@vellumai/assistant 0.12.2 → 0.12.3-staging.2

package/src/persistence/schema/conversation-tool-surfaces.ts

@@ -0,0 +1,32 @@
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+import { conversations } from "./conversations.js";
+
+/**
+ * The tool definitions a conversation's most recent live turn sent to the
+ * provider, serialized exactly as resolved, plus whether that turn's system
+ * prompt rendered the parallel-delegation section (which the prompt derives
+ * from the same resolved surface and the turn's channel). Written at the
+ * agent loop's send boundary when either changes; read by fork wakes that
+ * replay both so their provider prompt-cache prefix matches the source's live
+ * turns. Cascades with its conversation.
+ */
+export const conversationToolSurfaces = sqliteTable(
+  "conversation_tool_surfaces",
+  {
+    conversationId: text("conversation_id")
+      .primaryKey()
+      .references(() => conversations.id, { onDelete: "cascade" }),
+    toolsJson: text("tools_json").notNull(),
+    toolsHash: text("tools_hash").notNull(),
+    /**
+     * Whether the turn's system prompt rendered the `01-parallel-tasks`
+     * section. Null when unknown: the turn ran on a system-prompt override,
+     * or the row predates the column.
+     */
+    delegateIndependentTasks: integer("delegate_independent_tasks", {
+      mode: "boolean",
+    }),
+    updatedAt: integer("updated_at").notNull(),
+  },
+);

package/src/persistence/schema/conversations.ts

@@ -1,5 +1,6 @@
 import { sql } from "drizzle-orm";
 import {
+  check,
   index,
   integer,
   primaryKey,
@@ -141,6 +142,72 @@ export const conversations = sqliteTable(
   ],
 );
 
+export const conversationModeSessions = sqliteTable(
+  "conversation_mode_sessions",
+  {
+    id: text("id").primaryKey(),
+    conversationId: text("conversation_id")
+      .notNull()
+      .references(() => conversations.id, { onDelete: "cascade" }),
+    mode: text("mode", {
+      enum: ["computer_use", "browser", "live_vision", "ambient"],
+    }).notNull(),
+    status: text("status", {
+      enum: ["active", "completed", "interrupted"],
+    }).notNull(),
+    sourceStartedAt: integer("source_started_at").notNull(),
+    firstIncludedAt: integer("first_included_at"),
+    firstIncludedMessageId: text("first_included_message_id"),
+    lastActivityAt: integer("last_activity_at").notNull(),
+    lastOwnedMessageId: text("last_owned_message_id"),
+    endedAt: integer("ended_at"),
+    endReason: text("end_reason"),
+    revision: integer("revision").notNull().default(1),
+  },
+  (table) => [
+    check(
+      "conversation_mode_sessions_mode_check",
+      sql`${table.mode} IN ('computer_use', 'browser', 'live_vision', 'ambient')`,
+    ),
+    check(
+      "conversation_mode_sessions_status_check",
+      sql`${table.status} IN ('active', 'completed', 'interrupted')`,
+    ),
+    check(
+      "conversation_mode_sessions_revision_check",
+      sql`${table.revision} > 0`,
+    ),
+    check(
+      "conversation_mode_sessions_first_included_boundary_check",
+      sql`(${table.firstIncludedAt} IS NULL) = (${table.firstIncludedMessageId} IS NULL)`,
+    ),
+    check(
+      "conversation_mode_sessions_terminal_fields_check",
+      sql`(
+        (${table.status} = 'active' AND ${table.endedAt} IS NULL AND ${table.endReason} IS NULL)
+        OR (${table.status} = 'completed' AND ${table.endedAt} IS NOT NULL AND ${table.endReason} IS NOT NULL AND length(${table.endReason}) > 0)
+        OR (${table.status} = 'interrupted' AND ${table.endReason} IS NOT NULL AND length(${table.endReason}) > 0)
+      )`,
+    ),
+    check(
+      "conversation_mode_sessions_end_after_activity_check",
+      sql`${table.endedAt} IS NULL OR ${table.endedAt} >= ${table.lastActivityAt}`,
+    ),
+    check(
+      "conversation_mode_sessions_activity_after_source_check",
+      sql`${table.lastActivityAt} >= ${table.sourceStartedAt}`,
+    ),
+    check(
+      "conversation_mode_sessions_first_included_before_activity_check",
+      sql`${table.firstIncludedAt} IS NULL OR ${table.firstIncludedAt} <= ${table.lastActivityAt}`,
+    ),
+    index("idx_conversation_mode_sessions_conversation_status").on(
+      table.conversationId,
+      table.status,
+    ),
+  ],
+);
+
 export const messages = sqliteTable(
   "messages",
   {

package/src/persistence/schema/index.ts

@@ -5,6 +5,7 @@ export * from "./calls.js";
 export * from "./contacts.js";
 export * from "./conversation-groups.js";
 export * from "./conversation-starters.js";
+export * from "./conversation-tool-surfaces.js";
 export * from "./conversations.js";
 export * from "./documents.js";
 export * from "./guardian.js";

package/src/persistence/schema/infrastructure.ts

@@ -359,3 +359,32 @@ export const telemetryEvents = sqliteTable(
     index("idx_telemetry_events_conversation_id").on(table.conversationId),
   ],
 );
+
+/**
+ * Append-only hub subscribe/dispose ledger. Support reconstructs client
+ * uptime and reconnect flaps from these rows. No message bodies or page
+ * URLs: client UUID, interface, close reason, and optional build
+ * fingerprint only.
+ */
+export const clientConnectionEvents = sqliteTable(
+  "client_connection_events",
+  {
+    id: text("id").primaryKey(),
+    clientId: text("client_id").notNull(),
+    interfaceId: text("interface_id").notNull(),
+    connectionId: text("connection_id").notNull(),
+    reason: text("reason").notNull(),
+    occurredAt: integer("occurred_at").notNull(),
+    actorPrincipalId: text("actor_principal_id"),
+    clientVersion: text("client_version"),
+    sseWatchdog: integer("sse_watchdog", { mode: "boolean" }),
+    machineName: text("machine_name"),
+  },
+  (table) => [
+    index("idx_client_connection_events_client_occurred").on(
+      table.clientId,
+      table.occurredAt,
+    ),
+    index("idx_client_connection_events_occurred").on(table.occurredAt),
+  ],
+);

package/src/persistence/schema/oauth.ts

@@ -50,6 +50,7 @@ export const oauthProviders = sqliteTable("oauth_providers", {
   identityResponsePaths: text("identity_response_paths"),
   identityFormat: text("identity_format"),
   identityOkField: text("identity_ok_field"),
+  responseOkField: text("response_ok_field"),
   featureFlag: text("feature_flag"),
   createdAt: integer("created_at").notNull(),
   updatedAt: integer("updated_at").notNull(),

package/src/persistence/steps.ts

@@ -485,6 +485,14 @@ import { migrateChannelInboundMessageIdIndex } from "./migrations/374-channel-in
 import { migrateCreateChannelOutboundPosts } from "./migrations/375-create-channel-outbound-posts.js";
 import { migrateNotificationDeliveriesCanonicalMessageId } from "./migrations/376-notification-deliveries-canonical-message-id.js";
 import { migrateAddSubagentBudgetStopReason } from "./migrations/377-add-subagent-budget-stop-reason.js";
+import { migrateCreateConversationToolSurfaces } from "./migrations/378-create-conversation-tool-surfaces.js";
+import { migrateOAuthProvidersResponseOkField } from "./migrations/379-oauth-providers-response-ok-field.js";
+import { migrateConversationToolSurfacesDelegateIndependentTasks } from "./migrations/380-conversation-tool-surfaces-delegate-independent-tasks.js";
+import {
+  downCreateConversationModeSessions,
+  migrateCreateConversationModeSessions,
+} from "./migrations/381-create-conversation-mode-sessions.js";
+import { migrateCreateClientConnectionEvents } from "./migrations/382-create-client-connection-events.js";
 import type { MigrationStep } from "./migrations/run-migrations.js";
 
 export const migrationSteps: MigrationStep[] = [
@@ -1606,9 +1614,39 @@ export const migrationSteps: MigrationStep[] = [
   {
     name: "migrateAddSubagentBudgetStopReason",
     run: migrateAddSubagentBudgetStopReason,
-    // The column guard treats a missing table as nothing-to-do, so the table
-    // must be checkpointed first or a repair flow could permanently checkpoint
-    // this as a no-op.
+    // The column guard reads the table's columns and the ALTER throws on a
+    // missing table, so the table must be checkpointed first or a repair flow
+    // that failed to create it would fail this step needlessly.
     dependsOn: ["migrateCreateSubagentsTable"],
   },
+  migrateCreateConversationToolSurfaces,
+  {
+    name: "migrateOAuthProvidersResponseOkField",
+    run: migrateOAuthProvidersResponseOkField,
+    // The column guard reads the table's columns, and an `ALTER` on a missing
+    // table throws, so the table must be checkpointed first or a repair flow
+    // that failed to create it would either fail this step needlessly or, if
+    // the error were swallowed, checkpoint it as done against no table.
+    dependsOn: ["createOAuthTables"],
+  },
+  {
+    name: "migrateConversationToolSurfacesDelegateIndependentTasks",
+    run: migrateConversationToolSurfacesDelegateIndependentTasks,
+    // Same column-guard shape as the step above: the guard reads the table's
+    // columns and the `ALTER` throws on a missing table, so the table's own
+    // step must be checkpointed first.
+    dependsOn: ["migrateCreateConversationToolSurfaces"],
+  },
+  {
+    name: "migrateCreateConversationModeSessions",
+    run: migrateCreateConversationModeSessions,
+    rollback: [
+      {
+        version: 58,
+        description: "Create conversation-owned mode session lifecycle records",
+        down: downCreateConversationModeSessions,
+      },
+    ],
+  },
+  migrateCreateClientConnectionEvents,
 ];

package/src/plugin-api/__tests__/plugin-name-env.test.ts

@@ -0,0 +1,249 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { runInPluginContext } from "../../plugins/plugin-execution-context.js";
+import {
+  derivePluginNameFromProcess,
+  derivePluginNameFromSkillScriptPath,
+  PLUGIN_NAME_ENV,
+  readPluginNameFromEnv,
+  resolveCallingPluginName,
+} from "../plugin-name-env.js";
+
+const pluginsDir = "/tmp/vellum-workspace/plugins";
+
+describe("readPluginNameFromEnv", () => {
+  test("returns a trimmed install name", () => {
+    expect(readPluginNameFromEnv({ [PLUGIN_NAME_ENV]: "  sms  " })).toBe("sms");
+  });
+
+  test("ignores empty or whitespace-only values", () => {
+    expect(readPluginNameFromEnv({ [PLUGIN_NAME_ENV]: "" })).toBeUndefined();
+    expect(readPluginNameFromEnv({ [PLUGIN_NAME_ENV]: "   " })).toBeUndefined();
+    expect(readPluginNameFromEnv({})).toBeUndefined();
+  });
+});
+
+describe("derivePluginNameFromSkillScriptPath", () => {
+  test("returns the plugin install name for a scripts path", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts"),
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("returns the plugin install name for a tools path", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/sms-setup/tools/list.ts"),
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("accepts a file URL", () => {
+    const filePath = join(
+      pluginsDir,
+      "sms/skills/sms-setup/scripts/twilio-numbers.ts",
+    );
+    expect(
+      derivePluginNameFromSkillScriptPath(`file://${filePath}`, pluginsDir),
+    ).toBe("sms");
+  });
+
+  test("rejects a path outside plugins/", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        "/tmp/other/skills/sms-setup/scripts/twilio-numbers.ts",
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+  });
+
+  test("rejects a plugin file that is not under scripts/ or tools/", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/sms-setup/SKILL.md"),
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/register.ts"),
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+  });
+
+  test("rejects a truncated plugins path", () => {
+    expect(
+      derivePluginNameFromSkillScriptPath(
+        join(pluginsDir, "sms/skills/scripts/too-short.ts"),
+        pluginsDir,
+      ),
+    ).toBeUndefined();
+  });
+});
+
+describe("derivePluginNameFromProcess", () => {
+  test("scans argv for a plugin-resident skill script", () => {
+    expect(
+      derivePluginNameFromProcess(
+        ["bun", join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts")],
+        "/tmp",
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("resolves a relative argv path against cwd", () => {
+    expect(
+      derivePluginNameFromProcess(
+        ["bun", "sms/skills/sms-setup/scripts/twilio-numbers.ts"],
+        pluginsDir,
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+
+  test("skips flags", () => {
+    expect(
+      derivePluginNameFromProcess(
+        ["bun", "--hot", join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts")],
+        "/tmp",
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+});
+
+describe("resolveCallingPluginName", () => {
+  const prior = process.env[PLUGIN_NAME_ENV];
+
+  afterEach(() => {
+    if (prior === undefined) {
+      delete process.env[PLUGIN_NAME_ENV];
+    } else {
+      process.env[PLUGIN_NAME_ENV] = prior;
+    }
+  });
+
+  test("prefers AsyncLocalStorage over env", () => {
+    process.env[PLUGIN_NAME_ENV] = "from-env";
+    const name = runInPluginContext("from-als", () =>
+      resolveCallingPluginName(process.env, [], "/tmp"),
+    );
+    expect(name).toBe("from-als");
+  });
+
+  test("uses VELLUM_PLUGIN_NAME when ALS is empty", () => {
+    expect(
+      resolveCallingPluginName({ [PLUGIN_NAME_ENV]: "sms" }, [], "/tmp"),
+    ).toBe("sms");
+  });
+
+  test("falls back to the process entry path", () => {
+    expect(
+      resolveCallingPluginName(
+        {},
+        ["bun", join(pluginsDir, "sms/skills/sms-setup/scripts/twilio-numbers.ts")],
+        "/tmp",
+        pluginsDir,
+      ),
+    ).toBe("sms");
+  });
+});
+
+describe("resolveCallingPluginName real child", () => {
+  test("recovers the plugin name from a scripts path without env", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "plugin-name-child-"));
+    const scriptDir = join(
+      workspace,
+      "plugins/sms/skills/sms-setup/scripts",
+    );
+    mkdirSync(scriptDir, { recursive: true });
+    const helper = join(
+      import.meta.dir,
+      "..",
+      "plugin-name-env.ts",
+    );
+    const scriptPath = join(scriptDir, "echo-plugin-name.ts");
+    writeFileSync(
+      scriptPath,
+      `import { resolveCallingPluginName } from ${JSON.stringify(helper)};
+console.log(JSON.stringify({ name: resolveCallingPluginName() ?? null }));
+`,
+    );
+
+    try {
+      const child = Bun.spawn(
+        ["bun", scriptPath],
+        {
+          cwd: scriptDir,
+          env: {
+            PATH: process.env.PATH,
+            HOME: process.env.HOME,
+            VELLUM_WORKSPACE_DIR: workspace,
+          },
+          stdout: "pipe",
+          stderr: "pipe",
+        },
+      );
+      const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(child.stdout).text(),
+        new Response(child.stderr).text(),
+        child.exited,
+      ]);
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+      expect(JSON.parse(stdout.trim())).toEqual({ name: "sms" });
+    } finally {
+      rmSync(workspace, { recursive: true, force: true });
+    }
+  }, 15_000);
+
+  test("recovers the plugin name from VELLUM_PLUGIN_NAME without a plugin path", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "plugin-name-env-child-"));
+    const scriptDir = join(workspace, "scratch");
+    mkdirSync(scriptDir, { recursive: true });
+    const helper = join(import.meta.dir, "..", "plugin-name-env.ts");
+    const scriptPath = join(scriptDir, "echo-plugin-name.ts");
+    writeFileSync(
+      scriptPath,
+      `import { resolveCallingPluginName } from ${JSON.stringify(helper)};
+console.log(JSON.stringify({ name: resolveCallingPluginName() ?? null }));
+`,
+    );
+
+    try {
+      const child = Bun.spawn(
+        ["bun", scriptPath],
+        {
+          cwd: scriptDir,
+          env: {
+            PATH: process.env.PATH,
+            HOME: process.env.HOME,
+            VELLUM_WORKSPACE_DIR: workspace,
+            VELLUM_PLUGIN_NAME: "sms",
+          },
+          stdout: "pipe",
+          stderr: "pipe",
+        },
+      );
+      const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(child.stdout).text(),
+        new Response(child.stderr).text(),
+        child.exited,
+      ]);
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+      expect(JSON.parse(stdout.trim())).toEqual({ name: "sms" });
+    } finally {
+      rmSync(workspace, { recursive: true, force: true });
+    }
+  }, 15_000);
+});

package/src/plugin-api/conversation-turn.ts

@@ -284,13 +284,20 @@ export async function runConversationTurn(
   const { resolveChannelCapabilities } =
     await import("../daemon/conversation-runtime-assembly.js");
 
-  // Plugin-driven turns run as the guardian: plugins are installed by the
-  // guardian, so their conversations inherit guardian trust. This lets the
-  // existing non-interactive auto-approve machinery handle tool permissions
-  // (the conversation is already non-interactive via `isInteractive: false`
-  // below) without requiring a client to approve prompts.
+  // Channel-addressed turns are inbound: the gateway classifies the sender
+  // and the turn runs only if that actor clears the channel admission floor.
+  // Internal plugin jobs (no channel address) use guardian trust because they
+  // are assistant-owned work, not an external sender.
   const { INTERNAL_GUARDIAN_TRUST_CONTEXT } =
     await import("../daemon/trust-context.js");
+  const { resolvePluginChannelTurnTrust } =
+    await import("./plugin-channel-turn-trust.js");
+  const { prepareChannelInboundContent } =
+    await import("../runtime/routes/inbound-stages/inbound-content-prep.js");
+
+  const trustContext = options.channel
+    ? await resolvePluginChannelTurnTrust(options.channel)
+    : INTERNAL_GUARDIAN_TRUST_CONTEXT;
 
   // A channel address resolves through the same binding an inbound message
   // uses, so a turn addressed by chat lands in that chat's conversation
@@ -311,7 +318,7 @@ export async function runConversationTurn(
     ? !channelConversation.created
     : getConversation(conversationId) != null;
   const conversation = await getOrCreateConversation(conversationId, {
-    trustContext: INTERNAL_GUARDIAN_TRUST_CONTEXT,
+    trustContext,
     ...(options.conversationType
       ? { conversationType: options.conversationType }
       : {}),
@@ -336,10 +343,23 @@ export async function runConversationTurn(
 
   // Convert ContentBlock[] input to the text + attachments shape the
   // conversation's processMessage path expects.
-  const { text, attachments } = extractContentAndAttachments(
+  const { text: rawText, attachments } = extractContentAndAttachments(
     options.content,
     resolveMediaSourceData,
   );
+  const inboundContent = options.channel
+    ? prepareChannelInboundContent({
+        trimmedContent: rawText,
+        trustClass: trustContext.trustClass,
+        sourceChannel: options.channel.sourceChannel,
+        requesterIdentifier:
+          options.channel.username ??
+          options.channel.externalUserId ??
+          undefined,
+      })
+    : { content: rawText, displayContent: undefined };
+  const text = inboundContent.content;
+  const displayContent = inboundContent.displayContent;
 
   // The channel this turn speaks on. Runtime assembly reads the per-turn
   // context first and falls back to the conversation's `originChannel`, then
@@ -409,6 +429,8 @@ export async function runConversationTurn(
       requestId,
       isInteractive: false,
       metadata,
+      trustContext,
+      ...(displayContent ? { displayContent } : {}),
     });
     if (enqueueResult.rejected) {
       throw new Error(
@@ -432,6 +454,8 @@ export async function runConversationTurn(
     onEvent,
     isInteractive: false,
     metadata,
+    trustContext,
+    ...(displayContent ? { displayContent } : {}),
     ...(options.callSite ? { callSite: options.callSite } : {}),
   });
 

package/src/plugin-api/effective-context-window.ts

@@ -0,0 +1,33 @@
+import { resolveEffectiveContextWindow } from "../config/llm-context-resolution.js";
+import type { ResolveCallSiteOpts } from "../config/llm-resolver.js";
+import { getConfig } from "../config/loader.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
+
+export interface EffectiveContextWindowInfo {
+  provider: string;
+  model: string;
+  maxInputTokens: number;
+}
+
+export type EffectiveContextWindowOptions = Pick<
+  ResolveCallSiteOpts,
+  "overrideProfile" | "forceOverrideProfile" | "selectionSeed"
+>;
+
+/**
+ * Resolve the provider, model, and effective input limit for one configured
+ * call site. The result applies both the workspace override and the selected
+ * model's catalog limit, using the same profile-selection options accepted by
+ * {@link getConfiguredProvider}.
+ */
+export function getEffectiveContextWindow(
+  callSite: LLMCallSite,
+  options: EffectiveContextWindowOptions = {},
+): EffectiveContextWindowInfo {
+  const { provider, model, maxInputTokens } = resolveEffectiveContextWindow({
+    llm: getConfig().llm,
+    callSite,
+    ...options,
+  });
+  return { provider, model, maxInputTokens };
+}