@vellumai/assistant 0.3.4 → 0.3.6

package/src/daemon/pairing-store.ts

@@ -0,0 +1,177 @@
+/**
+ * In-memory pairing request store with TTL.
+ *
+ * Each pairing request lives for at most TTL_MS (5 minutes) before
+ * being swept as expired. Status transitions:
+ *   registered → pending → approved | denied | expired
+ */
+
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { getLogger } from '../util/logger.js';
+
+const log = getLogger('pairing-store');
+
+const TTL_MS = 5 * 60 * 1000; // 5 minutes
+const SWEEP_INTERVAL_MS = 30_000; // 30 seconds
+
+export type PairingStatus = 'registered' | 'pending' | 'approved' | 'denied' | 'expired';
+
+export interface PairingRequest {
+  pairingRequestId: string;
+  hashedPairingSecret: string;
+  hashedDeviceId?: string;
+  deviceName?: string;
+  status: PairingStatus;
+  gatewayUrl: string;
+  localLanUrl: string | null;
+  bearerToken?: string;
+  createdAt: number;
+}
+
+function hashValue(value: string): string {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+function timingSafeCompare(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
+export class PairingStore {
+  private requests = new Map<string, PairingRequest>();
+  private sweepTimer: ReturnType<typeof setInterval> | null = null;
+
+  start(): void {
+    this.sweepTimer = setInterval(() => this.sweep(), SWEEP_INTERVAL_MS);
+  }
+
+  stop(): void {
+    if (this.sweepTimer) {
+      clearInterval(this.sweepTimer);
+      this.sweepTimer = null;
+    }
+    this.requests.clear();
+  }
+
+  /**
+   * Pre-register a pairing request (called when QR is displayed).
+   * Idempotent: if the same ID exists and secret matches, overwrite.
+   * Returns false with 'conflict' if ID exists but secret doesn't match.
+   */
+  register(params: {
+    pairingRequestId: string;
+    pairingSecret: string;
+    gatewayUrl: string;
+    localLanUrl?: string | null;
+  }): { ok: true } | { ok: false; reason: 'conflict' } {
+    const hashedSecret = hashValue(params.pairingSecret);
+    const existing = this.requests.get(params.pairingRequestId);
+
+    if (existing) {
+      if (!timingSafeCompare(existing.hashedPairingSecret, hashedSecret)) {
+        return { ok: false, reason: 'conflict' };
+      }
+    }
+
+    this.requests.set(params.pairingRequestId, {
+      pairingRequestId: params.pairingRequestId,
+      hashedPairingSecret: hashedSecret,
+      status: 'registered',
+      gatewayUrl: params.gatewayUrl,
+      localLanUrl: params.localLanUrl ?? null,
+      createdAt: Date.now(),
+    });
+
+    log.info({ pairingRequestId: params.pairingRequestId }, 'Pairing request registered');
+    return { ok: true };
+  }
+
+  /**
+   * iOS initiates a pairing request. Validates the secret and transitions
+   * the entry to "pending" (or "approved" if auto-approved).
+   */
+  beginRequest(params: {
+    pairingRequestId: string;
+    pairingSecret: string;
+    deviceId: string;
+    deviceName: string;
+  }): { ok: true; entry: PairingRequest } | { ok: false; reason: 'not_found' | 'invalid_secret' | 'expired' } {
+    const entry = this.requests.get(params.pairingRequestId);
+    if (!entry) {
+      return { ok: false, reason: 'not_found' };
+    }
+
+    if (entry.status === 'expired' || entry.status === 'denied') {
+      return { ok: false, reason: 'expired' };
+    }
+
+    const hashedSecret = hashValue(params.pairingSecret);
+    if (!timingSafeCompare(entry.hashedPairingSecret, hashedSecret)) {
+      return { ok: false, reason: 'invalid_secret' };
+    }
+
+    entry.hashedDeviceId = hashValue(params.deviceId);
+    entry.deviceName = params.deviceName;
+    if (entry.status === 'registered') {
+      entry.status = 'pending';
+    }
+
+    return { ok: true, entry };
+  }
+
+  /**
+   * Approve a pairing request. Sets the bearer token for iOS to retrieve.
+   */
+  approve(pairingRequestId: string, bearerToken: string): PairingRequest | null {
+    const entry = this.requests.get(pairingRequestId);
+    if (!entry) return null;
+    entry.status = 'approved';
+    entry.bearerToken = bearerToken;
+    return entry;
+  }
+
+  /**
+   * Deny a pairing request.
+   */
+  deny(pairingRequestId: string): PairingRequest | null {
+    const entry = this.requests.get(pairingRequestId);
+    if (!entry) return null;
+    entry.status = 'denied';
+    return entry;
+  }
+
+  /**
+   * Get a pairing request by ID.
+   */
+  get(pairingRequestId: string): PairingRequest | null {
+    return this.requests.get(pairingRequestId) ?? null;
+  }
+
+  /**
+   * Validate the secret for a status poll request (timing-safe).
+   */
+  validateSecret(pairingRequestId: string, secret: string): boolean {
+    const entry = this.requests.get(pairingRequestId);
+    if (!entry) return false;
+    const hashedSecret = hashValue(secret);
+    return timingSafeCompare(entry.hashedPairingSecret, hashedSecret);
+  }
+
+  private sweep(): void {
+    const now = Date.now();
+    for (const [id, entry] of this.requests) {
+      if (now - entry.createdAt > TTL_MS) {
+        if (entry.status !== 'approved') {
+          entry.status = 'expired';
+        }
+        // Remove entries older than 2x TTL regardless of status
+        if (now - entry.createdAt > TTL_MS * 2) {
+          this.requests.delete(id);
+          log.debug({ pairingRequestId: id }, 'Pairing request swept');
+        }
+      }
+    }
+  }
+}

package/src/daemon/providers-setup.ts

@@ -0,0 +1,43 @@
+import { initializeProviders } from '../providers/registry.js';
+import { initializeTools } from '../tools/registry.js';
+import { registerWatcherProvider } from '../watcher/provider-registry.js';
+import { gmailProvider } from '../watcher/providers/gmail.js';
+import { googleCalendarProvider } from '../watcher/providers/google-calendar.js';
+import { slackProvider as slackWatcherProvider } from '../watcher/providers/slack.js';
+import { githubProvider } from '../watcher/providers/github.js';
+import { linearProvider } from '../watcher/providers/linear.js';
+import { registerMessagingProvider } from '../messaging/registry.js';
+import { slackProvider as slackMessagingProvider } from '../messaging/providers/slack/adapter.js';
+import { gmailMessagingProvider } from '../messaging/providers/gmail/adapter.js';
+import { telegramBotMessagingProvider } from '../messaging/providers/telegram-bot/adapter.js';
+import { smsMessagingProvider } from '../messaging/providers/sms/adapter.js';
+import { whatsappMessagingProvider } from '../messaging/providers/whatsapp/adapter.js';
+import { initWatcherEngine } from '../watcher/engine.js';
+import type { AssistantConfig } from '../config/types.js';
+import { getLogger } from '../util/logger.js';
+
+const log = getLogger('lifecycle');
+
+export async function initializeProvidersAndTools(config: AssistantConfig): Promise<void> {
+  log.info('Daemon startup: initializing providers and tools');
+  initializeProviders(config);
+  await initializeTools();
+  log.info('Daemon startup: providers and tools initialized');
+}
+
+export function registerWatcherProviders(): void {
+  registerWatcherProvider(gmailProvider);
+  registerWatcherProvider(googleCalendarProvider);
+  registerWatcherProvider(slackWatcherProvider);
+  registerWatcherProvider(githubProvider);
+  registerWatcherProvider(linearProvider);
+  initWatcherEngine();
+}
+
+export function registerMessagingProviders(): void {
+  registerMessagingProvider(slackMessagingProvider);
+  registerMessagingProvider(gmailMessagingProvider);
+  registerMessagingProvider(telegramBotMessagingProvider);
+  registerMessagingProvider(smsMessagingProvider);
+  registerMessagingProvider(whatsappMessagingProvider);
+}

package/src/daemon/ride-shotgun-handler.ts

@@ -23,6 +23,9 @@ const log = getLogger('ride-shotgun-handler');
 /** Active network recorders keyed by watchId. */
 const activeRecorders = new Map<string, NetworkRecorder>();
 
+/** Active progress interval timers keyed by watchId, cleared on session completion. */
+const activeProgressIntervals = new Map<string, NodeJS.Timeout>();
+
 /** Return domain-specific URL patterns that indicate a successful login. */
 function getLoginSignals(targetDomain?: string): string[] {
   if (targetDomain === 'x.com' || targetDomain === 'twitter.com') {
@@ -52,6 +55,13 @@ async function completeSession(session: WatchSession): Promise<void> {
     session.timeoutHandle = undefined;
   }
 
+  // Clear progress interval timer if one was registered for this session
+  const progressTimer = activeProgressIntervals.get(session.watchId);
+  if (progressTimer) {
+    clearInterval(progressTimer);
+    activeProgressIntervals.delete(session.watchId);
+  }
+
   const { watchId, sessionId } = session;
   log.info(
     { watchId, sessionId, observationCount: session.observations.length },
@@ -135,9 +145,62 @@ export async function handleRideShotgunStart(
           activeRecorders.set(watchId, recorder);
           log.info({ watchId, targetDomain, attempt }, 'Network recording started for learn session');
 
+          // Send periodic progress updates with network entry counts and idle detection
+          let lastNetworkEntryCount = 0;
+          let lastActivityTimestamp = Date.now();
+          let idleHintSent = false;
+
+          const progressInterval: NodeJS.Timeout = setInterval(() => {
+            if (session.status !== 'active') {
+              clearInterval(progressInterval);
+              return;
+            }
+
+            const currentCount = recorder.entryCount;
+
+            // Track activity: reset idle timer when count changes
+            if (currentCount !== lastNetworkEntryCount) {
+              lastNetworkEntryCount = currentCount;
+              lastActivityTimestamp = Date.now();
+              // If we previously sent an idle hint, clear it now that activity resumed
+              if (idleHintSent) {
+                idleHintSent = false;
+                log.info({ watchId, currentCount }, 'Activity resumed — clearing idleHint');
+                ctx.send(socket, {
+                  type: 'ride_shotgun_progress',
+                  watchId,
+                  message: `Recording network traffic...`,
+                  networkEntryCount: currentCount,
+                  statusMessage: 'Recording network traffic...',
+                  idleHint: false,
+                });
+                return;
+              }
+            }
+
+            // Idle detection: if some initial activity happened and no new entries for 15s, hint once
+            const idleMs = Date.now() - lastActivityTimestamp;
+            let idleHint: boolean | undefined;
+            if (!idleHintSent && currentCount > 0 && idleMs >= 15_000) {
+              idleHint = true;
+              idleHintSent = true;
+              log.info({ watchId, currentCount, idleMs }, 'Idle detected — sending idleHint');
+            }
+
+            ctx.send(socket, {
+              type: 'ride_shotgun_progress',
+              watchId,
+              message: `Recording network traffic...`,
+              networkEntryCount: currentCount,
+              statusMessage: 'Recording network traffic...',
+              ...(idleHint !== undefined ? { idleHint } : {}),
+            });
+          }, 5000);
+          activeProgressIntervals.set(watchId, progressInterval);
+
           // For x.com, auto-navigate Chrome through key pages to capture the full API surface.
           // Skip login detection — auto-navigation will complete the session when done.
-          if (targetDomain === 'x.com' || targetDomain === 'twitter.com') {
+          if ((targetDomain === 'x.com' || targetDomain === 'twitter.com') && msg.autoNavigate !== false) {
             // Don't set onLoginDetected — it would kill the session after the first
             // GraphQL call (5s grace), before auto-navigation finishes.
             const abortSignal = { aborted: false };
@@ -177,7 +240,7 @@ export async function handleRideShotgunStart(
                   type: 'ride_shotgun_progress',
                   watchId,
                   message: `[${progress.pageNumber || '?'}] ${shortUrl}`,
-                } as any);
+                });
               }
             }).then(visited => {
               clearInterval(checkInterval);
@@ -192,8 +255,10 @@ export async function handleRideShotgunStart(
                 completeSession(session);
               }
             });
+          } else if (msg.autoNavigate === false && targetDomain) {
+            // Manual mode: just record network traffic until timeout or early stop — no login detection shortcut.
           } else {
-            // No targetDomain: use login detection as before
+            // No targetDomain or targetDomain without explicit autoNavigate=false: use login detection
             recorder.onLoginDetected = () => {
               log.info({ watchId }, 'Login detected — auto-stopping learn session');
               completeSession(session);

package/src/daemon/server.ts

@@ -15,6 +15,7 @@ import { IngressBlockedError } from '../util/errors.js';
 import * as conversationStore from '../memory/conversation-store.js';
 import * as attachmentsStore from '../memory/attachments-store.js';
 import { Session, DEFAULT_MEMORY_POLICY, type SessionMemoryPolicy } from './session.js';
+import { parseChannelId, type ChannelId } from '../channels/types.js';
 import { resolveChannelCapabilities } from './session-runtime-assembly.js';
 import { ComputerUseSession } from './computer-use-session.js';
 import {
@@ -31,7 +32,6 @@ import { ensureBlobDir, sweepStaleBlobs } from './ipc-blob-store.js';
 import { bootstrapHomeBaseAppLink } from '../home-base/bootstrap.js';
 import { SessionEvictor } from './session-evictor.js';
 import { getSubagentManager } from '../subagent/index.js';
-import { tryRouteCallMessage } from '../calls/call-bridge.js';
 import { resolveSlash } from './session-slash.js';
 import { createUserMessage, createAssistantMessage } from '../agent/message-types.js';
 import { registerDaemonCallbacks } from '../work-items/work-item-runner.js';
@@ -53,6 +53,24 @@ function readPackageVersion(): string | undefined {
 
 const daemonVersion = readPackageVersion();
 
+function resolveTurnChannel(sourceChannel?: string, transportChannelId?: string): ChannelId {
+  if (sourceChannel != null) {
+    const parsed = parseChannelId(sourceChannel);
+    if (!parsed) {
+      throw new Error(`Invalid sourceChannel: ${sourceChannel}`);
+    }
+    return parsed;
+  }
+  if (transportChannelId != null) {
+    const parsed = parseChannelId(transportChannelId);
+    if (!parsed) {
+      throw new Error(`Invalid transport.channelId: ${transportChannelId}`);
+    }
+    return parsed;
+  }
+  return 'macos';
+}
+
 export class DaemonServer {
   private server: net.Server | null = null;
   private tcpServer: tls.Server | null = null;
@@ -358,7 +376,7 @@ export class DaemonServer {
       const parseDurationMs = Number(process.hrtime.bigint() - parseStartNs) / 1_000_000;
       for (const entry of parsed) {
         const msg = entry.msg;
-        if (typeof msg === 'object' && msg !== null && (msg as { type?: unknown }).type === 'cu_observation') {
+        if (typeof msg === 'object' && msg != null && (msg as { type?: unknown }).type === 'cu_observation') {
           const maybeSessionId = (msg as { sessionId?: unknown }).sessionId;
           const sessionId = typeof maybeSessionId === 'string' ? maybeSessionId : 'unknown';
           const previousSequence = this.cuObservationParseSequence.get(sessionId) ?? 0;
@@ -488,6 +506,20 @@ export class DaemonServer {
     }
   }
 
+  get lastConfigFingerprint(): string {
+    return this.configWatcher.lastFingerprint;
+  }
+
+  set lastConfigFingerprint(value: string) {
+    this.configWatcher.lastFingerprint = value;
+  }
+
+  refreshConfigFromSources(): boolean {
+    const changed = this.configWatcher.refreshConfigFromSources();
+    if (changed) this.evictSessionsForReload();
+    return changed;
+  }
+
   private async sendInitialSession(socket: net.Socket): Promise<void> {
     const conversation = conversationStore.getLatestConversation();
     if (!conversation) {
@@ -666,7 +698,15 @@ export class DaemonServer {
       throw new Error('Session is already processing a message');
     }
 
+    session.setAssistantId(options?.assistantId ?? 'self');
+    session.setGuardianContext(options?.guardianContext ?? null);
     session.setChannelCapabilities(resolveChannelCapabilities(sourceChannel));
+    session.setCommandIntent(options?.commandIntent ?? null);
+    const resolvedChannel = resolveTurnChannel(sourceChannel, options?.transport?.channelId);
+    session.setTurnChannelContext({
+      userMessageChannel: resolvedChannel,
+      assistantMessageChannel: resolvedChannel,
+    });
 
     const attachments = attachmentIds
       ? attachmentsStore.getAttachmentsByIds(attachmentIds).map((a) => ({
@@ -680,21 +720,6 @@ export class DaemonServer {
     const requestId = crypto.randomUUID();
     const messageId = session.persistUserMessage(content, attachments, requestId);
 
-    let bridgeHandled = false;
-    try {
-      const bridgeResult = await tryRouteCallMessage(conversationId, content, messageId);
-      bridgeHandled = bridgeResult.handled;
-    } catch (err) {
-      log.warn({ err, conversationId }, 'Call bridge check failed (non-fatal), proceeding with agent loop');
-    }
-
-    if (bridgeHandled) {
-      resetSessionProcessingState(session);
-      session.drainQueue('loop_complete');
-      log.info({ conversationId, messageId }, 'User message consumed by call bridge, skipping agent loop');
-      return { messageId };
-    }
-
     session.runAgentLoop(content, messageId, () => {}).catch((err) => {
       log.error({ err, conversationId }, 'Background agent loop failed');
     });
@@ -720,7 +745,15 @@ export class DaemonServer {
       throw new Error('Session is already processing a message');
     }
 
+    session.setAssistantId(options?.assistantId ?? 'self');
+    session.setGuardianContext(options?.guardianContext ?? null);
     session.setChannelCapabilities(resolveChannelCapabilities(sourceChannel));
+    session.setCommandIntent(options?.commandIntent ?? null);
+    const resolvedChannel2 = resolveTurnChannel(sourceChannel, options?.transport?.channelId);
+    session.setTurnChannelContext({
+      userMessageChannel: resolvedChannel2,
+      assistantMessageChannel: resolvedChannel2,
+    });
 
     const attachments = attachmentIds
       ? attachmentsStore.getAttachmentsByIds(attachmentIds).map((a) => ({
@@ -734,19 +767,33 @@ export class DaemonServer {
     const slashResult = resolveSlash(content);
 
     if (slashResult.kind === 'unknown') {
+      const serverTurnCtx = session.getTurnChannelContext();
+      const serverChannelMeta = serverTurnCtx
+        ? { userMessageChannel: serverTurnCtx.userMessageChannel, assistantMessageChannel: serverTurnCtx.assistantMessageChannel }
+        : undefined;
       const userMsg = createUserMessage(content, attachments);
       const persisted = conversationStore.addMessage(
         conversationId,
         'user',
         JSON.stringify(userMsg.content),
+        serverChannelMeta,
       );
       session.getMessages().push(userMsg);
 
+      if (serverTurnCtx) {
+        try {
+          conversationStore.setConversationOriginChannelIfUnset(conversationId, serverTurnCtx.userMessageChannel);
+        } catch (err) {
+          log.warn({ err, conversationId }, 'Failed to set origin channel (best-effort)');
+        }
+      }
+
       const assistantMsg = createAssistantMessage(slashResult.message);
       conversationStore.addMessage(
         conversationId,
         'assistant',
         JSON.stringify(assistantMsg.content),
+        serverChannelMeta,
       );
       session.getMessages().push(assistantMsg);
       return { messageId: persisted.id };
@@ -767,22 +814,6 @@ export class DaemonServer {
       throw err;
     }
 
-    let bridgeHandled = false;
-    try {
-      const bridgeResult = await tryRouteCallMessage(conversationId, resolvedContent, messageId);
-      bridgeHandled = bridgeResult.handled;
-    } catch (err) {
-      log.warn({ err, conversationId }, 'Call bridge check failed (non-fatal), proceeding with agent loop');
-    }
-
-    if (bridgeHandled) {
-      (session as unknown as { preactivatedSkillIds?: string[] }).preactivatedSkillIds = undefined;
-      resetSessionProcessingState(session);
-      session.drainQueue('loop_complete');
-      log.info({ conversationId, messageId }, 'User message consumed by call bridge, skipping agent loop');
-      return { messageId };
-    }
-
     await session.runAgentLoop(resolvedContent, messageId, () => {});
 
     return { messageId };
@@ -790,8 +821,8 @@ export class DaemonServer {
 
   createRunOrchestrator(): RunOrchestrator {
     return new RunOrchestrator({
-      getOrCreateSession: (conversationId) =>
-        this.getOrCreateSession(conversationId),
+      getOrCreateSession: (conversationId, transport) =>
+        this.getOrCreateSession(conversationId, undefined, true, transport ? { transport } : undefined),
       resolveAttachments: (attachmentIds) =>
         attachmentsStore.getAttachmentsByIds(attachmentIds).map((a) => ({
           id: a.id,
@@ -805,14 +836,3 @@ export class DaemonServer {
   }
 
 }
-
-function resetSessionProcessingState(session: Session): void {
-  const s = session as unknown as {
-    processing: boolean;
-    abortController: AbortController | null;
-    currentRequestId: string | undefined;
-  };
-  s.processing = false;
-  s.abortController = null;
-  s.currentRequestId = undefined;
-}