@vellumai/assistant 0.6.1 → 0.6.2

package/src/tools/terminal/shell.ts

@@ -261,11 +261,9 @@ class ShellTool implements Tool {
       "Executing shell command",
     );
 
-    // Resolve sandbox config early - needed both for proxy env and command wrapping.
-    const sandboxConfig =
-      context.sandboxOverride != null
-        ? { ...config.sandbox, enabled: context.sandboxOverride }
-        : config.sandbox;
+    // The assistant runs exclusively in Docker or platform-managed
+    // environments where the container provides isolation.
+    const sandboxConfig = { enabled: false } as const;
 
     // Acquire proxy session if proxied mode is requested.
     // `getOrStartSession` serializes per-conversation so concurrent proxied

package/src/tools/types.ts

@@ -34,7 +34,6 @@ export interface ToolPermissionPromptEvent extends ToolLifecycleEventBase {
   allowlistOptions: AllowlistOption[];
   scopeOptions: ScopeOption[];
   diff?: DiffInfo;
-  sandboxed?: boolean;
   persistentDecisionsAllowed?: boolean;
 }
 
@@ -110,8 +109,6 @@ export interface ToolContext {
   onOutput?: (chunk: string) => void;
   /** Abort signal for cooperative cancellation. Tools should check this periodically. */
   signal?: AbortSignal;
-  /** Per-conversation sandbox override. When set, takes precedence over the global config. */
-  sandboxOverride?: boolean;
   /** Optional callback for tool lifecycle events (start/prompt/deny/execute/error/secret_detected). */
   onToolLifecycleEvent?: ToolLifecycleEventHandler;
   /** Optional resolver for proxy tools - delegates execution to an external client. */

package/src/watcher/provider-types.ts

@@ -28,7 +28,7 @@ export interface WatcherProvider {
   id: string;
   /** Human-readable name. */
   displayName: string;
-  /** Credential service required (e.g. 'integration:google'). */
+  /** Credential service required (e.g. 'google'). */
   requiredCredentialService: string;
 
   /**

package/src/workspace/migrations/029-seed-pkb.ts

@@ -14,6 +14,7 @@ const INDEX_TEMPLATE = `_ Lines starting with _ are comments - they won't appear
 - threads.md — Active commitments, follow-ups, and projects in progress
 - buffer.md — Inbox of recently learned facts (filed periodically)
 
+
 ## Topics
 `;
 

package/src/workspace/migrations/030-seed-pkb-autoinject.ts

@@ -0,0 +1,73 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+const AUTOINJECT_TEMPLATE = `_ Lines starting with _ are comments - they won't appear in the injected context
+_ List one PKB filename per line. These files are loaded into every conversation.
+_ Remove a line to stop autoinjecting that file. Add new filenames to inject more.
+
+INDEX.md
+essentials.md
+threads.md
+buffer.md
+`;
+
+const INDEX_ENTRY = "- _autoinject.md — Controls which files are loaded into every conversation";
+
+export const seedPkbAutoinjectMigration: WorkspaceMigration = {
+  id: "030-seed-pkb-autoinject",
+  description: "Seed pkb/_autoinject.md for configurable PKB autoinjection",
+
+  run(workspaceDir: string): void {
+    const pkbDir = join(workspaceDir, "pkb");
+    if (!existsSync(pkbDir)) return;
+
+    // Seed _autoinject.md if it doesn't already exist
+    const autoinjectPath = join(pkbDir, "_autoinject.md");
+    if (!existsSync(autoinjectPath)) {
+      writeFileSync(autoinjectPath, AUTOINJECT_TEMPLATE, "utf-8");
+    }
+
+    // Append _autoinject.md entry to INDEX.md if not already present
+    const indexPath = join(pkbDir, "INDEX.md");
+    if (existsSync(indexPath)) {
+      try {
+        const indexContent = readFileSync(indexPath, "utf-8");
+        if (!indexContent.includes("_autoinject.md")) {
+          // Insert after the last "Always Loaded" entry (buffer.md line)
+          const bufferLine = "- buffer.md";
+          const bufferIdx = indexContent.indexOf(bufferLine);
+          if (bufferIdx !== -1) {
+            const endOfBufferLine = indexContent.indexOf("\n", bufferIdx);
+            const insertAt =
+              endOfBufferLine === -1 ? indexContent.length : endOfBufferLine;
+            const updated =
+              indexContent.slice(0, insertAt) +
+              "\n" +
+              INDEX_ENTRY +
+              indexContent.slice(insertAt);
+            writeFileSync(indexPath, updated, "utf-8");
+          }
+        }
+      } catch {
+        // INDEX.md unreadable — skip
+      }
+    }
+  },
+
+  down(workspaceDir: string): void {
+    const autoinjectPath = join(workspaceDir, "pkb", "_autoinject.md");
+    if (!existsSync(autoinjectPath)) return;
+
+    try {
+      const content = readFileSync(autoinjectPath, "utf-8");
+      // Only delete if content matches the template (preserve user edits)
+      if (content === AUTOINJECT_TEMPLATE) {
+        unlinkSync(autoinjectPath);
+      }
+    } catch {
+      // Unreadable — leave it alone
+    }
+  },
+};

package/src/workspace/migrations/registry.ts

@@ -26,6 +26,7 @@ import { backfillInstallMetaMigration } from "./026-backfill-install-meta.js";
 import { removeOrphanedOptimizedImagesCacheMigration } from "./027-remove-orphaned-optimized-images-cache.js";
 import { recoverConversationsFromDiskViewMigration } from "./028-recover-conversations-from-disk-view.js";
 import { seedPkbMigration } from "./029-seed-pkb.js";
+import { seedPkbAutoinjectMigration } from "./030-seed-pkb-autoinject.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -63,4 +64,5 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   removeOrphanedOptimizedImagesCacheMigration,
   recoverConversationsFromDiskViewMigration,
   seedPkbMigration,
+  seedPkbAutoinjectMigration,
 ];