@vellumai/assistant 0.6.3 → 0.6.4

package/src/cli/commands/oauth/__tests__/connect.test.ts

@@ -267,6 +267,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: "google-oauth",
     });
     mockIsManagedMode = () => true;
@@ -304,6 +305,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: "google-oauth",
     });
     mockIsManagedMode = () => true;
@@ -360,6 +362,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -406,6 +409,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -458,6 +462,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -486,6 +491,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -512,6 +518,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: "google-oauth",
     });
     mockIsManagedMode = () => true;
@@ -550,6 +557,7 @@ describe("assistant oauth connect", () => {
       provider: "slack",
       authorizeUrl: "https://slack.com/oauth/v2/authorize",
       tokenExchangeUrl: "https://slack.com/api/oauth.v2.access",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -594,6 +602,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -638,6 +647,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       tokenEndpointAuthMethod: "client_secret_post",
       managedServiceConfigKey: null,
       requiresClientSecret: 1,
@@ -677,6 +687,7 @@ describe("assistant oauth connect", () => {
       provider: "slack_channel",
       authorizeUrl: "urn:manual-token",
       tokenExchangeUrl: "urn:manual-token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;
@@ -704,6 +715,7 @@ describe("assistant oauth connect", () => {
       provider: "google",
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+      tokenExchangeBodyFormat: "form",
       managedServiceConfigKey: null,
     });
     mockIsManagedMode = () => false;

package/src/cli/commands/oauth/__tests__/providers-delete.test.ts

@@ -67,6 +67,7 @@ mock.module("../../../../oauth/oauth-store.js", () => ({
   },
   listProviders: () => [],
   registerProvider: () => ({}),
+  updateProvider: () => ({}),
   seedProviders: () => {},
   upsertApp: async () => ({}),
   getApp: () => undefined,

package/src/cli/commands/oauth/__tests__/providers-register.test.ts

@@ -144,6 +144,7 @@ const sampleProviderRow = {
   tokenExchangeUrl: "https://custom-api.example.com/oauth/token",
   refreshUrl: null,
   tokenEndpointAuthMethod: "client_secret_post",
+  tokenExchangeBodyFormat: "form",
   userinfoUrl: null,
   baseUrl: null,
   defaultScopes: "[]",

package/src/cli/commands/oauth/__tests__/providers-update.test.ts

@@ -144,6 +144,7 @@ const sampleProviderRow = {
   tokenExchangeUrl: "https://custom-api.example.com/oauth/token",
   refreshUrl: null,
   tokenEndpointAuthMethod: "client_secret_post",
+  tokenExchangeBodyFormat: "form",
   userinfoUrl: null,
   baseUrl: null,
   defaultScopes: "[]",

package/src/cli/commands/oauth/mode.ts

@@ -6,7 +6,10 @@ import {
   saveRawConfig,
   setNestedValue,
 } from "../../../config/loader.js";
-import type { Services } from "../../../config/schemas/services.js";
+import {
+  getServiceMode,
+  type Services,
+} from "../../../config/schemas/services.js";
 import {
   getProvider,
   listActiveConnectionsByProvider,
@@ -120,7 +123,10 @@ Examples:
 
           // Provider supports managed mode — read current config value
           const services: Services = getConfig().services;
-          const currentMode = services[managedKey as keyof Services].mode;
+          const currentMode = getServiceMode(
+            services,
+            managedKey as keyof Services,
+          );
 
           if (shouldOutputJson(cmd)) {
             writeOutput(cmd, {
@@ -189,7 +195,10 @@ Examples:
 
         // Read current mode
         const services: Services = getConfig().services;
-        const currentMode = services[managedKey as keyof Services].mode;
+        const currentMode = getServiceMode(
+          services,
+          managedKey as keyof Services,
+        );
 
         // Same mode — no-op
         if (currentMode === newMode) {

package/src/cli/commands/oauth/providers.ts

@@ -273,6 +273,11 @@ Examples:
       "--token-auth-method <method>",
       'How the client authenticates at the token endpoint: "client_secret_post" or "client_secret_basic"',
     )
+    .option(
+      "--token-exchange-body-format <format>",
+      'Body encoding for the token exchange request: "form" (application/x-www-form-urlencoded, default) or "json" (application/json)',
+      "form",
+    )
     .option(
       "--ping-url <url>",
       'Health-check endpoint URL for token validation (e.g. "https://api.example.com/user"). Used by "assistant oauth ping" to verify a stored token.',
@@ -428,6 +433,7 @@ Examples:
       --provider-key notion-custom \\
       --auth-url https://api.notion.com/v1/oauth/authorize \\
       --token-url https://api.notion.com/v1/oauth/token \\
+      --token-exchange-body-format json \\
       --logo-simpleicons-slug notion`,
     )
     .action(
@@ -442,6 +448,7 @@ Examples:
           scopes?: string;
           scopeSeparator?: string;
           tokenAuthMethod?: string;
+          tokenExchangeBodyFormat?: string;
           pingUrl?: string;
           pingMethod?: string;
           pingHeaders?: string;
@@ -488,6 +495,7 @@ Examples:
             scopePolicy: {},
             scopeSeparator: opts.scopeSeparator,
             tokenEndpointAuthMethod: opts.tokenAuthMethod,
+            tokenExchangeBodyFormat: opts.tokenExchangeBodyFormat,
             pingUrl: opts.pingUrl,
             pingMethod: opts.pingMethod,
             pingHeaders: opts.pingHeaders
@@ -574,6 +582,10 @@ Examples:
       "--token-auth-method <method>",
       'How the client authenticates at the token endpoint: "client_secret_post" or "client_secret_basic"',
     )
+    .option(
+      "--token-exchange-body-format <format>",
+      'Body encoding for the token exchange request: "form" (application/x-www-form-urlencoded, default) or "json" (application/json)',
+    )
     .option(
       "--ping-url <url>",
       'Health-check endpoint URL for token validation (e.g. "https://api.example.com/user"). Used by "assistant oauth ping" to verify a stored token.',
@@ -712,6 +724,7 @@ Examples:
           scopes?: string;
           scopeSeparator?: string;
           tokenAuthMethod?: string;
+          tokenExchangeBodyFormat?: string;
           pingUrl?: string;
           pingMethod?: string;
           pingHeaders?: string;
@@ -787,6 +800,8 @@ Examples:
             params.scopeSeparator = opts.scopeSeparator;
           if (opts.tokenAuthMethod !== undefined)
             params.tokenEndpointAuthMethod = opts.tokenAuthMethod;
+          if (opts.tokenExchangeBodyFormat !== undefined)
+            params.tokenExchangeBodyFormat = opts.tokenExchangeBodyFormat;
           if (opts.pingUrl !== undefined) params.pingUrl = opts.pingUrl;
           if (opts.pingMethod !== undefined)
             params.pingMethod = opts.pingMethod;

package/src/cli/commands/oauth/shared.ts

@@ -2,6 +2,7 @@ import type { Command } from "commander";
 
 import { getConfig } from "../../../config/loader.js";
 import {
+  getServiceMode,
   type Services,
   ServicesSchema,
 } from "../../../config/schemas/services.js";
@@ -46,7 +47,7 @@ export function isManagedMode(provider: string): boolean {
   if (!managedKey) return false;
   try {
     const services: Services = getConfig().services;
-    return services[managedKey as keyof Services].mode === "managed";
+    return getServiceMode(services, managedKey as keyof Services) === "managed";
   } catch {
     return false;
   }

package/src/cli/commands/platform/__tests__/callback-routes-list.test.ts

@@ -39,7 +39,9 @@ mock.module("../../../lib/daemon-credential-client.js", () => ({
   }),
 }));
 
+const realLogger = await import("../../../../util/logger.js");
 mock.module("../../../../util/logger.js", () => ({
+  ...realLogger,
   getLogger: () => ({
     info: () => {},
     warn: () => {},
@@ -53,13 +55,12 @@ mock.module("../../../../util/logger.js", () => ({
     debug: () => {},
   }),
   initLogger: () => {},
-  truncateForLog: (value: string, maxLen = 500) =>
-    value.length > maxLen ? value.slice(0, maxLen) + "..." : value,
   pruneOldLogFiles: () => 0,
 }));
 
+const realConfigLoader = await import("../../../../config/loader.js");
 mock.module("../../../../config/loader.js", () => ({
-  API_KEY_PROVIDERS: [] as const,
+  ...realConfigLoader,
   getConfig: () => ({
     permissions: { mode: "workspace" },
     skills: { load: { extraDirs: [] } },
@@ -70,12 +71,6 @@ mock.module("../../../../config/loader.js", () => ({
   saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
-  getNestedValue: () => undefined,
-  setNestedValue: () => {},
-  applyNestedDefaults: (config: unknown) => config,
-  deepMergeMissing: () => false,
-  deepMergeOverwrite: () => {},
-  mergeDefaultWorkspaceConfig: () => {},
 }));
 
 // ---------------------------------------------------------------------------

package/src/cli/commands/platform/__tests__/connect.test.ts

@@ -60,6 +60,7 @@ mock.module("../../../../util/logger.js", () => ({
   truncateForLog: (value: string, maxLen = 500) =>
     value.length > maxLen ? value.slice(0, maxLen) + "..." : value,
   pruneOldLogFiles: () => 0,
+  LOG_FILE_PATTERN: /^assistant-(\d{4}-\d{2}-\d{2})\.log$/,
 }));
 
 mock.module("../../../../config/loader.js", () => ({
@@ -69,6 +70,11 @@ mock.module("../../../../config/loader.js", () => ({
     skills: { load: { extraDirs: [] } },
     sandbox: { enabled: true },
   }),
+  getConfigReadOnly: () => ({
+    permissions: { mode: "workspace" },
+    skills: { load: { extraDirs: [] } },
+    sandbox: { enabled: true },
+  }),
   loadConfig: () => ({}),
   invalidateConfigCache: () => {},
   saveConfig: () => {},

package/src/cli/commands/platform/__tests__/disconnect.test.ts

@@ -30,7 +30,7 @@ mock.module("../../../../config/env-registry.js", () => ({
   getIsContainerized: () => false,
   isPlatformRemote: () => mockIsPlatformRemote,
   getDebugStdoutLogs: () => false,
-  getWorkspaceDirOverride: () => undefined,
+  getWorkspaceDirOverride: () => process.env.VELLUM_WORKSPACE_DIR,
   checkUnrecognizedEnvVars: () => [],
 }));
 
@@ -81,6 +81,7 @@ mock.module("../../../../util/logger.js", () => ({
   truncateForLog: (value: string, maxLen = 500) =>
     value.length > maxLen ? value.slice(0, maxLen) + "..." : value,
   pruneOldLogFiles: () => 0,
+  LOG_FILE_PATTERN: /^assistant-(\d{4}-\d{2}-\d{2})\.log$/,
 }));
 
 mock.module("../../../../config/loader.js", () => ({
@@ -90,6 +91,11 @@ mock.module("../../../../config/loader.js", () => ({
     skills: { load: { extraDirs: [] } },
     sandbox: { enabled: true },
   }),
+  getConfigReadOnly: () => ({
+    permissions: { mode: "workspace" },
+    skills: { load: { extraDirs: [] } },
+    sandbox: { enabled: true },
+  }),
   loadConfig: () => ({}),
   invalidateConfigCache: () => {},
   saveConfig: () => {},

package/src/cli/commands/platform/__tests__/status.test.ts

@@ -61,6 +61,7 @@ mock.module("../../../../util/logger.js", () => ({
   truncateForLog: (value: string, maxLen = 500) =>
     value.length > maxLen ? value.slice(0, maxLen) + "..." : value,
   pruneOldLogFiles: () => 0,
+  LOG_FILE_PATTERN: /^assistant-(\d{4}-\d{2}-\d{2})\.log$/,
 }));
 
 mock.module("../../../../config/loader.js", () => ({
@@ -70,6 +71,11 @@ mock.module("../../../../config/loader.js", () => ({
     skills: { load: { extraDirs: [] } },
     sandbox: { enabled: true },
   }),
+  getConfigReadOnly: () => ({
+    permissions: { mode: "workspace" },
+    skills: { load: { extraDirs: [] } },
+    sandbox: { enabled: true },
+  }),
   loadConfig: () => ({}),
   invalidateConfigCache: () => {},
   saveConfig: () => {},

package/src/cli/program.ts

@@ -1,16 +1,19 @@
+import { existsSync } from "node:fs";
+
 import { Command } from "commander";
 
 import { initFeatureFlagOverrides } from "../config/assistant-feature-flags.js";
-import { getConfig } from "../config/loader.js";
+import { getConfigReadOnly } from "../config/loader.js";
 import { isEmailEnabled } from "../email/feature-gate.js";
 import { registerHooksCommand } from "../hooks/cli.js";
+import { getWorkspaceDir } from "../util/platform.js";
 import { APP_VERSION } from "../version.js";
 import { registerAuditCommand } from "./commands/audit.js";
 import { registerAuthCommand } from "./commands/auth.js";
 import { registerAutonomyCommand } from "./commands/autonomy.js";
 import { registerAvatarCommand } from "./commands/avatar.js";
+import { registerBackupCommand } from "./commands/backup.js";
 import { registerBashCommand } from "./commands/bash.js";
-import { registerBrowserRelayCommand } from "./commands/browser-relay.js";
 import { registerChannelVerificationSessionsCommand } from "./commands/channel-verification-sessions.js";
 import { registerCompletionsCommand } from "./commands/completions.js";
 import { registerConfigCommand } from "./commands/config.js";
@@ -20,6 +23,7 @@ import { registerCredentialExecutionCommand } from "./commands/credential-execut
 import { registerCredentialsCommand } from "./commands/credentials.js";
 import { registerDefaultAction } from "./commands/default-action.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
+import { registerDomainCommand } from "./commands/domain.js";
 import { registerEmailCommand } from "./commands/email.js";
 import { registerKeysCommand } from "./commands/keys.js";
 import { registerMcpCommand } from "./commands/mcp.js";
@@ -33,6 +37,7 @@ import { registerShotgunCommand } from "./commands/shotgun.js";
 import { registerSkillsCommand } from "./commands/skills.js";
 import { registerTrustCommand } from "./commands/trust.js";
 import { registerUsageCommand } from "./commands/usage.js";
+import { log } from "./logger.js";
 
 /**
  * Build the CLI program tree. Pre-populates the feature flag cache from
@@ -59,8 +64,8 @@ Examples:
   );
 
   registerDefaultAction(program);
+  registerBackupCommand(program);
   registerBashCommand(program);
-  registerBrowserRelayCommand(program);
   registerConversationsCommand(program);
   registerConfigCommand(program);
   registerKeysCommand(program);
@@ -74,7 +79,8 @@ Examples:
   registerDoctorCommand(program);
   registerHooksCommand(program);
   registerMcpCommand(program);
-  if (isEmailEnabled(getConfig())) {
+  if (isEmailEnabled(getConfigReadOnly())) {
+    registerDomainCommand(program);
     registerEmailCommand(program);
   }
   registerContactsCommand(program);
@@ -91,5 +97,25 @@ Examples:
   registerShotgunCommand(program);
   registerSequenceCommand(program);
 
+  // Fail fast when no assistant workspace exists on disk. The workspace is
+  // created by `vellum hatch` and must be present for any command to work.
+  // Commander handles --help and --version before preAction fires, so those
+  // remain available even without a workspace.
+  // Workspace-independent commands are exempt:
+  //   completions — pure shell-script generation, no workspace files needed
+  const workspaceExemptCommands = new Set(["completions"]);
+  program.hook("preAction", (_thisCommand, actionCommand) => {
+    if (workspaceExemptCommands.has(actionCommand.name())) {
+      return;
+    }
+    const workspaceDir = getWorkspaceDir();
+    if (!existsSync(workspaceDir)) {
+      log.error(
+        `No assistant workspace found at ${workspaceDir}.\nRun 'vellum hatch' to create an assistant first.`,
+      );
+      process.exit(1);
+    }
+  });
+
   return program;
 }

package/src/config/__tests__/backup-schema.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  BackupConfigSchema,
+  BackupDestinationSchema,
+  BackupOffsiteConfigSchema,
+} from "../schemas/backup.js";
+
+describe("BackupConfigSchema", () => {
+  test("empty object parses to full defaults (disabled, sensible intervals, iCloud default)", () => {
+    const parsed = BackupConfigSchema.parse({});
+    expect(parsed).toEqual({
+      enabled: false,
+      intervalHours: 6,
+      retention: 7,
+      offsite: { enabled: true, destinations: null },
+      localDirectory: null,
+    });
+  });
+
+  test("rejects intervalHours: 0 (must be >= 1)", () => {
+    const result = BackupConfigSchema.safeParse({ intervalHours: 0 });
+    expect(result.success).toBe(false);
+  });
+
+  test("rejects intervalHours above max 168", () => {
+    const result = BackupConfigSchema.safeParse({ intervalHours: 169 });
+    expect(result.success).toBe(false);
+  });
+
+  test("rejects retention: 0 (must be >= 1)", () => {
+    const result = BackupConfigSchema.safeParse({ retention: 0 });
+    expect(result.success).toBe(false);
+  });
+
+  test("rejects retention above max 100", () => {
+    const result = BackupConfigSchema.safeParse({ retention: 101 });
+    expect(result.success).toBe(false);
+  });
+
+  test("valid custom values round-trip", () => {
+    const input = {
+      enabled: true,
+      intervalHours: 12,
+      retention: 30,
+      offsite: {
+        enabled: false,
+        destinations: [{ path: "/mnt/backups", encrypt: true }],
+      },
+      localDirectory: "/var/backups/vellum",
+    };
+    const parsed = BackupConfigSchema.parse(input);
+    expect(parsed).toEqual(input);
+  });
+
+  test("offsite.destinations with only path defaults encrypt to true", () => {
+    const parsed = BackupConfigSchema.parse({
+      offsite: {
+        destinations: [{ path: "/tmp/a" }, { path: "/tmp/b" }],
+      },
+    });
+    expect(parsed.offsite.destinations).toEqual([
+      { path: "/tmp/a", encrypt: true },
+      { path: "/tmp/b", encrypt: true },
+    ]);
+  });
+
+  test("offsite.destinations honors explicit encrypt: false (plaintext allowed)", () => {
+    const parsed = BackupConfigSchema.parse({
+      offsite: {
+        destinations: [{ path: "/tmp/a", encrypt: false }],
+      },
+    });
+    expect(parsed.offsite.destinations).toEqual([
+      { path: "/tmp/a", encrypt: false },
+    ]);
+  });
+
+  test("offsite.destinations allows mixed encryption across destinations", () => {
+    const parsed = BackupConfigSchema.parse({
+      offsite: {
+        destinations: [
+          { path: "/tmp/a", encrypt: true },
+          { path: "/tmp/b", encrypt: false },
+        ],
+      },
+    });
+    expect(parsed.offsite.destinations).toEqual([
+      { path: "/tmp/a", encrypt: true },
+      { path: "/tmp/b", encrypt: false },
+    ]);
+  });
+
+  test("offsite.destinations: [] parses as an explicit empty array (distinct from null)", () => {
+    const parsed = BackupConfigSchema.parse({
+      offsite: { destinations: [] },
+    });
+    expect(parsed.offsite.destinations).toEqual([]);
+    // Distinct from null (the iCloud-default sentinel).
+    expect(parsed.offsite.destinations).not.toBe(null);
+  });
+
+  test("partial config with only enabled: true fills in defaults", () => {
+    const parsed = BackupConfigSchema.parse({ enabled: true });
+    expect(parsed).toEqual({
+      enabled: true,
+      intervalHours: 6,
+      retention: 7,
+      offsite: { enabled: true, destinations: null },
+      localDirectory: null,
+    });
+  });
+});
+
+describe("BackupDestinationSchema", () => {
+  test("defaults encrypt to true when omitted", () => {
+    const parsed = BackupDestinationSchema.parse({ path: "/tmp/x" });
+    expect(parsed).toEqual({ path: "/tmp/x", encrypt: true });
+  });
+
+  test("requires path", () => {
+    const result = BackupDestinationSchema.safeParse({});
+    expect(result.success).toBe(false);
+  });
+});
+
+describe("BackupOffsiteConfigSchema", () => {
+  test("empty object defaults to enabled=true, destinations=null", () => {
+    expect(BackupOffsiteConfigSchema.parse({})).toEqual({
+      enabled: true,
+      destinations: null,
+    });
+  });
+});