@vellumai/assistant 0.3.4 → 0.3.6

package/src/daemon/handlers/diagnostics.ts

@@ -61,7 +61,7 @@ const SENSITIVE_KEYS = new Set([
 function redactDeep(value: unknown): unknown {
   if (typeof value === 'string') return redact(value);
   if (Array.isArray(value)) return value.map(redactDeep);
-  if (value !== null && typeof value === 'object') {
+  if (value != null && typeof value === 'object') {
     const out: Record<string, unknown> = {};
     for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
       if (SENSITIVE_KEYS.has(k.toLowerCase())) {

package/src/daemon/handlers/dictation.ts

@@ -0,0 +1,180 @@
+import * as net from 'node:net';
+import { getConfiguredProvider } from '../../providers/provider-send-message.js';
+import type { DictationRequest } from '../ipc-protocol.js';
+import { log, defineHandlers, type HandlerContext } from './shared.js';
+
+// Action verbs that signal the user wants a full agent session rather than inline text
+const ACTION_VERBS = ['slack', 'email', 'send', 'create', 'open', 'search', 'find'];
+
+const MAX_WINDOW_TITLE_LENGTH = 100;
+
+/** Sanitize window title to mitigate prompt injection from attacker-controlled titles (e.g. browser tabs, Slack conversations). */
+function sanitizeWindowTitle(title: string | undefined): string {
+  if (!title) return '';
+  return title
+    .replace(/[<>]/g, '') // strip angle brackets to prevent tag injection
+    .slice(0, MAX_WINDOW_TITLE_LENGTH);
+}
+
+/** Build a delimited app metadata block so the LLM treats it as contextual data, not instructions. */
+function buildAppMetadataBlock(msg: DictationRequest): string {
+  const windowTitle = sanitizeWindowTitle(msg.context.windowTitle);
+  return [
+    '<app_metadata>',
+    `App: ${msg.context.appName} (${msg.context.bundleIdentifier})`,
+    `Window: ${windowTitle}`,
+    '</app_metadata>',
+  ].join('\n');
+}
+
+type DictationMode = 'dictation' | 'command' | 'action';
+
+export function detectDictationMode(msg: DictationRequest): DictationMode {
+  // Command mode: selected text present — treat transcription as a transformation instruction
+  if (msg.context.selectedText && msg.context.selectedText.trim().length > 0) {
+    return 'command';
+  }
+
+  // Action mode: transcription starts with an action verb
+  const firstWord = msg.transcription.trim().split(/\s+/)[0]?.toLowerCase() ?? '';
+  if (ACTION_VERBS.includes(firstWord)) {
+    return 'action';
+  }
+
+  // Dictation mode: cursor is in a text field with no selection — clean up for typing
+  if (msg.context.cursorInTextField) {
+    return 'dictation';
+  }
+
+  // AX focus-role detection in browser editors (for example Gmail compose)
+  // is occasionally incomplete. If we default to action here, normal dictation
+  // gets misrouted into a new chat task. Treat ambiguous context as dictation.
+  return 'dictation';
+}
+
+function buildDictationPrompt(msg: DictationRequest): string {
+  return [
+    'You are a dictation assistant. Clean up the following speech transcription for direct insertion into a text field.',
+    '',
+    '## Rules',
+    '- Fix grammar, punctuation, and capitalization',
+    '- Remove filler words (um, uh, like, you know)',
+    "- Maintain the speaker's intent and meaning",
+    '- Do NOT add explanations or commentary',
+    '- Return ONLY the cleaned text, nothing else',
+    '',
+    '## Tone Adaptation',
+    'Adapt your output tone based on the active application:',
+    '- Email apps (Gmail, Mail): Professional but warm. Use proper greetings and sign-offs if appropriate.',
+    '- Slack: Casual and conversational. Match typical chat style.',
+    '- Code editors (VS Code, Xcode): Technical and concise. Code comments style.',
+    '- Terminal: Command-like, terse.',
+    '- Messages/iMessage: Very casual, texting style. Short sentences.',
+    '- Notes/Docs: Neutral, clear writing.',
+    '- Default: Match the user\'s natural voice.',
+    '',
+    '## Context Clues',
+    '- Window title may contain recipient name (Slack DMs, email compose)',
+    '- If you can identify a recipient, adapt formality to the apparent relationship',
+    '- Maintain the user\'s natural voice — don\'t over-formalize casual speech',
+    '- The user\'s writing patterns and preferences may be available from memory context — follow those when present',
+    '',
+    buildAppMetadataBlock(msg),
+  ].join('\n');
+}
+
+function buildCommandPrompt(msg: DictationRequest): string {
+  return [
+    'You are a text transformation assistant. The user has selected text and given a voice command to transform it.',
+    '',
+    '## Rules',
+    '- Apply the instruction to the selected text',
+    '- Return ONLY the transformed text, nothing else',
+    '- Do NOT add explanations or commentary',
+    '',
+    '## Tone Adaptation',
+    'Match the tone to the active application context:',
+    '- Email apps (Gmail, Mail): Professional but warm.',
+    '- Slack: Casual and conversational.',
+    '- Code editors (VS Code, Xcode): Technical and concise.',
+    '- Terminal: Command-like, terse.',
+    '- Messages/iMessage: Very casual, texting style.',
+    '- Notes/Docs: Neutral, clear writing.',
+    '- Default: Match the user\'s natural voice.',
+    '',
+    '## Context Clues',
+    '- Window title may contain recipient name (Slack DMs, email compose)',
+    '- If you can identify a recipient, adapt formality to the apparent relationship',
+    '- Maintain the user\'s natural voice — don\'t over-formalize casual speech',
+    '- The user\'s writing patterns and preferences may be available from memory context — follow those when present',
+    '',
+    buildAppMetadataBlock(msg),
+    '',
+    'Selected text:',
+    msg.context.selectedText ?? '',
+    '',
+    `Instruction: ${msg.transcription}`,
+  ].join('\n');
+}
+
+export async function handleDictationRequest(
+  msg: DictationRequest,
+  socket: net.Socket,
+  ctx: HandlerContext,
+): Promise<void> {
+  const mode = detectDictationMode(msg);
+  log.info({ mode, transcriptionLength: msg.transcription.length }, 'Dictation request received');
+
+  // Action mode: return immediately — the client will route to a full agent session
+  if (mode === 'action') {
+    ctx.send(socket, {
+      type: 'dictation_response',
+      text: msg.transcription,
+      mode: 'action',
+      actionPlan: `User wants to: ${msg.transcription}`,
+    });
+    return;
+  }
+
+  // Dictation / command mode: make a single-turn LLM call for text cleanup or transformation
+  const systemPrompt = mode === 'dictation'
+    ? buildDictationPrompt(msg)
+    : buildCommandPrompt(msg);
+
+  const userText = mode === 'dictation'
+    ? msg.transcription
+    : msg.transcription; // command prompt already embeds the selected text and instruction
+
+  try {
+    const provider = getConfiguredProvider();
+    if (!provider) {
+      log.warn('Dictation: no provider available, returning raw transcription');
+      const fallbackText = mode === 'command' ? (msg.context.selectedText ?? msg.transcription) : msg.transcription;
+      ctx.send(socket, { type: 'dictation_response', text: fallbackText, mode });
+      return;
+    }
+
+    const response = await provider.sendMessage(
+      [{ role: 'user', content: [{ type: 'text', text: userText }] }],
+      [], // no tools
+      systemPrompt,
+      { config: { max_tokens: 1024 } },
+    );
+
+    const textBlock = response.content.find((b) => b.type === 'text');
+    const inlineFallback = mode === 'command' ? (msg.context.selectedText ?? msg.transcription) : msg.transcription;
+    const cleanedText = textBlock && 'text' in textBlock ? textBlock.text.trim() : inlineFallback;
+
+    ctx.send(socket, { type: 'dictation_response', text: cleanedText, mode });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.error({ err }, 'Dictation LLM call failed, returning raw transcription');
+    const fallbackText = mode === 'command' ? (msg.context.selectedText ?? msg.transcription) : msg.transcription;
+    ctx.send(socket, { type: 'dictation_response', text: fallbackText, mode });
+    ctx.send(socket, { type: 'error', message: `Dictation cleanup failed: ${message}` });
+  }
+}
+
+export const dictationHandlers = defineHandlers({
+  dictation_request: handleDictationRequest,
+});

package/src/daemon/handlers/documents.ts

@@ -2,12 +2,23 @@ import { defineHandlers } from './shared.js';
 import type { HandlerContext } from './shared.js';
 import type { DocumentSaveRequest, DocumentLoadRequest, DocumentListRequest } from '../ipc-protocol.js';
 import type * as net from 'node:net';
-import type { Database } from 'bun:sqlite';
-import { getDb } from '../../memory/db.js';
+import { rawRun, rawGet, rawAll } from '../../memory/db.js';
 import { getLogger } from '../../util/logger.js';
 
 const log = getLogger('documents');
 
+interface DocumentRow {
+  surface_id: string;
+  conversation_id: string;
+  title: string;
+  content: string;
+  word_count: number;
+  created_at: number;
+  updated_at: number;
+}
+
+type DocumentListRow = Omit<DocumentRow, 'content'>;
+
 export function handleDocumentSave(msg: DocumentSaveRequest, socket: net.Socket, ctx: HandlerContext): void {
   log.info({
     surfaceId: msg.surfaceId,
@@ -18,13 +29,9 @@ export function handleDocumentSave(msg: DocumentSaveRequest, socket: net.Socket,
   }, 'Received save request');
 
   try {
-    const db = getDb();
-    // Get the raw SQLite client from Drizzle
-    const sqlite = (db as unknown as { $client: Database }).$client;
     const now = Date.now();
 
-    // Upsert document (insert or update if exists)
-    sqlite.run(
+    rawRun(
       `INSERT INTO documents (surface_id, conversation_id, title, content, word_count, created_at, updated_at)
        VALUES (?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(surface_id) DO UPDATE SET
@@ -32,7 +39,7 @@ export function handleDocumentSave(msg: DocumentSaveRequest, socket: net.Socket,
          content = excluded.content,
          word_count = excluded.word_count,
          updated_at = excluded.updated_at`,
-      [msg.surfaceId, msg.conversationId, msg.title, msg.content, msg.wordCount, now, now]
+      msg.surfaceId, msg.conversationId, msg.title, msg.content, msg.wordCount, now, now,
     );
 
     ctx.send(socket, {
@@ -55,22 +62,11 @@ export function handleDocumentSave(msg: DocumentSaveRequest, socket: net.Socket,
 
 export function handleDocumentLoad(msg: DocumentLoadRequest, socket: net.Socket, ctx: HandlerContext): void {
   try {
-    const db = getDb();
-    const sqlite = (db as unknown as { $client: Database }).$client;
-
-    const result = sqlite.prepare(/*sql*/ `
+    const result = rawGet<DocumentRow>(/*sql*/ `
       SELECT surface_id, conversation_id, title, content, word_count, created_at, updated_at
       FROM documents
       WHERE surface_id = ?
-    `).get(msg.surfaceId) as {
-      surface_id: string;
-      conversation_id: string;
-      title: string;
-      content: string;
-      word_count: number;
-      created_at: number;
-      updated_at: number;
-    } | undefined;
+    `, msg.surfaceId);
 
     if (result) {
       ctx.send(socket, {
@@ -119,9 +115,6 @@ export function handleDocumentLoad(msg: DocumentLoadRequest, socket: net.Socket,
 
 export function handleDocumentList(msg: DocumentListRequest, socket: net.Socket, ctx: HandlerContext): void {
   try {
-    const db = getDb();
-    const sqlite = (db as unknown as { $client: Database }).$client;
-
     let query = /*sql*/ `
       SELECT surface_id, conversation_id, title, word_count, created_at, updated_at
       FROM documents
@@ -135,14 +128,7 @@ export function handleDocumentList(msg: DocumentListRequest, socket: net.Socket,
 
     query += ' ORDER BY updated_at DESC';
 
-    const results = sqlite.prepare(query).all(...params) as Array<{
-      surface_id: string;
-      conversation_id: string;
-      title: string;
-      word_count: number;
-      created_at: number;
-      updated_at: number;
-    }>;
+    const results = rawAll<DocumentListRow>(query, ...params);
 
     ctx.send(socket, {
       type: 'document_list_response',

package/src/daemon/handlers/identity.ts

@@ -2,7 +2,7 @@ import * as net from 'node:net';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getWorkspacePromptPath } from '../../util/platform.js';
+import { getWorkspacePromptPath, readLockfile } from '../../util/platform.js';
 import { log, defineHandlers, type HandlerContext } from './shared.js';
 
 function handleIdentityGet(socket: net.Socket, ctx: HandlerContext): void {
@@ -68,28 +68,19 @@ function handleIdentityGet(socket: net.Socket, ctx: HandlerContext): void {
     let cloud: string | undefined;
     let originSystem: string | undefined;
     try {
-      const homedir = process.env.HOME ?? process.env.USERPROFILE ?? '';
-      const lockfilePaths = [
-        join(homedir, '.vellum.lock.json'),
-        join(homedir, '.vellum.lockfile.json'),
-      ];
-      for (const lockPath of lockfilePaths) {
-        if (!existsSync(lockPath)) continue;
-        const lockData = JSON.parse(readFileSync(lockPath, 'utf-8'));
-        const assistants = lockData.assistants as Array<Record<string, unknown>> | undefined;
-        if (assistants && assistants.length > 0) {
-          // Use the most recently hatched assistant
-          const sorted = [...assistants].sort((a, b) => {
-            const dateA = new Date(a.hatchedAt as string || 0).getTime();
-            const dateB = new Date(b.hatchedAt as string || 0).getTime();
-            return dateB - dateA;
-          });
-          const latest = sorted[0];
-          assistantId = latest.assistantId as string | undefined;
-          cloud = latest.cloud as string | undefined;
-          originSystem = cloud === 'local' ? 'local' : cloud;
-        }
-        break;
+      const lockData = readLockfile();
+      const assistants = lockData?.assistants as Array<Record<string, unknown>> | undefined;
+      if (assistants && assistants.length > 0) {
+        // Use the most recently hatched assistant
+        const sorted = [...assistants].sort((a, b) => {
+          const dateA = new Date(a.hatchedAt as string || 0).getTime();
+          const dateB = new Date(b.hatchedAt as string || 0).getTime();
+          return dateB - dateA;
+        });
+        const latest = sorted[0];
+        assistantId = latest.assistantId as string | undefined;
+        cloud = latest.cloud as string | undefined;
+        originSystem = cloud === 'local' ? 'local' : cloud;
       }
     } catch {
       // ignore — lockfile may not exist

package/src/daemon/handlers/index.ts

@@ -22,6 +22,9 @@ import { signingHandlers } from './signing.js';
 import { twitterAuthHandlers } from './twitter-auth.js';
 import { workspaceFileHandlers } from './workspace-files.js';
 import { identityHandlers } from './identity.js';
+import { dictationHandlers } from './dictation.js';
+import { inboxInviteHandlers } from './config-inbox.js';
+import { pairingHandlers } from './pairing.js';
 
 // Re-export types and utilities for backwards compatibility
 export type {
@@ -87,6 +90,11 @@ const inlineHandlers = defineHandlers({
   },
   integration_disconnect: () => { /* no-op — integration registry removed */ },
 
+  // Stub handler: assistant_inbox — real implementation will be added in a follow-up PR.
+  assistant_inbox: (_msg, socket, ctx) => {
+    ctx.send(socket, { type: 'assistant_inbox_response', success: false, error: 'Not yet implemented' });
+  },
+
 });
 
 const handlers = {
@@ -107,6 +115,9 @@ const handlers = {
   ...twitterAuthHandlers,
   ...workspaceFileHandlers,
   ...identityHandlers,
+  ...dictationHandlers,
+  ...inboxInviteHandlers,
+  ...pairingHandlers,
   ...inlineHandlers,
 } satisfies DispatchMap;
 

package/src/daemon/handlers/misc.ts

@@ -3,8 +3,7 @@ import { v4 as uuid } from 'uuid';
 import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import * as conversationStore from '../../memory/conversation-store.js';
-import { getConfig } from '../../config/loader.js';
-import { getFailoverProvider, listProviders } from '../../providers/registry.js';
+import { getConfiguredProvider } from '../../providers/provider-send-message.js';
 import type { Provider } from '../../providers/types.js';
 import { classifyInteraction } from '../classifier.js';
 import { checkIngressForSecrets } from '../../security/secret-ingress.js';
@@ -172,10 +171,9 @@ export async function handleSuggestionRequest(
     }
 
     // Try LLM suggestion using the configured provider
-    const config = getConfig();
-    if (listProviders().includes(config.provider)) {
+    const provider = getConfiguredProvider();
+    if (provider) {
       try {
-        const provider = getFailoverProvider(config.provider, config.providerOrder);
         let promise = suggestionInFlight.get(m.id);
         if (!promise) {
           promise = generateSuggestion(provider, text);

package/src/daemon/handlers/pairing.ts

@@ -0,0 +1,98 @@
+import * as net from 'node:net';
+import type {
+  PairingApprovalResponse,
+  ApprovedDeviceRemove,
+} from '../ipc-protocol.js';
+import { log, defineHandlers, type HandlerContext } from './shared.js';
+import {
+  approveDevice,
+  removeDevice,
+  clearAllDevices,
+  listDevices,
+} from '../approved-devices-store.js';
+import type { PairingStore } from '../pairing-store.js';
+
+/** Module-level reference set by the daemon server at startup. */
+let pairingStoreRef: PairingStore | null = null;
+let bearerTokenRef: string | undefined;
+
+export function initPairingHandlers(store: PairingStore, bearerToken: string | undefined): void {
+  pairingStoreRef = store;
+  bearerTokenRef = bearerToken;
+}
+
+function handlePairingApprovalResponse(
+  msg: PairingApprovalResponse,
+  _socket: net.Socket,
+  _ctx: HandlerContext,
+): void {
+  if (!pairingStoreRef) {
+    log.warn('Pairing store not initialized');
+    return;
+  }
+
+  const entry = pairingStoreRef.get(msg.pairingRequestId);
+  if (!entry) {
+    log.warn({ pairingRequestId: msg.pairingRequestId }, 'Pairing request not found for approval response');
+    return;
+  }
+
+  // Idempotent: if already approved/denied, just re-broadcast the current status
+  if (entry.status === 'approved' || entry.status === 'denied') {
+    log.info({ pairingRequestId: msg.pairingRequestId, status: entry.status }, 'Duplicate approval response, no-op');
+    return;
+  }
+
+  if (msg.decision === 'deny') {
+    pairingStoreRef.deny(msg.pairingRequestId);
+    log.info({ pairingRequestId: msg.pairingRequestId }, 'Pairing request denied');
+    return;
+  }
+
+  // approve_once or always_allow
+  if (!bearerTokenRef) {
+    log.error('Cannot approve pairing: no bearer token configured');
+    return;
+  }
+
+  pairingStoreRef.approve(msg.pairingRequestId, bearerTokenRef);
+  log.info({ pairingRequestId: msg.pairingRequestId, decision: msg.decision }, 'Pairing request approved');
+
+  // If always_allow, persist the device to the allowlist
+  if (msg.decision === 'always_allow' && entry.hashedDeviceId) {
+    approveDevice(entry.hashedDeviceId, entry.deviceName ?? 'Unknown Device');
+  }
+}
+
+function handleApprovedDevicesList(socket: net.Socket, ctx: HandlerContext): void {
+  const devices = listDevices();
+  ctx.send(socket, {
+    type: 'approved_devices_list_response',
+    devices,
+  });
+}
+
+function handleApprovedDeviceRemove(
+  msg: ApprovedDeviceRemove,
+  socket: net.Socket,
+  ctx: HandlerContext,
+): void {
+  const success = removeDevice(msg.hashedDeviceId);
+  ctx.send(socket, {
+    type: 'approved_device_remove_response',
+    success,
+  });
+  log.info({ hashedDeviceId: msg.hashedDeviceId, success }, 'Device removal requested via IPC');
+}
+
+function handleApprovedDevicesClear(_socket: net.Socket, _ctx: HandlerContext): void {
+  clearAllDevices();
+  log.info('All approved devices cleared via IPC');
+}
+
+export const pairingHandlers = defineHandlers({
+  pairing_approval_response: handlePairingApprovalResponse,
+  approved_devices_list: (_msg, socket, ctx) => handleApprovedDevicesList(socket, ctx),
+  approved_device_remove: handleApprovedDeviceRemove,
+  approved_devices_clear: (_msg, socket, ctx) => handleApprovedDevicesClear(socket, ctx),
+});

package/src/daemon/handlers/sessions.ts

@@ -1,4 +1,6 @@
 import * as net from 'node:net';
+import { isChannelId, parseChannelId } from '../../channels/types.js';
+import { silentlyWithLog } from '../../util/silently.js';
 import { v4 as uuid } from 'uuid';
 import * as conversationStore from '../../memory/conversation-store.js';
 import * as externalConversationStore from '../../memory/external-conversation-store.js';
@@ -22,6 +24,7 @@ import type {
   UsageRequest,
   SandboxSetRequest,
   ServerMessage,
+  ConversationSearchRequest,
 } from '../ipc-protocol.js';
 import { getConfig } from '../../config/loader.js';
 import { getSubagentManager } from '../../subagent/index.js';
@@ -80,7 +83,20 @@ export async function handleUserMessage(
       attributes: { source: 'user_message' },
     });
 
-    const result = session.enqueueMessage(msg.content ?? '', msg.attachments ?? [], sendEvent, requestId, msg.activeSurfaceId, msg.currentPage);
+    const ipcChannel = parseChannelId(msg.channel) ?? 'macos';
+    const queuedChannelMetadata = {
+      userMessageChannel: ipcChannel,
+      assistantMessageChannel: ipcChannel,
+    };
+    const result = session.enqueueMessage(
+      msg.content ?? '',
+      msg.attachments ?? [],
+      sendEvent,
+      requestId,
+      msg.activeSurfaceId,
+      msg.currentPage,
+      queuedChannelMetadata,
+    );
     if (result.rejected) {
       rlog.warn('Message rejected — queue is full');
       session.traceEmitter.emit('request_error', 'Message rejected — queue is full', {
@@ -114,6 +130,13 @@ export async function handleUserMessage(
     }
 
     rlog.info('Processing user message');
+    session.setTurnChannelContext({
+      userMessageChannel: ipcChannel,
+      assistantMessageChannel: ipcChannel,
+    });
+    session.setAssistantId('self');
+    session.setGuardianContext(null);
+    session.setCommandIntent(null);
     // Fire-and-forget: don't block the IPC handler so the connection can
     // continue receiving messages (e.g. cancel, confirmations, or
     // additional user_message that will be queued by the session).
@@ -208,12 +231,14 @@ export function handleSessionList(socket: net.Socket, ctx: HandlerContext, offse
     type: 'session_list_response',
     sessions: conversations.map((c) => {
       const binding = bindings.get(c.id);
+      const originChannel = parseChannelId(c.originChannel);
       return {
         id: c.id,
         title: c.title ?? 'Untitled',
         updatedAt: c.updatedAt,
         threadType: normalizeThreadType(c.threadType),
-        ...(binding ? {
+        source: c.source ?? 'user',
+        ...(binding && isChannelId(binding.sourceChannel) ? {
           channelBinding: {
             sourceChannel: binding.sourceChannel,
             externalChatId: binding.externalChatId,
@@ -222,6 +247,7 @@ export function handleSessionList(socket: net.Socket, ctx: HandlerContext, offse
             username: binding.username,
           },
         } : {}),
+        ...(originChannel ? { conversationOriginChannel: originChannel } : {}),
       };
     }),
     hasMore: offset + conversations.length < totalCount,
@@ -274,6 +300,11 @@ export async function handleSessionCreate(
     ctx.socketToSession.set(socket, conversation.id);
     const sendEvent = (event: ServerMessage) => ctx.send(socket, event);
     const requestId = uuid();
+    const transportChannel = parseChannelId(msg.transport?.channelId) ?? 'macos';
+    session.setTurnChannelContext({
+      userMessageChannel: transportChannel,
+      assistantMessageChannel: transportChannel,
+    });
     session.processMessage(msg.initialMessage, [], sendEvent, requestId).catch((err) => {
       const message = err instanceof Error ? err.message : String(err);
       log.error({ err, sessionId: conversation.id }, 'Error processing initial message');
@@ -401,9 +432,12 @@ export function handleHistoryRequest(
           if (a.mimeType.startsWith('video/') && !a.thumbnailBase64) {
             const attachmentId = a.id;
             const base64 = a.dataBase64;
-            generateVideoThumbnail(base64).then((thumb) => {
-              if (thumb) setAttachmentThumbnail(attachmentId, thumb);
-            }).catch(() => {});
+            silentlyWithLog(
+              generateVideoThumbnail(base64).then((thumb) => {
+                if (thumb) setAttachmentThumbnail(attachmentId, thumb);
+              }),
+              'video thumbnail generation',
+            );
           }
 
           return {
@@ -539,6 +573,22 @@ export function handleDeleteQueuedMessage(
   }
 }
 
+export function handleConversationSearch(
+  msg: ConversationSearchRequest,
+  socket: net.Socket,
+  ctx: HandlerContext,
+): void {
+  const results = conversationStore.searchConversations(msg.query, {
+    limit: msg.limit,
+    maxMessagesPerConversation: msg.maxMessagesPerConversation,
+  });
+  ctx.send(socket, {
+    type: 'conversation_search_response',
+    query: msg.query,
+    results,
+  });
+}
+
 export const sessionHandlers = defineHandlers({
   user_message: handleUserMessage,
   confirmation_response: handleConfirmationResponse,
@@ -554,4 +604,5 @@ export const sessionHandlers = defineHandlers({
   regenerate: handleRegenerate,
   usage_request: handleUsageRequest,
   sandbox_set: handleSandboxSet,
+  conversation_search: handleConversationSearch,
 });

package/src/daemon/handlers/shared.ts

@@ -9,6 +9,7 @@ import type { ClientMessage, CuSessionCreate, ServerMessage, SessionTransportMet
 import type { SecretPromptResult } from '../../permissions/secret-prompter.js';
 import { getConfig } from '../../config/loader.js';
 import type { DebouncerMap } from '../../util/debounce.js';
+import type { GuardianRuntimeContext } from '../session-runtime-assembly.js';
 
 const log = getLogger('handlers');
 
@@ -99,9 +100,13 @@ export interface SessionCreateOptions {
   systemPromptOverride?: string;
   maxResponseTokens?: number;
   transport?: SessionTransportMetadata;
+  assistantId?: string;
+  guardianContext?: GuardianRuntimeContext;
   memoryScopeId?: string;
   isPrivateThread?: boolean;
   strictPrivateSideEffects?: boolean;
+  /** Channel command intent metadata (e.g. Telegram /start). */
+  commandIntent?: { type: string; payload?: string; languageCode?: string };
 }
 
 /**
@@ -249,7 +254,7 @@ export function wireEscalationHandler(
 }
 
 export function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null;
+  return typeof value === 'object' && value != null;
 }
 
 export function formatBytes(sizeBytes: number): string {

package/src/daemon/handlers/skills.ts

@@ -423,7 +423,7 @@ export async function handleSkillsSearch(
   ctx: HandlerContext,
 ): Promise<void> {
   try {
-    // Search vellum-skills catalog (remote with bundled fallback)
+    // Search vellum-skills catalog (platform API with bundled fallback)
     const catalogEntries = await listCatalogEntries();
     const query = (msg.query ?? '').toLowerCase();
     const matchingCatalog = catalogEntries.filter((e) => {