@vellumai/assistant 0.8.4 → 0.8.5

package/src/tools/computer-use/definitions.ts

@@ -8,7 +8,6 @@
  */
 
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import type { Tool, ToolExecutionResult } from "../types.js";
 
 // ---------------------------------------------------------------------------
@@ -32,12 +31,9 @@ export const computerUseClickTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           click_type: {
@@ -71,8 +67,6 @@ export const computerUseClickTool: Tool = {
         },
         required: ["reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -88,12 +82,9 @@ export const computerUseTypeTextTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           text: {
@@ -112,8 +103,6 @@ export const computerUseTypeTextTool: Tool = {
         },
         required: ["text", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -129,12 +118,9 @@ export const computerUseKeyTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           key: {
@@ -154,8 +140,6 @@ export const computerUseKeyTool: Tool = {
         },
         required: ["key", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -171,12 +155,9 @@ export const computerUseScrollTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           element_id: {
@@ -213,8 +194,6 @@ export const computerUseScrollTool: Tool = {
         },
         required: ["direction", "amount", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -230,12 +209,9 @@ export const computerUseDragTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           element_id: {
@@ -278,8 +254,6 @@ export const computerUseDragTool: Tool = {
         },
         required: ["reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -294,12 +268,9 @@ export const computerUseWaitTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           duration_ms: {
@@ -318,8 +289,6 @@ export const computerUseWaitTool: Tool = {
         },
         required: ["duration_ms", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -335,12 +304,9 @@ export const computerUseOpenAppTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           app_name: {
@@ -361,8 +327,6 @@ export const computerUseOpenAppTool: Tool = {
         },
         required: ["app_name", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -378,12 +342,9 @@ export const computerUseRunAppleScriptTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           script: {
@@ -403,8 +364,6 @@ export const computerUseRunAppleScriptTool: Tool = {
         },
         required: ["script", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -420,12 +379,9 @@ export const computerUseDoneTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           summary: {
@@ -435,8 +391,6 @@ export const computerUseDoneTool: Tool = {
         },
         required: ["summary"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -452,12 +406,9 @@ export const computerUseRespondTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {
           answer: {
@@ -471,8 +422,6 @@ export const computerUseRespondTool: Tool = {
         },
         required: ["answer", "reasoning"],
       },
-    };
-  },
 
   execute: proxyExecute,
 };
@@ -488,18 +437,13 @@ const computerUseObserveTool: Tool = {
   category: "computer-use",
   defaultRiskLevel: RiskLevel.Low,
   executionMode: "proxy",
+  executionTarget: "host",
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema: {
         type: "object",
         properties: {},
         required: [],
       },
-    };
-  },
 
   execute: proxyExecute,
 };

package/src/tools/credential-execution/make-authenticated-request.ts

@@ -13,7 +13,6 @@
 import { GrantProposalSchema, renderProposal } from "@vellumai/service-contracts/credential-rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { getLogger } from "../../util/logger.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
@@ -24,13 +23,10 @@ class MakeAuthenticatedRequestTool implements Tool {
   description =
     "Execute an authenticated HTTP request through CES. CES injects the credential and returns the response - the assistant never sees raw secrets.";
   category = "credential-execution";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.High;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           credentialHandle: {
@@ -68,9 +64,7 @@ class MakeAuthenticatedRequestTool implements Tool {
           },
         },
         required: ["credentialHandle", "method", "url", "purpose"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/credential-execution/manage-secure-command-tool.ts

@@ -18,7 +18,6 @@
 import type { ManageSecureCommandTool } from "@vellumai/service-contracts/rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { getLogger } from "../../util/logger.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
@@ -31,13 +30,10 @@ class ManageSecureCommandToolImpl implements Tool {
     "Accepts only bundle metadata for guardian review - never raw bytes or file paths. " +
     "Each invocation requires fresh approval.";
   category = "credential-execution";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.High;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           action: {
@@ -236,9 +232,7 @@ class ManageSecureCommandToolImpl implements Tool {
           },
         },
         required: ["action", "toolName"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/credential-execution/run-authenticated-command.ts

@@ -13,7 +13,6 @@
 import { GrantProposalSchema, renderProposal } from "@vellumai/service-contracts/credential-rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { getLogger } from "../../util/logger.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
@@ -24,13 +23,10 @@ class RunAuthenticatedCommandTool implements Tool {
   description =
     "Execute a command with credential environment variables injected by CES. The command runs inside the CES sandbox - the assistant never sees raw secrets.";
   category = "credential-execution";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.High;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           credentialHandle: {
@@ -97,9 +93,7 @@ class RunAuthenticatedCommandTool implements Tool {
           },
         },
         required: ["credentialHandle", "command", "purpose"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/credentials/vault.ts

@@ -10,7 +10,6 @@ import {
   getActiveConnection,
 } from "../../oauth/oauth-store.js";
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { credentialKey } from "../../security/credential-key.js";
 import {
   deleteSecureKeyAsync,
@@ -75,13 +74,10 @@ class CredentialStoreTool implements Tool {
   description =
     "Store, list, delete, or prompt for credentials in the secure vault";
   category = "credentials";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.Low;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           action: {
@@ -181,9 +177,7 @@ class CredentialStoreTool implements Tool {
           },
         },
         required: ["action"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/document/document-tool.ts

@@ -42,6 +42,65 @@ export function canAccessDocument(
 
 // ── Exported execute functions ──────────────────────────────────────
 
+export function executeDocumentOpen(
+  input: Record<string, unknown>,
+  context: ToolContext,
+): ToolExecutionResult {
+  const surfaceId = input.surface_id as string;
+  if (!canAccessDocument(surfaceId, context)) {
+    return documentNotFound(surfaceId);
+  }
+
+  const doc = getDocumentById(surfaceId);
+  if (!doc) {
+    return documentNotFound(surfaceId);
+  }
+
+  if (context.sendToClient) {
+    context.sendToClient({
+      type: "document_editor_show",
+      conversationId: context.conversationId,
+      surfaceId: doc.surfaceId,
+      title: doc.title,
+      initialContent: doc.content,
+    });
+
+    context.sendToClient({
+      type: "ui_surface_show",
+      conversationId: context.conversationId,
+      surfaceId: `preview-${doc.surfaceId}`,
+      surfaceType: "document_preview",
+      display: "inline",
+      title: doc.title,
+      data: {
+        title: doc.title,
+        surfaceId: doc.surfaceId,
+        subtitle: "Document",
+      },
+    });
+
+    return {
+      content: JSON.stringify({
+        success: true,
+        surface_id: doc.surfaceId,
+        title: doc.title,
+        word_count: doc.wordCount,
+        message: "Document editor opened",
+      }),
+      isError: false,
+    };
+  }
+
+  return {
+    content: JSON.stringify({
+      success: false,
+      surface_id: surfaceId,
+      error: "No client connected to open document editor",
+    }),
+    isError: true,
+  };
+}
+
 export function executeDocumentCreate(
   input: Record<string, unknown>,
   context: ToolContext,

package/src/tools/execution-target.ts

@@ -1,4 +1,3 @@
-import { getTool } from "./registry.js";
 import type { ExecutionTarget } from "./types.js";
 
 export interface ManifestOverride {
@@ -6,28 +5,27 @@ export interface ManifestOverride {
   execution_target: "host" | "sandbox";
 }
 
-export function resolveExecutionTarget(
-  toolName: string,
-  manifestOverride?: ManifestOverride,
-): ExecutionTarget {
-  const tool = getTool(toolName);
-  // Manifest-declared execution target is authoritative - check it first so
-  // skill tools with host_/computer_use_ prefixes aren't mis-classified.
-  if (tool?.executionTarget) {
-    return tool.executionTarget;
-  }
-  // Check the tool's executionMode metadata - proxy tools run on the connected
-  // client (host), not inside the sandbox.
-  if (tool?.executionMode === "proxy") {
-    return "host";
-  }
-  // Use manifest metadata for unregistered skill tools so the Permission
-  // Simulator shows accurate execution targets instead of defaulting to sandbox.
-  if (!tool && manifestOverride) {
-    return manifestOverride.execution_target;
-  }
-  // Prefix heuristics for core tools that don't declare an explicit target.
-  if (toolName.startsWith("host_") || toolName.startsWith("computer_use_")) {
+/**
+ * Decide a tool's execution target — sandbox (assistant container) or host
+ * (guardian's device via host-bridge proxy). Pure: same input → same output.
+ *
+ * Resolution order:
+ *   1. Declared `executionTarget` on the tool wins.
+ *   2. `executionMode === "proxy"` ⇒ host (proxied tools run on the client).
+ *   3. Name prefix heuristic — `host_*` / `computer_use_*` ⇒ host.
+ *   4. Default sandbox.
+ *
+ * Called once per tool at load/construction time. The returned value is
+ * stamped onto every `LoadedTool`, so runtime reads are just a field read.
+ */
+export function resolveExecutionTarget(tool: {
+  name: string;
+  executionTarget?: ExecutionTarget;
+  executionMode?: "local" | "proxy";
+}): ExecutionTarget {
+  if (tool.executionTarget) return tool.executionTarget;
+  if (tool.executionMode === "proxy") return "host";
+  if (tool.name.startsWith("host_") || tool.name.startsWith("computer_use_")) {
     return "host";
   }
   return "sandbox";

package/src/tools/executor.ts

@@ -22,6 +22,7 @@ import { getLogger } from "../util/logger.js";
 import { resolveExecutionTarget } from "./execution-target.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { PermissionChecker } from "./permission-checker.js";
+import { getTool } from "./registry.js";
 import { extractAndSanitize } from "./sensitive-output-placeholders.js";
 import { applyEdit } from "./shared/filesystem/edit-engine.js";
 import { sandboxPolicy } from "./shared/filesystem/path-policy.js";
@@ -126,7 +127,11 @@ export class ToolExecutor {
     let permApprovalMode: string | undefined;
     let permApprovalReason: string | undefined;
     let permRiskThreshold: string | undefined;
-    const executionTarget = resolveExecutionTarget(name);
+    // Registered tools have `executionTarget` stamped at load time; the
+    // `resolveExecutionTarget` fallback only fires for unknown tools (the
+    // executor's name-aliased lookup can race against late registration).
+    const executionTarget =
+      getTool(name)?.executionTarget ?? resolveExecutionTarget({ name });
 
     emitLifecycleEvent(context, {
       type: "start",

package/src/tools/filesystem/edit.ts

@@ -1,5 +1,4 @@
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { registerTool } from "../registry.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
 import { formatEditDiff } from "../shared/filesystem/format-diff.js";
@@ -11,13 +10,10 @@ class FileEditTool implements Tool {
   description =
     "Replace an exact string in a file on your own machine with a new string. Use this for surgical edits instead of rewriting entire files. Use host_file_edit for files on your guardian's device instead.";
   category = "filesystem";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.Low;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           path: {
@@ -45,9 +41,7 @@ class FileEditTool implements Tool {
           },
         },
         required: ["path", "old_string", "new_string", "activity"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/filesystem/list.ts

@@ -1,5 +1,4 @@
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { registerTool } from "../registry.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
 import { sandboxPolicy } from "../shared/filesystem/path-policy.js";
@@ -10,13 +9,10 @@ class FileListTool implements Tool {
   description =
     "List the contents of a directory on your own machine. Returns file and subdirectory names with type indicators and sizes.";
   category = "filesystem";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.Low;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           path: {
@@ -34,9 +30,7 @@ class FileListTool implements Tool {
           },
         },
         required: ["path", "activity"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/filesystem/read.ts

@@ -1,7 +1,6 @@
 import { extname } from "node:path";
 
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { registerTool } from "../registry.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
 import {
@@ -16,13 +15,10 @@ class FileReadTool implements Tool {
   description =
     "Read the contents of a file on your own machine. For image files (JPEG, PNG, GIF, WebP), returns the image for visual analysis. Use host_file_read for files on your guardian's device instead.";
   category = "filesystem";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.Low;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           path: {
@@ -45,9 +41,7 @@ class FileReadTool implements Tool {
           },
         },
         required: ["path", "activity"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/filesystem/write.ts

@@ -3,7 +3,6 @@ import { join, resolve, sep } from "node:path";
 import { enqueuePkbIndexJob } from "../../memory/jobs/embed-pkb-file.js";
 import { PKB_WORKSPACE_SCOPE } from "../../memory/pkb/types.js";
 import { RiskLevel } from "../../permissions/types.js";
-import type { ToolDefinition } from "../../providers/types.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir } from "../../util/platform.js";
 import { registerTool } from "../registry.js";
@@ -35,13 +34,10 @@ class FileWriteTool implements Tool {
   description =
     "Write content to a file on your own machine, creating it if it does not exist. Use host_file_write for files on your guardian's device instead.";
   category = "filesystem";
+  executionTarget = "sandbox" as const;
   defaultRiskLevel = RiskLevel.Low;
 
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
+  input_schema = {
         type: "object",
         properties: {
           path: {
@@ -60,9 +56,7 @@ class FileWriteTool implements Tool {
           },
         },
         required: ["path", "content", "activity"],
-      },
-    };
-  }
+      };
 
   async execute(
     input: Record<string, unknown>,