@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/daemon/message-protocol.ts

@@ -15,6 +15,7 @@
 // Re-export domain modules (all individual types remain importable)
 export * from "./message-types/acp.js";
 export * from "./message-types/apps.js";
+export * from "./message-types/background-tools.js";
 export * from "./message-types/bookmarks.js";
 export * from "./message-types/computer-use.js";
 export * from "./message-types/contacts.js";
@@ -32,7 +33,6 @@ export * from "./message-types/host-file.js";
 export * from "./message-types/host-transfer.js";
 export * from "./message-types/inbox.js";
 export * from "./message-types/integrations.js";
-export * from "./message-types/meet.js";
 export * from "./message-types/memory.js";
 export * from "./message-types/messages.js";
 export * from "./message-types/notifications.js";
@@ -56,6 +56,7 @@ import type {
   _AppsClientMessages,
   _AppsServerMessages,
 } from "./message-types/apps.js";
+import type { _BackgroundToolsServerMessages } from "./message-types/background-tools.js";
 import type { _BookmarksServerMessages } from "./message-types/bookmarks.js";
 import type {
   _ComputerUseClientMessages,
@@ -100,7 +101,6 @@ import type {
   _IntegrationsClientMessages,
   _IntegrationsServerMessages,
 } from "./message-types/integrations.js";
-import type { _MeetServerMessages } from "./message-types/meet.js";
 import type { _MemoryServerMessages } from "./message-types/memory.js";
 import type {
   _MessagesClientMessages,
@@ -199,7 +199,6 @@ export type ServerMessage =
   | _HostCuServerMessages
   | _HostFileServerMessages
   | _HostTransferServerMessages
-  | _MeetServerMessages
   | _MemoryServerMessages
   | _WorkspaceServerMessages
   | _SchedulesServerMessages
@@ -209,6 +208,7 @@ export type ServerMessage =
   | _NotificationsServerMessages
   | _UpgradesServerMessages
   | _AcpServerMessages
+  | _BackgroundToolsServerMessages
   | _BookmarksServerMessages
   | _WorkflowsServerMessages
   | DiskPressureStatusChangedEvent

package/src/daemon/message-provenance.ts

@@ -8,28 +8,26 @@
  * actor filters the history down to rows whose provenance is itself
  * non-guardian.
  *
- * This lives in its own low-dependency module (types only) so both the
- * conversation lifecycle (history load) and the context compactor (image
- * manifest) can apply the identical filter without creating an import
- * cycle through `conversation-lifecycle` ↔ `window-manager` ↔ `compactor`.
+ * This lives in its own low-dependency module (types plus the zod-only
+ * trust-class leaf) so both the conversation lifecycle (history load) and the
+ * context compactor (image manifest) can apply the identical filter without
+ * creating an import cycle through `conversation-lifecycle` ↔
+ * `window-manager` ↔ `compactor`.
  */
 import type { MessageRow } from "../persistence/conversation-crud.js";
-import type { TrustClass } from "../runtime/actor-trust-resolver.js";
+import { type TrustClass, trustClassSchema } from "../runtime/trust-class.js";
 
 export function parseProvenanceTrustClass(
   metadata: string | null,
 ): TrustClass | undefined {
-  if (!metadata) return undefined;
+  if (!metadata) {
+    return undefined;
+  }
   try {
     const parsed = JSON.parse(metadata) as { provenanceTrustClass?: unknown };
-    const trustClass = parsed?.provenanceTrustClass;
-    if (
-      trustClass === "guardian" ||
-      trustClass === "trusted_contact" ||
-      trustClass === "unverified_contact" ||
-      trustClass === "unknown"
-    ) {
-      return trustClass;
+    const result = trustClassSchema.safeParse(parsed?.provenanceTrustClass);
+    if (result.success) {
+      return result.data;
     }
   } catch {
     // Ignore malformed metadata and treat as unknown provenance.

package/src/daemon/message-types/background-tools.ts

@@ -0,0 +1,28 @@
+// Background bash/host_bash command lifecycle types.
+
+// === Server → Client (streamed via SSE) ===
+
+export interface BackgroundToolStarted {
+  type: "background_tool_started";
+  id: string;
+  toolName: string;
+  conversationId: string;
+  command: string;
+  startedAt: number;
+}
+
+export interface BackgroundToolCompleted {
+  type: "background_tool_completed";
+  id: string;
+  conversationId: string;
+  status: "completed" | "failed" | "cancelled";
+  exitCode?: number | null;
+  output?: string;
+  completedAt: number;
+}
+
+// --- Domain-level union alias (consumed by message-protocol.ts) ---
+
+export type _BackgroundToolsServerMessages =
+  | BackgroundToolStarted
+  | BackgroundToolCompleted;

package/src/daemon/message-types/contacts.ts

@@ -1,4 +1,4 @@
-// Contact management: list, get, update channel status, and delete.
+// Contact management: list, get, and delete.
 
 import type { ContactRequestEvent } from "../../api/events/contact-request.js";
 
@@ -6,17 +6,9 @@ import type { ContactRequestEvent } from "../../api/events/contact-request.js";
 
 export interface ContactsRequest {
   type: "contacts";
-  action: "list" | "get" | "update_channel" | "delete";
+  action: "list" | "get" | "delete";
   /** Contact ID (get and delete). */
   contactId?: string;
-  /** Channel ID (update_channel only). */
-  channelId?: string;
-  /** New status for channel (update_channel only). */
-  status?: "active" | "pending" | "revoked" | "blocked" | "unverified";
-  /** New policy for channel (update_channel only). */
-  policy?: "allow" | "deny" | "escalate";
-  /** Reason for status change (update_channel only). */
-  reason?: string;
   /** Filter by role (list only). */
   role?: "guardian" | "contact";
   /** Limit (list only). */

package/src/daemon/message-types/conversations.ts

@@ -41,6 +41,16 @@ interface BaseTransportMetadata {
   chatType?: string;
   /** IANA timezone reported by the active client for the current turn. */
   clientTimezone?: string;
+  /**
+   * The client's operating-system surface ("web" | "ios" | "macos"),
+   * reported independently of {@link interfaceId}. The web bundle ships to a
+   * browser, the Capacitor iOS shell, and the Electron macOS app, all on the
+   * same `"web"` transport interface — `clientOs` is what tells the assistant
+   * which OS it is actually talking to (rendered as the `client_os:` line in
+   * the per-turn context) WITHOUT perturbing transport/host-proxy capability
+   * inference, which keys off `interfaceId`.
+   */
+  clientOs?: string;
 }
 
 /**

package/src/daemon/message-types/integrations.ts

@@ -1,6 +1,7 @@
 // External service integrations: Slack, Telegram, Vercel, ingress, guardian.
 
 import type { NavigateSettingsEvent } from "../../api/events/navigate-settings.js";
+import type { OpenPanelEvent } from "../../api/events/open-panel.js";
 import type { OpenUrlEvent } from "../../api/events/open-url.js";
 import type { ChannelId } from "../../channels/types.js";
 
@@ -242,6 +243,7 @@ export type _IntegrationsServerMessages =
   | IntegrationConnectResult
   | OAuthConnectResultResponse
   | OpenUrlEvent
+  | OpenPanelEvent
   | NavigateSettingsEvent
   | ShowPlatformLogin
   | PlatformDisconnected;

package/src/daemon/message-types/surfaces.ts

@@ -23,6 +23,7 @@ export {
 
 export type SurfaceType =
   | "card"
+  | "channel_setup"
   | "choice"
   | "copy_block"
   | "oauth_connect"

package/src/daemon/message-types/sync.ts

@@ -14,6 +14,7 @@ export const SYNC_TAGS = {
   assistantSounds: "assistant:self:sounds",
   assistantSchedules: "assistant:self:schedules",
   appsList: "apps:list",
+  pluginsList: "plugins:list",
   conversationsList: "conversations:list",
   featureFlagsClient: "feature-flags:client",
   featureFlagsAssistant: "feature-flags:assistant",

package/src/daemon/pointer-conversation-trust.ts

@@ -2,9 +2,10 @@
  * Guardian-trust elevation for call-status pointer turns.
  *
  * Call-status pointer messages are generated as owner self-maintenance turns:
- * only guardian-gated audiences route through the daemon processor (see
- * `resolvePointerAudienceTrust` in `calls/call-pointer-messages.ts`), so the
- * generation should run under the internal guardian context.
+ * only the owner's own conversations route through the daemon processor (see
+ * `resolvePointerAudienceIsOwner` in `calls/call-pointer-messages.ts`; contact
+ * and unknown audiences take the deterministic fallback instead), so the
+ * generation runs under the internal guardian context.
  *
  * The subtlety is history: `Conversation.loadFromDb` filters the persisted
  * history to non-guardian provenance whenever the active trust context cannot
@@ -38,18 +39,31 @@ export interface GuardianElevatableConversation {
  * its history so guardian-authored history is not filtered to empty on a cold
  * load. Returns a function that restores the prior trust context.
  *
- * No-ops (returning a no-op restorer) when the conversation is already
- * memory-capable, or when it is mid-turn — mutating `trustContext` during an
- * active loop would elevate that turn's actor trust (mirrors the warm-path guard
- * in `conversation-store.ts`).
+ * Elevation is restricted to the owner's own conversation: an explicit guardian
+ * context, or a trust-less cold load (an evicted owner conversation whose actor
+ * trust has not been re-resolved). It no-ops (returning a no-op restorer) when
+ * the prior context belongs to a known contact (`trusted_contact` /
+ * `unverified_contact`) or any other non-owner actor — rehydrating guardian-only
+ * history into a contact's conversation would leak it. It also no-ops when the
+ * conversation is already memory-capable, or when it is mid-turn — mutating
+ * `trustContext` during an active loop would elevate that turn's actor trust
+ * (mirrors the warm-path guard in `conversation-store.ts`).
  */
 export async function elevatePointerConversationToGuardian(
   conversation: GuardianElevatableConversation,
 ): Promise<() => void> {
   const priorTrustContext = conversation.trustContext;
+  const priorTrustClass = priorTrustContext?.trustClass;
+  // Only the owner may be elevated: an explicit guardian context (already
+  // memory-capable, so the capability check below no-ops it) or a trust-less
+  // cold load. Contact and unknown actors are excluded so guardian-only history
+  // is never rehydrated into a non-owner conversation.
+  const isOwnerContext =
+    priorTrustClass === undefined || priorTrustClass === "guardian";
   const shouldElevate =
-    !conversation.isProcessing() &&
-    !resolveCapabilities(priorTrustContext?.trustClass).canAccessMemory;
+    isOwnerContext &&
+    !resolveCapabilities(priorTrustClass).canAccessMemory &&
+    !conversation.isProcessing();
   if (!shouldElevate) return () => {};
 
   conversation.setTrustContext(INTERNAL_GUARDIAN_TRUST_CONTEXT);

package/src/daemon/pointer-turn-runner.ts

@@ -0,0 +1,174 @@
+/**
+ * Runs a call pointer/status event as a real daemon conversation turn: the
+ * assistant generates the pointer text in-context (identity, preferences,
+ * history) rather than emitting deterministic boilerplate.
+ *
+ * Pointer turns are guardian-gated owner self-maintenance. The turn is
+ * tool-disabled and fact-checked: if the model drops a required fact or the
+ * agent loop errors, the persisted messages are rolled back and the function
+ * throws so the caller can fall back to deterministic copy.
+ */
+
+import {
+  deleteMessageById,
+  getMessages,
+} from "../persistence/conversation-crud.js";
+import { getLogger } from "../util/logger.js";
+import { getOrCreateConversation } from "./conversation-store.js";
+import { elevatePointerConversationToGuardian } from "./pointer-conversation-trust.js";
+
+const log = getLogger("pointer-turn-runner");
+
+/**
+ * Generate and persist a pointer message as a conversation turn.
+ *
+ * @param requiredFacts - facts that must appear verbatim in the generated
+ *   text (phone number, duration, outcome keyword, etc.). The generated text
+ *   is validated against these; if any are missing the turn is rolled back
+ *   and this function throws so the caller's deterministic fallback fires.
+ * @throws if the agent loop errors or the generated text fails fact validation.
+ */
+export async function runPointerMessageTurn(
+  conversationId: string,
+  instruction: string,
+  requiredFacts?: string[],
+): Promise<void> {
+  const conversation = await getOrCreateConversation(conversationId);
+
+  // Pointer turns are guardian-gated owner self-maintenance: elevate to
+  // the internal guardian context and rehydrate history so a cold
+  // (evicted) load doesn't filter guardian history to empty and ship a
+  // cache-missing turn. `restoreTrustContext` undoes the elevation after
+  // the turn. See pointer-conversation-trust.ts for the full rationale.
+  const restoreTrustContext =
+    await elevatePointerConversationToGuardian(conversation);
+
+  // Constrain pointer generation to a tool-disabled path so call-
+  // status events cannot trigger unintended side-effect tools.
+  // Incrementing toolsDisabledDepth causes the resolveTools callback
+  // to return an empty tool list, preventing the LLM from seeing or
+  // invoking any tools during the pointer agent loop.
+  //
+  // A depth counter (rather than a boolean) ensures that overlapping
+  // pointer requests on the same conversation don't clear each other's
+  // constraint — each caller increments on entry and decrements in
+  // its own finally block.
+  conversation.toolsDisabledDepth++;
+  try {
+    const { id: messageId } = await conversation.persistUserMessage({
+      content: instruction,
+      metadata: { pointerInstruction: true },
+      displayContent: "[Call status event]",
+    });
+
+    // Helper: roll back persisted messages on failure, then reload
+    // in-memory history from the (now cleaned) DB. Reloading avoids
+    // stale-index issues when context compaction reassigns the
+    // messages array during runAgentLoop.
+    const rollback = async (extraMessageIds?: string[]) => {
+      try {
+        deleteMessageById(messageId);
+      } catch {
+        /* best effort */
+      }
+      for (const id of extraMessageIds ?? []) {
+        try {
+          deleteMessageById(id);
+        } catch {
+          /* best effort */
+        }
+      }
+      try {
+        await conversation.loadFromDb();
+      } catch {
+        /* best effort */
+      }
+    };
+
+    // Snapshot message IDs before the agent loop so we can diff
+    // afterwards to find exactly which messages this run created,
+    // avoiding positional heuristics that break under concurrency.
+    //
+    // Caveat: the diff captures *all* new messages in the
+    // conversation during the loop window, not just those from
+    // this specific agent loop.  If a concurrent pointer event
+    // falls back to a deterministic addMessage() while our loop
+    // is in flight, that message lands in our diff.  The race
+    // requires two pointer events for the same conversation
+    // within the agent loop window *and* this run must fail or
+    // fail fact-check — narrow enough to accept.  A future
+    // improvement could tag messages with a per-run correlation
+    // ID so rollback only targets its own output.
+    const preRunMessageIds = new Set(
+      getMessages(conversationId).map((m) => m.id),
+    );
+
+    let agentLoopError: string | undefined;
+    let generatedText = "";
+    await conversation.runAgentLoop(instruction, messageId, {
+      onEvent: (msg) => {
+        if (
+          "type" in msg &&
+          msg.type === "assistant_text_delta" &&
+          "text" in msg
+        ) {
+          generatedText += (msg as { text: string }).text;
+        }
+        if (
+          "type" in msg &&
+          (msg.type === "error" || msg.type === "conversation_error")
+        ) {
+          agentLoopError =
+            "message" in msg
+              ? (msg as { message: string }).message
+              : "userMessage" in msg
+                ? (msg as { userMessage: string }).userMessage
+                : "Agent loop failed";
+        }
+      },
+    });
+
+    // Identify messages created during this run by diffing against
+    // the pre-run snapshot. This captures all messages added to the
+    // conversation during the loop window, which may include messages
+    // from concurrent pointer events (see over-capture caveat above).
+    const postRunMessages = getMessages(conversationId);
+    const createdMessageIds = postRunMessages
+      .filter((m) => !preRunMessageIds.has(m.id) && m.id !== messageId)
+      .map((m) => m.id);
+
+    if (agentLoopError) {
+      await rollback(createdMessageIds);
+      throw new Error(agentLoopError);
+    }
+
+    // Post-generation fact check: verify the assistant's response
+    // includes all required factual details (phone number, duration,
+    // outcome keyword, etc.). If the model omitted or rewrote them,
+    // remove both the instruction and generated messages and throw so
+    // the deterministic fallback fires.
+    //
+    // Validation uses text accumulated from assistant_text_delta
+    // events during the agent loop rather than a DB lookup, avoiding
+    // any positional ambiguity when concurrent pointer events
+    // interleave messages in the conversation.
+    if (requiredFacts && requiredFacts.length > 0) {
+      const missingFacts = requiredFacts.filter(
+        (fact) => !generatedText.includes(fact),
+      );
+      if (missingFacts.length > 0) {
+        log.warn(
+          { conversationId, missingFacts },
+          "Generated pointer text failed fact validation — falling back to deterministic",
+        );
+        await rollback(createdMessageIds);
+        throw new Error("Generated pointer text failed fact validation");
+      }
+    }
+  } finally {
+    // Restore tool availability so subsequent turns aren't affected.
+    conversation.toolsDisabledDepth--;
+    // Undo the temporary guardian elevation installed above.
+    restoreTrustContext();
+  }
+}

package/src/daemon/providers-setup.ts

@@ -16,6 +16,7 @@ import { registerMessagingProvider } from "../messaging/registry.js";
 import { initializeProviders } from "../providers/registry.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
+import { validateSubagentRoleAllowlists } from "../subagent/validate-allowlists.js";
 import { createMcpToolsFromServer } from "../tools/mcp/mcp-tool-factory.js";
 import { initializeTools, registerMcpTools } from "../tools/registry.js";
 import { getLogger } from "../util/logger.js";
@@ -110,6 +111,21 @@ export async function initializeProvidersAndTools(
   // their names before the MCP / plugin registrations below run.
   await initializeTools();
 
+  // Validate subagent role tool-allowlists against the now-registered core
+  // tool set (every allowlisted name is an eager core tool, so they are all
+  // present at this point). A renamed tool would otherwise silently strip a
+  // role's access — the stale name just never matches. Warn-and-continue per
+  // the daemon startup philosophy: a stale allowlist is a logic bug, not a
+  // reason to refuse boot.
+  try {
+    validateSubagentRoleAllowlists();
+  } catch (err) {
+    log.warn(
+      { err },
+      "Subagent role allowlist validation failed — continuing startup",
+    );
+  }
+
   // Start MCP servers and register their tools
   if (config.mcp?.servers && Object.keys(config.mcp.servers).length > 0) {
     const manager = getMcpServerManager();