@vellumai/assistant 0.4.55 → 0.4.57

package/src/daemon/handlers/recording.ts

@@ -26,7 +26,7 @@ const RECORDING_MIME_TYPES = new Map<string, string>([
 
 // ─── Deterministic maps ──────────────────────────────────────────────────────
 // These ensure stop resolves the exact active recording for a conversation,
-// prevent ambiguous cross-thread stop behavior, and maintain conversation
+// prevent ambiguous cross-conversation stop behavior, and maintain conversation
 // linkage for future file attachment (M4).
 
 /** Maps recordingId -> conversationId. */
@@ -487,11 +487,11 @@ export async function finalizeAndPublishRecording(params: {
     ctx.broadcast({
       type: "assistant_text_delta",
       text: errorText,
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     ctx.broadcast({
       type: "message_complete",
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     return { success: false };
   }
@@ -540,11 +540,11 @@ export async function finalizeAndPublishRecording(params: {
     ctx.broadcast({
       type: "assistant_text_delta",
       text: errorText,
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     ctx.broadcast({
       type: "message_complete",
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     return { success: false };
   }
@@ -568,11 +568,11 @@ export async function finalizeAndPublishRecording(params: {
       ctx.broadcast({
         type: "assistant_text_delta",
         text: errorText,
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       ctx.broadcast({
         type: "message_complete",
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       return { success: false };
     }
@@ -601,11 +601,11 @@ export async function finalizeAndPublishRecording(params: {
       ctx.broadcast({
         type: "assistant_text_delta",
         text: errorText,
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       ctx.broadcast({
         type: "message_complete",
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       return { success: false };
     }
@@ -663,11 +663,11 @@ export async function finalizeAndPublishRecording(params: {
     ctx.broadcast({
       type: "assistant_text_delta",
       text: msgText,
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     ctx.broadcast({
       type: "message_complete",
-      sessionId: conversationId,
+      conversationId: conversationId,
       attachments: [
         {
           id: attachment.id,
@@ -703,11 +703,11 @@ export async function finalizeAndPublishRecording(params: {
     ctx.broadcast({
       type: "assistant_text_delta",
       text: errorText,
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     ctx.broadcast({
       type: "message_complete",
-      sessionId: conversationId,
+      conversationId: conversationId,
     });
     return { success: false };
   }
@@ -727,7 +727,7 @@ export async function handleRecordingStatusCore(
   msg: RecordingStatus,
   ctx: HandlerContext,
 ): Promise<void> {
-  const recordingId = msg.sessionId;
+  const recordingId = msg.conversationId;
   let conversationId = standaloneRecordingConversationId.get(recordingId);
 
   // Fall back to attachToConversationId when the in-memory map is missing
@@ -828,11 +828,11 @@ export async function handleRecordingStatusCore(
       ctx.broadcast({
         type: "assistant_text_delta",
         text: "Recording restart cancelled.",
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       ctx.broadcast({
         type: "message_complete",
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       break;
     }
@@ -960,11 +960,11 @@ export async function handleRecordingStatusCore(
           ctx.broadcast({
             type: "assistant_text_delta",
             text: "Previous recording saved. New recording failed to start.",
-            sessionId: deferred.conversationId,
+            conversationId: deferred.conversationId,
           });
           ctx.broadcast({
             type: "message_complete",
-            sessionId: deferred.conversationId,
+            conversationId: deferred.conversationId,
           });
         }
 
@@ -994,11 +994,11 @@ export async function handleRecordingStatusCore(
       ctx.broadcast({
         type: "assistant_text_delta",
         text: `Recording failed: ${msg.error ?? "unknown error"}`,
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
       ctx.broadcast({
         type: "message_complete",
-        sessionId: conversationId,
+        conversationId: conversationId,
       });
 
       cleanupMaps(recordingId, conversationId);

package/src/daemon/handlers/shared.ts

@@ -7,12 +7,12 @@ import type { AuthContext } from "../../runtime/auth/types.js";
 import type { DebouncerMap } from "../../util/debounce.js";
 import { getLogger } from "../../util/logger.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
+import { Conversation } from "../conversation.js";
+import type { TrustContext } from "../conversation-runtime-assembly.js";
 import type {
+  ConversationTransportMetadata,
   ServerMessage,
-  SessionTransportMetadata,
 } from "../message-protocol.js";
-import { Session } from "../session.js";
-import type { TrustContext } from "../session-runtime-assembly.js";
 
 const log = getLogger("handlers");
 
@@ -23,7 +23,7 @@ export const CONFIG_RELOAD_DEBOUNCE_MS = 300;
 
 const HISTORY_ATTACHMENT_TEXT_LIMIT = 500;
 
-// Module-level map for non-session secret prompts (e.g. publish_page)
+// Module-level map for non-conversation secret prompts (e.g. publish_page)
 export const pendingStandaloneSecrets = new Map<
   string,
   {
@@ -115,20 +115,20 @@ export interface ParsedHistoryMessage {
 }
 
 /**
- * Optional overrides for session creation (e.g. interview mode).
+ * Optional overrides for conversation creation (e.g. interview mode).
  */
-export interface SessionCreateOptions {
+export interface ConversationCreateOptions {
   systemPromptOverride?: string;
   maxResponseTokens?: number;
-  transport?: SessionTransportMetadata;
+  transport?: ConversationTransportMetadata;
   assistantId?: string;
   trustContext?: TrustContext;
-  /** Normalized auth context for the session. */
+  /** Normalized auth context for the conversation. */
   authContext?: AuthContext;
   /** Whether this turn can block on interactive approval prompts. */
   isInteractive?: boolean;
   memoryScopeId?: string;
-  isPrivateThread?: boolean;
+  isPrivateConversation?: boolean;
   strictPrivateSideEffects?: boolean;
   /** Channel command intent metadata (e.g. Telegram /start). */
   commandIntent?: { type: string; payload?: string; languageCode?: string };
@@ -141,7 +141,7 @@ export interface SessionCreateOptions {
  * Keeps handlers decoupled from the server class itself.
  */
 export interface HandlerContext {
-  sessions: Map<string, Session>;
+  conversations: Map<string, Conversation>;
   sharedRequestTimestamps: number[];
   debounceTimers: DebouncerMap;
   suppressConfigReload: boolean;
@@ -149,13 +149,13 @@ export interface HandlerContext {
   updateConfigFingerprint(): void;
   send(msg: ServerMessage): void;
   broadcast(msg: ServerMessage): void;
-  clearAllSessions(): number;
-  getOrCreateSession(
+  clearAllConversations(): number;
+  getOrCreateConversation(
     conversationId: string,
-    options?: SessionCreateOptions,
-  ): Promise<Session>;
-  /** Refresh the eviction timestamp for a session that was accessed directly. */
-  touchSession(sessionId: string): void;
+    options?: ConversationCreateOptions,
+  ): Promise<Conversation>;
+  /** Refresh the eviction timestamp for a conversation that was accessed directly. */
+  touchConversation(conversationId: string): void;
   /** Optional heartbeat service reference for "Run Now" support. */
   heartbeatService?: HeartbeatService;
 }
@@ -415,7 +415,7 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
 
 /**
  * Send a `secret_request` to the client and wait for the response,
- * outside of a session context (e.g. from handler-level code like publish_page).
+ * outside of a conversation context (e.g. from handler-level code like publish_page).
  */
 export function requestSecretStandalone(
   ctx: HandlerContext,

package/src/daemon/handlers/skills.ts

@@ -1,5 +1,13 @@
-import { existsSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import {
+  existsSync,
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+} from "node:fs";
+import { join, relative } from "node:path";
 
 import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import {
@@ -30,6 +38,7 @@ import {
   removeSkillsIndexEntry,
   validateManagedSkillId,
 } from "../../skills/managed-store.js";
+import { deleteSkillCapabilityMemory } from "../../skills/skill-memory.js";
 import { getWorkspaceSkillsDir } from "../../util/platform.js";
 import {
   CONFIG_RELOAD_DEBOUNCE_MS,
@@ -38,6 +47,24 @@ import {
   log,
 } from "./shared.js";
 
+// ─── MIME detection helpers ───────────────────────────────────────────────────
+
+const TEXT_MIME_PREFIXES = [
+  "text/",
+  "application/json",
+  "application/javascript",
+  "application/typescript",
+  "application/xml",
+  "application/yaml",
+  "application/x-yaml",
+  "application/toml",
+  "application/x-sh",
+];
+function isTextMime(mimeType: string): boolean {
+  return TEXT_MIME_PREFIXES.some((prefix) => mimeType.startsWith(prefix));
+}
+const MAX_INLINE_SIZE = 2 * 1024 * 1024; // 2 MB
+
 // ─── Shared context for standalone functions ─────────────────────────────────
 
 /**
@@ -219,15 +246,8 @@ export interface SkillListItem {
   emoji?: string;
   homepage?: string;
   source: "bundled" | "managed" | "workspace" | "clawhub" | "extra";
-  state: "enabled" | "disabled" | "available";
-  degraded: boolean;
-  missingRequirements?: {
-    bins?: string[];
-    env?: string[];
-    permissions?: string[];
-  };
+  state: "enabled" | "disabled";
   updateAvailable: boolean;
-  userInvocable: boolean;
   provenance: SkillProvenance;
 }
 
@@ -251,14 +271,8 @@ export function listSkills(_ctx: SkillOperationContext): SkillListItem[] {
     emoji: r.summary.emoji,
     homepage: r.summary.homepage,
     source: r.summary.source,
-    state: (r.state === "degraded" ? "enabled" : r.state) as
-      | "enabled"
-      | "disabled"
-      | "available",
-    degraded: r.degraded,
-    missingRequirements: r.missingRequirements,
+    state: r.state,
     updateAvailable: false,
-    userInvocable: r.summary.userInvocable,
     provenance: resolveProvenance(r.summary),
   }));
 
@@ -274,6 +288,140 @@ export function listSkills(_ctx: SkillOperationContext): SkillListItem[] {
   return items;
 }
 
+/** Look up a single skill by ID from the resolved catalog, returning its SkillListItem. */
+function findSkillById(
+  skillId: string,
+): { item: SkillListItem; summary: SkillSummary } | undefined {
+  const config = getConfig();
+  const catalog = loadSkillCatalog();
+  const resolved = resolveSkillStates(catalog, config);
+  const match = resolved.find((r) => r.summary.id === skillId);
+  if (!match) return undefined;
+
+  const r = match;
+  const item: SkillListItem = {
+    id: r.summary.id,
+    name: r.summary.displayName,
+    description: r.summary.description,
+    emoji: r.summary.emoji,
+    homepage: r.summary.homepage,
+    source: r.summary.source,
+    state: r.state,
+    updateAvailable: false,
+    provenance: resolveProvenance(r.summary),
+  };
+  return { item, summary: r.summary };
+}
+
+export function getSkill(
+  skillId: string,
+  _ctx: SkillOperationContext,
+): { skill: SkillListItem } | { error: string; status: number } {
+  const found = findSkillById(skillId);
+  if (!found) {
+    return { error: `Skill "${skillId}" not found`, status: 404 };
+  }
+  return { skill: found.item };
+}
+
+// ─── Skill file listing ──────────────────────────────────────────────────────
+
+export interface SkillFileEntry {
+  path: string; // relative to skill directory root (e.g. "SKILL.md", "tools/foo.ts")
+  name: string; // basename
+  size: number;
+  mimeType: string;
+  isBinary: boolean;
+  content: string | null; // inline text if ≤ 2 MB and text MIME, else null
+}
+
+const SKIP_DIRS = new Set(["node_modules", "__pycache__", ".git"]);
+
+/**
+ * Returns true if `filePath` is a symlink whose resolved real path escapes
+ * `rootDir`. Symlinks that stay within `rootDir` are allowed; only those that
+ * point outside are considered unsafe. Dangling symlinks are treated as escaping.
+ */
+function isEscapingSymlink(filePath: string, rootDir: string): boolean {
+  try {
+    if (!lstatSync(filePath).isSymbolicLink()) return false;
+    const real = realpathSync(filePath);
+    const normalizedRoot = realpathSync(rootDir);
+    return (
+      real !== normalizedRoot &&
+      !real.startsWith(normalizedRoot + "/") &&
+      !real.startsWith(normalizedRoot + "\\")
+    );
+  } catch {
+    // If we can't resolve (e.g. dangling symlink), treat as escaping.
+    return true;
+  }
+}
+
+function readDirRecursive(dir: string, rootDir: string): SkillFileEntry[] {
+  const entries: SkillFileEntry[] = [];
+  let dirents;
+  try {
+    dirents = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return entries;
+  }
+  for (const dirent of dirents) {
+    if (dirent.name.startsWith(".")) continue;
+    const fullPath = join(dir, dirent.name);
+    // Skip symlinks that escape the skill directory root
+    if (isEscapingSymlink(fullPath, rootDir)) continue;
+    if (dirent.isDirectory()) {
+      if (SKIP_DIRS.has(dirent.name)) continue;
+      entries.push(...readDirRecursive(fullPath, rootDir));
+      continue;
+    }
+    if (!dirent.isFile()) continue;
+    try {
+      const stat = statSync(fullPath);
+      const mimeType = Bun.file(fullPath).type;
+      const isText = isTextMime(mimeType);
+      let content: string | null = null;
+      if (isText && stat.size <= MAX_INLINE_SIZE) {
+        content = readFileSync(fullPath, "utf-8");
+      }
+      entries.push({
+        path: relative(rootDir, fullPath),
+        name: dirent.name,
+        size: stat.size,
+        mimeType,
+        isBinary: !isText,
+        content,
+      });
+    } catch {
+      // Skip files that can't be stat'd
+    }
+  }
+  return entries;
+}
+
+export function getSkillFiles(
+  skillId: string,
+  _ctx: SkillOperationContext,
+):
+  | { skill: SkillListItem; files: SkillFileEntry[] }
+  | { error: string; status: number } {
+  const found = findSkillById(skillId);
+  if (!found) {
+    return { error: `Skill "${skillId}" not found`, status: 404 };
+  }
+
+  const dirPath = found.summary.directoryPath;
+  if (!existsSync(dirPath)) {
+    return { error: `Skill directory not found for "${skillId}"`, status: 404 };
+  }
+
+  const files = readDirRecursive(dirPath, dirPath);
+  files.sort((a, b) => a.path.localeCompare(b.path));
+
+  return { skill: found.item, files };
+}
+
 export function enableSkill(
   skillId: string,
   ctx: SkillOperationContext,
@@ -456,6 +604,9 @@ export async function uninstallSkill(
       } catch {
         /* best effort */
       }
+      // Best-effort cleanup of capability memory for uninstalled skill
+      // (managed path handles this internally via deleteManagedSkill)
+      deleteSkillCapabilityMemory(skillId);
     }
 
     // Clean config entry
@@ -711,8 +862,6 @@ export interface CreateSkillParams {
   description: string;
   emoji?: string;
   bodyMarkdown: string;
-  userInvocable?: boolean;
-  disableModelInvocation?: boolean;
   overwrite?: boolean;
 }
 
@@ -727,8 +876,6 @@ export async function createSkill(
       description: params.description,
       emoji: params.emoji,
       bodyMarkdown: params.bodyMarkdown,
-      userInvocable: params.userInvocable,
-      disableModelInvocation: params.disableModelInvocation,
       overwrite: params.overwrite,
     });
 

package/src/daemon/history-repair.ts

@@ -194,7 +194,7 @@ export function repairHistory(messages: Message[]): RepairResult {
   // or from other history reconstruction artifacts. The Anthropic API requires
   // strict user/assistant alternation, so consecutive same-role messages must
   // always be merged. Undo semantics for mixed tool_result+text messages are
-  // handled by isUndoableUserMessage in session.ts.
+  // handled by isUndoableUserMessage in conversation.ts.
   const merged: Message[] = [];
   for (const msg of result) {
     const prev = merged[merged.length - 1];

package/src/daemon/host-bash-proxy.ts

@@ -39,8 +39,13 @@ export class HostBashProxy {
   }
 
   request(
-    input: { command: string; working_dir?: string; timeout_seconds?: number },
-    sessionId: string,
+    input: {
+      command: string;
+      working_dir?: string;
+      timeout_seconds?: number;
+      env?: Record<string, string>;
+    },
+    conversationId: string,
     signal?: AbortSignal,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
@@ -90,10 +95,13 @@ export class HostBashProxy {
       this.sendToClient({
         type: "host_bash_request",
         requestId,
-        sessionId,
+        conversationId,
         command: input.command,
         working_dir: input.working_dir,
         timeout_seconds: input.timeout_seconds,
+        ...(input.env && Object.keys(input.env).length > 0
+          ? { env: input.env }
+          : {}),
       } as ServerMessage);
     });
   }

package/src/daemon/host-cu-proxy.ts

@@ -129,7 +129,7 @@ export class HostCuProxy {
   request(
     toolName: string,
     input: Record<string, unknown>,
-    sessionId: string,
+    conversationId: string,
     stepNumber: number,
     reasoning?: string,
     signal?: AbortSignal,
@@ -179,7 +179,7 @@ export class HostCuProxy {
       this.sendToClient({
         type: "host_cu_request",
         requestId,
-        sessionId,
+        conversationId,
         toolName,
         input,
         stepNumber,

package/src/daemon/host-file-proxy.ts

@@ -14,7 +14,7 @@ type DistributiveOmit<T, K extends PropertyKey> = T extends unknown
 /** Clean input type for callers — transport envelope fields are added by the proxy. */
 export type HostFileInput = DistributiveOmit<
   HostFileRequest,
-  "type" | "requestId" | "sessionId"
+  "type" | "requestId" | "conversationId"
 >;
 
 const log = getLogger("host-file-proxy");
@@ -49,7 +49,7 @@ export class HostFileProxy {
 
   request(
     input: HostFileInput,
-    sessionId: string,
+    conversationId: string,
     signal?: AbortSignal,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
@@ -92,7 +92,7 @@ export class HostFileProxy {
         ...input,
         type: "host_file_request",
         requestId,
-        sessionId,
+        conversationId,
       } as ServerMessage);
     });
   }