@vellumai/assistant 0.4.43 → 0.4.45

package/src/runtime/local-actor-identity.ts

@@ -1,12 +1,12 @@
 /**
- * Deterministic local actor identity for IPC connections.
+ * Deterministic local actor identity for local connections.
  *
- * IPC (Unix domain socket) connections come from the local macOS native app.
- * No actor token is sent over the socket; instead, the daemon assigns a
+ * Local connections come from the native app via local HTTP sessions.
+ * No actor token is sent over the connection; instead, the daemon assigns a
  * deterministic local actor identity server-side by looking up the vellum
  * channel guardian binding.
  *
- * This routes IPC connections through the same `resolveTrustContext`
+ * This routes local connections through the same `resolveTrustContext`
  * pathway used by HTTP channel ingress, producing equivalent
  * guardian-context behavior for the vellum channel.
  */
@@ -34,34 +34,29 @@ const log = getLogger("local-actor-identity");
  */
 export function buildLocalAuthContext(sessionId: string): AuthContext {
   return {
-    subject: `ipc:self:${sessionId}`,
-    principalType: "ipc",
+    subject: `local:self:${sessionId}`,
+    principalType: "local",
     assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
     sessionId,
-    scopeProfile: "ipc_v1",
-    scopes: resolveScopeProfile("ipc_v1"),
+    scopeProfile: "local_v1",
+    scopes: resolveScopeProfile("local_v1"),
     policyEpoch: CURRENT_POLICY_EPOCH,
   };
 }
 
 /**
- * @deprecated Use `buildLocalAuthContext` instead.
- */
-export const buildIpcAuthContext = buildLocalAuthContext;
-
-/**
- * Resolve the guardian runtime context for a local IPC connection.
+ * Resolve the guardian runtime context for a local connection.
  *
  * Looks up the vellum guardian binding to obtain the `guardianPrincipalId`,
  * then passes it as the sender identity through `resolveTrustContext` --
- * the same pathway HTTP channel routes use. This ensures IPC and HTTP
+ * the same pathway HTTP channel routes use. This ensures local and HTTP
  * produce equivalent trust classification for the vellum channel.
  *
  * When no vellum guardian binding exists (e.g. fresh install before
  * bootstrap), falls back to a minimal guardian context so the local
  * user is not incorrectly denied.
  */
-export function resolveLocalIpcTrustContext(
+export function resolveLocalTrustContext(
   sourceChannel: ChannelId = "vellum",
 ): TrustContext {
   const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
@@ -81,7 +76,7 @@ export function resolveLocalIpcTrustContext(
 
   // No guardian contact with a principalId — bootstrap via ensureVellumGuardianBinding
   // to self-heal (creates the binding + contact if missing).
-  log.debug("No vellum guardian contact found; bootstrapping binding for IPC");
+  log.debug("No vellum guardian contact found; bootstrapping binding for local session");
   try {
     const principalId = ensureVellumGuardianBinding(assistantId);
     const trustCtx = resolveTrustContext({
@@ -107,15 +102,15 @@ export function resolveLocalIpcTrustContext(
 }
 
 /**
- * Build an AuthContext for a local IPC connection.
+ * Build an AuthContext for a local connection.
  *
  * Produces the same AuthContext shape that HTTP routes receive from JWT
- * verification, using the `ipc_v1` scope profile. The `actorPrincipalId`
+ * verification, using the `local_v1` scope profile. The `actorPrincipalId`
  * is populated from the vellum guardian binding when available, enabling
  * downstream code to resolve guardian context using the same
  * `authContext.actorPrincipalId` path as HTTP sessions.
  */
-export function resolveLocalIpcAuthContext(sessionId: string): AuthContext {
+export function resolveLocalAuthContext(sessionId: string): AuthContext {
   const authContext = buildLocalAuthContext(sessionId);
 
   // Enrich with the guardian principal ID from contacts-first path
@@ -128,10 +123,10 @@ export function resolveLocalIpcAuthContext(sessionId: string): AuthContext {
   }
 
   // Self-heal: no guardian contact with principalId — bootstrap via
-  // ensureVellumGuardianBinding (mirrors resolveLocalIpcTrustContext).
+  // ensureVellumGuardianBinding (mirrors resolveLocalTrustContext).
   try {
     log.debug(
-      "No vellum guardian contact found; bootstrapping binding for IPC auth",
+      "No vellum guardian contact found; bootstrapping binding for local auth",
     );
     const principalId = ensureVellumGuardianBinding(authContext.assistantId);
     return { ...authContext, actorPrincipalId: principalId };

package/src/runtime/middleware/error-handler.ts

@@ -2,7 +2,11 @@
  * Centralized error handling for runtime HTTP request dispatch.
  */
 
-import { ConfigError, IngressBlockedError } from "../../util/errors.js";
+import {
+  ConfigError,
+  IngressBlockedError,
+  ProviderNotConfiguredError,
+} from "../../util/errors.js";
 import { getLogger } from "../../util/logger.js";
 import { httpError } from "../http-errors.js";
 
@@ -26,6 +30,15 @@ export async function withErrorHandling(
       );
       return httpError("UNPROCESSABLE_ENTITY", err.message, 422);
     }
+    if (err instanceof ProviderNotConfiguredError) {
+      log.warn({ err, endpoint }, "No LLM provider configured");
+      const envVar = `${err.requestedProvider.toUpperCase()}_API_KEY`;
+      return httpError(
+        "UNPROCESSABLE_ENTITY",
+        `No API key configured. Set ${envVar} in your environment or run \`vellum hatch\` to set up your assistant.`,
+        422,
+      );
+    }
     if (err instanceof ConfigError) {
       log.warn({ err, endpoint }, "Runtime HTTP config error");
       return httpError("UNPROCESSABLE_ENTITY", err.message, 422);

package/src/runtime/pending-interactions.ts

@@ -1,11 +1,12 @@
 /**
  * In-memory tracker that maps requestId to session info for pending
- * confirmation and secret interactions.
+ * confirmation, secret, host_bash, and host_file interactions.
  *
- * When the agent loop emits a confirmation_request or secret_request,
- * the onEvent callback registers the interaction here. Standalone HTTP
- * endpoints (/v1/confirm, /v1/secret, /v1/trust-rules) look up the
- * session from this tracker to resolve the interaction.
+ * When the agent loop emits a confirmation_request, secret_request,
+ * host_bash_request, or host_file_request, the onEvent callback registers
+ * the interaction here. Standalone HTTP endpoints (/v1/confirm, /v1/secret,
+ * /v1/trust-rules, /v1/host-bash-result, /v1/host-file-result) look up
+ * the session from this tracker to resolve the interaction.
  */
 
 import type { Session } from "../daemon/session.js";
@@ -28,7 +29,7 @@ export interface ConfirmationDetails {
 export interface PendingInteraction {
   session: Session;
   conversationId: string;
-  kind: "confirmation" | "secret";
+  kind: "confirmation" | "secret" | "host_bash" | "host_file";
   confirmationDetails?: ConfirmationDetails;
 }
 
@@ -78,12 +79,23 @@ export function getByConversation(
 }
 
 /**
- * Remove all pending interactions for a given session.
- * Used when auto-denying all pending confirmations (e.g. new user message).
+ * Remove pending confirmation and secret interactions for a given session.
+ * Used when auto-denying all pending interactions (e.g. new user message).
+ *
+ * host_bash and host_file interactions are intentionally skipped — they
+ * represent in-flight tool executions proxied to the client, not
+ * confirmations to auto-deny. Removing them would orphan the request: the
+ * client would POST to /v1/host-bash-result or /v1/host-file-result after
+ * completing the operation, get a 404, and the proxy timer would fire with
+ * a spurious timeout error.
  */
 export function removeBySession(session: Session): void {
   for (const [requestId, interaction] of pending) {
-    if (interaction.session === session) {
+    if (
+      interaction.session === session &&
+      interaction.kind !== "host_bash" &&
+      interaction.kind !== "host_file"
+    ) {
       pending.delete(requestId);
     }
   }

package/src/runtime/routes/app-management-routes.ts

@@ -2,7 +2,7 @@
  * HTTP route definitions for app CRUD, bundling, sharing, versioning,
  * gallery, and signing operations.
  *
- * Business logic is extracted from the IPC handlers in
+ * Business logic is extracted from the handlers in
  * `daemon/handlers/apps.ts`, `daemon/handlers/publish.ts`,
  * `daemon/handlers/signing.ts`, and `daemon/handlers/open-bundle-handler.ts`
  * so that the same operations are available over HTTP.
@@ -23,8 +23,6 @@ import { compileApp } from "../../bundler/app-compiler.js";
 import { scanBundle } from "../../bundler/bundle-scanner.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
 import { defaultGallery } from "../../gallery/default-gallery.js";
-import { resolveHomeBaseAppId } from "../../home-base/bootstrap.js";
-import { isPrebuiltHomeBaseApp } from "../../home-base/prebuilt-home-base-updater.js";
 import {
   getAppDiff,
   getAppHistory,
@@ -90,45 +88,19 @@ function listAppsFiltered(): Array<{
   version: string;
   contentId: string;
 }> {
-  const allApps = listApps();
-  const homeBaseId = resolveHomeBaseAppId();
-
-  const excludeIds = new Set<string>();
-  if (homeBaseId) {
-    excludeIds.add(homeBaseId);
-  } else {
-    for (const a of allApps) {
-      if (isPrebuiltHomeBaseApp(a)) {
-        excludeIds.add(a.id);
-        continue;
-      }
-      const fullApp = getApp(a.id);
-      if (fullApp && isPrebuiltHomeBaseApp(fullApp)) {
-        excludeIds.add(a.id);
-        continue;
-      }
-    }
-  }
-
-  return allApps
-    .filter((a) => {
-      if (excludeIds.has(a.id)) return false;
-      if (isPrebuiltHomeBaseApp(a)) return false;
-      return true;
-    })
-    .map((a) => {
-      const version = a.version ?? "1.0.0";
-      const contentId = computeContentId(a.name);
-      return {
-        id: a.id,
-        name: a.name,
-        description: a.description,
-        icon: a.icon,
-        createdAt: a.createdAt,
-        version,
-        contentId,
-      };
-    });
+  return listApps().map((a) => {
+    const version = a.version ?? "1.0.0";
+    const contentId = computeContentId(a.name);
+    return {
+      id: a.id,
+      name: a.name,
+      description: a.description,
+      icon: a.icon,
+      createdAt: a.createdAt,
+      version,
+      contentId,
+    };
+  });
 }
 
 function getAppDataResult(
@@ -251,7 +223,9 @@ function listSharedApps(): Array<Record<string, unknown>> {
 
 function forkSharedApp(
   appUuid: string,
-): { success: true; appId: string; name: string } | { success: false; error: string } {
+):
+  | { success: true; appId: string; name: string }
+  | { success: false; error: string } {
   if (
     appUuid.includes("/") ||
     appUuid.includes("\\") ||
@@ -294,10 +268,11 @@ function forkSharedApp(
 
 async function installGalleryApp(
   galleryAppId: string,
-): Promise<{ success: true; appId: string; name: string } | { success: false; error: string }> {
-  const galleryApp = defaultGallery.apps.find(
-    (a) => a.id === galleryAppId,
-  );
+): Promise<
+  | { success: true; appId: string; name: string }
+  | { success: false; error: string }
+> {
+  const galleryApp = defaultGallery.apps.find((a) => a.id === galleryAppId);
   if (!galleryApp) {
     return {
       success: false,
@@ -408,7 +383,11 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           log.error({ err }, "Failed to list apps");
-          return httpError("INTERNAL_ERROR", `Failed to list apps: ${message}`, 500);
+          return httpError(
+            "INTERNAL_ERROR",
+            `Failed to list apps: ${message}`,
+            500,
+          );
         }
       },
     },
@@ -560,15 +539,16 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
               return httpError("BAD_REQUEST", "payload is not valid JSON", 400);
             }
 
-            const signatureJson: import("../../bundler/bundle-signer.js").SignatureJson = {
-              algorithm: "ed25519",
-              signer: {
-                key_id: body.keyId,
-                display_name: "HTTP Signer",
-              },
-              content_hashes: contentHashes,
-              signature: body.signature,
-            };
+            const signatureJson: import("../../bundler/bundle-signer.js").SignatureJson =
+              {
+                algorithm: "ed25519",
+                signer: {
+                  key_id: body.keyId,
+                  display_name: "HTTP Signer",
+                },
+                content_hashes: contentHashes,
+                signature: body.signature,
+              };
             return Response.json({ signed: true, signatureJson });
           }
 
@@ -629,8 +609,14 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
           return Response.json({ success: true, result });
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          log.error({ err, appId: params.id }, "Error handling app data request");
-          return Response.json({ success: false, error: message }, { status: 400 });
+          log.error(
+            { err, appId: params.id },
+            "Error handling app data request",
+          );
+          return Response.json(
+            { success: false, error: message },
+            { status: 400 },
+          );
         }
       },
     },
@@ -656,8 +642,14 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
           return Response.json({ success: true, result });
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          log.error({ err, appId: params.id }, "Error handling app data request");
-          return Response.json({ success: false, error: message }, { status: 400 });
+          log.error(
+            { err, appId: params.id },
+            "Error handling app data request",
+          );
+          return Response.json(
+            { success: false, error: message },
+            { status: 400 },
+          );
         }
       },
     },
@@ -704,7 +696,10 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
           });
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          log.error({ err, appId: params.id }, "Failed to handle app open request");
+          log.error(
+            { err, appId: params.id },
+            "Failed to handle app open request",
+          );
           return httpError(
             "INTERNAL_ERROR",
             `Failed to open app: ${message}`,
@@ -819,8 +814,7 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
               400,
             );
           }
-          const toCommit =
-            url.searchParams.get("toCommit") ?? undefined;
+          const toCommit = url.searchParams.get("toCommit") ?? undefined;
           const diff = await getAppDiff(params.id, fromCommit, toCommit);
           return Response.json({ appId: params.id, diff });
         } catch (err) {
@@ -893,12 +887,14 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
       handler: async ({ params }) => {
         try {
           // Package without signing callback (HTTP clients handle signing
-          // separately or skip it). The IPC flow used a socket-based
-          // signing callback; HTTP callers can use the sign-bundle
+          // separately or skip it). HTTP callers can use the sign-bundle
           // endpoint independently if needed.
           const result = await packageApp(params.id);
           const bundleData = readFileSync(result.bundlePath);
-          const { shareToken } = createSharedAppLink(bundleData, result.manifest);
+          const { shareToken } = createSharedAppLink(
+            bundleData,
+            result.manifest,
+          );
 
           const shareUrl = `/v1/apps/shared/${shareToken}`;
 

package/src/runtime/routes/approval-routes.ts

@@ -107,9 +107,7 @@ export async function handleConfirm(
     }
 
     if (selectedScope) {
-      const validScopes = (confirmation.scopeOptions ?? []).map(
-        (o) => o.scope,
-      );
+      const validScopes = (confirmation.scopeOptions ?? []).map((o) => o.scope);
       if (validScopes.length === 0) {
         if (selectedScope !== "everywhere") {
           return httpError(