@vellumai/assistant 0.5.6 → 0.5.7

package/src/events/domain-events.ts

@@ -25,7 +25,8 @@ export interface ToolDomainEvents {
       | "always_allow_high_risk"
       | "deny"
       | "always_deny"
-      | "temporary_override";
+      | "temporary_override"
+      | "dangerously_skip_permissions";
     riskLevel: string;
     decidedAtMs: number;
   };

package/src/inbound/platform-callback-registration.ts

@@ -2,7 +2,7 @@
  * Platform callback route registration for containerized deployments.
  *
  * When the assistant daemon runs inside a container (IS_CONTAINERIZED=true)
- * with a configured PLATFORM_BASE_URL and PLATFORM_ASSISTANT_ID, external
+ * with a configured VELLUM_PLATFORM_URL and PLATFORM_ASSISTANT_ID, external
  * service callbacks (Twilio webhooks, OAuth redirects, Telegram webhooks, etc.)
  * must route through the platform's gateway proxy instead of hitting the
  * assistant directly.
@@ -12,7 +12,7 @@
  * webhooks to the correct containerized assistant instance.
  *
  * The platform endpoint is:
- *   POST {PLATFORM_BASE_URL}/v1/internal/gateway/callback-routes/register/
+ *   POST {VELLUM_PLATFORM_URL}/v1/internal/gateway/callback-routes/register/
  *
  * It accepts { assistant_id, callback_path, type } and returns a stable
  * callback_url that external services should use.
@@ -30,7 +30,7 @@ const log = getLogger("platform-callback-registration");
 
 /**
  * Whether the daemon should register callback routes with the platform.
- * True when IS_CONTAINERIZED, PLATFORM_BASE_URL, and PLATFORM_ASSISTANT_ID
+ * True when IS_CONTAINERIZED, VELLUM_PLATFORM_URL, and PLATFORM_ASSISTANT_ID
  * are all set. Intentionally does **not** require the managed proxy API key
  * so that callback-only flows (OAuth transport, Telegram/Twilio callback
  * registration) work during partial bootstrap before the key is injected.

package/src/instrument.ts

@@ -39,14 +39,17 @@ function redactObject(obj: unknown): unknown {
 }
 
 /**
- * Call after dotenv has loaded so SENTRY_DSN is available.
- * Always initializes Sentry to capture early startup crashes. If the user
- * later opts out via the sendDiagnostics config key (or VELLUM_DEV=1),
- * call closeSentry() after config is loaded to stop future event capturing.
+ * Call after dotenv has loaded so SENTRY_DSN_ASSISTANT is available.
+ * Initializes Sentry when the DSN is set; no-ops when empty/unset so
+ * local dev builds don't send crash reports. If the user later opts out
+ * via the sendDiagnostics config key (or VELLUM_DEV=1), call closeSentry()
+ * after config is loaded to stop future event capturing.
  */
 export function initSentry(): void {
+  const dsn = getSentryDsn();
+  if (!dsn) return;
   Sentry.init({
-    dsn: getSentryDsn(),
+    dsn,
     release: `vellum-assistant@${APP_VERSION}`,
     dist: COMMIT_SHA,
     environment: APP_VERSION === "0.0.0-dev" ? "development" : "production",

package/src/memory/conversation-title-service.ts

@@ -358,12 +358,61 @@ function deriveFallbackTitle(context?: TitleContext): string | null {
   return null;
 }
 
+/**
+ * Extract only human-authored text from stored message content for title
+ * generation. Unlike extractTextFromStoredMessageContent (which includes
+ * tool metadata like "Tool use (...): {...}"), this only extracts:
+ * - `text` blocks (the actual conversation content)
+ * - `tool_result` string content (topical signal from tool responses)
+ *   — web_search_tool_result is skipped (structured search data, not topical)
+ *
+ * Returns empty string for content-block arrays with no extractable text,
+ * preventing raw JSON from polluting the title prompt.
+ */
+function extractTextForTitle(raw: string): string {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "string") return parsed;
+    if (!Array.isArray(parsed)) return raw;
+    const texts: string[] = [];
+    for (const block of parsed) {
+      if (!block || typeof block !== "object") continue;
+      if (block.type === "text" && typeof block.text === "string") {
+        texts.push(block.text);
+        // guard:allow-tool-result-only — web_search_tool_result has structured
+        // search result arrays, not useful for title generation; only plain
+        // tool_result string content carries topical signal.
+      } else if (block.type === "tool_result") {
+        if (typeof block.content === "string") {
+          texts.push(block.content);
+        } else if (Array.isArray(block.content)) {
+          for (const nested of block.content) {
+            if (
+              nested &&
+              typeof nested === "object" &&
+              nested.type === "text" &&
+              typeof nested.text === "string"
+            ) {
+              texts.push(nested.text);
+            }
+          }
+        }
+      }
+    }
+    return texts.join("\n");
+  } catch {
+    return raw;
+  }
+}
+
 function buildRegenerationPrompt(recentMessages: MessageRow[]): string {
   const parts: string[] = ["Recent messages:"];
 
   for (const msg of recentMessages) {
+    const text = extractTextForTitle(msg.content);
+    if (!text) continue;
     const role = msg.role === "user" ? "User" : "Assistant";
-    parts.push(`${role}: ${truncate(msg.content, 200, "")}`);
+    parts.push(`${role}: ${truncate(text, 200, "")}`);
   }
 
   return parts.join("\n");

package/src/memory/db-init.ts

@@ -35,12 +35,14 @@ import {
   createTasksAndWorkItemsTables,
   createWatchersAndLogsTables,
   migrateAssistantContactMetadata,
+  migrateBackfillAudioAttachmentMimeTypes,
   migrateBackfillContactInteractionStats,
   migrateBackfillGuardianPrincipalId,
   migrateBackfillInlineAttachmentsToDisk,
   migrateBackfillUsageCacheAccounting,
   migrateCallSessionInviteMetadata,
   migrateCallSessionMode,
+  migrateCallSessionSkipDisclosure,
   migrateCanonicalGuardianDeliveriesDestinationIndex,
   migrateCanonicalGuardianRequesterChatId,
   migrateCapabilityCardColumns,
@@ -51,6 +53,7 @@ import {
   migrateContactsAssistantId,
   migrateContactsNotesColumn,
   migrateContactsRolePrincipal,
+  migrateContactsUserFileColumn,
   migrateConversationForkLineage,
   migrateConversationsThreadTypeIndex,
   migrateCreateThreadStartersTable,
@@ -492,6 +495,15 @@ export function initializeDb(): void {
   // 86. Drop simplified-memory tables and reducer checkpoint columns
   migrateDropSimplifiedMemory(database);
 
+  // 87. Add skip_disclosure column to call_sessions for per-call disclosure control
+  migrateCallSessionSkipDisclosure(database);
+
+  // 88. Backfill correct MIME types for audio attachments stored as application/octet-stream
+  migrateBackfillAudioAttachmentMimeTypes(database);
+
+  // 89. Add user_file column to contacts for per-user persona file mapping
+  migrateContactsUserFileColumn(database);
+
   validateMigrationState(database);
 
   if (process.env.BUN_TEST === "1") {

package/src/memory/items-extractor.ts

@@ -3,6 +3,7 @@ import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../config/loader.js";
 import type { MemoryExtractionConfig } from "../config/types.js";
+import { resolveGuardianPersona } from "../prompts/persona-resolver.js";
 import { buildCoreIdentityContext } from "../prompts/system-prompt.js";
 import {
   createTimeout,
@@ -150,6 +151,7 @@ function buildExtractionSystemPrompt(
     statement: string;
   }>,
   messageRole: string,
+  userPersona?: string | null,
 ): string {
   // Build the fixed instruction body first so we can measure it and allocate
   // the remaining budget to identity context.
@@ -206,7 +208,9 @@ IMPORTANT: The message below is from the ASSISTANT, not the user. Do NOT attribu
   // ceiling, preventing oversized prompts from exceeding the provider input
   // window (which would cause sendMessage to error and fall back to
   // lower-quality pattern-based extraction).
-  const rawIdentityContext = buildCoreIdentityContext();
+  const rawIdentityContext = buildCoreIdentityContext(
+    userPersona ? { userPersona } : undefined,
+  );
 
   let prompt = "";
   if (rawIdentityContext) {
@@ -316,6 +320,7 @@ async function extractItemsWithLLM(
   extractionConfig: MemoryExtractionConfig,
   scopeId: string,
   messageRole: string,
+  userPersona?: string | null,
 ): Promise<ExtractedItem[]> {
   const provider = await getConfiguredProvider();
   if (!provider) {
@@ -334,6 +339,7 @@ async function extractItemsWithLLM(
       const systemPrompt = buildExtractionSystemPrompt(
         existingItems,
         messageRole,
+        userPersona,
       );
 
       const messagePrefix =
@@ -532,12 +538,20 @@ export async function extractAndUpsertMemoryItemsForMessage(
   const config = getConfig();
   const extractionConfig = config.memory.extraction;
   const effectiveScopeId = scopeId ?? "default";
+
+  // Resolve the guardian's persona to provide personality-aware extraction
+  // context. Currently uses the guardian persona for all conversations —
+  // non-guardian conversations are rare and the guardian's persona provides
+  // better extraction context than none.
+  const userPersona = resolveGuardianPersona();
+
   const extracted = extractionConfig.useLLM
     ? await extractItemsWithLLM(
         text,
         extractionConfig,
         effectiveScopeId,
         message.role,
+        userPersona,
       )
     : extractItemsPatternBased(text, effectiveScopeId);
 

package/src/memory/job-handlers/conversation-starters.ts

@@ -9,6 +9,7 @@ import { and, desc, eq } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import { loadSkillCatalog } from "../../config/skills.js";
+import { resolveGuardianPersona } from "../../prompts/persona-resolver.js";
 import { buildCoreIdentityContext } from "../../prompts/system-prompt.js";
 import {
   createTimeout,
@@ -171,7 +172,9 @@ async function generateStarters(scopeId: string): Promise<GeneratedStarter[]> {
 
   // Truncate identity context to prevent oversized prompts when SOUL.md /
   // IDENTITY.md / USER.md are large.
-  const rawIdentityContext = buildCoreIdentityContext();
+  const rawIdentityContext = buildCoreIdentityContext({
+    userPersona: resolveGuardianPersona(),
+  });
   const identityContext = rawIdentityContext
     ? truncate(rawIdentityContext, 2000, "\n…[truncated]")
     : null;

package/src/memory/jobs-store.ts

@@ -4,6 +4,10 @@ import { v4 as uuid } from "uuid";
 import { getLogger } from "../util/logger.js";
 import { truncate } from "../util/truncate.js";
 import { getDb, rawAll, rawChanges } from "./db.js";
+import {
+  isQdrantBreakerOpen,
+  shouldAllowQdrantProbe,
+} from "./qdrant-circuit-breaker.js";
 import { memoryJobs } from "./schema.js";
 
 const log = getLogger("memory-jobs-store");
@@ -201,14 +205,33 @@ export function claimMemoryJobs(limit: number): MemoryJob[] {
     .all();
 
   const remainingSlots = limit - nonEmbedCandidates.length;
+
+  // When the Qdrant circuit breaker is open, skip embed jobs entirely —
+  // they would just be claimed → fail → deferred, wasting CPU cycles.
+  // Exception: if the cooldown has elapsed (breaker ready for half-open probe),
+  // allow exactly 1 embed job through so the breaker can self-heal.
+  const breakerOpen = isQdrantBreakerOpen();
+  const probeAllowed = breakerOpen && shouldAllowQdrantProbe();
+  const skipEmbedJobs = breakerOpen && !probeAllowed;
+  const embedLimit = probeAllowed ? 1 : remainingSlots;
+
+  if (skipEmbedJobs && remainingSlots > 0) {
+    log.debug("Skipping embed job claims — Qdrant circuit breaker is open");
+  }
+  if (probeAllowed && remainingSlots > 0) {
+    log.debug(
+      "Allowing 1 embed probe job — Qdrant circuit breaker cooldown elapsed",
+    );
+  }
+
   const embedCandidates =
-    remainingSlots > 0
+    remainingSlots > 0 && !skipEmbedJobs
       ? db
           .select()
           .from(memoryJobs)
           .where(and(pendingFilter, inArray(memoryJobs.type, EMBED_JOB_TYPES)))
           .orderBy(asc(memoryJobs.runAfter), asc(memoryJobs.createdAt))
-          .limit(remainingSlots)
+          .limit(embedLimit)
           .all()
       : [];
 
@@ -243,8 +266,8 @@ export function completeMemoryJob(id: string): void {
 
 /** Max times a job can be deferred before it is marked as failed. */
 const MAX_DEFERRALS = 50;
-/** Warn when deferrals reach 80% of the limit. */
-const DEFER_WARNING_THRESHOLD = Math.floor(MAX_DEFERRALS * 0.8);
+/** Log warnings at these milestone counts to avoid flooding logs. */
+const DEFERRAL_WARN_MILESTONES = [40, 45];
 /** Base delay in ms for deferred jobs (grows with exponential backoff). */
 const DEFER_BASE_DELAY_MS = 30_000;
 /** Maximum delay cap for deferred jobs (5 minutes). */
@@ -286,7 +309,9 @@ export function deferMemoryJob(id: string): "deferred" | "failed" {
     return "failed";
   }
 
-  if (deferrals >= DEFER_WARNING_THRESHOLD) {
+  // Log at milestones only (40, 45) to avoid flooding logs.
+  // At 50, the job fails via the check above, so 40 and 45 are the warnings.
+  if (DEFERRAL_WARN_MILESTONES.includes(deferrals)) {
     log.warn(
       { jobId: id, type: row.type, deferrals, max: MAX_DEFERRALS },
       "Job approaching max deferral limit",

package/src/memory/jobs-worker.ts

@@ -44,6 +44,9 @@ import { QdrantCircuitOpenError } from "./qdrant-circuit-breaker.js";
 
 const log = getLogger("memory-jobs-worker");
 
+export const POLL_INTERVAL_MIN_MS = 1_500;
+export const POLL_INTERVAL_MAX_MS = 30_000;
+
 export interface MemoryJobsWorker {
   runOnce(): Promise<number>;
   stop(): void;
@@ -57,24 +60,45 @@ export function startMemoryJobsWorker(): MemoryJobsWorker {
 
   let stopped = false;
   let tickRunning = false;
+  let timer: ReturnType<typeof setTimeout>;
+  let currentIntervalMs = POLL_INTERVAL_MIN_MS;
 
   const tick = async () => {
     if (stopped || tickRunning) return;
     tickRunning = true;
     try {
-      await runMemoryJobsOnce({ enableScheduledCleanup: true });
+      const processed = await runMemoryJobsOnce({
+        enableScheduledCleanup: true,
+      });
+      if (processed > 0) {
+        currentIntervalMs = POLL_INTERVAL_MIN_MS;
+      } else {
+        currentIntervalMs = Math.min(
+          currentIntervalMs * 2,
+          POLL_INTERVAL_MAX_MS,
+        );
+      }
     } catch (err) {
       log.error({ err }, "Memory worker tick failed");
+      currentIntervalMs = Math.min(currentIntervalMs * 2, POLL_INTERVAL_MAX_MS);
     } finally {
       tickRunning = false;
     }
   };
 
-  const timer = setInterval(() => {
-    void tick();
-  }, 1500);
-  timer.unref();
-  void tick();
+  const scheduleTick = () => {
+    if (stopped) return;
+    timer = setTimeout(() => {
+      void tick().then(() => {
+        if (!stopped) scheduleTick();
+      });
+    }, currentIntervalMs);
+    (timer as NodeJS.Timeout).unref?.();
+  };
+
+  void tick().then(() => {
+    if (!stopped) scheduleTick();
+  });
 
   return {
     async runOnce(): Promise<number> {
@@ -82,7 +106,7 @@ export function startMemoryJobsWorker(): MemoryJobsWorker {
     },
     stop(): void {
       stopped = true;
-      clearInterval(timer);
+      clearTimeout(timer);
     },
   };
 }

package/src/memory/migrations/001-job-deferrals.ts

@@ -49,3 +49,22 @@ export function migrateJobDeferrals(database: DrizzleDb): void {
     throw e;
   }
 }
+
+/**
+ * Reverse the deferral reconciliation by moving `deferrals` back into `attempts`
+ * for pending embed jobs. Best-effort: jobs that accumulated real deferral counts
+ * after the forward migration ran cannot be distinguished from migrated ones.
+ */
+export function downJobDeferrals(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+  raw.exec(/*sql*/ `
+    UPDATE memory_jobs
+    SET attempts = deferrals,
+        deferrals = 0,
+        updated_at = ${Date.now()}
+    WHERE status = 'pending'
+      AND deferrals > 0
+      AND attempts = 0
+      AND type IN ('embed_segment', 'embed_item', 'embed_summary')
+  `);
+}

package/src/memory/migrations/004-entity-relation-dedup.ts

@@ -91,3 +91,13 @@ export function migrateMemoryEntityRelationDedup(database: DrizzleDb): void {
     throw e;
   }
 }
+
+/**
+ * No-op down: deduplication is a lossy operation — deleted duplicate rows
+ * cannot be restored. The forward migration merged rows by keeping the most
+ * recent evidence per (source, target, relation) triple; the discarded rows
+ * are permanently lost.
+ */
+export function downMemoryEntityRelationDedup(_database: DrizzleDb): void {
+  // Intentionally empty — irreversible lossy migration.
+}

package/src/memory/migrations/005-fingerprint-scope-unique.ts

@@ -93,3 +93,79 @@ export function migrateMemoryItemsFingerprintScopeUnique(
     raw.exec("PRAGMA foreign_keys = ON");
   }
 }
+
+/**
+ * Reverse the compound (fingerprint, scope_id) unique index change by rebuilding
+ * memory_items with a column-level UNIQUE on fingerprint.
+ *
+ * WARNING: This is dangerous if data now relies on the compound constraint
+ * (i.e., the same fingerprint exists in multiple scopes). In that case, the
+ * rebuild will fail with a UNIQUE constraint violation. This is intentional —
+ * it prevents silent data loss on rollback.
+ */
+export function downMemoryItemsFingerprintScopeUnique(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  // Check if the column-level UNIQUE already exists — if so, nothing to do.
+  const tableDdl = raw
+    .query(
+      `SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'memory_items'`,
+    )
+    .get() as { sql: string } | null;
+  if (
+    !tableDdl ||
+    tableDdl.sql.match(/fingerprint\s+TEXT\s+NOT\s+NULL\s+UNIQUE/i)
+  ) {
+    return;
+  }
+
+  raw.exec("PRAGMA foreign_keys = OFF");
+  try {
+    raw.exec("BEGIN");
+
+    raw.exec(/*sql*/ `
+      CREATE TABLE memory_items_new (
+        id TEXT PRIMARY KEY,
+        kind TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        statement TEXT NOT NULL,
+        status TEXT NOT NULL,
+        confidence REAL NOT NULL,
+        fingerprint TEXT NOT NULL UNIQUE,
+        first_seen_at INTEGER NOT NULL,
+        last_seen_at INTEGER NOT NULL,
+        last_used_at INTEGER,
+        importance REAL,
+        access_count INTEGER NOT NULL DEFAULT 0,
+        valid_from INTEGER,
+        invalid_at INTEGER,
+        verification_state TEXT NOT NULL DEFAULT 'assistant_inferred',
+        scope_id TEXT NOT NULL DEFAULT 'default'
+      )
+    `);
+
+    raw.exec(/*sql*/ `
+      INSERT INTO memory_items_new
+      SELECT id, kind, subject, statement, status, confidence, fingerprint,
+             first_seen_at, last_seen_at, last_used_at, importance, access_count,
+             valid_from, invalid_at, verification_state, scope_id
+      FROM memory_items
+    `);
+
+    raw.exec(/*sql*/ `DROP TABLE memory_items`);
+    raw.exec(/*sql*/ `ALTER TABLE memory_items_new RENAME TO memory_items`);
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  } finally {
+    raw.exec("PRAGMA foreign_keys = ON");
+  }
+}

package/src/memory/migrations/006-scope-salted-fingerprints.ts

@@ -1,3 +1,5 @@
+import { createHash } from "node:crypto";
+
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 import { computeMemoryFingerprint } from "../fingerprint.js";
 
@@ -75,3 +77,51 @@ export function migrateMemoryItemsScopeSaltedFingerprints(
     throw e;
   }
 }
+
+/**
+ * Reverse the scope-salted fingerprint migration by recomputing fingerprints
+ * WITHOUT the scope_id prefix.
+ *
+ * Old format: sha256(`${kind}|${subject.toLowerCase()}|${statement.toLowerCase()}`)
+ */
+export function downMemoryItemsScopeSaltedFingerprints(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  interface ItemRow {
+    id: string;
+    kind: string;
+    subject: string;
+    statement: string;
+  }
+
+  const items = raw
+    .query(`SELECT id, kind, subject, statement FROM memory_items`)
+    .all() as ItemRow[];
+
+  if (items.length === 0) return;
+
+  try {
+    raw.exec("BEGIN");
+
+    const updateStmt = raw.prepare(
+      `UPDATE memory_items SET fingerprint = ? WHERE id = ?`,
+    );
+
+    for (const item of items) {
+      const normalized = `${item.kind}|${item.subject.toLowerCase()}|${item.statement.toLowerCase()}`;
+      const fingerprint = createHash("sha256").update(normalized).digest("hex");
+      updateStmt.run(fingerprint, item.id);
+    }
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  }
+}

package/src/memory/migrations/007-assistant-id-to-self.ts

@@ -265,3 +265,13 @@ export function migrateAssistantIdToSelf(database: DrizzleDb): void {
     throw e;
   }
 }
+
+/**
+ * No-op down: the original assistant_id values are not recoverable. The forward
+ * migration normalized all assistant_id values to "self" and merged/deduplicated
+ * rows where the same logical entity existed under both the real assistantId and
+ * "self". The original per-assistant IDs are permanently lost.
+ */
+export function downAssistantIdToSelf(_database: DrizzleDb): void {
+  // Intentionally empty — original assistant_id values cannot be restored.
+}

package/src/memory/migrations/008-remove-assistant-id-columns.ts

@@ -228,3 +228,37 @@ export function migrateRemoveAssistantIdColumns(database: DrizzleDb): void {
     raw.exec("PRAGMA foreign_keys = ON");
   }
 }
+
+/**
+ * Add the assistant_id column back to the 4 tables that had it removed.
+ *
+ * NOTE: The data previously stored in assistant_id is lost — all rows will
+ * have assistant_id = 'self' after this down migration. This only restores
+ * the column structure so that older code expecting the column can function.
+ */
+export function downRemoveAssistantIdColumns(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const tables = [
+    "conversation_keys",
+    "attachments",
+    "channel_inbound_events",
+    "message_runs",
+  ];
+
+  for (const table of tables) {
+    // Check if the table exists and lacks assistant_id
+    const ddl = raw
+      .query(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`)
+      .get(table) as { sql: string } | null;
+    if (!ddl || ddl.sql.includes("assistant_id")) continue;
+
+    try {
+      raw.exec(
+        /*sql*/ `ALTER TABLE ${table} ADD COLUMN assistant_id TEXT NOT NULL DEFAULT 'self'`,
+      );
+    } catch {
+      /* column already exists */
+    }
+  }
+}

package/src/memory/migrations/009-llm-usage-events-drop-assistant-id.ts

@@ -95,3 +95,29 @@ export function migrateLlmUsageEventsDropAssistantId(
     raw.exec("PRAGMA foreign_keys = ON");
   }
 }
+
+/**
+ * Add the assistant_id column back to llm_usage_events.
+ *
+ * NOTE: The data previously stored in assistant_id is lost — all rows will
+ * have assistant_id = NULL after this down migration. This only restores
+ * the column structure so that older code expecting the column can function.
+ */
+export function downLlmUsageEventsDropAssistantId(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const ddl = raw
+    .query(
+      `SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'llm_usage_events'`,
+    )
+    .get() as { sql: string } | null;
+  if (!ddl || ddl.sql.includes("assistant_id")) return;
+
+  try {
+    raw.exec(
+      /*sql*/ `ALTER TABLE llm_usage_events ADD COLUMN assistant_id TEXT`,
+    );
+  } catch {
+    /* column already exists */
+  }
+}

package/src/memory/migrations/014-backfill-inbox-thread-state.ts

@@ -88,3 +88,13 @@ export function migrateBackfillInboxThreadStateFromBindings(
     throw e;
   }
 }
+
+/**
+ * No-op down: the seeded inbox thread state rows are expected to remain.
+ * The forward migration used INSERT OR IGNORE, so existing rows were never
+ * modified. Removing the seeded rows could leave the inbox empty for
+ * pre-existing conversations, which is worse than keeping them.
+ */
+export function downBackfillInboxThreadState(_database: DrizzleDb): void {
+  // Intentionally empty — seeded data is expected to remain.
+}