@vellumai/assistant 0.6.6 → 0.7.1

package/src/backup/__tests__/restore.test.ts

@@ -31,6 +31,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
+import { defaultV1Options } from "../../runtime/migrations/__tests__/v1-test-helpers.js";
 import { buildVBundle } from "../../runtime/migrations/vbundle-builder.js";
 import type { PathResolver } from "../../runtime/migrations/vbundle-import-analyzer.js";
 import type {
@@ -78,11 +79,13 @@ const NULL_RESOLVER: PathResolver = {
  * the file path along with the manifest the builder embedded so tests can
  * compare against it.
  */
-function writeTinyPlaintextBundle(
-  fileName: string,
-): { path: string; manifest: ManifestType } {
+function writeTinyPlaintextBundle(fileName: string): {
+  path: string;
+  manifest: ManifestType;
+} {
   const { archive, manifest } = buildVBundle({
     files: [
+      { path: "data/db/assistant.db", data: new Uint8Array() },
       {
         path: "workspace/notes/hello.txt",
         data: new TextEncoder().encode("hello world"),
@@ -92,8 +95,7 @@ function writeTinyPlaintextBundle(
         data: new TextEncoder().encode("a tiny bundle for tests"),
       },
     ],
-    source: "restore-test",
-    description: "tiny bundle for restore.test.ts",
+    ...defaultV1Options(),
   });
 
   const path = join(TEST_DIR, fileName);
@@ -117,21 +119,35 @@ function makeStubCommitImpl(): {
   const calls: RecordedCall[] = [];
   const commitImpl = (options: ImportCommitOptions): ImportCommitResult => {
     calls.push({ options });
-    const manifest =
+    const manifest: ManifestType =
       options.preValidatedManifest ??
       ({
-        schema_version: "1.0",
+        schema_version: 1,
+        bundle_id: "00000000-0000-4000-8000-000000000000",
         created_at: new Date().toISOString(),
-        files: [],
-        manifest_sha256: "stub",
-      } satisfies ManifestType);
+        assistant: { id: "self", name: "Test", runtime_version: "0.0.0-test" },
+        origin: { mode: "self-hosted-local" },
+        compatibility: {
+          min_runtime_version: "0.0.0-test",
+          max_runtime_version: null,
+        },
+        contents: [],
+        checksum:
+          "0000000000000000000000000000000000000000000000000000000000000000",
+        secrets_redacted: false,
+        export_options: {
+          include_logs: false,
+          include_browser_state: false,
+          include_memory_vectors: false,
+        },
+      } as ManifestType);
     return {
       ok: true,
       report: {
         success: true,
         summary: {
-          total_files: manifest.files.length,
-          files_created: manifest.files.length,
+          total_files: manifest.contents.length,
+          files_created: manifest.contents.length,
           files_overwritten: 0,
           files_skipped: 0,
           backups_created: 0,
@@ -178,8 +194,9 @@ describe("verifySnapshot", () => {
     expect(result.valid).toBe(true);
     expect(result.manifest).toBeDefined();
     expect(result.error).toBeUndefined();
-    expect(result.manifest?.manifest_sha256).toBe(manifest.manifest_sha256);
-    expect(result.manifest?.files.length).toBe(2);
+    expect(result.manifest?.checksum).toBe(manifest.checksum);
+    // 3 = synthetic data/db/assistant.db + workspace/notes/hello.txt + workspace/notes/about.txt
+    expect(result.manifest?.contents.length).toBe(3);
   });
 
   test("encrypted: returns valid:true after decrypting first", async () => {
@@ -244,11 +261,13 @@ describe("verifySnapshot", () => {
     // validateVBundle catches the bad manifest.
     const { archive } = buildVBundle({
       files: [
+        { path: "data/db/assistant.db", data: new Uint8Array() },
         {
           path: "workspace/notes/hello.txt",
           data: new TextEncoder().encode("hello"),
         },
       ],
+      ...defaultV1Options(),
     });
 
     // Flip a few bytes in the middle of the gzipped archive — this almost
@@ -292,21 +311,19 @@ describe("restoreFromSnapshot", () => {
     const passed = calls[0].options;
     // The wrapper should pass the pre-validated manifest + entries so
     // commitImport doesn't re-validate.
-    expect(passed.preValidatedManifest?.manifest_sha256).toBe(
-      manifest.manifest_sha256,
-    );
+    expect(passed.preValidatedManifest?.checksum).toBe(manifest.checksum);
     expect(passed.preValidatedEntries).toBeDefined();
     expect(passed.preValidatedEntries?.has("manifest.json")).toBe(true);
-    expect(
-      passed.preValidatedEntries?.has("workspace/notes/hello.txt"),
-    ).toBe(true);
+    expect(passed.preValidatedEntries?.has("workspace/notes/hello.txt")).toBe(
+      true,
+    );
     // archiveData must be the actual bundle bytes.
     expect(passed.archiveData).toBeInstanceOf(Uint8Array);
     expect(passed.archiveData.length).toBeGreaterThan(0);
 
     // Public result is shaped correctly.
-    expect(result.manifest.manifest_sha256).toBe(manifest.manifest_sha256);
-    expect(result.restoredFiles).toBe(2);
+    expect(result.manifest.checksum).toBe(manifest.checksum);
+    expect(result.restoredFiles).toBe(3);
   });
 
   test("encrypted round-trip: decrypts then commits, and cleans up the temp file", async () => {
@@ -327,8 +344,8 @@ describe("restoreFromSnapshot", () => {
     const after = listRestoreTempArtifacts();
 
     expect(calls.length).toBe(1);
-    expect(result.manifest.manifest_sha256).toBe(manifest.manifest_sha256);
-    expect(result.restoredFiles).toBe(2);
+    expect(result.manifest.checksum).toBe(manifest.checksum);
+    expect(result.restoredFiles).toBe(3);
 
     // Decrypted temp file must be cleaned up after the call.
     expect(after.length).toBe(before.length);
@@ -377,6 +394,7 @@ describe("restoreFromSnapshot", () => {
     // the OS keychain / CES and are not part of the backup round trip.
     const { archive, manifest } = buildVBundle({
       files: [
+        { path: "data/db/assistant.db", data: new Uint8Array() },
         {
           path: "workspace/notes/hello.txt",
           data: new TextEncoder().encode("hello"),
@@ -386,6 +404,7 @@ describe("restoreFromSnapshot", () => {
           data: new TextEncoder().encode("sk-test-1234"),
         },
       ],
+      ...defaultV1Options(),
     });
 
     const path = join(TEST_DIR, "with-creds.vbundle");
@@ -399,7 +418,7 @@ describe("restoreFromSnapshot", () => {
 
     // The restore result must not expose a `credentials` field — the public
     // type only has `manifest` and `restoredFiles`.
-    expect(result.manifest.manifest_sha256).toBe(manifest.manifest_sha256);
+    expect(result.manifest.checksum).toBe(manifest.checksum);
     expect("credentials" in result).toBe(false);
   });
 
@@ -468,9 +487,7 @@ describe("restoreFromSnapshot", () => {
 
     // Stub that simulates a write failure (the importer returns this for
     // disk errors like permission denied or partial bundle writes).
-    const failingCommit = (
-      _opts: ImportCommitOptions,
-    ): ImportCommitResult => ({
+    const failingCommit = (_opts: ImportCommitOptions): ImportCommitResult => ({
       ok: false,
       reason: "write_failed",
       message: "disk full",

package/src/backup/backup-worker.ts

@@ -26,23 +26,24 @@
  * surface against temp directories with tiny fake bundles.
  */
 
-import { join } from "node:path";
+import { hostname } from "node:os";
 import { Database } from "bun:sqlite";
 
 import { getConfig } from "../config/loader.js";
 import type { BackupConfig } from "../config/schema.js";
+import { getAssistantName } from "../daemon/identity-helpers.js";
 import {
   getMemoryCheckpoint as realGetMemoryCheckpoint,
   setMemoryCheckpoint as realSetMemoryCheckpoint,
 } from "../memory/checkpoints.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
+import type { VBundleOriginMode } from "../runtime/migrations/origin-mode.js";
 import type { StreamExportVBundleResult } from "../runtime/migrations/vbundle-builder.js";
 import { streamExportVBundle as realStreamExportVBundle } from "../runtime/migrations/vbundle-builder.js";
+import { getDaemonRuntimeMode } from "../runtime/runtime-mode.js";
 import { getLogger } from "../util/logger.js";
-import {
-  getDbPath,
-  getProtectedDir,
-  getWorkspaceDir,
-} from "../util/platform.js";
+import { getDbPath, getWorkspaceDir } from "../util/platform.js";
+import { APP_VERSION } from "../version.js";
 import { ensureBackupKey as realEnsureBackupKey } from "./backup-key.js";
 import type { SnapshotEntry } from "./list-snapshots.js";
 import { pruneLocalSnapshots, writeLocalSnapshot } from "./local-writer.js";
@@ -109,8 +110,6 @@ export interface BackupDeps {
   workspaceDir?: string;
   /** Override for the local backup directory (tests). */
   localDir?: string;
-  /** Override for the trust.json path (tests). */
-  trustPath?: string;
   /** Override for the backup key file path (tests). */
   backupKeyPath?: string;
   /**
@@ -178,7 +177,6 @@ async function performBackup(
   const ensureKey = deps.ensureBackupKey ?? realEnsureBackupKey;
   const workspaceDir = deps.workspaceDir ?? getWorkspaceDir();
   const localDir = deps.localDir ?? getLocalBackupsDir(config.localDirectory);
-  const trustPath = deps.trustPath ?? join(getProtectedDir(), "trust.json");
   const backupKeyPath = deps.backupKeyPath ?? getBackupKeyPath();
 
   const startTimestamp = Date.now();
@@ -193,11 +191,38 @@ async function performBackup(
   // mirrors the pattern in `handleMigrationExport`: open a fresh Database
   // handle, run PRAGMA wal_checkpoint(TRUNCATE), close it. Any failure is
   // best-effort — the export still proceeds with whatever is on disk.
+  //
+  // The backup worker bundles credentials by design (its purpose is local
+  // recovery), so `secretsRedacted: false`. Backups run locally on the host
+  // machine; managed deployments delegate to the platform. Hardcoding to
+  // self-hosted ensures the resulting bundle satisfies the v1 schema's
+  // refine for managed/secrets_redacted — `getOriginMode()` would return
+  // "managed" in a managed deployment, producing a non-restorable bundle.
+  const originMode: VBundleOriginMode =
+    getDaemonRuntimeMode() === "docker"
+      ? "self-hosted-remote"
+      : "self-hosted-local";
   const result = await streamExport({
     workspaceDir,
-    trustPath,
-    source: "backup-worker",
-    description: "Automated backup snapshot",
+    assistant: {
+      id: DAEMON_INTERNAL_ASSISTANT_ID,
+      name: getAssistantName() ?? "Assistant",
+      runtime_version: APP_VERSION,
+    },
+    origin: {
+      mode: originMode,
+      hostname: hostname(),
+    },
+    compatibility: {
+      min_runtime_version: APP_VERSION,
+      max_runtime_version: null,
+    },
+    exportOptions: {
+      include_logs: true,
+      include_browser_state: false,
+      include_memory_vectors: false,
+    },
+    secretsRedacted: false,
     checkpoint: () => {
       const dbPath = getDbPath();
       try {

package/src/backup/paths.ts

@@ -6,18 +6,7 @@ import {
   getBackupKeyPathOverride,
 } from "../config/env-registry.js";
 import type { BackupDestination } from "../config/schema.js";
-import { getProtectedDir } from "../util/platform.js";
-
-/**
- * Computes the root ~/.vellum directory without introducing a new export from
- * `platform.ts`. `getProtectedDir()` returns `join(vellumRoot(), "protected")`,
- * so its parent directory is the vellum root. Using `dirname(getProtectedDir())`
- * keeps this module self-contained and avoids expanding the platform.ts surface
- * area just for backups.
- */
-function vellumRootFromProtected(): string {
-  return dirname(getProtectedDir());
-}
+import { getWorkspaceDir } from "../util/platform.js";
 
 /**
  * Returns the backup root directory. Respects the `VELLUM_BACKUP_DIR`
@@ -25,7 +14,7 @@ function vellumRootFromProtected(): string {
  * backups must be on a persistent volume); falls back to `~/.vellum/backups`.
  */
 export function getBackupRootDir(): string {
-  return getBackupDirOverride() ?? join(vellumRootFromProtected(), "backups");
+  return getBackupDirOverride() ?? join(homedir(), ".vellum", "backups");
 }
 
 /**
@@ -69,12 +58,7 @@ function safeUserInfoHomedir(): string {
  */
 export function getICloudDriveRoot(): string {
   const home = process.env.HOME || safeUserInfoHomedir() || homedir();
-  const root = join(
-    home,
-    "Library",
-    "Mobile Documents",
-    "com~apple~CloudDocs",
-  );
+  const root = join(home, "Library", "Mobile Documents", "com~apple~CloudDocs");
   if (!isAbsolute(root)) {
     throw new Error(
       `getICloudDriveRoot resolved to a relative path: ${root}. ` +
@@ -150,13 +134,16 @@ export function resolveOffsiteDestinations(
 }
 
 /**
- * Returns the path to the backup encryption key file. By default this is
- * `~/.vellum/protected/backup.key`, but the `VELLUM_BACKUP_KEY_PATH` env var
- * can override it for containerized deployments where the key must live on a
- * persistent volume.
+ * Returns the path to the backup encryption key file.
+ *
+ * The `VELLUM_BACKUP_KEY_PATH` env var can override this for containerized
+ * deployments where the key must live on a persistent volume.
+ *
+ * TODO: The backup key is a credential and should eventually be managed by the
+ * gateway (behind IPC), not stored on the daemon's filesystem.
  */
 export function getBackupKeyPath(): string {
-  return getBackupKeyPathOverride() ?? join(getProtectedDir(), "backup.key");
+  return getBackupKeyPathOverride() ?? join(getWorkspaceDir(), ".backup.key");
 }
 
 /**

package/src/backup/restore.ts

@@ -27,14 +27,10 @@
  * in-process CLI caller get the reset for free. Tests can inject a fake via
  * `opts.resetDbImpl`.
  *
- * `commitImport` does NOT invalidate cached config or clear the trust cache.
- * Callers are responsible for:
- *   1. Calling `invalidateConfigCache()` and `clearTrustCache()` AFTER a
- *      successful restore so the daemon re-reads the restored `config.json`
- *      and `trust.json` instead of serving stale in-process caches.
- *   2. Considering a daemon restart as the simplest, most reliable recovery
- *      path — a CLI caller should refuse to restore against a live daemon
- *      unless explicitly forced.
+ * `commitImport` does NOT invalidate cached config. Callers are responsible
+ * for calling `invalidateConfigCache()` AFTER a successful restore so the
+ * daemon re-reads the restored `config.json` instead of serving stale
+ * in-process caches. A daemon restart is the simplest recovery path.
  *
  * Credentials are intentionally excluded from backups — they live in the OS
  * keychain / CES and are not restored by this path. Users re-authenticate
@@ -63,9 +59,9 @@ import { decryptFile } from "./stream-crypt.js";
  * live workspace. Production callers should leave this unset so the real
  * importer is used.
  */
-export type CommitImpl = typeof commitImport;
+type CommitImpl = typeof commitImport;
 
-export interface RestoreOptions {
+interface RestoreOptions {
   /** AES-256 decryption key. Required for `.vbundle.enc` snapshots. */
   key?: Buffer;
   /**
@@ -100,7 +96,7 @@ export interface RestoreResult {
   restoredFiles: number;
 }
 
-export interface VerifyOptions {
+interface VerifyOptions {
   /** AES-256 decryption key. Required for `.vbundle.enc` snapshots. */
   key?: Buffer;
 }

package/src/browser/__tests__/operations.test.ts

@@ -2,19 +2,11 @@ import { describe, expect, test } from "bun:test";
 
 import {
   BROWSER_OPERATION_META,
-  BROWSER_OPERATION_NAMES,
   executeBrowserOperation,
-  getBrowserOperationMeta,
 } from "../operations.js";
 import { BROWSER_OPERATIONS, type BrowserOperation } from "../types.js";
 
 describe("browser operations contract", () => {
-  // ── Exactly 17 operations ──────────────────────────────────────────
-
-  test("defines exactly 17 operations", () => {
-    expect(BROWSER_OPERATION_NAMES).toHaveLength(17);
-  });
-
   // ── CLI subcommand / operation 1:1 parity ──────────────────────────
 
   test("CLI subcommand metadata is in 1:1 parity with BROWSER_OPERATIONS", () => {
@@ -23,24 +15,6 @@ describe("browser operations contract", () => {
     expect(metaOps).toEqual(declaredOps);
   });
 
-  test("BROWSER_OPERATION_NAMES matches BROWSER_OPERATIONS", () => {
-    expect([...BROWSER_OPERATION_NAMES].sort()).toEqual(
-      [...BROWSER_OPERATIONS].sort(),
-    );
-  });
-
-  // ── Every operation has metadata ───────────────────────────────────
-
-  test("every operation has command metadata", () => {
-    for (const op of BROWSER_OPERATIONS) {
-      const meta = getBrowserOperationMeta(op);
-      expect(meta).toBeDefined();
-      expect(meta!.operation).toBe(op);
-      expect(typeof meta!.description).toBe("string");
-      expect(meta!.description.length).toBeGreaterThan(0);
-    }
-  });
-
   test("metadata count matches operation count", () => {
     expect(BROWSER_OPERATION_META).toHaveLength(BROWSER_OPERATIONS.length);
   });
@@ -67,15 +41,6 @@ describe("browser operations contract", () => {
 
   // ── wait_for_download mode constraints ─────────────────────────────
 
-  test("wait_for_download metadata restricts modes to auto and local", () => {
-    const meta = getBrowserOperationMeta("wait_for_download");
-    expect(meta).toBeDefined();
-    expect(meta!.allowedModes).toBeDefined();
-    expect(meta!.allowedModes).toContain("auto");
-    expect(meta!.allowedModes).toContain("local");
-    expect(meta!.allowedModes).toHaveLength(2);
-  });
-
   test("wait_for_download rejects extension mode", async () => {
     const result = await executeBrowserOperation(
       "wait_for_download",

package/src/browser/operations.ts

@@ -10,11 +10,6 @@
  *   - Dispatch to existing browser-execution.ts implementations.
  *   - Command-oriented metadata for CLI subcommand generation.
  *   - `wait_for_download` mode-constraint enforcement.
- *
- * Identifier-only exports (BROWSER_TOOL_NAMES, name mapping helpers)
- * live in `browser/identifiers.ts` to avoid pulling the browser
- * execution stack into policy/classification modules. This module
- * re-exports them for backwards compatibility.
  */
 
 import {
@@ -38,31 +33,7 @@ import {
 import { browserManager } from "../tools/browser/browser-manager.js";
 import { normalizeBrowserMode } from "../tools/browser/browser-mode.js";
 import type { ToolContext, ToolExecutionResult } from "../tools/types.js";
-import {
-  BROWSER_OPERATIONS,
-  type BrowserOperation,
-  type BrowserOperationMeta,
-} from "./types.js";
-
-// ── Re-exports from identifiers.ts ───────────────────────────────────
-//
-// Identifier-only constants and helpers are defined in the lightweight
-// `browser/identifiers.ts` module so that policy/classification
-// consumers can import them without pulling in the browser execution
-// stack. Re-exported here for backwards compatibility with existing
-// callers that import from `browser/operations.js`.
-
-export {
-  BROWSER_TOOL_NAMES,
-  browserOperationToToolName,
-  browserToolNameToOperation,
-} from "./identifiers.js";
-
-/**
- * All canonical browser operation identifiers (re-exported from types).
- */
-export const BROWSER_OPERATION_NAMES: readonly BrowserOperation[] =
-  BROWSER_OPERATIONS;
+import type { BrowserOperation, BrowserOperationMeta } from "./types.js";
 
 // ── Dispatch handlers ────────────────────────────────────────────────
 
@@ -641,20 +612,3 @@ Examples:
   $ assistant browser --json status`,
   },
 ];
-
-// ── Lookup helper ────────────────────────────────────────────────────
-
-/** Index for O(1) metadata lookups by operation. */
-const META_BY_OPERATION = new Map<BrowserOperation, BrowserOperationMeta>(
-  BROWSER_OPERATION_META.map((m) => [m.operation, m]),
-);
-
-/**
- * Get metadata for a specific operation. Returns `undefined` if the
- * operation is not recognized.
- */
-export function getBrowserOperationMeta(
-  operation: BrowserOperation,
-): BrowserOperationMeta | undefined {
-  return META_BY_OPERATION.get(operation);
-}

package/src/browser-session/events.ts

@@ -132,15 +132,6 @@ export function isTargetInvalidated(targetId: string): boolean {
   return invalidatedTargetIds.has(targetId);
 }
 
-/**
- * Test-only helper: snapshot the current invalidated set without
- * draining it. Exported so unit tests can assert exact set contents
- * across multiple frames; production code must not rely on this.
- */
-export function __peekInvalidatedTargetIdsForTests(): string[] {
-  return Array.from(invalidatedTargetIds);
-}
-
 /**
  * Atomically remove and return a target id from the invalidated set.
  * Returns `true` when the id was present (and has now been removed),

package/src/bundler/package-resolver.ts

@@ -7,11 +7,11 @@
 
 import { existsSync } from "node:fs";
 import { mkdir, stat } from "node:fs/promises";
-import { homedir } from "node:os";
 import { join } from "node:path";
 
 import { ensureBun } from "../util/bun-runtime.js";
 import { getLogger } from "../util/logger.js";
+import { getWorkspaceDir } from "../util/platform.js";
 
 const log = getLogger("package-resolver");
 
@@ -33,11 +33,7 @@ const inflight = new Map<string, Promise<string | null>>();
 
 /** Where all cached packages live on disk. */
 export function getCacheDir(): string {
-  // Package cache is intentionally shared across all local assistants to
-  // avoid re-downloading the same bundler deps per instance. Resolved
-  // against the real home directory so the cache is a single host-wide
-  // location regardless of BASE_DATA_DIR / per-instance containers.
-  return join(homedir(), ".vellum", "package-cache");
+  return join(getWorkspaceDir(), "package-cache");
 }
 
 /**

package/src/calls/active-call-lease.ts

@@ -150,7 +150,7 @@ export function upsertActiveCallLease(params: {
   return nextLease;
 }
 
-export function removeActiveCallLease(callSessionId: string): boolean {
+function removeActiveCallLease(callSessionId: string): boolean {
   const current = loadLeaseFile().leases;
   const next = current.filter((lease) => lease.callSessionId !== callSessionId);
   if (next.length === current.length) {

package/src/calls/call-constants.ts

@@ -1,7 +1,7 @@
 import { getConfig } from "../config/loader.js";
 
 // Emergency/high-risk numbers that should never be called
-export const DENIED_NUMBERS = new Set([
+const DENIED_NUMBERS = new Set([
   "911",
   "112",
   "999",

package/src/calls/call-controller.ts

@@ -8,10 +8,9 @@
  * barge-in, state machine, guardian verification).
  */
 
-import { getGatewayInternalBaseUrl } from "../config/env.js";
 import { loadConfig } from "../config/loader.js";
-import type { TrustContext } from "../daemon/conversation-runtime-assembly.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { TrustContext } from "../daemon/trust-context.js";
 import { getPublicBaseUrl } from "../inbound/public-ingress-urls.js";
 import {
   expireCanonicalGuardianRequest,
@@ -21,7 +20,6 @@ import {
 } from "../memory/canonical-guardian-store.js";
 import { revokeScopedApprovalGrantsForContext } from "../memory/scoped-approval-grants.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
-import { mintDaemonDeliveryToken } from "../runtime/auth/token-service.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 import { getCatalogProvider } from "../tts/provider-catalog.js";
 import type { TtsProvider, TtsProviderId } from "../tts/types.js";
@@ -1272,8 +1270,6 @@ export class CallController {
         void sendGuardianExpiryNotices(
           canonicalDeliveries,
           this.assistantId,
-          getGatewayInternalBaseUrl(),
-          () => mintDaemonDeliveryToken(),
         ).catch((err) => {
           log.error(
             {