@vellumai/assistant 0.9.0 → 0.10.0-dev.202606192226.8ed8a6a

package/src/tools/skills/execute.ts

@@ -1,4 +1,5 @@
 import { RiskLevel } from "../../permissions/types.js";
+import { isUnparseableToolArgs } from "../../providers/unparseable-tool-args.js";
 import { registerTool } from "../registry.js";
 import type {
   ToolContext,
@@ -9,6 +10,38 @@ import type {
 /** Envelope keys consumed by `skill_execute` itself, never inner-tool params. */
 const SKILL_EXECUTE_ENVELOPE_KEYS = new Set(["tool", "input", "activity"]);
 
+/**
+ * Recover a `skill_execute` envelope that the provider layer wrapped under the
+ * `_raw` unparseable marker.
+ *
+ * MiniMax's object→string argument coercion JSON-decodes the inner `input`
+ * value after parsing the outer arguments. When the model passes a bare string
+ * as `input` (e.g. Markdown body instead of `{ "content": "..." }`), that inner
+ * decode fails and the whole call is marked unparseable — even though the outer
+ * envelope is valid JSON. Re-parsing `_raw` recovers `{ tool, input, activity }`
+ * so the inner tool can still be dispatched. A genuinely truncated/malformed
+ * call's `_raw` won't parse and is returned unchanged, preserving the
+ * retryable-error path for real stream corruption.
+ */
+export function recoverSkillExecuteEnvelope(
+  envelope: Record<string, unknown>,
+): Record<string, unknown> {
+  if (!isUnparseableToolArgs(envelope)) return envelope;
+  try {
+    const parsed: unknown = JSON.parse(envelope._raw);
+    if (
+      parsed != null &&
+      typeof parsed === "object" &&
+      !Array.isArray(parsed)
+    ) {
+      return parsed as Record<string, unknown>;
+    }
+  } catch {
+    // Genuinely malformed/truncated — leave wrapped for the retryable error.
+  }
+  return envelope;
+}
+
 /**
  * Resolve the inner tool's parameters from a `skill_execute` envelope.
  *
@@ -19,15 +52,20 @@ const SKILL_EXECUTE_ENVELOPE_KEYS = new Set(["tool", "input", "activity"]);
  * Weaker models routinely misplace the parameters. Left unhandled, the inner
  * tool receives `{}`, fails schema validation ("<field> is required"), and the
  * model retries the identical malformed call until it gives up — the empty-
- * input retry loop. Two common misplacements are rescued so the call can
+ * input retry loop. Three common misplacements are rescued so the call can
  * succeed instead:
  *
  * 1. `input` passed as a JSON-encoded string instead of an object.
  * 2. Parameters spread as top-level siblings of `tool`/`activity`, with `input`
  *    absent or an empty object.
+ * 3. The sole required field's value passed bare as `input` (a non-JSON string)
+ *    — e.g. the full Markdown body as `input` instead of `{ "content": "..." }`.
+ *    Rescued only when `innerSchema` has exactly one required string field, so
+ *    the mapping is unambiguous.
  */
 export function resolveSkillExecuteInput(
   envelope: Record<string, unknown>,
+  innerSchema?: unknown,
 ): Record<string, unknown> {
   const raw = envelope.input;
 
@@ -48,7 +86,14 @@ export function resolveSkillExecuteInput(
         return parsed as Record<string, unknown>;
       }
     } catch {
-      // Not JSON — fall through to sibling rescue.
+      // Not JSON. A weak model may have placed the inner tool's sole required
+      // string value directly as `input` (e.g. the full Markdown body as
+      // `document_update`'s `content`) instead of a `{ "content": "..." }`
+      // object. When the inner tool has exactly one required string field, map
+      // the bare string onto it rather than discarding content the model
+      // actually produced.
+      const field = soleRequiredStringField(innerSchema);
+      if (field) return { [field]: raw };
     }
   }
 
@@ -62,6 +107,58 @@ export function resolveSkillExecuteInput(
   return {};
 }
 
+/**
+ * The single required string property of an inner tool's input schema, or
+ * `null` when the schema has zero or more than one required field, or its lone
+ * required field is not a string. Used to map a bare `input` string onto the
+ * one field it can unambiguously belong to.
+ */
+function soleRequiredStringField(innerSchema: unknown): string | null {
+  if (innerSchema == null || typeof innerSchema !== "object") return null;
+  const schema = innerSchema as {
+    required?: unknown;
+    properties?: Record<string, { type?: unknown } | undefined>;
+  };
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  if (required.length !== 1) return null;
+  const field = required[0];
+  if (typeof field !== "string") return null;
+  return schema.properties?.[field]?.type === "string" ? field : null;
+}
+
+/**
+ * Augment an inner-tool error with `skill_execute` envelope guidance when the
+ * call carried no inner parameters.
+ *
+ * {@link resolveSkillExecuteInput} rescues *misplaced* parameters (siblings, a
+ * JSON-encoded string). It cannot rescue a genuinely empty call — there is
+ * nothing to relocate — so the inner tool runs with `{}` and rejects it with a
+ * field-level message ("<field> is required") that says nothing about the
+ * envelope. Weak models then retry the identical empty shape, oscillating over
+ * whether parameters belong under `input`, as siblings, or as a JSON string.
+ *
+ * Appending the canonical envelope shape gives the next attempt a concrete
+ * template. Fires only when the resolved inner input was empty AND the tool
+ * errored, so well-formed calls and tools that legitimately accept no
+ * parameters are untouched.
+ */
+export function augmentSkillExecuteError(
+  toolName: string,
+  resolvedInput: Record<string, unknown>,
+  result: ToolExecutionResult,
+): ToolExecutionResult {
+  if (!result.isError || Object.keys(resolvedInput).length > 0) return result;
+
+  const guidance =
+    `\n\nThis skill_execute call carried no parameters for "${toolName}". ` +
+    `Put the tool's parameters inside \`input\`. For example: ` +
+    `{"tool": "${toolName}", "input": { /* the tool's parameters */ }, ` +
+    `"activity": "..."}. The skill's instructions (from skill_load) list ` +
+    `"${toolName}"'s required fields.`;
+
+  return { ...result, content: result.content + guidance };
+}
+
 export const skillExecuteTool = {
   name: "skill_execute",
   description:

package/src/tools/skills/load.ts

@@ -39,6 +39,17 @@ const INLINE_COMMAND_ELIGIBLE_SOURCES = new Set([
   "workspace",
 ]);
 
+/** Matches raw `` !`...` `` inline command tokens in a skill body. */
+const INLINE_COMMAND_TOKEN_PATTERN = /!`[^`]*`/g;
+
+/**
+ * Replacement for inline command tokens when they are not rendered during
+ * disk-pressure cleanup mode — keeps the raw tokens out of the prompt without
+ * executing any shell.
+ */
+const INLINE_COMMAND_CLEANUP_STUB =
+  "[inline command skipped: storage cleanup mode]";
+
 const log = getLogger("skill-load");
 
 /**
@@ -159,11 +170,18 @@ export const skillLoadTool = {
       };
     }
 
+    // During disk-pressure cleanup mode, skill_load must not produce side
+    // effects: no auto-install (workspace writes / `bun install`) and no inline
+    // command execution. Instructions are still returned so the assistant can
+    // load the system-storage-cleanup skill (and any already-installed skill).
+    const cleanupMode = context.diskPressureCleanupModeActive === true;
+
     let loaded = loadSkillBySelector(selector);
 
     // Auto-install from catalog if the skill isn't found locally
     if (
       !loaded.skill &&
+      !cleanupMode &&
       (loaded.errorCode === "not_found" || loaded.errorCode === "empty_catalog")
     ) {
       try {
@@ -221,6 +239,10 @@ export const skillLoadTool = {
         const missing = collectAllMissing(skill.id, catalogIndex);
         if (missing.size === 0) break;
 
+        // Under the disk-pressure lock, never auto-install missing includes
+        // (that writes to the workspace). Leave them advisory ("not loaded").
+        if (cleanupMode) break;
+
         // Lazily resolve catalog on first round with missing includes
         if (!remoteCatalog) {
           try {
@@ -289,7 +311,19 @@ export const skillLoadTool = {
     const hasInlineCommands =
       skill.inlineCommandExpansions && skill.inlineCommandExpansions.length > 0;
 
-    if (hasInlineCommands) {
+    if (hasInlineCommands && cleanupMode) {
+      // Under the disk-pressure lock, loading a skill must not execute shell.
+      // Strip inline command tokens instead of rendering them; the rest of the
+      // instructions are still returned.
+      body = body.replace(
+        INLINE_COMMAND_TOKEN_PATTERN,
+        INLINE_COMMAND_CLEANUP_STUB,
+      );
+      log.info(
+        { skillId: skill.id },
+        "Skipped inline command expansion during disk pressure cleanup mode",
+      );
+    } else if (hasInlineCommands) {
       if (skill.source === "extra" || skill.source === "plugin") {
         // Third-party skill roots — `extra` dirs and skills shipped inside
         // installed plugins — are out of scope for inline command expansion.
@@ -368,7 +402,14 @@ export const skillLoadTool = {
             childLoaded.skill.inlineCommandExpansions &&
             childLoaded.skill.inlineCommandExpansions.length > 0;
 
-          if (childHasInlineCommands) {
+          if (childHasInlineCommands && cleanupMode) {
+            // No shell execution under the disk-pressure lock — strip the
+            // child's inline command tokens rather than rendering them.
+            childBody = childBody.replace(
+              INLINE_COMMAND_TOKEN_PATTERN,
+              INLINE_COMMAND_CLEANUP_STUB,
+            );
+          } else if (childHasInlineCommands) {
             if (
               childLoaded.skill.source === "extra" ||
               childLoaded.skill.source === "plugin"

package/src/tools/subagent/spawn.ts

@@ -1,3 +1,7 @@
+import { validateInferenceProfileKey } from "../../config/inference-profile-validation.js";
+import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
+import { getConfig } from "../../config/loader.js";
+import { AUTO_PROFILE_KEY } from "../../config/seed-inference-profiles.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
 import { getConversationOverrideProfile } from "../../memory/conversation-crud.js";
 import type { Message } from "../../providers/types.js";
@@ -14,6 +18,7 @@ export async function executeSubagentSpawn(
   const extraContext = input.context as string | undefined;
   const fork = input.fork === true;
   const role = (input.role as string | undefined) ?? undefined;
+  const inferenceProfile = input.inference_profile;
 
   // For fork mode, sendResultToUser defaults to false unless explicitly set to true.
   // For regular mode, sendResultToUser defaults to true (existing behavior).
@@ -28,6 +33,26 @@ export async function executeSubagentSpawn(
     };
   }
 
+  let requestedOverrideProfile: string | undefined;
+  let forceOverrideProfile = false;
+  if (inferenceProfile !== undefined) {
+    if (typeof inferenceProfile !== "string") {
+      return {
+        content: "Error: inference_profile must be a string",
+        isError: true,
+      };
+    }
+    const profileError = validateInferenceProfileKey(inferenceProfile);
+    if (profileError) {
+      return {
+        content: `Error: ${profileError}`,
+        isError: true,
+      };
+    }
+    requestedOverrideProfile = inferenceProfile;
+    forceOverrideProfile = true;
+  }
+
   const manager = getSubagentManager();
   const sendToClient = context.sendToClient as
     | ((msg: { type: string; [key: string]: unknown }) => void)
@@ -71,22 +96,45 @@ export async function executeSubagentSpawn(
 
   // The subagent runs as its own background conversation, so the agent
   // loop's background-skip rule would zero out any inherited profile.
-  // Pass the parent's profile explicitly via `SubagentConfig` so
-  // `SubagentManager.spawn` forwards it back into the subagent's
-  // `runAgentLoop` call as `options.overrideProfile`.
+  // Forward the invoker's profile explicitly via `SubagentConfig` so
+  // `SubagentManager.spawn` passes it into the subagent's `runAgentLoop` as
+  // `options.overrideProfile`.
   //
-  // Prefer the per-turn `context.overrideProfile` (populated by
-  // `runAgentLoopImpl` from its resolved `turnOverrideProfile`) over a
-  // row read so nested spawns inherit correctly. The current subagent's
-  // own conversation row never has `inferenceProfile` set — its override
-  // arrived via in-memory `SubagentConfig.overrideProfile` — and even if it
-  // were set, `getConversationOverrideProfile` short-circuits for
-  // background conversations and returns `undefined`. Falling back to the
-  // row read preserves behavior for tool calls that originate outside an
-  // agent-loop turn.
-  const inheritedOverrideProfile =
-    context.overrideProfile ??
-    getConversationOverrideProfile(context.conversationId);
+  // Resolution order: an explicit spawn-time profile, then the per-turn
+  // `context.overrideProfile` (populated by `runAgentLoopImpl` from its
+  // resolved `turnOverrideProfile`, covering per-conversation overrides and
+  // tool-routed switches), then a row read, and finally the resolved DEFAULT
+  // profile of the call site that invoked us. That last fallback is what makes
+  // a subagent match its invoker when the invoking turn ran purely on its
+  // call-site default — the workspace `activeProfile` for `mainAgent`, or the
+  // call site's own catalog default (e.g. `cost-optimized`) for a
+  // heartbeat/background invoker. `resolveDefaultProfileKey` does not reflect a
+  // static `llm.callSites.<callSite>` profile override (only the
+  // activeProfile-for-mainAgent path plus the catalog default), a narrow gap
+  // that only surfaces with no `activeProfile` set and a hand-tuned call-site
+  // profile.
+  //
+  // The fallback is forwarded NON-forced, so an explicit
+  // `llm.callSites.subagentSpawn` profile still wins; an explicit
+  // `inference_profile` argument keeps `forceOverrideProfile` and wins
+  // outright. (The row read short-circuits to `undefined` for the background
+  // subagent conversation and for tool calls outside an agent-loop turn.)
+  let inheritedOverrideProfile = requestedOverrideProfile;
+  if (inheritedOverrideProfile === undefined) {
+    const inheritedCandidate =
+      context.overrideProfile ??
+      getConversationOverrideProfile(context.conversationId) ??
+      resolveDefaultProfileKey(
+        context.invokingCallSite ?? "mainAgent",
+        getConfig().llm,
+      );
+    // Skip the metadata-only "auto" key: forwarding it collapses the child to
+    // `llm.default`, whereas the invoker's own auto base IS the `subagentSpawn`
+    // default — so leaving this undefined keeps the child on that default.
+    if (inheritedCandidate !== AUTO_PROFILE_KEY) {
+      inheritedOverrideProfile = inheritedCandidate;
+    }
+  }
 
   try {
     const subagentId = await manager.spawn(
@@ -102,6 +150,7 @@ export async function executeSubagentSpawn(
         ...(inheritedOverrideProfile
           ? { overrideProfile: inheritedOverrideProfile }
           : {}),
+        ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
         ...(context.toolUseId ? { parentToolUseId: context.toolUseId } : {}),
         ...forkFields,
       },

package/src/tools/terminal/shell.ts

@@ -4,8 +4,8 @@ import { spawn } from "node:child_process";
 import { getConfig } from "../../config/loader.js";
 import { isCesShellLockdownEnabled } from "../../credential-execution/feature-gates.js";
 import { RiskLevel } from "../../permissions/types.js";
-import { isUntrustedTrustClass } from "../../runtime/actor-trust-resolver.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
+import { isUntrustedShellLockdownActive } from "../../runtime/effective-capabilities.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
@@ -117,9 +117,10 @@ export const shellTool = {
     }
 
     const config = getConfig();
-    const shellLockdownActive =
-      isCesShellLockdownEnabled(config) &&
-      isUntrustedTrustClass(context.trustClass);
+    const shellLockdownActive = isUntrustedShellLockdownActive({
+      trustClass: context.trustClass,
+      lockdownEnabled: isCesShellLockdownEnabled(config),
+    });
 
     const networkMode: "off" | "proxied" =
       input.network_mode === "proxied" ? "proxied" : "off";
@@ -307,6 +308,11 @@ export const shellTool = {
 
     const env = buildSanitizedEnv();
     env.__CONVERSATION_ID = context.conversationId;
+    // Surface the resolving model to assistant CLI commands so they can tailor
+    // remediation guidance for weak open models (see isWeakOpenModel).
+    if (context.attribution?.resolvedModel) {
+      env.__RESOLVED_MODEL = context.attribution.resolvedModel;
+    }
     if (proxyEnv) {
       Object.assign(env, proxyEnv);
     }

package/src/tools/tool-approval-handler.ts

@@ -9,7 +9,7 @@ import {
   isUnparseableToolArgs,
   unparseableToolArgsMessage,
 } from "../providers/unparseable-tool-args.js";
-import { isUntrustedTrustClass } from "../runtime/actor-trust-resolver.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { createOrReuseToolGrantRequest } from "../runtime/tool-grant-request-helper.js";
 import { redactSecrets } from "../security/secret-scanner.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
@@ -157,7 +157,6 @@ const UI_SURFACE_TOOLS = new Set(["ui_show", "ui_update", "ui_dismiss"]);
 
 function requiresGuardianApprovalForActor(
   toolName: string,
-  input: Record<string, unknown>,
   executionTarget: ExecutionTarget,
 ): boolean {
   // UI surface tools are passive, user-visible operations (cards, forms,
@@ -170,14 +169,14 @@ function requiresGuardianApprovalForActor(
   // Side-effect tools always require guardian approval for untrusted actors.
   // Read-only host execution is also blocked because it can leak sensitive
   // local information (e.g. shell/file reads).
-  return isSideEffectTool(toolName, input) || executionTarget === "host";
+  return isSideEffectTool(toolName) || executionTarget === "host";
 }
 
 function guardianApprovalDeniedMessage(
   trustClass: ToolContext["trustClass"],
   toolName: string,
 ): string {
-  if (trustClass === "unknown") {
+  if (resolveCapabilities(trustClass).sensitiveToolApproval === "deny") {
     return `Permission denied for "${toolName}": this action requires guardian approval from a verified channel identity.`;
   }
   return `Permission denied for "${toolName}": this action requires guardian approval and the current actor is not the guardian.`;
@@ -320,11 +319,14 @@ export class ToolApprovalHandler {
 
     const guardianApprovalRequired = requiresGuardianApprovalForActor(
       name,
-      input,
       executionTarget,
     );
 
-    if (isUntrustedTrustClass(context.trustClass) && guardianApprovalRequired) {
+    if (
+      resolveCapabilities(context.trustClass).sensitiveToolApproval !==
+        "self" &&
+      guardianApprovalRequired
+    ) {
       const inputDigest = computeToolApprovalDigest(name, input);
       needsGrantConsumption = true;
       deferredConsumeParams = {
@@ -532,15 +534,18 @@ export class ToolApprovalHandler {
 
       // No matching grant or race condition - deny or wait inline.
       //
-      // For verified non-guardian actors (trusted_contact) with sufficient
-      // context, escalate to the guardian by creating a canonical
-      // tool_grant_request. Then wait bounded for the grant to become
-      // available - this lets the tool call succeed inline after guardian
-      // approval without the requester having to retry manually.
+      // For non-guardian actors with established identity (trusted_contact
+      // or unverified_contact) and sufficient context, escalate to the
+      // guardian by creating a canonical tool_grant_request. Then wait
+      // bounded for the grant to become available - this lets the tool call
+      // succeed inline after guardian approval without the requester having
+      // to retry manually.
       //
-      // Unverified actors remain fail-closed with no escalation or wait.
+      // Actors with no identity (unknown) remain fail-closed with no
+      // escalation or wait.
       if (
-        context.trustClass === "trusted_contact" &&
+        resolveCapabilities(context.trustClass).sensitiveToolApproval ===
+          "escalate-and-wait" &&
         context.assistantId &&
         context.executionChannel &&
         context.requesterExternalUserId

package/src/tools/tool-manifest.ts

@@ -15,7 +15,6 @@ import { askQuestionTool } from "./ask-question/ask-question-tool.js";
 import { makeAuthenticatedRequestTool } from "./credential-execution/make-authenticated-request.js";
 import { manageSecureCommandTool } from "./credential-execution/manage-secure-command-tool.js";
 import { runAuthenticatedCommandTool } from "./credential-execution/run-authenticated-command.js";
-import { credentialStoreTool } from "./credentials/vault.js";
 import { fileEditTool } from "./filesystem/edit.js";
 import { fileListTool } from "./filesystem/list.js";
 import { fileReadTool } from "./filesystem/read.js";
@@ -90,7 +89,6 @@ export const explicitTools: ToolDefinition[] = [
   // Always-explicit tools
   rememberTool,
   recallTool,
-  credentialStoreTool,
   notifyParentTool,
   askQuestionTool,
   // NOTE: external skill tools (registered via registerExternalTools in

package/src/tools/types.ts

@@ -13,6 +13,7 @@ import { RiskLevel } from "@vellumai/skill-host-contracts";
 import { z } from "zod";
 
 import type { InterfaceId } from "../channels/types.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { ToolActivityMetadata } from "../daemon/message-types/web-activity.js";
 import type { SecretPromptResult } from "../permissions/secret-prompter.js";
 import type { ContentBlock } from "../providers/types.js";
@@ -25,6 +26,7 @@ export const DISK_PRESSURE_CLEANUP_TOOL_NAMES: ReadonlySet<string> = new Set([
   "file_read",
   "file_list",
   "host_file_read",
+  "skill_load",
   "background_tool_list",
   "background_tool_cancel",
 ]);
@@ -363,6 +365,14 @@ export interface ToolContext {
    * `executeSubagentSpawn` in tools/subagent/spawn.ts.
    */
   overrideProfile?: string;
+  /**
+   * The LLM call site of the turn currently executing this tool (`mainAgent`,
+   * `heartbeatAgent`, scheduled work, etc.). `subagent_spawn` reads it to
+   * default a spawned subagent's inference profile to the profile the invoking
+   * turn resolved to, so subagents match whatever agent invoked them rather
+   * than always falling back to the static `subagentSpawn` call-site default.
+   */
+  invokingCallSite?: LLMCallSite;
   /**
    * Canonical principal ID of the actor on whose behalf this tool invocation
    * is running. Sourced from `conversation.trustContext.guardianPrincipalId`.

package/src/tools/ui-surface/definitions.ts

@@ -8,6 +8,7 @@
  */
 
 import { RiskLevel } from "../../permissions/types.js";
+import { isWeakOpenModel } from "../../providers/weak-open-model.js";
 import { ACTIVATION_MOMENT_PARAMS } from "../../telemetry/activation-funnel.js";
 import type {
   ToolContext,
@@ -37,8 +38,9 @@ function proxyExecute(toolName: string) {
   ): Promise<ToolExecutionResult> => {
     if (toolName === "ui_show" && isEmptyDynamicPage(input)) {
       return {
-        content:
-          "Error: ui_show dynamic_page requires non-empty HTML in `data.html`. The surface was not displayed because no content was provided — the user would see a blank box. Resend ui_show with the full HTML markup in `data.html`.",
+        content: isWeakOpenModel(context.attribution?.resolvedModel)
+          ? EMPTY_DYNAMIC_PAGE_DECLARATIVE_REDIRECT
+          : EMPTY_DYNAMIC_PAGE_HTML_HINT,
         isError: true,
       };
     }
@@ -59,6 +61,14 @@ function proxyExecute(toolName: string) {
       };
     }
 
+    if (toolName === "ui_update" && isEmptyUpdate(input)) {
+      return {
+        content:
+          'Error: ui_update received an empty `data` payload, so the surface was unchanged — the user still sees its previous state. The provided data is merged into the surface\'s current data, and merging nothing is a no-op. To advance a task_progress card, send the full step list: ui_update { surface_id: "<id>", data: { templateData: { steps: [{ label: "<step>", status: "completed" }, { label: "<step>", status: "in_progress" }] } } }. Resend ui_update with the fields you intend to change under `data`.',
+        isError: true,
+      };
+    }
+
     if (!context.proxyToolResolver) {
       return {
         content: `No proxy resolver configured for proxy tool "${toolName}". This tool requires an external resolver (e.g. a connected macOS client).`,
@@ -81,6 +91,27 @@ function proxyExecute(toolName: string) {
   };
 }
 
+/**
+ * Rejection envelope for an empty `dynamic_page` ui_show from a capable model:
+ * the surface carried no `data.html`, so it would render as a blank box. These
+ * models reliably author HTML, so the fix is simply to resend it inline.
+ */
+const EMPTY_DYNAMIC_PAGE_HTML_HINT =
+  "Error: ui_show dynamic_page requires non-empty HTML in `data.html`. The surface was not displayed because no content was provided — the user would see a blank box. Resend ui_show with the full HTML markup in `data.html`.";
+
+/**
+ * Rejection envelope for an empty `dynamic_page` ui_show from a weak open model.
+ * Authoring full HTML inline is the generation task these models fail at (an
+ * empty `data: {}` here, or broken markup otherwise), so steering them to
+ * "resend the HTML" just repeats the failure. Most widget requests are really
+ * structured data — comparisons, results, metrics — which render reliably via a
+ * field-based surface the model populates without writing any HTML, and which
+ * cannot render blank. dynamic_page stays available for genuinely custom visual
+ * HTML.
+ */
+const EMPTY_DYNAMIC_PAGE_DECLARATIVE_REDIRECT =
+  'Error: ui_show dynamic_page was not displayed — `data.html` was empty, so the user would see a blank box. Authoring full HTML inline is error-prone; for data, comparisons, results, or metrics prefer a structured surface, which you fill with fields (no HTML) and which never renders blank. Re-show the content as one of: a `table` (ui_show { surface_type: "table", data: { columns: [{ id, label }], rows: [{ id, cells: { <columnId>: "<value>" } }] } }), a `card` ({ title, body, metadata: [{ label, value }] }), or `work_result` ({ summary, metrics: [{ label, value }] }). Only use dynamic_page when you genuinely need custom visual HTML, in which case include the complete markup in `data.html` now.';
+
 /**
  * Worked ui_update example, appended to a successful task_progress `ui_show`
  * result so the model learns the update pattern at the point of use (with the
@@ -98,6 +129,36 @@ function isTaskProgressCardShow(input: Record<string, unknown>): boolean {
   return data?.template === "task_progress";
 }
 
+/**
+ * A `ui_update` whose `data` merge would change nothing: missing, not an
+ * object, or containing only (recursively) empty objects. Merging such a
+ * payload is a silent no-op — the surface keeps its prior state while the
+ * client still reports "Surface updated" — so the model never learns its
+ * update was hollow and a live card (e.g. task_progress) appears frozen.
+ * Arrays (e.g. `templateData.steps`) and any non-empty primitive leaf count
+ * as content.
+ */
+function isEmptyUpdate(input: Record<string, unknown>): boolean {
+  const data = asRecord(input.data);
+  return data === null || !hasContent(data);
+}
+
+function hasContent(value: unknown): boolean {
+  if (value === null || value === undefined) {
+    return false;
+  }
+  if (Array.isArray(value)) {
+    return value.length > 0;
+  }
+  if (typeof value === "object") {
+    return Object.values(value).some(hasContent);
+  }
+  if (typeof value === "string") {
+    return value.trim().length > 0;
+  }
+  return true;
+}
+
 function isEmptyDynamicPage(input: Record<string, unknown>): boolean {
   if (input.surface_type !== "dynamic_page") {
     return false;
@@ -311,7 +372,7 @@ export const uiShowTool = {
 // ui_update
 // ---------------------------------------------------------------------------
 
-const uiUpdateTool = {
+export const uiUpdateTool = {
   name: "ui_update",
   description:
     "Update an existing surface's data. The provided data object is merged into the surface's current data.\n" +

package/src/tools/verification-control-plane-policy.ts

@@ -10,6 +10,8 @@
  *   /v1/channel-verification-sessions/revoke
  */
 
+import { resolveCapabilities } from "../runtime/capabilities.js";
+
 const VERIFICATION_ENDPOINT_PATHS = [
   "/v1/channel-verification-sessions",
   "/v1/channel-verification-sessions/resend",
@@ -128,7 +130,7 @@ export function enforceVerificationControlPlanePolicy(
     return { denied: false };
   }
 
-  if (trustClass === "guardian") {
+  if (resolveCapabilities(trustClass).canUseVerificationControlPlane) {
     return { denied: false };
   }