@vellumai/assistant 0.8.0 → 0.8.2

package/src/daemon/conversation-store.ts

@@ -14,13 +14,16 @@
  * shared rate-limit timestamps, broadcast).
  */
 
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { CesClient } from "../credential-execution/client.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
-import { CallSiteRoutingProvider } from "../providers/call-site-routing.js";
+import { wrapWithCallSiteRouting } from "../providers/call-site-routing.js";
+import { resolveDefaultProvider } from "../providers/connection-resolution.js";
 import { RateLimitProvider } from "../providers/ratelimit.js";
-import { getProvider } from "../providers/registry.js";
+import { listProviders } from "../providers/registry.js";
 import { getSubagentManager } from "../subagent/index.js";
+import { ProviderNotConfiguredError } from "../util/errors.js";
 import { getSandboxWorkingDir } from "../util/platform.js";
 import { Conversation } from "./conversation.js";
 import type { ConversationEvictor } from "./conversation-evictor.js";
@@ -222,14 +225,25 @@ export async function getOrCreateConversation(
 
     const createPromise = (async () => {
       const config = getConfig();
-      let provider = getProvider(config.llm.default.provider);
-      provider = new CallSiteRoutingProvider(provider, (name) => {
-        try {
-          return getProvider(name);
-        } catch {
-          return undefined;
-        }
-      });
+      // Connection-aware default-provider resolution. Throws
+      // `ConnectionResolutionError` when the default profile's
+      // `provider_connection` is unset / unknown / mismatched (config
+      // bugs). Returns null on soft credential failures (missing
+      // credential, platform auth unavailable).
+      const baseProvider = await resolveDefaultProvider(config);
+      if (!baseProvider) {
+        const resolved = resolveCallSiteConfig("mainAgent", config.llm);
+        throw new ProviderNotConfiguredError(
+          resolved.provider,
+          listProviders(),
+          {
+            connectionName: resolved.provider_connection,
+          },
+        );
+      }
+      // Per-call `callSite` routing layered on top, with connection-awareness
+      // for alternate profiles (matches the canonical dispatch path).
+      let provider = wrapWithCallSiteRouting(baseProvider, config);
       const { rateLimit } = config;
       if (rateLimit.maxRequestsPerMinute > 0) {
         provider = new RateLimitProvider(

package/src/daemon/conversation-surfaces.ts

@@ -2023,14 +2023,6 @@ export async function surfaceProxyResolver(
 
   // Route app-control proxy tools (all app_control_* tool variants)
   if (toolName.startsWith("app_control_")) {
-    if (!ctx.hostAppControlProxy || !ctx.hostAppControlProxy.isAvailable()) {
-      return {
-        content:
-          "App control is not available — enable the `app-control` feature flag and connect a macOS client.",
-        isError: true,
-      };
-    }
-
     // `app_control_stop` resolves immediately: tear down the proxy without
     // a client round-trip. Mirrors CU's terminal-tool short-circuit
     // (`computer_use_done` / `computer_use_respond`). Clear the
@@ -2039,15 +2031,85 @@ export async function surfaceProxyResolver(
     // instead of dispatching against a torn-down proxy, and so a sibling
     // conversation can acquire the released singleton lock without the
     // disposed proxy still being addressable.
+    //
+    // Run this BEFORE the isAvailable() gate so a disconnected client
+    // doesn't strand the singleton lock — stop is local-only.
     if (toolName === "app_control_stop") {
-      if (ctx.setHostAppControlProxy) {
-        ctx.setHostAppControlProxy(undefined);
-      } else {
-        ctx.hostAppControlProxy.dispose();
+      if (ctx.hostAppControlProxy) {
+        if (ctx.setHostAppControlProxy) {
+          ctx.setHostAppControlProxy(undefined);
+        } else {
+          ctx.hostAppControlProxy.dispose();
+        }
       }
       return { content: "App control stopped.", isError: false };
     }
 
+    if (!ctx.hostAppControlProxy || !ctx.hostAppControlProxy.isAvailable()) {
+      return {
+        content:
+          "App control is not available — enable the `app-control` feature flag and connect a macOS client.",
+        isError: true,
+      };
+    }
+
+    // Resolve target client. Mirrors the host_cu block above: validate
+    // explicit target_client_id (existence, capability, same-actor), then
+    // multi-client guard when no target is supplied. App-control is
+    // single-client-only at the host (one active session per macOS
+    // machine), so a broadcast across multiple capable clients would fire
+    // the same input on every machine.
+    let targetClientId: string | undefined =
+      typeof input.target_client_id === "string" &&
+      input.target_client_id !== ""
+        ? input.target_client_id
+        : undefined;
+
+    const sourceActorPrincipalId = ctx.trustContext?.guardianPrincipalId;
+    if (targetClientId != null) {
+      const client = assistantEventHub.getClientById(targetClientId);
+      if (!client) {
+        return {
+          content: `No connected client with id '${targetClientId}'. Run \`assistant clients list --capability host_app_control\` to see available clients.`,
+          isError: true,
+        };
+      }
+      if (!client.capabilities.includes("host_app_control")) {
+        return {
+          content: `Client '${targetClientId}' does not support host_app_control. Run \`assistant clients list --capability host_app_control\` to see available clients.`,
+          isError: true,
+        };
+      }
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId,
+        op: "host_app_control",
+      });
+      if (rejection) return rejection;
+    }
+
+    if (targetClientId == null) {
+      const allAcClients =
+        assistantEventHub.listClientsByCapability("host_app_control");
+      const sameUserAcClients = allAcClients.filter(
+        (c) => c.actorPrincipalId === sourceActorPrincipalId,
+      );
+      if (sameUserAcClients.length > 1) {
+        return {
+          content: `Error: multiple clients support host_app_control. Specify which client to target with \`target_client_id\`. Run \`assistant clients list --capability host_app_control\` to see client IDs and labels.`,
+          isError: true,
+        };
+      }
+      // When cross-user host_app_control clients are connected, auto-
+      // resolve to the unique same-user client. Otherwise the proxy would
+      // dispatch untargeted and the action could reach a cross-user
+      // client. Belt-and-suspenders: the proxy re-checks same-user.
+      if (sameUserAcClients.length === 1 && allAcClients.length > 1) {
+        targetClientId = sameUserAcClients[0].clientId;
+      }
+    }
+
     // The TS `HostAppControlInput` (and the Swift mirror) is a discriminated
     // union on `tool` ("start" | "observe" | "press" | …). The agent's raw
     // tool input only carries the action-specific payload (app, x/y, text,
@@ -2066,6 +2128,8 @@ export async function surfaceProxyResolver(
       inputWithTool,
       ctx.conversationId,
       signal ?? new AbortController().signal,
+      sourceActorPrincipalId,
+      targetClientId,
     );
   }
 

package/src/daemon/conversation-tool-setup.ts

@@ -13,6 +13,7 @@ import {
 } from "../channels/types.js";
 import { isHttpAuthDisabled } from "../config/env.js";
 import { getIsPlatform } from "../config/env-registry.js";
+import { getConfig } from "../config/loader.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
@@ -156,6 +157,7 @@ export function createToolExecutor(
       onOutput,
       signal: ctx.abortController?.signal,
       allowedToolNames: ctx.allowedToolNames,
+      forcePromptSideEffects: ctx.forcePromptSideEffects,
       diskPressureCleanupModeActive: ctx.diskPressureCleanupModeActive,
       toolUseId,
       isPlatformHosted: getIsPlatform(),
@@ -361,28 +363,38 @@ export const HOST_TOOL_TO_CAPABILITY = new Map<string, HostProxyCapability>([
 export const HOST_TOOL_NAMES = new Set(HOST_TOOL_TO_CAPABILITY.keys());
 /**
  * Capabilities eligible for cross-client exposure on non-host-proxy
- * transports (e.g. web, ios routing to a connected macOS client).
+ * transports (e.g. web, ios routing to a connected capable client).
  * Adding a capability here exposes ALL tools that map to it (per
  * HOST_TOOL_TO_CAPABILITY) on non-host-proxy transports — the daemon then
  * routes the actual invocation to the connected capable client via the
  * proxy's targetClientId path.
  *
+ * All members below adopt the same-actor enforcement pattern: the proxy
+ * binds the request to a specific client id + actor principal id at
+ * dispatch time, and the corresponding result route requires the
+ * submitting client to present an `x-vellum-client-id` matching the
+ * captured target plus an `x-vellum-actor-principal-id` matching the
+ * captured actor (see `enforceSameActorOrThrow` in
+ * `runtime/auth/same-actor.ts`).
+ *
  * Inclusions:
  * - host_bash (Phase 1, PR #29322)
  * - host_file (Phases 2 & 3, PRs #29398 + #29440)
+ * - host_browser (PR #27489 executor parity + PR #29829 cross-client
+ *   exposure with same-actor guard at proxy dispatch and result route)
  *
  * Exclusions:
- * - host_browser: chrome-extension is its own executor; web turns don't
- *   have a CDP target model. Re-evaluate when host browser via macOS
- *   host proxy ships (PR #27489).
- * - host_app_control, host_cu: not in HOST_TOOL_TO_CAPABILITY
- *   (skill-routed).
+ * - host_app_control, host_cu: not in HOST_TOOL_TO_CAPABILITY (skill-routed).
+ *   Their cross-client exposure is handled at the skill preactivation layer
+ *   via `preactivateHostProxySkills` — see host-proxy-preactivation.ts.
  */
 const CROSS_CLIENT_EXPOSED_CAPABILITIES = new Set<HostProxyCapability>([
   "host_bash",
   "host_file",
+  "host_browser",
 ]);
-const CLIENT_CAPABILITY_TOOL_NAMES = new Set(["app_open"]);
+// Tools that require a connected client but no specific host proxy capability.
+const CLIENT_CAPABILITY_TOOL_NAMES = new Set(["app_open", "ask_question"]);
 const PLATFORM_TOOL_NAMES = new Set(["request_system_permission"]);
 
 /**
@@ -396,16 +408,34 @@ export const SUBAGENT_ONLY_TOOL_NAMES = new Set<string>([
 ]);
 
 /**
- * Determine whether a tool should be included in the LLM tool definitions
- * for the current turn based on conversation context. Tools not active for the
- * current context are omitted from the definitions sent to the provider,
- * reducing noise and preventing the model from attempting calls that would
- * fail.
+ * Determine whether a tool is part of the final exposed tool set for the
+ * current turn. This helper mirrors the filtering applied by
+ * `createResolveToolsCallback` — including the subagent allowlist,
+ * `toolsDisabledDepth`, and disk-pressure cleanup restrictions.
  */
 export function isToolActiveForContext(
   name: string,
   ctx: SkillProjectionContext,
 ): boolean {
+  // When the conversation is acting as a subagent, the parent orchestrator
+  // restricts the tool list. A tool that isn't on the allowlist is not
+  // available for this turn, so short-circuit before any capability checks.
+  if (ctx.subagentAllowedTools && !ctx.subagentAllowedTools.has(name)) {
+    return false;
+  }
+  // `createResolveToolsCallback` returns an empty tool list when tools are
+  // disabled (e.g. pointer-generation turns) and restricts to cleanup-safe
+  // tools under disk pressure. Mirror both here so this helper reports the
+  // same final tool set the LLM receives.
+  if (ctx.toolsDisabledDepth > 0) {
+    return false;
+  }
+  if (
+    ctx.diskPressureCleanupModeActive === true &&
+    !isDiskPressureCleanupToolName(name)
+  ) {
+    return false;
+  }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
     return ctx.channelCapabilities?.supportsDynamicUi ?? !ctx.hasNoClient;
   }
@@ -417,15 +447,15 @@ export function isToolActiveForContext(
     // transport cannot service this capability, the tool is filtered out.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
       // Cross-client exception: allow host tools whose capabilities have
-      // cross-client routing infrastructure (Phases 1–3) to be exposed for
-      // non-host-proxy transports (e.g. "web", "ios") when at least one
-      // capable client is connected via the event hub. Members of
-      // CROSS_CLIENT_EXPOSED_CAPABILITIES (host_bash, host_file) qualify;
-      // host_browser is intentionally excluded (chrome-extension is its
-      // own executor and web turns don't have a CDP target model).
+      // cross-client routing infrastructure (Phases 1–3 plus host_browser
+      // via PR #27489) to be exposed for non-host-proxy transports (e.g.
+      // "web", "ios") when at least one capable client is connected via
+      // the event hub. Members of CROSS_CLIENT_EXPOSED_CAPABILITIES
+      // (host_bash, host_file, host_browser) qualify.
       // chrome-extension transport is excluded as a security boundary
-      // (extension only gets host_browser); hasNoClient turns are excluded
-      // (no interactive approval UI available).
+      // (extension only gets host_browser via its own executor path);
+      // hasNoClient turns are excluded (no interactive approval UI
+      // available).
       if (
         capability &&
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
@@ -453,6 +483,14 @@ export function isToolActiveForContext(
     return !ctx.hasNoClient;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
+    if (
+      name === "ask_question" &&
+      ctx.channelCapabilities?.clientOS === "macos"
+    ) {
+      // macOS has no UI handler for question_request yet; hiding the tool
+      // avoids a 5-minute prompter timeout when the LLM would otherwise call it.
+      return false;
+    }
     return !ctx.hasNoClient;
   }
   if (PLATFORM_TOOL_NAMES.has(name)) {
@@ -534,7 +572,10 @@ export function createResolveToolsCallback(
     const scopedMcpDefs = ctx.subagentAllowedTools
       ? currentMcpDefs.filter((d) => ctx.subagentAllowedTools!.has(d.name))
       : currentMcpDefs;
-    const allBaseDefs = [...scopedCoreDefs, ...scopedMcpDefs];
+    const excluded = new Set(getConfig().tools.exclude);
+    const allBaseDefs = [...scopedCoreDefs, ...scopedMcpDefs].filter(
+      (d) => !excluded.has(d.name),
+    );
 
     const effectivePreactivated = [
       ...DEFAULT_PREACTIVATED_SKILL_IDS,
@@ -551,6 +592,7 @@ export function createResolveToolsCallback(
       if (ctx.subagentAllowedTools && !ctx.subagentAllowedTools.has(name)) {
         continue;
       }
+      if (excluded.has(name)) continue;
       turnAllowed.add(name);
     }
     if (ctx.diskPressureCleanupModeActive === true) {

package/src/daemon/conversation.ts

@@ -27,6 +27,7 @@ import {
   contextWindowConfigFromEffective,
   resolveEffectiveContextWindow,
 } from "../config/llm-context-resolution.js";
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite, Speed } from "../config/schemas/llm.js";
 import type { ContextWindowConfig } from "../config/types.js";
@@ -53,7 +54,9 @@ import {
   getConversationOriginChannel,
   getConversationOverrideProfileFromRow,
 } from "../memory/conversation-crud.js";
+import { isBackgroundConversationType } from "../memory/conversation-types.js";
 import { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
+import { shouldExposePersonalMemory } from "../memory/v2/static-context.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { UserDecision } from "../permissions/types.js";
@@ -116,11 +119,13 @@ import {
   buildToolDefinitions,
   createResolveToolsCallback,
   createToolExecutor,
+  resolveTrustClass,
 } from "./conversation-tool-setup.js";
 import { refreshWorkspaceTopLevelContextIfNeeded as refreshWorkspaceImpl } from "./conversation-workspace.js";
 import { canonicalizeTimeZone } from "./date-context.js";
-import type { HostAppControlProxy } from "./host-app-control-proxy.js";
+import { HostAppControlProxy } from "./host-app-control-proxy.js";
 import { HostCuProxy } from "./host-cu-proxy.js";
+import { shouldAttachHostProxyForCapability } from "./host-proxy-preactivation.js";
 import type {
   ServerMessage,
   SurfaceData,
@@ -177,6 +182,17 @@ export class Conversation {
   /** @internal */ contextWindowManager: ContextWindowManager;
   /** @internal */ contextCompactedMessageCount = 0;
   /** @internal */ contextCompactedAt: number | null = null;
+  /**
+   * Set true by `applyCompactionResult` when compaction strips runtime
+   * injections from the tail. The next agent loop turn reads this flag at
+   * entry, treats it as a `compactedThisTurn` trigger (re-injecting NOW.md,
+   * PKB, and the v2 essentials/threads/recent/buffer block), and clears it.
+   *
+   * Required because `/compact` runs outside the agent loop — without this
+   * signal, the next turn cannot tell that the static blocks were just
+   * stripped and never re-emits them.
+   */
+  /** @internal */ pendingPostCompactReinject = false;
   /**
    * Tracks consecutive compaction failures (summary LLM call threw). In-memory
    * only — resets to 0 on process restart, which is the intended "one free
@@ -222,6 +238,7 @@ export class Conversation {
   /** @internal */ currentTurnOverrideProfile?: string;
   /** @internal */ authContext?: AuthContext;
   /** @internal */ loadedHistoryTrustClass?: TrustClass;
+  /** @internal */ loadedHistoryPersonalMemoryAllowed?: boolean;
   /** @internal */ voiceCallControlPrompt?: string;
   /** @internal */ transportHints?: string[];
   /** @internal */ slackRuntimeContextNotice?: string;
@@ -233,6 +250,14 @@ export class Conversation {
   };
   /** @internal */ surfaceActionRequestIds = new Set<string>();
   /** @internal */ approvedViaPromptThisTurn = false;
+  /**
+   * When true, side-effect tools must prompt even if a trust/allow rule
+   * would auto-allow. Set by non-interactive callers (e.g. non-guardian
+   * phone voice) so their auto-deny handler reliably sees a
+   * `confirmation_request` event. See ToolSetupContext.forcePromptSideEffects.
+   * @internal
+   */
+  forcePromptSideEffects = false;
   /** @internal */ pendingSurfaceActions = new Map<
     string,
     { surfaceType: SurfaceType }
@@ -424,7 +449,8 @@ export class Conversation {
     );
 
     const config = getConfig();
-    this.streamThinking = config.llm.default.thinking.streamThinking ?? false;
+    const resolvedMainAgent = resolveCallSiteConfig("mainAgent", config.llm);
+    this.streamThinking = resolvedMainAgent.thinking.streamThinking ?? false;
 
     // CES (Credential Execution Service) — use the shared server-level client.
     // The CES sidecar accepts exactly one bootstrap connection, so the
@@ -463,6 +489,9 @@ export class Conversation {
                 channelPersona: persona.channelPersona,
                 userSlug: persona.userSlug,
                 onboardingContext: this.getOnboardingContext(),
+                isBackgroundConversation: isBackgroundConversationType(
+                  getConversation(this.conversationId)?.conversationType,
+                ),
               });
             })(),
       };
@@ -476,20 +505,19 @@ export class Conversation {
     };
 
     const fastModeEnabled = isAssistantFeatureFlagEnabled("fast-mode", config);
-    const resolvedSpeed = speedOverride ?? config.llm.default.speed;
-    const llmDefault = config.llm.default;
+    const resolvedSpeed = speedOverride ?? resolvedMainAgent.speed;
     const initialContextWindow = resolveEffectiveContextWindow({
       llm: config.llm,
       callSite: "mainAgent",
     });
     const initialContextWindowConfig = contextWindowConfigFromEffective(
-      llmDefault.contextWindow,
+      resolvedMainAgent.contextWindow,
       initialContextWindow,
     );
 
     const agentLoopConfig: Partial<AgentLoopConfig> = {
-      thinking: llmDefault.thinking,
-      effort: llmDefault.effort,
+      thinking: resolvedMainAgent.thinking,
+      effort: resolvedMainAgent.effort,
       ...(fastModeEnabled && resolvedSpeed === "fast"
         ? { speed: resolvedSpeed }
         : {}),
@@ -513,6 +541,10 @@ export class Conversation {
       systemPrompt: () => resolveSystemPromptCallback([]).systemPrompt,
       config: initialContextWindowConfig,
       toolTokenBudget: this.agentLoop.getToolTokenBudget(),
+      conversationId: this.conversationId,
+      resolveTools: resolveTools
+        ? () => resolveTools(this.messages)
+        : undefined,
     });
   }
 
@@ -551,6 +583,9 @@ export class Conversation {
             channelPersona: persona.channelPersona,
             userSlug: persona.userSlug,
             onboardingContext: this.getOnboardingContext(),
+            isBackgroundConversation: isBackgroundConversationType(
+              getConversation(this.conversationId)?.conversationType,
+            ),
           });
         })();
     const tools = buildToolDefinitions();
@@ -630,7 +665,21 @@ export class Conversation {
 
   async ensureActorScopedHistory(): Promise<void> {
     const currentTrustClass = this.trustContext?.trustClass;
-    if (this.loadedHistoryTrustClass === currentTrustClass) return;
+    // `loadFromDb` gates personal-memory rehydration on `sourceChannel` too
+    // (via `shouldExposePersonalMemory`), so a same-trust-class reuse from a
+    // different channel (e.g. internal `vellum` → remote channel) must also
+    // trigger a reload. Otherwise stale personal-memory blocks can leak to
+    // an untrusted remote turn, or be hidden when they should be present.
+    const currentPersonalMemoryAllowed = shouldExposePersonalMemory({
+      sourceChannel: this.trustContext?.sourceChannel,
+      isTrustedActor: resolveTrustClass(this.trustContext) === "guardian",
+    });
+    if (
+      this.loadedHistoryTrustClass === currentTrustClass &&
+      this.loadedHistoryPersonalMemoryAllowed === currentPersonalMemoryAllowed
+    ) {
+      return;
+    }
     await this.loadFromDb();
   }
 
@@ -943,6 +992,23 @@ export class Conversation {
     this.hostAppControlProxy = proxy;
   }
 
+  ensureHostProxiesForTurn(
+    sourceInterface: import("../channels/types.js").InterfaceId | undefined,
+  ): void {
+    if (
+      shouldAttachHostProxyForCapability("host_cu", sourceInterface) &&
+      !this.hostCuProxy
+    ) {
+      this.setHostCuProxy(new HostCuProxy());
+    }
+    if (
+      shouldAttachHostProxyForCapability("host_app_control", sourceInterface) &&
+      !this.hostAppControlProxy
+    ) {
+      this.setHostAppControlProxy(new HostAppControlProxy(this.conversationId));
+    }
+  }
+
   // ── Server-authoritative state signals ─────────────────────────────
 
   emitConfirmationStateChanged(
@@ -991,7 +1057,9 @@ export class Conversation {
     }
   }
 
-  async forceCompact(): Promise<ContextWindowResult> {
+  async forceCompact(options?: {
+    targetInputTokensOverride?: number;
+  }): Promise<ContextWindowResult> {
     const conversationRow = getConversation(this.conversationId);
     const overrideProfile =
       getConversationOverrideProfileFromRow(conversationRow) ?? null;
@@ -1007,7 +1075,9 @@ export class Conversation {
       }
     ).updateConfig?.(
       contextWindowConfigFromEffective(
-        config.llm.default.contextWindow,
+        resolveCallSiteConfig("mainAgent", config.llm, {
+          overrideProfile: overrideProfile ?? undefined,
+        }).contextWindow,
         effectiveContextWindow,
       ),
     );
@@ -1037,6 +1107,7 @@ export class Conversation {
         conversationOriginChannel:
           getConversationOriginChannel(this.conversationId) ?? undefined,
         overrideProfile,
+        targetInputTokensOverride: options?.targetInputTokensOverride,
       },
     );
     // Track circuit-breaker state for user-initiated `/compact` and other