@vellumai/assistant 0.6.6 → 0.7.1

package/src/daemon/conversation-surfaces.ts

@@ -1,6 +1,7 @@
 import { v4 as uuid } from "uuid";
 
 import {
+  addAppConversationId,
   getApp,
   getAppDirPath,
   getAppPreview,
@@ -13,6 +14,7 @@ import {
   getMessages,
   updateMessageContent,
 } from "../memory/conversation-crud.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import type {
   InteractiveUiRequest,
   InteractiveUiResult,
@@ -22,7 +24,7 @@ import { getLogger } from "../util/logger.js";
 import { isPlainObject } from "../util/object.js";
 import { buildConversationErrorMessage } from "./conversation-error.js";
 import { launchConversation } from "./conversation-launch.js";
-import type { TrustContext } from "./conversation-runtime-assembly.js";
+import type { HostCuProxy } from "./host-cu-proxy.js";
 import type {
   CardSurfaceData,
   ConfirmationSurfaceData,
@@ -40,6 +42,7 @@ import type {
 import { INTERACTIVE_SURFACE_TYPES } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import type { UserMessageAttachment } from "./message-types/shared.js";
+import type { TrustContext } from "./trust-context.js";
 
 const log = getLogger("conversation-surfaces");
 
@@ -254,7 +257,6 @@ export interface SurfaceConversationContext {
     emit(type: string, message: string, meta?: Record<string, unknown>): void;
   };
   sendToClient(msg: ServerMessage): void;
-  broadcastToAllClients?(msg: ServerMessage): void;
   pendingSurfaceActions: Map<string, { surfaceType: SurfaceType }>;
   lastSurfaceAction: Map<
     string,
@@ -317,15 +319,15 @@ export interface SurfaceConversationContext {
     persistent?: boolean;
   }>;
   /** Optional proxy for delegating computer-use actions to a connected desktop client. */
-  hostCuProxy?: import("./host-cu-proxy.js").HostCuProxy;
+  hostCuProxy?: HostCuProxy;
   /** True when no interactive client is connected (headless / channel-only). */
   readonly hasNoClient?: boolean;
   isProcessing(): boolean;
   enqueueMessage(
     content: string,
     attachments: UserMessageAttachment[],
-    onEvent: (msg: ServerMessage) => void,
-    requestId: string,
+    onEvent?: (msg: ServerMessage) => void,
+    requestId?: string,
     activeSurfaceId?: string,
     currentPage?: string,
     metadata?: Record<string, unknown>,
@@ -337,7 +339,7 @@ export interface SurfaceConversationContext {
   processMessage(
     content: string,
     attachments: UserMessageAttachment[],
-    onEvent: (msg: ServerMessage) => void,
+    onEvent?: (msg: ServerMessage) => void,
     requestId?: string,
     activeSurfaceId?: string,
     currentPage?: string,
@@ -484,9 +486,7 @@ export function showStandaloneSurface(
       // the client side, preventing stale user interactions from reaching
       // handleSurfaceAction and being misrouted to the LLM.
       try {
-        const emitTimeout =
-          ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-        emitTimeout({
+        broadcastMessage({
           type: "ui_surface_complete",
           conversationId: ctx.conversationId,
           surfaceId,
@@ -522,9 +522,7 @@ export function showStandaloneSurface(
       actions,
     });
 
-    // ── Emit to client ──
-    const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-    emit({
+    broadcastMessage({
       type: "ui_surface_show",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -756,7 +754,7 @@ function handleStateUpdate(
   );
 }
 
-export function pushUndoState(
+function pushUndoState(
   surfaceUndoStacks: Map<string, string[]>,
   surfaceId: string,
   html: string,
@@ -993,9 +991,7 @@ export async function handleSurfaceAction(
       summary,
     };
 
-    // Emit ui_surface_complete so the client transitions the surface chip.
-    const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-    emit({
+    broadcastMessage({
       type: "ui_surface_complete",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1210,12 +1206,7 @@ export async function handleSurfaceAction(
 
     const requestId = uuid();
     ctx.surfaceActionRequestIds.add(requestId);
-    // Use broadcastToAllClients (publishes to the SSE event hub) instead of
-    // sendToClient, which is reset to a no-op between HTTP requests. Without
-    // this, surface action responses are persisted to DB but never reach the
-    // client's SSE stream.
-    const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-    const onEvent = (msg: ServerMessage) => emit(msg);
+    const onEvent = (msg: ServerMessage) => broadcastMessage(msg);
 
     ctx.traceEmitter.emit("request_received", "Surface action received", {
       requestId,
@@ -1249,7 +1240,7 @@ export async function handleSurfaceAction(
     // Echo the prompt to the client so it appears in the chat UI.
     // Deferred until after rejection check to avoid ghost messages.
     if (prompt) {
-      emit({
+      broadcastMessage({
         type: "user_message_echo",
         text: prompt,
         conversationId: ctx.conversationId,
@@ -1349,16 +1340,11 @@ export async function handleSurfaceAction(
     surfaceData,
   );
 
-  // Use broadcastToAllClients so events reach the SSE hub — sendToClient is
-  // reset to a no-op between HTTP requests (see history-restored path for
-  // full rationale).
-  const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-
   // Forms are one-shot surfaces — auto-complete immediately so the client
   // transitions from the "Submitting…" spinner to a completion chip without
   // requiring the LLM to call ui_dismiss.
   if (pending.surfaceType === "form") {
-    emit({
+    broadcastMessage({
       type: "ui_surface_complete",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1454,7 +1440,7 @@ export async function handleSurfaceAction(
 
   const requestId = uuid();
   ctx.surfaceActionRequestIds.add(requestId);
-  const onEvent = (msg: ServerMessage) => emit(msg);
+  const onEvent = (msg: ServerMessage) => broadcastMessage(msg);
 
   ctx.traceEmitter.emit("request_received", "Surface action received", {
     requestId,
@@ -1502,7 +1488,7 @@ export async function handleSurfaceAction(
   // Echo the user's prompt to the client so it appears in the chat UI.
   // Deferred until after rejection check to avoid ghost messages.
   if (shouldRelayPrompt && prompt) {
-    emit({
+    broadcastMessage({
       type: "user_message_echo",
       text: prompt,
       conversationId: ctx.conversationId,
@@ -1566,6 +1552,7 @@ export async function handleSurfaceAction(
       );
       onEvent({
         type: "error",
+        conversationId: ctx.conversationId,
         message: `Failed to process surface action: ${message}`,
       });
     });
@@ -1690,7 +1677,7 @@ export function buildCompletionSummary(
  * surface action. Unlike `buildCompletionSummary` (which is for the LLM),
  * this produces natural language the user can glance at.
  */
-export function buildUserFacingLabel(
+function buildUserFacingLabel(
   surfaceType: string | undefined,
   actionId: string,
   data?: Record<string, unknown>,
@@ -2015,6 +2002,14 @@ export async function surfaceProxyResolver(
     const openMode = input.open_mode as string | undefined;
     const app = getApp(appId);
     if (!app) return { content: `App not found: ${appId}`, isError: true };
+
+    // Track conversation association (best-effort — failures must not break open flow).
+    try {
+      addAppConversationId(appId, ctx.conversationId);
+    } catch (err) {
+      log.warn({ err, appId }, "Failed to track conversation ID on app_open");
+    }
+
     // Generate a minimal fallback preview from app metadata so that the
     // surface is always rendered as a clickable preview card (not an
     // un-clickable fallback chip) after conversation restart.

package/src/daemon/conversation-tool-setup.ts

@@ -15,22 +15,10 @@ import { isHttpAuthDisabled } from "../config/env.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import type { CesClient } from "../credential-execution/client.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
-import {
-  generateAllowlistOptions,
-  generateScopeOptions,
-  normalizeWebFetchUrl,
-} from "../permissions/checker.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
-import {
-  addRule,
-  findHighestPriorityRule,
-} from "../permissions/trust-store.js";
-import { isAllowDecision } from "../permissions/types.js";
-import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
-import { getTaskRunRules } from "../tasks/ephemeral-permissions.js";
 import { coreAppProxyTools } from "../tools/apps/definitions.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -51,7 +39,6 @@ import type {
 } from "../tools/types.js";
 import { allUiSurfaceTools } from "../tools/ui-surface/definitions.js";
 import { getLogger } from "../util/logger.js";
-import type { TrustContext } from "./conversation-runtime-assembly.js";
 import {
   projectSkillTools,
   type SkillProjectionCache,
@@ -64,6 +51,7 @@ import {
 } from "./doordash-steps.js";
 import type { ServerMessage, UiSurfaceShow } from "./message-protocol.js";
 import { runPostExecutionSideEffects } from "./tool-side-effects.js";
+import type { TrustContext } from "./trust-context.js";
 
 const log = getLogger("conversation-tool-setup");
 
@@ -99,8 +87,8 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   abortController: AbortController | null;
   /** When set, only tools in this set may execute during the current turn. */
   allowedToolNames?: Set<string>;
-  /** Conversation memory policy — used to propagate scopeId and strictSideEffects into ToolContext. */
-  memoryPolicy: { scopeId: string; strictSideEffects: boolean };
+  /** Conversation memory policy used to propagate scopeId into ToolContext. */
+  memoryPolicy: { scopeId: string };
   /** True when the conversation has no connected client (HTTP-only path). */
   hasNoClient?: boolean;
   /** When true, the conversation is executing a task run and must not become interactive. */
@@ -111,29 +99,21 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   trustContext?: TrustContext;
   /** Voice/call session ID, if the conversation originates from a call. Propagated into ToolContext for scoped grant consumption. */
   callSessionId?: string;
-  /** Optional proxy for delegating host_bash execution to a connected client. */
-  hostBashProxy?: import("./host-bash-proxy.js").HostBashProxy;
-  /** Optional proxy for delegating CDP commands to a connected client (managed/cloud-hosted mode). */
-  hostBrowserProxy?: import("./host-browser-proxy.js").HostBrowserProxy;
-  /** Optional proxy for delegating host_file_read/write/edit execution to a connected client. */
-  hostFileProxy?: import("./host-file-proxy.js").HostFileProxy;
   /** CES RPC client for credential execution operations. Injected when CES tools are enabled and the CES process is available. */
   cesClient?: CesClient;
   /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
   readonly transportInterface?: InterfaceId;
-  /**
-   * Registry-routed sender override for the host browser proxy. When set
-   * (non-undefined), indicates the browser proxy sender was replaced by a
-   * ChromeExtensionRegistry WebSocket sender — i.e., an extension connection
-   * was actively wired at turn-start. Propagated into ToolContext as
-   * `hostBrowserRegistryRouted` (boolean) so the CDP factory can distinguish
-   * SSE-backed proxies from extension-backed proxies.
-   */
-  hostBrowserSenderOverride?: (
-    msg: import("./message-protocol.js").ServerMessage,
-  ) => void;
+
   /** Turn-scoped flag: true when any tool call in the current turn received explicit user approval via interactive prompt. Cleared at turn end. */
   approvedViaPromptThisTurn?: boolean;
+  /**
+   * Per-turn snapshot of the resolved inference-profile override, set by
+   * `runAgentLoopImpl`. Propagated into `ToolContext.overrideProfile` so
+   * tools that spawn nested invocations (e.g. `subagent_spawn`) can forward
+   * the override without round-tripping through a row read that would
+   * return `undefined` for the in-flight (background) subagent.
+   */
+  currentTurnOverrideProfile?: string;
 }
 
 // ── buildToolDefinitions ─────────────────────────────────────────────
@@ -164,7 +144,6 @@ export function createToolExecutor(
   secretPrompter: SecretPrompter,
   ctx: ToolSetupContext,
   handleToolLifecycleEvent: ToolLifecycleEventHandler,
-  broadcastToAllClients?: (msg: ServerMessage) => void,
 ): (
   name: string,
   input: Record<string, unknown>,
@@ -188,15 +167,6 @@ export function createToolExecutor(
       markDoordashStepInProgress(ctx, input);
     }
 
-    // Unwrap skill_execute dispatch so downstream context (notably
-    // batchAuthorizedByTask) is keyed on the tool that will actually run.
-    // Task rules in required_tools contain underlying tool names (e.g.
-    // "gmail_archive"), never the outer "skill_execute" dispatcher.
-    const effectiveToolName =
-      name === "skill_execute" && typeof input.tool === "string" && input.tool
-        ? input.tool
-        : name;
-
     // Build the context object shared by both the skill_execute interception
     // path and the regular executor path.
     const toolContext: ToolContext = {
@@ -211,17 +181,7 @@ export function createToolExecutor(
       triggeredBySurfaceAction:
         ctx.surfaceActionRequestIds?.has(ctx.currentRequestId ?? "") ?? false,
       approvedViaPrompt: ctx.approvedViaPromptThisTurn || undefined,
-      // A task without required_tools entries (e.g. ad-hoc tasks created with
-      // omitted/empty required_tools, or legacy rows where it was never
-      // populated) correctly gets no batch authorization — that's the
-      // intended stricter contract this check enforces, not a regression to
-      // paper over. Batch tools gate themselves via this flag; callers that
-      // never declared the tool shouldn't get blanket authorization.
-      batchAuthorizedByTask:
-        ctx.taskRunId != null &&
-        getTaskRunRules(ctx.taskRunId).some(
-          (r) => r.tool === effectiveToolName,
-        ),
+      batchAuthorizedByTask: false,
       requesterExternalUserId: ctx.trustContext?.requesterExternalUserId,
       requesterChatId: ctx.trustContext?.requesterChatId,
       requesterIdentifier: ctx.trustContext?.requesterIdentifier,
@@ -234,15 +194,11 @@ export function createToolExecutor(
       signal: ctx.abortController?.signal,
       allowedToolNames: ctx.allowedToolNames,
       memoryScopeId: ctx.memoryPolicy.scopeId,
-      forcePromptSideEffects: ctx.memoryPolicy.strictSideEffects,
       toolUseId,
-      hostBashProxy: ctx.hostBashProxy,
-      hostBrowserProxy: ctx.hostBrowserProxy,
-      hostFileProxy: ctx.hostFileProxy,
       isPlatformHosted: getIsPlatform(),
       cesClient: ctx.cesClient,
       transportInterface: ctx.transportInterface,
-      hostBrowserRegistryRouted: !!ctx.hostBrowserSenderOverride,
+      overrideProfile: ctx.currentTurnOverrideProfile,
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
         // Tool context's sendToClient uses a loose { type: string; [key: string]: unknown }
@@ -330,10 +286,7 @@ export function createToolExecutor(
         ctx.approvedViaPromptThisTurn = true;
       }
 
-      runPostExecutionSideEffects(toolName, toolInput, result, {
-        ctx,
-        broadcastToAllClients,
-      });
+      runPostExecutionSideEffects(toolName, toolInput, result, { ctx });
 
       return result;
     }
@@ -348,10 +301,7 @@ export function createToolExecutor(
       ctx.approvedViaPromptThisTurn = true;
     }
 
-    runPostExecutionSideEffects(name, input, result, {
-      ctx,
-      broadcastToAllClients,
-    });
+    runPostExecutionSideEffects(name, input, result, { ctx });
 
     return result;
   };
@@ -366,143 +316,13 @@ export function createToolExecutor(
  * user confirmation before proceeding.
  */
 export function createProxyApprovalCallback(
-  prompter: PermissionPrompter,
-  ctx: ToolSetupContext,
+  _prompter: PermissionPrompter,
+  _ctx: ToolSetupContext,
 ): ProxyApprovalCallback {
-  return async (request: ProxyApprovalRequest): Promise<boolean> => {
-    const { decision } = request;
-    const { hostname, port, path } = decision.target;
-
-    // Use the standard network_request tool name so trust rules align with
-    // the checker's URL-based candidate generation and allowlist options.
-    const toolName = "network_request";
-    const { scheme } = decision.target;
-    const url = `${scheme}://${hostname}${port ? ":" + port : ""}${path}`;
-
-    if (isPermissionControlsV2Enabled()) {
-      // Under v2 we suppress deterministic network approval cards entirely.
-      // Proxied asks should follow the same non-host auto-allow contract as
-      // regular network_request invocations instead of turning into hard blocks.
-      return true;
-    }
-
-    const input: Record<string, unknown> = {
-      url,
-      scheme,
-    };
-    if (request.method) {
-      input.method = request.method;
-    }
-    if (request.requestHeaders && Object.keys(request.requestHeaders).length) {
-      input.request_headers = request.requestHeaders;
-    }
-    input.reason =
-      decision.kind === "ask_missing_credential"
-        ? "A known credential template matches this host, but no credential is bound to this session. Approving will forward the request as-is — the assistant won't inject a credential, but any caller-supplied auth headers will still be sent."
-        : "This host isn't covered by any known credential template. Approving will forward the request as-is, including any caller-supplied auth headers.";
-    if (decision.kind === "ask_missing_credential") {
-      input.known_credential_patterns = decision.matchingPatterns;
-    }
-    if (!request.method) {
-      input.connection_detail_available = "no";
-    }
-
-    const riskLevel: string = "medium";
-
-    // Check trust store before prompting — build candidates that mirror
-    // buildCommandCandidates() in checker.ts for network_request.
-    const candidates: string[] = [`${toolName}:${url}`];
-    const normalized = normalizeWebFetchUrl(url);
-    if (normalized) {
-      candidates.push(`${toolName}:${normalized.href}`);
-      candidates.push(`${toolName}:${normalized.origin}/*`);
-    }
-    candidates.push(`${toolName}:*`);
-    // Deduplicate
-    const uniqueCandidates = [...new Set(candidates)];
-
-    const existingRule = findHighestPriorityRule(
-      toolName,
-      uniqueCandidates,
-      ctx.workingDir,
-    );
-    if (existingRule && existingRule.decision !== "ask") {
-      if (existingRule.decision === "deny") return false;
-      return true;
-    }
-
-    // Use the checker's built-in allowlist generation for network_request
-    const allowlistOptions = await generateAllowlistOptions("network_request", {
-      url,
-    });
-
-    const scopeOptions = generateScopeOptions(ctx.workingDir);
-
-    // Non-interactive conversations have no client to prompt — fast-deny to avoid
-    // blocking for the full permission timeout before auto-denying.
-    if (ctx.hasNoClient) {
-      return false;
-    }
-
-    // Proxied network requests require per-invocation approval and must
-    // not be auto-approved by temporary overrides (allow_10m / allow_conversation).
-    // Unlike regular tool invocations, these represent outbound network
-    // actions that should always receive explicit confirmation.
-
-    const response = await prompter.prompt(
-      toolName,
-      input,
-      riskLevel,
-      allowlistOptions,
-      scopeOptions,
-      undefined,
-      ctx.conversationId,
-    );
-
-    // Persist trust rule if the user chose "always allow" or "always deny"
-    if (
-      response.decision === "always_allow" &&
-      response.selectedPattern &&
-      response.selectedScope
-    ) {
-      log.info(
-        {
-          toolName,
-          pattern: response.selectedPattern,
-          scope: response.selectedScope,
-        },
-        "Persisting always-allow trust rule (proxy)",
-      );
-      addRule(
-        toolName,
-        response.selectedPattern,
-        response.selectedScope,
-        "allow",
-        100,
-      );
-    }
-    if (
-      response.decision === "always_deny" &&
-      response.selectedPattern &&
-      response.selectedScope
-    ) {
-      log.info(
-        {
-          toolName,
-          pattern: response.selectedPattern,
-          scope: response.selectedScope,
-        },
-        "Persisting always-deny trust rule (proxy)",
-      );
-      addRule(
-        toolName,
-        response.selectedPattern,
-        response.selectedScope,
-        "deny",
-      );
-    }
-
-    return isAllowDecision(response.decision);
+  return async (_request: ProxyApprovalRequest): Promise<boolean> => {
+    // Proxied asks follow the same non-host auto-allow contract as regular
+    // network_request invocations — suppress deterministic approval cards.
+    return true;
   };
 }
 
@@ -577,6 +397,7 @@ export const HOST_TOOL_TO_CAPABILITY = new Map<string, HostProxyCapability>([
   ["host_file_read", "host_file"],
   ["host_file_write", "host_file"],
   ["host_file_edit", "host_file"],
+  ["host_file_transfer", "host_file"],
   ["host_browser", "host_browser"],
 ]);
 // Derived from HOST_TOOL_TO_CAPABILITY so the invariant "every host tool has

package/src/daemon/conversation-usage.ts

@@ -2,10 +2,13 @@ import { getConfig } from "../config/loader.js";
 import { updateConversationUsage } from "../memory/conversation-crud.js";
 import { recordUsageEvent } from "../memory/llm-usage-store.js";
 import type { UsageActor } from "../usage/actors.js";
+import { resolveUsageAttribution } from "../usage/attribution.js";
 import type {
   AnthropicCacheCreationTokenDetails,
   PricingResult,
   PricingUsage,
+  UsageAttributionInput,
+  UsageAttributionSnapshot,
 } from "../usage/types.js";
 import { getLogger } from "../util/logger.js";
 import {
@@ -117,6 +120,34 @@ function resolveStructuredPricing(
   }
 }
 
+function isUsageAttributionSnapshot(
+  attribution:
+    | UsageAttributionInput
+    | UsageAttributionSnapshot
+    | null
+    | undefined,
+): attribution is UsageAttributionSnapshot {
+  return (
+    attribution != null &&
+    typeof (attribution as UsageAttributionSnapshot).resolvedProvider ===
+      "string" &&
+    typeof (attribution as UsageAttributionSnapshot).resolvedModel === "string"
+  );
+}
+
+function resolveAttribution(
+  attribution:
+    | UsageAttributionInput
+    | UsageAttributionSnapshot
+    | null
+    | undefined,
+): UsageAttributionSnapshot | null {
+  if (attribution == null) return null;
+  return isUsageAttributionSnapshot(attribution)
+    ? attribution
+    : resolveUsageAttribution(attribution);
+}
+
 export function recordUsage(
   ctx: UsageContext,
   inputTokens: number,
@@ -130,6 +161,7 @@ export function recordUsage(
   rawResponse?: unknown,
   llmCallCount = 1,
   contextWindow?: { tokens: number; maxTokens: number },
+  attribution?: UsageAttributionInput | UsageAttributionSnapshot | null,
 ): void {
   if (inputTokens <= 0 && outputTokens <= 0) return;
 
@@ -193,6 +225,7 @@ export function recordUsage(
 
   // Dual-write: persist per-turn usage event to the new ledger table
   try {
+    const attributionSnapshot = resolveAttribution(attribution);
     recordUsageEvent(
       {
         actor,
@@ -206,6 +239,9 @@ export function recordUsage(
         runId: null,
         requestId,
         llmCallCount,
+        callSite: attributionSnapshot?.callSite ?? null,
+        inferenceProfile: attributionSnapshot?.appliedProfile ?? null,
+        inferenceProfileSource: attributionSnapshot?.profileSource ?? null,
       },
       pricing,
     );