@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/daemon/external-plugins-bootstrap.ts

@@ -14,7 +14,7 @@
  * 2. Walks {@link getRegisteredPlugins} in registration order.
  * 3. For each plugin, consults `manifest.requiresFlag` against
  *    {@link isAssistantFeatureFlagEnabled}. If any listed flag is disabled,
- *    the plugin is skipped wholesale — no `init()`, no tool/route/skill
+ *    the plugin is skipped wholesale — no `init()`, no tool/route
  *    contributions, no entry in the shutdown hook, and the plugin is also
  *    dropped from the registry via {@link unregisterPlugin} so none of its
  *    hooks participate in the turn lifecycle. This is the primary mechanism for
@@ -29,22 +29,21 @@
  *    through untouched).
  * 6. Creates `<workspaceDir>/plugins-data/<plugin>/` on demand for per-plugin
  *    writable state and exposes it via {@link PluginInitContext.pluginStorageDir}.
- * 7. For each surviving plugin, registers its contributed tools, routes,
- *    and skills into their global registries via
- *    {@link registerPluginTools}, {@link registerSkillRoute}, and
- *    {@link registerPluginSkills}. Contributions land BEFORE `init()` so
+ * 7. For each surviving plugin, registers its contributed tools and routes
+ *    into their global registries via {@link registerPluginTools} and
+ *    {@link registerSkillRoute}. Contributions land BEFORE `init()` so
  *    the plugin's hook can observe a registry where its own model-visible
  *    surface is already wired — useful for plugins that want to attach
  *    metadata, warm caches, or otherwise interact with their own
  *    contributions during initialization.
- * 8. Awaits `plugin.init(ctx)` sequentially. An init failure surfaces as a
- *    {@link PluginExecutionError} naming the offending plugin and aborts
- *    bootstrap — later plugins' `init()` never runs and the daemon fails
- *    startup cleanly rather than coming up in a half-wired state. The
- *    failing plugin's already-registered tools, routes, and skills are
- *    rolled back before the error propagates so the registry never
- *    carries state contributed by a plugin that never finished
- *    initializing.
+ * 8. Awaits `plugin.init(ctx)` sequentially. An init failure is contained to
+ *    the offending plugin: its already-registered tools and routes are rolled
+ *    back, it is dropped from the registry, the failure is logged, and
+ *    bootstrap continues with the remaining plugins. A single plugin's failure
+ *    never deregisters plugins that already initialized — in particular the
+ *    first-party defaults, which carry core turn behavior (memory retrieval,
+ *    history repair, title generation) — so the daemon comes up with the
+ *    failing plugin absent rather than blacking out the whole plugin layer.
  *
  * A single shutdown hook is registered via
  * {@link registerShutdownHook} that walks the plugin list in **reverse
@@ -65,12 +64,7 @@ import { getConfig } from "../config/loader.js";
 import type { AssistantConfig } from "../config/schema.js";
 import { HOOKS } from "../plugin-api/constants.js";
 import { registerDefaultPlugins } from "../plugins/defaults/index.js";
-import { installPluginRuntime } from "../plugins/external-api.js";
 import { buildExternalPlugin } from "../plugins/external-plugin-loader.js";
-import {
-  registerPluginSkills,
-  unregisterPluginSkills,
-} from "../plugins/plugin-skill-contributions.js";
 import {
   getRegisteredPlugin,
   getRegisteredPlugins,
@@ -81,7 +75,6 @@ import {
   type Plugin,
   PluginExecutionError,
   type PluginShutdownContext,
-  type PluginSkillRegistration,
 } from "../plugins/types.js";
 import { loadUserPlugins } from "../plugins/user-loader.js";
 import {
@@ -187,21 +180,17 @@ function getDisabledPluginFlag(
  * Bring the plugin layer up during daemon startup. Runs the full sequence in
  * the one order the rest of the system depends on:
  *
- * 1. Install the `globalThis.__vellumPluginRuntime` bridge so plugins can touch
- *    it from their module body (see `plugins/external-api.ts` — compiled-binary
- *    module identity).
- * 2. Register the first-party defaults so their middleware composes innermost,
+ * 1. Register the first-party defaults so their middleware composes innermost,
  *    ahead of any user plugins.
- * 3. Load user plugins from `<workspaceDir>/plugins/*`. A failing user plugin is
+ * 2. Load user plugins from `<workspaceDir>/plugins/*`. A failing user plugin is
  *    logged and skipped; `loadUserPlugins()` closes the registration window
  *    when it returns, so the defaults must already be registered by then.
- * 4. Run every registered plugin's `init()` via {@link bootstrapPlugins}.
+ * 3. Run every registered plugin's `init()` via {@link bootstrapPlugins}.
  *
  * Plugin bootstrap is wrapped so a failing plugin cannot block daemon startup —
  * the daemon comes up with degraded plugin functionality instead.
  */
 export async function initializePlugins(): Promise<void> {
-  installPluginRuntime();
   registerDefaultPlugins();
   await loadUserPlugins();
   try {
@@ -218,9 +207,10 @@ export async function initializePlugins(): Promise<void> {
  * Run every registered plugin's `init()` hook sequentially and install a
  * reverse-order shutdown hook. See the module docstring for full semantics.
  *
- * Returns once every plugin has finished initialising successfully. Throws a
- * {@link PluginExecutionError} on the first failure — the error message names
- * the offending plugin so operators see which `init()` bailed.
+ * Returns once every plugin has been processed. A plugin whose `init()` throws
+ * is rolled back, dropped from the registry, and logged; bootstrap continues
+ * with the rest, so one failing plugin never blocks the others — or the
+ * first-party defaults — from coming up.
  *
  * Must be called after any custom/third-party plugin registrations have run
  * and before the first conversation is served. First-party defaults are
@@ -259,35 +249,14 @@ export async function bootstrapPlugins(): Promise<void> {
   // onShutdown" invariant.
   const activePlugins: ActivePlugin[] = [];
 
-  // Tear down a plugin's contributions AND remove it from the registry. The
-  // two steps always move together on the bootstrap failure path: the former
-  // clears tools/routes/skills (so they stop appearing to the model/HTTP
-  // server), the latter drops the plugin's entry from the Map (so the registry
-  // doesn't expose an uninitialized plugin's hooks).
   // Shutdown context is identical for every plugin in this boot — construct
-  // once and reuse across the bootstrap-failure rollback and the normal
-  // shutdown hook below. Only `assistantVersion` is exposed today; future
-  // additions live on {@link PluginShutdownContext}.
+  // once and reuse across the per-plugin teardown and the normal shutdown
+  // hook below. Only `assistantVersion` is exposed today; future additions
+  // live on {@link PluginShutdownContext}.
   const shutdownContext: PluginShutdownContext = {
     assistantVersion: APP_VERSION,
   };
 
-  async function rollbackPlugin(active: ActivePlugin): Promise<void> {
-    await teardownPlugin(active, "bootstrap-failed", shutdownContext);
-    unregisterPlugin(active.plugin.manifest.name);
-  }
-
-  // If one plugin's init or contribution phase throws, tear down any plugins
-  // that already fully initialized (in reverse registration order) before
-  // re-throwing. Without this, a mid-loop failure would leave earlier plugins
-  // with live tools/routes/skills and no `onShutdown()` call — the shutdown
-  // hook is only registered once the loop completes successfully.
-  async function teardownPartialInit(): Promise<void> {
-    for (let i = activePlugins.length - 1; i >= 0; i--) {
-      await rollbackPlugin(activePlugins[i]!);
-    }
-  }
-
   for (const plugin of plugins) {
     const name = plugin.manifest.name;
     const disabledFlag = getDisabledPluginFlag(plugin, assistantConfig);
@@ -303,9 +272,18 @@ export async function bootstrapPlugins(): Promise<void> {
     try {
       activePlugins.push(await initializePlugin(plugin, assistantConfig));
     } catch (err) {
+      // Contain the failure to this plugin. `initializePlugin` already rolled
+      // back its own partial tool/route contributions, so we just drop
+      // it from the registry and move on. A single plugin's init failure must
+      // never deregister the plugins that already came up — above all the
+      // first-party defaults, which carry core turn behavior. The daemon stays
+      // reachable with the failing plugin absent rather than losing the whole
+      // plugin layer.
       unregisterPlugin(name);
-      await teardownPartialInit();
-      throw err;
+      log.warn(
+        { err, plugin: name },
+        `plugin ${name} failed to initialize — skipping (continuing with remaining plugins)`,
+      );
     }
   }
 
@@ -323,12 +301,6 @@ export async function bootstrapPlugins(): Promise<void> {
   //   3. Call `onShutdown()` (if defined) so the plugin can release resources
   //      (background tasks, timers, connections) with its tools and routes
   //      already removed.
-  //   4. Unregister contributed skills via the ref-counted helper. Skills tear
-  //      down last so `onShutdown()` can still invoke skill-resolving code
-  //      (e.g. to flush pending skill work) before the catalog is emptied.
-  //      This mirrors the symmetry of registerPluginSkills() — every
-  //      successful registration must get a matching unregister call,
-  //      regardless of whether onShutdown throws.
   const shutdownSnapshot: ActivePlugin[] = [...activePlugins];
   registerShutdownHook("plugins", async (reason) => {
     for (let i = shutdownSnapshot.length - 1; i >= 0; i--) {
@@ -404,23 +376,6 @@ async function initializePlugin(
       );
     }
 
-    if (plugin.skills && plugin.skills.length > 0) {
-      try {
-        registerPluginSkills(
-          name,
-          plugin.skills as readonly PluginSkillRegistration[],
-        );
-      } catch (err) {
-        throw new PluginExecutionError(
-          `plugin ${name} skill registration failed: ${
-            err instanceof Error ? err.message : String(err)
-          }`,
-          name,
-          { cause: err },
-        );
-      }
-    }
-
     if (plugin.hooks?.[HOOKS.INIT]) {
       try {
         await plugin.hooks[HOOKS.INIT](initContext);
@@ -448,9 +403,6 @@ async function initializePlugin(
         unregisterSkillRoute(handle);
       }
       unregisterPluginTools(name);
-      if (plugin.skills && plugin.skills.length > 0) {
-        unregisterPluginSkills(name);
-      }
     }
     throw err;
   }
@@ -458,9 +410,9 @@ async function initializePlugin(
 
 /**
  * Tear down a single fully-initialized plugin: unregister routes, unregister
- * tools, invoke `onShutdown()` if present, then unregister skills. Every step
- * swallows errors and logs with plugin attribution so one bad plugin can't
- * block teardown of the rest.
+ * tools, then invoke `onShutdown()` if present. Every step swallows errors and
+ * logs with plugin attribution so one bad plugin can't block teardown of the
+ * rest.
  *
  * Shared between the normal shutdown hook and the bootstrap error path; both
  * consume plugins that already cleared every contribution step.
@@ -514,17 +466,6 @@ async function teardownPlugin(
       );
     }
   }
-
-  if (plugin.skills && plugin.skills.length > 0) {
-    try {
-      unregisterPluginSkills(name);
-    } catch (err) {
-      log.warn(
-        { err, plugin: name, reason },
-        "plugin skill unregistration failed (continuing with remaining plugins)",
-      );
-    }
-  }
 }
 
 /** Rebuild a changed external plugin and swap it into the live registry. */

package/src/daemon/handlers/config-channels.ts

@@ -31,6 +31,7 @@ import {
 } from "../../runtime/channel-verification-service.js";
 import {
   cancelOutbound,
+  deliverVerificationEmail,
   deliverVerificationSlack,
   deliverVerificationTelegram,
   DESTINATION_RATE_WINDOW_MS,
@@ -555,7 +556,11 @@ export async function handleChannelVerificationSession(
           const { userId, text, assistantId: aid } = result._pendingSlackDm;
           deliverVerificationSlack(userId, text, aid);
         }
-        const { _pendingSlackDm: _, ...publicResult } = result;
+        if (result._pendingEmail) {
+          const { to, text, subject, assistantId: aid } = result._pendingEmail;
+          deliverVerificationEmail(to, text, subject, aid);
+        }
+        const { _pendingSlackDm: _, _pendingEmail: __, ...publicResult } = result;
         broadcastMessage({
           type: "channel_verification_session_response",
           ...publicResult,
@@ -600,7 +605,11 @@ export async function handleChannelVerificationSession(
         const { userId, text, assistantId: aid } = result._pendingSlackDm;
         deliverVerificationSlack(userId, text, aid);
       }
-      const { _pendingSlackDm: _, ...publicResult } = result;
+      if (result._pendingEmail) {
+        const { to, text, subject, assistantId: aid } = result._pendingEmail;
+        deliverVerificationEmail(to, text, subject, aid);
+      }
+      const { _pendingSlackDm: _, _pendingEmail: __, ...publicResult } = result;
       broadcastMessage({
         type: "channel_verification_session_response",
         ...publicResult,

package/src/daemon/handlers/shared.ts

@@ -428,7 +428,15 @@ export function renderHistoryContent(
       finalizeSegment();
       thinkingSegments.push(block.thinking);
       contentOrder.push(`thinking:${thinkingSegments.length - 1}`);
-      contentBlocks.push({ type: "thinking", thinking: block.thinking });
+      const thinkingBlock: Extract<
+        ConversationContentBlock,
+        { type: "thinking" }
+      > = { type: "thinking", thinking: block.thinking };
+      if (typeof block._startedAt === "number")
+        thinkingBlock.startedAt = block._startedAt;
+      if (typeof block._completedAt === "number")
+        thinkingBlock.completedAt = block._completedAt;
+      contentBlocks.push(thinkingBlock);
       continue;
     }
 

package/src/daemon/handlers/skills.ts

@@ -314,9 +314,10 @@ function deriveKind(
 ): SlimSkillResponse["kind"] {
   if (source === "bundled") return "bundled";
   if (source === "catalog") return "catalog";
-  // Plugin-contributed skills are framework-provided like bundled skills —
+  // Plugin-resident skills are framework-provided like bundled skills —
   // expose them under the same "bundled" kind so the UI doesn't invent a
-  // new category that existing clients don't know how to render.
+  // new category that existing clients don't know how to render. Attribution
+  // to the owning plugin rides on the separate `owner` descriptor.
   if (source === "plugin") return "bundled";
   return "installed"; // managed, workspace, extra
 }
@@ -349,7 +350,8 @@ function toSlimSkillResponse(
   const origin = deriveOrigin(kind, summary.directoryPath, installMeta);
   const status: SlimSkillResponse["status"] = state;
 
-  const category = getCatalogCategoryMap().get(summary.id) ?? "system";
+  const category =
+    getCatalogCategoryMap().get(summary.id) ?? summary.category ?? "system";
   const base = {
     id: summary.id,
     name: summary.displayName,
@@ -359,6 +361,7 @@ function toSlimSkillResponse(
     kind,
     status,
     category,
+    owner: summary.owner,
   } as const;
 
   switch (origin) {
@@ -701,7 +704,9 @@ export async function getSkill(
     return { skill: detail };
   }
 
-  // vellum or custom origin — base fields only
+  // vellum or custom origin — base fields plus owner attribution. Plugin-
+  // resident skills are mapped to the vellum origin, so `owner` is how their
+  // `{ kind: "plugin", id }` provenance is surfaced on the detail response.
   const detail: SkillDetailResponse = {
     id: slim.id,
     name: slim.name,
@@ -712,6 +717,7 @@ export async function getSkill(
     origin: slim.origin,
     status: slim.status,
     category: slim.category,
+    owner: slim.owner,
   };
   return { skill: detail };
 }

package/src/daemon/host-app-control-proxy.ts

@@ -12,11 +12,12 @@
  * translation on top.
  *
  * **Session lock.** Only one conversation may hold an active app-control
- * session at a time, and that session is bound to a specific target app.
+ * session at a time, and that session is bound to a specific target app
+ * on a specific client.
  * The lock is module-level (`activeAppControlSession`) because the session
  * targets the user's actual desktop application, which is a host-wide
  * resource. It is acquired optimistically when `app_control_start` is
- * dispatched (storing `(conversationId, app)`) so that the synchronous
+ * dispatched (storing `(conversationId, app, targetClientId)`) so that the synchronous
  * guard and the asynchronous host round-trip cannot race. A separate
  * `confirmedAppControlSession` tracks the last session the host reported
  * `running`; the rollback path on a failed `start` restores from the
@@ -32,7 +33,7 @@
  * user's medium-risk approval at start time is the consent boundary. All
  * other tools (observe / press / combo / sequence / type / click / drag)
  * require the calling conversation to own an active session targeting the
- * same `app`; otherwise the call is rejected before any host dispatch.
+ * same `app` and client; otherwise the call is rejected before any host dispatch.
  * This prevents prompt-injected tool calls from sending raw input to
  * arbitrary apps without the user having approved control of that
  * specific app.
@@ -78,9 +79,9 @@ const STUCK_REPEAT_THRESHOLD = 4;
 // ---------------------------------------------------------------------------
 
 /**
- * Active app-control session: the conversation that owns the lock and the
- * `app` it was approved against. Set on a successful `app_control_start`;
- * cleared by the owning proxy's `dispose()`.
+ * Active app-control session: the conversation that owns the lock, the
+ * `app` and client it was approved against. Set on a successful
+ * `app_control_start`; cleared by the owning proxy's `dispose()`.
  */
 export interface ActiveAppControlSession {
   conversationId: string;
@@ -90,6 +91,11 @@ export interface ActiveAppControlSession {
    * the `app` of subsequent non-start tool calls.
    */
   app: string;
+  /**
+   * The client selected for `app_control_start`. Undefined when the start
+   * was untargeted; subsequent calls must match the same value.
+   */
+  targetClientId?: string;
   /**
    * Strictly monotonic counter assigned when the session is created (in
    * `request()` for a `start`). Used by {@link promoteStartIfCurrent} to
@@ -153,11 +159,13 @@ export function _resetActiveAppControlSession(): void {
 export function _setActiveAppControlSession(session: {
   conversationId: string;
   app: string;
+  targetClientId?: string;
   dispatchedAt?: number;
 }): void {
   const full: ActiveAppControlSession = {
     conversationId: session.conversationId,
     app: session.app,
+    targetClientId: session.targetClientId,
     dispatchedAt: session.dispatchedAt ?? nextDispatchedAt++,
   };
   activeAppControlSession = full;
@@ -177,6 +185,7 @@ export function _setActiveAppControlSession(session: {
 function checkNonStartAuthorization(
   input: HostAppControlInput,
   conversationId: string,
+  targetClientId: string | undefined,
 ): ToolExecutionResult | null {
   if (activeAppControlSession == null) {
     return {
@@ -219,6 +228,16 @@ function checkNonStartAuthorization(
       isError: true,
     };
   }
+  if (activeAppControlSession.targetClientId !== targetClientId) {
+    return {
+      content:
+        `Active app-control session targets client ` +
+        `${activeAppControlSession.targetClientId ?? "<default>"}; cannot ` +
+        `send actions to client ${targetClientId ?? "<default>"}. Call ` +
+        `app_control_stop and app_control_start to switch clients.`,
+      isError: true,
+    };
+  }
   return null;
 }
 
@@ -284,11 +303,53 @@ export class HostAppControlProxy extends HostProxyBase<
       return { content: "Aborted", isError: true };
     }
 
+    // Resolve target client and enforce same-actor BEFORE acquiring the
+    // session lock. This way early-exit errors don't need rollback, and
+    // the resolved client id can be stored in the session.
+    let resolvedTargetClientId = targetClientId;
+    if (resolvedTargetClientId == null) {
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_app_control",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        return {
+          content:
+            "Multiple host_app_control clients are connected for this user. Specify target_client_id to disambiguate.",
+          isError: true,
+        };
+      }
+      if (resolved.kind === "match") {
+        resolvedTargetClientId = resolved.clientId;
+      } else if (
+        assistantEventHub.listClientsByCapability("host_app_control").length > 0
+      ) {
+        return {
+          content:
+            "App control is not available for the current actor. Connect a host_app_control-capable client as the same user.",
+          isError: true,
+        };
+      }
+    }
+
+    if (resolvedTargetClientId != null) {
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId: resolvedTargetClientId,
+        op: "host_app_control",
+      });
+      if (rejection) {
+        return rejection;
+      }
+    }
+
     // Authorization gate. `start` acquires the session lock (the user's
     // medium-risk approval is the consent boundary); all other tools must
-    // belong to the active session and target the same `app`. Without this
-    // gate, prompt-injected calls would bypass the start-time approval and
-    // send raw input to arbitrary apps.
+    // belong to the active session and target the same `app` and client.
+    // Without this gate, prompt-injected calls would bypass the start-time
+    // approval and send raw input to arbitrary apps or clients.
     let attemptedSession: ActiveAppControlSession | undefined;
     if (input.tool === "start") {
       if (
@@ -314,6 +375,7 @@ export class HostAppControlProxy extends HostProxyBase<
       attemptedSession = {
         conversationId: this.conversationId,
         app: input.app,
+        targetClientId: resolvedTargetClientId,
         dispatchedAt: nextDispatchedAt++,
       };
       activeAppControlSession = attemptedSession;
@@ -321,60 +383,13 @@ export class HostAppControlProxy extends HostProxyBase<
       const sessionError = checkNonStartAuthorization(
         input,
         this.conversationId,
+        resolvedTargetClientId,
       );
       if (sessionError != null) {
         return sessionError;
       }
     }
 
-    let resolvedTargetClientId = targetClientId;
-    if (resolvedTargetClientId == null) {
-      const resolved = pickSameUserAutoResolve({
-        hub: assistantEventHub,
-        capability: "host_app_control",
-        sourceActorPrincipalId,
-      });
-      if (resolved.kind === "ambiguous") {
-        if (input.tool === "start") {
-          this.rollbackStartIfCurrent(attemptedSession);
-        }
-        return {
-          content:
-            "Multiple host_app_control clients are connected for this user. Specify target_client_id to disambiguate.",
-          isError: true,
-        };
-      }
-      if (resolved.kind === "match") {
-        resolvedTargetClientId = resolved.clientId;
-      } else if (
-        assistantEventHub.listClientsByCapability("host_app_control").length > 0
-      ) {
-        if (input.tool === "start") {
-          this.rollbackStartIfCurrent(attemptedSession);
-        }
-        return {
-          content:
-            "App control is not available for the current actor. Connect a host_app_control-capable client as the same user.",
-          isError: true,
-        };
-      }
-    }
-
-    if (resolvedTargetClientId != null) {
-      const rejection = enforceSameActorOrErrorResult({
-        hub: assistantEventHub,
-        sourceActorPrincipalId,
-        targetClientId: resolvedTargetClientId,
-        op: "host_app_control",
-      });
-      if (rejection) {
-        if (input.tool === "start") {
-          this.rollbackStartIfCurrent(attemptedSession);
-        }
-        return rejection;
-      }
-    }
-
     try {
       const payload = await this.dispatchRequest(
         toolName,