@vellumai/assistant 0.7.0 → 0.7.1

package/src/cli/commands/trust.ts

@@ -1,9 +1,8 @@
 /**
  * `assistant trust` CLI namespace.
  *
- * Subcommands: list, add, update, remove — thin wrappers
- * over the daemon's trust rule IPC routes (`trust_rules_list`,
- * `trust_rules_create`, `trust_rules_update`, `trust_rules_remove`).
+ * Subcommand: list — thin wrapper over the daemon's trust rule
+ * IPC route (`trust_rules_list`).
  */
 
 import type { Command } from "commander";
@@ -28,7 +27,7 @@ interface TrustRule {
 export function registerTrustCommand(program: Command): void {
   const trust = program
     .command("trust")
-    .description("Manage tool trust rules (allow-list patterns for tool use)");
+    .description("View tool trust rules (allow-list patterns for tool use)");
 
   trust.addHelpText(
     "after",
@@ -39,10 +38,7 @@ pattern (regular expression) against the tool input.
 
 Examples:
   $ assistant trust list                List user-modified trust rules
-  $ assistant trust list --all          Include unmodified defaults
-  $ assistant trust add --tool bash --pattern "ls .*" --risk low --description "Directory listing"
-  $ assistant trust update <id> --risk medium
-  $ assistant trust remove <id>`,
+  $ assistant trust list --all          Include unmodified defaults`,
   );
 
   // ── list ──────────────────────────────────────────────────────────────────
@@ -69,434 +65,78 @@ Examples:
   $ assistant trust list --tool bash
   $ assistant trust list --json`,
     )
-    .action(
-      async (opts: { all?: boolean; tool?: string; json?: boolean }) => {
-        const params: Record<string, unknown> = {
-          ...(opts.all ? { include_all: true } : {}),
-          ...(opts.tool ? { tool: opts.tool } : {}),
-        };
-
-        const result = await cliIpcCall<{ rules: TrustRule[] }>(
-          "trust_rules_list",
-          { body: params },
-        );
-
-        if (!result.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: result.error }) + "\n",
-            );
-          } else {
-            log.error(result.error ?? "Failed to list trust rules");
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (opts.json) {
-          process.stdout.write(
-            JSON.stringify({ ok: true, data: result.result }) + "\n",
-          );
-          return;
-        }
-
-        const { rules } = result.result!;
-
-        if (rules.length === 0) {
-          log.info("No trust rules found.");
-          return;
-        }
-
-        // Table output
-        const showOrigin = !!opts.all;
-        const header = [
-          "ID",
-          "TOOL",
-          "PATTERN",
-          "RISK",
-          ...(showOrigin ? ["ORIGIN"] : []),
-          "MODIFIED",
-        ];
-
-        const rows: string[][] = rules.map((r: TrustRule) => [
-          r.id.slice(0, 16),
-          r.tool,
-          r.pattern,
-          r.risk,
-          ...(showOrigin ? [r.origin] : []),
-          r.updatedAt.slice(0, 10),
-        ]);
-
-        // Calculate column widths
-        const colWidths = header.map((h: string, i: number) =>
-          Math.max(h.length, ...rows.map((row: string[]) => row[i].length)),
-        );
-
-        const pad = (s: string, w: number) => s.padEnd(w);
-        const line = header
-          .map((h: string, i: number) => pad(h, colWidths[i]))
-          .join("  ");
-        log.info(line);
-        log.info(colWidths.map((w: number) => "─".repeat(w)).join("  "));
-        for (const row of rows) {
-          log.info(
-            row.map((c: string, i: number) => pad(c, colWidths[i])).join("  "),
-          );
-        }
-      },
-    );
-
-  // ── add ───────────────────────────────────────────────────────────────────
-
-  trust
-    .command("add")
-    .description("Add a new trust rule")
-    .requiredOption("--tool <name>", "Tool name (e.g. bash, file_write)")
-    .requiredOption("--pattern <regex>", "Regular expression pattern to match")
-    .requiredOption(
-      "--risk <level>",
-      "Risk level: low, medium, or high",
-    )
-    .requiredOption(
-      "--description <text>",
-      "Human-readable description of the rule",
-    )
-    .option("--json", "Output result as machine-readable JSON")
-    .addHelpText(
-      "after",
-      `
-Patterns are regular expressions (regex), not globs.
-
-Example:
-  $ assistant trust add --tool bash --pattern "ls .*" --risk low --description "Directory listing"
-
-Options:
-  --tool <name>          Tool name (e.g. bash, file_write, http_request).
-  --pattern <regex>      Regular expression matched against the tool input.
-  --risk <level>         One of: low, medium, high.
-  --description <text>   Human-readable description of what this rule allows.
-  --json                 Output as compact JSON instead of a success message.`,
-    )
-    .action(
-      async (opts: {
-        tool: string;
-        pattern: string;
-        risk: string;
-        description: string;
-        json?: boolean;
-      }) => {
-        const validRisks = ["low", "medium", "high"];
-        if (!validRisks.includes(opts.risk)) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({
-                ok: false,
-                error: `Invalid --risk "${opts.risk}". Must be one of: low, medium, high`,
-              }) + "\n",
-            );
-          } else {
-            log.error(
-              `Invalid --risk "${opts.risk}". Must be one of: low, medium, high`,
-            );
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const result = await cliIpcCall<{ rule: TrustRule }>(
-          "trust_rules_create",
-          {
-            body: {
-              tool: opts.tool,
-              pattern: opts.pattern,
-              risk: opts.risk,
-              description: opts.description,
-            },
-          },
-        );
-
-        if (!result.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: result.error }) + "\n",
-            );
-          } else {
-            log.error(result.error ?? "Failed to create trust rule");
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (opts.json) {
-          process.stdout.write(
-            JSON.stringify({ ok: true, data: result.result }) + "\n",
-          );
-        } else {
-          const rule = result.result!.rule;
-          log.info("Trust rule created: " + rule.id.slice(0, 8));
-        }
-      },
-    );
-
-  // ── update ────────────────────────────────────────────────────────────────
-
-  trust
-    .command("update <id>")
-    .description("Update an existing trust rule by ID prefix")
-    .option("--risk <level>", "New risk level: low, medium, or high")
-    .option("--description <text>", "New human-readable description")
-    .option("--json", "Output result as machine-readable JSON")
-    .addHelpText(
-      "after",
-      `
-Run 'assistant trust list' to see available rule IDs.
-
-The <id> argument can be a prefix of the full UUID (at least the first
-few characters, enough to be unambiguous).
-
-At least one of --risk or --description must be provided.
-
-Examples:
-  $ assistant trust update abc12345 --risk medium
-  $ assistant trust update abc12345 --description "Updated description"
-  $ assistant trust update abc12345 --risk high --description "Dangerous pattern"`,
-    )
-    .action(
-      async (
-        id: string,
-        opts: { risk?: string; description?: string; json?: boolean },
-      ) => {
-        if (!opts.risk && !opts.description) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({
-                ok: false,
-                error:
-                  "At least one of --risk or --description must be provided",
-              }) + "\n",
-            );
-          } else {
-            log.error(
-              "At least one of --risk or --description must be provided",
-            );
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (opts.risk) {
-          const validRisks = ["low", "medium", "high"];
-          if (!validRisks.includes(opts.risk)) {
-            if (opts.json) {
-              process.stdout.write(
-                JSON.stringify({
-                  ok: false,
-                  error: `Invalid --risk "${opts.risk}". Must be one of: low, medium, high`,
-                }) + "\n",
-              );
-            } else {
-              log.error(
-                `Invalid --risk "${opts.risk}". Must be one of: low, medium, high`,
-              );
-            }
-            process.exitCode = 1;
-            return;
-          }
-        }
-
-        // Prefix resolution: fetch all rules to find the full ID
-        const listResult = await cliIpcCall<{ rules: TrustRule[] }>(
-          "trust_rules_list",
-          { body: { include_all: true } },
-        );
-
-        if (!listResult.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: listResult.error }) + "\n",
-            );
-          } else {
-            log.error(listResult.error ?? "Failed to list trust rules");
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const rules = listResult.result!.rules;
-        const matches = rules.filter((r) => r.id.startsWith(id));
-
-        if (matches.length === 0) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({
-                ok: false,
-                error: `No trust rule found matching prefix "${id}". Run 'assistant trust list --all' to see all rule IDs.`,
-              }) + "\n",
-            );
-          } else {
-            log.error(`No trust rule found matching prefix "${id}". Run 'assistant trust list --all' to see all rule IDs.`);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (matches.length > 1) {
-          const details = matches
-            .map((r) => `  ${r.id.slice(0, 20)}  ${r.tool}  ${r.pattern}`)
-            .join("\n");
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({
-                ok: false,
-                error: `Ambiguous prefix "${id}" matches ${matches.length} rules:\n${details}`,
-              }) + "\n",
-            );
-          } else {
-            log.error(
-              `Ambiguous prefix "${id}" matches ${matches.length} rules:\n${details}`,
-            );
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const updateParams: Record<string, unknown> = {
-          id: matches[0].id,
-          ...(opts.risk ? { risk: opts.risk } : {}),
-          ...(opts.description ? { description: opts.description } : {}),
-        };
-
-        const result = await cliIpcCall<{ rule: TrustRule }>(
-          "trust_rules_update",
-          { body: updateParams },
-        );
-
-        if (!result.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: result.error }) + "\n",
-            );
-          } else {
-            log.error(result.error ?? "Failed to update trust rule");
-          }
-          process.exitCode = 1;
-          return;
-        }
-
+    .action(async (opts: { all?: boolean; tool?: string; json?: boolean }) => {
+      const params: Record<string, unknown> = {
+        ...(opts.all ? { include_all: true } : {}),
+        ...(opts.tool ? { tool: opts.tool } : {}),
+      };
+
+      const result = await cliIpcCall<{ rules: TrustRule[] }>(
+        "trust_rules_list",
+        { body: params },
+      );
+
+      if (!result.ok) {
         if (opts.json) {
           process.stdout.write(
-            JSON.stringify({ ok: true, data: result.result }) + "\n",
+            JSON.stringify({ ok: false, error: result.error }) + "\n",
           );
         } else {
-          const rule = result.result!.rule;
-          log.info("Trust rule updated: " + rule.id.slice(0, 8));
+          log.error(result.error ?? "Failed to list trust rules");
         }
-      },
-    );
-
-  // ── remove ────────────────────────────────────────────────────────────────
+        process.exitCode = 1;
+        return;
+      }
 
-  trust
-    .command("remove <id>")
-    .description("Remove a trust rule by ID prefix")
-    .option("--json", "Output result as machine-readable JSON")
-    .addHelpText(
-      "after",
-      `
-Run 'assistant trust list' to see available rule IDs.
-
-The <id> argument can be a prefix of the full UUID (at least the first
-few characters, enough to be unambiguous).
-
-Examples:
-  $ assistant trust remove abc12345
-  $ assistant trust remove abc12345 --json`,
-    )
-    .action(
-      async (id: string, opts: { json?: boolean }) => {
-        // Prefix resolution: fetch all rules to find the full ID
-        const listResult = await cliIpcCall<{ rules: TrustRule[] }>(
-          "trust_rules_list",
-          { body: { include_all: true } },
+      if (opts.json) {
+        process.stdout.write(
+          JSON.stringify({ ok: true, data: result.result }) + "\n",
         );
-
-        if (!listResult.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: listResult.error }) + "\n",
-            );
-          } else {
-            log.error(listResult.error ?? "Failed to list trust rules");
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const rules = listResult.result!.rules;
-        const matches = rules.filter((r) => r.id.startsWith(id));
-
-        if (matches.length === 0) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({
-                ok: false,
-                error: `No trust rule found matching prefix "${id}". Run 'assistant trust list --all' to see all rule IDs.`,
-              }) + "\n",
-            );
-          } else {
-            log.error(`No trust rule found matching prefix "${id}". Run 'assistant trust list --all' to see all rule IDs.`);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (matches.length > 1) {
-          const details = matches
-            .map((r) => `  ${r.id.slice(0, 20)}  ${r.tool}  ${r.pattern}`)
-            .join("\n");
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({
-                ok: false,
-                error: `Ambiguous prefix "${id}" matches ${matches.length} rules:\n${details}`,
-              }) + "\n",
-            );
-          } else {
-            log.error(
-              `Ambiguous prefix "${id}" matches ${matches.length} rules:\n${details}`,
-            );
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const result = await cliIpcCall<{ success: boolean }>(
-          "trust_rules_remove",
-          { body: { id: matches[0].id } },
+        return;
+      }
+
+      const { rules } = result.result!;
+
+      if (rules.length === 0) {
+        log.info("No trust rules found.");
+        return;
+      }
+
+      // Table output
+      const showOrigin = !!opts.all;
+      const header = [
+        "ID",
+        "TOOL",
+        "PATTERN",
+        "RISK",
+        ...(showOrigin ? ["ORIGIN"] : []),
+        "MODIFIED",
+      ];
+
+      const rows: string[][] = rules.map((r: TrustRule) => [
+        r.id.slice(0, 16),
+        r.tool,
+        r.pattern,
+        r.risk,
+        ...(showOrigin ? [r.origin] : []),
+        r.updatedAt.slice(0, 10),
+      ]);
+
+      // Calculate column widths
+      const colWidths = header.map((h: string, i: number) =>
+        Math.max(h.length, ...rows.map((row: string[]) => row[i].length)),
+      );
+
+      const pad = (s: string, w: number) => s.padEnd(w);
+      const line = header
+        .map((h: string, i: number) => pad(h, colWidths[i]))
+        .join("  ");
+      log.info(line);
+      log.info(colWidths.map((w: number) => "─".repeat(w)).join("  "));
+      for (const row of rows) {
+        log.info(
+          row.map((c: string, i: number) => pad(c, colWidths[i])).join("  "),
         );
-
-        if (!result.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: result.error }) + "\n",
-            );
-          } else {
-            log.error(result.error ?? "Failed to remove trust rule");
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (opts.json) {
-          process.stdout.write(
-            JSON.stringify({
-              ok: true,
-              data: { success: true, id: matches[0].id },
-            }) + "\n",
-          );
-        } else {
-          log.info("Trust rule removed: " + matches[0].id.slice(0, 8));
-        }
-      },
-    );
+      }
+    });
 }

package/src/cli/commands/usage.ts

@@ -5,6 +5,8 @@ import {
   getUsageDayBuckets,
   getUsageGroupBreakdown,
   getUsageTotals,
+  type GroupByDimension,
+  USAGE_GROUP_BY_DIMENSIONS,
   type UsageDayBucket,
   type UsageGroupBreakdown,
   type UsageTotals,
@@ -126,7 +128,12 @@ function printBreakdownTable(
     return;
   }
 
-  const groupLabel = groupBy.toUpperCase();
+  const groupLabel =
+    groupBy === "call_site"
+      ? "TASK"
+      : groupBy === "inference_profile"
+        ? "PROFILE"
+        : groupBy.toUpperCase();
   const groupW = Math.max(
     groupLabel.length,
     ...entries.map((e) => e.group.length),
@@ -267,31 +274,38 @@ Examples:
 
   usage
     .command("breakdown")
-    .description("Grouped breakdown by actor, provider, model, or conversation")
+    .description(
+      "Grouped breakdown by task, profile, provider, model, or conversation",
+    )
     .option(...rangeOption)
     .option(...fromOption)
     .option(...toOption)
     .option(...jsonOption)
     .option(
       "-g, --group-by <dimension>",
-      "Grouping dimension: actor, provider, model, conversation",
+      "Grouping dimension: call_site, inference_profile, provider, model, conversation, actor",
       "model",
     )
     .addHelpText(
       "after",
       `
 Grouping dimensions:
-  actor          Groups by the subsystem that made the call (main_agent,
-                 title_generator, etc.)
-  provider       Groups by LLM provider (anthropic, openai, etc.)
-  model          Groups by model name (claude-sonnet-4-20250514, etc.)
-  conversation   Groups by conversation ID
+  call_site          Groups by user-facing task (Main Agent, Memory Extraction,
+                     Conversation Title, etc.)
+  inference_profile  Groups by inference profile; unset historical rows are
+                     shown as Default / Unset
+  provider           Groups by LLM provider (anthropic, openai, etc.)
+  model              Groups by model name (claude-sonnet-4-20250514, etc.)
+  conversation       Groups by conversation ID
+  actor              Legacy/internal subsystem grouping (main_agent, etc.)
 
 Shows one row per group with input/output tokens, estimated cost, and
 call count. Rows are sorted by cost descending.
 
 Examples:
   $ assistant usage breakdown
+  $ assistant usage breakdown --group-by call_site
+  $ assistant usage breakdown --group-by inference_profile
   $ assistant usage breakdown --group-by provider
   $ assistant usage breakdown --group-by actor --range week`,
     )
@@ -303,15 +317,10 @@ Examples:
         json?: boolean;
         groupBy: string;
       }) => {
-        const validDimensions = new Set([
-          "actor",
-          "provider",
-          "model",
-          "conversation",
-        ]);
+        const validDimensions = new Set<string>(USAGE_GROUP_BY_DIMENSIONS);
         if (!validDimensions.has(opts.groupBy)) {
           log.error(
-            `Invalid --group-by value: '${opts.groupBy}'. Must be one of: actor, provider, model, conversation`,
+            `Invalid --group-by value: '${opts.groupBy}'. Must be one of: ${USAGE_GROUP_BY_DIMENSIONS.join(", ")}`,
           );
           process.exit(1);
         }
@@ -319,7 +328,7 @@ Examples:
         const { from, to } = resolveRange(opts);
         const breakdown = getUsageGroupBreakdown(
           { from, to },
-          opts.groupBy as "actor" | "provider" | "model" | "conversation",
+          opts.groupBy as GroupByDimension,
         );
         if (opts.json) {
           log.info(JSON.stringify({ breakdown }, null, 2));

package/src/cli/lib/daemon-credential-client.ts

@@ -42,6 +42,9 @@ export async function setSecureKeyViaDaemon(
   }
 
   // Daemon unreachable — fall back to direct write.
+  if (type === "api_key") {
+    return setSecureKeyAsync(credentialKey(name, "api_key"), value);
+  }
   if (type === "credential" && !name.startsWith("credential/")) {
     const colonIdx = name.lastIndexOf(":");
     if (colonIdx > 0 && colonIdx < name.length - 1) {
@@ -78,6 +81,17 @@ export async function deleteSecureKeyViaDaemon(
   }
 
   // Daemon unreachable — fall back to direct delete.
+  if (type === "api_key") {
+    // Delete from both locations; during migration overlap both may exist.
+    // Ignore "not-found" on each — one location may already be empty.
+    const credResult = await deleteSecureKeyAsync(credentialKey(name, "api_key"));
+    if (credResult === "error") return "error";
+    const bareResult = await deleteSecureKeyAsync(name);
+    if (bareResult === "error") return "error";
+    return credResult === "deleted" || bareResult === "deleted"
+      ? "deleted"
+      : "not-found";
+  }
   if (type === "credential" && !name.startsWith("credential/")) {
     const colonIdx = name.lastIndexOf(":");
     if (colonIdx > 0 && colonIdx < name.length - 1) {

package/src/cli/program.ts

@@ -35,6 +35,7 @@ import { registerMemoryCommand } from "./commands/memory.js";
 import { registerMemoryV2Command } from "./commands/memory-v2.js";
 import { registerNotificationsCommand } from "./commands/notifications.js";
 import { registerOAuthCommand } from "./commands/oauth/index.js";
+import { registerPendingCommand } from "./commands/pending.js";
 import { registerPlatformCommand } from "./commands/platform/index.js";
 import { registerRoutesCommand } from "./commands/routes.js";
 import { registerSequenceCommand } from "./commands/sequence.js";
@@ -103,6 +104,7 @@ Examples:
   registerMemoryV2Command(program);
   registerNotificationsCommand(program);
   registerOAuthCommand(program);
+  registerPendingCommand(program);
   registerPlatformCommand(program);
   registerRoutesCommand(program);
   registerSequenceCommand(program);