@vellumai/assistant 0.5.5 → 0.5.7

package/src/memory/migrations/validate-migration-state.ts

@@ -33,7 +33,9 @@ export function recoverCrashedMigrations(database: DrizzleDb): string[] {
     return [];
   }
 
-  const crashed = rows.filter((r) => r.value === "started").map((r) => r.key);
+  const crashed = rows
+    .filter((r) => r.value === "started" || r.value === "rolling_back")
+    .map((r) => r.key);
   if (crashed.length === 0) return [];
 
   log.error(
@@ -83,7 +85,12 @@ export function withCrashRecovery(
   const existing = raw
     .query(`SELECT value FROM memory_checkpoints WHERE key = ?`)
     .get(checkpointKey) as { value: string } | null;
-  if (existing && existing.value !== "started") return;
+  if (
+    existing &&
+    existing.value !== "started" &&
+    existing.value !== "rolling_back"
+  )
+    return;
 
   raw
     .query(
@@ -126,12 +133,14 @@ export function validateMigrationState(
       .all() as Array<{ key: string; value: string }>;
   } catch {
     // memory_checkpoints may not exist on a very old database; skip.
-    return { crashed: [], dependencyViolations: [] };
+    return { crashed: [], dependencyViolations: [], unknownCheckpoints: [] };
   }
 
-  // Any remaining 'started' checkpoints after recovery + migration execution
-  // indicate a migration that was retried but failed again.
-  const crashed = rows.filter((r) => r.value === "started").map((r) => r.key);
+  // Any remaining 'started' or 'rolling_back' checkpoints after recovery +
+  // migration execution indicate a migration that was retried but failed again.
+  const crashed = rows
+    .filter((r) => r.value === "started" || r.value === "rolling_back")
+    .map((r) => r.key);
   if (crashed.length > 0) {
     log.error(
       { crashed },
@@ -149,11 +158,14 @@ export function validateMigrationState(
     );
   }
 
-  // Only rows whose value is NOT 'started' represent truly completed migrations.
-  // In-progress/crashed checkpoints (value = 'started') must not count as applied
-  // dependencies — the migration never finished, so its postconditions are unmet.
+  // Only rows whose value is NOT 'started' or 'rolling_back' represent truly
+  // completed migrations. In-progress/crashed checkpoints must not count as
+  // applied dependencies — the migration never finished, so its postconditions
+  // are unmet.
   const completed = new Set(
-    rows.filter((r) => r.value !== "started").map((r) => r.key),
+    rows
+      .filter((r) => r.value !== "started" && r.value !== "rolling_back")
+      .map((r) => r.key),
   );
 
   const dependencyViolations: Array<{
@@ -191,5 +203,119 @@ export function validateMigrationState(
     );
   }
 
-  return { crashed, dependencyViolations };
+  // Detect checkpoints that exist in the database but have no corresponding
+  // registry entry — these are from a newer version of the daemon.
+  //
+  // The memory_checkpoints table is a general-purpose key-value store also
+  // used by non-migration subsystems (e.g., "identity:intro:text",
+  // "conversation_starters:item_count_at_last_gen"). Filter to only keys
+  // that follow migration naming conventions before comparing against the
+  // registry to avoid false-positive warnings.
+  const registryKeys = new Set(MIGRATION_REGISTRY.map((e) => e.key));
+  const isMigrationKey = (k: string): boolean =>
+    k.startsWith("migration_") ||
+    k.startsWith("backfill_") ||
+    k.startsWith("drop_");
+  const unknownCheckpoints = [...completed].filter(
+    (k) => isMigrationKey(k) && !registryKeys.has(k),
+  );
+
+  if (unknownCheckpoints.length > 0) {
+    log.warn(
+      { unknownCheckpoints },
+      `Database contains ${unknownCheckpoints.length} migration checkpoint(s) from a newer version. Data may be incompatible.`,
+    );
+  }
+
+  return { crashed, dependencyViolations, unknownCheckpoints };
+}
+
+/**
+ * Roll back all completed memory (database) migrations with version > targetVersion.
+ *
+ * Iterates eligible migrations in reverse version order. For each:
+ * 1. Marks the checkpoint as `"rolling_back"` for crash recovery.
+ * 2. Calls `entry.down(database)` — each down() manages its own transactions.
+ *    (`down` is required on `MigrationRegistryEntry` at the type level.)
+ * 3. Deletes the checkpoint from `memory_checkpoints`.
+ *
+ * **Usage**: Pass the target version number you want to roll back *to*. All
+ * migrations with a higher version number that have been applied will be
+ * reversed. For example, `rollbackMemoryMigration(db, 5)` rolls back all
+ * applied migrations with version > 5.
+ *
+ * **Checkpoint state**: Each rolled-back migration's checkpoint is deleted
+ * from `memory_checkpoints`. If the process crashes mid-rollback, the
+ * `"rolling_back"` marker is detected and cleared by
+ * `recoverCrashedMigrations` on the next startup.
+ *
+ * **Warning — data loss**: Some down() migrations may not fully restore the
+ * original state (e.g., DROP TABLE migrations recreate the table but cannot
+ * recover the original data). Review each migration's down() implementation
+ * before calling this function programmatically.
+ *
+ * **Important**: Stop the assistant before running rollbacks. Rolling back
+ * migrations while the assistant is running may cause schema mismatches,
+ * query failures, or data corruption.
+ *
+ * @param database  The Drizzle database instance.
+ * @param targetVersion  Roll back to this version (exclusive — all migrations
+ *   with version > targetVersion are reversed).
+ * @returns The list of rolled-back migration keys.
+ */
+export function rollbackMemoryMigration(
+  database: DrizzleDb,
+  targetVersion: number,
+): string[] {
+  const raw = getSqliteFrom(database);
+
+  // Read completed checkpoints to determine which migrations have been applied.
+  let rows: Array<{ key: string; value: string }>;
+  try {
+    rows = raw
+      .query(`SELECT key, value FROM memory_checkpoints`)
+      .all() as Array<{ key: string; value: string }>;
+  } catch {
+    return [];
+  }
+
+  const completedKeys = new Set(
+    rows
+      .filter((r) => r.value !== "started" && r.value !== "rolling_back")
+      .map((r) => r.key),
+  );
+
+  // Find registry entries with version > targetVersion that have completed checkpoints.
+  const toRollback = MIGRATION_REGISTRY.filter(
+    (entry) => entry.version > targetVersion && completedKeys.has(entry.key),
+  ).sort((a, b) => b.version - a.version); // reverse version order
+
+  const rolledBack: string[] = [];
+
+  for (const entry of toRollback) {
+    // Mark as rolling_back for crash recovery — if the process crashes here,
+    // recoverCrashedMigrations will clear this checkpoint on next startup.
+    raw
+      .query(
+        `UPDATE memory_checkpoints SET value = 'rolling_back', updated_at = ? WHERE key = ?`,
+      )
+      .run(Date.now(), entry.key);
+
+    // Execute the down migration — let it manage its own transaction lifecycle.
+    // Many down() functions call BEGIN/COMMIT internally or use PRAGMA statements
+    // that are no-ops inside a transaction.
+    entry.down(database);
+
+    // Delete the checkpoint after down() succeeds — outside any transaction
+    // so it's not affected by down()'s internal transaction management.
+    raw.query(`DELETE FROM memory_checkpoints WHERE key = ?`).run(entry.key);
+
+    log.info(
+      { key: entry.key, version: entry.version },
+      `Rolled back migration "${entry.key}" (version ${entry.version})`,
+    );
+    rolledBack.push(entry.key);
+  }
+
+  return rolledBack;
 }

package/src/memory/qdrant-circuit-breaker.ts

@@ -101,6 +101,15 @@ export function isQdrantBreakerOpen(): boolean {
   return breakerState !== "closed";
 }
 
+/**
+ * Returns true when the breaker is open and the cooldown has elapsed,
+ * meaning the next call to `withQdrantBreaker` will transition to half-open.
+ * Use this to allow a single probe job through when embed jobs are otherwise skipped.
+ */
+export function shouldAllowQdrantProbe(): boolean {
+  return breakerState === "open" && Date.now() - openedAt >= COOLDOWN_MS;
+}
+
 /** @internal Test-only: reset circuit breaker state */
 export function _resetQdrantBreaker(): void {
   breakerState = "closed";

package/src/memory/qdrant-client.ts

@@ -20,7 +20,7 @@ export interface QdrantClientConfig {
 }
 
 export interface QdrantPointPayload {
-  target_type: "segment" | "item" | "summary" | "observation" | "chunk" | "episode" | "media";
+  target_type: "segment" | "item" | "summary" | "media";
   target_id: string;
   text: string;
   kind?: string;
@@ -230,7 +230,7 @@ export class VellumQdrantClient {
   }
 
   async upsert(
-    targetType: "segment" | "item" | "summary" | "observation" | "chunk" | "episode" | "media",
+    targetType: "segment" | "item" | "summary" | "media",
     targetId: string,
     vector: number[],
     payload: Omit<QdrantPointPayload, "target_type" | "target_id">,
@@ -324,9 +324,7 @@ export class VellumQdrantClient {
   async searchWithFilter(
     vector: number[],
     limit: number,
-    targetTypes: Array<
-      "segment" | "item" | "summary" | "media" | "chunk" | "episode"
-    >,
+    targetTypes: Array<"segment" | "item" | "summary" | "media">,
     excludeMessageIds?: string[],
     scopeIds?: string[],
   ): Promise<QdrantSearchResult[]> {
@@ -349,7 +347,7 @@ export class VellumQdrantClient {
           },
           {
             key: "target_type",
-            match: { any: ["segment", "summary", "media", "chunk"] },
+            match: { any: ["segment", "summary", "media"] },
           },
         ],
       });

package/src/memory/qdrant-manager.ts

@@ -4,6 +4,7 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  symlinkSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
@@ -12,7 +13,7 @@ import { dirname, join } from "node:path";
 
 import type { Subprocess } from "bun";
 
-import { getQdrantUrlEnv } from "../config/env.js";
+import { getQdrantReadyzTimeoutMs, getQdrantUrlEnv } from "../config/env.js";
 import { getLogger } from "../util/logger.js";
 import { getDataDir } from "../util/platform.js";
 
@@ -47,6 +48,8 @@ export interface QdrantManagerConfig {
  */
 export class QdrantManager {
   private process: Subprocess | null = null;
+  private stderrBuffer = "";
+  private stderrDrained: Promise<void> = Promise.resolve();
   private readonly url: string;
   private readonly host: string;
   private readonly port: number;
@@ -67,7 +70,8 @@ export class QdrantManager {
 
     this.readyzPollIntervalMs =
       config.readyzPollIntervalMs ?? READYZ_POLL_INTERVAL_MS;
-    this.readyzTimeoutMs = config.readyzTimeoutMs ?? READYZ_TIMEOUT_MS;
+    this.readyzTimeoutMs =
+      config.readyzTimeoutMs ?? getQdrantReadyzTimeoutMs() ?? READYZ_TIMEOUT_MS;
     this.shutdownGraceMs = config.shutdownGraceMs ?? SHUTDOWN_GRACE_MS;
 
     // External mode only if QDRANT_URL is explicitly set
@@ -92,13 +96,15 @@ export class QdrantManager {
       await this.installBinary(binaryPath);
     }
 
+    const spawnPath = this.ensureVellumSymlink(binaryPath);
+
     log.info(
-      { binaryPath, storagePath: this.storagePath, port: this.port },
+      { binaryPath: spawnPath, storagePath: this.storagePath, port: this.port },
       "Starting Qdrant",
     );
 
-    this.process = Bun.spawn({
-      cmd: [binaryPath],
+    const proc = Bun.spawn({
+      cmd: [spawnPath],
       env: {
         ...process.env,
         QDRANT__SERVICE__HOST: this.host,
@@ -109,8 +115,10 @@ export class QdrantManager {
         QDRANT__LOG_LEVEL: "WARN",
       },
       stdout: "ignore",
-      stderr: "ignore",
+      stderr: "pipe",
     });
+    this.process = proc;
+    this.drainStderrFrom(proc.stderr);
 
     if (this.process.pid) {
       this.writePid(this.process.pid);
@@ -150,6 +158,7 @@ export class QdrantManager {
     }
 
     this.process = null;
+    this.stderrBuffer = "";
     this.cleanupPid();
     log.info("Qdrant stopped");
   }
@@ -259,6 +268,15 @@ export class QdrantManager {
   private async waitForReady(): Promise<void> {
     const start = Date.now();
     while (Date.now() - start < this.readyzTimeoutMs) {
+      // Fail fast if the managed process exited before becoming ready
+      if (this.process != null && this.process.exitCode != null) {
+        await this.stderrDrained;
+        const stderr = this.stderrBuffer.trim();
+        throw new Error(
+          `Qdrant process exited with code ${this.process.exitCode} before becoming ready` +
+            (stderr ? `\nstderr:\n${stderr}` : ""),
+        );
+      }
       try {
         const res = await fetch(`${this.url}/readyz`);
         if (res.ok) return;
@@ -267,11 +285,32 @@ export class QdrantManager {
       }
       await Bun.sleep(this.readyzPollIntervalMs);
     }
+    const stderr = this.stderrBuffer.trim();
     throw new Error(
-      `Qdrant did not become ready within ${this.readyzTimeoutMs}ms at ${this.url}`,
+      `Qdrant did not become ready within ${this.readyzTimeoutMs}ms at ${this.url}` +
+        (stderr ? `\nstderr:\n${stderr}` : ""),
     );
   }
 
+  private drainStderrFrom(stream: ReadableStream<Uint8Array>): void {
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    this.stderrDrained = (async () => {
+      try {
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          this.stderrBuffer += decoder.decode(value, { stream: true });
+          if (this.stderrBuffer.length > 4096) {
+            this.stderrBuffer = this.stderrBuffer.slice(-4096);
+          }
+        }
+      } catch {
+        // Stream closed or error — expected during shutdown
+      }
+    })();
+  }
+
   private getBinaryPath(): string {
     return join(getDataDir(), "qdrant", "bin", "qdrant");
   }
@@ -314,4 +353,22 @@ export class QdrantManager {
       }
     }
   }
+
+  /**
+   * Ensures a `vellum-qdrant` symlink exists next to the real binary so that
+   * `lsof` reports "vellum-qdrant" in the COMMAND column, making the process
+   * discoverable by tools that scan for "vellum" in process names.
+   */
+  private ensureVellumSymlink(binaryPath: string): string {
+    const symlinkPath = join(dirname(binaryPath), "vellum-qdrant");
+    if (!existsSync(symlinkPath)) {
+      try {
+        symlinkSync(binaryPath, symlinkPath);
+      } catch {
+        // Fall back to the real binary if symlink creation fails
+        return binaryPath;
+      }
+    }
+    return symlinkPath;
+  }
 }

package/src/memory/schema/calls.ts

@@ -27,6 +27,7 @@ export const callSessions = sqliteTable(
     inviteGuardianName: text("invite_guardian_name"),
     callerIdentityMode: text("caller_identity_mode"),
     callerIdentitySource: text("caller_identity_source"),
+    skipDisclosure: integer("skip_disclosure").notNull().default(0),
     initiatedFromConversationId: text("initiated_from_conversation_id"),
     startedAt: integer("started_at"),
     endedAt: integer("ended_at"),

package/src/memory/schema/contacts.ts

@@ -10,6 +10,7 @@ export const contacts = sqliteTable("contacts", {
   updatedAt: integer("updated_at").notNull(),
   role: text("role").notNull().default("contact"), // 'guardian' | 'contact'
   principalId: text("principal_id"), // internal auth principal (nullable)
+  userFile: text("user_file"), // workspace-relative path to per-user persona file
   contactType: text("contact_type").notNull().default("human"), // 'human' | 'assistant'
 });
 

package/src/memory/schema/conversations.ts

@@ -30,9 +30,6 @@ export const conversations = sqliteTable(
     forkParentMessageId: text("fork_parent_message_id"),
     isAutoTitle: integer("is_auto_title").notNull().default(1),
     scheduleJobId: text("schedule_job_id"),
-    memoryReducedThroughMessageId: text("memory_reduced_through_message_id"),
-    memoryDirtyTailSinceMessageId: text("memory_dirty_tail_since_message_id"),
-    memoryLastReducedAt: integer("memory_last_reduced_at"),
   },
   (table) => [
     index("idx_conversations_updated_at").on(table.updatedAt),

package/src/memory/schema/index.ts

@@ -3,8 +3,6 @@ export * from "./contacts.js";
 export * from "./conversations.js";
 export * from "./guardian.js";
 export * from "./infrastructure.js";
-export * from "./memory-archive.js";
-export * from "./memory-brief.js";
 export * from "./memory-core.js";
 export * from "./notifications.js";
 export * from "./oauth.js";

package/src/messaging/draft-store.ts

@@ -10,7 +10,7 @@ import { readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { ensureDir, pathExists } from "../util/fs.js";
-import { getRootDir } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
 
 export interface Draft {
   id: string;
@@ -25,7 +25,7 @@ export interface Draft {
 }
 
 function getDraftsDir(platform: string): string {
-  const dir = join(getRootDir(), "workspace", "data", "drafts", platform);
+  const dir = join(getWorkspaceDir(), "data", "drafts", platform);
   ensureDir(dir);
   return dir;
 }

package/src/notifications/decision-engine.ts

@@ -13,6 +13,7 @@ import { v4 as uuid } from "uuid";
 
 import { getDeliverableChannels } from "../channels/config.js";
 import { getConfig } from "../config/loader.js";
+import { resolveGuardianPersona } from "../prompts/persona-resolver.js";
 import { buildCoreIdentityContext } from "../prompts/system-prompt.js";
 import {
   createTimeout,
@@ -800,7 +801,9 @@ async function classifyWithLLM(
   const candidateContext = candidateSet
     ? (serializeCandidatesForPrompt(candidateSet) ?? undefined)
     : undefined;
-  const rawIdentityContext = buildCoreIdentityContext();
+  const rawIdentityContext = buildCoreIdentityContext({
+    userPersona: resolveGuardianPersona(),
+  });
   const identityContext = rawIdentityContext
     ? truncate(rawIdentityContext, MAX_IDENTITY_CONTEXT_CHARS, "\n…[truncated]")
     : undefined;

package/src/oauth/connection-resolver.ts

@@ -156,10 +156,12 @@ async function resolvePlatformConnectionId(
     );
   }
 
-  const body = (await response.json()) as {
-    results?: Array<{ id: string; account_label?: string }>;
-  };
-  const connections = body.results ?? [];
+  const body = (await response.json()) as unknown;
+  const connections = (
+    Array.isArray(body)
+      ? body
+      : ((body as Record<string, unknown>).results ?? [])
+  ) as Array<{ id: string; account_label?: string }>;
 
   if (connections.length === 0) {
     throw new Error(

package/src/permissions/checker.ts

@@ -147,7 +147,6 @@ const LOW_RISK_PROGRAMS = new Set([
   "du",
   "df",
   "assistant",
-  "vellum",
 ]);
 
 // High-risk shell programs / patterns
@@ -201,32 +200,6 @@ const LOW_RISK_GIT_SUBCOMMANDS = new Set([
   "reflog",
 ]);
 
-// Mutating assistant/vellum CLI subcommands that should be escalated to Medium
-// risk. Most assistant/vellum subcommands are read-only and stay Low risk.
-// This mirrors the git subcommand pattern — only known mutating operations
-// get escalated.
-const MEDIUM_RISK_CLI_SUBCOMMANDS = new Set([
-  "credentials",
-  "config",
-  "bash",
-  "trust",
-  "autonomy",
-  "contacts",
-  "mcp",
-  "keys",
-  "wake",
-  "sleep",
-  "hatch",
-  "retire",
-  "clean",
-  "setup",
-  "upgrade",
-  "recover",
-  "login",
-  "use",
-  "pair",
-]);
-
 // Commands that wrap another program — the real program appears as the first
 // non-flag argument.  When one of these is the segment program we look through
 // its args to find the effective program (e.g. `env curl …` → curl).
@@ -771,17 +744,6 @@ async function classifyRiskUncached(
         continue;
       }
 
-      if (prog === "vellum" || prog === "assistant") {
-        const subcommand = firstPositionalArg(seg.args);
-        if (subcommand && MEDIUM_RISK_CLI_SUBCOMMANDS.has(subcommand)) {
-          // Known mutating subcommands are medium
-          maxRisk = RiskLevel.Medium;
-          continue;
-        }
-        // Read-only / unknown subcommands stay at current risk
-        continue;
-      }
-
       if (!LOW_RISK_PROGRAMS.has(prog)) {
         // Unknown program → medium
         if (maxRisk === RiskLevel.Low) {

package/src/permissions/defaults.ts

@@ -2,7 +2,7 @@ import { join } from "node:path";
 
 import { getConfig } from "../config/loader.js";
 import { getBundledSkillsDir } from "../config/skills.js";
-import { getRootDir } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
 
 export interface DefaultRuleTemplate {
   id: string;
@@ -116,7 +116,7 @@ export function getDefaultRuleTemplates(): DefaultRuleTemplate[] {
   // Workspace prompt files — the agent should always be able to read, edit,
   // and write these without prompting.  Also allow `rm BOOTSTRAP.md` so the
   // agent can delete it at the end of the onboarding ritual.
-  const workspaceDir = join(getRootDir(), "workspace").replaceAll("\\", "/");
+  const workspaceDir = getWorkspaceDir().replaceAll("\\", "/");
   const WORKSPACE_PROMPT_FILES = [
     "IDENTITY.md",
     "USER.md",
@@ -163,7 +163,7 @@ export function getDefaultRuleTemplates(): DefaultRuleTemplate[] {
   // Skill source directories — writing or editing skill source files should
   // require explicit user approval so a compromised agent loop cannot silently
   // modify skill code to escalate privileges.
-  const managedSkillsDir = join(getRootDir(), "workspace", "skills").replaceAll(
+  const managedSkillsDir = join(getWorkspaceDir(), "skills").replaceAll(
     "\\",
     "/",
   );