@vellumai/assistant 0.7.1 → 0.7.3

package/src/config/schemas/services.ts

@@ -4,7 +4,7 @@ import { SttServiceSchema } from "./stt.js";
 import { TtsServiceSchema } from "./tts.js";
 
 const ServiceModeSchema = z.enum(["managed", "your-own"]);
-export type ServiceMode = z.infer<typeof ServiceModeSchema>;
+type ServiceMode = z.infer<typeof ServiceModeSchema>;
 
 export const VALID_INFERENCE_PROVIDERS = [
   "anthropic",
@@ -26,7 +26,6 @@ const VALID_WEB_SEARCH_PROVIDERS = [
 const BaseServiceSchema = z.object({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type BaseService = z.infer<typeof BaseServiceSchema>;
 
 /**
  * Inference service entry. Carries only the routing `mode`
@@ -37,52 +36,57 @@ export type BaseService = z.infer<typeof BaseServiceSchema>;
  * workspace migration `039-drop-legacy-llm-keys`.
  */
 const InferenceServiceSchema = BaseServiceSchema;
-export type InferenceService = z.infer<typeof InferenceServiceSchema>;
 
 const ImageGenerationServiceSchema = BaseServiceSchema.extend({
   provider: z.enum(VALID_IMAGE_GEN_PROVIDERS).default("gemini"),
   model: z.string().default("gemini-3.1-flash-image-preview"),
 });
-export type ImageGenerationService = z.infer<
-  typeof ImageGenerationServiceSchema
->;
 
 const WebSearchServiceSchema = BaseServiceSchema.extend({
   provider: z
     .enum(VALID_WEB_SEARCH_PROVIDERS)
     .default("inference-provider-native"),
 });
-export type WebSearchService = z.infer<typeof WebSearchServiceSchema>;
 
 const GoogleOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type GoogleOAuthService = z.infer<typeof GoogleOAuthServiceSchema>;
 
 const OutlookOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type OutlookOAuthService = z.infer<typeof OutlookOAuthServiceSchema>;
 
 const LinearOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type LinearOAuthService = z.infer<typeof LinearOAuthServiceSchema>;
 
 const GitHubOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type GitHubOAuthService = z.infer<typeof GitHubOAuthServiceSchema>;
 
 const NotionOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type NotionOAuthService = z.infer<typeof NotionOAuthServiceSchema>;
 
 const TwitterOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
-export type TwitterOAuthService = z.infer<typeof TwitterOAuthServiceSchema>;
+
+const AsanaOAuthServiceSchema = BaseServiceSchema.extend({
+  mode: ServiceModeSchema.default("your-own"),
+});
+
+const TodoistOAuthServiceSchema = BaseServiceSchema.extend({
+  mode: ServiceModeSchema.default("your-own"),
+});
+
+const DiscordOAuthServiceSchema = BaseServiceSchema.extend({
+  mode: ServiceModeSchema.default("your-own"),
+});
+
+const HubspotOAuthServiceSchema = BaseServiceSchema.extend({
+  mode: ServiceModeSchema.default("your-own"),
+});
 
 /**
  * `services.meet.host.*` — daemon-side knobs for the externalized meet-join
@@ -106,7 +110,6 @@ const MeetHostConfigSchema = z
       ),
   })
   .describe("Daemon-side configuration for the external meet-join skill host");
-export type MeetHostConfig = z.infer<typeof MeetHostConfigSchema>;
 
 /**
  * Daemon-side `services.meet` block. Intentionally distinct from the
@@ -120,7 +123,6 @@ const MeetDaemonServiceSchema = z
     host: MeetHostConfigSchema.default(MeetHostConfigSchema.parse({})),
   })
   .describe("meet-join skill daemon-side configuration");
-export type MeetDaemonService = z.infer<typeof MeetDaemonServiceSchema>;
 
 export const ServicesSchema = z.object({
   inference: InferenceServiceSchema.default(InferenceServiceSchema.parse({})),
@@ -154,6 +156,18 @@ export const ServicesSchema = z.object({
   "twitter-oauth": TwitterOAuthServiceSchema.default(
     TwitterOAuthServiceSchema.parse({}),
   ),
+  "asana-oauth": AsanaOAuthServiceSchema.default(
+    AsanaOAuthServiceSchema.parse({}),
+  ),
+  "todoist-oauth": TodoistOAuthServiceSchema.default(
+    TodoistOAuthServiceSchema.parse({}),
+  ),
+  "discord-oauth": DiscordOAuthServiceSchema.default(
+    DiscordOAuthServiceSchema.parse({}),
+  ),
+  "hubspot-oauth": HubspotOAuthServiceSchema.default(
+    HubspotOAuthServiceSchema.parse({}),
+  ),
   meet: MeetDaemonServiceSchema.default(MeetDaemonServiceSchema.parse({})),
 });
 export type Services = z.infer<typeof ServicesSchema>;

package/src/config/schemas/skills.ts

@@ -149,9 +149,3 @@ export const SkillsConfigSchema = z
   );
 
 export type SkillEntryConfig = z.infer<typeof SkillEntryConfigSchema>;
-export type SkillsLoadConfig = z.infer<typeof SkillsLoadConfigSchema>;
-export type SkillsInstallConfig = z.infer<typeof SkillsInstallConfigSchema>;
-export type RemoteProviderConfig = z.infer<typeof RemoteProviderConfigSchema>;
-export type RemoteProvidersConfig = z.infer<typeof RemoteProvidersConfigSchema>;
-export type RemotePolicyConfig = z.infer<typeof RemotePolicyConfigSchema>;
-export type SkillsConfig = z.infer<typeof SkillsConfigSchema>;

package/src/config/seed-inference-profiles.ts

@@ -1,3 +1,6 @@
+import { PROVIDER_CATALOG } from "../providers/model-catalog.js";
+import { resolveModelIntent } from "../providers/model-intents.js";
+import type { ModelIntent } from "../providers/types.js";
 import { loadRawConfig, saveRawConfig } from "./loader.js";
 import {
   DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
@@ -5,41 +8,82 @@ import {
 } from "./schemas/llm.js";
 
 /**
- * Declarative seed data for daemon-managed inference profiles.
- *
- * These profiles are overwritten on every startup so upstream model
- * updates propagate automatically. User-created profiles (keyed by
- * different names) are never touched.
+ * Template for a daemon-managed inference profile. The profile's model is
+ * resolved at seed time from `PROVIDER_MODEL_INTENTS` so the catalog stays the
+ * single source of truth for "which model does this intent map to?".
  */
-export const MANAGED_PROFILE_SEED_DATA: Record<string, ProfileEntry> = {
+type ManagedProfileTemplate = Omit<ProfileEntry, "provider" | "model"> & {
+  intent: ModelIntent;
+};
+
+/**
+ * Anthropic-managed profiles. Always seeded so users can target Anthropic via
+ * their own key, even when the resolved default provider is something else.
+ */
+const ANTHROPIC_PROFILE_TEMPLATES: Record<string, ManagedProfileTemplate> = {
   balanced: {
+    intent: "balanced",
     source: "managed",
     label: "Balanced",
     description: "Good balance of quality, cost, and speed",
-    provider: "anthropic",
-    model: "claude-sonnet-4-6",
     maxTokens: 16000,
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
   "quality-optimized": {
+    intent: "quality-optimized",
     source: "managed",
     label: "Quality",
     description: "Best results with the most capable model",
-    provider: "anthropic",
-    model: "claude-opus-4-7",
     maxTokens: 32000,
     effort: "max",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
   "cost-optimized": {
+    intent: "latency-optimized",
     source: "managed",
     label: "Speed",
     description: "Fastest responses at lower cost",
-    provider: "anthropic",
-    model: "claude-haiku-4-5-20251001",
+    maxTokens: 8192,
+    effort: "low",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+};
+
+/**
+ * Custom-provider profile templates. Materialized at seed time when the
+ * resolved default provider is non-Anthropic, using `resolveModelIntent` to
+ * pick the model.
+ */
+const CUSTOM_PROFILE_TEMPLATES: Record<string, ManagedProfileTemplate> = {
+  "custom-balanced": {
+    intent: "balanced",
+    source: "user",
+    label: "Balanced (Custom Provider)",
+    description: "Good balance of quality, cost, and speed",
+    maxTokens: 16000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "custom-quality-optimized": {
+    intent: "quality-optimized",
+    source: "user",
+    label: "Quality (Custom Provider)",
+    description: "Best results with the most capable model",
+    maxTokens: 32000,
+    effort: "max",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "custom-cost-optimized": {
+    intent: "latency-optimized",
+    source: "user",
+    label: "Speed (Custom Provider)",
+    description: "Fastest responses at lower cost",
     maxTokens: 8192,
     effort: "low",
     thinking: { enabled: false, streamThinking: false },
@@ -48,26 +92,47 @@ export const MANAGED_PROFILE_SEED_DATA: Record<string, ProfileEntry> = {
 };
 
 export const MANAGED_PROFILE_NAMES = new Set(
-  Object.keys(MANAGED_PROFILE_SEED_DATA),
+  Object.keys(ANTHROPIC_PROFILE_TEMPLATES),
 );
 
+const SEEDED_PROFILE_NAMES = new Set([
+  ...Object.keys(ANTHROPIC_PROFILE_TEMPLATES),
+  ...Object.keys(CUSTOM_PROFILE_TEMPLATES),
+]);
+
+const KNOWN_PROVIDERS = new Set(PROVIDER_CATALOG.map((entry) => entry.id));
+
+export type SeedInferenceProfilesOptions = {
+  /**
+   * Managed profile names supplied by the platform/default overlay for this
+   * startup. Those entries are already on disk by the time seeding runs and
+   * should remain authoritative for this boot.
+   */
+  preserveProfileNames?: Iterable<string>;
+  preserveActiveProfile?: boolean;
+};
+
 /**
  * Seed managed inference profiles into the workspace config.
  *
- * Called on every daemon startup after workspace migrations and before
- * the first `loadConfig()`. Managed profiles are overwritten entirely
- * (replace, not merge) so upstream model/effort changes propagate.
- * User-created profiles are never touched; pre-existing profiles
- * without a `source` field get `source: "user"` backfilled.
+ * Called on every daemon startup after workspace migrations and default-config
+ * overlay merge, but before the first `loadConfig()`. The 3 Anthropic-managed
+ * profiles (`balanced`, `quality-optimized`, `cost-optimized`) are always
+ * written so users can target Anthropic via their own key. When the resolved
+ * default provider is non-Anthropic, the 3 `custom-*` profiles are also
+ * materialized using `resolveModelIntent` against that provider, and
+ * `custom-balanced` becomes the active profile for fresh hatches.
  *
- * No-op when `VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH` is set (same guard
- * as migration 052) because the platform-provided default-config overlay
- * is the authoritative source for profile seeds.
+ * Default-config overlays can provide their own profile fragments and active
+ * profile. Lifecycle passes those explicit fields in `options`, letting local
+ * hatches still receive managed defaults while platform-owned profile choices
+ * remain authoritative.
  */
-export function seedInferenceProfiles(): void {
-  if (process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH) return;
-
+export function seedInferenceProfiles(
+  options: SeedInferenceProfilesOptions = {},
+): void {
   const config = loadRawConfig();
+  const preservedProfileNames = new Set(options.preserveProfileNames ?? []);
 
   if (config.llm == null || typeof config.llm !== "object") {
     config.llm = {};
@@ -79,25 +144,135 @@ export function seedInferenceProfiles(): void {
   }
   const profiles = llm.profiles as Record<string, Record<string, unknown>>;
 
-  for (const [name, seed] of Object.entries(MANAGED_PROFILE_SEED_DATA)) {
-    profiles[name] = { ...seed };
+  const requestedProvider =
+    readString(readObject(llm.default)?.provider) ?? "anthropic";
+  const isKnownProvider = KNOWN_PROVIDERS.has(requestedProvider);
+  const resolvedProvider: NonNullable<ProfileEntry["provider"]> =
+    isKnownProvider
+      ? (requestedProvider as NonNullable<ProfileEntry["provider"]>)
+      : "anthropic";
+  const isAnthropicDefault = resolvedProvider === "anthropic";
+
+  // Persist the resolved provider when the overlay supplied an unrecognized
+  // value, so the on-disk config doesn't keep emitting Zod warnings for
+  // `unknownprov` on every load.
+  if (!isKnownProvider) {
+    const defaultBlock = (readObject(llm.default) ?? {}) as Record<
+      string,
+      unknown
+    >;
+    defaultBlock.provider = resolvedProvider;
+    llm.default = defaultBlock;
+  }
+
+  for (const [name, template] of Object.entries(ANTHROPIC_PROFILE_TEMPLATES)) {
+    if (preservedProfileNames.has(name)) continue;
+    // Preserve a previously overlay-supplied profile whose provider matches
+    // the resolved default — that's the platform-managed case where the
+    // overlay file has already been consumed and archived. Only valid for
+    // non-Anthropic resolutions; when the default is Anthropic the daemon
+    // owns these names and re-seeds with Anthropic data so a stale openai
+    // `balanced` doesn't keep routing through the wrong provider after a
+    // re-hatch back to Anthropic.
+    const existing = readObject(profiles[name]);
+    const existingProvider = readString(existing?.provider);
+    if (
+      existing !== null &&
+      !isAnthropicDefault &&
+      existingProvider === resolvedProvider
+    ) {
+      continue;
+    }
+    profiles[name] = materializeProfile(template, "anthropic");
+  }
+
+  if (!isAnthropicDefault) {
+    for (const [name, template] of Object.entries(CUSTOM_PROFILE_TEMPLATES)) {
+      if (preservedProfileNames.has(name)) continue;
+      if (readObject(profiles[name]) !== null) continue;
+      profiles[name] = materializeProfile(template, resolvedProvider);
+    }
+  }
+
+  const requestedActiveProfile = readString(llm.activeProfile);
+  const requestedActiveEntry =
+    requestedActiveProfile !== undefined
+      ? readObject(profiles[requestedActiveProfile])
+      : null;
+  const requestedActiveExists = requestedActiveEntry !== null;
+  const shouldPreserveActiveProfile =
+    options.preserveActiveProfile === true && requestedActiveExists;
+
+  // Decide whether the existing active profile is still appropriate. A managed
+  // profile whose provider no longer matches the resolved default goes stale
+  // (e.g. re-hatching anthropic→openai leaves `balanced` pointing at anthropic;
+  // re-hatching openai→anthropic leaves `custom-balanced` pointing at openai).
+  // Either direction should land the user on the new default's `balanced`
+  // counterpart rather than routing the main agent to a stale provider.
+  // User-created profiles are left alone — those are the user's choice.
+  let keepActiveProfile = shouldPreserveActiveProfile;
+  if (!keepActiveProfile && requestedActiveExists) {
+    const isSeededName = SEEDED_PROFILE_NAMES.has(requestedActiveProfile!);
+    const activeProvider = readString(requestedActiveEntry?.provider);
+    const managedActiveProviderMismatch =
+      isSeededName && activeProvider !== resolvedProvider;
+    keepActiveProfile = !managedActiveProviderMismatch;
   }
 
-  // Reset to the default managed profile when the current value is missing.
-  if (
-    typeof llm.activeProfile !== "string" ||
-    !(llm.activeProfile in profiles)
-  ) {
-    llm.activeProfile = "balanced";
+  let activeProfileName: string;
+  if (keepActiveProfile) {
+    activeProfileName = requestedActiveProfile!;
+  } else {
+    activeProfileName = isAnthropicDefault ? "balanced" : "custom-balanced";
+    llm.activeProfile = activeProfileName;
+  }
+
+  // Sync `llm.default.model` to the active profile's model so the providers
+  // registry sees a coherent provider/model pair. Only writes when the on-disk
+  // default model is missing or unambiguously belongs to a *different*
+  // provider's catalog (e.g. `claude-opus-4-7` paired with `provider: openai`).
+  // A user-supplied model not listed in any provider's catalog is preserved —
+  // ollama and openrouter expose far more models than `PROVIDER_CATALOG` lists,
+  // and silently overwriting `codellama`/`phi3`/etc. on every restart would
+  // break those users' configs. Skipped when the overlay owns the active
+  // profile (platform mode).
+  if (!shouldPreserveActiveProfile) {
+    const activeEntry = readObject(profiles[activeProfileName]);
+    const activeModel = readString(activeEntry?.model);
+    if (activeModel !== undefined) {
+      const defaultBlock = (readObject(llm.default) ?? {}) as Record<
+        string,
+        unknown
+      >;
+      const currentModel = readString(defaultBlock.model);
+      const modelBelongsToOtherProvider =
+        currentModel !== undefined &&
+        PROVIDER_CATALOG.some(
+          (p) =>
+            p.id !== resolvedProvider &&
+            p.models.some((m) => m.id === currentModel),
+        );
+      const shouldOverwriteDefaultModel =
+        currentModel === undefined || modelBelongsToOtherProvider;
+      if (shouldOverwriteDefaultModel) {
+        defaultBlock.model = activeModel;
+        llm.default = defaultBlock;
+      }
+    }
   }
 
   const profileOrder = Array.isArray(llm.profileOrder)
     ? (llm.profileOrder as string[])
     : [];
   const orderSet = new Set(profileOrder);
-  for (const name of MANAGED_PROFILE_NAMES) {
+  const seededOrder = [
+    ...Object.keys(ANTHROPIC_PROFILE_TEMPLATES),
+    ...(isAnthropicDefault ? [] : Object.keys(CUSTOM_PROFILE_TEMPLATES)),
+  ];
+  for (const name of seededOrder) {
     if (!orderSet.has(name)) {
       profileOrder.push(name);
+      orderSet.add(name);
     }
   }
   llm.profileOrder = profileOrder;
@@ -115,3 +290,25 @@ export function seedInferenceProfiles(): void {
 
   saveRawConfig(config);
 }
+
+function materializeProfile(
+  template: ManagedProfileTemplate,
+  provider: NonNullable<ProfileEntry["provider"]>,
+): ProfileEntry {
+  const { intent, ...rest } = template;
+  return {
+    ...rest,
+    provider,
+    model: resolveModelIntent(provider, intent),
+  };
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}

package/src/contacts/contact-store.ts

@@ -704,31 +704,6 @@ export function mergeContacts(
   return getContactInternal(keepId)!;
 }
 
-/**
- * Delete a contact by ID. Guardians cannot be deleted as a safety guard.
- * Associated contactChannels and assistantContactMetadata rows are
- * cascade-deleted by the DB schema's onDelete constraints.
- */
-export function deleteContact(
-  contactId: string,
-): "ok" | "not_found" | "is_guardian" {
-  const db = getDb();
-
-  const contact = db
-    .select()
-    .from(contacts)
-    .where(eq(contacts.id, contactId))
-    .get();
-
-  if (!contact) return "not_found";
-  if (contact.role === "guardian") return "is_guardian";
-
-  db.delete(contacts).where(eq(contacts.id, contactId)).run();
-
-  emitContactChange();
-  return "ok";
-}
-
 /**
  * Find a contact by a specific channel address. Returns null if not found.
  */
@@ -961,19 +936,6 @@ export function updateChannelStatus(
   return parseChannel(existing);
 }
 
-/**
- * Update the lastSeenAt timestamp on a contact channel by its primary key.
- * Optimized for the hot path — single UPDATE with no prior SELECT.
- */
-export function updateChannelLastSeenById(channelId: string): void {
-  const db = getDb();
-  const now = Date.now();
-  db.update(contactChannels)
-    .set({ lastSeenAt: now, updatedAt: now })
-    .where(eq(contactChannels.id, channelId))
-    .run();
-}
-
 /**
  * Update a guardian contact's principalId and its channel's identity fields.
  * Used for healing guardian binding drift when the JWT principal no longer
@@ -1037,23 +999,6 @@ export function updateContactPrincipalAndChannel(
   return true;
 }
 
-/**
- * Atomically increment interactionCount and set lastInteraction on a contact channel.
- * Optimized for the hot path — single UPDATE with no prior SELECT.
- */
-export function updateChannelInteraction(channelId: string): void {
-  const db = getDb();
-  const now = Date.now();
-  db.update(contactChannels)
-    .set({
-      lastInteraction: now,
-      interactionCount: sql`${contactChannels.interactionCount} + 1`,
-      updatedAt: now,
-    })
-    .where(eq(contactChannels.id, channelId))
-    .run();
-}
-
 // ── Assistant Contact Metadata ──────────────────────────────────────
 
 function parseAssistantMetadata(

package/src/contacts/contacts-write.ts

@@ -8,7 +8,6 @@
 
 import type { ChannelId } from "../channels/types.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
-import { getLogger } from "../util/logger.js";
 import { emitContactChange } from "./contact-events.js";
 import {
   findContactChannel,
@@ -16,8 +15,6 @@ import {
   getChannelById,
   getContact,
   getContactInternal,
-  updateChannelInteraction,
-  updateChannelLastSeenById,
   updateChannelStatus,
   upsertContact,
 } from "./contact-store.js";
@@ -28,7 +25,6 @@ import type {
   ContactWriteResult,
 } from "./types.js";
 
-const log = getLogger("contacts-write");
 
 // ── Guardian operations ──────────────────────────────────────────────
 
@@ -179,26 +175,3 @@ export function revokeMember(
   return { contact, channel: updatedChannel };
 }
 
-/**
- * Update the lastSeenAt timestamp on a contact channel by its ID.
- * Expects a plain channel UUID (ContactChannel.id), not the composite API ID.
- */
-export function touchChannelLastSeen(channelId: string): void {
-  try {
-    updateChannelLastSeenById(channelId);
-  } catch (err) {
-    log.warn({ err }, "Failed to update channel lastSeenAt");
-  }
-}
-
-/**
- * Track an interaction on the specific channel that received it.
- * Swallows errors to avoid disrupting the inbound message hot path.
- */
-export function touchContactInteraction(channelId: string): void {
-  try {
-    updateChannelInteraction(channelId);
-  } catch (err) {
-    log.warn({ err }, "Failed to update channel interaction stats");
-  }
-}

package/src/context/window-manager.ts

@@ -22,8 +22,7 @@ import { truncateToolResultsAcrossHistory } from "./tool-result-truncation.js";
 const log = getLogger("context-window");
 
 export const CONTEXT_SUMMARY_MARKER = "<context_summary>";
-export const CONVERSATION_SUMMARY_CALL_SITE: LLMCallSite =
-  "conversationSummarization";
+const CONVERSATION_SUMMARY_CALL_SITE: LLMCallSite = "conversationSummarization";
 const MAX_BLOCK_PREVIEW_CHARS = 3000;
 const MAX_FALLBACK_SUMMARY_CHARS = 12000;
 const COMPACTION_COOLDOWN_MS = 2 * 60 * 1000;

package/src/credential-execution/feature-gates.ts

@@ -28,12 +28,12 @@ export const CES_SECURE_INSTALL_FLAG_KEY = "ces-secure-install" as const;
 /** Gate for credential grant and audit inspection surfaces. */
 export const CES_GRANT_AUDIT_FLAG_KEY = "ces-grant-audit" as const;
 
-/** Gate for managed sidecar transport in containerized environments. */
-export const CES_MANAGED_SIDECAR_FLAG_KEY = "ces-managed-sidecar" as const;
-
 /** Gate for routing credential reads/writes through the CES process. */
 const CES_CREDENTIAL_BACKEND_FLAG_KEY = "ces-credential-backend" as const;
 
+/** Gate for managed sidecar transport in containerized environments. */
+export const CES_MANAGED_SIDECAR_FLAG_KEY = "ces-managed-sidecar" as const;
+
 // ---------------------------------------------------------------------------
 // Public API — predicate functions
 // ---------------------------------------------------------------------------
@@ -66,13 +66,6 @@ export function isCesGrantAuditEnabled(config: AssistantConfig): boolean {
   return isAssistantFeatureFlagEnabled(CES_GRANT_AUDIT_FLAG_KEY, config);
 }
 
-/**
- * Whether managed sidecar transport should be used for CES communication.
- */
-export function isCesManagedSidecarEnabled(config: AssistantConfig): boolean {
-  return isAssistantFeatureFlagEnabled(CES_MANAGED_SIDECAR_FLAG_KEY, config);
-}
-
 /**
  * Whether credential reads and writes should be routed through the CES process.
  */
@@ -81,3 +74,10 @@ export function isCesCredentialBackendEnabled(
 ): boolean {
   return isAssistantFeatureFlagEnabled(CES_CREDENTIAL_BACKEND_FLAG_KEY, config);
 }
+
+/**
+ * Whether managed sidecar transport should be used for CES communication.
+ */
+export function isCesManagedSidecarEnabled(config: AssistantConfig): boolean {
+  return isAssistantFeatureFlagEnabled(CES_MANAGED_SIDECAR_FLAG_KEY, config);
+}