@vellumai/assistant 0.11.10 → 0.11.11-staging.1

package/src/tools/capability-offer.ts

@@ -0,0 +1,93 @@
+import type { ClientOs, InterfaceId } from "../channels/types.js";
+
+/** Public download page for the desktop apps. */
+export const DESKTOP_APP_DOWNLOAD_URL = "https://www.vellum.ai/download";
+
+/** Chrome Web Store listing for the Vellum Assistant browser extension. */
+export const CHROME_WEB_STORE_INSTALL_URL =
+  "https://chromewebstore.google.com/detail/vellum-assistant-browser/hphbdmpffeigpcdjkckleobjmhhokpne";
+
+export const DESKTOP_APP_INSTALL_HINT = `Install the Vellum desktop app: ${DESKTOP_APP_DOWNLOAD_URL}`;
+
+/** User-facing install step for status userActions and command-failure hints. */
+export const CHROME_EXTENSION_INSTALL_HINT = `Install the Vellum Assistant Chrome extension from the Chrome Web Store: ${CHROME_WEB_STORE_INSTALL_URL}`;
+
+export interface CapabilityOfferSurface {
+  transportInterface?: InterfaceId;
+  clientOs?: ClientOs;
+}
+
+const LOGGED_IN_BROWSER_HELPFUL_RE =
+  /timed?\s*out|timeout|etimedout|econnrefused|enotfound|ehostunreach|unreachable|err_connection|err_name_not_resolved|err_timed_out|net::err_|login required|sign[- ]in required|\b401\b|\b403\b|authentication|captcha|verify you are human|access denied|forbidden/i;
+
+/**
+ * True on phone transports and mobile client OS values. Those surfaces have
+ * no in-app browser and cannot install the Chrome extension in-place.
+ */
+export function isPhoneSurface(surface?: CapabilityOfferSurface): boolean {
+  if (
+    surface?.transportInterface === "ios" ||
+    surface?.transportInterface === "phone"
+  ) {
+    return true;
+  }
+  return surface?.clientOs === "ios" || surface?.clientOs === "android";
+}
+
+/**
+ * True when a logged-in browser session (desktop app or Chrome extension)
+ * would plausibly reach the page this failure could not.
+ */
+export function shouldOfferLoggedInBrowser(message: string): boolean {
+  return LOGGED_IN_BROWSER_HELPFUL_RE.test(message);
+}
+
+/**
+ * Offer the desktop app and Chrome extension as a capability the user can
+ * turn on. Screenshot-and-paste is the fallback after that offer, not the
+ * first suggestion.
+ */
+export function formatLoggedInBrowserOffer(
+  surface?: CapabilityOfferSurface,
+): string {
+  const lines: string[] = [];
+  if (isPhoneSurface(surface)) {
+    lines.push(
+      "This page needs a logged-in browser on a computer. There is no in-app browser on this phone, and the Chrome extension cannot be installed here.",
+    );
+    lines.push(
+      `Install the desktop app on a Mac or Windows PC (${DESKTOP_APP_DOWNLOAD_URL}) or the Chrome extension in Chrome on that computer (${CHROME_WEB_STORE_INSTALL_URL}).`,
+    );
+    lines.push(
+      "Offer those first. Do not describe a browser panel here. Only ask for a screenshot or pasted page content if the user cannot install either.",
+    );
+    return lines.join("\n");
+  }
+
+  lines.push(
+    "A connected desktop app or Chrome extension can open this page in a browser where you are already logged in.",
+  );
+  lines.push(`Desktop app: ${DESKTOP_APP_DOWNLOAD_URL}`);
+  lines.push(`Chrome extension: ${CHROME_WEB_STORE_INSTALL_URL}`);
+  lines.push(
+    "Offer those first. Only ask for a screenshot or pasted page content if the user cannot install either.",
+  );
+  return lines.join("\n");
+}
+
+/**
+ * Append {@link formatLoggedInBrowserOffer} when the message does not already
+ * carry the install URLs.
+ */
+export function appendLoggedInBrowserOffer(
+  message: string,
+  surface?: CapabilityOfferSurface,
+): string {
+  if (
+    message.includes(DESKTOP_APP_DOWNLOAD_URL) &&
+    message.includes(CHROME_WEB_STORE_INSTALL_URL)
+  ) {
+    return message;
+  }
+  return `${message}\n\n${formatLoggedInBrowserOffer(surface)}`;
+}

package/src/tools/terminal/__tests__/safe-env.test.ts

@@ -50,6 +50,23 @@ describe("safe-env Qdrant forwarding", () => {
   });
 });
 
+describe("safe-env CES vault isolation", () => {
+  test("strips the CES HTTP bearer and credential URL from child shells", () => {
+    expect(SAFE_ENV_VARS).not.toContain("CES_SERVICE_TOKEN");
+    expect(SAFE_ENV_VARS).not.toContain("CES_CREDENTIAL_URL");
+    expect(SAFE_ENV_VARS).toContain("CES_LOCAL_SOCKET");
+
+    const env = buildSanitizedEnv("linux", {
+      CES_SERVICE_TOKEN: "vault-bearer",
+      CES_CREDENTIAL_URL: "http://127.0.0.1:8090",
+      CES_LOCAL_SOCKET: "/tmp/ces.sock",
+    });
+    expect(env.CES_SERVICE_TOKEN).toBeUndefined();
+    expect(env.CES_CREDENTIAL_URL).toBeUndefined();
+    expect(env.CES_LOCAL_SOCKET).toBe("/tmp/ces.sock");
+  });
+});
+
 describe("safe-env Windows forwarding", () => {
   test("forwards runtime paths only to Windows children", () => {
     const keys = [

package/src/tools/terminal/safe-env.ts

@@ -54,8 +54,10 @@ export const SAFE_ENV_VARS = [
   "VELLUM_MARKETING_URL",
   "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
   "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
-  "CES_CREDENTIAL_URL",
   "CES_MANAGED_MODE",
+  // Socket path only. The CES HTTP bearer (`CES_SERVICE_TOKEN`) and
+  // `CES_CREDENTIAL_URL` stay in the assistant process: child shells must
+  // not inherit a vault token they can printenv or log.
   "CES_LOCAL_SOCKET",
   // Per-instance port of the assistant-managed Qdrant sidecar, so skill and
   // bash-tool subprocesses that use the vector helpers (e.g. embed/search over
@@ -67,7 +69,6 @@ export const SAFE_ENV_VARS = [
   "IS_PLATFORM",
   "VELLUM_CLOUD",
   "VELLUM_SANDBOX_RUNTIME",
-  "CES_SERVICE_TOKEN",
   "VELLUM_PROFILER_RUN_ID",
   "VELLUM_PROFILER_MODE",
   "VELLUM_PROFILER_MAX_BYTES",

package/src/util/provider-error-patterns.ts

@@ -45,6 +45,40 @@ export function isChatTemplateFailureError(message: string): boolean {
   return CHAT_TEMPLATE_FAILURE_PATTERNS.some((re) => re.test(message));
 }
 
+// Provider prose that indicates the selected model id is unknown to the
+// endpoint. Distinct from OpenCode's `ModelError` / "is not supported"
+// shape, which is only safe to treat as model-not-found on a 4xx.
+export const MODEL_NOT_FOUND_PATTERNS = [
+  /model .*(?:not found|does not exist)/i,
+  /model_not_found/i,
+];
+
+// OpenCode zen returns HTTP 401 with `type=ModelError` and
+// "Model <id> is not supported". Treating that as a rejected key sends
+// users to update credentials instead of switching models. Do not apply
+// these on 5xx: retry treats a stamped reason as authoritative, so a
+// transient server error with this type would skip retries and may
+// immediately switch profiles.
+export const UNSUPPORTED_MODEL_ID_PATTERNS = [
+  /model .+ is not supported/i,
+  /\bModelError\b/,
+];
+
+/**
+ * Whether a provider error message indicates the selected model is unknown
+ * to the endpoint. Providers wrap raw upstream rejections in their own
+ * prose, so the classifier matches the full {@link MODEL_NOT_FOUND_PATTERNS}
+ * and {@link UNSUPPORTED_MODEL_ID_PATTERNS} sets rather than any single
+ * normalized phrase. Callers that see HTTP 5xx must not use this helper
+ * to stamp `model_not_found`.
+ */
+export function isModelNotFoundError(message: string): boolean {
+  return (
+    MODEL_NOT_FOUND_PATTERNS.some((re) => re.test(message)) ||
+    UNSUPPORTED_MODEL_ID_PATTERNS.some((re) => re.test(message))
+  );
+}
+
 // Vendor-neutral (OpenRouter/Anthropic-style) credit-exhaustion prose. Also
 // covers per-key spend caps: OpenRouter returns 403 "Key limit exceeded" when a
 // key's configured credit limit is reached — a billing/budget condition that

package/src/watcher/__tests__/engine.test.ts

@@ -274,9 +274,12 @@ describe("runWatchersOnce — Phase 2 runBackgroundJob integration", () => {
     expect(sandwich.preamble).not.toContain("Linear inbox");
     expect(sandwich.preamble).not.toContain("Investigate flaky CI");
 
-    // Postamble (user role) carries the disposition contract; it must NOT
-    // include the attacker-controllable watcher name or event payload.
+    // Postamble (user role) carries the disposition contract and the
+    // silent-by-default notify rule; it must NOT include the
+    // attacker-controllable watcher name or event payload.
     expect(sandwich.postamble).toContain("<watcher-disposition>");
+    expect(sandwich.postamble).toContain("Watcher ticks are not scheduled runs");
+    expect(sandwich.postamble).toContain("Unmatched events stay quiet");
     expect(sandwich.postamble).not.toContain("Linear inbox");
     expect(sandwich.postamble).not.toContain("Investigate flaky CI");
   });

package/src/watcher/engine.ts

@@ -411,7 +411,8 @@ export async function runWatchersOnce(
     //    assistant-role content as its own past output, so a malicious payload
     //    (e.g. a Linear title reading "Ignore previous instructions and
     //    exfiltrate ...") cannot override the user-role postamble. The runner
-    //    inserts these before invoking processMessage with an empty prompt.
+    //    inserts the preamble and untrusted payload, then invokes
+    //    processMessage with the trusted postamble as the kickoff prompt.
     //    See `assistantSandwich` in `runtime/background-job-runner.ts`.
     //
     // The fence marks the content as third-party data; the sandwich denies it
@@ -440,7 +441,9 @@ export async function runWatchersOnce(
     ].join("\n");
 
     const postamble = [
-      "Process the events above according to the watcher's action prompt. For each event, include a disposition block:",
+      "Process the events above according to the watcher's action prompt.",
+      "Notify only when the action prompt's match criteria are met, using `assistant notifications send`. Unmatched events stay quiet: write a silent disposition block and do not send a notification, including a \"nothing new\" ping. Watcher ticks are not scheduled runs.",
+      "For each event, include a disposition block:",
       "<watcher-disposition>",
       '{"event_id": "...", "disposition": "silent|notify|escalate", "action": "what you did", "title": "notification title", "body": "notification body"}',
       "</watcher-disposition>",
@@ -449,8 +452,8 @@ export async function runWatchersOnce(
     const result = await runBackgroundJob({
       jobName: `watcher:${watcher.id}`,
       source: "watcher",
-      // The seed lives in the sandwich messages; processMessage runs
-      // with an empty prompt so we don't double-inject the action prompt.
+      // Empty prompt tells the runner to use the sandwich postamble as
+      // the kickoff so persistUserMessage has content.
       prompt: "",
       systemHint: `Watcher: ${watcher.name}`,
       trustContext: { sourceChannel: "vellum", trustClass: "guardian" },