@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/tools/credentials/vault.ts

@@ -1,7 +1,11 @@
-import { getConfig } from "../../config/loader.js";
+import {
+  formatSlackChannelStatus,
+  isSlackChannelCredential,
+  persistPromptedCredential,
+  storeSlackChannelCredential,
+} from "../../credential-execution/prompted-credential.js";
 import {
   clearSlackUserToken,
-  setSlackChannelConfig,
   type SlackChannelConfigResult,
 } from "../../daemon/handlers/config-slack-channel.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
@@ -22,7 +26,6 @@ import type {
   ToolDefinition,
   ToolExecutionResult,
 } from "../types.js";
-import { credentialBroker } from "./broker.js";
 import {
   assertMetadataWritable,
   deleteCredentialMetadata,
@@ -38,41 +41,6 @@ import { toPolicyFromInput, validatePolicyInput } from "./policy-validate.js";
 
 const log = getLogger("credential-vault");
 
-function isSlackChannelCredential(
-  service: string,
-  field: string,
-): field is "bot_token" | "app_token" | "user_token" {
-  return (
-    service === "slack_channel" &&
-    (field === "bot_token" || field === "app_token" || field === "user_token")
-  );
-}
-
-async function storeSlackChannelCredential(
-  field: "bot_token" | "app_token" | "user_token",
-  value: string,
-): Promise<SlackChannelConfigResult> {
-  if (field === "bot_token") {
-    return setSlackChannelConfig(value, undefined);
-  }
-  if (field === "app_token") {
-    return setSlackChannelConfig(undefined, value);
-  }
-  return setSlackChannelConfig(undefined, undefined, value);
-}
-
-function formatSlackChannelStatus(result: SlackChannelConfigResult): string {
-  if (result.connected) {
-    const teamLabel = result.teamName ?? "Slack";
-    const botLabel = result.botUsername ? ` (@${result.botUsername})` : "";
-    return ` Slack channel connected to ${teamLabel}${botLabel}.`;
-  }
-  if (result.warning) {
-    return ` ${result.warning}`;
-  }
-  return "";
-}
-
 export const credentialStoreTool = {
   name: "credential_store",
   description:
@@ -347,8 +315,8 @@ export const credentialStoreTool = {
         }
         try {
           upsertCredentialMetadata(service, field, {
-            allowedTools: policy.allowedTools,
-            allowedDomains: policy.allowedDomains,
+            allowedTools: policyInput.allowed_tools,
+            allowedDomains: policyInput.allowed_domains,
             usageDescription: policy.usageDescription,
             alias,
             injectionTemplates,
@@ -701,106 +669,27 @@ export const credentialStoreTool = {
           };
         }
 
-        // Handle one-time send delivery: inject into context without persisting
-        if (result.delivery === "transient_send") {
-          if (isSlackChannelCredential(service, field)) {
-            return {
-              content:
-                "Error: Slack channel credentials must be saved to secure storage. Re-run the secure prompt and choose to store the token.",
-              isError: true,
-            };
-          }
-          const config = getConfig();
-          if (!config.secretDetection.allowOneTimeSend) {
-            log.warn(
-              { service, field },
-              "One-time send requested but not enabled in config",
-            );
-            return {
-              content:
-                "Error: one-time send is not enabled. Set secretDetection.allowOneTimeSend to true in config.",
-              isError: true,
-            };
-          }
-          // Ensure metadata exists so broker policy checks work, but don't
-          // overwrite an existing record - a stored credential's policy should
-          // not be silently replaced by the transient prompt's policy.
-          // Metadata must be written before injecting the transient value so
-          // we never leave a dangling value that fails policy checks.
-          if (!getCredentialMetadata(service, field)) {
-            try {
-              upsertCredentialMetadata(service, field, {
-                allowedTools: promptPolicy.allowedTools,
-                allowedDomains: promptPolicy.allowedDomains,
-                usageDescription: promptPolicy.usageDescription,
-                injectionTemplates: promptInjectionTemplates,
-              });
-            } catch (err) {
-              // Without metadata the broker's policy checks will reject usage,
-              // so the transient value would be silently unusable. Fail loudly.
-              log.error(
-                { service, field, err },
-                "metadata write failed for transient credential",
-              );
-              return {
-                content: `Error: failed to write credential metadata for ${service}/${field}; the one-time value was discarded.`,
-                isError: true,
-              };
-            }
-          }
-          // Inject into broker for one-time use by the next tool call, then discard
-          credentialBroker.injectTransient(service, field, result.value);
-          log.info(
-            { service, field, delivery: "transient_send" },
-            "One-time secret delivery used",
-          );
+        const persisted = await persistPromptedCredential({
+          service,
+          field,
+          value: result.value,
+          delivery: result.delivery,
+          policy: {
+            allowedTools: promptPolicyInput.allowed_tools,
+            allowedDomains: promptPolicyInput.allowed_domains,
+            usageDescription: promptPolicy.usageDescription,
+            injectionTemplates: promptInjectionTemplates,
+          },
+        });
+        if (persisted.outcome === "error") {
+          return { content: `Error: ${persisted.message}`, isError: true };
+        }
+        if (persisted.outcome === "transient") {
           return {
             content: `One-time credential provided for ${service}/${field}. The value was NOT saved to the vault and will be consumed by the next operation.`,
             isError: false,
           };
         }
-
-        let slackChannelResult: SlackChannelConfigResult | undefined;
-        if (isSlackChannelCredential(service, field)) {
-          slackChannelResult = await storeSlackChannelCredential(
-            field,
-            result.value,
-          );
-          if (!slackChannelResult.success) {
-            return {
-              content: `Error: ${
-                slackChannelResult.error ?? "failed to configure Slack channel"
-              }`,
-              isError: true,
-            };
-          }
-        } else {
-          // Default: persist to credential store
-          const key = credentialKey(service, field);
-          const ok = await setSecureKeyAsync(key, result.value);
-          if (!ok) {
-            return {
-              content: "Error: failed to store credential",
-              isError: true,
-            };
-          }
-        }
-        try {
-          upsertCredentialMetadata(service, field, {
-            allowedTools: promptPolicy.allowedTools,
-            allowedDomains: promptPolicy.allowedDomains,
-            usageDescription: promptPolicy.usageDescription,
-            injectionTemplates: promptInjectionTemplates,
-          });
-        } catch (err) {
-          log.warn(
-            { service, field, err },
-            "metadata write failed after storing credential",
-          );
-        }
-        if (!isSlackChannelCredential(service, field)) {
-          await syncManualTokenConnection(service);
-        }
         const promptMeta = getCredentialMetadata(service, field);
         const promptCredIdSuffix = promptMeta
           ? ` (credential_id: ${promptMeta.credentialId})`
@@ -808,8 +697,8 @@ export const credentialStoreTool = {
         const promptRetrieveHint = ` Retrieve with: \`assistant credentials reveal --service ${service} --field ${field}\``;
         return {
           content: `Credential stored for ${service}/${field}.${promptCredIdSuffix}${promptRetrieveHint}${
-            slackChannelResult
-              ? formatSlackChannelStatus(slackChannelResult)
+            persisted.slackChannel
+              ? formatSlackChannelStatus(persisted.slackChannel)
               : ""
           }`,
           isError: false,

package/src/tools/executor.ts

@@ -12,6 +12,11 @@ import { TokenExpiredError } from "../security/token-manager.js";
 import { PermissionDeniedError, ToolError } from "../util/errors.js";
 import { pathExists, safeStatSync } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
+import {
+  callerOwnsWorkflowRun,
+  manifestGrantsSideEffects,
+} from "../workflows/capabilities.js";
+import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { resolveExecutionTarget } from "./execution-target.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { PermissionChecker } from "./permission-checker.js";
@@ -138,6 +143,70 @@ export class ToolExecutor {
         context.requireFreshApproval = true;
       }
 
+      // A workflow run whose capability manifest grants side-effecting tools or
+      // host functions (beyond the read-only baseline) must prompt at LAUNCH.
+      // The manifest is authored and declared by the model, and the run's
+      // leaves execute granted tools DIRECTLY (no per-call permission check) -
+      // so the launch is the single point at which the user can consent to the
+      // grant, which would otherwise bypass the gate those tools hit when the
+      // main agent calls them. requireFreshApproval promotes the otherwise
+      // low-risk launch to an interactive prompt that cached grants/trust rules
+      // cannot silently bypass (run_workflow is not itself a SIDE_EFFECT tool,
+      // so forcePromptSideEffects would not fire — requireFreshApproval is the
+      // self-sufficient promotion). Read-only runs stay low-risk and silent.
+      if (
+        name === "run_workflow" &&
+        manifestGrantsSideEffects(input.capabilities)
+      ) {
+        context.requireFreshApproval = true;
+      }
+
+      // Creating a workflow-mode schedule whose capability manifest grants
+      // side-effecting tools or host functions persists that grant for an
+      // unattended future run — so the user consents to it at CREATION, the
+      // single interactive point in the flow (a triggered run later fires with
+      // no live conversation). Same rationale as run_workflow above: the
+      // manifest is model-declared and the eventual run's leaves execute granted
+      // tools directly (no per-call prompt). Read-only or absent manifests stay
+      // low-risk and silent. `schedule_create` is not a SIDE_EFFECT tool, so
+      // requireFreshApproval is the self-sufficient promotion.
+      if (
+        name === "schedule_create" &&
+        input.mode === "workflow" &&
+        manifestGrantsSideEffects(input.capabilities)
+      ) {
+        context.requireFreshApproval = true;
+      }
+
+      // Resuming a workflow whose STORED manifest granted side-effecting tools /
+      // host functions restarts unfinished leaves that perform those side
+      // effects. The original consent was given at LAUNCH (run_workflow above),
+      // but resume is reachable by any actor who can list or guess the run id —
+      // so re-require a fresh interactive approval when the target run's stored
+      // manifest grants side effects. The other manage_workflows actions
+      // (status/abort/list_runs) and resumes of read-only runs stay low-risk and
+      // silent. `manage_workflows` is not a SIDE_EFFECT tool, so (like
+      // run_workflow) requireFreshApproval is the self-sufficient promotion.
+      if (name === "manage_workflows" && input.action === "resume") {
+        const targetRunId =
+          typeof input.run_id === "string" ? input.run_id : undefined;
+        const targetRun = targetRunId
+          ? getWorkflowRunManager().status(targetRunId)
+          : null;
+        // Only promote to fresh approval for a run the caller actually OWNS. The
+        // tool hides others' runs as not-found, so prompting here for a
+        // non-owned run would both leak that the run exists and nag the guardian
+        // for a resume that will return not-found. Uses the same ownership scope
+        // the tool applies (callerOwnsWorkflowRun) so the gate and the tool agree.
+        if (
+          targetRun &&
+          callerOwnsWorkflowRun(targetRun, context) &&
+          manifestGrantsSideEffects(targetRun.capabilities)
+        ) {
+          context.requireFreshApproval = true;
+        }
+      }
+
       // A consumed scoped grant is a complete authorization - skip the
       // interactive permission/prompt flow so non-interactive sessions
       // don't auto-deny prompt-gated tools and burn the one-time grant.

package/src/tools/flag-gated-tools.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Tests for `syncFlagGatedTools()` — the follow-up registration that runs after
+ * feature-flag overrides are fetched from the gateway. `initializeTools()` runs
+ * during startup BEFORE that async fetch resolves, so a flag-enabled assistant
+ * would otherwise never expose the gated tools until a restart (which can lose
+ * the same race). These tests drive the gated-tool sets directly by mocking
+ * `tool-manifest.js`, so they verify the registry behavior in isolation without
+ * loading the full tool manifest.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// Controllable gated-tool set. `syncFlagGatedTools()` dynamically imports
+// `./tool-manifest.js` and reads only this helper, so mocking it lets a test
+// simulate "flag enabled" (non-empty) vs "flag off / not yet loaded" ([]).
+let cesEnabled: Array<{ name: string }> = [];
+mock.module("./tool-manifest.js", () => ({
+  getCesToolsIfEnabled: () => cesEnabled,
+}));
+
+import {
+  __clearRegistryForTesting,
+  getTool,
+  syncFlagGatedTools,
+} from "./registry.js";
+
+function fakeTool(name: string) {
+  return {
+    name,
+    description: `fake ${name}`,
+    category: "test",
+    defaultRiskLevel: "low" as never,
+    executionTarget: "sandbox" as const,
+    input_schema: { type: "object", properties: {}, required: [] },
+    execute: async () => ({ content: "ok", isError: false }),
+  };
+}
+
+describe("syncFlagGatedTools", () => {
+  beforeEach(() => {
+    __clearRegistryForTesting();
+    cesEnabled = [];
+  });
+
+  test("registers a CES tool that startup registration missed (the race)", async () => {
+    cesEnabled = [fakeTool("make_authenticated_request")];
+    // Simulates initializeTools() having run before the flag was known.
+    expect(getTool("make_authenticated_request")).toBeUndefined();
+
+    await syncFlagGatedTools();
+
+    expect(getTool("make_authenticated_request")).toBeDefined();
+  });
+
+  test("is idempotent — re-running does not throw or duplicate", async () => {
+    cesEnabled = [fakeTool("make_authenticated_request")];
+
+    await syncFlagGatedTools();
+    await syncFlagGatedTools();
+
+    expect(getTool("make_authenticated_request")).toBeDefined();
+  });
+
+  test("registers nothing when no gated flag is enabled", async () => {
+    await syncFlagGatedTools();
+
+    expect(getTool("make_authenticated_request")).toBeUndefined();
+  });
+});

package/src/tools/permission-checker.ts

@@ -9,6 +9,7 @@ import {
 } from "../permissions/checker.js";
 import { getAutoApproveThreshold } from "../permissions/gateway-threshold-reader.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
+import { isFullAccessThreshold } from "../permissions/threshold.js";
 import type {
   ApprovalMode,
   ApprovalReason,
@@ -183,7 +184,13 @@ export class PermissionChecker {
       // cannot bypass the interactive prompt. This is separate from the
       // forcePromptSideEffects path above to ensure requireFreshApproval
       // is self-sufficient without relying on SIDE_EFFECT_TOOLS membership.
-      if (context.requireFreshApproval && result.decision === "allow") {
+      // At a full-access posture the user has opted into auto-approving even
+      // high-risk tools, so the promotion is skipped.
+      if (
+        context.requireFreshApproval &&
+        result.decision === "allow" &&
+        !isFullAccessThreshold(riskThreshold)
+      ) {
         result.decision = "prompt";
         result.reason =
           "Fresh approval required: per-invocation human review enforced";

package/src/tools/registry.ts

@@ -199,6 +199,17 @@ export function getTool(name: string): Tool | undefined {
   return tools.get(name);
 }
 
+/**
+ * True once {@link initializeTools} has populated the core registry (the core
+ * snapshot is captured at the end of init). Callers that must not run before the
+ * read-only baseline (`file_read`/`web_fetch`/etc.) exists — e.g. the scheduler
+ * deferring boot-time workflow triggers — gate on this. It only ever flips
+ * false→true, so a true reading is stable for the process lifetime.
+ */
+export function areCoreToolsInitialized(): boolean {
+  return coreToolsSnapshot !== null;
+}
+
 export function getAllTools(): Tool[] {
   return Array.from(tools.values());
 }
@@ -944,6 +955,46 @@ export async function initializeTools(): Promise<void> {
   await loadWorkspaceTools();
 }
 
+/**
+ * Register any feature-flag-gated tools (CES `ces-tools`) that are enabled but
+ * not yet in the registry. Idempotent and safe to call repeatedly.
+ *
+ * `initializeTools()` registers the gated tools once at startup, but feature-flag
+ * overrides are fetched from the gateway ASYNCHRONOUSLY and non-blocking (see
+ * `lifecycle.ts` — `initFeatureFlagOverrides()` is fired with `void`), so
+ * `initializeTools()` can run BEFORE the flag value is known and register
+ * nothing. The daemon receives ALL overrides (local `protected/feature-flags.json`
+ * and remote/LaunchDarkly alike) through that async fetch, so this race affects
+ * every install — without this follow-up sync a flag-enabled assistant would
+ * never see the gated tools until a restart, which can lose the same race again.
+ * Call this once the override fetch resolves.
+ *
+ * Enable-direction only: it does not unregister tools whose flag was turned OFF
+ * (a live flip to OFF still requires a restart to drop them — the expected
+ * behavior for daemon-gating flags). Never throws.
+ */
+export async function syncFlagGatedTools(): Promise<void> {
+  try {
+    const { getCesToolsIfEnabled } = await import("./tool-manifest.js");
+    const enabled = [...getCesToolsIfEnabled()];
+    const added: string[] = [];
+    for (const tool of enabled) {
+      if (tool.name && !tools.has(tool.name)) {
+        registerTool(tool);
+        added.push(tool.name);
+      }
+    }
+    if (added.length > 0) {
+      log.info({ tools: added }, "Registered flag-gated tools after flag load");
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "syncFlagGatedTools failed; flag-gated tools may stay unregistered until restart",
+    );
+  }
+}
+
 /**
  * Reset registry to its post-initializeTools() baseline. Exposed
  * exclusively for test isolation - prevents cross-file contamination

package/src/tools/schedule/create.ts

@@ -1,3 +1,6 @@
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
+import { getConfig } from "../../config/loader.js";
+import { validateScheduleInferenceProfile } from "../../schedule/inference-profile.js";
 import { formatIntegrationSummary } from "../../schedule/integration-status.js";
 import { validateRruleSetLines } from "../../schedule/recurrence-engine.js";
 import { normalizeScheduleSyntax } from "../../schedule/recurrence-types.js";
@@ -12,9 +15,13 @@ import {
   formatLocalDate,
   isValidCronExpression,
 } from "../../schedule/schedule-store.js";
+import {
+  CapabilityManifestSchema,
+  resolveCapabilities,
+} from "../../workflows/capabilities.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
-const VALID_MODES: ScheduleMode[] = ["notify", "execute", "script"];
+const VALID_MODES: ScheduleMode[] = ["notify", "execute", "script", "workflow"];
 const VALID_ROUTING_INTENTS: RoutingIntent[] = [
   "single_channel",
   "multi_channel",
@@ -49,6 +56,14 @@ export async function executeScheduleCreate(
   const maxRetries = input.max_retries as number | undefined;
   const retryBackoffMs = input.retry_backoff_ms as number | undefined;
   const timeoutMs = input.timeout_ms as number | undefined;
+  const workflowName =
+    typeof input.workflow_name === "string" ? input.workflow_name.trim() : null;
+  const workflowArgs = input.workflow_args;
+  const inferenceProfile = input.inference_profile as string | undefined;
+
+  // Validated workflow capability manifest, resolved only for workflow mode.
+  // Left null for non-workflow modes so `createSchedule` persists no manifest.
+  let capabilities: unknown = null;
 
   if (timeoutMs !== undefined) {
     const timeoutError = validateScriptTimeoutMs(timeoutMs);
@@ -57,6 +72,19 @@ export async function executeScheduleCreate(
     }
   }
 
+  if (inferenceProfile !== undefined) {
+    if (typeof inferenceProfile !== "string") {
+      return {
+        content: "Error: inference_profile must be a string",
+        isError: true,
+      };
+    }
+    const profileError = validateScheduleInferenceProfile(inferenceProfile);
+    if (profileError) {
+      return { content: `Error: ${profileError}`, isError: true };
+    }
+  }
+
   if (!name || typeof name !== "string") {
     return {
       content: "Error: name is required and must be a string",
@@ -92,6 +120,40 @@ export async function executeScheduleCreate(
         isError: true,
       };
     }
+  } else if (mode === "workflow") {
+    // Workflow mode is gated by the `workflows` flag (a scheduled run would
+    // otherwise hard-fail at trigger time) and requires a saved workflow name —
+    // mirrors the HTTP route's create-side validation so the assistant-facing
+    // path and the settings route enforce the same shape.
+    if (!isAssistantFeatureFlagEnabled("workflows", getConfig())) {
+      return { content: "Error: workflows are not enabled.", isError: true };
+    }
+    if (!workflowName) {
+      return {
+        content:
+          "Error: workflow_name is required for workflow mode and must be a non-empty string",
+        isError: true,
+      };
+    }
+    // A workflow schedule may carry a capability manifest — the single consent
+    // point for its eventual unattended run. Validate and normalize it here so a
+    // schedule can never persist a malformed or forbidden manifest: parse the
+    // declared shape, then run the same forbidden/unknown/host-tool checks
+    // resolveCapabilities applies at launch. A side-effecting manifest forces a
+    // fresh approval at CREATION (see executor.ts).
+    if (input.capabilities !== undefined) {
+      try {
+        const manifest = CapabilityManifestSchema.parse(input.capabilities);
+        resolveCapabilities(manifest);
+        capabilities = manifest;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: `Error: invalid capabilities manifest: ${msg}`,
+          isError: true,
+        };
+      }
+    }
   } else {
     if (!message || typeof message !== "string") {
       return {
@@ -157,6 +219,10 @@ export async function executeScheduleCreate(
         maxRetries,
         retryBackoffMs,
         timeoutMs,
+        workflowName,
+        workflowArgs,
+        capabilities,
+        inferenceProfile,
         createdFromConversationId: context.conversationId,
       });
 
@@ -170,6 +236,9 @@ export async function executeScheduleCreate(
           `  Description: ${job.description}`,
           `  Type: one-shot`,
           `  Mode: ${job.mode}`,
+          ...(job.inferenceProfile
+            ? [`  Inference profile: ${job.inferenceProfile}`]
+            : []),
           `  Fire at: ${fireDate}`,
           `  Enabled: ${job.enabled}`,
           `  Status: ${job.status}`,
@@ -241,6 +310,10 @@ export async function executeScheduleCreate(
       maxRetries,
       retryBackoffMs,
       timeoutMs,
+      workflowName,
+      workflowArgs,
+      capabilities,
+      inferenceProfile,
       createdFromConversationId: context.conversationId,
     });
 
@@ -261,6 +334,9 @@ export async function executeScheduleCreate(
         `  Description: ${job.description}`,
         `  Syntax: ${job.syntax}`,
         `  Mode: ${job.mode}`,
+        ...(job.inferenceProfile
+          ? [`  Inference profile: ${job.inferenceProfile}`]
+          : []),
         `  Schedule: ${scheduleDescription}${
           job.timezone ? ` (${job.timezone})` : ""
         }`,

package/src/tools/schedule/list.ts

@@ -71,6 +71,7 @@ export async function executeScheduleList(
       `  Enabled: ${job.enabled}`,
       `  Quiet: ${job.quiet}`,
       `  Reuse conversation: ${job.reuseConversation}`,
+      `  Inference profile: ${job.inferenceProfile ?? "default (mainAgent)"}`,
       `  Message: ${job.message}`,
     );