@vellumai/assistant 0.8.0 → 0.8.1

package/src/ipc/skill-routes/events.ts

@@ -70,6 +70,30 @@ const BuildEventParams = z.object({
   conversationId: z.string().optional(),
 });
 
+// ---------------------------------------------------------------------------
+// Event-type blocklist
+// ---------------------------------------------------------------------------
+
+/**
+ * Message types that skills are NOT allowed to publish. These are
+ * daemon→client control events that trigger host-side execution (bash,
+ * file I/O, browser automation, credential prompts) or register pending
+ * interactions. Allowing a skill to publish them would bypass the
+ * trust/approval gates and escape the skill isolation boundary.
+ *
+ * Prefix-based: any event whose `type` starts with `"host_"` is blocked,
+ * covering current types (`host_bash_request`, `host_file_request`,
+ * `host_browser_request`, `host_cu_request`, `host_transfer_request`,
+ * and their `_cancel` counterparts) plus any future `host_*` additions.
+ */
+function isBlockedEventType(type: unknown): boolean {
+  if (typeof type !== "string") return true;
+  if (type.startsWith("host_")) return true;
+  if (type === "confirmation_request") return true;
+  if (type === "secret_request") return true;
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -78,9 +102,12 @@ async function handlePublish(
   params?: Record<string, unknown>,
 ): Promise<{ published: true }> {
   const { event } = PublishParams.parse(params);
-  // Contract types the hub as `AssistantEvent<ServerMessage>`; the wire-level
-  // message is an opaque record that satisfies the `ServerMessage` structural
-  // shape (`{ type: string; [key: string]: unknown }`). Cast at the boundary.
+  const msgType = (event.message as Record<string, unknown>)?.type;
+  if (isBlockedEventType(msgType)) {
+    throw new Error(
+      `Skills cannot publish events of type "${String(msgType)}"`,
+    );
+  }
   await assistantEventHub.publish(event as never);
   return { published: true };
 }

package/src/live-voice/__tests__/live-voice-session-manager.test.ts

@@ -328,6 +328,52 @@ describe("LiveVoiceSessionManager", () => {
     expect(manager.activeSessionId).toBe("session-1");
   });
 
+  test("holds the session lock until close completes", async () => {
+    const sessions: TestSession[] = [];
+    let resolveClose: (() => void) | undefined;
+    const manager = new LiveVoiceSessionManager({
+      createSessionId: mock(() => `session-${sessions.length + 1}`),
+      createSession: () => {
+        const session = createTestSession({
+          close: mock(
+            (reason: LiveVoiceSessionCloseReason) =>
+              new Promise<void>((resolve) => {
+                sessions[sessions.length - 1]?.closeReasons.push(reason);
+                resolveClose = resolve;
+              }),
+          ),
+        });
+        sessions.push(session);
+        return session;
+      },
+    });
+    const first = createSink();
+    const second = createSink();
+    const third = createSink();
+
+    await manager.startSession(START_FRAME, first.sink);
+    const releasePromise = manager.releaseSession("session-1", "client_end");
+    const concurrent = await manager.startSession(START_FRAME, second.sink);
+    const concurrentDispatch = await manager.handleClientFrame("session-1", {
+      type: "interrupt",
+    });
+
+    expect(concurrent).toEqual({
+      status: "busy",
+      activeSessionId: "session-1",
+      frame: { type: "busy", seq: 1, activeSessionId: "session-1" },
+    });
+    expect(concurrentDispatch).toEqual({ status: "not_found" });
+    expect(sessions).toHaveLength(1);
+
+    resolveClose?.();
+    await releasePromise;
+
+    const next = await manager.startSession(START_FRAME, third.sink);
+    expect(next).toEqual({ status: "accepted", sessionId: "session-2" });
+    expect(manager.activeSessionId).toBe("session-2");
+  });
+
   test("does not import runtime, gateway, provider, or conversation modules", async () => {
     const source = await Bun.file(
       new URL("../live-voice-session-manager.ts", import.meta.url),

package/src/live-voice/__tests__/runtime-websocket-shell.test.ts

@@ -348,6 +348,7 @@ describe("RuntimeHttpServer live voice WebSocket shell", () => {
       conversationId: "conversation-after-error",
     });
     expect(typeof ready.sessionId).toBe("string");
+    expect(ready.seq as number).toBeGreaterThan(error.seq as number);
   });
 
   test("releases the session lock when the WebSocket closes", async () => {

package/src/live-voice/live-voice-session-manager.ts

@@ -85,6 +85,7 @@ export type LiveVoiceSessionReleaseResult =
 interface ActiveLiveVoiceSession {
   sessionId: string;
   session: LiveVoiceSession;
+  closing: boolean;
 }
 
 export class LiveVoiceSessionManager {
@@ -132,7 +133,7 @@ export class LiveVoiceSessionManager {
       },
     };
     const session = this.createSession(context);
-    this.activeSession = { sessionId, session };
+    this.activeSession = { sessionId, session, closing: false };
 
     try {
       await session.start();
@@ -198,14 +199,20 @@ export class LiveVoiceSessionManager {
       return { released: false };
     }
 
-    this.activeSession = null;
-    await active.session.close(reason);
+    active.closing = true;
+    try {
+      await active.session.close(reason);
+    } finally {
+      if (this.activeSession === active) {
+        this.activeSession = null;
+      }
+    }
     return { released: true, sessionId };
   }
 
   private findActiveSession(sessionId: string): ActiveLiveVoiceSession | null {
     const active = this.activeSession;
-    if (active === null || active.sessionId !== sessionId) {
+    if (active === null || active.sessionId !== sessionId || active.closing) {
       return null;
     }
 

package/src/live-voice/live-voice-session.ts

@@ -307,7 +307,6 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         )}`,
       });
       this.state = "transcriber_closed";
-      this.transcriber = null;
     }
     await this.startAssistantTurnIfReady();
     await this.drainOutboundFrames();
@@ -340,12 +339,15 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         return;
       }
       case "error":
+        // Non-terminal: providers like OpenAI Whisper emit `error` for
+        // transient poll failures and continue streaming. Let `closed` /
+        // `final` drive turn lifecycle so we don't drain audio buffers or
+        // mark the turn cancelled prematurely.
         await this.sendFrame({
           type: "error",
           code: LiveVoiceProtocolErrorCode.InvalidField,
           message: event.message,
         });
-        await this.finalizePendingTurn("stt_error");
         return;
       case "closed":
         if (!this.isClosed) {
@@ -470,16 +472,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
           },
         },
         onError: (message) => {
-          if (!this.isActiveAssistantTurn(token)) return;
+          const activeTurn = this.activeAssistantTurn;
+          if (
+            !this.isActiveAssistantTurn(token) ||
+            activeTurn?.assistantCompleted
+          ) {
+            return;
+          }
           void (async () => {
             await this.sendFrame({
               type: "error",
               code: LiveVoiceProtocolErrorCode.InvalidField,
               message,
             });
-            const activeTurn = this.activeAssistantTurn;
-            if (activeTurn?.token !== token) return;
-            await this.finalizeAssistantTurn(activeTurn, "cancelled", "error");
+            const currentTurn = this.activeAssistantTurn;
+            if (currentTurn?.token !== token) return;
+            await this.finalizeAssistantTurn(currentTurn, "cancelled", "error");
           })();
         },
       });

package/src/memory/__tests__/bookmark-crud.test.ts

@@ -0,0 +1,258 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import {
+  createBookmark,
+  deleteBookmarkByMessageId,
+  listBookmarks,
+} from "../bookmark-crud.js";
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+import { migrateMessageBookmarks } from "../migrations/242-message-bookmarks.js";
+import * as schema from "../schema.js";
+
+/**
+ * Recreate just enough of the conversations + messages tables to satisfy
+ * the bookmark JOIN and FK CASCADE behavior. The PR-2 schema test uses
+ * the same lightweight bootstrap.
+ */
+function bootstrapMessageTables(raw: Database): void {
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS memory_checkpoints (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS conversations (
+      id TEXT PRIMARY KEY,
+      title TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS messages (
+      id TEXT PRIMARY KEY,
+      conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+      role TEXT NOT NULL,
+      content TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    )
+  `);
+}
+
+interface SeedOptions {
+  conversationId: string;
+  messageId: string;
+  conversationTitle?: string | null;
+  messageContent?: string;
+  messageRole?: string;
+  messageCreatedAt?: number;
+}
+
+function seedConversationAndMessage(raw: Database, opts: SeedOptions): void {
+  const now = Date.now();
+  raw
+    .query(
+      `INSERT INTO conversations (id, title, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+    )
+    .run(opts.conversationId, opts.conversationTitle ?? "Example", now, now);
+  raw
+    .query(
+      `INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)`,
+    )
+    .run(
+      opts.messageId,
+      opts.conversationId,
+      opts.messageRole ?? "user",
+      opts.messageContent ?? "hello",
+      opts.messageCreatedAt ?? now,
+    );
+}
+
+function setupDb(): { db: DrizzleDb; raw: Database } {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec("PRAGMA foreign_keys = ON");
+  const db = drizzle(sqlite, { schema });
+  const raw = getSqliteFrom(db);
+  bootstrapMessageTables(raw);
+  migrateMessageBookmarks(db);
+  return { db, raw };
+}
+
+describe("bookmark-crud", () => {
+  test("createBookmark is idempotent — second call returns the existing row", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-1",
+      messageId: "msg-1",
+    });
+
+    const first = createBookmark(db, {
+      messageId: "msg-1",
+      conversationId: "conv-1",
+    });
+    const second = createBookmark(db, {
+      messageId: "msg-1",
+      conversationId: "conv-1",
+    });
+
+    expect(second.id).toBe(first.id);
+    expect(second.createdAt).toBe(first.createdAt);
+
+    const all = listBookmarks(db);
+    expect(all.length).toBe(1);
+  });
+
+  test("createBookmark returns the JOIN-shaped summary directly", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-summary",
+      messageId: "msg-summary",
+      conversationTitle: "Title goes here",
+      messageContent: "summary body",
+      messageRole: "assistant",
+    });
+
+    const summary = createBookmark(db, {
+      messageId: "msg-summary",
+      conversationId: "conv-summary",
+    });
+
+    expect(summary.conversationTitle).toBe("Title goes here");
+    expect(summary.messagePreview).toBe("summary body");
+    expect(summary.messageRole).toBe("assistant");
+    expect(typeof summary.messageCreatedAt).toBe("number");
+  });
+
+  test("listBookmarks returns rows newest-first and includes joined fields", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-A",
+      messageId: "msg-A",
+      conversationTitle: "Older",
+      messageContent: "first message",
+      messageRole: "user",
+    });
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-B",
+      messageId: "msg-B",
+      conversationTitle: "Newer",
+      messageContent: "second message",
+      messageRole: "assistant",
+    });
+
+    // Force deterministic ordering by inserting bookmarks with explicit
+    // created_at values 1 ms apart.
+    raw
+      .query(
+        `INSERT INTO message_bookmarks (id, message_id, conversation_id, created_at) VALUES (?, ?, ?, ?)`,
+      )
+      .run("bm-A", "msg-A", "conv-A", 1000);
+    raw
+      .query(
+        `INSERT INTO message_bookmarks (id, message_id, conversation_id, created_at) VALUES (?, ?, ?, ?)`,
+      )
+      .run("bm-B", "msg-B", "conv-B", 2000);
+
+    const result = listBookmarks(db);
+    expect(result.map((r) => r.id)).toEqual(["bm-B", "bm-A"]);
+    expect(result[0]?.conversationTitle).toBe("Newer");
+    expect(result[0]?.messagePreview).toBe("second message");
+    expect(result[0]?.messageRole).toBe("assistant");
+    expect(result[1]?.conversationTitle).toBe("Older");
+    expect(result[1]?.messageRole).toBe("user");
+  });
+
+  test("listBookmarks excludes bookmarks whose conversation no longer exists (CASCADE)", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-keep",
+      messageId: "msg-keep",
+    });
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-drop",
+      messageId: "msg-drop",
+    });
+    createBookmark(db, {
+      messageId: "msg-keep",
+      conversationId: "conv-keep",
+    });
+    createBookmark(db, {
+      messageId: "msg-drop",
+      conversationId: "conv-drop",
+    });
+    expect(listBookmarks(db).length).toBe(2);
+
+    // Deleting the parent conversation cascades through messages → bookmarks.
+    raw.query(`DELETE FROM conversations WHERE id = ?`).run("conv-drop");
+
+    const remaining = listBookmarks(db);
+    expect(remaining.length).toBe(1);
+    expect(remaining[0]?.conversationId).toBe("conv-keep");
+  });
+
+  test("deleteBookmarkByMessageId removes the matching row", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-d",
+      messageId: "msg-d",
+    });
+    createBookmark(db, { messageId: "msg-d", conversationId: "conv-d" });
+    expect(listBookmarks(db).length).toBe(1);
+
+    expect(deleteBookmarkByMessageId(db, "msg-d")).toBe(true);
+    expect(listBookmarks(db).length).toBe(0);
+    // Calling again with no row present returns false.
+    expect(deleteBookmarkByMessageId(db, "msg-d")).toBe(false);
+  });
+
+  test("messagePreview decodes JSON-serialized ContentBlock[] rows", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-blocks",
+      messageId: "msg-blocks",
+      messageContent: JSON.stringify([
+        { type: "text", text: "Hello, can you help with…" },
+      ]),
+      messageRole: "user",
+    });
+
+    const summary = createBookmark(db, {
+      messageId: "msg-blocks",
+      conversationId: "conv-blocks",
+    });
+
+    // Without the decode step, this would render as the raw JSON literal
+    // (`[{"type":"text","text":"…"}]`) rather than the spoken text.
+    expect(summary.messagePreview).toBe("Hello, can you help with…");
+    const listed = listBookmarks(db);
+    expect(listed[0]?.messagePreview).toBe("Hello, can you help with…");
+  });
+
+  test("messagePreview concatenates multi-text blocks and drops non-text blocks", () => {
+    const { db, raw } = setupDb();
+    seedConversationAndMessage(raw, {
+      conversationId: "conv-multi",
+      messageId: "msg-multi",
+      messageContent: JSON.stringify([
+        { type: "text", text: "first paragraph" },
+        { type: "tool_use", id: "x", name: "noop", input: {} },
+        { type: "text", text: "second paragraph" },
+      ]),
+      messageRole: "assistant",
+    });
+
+    const summary = createBookmark(db, {
+      messageId: "msg-multi",
+      conversationId: "conv-multi",
+    });
+
+    expect(summary.messagePreview).toBe("first paragraph\nsecond paragraph");
+  });
+});

package/src/memory/__tests__/bookmark-schema.test.ts

@@ -0,0 +1,181 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../db-connection.js";
+import { migrateMessageBookmarks } from "../migrations/242-message-bookmarks.js";
+import * as schema from "../schema.js";
+
+interface ColumnRow {
+  name: string;
+  type: string;
+  notnull: number;
+  pk: number;
+}
+
+interface IndexInfoRow {
+  name: string;
+  unique: number;
+}
+
+interface CountRow {
+  n: number;
+}
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec("PRAGMA foreign_keys = ON");
+  return drizzle(sqlite, { schema });
+}
+
+function bootstrapCheckpointsTable(raw: Database): void {
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS memory_checkpoints (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+}
+
+/**
+ * Recreate just enough of the conversations + messages tables to exercise
+ * CASCADE behavior. We only need the columns the FKs reference (id) plus
+ * NOT NULL columns required to insert a row.
+ */
+function bootstrapMessageTables(raw: Database): void {
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS conversations (
+      id TEXT PRIMARY KEY,
+      title TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+  raw.exec(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS messages (
+      id TEXT PRIMARY KEY,
+      conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+      role TEXT NOT NULL,
+      content TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    )
+  `);
+}
+
+function seedConversationAndMessage(
+  raw: Database,
+  conversationId: string,
+  messageId: string,
+): void {
+  const now = Date.now();
+  raw
+    .query(
+      `INSERT INTO conversations (id, title, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+    )
+    .run(conversationId, "Example", now, now);
+  raw
+    .query(
+      `INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)`,
+    )
+    .run(messageId, conversationId, "user", "hello", now);
+}
+
+function insertBookmark(
+  raw: Database,
+  id: string,
+  messageId: string,
+  conversationId: string,
+): void {
+  raw
+    .query(
+      `INSERT INTO message_bookmarks (id, message_id, conversation_id, created_at) VALUES (?, ?, ?, ?)`,
+    )
+    .run(id, messageId, conversationId, Date.now());
+}
+
+function countBookmarks(raw: Database): number {
+  const row = raw
+    .query(`SELECT COUNT(*) AS n FROM message_bookmarks`)
+    .get() as CountRow | null;
+  return row?.n ?? 0;
+}
+
+describe("message_bookmarks schema migration", () => {
+  test("creates table with expected columns and indexes", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+    bootstrapMessageTables(raw);
+
+    migrateMessageBookmarks(db);
+
+    const columns = raw
+      .query(`PRAGMA table_info(message_bookmarks)`)
+      .all() as ColumnRow[];
+    const byName = new Map(columns.map((c) => [c.name, c]));
+    expect(byName.get("id")?.pk).toBe(1);
+    expect(byName.get("id")?.type).toBe("TEXT");
+    expect(byName.get("message_id")?.notnull).toBe(1);
+    expect(byName.get("conversation_id")?.notnull).toBe(1);
+    expect(byName.get("created_at")?.notnull).toBe(1);
+    expect(byName.get("created_at")?.type).toBe("INTEGER");
+
+    const indexes = raw
+      .query(`PRAGMA index_list(message_bookmarks)`)
+      .all() as IndexInfoRow[];
+    const indexByName = new Map(indexes.map((i) => [i.name, i]));
+    const uniqIndex = indexByName.get("message_bookmarks_message_id_uniq");
+    expect(uniqIndex).toBeDefined();
+    expect(uniqIndex?.unique).toBe(1);
+    expect(indexByName.get("message_bookmarks_created_at_idx")).toBeDefined();
+  });
+
+  test("CASCADE removes bookmark when parent message is deleted", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+    bootstrapMessageTables(raw);
+    migrateMessageBookmarks(db);
+
+    seedConversationAndMessage(raw, "conv-1", "msg-1");
+    insertBookmark(raw, "bm-1", "msg-1", "conv-1");
+    expect(countBookmarks(raw)).toBe(1);
+
+    raw.query(`DELETE FROM messages WHERE id = ?`).run("msg-1");
+    expect(countBookmarks(raw)).toBe(0);
+  });
+
+  test("CASCADE removes bookmark when parent conversation is deleted", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+    bootstrapMessageTables(raw);
+    migrateMessageBookmarks(db);
+
+    seedConversationAndMessage(raw, "conv-2", "msg-2");
+    insertBookmark(raw, "bm-2", "msg-2", "conv-2");
+    expect(countBookmarks(raw)).toBe(1);
+
+    raw.query(`DELETE FROM conversations WHERE id = ?`).run("conv-2");
+    // Deleting the conversation cascades to messages, which cascades to
+    // bookmarks. Either FK alone would suffice; both fire here.
+    expect(countBookmarks(raw)).toBe(0);
+  });
+
+  test("unique constraint on message_id rejects a second bookmark", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+    bootstrapMessageTables(raw);
+    migrateMessageBookmarks(db);
+
+    seedConversationAndMessage(raw, "conv-3", "msg-3");
+    insertBookmark(raw, "bm-3a", "msg-3", "conv-3");
+
+    expect(() => insertBookmark(raw, "bm-3b", "msg-3", "conv-3")).toThrow();
+    expect(countBookmarks(raw)).toBe(1);
+  });
+});

package/src/memory/__tests__/conversation-types.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from "bun:test";
+
+import { isBackgroundConversationType } from "../conversation-types.js";
+
+describe("isBackgroundConversationType", () => {
+  test("returns true for background", () => {
+    expect(isBackgroundConversationType("background")).toBe(true);
+  });
+
+  test("returns true for scheduled", () => {
+    expect(isBackgroundConversationType("scheduled")).toBe(true);
+  });
+
+  test("returns false for standard", () => {
+    expect(isBackgroundConversationType("standard")).toBe(false);
+  });
+
+  test("returns false for null", () => {
+    expect(isBackgroundConversationType(null)).toBe(false);
+  });
+
+  test("returns false for undefined", () => {
+    expect(isBackgroundConversationType(undefined)).toBe(false);
+  });
+
+  test("returns false for empty string", () => {
+    expect(isBackgroundConversationType("")).toBe(false);
+  });
+
+  test.each(["chat", "foo", "BACKGROUND", "Scheduled", " background "])(
+    "returns false for unknown string %p",
+    (value) => {
+      expect(isBackgroundConversationType(value)).toBe(false);
+    },
+  );
+});