@vellumai/assistant 0.6.6 → 0.7.1

package/src/tools/types.ts

@@ -1,106 +1,159 @@
-import type { ApprovalRequired } from "@vellumai/ces-contracts";
+import type { ApprovalRequired } from "@vellumai/service-contracts/credential-rpc";
+import type {
+  DiffInfo,
+  ExecutionTarget,
+  ProxyApprovalCallback,
+  RiskLevel,
+  SensitiveOutputBinding,
+  ToolDefinition,
+  ToolExecutionErrorEvent,
+  ToolExecutionStartEvent,
+  ToolPermissionDeniedEvent,
+  ToolPermissionPromptEvent,
+} from "@vellumai/skill-host-contracts";
 
 import type { InterfaceId } from "../channels/types.js";
 import type { CesClient } from "../credential-execution/client.js";
 import type { SecretPromptResult } from "../permissions/secret-prompter.js";
-import type {
-  AllowlistOption,
-  RiskLevel,
-  ScopeOption,
-} from "../permissions/types.js";
-import type { ContentBlock, ToolDefinition } from "../providers/types.js";
+import type { ContentBlock } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
-import type { SensitiveOutputBinding } from "./sensitive-output-placeholders.js";
 
-export type ExecutionTarget = "sandbox" | "host";
+// ---------------------------------------------------------------------------
+// Re-exports + concrete overlays for types that live in
+// @vellumai/skill-host-contracts.
+//
+// The canonical declarations moved into the neutral contracts package as
+// part of the skill-isolation work. This file preserves existing import
+// paths (`"../tools/types.js"`) so all callers keep resolving.
+//
+// Pure re-exports below cover types the contracts package could declare
+// without any assistant-side references. The remaining interfaces (`Tool`,
+// `ToolContext`, `ToolExecutionResult`, `ToolExecutedEvent`,
+// `ToolLifecycleEvent`, `ToolLifecycleEventHandler`, `ProxyToolResolver`)
+// reference daemon-internal types (CES client, host-proxy classes,
+// `ContentBlock`, `ApprovalRequired`, `TrustClass`, `InterfaceId`,
+// `SecretPromptResult`) that can't move into a neutral package. For those,
+// the contracts version uses opaque placeholders (`unknown`, broadened
+// `string`) and the assistant redeclares the interface here with the
+// concrete types. The two sides are structurally independent — no
+// inheritance, no intersection — which avoids TypeScript's contravariance
+// mismatches on lifecycle-event handlers.
+// ---------------------------------------------------------------------------
 
-interface ToolLifecycleEventBase {
-  toolName: string;
-  input: Record<string, unknown>;
-  workingDir: string;
-  conversationId: string;
-  requestId?: string;
-  executionTarget?: ExecutionTarget;
-}
+export type {
+  DiffInfo,
+  ErrorCategory,
+  ExecutionTarget,
+  ProxyApprovalCallback,
+  ProxyApprovalRequest,
+  ProxyEnvVars,
+  SensitiveOutputBinding,
+  SensitiveOutputKind,
+  ToolDefinition,
+  ToolExecutionErrorEvent,
+  ToolExecutionStartEvent,
+  ToolPermissionDeniedEvent,
+  ToolPermissionPromptEvent,
+} from "@vellumai/skill-host-contracts";
+export { RiskLevel } from "@vellumai/skill-host-contracts";
 
-export interface ToolExecutionStartEvent extends ToolLifecycleEventBase {
-  type: "start";
-  startedAtMs: number;
-}
+// ---------------------------------------------------------------------------
+// Assistant-side concrete overlays
+// ---------------------------------------------------------------------------
 
-export interface ToolPermissionPromptEvent extends ToolLifecycleEventBase {
-  type: "permission_prompt";
-  riskLevel: string;
-  /** Classifier-provided reason explaining why the risk level was assigned (bash/host_bash only). */
-  riskReason?: string;
-  reason: string;
-  allowlistOptions: AllowlistOption[];
-  scopeOptions: ScopeOption[];
+export interface ToolExecutionResult {
+  content: string;
+  isError: boolean;
   diff?: DiffInfo;
-  persistentDecisionsAllowed?: boolean;
-}
-
-export interface ToolPermissionDeniedEvent extends ToolLifecycleEventBase {
-  type: "permission_denied";
-  riskLevel: string;
-  /** Classifier-provided reason explaining why the risk level was assigned (bash/host_bash only). */
+  /** Optional status message for display (e.g. timeout, truncation). */
+  status?: string;
+  /** Optional rich content blocks (e.g. images) to include alongside text in the tool result. */
+  contentBlocks?: ContentBlock[];
+  /**
+   * Runtime-internal sensitive output bindings (placeholder -> real value).
+   * Populated by the executor when tool output contains
+   * `<vellum-sensitive-output>` directives. The agent loop merges these
+   * into a per-run substitution map for deterministic post-generation
+   * replacement. MUST NOT be emitted in client-facing events or logs.
+   */
+  sensitiveBindings?: SensitiveOutputBinding[];
+  /**
+   * When true, the agent loop should yield control back to the user after
+   * returning this result — tool results are pushed to history and the loop
+   * breaks without another LLM call. Two callers set this: interactive
+   * surfaces (tables with action buttons, file uploads) that force-stop the
+   * loop so the LLM cannot bypass the "wait for user action" instruction,
+   * and tools like `remember` that expose a `finish_turn` parameter letting
+   * the LLM voluntarily end its turn.
+   */
+  yieldToUser?: boolean;
+  /** Risk level from the classifier (populated during permission check). */
+  riskLevel?: string;
+  /** Human-readable reason for the risk classification. */
   riskReason?: string;
-  decision: "deny" | "always_deny";
-  reason: string;
-  durationMs: number;
+  /** ID of the trust rule that matched this invocation (if any). */
+  matchedTrustRuleId?: string;
+  /** How the decision was reached: prompted, auto, blocked, or unknown (legacy). */
+  approvalMode?: string;
+  /** Why the decision was reached (stable enum for client display). */
+  approvalReason?: string;
+  /** Snapshot of the auto-approve threshold at the time of execution. */
+  riskThreshold?: string;
+  /** Whether the daemon is running in a containerized (Docker) environment. */
+  isContainerized?: boolean;
+  /** Scope options ladder for the rule editor (narrowest to broadest). */
+  riskScopeOptions?: Array<{ pattern: string; label: string }>;
+  /** Directory scope ladder for the rule editor (narrowest to broadest). */
+  riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+  /**
+   * When present, indicates that a CES tool returned an `approval_required`
+   * response. The executor uses the approval bridge to prompt the guardian,
+   * commit the grant decision to CES, and retry the original tool invocation
+   * with the granted grantId. CES tools populate this field rather than
+   * returning a textual error so the executor can intercept and handle the
+   * approval flow transparently.
+   */
+  cesApprovalRequired?: ApprovalRequired;
 }
 
-export interface ToolExecutedEvent extends ToolLifecycleEventBase {
+export type ProxyToolResolver = (
+  toolName: string,
+  input: Record<string, unknown>,
+) => Promise<ToolExecutionResult>;
+
+/**
+ * `ToolExecutedEvent` carries a `result: ToolExecutionResult` field, so
+ * the assistant re-declares it here to reference the assistant-side
+ * `ToolExecutionResult` (which narrows `contentBlocks` to `ContentBlock[]`
+ * and `cesApprovalRequired` to `ApprovalRequired`).
+ */
+export interface ToolExecutedEvent {
   type: "executed";
+  toolName: string;
+  input: Record<string, unknown>;
+  workingDir: string;
+  conversationId: string;
+  requestId?: string;
+  executionTarget?: ExecutionTarget;
   riskLevel: string;
+  /** ID of the trust rule that matched this invocation (if any). */
+  matchedTrustRuleId?: string;
   decision: string;
   durationMs: number;
   result: ToolExecutionResult;
 }
 
-export type ErrorCategory =
-  | "permission_denied"
-  | "auth"
-  | "tool_failure"
-  | "unexpected";
-
-export interface ToolExecutionErrorEvent extends ToolLifecycleEventBase {
-  type: "error";
-  riskLevel: string;
-  decision: string;
-  durationMs: number;
-  errorMessage: string;
-  isExpected: boolean;
-  /** Classifies the error for downstream consumers (audit, alerting, monitoring). */
-  errorCategory: ErrorCategory;
-  errorName?: string;
-  errorStack?: string;
-}
-
-export interface ToolSecretDetectedEvent extends ToolLifecycleEventBase {
-  type: "secret_detected";
-  matches: Array<{ type: string; redactedValue: string }>;
-  action: "redact" | "warn" | "block" | "prompt";
-  detectedAtMs: number;
-}
-
 export type ToolLifecycleEvent =
   | ToolExecutionStartEvent
   | ToolPermissionPromptEvent
   | ToolPermissionDeniedEvent
   | ToolExecutedEvent
-  | ToolExecutionErrorEvent
-  | ToolSecretDetectedEvent;
+  | ToolExecutionErrorEvent;
 
 export type ToolLifecycleEventHandler = (
   event: ToolLifecycleEvent,
 ) => void | Promise<void>;
 
-export type ProxyToolResolver = (
-  toolName: string,
-  input: Record<string, unknown>,
-) => Promise<ToolExecutionResult>;
-
 export interface ToolContext {
   workingDir: string;
   conversationId: string;
@@ -114,7 +167,7 @@ export interface ToolContext {
   onOutput?: (chunk: string) => void;
   /** Abort signal for cooperative cancellation. Tools should check this periodically. */
   signal?: AbortSignal;
-  /** Optional callback for tool lifecycle events (start/prompt/deny/execute/error/secret_detected). */
+  /** Optional callback for tool lifecycle events (start/prompt/deny/execute/error). */
   onToolLifecycleEvent?: ToolLifecycleEventHandler;
   /** Optional resolver for proxy tools - delegates execution to an external client. */
   proxyToolResolver?: ProxyToolResolver;
@@ -137,7 +190,7 @@ export interface ToolContext {
   isInteractive?: boolean;
   /** Memory scope ID from the conversation's memory policy, so memory tools can target the correct scope. */
   memoryScopeId?: string;
-  /** When true, tools with private side-effects should always prompt for confirmation. */
+  /** When true, tools with side effects should always prompt for confirmation. */
   forcePromptSideEffects?: boolean;
   /**
    * When true, the tool requires a fresh interactive approval for every
@@ -189,12 +242,6 @@ export interface ToolContext {
   channelPermissionChannelId?: string;
   /** The tool_use block ID from the LLM response, used to correlate confirmation prompts with specific tool invocations. */
   toolUseId?: string;
-  /** Optional proxy for delegating host_bash execution to a connected client (managed/cloud-hosted mode). */
-  hostBashProxy?: import("../daemon/host-bash-proxy.js").HostBashProxy;
-  /** Optional proxy for delegating CDP commands to a connected client (managed/cloud-hosted mode). */
-  hostBrowserProxy?: import("../daemon/host-browser-proxy.js").HostBrowserProxy;
-  /** Optional proxy for delegating host_file_read/write/edit execution to a connected client (managed/cloud-hosted mode). */
-  hostFileProxy?: import("../daemon/host-file-proxy.js").HostFileProxy;
   /** True when the assistant is running as a platform-managed remote instance. Used to auto-approve sandboxed bash tools. */
   isPlatformHosted?: boolean;
   /** CES RPC client for credential execution operations. When present, the executor can bridge CES approval flows. */
@@ -208,109 +255,15 @@ export interface ToolContext {
    */
   transportInterface?: InterfaceId;
   /**
-   * True when the host browser proxy's sender was overridden by a
-   * registry-routed extension connection (ChromeExtensionRegistry WebSocket).
-   * The CDP factory uses this to distinguish between an SSE-backed proxy
-   * (macOS, no extension) and an extension-backed proxy: only the latter
-   * should suppress desktop-auto cdp-inspect when temporarily unavailable,
-   * because the extension transport was explicitly expected and the
-   * disconnection is transient. An SSE-backed proxy that reports
-   * unavailable (e.g. non-interactive turn) should NOT suppress
-   * cdp-inspect — the proxy was never expected to service browser requests.
-   */
-  hostBrowserRegistryRouted?: boolean;
-}
-
-export interface DiffInfo {
-  filePath: string;
-  oldContent: string;
-  newContent: string;
-  isNewFile: boolean;
-}
-
-export interface ToolExecutionResult {
-  content: string;
-  isError: boolean;
-  diff?: DiffInfo;
-  /** Optional status message for display (e.g. timeout, truncation). */
-  status?: string;
-  /** Optional rich content blocks (e.g. images) to include alongside text in the tool result. */
-  contentBlocks?: ContentBlock[];
-  /**
-   * Runtime-internal sensitive output bindings (placeholder -> real value).
-   * Populated by the executor when tool output contains
-   * `<vellum-sensitive-output>` directives. The agent loop merges these
-   * into a per-run substitution map for deterministic post-generation
-   * replacement. MUST NOT be emitted in client-facing events or logs.
+   * The per-turn inference-profile override the agent loop is currently
+   * running under, propagated through tool context so subagent-spawn tools
+   * can forward it when spawning nested subagents. Without this, sub-subagent
+   * spawns silently lose inheritance because their own conversation row never
+   * has `inferenceProfile` set — the override only flows through the
+   * in-memory `SubagentConfig.overrideProfile` chain. See
+   * `executeSubagentSpawn` in tools/subagent/spawn.ts.
    */
-  sensitiveBindings?: SensitiveOutputBinding[];
-  /**
-   * When true, the agent loop should yield control back to the user after
-   * returning this result — tool results are pushed to history and the loop
-   * breaks without another LLM call. Two callers set this: interactive
-   * surfaces (tables with action buttons, file uploads) that force-stop the
-   * loop so the LLM cannot bypass the "wait for user action" instruction,
-   * and tools like `remember` that expose a `finish_turn` parameter letting
-   * the LLM voluntarily end its turn.
-   */
-  yieldToUser?: boolean;
-  /** Risk level from the classifier (populated during permission check). */
-  riskLevel?: string;
-  /** Human-readable reason for the risk classification. */
-  riskReason?: string;
-  /** Whether the daemon is running in a containerized (Docker) environment. */
-  isContainerized?: boolean;
-  /** Scope options ladder for the rule editor (narrowest to broadest). */
-  riskScopeOptions?: Array<{ pattern: string; label: string }>;
-  /**
-   * When present, indicates that a CES tool returned an `approval_required`
-   * response. The executor uses the approval bridge to prompt the guardian,
-   * commit the grant decision to CES, and retry the original tool invocation
-   * with the granted grantId. CES tools populate this field rather than
-   * returning a textual error so the executor can intercept and handle the
-   * approval flow transparently.
-   */
-  cesApprovalRequired?: ApprovalRequired;
-}
-
-// ---------------------------------------------------------------------------
-// Proxy approval types - local definitions for the outbound-proxy contract.
-// The proxy service owns the canonical shapes; these are the assistant's
-// minimal view of the approval callback interface.
-// ---------------------------------------------------------------------------
-
-/** Approval request from the outbound proxy when a policy decision requires user confirmation. */
-export interface ProxyApprovalRequest {
-  decision: {
-    kind: "ask_missing_credential" | "ask_unauthenticated";
-    target: {
-      hostname: string;
-      port: number | null;
-      path: string;
-      scheme: "http" | "https";
-    };
-    /** Present when kind is "ask_missing_credential". */
-    matchingPatterns?: string[];
-  };
-  sessionId: string;
-  /** HTTP method (plain HTTP only; undefined for HTTPS CONNECT tunnels). */
-  method?: string;
-  /** Curated non-sensitive headers (plain HTTP only). */
-  requestHeaders?: Record<string, string>;
-}
-
-/** Callback for proxy policy decisions requiring user confirmation. Returns true if approved. */
-export type ProxyApprovalCallback = (
-  request: ProxyApprovalRequest,
-) => Promise<boolean>;
-
-/** Env vars a proxy session injects into child processes. */
-export interface ProxyEnvVars {
-  HTTP_PROXY: string;
-  HTTPS_PROXY: string;
-  NO_PROXY: string;
-  NODE_EXTRA_CA_CERTS?: string;
-  SSL_CERT_FILE?: string;
+  overrideProfile?: string;
 }
 
 export interface Tool {

package/src/tools/ui-surface/definitions.ts

@@ -116,7 +116,7 @@ export const uiShowTool: Tool = {
 // ui_update
 // ---------------------------------------------------------------------------
 
-export const uiUpdateTool: Tool = {
+const uiUpdateTool: Tool = {
   name: "ui_update",
   description:
     "Update an existing surface's data. The provided data object is merged into the surface's current data.\n" +
@@ -153,7 +153,7 @@ export const uiUpdateTool: Tool = {
 // ui_dismiss
 // ---------------------------------------------------------------------------
 
-export const uiDismissTool: Tool = {
+const uiDismissTool: Tool = {
   name: "ui_dismiss",
   description: "Dismiss a currently displayed surface.",
   category: "ui-surface",

package/src/tts/__tests__/provider-catalog.test.ts

@@ -172,9 +172,9 @@ describe("Deepgram catalog entry", () => {
     expect(entry.capabilities.supportedFormats).toContain("opus");
   });
 
-  test("requires a bare API key stored under 'deepgram'", () => {
+  test("requires an API key stored under 'credential/deepgram/api_key'", () => {
     const apiKeySecret = entry.secretRequirements.find(
-      (s) => s.credentialStoreKey === "deepgram",
+      (s) => s.credentialStoreKey === "credential/deepgram/api_key",
     );
     expect(apiKeySecret).toBeDefined();
     expect(apiKeySecret!.displayName).toContain("Deepgram");

package/src/tts/provider-catalog.ts

@@ -152,7 +152,7 @@ const CATALOG: readonly TtsProviderCatalogEntry[] = [
     },
     secretRequirements: [
       {
-        credentialStoreKey: "deepgram",
+        credentialStoreKey: "credential/deepgram/api_key",
         displayName: "Deepgram API Key",
         setCommand: "assistant keys set deepgram <key>",
       },

package/src/usage/actors.ts

@@ -9,4 +9,5 @@ export type UsageActor =
   | "ambient_analyzer"
   | "suggestion_generator"
   | "computer_use_agent"
-  | "memory_embedding";
+  | "memory_embedding"
+  | "llm_call_site";

package/src/usage/attribution.ts

@@ -0,0 +1,185 @@
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
+import { getConfig } from "../config/loader.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
+import { safeStringSlice } from "../util/unicode.js";
+
+const MAX_METADATA_VALUE_LENGTH = 128;
+
+export type UsageAttributionProfileSource =
+  | "call_site"
+  | "conversation"
+  | "active"
+  | "default"
+  | "unknown";
+
+export interface UsageAttributionInput {
+  callSite: LLMCallSite | null;
+  overrideProfile?: string | null;
+}
+
+export interface UsageAttributionSnapshot {
+  callSite: LLMCallSite | null;
+  activeProfile: string | null;
+  overrideProfile: string | null;
+  callSiteProfile: string | null;
+  appliedProfile: string | null;
+  profileSource: UsageAttributionProfileSource;
+  resolvedProvider: string;
+  resolvedModel: string;
+}
+
+/**
+ * Sanitizes values before they are copied into external metadata surfaces.
+ * Empty strings and control-character-bearing strings are dropped, and long
+ * values are capped so later forwarding cannot create unbounded headers.
+ */
+export function sanitizeUsageMetadataValue(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return null;
+  if (containsControlCharacter(trimmed)) return null;
+
+  return safeStringSlice(trimmed, 0, MAX_METADATA_VALUE_LENGTH);
+}
+
+export function resolveUsageAttribution(
+  input: UsageAttributionInput,
+): UsageAttributionSnapshot {
+  const llm = getConfig().llm;
+  const callSite = input.callSite;
+  const overrideProfile = normalizeProfileId(input.overrideProfile);
+
+  if (callSite == null) {
+    return {
+      callSite: null,
+      activeProfile: normalizeProfileId(llm.activeProfile),
+      overrideProfile,
+      callSiteProfile: null,
+      appliedProfile: null,
+      profileSource: "unknown",
+      resolvedProvider: llm.default.provider,
+      resolvedModel: llm.default.model,
+    };
+  }
+
+  const resolved = resolveCallSiteConfig(callSite, llm, {
+    ...(overrideProfile != null ? { overrideProfile } : {}),
+  });
+  const activeProfile = normalizeProfileId(llm.activeProfile);
+  const callSiteProfile = normalizeProfileId(
+    llm.callSites?.[callSite]?.profile,
+  );
+  const profile = resolveAppliedProfile({
+    callSite,
+    profiles: llm.profiles ?? {},
+    activeProfile,
+    overrideProfile,
+    callSiteProfile,
+  });
+
+  return {
+    callSite,
+    activeProfile,
+    overrideProfile,
+    callSiteProfile,
+    appliedProfile: profile.appliedProfile,
+    profileSource: profile.profileSource,
+    resolvedProvider: resolved.provider,
+    resolvedModel: resolved.model,
+  };
+}
+
+function resolveAppliedProfile(input: {
+  callSite: LLMCallSite;
+  profiles: Record<string, unknown>;
+  activeProfile: string | null;
+  overrideProfile: string | null;
+  callSiteProfile: string | null;
+}): Pick<UsageAttributionSnapshot, "appliedProfile" | "profileSource"> {
+  if (input.callSite === "mainAgent") {
+    if (
+      input.overrideProfile != null &&
+      input.profiles[input.overrideProfile] != null
+    ) {
+      return {
+        appliedProfile: input.overrideProfile,
+        profileSource: "conversation",
+      };
+    }
+
+    if (
+      input.activeProfile != null &&
+      input.profiles[input.activeProfile] != null
+    ) {
+      return {
+        appliedProfile: input.activeProfile,
+        profileSource: "active",
+      };
+    }
+
+    if (
+      input.callSiteProfile != null &&
+      input.profiles[input.callSiteProfile] != null
+    ) {
+      return {
+        appliedProfile: input.callSiteProfile,
+        profileSource: "call_site",
+      };
+    }
+
+    return {
+      appliedProfile: null,
+      profileSource: "default",
+    };
+  }
+
+  if (
+    input.callSiteProfile != null &&
+    input.profiles[input.callSiteProfile] != null
+  ) {
+    return {
+      appliedProfile: input.callSiteProfile,
+      profileSource: "call_site",
+    };
+  }
+
+  if (
+    input.overrideProfile != null &&
+    input.profiles[input.overrideProfile] != null
+  ) {
+    return {
+      appliedProfile: input.overrideProfile,
+      profileSource: "conversation",
+    };
+  }
+
+  if (
+    input.activeProfile != null &&
+    input.profiles[input.activeProfile] != null
+  ) {
+    return {
+      appliedProfile: input.activeProfile,
+      profileSource: "active",
+    };
+  }
+
+  return {
+    appliedProfile: null,
+    profileSource: "default",
+  };
+}
+
+function normalizeProfileId(value: string | null | undefined): string | null {
+  return value ?? null;
+}
+
+function containsControlCharacter(value: string): boolean {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
+      return true;
+    }
+  }
+  return false;
+}