@vellumai/assistant 0.4.44 → 0.4.45

package/src/daemon/session-tool-setup.ts

@@ -27,10 +27,14 @@ import { coreAppProxyTools } from "../tools/apps/definitions.js";
 import { registerSessionSender } from "../tools/browser/browser-screencast.js";
 import { requestComputerControlTool } from "../tools/computer-use/request-computer-control.js";
 import type { ToolExecutor } from "../tools/executor.js";
-import { getAllToolDefinitions } from "../tools/registry.js";
+import {
+  getAllToolDefinitions,
+  getMcpToolDefinitions,
+} from "../tools/registry.js";
 import type {
   ProxyApprovalCallback,
   ProxyApprovalRequest,
+  ToolContext,
   ToolExecutionResult,
   ToolLifecycleEventHandler,
 } from "../tools/types.js";
@@ -87,7 +91,7 @@ export interface ToolSetupContext extends SurfaceSessionContext {
   allowedToolNames?: Set<string>;
   /** Session memory policy — used to propagate scopeId and strictSideEffects into ToolContext. */
   memoryPolicy: { scopeId: string; strictSideEffects: boolean };
-  /** True when the session has no connected IPC client (HTTP-only path). */
+  /** True when the session has no connected client (HTTP-only path). */
   hasNoClient?: boolean;
   /** When true, the session is executing a task run and must not become interactive. */
   headlessLock?: boolean;
@@ -97,6 +101,10 @@ export interface ToolSetupContext extends SurfaceSessionContext {
   trustContext?: TrustContext;
   /** Voice/call session ID, if the session originates from a call. Propagated into ToolContext for scoped grant consumption. */
   callSessionId?: string;
+  /** Optional proxy for delegating host_bash execution to a connected client. */
+  hostBashProxy?: import("./host-bash-proxy.js").HostBashProxy;
+  /** Optional proxy for delegating host_file_read/write/edit execution to a connected client. */
+  hostFileProxy?: import("./host-file-proxy.js").HostFileProxy;
 }
 
 // ── buildToolDefinitions ─────────────────────────────────────────────
@@ -150,7 +158,9 @@ export function createToolExecutor(
       markDoordashStepInProgress(ctx, input);
     }
 
-    const result = await executor.execute(name, input, {
+    // Build the context object shared by both the skill_execute interception
+    // path and the regular executor path.
+    const toolContext: ToolContext = {
       workingDir: ctx.workingDir,
       sessionId: ctx.conversationId,
       conversationId: ctx.conversationId,
@@ -175,6 +185,8 @@ export function createToolExecutor(
       memoryScopeId: ctx.memoryPolicy.scopeId,
       forcePromptSideEffects: ctx.memoryPolicy.strictSideEffects,
       toolUseId,
+      hostBashProxy: ctx.hostBashProxy,
+      hostFileProxy: ctx.hostFileProxy,
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
         // Tool context's sendToClient uses a loose { type: string; [key: string]: unknown }
@@ -315,7 +327,38 @@ export function createToolExecutor(
             : ("deny" as const),
         };
       },
-    });
+    };
+
+    // Intercept skill_execute: extract the real tool name and input, then
+    // route through the full executor pipeline so the underlying tool's
+    // risk level, permission checks, hooks, and lifecycle events all fire
+    // with the real tool name.
+    if (name === "skill_execute") {
+      const toolName = typeof input.tool === "string" ? input.tool : "";
+      const toolInput =
+        input.input != null && typeof input.input === "object"
+          ? (input.input as Record<string, unknown>)
+          : {};
+
+      if (!toolName) {
+        return {
+          content:
+            'Error: skill_execute requires a "tool" parameter with the tool name',
+          isError: true,
+        };
+      }
+
+      const result = await executor.execute(toolName, toolInput, toolContext);
+
+      runPostExecutionSideEffects(toolName, toolInput, result, {
+        ctx,
+        broadcastToAllClients,
+      });
+
+      return result;
+    }
+
+    const result = await executor.execute(name, input, toolContext);
 
     runPostExecutionSideEffects(name, input, result, {
       ctx,
@@ -486,6 +529,63 @@ export interface SkillProjectionContext {
   allowedToolNames?: Set<string>;
   /** When > 0, the resolveTools callback returns no tools at all. */
   toolsDisabledDepth: number;
+  /** Channel capabilities — read lazily per turn for conditional tool filtering. */
+  readonly channelCapabilities?: {
+    channel: string;
+    supportsDynamicUi: boolean;
+  };
+  /** True when no client is connected (HTTP-only). */
+  readonly hasNoClient?: boolean;
+  /** True when the conversation has user-uploaded attachments. */
+  hasAttachments?: boolean;
+}
+
+// ── Conditional tool sets ────────────────────────────────────────────
+
+const UI_SURFACE_TOOL_NAMES = new Set(["ui_show", "ui_update", "ui_dismiss"]);
+const HOST_TOOL_NAMES = new Set([
+  "host_file_read",
+  "host_file_write",
+  "host_file_edit",
+  "host_bash",
+]);
+const ASSET_TOOL_NAMES = new Set(["asset_search", "asset_materialize"]);
+const CLIENT_CAPABILITY_TOOL_NAMES = new Set([
+  "app_open",
+  "computer_use_request_control",
+]);
+const PLATFORM_TOOL_NAMES = new Set(["request_system_permission"]);
+
+/**
+ * Determine whether a tool should be included in the LLM tool definitions
+ * for the current turn based on session context. Tools not active for the
+ * current context are omitted from the definitions sent to the provider,
+ * reducing noise and preventing the model from attempting calls that would
+ * fail.
+ */
+export function isToolActiveForContext(
+  name: string,
+  ctx: SkillProjectionContext,
+): boolean {
+  if (UI_SURFACE_TOOL_NAMES.has(name)) {
+    return ctx.channelCapabilities?.supportsDynamicUi ?? !ctx.hasNoClient;
+  }
+  if (HOST_TOOL_NAMES.has(name)) {
+    // Host tools require a connected client — without one, there is no human
+    // to approve execution and the guardian auto-approve path would allow
+    // unchecked host command execution on the daemon host.
+    return !ctx.hasNoClient;
+  }
+  if (ASSET_TOOL_NAMES.has(name)) {
+    return ctx.hasAttachments ?? false;
+  }
+  if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
+    return !ctx.hasNoClient;
+  }
+  if (PLATFORM_TOOL_NAMES.has(name)) {
+    return process.platform === "darwin" && !ctx.hasNoClient;
+  }
+  return true;
 }
 
 /**
@@ -493,6 +593,12 @@ export interface SkillProjectionContext {
  * dynamically projected skill tools on each agent turn. Also updates
  * allowedToolNames so newly-activated skill tools aren't blocked by
  * the executor's stale gate.
+ *
+ * Core (non-MCP) tool definitions are captured at session creation and
+ * reused on each turn. MCP tool definitions are re-read from the global
+ * registry on each turn so that tools registered after session creation
+ * (e.g. via `vellum mcp reload`) are automatically picked up without
+ * requiring session disposal or app restart.
  */
 export function createResolveToolsCallback(
   toolDefs: ToolDefinition[],
@@ -500,6 +606,20 @@ export function createResolveToolsCallback(
 ): ((history: Message[]) => ToolDefinition[]) | undefined {
   if (toolDefs.length === 0) return undefined;
 
+  // Separate the initial tool defs into core (stable) and MCP (dynamic).
+  // We keep core tools from the snapshot and re-read MCP tools each turn.
+  const initialMcpDefs = getMcpToolDefinitions();
+  const initialMcpNames = new Set(initialMcpDefs.map((d) => d.name));
+  const coreToolDefs = toolDefs.filter((d) => !initialMcpNames.has(d.name));
+  log.debug(
+    {
+      coreCount: coreToolDefs.length,
+      mcpCount: initialMcpDefs.length,
+      mcpTools: initialMcpDefs.map((d) => d.name),
+    },
+    "Session tool resolver initialized",
+  );
+
   return (history: Message[]) => {
     // When tools are explicitly disabled (e.g. during pointer generation),
     // return an empty tool list so the LLM never sees tool definitions and
@@ -509,6 +629,26 @@ export function createResolveToolsCallback(
       return [];
     }
 
+    // Filter core tools based on current session context so that tools
+    // irrelevant to this turn (e.g. UI tools when no client is connected)
+    // are omitted from the definitions sent to the provider.
+    const filteredCoreDefs = coreToolDefs.filter((d) =>
+      isToolActiveForContext(d.name, ctx),
+    );
+
+    // Re-read MCP tool definitions from the registry each turn so sessions
+    // automatically pick up tools added/removed by `vellum mcp reload`.
+    const currentMcpDefs = getMcpToolDefinitions();
+    log.debug(
+      {
+        coreCount: filteredCoreDefs.length,
+        mcpCount: currentMcpDefs.length,
+        mcpTools: currentMcpDefs.map((d) => d.name),
+      },
+      "MCP tools resolved for turn",
+    );
+    const allBaseDefs = [...filteredCoreDefs, ...currentMcpDefs];
+
     const effectivePreactivated = [
       ...DEFAULT_PREACTIVATED_SKILL_IDS,
       ...(ctx.preactivatedSkillIds ?? []),
@@ -518,11 +658,11 @@ export function createResolveToolsCallback(
       previouslyActiveSkillIds: ctx.skillProjectionState,
       cache: ctx.skillProjectionCache,
     });
-    const turnAllowed = new Set(ctx.coreToolNames);
+    const turnAllowed = new Set(allBaseDefs.map((d) => d.name));
     for (const name of projection.allowedToolNames) {
       turnAllowed.add(name);
     }
     ctx.allowedToolNames = turnAllowed;
-    return [...toolDefs, ...projection.toolDefinitions];
+    return allBaseDefs;
   };
 }

package/src/daemon/session.ts

@@ -46,6 +46,8 @@ import type { AuthContext } from "../runtime/auth/types.js";
 import * as approvalOverrides from "../runtime/session-approval-overrides.js";
 import { ToolExecutor } from "../tools/executor.js";
 import type { AssistantAttachmentDraft } from "./assistant-attachments.js";
+import { HostBashProxy } from "./host-bash-proxy.js";
+import { HostFileProxy } from "./host-file-proxy.js";
 import type {
   ServerMessage,
   SurfaceData,
@@ -82,15 +84,13 @@ import {
   drainQueue as drainQueueImpl,
   processMessage as processMessageImpl,
 } from "./session-process.js";
-import type {
-  QueueDrainReason,
-  QueueMetrics,
-} from "./session-queue-manager.js";
+import type { QueueDrainReason } from "./session-queue-manager.js";
 import { MessageQueue } from "./session-queue-manager.js";
 import type {
   ChannelCapabilities,
   TrustContext,
 } from "./session-runtime-assembly.js";
+import { messagesContainAttachments } from "./session-runtime-assembly.js";
 import type { SkillProjectionCache } from "./session-skill-tools.js";
 import {
   createSurfaceMutex,
@@ -121,7 +121,6 @@ export const DEFAULT_MEMORY_POLICY: Readonly<SessionMemoryPolicy> =
 
 export { findLastUndoableUserMessageIndex } from "./session-history.js";
 export type { QueueDrainReason, QueuePolicy } from "./session-queue-manager.js";
-export { MAX_QUEUE_DEPTH } from "./session-queue-manager.js";
 
 export class Session {
   public readonly conversationId: string;
@@ -157,9 +156,12 @@ export class Session {
   /** @internal */ currentRequestId?: string;
   /** @internal */ conflictGate = new ConflictGate();
   /** @internal */ hasNoClient = false;
+  /** @internal */ hasAttachments = false;
   /** @internal */ headlessLock = false;
   /** @internal */ taskRunId?: string;
   /** @internal */ callSessionId?: string;
+  /** @internal */ hostBashProxy?: HostBashProxy;
+  /** @internal */ hostFileProxy?: HostFileProxy;
   /** @internal */ readonly queue = new MessageQueue();
   /** @internal */ currentActiveSurfaceId?: string;
   /** @internal */ currentPage?: string;
@@ -336,7 +338,6 @@ export class Session {
         maxInputTokens: config.contextWindow.maxInputTokens,
         thinking: config.thinking,
         effort: config.effort,
-        maxToolUseTurns: config.maxToolUseTurns,
       },
       toolDefs.length > 0 ? toolDefs : undefined,
       toolDefs.length > 0 ? toolExecutor : undefined,
@@ -358,7 +359,15 @@ export class Session {
   // ── Lifecycle ────────────────────────────────────────────────────
 
   async loadFromDb(): Promise<void> {
-    return loadFromDbImpl(this);
+    await loadFromDbImpl(this);
+    // Scan loaded history for attachment content blocks so that asset
+    // tools are available when resuming a conversation that already had
+    // attachments. One-way: once true it stays true for the session.
+    // Also picks up the hasAttachments flag set by loadFromDbImpl which
+    // scans compacted (sliced-off) messages that aren't in this.messages.
+    if (!this.hasAttachments && messagesContainAttachments(this.messages)) {
+      this.hasAttachments = true;
+    }
   }
 
   async ensureActorScopedHistory(): Promise<void> {
@@ -370,12 +379,17 @@ export class Session {
   updateClient(
     sendToClient: (msg: ServerMessage) => void,
     hasNoClient = false,
+    opts?: { skipProxySenderUpdate?: boolean },
   ): void {
     this.sendToClient = sendToClient;
     this.hasNoClient = hasNoClient;
     this.prompter.updateSender(sendToClient);
     this.secretPrompter.updateSender(sendToClient);
     this.traceEmitter.updateSender(sendToClient);
+    if (!opts?.skipProxySenderUpdate) {
+      this.hostBashProxy?.updateSender(sendToClient, !hasNoClient);
+      this.hostFileProxy?.updateSender(sendToClient, !hasNoClient);
+    }
   }
 
   /** Returns the current sendToClient reference for identity comparison. */
@@ -383,6 +397,20 @@ export class Session {
     return this.sendToClient;
   }
 
+  /** Mark host proxies as unavailable so tool execution uses local fallback. */
+  clearProxyAvailability(): void {
+    this.hostBashProxy?.updateSender(this.sendToClient, false);
+    this.hostFileProxy?.updateSender(this.sendToClient, false);
+  }
+
+  /** Restore host proxy availability based on whether a real client is connected. */
+  restoreProxyAvailability(): void {
+    if (!this.hasNoClient) {
+      this.hostBashProxy?.updateSender(this.sendToClient, true);
+      this.hostFileProxy?.updateSender(this.sendToClient, true);
+    }
+  }
+
   setSandboxOverride(enabled: boolean | undefined): void {
     this.sandboxOverride = enabled;
   }
@@ -418,6 +446,8 @@ export class Session {
 
   dispose(): void {
     approvalOverrides.clearMode(this.conversationId);
+    this.hostBashProxy?.dispose();
+    this.hostFileProxy?.dispose();
     disposeSession(this);
   }
 
@@ -445,7 +475,7 @@ export class Session {
     metadata?: Record<string, unknown>,
     options?: { isInteractive?: boolean },
     displayContent?: string,
-  ): { queued: boolean; rejected?: boolean; requestId: string } {
+  ): { queued: boolean; requestId: string; rejected?: boolean } {
     return enqueueMessageImpl(
       this,
       content,
@@ -464,10 +494,6 @@ export class Session {
     return this.queue.length;
   }
 
-  getQueueMetrics(): QueueMetrics {
-    return this.queue.getMetrics();
-  }
-
   hasQueuedMessages(): boolean {
     return !this.queue.isEmpty;
   }
@@ -530,7 +556,7 @@ export class Session {
     // guardian trust-class and conversation context are available.
 
     // Emit authoritative confirmation state and activity transition centrally
-    // so ALL callers (IPC handlers, /v1/confirm, channel bridges) get
+    // so ALL callers (HTTP handlers, /v1/confirm, channel bridges) get
     // consistent events without duplicating emission logic.
     const resolvedState =
       decision === "deny" || decision === "always_deny"
@@ -573,6 +599,39 @@ export class Session {
     this.secretPrompter.resolveSecret(requestId, value, delivery);
   }
 
+  resolveHostBash(
+    requestId: string,
+    response: {
+      stdout: string;
+      stderr: string;
+      exitCode: number | null;
+      timedOut: boolean;
+    },
+  ): void {
+    this.hostBashProxy?.resolve(requestId, response);
+  }
+
+  setHostBashProxy(proxy: HostBashProxy | undefined): void {
+    if (this.hostBashProxy && this.hostBashProxy !== proxy) {
+      this.hostBashProxy.dispose();
+    }
+    this.hostBashProxy = proxy;
+  }
+
+  resolveHostFile(
+    requestId: string,
+    response: { content: string; isError: boolean },
+  ): void {
+    this.hostFileProxy?.resolve(requestId, response);
+  }
+
+  setHostFileProxy(proxy: HostFileProxy | undefined): void {
+    if (this.hostFileProxy && this.hostFileProxy !== proxy) {
+      this.hostFileProxy.dispose();
+    }
+    this.hostFileProxy = proxy;
+  }
+
   // ── Server-authoritative state signals ─────────────────────────────
 
   emitConfirmationStateChanged(
@@ -666,6 +725,11 @@ export class Session {
     if (!this.processing) {
       await this.ensureActorScopedHistory();
     }
+    // One-way flag: once an attachment arrives, asset tools stay available
+    // for the remainder of the session.
+    if (!this.hasAttachments && attachments.length > 0) {
+      this.hasAttachments = true;
+    }
     return persistUserMessageImpl(
       this,
       content,

package/src/errors.ts

@@ -18,7 +18,6 @@
  *      ├─ PermissionDeniedError
  *      ├─ ConfigError
  *      ├─ DaemonError
- *      ├─ IpcError
  *      ├─ PlatformError
  *      ├─ IntegrityError
  *      └─ IngressBlockedError
@@ -32,7 +31,6 @@ export {
   ErrorCode,
   IngressBlockedError,
   IntegrityError,
-  IpcError,
   PermissionDeniedError,
   PlatformError,
   ProviderError,

package/src/export/formatter.ts

@@ -51,6 +51,12 @@ function extractText(blocks: ContentBlock[]): string {
           parts.push(`[Result: ${truncate(block.content ?? "", 500)}]`);
         }
         break;
+      case "server_tool_use":
+        parts.push(`[Web search: ${block.name ?? "web_search"}]`);
+        break;
+      case "web_search_tool_result":
+        parts.push("[Web search results]");
+        break;
     }
   }
   return parts.join("\n");

package/src/mcp/mcp-oauth-provider.ts

@@ -445,9 +445,7 @@ export async function deleteMcpOAuthCredentials(
     { key: "client_info", result: clientResult },
     { key: "discovery", result: discoveryResult },
   ];
-  const errors = results
-    .filter((r) => r.result === "error")
-    .map((r) => r.key);
+  const errors = results.filter((r) => r.result === "error").map((r) => r.key);
   if (errors.length > 0) {
     log.warn(
       { serverId, failedKeys: errors },

package/src/media/avatar-router.ts

@@ -1,15 +1,12 @@
 /**
- * Strategy router for avatar generation.
- * Selects managed platform or local Gemini path based on config.
+ * Avatar generation router.
+ * Tries managed platform path if available, falls back to local Gemini.
  */
 
 import { getConfig } from "../config/loader.js";
 import { ConfigError, ProviderError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import type {
-  AvatarGenerationResult,
-  AvatarGenerationStrategy,
-} from "./avatar-types.js";
+import type { AvatarGenerationResult } from "./avatar-types.js";
 import { generateImage } from "./gemini-image-service.js";
 import {
   generateManagedAvatar,
@@ -18,10 +15,6 @@ import {
 
 const log = getLogger("avatar-router");
 
-export function getAvatarStrategy(): AvatarGenerationStrategy {
-  return getConfig().avatar.generationStrategy;
-}
-
 async function generateLocal(
   prompt: string,
   correlationId?: string,
@@ -58,36 +51,35 @@ async function generateLocal(
 
 export async function routedGenerateAvatar(
   prompt: string,
-  options?: { correlationId?: string },
+  options?: { correlationId?: string; model?: string },
 ): Promise<AvatarGenerationResult> {
-  const strategy = getAvatarStrategy();
   const correlationId = options?.correlationId;
+  const model = options?.model;
 
-  if (strategy === "managed_required") {
-    const managed = await generateManagedAvatar(prompt, { correlationId });
-    return {
-      imageBase64: managed.image.data_base64,
-      mimeType: managed.image.mime_type,
-      pathUsed: "managed",
-      correlationId: managed.correlation_id,
-    };
-  }
-
-  if (strategy === "local_only") {
-    return generateLocal(prompt, correlationId);
-  }
-
-  // managed_prefer: try managed first if available, fall back to local
+  // Try managed platform path if available, fall back to local Gemini
   if (isManagedAvailable()) {
     try {
-      const managed = await generateManagedAvatar(prompt, { correlationId });
+      const managed = await generateManagedAvatar(prompt, {
+        correlationId,
+        model,
+      });
       return {
         imageBase64: managed.image.data_base64,
         mimeType: managed.image.mime_type,
         pathUsed: "managed",
         correlationId: managed.correlation_id,
+        model,
       };
     } catch (err) {
+      const config = getConfig();
+      const geminiKey = config.apiKeys.gemini ?? process.env.GEMINI_API_KEY;
+      if (!geminiKey) {
+        log.warn(
+          { err: err instanceof Error ? err.message : String(err) },
+          "Managed avatar generation failed and no local Gemini key configured; re-throwing",
+        );
+        throw err;
+      }
       log.warn(
         { err: err instanceof Error ? err.message : String(err) },
         "Managed avatar generation failed, falling back to local Gemini",

package/src/media/avatar-types.ts

@@ -1,5 +1,3 @@
-export type AvatarGenerationStrategy = "managed_required" | "managed_prefer" | "local_only";
-
 export interface ManagedAvatarImagePayload {
   mime_type: string;
   data_base64: string;
@@ -9,17 +7,6 @@ export interface ManagedAvatarImagePayload {
 
 export interface ManagedAvatarResponse {
   image: ManagedAvatarImagePayload;
-  usage: { billable: boolean; class_name: string };
-  generation_source: string;
-  profile: string;
-  correlation_id: string;
-}
-
-export interface ManagedAvatarErrorResponse {
-  code: string;
-  subcode: string;
-  detail: string;
-  retryable: boolean;
   correlation_id: string;
 }
 
@@ -53,8 +40,14 @@ export interface AvatarGenerationResult {
   mimeType: string;
   pathUsed: "managed" | "local";
   correlationId?: string;
+  model?: string;
 }
 
-export const AVATAR_MIME_ALLOWLIST = new Set(["image/png", "image/jpeg", "image/webp"]);
+export const AVATAR_MIME_ALLOWLIST = new Set([
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+]);
 export const AVATAR_MAX_DECODED_BYTES = 10 * 1024 * 1024;
 export const AVATAR_PROMPT_MAX_LENGTH = 2000;
+export const VERTEX_IMAGE_DEFAULT_MODEL = "imagen-3.0-generate-002";