@vellumai/assistant 0.11.5 → 0.11.6-staging.1

package/src/daemon/conversation-error.ts

@@ -1,4 +1,5 @@
 import {
+  isUserTerminalHistoryError,
   ORDERING_ERROR_PATTERNS,
   WEB_SEARCH_ORDERING_PATTERNS,
 } from "../agent/history-repair/history-repair.js";
@@ -480,6 +481,14 @@ function classifyCore(
           errorCategory: "stale_web_search_content",
         };
       }
+      if (isUserTerminalHistoryError(message)) {
+        return {
+          code: "PROVIDER_ORDERING",
+          userMessage: "An internal error occurred. Please try again.",
+          retryable: true,
+          errorCategory: "history_user_terminal",
+        };
+      }
       if (isOrderingError(message)) {
         return {
           code: "PROVIDER_ORDERING",
@@ -645,13 +654,17 @@ function reasonToClassification(
       return contextTooLargeClassification();
     case "vision_unsupported":
       return visionNotSupportedClassification();
+    // Two producers share this reason: SDK transport failures that never got
+    // a response (OpenAI APIConnectionError), and Gemini responses whose empty
+    // body reveals a proxy/egress filter intercepting the request. The copy
+    // must stay broad enough for both.
     case "network_error":
       return {
         code: "PROVIDER_NETWORK",
         userMessage:
-          "The provider returned an empty response with no body — this typically indicates a network proxy or egress filter intercepting the request, not a genuine provider error. Check your network configuration.",
+          "The request could not reach the provider: the connection failed before a real response arrived. Check that the endpoint is reachable and that no proxy or egress filter is intercepting the request, then try again.",
         retryable: true,
-        errorCategory: "provider_network_proxy_intercepted",
+        errorCategory: "provider_network_error",
       };
     case "model_not_found":
       return {
@@ -1099,6 +1112,15 @@ function classifyByMessage(
     };
   }
 
+  if (isUserTerminalHistoryError(message)) {
+    return {
+      code: "PROVIDER_ORDERING",
+      userMessage: "An internal error occurred. Please try again.",
+      retryable: true,
+      errorCategory: "history_user_terminal",
+    };
+  }
+
   // General tool_use/tool_result ordering errors
   if (isOrderingError(message)) {
     return {

package/src/daemon/conversation-slash.ts

@@ -295,6 +295,11 @@ function resolveStatusCommand(context: SlashContext): SlashResolution {
 
 const CLEAN_HELP_LINE =
   "/clean — Strip injected runtime context and reset memory injection state (no summarization)";
+const FORK_CAPABLE_INTERFACES = new Set<InterfaceId>([
+  "macos",
+  "windows",
+  "ios",
+]);
 
 function resolveCommandsList(context?: SlashContext): string[] {
   const fallbackLines = [
@@ -315,21 +320,7 @@ function resolveCommandsList(context?: SlashContext): string[] {
     return fallbackLines;
   }
 
-  if (context.userMessageInterface === "macos") {
-    return [
-      "/commands — List all available commands",
-      "/compact — Force context compaction immediately",
-      CLEAN_HELP_LINE,
-      "/context — Show conversation context usage",
-      "/model — List or switch inference profile",
-      "/models — List all available models",
-      "/status — Show conversation status and context usage",
-      "/btw — Ask a side question while the assistant is working",
-      "/fork — Fork the current conversation into a new branch",
-    ];
-  }
-
-  if (context.userMessageInterface === "ios") {
+  if (FORK_CAPABLE_INTERFACES.has(context.userMessageInterface)) {
     return [
       "/commands — List all available commands",
       "/compact — Force context compaction immediately",

package/src/daemon/daemon-control.ts

@@ -413,6 +413,7 @@ async function startDaemonLocked(): Promise<{
   const child = spawn(bunPath, ["run", mainPath], {
     detached: true,
     stdio: ["ignore", "ignore", stderrFd],
+    windowsHide: true,
     env: spawnEnv,
   });
 

package/src/daemon/disk-pressure-policy.ts

@@ -57,7 +57,13 @@ const BACKGROUND_SOURCES = new Set([
   "schedule",
   "task",
 ]);
-const LOCAL_OWNER_INTERFACES = new Set(["macos", "web", "vellum", "cli"]);
+const LOCAL_OWNER_INTERFACES = new Set([
+  "macos",
+  "windows",
+  "web",
+  "vellum",
+  "cli",
+]);
 
 export function classifyDiskPressureTurnPolicy(
   status: DiskPressureStatus,

package/src/daemon/handlers/__tests__/config-ingress-tunnel-records.test.ts

@@ -0,0 +1,208 @@
+/**
+ * Unit tests for the ingress section of the workspace config: the records
+ * `vellum tunnel` leaves behind, who owns the public base URL, and when the
+ * records are dropped. The record truth table lives on the shared parser
+ * (`packages/service-contracts/src/__tests__/ingress.test.ts`); what is
+ * checked here is that the daemon reads the keys the CLI and the gateway
+ * write, and inherits that validation.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+let rawConfig: Record<string, unknown> = {};
+
+mock.module("../../../config/loader.js", () => ({
+  loadRawConfig: () => rawConfig,
+}));
+
+import {
+  dropTunnelRecordsForNewUrl,
+  getIngressConfigResult,
+  isVelayManagedIngress,
+  loadLastTunnelRecord,
+  loadPairingTunnelRecord,
+  loadRecordedAssistantId,
+} from "../config-ingress.js";
+
+const TUNNEL_URL = "https://assistant-1.example.ts.net";
+const PAIRING_URL = "https://assistant-1.pairing.example.ts.net";
+
+describe("workspace tunnel records", () => {
+  beforeEach(() => {
+    rawConfig = {};
+  });
+
+  test("reads a well-formed record", () => {
+    rawConfig = {
+      ingress: {
+        assistantId: "assistant-1",
+        lastTunnel: { provider: "tailscale", publicBaseUrl: TUNNEL_URL },
+      },
+    };
+
+    expect(loadLastTunnelRecord()).toEqual({
+      provider: "tailscale",
+      publicBaseUrl: TUNNEL_URL,
+    });
+    expect(loadRecordedAssistantId()).toBe("assistant-1");
+  });
+
+  test("reads a pairing record beside the tunnel that owns the URL", () => {
+    rawConfig = {
+      ingress: {
+        publicBaseUrl: "https://webhooks.ngrok.app",
+        lastTunnel: {
+          provider: "ngrok",
+          publicBaseUrl: "https://webhooks.ngrok.app",
+        },
+        pairingTunnel: { provider: "tailscale", publicBaseUrl: PAIRING_URL },
+      },
+    };
+
+    expect(loadPairingTunnelRecord()).toEqual({
+      provider: "tailscale",
+      publicBaseUrl: PAIRING_URL,
+    });
+    expect(loadLastTunnelRecord()).toEqual({
+      provider: "ngrok",
+      publicBaseUrl: "https://webhooks.ngrok.app",
+    });
+  });
+
+  test("inherits the shared validation for the pairing record", () => {
+    rawConfig = {
+      ingress: {
+        pairingTunnel: { provider: "wireguard", publicBaseUrl: PAIRING_URL },
+      },
+    };
+    expect(loadPairingTunnelRecord()).toBeNull();
+
+    rawConfig = { ingress: { pairingTunnel: { provider: "tailscale" } } };
+    expect(loadPairingTunnelRecord()).toBeNull();
+  });
+
+  test("returns null when the ingress section is absent", () => {
+    expect(loadLastTunnelRecord()).toBeNull();
+    expect(loadPairingTunnelRecord()).toBeNull();
+    expect(loadRecordedAssistantId()).toBeNull();
+  });
+
+  test("returns null when the ingress section is not an object", () => {
+    rawConfig = { ingress: "nonsense" };
+
+    expect(loadLastTunnelRecord()).toBeNull();
+    expect(loadRecordedAssistantId()).toBeNull();
+  });
+
+  test("returns null for a provider outside the shared registry", () => {
+    // Readers render the provider into a shell command they tell the user to
+    // run, so an unknown one makes the whole record unusable.
+    rawConfig = {
+      ingress: {
+        lastTunnel: { provider: "wireguard", publicBaseUrl: TUNNEL_URL },
+      },
+    };
+
+    expect(loadLastTunnelRecord()).toBeNull();
+  });
+
+  test("returns null for a malformed record", () => {
+    rawConfig = { ingress: { lastTunnel: { provider: "ngrok" } } };
+    expect(loadLastTunnelRecord()).toBeNull();
+
+    rawConfig = {
+      ingress: {
+        lastTunnel: { provider: "ngrok", publicBaseUrl: "example.ts.net" },
+      },
+    };
+    expect(loadLastTunnelRecord()).toBeNull();
+  });
+
+  test("returns null for a blank recorded assistant id", () => {
+    rawConfig = { ingress: { assistantId: "   " } };
+
+    expect(loadRecordedAssistantId()).toBeNull();
+  });
+
+  test("falls back to typed defaults for a mistyped ingress section", () => {
+    rawConfig = { ingress: { publicBaseUrl: 42, enabled: "yes" } };
+
+    const config = getIngressConfigResult();
+
+    expect(config.publicBaseUrl).toBe("");
+    expect(config.enabled).toBe(false);
+    expect(config.explicitlyDisabled).toBe(false);
+  });
+
+  test("reports Velay ownership of the public base URL", () => {
+    rawConfig = {
+      ingress: { publicBaseUrl: TUNNEL_URL, publicBaseUrlManagedBy: "velay" },
+    };
+    expect(isVelayManagedIngress()).toBe(true);
+
+    rawConfig = { ingress: { publicBaseUrl: TUNNEL_URL } };
+    expect(isVelayManagedIngress()).toBe(false);
+  });
+});
+
+describe("explicitlyDisabled", () => {
+  beforeEach(() => {
+    rawConfig = {};
+  });
+
+  test("only an explicit false is an opt-out", () => {
+    // `ingress.enabled` is opt-out across the assistant: a URL set through
+    // `config set ingress.publicBaseUrl` never writes the flag and is live.
+    rawConfig = { ingress: { publicBaseUrl: TUNNEL_URL } };
+    expect(getIngressConfigResult().explicitlyDisabled).toBe(false);
+
+    rawConfig = { ingress: { publicBaseUrl: TUNNEL_URL, enabled: true } };
+    expect(getIngressConfigResult().explicitlyDisabled).toBe(false);
+
+    rawConfig = { ingress: { publicBaseUrl: TUNNEL_URL, enabled: false } };
+    expect(getIngressConfigResult().explicitlyDisabled).toBe(true);
+  });
+});
+
+describe("dropTunnelRecordsForNewUrl", () => {
+  const records = () => ({
+    publicBaseUrl: TUNNEL_URL,
+    assistantId: "assistant-1",
+    lastTunnel: { provider: "tailscale", publicBaseUrl: TUNNEL_URL },
+    pairingTunnel: { provider: "tailscale", publicBaseUrl: PAIRING_URL },
+  });
+
+  test("keeps the records when the URL is unchanged", () => {
+    const ingress: Record<string, unknown> = records();
+
+    dropTunnelRecordsForNewUrl(ingress, ` ${TUNNEL_URL}/ `);
+
+    expect(ingress).toEqual(records());
+  });
+
+  test("drops the pairing record too, so a new URL is the one reported", () => {
+    // The pairing record outranks `publicBaseUrl` in the status route, so a
+    // leftover one would hide the address the user just set.
+    const retargeted: Record<string, unknown> = records();
+
+    dropTunnelRecordsForNewUrl(retargeted, "https://other.example.ts.net");
+
+    expect(retargeted.pairingTunnel).toBeUndefined();
+  });
+
+  test("drops the records when the URL is retargeted or cleared", () => {
+    const retargeted: Record<string, unknown> = records();
+    dropTunnelRecordsForNewUrl(retargeted, "https://other.example.ts.net");
+    expect(retargeted).toEqual({ publicBaseUrl: TUNNEL_URL });
+
+    const cleared: Record<string, unknown> = records();
+    dropTunnelRecordsForNewUrl(cleared, undefined);
+    expect(cleared).toEqual({ publicBaseUrl: TUNNEL_URL });
+  });
+
+  test("is a no-op without an ingress section", () => {
+    expect(() =>
+      dropTunnelRecordsForNewUrl(undefined, TUNNEL_URL),
+    ).not.toThrow();
+  });
+});

package/src/daemon/handlers/config-ingress.ts

@@ -1,3 +1,13 @@
+import {
+  INGRESS_ASSISTANT_ID_KEY,
+  INGRESS_LAST_TUNNEL_KEY,
+  INGRESS_PAIRING_TUNNEL_KEY,
+  normalizePublicBaseUrl,
+  parseRecordedAssistantId,
+  parseTunnelRecord,
+  type TunnelRecord,
+} from "@vellumai/service-contracts/ingress";
+
 import { updatePhoneNumberWebhooks } from "../../calls/twilio-rest.js";
 import {
   getGatewayInternalBaseUrl,
@@ -11,13 +21,105 @@ import {
   getTwilioStatusCallbackUrl,
   getTwilioVoiceWebhookUrl,
   type IngressConfig,
+  isPublicIngressDisabled,
 } from "../../inbound/public-ingress-urls.js";
+import { isPlainObject } from "../../util/object.js";
 import { log } from "./shared.js";
 
 export function computeGatewayTarget(): string {
   return getGatewayInternalBaseUrl();
 }
 
+/**
+ * The `ingress` section of the raw workspace config.
+ *
+ * `vellum tunnel` writes this section (`cli/src/lib/ingress-config.ts`). The
+ * CLI is a separate build unit the assistant does not depend on, so the key
+ * names and the record validation are shared through
+ * `@vellumai/service-contracts/ingress` instead.
+ */
+function readIngressSection(): Record<string, unknown> {
+  const ingress = loadRawConfig().ingress;
+  return isPlainObject(ingress) ? ingress : {};
+}
+
+/** Read the last tunnel that ran, or null when it is absent or malformed. */
+export function loadLastTunnelRecord(): TunnelRecord | null {
+  return parseTunnelRecord(readIngressSection()[INGRESS_LAST_TUNNEL_KEY]);
+}
+
+/**
+ * Read the tunnel published for device pairing alone, or null when it is
+ * absent or malformed.
+ *
+ * A tailnet-only tunnel started beside configured webhook integrations records
+ * itself here instead of replacing `publicBaseUrl`, which those callbacks need
+ * to keep resolving to an address their callers can reach.
+ */
+export function loadPairingTunnelRecord(): TunnelRecord | null {
+  return parseTunnelRecord(readIngressSection()[INGRESS_PAIRING_TUNNEL_KEY]);
+}
+
+/**
+ * Read the assistant id the last tunnel fronted, or null when absent. The
+ * daemon cannot derive it: it scopes itself as `self` internally.
+ */
+export function loadRecordedAssistantId(): string | null {
+  return parseRecordedAssistantId(
+    readIngressSection()[INGRESS_ASSISTANT_ID_KEY],
+  );
+}
+
+/** Key under `ingress` naming the component that owns `publicBaseUrl`. */
+const INGRESS_MANAGED_BY_KEY = "publicBaseUrlManagedBy";
+
+/** Value that key carries when a self-hosted gateway's Velay tunnel owns it. */
+const VELAY_MANAGED_BY = "velay";
+
+/**
+ * True when Velay owns `ingress.publicBaseUrl`.
+ *
+ * A gateway started with `VELAY_BASE_URL` writes the URL when its tunnel comes
+ * up, clears it when the tunnel drops, and reconnects on its own
+ * (`gateway/src/velay/client.ts`). Readers must not offer the user a tunnel
+ * command for an ingress they do not own.
+ */
+export function isVelayManagedIngress(): boolean {
+  return readIngressSection()[INGRESS_MANAGED_BY_KEY] === VELAY_MANAGED_BY;
+}
+
+/**
+ * Drop `ingress.assistantId`, `ingress.lastTunnel` and `ingress.pairingTunnel`
+ * from `ingress` when `nextPublicBaseUrl` replaces a different address,
+ * mutating it in place.
+ *
+ * The first two describe the address being replaced, so keeping them makes the
+ * status route call a legitimate retarget `foreign` and name a tunnel that
+ * never fronted the new address. The pairing record goes with them because it
+ * outranks `publicBaseUrl` where the status route reports an address: a
+ * leftover one would hide the address the user just set behind a tunnel they
+ * are no longer running. Every writer of `ingress.publicBaseUrl` owes this
+ * cleanup, so it lives here rather than in each of them. An absent `ingress`
+ * section carries no records to drop.
+ */
+export function dropTunnelRecordsForNewUrl(
+  ingress: Record<string, unknown> | undefined,
+  nextPublicBaseUrl: unknown,
+): void {
+  if (!ingress) {
+    return;
+  }
+  if (
+    normalizePublicBaseUrl(nextPublicBaseUrl) ===
+    normalizePublicBaseUrl(ingress.publicBaseUrl)
+  ) {
+    return;
+  }
+  delete ingress[INGRESS_ASSISTANT_ID_KEY];
+  delete ingress[INGRESS_LAST_TUNNEL_KEY];
+  delete ingress[INGRESS_PAIRING_TUNNEL_KEY];
+}
+
 /**
  * Read the current ingress config from the raw workspace config file.
  * Extracted so it can be called from both the daemon message handler
@@ -25,6 +127,7 @@ export function computeGatewayTarget(): string {
  */
 export function getIngressConfigResult(): {
   enabled: boolean;
+  explicitlyDisabled: boolean;
   publicBaseUrl: string;
   localGatewayTarget: string;
   managedCallbacks: boolean;
@@ -40,6 +143,7 @@ export function getIngressConfigResult(): {
     if (assistantId) {
       return {
         enabled: true,
+        explicitlyDisabled: false,
         publicBaseUrl: `${platformBase}/gateway/callbacks/${assistantId}`,
         localGatewayTarget: computeGatewayTarget(),
         managedCallbacks: true,
@@ -48,12 +152,18 @@ export function getIngressConfigResult(): {
     }
   }
 
-  const raw = loadRawConfig();
-  const ingress = (raw?.ingress ?? {}) as Record<string, unknown>;
-  const publicBaseUrl = (ingress.publicBaseUrl as string) ?? "";
-  const enabled = (ingress.enabled as boolean | undefined) ?? false;
+  const ingress = readIngressSection();
+  // Typed reads, not casts: a hand-edited config must not hand callers a
+  // value whose type contradicts this function's return type.
+  const publicBaseUrl =
+    typeof ingress.publicBaseUrl === "string" ? ingress.publicBaseUrl : "";
+  const enabled =
+    typeof ingress.enabled === "boolean" ? ingress.enabled : undefined;
   return {
-    enabled,
+    enabled: enabled === true,
+    // `enabled` is opt-out across the assistant, so an unset flag is not off:
+    // callers asking whether ingress is live read this, not `!enabled`.
+    explicitlyDisabled: isPublicIngressDisabled({ ingress: { enabled } }),
     publicBaseUrl,
     localGatewayTarget: computeGatewayTarget(),
     managedCallbacks: false,

package/src/daemon/lifecycle.ts

@@ -1,5 +1,6 @@
 import { config as dotenvConfig } from "dotenv";
 
+import { reconcileAppPins } from "../apps/app-pin-reconciler.js";
 import { reconcileCallsOnStartup } from "../calls/call-recovery.js";
 import { TwilioVoiceProvider } from "../calls/twilio-provider.js";
 import { expireInteractionBoundGuardianRequests } from "../channels/gateway-guardian-requests.js";
@@ -62,6 +63,7 @@ import {
   getWorkspaceDir,
 } from "../util/platform.js";
 import { APP_VERSION } from "../version.js";
+import { drainOrphanedWatchTimelineEntries } from "../watch/watch-timeline.js";
 import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/adaptive-thinking-repair.js";
 import { ensureByokDefaultProfiles } from "../workspace/byok-default-profile-ensure.js";
@@ -385,6 +387,29 @@ export async function runDaemon(): Promise<void> {
       log.warn({ err }, "Profiler retention sweep failed — continuing startup");
     }
 
+    // Reclaim watch-timeline entries whose conversation is gone. Their purge
+    // runs after the conversation row is already committed as deleted and
+    // cannot be retried by the caller, and nothing cascades into the table, so
+    // a failed purge or a crash between the two writes would otherwise keep
+    // narration, AX trees, and screenshots of the user's screen for as long as
+    // the database lives. Startup is the pass every install gets: the periodic
+    // pass runs from database maintenance on the memory plugin's jobs worker,
+    // which an install with that plugin disabled or `memory.enabled: false`
+    // never starts, so this is the only sweep that install's residue sees and
+    // it drains rather than taking one page. Best-effort inside the sweep,
+    // which reports zero rather than throwing.
+    try {
+      const sweptWatchEntries = await drainOrphanedWatchTimelineEntries();
+      if (sweptWatchEntries > 0) {
+        log.info(
+          { sweptWatchEntries },
+          "Swept watch timeline entries for deleted conversations on startup",
+        );
+      }
+    } catch (err) {
+      log.warn({ err }, "Watch timeline sweep failed, continuing startup");
+    }
+
     // Backfill oauth_connection rows for manual-token providers (Telegram,
     // Slack channel) that already have stored credentials from before the
     // oauth_connection migration. Safe to call on every startup.
@@ -722,6 +747,7 @@ export async function runDaemon(): Promise<void> {
   // the same shape as schedule recovery above.
   try {
     await reconcilePluginSchedules();
+    reconcileAppPins();
   } catch (err) {
     log.error({ err }, "Plugin schedule reconcile failed, continuing startup");
   }

package/src/daemon/message-types/web-activity.ts

@@ -11,10 +11,11 @@ export type WebSearchProviderId =
   | "perplexity"
   | "tavily"
   | "keenable"
-  | "firecrawl";
+  | "firecrawl"
+  | "fastcrw";
 
 /** Provider that backed a `web_fetch` call. `default` is the built-in fetcher. */
-export type WebFetchProviderId = "default" | "firecrawl";
+export type WebFetchProviderId = "default" | "firecrawl" | "fastcrw";
 
 export interface WebSearchResultItem {
   rank: number; // 1-indexed

package/src/daemon/trust-context.ts

@@ -4,7 +4,6 @@
  * Extracted from conversation-runtime-assembly.ts to break circular
  * imports (memory/conversation-crud → daemon/conversation-runtime-assembly).
  */
-import type { ChannelConversationType } from "@vellumai/gateway-client";
 
 import { isHttpAuthDisabled } from "../config/env.js";
 import { canSeePersonalMemory } from "../runtime/effective-capabilities.js";
@@ -88,39 +87,3 @@ export function isPersonalMemoryAllowed(
     trustClass: resolveTrustClass(trustContext),
   });
 }
-
-/**
- * Map a channel-native chat type (Telegram `private`/`group`/`supergroup`,
- * Slack `im`/`mpim`/`channel`, Discord `dm`/`channel`) onto the
- * permission-matrix conversation-type axis. Slack and Discord both forward
- * every non-DM as `"channel"` without distinguishing public from private, so
- * `"channel"` maps to undefined: a permissive public-channel cell must not
- * silently govern private channels. The channel-type tier starts matching for
- * their non-DMs once the gateway forwards the distinct type.
- *
- * Every DM-capable channel must have an arm here. A missing one is silent:
- * the cell stays settable, because the adapter validates, and simply never
- * matches, so the guardian sets a rule for DMs and it does nothing.
- */
-export function mapChatTypeToConversationType(
-  chatType?: string,
-): ChannelConversationType | undefined {
-  switch (chatType) {
-    case "im": // Slack DM
-    case "private": // Telegram DM
-    // Discord has no string vocabulary for this: its API distinguishes a DM by
-    // a numeric channel type, and the absence of a guild. The normalizer names
-    // it for the axis rather than inventing a native-looking word.
-    case "dm":
-      return "dm";
-    // "mpim" is Slack's multi-party DM, forwarded under its own name rather
-    // than reported as "im": a room with several people in it takes the
-    // tighter `private` cell and the group-chat etiquette, not the `dm` one.
-    case "mpim":
-    case "group": // Telegram group
-    case "supergroup": // Telegram supergroup
-      return "private";
-    default:
-      return undefined;
-  }
-}