@vellumai/assistant 0.10.4-dev.202607011847.0734ff2 → 0.10.4-dev.202607012136.5ef7865

package/eslint.config.mjs

@@ -12,6 +12,10 @@ const eslintConfig = defineConfig([
       "simple-import-sort": simpleImportSort,
     },
     rules: {
+      // Require braces on every control-statement body (if/else/for/
+      // while/do). A braceless body is a maintenance hazard: a second
+      // line added under the condition reads as guarded but always runs.
+      curly: ["warn", "all"],
       "simple-import-sort/imports": [
         "error",
         {
@@ -52,7 +56,9 @@ const eslintConfig = defineConfig([
   {
     files: ["src/cli/commands/**/*.ts"],
     ignores: ["src/cli/commands/**/__tests__/**"],
-    plugins: { cli: { rules: { "no-daemon-internals": cliNoDaemonInternals } } },
+    plugins: {
+      cli: { rules: { "no-daemon-internals": cliNoDaemonInternals } },
+    },
     rules: { "cli/no-daemon-internals": "error" },
   },
 ]);

package/openapi.yaml

@@ -19360,6 +19360,175 @@ paths:
       responses:
         "200":
           description: Successful response
+  /v1/monitoring/start:
+    post:
+      operationId: monitoring_start_post
+      summary: Start the resource monitor
+      description: Spawns (or reuses) the resource monitor process as a child of the daemon and enables monitoring.enabled.
+      tags:
+        - system
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  pid:
+                    type: number
+                  alreadyRunning:
+                    type: boolean
+                  monitoringEnabled:
+                    type: boolean
+                    const: true
+                  pidPath:
+                    type: string
+                required:
+                  - pid
+                  - alreadyRunning
+                  - monitoringEnabled
+                  - pidPath
+                additionalProperties: false
+  /v1/monitoring/status:
+    get:
+      operationId: monitoring_status_get
+      summary: Resource monitor status
+      description:
+        Reports the resource monitor process state, monitoring.enabled, the forensics data directory, and the most
+        recent persisted memory/disk sample.
+      tags:
+        - system
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    enum:
+                      - running
+                      - not_running
+                  pid:
+                    type: number
+                  monitoringEnabled:
+                    type: boolean
+                  dataDir:
+                    type: string
+                  latestSample:
+                    anyOf:
+                      - type: object
+                        properties:
+                          ts:
+                            type: number
+                          memory:
+                            anyOf:
+                              - type: object
+                                properties:
+                                  currentBytes:
+                                    type: number
+                                  limitBytes:
+                                    anyOf:
+                                      - type: number
+                                      - type: "null"
+                                  peakBytes:
+                                    anyOf:
+                                      - type: number
+                                      - type: "null"
+                                  ratio:
+                                    anyOf:
+                                      - type: number
+                                      - type: "null"
+                                required:
+                                  - currentBytes
+                                  - limitBytes
+                                  - peakBytes
+                                  - ratio
+                                additionalProperties: false
+                              - type: "null"
+                          events:
+                            anyOf:
+                              - type: object
+                                properties:
+                                  low:
+                                    type: number
+                                  high:
+                                    type: number
+                                  max:
+                                    type: number
+                                  oom:
+                                    type: number
+                                  oomKill:
+                                    type: number
+                                required:
+                                  - low
+                                  - high
+                                  - max
+                                  - oom
+                                  - oomKill
+                                additionalProperties: false
+                              - type: "null"
+                          disk:
+                            anyOf:
+                              - type: object
+                                properties:
+                                  path:
+                                    type: string
+                                  usedMb:
+                                    type: number
+                                  totalMb:
+                                    type: number
+                                  freeMb:
+                                    type: number
+                                required:
+                                  - path
+                                  - usedMb
+                                  - totalMb
+                                  - freeMb
+                                additionalProperties: false
+                              - type: "null"
+                        required:
+                          - ts
+                          - memory
+                          - events
+                          - disk
+                        additionalProperties: false
+                      - type: "null"
+                required:
+                  - status
+                  - monitoringEnabled
+                  - dataDir
+                  - latestSample
+                additionalProperties: false
+  /v1/monitoring/stop:
+    post:
+      operationId: monitoring_stop_post
+      summary: Stop the resource monitor
+      description: Disables monitoring.enabled and SIGTERMs the resource monitor process if it is running.
+      tags:
+        - system
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  monitoringWasRunning:
+                    type: boolean
+                  pid:
+                    type: number
+                  monitoringEnabled:
+                    type: boolean
+                    const: false
+                required:
+                  - monitoringWasRunning
+                  - monitoringEnabled
+                additionalProperties: false
   /v1/notification-intent-result:
     post:
       operationId: notificationintentresult_post
@@ -22860,145 +23029,143 @@ paths:
               schema:
                 type: object
                 properties:
-                  schedules:
-                    type: array
-                    items:
-                      type: object
-                      properties:
-                        id:
-                          type: string
-                        name:
-                          type: string
-                        enabled:
-                          type: boolean
-                        syntax:
-                          type: string
-                          enum:
-                            - cron
-                            - rrule
-                        expression:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        cronExpression:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        timezone:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        message:
-                          type: string
-                        script:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        nextRunAt:
-                          type: number
-                        lastRunAt:
-                          anyOf:
-                            - type: number
-                            - type: "null"
-                        lastStatus:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        retryCount:
-                          type: number
-                        maxRetries:
-                          type: number
-                        retryBackoffMs:
-                          type: number
-                        timeoutMs:
-                          anyOf:
-                            - type: number
-                            - type: "null"
-                        inferenceProfile:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        createdFromConversationId:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        createdFromConversationExists:
-                          type: boolean
-                        createdFromConversationArchivedAt:
-                          anyOf:
-                            - type: number
-                            - type: "null"
-                        description:
-                          type: string
-                        cadenceDescription:
-                          type: string
-                        mode:
-                          type: string
-                          enum:
-                            - notify
-                            - execute
-                            - script
-                            - wake
-                            - workflow
-                        status:
-                          type: string
-                          enum:
-                            - active
-                            - firing
-                            - fired
-                            - cancelled
-                        routingIntent:
-                          type: string
-                          enum:
-                            - single_channel
-                            - multi_channel
-                            - all_channels
-                        reuseConversation:
-                          type: boolean
-                        wakeConversationId:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        workflowName:
-                          anyOf:
-                            - type: string
-                            - type: "null"
-                        isOneShot:
-                          type: boolean
-                      required:
-                        - id
-                        - name
-                        - enabled
-                        - syntax
-                        - expression
-                        - cronExpression
-                        - timezone
-                        - message
-                        - script
-                        - nextRunAt
-                        - lastRunAt
-                        - lastStatus
-                        - retryCount
-                        - maxRetries
-                        - retryBackoffMs
-                        - timeoutMs
-                        - inferenceProfile
-                        - createdFromConversationId
-                        - createdFromConversationExists
-                        - createdFromConversationArchivedAt
-                        - description
-                        - cadenceDescription
-                        - mode
-                        - status
-                        - routingIntent
-                        - reuseConversation
-                        - wakeConversationId
-                        - workflowName
-                        - isOneShot
-                      additionalProperties: false
-                    description: Updated schedule list
+                  schedule:
+                    type: object
+                    properties:
+                      id:
+                        type: string
+                      name:
+                        type: string
+                      enabled:
+                        type: boolean
+                      syntax:
+                        type: string
+                        enum:
+                          - cron
+                          - rrule
+                      expression:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      cronExpression:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      timezone:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      message:
+                        type: string
+                      script:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      nextRunAt:
+                        type: number
+                      lastRunAt:
+                        anyOf:
+                          - type: number
+                          - type: "null"
+                      lastStatus:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      retryCount:
+                        type: number
+                      maxRetries:
+                        type: number
+                      retryBackoffMs:
+                        type: number
+                      timeoutMs:
+                        anyOf:
+                          - type: number
+                          - type: "null"
+                      inferenceProfile:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      createdFromConversationId:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      createdFromConversationExists:
+                        type: boolean
+                      createdFromConversationArchivedAt:
+                        anyOf:
+                          - type: number
+                          - type: "null"
+                      description:
+                        type: string
+                      cadenceDescription:
+                        type: string
+                      mode:
+                        type: string
+                        enum:
+                          - notify
+                          - execute
+                          - script
+                          - wake
+                          - workflow
+                      status:
+                        type: string
+                        enum:
+                          - active
+                          - firing
+                          - fired
+                          - cancelled
+                      routingIntent:
+                        type: string
+                        enum:
+                          - single_channel
+                          - multi_channel
+                          - all_channels
+                      reuseConversation:
+                        type: boolean
+                      wakeConversationId:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      workflowName:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      isOneShot:
+                        type: boolean
+                    required:
+                      - id
+                      - name
+                      - enabled
+                      - syntax
+                      - expression
+                      - cronExpression
+                      - timezone
+                      - message
+                      - script
+                      - nextRunAt
+                      - lastRunAt
+                      - lastStatus
+                      - retryCount
+                      - maxRetries
+                      - retryBackoffMs
+                      - timeoutMs
+                      - inferenceProfile
+                      - createdFromConversationId
+                      - createdFromConversationExists
+                      - createdFromConversationArchivedAt
+                      - description
+                      - cadenceDescription
+                      - mode
+                      - status
+                      - routingIntent
+                      - reuseConversation
+                      - wakeConversationId
+                      - workflowName
+                      - isOneShot
+                    additionalProperties: false
+                    description: The created schedule
                 required:
-                  - schedules
+                  - schedule
                 additionalProperties: false
   /v1/schedules/{id}:
     delete:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.4-dev.202607011847.0734ff2",
+  "version": "0.10.4-dev.202607012136.5ef7865",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/conversation-agent-loop.test.ts

@@ -2409,6 +2409,44 @@ describe("session-agent-loop", () => {
       expect(metadataPublishes).toHaveLength(1);
     });
 
+    test("terminal message_complete is emitted before the deferred indexer runs (LUM-2654)", async () => {
+      // Regression guard for LUM-2654 ("long delay between last streaming token
+      // and send-button becoming available"). The terminal `message_complete`
+      // SSE — which the client uses to flip stop→send — is emitted before the
+      // non-critical finalize side-effects (memory segment indexing, lexical
+      // indexing, attention projection), which the orchestrator drains from its
+      // end-of-turn tail. The tail runs within the turn, so the indexer still
+      // fires exactly once; this test pins the ordering by asserting
+      // `message_complete` is already in the client stream when it does.
+      mockMessageById = {
+        id: "msg-reserve",
+        conversationId: "test-conv",
+        createdAt: 1234567,
+        role: "assistant",
+        content: "[]",
+        metadata: null,
+      };
+
+      const events: ServerMessage[] = [];
+      let messageCompleteSeenWhenIndexed: boolean | undefined;
+      indexMessageNowMock.mockImplementationOnce(async () => {
+        messageCompleteSeenWhenIndexed = events.some(
+          (event) => event.type === "message_complete",
+        );
+        return { indexedSegments: 0, enqueuedJobs: 0 };
+      });
+
+      const ctx = makeCtx({
+        providerResponses: [textResponse("indexed reply")],
+      });
+      await runAgentLoopImpl(ctx, "hi", "msg-1", (msg) => events.push(msg));
+
+      // The deferred indexer runs exactly once, within the turn…
+      expect(indexMessageNowMock).toHaveBeenCalledTimes(1);
+      // …and only after the terminal SSE that re-enables the composer.
+      expect(messageCompleteSeenWhenIndexed).toBe(true);
+    });
+
     test("handleMessageComplete skips sync invalidation when attention state unchanged", async () => {
       // Mirror of the previous test but with the default projector return
       // (`false`). The projection still runs every turn, but the sync

package/src/__tests__/personal-memory-auth-bypass.test.ts

@@ -0,0 +1,62 @@
+/**
+ * Security regression test for the personal-memory trust gate under
+ * DISABLE_HTTP_AUTH.
+ *
+ * `isPersonalMemoryAllowed` derives trust from `resolveTrustClass`, which only
+ * elevates an *unresolved* actor to guardian under DISABLE_HTTP_AUTH (the
+ * standing config in platform-managed deployments). A resolved non-guardian
+ * channel actor must therefore be denied personal memory even with auth
+ * disabled — otherwise the guardian's memory leaks to Slack/phone contacts in
+ * the cloud. See LUM-2669. These cases fail on the pre-fix behavior.
+ *
+ * Uses process.env directly (not a module mock) since isHttpAuthDisabled()
+ * reads DISABLE_HTTP_AUTH live.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  isPersonalMemoryAllowed,
+  type TrustContext,
+} from "../daemon/trust-context.js";
+import type { TrustClass } from "../runtime/actor-trust-resolver.js";
+
+function slack(trustClass: TrustClass): TrustContext {
+  return { sourceChannel: "slack", trustClass };
+}
+
+let prior: string | undefined;
+
+beforeEach(() => {
+  // Platform-managed / dev-bypass posture: the flag is on process-wide.
+  prior = process.env.DISABLE_HTTP_AUTH;
+  process.env.DISABLE_HTTP_AUTH = "true";
+});
+
+afterEach(() => {
+  if (prior === undefined) {
+    delete process.env.DISABLE_HTTP_AUTH;
+  } else {
+    process.env.DISABLE_HTTP_AUTH = prior;
+  }
+});
+
+describe("isPersonalMemoryAllowed — no exposure to non-guardian channel actors under DISABLE_HTTP_AUTH", () => {
+  test("blocks personal memory for a non-guardian Slack actor even with auth disabled", () => {
+    expect(isPersonalMemoryAllowed(slack("trusted_contact"))).toBe(false);
+    expect(isPersonalMemoryAllowed(slack("unknown"))).toBe(false);
+    expect(isPersonalMemoryAllowed(slack("unverified_contact"))).toBe(false);
+  });
+
+  test("allows personal memory for the guardian and for local / internal turns", () => {
+    expect(isPersonalMemoryAllowed(slack("guardian"))).toBe(true);
+    // Local/native turn — no resolved actor.
+    expect(isPersonalMemoryAllowed(undefined)).toBe(true);
+    // Internal vellum-channel flow.
+    expect(
+      isPersonalMemoryAllowed({
+        sourceChannel: "vellum",
+        trustClass: "unknown",
+      }),
+    ).toBe(true);
+  });
+});