@vellumai/assistant 0.8.6 → 0.8.7

package/src/daemon/conversation-runtime-assembly.ts

@@ -19,8 +19,10 @@ import {
 import {
   countMemoryPrefixBlocks,
   extractMemoryPrefixBlocks,
+  stripAllMemoryInjections,
 } from "../memory/graph/conversation-graph-memory.js";
 import type { QdrantSparseVector } from "../memory/qdrant-client.js";
+import { MEMORY_V3_BLOCK_ID } from "../memory/v3/types.js";
 import {
   readSlackMetadata,
   readSlackMetadataFromMessageMetadata,
@@ -53,7 +55,7 @@ import { TERMINAL_STATUSES } from "../subagent/types.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
 import { getWorkspaceDir, getWorkspacePromptPath } from "../util/platform.js";
 import { stripCommentLines } from "../util/strip-comment-lines.js";
-import { filterMessagesForUntrustedActor } from "./conversation-lifecycle.js";
+import { filterMessagesForUntrustedActor } from "./message-provenance.js";
 import { type PkbContextConversation } from "./pkb-context-tracker.js";
 import type { TrustContext } from "./trust-context.js";
 
@@ -299,7 +301,7 @@ function injectActiveSurfaceContext(
     lines.push(
       `The user is viewing app "${ctx.appName ?? "Untitled"}" (app_id: "${ctx.appId}", slug: "${slug}") in workspace mode.`,
       "",
-      'PREREQUISITE: If `app_refresh` is not yet available, call `skill_load` with `id: "app-builder"` first to load it.',
+      'PREREQUISITE: If `app_refresh` is not yet available, call `skill_load` with `skill: "app-builder"` first to load it.',
       "",
       "RULES FOR WORKSPACE MODIFICATION:",
       `1. Use \`file_edit\` to make surgical changes to app files. The file path is \`${getAppDirPath(ctx.appId)}/<path>\`.`,
@@ -488,7 +490,7 @@ export function buildSubagentStatusBlock(
 }
 
 // The `<active_subagents>` block is emitted by the `subagent-status` default
-// injector (`plugins/defaults/injectors.ts`) as an `append-user-tail`
+// injector (`plugins/defaults/injectors/register.ts`) as an `append-user-tail`
 // placement. Use {@link applyRuntimeInjections} with
 // `options.subagentStatusBlock` set, or drive the injector chain directly
 // via `collectInjectorBlocks`.
@@ -531,7 +533,7 @@ export function readNowScratchpad(): string | null {
 
 /**
  * The `<NOW.md>` block is emitted by the `now-md` default injector
- * (`plugins/defaults/injectors.ts`) as an `after-memory-prefix` placement.
+ * (`plugins/defaults/injectors/register.ts`) as an `after-memory-prefix` placement.
  * Use {@link applyRuntimeInjections} with `options.nowScratchpad` set.
  */
 
@@ -1647,10 +1649,9 @@ function buildActiveThreadBlockFromRenderable(
 
   if (members.length === 0) return null;
 
-  // The active-thread block is flattened to plain text below, which discards
-  // `Message.role`. Assistant rows that render content-only are relabeled in
-  // the post-render step. Timezone-aware assistant rows are already
-  // bracket-tagged by the renderer and must not receive another prefix.
+  // The active-thread block is flattened to plain text below. User rows keep
+  // explicit Slack attribution through the renderer; assistant rows pass
+  // through unchanged so the model does not learn a synthetic reply prefix.
   // Unnamed user rows (no real Slack displayName) get a `@user` senderLabel
   // here so their tag line carries attribution through the renderer. Labeled
   // user rows and assistant rows pass through unchanged.
@@ -1662,18 +1663,8 @@ function buildActiveThreadBlockFromRenderable(
 
   const rendered = renderSlackTranscriptWithProvenance(labeledMembers);
   if (rendered.renderedMessages.length === 0) return null;
-  // Reaction / overflow-trailer lines are renderer-owned Slack event lines,
-  // and timezone-aware assistant rows already carry metadata-backed compact
-  // attribution. Regular assistant content and the `[deleted]` sentinel get
-  // the prefix so attribution survives flattening.
   const lines = rendered.renderedMessages
-    .map((entry) => {
-      const text = extractTagLineTexts([entry.message])[0] ?? "";
-      return entry.message.role === "assistant" &&
-        entry.tagLineProvenance === "none"
-        ? `@assistant: ${text}`
-        : text;
-    })
+    .map((entry) => extractTagLineTexts([entry.message])[0] ?? "")
     .join("\n");
   return `<active_thread>\n${lines}\n</active_thread>`;
 }
@@ -2110,6 +2101,20 @@ export interface RuntimeInjectionOptions {
   slackActiveThreadFocusBlock?: string | null;
   activeDocuments?: TurnInjectionInputs["activeDocuments"];
   mode?: InjectionMode;
+  /**
+   * memory-v3-live: when true AND the v3 injector produced a `<memory>` block
+   * this turn (placement `after-memory-prefix`, id `memory-v3`), the v2
+   * `<memory>` injection that `graphMemory.prepareMemory` prepended to the
+   * tail is stripped from EVERY user message before the v3 block is spliced —
+   * so v3 becomes the sole `<memory>` source and history stays byte-stable for
+   * prompt caching.
+   *
+   * The strip is keyed off whether v3 ACTUALLY produced a block, not off the
+   * flag alone: when v3 errors or selects nothing (its injector returns
+   * `null`), v2's block is left in place so the turn still ships memory rather
+   * than dropping it (fallback-to-v2). Default false — v2 untouched.
+   */
+  suppressV2MemoryForV3?: boolean;
   /**
    * Per-turn {@link TurnContext} forwarded to plugin-registered
    * {@link Injector}s via {@link collectInjectorBlocks}. When omitted,
@@ -2319,7 +2324,26 @@ export async function applyRuntimeInjections(
       ? injectorChainPieces.join("\n\n")
       : undefined;
 
-  let result = runMessages;
+  // ── Step 0: memory-v3-live v2 suppression ──
+  // When v3 live mode is on AND the v3 injector actually produced a block this
+  // turn, v3 is the sole `<memory>` source. v2's `prepareMemory` already
+  // prepended its own `<memory>` block to the tail user message (and historical
+  // turns may carry v2 blocks from earlier turns). Strip every user message's
+  // memory prefix here so:
+  //   1. The v3 `after-memory-prefix` block (Step 2) lands at the top of the
+  //      tail with no v2 prefix ahead of it — exactly one `<memory>` block.
+  //   2. History is byte-stable across turns for prompt caching.
+  // Keyed off the v3 block being present (not the flag alone) so a v3 failure
+  // (`produce()` → null) leaves v2's block intact — fallback rather than a
+  // memory-less turn. Idempotent: re-injection sites that already stripped
+  // see no change.
+  const v3ProducedBlock = afterMemory.some((b) => b.id === MEMORY_V3_BLOCK_ID);
+  let runMessagesForAssembly = runMessages;
+  if (options.suppressV2MemoryForV3 && v3ProducedBlock) {
+    runMessagesForAssembly = stripAllMemoryInjections(runMessages);
+  }
+
+  let result = runMessagesForAssembly;
 
   // ── Step 1: Slack chronological replacement (chain "replace" block) ──
   if (replaceBlock && replaceBlock.messagesOverride) {
@@ -2328,7 +2352,9 @@ export async function applyRuntimeInjections(
     // runtime assembly runs. The Slack transcript is freshly rendered
     // from persisted rows and has no such prefix, so swap it in and then
     // re-prepend the captured prefix onto the new tail user message.
-    const carriedMemoryBlocks = extractMemoryPrefixBlocks(runMessages);
+    const carriedMemoryBlocks = extractMemoryPrefixBlocks(
+      runMessagesForAssembly,
+    );
     result = replaceBlock.messagesOverride;
     if (carriedMemoryBlocks.length > 0) {
       const slackTail = result[result.length - 1];

package/src/daemon/conversation-store.ts

@@ -265,13 +265,14 @@ export async function getOrCreateConversation(
         conversationId,
         provider,
         systemPrompt,
-        maxTokens,
         sendToClient,
         workingDir,
-        sharedCesClient,
-        storedOptions?.speed,
-        undefined,
-        storedOptions?.modelOverride,
+        {
+          maxTokens,
+          sharedCesClient,
+          speedOverride: storedOptions?.speed,
+          modelOverride: storedOptions?.modelOverride,
+        },
       );
       newConversation.updateClient(sendToClient, true);
       await newConversation.loadFromDb();

package/src/daemon/conversation-surfaces.ts

@@ -18,7 +18,11 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
-import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
+import {
+  ambiguousSameUserError,
+  enforceSameActorOrErrorResult,
+  pickSameUserAutoResolve,
+} from "../runtime/auth/same-actor.js";
 import type {
   InteractiveUiRequest,
   InteractiveUiResult,
@@ -29,6 +33,7 @@ import { isPlainObject } from "../util/object.js";
 import { buildConversationErrorMessage } from "./conversation-error.js";
 import { launchConversation } from "./conversation-launch.js";
 import type { EnqueueMessageOptions } from "./conversation-messaging.js";
+import type { ProcessMessageOptions } from "./conversation-process.js";
 import type { HostAppControlProxy } from "./host-app-control-proxy.js";
 import type { HostCuProxy } from "./host-cu-proxy.js";
 import type {
@@ -503,6 +508,7 @@ export interface SurfaceConversationContext {
     }>;
     display?: string;
     persistent?: boolean;
+    toolCallId?: string;
   }>;
   /** Optional proxy for delegating computer-use actions to a connected desktop client. */
   hostCuProxy?: HostCuProxy;
@@ -524,16 +530,7 @@ export interface SurfaceConversationContext {
     rejected?: boolean;
   };
   getQueueDepth(): number;
-  processMessage(
-    content: string,
-    attachments: UserMessageAttachment[],
-    onEvent?: (msg: ServerMessage) => void,
-    requestId?: string,
-    activeSurfaceId?: string,
-    currentPage?: string,
-    options?: { isInteractive?: boolean },
-    displayContent?: string,
-  ): Promise<string>;
+  processMessage(options: ProcessMessageOptions): Promise<string>;
   /** Serialize operations on a given surface to prevent read-modify-write races. */
   withSurface<T>(surfaceId: string, fn: () => T | Promise<T>): Promise<T>;
 }
@@ -1492,16 +1489,14 @@ export async function handleSurfaceAction(
       "Processing surface action immediately (history-restored) with attachments",
     );
     ctx
-      .processMessage(
+      .processMessage({
         content,
         attachments,
         onEvent,
         requestId,
-        surfaceId,
-        undefined,
-        undefined,
+        activeSurfaceId: surfaceId,
         displayContent,
-      )
+      })
       .catch((err) => {
         const message = err instanceof Error ? err.message : String(err);
         log.error(
@@ -1779,16 +1774,14 @@ export async function handleSurfaceAction(
     "Processing surface action as follow-up with attachments",
   );
   ctx
-    .processMessage(
+    .processMessage({
       content,
-      pendingAttachments,
+      attachments: pendingAttachments,
       onEvent,
       requestId,
-      surfaceId,
-      undefined,
-      undefined,
+      activeSurfaceId: surfaceId,
       displayContent,
-    )
+    })
     .catch((err) => {
       const message = err instanceof Error ? err.message : String(err);
       log.error(
@@ -1978,6 +1971,7 @@ export async function surfaceProxyResolver(
   toolName: string,
   input: Record<string, unknown>,
   signal?: AbortSignal,
+  toolUseId?: string,
 ): Promise<ToolExecutionResult> {
   // Route CU proxy tools (all computer_use_* action tools)
   if (toolName.startsWith("computer_use_")) {
@@ -2042,44 +2036,29 @@ export async function surfaceProxyResolver(
       if (rejection) return rejection;
     }
 
-    // Guard: require explicit targeting when multiple same-user CU-capable
-    // clients are connected. The tool schemas document target_client_id as
-    // "required when multiple clients support host_cu" but nothing enforced
-    // it at runtime until now. Without this guard, the request would
-    // broadcast to all capable clients simultaneously, causing the same CU
-    // action to execute on multiple machines. The filter mirrors
-    // HostFileProxy's auto-resolve: only same-user clients participate, so
-    // a cross-user client connected to the same daemon does not falsely
-    // trigger this ambiguity error.
-    //
-    // Asymmetry with host_bash / host_file (host-shell.ts): the bash/file
-    // guard additionally checks `transportInterface != null &&
-    // !supportsHostProxy(transportInterface)` and so only fires for non-host-
-    // proxy transports (web, Slack). For CU that check would be a no-op:
-    // every host_cu-capable client is host-proxy-capable by definition
-    // (host_cu only ships on macOS and the Chrome extension), so there is no
-    // host_cu-capable transport for which auto-routing-to-self would be
-    // appropriate. We therefore fire whenever there is genuine ambiguity.
+    // Untargeted CU must resolve to exactly one same-user capable client
+    // before dispatch. Otherwise the proxy would broadcast without a target
+    // actor binding, which is unsafe in shared runtimes.
     if (targetClientId == null) {
-      const allCuClients = assistantEventHub.listClientsByCapability("host_cu");
-      const sameUserCuClients = allCuClients.filter(
-        (c) => c.actorPrincipalId === sourceActorPrincipalId,
-      );
-      if (sameUserCuClients.length > 1) {
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_cu",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        return ambiguousSameUserError("host_cu");
+      }
+      if (resolved.kind === "match") {
+        targetClientId = resolved.clientId;
+      } else if (
+        assistantEventHub.listClientsByCapability("host_cu").length > 0
+      ) {
         return {
-          content: `Error: multiple clients support host_cu. Specify which client to target with \`target_client_id\`. Run \`assistant clients list --capability host_cu\` to see client IDs and labels.`,
+          content:
+            "Computer use is not available for the current actor. Connect a host_cu-capable client as the same user.",
           isError: true,
         };
       }
-      // When cross-user host_cu clients are connected, we MUST auto-resolve
-      // to the unique same-user client (or fail explicitly) — otherwise the
-      // proxy would broadcast untargeted and the CU action would reach the
-      // cross-user client too. Setting targetClientId here forces the proxy
-      // to deliver only to that client, with the same-user check below as
-      // belt-and-suspenders.
-      if (sameUserCuClients.length === 1 && allCuClients.length > 1) {
-        targetClientId = sameUserCuClients[0].clientId;
-      }
     }
 
     ctx.hostCuProxy.recordAction(toolName, input, reasoning);
@@ -2164,24 +2143,25 @@ export async function surfaceProxyResolver(
     }
 
     if (targetClientId == null) {
-      const allAcClients =
-        assistantEventHub.listClientsByCapability("host_app_control");
-      const sameUserAcClients = allAcClients.filter(
-        (c) => c.actorPrincipalId === sourceActorPrincipalId,
-      );
-      if (sameUserAcClients.length > 1) {
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_app_control",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        return ambiguousSameUserError("host_app_control");
+      }
+      if (resolved.kind === "match") {
+        targetClientId = resolved.clientId;
+      } else if (
+        assistantEventHub.listClientsByCapability("host_app_control").length > 0
+      ) {
         return {
-          content: `Error: multiple clients support host_app_control. Specify which client to target with \`target_client_id\`. Run \`assistant clients list --capability host_app_control\` to see client IDs and labels.`,
+          content:
+            "App control is not available for the current actor. Connect a host_app_control-capable client as the same user.",
           isError: true,
         };
       }
-      // When cross-user host_app_control clients are connected, auto-
-      // resolve to the unique same-user client. Otherwise the proxy would
-      // dispatch untargeted and the action could reach a cross-user
-      // client. Belt-and-suspenders: the proxy re-checks same-user.
-      if (sameUserAcClients.length === 1 && allAcClients.length > 1) {
-        targetClientId = sameUserAcClients[0].clientId;
-      }
     }
 
     // The TS `HostAppControlInput` (and the Swift mirror) is a discriminated
@@ -2323,6 +2303,7 @@ export async function surfaceProxyResolver(
       actions: mappedActions,
       display,
       ...(persistent ? { persistent: true } : {}),
+      ...(toolUseId ? { toolCallId: toolUseId } : {}),
     } as unknown as UiSurfaceShow);
 
     // Track surface for persistence with the message
@@ -2334,6 +2315,7 @@ export async function surfaceProxyResolver(
       actions: mappedActions,
       display,
       ...(persistent ? { persistent: true } : {}),
+      ...(toolUseId ? { toolCallId: toolUseId } : {}),
     });
 
     if (awaitAction) {
@@ -2507,6 +2489,7 @@ export async function surfaceProxyResolver(
         title: app.name,
         data: surfaceData,
         display: "inline",
+        ...(toolUseId ? { toolCallId: toolUseId } : {}),
       } as UiSurfaceShow);
 
       // Track for message persistence so the inline card survives history reload.
@@ -2516,6 +2499,7 @@ export async function surfaceProxyResolver(
         title: app.name,
         data: surfaceData,
         display: "inline",
+        ...(toolUseId ? { toolCallId: toolUseId } : {}),
       });
 
       return { content: JSON.stringify({ surfaceId, appId }), isError: false };
@@ -2534,6 +2518,7 @@ export async function surfaceProxyResolver(
       surfaceType: "dynamic_page",
       title: app.name,
       data: surfaceData,
+      ...(toolUseId ? { toolCallId: toolUseId } : {}),
     } as UiSurfaceShow);
 
     // Track surface for persistence
@@ -2542,6 +2527,7 @@ export async function surfaceProxyResolver(
       surfaceType: "dynamic_page",
       title: app.name,
       data: surfaceData,
+      ...(toolUseId ? { toolCallId: toolUseId } : {}),
     });
 
     ctx.pendingSurfaceActions.set(surfaceId, { surfaceType: "dynamic_page" });

package/src/daemon/conversation-tool-setup.ts

@@ -159,6 +159,7 @@ export function createToolExecutor(
         ctx.sendToClient(msg as ServerMessage);
         if (msg.type === "ui_surface_show") {
           const s = msg as unknown as UiSurfaceShow;
+          const surfaceToolCallId = s.toolCallId ?? toolUseId;
           ctx.currentTurnSurfaces.push({
             surfaceId: s.surfaceId,
             surfaceType: s.surfaceType,
@@ -167,6 +168,7 @@ export function createToolExecutor(
             actions: s.actions,
             display: s.display,
             ...(s.persistent ? { persistent: true } : {}),
+            ...(surfaceToolCallId ? { toolCallId: surfaceToolCallId } : {}),
           });
         }
       },
@@ -180,6 +182,7 @@ export function createToolExecutor(
           toolName,
           proxyInput,
           ctx.abortController?.signal,
+          toolUseId,
         ),
       proxyApprovalCallback: createProxyApprovalCallback(prompter, ctx),
       requestSecret: async (params) => {