@vellumai/assistant 0.7.0 → 0.7.1

package/src/cli.ts

@@ -498,27 +498,6 @@ export async function startCli(): Promise<void> {
         prompt();
         break;
 
-      case "secret_detected": {
-        const wasSpinning = spinner.isSpinning;
-        spinner.stop();
-        const types = msg.matches.map((m) => m.type).join(", ");
-        const actionLabel =
-          msg.action === "redact"
-            ? "redacted"
-            : msg.action === "block"
-              ? "blocked"
-              : "detected";
-        process.stdout.write(
-          `\n  ⚠ Secret ${actionLabel} in ${msg.toolName} output: ${types}\n`,
-        );
-        for (const match of msg.matches) {
-          process.stdout.write(`    • ${match.type}: ${match.redactedValue}\n`);
-        }
-        process.stdout.write("\n");
-        if (wasSpinning) spinner.start("Thinking...");
-        break;
-      }
-
       case "conversation_list_response":
         if (pendingSessionPick) {
           renderConversationPicker(msg.conversations);

package/src/config/__tests__/feature-flag-registry-guard.test.ts

@@ -31,7 +31,7 @@ function loadRegistry(): Record<string, unknown> {
   return JSON.parse(raw);
 }
 
-const VALID_SCOPES = new Set(["assistant", "macos"]);
+const VALID_SCOPES = new Set(["assistant", "client"]);
 
 // ---------------------------------------------------------------------------
 // Tests
@@ -169,7 +169,7 @@ describe("unified feature flag registry guard", () => {
       const scope = flag.scope as string;
       if (!VALID_SCOPES.has(scope)) {
         violations.push(
-          `flag '${flag.id}' has invalid scope '${scope}' (expected 'assistant' or 'macos')`,
+          `flag '${flag.id}' has invalid scope '${scope}' (expected 'assistant' or 'client')`,
         );
       }
     }

package/src/config/bundled-skills/messaging/TOOLS.json

@@ -21,7 +21,8 @@
             "type": "string",
             "description": "Brief non-technical explanation of why this tool is being called"
           }
-        }
+        },
+        "additionalProperties": false
       },
       "executor": "tools/messaging-auth-test.ts",
       "execution_target": "host"
@@ -58,7 +59,8 @@
             "type": "string",
             "description": "Brief non-technical explanation of why this tool is being called"
           }
-        }
+        },
+        "additionalProperties": false
       },
       "executor": "tools/messaging-list-conversations.ts",
       "execution_target": "host"
@@ -96,6 +98,7 @@
             "description": "Brief non-technical explanation of why this tool is being called"
           }
         },
+        "additionalProperties": false,
         "required": ["conversation_id"]
       },
       "executor": "tools/messaging-read.ts",
@@ -130,6 +133,7 @@
             "description": "Brief non-technical explanation of why this tool is being called"
           }
         },
+        "additionalProperties": false,
         "required": ["query"]
       },
       "executor": "tools/messaging-search.ts",
@@ -187,6 +191,7 @@
             "description": "Brief non-technical explanation of why this tool is being called"
           }
         },
+        "additionalProperties": false,
         "required": ["conversation_id", "text", "confidence"]
       },
       "executor": "tools/messaging-send.ts",
@@ -221,6 +226,7 @@
             "description": "Brief non-technical explanation of why this tool is being called"
           }
         },
+        "additionalProperties": false,
         "required": ["conversation_id"]
       },
       "executor": "tools/messaging-mark-read.ts",
@@ -254,7 +260,8 @@
             "type": "string",
             "description": "Brief non-technical explanation of why this tool is being called"
           }
-        }
+        },
+        "additionalProperties": false
       },
       "executor": "tools/messaging-analyze-style.ts",
       "execution_target": "host"
@@ -301,6 +308,7 @@
             "description": "Brief non-technical explanation of why this tool is being called"
           }
         },
+        "additionalProperties": false,
         "required": ["action"]
       },
       "executor": "tools/messaging-draft.ts",
@@ -342,7 +350,8 @@
             "type": "string",
             "description": "Brief non-technical explanation of why this tool is being called"
           }
-        }
+        },
+        "additionalProperties": false
       },
       "executor": "tools/messaging-sender-digest.ts",
       "execution_target": "host"
@@ -380,6 +389,7 @@
             "description": "Set to true ONLY when the user's most recent message contains explicit approval language for this specific action (e.g. 'archive these', 'yes do it', 'go ahead'). Do NOT set this when the user merely described what they want without confirming, or when acting on prior instructions without fresh confirmation in this turn."
           }
         },
+        "additionalProperties": false,
         "required": ["query", "confidence"]
       },
       "executor": "tools/messaging-archive-by-sender.ts",

package/src/config/env-registry.ts

@@ -116,6 +116,17 @@ export function getCpuLimit(): string | undefined {
   return str("VELLUM_CPU_LIMIT");
 }
 
+/**
+ * VELLUM_MINIKUBE_STORAGE_SIZE — string (K8s resource format), default: undefined
+ * The PVC storage request size for the assistant volume (e.g. "10Gi").
+ * Only set in minikube (local dev) mode. Used by the health endpoint to
+ * report accurate disk capacity on hostPath-backed PVCs where statfsSync
+ * reports the host's entire filesystem instead of the PVC.
+ */
+export function getMinikubeStorageSize(): string | undefined {
+  return str("VELLUM_MINIKUBE_STORAGE_SIZE");
+}
+
 /**
  * VELLUM_PROFILER_RUN_ID — string, default: undefined
  * Unique identifier for the current profiler run. When set, the profiler
@@ -177,7 +188,6 @@ const KNOWN_VELLUM_VARS = new Set([
   "VELLUM_CLOUD",
   "VELLUM_CUSTOM_QR_CODE_PATH",
   "VELLUM_DAEMON_AUTOSTART",
-  "VELLUM_DAEMON_NOAUTH",
   "VELLUM_DATA_DIR",
   "VELLUM_DEBUG",
   "VELLUM_DESKTOP_APP",
@@ -198,10 +208,10 @@ const KNOWN_VELLUM_VARS = new Set([
   "VELLUM_PROFILER_RUN_ID",
   "VELLUM_ROOT_DIR",
   "VELLUM_SSH_USER",
-  "VELLUM_UNSAFE_AUTH_BYPASS",
   "VELLUM_WORKSPACE_DIR",
   "VELLUM_CPU_LIMIT",
   "VELLUM_MEMORY_LIMIT",
+  "VELLUM_MINIKUBE_STORAGE_SIZE",
 ]);
 
 /**

package/src/config/env.ts

@@ -88,22 +88,11 @@ export function getRuntimeHttpHost(): string {
 }
 
 /**
- * True when HTTP API auth is disabled via DISABLE_HTTP_AUTH=true AND the
- * safety gate VELLUM_UNSAFE_AUTH_BYPASS=1 is also set. Without the safety
- * gate, the bypass is ignored.
+ * True when HTTP API auth is disabled via DISABLE_HTTP_AUTH=true.
+ * Used in platform-managed deployments where the platform handles auth.
  */
 export function isHttpAuthDisabled(): boolean {
-  if (str("DISABLE_HTTP_AUTH")?.toLowerCase() !== "true") return false;
-  return str("VELLUM_UNSAFE_AUTH_BYPASS")?.trim() === "1";
-}
-
-/**
- * True when DISABLE_HTTP_AUTH is set but the safety gate
- * VELLUM_UNSAFE_AUTH_BYPASS=1 is missing — used for warning messages.
- */
-export function hasUngatedHttpAuthDisabled(): boolean {
-  if (str("DISABLE_HTTP_AUTH")?.toLowerCase() !== "true") return false;
-  return str("VELLUM_UNSAFE_AUTH_BYPASS")?.trim() !== "1";
+  return str("DISABLE_HTTP_AUTH")?.toLowerCase() === "true";
 }
 
 // ── Monitoring ───────────────────────────────────────────────────────────────

package/src/config/feature-flag-registry.json

@@ -19,7 +19,7 @@
     },
     {
       "id": "user-hosted-enabled",
-      "scope": "macos",
+      "scope": "client",
       "key": "user-hosted-enabled",
       "label": "User Hosted Enabled",
       "description": "Enable user-hosted onboarding flow",
@@ -27,7 +27,7 @@
     },
     {
       "id": "local-docker-enabled",
-      "scope": "macos",
+      "scope": "client",
       "key": "local-docker-enabled",
       "label": "Local Docker Mode",
       "description": "When enabled, the Local hosting option uses Docker under the hood for sandboxed execution, hiding the separate Docker card",
@@ -51,7 +51,7 @@
     },
     {
       "id": "mobile-pairing",
-      "scope": "macos",
+      "scope": "client",
       "key": "mobile-pairing",
       "label": "Mobile Pairing",
       "description": "Show the Mobile (iOS) pairing card in Settings > Account",
@@ -67,7 +67,7 @@
     },
     {
       "id": "developer-menu-items",
-      "scope": "macos",
+      "scope": "client",
       "key": "developer-menu-items",
       "label": "Developer Menu Items",
       "description": "Show Component Gallery and Replay Onboarding in the menu bar",
@@ -123,7 +123,7 @@
     },
     {
       "id": "settings-billing",
-      "scope": "macos",
+      "scope": "client",
       "key": "settings-billing",
       "label": "Billing Settings Tab",
       "description": "Show the Billing tab in Settings when signed in, displaying credits balance and top-up",
@@ -131,7 +131,7 @@
     },
     {
       "id": "referral-codes",
-      "scope": "macos",
+      "scope": "client",
       "key": "referral-codes",
       "label": "Referral Codes",
       "description": "Surface the Earn Credits referral entry points (sidebar drawer row and Billing tab button) that open the referral modal",
@@ -139,7 +139,7 @@
     },
     {
       "id": "managed-sign-in",
-      "scope": "macos",
+      "scope": "client",
       "key": "managed-sign-in",
       "label": "Managed Sign In",
       "description": "Enable managed (organization-hosted) sign-in flow in the onboarding experience",
@@ -179,7 +179,7 @@
     },
     {
       "id": "quick-input",
-      "scope": "macos",
+      "scope": "client",
       "key": "quick-input",
       "label": "Quick Input",
       "description": "Enable the Quick Input popover on right-click of the menu bar icon",
@@ -187,7 +187,7 @@
     },
     {
       "id": "expand-completed-steps",
-      "scope": "macos",
+      "scope": "client",
       "key": "expand-completed-steps",
       "label": "Expand Completed Steps",
       "description": "Auto-expand completed tool call step groups instead of showing them collapsed",
@@ -195,7 +195,7 @@
     },
     {
       "id": "show-thinking-blocks",
-      "scope": "macos",
+      "scope": "client",
       "key": "show-thinking-blocks",
       "label": "Show Thinking Blocks",
       "description": "Display the assistant's thinking/reasoning inline in chat messages as collapsible blocks",
@@ -267,7 +267,7 @@
     },
     {
       "id": "teleport",
-      "scope": "macos",
+      "scope": "client",
       "key": "teleport",
       "label": "Teleport",
       "description": "Enable teleport UI in General settings for moving assistants between hosting environments",
@@ -275,7 +275,7 @@
     },
     {
       "id": "apple-container",
-      "scope": "macos",
+      "scope": "client",
       "key": "apple-container",
       "label": "Apple Container",
       "description": "Enable assistant sandboxing via Apple Containers on macOS 26+, providing a lightweight native sandbox without third-party dependencies",
@@ -299,7 +299,7 @@
     },
     {
       "id": "fork-from-message",
-      "scope": "macos",
+      "scope": "client",
       "key": "fork-from-message",
       "label": "Fork from Message",
       "description": "Show the 'Fork from here' option in message overflow menus",
@@ -307,7 +307,7 @@
     },
     {
       "id": "onboarding-pre-chat",
-      "scope": "macos",
+      "scope": "client",
       "key": "onboarding-pre-chat",
       "label": "Pre-Chat Onboarding Flow",
       "description": "Gates the 3-screen pre-chat onboarding flow (tools, tasks/tone, name exchange) shown before the first conversation",
@@ -315,7 +315,7 @@
     },
     {
       "id": "home-tab",
-      "scope": "macos",
+      "scope": "client",
       "key": "home-tab",
       "label": "Home Tab",
       "description": "Replace the knowledge graph top-level tab with a new Home page showing relationship progression, facts, and capability tiers",
@@ -337,17 +337,9 @@
       "description": "Enables the Google Meet joining bot and the meet-join skill.",
       "defaultEnabled": false
     },
-    {
-      "id": "compaction-v2",
-      "scope": "assistant",
-      "key": "compaction-v2",
-      "label": "Compaction v2",
-      "description": "Boundary-message-based compaction pipeline with forked prompt-cache-shared summarization and microcompact pre-pass. Replaces the four-tier overflow reducer and cursor-based storage.",
-      "defaultEnabled": false
-    },
     {
       "id": "scroll-debug-overlay",
-      "scope": "macos",
+      "scope": "client",
       "key": "scroll-debug-overlay",
       "label": "Scroll Debug Overlay",
       "description": "Show a live HUD in the top-right of the conversation with scroll geometry, velocity, update rate, and anchor-preserver activity. Developer diagnostic for investigating scroll jank.",
@@ -355,12 +347,20 @@
     },
     {
       "id": "message-height-cache",
-      "scope": "macos",
+      "scope": "client",
       "key": "message-height-cache",
       "label": "Message Height Cache",
       "description": "Swap the transcript's LazyVStack for a plain VStack so scrollContentHeight is the true sum of row heights (no LazyVStack estimator drift). Row frames are not pinned — the earlier frame-pinning approach was removed because it caused overlap when rows grew past their first measurement (streaming, expanding thinking blocks). Tradeoff: eager layout — every row measures up-front, which can stall for many seconds to minutes on very long conversations.",
       "defaultEnabled": true
     },
+    {
+      "id": "coding-agents-panel",
+      "scope": "client",
+      "key": "coding-agents-panel",
+      "label": "Coding Agents Panel",
+      "description": "Gate native macOS/iOS Coding Agents panel entry points and inline ACP session deep links.",
+      "defaultEnabled": false
+    },
     {
       "id": "compaction-playground",
       "scope": "assistant",
@@ -378,11 +378,11 @@
       "defaultEnabled": false
     },
     {
-      "id": "inference-profiles",
-      "scope": "assistant",
-      "key": "inference-profiles",
-      "label": "Inference Profiles",
-      "description": "Show inference profile picker in chat, active profile dropdown, Manage Profiles button, and per-task overrides link in Settings",
+      "id": "account-deletion",
+      "scope": "client",
+      "key": "account-deletion",
+      "label": "Account Deletion",
+      "description": "Surfaces the user-initiated account deletion flow in client settings.",
       "defaultEnabled": false
     }
   ]

package/src/config/llm-callsite-catalog.ts

@@ -0,0 +1,12 @@
+import { CALL_SITE_CATALOG } from "./schemas/call-site-catalog.js";
+import type { LLMCallSite } from "./schemas/llm.js";
+
+// Compatibility wrapper for existing usage display imports. Do not define
+// labels here; call-site display metadata belongs in CALL_SITE_CATALOG.
+const LLM_CALLSITE_LABELS = new Map<LLMCallSite, string>(
+  CALL_SITE_CATALOG.map(({ id, displayName }) => [id, displayName]),
+);
+
+export function getLLMCallSiteLabel(callSite: LLMCallSite | string): string {
+  return LLM_CALLSITE_LABELS.get(callSite as LLMCallSite) ?? String(callSite);
+}

package/src/config/llm-context-resolution.ts

@@ -0,0 +1,80 @@
+import { PROVIDER_CATALOG } from "../providers/model-catalog.js";
+import { resolveCallSiteConfig } from "./llm-resolver.js";
+import {
+  type ContextWindow,
+  DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
+  type LLMCallSite,
+  type LLMConfig,
+} from "./schemas/llm.js";
+import type { ContextWindowConfig } from "./types.js";
+
+export interface EffectiveContextWindow {
+  provider: string;
+  model: string;
+  enabled: boolean;
+  maxInputTokens: number;
+  modelMaxInputTokens: number;
+  defaultInputTokens: number;
+  compactThreshold: number;
+  summaryBudgetRatio: number;
+  targetBudgetRatio: number;
+  overflowRecovery: ContextWindow["overflowRecovery"];
+  isLongContextEnabled: boolean;
+  maxOutputTokens?: number;
+}
+
+export function resolveEffectiveContextWindow({
+  llm,
+  callSite,
+  overrideProfile,
+}: {
+  llm: LLMConfig;
+  callSite: LLMCallSite;
+  overrideProfile?: string;
+}): EffectiveContextWindow {
+  const resolved = resolveCallSiteConfig(callSite, llm, { overrideProfile });
+  const catalogModel = PROVIDER_CATALOG.find(
+    (provider) => provider.id === resolved.provider,
+  )?.models.find((model) => model.id === resolved.model);
+
+  const modelMaxInputTokens =
+    catalogModel?.contextWindowTokens ??
+    DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS;
+  const defaultInputTokens =
+    catalogModel?.defaultContextWindowTokens ??
+    DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS;
+  const maxInputTokens = Math.min(
+    resolved.contextWindow.maxInputTokens,
+    modelMaxInputTokens,
+  );
+
+  return {
+    provider: resolved.provider,
+    model: resolved.model,
+    enabled: resolved.contextWindow.enabled,
+    maxInputTokens,
+    modelMaxInputTokens,
+    defaultInputTokens,
+    compactThreshold: resolved.contextWindow.compactThreshold,
+    summaryBudgetRatio: resolved.contextWindow.summaryBudgetRatio,
+    targetBudgetRatio: resolved.contextWindow.targetBudgetRatio,
+    overflowRecovery: resolved.contextWindow.overflowRecovery,
+    isLongContextEnabled: maxInputTokens > defaultInputTokens,
+    maxOutputTokens: catalogModel?.maxOutputTokens,
+  };
+}
+
+export function contextWindowConfigFromEffective(
+  base: ContextWindowConfig,
+  effective: EffectiveContextWindow,
+): ContextWindowConfig {
+  return {
+    ...base,
+    enabled: effective.enabled,
+    maxInputTokens: effective.maxInputTokens,
+    targetBudgetRatio: effective.targetBudgetRatio,
+    compactThreshold: effective.compactThreshold,
+    summaryBudgetRatio: effective.summaryBudgetRatio,
+    overflowRecovery: effective.overflowRecovery,
+  };
+}

package/src/config/llm-resolver.ts

@@ -3,8 +3,8 @@ import { z } from "zod";
 import {
   type LLMCallSite,
   LLMConfigBase,
-  type LLMConfigFragment,
   type LLMSchema,
+  type ProfileEntry,
 } from "./schemas/llm.js";
 
 /**
@@ -12,13 +12,24 @@ import {
  * call-site overrides, optional per-call profile, an optional ad-hoc override
  * profile, the workspace's active profile, and the required `llm.default`.
  *
- * Merge layers (low → high precedence; later layers override earlier):
+ * Merge layers (low → high precedence; later layers override earlier) for
+ * non-main-agent call sites:
  *   1. `llm.default` fields (required base)
  *   2. `llm.profiles[llm.activeProfile]` (workspace-wide active profile)
  *   3. `llm.profiles[opts.overrideProfile]` (per-call ad-hoc override)
  *   4. `llm.profiles[site.profile]` fields (call-site's named profile)
  *   5. `llm.callSites[callSite]` fields (call-site override)
  *
+ * For `mainAgent`, the selected active/conversation profile is the direct
+ * user intent for the chat loop, so profile layers intentionally sit above
+ * any static `llm.callSites.mainAgent` defaults seeded by migrations or UI
+ * settings:
+ *   1. `llm.default`
+ *   2. `llm.profiles[site.profile]`
+ *   3. `llm.callSites.mainAgent`
+ *   4. `llm.profiles[llm.activeProfile]`
+ *   5. `llm.profiles[opts.overrideProfile]`
+ *
  * Nested objects (`thinking`, `contextWindow`, and
  * `contextWindow.overflowRecovery`) are deep-merged so partial overrides at
  * any nesting level merge into — rather than replace — the corresponding
@@ -38,28 +49,51 @@ export function resolveCallSiteConfig(
 ): z.infer<typeof LLMConfigBase> {
   const layers: Mergeable[] = [llm.default as Mergeable];
 
-  // Layer: workspace-wide active profile. Silent fall-through on missing key
-  // — schema validation in LLMSchema.superRefine catches static references.
   const activeFragment =
     llm.activeProfile != null ? llm.profiles?.[llm.activeProfile] : undefined;
-  if (activeFragment != null) {
-    layers.push(activeFragment as Mergeable);
-  }
-
-  // Layer: per-call ad-hoc override (e.g. a chat conversation's pinned
-  // profile). Silent fall-through on missing key keeps the resolver pure.
   const overrideFragment =
     opts.overrideProfile != null
       ? llm.profiles?.[opts.overrideProfile]
       : undefined;
-  if (overrideFragment != null) {
-    layers.push(overrideFragment as Mergeable);
+  const site = llm.callSites?.[callSite];
+
+  if (callSite === "mainAgent") {
+    appendCallSiteLayers(layers, callSite, llm, site);
+    appendProfileLayer(layers, activeFragment);
+    appendProfileLayer(layers, overrideFragment);
+  } else {
+    appendProfileLayer(layers, activeFragment);
+    appendProfileLayer(layers, overrideFragment);
+    appendCallSiteLayers(layers, callSite, llm, site);
   }
 
-  const site = llm.callSites?.[callSite];
+  return finalize(deepMerge(...layers));
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+type Mergeable = Record<string, unknown>;
+
+function appendProfileLayer(
+  layers: Mergeable[],
+  profile: ProfileEntry | undefined,
+): void {
+  if (profile != null) {
+    layers.push(profileConfigFragment(profile));
+  }
+}
+
+function appendCallSiteLayers(
+  layers: Mergeable[],
+  callSite: LLMCallSite,
+  llm: z.infer<typeof LLMSchema>,
+  site: z.infer<typeof LLMSchema>["callSites"][LLMCallSite] | undefined,
+): void {
   if (site != null) {
     if (site.profile != null) {
-      const profileFragment: LLMConfigFragment | undefined =
+      const profileFragment: ProfileEntry | undefined =
         llm.profiles?.[site.profile];
       if (profileFragment == null) {
         // Defensive: `LLMSchema.superRefine` already rejects unknown profile
@@ -70,22 +104,24 @@ export function resolveCallSiteConfig(
           `LLM call site "${callSite}" references undefined profile "${site.profile}"`,
         );
       }
-      layers.push(profileFragment as Mergeable);
+      layers.push(profileConfigFragment(profileFragment));
     }
     // Strip the `profile` discriminator before merging — it isn't a
     // `LLMConfigBase` field.
     const { profile: _profile, ...siteFragment } = site;
     layers.push(siteFragment as Mergeable);
   }
-
-  return finalize(deepMerge(...layers));
 }
 
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
-
-type Mergeable = Record<string, unknown>;
+function profileConfigFragment(profile: ProfileEntry): Mergeable {
+  const {
+    source: _source,
+    label: _label,
+    description: _description,
+    ...config
+  } = profile;
+  return config as Mergeable;
+}
 
 /**
  * Returns true for objects we should recurse into during deep merge. We

package/src/config/loader.ts

@@ -512,9 +512,9 @@ export function mergeDefaultWorkspaceConfig(): void {
 export function loadConfig(): AssistantConfig {
   if (cached) return cached;
 
-  // Re-entrancy guard: log calls during loading can trigger loadConfig
-  // again. Return defaults to break the cycle instead of recursing to
-  // stack overflow.
+  // Re-entrancy guard: log calls during loading (e.g. file-mode warning)
+  // can trigger loadConfig again. Return defaults to break the cycle
+  // instead of recursing to stack overflow.
   if (loading) return cloneDefaultConfig();
   loading = true;