@vellumai/assistant 0.8.1 → 0.8.3

package/src/memory/__tests__/memory-retrospective-job.test.ts

@@ -65,10 +65,42 @@ mock.module("../conversation-crud.js", () => ({
   },
 }));
 
+let transcriptFormatterCalls: Array<{
+  messageIds: string[];
+  timeZone?: string;
+  assistantName?: string | null;
+  userName?: string | null;
+}> = [];
+
 mock.module("../../export/transcript-formatter.js", () => ({
   formatMessageSliceForTranscript: (
     messages: Array<{ id: string; createdAt: number }>,
-  ) => messages.map((m) => `[msg ${m.id}]`).join("\n"),
+    options: {
+      timeZone?: string;
+      assistantName?: string | null;
+      userName?: string | null;
+    } = {},
+  ) => {
+    transcriptFormatterCalls.push({
+      messageIds: messages.map((m) => m.id),
+      timeZone: options.timeZone,
+      assistantName: options.assistantName,
+      userName: options.userName,
+    });
+    return messages.map((m) => `[msg ${m.id}]`).join("\n");
+  },
+}));
+
+let mockAssistantName: string | null = "Bob";
+let mockUserName: string | null = "Alice";
+
+mock.module("../../daemon/identity-helpers.js", () => ({
+  getAssistantName: () => mockAssistantName,
+  resolveUserName: (_workspaceDir: string) => mockUserName,
+}));
+
+mock.module("../../util/platform.js", () => ({
+  getWorkspaceDir: () => "/tmp/test-workspace",
 }));
 
 mock.module("../conversation-bootstrap.js", () => ({
@@ -102,9 +134,19 @@ mock.module("../jobs-store.js", () => ({
 import type { MemoryJob } from "../jobs-store.js";
 import { memoryRetrospectiveJob } from "../memory-retrospective-job.js";
 
-const stubConfig = {
-  memory: { v2: { enabled: true } },
-} as unknown as Parameters<typeof memoryRetrospectiveJob>[1];
+function makeConfig(
+  overrides: { userTimezone?: string; detectedTimezone?: string } = {},
+): Parameters<typeof memoryRetrospectiveJob>[1] {
+  return {
+    memory: { v2: { enabled: true } },
+    ui: {
+      userTimezone: overrides.userTimezone,
+      detectedTimezone: overrides.detectedTimezone,
+    },
+  } as unknown as Parameters<typeof memoryRetrospectiveJob>[1];
+}
+
+const stubConfig = makeConfig();
 
 function makeJob(conversationId = "src-conv-1"): MemoryJob<{
   conversationId?: string;
@@ -155,6 +197,9 @@ describe("memoryRetrospectiveJob", () => {
     bootstrappedConversationId = "bg-conv-new";
     bootstrapCalls = [];
     deletedConversationIds = [];
+    transcriptFormatterCalls = [];
+    mockAssistantName = "Bob";
+    mockUserName = "Alice";
   });
 
   test("first-run happy path: no state row, no prior retrospective, both pointer fields set on success", async () => {
@@ -274,6 +319,44 @@ describe("memoryRetrospectiveJob", () => {
     expect(hint).toContain("- a real save");
   });
 
+  test("transcript is formatted in the configured user timezone and the prompt discloses it", async () => {
+    const config = makeConfig({ userTimezone: "America/Los_Angeles" });
+    await memoryRetrospectiveJob(makeJob(), config);
+
+    expect(transcriptFormatterCalls).toHaveLength(1);
+    expect(transcriptFormatterCalls[0]!.timeZone).toBe("America/Los_Angeles");
+
+    const hint = wakeCalls[0]!.hint;
+    expect(hint).toContain("Timestamps are in America/Los_Angeles.");
+  });
+
+  test("detected timezone is used when no manual override is set", async () => {
+    const config = makeConfig({ detectedTimezone: "Europe/Berlin" });
+    await memoryRetrospectiveJob(makeJob(), config);
+
+    expect(transcriptFormatterCalls[0]!.timeZone).toBe("Europe/Berlin");
+
+    const hint = wakeCalls[0]!.hint;
+    expect(hint).toContain("Timestamps are in Europe/Berlin.");
+  });
+
+  test("resolved assistant and user display names are passed to the transcript formatter", async () => {
+    await memoryRetrospectiveJob(makeJob(), stubConfig);
+
+    expect(transcriptFormatterCalls).toHaveLength(1);
+    expect(transcriptFormatterCalls[0]!.assistantName).toBe("Bob");
+    expect(transcriptFormatterCalls[0]!.userName).toBe("Alice");
+  });
+
+  test("formatter receives null names when identity files are missing — formatter handles fallback", async () => {
+    mockAssistantName = null;
+    mockUserName = null;
+    await memoryRetrospectiveJob(makeJob(), stubConfig);
+
+    expect(transcriptFormatterCalls[0]!.assistantName).toBeNull();
+    expect(transcriptFormatterCalls[0]!.userName).toBeNull();
+  });
+
   test("non-remember tool_use blocks in the prior retro are ignored", async () => {
     priorRetroId = "prior-retro-conv-1";
     priorRetroMessages = [

package/src/memory/__tests__/memory-retrospective-startup-cleanup.test.ts

@@ -15,6 +15,8 @@ type ConvRow = {
   id: string;
   source: string | null;
   last_message_at: number | null;
+  fork_parent_conversation_id: string | null;
+  created_at: number;
 };
 type JobRow = {
   type: string;
@@ -58,11 +60,26 @@ mock.module("../db-connection.js", () => ({
                   return { conversationId: convId };
                 });
             }
-            // Otherwise, this is the conversation query.
-            // The test harness applies its OWN filter logic below since the
-            // production code uses drizzle's combinator. We expose all rows
-            // tagged with the right source/last_message_at, and the test
-            // post-filters them to mirror the production query.
+            // The "all retros" query (used to compute most-recent-per-source
+            // preservation) requests id + forkParentConversationId + createdAt
+            // with only the source + isNotNull(forkParent) predicate.
+            if (
+              colKeys.includes("forkParentConversationId") &&
+              colKeys.includes("createdAt")
+            ) {
+              return mockConversations
+                .filter((c) => c.source === "memory-retrospective")
+                .filter((c) => c.fork_parent_conversation_id !== null)
+                .map((c) => ({
+                  id: c.id,
+                  forkParentConversationId: c.fork_parent_conversation_id,
+                  createdAt: c.created_at,
+                }));
+            }
+            // Otherwise, this is the orphan-candidate query. The production
+            // predicate compares `forkParentConversationId` (the source ID
+            // encoded on the background conversation row) against the set
+            // of source IDs extracted from active jobs.
             return mockConversations
               .filter((c) => c.source === "memory-retrospective")
               .filter(
@@ -70,7 +87,11 @@ mock.module("../db-connection.js", () => ({
                   c.last_message_at !== null &&
                   c.last_message_at < injectedNowMinusOrphanAgeMs,
               )
-              .filter((c) => !activeJobConvIds.has(c.id))
+              .filter(
+                (c) =>
+                  c.fork_parent_conversation_id === null ||
+                  !activeJobSourceConvIds.has(c.fork_parent_conversation_id),
+              )
               .map((c) => ({ id: c.id }));
           },
         }),
@@ -79,7 +100,7 @@ mock.module("../db-connection.js", () => ({
   }),
 }));
 
-let activeJobConvIds = new Set<string>();
+let activeJobSourceConvIds = new Set<string>();
 let injectedNowMinusOrphanAgeMs = 0;
 
 mock.module("../conversation-crud.js", () => ({
@@ -94,7 +115,7 @@ import { sweepOrphanMemoryRetrospectiveConversations } from "../memory-retrospec
 const ORPHAN_AGE_MS = 60 * 60 * 1000;
 
 function rebuildActiveJobSet(): void {
-  activeJobConvIds = new Set();
+  activeJobSourceConvIds = new Set();
   for (const j of mockJobs) {
     if (
       j.type !== "memory_retrospective" ||
@@ -105,7 +126,7 @@ function rebuildActiveJobSet(): void {
     try {
       const parsed = JSON.parse(j.payload) as { conversationId?: unknown };
       if (typeof parsed.conversationId === "string") {
-        activeJobConvIds.add(parsed.conversationId);
+        activeJobSourceConvIds.add(parsed.conversationId);
       }
     } catch {
       // ignore
@@ -118,7 +139,7 @@ describe("sweepOrphanMemoryRetrospectiveConversations", () => {
     mockConversations = [];
     mockJobs = [];
     deletedIds = [];
-    activeJobConvIds = new Set();
+    activeJobSourceConvIds = new Set();
     injectedNowMinusOrphanAgeMs = 0;
   });
 
@@ -127,7 +148,7 @@ describe("sweepOrphanMemoryRetrospectiveConversations", () => {
     mockJobs = [];
   });
 
-  test("sweeps an old memory-retrospective conversation with no active job", () => {
+  test("sweeps an old memory-retrospective orphan that has been superseded by a newer retro for the same source", () => {
     const now = Date.now();
     injectedNowMinusOrphanAgeMs = now - ORPHAN_AGE_MS;
     mockConversations = [
@@ -135,6 +156,16 @@ describe("sweepOrphanMemoryRetrospectiveConversations", () => {
         id: "old-orphan",
         source: "memory-retrospective",
         last_message_at: now - 2 * ORPHAN_AGE_MS,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 3 * ORPHAN_AGE_MS,
+      },
+      // Newer successful retro for the same source — this one is preserved.
+      {
+        id: "newer-retro",
+        source: "memory-retrospective",
+        last_message_at: now - 90 * 60 * 1000,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 2 * ORPHAN_AGE_MS,
       },
     ];
     rebuildActiveJobSet();
@@ -153,6 +184,8 @@ describe("sweepOrphanMemoryRetrospectiveConversations", () => {
         id: "fresh-bg",
         source: "memory-retrospective",
         last_message_at: now - 60_000,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 60_000,
       },
     ];
     rebuildActiveJobSet();
@@ -171,6 +204,8 @@ describe("sweepOrphanMemoryRetrospectiveConversations", () => {
         id: "auto-analysis-old",
         source: "auto-analysis",
         last_message_at: now - 2 * ORPHAN_AGE_MS,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 2 * ORPHAN_AGE_MS,
       },
     ];
     rebuildActiveJobSet();
@@ -180,21 +215,91 @@ describe("sweepOrphanMemoryRetrospectiveConversations", () => {
     expect(result.swept).toBe(0);
   });
 
-  test("does NOT sweep an orphan whose source conversation has an active job", () => {
+  // Regression test for the previously-broken active-job guard. Before the
+  // fix, the predicate compared `conversations.id` (the BACKGROUND-conv id)
+  // to source-conv ids extracted from job payloads — two different identifier
+  // spaces — so the guard never matched and in-flight retros were swept.
+  test("does NOT sweep a background conversation whose SOURCE has an active job (different identifier spaces)", () => {
     const now = Date.now();
     injectedNowMinusOrphanAgeMs = now - ORPHAN_AGE_MS;
+    // The background conv has its own id, distinct from the source it forks
+    // from. The active job's payload references the SOURCE, not the
+    // background.
     mockConversations = [
       {
-        id: "orphan-but-protected",
+        id: "background-conv-id",
         source: "memory-retrospective",
         last_message_at: now - 2 * ORPHAN_AGE_MS,
+        fork_parent_conversation_id: "source-conv-id",
+        created_at: now - 2 * ORPHAN_AGE_MS,
       },
     ];
     mockJobs = [
       {
         type: "memory_retrospective",
         status: "pending",
-        payload: JSON.stringify({ conversationId: "orphan-but-protected" }),
+        payload: JSON.stringify({ conversationId: "source-conv-id" }),
+      },
+    ];
+    rebuildActiveJobSet();
+
+    const result = sweepOrphanMemoryRetrospectiveConversations(now);
+
+    expect(result.swept).toBe(0);
+    expect(deletedIds).toEqual([]);
+  });
+
+  test("sweeps a superseded background conversation whose source has NO active job, even when another unrelated job is pending", () => {
+    const now = Date.now();
+    injectedNowMinusOrphanAgeMs = now - ORPHAN_AGE_MS;
+    mockConversations = [
+      {
+        id: "background-A",
+        source: "memory-retrospective",
+        last_message_at: now - 2 * ORPHAN_AGE_MS,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 3 * ORPHAN_AGE_MS,
+      },
+      {
+        id: "newer-A",
+        source: "memory-retrospective",
+        last_message_at: now - 90 * 60 * 1000,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 2 * ORPHAN_AGE_MS,
+      },
+    ];
+    // Active job references a DIFFERENT source — neither retro above is
+    // protected by the active-job guard.
+    mockJobs = [
+      {
+        type: "memory_retrospective",
+        status: "pending",
+        payload: JSON.stringify({ conversationId: "source-B" }),
+      },
+    ];
+    rebuildActiveJobSet();
+
+    const result = sweepOrphanMemoryRetrospectiveConversations(now);
+
+    expect(result.swept).toBe(1);
+    expect(deletedIds).toEqual(["background-A"]);
+  });
+
+  // Regression test for Devin's concern on PR #30331: the sweep used to
+  // delete every memory-retrospective conversation older than 1h, including
+  // the most-recent successful one per source. That broke
+  // `findMostRecentRetrospectiveFor` on the next run — the next retro had
+  // no dedup context and could re-save facts the prior pass already captured.
+  test("PRESERVES the most-recent retro per source even when older than the orphan cutoff", () => {
+    const now = Date.now();
+    injectedNowMinusOrphanAgeMs = now - ORPHAN_AGE_MS;
+    mockConversations = [
+      {
+        id: "successful-retro",
+        source: "memory-retrospective",
+        last_message_at: now - 2 * ORPHAN_AGE_MS,
+        fork_parent_conversation_id: "source-A",
+        created_at: now - 2 * ORPHAN_AGE_MS,
       },
     ];
     rebuildActiveJobSet();

package/src/memory/__tests__/message-content.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+
+import { stringifyMessageContent } from "../message-content.js";
+
+describe("stringifyMessageContent", () => {
+  test("returns trimmed raw text for legacy plain-string rows", () => {
+    expect(stringifyMessageContent("  hello world  ")).toBe("hello world");
+  });
+
+  test("returns trimmed inner string when JSON parses to a string", () => {
+    expect(stringifyMessageContent(JSON.stringify("  inner  "))).toBe("inner");
+  });
+
+  test("concatenates text blocks from a ContentBlock[] payload", () => {
+    const raw = JSON.stringify([
+      { type: "text", text: "alpha" },
+      { type: "tool_use", id: "x", name: "noop", input: {} },
+      { type: "text", text: "beta" },
+    ]);
+    expect(stringifyMessageContent(raw)).toBe("alpha\nbeta");
+  });
+
+  test("falls back to raw trimmed text when JSON parses to a non-array object", () => {
+    const raw = '  {"type":"text","text":"hi"}  ';
+    expect(stringifyMessageContent(raw)).toBe('{"type":"text","text":"hi"}');
+  });
+
+  test("falls back to raw trimmed text when JSON parses to a number", () => {
+    expect(stringifyMessageContent("  42  ")).toBe("42");
+  });
+
+  test("returns trimmed raw text when JSON parsing fails", () => {
+    expect(stringifyMessageContent("  not json  ")).toBe("not json");
+  });
+});

package/src/memory/bookmark-crud.ts

@@ -106,22 +106,51 @@ export function listBookmarks(db: DrizzleDb): BookmarkSummary[] {
 }
 
 /**
- * Create a bookmark for the given message and return its JOIN-shaped
- * {@link BookmarkSummary}. Idempotent on the unique `message_id` index —
- * if a bookmark already exists for `messageId`, the existing summary is
- * returned and no new row is inserted.
+ * Discriminated result returned by {@link createBookmark}. `inserted`
+ * distinguishes a brand-new row from an idempotent return of an existing
+ * one, so callers can suppress side effects (e.g. `bookmark.created` SSE
+ * publishes) on duplicate POSTs.
+ */
+export type CreateBookmarkResult =
+  | { inserted: true; bookmark: BookmarkSummary }
+  | { inserted: false; bookmark: BookmarkSummary };
+
+/**
+ * Create a bookmark for the given message and return a discriminated
+ * result indicating whether a new row was actually inserted. Idempotent
+ * on the unique `message_id` index — if a bookmark already exists for
+ * `messageId`, the existing summary is returned with `inserted: false`.
+ *
+ * `conversationId` is derived from the message row rather than trusted from
+ * the caller, so a buggy or malicious caller cannot persist a bookmark
+ * whose `conversationId` disagrees with the message's actual conversation.
  */
 export function createBookmark(
   db: DrizzleDb,
-  params: { messageId: string; conversationId: string },
-): BookmarkSummary {
-  const { messageId, conversationId } = params;
+  params: { messageId: string },
+): CreateBookmarkResult {
+  const { messageId } = params;
+  const message = db
+    .select({ conversationId: messages.conversationId })
+    .from(messages)
+    .where(eq(messages.id, messageId))
+    .get();
+  if (!message) {
+    throw new Error(`Message ${messageId} not found`);
+  }
+  const conversationId = message.conversationId;
+
   const existing = db
     .select({ id: messageBookmarks.id })
     .from(messageBookmarks)
     .where(eq(messageBookmarks.messageId, messageId))
     .get();
-  if (existing) return readBookmarkSummaryOrThrow(db, existing.id);
+  if (existing) {
+    return {
+      inserted: false,
+      bookmark: readBookmarkSummaryOrThrow(db, existing.id),
+    };
+  }
 
   const id = uuid();
   try {
@@ -137,9 +166,12 @@ export function createBookmark(
       .where(eq(messageBookmarks.messageId, messageId))
       .get();
     if (!winner) throw err;
-    return readBookmarkSummaryOrThrow(db, winner.id);
+    return {
+      inserted: false,
+      bookmark: readBookmarkSummaryOrThrow(db, winner.id),
+    };
   }
-  return readBookmarkSummaryOrThrow(db, id);
+  return { inserted: true, bookmark: readBookmarkSummaryOrThrow(db, id) };
 }
 
 function readBookmarkSummaryOrThrow(

package/src/memory/context-search/sources/conversations.ts

@@ -1,7 +1,12 @@
+import { readSlackMetadata } from "../../../messaging/providers/slack/message-metadata.js";
+import {
+  parseExternalContentEnvelope,
+  wrapUntrustedContent,
+} from "../../../security/untrusted-content.js";
 import { AUTO_ANALYSIS_SOURCE } from "../../auto-analysis-guard.js";
 import {
-  buildExcerpt,
   buildFtsMatchQuery,
+  buildRecallEvidenceExcerpt,
 } from "../../conversation-queries.js";
 import { rawAll } from "../../raw-query.js";
 import type { RecallSearchContext, RecallSearchResult } from "../types.js";
@@ -15,6 +20,7 @@ interface ConversationEvidenceRow {
   role: string;
   content: string;
   created_at: number;
+  metadata: string | null;
   title: string | null;
 }
 
@@ -118,7 +124,7 @@ export async function searchConversationSource(
       source: "conversations",
       title: row.title?.trim() || "Untitled conversation",
       locator: `${row.conversation_id}#${row.message_id}`,
-      excerpt: buildExcerpt(row.content, trimmedQuery),
+      excerpt: buildRecallExcerpt(row, trimmedQuery),
       timestampMs: row.created_at,
       score,
       metadata: {
@@ -142,6 +148,7 @@ function searchWithFts(
       m.role,
       m.content,
       m.created_at,
+      m.metadata,
       c.title
     FROM messages_fts
     JOIN messages m ON m.id = messages_fts.message_id
@@ -175,6 +182,7 @@ function searchWithLike(
       m.role,
       m.content,
       m.created_at,
+      m.metadata,
       c.title
     FROM messages m
     JOIN conversations c ON c.id = m.conversation_id
@@ -194,6 +202,58 @@ function searchWithLike(
   );
 }
 
+function buildRecallExcerpt(
+  row: ConversationEvidenceRow,
+  query: string,
+): string {
+  const excerpt = buildRecallEvidenceExcerpt(row.content, query);
+  const slackMeta = parseSlackRecallMetadata(row.metadata);
+  if (
+    row.role !== "user" ||
+    !slackMeta ||
+    slackMeta.provenanceTrustClass === "guardian" ||
+    excerpt.length === 0 ||
+    parseExternalContentEnvelope(excerpt)
+  ) {
+    return excerpt;
+  }
+
+  return wrapUntrustedContent(excerpt, {
+    source: "slack",
+    ...(slackMeta.displayName ? { sourceDetail: slackMeta.displayName } : {}),
+  });
+}
+
+function parseSlackRecallMetadata(rawMetadata: string | null): {
+  displayName?: string;
+  provenanceTrustClass?: string;
+} | null {
+  if (!rawMetadata) return null;
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawMetadata);
+  } catch {
+    return null;
+  }
+
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+
+  const metadata = parsed as Record<string, unknown>;
+  if (typeof metadata.slackMeta !== "string") return null;
+  const slackMeta = readSlackMetadata(metadata.slackMeta);
+  if (!slackMeta) return null;
+
+  return {
+    ...(slackMeta.displayName ? { displayName: slackMeta.displayName } : {}),
+    ...(typeof metadata.provenanceTrustClass === "string"
+      ? { provenanceTrustClass: metadata.provenanceTrustClass }
+      : {}),
+  };
+}
+
 function buildRecallFtsMatchQueries(query: string): string[] {
   const queries: string[] = [];
   const exact = buildFtsMatchQuery(query);

package/src/memory/context-search/sources/workspace.ts

@@ -68,6 +68,9 @@ const SECRET_SEGMENT_NAMES = new Set([
 const SECRET_TOKEN_PATTERN =
   /(?:^|[-_.])(?:keys?|secrets?|tokens?)(?:[-_.]|$)/i;
 
+const SECRET_TOKEN_CAMEL_CASE_PATTERN =
+  /(?<=[a-z0-9])(?:Keys?|Secrets?|Tokens?)(?=[A-Z]|[-_.]|$)/;
+
 const QUERY_STOP_WORDS = new Set([
   "a",
   "about",
@@ -1185,6 +1188,7 @@ function shouldSkipSegmentName(name: string): boolean {
     GENERATED_OR_DEPENDENCY_DIR_NAMES.has(lowerName) ||
     lowerName.startsWith(".env") ||
     SECRET_TOKEN_PATTERN.test(lowerName) ||
+    SECRET_TOKEN_CAMEL_CASE_PATTERN.test(name) ||
     lowerName.startsWith("credentials") ||
     SECRET_SEGMENT_NAMES.has(lowerName)
   );