@vellumai/assistant 0.7.1 → 0.7.2

package/src/daemon/message-types/host-cu.ts

@@ -8,6 +8,7 @@ export interface HostCuRequest {
   type: "host_cu_request";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
   toolName: string; // "computer_use_click", "computer_use_type_text", etc.
   input: Record<string, unknown>;
   stepNumber: number;
@@ -18,6 +19,7 @@ export interface HostCuCancelRequest {
   type: "host_cu_cancel";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
 }
 
 // --- Domain-level union aliases (consumed by the barrel file) ---

package/src/daemon/message-types/host-file.ts

@@ -8,6 +8,7 @@ export interface HostFileReadRequest {
   type: "host_file_request";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
   operation: "read";
   path: string;
   offset?: number;
@@ -18,6 +19,7 @@ export interface HostFileWriteRequest {
   type: "host_file_request";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
   operation: "write";
   path: string;
   content: string;
@@ -27,6 +29,7 @@ export interface HostFileEditRequest {
   type: "host_file_request";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
   operation: "edit";
   path: string;
   old_string: string;
@@ -43,6 +46,7 @@ export interface HostFileCancelRequest {
   type: "host_file_cancel";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
 }
 
 // --- Domain-level union aliases (consumed by the barrel file) ---

package/src/daemon/message-types/host-transfer.ts

@@ -8,6 +8,7 @@ export interface HostTransferToHostRequest {
   type: "host_transfer_request";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
   direction: "to_host";
   transferId: string;
   destPath: string;
@@ -20,6 +21,7 @@ export interface HostTransferToSandboxRequest {
   type: "host_transfer_request";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
   direction: "to_sandbox";
   transferId: string;
   sourcePath: string;
@@ -33,6 +35,7 @@ export interface HostTransferCancelRequest {
   type: "host_transfer_cancel";
   requestId: string;
   conversationId: string;
+  targetClientId?: string;
 }
 
 // --- Domain-level union aliases (consumed by the barrel file) ---

package/src/daemon/message-types/schedules.ts

@@ -118,10 +118,15 @@ export interface HeartbeatRunsListResponse {
   type: "heartbeat_runs_list_response";
   runs: Array<{
     id: string;
-    title: string;
+    scheduledFor: number;
+    startedAt: number | null;
+    finishedAt: number | null;
+    durationMs: number | null;
+    status: string;
+    skipReason: string | null;
+    error: string | null;
+    conversationId: string | null;
     createdAt: number;
-    result: string;
-    summary?: string;
   }>;
 }
 

package/src/daemon/message-types/skills.ts

@@ -1,9 +1,9 @@
 // Skill management types.
 
-import type { PartnerAudit } from "../../skills/skillssh-registry.js";
+import type { PartnerAudit } from "../../skills/skillssh-audit-types.js";
 
 // Re-export so consumers can access the audit types from this module.
-export type { PartnerAudit } from "../../skills/skillssh-registry.js";
+export type { PartnerAudit } from "../../skills/skillssh-audit-types.js";
 
 // === Client → Server ===
 

package/src/daemon/process-message.ts

@@ -45,7 +45,9 @@ import {
   mergeConversationOptions,
 } from "./conversation-store.js";
 import type { ConversationCreateOptions } from "./handlers/shared.js";
+import { HostAppControlProxy } from "./host-app-control-proxy.js";
 import { HostCuProxy } from "./host-cu-proxy.js";
+import { preactivateHostProxySkills } from "./host-proxy-preactivation.js";
 
 const log = getLogger("process-message");
 
@@ -156,10 +158,25 @@ async function prepareConversationForMessage(
     if (!conversation.isProcessing() || !conversation.hostCuProxy) {
       conversation.setHostCuProxy(new HostCuProxy());
     }
-    conversation.addPreactivatedSkillId("computer-use");
   } else if (!conversation.isProcessing()) {
     conversation.setHostCuProxy(undefined);
   }
+  // App-control mirrors CU's per-conversation lifecycle. The proxy attaches
+  // unconditionally when the client supports the capability — feature-flag
+  // gating is enforced by the skill-projection layer via SKILL.md
+  // frontmatter, so an attached proxy is harmless when the flag is off.
+  if (supportsHostProxy(resolvedInterface, "host_app_control")) {
+    if (!conversation.isProcessing() || !conversation.hostAppControlProxy) {
+      conversation.setHostAppControlProxy(
+        new HostAppControlProxy(conversationId),
+      );
+    }
+  } else if (!conversation.isProcessing()) {
+    conversation.setHostAppControlProxy(undefined);
+  }
+  // The early `isProcessing()` throw above guarantees the conversation is
+  // idle here, so preactivation is unconditional once the proxies are wired.
+  preactivateHostProxySkills(conversation, resolvedInterface);
   conversation.setCommandIntent(options?.commandIntent ?? null);
   conversation.setTurnChannelContext({
     userMessageChannel: resolvedChannel,

package/src/daemon/shutdown-handlers.ts

@@ -1,6 +1,5 @@
 import * as Sentry from "@sentry/node";
 
-import type { BackupWorkerHandle } from "../backup/backup-worker.js";
 import type { FilingService } from "../filing/filing-service.js";
 import type { HeartbeatService } from "../heartbeat/heartbeat-service.js";
 import type { McpServerManager } from "../mcp/manager.js";
@@ -26,7 +25,6 @@ export interface ShutdownDeps {
   scheduler: { stop(): void };
   feedScheduler: { stop(): void } | null;
   getMemoryWorker: () => { stop(): void } | null;
-  getBackupWorker: () => BackupWorkerHandle | null;
   getQdrantManager: () => QdrantManager | null;
   mcpManager: McpServerManager | null;
   telemetryReporter: { stop(): Promise<void> } | null;
@@ -123,7 +121,6 @@ export function installShutdownHandlers(deps: ShutdownDeps): void {
     deps.scheduler.stop();
     deps.feedScheduler?.stop();
     deps.getMemoryWorker()?.stop();
-    deps.getBackupWorker()?.stop();
 
     if (deps.mcpManager) {
       try {

package/src/daemon/tool-setup-types.ts

@@ -0,0 +1,51 @@
+/**
+ * Types extracted from conversation-tool-setup.ts to break the
+ * tool-setup ↔ doordash-steps and tool-setup ↔ tool-side-effects cycles.
+ */
+
+import type { InterfaceId } from "../channels/types.js";
+import type { CesClient } from "../credential-execution/client.js";
+import type { SurfaceConversationContext } from "./conversation-surfaces.js";
+import type { TrustContext } from "./trust-context.js";
+
+/**
+ * Subset of Conversation state that the tool executor callback reads at
+ * call time (not construction time). These are captured by the
+ * returned closure, so they must be live references.
+ */
+export interface ToolSetupContext extends SurfaceConversationContext {
+  readonly conversationId: string;
+  assistantId?: string;
+  currentRequestId?: string;
+  workingDir: string;
+  abortController: AbortController | null;
+  /** When set, only tools in this set may execute during the current turn. */
+  allowedToolNames?: Set<string>;
+  /** Conversation memory policy used to propagate scopeId into ToolContext. */
+  memoryPolicy: { scopeId: string };
+  /** True when the conversation has no connected client (HTTP-only path). */
+  hasNoClient?: boolean;
+  /** When true, the conversation is executing a task run and must not become interactive. */
+  headlessLock?: boolean;
+  /** When set, this conversation is executing a task run. Used to retrieve ephemeral permission rules. */
+  taskRunId?: string;
+  /** Guardian runtime context for the conversation — trustClass is propagated into ToolContext for control-plane policy enforcement. */
+  trustContext?: TrustContext;
+  /** Voice/call session ID, if the conversation originates from a call. Propagated into ToolContext for scoped grant consumption. */
+  callSessionId?: string;
+  /** CES RPC client for credential execution operations. Injected when CES tools are enabled and the CES process is available. */
+  cesClient?: CesClient;
+  /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
+  readonly transportInterface?: InterfaceId;
+
+  /** Turn-scoped flag: true when any tool call in the current turn received explicit user approval via interactive prompt. Cleared at turn end. */
+  approvedViaPromptThisTurn?: boolean;
+  /**
+   * Per-turn snapshot of the resolved inference-profile override, set by
+   * `runAgentLoopImpl`. Propagated into `ToolContext.overrideProfile` so
+   * tools that spawn nested invocations (e.g. `subagent_spawn`) can forward
+   * the override without round-tripping through a row read that would
+   * return `undefined` for the in-flight (background) subagent.
+   */
+  currentTurnOverrideProfile?: string;
+}

package/src/daemon/tool-side-effects.ts

@@ -22,9 +22,9 @@ import { getLogger } from "../util/logger.js";
 import { getWorkspaceDir } from "../util/platform.js";
 import { ensureAppSourceWatcher } from "./app-source-watcher.js";
 import { refreshSurfacesForApp } from "./conversation-surfaces.js";
-import type { ToolSetupContext } from "./conversation-tool-setup.js";
 import { isDoordashCommand, updateDoordashProgress } from "./doordash-steps.js";
 import type { ServerMessage } from "./message-protocol.js";
+import type { ToolSetupContext } from "./tool-setup-types.js";
 
 const log = getLogger("tool-side-effects");
 

package/src/events/tool-audit-listener.ts

@@ -2,6 +2,7 @@ import {
   recordToolInvocation,
   type ToolInvocationRecord,
 } from "../memory/tool-usage-store.js";
+import { redactSecrets } from "../security/secret-scanner.js";
 import type {
   ToolLifecycleEvent,
   ToolLifecycleEventHandler,
@@ -40,7 +41,7 @@ function toInvocationRecord(
         conversationId: event.conversationId,
         toolName: event.toolName,
         input: stringifyInput(event.input),
-        result: event.result.content.slice(0, RESULT_PREVIEW_LIMIT),
+        result: redactSecrets(event.result.content).slice(0, RESULT_PREVIEW_LIMIT),
         decision: event.decision,
         riskLevel: event.riskLevel,
         matchedTrustRuleId: event.matchedTrustRuleId,

package/src/heartbeat/__tests__/heartbeat-feed-event.test.ts

@@ -5,6 +5,18 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 let workspaceDir: string;
 
+// Stub the heartbeat run store so HeartbeatService doesn't hit the real DB.
+mock.module("../heartbeat-run-store.js", () => ({
+  insertPendingHeartbeatRun: () => "mock-run-id",
+  startHeartbeatRun: () => true,
+  completeHeartbeatRun: () => true,
+  skipHeartbeatRun: () => true,
+  supersedePendingRun: () => true,
+  markStaleRunsAsMissed: () => 0,
+  markStaleRunningAsError: () => 0,
+  listHeartbeatRuns: () => [],
+}));
+
 // Stub the in-process SSE hub so the writer's publish path is a
 // no-op in these tests.
 const publishSpy = mock<(event: unknown) => Promise<void>>(async () => {});
@@ -60,12 +72,10 @@ mock.module("../../config/loader.js", () => ({
   getConfig: () => stubConfig,
   getConfigReadOnly: () => stubConfig,
   loadConfig: () => stubConfig,
-  saveConfig: () => {},
   invalidateConfigCache: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   applyNestedDefaults: (c: unknown) => c,
-  deepMergeMissing: (a: unknown) => a,
   deepMergeOverwrite: (a: unknown) => a,
   mergeDefaultWorkspaceConfig: () => {},
   getNestedValue: () => undefined,
@@ -200,13 +210,11 @@ describe("heartbeat feed events", () => {
     await new Promise((r) => setTimeout(r, 100));
 
     const items = readFeedItems();
-    const heartbeatItem = items.find((i) => i.title === "Heartbeat");
+    const heartbeatItem = items.find((i) => i.title === "Heartbeat Failed");
     expect(heartbeatItem).toBeDefined();
-    expect(heartbeatItem!.summary).toBe(
-      "Heartbeat check failed. Check logs for details.",
-    );
+    expect(heartbeatItem!.summary).toContain("LLM call failed");
     expect(heartbeatItem!.priority).toBe(55);
-    expect(heartbeatItem!.urgency).toBe("medium");
+    expect(heartbeatItem!.urgency).toBe("high");
     expect(heartbeatItem!.source).toBe("assistant");
   });
 

package/src/heartbeat/__tests__/heartbeat-run-store.test.ts

@@ -0,0 +1,216 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+import { mock } from "bun:test";
+
+mock.module("../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+  truncateForLog: (value: string) => value,
+}));
+
+import { sql } from "drizzle-orm";
+
+import { getDb } from "../../memory/db-connection.js";
+import { initializeDb } from "../../memory/db-init.js";
+import {
+  completeHeartbeatRun,
+  insertPendingHeartbeatRun,
+  listHeartbeatRuns,
+  markStaleRunningAsError,
+  markStaleRunsAsMissed,
+  skipHeartbeatRun,
+  startHeartbeatRun,
+  supersedePendingRun,
+} from "../heartbeat-run-store.js";
+
+initializeDb();
+
+describe("heartbeat-run-store", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM heartbeat_runs");
+  });
+
+  test("insertPendingHeartbeatRun creates row with status pending and null timing", () => {
+    const scheduledFor = Date.now();
+    const id = insertPendingHeartbeatRun(scheduledFor);
+    expect(id).toBeTruthy();
+
+    const rows = listHeartbeatRuns();
+    expect(rows).toHaveLength(1);
+    expect(rows[0].id).toBe(id);
+    expect(rows[0].status).toBe("pending");
+    expect(rows[0].scheduledFor).toBe(scheduledFor);
+    expect(rows[0].startedAt).toBeNull();
+    expect(rows[0].finishedAt).toBeNull();
+    expect(rows[0].durationMs).toBeNull();
+    expect(rows[0].error).toBeNull();
+    expect(rows[0].conversationId).toBeNull();
+    expect(rows[0].skipReason).toBeNull();
+  });
+
+  test("startHeartbeatRun transitions pending -> running and sets startedAt", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    const ok = startHeartbeatRun(id);
+    expect(ok).toBe(true);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("running");
+    expect(rows[0].startedAt).toBeGreaterThan(0);
+  });
+
+  test("startHeartbeatRun returns false for non-pending row", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+
+    // Start once — succeeds
+    expect(startHeartbeatRun(id)).toBe(true);
+    // Start again — fails (already running)
+    expect(startHeartbeatRun(id)).toBe(false);
+
+    // Also: superseded row cannot be started
+    const id2 = insertPendingHeartbeatRun(Date.now());
+    supersedePendingRun(id2);
+    expect(startHeartbeatRun(id2)).toBe(false);
+  });
+
+  test("completeHeartbeatRun transitions running -> ok with conversationId", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    startHeartbeatRun(id);
+    const ok = completeHeartbeatRun(id, {
+      status: "ok",
+      conversationId: "conv-123",
+    });
+    expect(ok).toBe(true);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("ok");
+    expect(rows[0].conversationId).toBe("conv-123");
+    expect(rows[0].finishedAt).toBeGreaterThan(0);
+    expect(rows[0].durationMs).toBeGreaterThanOrEqual(0);
+  });
+
+  test("completeHeartbeatRun transitions running -> error with truncated error", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    startHeartbeatRun(id);
+
+    // 3KB string — should be truncated to 2000 chars
+    const longError = "x".repeat(3000);
+    const ok = completeHeartbeatRun(id, {
+      status: "error",
+      error: longError,
+    });
+    expect(ok).toBe(true);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("error");
+    expect(rows[0].error).toHaveLength(2000);
+  });
+
+  test("completeHeartbeatRun returns false when status is not running (CAS)", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    startHeartbeatRun(id);
+    // Complete with timeout
+    completeHeartbeatRun(id, { status: "timeout" });
+    // Try to complete again with ok — should fail (already timeout)
+    const ok = completeHeartbeatRun(id, { status: "ok" });
+    expect(ok).toBe(false);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("timeout");
+  });
+
+  test("skipHeartbeatRun transitions pending -> skipped with reason", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    const ok = skipHeartbeatRun(id, "outside_active_hours");
+    expect(ok).toBe(true);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("skipped");
+    expect(rows[0].skipReason).toBe("outside_active_hours");
+  });
+
+  test("skipHeartbeatRun returns false for non-pending row", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    startHeartbeatRun(id);
+    const ok = skipHeartbeatRun(id, "disabled");
+    expect(ok).toBe(false);
+  });
+
+  test("supersedePendingRun transitions pending -> superseded", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    const ok = supersedePendingRun(id);
+    expect(ok).toBe(true);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("superseded");
+  });
+
+  test("supersedePendingRun returns false for non-pending row", () => {
+    const id = insertPendingHeartbeatRun(Date.now());
+    startHeartbeatRun(id);
+    const ok = supersedePendingRun(id);
+    expect(ok).toBe(false);
+  });
+
+  test("markStaleRunsAsMissed transitions old pending rows to missed", () => {
+    const now = Date.now();
+    // Two old pending rows
+    const id1 = insertPendingHeartbeatRun(now - 10 * 60 * 1000);
+    const id2 = insertPendingHeartbeatRun(now - 8 * 60 * 1000);
+    // One recent pending row
+    const id3 = insertPendingHeartbeatRun(now);
+
+    const count = markStaleRunsAsMissed(5 * 60 * 1000);
+    expect(count).toBe(2);
+
+    const rows = listHeartbeatRuns();
+    const byId = Object.fromEntries(rows.map((r) => [r.id, r]));
+    expect(byId[id1].status).toBe("missed");
+    expect(byId[id2].status).toBe("missed");
+    expect(byId[id3].status).toBe("pending");
+  });
+
+  test("markStaleRunningAsError transitions old running rows to error", () => {
+    const now = Date.now();
+    const id = insertPendingHeartbeatRun(now - 60 * 60 * 1000);
+    startHeartbeatRun(id);
+
+    // Backdate started_at to simulate a long-running process
+    const db = getDb();
+    const backdatedStartedAt = now - 60 * 60 * 1000;
+    db.run(
+      sql`UPDATE heartbeat_runs SET started_at = ${backdatedStartedAt} WHERE id = ${id}`,
+    );
+
+    const count = markStaleRunningAsError(45 * 60 * 1000);
+    expect(count).toBe(1);
+
+    const rows = listHeartbeatRuns();
+    expect(rows[0].status).toBe("error");
+    expect(rows[0].error).toBe("Process crashed or restarted during execution");
+  });
+
+  test("listHeartbeatRuns returns rows ordered by scheduledFor desc", () => {
+    const now = Date.now();
+    insertPendingHeartbeatRun(now - 2000);
+    insertPendingHeartbeatRun(now);
+    insertPendingHeartbeatRun(now - 1000);
+
+    const rows = listHeartbeatRuns();
+    expect(rows).toHaveLength(3);
+    expect(rows[0].scheduledFor).toBe(now);
+    expect(rows[1].scheduledFor).toBe(now - 1000);
+    expect(rows[2].scheduledFor).toBe(now - 2000);
+  });
+
+  test("listHeartbeatRuns respects limit", () => {
+    const now = Date.now();
+    for (let i = 0; i < 5; i++) {
+      insertPendingHeartbeatRun(now + i);
+    }
+
+    const rows = listHeartbeatRuns(3);
+    expect(rows).toHaveLength(3);
+  });
+});