@vellumai/assistant 0.7.0 → 0.7.1

package/src/security/token-manager.ts

@@ -14,7 +14,6 @@
 import {
   isCredentialError,
   isTokenExpired,
-  oauthConnectionAccessTokenPath,
   oauthConnectionRefreshTokenPath,
   persistRefreshedTokens,
   RefreshCircuitBreaker,
@@ -22,6 +21,7 @@ import {
   type SecureKeyBackend,
 } from "@vellumai/credential-storage";
 
+import { getConnectionAccessTokenResult } from "../oauth/credential-token-resolver.js";
 import {
   getApp,
   getConnection,
@@ -321,9 +321,13 @@ export async function withValidToken<T>(
     opts && typeof opts === "object"
       ? getConnection(opts.connectionId)
       : getConnectionByProvider(service, opts);
-  let token = conn
-    ? await getSecureKeyAsync(oauthConnectionAccessTokenPath(conn.id))
+  const tokenResult = conn
+    ? await getConnectionAccessTokenResult({
+        provider: conn.provider,
+        connectionId: conn.id,
+      })
     : undefined;
+  let token = tokenResult?.value;
   if (!token || !conn) {
     throw new TokenExpiredError(
       service,

package/src/signals/cancel.ts

@@ -5,34 +5,23 @@
  * HTTP POST to `/v1/conversations/:id/cancel`. The daemon's ConfigWatcher
  * detects the file change and invokes {@link handleCancelSignal}, which
  * reads the payload and aborts the target conversation.
- *
- * Because the signal handler needs access to the daemon's conversation map, the
- * daemon registers a callback at startup via {@link registerCancelCallback}.
  */
 
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
+import {
+  findConversation,
+  touchConversation,
+} from "../daemon/conversation-store.js";
+import { getSubagentManager } from "../subagent/index.js";
+import { createAbortReason } from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
 import { getSignalsDir } from "../util/platform.js";
 
 const log = getLogger("signal:cancel");
 
-// ── Daemon callback registry ─────────────────────────────────────────
-
-type CancelCallback = (conversationId: string) => boolean;
-
-let _cancelGeneration: CancelCallback | null = null;
-
-/**
- * Register the cancel-generation callback. Called once by the daemon
- * server at startup so the signal handler can reach the conversation map.
- */
-export function registerCancelCallback(cb: CancelCallback): void {
-  _cancelGeneration = cb;
-}
-
 // ── Signal handler ───────────────────────────────────────────────────
 
 /**
@@ -52,17 +41,19 @@ export function handleCancelSignal(): void {
       return;
     }
 
-    if (!_cancelGeneration) {
-      log.warn("Cancel callback not registered; daemon may not be ready");
+    const conversation = findConversation(conversationId);
+    if (!conversation) {
+      log.warn({ conversationId }, "No active conversation for cancel signal");
       return;
     }
 
-    const found = _cancelGeneration(conversationId);
-    if (found) {
-      log.info({ conversationId }, "Generation cancelled via signal file");
-    } else {
-      log.warn({ conversationId }, "No active conversation for cancel signal");
-    }
+    touchConversation(conversationId);
+    conversation.abort(
+      createAbortReason("signal_cancel", "handleCancelSignal", conversationId),
+    );
+    getSubagentManager().abortAllForParent(conversationId);
+
+    log.info({ conversationId }, "Generation cancelled via signal file");
   } catch (err) {
     log.error({ err }, "Failed to handle cancel signal");
   }

package/src/signals/conversation-undo.ts

@@ -7,37 +7,18 @@
  * {@link handleConversationUndoSignal}, which reads the payload, performs
  * the undo, and writes `signals/conversation-undo.result` so the CLI
  * receives feedback.
- *
- * Because the signal handler needs access to the daemon's conversation map, the
- * daemon registers a callback at startup via
- * {@link registerConversationUndoCallback}.
  */
 
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
+import { undoLastMessage } from "../daemon/handlers/conversations.js";
 import { getLogger } from "../util/logger.js";
 import { getSignalsDir } from "../util/platform.js";
 
 const log = getLogger("signal:conversation-undo");
 
-// ── Daemon callback registry ─────────────────────────────────────────
-
-type UndoCallback = (
-  conversationId: string,
-) => Promise<{ removedCount: number } | null>;
-
-let _undoLastMessage: UndoCallback | null = null;
-
-/**
- * Register the undo callback. Called once by the daemon server at startup
- * so the signal handler can reach the conversation map.
- */
-export function registerConversationUndoCallback(cb: UndoCallback): void {
-  _undoLastMessage = cb;
-}
-
 // ── Signal handler ───────────────────────────────────────────────────
 
 /**
@@ -93,13 +74,7 @@ export async function handleConversationUndoSignal(): Promise<void> {
       return;
     }
 
-    if (!_undoLastMessage) {
-      log.warn("Undo callback not registered; daemon may not be ready");
-      writeResult({ ok: false, error: "Assistant not ready", requestId });
-      return;
-    }
-
-    const result = await _undoLastMessage(conversationId);
+    const result = await undoLastMessage(conversationId);
     if (!result) {
       log.warn({ conversationId }, "No active conversation for undo signal");
       writeResult({ ok: false, error: "No active conversation", requestId });

package/src/signals/emit-event.ts

@@ -18,7 +18,6 @@ import { join } from "node:path";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import { buildAssistantEvent } from "../runtime/assistant-event.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getLogger } from "../util/logger.js";
 import { getSignalsDir } from "../util/platform.js";
 
@@ -30,7 +29,7 @@ export function handleEmitEventSignal(): void {
     const message = JSON.parse(content) as ServerMessage;
 
     assistantEventHub
-      .publish(buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message))
+      .publish(buildAssistantEvent(message))
       .catch((err: unknown) => {
         log.error({ err }, "Failed to publish event from signal");
       });

package/src/signals/user-message.ts

@@ -9,15 +9,24 @@
  *
  * Per-request filenames avoid dropped messages when overlapping invocations
  * race on the same signal file.
- *
- * Because the signal handler needs access to the daemon's conversation map and
- * event hub, the daemon registers a callback at startup via
- * {@link registerUserMessageCallback}.
  */
 
-import { readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { getOrCreateConversation } from "../daemon/conversation-store.js";
+import type { UserMessageAttachment } from "../daemon/message-types/shared.js";
+import {
+  processMessageInBackground,
+  resolveTurnChannel,
+  resolveTurnInterface,
+} from "../daemon/process-message.js";
+import {
+  uploadFileBackedAttachment,
+  validateAttachmentUpload,
+} from "../memory/attachments-store.js";
+import { getOrCreateConversation as getOrCreateConversationKey } from "../memory/conversation-key-store.js";
+import { checkIngressForSecrets } from "../security/secret-ingress.js";
 import { getLogger } from "../util/logger.js";
 import { getSignalsDir } from "../util/platform.js";
 
@@ -35,25 +44,108 @@ export interface SignalAttachment {
   mimeType: string;
 }
 
-// ── Daemon callback registry ─────────────────────────────────────────
+// ── Dispatch helper ──────────────────────────────────────────────────
 
-type UserMessageCallback = (params: {
+async function dispatchUserMessage(params: {
   conversationKey: string;
   content: string;
   sourceChannel: string;
   sourceInterface: string;
   bypassSecretCheck?: boolean;
   attachments?: SignalAttachment[];
-}) => Promise<{ accepted: boolean; error?: string; message?: string }>;
+}): Promise<{ accepted: boolean; error?: string; message?: string }> {
+  if (!params.bypassSecretCheck) {
+    const ingressResult = checkIngressForSecrets(params.content);
+    if (ingressResult.blocked) {
+      return {
+        accepted: false,
+        error: "secret_blocked" as const,
+        message: ingressResult.userNotice,
+      };
+    }
+  }
 
-let _sendUserMessage: UserMessageCallback | null = null;
+  const { conversationId } = getOrCreateConversationKey(params.conversationKey);
+  const conversation = await getOrCreateConversation(conversationId);
 
-/**
- * Register the user-message callback. Called once by the daemon server at
- * startup so the signal handler can reach the conversation map and event hub.
- */
-export function registerUserMessageCallback(cb: UserMessageCallback): void {
-  _sendUserMessage = cb;
+  const attachmentIds: string[] = [];
+  const resolvedAttachments: UserMessageAttachment[] = [];
+  if (params.attachments && params.attachments.length > 0) {
+    for (const a of params.attachments) {
+      try {
+        const validation = validateAttachmentUpload(a.filename, a.mimeType);
+        if (!validation.ok) {
+          log.warn(
+            { error: validation.error, path: a.path },
+            "Signal attachment rejected by validation",
+          );
+          continue;
+        }
+        const size = statSync(a.path).size;
+        const stored = uploadFileBackedAttachment(
+          a.filename,
+          a.mimeType,
+          a.path,
+          size,
+        );
+        attachmentIds.push(stored.id);
+        resolvedAttachments.push({
+          id: stored.id,
+          filename: a.filename,
+          mimeType: a.mimeType,
+          data: "",
+          filePath: a.path,
+        });
+      } catch (err) {
+        log.warn({ err, path: a.path }, "Failed to register signal attachment");
+      }
+    }
+  }
+
+  if (conversation.isProcessing()) {
+    for (let i = resolvedAttachments.length - 1; i >= 0; i--) {
+      const att = resolvedAttachments[i];
+      if (att.filePath && !att.data) {
+        try {
+          att.data = readFileSync(att.filePath).toString("base64");
+        } catch (err) {
+          log.warn(
+            { err, path: att.filePath },
+            "Failed to read queued signal attachment, skipping",
+          );
+          resolvedAttachments.splice(i, 1);
+        }
+      }
+    }
+    const requestId = crypto.randomUUID();
+    const resolvedChannel = resolveTurnChannel(params.sourceChannel);
+    const resolvedInterface = resolveTurnInterface(params.sourceInterface);
+    const result = conversation.enqueueMessage(
+      params.content,
+      resolvedAttachments,
+      undefined,
+      requestId,
+      undefined,
+      undefined,
+      {
+        userMessageChannel: resolvedChannel,
+        assistantMessageChannel: resolvedChannel,
+        userMessageInterface: resolvedInterface,
+        assistantMessageInterface: resolvedInterface,
+      },
+    );
+    return { accepted: !result.rejected };
+  }
+
+  await processMessageInBackground(
+    conversationId,
+    params.content,
+    attachmentIds.length > 0 ? attachmentIds : undefined,
+    undefined,
+    params.sourceChannel,
+    params.sourceInterface,
+  );
+  return { accepted: true };
 }
 
 // ── Signal handler ───────────────────────────────────────────────────
@@ -143,12 +235,6 @@ export async function handleUserMessageSignal(filename: string): Promise<void> {
       return;
     }
 
-    if (!_sendUserMessage) {
-      log.warn("User-message callback not registered; daemon may not be ready");
-      writeResult({ ok: false, error: "Assistant not ready", requestId });
-      return;
-    }
-
     // Validate and normalize attachments
     const attachments: SignalAttachment[] = [];
     if (Array.isArray(parsed.attachments)) {
@@ -167,7 +253,7 @@ export async function handleUserMessageSignal(filename: string): Promise<void> {
       }
     }
 
-    const result = await _sendUserMessage({
+    const result = await dispatchUserMessage({
       conversationKey: parsed.conversationKey,
       content: parsed.content,
       sourceChannel: parsed.sourceChannel ?? "vellum",

package/src/skills/catalog-install.ts

@@ -30,6 +30,7 @@ export interface CatalogSkill {
   emoji?: string;
   includes?: string[];
   version?: string;
+  updatedAt?: string;
   metadata?: {
     vellum?: {
       "display-name"?: string;

package/src/skills/clawhub.ts

@@ -181,7 +181,7 @@ async function runClawhub(
   const { mkdirSync } = await import("node:fs");
   mkdirSync(cwd, { recursive: true });
 
-  log.info({ args, cwd }, "Running clawhub command");
+  log.debug({ args, cwd }, "Running clawhub command");
 
   const proc = Bun.spawn(["npx", "clawhub", ...args], {
     cwd,
@@ -211,7 +211,7 @@ async function runClawhub(
 
   const exitCode = await proc.exited;
 
-  log.info(
+  log.debug(
     { exitCode, stdoutLen: stdout.length, stderrLen: stderr.length },
     "clawhub command completed",
   );

package/src/skills/inline-command-runner.ts

@@ -24,7 +24,6 @@
 import { spawn } from "node:child_process";
 
 import { buildSanitizedEnv } from "../tools/terminal/safe-env.js";
-import { wrapCommand } from "../tools/terminal/sandbox.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("inline-command-runner");
@@ -105,12 +104,7 @@ export async function runInlineCommand(
   const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const maxChars = options?.maxOutputChars ?? MAX_OUTPUT_CHARS;
 
-  // Sandbox is disabled — the assistant runs in Docker or platform-managed
-  // environments where the container provides isolation. The networkMode
-  // option is a no-op when sandbox is disabled (wrapCommand returns a plain
-  // bash invocation); network isolation is handled at the container level.
-  const sandboxConfig = { enabled: false } as const;
-  const wrapped = wrapCommand(command, workingDir, sandboxConfig);
+  const wrapped = { command: "bash", args: ["-c", "--", command] };
 
   // Build a minimal, sanitized environment. Explicitly exclude gateway URL,
   // workspace dir, and data dir since inline commands have no business calling

package/src/subagent/manager.ts

@@ -116,13 +116,6 @@ export interface SubagentNotificationInfo {
   conversationId?: string;
 }
 
-export type ParentNotifyCallback = (
-  parentConversationId: string,
-  message: string,
-  sendToClient: (msg: ServerMessage) => void,
-  notification: SubagentNotificationInfo,
-) => void;
-
 export class SubagentManager {
   /** subagentId → ManagedSubagent */
   private subagents = new Map<string, ManagedSubagent>();
@@ -131,26 +124,12 @@ export class SubagentManager {
   /** `${parentConversationId}:${normalizedLabel}` → subagentId */
   private labelIndex = new Map<string, string>();
 
-  /**
-   * Optional callback to inject a completion/failure message into the parent
-   * conversation so the LLM can automatically inform the user.
-   * Wired by DaemonServer at startup.
-   */
-  onSubagentFinished?: ParentNotifyCallback;
-
   /**
    * Shared rate-limit timestamps array from the daemon server.
    * Set by DaemonServer at startup so subagents share the global rate limit.
    */
   sharedRequestTimestamps: number[] = [];
 
-  /**
-   * Broadcast callback from the daemon server.
-   * Set by DaemonServer at startup so subagent conversations can broadcast
-   * to all connected clients (e.g. app_files_changed side-effects).
-   */
-  broadcastToAllClients?: (msg: ServerMessage) => void;
-
   // ── Spawn ───────────────────────────────────────────────────────────
 
   /**
@@ -310,7 +289,6 @@ export class SubagentManager {
       maxTokens,
       wrappedSendToClient,
       workingDir,
-      this.broadcastToAllClients, // forward parent's broadcast so tool side-effects (e.g. app_files_changed) reach all clients
       memoryPolicy,
       undefined, // sharedCesClient
       undefined, // speedOverride
@@ -427,8 +405,6 @@ export class SubagentManager {
     this.setStatus(subagentId, "running", getSender());
     managed.state.startedAt = Date.now();
 
-    const onEvent = conversation.sendToClient;
-
     try {
       // For forks, inject the parent's message history before the first message.
       // This prepends the inherited context so the fork has full conversational
@@ -462,7 +438,7 @@ export class SubagentManager {
           ].join("\n")
         : objective;
       const messageId = await conversation.persistUserMessage(message, []);
-      await conversation.runAgentLoop(message, messageId, onEvent, {
+      await conversation.runAgentLoop(message, messageId, undefined, {
         callSite: "subagentSpawn",
         ...(managed.state.config.overrideProfile
           ? { overrideProfile: managed.state.config.overrideProfile }
@@ -480,7 +456,7 @@ export class SubagentManager {
         log.info({ subagentId }, "Subagent completed");
 
         // Notify the parent conversation so the LLM can call subagent_read.
-        this.notifyParentTerminal(managed, "completed", getSender());
+        this.notifyParentTerminal(managed, "completed");
       }
     } catch (err) {
       const errorMsg = err instanceof Error ? err.message : String(err);
@@ -493,7 +469,7 @@ export class SubagentManager {
       // Only update status if not already terminal (e.g. aborted).
       if (!TERMINAL_STATUSES.has(managed.state.status)) {
         this.setStatus(subagentId, "failed", getSender(), errorMsg);
-        this.notifyParentTerminal(managed, "failed", getSender());
+        this.notifyParentTerminal(managed, "failed");
       }
 
       log.error({ subagentId, err }, "Subagent failed");
@@ -566,30 +542,24 @@ export class SubagentManager {
       this.setStatus(subagentId, "aborted", statusSender);
       // Notify parent that the subagent was explicitly aborted — tell it NOT to re-spawn.
       // Skip when the parent LLM itself called subagent_abort (it already has the tool result).
-      if (this.onSubagentFinished && !options?.suppressNotification) {
+      if (!options?.suppressNotification) {
         const label = managed.state.config.label;
         const prefix = managed.state.isFork ? "Fork" : "Subagent";
         const message =
           `[${prefix} "${label}" was explicitly aborted]\n\n` +
           `This ${prefix.toLowerCase()} was cancelled on purpose. Do NOT re-spawn or retry it.`;
-        try {
-          // Use the managed subagent's stored parentSendToClient so the
-          // notification routes to the parent conversation's socket, not the
-          // aborting socket (which may be a different conversation after switching).
-          this.onSubagentFinished(
-            managed.state.config.parentConversationId,
-            message,
-            managed.parentSendToClient,
-            {
+        this.injectMessageIntoParent(
+          managed.state.config.parentConversationId,
+          message,
+          {
+            subagentNotification: {
               subagentId,
               label,
-              status: "aborted",
+              status: "aborted" as const,
               conversationId: managed.state.conversationId,
             },
-          );
-        } catch (err) {
-          log.error({ subagentId, err }, "Failed to notify parent about abort");
-        }
+          },
+        );
       }
     } else {
       managed.state.status = "aborted";
@@ -640,18 +610,10 @@ export class SubagentManager {
     if (TERMINAL_STATUSES.has(managed.state.status) || !managed.conversation)
       return "terminal";
 
-    const onEvent = managed.conversation.sendToClient;
-    const requestId = uuid();
-
     // If the conversation is busy, queue the message; otherwise process immediately.
-    const result = managed.conversation.enqueueMessage(
-      trimmed,
-      [],
-      onEvent,
-      requestId,
-    );
+    const result = managed.conversation.enqueueMessage(trimmed, []);
     if (result.rejected) {
-      return "sent"; // error event already delivered via onEvent
+      return "sent"; // error event already delivered via sendToClient
     }
     if (result.queued) {
       managed.hadEnqueuedMessages = true;
@@ -662,7 +624,7 @@ export class SubagentManager {
       const conversation = managed.conversation;
       const messageId = await conversation.persistUserMessage(trimmed, []);
       conversation
-        .runAgentLoop(trimmed, messageId, onEvent, {
+        .runAgentLoop(trimmed, messageId, undefined, {
           callSite: "subagentSpawn",
           ...(managed.state.config.overrideProfile
             ? { overrideProfile: managed.state.config.overrideProfile }
@@ -928,7 +890,6 @@ export class SubagentManager {
 
     const managed = this.subagents.get(info.subagentId);
     if (!managed || TERMINAL_STATUSES.has(managed.state.status)) return false;
-    if (!this.onSubagentFinished) return false;
 
     const prefix = managed.state.isFork ? "Fork" : "Subagent";
     let notificationString = `[${prefix} "${info.label}" — ${urgency}] ${message}`;
@@ -936,25 +897,18 @@ export class SubagentManager {
       notificationString += `\nUse subagent_message to send guidance to this ${prefix.toLowerCase()}.`;
     }
 
-    try {
-      this.onSubagentFinished(
-        info.parentConversationId,
-        notificationString,
-        info.parentSendToClient,
-        {
+    this.injectMessageIntoParent(
+      info.parentConversationId,
+      notificationString,
+      {
+        subagentNotification: {
           subagentId: info.subagentId,
           label: info.label,
-          status: "running",
+          status: "running" as const,
         },
-      );
-      return true;
-    } catch (err) {
-      log.error(
-        { subagentId: info.subagentId, err },
-        "Failed to notify parent from subagent",
-      );
-      return false;
-    }
+      },
+    );
+    return true;
   }
 
   /**
@@ -964,10 +918,7 @@ export class SubagentManager {
   private notifyParentTerminal(
     managed: ManagedSubagent,
     outcome: "completed" | "failed",
-    parentSendToClient: (msg: ServerMessage) => void,
   ): void {
-    if (!this.onSubagentFinished) return;
-
     const { config } = managed.state;
     const isFork = managed.state.isFork;
     let message: string;
@@ -1009,18 +960,50 @@ export class SubagentManager {
         : {}),
     };
 
-    try {
-      this.onSubagentFinished(
-        config.parentConversationId,
-        message,
-        parentSendToClient,
-        notification,
-      );
-    } catch (err) {
-      log.error(
-        { subagentId: config.id, err },
-        "Failed to notify parent conversation",
+    this.injectMessageIntoParent(config.parentConversationId, message, {
+      subagentNotification: notification,
+    });
+  }
+
+  /**
+   * Inject a notification message into the parent conversation so the LLM
+   * sees subagent lifecycle events. Relies on the parent conversation's
+   * sendToClient (backed by broadcastMessage) for event delivery.
+   */
+  private injectMessageIntoParent(
+    parentConversationId: string,
+    message: string,
+    metadata?: Record<string, unknown>,
+  ): void {
+    const parentConversation = findConversation(parentConversationId);
+    if (!parentConversation) {
+      log.warn(
+        { parentConversationId },
+        "Subagent finished but parent conversation not found",
       );
+      return;
+    }
+    const enqueueResult = parentConversation.enqueueMessage(
+      message,
+      [],
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      metadata,
+    );
+    if (!enqueueResult.queued && !enqueueResult.rejected) {
+      parentConversation
+        .persistUserMessage(message, [], undefined, metadata)
+        .then((messageId) =>
+          parentConversation.runAgentLoop(message, messageId),
+        )
+        .catch((err) => {
+          log.error(
+            { parentConversationId, err },
+            "Failed to process subagent notification in parent",
+          );
+        });
     }
   }
 }