@vellumai/assistant 0.8.9-staging.1 → 0.8.9-staging.2

package/src/daemon/conversation.ts

@@ -63,7 +63,10 @@ import { PermissionPrompter } from "../permissions/prompter.js";
 import { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { UserDecision } from "../permissions/types.js";
 import { defaultCompact } from "../plugins/defaults/compaction/compact.js";
-import { createContextWindowManager } from "../plugins/defaults/compaction/manager-store.js";
+import {
+  createContextWindowManager,
+  getContextWindowManager,
+} from "../plugins/defaults/compaction/manager-store.js";
 import { repairHistory } from "../plugins/defaults/history-repair/terminal.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import type { ContentBlock, Message } from "../providers/types.js";
@@ -205,7 +208,6 @@ export class Conversation {
     estimatedCost: 0,
   };
   /** @internal */ readonly systemPrompt: string;
-  /** @internal */ contextWindowManager: ContextWindowManager;
   /** @internal */ contextCompactedMessageCount = 0;
   /** @internal */ contextCompactedAt: number | null = null;
   /** @internal */ contextSummary: string | null = null;
@@ -610,7 +612,7 @@ export class Conversation {
       resolveTools,
       resolveSystemPrompt: resolveSystemPromptCallback,
     });
-    this.contextWindowManager = createContextWindowManager({
+    createContextWindowManager({
       provider,
       systemPrompt: () => resolveSystemPromptCallback([]).systemPrompt,
       config: initialContextWindowConfig,
@@ -622,6 +624,24 @@ export class Conversation {
     });
   }
 
+  /**
+   * The conversation's {@link ContextWindowManager}, owned by the compaction
+   * module's per-conversation store. The constructor registers it there; this
+   * accessor resolves it on demand so the conversation holds no separate
+   * handle. Present for the conversation's whole in-memory lifetime (registered
+   * at construction, released on teardown), so a live conversation always
+   * resolves an instance.
+   */
+  /** @internal */ get contextWindowManager(): ContextWindowManager {
+    const manager = getContextWindowManager(this.conversationId);
+    if (manager == null) {
+      throw new Error(
+        `ContextWindowManager missing for conversation ${this.conversationId} — the compaction store entry was released while the conversation is still live`,
+      );
+    }
+    return manager;
+  }
+
   // ── Onboarding context ───────────────────────────────────────────
 
   setOnboardingContext(ctx: OnboardingContext): void {

package/src/daemon/disk-pressure-policy.ts

@@ -51,7 +51,6 @@ const BACKGROUND_SOURCES = new Set([
   "heartbeat",
   "memory",
   "notification",
-  "proactive-artifact",
   "reminder",
   "schedule",
   "task",

package/src/daemon/lifecycle.ts

@@ -60,7 +60,6 @@ import { sweepConceptPageFrontmatter } from "../memory/v2/frontmatter-sweep.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { backfillManualTokenConnections } from "../oauth/manual-token-connection.js";
 import { seedOAuthProviders } from "../oauth/seed-providers.js";
-import { backfillGuardIfNeeded } from "../proactive-artifact/index.js";
 import { ensurePromptFiles } from "../prompts/system-prompt.js";
 import { runProviderConnectionsBackfill } from "../providers/inference/backfill.js";
 import { resolveManagedProxyContext } from "../providers/platform-proxy/context.js";
@@ -1297,12 +1296,6 @@ export async function runDaemon(): Promise<void> {
       "Heartbeat service configured",
     );
 
-    try {
-      backfillGuardIfNeeded();
-    } catch (err) {
-      log.warn({ err }, "Proactive artifact backfill failed");
-    }
-
     // Filing yields to the memory v2 consolidation job when v2 is enabled —
     // both serve the same role (periodic background memory processing) and
     // running both is redundant. The consolidation job runs through the

package/src/{daemon → plugins/defaults/compaction}/context-overflow-reducer.ts

@@ -16,23 +16,23 @@
  *   4. Runtime injection downgrade to minimal mode
  */
 
-import type { ContextWindowConfig } from "../config/types.js";
+import type { ContextWindowConfig } from "../../../config/types.js";
 import {
   estimateContentBlockTokens,
   estimatePromptTokens,
-} from "../context/token-estimator.js";
-import { truncateToolResultsAcrossHistory } from "../context/tool-result-truncation.js";
+} from "../../../context/token-estimator.js";
+import { truncateToolResultsAcrossHistory } from "../../../context/tool-result-truncation.js";
 import type {
   ContextWindowCompactOptions,
   ContextWindowResult,
-} from "../context/window-manager.js";
-import type { Message } from "../providers/types.js";
+} from "../../../context/window-manager.js";
 import {
   countMediaBlocks,
   estimateUnconditionalStubTokens,
   stripMediaPayloadsForRetry,
-} from "./conversation-media-retry.js";
-import type { InjectionMode } from "./conversation-runtime-assembly.js";
+} from "../../../daemon/conversation-media-retry.js";
+import type { InjectionMode } from "../../../daemon/conversation-runtime-assembly.js";
+import type { Message } from "../../../providers/types.js";
 
 /**
  * Identifies which reduction tier was applied in a given step.

package/src/plugins/defaults/compaction/manager-store.ts

@@ -35,6 +35,19 @@ export function createContextWindowManager(
   return manager;
 }
 
+/**
+ * Resolve the manager registered for a conversation, or `undefined` when none
+ * is registered (the conversation was never constructed or has been torn
+ * down). The store is the single owner of the instance; the conversation, its
+ * agent loop, and the compaction surface all read through this lookup rather
+ * than holding their own handle.
+ */
+export function getContextWindowManager(
+  conversationId: string,
+): ContextWindowManager | undefined {
+  return managersByConversation.get(conversationId);
+}
+
 /**
  * Release the manager registered for a conversation. Called from conversation
  * teardown so the store releases the instance once the conversation is gone.

package/src/plugins/defaults/memory-retrieval/hooks/post-compact.ts

@@ -10,13 +10,11 @@
  * history (and the blocks it captured), with no dependency on the agent loop's
  * closure state.
  *
- * It re-applies the runtime injections via {@link applyRuntimeInjections},
- * re-tracks the memory graph's cached nodes against the re-injected history,
- * and converts now-historical `web_search_tool_result` blocks to text so their
- * expired `encrypted_content` tokens are not replayed. The remaining
- * orchestrator-side step (the post-injection bookkeeping the loop records) is
- * expected to migrate here as the hook subsumes the loop's re-injection
- * ceremony.
+ * It re-applies the runtime injections via {@link applyRuntimeInjections} and
+ * re-tracks the memory graph's cached nodes against the re-injected history.
+ * The remaining orchestrator-side step (the post-injection bookkeeping the
+ * loop records) is expected to migrate here as the hook subsumes the loop's
+ * re-injection ceremony.
  *
  * The memory graph handle is sourced internally from the plugin's own
  * conversation-keyed registry ({@link getLiveGraphMemory}) rather than being
@@ -34,12 +32,8 @@ import {
   resolveTrustClass,
   type TrustContext,
 } from "../../../../daemon/trust-context.js";
-import { stripHistoricalWebSearchResults } from "../../../../daemon/web-search-history.js";
 import { getLiveGraphMemory } from "../../../../memory/graph/conversation-graph-memory.js";
 import type { Message } from "../../../../providers/types.js";
-import { getLogger } from "../../../../util/logger.js";
-
-const log = getLogger("post-compact-reinject");
 
 /**
  * Everything the post-compaction hook needs, supplied by the agent loop from
@@ -141,16 +135,5 @@ export default async function postCompact(
   if (isTrustedActor && options.mode !== "minimal") {
     getLiveGraphMemory(conversationId)?.retrackCachedNodes();
   }
-  const strip = stripHistoricalWebSearchResults(result.messages);
-  if (strip.stats.blocksStripped > 0) {
-    log.info(
-      {
-        phase: "mid-loop-compact",
-        conversationId,
-        ...strip.stats,
-      },
-      "Converted historical web_search_tool_result blocks to text summaries",
-    );
-  }
-  return { ...result, messages: strip.messages };
+  return result;
 }

package/src/plugins/defaults/memory-retrieval/hooks/user-prompt-submit-temp.ts

@@ -33,7 +33,8 @@
 import type { PluginHookFn } from "@vellumai/plugin-api";
 import type { Logger } from "pino";
 
-import type { AssistantConfig } from "../../../../config/schema.js";
+import { getConfig } from "../../../../config/loader.js";
+import { findConversationOrSubagent } from "../../../../daemon/conversation-registry.js";
 import {
   applyRuntimeInjections,
   type InboundActorContext,
@@ -42,40 +43,29 @@ import {
 } from "../../../../daemon/conversation-runtime-assembly.js";
 import type { ServerMessage } from "../../../../daemon/message-protocol.js";
 import type { MemoryRecalled } from "../../../../daemon/message-types/memory.js";
+import { resolveTrustClass } from "../../../../daemon/trust-context.js";
 import { updateMessageMetadata } from "../../../../memory/conversation-crud.js";
-import type { ConversationGraphMemory } from "../../../../memory/graph/conversation-graph-memory.js";
 import { recordMemoryRecallLog } from "../../../../memory/memory-recall-log-store.js";
 import type { Message } from "../../../../providers/types.js";
 import type { GraphMemoryResult } from "../../../types.js";
 
 /**
- * Context threaded through the `user-prompt-submit-temp` hook. The readonly
- * fields carry the conversation-scoped state the retriever needs (graph
- * handle, event sink, abort signal); the output fields are populated by the
- * hook and read back by the agent loop. `latestMessages` straddles both: the
- * loop seeds it with the pre-injection array and the hook overwrites it with
- * the injected result.
+ * Context threaded through the `user-prompt-submit-temp` hook. The
+ * conversation-scoped retrieval state (graph handle, abort signal, trust
+ * class) is self-resolved from the live conversation by id; the readonly
+ * fields here carry the event sink and the turn-start injection snapshot,
+ * while `latestMessages` straddles input and output — the loop seeds it with
+ * the pre-injection array and the hook overwrites it with the injected result.
  */
 export interface MemoryRetrievalHookContext {
-  /** Per-conversation memory graph handle. */
-  readonly graphMemory: ConversationGraphMemory;
-  /** Assistant config snapshot. */
-  readonly config: AssistantConfig;
   /** Event sink used by the graph retriever and `memory_recalled` emission. */
   readonly onEvent: (msg: ServerMessage) => void;
-  /** True when the actor for this turn is trusted (guardian-class). */
-  readonly isTrustedActor: boolean;
   /** Conversation the turn belongs to — keys the recall-log row. */
   readonly conversationId: string;
   /** User message the injected memory block is persisted onto. */
   readonly userMessageId: string;
   /** Turn-scoped logger for non-fatal persistence warnings. */
   readonly logger: Logger;
-  /**
-   * Per-turn abort signal forwarded to `prepareMemory`. An external cancel
-   * aborts the underlying retrieval instead of letting it run to completion.
-   */
-  readonly signal: AbortSignal;
   /**
    * Working message list for the turn. Seeded by the loop with the
    * pre-injection messages and consumed as the retrieval input; the hook
@@ -268,11 +258,20 @@ function persistInjectionBlocks(
 const userPromptSubmitMemoryRetrieval: PluginHookFn<
   MemoryRetrievalHookContext
 > = async (ctx) => {
-  if (ctx.isTrustedActor) {
-    const graphResult = await ctx.graphMemory.prepareMemory(
+  // The conversation-scoped retrieval state — graph handle, abort signal, and
+  // trust class — is resolved from the live conversation by id rather than
+  // threaded in, mirroring how `applyRuntimeInjections` self-resolves its
+  // per-turn inputs.
+  const conversation = findConversationOrSubagent(ctx.conversationId);
+  const abortSignal = conversation?.abortController?.signal;
+  const isTrustedActor =
+    resolveTrustClass(conversation?.trustContext) === "guardian";
+
+  if (conversation && isTrustedActor && abortSignal) {
+    const graphResult = await conversation.graphMemory.prepareMemory(
       ctx.latestMessages,
-      ctx.config,
-      ctx.signal,
+      getConfig(),
+      abortSignal,
       ctx.onEvent,
     );
 
@@ -292,12 +291,12 @@ const userPromptSubmitMemoryRetrieval: PluginHookFn<
     // (looked up by conversation id) rather than receiving it threaded through
     // the agent loop.
     if (graphResult.userQueryVector) {
-      ctx.graphMemory.recordPkbQueryVectors(
+      conversation.graphMemory.recordPkbQueryVectors(
         graphResult.userQueryVector,
         graphResult.userQuerySparseVector,
       );
     } else {
-      ctx.graphMemory.recordPkbQueryVectors(
+      conversation.graphMemory.recordPkbQueryVectors(
         graphResult.queryVector,
         graphResult.sparseVector,
       );

package/src/runtime/routes/__tests__/acp-routes.test.ts

@@ -8,9 +8,10 @@
  * (default 50, max 500).
  *
  * `POST /v1/acp/spawn`: when the adapter binary is missing, the handler
- * silently auto-installs allowlisted adapter packages before failing with
- * the install hint. `execFile` is stubbed via the shared
- * `installExecFileStub` helper so tests can script `npm i -g` outcomes.
+ * silently auto-installs allowlisted adapter packages via a sandboxed `bun`
+ * global install before failing with the install hint. `execFile` is stubbed
+ * via the shared `installExecFileStub` helper so tests can script
+ * `bun add --global` outcomes.
  */
 
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
@@ -433,9 +434,25 @@ const SPAWN_BODY = {
   conversationId: "conv-1",
 };
 
-describe("POST /v1/acp/spawn: auto-install on missing binary", () => {
-  test("binary missing + bun present: spawn proceeds via bunx without npm", async () => {
-    which.setWhich({ bun: "/usr/local/bin/bun" });
+const BUN_BIN = "/usr/local/bin/bun";
+const BUN_ADD_KEY = `${BUN_BIN} add`;
+
+describe("POST /v1/acp/spawn: sandboxed bun auto-install on missing binary", () => {
+  test("known command + bun present: installs via bun, then spawns the real binary", async () => {
+    // Binary appears on PATH only after `bun add --global` runs, simulating a
+    // successful global install that links the adapter bin onto PATH.
+    let binaryOnPath = false;
+    which.setWhich((cmd) => {
+      if (cmd === "bun") return BUN_BIN;
+      if (binaryOnPath) return `/usr/local/bin/${cmd}`;
+      return null;
+    });
+    execScripts.set(BUN_ADD_KEY, {
+      stdout: "",
+      onCall: () => {
+        binaryOnPath = true;
+      },
+    });
 
     const handler = getSpawnHandler();
     const body = (await handler({ body: SPAWN_BODY })) as Record<
@@ -448,28 +465,31 @@ describe("POST /v1/acp/spawn: auto-install on missing binary", () => {
       protocolSessionId: "proto-route-session",
       agent: "claude",
     });
-    expect(execFileMock).not.toHaveBeenCalled();
     expect(spawnMock).toHaveBeenCalledTimes(1);
+    // The real adapter binary is spawned, not a `bun x` wrapper.
     const agentConfigArg = (spawnMock.mock.calls[0] as unknown[])[1] as {
       command: string;
-      args: string[];
-      adapterCommand?: string;
     };
-    expect(agentConfigArg.command).toBe("bun");
-    expect(agentConfigArg.args).toEqual([
-      "x",
-      "--bun",
+    expect(agentConfigArg.command).toBe("claude-agent-acp");
+    // Exactly one install, and it was `bun add --global` (never npm).
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+    const [command, args] = execFileMock.mock.calls[0];
+    expect(command).toBe(BUN_BIN);
+    expect(args).toEqual([
+      "add",
+      "--global",
       "@agentclientprotocol/claude-agent-acp",
     ]);
-    expect(agentConfigArg.adapterCommand).toBe("claude-agent-acp");
   });
 
-  test("known command: installs the mapped package and spawn proceeds", async () => {
-    // Binary appears on PATH only after `npm i -g` runs, simulating a
-    // successful global install.
+  test("install runs in a temp dir (not the task cwd) with secrets stripped", async () => {
     let binaryOnPath = false;
-    which.setWhich((cmd) => (binaryOnPath ? `/usr/local/bin/${cmd}` : null));
-    execScripts.set("npm i", {
+    which.setWhich((cmd) => {
+      if (cmd === "bun") return BUN_BIN;
+      if (binaryOnPath) return `/usr/local/bin/${cmd}`;
+      return null;
+    });
+    execScripts.set(BUN_ADD_KEY, {
       stdout: "",
       onCall: () => {
         binaryOnPath = true;
@@ -477,28 +497,37 @@ describe("POST /v1/acp/spawn: auto-install on missing binary", () => {
     });
 
     const handler = getSpawnHandler();
-    const body = (await handler({ body: SPAWN_BODY })) as Record<
-      string,
-      unknown
-    >;
+    await handler({ body: { ...SPAWN_BODY, cwd: "/untrusted/project" } });
 
-    expect(body).toEqual({
-      acpSessionId: "acp-route-session",
-      protocolSessionId: "proto-route-session",
-      agent: "claude",
-    });
-    expect(spawnMock).toHaveBeenCalledTimes(1);
-    expect(execFileMock).toHaveBeenCalledTimes(1);
-    expect(execFileMock.mock.calls[0][1]).toEqual([
-      "i",
-      "-g",
-      "@agentclientprotocol/claude-agent-acp",
-    ]);
+    const options = execFileMock.mock.calls[0][2] as {
+      cwd?: string;
+      env?: NodeJS.ProcessEnv;
+    };
+    expect(options.cwd).not.toBe("/untrusted/project");
+    expect(options.cwd).toContain("vellum-acp-install-");
+    expect(options.env?.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+    expect(options.env?.GEMINI_API_KEY).toBeUndefined();
+    expect(options.env?.BUN_CONFIG_REGISTRY).toBe(
+      "https://registry.npmjs.org/",
+    );
   });
 
-  test("npm failure: FailedDependencyError carries hint and failure reason", async () => {
-    which.setWhich({});
-    execScripts.set("npm i", {
+  test("bun absent: no install attempted, FailedDependencyError with the hint", async () => {
+    which.setWhich({}); // neither bun nor the adapter on PATH
+
+    const handler = getSpawnHandler();
+    const promise = handler({ body: SPAWN_BODY });
+    await expect(promise).rejects.toBeInstanceOf(FailedDependencyError);
+    await expect(promise).rejects.toThrow(
+      /claude-agent-acp is not on PATH.*bun add -g @agentclientprotocol\/claude-agent-acp/,
+    );
+    expect(execFileMock).not.toHaveBeenCalled();
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  test("install failure: FailedDependencyError carries hint and failure reason, never npm", async () => {
+    which.setWhich({ bun: BUN_BIN });
+    execScripts.set(BUN_ADD_KEY, {
       error: new Error("EACCES: permission denied"),
     });
 
@@ -506,8 +535,11 @@ describe("POST /v1/acp/spawn: auto-install on missing binary", () => {
     const promise = handler({ body: SPAWN_BODY });
     await expect(promise).rejects.toBeInstanceOf(FailedDependencyError);
     await expect(promise).rejects.toThrow(
-      /claude-agent-acp is not on PATH.*npm i -g @agentclientprotocol\/claude-agent-acp.*auto-install failed.*EACCES/,
+      /claude-agent-acp is not on PATH.*bun add -g @agentclientprotocol\/claude-agent-acp.*auto-install failed.*EACCES/,
     );
+    for (const call of execFileMock.mock.calls) {
+      expect(call[0]).not.toBe("npm");
+    }
     expect(spawnMock).not.toHaveBeenCalled();
   });
 

package/src/runtime/routes/__tests__/plugins-routes.test.ts

@@ -737,7 +737,7 @@ describe("POST /v1/plugins/install", () => {
     installSpy.mockReset();
   });
 
-  test("forwards name/ref/force to installPlugin and shapes the result", async () => {
+  test("forwards name/force and shapes the result, pinning ref to the default", async () => {
     installSpy.mockImplementation(async (opts) => ({
       name: opts.name,
       target: `/workspace/.vellum/plugins/${opts.name}`,
@@ -747,7 +747,7 @@ describe("POST /v1/plugins/install", () => {
     }));
 
     const result = await invokeInstall({
-      body: { name: "caveman", ref: "v1.8.2", force: true },
+      body: { name: "caveman", force: true },
     });
 
     expect(result).toEqual({
@@ -755,15 +755,40 @@ describe("POST /v1/plugins/install", () => {
       name: "caveman",
       target: "/workspace/.vellum/plugins/caveman",
       fileCount: 7,
-      ref: "v1.8.2",
+      ref: "main",
     });
     expect(installSpy.mock.calls[0]?.[0]).toEqual({
       name: "caveman",
-      ref: "v1.8.2",
+      ref: "main",
       force: true,
     });
   });
 
+  test("ignores a caller-supplied ref and pins to the curated default", async () => {
+    // Security boundary: installing from an unreviewed ref (a PR branch,
+    // fork ref, ...) could load attacker-controlled marketplace/first-party
+    // code, so the HTTP route never honors a body `ref` — it always resolves
+    // against the curated default ref.
+    installSpy.mockImplementation(async (opts) => ({
+      name: opts.name,
+      target: `/workspace/.vellum/plugins/${opts.name}`,
+      fileCount: 7,
+      ref: opts.ref ?? "main",
+      commit: null,
+    }));
+
+    const result = await invokeInstall({
+      body: { name: "caveman", ref: "attacker-pr-branch" },
+    });
+
+    expect(result.ref).toBe("main");
+    expect(installSpy.mock.calls[0]?.[0]).toEqual({
+      name: "caveman",
+      ref: "main",
+      force: undefined,
+    });
+  });
+
   test("a missing name short-circuits to BadRequestError without calling the lib", async () => {
     await expect(invokeInstall({ body: {} })).rejects.toBeInstanceOf(
       BadRequestError,

package/src/runtime/routes/plugins-routes.ts

@@ -202,12 +202,6 @@ const pluginInstallRequestSchema = z.object({
     .describe(
       "Install name to resolve against the catalog (first-party directory or marketplace entry).",
     ),
-  ref: z
-    .string()
-    .optional()
-    .describe(
-      "Optional git ref to install from. Defaults to the CLI's `DEFAULT_PLUGIN_REF`.",
-    ),
   force: z
     .boolean()
     .optional()
@@ -442,12 +436,19 @@ async function handleInstallPlugin({ body = {} }: RouteHandlerArgs) {
   if (!name) {
     throw new BadRequestError("`name` is required");
   }
-  const ref = typeof body.ref === "string" ? body.ref : undefined;
   const force = typeof body.force === "boolean" ? body.force : undefined;
 
+  // The ref is pinned to the curated `DEFAULT_PLUGIN_REF` rather than taken
+  // from the request: a caller-supplied ref would let any `settings.write`
+  // principal install from an unreviewed revision (a PR branch, fork ref,
+  // ...) whose marketplace manifest or first-party plugin directory could
+  // carry attacker code that the loader then dynamically imports. Installs
+  // over HTTP therefore only ever resolve against the reviewed catalog on
+  // the default ref. Operators who need another ref use the local CLI's
+  // `assistant plugins install --ref`.
   try {
     const result = await installPlugin(
-      { name, ref, force },
+      { name, ref: DEFAULT_PLUGIN_REF, force },
       { fetch: globalThis.fetch.bind(globalThis) },
     );
     return {
@@ -545,7 +546,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Install a plugin",
     description:
-      "Install a plugin by name from the canonical source — a whitelisted `experimental/plugins/marketplace.json` entry, else the first-party `experimental/plugins/<name>/` convention. Materializes the plugin under `<workspaceDir>/plugins/<name>/`; the assistant must be restarted to load it. Mirrors the CLI's `assistant plugins install <name>`. An already-installed name without `force` returns 409; a name that resolves to nothing at the ref returns 404. Sibling to `POST /v1/skills/install`.",
+      "Install a plugin by name from the canonical source — a whitelisted `experimental/plugins/marketplace.json` entry, else the first-party `experimental/plugins/<name>/` convention. Always resolves against the curated default git ref (no caller-supplied ref): installing from an unreviewed revision would bypass the marketplace/first-party curation boundary and let attacker-controlled code be loaded. Materializes the plugin under `<workspaceDir>/plugins/<name>/`; the assistant must be restarted to load it. Mirrors the CLI's `assistant plugins install <name>`. An already-installed name without `force` returns 409; a name that resolves to nothing returns 404. Sibling to `POST /v1/skills/install`.",
     tags: ["plugins"],
     requestBody: pluginInstallRequestSchema,
     responseBody: pluginInstallResponseSchema,

package/src/tools/acp/list-agents.test.ts

@@ -107,12 +107,12 @@ describe("executeAcpListAgents", () => {
     const codex = parsed.agents.find((a: { id: string }) => a.id === "codex");
     expect(codex.available).toBe(false);
     expect(codex.unavailableReason).toBe("'codex-acp' is not on PATH");
-    expect(codex.setupHint).toBe("npm i -g @zed-industries/codex-acp");
+    expect(codex.setupHint).toBe("bun add -g @zed-industries/codex-acp");
 
     const gemini = parsed.agents.find((a: { id: string }) => a.id === "gemini");
     expect(gemini.available).toBe(false);
     expect(gemini.unavailableReason).toBe("'gemini' is not on PATH");
-    expect(gemini.setupHint).toBe("npm i -g @google/gemini-cli");
+    expect(gemini.setupHint).toBe("bun add -g @google/gemini-cli");
 
     const claude = parsed.agents.find((a: { id: string }) => a.id === "claude");
     expect(claude.available).toBe(true);