@vellumai/assistant 0.7.1 → 0.7.3

package/src/memory/v2/skill-qdrant.ts

@@ -1,395 +0,0 @@
-// ---------------------------------------------------------------------------
-// Memory v2 — Qdrant collection for skill autoinjection
-// ---------------------------------------------------------------------------
-//
-// Owns a dedicated Qdrant collection, keyed by skill `id`, that holds dense +
-// sparse embeddings of every enabled skill's `buildSkillContent` snippet. The
-// collection is separate from `memory_v2_concept_pages` because skills are
-// stateless (no `everInjected` dedup, no on-disk concept pages, no edges) and
-// re-presented every turn — keeping them in their own collection means skill
-// pruning and reseeding never touches concept-page state.
-//
-// Mirrors the dense + sparse named-vectors layout used by
-// `ensureConceptPageCollection` in `qdrant.ts`. Connection settings — URL,
-// vector size, on-disk storage — flow through the same env → config
-// precedence as v1 via `resolveQdrantUrl` and `config.memory.qdrant.*`.
-//
-// Per-channel queries: `hybridQuerySkills` runs separate dense and sparse
-// queries (no Qdrant-side RRF). Callers do their own weighted-sum fusion using
-// `dense_weight` / `sparse_weight` from `config.memory.v2`, which RRF fusion
-// would discard.
-
-import { QdrantClient as QdrantRestClient } from "@qdrant/js-client-rest";
-import { v5 as uuidv5 } from "uuid";
-
-import { getConfig } from "../../config/loader.js";
-import { getLogger } from "../../util/logger.js";
-import type { SparseEmbedding } from "../embedding-types.js";
-import { resolveQdrantUrl } from "../qdrant-client.js";
-
-const log = getLogger("memory-v2-skill-qdrant");
-
-/** Name of the dedicated Qdrant collection holding skill embeddings. */
-export const MEMORY_V2_SKILLS_COLLECTION = "memory_v2_skills";
-
-/**
- * Stable UUIDv5 namespace used to derive a deterministic Qdrant point ID from
- * a skill id. The namespace is an arbitrary fixed UUID; what matters is that
- * the same id always maps to the same point ID so upserts replace in place
- * instead of accumulating duplicates. Distinct from `qdrant.ts`'s
- * `SLUG_NAMESPACE` so a skill id that happens to collide with a concept-page
- * slug still maps to a different point ID across the two collections.
- */
-export const SKILL_NAMESPACE = "f1903e7f-1b9d-4c15-ac46-3540b8b0a9f6";
-
-/**
- * Per-channel score for a single skill hit returned by hybrid query.
- * Module-private — `sim.ts` consumes the fields by duck-typing rather than
- * naming the type, so there is no benefit to exporting it.
- */
-interface SkillQueryResult {
-  id: string;
-  /**
-   * Dense cosine similarity, when the id appeared in the dense top-`limit`.
-   * `undefined` if the id only appeared in the sparse channel.
-   */
-  denseScore?: number;
-  /**
-   * Sparse score, when the id appeared in the sparse top-`limit`.
-   * `undefined` if the id only appeared in the dense channel. Lives on a
-   * different scale than `denseScore` — callers must normalize before fusing.
-   */
-  sparseScore?: number;
-}
-
-let _client: QdrantRestClient | null = null;
-let _collectionReady = false;
-
-/** Lazily create a Qdrant REST client bound to the resolved URL. */
-function getClient(): QdrantRestClient {
-  if (_client) return _client;
-  const config = getConfig();
-  _client = new QdrantRestClient({
-    url: resolveQdrantUrl(config),
-    checkCompatibility: false,
-  });
-  return _client;
-}
-
-/**
- * Create the v2 skills collection if it does not already exist.
- * Idempotent: a no-op when the collection is already present.
- *
- * Vector layout mirrors `ensureConceptPageCollection` — named dense (cosine,
- * configurable size + on-disk) and sparse vectors. The vector size and
- * on-disk flag inherit from `config.memory.qdrant` so v2 stays aligned with
- * the user's existing embedding backend without separate knobs.
- */
-export async function ensureSkillCollection(): Promise<void> {
-  if (_collectionReady) return;
-
-  const client = getClient();
-  const config = getConfig();
-  const vectorSize = config.memory.qdrant.vectorSize;
-  const onDisk = config.memory.qdrant.onDisk;
-
-  try {
-    const exists = await client.collectionExists(MEMORY_V2_SKILLS_COLLECTION);
-    if (exists.exists) {
-      _collectionReady = true;
-      return;
-    }
-  } catch (err) {
-    // Treat "not found"-shaped errors as "needs creation" and fall through.
-    if (!isCollectionMissing(err)) throw err;
-  }
-
-  log.info(
-    { collection: MEMORY_V2_SKILLS_COLLECTION, vectorSize },
-    "Creating Qdrant collection for memory v2 skills",
-  );
-
-  try {
-    await client.createCollection(MEMORY_V2_SKILLS_COLLECTION, {
-      vectors: {
-        dense: {
-          size: vectorSize,
-          distance: "Cosine",
-          on_disk: onDisk,
-        },
-      },
-      sparse_vectors: {
-        sparse: {}, // Qdrant auto-infers sparse vector params
-      },
-      hnsw_config: {
-        on_disk: onDisk,
-        m: 16,
-        ef_construct: 100,
-      },
-      on_disk_payload: onDisk,
-    });
-  } catch (err) {
-    // 409 = a concurrent caller created the collection — that's fine.
-    if (
-      err instanceof Error &&
-      "status" in err &&
-      (err as { status: number }).status === 409
-    ) {
-      _collectionReady = true;
-      return;
-    }
-    throw err;
-  }
-
-  // Eagerly index `id` so future per-id filters (e.g. inspecting a single
-  // skill's stored payload) don't pay a one-time indexing cost. Mirrors the
-  // up-front `slug` index in `ensureConceptPageCollection`.
-  await client.createPayloadIndex(MEMORY_V2_SKILLS_COLLECTION, {
-    field_name: "id",
-    field_schema: "keyword",
-  });
-
-  _collectionReady = true;
-}
-
-/**
- * Upsert a skill's dense + sparse embedding. The point ID is derived
- * deterministically from the skill id so subsequent calls for the same id
- * replace the prior point in place rather than accumulating duplicates.
- */
-export async function upsertSkillEmbedding(params: {
-  id: string;
-  content: string;
-  dense: number[];
-  sparse: SparseEmbedding;
-  updatedAt: number;
-}): Promise<void> {
-  await ensureSkillCollection();
-
-  const { id, content, dense, sparse, updatedAt } = params;
-  const client = getClient();
-  const pointId = pointIdForId(id);
-
-  const upsertOnce = () =>
-    client.upsert(MEMORY_V2_SKILLS_COLLECTION, {
-      wait: true,
-      points: [
-        {
-          id: pointId,
-          vector: { dense, sparse },
-          payload: {
-            id,
-            content,
-            updated_at: updatedAt,
-          },
-        },
-      ],
-    });
-
-  try {
-    await upsertOnce();
-  } catch (err) {
-    if (isCollectionMissing(err)) {
-      _collectionReady = false;
-      await ensureSkillCollection();
-      await upsertOnce();
-      return;
-    }
-    throw err;
-  }
-}
-
-/**
- * Remove every skill point whose `payload.id` is not in `activeIds`. Used by
- * `seedV2SkillEntries` to drop stale points after a skill is uninstalled or
- * disabled. Idempotent: when the live points already equal `activeIds`,
- * the function performs a single scroll and no deletes.
- *
- * Implementation: paginate the collection with the Qdrant `scroll` API
- * (payload-only, no vectors) and delete by point ID for any payload whose
- * `id` is missing from the active set.
- */
-export async function pruneSkillsExcept(
-  activeIds: readonly string[],
-): Promise<void> {
-  await ensureSkillCollection();
-
-  const client = getClient();
-  const activeSet = new Set(activeIds);
-
-  const doPrune = async (): Promise<void> => {
-    const stalePointIds: Array<string | number> = [];
-    let offset: string | number | undefined = undefined;
-    // Guard against a pathological pagination loop.
-    const maxIterations = 10_000;
-    const batchSize = 256;
-    for (let i = 0; i < maxIterations; i++) {
-      const result = await client.scroll(MEMORY_V2_SKILLS_COLLECTION, {
-        limit: batchSize,
-        with_payload: true,
-        with_vector: false,
-        ...(offset !== undefined ? { offset } : {}),
-      });
-      for (const point of result.points) {
-        const payloadId = (point.payload as { id?: unknown } | null)?.id;
-        if (typeof payloadId !== "string") continue;
-        if (!activeSet.has(payloadId)) {
-          stalePointIds.push(point.id);
-        }
-      }
-      const next = result.next_page_offset;
-      if (next == null) break;
-      offset = typeof next === "string" ? next : (next as number);
-    }
-
-    if (stalePointIds.length === 0) return;
-
-    await client.delete(MEMORY_V2_SKILLS_COLLECTION, {
-      wait: true,
-      points: stalePointIds,
-    });
-  };
-
-  try {
-    await doPrune();
-  } catch (err) {
-    if (isCollectionMissing(err)) {
-      _collectionReady = false;
-      await ensureSkillCollection();
-      await doPrune();
-      return;
-    }
-    throw err;
-  }
-}
-
-/**
- * Run separate dense and sparse queries against the skills collection and
- * return per-channel scores per skill id. Callers fuse these — typically via
- * a normalized weighted-sum — because RRF would discard the score magnitudes
- * the activation formula needs.
- *
- * Each channel returns up to `limit` hits. A skill is included in the result
- * if it appears in either channel; the missing channel's score is left
- * `undefined` so callers can detect single-channel matches.
- *
- * `restrictToIds`, when provided, filters the search server-side to only
- * those ids (Qdrant `id IN [...]` filter). Used by `simSkillBatch` when the
- * candidate set is already known so the activation scorer gets scores for
- * exactly those ids rather than Qdrant's global top-`limit`. An empty list
- * short-circuits to no results — the caller is asking for "nothing", not
- * "everything". Undefined queries the full collection (used by
- * `selectSkillCandidates` to discover candidates from the global top-K).
- */
-export async function hybridQuerySkills(
-  dense: number[],
-  sparse: SparseEmbedding,
-  limit: number,
-  restrictToIds?: readonly string[],
-): Promise<SkillQueryResult[]> {
-  if (restrictToIds && restrictToIds.length === 0) {
-    // An empty restriction means "no candidates"; skip the round-trip.
-    return [];
-  }
-
-  await ensureSkillCollection();
-
-  const client = getClient();
-  const filter = restrictToIds
-    ? { must: [{ key: "id", match: { any: [...restrictToIds] } }] }
-    : undefined;
-
-  const denseQuery = () =>
-    client.query(MEMORY_V2_SKILLS_COLLECTION, {
-      query: dense,
-      using: "dense",
-      limit,
-      with_payload: true,
-      filter,
-    });
-  const sparseQuery = () =>
-    client.query(MEMORY_V2_SKILLS_COLLECTION, {
-      query: sparse,
-      using: "sparse",
-      limit,
-      with_payload: true,
-      filter,
-    });
-
-  // Run both queries concurrently — they hit independent named vectors.
-  const runQueries = async () => Promise.all([denseQuery(), sparseQuery()]);
-
-  let denseResults;
-  let sparseResults;
-  try {
-    [denseResults, sparseResults] = await runQueries();
-  } catch (err) {
-    if (isCollectionMissing(err)) {
-      _collectionReady = false;
-      await ensureSkillCollection();
-      [denseResults, sparseResults] = await runQueries();
-    } else {
-      throw err;
-    }
-  }
-
-  // Merge by id. Missing-side scores stay undefined so the fuser can tell
-  // "no match in this channel" apart from "match with score 0".
-  const merged = new Map<string, SkillQueryResult>();
-  for (const point of denseResults.points ?? []) {
-    const id = (point.payload as { id?: unknown } | null)?.id;
-    if (typeof id !== "string") continue;
-    merged.set(id, { id, denseScore: point.score ?? 0 });
-  }
-  for (const point of sparseResults.points ?? []) {
-    const id = (point.payload as { id?: unknown } | null)?.id;
-    if (typeof id !== "string") continue;
-    const existing = merged.get(id);
-    if (existing) {
-      existing.sparseScore = point.score ?? 0;
-    } else {
-      merged.set(id, { id, sparseScore: point.score ?? 0 });
-    }
-  }
-
-  return Array.from(merged.values());
-}
-
-/**
- * Detect "collection not found" errors so callers can reset readiness and
- * retry after an external deletion (e.g. workspace reset). Re-implemented
- * locally rather than imported from `qdrant.ts` to keep this module
- * self-contained — the helper is small and the duplication is cleaner than
- * exporting an internal detail across files.
- */
-function isCollectionMissing(err: unknown): boolean {
-  if (
-    err &&
-    typeof err === "object" &&
-    "status" in err &&
-    (err as { status: number }).status === 404
-  ) {
-    return true;
-  }
-  const msg = err instanceof Error ? err.message : String(err);
-  return (
-    msg.includes("Not found") ||
-    msg.includes("doesn't exist") ||
-    msg.includes("not found")
-  );
-}
-
-/**
- * Derive the deterministic Qdrant point ID for a skill id. Qdrant requires
- * UUID/integer IDs; UUIDv5 keeps the mapping stable across processes so
- * upserts replace in place.
- */
-function pointIdForId(id: string): string {
-  return uuidv5(id, SKILL_NAMESPACE);
-}
-
-/** @internal Test-only: reset module-level singletons. */
-export function _resetMemoryV2SkillQdrantForTests(): void {
-  _client = null;
-  _collectionReady = false;
-}

package/src/outbound-proxy/config.ts

@@ -1,20 +0,0 @@
-/**
- * Configuration for the standalone proxy sidecar server.
- *
- * All values are sourced from environment variables with sensible defaults.
- * Invalid values cause the process to exit with a descriptive error so
- * misconfigurations are caught immediately at startup.
- */
-
-export interface SidecarConfig {
-  /** Port the proxy server listens on. */
-  port: number;
-  /** Host address to bind to. */
-  host: string;
-  /** Port for the health/readiness HTTP server. */
-  healthPort: number;
-  /** Optional CA directory for MITM interception (contains ca.pem / ca-key.pem). */
-  caDir: string | null;
-  /** Log level for the sidecar process. */
-  logLevel: "debug" | "info" | "warn" | "error";
-}

package/src/outbound-proxy/health.ts

@@ -1,18 +0,0 @@
-/**
- * Health / readiness HTTP server for the proxy sidecar.
- *
- * Exposes two endpoints on a separate control port:
- *   GET /healthz  - Liveness probe. Returns 200 whenever the process is alive.
- *   GET /readyz   - Readiness probe. Returns 200 only when the proxy server
- *                   is listening and ready to accept connections.
- *
- * All other paths return 404. Non-GET methods return 405.
- */
-
-export interface HealthServerOptions {
-  /**
-   * Callback that returns `true` when the proxy server is ready to accept
-   * connections. The readiness probe delegates to this function.
-   */
-  isReady: () => boolean;
-}

package/src/outbound-proxy/types.ts

@@ -1,150 +0,0 @@
-/** How a credential value is injected into an outbound proxied request. */
-export type CredentialInjectionType = "header" | "query";
-
-/**
- * Describes where and how to inject a credential into proxied requests
- * matching a specific host pattern.
- */
-export interface CredentialInjectionTemplate {
-  /** Glob pattern for matching request hosts (e.g. "*.fal.ai"). */
-  hostPattern: string;
-  /** Where the credential value is injected. */
-  injectionType: CredentialInjectionType;
-  /** Header name when injectionType is 'header' (e.g. "Authorization"). */
-  headerName?: string;
-  /** Prefix prepended to the secret value (e.g. "Key ", "Bearer "). */
-  valuePrefix?: string;
-  /** Query parameter name when injectionType is 'query'. */
-  queryParamName?: string;
-}
-
-/** Unique identifier for a proxy session. */
-export type ProxySessionId = string;
-
-export type ProxySessionStatus = "starting" | "active" | "stopping" | "stopped";
-
-export interface ProxySession {
-  id: ProxySessionId;
-  conversationId: string;
-  credentialIds: string[];
-  status: ProxySessionStatus;
-  createdAt: Date;
-  /** Ephemeral port assigned once the session starts listening. */
-  port: number | null;
-}
-
-export interface ProxySessionConfig {
-  /** How long (ms) an idle session stays alive before auto-stopping. */
-  idleTimeoutMs: number;
-  /** Maximum concurrent sessions per conversation. */
-  maxSessionsPerConversation: number;
-}
-
-export interface ProxyEnvVars {
-  HTTP_PROXY: string;
-  HTTPS_PROXY: string;
-  NO_PROXY: string;
-  NODE_EXTRA_CA_CERTS?: string;
-  /** Combined CA bundle (system roots + proxy CA) for non-Node TLS clients (curl, Python, etc.). */
-  SSL_CERT_FILE?: string;
-}
-
-// ---------------------------------------------------------------------------
-// Policy engine types
-// ---------------------------------------------------------------------------
-
-/** A single credential matched -- inject it. */
-export interface PolicyDecisionMatched {
-  kind: "matched";
-  credentialId: string;
-  template: CredentialInjectionTemplate;
-}
-
-/** Multiple credentials match -- caller must disambiguate. */
-export interface PolicyDecisionAmbiguous {
-  kind: "ambiguous";
-  candidates: Array<{
-    credentialId: string;
-    template: CredentialInjectionTemplate;
-  }>;
-}
-
-/** No credential matches the target host/path. */
-export interface PolicyDecisionMissing {
-  kind: "missing";
-}
-
-/** No credential_ids were requested -- pass-through. */
-export interface PolicyDecisionUnauthenticated {
-  kind: "unauthenticated";
-}
-
-// ---------------------------------------------------------------------------
-// Approval hook outcomes -- structured data for triggering permission prompts.
-// ---------------------------------------------------------------------------
-
-/** Context about the outbound request target, used to build permission prompts. */
-export interface RequestTargetContext {
-  hostname: string;
-  port: number | null;
-  path: string;
-  /** The protocol scheme of the original request ('http' or 'https'). */
-  scheme: "http" | "https";
-}
-
-/**
- * The target host matches a known credential template pattern, but the
- * session has no credential bound for it. The UI should prompt the user
- * to bind or create a credential.
- */
-export interface PolicyDecisionAskMissingCredential {
-  kind: "ask_missing_credential";
-  target: RequestTargetContext;
-  /** Host patterns from the known registry that matched the target. */
-  matchingPatterns: string[];
-}
-
-/**
- * The request doesn't match any known credential template and the session
- * has no credentials. The UI should prompt the user to allow or deny the
- * unauthenticated request.
- */
-export interface PolicyDecisionAskUnauthenticated {
-  kind: "ask_unauthenticated";
-  target: RequestTargetContext;
-}
-
-export type PolicyDecision =
-  | PolicyDecisionMatched
-  | PolicyDecisionAmbiguous
-  | PolicyDecisionMissing
-  | PolicyDecisionUnauthenticated
-  | PolicyDecisionAskMissingCredential
-  | PolicyDecisionAskUnauthenticated;
-
-// ---------------------------------------------------------------------------
-// Proxy approval callback -- wires policy "ask" decisions to the UI prompter.
-// ---------------------------------------------------------------------------
-
-/**
- * Payload passed to the approval callback when the policy engine emits an
- * `ask_missing_credential` or `ask_unauthenticated` decision. Contains
- * enough context for the prompter to build a meaningful confirmation dialog.
- */
-export interface ProxyApprovalRequest {
-  /** The policy decision that triggered the approval prompt. */
-  decision:
-    | PolicyDecisionAskMissingCredential
-    | PolicyDecisionAskUnauthenticated;
-  /** The proxy session ID that originated the request. */
-  sessionId: ProxySessionId;
-}
-
-/**
- * Callback signature for proxy approval prompts. The proxy service calls
- * this when an outbound request requires user confirmation. Returns `true`
- * if the user approves, `false` if denied.
- */
-export type ProxyApprovalCallback = (
-  request: ProxyApprovalRequest,
-) => Promise<boolean>;