@vellumai/assistant 0.12.0 → 0.12.1-dev.202609141913.5e16607

package/src/config/default-profile-catalog.ts

@@ -137,7 +137,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     // The managed latency class, also what the live-voice front model runs on.
     // Its leading tokens are the turn-taking verdict, so what this profile
     // optimizes is the tail of time-to-first-token rather than the median: a
-    // verdict slower than `liveVoice.frontModel.endpointDecisionTimeoutMs`
+    // verdict slower than `voice.frontModel.endpointDecisionTimeoutMs`
     // trips the speculative fail-open commit in live-voice-session.ts, which
     // is audible dead air.
     //

package/src/config/env.ts

@@ -229,8 +229,8 @@ export function setPlatformAssistantId(value: string | undefined): void {
  * Platform assistant ID — UUID of this assistant on the platform.
  *
  * Resolved from the in-memory override (populated by providers-setup
- * rehydration from the credential store at daemon startup, or by
- * secret-routes when the platform pushes the value).
+ * rehydration via platform validate, or by secret-routes when the
+ * platform pushes the value).
  */
 export function getPlatformAssistantId(): string {
   return _platformAssistantIdOverride ?? "";

package/src/config/feature-flag-registry.json

@@ -29,18 +29,6 @@
       "description": "Enable user-hosted onboarding flow",
       "defaultEnabled": false
     },
-    {
-      "id": "proactive-tips",
-      "scope": "client",
-      "key": "proactive-tips",
-      "label": "Proactive Tips",
-      "description": "Gates the dismissible proactive tip card in the web sidebar. String-valued so future A/B arms can be added as new values.",
-      "defaultEnabled": "off",
-      "values": [
-        "off",
-        "on"
-      ]
-    },
     {
       "id": "vision-mode",
       "scope": "client",
@@ -454,6 +442,14 @@
       "description": "Native notifications show the assistant's avatar as the icon with the assistant's name on line one. Same key the platform reads for APNs/FCM sender blocks.",
       "defaultEnabled": false
     },
+    {
+      "id": "local-notification-avatar",
+      "scope": "client",
+      "key": "local-notification-avatar",
+      "label": "Local Notification Avatar",
+      "description": "Shows the assistant name and avatar in notifications posted locally by native clients and supported browsers. Independent of remote push avatar presentation.",
+      "defaultEnabled": false
+    },
     {
       "id": "channel-conversation-sidecar",
       "scope": "client",
@@ -478,6 +474,14 @@
       "description": "Gates the seeded Figma OAuth provider. When off, the provider is hidden from GET /v1/oauth/providers, its get-by-id route, and the connect/update routes, so it cannot be listed or connected from the CLI, gateway, or web integrations list. The row is still seeded into oauth_providers on startup, and existing connections keep injecting credentials; only its visibility changes.",
       "defaultEnabled": false
     },
+    {
+      "id": "shopify-oauth",
+      "scope": "assistant",
+      "key": "shopify-oauth",
+      "label": "Shopify Integration",
+      "description": "Gates the seeded Shopify OAuth provider. When off, the provider is hidden from GET /v1/oauth/providers, its get-by-id route, and the connect/update routes, so it cannot be listed or connected from the CLI, gateway, or web integrations list. The row is still seeded into oauth_providers on startup, and existing connections keep injecting credentials; only its visibility changes. Off by default because Shopify is the first per-tenant provider: connecting needs the merchant's myshopify.com domain, and the shop-domain input in the clients ships separately from the seed.",
+      "defaultEnabled": false
+    },
     {
       "id": "chatgpt-device-code-login",
       "scope": "client",
@@ -523,6 +527,14 @@
       "label": "Send User Message Tool",
       "description": "Route all user-facing assistant text through the send_user_message tool instead of streamed assistant text",
       "defaultEnabled": false
+    },
+    {
+      "id": "assistant-desktop",
+      "scope": "assistant",
+      "key": "assistant-desktop",
+      "label": "Assistant Desktop",
+      "description": "Streams an interactive desktop from a containerized assistant pod to the web client over /v1/desktop/stream. Off: no desktop affordance is rendered. On: the chat header offers a desktop panel that views and controls the pod's display.",
+      "defaultEnabled": false
     }
   ]
 }

package/src/config/loader.ts

@@ -180,6 +180,7 @@ export function getDeploymentContextDefaults(): Record<string, unknown> {
       "discord-oauth": managed,
       "hubspot-oauth": managed,
       "monday-oauth": managed,
+      "shopify-oauth": managed,
       "stripe-link-oauth": managed,
       "figma-oauth": managed,
       "eventbrite-oauth": managed,

package/src/config/memory-v3-gate.test.ts

@@ -6,6 +6,7 @@ import {
   isMemoryV1Active,
   isMemoryV2ExplicitlyDisabled,
   isMemoryV3Live,
+  isSkillImprovementActive,
   isV2InjectionEngineActive,
   isV3TierActive,
   usesConceptPageMemory,
@@ -55,12 +56,16 @@ function makeConfig(
   enabled: TriState,
   v2Enabled: TriState,
   v3Live: TriState,
+  skillImprovement?: boolean,
 ): AssistantConfig {
   return {
     memory: {
       ...(enabled === undefined ? {} : { enabled }),
       ...(v2Enabled === undefined ? {} : { v2: { enabled: v2Enabled } }),
       ...(v3Live === undefined ? {} : { v3: { live: v3Live } }),
+      ...(skillImprovement === undefined
+        ? {}
+        : { retrospective: { skillImprovement } }),
     },
   } as AssistantConfig;
 }
@@ -296,6 +301,32 @@ describe("v1-staleness guard is one condition", () => {
  * proc-to-skills alias of `isMemoryV3Live` (which did not). One predicate now
  * answers for both features.
  */
+describe("skill improvement gate", () => {
+  test("defaults on for a live v3 tier", () => {
+    expect(isSkillImprovementActive(makeConfig(true, undefined, true))).toBe(
+      true,
+    );
+    expect(isSkillImprovementActive(makeConfig(undefined, undefined, true))).toBe(
+      true,
+    );
+  });
+
+  test("explicit opt-out disables skill improvement without disabling v3", () => {
+    const config = makeConfig(true, undefined, true, false);
+
+    expect(isV3TierActive(config)).toBe(true);
+    expect(isSkillImprovementActive(config)).toBe(false);
+  });
+
+  test("requires the live v3 tier even when explicitly enabled", () => {
+    const v2Config = makeConfig(true, true, false, true);
+    const memoryOffConfig = makeConfig(false, undefined, true, true);
+
+    expect(isSkillImprovementActive(v2Config)).toBe(false);
+    expect(isSkillImprovementActive(memoryOffConfig)).toBe(false);
+  });
+});
+
 describe("v3 tier is one condition", () => {
   test("memory off suppresses the v3 tier even with memory.v3.live set", () => {
     const config = makeConfig(false, undefined, true);

package/src/config/memory-v3-gate.ts

@@ -81,28 +81,32 @@ export function isMemoryV3Live(config: AssistantConfig): boolean {
  * FEATURE asks this predicate; only the injection-suppression checks that must
  * mirror the raw `memory.v3.live` key ask {@link isMemoryV3Live} directly.
  *
- * The two features gated on it, and why they must agree:
+ * The memory concept graph is gated on it: both `GET /memory-graph`
+ * (`supported`) and the cheap `graph_supported` bit on `GET /memory/stats`
+ * must agree with whether the graph can build from the v3 concept-page
+ * substrate.
  *
- * - The memory concept graph — the single source of truth for both
- *   `GET /memory-graph` (`supported`) and the cheap `graph_supported` bit on
- *   `GET /memory/stats`, so the advertised capability and the actual build can
- *   never drift. The graph builds off the v3 concept-page substrate.
- * - Procedural-memory-as-skills — the retrospective's skill-authoring step and
- *   its permission grant. Scoped to the v3 tier because skill retrieval rides
- *   the v3 lanes and the usage-prune stage lives in the v3 maintain job. That
- *   prune ships observe-first: with `memory.maintenance.skillPruneDays` at its
- *   default (`null`) it reports stale assistant-authored skills
- *   (`prunableSkills`) but deletes none — so a v3-tier assistant authors skills
- *   without an automatic retirement bound until a positive `skillPruneDays` is
- *   configured.
- *
- * Both write into memory on the user's behalf, so both honor the Memory
- * opt-out identically: one predicate, one answer.
+ * Retrospective skill improvement is a separate optional v3-tier feature.
+ * Ask {@link isSkillImprovementActive} for it so an operator can stop managed
+ * skill authoring without turning off ordinary retrospective memory capture.
  */
 export function isV3TierActive(config: AssistantConfig): boolean {
   return isMemoryEnabled(config) && isMemoryV3Live(config);
 }
 
+/**
+ * Whether a retrospective may turn observed procedures into managed skills.
+ * This requires the v3 tier because skills are retrieved through its memory
+ * substrate, and it honors the retrospective-specific opt-out without
+ * disabling ordinary retrospective fact retention.
+ */
+export function isSkillImprovementActive(config: AssistantConfig): boolean {
+  return (
+    isV3TierActive(config) &&
+    config.memory?.retrospective?.skillImprovement !== false
+  );
+}
+
 /**
  * Minimal structural view of the memory config the concept-page gate reads.
  * Accepting the shape (rather than the full `MemoryConfig`) lets call sites

package/src/config/platform-identity.ts

@@ -0,0 +1,201 @@
+/**
+ * Bound platform identity (assistant, organization, user).
+ *
+ * Django maps an assistant API key to these ids via
+ * `POST /v1/internal/assistants/validate/`. Process startup rehydrates from
+ * that endpoint into the in-memory overrides. Resolution reads those
+ * overrides (and `PLATFORM_ORGANIZATION_ID` / `PLATFORM_USER_ID` when set).
+ * When the in-memory assistant id is empty, the next resolve retries
+ * validate (single-flight, with a cooldown after a failed attempt).
+ */
+
+import { credentialKey } from "../security/credential-key.js";
+import { getSecureKeyAsync } from "../security/secure-keys.js";
+import { getLogger } from "../util/logger.js";
+import {
+  getPlatformAssistantId,
+  getPlatformBaseUrl,
+  getPlatformOrganizationId,
+  getPlatformUserId,
+  setPlatformAssistantId,
+  setPlatformOrganizationId,
+  setPlatformUserId,
+} from "./env.js";
+
+const log = getLogger("platform-identity");
+
+export const PLATFORM_IDENTITY_VALIDATE_PATH =
+  "/v1/internal/assistants/validate/";
+
+const VALIDATE_TIMEOUT_MS = 5_000;
+const ENSURE_COOLDOWN_MS = 10_000;
+
+export type PlatformIdentityIds = {
+  assistantId: string;
+  organizationId: string;
+  userId: string;
+};
+
+function asNonEmptyString(value: unknown): string | undefined {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+export function applyPlatformIdentityIds(ids: PlatformIdentityIds): void {
+  if (ids.assistantId) {
+    setPlatformAssistantId(ids.assistantId);
+  }
+  if (ids.organizationId) {
+    setPlatformOrganizationId(ids.organizationId);
+  }
+  if (ids.userId) {
+    setPlatformUserId(ids.userId);
+  }
+}
+
+/**
+ * Trade an assistant API key for the bound platform ids.
+ *
+ * Returns null when the platform is unreachable, refuses the key, or the
+ * body has no ids. Never throws.
+ */
+export async function fetchPlatformIdentityIds(
+  baseUrl: string,
+  apiKey: string,
+): Promise<PlatformIdentityIds | null> {
+  const url = `${baseUrl.replace(/\/+$/, "")}${PLATFORM_IDENTITY_VALIDATE_PATH}`;
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Api-Key ${apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(VALIDATE_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      log.warn(
+        { status: res.status },
+        "platform identity validate returned non-2xx",
+      );
+      return null;
+    }
+    const body: unknown = await res.json();
+    if (!body || typeof body !== "object") {
+      return null;
+    }
+    const obj = body as Record<string, unknown>;
+    const assistantId = asNonEmptyString(obj.assistant_id);
+    const organizationId = asNonEmptyString(obj.organization_id);
+    const userId = asNonEmptyString(obj.user_id);
+    if (!assistantId && !organizationId && !userId) {
+      return null;
+    }
+    return {
+      assistantId: assistantId ?? "",
+      organizationId: organizationId ?? "",
+      userId: userId ?? "",
+    };
+  } catch (err) {
+    log.warn({ err }, "platform identity validate failed");
+    return null;
+  }
+}
+
+async function readAssistantApiKey(): Promise<string> {
+  try {
+    const stored = (
+      await getSecureKeyAsync(credentialKey("vellum", "assistant_api_key"))
+    )?.trim();
+    if (stored) {
+      return stored;
+    }
+  } catch (err) {
+    log.warn({ err }, "failed to read assistant API key from credential store");
+  }
+  return process.env.ASSISTANT_API_KEY?.trim() ?? "";
+}
+
+let ensureInFlight: Promise<void> | null = null;
+let nextEnsureAttemptAt = 0;
+
+export function _resetPlatformIdentityEnsureForTests(): void {
+  ensureInFlight = null;
+  nextEnsureAttemptAt = 0;
+}
+
+/**
+ * Load in-memory platform ids from validate when they are missing.
+ *
+ * No-ops when the assistant id is already set, when auth prerequisites are
+ * missing, or when a failed attempt is still inside the cooldown window.
+ * Concurrent callers share one in-flight request.
+ */
+export async function ensurePlatformIdentityIds(): Promise<void> {
+  if (getPlatformAssistantId().trim()) {
+    return;
+  }
+  if (Date.now() < nextEnsureAttemptAt) {
+    return;
+  }
+  if (!ensureInFlight) {
+    ensureInFlight = (async () => {
+      try {
+        const apiKey = await readAssistantApiKey();
+        const baseUrl = getPlatformBaseUrl();
+        if (!apiKey || !baseUrl) {
+          return;
+        }
+        const ids = await fetchPlatformIdentityIds(baseUrl, apiKey);
+        if (!ids) {
+          nextEnsureAttemptAt = Date.now() + ENSURE_COOLDOWN_MS;
+          return;
+        }
+        applyPlatformIdentityIds(ids);
+        nextEnsureAttemptAt = 0;
+        log.info("Loaded platform identity from platform validate");
+      } finally {
+        ensureInFlight = null;
+      }
+    })();
+  }
+  await ensureInFlight;
+}
+
+export async function resolvePlatformAssistantId(): Promise<string> {
+  const existing = getPlatformAssistantId().trim();
+  if (existing) {
+    return existing;
+  }
+  await ensurePlatformIdentityIds();
+  return getPlatformAssistantId().trim();
+}
+
+export async function resolvePlatformAssistantIdOrNull(): Promise<
+  string | null
+> {
+  const id = await resolvePlatformAssistantId();
+  return id || null;
+}
+
+export async function resolvePlatformOrganizationId(): Promise<string> {
+  const existing = getPlatformOrganizationId().trim();
+  if (existing) {
+    return existing;
+  }
+  await ensurePlatformIdentityIds();
+  return getPlatformOrganizationId().trim();
+}
+
+export async function resolvePlatformUserId(): Promise<string> {
+  const existing = getPlatformUserId().trim();
+  if (existing) {
+    return existing;
+  }
+  await ensurePlatformIdentityIds();
+  return getPlatformUserId().trim();
+}

package/src/config/platform-rehydration.ts

@@ -1,6 +1,5 @@
 /**
- * Rehydrate the in-memory platform identity/URL overrides from the credential
- * store at process startup.
+ * Rehydrate the in-memory platform identity/URL overrides at process startup.
  *
  * These overrides (`setPlatformBaseUrl` and the platform ID setters in
  * `config/env.ts`) are normally only populated at runtime by the secret-routes
@@ -10,18 +9,17 @@
  * environment default (e.g. dev-platform) while the credential store holds the
  * real production values, and requests are sent to the wrong environment.
  *
+ * Bound platform ids come from `POST /v1/internal/assistants/validate/`,
+ * which trades the assistant API key for assistant/organization/user ids.
+ *
  * Each field is best-effort: a credential-store read failure is logged and
  * skipped so a single missing value never blocks startup.
  */
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
-import {
-  setPlatformAssistantId,
-  setPlatformBaseUrl,
-  setPlatformOrganizationId,
-  setPlatformUserId,
-} from "./env.js";
+import { setPlatformBaseUrl } from "./env.js";
+import { ensurePlatformIdentityIds } from "./platform-identity.js";
 
 const log = getLogger("platform-rehydration");
 
@@ -47,30 +45,16 @@ async function rehydrateField(
 
 /**
  * Rehydrate the platform base URL and the related platform IDs (assistant,
- * organization, user) from the credential store into their in-memory
- * overrides. Safe to call more than once.
+ * organization, user). Safe to call more than once.
  */
 export async function rehydratePlatformCredentials(): Promise<void> {
-  // Base URL first so managed proxy activation resolves the correct
-  // environment for the ID lookups and every request that follows.
+  // Base URL first so managed proxy activation and identity validate resolve
+  // the correct environment for every request that follows.
   await rehydrateField(
     "platform_base_url",
     setPlatformBaseUrl,
     "platform base URL",
   );
-  await rehydrateField(
-    "platform_assistant_id",
-    setPlatformAssistantId,
-    "platform assistant ID",
-  );
-  await rehydrateField(
-    "platform_organization_id",
-    setPlatformOrganizationId,
-    "platform organization ID",
-  );
-  await rehydrateField(
-    "platform_user_id",
-    setPlatformUserId,
-    "platform user ID",
-  );
+
+  await ensurePlatformIdentityIds();
 }

package/src/config/schema.ts

@@ -41,7 +41,6 @@ import {
   AuditLogConfigSchema,
   LogFileConfigSchema,
 } from "./schemas/logging.js";
-import { McpConfigSchema } from "./schemas/mcp.js";
 import { MemoryConfigSchema } from "./schemas/memory.js";
 import { MigrationsConfigSchema } from "./schemas/migrations.js";
 import { MonitoringConfigSchema } from "./schemas/monitoring.js";
@@ -62,6 +61,7 @@ import {
 } from "./schemas/timeouts.js";
 import { ToolsConfigSchema } from "./schemas/tools.js";
 import { UserRoutesConfigSchema } from "./schemas/user-routes.js";
+import { VoiceConfigSchema } from "./schemas/voice.js";
 import { WorkflowsConfigSchema } from "./schemas/workflows.js";
 import { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 
@@ -108,7 +108,6 @@ export const AssistantConfigSchema = z.object({
   ),
   journal: JournalConfigSchema.default(JournalConfigSchema.parse({})),
   backup: BackupConfigSchema.default(BackupConfigSchema.parse({})),
-  mcp: McpConfigSchema.default(McpConfigSchema.parse({})),
   acp: AcpConfigSchema.default(AcpConfigSchema.parse({})),
   skills: SkillsConfigSchema.default(SkillsConfigSchema.parse({})),
   workspaceGit: WorkspaceGitConfigSchema.default(
@@ -119,6 +118,7 @@ export const AssistantConfigSchema = z.object({
   twilio: TwilioConfigSchema.default(TwilioConfigSchema.parse({})),
   calls: CallsConfigSchema.default(CallsConfigSchema.parse({})),
   liveVoice: LiveVoiceConfigSchema.default(LiveVoiceConfigSchema.parse({})),
+  voice: VoiceConfigSchema.default(VoiceConfigSchema.parse({})),
   sight: SightConfigSchema.default(SightConfigSchema.parse({})),
   whatsapp: WhatsAppConfigSchema.default(WhatsAppConfigSchema.parse({})),
   telegram: TelegramConfigSchema.default(TelegramConfigSchema.parse({})),