@vellumai/assistant 0.8.0 → 0.8.2

package/src/memory/bookmark-crud.ts

@@ -0,0 +1,211 @@
+import { desc, eq } from "drizzle-orm";
+import { v4 as uuid } from "uuid";
+
+import type { DrizzleDb } from "./db-connection.js";
+import { stringifyMessageContent } from "./message-content.js";
+import { conversations, messageBookmarks, messages } from "./schema.js";
+
+/**
+ * Wire-shape representation of a bookmark, joined with the bookmarked
+ * message and its parent conversation. Mirrors
+ * `clients/shared/Network/BookmarkSummary.swift` — dates are emitted as
+ * unix-millisecond integers, and the message preview is capped to keep
+ * the list payload bounded.
+ */
+export interface BookmarkSummary {
+  id: string;
+  messageId: string;
+  conversationId: string;
+  conversationTitle: string | null;
+  messagePreview: string;
+  /** "user" | "assistant" — kept as a free-form string so it round-trips raw. */
+  messageRole: string;
+  /** Unix milliseconds. */
+  messageCreatedAt: number;
+  /** Unix milliseconds. */
+  createdAt: number;
+}
+
+const PREVIEW_MAX_CHARS = 240;
+
+/**
+ * Decode the on-disk message content (legacy plain string OR JSON-serialized
+ * `ContentBlock[]`) into a single text string and cap it at
+ * `PREVIEW_MAX_CHARS`. Without the decode step, modern rows would render as
+ * raw JSON in the bookmark list.
+ */
+function buildPreview(content: string): string {
+  const text = stringifyMessageContent(content);
+  return text.length > PREVIEW_MAX_CHARS
+    ? text.slice(0, PREVIEW_MAX_CHARS)
+    : text;
+}
+
+/**
+ * Shared SELECT shape used by the JOIN-based readers. Pulling this out
+ * avoids duplicating the column list and the row-mapping below.
+ */
+const BOOKMARK_JOIN_COLUMNS = {
+  id: messageBookmarks.id,
+  messageId: messageBookmarks.messageId,
+  conversationId: messageBookmarks.conversationId,
+  createdAt: messageBookmarks.createdAt,
+  conversationTitle: conversations.title,
+  messageContent: messages.content,
+  messageRole: messages.role,
+  messageCreatedAt: messages.createdAt,
+} as const;
+
+type BookmarkJoinRow = {
+  id: string;
+  messageId: string;
+  conversationId: string;
+  createdAt: number;
+  conversationTitle: string | null;
+  messageContent: string;
+  messageRole: string;
+  messageCreatedAt: number;
+};
+
+function rowToSummary(row: BookmarkJoinRow): BookmarkSummary {
+  return {
+    id: row.id,
+    messageId: row.messageId,
+    conversationId: row.conversationId,
+    conversationTitle: row.conversationTitle,
+    messagePreview: buildPreview(row.messageContent),
+    messageRole: row.messageRole,
+    messageCreatedAt: row.messageCreatedAt,
+    createdAt: row.createdAt,
+  };
+}
+
+function selectBookmarkJoin(db: DrizzleDb) {
+  return db
+    .select(BOOKMARK_JOIN_COLUMNS)
+    .from(messageBookmarks)
+    .innerJoin(messages, eq(messages.id, messageBookmarks.messageId))
+    .innerJoin(
+      conversations,
+      eq(conversations.id, messageBookmarks.conversationId),
+    );
+}
+
+/**
+ * List all bookmarks newest-first, joined against `messages` and
+ * `conversations`. Bookmarks whose parent message or conversation has
+ * been deleted are naturally excluded by the inner-join semantics; the
+ * `ON DELETE CASCADE` on the FKs means rows should never end up in this
+ * orphan state, but the join provides a defense-in-depth guarantee.
+ */
+export function listBookmarks(db: DrizzleDb): BookmarkSummary[] {
+  const rows = selectBookmarkJoin(db)
+    .orderBy(desc(messageBookmarks.createdAt))
+    .all();
+  return rows.map(rowToSummary);
+}
+
+/**
+ * Discriminated result returned by {@link createBookmark}. `inserted`
+ * distinguishes a brand-new row from an idempotent return of an existing
+ * one, so callers can suppress side effects (e.g. `bookmark.created` SSE
+ * publishes) on duplicate POSTs.
+ */
+export type CreateBookmarkResult =
+  | { inserted: true; bookmark: BookmarkSummary }
+  | { inserted: false; bookmark: BookmarkSummary };
+
+/**
+ * Create a bookmark for the given message and return a discriminated
+ * result indicating whether a new row was actually inserted. Idempotent
+ * on the unique `message_id` index — if a bookmark already exists for
+ * `messageId`, the existing summary is returned with `inserted: false`.
+ *
+ * `conversationId` is derived from the message row rather than trusted from
+ * the caller, so a buggy or malicious caller cannot persist a bookmark
+ * whose `conversationId` disagrees with the message's actual conversation.
+ */
+export function createBookmark(
+  db: DrizzleDb,
+  params: { messageId: string },
+): CreateBookmarkResult {
+  const { messageId } = params;
+  const message = db
+    .select({ conversationId: messages.conversationId })
+    .from(messages)
+    .where(eq(messages.id, messageId))
+    .get();
+  if (!message) {
+    throw new Error(`Message ${messageId} not found`);
+  }
+  const conversationId = message.conversationId;
+
+  const existing = db
+    .select({ id: messageBookmarks.id })
+    .from(messageBookmarks)
+    .where(eq(messageBookmarks.messageId, messageId))
+    .get();
+  if (existing) {
+    return {
+      inserted: false,
+      bookmark: readBookmarkSummaryOrThrow(db, existing.id),
+    };
+  }
+
+  const id = uuid();
+  try {
+    db.insert(messageBookmarks)
+      .values({ id, messageId, conversationId, createdAt: Date.now() })
+      .run();
+  } catch (err) {
+    // Lost a race against a concurrent create — fall back to fetch by
+    // messageId so we still return the winning row.
+    const winner = db
+      .select({ id: messageBookmarks.id })
+      .from(messageBookmarks)
+      .where(eq(messageBookmarks.messageId, messageId))
+      .get();
+    if (!winner) throw err;
+    return {
+      inserted: false,
+      bookmark: readBookmarkSummaryOrThrow(db, winner.id),
+    };
+  }
+  return { inserted: true, bookmark: readBookmarkSummaryOrThrow(db, id) };
+}
+
+function readBookmarkSummaryOrThrow(
+  db: DrizzleDb,
+  id: string,
+): BookmarkSummary {
+  const row = selectBookmarkJoin(db).where(eq(messageBookmarks.id, id)).get();
+  if (!row) {
+    // Unreachable: caller just observed (or inserted) this id.
+    throw new Error(`Bookmark ${id} disappeared between insert and read`);
+  }
+  return rowToSummary(row);
+}
+
+/**
+ * Delete the bookmark (if any) attached to the given `messageId`.
+ * Returns true iff a row was removed.
+ *
+ * Drizzle's high-level `.run()` is typed as `void` for the sync sqlite
+ * driver, so we check existence with a follow-up SELECT instead of
+ * relying on a row-count from the delete statement.
+ */
+export function deleteBookmarkByMessageId(
+  db: DrizzleDb,
+  messageId: string,
+): boolean {
+  const existed = db
+    .select({ id: messageBookmarks.id })
+    .from(messageBookmarks)
+    .where(eq(messageBookmarks.messageId, messageId))
+    .get();
+  if (!existed) return false;
+  db.delete(messageBookmarks)
+    .where(eq(messageBookmarks.messageId, messageId))
+    .run();
+  return true;
+}

package/src/memory/context-search/__tests__/agent-runner-redaction.test.ts

@@ -4,7 +4,7 @@
  *
  * `redactWorkspaceEvidence` scrubs secrets from workspace-sourced evidence
  * excerpts before they are serialised into the prompt that is sent to the
- * external recall LLM provider. Memory/PKB/conversation evidence is left
+ * external recall LLM provider. Memory/conversation evidence is left
  * untouched — those sources contain intentionally stored user content.
  */
 
@@ -65,7 +65,10 @@ describe("redactWorkspaceEvidence", () => {
 
   test("does NOT modify non-secret workspace excerpts", () => {
     const safeContent = "This is a normal comment explaining the architecture.";
-    const original = makeEvidence({ source: "workspace", excerpt: safeContent });
+    const original = makeEvidence({
+      source: "workspace",
+      excerpt: safeContent,
+    });
     const [result] = redactWorkspaceEvidence([original]);
 
     expect(result.excerpt).toBe(safeContent);
@@ -74,11 +77,11 @@ describe("redactWorkspaceEvidence", () => {
   });
 
   test("does NOT redact non-workspace sources", () => {
-    // Memory/PKB/conversation evidence is intentionally stored user content —
+    // Memory/conversation evidence is intentionally stored user content —
     // redacting it would break recall for things the user deliberately noted.
     const secretLike = "token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.abc";
 
-    for (const source of ["memory", "pkb", "conversations"] as const) {
+    for (const source of ["memory", "conversations"] as const) {
       const original = makeEvidence({ source, excerpt: secretLike });
       const [result] = redactWorkspaceEvidence([original]);
 
@@ -89,8 +92,16 @@ describe("redactWorkspaceEvidence", () => {
 
   test("redacts multiple secrets across multiple workspace evidence items", () => {
     const results = redactWorkspaceEvidence([
-      makeEvidence({ id: "ev-1", source: "workspace", excerpt: `key=${ANTHROPIC_KEY}` }),
-      makeEvidence({ id: "ev-2", source: "workspace", excerpt: GENERIC_SECRET_EXCERPT }),
+      makeEvidence({
+        id: "ev-1",
+        source: "workspace",
+        excerpt: `key=${ANTHROPIC_KEY}`,
+      }),
+      makeEvidence({
+        id: "ev-2",
+        source: "workspace",
+        excerpt: GENERIC_SECRET_EXCERPT,
+      }),
     ]);
 
     expect(results[0].excerpt).not.toContain(ANTHROPIC_KEY);
@@ -101,7 +112,10 @@ describe("redactWorkspaceEvidence", () => {
 
   test("does not mutate the original evidence objects", () => {
     const secret = ANTHROPIC_KEY;
-    const original = makeEvidence({ source: "workspace", excerpt: `key=${secret}` });
+    const original = makeEvidence({
+      source: "workspace",
+      excerpt: `key=${secret}`,
+    });
     const originalExcerpt = original.excerpt;
 
     redactWorkspaceEvidence([original]);
@@ -111,8 +125,16 @@ describe("redactWorkspaceEvidence", () => {
 
   test("handles mixed sources in one batch correctly", () => {
     const secret = ANTHROPIC_KEY;
-    const wsItem = makeEvidence({ id: "ev-ws", source: "workspace", excerpt: `key=${secret}` });
-    const memItem = makeEvidence({ id: "ev-mem", source: "memory", excerpt: `key=${secret}` });
+    const wsItem = makeEvidence({
+      id: "ev-ws",
+      source: "workspace",
+      excerpt: `key=${secret}`,
+    });
+    const memItem = makeEvidence({
+      id: "ev-mem",
+      source: "memory",
+      excerpt: `key=${secret}`,
+    });
 
     const [wsResult, memResult] = redactWorkspaceEvidence([wsItem, memItem]);
 

package/src/memory/context-search/agent-protocol.ts

@@ -34,6 +34,7 @@ type RecallFinishFallbackReason =
   | "malformed_finish_payload"
   | "invalid_confidence"
   | "invalid_citation_ids"
+  | "missing_citations"
   | "unknown_citation_ids"
   | "empty_answer";
 
@@ -57,7 +58,6 @@ const DEFAULT_MAX_SEARCH_CALLS = 4;
 
 const RECALL_SOURCE_DESCRIPTIONS: Record<RecallSource, string> = {
   memory: "durable memory graph facts and relationship/context memories",
-  pkb: "personal knowledge base notes, NOW context, and pinned context",
   conversations: "past assistant conversations and conversation summaries",
   workspace: "files and text available in the current workspace",
 };
@@ -293,6 +293,10 @@ export function validateFinishRecallPayload(
     return fallbackFinish("invalid_citation_ids");
   }
 
+  if (payload.citation_ids.length === 0) {
+    return fallbackFinish("missing_citations");
+  }
+
   const citationValidation = validateRecallCitationIds(
     payload.citation_ids,
     evidence,

package/src/memory/context-search/agent-runner.ts

@@ -27,13 +27,13 @@ import {
 import {
   type DeterministicRecallSearchOptions,
   type DeterministicRecallSearchResult,
-  isAutoInjectedPkbContextEvidence,
   runDeterministicRecallSearch,
 } from "./search.js";
 import {
   extractWorkspacePathLiterals,
   inspectWorkspacePaths,
   isSafeWorkspaceRelativePath,
+  normalizeWorkspacePathLiteral,
 } from "./sources/workspace.js";
 import type {
   RecallAnswer,
@@ -214,19 +214,6 @@ const FINISH_NEGATIVE_PATTERNS = [
   /\bno text\b/i,
 ];
 
-const PKB_RELATIVE_PATH_PREFIXES = [
-  "archive/",
-  "dpo/",
-  "essentials.md",
-  "INDEX.md",
-  "intimate/",
-  "people/",
-  "preferences/",
-  "procedures/",
-  "schedule/",
-  "us-arcs/",
-];
-
 export async function runAgenticRecall(
   input: RecallInput,
   context: RecallSearchContext,
@@ -429,7 +416,7 @@ export async function runAgenticRecall(
  * Redact secrets from workspace-sourced evidence excerpts before they are
  * serialised into a prompt that will be sent to an external LLM provider.
  *
- * Memory, PKB, and conversation evidence is already controlled content —
+ * Memory and conversation evidence is already controlled content —
  * only workspace files can contain arbitrary secrets (API keys, tokens, etc.)
  * written by the user or by tools. This runs the same pattern-based scanner
  * used for shell command summaries and approval prompts, replacing any
@@ -499,7 +486,7 @@ async function runSeedRecallSearch(
       context,
       searchOptions,
     );
-    evidence = mergeEvidence(expansionResult.evidence, evidence);
+    evidence = mergeEvidence(evidence, expansionResult.evidence);
   }
 
   return withFallbackEvidence(baseResult, evidence);
@@ -694,6 +681,13 @@ function finishRecallFromToolUse(
   }
 
   const citedEvidence = selectCitedEvidence(promptEvidence, finish.citationIds);
+  if (citedEvidence.length === 0) {
+    return {
+      ok: false,
+      reason: "citation_validation_failed",
+      detail: "finish_recall returned no resolvable citations",
+    };
+  }
   debug.finish = {
     confidence: finish.confidence,
     citationIds: finish.citationIds,
@@ -960,14 +954,16 @@ async function executeInspectWorkspacePaths(
 }> {
   const reason = readSearchReason(payload.reason);
   const requestedPaths = readInspectPaths(payload.paths);
-  const allowedPaths = collectInspectableWorkspacePaths(input.query, evidence);
+  const workspaceSourceEnabled = input.sources.includes("workspace");
+  const allowedPaths = workspaceSourceEnabled
+    ? collectInspectableWorkspacePaths(input.query, evidence)
+    : new Set<string>();
   const acceptedPaths: string[] = [];
   const rejectedPaths: string[] = [];
   for (const requestedPath of requestedPaths) {
-    const acceptedPath = normalizeRequestedWorkspaceInspectionPath(
-      requestedPath,
-      allowedPaths,
-    );
+    const acceptedPath = workspaceSourceEnabled
+      ? normalizeRequestedWorkspaceInspectionPath(requestedPath, allowedPaths)
+      : null;
     if (acceptedPath) {
       acceptedPaths.push(acceptedPath);
     } else {
@@ -994,6 +990,7 @@ async function executeInspectWorkspacePaths(
       ],
       debug: {
         ...debug,
+        evidenceCount: 1,
         errors: [
           {
             path: "inspect_workspace_paths",
@@ -1006,8 +1003,9 @@ async function executeInspectWorkspacePaths(
 
   const errors = rejectedPaths.map((path) => ({
     path,
-    reason:
-      "path was not a safe relative workspace file surfaced by the query or prior evidence",
+    reason: workspaceSourceEnabled
+      ? "path was not a safe relative workspace file surfaced by the query or prior evidence"
+      : "workspace source is disabled for this recall request",
   }));
 
   let inspectionEvidence: RecallEvidence[] = [];
@@ -1049,7 +1047,7 @@ async function runAutomaticWorkspaceInspection(
   evidence: RecallEvidence[];
   debug?: AgenticRecallInspectDebug;
 }> {
-  if (!input.sources.includes("workspace") && !input.sources.includes("pkb")) {
+  if (!input.sources.includes("workspace")) {
     return { evidence: [] };
   }
 
@@ -1113,7 +1111,7 @@ function collectAutomaticWorkspaceInspectionPaths(
   for (const item of evidence) {
     collectEvidenceWorkspacePaths(item).forEach((path) => paths.add(path));
   }
-  return [...paths].filter(isSafeWorkspaceRelativePath).slice(0, 3);
+  return [...paths].slice(0, 3);
 }
 
 function collectInspectableWorkspacePaths(
@@ -1128,62 +1126,33 @@ function collectInspectableWorkspacePaths(
 }
 
 function collectEvidenceWorkspacePaths(item: RecallEvidence): string[] {
-  if (isAutoInjectedPkbContextEvidence(item)) {
-    return [];
-  }
-
-  const rawPaths = new Set<string>();
+  const paths = new Set<string>();
   const metadataPath = item.metadata?.path;
-  if (typeof metadataPath === "string") {
-    rawPaths.add(metadataPath);
+  if (
+    typeof metadataPath === "string" &&
+    isSafeWorkspaceRelativePath(metadataPath)
+  ) {
+    paths.add(metadataPath);
   }
   for (const text of [item.locator, item.title, item.excerpt]) {
     for (const path of extractWorkspacePathLiterals(text)) {
-      rawPaths.add(path);
-    }
-  }
-
-  const paths: string[] = [];
-  for (const rawPath of rawPaths) {
-    for (const path of normalizeEvidenceWorkspacePath(rawPath, item.source)) {
       if (isSafeWorkspaceRelativePath(path)) {
-        paths.push(path);
+        paths.add(path);
       }
     }
   }
-  return [...new Set(paths)];
+  return [...paths];
 }
 
 function normalizeRequestedWorkspaceInspectionPath(
   requestedPath: string,
   allowedPaths: ReadonlySet<string>,
 ): string | null {
-  const pkbPrefixedPath = `pkb/${requestedPath}`;
-  if (!requestedPath.startsWith("pkb/") && allowedPaths.has(pkbPrefixedPath)) {
-    return pkbPrefixedPath;
-  }
-
-  if (allowedPaths.has(requestedPath)) {
-    return requestedPath;
-  }
-
-  return null;
-}
-
-function normalizeEvidenceWorkspacePath(
-  path: string,
-  source: RecallSource,
-): string[] {
-  if (path.startsWith("pkb/")) {
-    return [path];
-  }
-  if (
-    source === "pkb" ||
-    PKB_RELATIVE_PATH_PREFIXES.some((prefix) => path.startsWith(prefix))
-  ) {
-    return [`pkb/${path}`];
+  const normalized = normalizeWorkspacePathLiteral(requestedPath);
+  if (!normalized) {
+    return null;
   }
-  return [path];
+  return allowedPaths.has(normalized) ? normalized : null;
 }
 
 function makeWorkspaceInspectionErrorEvidence(options: {
@@ -1240,24 +1209,7 @@ function mergeEvidence(
     merged.push(item);
   }
 
-  return demoteAutoInjectedContextEvidence(merged);
-}
-
-function demoteAutoInjectedContextEvidence(
-  evidence: readonly RecallEvidence[],
-): RecallEvidence[] {
-  const regularEvidence: RecallEvidence[] = [];
-  const autoInjectedContextEvidence: RecallEvidence[] = [];
-
-  for (const item of evidence) {
-    if (isAutoInjectedPkbContextEvidence(item)) {
-      autoInjectedContextEvidence.push(item);
-    } else {
-      regularEvidence.push(item);
-    }
-  }
-
-  return [...regularEvidence, ...autoInjectedContextEvidence];
+  return merged;
 }
 
 function toRecallInput(input: NormalizedRecallInput): RecallInput {
@@ -1284,7 +1236,7 @@ function withFallbackEvidence(
   result: DeterministicRecallSearchResult,
   evidence: readonly RecallEvidence[],
 ): DeterministicRecallSearchResult {
-  const orderedEvidence = demoteAutoInjectedContextEvidence(evidence);
+  const orderedEvidence = dedupeEvidenceByContent(evidence);
   const evidenceCountBySource = new Map<RecallSource, number>();
   for (const item of orderedEvidence) {
     evidenceCountBySource.set(
@@ -1303,6 +1255,29 @@ function withFallbackEvidence(
   };
 }
 
+function dedupeEvidenceByContent(
+  evidence: readonly RecallEvidence[],
+): RecallEvidence[] {
+  const seenIds = new Set<string>();
+  const seenContent = new Set<string>();
+  const deduped: RecallEvidence[] = [];
+
+  for (const item of evidence) {
+    if (seenIds.has(item.id)) {
+      continue;
+    }
+    const contentKey = `${item.source}\0${item.locator}\0${item.excerpt}`;
+    if (seenContent.has(contentKey)) {
+      continue;
+    }
+    seenIds.add(item.id);
+    seenContent.add(contentKey);
+    deduped.push(item);
+  }
+
+  return deduped;
+}
+
 function deterministicFallback(
   result: DeterministicRecallSearchResult,
   debug: AgenticRecallDebug,

package/src/memory/context-search/limits.ts

@@ -2,7 +2,6 @@ import type { RecallDepth, RecallInput, RecallSource } from "./types.js";
 
 export const ALL_RECALL_SOURCES: readonly RecallSource[] = [
   "memory",
-  "pkb",
   "conversations",
   "workspace",
 ] as const;
@@ -81,9 +80,7 @@ export function normalizeRecallMaxResults(
   );
 }
 
-function normalizeRecallDepth(
-  depth: RecallDepth | undefined,
-): RecallDepth {
+function normalizeRecallDepth(depth: RecallDepth | undefined): RecallDepth {
   if (depth === undefined) {
     return DEFAULT_RECALL_DEPTH;
   }