@vellumai/assistant 0.8.1 → 0.8.2

package/src/memory/conversation-queries.ts

@@ -1,5 +1,11 @@
 import { and, count, desc, eq, sql } from "drizzle-orm";
 
+import {
+  parseExternalContentEnvelope,
+  type UntrustedContentSource,
+  unwrapExternalContentForDisplay,
+  wrapUntrustedContent,
+} from "../security/untrusted-content.js";
 import { getLogger } from "../util/logger.js";
 import type { ConversationRow } from "./conversation-crud.js";
 import { parseConversation } from "./conversation-crud.js";
@@ -55,9 +61,14 @@ export function listConversations(
   // SQLite file without running migrations in-process, so legacy private rows
   // can briefly exist before migration cleanup. Hide them from foreground
   // lists until the next migration pass deletes them.
+  //
+  // group_id is checked alongside conversationType so that conversations
+  // routed to system:background (e.g. heartbeat) via conversationMetadata
+  // but created with conversationType "standard" (vellum channel strategy)
+  // appear in the correct bucket.
   const typeCond = backgroundOnly
-    ? sql`${conversations.conversationType} IN ('background', 'scheduled') AND (${conversations.source} IS NULL OR ${conversations.source} != 'subagent')`
-    : sql`${conversations.conversationType} NOT IN ('background', 'scheduled', 'private')`;
+    ? sql`(${conversations.conversationType} IN ('background', 'scheduled') OR group_id IN ('system:background', 'system:scheduled')) AND (${conversations.source} IS NULL OR ${conversations.source} != 'subagent')`
+    : sql`${conversations.conversationType} NOT IN ('background', 'scheduled', 'private') AND COALESCE(group_id, 'system:all') NOT IN ('system:background', 'system:scheduled')`;
   const where = includeArchived
     ? typeCond
     : sql`${typeCond} AND ${conversations.archivedAt} IS NULL`;
@@ -151,10 +162,11 @@ export function listConversationsByTitlePrefix(
 }
 
 export function countConversations(backgroundOnly = false): number {
+  ensureGroupMigration();
   const db = getDb();
   const where = backgroundOnly
-    ? sql`${conversations.conversationType} IN ('background', 'scheduled') AND (${conversations.source} IS NULL OR ${conversations.source} != 'subagent')`
-    : sql`${conversations.conversationType} NOT IN ('background', 'scheduled')`;
+    ? sql`(${conversations.conversationType} IN ('background', 'scheduled') OR group_id IN ('system:background', 'system:scheduled')) AND (${conversations.source} IS NULL OR ${conversations.source} != 'subagent')`
+    : sql`${conversations.conversationType} NOT IN ('background', 'scheduled', 'private') AND COALESCE(group_id, 'system:all') NOT IN ('system:background', 'system:scheduled')`;
   const [{ total }] = db
     .select({ total: count() })
     .from(conversations)
@@ -233,6 +245,7 @@ export function searchConversations(
 ): ConversationSearchResult[] {
   if (!query.trim()) return [];
 
+  ensureGroupMigration();
   const db = getDb();
   const limit = opts?.limit ?? 20;
   const maxMsgsPerConv = opts?.maxMessagesPerConversation ?? 3;
@@ -262,7 +275,7 @@ export function searchConversations(
         FROM messages_fts f
         JOIN messages m ON m.id = f.message_id
         JOIN conversations c ON c.id = m.conversation_id
-        WHERE messages_fts MATCH ? AND c.conversation_type NOT IN ('background', 'scheduled', 'private') AND c.archived_at IS NULL
+        WHERE messages_fts MATCH ? AND c.conversation_type NOT IN ('background', 'scheduled', 'private') AND COALESCE(c.group_id, 'system:all') NOT IN ('system:background', 'system:scheduled') AND c.archived_at IS NULL
         LIMIT 1000
       `,
         ftsMatch,
@@ -287,7 +300,7 @@ export function searchConversations(
       SELECT DISTINCT m.conversation_id
       FROM messages m
       JOIN conversations c ON c.id = m.conversation_id
-      WHERE m.content LIKE ? ESCAPE '\\' AND c.conversation_type NOT IN ('background', 'scheduled', 'private') AND c.archived_at IS NULL
+      WHERE m.content LIKE ? ESCAPE '\\' AND c.conversation_type NOT IN ('background', 'scheduled', 'private') AND COALESCE(c.group_id, 'system:all') NOT IN ('system:background', 'system:scheduled') AND c.archived_at IS NULL
       LIMIT 1000
     `,
       likePattern,
@@ -302,6 +315,7 @@ export function searchConversations(
     .where(
       and(
         sql`${conversations.conversationType} NOT IN ('background', 'scheduled', 'private')`,
+        sql`COALESCE(group_id, 'system:all') NOT IN ('system:background', 'system:scheduled')`,
         sql`${conversations.title} LIKE ${titlePattern} ESCAPE '\\'`,
         sql`${conversations.archivedAt} IS NULL`,
       ),
@@ -403,29 +417,68 @@ export function searchConversations(
  * text; we extract a readable snippet in either case.
  */
 export function buildExcerpt(rawContent: string, query: string): string {
+  return buildExcerptWithExternalContentMode(rawContent, query, "display");
+}
+
+/**
+ * Build an excerpt for model-facing recall evidence. Unlike display excerpts,
+ * this keeps complete external_content envelopes around untrusted snippets so
+ * the model still sees clear third-party content boundaries.
+ */
+export function buildRecallEvidenceExcerpt(
+  rawContent: string,
+  query: string,
+): string {
+  return buildExcerptWithExternalContentMode(rawContent, query, "preserve");
+}
+
+function buildExcerptWithExternalContentMode(
+  rawContent: string,
+  query: string,
+  externalContentMode: "display" | "preserve",
+): string {
   // Try to extract plain text from JSON content blocks first.
   let text = rawContent;
   try {
     const parsed = JSON.parse(rawContent);
     if (Array.isArray(parsed)) {
       const parts: string[] = [];
+      let preservedExternalContent = false;
       for (const block of parsed) {
         if (typeof block === "object" && block != null) {
           if (block.type === "text" && typeof block.text === "string") {
-            parts.push(block.text);
+            if (externalContentMode === "display") {
+              parts.push(unwrapExternalContentForDisplay(block.text));
+            } else {
+              const excerpt = buildRecallEvidenceText(block.text, query);
+              parts.push(excerpt.text);
+              preservedExternalContent ||= excerpt.preservedExternalContent;
+            }
           } else if (
             block.type === "tool_result" ||
             block.type === "web_search_tool_result"
           ) {
             const inner = Array.isArray(block.content) ? block.content : [];
             for (const ib of inner) {
-              if (ib?.type === "text" && typeof ib.text === "string")
-                parts.push(ib.text);
+              if (ib?.type === "text" && typeof ib.text === "string") {
+                if (externalContentMode === "display") {
+                  parts.push(unwrapExternalContentForDisplay(ib.text));
+                } else {
+                  const excerpt = buildRecallEvidenceText(ib.text, query);
+                  parts.push(excerpt.text);
+                  preservedExternalContent ||= excerpt.preservedExternalContent;
+                }
+              }
             }
           }
         }
       }
-      if (parts.length > 0) text = parts.join(" ");
+      if (parts.length > 0) {
+        text = parts.join(" ");
+        if (externalContentMode === "preserve" && preservedExternalContent) {
+          return text;
+        }
+      }
     } else if (typeof parsed === "string") {
       text = parsed;
     }
@@ -433,6 +486,53 @@ export function buildExcerpt(rawContent: string, query: string): string {
     // Not JSON — use as-is
   }
 
+  if (externalContentMode === "display") {
+    text = unwrapExternalContentForDisplay(text);
+  } else {
+    const envelope = parseExternalContentEnvelope(text);
+    if (envelope) {
+      const innerExcerpt = buildExcerptFromText(envelope.content, query);
+      return wrapRecallEvidenceExcerpt(
+        innerExcerpt,
+        envelope.source,
+        envelope.origin,
+      );
+    }
+  }
+
+  return buildExcerptFromText(text, query);
+}
+
+function buildRecallEvidenceText(
+  text: string,
+  query: string,
+): { text: string; preservedExternalContent: boolean } {
+  const envelope = parseExternalContentEnvelope(text);
+  if (!envelope) {
+    return { text, preservedExternalContent: false };
+  }
+  const innerExcerpt = buildExcerptFromText(envelope.content, query);
+  return {
+    text: wrapRecallEvidenceExcerpt(
+      innerExcerpt,
+      envelope.source,
+      envelope.origin,
+    ),
+    preservedExternalContent: true,
+  };
+}
+
+function wrapRecallEvidenceExcerpt(
+  excerpt: string,
+  source: UntrustedContentSource,
+  origin?: string,
+): string {
+  return origin
+    ? wrapUntrustedContent(excerpt, { source, sourceDetail: origin })
+    : wrapUntrustedContent(excerpt, { source });
+}
+
+function buildExcerptFromText(text: string, query: string): string {
   const WINDOW = 100;
   const lowerText = text.toLowerCase();
   const lowerQuery = query.toLowerCase();

package/src/memory/db-init.ts

@@ -32,6 +32,7 @@ import {
   createMessagesFts,
   createNotificationTables,
   createOAuthTables,
+  createOnboardingEventsTable,
   createScopedApprovalGrantsTable,
   createSequenceTables,
   createTasksAndWorkItemsTables,
@@ -94,6 +95,7 @@ import {
   migrateDropSetupSkillIdColumn,
   migrateDropSimplifiedMemory,
   migrateDropUsageCompositeIndexes,
+  migrateExternalConversationBindingThreadId,
   migrateFkCascadeRebuilds,
   migrateGuardianActionFollowup,
   migrateGuardianActionSupersession,
@@ -122,6 +124,7 @@ import {
   migrateMessagesConversationCreatedAtIndex,
   migrateMessagesFtsBackfill,
   migrateNormalizePhoneIdentities,
+  migrateNormalizeSlackExternalContent,
   migrateNormalizeUserFileByPrincipal,
   migrateNotificationDeliveryThreadDecision,
   migrateOAuthAppsClientSecretPath,
@@ -424,6 +427,9 @@ export function initializeDb(): void {
     migrateProviderConnectionStatusLabel,
     migrateMemoryRetrospectiveState,
     migrateBackfillProviderConnectionLabel,
+    migrateExternalConversationBindingThreadId,
+    createOnboardingEventsTable,
+    migrateNormalizeSlackExternalContent,
   ];
 
   // Run each migration step, catching and logging individual failures so one

package/src/memory/delivery-crud.ts

@@ -5,11 +5,17 @@
  * finding messages by source identifiers, and managing raw payload storage.
  */
 
-import { and, eq, isNotNull } from "drizzle-orm";
+import { and, eq, isNotNull, or } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
+import { readSlackMetadataFromMessageMetadata } from "../messaging/providers/slack/message-metadata.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
-import { getOrCreateConversation } from "./conversation-key-store.js";
+import { selectSlackMetaCandidateMetadata } from "./conversation-crud.js";
+import {
+  getConversationByKey,
+  getOrCreateConversation,
+  setConversationKeyIfAbsent,
+} from "./conversation-key-store.js";
 import { getDb } from "./db-connection.js";
 import { channelInboundEvents, conversations } from "./schema.js";
 
@@ -23,6 +29,144 @@ export interface InboundResult {
 export interface RecordInboundOptions {
   sourceMessageId?: string;
   assistantId?: string;
+  sourceThreadId?: string;
+}
+
+const SLACK_LEGACY_THREAD_EVIDENCE_BATCH_SIZE = 50;
+const SLACK_LEGACY_THREAD_EVIDENCE_MAX_SCAN = 500;
+
+function buildScopedConversationKeyForAssistant(
+  assistantId: string,
+  sourceChannel: string,
+  externalChatId: string,
+  sourceThreadId?: string | null,
+): string {
+  const threadId = sourceThreadId?.trim();
+  if (sourceChannel === "slack" && threadId) {
+    return `asst:${assistantId}:${sourceChannel}:${externalChatId}:thread:${threadId}`;
+  }
+  return `asst:${assistantId}:${sourceChannel}:${externalChatId}`;
+}
+
+export function buildScopedConversationKey(
+  sourceChannel: string,
+  externalChatId: string,
+  sourceThreadId?: string | null,
+): string {
+  return buildScopedConversationKeyForAssistant(
+    DAEMON_INTERNAL_ASSISTANT_ID,
+    sourceChannel,
+    externalChatId,
+    sourceThreadId,
+  );
+}
+
+function legacySlackConversationHasThreadEvidence(
+  conversationId: string,
+  externalChatId: string,
+  sourceThreadId: string,
+): boolean {
+  const db = getDb();
+  const inboundEvidence = db
+    .select({ id: channelInboundEvents.id })
+    .from(channelInboundEvents)
+    .where(
+      and(
+        eq(channelInboundEvents.conversationId, conversationId),
+        eq(channelInboundEvents.sourceChannel, "slack"),
+        eq(channelInboundEvents.externalChatId, externalChatId),
+        or(
+          eq(channelInboundEvents.sourceMessageId, sourceThreadId),
+          eq(channelInboundEvents.externalMessageId, sourceThreadId),
+        ),
+      ),
+    )
+    .get();
+
+  if (inboundEvidence) {
+    return true;
+  }
+
+  let offset = 0;
+  while (offset < SLACK_LEGACY_THREAD_EVIDENCE_MAX_SCAN) {
+    const remaining = SLACK_LEGACY_THREAD_EVIDENCE_MAX_SCAN - offset;
+    const batchLimit = Math.min(
+      SLACK_LEGACY_THREAD_EVIDENCE_BATCH_SIZE,
+      remaining,
+    );
+    const metadataRows = selectSlackMetaCandidateMetadata(
+      conversationId,
+      batchLimit,
+      offset,
+      { includeFlatLegacy: true },
+    );
+
+    if (metadataRows.length === 0) return false;
+    for (const metadata of metadataRows) {
+      const slackMeta = readSlackMetadataFromMessageMetadata(metadata, {
+        allowFlatLegacy: true,
+      });
+      if (
+        slackMeta?.channelId === externalChatId &&
+        slackMeta.threadTs === sourceThreadId
+      ) {
+        return true;
+      }
+    }
+
+    if (metadataRows.length < batchLimit) return false;
+    offset += metadataRows.length;
+  }
+
+  return false;
+}
+
+function resolveInboundConversation(
+  assistantId: string,
+  sourceChannel: string,
+  externalChatId: string,
+  sourceThreadId?: string | null,
+): { conversationId: string } {
+  const threadedKey = buildScopedConversationKeyForAssistant(
+    assistantId,
+    sourceChannel,
+    externalChatId,
+    sourceThreadId,
+  );
+
+  const threadId = sourceThreadId?.trim();
+  if (sourceChannel !== "slack" || !threadId) {
+    return getOrCreateConversation(threadedKey);
+  }
+
+  const threadedMapping = getConversationByKey(threadedKey);
+  if (threadedMapping) {
+    return { conversationId: threadedMapping.conversationId };
+  }
+
+  const legacyKey = buildScopedConversationKeyForAssistant(
+    assistantId,
+    sourceChannel,
+    externalChatId,
+    null,
+  );
+  const legacyMapping = getConversationByKey(legacyKey);
+  if (
+    legacyMapping &&
+    legacySlackConversationHasThreadEvidence(
+      legacyMapping.conversationId,
+      externalChatId,
+      threadId,
+    )
+  ) {
+    setConversationKeyIfAbsent(threadedKey, legacyMapping.conversationId);
+    const aliasedMapping = getConversationByKey(threadedKey);
+    if (aliasedMapping) {
+      return { conversationId: aliasedMapping.conversationId };
+    }
+  }
+
+  return getOrCreateConversation(threadedKey);
 }
 
 /**
@@ -62,8 +206,12 @@ export function recordInbound(
   }
 
   const assistantId = options?.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID;
-  const scopedKey = `asst:${assistantId}:${sourceChannel}:${externalChatId}`;
-  const mapping = getOrCreateConversation(scopedKey);
+  const mapping = resolveInboundConversation(
+    assistantId,
+    sourceChannel,
+    externalChatId,
+    options?.sourceThreadId,
+  );
   const now = Date.now();
   const eventId = uuid();
 
@@ -176,4 +324,3 @@ export function clearPayload(eventId: string): void {
     .where(eq(channelInboundEvents.id, eventId))
     .run();
 }
-

package/src/memory/embedding-backend.ts

@@ -4,8 +4,8 @@ import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags
 import { getOllamaBaseUrlEnv } from "../config/env.js";
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import type { AssistantConfig } from "../config/types.js";
-import { MANAGED_PROVIDER_META } from "../providers/managed-proxy/constants.js";
-import { resolveManagedProxyContext } from "../providers/managed-proxy/context.js";
+import { PLATFORM_PROVIDER_META } from "../providers/platform-proxy/constants.js";
+import { resolveManagedProxyContext } from "../providers/platform-proxy/context.js";
 import { getProviderKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
 import { GeminiEmbeddingBackend } from "./embedding-gemini.js";
@@ -311,7 +311,7 @@ export async function selectEmbeddingBackend(
   ) {
     const proxyCtx = await resolveManagedProxyContext();
     if (proxyCtx.enabled) {
-      const meta = MANAGED_PROVIDER_META["gemini"];
+      const meta = PLATFORM_PROVIDER_META["gemini"];
       if (meta?.managed && meta.proxyPath) {
         const managedBaseUrl = `${proxyCtx.platformBaseUrl}${meta.proxyPath}`;
         const managedModel = config.memory.embeddings.geminiModel;
@@ -685,7 +685,7 @@ async function selectFallbackBackends(
         ) {
           // Try managed proxy Gemini as fallback when no direct key exists.
           const proxyCtx = await resolveManagedProxyContext();
-          const meta = MANAGED_PROVIDER_META["gemini"];
+          const meta = PLATFORM_PROVIDER_META["gemini"];
           if (proxyCtx.enabled && meta?.managed && meta.proxyPath) {
             const managedBaseUrl = `${proxyCtx.platformBaseUrl}${meta.proxyPath}`;
             const managedModel = config.memory.embeddings.geminiModel;

package/src/memory/external-conversation-store.ts

@@ -7,7 +7,7 @@
  * list APIs.
  */
 
-import { and, eq, inArray } from "drizzle-orm";
+import { and, eq, inArray, isNull } from "drizzle-orm";
 
 import { getDb } from "./db-connection.js";
 import { externalConversationBindings } from "./schema.js";
@@ -16,6 +16,7 @@ export interface ExternalConversationBinding {
   conversationId: string;
   sourceChannel: string;
   externalChatId: string;
+  externalThreadId?: string | null;
   externalUserId?: string | null;
   displayName?: string | null;
   username?: string | null;
@@ -29,11 +30,19 @@ export interface UpsertBindingInput {
   conversationId: string;
   sourceChannel: string;
   externalChatId: string;
+  externalThreadId?: string | null;
   externalUserId?: string | null;
   displayName?: string | null;
   username?: string | null;
 }
 
+function normalizeExternalThreadId(
+  externalThreadId?: string | null,
+): string | null {
+  const trimmed = externalThreadId?.trim();
+  return trimmed ? trimmed : null;
+}
+
 /**
  * Insert or update an external conversation binding on conflict (conversationId).
  * On conflict, updates channel metadata and timestamps.
@@ -41,12 +50,14 @@ export interface UpsertBindingInput {
 export function upsertBinding(input: UpsertBindingInput): void {
   const db = getDb();
   const now = Date.now();
+  const externalThreadId = normalizeExternalThreadId(input.externalThreadId);
 
-  // If a stale binding exists for this (sourceChannel, externalChatId) under a
+  // If a stale binding exists for this channel/chat/thread tuple under a
   // different conversationId, remove it first so the unique index is not violated.
-  const existing = getBindingByChannelChat(
+  const existing = getBindingByChannelChatThread(
     input.sourceChannel,
     input.externalChatId,
+    externalThreadId,
   );
   if (existing && existing.conversationId !== input.conversationId) {
     db.delete(externalConversationBindings)
@@ -64,6 +75,7 @@ export function upsertBinding(input: UpsertBindingInput): void {
       conversationId: input.conversationId,
       sourceChannel: input.sourceChannel,
       externalChatId: input.externalChatId,
+      externalThreadId,
       externalUserId: input.externalUserId ?? null,
       displayName: input.displayName ?? null,
       username: input.username ?? null,
@@ -76,6 +88,7 @@ export function upsertBinding(input: UpsertBindingInput): void {
       set: {
         sourceChannel: input.sourceChannel,
         externalChatId: input.externalChatId,
+        externalThreadId,
         externalUserId: input.externalUserId ?? null,
         displayName: input.displayName ?? null,
         username: input.username ?? null,
@@ -95,15 +108,18 @@ export function upsertOutboundBinding(input: {
   conversationId: string;
   sourceChannel: string;
   externalChatId: string;
+  externalThreadId?: string | null;
 }): void {
   const db = getDb();
   const now = Date.now();
+  const externalThreadId = normalizeExternalThreadId(input.externalThreadId);
 
-  // If a stale binding exists for this (sourceChannel, externalChatId) under a
+  // If a stale binding exists for this channel/chat/thread tuple under a
   // different conversationId, remove it first so the unique index is not violated.
-  const existing = getBindingByChannelChat(
+  const existing = getBindingByChannelChatThread(
     input.sourceChannel,
     input.externalChatId,
+    externalThreadId,
   );
   if (existing && existing.conversationId !== input.conversationId) {
     db.delete(externalConversationBindings)
@@ -121,6 +137,7 @@ export function upsertOutboundBinding(input: {
       conversationId: input.conversationId,
       sourceChannel: input.sourceChannel,
       externalChatId: input.externalChatId,
+      externalThreadId,
       externalUserId: null,
       displayName: null,
       username: null,
@@ -133,6 +150,7 @@ export function upsertOutboundBinding(input: {
       set: {
         sourceChannel: input.sourceChannel,
         externalChatId: input.externalChatId,
+        externalThreadId,
         updatedAt: now,
         lastOutboundAt: now,
       },
@@ -161,8 +179,20 @@ export function getBindingByConversation(
 export function getBindingByChannelChat(
   sourceChannel: string,
   externalChatId: string,
+): ExternalConversationBinding | null {
+  return getBindingByChannelChatThread(sourceChannel, externalChatId, null);
+}
+
+/**
+ * Look up an external binding by channel + external chat ID + optional thread ID.
+ */
+export function getBindingByChannelChatThread(
+  sourceChannel: string,
+  externalChatId: string,
+  externalThreadId?: string | null,
 ): ExternalConversationBinding | null {
   const db = getDb();
+  const normalizedThreadId = normalizeExternalThreadId(externalThreadId);
   const row = db
     .select()
     .from(externalConversationBindings)
@@ -170,6 +200,12 @@ export function getBindingByChannelChat(
       and(
         eq(externalConversationBindings.sourceChannel, sourceChannel),
         eq(externalConversationBindings.externalChatId, externalChatId),
+        normalizedThreadId
+          ? eq(
+              externalConversationBindings.externalThreadId,
+              normalizedThreadId,
+            )
+          : isNull(externalConversationBindings.externalThreadId),
       ),
     )
     .get();
@@ -195,6 +231,31 @@ export function deleteBindingByChannelChat(
     .run();
 }
 
+/**
+ * Remove an external binding by channel + external chat ID + thread ID.
+ */
+export function deleteBindingByChannelChatThread(
+  sourceChannel: string,
+  externalChatId: string,
+  externalThreadId: string,
+): void {
+  const db = getDb();
+  const normalizedThreadId = normalizeExternalThreadId(externalThreadId);
+  if (!normalizedThreadId) {
+    deleteBindingByChannelChat(sourceChannel, externalChatId);
+    return;
+  }
+  db.delete(externalConversationBindings)
+    .where(
+      and(
+        eq(externalConversationBindings.sourceChannel, sourceChannel),
+        eq(externalConversationBindings.externalChatId, externalChatId),
+        eq(externalConversationBindings.externalThreadId, normalizedThreadId),
+      ),
+    )
+    .run();
+}
+
 /**
  * Get bindings for multiple conversation IDs at once.
  * Returns a map of conversationId -> binding for efficient lookup.