@vellumai/assistant 0.7.2 → 0.7.3

package/src/backup/snapshot-lock.ts

@@ -32,10 +32,10 @@ import {
   writeSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-import { kill } from "node:process";
 import { setTimeout as sleep } from "node:timers/promises";
 
 import { getLogger } from "../util/logger.js";
+import { isProcessAlive } from "../util/process-liveness.js";
 import { getLocalBackupsDir } from "./paths.js";
 
 const log = getLogger("snapshot-lock");
@@ -88,29 +88,6 @@ export function getSnapshotLockPath(): string {
   return join(dirname(getLocalBackupsDir()), ".snapshot.lock");
 }
 
-/**
- * Check whether a PID refers to a live process. Uses `kill(pid, 0)`, which
- * does not send any signal — it just probes for existence and permission.
- *
- * Returns `false` for obviously invalid PIDs (<= 0) and for any error that
- * indicates the process is gone. Returns `true` for ESRCH-negative results
- * (meaning a process exists) and for EPERM (process exists but is owned by
- * another user — still a live process, still should not be taken over).
- */
-function isProcessAlive(pid: number): boolean {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = (err as NodeJS.ErrnoException).code;
-    // EPERM means the PID exists but we cannot signal it — treat as alive so
-    // we don't accidentally take over another user's lock.
-    if (code === "EPERM") return true;
-    return false;
-  }
-}
-
 /**
  * Try to atomically create the lock file with mode `0o600` and the current
  * PID as its contents. Returns `true` on success, `false` if the file
@@ -348,9 +325,7 @@ export async function acquireSnapshotLock(
     }
 
     if (isProcessAlive(holder.pid)) {
-      throw new Error(
-        `snapshot in progress (locked by pid ${holder.pid})`,
-      );
+      throw new Error(`snapshot in progress (locked by pid ${holder.pid})`);
     }
 
     // --- Step 3: stale takeover via rename-aside ---

package/src/bundler/compiler-tools.ts

@@ -15,10 +15,11 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { arch, homedir, platform } from "node:os";
+import { arch, platform } from "node:os";
 import { join } from "node:path";
 
 import { getLogger } from "../util/logger.js";
+import { getWorkspaceDir } from "../util/platform.js";
 import { PromiseGuard } from "../util/promise-guard.js";
 
 const log = getLogger("compiler-tools");
@@ -44,7 +45,7 @@ interface VersionManifest {
 }
 
 function getToolsDir(): string {
-  return join(homedir(), ".vellum", "workspace", "compiler-tools");
+  return join(getWorkspaceDir(), "compiler-tools");
 }
 
 const installGuard = new PromiseGuard<void>();

package/src/calls/call-conversation-messages.ts

@@ -6,6 +6,21 @@
 import { addMessage } from "../memory/conversation-crud.js";
 import { getCallEvents, getCallSession } from "./call-store.js";
 
+function buildCallSummaryLabel(
+  status: string | undefined,
+  duration: number | null,
+  eventCount: number,
+): string {
+  const statusLabel =
+    status === "failed"
+      ? "Call failed"
+      : status === "cancelled"
+        ? "Call cancelled"
+        : "Call completed";
+  const durationStr = duration != null ? ` (${duration}s)` : "";
+  return `**${statusLabel}**${durationStr}. ${eventCount} event(s) recorded.`;
+}
+
 export function buildCallCompletionMessage(callSessionId: string): string {
   const callSession = getCallSession(callSessionId);
   const events = getCallEvents(callSessionId);
@@ -13,25 +28,46 @@ export function buildCallCompletionMessage(callSessionId: string): string {
     callSession?.endedAt && callSession?.startedAt
       ? Math.round((callSession.endedAt - callSession.startedAt) / 1000)
       : null;
-  const durationStr = duration != null ? ` (${duration}s)` : "";
-  const statusLabel =
-    callSession?.status === "failed"
-      ? "Call failed"
-      : callSession?.status === "cancelled"
-        ? "Call cancelled"
-        : "Call completed";
-  return `**${statusLabel}**${durationStr}. ${events.length} event(s) recorded.`;
+  return buildCallSummaryLabel(callSession?.status, duration, events.length);
 }
 
 export async function persistCallCompletionMessage(
   conversationId: string,
   callSessionId: string,
 ): Promise<string> {
-  const summaryText = buildCallCompletionMessage(callSessionId);
+  const callSession = getCallSession(callSessionId);
+  const events = getCallEvents(callSessionId);
+  const duration =
+    callSession?.endedAt && callSession?.startedAt
+      ? Math.round((callSession.endedAt - callSession.startedAt) / 1000)
+      : null;
+  const summaryText = buildCallSummaryLabel(
+    callSession?.status,
+    duration,
+    events.length,
+  );
+
   await addMessage(
     conversationId,
     "assistant",
-    JSON.stringify([{ type: "text", text: summaryText }]),
+    JSON.stringify([
+      {
+        type: "ui_surface",
+        surfaceType: "call_summary",
+        surfaceId: crypto.randomUUID(),
+        completed: true,
+        data: {
+          summaryText,
+          status: callSession?.status ?? "completed",
+          duration,
+          events: events.map((e) => ({
+            eventType: e.eventType,
+            payloadJson: e.payloadJson,
+            createdAt: e.createdAt,
+          })),
+        },
+      },
+    ]),
     {
       userMessageChannel: "phone",
       assistantMessageChannel: "phone",

package/src/cli/commands/__tests__/webhooks.test.ts

@@ -14,7 +14,6 @@ let mockPlatformContext: Record<string, unknown> = {
   isPlatform: false,
   platformBaseUrl: "",
   assistantId: "",
-  hasInternalApiKey: false,
   hasAssistantApiKey: false,
   authHeader: null,
   enabled: false,
@@ -128,7 +127,6 @@ function connectedContext(
     isPlatform: false,
     platformBaseUrl: "https://test-platform.vellum.ai",
     assistantId: "019d6d4f-6dbd-779f-91d3-cb273b9429a5",
-    hasInternalApiKey: false,
     hasAssistantApiKey: true,
     authHeader: "Api-Key vak_test123",
     enabled: true,
@@ -145,7 +143,6 @@ describe("assistant webhooks register", () => {
       isPlatform: false,
       platformBaseUrl: "",
       assistantId: "",
-      hasInternalApiKey: false,
       hasAssistantApiKey: false,
       authHeader: null,
       enabled: false,
@@ -466,7 +463,6 @@ describe("assistant webhooks list", () => {
       isPlatform: false,
       platformBaseUrl: "",
       assistantId: "",
-      hasInternalApiKey: false,
       hasAssistantApiKey: false,
       authHeader: null,
       enabled: false,

package/src/cli/commands/bash.ts

@@ -1,23 +1,11 @@
-import { randomUUID } from "node:crypto";
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { join } from "node:path";
-
 import type { Command } from "commander";
 
-import { getSignalsDir } from "../../util/platform.js";
+import { cliIpcCall } from "../../ipc/cli-client.js";
 import { log } from "../logger.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
-const POLL_INTERVAL_MS = 100;
 
-interface BashSignalResult {
-  requestId: string;
+interface DebugBashResult {
   stdout: string;
   stderr: string;
   exitCode: number | null;
@@ -39,20 +27,16 @@ export function registerBashCommand(program: Command): void {
     .addHelpText(
       "after",
       `
-Sends a shell command to the running assistant for execution via the
-signals directory. The assistant spawns the command in its own process environment
-and returns stdout, stderr, and the exit code.
+Sends a shell command to the running assistant for execution via the IPC
+socket. The assistant spawns the command in its own process environment and
+returns stdout, stderr, and the exit code.
 
 This is a developer debugging tool for inspecting how the assistant invokes and
 observes shell commands. The command runs with the assistant's environment, working
 directory, and process context — not the caller's shell.
 
 Requires the assistant to be running with VELLUM_DEBUG=1. When debug mode is off
-(the default), the assistant ignores bash signal files and returns an error.
-
-The CLI writes the command to signals/bash.<requestId> and polls
-signals/bash.<requestId>.result for the output. The assistant must be running
-for this to work.
+(the default), the assistant returns an error immediately.
 
 Arguments:
   command   The shell command string to execute (e.g. "echo hello", "ls -la").
@@ -64,7 +48,7 @@ Examples:
   $ assistant bash "env | grep PATH" --timeout 10000
   $ assistant bash "ls -la"`,
     )
-    .action((command: string, opts: { timeout: string }) => {
+    .action(async (command: string, opts: { timeout: string }) => {
       const timeoutMs = parseInt(opts.timeout, 10);
       if (!Number.isFinite(timeoutMs) || timeoutMs < 1) {
         log.error("Invalid timeout value. Must be a positive integer.");
@@ -72,105 +56,48 @@ Examples:
         return;
       }
 
-      const requestId = randomUUID();
-      const signalsDir = getSignalsDir();
+      const result = await cliIpcCall<DebugBashResult>(
+        "debug_bash",
+        { body: { command, timeoutMs } },
+        { timeoutMs: timeoutMs + 10_000 },
+      );
 
-      try {
-        mkdirSync(signalsDir, { recursive: true });
-      } catch {
-        log.error("Failed to create signals directory.");
+      if (!result.ok) {
+        log.error(result.error ?? "Failed to reach the assistant.");
         process.exitCode = 1;
         return;
       }
 
-      // Write the command signal for the assistant to pick up.
-      const signalPath = join(signalsDir, `bash.${requestId}`);
-      const resultPath = join(signalsDir, `bash.${requestId}.result`);
-
-      try {
-        writeFileSync(
-          signalPath,
-          JSON.stringify({ requestId, command, timeoutMs }),
-        );
-      } catch {
-        log.error("Failed to write bash signal file.");
+      const data = result.result!;
+
+      if (data.error) {
+        log.error(data.error);
         process.exitCode = 1;
         return;
       }
 
-      log.info(`Sent command to assistant (requestId: ${requestId})`);
-      log.info("Waiting for result...");
-
-      // Poll for the result file until timeout.
-      const deadline = Date.now() + timeoutMs + 5_000; // extra buffer for assistant overhead
-
-      const poll = setInterval(() => {
-        if (Date.now() > deadline) {
-          clearInterval(poll);
-          cleanupSignalFiles();
-          log.error(
-            "Timed out waiting for response. Is the assistant running?",
-          );
-          process.exitCode = 1;
-          return;
-        }
-
-        if (!existsSync(resultPath)) return;
-
-        let result: BashSignalResult;
-        try {
-          const content = readFileSync(resultPath, "utf-8");
-          result = JSON.parse(content) as BashSignalResult;
-        } catch {
-          // File may be partially written; retry on next poll.
-          return;
-        }
-
-        // Ignore stale results from a previous invocation.
-        if (result.requestId !== requestId) return;
-
-        clearInterval(poll);
-        cleanupSignalFiles();
-
-        if (result.error) {
-          log.error(result.error);
-          process.exitCode = 1;
-          return;
-        }
-
-        if (result.stdout) {
-          process.stdout.write(result.stdout);
-          if (!result.stdout.endsWith("\n")) {
-            process.stdout.write("\n");
-          }
-        }
-
-        if (result.stderr) {
-          process.stderr.write(result.stderr);
-          if (!result.stderr.endsWith("\n")) {
-            process.stderr.write("\n");
-          }
-        }
-
-        if (result.timedOut) {
-          log.info(`Command timed out in assistant.`);
+      if (data.stdout) {
+        process.stdout.write(data.stdout);
+        if (!data.stdout.endsWith("\n")) {
+          process.stdout.write("\n");
         }
+      }
 
-        if (result.exitCode != null && result.exitCode !== 0) {
-          log.info(`Exit code: ${result.exitCode}`);
+      if (data.stderr) {
+        process.stderr.write(data.stderr);
+        if (!data.stderr.endsWith("\n")) {
+          process.stderr.write("\n");
         }
+      }
 
-        process.exitCode = result.exitCode ?? 1;
-      }, POLL_INTERVAL_MS);
+      if (data.timedOut) {
+        log.info(`Command timed out in assistant.`);
+      }
 
-      function cleanupSignalFiles(): void {
-        for (const p of [signalPath, resultPath]) {
-          try {
-            unlinkSync(p);
-          } catch {
-            // Best-effort cleanup; the file may already be gone.
-          }
-        }
+      if (data.exitCode != null && data.exitCode !== 0) {
+        log.info(`Exit code: ${data.exitCode}`);
       }
+
+      process.exitCode = data.exitCode ?? 1;
     });
 }

package/src/cli/commands/contacts.ts

@@ -35,19 +35,70 @@ import { shouldOutputJson, writeOutput } from "../output.js";
 // Human-readable formatters
 // ---------------------------------------------------------------------------
 
-function formatChannelSummary(ch: ContactChannel): string {
-  const parts = [ch.type, ch.address];
-  if (ch.status !== "active") parts.push(`(${ch.status})`);
-  if (ch.policy !== "allow") parts.push(`[${ch.policy}]`);
-  return parts.join(" ");
+function formatContactTable(contacts: ContactWithChannels[]): string {
+  const headers = ["ID", "NAME", "ROLE", "CHANNELS"];
+  const rows = contacts.map((c) => [
+    c.id,
+    c.displayName,
+    `${c.role}/${c.contactType}`,
+    String(c.channels.length),
+  ]);
+
+  // Pad all columns
+  const widths = headers.map((h, i) =>
+    Math.max(h.length, ...rows.map((r) => r[i]?.length ?? 0)),
+  );
+
+  const pad = (s: string, w: number) => s.padEnd(w);
+  const headerLine = headers.map((h, i) => pad(h, widths[i])).join("  ");
+  const separator = widths.map((w) => "─".repeat(w)).join("  ");
+
+  const dataLines = rows.map((row) =>
+    row.map((cell, i) => pad(cell, widths[i])).join("  "),
+  );
+
+  return [headerLine, separator, ...dataLines].join("\n");
 }
 
-function formatContactRow(c: ContactWithChannels): string {
-  const channels =
-    c.channels.length > 0
-      ? c.channels.map(formatChannelSummary).join(", ")
-      : "(no channels)";
-  return `${c.id}  ${c.displayName}  ${c.role}/${c.contactType}  ${channels}`;
+function formatChannelTable(channels: ContactChannel[]): string {
+  const headers = ["ID", "TYPE", "ADDRESS", "FLAGS"];
+  const rows = channels.map((ch) => {
+    const flags = [
+      ch.isPrimary ? "primary" : null,
+      ch.status !== "active" ? ch.status : null,
+      ch.policy !== "allow" ? ch.policy : null,
+    ]
+      .filter(Boolean)
+      .join(", ");
+    return [ch.id, ch.type, ch.address, flags];
+  });
+
+  // Pad all columns except the last (FLAGS can be empty)
+  const fixedCols = headers.length - 1;
+  const widths = headers
+    .slice(0, fixedCols)
+    .map((h, i) => Math.max(h.length, ...rows.map((r) => r[i]?.length ?? 0)));
+
+  const pad = (s: string, w: number) => s.padEnd(w);
+  const headerLine = [
+    ...headers.slice(0, fixedCols).map((h, i) => pad(h, widths[i])),
+    headers[fixedCols],
+  ].join("  ");
+  const separator = [
+    ...widths.map((w) => "─".repeat(w)),
+    "─".repeat(headers[fixedCols].length),
+  ].join("  ");
+
+  const dataLines = rows.map((row) =>
+    [
+      ...row.slice(0, fixedCols).map((cell, i) => pad(cell, widths[i])),
+      row[fixedCols],
+    ].join("  "),
+  );
+
+  return [headerLine, separator, ...dataLines]
+    .map((l) => `  ${l}`)
+    .join("\n");
 }
 
 function formatContactDetail(
@@ -67,17 +118,7 @@ function formatContactDetail(
   if (c.channels.length > 0) {
     lines.push("");
     lines.push("Channels:");
-    for (const ch of c.channels) {
-      const flags = [
-        ch.isPrimary ? "primary" : null,
-        ch.status !== "active" ? ch.status : null,
-        ch.policy !== "allow" ? ch.policy : null,
-      ]
-        .filter(Boolean)
-        .join(", ");
-      const suffix = flags ? `  (${flags})` : "";
-      lines.push(`  ${ch.id}  ${ch.type}  ${ch.address}${suffix}`);
-    }
+    lines.push(formatChannelTable(c.channels));
   }
   if (assistantMeta?.metadata && "assistantId" in assistantMeta.metadata) {
     lines.push("");
@@ -205,9 +246,7 @@ Examples:
           } else if (results.length === 0) {
             process.stdout.write("No contacts found.\n");
           } else {
-            for (const c of results) {
-              process.stdout.write(formatContactRow(c) + "\n");
-            }
+            process.stdout.write(formatContactTable(results) + "\n");
             process.stdout.write(`\n${results.length} contact(s)\n`);
           }
         } catch (err) {

package/src/cli/commands/credentials.ts

@@ -15,6 +15,7 @@ import {
 import type { CredentialPromptResult } from "../../runtime/routes/credential-prompt-routes.js";
 import { credentialKey } from "../../security/credential-key.js";
 import {
+  getActiveBackendInfoAsync,
   getSecureKeyAsync,
   getSecureKeyResultAsync,
 } from "../../security/secure-keys.js";
@@ -393,6 +394,61 @@ Examples:
       }
     });
 
+  // -------------------------------------------------------------------------
+  // status
+  // -------------------------------------------------------------------------
+
+  credential
+    .command("status")
+    .description("Show the active credential backend and its configuration")
+    .addHelpText(
+      "after",
+      `
+Shows which credential storage backend this process is using and backend-specific
+path or connection details. Run this to diagnose credential lookup mismatches —
+for example, when the CLI and the daemon are reading from different stores.
+
+Backend types:
+  encrypted-store   Direct file read from keys.enc (standalone CLI, no daemon)
+  ces-rpc           Delegates to the running CES process via stdio RPC (daemon)
+  ces-http          Delegates to CES sidecar over HTTP (containerized/Docker mode)
+
+Also shows the CREDENTIAL_SECURITY_DIR, GATEWAY_SECURITY_DIR, and
+VELLUM_WORKSPACE_DIR env vars so you can confirm which instance directory this
+process is scoped to.
+
+Examples:
+  $ assistant credentials status
+  $ assistant credentials status --json`,
+    )
+    .action(async (_opts: Record<string, unknown>, cmd: Command) => {
+      try {
+        const info = await getActiveBackendInfoAsync();
+
+        if (shouldOutputJson(cmd)) {
+          writeOutput(cmd, { ok: true, ...info });
+        } else {
+          log.info(`Backend: ${info.backend}`);
+          if (info.backend === "encrypted-store") {
+            log.info(
+              `  Store path:  ${info.storePath} [${info.storeExists ? "exists" : "missing"}]`,
+            );
+            log.info(
+              `  Key path:    ${info.storeKeyPath} [${info.storeKeyExists ? "exists" : "missing"}]`,
+            );
+          } else if (info.backend === "ces-rpc") {
+            log.info(`  RPC ready:   ${info.ready}`);
+          } else if (info.backend === "ces-http") {
+            log.info(`  URL:         ${info.url}`);
+          }
+        }
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        writeError(cmd, message);
+        process.exitCode = 1;
+      }
+    });
+
   // -------------------------------------------------------------------------
   // set
   // -------------------------------------------------------------------------

package/src/cli/commands/memory-v2.ts

@@ -25,9 +25,9 @@
  *     violation lists). Does not mutate the workspace.
  *
  * Lives alongside the existing v1 `memory` command rather than replacing it
- * because v1 graph + PKB stays write-active until the cutover PR. Until the
- * `memory-v2-enabled` feature flag flips on, the workspace keeps both v1 and
- * v2 state side-by-side.
+ * so flipping `memory-v2-enabled` back to off fully re-engages the v1
+ * pipeline. While the flag is on, v1 graph extraction/maintenance and PKB
+ * filing are suppressed; v1 data stays in place but stops being updated.
  */
 
 import type { Command } from "commander";
@@ -267,9 +267,10 @@ Examples:
       "after",
       `
 Re-runs the v2 skill catalog seed against the current skill set, replacing
-both the in-process skill cache and the memory_v2_skills Qdrant collection.
-Useful after editing a skill's SKILL.md, after a feature-flag flip changes
-the enabled-skill set, or to recover a corrupted skills collection.
+both the in-process skill cache and the skill entries in the unified
+memory_v2_concept_pages Qdrant collection (under the skills/<id> slug
+prefix). Useful after editing a skill's SKILL.md, after a feature-flag flip
+changes the enabled-skill set, or to recover corrupted skill embeddings.
 
 Unlike 'reembed' (concept pages), this runs synchronously inside the
 daemon — the command returns only once the seed completes. Requires both