@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/daemon/conversation-surfaces.ts

@@ -1354,6 +1354,113 @@ export function cleanupStandaloneSurface(
   }
 }
 
+/**
+ * How long to wait for a client to acknowledge an `open_panel` command
+ * before reporting failure to the model. The ack round-trip is one SSE
+ * delivery plus one HTTP POST, so this is generous — it only elapses when
+ * no connected client rendered the panel (event dropped, no client
+ * listening, or a client build that predates panel acknowledgment).
+ */
+const OPEN_PANEL_ACK_TIMEOUT_MS = 10_000;
+
+/**
+ * Open the channel-setup drawer on a connected client and wait for the
+ * client's acknowledgment.
+ *
+ * `open_panel` is a side-effect-only command: it is never persisted to the
+ * transcript, so a dropped event is unrecoverable by reload. The ack is what
+ * makes the emitting tool result truthful — "displayed" must mean a client
+ * actually rendered the drawer, not merely that the event was emitted.
+ *
+ * Reuses the standalone-surface pending machinery: the client responds via
+ * the existing surface-action route (`actionId: "ack"` on success, `"nack"`
+ * with `data.reason` when it received the event but could not open the
+ * panel), which `handleSurfaceAction` intercepts and resolves without an
+ * LLM turn. The surface-state entry exists only so the surface-action route
+ * can resolve the owning conversation by `surfaceId`; `cleanupStandaloneSurface`
+ * removes it on every outcome.
+ */
+export function openChannelSetupPanel(
+  ctx: SurfaceConversationContext,
+  surfaceId: string,
+  data: Record<string, unknown>,
+  options?: { signal?: AbortSignal; timeoutMs?: number },
+): Promise<InteractiveUiResult> {
+  if (!canShowInteractiveUi(ctx) || !ctx.pendingStandaloneSurfaces) {
+    log.warn(
+      {
+        conversationId: ctx.conversationId,
+        hasNoClient: ctx.hasNoClient,
+        channel: ctx.channelCapabilities?.channel,
+      },
+      "channel_setup panel: no interactive UI capability; failing closed",
+    );
+    return Promise.resolve({
+      status: "cancelled" as const,
+      surfaceId,
+      cancellationReason: "no_interactive_surface" as const,
+    });
+  }
+  const pendingMap = ctx.pendingStandaloneSurfaces;
+  const signal = options?.signal;
+  const timeoutMs = options?.timeoutMs ?? OPEN_PANEL_ACK_TIMEOUT_MS;
+
+  if (signal?.aborted) {
+    return Promise.resolve({
+      status: "cancelled" as const,
+      surfaceId,
+      cancellationReason: "resolver_unavailable" as const,
+    });
+  }
+
+  return new Promise<InteractiveUiResult>((resolve) => {
+    const settle = (result: InteractiveUiResult) => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve(result);
+    };
+
+    const timer = setTimeout(() => {
+      cleanupStandaloneSurface(ctx, surfaceId);
+      log.warn(
+        { conversationId: ctx.conversationId, surfaceId, timeoutMs },
+        "channel_setup panel: no client acknowledged open_panel",
+      );
+      settle({ status: "timed_out", surfaceId });
+    }, timeoutMs);
+
+    const onAbort = () => {
+      cleanupStandaloneSurface(ctx, surfaceId);
+      settle({
+        status: "cancelled",
+        surfaceId,
+        cancellationReason: "resolver_unavailable",
+      });
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+
+    pendingMap.set(surfaceId, {
+      resolve: settle,
+      timer,
+      surfaceType: "channel_setup",
+    });
+    // Registered so the surface-action route's by-surfaceId conversation
+    // lookup finds this conversation when the ack arrives without a
+    // conversationId. Cleared by cleanupStandaloneSurface on all outcomes.
+    ctx.surfaceState.set(surfaceId, {
+      surfaceType: "channel_setup",
+      data: data as SurfaceData,
+    });
+
+    ctx.sendToClient({
+      type: "open_panel",
+      panelType: "channel_setup",
+      data,
+      conversationId: ctx.conversationId,
+      surfaceId,
+    });
+  });
+}
+
 /**
  * Handle content_changed action from document editor.
  * Auto-saves the document content to the app store.
@@ -1787,6 +1894,20 @@ export async function handleSurfaceAction(
       summary,
     };
 
+    // channel_setup pendings are protocol-level acknowledgments for the
+    // `open_panel` command, not user-facing surfaces: nothing was rendered
+    // in the transcript, so there is no completion to broadcast, persist,
+    // or count as an activation commit. Resolve and clean up only.
+    if (standalone.surfaceType === "channel_setup") {
+      cleanupStandaloneSurface(ctx, surfaceId);
+      standalone.resolve(result);
+      log.info(
+        { conversationId: ctx.conversationId, surfaceId, actionId, status },
+        "open_panel acknowledgment resolved",
+      );
+      return { accepted: true, conversationId: ctx.conversationId };
+    }
+
     broadcastMessage({
       type: "ui_surface_complete",
       conversationId: ctx.conversationId,
@@ -2925,6 +3046,56 @@ export async function surfaceProxyResolver(
     const surfaceType = input.surface_type as SurfaceType;
     const title = typeof input.title === "string" ? input.title : undefined;
     const rawData = isPlainObject(input.data) ? input.data : {};
+
+    // channel_setup is a side-effect-only command: it opens the channel setup
+    // drawer on the client. Emitted as `open_panel` (not `ui_surface_show`)
+    // so the rolling-snapshot reducer never folds it into the transcript.
+    // Because the event is never persisted, success is gated on a client
+    // acknowledgment — "displayed" must mean a client actually rendered the
+    // drawer, otherwise the model announces a panel the user cannot see.
+    if (surfaceType === "channel_setup") {
+      const ack = await openChannelSetupPanel(
+        ctx,
+        surfaceId,
+        rawData as Record<string, unknown>,
+        { signal },
+      );
+
+      if (ack.status === "submitted" && ack.actionId === "ack") {
+        return {
+          content: JSON.stringify({ surfaceId, status: "displayed" }),
+          isError: false,
+        };
+      }
+
+      if (ack.status === "submitted") {
+        // Client received the event but could not open the panel (nack).
+        const reason =
+          typeof ack.submittedData?.reason === "string"
+            ? ack.submittedData.reason
+            : "unknown";
+        return {
+          content: `The channel setup panel could not be opened by the connected client (reason: ${reason}). Do NOT tell the user the panel is open. Troubleshoot with the user (e.g. ask them to reopen or refresh the Vellum app), then retry ui_show.`,
+          isError: true,
+        };
+      }
+
+      if (ack.status === "timed_out") {
+        return {
+          content:
+            "No connected client confirmed opening the channel setup panel. Do NOT tell the user the panel is open. The user's app may be closed, viewing a different conversation, or running a version that cannot show this panel. Ask the user to open this conversation in the Vellum app (web or desktop), then retry ui_show.",
+          isError: true,
+        };
+      }
+
+      // cancelled — no interactive client, or the turn was aborted.
+      return {
+        content:
+          "The channel setup panel could not be opened — no connected client can render interactive UI. Do NOT tell the user the panel is open. Ask the user to open the Vellum app (web or desktop), then retry ui_show.",
+        isError: true,
+      };
+    }
+
     // Each surface type that has a canonical Zod schema gets parsed through it;
     // the rest pass through raw until migrated (LUM-2134 scope). The per-type
     // normalizers validate+recover; the union cast at the end is only for the

package/src/daemon/conversation-tool-setup.test.ts

@@ -0,0 +1,95 @@
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { getAllDefaultPlugins } from "../plugins/defaults/index.js";
+import { getWorkspacePluginsDir } from "../util/platform.js";
+import { getEffectiveEnabledPluginSet } from "./conversation-tool-setup.js";
+
+const DEFAULT_NAMES = getAllDefaultPlugins().map((p) => p.manifest.name);
+
+/** Write a `.disabled` sentinel for `pluginName`; returns the created dir. */
+function disablePlugin(pluginName: string): string {
+  const dir = join(getWorkspacePluginsDir(), pluginName);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, ".disabled"), "");
+  return dir;
+}
+
+describe("getEffectiveEnabledPluginSet", () => {
+  test("returns null when enabledPlugins is null (no per-chat restriction)", () => {
+    expect(getEffectiveEnabledPluginSet({ enabledPlugins: null })).toBeNull();
+  });
+
+  test("returns null when enabledPlugins is undefined", () => {
+    expect(getEffectiveEnabledPluginSet({})).toBeNull();
+  });
+
+  test("unions first-party defaults with the selected user plugins", () => {
+    const set = getEffectiveEnabledPluginSet({ enabledPlugins: ["user-a"] });
+    expect(set).not.toBeNull();
+    // The explicitly selected user plugin is present...
+    expect(set?.has("user-a")).toBe(true);
+    // ...alongside core default-plugin infrastructure, which the new-chat pills
+    // never list and so must never be filtered out.
+    expect(set?.has("default-memory")).toBe(true);
+    expect(set?.has("default-turn-context")).toBe(true);
+    expect(set?.has("default-workspace")).toBe(true);
+    expect(set?.has("default-session")).toBe(true);
+    expect(set?.has("default-title-generate")).toBe(true);
+    for (const name of DEFAULT_NAMES) {
+      expect(set?.has(name)).toBe(true);
+    }
+  });
+
+  test("still excludes a non-selected user plugin", () => {
+    const set = getEffectiveEnabledPluginSet({ enabledPlugins: ["user-a"] });
+    expect(set?.has("user-b")).toBe(false);
+  });
+
+  test("an explicit empty scope still includes the defaults", () => {
+    const set = getEffectiveEnabledPluginSet({ enabledPlugins: [] });
+    expect(set).not.toBeNull();
+    expect(set?.has("default-memory")).toBe(true);
+    expect(set?.size).toBe(DEFAULT_NAMES.length);
+  });
+
+  describe("workspace-disabled plugins (precedence)", () => {
+    const created: string[] = [];
+    afterEach(() => {
+      for (const dir of created.splice(0)) {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test("drops a workspace-disabled default the conversation did not select", () => {
+      created.push(disablePlugin("default-memory"));
+      const set = getEffectiveEnabledPluginSet({ enabledPlugins: ["user-a"] });
+      expect(set?.has("user-a")).toBe(true);
+      // The workspace-disabled default is excluded (rule 2 beats rule 3)...
+      expect(set?.has("default-memory")).toBe(false);
+      // ...while the other defaults remain.
+      expect(set?.has("default-turn-context")).toBe(true);
+      expect(set?.size).toBe(DEFAULT_NAMES.length); // user-a + defaults - memory
+    });
+
+    test("keeps a conversation-enabled plugin even if workspace-disabled", () => {
+      // Rule 1 (per-conversation explicit enable) beats rule 2 (workspace).
+      created.push(disablePlugin("user-a"));
+      const set = getEffectiveEnabledPluginSet({
+        enabledPlugins: ["user-a", "user-b"],
+      });
+      expect(set?.has("user-a")).toBe(true);
+      expect(set?.has("user-b")).toBe(true);
+    });
+
+    test("keeps a default the conversation explicitly enabled even if workspace-disabled", () => {
+      // Rule 1 beats rule 2 for defaults too.
+      created.push(disablePlugin("default-memory"));
+      const set = getEffectiveEnabledPluginSet({
+        enabledPlugins: ["default-memory"],
+      });
+      expect(set?.has("default-memory")).toBe(true);
+    });
+  });
+});

package/src/daemon/conversation-tool-setup.ts

@@ -17,6 +17,8 @@ import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import { getBindingByConversation } from "../persistence/external-conversation-store.js";
+import { DEFAULT_PLUGIN_NAMES } from "../plugins/defaults/default-plugin-names.js";
+import { isPluginDisabled } from "../plugins/disabled-state.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
@@ -25,6 +27,7 @@ import {
   getMcpToolDefinitions,
   getPluginToolDefinitions,
   getTool,
+  getToolOwner,
   getWorkspaceToolDefinitions,
   getWorkspaceToolNames,
 } from "../tools/registry.js";
@@ -119,6 +122,50 @@ export function resolveConversationAttribution(
   }
 }
 
+/**
+ * Resolve a conversation's effective per-chat plugin scope as a Set for
+ * membership checks. Returns `null` when there is no per-chat restriction
+ * (`enabledPlugins` null/undefined) — meaning all globally-enabled plugins
+ * apply — otherwise a Set of the scoped plugin ids. Later tool/skill/hook
+ * filters intersect their candidate set against this; `null` is the no-op
+ * sentinel (no intersection).
+ *
+ * Enablement precedence, highest first:
+ *   1. Explicit per-conversation enable/disable — the `enabledPlugins`
+ *      allowlist. A plugin listed here is enabled for this chat even if it is
+ *      disabled at the workspace level; an installed plugin omitted from a
+ *      non-null list is disabled for this chat.
+ *   2. Explicit workspace enable/disable — the `.disabled` sentinel
+ *      (`assistant plugins disable <name>`), via {@link isPluginDisabled}.
+ *   3. Default plugins are enabled by default.
+ *
+ * The first-party default plugins are therefore unioned into a non-null scope
+ * unless they are disabled at the workspace level: they are core runtime
+ * infrastructure (memory, turn-context, workspace grounding, session framing,
+ * history repair, title generation, …), not user-toggleable extensions, and
+ * the per-chat pills only list user-INSTALLED plugins (`/v1/plugins`), so
+ * without this union deselecting any pill would intersect the defaults out and
+ * silently disable core behavior. A workspace-disabled default is left out so
+ * `assistant plugins disable default-*` still takes effect; a default the
+ * conversation explicitly enabled (rule 1) stays in regardless. Unioning here
+ * fixes every consumer (tools/skills/injectors/hooks) at the single chokepoint.
+ */
+export function getEffectiveEnabledPluginSet(conv: {
+  enabledPlugins?: string[] | null;
+}): Set<string> | null {
+  if (conv.enabledPlugins == null) return null;
+  // Rule 1: the conversation's explicit selections always apply.
+  const effective = new Set(conv.enabledPlugins);
+  // Rules 2 + 3: add a default the conversation did not already decide, unless
+  // it is disabled at the workspace level.
+  for (const name of DEFAULT_PLUGIN_NAMES) {
+    if (!effective.has(name) && !isPluginDisabled(name)) {
+      effective.add(name);
+    }
+  }
+  return effective;
+}
+
 // ── createToolExecutor ───────────────────────────────────────────────
 
 /**
@@ -161,6 +208,27 @@ export function createToolExecutor(
     };
   };
 
+  // Per-chat plugin scope guard for the `skill_execute` dispatch path. The
+  // wire definitions + per-turn `allowedToolNames` already keep an excluded
+  // plugin's tools off the model's tool surface, but `skill_execute` names its
+  // inner tool by string, so resolve the inner tool's owner and reject when it
+  // belongs to a plugin outside the conversation's effective set. Authoritative
+  // regardless of how the name was obtained (also covers name collisions where
+  // the projected name is owned by a different, in-scope source). `null` =
+  // no per-chat restriction; non-plugin tools are never blocked.
+  const rejectOutOfScopePluginTool = (
+    toolName: string,
+    effectiveSet: Set<string> | null,
+  ): ToolExecutionResult | null => {
+    if (effectiveSet === null) return null;
+    const owner = getToolOwner(toolName);
+    if (owner?.kind !== "plugin" || effectiveSet.has(owner.id)) return null;
+    return {
+      content: `Tool "${toolName}" belongs to a plugin that is not enabled in this conversation.`,
+      isError: true,
+    };
+  };
+
   return async (
     name: string,
     input: Record<string, unknown>,
@@ -170,6 +238,11 @@ export function createToolExecutor(
     const { name: executionName, input: executionInput } =
       resolveToolInvocationAlias(name, input, ctx.allowedToolNames);
 
+    // Resolve the conversation's effective per-chat plugin scope once per tool
+    // call: reused for the ToolContext field (read by skill-surface tools) and
+    // the skill_execute dispatch guard below.
+    const effectiveEnabledPluginSet = getEffectiveEnabledPluginSet(ctx);
+
     // The execution-layer gate must run FIRST — before any interception or
     // pre-execution side effect (DoorDash step marking) — so a non-allowlisted
     // tool can neither run nor mutate conversation state. `skill_execute` is
@@ -225,6 +298,7 @@ export function createToolExecutor(
       overrideProfile: ctx.currentTurnOverrideProfile,
       invokingCallSite: ctx.currentCallSite ?? "mainAgent",
       attribution: resolveConversationAttribution(ctx),
+      enabledPluginSet: effectiveEnabledPluginSet,
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
         // Tool context's sendToClient uses a loose { type: string; [key: string]: unknown }
@@ -313,6 +387,14 @@ export function createToolExecutor(
       const innerRejection = rejectNonAllowlistedTool(toolName);
       if (innerRejection) return innerRejection;
 
+      // Per-chat plugin scope: reject the resolved inner tool when it belongs
+      // to a plugin outside the conversation's effective set.
+      const pluginRejection = rejectOutOfScopePluginTool(
+        toolName,
+        effectiveEnabledPluginSet,
+      );
+      if (pluginRejection) return pluginRejection;
+
       const rawResult = await executor.execute(
         toolName,
         toolInput,
@@ -426,6 +508,15 @@ export interface SkillProjectionContext {
   readonly transportInterface?: InterfaceId;
   /** Per-turn override profile. */
   currentTurnOverrideProfile?: string;
+  /**
+   * The conversation's per-chat plugin scope (mirrors
+   * {@link Conversation.enabledPlugins}). `null`/absent means no per-chat
+   * restriction; otherwise plugin-owned tools and skills are intersected with
+   * the effective set (the scope unioned with the always-on first-party
+   * defaults) via {@link getEffectiveEnabledPluginSet}. Read per turn so a
+   * mid-conversation scope change is picked up.
+   */
+  readonly enabledPlugins?: string[] | null;
   /**
    * Conversation id for `skill_loaded` telemetry. Absent (e.g. minimal test
    * contexts) disables telemetry recording in the skill projection.
@@ -703,6 +794,12 @@ export function createResolveToolsCallback(
       return [];
     }
 
+    // Resolve the conversation's effective per-chat plugin scope ONCE for this
+    // turn and reuse it for the plugin-tool filter and the skill projection.
+    // `null` = no per-chat restriction; otherwise a fresh Set of the selection
+    // unioned with the always-on first-party defaults.
+    const effectiveEnabledPluginSet = getEffectiveEnabledPluginSet(ctx);
+
     // Reconcile workspace tool overrides under `<workspaceDir>/tools/` into
     // the registry, then re-read them below — the on-read replacement for a
     // filesystem watcher. Fire-and-forget: the reconcile is idempotent,
@@ -717,10 +814,25 @@ export function createResolveToolsCallback(
     // so combine them with the core snapshot before filtering.
     const currentPluginDefs = getPluginToolDefinitions();
 
+    // Scope plugin tools to the conversation's per-chat plugin set. `null`
+    // leaves the list unchanged (no per-chat restriction); otherwise keep only
+    // tools whose owning plugin id is in the set, mirroring the
+    // `subagentAllowedTools` intersection below. Ownership lives in the registry
+    // (queried via getToolOwner), not on the Tool object.
+    const scopedPluginDefs =
+      effectiveEnabledPluginSet === null
+        ? currentPluginDefs
+        : currentPluginDefs.filter((d) => {
+            const ownerId = getToolOwner(d.name)?.id;
+            return (
+              ownerId !== undefined && effectiveEnabledPluginSet.has(ownerId)
+            );
+          });
+
     // Filter core + plugin tools based on current conversation context so that
     // tools irrelevant to this turn (e.g. UI tools when no client is connected)
     // are omitted from the definitions sent to the provider.
-    const filteredCoreDefs = [...coreToolDefs, ...currentPluginDefs].filter(
+    const filteredCoreDefs = [...coreToolDefs, ...scopedPluginDefs].filter(
       (d) => isToolActiveForContext(d.name, ctx),
     );
 
@@ -774,6 +886,9 @@ export function createResolveToolsCallback(
       preactivatedSkillIds: effectivePreactivated,
       previouslyActiveSkillIds: ctx.skillProjectionState,
       cache: ctx.skillProjectionCache,
+      // Scope plugin-contributed skills to the conversation's per-chat plugin
+      // selection (null = no restriction).
+      effectiveEnabledPluginSet,
       // skill_loaded telemetry context — resolved per turn so attribution
       // reflects the call site/profile the current turn actually runs on.
       telemetry: