npm - @vellumai/assistant - Versions diffs - 0.5.11 → 0.5.13 - Mend

@vellumai/assistant 0.5.11 → 0.5.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (209) hide show

package/Dockerfile +42 -9
package/docs/architecture/integrations.md +34 -32
package/node_modules/@vellumai/ces-contracts/src/__tests__/grants.test.ts +7 -7
package/node_modules/@vellumai/ces-contracts/src/handles.ts +5 -4
package/node_modules/@vellumai/ces-contracts/src/index.ts +7 -0
package/node_modules/@vellumai/ces-contracts/src/rpc.ts +5 -0
package/node_modules/@vellumai/credential-storage/src/index.ts +1 -1
package/openapi.yaml +87 -9
package/package.json +1 -1
package/src/__tests__/catalog-cache.test.ts +164 -0
package/src/__tests__/catalog-search.test.ts +61 -0
package/src/__tests__/cli-command-risk-guard.test.ts +181 -6
package/src/__tests__/conversation-delete-schedule-cleanup.test.ts +396 -0
package/src/__tests__/conversation-error.test.ts +3 -2
package/src/__tests__/credential-security-invariants.test.ts +9 -15
package/src/__tests__/credential-vault-unit.test.ts +32 -34
package/src/__tests__/credential-vault.test.ts +25 -33
package/src/__tests__/credentials-cli.test.ts +3 -3
package/src/__tests__/daemon-credential-client.test.ts +2 -2
package/src/__tests__/first-greeting.test.ts +7 -0
package/src/__tests__/host-bash-proxy.test.ts +79 -0
package/src/__tests__/host-cu-proxy.test.ts +90 -0
package/src/__tests__/host-file-proxy.test.ts +89 -0
package/src/__tests__/integration-status.test.ts +5 -5
package/src/__tests__/list-messages-attachments.test.ts +171 -0
package/src/__tests__/mcp-abort-signal.test.ts +205 -0
package/src/__tests__/messaging-send-tool.test.ts +5 -5
package/src/__tests__/navigate-settings-tab.test.ts +6 -2
package/src/__tests__/notification-telegram-adapter.test.ts +125 -0
package/src/__tests__/oauth-cli.test.ts +126 -119
package/src/__tests__/oauth-provider-profiles.test.ts +55 -20
package/src/__tests__/oauth-scope-policy.test.ts +4 -6
package/src/__tests__/onboarding-template-contract.test.ts +2 -2
package/src/__tests__/platform.test.ts +3 -168
package/src/__tests__/secret-routes-managed-proxy.test.ts +78 -0
package/src/__tests__/secure-keys-managed-failover.test.ts +73 -0
package/src/__tests__/skill-feature-flags.test.ts +8 -0
package/src/__tests__/skill-secret-handling-guard.test.ts +212 -0
package/src/__tests__/skills-uninstall.test.ts +2 -2
package/src/__tests__/slack-messaging-token-resolution.test.ts +22 -24
package/src/__tests__/slack-share-routes.test.ts +5 -5
package/src/__tests__/system-prompt.test.ts +39 -0
package/src/__tests__/token-estimator-accuracy.benchmark.test.ts +1 -1
package/src/__tests__/workspace-migration-backfill-installation-id.test.ts +5 -4
package/src/cli/AGENTS.md +47 -7
package/src/cli/commands/browser-relay.ts +2 -17
package/src/cli/commands/contacts.ts +6 -4
package/src/cli/commands/conversations.ts +13 -1
package/src/cli/commands/credential-execution.ts +16 -1
package/src/cli/commands/credentials.ts +2 -8
package/src/cli/commands/oauth/__tests__/connect.test.ts +29 -108
package/src/cli/commands/oauth/__tests__/disconnect.test.ts +13 -87
package/src/cli/commands/oauth/__tests__/mode.test.ts +22 -69
package/src/cli/commands/oauth/__tests__/ping.test.ts +20 -79
package/src/cli/commands/oauth/__tests__/providers-delete.test.ts +574 -0
package/src/cli/commands/oauth/__tests__/providers-update.test.ts +416 -0
package/src/cli/commands/oauth/__tests__/status.test.ts +12 -40
package/src/cli/commands/oauth/__tests__/token.test.ts +3 -50
package/src/cli/commands/oauth/apps.ts +63 -44
package/src/cli/commands/oauth/connect.ts +187 -155
package/src/cli/commands/oauth/disconnect.ts +27 -75
package/src/cli/commands/oauth/index.ts +36 -46
package/src/cli/commands/oauth/mode.ts +22 -34
package/src/cli/commands/oauth/ping.ts +19 -45
package/src/cli/commands/oauth/providers.ts +569 -62
package/src/cli/commands/oauth/request.ts +36 -48
package/src/cli/commands/oauth/shared.ts +1 -19
package/src/cli/commands/oauth/status.ts +14 -25
package/src/cli/commands/oauth/token.ts +25 -34
package/src/cli/commands/platform/__tests__/connect.test.ts +224 -0
package/src/cli/commands/platform/__tests__/disconnect.test.ts +237 -0
package/src/cli/commands/platform/__tests__/status.test.ts +246 -0
package/src/cli/commands/platform/connect.ts +104 -0
package/src/cli/commands/platform/disconnect.ts +118 -0
package/src/cli/commands/{platform.ts → platform/index.ts} +108 -38
package/src/cli/commands/sequence.ts +5 -4
package/src/cli/commands/shotgun.ts +16 -0
package/src/cli/commands/skills.ts +173 -41
package/src/cli/commands/usage.ts +5 -11
package/src/cli/lib/daemon-credential-client.ts +22 -38
package/src/cli/program.ts +1 -1
package/src/config/assistant-feature-flags.ts +3 -7
package/src/config/bundled-skills/contacts/tools/google-contacts.ts +1 -1
package/src/config/bundled-skills/conversations/SKILL.md +20 -0
package/src/config/bundled-skills/conversations/TOOLS.json +23 -0
package/src/config/bundled-skills/conversations/tools/rename-conversation.ts +66 -0
package/src/config/bundled-skills/gmail/SKILL.md +13 -13
package/src/config/bundled-skills/gmail/tools/gmail-archive.ts +3 -3
package/src/config/bundled-skills/gmail/tools/gmail-attachments.ts +2 -2
package/src/config/bundled-skills/gmail/tools/gmail-draft.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-filters.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-follow-up.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-forward.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-label.ts +2 -2
package/src/config/bundled-skills/gmail/tools/gmail-outreach-scan.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-send-draft.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-sender-digest.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-trash.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-unsubscribe.ts +1 -1
package/src/config/bundled-skills/gmail/tools/gmail-vacation.ts +1 -1
package/src/config/bundled-skills/google-calendar/SKILL.md +10 -4
package/src/config/bundled-skills/google-calendar/tools/shared.ts +1 -1
package/src/config/bundled-skills/messaging/SKILL.md +7 -7
package/src/config/bundled-skills/messaging/tools/messaging-send.ts +5 -2
package/src/config/bundled-skills/messaging/tools/shared.ts +5 -6
package/src/config/bundled-skills/settings/TOOLS.json +5 -3
package/src/config/bundled-skills/settings/tools/navigate-settings-tab.ts +4 -2
package/src/config/bundled-tool-registry.ts +5 -0
package/src/config/feature-flag-registry.json +2 -2
package/src/credential-execution/client.ts +15 -3
package/src/daemon/conversation-agent-loop.ts +2 -0
package/src/daemon/conversation-error.ts +36 -6
package/src/daemon/conversation-messaging.ts +9 -0
package/src/daemon/conversation-runtime-assembly.ts +33 -0
package/src/daemon/conversation-surfaces.ts +120 -14
package/src/daemon/conversation.ts +5 -0
package/src/daemon/first-greeting.ts +6 -1
package/src/daemon/handlers/skills.ts +148 -3
package/src/daemon/host-bash-proxy.ts +16 -0
package/src/daemon/host-cu-proxy.ts +16 -0
package/src/daemon/host-file-proxy.ts +16 -0
package/src/daemon/lifecycle.ts +56 -5
package/src/daemon/message-types/conversations.ts +1 -0
package/src/daemon/message-types/guardian-actions.ts +2 -0
package/src/daemon/message-types/host-bash.ts +6 -1
package/src/daemon/message-types/host-cu.ts +6 -1
package/src/daemon/message-types/host-file.ts +6 -1
package/src/daemon/message-types/integrations.ts +0 -1
package/src/daemon/server.ts +29 -2
package/src/hooks/cli.ts +74 -0
package/src/inbound/platform-callback-registration.ts +7 -12
package/src/index.ts +0 -12
package/src/mcp/client.ts +6 -1
package/src/mcp/manager.ts +2 -1
package/src/memory/conversation-crud.ts +92 -3
package/src/memory/conversation-key-store.ts +26 -0
package/src/memory/conversation-queries.ts +6 -6
package/src/memory/db-init.ts +16 -0
package/src/memory/journal-memory.ts +8 -2
package/src/memory/migrations/196-messages-conversation-created-at-index.ts +9 -0
package/src/memory/migrations/196-strip-integration-prefix-from-provider-keys.ts +186 -0
package/src/memory/migrations/197-oauth-providers-behavior-columns.ts +29 -0
package/src/memory/migrations/198-drop-setup-skill-id-column.ts +11 -0
package/src/memory/migrations/index.ts +4 -0
package/src/memory/migrations/registry.ts +8 -0
package/src/memory/schema/oauth.ts +11 -0
package/src/messaging/provider.ts +13 -12
package/src/messaging/providers/gmail/adapter.ts +44 -35
package/src/messaging/providers/slack/adapter.ts +63 -33
package/src/messaging/providers/telegram-bot/adapter.ts +6 -8
package/src/messaging/providers/whatsapp/adapter.ts +6 -8
package/src/notifications/adapters/telegram.ts +78 -2
package/src/oauth/__tests__/identity-verifier.test.ts +464 -0
package/src/oauth/byo-connection.test.ts +22 -24
package/src/oauth/connect-orchestrator.ts +37 -76
package/src/oauth/connect-types.ts +7 -65
package/src/oauth/connection-resolver.test.ts +13 -13
package/src/oauth/connection-resolver.ts +3 -4
package/src/oauth/identity-verifier.ts +177 -0
package/src/oauth/oauth-store.ts +228 -3
package/src/oauth/platform-connection.test.ts +56 -6
package/src/oauth/platform-connection.ts +8 -1
package/src/oauth/seed-providers.ts +247 -34
package/src/permissions/checker.ts +127 -1
package/src/prompts/journal-context.ts +4 -1
package/src/prompts/system-prompt.ts +54 -9
package/src/prompts/templates/BOOTSTRAP.md +16 -5
package/src/providers/anthropic/client.ts +2 -33
package/src/runtime/guardian-action-service.ts +7 -2
package/src/runtime/http-server.ts +12 -18
package/src/runtime/http-types.ts +8 -1
package/src/runtime/migrations/rebind-secrets-screen.ts +2 -2
package/src/runtime/routes/conversation-management-routes.ts +31 -0
package/src/runtime/routes/conversation-routes.ts +79 -4
package/src/runtime/routes/guardian-action-routes.ts +15 -2
package/src/runtime/routes/inbound-stages/acl-enforcement.ts +21 -8
package/src/runtime/routes/integrations/slack/share.ts +1 -1
package/src/runtime/routes/oauth-apps.ts +2 -1
package/src/runtime/routes/secret-routes.ts +45 -15
package/src/runtime/routes/settings-routes.ts +12 -19
package/src/runtime/routes/skills-routes.ts +45 -4
package/src/schedule/integration-status.ts +2 -2
package/src/security/ces-rpc-credential-backend.ts +19 -16
package/src/security/oauth-completion-page.ts +153 -0
package/src/security/oauth2.ts +3 -17
package/src/security/secure-keys.ts +207 -7
package/src/security/token-manager.ts +3 -6
package/src/signals/bash.ts +6 -1
package/src/skills/catalog-cache.ts +44 -0
package/src/skills/catalog-search.ts +18 -0
package/src/tools/browser/browser-manager.ts +2 -2
package/src/tools/credentials/post-connect-hooks.ts +1 -1
package/src/tools/credentials/vault.ts +34 -45
package/src/tools/host-terminal/host-shell.ts +16 -3
package/src/tools/mcp/mcp-tool-factory.ts +2 -1
package/src/tools/skills/sandbox-runner.ts +16 -3
package/src/tools/terminal/shell.ts +16 -3
package/src/util/logger.ts +11 -1
package/src/util/platform.ts +1 -91
package/src/util/sentry-log-stream.ts +51 -0
package/src/watcher/providers/github.ts +2 -2
package/src/watcher/providers/gmail.ts +1 -1
package/src/watcher/providers/google-calendar.ts +1 -1
package/src/watcher/providers/linear.ts +2 -2
package/src/workspace/migrations/011-backfill-installation-id.ts +5 -3
package/src/workspace/migrations/020-rename-oauth-skill-dirs.ts +119 -0
package/src/workspace/migrations/registry.ts +2 -0
package/src/cli/commands/oauth/connections.ts +0 -255
package/src/oauth/provider-behaviors.ts +0 -634

package/src/security/oauth2.ts CHANGED Viewed

@@ -20,6 +20,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { createServer, type Server } from "node:http";
 import { getLogger } from "../util/logger.js";
+import { renderOAuthCompletionPage as renderLoopbackPage } from "./oauth-completion-page.js";
 const log = getLogger("oauth2");
@@ -359,7 +360,7 @@ function startLoopbackServerAndWaitForCode(
       res.writeHead(200, { "Content-Type": "text/html" });
       res.end(
         renderLoopbackPage(
-          "Authorization successful! You can close this tab.",
+          "You can close this tab and return to your assistant.",
           true,
         ),
       );
@@ -433,21 +434,6 @@ function startLoopbackServerAndWaitForCode(
   });
 }
-function escapeHtml(s: string): string {
-  return s
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-function renderLoopbackPage(message: string, success: boolean): string {
-  const title = success ? "Authorization Successful" : "Authorization Failed";
-  const color = success ? "#4CAF50" : "#f44336";
-  return `<!DOCTYPE html><html><head><title>${escapeHtml(title)}</title><style>body{font-family:system-ui,sans-serif;display:flex;justify-content:center;align-items:center;min-height:100vh;margin:0;background:#f5f5f5}div{text-align:center;padding:2rem;background:white;border-radius:8px;box-shadow:0 2px 4px rgba(0,0,0,0.1)}h1{color:${color}}</style></head><body><div><h1>${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p></div></body></html>`;
-}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -640,7 +626,7 @@ function startLoopbackServerForPreparedFlow(
       res.writeHead(200, { "Content-Type": "text/html" });
       res.end(
         renderLoopbackPage(
-          "Authorization successful! You can close this tab.",
+          "You can close this tab and return to your assistant.",
           true,
         ),
       );

package/src/security/secure-keys.ts CHANGED Viewed

@@ -5,13 +5,16 @@
  * Backend selection (`resolveBackendAsync`) is the single async decision point:
  *   1. CES RPC (primary) — injected via `setCesClient()`: delegates credential
  *      operations to the CES process over stdio RPC. This is the default path
- *      for all local modes (desktop app, dev, CLI).
+ *      for local modes and the managed bootstrap handshake path.
  *   2. CES HTTP — containerized mode (IS_CONTAINERIZED + CES_CREDENTIAL_URL):
- *      delegates to the CES sidecar over HTTP. Used in Docker/managed mode.
+ *      delegates to the CES sidecar over HTTP. Used in Docker/managed mode,
+ *      including failover when the bootstrap RPC transport dies later.
  *   3. Encrypted file store (fallback) — used when CES is unavailable.
  *
  * All operations (reads, writes, lists, deletes) go to exactly one backend.
- * There are no cross-backend fallbacks or merges.
+ * There are no cross-store fallbacks or merges. The only transport failover is
+ * CES RPC → CES HTTP in managed mode; both backends target the same CES
+ * sidecar and credential data.
  */
 import type {
@@ -56,12 +59,59 @@ let _encryptedStore: CredentialBackend | undefined;
 let _resolvedBackend: CredentialBackend | undefined;
 let _resolvePromise: Promise<CredentialBackend> | undefined;
+/**
+ * Optional callback that attempts to re-establish a CES connection when
+ * the current transport dies. Set by lifecycle.ts after initial CES startup.
+ * Returns a new CesClient on success, or undefined if reconnection failed.
+ */
+let _cesReconnect: (() => Promise<CesClient | undefined>) | undefined;
+/** Optional listener invoked whenever setCesClient() updates the client. */
+let _cesClientListener: ((client: CesClient | undefined) => void) | undefined;
+/** Epoch ms of the last reconnection attempt. Used for cooldown. */
+let _lastReconnectAttempt = 0;
+/** In-flight reconnection promise — concurrent callers share the same attempt. */
+let _reconnectInFlight: Promise<boolean> | undefined;
+/**
+ * Set to true when a ces-http operation returns an unreachable result.
+ * Triggers CES RPC reconnection on the next resolveBackendAsync() call so
+ * we don't keep routing to a dead HTTP endpoint. Cleared on reconnection or
+ * backend reset.
+ */
+let _cesHttpUnreachable = false;
+/** Minimum interval between CES reconnection attempts. */
+const RECONNECT_COOLDOWN_MS = 3_000;
 /** Inject a CES RPC client for credential routing. Resets the resolved backend. */
 export function setCesClient(client: CesClient | undefined): void {
   _cesClient = client;
   // Reset resolved backend so next call picks up CES
   _resolvedBackend = undefined;
   _resolvePromise = undefined;
+  _cesHttpUnreachable = false;
+  _cesClientListener?.(client);
+}
+/**
+ * Register a listener that is called whenever setCesClient() updates the
+ * CES client reference. Used by lifecycle.ts to keep DaemonServer in sync
+ * after a successful reconnection.
+ */
+export function onCesClientChanged(
+  fn: ((client: CesClient | undefined) => void) | undefined,
+): void {
+  _cesClientListener = fn;
+}
+/** Register a callback for reconnecting to CES when the transport dies. */
+export function setCesReconnect(
+  fn: (() => Promise<CesClient | undefined>) | undefined,
+): void {
+  _cesReconnect = fn;
 }
 function getEncryptedStoreBackend(): CredentialBackend {
@@ -77,17 +127,141 @@ function getEncryptedStoreBackend(): CredentialBackend {
  *   2. Containerized + CES_CREDENTIAL_URL → CES HTTP client (Docker/managed).
  *   3. Encrypted file store → fallback when CES is unavailable.
  *
- * Once resolved, the backend does not change during the process lifetime.
+ * Once resolved, the backend is cached. If it becomes unavailable (e.g. the
+ * CES transport dies), we attempt to reconnect via `_cesReconnect` rather
+ * than falling back to a different backend. In managed cloud mode CES is the
+ * primary credential source — falling back to the encrypted file store would
+ * silently serve stale or empty data.
+ *
+ * In managed mode, if the CES bootstrap RPC transport dies, we first fail
+ * over from CES RPC to the CES HTTP credential API exposed by the same
+ * sidecar. This avoids pinning credential reads to a dead bootstrap socket
+ * when the in-pod HTTP interface is still healthy.
+ *
+ * If HTTP failover is unavailable, we attempt CES RPC reconnection. When
+ * reconnection succeeds the cache is refreshed with the new client.
+ *
+ * If neither recovery path succeeds, the existing unavailable backend is
+ * returned — its methods short-circuit via `isAvailable()` guards and return
+ * `unreachable` results so callers can degrade gracefully.
+ *
+ * Additionally, if CES failed on initial startup (so the encrypted file
+ * store became the resolved backend) but the reconnection callback is
+ * registered, we periodically attempt to upgrade to CES — ensuring managed
+ * cloud deployments don't stay on the (potentially stale) file store.
+ *
  * Call `_resetBackend()` in tests to clear the cached resolution.
  */
 async function resolveBackendAsync(): Promise<CredentialBackend> {
-  if (_resolvedBackend) return _resolvedBackend;
+  if (_resolvedBackend) {
+    if (!_resolvedBackend.isAvailable()) {
+      const cesHttpFallback = tryFailoverToCesHttpBackend(_resolvedBackend);
+      if (cesHttpFallback) {
+        return cesHttpFallback;
+      }
+      // Backend is no longer reachable — attempt CES reconnection.
+      const reconnected = await attemptCesReconnection();
+      if (reconnected) {
+        // setCesClient() cleared the cache — fall through to re-resolve
+        // with the fresh client.
+      } else {
+        // Reconnection failed or on cooldown — return the existing (dead)
+        // backend. Its methods short-circuit via isAvailable() guards and
+        // return unreachable results. Callers like getProviderKeyAsync fall
+        // back to env vars, and embedding backend selection uses cached
+        // backends.
+        return _resolvedBackend;
+      }
+    } else if (
+      _cesReconnect &&
+      (_resolvedBackend.name === "encrypted-store" ||
+        (_resolvedBackend.name === "ces-http" && _cesHttpUnreachable))
+    ) {
+      // CES RPC is the preferred backend. Attempt to reconnect when:
+      // - We fell back to the encrypted store (CES startup failed), or
+      // - We're on ces-http but an operation returned unreachable (HTTP
+      //   endpoint is actually down even though isAvailable() returned true,
+      //   since it only checks env vars, not actual connectivity).
+      const reconnected = await attemptCesReconnection();
+      if (reconnected) {
+        // setCesClient() cleared the cache — fall through to re-resolve.
+      } else {
+        // Reconnection failed or on cooldown — continue with current backend.
+        return _resolvedBackend;
+      }
+    } else {
+      return _resolvedBackend;
+    }
+  }
   if (!_resolvePromise) {
     _resolvePromise = doResolveBackend();
   }
   return _resolvePromise;
 }
+function tryFailoverToCesHttpBackend(
+  backend: CredentialBackend,
+): CredentialBackend | undefined {
+  if (backend.name !== "ces-rpc") return undefined;
+  if (!getIsContainerized() || !process.env.CES_CREDENTIAL_URL) {
+    return undefined;
+  }
+  const cesHttp = createCesCredentialBackend();
+  if (!cesHttp.isAvailable()) return undefined;
+  _resolvedBackend = cesHttp;
+  _resolvePromise = undefined;
+  log.warn(
+    "CES RPC credential backend became unavailable — failing over to CES HTTP backend",
+  );
+  return cesHttp;
+}
+/**
+ * Try to re-establish a CES connection when the current transport has died.
+ * Returns true if reconnection succeeded (setCesClient was called with a
+ * new client), false otherwise.
+ *
+ * Concurrent callers share the same in-flight reconnection attempt to avoid
+ * racing on the same process manager. A timestamp cooldown prevents rapid
+ * back-to-back attempts after completion.
+ */
+async function attemptCesReconnection(): Promise<boolean> {
+  if (!_cesReconnect) return false;
+  // If a reconnection is already in flight, share it.
+  if (_reconnectInFlight) return _reconnectInFlight;
+  // Cooldown — don't retry immediately after a completed attempt.
+  if (Date.now() - _lastReconnectAttempt < RECONNECT_COOLDOWN_MS) return false;
+  _lastReconnectAttempt = Date.now();
+  log.warn("Credential backend unavailable — attempting CES reconnection");
+  _reconnectInFlight = (async () => {
+    try {
+      const newClient = await _cesReconnect!();
+      if (newClient) {
+        setCesClient(newClient);
+        log.info("CES reconnection successful — credential backend restored");
+        return true;
+      }
+      log.warn("CES reconnection returned no client");
+    } catch (err) {
+      log.warn({ err }, "CES reconnection failed");
+    }
+    return false;
+  })();
+  try {
+    return await _reconnectInFlight;
+  } finally {
+    _reconnectInFlight = undefined;
+  }
+}
 async function doResolveBackend(): Promise<CredentialBackend> {
   // 1. CES RPC — primary credential backend for all local modes
   if (_cesClient) {
@@ -119,6 +293,21 @@ async function doResolveBackend(): Promise<CredentialBackend> {
   return _resolvedBackend;
 }
+/**
+ * Update the ces-http reachability latch after any get/list operation.
+ * Sets `_cesHttpUnreachable = true` on failure so the next
+ * resolveBackendAsync() call triggers a CES RPC reconnection attempt.
+ * Clears it on success so a transient blip doesn't cause endless churn.
+ */
+function updateCesHttpReachability(
+  backend: CredentialBackend,
+  unreachable: boolean,
+): void {
+  if (backend.name === "ces-http") {
+    _cesHttpUnreachable = unreachable;
+  }
+}
 /**
  * List all account names from the resolved backend (async).
  *
@@ -126,7 +315,9 @@ async function doResolveBackend(): Promise<CredentialBackend> {
  */
 export async function listSecureKeysAsync(): Promise<CredentialListResult> {
   const backend = await resolveBackendAsync();
-  return backend.list();
+  const result = await backend.list();
+  updateCesHttpReachability(backend, result.unreachable);
+  return result;
 }
 // ---------------------------------------------------------------------------
@@ -147,6 +338,7 @@ export async function getSecureKeyResultAsync(
 ): Promise<SecureKeyResult> {
   const backend = await resolveBackendAsync();
   const result = await backend.get(account);
+  updateCesHttpReachability(backend, result.unreachable);
   if (result.value != null) {
     return { value: result.value, unreachable: false };
   }
@@ -180,6 +372,7 @@ export async function setSecureKeyAsync(
       "Credential backend set failed",
     );
   }
+  updateCesHttpReachability(backend, !ok);
   return ok;
 }
@@ -192,7 +385,9 @@ export async function deleteSecureKeyAsync(
   account: string,
 ): Promise<DeleteResult> {
   const backend = await resolveBackendAsync();
-  return backend.delete(account);
+  const result = await backend.delete(account);
+  updateCesHttpReachability(backend, result === "error");
+  return result;
 }
 // ---------------------------------------------------------------------------
@@ -264,4 +459,9 @@ export function _resetBackend(): void {
   _encryptedStore = undefined;
   _resolvedBackend = undefined;
   _resolvePromise = undefined;
+  _cesReconnect = undefined;
+  _cesClientListener = undefined;
+  _lastReconnectAttempt = 0;
+  _reconnectInFlight = undefined;
+  _cesHttpUnreachable = false;
 }

package/src/security/token-manager.ts CHANGED Viewed

@@ -35,16 +35,13 @@ import { getSecureKeyAsync, setSecureKeyAsync } from "./secure-keys.js";
 const log = getLogger("token-manager");
-const MESSAGING_SERVICES = new Set(["integration:google", "integration:slack"]);
+const MESSAGING_SERVICES = new Set(["google", "slack"]);
 function recoveryHint(service: string): string {
-  const shortName = service.startsWith("integration:")
-    ? service.slice("integration:".length)
-    : service;
   if (MESSAGING_SERVICES.has(service)) {
-    return ` Reconnect ${shortName} — follow the Error Recovery steps in the messaging skill. Do not present options or explain the error to the user.`;
+    return ` Reconnect ${service} — follow the Error Recovery steps in the messaging skill. Do not present options or explain the error to the user.`;
   }
-  return ` Re-authorization required for ${shortName}. Do not present options or explain the error to the user.`;
+  return ` Re-authorization required for ${service}. Do not present options or explain the error to the user.`;
 }
 // ── Shared circuit breaker & deduplication instances ──────────────────

package/src/signals/bash.ts CHANGED Viewed

@@ -138,11 +138,16 @@ export function handleBashSignal(filename: string): void {
   const child = spawn("bash", ["-c", command], {
     cwd: getWorkspaceDir(),
     stdio: ["ignore", "pipe", "pipe"],
+    detached: true,
   });
   const timer = setTimeout(() => {
     timedOut = true;
-    child.kill("SIGKILL");
+    try {
+      process.kill(-child.pid!, "SIGKILL");
+    } catch {
+      // Process group may have already exited.
+    }
   }, effectiveTimeout);
   child.stdout.on("data", (data: Buffer) => {

package/src/skills/catalog-cache.ts ADDED Viewed

@@ -0,0 +1,44 @@
+import { getLogger } from "../util/logger.js";
+import type { CatalogSkill } from "./catalog-install.js";
+import {
+  fetchCatalog,
+  getRepoSkillsDir,
+  readLocalCatalog,
+} from "./catalog-install.js";
+const log = getLogger("catalog-cache");
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+let cachedCatalog: CatalogSkill[] | null = null;
+let cacheTimestamp = 0;
+/** Resolve the Vellum catalog with in-memory caching. */
+export async function getCatalog(): Promise<CatalogSkill[]> {
+  if (cachedCatalog && Date.now() - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedCatalog;
+  }
+  const repoSkillsDir = getRepoSkillsDir();
+  let catalog: CatalogSkill[];
+  if (repoSkillsDir) {
+    catalog = readLocalCatalog(repoSkillsDir);
+  } else {
+    try {
+      catalog = await fetchCatalog();
+    } catch (err) {
+      log.warn(
+        { err },
+        "Failed to fetch Vellum catalog, using stale cache or empty",
+      );
+      return cachedCatalog ?? [];
+    }
+  }
+  cachedCatalog = catalog;
+  cacheTimestamp = Date.now();
+  return catalog;
+}
+/** Invalidate the cache (for testing or forced refresh). */
+export function invalidateCatalogCache(): void {
+  cachedCatalog = null;
+  cacheTimestamp = 0;
+}

package/src/skills/catalog-search.ts ADDED Viewed

@@ -0,0 +1,18 @@
+/**
+ * Shared catalog text-search helper.
+ *
+ * Both the CLI `skills search` command and the daemon `searchSkills` handler
+ * need case-insensitive substring matching across multiple fields. This module
+ * provides a single generic implementation to prevent the two from drifting.
+ */
+export function filterByQuery<T>(
+  items: T[],
+  query: string,
+  fields: ((item: T) => string)[],
+): T[] {
+  const lower = query.toLowerCase();
+  return items.filter((item) =>
+    fields.some((fn) => fn(item).toLowerCase().includes(lower)),
+  );
+}

package/src/tools/browser/browser-manager.ts CHANGED Viewed

@@ -242,13 +242,13 @@ class BrowserManager {
         if (!chromiumInstalled) {
           log.info("Chromium not installed, installing via playwright...");
           const proc = Bun.spawn(
-            ["bunx", "playwright", "install", "chromium"],
+            ["bunx", "playwright", "install", "--with-deps", "chromium"],
             {
               stdout: "pipe",
               stderr: "pipe",
             },
           );
-          const timeoutMs = 120_000;
+          const timeoutMs = 300_000;
           let timer: ReturnType<typeof setTimeout>;
           const exitCode = await Promise.race([
             proc.exited.finally(() => clearTimeout(timer)),

package/src/tools/credentials/post-connect-hooks.ts CHANGED Viewed

@@ -48,7 +48,7 @@ async function slackWelcomeDM(ctx: PostConnectHookContext): Promise<void> {
 // ---------------------------------------------------------------------------
 const POST_CONNECT_HOOKS: Record<string, PostConnectHook> = {
-  "integration:slack": slackWelcomeDM,
+  slack: slackWelcomeDM,
 };
 /**

package/src/tools/credentials/vault.ts CHANGED Viewed

@@ -11,12 +11,8 @@ import {
   getAppByProviderAndClientId,
   getMostRecentAppByProvider,
   getProvider,
+  listProviders,
 } from "../../oauth/oauth-store.js";
-import {
-  getProviderBehavior,
-  resolveService,
-  SERVICE_ALIASES,
-} from "../../oauth/provider-behaviors.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import { buildAssistantEvent } from "../../runtime/assistant-event.js";
@@ -103,11 +99,11 @@ class CredentialStoreTool implements Tool {
               "describe",
             ],
             description:
-              'The operation to perform. Use "prompt" to ask the user for a secret via secure UI - the value never enters the conversation. Use "oauth2_connect" to connect an OAuth2 service via browser authorization. Use "describe" to get setup metadata for a well-known OAuth service (dashboard URL, scopes, redirect URI, etc.). For well-known services (gmail, slack), only the service name is required - endpoints, scopes, and stored client credentials are resolved automatically.',
+              'The operation to perform. Use "prompt" to ask the user for a secret via secure UI - the value never enters the conversation. Use "oauth2_connect" to connect an OAuth2 service via browser authorization. Use "describe" to get setup metadata for a well-known OAuth service (dashboard URL, scopes, redirect URI, etc.). For well-known services (google, slack), only the service name is required - endpoints, scopes, and stored client credentials are resolved automatically.',
           },
           service: {
             type: "string",
-            description: "Service name, e.g. gmail, github",
+            description: "Service name, e.g. google, github",
           },
           account: {
             type: "string",
@@ -158,7 +154,7 @@ class CredentialStoreTool implements Tool {
             type: "array",
             items: { type: "string" },
             description:
-              "OAuth2 scopes to request (only for oauth2_connect action). Auto-filled for well-known services (gmail, slack).",
+              "OAuth2 scopes to request (only for oauth2_connect action). Auto-filled for well-known services (google, slack).",
           },
           client_id: {
             type: "string",
@@ -822,18 +818,13 @@ class CredentialStoreTool implements Tool {
       }
       case "oauth2_connect": {
-        const rawService = input.service as string | undefined;
-        if (!rawService)
+        const service = input.service as string | undefined;
+        if (!service)
           return {
             content: "Error: service is required for oauth2_connect action",
             isError: true,
           };
-        // Resolve aliases (e.g. "gmail" → "integration:google")
-        const service = resolveService(rawService);
-        // Code-side behavioral fields (identityVerifier, setup, etc.)
-        const behavior = getProviderBehavior(service);
         // Protocol-level config from the DB (authUrl, tokenUrl, scopes, etc.)
         const providerRow = getProvider(service);
@@ -880,16 +871,10 @@ class CredentialStoreTool implements Tool {
         // Fail early when client_secret is required but missing - guide the
         // agent to collect it from the user rather than letting it improvise
         // browser-automation workarounds that inevitably fail.
-        const requiresSecret =
-          behavior?.setup?.requiresClientSecret ??
-          !!(providerRow.tokenEndpointAuthMethod || providerRow.extraParams);
+        const requiresSecret = !!providerRow.requiresClientSecret;
         if (requiresSecret && !clientSecret) {
-          const skillId = behavior?.setupSkillId;
-          const skillHint = skillId
-            ? `\n\nLoad the "${skillId}" skill for provider-specific instructions on obtaining the client secret.`
-            : '\n\nUse credential_store with action "prompt" to securely collect the client_secret from the user before calling oauth2_connect again.';
           return {
-            content: `Error: client_secret is required for ${rawService} but not found in the vault.${skillHint}`,
+            content: `Error: client_secret is required for ${service} but not found in the vault.\n\nUse credential_store with action "prompt" to securely collect the client_secret from the user before calling oauth2_connect again.`,
             isError: true,
           };
         }
@@ -897,7 +882,7 @@ class CredentialStoreTool implements Tool {
         // Delegate to the shared orchestrator - it resolves authUrl, tokenUrl,
         // extraParams, userinfoUrl, and tokenEndpointAuthMethod from the DB.
         const result = await orchestrateOAuthConnect({
-          service: rawService,
+          service,
           clientId,
           clientSecret,
           isInteractive: !!context.isInteractive,
@@ -949,7 +934,7 @@ class CredentialStoreTool implements Tool {
         if (result.deferred) {
           return {
-            content: `To connect ${rawService}, open this link and authorize access:\n\n${result.authUrl}\n\nOnce you authorize, the connection will be set up automatically. You can verify by asking me to check your inbox.`,
+            content: `To connect ${service}, open this link and authorize access:\n\n${result.authUrl}\n\nOnce you authorize, the connection will be set up automatically. You can verify by asking me to check your inbox.`,
             isError: false,
           };
         }
@@ -963,34 +948,30 @@ class CredentialStoreTool implements Tool {
       }
       case "describe": {
-        const rawService = (input.service as string | undefined) ?? "";
-        if (!rawService) {
+        const descService = (input.service as string | undefined) ?? "";
+        if (!descService) {
           return {
             content: "Error: service is required for describe action",
             isError: true,
           };
         }
-        const resolvedService = resolveService(rawService);
-        const descProviderRow = getProvider(resolvedService);
+        const descProviderRow = getProvider(descService);
         if (!descProviderRow) {
+          const availableServices = listProviders().map((p) => p.providerKey);
           return {
-            content: `No well-known OAuth config found for "${rawService}". Available services: ${Object.keys(
-              SERVICE_ALIASES,
-            ).join(", ")}`,
+            content: `No well-known OAuth config found for "${descService}". Available services: ${availableServices.join(", ")}`,
             isError: false,
           };
         }
-        const descBehavior = getProviderBehavior(resolvedService);
         // Compute the redirect URI based on callback transport
         let redirectUri: string;
         const transport =
           (descProviderRow.callbackTransport as
             | "loopback"
             | "gateway"
-            | null) ?? "gateway";
-        const loopbackPort = descBehavior?.loopbackPort;
+            | null) ?? "loopback";
+        const loopbackPort = descProviderRow.loopbackPort;
         if (transport === "loopback" && loopbackPort) {
           redirectUri = `http://localhost:${loopbackPort}/oauth/callback`;
         } else if (transport === "loopback") {
@@ -1010,20 +991,14 @@ class CredentialStoreTool implements Tool {
           }
         }
-        // Prefer explicit setup metadata, fall back to heuristic
-        const requiresClientSecret =
-          descBehavior?.setup?.requiresClientSecret ??
-          !!(
-            descProviderRow.tokenEndpointAuthMethod ||
-            descProviderRow.extraParams
-          );
+        const requiresClientSecret = !!descProviderRow.requiresClientSecret;
         const descDefaultScopes: string[] = descProviderRow.defaultScopes
           ? JSON.parse(descProviderRow.defaultScopes)
           : [];
         const info: Record<string, unknown> = {
-          service: resolvedService,
+          service: descService,
           authUrl: descProviderRow.authUrl,
           tokenUrl: descProviderRow.tokenUrl,
           scopes: descDefaultScopes,
@@ -1031,7 +1006,21 @@ class CredentialStoreTool implements Tool {
           redirectUri,
           requiresClientSecret,
         };
-        if (descBehavior?.setup) info.setup = descBehavior.setup;
+        if (
+          descProviderRow.displayName &&
+          descProviderRow.dashboardUrl &&
+          descProviderRow.appType
+        ) {
+          info.setup = {
+            displayName: descProviderRow.displayName,
+            dashboardUrl: descProviderRow.dashboardUrl,
+            appType: descProviderRow.appType,
+            requiresClientSecret: !!descProviderRow.requiresClientSecret,
+            ...(descProviderRow.setupNotes
+              ? { notes: JSON.parse(descProviderRow.setupNotes) }
+              : {}),
+          };
+        }
         if (descProviderRow.extraParams) {
           try {
             info.extraParams = JSON.parse(descProviderRow.extraParams);