@vellumai/assistant 0.6.6 → 0.7.1

package/src/cli/commands/credentials.ts

@@ -4,6 +4,7 @@ import {
   fetchManagedCatalog,
   type ManagedCredentialDescriptor,
 } from "../../credential-execution/managed-catalog.js";
+import { cliIpcCall } from "../../ipc/cli-client.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
 import {
   disconnectOAuthProvider,
@@ -11,7 +12,12 @@ import {
   listConnections,
   type OAuthConnectionRow,
 } from "../../oauth/oauth-store.js";
+import type { CredentialPromptResult } from "../../runtime/routes/credential-prompt-routes.js";
 import { credentialKey } from "../../security/credential-key.js";
+import {
+  getSecureKeyAsync,
+  getSecureKeyResultAsync,
+} from "../../security/secure-keys.js";
 import {
   assertMetadataWritable,
   type CredentialMetadata,
@@ -23,8 +29,6 @@ import {
 } from "../../tools/credentials/metadata-store.js";
 import {
   deleteSecureKeyViaDaemon,
-  getSecureKeyResultViaDaemon,
-  getSecureKeyViaDaemon,
   setSecureKeyViaDaemon,
 } from "../lib/daemon-credential-client.js";
 import { log } from "../logger.js";
@@ -327,7 +331,7 @@ Examples:
 
         const credentials = await Promise.all(
           allMetadata.map(async (m) => {
-            const secret = await getSecureKeyViaDaemon(
+            const secret = await getSecureKeyAsync(
               credentialKey(m.service, m.field),
             );
             const connection = connectionsByProvider.get(m.service);
@@ -622,7 +626,7 @@ Examples:
           }
 
           const { value: secret, unreachable } =
-            await getSecureKeyResultViaDaemon(storageKey);
+            await getSecureKeyResultAsync(storageKey);
 
           if (!metadata && (secret == null || secret.length === 0)) {
             if (unreachable) {
@@ -757,7 +761,7 @@ Examples:
           }
 
           const { value: secret, unreachable } =
-            await getSecureKeyResultViaDaemon(storageKey);
+            await getSecureKeyResultAsync(storageKey);
 
           if (secret == null || secret.length === 0) {
             if (unreachable) {
@@ -784,4 +788,134 @@ Examples:
         }
       },
     );
+
+  // -------------------------------------------------------------------------
+  // prompt
+  // -------------------------------------------------------------------------
+
+  credential
+    .command("prompt")
+    .description(
+      "Securely prompt the user for a credential via the app UI and store it",
+    )
+    .requiredOption("--service <service>", "Service namespace (e.g. sentry)")
+    .requiredOption("--field <field>", "Field name (e.g. auth_token)")
+    .requiredOption("--label <label>", "Display label for the prompt UI")
+    .option("--description <description>", "Context shown in the prompt UI")
+    .option("--placeholder <placeholder>", "Placeholder text for the input")
+    .option(
+      "--allowed-domains <domains>",
+      "Comma-separated domains where this credential may be used",
+    )
+    .option(
+      "--allowed-tools <tools>",
+      "Comma-separated tool names that may use this credential",
+    )
+    .option(
+      "--injection-templates <json>",
+      "JSON array of injection template objects",
+    )
+    .addHelpText(
+      "after",
+      `
+Opens a secure credential input prompt in the user's connected app (desktop,
+web, etc.). The user enters the secret through the UI — it never passes through
+the conversation or CLI output. On success the credential is stored in the
+encrypted vault with the specified metadata.
+
+Requires the assistant to be running with at least one connected client.
+
+Examples:
+  $ assistant credentials prompt --service sentry --field auth_token \\
+      --label "Sentry Auth Token" --placeholder "sntrys_..." \\
+      --allowed-domains "sentry.io" \\
+      --injection-templates '[{"hostPattern":"sentry.io","injectionType":"header","headerName":"Authorization","valuePrefix":"Bearer "}]'`,
+    )
+    .action(
+      async (
+        opts: {
+          service: string;
+          field: string;
+          label: string;
+          description?: string;
+          placeholder?: string;
+          allowedDomains?: string;
+          allowedTools?: string;
+          injectionTemplates?: string;
+        },
+        cmd: Command,
+      ) => {
+        try {
+          const allowedDomains = opts.allowedDomains
+            ? opts.allowedDomains.split(",").map((d) => d.trim())
+            : undefined;
+          const allowedTools = opts.allowedTools
+            ? opts.allowedTools.split(",").map((t) => t.trim())
+            : undefined;
+
+          let injectionTemplates: unknown[] | undefined;
+          if (opts.injectionTemplates) {
+            try {
+              injectionTemplates = JSON.parse(opts.injectionTemplates);
+              if (!Array.isArray(injectionTemplates)) {
+                writeError(cmd, "--injection-templates must be a JSON array");
+                process.exitCode = 1;
+                return;
+              }
+            } catch {
+              writeError(cmd, "--injection-templates must be valid JSON");
+              process.exitCode = 1;
+              return;
+            }
+          }
+
+          // The server-side handler waits up to permissionTimeoutSec (default
+          // 300s) for the user to enter the credential. Give the IPC call a
+          // generous budget so it doesn't time out before the prompt resolves.
+          const PROMPT_TIMEOUT_MS = 310_000; // 5 min + 10s buffer
+          const ipc = await cliIpcCall<CredentialPromptResult>(
+            "credentials_prompt",
+            {
+              body: {
+                service: opts.service,
+                field: opts.field,
+                label: opts.label,
+                description: opts.description,
+                placeholder: opts.placeholder,
+                allowedDomains,
+                allowedTools,
+                injectionTemplates,
+              },
+            },
+            { timeoutMs: PROMPT_TIMEOUT_MS },
+          );
+
+          if (!ipc.ok) {
+            writeError(cmd, ipc.error ?? "Failed to connect to the assistant");
+            process.exitCode = 1;
+            return;
+          }
+
+          if (!ipc.result?.ok) {
+            writeError(cmd, ipc.result?.error ?? "Credential prompt failed");
+            process.exitCode = 1;
+            return;
+          }
+
+          if (shouldOutputJson(cmd)) {
+            writeOutput(cmd, {
+              ok: true,
+              service: opts.service,
+              field: opts.field,
+            });
+          } else {
+            log.info(`Stored credential ${opts.service}:${opts.field}`);
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          writeError(cmd, message);
+          process.exitCode = 1;
+        }
+      },
+    );
 }

package/src/cli/commands/default-action.ts

@@ -2,7 +2,7 @@ import type { Command } from "commander";
 
 import { startCli } from "../../cli.js";
 import { shouldAutoStartDaemon } from "../../daemon/connection-policy.js";
-import { ensureDaemonRunning } from "../../daemon/lifecycle.js";
+import { ensureDaemonRunning } from "../../daemon/daemon-control.js";
 
 export function registerDefaultAction(program: Command): void {
   program.action(async (_options: unknown, cmd: Command) => {

package/src/cli/commands/domain.ts

@@ -64,7 +64,7 @@ Examples:
           }
           if (!client.platformAssistantId) {
             throw new Error(
-              "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+              "Assistant ID not configured. Run: assistant platform connect",
             );
           }
 
@@ -154,7 +154,7 @@ Examples:
         }
         if (!client.platformAssistantId) {
           throw new Error(
-            "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+            "Assistant ID not configured. Run: assistant platform connect",
           );
         }
 

package/src/cli/commands/email.ts

@@ -74,7 +74,7 @@ Examples:
         }
         if (!client.platformAssistantId) {
           throw new Error(
-            "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+            "Assistant ID not configured. Run: assistant platform connect",
           );
         }
 
@@ -157,7 +157,7 @@ Examples:
         }
         if (!client.platformAssistantId) {
           throw new Error(
-            "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+            "Assistant ID not configured. Run: assistant platform connect",
           );
         }
 
@@ -258,7 +258,7 @@ Examples:
         }
         if (!client.platformAssistantId) {
           throw new Error(
-            "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+            "Assistant ID not configured. Run: assistant platform connect",
           );
         }
 
@@ -378,7 +378,7 @@ Examples:
           }
           if (!client.platformAssistantId) {
             throw new Error(
-              "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+              "Assistant ID not configured. Run: assistant platform connect",
             );
           }
 
@@ -502,7 +502,7 @@ Examples:
           }
           if (!client.platformAssistantId) {
             throw new Error(
-              "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+              "Assistant ID not configured. Run: assistant platform connect",
             );
           }
 
@@ -661,7 +661,7 @@ Examples:
           }
           if (!client.platformAssistantId) {
             throw new Error(
-              "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+              "Assistant ID not configured. Run: assistant platform connect",
             );
           }
 
@@ -817,7 +817,7 @@ $ assistant email attachment msg_abc1 --list --json`,
           }
           if (!client.platformAssistantId) {
             throw new Error(
-              "Assistant ID not configured. Set PLATFORM_ASSISTANT_ID or run: assistant platform connect",
+              "Assistant ID not configured. Run: assistant platform connect",
             );
           }
 

package/src/cli/commands/image-generation.ts

@@ -172,7 +172,7 @@ Examples:
       const hint =
         svc.mode === "managed"
           ? `${baseHint}\n  Run 'assistant auth login' to authenticate, or set services.image-generation.mode to 'your-own' in config.`
-          : `Run: assistant keys set ${provider} <key>.\n${baseHint}`;
+          : `Run: assistant keys set ${provider} <key>\n${baseHint}`;
       if (jsonOutput) {
         process.stdout.write(JSON.stringify({ ok: false, error: hint }) + "\n");
       } else {

package/src/cli/commands/keys.ts

@@ -1,9 +1,10 @@
 import type { Command } from "commander";
 
 import { API_KEY_PROVIDERS } from "../../config/loader.js";
+import { credentialKey } from "../../security/credential-key.js";
+import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import {
   deleteSecureKeyViaDaemon,
-  getSecureKeyViaDaemon,
   setSecureKeyViaDaemon,
 } from "../lib/daemon-credential-client.js";
 import { log } from "../logger.js";
@@ -61,7 +62,9 @@ Examples:
     .action(async () => {
       const stored: string[] = [];
       for (const provider of API_KEY_PROVIDERS) {
-        const value = await getSecureKeyViaDaemon(provider);
+        const value =
+          (await getSecureKeyAsync(credentialKey(provider, "api_key"))) ??
+          (await getSecureKeyAsync(provider));
         if (value) stored.push(provider);
       }
       if (stored.length === 0) {

package/src/cli/commands/mcp.ts

@@ -17,7 +17,7 @@ import {
 import { getSignalsDir } from "../../util/platform.js";
 import { log } from "../logger.js";
 
-export const HEALTH_CHECK_TIMEOUT_MS = 10_000;
+const HEALTH_CHECK_TIMEOUT_MS = 10_000;
 
 export async function checkServerHealth(
   serverId: string,

package/src/cli/commands/memory-v2.ts

@@ -0,0 +1,315 @@
+/**
+ * `assistant memory v2` CLI subgroup.
+ *
+ * Operator-facing subcommands for the v2 memory subsystem (concept-page
+ * activation model). All commands are thin wrappers over two IPC routes:
+ *
+ *   - `memory_v2/backfill` — enqueues one of three mutating jobs against the
+ *     memory job queue (`migrate`, `reembed`, `activation-recompute`).
+ *     Returns a `jobId` so the operator can poll status from the regular
+ *     memory subsystem.
+ *   - `memory_v2/validate` — read-only structural validation of the v2
+ *     workspace state. Returns an aggregate report of orphan outgoing-edge
+ *     targets, oversized pages, and parse failures.
+ *
+ * Subcommands:
+ *
+ *   - `migrate [--force]` — one-shot v1->v2 synthesis. Refuses to run a
+ *     second time unless `--force` is passed (the migration handler writes a
+ *     sentinel after a successful first run).
+ *   - `reembed` — fan out an `embed_concept_page` job per page slug to
+ *     refresh dense + sparse vectors in Qdrant.
+ *   - `activation` — refresh persisted activation state for every
+ *     conversation that has a stored row.
+ *   - `validate` — print a diagnostic report (page count, edge count, and
+ *     violation lists). Does not mutate the workspace.
+ *
+ * Lives alongside the existing v1 `memory` command rather than replacing it
+ * because v1 graph + PKB stays write-active until the cutover PR. Until the
+ * `memory-v2-enabled` feature flag flips on, the workspace keeps both v1 and
+ * v2 state side-by-side.
+ */
+
+import type { Command } from "commander";
+
+import { cliIpcCall } from "../../ipc/cli-client.js";
+import type {
+  MemoryV2BackfillOp,
+  MemoryV2BackfillResult,
+  MemoryV2ReembedSkillsResult,
+  MemoryV2ValidateResult,
+} from "../../runtime/routes/memory-v2-routes.js";
+import { log } from "../logger.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Issue a backfill IPC call, log the resulting `jobId`, and set a non-zero
+ * exit code on failure. Centralises the error-handling boilerplate for the
+ * four mutating subcommands.
+ */
+async function runBackfillOp(
+  op: MemoryV2BackfillOp,
+  opts: { force?: boolean } = {},
+): Promise<void> {
+  // Only forward `force: true` — the route handler already defaults missing
+  // to false, so omitting the field keeps the queued JSON minimal.
+  const params: Record<string, unknown> = { op };
+  if (opts.force === true) params.force = true;
+
+  const result = await cliIpcCall<MemoryV2BackfillResult>(
+    "memory_v2_backfill",
+    { body: params },
+  );
+
+  if (!result.ok) {
+    log.error(result.error ?? `Failed to enqueue ${op} job`);
+    process.exitCode = 1;
+    return;
+  }
+
+  log.info(`Queued ${op} job: ${result.result!.jobId}`);
+}
+
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+
+export function registerMemoryV2Command(program: Command): void {
+  // Attach the `v2` subgroup to the existing top-level `memory` command so
+  // operators invoke it as `assistant memory v2 <op>`. The plan deliberately
+  // namespaces v2 under v1 rather than promoting it to a top-level command,
+  // so `assistant memory --help` surfaces both eras side-by-side until the
+  // post-soak cutover removes v1.
+  const memory = program.commands.find((c) => c.name() === "memory");
+  if (!memory) {
+    throw new Error(
+      "registerMemoryV2Command: parent `memory` command not found. " +
+        "Call registerMemoryCommand(program) before registerMemoryV2Command(program).",
+    );
+  }
+
+  const v2 = memory
+    .command("v2")
+    .description("Memory v2 subsystem operations (concept-page model)");
+
+  v2.addHelpText(
+    "after",
+    `
+The v2 subsystem replaces the v1 graph + PKB with prose concept pages,
+directed edges stored in each page's frontmatter, and activation-based
+retrieval. v2 stays gated behind the memory-v2-enabled feature flag —
+these subcommands remain useful operator tools regardless of whether
+the flag is on.
+
+Subcommands fall into three groups:
+
+  Mutating (return a jobId enqueued on the memory job queue):
+    migrate          One-shot v1->v2 synthesis. Refuses to overwrite an
+                     existing v2 state without --force.
+    reembed          Refresh dense + sparse vectors for every concept page.
+    activation       Refresh persisted activation state for every conversation.
+
+  Mutating (synchronous — runs inside the daemon and returns when done):
+    reembed-skills   Re-seed v2 skill entries from the current skill catalog.
+
+  Read-only:
+    validate         Print a diagnostic report of orphan outgoing-edge
+                     targets, oversized pages, and parse failures.
+
+Examples:
+  $ assistant memory v2 validate
+  $ assistant memory v2 migrate
+  $ assistant memory v2 migrate --force
+  $ assistant memory v2 reembed
+  $ assistant memory v2 reembed-skills
+  $ assistant memory v2 activation`,
+  );
+
+  // ── migrate ───────────────────────────────────────────────────────────
+
+  v2.command("migrate")
+    .description("Run the v1->v2 migration (one-shot synthesis)")
+    .option(
+      "-f, --force",
+      "Re-run the migration even if the v2 sentinel is already present",
+    )
+    .addHelpText(
+      "after",
+      `
+Synthesises v2 concept pages from the v1 graph + PKB, writing each page's
+outgoing directed edges directly into its frontmatter. The migration handler
+stores a sentinel at memory/.v2-state/.migration-complete-v1-to-v2 after a
+successful run and refuses to run again unless --force is passed.
+
+The job runs on the background memory worker — this command returns once
+the job is enqueued. Track progress via 'assistant memory status' or the
+assistant logs.
+
+Examples:
+  $ assistant memory v2 migrate
+  $ assistant memory v2 migrate --force`,
+    )
+    .action(async (opts: { force?: boolean }) => {
+      await runBackfillOp("migrate", { force: opts.force });
+    });
+
+  // ── reembed ───────────────────────────────────────────────────────────
+
+  v2.command("reembed")
+    .description(
+      "Refresh dense + sparse vectors for every concept page in Qdrant",
+    )
+    .addHelpText(
+      "after",
+      `
+Fans out an embed_concept_page job per concept page slug (plus the four
+reserved meta-file slugs) so each page's dense and sparse vectors get
+recomputed against the current embedding backend. Useful after upgrading
+the embedding model or recovering a corrupted Qdrant collection.
+
+The fan-out runs on the background memory worker — this command returns
+once the parent job is enqueued.
+
+Examples:
+  $ assistant memory v2 reembed`,
+    )
+    .action(async () => {
+      await runBackfillOp("reembed");
+    });
+
+  // ── reembed-skills ────────────────────────────────────────────────────
+
+  v2.command("reembed-skills")
+    .description(
+      "Re-seed v2 skill entries from the current skill catalog (synchronous)",
+    )
+    .addHelpText(
+      "after",
+      `
+Re-runs the v2 skill catalog seed against the current skill set, replacing
+both the in-process skill cache and the memory_v2_skills Qdrant collection.
+Useful after editing a skill's SKILL.md, after a feature-flag flip changes
+the enabled-skill set, or to recover a corrupted skills collection.
+
+Unlike 'reembed' (concept pages), this runs synchronously inside the
+daemon — the command returns only once the seed completes. Requires both
+the memory-v2-enabled feature flag and memory.v2.enabled to be on.
+
+Examples:
+  $ assistant memory v2 reembed-skills`,
+    )
+    .action(async () => {
+      const result = await cliIpcCall<MemoryV2ReembedSkillsResult>(
+        "memory_v2_reembed_skills",
+        { body: {} },
+      );
+
+      if (!result.ok) {
+        log.error(result.error ?? "Failed to re-seed v2 skill entries");
+        process.exitCode = 1;
+        return;
+      }
+
+      log.info("Skill re-seed complete.");
+    });
+
+  // ── activation ────────────────────────────────────────────────────────
+
+  v2.command("activation")
+    .description(
+      "Refresh persisted activation state for every active conversation",
+    )
+    .addHelpText(
+      "after",
+      `
+Walks every conversation row in the activation_state table and
+recomputes the persisted state without rendering or injecting a memory
+block. Useful after tuning the activation params (d, c_user, c_assistant,
+c_now, k, hops) so subsequent retrievals reflect the new weights without
+waiting for organic per-turn updates.
+
+The job runs on the background memory worker — this command returns once
+the job is enqueued.
+
+Examples:
+  $ assistant memory v2 activation`,
+    )
+    .action(async () => {
+      await runBackfillOp("activation-recompute");
+    });
+
+  // ── validate ──────────────────────────────────────────────────────────
+
+  v2.command("validate")
+    .description("Print a diagnostic report of v2 workspace state (read-only)")
+    .addHelpText(
+      "after",
+      `
+Walks every concept page and aggregates outgoing edges from each page's
+frontmatter, returning a diagnostic report of:
+
+  pageCount             Number of concept pages successfully parsed.
+  edgeCount             Total number of directed outgoing edges across pages.
+  missingEdgeEndpoints  Outgoing edges whose target slug has no
+                        corresponding concept page (orphan targets).
+  oversizedPages        Pages whose body exceeds memory.v2.max_page_chars
+                        (a soft cap; consolidation will eventually split).
+  parseFailures         Pages whose YAML frontmatter or schema validation
+                        failed during read.
+
+This is purely diagnostic — the command never mutates the workspace.
+
+Examples:
+  $ assistant memory v2 validate`,
+    )
+    .action(async () => {
+      const result = await cliIpcCall<MemoryV2ValidateResult>(
+        "memory_v2_validate",
+        {
+          body: {},
+        },
+      );
+
+      if (!result.ok) {
+        log.error(result.error ?? "Failed to validate memory v2 state");
+        process.exitCode = 1;
+        return;
+      }
+
+      const report = result.result!;
+      log.info(`Pages: ${report.pageCount}`);
+      log.info(`Edges: ${report.edgeCount}`);
+
+      if (report.missingEdgeEndpoints.length === 0) {
+        log.info("Missing outgoing edge targets: none");
+      } else {
+        log.info(
+          `Missing outgoing edge targets: ${report.missingEdgeEndpoints.length}`,
+        );
+        for (const { from, to } of report.missingEdgeEndpoints) {
+          log.info(`  ${from} -> ${to}`);
+        }
+      }
+
+      if (report.oversizedPages.length === 0) {
+        log.info("Oversized pages: none");
+      } else {
+        log.info(`Oversized pages: ${report.oversizedPages.length}`);
+        for (const { slug, chars } of report.oversizedPages) {
+          log.info(`  ${slug} (${chars.toLocaleString()} chars)`);
+        }
+      }
+
+      if (report.parseFailures.length === 0) {
+        log.info("Parse failures: none");
+      } else {
+        log.info(`Parse failures: ${report.parseFailures.length}`);
+        for (const { slug, error } of report.parseFailures) {
+          log.info(`  ${slug}: ${error}`);
+        }
+      }
+    });
+}