@vellumai/assistant 0.5.12 → 0.5.14

package/.env.example

@@ -21,12 +21,7 @@ VELLUM_PLATFORM_URL=https://dev-platform.vellum.ai
 
 # --- Sentry (crash reporting) ---
 # Omit to disable Sentry.
-SENTRY_DSN_ASSISTANT=https://db2d38a082e4ee35eeaea08c44b376ec@o4504590528675840.ingest.us.sentry.io/4510874712276992
-
-# --- Telemetry ---
-# Omit to disable telemetry reporting.
-TELEMETRY_PLATFORM_URL=https://platform.vellum.ai
-TELEMETRY_APP_TOKEN=e01cf85768cc3617e986f0a7f1966b72e25316526c5db54c8b94a9c3c5c9eaed
+SENTRY_DSN_ASSISTANT=
 
 # --- Network proxy ---
 # Comma-separated host patterns allowed through the proxy.

package/AGENTS.md

@@ -11,3 +11,7 @@ When you introduce a new env var that the assistant process needs to read at run
 `safe-env.ts` maintains the allowlist of env vars that are forwarded to agent-spawned child processes (bash tool, skill sandbox, etc.). Anything not on the list is stripped to prevent credential leakage. If your new var is needed by commands the agent runs, it must be added.
 
 **Default to including it.** If the var doesn't contain secrets (e.g. a URL, a feature flag, a path, a mode string), add it. Only omit it if it carries credential material (tokens, passwords, private keys) — those must stay isolated to CES.
+
+## Code comments
+
+When writing or updating comments, **do not reference code that has been removed.** Comments should describe the current state of the codebase, not narrate its history. Avoid phrases like "no longer does X", "previously used Y", or "was removed in PR Z" — future readers should not need to understand past implementations to understand the current code.

package/ARCHITECTURE.md

@@ -707,7 +707,6 @@ graph LR
 
     subgraph "~/.vellum/ (Root Files)"
         TRUST["protected/trust.json<br/>Tool permission rules"]
-        FF_TOKEN["feature-flag-token<br/>Client token for feature-flag API"]
     end
 
     subgraph "~/.vellum/workspace/ (Workspace Files)"

package/Dockerfile

@@ -38,23 +38,55 @@ WORKDIR /app/assistant
 
 # Install runtime dependencies for Playwright and tree-sitter
 RUN apt-get update && apt-get install -y \
-    curl \
-    unzip \
+    bubblewrap \
     ca-certificates \
-    python3 \
-    libnss3 \
-    libfreetype6 \
-    libharfbuzz0b \
+    curl \
+    ffmpeg \
     fonts-freefont-ttf \
-    make \
     g++ \
     git \
-    sudo \
     htop \
-    procps \
     jq \
+    libasound2 \
+    libatk-bridge2.0-0 \
+    libatk1.0-0 \
+    libatspi2.0-0 \
+    libcairo2 \
+    libcups2 \
+    libdrm2 \
+    libfreetype6 \
+    libgbm1 \
+    libharfbuzz0b \
+    libnspr4 \
+    libnss3 \
+    libpango-1.0-0 \
+    libpangocairo-1.0-0 \
+    libx11-6 \
+    libx11-xcb1 \
+    libxcb-dri3-0 \
+    libxcb1 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxext6 \
+    libxfixes3 \
+    libxi6 \
+    libxkbcommon0 \
+    libxrandr2 \
+    libxrender1 \
+    libxshmfence1 \
+    libxtst6 \
+    lsof \
+    make \
+    openssl \
+    procps \
+    python3 \
+    sqlite3 \
+    sudo \
+    unzip \
     uuid-runtime \
     vim \
+    xclip \
+    xdg-utils \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy bun binary from builder instead of re-installing

package/bunfig.toml

@@ -1,2 +1,3 @@
 [test]
 root = "./src"
+preload = ["./src/__tests__/test-preload.ts"]

package/docs/architecture/memory.md

@@ -260,10 +260,10 @@ The key distinction: normal compaction is a cost-optimized background process th
 | Config key                                            |                   Default | Purpose                                                              |
 | ----------------------------------------------------- | ------------------------: | -------------------------------------------------------------------- |
 | `memory.retrieval.dynamicBudget.enabled`              |                    `true` | Toggle per-turn recall budget calculation from live prompt headroom. |
-| `memory.retrieval.dynamicBudget.minInjectTokens`      |                    `1200` | Lower clamp for computed recall injection budget.                    |
-| `memory.retrieval.dynamicBudget.maxInjectTokens`      |                   `10000` | Upper clamp for computed recall injection budget.                    |
+| `memory.retrieval.dynamicBudget.minInjectTokens`      |                    `2400` | Lower clamp for computed recall injection budget.                    |
+| `memory.retrieval.dynamicBudget.maxInjectTokens`      |                   `16000` | Upper clamp for computed recall injection budget.                    |
 | `memory.retrieval.dynamicBudget.targetHeadroomTokens` |                   `10000` | Reserved headroom to keep free for response generation/tool traces.  |
-| `memory.retrieval.maxInjectTokens`                    |                   `10000` | Static fallback when dynamic budget is disabled.                     |
+| `memory.retrieval.maxInjectTokens`                    |                   `16000` | Static fallback when dynamic budget is disabled.                     |
 | `memory.retrieval.scopePolicy`                        | `'allow_global_fallback'` | Scope filtering strategy: `'strict'` or `'allow_global_fallback'`.   |
 
 ### Memory Recall Debugging Playbook

package/node_modules/@vellumai/ces-contracts/src/index.ts

@@ -33,6 +33,13 @@ export const HandshakeRequestSchema = z.object({
    * can use it for platform credential materialisation.
    */
   assistantApiKey: z.string().optional(),
+  /**
+   * Optional platform assistant ID passed from the assistant runtime.
+   * In managed (sidecar) mode with warm pools, the PLATFORM_ASSISTANT_ID
+   * env var may not be set at CES startup. The assistant forwards it here
+   * so CES can use it for platform credential materialisation.
+   */
+  assistantId: z.string().optional(),
 });
 export type HandshakeRequest = z.infer<typeof HandshakeRequestSchema>;
 

package/node_modules/@vellumai/ces-contracts/src/rpc.ts

@@ -422,6 +422,11 @@ export type ListAuditRecordsResponse = z.infer<
 export const UpdateManagedCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
+  /**
+   * Optional platform assistant ID. In warm-pool mode the ID may not be
+   * available at CES startup; the assistant pushes it here once provisioned.
+   */
+  assistantId: z.string().optional(),
 });
 export type UpdateManagedCredential = z.infer<
   typeof UpdateManagedCredentialSchema

package/openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.0
 info:
   title: Vellum Assistant API
-  version: 0.5.11
+  version: 0.5.13
   description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
 servers:
   - url: http://127.0.0.1:7821
@@ -3144,7 +3144,7 @@ paths:
     post:
       operationId: export_post
       summary: Export logs and audit data
-      description: Export audit records, daemon logs, workspace contents, and config as a tar.gz archive.
+      description: Export audit records, assistant logs, workspace contents, and config as a tar.gz archive.
       tags:
         - export
       responses:
@@ -3158,24 +3158,19 @@ paths:
               type: object
               properties:
                 auditLimit:
+                  description: Max audit records (default 1000)
                   type: integer
                   minimum: -9007199254740991
                   maximum: 9007199254740991
-                  description: Max audit records (default 1000)
                 conversationId:
-                  type: string
                   description: Scope to a single conversation
+                  type: string
                 startTime:
-                  type: number
                   description: Lower bound epoch ms
-                endTime:
                   type: number
+                endTime:
                   description: Upper bound epoch ms
-              required:
-                - auditLimit
-                - conversationId
-                - startTime
-                - endTime
+                  type: number
               additionalProperties: false
   /v1/guardian-actions/decision:
     post:
@@ -3316,6 +3311,52 @@ paths:
                   - cpu
                   - migrations
                 additionalProperties: false
+  /v1/healthz:
+    get:
+      operationId: healthz_get
+      summary: Detailed health check (alias)
+      description: Alias for /v1/health. Returns runtime health including version, disk, memory, CPU, and migration status.
+      tags:
+        - system
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                  timestamp:
+                    type: string
+                  version:
+                    type: string
+                  disk:
+                    type: object
+                    properties: {}
+                    additionalProperties: {}
+                  memory:
+                    type: object
+                    properties: {}
+                    additionalProperties: {}
+                  cpu:
+                    type: object
+                    properties: {}
+                    additionalProperties: {}
+                  migrations:
+                    type: object
+                    properties: {}
+                    additionalProperties: {}
+                required:
+                  - status
+                  - timestamp
+                  - version
+                  - disk
+                  - memory
+                  - cpu
+                  - migrations
+                additionalProperties: false
   /v1/heartbeat/checklist:
     get:
       operationId: heartbeat_checklist_get
@@ -3968,6 +4009,38 @@ paths:
       responses:
         "200":
           description: Successful response
+  /v1/logs/export:
+    post:
+      operationId: logs_export_post
+      summary: Export logs and audit data (alias)
+      description: Alias for /v1/export. Export audit records, assistant logs, workspace contents, and config as a tar.gz archive.
+      tags:
+        - export
+      responses:
+        "200":
+          description: Successful response
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                auditLimit:
+                  description: Max audit records (default 1000)
+                  type: integer
+                  minimum: -9007199254740991
+                  maximum: 9007199254740991
+                conversationId:
+                  description: Scope to a single conversation
+                  type: string
+                startTime:
+                  description: Lower bound epoch ms
+                  type: number
+                endTime:
+                  description: Upper bound epoch ms
+                  type: number
+              additionalProperties: false
   /v1/memory-items:
     get:
       operationId: memoryitems_get
@@ -4644,6 +4717,28 @@ paths:
           required: true
           schema:
             type: string
+  /v1/oauth/providers:
+    get:
+      operationId: oauth_providers_get
+      tags:
+        - oauth-providers
+      responses:
+        "200":
+          description: Successful response
+  /v1/oauth/providers/{providerKey}:
+    get:
+      operationId: oauth_providers_by_providerKey_get
+      tags:
+        - oauth-providers
+      responses:
+        "200":
+          description: Successful response
+      parameters:
+        - name: providerKey
+          in: path
+          required: true
+          schema:
+            type: string
   /v1/oauth/start:
     post:
       operationId: oauth_start_post
@@ -6281,17 +6376,27 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  id:
-                    type: string
-                    description: Event ID
-                  event_name:
-                    type: string
-                required:
-                  - id
-                  - event_name
-                additionalProperties: false
+                anyOf:
+                  - type: object
+                    properties:
+                      id:
+                        type: string
+                        description: Event ID
+                      event_name:
+                        type: string
+                    required:
+                      - id
+                      - event_name
+                    additionalProperties: false
+                  - type: object
+                    properties:
+                      skipped:
+                        type: boolean
+                        const: true
+                        description: Event skipped due to usage data collection being disabled
+                    required:
+                      - skipped
+                    additionalProperties: false
       requestBody:
         required: true
         content:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/access-request-decision.test.ts

@@ -8,28 +8,7 @@
  * - Stale: handles already-resolved requests gracefully.
  * - Idempotent: approving same request twice does not create duplicate sessions.
  */
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
-
-// ---------------------------------------------------------------------------
-// Test isolation: in-memory SQLite via temp directory
-// ---------------------------------------------------------------------------
-
-const testDir = mkdtempSync(join(tmpdir(), "access-request-decision-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -56,7 +35,7 @@ mock.module("../runtime/gateway-client.js", () => ({
   },
 }));
 
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import {
   createApprovalRequest,
   getApprovalRequestById,
@@ -72,15 +51,6 @@ import {
 
 initializeDb();
 
-afterAll(() => {
-  resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
-});
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

package/src/__tests__/actor-token-service.test.ts

@@ -6,25 +6,7 @@
  * that middleware is replaced by the JWT auth middleware in
  * runtime/auth/middleware.ts (tested in auth/middleware.test.ts).
  */
-import { mkdtempSync, realpathSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
-
-const testDir = realpathSync(mkdtempSync(join(tmpdir(), "actor-token-test-")));
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  getDbPath: () => join(testDir, "test.db"),
-  normalizeAssistantId: (id: string) => (id === "self" ? "self" : id),
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -40,7 +22,6 @@ mock.module("../config/env.js", () => ({
   getRuntimeGatewayOriginSecret: () => undefined,
   isHttpAuthDisabledWithoutSafetyGate: () => false,
   checkUnrecognizedEnvVars: () => {},
-  getBaseDataDir: () => testDir,
 }));
 
 import { findGuardianForChannel } from "../contacts/contact-store.js";
@@ -110,12 +91,6 @@ beforeEach(() => {
   db.run("DELETE FROM contacts");
 });
 
-afterAll(() => {
-  try {
-    rmSync(testDir, { recursive: true, force: true });
-  } catch {}
-});
-
 // ---------------------------------------------------------------------------
 // Hash-only storage
 // ---------------------------------------------------------------------------
@@ -462,7 +437,6 @@ describe("pairing credential flow", () => {
     const ctx = {
       pairingStore: store,
       bearerToken,
-      featureFlagToken: undefined,
       pairingBroadcast: () => {},
     };
 
@@ -520,7 +494,6 @@ describe("pairing credential flow", () => {
     const ctx = {
       pairingStore: store,
       bearerToken,
-      featureFlagToken: undefined,
       pairingBroadcast: () => {},
     };
 
@@ -577,7 +550,6 @@ describe("pairing credential flow", () => {
     const ctx = {
       pairingStore: store,
       bearerToken,
-      featureFlagToken: undefined,
       pairingBroadcast: () => {},
     };
 
@@ -637,7 +609,6 @@ describe("pairing credential flow", () => {
     const ctx = {
       pairingStore: store,
       bearerToken,
-      featureFlagToken: undefined,
       pairingBroadcast: () => {},
     };
 
@@ -727,4 +698,3 @@ describe("bootstrap private-network guard", () => {
     expect(res.status).toBe(200);
   });
 });
-