@vellumai/assistant 0.4.48 → 0.4.50

package/src/daemon/handlers/sessions.ts

@@ -35,6 +35,7 @@ import * as pendingInteractions from "../../runtime/pending-interactions.js";
 import { getSubagentManager } from "../../subagent/index.js";
 import { truncate } from "../../util/truncate.js";
 import { HostBashProxy } from "../host-bash-proxy.js";
+import { HostCuProxy } from "../host-cu-proxy.js";
 import { HostFileProxy } from "../host-file-proxy.js";
 import type {
   CancelRequest,
@@ -60,7 +61,6 @@ import {
   type HandlerContext,
   log,
   pendingStandaloneSecrets,
-  wireEscalationHandler,
 } from "./shared.js";
 
 /**
@@ -165,6 +165,12 @@ export function makeEventSender(params: {
         conversationId,
         kind: "host_file",
       });
+    } else if (event.type === "host_cu_request") {
+      pendingInteractions.register(event.requestId, {
+        session,
+        conversationId,
+        kind: "host_cu",
+      });
     }
 
     ctx.send(event);
@@ -195,21 +201,6 @@ export function handleConfirmationResponse(
     }
   }
 
-  // Also check computer-use sessions — they have their own PermissionPrompter
-  for (const [, cuSession] of ctx.cuSessions) {
-    if (cuSession.hasPendingConfirmation(msg.requestId)) {
-      cuSession.handleConfirmationResponse(
-        msg.requestId,
-        msg.decision,
-        msg.selectedPattern,
-        msg.selectedScope,
-      );
-      syncCanonicalStatusFromConfirmationDecision(msg.requestId, msg.decision);
-      pendingInteractions.resolve(msg.requestId);
-      return;
-    }
-  }
-
   log.warn(
     { requestId: msg.requestId },
     "No session found with pending confirmation for requestId",
@@ -362,7 +353,6 @@ export async function handleSessionCreate(
     maxResponseTokens: msg.maxResponseTokens,
     transport: msg.transport,
   });
-  wireEscalationHandler(session, ctx);
 
   // Pre-activate skills before sending session_info so they're available
   // for the initial message processing.
@@ -431,6 +421,11 @@ export async function handleSessionCreate(
         pendingInteractions.resolve(requestId);
       });
       session.setHostFileProxy(fileProxy);
+      const cuProxy = new HostCuProxy(sendEvent, (requestId) => {
+        pendingInteractions.resolve(requestId);
+      });
+      session.setHostCuProxy(cuProxy);
+      session.addPreactivatedSkillId("computer-use");
     }
     session.updateClient(sendEvent, false);
     session
@@ -492,13 +487,7 @@ export async function switchSession(
     // Load the session without rebinding the client — the session stays headless
     await ctx.getOrCreateSession(sessionId);
   } else {
-    const session = await ctx.getOrCreateSession(sessionId);
-    // Only wire the escalation handler if one isn't already set — handleTaskSubmit
-    // sets a handler with the client's actual screen dimensions, and overwriting it
-    // here would replace those dimensions with the daemon's defaults.
-    if (!session.hasEscalationHandler()) {
-      wireEscalationHandler(session, ctx);
-    }
+    await ctx.getOrCreateSession(sessionId);
   }
 
   return {
@@ -589,23 +578,24 @@ export function handleCancel(msg: CancelRequest, ctx: HandlerContext): void {
 }
 
 /**
- * Undo the last message in a session. Returns the removed count, or null if session not found.
+ * Undo the last message in a session. Returns the removed count, or null if
+ * the conversation does not exist. Restores evicted sessions from the database.
  */
-export function undoLastMessage(
+export async function undoLastMessage(
   sessionId: string,
   ctx: HandlerContext,
-): { removedCount: number } | null {
-  const session = ctx.sessions.get(sessionId);
-  if (!session) {
+): Promise<{ removedCount: number } | null> {
+  if (!getConversation(sessionId)) {
     return null;
   }
+  const session = await ctx.getOrCreateSession(sessionId);
   ctx.touchSession(sessionId);
   const removedCount = session.undo();
   return { removedCount };
 }
 
-export function handleUndo(msg: UndoRequest, ctx: HandlerContext): void {
-  const result = undoLastMessage(msg.sessionId, ctx);
+export async function handleUndo(msg: UndoRequest, ctx: HandlerContext): Promise<void> {
+  const result = await undoLastMessage(msg.sessionId, ctx);
   if (!result) {
     ctx.send({ type: "error", message: "No active session" });
     return;
@@ -620,17 +610,18 @@ export function handleUndo(msg: UndoRequest, ctx: HandlerContext): void {
 /**
  * Regenerate the last assistant response for a session. The caller provides
  * a `sendEvent` callback for delivering streaming events via HTTP/SSE.
- * Returns null if the session is not found. Throws on regeneration errors.
+ * Returns null if the conversation does not exist. Restores evicted sessions
+ * from the database when needed. Throws on regeneration errors.
  */
 export async function regenerateResponse(
   sessionId: string,
   ctx: HandlerContext,
   sendEvent: (event: ServerMessage) => void,
 ): Promise<{ requestId: string } | null> {
-  const session = ctx.sessions.get(sessionId);
-  if (!session) {
+  if (!getConversation(sessionId)) {
     return null;
   }
+  const session = await ctx.getOrCreateSession(sessionId);
   ctx.touchSession(sessionId);
   session.updateClient(sendEvent, false);
   const requestId = uuid();
@@ -661,11 +652,11 @@ export async function handleRegenerate(
   msg: RegenerateRequest,
   ctx: HandlerContext,
 ): Promise<void> {
-  const session = ctx.sessions.get(msg.sessionId);
-  if (!session) {
+  if (!getConversation(msg.sessionId)) {
     ctx.send({ type: "error", message: "No active session" });
     return;
   }
+  const session = await ctx.getOrCreateSession(msg.sessionId);
 
   const regenerateChannel =
     parseChannelId(session.getTurnChannelContext()?.assistantMessageChannel) ??

package/src/daemon/handlers/shared.ts

@@ -1,17 +1,12 @@
-import { execSync } from "node:child_process";
-
 import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../../config/loader.js";
 import type { HeartbeatService } from "../../heartbeat/heartbeat-service.js";
 import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
-import { RateLimitProvider } from "../../providers/ratelimit.js";
-import { getFailoverProvider } from "../../providers/registry.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
 import type { DebouncerMap } from "../../util/debounce.js";
 import { getLogger } from "../../util/logger.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
-import { ComputerUseSession } from "../computer-use-session.js";
 import type {
   ServerMessage,
   SessionTransportMetadata,
@@ -28,9 +23,6 @@ export const CONFIG_RELOAD_DEBOUNCE_MS = 300;
 
 const HISTORY_ATTACHMENT_TEXT_LIMIT = 500;
 
-export const FALLBACK_SCREEN = { width: 1920, height: 1080 };
-let cachedScreenDims: { width: number; height: number } | null = null;
-
 // Module-level map for non-session secret prompts (e.g. publish_page)
 export const pendingStandaloneSecrets = new Map<
   string,
@@ -150,8 +142,6 @@ export interface SessionCreateOptions {
  */
 export interface HandlerContext {
   sessions: Map<string, Session>;
-  cuSessions: Map<string, ComputerUseSession>;
-  cuObservationParseSequence: Map<string, number>;
   sharedRequestTimestamps: number[];
   debounceTimers: DebouncerMap;
   suppressConfigReload: boolean;
@@ -170,126 +160,6 @@ export interface HandlerContext {
   heartbeatService?: HeartbeatService;
 }
 
-/**
- * Query the main display dimensions via CoreGraphics.
- * Cached after the first successful call; falls back to 1920x1080.
- */
-export function getScreenDimensions(): { width: number; height: number } {
-  if (cachedScreenDims) return cachedScreenDims;
-  if (process.platform !== "darwin") return FALLBACK_SCREEN;
-  try {
-    // Use osascript (JXA) instead of `swift` to avoid the
-    // "Install Command Line Developer Tools" popup on fresh macOS installs.
-    const out = execSync(
-      `osascript -l JavaScript -e 'ObjC.import("AppKit"); var f = $.NSScreen.mainScreen.frame; Math.round(f.size.width) + "x" + Math.round(f.size.height)'`,
-      { timeout: 10_000, encoding: "utf-8" },
-    ).trim();
-    const [w, h] = out.split("x").map(Number);
-    if (w > 0 && h > 0) {
-      cachedScreenDims = { width: w, height: h };
-      return cachedScreenDims;
-    }
-  } catch (err) {
-    log.debug({ err }, "Failed to query screen dimensions, using fallback");
-  }
-  return FALLBACK_SCREEN;
-}
-
-/**
- * Wire the escalation handler on a text_qa session so that invoking
- * `computer_use_request_control` creates a CU session and notifies the client.
- *
- * In the HTTP-only world, the escalation handler broadcasts events via
- * `ctx.broadcast` instead of targeting a specific socket.
- */
-export function wireEscalationHandler(
-  session: Session,
-  ctx: HandlerContext,
-  explicitWidth?: number,
-  explicitHeight?: number,
-): void {
-  const dims =
-    explicitWidth && explicitHeight
-      ? { width: explicitWidth, height: explicitHeight }
-      : getScreenDimensions();
-  const screenWidth = dims.width;
-  const screenHeight = dims.height;
-  session.setEscalationHandler(
-    (task: string, sourceSessionId: string): boolean => {
-      const cuSessionId = uuid();
-
-      // Inline CU session creation (previously delegated to deleted handlers/computer-use.ts)
-      const existingSession = ctx.cuSessions.get(cuSessionId);
-      if (existingSession) {
-        existingSession.abort();
-        ctx.cuSessions.delete(cuSessionId);
-        ctx.cuObservationParseSequence.delete(cuSessionId);
-      }
-
-      const config = getConfig();
-      let provider = getFailoverProvider(config.provider, config.providerOrder);
-      const { rateLimit } = config;
-      if (
-        rateLimit.maxRequestsPerMinute > 0 ||
-        rateLimit.maxTokensPerSession > 0
-      ) {
-        provider = new RateLimitProvider(
-          provider,
-          rateLimit,
-          ctx.sharedRequestTimestamps,
-        );
-      }
-
-      const sendToClient = (serverMsg: ServerMessage) => {
-        ctx.send(serverMsg);
-      };
-
-      const sessionRef: { current?: ComputerUseSession } = {};
-      const onTerminal = (sid: string) => {
-        const current = ctx.cuSessions.get(sid);
-        if (sessionRef.current && current && current !== sessionRef.current) {
-          return;
-        }
-        ctx.cuSessions.delete(sid);
-        ctx.cuObservationParseSequence.delete(sid);
-        log.info(
-          { sessionId: sid },
-          "Computer-use session cleaned up after terminal state",
-        );
-      };
-
-      const cuSession = new ComputerUseSession(
-        cuSessionId,
-        task,
-        screenWidth,
-        screenHeight,
-        provider,
-        sendToClient,
-        "computer_use",
-        onTerminal,
-      );
-      sessionRef.current = cuSession;
-
-      ctx.cuSessions.set(cuSessionId, cuSession);
-
-      log.info(
-        { sessionId: cuSessionId, taskLength: task.length },
-        "Computer-use session created via escalation",
-      );
-
-      ctx.broadcast({
-        type: "task_routed",
-        sessionId: cuSessionId,
-        interactionType: "computer_use",
-        task,
-        escalatedFrom: sourceSessionId,
-      });
-
-      return true;
-    },
-  );
-}
-
 export function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value != null;
 }

package/src/daemon/handlers/skills.ts

@@ -250,12 +250,20 @@ export interface SkillListItem {
   provenance: SkillProvenance;
 }
 
+/** Sorting rank for provenance-based ordering: first-party first, local last. */
+function provenanceSortRank(p: SkillProvenance): number {
+  if (p.kind === "first-party") return 0;
+  if (p.kind === "third-party" && p.provider) return 1;
+  if (p.kind === "third-party") return 2;
+  return 3; // local
+}
+
 export function listSkills(_ctx: SkillOperationContext): SkillListItem[] {
   const config = getConfig();
   const catalog = loadSkillCatalog();
   const resolved = resolveSkillStates(catalog, config);
 
-  return resolved.map((r) => ({
+  const items = resolved.map((r) => ({
     id: r.summary.id,
     name: r.summary.displayName,
     description: r.summary.description,
@@ -272,6 +280,17 @@ export function listSkills(_ctx: SkillOperationContext): SkillListItem[] {
     userInvocable: r.summary.userInvocable,
     provenance: resolveProvenance(r.summary),
   }));
+
+  // Sort: first-party > third-party with provider > third-party without > local,
+  // alphabetical by name within each tier.
+  items.sort((a, b) => {
+    const rankDiff =
+      provenanceSortRank(a.provenance) - provenanceSortRank(b.provenance);
+    if (rankDiff !== 0) return rankDiff;
+    return a.name.localeCompare(b.name);
+  });
+
+  return items;
 }
 
 export function enableSkill(

package/src/daemon/history-repair.ts

@@ -1,6 +1,7 @@
 import type {
   ContentBlock,
   Message,
+  ServerToolUseContent,
   ToolResultContent,
   ToolUseContent,
 } from "../providers/types.js";
@@ -20,6 +21,11 @@ export interface RepairResult {
 const SYNTHETIC_RESULT =
   "<synthesized_result>tool result missing from history</synthesized_result>";
 
+const SYNTHETIC_WEB_SEARCH_ERROR = {
+  type: "web_search_tool_result_error",
+  error_code: "unavailable",
+};
+
 export function repairHistory(messages: Message[]): RepairResult {
   const stats: RepairStats = {
     assistantToolResultsMigrated: 0,
@@ -45,12 +51,15 @@ export function repairHistory(messages: Message[]): RepairResult {
         recoveredResults = new Map();
       }
 
-      // Strip tool_result blocks from assistant messages, preserving them
-      // so they can be migrated to the correct user message position
+      // Strip client-side tool_result blocks from assistant messages,
+      // preserving them so they can be migrated to the correct user message.
+      // Server-side tools (server_tool_use / web_search_tool_result) are
+      // self-paired within the assistant message and must NOT be separated.
       const cleanedContent: ContentBlock[] = [];
       const newRecovered = new Map<string, ToolResultContent>();
       for (const block of msg.content) {
         if (block.type === "tool_result") {
+          // guard:allow-tool-result-only — only client-side tool_result belongs in recovered; web_search_tool_result stays in the assistant message
           const tr = block as ToolResultContent;
           newRecovered.set(tr.tool_use_id, tr);
           stats.assistantToolResultsMigrated++;
@@ -59,9 +68,34 @@ export function repairHistory(messages: Message[]): RepairResult {
         }
       }
 
+      // Ensure every server_tool_use has a paired web_search_tool_result
+      // in the same assistant message (handles interrupted streams)
+      const serverToolIds = new Set(
+        cleanedContent
+          .filter(
+            (b): b is ServerToolUseContent => b.type === "server_tool_use",
+          )
+          .map((b) => b.id),
+      );
+      const matchedServerIds = new Set(
+        cleanedContent
+          .filter((b) => b.type === "web_search_tool_result")
+          .map((b) => (b as { tool_use_id: string }).tool_use_id),
+      );
+      for (const id of serverToolIds) {
+        if (!matchedServerIds.has(id)) {
+          cleanedContent.push({
+            type: "web_search_tool_result",
+            tool_use_id: id,
+            content: SYNTHETIC_WEB_SEARCH_ERROR,
+          });
+          stats.missingToolResultsInserted++;
+        }
+      }
+
       result.push({ role: "assistant", content: cleanedContent });
 
-      // Collect tool_use IDs from this assistant message
+      // Only track client-side tool_use IDs as pending (not server_tool_use)
       pendingToolUseIds = new Set(
         cleanedContent
           .filter((b): b is ToolUseContent => b.type === "tool_use")
@@ -76,14 +110,28 @@ export function repairHistory(messages: Message[]): RepairResult {
 
         for (const block of msg.content) {
           if (block.type === "tool_result") {
+            // guard:allow-tool-result-only — matches client-side tool_use; web_search_tool_result is handled separately below
             const tr = block as ToolResultContent;
             if (pendingToolUseIds.has(tr.tool_use_id)) {
               matchedIds.add(tr.tool_use_id);
               newContent.push(block);
             } else {
               stats.orphanToolResultsDowngraded++;
-              newContent.push(downgradeToolResult(tr));
+              newContent.push(downgradeResult(tr));
             }
+          } else if (block.type === "web_search_tool_result") {
+            // web_search_tool_result in a user message is orphaned — server-side
+            // results belong in the assistant message, not here
+            stats.orphanToolResultsDowngraded++;
+            newContent.push(
+              downgradeResult(
+                block as {
+                  type: "web_search_tool_result";
+                  tool_use_id: string;
+                  content: unknown;
+                },
+              ),
+            );
           } else {
             newContent.push(block);
           }
@@ -112,11 +160,21 @@ export function repairHistory(messages: Message[]): RepairResult {
         pendingToolUseIds = new Set();
         recoveredResults = new Map();
       } else {
-        // No pending tool_use — any tool_result here is orphaned
+        // No pending tool_use — any tool_result/web_search_tool_result here is orphaned
         const newContent: ContentBlock[] = msg.content.map((block) => {
           if (block.type === "tool_result") {
             stats.orphanToolResultsDowngraded++;
-            return downgradeToolResult(block as ToolResultContent);
+            return downgradeResult(block as ToolResultContent);
+          }
+          if (block.type === "web_search_tool_result") {
+            stats.orphanToolResultsDowngraded++;
+            return downgradeResult(
+              block as {
+                type: "web_search_tool_result";
+                tool_use_id: string;
+                content: unknown;
+              },
+            );
           }
           return block;
         });
@@ -207,9 +265,15 @@ export function deepRepairHistory(messages: Message[]): RepairResult {
   return repairHistory(merged);
 }
 
-function downgradeToolResult(tr: ToolResultContent): ContentBlock {
+function downgradeResult(tr: {
+  type: string;
+  tool_use_id: string;
+  content?: unknown;
+}): ContentBlock {
+  const content =
+    tr.type === "tool_result" ? tr.content : "[web search result]"; // guard:allow-tool-result-only — distinguishes content format between the two types
   return {
     type: "text",
-    text: `[orphaned tool_result for ${tr.tool_use_id}]: ${tr.content}`,
+    text: `[orphaned ${tr.type} for ${tr.tool_use_id}]: ${content}`,
   };
 }