@vellumai/assistant 0.12.2 → 0.12.3-staging.2

package/src/daemon/host-cu-proxy.ts

@@ -13,7 +13,6 @@
  * RPC lifecycle (resolve/reject/timer/detachAbort) is stored in
  * pendingInteractions alongside routing metadata.
  */
-
 import { v4 as uuid } from "uuid";
 
 import { loadConfig } from "../config/loader.js";
@@ -30,6 +29,7 @@ import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 import { resolveHostCuTarget } from "./host-cu-target.js";
+import { bestEffortModeSessionTracking } from "./mode-session-tracking.js";
 
 const log = getLogger("host-cu-proxy");
 
@@ -161,27 +161,14 @@ function isNoDiffKeyAction(action: ActionIdentity | undefined): boolean {
   );
 }
 
-/**
- * Canonical signature for loop detection. Key presses collapse equivalent
- * spellings (`cmd+a`, `command+a`, `cmd + a`) of the same combo so a stuck
- * session retrying it with alias/whitespace variants is still caught —
- * important now that exempt keys no longer emit no-effect warnings. Only the
- * `key` value is normalized; all other input fields (e.g. the routing
- * `target_client_id`) are preserved, so the same combo sent to different
- * desktop clients is not mistaken for a repeat.
- */
+/** Normalize key aliases and ignore observation tokens when detecting repeats. */
 function actionSignature(record: ActionRecord): string {
-  if (
-    record.toolName === "computer_use_key" &&
-    typeof record.input.key === "string"
-  ) {
-    const normalizedInput = {
-      ...record.input,
-      key: canonicalizeKeyCombo(record.input.key),
-    };
-    return `computer_use_key:${JSON.stringify(normalizedInput)}`;
+  const input = { ...record.input };
+  delete input.observation_id;
+  if (record.toolName === "computer_use_key" && typeof input.key === "string") {
+    input.key = canonicalizeKeyCombo(input.key);
   }
-  return `${record.toolName}:${JSON.stringify(record.input)}`;
+  return `${record.toolName}:${JSON.stringify(input)}`;
 }
 
 /**
@@ -223,6 +210,8 @@ function clientAdvertises(
 // ---------------------------------------------------------------------------
 
 export class HostCuProxy {
+  /** Stable identity for this conversation-owned proxy instance. */
+  private readonly _sourceId = uuid();
   // CU state tracking (per-conversation)
   private _stepCount = 0;
   private _maxSteps: number;
@@ -294,6 +283,14 @@ export class HostCuProxy {
     return this._actionHistory;
   }
 
+  get sourceId(): string {
+    return this._sourceId;
+  }
+
+  get resetGeneration(): number {
+    return this._resetGeneration;
+  }
+
   // ---------------------------------------------------------------------------
   // Availability
   // ---------------------------------------------------------------------------
@@ -328,6 +325,7 @@ export class HostCuProxy {
     signal?: AbortSignal,
     targetClientId?: string,
     sourceActorPrincipalId?: string,
+    onValidatedDispatch?: () => void,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
       return Promise.resolve({
@@ -399,6 +397,9 @@ export class HostCuProxy {
         isError: true,
       });
     }
+    bestEffortModeSessionTracking("computer admission", () =>
+      onValidatedDispatch?.(),
+    );
     const scopedObservation = hasCaptureTarget(input);
     if (scopedObservation) {
       this._previousAXTree = undefined;
@@ -597,6 +598,30 @@ export class HostCuProxy {
     return result;
   }
 
+  /** Run a screenshot-only backend through the shared CU budget and formatter. */
+  async executeLocal(
+    toolName: string,
+    input: Record<string, unknown>,
+    execute: () => Promise<CuObservationResult>,
+  ): Promise<ToolExecutionResult> {
+    if (this._stepCount >= this._maxSteps) {
+      return {
+        content: `Step limit (${this._maxSteps}) exceeded. Call computer_use_done to finish.`,
+        isError: true,
+      };
+    }
+    const reasoning =
+      typeof input.reasoning === "string" ? input.reasoning : undefined;
+    this.recordAction(toolName, input, reasoning);
+    this._previousAXTree = undefined;
+    this._consecutiveUnchangedSteps = 0;
+    const observation = await execute();
+    return this.formatObservation(observation, undefined, false, {
+      toolName,
+      input,
+    });
+  }
+
   // ---------------------------------------------------------------------------
   // CU state management
   // ---------------------------------------------------------------------------
@@ -629,7 +654,8 @@ export class HostCuProxy {
    * stopping and puts the pointer back where the user left it, instead of
    * waiting out its idle fallback.
    */
-  endTask(conversationId: string): void {
+  endTask(conversationId: string): number {
+    const endedGeneration = this._resetGeneration;
     for (const targetClientId of this._dispatchedTargets.values()) {
       try {
         broadcastMessage(
@@ -647,10 +673,12 @@ export class HostCuProxy {
       }
     }
     this.reset();
+    return endedGeneration;
   }
 
   /** Reset all CU state. Called on terminal tools (computer_use_done, etc.). */
-  reset(): void {
+  reset(): number {
+    const endedGeneration = this._resetGeneration;
     this._dispatchedTargets.clear();
     this._stepCount = 0;
     this._previousAXTree = undefined;
@@ -658,6 +686,7 @@ export class HostCuProxy {
     this._actionHistory = [];
     this._observedTargets.clear();
     this._resetGeneration++;
+    return endedGeneration;
   }
 
   /**

package/src/daemon/lifecycle.ts

@@ -77,7 +77,6 @@ import { writePid } from "./daemon-control.js";
 import {
   setDbMigrating,
   setDbMigrationFailed,
-  setDbReady,
   setStartupComplete,
 } from "./daemon-readiness.js";
 import { startDiskPressureGuardForLifecycle } from "./disk-pressure-guard-lifecycle.js";
@@ -91,6 +90,7 @@ import {
   reconcileInterruptedConversations,
   resumeInterruptedConversations,
 } from "./interrupted-turn-reconciler.js";
+import { recoverModeSessionsBeforeDbReady } from "./mode-session-startup-recovery.js";
 import { startOrphanReaper } from "./orphan-reaper.js";
 import { runProfilerSweep } from "./profiler-run-store.js";
 import {
@@ -290,22 +290,39 @@ export async function runDaemon(): Promise<void> {
         "stream seq floor from persisted anchors failed — continuing startup",
       );
     }
+    const migrationFailureDetails = {
+      failedMigrations: initResult.failedMigrations,
+      deferredMigrations: initResult.deferredMigrations,
+      validationError: initResult.validationError,
+    };
+    const modeSessionRecovery = migrationsOk
+      ? recoverModeSessionsBeforeDbReady()
+      : null;
+    if (modeSessionRecovery?.ok && modeSessionRecovery.interruptedCount > 0) {
+      log.info(
+        { interruptedModeSessions: modeSessionRecovery.interruptedCount },
+        "Recovered active mode sessions as interrupted",
+      );
+    }
+    if (modeSessionRecovery && !modeSessionRecovery.ok) {
+      log.error(
+        { err: modeSessionRecovery.error },
+        "Mode session recovery failed; tracking is unavailable for this boot",
+      );
+    }
     if (migrationsOk) {
-      setDbReady(true);
       log.info("Daemon startup: DB initialized");
     } else {
-      setDbMigrationFailed(undefined, {
-        failedMigrations: initResult.failedMigrations,
-        deferredMigrations: initResult.deferredMigrations,
-        validationError: initResult.validationError,
-      });
+      setDbMigrationFailed(undefined, migrationFailureDetails);
+    }
+    if (!migrationsOk) {
       log.error(
         {
           failedMigrations: initResult.failedMigrations,
           deferredMigrations: initResult.deferredMigrations,
           validationError: initResult.validationError,
         },
-        "Daemon startup: DB opened but one or more migrations failed or were deferred — /readyz will remain unready",
+        "Daemon startup: DB migrations failed; /readyz will remain unready",
       );
     }
     // Migrations have settled (successfully or in the failed degraded mode),
@@ -673,11 +690,11 @@ export async function runDaemon(): Promise<void> {
   // blocked.
   startConsentRefresh();
 
-  // Bring up the daemon's CES connection (process + handshake + reconnect
-  // wiring). Blocks up to a 20s timeout so credential reads route through CES
-  // before provider init; non-fatal — falls back to the direct credential store
-  // on failure. The sidecar accepts exactly one bootstrap connection, so this
-  // happens at the process level.
+  // Open the assistant's CES RPC client (handshake + reconnect wiring).
+  // Blocks up to a 20s timeout so credential reads route through CES before
+  // provider init; non-fatal, falls back to the direct credential store on
+  // failure. CES serves a multi-connection bootstrap socket, so child
+  // processes can open the same `openCesRpcSession` path independently.
   await startCes(config);
 
   // Bring up the plugin layer: install the runtime bridge, register the

package/src/daemon/mcp-reload-service.ts

@@ -116,7 +116,7 @@ async function doReload(): Promise<McpReloadResult> {
     const servers: McpReloadServerResult[] = [];
 
     if (serverIds.length > 0) {
-      const serverToolInfos = await manager.start(mcpConfig);
+      const { servers: serverToolInfos } = await manager.start(mcpConfig);
       for (const { serverId, serverConfig, tools } of serverToolInfos) {
         const mcpTools = createMcpToolsFromServer(
           tools,

package/src/daemon/message-protocol.ts

@@ -18,7 +18,6 @@ export * from "./message-types/shared.js";
 export * from "./message-types/skills.js";
 export * from "./message-types/surfaces.js";
 export * from "./message-types/sync.js";
-export * from "./message-types/web-activity.js";
 
 // Client-message domain aliases for the ClientMessage union.
 import type { _ComputerUseClientMessages } from "./message-types/computer-use.js";

package/src/daemon/message-provenance.ts

@@ -8,14 +8,19 @@
  * actor filters the history down to rows whose provenance is itself
  * non-guardian.
  *
- * This lives in its own low-dependency module (types plus the zod-only
- * trust-class leaf) so both the conversation lifecycle (history load) and the
+ * This lives in its own low-dependency module (types plus the gateway-client
+ * trust-class contract) so both the conversation lifecycle (history load) and the
  * context compactor (image manifest) can apply the identical filter without
  * creating an import cycle through `conversation-lifecycle` ↔
  * `window-manager` ↔ `compactor`.
+ *
+ * It also owns the author field (`actorAuthorProvenance`), which says who
+ * wrote a row rather than whose turn wrote it.
  */
+import { type TrustClass, TrustClassSchema } from "@vellumai/gateway-client";
+
 import type { MessageRow } from "../persistence/conversation-crud.js";
-import { type TrustClass, trustClassSchema } from "../runtime/trust-class.js";
+import type { TrustContext } from "./trust-context-types.js";
 
 export function parseProvenanceTrustClass(
   metadata: string | null,
@@ -25,7 +30,7 @@ export function parseProvenanceTrustClass(
   }
   try {
     const parsed = JSON.parse(metadata) as { provenanceTrustClass?: unknown };
-    const result = trustClassSchema.safeParse(parsed?.provenanceTrustClass);
+    const result = TrustClassSchema.safeParse(parsed?.provenanceTrustClass);
     if (result.success) {
       return result.data;
     }
@@ -56,3 +61,22 @@ export function filterMessagesForUntrustedActor(
 ): MessageRow[] {
   return messages.filter((m) => isRowVisibleToUntrustedActor(m.metadata));
 }
+
+/** The persisted author field: the contact who wrote the row. */
+export interface ActorAuthorProvenance {
+  provenanceContactId?: string;
+}
+
+/**
+ * Author fields for a row the trust context's actor wrote themselves: their
+ * own message or reaction. `provenanceFromTrustContext` describes the turn and
+ * is also stamped on the assistant's replies, tool results, and notices, so
+ * those rows must never carry these.
+ */
+export function actorAuthorProvenance(
+  trustContext: TrustContext | undefined,
+): ActorAuthorProvenance {
+  return trustContext?.requesterContactId
+    ? { provenanceContactId: trustContext.requesterContactId }
+    : {};
+}

package/src/daemon/message-types/shared.ts

@@ -39,6 +39,7 @@ export interface UserMessageAttachment {
   data: string;
   /** Origin of the attachment on the daemon side, when known. */
   sourceType?: "sandbox_file" | "host_file" | "tool_block";
+  computerUseScreenshot?: boolean;
   extractedText?: string;
   /** Original file size in bytes. Present when data was omitted from history_response to reduce payload size. */
   sizeBytes?: number;

package/src/daemon/mode-session-startup-recovery.ts

@@ -0,0 +1,23 @@
+import { setModeSessionRecoveryHealthy } from "../config/session-groups-gate.js";
+import { recoverActiveConversationModeSessions } from "../persistence/conversation-mode-sessions.js";
+import { setDbReady } from "./daemon-readiness.js";
+
+export type ModeSessionStartupRecoveryResult =
+  | { ok: true; interruptedCount: number }
+  | { ok: false; error: unknown };
+
+/** Runs after migrations; auxiliary recovery failure disables tracking for this boot. */
+export function recoverModeSessionsBeforeDbReady(
+  recover: () => number = recoverActiveConversationModeSessions,
+): ModeSessionStartupRecoveryResult {
+  try {
+    const interruptedCount = recover();
+    setModeSessionRecoveryHealthy(true);
+    return { ok: true, interruptedCount };
+  } catch (error) {
+    setModeSessionRecoveryHealthy(false);
+    return { ok: false, error };
+  } finally {
+    setDbReady(true);
+  }
+}

package/src/daemon/mode-session-tracking.ts

@@ -0,0 +1,54 @@
+import type { ModeSession } from "../api/mode-session.js";
+import { getLogger } from "../util/logger.js";
+import type {
+  ConversationModeSessionCoordinator,
+  ModeSessionSourceHandle,
+} from "./conversation-mode-session.js";
+
+const log = getLogger("mode-session-tracking");
+
+/** Optional bookkeeping must not interrupt accepted actions or content. */
+export function bestEffortModeSessionTracking<T>(
+  operation: string,
+  track: () => T,
+): T | undefined {
+  try {
+    return track();
+  } catch (err) {
+    log.warn({ err, operation }, "Mode-session tracking failed");
+    return undefined;
+  }
+}
+
+/** Retire a refused source while already accepted turn output keeps its owner. */
+export function claimModeSessionTurn(
+  coordinator: Pick<
+    ConversationModeSessionCoordinator,
+    "claimTurn" | "retireSource"
+  >,
+  turnId: string,
+  handle: ModeSessionSourceHandle,
+  at: number,
+): ModeSession | undefined {
+  let owner: ModeSession | undefined;
+  try {
+    owner = coordinator.claimTurn(turnId, handle, at);
+  } catch (err) {
+    bestEffortModeSessionTracking("failed admission cleanup", () =>
+      coordinator.retireSource(handle, {
+        status: "interrupted",
+        endReason: "tracking_failed",
+      }),
+    );
+    throw err;
+  }
+  if (!owner || owner.id !== handle.id) {
+    bestEffortModeSessionTracking("refused admission cleanup", () =>
+      coordinator.retireSource(handle, {
+        status: "interrupted",
+        endReason: "tracking_refused",
+      }),
+    );
+  }
+  return owner;
+}

package/src/daemon/orphan-reaper.ts

@@ -1,9 +1,10 @@
 /**
  * Periodic reaper for orphaned subprocesses that reparent to the daemon.
  *
- * Tools run commands in their own process group (`detached: true`) and, on
- * timeout/abort, group-kill with `process.kill(-pgid, SIGKILL)` (the bash and
- * host_bash tools, and the skill sandbox runner). The
+ * POSIX tools run commands in their own process group (`detached: true`) and,
+ * on timeout/abort, group-kill with `process.kill(-pgid, SIGKILL)` (the bash
+ * and host_bash tools, and the skill sandbox runner). Windows piped shell
+ * children stay attached and are torn down with `taskkill /T`. The
  * immediate child is reaped by Bun/libuv, but its descendants — e.g. git's
  * transport helpers or a skill runner's `bun` process — were never spawned by
  * the daemon, so when the group dies they reparent to PID 1. When the daemon

package/src/daemon/persist-media-references.ts

@@ -29,6 +29,7 @@ import type {
   WorkspaceRefMediaSource,
 } from "../providers/types.js";
 import { getLogger } from "../util/logger.js";
+import { toolImageFilename } from "./assistant-attachments.js";
 
 const log = getLogger("persist-media-references");
 
@@ -62,6 +63,7 @@ async function referenceMediaBlock(
   messageId: string,
   block: ImageContent | FileContent,
   position: number,
+  imageFilenameOverride?: string,
 ): Promise<ContentBlock | null> {
   if (block.source.type !== "base64") {
     return block;
@@ -69,7 +71,9 @@ async function referenceMediaBlock(
   const { data, media_type } = block.source;
   const filename =
     block.source.filename ??
-    (block.type === "image" ? imageFilename(media_type) : "attachment");
+    (block.type === "image"
+      ? (imageFilenameOverride ?? imageFilename(media_type))
+      : "attachment");
 
   let stored: { id: string; sizeBytes: number };
   try {
@@ -127,11 +131,15 @@ export async function referenceMediaBlocksForPersist(
   conversationCreatedAt: number,
   messageId: string,
   blocks: ContentBlock[],
+  computerUseToolNames?: ReadonlyMap<string, string>,
 ): Promise<ContentBlock[]> {
   // A single link position counter across all attachments in the message so
   // their `message_attachments` rows keep content order.
   let position = 0;
-  const convert = async (block: ContentBlock): Promise<ContentBlock> => {
+  const convert = async (
+    block: ContentBlock,
+    imageFilenameOverride?: string,
+  ): Promise<ContentBlock> => {
     if (block.type === "image" || block.type === "file") {
       if (block.source.type !== "base64") {
         return block;
@@ -143,13 +151,22 @@ export async function referenceMediaBlocksForPersist(
           messageId,
           block,
           position++,
+          imageFilenameOverride,
         )) ?? block
       );
     }
     if (block.type === "tool_result" && block.contentBlocks?.length) {
       const contentBlocks: ContentBlock[] = [];
+      const computerUseToolName = computerUseToolNames?.get(block.tool_use_id);
       for (const cb of block.contentBlocks) {
-        contentBlocks.push(await convert(cb));
+        contentBlocks.push(
+          await convert(
+            cb,
+            cb.type === "image" && computerUseToolName
+              ? toolImageFilename(cb.source.media_type, computerUseToolName)
+              : undefined,
+          ),
+        );
       }
       return { ...block, contentBlocks };
     }

package/src/daemon/process-message.ts

@@ -67,12 +67,19 @@ import {
   preactivateHostProxySkills,
   shouldAttachHostProxyForCapability,
 } from "./host-proxy-preactivation.js";
+import { actorAuthorProvenance } from "./message-provenance.js";
 import type { SubagentToolGateMode } from "./tool-setup-types.js";
-import { restingTrust } from "./trust-context-types.js";
+import { restingTrust, type TrustContext } from "./trust-context-types.js";
 
 const log = getLogger("process-message");
 
 type ProcessMessageOptions = ConversationCreateOptions & {
+  /**
+   * The person whose own inbound message this turn persists, set only by
+   * channel ingress and its retry replay. Names the author on the persisted
+   * user row; see `PersistMessageOptions.author`.
+   */
+  author?: TrustContext;
   /** Per-turn observer for live agent-loop events. Does not replace SSE broadcast. */
   onEvent?: (msg: AssistantEvent) => void;
   /** IDs of user-uploaded attachments to resolve and include in the turn. */
@@ -539,7 +546,7 @@ export async function processMessage(
       ...(Object.keys(imageSourcePaths).length > 0 ? { imageSourcePaths } : {}),
     };
     const userMetaWithSlack = withChannelEnvelopes(
-      serverChannelMeta,
+      { ...serverChannelMeta, ...actorAuthorProvenance(options?.author) },
       slackMeta,
       providerMeta,
     );
@@ -638,7 +645,7 @@ export async function processMessage(
         : {}),
     };
     const compactUserMeta = withChannelEnvelopes(
-      compactChannelMeta,
+      { ...compactChannelMeta, ...actorAuthorProvenance(options?.author) },
       slackMeta,
       providerMeta,
     );
@@ -698,7 +705,7 @@ export async function processMessage(
         : {}),
     };
     const cleanUserMeta = withChannelEnvelopes(
-      cleanChannelMeta,
+      { ...cleanChannelMeta, ...actorAuthorProvenance(options?.author) },
       slackMeta,
       providerMeta,
     );
@@ -744,6 +751,7 @@ export async function processMessage(
       requestId,
       metadata: persistMetadata,
       displayContent: options?.displayContent,
+      ...(options?.author ? { author: options.author } : {}),
       ...(options?.skipUserMessageIndexing ? { skipIndexing: true } : {}),
       ...(ingressKey ? { clientMessageId: ingressKey } : {}),
     },
@@ -825,6 +833,7 @@ export async function processMessageInBackground(
       requestId,
       metadata: persistMetadata,
       displayContent: options?.displayContent,
+      ...(options?.author ? { author: options.author } : {}),
       ...(ingressKey ? { clientMessageId: ingressKey } : {}),
     },
   );

package/src/daemon/tool-setup-types.ts

@@ -59,6 +59,12 @@ export interface SubagentToolStats {
  * parity for desktop/web sources; channel-routed sources resolve every tool
  * gate identically under `hasNoClient: true` with or without them.)
  *
+ * A wake that also carries its source's recorded wire array
+ * (`Conversation.wireToolReplay`, set by `scopeWakeAllowedTools`) sends that
+ * array verbatim, so the pin then shapes only the execution-side inventory
+ * (`allowedToolNames`); the pin alone carries wire parity for a source with
+ * no recorded surface.
+ *
  * Tool-definition resolution ONLY. The executor callback and host-proxy
  * attachment paths never read the pin, so it cannot make a host tool
  * runnable: in execution gate mode every non-allowlisted call is rejected

package/src/daemon/virtual-desktop-context.ts

@@ -0,0 +1,21 @@
+import type { ToolContext } from "../tools/types.js";
+import type { Conversation } from "./conversation.js";
+import { resolveTurnClientOs } from "./conversation-client-surface.js";
+import { FALLBACK_TURN_TRUST, resolveTrustClass } from "./trust-context.js";
+import { turnActorPrincipalId } from "./turn-actor.js";
+
+export function virtualDesktopContext(
+  ctx: Conversation,
+  signal?: AbortSignal,
+): ToolContext {
+  return {
+    workingDir: ctx.workingDir,
+    conversationId: ctx.conversationId,
+    trustClass: resolveTrustClass(
+      ctx.getTurnOrRestingTrust?.() ?? FALLBACK_TURN_TRUST,
+    ),
+    ...resolveTurnClientOs(ctx),
+    sourceActorPrincipalId: turnActorPrincipalId(ctx),
+    signal,
+  };
+}