@vellumai/assistant 0.4.43 → 0.4.44

package/src/runtime/routes/brain-graph-routes.ts

@@ -156,47 +156,14 @@ export function handleGetBrainGraph(): Response {
   }
 }
 
-export function handleServeHomeBaseUI(bearerToken?: string): Response {
-  try {
-    const prebuiltDir = resolveBundledDir(
-      import.meta.dirname ?? __dirname,
-      "../../home-base/prebuilt",
-      "prebuilt",
-    );
-    let html = readFileSync(join(prebuiltDir, "index.html"), "utf-8");
-    if (bearerToken) {
-      const escapedToken = bearerToken
-        .replace(/&/g, "&")
-        .replace(/"/g, """)
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
-      html = html.replace(
-        "</head>",
-        `  <meta name="api-token" content="${escapedToken}">\n</head>`,
-      );
-    }
-    return new Response(html, {
-      headers: { "Content-Type": "text/html; charset=utf-8" },
-    });
-  } catch (err) {
-    return Response.json(
-      {
-        error: "Home Base UI not available",
-        detail: err instanceof Error ? err.message : String(err),
-      },
-      { status: 500 },
-    );
-  }
-}
-
 export function handleServeBrainGraphUI(bearerToken?: string): Response {
   try {
-    const prebuiltDir = resolveBundledDir(
+    const brainGraphDir = resolveBundledDir(
       import.meta.dirname ?? __dirname,
-      "../../home-base/prebuilt",
-      "prebuilt",
+      "./brain-graph",
+      "brain-graph",
     );
-    let html = readFileSync(join(prebuiltDir, "brain-graph.html"), "utf-8");
+    let html = readFileSync(join(brainGraphDir, "brain-graph.html"), "utf-8");
     if (bearerToken) {
       // Inject token as a meta tag for client-side fetch authentication.
       // HTML-escape the token value to guard against injection if the token
@@ -256,10 +223,5 @@ export function brainGraphRouteDefinitions(deps: {
       method: "GET",
       handler: () => handleServeBrainGraphUI(deps.mintUiPageToken()),
     },
-    {
-      endpoint: "home-base-ui",
-      method: "GET",
-      handler: () => handleServeHomeBaseUI(deps.mintUiPageToken()),
-    },
   ];
 }

package/src/runtime/routes/conversation-routes.ts

@@ -331,6 +331,9 @@ export function handleListMessages(
       attachments: msgAttachments,
       ...(m.toolCalls.length > 0 ? { toolCalls: m.toolCalls } : {}),
       ...(interfaces ? { interfaces } : {}),
+      ...(m.surfaces.length > 0 ? { surfaces: m.surfaces } : {}),
+      ...(m.textSegments.length > 0 ? { textSegments: m.textSegments } : {}),
+      ...(m.contentOrder.length > 0 ? { contentOrder: m.contentOrder } : {}),
     };
   });
 
@@ -554,11 +557,11 @@ export async function handleSendMessage(
   }
 
   const onEvent = makeHubPublisher(smDeps, mapping.conversationId, session);
-  // Route server-authoritative state signals (confirmation_state_changed,
-  // assistant_activity_state) to the SSE hub. Without this, these signals
-  // only travel through session.sendToClient, which is a no-op for
-  // socketless HTTP sessions.
-  session.setStateSignalListener(onEvent);
+  // Wire sendToClient to the SSE hub so all subsystems (prompter, surface
+  // resolver, notifiers, trace emitter) can reach the HTTP client.  The
+  // IPC socket removal (PR #14431) left sendToClient as a no-op; this
+  // restores the delivery path using the SSE hub instead.
+  session.updateClient(onEvent, true);
 
   const attachments = hasAttachments
     ? smDeps.resolveAttachments(attachmentIds)
@@ -610,7 +613,7 @@ export async function handleSendMessage(
     // can finish the current turn and process this queued message.
     if (session.hasAnyPendingConfirmation()) {
       // Emit authoritative denial state for each pending request.
-      // The onStateSignal listener routes these to the SSE hub automatically.
+      // sendToClient (wired to the SSE hub) delivers these to the client.
       for (const interaction of pendingInteractions.getByConversation(
         mapping.conversationId,
       )) {

package/src/runtime/routes/diagnostics-routes.ts

@@ -7,9 +7,17 @@
  */
 
 import { randomBytes } from "node:crypto";
-import { createWriteStream, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import {
+  createWriteStream,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 
 import archiver from "archiver";
 import { and, desc, eq, gte, lte } from "drizzle-orm";
@@ -104,6 +112,58 @@ function redactDeep(value: unknown): unknown {
   return value;
 }
 
+// ---------------------------------------------------------------------------
+// Crash report discovery
+// ---------------------------------------------------------------------------
+
+const CRASH_REPORT_EXTENSIONS = new Set([".crash", ".ips", ".diag"]);
+const CRASH_REPORT_TAR_GZ = ".tar.gz";
+const CRASH_REPORT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+
+function findRecentCrashReports(): string[] {
+  const diagnosticReportsDir = join(
+    homedir(),
+    "Library",
+    "Logs",
+    "DiagnosticReports",
+  );
+
+  try {
+    const entries = readdirSync(diagnosticReportsDir);
+    const now = Date.now();
+    const results: string[] = [];
+
+    for (const entry of entries) {
+      // Case-insensitive prefix match for "vellum-assistant"
+      if (!entry.toLowerCase().startsWith("vellum-assistant")) continue;
+
+      // Check extension
+      const lowerEntry = entry.toLowerCase();
+      const hasValidExt =
+        CRASH_REPORT_EXTENSIONS.has(
+          lowerEntry.slice(lowerEntry.lastIndexOf(".")),
+        ) || lowerEntry.endsWith(CRASH_REPORT_TAR_GZ);
+
+      if (!hasValidExt) continue;
+
+      const filePath = join(diagnosticReportsDir, entry);
+      try {
+        const stat = statSync(filePath);
+        if (!stat.isFile()) continue;
+        if (now - stat.mtimeMs > CRASH_REPORT_MAX_AGE_MS) continue;
+        results.push(filePath);
+      } catch {
+        // Skip files we can't stat
+      }
+    }
+
+    return results;
+  } catch {
+    // Directory doesn't exist or can't be read — not an error
+    return [];
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Diagnostics export handler
 // ---------------------------------------------------------------------------
@@ -344,6 +404,28 @@ async function handleDiagnosticsExport(body: {
 
         archive.pipe(output);
         archive.directory(tempDir, false);
+
+        // Add recent crash report files under crash-reports/.
+        // Text-based crash files (.crash, .ips, .diag) are redacted using the
+        // same patterns as conversation data. Binary archives (.tar.gz) are
+        // added as-is since they can't be meaningfully text-redacted.
+        const crashReportFiles = findRecentCrashReports();
+        for (const filePath of crashReportFiles) {
+          try {
+            const fileName = basename(filePath);
+            if (fileName.toLowerCase().endsWith(CRASH_REPORT_TAR_GZ)) {
+              archive.file(filePath, { name: "crash-reports/" + fileName });
+            } else {
+              const content = readFileSync(filePath, "utf-8");
+              archive.append(redact(content), {
+                name: "crash-reports/" + fileName,
+              });
+            }
+          } catch {
+            // Skip files that can't be read
+          }
+        }
+
         archive.finalize();
       });
 
@@ -382,9 +464,7 @@ const MAX_WINDOW_TITLE_LENGTH = 100;
 
 function sanitizeWindowTitle(title: string | undefined): string {
   if (!title) return "";
-  return title
-    .replace(/[<>]/g, "")
-    .slice(0, MAX_WINDOW_TITLE_LENGTH);
+  return title.replace(/[<>]/g, "").slice(0, MAX_WINDOW_TITLE_LENGTH);
 }
 
 interface DictationBody {
@@ -469,10 +549,7 @@ function buildCombinedDictationPrompt(
   return sections.join("\n");
 }
 
-function buildCommandPrompt(
-  body: DictationBody,
-  stylePrompt?: string,
-): string {
+function buildCommandPrompt(body: DictationBody, stylePrompt?: string): string {
   const sections = [
     "You are a text transformation assistant. The user has selected text and given a voice command to transform it.",
     "",
@@ -559,7 +636,10 @@ async function handleDictation(body: DictationBody): Promise<Response> {
   const stylePrompt = profile.stylePrompt || undefined;
 
   // Command mode: selected text present
-  if (body.context.selectedText && body.context.selectedText.trim().length > 0) {
+  if (
+    body.context.selectedText &&
+    body.context.selectedText.trim().length > 0
+  ) {
     log.info({ mode: "command" }, "Command mode (selected text present)");
     return handleCommandMode(body, profile, profileMeta, stylePrompt);
   }
@@ -669,10 +749,7 @@ async function handleDictation(body: DictationBody): Promise<Response> {
           });
         }
         const cleanedText = input.text?.trim() || transcription;
-        const normalizedText = applyDictionary(
-          cleanedText,
-          profile.dictionary,
-        );
+        const normalizedText = applyDictionary(cleanedText, profile.dictionary);
         return Response.json({
           text: normalizedText,
           mode: "dictation",

package/src/runtime/routes/settings-routes.ts

@@ -1,13 +1,12 @@
 /**
  * HTTP route handlers for settings, identity/avatar, voice config,
- * OAuth connect, Twitter auth, home base, and workspace files.
+ * OAuth connect, Twitter auth, and workspace files.
  *
  * Migrated from IPC handlers:
  *   - handlers/config-voice.ts (voice_config_update)
  *   - handlers/avatar.ts (generate_avatar)
  *   - handlers/oauth-connect.ts (oauth_connect_start)
  *   - handlers/twitter-auth.ts (twitter_auth_start, twitter_auth_status)
- *   - handlers/home-base.ts (home_base_get)
  *   - handlers/workspace-files.ts (workspace_files_list, workspace_file_read)
  *   - handlers/config-tools.ts (tool_names_list, tool_permission_simulate, env_vars_request)
  */
@@ -29,17 +28,7 @@ import {
 } from "../../config/loader.js";
 import { loadSkillCatalog } from "../../config/skills.js";
 import { normalizeActivationKey } from "../../daemon/handlers/config-voice.js";
-import { getHomeBaseAppLink } from "../../home-base/app-link-store.js";
-import {
-  bootstrapHomeBaseAppLink,
-  resolveHomeBaseAppId,
-} from "../../home-base/bootstrap.js";
-import {
-  getPrebuiltHomeBasePreview,
-  getPrebuiltHomeBaseTaskPayload,
-} from "../../home-base/prebuilt/seed.js";
 import { getPublicBaseUrl } from "../../inbound/public-ingress-urls.js";
-import { getApp } from "../../memory/app-store.js";
 import { orchestrateOAuthConnect } from "../../oauth/connect-orchestrator.js";
 import {
   getProviderProfile,
@@ -452,7 +441,8 @@ function handleTwitterAuthStatus(): Response {
     )?.baseUrl as string | undefined;
     const platformAssistantIdResolvable = !!(
       (platformBaseUrlFromEnv || platformBaseUrlFromConfig) &&
-      getPlatformAssistantId()
+      (getSecureKey("credential:vellum:platform_assistant_id") ||
+        getPlatformAssistantId())
     );
 
     const managedPrerequisites = {
@@ -470,13 +460,6 @@ function handleTwitterAuthStatus(): Response {
       "credential:integration:twitter:client_id",
     );
 
-    // Strategy
-    const strategyRaw = getNestedValue(raw, "twitter.strategy") as
-      | string
-      | undefined;
-    const strategy = strategyRaw ?? "auto";
-    const strategyConfigured = strategyRaw !== undefined;
-
     // In managed mode, connected is always false (auth goes through platform)
     const connected = mode === "managed" ? false : !!accessToken;
 
@@ -487,8 +470,6 @@ function handleTwitterAuthStatus(): Response {
       managedAvailable,
       managedPrerequisites,
       localClientConfigured,
-      strategy,
-      strategyConfigured,
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -497,66 +478,6 @@ function handleTwitterAuthStatus(): Response {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Home base
-// ---------------------------------------------------------------------------
-
-function handleHomeBaseGet(ensureLinked: boolean): Response {
-  try {
-    if (ensureLinked !== false) {
-      bootstrapHomeBaseAppLink();
-    }
-
-    const appId = resolveHomeBaseAppId();
-    if (!appId) {
-      return Response.json({ homeBase: null });
-    }
-
-    const link = getHomeBaseAppLink();
-    const source = link?.source ?? "prebuilt_seed";
-
-    let preview: {
-      title: string;
-      subtitle: string;
-      description: string;
-      icon: string;
-      metrics: Array<{ label: string; value: string }>;
-    };
-
-    if (source === "personalized") {
-      const app = getApp(appId);
-      if (app) {
-        preview = {
-          title: app.name,
-          subtitle: "Dashboard",
-          description: app.description ?? "",
-          icon: app.icon ?? "🏠",
-          metrics: [],
-        };
-      } else {
-        preview = getPrebuiltHomeBasePreview();
-      }
-    } else {
-      preview = getPrebuiltHomeBasePreview();
-    }
-
-    const tasks = getPrebuiltHomeBaseTaskPayload();
-
-    return Response.json({
-      homeBase: {
-        appId,
-        source,
-        starterTasks: tasks.starterTasks,
-        onboardingTasks: tasks.onboardingTasks,
-        preview,
-      },
-    });
-  } catch (err) {
-    log.error({ err }, "Failed to resolve home base metadata");
-    return Response.json({ homeBase: null });
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Workspace files (IPC-style list/read)
 // ---------------------------------------------------------------------------
@@ -906,17 +827,6 @@ export function settingsRouteDefinitions(): RouteDefinition[] {
       handler: () => handleTwitterAuthStatus(),
     },
 
-    // Home base
-    {
-      endpoint: "home-base",
-      method: "GET",
-      policyKey: "home-base",
-      handler: ({ url }) => {
-        const ensureLinked = url.searchParams.get("ensureLinked") !== "false";
-        return handleHomeBaseGet(ensureLinked);
-      },
-    },
-
     // Workspace files (IPC-style list/read -- distinct from workspace-routes.ts tree/file)
     {
       endpoint: "workspace-files",

package/src/tools/AGENTS.md

@@ -0,0 +1,38 @@
+# Tools — Agent Instructions
+
+## No New Tools Policy
+
+**New tool registrations require approval from Team Jarvis.**
+
+The tool registration system (`class ... implements Tool` + `registerTool()`) is being phased out in favor of skill-based approaches. Before adding a new tool, contact Team Jarvis for approval.
+
+## Why This Policy Exists
+
+1. **Skills are preferred** — The project direction is to teach the assistant CLI tools via skills rather than hardcoding tool implementations. Skills are progressively disclosed into context, are more portable, and are often self-contained.
+
+2. **Context overhead** — Each registered tool adds to the system prompt and increases token usage for every conversation.
+
+3. **Maintenance burden** — Tools require ongoing maintenance, testing, and security review. Skills can be iterated on independently.
+
+## What To Do Instead
+
+Instead of creating a new tool, consider:
+
+1. **Create a skill**
+
+2. **Use existing tools** — Many capabilities can be achieved by combining existing tools (bash, file operations, network tools) with skill instructions.
+
+3. **External CLI tools** — If you need new functionality, consider whether it can be exposed as a CLI tool that the assistant can invoke via bash.
+
+## If You Have Approval
+
+If Team Jarvis has approved your new tool:
+
+1. The pre-commit hook will block your commit by default
+2. Use `git commit --no-verify` to bypass the hook
+3. Include the approval context in your PR description
+
+
+## Questions?
+
+Contact Team Jarvis before shipping a new tool.

package/src/tools/apps/executors.ts

@@ -9,7 +9,6 @@
  */
 
 import { compileApp } from "../../bundler/app-compiler.js";
-import { setHomeBaseAppLink } from "../../home-base/app-link-store.js";
 import { generateAppIcon } from "../../media/app-icon-generator.js";
 import type {
   AppDefinition,
@@ -115,7 +114,6 @@ export interface AppCreateInput {
   html?: string;
   pages?: Record<string, string>;
   auto_open?: boolean;
-  set_as_home_base?: boolean;
   preview?: Record<string, unknown>;
   /** When provided, controls multifile scaffold behavior. */
   featureFlags?: { multifileEnabled: boolean };
@@ -240,10 +238,6 @@ render(<App />, document.getElementById('app')!);
     }
   }
 
-  if (input.set_as_home_base) {
-    setHomeBaseAppLink(app.id, "personalized");
-  }
-
   // Emit the inline preview card via the proxy without opening a workspace panel.
   // open_mode: "preview" signals to the client that this should be shown inline only.
   if (autoOpen && proxyToolResolver) {

package/src/tools/document/editor-template.ts

@@ -39,17 +39,19 @@ export function generateEditorHTML(
       --v-text: #1D1D1F;
       --v-text-secondary: #86868B;
       --v-text-muted: #AEAEB2;
-      --v-accent: #8A5BE0;
+      --v-accent: #657D5B;
+      --v-accent-hover: #516748;
     }
     @media (prefers-color-scheme: dark) {
       :root {
-        --v-bg: #070D19;
-        --v-surface: #1E293B;
-        --v-surface-border: #334155;
-        --v-text: #F8FAFC;
-        --v-text-secondary: #94A3B8;
-        --v-text-muted: #64748B;
-        --v-accent: #8A5BE0;
+        --v-bg: #20201E;
+        --v-surface: #3A3A37;
+        --v-surface-border: #4A4A46;
+        --v-text: #F5F3EB;
+        --v-text-secondary: #A1A096;
+        --v-text-muted: #6B6B65;
+        --v-accent: #657D5B;
+        --v-accent-hover: #516748;
       }
     }
 

package/src/twitter/platform-proxy-client.ts

@@ -9,7 +9,7 @@
  * Prerequisites:
  * - Platform base URL (env `PLATFORM_BASE_URL` or config `platform.baseUrl`)
  * - Auth token (secure key `credential:vellum:assistant_api_key`)
- * - Platform assistant ID (env `PLATFORM_ASSISTANT_ID`)
+ * - Platform assistant ID (secure key store or env `PLATFORM_ASSISTANT_ID`)
  */
 
 import { getPlatformAssistantId, getPlatformBaseUrl } from "../config/env.js";
@@ -64,10 +64,13 @@ export function resolveAuthToken(): string | undefined {
 }
 
 /**
- * Resolve the platform assistant ID from environment.
+ * Resolve the platform assistant ID from secure storage (local) or environment (containerized).
  */
 export function resolvePlatformAssistantId(): string {
-  return getPlatformAssistantId();
+  return (
+    getSecureKey("credential:vellum:platform_assistant_id") ||
+    getPlatformAssistantId()
+  );
 }
 
 /**

package/src/util/errors.ts

@@ -151,6 +151,18 @@ export class ConfigError extends AssistantError {
   }
 }
 
+export class ProviderNotConfiguredError extends ConfigError {
+  constructor(
+    public readonly requestedProvider: string,
+    public readonly registeredProviders: string[],
+  ) {
+    super(
+      `No providers available. Requested: "${requestedProvider}". Registered: ${registeredProviders.join(", ") || "none"}`,
+    );
+    this.name = "ProviderNotConfiguredError";
+  }
+}
+
 export class DaemonError extends AssistantError {
   constructor(message: string, options?: { cause?: unknown }) {
     super(message, ErrorCode.DAEMON_ERROR, options);

package/src/__tests__/home-base-bootstrap.test.ts

@@ -1,84 +0,0 @@
-import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
-
-const testRoot = mkdtempSync(join(tmpdir(), "home-base-bootstrap-test-"));
-const dataDir = join(testRoot, "data");
-const dbPath = join(testRoot, "assistant.db");
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => dataDir,
-  getDbPath: () => dbPath,
-  ensureDataDir: () => {
-    mkdirSync(dataDir, { recursive: true });
-  },
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getSocketPath: () => join(testRoot, "test.sock"),
-  getPidPath: () => join(testRoot, "test.pid"),
-  getLogPath: () => join(testRoot, "test.log"),
-}));
-
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
-import { getHomeBaseAppLink } from "../home-base/app-link-store.js";
-import {
-  bootstrapHomeBaseAppLink,
-  resolveHomeBaseAppId,
-} from "../home-base/bootstrap.js";
-import { deleteApp } from "../memory/app-store.js";
-import { initializeDb, resetDb } from "../memory/db.js";
-
-describe("home base bootstrap", () => {
-  beforeEach(() => {
-    resetDb();
-    rmSync(testRoot, { recursive: true, force: true });
-    mkdirSync(testRoot, { recursive: true });
-    initializeDb();
-  });
-
-  afterAll(() => {
-    resetDb();
-    rmSync(testRoot, { recursive: true, force: true });
-  });
-
-  test("creates a durable Home Base link on first bootstrap", () => {
-    const result = bootstrapHomeBaseAppLink();
-    expect(result).not.toBeNull();
-    const link = getHomeBaseAppLink();
-
-    expect(result!.linked).toBe(true);
-    expect(link).not.toBeNull();
-    expect(link?.appId).toBe(result!.appId);
-    expect(resolveHomeBaseAppId()).toBe(result!.appId);
-  });
-
-  test("reuses existing link on repeated bootstrap calls", () => {
-    const first = bootstrapHomeBaseAppLink();
-    const second = bootstrapHomeBaseAppLink();
-    expect(first).not.toBeNull();
-    expect(second).not.toBeNull();
-
-    expect(second!.appId).toBe(first!.appId);
-    expect(second!.created).toBe(false);
-  });
-
-  test("relinks when stored app id is stale", () => {
-    const first = bootstrapHomeBaseAppLink();
-    expect(first).not.toBeNull();
-    deleteApp(first!.appId);
-
-    const second = bootstrapHomeBaseAppLink();
-    expect(second).not.toBeNull();
-
-    expect(second!.appId).not.toBe(first!.appId);
-    expect(getHomeBaseAppLink()?.appId).toBe(second!.appId);
-  });
-});