@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/daemon/conversation-initial-prompt.ts

@@ -0,0 +1,77 @@
+/**
+ * Construction-time system-prompt resolution for a new conversation.
+ *
+ * The dependency seams (`fetchDelivery`, `deps.warm`, `deps.build`) exist so the
+ * warm-then-build sequencing can be unit-tested without mocking the
+ * widely-imported guardian-delivery / system-prompt modules — global module
+ * mocks of those leak across test files in the shared-process runner.
+ */
+import { getGuardianDeliveryFresh } from "../contacts/guardian-delivery-reader.js";
+import { buildSystemPrompt } from "../prompts/system-prompt.js";
+import type { ConversationCreateOptions } from "./handlers/shared.js";
+import type { TrustContext } from "./trust-context.js";
+
+type GuardianDeliveryFetch = (input?: {
+  channelTypes?: string[];
+}) => Promise<unknown>;
+
+/**
+ * Warm both guardian-binding cache keys the desktop/native persona resolver
+ * reads: the `"vellum"`-channel key for `peekGuardianForChannel("vellum")` and
+ * the unfiltered key for its `peekAnyGuardian()` fallback. Warming only one
+ * would still freeze `users/default.md` when the guardian lives on a non-vellum
+ * channel (phone / Telegram).
+ *
+ * Uses the FRESH reader so warmup bypasses a stale/empty cached entry: a
+ * gateway-side binding write (onboarding, rebind) does not invalidate the daemon
+ * cache, so a non-fresh read could return an empty binding cached before the
+ * guardian existed and freeze `users/default.md` until the TTL expires. The
+ * fresh read repopulates the cache the sync `peek*` resolvers then read.
+ * Best-effort — the reader swallows failures.
+ */
+export async function warmGuardianBindings(
+  fetchDelivery: GuardianDeliveryFetch = getGuardianDeliveryFresh,
+): Promise<void> {
+  await Promise.all([
+    fetchDelivery({ channelTypes: ["vellum"] }),
+    fetchDelivery(),
+  ]);
+}
+
+/**
+ * Resolve the system prompt to freeze onto a newly constructed conversation.
+ *
+ * The conversation's prompt is built once here and reused for every turn (the
+ * agent loop never re-resolves it), so the persona slot must resolve correctly
+ * at construction.
+ *
+ * - An explicit `systemPromptOverride` (including an empty string) is used
+ *   verbatim.
+ * - A channel-routed conversation that already carries the requester's
+ *   `trustContext` (e.g. Slack / Telegram inbound) builds with it, so the
+ *   persona resolves the *requester's* `users/<slug>.md` (a DB contact lookup)
+ *   rather than the guardian/default profile.
+ * - Otherwise (no construction-time identity — the local vellum app sets trust
+ *   after creation) the guardian binding is warmed first so the persona slot
+ *   resolves the guardian's `users/<slug>.md` instead of `users/default.md` on
+ *   a cold cache.
+ */
+export async function resolveInitialSystemPrompt(
+  storedOptions: ConversationCreateOptions | undefined,
+  deps: {
+    warm?: () => Promise<void>;
+    build?: (trustContext: TrustContext | undefined) => string;
+  } = {},
+): Promise<string> {
+  if (storedOptions?.systemPromptOverride !== undefined) {
+    return storedOptions.systemPromptOverride;
+  }
+  const trustContext = storedOptions?.trustContext;
+  if (trustContext === undefined) {
+    await (deps.warm ?? warmGuardianBindings)();
+  }
+  const build =
+    deps.build ??
+    ((tc: TrustContext | undefined) => buildSystemPrompt({ trustContext: tc }));
+  return build(trustContext);
+}

package/src/daemon/conversation-lifecycle.ts

@@ -69,6 +69,7 @@ export function reinjectImageSourcePaths(
 export interface AbortContext {
   readonly conversationId: string;
   isProcessing(): boolean;
+  setProcessing(value: boolean): void;
   abortController: AbortController | null;
   prompter: PermissionPrompter;
   secretPrompter: SecretPrompter;
@@ -125,7 +126,30 @@ export function abortConversation(
       { conversationId: ctx.conversationId, abortReason: effectiveReason },
       "Aborting in-flight processing",
     );
-    ctx.abortController?.abort(effectiveReason);
+    if (ctx.abortController) {
+      // A live turn owns this controller. Signal it and let the agent loop's
+      // own `finally` observe the abort, unwind, and clear the processing flag
+      // — that path clears it with the correct sync-invalidation ordering
+      // (after the awaited turn-boundary commit), so we deliberately do NOT
+      // clear it here and risk clobbering a client's optimistic state.
+      ctx.abortController.abort(effectiveReason);
+    } else {
+      // The flag is set but there is no live controller to signal: the turn
+      // that owned it already tore its controller down (the agent-loop
+      // `finally` nulls `abortController` before clearing the flag) or died
+      // without ever installing one. Either way no agent-loop `finally` is
+      // going to run to clear the flag. Without this branch the abort is a
+      // silent no-op — `?.abort()` does nothing — and the conversation stays
+      // wedged: every later submit is rejected with "already processing" and
+      // Stop appears dead. Force-clear the flag directly so the conversation
+      // frees up. `setProcessing(false)` also nulls the persisted column and
+      // emits the metadata invalidation that drives clients to idle.
+      log.warn(
+        { conversationId: ctx.conversationId },
+        "Abort requested while processing but no live abort controller — force-clearing stale processing flag",
+      );
+      ctx.setProcessing(false);
+    }
     ctx.prompter.dispose();
     ctx.secretPrompter.dispose();
     ctx.pendingSurfaceActions.clear();

package/src/daemon/conversation-messaging.ts

@@ -551,7 +551,7 @@ export async function persistQueuedMessageBody(
       ctx.conversationId,
       "user",
       contentToPersist,
-      { metadata: mergedMetadata, clientMessageId },
+      { metadata: mergedMetadata, clientMessageId, id: requestId },
     );
 
     if (persistedUserMessage.deduplicated) {
@@ -613,7 +613,7 @@ export async function persistQueuedMessageBody(
           a.filename,
           a.mimeType,
           a.data,
-          { sourcePath: a.filePath },
+          { sourcePath: a.filePath, normalizeImage: true },
         );
       } catch (err) {
         if (err instanceof AttachmentUploadError) {

package/src/daemon/conversation-plugin-scope.ts

@@ -0,0 +1,38 @@
+/**
+ * Resolve a conversation's effective plugin scope for the hook pipeline.
+ *
+ * The hook pipeline calls this by `conversationId` so lifecycle hooks honor
+ * the per-chat plugin selection. Resolution is memory-then-DB: prefer the live
+ * conversation/subagent (so a mid-conversation selection change applies to the
+ * next turn's hooks), falling back to the persisted `enabled_plugins` row when
+ * no live instance is resident. `null` means no per-chat restriction — every
+ * globally-enabled plugin's hooks run.
+ */
+
+import { getConversationEnabledPlugins } from "../persistence/conversation-crud.js";
+import { getLogger } from "../util/logger.js";
+import { findConversationOrSubagent } from "./conversation-registry.js";
+import { getEffectiveEnabledPluginSet } from "./conversation-tool-setup.js";
+
+const log = getLogger("conversation-plugin-scope");
+
+/** Resolve `conversationId`'s effective plugin scope; `null` = no restriction. */
+export function resolveConversationPluginScope(
+  conversationId: string,
+): Set<string> | null {
+  const live = findConversationOrSubagent(conversationId);
+  if (live) return getEffectiveEnabledPluginSet(live);
+  // Fall back to the persisted row for a non-resident conversation. A failure
+  // here must not break hook discovery — fail open to no restriction so the
+  // turn's hooks still run, rather than dropping every plugin's lifecycle hook.
+  try {
+    const enabledPlugins = getConversationEnabledPlugins(conversationId);
+    return getEffectiveEnabledPluginSet({ enabledPlugins });
+  } catch (err) {
+    log.debug(
+      { err, conversationId },
+      "Failed to resolve per-chat plugin scope from DB; applying no restriction",
+    );
+    return null;
+  }
+}

package/src/daemon/conversation-process.ts

@@ -23,6 +23,7 @@ import { extractPreferences } from "../notifications/preference-extractor.js";
 import { createPreference } from "../notifications/preferences-store.js";
 import {
   addMessage,
+  isHiddenMessageMetadata,
   provenanceFromTrustContext,
   setConversationOriginChannelIfUnset,
   setConversationOriginInterfaceIfUnset,
@@ -61,19 +62,30 @@ import { resolveVerificationSessionIntent } from "./verification-session-intent.
 const log = getLogger("conversation-process");
 
 /**
- * Daemon-injected run lifecycle notifications — subagent (`subagentNotification`)
- * and ACP run (`acpNotification`) — are persisted into the parent conversation so
- * the orchestrator wakes and reads the run's result, but they are internal
- * scaffolding: the user sees the run through its inline progress card, not a chat
- * turn. Skip the `user_message_echo` broadcast for these so they never render as a
- * live user bubble; the persisted row is filtered from the rendered transcript on
- * the client.
+ * Daemon-injected run lifecycle notifications — subagent (`subagentNotification`),
+ * ACP run (`acpNotification`), and any wake trigger (the persisted
+ * `<background_event source="...">` row every wake reads) — are persisted into
+ * the parent conversation so the orchestrator wakes and reads the trigger, but
+ * they are internal scaffolding: the user sees the wake through its inline card
+ * ("Conversation Woke", or a terminal card for a backgrounded bash run), not a
+ * chat turn. Skip the `user_message_echo` broadcast for these so they never
+ * render as a live user bubble; the persisted row is filtered from the rendered
+ * transcript on the client.
+ *
+ * Messages explicitly flagged `hidden` (a hidden `POST /messages` send that
+ * queued behind an in-flight turn, e.g. the channel-setup wizard-close
+ * marker) are suppressed the same way — the immediate route path already
+ * skips their echo, and the persisted `hidden` metadata keeps them out of
+ * the fetched transcript.
  */
-function isHiddenRunNotificationMessage(
+function isEchoSuppressedUserMessage(
   metadata: Record<string, unknown> | undefined,
 ): boolean {
   return (
-    metadata?.subagentNotification != null || metadata?.acpNotification != null
+    isHiddenMessageMetadata(metadata) ||
+    metadata?.subagentNotification != null ||
+    metadata?.acpNotification != null ||
+    typeof metadata?.backgroundEventSource === "string"
   );
 }
 
@@ -242,6 +254,11 @@ async function buildPassthroughBatch(
     // otherwise diverge.
     if (candIf?.userMessageInterface !== headInterface?.userMessageInterface)
       break;
+    // The batched turn applies only the head's `clientOs`, so messages from a
+    // different OS surface must not coalesce. The web, iOS, and macOS apps all
+    // report `interfaceId: "web"`, so the interface check above no longer
+    // separates them — split on the reported OS explicitly.
+    if (candidate.transport?.clientOs !== head.transport?.clientOs) break;
     if (candidate.sourceActorPrincipalId !== head.sourceActorPrincipalId) break;
     if (classifySlash(candidate.content) !== "passthrough") break;
     if (
@@ -441,6 +458,7 @@ async function drainSingleMessage(
     // and queue-drain stay in sync without duplicating the gate logic.
     conversation.applyHostEnvFromTransport(next.transport);
     conversation.applyClientTimezoneFromTransport(next.transport);
+    conversation.applyClientOsFromTransport(next.transport);
   }
 
   conversation.currentTurnAuthContext = next.authContext;
@@ -512,6 +530,7 @@ async function drainSingleMessage(
             }
           : {}),
         ...(next.metadata?.automated ? { automated: true } : {}),
+        ...(next.metadata?.hidden === true ? { hidden: true } : {}),
         ...(Object.keys(drainImageSourcePaths).length > 0
           ? { imageSourcePaths: drainImageSourcePaths }
           : {}),
@@ -870,7 +889,7 @@ async function drainSingleMessage(
 
   // Broadcast the user message to all hub subscribers so passive devices
   // see the user turn before the assistant reply starts streaming.
-  if (!isHiddenRunNotificationMessage(next.metadata)) {
+  if (!isEchoSuppressedUserMessage(next.metadata)) {
     next.onEvent({
       type: "user_message_echo",
       text: resolvedContent,
@@ -888,7 +907,10 @@ async function drainSingleMessage(
 
   // Fire-and-forget: detect notification preferences in the queued message
   // and persist any that are found, mirroring the logic in processMessage.
-  if (conversation.assistantId) {
+  // Hidden rows are machine signals, not user speech — running the detector
+  // on them burns an LLM call per signal and risks persisting a bogus
+  // preference from text the user never typed.
+  if (conversation.assistantId && !isHiddenMessageMetadata(next.metadata)) {
     extractPreferences(resolvedContent)
       .then((result) => {
         if (!result.detected) return;
@@ -923,11 +945,14 @@ async function drainSingleMessage(
     isInteractive?: boolean;
     isUserMessage?: boolean;
     titleText?: string;
+    isHiddenPrompt?: boolean;
   } = { isUserMessage: true };
   if (next.isInteractive !== undefined)
     drainLoopOptions.isInteractive = next.isInteractive;
   if (agentLoopContent !== resolvedContent)
     drainLoopOptions.titleText = resolvedContent;
+  if (isHiddenMessageMetadata(next.metadata))
+    drainLoopOptions.isHiddenPrompt = true;
 
   conversation
     .runAgentLoop(agentLoopContent, userMessageId, {
@@ -1002,6 +1027,7 @@ async function drainBatch(
     conversation.setTransportHints(buildTransportHints(head.transport));
     conversation.applyHostEnvFromTransport(head.transport);
     conversation.applyClientTimezoneFromTransport(head.transport);
+    conversation.applyClientOsFromTransport(head.transport);
   }
 
   conversation.currentTurnAuthContext = head.authContext;
@@ -1223,7 +1249,7 @@ async function drainBatch(
 
     // Broadcast the user message to all hub subscribers so passive devices
     // see each batched user turn before the assistant reply starts streaming.
-    if (!isHiddenRunNotificationMessage(qm.metadata)) {
+    if (!isEchoSuppressedUserMessage(qm.metadata)) {
       qm.onEvent({
         type: "user_message_echo",
         text: qmContent,
@@ -1244,8 +1270,9 @@ async function drainBatch(
     successfulBatch.push(qm);
 
     // Fire-and-forget: detect notification preferences in each batched user
-    // message and persist any that are found, mirroring drainSingleMessage.
-    if (conversation.assistantId) {
+    // message and persist any that are found, mirroring drainSingleMessage
+    // (including its hidden-row exclusion).
+    if (conversation.assistantId && !isHiddenMessageMetadata(qm.metadata)) {
       extractPreferences(qmContent)
         .then((result) => {
           if (!result.detected) return;
@@ -1332,6 +1359,7 @@ async function drainBatch(
     isInteractive?: boolean;
     isUserMessage?: boolean;
     titleText?: string;
+    isHiddenPrompt?: boolean;
   } = { isUserMessage: true };
   // Source interactive flag from the last successfully-persisted sibling so
   // a trailing failed tail doesn't flip the agent loop's interactivity.
@@ -1341,6 +1369,14 @@ async function drainBatch(
       : undefined;
   if (lastSuccessfulBatchEntry?.isInteractive !== undefined)
     drainLoopOptions.isInteractive = lastSuccessfulBatchEntry.isInteractive;
+  // A batch counts as a hidden turn only when every message in it is a
+  // hidden machine signal — one genuine user prompt justifies the
+  // prompt-as-user-speech consumers (title generation).
+  if (
+    successfulBatch.length > 0 &&
+    successfulBatch.every((qm) => isHiddenMessageMetadata(qm.metadata))
+  )
+    drainLoopOptions.isHiddenPrompt = true;
 
   // Fire-and-forget: runAgentLoop's finally block recursively calls drainQueue
   // when this run completes. Mirrors drainSingleMessage.

package/src/daemon/conversation-runtime-assembly.ts

@@ -71,6 +71,7 @@ import type { SubagentState } from "../subagent/types.js";
 import { TERMINAL_STATUSES } from "../subagent/types.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
 import { findConversationOrSubagent } from "./conversation-registry.js";
+import { getEffectiveEnabledPluginSet } from "./conversation-tool-setup.js";
 import { canonicalizeTimeZone, formatTurnTimestamp } from "./date-context.js";
 import type {
   DynamicPageSurfaceData,
@@ -165,9 +166,10 @@ export function inboundActorContextFromTrustContext(
  *
  * Returns `null` when there is no trust context and on guardian (owner) turns —
  * the actor section is suppressed for the owner. ACL fields (trust class,
- * member status/policy, guardian binding) come from the verdict-derived trust
- * context; INFO fields (contact notes, interaction count) are joined locally by
- * contact ID. Derives purely from the passed trust context, so callers
+ * member status/policy, guardian binding) and the gateway-owned interaction
+ * count come from the verdict-derived trust context; the INFO `notes` field is
+ * joined locally by contact ID. Derives purely from the passed trust context,
+ * so callers
  * self-resolve it from the live conversation rather than threading it.
  */
 export function resolveTurnInboundActorContext(
@@ -180,11 +182,13 @@ export function resolveTurnInboundActorContext(
   if (resolved.trustClass === "guardian") {
     return null;
   }
+  // Interaction count is gateway-owned telemetry, carried on the verdict-derived
+  // trust context; notes remain an INFO field joined locally by contact ID.
+  resolved.contactInteractionCount = trustContext.requesterInteractionCount;
   if (trustContext.requesterContactId) {
     const info = findContactInfoById(trustContext.requesterContactId);
     if (info) {
       resolved.contactNotes = info.notes ?? undefined;
-      resolved.contactInteractionCount = info.interactionCount;
     }
   }
   return resolved;
@@ -1592,13 +1596,19 @@ export interface RuntimeInjectionResult {
  * preserves ascending-`order` sort so downstream callers (notably
  * {@link applyRuntimeInjections}) can group blocks by `placement` and apply
  * them declaratively without losing per-injector ordering within each slot.
+ *
+ * `effectiveEnabledPlugins` carries the conversation's per-chat plugin scope:
+ * when non-null, injectors contributed by a plugin outside the set are excluded
+ * for this turn (see {@link getRegisteredInjectors}). `null`/omitted means no
+ * per-chat restriction.
  */
 async function collectInjectorBlocks(
   ctx: TurnContext,
   runMessages?: Message[],
+  effectiveEnabledPlugins?: Set<string> | null,
 ): Promise<InjectionBlock[]> {
   const out: InjectionBlock[] = [];
-  for (const injector of getRegisteredInjectors()) {
+  for (const injector of getRegisteredInjectors(effectiveEnabledPlugins)) {
     const block = await injector.produce(ctx, runMessages);
     if (block) out.push(block);
   }
@@ -1937,6 +1947,14 @@ export async function applyRuntimeInjections(
   // field below from it rather than from orchestrator-computed options.
   const liveConversation = findConversationOrSubagent(conversationId);
 
+  // Per-chat plugin scope for this turn: when the conversation restricts its
+  // plugins (`enabledPlugins` non-null), injectors contributed by a plugin
+  // outside the set are excluded below. `null` (no live conversation, or no
+  // restriction) leaves the injector chain unchanged.
+  const effectiveEnabledPlugins = liveConversation
+    ? getEffectiveEnabledPluginSet(liveConversation)
+    : null;
+
   const channelCapabilities = liveConversation?.channelCapabilities ?? null;
   const slackConversation = channelCapabilities?.channel === "slack";
 
@@ -1951,6 +1969,13 @@ export async function applyRuntimeInjections(
       liveConversation.originInterface ??
       "web")
     : undefined;
+  // OS surface reported by the client, independent of the transport interface
+  // above. Drives the per-turn `client_os:` line so the model knows whether it
+  // is talking to the web, iOS, or macOS app (all sharing the `"web"`
+  // transport interface). Read the frozen per-turn snapshot (not the live
+  // `clientOs`) so a queued message from another surface can't perturb the
+  // in-flight turn — same anti-race pattern as `clientTimezone`.
+  const clientOs = liveConversation?.currentTurnClientOs ?? undefined;
   const channelName = liveConversation
     ? (liveConversation.currentTurnChannelContext?.userMessageChannel ??
       liveConversation.originChannel ??
@@ -2059,6 +2084,7 @@ export async function applyRuntimeInjections(
     activeDocuments,
     timestamp,
     interfaceName,
+    clientOs,
     channelName,
     actorContext: options.actorContext,
     configuredUserTimezone,
@@ -2080,7 +2106,11 @@ export async function applyRuntimeInjections(
     ...injectionInputs,
   };
 
-  const chainBlocks = await collectInjectorBlocks(turnCtx, runMessages);
+  const chainBlocks = await collectInjectorBlocks(
+    turnCtx,
+    runMessages,
+    effectiveEnabledPlugins,
+  );
 
   // Split the chain output by placement so the downstream assembly can
   // process each slot with the correct ordering rule.

package/src/daemon/conversation-skill-tools.ts

@@ -15,7 +15,10 @@ import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags
 import { getConfig } from "../config/loader.js";
 import { skillFlagKey } from "../config/skill-state.js";
 import type { SkillSummary, SkillToolManifest } from "../config/skills.js";
-import { loadSkillCatalog } from "../config/skills.js";
+import {
+  filterSkillsByEnabledPlugins,
+  loadSkillCatalog,
+} from "../config/skills.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import type { ActiveSkillEntry } from "../skills/active-skill-tools.js";
 import { deriveActiveSkills } from "../skills/active-skill-tools.js";
@@ -114,6 +117,14 @@ export interface ProjectSkillToolsOptions {
    * reads across agent turns.
    */
   cache?: SkillProjectionCache;
+  /**
+   * The conversation's effective per-chat plugin scope from
+   * `getEffectiveEnabledPluginSet`. `null`/absent means no per-chat restriction
+   * (all globally-enabled plugins apply). When a set is given, plugin-owned
+   * skills whose owning plugin id is outside it are dropped from this
+   * conversation's resolution; non-plugin skills are unaffected.
+   */
+  effectiveEnabledPluginSet?: Set<string> | null;
   /** Telemetry context for skill_loaded events; absent disables recording. */
   telemetry?: {
     conversationId: string;
@@ -339,8 +350,13 @@ export function projectSkillTools(
   const contextIds = contextEntries.map((e) => e.id);
   const allCandidateIds = new Set<string>([...contextIds, ...preactivated]);
 
-  // Load the catalog (cached for conversation lifetime) and index by ID
-  const catalog = getCachedCatalog(options?.cache);
+  // Load the catalog (cached for conversation lifetime), then scope it to the
+  // conversation's per-chat plugin selection so plugin-contributed skills from
+  // unselected plugins are not resolvable for this run (null = no restriction).
+  const catalog = filterSkillsByEnabledPlugins(
+    getCachedCatalog(options?.cache),
+    options?.effectiveEnabledPluginSet ?? null,
+  );
   const catalogById = new Map<string, SkillSummary>();
   for (const skill of catalog) {
     catalogById.set(skill.id, skill);

package/src/daemon/conversation-store.ts

@@ -14,7 +14,6 @@
 
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
-import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import { wrapWithCallSiteRouting } from "../providers/call-site-routing.js";
 import { resolveDefaultProvider } from "../providers/connection-resolution.js";
 import { RateLimitProvider } from "../providers/ratelimit.js";
@@ -27,6 +26,7 @@ import {
   removeFromEvictor,
   touchConversation,
 } from "./conversation-evictor.js";
+import { resolveInitialSystemPrompt } from "./conversation-initial-prompt.js";
 import {
   allConversations,
   clearConversations,
@@ -76,6 +76,7 @@ function applyTransportMetadata(
   conversation.setTransportHints(buildTransportHints(transport));
   conversation.applyHostEnvFromTransport(transport);
   conversation.applyClientTimezoneFromTransport(transport);
+  conversation.applyClientOsFromTransport(transport);
 }
 
 /**
@@ -144,8 +145,7 @@ export async function getOrCreateConversation(
       }
       const workingDir = getSandboxWorkingDir();
 
-      const systemPrompt =
-        storedOptions?.systemPromptOverride ?? buildSystemPrompt();
+      const systemPrompt = await resolveInitialSystemPrompt(storedOptions);
       const maxTokens = storedOptions?.maxResponseTokens;
 
       const newConversation = new Conversation(