@vellumai/assistant 0.5.4 → 0.5.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (151) hide show
  1. package/Dockerfile +17 -27
  2. package/node_modules/@vellumai/ces-contracts/src/index.ts +1 -0
  3. package/node_modules/@vellumai/ces-contracts/src/trust-rules.ts +42 -0
  4. package/package.json +1 -1
  5. package/src/__tests__/actor-token-service.test.ts +113 -0
  6. package/src/__tests__/config-schema.test.ts +2 -2
  7. package/src/__tests__/context-window-manager.test.ts +78 -0
  8. package/src/__tests__/conversation-title-service.test.ts +30 -1
  9. package/src/__tests__/credential-security-invariants.test.ts +2 -0
  10. package/src/__tests__/docker-signing-key-bootstrap.test.ts +207 -0
  11. package/src/__tests__/memory-regressions.test.ts +8 -30
  12. package/src/__tests__/openai-whisper.test.ts +93 -0
  13. package/src/__tests__/require-fresh-approval.test.ts +4 -0
  14. package/src/__tests__/slack-messaging-token-resolution.test.ts +319 -0
  15. package/src/__tests__/tool-executor-lifecycle-events.test.ts +4 -0
  16. package/src/__tests__/tool-executor.test.ts +4 -0
  17. package/src/__tests__/volume-security-guard.test.ts +155 -0
  18. package/src/cli/commands/conversations.ts +0 -18
  19. package/src/config/bundled-skills/messaging/tools/shared.ts +1 -0
  20. package/src/config/bundled-skills/transcribe/tools/transcribe-media.ts +16 -37
  21. package/src/config/env-registry.ts +9 -0
  22. package/src/config/env.ts +8 -2
  23. package/src/config/feature-flag-registry.json +8 -8
  24. package/src/config/schema.ts +0 -12
  25. package/src/config/schemas/memory.ts +0 -4
  26. package/src/config/schemas/platform.ts +1 -1
  27. package/src/config/schemas/security.ts +4 -0
  28. package/src/context/window-manager.ts +53 -2
  29. package/src/credential-execution/managed-catalog.ts +5 -15
  30. package/src/daemon/conversation-agent-loop.ts +0 -60
  31. package/src/daemon/conversation-memory.ts +0 -117
  32. package/src/daemon/conversation-runtime-assembly.ts +0 -2
  33. package/src/daemon/daemon-control.ts +7 -0
  34. package/src/daemon/handlers/conversations.ts +0 -11
  35. package/src/daemon/lifecycle.ts +10 -47
  36. package/src/daemon/providers-setup.ts +2 -1
  37. package/src/followups/followup-store.ts +5 -2
  38. package/src/hooks/manager.ts +7 -0
  39. package/src/instrument.ts +33 -1
  40. package/src/memory/conversation-crud.ts +0 -236
  41. package/src/memory/conversation-title-service.ts +26 -10
  42. package/src/memory/db-init.ts +5 -13
  43. package/src/memory/embedding-local.ts +11 -5
  44. package/src/memory/indexer.ts +15 -106
  45. package/src/memory/job-handlers/conversation-starters.ts +24 -36
  46. package/src/memory/job-handlers/embedding.ts +0 -79
  47. package/src/memory/job-utils.ts +1 -1
  48. package/src/memory/jobs-store.ts +0 -8
  49. package/src/memory/jobs-worker.ts +0 -20
  50. package/src/memory/migrations/189-drop-simplified-memory.ts +42 -0
  51. package/src/memory/migrations/index.ts +1 -3
  52. package/src/memory/qdrant-client.ts +4 -6
  53. package/src/memory/schema/conversations.ts +0 -3
  54. package/src/memory/schema/index.ts +0 -2
  55. package/src/messaging/draft-store.ts +2 -2
  56. package/src/messaging/provider.ts +9 -0
  57. package/src/messaging/providers/slack/adapter.ts +29 -2
  58. package/src/oauth/connection-resolver.test.ts +22 -18
  59. package/src/oauth/connection-resolver.ts +92 -7
  60. package/src/oauth/platform-connection.test.ts +78 -69
  61. package/src/oauth/platform-connection.ts +12 -19
  62. package/src/permissions/defaults.ts +3 -3
  63. package/src/permissions/trust-client.ts +332 -0
  64. package/src/permissions/trust-store-interface.ts +105 -0
  65. package/src/permissions/trust-store.ts +531 -39
  66. package/src/platform/client.test.ts +148 -0
  67. package/src/platform/client.ts +71 -0
  68. package/src/providers/speech-to-text/openai-whisper.test.ts +190 -0
  69. package/src/providers/speech-to-text/openai-whisper.ts +68 -0
  70. package/src/providers/speech-to-text/resolve.ts +9 -0
  71. package/src/providers/speech-to-text/types.ts +17 -0
  72. package/src/runtime/auth/route-policy.ts +14 -0
  73. package/src/runtime/auth/token-service.ts +133 -0
  74. package/src/runtime/http-server.ts +4 -2
  75. package/src/runtime/routes/conversation-management-routes.ts +0 -36
  76. package/src/runtime/routes/conversation-query-routes.ts +44 -2
  77. package/src/runtime/routes/conversation-routes.ts +2 -1
  78. package/src/runtime/routes/inbound-message-handler.ts +27 -3
  79. package/src/runtime/routes/inbound-stages/acl-enforcement.ts +16 -1
  80. package/src/runtime/routes/inbound-stages/transcribe-audio.test.ts +287 -0
  81. package/src/runtime/routes/inbound-stages/transcribe-audio.ts +122 -0
  82. package/src/runtime/routes/log-export-routes.ts +1 -0
  83. package/src/runtime/routes/memory-item-routes.test.ts +221 -3
  84. package/src/runtime/routes/memory-item-routes.ts +124 -2
  85. package/src/runtime/routes/secret-routes.ts +4 -1
  86. package/src/runtime/routes/upgrade-broadcast-routes.ts +151 -0
  87. package/src/schedule/schedule-store.ts +0 -21
  88. package/src/security/ces-credential-client.ts +173 -0
  89. package/src/security/secure-keys.ts +65 -22
  90. package/src/signals/bash.ts +3 -0
  91. package/src/signals/cancel.ts +3 -0
  92. package/src/signals/confirm.ts +3 -0
  93. package/src/signals/conversation-undo.ts +3 -0
  94. package/src/signals/event-stream.ts +7 -0
  95. package/src/signals/shotgun.ts +3 -0
  96. package/src/signals/trust-rule.ts +3 -0
  97. package/src/skills/inline-command-render.ts +5 -1
  98. package/src/skills/inline-command-runner.ts +30 -2
  99. package/src/telemetry/usage-telemetry-reporter.test.ts +23 -36
  100. package/src/telemetry/usage-telemetry-reporter.ts +21 -19
  101. package/src/tools/memory/handlers.ts +1 -129
  102. package/src/tools/permission-checker.ts +18 -0
  103. package/src/tools/skills/load.ts +9 -2
  104. package/src/util/device-id.ts +70 -7
  105. package/src/util/logger.ts +35 -9
  106. package/src/util/platform.ts +29 -5
  107. package/src/util/xml.ts +8 -0
  108. package/src/workspace/heartbeat-service.ts +5 -24
  109. package/src/workspace/migrations/migrate-to-workspace-volume.ts +113 -0
  110. package/src/workspace/migrations/registry.ts +2 -0
  111. package/src/__tests__/archive-recall.test.ts +0 -560
  112. package/src/__tests__/conversation-memory-dirty-tail.test.ts +0 -150
  113. package/src/__tests__/conversation-switch-memory-reduction.test.ts +0 -474
  114. package/src/__tests__/db-memory-archive-migration.test.ts +0 -372
  115. package/src/__tests__/db-memory-brief-state-migration.test.ts +0 -213
  116. package/src/__tests__/db-memory-reducer-checkpoints.test.ts +0 -273
  117. package/src/__tests__/memory-brief-open-loops.test.ts +0 -530
  118. package/src/__tests__/memory-brief-time.test.ts +0 -285
  119. package/src/__tests__/memory-brief-wrapper.test.ts +0 -311
  120. package/src/__tests__/memory-chunk-archive.test.ts +0 -400
  121. package/src/__tests__/memory-chunk-dual-write.test.ts +0 -453
  122. package/src/__tests__/memory-episode-archive.test.ts +0 -370
  123. package/src/__tests__/memory-episode-dual-write.test.ts +0 -626
  124. package/src/__tests__/memory-observation-archive.test.ts +0 -375
  125. package/src/__tests__/memory-observation-dual-write.test.ts +0 -318
  126. package/src/__tests__/memory-reducer-job.test.ts +0 -538
  127. package/src/__tests__/memory-reducer-scheduling.test.ts +0 -473
  128. package/src/__tests__/memory-reducer-store.test.ts +0 -728
  129. package/src/__tests__/memory-reducer-types.test.ts +0 -707
  130. package/src/__tests__/memory-reducer.test.ts +0 -704
  131. package/src/__tests__/memory-simplified-config.test.ts +0 -281
  132. package/src/__tests__/simplified-memory-e2e.test.ts +0 -666
  133. package/src/__tests__/simplified-memory-runtime.test.ts +0 -616
  134. package/src/config/schemas/memory-simplified.ts +0 -101
  135. package/src/memory/archive-recall.ts +0 -516
  136. package/src/memory/archive-store.ts +0 -400
  137. package/src/memory/brief-formatting.ts +0 -33
  138. package/src/memory/brief-open-loops.ts +0 -266
  139. package/src/memory/brief-time.ts +0 -162
  140. package/src/memory/brief.ts +0 -75
  141. package/src/memory/job-handlers/backfill-simplified-memory.ts +0 -462
  142. package/src/memory/job-handlers/reduce-conversation-memory.ts +0 -229
  143. package/src/memory/migrations/185-memory-brief-state.ts +0 -52
  144. package/src/memory/migrations/186-memory-archive.ts +0 -109
  145. package/src/memory/migrations/187-memory-reducer-checkpoints.ts +0 -19
  146. package/src/memory/reducer-scheduler.ts +0 -242
  147. package/src/memory/reducer-store.ts +0 -271
  148. package/src/memory/reducer-types.ts +0 -106
  149. package/src/memory/reducer.ts +0 -467
  150. package/src/memory/schema/memory-archive.ts +0 -121
  151. package/src/memory/schema/memory-brief.ts +0 -55
@@ -1,271 +0,0 @@
1
- /**
2
- * Reducer store — transactional application of reducer results to brief-state
3
- * tables (time_contexts, open_loops) and conversation reducer checkpoints.
4
- *
5
- * The `applyReducerResult` helper is the single entry point for persisting
6
- * reducer output. It runs all upserts, resolves, and checkpoint advances
7
- * inside a single SQLite transaction so the DB is never left in a
8
- * partially-applied state.
9
- *
10
- * Archive writes are intentionally out of scope — they have their own
11
- * lifecycle and can be tested independently.
12
- */
13
-
14
- import { and, eq, gt } from "drizzle-orm";
15
- import { v4 as uuid } from "uuid";
16
-
17
- import { getLogger } from "../util/logger.js";
18
- import { getDb } from "./db.js";
19
- import type { ReducerResult } from "./reducer-types.js";
20
- import { conversations, messages, openLoops, timeContexts } from "./schema.js";
21
-
22
- const log = getLogger("reducer-store");
23
-
24
- // ── Read helpers ─────────────────────────────────────────────────────
25
-
26
- /**
27
- * Return all active (non-expired) time contexts for a memory scope.
28
- * "Active" means `activeUntil` is in the future relative to `now`.
29
- */
30
- export function getActiveTimeContexts(
31
- scopeId: string,
32
- now: number = Date.now(),
33
- ): Array<{
34
- id: string;
35
- summary: string;
36
- activeFrom: number;
37
- activeUntil: number;
38
- }> {
39
- const db = getDb();
40
- return db
41
- .select({
42
- id: timeContexts.id,
43
- summary: timeContexts.summary,
44
- activeFrom: timeContexts.activeFrom,
45
- activeUntil: timeContexts.activeUntil,
46
- })
47
- .from(timeContexts)
48
- .where(
49
- and(eq(timeContexts.scopeId, scopeId), gt(timeContexts.activeUntil, now)),
50
- )
51
- .all();
52
- }
53
-
54
- /**
55
- * Return all open loops for a memory scope.
56
- */
57
- export function getActiveOpenLoops(
58
- scopeId: string,
59
- ): Array<{ id: string; summary: string; status: string }> {
60
- const db = getDb();
61
- return db
62
- .select({
63
- id: openLoops.id,
64
- summary: openLoops.summary,
65
- status: openLoops.status,
66
- })
67
- .from(openLoops)
68
- .where(and(eq(openLoops.scopeId, scopeId), eq(openLoops.status, "open")))
69
- .all();
70
- }
71
-
72
- // ── Brief-compiler helper ────────────────────────────────────────────
73
-
74
- /**
75
- * Update the `surfaced_at` timestamp on a single open loop.
76
- *
77
- * Called by the brief compiler after resurfacing a low-salience loop
78
- * so it is not immediately resurfaced again on the next turn.
79
- */
80
- export function updateLastSurfacedAt(loopId: string, surfacedAt: number): void {
81
- const db = getDb();
82
- db.update(openLoops)
83
- .set({ surfacedAt, updatedAt: surfacedAt })
84
- .where(eq(openLoops.id, loopId))
85
- .run();
86
- }
87
-
88
- // ── Transactional apply ──────────────────────────────────────────────
89
-
90
- export interface ApplyReducerResultParams {
91
- /** The validated reducer result to persist. */
92
- result: ReducerResult;
93
- /** Conversation that was reduced. */
94
- conversationId: string;
95
- /** Memory scope for new rows (e.g. assistant instance ID). */
96
- scopeId: string;
97
- /** ID of the last message that was included in this reducer run. */
98
- reducedThroughMessageId: string;
99
- /** Current timestamp in epoch ms (injectable for testing). */
100
- now?: number;
101
- }
102
-
103
- /**
104
- * Atomically apply a reducer result to the database.
105
- *
106
- * Within a single transaction this function:
107
- * 1. Upserts time_contexts (create / update / resolve)
108
- * 2. Upserts open_loops (create / update / resolve)
109
- * 3. Advances the conversation's reducer checkpoint columns
110
- * 4. Clears `memoryDirtyTailSinceMessageId` when the conversation is
111
- * fully caught up (no messages exist after `reducedThroughMessageId`)
112
- *
113
- * Archive candidates in the result are intentionally ignored — they are
114
- * handled by a separate pipeline.
115
- *
116
- * The function is idempotent: applying the same result twice leaves the
117
- * database in the same state. Create operations use deterministic IDs
118
- * derived from the reducer output position so re-application produces
119
- * the same rows.
120
- */
121
- export function applyReducerResult(params: ApplyReducerResultParams): void {
122
- const {
123
- result,
124
- conversationId,
125
- scopeId,
126
- reducedThroughMessageId,
127
- now = Date.now(),
128
- } = params;
129
-
130
- const db = getDb();
131
-
132
- db.transaction((tx) => {
133
- // ── 1. Time contexts ───────────────────────────────────────────
134
- for (let i = 0; i < result.timeContexts.length; i++) {
135
- const op = result.timeContexts[i];
136
-
137
- if (op.action === "create") {
138
- const id = uuid();
139
- tx.insert(timeContexts)
140
- .values({
141
- id,
142
- scopeId,
143
- summary: op.summary,
144
- source: op.source,
145
- activeFrom: op.activeFrom,
146
- activeUntil: op.activeUntil,
147
- createdAt: now,
148
- updatedAt: now,
149
- })
150
- .run();
151
- } else if (op.action === "update") {
152
- const setFields: Record<string, unknown> = { updatedAt: now };
153
- if (op.summary !== undefined) setFields.summary = op.summary;
154
- if (op.activeFrom !== undefined) setFields.activeFrom = op.activeFrom;
155
- if (op.activeUntil !== undefined)
156
- setFields.activeUntil = op.activeUntil;
157
-
158
- tx.update(timeContexts)
159
- .set(setFields)
160
- .where(eq(timeContexts.id, op.id))
161
- .run();
162
- } else {
163
- // resolve — delete the row (resolved time contexts are no longer relevant)
164
- tx.delete(timeContexts).where(eq(timeContexts.id, op.id)).run();
165
- }
166
- }
167
-
168
- // ── 2. Open loops ──────────────────────────────────────────────
169
- for (let i = 0; i < result.openLoops.length; i++) {
170
- const op = result.openLoops[i];
171
-
172
- if (op.action === "create") {
173
- const id = uuid();
174
- tx.insert(openLoops)
175
- .values({
176
- id,
177
- scopeId,
178
- summary: op.summary,
179
- source: op.source,
180
- status: "open",
181
- dueAt: op.dueAt ?? null,
182
- createdAt: now,
183
- updatedAt: now,
184
- })
185
- .run();
186
- } else if (op.action === "update") {
187
- const setFields: Record<string, unknown> = { updatedAt: now };
188
- if (op.summary !== undefined) setFields.summary = op.summary;
189
- if (op.dueAt !== undefined) setFields.dueAt = op.dueAt;
190
-
191
- tx.update(openLoops)
192
- .set(setFields)
193
- .where(eq(openLoops.id, op.id))
194
- .run();
195
- } else {
196
- // resolve — mark status (resolved | expired)
197
- tx.update(openLoops)
198
- .set({ status: op.status, updatedAt: now })
199
- .where(eq(openLoops.id, op.id))
200
- .run();
201
- }
202
- }
203
-
204
- // ── 3. Advance reducer checkpoint ──────────────────────────────
205
- //
206
- // Check whether the conversation is fully caught up: no messages
207
- // exist after the one we just reduced through. If caught up, clear
208
- // the dirty tail marker so the reducer knows there's nothing left
209
- // to process.
210
- const laterMessage = tx
211
- .select({ id: messages.id })
212
- .from(messages)
213
- .where(
214
- and(
215
- eq(messages.conversationId, conversationId),
216
- gt(
217
- messages.createdAt,
218
- getMessageCreatedAt(tx, reducedThroughMessageId),
219
- ),
220
- ),
221
- )
222
- .limit(1)
223
- .get();
224
-
225
- const isCaughtUp = !laterMessage;
226
-
227
- const checkpointUpdate: Record<string, unknown> = {
228
- memoryReducedThroughMessageId: reducedThroughMessageId,
229
- memoryLastReducedAt: now,
230
- };
231
-
232
- if (isCaughtUp) {
233
- checkpointUpdate.memoryDirtyTailSinceMessageId = null;
234
- }
235
-
236
- tx.update(conversations)
237
- .set(checkpointUpdate)
238
- .where(eq(conversations.id, conversationId))
239
- .run();
240
-
241
- log.debug(
242
- {
243
- conversationId,
244
- reducedThroughMessageId,
245
- timeContextOps: result.timeContexts.length,
246
- openLoopOps: result.openLoops.length,
247
- isCaughtUp,
248
- },
249
- "Applied reducer result",
250
- );
251
- });
252
- }
253
-
254
- // ── Internal helpers ─────────────────────────────────────────────────
255
-
256
- /**
257
- * Get the createdAt timestamp for a message by ID.
258
- * Returns 0 if the message doesn't exist (which means the gt() comparison
259
- * will match all messages — safe fallback that prevents clearing dirty tail).
260
- */
261
- function getMessageCreatedAt(
262
- tx: Parameters<Parameters<ReturnType<typeof getDb>["transaction"]>[0]>[0],
263
- messageId: string,
264
- ): number {
265
- const row = tx
266
- .select({ createdAt: messages.createdAt })
267
- .from(messages)
268
- .where(eq(messages.id, messageId))
269
- .get();
270
- return row?.createdAt ?? 0;
271
- }
@@ -1,106 +0,0 @@
1
- /**
2
- * Structured result types for the simplified memory reducer.
3
- *
4
- * The reducer processes conversation turns and produces CRUD operations for
5
- * two brief-state tables (time_contexts, open_loops) and optional archive
6
- * candidates (observations, episodes).
7
- *
8
- * These types are consumed by the reducer parser/validator and eventually by
9
- * the DB-write layer that applies them atomically.
10
- */
11
-
12
- // ── Time-context CRUD ──────────────────────────────────────────────────
13
-
14
- export interface TimeContextCreate {
15
- action: "create";
16
- summary: string;
17
- source: string;
18
- activeFrom: number; // epoch ms
19
- activeUntil: number; // epoch ms
20
- }
21
-
22
- export interface TimeContextUpdate {
23
- action: "update";
24
- id: string;
25
- summary?: string;
26
- activeFrom?: number;
27
- activeUntil?: number;
28
- }
29
-
30
- export interface TimeContextResolve {
31
- action: "resolve";
32
- id: string;
33
- }
34
-
35
- export type TimeContextOp =
36
- | TimeContextCreate
37
- | TimeContextUpdate
38
- | TimeContextResolve;
39
-
40
- // ── Open-loop CRUD ─────────────────────────────────────────────────────
41
-
42
- export interface OpenLoopCreate {
43
- action: "create";
44
- summary: string;
45
- source: string;
46
- dueAt?: number; // epoch ms, optional deadline
47
- }
48
-
49
- export interface OpenLoopUpdate {
50
- action: "update";
51
- id: string;
52
- summary?: string;
53
- dueAt?: number;
54
- }
55
-
56
- export interface OpenLoopResolve {
57
- action: "resolve";
58
- id: string;
59
- status: "resolved" | "expired";
60
- }
61
-
62
- export type OpenLoopOp = OpenLoopCreate | OpenLoopUpdate | OpenLoopResolve;
63
-
64
- // ── Archive candidates ─────────────────────────────────────────────────
65
-
66
- export interface ArchiveObservationCandidate {
67
- content: string;
68
- role: string;
69
- modality?: string;
70
- source?: string;
71
- }
72
-
73
- export interface ArchiveEpisodeCandidate {
74
- title: string;
75
- summary: string;
76
- source?: string;
77
- }
78
-
79
- // ── Top-level reducer result ───────────────────────────────────────────
80
-
81
- export interface ReducerResult {
82
- timeContexts: TimeContextOp[];
83
- openLoops: OpenLoopOp[];
84
- archiveObservations: ArchiveObservationCandidate[];
85
- archiveEpisodes: ArchiveEpisodeCandidate[];
86
- }
87
-
88
- /**
89
- * Sentinel empty result returned when the reducer output is **unparseable**
90
- * (not valid JSON, not a JSON object, provider failure, etc.).
91
- *
92
- * Callers use identity comparison (`=== EMPTY_REDUCER_RESULT`) to detect
93
- * true parse failures and skip checkpoint advancement so the job can retry.
94
- *
95
- * A valid-but-empty model response (e.g. `{}`) returns a normal
96
- * `ReducerResult` with all empty arrays — NOT this sentinel — so the
97
- * checkpoint advances and the dirty tail is cleared.
98
- */
99
- export const EMPTY_REDUCER_RESULT: Readonly<ReducerResult> = Object.freeze({
100
- timeContexts: Object.freeze([]) as unknown as TimeContextOp[],
101
- openLoops: Object.freeze([]) as unknown as OpenLoopOp[],
102
- archiveObservations: Object.freeze(
103
- [],
104
- ) as unknown as ArchiveObservationCandidate[],
105
- archiveEpisodes: Object.freeze([]) as unknown as ArchiveEpisodeCandidate[],
106
- });