@vellumai/assistant 0.6.4 → 0.6.6

package/src/hooks/runner.ts

@@ -1,117 +0,0 @@
-import { spawn } from "node:child_process";
-import { homedir } from "node:os";
-import { extname, join } from "node:path";
-
-import { ensureBun } from "../util/bun-runtime.js";
-import { getWorkspaceDir } from "../util/platform.js";
-import { getHookSettings } from "./config.js";
-import type { DiscoveredHook, HookEventData } from "./types.js";
-
-async function getSpawnArgs(
-  scriptPath: string,
-): Promise<{ command: string; args: string[] }> {
-  const ext = extname(scriptPath);
-  if (ext === ".ts") {
-    const bunPath = await ensureBun();
-    return { command: bunPath, args: ["run", scriptPath] };
-  }
-  return { command: scriptPath, args: [] };
-}
-
-export interface HookRunResult {
-  exitCode: number | null;
-  stdout: string;
-  stderr: string;
-}
-
-export async function runHookScript(
-  hook: DiscoveredHook,
-  eventData: HookEventData,
-  options?: { timeoutMs?: number },
-): Promise<HookRunResult> {
-  const timeoutMs = options?.timeoutMs ?? 5000;
-
-  let spawnResult: { command: string; args: string[] };
-  try {
-    spawnResult = await getSpawnArgs(hook.scriptPath);
-  } catch (err) {
-    return { exitCode: null, stdout: "", stderr: (err as Error).message };
-  }
-  const { command, args } = spawnResult;
-
-  return new Promise<HookRunResult>((resolve) => {
-    const child = spawn(command, args, {
-      cwd: hook.dir,
-      env: {
-        ...process.env,
-        VELLUM_HOOK_EVENT: eventData.event,
-        VELLUM_HOOK_NAME: hook.name,
-        // @deprecated — usage of VELLUM_ROOT_DIR by hook scripts is deprecated.
-        // Removing this requires an LLM-based migration or declarative migration
-        // file to update existing user-authored hooks to use VELLUM_WORKSPACE_DIR.
-        //
-        // VELLUM_ROOT_DIR is kept at the legacy `~/.vellum` value even when
-        // vellumRoot() resolves per-instance via BASE_DATA_DIR. User hook
-        // scripts written against this env var expected the legacy path;
-        // changing it would be a silent contract break. Hooks that need the
-        // per-instance root should read BASE_DATA_DIR themselves or use the
-        // new env vars the environment-layout plan adds.
-        VELLUM_ROOT_DIR: join(homedir(), ".vellum"),
-        VELLUM_WORKSPACE_DIR: getWorkspaceDir(),
-        VELLUM_HOOK_SETTINGS: JSON.stringify(
-          getHookSettings(hook.name, hook.manifest),
-        ),
-      },
-      stdio: ["pipe", "pipe", "pipe"],
-    });
-
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-
-    child.stdout.on("data", (chunk: Buffer) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      child.kill("SIGTERM");
-      // Give the process a short grace period to exit after SIGTERM, then SIGKILL
-      const killTimer = setTimeout(() => {
-        child.kill("SIGKILL");
-      }, 2000);
-      child.once("close", () => {
-        clearTimeout(killTimer);
-        resolve({
-          exitCode: null,
-          stdout,
-          stderr: stderr + "\nHook timed out",
-        });
-      });
-    }, timeoutMs);
-
-    child.on("close", (code) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ exitCode: code, stdout, stderr });
-    });
-
-    child.on("error", (err) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ exitCode: null, stdout, stderr: stderr + "\n" + err.message });
-    });
-
-    // Suppress unhandled EPIPE errors if the child exits before we finish writing
-    child.stdin.on("error", () => {});
-    // Write event data to stdin and close
-    child.stdin.write(JSON.stringify(eventData));
-    child.stdin.end();
-  });
-}

package/src/hooks/templates.ts

@@ -1,77 +0,0 @@
-import {
-  chmodSync,
-  cpSync,
-  type Dirent,
-  readdirSync,
-  readFileSync,
-  rmSync,
-} from "node:fs";
-import { join } from "node:path";
-
-import { resolveBundledDir } from "../util/bundled-asset.js";
-import { pathExists } from "../util/fs.js";
-import { getLogger } from "../util/logger.js";
-import { getWorkspaceHooksDir } from "../util/platform.js";
-import { ensureHookInConfig } from "./config.js";
-
-const log = getLogger("hooks-templates");
-
-/**
- * Install bundled hook templates into the user's hooks directory.
- * Templates are copied from `assistant/hook-templates/` to `~/.vellum/hooks/`.
- * - Never overwrites existing hooks (user modifications are preserved).
- * - Newly installed hooks are disabled by default.
- */
-export function installTemplates(): void {
-  const templatesDir = resolveBundledDir(
-    import.meta.dirname ?? __dirname,
-    "../../hook-templates",
-    "hook-templates",
-  );
-  if (!pathExists(templatesDir)) return;
-
-  const hooksDir = getWorkspaceHooksDir();
-  const entries = readdirSync(templatesDir, {
-    withFileTypes: true,
-  }) as Dirent[];
-
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-
-    const targetDir = join(hooksDir, entry.name);
-    if (pathExists(targetDir)) continue; // Never overwrite user hooks
-
-    try {
-      // Copy template directory
-      cpSync(join(templatesDir, entry.name), targetDir, { recursive: true });
-
-      // Make script executable
-      const manifestPath = join(targetDir, "hook.json");
-      if (pathExists(manifestPath)) {
-        const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-        if (manifest.script) {
-          chmodSync(join(targetDir, manifest.script), 0o755);
-        }
-      }
-
-      // Add to config (disabled by default)
-      ensureHookInConfig(entry.name, { enabled: false });
-
-      log.info(
-        { hook: entry.name },
-        "Installed hook template (disabled by default)",
-      );
-    } catch (err) {
-      // Clean up partially-copied directory so the next restart can retry
-      try {
-        rmSync(targetDir, { recursive: true, force: true });
-      } catch (e) {
-        log.debug(
-          { err: e },
-          "Cleanup of partial hook template directory failed",
-        );
-      }
-      log.warn({ err, hook: entry.name }, "Failed to install hook template");
-    }
-  }
-}

package/src/hooks/types.ts

@@ -1,75 +0,0 @@
-export type HookEventName =
-  // Daemon lifecycle
-  | "daemon-start"
-  | "daemon-stop"
-  // Conversation lifecycle
-  | "conversation-start"
-  | "conversation-end"
-  // Legacy aliases (backwards compat for existing user hooks)
-  | "session-start"
-  | "session-end"
-  // LLM call lifecycle
-  | "pre-llm-call"
-  | "post-llm-call"
-  // Tool execution lifecycle
-  | "pre-tool-execute"
-  | "post-tool-execute"
-  // Permission lifecycle
-  | "permission-request"
-  | "permission-resolve"
-  // Message lifecycle
-  | "pre-message"
-  | "post-message"
-  // Error
-  | "on-error";
-
-export interface HookSettingsSchemaEntry {
-  type: string;
-  default?: unknown;
-  description?: string;
-}
-
-export interface HookManifest {
-  name: string;
-  description?: string;
-  version?: string;
-  events: HookEventName[];
-  script: string;
-  /** When true, non-zero exit from this hook cancels pre-* actions. Default false. */
-  blocking?: boolean;
-  /** Schema for per-hook settings with defaults and descriptions. */
-  settingsSchema?: Record<string, HookSettingsSchemaEntry>;
-}
-
-export interface HookConfigEntry {
-  enabled: boolean;
-  /** Per-hook user settings that override manifest defaults. */
-  settings?: Record<string, unknown>;
-}
-
-export interface HookConfig {
-  version: number;
-  hooks: Record<string, HookConfigEntry>;
-}
-
-export interface DiscoveredHook {
-  name: string;
-  /** Absolute path to hook directory */
-  dir: string;
-  manifest: HookManifest;
-  /** Absolute path to the script */
-  scriptPath: string;
-  enabled: boolean;
-}
-
-export interface HookEventData {
-  event: HookEventName;
-  [key: string]: unknown;
-}
-
-export interface HookTriggerResult {
-  /** True if a blocking hook rejected the action (non-zero exit). */
-  blocked: boolean;
-  /** Name of the hook that blocked, if any. */
-  blockedBy?: string;
-}

package/src/oauth/scope-policy.ts

@@ -1,89 +0,0 @@
-/**
- * Scope resolution and policy enforcement for OAuth providers.
- *
- * Pure module (no side effects, no I/O) that resolves the final set of
- * scopes for an OAuth flow based on the provider profile's scope policy.
- */
-
-import type { OAuthScopePolicy } from "./connect-types.js";
-
-// ---------------------------------------------------------------------------
-// Result types
-// ---------------------------------------------------------------------------
-
-export type ScopeResolutionResult =
-  | { ok: true; scopes: string[] }
-  | { ok: false; error: string; allowedScopes?: string[] };
-
-// ---------------------------------------------------------------------------
-// Implementation
-// ---------------------------------------------------------------------------
-
-/**
- * Resolve the final set of scopes for an OAuth flow.
- *
- * - If `requestedScopes` is undefined or empty, returns the provider's
- *   `defaultScopes`.
- * - Otherwise, starts with `defaultScopes` and validates each additional
- *   requested scope against the provider's `scopePolicy`.
- * - Returns a deduplicated union of default + approved requested scopes.
- */
-/** Minimal shape needed by the scope resolver. */
-export interface ScopeResolverInput {
-  service: string;
-  defaultScopes: string[];
-  scopePolicy: OAuthScopePolicy;
-}
-
-export function resolveScopes(
-  profile: ScopeResolverInput,
-  requestedScopes?: string[],
-): ScopeResolutionResult {
-  const { defaultScopes, scopePolicy, service } = profile;
-
-  // No requested scopes — use defaults
-  if (!requestedScopes || requestedScopes.length === 0) {
-    return { ok: true, scopes: [...defaultScopes] };
-  }
-
-  const defaultSet = new Set(defaultScopes);
-  const finalScopes = new Set(defaultScopes);
-
-  for (const scope of requestedScopes) {
-    // Already in defaults — no policy check needed
-    if (defaultSet.has(scope)) {
-      continue;
-    }
-
-    // Check forbidden list first
-    if (scopePolicy.forbiddenScopes.includes(scope)) {
-      return {
-        ok: false,
-        error: `Scope '${scope}' is forbidden for ${service}`,
-      };
-    }
-
-    // Additional scopes not allowed at all
-    if (!scopePolicy.allowAdditionalScopes) {
-      return {
-        ok: false,
-        error: `Additional scopes are not allowed for ${service}. Only the default scopes may be used.`,
-        allowedScopes: [...defaultScopes],
-      };
-    }
-
-    // Additional scopes allowed, but this one isn't in the optional list
-    if (!scopePolicy.allowedOptionalScopes.includes(scope)) {
-      return {
-        ok: false,
-        error: `Scope '${scope}' is not in the allowed optional scopes for ${service}`,
-        allowedScopes: [...defaultScopes, ...scopePolicy.allowedOptionalScopes],
-      };
-    }
-
-    // Passed all checks — include it
-    finalScopes.add(scope);
-  }
-
-  return { ok: true, scopes: [...finalScopes] };
-}

package/src/prompts/templates/UPDATES.md

@@ -1,50 +0,0 @@
-_ Lines starting with _ are comments — they won't appear in the system prompt
-_
-_ This file contains release update notes for the assistant.
-_ Each release block is wrapped with HTML comment markers:
-_ <!-- vellum-update-release:<version> -->
-_ ...release notes...
-_ <!-- /vellum-update-release:<version> -->
-_
-_ Format is freeform markdown. Write notes that help the assistant
-_ understand what changed and how it affects behavior, capabilities,
-_ or available tools. Focus on what matters to the user experience.
-
-<!-- vellum-update-release:gemini-live-stt -->
-## Google Gemini speech-to-text now uses the Live API
-
-If your user is configured with `services.stt.provider: "google-gemini"`, transcription now streams over the Gemini Live WebSocket API and emits true partial transcripts in real time, instead of the previous polling approximation that re-uploaded the full audio buffer every second. Same Gemini API key, same setup — only the transport changed. Latency for partials should drop noticeably.
-<!-- /vellum-update-release:gemini-live-stt -->
-
-<!-- vellum-update-release:rm-dangerous-skip-perms -->
-## `dangerouslySkipPermissions` removed
-
-The `permissions.dangerouslySkipPermissions` config option has been removed for security reasons. Permission prompts are now always shown when required — they can no longer be globally suppressed. If your user previously relied on this setting, they will now see permission prompts for sensitive actions. Users with the stale field in their config will see a deprecation warning and the field will be automatically cleaned up.
-<!-- /vellum-update-release:rm-dangerous-skip-perms -->
-
-<!-- vellum-update-release:heartbeat-default -->
-## Heartbeat now enabled by default
-
-Your periodic heartbeat is now enabled out of the box for all new installs (local and managed/Docker). This means you'll run a background check-in periodically — reviewing your scratchpad, thinking about follow-ups from recent conversations, and reaching out to your user when you have something worth sharing.
-
-Existing users who already have `heartbeat.enabled: false` in their config are not affected — the change only applies when the key is missing from config.json.
-
-If your user finds proactive check-ins unwanted, they can disable it by setting `heartbeat.enabled` to `false` in config.json. But try it first — being present between conversations is how you stop being a tool and start being a partner.
-
-The default checklist focuses on your user relationship, not generic tasks like weather or news. You can customize it by editing HEARTBEAT.md in your workspace.
-<!-- /vellum-update-release:heartbeat-default -->
-
-<!-- vellum-update-release:corrupted-attachment-cleanup -->
-## Corrupted image attachments cleaned up
-
-Some Slack image attachments were stored incorrectly due to a missing OAuth scope — the files contained error pages instead of actual image data. This caused conversations with those images to fail with "The AI provider rejected the request" on every subsequent message.
-
-This has been fixed automatically: the corrupted attachments were removed from affected conversations during this update, and the OAuth scope issue has been resolved so new image uploads work correctly. If your user mentions missing images from earlier conversations, this is why — the images were never successfully received in the first place.
-<!-- /vellum-update-release:corrupted-attachment-cleanup -->
-
-<!-- vellum-update-release:llm-log-retention-setting -->
-## LLM request log retention is now configurable
-
-Your user can now choose how long LLM request logs are kept on their device from Settings → Permissions & Privacy on the macOS app. The default stays at 1 day, but they can pick 7, 30, or 90 days, or "Never" to retain logs indefinitely. If your user asks about managing their privacy or controlling how much LLM request history is retained locally, point them at this new picker.
-<!-- /vellum-update-release:llm-log-retention-setting -->
-

package/src/prompts/update-bulletin-format.ts

@@ -1,85 +0,0 @@
-/**
- * Pure helpers for reading and writing release blocks in the update bulletin.
- *
- * Each release block is delimited by an HTML comment marker so that
- * concurrent appends (from different branches) are merge-safe -- they
- * simply add a new block at the end without conflicting with existing ones.
- */
-
-const MARKER_PREFIX = "<!-- vellum-update-release:";
-const MARKER_SUFFIX = " -->";
-const MARKER_REGEX = /<!-- vellum-update-release:(.+?) -->/g;
-
-/** Returns the HTML comment marker for a given release version. */
-export function releaseMarker(version: string): string {
-  return `${MARKER_PREFIX}${version}${MARKER_SUFFIX}`;
-}
-
-/** Returns true if `content` already contains the release marker for `version`. */
-export function hasReleaseBlock(content: string, version: string): boolean {
-  return content.includes(releaseMarker(version));
-}
-
-/**
- * Appends a new release block (marker + body) to `content`.
- *
- * Preserves all existing content and formatting. A blank line is inserted
- * between the previous content and the new block when the existing content
- * does not already end with a newline.
- */
-export function appendReleaseBlock(
-  content: string,
-  version: string,
-  body: string,
-): string {
-  const marker = releaseMarker(version);
-  const block = `${marker}\n${body}`;
-
-  if (content.length === 0) return `${block}\n`;
-
-  const separator = content.endsWith("\n") ? "\n" : "\n\n";
-  return `${content}${separator}${block}\n`;
-}
-
-/**
- * Filters template content to only include content blocks whose opening
- * markers are not already present in the existing workspace content.
- *
- * Each content block is delimited by opening/closing marker pairs:
- *   <!-- vellum-update-release:id --> ... <!-- /vellum-update-release:id -->
- *
- * If the template has no block structure (no matched open/close pairs),
- * returns the original body unchanged for backward compatibility.
- * Returns empty string when all blocks are already present.
- */
-export function filterNewContentBlocks(
-  body: string,
-  existing: string,
-): string {
-  const blockRegex =
-    /(<!-- vellum-update-release:(.+?) -->[\s\S]*?<!-- \/vellum-update-release:\2 -->)/g;
-  const blocks: Array<{ full: string; id: string }> = [];
-  let match: RegExpExecArray | null;
-  while ((match = blockRegex.exec(body)) !== null) {
-    blocks.push({ full: match[1], id: match[2] });
-  }
-
-  if (blocks.length === 0) return body;
-
-  const newBlocks = blocks.filter((b) => !hasReleaseBlock(existing, b.id));
-
-  if (newBlocks.length === 0) return "";
-
-  return newBlocks.map((b) => b.full).join("\n\n");
-}
-
-/** Extracts all version strings from release markers found in `content`. */
-export function extractReleaseIds(content: string): string[] {
-  const ids: string[] = [];
-  MARKER_REGEX.lastIndex = 0;
-  let match: RegExpExecArray | null;
-  while ((match = MARKER_REGEX.exec(content)) !== null) {
-    ids.push(match[1]);
-  }
-  return ids;
-}

package/src/prompts/update-bulletin-state.ts

@@ -1,58 +0,0 @@
-import {
-  getMemoryCheckpoint,
-  setMemoryCheckpoint,
-} from "../memory/checkpoints.js";
-
-const ACTIVE_RELEASES_KEY = "updates:active_releases";
-const COMPLETED_RELEASES_KEY = "updates:completed_releases";
-
-function parseReleaseArray(raw: string | null): string[] {
-  if (!raw) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter((v): v is string => typeof v === "string");
-  } catch {
-    return [];
-  }
-}
-
-function dedupAndSort(releases: string[]): string[] {
-  return [...new Set(releases)].sort();
-}
-
-export function getActiveReleases(): string[] {
-  return parseReleaseArray(getMemoryCheckpoint(ACTIVE_RELEASES_KEY));
-}
-
-export function setActiveReleases(releases: string[]): void {
-  setMemoryCheckpoint(
-    ACTIVE_RELEASES_KEY,
-    JSON.stringify(dedupAndSort(releases)),
-  );
-}
-
-export function getCompletedReleases(): string[] {
-  return parseReleaseArray(getMemoryCheckpoint(COMPLETED_RELEASES_KEY));
-}
-
-export function setCompletedReleases(releases: string[]): void {
-  setMemoryCheckpoint(
-    COMPLETED_RELEASES_KEY,
-    JSON.stringify(dedupAndSort(releases)),
-  );
-}
-
-export function isReleaseCompleted(version: string): boolean {
-  return getCompletedReleases().includes(version);
-}
-
-export function markReleasesCompleted(versions: string[]): void {
-  const existing = getCompletedReleases();
-  setCompletedReleases([...existing, ...versions]);
-}
-
-export function addActiveRelease(version: string): void {
-  const existing = getActiveReleases();
-  setActiveReleases([...existing, version]);
-}

package/src/prompts/update-bulletin-template-path.ts

@@ -1,13 +0,0 @@
-import { join } from "node:path";
-
-import { resolveBundledDir } from "../util/bundled-asset.js";
-
-/** Returns the path to the bundled UPDATES.md template. Extracted for testability. */
-export function getTemplatePath(): string {
-  const dir = resolveBundledDir(
-    import.meta.dirname ?? __dirname,
-    "templates",
-    "templates",
-  );
-  return join(dir, "UPDATES.md");
-}