@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/cli/commands/inference-providers.ts

@@ -18,9 +18,8 @@ import type { Command } from "commander";
 
 import { cliIpcCall } from "../../ipc/cli-client.js";
 import type { OAuth2Config } from "../../security/oauth2.js";
-import { startOAuth2Flow } from "../../security/oauth2.js";
-import { setSecureKeyAsync } from "../../security/secure-keys.js";
-import { log } from "../logger.js";
+import { writeCliError } from "../lib/cli-output.js";
+import { attachDefaultProviderSubcommand } from "./inference-providers-default.js";
 
 // ---------------------------------------------------------------------------
 // Response types
@@ -86,7 +85,9 @@ function attachListSubcommand(connections: Command): void {
       const rows = ipcResult.result!.connections;
 
       if (opts.json) {
-        process.stdout.write(JSON.stringify({ ok: true, connections: rows }) + "\n");
+        process.stdout.write(
+          JSON.stringify({ ok: true, connections: rows }) + "\n",
+        );
         return;
       }
 
@@ -128,7 +129,9 @@ function attachGetSubcommand(connections: Command): void {
       const conn = ipcResult.result!;
 
       if (opts.json) {
-        process.stdout.write(JSON.stringify({ ok: true, connection: conn }) + "\n");
+        process.stdout.write(
+          JSON.stringify({ ok: true, connection: conn }) + "\n",
+        );
         return;
       }
 
@@ -157,31 +160,55 @@ function buildAuthInput(
   credential?: string,
 ): Record<string, unknown> | string {
   if (authType === "api_key") {
-    if (!credential) return "--credential is required when --auth api_key";
+    if (!credential) {
+      return "--credential is required when --auth api_key";
+    }
     return { type: "api_key", credential };
   }
   if (authType === "platform") {
-    if (credential) return "--credential is not accepted with --auth platform";
+    if (credential) {
+      return "--credential is not accepted with --auth platform";
+    }
     return { type: "platform" };
   }
   if (authType === "none") {
-    if (credential) return "--credential is not accepted with --auth none";
+    if (credential) {
+      return "--credential is not accepted with --auth none";
+    }
     return { type: "none" };
   }
   if (authType === "oauth_subscription") {
-    if (!credential) return "--credential is required when --auth oauth_subscription";
+    if (!credential) {
+      return "--credential is required when --auth oauth_subscription";
+    }
     return { type: "oauth_subscription", credential };
   }
   return `Unknown auth type "${authType}". Use: api_key, platform, none, oauth_subscription`;
 }
 
-function writeCliError(msg: string, json?: boolean): void {
-  if (json) {
-    process.stdout.write(JSON.stringify({ ok: false, error: msg }) + "\n");
-  } else {
-    log.error(msg);
+/** Commander collector for a repeatable option (e.g. `--model` multiple times). */
+function collectRepeatable(value: string, previous: string[]): string[] {
+  return [...previous, value];
+}
+
+/**
+ * Build the openai-compatible custom-provider fields (`base_url`, `models`)
+ * from CLI flags, forwarded to the connection route under its exact field
+ * names. The daemon stays authoritative on whether they are required/allowed;
+ * the CLI only shape-forwards what the user passed.
+ */
+function buildCustomProviderFields(opts: {
+  baseUrl?: string;
+  model?: string[];
+}): Record<string, unknown> {
+  const fields: Record<string, unknown> = {};
+  if (opts.baseUrl !== undefined) {
+    fields.base_url = opts.baseUrl;
+  }
+  if (opts.model !== undefined && opts.model.length > 0) {
+    fields.models = opts.model.map((id) => ({ id }));
   }
-  process.exitCode = 1;
+  return fields;
 }
 
 // ---------------------------------------------------------------------------
@@ -192,14 +219,37 @@ function attachCreateSubcommand(connections: Command): void {
   connections
     .command("create <name>")
     .description("Create a new provider connection")
-    .requiredOption("--provider <p>", "Provider (anthropic|openai|gemini|ollama|...)")
+    .requiredOption(
+      "--provider <p>",
+      "Provider (anthropic|openai|gemini|ollama|...)",
+    )
     .requiredOption("--auth <type>", "Auth type: api_key|platform|none")
-    .option("--credential <vault-key>", "Vault credential name (required for --auth api_key)")
+    .option(
+      "--credential <vault-key>",
+      "Vault credential name (required for --auth api_key)",
+    )
+    .option(
+      "--base-url <url>",
+      "Endpoint base URL (required for --provider openai-compatible)",
+    )
+    .option(
+      "--model <id>",
+      "Model id offered by this connection (repeatable; required for openai-compatible)",
+      collectRepeatable,
+      [] as string[],
+    )
     .option("--json", "Output as JSON")
     .action(
       async (
         name: string,
-        opts: { provider: string; auth: string; credential?: string; json?: boolean },
+        opts: {
+          provider: string;
+          auth: string;
+          credential?: string;
+          baseUrl?: string;
+          model?: string[];
+          json?: boolean;
+        },
       ) => {
         const authInput = buildAuthInput(opts.auth, opts.credential);
         if (typeof authInput === "string") {
@@ -207,6 +257,14 @@ function attachCreateSubcommand(connections: Command): void {
           return;
         }
 
+        if (opts.provider === "openai-compatible" && !opts.baseUrl) {
+          writeCliError(
+            "--base-url is required when --provider openai-compatible",
+            opts.json,
+          );
+          return;
+        }
+
         const ipcResult = await cliIpcCall<ProviderConnection>(
           "inference_provider_connections_create",
           {
@@ -214,6 +272,7 @@ function attachCreateSubcommand(connections: Command): void {
               name,
               provider: opts.provider,
               auth: authInput,
+              ...buildCustomProviderFields(opts),
             },
           },
         );
@@ -231,7 +290,8 @@ function attachCreateSubcommand(connections: Command): void {
           );
         } else {
           process.stdout.write(
-            `Created connection "${conn.name}" (provider=${conn.provider}, auth=${formatAuth(conn.auth)})\n`,
+            `Created connection "${conn.name}" (provider=${conn.provider}, auth=${formatAuth(conn.auth)})\n` +
+              `Verify it works: point a profile's provider_connection at "${conn.name}", then run: assistant inference send --profile <profile> "Reply with OK"\n`,
           );
         }
       },
@@ -247,12 +307,31 @@ function attachUpdateSubcommand(connections: Command): void {
     .command("update <name>")
     .description("Update a connection's auth")
     .requiredOption("--auth <type>", "Auth type: api_key|platform|none")
-    .option("--credential <vault-key>", "Vault credential name (required for --auth api_key)")
+    .option(
+      "--credential <vault-key>",
+      "Vault credential name (required for --auth api_key)",
+    )
+    .option(
+      "--base-url <url>",
+      "Endpoint base URL (openai-compatible connections)",
+    )
+    .option(
+      "--model <id>",
+      "Model id offered by this connection (repeatable; openai-compatible)",
+      collectRepeatable,
+      [] as string[],
+    )
     .option("--json", "Output as JSON")
     .action(
       async (
         name: string,
-        opts: { auth: string; credential?: string; json?: boolean },
+        opts: {
+          auth: string;
+          credential?: string;
+          baseUrl?: string;
+          model?: string[];
+          json?: boolean;
+        },
       ) => {
         const authInput = buildAuthInput(opts.auth, opts.credential);
         if (typeof authInput === "string") {
@@ -264,7 +343,7 @@ function attachUpdateSubcommand(connections: Command): void {
           "inference_provider_connections_update",
           {
             pathParams: { name },
-            body: { auth: authInput },
+            body: { auth: authInput, ...buildCustomProviderFields(opts) },
           },
         );
 
@@ -281,7 +360,8 @@ function attachUpdateSubcommand(connections: Command): void {
           );
         } else {
           process.stdout.write(
-            `Updated connection "${name}" auth to ${formatAuth(conn.auth)}\n`,
+            `Updated connection "${name}" auth to ${formatAuth(conn.auth)}\n` +
+              `Verify it works: assistant inference send --profile <profile-using-this-connection> "Reply with OK"\n`,
           );
         }
       },
@@ -342,6 +422,11 @@ function attachLoginChatgptSubcommand(providers: Command): void {
     .option("--json", "Output as JSON")
     .action(async (opts: { json?: boolean }) => {
       try {
+        // Deferred: loads the OAuth and secure-key graphs on demand.
+        const [{ startOAuth2Flow }, { setSecureKeyAsync }] = await Promise.all([
+          import("../../security/oauth2.js"),
+          import("../../security/secure-keys.js"),
+        ]);
         // Step 1: Run browser-based PKCE OAuth flow
         process.stdout.write("Opening browser for ChatGPT authentication...\n");
         const result = await startOAuth2Flow(
@@ -476,8 +561,15 @@ Examples:
   $ assistant inference providers connections get anthropic-managed
   $ assistant inference providers connections create anthropic-personal \\
       --provider anthropic --auth api_key --credential credential/anthropic/api_key
+  $ assistant inference providers connections create local-llm \\
+      --provider openai-compatible --auth none \\
+      --base-url http://localhost:1234/v1 --model my-model
   $ assistant inference providers connections update anthropic-personal --auth platform
-  $ assistant inference providers connections delete anthropic-personal`,
+  $ assistant inference providers connections delete anthropic-personal
+
+After creating or updating a connection, validate it with a live call through
+a profile that uses it:
+  $ assistant inference send --profile <profile> "Reply with OK"`,
   );
 
   attachListSubcommand(connections);
@@ -487,4 +579,5 @@ Examples:
   attachDeleteSubcommand(connections);
 
   attachLoginChatgptSubcommand(providers);
+  attachDefaultProviderSubcommand(providers);
 }

package/src/cli/commands/inference.ts

@@ -15,6 +15,9 @@ import { cliIpcCall } from "../../ipc/cli-client.js";
 import { readStdinSync } from "../../util/read-stdin.js";
 import { registerCommand } from "../lib/register-command.js";
 import { log } from "../logger.js";
+import { attachCallsitesSubcommand } from "./inference-callsites.js";
+import { attachModelsSubcommand } from "./inference-models.js";
+import { attachProfilesSubcommand } from "./inference-profiles.js";
 import { attachProvidersSubcommand } from "./inference-providers.js";
 import { attachSessionSubcommand } from "./inference-session.js";
 
@@ -248,6 +251,9 @@ Examples:
       attachSendSubcommand(inference);
       attachSessionSubcommand(inference);
       attachProvidersSubcommand(inference);
+      attachModelsSubcommand(inference);
+      attachProfilesSubcommand(inference);
+      attachCallsitesSubcommand(inference);
     },
   });
 

package/src/cli/commands/keys.ts

@@ -1,33 +1,24 @@
+import { createRequire } from "node:module";
+
 import type { Command } from "commander";
 
-import { API_KEY_PROVIDERS } from "../../providers/provider-secret-catalog.js";
-import { credentialKey } from "../../security/credential-key.js";
-import { getSecureKeyAsync } from "../../security/secure-keys.js";
-import {
-  deleteSecureKeyViaDaemon,
-  setSecureKeyViaDaemon,
-} from "../lib/daemon-credential-client.js";
 import { registerCommand } from "../lib/register-command.js";
 import { log } from "../logger.js";
 
-// ---------------------------------------------------------------------------
-// CES shell lockdown guard
-// ---------------------------------------------------------------------------
+const loadModule = createRequire(import.meta.url);
 
 /**
- * Returns true when the current process is running inside an untrusted shell
- * (CES shell lockdown active). CLI commands that store or delete API keys
- * must check this and fail deterministically.
+ * Loaded lazily because the provider catalog pulls the full model/TTS/STT
+ * graphs. Sync require rather than import(): commander invokes help-text
+ * callbacks synchronously, so there is no place to await a module load.
  */
-function isUntrustedShell(): boolean {
-  return process.env.VELLUM_UNTRUSTED_SHELL === "1";
+function apiKeyProviders(): readonly string[] {
+  const { API_KEY_PROVIDERS } = loadModule(
+    "../../providers/provider-secret-catalog.js",
+  ) as typeof import("../../providers/provider-secret-catalog.js");
+  return API_KEY_PROVIDERS;
 }
 
-/** Error message for commands blocked by CES shell lockdown. */
-const UNTRUSTED_SHELL_ERROR =
-  "This command is not available in untrusted shell mode. " +
-  "API key management is restricted when running under CES shell lockdown.";
-
 export function registerKeysCommand(program: Command): void {
   registerCommand(program, {
     name: "keys",
@@ -36,11 +27,11 @@ export function registerKeysCommand(program: Command): void {
     build: (keys) => {
       keys.addHelpText(
         "after",
-        `
+        () => `
 Keys are stored in secure local storage and are never written to disk in
 plaintext. Each key is identified by provider name.
 
-Known providers: ${API_KEY_PROVIDERS.join(", ")}
+Known providers: ${apiKeyProviders().join(", ")}
 
 Examples:
   $ assistant keys list
@@ -53,8 +44,8 @@ Examples:
         .description("List all stored API key names")
         .addHelpText(
           "after",
-          `
-Checks each known provider (${API_KEY_PROVIDERS.join(", ")}) and prints the
+          () => `
+Checks each known provider (${apiKeyProviders().join(", ")}) and prints the
 names of providers that have a stored key. Providers without a stored key are
 omitted from the output.
 
@@ -62,12 +53,18 @@ Examples:
   $ assistant keys list`,
         )
         .action(async () => {
+          const [{ credentialKey }, { getSecureKeyAsync }] = await Promise.all([
+            import("../../security/credential-key.js"),
+            import("../../security/secure-keys.js"),
+          ]);
           const stored: string[] = [];
-          for (const provider of API_KEY_PROVIDERS) {
+          for (const provider of apiKeyProviders()) {
             const value =
               (await getSecureKeyAsync(credentialKey(provider, "api_key"))) ??
               (await getSecureKeyAsync(provider));
-            if (value) stored.push(provider);
+            if (value) {
+              stored.push(provider);
+            }
           }
           if (stored.length === 0) {
             log.info("No API keys stored");
@@ -98,12 +95,8 @@ Examples:
   $ assistant keys set fireworks fw-abc123`,
         )
         .action(async (provider: string, key: string) => {
-          // CES shell lockdown: deny key storage in untrusted shells.
-          if (isUntrustedShell()) {
-            log.error(UNTRUSTED_SHELL_ERROR);
-            process.exit(1);
-          }
-
+          const { setSecureKeyViaDaemon } =
+            await import("../lib/daemon-credential-client.js");
           const setResult = await setSecureKeyViaDaemon(
             "api_key",
             provider,
@@ -135,12 +128,8 @@ Examples:
   $ assistant keys delete anthropic`,
         )
         .action(async (provider: string) => {
-          // CES shell lockdown: deny key deletion in untrusted shells.
-          if (isUntrustedShell()) {
-            log.error(UNTRUSTED_SHELL_ERROR);
-            process.exit(1);
-          }
-
+          const { deleteSecureKeyViaDaemon } =
+            await import("../lib/daemon-credential-client.js");
           const delResult = await deleteSecureKeyViaDaemon("api_key", provider);
           if (delResult.result === "deleted") {
             log.info(`Deleted API key for "${provider}"`);

package/src/cli/commands/memory/index.ts

@@ -5,6 +5,7 @@ import { registerMemoryItemsCommand } from "./items.js";
 import { registerMemoryRetrospectiveCommand } from "./memory-retrospective.js";
 import { registerMemoryV2Command } from "./memory-v2.js";
 import { registerMemoryV3Command } from "./memory-v3.js";
+import { registerMemoryNodesCommand } from "./nodes.js";
 import { registerMemoryWorkerCommand } from "./worker.js";
 
 export function registerMemoryCommand(program: Command): void {
@@ -17,6 +18,9 @@ export function registerMemoryCommand(program: Command): void {
       memory.addHelpText(
         "after",
         `
+The 'nodes' subgroup provides content-based list, delete, and update over
+memory v2 graph nodes — address facts by text, not UUID (requires memory v2).
+
 The 'items' subgroup exposes full CRUD over individual memory items
 (remembered facts) — list, get, create, update, delete.
 
@@ -26,6 +30,9 @@ model (section-grain lanes cached as live shadow state). Each subgroup exposes
 operator-facing maintenance verbs — reindexing, backfills, validation, and evals.
 
 Examples:
+  $ assistant memory nodes list --search "coffee"
+  $ assistant memory nodes delete "User prefers TypeScript"
+  $ assistant memory nodes update "User prefers TypeScript" "User prefers TypeScript and Bun"
   $ assistant memory items list --search "coffee"
   $ assistant memory items update 9f2c4f3a-3f1a-41e4-88e7-abc123 --statement "Prefers tea"
   $ assistant memory items delete 9f2c4f3a-3f1a-41e4-88e7-abc123
@@ -33,6 +40,7 @@ Examples:
   $ assistant memory v3 rebuild-index`,
       );
 
+      registerMemoryNodesCommand(memory);
       registerMemoryItemsCommand(memory);
       registerMemoryV2Command(memory);
       registerMemoryV3Command(memory);

package/src/cli/commands/memory/memory-retrospective.ts

@@ -13,11 +13,7 @@
 
 import type { Command } from "commander";
 
-import { getConfig } from "../../../config/loader.js";
-import {
-  type MemoryRetrospectiveOutcome,
-  runForkBasedRetrospective,
-} from "../../../plugins/defaults/memory/memory-retrospective-job.js";
+import type { MemoryRetrospectiveOutcome } from "../../../plugins/defaults/memory/memory-retrospective-job.js";
 import { registerCommand } from "../../lib/register-command.js";
 import { log } from "../../logger.js";
 import { shouldOutputJson, writeOutput } from "../../output.js";
@@ -63,6 +59,12 @@ Examples:
             opts: { json?: boolean },
             cmd: Command,
           ) => {
+            // Deferred: loads the config loader and retrospective job graph.
+            const [{ getConfig }, { runForkBasedRetrospective }] =
+              await Promise.all([
+                import("../../../config/loader.js"),
+                import("../../../plugins/defaults/memory/memory-retrospective-job.js"),
+              ]);
             const config = getConfig();
             let outcome: MemoryRetrospectiveOutcome;
             try {

package/src/cli/commands/memory/memory-v2-compare-render.ts

@@ -5,8 +5,8 @@
  *
  * Lives CLI-side because formatting for the terminal is a presentation concern
  * (mirroring the inline rendering in the `simulate` subcommand). It imports
- * only the response *type* from the daemon — `cli/no-daemon-internals` permits
- * type-only imports but forbids pulling in daemon runtime modules.
+ * only the response *type* from the daemon (erased at runtime), never a daemon
+ * runtime module.
  */
 
 import type { ComparisonReport } from "../../../plugins/defaults/memory/v2/harness/runner.js";