@vellumai/assistant 0.6.5 → 0.7.0

package/src/daemon/handlers/conversations.ts

@@ -1,12 +1,10 @@
 import { v4 as uuid } from "uuid";
 
-import { getConfig } from "../../config/loader.js";
 import {
   createCanonicalGuardianRequest,
   generateCanonicalRequestCode,
 } from "../../memory/canonical-guardian-store.js";
 import {
-  batchSetDisplayOrders,
   clearAll,
   getConversation,
   updateConversationTitle,
@@ -19,16 +17,17 @@ import { summarizeToolInput } from "../../tools/tool-input-summary.js";
 import { createAbortReason } from "../../util/abort-reasons.js";
 import { truncate } from "../../util/truncate.js";
 import type { Conversation } from "../conversation.js";
+import {
+  clearAllActiveConversations,
+  conversationEntries,
+  findConversation,
+  getOrCreateConversation,
+  touchConversation,
+} from "../conversation-store.js";
 import type {
   ConfirmationResponse,
-  ConversationRenameRequest,
-  ConversationSwitchRequest,
-  DeleteQueuedMessage,
-  ReorderConversationsRequest,
   SecretResponse,
   ServerMessage,
-  UndoRequest,
-  UsageRequest,
 } from "../message-protocol.js";
 import { normalizeConversationType } from "../message-protocol.js";
 import {
@@ -66,7 +65,6 @@ export function makeEventSender(params: {
             allowlistOptions: event.allowlistOptions,
             scopeOptions: event.scopeOptions,
             persistentDecisionsAllowed: event.persistentDecisionsAllowed,
-            temporaryOptionsAvailable: event.temporaryOptionsAvailable,
           },
         });
 
@@ -148,14 +146,9 @@ export function handleConfirmationResponse(
   // Route by requestId to the conversation that originated the prompt, not by
   // the current conversation binding which may have changed since the
   // request was issued (e.g. after a conversation switch).
-  // Normalize legacy decision: older clients may still send
-  // "always_allow_high_risk" via WebSocket for high-risk prompts.
-  const decision =
-    msg.decision === ("always_allow_high_risk" as typeof msg.decision)
-      ? "always_allow"
-      : msg.decision;
+  const decision = msg.decision;
 
-  for (const [conversationId, conversation] of ctx.conversations) {
+  for (const [conversationId, conversation] of conversationEntries()) {
     if (conversation.hasPendingConfirmation(msg.requestId)) {
       ctx.touchConversation(conversationId);
       conversation.handleConfirmationResponse(
@@ -198,7 +191,7 @@ export function handleSecretResponse(
   // Route by requestId to the conversation that originated the prompt, not by
   // the current conversation binding which may have changed since the
   // request was issued (e.g. after a conversation switch).
-  for (const [conversationId, conversation] of ctx.conversations) {
+  for (const [conversationId, conversation] of conversationEntries()) {
     if (conversation.hasPendingSecret(msg.requestId)) {
       ctx.touchConversation(conversationId);
       conversation.handleSecretResponse(msg.requestId, msg.value, msg.delivery);
@@ -215,8 +208,8 @@ export function handleSecretResponse(
 /**
  * Clear all conversations and DB conversations. Returns the number of conversations cleared.
  */
-export function clearAllConversations(ctx: HandlerContext): number {
-  const cleared = ctx.clearAllConversations();
+export function clearAllConversations(): number {
+  const cleared = clearAllActiveConversations();
   // Also clear DB conversations. When a new local connection triggers
   // sendInitialConversation, it auto-creates a conversation if none exist.
   // Without this DB clear, that auto-created row survives, contradicting
@@ -231,60 +224,27 @@ export function clearAllConversations(ctx: HandlerContext): number {
  */
 export async function switchConversation(
   conversationId: string,
-  ctx: HandlerContext,
 ): Promise<{
   conversationId: string;
   title: string;
   conversationType: ReturnType<typeof normalizeConversationType>;
-  hostAccess: boolean;
+  inferenceProfile?: string;
 } | null> {
   const conversation = getConversation(conversationId);
   if (!conversation) {
     return null;
   }
 
-  // If the target conversation is headless-locked (actively executing a task run),
-  // skip rebinding so tool confirmations stay suppressed.
-  const existingConversation = ctx.conversations.get(conversationId);
-  const isHeadlessLocked = existingConversation?.headlessLock;
-
-  if (isHeadlessLocked) {
-    // Load the conversation without rebinding the client — the conversation stays headless
-    await ctx.getOrCreateConversation(conversationId);
-  } else {
-    await ctx.getOrCreateConversation(conversationId);
-  }
+  // Restore evicted conversations from the database when needed.
+  await getOrCreateConversation(conversationId);
 
   return {
     conversationId: conversation.id,
     title: conversation.title ?? "Untitled",
     conversationType: normalizeConversationType(conversation.conversationType),
-    hostAccess: conversation.hostAccess === 1,
+    inferenceProfile: conversation.inferenceProfile ?? undefined,
   };
 }
-
-export async function handleConversationSwitch(
-  msg: ConversationSwitchRequest,
-  ctx: HandlerContext,
-): Promise<void> {
-  const result = await switchConversation(msg.conversationId, ctx);
-  if (!result) {
-    ctx.send({
-      type: "error",
-      message: `Conversation ${msg.conversationId} not found`,
-    });
-    return;
-  }
-
-  ctx.send({
-    type: "conversation_info",
-    conversationId: result.conversationId,
-    title: result.title,
-    conversationType: result.conversationType,
-    hostAccess: result.hostAccess,
-  });
-}
-
 /**
  * Rename a conversation. Returns true on success, false if not found.
  */
@@ -300,37 +260,17 @@ export function renameConversation(
   return true;
 }
 
-export function handleConversationRename(
-  msg: ConversationRenameRequest,
-  ctx: HandlerContext,
-): void {
-  const success = renameConversation(msg.conversationId, msg.title);
-  if (!success) {
-    ctx.send({
-      type: "error",
-      message: `Conversation ${msg.conversationId} not found`,
-    });
-    return;
-  }
-  ctx.send({
-    type: "conversation_title_updated",
-    conversationId: msg.conversationId,
-    title: msg.title,
-  });
-}
-
 /**
  * Cancel generation for a conversation. Returns true if a conversation was found and cancelled.
  */
 export function cancelGeneration(
   conversationId: string,
-  ctx: HandlerContext,
 ): boolean {
-  const conversation = ctx.conversations.get(conversationId);
+  const conversation = findConversation(conversationId);
   if (!conversation) {
     return false;
   }
-  ctx.touchConversation(conversationId);
+  touchConversation(conversationId);
   conversation.abort(
     createAbortReason("user_cancel", "cancelGeneration", conversationId),
   );
@@ -348,35 +288,17 @@ export function cancelGeneration(
  */
 export async function undoLastMessage(
   conversationId: string,
-  ctx: HandlerContext,
 ): Promise<{ removedCount: number } | null> {
   const resolvedId = resolveConversationId(conversationId);
   if (!resolvedId) {
     return null;
   }
   conversationId = resolvedId;
-  const conversation = await ctx.getOrCreateConversation(conversationId);
-  ctx.touchConversation(conversationId);
+  const conversation = await getOrCreateConversation(conversationId);
+  touchConversation(conversationId);
   const removedCount = conversation.undo();
   return { removedCount };
 }
-
-export async function handleUndo(
-  msg: UndoRequest,
-  ctx: HandlerContext,
-): Promise<void> {
-  const result = await undoLastMessage(msg.conversationId, ctx);
-  if (!result) {
-    ctx.send({ type: "error", message: "No active conversation" });
-    return;
-  }
-  ctx.send({
-    type: "undo_complete",
-    removedCount: result.removedCount,
-    conversationId: msg.conversationId,
-  });
-}
-
 /**
  * Regenerate the last assistant response for a conversation. The caller provides
  * a `sendEvent` callback for delivering streaming events via HTTP/SSE.
@@ -385,7 +307,6 @@ export async function handleUndo(
  */
 export async function regenerateResponse(
   conversationId: string,
-  ctx: HandlerContext,
   sendEvent: (event: ServerMessage) => void,
 ): Promise<{ requestId: string } | null> {
   // The caller may pass a conversation key (e.g. the macOS client's local
@@ -396,8 +317,8 @@ export async function regenerateResponse(
     return null;
   }
   conversationId = resolvedId;
-  const conversation = await ctx.getOrCreateConversation(conversationId);
-  ctx.touchConversation(conversationId);
+  const conversation = await getOrCreateConversation(conversationId);
+  touchConversation(conversationId);
   conversation.updateClient(sendEvent, false);
   const requestId = uuid();
   conversation.traceEmitter.emit("request_received", "Regenerate requested", {
@@ -426,26 +347,6 @@ export async function regenerateResponse(
   }
   return { requestId };
 }
-
-export function handleUsageRequest(
-  msg: UsageRequest,
-  ctx: HandlerContext,
-): void {
-  const conversation = getConversation(msg.conversationId);
-  if (!conversation) {
-    ctx.send({ type: "error", message: "No active conversation" });
-    return;
-  }
-  const config = getConfig();
-  ctx.send({
-    type: "usage_response",
-    totalInputTokens: conversation.totalInputTokens,
-    totalOutputTokens: conversation.totalOutputTokens,
-    estimatedCost: conversation.totalEstimatedCost,
-    model: config.llm.default.model,
-  });
-}
-
 // ---------------------------------------------------------------------------
 // Shared business logic (transport-agnostic)
 // ---------------------------------------------------------------------------
@@ -457,9 +358,6 @@ export function handleUsageRequest(
 export function deleteQueuedMessage(
   conversationId: string,
   requestId: string,
-  findConversation: (
-    id: string,
-  ) => { removeQueuedMessage(requestId: string): boolean } | undefined,
 ):
   | { removed: true }
   | { removed: false; reason: "conversation_not_found" | "message_not_found" } {
@@ -485,35 +383,3 @@ export function deleteQueuedMessage(
 // ---------------------------------------------------------------------------
 // HTTP handler (delegates to shared logic)
 // ---------------------------------------------------------------------------
-
-export function handleDeleteQueuedMessage(
-  msg: DeleteQueuedMessage,
-  ctx: HandlerContext,
-): void {
-  const result = deleteQueuedMessage(msg.conversationId, msg.requestId, (id) =>
-    ctx.conversations.get(id),
-  );
-  if (result.removed) {
-    ctx.send({
-      type: "message_queued_deleted",
-      conversationId: msg.conversationId,
-      requestId: msg.requestId,
-    });
-  }
-}
-
-export function handleReorderConversations(
-  msg: ReorderConversationsRequest,
-  _ctx: HandlerContext,
-): void {
-  if (!Array.isArray(msg.updates)) {
-    return;
-  }
-  batchSetDisplayOrders(
-    msg.updates.map((u) => ({
-      id: u.conversationId,
-      displayOrder: u.displayOrder ?? null,
-      isPinned: u.isPinned ?? false,
-    })),
-  );
-}

package/src/daemon/handlers/recording.ts

@@ -443,7 +443,7 @@ function cleanupMaps(
  * Includes an idempotency guard so the same recording cannot be finalized
  * twice (prevents double-finalization during restart races).
  */
-export async function finalizeAndPublishRecording(params: {
+async function finalizeAndPublishRecording(params: {
   recordingId: string;
   conversationId: string;
   filePath?: string;

package/src/daemon/handlers/shared.ts

@@ -1,8 +1,8 @@
 import { v4 as uuid } from "uuid";
 
+import { broadcastToAllClients } from "../../acp/index.js";
 import { getConfig } from "../../config/loader.js";
 import type { LLMCallSite, Speed } from "../../config/schemas/llm.js";
-import type { HeartbeatService } from "../../heartbeat/heartbeat-service.js";
 import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
 import { isPlaceholderSentinelText } from "../../providers/anthropic/client.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
@@ -10,11 +10,11 @@ import type { DebouncerMap } from "../../util/debounce.js";
 import { getLogger } from "../../util/logger.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
 import { Conversation } from "../conversation.js";
-import type { TrustContext } from "../conversation-runtime-assembly.js";
 import type {
   ConversationTransportMetadata,
   ServerMessage,
 } from "../message-protocol.js";
+import type { TrustContext } from "../trust-context.js";
 
 const log = getLogger("handlers");
 
@@ -44,17 +44,7 @@ interface PendingSigningResolve {
   reject: (err: Error) => void;
   timer: ReturnType<typeof setTimeout>;
 }
-export const pendingSignBundlePayload = new Map<
-  string,
-  PendingSigningResolve
->();
-
-interface PendingIdentityResolve {
-  resolve: (result: { keyId: string; publicKey: string }) => void;
-  reject: (err: Error) => void;
-  timer: ReturnType<typeof setTimeout>;
-}
-export const pendingSigningIdentity = new Map<string, PendingIdentityResolve>();
+const pendingSignBundlePayload = new Map<string, PendingSigningResolve>();
 
 export interface HistoryToolCall {
   name: string;
@@ -73,6 +63,12 @@ export interface HistoryToolCall {
   confirmationDecision?: string;
   /** Friendly label for the confirmation (e.g. "Edit File", "Run Command"). */
   confirmationLabel?: string;
+  /** Risk level classification at invocation time ("low" | "medium" | "high" | "unknown"). */
+  riskLevel?: string;
+  /** Human-readable reason for the risk classification. */
+  riskReason?: string;
+  /** Whether the tool was auto-approved (true) or required explicit user input (false). */
+  autoApproved?: boolean;
 }
 
 export interface HistorySurface {
@@ -138,8 +134,6 @@ export interface ConversationCreateOptions {
   /** Whether this turn can block on interactive approval prompts. */
   isInteractive?: boolean;
   memoryScopeId?: string;
-  isPrivateConversation?: boolean;
-  strictPrivateSideEffects?: boolean;
   /** Channel command intent metadata (e.g. Telegram /start). */
   commandIntent?: { type: string; payload?: string; languageCode?: string };
   /** Optional callback to receive real-time agent loop events (text deltas, tool starts, etc.). */
@@ -171,7 +165,6 @@ export interface ConversationCreateOptions {
  * Keeps handlers decoupled from the server class itself.
  */
 export interface HandlerContext {
-  conversations: Map<string, Conversation>;
   sharedRequestTimestamps: number[];
   debounceTimers: DebouncerMap;
   suppressConfigReload: boolean;
@@ -186,15 +179,13 @@ export interface HandlerContext {
   ): Promise<Conversation>;
   /** Refresh the eviction timestamp for a conversation that was accessed directly. */
   touchConversation(conversationId: string): void;
-  /** Optional heartbeat service reference for "Run Now" support. */
-  heartbeatService?: HeartbeatService;
 }
 
-export function isRecord(value: unknown): value is Record<string, unknown> {
+function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value != null;
 }
 
-export function formatBytes(sizeBytes: number): string {
+function formatBytes(sizeBytes: number): string {
   if (sizeBytes < 1024) return `${sizeBytes} B`;
   const kb = sizeBytes / 1024;
   if (kb < 1024) return `${kb.toFixed(1)} KB`;
@@ -390,6 +381,12 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
         entry.confirmationDecision = block._confirmationDecision;
       if (typeof block._confirmationLabel === "string")
         entry.confirmationLabel = block._confirmationLabel;
+      if (typeof block._riskLevel === "string")
+        entry.riskLevel = block._riskLevel;
+      if (typeof block._riskReason === "string")
+        entry.riskReason = block._riskReason;
+      if (typeof block._autoApproved === "boolean")
+        entry.autoApproved = block._autoApproved;
       toolCalls.push(entry);
       if (id) pendingToolUses.set(id, entry);
       contentOrder.push(`tool:${toolCalls.length - 1}`);
@@ -533,21 +530,23 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
 
 /**
  * Send a `secret_request` to the client and wait for the response,
- * outside of a conversation context (e.g. from handler-level code like publish_page).
+ * outside of a conversation context (e.g. from IPC routes like
+ * credentials/prompt).
  */
-export function requestSecretStandalone(
-  ctx: HandlerContext,
-  params: {
-    service: string;
-    field: string;
-    label: string;
-    description?: string;
-    placeholder?: string;
-    purpose?: string;
-    allowedTools?: string[];
-    allowedDomains?: string[];
-  },
-): Promise<SecretPromptResult> {
+export function requestSecretStandalone(params: {
+  service: string;
+  field: string;
+  label: string;
+  description?: string;
+  placeholder?: string;
+  purpose?: string;
+  allowedTools?: string[];
+  allowedDomains?: string[];
+}): Promise<SecretPromptResult> {
+  const broadcast = broadcastToAllClients;
+  if (!broadcast) {
+    return Promise.resolve({ value: null, delivery: "store" });
+  }
   const requestId = uuid();
   const config = getConfig();
   return new Promise((resolve) => {
@@ -556,7 +555,7 @@ export function requestSecretStandalone(
       resolve({ value: null, delivery: "store" });
     }, config.timeouts.permissionTimeoutSec * 1000);
     pendingStandaloneSecrets.set(requestId, { resolve, timer });
-    ctx.send({
+    broadcast({
       type: "secret_request",
       requestId,
       service: params.service,

package/src/daemon/handlers/skills.ts

@@ -81,6 +81,7 @@ import {
   type SkillAuditData,
 } from "../../skills/skillssh-registry.js";
 import { getWorkspaceSkillsDir } from "../../util/platform.js";
+import { maybeSeedMemoryV2Skills } from "../memory-v2-startup.js";
 import type {
   SkillDetailResponse,
   SkillFileContentResponse,
@@ -295,7 +296,7 @@ function saveConfigWithSuppression(
  * NOT used for bundled skills — those have a simpler inline path in
  * `installSkill()` that only auto-enables, broadcasts, and seeds memories.
  */
-export function postInstallSkill(
+function postInstallSkill(
   skillId: string,
   _skillDir: string,
   ctx: SkillOperationContext,
@@ -319,6 +320,7 @@ export function postInstallSkill(
 
   // Seed skill memories
   seedSkillGraphNodes();
+  maybeSeedMemoryV2Skills(getConfig());
   void seedUninstalledCatalogSkillMemories().catch(() => {});
 }
 
@@ -326,10 +328,14 @@ export function postInstallSkill(
 
 /** Map the old `source` field to the new `kind` axis. */
 function deriveKind(
-  source: "bundled" | "managed" | "workspace" | "extra" | "catalog",
+  source: "bundled" | "managed" | "workspace" | "extra" | "catalog" | "plugin",
 ): SlimSkillResponse["kind"] {
   if (source === "bundled") return "bundled";
   if (source === "catalog") return "catalog";
+  // Plugin-contributed skills are framework-provided like bundled skills —
+  // expose them under the same "bundled" kind so the UI doesn't invent a
+  // new category that existing clients don't know how to render.
+  if (source === "plugin") return "bundled";
   return "installed"; // managed, workspace, extra
 }
 
@@ -348,13 +354,6 @@ function deriveOrigin(
   return meta?.origin ?? "custom";
 }
 
-/** Sort rank by kind: bundled first, then catalog, then installed. */
-function kindSortRank(kind: SlimSkillResponse["kind"]): number {
-  if (kind === "bundled") return 0;
-  if (kind === "catalog") return 1;
-  return 2; // installed
-}
-
 /** Convert a resolved skill to a SlimSkillResponse. */
 function toSlimSkillResponse(
   summary: SkillSummary,
@@ -421,12 +420,9 @@ export function listSkills(_ctx: SkillOperationContext): SlimSkillResponse[] {
 
   const items = resolved.map((r) => toSlimSkillResponse(r.summary, r.state));
 
-  // Sort by kind rank, then alphabetical by name within each tier.
-  items.sort((a, b) => {
-    const rankDiff = kindSortRank(a.kind) - kindSortRank(b.kind);
-    if (rankDiff !== 0) return rankDiff;
-    return a.name.localeCompare(b.name);
-  });
+  // Alphabetical by name — kind/source is a property on each skill, not a
+  // grouping axis. Keeps output stable as the catalog grows.
+  items.sort((a, b) => a.name.localeCompare(b.name));
 
   return items;
 }
@@ -435,7 +431,7 @@ export function listSkills(_ctx: SkillOperationContext): SlimSkillResponse[] {
  * List installed skills merged with available catalog skills.
  * Installed skills take precedence when deduplicating by ID.
  */
-export async function listSkillsWithCatalog(
+async function listSkillsWithCatalog(
   ctx: SkillOperationContext,
 ): Promise<SlimSkillResponse[]> {
   const installed = listSkills(ctx);
@@ -457,12 +453,8 @@ export async function listSkillsWithCatalog(
 
   const merged = [...installed, ...available];
 
-  // Sort by kind rank, then alphabetical by name
-  merged.sort((a, b) => {
-    const rankDiff = kindSortRank(a.kind) - kindSortRank(b.kind);
-    if (rankDiff !== 0) return rankDiff;
-    return a.name.localeCompare(b.name);
-  });
+  // Alphabetical by name — kind is a property on each skill, not a grouping axis.
+  merged.sort((a, b) => a.name.localeCompare(b.name));
 
   return merged;
 }
@@ -478,7 +470,7 @@ export interface SkillListFilter {
 }
 
 /** Human-readable labels matching Swift's `sourceLabel`. */
-export function originDisplayLabel(origin: string): string {
+function originDisplayLabel(origin: string): string {
   switch (origin) {
     case "vellum":
       return "Vellum";
@@ -494,7 +486,7 @@ export function originDisplayLabel(origin: string): string {
 }
 
 /** Check if a skill's origin matches a text query (matching Swift logic). */
-export function originMatchesQuery(origin: string, query: string): boolean {
+function originMatchesQuery(origin: string, query: string): boolean {
   const label = originDisplayLabel(origin).toLowerCase();
   if (label.includes(query)) return true;
   // "community" umbrella matches clawhub and skillssh
@@ -996,6 +988,7 @@ export function enableSkill(
       state: "enabled",
     });
     seedSkillGraphNodes();
+    maybeSeedMemoryV2Skills(getConfig());
     void seedUninstalledCatalogSkillMemories().catch(() => {});
     return { success: true };
   } catch (err) {
@@ -1019,6 +1012,7 @@ export function disableSkill(
       state: "disabled",
     });
     seedSkillGraphNodes();
+    maybeSeedMemoryV2Skills(getConfig());
     void seedUninstalledCatalogSkillMemories().catch(() => {});
     return { success: true };
   } catch (err) {
@@ -1114,6 +1108,7 @@ export async function installSkill(
         );
       }
       seedSkillGraphNodes();
+      maybeSeedMemoryV2Skills(config);
       void seedUninstalledCatalogSkillMemories().catch(() => {});
       return { success: true, skillId: spec.slug };
     }
@@ -1688,6 +1683,7 @@ export async function createSkill(
     }
 
     seedSkillGraphNodes();
+    maybeSeedMemoryV2Skills(getConfig());
     void seedUninstalledCatalogSkillMemories().catch(() => {});
     return { success: true };
   } catch (err) {