@vellumai/assistant 0.4.22 → 0.4.25

package/src/daemon/ipc-contract/surfaces.ts

@@ -2,14 +2,27 @@
 
 // === Surface type definitions ===
 
-export type SurfaceType = 'card' | 'form' | 'list' | 'table' | 'confirmation' | 'dynamic_page' | 'file_upload' | 'browser_view' | 'document_preview';
-
-export const INTERACTIVE_SURFACE_TYPES: SurfaceType[] = ['form', 'confirmation', 'dynamic_page', 'file_upload'];
+export type SurfaceType =
+  | "card"
+  | "form"
+  | "list"
+  | "table"
+  | "confirmation"
+  | "dynamic_page"
+  | "file_upload"
+  | "document_preview";
+
+export const INTERACTIVE_SURFACE_TYPES: SurfaceType[] = [
+  "form",
+  "confirmation",
+  "dynamic_page",
+  "file_upload",
+];
 
 export interface SurfaceAction {
   id: string;
   label: string;
-  style?: 'primary' | 'secondary' | 'destructive';
+  style?: "primary" | "secondary" | "destructive";
 }
 
 export interface CardSurfaceData {
@@ -25,7 +38,7 @@ export interface CardSurfaceData {
 
 export interface FormField {
   id: string;
-  type: 'text' | 'textarea' | 'select' | 'toggle' | 'number' | 'password';
+  type: "text" | "textarea" | "select" | "toggle" | "number" | "password";
   label: string;
   placeholder?: string;
   required?: boolean;
@@ -58,7 +71,7 @@ export interface ListItem {
 
 export interface ListSurfaceData {
   items: ListItem[];
-  selectionMode: 'single' | 'multiple' | 'none';
+  selectionMode: "single" | "multiple" | "none";
 }
 
 export interface ConfirmationSurfaceData {
@@ -76,8 +89,8 @@ export interface DynamicPagePreview {
   description?: string;
   icon?: string;
   metrics?: Array<{ label: string; value: string }>;
-  context?: 'app_create' | 'general';
-  previewImage?: string;  // base64 PNG
+  context?: "app_create" | "general";
+  previewImage?: string; // base64 PNG
 }
 
 export interface DynamicPageSurfaceData {
@@ -106,8 +119,8 @@ export interface TableColumn {
 
 export interface TableCellValue {
   text: string;
-  icon?: string;       // SF Symbol name
-  iconColor?: string;  // semantic token: "success" | "warning" | "error" | "muted"
+  icon?: string; // SF Symbol name
+  iconColor?: string; // semantic token: "success" | "warning" | "error" | "muted"
 }
 
 export interface TableRow {
@@ -120,32 +133,30 @@ export interface TableRow {
 export interface TableSurfaceData {
   columns: TableColumn[];
   rows: TableRow[];
-  selectionMode?: 'none' | 'single' | 'multiple';
+  selectionMode?: "none" | "single" | "multiple";
   caption?: string;
 }
 
-export interface BrowserViewSurfaceData {
-  sessionId: string;
-  currentUrl: string;
-  status: 'navigating' | 'idle' | 'interacting';
-  frame?: string; // base64 JPEG
-  actionText?: string; // "Clicking 'Submit' button"
-  highlights?: Array<{ x: number; y: number; w: number; h: number; label: string }>;
-  pages?: Array<{ id: string; title: string; url: string; active: boolean }>;
-}
-
 export interface DocumentPreviewSurfaceData {
   title: string;
-  surfaceId: string;   // the doc's real surfaceId, for focusing the panel
+  surfaceId: string; // the doc's real surfaceId, for focusing the panel
   subtitle?: string;
 }
 
-export type SurfaceData = CardSurfaceData | FormSurfaceData | ListSurfaceData | TableSurfaceData | ConfirmationSurfaceData | DynamicPageSurfaceData | FileUploadSurfaceData | BrowserViewSurfaceData | DocumentPreviewSurfaceData;
+export type SurfaceData =
+  | CardSurfaceData
+  | FormSurfaceData
+  | ListSurfaceData
+  | TableSurfaceData
+  | ConfirmationSurfaceData
+  | DynamicPageSurfaceData
+  | FileUploadSurfaceData
+  | DocumentPreviewSurfaceData;
 
 // === Client → Server ===
 
 export interface UiSurfaceAction {
-  type: 'ui_surface_action';
+  type: "ui_surface_action";
   sessionId: string;
   surfaceId: string;
   actionId: string;
@@ -153,7 +164,7 @@ export interface UiSurfaceAction {
 }
 
 export interface UiSurfaceUndoRequest {
-  type: 'ui_surface_undo';
+  type: "ui_surface_undo";
   sessionId: string;
   surfaceId: string;
 }
@@ -162,58 +173,53 @@ export interface UiSurfaceUndoRequest {
 
 /** Common fields shared by all UiSurfaceShow variants. */
 interface UiSurfaceShowBase {
-  type: 'ui_surface_show';
+  type: "ui_surface_show";
   sessionId: string;
   surfaceId: string;
   title?: string;
   actions?: SurfaceAction[];
-  display?: 'inline' | 'panel';
+  display?: "inline" | "panel";
   /** The message ID that this surface belongs to (for history loading). */
   messageId?: string;
 }
 
 export interface UiSurfaceShowCard extends UiSurfaceShowBase {
-  surfaceType: 'card';
+  surfaceType: "card";
   data: CardSurfaceData;
 }
 
 export interface UiSurfaceShowForm extends UiSurfaceShowBase {
-  surfaceType: 'form';
+  surfaceType: "form";
   data: FormSurfaceData;
 }
 
 export interface UiSurfaceShowList extends UiSurfaceShowBase {
-  surfaceType: 'list';
+  surfaceType: "list";
   data: ListSurfaceData;
 }
 
 export interface UiSurfaceShowConfirmation extends UiSurfaceShowBase {
-  surfaceType: 'confirmation';
+  surfaceType: "confirmation";
   data: ConfirmationSurfaceData;
 }
 
 export interface UiSurfaceShowDynamicPage extends UiSurfaceShowBase {
-  surfaceType: 'dynamic_page';
+  surfaceType: "dynamic_page";
   data: DynamicPageSurfaceData;
 }
 
 export interface UiSurfaceShowTable extends UiSurfaceShowBase {
-  surfaceType: 'table';
+  surfaceType: "table";
   data: TableSurfaceData;
 }
 
 export interface UiSurfaceShowFileUpload extends UiSurfaceShowBase {
-  surfaceType: 'file_upload';
+  surfaceType: "file_upload";
   data: FileUploadSurfaceData;
 }
 
-export interface UiSurfaceShowBrowserView extends UiSurfaceShowBase {
-  surfaceType: 'browser_view';
-  data: BrowserViewSurfaceData;
-}
-
 export interface UiSurfaceShowDocumentPreview extends UiSurfaceShowBase {
-  surfaceType: 'document_preview';
+  surfaceType: "document_preview";
   data: DocumentPreviewSurfaceData;
 }
 
@@ -225,24 +231,23 @@ export type UiSurfaceShow =
   | UiSurfaceShowConfirmation
   | UiSurfaceShowDynamicPage
   | UiSurfaceShowFileUpload
-  | UiSurfaceShowBrowserView
   | UiSurfaceShowDocumentPreview;
 
 export interface UiSurfaceUpdate {
-  type: 'ui_surface_update';
+  type: "ui_surface_update";
   sessionId: string;
   surfaceId: string;
   data: Partial<SurfaceData>;
 }
 
 export interface UiSurfaceDismiss {
-  type: 'ui_surface_dismiss';
+  type: "ui_surface_dismiss";
   sessionId: string;
   surfaceId: string;
 }
 
 export interface UiSurfaceComplete {
-  type: 'ui_surface_complete';
+  type: "ui_surface_complete";
   sessionId: string;
   surfaceId: string;
   summary: string;
@@ -250,7 +255,7 @@ export interface UiSurfaceComplete {
 }
 
 export interface UiSurfaceUndoResult {
-  type: 'ui_surface_undo_result';
+  type: "ui_surface_undo_result";
   sessionId: string;
   surfaceId: string;
   success: boolean;
@@ -260,9 +265,7 @@ export interface UiSurfaceUndoResult {
 
 // --- Domain-level union aliases (consumed by the barrel file) ---
 
-export type _SurfacesClientMessages =
-  | UiSurfaceAction
-  | UiSurfaceUndoRequest;
+export type _SurfacesClientMessages = UiSurfaceAction | UiSurfaceUndoRequest;
 
 export type _SurfacesServerMessages =
   | UiSurfaceShow

package/src/daemon/ipc-contract-inventory.json

@@ -62,11 +62,6 @@
     "apps_list",
     "assistant_inbox_escalation",
     "auth",
-    "browser_cdp_response",
-    "browser_interactive_mode",
-    "browser_user_click",
-    "browser_user_keypress",
-    "browser_user_scroll",
     "bundle_app",
     "cancel",
     "confirmation_response",
@@ -210,10 +205,6 @@
     "assistant_thinking_delta",
     "auth_result",
     "avatar_updated",
-    "browser_cdp_request",
-    "browser_frame",
-    "browser_handoff_request",
-    "browser_interactive_mode_changed",
     "bundle_app_response",
     "client_settings_update",
     "confirmation_request",

package/src/daemon/session-agent-loop-handlers.ts

@@ -150,6 +150,9 @@ const TOOL_FRIENDLY_NAMES: Record<string, string> = {
   browser_wait: 'browser',
   app_create: 'app',
   app_update: 'app',
+  skill_load: 'skill',
+  app_file_edit: 'app file',
+  app_file_write: 'app file',
 };
 
 function friendlyToolName(name: string): string {

package/src/daemon/session-agent-loop.ts

@@ -65,6 +65,7 @@ import {
   stripInjectedContext,
 } from './session-runtime-assembly.js';
 import type { SkillProjectionCache } from './session-skill-tools.js';
+import { resolveGuardianTrustClass } from './session-tool-setup.js';
 import { recordUsage } from './session-usage.js';
 import type { TraceEmitter } from './trace-emitter.js';
 
@@ -319,7 +320,7 @@ export async function runAgentLoopImpl(
         conflictGate: ctx.conflictGate,
         scopeId: ctx.memoryPolicy.scopeId,
         includeDefaultFallback: ctx.memoryPolicy.includeDefaultFallback,
-        guardianTrustClass: ctx.guardianContext?.trustClass ?? 'guardian',
+        guardianTrustClass: resolveGuardianTrustClass(ctx.guardianContext),
         isInteractive: options?.isInteractive ?? (!ctx.hasNoClient && !ctx.headlessLock),
       },
       content,

package/src/daemon/session-runtime-assembly.ts

@@ -314,7 +314,7 @@ export function resolveChannelCapabilities(
       return {
         channel,
         dashboardCapable: supportsDesktopUi,
-        supportsDynamicUi: supportsDesktopUi,
+        supportsDynamicUi: supportsDesktopUi || iface === "vellum",
         supportsVoiceInput: supportsDesktopUi,
         pttActivationKey: sanitizePttActivationKey(
           pttMetadata?.pttActivationKey,
@@ -592,12 +592,14 @@ export function injectChannelCapabilityContext(
     lines.push(
       "- Do NOT reference the dashboard UI, settings panels, or visual preference pickers.",
     );
-    lines.push(
-      "- Do NOT use ui_show, ui_update, or app_create — this channel cannot render them.",
-    );
-    lines.push(
-      "- Present information as well-formatted text instead of dynamic UI.",
-    );
+    if (!caps.supportsDynamicUi) {
+      lines.push(
+        "- Do NOT use ui_show, ui_update, or app_create — this channel cannot render them.",
+      );
+      lines.push(
+        "- Present information as well-formatted text instead of dynamic UI.",
+      );
+    }
     lines.push(
       "- Defer dashboard-specific actions (e.g. accent color selection) by telling the user",
     );

package/src/daemon/session-tool-setup.ts

@@ -6,6 +6,7 @@
  * keeping the constructor body focused on wiring.
  */
 
+import { isHttpAuthDisabled } from "../config/env.js";
 import {
   generateAllowlistOptions,
   generateScopeOptions,
@@ -19,30 +20,28 @@ import {
 } from "../permissions/trust-store.js";
 import { isAllowDecision } from "../permissions/types.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
+import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 import { getEffectiveMode } from "../runtime/session-approval-overrides.js";
+import { coreAppProxyTools } from "../tools/apps/definitions.js";
+import { registerSessionSender } from "../tools/browser/browser-screencast.js";
+import { requestComputerControlTool } from "../tools/computer-use/request-computer-control.js";
 import type { ToolExecutor } from "../tools/executor.js";
+import type {
+  ProxyApprovalCallback,
+  ProxyApprovalRequest,
+} from "../tools/network/script-proxy/index.js";
+import { getAllToolDefinitions } from "../tools/registry.js";
 import type {
   ToolExecutionResult,
   ToolLifecycleEventHandler,
 } from "../tools/types.js";
+import { allUiSurfaceTools } from "../tools/ui-surface/definitions.js";
 import { getLogger } from "../util/logger.js";
 import {
   isDoordashCommand,
   markDoordashStepInProgress,
 } from "./doordash-steps.js";
 import type { ServerMessage, UiSurfaceShow } from "./ipc-protocol.js";
-import { runPostExecutionSideEffects } from "./tool-side-effects.js";
-
-const log = getLogger("session-tool-setup");
-import { coreAppProxyTools } from "../tools/apps/definitions.js";
-import { registerSessionSender } from "../tools/browser/browser-screencast.js";
-import { requestComputerControlTool } from "../tools/computer-use/request-computer-control.js";
-import type {
-  ProxyApprovalCallback,
-  ProxyApprovalRequest,
-} from "../tools/network/script-proxy/index.js";
-import { getAllToolDefinitions } from "../tools/registry.js";
-import { allUiSurfaceTools } from "../tools/ui-surface/definitions.js";
 import type { GuardianRuntimeContext } from "./session-runtime-assembly.js";
 import {
   projectSkillTools,
@@ -50,6 +49,21 @@ import {
 } from "./session-skill-tools.js";
 import type { SurfaceSessionContext } from "./session-surfaces.js";
 import { surfaceProxyResolver } from "./session-surfaces.js";
+import { runPostExecutionSideEffects } from "./tool-side-effects.js";
+
+const log = getLogger("session-tool-setup");
+
+/**
+ * Resolve the effective guardian trust class for tool execution.
+ * When HTTP auth is disabled (dev bypass), always treat the actor as
+ * guardian so that control-plane gates don't block local development.
+ */
+export function resolveGuardianTrustClass(
+  guardianContext: GuardianRuntimeContext | undefined,
+): TrustClass {
+  if (isHttpAuthDisabled()) return "guardian";
+  return guardianContext?.trustClass ?? "guardian";
+}
 
 // ── Context Interface ────────────────────────────────────────────────
 
@@ -137,7 +151,7 @@ export function createToolExecutor(
       assistantId: ctx.assistantId,
       requestId: ctx.currentRequestId,
       taskRunId: ctx.taskRunId,
-      guardianTrustClass: ctx.guardianContext?.trustClass ?? "guardian",
+      guardianTrustClass: resolveGuardianTrustClass(ctx.guardianContext),
       executionChannel: ctx.guardianContext?.sourceChannel,
       callSessionId: ctx.callSessionId,
       triggeredBySurfaceAction:

package/src/mcp/client.ts

@@ -75,7 +75,8 @@ export class McpClient {
 
       if (isHttpTransport) {
         const isAuthError = err instanceof UnauthorizedError
-          || (err instanceof Error && /\b(401|403|unauthorized|forbidden)\b/i.test(err.message));
+          || (err instanceof Error && /\b(401|403|unauthorized|forbidden)\b/i.test(err.message))
+          || (err != null && typeof err === 'object' && 'code' in err && (err.code === 401 || err.code === 403));
 
         if (isAuthError) {
           // Auth-related — user can run `vellum mcp auth <name>` to authenticate.