. Sets status back to
+ * 'active' and pulls `nextRunAt` back to now: `claimDueSchedules` advances
+ * `nextRunAt` for recurring jobs (and flips one-shots to 'firing'), so without
+ * resetting both the claimed occurrence would be dropped until the next cron
+ * time. Used when a tick claims a job it cannot yet process (e.g. a workflow
+ * schedule that fired before the tool registry finished initializing at boot);
+ * unlike a failure path it does not touch `retryCount`, since the deferral is
+ * not the schedule's fault. Keyed by id only (no status guard) because recurring
+ * claims leave the row 'active' while one-shot claims leave it 'firing', and it
+ * runs immediately after the claim within the same tick.
+ *
+ * Also restores `enabled: true`. `claimDueSchedules` disables a row whose
+ * claimed occurrence was its LAST (a one-shot, or the final fire of a finite
+ * RRULE), but the due-claim query requires `enabled = true` — so a deferred
+ * final occurrence would never be re-claimed and the run would be silently lost.
+ * The deferred occurrence has not actually run yet, so re-enabling is correct;
+ * when it later fires, the claim path re-applies the right `enabled` state.
+ */
+export function deferClaimedSchedule(id: string): void {
+  const db = getDb();
+  const now = Date.now();
+  db.update(scheduleJobs)
+    .set({
+      status: "active",
+      enabled: true,
+      nextRunAt: now,
+      updatedAt: now,
+    })
+    .where(eq(scheduleJobs.id, id))
+    .run();
+  if (rawChanges() > 0) notifySchedulesChanged();
+}
+
 /**
  * Revert a one-shot from 'firing' back to 'active' and increment its
  * retry count. Used when a wake times out waiting for an idle conversation
@@ -718,12 +804,26 @@ export function getLastScheduleConversationId(jobId: string): string | null {
   return row?.conversationId ?? null;
 }
 
-export function getScheduleRuns(jobId: string, limit?: number): ScheduleRun[] {
+/**
+ * List runs for a schedule, newest first. When `before` is set, only runs
+ * with `createdAt` strictly older than it are returned (cursor for
+ * paginating into history).
+ */
+export function getScheduleRuns(
+  jobId: string,
+  limit?: number,
+  before?: number,
+): ScheduleRun[] {
   const db = getDb();
   const rows = db
     .select()
     .from(scheduleRuns)
-    .where(eq(scheduleRuns.jobId, jobId))
+    .where(
+      and(
+        eq(scheduleRuns.jobId, jobId),
+        before != null ? lt(scheduleRuns.createdAt, before) : undefined,
+      ),
+    )
     .orderBy(desc(scheduleRuns.createdAt))
     .limit(limit ?? 10)
     .all();
@@ -886,6 +986,36 @@ export function describeCronExpression(expr: string | null): string {
       }
     }
 
+    // Stepped or fixed minutes constrained to a contiguous range of hours,
+    // every day/month (e.g. "*/30 7-23 * * *" → "Every 30 minutes, 7 AM–11 PM").
+    const hoursAreContiguousRange =
+      !allHours &&
+      activeHours.length > 1 &&
+      activeHours.every((h, i) => i === 0 || h === activeHours[i - 1] + 1);
+
+    if (hoursAreContiguousRange && anyDayAndMonth) {
+      const hourLabel = (h: number) => {
+        const period = h >= 12 ? "PM" : "AM";
+        return `${h % 12 || 12} ${period}`;
+      };
+      const rangeStr = `${hourLabel(activeHours[0])}–${hourLabel(
+        activeHours[activeHours.length - 1],
+      )}`;
+
+      if (steppedMinutes && activeMinutes[0] === 0) {
+        const step = activeMinutes[1] - activeMinutes[0];
+        const isRegularStep = activeMinutes.every((v, i) => v === i * step);
+        if (isRegularStep && 60 % step === 0) {
+          return `Every ${step} minutes, ${rangeStr}`;
+        }
+      }
+      if (fixedMinute) {
+        return activeMinutes[0] === 0
+          ? `Hourly, ${rangeStr}`
+          : `Hourly at minute ${activeMinutes[0]}, ${rangeStr}`;
+      }
+    }
+
     // Fallback: return the raw expression
     return expr;
   } catch {
@@ -999,6 +1129,9 @@ function parseJobRow(row: typeof scheduleJobs.$inferSelect): ScheduleJob {
     message: row.message,
     script: row.script ?? null,
     wakeConversationId: row.wakeConversationId ?? null,
+    workflowName: row.workflowName ?? null,
+    workflowArgs: parseOptionalJson(row.workflowArgsJson),
+    capabilities: parseOptionalJson(row.capabilitiesJson),
     nextRunAt: row.nextRunAt,
     lastRunAt: row.lastRunAt,
     lastStatus: row.lastStatus,
@@ -1006,6 +1139,7 @@ function parseJobRow(row: typeof scheduleJobs.$inferSelect): ScheduleJob {
     maxRetries: row.maxRetries ?? 3,
     retryBackoffMs: row.retryBackoffMs ?? 60000,
     timeoutMs: row.timeoutMs ?? null,
+    inferenceProfile: row.inferenceProfile ?? null,
     createdFromConversationId: row.createdFromConversationId ?? null,
     createdBy: row.createdBy,
     mode: (row.mode ?? "execute") as ScheduleMode,
@@ -1038,6 +1172,20 @@ function safeParseJson(
   }
 }
 
+/**
+ * Parse a nullable JSON column into an arbitrary value. Unlike
+ * {@link safeParseJson}, the result is not coerced to an object — workflow
+ * args may be any JSON value — and an absent/unparseable column yields null.
+ */
+function parseOptionalJson(json: string | null | undefined): unknown {
+  if (json == null) return null;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
 function parseRunRow(row: typeof scheduleRuns.$inferSelect): ScheduleRun {
   return {
     id: row.id,

package/src/schedule/scheduler-types.ts

@@ -16,6 +16,12 @@ export interface ScheduleMessageOptions {
    * the default `mainAgent` route.
    */
   callSite?: LLMCallSite;
+  /**
+   * Optional ad-hoc inference-profile override (`llm.profiles` key) applied
+   * to every LLM call the run issues — a schedule's pinned profile. Omitted
+   * = the call site's default resolution (main-agent model selection).
+   */
+  overrideProfile?: string;
 }
 
 export type ScheduleMessageProcessor = (

package/src/schedule/scheduler.ts

@@ -3,6 +3,7 @@ import {
   diskPressureBackgroundSkipLogFields,
   shouldLogDiskPressureBackgroundSkip,
 } from "../daemon/disk-pressure-background-gate.js";
+import { INTERNAL_GUARDIAN_TRUST_CONTEXT } from "../daemon/trust-context.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { getConversation } from "../memory/conversation-crud.js";
 import { invalidateAssistantInferredItemsForConversation } from "../memory/task-memory-cleanup.js";
@@ -10,8 +11,11 @@ import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { wakeAgentForOpportunity } from "../runtime/agent-wake.js";
 import { runBackgroundJob } from "../runtime/background-job-runner.js";
 import { runSequencesOnce } from "../sequence/engine.js";
+import { areCoreToolsInitialized } from "../tools/registry.js";
 import { getLogger } from "../util/logger.js";
 import { runWatchersOnce, type WatcherNotifier } from "../watcher/engine.js";
+import { normalizeCapabilityManifest } from "../workflows/capabilities.js";
+import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { hasSetConstructs } from "./recurrence-engine.js";
 import { applyRetryDecision, decideRetry } from "./retry-policy.js";
 import { runScript, type ScriptResult } from "./run-script.js";
@@ -20,6 +24,7 @@ import {
   completeOneShot,
   completeScheduleRun,
   createScheduleRun,
+  deferClaimedSchedule,
   failOneShotPermanently,
   getLastScheduleConversationId,
   listSchedules,
@@ -357,6 +362,9 @@ export async function runScheduleDueWorkOnce(
           conversationId: wakeConversationId,
           hint: job.message,
           source: "defer",
+          ...(job.inferenceProfile
+            ? { forceOverrideProfile: job.inferenceProfile }
+            : {}),
         });
 
         if (result.reason === "timeout" && isOneShot) {
@@ -433,6 +441,85 @@ export async function runScheduleDueWorkOnce(
       continue;
     }
 
+    // ── Workflow mode (trigger a saved workflow by name) ────────────
+    if (job.mode === "workflow") {
+      if (!job.workflowName) {
+        log.warn(
+          { jobId: job.id, name: job.name },
+          "Workflow schedule has no workflowName — skipping",
+        );
+        mark("skipped");
+        continue;
+      }
+      // Boot race: the scheduler starts before initializeProvidersAndTools()
+      // registers the read-only baseline (file_read/web_fetch/etc.) that
+      // resolveCapabilities grants to every workflow run. Launching now would
+      // give the run an EMPTY baseline and degrade/fail it. Defer the claimed
+      // job back to due so it fires on a later tick once tools are registered
+      // (the window is just the few seconds of daemon boot). Non-workflow modes
+      // don't depend on the baseline, so only this branch gates.
+      if (!areCoreToolsInitialized()) {
+        log.info(
+          { jobId: job.id, name: job.name, workflowName: job.workflowName },
+          "Deferring workflow schedule until tools are registered",
+        );
+        deferClaimedSchedule(job.id);
+        mark("skipped");
+        continue;
+      }
+      const runId = createScheduleRun(job.id, `workflow:${job.id}`);
+      let failed = false;
+      try {
+        log.info(
+          {
+            jobId: job.id,
+            name: job.name,
+            workflowName: job.workflowName,
+            isOneShot,
+          },
+          "Triggering workflow schedule",
+        );
+        const { runId: workflowRunId } = getWorkflowRunManager().start({
+          name: job.workflowName,
+          args: job.workflowArgs ?? {},
+          // Where the completion summary is delivered (an agent wake). Prefer an
+          // explicit wake target, then fall back to the conversation that
+          // created the schedule — workflow schedules made via `schedule_create`
+          // store that as `createdFromConversationId` and leave
+          // `wakeConversationId` unset, so without this fallback their result
+          // would surface only to live SSE listeners / the DB, never delivered.
+          conversationId:
+            job.wakeConversationId ??
+            job.createdFromConversationId ??
+            undefined,
+          // The schedule's persisted capability manifest scopes the run; a
+          // legacy schedule with null `capabilities` normalizes to the read-only
+          // baseline.
+          manifest: normalizeCapabilityManifest(job.capabilities),
+          trustContext: INTERNAL_GUARDIAN_TRUST_CONTEXT,
+        });
+        // `start` launches the run fire-and-forget and returns synchronously;
+        // a successful trigger is recorded as ok. Workflow completion/failure
+        // is surfaced out-of-band via workflow events and the completion wake.
+        completeScheduleRun(runId, {
+          status: "ok",
+          output: `workflow run ${workflowRunId} started`,
+        });
+        if (isOneShot) completeOneShot(job.id);
+      } catch (err) {
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        log.warn(
+          { err, jobId: job.id, name: job.name, isOneShot },
+          "Workflow schedule trigger failed",
+        );
+        completeScheduleRun(runId, { status: "error", error: errorMsg });
+        handleExecutionFailure({ job, errorMsg, isOneShot });
+        failed = true;
+      }
+      mark(failed ? "failed" : "completed");
+      continue;
+    }
+
     // ── Execute mode ────────────────────────────────────────────────
 
     // Check if message is a task invocation (run_task:<task_id>)
@@ -470,6 +557,9 @@ export async function runScheduleDueWorkOnce(
             await processMessage(conversationId, message, {
               trustClass: "guardian",
               taskRunId,
+              ...(job.inferenceProfile
+                ? { overrideProfile: job.inferenceProfile }
+                : {}),
             });
           },
         );
@@ -602,6 +692,9 @@ export async function runScheduleDueWorkOnce(
       try {
         await processMessage(conversationId, job.message, {
           trustClass: "guardian",
+          ...(job.inferenceProfile
+            ? { overrideProfile: job.inferenceProfile }
+            : {}),
         });
         ok = true;
       } catch (err) {
@@ -622,6 +715,9 @@ export async function runScheduleDueWorkOnce(
         systemHint: `Schedule: ${job.name}`,
         trustContext: { sourceChannel: "vellum", trustClass: "guardian" },
         callSite: "mainAgent",
+        ...(job.inferenceProfile
+          ? { overrideProfile: job.inferenceProfile }
+          : {}),
         timeoutMs: SCHEDULE_TALK_TIMEOUT_MS,
         origin: "schedule",
         groupId: "system:scheduled",

package/src/security/secret-allowlist.ts

@@ -1,7 +1,7 @@
 /**
  * User-defined allowlist for suppressing secret scanner false positives.
  *
- * Reads `~/.vellum/workspace/data/secret-allowlist.json` (if present) and provides
+ * Reads `$VELLUM_WORKSPACE_DIR/data/secret-allowlist.json` (if present) and provides
  * `isAllowlisted(value)` to check whether a matched value should be
  * suppressed.
  *

package/src/skills/path-classifier.ts

@@ -6,7 +6,7 @@ import { getWorkspaceSkillsDir } from "../util/platform.js";
 
 /**
  * Returns the managed skills root directory. Managed skills are user-installed
- * skills that live under ~/.vellum/workspace/skills.
+ * skills that live under $VELLUM_WORKSPACE_DIR/skills.
  */
 export function getManagedSkillsRoot(): string {
   return normalizeDirPath(getWorkspaceSkillsDir());

package/src/tools/apps/executors.ts

@@ -12,6 +12,7 @@ import { compileApp } from "../../bundler/app-compiler.js";
 import { generateAppIcon } from "../../media/app-icon-generator.js";
 import type { AppDefinition } from "../../memory/app-store.js";
 import { getAppDirPath } from "../../memory/app-store.js";
+import { getLogger } from "../../util/logger.js";
 
 // ---------------------------------------------------------------------------
 // Shared result type
@@ -55,6 +56,11 @@ export interface AppStoreWriter {
   ): AppDefinition;
   deleteApp(id: string): void;
   writeAppFile(appId: string, path: string, content: string): void;
+  /**
+   * Associate a freshly created app with the conversation that created it.
+   * Optional so test doubles need not implement it; the real store does.
+   */
+  addAppConversationId?(appId: string, conversationId: string): boolean;
 }
 
 export type AppStore = AppStoreReader & AppStoreWriter;
@@ -158,6 +164,7 @@ export async function executeAppCreate(
   input: AppCreateInput,
   store: AppStore,
   proxyToolResolver?: ProxyResolver,
+  conversationId?: string,
 ): Promise<ExecutorResult> {
   // The model sometimes omits a name; resolve a sensible one rather than
   // erroring out so the build still succeeds. Users can rename via app_update.
@@ -213,6 +220,22 @@ export async function executeAppCreate(
     formatVersion: 2,
   });
 
+  // Associate the app with its conversation at creation so subsequent
+  // `app_*` calls in the same turn can resolve it even when the model omits
+  // `app_id` (see resolveAppId). Without this the link is only formed at
+  // `app_open`, leaving the create→update→refresh gap unresolvable.
+  // Best-effort: a failed association must never fail the create.
+  if (conversationId && store.addAppConversationId) {
+    try {
+      store.addAppConversationId(app.id, conversationId);
+    } catch (err) {
+      getLogger("app-executors").debug(
+        { err, appId: app.id, conversationId },
+        "Failed to associate app with conversation at create",
+      );
+    }
+  }
+
   // Scaffold multifile app with src/ files and compile to dist/
   const htmlSafeName = name
     .replace(/&/g, "&amp;")

package/src/tools/apps/resolve-app-id.ts

@@ -0,0 +1,42 @@
+import { listAppsByConversation } from "../../memory/app-store.js";
+
+/**
+ * Resolve the `app_id` an app-builder tool should operate on.
+ *
+ * Weaker models routinely omit `app_id` when calling `app_*` tools through
+ * `skill_execute`, even though the active app's id is in their context from the
+ * preceding `app_create`/`app_update` result. Left unhandled, the executor
+ * fails with a cryptic "Invalid ID: undefined", the model retries the same
+ * empty call, and the turn burns many steps before recovering.
+ *
+ * An explicit, non-empty `app_id` always wins. When it is missing, fall back to
+ * the conversation's most-recently-updated app — the one being actively built.
+ * Returns `null` when no app_id is supplied and the conversation has no app, so
+ * callers can surface an actionable error instead of a raw store throw.
+ *
+ * Not used for destructive operations (`app_delete`): deleting an inferred app
+ * is unsafe, so deletion requires an explicit id.
+ */
+export function resolveAppId(
+  input: Record<string, unknown>,
+  conversationId: string,
+): string | null {
+  if (typeof input.app_id === "string" && input.app_id.trim().length > 0) {
+    return input.app_id;
+  }
+  // `listAppsByConversation` preserves `listApps`' updatedAt-descending order,
+  // so the first entry is the app the model is actively working on.
+  const apps = listAppsByConversation(conversationId);
+  return apps.length > 0 ? apps[0].id : null;
+}
+
+/** Error payload returned when no app_id is supplied and none can be inferred. */
+export function missingAppIdError(): { content: string; isError: boolean } {
+  return {
+    content: JSON.stringify({
+      error:
+        "app_id is required and no active app exists in this conversation. Call app_create first, or pass app_id explicitly.",
+    }),
+    isError: true,
+  };
+}

package/src/tools/browser/browser-execution.ts

@@ -669,11 +669,10 @@ export async function executeBrowserNavigate(
   const newTab = input.new_tab === true;
   if (newTab && cdp.kind === "extension") {
     try {
-      const result = await cdp.send<{ tabId?: number | string; clientId?: string }>(
-        "Vellum.createTab",
-        {},
-        context.signal,
-      );
+      const result = await cdp.send<{
+        tabId?: number | string;
+        clientId?: string;
+      }>("Vellum.createTab", {}, context.signal);
       const tabId =
         typeof result?.tabId === "number"
           ? String(result.tabId)
@@ -720,8 +719,7 @@ export async function executeBrowserNavigate(
       // We're early-returning before the main try/finally block below,
       // so we must dispose the cdp client manually to avoid leaking it.
       clearPinnedTab(context.conversationId);
-      const message =
-        err instanceof Error ? err.message : String(err);
+      const message = err instanceof Error ? err.message : String(err);
       log.warn(
         { conversationId: context.conversationId, err },
         "Vellum.createTab failed; aborting --new-tab navigate",
@@ -1075,7 +1073,7 @@ export async function executeBrowserNavigate(
                 "1. Take a snapshot to find the sign-in form elements",
               );
               lines.push(
-                "2. Use credential fill to enter email/password from credential_store",
+                "2. Use credential fill to enter email/password from the credential vault",
               );
               lines.push(
                 "3. For email verification codes, use ui_show with a form to request the code mid-turn",
@@ -1102,7 +1100,7 @@ export async function executeBrowserNavigate(
           lines.push("Handle this by interacting with the login form:");
           lines.push("1. Take a snapshot to find the sign-in form elements");
           lines.push(
-            "2. Use credential fill to enter email/password from credential_store",
+            "2. Use credential fill to enter email/password from the credential vault",
           );
           lines.push(
             "3. For email verification codes, use ui_show with a form to request the code mid-turn",
@@ -2175,13 +2173,13 @@ export async function executeBrowserFillCredential(
         reason.includes("no stored value")
       ) {
         return {
-          content: `No credential stored for ${service}/${field}. Use credential_store to save it first.`,
+          content: `No credential stored for ${service}/${field}. Use \`assistant credentials set\` to save it first.`,
           isError: true,
         };
       }
       if (reason.includes("not allowed to use credential")) {
         return {
-          content: `Policy denied: ${reason} Update the credential's allowed_tools via credential_store if this tool should have access.`,
+          content: `Policy denied: ${reason} Update the credential's allowed_tools via \`assistant credentials set\` if this tool should have access.`,
           isError: true,
         };
       }

package/src/tools/credentials/broker.ts

@@ -76,7 +76,7 @@ export class CredentialBroker {
         reason:
           `Tool "${request.toolName}" is not allowed to use credential ${request.service}/${request.field}. ` +
           (tools.length === 0
-            ? "No tools are currently allowed - update the credential with allowed_tools via credential_store."
+            ? "No tools are currently allowed - update the credential's allowed_tools via `assistant credentials set`."
             : `Allowed tools: ${tools.join(", ")}.`),
       };
     }
@@ -186,7 +186,7 @@ export class CredentialBroker {
         reason:
           `Tool "${request.toolName}" is not allowed to use credential ${request.service}/${request.field}. ` +
           (tools.length === 0
-            ? "No tools are currently allowed - update the credential with allowed_tools via credential_store."
+            ? "No tools are currently allowed - update the credential's allowed_tools via `assistant credentials set`."
             : `Allowed tools: ${tools.join(", ")}.`),
       };
     }
@@ -282,7 +282,7 @@ export class CredentialBroker {
         reason:
           `Tool "${request.toolName}" is not allowed to use credential ${request.service}/${request.field}. ` +
           (tools.length === 0
-            ? "No tools are currently allowed - update the credential with allowed_tools via credential_store."
+            ? "No tools are currently allowed - update the credential's allowed_tools via `assistant credentials set`."
             : `Allowed tools: ${tools.join(", ")}.`),
       };
     }
@@ -365,7 +365,7 @@ export class CredentialBroker {
         reason:
           `Tool "${request.requestingTool}" is not allowed to use credential ${metadata.service}/${metadata.field}. ` +
           (tools.length === 0
-            ? "No tools are currently allowed - update the credential with allowed_tools via credential_store."
+            ? "No tools are currently allowed - update the credential's allowed_tools via `assistant credentials set`."
             : `Allowed tools: ${tools.join(", ")}.`),
       };
     }