@vellumai/assistant 0.12.0 → 0.12.1-dev.202609142113.d1590bc

package/src/tools/terminal/sanitized-bash.ts

@@ -0,0 +1,105 @@
+/**
+ * Spawn a shell command with the same sanitized environment the bash tool
+ * forwards to tool-call subprocesses.
+ *
+ * Used by `assistant bash` so a CLI invocation sees the same allowlisted
+ * env, workspace cwd, and platform shell as a bash tool call, without
+ * round-tripping through the assistant HTTP or IPC API.
+ */
+
+import { spawn } from "node:child_process";
+
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
+import { getWorkspaceDir } from "../../util/platform.js";
+import { buildSanitizedEnv } from "./safe-env.js";
+
+export const DEFAULT_SANITIZED_BASH_TIMEOUT_MS = 30_000;
+
+export interface SanitizedBashResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+  error?: string;
+}
+
+export function runSanitizedBash(
+  command: string,
+  timeoutMs: number = DEFAULT_SANITIZED_BASH_TIMEOUT_MS,
+): Promise<SanitizedBashResult> {
+  if (!command) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "command is required",
+    });
+  }
+
+  const effectiveTimeout =
+    typeof timeoutMs === "number" && timeoutMs > 0
+      ? timeoutMs
+      : DEFAULT_SANITIZED_BASH_TIMEOUT_MS;
+
+  return new Promise<SanitizedBashResult>((resolve) => {
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    let timedOut = false;
+    let settled = false;
+
+    const finish = (result: SanitizedBashResult) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve(result);
+    };
+
+    const wrapped = buildShellInvocation(command);
+    const child = spawn(wrapped.command, wrapped.args, {
+      cwd: getWorkspaceDir(),
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+      env: buildSanitizedEnv(),
+      windowsHide: true,
+    });
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      terminateProcessTree(child);
+    }, effectiveTimeout);
+
+    child.stdout.on("data", (data: Buffer) => {
+      stdoutChunks.push(data);
+    });
+
+    child.stderr.on("data", (data: Buffer) => {
+      stderrChunks.push(data);
+    });
+
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({
+        stdout: Buffer.concat(stdoutChunks).toString(),
+        stderr: Buffer.concat(stderrChunks).toString(),
+        exitCode: code,
+        timedOut,
+      });
+    });
+
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      finish({
+        stdout: "",
+        stderr: "",
+        exitCode: null,
+        timedOut: false,
+        error: err.message,
+      });
+    });
+  });
+}

package/src/tools/watch/watch-retro-report.ts

@@ -14,14 +14,6 @@ import type {
 /**
  * How a watch retrospective hands its report to the daemon.
  *
- * **The card cannot come from `ui_show`.** A retrospective runs as a
- * `clientless` wake, which pins the turn non-interactive, and
- * `conversation-tool-setup` gates the whole `ui_surface` tool family on a
- * client being present (`return channelCapabilities?.supportsDynamicUi ??
- * !hasNoClient`). So `ui_show` is not merely denied in this turn, it is absent
- * from the tool set, and a retrospective told to call it can only report that
- * it cannot. This tool is an ordinary one and passes that gate untouched.
- *
  * **It records; it does not render.** The executor validates the payload and
  * returns, and nothing here writes to the conversation. What makes the card is
  * `watch-retro.ts` reading this call back out of the turn's own history once

package/src/types/host-capabilities.ts

@@ -16,6 +16,7 @@ export const HOST_PROXY_CAPABILITIES = [
   "host_file",
   "host_cu",
   "host_cu_window_capture",
+  "host_cu_sequence",
   "host_cu_annotate",
   "host_browser",
   "host_app_control",
@@ -24,11 +25,12 @@ export const HOST_PROXY_CAPABILITIES = [
 
 export type HostProxyCapability = (typeof HOST_PROXY_CAPABILITIES)[number];
 
-/** Every host capability except the three macOS-only ones. */
+/** Every host capability except the macOS-only ones. */
 const DESKTOP_SHARED_CAPABILITIES = HOST_PROXY_CAPABILITIES.filter(
   (capability) =>
     capability !== "host_app_control" &&
     capability !== "host_cu_window_capture" &&
+    capability !== "host_cu_sequence" &&
     capability !== "host_cu_annotate",
 );
 
@@ -47,8 +49,8 @@ export type HostProxyInterfaceId = "macos" | "windows" | "linux";
  * (web, ios, android, and every messaging transport) provide none.
  *
  * Windows and Linux run the same host proxy as macOS minus app control. The
- * two window-scoped CU capabilities ride the host_cu transport and are
- * negotiated per connection; only the macOS native helper answers them, so a
+ * negotiated CU capabilities ride the host_cu transport and are claimed per
+ * connection; only the macOS native helper answers them, so a
  * request elsewhere would reach that helper as an unknown action.
  *
  * macOS additionally provisions its `host_browser` proxy via the assistant

package/src/util/__tests__/language-subtag.test.ts

@@ -1,6 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
-import { baseLanguageSubtag, localizedOrDefault } from "../language-subtag.js";
+import {
+  baseLanguageSubtag,
+  fixedPhraseLanguage,
+  localizedOrDefault,
+} from "../language-subtag.js";
 
 describe("baseLanguageSubtag", () => {
   test("lowercases a bare tag", () => {
@@ -52,3 +56,21 @@ describe("localizedOrDefault", () => {
     expect(localizedOrDefault(table, "__proto__", "fallback")).toBe("fallback");
   });
 });
+
+describe("fixedPhraseLanguage", () => {
+  const table = { en: "one", es: "uno" };
+
+  test("pins English when the speaker's language has no table entry", () => {
+    expect(fixedPhraseLanguage(table, "ko")).toBe("en");
+    expect(fixedPhraseLanguage(table, "ar-EG")).toBe("en");
+  });
+
+  test("rides the speaker's language when the table covers it", () => {
+    expect(fixedPhraseLanguage(table, "es")).toBeUndefined();
+    expect(fixedPhraseLanguage(table, "es-419")).toBeUndefined();
+  });
+
+  test("carries no hint when the language is unknown", () => {
+    expect(fixedPhraseLanguage(table, undefined)).toBeUndefined();
+  });
+});

package/src/util/ca-bundle.ts

@@ -0,0 +1,13 @@
+import { readFile, writeFile } from "node:fs/promises";
+
+export async function writeCombinedCABundle(
+  systemBundlePath: string,
+  extraCAPath: string,
+  outputPath: string,
+): Promise<void> {
+  const [systemCAs, extraCAs] = await Promise.all([
+    readFile(systemBundlePath, "utf-8"),
+    readFile(extraCAPath, "utf-8"),
+  ]);
+  await writeFile(outputPath, `${systemCAs}\n${extraCAs}`, { mode: 0o644 });
+}

package/src/util/language-subtag.ts

@@ -41,3 +41,19 @@ export function localizedOrDefault<T>(
     ? (table[baseLanguageSubtag(language)!] as T)
     : fallback;
 }
+
+/**
+ * The TTS language hint for a fixed phrase picked from a localized table:
+ * "en" when the speaker has a language the table does not cover (the
+ * picker fell back to English text, which must not be synthesized under
+ * an ar/ko/ta hint), undefined otherwise (the phrase rides the speaker's
+ * language, or carries no hint at all when the language is unknown).
+ */
+export function fixedPhraseLanguage(
+  table: Readonly<Record<string, unknown>>,
+  language: string | undefined,
+): string | undefined {
+  return language !== undefined && !hasLocalizedEntry(table, language)
+    ? "en"
+    : undefined;
+}

package/src/util/platform.ts

@@ -470,6 +470,14 @@ export function getWorkspaceConfigPath(): string {
   return join(getWorkspaceDir(), "config.json");
 }
 
+/** Filename for the user-owned Agent Plugins MCP document. */
+export const WORKSPACE_MCP_FILENAME = "mcp.json";
+
+/** Returns $VELLUM_WORKSPACE_DIR/mcp.json */
+export function getWorkspaceMcpConfigPath(): string {
+  return join(getWorkspaceDir(), WORKSPACE_MCP_FILENAME);
+}
+
 /** Returns $VELLUM_WORKSPACE_DIR/skills */
 export function getWorkspaceSkillsDir(): string {
   return join(getWorkspaceDir(), "skills");

package/src/util/unicode.ts

@@ -126,6 +126,15 @@ export interface DeepSanitizeResult<T> {
   fixedStringCount: number;
 }
 
+export interface DeepSanitizeOptions {
+  /**
+   * Skip a plain-object property entirely: its value is neither scanned nor
+   * copied. For fields known to hold ASCII (base64 payloads), scanning is
+   * pure cost.
+   */
+  skipKey?: (key: string, parent: Record<string, unknown>) => boolean;
+}
+
 /**
  * Recursively walk arrays and plain objects, replacing orphaned surrogates in
  * every string value. Non-plain objects (class instances, Date, Buffer, Map,
@@ -136,8 +145,10 @@ export interface DeepSanitizeResult<T> {
  */
 export function stripOrphanedSurrogatesDeep<T>(
   input: T,
+  options: DeepSanitizeOptions = {},
 ): DeepSanitizeResult<T> {
   let fixedStringCount = 0;
+  const { skipKey } = options;
 
   const walk = (value: unknown): { value: unknown; changed: boolean } => {
     if (typeof value === "string") {
@@ -178,7 +189,10 @@ export function stripOrphanedSurrogatesDeep<T>(
       let next: Record<string, unknown> | null = null;
       for (let i = 0; i < keys.length; i++) {
         const key = keys[i]!;
-        const result = walk(source[key]);
+        const result =
+          skipKey?.(key, source) === true
+            ? { value: source[key], changed: false }
+            : walk(source[key]);
         if (result.changed && next === null) {
           next = {};
           for (let j = 0; j < i; j++) {

package/src/watch/watch-timeline.ts

@@ -366,8 +366,8 @@ export function appendNarration(
  * timeline of a session where observation stalled is simply a sparser one.
  *
  * The screenshot is stored only when `attachScreenshot` asks for it, and
- * carrying one is not asking. The host captures a screenshot on every observe
- * with no opt-out, so an observation always has pixels available and a policy
+ * carrying one is not asking. Watch requests a screenshot on every observe, so
+ * an observation normally has pixels available and a policy
  * of "store what arrives" is a policy of storing every frame. Which frames are
  * worth an image is a cadence decision, and it belongs to the caller driving
  * the session rather than to the row writer.

package/src/workflows/run-manager.ts

@@ -33,6 +33,7 @@ import type { TrustContext } from "../daemon/trust-context-types.js";
 import { wakeAgentForOpportunity } from "../runtime/agent-wake.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { getLogger } from "../util/logger.js";
+import { safeStringSlice } from "../util/unicode.js";
 import type { CapabilityManifest } from "./capabilities.js";
 import {
   normalizeCapabilityManifest,
@@ -611,7 +612,7 @@ function truncateForSummary(s: string, runId: string): string {
   }
   const omitted = s.length - MAX_SUMMARY_RESULT_CHARS;
   return (
-    `${s.slice(0, MAX_SUMMARY_RESULT_CHARS)}… ` +
+    `${safeStringSlice(s, 0, MAX_SUMMARY_RESULT_CHARS)}… ` +
     `[truncated ${omitted} chars — fetch the full result with manage_workflows ` +
     `{ action: "get_result", run_id: "${runId}" }]`
   );

package/src/workspace/git-porcelain.ts

@@ -0,0 +1,66 @@
+/**
+ * NUL-terminated `git status --porcelain -z` parsing.
+ *
+ * Status reporting and batched staging share this parser so rename/copy
+ * origin paths cannot drift between the two readers.
+ */
+
+export interface PorcelainEntry {
+  /** Two-character XY status from porcelain v1. */
+  status: string;
+  /** Path git reports for this record (the destination for rename/copy). */
+  path: string;
+  /** Pre-rename/copy path. Present when the record is a rename or copy. */
+  origin?: string;
+}
+
+/**
+ * Parse NUL-terminated `git status --porcelain -z` output into status/path
+ * records. NUL termination is required so paths with special characters
+ * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
+ *
+ * A rename/copy record is followed by a bare origin-path entry, captured on
+ * {@link PorcelainEntry.origin}.
+ */
+export function parsePorcelainZ(stdout: string): PorcelainEntry[] {
+  const entries = stdout.split("\0");
+  const parsed: PorcelainEntry[] = [];
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i] ?? "";
+    if (entry.length < 4) {
+      continue;
+    }
+    const status = entry.substring(0, 2);
+    const path = entry.substring(3);
+    if (status[0] === "R" || status[0] === "C") {
+      i++;
+      const origin = entries[i];
+      if (origin && origin.length > 0) {
+        parsed.push({ status, path, origin });
+        continue;
+      }
+    }
+    parsed.push({ status, path });
+  }
+  return parsed;
+}
+
+/**
+ * Every path git status knows about, including rename/copy origins.
+ * Origins still need to be staged so a deletion is not left behind when a
+ * rename is split across add batches.
+ */
+export function collectDirtyPathsFromPorcelain(stdout: string): string[] {
+  const paths: string[] = [];
+  const seen = new Set<string>();
+  for (const entry of parsePorcelainZ(stdout)) {
+    for (const path of [entry.path, entry.origin]) {
+      if (!path || seen.has(path)) {
+        continue;
+      }
+      seen.add(path);
+      paths.push(path);
+    }
+  }
+  return paths;
+}

package/src/workspace/git-service.ts

@@ -17,6 +17,10 @@ import { getLogger } from "../util/logger.js";
 import { Mutex } from "../util/mutex.js";
 import { addToPathEnv, getExtraToolPathDirs } from "../util/platform.js";
 import { PromiseGuard } from "../util/promise-guard.js";
+import {
+  collectDirtyPathsFromPorcelain,
+  parsePorcelainZ,
+} from "./git-porcelain.js";
 
 const execFileAsync = promisify(execFile);
 const log = getLogger("workspace-git");
@@ -51,7 +55,7 @@ function cleanGitEnv(workspaceDir: string): Record<string, string> {
  * Patterns excluded from workspace git tracking.
  * These are written to .gitignore on init and appended to existing .gitignore files.
  */
-const WORKSPACE_GITIGNORE_RULES = [
+export const WORKSPACE_GITIGNORE_RULES = [
   // Runtime state directories
   "data/db/",
   "data/qdrant/",
@@ -226,59 +230,6 @@ done
 exit 0
 `;
 
-/**
- * Parse NUL-terminated `git status --porcelain -z` output into status/path
- * pairs. NUL termination is required so paths with special characters
- * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
- * A rename/copy record is followed by a bare origin-path entry, which is
- * skipped.
- */
-function parsePorcelainZ(
-  stdout: string,
-): Array<{ status: string; path: string }> {
-  const entries = stdout.split("\0");
-  const parsed: Array<{ status: string; path: string }> = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    parsed.push({ status, path: entry.substring(3) });
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-    }
-  }
-  return parsed;
-}
-
-/**
- * Every path git status knows about, including rename/copy origins.
- * Origins are skipped by {@link parsePorcelainZ} (they have no status
- * prefix) but still need to be staged so a deletion is not left behind
- * when a rename is split across add batches.
- */
-function collectDirtyPathsFromPorcelain(stdout: string): string[] {
-  const entries = stdout.split("\0");
-  const paths: string[] = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    paths.push(entry.substring(3));
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-      const origin = entries[i];
-      if (origin && origin.length > 0) {
-        paths.push(origin);
-      }
-    }
-  }
-  return paths;
-}
-
 /** Properties added by Node's child_process errors. */
 interface ExecError extends Error {
   killed?: boolean;
@@ -433,7 +384,7 @@ export class WorkspaceGitService {
    *
    * This method is always called inside the mutex, so no git operation from
    * our code can be concurrently holding the lock. However, an external git
-   * process (user running `git add`, IDE tooling, etc.) could legitimately
+   * git process (user running `git add`, IDE tooling, etc.) could legitimately
    * hold the lock. We use `lsof` to check — if any process has the file
    * open, we leave it alone. If no process holds it, it's stale (crashed
    * process) and safe to remove.