@vellumai/assistant 0.12.5 → 0.12.6-dev.202609292116.41f7caa

package/src/sequence/analytics.ts

@@ -13,8 +13,6 @@ import {
 } from "./store.js";
 import type { Sequence } from "./types.js";
 
-// ── Event tracking ──────────────────────────────────────────────────
-
 type SequenceEventType =
   | "send"
   | "reply"
@@ -72,8 +70,6 @@ function getRecentEvents(limit = 20): SequenceEvent[] {
   return eventLog.slice(-limit).reverse();
 }
 
-// ── Metrics ─────────────────────────────────────────────────────────
-
 interface SequenceMetrics {
   sequenceId: string;
   sequenceName: string;

package/src/sequence/engine.ts

@@ -105,8 +105,7 @@ async function processEnrollment(
       },
       "Sequence not active, skipping",
     );
-    // Re-set nextStepAt so it can be picked up when the sequence resumes
-    advanceEnrollmentToCurrentStep(enrollment, sequence);
+    rescheduleEnrollment(enrollment.id, Date.now() + 60_000);
     return;
   }
 
@@ -302,15 +301,6 @@ function buildStepPrompt(
   return parts.join("\n");
 }
 
-/** Re-schedule the enrollment for the current step (used when sequence is paused). */
-function advanceEnrollmentToCurrentStep(
-  enrollment: SequenceEnrollment,
-  _sequence: Sequence,
-): void {
-  // Re-schedule 60 seconds from now so it gets picked up after the sequence resumes
-  rescheduleEnrollment(enrollment.id, Date.now() + 60_000);
-}
-
 /**
  * Scan conversation messages for an email thread ID returned by tool
  * invocations. Looks for common patterns like "thread_id": "..." or

package/src/sequence/guardrails.ts

@@ -12,8 +12,6 @@ import type { SequenceEnrollment } from "./types.js";
 
 const log = getLogger("sequence:guardrails");
 
-// ── Defaults ────────────────────────────────────────────────────────
-
 export interface GuardrailConfig {
   dailySendCap: number;
   perSequenceHourlyRate: number;
@@ -45,13 +43,12 @@ export function setGuardrailConfig(
   return { ...config };
 }
 
-// ── Send tracking (in-memory, resets on daemon restart) ─────────────
-
 interface SendRecord {
   sequenceId: string;
   timestamp: number;
 }
 
+// In-memory; resets on assistant restart.
 const sendLog: SendRecord[] = [];
 
 export function recordSend(sequenceId: string): void {
@@ -72,8 +69,6 @@ function getSendsThisHour(sequenceId: string): number {
   ).length;
 }
 
-// ── Guardrail checks ────────────────────────────────────────────────
-
 export type GuardrailResult =
   | { ok: true }
   | { ok: false; reason: string; guardrail: string };

package/src/sequence/importer.ts

@@ -17,8 +17,6 @@ import { enrollContact, getSequence } from "./store.js";
 
 const log = getLogger("sequence:importer");
 
-// ── Types ───────────────────────────────────────────────────────────
-
 export interface ParsedContact {
   email: string;
   name?: string;
@@ -37,16 +35,12 @@ export interface EnrollResult {
   failed: Array<{ email: string; reason: string }>;
 }
 
-// ── Email validation ────────────────────────────────────────────────
-
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
 function isValidEmail(email: string): boolean {
   return EMAIL_RE.test(email);
 }
 
-// ── Column detection ────────────────────────────────────────────────
-
 // Alias lists are pre-normalized (same transform as normalizeHeader) so lookups
 // match regardless of the original casing, spacing, or punctuation in the file.
 const EMAIL_HEADERS = [
@@ -101,8 +95,6 @@ function detectColumns(headers: string[]): {
   return { emailIdx, nameIdx, firstNameIdx, lastNameIdx, contextIdxs };
 }
 
-// ── CSV parsing ─────────────────────────────────────────────────────
-
 function detectDelimiter(firstLine: string): string {
   if (firstLine.includes("\t")) {
     return "\t";

package/src/sequence/store.ts

@@ -33,8 +33,6 @@ import type {
   UpdateSequenceInput,
 } from "./types.js";
 
-// ── Row Mappers ─────────────────────────────────────────────────────
-
 const parseSequenceRow = createRowMapper<
   typeof sequences.$inferSelect,
   Sequence
@@ -70,8 +68,6 @@ const parseEnrollmentRow = createRowMapper<
   updatedAt: "updatedAt",
 });
 
-// ── Sequence CRUD ───────────────────────────────────────────────────
-
 export function createSequence(input: CreateSequenceInput): Sequence {
   const db = getDb();
   const now = Date.now();
@@ -156,8 +152,6 @@ export function deleteSequence(id: string): void {
   db.delete(sequences).where(eq(sequences.id, id)).run();
 }
 
-// ── Enrollment CRUD ─────────────────────────────────────────────────
-
 export function enrollContact(input: EnrollContactInput): SequenceEnrollment {
   const db = getDb();
   const now = Date.now();
@@ -265,8 +259,6 @@ export function claimDueEnrollments(
 
   const claimed: SequenceEnrollment[] = [];
   for (const row of candidates) {
-    // Optimistic lock: set status to 'active' (no-op value-wise) but bump updatedAt
-    // The WHERE ensures only one claimer succeeds
     // Optimistic lock: null out nextStepAt to prevent the row from being
     // picked up by a concurrent claim. The WHERE on the old nextStepAt value
     // ensures only one claimer wins (same pattern as reminders changing
@@ -358,8 +350,6 @@ export function resumeEnrollment(id: string): void {
     .run();
 }
 
-// ── Query Helpers ───────────────────────────────────────────────────
-
 export function findActiveEnrollmentsByEmail(
   email: string,
 ): SequenceEnrollment[] {

package/src/signals/user-message.ts

@@ -43,8 +43,6 @@ import { getSignalsDir } from "../util/platform.js";
 
 const log = getLogger("signal:user-message");
 
-// ── Attachment descriptor ───────────────────────────────────────────
-
 /** A file-backed attachment included in a signal payload. */
 export interface SignalAttachment {
   /** Absolute path to the file on disk. */
@@ -55,8 +53,6 @@ export interface SignalAttachment {
   mimeType: string;
 }
 
-// ── Dispatch helper ──────────────────────────────────────────────────
-
 async function dispatchUserMessage(params: {
   conversationKey: string;
   content: string;
@@ -279,8 +275,6 @@ async function dispatchUserMessage(params: {
   return { accepted: true };
 }
 
-// ── Signal handler ───────────────────────────────────────────────────
-
 /**
  * Read a `signals/user-message.<requestId>` file and dispatch the message
  * through the daemon's send pipeline. Writes

package/src/skills/catalog-install.ts

@@ -14,6 +14,8 @@ import { homedir } from "node:os";
 import { dirname, join, posix, resolve, sep } from "node:path";
 import { gunzipSync } from "node:zlib";
 
+import { z } from "zod";
+
 import {
   MALFORMED_USTAR_SIZE,
   parseUstarSizeField,
@@ -27,6 +29,7 @@ import { computeSkillHash, writeInstallMeta } from "./install-meta.js";
 import {
   isSkillCompatibleWithPlatform,
   normalizeSkillPlatforms,
+  SKILL_PLATFORM_VALUES,
   type SkillPlatform,
   skillPlatformUnavailableMessage,
 } from "./platform-compatibility.js";
@@ -142,21 +145,46 @@ export function getRepoSkillsDir(): string | undefined {
  * `metadata.vellum.*` shape used by the local `catalog.json`. Both shapes are
  * accepted here so the daemon has a single canonical representation downstream.
  */
-interface RawCatalogEntry {
-  id?: unknown;
-  name?: unknown;
-  description?: unknown;
-  icon?: unknown;
-  emoji?: string;
-  includes?: string[];
-  version?: string;
-  updatedAt?: unknown;
-  display_name?: unknown;
-  category?: unknown;
-  platforms?: unknown;
-  updated_at?: unknown;
-  metadata?: CatalogSkill["metadata"];
-}
+const CatalogPlatformsSchema = z
+  .array(z.enum(SKILL_PLATFORM_VALUES).optional().catch(undefined))
+  .transform((platforms) =>
+    platforms.filter((platform): platform is SkillPlatform => platform != null),
+  );
+const CatalogVellumMetadataSchema = z
+  .object({
+    "display-name": z.string().optional().catch(undefined),
+    "activation-hints": z.array(z.string()).optional().catch(undefined),
+    "avoid-when": z.array(z.string()).optional().catch(undefined),
+    "feature-flag": z.string().optional().catch(undefined),
+    category: z.string().optional().catch(undefined),
+    platforms: CatalogPlatformsSchema.optional().catch(undefined),
+  })
+  .passthrough();
+const CatalogMetadataSchema = z
+  .object({
+    icon: z.string().optional().catch(undefined),
+    emoji: z.string().optional().catch(undefined),
+    vellum: CatalogVellumMetadataSchema.optional().catch(undefined),
+  })
+  .passthrough();
+const RawCatalogEntrySchema = z.object({
+  id: z.string().optional().catch(undefined),
+  name: z.string().optional().catch(undefined),
+  description: z.string().optional().catch(undefined),
+  icon: z.string().optional().catch(undefined),
+  emoji: z.string().optional().catch(undefined),
+  includes: z.array(z.string()).optional().catch(undefined),
+  version: z.string().optional().catch(undefined),
+  updatedAt: z.string().optional().catch(undefined),
+  display_name: z.string().optional().catch(undefined),
+  category: z.string().optional().catch(undefined),
+  platforms: CatalogPlatformsSchema.optional().catch(undefined),
+  updated_at: z.string().optional().catch(undefined),
+  metadata: CatalogMetadataSchema.optional().catch(undefined),
+});
+const CatalogManifestSchema = z.object({
+  skills: z.array(z.unknown()),
+});
 
 function asStr(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -172,10 +200,11 @@ function asStr(value: unknown): string | undefined {
  * so a future API change to the nested shape keeps working.
  */
 function normalizeCatalogEntry(raw: unknown): CatalogSkill | null {
-  if (typeof raw !== "object" || raw === null) {
+  const parsed = RawCatalogEntrySchema.safeParse(raw);
+  if (!parsed.success) {
     return null;
   }
-  const entry = raw as RawCatalogEntry;
+  const entry = parsed.data;
 
   const id = asStr(entry.id);
   if (!id) {
@@ -227,11 +256,11 @@ export async function fetchCatalog(): Promise<CatalogSkill[]> {
     );
   }
 
-  const manifest = (await response.json()) as { skills?: unknown };
-  if (!Array.isArray(manifest.skills)) {
+  const manifest = CatalogManifestSchema.safeParse(await response.json());
+  if (!manifest.success) {
     throw new Error("Platform catalog has invalid skills array");
   }
-  return manifest.skills
+  return manifest.data.skills
     .map((s) => normalizeCatalogEntry(s))
     .filter((s): s is CatalogSkill => s !== null);
 }
@@ -239,11 +268,11 @@ export async function fetchCatalog(): Promise<CatalogSkill[]> {
 export function readLocalCatalog(repoSkillsDir: string): CatalogSkill[] {
   try {
     const raw = readFileSync(join(repoSkillsDir, "catalog.json"), "utf-8");
-    const manifest = JSON.parse(raw) as { skills?: unknown };
-    if (!Array.isArray(manifest.skills)) {
+    const manifest = CatalogManifestSchema.safeParse(JSON.parse(raw));
+    if (!manifest.success) {
       return [];
     }
-    return manifest.skills
+    return manifest.data.skills
       .map((s) => normalizeCatalogEntry(s))
       .filter((s): s is CatalogSkill => s !== null);
   } catch {

package/src/tools/browser/browser-execution.ts

@@ -287,8 +287,7 @@ export const EXTRACT_LINKS_EXPRESSION = `
 export function parseBrowserMode(
   input: Record<string, unknown>,
 ): { ok: true; mode: BrowserMode } | { ok: false; error: string } {
-  const raw = input.browser_mode;
-  const result = normalizeBrowserMode(raw);
+  const result = normalizeBrowserMode(input.browser_mode);
   if ("error" in result) {
     return { ok: false, error: `Error: ${result.error}` };
   }
@@ -900,7 +899,7 @@ export async function executeBrowserNavigate(
     // authoritative — otherwise a pin from an earlier navigate would
     // still capture the command and route it to the dedicated tab.
     clearPinnedTab(context.conversationId, targetClientId);
-    cdp.setCdpSessionId?.(undefined);
+    cdp.setCdpSessionId?.("active");
   } else if (cdp.kind === "extension") {
     const alreadyPinned =
       getPinnedTab(context.conversationId, targetClientId) !== undefined;
@@ -921,24 +920,20 @@ export async function executeBrowserNavigate(
             ? result.clientId
             : undefined;
         if (!tabId) {
-          // Malformed createTab response (no tabId). We're nominally falling
-          // back to active-tab routing — but the live `cdp` instance was
-          // already constructed with whatever pin was in scope for this
-          // conversation, AND the pin store still holds it for future
-          // client construction. Clear both: the pin store (so the next
-          // executeBrowserNavigate builds a clean client) AND the current
-          // cdp instance's session (so the Page.navigate that runs in a
-          // few lines targets the active tab rather than the stale pin).
-          // Without the setCdpSessionId(undefined) call, the warn message
-          // is a lie: navigation would still route to the dead tab via the
-          // already-injected cdpSessionId and likely fail with
-          // cdp_session_not_found.
           clearPinnedTab(context.conversationId, targetClientId);
-          cdp.setCdpSessionId?.(undefined);
-          log.warn(
-            { conversationId: context.conversationId, result },
-            "Vellum.createTab returned no tabId; cleared stale pin and live session, falling back to active-tab routing",
-          );
+          try {
+            cdp.dispose();
+          } catch (disposeErr) {
+            log.warn(
+              { conversationId: context.conversationId, err: disposeErr },
+              "Failed to dispose CDP client after Vellum.createTab returned no tabId",
+            );
+          }
+          return {
+            content:
+              "Error: Failed to open a new tab for navigation: Vellum.createTab returned no tabId. Pass --use-active-tab to navigate the currently-active tab instead.",
+            isError: true,
+          };
         } else {
           cdp.setCdpSessionId?.(tabId);
           setPinnedTab(context.conversationId, tabId, clientId);
@@ -2672,9 +2667,11 @@ async function checkExtensionModeStatus(
   context: ToolContext,
   autoCandidate: boolean,
 ): Promise<BrowserStatusModeResult> {
-  const proxy = HostBrowserProxy.instance;
-
-  if (!proxy.hasExtensionClient(context.sourceActorPrincipalId)) {
+  if (
+    !HostBrowserProxy.instance.hasExtensionClient(
+      context.sourceActorPrincipalId,
+    )
+  ) {
     return {
       mode: BROWSER_STATUS_MODE.EXTENSION,
       available: false,

package/src/tools/browser/cdp-client/cdp-inspect/ws-transport.ts

@@ -465,7 +465,7 @@ function createTransport(ws: WsLike): CdpWsTransport {
   ws.addEventListener("close", handleClose);
   ws.addEventListener("error", handleError);
 
-  const transport: CdpWsTransport = {
+  return {
     get closed() {
       return disposed || closed;
     },
@@ -607,6 +607,4 @@ function createTransport(ws: WsLike): CdpWsTransport {
       }
     },
   };
-
-  return transport;
 }

package/src/tools/document/document-tool.ts

@@ -158,6 +158,7 @@ export function executeDocumentOpen(
       surfaceId: doc.surfaceId,
       title: doc.title,
       initialContent: doc.content,
+      revision: doc.revision,
     });
 
     context.sendToClient({
@@ -244,6 +245,7 @@ function maybeReuseEmptyDocument(
       surfaceId,
       markdown: initialContent,
       mode: "replace",
+      revision: update.revision,
     });
 
     context.sendToClient({
@@ -304,7 +306,7 @@ export function executeDocumentCreate(
       isError: true,
     };
   }
-  const { surfaceId } = created;
+  const { surfaceId, revision } = created;
 
   // Send document_editor_show message to open the built-in RTE
   if (context.sendToClient) {
@@ -314,6 +316,7 @@ export function executeDocumentCreate(
       surfaceId,
       title,
       initialContent,
+      revision,
     });
 
     context.sendToClient({
@@ -441,6 +444,7 @@ export function executeDocumentUpdate(
       surfaceId,
       markdown: applied,
       mode,
+      revision: result.revision,
     });
 
     return {
@@ -684,16 +688,14 @@ export function executeDocumentReplaceText(
   }
 
   if (context.sendToClient && result.content_changed) {
-    const doc = getDocumentById(surfaceId);
-    if (doc) {
-      context.sendToClient({
-        type: "document_editor_update",
-        conversationId: context.conversationId,
-        surfaceId,
-        markdown: doc.content,
-        mode: "replace",
-      });
-    }
+    context.sendToClient({
+      type: "document_editor_update",
+      conversationId: context.conversationId,
+      surfaceId,
+      markdown: result.content,
+      mode: "replace",
+      revision: result.revision,
+    });
   }
 
   return {

package/src/tools/executor.ts

@@ -482,8 +482,7 @@ export function computePerToolTimeoutMs(
     const { questionResponseTimeoutSec } = getConfig().timeouts;
     return (questionResponseTimeoutSec + 5) * 1000;
   }
-  const rawTimeoutSec = getConfig().timeouts.toolExecutionTimeoutSec;
-  return safeTimeoutMs(rawTimeoutSec);
+  return safeTimeoutMs(getConfig().timeouts.toolExecutionTimeoutSec);
 }
 
 /**

package/src/tools/host-terminal/host-shell.ts

@@ -486,7 +486,7 @@ export const hostShellTool = {
       // Only the first handler to fire should wake the agent.
       let completed = false;
 
-      child.on("close", (code) => {
+      child.on("close", (code, signal) => {
         if (completed) {
           return;
         }
@@ -494,6 +494,7 @@ export const hostShellTool = {
         clearTimeout(timer);
         const result = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
+          signal: aborted ? null : signal,
         });
         // Cancel takes precedence over the SIGKILL-induced error result.
         const status = aborted
@@ -667,12 +668,13 @@ export const hostShellTool = {
         }
       }
 
-      child.on("close", (code) => {
+      child.on("close", (code, signal) => {
         clearTimeout(timer);
         context.signal?.removeEventListener("abort", onAbort);
 
         const result = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
+          signal: context.signal?.aborted ? null : signal,
         });
 
         resolve({

package/src/tools/network/__tests__/web-search.test.ts

@@ -13,6 +13,7 @@ let mockFastcrwSecureKey: string | undefined;
 let mockSearxngSecureKey: string | undefined;
 let mockTinyfishSecureKey: string | undefined;
 let mockExaSecureKey: string | undefined;
+let mockSerplySecureKey: string | undefined;
 let mockManagedSearchProxyResult: any;
 let mockManagedSearchAvailable = true;
 let mockManagedSearchProxyCalls: Array<{
@@ -69,6 +70,9 @@ mock.module("../../../security/secure-keys.js", () => ({
     if (provider === "exa") {
       return mockExaSecureKey;
     }
+    if (provider === "serply") {
+      return mockSerplySecureKey;
+    }
     return undefined;
   },
 }));
@@ -116,6 +120,7 @@ describe("web_search tool", () => {
     mockSearxngSecureKey = undefined;
     mockTinyfishSecureKey = undefined;
     mockExaSecureKey = undefined;
+    mockSerplySecureKey = undefined;
     mockManagedSearchProxyCalls = [];
     mockManagedSearchAvailable = true;
     mockManagedSearchProxyResult = {
@@ -1441,6 +1446,106 @@ describe("web_search tool", () => {
     expect(result.activityMetadata?.webSearch?.provider).toBe("exa");
   });
 
+  // ---- Serply provider ---------------------------------------------------
+
+  test("Serply search sends the query form request and maps freshness", async () => {
+    seedWebSearch("your-own", "serply");
+    mockSerplySecureKey = "serply_test";
+    let capturedUrl = "";
+    let capturedInit: RequestInit | undefined;
+    globalThis.fetch = (async (url: string, init?: RequestInit) => {
+      capturedUrl = url;
+      capturedInit = init;
+      return new Response(
+        JSON.stringify({
+          query: "fresh tools",
+          total: 1,
+          results: [
+            {
+              title: "Serply Result",
+              link: "https://example.com/serply",
+              description: "Fresh from Serply",
+              position: 1,
+            },
+          ],
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      );
+    }) as any;
+
+    const result = await execute({
+      query: "fresh tools",
+      freshness: "pw",
+      count: 5,
+    });
+
+    expect(result.isError).toBe(false);
+    const parsed = new URL(capturedUrl);
+    expect(parsed.origin + parsed.pathname).toBe(
+      "https://api.serply.io/v1/search",
+    );
+    expect(parsed.searchParams.get("q")).toBe("fresh tools");
+    expect(parsed.searchParams.get("num")).toBe("5");
+    expect(parsed.searchParams.get("tbs")).toBe("qdr:w");
+    expect(capturedInit?.method).toBe("GET");
+    const headers = new Headers(capturedInit?.headers);
+    expect(headers.get("x-api-key")).toBe("serply_test");
+    expect(headers.get("user-agent")).toBe("vellum-assistant");
+    expect(result.content).toContain("Serply Result");
+    expect(result.content).toContain("Fresh from Serply");
+    expect(result.activityMetadata?.webSearch?.provider).toBe("serply");
+  });
+
+  test("Serply omits tbs without freshness, clamps num, and trims to count", async () => {
+    seedWebSearch("your-own", "serply");
+    mockSerplySecureKey = "serply_test";
+    let capturedUrl = "";
+    globalThis.fetch = (async (url: string) => {
+      capturedUrl = url;
+      return new Response(
+        JSON.stringify({
+          results: [
+            { title: "A", link: "https://a.example.com", description: "a" },
+            { title: "B", link: "https://b.example.com", description: "b" },
+            { title: "C", link: "https://c.example.com", description: "c" },
+          ],
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      );
+    }) as any;
+
+    const result = await execute({ query: "test", count: 2 });
+
+    const parsed = new URL(capturedUrl);
+    expect(parsed.searchParams.get("tbs")).toBeNull();
+    expect(parsed.searchParams.get("num")).toBe("2");
+    expect(result.content).toContain("A");
+    expect(result.content).toContain("B");
+    expect(result.content).not.toContain("https://c.example.com");
+    expect(result.activityMetadata?.webSearch?.resultCount).toBe(2);
+
+    const clamped = await execute({ query: "test", count: 20 });
+    expect(new URL(capturedUrl).searchParams.get("num")).toBe("10");
+    expect(clamped.isError).toBe(false);
+  });
+
+  test.each([401, 402, 403])(
+    "Serply handles %d access error",
+    async (status) => {
+      seedWebSearch("your-own", "serply");
+      mockSerplySecureKey = "serply_test";
+      globalThis.fetch = (async () =>
+        new Response(JSON.stringify({ detail: "Invalid API key" }), {
+          status,
+        })) as any;
+
+      const result = await execute({ query: "test" });
+
+      expect(result.isError).toBe(true);
+      expect(result.activityMetadata?.webSearch?.provider).toBe("serply");
+    },
+  );
+
   // ---- Provider fallback --------------------------------------------------
 
   test("falls back from perplexity to brave when perplexity has no key", async () => {

package/src/tools/network/web-fetch.ts

@@ -1530,9 +1530,8 @@ export async function executeFastcrwScrape(
   input: Record<string, unknown>,
   options: { apiKey: string; signal?: AbortSignal },
 ): Promise<ToolExecutionResult> {
-  const apiBase = getConfig().services["web-fetch"]?.apiBase;
   const endpoint = resolveProviderApiUrl(
-    apiBase,
+    getConfig().services["web-fetch"]?.apiBase,
     FASTCRW_SCRAPE_PATH,
     FASTCRW_DEFAULT_API_BASE,
   );
@@ -1587,9 +1586,8 @@ export async function executeTinyfishFetch(
     1,
     MAX_TIMEOUT_SECONDS,
   );
-  const apiBase = getConfig().services["web-fetch"]?.apiBase;
   const endpoint = resolveProviderApiUrl(
-    apiBase,
+    getConfig().services["web-fetch"]?.apiBase,
     "/",
     TINYFISH_DEFAULT_FETCH_API_BASE,
   );