@vellumai/assistant 0.7.0 → 0.7.2

package/src/daemon/conversation-surfaces.ts

@@ -1,6 +1,7 @@
 import { v4 as uuid } from "uuid";
 
 import {
+  addAppConversationId,
   getApp,
   getAppDirPath,
   getAppPreview,
@@ -13,15 +14,20 @@ import {
   getMessages,
   updateMessageContent,
 } from "../memory/conversation-crud.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "../runtime/assistant-event-hub.js";
 import type {
   InteractiveUiRequest,
   InteractiveUiResult,
-} from "../runtime/interactive-ui.js";
+} from "../runtime/interactive-ui-types.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
 import { isPlainObject } from "../util/object.js";
 import { buildConversationErrorMessage } from "./conversation-error.js";
 import { launchConversation } from "./conversation-launch.js";
+import type { HostAppControlProxy } from "./host-app-control-proxy.js";
 import type { HostCuProxy } from "./host-cu-proxy.js";
 import type {
   CardSurfaceData,
@@ -39,6 +45,7 @@ import type {
 } from "./message-protocol.js";
 import { INTERACTIVE_SURFACE_TYPES } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
+import type { HostAppControlInput } from "./message-types/host-app-control.js";
 import type { UserMessageAttachment } from "./message-types/shared.js";
 import type { TrustContext } from "./trust-context.js";
 
@@ -255,7 +262,6 @@ export interface SurfaceConversationContext {
     emit(type: string, message: string, meta?: Record<string, unknown>): void;
   };
   sendToClient(msg: ServerMessage): void;
-  broadcastToAllClients?(msg: ServerMessage): void;
   pendingSurfaceActions: Map<string, { surfaceType: SurfaceType }>;
   lastSurfaceAction: Map<
     string,
@@ -319,14 +325,23 @@ export interface SurfaceConversationContext {
   }>;
   /** Optional proxy for delegating computer-use actions to a connected desktop client. */
   hostCuProxy?: HostCuProxy;
+  /** Optional proxy for delegating per-app app-control actions to a connected desktop client. */
+  hostAppControlProxy?: HostAppControlProxy;
+  /**
+   * Setter that lets the resolver detach the conversation's app-control proxy
+   * after `app_control_stop`. Disposes the existing proxy when transitioning
+   * to undefined so subsequent tool calls cleanly fail with "unavailable"
+   * rather than dispatching to a torn-down proxy.
+   */
+  setHostAppControlProxy?(proxy: HostAppControlProxy | undefined): void;
   /** True when no interactive client is connected (headless / channel-only). */
   readonly hasNoClient?: boolean;
   isProcessing(): boolean;
   enqueueMessage(
     content: string,
     attachments: UserMessageAttachment[],
-    onEvent: (msg: ServerMessage) => void,
-    requestId: string,
+    onEvent?: (msg: ServerMessage) => void,
+    requestId?: string,
     activeSurfaceId?: string,
     currentPage?: string,
     metadata?: Record<string, unknown>,
@@ -338,7 +353,7 @@ export interface SurfaceConversationContext {
   processMessage(
     content: string,
     attachments: UserMessageAttachment[],
-    onEvent: (msg: ServerMessage) => void,
+    onEvent?: (msg: ServerMessage) => void,
     requestId?: string,
     activeSurfaceId?: string,
     currentPage?: string,
@@ -485,9 +500,7 @@ export function showStandaloneSurface(
       // the client side, preventing stale user interactions from reaching
       // handleSurfaceAction and being misrouted to the LLM.
       try {
-        const emitTimeout =
-          ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-        emitTimeout({
+        broadcastMessage({
           type: "ui_surface_complete",
           conversationId: ctx.conversationId,
           surfaceId,
@@ -523,9 +536,7 @@ export function showStandaloneSurface(
       actions,
     });
 
-    // ── Emit to client ──
-    const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-    emit({
+    broadcastMessage({
       type: "ui_surface_show",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -994,9 +1005,7 @@ export async function handleSurfaceAction(
       summary,
     };
 
-    // Emit ui_surface_complete so the client transitions the surface chip.
-    const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-    emit({
+    broadcastMessage({
       type: "ui_surface_complete",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1211,12 +1220,11 @@ export async function handleSurfaceAction(
 
     const requestId = uuid();
     ctx.surfaceActionRequestIds.add(requestId);
-    // Use broadcastToAllClients (publishes to the SSE event hub) instead of
-    // sendToClient, which is reset to a no-op between HTTP requests. Without
-    // this, surface action responses are persisted to DB but never reach the
-    // client's SSE stream.
-    const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-    const onEvent = (msg: ServerMessage) => emit(msg);
+    // Pass conversationId so events without an inline conversationId (e.g.
+    // text_delta) are published with the correct conversation scope and
+    // reach the SSE subscriber filtered to this conversation.
+    const onEvent = (msg: ServerMessage) =>
+      broadcastMessage(msg, ctx.conversationId);
 
     ctx.traceEmitter.emit("request_received", "Surface action received", {
       requestId,
@@ -1250,7 +1258,7 @@ export async function handleSurfaceAction(
     // Echo the prompt to the client so it appears in the chat UI.
     // Deferred until after rejection check to avoid ghost messages.
     if (prompt) {
-      emit({
+      broadcastMessage({
         type: "user_message_echo",
         text: prompt,
         conversationId: ctx.conversationId,
@@ -1350,16 +1358,11 @@ export async function handleSurfaceAction(
     surfaceData,
   );
 
-  // Use broadcastToAllClients so events reach the SSE hub — sendToClient is
-  // reset to a no-op between HTTP requests (see history-restored path for
-  // full rationale).
-  const emit = ctx.broadcastToAllClients ?? ctx.sendToClient.bind(ctx);
-
   // Forms are one-shot surfaces — auto-complete immediately so the client
   // transitions from the "Submitting…" spinner to a completion chip without
   // requiring the LLM to call ui_dismiss.
   if (pending.surfaceType === "form") {
-    emit({
+    broadcastMessage({
       type: "ui_surface_complete",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1455,7 +1458,11 @@ export async function handleSurfaceAction(
 
   const requestId = uuid();
   ctx.surfaceActionRequestIds.add(requestId);
-  const onEvent = (msg: ServerMessage) => emit(msg);
+  // Pass conversationId so events without an inline conversationId (e.g.
+  // text_delta) are published with the correct conversation scope and
+  // reach the SSE subscriber filtered to this conversation.
+  const onEvent = (msg: ServerMessage) =>
+    broadcastMessage(msg, ctx.conversationId);
 
   ctx.traceEmitter.emit("request_received", "Surface action received", {
     requestId,
@@ -1503,7 +1510,7 @@ export async function handleSurfaceAction(
   // Echo the user's prompt to the client so it appears in the chat UI.
   // Deferred until after rejection check to avoid ghost messages.
   if (shouldRelayPrompt && prompt) {
-    emit({
+    broadcastMessage({
       type: "user_message_echo",
       text: prompt,
       conversationId: ctx.conversationId,
@@ -1567,6 +1574,7 @@ export async function handleSurfaceAction(
       );
       onEvent({
         type: "error",
+        conversationId: ctx.conversationId,
         message: `Failed to process surface action: ${message}`,
       });
     });
@@ -1775,6 +1783,56 @@ export async function surfaceProxyResolver(
     // Record the action and proxy to the connected desktop client
     const reasoning =
       typeof input.reasoning === "string" ? input.reasoning : undefined;
+    const targetClientId =
+      typeof input.target_client_id === "string" && input.target_client_id !== ""
+        ? input.target_client_id
+        : undefined;
+
+    // Validate targetClientId before recordAction so an invalid ID does not
+    // burn a step or pollute action history. (HostBashProxy / HostFileProxy
+    // both validate at the tool-resolution layer before incrementing any
+    // state; this mirrors that behaviour for CU.)
+    if (targetClientId != null) {
+      const client = assistantEventHub.getClientById(targetClientId);
+      if (!client) {
+        return {
+          content: `No connected client with id '${targetClientId}'. Run \`assistant clients list --capability host_cu\` to see available clients.`,
+          isError: true,
+        };
+      }
+      if (!client.capabilities.includes("host_cu")) {
+        return {
+          content: `Client '${targetClientId}' does not support host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
+          isError: true,
+        };
+      }
+    }
+
+    // Guard: require explicit targeting when multiple CU-capable clients are
+    // connected. The tool schemas document target_client_id as "required when
+    // multiple clients support host_cu" but nothing enforced it at runtime
+    // until now. Without this guard, the request would broadcast to all
+    // capable clients simultaneously, causing the same CU action to execute
+    // on multiple machines.
+    //
+    // Asymmetry with host_bash / host_file (host-shell.ts): the bash/file
+    // guard additionally checks `transportInterface != null &&
+    // !supportsHostProxy(transportInterface)` and so only fires for non-host-
+    // proxy transports (web, Slack). For CU that check would be a no-op:
+    // every host_cu-capable client is host-proxy-capable by definition
+    // (host_cu only ships on macOS and the Chrome extension), so there is no
+    // host_cu-capable transport for which auto-routing-to-self would be
+    // appropriate. We therefore fire whenever there is genuine ambiguity.
+    if (targetClientId == null) {
+      const cuClients = assistantEventHub.listClientsByCapability("host_cu");
+      if (cuClients.length > 1) {
+        return {
+          content: `Error: multiple clients support host_cu. Specify which client to target with \`target_client_id\`. Run \`assistant clients list --capability host_cu\` to see client IDs and labels.`,
+          isError: true,
+        };
+      }
+    }
+
     ctx.hostCuProxy.recordAction(toolName, input, reasoning);
     return ctx.hostCuProxy.request(
       toolName,
@@ -1783,6 +1841,55 @@ export async function surfaceProxyResolver(
       ctx.hostCuProxy.stepCount,
       reasoning,
       signal,
+      targetClientId,
+    );
+  }
+
+  // Route app-control proxy tools (all app_control_* tool variants)
+  if (toolName.startsWith("app_control_")) {
+    if (!ctx.hostAppControlProxy || !ctx.hostAppControlProxy.isAvailable()) {
+      return {
+        content:
+          "App control is not available — enable the `app-control` feature flag and connect a macOS client.",
+        isError: true,
+      };
+    }
+
+    // `app_control_stop` resolves immediately: tear down the proxy without
+    // a client round-trip. Mirrors CU's terminal-tool short-circuit
+    // (`computer_use_done` / `computer_use_respond`). Clear the
+    // conversation's reference (setter disposes the existing proxy) so a
+    // later `app_control_observe`/etc. cleanly fails with "unavailable"
+    // instead of dispatching against a torn-down proxy, and so a sibling
+    // conversation can acquire the released singleton lock without the
+    // disposed proxy still being addressable.
+    if (toolName === "app_control_stop") {
+      if (ctx.setHostAppControlProxy) {
+        ctx.setHostAppControlProxy(undefined);
+      } else {
+        ctx.hostAppControlProxy.dispose();
+      }
+      return { content: "App control stopped.", isError: false };
+    }
+
+    // The TS `HostAppControlInput` (and the Swift mirror) is a discriminated
+    // union on `tool` ("start" | "observe" | "press" | …). The agent's raw
+    // tool input only carries the action-specific payload (app, x/y, text,
+    // …) — the discriminator is implied by `toolName` (`app_control_<tool>`).
+    // Inject it here so the proxy's singleton-lock guard (`input.tool ===
+    // "start"`) and the Swift client's discriminated-union decoder both see
+    // the field they require.
+    const tool = toolName.slice("app_control_".length);
+    const inputWithTool = {
+      ...input,
+      tool,
+    } as unknown as HostAppControlInput;
+
+    return ctx.hostAppControlProxy.request(
+      toolName,
+      inputWithTool,
+      ctx.conversationId,
+      signal ?? new AbortController().signal,
     );
   }
 
@@ -2016,6 +2123,14 @@ export async function surfaceProxyResolver(
     const openMode = input.open_mode as string | undefined;
     const app = getApp(appId);
     if (!app) return { content: `App not found: ${appId}`, isError: true };
+
+    // Track conversation association (best-effort — failures must not break open flow).
+    try {
+      addAppConversationId(appId, ctx.conversationId);
+    } catch (err) {
+      log.warn({ err, appId }, "Failed to track conversation ID on app_open");
+    }
+
     // Generate a minimal fallback preview from app metadata so that the
     // surface is always rendered as a clickable preview card (not an
     // un-clickable fallback chip) after conversation restart.

package/src/daemon/conversation-tool-setup.ts

@@ -13,12 +13,12 @@ import {
 } from "../channels/types.js";
 import { isHttpAuthDisabled } from "../config/env.js";
 import { getIsPlatform } from "../config/env-registry.js";
-import type { CesClient } from "../credential-execution/client.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { coreAppProxyTools } from "../tools/apps/definitions.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -43,7 +43,6 @@ import {
   projectSkillTools,
   type SkillProjectionCache,
 } from "./conversation-skill-tools.js";
-import type { SurfaceConversationContext } from "./conversation-surfaces.js";
 import { surfaceProxyResolver } from "./conversation-surfaces.js";
 import {
   isDoordashCommand,
@@ -72,67 +71,8 @@ export function resolveTrustClass(
   return trustContext?.trustClass ?? "unknown";
 }
 
-// ── Context Interface ────────────────────────────────────────────────
-
-/**
- * Subset of Conversation state that the tool executor callback reads at
- * call time (not construction time). These are captured by the
- * returned closure, so they must be live references.
- */
-export interface ToolSetupContext extends SurfaceConversationContext {
-  readonly conversationId: string;
-  assistantId?: string;
-  currentRequestId?: string;
-  workingDir: string;
-  abortController: AbortController | null;
-  /** When set, only tools in this set may execute during the current turn. */
-  allowedToolNames?: Set<string>;
-  /** Conversation memory policy used to propagate scopeId into ToolContext. */
-  memoryPolicy: { scopeId: string };
-  /** True when the conversation has no connected client (HTTP-only path). */
-  hasNoClient?: boolean;
-  /** When true, the conversation is executing a task run and must not become interactive. */
-  headlessLock?: boolean;
-  /** When set, this conversation is executing a task run. Used to retrieve ephemeral permission rules. */
-  taskRunId?: string;
-  /** Guardian runtime context for the conversation — trustClass is propagated into ToolContext for control-plane policy enforcement. */
-  trustContext?: TrustContext;
-  /** Voice/call session ID, if the conversation originates from a call. Propagated into ToolContext for scoped grant consumption. */
-  callSessionId?: string;
-  /** Optional proxy for delegating host_bash execution to a connected client. */
-  hostBashProxy?: import("./host-bash-proxy.js").HostBashProxy;
-  /** Optional proxy for delegating CDP commands to a connected client (managed/cloud-hosted mode). */
-  hostBrowserProxy?: import("./host-browser-proxy.js").HostBrowserProxy;
-  /** Optional proxy for delegating host_file_read/write/edit execution to a connected client. */
-  hostFileProxy?: import("./host-file-proxy.js").HostFileProxy;
-  /** Optional proxy for delegating bidirectional file transfers between sandbox and host. */
-  hostTransferProxy?: import("./host-transfer-proxy.js").HostTransferProxy;
-  /** CES RPC client for credential execution operations. Injected when CES tools are enabled and the CES process is available. */
-  cesClient?: CesClient;
-  /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
-  readonly transportInterface?: InterfaceId;
-  /**
-   * Registry-routed sender override for the host browser proxy. When set
-   * (non-undefined), indicates the browser proxy sender was replaced by a
-   * ChromeExtensionRegistry WebSocket sender — i.e., an extension connection
-   * was actively wired at turn-start. Propagated into ToolContext as
-   * `hostBrowserRegistryRouted` (boolean) so the CDP factory can distinguish
-   * SSE-backed proxies from extension-backed proxies.
-   */
-  hostBrowserSenderOverride?: (
-    msg: import("./message-protocol.js").ServerMessage,
-  ) => void;
-  /** Turn-scoped flag: true when any tool call in the current turn received explicit user approval via interactive prompt. Cleared at turn end. */
-  approvedViaPromptThisTurn?: boolean;
-  /**
-   * Per-turn snapshot of the resolved inference-profile override, set by
-   * `runAgentLoopImpl`. Propagated into `ToolContext.overrideProfile` so
-   * tools that spawn nested invocations (e.g. `subagent_spawn`) can forward
-   * the override without round-tripping through a row read that would
-   * return `undefined` for the in-flight (background) subagent.
-   */
-  currentTurnOverrideProfile?: string;
-}
+import type { ToolSetupContext } from "./tool-setup-types.js";
+export type { ToolSetupContext } from "./tool-setup-types.js";
 
 // ── buildToolDefinitions ─────────────────────────────────────────────
 
@@ -162,7 +102,6 @@ export function createToolExecutor(
   secretPrompter: SecretPrompter,
   ctx: ToolSetupContext,
   handleToolLifecycleEvent: ToolLifecycleEventHandler,
-  broadcastToAllClients?: (msg: ServerMessage) => void,
 ): (
   name: string,
   input: Record<string, unknown>,
@@ -214,14 +153,9 @@ export function createToolExecutor(
       allowedToolNames: ctx.allowedToolNames,
       memoryScopeId: ctx.memoryPolicy.scopeId,
       toolUseId,
-      hostBashProxy: ctx.hostBashProxy,
-      hostBrowserProxy: ctx.hostBrowserProxy,
-      hostFileProxy: ctx.hostFileProxy,
-      hostTransferProxy: ctx.hostTransferProxy,
       isPlatformHosted: getIsPlatform(),
       cesClient: ctx.cesClient,
       transportInterface: ctx.transportInterface,
-      hostBrowserRegistryRouted: !!ctx.hostBrowserSenderOverride,
       overrideProfile: ctx.currentTurnOverrideProfile,
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
@@ -282,16 +216,6 @@ export function createToolExecutor(
       // Clone to avoid mutating shared input objects
       const toolInput = { ...rawToolInput };
 
-      // Propagate outer activity when inner input lacks a valid one
-      if (
-        typeof input.activity === "string" &&
-        input.activity &&
-        (typeof toolInput.activity !== "string" ||
-          toolInput.activity.length === 0)
-      ) {
-        toolInput.activity = input.activity;
-      }
-
       if (!toolName) {
         return {
           content:
@@ -310,10 +234,7 @@ export function createToolExecutor(
         ctx.approvedViaPromptThisTurn = true;
       }
 
-      runPostExecutionSideEffects(toolName, toolInput, result, {
-        ctx,
-        broadcastToAllClients,
-      });
+      runPostExecutionSideEffects(toolName, toolInput, result, { ctx });
 
       return result;
     }
@@ -328,10 +249,7 @@ export function createToolExecutor(
       ctx.approvedViaPromptThisTurn = true;
     }
 
-    runPostExecutionSideEffects(name, input, result, {
-      ctx,
-      broadcastToAllClients,
-    });
+    runPostExecutionSideEffects(name, input, result, { ctx });
 
     return result;
   };
@@ -467,6 +385,19 @@ export function isToolActiveForContext(
     // Per-capability check is authoritative for structural support: if the
     // transport cannot service this capability, the tool is filtered out.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
+      // Cross-client exception: allow host_bash for non-host-proxy interfaces when
+      // at least one capable client is connected via the event hub.
+      // Only applies to host_bash (not host_file, host_cu, host_browser — Phase 2).
+      // Excludes chrome-extension (security boundary: extension only gets host_browser)
+      // and hasNoClient turns (no interactive approval UI available).
+      if (
+        capability === "host_bash" &&
+        transport !== "chrome-extension" &&
+        !ctx.hasNoClient &&
+        assistantEventHub.listClientsByCapability("host_bash").length > 0
+      ) {
+        return true;
+      }
       return false;
     }
 

package/src/daemon/conversation-usage.ts

@@ -2,10 +2,13 @@ import { getConfig } from "../config/loader.js";
 import { updateConversationUsage } from "../memory/conversation-crud.js";
 import { recordUsageEvent } from "../memory/llm-usage-store.js";
 import type { UsageActor } from "../usage/actors.js";
+import { resolveUsageAttribution } from "../usage/attribution.js";
 import type {
   AnthropicCacheCreationTokenDetails,
   PricingResult,
   PricingUsage,
+  UsageAttributionInput,
+  UsageAttributionSnapshot,
 } from "../usage/types.js";
 import { getLogger } from "../util/logger.js";
 import {
@@ -117,6 +120,34 @@ function resolveStructuredPricing(
   }
 }
 
+function isUsageAttributionSnapshot(
+  attribution:
+    | UsageAttributionInput
+    | UsageAttributionSnapshot
+    | null
+    | undefined,
+): attribution is UsageAttributionSnapshot {
+  return (
+    attribution != null &&
+    typeof (attribution as UsageAttributionSnapshot).resolvedProvider ===
+      "string" &&
+    typeof (attribution as UsageAttributionSnapshot).resolvedModel === "string"
+  );
+}
+
+function resolveAttribution(
+  attribution:
+    | UsageAttributionInput
+    | UsageAttributionSnapshot
+    | null
+    | undefined,
+): UsageAttributionSnapshot | null {
+  if (attribution == null) return null;
+  return isUsageAttributionSnapshot(attribution)
+    ? attribution
+    : resolveUsageAttribution(attribution);
+}
+
 export function recordUsage(
   ctx: UsageContext,
   inputTokens: number,
@@ -130,6 +161,7 @@ export function recordUsage(
   rawResponse?: unknown,
   llmCallCount = 1,
   contextWindow?: { tokens: number; maxTokens: number },
+  attribution?: UsageAttributionInput | UsageAttributionSnapshot | null,
 ): void {
   if (inputTokens <= 0 && outputTokens <= 0) return;
 
@@ -193,6 +225,7 @@ export function recordUsage(
 
   // Dual-write: persist per-turn usage event to the new ledger table
   try {
+    const attributionSnapshot = resolveAttribution(attribution);
     recordUsageEvent(
       {
         actor,
@@ -206,6 +239,9 @@ export function recordUsage(
         runId: null,
         requestId,
         llmCallCount,
+        callSite: attributionSnapshot?.callSite ?? null,
+        inferenceProfile: attributionSnapshot?.appliedProfile ?? null,
+        inferenceProfileSource: attributionSnapshot?.profileSource ?? null,
       },
       pricing,
     );