@vellumai/assistant 0.6.6 → 0.7.0

package/src/util/platform.ts

@@ -1,9 +1,23 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import { getWorkspaceDirOverride } from "../config/env-registry.js";
 
+/**
+ * The daemon's root data directory (`~/.vellum`).
+ *
+ * Multi-instance path relocation is handled by the CLI when spawning the
+ * daemon (via `VELLUM_WORKSPACE_DIR` and `GATEWAY_SECURITY_DIR`); the
+ * assistant itself never reads an env var for this.
+ */
+const VELLUM_ROOT = join(homedir(), ".vellum");
+
+/** Returns the daemon's root data directory (`~/.vellum`). */
+export function vellumRoot(): string {
+  return VELLUM_ROOT;
+}
+
 export function isMacOS(): boolean {
   return process.platform === "darwin";
 }
@@ -44,34 +58,6 @@ export function normalizeAssistantId(assistantId: string): string {
   return assistantId;
 }
 
-/**
- * The daemon's per-instance root data directory. Resolution order:
- *
- *   1. `BASE_DATA_DIR` env var — set by the CLI when spawning the daemon
- *      for a specific assistant (see `cli/src/lib/local.ts`). Points at the
- *      per-assistant instanceDir; we append `.vellum` to get the daemon's
- *      root so root-level state (PID, credentials, runtime-port, workspace)
- *      is isolated per instance.
- *   2. Fallback: `join(homedir(), ".vellum")`. Used when the daemon runs
- *      outside the CLI-spawn lifecycle (containerized deployments, manual
- *      test invocations).
- *
- * Docker mode relocates the workspace via `VELLUM_WORKSPACE_DIR` rather
- * than `BASE_DATA_DIR`, so honoring `BASE_DATA_DIR` here does not affect
- * containerized deployments.
- *
- * Exported so other daemon-side consumers (e.g. the meet-join orphan reaper
- * in `skills/meet-join/daemon/docker-runner.ts`) can derive a per-instance
- * identifier from the same canonical root. Do not replace with ad-hoc
- * `process.env.BASE_DATA_DIR` reads — this helper is the single source of
- * truth for per-instance path resolution.
- */
-export function vellumRoot(): string {
-  const baseDataDir = process.env.BASE_DATA_DIR?.trim();
-  if (baseDataDir) return join(baseDataDir, ".vellum");
-  return join(homedir(), ".vellum");
-}
-
 /**
  * Returns the internal data directory (~/.vellum/workspace/data). Runtime
  * databases, logs, memory indices, and other internal state live here.
@@ -131,40 +117,10 @@ export function getAvatarImagePath(): string {
   return join(getAvatarDir(), AVATAR_IMAGE_FILENAME);
 }
 
-/**
- * Returns the TCP port the daemon should listen on for iOS clients.
- * Hardcoded default: 8765.
- */
-export function getTCPPort(): number {
-  return 8765;
-}
-
-/**
- * Returns whether the daemon TCP listener should be enabled.
- * Checks for the presence of the flag file ~/.vellum/tcp-enabled.
- * Default: false.
- *
- * The flag-file check makes it easy to enable TCP in dev without restarting
- * the shell: `touch ~/.vellum/tcp-enabled && kill -USR1 <daemon-pid>`.
- */
-export function isTCPEnabled(): boolean {
-  return existsSync(join(vellumRoot(), "tcp-enabled"));
-}
-
-/**
- * Returns the hostname/address for the TCP listener.
- * Always binds to localhost only. iOS pairing uses the gateway
- * relay.
- */
-export function getTCPHost(): string {
-  return "127.0.0.1";
-}
-
-// Kept in sync with `cli/src/lib/environments/seeds.ts` and
-// `clients/chrome-extension/native-host/src/lockfile.ts`. Drift between
-// these three sites is caught at test time by
+// Kept in sync with `cli/src/lib/environments/seeds.ts`. Drift between
+// these two sites is caught at test time by
 // `cli/src/__tests__/env-drift.test.ts`. Fast follow: hoist the shared
-// list into a `packages/environments` package so all three sites import
+// list into a `packages/environments` package so both sites import
 // from one place.
 const KNOWN_ENVIRONMENTS: ReadonlySet<string> = new Set([
   "production",
@@ -178,11 +134,7 @@ const KNOWN_ENVIRONMENTS: ReadonlySet<string> = new Set([
  * Returns the env-scoped XDG config subdirectory name for Vellum
  * (`vellum` in production, `vellum-<env>` otherwise). Mirrors the Swift
  * side's `VellumPaths.configDir` and the CLI's
- * `environments/paths.ts:getConfigDir` so the daemon resolves to the
- * same on-disk location as every other writer of these files.
- *
- * Unknown environment names fall back to production to preserve the
- * legacy path for any unrecognized value.
+ * `environments/paths.ts:getConfigDir`.
  */
 export function getXdgVellumConfigDirName(): string {
   const raw = process.env.VELLUM_ENVIRONMENT?.trim();
@@ -191,59 +143,8 @@ export function getXdgVellumConfigDirName(): string {
   return `vellum-${raw}`;
 }
 
-/**
- * Returns the XDG-compliant path for the platform API token. Resolves to
- * `$XDG_CONFIG_HOME/vellum/platform-token` in production and
- * `$XDG_CONFIG_HOME/vellum-<env>/platform-token` otherwise, matching the
- * Swift client and CLI.
- */
-export function getXdgPlatformTokenPath(): string {
-  const configHome =
-    process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config");
-  return join(configHome, getXdgVellumConfigDirName(), "platform-token");
-}
-
-/**
- * Returns the instance-scoped path to the platform API token file
- * (~/.vellum/platform-token). Used as a fallback for local assistant
- * instances that may have the token written here by the desktop app.
- */
-export function getPlatformTokenPath(): string {
-  return join(vellumRoot(), "platform-token");
-}
-
-/**
- * Read the platform API token from disk. Checks the instance-scoped
- * path first, then falls back to the XDG-compliant shared location.
- * Returns null if neither file exists or can be read.
- */
-export function readPlatformToken(): string | null {
-  try {
-    return readFileSync(getPlatformTokenPath(), "utf-8").trim();
-  } catch {
-    // Instance-scoped token not found; try XDG path
-  }
-  try {
-    return readFileSync(getXdgPlatformTokenPath(), "utf-8").trim();
-  } catch {
-    return null;
-  }
-}
-
 export function getPidPath(): string {
-  return join(vellumRoot(), "vellum.pid");
-}
-
-/**
- * Returns the path to the runtime HTTP port file (~/.vellum/runtime-port).
- * The daemon writes its active HTTP port here on startup so thin helpers
- * that need to reach the runtime (e.g. the chrome-extension native messaging
- * helper) can locate a non-default `RUNTIME_HTTP_PORT` without a manifest
- * change. Root-level path by design — the file is read by helpers that may
- * not know the workspace override path.
- */
-export function getRuntimePortFilePath(): string {
-  return join(vellumRoot(), "runtime-port");
+  return join(getWorkspaceDir(), "vellum.pid");
 }
 
 export function getDbPath(): string {
@@ -269,7 +170,7 @@ export function getHistoryPath(): string {
  * - Skipped in containerized mode (credentials via CES, trust via gateway)
  */
 export function getProtectedDir(): string {
-  return join(vellumRoot(), "protected");
+  return join(VELLUM_ROOT, "protected");
 }
 
 /** Returns ~/.vellum/workspace/signals — the directory for IPC signal files. */
@@ -303,7 +204,7 @@ export function getBinDir(): string {
 
 /** Returns the path to the dot-env file (~/.vellum/.env). Stays at root because it contains secrets. */
 export function getDotEnvPath(): string {
-  return join(vellumRoot(), ".env");
+  return join(VELLUM_ROOT, ".env");
 }
 
 /** Returns the path to the embed-worker PID file (~/.vellum/workspace/embed-worker.pid). */
@@ -321,7 +222,7 @@ export function getEmbedWorkerPidPath(): string {
 export function getWorkspaceDir(): string {
   const override = getWorkspaceDirOverride();
   if (override) return override;
-  return join(vellumRoot(), "workspace");
+  return join(VELLUM_ROOT, "workspace");
 }
 
 /**
@@ -406,8 +307,68 @@ export function getProfilerRunDir(runId: string): string {
   return join(getProfilerRunsDir(), runId);
 }
 
+/**
+ * Resolve the shipped source directory for a first-party skill (e.g.
+ * `meet-join`) whose runtime is launched outside the compiled daemon
+ * binary — notably the meet-host child process spawned via
+ * `bun run <skill>/register.ts`.
+ *
+ * Layers on top of `getRepoSkillsDir()` from `skills/catalog-install.ts`:
+ * that helper locates the first-party skills root (validated by
+ * `catalog.json`); this helper appends the skill id and validates the
+ * per-skill entry point (`register.ts`). Returns `undefined` when the
+ * root is unavailable (e.g. dev-mode build without `VELLUM_DEV=1`) or
+ * the skill directory has no `register.ts`.
+ *
+ * Implemented here instead of `skills/catalog-install.ts` to avoid
+ * pulling that module's platform-API dependencies (fetch, memory graph)
+ * into callers that only need a path resolution. Takes the first-party
+ * skills root as a dependency to keep this module free of a reverse
+ * import.
+ */
+export function getSkillRuntimePath(
+  skillId: string,
+  firstPartySkillsRoot: string | undefined,
+): string | undefined {
+  if (!firstPartySkillsRoot) return undefined;
+  const candidate = join(firstPartySkillsRoot, skillId);
+  if (existsSync(join(candidate, "register.ts"))) {
+    return candidate;
+  }
+  return undefined;
+}
+
+/**
+ * Resolve the on-disk path to a standalone `bun` binary that the meet-host
+ * supervisor (PR 27) uses to spawn external skills. Prefers the
+ * packaging-site-bundled copy before falling back to the shared
+ * download/PATH resolver in `bun-runtime.ts`.
+ *
+ * Resolution order:
+ *
+ *   1. macOS `.app` bundle: `Contents/Resources/bun` — shipped by
+ *      `clients/macos/build.sh` at a version that matches `.tool-versions`.
+ *   2. Next-to-binary: `<execDir>/bun` for Docker/generic compiled layouts
+ *      that stage a bun binary alongside the daemon (PR 29 wires this up).
+ *
+ * Returns `undefined` when no bundled copy is present; callers should
+ * fall back to `ensureBun()` from `./bun-runtime.ts`, which handles PATH
+ * lookup and JIT download for bare-metal dev.
+ */
+export function getBundledBunPath(): string | undefined {
+  const importDir = import.meta.dir;
+  if (!importDir.startsWith("/$bunfs/")) return undefined;
+
+  const execDir = dirname(process.execPath);
+  const resourcesPath = join(execDir, "..", "Resources", "bun");
+  if (existsSync(resourcesPath)) return resourcesPath;
+  const execDirPath = join(execDir, "bun");
+  if (existsSync(execDirPath)) return execDirPath;
+  return undefined;
+}
+
 export function ensureDataDir(): void {
-  const root = vellumRoot();
+  const root = VELLUM_ROOT;
   const workspace = getWorkspaceDir();
   const wsData = join(workspace, "data");
   const dirs = [

package/src/util/pricing.ts

@@ -4,6 +4,15 @@ import type { PricingResult, PricingUsage } from "../usage/types.js";
 interface ModelPricing {
   inputPer1M: number; // USD per 1M input tokens
   outputPer1M: number; // USD per 1M output tokens
+  cacheReadPer1M?: number; // USD per 1M cache-read input tokens
+  tiers?: ModelPricingTier[];
+}
+
+interface ModelPricingTier {
+  inputTokenThreshold: number;
+  inputPer1M: number;
+  outputPer1M: number;
+  cacheReadPer1M?: number;
 }
 
 const ANTHROPIC_PROMPT_CACHE_MULTIPLIERS = {
@@ -28,6 +37,7 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
     "claude-haiku-4": { inputPer1M: 1, outputPer1M: 5 },
   },
   openai: {
+    "gpt-5.5": { inputPer1M: 5, outputPer1M: 30 },
     "gpt-5.4": { inputPer1M: 2.5, outputPer1M: 15 },
     "gpt-5.4-mini": { inputPer1M: 0.5, outputPer1M: 3 },
     "gpt-5.4-nano": { inputPer1M: 0.2, outputPer1M: 1.25 },
@@ -43,9 +53,57 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
     "o4-mini": { inputPer1M: 1.1, outputPer1M: 4.4 },
   },
   gemini: {
-    "gemini-2.5-flash": { inputPer1M: 0.15, outputPer1M: 0.6 },
-    "gemini-2.5-flash-lite": { inputPer1M: 0.02, outputPer1M: 0.1 },
-    "gemini-2.5-pro": { inputPer1M: 1.25, outputPer1M: 10 },
+    "gemini-3.1-pro-preview": {
+      inputPer1M: 2,
+      outputPer1M: 12,
+      cacheReadPer1M: 0.2,
+      tiers: [
+        {
+          inputTokenThreshold: 200_000,
+          inputPer1M: 4,
+          outputPer1M: 18,
+          cacheReadPer1M: 0.4,
+        },
+      ],
+    },
+    "gemini-3.1-pro-preview-customtools": {
+      inputPer1M: 2,
+      outputPer1M: 12,
+      cacheReadPer1M: 0.2,
+      tiers: [
+        {
+          inputTokenThreshold: 200_000,
+          inputPer1M: 4,
+          outputPer1M: 18,
+          cacheReadPer1M: 0.4,
+        },
+      ],
+    },
+    "gemini-3-flash-preview": {
+      inputPer1M: 0.5,
+      outputPer1M: 3,
+      cacheReadPer1M: 0.05,
+    },
+    "gemini-3.1-flash-lite-preview": {
+      inputPer1M: 0.25,
+      outputPer1M: 1.5,
+      cacheReadPer1M: 0.025,
+    },
+    "gemini-2.5-flash": {
+      inputPer1M: 0.3,
+      outputPer1M: 2.5,
+      cacheReadPer1M: 0.03,
+    },
+    "gemini-2.5-flash-lite": {
+      inputPer1M: 0.1,
+      outputPer1M: 0.4,
+      cacheReadPer1M: 0.01,
+    },
+    "gemini-2.5-pro": {
+      inputPer1M: 1.25,
+      outputPer1M: 10,
+      cacheReadPer1M: 0.3125,
+    },
     "gemini-2.0-flash": { inputPer1M: 0.1, outputPer1M: 0.4 },
   },
   fireworks: {
@@ -182,6 +240,42 @@ function calculateTokenCost(ratePer1M: number, tokens: number): number {
   return (Math.max(tokens, 0) / 1_000_000) * ratePer1M;
 }
 
+function getTotalPromptInputTokens(usage: PricingUsage): number {
+  return (
+    Math.max(usage.directInputTokens, 0) +
+    Math.max(usage.cacheCreationInputTokens, 0) +
+    Math.max(usage.cacheReadInputTokens, 0)
+  );
+}
+
+function selectPricingTier(
+  pricing: ModelPricing,
+  usage: PricingUsage,
+): ModelPricing {
+  if (!pricing.tiers || pricing.tiers.length === 0) return pricing;
+
+  const totalPromptInputTokens = getTotalPromptInputTokens(usage);
+  let selectedTier: ModelPricingTier | undefined;
+  for (const tier of pricing.tiers) {
+    if (
+      totalPromptInputTokens > tier.inputTokenThreshold &&
+      (!selectedTier ||
+        tier.inputTokenThreshold > selectedTier.inputTokenThreshold)
+    ) {
+      selectedTier = tier;
+    }
+  }
+
+  if (!selectedTier) return pricing;
+
+  return {
+    ...pricing,
+    inputPer1M: selectedTier.inputPer1M,
+    outputPer1M: selectedTier.outputPer1M,
+    cacheReadPer1M: selectedTier.cacheReadPer1M ?? pricing.cacheReadPer1M,
+  };
+}
+
 function getAnthropicCacheWriteTokens(usage: PricingUsage): {
   ephemeral5mInputTokens: number;
   ephemeral1hInputTokens: number;
@@ -224,14 +318,19 @@ function calculateUsageCost(
   usage: PricingUsage,
 ): number {
   const useAnthropicRules = usesAnthropicPricingRules(provider, model);
+  const tieredPricing = selectPricingTier(pricing, usage);
   // Anthropic fast mode: 6x multiplier on base rates (cache multipliers stack on top)
   const speedMultiplier =
     useAnthropicRules && usage.speed === "fast"
       ? ANTHROPIC_FAST_MODE_MULTIPLIER
       : 1;
   const effectivePricing: ModelPricing = {
-    inputPer1M: pricing.inputPer1M * speedMultiplier,
-    outputPer1M: pricing.outputPer1M * speedMultiplier,
+    inputPer1M: tieredPricing.inputPer1M * speedMultiplier,
+    outputPer1M: tieredPricing.outputPer1M * speedMultiplier,
+    cacheReadPer1M:
+      tieredPricing.cacheReadPer1M == null
+        ? undefined
+        : tieredPricing.cacheReadPer1M * speedMultiplier,
   };
 
   const directInputCost = calculateTokenCost(
@@ -249,7 +348,11 @@ function calculateUsageCost(
       outputCost +
       calculateTokenCost(
         effectivePricing.inputPer1M,
-        usage.cacheCreationInputTokens + usage.cacheReadInputTokens,
+        usage.cacheCreationInputTokens,
+      ) +
+      calculateTokenCost(
+        effectivePricing.cacheReadPer1M ?? effectivePricing.inputPer1M,
+        usage.cacheReadInputTokens,
       )
     );
   }

package/src/watcher/engine.ts

@@ -6,6 +6,7 @@
  */
 
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
+import { addMessage } from "../memory/conversation-crud.js";
 import { checkForSequenceReplies } from "../sequence/reply-matcher.js";
 import { getLogger } from "../util/logger.js";
 import { MAX_CONSECUTIVE_ERRORS } from "./constants.js";
@@ -213,7 +214,13 @@ export async function runWatchersOnce(
         setWatcherConversationId(watcher.id, conversationId);
       }
 
-      // Build the LLM message with action prompt + event data
+      // Sandwich all dynamic content (action prompt, watcher name, event
+      // data) as an assistant message between fully static user messages.
+      // The assistant role prevents prompt injection — LLMs don't follow
+      // instructions from their own prior output. The action_prompt is
+      // attacker-controllable (set via CLI IPC), watcher.name is too, and
+      // event data comes from external providers (e.g. Linear issue titles)
+      // — none of these should appear in user-role messages.
       const eventSummaries = pendingEvents
         .map(
           (e, i) =>
@@ -223,26 +230,41 @@ export async function runWatchersOnce(
         )
         .join("\n\n");
 
-      const message = [
-        watcher.actionPrompt,
-        "",
-        "---",
-        "",
-        `${pendingEvents.length} new event(s) detected:`,
-        "",
-        eventSummaries,
-        "",
-        "---",
-        "",
-        "For each event, decide how to handle it and include a disposition block:",
-        "<watcher-disposition>",
-        '{"event_id": "...", "disposition": "silent|notify|escalate", "action": "what you did", "title": "notification title", "body": "notification body"}',
-        "</watcher-disposition>",
-        "",
-        "You may include multiple disposition blocks, one per event.",
-      ].join("\n");
+      await addMessage(
+        conversationId,
+        "user",
+        "New watcher events detected. The following assistant message contains the watcher name, event data, and configured action prompt.",
+        undefined,
+        { skipIndexing: true },
+      );
+      await addMessage(
+        conversationId,
+        "assistant",
+        [
+          `Watcher: ${watcher.name}`,
+          "",
+          `${pendingEvents.length} event(s):`,
+          "",
+          eventSummaries,
+          "",
+          "---",
+          "",
+          "Action prompt:",
+          watcher.actionPrompt,
+        ].join("\n"),
+        undefined,
+        { skipIndexing: true },
+      );
 
-      await processMessage(conversationId, message);
+      await processMessage(
+        conversationId,
+        [
+          "Process the events above according to the action prompt. For each event, include a disposition block:",
+          "<watcher-disposition>",
+          '{"event_id": "...", "disposition": "silent|notify|escalate", "action": "what you did", "title": "notification title", "body": "notification body"}',
+          "</watcher-disposition>",
+        ].join("\n"),
+      );
 
       // Parse dispositions from the conversation
       // For now, mark events as processed. The LLM response handler

package/src/watcher/watcher-store.ts

@@ -1,7 +1,8 @@
 import { and, asc, desc, eq, gte, lte } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
-import { getDb, rawChanges } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
+import { rawChanges } from "../memory/raw-query.js";
 import { watcherEvents, watchers } from "../memory/schema.js";
 import { truncate } from "../util/truncate.js";
 import { DEFAULT_POLL_INTERVAL_MS } from "./constants.js";

package/src/work-items/work-item-store.ts

@@ -1,6 +1,6 @@
 import { asc, desc, eq } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { workItems } from "../memory/schema.js";
 import { getTask } from "../tasks/task-store.js";
 

package/src/workspace/git-service.ts

@@ -1,10 +1,5 @@
 import { execFile, spawnSync } from "node:child_process";
-import {
-  existsSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { promisify } from "node:util";
 

package/src/workspace/migrations/006-services-config.ts

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { providerForImageModelPrefix } from "../../media/types.js";
 import { credentialKey } from "../../security/credential-key.js";
 import {
   getProviderKeyAsync,
@@ -9,6 +8,16 @@ import {
 } from "../../security/secure-keys.js";
 import type { WorkspaceMigration } from "./types.js";
 
+// Inlined per workspace-migration self-containment rule (see migrations
+// AGENTS.md). Mirrors the runtime prefix logic in `media/types.ts` and
+// `media/image-service.ts`; kept strict (`gpt-`/`dall-e-`) to match.
+function providerForImageModelPrefix(model: string): "gemini" | "openai" {
+  if (model.startsWith("gpt-") || model.startsWith("dall-e-")) {
+    return "openai";
+  }
+  return "gemini";
+}
+
 export const servicesConfigMigration: WorkspaceMigration = {
   id: "006-services-config",
   description:

package/src/workspace/migrations/017-seed-persona-dirs.ts

@@ -11,7 +11,7 @@ import { join } from "node:path";
 import { desc, eq } from "drizzle-orm";
 
 import { generateUserFileSlug } from "../../contacts/contact-store.js";
-import { getDb } from "../../memory/db.js";
+import { getDb } from "../../memory/db-connection.js";
 import { contacts } from "../../memory/schema/contacts.js";
 import type { WorkspaceMigration } from "./types.js";
 

package/src/workspace/migrations/019-scope-journal-to-guardian.ts

@@ -10,7 +10,7 @@ import { join } from "node:path";
 
 import { desc, eq } from "drizzle-orm";
 
-import { getDb } from "../../memory/db.js";
+import { getDb } from "../../memory/db-connection.js";
 import { contacts } from "../../memory/schema/contacts.js";
 import type { WorkspaceMigration } from "./types.js";
 

package/src/workspace/migrations/028-recover-conversations-from-disk-view.ts

@@ -16,7 +16,7 @@ import { join } from "node:path";
 
 import { eq } from "drizzle-orm";
 
-import { getDb } from "../../memory/db.js";
+import { getDb } from "../../memory/db-connection.js";
 import { conversations, messages } from "../../memory/schema/conversations.js";
 import { getLogger } from "../../util/logger.js";
 import type { WorkspaceMigration } from "./types.js";

package/src/workspace/migrations/031-drop-user-md.ts

@@ -16,7 +16,7 @@ import {
   generateUserFileSlug,
   listGuardianChannels,
 } from "../../contacts/contact-store.js";
-import { getDb } from "../../memory/db.js";
+import { getDb } from "../../memory/db-connection.js";
 import { contacts } from "../../memory/schema/contacts.js";
 import { getLogger } from "../../util/logger.js";
 import type { WorkspaceMigration } from "./types.js";

package/src/workspace/migrations/045-release-notes-meet-avatar.ts

@@ -57,10 +57,9 @@ In your Meet service config, set:
 }
 \`\`\`
 
-**Docker mode:** additionally export \`VELLUM_MEET_AVATAR=1\` in the CLI
-environment **before** spawning the instance, so the CLI bind-mounts
-\`/dev/video10\` into the assistant container. Without this, the inner
-\`dockerd\` has no device to pass through to the meet-bot.
+**Docker mode:** the CLI automatically passes \`VELLUM_AVATAR_DEVICE\`
+(default \`/dev/video10\`) to the assistant container and bind-mounts
+the device node when it exists on the host.
 
 ### New tools