@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/skills/categories-cache.ts

@@ -0,0 +1,118 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { parse as parseYaml } from "yaml";
+
+import { getPlatformBaseUrl } from "../config/env.js";
+import { getLogger } from "../util/logger.js";
+import { getRepoSkillsDir } from "./catalog-install.js";
+
+const log = getLogger("categories-cache");
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface SkillCategoryDef {
+  slug: string;
+  label: string;
+  description: string;
+  icon: string;
+}
+
+let cachedCategories: SkillCategoryDef[] | null = null;
+let cacheTimestamp = 0;
+
+async function fetchCategories(): Promise<SkillCategoryDef[]> {
+  const platformUrl = getPlatformBaseUrl();
+  const url = `${platformUrl}/v1/skills/categories/`;
+  const response = await fetch(url, {
+    signal: AbortSignal.timeout(10000),
+  });
+
+  if (!response.ok) {
+    throw new Error(
+      `Platform API error ${response.status}: ${response.statusText}`,
+    );
+  }
+
+  const data = (await response.json()) as {
+    categories: SkillCategoryDef[];
+  };
+  if (!Array.isArray(data.categories)) {
+    throw new Error("Platform categories response has invalid categories array");
+  }
+  return data.categories.filter(
+    (c): c is SkillCategoryDef =>
+      !!c && typeof c.slug === "string" && typeof c.label === "string",
+  );
+}
+
+function readLocalCategories(repoSkillsDir: string): SkillCategoryDef[] {
+  try {
+    const raw = readFileSync(
+      join(repoSkillsDir, "skill-categories-catalog.yaml"),
+      "utf-8",
+    );
+    const parsed = parseYaml(raw) as { categories?: SkillCategoryDef[] };
+    if (!Array.isArray(parsed?.categories)) return [];
+    return parsed.categories.filter(
+      (c): c is SkillCategoryDef =>
+        !!c && typeof c.slug === "string" && typeof c.label === "string",
+    );
+  } catch {
+    return [];
+  }
+}
+
+export async function getCategories(): Promise<SkillCategoryDef[]> {
+  if (cachedCategories && Date.now() - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedCategories;
+  }
+
+  const repoSkillsDir = getRepoSkillsDir();
+  const local = repoSkillsDir ? readLocalCategories(repoSkillsDir) : [];
+  let categories: SkillCategoryDef[];
+
+  try {
+    const remote = await fetchCategories();
+    if (local.length > 0) {
+      const localSlugs = new Set(local.map((c) => c.slug));
+      categories = [
+        ...local,
+        ...remote.filter((c) => !localSlugs.has(c.slug)),
+      ];
+    } else {
+      categories = remote;
+    }
+  } catch (err) {
+    if (cachedCategories) {
+      log.warn(
+        { err },
+        "Failed to fetch skill categories, keeping stale cache",
+      );
+      cacheTimestamp = Date.now();
+      return cachedCategories;
+    }
+    if (local.length > 0) {
+      log.warn(
+        { err },
+        "Failed to fetch skill categories, falling back to bundled local catalog",
+      );
+      categories = local;
+    } else {
+      log.warn({ err }, "Failed to fetch skill categories, returning empty");
+      return [];
+    }
+  }
+
+  cachedCategories = categories;
+  cacheTimestamp = Date.now();
+  return categories;
+}
+
+export function getCachedCategoriesSync(): SkillCategoryDef[] {
+  return cachedCategories ?? [];
+}
+
+export function invalidateCategoriesCache(): void {
+  cachedCategories = null;
+  cacheTimestamp = 0;
+}

package/src/skills/clawhub-files.ts

@@ -198,6 +198,7 @@ export function createClawhubProvider(): SkillFileProvider {
         kind: "catalog",
         status: "available",
         origin: "clawhub",
+        category: "integrations",
         slug: data.skill.slug,
         author: data.owner?.handle ?? "",
         stars: data.stats?.stars ?? 0,

package/src/skills/skillssh-files.ts

@@ -383,6 +383,7 @@ export function createSkillsShProvider(): SkillFileProvider {
           kind: "catalog",
           status: "available",
           origin: "skillssh",
+          category: "integrations",
           slug: skillId,
           sourceRepo: `${source.owner}/${source.repo}`,
           installs: 0,

package/src/subagent/manager.ts

@@ -13,7 +13,11 @@ import { v4 as uuid } from "uuid";
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import { Conversation } from "../daemon/conversation.js";
-import { findConversation } from "../daemon/conversation-store.js";
+import {
+  findConversation,
+  removeSubagentConversation,
+  setSubagentConversation,
+} from "../daemon/conversation-registry.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { wrapWithCallSiteRouting } from "../providers/call-site-routing.js";
@@ -285,12 +289,9 @@ export class SubagentManager {
       conversationRecord.id,
       provider,
       systemPrompt,
-      maxTokens,
       wrappedSendToClient,
       workingDir,
-      undefined, // sharedCesClient
-      undefined, // speedOverride
-      "5m", // cacheTtl — subagents run tight tool-use loops, 5m is always hot
+      { maxTokens, cacheTtl: "5m" },
     );
 
     // Mark conversation as having no direct client — it routes through parent.
@@ -337,6 +338,10 @@ export class SubagentManager {
 
     managed.conversation = conversation;
     this.subagents.set(subagentId, managed);
+    // Index the live conversation so the per-conversation injectors (workspace
+    // context, disk-pressure warning) can resolve it by id; subagents are not
+    // in the eviction-managed conversation store.
+    setSubagentConversation(conversationRecord.id, conversation);
     const labelKey = `${config.parentConversationId}:${config.label.toLowerCase().trim()}`;
     if (this.labelIndex.has(labelKey)) {
       log.warn(
@@ -439,7 +444,7 @@ export class SubagentManager {
       const { id: messageId } = await conversation.persistUserMessage({
         content: message,
       });
-      await conversation.runAgentLoop(message, messageId, undefined, {
+      await conversation.runAgentLoop(message, messageId, {
         callSite: "subagentSpawn",
         ...(managed.state.config.overrideProfile
           ? { overrideProfile: managed.state.config.overrideProfile }
@@ -627,7 +632,7 @@ export class SubagentManager {
         content: trimmed,
       });
       conversation
-        .runAgentLoop(trimmed, messageId, undefined, {
+        .runAgentLoop(trimmed, messageId, {
           callSite: "subagentSpawn",
           ...(managed.state.config.overrideProfile
             ? { overrideProfile: managed.state.config.overrideProfile }
@@ -698,7 +703,9 @@ export class SubagentManager {
    */
   private releaseConversation(managed: ManagedSubagent): void {
     if (!managed.conversation) return;
-    managed.conversation.dispose();
+    const conversation = managed.conversation;
+    removeSubagentConversation(conversation.conversationId, conversation);
+    conversation.dispose();
     managed.conversation = null;
     managed.retainedUntil = Date.now() + TERMINAL_RETENTION_MS;
     this.ensureSweepRunning();
@@ -719,16 +726,18 @@ export class SubagentManager {
     if (!managed) return;
 
     if (managed.conversation) {
+      const conversation = managed.conversation;
       if (!TERMINAL_STATUSES.has(managed.state.status)) {
-        managed.conversation.abort(
+        conversation.abort(
           createAbortReason(
             "subagent_aborted",
             "SubagentManager.dispose",
-            managed.conversation.conversationId,
+            conversation.conversationId,
           ),
         );
       }
-      managed.conversation.dispose();
+      removeSubagentConversation(conversation.conversationId, conversation);
+      conversation.dispose();
       managed.conversation = null;
     }
     this.subagents.delete(subagentId);

package/src/telemetry/types.ts

@@ -6,6 +6,32 @@ export interface TelemetryEventBase {
   type: string;
   daemon_event_id: string;
   recorded_at: number;
+  /**
+   * Version of the assistant binary at the moment THIS event was
+   * RECORDED (not when the batch was uploaded). Distinct from the
+   * envelope's `assistant_version` field, which still ships for
+   * back-compat with platforms that haven't deployed the per-event
+   * handling.
+   *
+   * The platform's `TelemetryIngestView` prefers per-event over
+   * envelope: when a per-event value is present (including explicit
+   * `null`) it wins. When the field is omitted on the event entirely
+   * (old assistant), the envelope value is the back-compat fallback.
+   *
+   * Daemon-side, this field is always non-null — the reporter stamps
+   * the running binary's `APP_VERSION` when the underlying SQLite row
+   * has no record-time value. In this PR only `llm_usage` events
+   * carry a true record-time value (legacy llm_usage rows from before
+   * migration 267 fall back to `APP_VERSION`); turn, lifecycle, and
+   * onboarding events all stamp `APP_VERSION` directly until the
+   * follow-ups that add the column to `messages` / `lifecycle_events`
+   * (#18112) / `onboarding_events` (#30733) land. Stamping
+   * `APP_VERSION` instead of emitting explicit `null` preserves
+   * envelope-equivalent behavior under the per-event-wins contract.
+   * The type allows `null` for parity with the platform contract;
+   * in practice the daemon never sends it.
+   */
+  assistant_version: string | null;
 }
 
 /** LLM usage event — one per provider API call. */
@@ -159,9 +185,37 @@ export interface OnboardingTelemetryEvent extends TelemetryEventBase {
   ab_variant?: string;
 }
 
+/**
+ * Auth-fallback event — aggregated count of requests served via the legacy
+ * loopback auth fallback. One event per (guard, path, failure_kind) per flush
+ * window. Lets the platform see which deployments still rely on the loopback
+ * exemption instead of sending a bearer token.
+ */
+export interface AuthFallbackTelemetryEvent extends TelemetryEventBase {
+  type: "auth_fallback";
+  /** Which auth guard fell back: `"edge"` | `"edge-scoped"` | `"edge-guardian"`. */
+  guard: string;
+  /** Request pathname that fell back. */
+  path: string;
+  /**
+   * Why the bearer-token check did not succeed before the fallback:
+   * `"missing_authorization"` | `"malformed_authorization"` |
+   * `"token_validation_failed"` | `"insufficient_scope"` |
+   * `"non_actor_principal"` | `"guardian_mismatch"`.
+   */
+  failure_kind: string;
+  /** Number of requests that fell back for this key during the window. */
+  count: number;
+  /** Window start (epoch ms) the count was accumulated over. */
+  window_start: number;
+  /** Window end (epoch ms) the count was accumulated over. */
+  window_end: number;
+}
+
 /** Discriminated union of all telemetry event types. */
 export type TelemetryEvent =
   | LlmUsageTelemetryEvent
   | TurnTelemetryEvent
   | LifecycleTelemetryEvent
-  | OnboardingTelemetryEvent;
+  | OnboardingTelemetryEvent
+  | AuthFallbackTelemetryEvent;

package/src/telemetry/usage-telemetry-reporter.test.ts

@@ -94,11 +94,24 @@ mock.module("../version.js", () => ({
 let mockCollectUsageData = true;
 
 mock.module("../config/loader.js", () => ({
-  getConfig: () => ({ collectUsageData: mockCollectUsageData }),
+  getConfig: () => ({
+    ui: {},
+    model: "test",
+    provider: "test",
+    memory: { enabled: false },
+    rateLimit: { maxRequestsPerMinute: 0 },
+    secretDetection: { enabled: false },
+    collectUsageData: mockCollectUsageData,
+  }),
 }));
 
 const mockQueryUnreportedLifecycleEvents = mock(
-  () => [] as { id: string; eventName: string; createdAt: number }[],
+  () =>
+    [] as {
+      id: string;
+      eventName: string;
+      createdAt: number;
+    }[],
 );
 
 mock.module("../memory/lifecycle-events-store.js", () => ({
@@ -116,6 +129,7 @@ const mockQueryUnreportedOnboardingEvents = mock(
       tone: string | null;
       googleConnected: boolean | null;
       googleScopesJson: string | null;
+      priorAssistantsJson: string | null;
       abVariant: string | null;
     }[],
 );
@@ -124,13 +138,24 @@ mock.module("../memory/onboarding-events-store.js", () => ({
   queryUnreportedOnboardingEvents: mockQueryUnreportedOnboardingEvents,
 }));
 
+// The auth-fallback store is intentionally NOT mocked — it has its own
+// DB-backed tests, and Bun's `mock.module` is process-global, so mocking it
+// here would leak into those tests when files share an invocation. We seed the
+// real DB instead so every auth-fallback test stays order-independent.
+
 // ---------------------------------------------------------------------------
 // Production import (after mocks)
 // ---------------------------------------------------------------------------
 
+import { recordAuthFallbackCounts } from "../memory/auth-fallback-events-store.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+import { authFallbackEvents } from "../memory/schema.js";
 import type { UsageEvent } from "../usage/types.js";
 import { UsageTelemetryReporter } from "./usage-telemetry-reporter.js";
 
+initializeDb();
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -169,6 +194,7 @@ function makeUsageEvent(
     requestId: null,
     estimatedCostUsd: 0.001,
     pricingStatus: "priced",
+    assistantVersion: "test-app-version",
     conversationType: "standard",
     turnIndex: 1,
     ...overrides,
@@ -194,6 +220,7 @@ beforeEach(() => {
   mockQueryUnreportedLifecycleEvents.mockReturnValue([]);
   mockQueryUnreportedOnboardingEvents.mockReset();
   mockQueryUnreportedOnboardingEvents.mockReturnValue([]);
+  getDb().delete(authFallbackEvents).run();
   mockPlatformClient = null;
   mockGetPlatformBaseUrl.mockReset();
   mockGetDeviceId.mockReset();
@@ -902,9 +929,9 @@ describe("UsageTelemetryReporter", () => {
     // No HTTP call should have been made
     expect(mockFetch).not.toHaveBeenCalled();
 
-    // All 4 timestamp watermarks should have been advanced (IDs left untouched
+    // All 5 timestamp watermarks should have been advanced (IDs left untouched
     // so the compound-cursor branch stays active)
-    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(4);
+    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(5);
 
     const calls = mockSetMemoryCheckpoint.mock.calls;
     const keys = calls.map((c) => c[0]);
@@ -912,6 +939,7 @@ describe("UsageTelemetryReporter", () => {
     expect(keys).toContain("telemetry:turns:last_reported_at");
     expect(keys).toContain("telemetry:lifecycle:last_reported_at");
     expect(keys).toContain("telemetry:onboarding:last_reported_at");
+    expect(keys).toContain("telemetry:auth_fallback:last_reported_at");
   });
 
   test("events sent normally after re-enabling collectUsageData", async () => {
@@ -938,4 +966,222 @@ describe("UsageTelemetryReporter", () => {
     );
     expect(body.events[0].daemon_event_id).toBe("evt-after-reenable");
   });
+
+  // -------------------------------------------------------------------------
+  // Per-event `assistant_version` on the wire
+  //
+  // The envelope's `assistant_version` is upload-time (always the current
+  // binary). The per-event field is record-time (the binary that was running
+  // when the event was persisted to SQLite). In this PR only `llm_usage`
+  // events carry a true record-time value; turn events (and lifecycle /
+  // onboarding events, not asserted here) stamp the running binary's
+  // `APP_VERSION` directly until their respective follow-ups land.
+  // Nullable llm_usage cases (legacy rows from before migration 267 ran)
+  // fall back to the running binary's `APP_VERSION` rather than emitting
+  // explicit `null` — under the platform contract a present-but-null
+  // per-event value would override the envelope, and we'd rather have a
+  // concrete version than no version.
+  // -------------------------------------------------------------------------
+
+  test("llm_usage event carries its recorded assistantVersion on the wire", async () => {
+    const event = makeUsageEvent({
+      id: "evt-version-llm",
+      assistantVersion: "0.8.4",
+    });
+    mockQueryUnreportedUsageEvents.mockReturnValue([event]);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":1}', { status: 200 })),
+    );
+
+    const reporter = new UsageTelemetryReporter();
+    await reporter.flush();
+
+    const body = JSON.parse(
+      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+    );
+    // Envelope reflects current binary (upload-time).
+    expect(body.assistant_version).toBe("1.2.3-test");
+    // Per-event reflects record-time — a different value here is the
+    // whole point: backlogged events keep the binary they were stamped
+    // with when they were originally recorded.
+    expect(body.events[0].assistant_version).toBe("0.8.4");
+  });
+
+  test("llm_usage event with null assistantVersion falls back to APP_VERSION (pre-migration row)", async () => {
+    const event = makeUsageEvent({
+      id: "evt-version-llm-null",
+      assistantVersion: null,
+    });
+    mockQueryUnreportedUsageEvents.mockReturnValue([event]);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":1}', { status: 200 })),
+    );
+
+    const reporter = new UsageTelemetryReporter();
+    await reporter.flush();
+
+    const body = JSON.parse(
+      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+    );
+    // No explicit null on the wire — the running binary's APP_VERSION is
+    // stamped instead so a present-but-null value can't override the
+    // envelope under the platform's per-event-wins contract.
+    expect(body.events[0].assistant_version).toBe("1.2.3-test");
+  });
+
+  test("turn event emits assistant_version: APP_VERSION (running binary)", async () => {
+    // Turn events are derived from `messages` + `conversations`, which
+    // don't yet carry a per-event version. Until the follow-up migration
+    // adds a column to `messages`, we stamp the running binary's
+    // APP_VERSION instead of explicit null — matches what the envelope
+    // would have provided but per-event so it survives the platform
+    // contract that treats present per-event values as winning over the
+    // envelope.
+    mockQueryUnreportedUsageEvents.mockReturnValue([]);
+    mockQueryUnreportedTurnEvents.mockReturnValue([
+      {
+        id: "evt-turn-version",
+        createdAt: 1700000300000,
+        conversationId: "conv-1",
+        conversationType: "standard",
+        turnIndex: 1,
+        interfaceId: null,
+        channelId: null,
+        clientMetadata: null,
+      },
+    ]);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":1}', { status: 200 })),
+    );
+
+    const reporter = new UsageTelemetryReporter();
+    await reporter.flush();
+
+    const body = JSON.parse(
+      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+    );
+    const turn = body.events.find((e: { type: string }) => e.type === "turn");
+    expect(turn).toBeDefined();
+    expect(turn.assistant_version).toBe("1.2.3-test");
+  });
+
+  test("a single batch can carry mixed per-event versions", async () => {
+    // The whole point of this migration: an old backlogged event keeps
+    // its old version while a freshly recorded event in the same flush
+    // carries the current version. Pre-migration the entire batch would
+    // collapse to the envelope value.
+    const oldEvent = makeUsageEvent({
+      id: "evt-old",
+      assistantVersion: "0.8.3",
+    });
+    const newEvent = makeUsageEvent({
+      id: "evt-new",
+      assistantVersion: "0.8.5",
+    });
+    mockQueryUnreportedUsageEvents.mockReturnValue([oldEvent, newEvent]);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":2}', { status: 200 })),
+    );
+
+    const reporter = new UsageTelemetryReporter();
+    await reporter.flush();
+
+    const body = JSON.parse(
+      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+    );
+    const versions = body.events.map(
+      (e: { assistant_version: string | null }) => e.assistant_version,
+    );
+    expect(versions.sort()).toEqual(["0.8.3", "0.8.5"]);
+    // Envelope still reflects the running binary, not either event.
+    expect(body.assistant_version).toBe("1.2.3-test");
+  });
+
+  // -------------------------------------------------------------------------
+  // Auth-fallback events
+  // -------------------------------------------------------------------------
+
+  test("auth_fallback events are included in the events array with type discriminator", async () => {
+    mockQueryUnreportedUsageEvents.mockReturnValue([]);
+    recordAuthFallbackCounts(1700000740000, 1700000800000, [
+      {
+        guard: "edge",
+        path: "/v1/messages",
+        failureKind: "missing_authorization",
+        count: 42,
+      },
+    ]);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":1}', { status: 200 })),
+    );
+
+    const reporter = new UsageTelemetryReporter();
+    await reporter.flush();
+
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    const body = JSON.parse(
+      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
+    );
+    expect(body.events.length).toBe(1);
+    expect(body.events[0]).toMatchObject({
+      type: "auth_fallback",
+      guard: "edge",
+      path: "/v1/messages",
+      failure_kind: "missing_authorization",
+      count: 42,
+      window_start: 1700000740000,
+      window_end: 1700000800000,
+      assistant_version: "1.2.3-test",
+    });
+    // recorded_at is the row's createdAt (stamped at record time).
+    expect(typeof body.events[0].recorded_at).toBe("number");
+    expect(typeof body.events[0].daemon_event_id).toBe("string");
+  });
+
+  test("auth_fallback watermark advances to the last reported row on success", async () => {
+    mockQueryUnreportedUsageEvents.mockReturnValue([]);
+    recordAuthFallbackCounts(1700000000000, 1700000001000, [
+      {
+        guard: "edge-scoped",
+        path: "/v1/a",
+        failureKind: "insufficient_scope",
+        count: 1,
+      },
+      {
+        guard: "edge-guardian",
+        path: "/v1/b",
+        failureKind: "guardian_mismatch",
+        count: 3,
+      },
+    ]);
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response('{"accepted":2}', { status: 200 })),
+    );
+
+    // The last row by the reporter's (createdAt, id) cursor order is the one
+    // whose watermark should be persisted after a successful upload.
+    const rows = getDb()
+      .select()
+      .from(authFallbackEvents)
+      .orderBy(authFallbackEvents.createdAt, authFallbackEvents.id)
+      .all();
+    const lastRow = rows[rows.length - 1];
+
+    const reporter = new UsageTelemetryReporter();
+    await reporter.flush();
+
+    const watermarkCalls = mockSetMemoryCheckpoint.mock.calls.filter(
+      (c) => c[0] === "telemetry:auth_fallback:last_reported_at",
+    );
+    expect(watermarkCalls.length).toBeGreaterThanOrEqual(1);
+    expect(watermarkCalls[watermarkCalls.length - 1][1]).toBe(
+      String(lastRow.createdAt),
+    );
+
+    const idCalls = mockSetMemoryCheckpoint.mock.calls.filter(
+      (c) => c[0] === "telemetry:auth_fallback:last_reported_id",
+    );
+    expect(idCalls.length).toBeGreaterThanOrEqual(1);
+    expect(idCalls[idCalls.length - 1][1]).toBe(lastRow.id);
+  });
 });