@vellumai/assistant 0.12.2-staging.2 → 0.12.2-staging.4

package/src/runtime/routes/acp-routes.ts

@@ -24,7 +24,13 @@ import {
   AcpResumeError,
   AcpSessionNotFoundError,
 } from "../../acp/session-manager.js";
-import { type AcpSessionState, isLiveAcpStatus } from "../../acp/types.js";
+import {
+  type AcpSessionSnapshot,
+  listAcpSessionSnapshots,
+  snapshotHistoryRow,
+  withCurrentAuthMarkers,
+} from "../../acp/session-snapshot.js";
+import { isLiveAcpStatus } from "../../acp/types.js";
 import {
   AcpSessionModelUpdateEventSchema,
   type AssistantEvent,
@@ -103,11 +109,14 @@ type SessionEntry = z.infer<typeof sessionEntrySchema>;
  * client has no use for it and no way to resolve the other side of the
  * comparison, so serving it would only widen what leaves the daemon.
  */
-type MergedSession = SessionEntry & { authErrorCredential?: string };
+type MergedSession = AcpSessionSnapshot;
 
-/** Drop the comparison's own input before the session goes out on the wire. */
+/** Drop internal snapshot metadata before the session goes out on the wire. */
 function stripMarkerCredential({
-  authErrorCredential: _dropped,
+  authErrorCredential: _credential,
+  source: _source,
+  resumable: _resumable,
+  cwd: _cwd,
   ...session
 }: MergedSession): SessionEntry {
   return session;
@@ -511,7 +520,7 @@ async function listSessions({ queryParams }: RouteHandlerArgs) {
     return resolvedByAgent.get(agentId);
   };
 
-  const { sessions: merged, sawEveryHistoryRow } = listMergedSessions({
+  const { sessions: merged, sawEveryHistoryRow } = listAcpSessionSnapshots({
     limit,
     conversationId,
   });
@@ -552,43 +561,12 @@ async function listSessions({ queryParams }: RouteHandlerArgs) {
   return { sessions: [...page, stripMarkerCredential(marker)] };
 }
 
-/**
- * Blank the failure code on any session whose marker no longer describes the
- * credential its agent would resolve.
- *
- * This comparison is what retires a Connect card: not a sweep that has to run
- * at the right moment, but the marker no longer describing the credential in
- * use. Applied after merging rather than inside the query, so live sessions
- * and history rows are judged by exactly the same rule.
- *
- * Resolved per agent, because precedence is per agent: one alias can carry a
- * configured token while another falls through to the vault. Memoised across
- * the request, since a conversation's marked runs are nearly always one agent
- * and each resolution costs a vault read.
- */
 async function withCurrentMarkersOnly(
   sessions: MergedSession[],
   resolvedFor: (agentId: string) => Promise<string | undefined>,
 ): Promise<SessionEntry[]> {
-  const strip = stripMarkerCredential;
-  if (!sessions.some((s) => s.authErrorCode !== undefined)) {
-    return sessions.map(strip);
-  }
-  const judged: SessionEntry[] = [];
-  for (const session of sessions) {
-    if (session.authErrorCode === undefined) {
-      judged.push(strip(session));
-      continue;
-    }
-    const current = acpAuthMarkerStillCurrent(
-      session.authErrorCredential,
-      await resolvedFor(session.agentId),
-    );
-    judged.push(
-      strip(current ? session : { ...session, authErrorCode: undefined }),
-    );
-  }
-  return judged;
+  const judged = await withCurrentAuthMarkers(sessions, resolvedFor);
+  return judged.map(stripMarkerCredential);
 }
 
 function bulkDeleteSessions({ queryParams }: RouteHandlerArgs) {
@@ -879,128 +857,6 @@ function parseLimit(raw: string | null | undefined): number {
   return Math.min(Math.floor(n), MAX_SESSION_LIMIT);
 }
 
-function listMergedSessions(opts: { limit: number; conversationId?: string }): {
-  sessions: MergedSession[];
-  /**
-   * Whether the history query reached the end of this conversation's rows.
-   *
-   * A short read means there is nothing beyond what was returned, which is the
-   * proof that no marker is hiding outside the page.
-   */
-  sawEveryHistoryRow: boolean;
-} {
-  const manager = getAcpSessionManager();
-  const inMemory = manager.getStatus() as AcpSessionState[];
-
-  const merged = new Map<string, MergedSession>();
-  for (const s of inMemory) {
-    if (opts.conversationId && s.parentConversationId !== opts.conversationId) {
-      continue;
-    }
-    merged.set(s.id, {
-      id: s.id,
-      agentId: s.agentId,
-      acpSessionId: s.acpSessionId,
-      parentConversationId: s.parentConversationId,
-      status: s.status,
-      startedAt: s.startedAt,
-      completedAt: s.completedAt ?? null,
-      error: s.error ?? null,
-      stopReason: s.stopReason ?? null,
-      task: s.task,
-      parentToolUseId: s.parentToolUseId,
-      authErrorCode: s.authErrorCode,
-      authErrorCredential: s.authErrorCredential,
-      model: s.model,
-      availableModels: s.availableModels,
-      modelRevisionEpoch: s.modelRevisionEpoch,
-      modelRevision: s.modelRevision,
-      usedTokens: s.latestUsage?.usedTokens,
-      contextSize: s.latestUsage?.contextSize,
-      costAmount: s.latestUsage?.costAmount,
-      costCurrency: s.latestUsage?.costCurrency,
-      inputTokens: s.latestUsage?.inputTokens,
-      outputTokens: s.latestUsage?.outputTokens,
-      eventLog: manager.getBufferedUpdates(s.id),
-    });
-  }
-
-  const db = getDb();
-  const baseQuery = db.select().from(acpSessionHistory);
-  const filtered = opts.conversationId
-    ? baseQuery.where(
-        eq(acpSessionHistory.parentConversationId, opts.conversationId),
-      )
-    : baseQuery;
-  // Fetch only enough rows to fill the requested page after merging with
-  // in-memory sessions. In-memory entries take precedence on id collision,
-  // so we pad by the count that survived the conversation filter to
-  // guarantee we still surface `limit` distinct rows even when every
-  // in-memory session shadows a DB row — without over-fetching when many
-  // unrelated sessions are in memory.
-  const historyLimit = opts.limit + merged.size;
-  const historyRows = filtered
-    .orderBy(desc(acpSessionHistory.startedAt))
-    .limit(historyLimit)
-    .all();
-
-  for (const row of historyRows) {
-    if (merged.has(row.id)) {
-      continue;
-    }
-    merged.set(row.id, toMergedSession(row));
-  }
-
-  return {
-    sessions: Array.from(merged.values()).sort(
-      (a, b) => b.startedAt - a.startedAt,
-    ),
-    sawEveryHistoryRow: historyRows.length < historyLimit,
-  };
-}
-
-/** Shape a history row for the response, parsing its stored event log. */
-function toMergedSession(
-  row: typeof acpSessionHistory.$inferSelect,
-): MergedSession {
-  let eventLog: unknown[] = [];
-  try {
-    const parsed = JSON.parse(row.eventLogJson) as unknown;
-    if (Array.isArray(parsed)) {
-      eventLog = parsed;
-    }
-  } catch (err) {
-    log.warn(
-      { id: row.id, err },
-      "Failed to parse event_log_json for ACP session history row",
-    );
-  }
-  // Rows predating the usage migration carry NULLs for these columns and
-  // degrade to undefined.
-  return {
-    id: row.id,
-    agentId: row.agentId,
-    acpSessionId: row.acpSessionId,
-    parentConversationId: row.parentConversationId,
-    status: row.status,
-    startedAt: row.startedAt,
-    completedAt: row.completedAt,
-    error: row.error,
-    stopReason: row.stopReason,
-    task: row.task ?? undefined,
-    parentToolUseId: row.parentToolUseId ?? undefined,
-    authErrorCode: row.authErrorCode ?? undefined,
-    authErrorCredential: row.authErrorCredential ?? undefined,
-    usedTokens: row.usedTokens ?? undefined,
-    contextSize: row.contextSize ?? undefined,
-    costAmount: row.costAmount ?? undefined,
-    costCurrency: row.costCurrency ?? undefined,
-    inputTokens: row.inputTokens ?? undefined,
-    outputTokens: row.outputTokens ?? undefined,
-    eventLog,
-  };
-}
-
 /**
  * Reach past the page for the one marked run a client would restore the card
  * from, when the page itself holds none.
@@ -1061,7 +917,7 @@ async function findRecoveryMarker(
         .from(acpSessionHistory)
         .where(eq(acpSessionHistory.id, marker.id))
         .get();
-      return row ? toMergedSession(row) : undefined;
+      return row ? snapshotHistoryRow(row) : undefined;
     }
   }
   return undefined;

package/src/runtime/routes/browser-context.ts

@@ -0,0 +1,39 @@
+import { resolveTurnClientOs } from "../../daemon/conversation-client-surface.js";
+import { findConversation } from "../../daemon/conversation-registry.js";
+import type { ToolContext } from "../../tools/types.js";
+import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
+
+export function browserCliConversationKey(sessionId: string): string {
+  return `browser-cli:${sessionId}`;
+}
+
+export async function resolveBrowserContext(
+  conversationId: string | undefined,
+  sessionId: string,
+  headers: Record<string, string>,
+  abortSignal?: AbortSignal,
+): Promise<ToolContext> {
+  const conversation = conversationId
+    ? findConversation(conversationId)
+    : undefined;
+  const actor = await resolveActorPrincipalIdForLocalGuardian(
+    conversation?.getTurnActorPrincipalId() ??
+      headers["x-vellum-actor-principal-id"]?.trim(),
+  );
+  const signals = [abortSignal, conversation?.abortController?.signal].filter(
+    (signal): signal is AbortSignal => signal !== undefined,
+  );
+  return {
+    workingDir: process.cwd(),
+    conversationId: conversation
+      ? conversationId!
+      : browserCliConversationKey(sessionId),
+    trustClass: conversation?.trustContext?.trustClass ?? "unknown",
+    transportInterface: conversation?.transportInterface,
+    clientOs: conversation
+      ? resolveTurnClientOs(conversation).clientOs
+      : undefined,
+    sourceActorPrincipalId: actor,
+    signal: signals.length ? AbortSignal.any(signals) : undefined,
+  };
+}

package/src/runtime/routes/browser-routes.ts

@@ -16,10 +16,12 @@ import {
   BROWSER_OPERATIONS,
   type BrowserOperation,
 } from "../../browser/types.js";
-import { findConversation } from "../../daemon/conversation-registry.js";
+import { shouldUseVirtualDesktopBrowser } from "../../browser/virtual-desktop-target.js";
+import { executeDesktopBrowserOperation } from "../../desktop/desktop-browser-operations.js";
 import type { ContentBlock } from "../../providers/types.js";
 import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
-import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
+import { resolveBrowserContext } from "./browser-context.js";
+export { browserCliConversationKey } from "./browser-context.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Param validation ─────────────────────────────────────────────────
@@ -29,18 +31,9 @@ const BrowserExecuteParams = z.object({
   input: z.record(z.string(), z.unknown()).default({}),
   sessionId: z.string().min(1).default("default"),
   conversationId: z.string().min(1).optional(),
+  desktop: z.boolean().optional(),
 });
 
-// ── Conversation key ─────────────────────────────────────────────────
-
-/**
- * Build a deterministic conversation key from a session ID.
- * All CLI browser calls with the same session share browser state.
- */
-export function browserCliConversationKey(sessionId: string): string {
-  return `browser-cli:${sessionId}`;
-}
-
 // ── Screenshot extraction ────────────────────────────────────────────
 
 /**
@@ -70,45 +63,21 @@ function extractScreenshots(
 async function handleBrowserExecute({
   body = {},
   headers = {},
+  abortSignal,
 }: RouteHandlerArgs) {
-  const { operation, input, sessionId, conversationId } =
+  const { operation, input, sessionId, conversationId, desktop } =
     BrowserExecuteParams.parse(body);
 
-  // When the caller passes a live conversation ID (e.g. from
-  // __CONVERSATION_ID in a nested bash invocation), reuse that
-  // conversation's trust context and transport interface.
-  const conversation = conversationId
-    ? findConversation(conversationId)
-    : undefined;
-
-  const resolvedConversationId = conversation
-    ? conversationId!
-    : browserCliConversationKey(sessionId);
-
-  // Actor principal lets host-browser routing enforce same-actor ownership.
-  // A live conversation's turn actor owns the request (e.g. a nested-bash
-  // browser call inherits the conversation's actor), so it wins over the
-  // request header — which over IPC may carry a synthetic local-guardian id
-  // injected for header-less local callers. Resolve through the local-guardian
-  // translation so the value matches the actorPrincipalId host_browser clients
-  // register with (dev-bypass otherwise mismatches).
-  const headerActor =
-    headers["x-vellum-actor-principal-id"]?.trim() || undefined;
-  const sourceActorPrincipalId = await resolveActorPrincipalIdForLocalGuardian(
-    conversation?.getTurnActorPrincipalId() ?? headerActor,
-  );
-
-  const result = await executeBrowserOperation(
-    operation as BrowserOperation,
-    input,
-    {
-      workingDir: process.cwd(),
-      conversationId: resolvedConversationId,
-      trustClass: conversation?.trustContext?.trustClass ?? "unknown",
-      transportInterface: conversation?.transportInterface,
-      sourceActorPrincipalId,
-    },
+  const context = await resolveBrowserContext(
+    conversationId,
+    sessionId,
+    headers,
+    abortSignal,
   );
+  const execute = shouldUseVirtualDesktopBrowser(desktop, input, context)
+    ? executeDesktopBrowserOperation
+    : executeBrowserOperation;
+  const result = await execute(operation as BrowserOperation, input, context);
 
   const screenshots = extractScreenshots(result.contentBlocks);
 

package/src/runtime/routes/browser-tabs-routes.ts

@@ -2,22 +2,23 @@
  * Routes for browser tab management commands.
  *
  * Exposes `browser_tabs` so CLI commands can list, create, select, and
- * close browser tabs via the Chrome extension backend.
+ * close browser tabs in the Chrome extension or streamed desktop browser.
  */
 
 import { z } from "zod";
 
-import { findConversation } from "../../daemon/conversation-registry.js";
+import { shouldUseVirtualDesktopBrowser } from "../../browser/virtual-desktop-target.js";
 import { HostBrowserProxy } from "../../daemon/host-browser-proxy.js";
+import { executeDesktopBrowserTabs } from "../../desktop/desktop-browser-operations.js";
+import { normalizeBrowserMode } from "../../tools/browser/browser-mode.js";
 import { getCdpClient } from "../../tools/browser/cdp-client/factory.js";
 import {
   clearPinnedTab,
   clearPinnedTabByTabId,
   setPinnedTab,
 } from "../../tools/browser/pinned-tabs.js";
-import type { ToolContext } from "../../tools/types.js";
 import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
-import { browserCliConversationKey } from "./browser-routes.js";
+import { resolveBrowserContext } from "./browser-context.js";
 import { BadRequestError } from "./errors.js";
 import { parseBody } from "./parse-body.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -26,6 +27,8 @@ const BrowserTabsParams = z.object({
   command: z.enum(["list", "select", "new", "close"]),
   sessionId: z.string().min(1).default("default"),
   conversationId: z.string().min(1).optional(),
+  desktop: z.boolean().optional(),
+  browserMode: z.string().optional(),
   tabId: z.number().optional(),
   url: z.string().optional(),
   // Route tab operations to a specific extension client in multi-client
@@ -33,33 +36,73 @@ const BrowserTabsParams = z.object({
   targetClientId: z.string().min(1).optional(),
 });
 
-async function handleBrowserTabs({ body = {} }: RouteHandlerArgs) {
-  const { command, sessionId, conversationId, tabId, url, targetClientId } =
-    parseBody(BrowserTabsParams, body);
-
-  const conversation = conversationId
-    ? findConversation(conversationId)
-    : undefined;
-  const resolvedConversationId = conversation
-    ? conversationId!
-    : browserCliConversationKey(sessionId);
-
-  const context = {
-    workingDir: process.cwd(),
-    conversationId: resolvedConversationId,
-    trustClass: conversation?.trustContext?.trustClass ?? "unknown",
-    transportInterface: conversation?.transportInterface,
-  } as unknown as ToolContext;
+async function handleBrowserTabs({
+  body = {},
+  headers = {},
+  abortSignal,
+}: RouteHandlerArgs) {
+  const {
+    command,
+    sessionId,
+    conversationId,
+    tabId,
+    url,
+    targetClientId,
+    desktop,
+    browserMode,
+  } = parseBody(BrowserTabsParams, body);
 
-  const cdpOptions = { mode: "extension" as const, targetClientId };
+  const context = await resolveBrowserContext(
+    conversationId,
+    sessionId,
+    headers,
+    abortSignal,
+  );
+  const resolvedConversationId = context.conversationId;
+  const mode = normalizeBrowserMode(browserMode);
+  if ("error" in mode) {
+    throw new BadRequestError(mode.error);
+  }
+  if (
+    shouldUseVirtualDesktopBrowser(
+      desktop,
+      { browser_mode: browserMode, target_client_id: targetClientId },
+      context,
+    )
+  ) {
+    if (
+      targetClientId ||
+      (mode.mode !== "auto" && mode.mode !== "cdp-inspect")
+    ) {
+      throw new BadRequestError(
+        "--virtual-desktop cannot target a personal browser client",
+      );
+    }
+    const result = await executeDesktopBrowserTabs(
+      { command, tabId, url },
+      context,
+    );
+    if (result.isError) {
+      throw new BadRequestError(result.content);
+    }
+    return JSON.parse(result.content);
+  }
 
-  // Every tabs command pins extension mode. Absorb a brief extension SSE
-  // reconnect blip so a flapping connection doesn't surface as a hard
-  // "no Chrome Extension connected" error.
-  await HostBrowserProxy.instance.waitForExtensionClient(
-    context.sourceActorPrincipalId,
+  const cdpOptions = {
+    mode:
+      targetClientId || mode.mode === "auto"
+        ? ("extension" as const)
+        : mode.mode,
     targetClientId,
-  );
+  };
+
+  // Absorb brief reconnects before dispatching to the extension.
+  if (cdpOptions.mode === "extension") {
+    await HostBrowserProxy.instance.waitForExtensionClient(
+      context.sourceActorPrincipalId,
+      targetClientId,
+    );
+  }
 
   if (command === "list") {
     const cdp = getCdpClient(context, cdpOptions);
@@ -185,7 +228,7 @@ export const ROUTES: RouteDefinition[] = [
     handler: handleBrowserTabs,
     summary: "Manage browser tabs",
     description:
-      "List, create, select, or close browser tabs via the Chrome extension backend.",
+      "List, create, select, or close browser tabs in the Chrome extension or streamed desktop browser.",
     tags: ["browser"],
     requestBody: BrowserTabsParams,
     responseBody: z.object({

package/src/runtime/routes/desktop-setup-routes.test.ts

@@ -14,6 +14,7 @@ import { ROUTES } from "./desktop-setup-routes.js";
 import { NotFoundError } from "./errors.js";
 
 const originalContainerized = process.env.IS_CONTAINERIZED;
+const originalPlatform = process.env.IS_PLATFORM;
 const status = spyOn(desktopDependencyInstaller, "getStatus");
 const start = spyOn(desktopDependencyInstaller, "start");
 
@@ -24,6 +25,7 @@ afterAll(() => {
 
 beforeEach(() => {
   process.env.IS_CONTAINERIZED = "true";
+  process.env.IS_PLATFORM = "true";
   status.mockReturnValue({ state: "required" });
   start.mockReturnValue({ state: "installing", stage: "packages" });
 });
@@ -34,6 +36,11 @@ afterEach(() => {
   } else {
     process.env.IS_CONTAINERIZED = originalContainerized;
   }
+  if (originalPlatform === undefined) {
+    delete process.env.IS_PLATFORM;
+  } else {
+    process.env.IS_PLATFORM = originalPlatform;
+  }
   setOverridesForTesting({});
   status.mockClear();
   start.mockClear();
@@ -60,7 +67,15 @@ describe("desktop setup route feature gate", () => {
       expect(start).not.toHaveBeenCalled();
     });
 
-    test(`${route.method} serves setup only with the flag enabled in a container`, () => {
+    test(`${route.method} rejects self-hosted Docker assistants without inspecting or installing dependencies`, () => {
+      process.env.IS_PLATFORM = "false";
+      setOverridesForTesting({ "assistant-desktop": true });
+      expect(() => route.handler({})).toThrow(NotFoundError);
+      expect(status).not.toHaveBeenCalled();
+      expect(start).not.toHaveBeenCalled();
+    });
+
+    test(`${route.method} serves setup only for enabled platform containers`, () => {
       setOverridesForTesting({ "assistant-desktop": true });
       expect(route.handler({})).toEqual(
         route.method === "GET"

package/src/runtime/routes/desktop-setup-routes.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 
 import { getConfig } from "../../config/loader.js";
 import { desktopDependencyInstaller } from "../../desktop/desktop-dependencies.js";
-import { isAssistantDesktopEnabled } from "../../desktop/desktop-feature.js";
+import { isVirtualDesktopEnabled } from "../../desktop/virtual-desktop-feature.js";
 import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
@@ -19,8 +19,10 @@ export const ROUTES: RouteDefinition[] = ["GET", "POST"].map((method) => ({
   method,
   policy: { requiredScopes: [], allowedPrincipalTypes: GATEWAY_PRINCIPALS },
   handler: () => {
-    if (!isAssistantDesktopEnabled(getConfig())) {
-      throw new NotFoundError("Desktop is not available on this assistant");
+    if (!isVirtualDesktopEnabled(getConfig())) {
+      throw new NotFoundError(
+        "Virtual desktop is available only on enabled platform-hosted assistants",
+      );
     }
     return method === "GET"
       ? desktopDependencyInstaller.getStatus()
@@ -28,8 +30,8 @@ export const ROUTES: RouteDefinition[] = ["GET", "POST"].map((method) => ({
   },
   summary:
     method === "GET"
-      ? "Get desktop setup status"
-      : "Install desktop components",
+      ? "Get virtual desktop setup status"
+      : "Install virtual desktop components",
   tags: ["desktop"],
   responseBody: statusSchema,
 }));