@vellumai/assistant 0.7.2 → 0.7.3

package/src/runtime/routes/contact-routes.ts

@@ -11,7 +11,6 @@
 import { z } from "zod";
 
 import {
-  deleteContact,
   getAssistantContactMetadata,
   getChannelById,
   getContact,
@@ -42,7 +41,6 @@ import {
 import {
   BadRequestError,
   ConflictError,
-  ForbiddenError,
   NotFoundError,
 } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -154,17 +152,6 @@ function handleGetContact(contactId: string) {
   };
 }
 
-function handleDeleteContact(contactId: string) {
-  const result = deleteContact(contactId);
-  if (result === "not_found") {
-    throw new NotFoundError(`Contact "${contactId}" not found`);
-  }
-  if (result === "is_guardian") {
-    throw new ForbiddenError("Cannot delete a guardian contact");
-  }
-  return null;
-}
-
 // ---------------------------------------------------------------------------
 // Invite handlers (transport-agnostic)
 // ---------------------------------------------------------------------------
@@ -502,18 +489,6 @@ export const ROUTES: RouteDefinition[] = [
     handler: ({ pathParams }: RouteHandlerArgs) =>
       handleGetContact(pathParams!.id),
   },
-  {
-    operationId: "deleteContact",
-    endpoint: "contacts/:id",
-    method: "DELETE",
-    policyKey: "contacts",
-    summary: "Delete a contact",
-    description: "Delete a contact by ID.",
-    tags: ["contacts"],
-    responseStatus: "204",
-    handler: ({ pathParams }: RouteHandlerArgs) =>
-      handleDeleteContact(pathParams!.id),
-  },
   {
     operationId: "upsert_contact",
     endpoint: "contacts",

package/src/runtime/routes/conversation-routes.ts

@@ -39,6 +39,7 @@ import {
   resolveSlash,
 } from "../../daemon/conversation-slash.js";
 import { getOrCreateConversation as getOrCreateConversationInstance } from "../../daemon/conversation-store.js";
+import { canonicalizeTimeZone } from "../../daemon/date-context.js";
 import {
   getCannedFirstGreeting,
   isWakeUpGreeting,
@@ -86,6 +87,8 @@ import {
   getOrCreateConversation,
 } from "../../memory/conversation-key-store.js";
 import { searchConversations } from "../../memory/conversation-queries.js";
+import { normalizeOnboardingContext } from "../../prompts/normalize-onboarding.js";
+import { writeOnboardingSection } from "../../prompts/persona-resolver.js";
 import { getConfiguredProvider } from "../../providers/provider-send-message.js";
 import type { Provider } from "../../providers/types.js";
 import { checkIngressForSecrets } from "../../security/secret-ingress.js";
@@ -999,7 +1002,7 @@ function mergeConsecutiveAssistantMessages(messages: MessageRow[]): {
 /**
  * Persist the pre-chat onboarding payload to disk.
  *
- * Runs only on the very first message of a fresh conversation. Three
+ * Runs only on the very first message of a fresh conversation. Four
  * artifacts are produced:
  *
  *   1. `data/onboarding-context.json` — sidecar read by the
@@ -1007,12 +1010,15 @@ function mergeConsecutiveAssistantMessages(messages: MessageRow[]): {
  *      the pure-recomputation write cycle (every turn boundary rebuilds
  *      facts from markdown; the sidecar is the durable source for the
  *      tool/task/tone chips).
- *   2. `IDENTITY.md` / `USER.md` — persona seed files, only written
- *      when missing so we never clobber existing content. These feed
- *      the system prompt and the relationship-state writer's
- *      `parseIdentity` / `parseUserName` helpers after a daemon
- *      restart when the in-memory onboarding context is gone.
- *   3. `data/relationship-state.json` — kicked off fire-and-forget so
+ *   2. `IDENTITY.md` — assistant persona seed file, only written when
+ *      missing so we never clobber existing content. Feeds the system
+ *      prompt and the relationship-state writer's `parseIdentity`
+ *      helper after a daemon restart when the in-memory onboarding
+ *      context is gone.
+ *   3. Onboarding section in the guardian persona file — written via
+ *      `writeOnboardingSection`, which handles the user's preferred
+ *      name (with fallback to root `USER.md`).
+ *   4. `data/relationship-state.json` — kicked off fire-and-forget so
  *      the Home page can populate immediately on first visit instead
  *      of waiting for the first agent-turn boundary.
  *
@@ -1057,25 +1063,11 @@ export function persistOnboardingArtifacts(onboarding: {
     }
   }
 
-  const userName = onboarding.userName?.trim();
-  if (userName) {
-    const userPath = getWorkspacePromptPath("USER.md");
-    try {
-      if (existsSync(userPath)) {
-        const content = readFileSync(userPath, "utf-8");
-        const updated = content.replace(
-          /^- (?:\*\*)?Name:(?:\*\*)?\s*.*$/m,
-          () => `- **Name:** ${userName}`,
-        );
-        if (updated !== content) {
-          writeFileSync(userPath, updated, "utf-8");
-        }
-      } else {
-        writeFileSync(userPath, `# User\n\n- **Name:** ${userName}\n`, "utf-8");
-      }
-    } catch (err) {
-      log.warn({ err, userPath }, "Failed to seed USER.md from onboarding");
-    }
+  try {
+    const normalized = normalizeOnboardingContext(onboarding);
+    writeOnboardingSection(normalized);
+  } catch (err) {
+    log.warn({ err }, "Failed to write onboarding section to persona file");
   }
 
   void writeRelationshipState().catch((err) => {
@@ -1104,6 +1096,7 @@ export async function handleSendMessage(
     bypassSecretCheck?: boolean;
     hostHomeDir?: string;
     hostUsername?: string;
+    clientTimezone?: unknown;
     clientId?: string;
     clientMessageId?: string;
     inferenceProfile?: string | null;
@@ -1183,6 +1176,10 @@ export async function handleSendMessage(
       )}`,
     );
   }
+  const clientTimezone =
+    typeof body.clientTimezone === "string"
+      ? (canonicalizeTimeZone(body.clientTimezone) ?? undefined)
+      : undefined;
 
   // When conversationKey is omitted, derive a stable default from
   // sourceChannel + sourceInterface so that repeated calls from the same
@@ -1302,10 +1299,12 @@ export async function handleSendMessage(
         interfaceId: sourceInterface,
         hostHomeDir: body.hostHomeDir,
         hostUsername: body.hostUsername,
+        ...(clientTimezone ? { clientTimezone } : {}),
       } satisfies HostProxyTransportMetadata)
     : ({
         channelId: sourceChannel,
         interfaceId: sourceInterface,
+        ...(clientTimezone ? { clientTimezone } : {}),
       } satisfies NonHostProxyTransportMetadata);
 
   const conversation = await smDeps.getOrCreateConversation(
@@ -1991,6 +1990,13 @@ async function generateLlmSuggestion(
   // prefill-safe model. Keep `stop_sequences: ["</reply>"]` as an
   // early-termination hint; the parser below handles both tagged and
   // untagged responses so untagged "casual answer" replies still work.
+  //
+  // Force `thinking: disabled` + `effort: none` so the call works on any
+  // user profile — including thinking-enabled profiles (Opus 4.x at
+  // `effort: high|xhigh`, etc.) where Anthropic 400s on `temperature` ≠ 1
+  // when thinking is enabled or in adaptive mode. A 60-token reply chip
+  // doesn't benefit from extended thinking anyway, and burning thinking
+  // tokens here would be wasteful.
   const response = await provider.sendMessage(
     [{ role: "user", content: [{ type: "text", text: userPrompt }] }],
     [], // no tools
@@ -2001,6 +2007,8 @@ async function generateLlmSuggestion(
         max_tokens: 60,
         stop_sequences: ["</reply>"],
         temperature: 0.7,
+        thinking: { type: "disabled" },
+        effort: "none",
       },
     },
   );
@@ -2274,6 +2282,7 @@ export const ROUTES: RouteDefinition[] = [
         .optional(),
       conversationType: z.string().optional(),
       slashCommand: z.string().optional(),
+      clientTimezone: z.string().optional(),
       inferenceProfile: z.string().nullable().optional(),
       riskThreshold: z.enum(VALID_RISK_THRESHOLDS).optional(),
     }),

package/src/runtime/routes/debug-bash-routes.ts

@@ -0,0 +1,163 @@
+/**
+ * IPC route for executing shell commands through the assistant process.
+ *
+ * The CLI sends the command over the IPC socket and receives a single
+ * response containing stdout, stderr, and the exit code.
+ *
+ * **Security**: Gated behind VELLUM_DEBUG=1. When debug mode is off (the
+ * default), the handler returns an error immediately so the CLI surfaces a
+ * clear rejection instead of hanging. The assistant must be restarted with
+ * VELLUM_DEBUG=1 for this route to execute commands.
+ */
+
+import { spawn } from "node:child_process";
+
+import { z } from "zod";
+
+import { getIsContainerized } from "../../config/env-registry.js";
+import { getWorkspaceDir } from "../../util/platform.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+const DEFAULT_TIMEOUT_MS = 30_000;
+
+function isDebugMode(): boolean {
+  return (
+    process.env.VELLUM_DEBUG === "1" || process.env.VELLUM_DEBUG === "true"
+  );
+}
+
+interface DebugBashResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+  error?: string;
+}
+
+function handleDebugBash({ body }: RouteHandlerArgs): Promise<DebugBashResult> {
+  if (getIsContainerized()) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "debug bash is not available in containerized environments",
+    });
+  }
+
+  if (!isDebugMode()) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error:
+        "Bash debug execution is disabled. The running assistant process must have been started with VELLUM_DEBUG=1 (setting it on the CLI command alone is not enough). Restart the assistant with: vellum sleep && VELLUM_DEBUG=1 vellum wake",
+    });
+  }
+
+  const { command, timeoutMs } = body as {
+    command?: string;
+    timeoutMs?: number;
+  };
+
+  if (!command || typeof command !== "string") {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "command is required",
+    });
+  }
+
+  const effectiveTimeout =
+    typeof timeoutMs === "number" && timeoutMs > 0
+      ? timeoutMs
+      : DEFAULT_TIMEOUT_MS;
+
+  return new Promise<DebugBashResult>((resolve) => {
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    let timedOut = false;
+    let settled = false;
+
+    const finish = (result: DebugBashResult) => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+
+    const child = spawn("bash", ["-c", command], {
+      cwd: getWorkspaceDir(),
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+    });
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        process.kill(-child.pid!, "SIGKILL");
+      } catch {
+        // Process group may have already exited.
+      }
+    }, effectiveTimeout);
+
+    child.stdout.on("data", (data: Buffer) => {
+      stdoutChunks.push(data);
+    });
+
+    child.stderr.on("data", (data: Buffer) => {
+      stderrChunks.push(data);
+    });
+
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({
+        stdout: Buffer.concat(stdoutChunks).toString(),
+        stderr: Buffer.concat(stderrChunks).toString(),
+        exitCode: code,
+        timedOut,
+      });
+    });
+
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      finish({
+        stdout: "",
+        stderr: "",
+        exitCode: null,
+        timedOut: false,
+        error: err.message,
+      });
+    });
+  });
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "debug_bash",
+    endpoint: "debug/bash",
+    method: "POST",
+    requireGuardian: false,
+    summary: "Execute a shell command in the assistant process",
+    description:
+      "Developer debugging tool. Requires the assistant to be running with VELLUM_DEBUG=1.",
+    tags: ["debug"],
+    requestBody: z.object({
+      command: z.string().describe("Shell command to execute via bash -c"),
+      timeoutMs: z
+        .number()
+        .optional()
+        .describe("Execution timeout in milliseconds (default: 30000)"),
+    }),
+    responseBody: z.object({
+      stdout: z.string(),
+      stderr: z.string(),
+      exitCode: z.number().nullable(),
+      timedOut: z.boolean(),
+      error: z.string().optional(),
+    }),
+    handler: handleDebugBash,
+  },
+];

package/src/runtime/routes/disk-pressure-routes.ts

@@ -0,0 +1,121 @@
+import { z } from "zod";
+
+import {
+  acknowledgeDiskPressureLock,
+  DISK_PRESSURE_OVERRIDE_CONFIRMATION,
+  getDiskPressureStatus,
+  overrideDiskPressureLock,
+} from "../../daemon/disk-pressure-guard.js";
+import { RouteError } from "./errors.js";
+import type { RouteDefinition } from "./types.js";
+
+const DiskPressureStatusSchema = z.object({
+  enabled: z.boolean(),
+  state: z.enum(["disabled", "ok", "critical", "unknown"]),
+  locked: z.boolean(),
+  acknowledged: z.boolean(),
+  overrideActive: z.boolean(),
+  effectivelyLocked: z.boolean(),
+  lockId: z.string().nullable(),
+  usagePercent: z.number().nullable(),
+  thresholdPercent: z.number(),
+  path: z.string().nullable(),
+  lastCheckedAt: z.string().nullable(),
+  blockedCapabilities: z.array(
+    z.enum(["agent-turns", "background-work", "remote-ingress"]),
+  ),
+  error: z.string().nullable(),
+});
+
+const DiskPressureActionResponseSchema = z.object({
+  status: DiskPressureStatusSchema,
+});
+
+const OverrideRequestSchema = z.object({
+  confirmation: z.string(),
+});
+
+function statusResponse() {
+  return { status: getDiskPressureStatus() };
+}
+
+function transitionErrorCode(
+  reason: "not_locked" | "already_acknowledged" | "already_overridden",
+): string {
+  if (reason === "not_locked") return "NOT_LOCKED";
+  if (reason === "already_acknowledged") return "ALREADY_ACKNOWLEDGED";
+  return "ALREADY_OVERRIDDEN";
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "getDiskPressureStatus",
+    endpoint: "disk-pressure/status",
+    method: "GET",
+    policyKey: "disk-pressure/status",
+    requirePolicyEnforcement: true,
+    summary: "Get disk pressure status",
+    description:
+      "Return the current disk pressure status snapshot. When safe storage limits are disabled, returns a disabled status.",
+    tags: ["disk-pressure"],
+    responseBody: DiskPressureActionResponseSchema,
+    handler: () => statusResponse(),
+  },
+  {
+    operationId: "acknowledgeDiskPressure",
+    endpoint: "disk-pressure/acknowledge",
+    method: "POST",
+    policyKey: "disk-pressure/acknowledge",
+    requirePolicyEnforcement: true,
+    summary: "Acknowledge disk pressure",
+    description:
+      "Acknowledge the current disk pressure lock and enter cleanup mode without overriding assistant protections.",
+    tags: ["disk-pressure"],
+    responseBody: DiskPressureActionResponseSchema,
+    additionalResponses: {
+      "409": { description: "No active lock or lock already acknowledged." },
+    },
+    handler: () => {
+      const result = acknowledgeDiskPressureLock();
+      if (result.ok) return { status: result.status };
+      if (result.reason === "invalid_confirmation") {
+        throw new RouteError(result.message, "INVALID_CONFIRMATION", 400);
+      }
+      throw new RouteError(
+        result.message,
+        transitionErrorCode(result.reason),
+        409,
+      );
+    },
+  },
+  {
+    operationId: "overrideDiskPressure",
+    endpoint: "disk-pressure/override",
+    method: "POST",
+    policyKey: "disk-pressure/override",
+    requirePolicyEnforcement: true,
+    summary: "Override disk pressure",
+    description: `Override the current disk pressure lock only after confirming "${DISK_PRESSURE_OVERRIDE_CONFIRMATION}".`,
+    tags: ["disk-pressure"],
+    requestBody: OverrideRequestSchema,
+    responseBody: DiskPressureActionResponseSchema,
+    additionalResponses: {
+      "400": { description: "Confirmation phrase is invalid." },
+      "409": { description: "No active lock or lock already overridden." },
+    },
+    handler: ({ body }) => {
+      const parsed = OverrideRequestSchema.safeParse(body);
+      const confirmation = parsed.success ? parsed.data.confirmation : "";
+      const result = overrideDiskPressureLock(confirmation);
+      if (result.ok) return { status: result.status };
+      if (result.reason === "invalid_confirmation") {
+        throw new RouteError(result.message, "INVALID_CONFIRMATION", 400);
+      }
+      throw new RouteError(
+        result.message,
+        transitionErrorCode(result.reason),
+        409,
+      );
+    },
+  },
+];

package/src/runtime/routes/document-pdf-renderer.ts

@@ -146,8 +146,12 @@ export async function renderMarkdownToPDF(
   const pw = await importPlaywright();
   const browser = await pw.chromium.launch({ headless: true });
   try {
-    const page = await browser.newPage();
-    await page.setContent(fullHtml, { waitUntil: "networkidle" });
+    const context = await browser.newContext({
+      javaScriptEnabled: false,
+    });
+    const page = await context.newPage();
+    await page.route("**/*", (route) => route.abort());
+    await page.setContent(fullHtml, { waitUntil: "domcontentloaded" });
     const pdfBuffer = await page.pdf({
       format: "A4",
       margin: {

package/src/runtime/routes/documents-routes.ts

@@ -6,7 +6,8 @@
  */
 import { z } from "zod";
 
-import { rawAll, rawGet, rawRun } from "../../memory/raw-query.js";
+import { saveDocument } from "../../documents/document-store.js";
+import { rawAll, rawGet } from "../../memory/raw-query.js";
 import { getLogger } from "../../util/logger.js";
 import { renderMarkdownToPDF } from "./document-pdf-renderer.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
@@ -27,80 +28,6 @@ interface DocumentRow {
 
 type DocumentListRow = Omit<DocumentRow, "content">;
 
-// ---------------------------------------------------------------------------
-// Junction table helper
-// ---------------------------------------------------------------------------
-
-/** Insert a document–conversation association (idempotent via INSERT OR IGNORE). */
-function addDocumentConversation(
-  surfaceId: string,
-  conversationId: string,
-): void {
-  rawRun(
-    /*sql*/ `INSERT OR IGNORE INTO document_conversations (surface_id, conversation_id, created_at) VALUES (?, ?, ?)`,
-    surfaceId,
-    conversationId,
-    Date.now(),
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Shared business logic (used by both message handlers and HTTP routes)
-// ---------------------------------------------------------------------------
-
-function saveDocument(params: {
-  surfaceId: string;
-  conversationId: string;
-  title: string;
-  content: string;
-  wordCount: number;
-}): { success: true; surfaceId: string } | { success: false; error: string } {
-  try {
-    const now = Date.now();
-    rawRun(
-      `INSERT INTO documents (surface_id, conversation_id, title, content, word_count, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(surface_id) DO UPDATE SET
-         title = excluded.title,
-         content = excluded.content,
-         word_count = excluded.word_count,
-         updated_at = excluded.updated_at`,
-      params.surfaceId,
-      params.conversationId,
-      params.title,
-      params.content,
-      params.wordCount,
-      now,
-      now,
-    );
-    log.info(
-      { surfaceId: params.surfaceId, title: params.title },
-      "Saved document",
-    );
-
-    // Best-effort: associate the document with the conversation.
-    // Failures (e.g. migration not yet applied, table missing) must not
-    // cause the save response to report failure — the document itself is
-    // already persisted at this point.
-    try {
-      addDocumentConversation(params.surfaceId, params.conversationId);
-    } catch (err) {
-      log.warn(
-        { err, surfaceId: params.surfaceId },
-        "Failed to record document–conversation association",
-      );
-    }
-
-    return { success: true, surfaceId: params.surfaceId };
-  } catch (error) {
-    log.error({ err: error, surfaceId: params.surfaceId }, "Save error");
-    return {
-      success: false,
-      error: error instanceof Error ? error.message : "Unknown error",
-    };
-  }
-}
-
 function loadDocument(surfaceId: string):
   | {
       success: true;