@vellumai/assistant 0.11.1-dev.202608031840.e66a55c → 0.11.1-dev.202608032034.aebd2da

package/eslint.config.mjs

@@ -49,14 +49,29 @@ const eslintConfig = defineConfig([
       "@typescript-eslint/no-explicit-any": "off",
     },
   },
-  // Managed-column profile resolution (`getEffectiveProfile(s)`) resolves
-  // default profiles against the vellum column only, ignoring
-  // `llm.defaultProvider`; on a BYO install that is not the body that
-  // dispatches. Runtime code must use `resolveDefaultProfileForProvider` /
-  // `getEffectiveProfilesForProvider` instead. The allowlist below is the
-  // full set of intentional managed-column consumers: the catalog itself,
-  // hatch-time seeding (writes managed stubs by design), and write-path
-  // validation.
+  // Two unrelated import bans share one `no-restricted-imports` entry on
+  // purpose: flat config replaces rule options rather than merging them, so a
+  // second block setting the same rule over overlapping files would silently
+  // drop the first one's patterns.
+  //
+  // 1. Managed-column profile resolution (`getEffectiveProfile(s)`) resolves
+  //    default profiles against the vellum column only, ignoring
+  //    `llm.defaultProvider`; on a BYO install that is not the body that
+  //    dispatches. Runtime code must use `resolveDefaultProfileForProvider` /
+  //    `getEffectiveProfilesForProvider` instead. The allowlist below is the
+  //    full set of intentional managed-column consumers: the catalog itself,
+  //    hatch-time seeding (writes managed stubs by design), and write-path
+  //    validation.
+  //
+  // 2. `cli/logger` is the plain-stdout writer for short-lived `assistant …`
+  //    invocations. It has no level filtering and no log-file routing, so a
+  //    daemon-side module reaching for it writes debug output straight to a
+  //    stdout the daemon may not own. Daemon code uses `getLogger()` from
+  //    `util/logger.js`. The pattern matches on the import specifier, so
+  //    CLI-internal files (which reach their logger relatively, as
+  //    `../logger.js`) are unaffected. The companion guard test
+  //    `src/__tests__/cli-logger-boundary-guard.test.ts` enforces the same
+  //    boundary by resolved path, independent of how a specifier is spelled.
   {
     files: ["src/**/*.ts"],
     ignores: [
@@ -77,6 +92,11 @@ const eslintConfig = defineConfig([
               message:
                 "Managed-column resolution ignores llm.defaultProvider. Use resolveDefaultProfileForProvider / getEffectiveProfilesForProvider with the parsed config's llm.defaultProvider ?? null.",
             },
+            {
+              group: ["**/cli/logger.js"],
+              message:
+                "cli/logger writes unfiltered plain text to stdout and is for src/cli/ only. Daemon and shared modules must use getLogger() from util/logger.js so output is level-filtered and routed to the log file. Within src/cli/, import the logger relatively (../logger.js).",
+            },
           ],
         },
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.1-dev.202608031840.e66a55c",
+  "version": "0.11.1-dev.202608032034.aebd2da",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/cli-logger-boundary-guard.test.ts

@@ -0,0 +1,87 @@
+import { readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { Glob } from "bun";
+
+/**
+ * Guard test for the CLI-logger boundary.
+ *
+ * `src/cli/logger.ts` is the plain-stdout writer for short-lived `assistant …`
+ * invocations. It has no level filtering and no log-file routing, so a
+ * daemon-side module that reaches for it writes debug output straight to a
+ * stdout the daemon may not own. When the daemon runs detached and its
+ * spawning parent has closed the read end of the stdout pipe, those writes
+ * fail with `EPIPE` and take the process down through the fatal-error handler.
+ *
+ * Daemon and shared modules use `getLogger()` from `util/logger.js`, which
+ * routes to the rotating log file and skips stdout entirely when stdout is not
+ * a TTY.
+ *
+ * `no-restricted-imports` in `eslint.config.mjs` bans this too, but matches on
+ * the import specifier. This guard resolves each relative import to a path, so
+ * it holds regardless of how the specifier is spelled.
+ */
+
+/** Tests run from `assistant/`. */
+const ASSISTANT_ROOT = process.cwd();
+const CLI_LOGGER_PATH = resolve(ASSISTANT_ROOT, "src/cli/logger.ts");
+
+/** Modules allowed to import the CLI logger: the CLI itself, and tests. */
+function isExempt(relPath: string): boolean {
+  return (
+    relPath.startsWith("src/cli/") ||
+    relPath.includes("/__tests__/") ||
+    relPath.endsWith(".test.ts")
+  );
+}
+
+function findCliLoggerImporters(): string[] {
+  const pattern = /\b(?:from|import)\s*\(?\s*["'](\.[^"']*logger\.js)["']/g;
+  const violations = new Set<string>();
+
+  for (const relPath of new Glob("src/**/*.ts").scanSync({
+    cwd: ASSISTANT_ROOT,
+  })) {
+    if (isExempt(relPath)) {
+      continue;
+    }
+    const filePath = join(ASSISTANT_ROOT, relPath);
+    for (const match of readFileSync(filePath, "utf-8").matchAll(pattern)) {
+      // Imports carry the compiled `.js` extension; sources are `.ts`.
+      const resolved = resolve(
+        dirname(filePath),
+        match[1]!.replace(/\.js$/, ".ts"),
+      );
+      if (resolved === CLI_LOGGER_PATH) {
+        violations.add(relPath);
+        break;
+      }
+    }
+  }
+  return Array.from(violations).sort();
+}
+
+describe("CLI logger boundary", () => {
+  test("no production module outside src/cli/ imports cli/logger", () => {
+    expect(findCliLoggerImporters()).toEqual([]);
+  });
+
+  test("the guard resolves the CLI logger it is guarding", () => {
+    // A typo in CLI_LOGGER_PATH would make the guard above vacuously pass.
+    expect(readFileSync(CLI_LOGGER_PATH, "utf-8")).toContain("getCliLogger");
+  });
+
+  test("pinned-tabs logs through the daemon logger", () => {
+    // The incident site: pinned-tab mutations run inside daemon host-browser
+    // request handling, on every tab pin, select, close, and invalidation.
+    const source = readFileSync(
+      join(ASSISTANT_ROOT, "src/tools/browser/pinned-tabs.ts"),
+      "utf-8",
+    );
+
+    expect(source).toContain('from "../../util/logger.js"');
+    expect(source).toContain('getLogger("pinned-tabs")');
+    expect(source).not.toContain("cli/logger");
+  });
+});

package/src/config/__tests__/deployment-context-defaults.test.ts

@@ -52,6 +52,7 @@ afterAll(() => {
 });
 
 import { setStorePathForTesting } from "../../__tests__/encrypted-store-test-helpers.js";
+import { enableMemoryV3LiveForNewWorkspacesMigration } from "../../workspace/migrations/105-enable-memory-v3-live-for-new-workspaces.js";
 import { invalidateConfigCache, loadConfig } from "../loader.js";
 
 // ---------------------------------------------------------------------------
@@ -221,7 +222,7 @@ describe("deployment-context embedding-provider default (via loadConfig)", () =>
     expect(config.memory.qdrant.vectorSize).toBe(384);
   });
 
-  test("first launch seeds memory.v3 with only `live` — tuning knobs resolve from the schema, not disk", () => {
+  test("first launch persists nothing under memory.v3, not even `live`", () => {
     if (existsSync(CONFIG_PATH)) {
       rmSync(CONFIG_PATH, { force: true });
     }
@@ -233,16 +234,37 @@ describe("deployment-context embedding-provider default (via loadConfig)", () =>
     expect(config.memory.v3.gate.denseThreshold).toBe(0.66);
     expect(config.memory.v3.needleK).toBe(100);
 
-    // Persisted config.json carries ONLY `live` under memory.v3 — no tuning knob
-    // is frozen to disk, so a shipped schema-default change reaches this
-    // assistant on its next load (mirrors the embedding-provider strip above).
+    // Nothing under memory.v3 is frozen to disk. Tuning knobs stay absent so a
+    // shipped schema-default change reaches this assistant on its next load
+    // (mirrors the embedding-provider strip above), and `live` stays absent so
+    // migration 105 can record the initial choice: 105 bails on any value
+    // already present, and this seed runs before workspace migrations.
     const raw = readConfig();
     const v3Raw = ((raw.memory as Record<string, unknown>).v3 ?? {}) as Record<
       string,
       unknown
     >;
-    expect(Object.keys(v3Raw)).toEqual(["live"]);
+    expect(Object.keys(v3Raw)).toEqual([]);
     expect(v3Raw.gate).toBeUndefined();
     expect(v3Raw.needleK).toBeUndefined();
   });
+
+  test("migration 105 turns v3 on for a workspace this seed just created", () => {
+    if (existsSync(CONFIG_PATH)) {
+      rmSync(CONFIG_PATH, { force: true });
+    }
+    delete process.env.IS_PLATFORM;
+
+    loadConfig();
+    enableMemoryV3LiveForNewWorkspacesMigration.run(WORKSPACE_DIR, {
+      isNewWorkspace: true,
+    });
+
+    const raw = readConfig();
+    const v3Raw = ((raw.memory as Record<string, unknown>).v3 ?? {}) as Record<
+      string,
+      unknown
+    >;
+    expect(v3Raw.live).toBe(true);
+  });
 });

package/src/config/loader.ts

@@ -1119,17 +1119,24 @@ export function loadConfig(): AssistantConfig {
         // Drop the deployment-context embedding provider so it is never
         // persisted (see above); the schema default re-applies in memory.
         delete (seed.memory.embeddings as { provider?: unknown }).provider;
-        // Memory-v3 tuning knobs are globally-shipped defaults, not per-assistant
-        // config: persist only `live` (genuine per-assistant state — some
-        // workspaces predate the v3 migration and must not be flipped on) and let
-        // every tuning knob resolve from the schema on load. This way a shipped
-        // schema-default change reaches all assistants (mirrors the
-        // embedding-provider strip above); migration
-        // 119-strip-persisted-memory-v3-tuning-defaults handles already-seeded
-        // configs.
-        seed.memory.v3 = {
-          live: seed.memory.v3.live,
-        } as (typeof seed.memory)["v3"];
+        // Nothing under memory.v3 is persisted at seed time.
+        //
+        // The tuning knobs are globally-shipped defaults: freezing them to
+        // disk would stop a shipped default change from reaching this
+        // assistant (mirrors the embedding-provider strip above; migration 119
+        // strips them from configs that already carry them).
+        //
+        // `live` stays absent because an absent leaf is the only way to
+        // express "no decision recorded". This seed runs before workspace
+        // migrations, and migration 105 defers to any value already present
+        // (`if ("live" in v3Config) return`), unable to tell a deliberate
+        // choice from a schema default. Writing the leaf here would pin a
+        // brand-new workspace to the schema default; leaving it absent lets
+        // 105 decide regardless of boot ordering. The schema default still
+        // applies in memory on every load, and a hatch-time
+        // `memory.v3.live=false` override still wins by merging after
+        // migrations.
+        seed.memory.v3 = {} as (typeof seed.memory)["v3"];
         // Strip dataDir (runtime-derived) from the persisted config
         const { dataDir: _, ...persistable } = seed;
         writeFileSync(configPath, JSON.stringify(persistable, null, 2) + "\n");

package/src/persistence/db-init.ts

@@ -3,9 +3,10 @@ import { existsSync } from "node:fs";
 import { getLogger } from "../util/logger.js";
 import { getDbPath } from "../util/platform.js";
 import { runAsyncSqlite } from "./db-async-query.js";
-import { getDb } from "./db-connection.js";
+import { getDb, getSqliteFrom } from "./db-connection.js";
 import { runMigrationSteps } from "./migrations/run-migrations.js";
 import { validateMigrationState } from "./migrations/validate-migration-state.js";
+import { PLANNER_OPTIMIZE_PRAGMA } from "./planner-statistics.js";
 import { migrationSteps } from "./steps.js";
 
 /**
@@ -101,6 +102,18 @@ export async function initializeDb(): Promise<{ migrationsOk: boolean }> {
     "DB migration steps complete",
   );
 
+  // An index a migration creates has no sqlite_stat1 entry until something
+  // analyzes it, which SQLite calls out as a case to handle after a schema
+  // change. Only boots that applied a step pay for it, and optimize analyzes
+  // just the tables that need it.
+  if (applied.length > 0) {
+    try {
+      getSqliteFrom(database).exec(PLANNER_OPTIMIZE_PRAGMA);
+    } catch (err) {
+      log.warn({ err }, "Post-migration PRAGMA optimize failed (non-fatal)");
+    }
+  }
+
   if (failed.length > 0) {
     log.error(
       { failedMigrations: failed, count: failed.length },

package/src/persistence/db-maintenance.ts

@@ -8,6 +8,7 @@ import { getMemoryCheckpoint, setMemoryCheckpoint } from "./checkpoints.js";
 import { getLastInteractiveUserMessageTimestamp } from "./conversation-crud.js";
 import { runAsyncSqlite } from "./db-async-query.js";
 import { getSqlite } from "./db-connection.js";
+import { PLANNER_OPTIMIZE_PRAGMA } from "./planner-statistics.js";
 
 const log = getLogger("db-maintenance");
 
@@ -80,11 +81,11 @@ async function runDbMaintenance(): Promise<void> {
     log.warn({ err }, "Workflow run pruning failed (non-fatal)");
   }
 
-  // Refresh the query planner's statistics. PRAGMA optimize is cheap; it is
-  // routed through the async path for consistency and to keep it off the main
-  // thread when the sqlite3 CLI backend is available.
+  // Refresh the query planner's statistics (see PLANNER_OPTIMIZE_PRAGMA for
+  // what the mask buys here). Routed through the async path to keep it off the
+  // main thread when the sqlite3 CLI backend is available.
   const optimizeResult = await runAsyncSqlite(
-    "PRAGMA optimize",
+    PLANNER_OPTIMIZE_PRAGMA,
     "db-maintenance:optimize",
   );
   if (!optimizeResult.ok) {

package/src/persistence/planner-statistics.ts

@@ -0,0 +1,14 @@
+/**
+ * The `PRAGMA optimize` mask run by the daily maintenance sweep and by
+ * `db-init` after a boot that applied migrations.
+ *
+ * Both run on connections with no useful query history, so `0x10000` is what
+ * lets optimize look past tables missing from `sqlite_stat1` and reconsider
+ * ones whose entries have gone stale. `0x2` keeps the default "analyze where
+ * it helps" behavior and `0x10` bounds each ANALYZE with a temporary
+ * `analysis_limit`. Releases before 3.46 ignore bits they do not recognize
+ * rather than failing, so the mask is safe to send to any version.
+ *
+ * https://sqlite.org/lang_analyze.html#recommended_usage_patterns
+ */
+export const PLANNER_OPTIMIZE_PRAGMA = "PRAGMA optimize=0x10012";

package/src/tools/browser/pinned-tabs.ts

@@ -14,7 +14,9 @@
  * `host_browser_session_invalidated`.
  */
 
-import { log } from "../../cli/logger.js";
+import { getLogger } from "../../util/logger.js";
+
+const log = getLogger("pinned-tabs");
 
 const pinnedTabs = new Map<string, Map<string, string>>();