@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/src/telemetry/usage-telemetry-reporter.test.ts

@@ -1318,6 +1318,7 @@ describe("UsageTelemetryReporter", () => {
       outcome?: string | null;
       batchedInto?: string | null;
       failureCode?: string | null;
+      scripted?: boolean | null;
     } = {},
   ) {
     return {
@@ -1329,6 +1330,9 @@ describe("UsageTelemetryReporter", () => {
       interfaceId: "macos",
       channelId: "vellum",
       clientMetadata: null,
+      // Defaults to UNKNOWN so existing cases keep asserting the pre-marker
+      // wire shape; each scripted case opts in explicitly.
+      scripted: null,
       ...overrides,
     };
   }
@@ -1588,6 +1592,50 @@ describe("UsageTelemetryReporter", () => {
     expect("failure_code" in byId["evt-cancelled"]).toBe(false);
   });
 
+  test("the scripted marker rides the turn event with all three states distinct", async () => {
+    // `scripted` is what lets activation metrics exclude auto-sent onboarding
+    // turns for EVERY owner rather than only diagnostics-consenting ones
+    // (ANT-10), so its states must stay distinguishable on the wire. Note
+    // diagnostics consent is OFF here: unlike `trace`, this field must ship
+    // regardless: that independence is the entire point of the field.
+    mockGetCachedShareDiagnostics.mockReturnValue(false);
+    mockQueryUnreportedUsageEvents.mockReturnValue([]);
+    useStatefulCheckpoints();
+    mockQueryUnreportedTurnEvents.mockReturnValue([
+      turnEvent("evt-scripted", 1700000010000, "conv-1", { scripted: true }),
+      turnEvent("evt-typed", 1700000011000, "conv-1", { scripted: false }),
+      turnEvent("evt-unknown", 1700000012000, "conv-2", { scripted: null }),
+    ]);
+    mockIsTurnSettled.mockReturnValue(true);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":3}', { status: 200 })),
+    );
+
+    const reporter = makeReporter();
+    await reporter.flush();
+
+    const body = JSON.parse(
+      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+    );
+    const byId = Object.fromEntries(
+      body.events.map((e: { daemon_event_id: string }) => [
+        e.daemon_event_id,
+        e,
+      ]),
+    );
+    expect(byId["evt-scripted"].scripted).toBe(true);
+    // The state most at risk: an omit-when-falsy spread would drop this and
+    // silently downgrade a turn we KNOW was typed into "unknown", handing
+    // activation back to the consent-gated classifier this field replaces.
+    expect("scripted" in byId["evt-typed"]).toBe(true);
+    expect(byId["evt-typed"].scripted).toBe(false);
+    // A row predating the marker stays UNKNOWN: the key is absent, so the
+    // wire shape is byte-identical to a pre-scripted turn event and
+    // downstream falls back to the trace classifier rather than being told
+    // something untrue about the turn.
+    expect("scripted" in byId["evt-unknown"]).toBe(false);
+  });
+
   test("an unrecognized outcome value in metadata is dropped from the wire", async () => {
     mockGetCachedShareDiagnostics.mockReturnValue(false);
     mockQueryUnreportedUsageEvents.mockReturnValue([]);

package/src/tools/browser/pinned-tabs.ts

@@ -14,7 +14,9 @@
  * `host_browser_session_invalidated`.
  */
 
-import { log } from "../../cli/logger.js";
+import { getLogger } from "../../util/logger.js";
+
+const log = getLogger("pinned-tabs");
 
 const pinnedTabs = new Map<string, Map<string, string>>();
 

package/src/tools/subagent/spawn.ts

@@ -10,6 +10,7 @@ import {
   getMessages,
 } from "../../persistence/conversation-crud.js";
 import type { ContentBlock, Message } from "../../providers/types.js";
+import { buildAdvisorContext } from "../../subagent/consult-context.js";
 import {
   advisorRequestText,
   buildAdvisorSystem,
@@ -293,6 +294,23 @@ async function runAdvisorConsult(args: {
     );
     const sanitizedMessages = sanitizeConsultTranscript(withInFlight);
 
+    // Situational awareness for the advisor: the parent's live tool set, the
+    // full skill catalog, and its workspace. Assembled off the per-turn
+    // ToolContext snapshot (trust, channel) so the personal-memory sections
+    // are gated exactly like the runtime injectors. Best-effort: a null pack
+    // just means the consult runs on transcript + system prompt alone.
+    const situationalContext = await buildAdvisorContext({
+      conversationId: context.conversationId,
+      workingDir: context.workingDir,
+      allowedToolNames: context.allowedToolNames,
+      trustClass: context.trustClass,
+      sourceChannel: context.executionChannel,
+      enabledPluginSet: context.enabledPluginSet,
+      // The parent's warm per-turn catalog keeps the synchronous on-disk
+      // catalog scan out of the consult path.
+      skillCatalog: parentConversation.skillProjectionCache?.catalog,
+    });
+
     // Default to the stronger advisor profile when the caller did not pin one;
     // an explicit `inference_profile` wins (already forced upstream).
     const advisorProfile = getConfig().llm.advisorProfile;
@@ -322,8 +340,12 @@ async function runAdvisorConsult(args: {
           parentConversationId: context.conversationId,
           label,
           // Carry the agent's own objective into the consult request — the
-          // agent states the task here, and the inherited transcript can be thin.
+          // agent states the task here, and the inherited transcript can be
+          // thin. The situational pack rides in the model request only
+          // (`requestText`), keeping the system prompt minimal and the
+          // display-facing `objective` free of bulky internal context.
           objective: advisorRequestText(objective),
+          requestText: advisorRequestText(objective, situationalContext),
           sendResultToUser: false,
           role: "advisor",
           fork: true,

package/src/tools/terminal/safe-env.ts

@@ -70,6 +70,7 @@ export const SAFE_ENV_VARS = [
   "VELLUM_PROFILER_MIN_FREE_MB",
   "VELLUM_MEMORY_LIMIT",
   "VELLUM_CPU_LIMIT",
+  "VELLUM_ONNX_INTRA_OP_THREADS",
   "VELLUM_MINIKUBE_STORAGE_SIZE",
   "VELLUM_BACKUP_DIR",
   "VELLUM_BACKUP_KEY_PATH",

package/src/tools/ui-surface/definitions.ts

@@ -7,7 +7,10 @@
  * handled locally by the daemon.
  */
 
-import { coerceSurfaceDataRecord } from "../../api/surfaces.js";
+import {
+  coerceSurfaceDataRecord,
+  normalizeVisualShowData,
+} from "../../api/surfaces.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { isWeakOpenModel } from "../../providers/weak-open-model.js";
 import type {
@@ -22,6 +25,7 @@ import {
   UI_SHOW_TYPE_DOCS,
   uiShowTeachingError,
 } from "./surface-shape-docs.js";
+import { validateVisualHtml } from "./visual-validation.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -59,6 +63,13 @@ function proxyExecute(toolName: string) {
       };
     }
 
+    if (toolName === "ui_show" && input.surface_type === "visual") {
+      const visualError = visualTeachingError(input);
+      if (visualError !== null) {
+        return { content: visualError, isError: true };
+      }
+    }
+
     if (toolName === "ui_show" && isDynamicPageAppSubstitute(input)) {
       return {
         content:
@@ -197,6 +208,33 @@ function isSubstantialInteractiveHtml(input: Record<string, unknown>): boolean {
   return html.length > 2000 && INTERACTIVE_HTML_RE.test(html);
 }
 
+/**
+ * Teaching error for a `visual` ui_show whose fragment would not render as
+ * intended, or null when it is sound. The checks run before proxying because
+ * the sandbox fails silently: an external resource never loads and an
+ * unknown `var()` resolves to nothing, so the user sees a blank or unthemed
+ * widget while the model believes it rendered.
+ */
+function visualTeachingError(input: Record<string, unknown>): string | null {
+  const { html } = normalizeVisualShowData(
+    input,
+    coerceSurfaceDataRecord(input.data),
+  );
+  if (html.trim().length === 0) {
+    return "Error: ui_show visual requires a non-empty HTML fragment in `data.html`. The surface was not displayed because no markup was provided — the user would see a blank box. Resend ui_show with the complete self-contained fragment in `data.html`.";
+  }
+
+  const problems = validateVisualHtml(html);
+  if (problems.length === 0) {
+    return null;
+  }
+  return (
+    "Error: ui_show visual was not displayed — the fragment does not meet the sandbox contract:\n" +
+    problems.map((problem) => `- ${problem}`).join("\n") +
+    "\nFix every item above and call ui_show again."
+  );
+}
+
 function collectRoutingText(input: Record<string, unknown>): string[] {
   const values: string[] = [];
   addString(values, input.title);

package/src/tools/ui-surface/surface-shape-docs.ts

@@ -18,6 +18,7 @@
 
 import {
   coerceSurfaceDataRecord,
+  describeSurfaceDataStringParseFailure,
   FileUploadSurfaceDataSchema,
   normalizeCopyBlockShowData,
 } from "../../api/surfaces.js";
@@ -66,7 +67,8 @@ interface SurfaceShapeDoc {
    * Returns a description of what keeps the payload from rendering as intended
    * — missing load-bearing content, or keys that would be silently dropped —
    * or null when the payload is fine. Absent for types the daemon normalizes
-   * leniently (card) or that have bespoke handling (dynamic_page). Guards for
+   * leniently (card) or that have bespoke handling (dynamic_page, visual).
+   * Guards for
    * types whose daemon normalizer recovers top-level input fields also receive
    * the full tool `input`, so the guard accepts exactly what the normalizer
    * accepts.
@@ -193,6 +195,12 @@ export const SURFACE_SHAPE_DOCS: Record<string, SurfaceShapeDoc> = {
     shape:
       "{ html, width?, height?, preview?: { title, subtitle?, description?, icon?, metrics?: [{ label, value }] } } — custom visual HTML for transient surfaces only, never app-like builds",
   },
+  visual: {
+    purpose:
+      "polished inline diagram/chart/explainer — PREFER this when explaining how something works or compares; load the `visualize` skill first",
+    shape:
+      "{ html, height? } — one self-contained HTML/SVG fragment (no DOCTYPE/html/head/body, no external resources); every colour comes from the injected design-token CSS variables, so hex/rgb literals and invented `var()` names are rejected. Load the `visualize` skill with `skill_load` for the full contract and the token vocabulary",
+  },
   channel_setup: {
     purpose: "open the Slack/Telegram/Phone setup panel",
     shape: '{ channel: "slack" | "telegram" | "phone" }',
@@ -243,12 +251,34 @@ export const UI_SHOW_TYPE_DOCS = [
   `Other types: ${COLD_SURFACE_INDEX}. Send your best-guess data — if required content is missing, the error returns the exact shape.`,
 ].join("\n");
 
+/**
+ * Rejection envelope for a `data` argument the model double-encoded as a JSON
+ * string that does not parse — most often HTML whose inner double quotes were
+ * escaped wrong. The decode failure strands every field, so without this the
+ * surface's own shape check fires and blames the first field it misses, sending
+ * the model off to fix a fragment that was never the problem.
+ */
+function surfaceDataEncodingError(
+  surfaceType: string,
+  detail: string,
+  shape: string,
+): string {
+  return (
+    `Error: ui_show ${surfaceType} was not displayed — \`data\` arrived as a JSON-encoded string that could not be parsed: ${detail}. ` +
+    "None of its fields could be read, so the surface looked empty. This is an argument-encoding problem, not a problem with the content itself. " +
+    `Pass \`data\` as a JSON object rather than a string: ${shape}. ` +
+    "If the content is HTML with double quotes inside, use single quotes for the HTML attributes (<rect class='box'>) so there is nothing to escape. " +
+    "Resend the same ui_show with `data` as an object."
+  );
+}
+
 /**
  * Teaching error for a ui_show payload that would render nothing, or null
  * when the payload is displayable. Unknown/missing surface_type gets the
- * full type index; a known type missing its load-bearing content gets that
- * type's exact shape. dynamic_page emptiness is handled by the bespoke
- * model-aware envelopes in `definitions.ts`, not here.
+ * full type index; an undecodable JSON-string `data` gets the encoding
+ * envelope; a known type missing its load-bearing content gets that type's
+ * exact shape. dynamic_page emptiness and the `visual` fragment checks are
+ * handled by the bespoke envelopes in `definitions.ts`, not here.
  */
 export function uiShowTeachingError(
   input: Record<string, unknown>,
@@ -265,6 +295,10 @@ export function uiShowTeachingError(
     return `Error: ui_show was not displayed — ${got}. Valid types: ${SURFACE_TYPE_INDEX}. Resend ui_show with one of these surface_type values; if a type's data is missing required content, the error will include its exact shape.`;
   }
   const doc = SURFACE_SHAPE_DOCS[surfaceType]!;
+  const parseFailure = describeSurfaceDataStringParseFailure(input.data);
+  if (parseFailure !== null) {
+    return surfaceDataEncodingError(surfaceType, parseFailure, doc.shape);
+  }
   if (!doc.missingContent) {
     return null;
   }