@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/daemon/host-browser-proxy.ts

@@ -24,6 +24,46 @@ export type HostBrowserInput = DistributiveOmit<
 
 const log = getLogger("host-browser-proxy");
 
+/**
+ * Extension-only pseudo-CDP methods (Vellum.listTabs, Vellum.selectTab,
+ * Vellum.closeTab, Vellum.createTab, Vellum.findTab, Vellum.attach,
+ * Vellum.detach) are implemented solely by the Chrome extension's
+ * dispatcher via the chrome.tabs / chrome.debugger APIs. The macOS CDP
+ * bridge speaks raw CDP against localhost:9222 only and fails on every
+ * `Vellum.*` method, so routing them anywhere but the extension is a
+ * guaranteed failure. Prefix check rather than an allowlist so newly
+ * added pseudo-methods stay covered.
+ */
+function isExtensionOnlyMethod(cdpMethod: string): boolean {
+  return cdpMethod.startsWith("Vellum.");
+}
+
+/**
+ * Structured isError result for pseudo-methods that cannot be served
+ * because no Chrome Extension client is connected (or the explicit
+ * target is a different transport). The `extension_required` code is
+ * deliberately NOT in ExtensionCdpClient's TRANSPORT_ERROR_CODES: it
+ * classifies as `cdp_error` so the factory does not fail over to a
+ * backend that cannot serve `Vellum.*` either, and the message is
+ * surfaced verbatim to the caller.
+ */
+function extensionRequiredResult(
+  cdpMethod: string,
+  targetInterfaceId?: string,
+): ToolExecutionResult {
+  return {
+    content: JSON.stringify({
+      code: "extension_required",
+      message:
+        `${cdpMethod} requires the Chrome extension; ` +
+        (targetInterfaceId
+          ? `the targeted client (interface "${targetInterfaceId}") cannot handle it.`
+          : "no Chrome extension client is connected."),
+    }),
+    isError: true,
+  };
+}
+
 /**
  * Pick the host_browser-capable client to dispatch to.
  *
@@ -32,24 +72,43 @@ const log = getLogger("host-browser-proxy");
  * in `request()` still runs on the returned client when
  * `sourceActorPrincipalId` is present.
  *
- * When `sourceActorPrincipalId` is supplied (and no explicit target),
- * candidate clients are filtered down to those owned by the same actor.
- * Returns `undefined` when no same-actor client is connected; the
- * caller surfaces this as the existing "no active extension connection"
- * rejection.
+ * Candidate ordering is method-aware and deterministic. Both the Chrome
+ * extension and the macOS desktop bridge register the `host_browser`
+ * capability, and both receive periodic heartbeats that update
+ * `lastActiveAt` — so pure recency ordering is a race between transports
+ * with very different capabilities:
  *
- * When neither is supplied (legacy callers without a resolved actor
- * identity), falls through to the most-recently-active host_browser
- * client so the registry singleton continues to work for single-client
- * setups.
+ *  - `Vellum.*` pseudo-methods: candidates are restricted to
+ *    chrome-extension clients (the only transport that implements them).
+ *  - Raw CDP methods: chrome-extension clients are preferred over other
+ *    host_browser clients (the macOS bridge), with `lastActiveAt`
+ *    descending within each group — the natural order returned by
+ *    `listClientsByCapability`. Callers that want the bridge despite a
+ *    connected extension must pass `targetClientId` explicitly via the
+ *    LLM-facing param added in #30066.
  *
- * Within each branch, ties are broken by `lastActiveAt` descending —
- * the natural order returned by `listClientsByCapability`. Callers that
- * need a specific transport (e.g. Chrome Extension's `chrome.debugger`
- * over the macOS CDP bridge) must pass `targetClientId` explicitly via
- * the LLM-facing param added in #30066.
+ * When `sourceActorPrincipalId` is supplied (and no explicit target),
+ * candidate clients are filtered down to those owned by the same actor.
+ * Returns `undefined` when no eligible client is connected.
+ */
+/**
+ * Whether any of `clients` is dispatchable for the caller. Without an
+ * actor, any client counts (legacy single-user behavior); with one,
+ * only same-actor clients count — the strict match used by
+ * `resolveTargetClient`.
  */
+function hasClientForActor(
+  clients: ReadonlyArray<{ actorPrincipalId?: string }>,
+  sourceActorPrincipalId?: string,
+): boolean {
+  if (sourceActorPrincipalId == null) return clients.length > 0;
+  return clients.some(
+    (c) => c.actorPrincipalId === sourceActorPrincipalId,
+  );
+}
+
 function resolveTargetClient(
+  cdpMethod: string,
   sourceActorPrincipalId: string | undefined,
   targetClientId?: string,
 ) {
@@ -58,8 +117,12 @@ function resolveTargetClient(
     return clients.find((c) => c.clientId === targetClientId);
   }
 
-  const candidates =
-    assistantEventHub.listClientsByCapability("host_browser");
+  const all = assistantEventHub.listClientsByCapability("host_browser");
+  const extension = all.filter((c) => c.interfaceId === "chrome-extension");
+  const candidates = isExtensionOnlyMethod(cdpMethod)
+    ? extension
+    : [...extension, ...all.filter((c) => c.interfaceId !== "chrome-extension")];
+
   if (sourceActorPrincipalId == null) {
     return candidates[0];
   }
@@ -102,10 +165,16 @@ export class HostBrowserProxy {
    * Returns `true` when either the Chrome Extension or the macOS SSE
    * bridge is available — i.e. any transport can forward host-browser
    * requests.
+   *
+   * When `sourceActorPrincipalId` is supplied, only clients owned by
+   * that actor count — mirroring `resolveTargetClient`'s strict actor
+   * matching so availability checks never report a client the proxy
+   * would refuse to dispatch to.
    */
-  isAvailable(): boolean {
-    return (
-      assistantEventHub.getMostRecentClientByCapability("host_browser") != null
+  isAvailable(sourceActorPrincipalId?: string): boolean {
+    return hasClientForActor(
+      assistantEventHub.listClientsByCapability("host_browser"),
+      sourceActorPrincipalId,
     );
   }
 
@@ -114,9 +183,17 @@ export class HostBrowserProxy {
    * Returns `false` when only the macOS SSE bridge is available.
    * Unlike {@link isAvailable}, this does not consider the macOS bridge
    * a valid extension transport.
+   *
+   * When `sourceActorPrincipalId` is supplied, only extension clients
+   * owned by that actor count. On a multi-actor cloud daemon, another
+   * actor's connected extension must not make this actor's
+   * conversations select extension-labelled transports.
    */
-  hasExtensionClient(): boolean {
-    return assistantEventHub.listClientsByInterface("chrome-extension").length > 0;
+  hasExtensionClient(sourceActorPrincipalId?: string): boolean {
+    return hasClientForActor(
+      assistantEventHub.listClientsByInterface("chrome-extension"),
+      sourceActorPrincipalId,
+    );
   }
 
   /**
@@ -155,7 +232,11 @@ export class HostBrowserProxy {
     // alongside the pending interaction registration. Same shape as
     // host-cu-proxy: the result-route same-actor check compares the
     // submitting client's actor against this captured value.
-    const preferredClient = resolveTargetClient(sourceActorPrincipalId, targetClientId);
+    const preferredClient = resolveTargetClient(
+      input.cdpMethod,
+      sourceActorPrincipalId,
+      targetClientId,
+    );
 
     // Same-user enforcement: when the caller's actor is known, refuse to
     // dispatch to a client owned by a different actor. This covers the
@@ -175,6 +256,20 @@ export class HostBrowserProxy {
       if (rejection) return Promise.resolve(rejection);
     }
 
+    // Pseudo-methods can only be served by the Chrome extension. Fail fast
+    // (after the same-actor gate, which stays authoritative) instead of
+    // dispatching to a transport that is guaranteed to fail — the factory's
+    // pinned-extension gate is the first line of defense; this covers
+    // heartbeat races and bridge-routed auto-mode sends.
+    if (
+      isExtensionOnlyMethod(input.cdpMethod) &&
+      preferredClient?.interfaceId !== "chrome-extension"
+    ) {
+      return Promise.resolve(
+        extensionRequiredResult(input.cdpMethod, preferredClient?.interfaceId),
+      );
+    }
+
     const resolvedClientId = preferredClient?.clientId;
     const targetActorPrincipalId = preferredClient?.actorPrincipalId;
     const requestId = uuid();

package/src/daemon/lifecycle.ts

@@ -31,6 +31,7 @@ import {
 import {
   awaitCesClientWithTimeout,
   DEFAULT_CES_STARTUP_TIMEOUT_MS,
+  injectCesClientWhenReady,
 } from "../credential-execution/startup-timeout.js";
 import { FilingService } from "../filing/filing-service.js";
 import { HeartbeatService } from "../heartbeat/heartbeat-service.js";
@@ -75,6 +76,7 @@ import { publishConversationListChanged } from "../runtime/sync/resource-sync-ev
 import { recoverStaleSchedules } from "../schedule/schedule-recovery.js";
 import { startScheduler } from "../schedule/scheduler.js";
 import {
+  getCesClient,
   onCesClientChanged,
   setCesClient,
   setCesReconnect,
@@ -633,21 +635,38 @@ export async function runDaemon(): Promise<void> {
     }
 
     // Privacy gating: Sentry crash/error reporting is gated by sendDiagnostics,
-    // while the usage telemetry reporter is gated by collectUsageData. Both are
-    // disabled in dev mode. Early-startup crashes before this point are still captured.
+    // while the usage telemetry reporter re-checks collectUsageData on every
+    // flush. Both are disabled in dev mode. Early-startup crashes before this
+    // point are still captured.
     const isDevMode = process.env.VELLUM_DEV === "1";
     const sendDiagnostics = !isDevMode && config.sendDiagnostics;
-    const collectUsageData = !isDevMode && config.collectUsageData;
     if (!sendDiagnostics) {
       await closeSentry();
     }
 
+    // Construct and start the reporter even when usage collection is disabled:
+    // flush() re-checks collectUsageData each cycle and, when opted out, sends
+    // nothing but advances all watermarks (including the final flush in
+    // stop()). New opted-out tool_invocations rows are already unreportable by
+    // construction — the audit listener persists NULL telemetry columns for
+    // them, which the tool_executed projection filters out — so the opted-out
+    // flushes are defense in depth there (covering rows recorded under builds
+    // that predate that write-time gate) and remain the primary guard for the
+    // always-on tables without a write-time gate (llm_usage, turn events).
+    // Deliberately NOT gated on dbReady: getDb()
+    // can still work when initializeDb() failed mid-migration, in which case
+    // the audit listener keeps writing rows that the opt-out branch must keep
+    // covered. The reporter is degraded-mode safe — its constructor and
+    // flush() treat DB errors as non-fatal.
     let telemetryReporter: UsageTelemetryReporter | null = null;
-    if (collectUsageData) {
+    if (!isDevMode) {
       telemetryReporter = new UsageTelemetryReporter();
       setUsageTelemetryReporter(telemetryReporter);
       telemetryReporter.start();
-      log.info("Usage telemetry reporter started");
+      log.info(
+        { collectUsageData: config.collectUsageData },
+        "Usage telemetry reporter started",
+      );
     }
 
     // CES lifecycle — kick off early so CES handshake runs concurrently with
@@ -673,6 +692,16 @@ export async function runDaemon(): Promise<void> {
       });
       if (client) {
         setCesClient(client);
+      } else {
+        // The handshake lost the startup race, so provider init proceeds on
+        // the direct credential store. Still inject the CES client into the
+        // resolver once the handshake completes, so CES tools and the
+        // approval bridge route through CES rather than reporting it
+        // unavailable for the rest of the process.
+        injectCesClientWhenReady(cesResult.clientPromise, {
+          getCesClient,
+          setCesClient,
+        });
       }
     }
 

package/src/daemon/message-protocol.ts

@@ -16,7 +16,6 @@
 export * from "./message-types/acp.js";
 export * from "./message-types/apps.js";
 export * from "./message-types/bookmarks.js";
-export * from "./message-types/browser.js";
 export * from "./message-types/computer-use.js";
 export * from "./message-types/contacts.js";
 export * from "./message-types/conversations.js";
@@ -57,10 +56,6 @@ import type {
   _AppsServerMessages,
 } from "./message-types/apps.js";
 import type { _BookmarksServerMessages } from "./message-types/bookmarks.js";
-import type {
-  _BrowserClientMessages,
-  _BrowserServerMessages,
-} from "./message-types/browser.js";
 import type {
   _ComputerUseClientMessages,
   _ComputerUseServerMessages,
@@ -167,7 +162,6 @@ export type ClientMessage =
   | _ComputerUseClientMessages
   | _ContactsClientMessages
   | _WorkItemsClientMessages
-  | _BrowserClientMessages
   | _HostBrowserClientMessages
   | _SubagentsClientMessages
   | _DocumentsClientMessages
@@ -191,7 +185,6 @@ export type ServerMessage =
   | _ComputerUseServerMessages
   | _ContactsServerMessages
   | _WorkItemsServerMessages
-  | _BrowserServerMessages
   | _SubagentsServerMessages
   | _DocumentsServerMessages
   | _DocumentCommentsServerMessages

package/src/daemon/message-types/schedules.ts

@@ -80,6 +80,7 @@ export interface SchedulesListResponse {
     lastRunAt: number | null;
     lastStatus: string | null;
     description: string;
+    cadenceDescription: string;
     mode: string;
     status: string;
     routingIntent: string;

package/src/daemon/message-types/skills.ts

@@ -1,6 +1,7 @@
 // Skill management types.
 
 import type { PartnerAudit } from "../../skills/skillssh-audit-types.js";
+import type { OwnerInfo } from "../../tools/types.js";
 
 // Re-export so consumers can access the audit types from this module.
 export type { PartnerAudit } from "../../skills/skillssh-audit-types.js";
@@ -91,6 +92,13 @@ interface SlimSkillBase {
   kind: "bundled" | "installed" | "catalog";
   status: "enabled" | "disabled" | "available";
   category: string;
+  /**
+   * Extension that ships this skill, reusing the tool registry's
+   * {@link OwnerInfo} model. Set for plugin-resident skills as
+   * `{ kind: "plugin", id: <plugin dir name> }` so clients can attribute
+   * them to the owning plugin instead of collapsing to their `kind`/`origin`.
+   */
+  owner?: OwnerInfo;
 }
 
 interface VellumSlimSkill extends SlimSkillBase {
@@ -167,6 +175,13 @@ interface SkillDetailBase {
 
 interface VellumSkillDetail extends SkillDetailBase {
   origin: "vellum";
+  /**
+   * Extension that ships this skill, reusing the tool registry's
+   * {@link OwnerInfo} model. Set for plugin-resident skills as
+   * `{ kind: "plugin", id: <plugin dir name> }` — plugin skills are mapped to
+   * the `vellum` origin, so this is where their attribution is preserved.
+   */
+  owner?: OwnerInfo;
 }
 
 interface ClawhubSkillDetail extends SkillDetailBase {
@@ -201,6 +216,8 @@ interface SkillsshSkillDetail extends SkillDetailBase {
 
 interface CustomSkillDetail extends SkillDetailBase {
   origin: "custom";
+  /** See {@link VellumSkillDetail.owner}. */
+  owner?: OwnerInfo;
 }
 
 export type SkillDetailResponse =

package/src/daemon/providers-setup.ts

@@ -119,6 +119,9 @@ export async function initializeProvidersAndTools(
   }
 
   await initializeProviders(config);
+  // initializeTools() also loads workspace tool overrides from
+  // `<workspaceDir>/tools/` once core tools have settled, so they own
+  // their names before the MCP / plugin registrations below run.
   await initializeTools();
 
   // Start MCP servers and register their tools

package/src/daemon/server.ts

@@ -43,7 +43,6 @@ import {
 import {
   getOrCreateConversation as getOrCreateActiveConversation,
   initConversationLifecycle,
-  setCesClientPromise,
 } from "./conversation-store.js";
 import { refreshSurfacesForApp } from "./conversation-surfaces.js";
 import { parseIdentityFields } from "./handlers/identity.js";
@@ -51,6 +50,7 @@ import type { ConversationCreateOptions } from "./handlers/shared.js";
 import { setGlobalSkillIpcSender } from "./meet-host-supervisor.js";
 import { PluginSourceWatcher } from "./plugin-source-watcher.js";
 import { refreshSkillCapabilityMemories } from "./skill-memory-refresh.js";
+import { WorkspaceToolsWatcher } from "./workspace-tools-watcher.js";
 
 const log = getLogger("server");
 
@@ -126,7 +126,6 @@ export class DaemonServer {
         }
         return client;
       });
-      setCesClientPromise(this.cesClientPromise);
     }
   }
 
@@ -322,6 +321,7 @@ export class DaemonServer {
     this.appSourceWatcher.start((appId) => this.handleAppSourceChange(appId));
 
     this.pluginSourceWatcher.start();
+    WorkspaceToolsWatcher.getInstance().start();
 
     // Broadcast contacts_changed to all clients when any contact mutation occurs.
     this.unsubscribeContactChange = onContactChange(() => {
@@ -338,6 +338,7 @@ export class DaemonServer {
     this.configWatcher.stop();
     this.appSourceWatcher.stop();
     this.pluginSourceWatcher.stop();
+    WorkspaceToolsWatcher.getInstance().stop();
     this.cliIpc.stop();
     this.skillIpc.stop();
     if (this.unsubscribeContactChange) {
@@ -373,7 +374,6 @@ export class DaemonServer {
     if (this.cesClientPromise) {
       await this.cesClientPromise.catch(() => undefined);
       this.cesClientPromise = undefined;
-      setCesClientPromise(undefined);
     }
     if (this.cesProcessManager) {
       this.cesProcessManager = undefined;

package/src/daemon/tool-setup-types.ts

@@ -4,7 +4,7 @@
  */
 
 import type { InterfaceId } from "../channels/types.js";
-import type { CesClient } from "../credential-execution/client.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { SurfaceConversationContext } from "./conversation-surfaces.js";
 import type { TrustContext } from "./trust-context.js";
 
@@ -33,8 +33,6 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   trustContext?: TrustContext;
   /** Voice/call session ID, if the conversation originates from a call. Propagated into ToolContext for scoped grant consumption. */
   callSessionId?: string;
-  /** CES RPC client for credential execution operations. Injected when CES tools are enabled and the CES process is available. */
-  cesClient?: CesClient;
   /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
   readonly transportInterface?: InterfaceId;
 
@@ -49,6 +47,14 @@ export interface ToolSetupContext extends SurfaceConversationContext {
    * trust rules auto-executing side-effect tools in non-interactive contexts.
    */
   forcePromptSideEffects?: boolean;
+  /**
+   * The LLM call site driving the current turn, set by `runAgentLoopImpl`
+   * (`options.callSite ?? "mainAgent"`). Non-main turns (voice `callAgent`,
+   * `filingAgent`, …) resolve different provider/model/profile config, so
+   * tool telemetry attribution must use this rather than assuming
+   * `mainAgent`. Absent before the first turn starts.
+   */
+  currentCallSite?: LLMCallSite;
   /**
    * Per-turn snapshot of the resolved inference-profile override, set by
    * `runAgentLoopImpl`. Propagated into `ToolContext.overrideProfile` so

package/src/daemon/trust-context.ts

@@ -6,6 +6,7 @@
  */
 import type { ChannelId } from "../channels/types.js";
 import { isHttpAuthDisabled } from "../config/env.js";
+import { shouldExposePersonalMemory } from "../memory/v2/static-context.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 
 export interface TrustContext {
@@ -81,3 +82,25 @@ export function resolveTrustClass(
   if (isHttpAuthDisabled()) return "guardian";
   return trustContext?.trustClass ?? "unknown";
 }
+
+/**
+ * Whether personal-memory content may be surfaced for the actor described by
+ * `trustContext`: the gate admits guardian-class actors and internal/local
+ * flows (including turns with no trust context), and blocks remote untrusted
+ * actors — see {@link shouldExposePersonalMemory} for the rationale.
+ *
+ * This is THE personal-memory trust gate. Every surface that exposes private
+ * user content — the v2 dynamic/static `<memory>` layers, PKB context, NOW.md,
+ * memory-v3 cards/spotlight, and the `loadFromDb` rehydration of persisted
+ * memory blocks — must call this one helper so the exposure rule cannot drift
+ * between copies. It folds in {@link resolveTrustClass} so the dev-bypass
+ * (HTTP auth disabled → guardian) applies uniformly at every call site.
+ */
+export function isPersonalMemoryAllowed(
+  trustContext: TrustContext | undefined,
+): boolean {
+  return shouldExposePersonalMemory({
+    sourceChannel: trustContext?.sourceChannel,
+    isTrustedActor: resolveTrustClass(trustContext) === "guardian",
+  });
+}