@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/daemon/conversation-store.ts

@@ -151,6 +151,13 @@ function applyTransportMetadata(
  *
  * Handles provider setup, rate limiting, system prompt, memory policy,
  * and conversation hydration.
+ *
+ * The in-memory Conversation snapshots the tool registry at construction.
+ * An empty snapshot is an empty tool list on the wire for the life of the
+ * instance, so the create path initializes the registry before that
+ * constructor runs. A hit in `findConversation` already has its snapshot.
+ * `initializeTools` is idempotent: a process that already initialized at
+ * boot awaits the settled promise.
  */
 export async function getOrCreateConversation(
   conversationId: string,
@@ -228,6 +235,9 @@ export async function getOrCreateConversation(
       const systemPrompt = await resolveInitialSystemPrompt(storedOptions);
       const maxTokens = storedOptions?.maxResponseTokens;
 
+      const { initializeTools } = await import("../tools/registry.js");
+      await initializeTools();
+
       const newConversation = new Conversation(
         conversationId,
         provider,

package/src/daemon/conversation-surfaces.ts

@@ -85,6 +85,8 @@ import type {
 } from "./message-protocol.js";
 import { INTERACTIVE_SURFACE_TYPES } from "./message-protocol.js";
 import { isRowVisibleToUntrustedActor } from "./message-provenance.js";
+import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 export {
   buildSurfaceShowPair,
   type CurrentTurnSurface,
@@ -1904,7 +1906,13 @@ export async function handleSurfaceAction(
   // reconstruct the same-user binding for host proxies (CU / app-control),
   // mirroring the normal message path.
   sourceActorPrincipalId?: string,
+  // Trust of the actor committing this action, resolved by the route from the
+  // verified requester. Passed rather than read back off the conversation so a
+  // click that lands mid-turn is attributed to its clicker instead of to
+  // whoever occupies the resting slot.
+  requesterTrustContext?: TrustContext,
 ): Promise<SurfaceActionResult> {
+  const actionTrustContext = requesterTrustContext ?? restingTrust(ctx);
   // ── Standalone surface interception ──────────────────────────────
   // Daemon-driven surfaces (from `requestInteractiveUi`) register a
   // pending entry in `pendingStandaloneSurfaces`. When the user clicks
@@ -2050,7 +2058,7 @@ export async function handleSurfaceAction(
     // `await` resolves as soon as the conversation is created + titled +
     // published to the event hub. The HTTP POST /v1/surface-actions
     // response returns promptly — the seed turn runs in the background.
-    const originTrustContext = ctx.trustContext;
+    const originTrustContext = actionTrustContext;
     const { conversationId } = await launchConversation({
       title,
       seedPrompt,
@@ -2069,14 +2077,11 @@ export async function handleSurfaceAction(
     return { accepted: true, conversationId };
   }
 
-  // Trust of the actor committing THIS action. `POST /v1/surface-actions`
-  // stamps the verified requester's trust onto the conversation before
-  // dispatching here, and `loadFromDb` derives the live history filter from
-  // the same value, so the completion path's persisted read stays scoped to
-  // exactly what this actor's live view would have held. Unresolvable trust
-  // fails closed to the untrusted filter.
+  // Trust of the actor committing THIS action, so the completion path's
+  // persisted read stays scoped to exactly what this actor's live view would
+  // have held. Unresolvable trust fails closed to the untrusted filter.
   const requesterCanAccessMemory = resolveCapabilities(
-    ctx.trustContext?.trustClass,
+    actionTrustContext?.trustClass,
   ).canAccessMemory;
 
   const pending = ctx.pendingSurfaceActions.get(surfaceId);
@@ -2222,6 +2227,7 @@ export async function handleSurfaceAction(
       activeSurfaceId: surfaceId,
       displayContent,
       sourceActorPrincipalId,
+      trustContext: actionTrustContext,
       isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
       // Rides the metadata bag rather than a typed option: the queue
       // round-trips `metadata` but not `PersistMessageOptions`.
@@ -2285,6 +2291,9 @@ export async function handleSurfaceAction(
         activeSurfaceId: surfaceId,
         displayContent,
         sourceActorPrincipalId,
+        // Reached only when `enqueueMessage` declined to queue: the click is
+        // starting this turn, so it is the actor the run belongs to.
+        trustContext: actionTrustContext,
         isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
         scripted: isSyntheticSurfaceActionContent(content),
       })
@@ -2472,6 +2481,7 @@ export async function handleSurfaceAction(
     activeSurfaceId: surfaceId,
     displayContent,
     sourceActorPrincipalId,
+    trustContext: actionTrustContext,
     isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
     // Rides the metadata bag rather than a typed option: the queue
     // round-trips `metadata` but not `PersistMessageOptions`.
@@ -2545,6 +2555,9 @@ export async function handleSurfaceAction(
       activeSurfaceId: surfaceId,
       displayContent,
       sourceActorPrincipalId,
+      // Same as the history-restored branch: the enqueue declined, so this
+      // click is the turn about to run.
+      trustContext: actionTrustContext,
       isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
       scripted: isSyntheticSurfaceActionContent(content),
     })

package/src/daemon/conversation.ts

@@ -1119,11 +1119,10 @@ export class Conversation {
       preStrippedCount = boundary === -1 ? slicedDbMessages.length : boundary;
     }
 
-    // The injection-time personal-memory gate, so background/local
-    // conversations (sourceChannel `undefined` or `"vellum"`) can rehydrate
-    // the persisted v2 static memory block. The shared helper folds in the
-    // HTTP-auth-disabled dev bypass so rehydration and injection agree on the
-    // effective trust class.
+    // The injection-time personal-memory gate, so rehydration of the persisted
+    // blocks admits exactly the actors injection would. The shared helper folds
+    // in the HTTP-auth-disabled dev bypass, so a turn with no bound actor
+    // resolves the same way on both paths.
     const personalMemoryAllowed = isPersonalMemoryAllowed(this.trustContext);
     // Pruned v3 card slugs, read lazily on the first row that carries a v3
     // block (most conversations carry none, so most loads never query). The
@@ -1513,11 +1512,12 @@ export class Conversation {
 
   async ensureActorScopedHistory(): Promise<void> {
     const currentTrustClass = this.trustContext?.trustClass;
-    // `loadFromDb` gates personal-memory rehydration on `sourceChannel` too
-    // (via `isPersonalMemoryAllowed`), so a same-trust-class reuse from a
-    // different channel (e.g. internal `vellum` → remote channel) must also
-    // trigger a reload. Otherwise stale personal-memory blocks can leak to
-    // an untrusted remote turn, or be hidden when they should be present.
+    // Tracked alongside the trust class because `loadFromDb` gates
+    // personal-memory rehydration on `isPersonalMemoryAllowed`, which folds in
+    // the disabled-auth elevation of an unbound actor: two contexts can share a
+    // trust class and still differ here. A reuse that changes the answer has to
+    // reload, or stale personal-memory blocks persist into a turn that must not
+    // see them, or stay stripped from one that should.
     const currentPersonalMemoryAllowed = isPersonalMemoryAllowed(
       this.trustContext,
     );
@@ -2829,6 +2829,7 @@ export class Conversation {
     actionId: string,
     data?: Record<string, unknown>,
     sourceActorPrincipalId?: string,
+    requesterTrustContext?: TrustContext,
   ): Promise<SurfaceActionResult> {
     return handleSurfaceActionImpl(
       this,
@@ -2836,6 +2837,7 @@ export class Conversation {
       actionId,
       data,
       sourceActorPrincipalId,
+      requesterTrustContext,
     );
   }
 

package/src/daemon/lifecycle.ts

@@ -98,6 +98,7 @@ import {
   registerMessagingProviders,
   registerWatcherProviders,
 } from "./providers-setup.js";
+import { startResourcePressureGuardForLifecycle } from "./resource-pressure-guard-lifecycle.js";
 import { installShutdownHandlers } from "./shutdown-handlers.js";
 import { broadcastDaemonStatus } from "./status.js";
 
@@ -197,8 +198,10 @@ export async function runDaemon(): Promise<void> {
     }
   }
 
-  // Start the runtime HTTP server early so /healthz answers ASAP. A bind
-  // failure is non-fatal — the daemon falls back to IPC-only operation.
+  // Start the runtime HTTP server early so /healthz answers ASAP. Throws on
+  // EADDRINUSE to abort startup: another process holds the port every HTTP
+  // client (and the gateway's /v1/* proxy) targets, so an IPC-only daemon
+  // would look healthy while all HTTP traffic 502s.
   await startRuntimeHttpServer();
 
   // Warms the configured-probe cache (credential reads only, no DB). Fired
@@ -700,6 +703,7 @@ export async function runDaemon(): Promise<void> {
 
   startUsageTelemetryReporter();
   startDiskPressureGuardForLifecycle();
+  startResourcePressureGuardForLifecycle();
   startOrphanReaper();
   startEventLoopWatchdog();
 

package/src/daemon/message-types/conversations.ts

@@ -48,18 +48,16 @@ interface BaseTransportMetadata {
 }
 
 /**
- * Transport metadata for interfaces that support the full desktop host-proxy
- * set (see `HostProxyInterfaceId` / `supportsHostProxy`). Carries the host
+ * Transport metadata for interfaces that support desktop host-proxy tools
+ * (see `HostProxyInterfaceId` / `supportsHostProxy`). Carries the host
  * environment fields the client reports so the `<workspace>` block renders
  * the user's actual machine rather than a containerized daemon's own OS.
  *
- * Today this variant is populated only by the macOS client, but the shape
- * is capability-keyed (not interface-name-keyed) so future host-capable
- * clients (e.g. a native Linux or Windows desktop) get the same treatment
- * automatically when added to `HostProxyInterfaceId`.
+ * The shape is capability-keyed so each native desktop client gets the same
+ * host-environment treatment through `HostProxyInterfaceId`.
  */
 export interface HostProxyTransportMetadata extends BaseTransportMetadata {
-  /** Interface identifier — restricted to interfaces that support host proxies. */
+  /** Interface identifier restricted to interfaces that support host proxies. */
   interfaceId: HostProxyInterfaceId;
   /** Home directory of the user on the host machine (e.g. `NSHomeDirectory()`). */
   hostHomeDir?: string;

package/src/daemon/provider-rejection-log-fields.ts

@@ -0,0 +1,124 @@
+/**
+ * Log-field builder for provider rejections that carry no actionable
+ * classification of their own (unclassified 4xx).
+ *
+ * The extracted fields on `ProviderError` (`apiErrorCode`, `message`) drop the
+ * detail an operator needs to find the offending request: which request field,
+ * which message, which byte pattern. The verbatim upstream body carries it, so
+ * it rides the log record, bounded so a large provider error page cannot flood
+ * the log stream.
+ */
+
+import { ProviderError } from "../util/errors.js";
+import { redactLogString } from "../util/log-redact.js";
+
+/**
+ * Ceiling for the logged upstream body. Bodies are already capped at 16 KiB
+ * when captured (`providers/openai/api-error-normalization.ts`); this second,
+ * tighter bound is what a log record carries.
+ */
+export const MAX_LOGGED_UPSTREAM_BODY_CHARS = 4096;
+
+/**
+ * Upstream error codes whose message names the offending request content part,
+ * e.g. `Invalid 'input[191].content[1].text': string too long`. Kept narrow:
+ * codes outside this set have no such pointer, so parsing their message would
+ * only produce coincidental matches.
+ */
+const CONTENT_PART_POINTER_CODES = new Set([
+  "string_above_max_length",
+  "invalid_body",
+]);
+
+/**
+ * Positional pointer into the request payload. `input[N]` is the Responses API
+ * shape, `messages[N]` the Chat Completions shape; both index the request's
+ * message array in send order, so `N` is an offset into the conversation
+ * history that produced the request.
+ */
+const CONTENT_PART_POINTER = /\b(?:input|messages)\[(\d+)\]\.content\[(\d+)\]/i;
+
+export interface ProviderRejectionLogFields {
+  /** Verbatim upstream non-2xx body, truncated to the logged ceiling. */
+  upstreamErrorBody: string | null;
+  /** True when the body was cut to fit the ceiling. */
+  upstreamErrorBodyTruncated?: boolean;
+  apiErrorCode?: string;
+  apiErrorType?: string;
+  apiErrorParam?: string;
+  requestId?: string;
+  /** Index of the offending message within the request's message array. */
+  offendingMessageIndex?: number;
+  /** Index of the offending content part within that message. */
+  offendingContentIndex?: number;
+}
+
+/**
+ * Extract the offending `input[N].content[M]` coordinates from an upstream
+ * error message, for the codes that carry such a pointer.
+ */
+function parseContentPartPointer(
+  error: ProviderError,
+): Pick<
+  ProviderRejectionLogFields,
+  "offendingMessageIndex" | "offendingContentIndex"
+> {
+  const code = error.apiErrorCode?.toLowerCase();
+  if (!code || !CONTENT_PART_POINTER_CODES.has(code)) {
+    return {};
+  }
+  const match = CONTENT_PART_POINTER.exec(
+    `${error.message} ${error.rawBody ?? ""}`,
+  );
+  if (!match) {
+    return {};
+  }
+  const messageIndex = Number(match[1]);
+  const contentIndex = Number(match[2]);
+  if (
+    !Number.isSafeInteger(messageIndex) ||
+    !Number.isSafeInteger(contentIndex)
+  ) {
+    return {};
+  }
+  return {
+    offendingMessageIndex: messageIndex,
+    offendingContentIndex: contentIndex,
+  };
+}
+
+/** Diagnostic fields describing what the provider actually rejected. */
+export function buildProviderRejectionLogFields(
+  error: Error,
+): ProviderRejectionLogFields {
+  if (!(error instanceof ProviderError)) {
+    return { upstreamErrorBody: null };
+  }
+
+  // The body is arbitrary upstream text under a custom field name, so it is
+  // outside the reach of the pino `err`/`req`/`res` serializers and is scrubbed
+  // here before it reaches the record.
+  const rawBody =
+    error.rawBody === undefined ? undefined : redactLogString(error.rawBody);
+  const truncated =
+    rawBody !== undefined && rawBody.length > MAX_LOGGED_UPSTREAM_BODY_CHARS;
+
+  return {
+    upstreamErrorBody:
+      rawBody === undefined
+        ? null
+        : rawBody.slice(0, MAX_LOGGED_UPSTREAM_BODY_CHARS),
+    ...(truncated ? { upstreamErrorBodyTruncated: true } : {}),
+    ...(error.apiErrorCode !== undefined
+      ? { apiErrorCode: error.apiErrorCode }
+      : {}),
+    ...(error.apiErrorType !== undefined
+      ? { apiErrorType: error.apiErrorType }
+      : {}),
+    ...(error.apiErrorParam !== undefined
+      ? { apiErrorParam: error.apiErrorParam }
+      : {}),
+    ...(error.requestId !== undefined ? { requestId: error.requestId } : {}),
+    ...parseContentPartPointer(error),
+  };
+}

package/src/daemon/resource-pressure-guard-lifecycle.ts

@@ -0,0 +1,66 @@
+/**
+ * Resource-pressure guard wiring for the daemon lifecycle.
+ *
+ * Starts the guard at boot and defers the first sample onto a macrotask so it
+ * never blocks startup, and stops the guard (cancelling any pending deferred
+ * sample) on shutdown. When the guard is disabled (non-platform), no deferred
+ * sample is scheduled.
+ */
+import { getLogger } from "../util/logger.js";
+import {
+  evaluateResourcePressureNow,
+  startResourcePressureGuard,
+  stopResourcePressureGuard,
+} from "./resource-pressure-guard.js";
+
+const log = getLogger("resource-pressure-guard-lifecycle");
+
+let resourcePressureStartupSampleTimer: ReturnType<typeof setTimeout> | null =
+  null;
+
+function runDeferredResourcePressureStartupSample(): void {
+  resourcePressureStartupSampleTimer = null;
+  try {
+    const status = evaluateResourcePressureNow();
+    if (status.error) {
+      log.warn(
+        { error: status.error },
+        "Resource pressure guard sample failed during startup, continuing",
+      );
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "Resource pressure guard failed during startup, continuing",
+    );
+  }
+}
+
+export function startResourcePressureGuardForLifecycle(): void {
+  try {
+    const startedStatus = startResourcePressureGuard();
+    if (!startedStatus.enabled) {
+      return;
+    }
+    if (!resourcePressureStartupSampleTimer) {
+      resourcePressureStartupSampleTimer = setTimeout(
+        runDeferredResourcePressureStartupSample,
+        0,
+      );
+      (resourcePressureStartupSampleTimer as { unref?: () => void }).unref?.();
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "Resource pressure guard failed during startup, continuing",
+    );
+  }
+}
+
+export function stopResourcePressureGuardForLifecycle(): void {
+  if (resourcePressureStartupSampleTimer) {
+    clearTimeout(resourcePressureStartupSampleTimer);
+    resourcePressureStartupSampleTimer = null;
+  }
+  stopResourcePressureGuard();
+}