@vellumai/assistant 0.3.27 → 0.4.0

package/src/daemon/ipc-contract-inventory.json

@@ -267,6 +267,7 @@
     "message_dequeued",
     "message_queued",
     "message_queued_deleted",
+    "message_request_complete",
     "model_info",
     "navigate_settings",
     "notification_intent",

package/src/daemon/lifecycle.ts

@@ -59,7 +59,6 @@ import type { ServerMessage } from './ipc-protocol.js';
 import { initializeProvidersAndTools, registerMessagingProviders,registerWatcherProviders } from './providers-setup.js';
 import { seedInterfaceFiles } from './seed-files.js';
 import { DaemonServer } from './server.js';
-import { setApprovalConversationGenerator, setGuardianActionCopyGenerator, setGuardianFollowUpConversationGenerator } from './session-process.js';
 import { initSlashPairingContext } from './session-slash.js';
 import { installShutdownHandlers } from './shutdown-handlers.js';
 
@@ -320,21 +319,9 @@ export async function runDaemon(): Promise<void> {
         server.persistAndProcessMessage(conversationId, content, attachmentIds, options, sourceChannel, sourceInterface),
       interfacesDir: getInterfacesDir(),
       approvalCopyGenerator: createApprovalCopyGenerator(),
-      approvalConversationGenerator: (() => {
-        const gen = createApprovalConversationGenerator();
-        setApprovalConversationGenerator(gen);
-        return gen;
-      })(),
-      guardianActionCopyGenerator: (() => {
-        const gen = createGuardianActionCopyGenerator();
-        setGuardianActionCopyGenerator(gen);
-        return gen;
-      })(),
-      guardianFollowUpConversationGenerator: (() => {
-        const gen = createGuardianFollowUpConversationGenerator();
-        setGuardianFollowUpConversationGenerator(gen);
-        return gen;
-      })(),
+      approvalConversationGenerator: createApprovalConversationGenerator(),
+      guardianActionCopyGenerator: createGuardianActionCopyGenerator(),
+      guardianFollowUpConversationGenerator: createGuardianFollowUpConversationGenerator(),
       sendMessageDeps: {
         getOrCreateSession: (conversationId) =>
           server.getSessionForMessages(conversationId),
@@ -390,6 +377,25 @@ export async function runDaemon(): Promise<void> {
       socketPath: getSocketPath(),
     });
 
+    // Download embedding runtime in background (non-blocking).
+    // If download fails, local embeddings gracefully fall back to cloud backends.
+    void (async () => {
+      try {
+        const { EmbeddingRuntimeManager } = await import('../memory/embedding-runtime-manager.js');
+        const runtimeManager = new EmbeddingRuntimeManager();
+        if (!runtimeManager.isReady()) {
+          log.info('Downloading embedding runtime in background...');
+          await runtimeManager.ensureInstalled();
+          // Reset the localBackendBroken flag so auto mode retries local embeddings
+          const { clearEmbeddingBackendCache } = await import('../memory/embedding-backend.js');
+          clearEmbeddingBackendCache();
+          log.info('Embedding runtime download complete');
+        }
+      } catch (err) {
+        log.warn({ err }, 'Embedding runtime download failed — local embeddings will use cloud fallback');
+      }
+    })();
+
     if (config.auditLog.retentionDays > 0) {
       try {
         rotateToolInvocations(config.auditLog.retentionDays);

package/src/daemon/pairing-store.ts

@@ -1,14 +1,21 @@
 /**
- * In-memory pairing request store with TTL.
+ * Pairing request store with TTL and disk persistence.
  *
  * Each pairing request lives for at most TTL_MS (5 minutes) before
  * being swept as expired. Status transitions:
  *   registered → pending → approved | denied | expired
+ *
+ * Entries are persisted to ~/.vellum/protected/pairing-requests.json
+ * using the same atomic-write pattern as approved-devices-store.ts
+ * so that device bindings survive daemon restarts.
  */
 
 import { createHash, timingSafeEqual } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 
 import { getLogger } from '../util/logger.js';
+import { getRootDir } from '../util/platform.js';
 
 const log = getLogger('pairing-store');
 
@@ -40,11 +47,60 @@ function timingSafeCompare(a: string, b: string): boolean {
   return timingSafeEqual(bufA, bufB);
 }
 
+interface PairingStoreFile {
+  version: 1;
+  requests: PairingRequest[];
+}
+
+function getStorePath(): string {
+  return join(getRootDir(), 'protected', 'pairing-requests.json');
+}
+
+function loadFromDisk(): Map<string, PairingRequest> {
+  const path = getStorePath();
+  if (!existsSync(path)) {
+    return new Map();
+  }
+  try {
+    const raw = readFileSync(path, 'utf-8');
+    const data = JSON.parse(raw) as PairingStoreFile;
+    if (data.version !== 1 || !Array.isArray(data.requests)) {
+      log.warn('Invalid pairing-requests.json format, starting fresh');
+      return new Map();
+    }
+    const map = new Map<string, PairingRequest>();
+    for (const entry of data.requests) {
+      map.set(entry.pairingRequestId, entry);
+    }
+    return map;
+  } catch (err) {
+    log.error({ err }, 'Failed to load pairing-requests.json');
+    return new Map();
+  }
+}
+
+function saveToDisk(requests: Map<string, PairingRequest>): void {
+  const path = getStorePath();
+  const dir = dirname(path);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  const data: PairingStoreFile = {
+    version: 1,
+    requests: Array.from(requests.values()),
+  };
+  const tmpPath = path + '.tmp.' + process.pid;
+  writeFileSync(tmpPath, JSON.stringify(data, null, 2), { mode: 0o600 });
+  renameSync(tmpPath, path);
+  chmodSync(path, 0o600);
+}
+
 export class PairingStore {
   private requests = new Map<string, PairingRequest>();
   private sweepTimer: ReturnType<typeof setInterval> | null = null;
 
   start(): void {
+    this.requests = loadFromDisk();
     this.sweepTimer = setInterval(() => this.sweep(), SWEEP_INTERVAL_MS);
   }
 
@@ -84,6 +140,7 @@ export class PairingStore {
       localLanUrl: params.localLanUrl ?? null,
       createdAt: Date.now(),
     });
+    this.persist();
 
     log.info({ pairingRequestId: params.pairingRequestId }, 'Pairing request registered');
     return { ok: true };
@@ -98,7 +155,7 @@ export class PairingStore {
     pairingSecret: string;
     deviceId: string;
     deviceName: string;
-  }): { ok: true; entry: PairingRequest } | { ok: false; reason: 'not_found' | 'invalid_secret' | 'expired' } {
+  }): { ok: true; entry: PairingRequest } | { ok: false; reason: 'not_found' | 'invalid_secret' | 'expired' | 'already_paired' } {
     const entry = this.requests.get(params.pairingRequestId);
     if (!entry) {
       return { ok: false, reason: 'not_found' };
@@ -113,11 +170,21 @@ export class PairingStore {
       return { ok: false, reason: 'invalid_secret' };
     }
 
-    entry.hashedDeviceId = hashValue(params.deviceId);
+    const hashedDeviceId = hashValue(params.deviceId);
+
+    // If a device has already been bound to this pairing request, reject
+    // attempts from a different device to prevent hijacking.
+    if (entry.hashedDeviceId && !timingSafeCompare(entry.hashedDeviceId, hashedDeviceId)) {
+      log.warn({ pairingRequestId: params.pairingRequestId }, 'Pairing request already bound to a different device');
+      return { ok: false, reason: 'already_paired' };
+    }
+
+    entry.hashedDeviceId = hashedDeviceId;
     entry.deviceName = params.deviceName;
     if (entry.status === 'registered') {
       entry.status = 'pending';
     }
+    this.persist();
 
     return { ok: true, entry };
   }
@@ -130,6 +197,7 @@ export class PairingStore {
     if (!entry) return null;
     entry.status = 'approved';
     entry.bearerToken = bearerToken;
+    this.persist();
     return entry;
   }
 
@@ -140,6 +208,7 @@ export class PairingStore {
     const entry = this.requests.get(pairingRequestId);
     if (!entry) return null;
     entry.status = 'denied';
+    this.persist();
     return entry;
   }
 
@@ -160,19 +229,33 @@ export class PairingStore {
     return timingSafeCompare(entry.hashedPairingSecret, hashedSecret);
   }
 
+  private persist(): void {
+    try {
+      saveToDisk(this.requests);
+    } catch (err) {
+      log.error({ err }, 'Failed to persist pairing requests to disk');
+    }
+  }
+
   private sweep(): void {
     const now = Date.now();
+    let changed = false;
     for (const [id, entry] of this.requests) {
       if (now - entry.createdAt > TTL_MS) {
         if (entry.status !== 'approved') {
           entry.status = 'expired';
+          changed = true;
         }
         // Remove entries older than 2x TTL regardless of status
         if (now - entry.createdAt > TTL_MS * 2) {
           this.requests.delete(id);
+          changed = true;
           log.debug({ pairingRequestId: id }, 'Pairing request swept');
         }
       }
     }
+    if (changed) {
+      this.persist();
+    }
   }
 }

package/src/daemon/server.ts

@@ -10,6 +10,10 @@ import { buildSystemPrompt } from '../config/system-prompt.js';
 import type { HeartbeatService } from '../heartbeat/heartbeat-service.js';
 import { bootstrapHomeBaseAppLink } from '../home-base/bootstrap.js';
 import * as attachmentsStore from '../memory/attachments-store.js';
+import {
+  createCanonicalGuardianRequest,
+  generateCanonicalRequestCode,
+} from '../memory/canonical-guardian-store.js';
 import * as conversationStore from '../memory/conversation-store.js';
 import { provenanceFromGuardianContext } from '../memory/conversation-store.js';
 import { RateLimitProvider } from '../providers/ratelimit.js';
@@ -114,6 +118,20 @@ function makePendingInteractionRegistrar(
           persistentDecisionsAllowed: msg.persistentDecisionsAllowed,
         },
       });
+
+      // Create a canonical guardian request so IPC/HTTP handlers can find it
+      // via applyCanonicalGuardianDecision.
+      createCanonicalGuardianRequest({
+        id: msg.requestId,
+        kind: 'tool_approval',
+        sourceType: 'desktop',
+        sourceChannel: 'vellum',
+        conversationId,
+        toolName: msg.toolName,
+        status: 'pending',
+        requestCode: generateCanonicalRequestCode(),
+        expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString(),
+      });
     } else if (msg.type === 'secret_request') {
       pendingInteractions.register(msg.requestId, {
         session,

package/src/daemon/session-agent-loop-handlers.ts

@@ -330,6 +330,7 @@ export async function handleMessageComplete(
   // Clean assistant content and accumulate directives
   const { cleanedContent, directives: msgDirectives, warnings: msgWarnings } =
     cleanAssistantContent(event.message.content);
+  const cleanedBlocks = cleanedContent as ContentBlock[];
   state.accumulatedDirectives.push(...msgDirectives);
   state.directiveWarnings.push(...msgWarnings);
   if (msgDirectives.length > 0) {
@@ -340,7 +341,7 @@ export async function handleMessageComplete(
   }
 
   // Build content with UI surfaces
-  const contentWithSurfaces: ContentBlock[] = [...cleanedContent as ContentBlock[]];
+  const contentWithSurfaces: ContentBlock[] = [...cleanedBlocks];
   for (const surface of deps.ctx.currentTurnSurfaces) {
     contentWithSurfaces.push({
       type: 'ui_surface',
@@ -371,9 +372,9 @@ export async function handleMessageComplete(
   deps.ctx.currentTurnSurfaces = [];
 
   // Emit trace event
-  const charCount = cleanedContent
-    .filter((b) => (b as Record<string, unknown>).type === 'text')
-    .reduce((sum: number, b) => sum + ((b as { text?: string }).text?.length ?? 0), 0);
+  const charCount = cleanedBlocks
+    .filter((b): b is Extract<ContentBlock, { type: 'text' }> => b.type === 'text')
+    .reduce((sum, b) => sum + b.text.length, 0);
   const toolUseCount = event.message.content
     .filter((b) => b.type === 'tool_use')
     .length;

package/src/daemon/session-agent-loop.ts

@@ -25,6 +25,7 @@ import { stripMemoryRecallMessages } from '../memory/retriever.js';
 import type { PermissionPrompter } from '../permissions/prompter.js';
 import type { ContentBlock,Message } from '../providers/types.js';
 import type { Provider } from '../providers/types.js';
+import { resolveActorTrust } from '../runtime/actor-trust-resolver.js';
 import type { UsageActor } from '../usage/actors.js';
 import { getLogger } from '../util/logger.js';
 import { truncate } from '../util/truncate.js';
@@ -55,9 +56,11 @@ import { raceWithTimeout,stripMediaPayloadsForRetry } from './session-media-retr
 import { prepareMemoryContext } from './session-memory.js';
 import type { MessageQueue } from './session-queue-manager.js';
 import type { QueueDrainReason } from './session-queue-manager.js';
-import type { ActiveSurfaceContext, ChannelCapabilities, ChannelTurnContextParams, GuardianRuntimeContext,InterfaceTurnContextParams } from './session-runtime-assembly.js';
+import type { ActiveSurfaceContext, ChannelCapabilities, ChannelTurnContextParams, GuardianRuntimeContext, InboundActorContext, InterfaceTurnContextParams } from './session-runtime-assembly.js';
 import {
   applyRuntimeInjections,
+  inboundActorContextFromGuardian,
+  inboundActorContextFromTrust,
   stripInjectedContext,
 } from './session-runtime-assembly.js';
 import type { SkillProjectionCache } from './session-skill-tools.js';
@@ -102,6 +105,7 @@ export interface AgentLoopSessionContext {
   channelCapabilities?: ChannelCapabilities;
   commandIntent?: { type: string; payload?: string; languageCode?: string };
   guardianContext?: GuardianRuntimeContext;
+  assistantId?: string;
   voiceCallControlPrompt?: string;
 
   readonly coreToolNames: Set<string>;
@@ -254,7 +258,7 @@ export async function runAgentLoopImpl(
         conflictGate: ctx.conflictGate,
         scopeId: ctx.memoryPolicy.scopeId,
         includeDefaultFallback: ctx.memoryPolicy.includeDefaultFallback,
-        guardianActorRole: ctx.guardianContext?.actorRole,
+        guardianTrustClass: ctx.guardianContext?.trustClass,
         isInteractive: options?.isInteractive ?? (!ctx.hasNoClient && !ctx.headlessLock),
       },
       content,
@@ -349,6 +353,28 @@ export async function runAgentLoopImpl(
       conversationOriginInterface: getConversationOriginInterface(ctx.conversationId),
     };
 
+    // Resolve the inbound actor context for the model's <inbound_actor_context>
+    // block. When the session carries enough identity info, use the unified
+    // actor trust resolver so member status/policy and guardian binding details
+    // are fresh for this turn. The session runtime context remains the source
+    // for policy gating; this block is model-facing grounding metadata.
+    let resolvedInboundActorContext: InboundActorContext | null = null;
+    if (ctx.guardianContext) {
+      const gc = ctx.guardianContext;
+      if (gc.requesterExternalUserId && gc.requesterChatId) {
+        const actorTrust = resolveActorTrust({
+          assistantId: ctx.assistantId ?? 'self',
+          sourceChannel: gc.sourceChannel,
+          externalChatId: gc.requesterChatId,
+          senderExternalUserId: gc.requesterExternalUserId,
+          senderDisplayName: gc.requesterSenderDisplayName,
+        });
+        resolvedInboundActorContext = inboundActorContextFromTrust(actorTrust);
+      } else {
+        resolvedInboundActorContext = inboundActorContextFromGuardian(gc);
+      }
+    }
+
     const isInteractiveResolved = options?.isInteractive ?? (!ctx.hasNoClient && !ctx.headlessLock);
     runMessages = applyRuntimeInjections(runMessages, {
       softConflictInstruction,
@@ -358,7 +384,7 @@ export async function runAgentLoopImpl(
       channelCommandContext: ctx.commandIntent ?? null,
       channelTurnContext,
       interfaceTurnContext,
-      guardianContext: ctx.guardianContext ?? null,
+      inboundActorContext: resolvedInboundActorContext,
       temporalContext,
       voiceCallControlPrompt: ctx.voiceCallControlPrompt ?? null,
       isNonInteractive: !isInteractiveResolved,
@@ -477,7 +503,7 @@ export async function runAgentLoopImpl(
           channelCommandContext: ctx.commandIntent ?? null,
           channelTurnContext,
           interfaceTurnContext,
-          guardianContext: ctx.guardianContext ?? null,
+          inboundActorContext: resolvedInboundActorContext,
           temporalContext,
           voiceCallControlPrompt: ctx.voiceCallControlPrompt ?? null,
           isNonInteractive: !isInteractiveResolved,
@@ -515,7 +541,7 @@ export async function runAgentLoopImpl(
             channelCommandContext: ctx.commandIntent ?? null,
             channelTurnContext,
             interfaceTurnContext,
-            guardianContext: ctx.guardianContext ?? null,
+            inboundActorContext: resolvedInboundActorContext,
             temporalContext,
             voiceCallControlPrompt: ctx.voiceCallControlPrompt ?? null,
             isNonInteractive: !isInteractiveResolved,
@@ -604,7 +630,8 @@ export async function runAgentLoopImpl(
     const newMessages = updatedHistory.slice(preRunHistoryLength).map((msg) => {
       if (msg.role !== 'assistant') return msg;
       const { cleanedContent } = cleanAssistantContent(msg.content);
-      return { ...msg, content: cleanedContent as ContentBlock[] };
+      const cleanedBlocks = cleanedContent as ContentBlock[];
+      return { ...msg, content: cleanedBlocks };
     });
 
     const hasAssistantResponse = newMessages.some((msg) => msg.role === 'assistant');

package/src/daemon/session-lifecycle.ts

@@ -24,30 +24,38 @@ import { resetSkillToolProjection } from './session-skill-tools.js';
 
 const log = getLogger('session-lifecycle');
 
-type GuardianActorRole = GuardianRuntimeContext['actorRole'];
+type GuardianTrustClass = GuardianRuntimeContext['trustClass'];
 
-function parseProvenanceActorRole(metadata: string | null): GuardianActorRole | undefined {
+function parseProvenanceTrustClass(metadata: string | null): GuardianTrustClass | undefined {
   if (!metadata) return undefined;
   try {
-    const parsed = JSON.parse(metadata) as { provenanceActorRole?: unknown };
-    const role = parsed?.provenanceActorRole;
-    if (role === 'guardian' || role === 'non-guardian' || role === 'unverified_channel') {
-      return role;
+    const parsed = JSON.parse(metadata) as {
+      provenanceTrustClass?: unknown;
+      provenanceActorRole?: unknown;
+    };
+    const trustClass = parsed?.provenanceTrustClass;
+    if (trustClass === 'guardian' || trustClass === 'trusted_contact' || trustClass === 'unknown') {
+      return trustClass;
     }
+    // Legacy fallback for rows persisted before provenanceTrustClass existed.
+    const legacyRole = parsed?.provenanceActorRole;
+    if (legacyRole === 'guardian') return 'guardian';
+    if (legacyRole === 'non-guardian') return 'trusted_contact';
+    if (legacyRole === 'unverified_channel') return 'unknown';
   } catch {
     // Ignore malformed metadata and treat as unknown provenance.
   }
   return undefined;
 }
 
-function isUntrustedActorRole(role: GuardianActorRole | undefined): boolean {
-  return role === 'non-guardian' || role === 'unverified_channel';
+function isUntrustedTrustClass(trustClass: GuardianTrustClass | undefined): boolean {
+  return trustClass === 'trusted_contact' || trustClass === 'unknown';
 }
 
 function filterMessagesForUntrustedActor(messages: conversationStore.MessageRow[]): conversationStore.MessageRow[] {
   return messages.filter((m) => {
-    const provenanceRole = parseProvenanceActorRole(m.metadata);
-    return provenanceRole === 'non-guardian' || provenanceRole === 'unverified_channel';
+    const provenanceTrustClass = parseProvenanceTrustClass(m.metadata);
+    return provenanceTrustClass === 'trusted_contact' || provenanceTrustClass === 'unknown';
   });
 }
 
@@ -59,8 +67,8 @@ export interface LoadFromDbContext {
   usageStats: UsageStats;
   contextCompactedMessageCount: number;
   contextCompactedAt: number | null;
-  guardianContext?: { actorRole: GuardianActorRole };
-  loadedHistoryActorRole?: GuardianActorRole;
+  guardianContext?: { trustClass: GuardianTrustClass };
+  loadedHistoryTrustClass?: GuardianTrustClass;
 }
 
 export interface AbortContext {
@@ -89,17 +97,17 @@ export interface DisposeContext extends AbortContext {
 // ── loadFromDb ───────────────────────────────────────────────────────
 
 export async function loadFromDb(ctx: LoadFromDbContext): Promise<void> {
-  const actorRole = ctx.guardianContext?.actorRole;
+  const trustClass = ctx.guardianContext?.trustClass;
   const allDbMessages = conversationStore.getMessages(ctx.conversationId);
-  const dbMessages = isUntrustedActorRole(actorRole)
+  const dbMessages = isUntrustedTrustClass(trustClass)
     ? filterMessagesForUntrustedActor(allDbMessages)
     : allDbMessages;
 
   const conv = conversationStore.getConversation(ctx.conversationId);
-  const contextSummary = !isUntrustedActorRole(actorRole)
+  const contextSummary = !isUntrustedTrustClass(trustClass)
     ? conv?.contextSummary?.trim() || null
     : null;
-  if (isUntrustedActorRole(actorRole)) {
+  if (isUntrustedTrustClass(trustClass)) {
     // Compacted summaries may include trusted/guardian-only details, so we
     // disable summary-based context for untrusted actor views.
     ctx.contextCompactedMessageCount = 0;
@@ -145,7 +153,7 @@ export async function loadFromDb(ctx: LoadFromDbContext): Promise<void> {
     };
   }
 
-  ctx.loadedHistoryActorRole = actorRole;
+  ctx.loadedHistoryTrustClass = trustClass;
 
   log.info({ conversationId: ctx.conversationId, count: ctx.messages.length }, 'Loaded messages from DB');
 }

package/src/daemon/session-memory.ts

@@ -34,7 +34,7 @@ export interface MemoryPrepareContext {
   conflictGate: ConflictGate;
   scopeId: string;
   includeDefaultFallback: boolean;
-  guardianActorRole?: 'guardian' | 'non-guardian' | 'unverified_channel';
+  guardianTrustClass?: 'guardian' | 'trusted_contact' | 'unknown';
   /** When false (e.g. scheduled tasks), skip conflict clarification prompts. */
   isInteractive?: boolean;
 }
@@ -64,7 +64,7 @@ export async function prepareMemoryContext(
   // Provenance-based trust gating: untrusted actors skip all memory operations
   // (recall, dynamic profile, conflict gate) to prevent untrusted content from
   // influencing memory-augmented responses.
-  const isTrustedActor = ctx.guardianActorRole === 'guardian' || ctx.guardianActorRole === undefined;
+  const isTrustedActor = ctx.guardianTrustClass === 'guardian' || ctx.guardianTrustClass === undefined;
 
   if (!isTrustedActor) {
     return {