@vellumai/assistant 0.10.2 → 0.10.3-dev.202606252046.9075fd5

package/src/config/schemas/__tests__/memory-v3.test.ts

@@ -22,6 +22,7 @@ describe("MemoryV3ConfigSchema", () => {
       needleK: 100,
       denseK: 100,
       replyQueryK: 12,
+      selectorPromptPath: null,
       edge: { hubDegree: 30, seedCount: 18, perSeed: 6, cap: 45 },
     });
   });

package/src/config/schemas/call-site-catalog.ts

@@ -300,13 +300,6 @@ const CATALOG_RECORD: CatalogRecord = {
     description: "General-purpose LLM inference call site for skill use.",
     domain: "skills",
   },
-  advisor: {
-    id: "advisor",
-    displayName: "Advisor",
-    description:
-      "Stronger reviewer model consulted mid-task to shape or pressure-test the plan.",
-    domain: "skills",
-  },
   vision: {
     id: "vision",
     displayName: "Vision",

package/src/config/schemas/heartbeat.ts

@@ -5,10 +5,7 @@ export const HeartbeatConfigSchema = z
   .object({
     enabled: z
       .boolean({ error: "heartbeat.enabled must be a boolean" })
-      // Heartbeats are opt-in for new workspaces. Workspaces created while
-      // the default was true keep their behavior via workspace migration
-      // 102-preserve-heartbeat-enabled-for-existing-workspaces.
-      .default(false)
+      .default(true)
       .describe("Whether periodic heartbeat checks are enabled"),
     intervalMs: z
       .number({ error: "heartbeat.intervalMs must be a number" })
@@ -64,7 +61,7 @@ export const HeartbeatConfigSchema = z
       .int("heartbeat.maxDailyRuns must be an integer")
       .positive("heartbeat.maxDailyRuns must be a positive integer")
       .nullable()
-      .default(2)
+      .default(10)
       .describe(
         "Maximum heartbeats that can run per calendar day. Resets at midnight local time. Set to null for unlimited.",
       ),

package/src/config/schemas/llm.ts

@@ -79,7 +79,6 @@ export const LLMCallSiteEnum = z.enum([
   "meetConsentMonitor",
   "meetChatOpportunity",
   "inference",
-  "advisor",
   "vision",
   "trustRuleSuggestion",
   "homeGreeting",
@@ -442,13 +441,6 @@ export const ProfileEntry = LLMConfigFragment.extend({
    * #30362 even though the schema didn't accept it until now.
    */
   status: ProfileStatusSchema.nullable().optional(),
-  /**
-   * Whether the advisor is active while this profile is the chat profile.
-   * Absent/null means enabled (default on); only an explicit `false` disables
-   * it. `.nullable()` matches `status`/`label` so the PUT route's "send null
-   * to clear" sentinel resets it back to the default-on state.
-   */
-  advisorEnabled: z.boolean().nullable().optional(),
   /**
    * When present, this profile is a "mix": it carries no model config and
    * instead references a weighted list of standard profiles. The resolver
@@ -492,10 +484,9 @@ export const LLMSchema = z
     // schema level, so `LLMSchema.parse({})` yields an empty map.
     callSites: z.partialRecord(LLMCallSiteEnum, LLMCallSiteConfig).default({}),
     activeProfile: z.string().min(1).optional(),
-    // The profile the advisor consults (chosen under Models & Services). It is
-    // excluded from the chat-profile pickers so it can't be selected as the
-    // assistant's chat model. Absent falls back to the `advisor` call-site
-    // default (`quality-optimized`).
+    // The profile the advisor role consults when spawned as a subagent (chosen
+    // under Models & Services). It is excluded from the chat-profile pickers so
+    // it can't be selected as the assistant's chat model.
     advisorProfile: z.string().min(1).optional(),
     // TTL bounds for inference profile sessions. `defaultTtlSeconds` is read by
     // the CLI to apply when `--ttl` is omitted; the daemon handler itself only

package/src/config/schemas/memory-lifecycle.ts

@@ -78,6 +78,17 @@ export const MemoryJobsConfigSchema = MemoryJobsConfigInputSchema.transform(
   },
 ).describe("Memory background job processing configuration");
 
+export const MemoryWorkerConfigSchema = z
+  .object({
+    enabled: z
+      .boolean({ error: "memory.worker.enabled must be a boolean" })
+      .default(false)
+      .describe(
+        "Whether the memory jobs worker runs as a separate OS process instead of the assistant's synchronous in-process runner. The assistant's worker supervisor re-reads this flag on every poll: while it is set, the in-process runner stands down (the out-of-process worker, spawned at startup when set, owns the queue); while it is unset, the in-process runner drains the queue. `assistant memory worker start`/`stop` flip the flag (and spawn/stop the worker process) to switch modes at runtime without a restart.",
+      ),
+  })
+  .describe("Memory jobs worker process configuration");
+
 export const MemoryRetentionConfigSchema = z
   .object({
     keepRawForever: z
@@ -185,6 +196,7 @@ export const MemoryMaintenanceConfigSchema = z
   );
 
 export type MemoryJobsConfig = z.infer<typeof MemoryJobsConfigSchema>;
+export type MemoryWorkerConfig = z.infer<typeof MemoryWorkerConfigSchema>;
 export type MemoryRetentionConfig = z.infer<typeof MemoryRetentionConfigSchema>;
 export type MemoryCleanupConfig = z.infer<typeof MemoryCleanupConfigSchema>;
 export type MemoryMaintenanceConfig = z.infer<

package/src/config/schemas/memory-v3.ts

@@ -259,6 +259,13 @@ export const MemoryV3ConfigSchema = z
       .describe(
         "Per-lane article budget for the reply-query finder pass: needle and dense each re-run over the assistant's previous message as separate queries (never concatenated with the user's message). 0 disables the pass. Deliberately small next to needleK/denseK — the pass adds the assistant-side retrieval signal, not a second full sweep.",
       ),
+    selectorPromptPath: z
+      .string({ error: "memory.v3.selectorPromptPath must be a string" })
+      .nullable()
+      .default(null)
+      .describe(
+        "Optional path to a file whose contents replace the bundled per-turn selector system prompt (the instructions that tell the selector which candidate pages to keep). Absolute paths are used as-is, a leading `~/` is expanded to the home directory, otherwise the path is resolved under the workspace root. The selector prompt takes no placeholders — the candidate pool is supplied separately as the user message — so the file is used verbatim. If the file is missing, unreadable, empty, or over 1 MiB, the bundled prompt is used and a warning is logged.",
+      ),
     edge: MemoryV3EdgeSchema.default(MemoryV3EdgeSchema.parse({})),
   })
   .describe("Memory v3 — section-grain lane retrieval");

package/src/config/schemas/memory.ts

@@ -5,6 +5,7 @@ import {
   MemoryJobsConfigSchema,
   MemoryMaintenanceConfigSchema,
   MemoryRetentionConfigSchema,
+  MemoryWorkerConfigSchema,
 } from "./memory-lifecycle.js";
 import {
   MemoryExtractionConfigSchema,
@@ -39,6 +40,9 @@ export const MemoryConfigSchema = z
       MemorySegmentationConfigSchema.parse({}),
     ),
     jobs: MemoryJobsConfigSchema.default(MemoryJobsConfigSchema.parse({})),
+    worker: MemoryWorkerConfigSchema.default(
+      MemoryWorkerConfigSchema.parse({}),
+    ),
     retention: MemoryRetentionConfigSchema.default(
       MemoryRetentionConfigSchema.parse({}),
     ),

package/src/config/schemas/timeouts.ts

@@ -28,6 +28,14 @@ export const TimeoutConfigSchema = z
       .describe(
         "How long to wait for user permission approval before timing out (seconds)",
       ),
+    questionResponseTimeoutSec: z
+      .number({ error: "timeouts.questionResponseTimeoutSec must be a number" })
+      .finite("timeouts.questionResponseTimeoutSec must be finite")
+      .positive("timeouts.questionResponseTimeoutSec must be a positive number")
+      .default(1800)
+      .describe(
+        "Backstop timeout for an unanswered ask_question prompt (seconds). The primary way an interactive user dismisses a prompt is by moving on — enqueuing another message supersedes it — so this only bounds a prompt left open with no response and no follow-up message.",
+      ),
     toolExecutionTimeoutSec: z
       .number({ error: "timeouts.toolExecutionTimeoutSec must be a number" })
       .finite("timeouts.toolExecutionTimeoutSec must be finite")

package/src/config/seed-inference-profiles.ts

@@ -52,7 +52,7 @@ const MANAGED_PROFILE_TEMPLATES: Record<string, ManagedProfileTemplate> = {
     label: "Balanced",
     description: "Good balance of quality, cost, and speed",
     maxTokens: 32000,
-    effort: "high",
+    effort: "medium",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
     topP: 0.95,
@@ -84,19 +84,25 @@ const MANAGED_PROFILE_TEMPLATES: Record<string, ManagedProfileTemplate> = {
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
-    // This is the advisor's own (strongest) profile: when it's also the chat
-    // profile there's nothing stronger to consult, so the advisor defaults off.
-    advisorEnabled: false,
   },
+  // Served by DeepSeek V4 Flash on Fireworks via managed platform inference: a
+  // fast, low-cost open model. `model` is pinned explicitly rather than
+  // resolved via the `latency-optimized` intent (which still maps to Kimi K2.5
+  // on Fireworks and Anthropic Haiku elsewhere).
+  //
+  // `effort: "none"` (not "low") because Fireworks is not thinking-aware: the
+  // disabled `thinking` config is stripped before the request, so a non-"none"
+  // effort would be sent as `reasoning_effort` and make this profile pay for
+  // reasoning despite thinking being off. "none" keeps Speed non-reasoning.
   "cost-optimized": {
-    intent: "latency-optimized",
-    provider: "anthropic",
-    connectionName: "anthropic-managed",
+    model: "accounts/fireworks/models/deepseek-v4-flash",
+    provider: "fireworks",
+    connectionName: "fireworks-managed",
     source: "managed",
     label: "Speed",
-    description: "Fastest responses at lower cost",
+    description: "Fastest responses at lower cost (DeepSeek V4 Flash)",
     maxTokens: 8192,
-    effort: "low",
+    effort: "none",
     thinking: { enabled: false, streamThinking: false },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
@@ -155,19 +161,20 @@ export const OS_BETA_FEATURE_FLAG_KEY = "os-beta";
  * Flag-gated managed profile. NOT in MANAGED_PROFILE_TEMPLATES, so the
  * unconditional boot seed never creates it. Reconciled in/out by
  * the flag-gated profile reconcile based on the `os-beta` feature flag.
- * Balanced-parity defaults; GLM 5.2 pinned explicitly via `model`.
+ * Balanced defaults, with lower reasoning effort while the profile is in beta.
  */
 export const OS_BETA_PROFILE_TEMPLATE: ManagedProfileTemplate = {
-  model: "accounts/fireworks/models/glm-5p2",
-  provider: "fireworks",
-  connectionName: "fireworks-managed",
+  intent: "balanced",
+  provider: "together",
+  connectionName: "together-managed",
   source: "managed",
   label: "OS Beta",
-  description: "Open-source frontier model (GLM 5.2), in beta",
+  description: "Good balance of quality, cost, and speed, in beta",
   maxTokens: 32000,
-  effort: "high",
+  effort: "low",
   thinking: { enabled: true, streamThinking: true },
   contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  topP: 0.95,
 };
 
 // Membership here marks a name as managed. The route layer applies managed
@@ -214,11 +221,9 @@ export type SeedInferenceProfilesOptions = {
  *    `cost-optimized`): reconciled from the code templates on every boot —
  *    on-platform and off-platform alike — so Vellum can push model/config
  *    updates to customers in a release without a workspace migration. The
- *    templates own all profile content; `label`, `status`, `advisorEnabled`,
- *    and `topP` are user overrides that survive reseeds. Of those, only
- *    `label`, `status`, and `topP` are editable through the managed PUT route
- *    allowlist; `advisorEnabled` is edited via the generic config path but is
- *    still preserved here so it survives reboots.
+ *    templates own all profile content; `label`, `status`, and `topP` are user
+ *    overrides that survive reseeds and are editable through the managed PUT
+ *    route allowlist.
  *    Platform overlays (`preserveProfileNames`) take precedence for the boot
  *    they are supplied.
  *
@@ -273,14 +278,11 @@ export function seedInferenceProfiles(
   //    as usual.
   //
   //    A whitelist of user-editable fields survives the reconcile: `label`
-  //    (display rename), `status` (active/disabled toggle), `advisorEnabled`
-  //    (per-profile advisor toggle), and `topP` (sampling override) — the only
-  //    fields a user may override. The managed PUT route
-  //    `/v1/config/llm/profiles/:name` lets users patch `label`, `status`, and
-  //    `topP` on managed profiles without duplicating (its editable allowlist,
-  //    `MANAGED_PROFILE_EDITABLE_KEYS`, deliberately excludes `advisorEnabled`,
-  //    which is set through the generic config path). We honor every one of
-  //    these overrides across reseeds or they'd silently revert on every boot.
+  //    (display rename), `status` (active/disabled toggle), and `topP`
+  //    (sampling override) — the only fields a user may override. The managed
+  //    PUT route `/v1/config/llm/profiles/:name` lets users patch these on
+  //    managed profiles without duplicating. We honor every one of these
+  //    overrides across reseeds or they'd silently revert on every boot.
   //    Carry by key-presence rather than truthiness so an explicit `null` (user
   //    cleared the field) survives too.
   //
@@ -352,12 +354,6 @@ export function seedInferenceProfiles(
             : previous.label;
       }
       if ("status" in previous) next.status = previous.status;
-      // The per-profile advisor toggle is a user override — preserve it across
-      // reseeds so a user's choice survives reboots (the template value only
-      // seeds the initial default, e.g. off for quality-optimized).
-      if ("advisorEnabled" in previous) {
-        next.advisorEnabled = previous.advisorEnabled;
-      }
       // `topP` is user-editable on managed profiles (see the managed-profile
       // editable allowlist on the PUT route) — preserve a user override across
       // reseeds, including an explicit `null` clear, or it would silently revert

package/src/config/skills.ts

@@ -688,6 +688,9 @@ function discoverSkillDirectories(skillsDir: string): string[] {
  * parseable `package.json` whose `name` equals the directory name. This
  * mirrors the external plugin loader's recognition gate, which skips any
  * directory whose `manifest.name` does not match its directory name.
+ *
+ * The caller is responsible for the missing-`package.json` case (it emits a
+ * diagnostic warning); this function only judges a manifest that is present.
  */
 function isRecognizedPluginDir(pluginDir: string, dirName: string): boolean {
   const manifestPath = join(pluginDir, "package.json");
@@ -735,12 +738,31 @@ function discoverPluginResidentSkills(): SkillSummary[] {
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
     const pluginDir = join(pluginsDir, entry.name);
+
+    // A directory under `plugins/` with no `package.json` is not a plugin the
+    // runtime can load, so its skills are never surfaced. This is an easy
+    // footgun — a plugin dropped in without its manifest looks installed but
+    // silently contributes nothing — so warn loudly with the path rather than
+    // skipping in silence, to make the misconfiguration diagnosable.
+    if (!existsSync(join(pluginDir, "package.json"))) {
+      log.warn(
+        { pluginDir },
+        "Plugin directory is missing package.json — skipping; its skills will not be available. Add a package.json whose `name` matches the directory.",
+      );
+      continue;
+    }
+
+    // Honor the `.disabled` sentinel the runtime plugin scan checks
+    // (`plugins/mtime-cache.ts`): a disabled plugin contributes no hooks or
+    // tools, so its resident skills must not be loadable either.
+    if (existsSync(join(pluginDir, ".disabled"))) continue;
+
     // Mirror the plugin loader's recognition gate: a directory is a real
-    // installed plugin only if it carries a parseable `package.json` whose
-    // `name` matches the directory. This rejects staging dirs, stray files,
-    // and malformed/mismatched clones (e.g. an un-adapted `caveman-installer`)
-    // that the loader itself would skip, so the catalog never surfaces skills
-    // from a directory the runtime would refuse to load.
+    // installed plugin only if its `package.json` `name` matches the directory.
+    // This rejects staging dirs and malformed/mismatched clones (e.g. an
+    // un-adapted `caveman-installer`) that the loader itself would skip, so the
+    // catalog never surfaces skills from a directory the runtime would refuse
+    // to load.
     if (!isRecognizedPluginDir(pluginDir, entry.name)) continue;
 
     const skillsDir = join(pluginDir, "skills");

package/src/config/sync-gated-profiles.ts

@@ -23,12 +23,12 @@ const log = getLogger("sync-gated-profiles");
  * Reconcile flag-gated managed profiles against the current feature-flag state.
  *
  * `seedInferenceProfiles()` runs synchronously at boot before feature flags are
- * available, so the OS Beta profile (GLM 5.2 / fireworks-managed) is materialized
- * here once flags have loaded. When the `os-beta` flag is on, the managed profile
- * is created (ordered right after `balanced`); when it is off, a previously
- * managed entry is removed with `profileOrder` / `activeProfile` / `advisorProfile`
- * fallbacks. The reconcile is idempotent and never touches a user-owned profile of
- * the same name.
+ * available, so the OS Beta profile (MiniMax M3 / together-managed) is
+ * materialized here once flags have loaded. When the `os-beta` flag is on, the
+ * managed profile is created (ordered right after `balanced`); when it is off, a
+ * previously managed entry is removed with `profileOrder` / `activeProfile` /
+ * `advisorProfile` fallbacks. The reconcile is idempotent and never touches a
+ * user-owned profile of the same name.
  *
  * Returns whether the on-disk config changed.
  */
@@ -105,23 +105,19 @@ function enableProfile(
     OS_BETA_PROFILE_TEMPLATE.connectionName,
   ) as Record<string, unknown>;
 
-  // BYOK installs seed managed profiles disabled: the platform-auth
-  // `fireworks-managed` connection backing this profile isn't usable until the
-  // user enables it, so a fresh OS Beta entry starts disabled to avoid offering
-  // an unusable route. A user's own status override (preserved below) wins on
-  // later reconciles.
+  // BYOK installs seed managed profiles disabled: the managed inference
+  // connection backing this profile isn't usable until the user enables it, so a
+  // fresh OS Beta entry starts disabled to avoid offering an unusable route. A
+  // user's own status override (preserved below) wins on later reconciles.
   if (isByokMode && !previous) {
     next.status = "disabled";
   }
 
   if (previous) {
-    // The only fields a user may override on a managed profile. Carry `label`
-    // by key-presence so an explicit null (user cleared it) survives too.
+    // Preserve user-owned overrides across reconciles.
     if ("label" in previous) next.label = previous.label;
     if ("status" in previous) next.status = previous.status;
-    if ("advisorEnabled" in previous) {
-      next.advisorEnabled = previous.advisorEnabled;
-    }
+    if ("topP" in previous) next.topP = previous.topP;
   }
 
   let changed = false;

package/src/contacts/__tests__/contacts-write-revoke-relay.test.ts

@@ -0,0 +1,128 @@
+/**
+ * Tests for the gateway-first member-revoke relay.
+ *
+ * revokeMemberChannel downgrades the channel's ACL status through the gateway
+ * (source of truth) via `ipcCallPersistent("mark_channel_revoked", ...)` first,
+ * then mirrors the downgrade to the assistant DB best-effort. A local mirror
+ * failure is swallowed so the gateway-owned outcome stands.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { ContactWriteResult } from "../types.js";
+
+type IpcCall = { method: string; params?: Record<string, unknown> };
+
+let ipcCalls: IpcCall[] = [];
+let ipcOk = true;
+
+const ipcCallPersistentMock = mock(
+  async (method: string, params?: Record<string, unknown>) => {
+    ipcCalls.push({ method, params });
+    return {
+      ok: ipcOk,
+      didWrite: ipcOk,
+      channel: {
+        id: (params?.contactChannelId as string) ?? "ch1",
+        contactId: "c1",
+        type: "telegram",
+        address: "addr",
+        status: "revoked",
+        revokedReason: (params?.reason as string) ?? null,
+      },
+    };
+  },
+);
+const actualGatewayClient = await import("../../ipc/gateway-client.js");
+mock.module("../../ipc/gateway-client.js", () => ({
+  ...actualGatewayClient,
+  ipcCallPersistent: ipcCallPersistentMock,
+}));
+
+
+// Local resolver primitive — resolves the native contact/channel by id; the
+// gateway owns the ACL downgrade, so it takes no reason and mutates nothing.
+const revokeMemberResult: ContactWriteResult = {
+  contact: { id: "c1" } as ContactWriteResult["contact"],
+  channel: { id: "ch1" } as ContactWriteResult["channel"],
+};
+const revokeMemberMock = mock((_memberId: string) => revokeMemberResult);
+const actualContactsWrite = await import("../contacts-write.js");
+mock.module("../contacts-write.js", () => ({
+  ...actualContactsWrite,
+  revokeMember: revokeMemberMock,
+}));
+
+const { revokeMemberChannel } = await import("../member-write-relay.js");
+
+describe("revokeMemberChannel gateway-first relay", () => {
+  beforeEach(() => {
+    ipcCalls = [];
+    ipcOk = true;
+    ipcCallPersistentMock.mockClear();
+    revokeMemberMock.mockClear();
+    revokeMemberMock.mockImplementation(() => revokeMemberResult);
+  });
+
+  test("relays the revoke to the gateway before mirroring locally", async () => {
+    const result = await revokeMemberChannel("ch1", "removed");
+
+    expect(ipcCalls).toEqual([
+      {
+        method: "mark_channel_revoked",
+        params: { contactChannelId: "ch1", reason: "removed" },
+      },
+    ]);
+    expect(revokeMemberMock).toHaveBeenCalledTimes(1);
+    expect(revokeMemberMock).toHaveBeenCalledWith("ch1");
+    expect(result).toBe(revokeMemberResult);
+  });
+
+  test("strips the composite contactId:channelId prefix before the relay", async () => {
+    await revokeMemberChannel("c1:ch1");
+
+    expect(ipcCalls[0]?.params?.contactChannelId).toBe("ch1");
+    // The local resolver still receives the original composite id it accepts.
+    expect(revokeMemberMock).toHaveBeenCalledWith("c1:ch1");
+  });
+
+  test("always relays — never skips based on local mirror status", async () => {
+    // The gateway owns the ACL outcome; the relay must fire even if the local
+    // mirror lags (says revoked) while the gateway row is still active.
+    await revokeMemberChannel("ch1");
+
+    expect(ipcCalls).toEqual([
+      {
+        method: "mark_channel_revoked",
+        params: { contactChannelId: "ch1", reason: undefined },
+      },
+    ]);
+    expect(revokeMemberMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("swallows a local-mirror failure without throwing; the gateway revoke stands", async () => {
+    revokeMemberMock.mockImplementation(() => {
+      throw new Error("local mirror exploded");
+    });
+
+    const result = await revokeMemberChannel("ch1", "removed");
+
+    expect(ipcCalls).toHaveLength(1);
+    expect(result).toBeNull();
+  });
+
+  test("throws when the gateway relay returns ok: false", async () => {
+    ipcOk = false;
+
+    let thrown: Error | undefined;
+    try {
+      await revokeMemberChannel("ch1");
+    } catch (err) {
+      thrown = err as Error;
+    }
+
+    expect(thrown).toBeDefined();
+    // Local mirror must not run when the gateway refuses the downgrade.
+    expect(revokeMemberMock).not.toHaveBeenCalled();
+  });
+});