@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/daemon/conversation-store.ts

@@ -10,13 +10,12 @@
  * creation/reuse lifecycle — provider wiring, rate limiting, system
  * prompt assembly, and DB hydration. DaemonServer calls
  * {@link initConversationLifecycle} once at construction time to
- * supply the few remaining lifecycle references (evictor, CES client,
- * shared rate-limit timestamps, broadcast).
+ * supply the few remaining lifecycle references (evictor, shared
+ * rate-limit timestamps, broadcast).
  */
 
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
-import type { CesClient } from "../credential-execution/client.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import { wrapWithCallSiteRouting } from "../providers/call-site-routing.js";
 import { resolveDefaultProvider } from "../providers/connection-resolution.js";
@@ -68,7 +67,6 @@ const conversationCreating = new Map<string, Promise<Conversation>>();
 
 /** Lifecycle refs injected once by DaemonServer at construction. */
 let _evictor: ConversationEvictor | null = null;
-let _cesClientPromise: Promise<CesClient | undefined> | undefined;
 let _sharedRequestTimestamps: number[] = [];
 
 /**
@@ -77,23 +75,12 @@ let _sharedRequestTimestamps: number[] = [];
  */
 export function initConversationLifecycle(refs: {
   evictor: ConversationEvictor;
-  cesClientPromise?: Promise<CesClient | undefined>;
   sharedRequestTimestamps: number[];
 }): void {
   _evictor = refs.evictor;
-  _cesClientPromise = refs.cesClientPromise;
   _sharedRequestTimestamps = refs.sharedRequestTimestamps;
 }
 
-/**
- * Update the CES client promise after async initialization completes.
- */
-export function setCesClientPromise(
-  p: Promise<CesClient | undefined> | undefined,
-): void {
-  _cesClientPromise = p;
-}
-
 function applyTransportMetadata(
   conversation: Conversation,
   options: ConversationCreateOptions | undefined,
@@ -177,9 +164,6 @@ export async function getOrCreateConversation(
         storedOptions?.systemPromptOverride ?? buildSystemPrompt();
       const maxTokens = storedOptions?.maxResponseTokens;
 
-      const sharedCesClient = _cesClientPromise
-        ? await _cesClientPromise
-        : undefined;
       const newConversation = new Conversation(
         conversationId,
         provider,
@@ -188,7 +172,6 @@ export async function getOrCreateConversation(
         workingDir,
         {
           maxTokens,
-          sharedCesClient,
           speedOverride: storedOptions?.speed,
           modelOverride: storedOptions?.modelOverride,
         },

package/src/daemon/conversation-tool-setup.ts

@@ -13,6 +13,7 @@ import {
 } from "../channels/types.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import { getConfig } from "../config/loader.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
@@ -34,6 +35,10 @@ import {
   type ToolExecutionResult,
   type ToolLifecycleEventHandler,
 } from "../tools/types.js";
+import {
+  resolveUsageAttribution,
+  type UsageAttributionSnapshot,
+} from "../usage/attribution.js";
 import { getLogger } from "../util/logger.js";
 import {
   projectSkillTools,
@@ -59,6 +64,45 @@ import {
 import type { ToolSetupContext } from "./tool-setup-types.js";
 export type { ToolSetupContext } from "./tool-setup-types.js";
 
+// ── resolveConversationAttribution ───────────────────────────────────
+
+/**
+ * Resolve the model attribution snapshot for the conversation at invocation
+ * time (provider/model/profile that issued the current turn). Mirrors how
+ * the agent-loop usage path builds its `UsageAttributionInput` — the
+ * current turn's call site (`runAgentLoopImpl` sets `ctx.currentCallSite`
+ * from `options.callSite`, defaulting to `mainAgent`) plus the
+ * conversation's per-turn override profile — so `profileSource` resolves
+ * to `call_site`/`conversation`/`active`/`default` exactly as `llm_usage`
+ * records do for the same turn (non-main turns like voice `callAgent` or
+ * `filingAgent` attribute their own call-site config, not the main
+ * agent's). The conversation id is threaded as the mix selection seed so
+ * mix-profile arms match what the dispatch path actually ran.
+ *
+ * Returns `null` on any failure: attribution is telemetry-only and must
+ * never break tool execution (or skill loads, which reuse this helper).
+ */
+export function resolveConversationAttribution(
+  ctx: Pick<
+    ToolSetupContext,
+    "conversationId" | "currentCallSite" | "currentTurnOverrideProfile"
+  >,
+): UsageAttributionSnapshot | null {
+  try {
+    return resolveUsageAttribution({
+      callSite: ctx.currentCallSite ?? "mainAgent",
+      overrideProfile: ctx.currentTurnOverrideProfile ?? null,
+      selectionSeed: ctx.conversationId,
+    });
+  } catch (err) {
+    log.debug(
+      { err, conversationId: ctx.conversationId },
+      "Failed to resolve conversation attribution for telemetry (non-fatal)",
+    );
+    return null;
+  }
+}
+
 // ── createToolExecutor ───────────────────────────────────────────────
 
 /**
@@ -128,9 +172,9 @@ export function createToolExecutor(
       diskPressureCleanupModeActive: ctx.diskPressureCleanupModeActive,
       toolUseId,
       isPlatformHosted: getIsPlatform(),
-      cesClient: ctx.cesClient,
       transportInterface: ctx.transportInterface,
       overrideProfile: ctx.currentTurnOverrideProfile,
+      attribution: resolveConversationAttribution(ctx),
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
         // Tool context's sendToClient uses a loose { type: string; [key: string]: unknown }
@@ -299,6 +343,12 @@ export interface SkillProjectionContext {
   readonly skillProjectionCache: SkillProjectionCache;
   readonly coreToolNames: Set<string>;
   allowedToolNames?: Set<string>;
+  /**
+   * Durable copy of the full tool set resolved on the most recent turn, used
+   * by read-only inventory queries. Set alongside {@link allowedToolNames}
+   * but, unlike that per-turn execution gate, never cleared at turn teardown.
+   */
+  lastResolvedToolNames?: Set<string>;
   /** When > 0, the resolveTools callback returns no tools at all. */
   toolsDisabledDepth: number;
   /** Channel capabilities — read lazily per turn for conditional tool filtering. */
@@ -326,6 +376,17 @@ export interface SkillProjectionContext {
   readonly transportInterface?: InterfaceId;
   /** Per-turn override profile, read by the switch_inference_profile tool injection. */
   currentTurnOverrideProfile?: string;
+  /**
+   * Conversation id for `skill_loaded` telemetry. Absent (e.g. minimal test
+   * contexts) disables telemetry recording in the skill projection.
+   */
+  readonly conversationId?: string;
+  /**
+   * The LLM call site driving the current turn (see
+   * {@link ToolSetupContext.currentCallSite}) — read per turn so skill_loaded
+   * telemetry attributes the provider/model/profile the turn actually ran on.
+   */
+  currentCallSite?: LLMCallSite;
 }
 
 // ── Conditional tool sets ────────────────────────────────────────────
@@ -437,6 +498,13 @@ export function isToolActiveForContext(
   ) {
     return false;
   }
+  if (name === "remember") {
+    try {
+      return getConfig().memory?.enabled !== false;
+    } catch {
+      return true;
+    }
+  }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
     if (
       ctx.channelCapabilities?.channel === "slack" &&
@@ -592,6 +660,19 @@ export function createResolveToolsCallback(
       preactivatedSkillIds: effectivePreactivated,
       previouslyActiveSkillIds: ctx.skillProjectionState,
       cache: ctx.skillProjectionCache,
+      // skill_loaded telemetry context — resolved per turn so attribution
+      // reflects the call site/profile the current turn actually runs on.
+      telemetry:
+        ctx.conversationId !== undefined
+          ? {
+              conversationId: ctx.conversationId,
+              attribution: resolveConversationAttribution({
+                conversationId: ctx.conversationId,
+                currentCallSite: ctx.currentCallSite,
+                currentTurnOverrideProfile: ctx.currentTurnOverrideProfile,
+              }),
+            }
+          : undefined,
     });
     const turnAllowed = new Set(allBaseDefs.map((d) => d.name));
     for (const name of projection.allowedToolNames) {
@@ -602,6 +683,11 @@ export function createResolveToolsCallback(
       if (excluded.has(name)) continue;
       turnAllowed.add(name);
     }
+    // Record the full resolved inventory durably for read-only queries before
+    // any degraded-mode narrowing below — `allowedToolNames` is the per-turn
+    // execution gate (cleared at teardown and restricted under disk pressure),
+    // whereas this snapshot answers "what tools does this conversation have".
+    ctx.lastResolvedToolNames = turnAllowed;
     if (ctx.diskPressureCleanupModeActive === true) {
       const cleanupDefs = allBaseDefs.filter((d) =>
         isDiskPressureCleanupToolName(d.name),

package/src/daemon/conversation.ts

@@ -33,7 +33,6 @@ import {
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite, Speed } from "../config/schemas/llm.js";
-import type { CesClient } from "../credential-execution/client.js";
 import { EventBus } from "../events/bus.js";
 import type { AssistantDomainEvents } from "../events/domain-events.js";
 import { createToolAuditListener } from "../events/tool-audit-listener.js";
@@ -53,7 +52,7 @@ import {
   setConversationHistoryStrippedAt,
 } from "../memory/conversation-crud.js";
 import { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
-import { shouldExposePersonalMemory } from "../memory/v2/static-context.js";
+import { unwrapMemoryBlock, wrapMemoryBlock } from "../memory/memory-marker.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { UserDecision } from "../permissions/types.js";
@@ -68,6 +67,11 @@ import {
   createContextSummaryMessage,
 } from "../plugins/defaults/compaction/window-manager.js";
 import { repairHistory } from "../plugins/defaults/history-repair/terminal.js";
+import {
+  getPrunedSlugs,
+  MEMORY_V3_INJECTED_BLOCK_METADATA_KEY,
+} from "../plugins/defaults/memory-v3-shadow/ever-injected-store.js";
+import { filterPrunedCardSections } from "../plugins/defaults/memory-v3-shadow/prune.js";
 import {
   applyBootstrapTemplate,
   buildSystemPrompt,
@@ -129,6 +133,7 @@ import { MessageQueue } from "./conversation-queue-manager.js";
 import {
   type ChannelCapabilities,
   getSlackCompactionWatermarkForPrefix,
+  type InboundActorContext,
   loadSlackChronologicalContext,
   stripInjectionsForCompaction,
 } from "./conversation-runtime-assembly.js";
@@ -176,11 +181,10 @@ export type {
   QueueDrainReason,
   QueuePolicy,
 } from "./conversation-queue-manager.js";
-import { resolveTrustClass, type TrustContext } from "./trust-context.js";
+import { isPersonalMemoryAllowed, type TrustContext } from "./trust-context.js";
 
 export interface ConversationConstructorOptions {
   maxTokens?: number;
-  sharedCesClient?: CesClient;
   speedOverride?: Speed;
   cacheTtl?: "5m" | "1h";
   modelOverride?: string;
@@ -202,6 +206,15 @@ export class Conversation {
   /** @internal */ eventBus = new EventBus<AssistantDomainEvents>();
   /** @internal */ workingDir: string;
   /** @internal */ allowedToolNames?: Set<string>;
+  /**
+   * Durable copy of the full tool set resolved on the most recent turn,
+   * kept for read-only inventory queries. Unlike {@link allowedToolNames}
+   * — the per-turn execution gate the agent loop clears at turn teardown —
+   * this survives between turns so a query against an idle conversation
+   * still reports the skill/MCP tools it gained over its lifecycle.
+   * @internal
+   */
+  lastResolvedToolNames?: Set<string>;
   /** @internal */ diskPressureCleanupModeActive?: boolean;
   /** @internal */ toolsDisabledDepth = 0;
   /** @internal */ preactivatedSkillIds?: string[];
@@ -256,7 +269,6 @@ export class Conversation {
    * @internal
    */
   hostAppControlProxy?: HostAppControlProxy;
-  /** @internal */ cesClient?: CesClient;
   /** @internal */ readonly queue = new MessageQueue();
   /** @internal */ currentActiveSurfaceId?: string;
   /** @internal */ currentPage?: string;
@@ -269,6 +281,18 @@ export class Conversation {
    * another actor's persona mid-turn.
    */
   /** @internal */ currentTurnTrustContext?: TrustContext;
+  /**
+   * The model-facing inbound actor context resolved once at turn start from
+   * {@link currentTurnTrustContext}. Frozen here because resolving it reads the
+   * live contact/member registry (member status/policy, contact notes,
+   * interaction count), which a contact tool or the guardian can mutate
+   * mid-turn; post-compaction re-injection reads this snapshot so it re-emits
+   * the actor context the turn's initial assembly saw rather than re-resolving
+   * against drifted registry state. `null` on guardian turns and when there is
+   * no trust context (the actor section is suppressed).
+   * @internal
+   */
+  currentTurnInboundActorContext?: InboundActorContext | null;
   /** @internal */ currentTurnChannelCapabilities?: ChannelCapabilities;
   /** @internal */ currentTurnOverrideProfile?: string;
   /** @internal */ toolRoutedProfile?: string;
@@ -477,13 +501,7 @@ export class Conversation {
     workingDir: string,
     options?: ConversationConstructorOptions,
   ) {
-    const {
-      maxTokens,
-      sharedCesClient,
-      speedOverride,
-      cacheTtl,
-      modelOverride,
-    } = options ?? {};
+    const { maxTokens, speedOverride, cacheTtl, modelOverride } = options ?? {};
     this.conversationId = conversationId;
     this.systemPrompt = systemPrompt;
     this.provider = provider;
@@ -552,13 +570,6 @@ export class Conversation {
     const resolvedMainAgent = resolveCallSiteConfig("mainAgent", config.llm);
     this.streamThinking = resolvedMainAgent.thinking.streamThinking ?? false;
 
-    // CES (Credential Execution Service) — use the shared server-level client.
-    // The CES sidecar accepts exactly one bootstrap connection, so the
-    // client is owned by DaemonServer and passed in here.
-    if (sharedCesClient) {
-      this.cesClient = sharedCesClient;
-    }
-
     const resolveTools = createResolveToolsCallback(toolDefs, this);
 
     const configuredMaxTokens = maxTokens;
@@ -802,16 +813,30 @@ export class Conversation {
       preStrippedCount = boundary === -1 ? slicedDbMessages.length : boundary;
     }
 
-    // Mirror the injection-time gate (`shouldExposePersonalMemory` in
-    // `conversation-agent-loop.ts`) so background/local conversations
-    // (sourceChannel `undefined` or `"vellum"`) can rehydrate the persisted
-    // v2 static memory block. Use `resolveTrustClass` for parity with the
-    // agent loop — it folds in the HTTP-auth-disabled dev bypass so
-    // rehydration and injection agree on the effective trust class.
-    const personalMemoryAllowed = shouldExposePersonalMemory({
-      sourceChannel: this.trustContext?.sourceChannel,
-      isTrustedActor: resolveTrustClass(this.trustContext) === "guardian",
-    });
+    // The injection-time personal-memory gate, so background/local
+    // conversations (sourceChannel `undefined` or `"vellum"`) can rehydrate
+    // the persisted v2 static memory block. The shared helper folds in the
+    // HTTP-auth-disabled dev bypass so rehydration and injection agree on the
+    // effective trust class.
+    const personalMemoryAllowed = isPersonalMemoryAllowed(this.trustContext);
+    // Pruned v3 card slugs, read lazily on the first row that carries a v3
+    // block (most conversations carry none, so most loads never query). The
+    // prune valve marks cards pruned in the everInjected store instead of
+    // rewriting the persisted metadata, so the v3 rehydration splice below
+    // re-applies the filter on every load — that is what makes a prune
+    // survive daemon restarts. Defensive catch: a store failure degrades to
+    // an unfiltered (pre-prune) rehydration rather than a failed load.
+    let v3PrunedSlugsMemo: Set<string> | null = null;
+    const v3PrunedSlugs = (): Set<string> => {
+      if (v3PrunedSlugsMemo === null) {
+        try {
+          v3PrunedSlugsMemo = getPrunedSlugs(this.conversationId);
+        } catch {
+          v3PrunedSlugsMemo = new Set();
+        }
+      }
+      return v3PrunedSlugsMemo;
+    };
     const parsedMessages: Message[] = slicedDbMessages.map((m, index, arr) => {
       const isPreStripped = index < preStrippedCount;
       const role = m.role as "user" | "assistant";
@@ -842,18 +867,21 @@ export class Conversation {
           // so the resulting layout matches `applyRuntimeInjections`'s
           // after-memory-prefix splices in ascending injector order
           // (pkb-context 30, pkb-reminder 35, memory-v2-static 38,
-          // now-md 40 — the v2 static block lands inside the memory
-          // prefix, so now-md splices *after* it):
+          // now-md 40, memory-v3-shadow 1000 — the v2 static block lands
+          // inside the memory prefix, so now-md splices *after* it; the
+          // v3 card block is `<memory>`-wrapped and splices LAST, landing
+          // at the memory boundary after the `<info>` block but before
+          // now-md's earlier splice):
           //   [<workspace>, <turn_context>, <memory>dynamic</memory>,
-          //    <info>v2static</info>, <NOW.md>, <system_reminder>,
-          //    <knowledge_base>, ...original]
+          //    <info>v2static</info>, <memory>v3cards</memory>, <NOW.md>,
+          //    <system_reminder>, <knowledge_base>, ...original]
           // The v2 static block is replayed verbatim from stored metadata,
           // so rows may carry either `<info>…</info>` or `<memory>…</memory>`
           // depending on when they were persisted.
           // Required so Anthropic's prefix cache keeps matching msg[0]
           // across daemon restart and conversation eviction. The tail
-          // row only rehydrates `memoryInjectedBlock` — the next turn
-          // re-injects the rest fresh.
+          // row only rehydrates `memoryInjectedBlock` and the v3 card
+          // block — the next turn re-injects the rest fresh.
           if (!isTail && typeof meta.pkbContextBlock === "string") {
             content = [
               { type: "text" as const, text: meta.pkbContextBlock },
@@ -875,10 +903,42 @@ export class Conversation {
             ];
           }
 
+          // The memory-v3 frozen card block (net-new compact cards) persists
+          // under its own key, stored UNWRAPPED like v2's dynamic block below.
+          // Rehydrated on ALL rows (tail included): the next turn injects only
+          // net-new cards — deduped via the v3 everInjected store — so this
+          // row's block must be back in history byte-identical for the dedup
+          // (and the provider prefix cache) to hold. A row carries at most one
+          // of the v3 and v2-dynamic keys (the user-prompt-submit hook
+          // persists them mutually exclusively). Spliced here — before the v2
+          // static and dynamic blocks — because prepends invert: executing
+          // first leaves it BELOW both in the final content, matching the
+          // live after-memory-prefix splice (order 1000 lands at the memory
+          // boundary, after `<info>` / `<memory>` prefix blocks).
+          // Pruned slugs' card sections are filtered out here (the metadata
+          // itself is never rewritten — auditable and reversible); an
+          // all-pruned block is skipped entirely, matching the live strip in
+          // `memory-v3-shadow/prune.ts`.
+          if (typeof meta[MEMORY_V3_INJECTED_BLOCK_METADATA_KEY] === "string") {
+            const v3Block = meta[
+              MEMORY_V3_INJECTED_BLOCK_METADATA_KEY
+            ] as string;
+            const v3Resident = filterPrunedCardSections(
+              unwrapMemoryBlock(v3Block),
+              v3PrunedSlugs(),
+            );
+            if (v3Resident.length > 0) {
+              content = [
+                { type: "text" as const, text: wrapMemoryBlock(v3Resident) },
+                ...content,
+              ];
+            }
+          }
+
           // The v2 static memory block (essentials/threads/recent/buffer
           // wrapped in either `<info>…</info>` or `<memory>…</memory>`)
           // carries personal user memory. Trust-gated to mirror
-          // `shouldExposePersonalMemory` at injection time — untrusted-actor
+          // `isPersonalMemoryAllowed` at injection time — untrusted-actor
           // views must not read persisted personal memory back through
           // metadata. Skipped on the tail row because the next turn
           // re-injects fresh content on full-mode turns.
@@ -902,15 +962,12 @@ export class Conversation {
           // legitimate unwrapped payloads that happen to start with
           // "<memory>\n" or end with "\n</memory>".
           if (typeof meta.memoryInjectedBlock === "string") {
-            const block = meta.memoryInjectedBlock;
-            const inner =
-              block.startsWith("<memory>\n") && block.endsWith("\n</memory>")
-                ? block.slice("<memory>\n".length, -"\n</memory>".length)
-                : block;
             content = [
               {
                 type: "text" as const,
-                text: `<memory>\n${inner}\n</memory>`,
+                text: wrapMemoryBlock(
+                  unwrapMemoryBlock(meta.memoryInjectedBlock),
+                ),
               },
               ...content,
             ];
@@ -1044,14 +1101,13 @@ export class Conversation {
   async ensureActorScopedHistory(): Promise<void> {
     const currentTrustClass = this.trustContext?.trustClass;
     // `loadFromDb` gates personal-memory rehydration on `sourceChannel` too
-    // (via `shouldExposePersonalMemory`), so a same-trust-class reuse from a
+    // (via `isPersonalMemoryAllowed`), so a same-trust-class reuse from a
     // different channel (e.g. internal `vellum` → remote channel) must also
     // trigger a reload. Otherwise stale personal-memory blocks can leak to
     // an untrusted remote turn, or be hidden when they should be present.
-    const currentPersonalMemoryAllowed = shouldExposePersonalMemory({
-      sourceChannel: this.trustContext?.sourceChannel,
-      isTrustedActor: resolveTrustClass(this.trustContext) === "guardian",
-    });
+    const currentPersonalMemoryAllowed = isPersonalMemoryAllowed(
+      this.trustContext,
+    );
     if (
       this.loadedHistoryTrustClass === currentTrustClass &&
       this.loadedHistoryPersonalMemoryAllowed === currentPersonalMemoryAllowed
@@ -1207,9 +1263,6 @@ export class Conversation {
     this.hostCuProxy?.dispose();
     this.hostAppControlProxy?.dispose();
     this.hostAppControlProxy = undefined;
-    // CES client is owned by DaemonServer — just drop the reference.
-    // Do NOT close it here; the server manages the CES lifecycle.
-    this.cesClient = undefined;
     this.activeContextNodeIds = this.graphMemory.tracker.getActiveNodeIds();
     this.graphMemory.persistState();
     this.graphMemory.dispose();
@@ -1706,6 +1759,22 @@ export class Conversation {
     });
   }
 
+  // ── Tools ────────────────────────────────────────────────────────
+
+  /**
+   * The set of tool names available to this conversation as of its most
+   * recent turn — including skill/MCP tools registered over the
+   * conversation's lifecycle. Reads the durable {@link lastResolvedToolNames}
+   * snapshot the `resolveTools` callback records each turn (which, unlike the
+   * per-turn `allowedToolNames` gate, is not cleared at turn teardown); before
+   * the first turn it falls back to the core tool set. This is a pure read: it
+   * does not re-run `resolveTools`, which has registry/projection side effects
+   * that must not fire outside a turn.
+   */
+  getRegisteredToolNames(): Set<string> {
+    return new Set(this.lastResolvedToolNames ?? this.coreToolNames);
+  }
+
   // ── History ──────────────────────────────────────────────────────
 
   getMessages(): Message[] {