@vellumai/assistant 0.5.11 → 0.5.12

package/src/config/bundled-tool-registry.ts

@@ -56,6 +56,8 @@ import * as contactMerge from "./bundled-skills/contacts/tools/contact-merge.js"
 import * as contactSearch from "./bundled-skills/contacts/tools/contact-search.js";
 import * as contactUpsert from "./bundled-skills/contacts/tools/contact-upsert.js";
 import * as googleContacts from "./bundled-skills/contacts/tools/google-contacts.js";
+// ── conversations ─────────────────────────────────────────────────────────────
+import * as renameConversation from "./bundled-skills/conversations/tools/rename-conversation.js";
 // ── document ───────────────────────────────────────────────────────────────────
 import * as documentCreate from "./bundled-skills/document/tools/document-create.js";
 import * as documentUpdate from "./bundled-skills/document/tools/document-update.js";
@@ -222,6 +224,9 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   ["contacts:tools/contact-merge.ts", contactMerge],
   ["contacts:tools/google-contacts.ts", googleContacts],
 
+  // conversations
+  ["conversations:tools/rename-conversation.ts", renameConversation],
+
   // document
   ["document:tools/document-create.ts", documentCreate],
   ["document:tools/document-update.ts", documentUpdate],

package/src/config/feature-flag-registry.json

@@ -255,7 +255,7 @@
       "key": "managed-google-oauth",
       "label": "Managed Google OAuth",
       "description": "Show the Google OAuth service card in Models & Services settings",
-      "defaultEnabled": false
+      "defaultEnabled": true
     },
     {
       "id": "settings-embedding-provider",

package/src/credential-execution/client.ts

@@ -348,7 +348,7 @@ export function createCesClient(
     },
 
     isReady(): boolean {
-      return ready;
+      return ready && transport.isAlive();
     },
 
     close(): void {

package/src/daemon/conversation-agent-loop.ts

@@ -245,6 +245,7 @@ export interface AgentLoopConversationContext {
   trustContext?: TrustContext;
   assistantId?: string;
   voiceCallControlPrompt?: string;
+  transportHints?: string[];
 
   readonly coreToolNames: Set<string>;
   allowedToolNames?: Set<string>;
@@ -748,6 +749,7 @@ export async function runAgentLoopImpl(
       temporalContext,
       nowScratchpad,
       voiceCallControlPrompt: ctx.voiceCallControlPrompt ?? null,
+      transportHints: ctx.transportHints ?? null,
       isNonInteractive: !isInteractiveResolved,
     } as const;
 

package/src/daemon/conversation-error.ts

@@ -1,3 +1,4 @@
+import { getProviderRoutingSource } from "../providers/registry.js";
 import { ProviderError, ProviderNotConfiguredError } from "../util/errors.js";
 import type {
   ConversationErrorCode,
@@ -200,12 +201,40 @@ function classifyCore(
         errorCategory: "context_too_large",
       };
     }
+    if (error.statusCode === 401 || error.statusCode === 403) {
+      if (
+        /invalid.*api.?key|invalid.*x-api-key|authentication.?error/i.test(
+          message,
+        )
+      ) {
+        // Check if this provider is routed through the managed proxy.
+        // If so, the assistant API key is stale — the client should reprovision.
+        const providerName = error.provider;
+        if (getProviderRoutingSource(providerName) === "managed-proxy") {
+          return {
+            code: "MANAGED_KEY_INVALID",
+            userMessage:
+              "The assistant API key is invalid. Attempting to re-provision…",
+            retryable: true,
+            errorCategory: "managed_key_invalid",
+          };
+        }
+        return {
+          code: "PROVIDER_NOT_CONFIGURED",
+          userMessage:
+            "Your API key is invalid or expired. Update it in Settings or switch to managed mode.",
+          retryable: false,
+          errorCategory: "provider_not_configured",
+        };
+      }
+    }
     if (error.statusCode === 401) {
       return {
-        code: "PROVIDER_BILLING",
-        userMessage: "Your API key is invalid or expired.",
+        code: "PROVIDER_NOT_CONFIGURED",
+        userMessage:
+          "Your API key is invalid or expired. Update it in Settings or switch to managed mode.",
         retryable: false,
-        errorCategory: "provider_billing",
+        errorCategory: "provider_not_configured",
       };
     }
     if (error.statusCode === 402) {
@@ -275,10 +304,11 @@ function classifyCore(
         )
       ) {
         return {
-          code: "PROVIDER_BILLING",
-          userMessage: "Your API key is invalid.",
+          code: "PROVIDER_NOT_CONFIGURED",
+          userMessage:
+            "Your API key is invalid. Update it in Settings or switch to managed mode.",
           retryable: false,
-          errorCategory: "provider_billing",
+          errorCategory: "provider_not_configured",
         };
       }
       return {

package/src/daemon/conversation-messaging.ts

@@ -296,6 +296,15 @@ export async function persistUserMessage(
     cleanMessage,
     attachmentInputs,
   );
+  log.info(
+    {
+      contentBlockTypes: Array.isArray(llmMessage.content)
+        ? llmMessage.content.map((b) => b.type)
+        : typeof llmMessage.content,
+      attachmentCount: attachments.length,
+    },
+    "persistUserMessage: content blocks being sent to model",
+  );
   ctx.messages.push(llmMessage);
 
   try {

package/src/daemon/conversation-runtime-assembly.ts

@@ -1000,6 +1000,23 @@ export function stripInterfaceTurnContext(messages: Message[]): Message[] {
   ]);
 }
 
+// ---------------------------------------------------------------------------
+// Transport hints injection (e.g. Slack thread context from the gateway)
+// ---------------------------------------------------------------------------
+
+function injectTransportHints(message: Message, hints: string[]): Message {
+  const block = `<transport_hints>\n${hints.join("\n")}\n</transport_hints>`;
+  return {
+    ...message,
+    content: [{ type: "text", text: block }, ...message.content],
+  };
+}
+
+/** Strip `<transport_hints>` blocks injected by `injectTransportHints`. */
+export function stripTransportHints(messages: Message[]): Message[] {
+  return stripUserTextBlocksByPrefix(messages, ["<transport_hints>"]);
+}
+
 /** Prefixes stripped by the pipeline (order doesn't matter — single pass). */
 const RUNTIME_INJECTION_PREFIXES = [
   "<channel_capabilities>",
@@ -1018,6 +1035,7 @@ const RUNTIME_INJECTION_PREFIXES = [
   "<active_dynamic_page>",
   "<non_interactive_context>",
   "<now_scratchpad>",
+  "<transport_hints>",
 ];
 
 /**
@@ -1064,6 +1082,7 @@ export function applyRuntimeInjections(
     voiceCallControlPrompt?: string | null;
     nowScratchpad?: string | null;
     isNonInteractive?: boolean;
+    transportHints?: string[] | null;
     mode?: InjectionMode;
   },
 ): Message[] {
@@ -1165,6 +1184,20 @@ export function applyRuntimeInjections(
     }
   }
 
+  if (
+    mode === "full" &&
+    options.transportHints &&
+    options.transportHints.length > 0
+  ) {
+    const userTail = result[result.length - 1];
+    if (userTail && userTail.role === "user") {
+      result = [
+        ...result.slice(0, -1),
+        injectTransportHints(userTail, options.transportHints),
+      ];
+    }
+  }
+
   // Temporal context is injected before workspace top-level so it
   // appears after workspace context in the final message content
   // (both are prepended, so later injections appear first).

package/src/daemon/conversation-surfaces.ts

@@ -26,6 +26,7 @@ import type {
   UiSurfaceShow,
 } from "./message-protocol.js";
 import { INTERACTIVE_SURFACE_TYPES } from "./message-protocol.js";
+import type { UserMessageAttachment } from "./message-types/shared.js";
 
 const log = getLogger("conversation-surfaces");
 
@@ -217,7 +218,7 @@ export interface SurfaceConversationContext {
   isProcessing(): boolean;
   enqueueMessage(
     content: string,
-    attachments: never[],
+    attachments: UserMessageAttachment[],
     onEvent: (msg: ServerMessage) => void,
     requestId: string,
     activeSurfaceId?: string,
@@ -229,7 +230,7 @@ export interface SurfaceConversationContext {
   getQueueDepth(): number;
   processMessage(
     content: string,
-    attachments: never[],
+    attachments: UserMessageAttachment[],
     onEvent: (msg: ServerMessage) => void,
     requestId?: string,
     activeSurfaceId?: string,
@@ -625,6 +626,36 @@ export function handleSurfaceAction(
     const accState = ctx.accumulatedSurfaceState.get(surfaceId);
     const hasAccState = accState && Object.keys(accState).length > 0;
 
+    // Extract file attachments from action data so they are sent as proper
+    // image/file content blocks instead of dumping base64 into the text.
+    let attachments: UserMessageAttachment[] = [];
+    let actionDataForText = data;
+    if (data && Array.isArray(data.files)) {
+      const files = data.files as Array<Record<string, unknown>>;
+      attachments = files
+        .filter(
+          (f) =>
+            typeof f.filename === "string" &&
+            typeof f.mimeType === "string" &&
+            typeof f.data === "string",
+        )
+        .map((f) => ({
+          filename: f.filename as string,
+          mimeType: f.mimeType as string,
+          data: f.data as string,
+          ...(typeof f.extractedText === "string"
+            ? { extractedText: f.extractedText }
+            : {}),
+        }));
+      // Only remove files from the text payload when we successfully parsed
+      // attachments — otherwise preserve the original data so the model still
+      // sees the files field (e.g. IDs/paths from dynamic app actions).
+      if (attachments.length > 0) {
+        const { files: _files, ...rest } = data;
+        actionDataForText = Object.keys(rest).length > 0 ? rest : undefined;
+      }
+    }
+
     let content: string;
     let displayContent: string | undefined;
     if (prompt) {
@@ -639,8 +670,12 @@ export function handleSurfaceAction(
         .replace(/_/g, " ")
         .replace(/\b\w/g, (c) => c.toUpperCase());
       content = `[User action on app: ${summary}]`;
-      if (data && Object.keys(data).length > 0) {
-        content += `\n\nAction data: ${JSON.stringify(data)}`;
+      if (attachments.length > 0) {
+        const names = attachments.map((a) => a.filename).join(", ");
+        content += `\n\nUploaded files: ${names}`;
+      }
+      if (actionDataForText && Object.keys(actionDataForText).length > 0) {
+        content += `\n\nAction data: ${JSON.stringify(actionDataForText)}`;
       }
       if (hasAccState) {
         content += `\n\nAccumulated surface state: ${JSON.stringify(accState)}`;
@@ -648,6 +683,23 @@ export function handleSurfaceAction(
       displayContent = summary;
     }
 
+    log.info(
+      {
+        surfaceId,
+        actionId,
+        contentLength: content.length,
+        contentPreview: content.slice(0, 200),
+        attachmentCount: attachments.length,
+        attachments: attachments.map((a) => ({
+          filename: a.filename,
+          mimeType: a.mimeType,
+          dataLength: a.data?.length ?? 0,
+          hasExtractedText: !!a.extractedText,
+        })),
+      },
+      "Surface action: preparing to send message to model",
+    );
+
     const requestId = uuid();
     ctx.surfaceActionRequestIds.add(requestId);
     // Use broadcastToAllClients (publishes to the SSE event hub) instead of
@@ -665,7 +717,7 @@ export function handleSurfaceAction(
 
     const result = ctx.enqueueMessage(
       content,
-      [],
+      attachments,
       onEvent,
       requestId,
       surfaceId,
@@ -706,13 +758,13 @@ export function handleSurfaceAction(
 
     // Conversation is idle — process the message immediately.
     log.info(
-      { surfaceId, actionId, requestId },
-      "Processing surface action immediately (history-restored)",
+      { surfaceId, actionId, requestId, attachmentCount: attachments.length },
+      "Processing surface action immediately (history-restored) with attachments",
     );
     ctx
       .processMessage(
         content,
-        [],
+        attachments,
         onEvent,
         requestId,
         surfaceId,
@@ -807,11 +859,45 @@ export function handleSurfaceAction(
     });
   }
 
+  // Extract file attachments from action data so they are sent as proper
+  // image/file content blocks instead of dumping base64 into the text.
+  let pendingAttachments: UserMessageAttachment[] = [];
+  let mergedDataForText = mergedData;
+  if (mergedData && Array.isArray(mergedData.files)) {
+    const files = mergedData.files as Array<Record<string, unknown>>;
+    pendingAttachments = files
+      .filter(
+        (f) =>
+          typeof f.filename === "string" &&
+          typeof f.mimeType === "string" &&
+          typeof f.data === "string",
+      )
+      .map((f) => ({
+        filename: f.filename as string,
+        mimeType: f.mimeType as string,
+        data: f.data as string,
+        ...(typeof f.extractedText === "string"
+          ? { extractedText: f.extractedText }
+          : {}),
+      }));
+    // Only remove files from the text payload when we successfully parsed
+    // attachments — otherwise preserve the original data so the model still
+    // sees the files field.
+    if (pendingAttachments.length > 0) {
+      const { files: _files, ...rest } = mergedData;
+      mergedDataForText = Object.keys(rest).length > 0 ? rest : undefined;
+    }
+  }
+
   let fallbackContent = `[User action on ${pending.surfaceType} surface: ${summary}]`;
+  if (pendingAttachments.length > 0) {
+    const names = pendingAttachments.map((a) => a.filename).join(", ");
+    fallbackContent += `\n\nUploaded files: ${names}`;
+  }
   // Append structured data so the LLM has access to IDs/values it needs
   // to act on (e.g. selectedIds for archiving).
-  if (mergedData && Object.keys(mergedData).length > 0) {
-    fallbackContent += `\n\nAction data: ${JSON.stringify(mergedData)}`;
+  if (mergedDataForText && Object.keys(mergedDataForText).length > 0) {
+    fallbackContent += `\n\nAction data: ${JSON.stringify(mergedDataForText)}`;
   }
   // Append deselection context for table/list surfaces so the LLM knows what the user chose to keep.
   const selectedIds = mergedData?.selectedIds as string[] | undefined;
@@ -867,9 +953,24 @@ export function handleSurfaceAction(
     attributes: { source: "surface_action", surfaceId, actionId },
   });
 
+  log.info(
+    {
+      surfaceId,
+      actionId,
+      attachmentCount: pendingAttachments.length,
+      attachments: pendingAttachments.map((a) => ({
+        filename: a.filename,
+        mimeType: a.mimeType,
+        dataLength: a.data?.length ?? 0,
+      })),
+      contentPreview: content.slice(0, 200),
+    },
+    "Surface action follow-up: preparing to send message to model",
+  );
+
   const result = ctx.enqueueMessage(
     content,
-    [],
+    pendingAttachments,
     onEvent,
     requestId,
     surfaceId,
@@ -929,13 +1030,18 @@ export function handleSurfaceAction(
     ctx.pendingSurfaceActions.delete(surfaceId);
   }
   log.info(
-    { surfaceId, actionId, requestId },
-    "Processing surface action as follow-up",
+    {
+      surfaceId,
+      actionId,
+      requestId,
+      attachmentCount: pendingAttachments.length,
+    },
+    "Processing surface action as follow-up with attachments",
   );
   ctx
     .processMessage(
       content,
-      [],
+      pendingAttachments,
       onEvent,
       requestId,
       surfaceId,

package/src/daemon/conversation.ts

@@ -187,6 +187,7 @@ export class Conversation {
   /** @internal */ authContext?: AuthContext;
   /** @internal */ loadedHistoryTrustClass?: TrustClass;
   /** @internal */ voiceCallControlPrompt?: string;
+  /** @internal */ transportHints?: string[];
   /** @internal */ assistantId?: string;
   /** @internal */ commandIntent?: {
     type: string;
@@ -892,6 +893,10 @@ export class Conversation {
     this.voiceCallControlPrompt = prompt ?? undefined;
   }
 
+  setTransportHints(hints: string[] | undefined): void {
+    this.transportHints = hints;
+  }
+
   setAssistantId(assistantId: string | null): void {
     this.assistantId = assistantId ?? undefined;
   }

package/src/daemon/handlers/skills.ts

@@ -25,6 +25,9 @@ import {
   userMessage,
 } from "../../providers/provider-send-message.js";
 import { isTextMimeType as isTextMime } from "../../runtime/routes/workspace-utils.js";
+import { getCatalog } from "../../skills/catalog-cache.js";
+import { installSkillLocally } from "../../skills/catalog-install.js";
+import { filterByQuery } from "../../skills/catalog-search.js";
 import {
   clawhubCheckUpdates,
   clawhubInspect,
@@ -232,8 +235,9 @@ export interface SkillListItem {
   description: string;
   emoji?: string;
   homepage?: string;
-  source: "bundled" | "managed" | "workspace" | "clawhub" | "extra";
+  source: "bundled" | "managed" | "workspace" | "clawhub" | "extra" | "catalog";
   state: "enabled" | "disabled";
+  installStatus: "bundled" | "installed" | "available";
   updateAvailable: boolean;
   provenance: SkillProvenance;
 }
@@ -259,6 +263,9 @@ export function listSkills(_ctx: SkillOperationContext): SkillListItem[] {
     homepage: r.summary.homepage,
     source: r.summary.source,
     state: r.state,
+    installStatus: (r.summary.source === "bundled"
+      ? "bundled"
+      : "installed") as SkillListItem["installStatus"],
     updateAvailable: false,
     provenance: resolveProvenance(r.summary),
   }));
@@ -275,6 +282,54 @@ export function listSkills(_ctx: SkillOperationContext): SkillListItem[] {
   return items;
 }
 
+/**
+ * List installed skills merged with available catalog skills.
+ * Installed skills take precedence when deduplicating by ID.
+ */
+export async function listSkillsWithCatalog(
+  ctx: SkillOperationContext,
+): Promise<SkillListItem[]> {
+  const installed = listSkills(ctx);
+  const installedIds = new Set(installed.map((s) => s.id));
+
+  let catalogSkills: import("../../skills/catalog-install.js").CatalogSkill[];
+  try {
+    catalogSkills = await getCatalog();
+  } catch {
+    // If catalog fetch fails, return installed-only
+    return installed;
+  }
+
+  // All entries from the Vellum platform API are first-party.
+  // Create SkillListItems for catalog skills not already installed.
+  const available: SkillListItem[] = catalogSkills
+    .filter((cs) => !installedIds.has(cs.id))
+    .map((cs) => ({
+      id: cs.id,
+      name: cs.metadata?.vellum?.["display-name"] ?? cs.name,
+      description: cs.description,
+      emoji: cs.emoji,
+      homepage: undefined,
+      source: "catalog" as const,
+      state: "disabled" as const,
+      installStatus: "available" as const,
+      updateAvailable: false,
+      provenance: { kind: "first-party" as const, provider: "Vellum" },
+    }));
+
+  const merged = [...installed, ...available];
+
+  // Sort using the same provenance sort + alphabetical
+  merged.sort((a, b) => {
+    const rankDiff =
+      provenanceSortRank(a.provenance) - provenanceSortRank(b.provenance);
+    if (rankDiff !== 0) return rankDiff;
+    return a.name.localeCompare(b.name);
+  });
+
+  return merged;
+}
+
 /** Look up a single skill by ID from the resolved catalog, returning its SkillListItem. */
 function findSkillById(
   skillId: string,
@@ -294,6 +349,7 @@ function findSkillById(
     homepage: r.summary.homepage,
     source: r.summary.source,
     state: r.state,
+    installStatus: r.summary.source === "bundled" ? "bundled" : "installed",
     updateAvailable: false,
     provenance: resolveProvenance(r.summary),
   };
@@ -519,6 +575,43 @@ export async function installSkill(
       return { success: true };
     }
 
+    // Check the Vellum catalog (first-party skills hosted on the platform)
+    try {
+      const vellumCatalog = await getCatalog();
+      const catalogEntry = vellumCatalog.find((s) => s.id === spec.slug);
+      if (catalogEntry) {
+        await installSkillLocally(spec.slug, catalogEntry, true);
+
+        // Reload skill catalog so the newly installed skill is picked up
+        loadSkillCatalog();
+
+        // Auto-enable the newly installed catalog skill
+        try {
+          const raw = loadRawConfig();
+          ensureSkillEntry(raw, spec.slug).enabled = true;
+          saveConfigWithSuppression(raw, ctx);
+          ctx.broadcast({
+            type: "skills_state_changed",
+            name: spec.slug,
+            state: "enabled",
+          });
+        } catch (err) {
+          log.warn(
+            { err, skillId: spec.slug },
+            "Failed to auto-enable installed catalog skill",
+          );
+        }
+
+        return { success: true };
+      }
+    } catch (err) {
+      // If catalog lookup/install fails, fall through to clawhub
+      log.warn(
+        { err, skillId: spec.slug },
+        "Vellum catalog install failed, falling back to community registry",
+      );
+    }
+
     // Install from clawhub (community)
     const result = await clawhubInstall(spec.slug, { version: spec.version });
     if (!result.success) {
@@ -660,8 +753,60 @@ export async function searchSkills(
   { success: true; data: unknown } | { success: false; error: string }
 > {
   try {
-    const result = await clawhubSearch(query);
-    return { success: true, data: result };
+    // Search the loaded skill catalog (bundled + installed) for matches
+    const catalog = loadSkillCatalog();
+    const catalogMatches = filterByQuery(catalog, query, [
+      (s) => s.id,
+      (s) => s.displayName,
+      (s) => s.description,
+    ]);
+
+    // Shape that matches ClawhubSearchResultItem so the client
+    // (Swift ClawhubSkillItem) can decode results uniformly.
+    interface SearchItem {
+      name: string;
+      slug: string;
+      description: string;
+      author: string;
+      stars: number;
+      installs: number;
+      version: string;
+      createdAt: number;
+      source: "vellum" | "clawhub";
+    }
+
+    const catalogItems: SearchItem[] = catalogMatches.map((s) => ({
+      name: s.displayName,
+      slug: s.id,
+      description: s.description,
+      author: "Vellum",
+      stars: 0,
+      installs: 0,
+      version: "",
+      createdAt: 0,
+      source: "vellum" as const,
+    }));
+
+    // Search the community registry (non-fatal on failure)
+    let communitySkills: SearchItem[] = [];
+    try {
+      const communityResult = await clawhubSearch(query);
+      communitySkills = communityResult.skills;
+    } catch (err) {
+      log.warn(
+        { err },
+        "clawhub search failed, returning catalog-only results",
+      );
+    }
+
+    // Deduplicate: catalog takes precedence when slugs collide
+    const catalogSlugs = new Set(catalogItems.map((s) => s.slug));
+    const deduped = communitySkills.filter((s) => !catalogSlugs.has(s.slug));
+
+    return {
+      success: true,
+      data: { skills: [...catalogItems, ...deduped] },
+    };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err }, "Failed to search skills");

package/src/daemon/host-bash-proxy.ts

@@ -86,6 +86,14 @@ export class HostBashProxy {
             clearTimeout(timer);
             this.pending.delete(requestId);
             this.onInternalResolve?.(requestId);
+            try {
+              this.sendToClient({
+                type: "host_bash_cancel",
+                requestId,
+              } as ServerMessage);
+            } catch {
+              // Best-effort cancel notification — connection may already be closed.
+            }
             resolve(formatShellOutput("", "Aborted", null, false, 0));
           }
         };
@@ -144,6 +152,14 @@ export class HostBashProxy {
     for (const [requestId, entry] of this.pending) {
       clearTimeout(entry.timer);
       this.onInternalResolve?.(requestId);
+      try {
+        this.sendToClient({
+          type: "host_bash_cancel",
+          requestId,
+        } as ServerMessage);
+      } catch {
+        // Best-effort cancel notification — connection may already be closed.
+      }
       entry.reject(
         new AssistantError(
           "Host bash proxy disposed",