@vellumai/assistant 0.8.11 → 0.8.12-staging.2

package/src/runtime/routes/schedule-routes.ts

@@ -12,6 +12,10 @@ import { INTERNAL_GUARDIAN_TRUST_CONTEXT } from "../../daemon/trust-context.js";
 import { bootstrapConversation } from "../../memory/conversation-bootstrap.js";
 import { getConversation } from "../../memory/conversation-crud.js";
 import { getUsageCostForConversationWindow } from "../../memory/llm-usage-store.js";
+import {
+  describeRRuleExpression,
+  isSingleFireRRule,
+} from "../../schedule/recurrence-engine.js";
 import { normalizeScheduleSyntax } from "../../schedule/recurrence-types.js";
 import {
   runScript,
@@ -136,7 +140,20 @@ function getCadenceDescription(
   if (job.syntax === "cron") {
     return describeCronExpression(job.cronExpression);
   }
-  return job.expression ?? "";
+  return describeRRuleExpression(job.cronExpression);
+}
+
+/**
+ * Presentation-layer one-shot flag. A COUNT=1 rrule fires exactly once and
+ * should read as one-time in clients, even though the scheduler internally
+ * treats expression-backed jobs as recurring (retry policy, conversation
+ * reuse). Do not feed this back into scheduler logic.
+ */
+function isOneShotForDisplay(
+  job: Pick<ScheduleJob, "syntax" | "cronExpression">,
+): boolean {
+  if (job.cronExpression == null) return true;
+  return job.syntax === "rrule" && isSingleFireRRule(job.cronExpression);
 }
 
 function handleListSchedules(queryParams: Record<string, string>) {
@@ -182,7 +199,7 @@ function handleListSchedules(queryParams: Record<string, string>) {
         routingIntent: j.routingIntent,
         reuseConversation: j.reuseConversation,
         wakeConversationId: j.wakeConversationId,
-        isOneShot: j.cronExpression == null,
+        isOneShot: isOneShotForDisplay(j),
       };
     }),
   };

package/src/runtime/routes/trust-rules-routes.ts

@@ -1,83 +1,30 @@
 /**
- * Trust rule listing route — gateway HTTP proxy.
+ * Trust rule listing route — gateway IPC proxy.
  *
- * The handler makes a single HTTP call to the gateway's trust-rules REST API
- * and surfaces the body's `.error` message on non-OK responses.
+ * The handler calls the gateway over the local IPC socket because trust rule
+ * storage is gateway-owned in Docker mode.
  */
-import { z } from "zod";
+import {
+  TrustRulesListIpcParamsSchema,
+  type TrustRulesListIpcResponse,
+  TrustRulesListIpcResponseSchema,
+} from "@vellumai/gateway-client/gateway-ipc-contracts";
 
-import { getGatewayInternalBaseUrl } from "../../config/env.js";
+import { ipcCallPersistent } from "../../ipc/gateway-client.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-// ── Shared helper ───────────────────────────────────────────────────────
-
-async function gatewayFetch(
-  path: string,
-  init?: RequestInit,
-): Promise<unknown> {
-  const base = getGatewayInternalBaseUrl();
-  const res = await fetch(`${base}${path}`, init);
-  if (!res.ok) {
-    let message = `Gateway request failed (${res.status})`;
-    try {
-      const body = (await res.json()) as { error?: unknown };
-      if (typeof body.error === "string") {
-        message = body.error;
-      }
-    } catch {
-      // ignore JSON parse failures
-    }
-    throw new Error(message);
-  }
-  return res.json();
-}
-
-// ── Schemas ─────────────────────────────────────────────────────────────
-
-const TrustRulesListParams = z
-  .object({
-    tool: z.string().optional(),
-    origin: z.string().optional(),
-    include_all: z.boolean().optional(),
-  })
-  .strict();
-
-const TrustRuleSchema = z.object({
-  id: z.string(),
-  tool: z.string(),
-  pattern: z.string(),
-  risk: z.enum(["low", "medium", "high"]),
-  description: z.string(),
-  origin: z.enum(["default", "user_defined"]),
-  userModified: z.boolean(),
-  deleted: z.boolean(),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-});
-
-const TrustRulesListResponseSchema = z.object({
-  rules: z.array(TrustRuleSchema),
-});
-type TrustRulesListResponse = z.infer<typeof TrustRulesListResponseSchema>;
-
 // ── Handlers ────────────────────────────────────────────────────────────
 
 async function handleList({
   queryParams = {},
   body = {},
-}: RouteHandlerArgs): Promise<TrustRulesListResponse> {
+}: RouteHandlerArgs): Promise<TrustRulesListIpcResponse> {
   // HTTP GET delivers filters via queryParams; CLI IPC puts them in body.
   const source = Object.keys(queryParams).length > 0 ? queryParams : body;
-  const p = TrustRulesListParams.parse(source);
-  const qs = new URLSearchParams();
-  if (p.tool) qs.set("tool", p.tool);
-  if (p.origin) qs.set("origin", p.origin);
-  if (p.include_all) qs.set("include_all", "true");
-  const query = qs.toString();
-  return gatewayFetch(
-    `/v1/trust-rules${query ? `?${query}` : ""}`,
-  ) as Promise<TrustRulesListResponse>;
+  const p = TrustRulesListIpcParamsSchema.parse(source);
+  const result = await ipcCallPersistent("trust_rules_list", p);
+  return TrustRulesListIpcResponseSchema.parse(result);
 }
 
 // ── Route definitions ───────────────────────────────────────────────────
@@ -96,7 +43,7 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "List trust rules, optionally filtered by tool, origin, or include_all.",
     tags: ["trust-rules"],
-    responseBody: TrustRulesListResponseSchema,
+    responseBody: TrustRulesListIpcResponseSchema,
     queryParams: [
       { name: "tool", description: "Filter by tool name" },
       { name: "origin", description: "Filter by origin" },

package/src/schedule/recurrence-engine.ts

@@ -135,6 +135,40 @@ export function isValidScheduleExpression(spec: ScheduleSpec): boolean {
   }
 }
 
+/**
+ * Detect whether an RRULE expression fires exactly once — a single RRULE
+ * with COUNT=1 and no set constructs. Such schedules are semantically
+ * one-shots even though they carry a recurrence expression.
+ */
+export function isSingleFireRRule(expression: string): boolean {
+  try {
+    const normalized = normalizeRruleExpression(expression);
+    if (hasSetConstructs(normalized)) return false;
+    const rule = rrulestr(normalized);
+    return !(rule instanceof RRuleSet) && rule.options.count === 1;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Human-readable description of an RRULE expression for display surfaces.
+ * Single-fire rules read as "One-time"; rules the library cannot express
+ * fall back to "Custom recurrence" rather than leaking raw iCalendar text.
+ */
+export function describeRRuleExpression(expression: string): string {
+  if (isSingleFireRRule(expression)) return "One-time";
+  try {
+    const normalized = normalizeRruleExpression(expression);
+    if (hasSetConstructs(normalized)) return "Custom recurrence";
+    const text = rrulestr(normalized).toText();
+    if (!text) return "Custom recurrence";
+    return text.charAt(0).toUpperCase() + text.slice(1);
+  } catch {
+    return "Custom recurrence";
+  }
+}
+
 /**
  * Compute the next run timestamp (epoch ms) for a schedule expression.
  * Throws if no future runs exist.

package/src/schedule/scheduler.ts

@@ -619,6 +619,7 @@ export async function runScheduleDueWorkOnce(
         jobName: `schedule:${job.id}`,
         source: "schedule",
         prompt: job.message,
+        systemHint: `Schedule: ${job.name}`,
         trustContext: { sourceChannel: "vellum", trustClass: "guardian" },
         callSite: "mainAgent",
         timeoutMs: SCHEDULE_TALK_TIMEOUT_MS,

package/src/security/redact-json.ts

@@ -0,0 +1,61 @@
+/**
+ * JSON-aware secret redaction: walk a parsed JSON value and run
+ * `redactSecrets()` over every string leaf (object keys included).
+ *
+ * The redaction marker (`<redacted type="..." />`) contains double quotes,
+ * so splicing it into an already-serialized JSON document corrupts any
+ * string it lands inside. Callers that need to keep serialized JSON valid
+ * must redact the string leaves of the parsed value and re-stringify,
+ * rather than redacting the serialized text.
+ *
+ * Shared by the export-time staged-file sweep (`redact-staged-export.ts`)
+ * and the tool-audit listener (`tool-audit-listener.ts`). The hot-path pino
+ * log serializer (`util/log-redact.ts`) intentionally does not use this
+ * module.
+ */
+
+import { redactSecrets } from "./secret-scanner.js";
+
+export interface RedactedJsonValue {
+  /** Redacted copy of the input (the input itself is never mutated). */
+  value: unknown;
+  /** True when at least one string leaf was changed by redaction. */
+  changed: boolean;
+}
+
+interface RedactionState {
+  changed: boolean;
+}
+
+/**
+ * Redact secrets in every string leaf (keys included) of a parsed JSON
+ * value. Returns the redacted copy plus a `changed` flag so callers can
+ * keep unchanged content byte-identical (no gratuitous re-serialization).
+ */
+export function redactJsonStringLeaves(value: unknown): RedactedJsonValue {
+  const state: RedactionState = { changed: false };
+  return { value: walk(value, state), changed: state.changed };
+}
+
+function walk(value: unknown, state: RedactionState): unknown {
+  if (typeof value === "string") {
+    return redactString(value, state);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => walk(item, state));
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(
+        ([key, val]) => [redactString(key, state), walk(val, state)] as const,
+      ),
+    );
+  }
+  return value;
+}
+
+function redactString(value: string, state: RedactionState): string {
+  const redacted = redactSecrets(value);
+  if (redacted !== value) state.changed = true;
+  return redacted;
+}

package/src/skills/validate-input.ts

@@ -66,6 +66,42 @@ function quoteList(values: readonly string[]): string {
   return values.map((v) => `"${v}"`).join(", ");
 }
 
+/**
+ * Coerce string-encoded booleans (`"true"`/`"false"`) to real booleans for
+ * properties the schema declares as `type: "boolean"`.
+ *
+ * Some providers' models serialize booleans as JSON strings. Rejecting those
+ * loses the caller's intent: the model's typical recovery is to drop the field
+ * and retry, at which point the field's default silently inverts what it asked
+ * for (e.g. `app_create` with `auto_open: "false"` → retry omits the field →
+ * default `true` opens a half-built app). Accepting the unambiguous string
+ * forms preserves intent.
+ *
+ * Pure: returns a new object when a coercion applies, otherwise returns
+ * `input` unchanged. Never mutates `input` or `schema`.
+ */
+export function coerceStringBooleans(
+  input: Record<string, unknown>,
+  schema: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  if (!schema) return input;
+  const properties = schema.properties;
+  if (!isPlainObject(properties)) return input;
+
+  let coerced: Record<string, unknown> | undefined;
+  for (const [key, rawSubSchema] of Object.entries(properties)) {
+    if (!isPlainObject(rawSubSchema)) continue;
+    if (rawSubSchema.type !== "boolean") continue;
+    const value = input[key];
+    if (typeof value !== "string") continue;
+    const normalized = value.trim().toLowerCase();
+    if (normalized !== "true" && normalized !== "false") continue;
+    coerced ??= { ...input };
+    coerced[key] = normalized === "true";
+  }
+  return coerced ?? input;
+}
+
 /**
  * Validate a tool input object against the (optional) JSON-schema definition
  * declared on the tool entry. Returns `{ ok: true }` if the input is valid (or
@@ -121,7 +157,11 @@ export function validateInputAgainstSchema(
     if (typeof declaredType === "string" && SUPPORTED_TYPES.has(declaredType)) {
       const type = declaredType as SupportedType;
       if (!matchesType(value, type)) {
-        errors.push(`${key} must be ${typeArticle(type)} ${type}`);
+        errors.push(
+          type === "boolean" && typeof value === "string"
+            ? `${key} must be a boolean — pass true or false as a JSON boolean, not a string`
+            : `${key} must be ${typeArticle(type)} ${type}`,
+        );
         // No point checking enum/items if the base type is wrong.
         continue;
       }

package/src/subagent/types.ts

@@ -105,7 +105,12 @@ export const SUBAGENT_LIMITS = {
 
 // ── Roles ───────────────────────────────────────────────────────────────
 
-export type SubagentRole = "general" | "researcher" | "coder" | "planner";
+export type SubagentRole =
+  | "general"
+  | "researcher"
+  | "coder"
+  | "planner"
+  | "investigator";
 
 export interface SubagentRoleConfig {
   /**
@@ -167,4 +172,24 @@ export const SUBAGENT_ROLE_REGISTRY: Record<SubagentRole, SubagentRoleConfig> =
       systemPromptPreamble:
         "You are an analysis-focused subagent with read-only access. Read files, search the web, and synthesize findings. You cannot write files or run shell commands.",
     },
+    investigator: {
+      allowedTools: [
+        "bash",
+        "file_read",
+        "file_list",
+        "web_search",
+        "web_fetch",
+        "recall",
+        "notify_parent",
+      ],
+      skillIds: [],
+      systemPromptPreamble: [
+        "You are an investigation-focused subagent for root-cause analysis: debugging, log forensics, and tracing behavior across code.",
+        "Your shell access is for read-only investigation (grep, find, reading files and logs) — do not modify files or system state.",
+        "Working method: read whole files instead of many small line-range slices; prefer broad searches (e.g. grep -rn across a directory) over one-symbol-at-a-time queries.",
+        "Send notify_parent (urgency 'important') as soon as each finding is confirmed, so progress survives interruption.",
+        "Your final message must be a compact root-cause report with these sections: Symptom, Root cause, Evidence (file:line references), Suggested fix, Open questions.",
+        "If you approach context limits, stop investigating and produce the report from what you have — a partial report delivered is worth more than a complete investigation lost.",
+      ].join(" "),
+    },
   };

package/src/telemetry/types.ts

@@ -55,7 +55,12 @@ export interface ModelTelemetryEventBase extends TelemetryEventBase {
   inference_profile_source: UsageAttributionProfileSource | null;
 }
 
-/** LLM usage event — one per provider API call. */
+/**
+ * LLM usage event — one per persisted usage row. The main agent loop
+ * persists a single row per turn with token totals summed across every
+ * provider API call in the loop (`llm_call_count` carries the call count);
+ * auxiliary call sites persist one row per call.
+ */
 export interface LlmUsageTelemetryEvent extends TelemetryEventBase {
   type: "llm_usage";
   /**
@@ -85,6 +90,15 @@ export interface LlmUsageTelemetryEvent extends TelemetryEventBase {
   output_tokens: number;
   cache_creation_input_tokens: number | null;
   cache_read_input_tokens: number | null;
+  /**
+   * Number of provider API calls aggregated into this event. The main
+   * agent loop persists one usage row per turn with token totals summed
+   * across every call in the loop, so this is how downstream consumers
+   * recover per-call averages (effective tokens ÷ calls). Auxiliary call
+   * sites record exactly 1. Null for rows persisted before daemon
+   * migration `200-usage-llm-call-count`; consumers treat null as 1.
+   */
+  llm_call_count: number | null;
   /**
    * The provider's untouched `usage` block. Anthropic surfaces a TTL
    * breakdown under `cache_creation.ephemeral_{5m,1h}_input_tokens`;

package/src/telemetry/usage-telemetry-reporter.test.ts

@@ -183,7 +183,7 @@ initializeDb();
 
 let eventIdCounter = 0;
 
-// The reporter consumes `UnreportedUsageEvent` (UsageEvent + the two
+// The reporter consumes `UnreportedUsageEvent` (UsageEvent + the
 // JOIN-computed fields `conversationType` and `turnIndex`). Build that
 // shape directly so the mock matches `queryUnreportedUsageEvents`'
 // return type exactly.
@@ -218,6 +218,7 @@ function makeUsageEvent(
     assistantVersion: "test-app-version",
     conversationType: "standard",
     turnIndex: 1,
+    llmCallCount: 1,
     ...overrides,
   };
 }
@@ -507,6 +508,7 @@ describe("UsageTelemetryReporter", () => {
       callSite: "compactionAgent",
       inferenceProfile: "quality-optimized",
       inferenceProfileSource: "conversation",
+      llmCallCount: 3,
       createdAt: 1700000099000,
     });
     mockQueryUnreportedUsageEvents.mockReturnValue([event]);
@@ -538,6 +540,7 @@ describe("UsageTelemetryReporter", () => {
     expect(e.output_tokens).toBe(100);
     expect(e.cache_creation_input_tokens).toBe(20);
     expect(e.cache_read_input_tokens).toBe(15);
+    expect(e.llm_call_count).toBe(3);
     expect(e.actor).toBe("context_compactor");
     expect(e.llm_call_site).toBe("compactionAgent");
     expect(e.inference_profile).toBe("quality-optimized");
@@ -599,6 +602,7 @@ describe("UsageTelemetryReporter", () => {
       callSite: null,
       inferenceProfile: null,
       inferenceProfileSource: null,
+      llmCallCount: null,
     });
     mockQueryUnreportedUsageEvents.mockReturnValue([event]);
     mockFetch.mockImplementation(() =>
@@ -617,6 +621,7 @@ describe("UsageTelemetryReporter", () => {
       llm_call_site: null,
       inference_profile: null,
       inference_profile_source: null,
+      llm_call_count: null,
     });
   });
 

package/src/telemetry/usage-telemetry-reporter.ts

@@ -379,6 +379,7 @@ export class UsageTelemetryReporter {
             output_tokens: e.outputTokens,
             cache_creation_input_tokens: e.cacheCreationInputTokens ?? null,
             cache_read_input_tokens: e.cacheReadInputTokens ?? null,
+            llm_call_count: e.llmCallCount,
             raw_usage: e.rawUsage,
             actor: e.actor,
             llm_call_site: e.callSite,

package/src/tools/apps/executors.ts

@@ -548,7 +548,7 @@ export async function executeAppGenerateIcon(
   return {
     content: JSON.stringify({
       error:
-        "Icon generation failed. Make sure a Gemini API key is configured in Settings.",
+        "Icon generation failed. Make sure a Gemini API key is configured in Settings → Models & Services.",
     }),
     isError: true,
   };

package/src/tools/skills/skill-tool-factory.ts

@@ -1,6 +1,9 @@
 import type { SkillToolEntry } from "../../config/skills.js";
 import { RiskLevel } from "../../permissions/types.js";
-import { validateInputAgainstSchema } from "../../skills/validate-input.js";
+import {
+  coerceStringBooleans,
+  validateInputAgainstSchema,
+} from "../../skills/validate-input.js";
 import type {
   ExecutionTarget,
   Tool,
@@ -42,10 +45,12 @@ export function createSkillTool(
       input: Record<string, unknown>,
       context: ToolContext,
     ): Promise<ToolExecutionResult> {
+      const schema = entry.input_schema as Record<string, unknown> | undefined;
+      const coercedInput = coerceStringBooleans(input, schema);
       const validation = validateInputAgainstSchema(
         entry.name,
-        input,
-        entry.input_schema as Record<string, unknown> | undefined,
+        coercedInput,
+        schema,
       );
       if (!validation.ok) {
         return {
@@ -54,11 +59,17 @@ export function createSkillTool(
         };
       }
 
-      return runSkillToolScript(skillDir, entry.executor, input, context, {
-        target: entry.execution_target,
-        expectedSkillVersionHash: versionHash,
-        bundled,
-      });
+      return runSkillToolScript(
+        skillDir,
+        entry.executor,
+        coercedInput,
+        context,
+        {
+          target: entry.execution_target,
+          expectedSkillVersionHash: versionHash,
+          bundled,
+        },
+      );
     },
   };
 }

package/src/tools/tool-approval-handler.ts

@@ -5,6 +5,10 @@ import {
   getCanonicalGuardianRequest,
   updateCanonicalGuardianRequest,
 } from "../memory/canonical-guardian-store.js";
+import {
+  isUnparseableToolArgs,
+  unparseableToolArgsMessage,
+} from "../providers/unparseable-tool-args.js";
 import { isUntrustedTrustClass } from "../runtime/actor-trust-resolver.js";
 import { createOrReuseToolGrantRequest } from "../runtime/tool-grant-request-helper.js";
 import { redactSecrets } from "../security/secret-scanner.js";
@@ -241,6 +245,33 @@ export class ToolApprovalHandler {
       };
     }
 
+    // Reject tool calls whose arguments failed JSON parsing in the provider
+    // layer (wrapped under the `_raw` marker). Executing with the marker
+    // object would feed garbage input to the tool — and worse, a tool that
+    // tolerates missing fields can "succeed" (e.g. ui_show creating a
+    // typeless surface), so the model never learns its arguments were
+    // mangled. Fail loudly instead so the model retries.
+    if (isUnparseableToolArgs(input)) {
+      const msg = unparseableToolArgsMessage(name, input._raw);
+      const durationMs = Date.now() - startTime;
+      emitLifecycleEvent({
+        type: "error",
+        toolName: name,
+        executionTarget,
+        input,
+        workingDir: context.workingDir,
+        conversationId: context.conversationId,
+        requestId: context.requestId,
+        riskLevel,
+        decision: "error",
+        durationMs,
+        errorMessage: msg,
+        isExpected: true,
+        errorCategory: "tool_failure",
+      });
+      return { allowed: false, result: { content: msg, isError: true } };
+    }
+
     // Reject tool invocations targeting guardian control-plane endpoints from non-guardian actors.
     const guardianCheck = enforceVerificationControlPlanePolicy(
       name,

package/src/usage/types.ts

@@ -62,7 +62,7 @@ export interface UsageEventInput {
   inferenceProfile?: string | null;
   inferenceProfileSource?: UsageAttributionProfileSource | null;
   /** Number of actual LLM API calls represented by this event (defaults to 1). */
-  llmCallCount?: number;
+  llmCallCount?: number | null;
 }
 
 /**
@@ -85,6 +85,13 @@ export interface UsageEvent extends UsageEventInput {
   inferenceProfileSource: UsageAttributionProfileSource | null;
   estimatedCostUsd: number | null;
   pricingStatus: "priced" | "unpriced";
+  /**
+   * Number of provider API calls aggregated into this event. The main agent
+   * loop persists one row per turn with this set to the number of calls in
+   * the loop; auxiliary call sites persist 1. `null` only for rows persisted
+   * before migration `200-usage-llm-call-count` ran.
+   */
+  llmCallCount: number | null;
   /**
    * Version of the assistant binary at the moment this event was
    * RECORDED, captured by `recordUsageEvent` and persisted with the

package/src/util/platform.ts

@@ -79,6 +79,22 @@ export function getDataDir(): string {
   return join(getWorkspaceDir(), "data");
 }
 
+/**
+ * Returns the path to the config-quarantine notice sentinel
+ * (`<workspace>/data/config-quarantine-notice.json`).
+ *
+ * Written by the config loader when a corrupt `config.json` is quarantined and
+ * read by the per-turn `config-quarantine-notice` injector. Lives under the
+ * internal data dir (runtime state, config-free to resolve) rather than the
+ * user-facing workspace root because it is daemon-written bookkeeping, not a
+ * file the user edits. The path resolves without loading config, so it is safe
+ * to call during early-boot config load before the DB or `getConfig().dataDir`
+ * exist.
+ */
+export function getConfigQuarantineNoticePath(): string {
+  return join(getDataDir(), "config-quarantine-notice.json");
+}
+
 /**
  * Returns the embedding models directory (~/.vellum/workspace/embedding-models).
  * Downloaded embedding runtime (onnxruntime-node, transformers bundle, model weights)

package/src/watcher/engine.ts

@@ -251,6 +251,7 @@ export async function runWatchersOnce(
       // The seed lives in the sandwich messages; processMessage runs
       // with an empty prompt so we don't double-inject the action prompt.
       prompt: "",
+      systemHint: `Watcher: ${watcher.name}`,
       trustContext: { sourceChannel: "vellum", trustClass: "guardian" },
       callSite: "mainAgent",
       timeoutMs: WATCHER_JOB_TIMEOUT_MS,