@vellumai/assistant 0.8.5 → 0.8.7

package/node_modules/@vellumai/environments/src/types.ts

@@ -0,0 +1,70 @@
+/**
+ * Environment type definitions. Environments are deployment targets with
+ * their own platform backend and their own isolated on-host state. See the
+ * "Coexisting environments" design doc for the full model.
+ */
+
+/**
+ * Per-service default port set. Phase 5 (per-environment port offsets) is
+ * deferred from MVP, so today every environment uses the same port set. The
+ * shape exists so the rest of the stack can call `getDefaultPorts(env)` and
+ * gain per-env offsets later without changing any call sites.
+ */
+export interface PortMap {
+  daemon: number;
+  gateway: number;
+  qdrant: number;
+  ces: number;
+  outboundProxy: number;
+  tcp: number;
+}
+
+/**
+ * A resolved environment definition. Required fields are `name` and
+ * `platformUrl`. All other fields are optional and declared upfront — new
+ * fields are additive, never breaking. `name` is intentionally typed as
+ * `string` (not `keyof SEEDS`) so custom environments can be represented by
+ * future layers (user config file, ad-hoc env vars, etc.).
+ */
+export interface EnvironmentDefinition {
+  name: string;
+  platformUrl: string;
+
+  /**
+   * The web app (Next.js) base URL for browser-facing pages like
+   * `/account/login`. In production this is separate from the API backend
+   * (e.g. `www.vellum.ai` vs `platform.vellum.ai`); locally it's
+   * `localhost:3000` vs `localhost:8000`.
+   *
+   * Mirrors `VellumEnvironment.webURL` on the Swift side.
+   */
+  webUrl: string;
+
+  /**
+   * Override for the platform URL the assistant process itself uses. Only
+   * differs from `platformUrl` when the assistant runs in a different network
+   * namespace than the host (e.g. Docker on macOS, where the host's localhost
+   * is reached via `host.docker.internal`). Falls back to `platformUrl` when
+   * unset.
+   */
+  assistantPlatformUrl?: string;
+
+  /** Human-readable label for UI surfaces. */
+  displayName?: string;
+
+  /** Hint for UI surfaces that want to tint or badge their display. */
+  tintColor?: string;
+
+  /** Per-service port overrides merged on top of defaults. */
+  portsOverride?: Partial<PortMap>;
+
+  /** Override for the XDG config directory. */
+  configDirOverride?: string;
+
+  /**
+   * Override for the directory containing the lockfile. Populated by the
+   * resolver from `VELLUM_LOCKFILE_DIR` (an existing e2e test escape hatch)
+   * so path helpers don't read env vars directly.
+   */
+  lockfileDirOverride?: string;
+}

package/node_modules/@vellumai/environments/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "types": ["bun-types"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/node_modules/@vellumai/skill-host-contracts/src/assistant-event.ts

@@ -30,6 +30,13 @@ export interface AssistantEvent<TMessage = unknown> {
   id: string;
   /** Resolved conversation id when available. */
   conversationId?: string;
+  /**
+   * Monotonic per-conversation sequence number. Assigned by the daemon at
+   * publish time for conversation-scoped events; absent for unscoped
+   * broadcasts. Clients track the highest observed `seq` per conversation
+   * and pass it back on reconnect to request replay of missed events.
+   */
+  seq?: number;
   /** ISO-8601 timestamp of when the event was emitted. */
   emittedAt: string;
   /** Outbound message payload. */
@@ -70,6 +77,10 @@ export function buildAssistantEvent<TMessage>(
  * data: <JSON>\n
  * \n
  * ```
+ *
+ * The SSE `id:` line is the per-event UUID and is intentionally decoupled
+ * from any replay cursor. Replay-aware consumers read `seq` from the JSON
+ * payload of the envelope itself.
  */
 export function formatSseFrame(event: AssistantEvent): string {
   const sanitizedId = event.id.replace(/[\n\r]/g, "");

package/node_modules/@vellumai/skill-host-contracts/src/client.ts

@@ -502,9 +502,7 @@ export class SkillHostClient implements SkillHost {
 
     socket.on("close", () => {
       this.socket = null;
-      const err = new Error(
-        "SkillHostClient: socket closed before response",
-      );
+      const err = new Error("SkillHostClient: socket closed before response");
       for (const { reject, timer } of this.pending.values()) {
         clearTimeout(timer);
         reject(err);
@@ -971,15 +969,14 @@ export class SkillHostClient implements SkillHost {
       conversationId,
       role,
       content,
-      metadata,
-      opts,
+      options,
     ) =>
       this.call("host.memory.addMessage", {
         conversationId,
         role,
         content,
-        metadata,
-        opts,
+        metadata: options?.metadata,
+        skipIndexing: options?.skipIndexing,
       });
 
     return {
@@ -1057,9 +1054,7 @@ export class SkillHostClient implements SkillHost {
         // Fire-and-forget close RPC — we don't await the ack because the
         // server also tears down on socket close, which is the fallback.
         if (self.socket && !self.socket.destroyed) {
-          self
-            .call(SUBSCRIBE_CLOSE_METHOD, { subscribeId: id })
-            .catch(swallow);
+          self.call(SUBSCRIBE_CLOSE_METHOD, { subscribeId: id }).catch(swallow);
         }
       },
     };
@@ -1081,10 +1076,6 @@ export class SkillHostClient implements SkillHost {
             defaultRiskLevel: t.defaultRiskLevel,
             category: t.category,
             executionTarget: t.executionTarget,
-            executionMode: t.executionMode ?? "proxy",
-            ownerSkillId: t.ownerSkillId ?? this.options.skillId,
-            ownerSkillBundled: t.ownerSkillBundled,
-            ownerSkillVersionHash: t.ownerSkillVersionHash,
           };
         });
         // Cache the provider so `skill.dispatch_tool` can resolve a tool
@@ -1094,10 +1085,17 @@ export class SkillHostClient implements SkillHost {
           "skill.dispatch_tool",
           this.dispatchTool.bind(this),
         );
+        // Skill ownership travels at the params level (not per-tool) — the
+        // daemon-side registry stamps the owner from `skillId` into its
+        // own `ownersByName` map keyed by tool name. The `Tool` objects on
+        // the wire stay free of owner metadata so callers cannot spoof
+        // ownership by forging a field on the manifest.
+        //
         // Fire-and-forget; registration failures surface in the daemon log.
-        this.call("host.registries.register_tools", { tools: manifests }).catch(
-          swallow,
-        );
+        this.call("host.registries.register_tools", {
+          skillId: this.options.skillId,
+          tools: manifests,
+        }).catch(swallow);
       },
       registerSkillRoute: (route: SkillRoute): SkillRouteHandle => {
         // Cache the route by its regex source — `skill.dispatch_route` uses

package/node_modules/@vellumai/skill-host-contracts/src/skill-host.ts

@@ -194,18 +194,25 @@ export interface ProvidersFacet {
 // Memory
 // ---------------------------------------------------------------------------
 
+/** Valid message roles for `memory.addMessage`. */
+export type MessageRole = "user" | "assistant" | "system";
+
 /**
  * Callable signature for `memory.addMessage`. Mirrors the daemon's
  * `addMessage()` (in `assistant/src/memory/conversation-crud.ts`) shape.
  * The return type is left as `unknown` because the daemon has additional
  * fields (message id, metadata echo) that skills should not depend on.
  */
+export interface InsertMessageOptions {
+  metadata?: Record<string, unknown>;
+  skipIndexing?: boolean;
+}
+
 export type InsertMessageFn = (
   conversationId: string,
-  role: string,
+  role: MessageRole,
   content: string,
-  metadata?: Record<string, unknown>,
-  opts?: { skipIndexing?: boolean },
+  options?: InsertMessageOptions,
 ) => Promise<unknown>;
 
 /** Opaque payload passed to `memory.wakeAgentForOpportunity`. */

package/node_modules/@vellumai/skill-host-contracts/src/tool-types.ts

@@ -28,6 +28,22 @@
 
 export type ExecutionTarget = "sandbox" | "host";
 
+/** The kind of extension that owns a tool. Core tools have no owner. */
+export type OwnerKind = "skill" | "mcp" | "plugin";
+
+/**
+ * Identifies which extension owns a tool (skill / plugin / MCP server).
+ * Tracked by the daemon's tool registry keyed by tool name, not stored on
+ * the `Tool` object itself. The registry function `getToolOwner(name)`
+ * returns this shape; ownership is established at `register_tools` time
+ * via the `host.registries.register_tools` IPC method.
+ */
+export interface OwnerInfo {
+  kind: OwnerKind;
+  /** ID of the owning extension (skill id / plugin name / MCP server id). */
+  id: string;
+}
+
 export enum RiskLevel {
   Low = "low",
   Medium = "medium",
@@ -419,20 +435,6 @@ export interface Tool {
   description: string;
   category: string;
   defaultRiskLevel: RiskLevel;
-  /** When set to 'proxy', the tool is forwarded to a connected client rather than executed locally. */
-  executionMode?: "local" | "proxy";
-  /** Whether this tool is a core built-in, provided by a skill, contributed by a plugin, or from an MCP server. */
-  origin?: "core" | "skill" | "mcp" | "plugin";
-  /** If origin is 'skill', the ID of the owning skill. */
-  ownerSkillId?: string;
-  /** If origin is 'mcp', the ID of the owning MCP server. */
-  ownerMcpServerId?: string;
-  /** If origin is 'plugin', the name of the owning plugin. */
-  ownerPluginId?: string;
-  /** Content-hash of the owning skill's source at registration time. */
-  ownerSkillVersionHash?: string;
-  /** Whether the owning skill is bundled with the daemon (trusted first-party). */
-  ownerSkillBundled?: boolean;
   /** Declared execution target from the skill manifest. Used by resolveExecutionTarget
    * to accurately label lifecycle events for skill-provided tools. */
   executionTarget?: ExecutionTarget;