@vellumai/assistant 0.3.15 → 0.3.16

package/src/daemon/tls-certs.ts

@@ -42,6 +42,8 @@ function computeFingerprint(cert: X509Certificate): string {
   return cert.fingerprint256.replace(/:/g, '').toLowerCase();
 }
 
+type CertStatus = 'valid' | 'approaching_expiry' | 'invalid';
+
 /**
  * Check whether an existing cert+key pair is valid:
  * - All three files exist (cert, key, fingerprint)
@@ -49,8 +51,12 @@ function computeFingerprint(cert: X509Certificate): string {
  * - Cert is not expired
  * - Fingerprint file exists and matches the cert
  * - Private key is valid and matches the certificate
+ *
+ * Returns 'valid' if the cert is good, 'approaching_expiry' if it's still usable
+ * but expires within 30 days (renewal should be attempted), or 'invalid' if the
+ * cert cannot be used at all.
  */
-async function isExistingCertValid(): Promise<boolean> {
+async function checkCertStatus(): Promise<CertStatus> {
   const certPath = getTlsCertPath();
   const keyPath = getTlsKeyPath();
   const fpPath = getTlsFingerprintPath();
@@ -63,7 +69,7 @@ async function isExistingCertValid(): Promise<boolean> {
   ]);
 
   if (!certExists || !keyExists || !fpExists) {
-    return false;
+    return 'invalid';
   }
 
   try {
@@ -76,17 +82,18 @@ async function isExistingCertValid(): Promise<boolean> {
     const x509 = new X509Certificate(certPem);
 
     // Check expiration
+    const now = new Date();
     const notAfter = new Date(x509.validTo);
-    if (notAfter <= new Date()) {
+    if (notAfter <= now) {
       log.info('Existing TLS certificate has expired, will regenerate');
-      return false;
+      return 'invalid';
     }
 
     // Check fingerprint matches
     const actualFp = computeFingerprint(x509);
     if (actualFp !== storedFp.trim()) {
       log.info('TLS fingerprint mismatch, will regenerate');
-      return false;
+      return 'invalid';
     }
 
     // Verify the private key is valid and matches the certificate's public key.
@@ -95,13 +102,20 @@ async function isExistingCertValid(): Promise<boolean> {
     const privateKey = createPrivateKey(keyPem);
     if (!x509.checkPrivateKey(privateKey)) {
       log.info('TLS private key does not match certificate, will regenerate');
-      return false;
+      return 'invalid';
+    }
+
+    // Cert is structurally valid — check if it's approaching expiry
+    const thirtyDaysMs = 30 * 24 * 60 * 60 * 1000;
+    if (notAfter.getTime() - now.getTime() < thirtyDaysMs) {
+      log.info('TLS certificate approaching expiry, will attempt renewal');
+      return 'approaching_expiry';
     }
 
-    return true;
+    return 'valid';
   } catch (err) {
     log.warn({ err }, 'Failed to validate existing TLS certificate, will regenerate');
-    return false;
+    return 'invalid';
   }
 }
 
@@ -125,8 +139,9 @@ export async function ensureTlsCert(): Promise<{ cert: string; key: string; fing
   const keyPath = getTlsKeyPath();
   const fpPath = getTlsFingerprintPath();
 
-  // Check if existing cert is still valid
-  if (await isExistingCertValid()) {
+  const status = await checkCertStatus();
+
+  if (status === 'valid') {
     const [cert, key, fingerprint] = await Promise.all([
       readFile(certPath, 'utf-8'),
       readFile(keyPath, 'utf-8'),
@@ -136,7 +151,34 @@ export async function ensureTlsCert(): Promise<{ cert: string; key: string; fing
     return { cert, key, fingerprint: fingerprint.trim() };
   }
 
-  // Generate new cert
+  if (status === 'approaching_expiry') {
+    // Buffer existing cert/key/fingerprint before attempting renewal.
+    // generateNewCert() overwrites key.pem in-place, so if it fails mid-flight
+    // (e.g., key written but cert generation fails), reading from disk in the
+    // catch block would return a mismatched key/cert pair.
+    const [existingCert, existingKey, existingFp] = await Promise.all([
+      readFile(certPath, 'utf-8'),
+      readFile(keyPath, 'utf-8'),
+      readFile(fpPath, 'utf-8'),
+    ]);
+    try {
+      return await generateNewCert(tlsDir, certPath, keyPath, fpPath);
+    } catch (err) {
+      log.warn({ err }, 'Proactive TLS renewal failed, continuing with existing certificate');
+      return { cert: existingCert, key: existingKey, fingerprint: existingFp.trim() };
+    }
+  }
+
+  // status === 'invalid' — must regenerate, no fallback
+  return await generateNewCert(tlsDir, certPath, keyPath, fpPath);
+}
+
+async function generateNewCert(
+  tlsDir: string,
+  certPath: string,
+  keyPath: string,
+  fpPath: string,
+): Promise<{ cert: string; key: string; fingerprint: string }> {
   log.info('Generating new self-signed TLS certificate');
   await mkdir(tlsDir, { recursive: true });
 
@@ -151,13 +193,13 @@ export async function ensureTlsCert(): Promise<{ cert: string; key: string; fing
     throw new Error(`Failed to generate TLS key: ${stderr}`);
   }
 
-  // Generate self-signed cert (10-year validity)
+  // Generate self-signed cert (1-year validity)
   const certProc = Bun.spawn(
     [
       'openssl', 'req', '-new', '-x509',
       '-key', keyPath,
       '-out', certPath,
-      '-days', '3650',
+      '-days', '365',
       '-subj', '/CN=Vellum Daemon',
     ],
     { stdout: 'pipe', stderr: 'pipe' },

package/src/daemon/tool-side-effects.ts

@@ -7,6 +7,7 @@
  * registry entry instead of another if/else branch.
  */
 
+import { normalizeActivationKey } from './handlers/config-voice.js';
 import { updatePublishedAppDeployment } from '../services/published-app-updater.js';
 import { openAppViaSurface } from '../tools/apps/open-proxy.js';
 import type { ToolExecutionResult } from '../tools/types.js';
@@ -74,11 +75,6 @@ registerHook('app_update', (_name, input, _result, { ctx, broadcastToAllClients
   }
 });
 
-// Tell the client to open/focus the tasks window when the model lists tasks
-registerHook('task_list_show', (_name, _input, _result, { ctx }) => {
-  ctx.sendToClient({ type: 'open_tasks_window' });
-});
-
 // Broadcast tasks_changed so connected clients (e.g. macOS Tasks window)
 // auto-refresh when the LLM mutates the task queue via tools
 registerHook(
@@ -101,6 +97,18 @@ registerHook(
   },
 );
 
+// Broadcast activation key change to all connected clients so every
+// macOS/iOS instance picks up the new setting immediately.
+registerHook('voice_config_update', (_name, input, _result, { broadcastToAllClients }) => {
+  const key = input.activation_key as string | undefined;
+  if (key) {
+    const normalized = normalizeActivationKey(key);
+    if (normalized.ok) {
+      broadcastToAllClients?.({ type: 'client_settings_update', key: 'activationKey', value: normalized.value });
+    }
+  }
+});
+
 // ── Runner ───────────────────────────────────────────────────────────
 
 /**

package/src/gallery/default-gallery.ts

@@ -107,8 +107,8 @@ const focusTimerHtml = `<!DOCTYPE html>
   <div class="mode-label" id="modeLabel">Work Session</div>
   <div class="timer-display" id="timerDisplay">25:00</div>
   <div class="controls">
-    <button class="btn-primary" id="startBtn" onclick="toggleTimer()">Start</button>
-    <button class="btn-secondary" id="resetBtn" onclick="resetTimer()">Reset</button>
+    <button class="btn-primary" id="startBtn">Start</button>
+    <button class="btn-secondary" id="resetBtn">Reset</button>
   </div>
   <div class="stats">
     <div class="stat-item">
@@ -184,6 +184,9 @@ const focusTimerHtml = `<!DOCTYPE html>
     updateDisplay();
   }
 
+  document.getElementById('startBtn').addEventListener('click', toggleTimer);
+  document.getElementById('resetBtn').addEventListener('click', resetTimer);
+
   updateDisplay();
 </script>
 </body>
@@ -334,8 +337,8 @@ const habitTrackerHtml = `<!DOCTYPE html>
   <h1>Habit Tracker</h1>
 </div>
 <div class="add-form">
-  <input type="text" id="habitInput" placeholder="Add a new habit..." onkeydown="if(event.key==='Enter')addHabit()">
-  <button class="btn-primary" onclick="addHabit()">Add</button>
+  <input type="text" id="habitInput" placeholder="Add a new habit...">
+  <button class="btn-primary" id="addHabitBtn">Add</button>
 </div>
 <div class="days-header">
   <div></div>
@@ -387,12 +390,12 @@ const habitTrackerHtml = `<!DOCTYPE html>
       html += '<div class="habit-row">';
       html += '<div style="display:flex;align-items:center;gap:8px">';
       html += '<span class="habit-name">' + escapeHtml(record.data.name) + '</span>';
-      html += '<button class="delete-btn" onclick="deleteHabit(\\''+record.id+'\\')">x</button>';
+      html += '<button class="delete-btn" data-delete-habit="'+record.id+'">x</button>';
       html += '</div>';
       dates.forEach(function(date) {
         var checked = completedDates.indexOf(date) !== -1;
         html += '<div class="check-cell">';
-        html += '<button class="check-btn' + (checked ? ' checked' : '') + '" onclick="toggleDate(\\''+record.id+'\\',\\''+date+'\\')">';
+        html += '<button class="check-btn' + (checked ? ' checked' : '') + '" data-toggle-habit="'+record.id+'" data-toggle-date="'+date+'">';
         html += checked ? '\\u2713' : '';
         html += '</button></div>';
       });
@@ -438,6 +441,17 @@ const habitTrackerHtml = `<!DOCTYPE html>
     });
   }
 
+  document.getElementById('habitInput').addEventListener('keydown', function(event) {
+    if (event.key === 'Enter') addHabit();
+  });
+  document.getElementById('addHabitBtn').addEventListener('click', addHabit);
+  document.getElementById('habitsList').addEventListener('click', function(event) {
+    var btn = event.target.closest('[data-delete-habit]');
+    if (btn) { deleteHabit(btn.getAttribute('data-delete-habit')); return; }
+    var toggle = event.target.closest('[data-toggle-habit]');
+    if (toggle) { toggleDate(toggle.getAttribute('data-toggle-habit'), toggle.getAttribute('data-toggle-date')); }
+  });
+
   initDates();
   loadHabits();
 </script>
@@ -629,9 +643,9 @@ const expenseTrackerHtml = `<!DOCTYPE html>
     <option value="entertainment">Entertainment</option>
     <option value="other">Other</option>
   </select>
-  <input type="text" class="input-desc" id="descInput" placeholder="Description..." onkeydown="if(event.key==='Enter')addExpense()">
+  <input type="text" class="input-desc" id="descInput" placeholder="Description...">
   <input type="date" class="input-date" id="dateInput">
-  <button class="btn-primary" onclick="addExpense()">Add</button>
+  <button class="btn-primary" id="addExpenseBtn">Add</button>
 </div>
 <div class="section-title">By Category</div>
 <div class="categories-grid" id="categoriesGrid"></div>
@@ -693,7 +707,7 @@ const expenseTrackerHtml = `<!DOCTYPE html>
         listHtml += '<div class="expense-meta">' + escapeHtml(r.data.category || 'other') + ' \\u00B7 ' + escapeHtml(r.data.date || '') + '</div>';
         listHtml += '</div>';
         listHtml += '<div class="expense-amount">$' + amt.toFixed(2) + '</div>';
-        listHtml += '<button class="delete-btn" onclick="deleteExpense(\\''+r.id+'\\')">x</button>';
+        listHtml += '<button class="delete-btn" data-delete-expense="'+r.id+'">x</button>';
         listHtml += '</div>';
       });
     }
@@ -724,6 +738,15 @@ const expenseTrackerHtml = `<!DOCTYPE html>
     });
   }
 
+  document.getElementById('descInput').addEventListener('keydown', function(event) {
+    if (event.key === 'Enter') addExpense();
+  });
+  document.getElementById('addExpenseBtn').addEventListener('click', addExpense);
+  document.getElementById('expenseList').addEventListener('click', function(event) {
+    var btn = event.target.closest('[data-delete-expense]');
+    if (btn) { deleteExpense(btn.getAttribute('data-delete-expense')); }
+  });
+
   loadExpenses();
 </script>
 </body>

package/src/influencer/client.ts

@@ -47,6 +47,7 @@
 
 import type { ExtensionCommand, ExtensionResponse } from '../browser-extension-relay/protocol.js';
 import { extensionRelayServer } from '../browser-extension-relay/server.js';
+import { getGatewayInternalBaseUrl } from '../config/env.js';
 import { readHttpToken } from '../util/platform.js';
 
 // ---------------------------------------------------------------------------
@@ -133,7 +134,7 @@ async function sendRelayCommand(command: Record<string, unknown>): Promise<Exten
     );
   }
 
-  const resp = await fetch('http://127.0.0.1:7821/v1/browser-relay/command', {
+  const resp = await fetch(`${getGatewayInternalBaseUrl()}/v1/browser-relay/command`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',