@vellumai/assistant 0.8.5 → 0.8.7

package/src/__tests__/sync-message-contract.test.ts

@@ -5,7 +5,7 @@ import {
   conversationMessagesSyncTag,
   type ServerMessage,
   SYNC_TAGS,
-  SyncChangedMessageSchema,
+  SyncChangedEventSchema,
 } from "../daemon/message-protocol.js";
 
 describe("sync message contract", () => {
@@ -39,26 +39,32 @@ describe("sync message contract", () => {
 
   test("schema rejects malformed sync_changed payloads", () => {
     expect(() =>
-      SyncChangedMessageSchema.parse({
+      SyncChangedEventSchema.parse({
         type: "sync_changed",
         tags: [],
       }),
     ).toThrow();
 
     expect(() =>
-      SyncChangedMessageSchema.parse({
+      SyncChangedEventSchema.parse({
         type: "sync_changed",
         tags: [""],
       }),
     ).toThrow();
+  });
 
-    expect(() =>
-      SyncChangedMessageSchema.parse({
-        type: "sync_changed",
-        tags: [SYNC_TAGS.assistantAvatar],
-        cursor: 1,
-      }),
-    ).toThrow();
+  test("schema strips unknown server-stamped fields", () => {
+    const parsed = SyncChangedEventSchema.parse({
+      type: "sync_changed",
+      tags: [SYNC_TAGS.assistantAvatar],
+      cursor: 1,
+    });
+
+    expect(parsed).toEqual({
+      type: "sync_changed",
+      tags: [SYNC_TAGS.assistantAvatar],
+    });
+    expect("cursor" in parsed).toBe(false);
   });
 
   test("buildSyncChangedMessage includes originClientId when provided", () => {
@@ -85,10 +91,7 @@ describe("sync message contract", () => {
   });
 
   test("buildSyncChangedMessage trims and drops blank originClientId", () => {
-    const blank = buildSyncChangedMessage(
-      [SYNC_TAGS.assistantAvatar],
-      "   ",
-    );
+    const blank = buildSyncChangedMessage([SYNC_TAGS.assistantAvatar], "   ");
     expect("originClientId" in blank).toBe(false);
 
     const trimmed = buildSyncChangedMessage(
@@ -104,7 +107,7 @@ describe("sync message contract", () => {
 
   test("schema accepts a string originClientId and rejects non-string types", () => {
     expect(() =>
-      SyncChangedMessageSchema.parse({
+      SyncChangedEventSchema.parse({
         type: "sync_changed",
         tags: [SYNC_TAGS.assistantAvatar],
         originClientId: "client-abc",
@@ -112,7 +115,7 @@ describe("sync message contract", () => {
     ).not.toThrow();
 
     expect(() =>
-      SyncChangedMessageSchema.parse({
+      SyncChangedEventSchema.parse({
         type: "sync_changed",
         tags: [SYNC_TAGS.assistantAvatar],
         originClientId: 42,

package/src/__tests__/system-prompt.test.ts

@@ -89,6 +89,24 @@ mock.module("../prompts/persona-resolver.js", () => ({
   resolveGuardianPersona: () => mockPersona.guardianPersona,
 }));
 
+const mockOauthConnections: Array<{
+  provider: string;
+  status: string;
+  accountInfo?: string | null;
+}> = [];
+const mockManagedConnections: Array<{
+  provider: string;
+  accountInfo?: string | null;
+}> = [];
+
+mock.module("../oauth/oauth-store.js", () => ({
+  listConnections: () => mockOauthConnections,
+}));
+
+mock.module("../credential-execution/managed-catalog.js", () => ({
+  getCachedManagedConnections: () => mockManagedConnections,
+}));
+
 // Import after mock
 const { buildSystemPrompt, ensurePromptFiles, stripCommentLines } =
   await import("../prompts/system-prompt.js");
@@ -100,6 +118,8 @@ describe("buildSystemPrompt", () => {
     // no-guardian baseline.
     mockPersona.userSlug = null;
     mockPersona.guardianPersona = null;
+    mockOauthConnections.length = 0;
+    mockManagedConnections.length = 0;
   });
 
   afterEach(() => {
@@ -152,6 +172,40 @@ describe("buildSystemPrompt", () => {
     expect(identityIdx).toBeLessThan(soulIdx);
   });
 
+  test("renders runtime-computed dynamic sections after workspace-only static sections", () => {
+    const systemPromptsDir = join(TEST_DIR, "prompts", "system");
+    mkdirSync(systemPromptsDir, { recursive: true });
+    writeFileSync(
+      join(systemPromptsDir, "99-org-policy.md"),
+      "# Org policy\n\nMostly static workspace policy.\n",
+    );
+    mockManagedConnections.push({
+      provider: "google",
+      accountInfo: "user@example.com",
+    });
+
+    const result = buildSystemPrompt();
+
+    const staticIdx = result.indexOf("Mostly static workspace policy.");
+    const dynamicIdx = result.indexOf("# Connected Services");
+    expect(staticIdx).toBeGreaterThan(-1);
+    expect(dynamicIdx).toBeGreaterThan(-1);
+    expect(dynamicIdx).toBeGreaterThan(staticIdx);
+  });
+
+  test("side-chain prompt options still include IDENTITY.md and SOUL.md", () => {
+    writeFileSync(join(TEST_DIR, "IDENTITY.md"), "# Identity\n\nI am Vellum.");
+    writeFileSync(join(TEST_DIR, "SOUL.md"), "# Soul\n\nBe thoughtful.");
+
+    const result = buildSystemPrompt({
+      excludeBootstrap: true,
+      excludeCustomPrefix: true,
+    });
+
+    expect(result).toContain("# Identity\n\nI am Vellum.");
+    expect(result).toContain("# Soul\n\nBe thoughtful.");
+  });
+
   test("ignores empty SOUL.md", () => {
     writeFileSync(join(TEST_DIR, "SOUL.md"), "   \n  \n  ");
     writeFileSync(join(TEST_DIR, "IDENTITY.md"), "# Identity\n\nI am Vellum.");
@@ -171,6 +225,44 @@ describe("buildSystemPrompt", () => {
     expect(result).toContain("# Soul\n\nBe thoughtful.");
   });
 
+  test("gates off the unmodified bundled IDENTITY.md template when no BOOTSTRAP.md is present", () => {
+    // Regression: the seeded IDENTITY.md ships with `_`-comment lines, so
+    // the raw workspace body never equals the comment-stripped bundled
+    // template. `isTemplateContent` must comment-strip BOTH sides — otherwise
+    // detection fails and the `08-identity` transform leaks the blank
+    // template scaffolding into every fresh post-onboarding prompt.
+    const bundledIdentity = readFileSync(
+      join(import.meta.dirname, "..", "prompts", "templates", "IDENTITY.md"),
+      "utf-8",
+    );
+    writeFileSync(join(TEST_DIR, "IDENTITY.md"), bundledIdentity);
+    writeFileSync(join(TEST_DIR, "SOUL.md"), "# Soul\n\nBe thoughtful.");
+    const result = buildSystemPrompt();
+    // SOUL still renders; the template scaffolding must not.
+    expect(result).toContain("# Soul\n\nBe thoughtful.");
+    expect(result).not.toContain("(not yet chosen)");
+  });
+
+  test("includes the unmodified bundled IDENTITY.md template during bootstrap", () => {
+    // The mirror case: when BOOTSTRAP.md is active the template is included
+    // verbatim so the model can see the field structure and produce a valid
+    // file_write on the first turn.
+    const bundledIdentity = readFileSync(
+      join(import.meta.dirname, "..", "prompts", "templates", "IDENTITY.md"),
+      "utf-8",
+    );
+    writeFileSync(join(TEST_DIR, "IDENTITY.md"), bundledIdentity);
+    writeFileSync(
+      join(TEST_DIR, "BOOTSTRAP.md"),
+      "# First run\n\nGet started.",
+    );
+    const result = buildSystemPrompt();
+    // The bundled template's placeholder scaffolding (the `(not yet chosen)`
+    // field markers) renders verbatim during bootstrap — the mirror of the
+    // gating test above, which asserts it is absent without BOOTSTRAP.md.
+    expect(result).toContain("(not yet chosen)");
+  });
+
   test("trims whitespace from file content", () => {
     writeFileSync(join(TEST_DIR, "SOUL.md"), "\n  Be kind  \n\n");
     const result = buildSystemPrompt();

package/src/__tests__/terminal-tools.test.ts

@@ -1,8 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
-
-import type { ShellOutputResult } from "../tools/shared/shell-output.js";
-import type { Tool } from "../tools/types.js";
+import { afterEach, describe, expect, mock, test } from "bun:test";
 
 // ── Mock modules ────────────────────────────────────────────────────────────
 
@@ -64,6 +61,7 @@ mock.module("../tools/network/script-proxy/index.js", () => ({
 
 // ── Imports (after mocks) ───────────────────────────────────────────────────
 
+import { formatShellOutput } from "../tools/shared/shell-output.js";
 import {
   ALWAYS_INJECTED_ENV_VARS,
   buildSanitizedEnv,
@@ -71,6 +69,7 @@ import {
   KATA_SAFE_ENV_VARS,
   SAFE_ENV_VARS,
 } from "../tools/terminal/safe-env.js";
+import { shellTool } from "../tools/terminal/shell.js";
 
 // ═══════════════════════════════════════════════════════════════════════════
 //  Safe Environment — buildSanitizedEnv()
@@ -210,13 +209,6 @@ describe("buildSanitizedEnv", () => {
 // ═══════════════════════════════════════════════════════════════════════════
 
 describe("Shell tool input validation", () => {
-  let shellTool: Tool;
-
-  beforeEach(async () => {
-    const mod = await import("../tools/terminal/shell.js");
-    shellTool = mod.shellTool;
-  });
-
   const baseContext = {
     workingDir: testTmpDir,
     conversationId: "test-conv-1",
@@ -308,19 +300,6 @@ describe("Shell tool input validation", () => {
 // ═══════════════════════════════════════════════════════════════════════════
 
 describe("formatShellOutput", () => {
-  let formatShellOutput: (
-    stdout: string,
-    stderr: string,
-    code: number | null,
-    timedOut: boolean,
-    timeoutSec: number,
-  ) => ShellOutputResult;
-
-  beforeEach(async () => {
-    const mod = await import("../tools/shared/shell-output.js");
-    formatShellOutput = mod.formatShellOutput;
-  });
-
   test("successful command with output", () => {
     const result = formatShellOutput("hello world", "", 0, false, 120);
     expect(result.content).toBe("hello world");

package/src/__tests__/test-preload-verifier.ts

@@ -0,0 +1,68 @@
+/**
+ * Test preload verifier — runs immediately after test-preload.ts.
+ *
+ * Bun already exits with code 1 when a preload throws, has an unresolvable
+ * import, or doesn't exist on disk (verified empirically). This file is
+ * the explicit check for the remaining failure mode: the main preload
+ * ran successfully but didn't actually isolate workspace state (e.g. a
+ * future refactor of test-preload.ts introduces a logic bug that no-ops
+ * the env override).
+ *
+ * Without this verifier, that failure mode would silently let tests
+ * resolve `VELLUM_WORKSPACE_DIR` to the real `/workspace` and potentially
+ * destroy live data.
+ *
+ * Order matters: bunfig.toml lists this AFTER test-preload.ts so the
+ * main preload's env writes are observable here.
+ *
+ * No source-module imports — only node stdlib (matches the same rule
+ * test-preload.ts enforces).
+ *
+ * Positive assertion: `VELLUM_WORKSPACE_DIR` MUST resolve under
+ * `os.tmpdir()`. This mirrors exactly what test-preload.ts does
+ * (`mkdtempSync(join(tmpdir(), "vellum-test-"))`), so any other value
+ * indicates the preload either didn't run or didn't take effect.
+ */
+
+import { realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { sep } from "node:path";
+
+function fail(reason: string): never {
+  throw new Error(
+    [
+      `Test preload verifier failed: ${reason}.`,
+      "",
+      "test-preload.ts ran but did not isolate workspace state. Common",
+      "causes:",
+      "  - a logic bug in test-preload.ts (env override removed/reordered)",
+      "  - a preload phase threw silently and the verifier still picked up",
+      "    partial state",
+    ].join("\n"),
+  );
+}
+
+function canonicalize(p: string): string {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+
+const workspaceDir = process.env.VELLUM_WORKSPACE_DIR?.trim();
+if (!workspaceDir) {
+  fail("VELLUM_WORKSPACE_DIR is not set after main preload");
+}
+
+const resolvedWorkspace = canonicalize(workspaceDir);
+const tmpRoot = canonicalize(tmpdir());
+
+if (
+  resolvedWorkspace !== tmpRoot &&
+  !resolvedWorkspace.startsWith(tmpRoot + sep)
+) {
+  fail(
+    `VELLUM_WORKSPACE_DIR resolves to ${resolvedWorkspace}, which is not under ${tmpRoot}`,
+  );
+}

package/src/__tests__/test-preload.ts

@@ -1,56 +1,42 @@
 /**
  * Shared test preload — runs before every test file.
  *
- * Creates a per-file temporary directory and sets VELLUM_WORKSPACE_DIR so that
- * all workspace-derived helpers (getDataDir, getDbPath, getConversationsDir, …)
- * resolve under the temp dir instead of the real ~/.vellum/workspace.
- *
- * Individual test files can retrieve the workspace dir via getWorkspaceDir()
- * from platform.ts, or directly from process.env.VELLUM_WORKSPACE_DIR.
+ * Creates a per-process temporary directory and sets VELLUM_WORKSPACE_DIR so
+ * that all workspace-derived helpers (getDataDir, getDbPath,
+ * getConversationsDir, getProtectedDir, …) resolve under the temp dir
+ * instead of the real $VELLUM_WORKSPACE_DIR.
  *
  * Cleanup: the temp dir is removed after all tests in the file complete.
+ *
+ * No source-module imports
+ * ------------------------
+ * The only static imports in this file are node stdlib (`node:fs`,
+ * `node:os`, `node:path`), `bun:test`, and helpers in this same directory.
+ * Importing from the assistant directly runs the risk of triggering import
+ * time side effects and import from node modules that may not exist in
+ * some environments.
  */
 
-import { mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll } from "bun:test";
 
-import { installGatewayIpcMock } from "../__tests__/mock-gateway-ipc.js";
-import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
-import { resetDb } from "../memory/db-connection.js";
-import { _setStorePath } from "../security/encrypted-store.js";
+import { installGatewayIpcMock } from "./mock-gateway-ipc.js";
 
-const testDir = realpathSync(
-  mkdtempSync(join(tmpdir(), "vellum-test-workspace-")),
-);
+// --- Phase 1: env override (zero source-module imports above this point) ---
+
+// Layout: <tmpRoot>/workspace as VELLUM_WORKSPACE_DIR. The parent of
+// VELLUM_WORKSPACE_DIR is what `vellumRoot()` resolves to, so a separate
+// tmpRoot per process gives `getProtectedDir()` and friends per-process
+// isolation without needing an explicit `setStorePathForTesting()`.
+const tmpRoot = realpathSync(mkdtempSync(join(tmpdir(), "vellum-test-")));
+const testDir = join(tmpRoot, "workspace");
+mkdirSync(testDir);
 process.env.VELLUM_WORKSPACE_DIR = testDir;
 process.env.VELLUM_PLATFORM_URL = "https://test-platform.vellum.ai";
 process.exitCode = 0;
 
-// Isolate the encrypted credential store per test file. Without this,
-// parallel test processes all read/write the same ~/.vellum/protected/keys.enc,
-// causing races when one file deletes a key while another sets it.
-_setStorePath(join(testDir, "keys.enc"));
-
-// Mock gateway IPC so no test accidentally connects to a real gateway socket.
-// Tests that need to control IPC responses use mockGatewayIpc() / resetMockGatewayIpc().
-installGatewayIpcMock();
-
-// Pre-populate the feature-flag override cache so `initFeatureFlagOverrides()`
-// short-circuits its retry loop — there is no real gateway in tests, and the
-// retry backoff would otherwise exceed the per-test timeout for any test that
-// builds the CLI program. Tests exercising the retry behavior call
-// `clearFeatureFlagOverridesCache()` first.
-_setOverridesForTesting({});
-
-// Force-close any DB connection inherited from the parent process (e.g. when
-// the test runner is spawned by the running assistant via a pre-push hook).
-// Without this, the db singleton in db-connection.ts may still point at the
-// real ~/.vellum/workspace database, and test cleanup (DELETE FROM …) would
-// wipe production data — contacts, channels, credentials, etc.
-resetDb();
-
 // Prevent tests from routing credential writes through the real CES
 // (Credential Execution Service). Without this, setSecureKeyAsync() in
 // containerized environments writes to the live credential store.
@@ -59,8 +45,15 @@ const savedCesCredentialUrl = process.env.CES_CREDENTIAL_URL;
 delete process.env.IS_CONTAINERIZED;
 delete process.env.CES_CREDENTIAL_URL;
 
+// --- Phase 2: install the IPC mock (no source-module imports) ---
+
+// Mock gateway IPC so no test accidentally connects to a real gateway socket.
+// The mock returns a sentinel for `get_feature_flags` to short-circuit the
+// retry loop in `initFeatureFlagOverrides()`. Tests that need specific IPC
+// responses use `mockGatewayIpc()` / `resetMockGatewayIpc()`.
+installGatewayIpcMock();
+
 afterAll(() => {
-  resetDb();
   process.exitCode = 0;
   delete process.env.VELLUM_WORKSPACE_DIR;
   delete process.env.VELLUM_PLATFORM_URL;
@@ -71,7 +64,7 @@ afterAll(() => {
     process.env.CES_CREDENTIAL_URL = savedCesCredentialUrl;
   }
   try {
-    rmSync(testDir, { recursive: true, force: true });
+    rmSync(tmpRoot, { recursive: true, force: true });
   } catch {
     /* best-effort cleanup */
   }

package/src/__tests__/thread-backfill.test.ts

@@ -1284,7 +1284,7 @@ describe("triggerSlackThreadBackfillIfNeeded — gap detection and persistence",
         content: [
           {
             type: "text",
-            text: "[mar 4 2026 8:38 PM MT assistant] earlier assistant reply",
+            text: "earlier assistant reply",
           },
         ],
       },
@@ -2028,6 +2028,7 @@ function buildSlackDmRequest(
 }
 
 interface SlackInboundProcessOptions {
+  attachmentIds?: string[];
   displayContent?: string;
   transport?: {
     channelId?: string;
@@ -2111,7 +2112,6 @@ function flattenText(messages: Message[]): string {
 interface CapturedSlackProcessMessage {
   conversationId: string;
   content: string;
-  attachmentIds?: string[];
   options?: SlackInboundProcessOptions;
 }
 
@@ -2146,10 +2146,9 @@ async function handleAndCaptureLiveSlackProcessMessage(
   const processMessage = async (
     conversationId: string,
     content: string,
-    attachmentIds?: string[],
     options?: SlackInboundProcessOptions,
   ): Promise<{ messageId: string }> => {
-    captured = { conversationId, content, attachmentIds, options };
+    captured = { conversationId, content, options };
     const messageId = persistSlackInboundFromProcessMessage(
       conversationId,
       content,
@@ -2212,7 +2211,6 @@ describe("handleChannelInbound — Slack thread backfill wiring", () => {
     const processMessage = async (
       _conversationId: string,
       _content: string,
-      _attachmentIds?: string[],
       options?: {
         transport?: { hints?: string[] };
       },
@@ -2327,7 +2325,7 @@ describe("handleChannelInbound — Slack thread backfill wiring", () => {
     expect(captured.content.match(/<external_content/g)?.length).toBe(1);
     expect(captured.content).toContain('<external_content source="slack"');
     expect(captured.content).toContain("\n\n</external_content>");
-    expect(captured.attachmentIds).toEqual(["att-slack-file"]);
+    expect(captured.options?.attachmentIds).toEqual(["att-slack-file"]);
     expect(captured.options?.displayContent).toBe("");
 
     const persisted = readMessagesByConversation(captured.conversationId);
@@ -2370,7 +2368,6 @@ describe("handleChannelInbound — Slack thread backfill wiring", () => {
     const processMessage = async (
       conversationId: string,
       content: string,
-      _attachmentIds?: string[],
       options?: SlackInboundProcessOptions,
     ): Promise<{ messageId: string }> => {
       const messageId = persistSlackInboundFromProcessMessage(
@@ -2495,7 +2492,6 @@ describe("handleChannelInbound — Slack thread backfill wiring", () => {
     const processMessage = async (
       conversationId: string,
       content: string,
-      _attachmentIds?: string[],
       options?: SlackInboundProcessOptions,
     ): Promise<{ messageId: string }> => ({
       messageId: persistSlackInboundFromProcessMessage(
@@ -2551,7 +2547,6 @@ describe("handleChannelInbound — Slack thread backfill wiring", () => {
     const processMessage = async (
       conversationId: string,
       content: string,
-      _attachmentIds?: string[],
       options?: SlackInboundProcessOptions,
     ): Promise<{ messageId: string }> => ({
       messageId: persistSlackInboundFromProcessMessage(

package/src/__tests__/title-generate-pipeline.test.ts

@@ -36,7 +36,7 @@ mock.module("../memory/conversation-title-service.js", () => ({
   queueGenerateConversationTitle: queueGenerateConversationTitleMock,
 }));
 
-import { defaultTitleGenerateTerminal } from "../plugins/defaults/title-generate.js";
+import { defaultTitleGenerateTerminal } from "../plugins/defaults/title-generate/terminal.js";
 import { DEFAULT_TIMEOUTS, runPipeline } from "../plugins/pipeline.js";
 import {
   getMiddlewaresFor,

package/src/__tests__/token-estimate-pipeline.test.ts

@@ -30,10 +30,8 @@ import {
   estimateToolsTokens,
 } from "../context/token-estimator.js";
 import type { TrustContext } from "../daemon/trust-context.js";
-import {
-  defaultTokenEstimatePlugin,
-  defaultTokenEstimateTerminal,
-} from "../plugins/defaults/token-estimate.js";
+import { defaultTokenEstimatePlugin } from "../plugins/defaults/token-estimate/register.js";
+import { defaultTokenEstimateTerminal } from "../plugins/defaults/token-estimate/terminal.js";
 import { DEFAULT_TIMEOUTS, runPipeline } from "../plugins/pipeline.js";
 import {
   getMiddlewaresFor,

package/src/__tests__/tool-error-pipeline.test.ts

@@ -16,11 +16,11 @@
 import { beforeEach, describe, expect, test } from "bun:test";
 
 import type { TrustContext } from "../daemon/trust-context.js";
+import { defaultToolErrorPlugin } from "../plugins/defaults/tool-error/register.js";
 import {
   DEFAULT_TOOL_ERROR_NUDGE_TEXT,
-  defaultToolErrorPlugin,
   defaultToolErrorTerminal,
-} from "../plugins/defaults/tool-error.js";
+} from "../plugins/defaults/tool-error/terminal.js";
 import { runPipeline } from "../plugins/pipeline.js";
 import {
   getMiddlewaresFor,

package/src/__tests__/tool-execute-pipeline.test.ts

@@ -139,7 +139,7 @@ mock.module("../security/token-manager.js", () => ({
 
 // ── Imports — after mock.module so the executor under test picks them up ──
 import { PermissionPrompter } from "../permissions/prompter.js";
-import { defaultToolExecutePlugin } from "../plugins/defaults/tool-execute.js";
+import { defaultToolExecutePlugin } from "../plugins/defaults/tool-execute/register.js";
 import {
   getMiddlewaresFor,
   registerPlugin,

package/src/__tests__/tool-executor-lifecycle-events.test.ts

@@ -72,6 +72,7 @@ mock.module("../permissions/checker.js", () => ({
 
 mock.module("../memory/conversation-crud.js", () => ({
   createConversation: (title: string) => ({ id: "conversation-1", title }),
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
 // Mock every export so downstream test files that dynamically import modules
@@ -85,15 +86,16 @@ mock.module("../memory/tool-usage-store.js", () => ({
 mock.module("../tools/registry.js", () => ({
   getTool: (name: string) => {
     if (name === "unknown_tool") return undefined;
-    // Skill tools carry origin and executionTarget from their manifest
+    // Skill tools carry executionTarget from their manifest. Ownership lives
+    // on the registry (mocked below via getToolOwner reading the override's
+    // owner field), so it doesn't appear on the Tool object itself.
     if (name === "skill_host_tool") {
       return {
         name,
         description: "skill host tool",
         category: "skill",
         defaultRiskLevel: "low",
-        origin: "skill" as const,
-        ownerSkillId: "test-skill",
+        owner: { kind: "skill", id: "test-skill" },
         executionTarget: "host" as const,
         input_schema: {},
         execute: async () => {
@@ -108,8 +110,7 @@ mock.module("../tools/registry.js", () => ({
         description: "skill sandbox tool",
         category: "skill",
         defaultRiskLevel: "low",
-        origin: "skill" as const,
-        ownerSkillId: "test-skill",
+        owner: { kind: "skill", id: "test-skill" },
         executionTarget: "sandbox" as const,
         input_schema: {},
         execute: async () => {
@@ -126,8 +127,7 @@ mock.module("../tools/registry.js", () => ({
         description: "skill tool with host_ prefix but sandbox target",
         category: "skill",
         defaultRiskLevel: "low",
-        origin: "skill" as const,
-        ownerSkillId: "test-skill",
+        owner: { kind: "skill", id: "test-skill" },
         executionTarget: "sandbox" as const,
         input_schema: {},
         execute: async () => {
@@ -158,6 +158,19 @@ mock.module("../tools/registry.js", () => ({
       },
     };
   },
+  // Ownership lives on the registry post-refactor. Mirror that by surfacing
+  // the optional `owner`-shaped field set inline on the override-produced
+  // tool (see the skill_* branches above).
+  getToolOwner: (name: string) => {
+    if (
+      name === "skill_host_tool" ||
+      name === "skill_sandbox_tool" ||
+      name === "host_skill_sandboxed"
+    ) {
+      return { kind: "skill" as const, id: "test-skill" };
+    }
+    return undefined;
+  },
 }));
 
 mock.module("../tools/shared/filesystem/path-policy.js", () => ({