@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/security/ces-http-record-backend.ts

@@ -0,0 +1,120 @@
+/**
+ * CES HTTP backend for non-secret credential records (identity + policy).
+ *
+ * Used when the CES RPC socket is down but the CES HTTP sidecar is
+ * reachable (containerized deployments with CES_CREDENTIAL_URL).
+ */
+
+import {
+  type CesHttpCredentialClient,
+  createCesHttpCredentialClient,
+} from "@vellumai/ces-client/http-credentials";
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
+
+import { getIsContainerized } from "../config/env-registry.js";
+import { getLogger } from "../util/logger.js";
+import type { CredentialRecordBackend } from "./ces-rpc-record-backend.js";
+
+const log = getLogger("ces-http-record-backend");
+
+type RecordHttpClient = Pick<
+  CesHttpCredentialClient,
+  | "getRecord"
+  | "setRecord"
+  | "deleteRecord"
+  | "listRecords"
+  | "bulkSetRecords"
+>;
+
+function resolveEnvHttpClient(): RecordHttpClient | undefined {
+  const baseUrl = process.env.CES_CREDENTIAL_URL?.trim();
+  const serviceToken = process.env.CES_SERVICE_TOKEN?.trim();
+  if (!baseUrl || !serviceToken) {
+    return undefined;
+  }
+  return createCesHttpCredentialClient({ baseUrl, serviceToken }, log);
+}
+
+export class CesHttpRecordBackend implements CredentialRecordBackend {
+  readonly name = "ces-http";
+
+  constructor(private readonly client?: RecordHttpClient) {}
+
+  private resolveClient(): RecordHttpClient | undefined {
+    return this.client ?? resolveEnvHttpClient();
+  }
+
+  isAvailable(): boolean {
+    return this.resolveClient() !== undefined;
+  }
+
+  async get(account: string): Promise<CredentialRecord | undefined> {
+    const client = this.resolveClient();
+    if (!client) {
+      return undefined;
+    }
+    const result = await client.getRecord(account);
+    return result.record;
+  }
+
+  async set(account: string, record: CredentialRecord): Promise<boolean> {
+    const client = this.resolveClient();
+    if (!client) {
+      return false;
+    }
+    return client.setRecord(account, record);
+  }
+
+  async delete(
+    account: string,
+  ): Promise<"deleted" | "not-found" | "error"> {
+    const client = this.resolveClient();
+    if (!client) {
+      return "error";
+    }
+    return client.deleteRecord(account);
+  }
+
+  async list(): Promise<Array<{
+    account: string;
+    record: CredentialRecord;
+  }> | null> {
+    const client = this.resolveClient();
+    if (!client) {
+      return null;
+    }
+    const result = await client.listRecords();
+    if (result.unreachable) {
+      return null;
+    }
+    return result.records ?? [];
+  }
+
+  async bulkSet(
+    records: Array<{ account: string; record: CredentialRecord }>,
+  ): Promise<Array<{ account: string; ok: boolean }>> {
+    const client = this.resolveClient();
+    if (!client) {
+      return records.map((entry) => ({ account: entry.account, ok: false }));
+    }
+    return client.bulkSetRecords(records);
+  }
+}
+
+/**
+ * CES HTTP record backend when the assistant is containerized and the
+ * CES HTTP sidecar URL is configured. Returns null otherwise.
+ */
+export function createCesHttpRecordBackendIfConfigured(): CredentialRecordBackend | null {
+  if (!getIsContainerized()) {
+    return null;
+  }
+  if (!process.env.CES_CREDENTIAL_URL?.trim()) {
+    return null;
+  }
+  const backend = new CesHttpRecordBackend();
+  if (!backend.isAvailable()) {
+    return null;
+  }
+  return backend;
+}

package/src/security/ces-rpc-record-backend.ts

@@ -11,6 +11,11 @@ import { getLogger } from "../util/logger.js";
 const log = getLogger("ces-rpc-record-backend");
 
 export interface CredentialRecordBackend {
+  /**
+   * Transport id. `"ces-rpc"` is the attached CES socket backend; live
+   * catalog listing fails over to CES HTTP when that transport is down.
+   */
+  readonly name?: string;
   isAvailable(): boolean;
   get(account: string): Promise<CredentialRecord | undefined>;
   set(account: string, record: CredentialRecord): Promise<boolean>;
@@ -29,6 +34,8 @@ export interface CredentialRecordBackend {
 }
 
 export class CesRpcRecordBackend implements CredentialRecordBackend {
+  readonly name = "ces-rpc";
+
   constructor(private readonly client: CesClient) {}
 
   isAvailable(): boolean {

package/src/security/untrusted-content.ts

@@ -11,6 +11,8 @@
  * 3. Enforces per-source character budgets to prevent context flooding.
  */
 
+import { safeStringSlice } from "../util/unicode.js";
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -156,7 +158,7 @@ export function escapeContentBoundaries(content: string): string {
 
 /** Sanitize a value for use as an XML attribute (no quotes, angle brackets, newlines). */
 function sanitizeAttr(value: string): string {
-  return value.replace(/[<>"&\r\n]/g, "").slice(0, 200);
+  return safeStringSlice(value.replace(/[<>"&\r\n]/g, ""), 0, 200);
 }
 
 function parseExternalContentAttributes(

package/src/skills/__tests__/workspace-skill-md-signature.test.ts

@@ -0,0 +1,60 @@
+import { mkdirSync, mkdtempSync, rmSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { readWorkspaceSkillMdSignature } from "../workspace-skill-md-signature.js";
+
+const ROOT = mkdtempSync(join(tmpdir(), "skill-md-signature-"));
+
+afterEach(() => {
+  rmSync(ROOT, { recursive: true, force: true });
+  mkdirSync(ROOT, { recursive: true });
+});
+
+function writeSkill(id: string, body = "body"): string {
+  const dir = join(ROOT, id);
+  mkdirSync(dir, { recursive: true });
+  const skillMd = join(dir, "SKILL.md");
+  writeFileSync(skillMd, `---\nname: ${id}\ndescription: ${id}\n---\n${body}\n`);
+  return skillMd;
+}
+
+describe("readWorkspaceSkillMdSignature", () => {
+  test("empty or missing skills dir is the empty signature", () => {
+    expect(readWorkspaceSkillMdSignature(join(ROOT, "missing"))).toBe("");
+    mkdirSync(ROOT, { recursive: true });
+    expect(readWorkspaceSkillMdSignature(ROOT)).toBe("");
+  });
+
+  test("includes SKILL.md mtimes and ignores TOOLS.json", () => {
+    const skillMd = writeSkill("alpha");
+    const first = readWorkspaceSkillMdSignature(ROOT);
+    expect(first).toMatch(/^alpha:\d+$/);
+
+    writeFileSync(join(ROOT, "alpha", "TOOLS.json"), '{"version":1,"tools":[]}');
+    expect(readWorkspaceSkillMdSignature(ROOT)).toBe(first);
+
+    const later = new Date(Date.now() + 5_000);
+    utimesSync(skillMd, later, later);
+    expect(readWorkspaceSkillMdSignature(ROOT)).not.toBe(first);
+  });
+
+  test("add and remove skill directories change the signature", () => {
+    writeSkill("alpha");
+    const one = readWorkspaceSkillMdSignature(ROOT);
+    writeSkill("bravo");
+    const two = readWorkspaceSkillMdSignature(ROOT);
+    expect(two).not.toBe(one);
+    expect(two.split("\n")).toHaveLength(2);
+
+    rmSync(join(ROOT, "bravo"), { recursive: true, force: true });
+    expect(readWorkspaceSkillMdSignature(ROOT)).toBe(one);
+  });
+
+  test("directories without SKILL.md are omitted", () => {
+    mkdirSync(join(ROOT, "not-a-skill"), { recursive: true });
+    writeFileSync(join(ROOT, "README.md"), "nope");
+    expect(readWorkspaceSkillMdSignature(ROOT)).toBe("");
+  });
+});

package/src/skills/workspace-skill-md-signature.ts

@@ -0,0 +1,50 @@
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+import { getWorkspaceSkillsDir } from "../util/platform.js";
+
+/**
+ * Cheap change detector for workspace skill capability cards: the sorted set
+ * of immediate skill directories that contain a top-level `SKILL.md`, each
+ * paired with that file's mtime. Capability cards are frontmatter fields from
+ * `SKILL.md`. Body files, `TOOLS.json`, scripts, and `references/` are not part
+ * of this signature.
+ *
+ * Listing the skills directory (not only statting known paths) is what makes
+ * install and delete visible: a new or removed skill directory changes the
+ * signature even when no previously known `SKILL.md` mtime moved.
+ */
+export function readWorkspaceSkillMdSignature(
+  skillsDir: string = getWorkspaceSkillsDir(),
+): string {
+  if (!existsSync(skillsDir)) {
+    return "";
+  }
+
+  let entries;
+  try {
+    entries = readdirSync(skillsDir, { withFileTypes: true });
+  } catch {
+    return "";
+  }
+
+  const parts: string[] = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() && !entry.isSymbolicLink()) {
+      continue;
+    }
+    const skillMdPath = join(skillsDir, entry.name, "SKILL.md");
+    try {
+      const st = statSync(skillMdPath);
+      if (!st.isFile()) {
+        continue;
+      }
+      parts.push(`${entry.name}:${Math.trunc(st.mtimeMs)}`);
+    } catch {
+      // No readable SKILL.md: not a catalog skill.
+    }
+  }
+
+  parts.sort();
+  return parts.join("\n");
+}

package/src/subagent/consult-context.ts

@@ -33,7 +33,6 @@
 import { readdir } from "node:fs/promises";
 import { join } from "node:path";
 
-import type { SkillSummary } from "../config/skills.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 import { truncate as truncateText } from "../util/truncate.js";
@@ -56,15 +55,6 @@ export interface AdvisorContextSources {
    * from the catalog section, mirroring the `skill_load` gate.
    */
   enabledPluginSet?: ReadonlySet<string> | null;
-  /**
-   * Pre-resolved skill catalog, typically the parent conversation's warm
-   * `skillProjectionCache.catalog`. Passing it keeps the synchronous on-disk
-   * catalog scan out of the consult path (and matches the catalog view the
-   * parent turn's tool projection used). When absent, the section falls back
-   * to a fresh `loadSkillCatalog()` scan, the same call every agent turn's
-   * projection already makes.
-   */
-  skillCatalog?: readonly SkillSummary[];
 }
 
 /** Cap a block so the assembled context never balloons the consult prompt. */
@@ -114,7 +104,6 @@ async function buildToolsSection(
  */
 async function buildSkillsSection(
   enabledPluginSet: ReadonlySet<string> | null | undefined,
-  preResolvedCatalog: readonly SkillSummary[] | undefined,
 ): Promise<string | null> {
   try {
     const [
@@ -130,19 +119,17 @@ async function buildSkillsSection(
     ]);
     const config = getConfig();
     const pluginScope = enabledPluginSet ?? null;
-    const catalog = (preResolvedCatalog ?? loadSkillCatalog()).filter(
-      (skill) => {
-        if (
-          pluginScope !== null &&
-          skill.owner?.kind === "plugin" &&
-          !pluginScope.has(skill.owner.id)
-        ) {
-          return false;
-        }
-        const flagKey = skillFlagKey(skill);
-        return !flagKey || isAssistantFeatureFlagEnabled(flagKey, config);
-      },
-    );
+    const catalog = loadSkillCatalog().filter((skill) => {
+      if (
+        pluginScope !== null &&
+        skill.owner?.kind === "plugin" &&
+        !pluginScope.has(skill.owner.id)
+      ) {
+        return false;
+      }
+      const flagKey = skillFlagKey(skill);
+      return !flagKey || isAssistantFeatureFlagEnabled(flagKey, config);
+    });
     if (catalog.length === 0) {
       return null;
     }
@@ -384,7 +371,7 @@ export async function buildAdvisorContext(
   const sections = await Promise.all(
     [
       buildToolsSection(sources.allowedToolNames),
-      buildSkillsSection(sources.enabledPluginSet, sources.skillCatalog),
+      buildSkillsSection(sources.enabledPluginSet),
       buildWorkspaceSection(sources),
     ].map((section) => withSectionTimeout(section, sectionTimeoutMs)),
   );

package/src/tools/__tests__/side-effect-abort-guard.test.ts

@@ -158,6 +158,7 @@ const SKILL_TOOLS: GuardedTool[] = [
   proxied("computer_use_drag"),
   proxied("computer_use_open_app"),
   proxied("computer_use_run_applescript"),
+  proxied("computer_use_sequence"),
   proxied("computer_use_respond"),
 
   { name: "contact_merge", input: { keep_id: "c-1", merge_id: "c-2" } },

package/src/tools/acp/list-agents.test.ts

@@ -90,7 +90,9 @@ describe("executeAcpListAgents", () => {
     const codex = parsed.agents.find((a: { id: string }) => a.id === "codex");
     expect(codex.available).toBe(false);
     expect(codex.unavailableReason).toBe("'codex-acp' is not on PATH");
-    expect(codex.setupHint).toBe("bun add -g @agentclientprotocol/codex-acp");
+    expect(codex.setupHint).toBe(
+      "bun add -g @agentclientprotocol/codex-acp@1.10.0",
+    );
 
     const claude = parsed.agents.find((a: { id: string }) => a.id === "claude");
     expect(claude.available).toBe(true);

package/src/tools/acp/spawn.test.ts

@@ -124,11 +124,22 @@ const spawnMock = mock(
     _cwd: string,
     _parentConversationId: string,
     _sendToVellum: (msg: unknown) => void,
-    _parentToolUseId?: string,
-  ) => ({
-    acpSessionId: "acp-session-test",
-    protocolSessionId: "proto-session-test",
-  }),
+    _options?: { parentToolUseId?: string; model?: string },
+  ): Promise<{
+    acpSessionId: string;
+    protocolSessionId: string;
+    requestedModel?: string;
+    effectiveModel?: string;
+    modelWarning?: string;
+  }> => {
+    const requestedModel = _options?.model?.trim() || undefined;
+    return {
+      acpSessionId: "acp-session-test",
+      protocolSessionId: "proto-session-test",
+      requestedModel,
+      effectiveModel: "opus",
+    };
+  },
 );
 
 // Spread the real module's exports so transitive importers that pull other
@@ -201,6 +212,8 @@ describe("executeAcpSpawn - happy path", () => {
     const payload = JSON.parse(result.content);
     expect(payload.acpSessionId).toBe("acp-session-test");
     expect(payload.status).toBe("running");
+    expect(payload.requestedModel).toBeNull();
+    expect(payload.effectiveModel).toBe("opus");
     // The real adapter binary is spawned (no `bun x` wrapper).
     const agentConfigArg = spawnMock.mock.calls[0][1] as { command: string };
     expect(agentConfigArg.command).toBe("claude-agent-acp");
@@ -214,8 +227,10 @@ describe("executeAcpSpawn - happy path", () => {
 
     expect(result.isError).toBe(false);
     expect(spawnMock).toHaveBeenCalledTimes(1);
-    // parentToolUseId is the 7th positional arg to spawn().
-    expect(spawnMock.mock.calls[0][6]).toBe("toolu_abc123");
+    // The options bag is the 7th positional arg to spawn().
+    expect(spawnMock.mock.calls[0][6]).toEqual({
+      parentToolUseId: "toolu_abc123",
+    });
   });
 
   test("default-profile fallback when user config is empty", async () => {
@@ -272,7 +287,7 @@ describe("executeAcpSpawn — input validation", () => {
     expect(result.isError).toBe(true);
     expect(result.content).toContain("claude-agent-acp is not on PATH");
     expect(result.content).toContain(
-      "bun add -g @agentclientprotocol/claude-agent-acp",
+      "bun add -g @agentclientprotocol/claude-agent-acp@0.75.1",
     );
     expect(execFileMock).not.toHaveBeenCalled();
     expect(spawnMock).not.toHaveBeenCalled();
@@ -309,7 +324,7 @@ describe("executeAcpSpawn: sandboxed bun auto-install on missing binary", () =>
     expect(spawnMock).toHaveBeenCalledTimes(1);
     const payload = JSON.parse(result.content);
     expect(payload.message).toContain(
-      "Installed @agentclientprotocol/claude-agent-acp automatically.",
+      "Installed @agentclientprotocol/claude-agent-acp@0.75.1 automatically.",
     );
     // The real binary was spawned with cwd = the project dir and token
     // injected (trusted-binary config, no resolution at spawn).
@@ -330,7 +345,7 @@ describe("executeAcpSpawn: sandboxed bun auto-install on missing binary", () =>
     expect(args).toEqual([
       "add",
       "--global",
-      "@agentclientprotocol/claude-agent-acp",
+      "@agentclientprotocol/claude-agent-acp@0.75.1",
     ]);
   });
 
@@ -419,7 +434,7 @@ describe("executeAcpSpawn: sandboxed bun auto-install on missing binary", () =>
     expect(result.isError).toBe(true);
     expect(result.content).toContain("claude-agent-acp is not on PATH");
     expect(result.content).toContain(
-      "bun add -g @agentclientprotocol/claude-agent-acp",
+      "bun add -g @agentclientprotocol/claude-agent-acp@0.75.1",
     );
     expect(result.content).toContain("auto-install failed");
     expect(result.content).toContain("EACCES");
@@ -458,6 +473,126 @@ describe("executeAcpSpawn — per-agent resume hint", () => {
   });
 });
 
+describe("executeAcpSpawn - model selection", () => {
+  test("threads the requested model into manager.spawn's options", async () => {
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: "opus" },
+      { ...makeContext(), toolUseId: "toolu_model" },
+    );
+
+    expect(result.isError).toBe(false);
+    expect(spawnMock.mock.calls[0][6]).toEqual({
+      parentToolUseId: "toolu_model",
+      model: "opus",
+    });
+    const payload = JSON.parse(result.content);
+    expect(payload.requestedModel).toBe("opus");
+    expect(payload.effectiveModel).toBe("opus");
+    expect(payload.message).toContain(
+      'The top-level ACP session reports "opus" as its effective model.',
+    );
+  });
+
+  test("reports the manager-normalized requested model", async () => {
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: "  opus  " },
+      makeContext(),
+    );
+
+    expect(spawnMock.mock.calls[0][6]).toEqual({
+      parentToolUseId: undefined,
+      model: "  opus  ",
+    });
+    expect(JSON.parse(result.content).requestedModel).toBe("opus");
+  });
+
+  test("a null model is treated as omitted", async () => {
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: null },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    const options = spawnMock.mock.calls[0][6] as { model?: string };
+    expect(options.model).toBeUndefined();
+  });
+
+  test("a modelWarning from the spawn is relayed in the result message", async () => {
+    spawnMock.mockImplementationOnce(async () => ({
+      acpSessionId: "acp-session-test",
+      protocolSessionId: "proto-session-test",
+      requestedModel: "nope",
+      effectiveModel: "opus",
+      modelWarning: "Unknown model: nope",
+    }));
+
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: "nope" },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    const payload = JSON.parse(result.content);
+    expect(payload.message).toContain(
+      "The requested model was not applied: Unknown model: nope",
+    );
+    expect(payload.requestedModel).toBe("nope");
+    expect(payload.effectiveModel).toBe("opus");
+  });
+
+  test("the note relays a no-selector warning without calling it a refusal", async () => {
+    spawnMock.mockImplementationOnce(async () => ({
+      acpSessionId: "acp-session-test",
+      protocolSessionId: "proto-session-test",
+      requestedModel: "opus",
+      modelWarning:
+        'Agent "claude" does not support model selection, so the session is running on the agent\'s own model.',
+    }));
+
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: "opus" },
+      makeContext(),
+    );
+
+    const payload = JSON.parse(result.content);
+    expect(payload.message).toContain("does not support model selection");
+    expect(payload.message).not.toContain("refused");
+  });
+
+  test("no model note when the spawn reports no warning", async () => {
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: "opus" },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    const payload = JSON.parse(result.content);
+    expect(payload.message).not.toContain(
+      "The requested model was not applied",
+    );
+  });
+
+  test("reports when the adapter does not identify the effective model", async () => {
+    spawnMock.mockImplementationOnce(async () => ({
+      acpSessionId: "acp-session-test",
+      protocolSessionId: "proto-session-test",
+      requestedModel: "sonnet",
+    }));
+
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something", model: "sonnet" },
+      makeContext(),
+    );
+
+    const payload = JSON.parse(result.content);
+    expect(payload.requestedModel).toBe("sonnet");
+    expect(payload.effectiveModel).toBeNull();
+    expect(payload.message).toContain(
+      "The top-level ACP session did not report an effective model.",
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // executeAcpSpawn — CLAUDE_CODE_OAUTH_TOKEN env injection + preflight
 //

package/src/tools/acp/spawn.ts

@@ -37,6 +37,7 @@ export const acpSpawnInputSchema = z.looseObject({
   agent: nullAsOmitted(z.string()),
   task: nullAsOmitted(z.string()),
   cwd: nullAsOmitted(z.string()),
+  model: nullAsOmitted(z.string()),
 });
 
 /**
@@ -66,6 +67,7 @@ export async function executeAcpSpawn(
   }
   const agent = parsedInput.data.agent || "claude";
   const task = parsedInput.data.task;
+  const model = parsedInput.data.model;
 
   if (!task) {
     return { content: '"task" is required.', isError: true };
@@ -124,14 +126,20 @@ export async function executeAcpSpawn(
     // Recheck: the auto-install and the agent-env preparation above are both
     // awaits, and this is the point a long-lived subprocess starts.
     throwIfCancelled(context);
-    const { acpSessionId, protocolSessionId } = await manager.spawn(
+    const {
+      acpSessionId,
+      protocolSessionId,
+      requestedModel,
+      effectiveModel,
+      modelWarning,
+    } = await manager.spawn(
       agent,
       agentConfig,
       task,
       cwd,
       context.conversationId,
       sendToClient,
-      context.toolUseId,
+      { parentToolUseId: context.toolUseId, model },
       // The manager rechecks after its own protocol handshake and session
       // creation, so a turn stopped in that window tears the child process
       // down instead of handing it the task.
@@ -150,16 +158,26 @@ export async function executeAcpSpawn(
     const installNote = autoInstalledPackage
       ? ` Installed ${autoInstalledPackage} automatically.`
       : "";
+    // Relayed verbatim: the warning already distinguishes an adapter with no
+    // selector from one that refused the value.
+    const modelNote = modelWarning
+      ? ` The requested model was not applied: ${modelWarning}`
+      : "";
+    const effectiveModelNote = effectiveModel
+      ? ` The top-level ACP session reports "${effectiveModel}" as its effective model.`
+      : " The top-level ACP session did not report an effective model.";
     const payload = JSON.stringify({
       acpSessionId,
       protocolSessionId,
       agent,
       cwd,
+      requestedModel: requestedModel ?? null,
+      effectiveModel: effectiveModel ?? null,
       status: "running",
       message:
         `ACP agent "${agent}" spawned (session: ${protocolSessionId}). ` +
         `Results stream back via SSE. You will be notified when it completes.` +
-        `${installNote}${resumeHint}`,
+        `${installNote}${modelNote}${effectiveModelNote}${resumeHint}`,
     });
 
     return { content: payload, isError: false };