@vellumai/assistant 0.8.5 → 0.8.7

package/src/daemon/host-app-control-proxy.ts

@@ -47,6 +47,11 @@
 import { createHash } from "node:crypto";
 
 import type { ContentBlock } from "../providers/types.js";
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
+import {
+  enforceSameActorOrErrorResult,
+  pickSameUserAutoResolve,
+} from "../runtime/auth/same-actor.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
 import { HostProxyBase, HostProxyRequestError } from "./host-proxy-base.js";
@@ -322,6 +327,54 @@ export class HostAppControlProxy extends HostProxyBase<
       }
     }
 
+    let resolvedTargetClientId = targetClientId;
+    if (resolvedTargetClientId == null) {
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_app_control",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        if (input.tool === "start") {
+          this.rollbackStartIfCurrent(attemptedSession);
+        }
+        return {
+          content:
+            "Multiple host_app_control clients are connected for this user. Specify target_client_id to disambiguate.",
+          isError: true,
+        };
+      }
+      if (resolved.kind === "match") {
+        resolvedTargetClientId = resolved.clientId;
+      } else if (
+        assistantEventHub.listClientsByCapability("host_app_control").length > 0
+      ) {
+        if (input.tool === "start") {
+          this.rollbackStartIfCurrent(attemptedSession);
+        }
+        return {
+          content:
+            "App control is not available for the current actor. Connect a host_app_control-capable client as the same user.",
+          isError: true,
+        };
+      }
+    }
+
+    if (resolvedTargetClientId != null) {
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId: resolvedTargetClientId,
+        op: "host_app_control",
+      });
+      if (rejection) {
+        if (input.tool === "start") {
+          this.rollbackStartIfCurrent(attemptedSession);
+        }
+        return rejection;
+      }
+    }
+
     try {
       const payload = await this.dispatchRequest(
         toolName,
@@ -329,7 +382,7 @@ export class HostAppControlProxy extends HostProxyBase<
         conversationId,
         signal,
         undefined,
-        targetClientId,
+        resolvedTargetClientId,
       );
       if (input.tool === "start") {
         if (payload.state === "running") {

package/src/daemon/host-cu-proxy.ts

@@ -23,7 +23,11 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
-import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
+import {
+  ambiguousSameUserError,
+  enforceSameActorOrErrorResult,
+  pickSameUserAutoResolve,
+} from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -156,33 +160,48 @@ export class HostCuProxy {
       });
     }
 
-    // Existence + capability validation for explicit targets. Mirrors
-    // HostFileProxy's resolver-side guard so that the proxy is safe even
-    // when called outside the conversation-surfaces dispatch (which has
-    // its own validation layer).
-    if (targetClientId != null) {
-      const client = assistantEventHub.getClientById(targetClientId);
+    let resolvedTargetClientId = targetClientId;
+    if (resolvedTargetClientId == null) {
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_cu",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        return Promise.resolve(ambiguousSameUserError("host_cu"));
+      }
+      if (resolved.kind === "match") {
+        resolvedTargetClientId = resolved.clientId;
+      } else if (
+        assistantEventHub.listClientsByCapability("host_cu").length > 0
+      ) {
+        return Promise.resolve({
+          content:
+            "Computer use is not available for the current actor. Connect a host_cu-capable client as the same user.",
+          isError: true,
+        });
+      }
+    }
+
+    if (resolvedTargetClientId != null) {
+      const client = assistantEventHub.getClientById(resolvedTargetClientId);
       if (!client) {
         return Promise.resolve({
-          content: `No connected client with id '${targetClientId}' supports host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
+          content: `No connected client with id '${resolvedTargetClientId}' supports host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
           isError: true,
         });
       }
       if (!client.capabilities.includes("host_cu")) {
         return Promise.resolve({
-          content: `Client '${targetClientId}' does not support host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
+          content: `Client '${resolvedTargetClientId}' does not support host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
           isError: true,
         });
       }
 
-      // Same-user enforcement: targeted CU dispatch must be owned by the
-      // same actor on both sides. This is the authoritative gate — the
-      // dispatch layer (conversation-surfaces.ts) skips its own check
-      // and relies on the proxy.
       const rejection = enforceSameActorOrErrorResult({
         hub: assistantEventHub,
         sourceActorPrincipalId,
-        targetClientId,
+        targetClientId: resolvedTargetClientId,
         op: "host_cu",
       });
       if (rejection) return Promise.resolve(rejection);
@@ -214,10 +233,12 @@ export class HostCuProxy {
                   type: "host_cu_cancel",
                   requestId,
                   conversationId,
-                  ...(targetClientId != null ? { targetClientId } : {}),
+                  ...(resolvedTargetClientId != null
+                    ? { targetClientId: resolvedTargetClientId }
+                    : {}),
                 },
                 conversationId,
-                { targetClientId },
+                { targetClientId: resolvedTargetClientId },
               );
             } catch {
               // Best-effort cancel notification
@@ -234,10 +255,12 @@ export class HostCuProxy {
       pendingInteractions.register(requestId, {
         conversationId,
         kind: "host_cu",
-        targetClientId,
+        targetClientId: resolvedTargetClientId,
         targetActorPrincipalId:
-          targetClientId != null
-            ? assistantEventHub.getActorPrincipalIdForClient(targetClientId)
+          resolvedTargetClientId != null
+            ? assistantEventHub.getActorPrincipalIdForClient(
+                resolvedTargetClientId,
+              )
             : undefined,
         rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
@@ -255,11 +278,12 @@ export class HostCuProxy {
             input,
             stepNumber,
             reasoning,
-            // Include in body so receiving client can verify targeted endpoint.
-            ...(targetClientId != null ? { targetClientId } : {}),
+            ...(resolvedTargetClientId != null
+              ? { targetClientId: resolvedTargetClientId }
+              : {}),
           },
           conversationId,
-          { targetClientId },
+          { targetClientId: resolvedTargetClientId },
         );
       } catch (err) {
         this._ownedRequests.delete(requestId);

package/src/daemon/host-file-proxy.ts

@@ -10,6 +10,7 @@ import {
   pickSameUserAutoResolve,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
+import { readAudioBase64 } from "../tools/shared/filesystem/audio-read.js";
 import { readImageBase64 } from "../tools/shared/filesystem/image-read.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -225,7 +226,13 @@ export class HostFileProxy {
    */
   resolve(
     requestId: string,
-    response: { content: string; isError: boolean; imageData?: string },
+    response: {
+      content: string;
+      isError: boolean;
+      imageData?: string;
+      audioData?: string;
+      audioMimeType?: string;
+    },
   ): void {
     const interaction = pendingInteractions.resolve(requestId, "answered");
     if (!interaction?.rpcResolve) {
@@ -244,6 +251,23 @@ export class HostFileProxy {
       );
       return;
     }
+    if (
+      meta.operation === "read" &&
+      !response.isError &&
+      typeof response.audioData === "string" &&
+      response.audioData.length > 0 &&
+      typeof response.audioMimeType === "string" &&
+      response.audioMimeType.length > 0
+    ) {
+      interaction.rpcResolve(
+        readAudioBase64(
+          response.audioData,
+          meta.path as string,
+          response.audioMimeType,
+        ),
+      );
+      return;
+    }
     interaction.rpcResolve({
       content: response.content,
       isError: response.isError,

package/src/daemon/host-proxy-preactivation.ts

@@ -102,6 +102,7 @@ export const HOST_PROXY_SKILL_PREACTIVATIONS: ReadonlyArray<{
 export function evaluateHostProxyAttachment(
   capability: HostProxyCapability,
   sourceInterface: InterfaceId | undefined,
+  sourceActorPrincipalId?: string,
 ): HostProxyAttachmentDecision {
   if (!sourceInterface) {
     return { shouldAttach: false, reason: "denied_no_interface" };
@@ -112,10 +113,18 @@ export function evaluateHostProxyAttachment(
   if (sourceInterface === "chrome-extension") {
     return { shouldAttach: false, reason: "denied_chrome_extension" };
   }
-  const clientCount =
-    assistantEventHub.listClientsByCapability(capability).length;
-  if (clientCount > 0) {
-    return { shouldAttach: true, reason: "cross_client", clientCount };
+  if (sourceActorPrincipalId == null) {
+    return { shouldAttach: false, reason: "denied_no_clients", clientCount: 0 };
+  }
+  const sameActorClients = assistantEventHub
+    .listClientsByCapability(capability)
+    .filter((c) => c.actorPrincipalId === sourceActorPrincipalId);
+  if (sameActorClients.length > 0) {
+    return {
+      shouldAttach: true,
+      reason: "cross_client",
+      clientCount: sameActorClients.length,
+    };
   }
   return { shouldAttach: false, reason: "denied_no_clients", clientCount: 0 };
 }
@@ -128,8 +137,13 @@ export function evaluateHostProxyAttachment(
 export function shouldAttachHostProxyForCapability(
   capability: HostProxyCapability,
   sourceInterface: InterfaceId | undefined,
+  sourceActorPrincipalId?: string,
 ): boolean {
-  return evaluateHostProxyAttachment(capability, sourceInterface).shouldAttach;
+  return evaluateHostProxyAttachment(
+    capability,
+    sourceInterface,
+    sourceActorPrincipalId,
+  ).shouldAttach;
 }
 
 /**
@@ -148,12 +162,17 @@ export function shouldAttachHostProxyForCapability(
 export function preactivateHostProxySkills(
   conversation: HostProxyPreactivationTarget,
   sourceInterface: InterfaceId | undefined,
+  sourceActorPrincipalId?: string,
 ): void {
   const decisions: Record<string, HostProxyAttachmentDecision> = {};
   const preactivatedSkillIds: string[] = [];
 
   for (const { capability, skillId } of HOST_PROXY_SKILL_PREACTIVATIONS) {
-    const decision = evaluateHostProxyAttachment(capability, sourceInterface);
+    const decision = evaluateHostProxyAttachment(
+      capability,
+      sourceInterface,
+      sourceActorPrincipalId,
+    );
     decisions[capability] = decision;
     if (decision.shouldAttach) {
       conversation.addPreactivatedSkillId(skillId);

package/src/daemon/lifecycle.ts

@@ -2,6 +2,7 @@ import { join } from "node:path";
 
 import { config as dotenvConfig } from "dotenv";
 
+import { refreshBackgroundWakeIntent } from "../background-wake/publisher.js";
 import { registerBackgroundWakeRuntime } from "../background-wake/runtime-registry.js";
 import { setPointerMessageProcessor } from "../calls/call-pointer-messages.js";
 import { reconcileCallsOnStartup } from "../calls/call-recovery.js";
@@ -59,8 +60,6 @@ import { sweepConceptPageFrontmatter } from "../memory/v2/frontmatter-sweep.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { backfillManualTokenConnections } from "../oauth/manual-token-connection.js";
 import { seedOAuthProviders } from "../oauth/seed-providers.js";
-import { installPluginRuntime } from "../plugins/external-api.js";
-import { loadUserPlugins } from "../plugins/user-loader.js";
 import { backfillGuardIfNeeded } from "../proactive-artifact/index.js";
 import { ensurePromptFiles } from "../prompts/system-prompt.js";
 import { runProviderConnectionsBackfill } from "../providers/inference/backfill.js";
@@ -73,6 +72,7 @@ import {
 import { RuntimeHttpServer } from "../runtime/http-server.js";
 import { recoverInterruptedImport } from "../runtime/migrations/vbundle-streaming-importer.js";
 import { registerSecretsDeps } from "../runtime/routes/secrets-deps.js";
+import { publishConversationListChanged } from "../runtime/sync/resource-sync-events.js";
 import { recoverStaleSchedules } from "../schedule/schedule-recovery.js";
 import { startScheduler } from "../schedule/scheduler.js";
 import {
@@ -110,7 +110,7 @@ import {
   startDiskPressureGuard,
   stopDiskPressureGuard,
 } from "./disk-pressure-guard.js";
-import { bootstrapPlugins } from "./external-plugins-bootstrap.js";
+import { initializePlugins } from "./external-plugins-bootstrap.js";
 import { backfillSlackInjectionTemplates } from "./handlers/config-slack-channel.js";
 import { installAssistantSymlink } from "./install-symlink.js";
 import {
@@ -708,38 +708,12 @@ export async function runDaemon(): Promise<void> {
       });
     }
 
-    // Install the `globalThis.__vellumPluginRuntime` bridge before scanning
-    // for user plugins. Plugins that touch the bridge from their module body
-    // would throw without this — see `plugins/external-api.ts` for the
-    // rationale (compiled-binary module identity).
-    installPluginRuntime();
-
-    // Populate the registry with user plugins from `<workspaceDir>/plugins/*`
-    // AFTER first-party plugins have already registered via their static
-    // side-effect imports. User plugins may fail to load individually; a
-    // failing user plugin is logged and skipped so one bad install can't
-    // prevent the daemon from starting. Ordering is load-bearing:
-    //   first-party registrations → user registrations → bootstrap (init).
-    // Both groups are fully registered before any `init()` runs so plugins
-    // that depend on each other's registration observably see a stable
-    // registry at init time.
-    await loadUserPlugins();
-
-    // Bootstrap registered plugins. Runs after the plugin registry is
-    // populated (first-party static side-effect imports + user plugins
-    // loaded above) and before the DaemonServer starts handling
-    // conversations. Credential resolution + per-plugin storage directory
-    // creation happen here. Wrapped in try/catch so a failing plugin can't
-    // block daemon startup — bootstrapPlugins internally tears down any
-    // partially-initialized plugins before throwing.
-    try {
-      await bootstrapPlugins({ config, assistantVersion: APP_VERSION });
-    } catch (err) {
-      log.warn(
-        { err },
-        "Plugin bootstrap failed — continuing startup with degraded plugin functionality",
-      );
-    }
+    // Bring up the plugin layer: install the runtime bridge, register the
+    // first-party defaults, load user plugins, and run every plugin's
+    // `init()`. Ordering is load-bearing (defaults register ahead of user
+    // plugins so they compose innermost) and plugin failures are contained so
+    // they can't block daemon startup.
+    await initializePlugins();
 
     // Start the DaemonServer (conversation manager) before Qdrant so HTTP
     // routes can begin accepting requests while Qdrant initializes.
@@ -950,7 +924,6 @@ export async function runDaemon(): Promise<void> {
         await processMessage(
           conversationId,
           message,
-          undefined,
           options
             ? {
                 ...(options.trustClass
@@ -1018,6 +991,7 @@ export async function runDaemon(): Promise<void> {
           scheduleJobId: info.scheduleJobId,
           title: info.title,
         });
+        publishConversationListChanged("created");
       },
     );
 
@@ -1082,13 +1056,11 @@ export async function runDaemon(): Promise<void> {
           // its own finally block.
           conversation.toolsDisabledDepth++;
           try {
-            const messageId = await conversation.persistUserMessage(
-              instruction,
-              [],
-              undefined,
-              { pointerInstruction: true },
-              "[Call status event]",
-            );
+            const { id: messageId } = await conversation.persistUserMessage({
+              content: instruction,
+              metadata: { pointerInstruction: true },
+              displayContent: "[Call status event]",
+            });
 
             // Helper: roll back persisted messages on failure, then reload
             // in-memory history from the (now cleaned) DB. Reloading avoids
@@ -1134,25 +1106,27 @@ export async function runDaemon(): Promise<void> {
 
             let agentLoopError: string | undefined;
             let generatedText = "";
-            await conversation.runAgentLoop(instruction, messageId, (msg) => {
-              if (
-                "type" in msg &&
-                msg.type === "assistant_text_delta" &&
-                "text" in msg
-              ) {
-                generatedText += (msg as { text: string }).text;
-              }
-              if (
-                "type" in msg &&
-                (msg.type === "error" || msg.type === "conversation_error")
-              ) {
-                agentLoopError =
-                  "message" in msg
-                    ? (msg as { message: string }).message
-                    : "userMessage" in msg
-                      ? (msg as { userMessage: string }).userMessage
-                      : "Agent loop failed";
-              }
+            await conversation.runAgentLoop(instruction, messageId, {
+              onEvent: (msg) => {
+                if (
+                  "type" in msg &&
+                  msg.type === "assistant_text_delta" &&
+                  "text" in msg
+                ) {
+                  generatedText += (msg as { text: string }).text;
+                }
+                if (
+                  "type" in msg &&
+                  (msg.type === "error" || msg.type === "conversation_error")
+                ) {
+                  agentLoopError =
+                    "message" in msg
+                      ? (msg as { message: string }).message
+                      : "userMessage" in msg
+                        ? (msg as { userMessage: string }).userMessage
+                        : "Agent loop failed";
+                }
+              },
             });
 
             // Identify messages created during this run by diffing against
@@ -1271,11 +1245,9 @@ export async function runDaemon(): Promise<void> {
     })();
 
     if (config.auditLog.retentionDays > 0) {
-      void rotateToolInvocations(config.auditLog.retentionDays).catch(
-        (err) => {
-          log.warn({ err }, "Audit log rotation failed");
-        },
-      );
+      void rotateToolInvocations(config.auditLog.retentionDays).catch((err) => {
+        log.warn({ err }, "Audit log rotation failed");
+      });
     }
 
     const workspaceHeartbeat = new WorkspaceHeartbeatService();
@@ -1293,6 +1265,7 @@ export async function runDaemon(): Promise<void> {
     });
     heartbeat.start();
     registerBackgroundWakeRuntime({ scheduler, heartbeat });
+    refreshBackgroundWakeIntent("daemon-startup");
     log.info(
       {
         enabled: heartbeatConfig.enabled,

package/src/daemon/mcp-reload-service.ts

@@ -82,7 +82,7 @@ async function doReload(): Promise<McpReloadResult> {
           serverConfig,
           manager,
         );
-        const accepted = registerMcpTools(mcpTools);
+        const accepted = registerMcpTools(serverId, mcpTools);
         const acceptedNames = accepted.map((t) => t.name);
         toolCount += accepted.length;
         servers.push({

package/src/daemon/meet-manifest-loader.ts

@@ -40,11 +40,7 @@ import type { SkillRoute } from "../runtime/skill-route-registry.js";
 import { registerSkillRoute } from "../runtime/skill-route-registry.js";
 import { getRepoSkillsDir } from "../skills/catalog-install.js";
 import { registerExternalTools } from "../tools/registry.js";
-import type {
-  ExecutionTarget,
-  Tool,
-  ToolContext,
-} from "../tools/types.js";
+import type { ExecutionTarget, Tool, ToolContext } from "../tools/types.js";
 import { RiskLevel } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
 import { getSkillRuntimePath } from "../util/platform.js";
@@ -129,7 +125,6 @@ function serializeToolContext(context: ToolContext): Record<string, unknown> {
 function buildProxyTool(
   entry: ManifestToolEntry,
   supervisor: MeetHostSupervisor,
-  manifestHash: string,
 ): Tool {
   const risk = coerceRiskLevel(entry.risk, entry.name);
   return {
@@ -138,12 +133,7 @@ function buildProxyTool(
     input_schema: (entry.input_schema as object) ?? {},
     category: entry.category,
     defaultRiskLevel: risk,
-    executionMode: "proxy",
     executionTarget: "host" as ExecutionTarget,
-    origin: "skill",
-    ownerSkillId: MEET_SKILL_ID,
-    ownerSkillBundled: true,
-    ownerSkillVersionHash: manifestHash,
     execute: async (input, context) => {
       // `dispatchTool` ensures the meet-host child is up + connected
       // before sending the frame, so callers don't need a separate
@@ -318,7 +308,10 @@ export interface MeetManifestLoaderDeps {
   /** Override for the manifest path resolver. */
   manifestPath?: string;
   /** Override for {@link registerExternalTools}. */
-  registerTools?: (provider: () => Tool[]) => void;
+  registerTools?: (
+    owner: { kind: "skill" | "plugin" | "mcp"; id: string },
+    provider: () => Tool[],
+  ) => void;
   /** Override for {@link registerSkillRoute}. */
   registerRoute?: (route: SkillRoute) => unknown;
   /** Override for {@link registerShutdownHook}. */
@@ -361,11 +354,11 @@ export async function loadMeetManifestProxies(
 
   // Tool provider resolves the full proxy list lazily so the tool manifest
   // reflects the manifest file at `initializeTools()` time — same timing
-  // contract as the in-process skill's provider closure.
-  registerTools(() =>
-    manifest.tools.map((entry) =>
-      buildProxyTool(entry, supervisor, manifest.sourceHash),
-    ),
+  // contract as the in-process skill's provider closure. Owner is recorded
+  // up-front so `getToolOwner(name)` returns the meet-join skill id without
+  // the tool object having to carry it.
+  registerTools({ kind: "skill", id: MEET_SKILL_ID }, () =>
+    manifest.tools.map((entry) => buildProxyTool(entry, supervisor)),
   );
 
   for (const entry of manifest.routes) {

package/src/daemon/message-protocol.ts

@@ -21,7 +21,6 @@ export * from "./message-types/computer-use.js";
 export * from "./message-types/contacts.js";
 export * from "./message-types/conversations.js";
 export * from "./message-types/diagnostics.js";
-export * from "./message-types/disk-pressure.js";
 export * from "./message-types/document-comments.js";
 export * from "./message-types/documents.js";
 export * from "./message-types/guardian-actions.js";
@@ -51,6 +50,7 @@ export * from "./message-types/work-items.js";
 export * from "./message-types/workspace.js";
 
 // Import domain-level union aliases for composition
+import type { DiskPressureStatusChangedEvent } from "../api/events/disk-pressure-status-changed.js";
 import type { _AcpServerMessages } from "./message-types/acp.js";
 import type {
   _AppsClientMessages,
@@ -77,7 +77,6 @@ import type {
   _DiagnosticsClientMessages,
   _DiagnosticsServerMessages,
 } from "./message-types/diagnostics.js";
-import type { _DiskPressureServerMessages } from "./message-types/disk-pressure.js";
 import type { _DocumentCommentsServerMessages } from "./message-types/document-comments.js";
 import type {
   _DocumentsClientMessages,
@@ -216,7 +215,7 @@ export type ServerMessage =
   | _UpgradesServerMessages
   | _AcpServerMessages
   | _BookmarksServerMessages
-  | _DiskPressureServerMessages
+  | DiskPressureStatusChangedEvent
   | SubagentEvent;
 
 // === Contract schema ===

package/src/daemon/message-provenance.ts

@@ -0,0 +1,49 @@
+/**
+ * Provenance-based message trust filtering.
+ *
+ * Each persisted message row records the trust class of the actor that
+ * produced it under `metadata.provenanceTrustClass`. Untrusted actors
+ * (unknown / trusted_contact viewers) must never see content that
+ * originated from the guardian, so any view assembled for an untrusted
+ * actor filters the history down to rows whose provenance is itself
+ * non-guardian.
+ *
+ * This lives in its own low-dependency module (types only) so both the
+ * conversation lifecycle (history load) and the context compactor (image
+ * manifest) can apply the identical filter without creating an import
+ * cycle through `conversation-lifecycle` ↔ `window-manager` ↔ `compactor`.
+ */
+import type { MessageRow } from "../memory/conversation-crud.js";
+import type { TrustClass } from "../runtime/actor-trust-resolver.js";
+
+export function parseProvenanceTrustClass(
+  metadata: string | null,
+): TrustClass | undefined {
+  if (!metadata) return undefined;
+  try {
+    const parsed = JSON.parse(metadata) as { provenanceTrustClass?: unknown };
+    const trustClass = parsed?.provenanceTrustClass;
+    if (
+      trustClass === "guardian" ||
+      trustClass === "trusted_contact" ||
+      trustClass === "unknown"
+    ) {
+      return trustClass;
+    }
+  } catch {
+    // Ignore malformed metadata and treat as unknown provenance.
+  }
+  return undefined;
+}
+
+export function filterMessagesForUntrustedActor(
+  messages: MessageRow[],
+): MessageRow[] {
+  return messages.filter((m) => {
+    const provenanceTrustClass = parseProvenanceTrustClass(m.metadata);
+    return (
+      provenanceTrustClass === "trusted_contact" ||
+      provenanceTrustClass === "unknown"
+    );
+  });
+}