@vellumai/assistant 0.4.55 → 0.4.57

package/src/tools/acp/status.ts

@@ -0,0 +1,31 @@
+import { getAcpSessionManager } from "../../acp/index.js";
+import type { ToolContext, ToolExecutionResult } from "../types.js";
+
+export async function executeAcpStatus(
+  input: Record<string, unknown>,
+  _context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const acpSessionId = input.acp_session_id as string | undefined;
+  const manager = getAcpSessionManager();
+
+  try {
+    if (acpSessionId) {
+      const state = manager.getStatus(acpSessionId);
+      return {
+        content: JSON.stringify(state),
+        isError: false,
+      };
+    }
+
+    // List all sessions.
+    const allStates = manager.getStatus();
+    if (Array.isArray(allStates) && allStates.length === 0) {
+      return { content: "No ACP sessions found.", isError: false };
+    }
+
+    return { content: JSON.stringify(allStates), isError: false };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: msg, isError: true };
+  }
+}

package/src/tools/apps/executors.ts

@@ -28,7 +28,7 @@ export interface ExecutorResult {
 }
 
 // ---------------------------------------------------------------------------
-// Dependency interfaces — callers inject these rather than importing the
+// Dependency interfaces - callers inject these rather than importing the
 // app-store module directly, which makes the executors testable with mocks.
 // ---------------------------------------------------------------------------
 
@@ -82,7 +82,7 @@ export type ProxyResolver = (
 ) => Promise<ExecutorResult>;
 
 // ---------------------------------------------------------------------------
-// Path resolution — multifile apps default to src/ for file operations
+// Path resolution - multifile apps default to src/ for file operations
 // ---------------------------------------------------------------------------
 
 /**
@@ -146,7 +146,7 @@ export async function executeAppCreate(
   const autoOpen = input.auto_open !== false; // default true
   const preview = input.preview;
 
-  // Validate required fields — LLM input is not type-checked at runtime
+  // Validate required fields - LLM input is not type-checked at runtime
   if (typeof name !== "string" || name.trim() === "") {
     return {
       content: JSON.stringify({
@@ -168,7 +168,7 @@ export async function executeAppCreate(
     }
   }
 
-  // Extract icon from preview if provided — only persist emoji-like values,
+  // Extract icon from preview if provided - only persist emoji-like values,
   // not URLs which would render as raw strings in UI and bundle manifests.
   const rawIcon = preview?.icon as string | undefined;
   const icon = rawIcon && !rawIcon.startsWith("http") ? rawIcon : undefined;
@@ -270,7 +270,7 @@ render(<App />, document.getElementById('app')!);
         isError: false,
       };
     } catch {
-      // Preview emission failure is non-fatal — the app was created successfully.
+      // Preview emission failure is non-fatal - the app was created successfully.
       return {
         content: JSON.stringify({
           ...app,
@@ -388,7 +388,7 @@ export function executeAppFileList(
 
   if (app && isMultifileApp(app)) {
     // Separate build output paths from source paths without mutating the
-    // file path strings — consumers need clean paths for subsequent tool calls.
+    // file path strings - consumers need clean paths for subsequent tool calls.
     const buildOutputPaths = files.filter((f) =>
       f.replace(/\\/g, "/").startsWith("dist/"),
     );
@@ -557,7 +557,7 @@ export async function executeAppGenerateIcon(
   );
 
   if (existsSync(iconPath)) {
-    // Success — clean up the old icon backup
+    // Success - clean up the old icon backup
     if (existsSync(tempPath)) {
       unlinkSync(tempPath);
     }
@@ -567,7 +567,7 @@ export async function executeAppGenerateIcon(
     };
   }
 
-  // Generation failed — restore the previous icon if we had one
+  // Generation failed - restore the previous icon if we had one
   if (existsSync(tempPath)) {
     renameSync(tempPath, iconPath);
   }

package/src/tools/apps/registry.ts

@@ -2,7 +2,7 @@
  * Registers app proxy tools with the daemon's tool registry.
  *
  * Called once at daemon startup via initializeTools(). Only proxy tools
- * (e.g. app_open) are registered here — non-proxy data tools are now
+ * (e.g. app_open) are registered here - non-proxy data tools are now
  * provided by the app-builder skill via its TOOLS.json manifest.
  */
 

package/src/tools/assets/materialize.ts

@@ -1,5 +1,5 @@
 /**
- * asset_materialize — write a stored attachment to a sandbox file path.
+ * asset_materialize - write a stored attachment to a sandbox file path.
  *
  * Accepts an attachment ID (from asset_search) and a destination path
  * within the sandbox working directory. Decodes the base64 content and
@@ -7,7 +7,7 @@
  * regular file.
  */
 
-import { mkdirSync, writeFileSync } from "node:fs";
+import { copyFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 
 import { eq } from "drizzle-orm";
@@ -16,7 +16,11 @@ import {
   type AttachmentContext,
   isAttachmentVisible,
 } from "../../daemon/media-visibility-policy.js";
-import { getConversationThreadType } from "../../memory/conversation-crud.js";
+import {
+  getAttachmentContent,
+  getFilePathForAttachment,
+} from "../../memory/attachments-store.js";
+import { getConversationType } from "../../memory/conversation-crud.js";
 import { getDb } from "../../memory/db.js";
 import { attachments } from "../../memory/schema.js";
 import { RiskLevel } from "../../permissions/types.js";
@@ -27,11 +31,11 @@ import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 import { getAttachmentSourceConversations } from "./search.js";
 
 // ---------------------------------------------------------------------------
-// Size limit — prevent materializing excessively large attachments
+// Size limit - prevent materializing excessively large attachments
 // ---------------------------------------------------------------------------
 
-/** 50 MB ceiling for materialized files. */
-export const MAX_MATERIALIZE_BYTES = 50 * 1024 * 1024;
+/** 100 MB ceiling for materialized files. */
+export const MAX_MATERIALIZE_BYTES = 100 * 1024 * 1024;
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -44,7 +48,7 @@ function formatBytes(bytes: number): string {
 }
 
 /**
- * Load an attachment row (including base64 data) by its primary key.
+ * Load attachment metadata by its primary key.
  *
  * Not scoped by assistantId because attachment access is enforced by
  * conversation visibility checks in execute().
@@ -54,7 +58,6 @@ function loadAttachmentById(attachmentId: string): {
   originalFilename: string;
   mimeType: string;
   sizeBytes: number;
-  dataBase64: string;
 } | null {
   const db = getDb();
   const row = db
@@ -63,7 +66,6 @@ function loadAttachmentById(attachmentId: string): {
       originalFilename: attachments.originalFilename,
       mimeType: attachments.mimeType,
       sizeBytes: attachments.sizeBytes,
-      dataBase64: attachments.dataBase64,
     })
     .from(attachments)
     .where(eq(attachments.id, attachmentId))
@@ -108,7 +110,7 @@ class AssetMaterializeTool implements Tool {
   name = "asset_materialize";
   description = definition.description;
   category = "assets";
-  defaultRiskLevel = RiskLevel.Medium;
+  defaultRiskLevel = RiskLevel.Low;
 
   getDefinition(): ToolDefinition {
     return definition;
@@ -162,32 +164,32 @@ class AssetMaterializeTool implements Tool {
     }
 
     // --- Visibility check ---------------------------------------------------
-    // Reject materialization of attachments from private threads the caller
-    // does not belong to. This prevents cross-thread data leakage.
+    // Reject materialization of attachments from private conversations the caller
+    // does not belong to. This prevents cross-conversation data leakage.
 
-    const currentThreadType = getConversationThreadType(context.conversationId);
+    const currentConversationType = getConversationType(context.conversationId);
     const currentContext: AttachmentContext = {
       conversationId: context.conversationId,
-      isPrivate: currentThreadType === "private",
+      isPrivate: currentConversationType === "private",
     };
 
     const sources = getAttachmentSourceConversations(attachmentId);
     if (sources.length > 0) {
-      const hasStandard = sources.some((s) => s.threadType !== "private");
+      const hasStandard = sources.some((s) => s.conversationType !== "private");
       if (!hasStandard) {
-        // All sources are private — check if the caller is in any of those threads
-        const callerInSourceThread = sources.some((s) =>
+        // All sources are private - check if the caller is in any of those conversations
+        const callerInSourceConversation = sources.some((s) =>
           isAttachmentVisible(
             { conversationId: s.conversationId, isPrivate: true },
             currentContext,
           ),
         );
-        if (!callerInSourceThread) {
+        if (!callerInSourceConversation) {
           return {
             content:
-              `Error: Attachment "${attachment.originalFilename}" is from a private thread ` +
+              `Error: Attachment "${attachment.originalFilename}" is from a private conversation ` +
               `and cannot be accessed from this context. You can only access this ` +
-              `attachment from within the private thread where it was shared.`,
+              `attachment from within the private conversation where it was shared.`,
             isError: true,
           };
         }
@@ -205,15 +207,28 @@ class AssetMaterializeTool implements Tool {
       };
     }
 
-    // --- Decode and write ---------------------------------------------------
+    // --- Write to disk -------------------------------------------------------
 
     try {
-      const buffer = Buffer.from(attachment.dataBase64, "base64");
-
       // Ensure parent directories exist
       mkdirSync(dirname(resolvedPath), { recursive: true });
 
-      writeFileSync(resolvedPath, buffer);
+      // For file-backed attachments, copy directly from the on-disk path
+      // to avoid reading potentially large files into memory. For inline
+      // attachments, decode the base64 content from the database.
+      const filePath = getFilePathForAttachment(attachmentId);
+      if (filePath) {
+        copyFileSync(filePath, resolvedPath);
+      } else {
+        const buffer = getAttachmentContent(attachmentId);
+        if (!buffer) {
+          return {
+            content: `Error: Could not read content for attachment "${attachmentId}".`,
+            isError: true,
+          };
+        }
+        writeFileSync(resolvedPath, buffer);
+      }
 
       return {
         content:

package/src/tools/assets/search.ts

@@ -1,9 +1,9 @@
 /**
- * asset_search — cross-thread attachment metadata search.
+ * asset_search - cross-conversation attachment metadata search.
  *
  * Queries the attachments store for matching assets by MIME type,
  * filename, recency, or conversation scope. Returns metadata and
- * attachment IDs only — never base64 payloads. The IDs can be
+ * attachment IDs only - never base64 payloads. The IDs can be
  * passed to asset_materialize (PR 35) to retrieve actual content.
  */
 
@@ -14,7 +14,7 @@ import {
   isAttachmentVisible,
 } from "../../daemon/media-visibility-policy.js";
 import type { StoredAttachment } from "../../memory/attachments-store.js";
-import { getConversationThreadType } from "../../memory/conversation-crud.js";
+import { getConversationType } from "../../memory/conversation-crud.js";
 import { getDb, rawAll } from "../../memory/db.js";
 import {
   attachments,
@@ -33,7 +33,7 @@ import { registerTool } from "../registry.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 
 // ---------------------------------------------------------------------------
-// Recency presets — map human-readable labels to epoch-ms cutoff offsets
+// Recency presets - map human-readable labels to epoch-ms cutoff offsets
 // ---------------------------------------------------------------------------
 
 const RECENCY_MS: Record<string, number> = {
@@ -71,17 +71,17 @@ function formatAttachment(a: StoredAttachment): string {
 
 /**
  * Look up which conversations an attachment belongs to, along with each
- * conversation's thread type. An attachment can be linked to multiple
+ * conversation's type. An attachment can be linked to multiple
  * messages across multiple conversations.
  */
 export function getAttachmentSourceConversations(
   attachmentId: string,
-): Array<{ conversationId: string; threadType: string }> {
+): Array<{ conversationId: string; conversationType: string }> {
   const db = getDb();
   return db
     .select({
       conversationId: messages.conversationId,
-      threadType: conversations.threadType,
+      conversationType: conversations.conversationType,
     })
     .from(messageAttachments)
     .innerJoin(messages, eq(messages.id, messageAttachments.messageId))
@@ -95,9 +95,9 @@ export function getAttachmentSourceConversations(
  * Returns true if visible, false if hidden.
  *
  * - Orphan attachments (no message linkage) are universally visible.
- * - Attachments with any standard-thread source are universally visible.
+ * - Attachments with any standard-conversation source are universally visible.
  * - All-private attachments are visible only if the caller is in one of
- *   the source private threads.
+ *   the source private conversations.
  */
 function isAttachmentVisibleFromContext(
   attachmentId: string,
@@ -108,12 +108,12 @@ function isAttachmentVisibleFromContext(
     return true;
   }
 
-  const hasStandard = sources.some((s) => s.threadType !== "private");
+  const hasStandard = sources.some((s) => s.conversationType !== "private");
   if (hasStandard) {
     return true;
   }
 
-  // All sources are private — visible only if the caller is in one of those threads
+  // All sources are private - visible only if the caller is in one of those conversations
   return sources.some((s) =>
     isAttachmentVisible(
       { conversationId: s.conversationId, isPrivate: true },
@@ -143,13 +143,13 @@ export function searchAttachments(
   const db = getDb();
   const conditions = [];
 
-  // MIME type filter — supports wildcards like 'image/*' via LIKE
+  // MIME type filter - supports wildcards like 'image/*' via LIKE
   if (params.mime_type) {
     const mimePattern = params.mime_type.replace(/\*/g, "%");
     conditions.push(like(attachments.mimeType, mimePattern));
   }
 
-  // Filename filter — case-insensitive substring match (escape LIKE wildcards)
+  // Filename filter - case-insensitive substring match (escape LIKE wildcards)
   if (params.filename) {
     conditions.push(
       like(
@@ -159,7 +159,7 @@ export function searchAttachments(
     );
   }
 
-  // Recency filter — computed cutoff timestamp
+  // Recency filter - computed cutoff timestamp
   if (params.recency) {
     const offsetMs = RECENCY_MS[params.recency];
     if (offsetMs) {
@@ -168,7 +168,7 @@ export function searchAttachments(
     }
   }
 
-  // Conversation scope — join through message_attachments + messages
+  // Conversation scope - join through message_attachments + messages
   if (params.conversation_id) {
     const linkedIds = db
       .select({ attachmentId: messageAttachments.attachmentId })
@@ -239,7 +239,7 @@ export function searchAttachments(
     }));
   }
 
-  // No conversation constraint — query attachments table directly
+  // No conversation constraint - query attachments table directly
   const limit = Math.min(params.limit ?? DEFAULT_LIMIT, MAX_RESULTS);
   const where = conditions.length > 0 ? and(...conditions) : undefined;
 
@@ -271,7 +271,7 @@ const definition: ToolDefinition = {
   name: "asset_search",
   description:
     "Search for previously uploaded media assets (images, documents, etc.) by metadata. " +
-    "Returns attachment IDs and metadata — not file content. Use the returned IDs with " +
+    "Returns attachment IDs and metadata - not file content. Use the returned IDs with " +
     "asset_materialize to retrieve actual file data.",
   input_schema: {
     type: "object",
@@ -358,14 +358,14 @@ class AssetSearchTool implements Tool {
         limit: MAX_RESULTS,
       });
 
-      // Enforce private-thread visibility: filter out attachments that
-      // belong exclusively to private threads the caller cannot access.
-      const currentThreadType = getConversationThreadType(
+      // Enforce private-conversation visibility: filter out attachments that
+      // belong exclusively to private conversations the caller cannot access.
+      const currentConversationType = getConversationType(
         context.conversationId,
       );
       const currentContext: AttachmentContext = {
         conversationId: context.conversationId,
-        isPrivate: currentThreadType === "private",
+        isPrivate: currentConversationType === "private",
       };
 
       const effectiveLimit = Math.min(limit ?? DEFAULT_LIMIT, MAX_RESULTS);

package/src/tools/browser/__tests__/auth-cache.test.ts

@@ -157,7 +157,7 @@ describe("AuthSessionCache", () => {
     ];
     writeSessionsFile(tmpDir, sessions);
 
-    // Create a fresh cache — load() has NOT been called
+    // Create a fresh cache - load() has NOT been called
     const cache = new AuthSessionCache(tmpDir);
 
     // markAuthenticated should ensureLoaded first, so existing sessions
@@ -192,7 +192,7 @@ describe("AuthSessionCache", () => {
     ];
     writeSessionsFile(tmpDir, sessions);
 
-    // Create a fresh cache — load() has NOT been called
+    // Create a fresh cache - load() has NOT been called
     const cache = new AuthSessionCache(tmpDir);
 
     // invalidate should ensureLoaded first, so unrelated sessions

package/src/tools/browser/__tests__/auth-detector.test.ts

@@ -185,7 +185,7 @@ describe("isAuthUrl", () => {
 
 // ── DOM detection: login pages ───────────────────────────────────────
 
-describe("detectAuthChallenge — login pages", () => {
+describe("detectAuthChallenge - login pages", () => {
   it("detects a generic login page with password input", async () => {
     const page = mockPage("https://example.com/login", {
       type: "login",
@@ -251,7 +251,7 @@ describe("detectAuthChallenge — login pages", () => {
 
 // ── DOM detection: 2FA pages ─────────────────────────────────────────
 
-describe("detectAuthChallenge — 2FA pages", () => {
+describe("detectAuthChallenge - 2FA pages", () => {
   it("detects a 2FA page with code input", async () => {
     const page = mockPage("https://accounts.google.com/signin/v2/challenge", {
       type: "2fa",
@@ -290,7 +290,7 @@ describe("detectAuthChallenge — 2FA pages", () => {
 
 // ── DOM detection: OAuth consent ─────────────────────────────────────
 
-describe("detectAuthChallenge — OAuth consent", () => {
+describe("detectAuthChallenge - OAuth consent", () => {
   it("detects an OAuth consent page with Allow button", async () => {
     const page = mockPage("https://accounts.google.com/o/oauth2/v2/auth", {
       type: "oauth_consent",
@@ -324,7 +324,7 @@ describe("detectAuthChallenge — OAuth consent", () => {
 
 // ── Non-auth pages ───────────────────────────────────────────────────
 
-describe("detectAuthChallenge — non-auth pages", () => {
+describe("detectAuthChallenge - non-auth pages", () => {
   it("returns null for a regular page", async () => {
     const page = mockPage("https://example.com/dashboard", null);
 

package/src/tools/browser/auth-detector.ts

@@ -25,7 +25,7 @@ interface ServicePattern {
 }
 
 const SERVICE_PATTERNS: ServicePattern[] = [
-  // Auth-subdomain services — hostname match is sufficient
+  // Auth-subdomain services - hostname match is sufficient
   { pattern: /accounts\.google\.com/, service: "Google" },
   { pattern: /login\.microsoftonline\.com/, service: "Microsoft" },
   { pattern: /appleid\.apple\.com/, service: "Apple" },
@@ -33,7 +33,7 @@ const SERVICE_PATTERNS: ServicePattern[] = [
   { pattern: /id\.atlassian\.com/, service: "Atlassian" },
   { pattern: /auth0\.com/, service: "Auth0" },
   { pattern: /okta\.com/, service: "Okta" },
-  // General-domain services — need both hostname AND path match
+  // General-domain services - need both hostname AND path match
   {
     pattern: /github\.com/,
     service: "GitHub",
@@ -89,7 +89,7 @@ export function isAuthUrl(url: string): boolean {
     )
   )
     return true;
-  // Generic path patterns — match against pathname only to avoid false positives
+  // Generic path patterns - match against pathname only to avoid false positives
   // from query parameters or fragments that happen to contain auth-related words.
   return GENERIC_AUTH_PATTERNS.some((p) => p.test(parsedUrl.pathname));
 }
@@ -228,7 +228,7 @@ const CAPTCHA_DETECT_EXPRESSION = `(() => {
     if (document.querySelector(sel)) return true;
   }
 
-  // reCAPTCHA — only flag visible challenges, not invisible v3 scoring widgets.
+  // reCAPTCHA - only flag visible challenges, not invisible v3 scoring widgets.
   // The challenge iframe (api2/bframe) or a visible .g-recaptcha container indicates
   // an interactive CAPTCHA the user must solve.
   if (document.querySelector('iframe[src*="recaptcha/api2/bframe"]')) return true;
@@ -238,14 +238,14 @@ const CAPTCHA_DETECT_EXPRESSION = `(() => {
     if (rect.width > 0 && rect.height > 0) return true;
   }
 
-  // hCaptcha — only flag when a visible challenge container is present
+  // hCaptcha - only flag when a visible challenge container is present
   const hcaptchaContainer = document.querySelector('#hcaptcha-container, .h-captcha');
   if (hcaptchaContainer) {
     const rect = hcaptchaContainer.getBoundingClientRect();
     if (rect.width > 0 && rect.height > 0) return true;
   }
 
-  // hCaptcha fallback — catch custom-rendered hCaptcha in arbitrary host elements
+  // hCaptcha fallback - catch custom-rendered hCaptcha in arbitrary host elements
   // by looking for any visible hCaptcha iframe (check all, not just the first)
   const hcaptchaIframes = document.querySelectorAll('iframe[src*="hcaptcha"]');
   for (const iframe of hcaptchaIframes) {