@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/context/post-turn-tool-result-truncation.ts

@@ -32,6 +32,21 @@ export const TRUNCATION_MARKER = "\u2014 full result:";
  */
 export const TRUNCATION_EXEMPT_TOOLS = new Set<string>(["skill_load"]);
 
+/**
+ * File-read tools that page spooled `.tool-results/` content back into context.
+ * `file_read` reads inside the workspace; `host_file_read` reads anywhere on the
+ * host. Both are (a) exempt from the result-time spool pass — re-stubbing a read
+ * of a spooled file would hand back another stub, so the content could never be
+ * paged back at all — and (b) recognized by {@link derefToolResultReReads}, so a
+ * re-read of a spooled file collapses to a stub instead of duplicating content
+ * already in context. Sharing one set keeps the two passes from drifting if a
+ * new file-read tool is added.
+ */
+export const FILE_READ_TOOL_NAMES = new Set<string>([
+  "file_read",
+  "host_file_read",
+]);
+
 /**
  * Build a map of tool_use_id -> originating tool name by walking the tool_use
  * blocks in assistant messages. A tool_result only carries `tool_use_id`, so
@@ -170,16 +185,18 @@ export const REREAD_STUB =
  * Deduplicate re-reads of saved tool results.
  *
  * When `postTurnTruncateToolResults` truncates a large result, it saves the full
- * content to a `.tool-results/` file. If the model later calls `file_read` on that
- * saved file, the result is a second copy of content whose truncated prefix/suffix
- * is already in context. This function detects those re-reads and replaces their
- * tool_result content with a short stub to avoid duplication.
+ * content to a `.tool-results/` file. If the model later calls `file_read` or
+ * `host_file_read` on that saved file, the result is a second copy of content
+ * whose truncated prefix/suffix is already in context. This function detects
+ * those re-reads and replaces their tool_result content with a short stub to
+ * avoid duplication.
  */
 export function derefToolResultReReads(messages: Message[]): {
   messages: Message[];
   dereferencedCount: number;
 } {
-  // Build a set of tool_use_ids that are file_read calls targeting .tool-results/ paths.
+  // Build a set of tool_use_ids that are file-read calls (file_read or
+  // host_file_read) targeting .tool-results/ paths.
   const reReadToolUseIds = new Set<string>();
 
   for (const msg of messages) {
@@ -187,7 +204,7 @@ export function derefToolResultReReads(messages: Message[]): {
     for (const block of msg.content) {
       if (block.type !== "tool_use") continue;
       const tu = block as ToolUseContent;
-      if (tu.name !== "file_read") continue;
+      if (!FILE_READ_TOOL_NAMES.has(tu.name)) continue;
       const filePath = tu.input.path ?? tu.input.file_path;
       if (typeof filePath !== "string") continue;
       if (filePath.includes(`/${TOOL_RESULT_DIR}/`)) {

package/src/context/tool-result-spool.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import type { ContentBlock, ToolResultContent } from "../providers/types.js";
 import {
   buildTruncatedContent,
+  FILE_READ_TOOL_NAMES,
   getToolResultFilePath,
   isTruncationEligible,
   TOOL_RESULT_DIR,
@@ -18,27 +19,21 @@ import {
 const AX_TREE_TAG = "<ax-tree>";
 
 /**
- * Tools whose results keep their full content at result time even when
- * oversized. `file_read` is the model's only way to page spooled content back
- * into context: stubbing a read of a `.tool-results/` file would spool a
- * fresh copy and hand back another stub, so oversized content could never be
- * read at all. Explicit reads are therefore honored in full; the post-turn
- * pass still truncates them at turn end, after the model has consumed the
- * content.
- */
-const RESULT_TIME_STUB_EXEMPT_TOOLS = new Set<string>(["file_read"]);
-
-/**
- * Whether a tool result is eligible for the result-time spool/stub pass:
- * the post-turn pass's shared rules plus the AX-tree and `file_read`
- * exemptions above.
+ * Whether a tool result is eligible for the result-time spool/stub pass: the
+ * post-turn pass's shared rules plus the AX-tree exemption, minus the file-read
+ * tools ({@link FILE_READ_TOOL_NAMES}). The file-read tools are the model's only
+ * way to page spooled content back into context: stubbing a read of a
+ * `.tool-results/` file would spool a fresh copy and hand back another stub, so
+ * oversized content could never be read at all. Explicit reads are therefore
+ * honored in full; the post-turn pass still truncates them at turn end, after
+ * the model has consumed the content.
  */
 function isSpoolEligible(
   tr: ToolResultContent,
   toolName: string | undefined,
 ): boolean {
   if (!isTruncationEligible(tr, toolName)) return false;
-  if (toolName !== undefined && RESULT_TIME_STUB_EXEMPT_TOOLS.has(toolName)) {
+  if (toolName !== undefined && FILE_READ_TOOL_NAMES.has(toolName)) {
     return false;
   }
   if (tr.content.includes(AX_TREE_TAG)) return false;
@@ -56,8 +51,8 @@ function isSpoolEligible(
  * rewriting an earlier message between calls would invalidate the cache from
  * that point on every iteration. The model still gets the head/tail preview
  * plus the on-disk path, so it can page the full content back in with
- * `file_read` (whose results are exempt from this pass) when it actually
- * needs it.
+ * `file_read` or `host_file_read` (whose results are exempt from this pass)
+ * when it actually needs it.
  *
  * Uses the same file paths, stub bytes, and eligibility rules as
  * `postTurnTruncateToolResults`, whose `TRUNCATION_MARKER` guard then skips

package/src/credential-execution/executable-discovery.ts

@@ -63,7 +63,7 @@ function getManagedBootstrapSocketPath(): string {
  * in order. The first existing path wins.
  *
  * Only paths outside the sandbox working directory are eligible.
- * `getDataDir()` (under `~/.vellum/workspace/data`) was previously included
+ * `getDataDir()` (under `$VELLUM_WORKSPACE_DIR/data`) was previously included
  * but is inside the sandbox write boundary, so a sandboxed tool could plant
  * a malicious binary there. Removed to close the sandbox-escape vector.
  *

package/src/credential-execution/process-manager.ts

@@ -327,6 +327,8 @@ function createStdioTransport(proc: Subprocess): CesTransport {
     const decoder = new TextDecoder();
 
     void (async () => {
+      let endReason: "eof" | "error" = "eof";
+      let readError: unknown;
       try {
         while (true) {
           const { value, done } = await reader.read();
@@ -344,17 +346,49 @@ function createStdioTransport(proc: Subprocess): CesTransport {
             }
           }
         }
-      } catch {
-        // Process ended
+      } catch (err) {
+        endReason = "error";
+        readError = err;
       } finally {
+        // Preserve existing semantics: the transport reports dead the moment
+        // the stdout stream ends, regardless of why.
         alive = false;
+
+        // DIAGNOSTIC (observation only). The reconnection path (secure-keys.ts)
+        // bounces CES whenever isAlive() goes false. This classifies WHY the
+        // transport died: a real process exit, or a stdout stream that
+        // ended/errored while the process is STILL RUNNING — the spurious case
+        // that needlessly restarts a healthy CES. Let `proc.exited` settle one
+        // tick so a near-simultaneous real exit isn't misread as spurious, then
+        // snapshot the exit code (`null` = still running).
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        const exitCode = proc.exitCode;
+        if (exitCode === null) {
+          log.warn(
+            {
+              pid: proc.pid,
+              endReason,
+              err: readError instanceof Error ? readError.message : readError,
+            },
+            "CES stdio transport: stdout stream ended while the process is still alive (spurious transport death)",
+          );
+        } else {
+          log.debug(
+            { pid: proc.pid, endReason, exitCode },
+            "CES stdio transport: stdout stream ended after process exit",
+          );
+        }
       }
     })();
   }
 
   // Track process exit
-  proc.exited.then(() => {
+  void proc.exited.then((exitCode) => {
     alive = false;
+    log.info(
+      { pid: proc.pid, exitCode },
+      "CES stdio transport: process exited",
+    );
   });
 
   return {

package/src/credential-execution/prompted-credential.ts

@@ -0,0 +1,205 @@
+/**
+ * Persistence for credentials collected through a secure prompt.
+ *
+ * A prompted credential can be delivered in three shapes:
+ *   - one-time send: injected into the broker for the next operation, never
+ *     written to the vault;
+ *   - a Slack channel token: routed through the Slack channel config so the
+ *     channel actually connects, not just stored;
+ *   - any other credential: written to secure storage.
+ *
+ * Both the `credential_store` tool's prompt action and the CLI
+ * `credentials prompt` route share this logic so the two entry points behave
+ * identically.
+ */
+
+import { getConfig } from "../config/loader.js";
+import {
+  setSlackChannelConfig,
+  type SlackChannelConfigResult,
+} from "../daemon/handlers/config-slack-channel.js";
+import { syncManualTokenConnection } from "../oauth/manual-token-connection.js";
+import type { SecretDelivery } from "../permissions/secret-prompter.js";
+import { credentialKey } from "../security/credential-key.js";
+import { setSecureKeyAsync } from "../security/secure-keys.js";
+import { credentialBroker } from "../tools/credentials/broker.js";
+import {
+  getCredentialMetadata,
+  upsertCredentialMetadata,
+} from "../tools/credentials/metadata-store.js";
+import type { CredentialInjectionTemplate } from "../tools/credentials/policy-types.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("prompted-credential");
+
+/** Slack channel credentials connect the channel rather than just storing a value. */
+export function isSlackChannelCredential(
+  service: string,
+  field: string,
+): field is "bot_token" | "app_token" | "user_token" {
+  return (
+    service === "slack_channel" &&
+    (field === "bot_token" || field === "app_token" || field === "user_token")
+  );
+}
+
+export async function storeSlackChannelCredential(
+  field: "bot_token" | "app_token" | "user_token",
+  value: string,
+): Promise<SlackChannelConfigResult> {
+  if (field === "bot_token") {
+    return setSlackChannelConfig(value, undefined);
+  }
+  if (field === "app_token") {
+    return setSlackChannelConfig(undefined, value);
+  }
+  return setSlackChannelConfig(undefined, undefined, value);
+}
+
+export function formatSlackChannelStatus(
+  result: SlackChannelConfigResult,
+): string {
+  if (result.connected) {
+    const teamLabel = result.teamName ?? "Slack";
+    const botLabel = result.botUsername ? ` (@${result.botUsername})` : "";
+    return ` Slack channel connected to ${teamLabel}${botLabel}.`;
+  }
+  if (result.warning) {
+    return ` ${result.warning}`;
+  }
+  return "";
+}
+
+/**
+ * Usage policy carried alongside a prompted credential.
+ *
+ * `allowedTools` / `allowedDomains` are forwarded to the metadata store as-is:
+ * `undefined` leaves an existing credential's list untouched and defaults to
+ * deny-all (empty) when creating a new credential, while an explicit empty
+ * array sets a deny-all policy. This matches the store's partial-update
+ * contract, so re-prompting a credential without policy flags preserves the
+ * policy it was originally stored with.
+ */
+interface PromptedCredentialPolicy {
+  allowedTools?: string[];
+  allowedDomains?: string[];
+  usageDescription?: string;
+  injectionTemplates?: CredentialInjectionTemplate[];
+}
+
+/**
+ * Outcome of persisting a prompted credential.
+ *
+ * `error` carries a human-readable message (without an "Error:" prefix);
+ * `stored` carries the Slack connection result when the value was a Slack
+ * channel token.
+ */
+type PersistPromptedCredentialResult =
+  | { outcome: "transient" }
+  | { outcome: "stored"; slackChannel?: SlackChannelConfigResult }
+  | { outcome: "error"; message: string };
+
+/**
+ * Persist a credential value obtained from a secure prompt.
+ *
+ * The caller is responsible for issuing the prompt and handling a missing
+ * value (cancellation / unsupported channel); this function owns everything
+ * that happens once a value is in hand.
+ */
+export async function persistPromptedCredential(args: {
+  service: string;
+  field: string;
+  value: string;
+  delivery: SecretDelivery;
+  policy: PromptedCredentialPolicy;
+}): Promise<PersistPromptedCredentialResult> {
+  const { service, field, value, delivery, policy } = args;
+
+  if (delivery === "transient_send") {
+    if (isSlackChannelCredential(service, field)) {
+      return {
+        outcome: "error",
+        message:
+          "Slack channel credentials must be saved to secure storage. Re-run the secure prompt and choose to store the token.",
+      };
+    }
+    const config = getConfig();
+    if (!config.secretDetection.allowOneTimeSend) {
+      log.warn(
+        { service, field },
+        "One-time send requested but not enabled in config",
+      );
+      return {
+        outcome: "error",
+        message:
+          "one-time send is not enabled. Set secretDetection.allowOneTimeSend to true in config.",
+      };
+    }
+    // Ensure metadata exists so broker policy checks work, but don't overwrite
+    // an existing record - a stored credential's policy must not be silently
+    // replaced by the transient prompt's policy. Metadata is written before the
+    // transient value so no dangling value can fail policy checks.
+    if (!getCredentialMetadata(service, field)) {
+      try {
+        upsertCredentialMetadata(service, field, {
+          allowedTools: policy.allowedTools,
+          allowedDomains: policy.allowedDomains,
+          usageDescription: policy.usageDescription,
+          injectionTemplates: policy.injectionTemplates,
+        });
+      } catch (err) {
+        log.error(
+          { service, field, err },
+          "metadata write failed for transient credential",
+        );
+        return {
+          outcome: "error",
+          message: `failed to write credential metadata for ${service}/${field}; the one-time value was discarded.`,
+        };
+      }
+    }
+    credentialBroker.injectTransient(service, field, value);
+    log.info(
+      { service, field, delivery: "transient_send" },
+      "One-time secret delivery used",
+    );
+    return { outcome: "transient" };
+  }
+
+  let slackChannel: SlackChannelConfigResult | undefined;
+  if (isSlackChannelCredential(service, field)) {
+    slackChannel = await storeSlackChannelCredential(field, value);
+    if (!slackChannel.success) {
+      return {
+        outcome: "error",
+        message: slackChannel.error ?? "failed to configure Slack channel",
+      };
+    }
+  } else {
+    const key = credentialKey(service, field);
+    const ok = await setSecureKeyAsync(key, value);
+    if (!ok) {
+      return { outcome: "error", message: "failed to store credential" };
+    }
+  }
+
+  try {
+    upsertCredentialMetadata(service, field, {
+      allowedTools: policy.allowedTools,
+      allowedDomains: policy.allowedDomains,
+      usageDescription: policy.usageDescription,
+      injectionTemplates: policy.injectionTemplates,
+    });
+  } catch (err) {
+    log.warn(
+      { service, field, err },
+      "metadata write failed after storing credential",
+    );
+  }
+
+  if (!isSlackChannelCredential(service, field)) {
+    await syncManualTokenConnection(service);
+  }
+
+  return { outcome: "stored", slackChannel };
+}

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -51,6 +51,7 @@ import {
   writeSlackMetadata,
 } from "../messaging/providers/slack/message-metadata.js";
 import type { ContextWindowResult } from "../plugins/defaults/compaction/window-manager.js";
+import { backfillMemoryV3SelectionMessageId } from "../plugins/defaults/memory-v3-shadow/shadow-plugin.js";
 import type {
   ContentBlock,
   ImageContent,
@@ -867,6 +868,7 @@ function handleThinkingDelta(
     thinking: event.thinking,
     conversationId: deps.ctx.conversationId,
     messageId: state.lastAssistantMessageId,
+    timestampMs: Date.now(),
   });
   // Mirror thinking into the same running view as text so the debounced
   // partial flush persists it mid-turn -- long reasoning streams survive a
@@ -1945,6 +1947,18 @@ export async function handleMessageComplete(
     );
   }
 
+  try {
+    backfillMemoryV3SelectionMessageId(
+      deps.ctx.conversationId,
+      assistantMessageId,
+    );
+  } catch (err) {
+    deps.rlog.warn(
+      { err },
+      "Failed to backfill memory v3 selection messageId (non-fatal)",
+    );
+  }
+
   deps.ctx.currentTurnSurfaces = [];
 
   // Emit trace event. Char count is computed from the cleaned +

package/src/daemon/conversation-process.ts

@@ -222,8 +222,7 @@ async function buildPassthroughBatch(
     // otherwise diverge.
     if (candIf?.userMessageInterface !== headInterface?.userMessageInterface)
       break;
-    if (candidate.sourceActorPrincipalId !== head.sourceActorPrincipalId)
-      break;
+    if (candidate.sourceActorPrincipalId !== head.sourceActorPrincipalId) break;
     if (classifySlash(candidate.content) !== "passthrough") break;
     if (
       resolveVerificationSessionIntent(candidate.content).kind ===
@@ -1358,6 +1357,12 @@ export interface ProcessMessageOptions {
   currentPage?: string;
   isInteractive?: boolean;
   callSite?: LLMCallSite;
+  /**
+   * Optional ad-hoc inference-profile override applied to every LLM call
+   * this turn issues (e.g. a schedule's pinned profile). Forwarded to
+   * {@link Conversation.runAgentLoop}.
+   */
+  overrideProfile?: string;
   displayContent?: string;
 }
 
@@ -1380,6 +1385,7 @@ export async function processMessage(
     currentPage,
     isInteractive,
     callSite,
+    overrideProfile,
     displayContent,
   } = options;
   await conversation.ensureActorScopedHistory();
@@ -1852,11 +1858,14 @@ export async function processMessage(
     isUserMessage?: boolean;
     titleText?: string;
     callSite?: LLMCallSite;
+    overrideProfile?: string;
   } = { isUserMessage: true };
   if (isInteractive !== undefined) loopOptions.isInteractive = isInteractive;
   if (agentLoopContent !== resolvedContent)
     loopOptions.titleText = resolvedContent;
   if (callSite !== undefined) loopOptions.callSite = callSite;
+  if (overrideProfile !== undefined)
+    loopOptions.overrideProfile = overrideProfile;
 
   await conversation.runAgentLoop(agentLoopContent, userMessageId, {
     ...loopOptions,

package/src/daemon/conversation-surfaces.ts

@@ -7,6 +7,7 @@ import {
   getAppDirPath,
   getAppPreview,
   isMultifileApp,
+  listAppsByConversation,
   resolveAppDir,
   resolveEffectiveAppHtml,
   updateApp,
@@ -179,6 +180,18 @@ export function flushSurfaceDataPersist(surfaceId: string): void {
   persistSurfaceData(pending.conversationId, surfaceId, pending.data);
 }
 
+/**
+ * Discard (without writing) any pending debounced persist for `surfaceId`.
+ * Called on dismissal so an in-flight `ui_update` snapshot cannot land after
+ * the surface block has been removed.
+ */
+export function cancelSurfaceDataPersist(surfaceId: string): void {
+  const pending = pendingSurfacePersists.get(surfaceId);
+  if (!pending) return;
+  clearTimeout(pending.timer);
+  pendingSurfacePersists.delete(surfaceId);
+}
+
 /**
  * Cancel all pending debounced persists. Called on conversation
  * teardown to avoid timers firing against torn-down state.
@@ -277,8 +290,133 @@ export function markSurfaceCompleted(
     log.warn({ err, surfaceId }, "Failed to persist surface completion to DB");
   }
 }
+
+/**
+ * Remove a `ui_surface` content block from history so a passively dismissed
+ * surface does not survive a reload. The live client drops a dismissed surface
+ * entirely; this converges persisted state with that behaviour. Cancels any
+ * pending debounced data persist first so a late `ui_update` snapshot cannot
+ * re-add the block, then strips the block from in-memory messages and the DB.
+ */
+export function removeSurfaceBlock(
+  ctx: { conversationId: string; messages?: Array<{ content: unknown }> },
+  surfaceId: string,
+): void {
+  cancelSurfaceDataPersist(surfaceId);
+
+  if (ctx.messages) {
+    for (let i = ctx.messages.length - 1; i >= 0; i--) {
+      const msg = ctx.messages[i];
+      if (!Array.isArray(msg.content)) continue;
+      const idx = msg.content.findIndex((block) => {
+        const b = block as Record<string, unknown>;
+        return b.type === "ui_surface" && b.surfaceId === surfaceId;
+      });
+      if (idx !== -1) {
+        msg.content.splice(idx, 1);
+        break;
+      }
+    }
+  }
+
+  try {
+    const rows = getMessages(ctx.conversationId);
+    for (let r = rows.length - 1; r >= 0; r--) {
+      let parsed: unknown[];
+      try {
+        const result = JSON.parse(rows[r].content);
+        if (!Array.isArray(result)) continue;
+        parsed = result;
+      } catch {
+        continue;
+      }
+      const idx = parsed.findIndex((pb) => {
+        const rb = pb as Record<string, unknown>;
+        return rb.type === "ui_surface" && rb.surfaceId === surfaceId;
+      });
+      if (idx !== -1) {
+        parsed.splice(idx, 1);
+        updateMessageContent(rows[r].id, JSON.stringify(parsed));
+        return;
+      }
+    }
+  } catch (err) {
+    log.warn({ err, surfaceId }, "Failed to remove dismissed surface from DB");
+  }
+}
 const TASK_PROGRESS_TEMPLATE_FIELDS = ["title", "status", "steps"] as const;
 
+const TASK_PROGRESS_CARD_STATUSES = new Set([
+  "in_progress",
+  "completed",
+  "failed",
+]);
+const TASK_PROGRESS_STEP_STATUSES = new Set([
+  "pending",
+  "in_progress",
+  "completed",
+  "failed",
+]);
+
+/**
+ * Coerce a model-supplied `steps` value into a renderable array. Drops
+ * non-object and label-less entries, accepts `title` as a `label` alias, and
+ * defaults a missing/invalid per-step status to "pending". Returns `[]` for a
+ * missing or non-array input so an indeterminate card still renders.
+ */
+function normalizeTaskProgressSteps(
+  value: unknown,
+): Array<Record<string, unknown>> {
+  if (!Array.isArray(value)) return [];
+  return value
+    .filter((step): step is Record<string, unknown> => isPlainObject(step))
+    .map((step) => {
+      const label =
+        typeof step.label === "string"
+          ? step.label
+          : typeof step.title === "string"
+            ? step.title
+            : "";
+      const status =
+        typeof step.status === "string" &&
+        TASK_PROGRESS_STEP_STATUSES.has(step.status)
+          ? step.status
+          : "pending";
+      return { ...step, label, status };
+    })
+    .filter((step) => (step.label as string).trim().length > 0);
+}
+
+/**
+ * Guarantee a task_progress card reaches the client with a well-formed
+ * `templateData` object so a coarse or indeterminate attempt (missing steps,
+ * missing status) renders instead of being silently dropped. Fills only
+ * missing fields — a fully-specified card is left intact.
+ */
+function ensureTaskProgressTemplateData(
+  normalized: Record<string, unknown>,
+): void {
+  const templateData: Record<string, unknown> = isPlainObject(
+    normalized.templateData,
+  )
+    ? { ...normalized.templateData }
+    : {};
+  if (
+    typeof templateData.title !== "string" &&
+    typeof normalized.title === "string"
+  ) {
+    templateData.title = normalized.title;
+  }
+  if (
+    typeof templateData.status !== "string" ||
+    !TASK_PROGRESS_CARD_STATUSES.has(templateData.status)
+  ) {
+    templateData.status = "in_progress";
+  }
+  templateData.steps = normalizeTaskProgressSteps(templateData.steps);
+  normalized.templateData = templateData;
+}
+
 /**
  * Migrate dynamic_page fields from the top-level tool input into `data`.
  *
@@ -365,6 +503,10 @@ function normalizeCardShowData(
     normalized.body = "";
   }
 
+  if (normalized.template === "task_progress") {
+    ensureTaskProgressTemplateData(normalized);
+  }
+
   return normalized as unknown as CardSurfaceData;
 }
 
@@ -2783,6 +2925,15 @@ export async function surfaceProxyResolver(
         conversationId: ctx.conversationId,
         surfaceId,
       });
+      // The live client drops a dismissed surface entirely. Mirror that in
+      // persisted state: pull it from the pending turn snapshot (appended to
+      // the message at turn completion) and strip any already-persisted block,
+      // so a reload does not resurrect a half-finished progress card.
+      const turnIdx = ctx.currentTurnSurfaces.findIndex(
+        (s) => s.surfaceId === surfaceId,
+      );
+      if (turnIdx !== -1) ctx.currentTurnSurfaces.splice(turnIdx, 1);
+      removeSurfaceBlock(ctx, surfaceId);
     }
     ctx.pendingSurfaceActions.delete(surfaceId);
     ctx.surfaceState.delete(surfaceId);
@@ -2796,11 +2947,24 @@ export async function surfaceProxyResolver(
   }
 
   if (toolName === "app_open") {
-    const appId = input.app_id as string;
+    // Weaker models routinely omit app_id even though the active app is in
+    // context. Fall back to the conversation's most-recently-updated app
+    // rather than failing with "Invalid ID: undefined".
+    let appId = input.app_id as string;
+    if (typeof appId !== "string" || appId.trim().length === 0) {
+      appId = listAppsByConversation(ctx.conversationId)[0]?.id ?? "";
+    }
     const preview = input.preview as DynamicPageSurfaceData["preview"];
     const openMode = input.open_mode as string | undefined;
-    const app = getApp(appId);
-    if (!app) return { content: `App not found: ${appId}`, isError: true };
+    const app = appId ? getApp(appId) : null;
+    if (!app) {
+      return {
+        content: appId
+          ? `App not found: ${appId}`
+          : "app_id is required and no active app exists in this conversation. Call app_create first, or pass app_id explicitly.",
+        isError: true,
+      };
+    }
 
     // Track conversation association (best-effort — failures must not break open flow).
     try {