@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/eslint-rules/cli-no-daemon-internals.js

@@ -1,304 +1,126 @@
-// Import prefixes allowed for each transport class. Entries cover both
-// depth-1 (e.g. `commands/foo.ts`) and depth-2 (e.g. `commands/oauth/bar.ts`)
-// relative paths so nested command directories don't false-positive.
-//
-// Adding a new entry: prefer the narrowest match that captures the legitimate
-// case. Daemon-internal modules (`runtime/`, `services/`, `agents/`, `llm/`,
-// `skills/`, etc.) MUST remain off the allowlist for `ipc`-tagged commands.
-const ALLOWED_PREFIXES = {
-  ipc: [
-    "node:",
-    "bun:",
-    "commander",
-    // Sibling subcommand composition (e.g. oauth/index.ts -> ./connect.js).
-    // The imported file is itself a command and the rule will check its
-    // imports independently, so this can't be used to smuggle daemon
-    // internals through a sibling re-export.
-    "./",
-    // IPC client at depth-1 and depth-2.
-    "../../ipc/cli-client",
-    "../../../ipc/cli-client",
-    // Status command's daemon-down fallback needs socket path + platform.
-    "../../ipc/socket-path",
-    "../../util/platform",
-    // App version constant (leaf module; reads package.json/env, no daemon
-    // deps) — status prints it to surface CLI-vs-runtime version drift.
-    "../../version",
-    "../../../version",
-    // Robust stdin reader (leaf module; only node:fs, no daemon deps) —
-    // commands that accept piped payloads read fd 0 through it at depth-1
-    // and depth-2.
-    "../../util/read-stdin",
-    "../../../util/read-stdin",
-    // Logger / output at depth-1 and depth-2.
-    "../logger",
-    "../output",
-    "../../logger",
-    "../../output",
-    // Shared CLI lib / utils at depth-1 and depth-2.
-    "../lib/",
-    "../../lib/",
-    "../utils/",
-    "../../utils/",
-    // Environment access for commands that need to read VELLUM_* env vars
-    // before issuing IPC calls (e.g. email, domain).
-    "../../config/env",
-    // Browser command's operation metadata (drives subcommand generation).
-    "../../browser/operations",
-  ],
-  local: [
-    "node:",
-    "bun:",
-    "commander",
-    "zod",
-    // Sibling helpers + cross-namespace helper for config.ts managed-mode
-    // check (see commands/oauth/shared.ts docstring).
-    "./",
-    // Config schema/loader at depth-1 and depth-2.
-    "../../config/loader",
-    "../../../config/loader",
-    "../../config/schema",
-    "../../config/env",
-    "../../util/platform",
-    "../../../util/platform",
-    // Memory retrospective — the retrospective CLI runs the fork-based
-    // retrospective in-process (no daemon, no IPC), so it imports the
-    // job handler directly from the default-memory plugin. Depth-2 for
-    // commands/memory/ nesting.
-    "../../plugins/defaults/memory/memory-retrospective-job",
-    "../../../plugins/defaults/memory/memory-retrospective-job",
-    // Standalone tool execution — `tools run` executes a single tool
-    // in-process from the filesystem (no daemon, no IPC), so it imports the
-    // standalone runner directly. Depth-2 for commands/ nesting.
-    "../../tools/run-standalone",
-    "../../../tools/run-standalone",
-    "../logger",
-    "../output",
-    "../../logger",
-    "../../output",
-    "../lib/",
-    "../../lib/",
-    "../utils/",
-    "../../utils/",
-    // Secure key storage (keys.ts) needs direct security module access —
-    // by design, the secure-key helpers run in-process (not over IPC).
-    "../../security/",
-    // Canonical API-key provider list (keys.ts help text + validation) —
-    // a static metadata catalog with no daemon state.
-    "../../providers/provider-secret-catalog",
-    // CES bridge (credential-execution.ts) speaks to the CES sidecar via
-    // service-contracts RPC; daemon is not involved.
-    "../../credential-execution/",
-    "@vellumai/service-contracts",
-  ],
-  bootstrap: [
-    "node:",
-    "bun:",
-    "commander",
-    "./",
-    "../../config/loader",
-    "../../config/schema",
-    "../../config/env",
-    "../../util/platform",
-    "../logger",
-    "../output",
-    "../../logger",
-    "../../output",
-    "../lib/",
-    "../../lib/",
-    "../utils/",
-    "../../utils/",
-  ],
-};
+import path from "node:path";
 
 /**
- * Walks the program AST looking for a `registerCommand({ transport: ... })`
- * call. Returns:
- *   - the transport string when registerCommand is called with a string
- *     transport prop ("ipc" / "local" / "bootstrap")
- *   - "MISSING_TRANSPORT" when registerCommand is called but no string
- *     transport prop is present
- *   - null when no registerCommand call is found at all (helper module —
- *     not a command entry, no checks apply)
+ * `cli/no-daemon-internals`
+ *
+ * Forbids CLI command files from *hoisting* (statically importing at module
+ * top level) any module that lives outside the CLI's own tree or the shared
+ * leaf zones. Top-level imports load on every `assistant …` invocation, so
+ * pulling a daemon subsystem into the static graph inflates the memory
+ * footprint of every command — including the bash-tool fast path that only
+ * meant to run one small verb.
+ *
+ * The rule is purely structural — no per-module allowlist. Hoisted imports may
+ * resolve only to:
+ *   - non-relative specifiers (Node/npm/`bun:`/scoped packages), or
+ *   - the CLI's own tree (`src/cli/**`), or
+ *   - the shared non-daemon leaf zones below (`util/`, `ipc/`, `types/`,
+ *     `version`), which carry no daemon runtime graph.
+ *
+ * Everything else under `src/` is daemon-internal and must be reached with a
+ * dynamic `import()` inside the action, so it loads only when the command
+ * actually runs. Type-only imports are always fine — they are erased at
+ * compile time and cost nothing at runtime. Dynamic `import()` expressions are
+ * not `ImportDeclaration`s, so they are never flagged.
  */
-function findTransport(program) {
-  const worklist = [...program.body];
-  const seen = new WeakSet();
-  let registerCommandCalled = false;
 
-  while (worklist.length > 0) {
-    const node = worklist.pop();
+// Top-level `src/` directories that hold no daemon runtime graph and may be
+// hoisted into the CLI's static import graph. These are whole non-daemon
+// categories, not carve-outs for individual daemon modules: the CLI itself,
+// shared leaf utilities, the IPC transport (client + socket path), and type
+// declarations.
+const SAFE_DIRS = new Set(["cli", "util", "ipc", "types"]);
+// Individual leaf files directly under `src/` that may be hoisted (e.g. the
+// app version constant `src/version.ts`).
+const SAFE_ROOT_FILES = new Set(["version"]);
 
-    if (!node || typeof node !== "object" || seen.has(node)) {
-      continue;
-    }
-    seen.add(node);
+/**
+ * Given the importing file and an import specifier, decide whether hoisting it
+ * is allowed. Returns true (allowed) for anything that is not a
+ * daemon-internal module.
+ */
+function isHoistAllowed(filename, specifier) {
+  // Non-relative specifiers are packages (Node/npm/bun/scoped) — always fine.
+  if (!specifier.startsWith(".")) {
+    return true;
+  }
 
-    if (
-      node.type === "CallExpression" &&
-      node.callee.type === "Identifier" &&
-      node.callee.name === "registerCommand"
-    ) {
-      registerCommandCalled = true;
-      for (const arg of node.arguments) {
-        if (arg.type === "ObjectExpression") {
-          for (const prop of arg.properties) {
-            if (
-              prop.type === "Property" &&
-              prop.key.type === "Identifier" &&
-              prop.key.name === "transport" &&
-              prop.value.type === "Literal" &&
-              typeof prop.value.value === "string"
-            ) {
-              return prop.value.value;
-            }
-          }
-        }
-      }
-    }
+  // Locate the `.../src/cli/` prefix of the importing file to anchor `src/`.
+  const marker = `${path.sep}src${path.sep}cli${path.sep}`;
+  const markerIdx = filename.indexOf(marker);
+  if (markerIdx === -1) {
+    // Not a file under src/cli — the rule's file glob shouldn't match it, so
+    // be conservative and don't flag.
+    return true;
+  }
+  const srcRoot = filename.slice(0, markerIdx) + `${path.sep}src`;
 
-    switch (node.type) {
-      case "ExpressionStatement":
-        worklist.push(node.expression);
-        break;
-      case "CallExpression":
-        // Enqueue both arguments AND the callee so chained patterns like
-        // `registerCommand(...).command(...).description(...)` are walked.
-        // The outer call's callee is a MemberExpression whose object is the
-        // inner CallExpression; without traversing the callee we'd never
-        // reach the inner `registerCommand` invocation and findTransport()
-        // would return null, silently skipping all checks.
-        worklist.push(node.callee);
-        for (const arg of node.arguments) {
-          worklist.push(arg);
-        }
-        break;
-      case "MemberExpression":
-        // Reach through `.foo` chains so we can walk into the receiver.
-        worklist.push(node.object);
-        break;
-      case "FunctionDeclaration":
-      case "FunctionExpression":
-      case "ArrowFunctionExpression":
-        if (node.body) worklist.push(node.body);
-        break;
-      case "BlockStatement":
-        for (const stmt of node.body) {
-          worklist.push(stmt);
-        }
-        break;
-      case "ReturnStatement":
-        if (node.argument) worklist.push(node.argument);
-        break;
-      case "ExportNamedDeclaration":
-      case "ExportDefaultDeclaration":
-        if (node.declaration) worklist.push(node.declaration);
-        break;
-      case "VariableDeclaration":
-        for (const decl of node.declarations) {
-          if (decl.init) worklist.push(decl.init);
-        }
-        break;
-      case "ObjectExpression":
-        for (const prop of node.properties) {
-          if (prop.type === "Property") {
-            worklist.push(prop.value);
-          }
-        }
-        break;
-      default:
-        break;
-    }
+  const resolved = path.resolve(path.dirname(filename), specifier);
+  const relFromSrc = path.relative(srcRoot, resolved);
+
+  // Resolves outside `src/` entirely (unusual for a relative import) — leave
+  // it alone; it isn't a daemon-internal module.
+  if (relFromSrc.startsWith("..")) {
+    return true;
+  }
+
+  const segments = relFromSrc.split(path.sep);
+  const firstSegment = segments[0];
+
+  // A leaf file directly under src/ (e.g. `version.js`).
+  if (segments.length === 1) {
+    return SAFE_ROOT_FILES.has(firstSegment.replace(/\.[jt]s$/, ""));
   }
 
-  return registerCommandCalled ? "MISSING_TRANSPORT" : null;
+  return SAFE_DIRS.has(firstSegment);
 }
 
 const rule = {
   meta: {
-    type: "suggestion",
+    type: "problem",
     docs: {
       description:
-        "Enforce import allowlists for CLI commands by transport class",
+        "Forbid CLI command files from hoisting daemon-internal imports (lazy-import them inside the action instead)",
     },
     messages: {
-      missingTransport:
-        "CLI command file must call registerCommand({ transport: ... }) to declare its transport class.",
-      forbiddenImport:
-        "'{{transport}}'-tagged CLI command imports forbidden module '{{source}}'. See src/cli/AGENTS.md for allowed imports.",
+      hoistedDaemonImport:
+        "CLI command hoists daemon-internal module '{{source}}'. Import it lazily inside the action (`await import(...)`) so it stays out of the CLI's static graph. See src/cli/AGENTS.md.",
     },
     schema: [],
   },
 
   create(context) {
-    const importNodes = [];
+    const filename = context.filename ?? context.getFilename();
 
     return {
       ImportDeclaration(node) {
-        importNodes.push(node);
-      },
-
-      "Program:exit"(program) {
-        if (importNodes.length === 0) {
+        // `import type { … } from "…"` — erased at compile time. Skip.
+        if (node.importKind === "type") {
           return;
         }
-
-        const transport = findTransport(program);
-
-        // Helper modules (no registerCommand call) are not command entries —
-        // skip them. Command files that call registerCommand without a string
-        // transport prop still trip missingTransport.
-        if (transport === null) {
+        // Inline-type form `import { type A, type B } from "…"`: when *every*
+        // named specifier is type-only the whole import is erased. Skip those.
+        // Side-effect-only imports (`import "x"`) have no specifiers and run at
+        // load time — do not skip those.
+        if (
+          node.specifiers.length > 0 &&
+          node.specifiers.every(
+            (s) => s.type === "ImportSpecifier" && s.importKind === "type",
+          )
+        ) {
           return;
         }
 
-        if (transport === "MISSING_TRANSPORT") {
-          context.report({
-            node: program,
-            messageId: "missingTransport",
-          });
+        const source = node.source.value;
+        if (typeof source !== "string") {
           return;
         }
-
-        const allowedPrefixes = ALLOWED_PREFIXES[transport];
-        if (!allowedPrefixes) {
-          return;
-        }
-
-        for (const importNode of importNodes) {
-          // `import type {...}` is erased at compile time — top-level type
-          // import kind is set to "type" on the declaration. Skip.
-          if (importNode.importKind === "type") {
-            continue;
-          }
-          // Inline-type form `import { type X, type Y } from "..."` keeps
-          // the declaration `importKind === "value"` while marking each
-          // ImportSpecifier with `importKind === "type"`. When *every*
-          // specifier is type-only the entire import is erased. Skip those
-          // too. Side-effect-only imports (`import "x"`) have an empty
-          // specifiers list and run at module load — must NOT skip.
-          if (
-            importNode.specifiers.length > 0 &&
-            importNode.specifiers.every(
-              (s) => s.type === "ImportSpecifier" && s.importKind === "type",
-            )
-          ) {
-            continue;
-          }
-          const source = importNode.source.value;
-          const allowed = allowedPrefixes.some((prefix) =>
-            source.startsWith(prefix),
-          );
-          if (!allowed) {
-            context.report({
-              node: importNode,
-              messageId: "forbiddenImport",
-              data: {
-                transport,
-                source,
-              },
-            });
-          }
+        if (!isHoistAllowed(filename, source)) {
+          context.report({
+            node,
+            messageId: "hoistedDaemonImport",
+            data: { source },
+          });
         }
       },
     };

package/eslint.config.mjs

@@ -49,10 +49,10 @@ const eslintConfig = defineConfig([
       "@typescript-eslint/no-explicit-any": "off",
     },
   },
-  // `cli/no-daemon-internals` enforces the CLI ↔ daemon import boundary
-  // that the CLI → IPC refactor is built on. Keep at `"error"`: a soft
-  // rule here would let daemon-internal imports re-enter the CLI bundle,
-  // which is the regression class this rule exists to prevent.
+  // `cli/no-daemon-internals` keeps daemon-internal modules out of the CLI's
+  // static import graph, so `assistant …` invocations (including the bash-tool
+  // fast path) don't pay the memory cost of loading daemon subsystems. Keep at
+  // `"error"`: a soft rule would let hoisted daemon imports creep back in.
   {
     files: ["src/cli/commands/**/*.ts"],
     ignores: ["src/cli/commands/**/__tests__/**"],

package/knip.json

@@ -5,7 +5,8 @@
     "scripts/**/*.ts",
     "src/daemon/main.ts!",
     "src/plugin-api/index.ts!",
-    "src/api/index.ts!"
+    "src/api/index.ts!",
+    "src/config/bundled-skills/**/tools/**/*.ts!"
   ],
   "project": ["src/**/*.ts!", "src/**/*.tsx!", "scripts/**/*.ts"],
   "ignore": ["src/config/preloaded-apps/**"],

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/package.json

@@ -13,9 +13,8 @@
     "./twilio-ingress": "./src/twilio-ingress.ts",
     "./trust-rules": "./src/trust-rules.ts",
     "./handles": "./src/handles.ts",
-    "./grants": "./src/grants.ts",
     "./rpc": "./src/rpc.ts",
-    "./rendering": "./src/rendering.ts",
+    "./attachment-naming": "./src/attachment-naming.ts",
     "./error": "./src/error.ts"
   },
   "scripts": {

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/attachment-naming.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  inferMimeType,
+  resolveAttachmentFilename,
+} from "../attachment-naming.js";
+
+describe("inferMimeType", () => {
+  test("maps known extensions case-insensitively", () => {
+    expect(inferMimeType("shot.PNG")).toBe("image/png");
+    expect(inferMimeType("report.pdf")).toBe("application/pdf");
+  });
+
+  test("falls back to octet-stream for unknown or missing extensions", () => {
+    expect(inferMimeType("desktop")).toBe("application/octet-stream");
+    expect(inferMimeType("archive.xyz")).toBe("application/octet-stream");
+  });
+});
+
+describe("resolveAttachmentFilename", () => {
+  test("uses explicit filenames verbatim", () => {
+    expect(
+      resolveAttachmentFilename("custom.dat", "/tmp/shot.png", "explicit"),
+    ).toBe("custom.dat");
+  });
+
+  test("honors labels with recognized extensions", () => {
+    expect(
+      resolveAttachmentFilename("nice-name.png", "/tmp/shot.png", "label"),
+    ).toBe("nice-name.png");
+  });
+
+  test("keeps bare labels and appends the POSIX path extension", () => {
+    expect(resolveAttachmentFilename("desktop", "/tmp/shot.png", "label")).toBe(
+      "desktop.png",
+    );
+  });
+
+  test("keeps bare labels and appends the Windows path extension", () => {
+    expect(
+      resolveAttachmentFilename(
+        "desktop",
+        "C:\\Users\\user1\\Pictures\\shot.png",
+        "label",
+      ),
+    ).toBe("desktop.png");
+  });
+
+  test("bare labels to files sharing a basename resolve to unique names", () => {
+    expect(
+      resolveAttachmentFilename("first", "/workspace/a/result.png", "label"),
+    ).toBe("first.png");
+    expect(
+      resolveAttachmentFilename("second", "/workspace/b/result.png", "label"),
+    ).toBe("second.png");
+  });
+
+  test("does not duplicate an unknown extension the label already has", () => {
+    expect(
+      resolveAttachmentFilename(
+        "report.xlsx",
+        "/workspace/report.xlsx",
+        "label",
+      ),
+    ).toBe("report.xlsx");
+  });
+
+  test("matches the existing extension case-insensitively", () => {
+    expect(
+      resolveAttachmentFilename("data.YAML", "/workspace/data.yaml", "label"),
+    ).toBe("data.YAML");
+  });
+
+  test("still appends when the label ends differently", () => {
+    expect(
+      resolveAttachmentFilename(
+        "summary.v2",
+        "/workspace/data.parquet",
+        "label",
+      ),
+    ).toBe("summary.v2.parquet");
+  });
+
+  test("falls back to the basename when the path has no extension", () => {
+    expect(resolveAttachmentFilename("label", "/tmp/rawfile", "label")).toBe(
+      "rawfile",
+    );
+  });
+
+  test("uses the basename when no preferred name is given", () => {
+    expect(
+      resolveAttachmentFilename(undefined, "C:\\temp\\report.pdf", "label"),
+    ).toBe("report.pdf");
+    expect(resolveAttachmentFilename(undefined, "/tmp/report.pdf")).toBe(
+      "report.pdf",
+    );
+  });
+
+  test("ignores trailing separators", () => {
+    expect(resolveAttachmentFilename(undefined, "/tmp/dir/", "label")).toBe(
+      "dir",
+    );
+  });
+});

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/contracts.test.ts

@@ -27,9 +27,7 @@ describe("package independence", () => {
   const sourceFiles = [
     "../index.ts",
     "../handles.ts",
-    "../grants.ts",
     "../rpc.ts",
-    "../rendering.ts",
     "../transport.ts",
     "../credential-rpc.ts",
     "../trust-rules.ts",

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/attachment-naming.ts

@@ -0,0 +1,118 @@
+/**
+ * Attachment filename contract shared by the daemon (which materializes
+ * `vellum://` links and `<vellum-attachment>` directives into stored
+ * attachments) and the web client (which resolves clicked links back to
+ * those attachments). Both sides must agree on the stored filename, so the
+ * naming rule lives here once.
+ */
+
+const EXTENSION_MIME_MAP: Record<string, string> = {
+  // Images
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  ico: "image/x-icon",
+  bmp: "image/bmp",
+  heic: "image/heic",
+  heif: "image/heif",
+
+  // Documents
+  pdf: "application/pdf",
+  json: "application/json",
+  xml: "application/xml",
+  csv: "text/csv",
+  txt: "text/plain",
+  md: "text/markdown",
+  html: "text/html",
+  css: "text/css",
+  js: "text/javascript",
+  ts: "text/typescript",
+
+  // Audio
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  flac: "audio/flac",
+  aac: "audio/aac",
+  m4a: "audio/x-m4a",
+  opus: "audio/opus",
+
+  // Video
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  mpeg: "video/mpeg",
+
+  // Archives
+  zip: "application/zip",
+  gz: "application/gzip",
+  tar: "application/x-tar",
+};
+
+/**
+ * Infer a MIME type from a filename extension.
+ * Returns `application/octet-stream` when the extension is unrecognised.
+ */
+export function inferMimeType(filename: string): string {
+  const dot = filename.lastIndexOf(".");
+  if (dot === -1) {
+    return "application/octet-stream";
+  }
+  const ext = filename.slice(dot + 1).toLowerCase();
+  return EXTENSION_MIME_MAP[ext] ?? "application/octet-stream";
+}
+
+/**
+ * Pick the stored attachment filename for a materialized file directive.
+ *
+ * Explicit filenames (`<vellum-attachment filename="..." />` attributes)
+ * are an authoring contract and always used verbatim. Link display text
+ * (`[label](vellum://...)`) is cosmetic: it is only honored as the filename
+ * when it carries a recognized extension. A bare label
+ * (e.g. `[desktop](vellum://.../shot.png)`) would otherwise produce an
+ * extensionless download with an `application/octet-stream` MIME type,
+ * which macOS opens as raw text. In that case the label keeps the path's
+ * extension (`desktop.png`), staying unique per link even when several
+ * links share a basename; the raw basename is the last resort.
+ *
+ * The basename fallback splits on both `/` and `\\` so it handles POSIX
+ * sandbox paths, `vellum://` URL paths, and Windows host paths alike.
+ * Splitting on both separators regardless of the runtime platform also
+ * covers Windows host paths resolved by a non-Windows daemon, which
+ * platform-selected `node:path` semantics cannot.
+ */
+export function resolveAttachmentFilename(
+  preferred: string | undefined,
+  resolvedPath: string,
+  filenameSource: "explicit" | "label" = "explicit",
+): string {
+  const fallback =
+    resolvedPath.split(/[\\/]/).filter(Boolean).pop() ?? resolvedPath;
+  if (!preferred) {
+    return fallback;
+  }
+  if (filenameSource === "explicit") {
+    return preferred;
+  }
+  if (inferMimeType(preferred) !== "application/octet-stream") {
+    return preferred;
+  }
+  // Bare label: keep the label as a per-link disambiguator (two links to
+  // different files sharing a basename must not collide, because the
+  // transcript resolves clicks by filename) and append the path's
+  // extension so the stored name carries the correct type. Skip the
+  // append when the label already ends with that extension (a label like
+  // `report.xlsx` for `report.xlsx` must not become `report.xlsx.xlsx`).
+  const dot = fallback.lastIndexOf(".");
+  if (dot > 0 && dot < fallback.length - 1) {
+    const ext = fallback.slice(dot + 1);
+    if (preferred.toLowerCase().endsWith(`.${ext.toLowerCase()}`)) {
+      return preferred;
+    }
+    return `${preferred}.${ext}`;
+  }
+  return fallback;
+}