@vellumai/assistant 0.7.0 → 0.7.1

package/src/daemon/tool-side-effects.ts

@@ -7,12 +7,19 @@
  * registry entry instead of another if/else branch.
  */
 
+import { isAbsolute, resolve, sep } from "node:path";
+
 import { generateAppIcon } from "../media/app-icon-generator.js";
+import { addAppConversationId } from "../memory/app-store.js";
+import { invalidateEdgeIndex } from "../memory/v2/edge-index.js";
+import { getConceptsDir } from "../memory/v2/page-store.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { findActiveSession } from "../runtime/channel-verification-service.js";
 import { deliverVerificationSlack } from "../runtime/verification-outbound-actions.js";
 import { updatePublishedAppDeployment } from "../services/published-app-updater.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
+import { getWorkspaceDir } from "../util/platform.js";
 import { ensureAppSourceWatcher } from "./app-source-watcher.js";
 import { refreshSurfacesForApp } from "./conversation-surfaces.js";
 import type { ToolSetupContext } from "./conversation-tool-setup.js";
@@ -25,7 +32,6 @@ const log = getLogger("tool-side-effects");
 
 export interface SideEffectContext {
   ctx: ToolSetupContext;
-  broadcastToAllClients?: (msg: ServerMessage) => void;
 }
 
 export type PostExecutionHook = (
@@ -50,11 +56,10 @@ export type PostExecutionHook = (
 function notifyAppChanged(
   ctx: ToolSetupContext,
   appId: string,
-  broadcastToAllClients: ((msg: ServerMessage) => void) | undefined,
   opts?: { fileChange?: boolean; status?: string },
 ): void {
   refreshSurfacesForApp(ctx, appId, opts);
-  broadcastToAllClients?.({ type: "app_files_changed", appId });
+  broadcastMessage({ type: "app_files_changed", appId });
   void updatePublishedAppDeployment(appId);
 }
 
@@ -79,121 +84,106 @@ function registerHook(
 // Broadcast app_files_changed when a new app is created so clients
 // (e.g. macOS "Things" sidebar) refresh their app list immediately.
 // Also kicks off async icon generation via Gemini.
-registerHook(
-  "app_create",
-  (_name, _input, result, { ctx, broadcastToAllClients }) => {
-    try {
-      const parsed = JSON.parse(result.content) as {
-        id?: string;
-        name?: string;
-        description?: string;
-      };
-      if (parsed.id) {
-        // The apps directory may have just been created — ensure the
-        // filesystem watcher is running so subsequent file edits
-        // trigger live reload.
-        ensureAppSourceWatcher();
+registerHook("app_create", (_name, _input, result, { ctx }) => {
+  try {
+    const parsed = JSON.parse(result.content) as {
+      id?: string;
+      name?: string;
+      description?: string;
+    };
+    if (parsed.id) {
+      try {
+        addAppConversationId(parsed.id, ctx.conversationId);
+      } catch (err) {
+        log.warn(
+          { err, appId: parsed.id },
+          "Failed to track conversation ID on app_create",
+        );
+      }
+
+      ensureAppSourceWatcher();
 
-        notifyAppChanged(ctx, parsed.id, broadcastToAllClients);
+      notifyAppChanged(ctx, parsed.id);
 
-        // Fire-and-forget: generate an app icon in the background.
-        // When complete, broadcast again so clients pick up the new icon.
-        if (parsed.name) {
-          void generateAppIcon(parsed.id, parsed.name, parsed.description)
-            .then(() => {
-              broadcastToAllClients?.({
-                type: "app_files_changed",
-                appId: parsed.id!,
-              });
-            })
-            .catch((err) => {
-              log.warn(
-                { err, appId: parsed.id },
-                "Background icon generation failed",
-              );
+      if (parsed.name) {
+        void generateAppIcon(parsed.id, parsed.name, parsed.description)
+          .then(() => {
+            broadcastMessage({
+              type: "app_files_changed",
+              appId: parsed.id!,
             });
-        }
+          })
+          .catch((err) => {
+            log.warn(
+              { err, appId: parsed.id },
+              "Background icon generation failed",
+            );
+          });
       }
-    } catch {
-      // Result wasn't valid JSON — skip the broadcast.
     }
-  },
-);
+  } catch {
+    // Result wasn't valid JSON — skip the broadcast.
+  }
+});
 
-// Broadcast app_files_changed when an icon is (re)generated so clients refresh.
-registerHook(
-  "app_generate_icon",
-  (_name, input, _result, { broadcastToAllClients }) => {
-    const appId = input.app_id as string | undefined;
-    if (appId) {
-      broadcastToAllClients?.({ type: "app_files_changed", appId });
-    }
-  },
-);
+registerHook("app_generate_icon", (_name, input) => {
+  const appId = input.app_id as string | undefined;
+  if (appId) {
+    broadcastMessage({ type: "app_files_changed", appId });
+  }
+});
 
-// Broadcast app_files_changed when an app is deleted so clients remove it
-// from their cached app lists.
-registerHook(
-  "app_delete",
-  (_name, input, _result, { broadcastToAllClients }) => {
-    const appId = input.app_id as string | undefined;
-    if (appId) {
-      broadcastToAllClients?.({ type: "app_files_changed", appId });
-    }
-  },
-);
+registerHook("app_delete", (_name, input) => {
+  const appId = input.app_id as string | undefined;
+  if (appId) {
+    broadcastMessage({ type: "app_files_changed", appId });
+  }
+});
 
-// Trigger surface refresh + broadcast when an app is refreshed.
-registerHook(
-  "app_refresh",
-  (_name, input, _result, { ctx, broadcastToAllClients }) => {
-    const appId = input.app_id as string | undefined;
-    if (!appId) return;
-    notifyAppChanged(ctx, appId, broadcastToAllClients, { fileChange: true });
-  },
-);
+registerHook("app_refresh", (_name, input, _result, { ctx }) => {
+  const appId = input.app_id as string | undefined;
+  if (!appId) return;
+  try {
+    addAppConversationId(appId, ctx.conversationId);
+  } catch (err) {
+    log.warn({ err, appId }, "Failed to track conversation ID on app_refresh");
+  }
+  notifyAppChanged(ctx, appId, { fileChange: true });
+});
 
-// Broadcast voice config changes to all connected clients so every window
-// picks up the updated UserDefaults value immediately.
-registerHook(
-  "voice_config_update",
-  (_name, input, _result, { broadcastToAllClients }) => {
-    const setting = input.setting as string | undefined;
-    if (!setting) return;
+registerHook("voice_config_update", (_name, input) => {
+  const setting = input.setting as string | undefined;
+  if (!setting) return;
 
-    const SETTING_TO_KEY: Record<string, string> = {
-      activation_key: "pttActivationKey",
-      tts_voice_id: "ttsVoiceId",
-      tts_provider: "ttsProvider",
-      conversation_timeout: "voiceConversationTimeoutSeconds",
-      fish_audio_reference_id: "fishAudioReferenceId",
-    };
-    const key = SETTING_TO_KEY[setting];
-    if (!key) return;
+  const SETTING_TO_KEY: Record<string, string> = {
+    activation_key: "pttActivationKey",
+    tts_voice_id: "ttsVoiceId",
+    tts_provider: "ttsProvider",
+    conversation_timeout: "voiceConversationTimeoutSeconds",
+    fish_audio_reference_id: "fishAudioReferenceId",
+  };
+  const key = SETTING_TO_KEY[setting];
+  if (!key) return;
 
-    // Coerce the value to the correct type before broadcasting, matching
-    // the validation logic in the tool's execute method.
-    const raw = input.value;
-    let coerced: string | boolean | number = raw as string;
-    if (setting === "conversation_timeout") {
-      coerced = typeof raw === "number" ? raw : Number(raw);
-    } else if (setting === "tts_voice_id" && typeof raw === "string") {
-      coerced = raw.trim();
-    } else if (
-      setting === "fish_audio_reference_id" &&
-      typeof raw === "string"
-    ) {
-      coerced = raw.trim();
-    } else if (setting === "tts_provider" && typeof raw === "string") {
-      coerced = raw.trim();
-    }
-    broadcastToAllClients?.({
-      type: "client_settings_update",
-      key,
-      value: coerced,
-    } as unknown as ServerMessage);
-  },
-);
+  // Coerce the value to the correct type before broadcasting, matching
+  // the validation logic in the tool's execute method.
+  const raw = input.value;
+  let coerced: string | boolean | number = raw as string;
+  if (setting === "conversation_timeout") {
+    coerced = typeof raw === "number" ? raw : Number(raw);
+  } else if (setting === "tts_voice_id" && typeof raw === "string") {
+    coerced = raw.trim();
+  } else if (setting === "fish_audio_reference_id" && typeof raw === "string") {
+    coerced = raw.trim();
+  } else if (setting === "tts_provider" && typeof raw === "string") {
+    coerced = raw.trim();
+  }
+  broadcastMessage({
+    type: "client_settings_update",
+    key,
+    value: coerced,
+  } as unknown as ServerMessage);
+});
 
 // Dispatch pending Slack DM delivery when a CLI verification command
 // completes.  The CLI subprocess is sandboxed and cannot reach the
@@ -255,6 +245,34 @@ registerHook("bash", (_name, input, result) => {
   }
 });
 
+// Invalidate the in-memory v2 edge index when the LLM writes or edits a file
+// under `memory/concepts/`. The page-store invalidates on programmatic writes;
+// this hook covers consolidation, where the LLM edits page frontmatter through
+// the file tools rather than through `writePage`.
+function invalidateEdgeIndexIfConceptPage(
+  input: Record<string, unknown>,
+): void {
+  const rawPath = input.path;
+  if (typeof rawPath !== "string" || rawPath.length === 0) return;
+  const workspaceDir = getWorkspaceDir();
+  const conceptsRoot = getConceptsDir(workspaceDir);
+  const absPath = isAbsolute(rawPath)
+    ? resolve(rawPath)
+    : resolve(workspaceDir, rawPath);
+  const rootWithSep = conceptsRoot.endsWith(sep)
+    ? conceptsRoot
+    : conceptsRoot + sep;
+  if (absPath.startsWith(rootWithSep)) {
+    invalidateEdgeIndex(workspaceDir);
+  }
+}
+registerHook("file_write", (_name, input) =>
+  invalidateEdgeIndexIfConceptPage(input),
+);
+registerHook("file_edit", (_name, input) =>
+  invalidateEdgeIndexIfConceptPage(input),
+);
+
 // ── Runner ───────────────────────────────────────────────────────────
 
 /**

package/src/daemon/trust-context.ts

@@ -30,3 +30,16 @@ export interface TrustContext {
   /** Chat/conversation ID the requester is interacting through. */
   requesterChatId?: string;
 }
+
+/**
+ * Trust context used by internal background jobs (memory consolidation,
+ * update bulletin, scheduled tasks) when invoking the agent loop without
+ * an inbound actor identity. The assistant is the guardian over its own
+ * internal state, so self-maintenance flows clear the side-effect
+ * approval gate. Inbound message conversations resolve trust per-actor
+ * via `resolveTrustContext()` and must not use this constant.
+ */
+export const INTERNAL_GUARDIAN_TRUST_CONTEXT = {
+  sourceChannel: "vellum",
+  trustClass: "guardian",
+} as const satisfies TrustContext;

package/src/daemon/wake-target-adapter.ts

@@ -15,6 +15,7 @@ import {
 } from "../memory/conversation-crud.js";
 import { syncMessageToDisk } from "../memory/conversation-disk-view.js";
 import type { WakeTarget } from "../runtime/agent-wake.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { getLogger } from "../util/logger.js";
 import type { Conversation } from "./conversation.js";
 import type { ServerMessage } from "./message-protocol.js";
@@ -152,10 +153,7 @@ export function conversationToWakeTarget(
       conversation.messages.push(msg);
     },
     onWakeProducedOutput: (source, hint, surfaceId) => {
-      const emit =
-        conversation.broadcastToAllClients ??
-        conversation.sendToClient.bind(conversation);
-      emit({
+      broadcastMessage({
         type: "ui_surface_show",
         conversationId: conversation.conversationId,
         surfaceId,
@@ -174,16 +172,13 @@ export function conversationToWakeTarget(
         conversation.conversationId,
       );
       if (!frame) return;
-      if (conversation.broadcastToAllClients) {
-        conversation.broadcastToAllClients(frame);
-      } else {
-        conversation.sendToClient(frame);
-      }
+      broadcastMessage(frame);
     },
     isProcessing: () => conversation.isProcessing(),
     markProcessing: (on) => {
       conversation.processing = on;
     },
+    setTrustContext: (ctx) => conversation.setTrustContext(ctx),
     persistTailMessage: async (message) => {
       const turnChannelCtx = conversation.getTurnChannelContext();
       const turnInterfaceCtx = conversation.getTurnInterfaceContext();

package/src/events/domain-events.ts

@@ -21,14 +21,6 @@ export interface ToolDomainEvents {
     riskLevel: string;
     decidedAtMs: number;
   };
-  "tool.secret.detected": {
-    conversationId: string;
-    requestId?: string;
-    toolName: string;
-    action: "redact" | "warn" | "block" | "prompt";
-    matches: Array<{ type: string; redactedValue: string }>;
-    detectedAtMs: number;
-  };
   "tool.execution.finished": {
     conversationId: string;
     requestId?: string;

package/src/events/tool-audit-listener.ts

@@ -43,6 +43,7 @@ function toInvocationRecord(
         result: event.result.content.slice(0, RESULT_PREVIEW_LIMIT),
         decision: event.decision,
         riskLevel: event.riskLevel,
+        matchedTrustRuleId: event.matchedTrustRuleId,
         durationMs: event.durationMs,
       };
     case "error":
@@ -53,6 +54,7 @@ function toInvocationRecord(
         result: `error: ${event.errorMessage}`,
         decision: "error",
         riskLevel: event.riskLevel,
+        matchedTrustRuleId: event.matchedTrustRuleId,
         durationMs: event.durationMs,
       };
     case "permission_denied":
@@ -63,11 +65,11 @@ function toInvocationRecord(
         result: formatDeniedResult(event.reason),
         decision: "denied",
         riskLevel: event.riskLevel,
+        matchedTrustRuleId: event.matchedTrustRuleId,
         durationMs: event.durationMs,
       };
     case "start":
     case "permission_prompt":
-    case "secret_detected":
       return null;
   }
 }

package/src/events/tool-domain-event-publisher.ts

@@ -85,16 +85,6 @@ export function createToolDomainEventPublisher(
           failedAtMs: Date.now(),
         });
         break;
-      case "secret_detected":
-        await eventBus.emit("tool.secret.detected", {
-          conversationId: event.conversationId,
-          requestId: event.requestId,
-          toolName: event.toolName,
-          action: event.action,
-          matches: event.matches,
-          detectedAtMs: event.detectedAtMs,
-        });
-        break;
     }
   };
 }

package/src/events/tool-metrics-listener.ts

@@ -69,23 +69,6 @@ export function registerToolMetricsLoggingListener(
         }
         return;
       }
-      case "tool.secret.detected": {
-        const types = [
-          ...new Set(event.payload.matches.map((match) => match.type)),
-        ];
-        logger.warn(
-          {
-            toolName: event.payload.toolName,
-            matchCount: event.payload.matches.length,
-            types,
-            action: event.payload.action,
-            conversationId: event.payload.conversationId,
-            requestId: event.payload.requestId,
-          },
-          "Secrets detected in tool output",
-        );
-        return;
-      }
       case "tool.execution.finished":
         if (!debugEnabled()) return;
         logger.debug(

package/src/events/tool-trace-listener.ts

@@ -78,20 +78,6 @@ export function registerToolTraceListener(
         );
         return;
 
-      case "tool.secret.detected":
-        traceEmitter.emit(
-          "secret_detected",
-          `Secret detected in ${event.payload.toolName} output`,
-          {
-            requestId: event.payload.requestId,
-            status: "warning",
-            attributes: {
-              toolName: event.payload.toolName,
-            },
-          },
-        );
-        return;
-
       default:
         return;
     }

package/src/filing/filing-service.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import { processMessage } from "../daemon/process-message.js";
@@ -108,7 +109,18 @@ export class FilingService {
   }
 
   start(): void {
-    const config = getConfig().filing;
+    const fullConfig = getConfig();
+    if (
+      isAssistantFeatureFlagEnabled("memory-v2-enabled", fullConfig) &&
+      fullConfig.memory.v2.enabled
+    ) {
+      log.info("Filing service disabled — memory v2 is active");
+      this._nextRunAt = null;
+      this._nextCompactionAt = null;
+      return;
+    }
+
+    const config = fullConfig.filing;
 
     if (config.enabled && !this.timer) {
       log.info({ intervalMs: config.intervalMs }, "Filing service started");

package/src/heartbeat/__tests__/heartbeat-feed-event.test.ts

@@ -14,6 +14,7 @@ mock.module("../../runtime/assistant-event-hub.js", () => ({
     publish: publishSpy,
     subscribe: () => () => {},
   },
+  broadcastMessage: () => {},
 }));
 
 // Stub workspace prompt reads so the heartbeat service doesn't try to
@@ -100,19 +101,22 @@ mock.module("../../prompts/system-prompt.js", () => ({
   buildCliReferenceSection: () => "",
   ensurePromptFiles: () => {},
   stripCommentLines: (s: string) => s,
+  readPromptFile: () => null,
 }));
 
 // Mock processMessage — HeartbeatService now imports it directly.
-let _testProcessMessage: ((...args: unknown[]) => Promise<{ messageId: string }>) | undefined;
+let _testProcessMessage:
+  | ((...args: unknown[]) => Promise<{ messageId: string }>)
+  | undefined;
 
 mock.module("../../daemon/process-message.js", () => ({
   processMessage: async (...args: unknown[]) => {
     if (_testProcessMessage) return _testProcessMessage(...args);
     return { messageId: `mock-msg-${Date.now()}` };
   },
+  processMessageInBackground: async () => ({ messageId: "mock-bg" }),
   resolveTurnChannel: () => "vellum",
   resolveTurnInterface: () => "vellum",
-  makePendingInteractionRegistrar: () => () => {},
   prepareConversationForMessage: async () => ({}),
 }));
 

package/src/heartbeat/heartbeat-service.ts

@@ -274,11 +274,25 @@ export class HeartbeatService {
         await import("../credential-health/credential-health-service.js");
       const report = await checkAllCredentials();
       if (report.unhealthy.length > 0) {
-        await this.notifyUnhealthyCredentials(report.unhealthy);
-        // Only block providers for hard-failure statuses — expiring and ping_failed
-        // are transient/still-usable and should not disable provider tools.
-        // missing_scopes is a hard failure because required scopes are absent and
-        // provider tools will predictably fail.
+        // Filter out unreachable results — CES wake/startup blips should not
+        // produce user-facing credential alerts. Only actionable failures notify.
+        const notifiable = report.unhealthy.filter(
+          (r) => r.status !== "unreachable",
+        );
+        const unreachableCount = report.unhealthy.length - notifiable.length;
+        if (unreachableCount > 0) {
+          log.warn(
+            { unreachableCount },
+            "Credential backend unreachable — skipping health alerts for affected providers",
+          );
+        }
+        if (notifiable.length > 0) {
+          await this.notifyUnhealthyCredentials(notifiable);
+        }
+        // Only block providers for hard-failure statuses — expiring, ping_failed,
+        // and unreachable are transient/still-usable and should not disable
+        // provider tools. missing_scopes is a hard failure because required
+        // scopes are absent and provider tools will predictably fail.
         const hardFailureStatuses = new Set([
           "revoked",
           "missing_token",
@@ -355,6 +369,10 @@ export class HeartbeatService {
             missingScopes: result.missingScopes,
           },
           routingIntent: "single_channel",
+          conversationMetadata: {
+            source: "heartbeat",
+            groupId: "system:background",
+          },
         });
       } catch (err) {
         log.error(

package/src/home/__tests__/feed-writer.test.ts

@@ -18,8 +18,6 @@ import {
   test,
 } from "bun:test";
 
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../../runtime/assistant-scope.js";
-
 // ─── assistantEventHub mock ────────────────────────────────────────────
 // We spy on `publish` so the SSE-publish test can assert the writer
 // fires a `home_feed_updated` event with the correct `newItemCount`.
@@ -651,14 +649,12 @@ describe("feed-writer", () => {
       // Inspect the LAST publish — it reflects the final on-disk state.
       const lastCall = publishSpy.mock.calls[publishSpy.mock.calls.length - 1]!;
       const event = lastCall[0] as {
-        assistantId: string;
         message: {
           type: string;
           updatedAt: string;
           newItemCount: number;
         };
       };
-      expect(event.assistantId).toBe(DAEMON_INTERNAL_ASSISTANT_ID);
       expect(event.message.type).toBe("home_feed_updated");
       expect(event.message.newItemCount).toBe(2);
       expect(Number.isNaN(Date.parse(event.message.updatedAt))).toBe(false);

package/src/home/__tests__/relationship-state-writer.test.ts

@@ -704,6 +704,36 @@ describe("relationship-state-writer", () => {
       expect(state.facts[0]?.source).toBe("onboarding");
     });
 
+    test("tone group ID 'warm' maps to descriptive voice fact 'Warm and easy'", async () => {
+      writeOnboardingSidecar({
+        tools: [],
+        tasks: [],
+        tone: "warm",
+      });
+
+      const state = (await computeRelationshipState()) as RelationshipStateLike;
+      const voiceFacts = state.facts.filter(
+        (f) => f.category === "voice" && f.source === "onboarding",
+      );
+      expect(voiceFacts).toHaveLength(1);
+      expect(voiceFacts[0]!.text).toBe("Warm and easy");
+    });
+
+    test("unrecognized tone value passes through verbatim (backwards-compatible)", async () => {
+      writeOnboardingSidecar({
+        tools: [],
+        tasks: [],
+        tone: "balanced",
+      });
+
+      const state = (await computeRelationshipState()) as RelationshipStateLike;
+      const voiceFacts = state.facts.filter(
+        (f) => f.category === "voice" && f.source === "onboarding",
+      );
+      expect(voiceFacts).toHaveLength(1);
+      expect(voiceFacts[0]!.text).toBe("balanced");
+    });
+
     test("missing sidecar produces no onboarding-sourced facts", async () => {
       writeFile("USER.md", "- Preferred name: Alex");
       const state = (await computeRelationshipState()) as RelationshipStateLike;

package/src/home/feed-writer.ts

@@ -54,7 +54,6 @@ import { join } from "node:path";
 
 import { buildAssistantEvent } from "../runtime/assistant-event.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getLogger } from "../util/logger.js";
 import { getDataDir } from "../util/platform.js";
 import {
@@ -457,7 +456,7 @@ function compareFeedItems(a: FeedItem, b: FeedItem): number {
 function publishHomeFeedUpdated(updatedAt: string, newItemCount: number): void {
   assistantEventHub
     .publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, {
+      buildAssistantEvent({
         type: "home_feed_updated",
         updatedAt,
         newItemCount,