@vellumai/assistant 0.5.13 → 0.5.15

package/src/daemon/server.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import {
@@ -48,11 +48,13 @@ import { getSigningKeyFingerprint } from "../runtime/auth/token-service.js";
 import { bridgeConfirmationRequestToGuardian } from "../runtime/confirmation-request-guardian-bridge.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { checkIngressForSecrets } from "../security/secret-ingress.js";
+import { redactSecrets } from "../security/secret-scanner.js";
 import { registerCancelCallback } from "../signals/cancel.js";
 import { registerConversationUndoCallback } from "../signals/conversation-undo.js";
 import { appendEventToStream } from "../signals/event-stream.js";
 import { registerUserMessageCallback } from "../signals/user-message.js";
 import { getSubagentManager } from "../subagent/index.js";
+import { summarizeToolInput } from "../tools/tool-input-summary.js";
 import { getLogger } from "../util/logger.js";
 import {
   getSandboxWorkingDir,
@@ -66,6 +68,7 @@ import {
   DEFAULT_MEMORY_POLICY,
 } from "./conversation.js";
 import { ConversationEvictor } from "./conversation-evictor.js";
+import { formatCompactResult } from "./conversation-process.js";
 import { resolveChannelCapabilities } from "./conversation-runtime-assembly.js";
 import { resolveSlash, type SlashContext } from "./conversation-slash.js";
 import { undoLastMessage } from "./handlers/conversations.js";
@@ -78,7 +81,10 @@ import type { SkillOperationContext } from "./handlers/skills.js";
 import { HostBashProxy } from "./host-bash-proxy.js";
 import { HostCuProxy } from "./host-cu-proxy.js";
 import { HostFileProxy } from "./host-file-proxy.js";
-import type { ServerMessage } from "./message-protocol.js";
+import type {
+  ServerMessage,
+  UserMessageAttachment,
+} from "./message-protocol.js";
 
 const log = getLogger("server");
 
@@ -175,6 +181,14 @@ function makePendingInteractionRegistrar(
       try {
         const trustContext = conversation.trustContext;
         const sourceChannel = trustContext?.sourceChannel ?? "vellum";
+        const inputRecord = msg.input as Record<string, unknown>;
+        const activityRaw =
+          (typeof inputRecord.activity === "string"
+            ? inputRecord.activity
+            : undefined) ??
+          (typeof inputRecord.reason === "string"
+            ? inputRecord.reason
+            : undefined);
         const canonicalRequest = createCanonicalGuardianRequest({
           id: msg.requestId,
           kind: "tool_approval",
@@ -186,6 +200,15 @@ function makePendingInteractionRegistrar(
           guardianExternalUserId: trustContext?.guardianExternalUserId,
           guardianPrincipalId: trustContext?.guardianPrincipalId ?? undefined,
           toolName: msg.toolName,
+          commandPreview:
+            redactSecrets(
+              summarizeToolInput(msg.toolName, inputRecord),
+            ) || undefined,
+          riskLevel: msg.riskLevel,
+          activityText: activityRaw
+            ? redactSecrets(activityRaw)
+            : undefined,
+          executionTarget: msg.executionTarget,
           status: "pending",
           requestCode: generateCanonicalRequestCode(),
           expiresAt: Date.now() + 5 * 60 * 1000,
@@ -545,14 +568,68 @@ export class DaemonServer {
         params.conversationKey,
       );
       const conversation = await this.getOrCreateConversation(conversationId);
+
+      // Register file-backed attachments so they flow through the send
+      // pipeline as images the LLM can see directly.
+      const attachmentIds: string[] = [];
+      const resolvedAttachments: UserMessageAttachment[] = [];
+      if (params.attachments && params.attachments.length > 0) {
+        for (const a of params.attachments) {
+          try {
+            const size = statSync(a.path).size;
+            const stored = attachmentsStore.uploadFileBackedAttachment(
+              a.filename,
+              a.mimeType,
+              a.path,
+              size,
+            );
+            attachmentIds.push(stored.id);
+            const fileData = readFileSync(a.path).toString("base64");
+            resolvedAttachments.push({
+              id: stored.id,
+              filename: a.filename,
+              mimeType: a.mimeType,
+              data: fileData,
+              filePath: a.path,
+            });
+          } catch (err) {
+            log.warn(
+              { err, path: a.path },
+              "Failed to register signal attachment",
+            );
+          }
+        }
+      }
+
+      // Build a hub-publishing sender so events reach SSE clients.
+      const hubSender = (msg: ServerMessage) => {
+        const msgConversationId =
+          "conversationId" in msg &&
+          typeof (msg as { conversationId?: unknown }).conversationId ===
+            "string"
+            ? (msg as { conversationId: string }).conversationId
+            : undefined;
+        const event = buildAssistantEvent(
+          DAEMON_INTERNAL_ASSISTANT_ID,
+          msg,
+          msgConversationId ?? conversationId,
+        );
+        assistantEventHub.publish(event).catch((err) => {
+          log.warn(
+            { err },
+            "assistant-events hub subscriber threw during signal user-message",
+          );
+        });
+      };
+
       if (conversation.isProcessing()) {
         const requestId = crypto.randomUUID();
         const resolvedChannel = resolveTurnChannel(params.sourceChannel);
         const resolvedInterface = resolveTurnInterface(params.sourceInterface);
         const result = conversation.enqueueMessage(
           params.content,
-          [],
-          () => {},
+          resolvedAttachments,
+          hubSender,
           requestId,
           undefined,
           undefined,
@@ -568,8 +645,8 @@ export class DaemonServer {
       await this.persistAndProcessMessage(
         conversationId,
         params.content,
-        undefined,
-        undefined,
+        attachmentIds.length > 0 ? attachmentIds : undefined,
+        { onEvent: hubSender },
         params.sourceChannel,
         params.sourceInterface,
       );
@@ -773,6 +850,7 @@ export class DaemonServer {
           (msg) => this.broadcast(msg),
           memoryPolicy,
           sharedCesClient,
+          storedOptions?.speed,
         );
         newConversation.updateClient(sendToClient, true);
         await newConversation.loadFromDb();
@@ -885,9 +963,29 @@ export class DaemonServer {
     conversation.setAssistantId(
       options?.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
     );
-    conversation.setTrustContext(options?.trustContext ?? null);
-    conversation.setAuthContext(options?.authContext ?? null);
+    // Only overwrite trust/auth context when explicitly provided. Callers that
+    // don't supply a trust context (e.g. signal-injected messages) should
+    // inherit whatever the conversation already has from a prior session.
+    if (options?.trustContext !== undefined) {
+      conversation.setTrustContext(options.trustContext);
+    }
+    if (options?.authContext !== undefined) {
+      conversation.setAuthContext(options.authContext);
+    }
     await conversation.ensureActorScopedHistory();
+
+    // Persist the conversation's current trust/auth context so it survives
+    // eviction and recreation. The restore path in getOrCreateConversation
+    // reads from storedOptions.trustContext / storedOptions.authContext.
+    const currentTrust = conversation.trustContext;
+    const currentAuth = conversation.authContext;
+    if (currentTrust || currentAuth) {
+      this.conversationOptions.set(conversationId, {
+        ...this.conversationOptions.get(conversationId),
+        ...(currentTrust ? { trustContext: currentTrust } : {}),
+        ...(currentAuth ? { authContext: currentAuth } : {}),
+      });
+    }
     conversation.setChannelCapabilities(
       resolveChannelCapabilities(
         sourceChannel,
@@ -1155,6 +1253,54 @@ export class DaemonServer {
       return { messageId: persisted.id };
     }
 
+    if (slashResult.kind === "compact") {
+      const serverTurnCtx = conversation.getTurnChannelContext();
+      const serverProvenance = provenanceFromTrustContext(
+        conversation.trustContext,
+      );
+      const compactChannelMeta = {
+        ...serverProvenance,
+        ...(serverTurnCtx
+          ? {
+              userMessageChannel: serverTurnCtx.userMessageChannel,
+              assistantMessageChannel: serverTurnCtx.assistantMessageChannel,
+            }
+          : {}),
+        ...(serverInterfaceCtx
+          ? {
+              userMessageInterface: serverInterfaceCtx.userMessageInterface,
+              assistantMessageInterface:
+                serverInterfaceCtx.assistantMessageInterface,
+            }
+          : {}),
+      };
+      const cleanMsg = createUserMessage(content, attachments);
+      const persisted = await addMessage(
+        conversationId,
+        "user",
+        JSON.stringify(cleanMsg.content),
+        compactChannelMeta,
+      );
+      conversation.getMessages().push(cleanMsg);
+
+      conversation.emitActivityState(
+        "thinking",
+        "context_compacting",
+        "assistant_turn",
+      );
+      const result = await conversation.forceCompact();
+      const responseText = formatCompactResult(result);
+      const assistantMsg = createAssistantMessage(responseText);
+      await addMessage(
+        conversationId,
+        "assistant",
+        JSON.stringify(assistantMsg.content),
+        compactChannelMeta,
+      );
+      conversation.getMessages().push(assistantMsg);
+      return { messageId: persisted.id };
+    }
+
     const resolvedContent = slashResult.content;
 
     const requestId = crypto.randomUUID();

package/src/daemon/watch-handler.ts

@@ -1,3 +1,4 @@
+import { recordRequestLog } from "../memory/llm-request-log-store.js";
 import {
   extractText,
   getConfiguredProvider,
@@ -20,11 +21,16 @@ import type { WatchObservation } from "./message-protocol.js";
 const log = getLogger("watch-handler");
 
 /**
- * Module-level maps to store commentary/summary text so that session
- * notifier callbacks can retrieve it from the WatchSession's conversationId.
+ * Module-level maps to store commentary/summary text (and associated LLM log
+ * IDs) so that session notifier callbacks can retrieve them from the
+ * WatchSession's conversationId and link logs to the persisted message.
  */
-export const lastCommentaryByConversation = new Map<string, string>();
-export const lastSummaryByConversation = new Map<string, string>();
+export interface WatchResult {
+  text: string;
+  logIds: string[];
+}
+export const lastCommentaryByConversation = new Map<string, WatchResult>();
+export const lastSummaryByConversation = new Map<string, WatchResult>();
 
 export async function handleWatchObservation(
   msg: WatchObservation,
@@ -116,15 +122,15 @@ async function generateCommentary(session: WatchSession): Promise<void> {
       return;
     }
     const lastThree = session.observations.slice(-3);
-    const previousCommentary = lastCommentaryByConversation.get(
+    const previousResult = lastCommentaryByConversation.get(
       session.conversationId,
     );
 
     const userContent = [
       `Focus area: ${session.focusArea}`,
       "",
-      previousCommentary
-        ? `Previous commentary: "${previousCommentary}"`
+      previousResult
+        ? `Previous commentary: "${previousResult.text}"`
         : "No previous commentary yet.",
       "",
       ...lastThree.map(
@@ -164,10 +170,29 @@ async function generateCommentary(session: WatchSession): Promise<void> {
       },
     );
 
+    const logIds: string[] = [];
+    if (response.rawRequest && response.rawResponse) {
+      try {
+        const logId = recordRequestLog(
+          session.conversationId,
+          JSON.stringify(response.rawRequest),
+          JSON.stringify(response.rawResponse),
+          undefined,
+          response.actualProvider ?? provider.name,
+        );
+        logIds.push(logId);
+      } catch (err) {
+        log.warn({ err }, "Failed to persist watch commentary LLM log");
+      }
+    }
+
     const commentaryText = extractText(response);
 
     if (commentaryText && commentaryText !== "SKIP") {
-      lastCommentaryByConversation.set(session.conversationId, commentaryText);
+      lastCommentaryByConversation.set(session.conversationId, {
+        text: commentaryText,
+        logIds,
+      });
       fireWatchCommentaryNotifier(session.conversationId, session);
       session.commentaryCount++;
     }
@@ -206,10 +231,10 @@ export async function generateSummary(session: WatchSession): Promise<void> {
         { watchId: session.watchId },
         "Configured provider unavailable for summary generation",
       );
-      lastSummaryByConversation.set(
-        session.conversationId,
-        "[error] Configured provider unavailable. Check your settings.",
-      );
+      lastSummaryByConversation.set(session.conversationId, {
+        text: "[error] Configured provider unavailable. Check your settings.",
+        logIds: [],
+      });
       fireWatchCompletionNotifier(session.conversationId, session);
       return;
     }
@@ -310,6 +335,22 @@ export async function generateSummary(session: WatchSession): Promise<void> {
       },
     );
 
+    const logIds: string[] = [];
+    if (response.rawRequest && response.rawResponse) {
+      try {
+        const logId = recordRequestLog(
+          session.conversationId,
+          JSON.stringify(response.rawRequest),
+          JSON.stringify(response.rawResponse),
+          undefined,
+          response.actualProvider ?? provider.name,
+        );
+        logIds.push(logId);
+      } catch (err) {
+        log.warn({ err }, "Failed to persist watch summary LLM log");
+      }
+    }
+
     log.debug(
       { watchId: session.watchId },
       "LLM API call completed successfully",
@@ -323,7 +364,10 @@ export async function generateSummary(session: WatchSession): Promise<void> {
     );
 
     if (summaryText) {
-      lastSummaryByConversation.set(session.conversationId, summaryText);
+      lastSummaryByConversation.set(session.conversationId, {
+        text: summaryText,
+        logIds,
+      });
       log.debug(
         { watchId: session.watchId, conversationId: session.conversationId },
         "Firing completion notifier with summary",
@@ -334,10 +378,10 @@ export async function generateSummary(session: WatchSession): Promise<void> {
         { watchId: session.watchId },
         "Summary was empty from API response",
       );
-      lastSummaryByConversation.set(
-        session.conversationId,
-        "[error] The API returned an empty summary. This may indicate a service issue.",
-      );
+      lastSummaryByConversation.set(session.conversationId, {
+        text: "[error] The API returned an empty summary. This may indicate a service issue.",
+        logIds,
+      });
       fireWatchCompletionNotifier(session.conversationId, session);
     }
   } catch (err) {
@@ -346,10 +390,10 @@ export async function generateSummary(session: WatchSession): Promise<void> {
       "Error generating watch summary — LLM API call failed",
     );
     const message = err instanceof Error ? err.message : String(err);
-    lastSummaryByConversation.set(
-      session.conversationId,
-      `[error] Summary generation failed: ${message}`,
-    );
+    lastSummaryByConversation.set(session.conversationId, {
+      text: `[error] Summary generation failed: ${message}`,
+      logIds: [],
+    });
     fireWatchCompletionNotifier(session.conversationId, session);
   }
 }

package/src/email/guardrails.ts

@@ -8,7 +8,7 @@ import { join } from "node:path";
 
 import { minimatch } from "minimatch";
 
-import { getRootDir } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
 
 export interface AddressRule {
   id: string;
@@ -36,7 +36,7 @@ const DEFAULT_STATE: GuardrailsState = {
 };
 
 function getGuardrailsPath(): string {
-  return join(getRootDir(), "email-guardrails.json");
+  return join(getWorkspaceDir(), "email-guardrails.json");
 }
 
 function loadState(): GuardrailsState {
@@ -59,7 +59,7 @@ function loadState(): GuardrailsState {
 
 function saveState(state: GuardrailsState): void {
   const path = getGuardrailsPath();
-  const dir = join(getRootDir());
+  const dir = getWorkspaceDir();
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true });
   }

package/src/heartbeat/heartbeat-service.ts

@@ -1,20 +1,24 @@
 import { getConfig } from "../config/loader.js";
+import type { Speed } from "../config/schemas/inference.js";
 import type { HeartbeatAlert } from "../daemon/message-protocol.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { readTextFileSync } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
 import { getWorkspacePromptPath } from "../util/platform.js";
+import { stripCommentLines } from "../util/strip-comment-lines.js";
 
 const log = getLogger("heartbeat-check");
 
-const DEFAULT_CHECKLIST = `- Check the current weather and note anything notable
-- Review any recent news headlines worth flagging
-- Look for calendar events or reminders coming up soon`;
+const DEFAULT_CHECKLIST = `- Check in with yourself. Read NOW.md. Is it still accurate? Update it if anything has changed.
+- Think about your user. Is there anything from recent conversations you should follow up on? Anything you noticed that you should bring up?
+- Check if there's anything on the horizon — events, deadlines, things they mentioned wanting to do.
+- If you have a thought worth sharing, send it. A follow-up, a useful find, a check-in. Not every beat, but when it feels right.`;
 
 export interface HeartbeatDeps {
   processMessage: (
     conversationId: string,
     content: string,
+    options?: { speed?: Speed },
   ) => Promise<{ messageId: string }>;
   alerter: (alert: HeartbeatAlert) => void;
   onConversationCreated?: (info: {
@@ -167,6 +171,7 @@ export class HeartbeatService {
     log.info("Running heartbeat");
 
     try {
+      const config = getConfig().heartbeat;
       const checklist = this.readChecklist();
       const prompt = this.buildPrompt(checklist);
 
@@ -182,7 +187,9 @@ export class HeartbeatService {
         title: "Heartbeat",
       });
 
-      await this.deps.processMessage(conversation.id, prompt);
+      await this.deps.processMessage(conversation.id, prompt, {
+        speed: config.speed,
+      });
       log.info({ conversationId: conversation.id }, "Heartbeat completed");
     } catch (err) {
       log.error({ err }, "Heartbeat failed");
@@ -199,10 +206,10 @@ export class HeartbeatService {
   }
 
   private readChecklist(): string {
-    return (
+    const raw =
       readTextFileSync(getWorkspacePromptPath("HEARTBEAT.md")) ??
-      DEFAULT_CHECKLIST
-    );
+      DEFAULT_CHECKLIST;
+    return stripCommentLines(raw);
   }
 
   /** @internal Exposed for testing. */

package/src/hooks/cli.ts

@@ -5,7 +5,7 @@ import { Command } from "commander";
 
 import { pathExists } from "../util/fs.js";
 import { getCliLogger } from "../util/logger.js";
-import { getHooksDir } from "../util/platform.js";
+import { getWorkspaceHooksDir } from "../util/platform.js";
 import { ensureHookInConfig, removeHook, setHookEnabled } from "./config.js";
 import { discoverHooks, isValidInstallManifest } from "./discovery.js";
 
@@ -171,7 +171,7 @@ Examples:
         process.exit(1);
       }
 
-      const hooksDir = getHooksDir();
+      const hooksDir = getWorkspaceHooksDir();
       const resolvedHooksDir = resolve(hooksDir);
       const targetDir = resolve(join(hooksDir, manifest.name));
       if (!targetDir.startsWith(resolvedHooksDir + sep)) {

package/src/hooks/config.ts

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 
 import { ensureDir, readTextFileSync } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
-import { getHooksDir } from "../util/platform.js";
+import { getWorkspaceHooksDir } from "../util/platform.js";
 import type { HookConfig, HookConfigEntry, HookManifest } from "./types.js";
 
 const log = getLogger("hooks-config");
@@ -11,7 +11,7 @@ const log = getLogger("hooks-config");
 const HOOKS_CONFIG_VERSION = 1;
 
 function getConfigPath(): string {
-  return join(getHooksDir(), "config.json");
+  return join(getWorkspaceHooksDir(), "config.json");
 }
 
 export function loadHooksConfig(): HookConfig {

package/src/hooks/discovery.ts

@@ -3,7 +3,7 @@ import { join, relative, resolve } from "node:path";
 
 import { pathExists } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
-import { getHooksDir } from "../util/platform.js";
+import { getWorkspaceHooksDir } from "../util/platform.js";
 import { loadHooksConfig } from "./config.js";
 import type { DiscoveredHook, HookManifest } from "./types.js";
 
@@ -64,7 +64,7 @@ export function isValidInstallManifest(
 }
 
 export function discoverHooks(hooksDir?: string): DiscoveredHook[] {
-  const dir = hooksDir ?? getHooksDir();
+  const dir = hooksDir ?? getWorkspaceHooksDir();
   if (!pathExists(dir)) return [];
 
   const config = loadHooksConfig();

package/src/hooks/manager.ts

@@ -4,7 +4,7 @@ import { getIsContainerized } from "../config/env-registry.js";
 import { Debouncer } from "../util/debounce.js";
 import { pathExists } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
-import { getHooksDir } from "../util/platform.js";
+import { getWorkspaceHooksDir } from "../util/platform.js";
 import { discoverHooks } from "./discovery.js";
 import { runHookScript } from "./runner.js";
 import type {
@@ -121,7 +121,7 @@ export class HookManager {
 
   watch(): void {
     if (getIsContainerized()) return;
-    const hooksDir = getHooksDir();
+    const hooksDir = getWorkspaceHooksDir();
     if (!pathExists(hooksDir)) return;
 
     this.stopWatching();

package/src/hooks/runner.ts

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { basename, extname, join } from "node:path";
 
 import { pathExists } from "../util/fs.js";
-import { getRootDir, getWorkspaceDir } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
 import { getHookSettings } from "./config.js";
 import type { DiscoveredHook, HookEventData } from "./types.js";
 
@@ -69,7 +69,10 @@ export async function runHookScript(
         ...process.env,
         VELLUM_HOOK_EVENT: eventData.event,
         VELLUM_HOOK_NAME: hook.name,
-        VELLUM_ROOT_DIR: getRootDir(),
+        // @deprecated — usage of VELLUM_ROOT_DIR by hook scripts is deprecated.
+        // Removing this requires an LLM-based migration or declarative migration
+        // file to update existing user-authored hooks to use VELLUM_WORKSPACE_DIR.
+        VELLUM_ROOT_DIR: join(homedir(), ".vellum"),
         VELLUM_WORKSPACE_DIR: getWorkspaceDir(),
         VELLUM_HOOK_SETTINGS: JSON.stringify(
           getHookSettings(hook.name, hook.manifest),

package/src/hooks/templates.ts

@@ -11,7 +11,7 @@ import { join } from "node:path";
 import { resolveBundledDir } from "../util/bundled-asset.js";
 import { pathExists } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
-import { getHooksDir } from "../util/platform.js";
+import { getWorkspaceHooksDir } from "../util/platform.js";
 import { ensureHookInConfig } from "./config.js";
 
 const log = getLogger("hooks-templates");
@@ -30,7 +30,7 @@ export function installTemplates(): void {
   );
   if (!pathExists(templatesDir)) return;
 
-  const hooksDir = getHooksDir();
+  const hooksDir = getWorkspaceHooksDir();
   const entries = readdirSync(templatesDir, {
     withFileTypes: true,
   }) as Dirent[];