@vellumai/assistant 0.6.5 → 0.7.0

package/src/tools/types.ts

@@ -1,89 +1,144 @@
-import type { ApprovalRequired } from "@vellumai/ces-contracts";
+import type { ApprovalRequired } from "@vellumai/service-contracts/credential-rpc";
+import type {
+  DiffInfo,
+  ExecutionTarget,
+  ProxyApprovalCallback,
+  RiskLevel,
+  SensitiveOutputBinding,
+  ToolDefinition,
+  ToolExecutionErrorEvent,
+  ToolExecutionStartEvent,
+  ToolPermissionDeniedEvent,
+  ToolPermissionPromptEvent,
+  ToolSecretDetectedEvent,
+} from "@vellumai/skill-host-contracts";
 
 import type { InterfaceId } from "../channels/types.js";
 import type { CesClient } from "../credential-execution/client.js";
+import type { HostBashProxy } from "../daemon/host-bash-proxy.js";
+import type { HostBrowserProxy } from "../daemon/host-browser-proxy.js";
+import type { HostFileProxy } from "../daemon/host-file-proxy.js";
+import type { HostTransferProxy } from "../daemon/host-transfer-proxy.js";
 import type { SecretPromptResult } from "../permissions/secret-prompter.js";
-import type {
-  AllowlistOption,
-  RiskLevel,
-  ScopeOption,
-} from "../permissions/types.js";
-import type { ContentBlock, ToolDefinition } from "../providers/types.js";
+import type { ContentBlock } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
-import type { SensitiveOutputBinding } from "./sensitive-output-placeholders.js";
 
-export type ExecutionTarget = "sandbox" | "host";
+// ---------------------------------------------------------------------------
+// Re-exports + concrete overlays for types that live in
+// @vellumai/skill-host-contracts.
+//
+// The canonical declarations moved into the neutral contracts package as
+// part of the skill-isolation work. This file preserves existing import
+// paths (`"../tools/types.js"`) so all callers keep resolving.
+//
+// Pure re-exports below cover types the contracts package could declare
+// without any assistant-side references. The remaining interfaces (`Tool`,
+// `ToolContext`, `ToolExecutionResult`, `ToolExecutedEvent`,
+// `ToolLifecycleEvent`, `ToolLifecycleEventHandler`, `ProxyToolResolver`)
+// reference daemon-internal types (CES client, host-proxy classes,
+// `ContentBlock`, `ApprovalRequired`, `TrustClass`, `InterfaceId`,
+// `SecretPromptResult`) that can't move into a neutral package. For those,
+// the contracts version uses opaque placeholders (`unknown`, broadened
+// `string`) and the assistant redeclares the interface here with the
+// concrete types. The two sides are structurally independent — no
+// inheritance, no intersection — which avoids TypeScript's contravariance
+// mismatches on lifecycle-event handlers.
+// ---------------------------------------------------------------------------
 
-interface ToolLifecycleEventBase {
-  toolName: string;
-  input: Record<string, unknown>;
-  workingDir: string;
-  conversationId: string;
-  requestId?: string;
-  executionTarget?: ExecutionTarget;
-}
+export type {
+  DiffInfo,
+  ErrorCategory,
+  ExecutionTarget,
+  ProxyApprovalCallback,
+  ProxyApprovalRequest,
+  ProxyEnvVars,
+  SensitiveOutputBinding,
+  SensitiveOutputKind,
+  ToolDefinition,
+  ToolExecutionErrorEvent,
+  ToolExecutionStartEvent,
+  ToolPermissionDeniedEvent,
+  ToolPermissionPromptEvent,
+  ToolSecretDetectedEvent,
+} from "@vellumai/skill-host-contracts";
+export { RiskLevel } from "@vellumai/skill-host-contracts";
 
-export interface ToolExecutionStartEvent extends ToolLifecycleEventBase {
-  type: "start";
-  startedAtMs: number;
-}
+// ---------------------------------------------------------------------------
+// Assistant-side concrete overlays
+// ---------------------------------------------------------------------------
 
-export interface ToolPermissionPromptEvent extends ToolLifecycleEventBase {
-  type: "permission_prompt";
-  riskLevel: string;
-  /** Classifier-provided reason explaining why the risk level was assigned (bash/host_bash only). */
-  riskReason?: string;
-  reason: string;
-  allowlistOptions: AllowlistOption[];
-  scopeOptions: ScopeOption[];
+export interface ToolExecutionResult {
+  content: string;
+  isError: boolean;
   diff?: DiffInfo;
-  persistentDecisionsAllowed?: boolean;
-}
-
-export interface ToolPermissionDeniedEvent extends ToolLifecycleEventBase {
-  type: "permission_denied";
-  riskLevel: string;
-  /** Classifier-provided reason explaining why the risk level was assigned (bash/host_bash only). */
+  /** Optional status message for display (e.g. timeout, truncation). */
+  status?: string;
+  /** Optional rich content blocks (e.g. images) to include alongside text in the tool result. */
+  contentBlocks?: ContentBlock[];
+  /**
+   * Runtime-internal sensitive output bindings (placeholder -> real value).
+   * Populated by the executor when tool output contains
+   * `<vellum-sensitive-output>` directives. The agent loop merges these
+   * into a per-run substitution map for deterministic post-generation
+   * replacement. MUST NOT be emitted in client-facing events or logs.
+   */
+  sensitiveBindings?: SensitiveOutputBinding[];
+  /**
+   * When true, the agent loop should yield control back to the user after
+   * returning this result — tool results are pushed to history and the loop
+   * breaks without another LLM call. Two callers set this: interactive
+   * surfaces (tables with action buttons, file uploads) that force-stop the
+   * loop so the LLM cannot bypass the "wait for user action" instruction,
+   * and tools like `remember` that expose a `finish_turn` parameter letting
+   * the LLM voluntarily end its turn.
+   */
+  yieldToUser?: boolean;
+  /** Risk level from the classifier (populated during permission check). */
+  riskLevel?: string;
+  /** Human-readable reason for the risk classification. */
   riskReason?: string;
-  decision: "deny" | "always_deny";
-  reason: string;
-  durationMs: number;
+  /** Whether the daemon is running in a containerized (Docker) environment. */
+  isContainerized?: boolean;
+  /** Scope options ladder for the rule editor (narrowest to broadest). */
+  riskScopeOptions?: Array<{ pattern: string; label: string }>;
+  /** Directory scope ladder for the rule editor (narrowest to broadest). */
+  riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+  /**
+   * When present, indicates that a CES tool returned an `approval_required`
+   * response. The executor uses the approval bridge to prompt the guardian,
+   * commit the grant decision to CES, and retry the original tool invocation
+   * with the granted grantId. CES tools populate this field rather than
+   * returning a textual error so the executor can intercept and handle the
+   * approval flow transparently.
+   */
+  cesApprovalRequired?: ApprovalRequired;
 }
 
-export interface ToolExecutedEvent extends ToolLifecycleEventBase {
+export type ProxyToolResolver = (
+  toolName: string,
+  input: Record<string, unknown>,
+) => Promise<ToolExecutionResult>;
+
+/**
+ * `ToolExecutedEvent` carries a `result: ToolExecutionResult` field, so
+ * the assistant re-declares it here to reference the assistant-side
+ * `ToolExecutionResult` (which narrows `contentBlocks` to `ContentBlock[]`
+ * and `cesApprovalRequired` to `ApprovalRequired`).
+ */
+export interface ToolExecutedEvent {
   type: "executed";
+  toolName: string;
+  input: Record<string, unknown>;
+  workingDir: string;
+  conversationId: string;
+  requestId?: string;
+  executionTarget?: ExecutionTarget;
   riskLevel: string;
   decision: string;
   durationMs: number;
   result: ToolExecutionResult;
 }
 
-export type ErrorCategory =
-  | "permission_denied"
-  | "auth"
-  | "tool_failure"
-  | "unexpected";
-
-export interface ToolExecutionErrorEvent extends ToolLifecycleEventBase {
-  type: "error";
-  riskLevel: string;
-  decision: string;
-  durationMs: number;
-  errorMessage: string;
-  isExpected: boolean;
-  /** Classifies the error for downstream consumers (audit, alerting, monitoring). */
-  errorCategory: ErrorCategory;
-  errorName?: string;
-  errorStack?: string;
-}
-
-export interface ToolSecretDetectedEvent extends ToolLifecycleEventBase {
-  type: "secret_detected";
-  matches: Array<{ type: string; redactedValue: string }>;
-  action: "redact" | "warn" | "block" | "prompt";
-  detectedAtMs: number;
-}
-
 export type ToolLifecycleEvent =
   | ToolExecutionStartEvent
   | ToolPermissionPromptEvent
@@ -96,11 +151,6 @@ export type ToolLifecycleEventHandler = (
   event: ToolLifecycleEvent,
 ) => void | Promise<void>;
 
-export type ProxyToolResolver = (
-  toolName: string,
-  input: Record<string, unknown>,
-) => Promise<ToolExecutionResult>;
-
 export interface ToolContext {
   workingDir: string;
   conversationId: string;
@@ -137,7 +187,7 @@ export interface ToolContext {
   isInteractive?: boolean;
   /** Memory scope ID from the conversation's memory policy, so memory tools can target the correct scope. */
   memoryScopeId?: string;
-  /** When true, tools with private side-effects should always prompt for confirmation. */
+  /** When true, tools with side effects should always prompt for confirmation. */
   forcePromptSideEffects?: boolean;
   /**
    * When true, the tool requires a fresh interactive approval for every
@@ -190,11 +240,13 @@ export interface ToolContext {
   /** The tool_use block ID from the LLM response, used to correlate confirmation prompts with specific tool invocations. */
   toolUseId?: string;
   /** Optional proxy for delegating host_bash execution to a connected client (managed/cloud-hosted mode). */
-  hostBashProxy?: import("../daemon/host-bash-proxy.js").HostBashProxy;
+  hostBashProxy?: HostBashProxy;
   /** Optional proxy for delegating CDP commands to a connected client (managed/cloud-hosted mode). */
-  hostBrowserProxy?: import("../daemon/host-browser-proxy.js").HostBrowserProxy;
+  hostBrowserProxy?: HostBrowserProxy;
   /** Optional proxy for delegating host_file_read/write/edit execution to a connected client (managed/cloud-hosted mode). */
-  hostFileProxy?: import("../daemon/host-file-proxy.js").HostFileProxy;
+  hostFileProxy?: HostFileProxy;
+  /** Optional proxy for delegating bidirectional file transfers between sandbox and host (managed/cloud-hosted mode). */
+  hostTransferProxy?: HostTransferProxy;
   /** True when the assistant is running as a platform-managed remote instance. Used to auto-approve sandboxed bash tools. */
   isPlatformHosted?: boolean;
   /** CES RPC client for credential execution operations. When present, the executor can bridge CES approval flows. */
@@ -207,86 +259,38 @@ export interface ToolContext {
    * to cdp-inspect or local Playwright.
    */
   transportInterface?: InterfaceId;
-}
-
-export interface DiffInfo {
-  filePath: string;
-  oldContent: string;
-  newContent: string;
-  isNewFile: boolean;
-}
-
-export interface ToolExecutionResult {
-  content: string;
-  isError: boolean;
-  diff?: DiffInfo;
-  /** Optional status message for display (e.g. timeout, truncation). */
-  status?: string;
-  /** Optional rich content blocks (e.g. images) to include alongside text in the tool result. */
-  contentBlocks?: ContentBlock[];
   /**
-   * Runtime-internal sensitive output bindings (placeholder -> real value).
-   * Populated by the executor when tool output contains
-   * `<vellum-sensitive-output>` directives. The agent loop merges these
-   * into a per-run substitution map for deterministic post-generation
-   * replacement. MUST NOT be emitted in client-facing events or logs.
+   * True when the host browser proxy's sender was overridden by a
+   * registry-routed extension connection (ChromeExtensionRegistry WebSocket).
+   * The CDP factory uses this to distinguish between an SSE-backed proxy
+   * (macOS, no extension) and an extension-backed proxy: only the latter
+   * should suppress desktop-auto cdp-inspect when temporarily unavailable,
+   * because the extension transport was explicitly expected and the
+   * disconnection is transient. An SSE-backed proxy that reports
+   * unavailable (e.g. non-interactive turn) should NOT suppress
+   * cdp-inspect — the proxy was never expected to service browser requests.
    */
-  sensitiveBindings?: SensitiveOutputBinding[];
+  hostBrowserRegistryRouted?: boolean;
   /**
-   * When true, the agent loop should yield control back to the user after
-   * returning this result — tool results are pushed to history and the loop
-   * breaks without another LLM call. Two callers set this: interactive
-   * surfaces (tables with action buttons, file uploads) that force-stop the
-   * loop so the LLM cannot bypass the "wait for user action" instruction,
-   * and tools like `remember` that expose a `finish_turn` parameter letting
-   * the LLM voluntarily end its turn.
+   * Connected clients that support the `host_browser` capability, populated
+   * from the ClientRegistry. Used by `browser status` to report accurate
+   * extension availability even when no proxy is bound to the current
+   * conversation (e.g. when called from the CLI without a conversation ID).
    */
-  yieldToUser?: boolean;
+  connectedBrowserClients?: Array<{
+    clientId: string;
+    interfaceId: string;
+  }>;
   /**
-   * When present, indicates that a CES tool returned an `approval_required`
-   * response. The executor uses the approval bridge to prompt the guardian,
-   * commit the grant decision to CES, and retry the original tool invocation
-   * with the granted grantId. CES tools populate this field rather than
-   * returning a textual error so the executor can intercept and handle the
-   * approval flow transparently.
+   * The per-turn inference-profile override the agent loop is currently
+   * running under, propagated through tool context so subagent-spawn tools
+   * can forward it when spawning nested subagents. Without this, sub-subagent
+   * spawns silently lose inheritance because their own conversation row never
+   * has `inferenceProfile` set — the override only flows through the
+   * in-memory `SubagentConfig.overrideProfile` chain. See
+   * `executeSubagentSpawn` in tools/subagent/spawn.ts.
    */
-  cesApprovalRequired?: ApprovalRequired;
-}
-
-// ---------------------------------------------------------------------------
-// Proxy approval types - local definitions for the outbound-proxy contract.
-// The proxy service owns the canonical shapes; these are the assistant's
-// minimal view of the approval callback interface.
-// ---------------------------------------------------------------------------
-
-/** Approval request from the outbound proxy when a policy decision requires user confirmation. */
-export interface ProxyApprovalRequest {
-  decision: {
-    kind: "ask_missing_credential" | "ask_unauthenticated";
-    target: {
-      hostname: string;
-      port: number | null;
-      path: string;
-      scheme: "http" | "https";
-    };
-    /** Present when kind is "ask_missing_credential". */
-    matchingPatterns?: string[];
-  };
-  sessionId: string;
-}
-
-/** Callback for proxy policy decisions requiring user confirmation. Returns true if approved. */
-export type ProxyApprovalCallback = (
-  request: ProxyApprovalRequest,
-) => Promise<boolean>;
-
-/** Env vars a proxy session injects into child processes. */
-export interface ProxyEnvVars {
-  HTTP_PROXY: string;
-  HTTPS_PROXY: string;
-  NO_PROXY: string;
-  NODE_EXTRA_CA_CERTS?: string;
-  SSL_CERT_FILE?: string;
+  overrideProfile?: string;
 }
 
 export interface Tool {
@@ -296,12 +300,14 @@ export interface Tool {
   defaultRiskLevel: RiskLevel;
   /** When set to 'proxy', the tool is forwarded to a connected client rather than executed locally. */
   executionMode?: "local" | "proxy";
-  /** Whether this tool is a core built-in, provided by a skill, or from an MCP server. */
-  origin?: "core" | "skill" | "mcp";
+  /** Whether this tool is a core built-in, provided by a skill, contributed by a plugin, or from an MCP server. */
+  origin?: "core" | "skill" | "mcp" | "plugin";
   /** If origin is 'skill', the ID of the owning skill. */
   ownerSkillId?: string;
   /** If origin is 'mcp', the ID of the owning MCP server. */
   ownerMcpServerId?: string;
+  /** If origin is 'plugin', the name of the owning plugin. */
+  ownerPluginId?: string;
   /** Content-hash of the owning skill's source at registration time. */
   ownerSkillVersionHash?: string;
   /** Whether the owning skill is bundled with the daemon (trusted first-party). */

package/src/tools/ui-surface/definitions.ts

@@ -116,7 +116,7 @@ export const uiShowTool: Tool = {
 // ui_update
 // ---------------------------------------------------------------------------
 
-export const uiUpdateTool: Tool = {
+const uiUpdateTool: Tool = {
   name: "ui_update",
   description:
     "Update an existing surface's data. The provided data object is merged into the surface's current data.\n" +
@@ -153,7 +153,7 @@ export const uiUpdateTool: Tool = {
 // ui_dismiss
 // ---------------------------------------------------------------------------
 
-export const uiDismissTool: Tool = {
+const uiDismissTool: Tool = {
   name: "ui_dismiss",
   description: "Dismiss a currently displayed surface.",
   category: "ui-surface",

package/src/util/debounce.ts

@@ -2,27 +2,6 @@
  * Single-key debouncer. Delays execution until no new calls arrive
  * within the specified delay period.
  */
-export class Debouncer {
-  private timer: ReturnType<typeof setTimeout> | null = null;
-
-  constructor(private readonly delayMs: number) {}
-
-  schedule(fn: () => void): void {
-    if (this.timer) clearTimeout(this.timer);
-    this.timer = setTimeout(() => {
-      this.timer = null;
-      fn();
-    }, this.delayMs);
-  }
-
-  cancel(): void {
-    if (this.timer) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-  }
-}
-
 /**
  * Multi-key debouncer. Each key gets its own independent timer.
  * Includes an optional entry limit with eviction of oldest non-protected entries.

package/src/util/errors.ts

@@ -169,17 +169,9 @@ export class DaemonError extends AssistantError {
   }
 }
 
-export class PlatformError extends AssistantError {
-  constructor(message: string, options?: { cause?: unknown }) {
-    super(message, ErrorCode.PLATFORM_ERROR, options);
-    this.name = "PlatformError";
-  }
-}
-
 export class IntegrityError extends AssistantError {
   constructor(message: string, options?: { cause?: unknown }) {
     super(message, ErrorCode.INTEGRITY_ERROR, options);
     this.name = "IntegrityError";
   }
 }
-

package/src/util/log-redact.ts

@@ -161,4 +161,3 @@ export const logSerializers: Record<string, (value: unknown) => unknown> = {
 };
 
 // Exported for testing
-export { redactString as _redactString, redactValue as _redactValue };