@vellumai/assistant 0.4.54 → 0.4.56

package/src/tools/network/web-fetch.ts

@@ -361,7 +361,7 @@ function extractHtmlMetadata(html: string): {
   const stripped = candidate.replace(/<script[\s>][\s\S]*?<\/script>/gi, "");
   const headEnd = stripped.search(/<\/head[\s>]/i);
   const searchRegion =
-    headEnd > 0 ? stripped.slice(0, headEnd + 10) : stripped.slice(0, 50_000);
+    headEnd >= 0 ? stripped.slice(0, headEnd + 10) : stripped.slice(0, 50_000);
 
   const title = extractFirstMatch(
     searchRegion,

package/src/tools/network/web-search.ts

@@ -1,7 +1,7 @@
 import { getConfig } from "../../config/loader.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
-import { getSecureKeyAsync } from "../../security/secure-keys.js";
+import { getProviderKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import {
   DEFAULT_BASE_DELAY_MS,
@@ -43,7 +43,7 @@ interface PerplexityResponse {
 
 function getWebSearchProvider(): WebSearchProvider {
   const config = getConfig();
-  const configured = config.webSearchProvider ?? "perplexity";
+  const configured = config.services["web-search"].provider ?? "perplexity";
   // 'anthropic-native' is handled by the Anthropic client directly;
   // fall back to perplexity for other providers.
   if (configured === "anthropic-native") return "perplexity";
@@ -54,11 +54,11 @@ async function getApiKey(
   provider: WebSearchProvider,
 ): Promise<string | undefined> {
   if (provider === "brave") {
-    return (await getSecureKeyAsync("brave")) ?? undefined;
+    return (await getProviderKeyAsync("brave")) ?? undefined;
   }
 
   // Perplexity
-  return (await getSecureKeyAsync("perplexity")) ?? undefined;
+  return (await getProviderKeyAsync("perplexity")) ?? undefined;
 }
 
 function formatBraveResults(

package/src/tools/permission-checker.ts

@@ -10,9 +10,9 @@ import type { PermissionPrompter } from "../permissions/prompter.js";
 import { addRule } from "../permissions/trust-store.js";
 import {
   getEffectiveMode,
-  setThreadMode,
+  setConversationMode,
   setTimedMode,
-} from "../runtime/session-approval-overrides.js";
+} from "../runtime/conversation-approval-overrides.js";
 import { getLogger } from "../util/logger.js";
 import { buildPolicyContext } from "./policy-context.js";
 import { isSideEffectTool } from "./side-effects.js";
@@ -89,7 +89,7 @@ export class PermissionChecker {
         context.signal,
       );
 
-      // Private threads force prompting for side-effect tools even when a
+      // Private conversations force prompting for side-effect tools even when a
       // trust/allow rule would auto-allow. Deny decisions are preserved —
       // only allow → prompt promotion happens here.
       if (
@@ -99,7 +99,18 @@ export class PermissionChecker {
       ) {
         result.decision = "prompt";
         result.reason =
-          "Private thread: side-effect tools require explicit approval";
+          "Private conversation: side-effect tools require explicit approval";
+      }
+
+      // requireFreshApproval independently promotes allow → prompt so that
+      // cached grants, persistent trust rules, and auto-approve shortcuts
+      // cannot bypass the interactive prompt. This is separate from the
+      // forcePromptSideEffects path above to ensure requireFreshApproval
+      // is self-sufficient without relying on SIDE_EFFECT_TOOLS membership.
+      if (context.requireFreshApproval && result.decision === "allow") {
+        result.decision = "prompt";
+        result.reason =
+          "Fresh approval required: per-invocation human review enforced";
       }
 
       if (result.decision === "deny") {
@@ -110,7 +121,6 @@ export class PermissionChecker {
           executionTarget,
           input,
           workingDir: context.workingDir,
-          sessionId: context.sessionId,
           conversationId: context.conversationId,
           requestId: context.requestId,
           riskLevel,
@@ -130,9 +140,12 @@ export class PermissionChecker {
         // Guardian-trust sessions (e.g. scheduled jobs, reminders) should be
         // able to use bundled tools without interactive approval. The guardian
         // is the owner — prompting makes no sense when there is no client.
+        // Exception: requireFreshApproval tools cannot be auto-approved —
+        // without a human present, bundle installation must be denied.
         if (
           context.isInteractive === false &&
-          context.trustClass === "guardian"
+          context.trustClass === "guardian" &&
+          !context.requireFreshApproval
         ) {
           log.info(
             { toolName: name, riskLevel },
@@ -159,7 +172,6 @@ export class PermissionChecker {
             executionTarget,
             input,
             workingDir: context.workingDir,
-            sessionId: context.sessionId,
             conversationId: context.conversationId,
             requestId: context.requestId,
             riskLevel,
@@ -176,13 +188,17 @@ export class PermissionChecker {
         }
 
         // Temporary approval override: if the guardian has enabled a
-        // conversation-scoped "allow all" mode (allow_10m or allow_thread),
+        // conversation-scoped "allow all" mode (allow_10m or allow_conversation),
         // skip the interactive prompt and auto-approve. Only applies to
         // guardian actors — untrusted actors cannot leverage this to bypass
         // guardian-required gates (those are enforced in pre-execution gates).
+        // Exception: requireFreshApproval tools must always show the prompt —
+        // cached temporary overrides cannot substitute for per-invocation
+        // human review.
         if (
           context.trustClass === "guardian" &&
-          getEffectiveMode(context.conversationId) !== undefined
+          getEffectiveMode(context.conversationId) !== undefined &&
+          !context.requireFreshApproval
         ) {
           log.info(
             {
@@ -218,14 +234,16 @@ export class PermissionChecker {
           sandboxed = wrapped.sandboxed;
         }
 
-        const persistentDecisionsAllowed = true;
+        const persistentDecisionsAllowed = !context.requireFreshApproval;
 
-        // Offer temporary approval options to guardians.
+        // Offer temporary approval options to guardians. Suppressed when
+        // requireFreshApproval is true — temporary overrides would be
+        // misleading since future invocations still require fresh approval.
         const temporaryOptionsAvailable:
-          | Array<"allow_10m" | "allow_thread">
+          | Array<"allow_10m" | "allow_conversation">
           | undefined =
-          context.trustClass === "guardian"
-            ? ["allow_10m", "allow_thread"]
+          context.trustClass === "guardian" && !context.requireFreshApproval
+            ? ["allow_10m", "allow_conversation"]
             : undefined;
 
         emitLifecycleEvent({
@@ -234,7 +252,6 @@ export class PermissionChecker {
           executionTarget,
           input,
           workingDir: context.workingDir,
-          sessionId: context.sessionId,
           conversationId: context.conversationId,
           requestId: context.requestId,
           riskLevel,
@@ -250,7 +267,7 @@ export class PermissionChecker {
           toolName: name,
           input: sanitizeToolInput(name, input),
           riskLevel,
-          sessionId: context.sessionId,
+          conversationId: context.conversationId,
         });
 
         const response = await this.prompter.prompt(
@@ -275,7 +292,7 @@ export class PermissionChecker {
           toolName: name,
           decision: response.decision,
           riskLevel,
-          sessionId: context.sessionId,
+          conversationId: context.conversationId,
         });
 
         if (response.decision === "deny") {
@@ -298,7 +315,6 @@ export class PermissionChecker {
             executionTarget,
             input,
             workingDir: context.workingDir,
-            sessionId: context.sessionId,
             conversationId: context.conversationId,
             requestId: context.requestId,
             riskLevel,
@@ -347,7 +363,6 @@ export class PermissionChecker {
             executionTarget,
             input,
             workingDir: context.workingDir,
-            sessionId: context.sessionId,
             conversationId: context.conversationId,
             requestId: context.requestId,
             riskLevel,
@@ -402,7 +417,7 @@ export class PermissionChecker {
         }
 
         // Activate temporary approval mode when the user chooses a
-        // time-limited or thread-scoped override. Subsequent tool
+        // time-limited or conversation-scoped override. Subsequent tool
         // invocations in this conversation will auto-approve without
         // prompting (checked above in the temporary override block).
         if (response.decision === "allow_10m") {
@@ -411,11 +426,11 @@ export class PermissionChecker {
             { toolName: name, conversationId: context.conversationId },
             "Activated timed (10m) temporary approval mode",
           );
-        } else if (response.decision === "allow_thread") {
-          setThreadMode(context.conversationId);
+        } else if (response.decision === "allow_conversation") {
+          setConversationMode(context.conversationId);
           log.info(
             { toolName: name, conversationId: context.conversationId },
-            "Activated thread-scoped temporary approval mode",
+            "Activated conversation-scoped temporary approval mode",
           );
         }
 

package/src/tools/registry.ts

@@ -223,8 +223,13 @@ export function getAllToolDefinitions(): ToolDefinition[] {
 }
 
 export async function initializeTools(): Promise<void> {
-  const { loadEagerModules, eagerModuleToolNames, explicitTools } =
-    await import("./tool-manifest.js");
+  const {
+    loadEagerModules,
+    eagerModuleToolNames,
+    explicitTools,
+    getCesToolsIfEnabled,
+    cesTools,
+  } = await import("./tool-manifest.js");
 
   // Capture tool names already in the registry before any manifest
   // registrations.  In production this is empty; in tests a non-skill tool
@@ -251,6 +256,12 @@ export async function initializeTools(): Promise<void> {
     registerTool(tool);
   }
 
+  // CES tools — registered only when the CES feature flag is enabled.
+  const activeCesTools = getCesToolsIfEnabled();
+  for (const tool of activeCesTools) {
+    registerTool(tool);
+  }
+
   registerUiSurfaceTools();
   registerAppTools();
 
@@ -267,6 +278,7 @@ export async function initializeTools(): Promise<void> {
       ...eagerModuleToolNames,
       ...explicitTools.map((t: Tool) => t.name),
       ...hostTools.map((t: Tool) => t.name),
+      ...cesTools.map((t: Tool) => t.name),
       ...allComputerUseTools.map((t: Tool) => t.name),
       ...allUiSurfaceTools.map((t: Tool) => t.name),
       ...coreAppProxyTools.map((t: Tool) => t.name),

package/src/tools/secret-detection-handler.ts

@@ -84,7 +84,6 @@ export class SecretDetectionHandler {
       executionTarget,
       input,
       workingDir: context.workingDir,
-      sessionId: context.sessionId,
       conversationId: context.conversationId,
       requestId: context.requestId,
       matches: matchSummary,
@@ -229,7 +228,6 @@ export class SecretDetectionHandler {
       executionTarget,
       input,
       workingDir: context.workingDir,
-      sessionId: context.sessionId,
       conversationId: context.conversationId,
       requestId: context.requestId,
       riskLevel,
@@ -244,7 +242,7 @@ export class SecretDetectionHandler {
       riskLevel,
       isError: true,
       durationMs,
-      sessionId: context.sessionId,
+      conversationId: context.conversationId,
     });
 
     return { result: blockedResult, earlyReturn: true };
@@ -282,7 +280,6 @@ export class SecretDetectionHandler {
         executionTarget,
         input,
         workingDir: context.workingDir,
-        sessionId: context.sessionId,
         conversationId: context.conversationId,
         requestId: context.requestId,
         riskLevel: RiskLevel.High,
@@ -297,7 +294,7 @@ export class SecretDetectionHandler {
         riskLevel,
         isError: true,
         durationMs,
-        sessionId: context.sessionId,
+        conversationId: context.conversationId,
       });
 
       return {
@@ -318,7 +315,6 @@ export class SecretDetectionHandler {
       executionTarget,
       input: promptInput,
       workingDir: context.workingDir,
-      sessionId: context.sessionId,
       conversationId: context.conversationId,
       requestId: context.requestId,
       riskLevel: RiskLevel.High,
@@ -352,7 +348,6 @@ export class SecretDetectionHandler {
         executionTarget,
         input,
         workingDir: context.workingDir,
-        sessionId: context.sessionId,
         conversationId: context.conversationId,
         requestId: context.requestId,
         riskLevel: RiskLevel.High,
@@ -367,7 +362,7 @@ export class SecretDetectionHandler {
         riskLevel,
         isError: true,
         durationMs,
-        sessionId: context.sessionId,
+        conversationId: context.conversationId,
       });
 
       return {

package/src/tools/side-effects.ts

@@ -1,7 +1,7 @@
 // Side-effect tool classification — single source of truth.
 // Tools that modify state outside the assistant (filesystem writes,
 // shell commands, network requests that trigger actions, etc.).
-// Used by private-thread gating and permission simulation to decide
+// Used by private-conversation gating and permission simulation to decide
 // whether a tool invocation requires explicit approval.
 
 const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
@@ -26,6 +26,7 @@ const SIDE_EFFECT_TOOLS: ReadonlySet<string> = new Set([
   "schedule_create",
   "schedule_update",
   "schedule_delete",
+  "manage_secure_command_tool",
 ]);
 
 /**

package/src/tools/skills/load.ts

@@ -5,7 +5,11 @@ import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-fl
 import { getConfig } from "../../config/loader.js";
 import { skillFlagKey } from "../../config/skill-state.js";
 import type { SkillSummary, SkillToolManifest } from "../../config/skills.js";
-import { loadSkillBySelector, loadSkillCatalog } from "../../config/skills.js";
+import {
+  listReferenceFiles,
+  loadSkillBySelector,
+  loadSkillCatalog,
+} from "../../config/skills.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import {
@@ -277,6 +281,9 @@ export class SkillLoadTool implements Tool {
 
     const body = skill.body.length > 0 ? skill.body : "(No body content)";
 
+    // Build reference file listing (if any)
+    const referenceListing = listReferenceFiles(skill.directoryPath);
+
     // Load tool schemas for the main skill
     const mainManifest = loadToolManifest(skill.directoryPath);
     const toolSchemasSection = mainManifest
@@ -310,6 +317,12 @@ export class SkillLoadTool implements Tool {
             `--- Included Skill: ${childLoaded.skill.displayName} (${childId}) ---\n${childLoaded.skill.body}`,
           );
 
+          // List reference files for the included skill
+          const childRefs = listReferenceFiles(childLoaded.skill.directoryPath);
+          if (childRefs) {
+            includedBodies.push(childRefs);
+          }
+
           // Load tool schemas for the included skill (lighter sub-heading)
           const childManifest = loadToolManifest(
             childLoaded.skill.directoryPath,
@@ -378,6 +391,7 @@ export class SkillLoadTool implements Tool {
         "",
         body,
         "",
+        ...(referenceListing ? [referenceListing, ""] : []),
         ...(toolSchemasSection ? [toolSchemasSection, ""] : []),
         ...(!toolSchemasSection && anyChildHasTools
           ? [

package/src/tools/skills/sandbox-runner.ts

@@ -152,7 +152,6 @@ function spawnRunner(
     // Pass a serializable subset of context to the subprocess
     env.__SKILL_CONTEXT_JSON = JSON.stringify({
       workingDir: context.workingDir,
-      sessionId: context.sessionId,
       conversationId: context.conversationId,
     });
 

package/src/tools/skills/scaffold-managed.ts

@@ -92,14 +92,6 @@ export async function executeScaffoldManagedSkill(
       typeof input.emoji === "string"
         ? sanitizeFrontmatterValue(input.emoji)
         : undefined,
-    userInvocable:
-      typeof input.user_invocable === "boolean"
-        ? input.user_invocable
-        : undefined,
-    disableModelInvocation:
-      typeof input.disable_model_invocation === "boolean"
-        ? input.disable_model_invocation
-        : undefined,
     overwrite: input.overwrite === true,
     addToIndex: input.add_to_index !== false,
     includes,

package/src/tools/subagent/abort.ts

@@ -17,7 +17,7 @@ export async function executeSubagentAbort(
   const aborted = manager.abort(
     subagentId,
     sendToClient as ((msg: unknown) => void) | undefined,
-    context.sessionId,
+    context.conversationId,
     { suppressNotification: true },
   );
 

package/src/tools/subagent/message.ts

@@ -17,9 +17,9 @@ export async function executeSubagentMessage(
 
   const manager = getSubagentManager();
 
-  // Ownership check: only the parent session can message a subagent.
+  // Ownership check: only the parent conversation can message a subagent.
   const state = manager.getState(subagentId);
-  if (!state || state.config.parentSessionId !== context.sessionId) {
+  if (!state || state.config.parentConversationId !== context.conversationId) {
     return {
       content: `Could not send message to subagent "${subagentId}". It may not exist or be in a terminal state.`,
       isError: true,

package/src/tools/subagent/read.ts

@@ -20,8 +20,8 @@ export async function executeSubagentRead(
     };
   }
 
-  // Ownership check: only the parent session can read a subagent's output.
-  if (state.config.parentSessionId !== context.sessionId) {
+  // Ownership check: only the parent conversation can read a subagent's output.
+  if (state.config.parentConversationId !== context.conversationId) {
     return {
       content: `No subagent found with ID "${subagentId}".`,
       isError: true,

package/src/tools/subagent/spawn.ts

@@ -31,7 +31,7 @@ export async function executeSubagentSpawn(
   try {
     const subagentId = await manager.spawn(
       {
-        parentSessionId: context.sessionId,
+        parentConversationId: context.conversationId,
         label,
         objective,
         context: extraContext,

package/src/tools/subagent/status.ts

@@ -10,7 +10,10 @@ export async function executeSubagentStatus(
 
   if (subagentId) {
     const state = manager.getState(subagentId);
-    if (!state || state.config.parentSessionId !== context.sessionId) {
+    if (
+      !state ||
+      state.config.parentConversationId !== context.conversationId
+    ) {
       return {
         content: `No subagent found with ID "${subagentId}".`,
         isError: true,
@@ -31,10 +34,13 @@ export async function executeSubagentStatus(
     };
   }
 
-  // List all subagents for this parent session.
-  const children = manager.getChildrenOf(context.sessionId);
+  // List all subagents for this parent conversation.
+  const children = manager.getChildrenOf(context.conversationId);
   if (children.length === 0) {
-    return { content: "No subagents found for this session.", isError: false };
+    return {
+      content: "No subagents found for this conversation.",
+      isError: false,
+    };
   }
 
   const summary = children.map((s) => ({

package/src/tools/swarm/delegate.ts

@@ -12,8 +12,8 @@ import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
 const log = getLogger("swarm-delegate");
 
-/** Tracks active swarm sessions to prevent nested invocation per-session. */
-const activeSessions = new Set<string>();
+/** Tracks active swarm conversations to prevent nested invocation per-conversation. */
+const activeConversations = new Set<string>();
 
 export const swarmDelegateTool: Tool = {
   name: "swarm_delegate",
@@ -73,17 +73,17 @@ export const swarmDelegateTool: Tool = {
       return { content: "Cancelled", isError: true };
     }
 
-    // Recursion guard — scoped to session so independent sessions are not blocked
-    const sessionKey = context.sessionId;
-    if (activeSessions.has(sessionKey)) {
+    // Recursion guard — scoped to conversation so independent conversations are not blocked
+    const conversationKey = context.conversationId;
+    if (activeConversations.has(conversationKey)) {
       return {
         content:
-          "Error: A swarm is already executing in this session. Nested swarm invocation is not allowed.",
+          "Error: A swarm is already executing in this conversation. Nested swarm invocation is not allowed.",
         isError: true,
       };
     }
 
-    activeSessions.add(sessionKey);
+    activeConversations.add(conversationKey);
     try {
       const limits = resolveSwarmLimits({
         maxWorkers: maxWorkersOverride ?? config.swarm.maxWorkers,
@@ -96,7 +96,7 @@ export const swarmDelegateTool: Tool = {
       // Generate plan
       context.onOutput?.("Planning task decomposition...\n");
       const planProvider = getFailoverProvider(
-        config.provider,
+        config.services.inference.provider,
         config.providerOrder,
       );
       const plan = await generatePlan({
@@ -125,7 +125,7 @@ export const swarmDelegateTool: Tool = {
       let synthesisProvider: typeof planProvider | undefined;
       try {
         synthesisProvider = getFailoverProvider(
-          config.provider,
+          config.services.inference.provider,
           config.providerOrder,
         );
       } catch {
@@ -194,12 +194,12 @@ export const swarmDelegateTool: Tool = {
         isError: true,
       };
     } finally {
-      activeSessions.delete(sessionKey);
+      activeConversations.delete(conversationKey);
     }
   },
 };
 
-/** Clear all active sessions — only for testing. */
+/** Clear all active conversations — only for testing. */
 export function _resetSwarmActive(): void {
-  activeSessions.clear();
+  activeConversations.clear();
 }