@vellumai/assistant 0.7.0 → 0.7.2

package/src/contacts/contacts-write.ts

@@ -7,10 +7,7 @@
  */
 
 import type { ChannelId } from "../channels/types.js";
-import type { GuardianBinding } from "../memory/channel-verification-sessions.js";
-import { ensureGuardianPersonaFile } from "../prompts/persona-resolver.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
-import { getLogger } from "../util/logger.js";
 import { emitContactChange } from "./contact-events.js";
 import {
   findContactChannel,
@@ -18,8 +15,6 @@ import {
   getChannelById,
   getContact,
   getContactInternal,
-  updateChannelInteraction,
-  updateChannelLastSeenById,
   updateChannelStatus,
   upsertContact,
 } from "./contact-store.js";
@@ -30,112 +25,9 @@ import type {
   ContactWriteResult,
 } from "./types.js";
 
-const log = getLogger("contacts-write");
-
-// ── Helpers ──────────────────────────────────────────────────────────
-
-function parseDisplayNameFromMetadata(
-  metadataJson: string | null | undefined,
-): string | null {
-  if (!metadataJson) return null;
-  try {
-    const parsed = JSON.parse(metadataJson);
-    if (
-      typeof parsed.displayName === "string" &&
-      parsed.displayName.length > 0
-    ) {
-      return parsed.displayName;
-    }
-  } catch {
-    // Malformed JSON — fall through
-  }
-  return null;
-}
 
 // ── Guardian operations ──────────────────────────────────────────────
 
-/**
- * Create a guardian binding by writing to the contacts table.
- * Returns a GuardianBinding-compatible object synthesized from the input params
- * (so callers expecting binding.id still work).
- */
-export function createGuardianBinding(params: {
-  channel: string;
-  guardianExternalUserId: string;
-  guardianDeliveryChatId: string;
-  guardianPrincipalId: string;
-  verifiedVia?: string;
-  metadataJson?: string | null;
-}): GuardianBinding {
-  const canonicalId =
-    canonicalizeInboundIdentity(
-      params.channel as ChannelId,
-      params.guardianExternalUserId,
-    ) ?? params.guardianExternalUserId;
-
-  const displayName =
-    parseDisplayNameFromMetadata(params.metadataJson) ??
-    params.guardianExternalUserId;
-
-  const contact = upsertContact({
-    displayName,
-    role: "guardian",
-    notes: "guardian",
-    principalId: params.guardianPrincipalId,
-    channels: [
-      {
-        type: params.channel,
-        address: canonicalId,
-        externalUserId: canonicalId,
-        externalChatId: params.guardianDeliveryChatId,
-        status: "active",
-        verifiedAt: Date.now(),
-        verifiedVia: params.verifiedVia ?? "challenge",
-      },
-    ],
-  });
-
-  // Seed the per-user persona file so downstream readers (journaling,
-  // persona resolution) can rely on `users/<slug>.md` existing on disk.
-  // Idempotent: pre-existing customized files are preserved.
-  //
-  // Seeding is restricted to the guardian-creation path only — it must
-  // NOT run from inbound-message upsertContactChannel calls, since the
-  // `users/` directory watcher would fire on every new contact and
-  // evict live conversations.
-  if (contact.userFile) {
-    // Tolerate filesystem failures (read-only or full workspace) so a
-    // disk error doesn't leave the DB commit orphaned. The persona file
-    // can be reseeded later; failing the binding here would be worse.
-    try {
-      ensureGuardianPersonaFile(contact.userFile);
-    } catch (err) {
-      log.warn(
-        { err, userFile: contact.userFile },
-        "failed to seed guardian persona file; continuing",
-      );
-    }
-  }
-
-  const now = Date.now();
-  const result: GuardianBinding = {
-    id: `contact-binding-${params.channel}`,
-    assistantId: "self",
-    channel: params.channel,
-    guardianExternalUserId: params.guardianExternalUserId,
-    guardianDeliveryChatId: params.guardianDeliveryChatId,
-    guardianPrincipalId: params.guardianPrincipalId,
-    status: "active",
-    verifiedAt: now,
-    verifiedVia: params.verifiedVia ?? "challenge",
-    metadataJson: params.metadataJson ?? null,
-    createdAt: now,
-    updatedAt: now,
-  };
-
-  return result;
-}
-
 /**
  * Revoke a guardian binding by updating the contacts table.
  * Returns true when a guardian channel was found and revoked, false otherwise.
@@ -237,7 +129,7 @@ export function upsertContactChannel(params: {
   // inbound-message hot path — every new contact (Slack, phone, email, etc)
   // would otherwise fire the `users/` directory watcher in
   // config-watcher.ts and evict live conversations. Persona-file seeding
-  // is the sole responsibility of `createGuardianBinding`.
+  // is handled by the gateway's guardian bootstrap flow.
 
   const contactResult = findContactChannel({
     channelType: params.sourceChannel,
@@ -283,26 +175,3 @@ export function revokeMember(
   return { contact, channel: updatedChannel };
 }
 
-/**
- * Update the lastSeenAt timestamp on a contact channel by its ID.
- * Expects a plain channel UUID (ContactChannel.id), not the composite API ID.
- */
-export function touchChannelLastSeen(channelId: string): void {
-  try {
-    updateChannelLastSeenById(channelId);
-  } catch (err) {
-    log.warn({ err }, "Failed to update channel lastSeenAt");
-  }
-}
-
-/**
- * Track an interaction on the specific channel that received it.
- * Swallows errors to avoid disrupting the inbound message hot path.
- */
-export function touchContactInteraction(channelId: string): void {
-  try {
-    updateChannelInteraction(channelId);
-  } catch (err) {
-    log.warn({ err }, "Failed to update channel interaction stats");
-  }
-}

package/src/context/window-manager.ts

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { ContextWindowConfig } from "../config/types.js";
 import type {
   ContentBlock,
@@ -21,6 +22,7 @@ import { truncateToolResultsAcrossHistory } from "./tool-result-truncation.js";
 const log = getLogger("context-window");
 
 export const CONTEXT_SUMMARY_MARKER = "<context_summary>";
+const CONVERSATION_SUMMARY_CALL_SITE: LLMCallSite = "conversationSummarization";
 const MAX_BLOCK_PREVIEW_CHARS = 3000;
 const MAX_FALLBACK_SUMMARY_CHARS = 12000;
 const COMPACTION_COOLDOWN_MS = 2 * 60 * 1000;
@@ -241,6 +243,8 @@ export interface ContextWindowResult {
   summaryInputTokens: number;
   summaryOutputTokens: number;
   summaryModel: string;
+  summaryCallSite?: LLMCallSite;
+  summaryOverrideProfile?: string | null;
   summaryCacheCreationInputTokens?: number;
   summaryCacheReadInputTokens?: number;
   summaryRawResponses?: unknown[];
@@ -278,6 +282,11 @@ export interface ContextWindowCompactOptions {
    * aggressively. Explicit `minKeepRecentUserTurns` overrides this hint.
    */
   conversationOriginChannel?: string;
+  /**
+   * Per-conversation inference-profile override forwarded to the summary LLM
+   * call and usage attribution.
+   */
+  overrideProfile?: string | null;
   /**
    * Override the target input token budget used for keep-boundary
    * projected-fit checks. Clamped to no looser than `config.targetInputTokens`
@@ -305,7 +314,7 @@ export interface ContextWindowManagerOptions {
 export class ContextWindowManager {
   private readonly provider: Provider;
   private readonly _systemPrompt: string | (() => string);
-  private readonly config: ContextWindowConfig;
+  private config: ContextWindowConfig;
   private readonly toolTokenBudget: number;
   /**
    * Number of leading messages that are non-persisted (injected inherited
@@ -339,6 +348,10 @@ export class ContextWindowManager {
     this.toolTokenBudget = options.toolTokenBudget ?? 0;
   }
 
+  updateConfig(config: ContextWindowConfig): void {
+    this.config = config;
+  }
+
   /**
    * Provider key for the local token estimator. Wrapper providers (e.g.
    * OpenRouter routing to `anthropic/*`) override `tokenEstimationProvider`
@@ -480,6 +493,7 @@ export class ContextWindowManager {
       targetInputTokensOverride: options?.targetInputTokensOverride,
       conversationOriginChannel: options?.conversationOriginChannel,
       force: options?.force,
+      previousEstimatedInputTokens,
     });
     if (keepPlan.keepFromIndex <= summaryOffset) {
       // All turns fit after truncation projection, but the real in-memory
@@ -672,6 +686,7 @@ export class ContextWindowManager {
       transcriptBlocks,
       retainedThreadRefs,
       signal,
+      options?.overrideProfile ?? null,
     );
     const summary = summaryUpdate.summary;
     const summaryInputTokens = summaryUpdate.inputTokens;
@@ -748,6 +763,8 @@ export class ContextWindowManager {
       summaryInputTokens,
       summaryOutputTokens,
       summaryModel,
+      summaryCallSite: CONVERSATION_SUMMARY_CALL_SITE,
+      summaryOverrideProfile: options?.overrideProfile ?? null,
       summaryCacheCreationInputTokens,
       summaryCacheReadInputTokens,
       summaryRawResponses,
@@ -771,6 +788,7 @@ export class ContextWindowManager {
       targetInputTokensOverride?: number;
       conversationOriginChannel?: string;
       force?: boolean;
+      previousEstimatedInputTokens?: number;
     },
   ): { keepFromIndex: number; keepTurns: number } {
     // Slack-originated conversations rely on multi-turn thread context
@@ -854,6 +872,20 @@ export class ContextWindowManager {
       }
     }
 
+    // The projection's summary-swap and tool_result truncation can make
+    // projectedTokensForKeep(hi) optimistically fit even when the live
+    // conversation is well over target — sending /compact through the
+    // "already fits" skip path as a no-op. Clamp lo so summarization runs.
+    if (
+      opts?.force &&
+      floorIsImplicitDefault &&
+      lo === userTurnStarts.length &&
+      lo > 0 &&
+      (opts?.previousEstimatedInputTokens ?? 0) > targetTokens
+    ) {
+      lo -= 1;
+    }
+
     const keepTurns = lo;
     const rawKeepFromIndex =
       keepTurns === 0
@@ -994,6 +1026,7 @@ export class ContextWindowManager {
     transcriptBlocks: ContentBlock[],
     retainedThreadRefs: string[],
     signal?: AbortSignal,
+    overrideProfile?: string | null,
   ): Promise<{
     summary: string;
     inputTokens: number;
@@ -1025,15 +1058,20 @@ export class ContextWindowManager {
     const summaryMessage: Message = { role: "user", content: contentBlocks };
     let failed = false;
     try {
+      const providerConfig: Record<string, unknown> = {
+        callSite: CONVERSATION_SUMMARY_CALL_SITE,
+        usageTracking: "manual",
+        max_tokens: this.summaryMaxTokens,
+      };
+      if (overrideProfile) {
+        providerConfig.overrideProfile = overrideProfile;
+      }
       const response = await this.provider.sendMessage(
         [summaryMessage],
         undefined,
         SUMMARY_SYSTEM_PROMPT,
         {
-          config: {
-            callSite: "conversationSummarization" as const,
-            max_tokens: this.summaryMaxTokens,
-          },
+          config: providerConfig,
           signal,
         },
       );

package/src/credential-execution/feature-gates.ts

@@ -28,12 +28,12 @@ export const CES_SECURE_INSTALL_FLAG_KEY = "ces-secure-install" as const;
 /** Gate for credential grant and audit inspection surfaces. */
 export const CES_GRANT_AUDIT_FLAG_KEY = "ces-grant-audit" as const;
 
-/** Gate for managed sidecar transport in containerized environments. */
-export const CES_MANAGED_SIDECAR_FLAG_KEY = "ces-managed-sidecar" as const;
-
 /** Gate for routing credential reads/writes through the CES process. */
 const CES_CREDENTIAL_BACKEND_FLAG_KEY = "ces-credential-backend" as const;
 
+/** Gate for managed sidecar transport in containerized environments. */
+export const CES_MANAGED_SIDECAR_FLAG_KEY = "ces-managed-sidecar" as const;
+
 // ---------------------------------------------------------------------------
 // Public API — predicate functions
 // ---------------------------------------------------------------------------
@@ -66,13 +66,6 @@ export function isCesGrantAuditEnabled(config: AssistantConfig): boolean {
   return isAssistantFeatureFlagEnabled(CES_GRANT_AUDIT_FLAG_KEY, config);
 }
 
-/**
- * Whether managed sidecar transport should be used for CES communication.
- */
-export function isCesManagedSidecarEnabled(config: AssistantConfig): boolean {
-  return isAssistantFeatureFlagEnabled(CES_MANAGED_SIDECAR_FLAG_KEY, config);
-}
-
 /**
  * Whether credential reads and writes should be routed through the CES process.
  */
@@ -81,3 +74,10 @@ export function isCesCredentialBackendEnabled(
 ): boolean {
   return isAssistantFeatureFlagEnabled(CES_CREDENTIAL_BACKEND_FLAG_KEY, config);
 }
+
+/**
+ * Whether managed sidecar transport should be used for CES communication.
+ */
+export function isCesManagedSidecarEnabled(config: AssistantConfig): boolean {
+  return isAssistantFeatureFlagEnabled(CES_MANAGED_SIDECAR_FLAG_KEY, config);
+}

package/src/credential-execution/process-manager.ts

@@ -12,12 +12,6 @@
  * creates a socket-based CesTransport. The CES sidecar manages its own
  * lifecycle; the process manager only manages the transport connection.
  *
- * Feature-flag gate: Managed sidecar mode is controlled by the
- * `ces-managed-sidecar` feature flag (checked via the required
- * AssistantConfig). When the flag is off, the process manager skips
- * managed discovery even in containerized environments, ensuring
- * rollback safety.
- *
  * Managed env contract:
  * - CES_BOOTSTRAP_SOCKET  — Path to the bootstrap Unix socket (shared emptyDir)
  * - /assistant-data-ro     — Assistant data mounted read-only into the CES sidecar
@@ -42,7 +36,6 @@ import {
   type LocalSourceDiscoverySuccess,
   type ManagedDiscoverySuccess,
 } from "./executable-discovery.js";
-import { isCesManagedSidecarEnabled } from "./feature-gates.js";
 
 const log = getLogger("ces-process-manager");
 
@@ -71,10 +64,8 @@ export const CES_PRIVATE_DATA_DIR = "/ces-data";
 
 export interface CesProcessManagerConfig {
   /**
-   * Assistant configuration for feature-flag checks.
-   * The managed sidecar path is gated behind the `ces-managed-sidecar`
-   * feature flag via this config.  When omitted (e.g. CLI / admin
-   * callers), managed mode is allowed unconditionally.
+   * Assistant configuration.
+   * Reserved for future feature-flag checks or config-driven behavior.
    */
   assistantConfig?: AssistantConfig;
 }
@@ -88,10 +79,6 @@ export interface CesProcessManager {
    * Start the CES process (local) or connect to the sidecar (managed).
    * Returns a CesTransport ready for use with createCesClient().
    *
-   * When the `ces-managed-sidecar` feature flag is off, managed mode
-   * is skipped even in containerized environments — the process manager
-   * falls back to local discovery.
-   *
    * Throws if CES is unavailable.
    */
   start(): Promise<CesTransport>;
@@ -118,7 +105,7 @@ export interface CesProcessManager {
 // ---------------------------------------------------------------------------
 
 export function createCesProcessManager(
-  config: CesProcessManagerConfig,
+  _config: CesProcessManagerConfig,
 ): CesProcessManager {
   let childProcess: Subprocess | null = null;
   let managedSocket: Socket | null = null;
@@ -131,31 +118,15 @@ export function createCesProcessManager(
         throw new Error("CES process manager is already running");
       }
 
-      // Feature-flag gate: when the managed sidecar flag is off, skip
-      // managed discovery entirely. This ensures rollback safety —
-      // disabling the flag leaves existing non-agent platform consumers
-      // intact.
-      const managedAllowed = config.assistantConfig
-        ? isCesManagedSidecarEnabled(config.assistantConfig)
-        : true; // No config → allow managed mode unconditionally (CLI/admin callers)
-
-      if (managedAllowed) {
-        discoveryResult = await discoverCes();
-        if (discoveryResult.mode === "unavailable") {
-          // The managed sidecar bootstrap socket is not present — this happens
-          // when the flag is enabled by default but the instance pre-dates the
-          // socket volume mount (e.g. existing Docker configs without the
-          // ces-bootstrap volume). Warn and fall back to local discovery so
-          // these deployments don't fail on upgrade.
-          log.warn(
-            { reason: discoveryResult.reason },
-            "CES managed sidecar bootstrap socket unavailable — falling back to local CES discovery",
-          );
-          discoveryResult = discoverLocalCes();
-        }
-      } else {
-        log.info(
-          "CES managed sidecar feature flag is off — skipping managed discovery, falling back to local",
+      discoveryResult = await discoverCes();
+      if (discoveryResult.mode === "unavailable") {
+        // The managed sidecar bootstrap socket is not present — this happens
+        // when the instance pre-dates the socket volume mount (e.g. existing
+        // Docker configs without the ces-bootstrap volume). Warn and fall
+        // back to local discovery so these deployments don't fail on upgrade.
+        log.warn(
+          { reason: discoveryResult.reason },
+          "CES managed sidecar bootstrap socket unavailable — falling back to local CES discovery",
         );
         discoveryResult = discoverLocalCes();
       }
@@ -241,11 +212,7 @@ export function createCesProcessManager(
       stdin: "pipe",
       stdout: "pipe",
       stderr: "pipe",
-      env: {
-        ...process.env,
-        // Signal to CES that it was launched by the assistant
-        CES_LAUNCHED_BY: "assistant",
-      },
+      env: buildLocalCesEnv(),
     });
 
     childProcess = proc;
@@ -274,11 +241,7 @@ export function createCesProcessManager(
       stdin: "pipe",
       stdout: "pipe",
       stderr: "pipe",
-      env: {
-        ...process.env,
-        // Signal to CES that it was launched by the assistant
-        CES_LAUNCHED_BY: "assistant",
-      },
+      env: buildLocalCesEnv(),
     });
 
     childProcess = proc;
@@ -313,6 +276,38 @@ export function createCesProcessManager(
   }
 }
 
+// ---------------------------------------------------------------------------
+// Local CES env
+// ---------------------------------------------------------------------------
+
+/**
+ * Build the environment for a locally-spawned CES child process.
+ *
+ * Inherits the daemon's process env (which already has VELLUM_WORKSPACE_DIR
+ * and GATEWAY_SECURITY_DIR from the CLI) and adds CES-specific env vars:
+ *
+ * - `CREDENTIAL_SECURITY_DIR`: CES reads this to find its key store and
+ *   encryption data. In local mode this is the same directory as the
+ *   gateway security dir (both point to `<instance>/.vellum/protected`).
+ *
+ * - `VELLUM_WORKSPACE_DIR`: Forwarded so CES can locate the assistant
+ *   workspace (credential metadata, OAuth DB, token refresh).
+ */
+function buildLocalCesEnv(): Record<string, string | undefined> {
+  return {
+    ...process.env,
+    CES_LAUNCHED_BY: "assistant",
+    // Map the daemon's GATEWAY_SECURITY_DIR to CES's own env var.
+    // In local mode, both services share the same protected/ directory.
+    CREDENTIAL_SECURITY_DIR:
+      process.env["CREDENTIAL_SECURITY_DIR"] ||
+      process.env["GATEWAY_SECURITY_DIR"],
+    // VELLUM_WORKSPACE_DIR is already in process.env from the CLI,
+    // but be explicit for clarity.
+    VELLUM_WORKSPACE_DIR: process.env["VELLUM_WORKSPACE_DIR"],
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Stdio transport (local mode)
 // ---------------------------------------------------------------------------

package/src/credential-health/credential-health-service.ts

@@ -11,18 +11,14 @@
  * no token refresh or recovery is attempted.
  */
 
-import {
-  isTokenExpired,
-  oauthConnectionAccessTokenPath,
-} from "@vellumai/credential-storage";
+import { isTokenExpired } from "@vellumai/credential-storage";
 
-import { manualTokenAccessCredentialKey } from "../oauth/manual-token-connection.js";
+import { getConnectionAccessTokenResult } from "../oauth/credential-token-resolver.js";
 import {
   getProvider,
   listActiveConnectionsByProvider,
   listProviders,
 } from "../oauth/oauth-store.js";
-import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("credential-health");
@@ -40,6 +36,7 @@ export type CredentialHealthStatus =
   | "expiring"
   | "expired"
   | "missing_token"
+  | "unreachable"
   | "missing_scopes"
   | "revoked"
   | "ping_failed";
@@ -165,16 +162,23 @@ async function checkConnection(
     missingScopes: [] as string[],
   };
 
-  // 1. Check token presence. Manual-token providers (e.g. slack_channel,
-  // telegram) store their primary token under credential/<provider>/<field>
-  // rather than oauth_connection/<id>/access_token, so resolve the correct
-  // path before looking up the token — otherwise the lookup always returns
-  // null and marks these providers as "missing_token".
-  const tokenPath =
-    manualTokenAccessCredentialKey(provider) ??
-    oauthConnectionAccessTokenPath(connectionId);
-  const token = await getSecureKeyAsync(tokenPath);
-  if (!token) {
+  // 1. Check token presence via the centralized resolver. Manual-token
+  // providers (e.g. slack_channel, telegram) store their primary token at
+  // credential/<provider>/<field> rather than oauth_connection/<id>/access_token;
+  // the resolver handles the mapping automatically.
+  const tokenResult = await getConnectionAccessTokenResult({
+    provider,
+    connectionId,
+  });
+  if (!tokenResult.value) {
+    if (tokenResult.unreachable) {
+      return {
+        ...base,
+        status: "unreachable",
+        details: `Credential backend is temporarily unreachable for ${provider}. Token status unknown.`,
+        canAutoRecover: true,
+      };
+    }
     return {
       ...base,
       status: "missing_token",
@@ -182,6 +186,7 @@ async function checkConnection(
       canAutoRecover: false,
     };
   }
+  const token = tokenResult.value;
 
   // 2. Check token expiry
   if (isTokenExpired(expiresAt)) {