@vellumai/assistant 0.12.6 → 0.12.7-staging.1

package/src/runtime/routes/conversation-routes.ts

@@ -101,6 +101,7 @@ import {
   writeOnboardingSidecar,
   writeRelationshipState,
 } from "../../home/relationship-state-writer.js";
+import { localeFromAcceptLanguage } from "../../i18n/index.js";
 import { ipcCall } from "../../ipc/gateway-client.js";
 import { buildSlackMessageDeepLinks } from "../../messaging/providers/slack/deep-link.js";
 import {
@@ -118,6 +119,7 @@ import {
 } from "../../persistence/attachments-store.js";
 import {
   addMessage,
+  deleteConversation,
   findMessageIdByClientMessageId,
   getConversation,
   getConversationPersistedSeq,
@@ -138,6 +140,7 @@ import {
 import {
   getConversationByKey,
   getOrCreateConversation,
+  recordStandardConversationCreated,
 } from "../../persistence/conversation-key-store.js";
 import { listConversationModeSessionsByIds } from "../../persistence/conversation-mode-sessions.js";
 import { searchConversations } from "../../persistence/conversation-queries.js";
@@ -915,7 +918,9 @@ function parseRequestedModeSessionIds(raw: unknown): string[] {
 
 export async function handleListMessages({
   queryParams,
+  headers,
 }: RouteHandlerArgs): Promise<Record<string, unknown>> {
+  const locale = localeFromAcceptLanguage(headers?.["accept-language"]);
   const conversationId = queryParams?.conversationId;
   const conversationKey = queryParams?.conversationKey;
 
@@ -1338,6 +1343,7 @@ export async function handleListMessages({
         attachmentBlocks,
         m.id ?? undefined,
         m.rowMetadata,
+        m.role === "assistant" ? locale : undefined,
       );
 
       const toolCalls = enrichToolCallsWithQuestion(
@@ -1735,6 +1741,7 @@ export async function handleSendMessage(
   const principalType = headers?.["x-vellum-principal-type"];
   const originClientId = headers?.["x-vellum-client-id"]?.trim() || undefined;
   const clientMetadata = readClientMetadataHeaders(headers);
+  const locale = localeFromAcceptLanguage(headers?.["accept-language"]);
 
   const { conversationKey, content, attachmentIds } = body;
   const inboundConversationId =
@@ -1924,6 +1931,12 @@ export async function handleSendMessage(
     conversationType: string;
     created: boolean;
   };
+  const mintConversation =
+    inboundConversationId === undefined &&
+    !conversationKey &&
+    sourceChannel === "vellum";
+  const deferBootstrapCleanup =
+    mintConversation && requestedRiskThreshold !== undefined;
   if (inboundConversationId !== undefined) {
     const existing = getConversation(inboundConversationId);
     if (!existing) {
@@ -1940,7 +1953,7 @@ export async function handleSendMessage(
     const resolvedConversationKey =
       conversationKey && conversationKey.length > 0
         ? conversationKey
-        : sourceChannel === "vellum"
+        : mintConversation
           ? crypto.randomUUID()
           : `default:${sourceChannel}:${sourceInterface}`;
     // An onboarding flow may supply an explicit title for the conversation it
@@ -1955,26 +1968,51 @@ export async function handleSendMessage(
       // attributed from the moment it exists rather than on its first
       // message.
       origin: sourceChannel,
+      ...(deferBootstrapCleanup ? { deferBootstrapCleanup: true } : {}),
     });
   }
 
   if (requestedRiskThreshold !== undefined) {
-    const result = await ipcCall("set_conversation_threshold", {
-      conversationId: mapping.conversationId,
-      threshold: requestedRiskThreshold,
-    });
-    if (result === undefined) {
-      log.error(
-        {
-          conversationId: mapping.conversationId,
-          threshold: requestedRiskThreshold,
-        },
-        "Failed to set conversation risk threshold override via gateway IPC",
-      );
-      throw new InternalError("Failed to persist risk threshold override");
+    try {
+      const result = await ipcCall("set_conversation_threshold", {
+        conversationId: mapping.conversationId,
+        threshold: requestedRiskThreshold,
+      });
+      if (result === undefined) {
+        log.error(
+          {
+            conversationId: mapping.conversationId,
+            threshold: requestedRiskThreshold,
+          },
+          "Failed to set conversation risk threshold override via gateway IPC",
+        );
+        throw new InternalError("Failed to persist risk threshold override");
+      }
+    } catch (error) {
+      // Keyed chats can have concurrent senders. Only this request owns an
+      // unannounced, server-minted chat with no messages.
+      if (mintConversation && mapping.created) {
+        try {
+          if (hasMessages(mapping.conversationId)) {
+            recordStandardConversationCreated();
+          } else {
+            deleteConversation(mapping.conversationId);
+          }
+        } catch (cleanupError) {
+          log.error(
+            { err: cleanupError, conversationId: mapping.conversationId },
+            "Failed to roll back conversation after risk threshold failure",
+          );
+        }
+      }
+      throw error;
     }
   }
 
+  if (deferBootstrapCleanup && mapping.created) {
+    recordStandardConversationCreated();
+  }
+
   const smDeps = deps.sendMessageDeps;
 
   // Notify all connected clients that the conversation list changed when
@@ -2475,6 +2513,7 @@ export async function handleSendMessage(
         clientMetadata,
       ),
       isInteractive,
+      locale,
       sourceActorPrincipalId,
       transport,
       clientMessageId,
@@ -3159,6 +3198,7 @@ export async function handleSendMessage(
           onEvent: broadcastMessage,
           isInteractive,
           isUserMessage: true,
+          locale,
           turnTrustContext,
           ...(body.hidden === true ? { isHiddenPrompt: true } : {}),
         })

package/src/runtime/routes/identity-routes.ts

@@ -160,6 +160,7 @@ async function getDetailedHealth() {
       retryLastTurn: true,
       appPins: true,
       chatsSettings: true,
+      composerSettings: true,
     },
     ...(profiler ? { profiler } : {}),
     ...migrationHealthFields,
@@ -280,6 +281,7 @@ const healthCapabilitiesSchema = z.object({
   retryLastTurn: z.boolean(),
   appPins: z.boolean(),
   chatsSettings: z.boolean().optional(),
+  composerSettings: z.boolean().optional(),
 });
 
 const healthDiskSchema = z.object({

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -19,6 +19,7 @@ import {
 } from "../../../contacts/guardian-delivery-reader.js";
 import { isConversationBusyError } from "../../../daemon/conversation-messaging.js";
 import type { TrustContext } from "../../../daemon/trust-context-types.js";
+import { negotiateLocale } from "../../../i18n/index.js";
 import type { ProviderMessageMetadata } from "../../../messaging/provider-message-metadata.js";
 import {
   channelActivityRefreshMs,
@@ -288,6 +289,9 @@ export function processChannelMessageInBackground(
           trustContext: trustCtx,
           author: trustCtx,
           isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
+          ...(sourceLanguageCode
+            ? { locale: negotiateLocale([sourceLanguageCode]) }
+            : {}),
           ...(displayContent !== undefined ? { displayContent } : {}),
           ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
           ...(slackInbound ? { slackInbound } : {}),

package/src/runtime/routes/index.ts

@@ -44,6 +44,7 @@ import { ROUTES as CHANNEL_SEND_ROUTES } from "./channel-send-routes.js";
 import { ROUTES as CHANNEL_VERIFICATION_ROUTES } from "./channel-verification-routes.js";
 import { ROUTES as CHATGPT_SUBSCRIPTION_AUTH_ROUTES } from "./chatgpt-subscription-auth-routes.js";
 import { ROUTES as CLIENT_ROUTES } from "./client-routes.js";
+import { ROUTES as COMPOSER_SETTINGS_ROUTES } from "./composer-settings-routes.js";
 import { ROUTES as CONSOLIDATION_ROUTES } from "./consolidation-routes.js";
 import { CONTACT_PROMPT_ROUTES } from "./contact-prompt-routes.js";
 import { ROUTES as CONTACT_ROUTES } from "./contact-routes.js";
@@ -199,6 +200,7 @@ export const ROUTES: RouteDefinition[] = [
   ...BTW_ROUTES,
   ...BRAIN_GRAPH_ROUTES,
   ...CLIENT_ROUTES,
+  ...COMPOSER_SETTINGS_ROUTES,
   ...CONTENT_SOURCE_ROUTES,
   ...CONTACT_PROMPT_ROUTES,
   ...GUARDIAN_FORM_ROUTES,

package/src/runtime/routes/migration-routes.ts

@@ -2056,7 +2056,9 @@ export async function handleMigrationPreflightFromGcs({
   }
 
   const bytes = new Uint8Array(await upstream.arrayBuffer());
-  const validationResult = validateVBundle(bytes);
+  const validationResult = validateVBundle(bytes, {
+    enforceStreamingLimits: true,
+  });
 
   if (!validationResult.is_valid || !validationResult.manifest) {
     return {

package/src/runtime/routes/types.ts

@@ -186,7 +186,7 @@ export interface RouteDefinition {
   endpoint: string;
   method: string;
   /**
-   * Scope + principal-type policy for this route.
+   * Scope, principal-type, and trust-class policy for this route.
    *
    * `null` means the route is intentionally unprotected — health
    * probes, public capability-token endpoints, and the like.
@@ -196,6 +196,9 @@ export interface RouteDefinition {
    * (`enforcePolicy()`) and the gateway IPC proxy (via the route
    * schema served from `get_route_schema`) read this field.
    *
+   * Its optional `allowedTrustClasses` names whose turn may call the
+   * route; absent means guardian only.
+   *
    * Required so the type system catches every new route — there is
    * no separate registry to forget to update.
    */

package/src/runtime/shared-principal-lookup.ts

@@ -0,0 +1,235 @@
+/**
+ * Trust-class lookup for a shared-conversation principal.
+ *
+ * `local-principal-trust.ts` asks the gateway one question about a `vellum`
+ * principal (is it the guardian?), so it cannot classify a contact. Contacts
+ * in shared conversations live on the `vellum-shared` channel, and this module
+ * asks the question every other channel asks: the gateway's canonical
+ * per-actor classifier (`resolve_inbound_trust`, reached through
+ * {@link readInboundTrust}), with `vellum-shared` as the channel and the
+ * principal as the actor id. Classification stays gateway-owned; nothing
+ * here re-derives it from ACL rows.
+ *
+ * Results are cached per principal behind a short TTL and coalesced
+ * single-flight: the callers this exists for run per request, where
+ * {@link readInboundTrust} caches nothing because it serves call setup. A
+ * revoked contact keeps resolving from cache until the entry expires; callers
+ * that cannot tolerate that read {@link resolveSharedPrincipalFresh}, which
+ * also discards the entry for every later caller.
+ *
+ * Failures resolve `unknown` and are not cached: an unreachable gateway, a
+ * malformed response, and the resolver's own could-not-vouch sentinel all
+ * fail closed and are retried on the next call.
+ */
+
+import type { TrustClass } from "@vellumai/gateway-client";
+
+import { readInboundTrust } from "../calls/inbound-trust-reader.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("shared-principal-lookup");
+
+/** Bounds staleness after a revoke; callers needing none read fresh. */
+const CACHE_TTL_MS = 30_000;
+
+/** Keeps the map from growing without limit across principals. */
+export const MAX_ENTRIES = 2000;
+
+export interface SharedPrincipalTrust {
+  trustClass: TrustClass;
+  contactId?: string;
+  displayName?: string;
+}
+
+// Frozen: returned to every failing caller, so a mutation would travel.
+const UNKNOWN: SharedPrincipalTrust = Object.freeze({ trustClass: "unknown" });
+
+interface PrincipalState {
+  trust?: SharedPrincipalTrust;
+  expiresAt?: number;
+  inFlight?: Promise<SharedPrincipalTrust>;
+  /** Bumped when a read starts; only the newest read may write its result. */
+  generation: number;
+  /** Reads currently in flight for this principal. */
+  active: number;
+}
+
+const states = new Map<string, PrincipalState>();
+
+function stateFor(principalId: string): PrincipalState {
+  const existing = states.get(principalId);
+  if (existing) {
+    return existing;
+  }
+  const created: PrincipalState = { generation: 0, active: 0 };
+  states.set(principalId, created);
+  return created;
+}
+
+/** Drops a principal holding neither a cached verdict nor a live read. */
+function prune(principalId: string): void {
+  const state = states.get(principalId);
+  if (state && state.active === 0 && state.trust === undefined) {
+    states.delete(principalId);
+  }
+}
+
+/**
+ * Evicts idle principals, oldest first, until the map holds at most `limit`.
+ *
+ * A burst of distinct principals can push the map past MAX_ENTRIES: every
+ * entry is mid-read, so nothing is evictable, and the insert happens anyway
+ * rather than refusing the caller. Nothing else would bring the map back
+ * down, so every settling read trims too, not just the next insert.
+ */
+function trimTo(limit: number): void {
+  if (states.size <= limit) {
+    return;
+  }
+  for (const [key, state] of states) {
+    if (state.active > 0) {
+      continue;
+    }
+    states.delete(key);
+    if (states.size <= limit) {
+      return;
+    }
+  }
+}
+
+/** Makes room for a principal the map does not hold yet. */
+function evictIfFull(principalId: string): void {
+  if (states.has(principalId)) {
+    return;
+  }
+  trimTo(MAX_ENTRIES - 1);
+}
+
+async function fetchTrust(
+  principalId: string,
+): Promise<{ trust: SharedPrincipalTrust; cacheable: boolean }> {
+  const result = await readInboundTrust({
+    channelType: "vellum-shared",
+    actorExternalId: principalId,
+  });
+
+  if (!result.ok) {
+    log.warn(
+      { principalId },
+      "shared principal trust unresolved: gateway read failed",
+    );
+    return { trust: UNKNOWN, cacheable: false };
+  }
+
+  const { verdict } = result;
+
+  if (verdict.resolutionFailed) {
+    log.warn(
+      { principalId },
+      "shared principal trust unresolved: gateway could not vouch",
+    );
+    return { trust: UNKNOWN, cacheable: false };
+  }
+
+  const trust: SharedPrincipalTrust = { trustClass: verdict.trustClass };
+  if (verdict.contactId !== undefined) {
+    trust.contactId = verdict.contactId;
+  }
+  const displayName = verdict.memberDisplayName ?? verdict.guardianDisplayName;
+  if (displayName !== undefined) {
+    trust.displayName = displayName;
+  }
+  return { trust, cacheable: true };
+}
+
+function read(
+  principalId: string,
+  forceRefresh: boolean,
+): Promise<SharedPrincipalTrust> {
+  const key = principalId.trim();
+  if (!key) {
+    return Promise.resolve(UNKNOWN);
+  }
+
+  if (!forceRefresh) {
+    const cached = states.get(key);
+    if (
+      cached?.trust &&
+      cached.expiresAt !== undefined &&
+      cached.expiresAt > Date.now()
+    ) {
+      return Promise.resolve(cached.trust);
+    }
+    if (cached?.inFlight) {
+      return cached.inFlight;
+    }
+  }
+
+  evictIfFull(key);
+  const state = stateFor(key);
+  if (forceRefresh) {
+    // The forced read supersedes the cached verdict, so a failed refresh
+    // cannot leave the pre-revoke answer serving until the TTL runs out.
+    state.trust = undefined;
+    state.expiresAt = undefined;
+  }
+  state.generation += 1;
+  state.active += 1;
+  const generation = state.generation;
+
+  const promise = fetchTrust(key)
+    .then(({ trust, cacheable }) => {
+      // A read that started earlier must not overwrite a newer verdict: a
+      // fresh read racing an in-flight cached read would otherwise restore
+      // the pre-revoke answer for the rest of the TTL.
+      if (cacheable && state.generation === generation) {
+        state.trust = trust;
+        state.expiresAt = Date.now() + CACHE_TTL_MS;
+      }
+      return trust;
+    })
+    .finally(() => {
+      state.active -= 1;
+      if (state.inFlight === promise) {
+        state.inFlight = undefined;
+      }
+      prune(key);
+      trimTo(MAX_ENTRIES);
+    });
+
+  state.inFlight = promise;
+  return promise;
+}
+
+/**
+ * Trust class for a shared-conversation principal, from cache when fresh.
+ * Resolves `unknown` for an unknown, revoked, or blocked principal, and for
+ * any read the gateway could not complete.
+ */
+export function resolveSharedPrincipal(
+  principalId: string,
+): Promise<SharedPrincipalTrust> {
+  return read(principalId, false);
+}
+
+/**
+ * Uncached variant of {@link resolveSharedPrincipal}, for callers whose threat
+ * model is the stale entry itself. Discards the cached entry when it starts,
+ * so cached reads made while it is pending share its result, and repopulates
+ * the cache on success.
+ */
+export function resolveSharedPrincipalFresh(
+  principalId: string,
+): Promise<SharedPrincipalTrust> {
+  return read(principalId, true);
+}
+
+/** Test-only: number of principals currently held. */
+export function __sharedPrincipalCacheSizeForTest(): number {
+  return states.size;
+}
+
+/** Test-only: reset cache + in-flight state for deterministic test runs. */
+export function __resetSharedPrincipalCacheForTest(): void {
+  states.clear();
+}

package/src/tools/host-terminal/host-shell.ts

@@ -486,7 +486,7 @@ export const hostShellTool = {
       // Only the first handler to fire should wake the agent.
       let completed = false;
 
-      child.on("close", (code) => {
+      child.on("close", (code, signal) => {
         if (completed) {
           return;
         }
@@ -494,6 +494,7 @@ export const hostShellTool = {
         clearTimeout(timer);
         const result = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
+          signal: aborted ? null : signal,
         });
         // Cancel takes precedence over the SIGKILL-induced error result.
         const status = aborted
@@ -667,12 +668,13 @@ export const hostShellTool = {
         }
       }
 
-      child.on("close", (code) => {
+      child.on("close", (code, signal) => {
         clearTimeout(timer);
         context.signal?.removeEventListener("abort", onAbort);
 
         const result = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
+          signal: context.signal?.aborted ? null : signal,
         });
 
         resolve({

package/src/tools/shared/shell-output.test.ts

@@ -112,3 +112,45 @@ describe("formatShellOutput truncation", () => {
     expect(result.content).toContain(OUTPUT_TRUNCATED_TAG);
   });
 });
+
+describe("formatShellOutput kill reporting", () => {
+  test("names the signal and hints at memory for a SIGKILL", () => {
+    const result = formatShellOutput("", "", null, false, 120, {
+      signal: "SIGKILL",
+    });
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('<command_killed signal="SIGKILL" />');
+    expect(result.content).toContain("out of memory");
+    expect(result.content).not.toContain('code="null"');
+    expect(result.status).toBe('<command_killed signal="SIGKILL" />');
+  });
+
+  test("keeps the output produced before the kill", () => {
+    const result = formatShellOutput("partial", "", null, false, 120, {
+      signal: "SIGTERM",
+    });
+    expect(result.content.startsWith("partial\n")).toBe(true);
+    expect(result.content).toContain("killed by SIGTERM");
+    expect(result.content).not.toContain("out of memory");
+  });
+
+  test("does not infer a kill from a 128 + n exit code", () => {
+    const result = formatShellOutput("", "Killed", 137, false, 120);
+    expect(result.content).toBe("Killed");
+    expect(result.status).toBe('<command_exit code="137" />');
+  });
+
+  test("leaves a timeout framed as a timeout", () => {
+    const result = formatShellOutput("", "", null, true, 120, {
+      signal: "SIGKILL",
+    });
+    expect(result.content).toContain("<command_timeout");
+    expect(result.content).not.toContain("command_killed");
+  });
+
+  test("leaves an ordinary failure unchanged", () => {
+    const result = formatShellOutput("", "boom", 1, false, 120);
+    expect(result.content).toBe("boom");
+    expect(result.status).toBe('<command_exit code="1" />');
+  });
+});

package/src/tools/shared/shell-output.ts

@@ -13,6 +13,15 @@ export interface ShellOutputResult {
   isError: boolean;
 }
 
+function describeKill(signal: NodeJS.Signals): string {
+  const tag = `<command_killed signal="${signal}" />`;
+  const hint =
+    signal === "SIGKILL"
+      ? " A SIGKILL the command did not send itself usually means the system ran out of memory."
+      : "";
+  return `${tag}\nCommand was killed by ${signal} before it finished.${hint}`;
+}
+
 type StdioStream = "stdout" | "stderr";
 
 type DataListener = (data: Buffer | string) => void;
@@ -34,7 +43,11 @@ export function formatShellOutput(
   code: number | null,
   timedOut: boolean,
   timeoutSec: number,
-  options?: { truncated?: boolean; started?: boolean },
+  options?: {
+    truncated?: boolean;
+    started?: boolean;
+    signal?: NodeJS.Signals | null;
+  },
 ): ShellOutputResult {
   if (options?.started === false) {
     return {
@@ -66,6 +79,12 @@ export function formatShellOutput(
     statusParts.push(OUTPUT_TRUNCATED_TAG);
   }
 
+  const killSignal = timedOut ? null : (options?.signal ?? null);
+  if (killSignal) {
+    output += (output ? "\n" : "") + describeKill(killSignal);
+    statusParts.push(`<command_killed signal="${killSignal}" />`);
+  }
+
   if (!output.trim()) {
     if (code === 0) {
       output = "<command_completed />";
@@ -74,7 +93,7 @@ export function formatShellOutput(
       output = `${exitTag}\nCommand failed with exit code ${code}. No stdout or stderr output was produced.`;
       statusParts.push(exitTag);
     }
-  } else if (code !== 0 && !timedOut) {
+  } else if (code !== 0 && !timedOut && !killSignal) {
     statusParts.push(`<command_exit code="${code}" />`);
   }
 
@@ -148,7 +167,7 @@ export class BoundedStdioCollector {
     code: number | null,
     timedOut: boolean,
     timeoutSec: number,
-    options?: { started?: boolean },
+    options?: { started?: boolean; signal?: NodeJS.Signals | null },
   ): ShellOutputResult {
     return formatShellOutput(
       Buffer.concat(this.stdoutParts).toString(),
@@ -156,7 +175,11 @@ export class BoundedStdioCollector {
       code,
       timedOut,
       timeoutSec,
-      { truncated: this.truncated, started: options?.started },
+      {
+        truncated: this.truncated,
+        started: options?.started,
+        signal: options?.signal,
+      },
     );
   }
 }

package/src/tools/skills/execute.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { RiskLevel } from "../../permissions/types.js";
 import { isUnparseableToolArgs } from "../../providers/unparseable-tool-args.js";
 import { declareDaemonActivityField } from "../schema-transforms.js";
@@ -9,6 +11,9 @@ import type {
 
 /** Envelope keys consumed by `skill_execute` itself, never inner-tool params. */
 const SKILL_EXECUTE_ENVELOPE_KEYS = new Set(["tool", "input", "activity"]);
+const recoveredSkillExecuteEnvelopeSchema = z
+  .object({ tool: z.string() })
+  .passthrough();
 
 /**
  * Recover a `skill_execute` envelope that the provider layer wrapped under the
@@ -30,13 +35,11 @@ export function recoverSkillExecuteEnvelope(
     return envelope;
   }
   try {
-    const parsed: unknown = JSON.parse(envelope._raw);
-    if (
-      parsed != null &&
-      typeof parsed === "object" &&
-      !Array.isArray(parsed)
-    ) {
-      return parsed as Record<string, unknown>;
+    const recovered = recoveredSkillExecuteEnvelopeSchema.safeParse(
+      JSON.parse(envelope._raw),
+    );
+    if (recovered.success) {
+      return recovered.data;
     }
   } catch {
     // Genuinely malformed/truncated — leave wrapped for the retryable error.

package/src/tools/terminal/shell.ts

@@ -374,6 +374,7 @@ export const shellTool = {
 
         const fmtResult = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
+          signal: aborted ? null : signal,
         });
 
         const status: BackgroundToolCompletedEvent["status"] = aborted
@@ -585,6 +586,7 @@ export const shellTool = {
 
         const fmtResult = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
+          signal: context.signal?.aborted ? null : signal,
         });
 
         resolve({