@vellumai/assistant 0.8.5 → 0.8.7

package/src/__tests__/plugin-bootstrap.test.ts

@@ -31,20 +31,16 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: getSecureKeyAsyncMock,
 }));
 
-import {
-  _setOverridesForTesting,
-  clearFeatureFlagOverridesCache,
-} from "../config/assistant-feature-flags.js";
-import type { AssistantConfig } from "../config/schema.js";
-import {
-  bootstrapPlugins,
-  type DaemonContext,
-} from "../daemon/external-plugins-bootstrap.js";
+import { clearFeatureFlagOverridesCache } from "../config/assistant-feature-flags.js";
+import { bootstrapPlugins } from "../daemon/external-plugins-bootstrap.js";
 import { runShutdownHooks } from "../daemon/shutdown-registry.js";
 import { RiskLevel } from "../permissions/types.js";
+import { registerDefaultPlugins } from "../plugins/defaults/index.js";
 import {
+  closeRegistration,
   getInjectors,
   getMiddlewaresFor,
+  getRegisteredPlugins,
   registerPlugin,
   resetPluginRegistryForTests,
 } from "../plugins/registry.js";
@@ -54,6 +50,8 @@ import {
   PluginExecutionError,
   type PluginInitContext,
 } from "../plugins/types.js";
+import { APP_VERSION } from "../version.js";
+import { setOverridesForTesting } from "./feature-flag-test-helpers.js";
 
 // Redirect plugin storage directory creation into a per-process temp tree so
 // the test doesn't touch the developer's real ~/.vellum.
@@ -63,12 +61,6 @@ const TEST_WORKSPACE_DIR = join(
 );
 process.env.VELLUM_WORKSPACE_DIR = TEST_WORKSPACE_DIR;
 
-const fakeConfig = {} as unknown as AssistantConfig;
-const fakeCtx: DaemonContext = {
-  config: fakeConfig,
-  assistantVersion: "9.9.9-test",
-};
-
 /**
  * Test helper. Accepts the new `hooks` bag and ALSO legacy top-level
  * `init` / `onShutdown` for ergonomics — the helper merges them into a
@@ -125,7 +117,7 @@ describe("plugin bootstrap", () => {
     getSecureKeyAsyncMock.mockReset();
     getSecureKeyAsyncMock.mockImplementation(async () => undefined);
     // Reset feature-flag cache so tests start from a known state. Individual
-    // tests that exercise `requiresFlag` use `_setOverridesForTesting(...)`
+    // tests that exercise `requiresFlag` use `setOverridesForTesting(...)`
     // to install their own overrides.
     clearFeatureFlagOverridesCache();
     // Clean storage directory between runs so nothing leaks across cases.
@@ -141,7 +133,7 @@ describe("plugin bootstrap", () => {
     });
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     expect(received).toBeDefined();
     const ctx = received!;
@@ -157,7 +149,7 @@ describe("plugin bootstrap", () => {
       join(TEST_WORKSPACE_DIR, "plugins-data", "alpha"),
     );
     expect(existsSync(ctx.pluginStorageDir)).toBe(true);
-    expect(ctx.assistantVersion).toBe("9.9.9-test");
+    expect(ctx.assistantVersion).toBe(APP_VERSION);
   });
 
   test("credential resolution: init receives the resolved value under credentials[key]", async () => {
@@ -178,7 +170,7 @@ describe("plugin bootstrap", () => {
     );
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     expect(getSecureKeyAsyncMock).toHaveBeenCalledTimes(1);
     expect(getSecureKeyAsyncMock).toHaveBeenCalledWith("some-key");
@@ -198,7 +190,7 @@ describe("plugin bootstrap", () => {
 
     let caught: unknown;
     try {
-      await bootstrapPlugins(fakeCtx);
+      await bootstrapPlugins();
     } catch (err) {
       caught = err;
     }
@@ -230,7 +222,7 @@ describe("plugin bootstrap", () => {
 
     let caught: unknown;
     try {
-      await bootstrapPlugins(fakeCtx);
+      await bootstrapPlugins();
     } catch (err) {
       caught = err;
     }
@@ -278,7 +270,7 @@ describe("plugin bootstrap", () => {
 
     let caught: unknown;
     try {
-      await bootstrapPlugins(fakeCtx);
+      await bootstrapPlugins();
     } catch (err) {
       caught = err;
     }
@@ -306,7 +298,7 @@ describe("plugin bootstrap", () => {
       }),
     );
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
     await runShutdownHooks("test-shutdown");
 
     // The last plugin to register must shut down first; the first to register
@@ -322,7 +314,38 @@ describe("plugin bootstrap", () => {
     // tool-result truncate, etc.). Just assert bootstrap completes without
     // throwing — the surface of defaults is verified in each pipeline's own
     // dedicated test file.
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
+  });
+
+  test("startup ordering: defaults registered before the window closes survive bootstrap replay", async () => {
+    /**
+     * Reproduces the daemon startup ordering the registration regression
+     * guards: defaults must register before `loadUserPlugins()` closes the
+     * window, so the `registerDefaultPlugins` replay inside `bootstrapPlugins`
+     * is swallowed by the duplicate-name check instead of throwing on the
+     * closed window and leaving every default unregistered.
+     */
+
+    // GIVEN the first-party defaults have registered while the window is open
+    // (what `initializePlugins()` does at daemon startup)
+    registerDefaultPlugins();
+
+    // AND a user plugin registers after them (what `loadUserPlugins()` does)
+    registerPlugin(buildPlugin("user-after-defaults"));
+
+    // AND the registration window has since closed
+    closeRegistration();
+
+    // WHEN bootstrap runs and replays the default registration
+    await bootstrapPlugins();
+
+    // THEN the defaults are still registered, ahead of the user plugin, so the
+    // middleware onion order is unchanged
+    const names = getRegisteredPlugins().map((p) => p.manifest.name);
+    expect(names).toContain("default-llm-call");
+    expect(names.indexOf("default-llm-call")).toBeLessThan(
+      names.indexOf("user-after-defaults"),
+    );
   });
 
   // ── requiresFlag gating (G2.2) ──────────────────────────────────────────
@@ -335,11 +358,11 @@ describe("plugin bootstrap", () => {
   //   - no shutdown hook entry is installed (nothing to tear down later).
   // Plugins without `requiresFlag` are unaffected.
   //
-  // Uses `_setOverridesForTesting` to control the resolver deterministically
+  // Uses `setOverridesForTesting` to control the resolver deterministically
   // — no disk writes, no gateway IPC, no reliance on registry defaults.
 
   test("requiresFlag enabled: plugin inits normally", async () => {
-    _setOverridesForTesting({ "plugin-gated-enabled": true });
+    setOverridesForTesting({ "plugin-gated-enabled": true });
 
     let initFired = false;
     const plugin = buildPlugin(
@@ -353,13 +376,13 @@ describe("plugin bootstrap", () => {
     );
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     expect(initFired).toBe(true);
   });
 
   test("requiresFlag disabled: init does not fire and no tools/routes/skills are registered", async () => {
-    _setOverridesForTesting({ "plugin-gated-disabled": false });
+    setOverridesForTesting({ "plugin-gated-disabled": false });
 
     let initFired = false;
     // Attach tool/route/skill contributions alongside init. If gating works,
@@ -374,6 +397,7 @@ describe("plugin bootstrap", () => {
           {
             name: "gated-off-tool",
             description: "should not be registered",
+            category: "test",
             defaultRiskLevel: RiskLevel.Low,
             executionTarget: "sandbox",
             input_schema: { type: "object", properties: {}, required: [] },
@@ -409,7 +433,7 @@ describe("plugin bootstrap", () => {
     const { matchSkillRoute } =
       await import("../runtime/skill-route-registry.js");
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // init must not have fired.
     expect(initFired).toBe(false);
@@ -432,7 +456,7 @@ describe("plugin bootstrap", () => {
     });
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     expect(initFired).toBe(true);
   });
@@ -440,7 +464,7 @@ describe("plugin bootstrap", () => {
   test("requiresFlag: one disabled flag out of several skips the plugin", async () => {
     // When ANY listed flag is disabled, the plugin is skipped wholesale —
     // this prevents sneaky partial activation on AND semantics.
-    _setOverridesForTesting({
+    setOverridesForTesting({
       "plugin-multi-a": true,
       "plugin-multi-b": false,
     });
@@ -457,7 +481,7 @@ describe("plugin bootstrap", () => {
     );
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     expect(initFired).toBe(false);
   });
@@ -469,7 +493,7 @@ describe("plugin bootstrap", () => {
     // injectors still ran on every pipeline invocation and system-prompt
     // assembly even though `init()` had never fired to set up the state they
     // depended on.
-    _setOverridesForTesting({ "plugin-middleware-disabled": false });
+    setOverridesForTesting({ "plugin-middleware-disabled": false });
 
     const gatedMiddleware: PipelineMiddlewareMap["llmCall"] = async (
       args,
@@ -493,7 +517,7 @@ describe("plugin bootstrap", () => {
     );
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // Neither the middleware slot nor the injector list should expose the
     // flag-gated plugin's contributions. The default plugins also contribute
@@ -506,7 +530,7 @@ describe("plugin bootstrap", () => {
   });
 
   test("requiresFlag disabled: no shutdown hook entry installed for the skipped plugin", async () => {
-    _setOverridesForTesting({ "plugin-shutdown-flag": false });
+    setOverridesForTesting({ "plugin-shutdown-flag": false });
 
     let shutdownFired = false;
     const plugin = buildPlugin(
@@ -521,7 +545,7 @@ describe("plugin bootstrap", () => {
     );
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
     await runShutdownHooks("test-shutdown");
 
     // The shutdown hook is a single registered callback that walks a

package/src/__tests__/plugin-route-contribution.test.ts

@@ -43,11 +43,7 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: getSecureKeyAsyncMock,
 }));
 
-import type { AssistantConfig } from "../config/schema.js";
-import {
-  bootstrapPlugins,
-  type DaemonContext,
-} from "../daemon/external-plugins-bootstrap.js";
+import { bootstrapPlugins } from "../daemon/external-plugins-bootstrap.js";
 import { runShutdownHooks } from "../daemon/shutdown-registry.js";
 import {
   registerPlugin,
@@ -69,12 +65,6 @@ const TEST_WORKSPACE_DIR = join(
 );
 process.env.VELLUM_WORKSPACE_DIR = TEST_WORKSPACE_DIR;
 
-const fakeConfig = {} as unknown as AssistantConfig;
-const fakeCtx: DaemonContext = {
-  config: fakeConfig,
-  assistantVersion: "9.9.9-test",
-};
-
 /** Build a minimal valid plugin with optional route contributions. */
 /**
  * Test helper. Accepts the new `hooks` bag and ALSO legacy top-level
@@ -149,7 +139,7 @@ describe("plugin route contributions", () => {
       }),
     );
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // init() must have run — route registration is gated on init success.
     expect(initFired).toBe(true);
@@ -179,7 +169,7 @@ describe("plugin route contributions", () => {
 
     registerPlugin(buildPlugin("echo-plugin", { routes: [route] }));
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // Sanity: route is live after bootstrap.
     expect(matchSkillRoute("/_plugin/echo", "GET")).not.toBeNull();
@@ -197,7 +187,7 @@ describe("plugin route contributions", () => {
     // route handling entirely (the guard is `if plugin.routes && length > 0`).
     registerPlugin(buildPlugin("no-routes-plugin", { async init() {} }));
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
     await runShutdownHooks("test-shutdown");
 
     // Nothing to verify beyond "neither throws" — an empty `routes` must not
@@ -228,7 +218,7 @@ describe("plugin route contributions", () => {
       }),
     );
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // Simulate an external wipe before the shutdown hook runs — e.g. a
     // different subsystem calling `resetSkillRoutesForTests` or a hot-reload
@@ -301,7 +291,7 @@ describe("plugin route contributions", () => {
       }),
     );
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // Both plugins' routes landed in the registry; matching returns one of
     // them (order defined by registration, but we only care that *some*

package/src/__tests__/plugin-skill-contribution.test.ts

@@ -31,12 +31,8 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: getSecureKeyAsyncMock,
 }));
 
-import type { AssistantConfig } from "../config/schema.js";
 import { loadSkillBySelector, loadSkillCatalog } from "../config/skills.js";
-import {
-  bootstrapPlugins,
-  type DaemonContext,
-} from "../daemon/external-plugins-bootstrap.js";
+import { bootstrapPlugins } from "../daemon/external-plugins-bootstrap.js";
 import { runShutdownHooks } from "../daemon/shutdown-registry.js";
 import {
   getPluginContributedSkillDefinition,
@@ -64,12 +60,6 @@ const TEST_WORKSPACE_DIR = join(
 );
 process.env.VELLUM_WORKSPACE_DIR = TEST_WORKSPACE_DIR;
 
-const fakeConfig = {} as unknown as AssistantConfig;
-const fakeCtx: DaemonContext = {
-  config: fakeConfig,
-  assistantVersion: "9.9.9-test",
-};
-
 /** Build a plugin that contributes one or more skills. */
 function buildSkillPlugin(
   name: string,
@@ -106,7 +96,7 @@ describe("plugin skill contributions", () => {
     };
 
     registerPlugin(buildSkillPlugin("demo-plugin", [skill]));
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // Ref count bumped to exactly 1 so we can tell register and unregister
     // are balanced downstream.
@@ -138,7 +128,7 @@ describe("plugin skill contributions", () => {
     };
 
     registerPlugin(buildSkillPlugin("catalog-plugin", [skill]));
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // loadSkillCatalog is the exact entry point `skill_load` consults via
     // `loadSkillBySelector` -> `resolveSkillSelector`.
@@ -171,7 +161,7 @@ describe("plugin skill contributions", () => {
     };
 
     registerPlugin(buildSkillPlugin("ephemeral-plugin", [skill]));
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     // Sanity: present before shutdown.
     expect(loadSkillCatalog().some((s) => s.id === "ephemeral-skill")).toBe(
@@ -206,7 +196,7 @@ describe("plugin skill contributions", () => {
       },
     });
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     expect(getPluginSkillRefCount("no-skills-plugin")).toBe(0);
     expect(getPluginContributedSkillSummaries()).toEqual([]);
@@ -231,7 +221,7 @@ describe("plugin skill contributions", () => {
 
     let caught: unknown;
     try {
-      await bootstrapPlugins(fakeCtx);
+      await bootstrapPlugins();
     } catch (err) {
       caught = err;
     }
@@ -347,7 +337,7 @@ describe("plugin skill contributions", () => {
     registerPlugin(buildSkillPlugin("shadow-plugin", [pluginSkill]));
 
     try {
-      await bootstrapPlugins(fakeCtx);
+      await bootstrapPlugins();
 
       const catalog = loadSkillCatalog();
       const entry = catalog.find((s) => s.id === "shared-id");

package/src/__tests__/plugin-tool-contribution.test.ts

@@ -6,9 +6,11 @@
  *
  * - Registering a plugin with `tools: Tool[]`, running `bootstrapPlugins`,
  *   and observing the contributed tool via `getAllTools()` / `getTool()`.
- * - Tool ownership metadata (`origin: "plugin"`, `ownerPluginId: <plugin>`)
- *   stamped authoritatively by `registerPluginTools` regardless of what the
- *   plugin author set on the incoming object.
+ * - Tool ownership (`owner: { kind: "plugin", id: <plugin> }`) recorded
+ *   authoritatively by `registerPluginTools` into the registry's
+ *   `ownersByName` map (queried via `getToolOwner(name)`), regardless of
+ *   what the plugin author set on the incoming object. The `Tool` itself
+ *   carries no ownership field — the bootstrap is the only writer.
  * - Shutdown hook unregistering the contributed tools so the registry is
  *   clean again after teardown.
  * - Direct `registerPluginTools` / `unregisterPluginTools` semantics,
@@ -37,11 +39,7 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: getSecureKeyAsyncMock,
 }));
 
-import type { AssistantConfig } from "../config/schema.js";
-import {
-  bootstrapPlugins,
-  type DaemonContext,
-} from "../daemon/external-plugins-bootstrap.js";
+import { bootstrapPlugins } from "../daemon/external-plugins-bootstrap.js";
 import { runShutdownHooks } from "../daemon/shutdown-registry.js";
 import { RiskLevel } from "../permissions/types.js";
 import {
@@ -55,14 +53,11 @@ import {
   getAllTools,
   getPluginRefCount,
   getTool,
+  getToolOwner,
   registerPluginTools,
   unregisterPluginTools,
 } from "../tools/registry.js";
-import type {
-  LoadedTool,
-  ToolContext,
-  ToolExecutionResult,
-} from "../tools/types.js";
+import type { Tool, ToolContext, ToolExecutionResult } from "../tools/types.js";
 
 // Redirect plugin-storage-directory creation into a per-process temp tree so
 // the test doesn't touch the developer's real ~/.vellum. This matches the
@@ -73,22 +68,14 @@ const TEST_WORKSPACE_DIR = join(
 );
 process.env.VELLUM_WORKSPACE_DIR = TEST_WORKSPACE_DIR;
 
-const fakeConfig = {} as unknown as AssistantConfig;
-const fakeCtx: DaemonContext = {
-  config: fakeConfig,
-  assistantVersion: "9.9.9-test",
-};
-
-function makeFakeTool(
-  name: string,
-  extras: Partial<LoadedTool> = {},
-): LoadedTool {
+function makeFakeTool(name: string, extras: Partial<Tool> = {}): Tool {
   return {
     name,
     description: `Fake ${name}`,
     defaultRiskLevel: RiskLevel.Low,
     executionTarget: "sandbox",
     input_schema: { type: "object", properties: {}, required: [] },
+    category: "",
     async execute(
       _input: Record<string, unknown>,
       _context: ToolContext,
@@ -160,17 +147,21 @@ describe("plugin tool contributions", () => {
     });
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
 
     const retrieved = getTool("plugin-contrib-tool");
     expect(retrieved).toBeDefined();
-    // Ownership metadata must be stamped authoritatively by the bootstrap —
-    // the registry uses it to drive ref-counting and conflict detection when
-    // the plugin shuts down or is hot-reloaded. Plugin tools live in their
-    // own `origin: "plugin"` namespace, disjoint from real skills, so a
-    // plugin name that happens to match a skill id cannot collide.
-    expect(retrieved?.origin).toBe("plugin");
-    expect(retrieved?.ownerPluginId).toBe("alpha-contributor");
+    // Ownership is recorded authoritatively by the bootstrap into the
+    // registry's `ownersByName` map (keyed by tool name, accessed via
+    // `getToolOwner(name)`) — the registry uses it to drive ref-counting
+    // and conflict detection when the plugin shuts down or is hot-reloaded.
+    // Plugin tools live in their own namespace, disjoint from real skills,
+    // so a plugin name that happens to match a skill id cannot collide.
+    // Ownership is not stamped on the `Tool` object itself.
+    expect(getToolOwner("plugin-contrib-tool")).toEqual({
+      kind: "plugin",
+      id: "alpha-contributor",
+    });
 
     // The tool surfaces in the global `getAllTools()` snapshot, which is
     // what downstream consumers (tool-manifest, session projection) read.
@@ -185,7 +176,7 @@ describe("plugin tool contributions", () => {
     });
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
     expect(getTool("bravo-tool")).toBeDefined();
 
     await runShutdownHooks("test-shutdown");
@@ -198,7 +189,7 @@ describe("plugin tool contributions", () => {
     const plugin = buildPlugin("no-tools", { async init() {} });
     registerPlugin(plugin);
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
     // No tool should have been registered.
     expect(getAllTools()).toHaveLength(0);
 
@@ -222,7 +213,7 @@ describe("plugin tool contributions", () => {
 
     expect(getTool("charlie-tool")).toBeUndefined();
 
-    await bootstrapPlugins(fakeCtx);
+    await bootstrapPlugins();
     expect(getTool("charlie-tool")).toBeDefined();
   });
 
@@ -238,7 +229,7 @@ describe("plugin tool contributions", () => {
     });
     registerPlugin(plugin);
 
-    await expect(bootstrapPlugins(fakeCtx)).rejects.toThrow(/delta-broken/);
+    await expect(bootstrapPlugins()).rejects.toThrow(/delta-broken/);
     expect(getTool("delta-tool")).toBeUndefined();
   });
 });
@@ -248,22 +239,23 @@ describe("registerPluginTools / unregisterPluginTools helpers", () => {
     __resetRegistryForTesting();
   });
 
-  test("registerPluginTools stamps category, origin, and ownerPluginId from the plugin name", () => {
-    // Even if the plugin author hands in a tool with no category or ownership
-    // metadata, the helper fills it in so the tool can be registered and
-    // unregistered consistently.
+  test("registerPluginTools stamps category and records ownership in the registry", () => {
+    // Even if the plugin author hands in a tool with no category, the
+    // helper fills it in and records ownership in the registry's
+    // `ownersByName` map — the tool itself never carries an `owner` field,
+    // so plugin authors can't spoof ownership by forging one.
     const accepted = registerPluginTools("my-plugin", [
       makeFakeTool("pt_stamped"),
     ]);
     expect(accepted).toHaveLength(1);
     expect(accepted[0]?.category).toBe("plugin");
-    expect(accepted[0]?.origin).toBe("plugin");
-    expect(accepted[0]?.ownerPluginId).toBe("my-plugin");
+    expect(getToolOwner("pt_stamped")).toEqual({
+      kind: "plugin",
+      id: "my-plugin",
+    });
 
     const retrieved = getTool("pt_stamped");
     expect(retrieved?.category).toBe("plugin");
-    expect(retrieved?.origin).toBe("plugin");
-    expect(retrieved?.ownerPluginId).toBe("my-plugin");
   });
 
   test("registerPluginTools exposes provider-safe aliases for unsafe plugin tool names", async () => {
@@ -313,33 +305,28 @@ describe("registerPluginTools / unregisterPluginTools helpers", () => {
     expect(getTool(paddedAlias!)).toBeDefined();
   });
 
-  test("registerPluginTools overwrites any pre-existing ownership metadata", () => {
+  test("registerPluginTools ignores forged ownership fields on the incoming tool", () => {
     // A plugin author could (maliciously or mistakenly) hand in a tool
-    // pre-tagged with another skill's or plugin's ID. The helper must
-    // overwrite it so the bootstrap is always the source of truth for
-    // ownership — and it must clear cross-origin fields (ownerSkillId /
-    // ownerMcpServerId / ownerSkillBundled / ownerSkillVersionHash) so the
-    // stamped tool cannot leak across namespaces or spoof bundled-skill
-    // auto-allow.
+    // pre-tagged with another skill's or plugin's ID. The `Tool` type now
+    // carries no ownership field at all, so any such forgery is purely
+    // inert extra data — the registry only populates `ownersByName` from
+    // the first argument to `register*Tools`, which is the single source
+    // of truth for ownership and cannot be spoofed by forging fields on
+    // the manifest.
     //
-    // The narrow `ToolDefinition` shape doesn't expose these ownership
-    // fields, so the cast through `unknown` simulates a hostile or
-    // transpiled artifact that arrives with spoofed fields baked in —
-    // the bootstrap-side defense is the second layer that must hold.
+    // Cast through `unknown` to simulate a hostile or transpiled artifact
+    // arriving with extra fields baked in.
     const spoofed = {
       ...makeFakeTool("pt_spoof"),
       origin: "skill",
-      ownerSkillId: "some-other-skill",
-      ownerSkillBundled: true,
-      ownerSkillVersionHash: "deadbeef",
-    } as unknown as LoadedTool;
+      owner: { kind: "skill", id: "some-other-skill" },
+    } as unknown as Tool;
     registerPluginTools("my-plugin", [spoofed]);
-    const retrieved = getTool("pt_spoof");
-    expect(retrieved?.origin).toBe("plugin");
-    expect(retrieved?.ownerPluginId).toBe("my-plugin");
-    expect(retrieved?.ownerSkillId).toBeUndefined();
-    expect(retrieved?.ownerSkillBundled).toBeUndefined();
-    expect(retrieved?.ownerSkillVersionHash).toBeUndefined();
+    expect(getTool("pt_spoof")).toBeDefined();
+    expect(getToolOwner("pt_spoof")).toEqual({
+      kind: "plugin",
+      id: "my-plugin",
+    });
   });
 
   test("unregisterPluginTools removes the plugin's tools", () => {