@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/memory/migrations/285-schedule-workflow-mode.ts

@@ -0,0 +1,26 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Add `workflow_name` + `workflow_args_json` columns to `cron_jobs`.
+ *
+ * These back the new `workflow` schedule mode, which triggers a saved
+ * workflow by name on a schedule. Both are nullable and only populated for
+ * `mode = 'workflow'` rows; existing schedules stay NULL and unchanged.
+ *
+ * Idempotent — each ALTER is wrapped so a re-run (column already present)
+ * is a no-op.
+ */
+export function migrateScheduleWorkflowMode(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+  try {
+    raw.exec(`ALTER TABLE cron_jobs ADD COLUMN workflow_name TEXT`);
+  } catch {
+    /* Column already exists */
+  }
+  try {
+    raw.exec(`ALTER TABLE cron_jobs ADD COLUMN workflow_args_json TEXT`);
+  } catch {
+    /* Column already exists */
+  }
+}

package/src/memory/migrations/286-workflow-run-trust.ts

@@ -0,0 +1,27 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Add a `trust_json` column to `workflow_runs`.
+ *
+ * Persists the originating {@link TrustContext} (trust metadata — NOT secret
+ * material) so a crash-orphaned run can reconstruct the exact trust class it
+ * started under when it is resumed after a restart. Without this, resume could
+ * only fall back to a default, and the previous fallback was the internal
+ * guardian context — a privilege escalation, since a run started by a low-trust
+ * actor would resume with the side-effect approval gate cleared.
+ *
+ * Nullable — legacy rows written before this column stay NULL and resume at the
+ * low-trust fallback (never guardian).
+ *
+ * Idempotent — the ALTER is wrapped so a re-run (column already present) is a
+ * no-op.
+ */
+export function migrateWorkflowRunTrust(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+  try {
+    raw.exec(`ALTER TABLE workflow_runs ADD COLUMN trust_json TEXT`);
+  } catch {
+    /* Column already exists */
+  }
+}

package/src/memory/migrations/287-conversation-origin-channel-index.ts

@@ -0,0 +1,15 @@
+import type { DrizzleDb } from "../db-connection.js";
+
+/**
+ * Add an index on `origin_channel` to support the new `originChannel` query
+ * parameter on `GET /v1/conversations`. Channel-based sidebar sections fetch
+ * conversations filtered by origin channel; without this index, each such
+ * query requires a full table scan.
+ */
+export function migrateConversationOriginChannelIndex(
+  database: DrizzleDb,
+): void {
+  database.run(
+    /*sql*/ `CREATE INDEX IF NOT EXISTS idx_conversations_origin_channel ON conversations(origin_channel)`,
+  );
+}

package/src/memory/migrations/288-backfill-origin-channel-from-bindings.ts

@@ -0,0 +1,43 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Fully normalize `conversations.origin_channel` so no rows remain NULL.
+ *
+ * Step 1: Backfill from `external_conversation_bindings.source_channel` for
+ * conversations that have a channel binding but NULL origin_channel (created
+ * before origin_channel was consistently set on first inbound message).
+ *
+ * Step 2: Set remaining NULL rows to 'vellum'. These are native/local
+ * conversations created before the mechanism existed — they have no external
+ * binding and were always implicitly vellum-channel conversations.
+ */
+export function migrateBackfillOriginChannelFromBindings(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  // Step 1: Backfill from external bindings
+  raw
+    .query(
+      /*sql*/ `
+      UPDATE conversations
+      SET origin_channel = (
+        SELECT source_channel
+        FROM external_conversation_bindings
+        WHERE external_conversation_bindings.conversation_id = conversations.id
+      )
+      WHERE origin_channel IS NULL
+        AND id IN (
+          SELECT conversation_id FROM external_conversation_bindings
+        )
+    `,
+    )
+    .run();
+
+  // Step 2: Remaining NULL rows are native/local — set to 'vellum'
+  raw
+    .query(
+      /*sql*/ `UPDATE conversations SET origin_channel = 'vellum' WHERE origin_channel IS NULL`,
+    )
+    .run();
+}

package/src/memory/migrations/289-contact-channels-unique-ext-user.ts

@@ -0,0 +1,115 @@
+import { getLogger } from "../../util/logger.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const log = getLogger("migration-289");
+
+/**
+ * Deduplicates historical case collisions in contact_channels.
+ *
+ * Pure dedup — removes duplicate rows but does not change any stored values.
+ *
+ * Steps:
+ *  1. Deduplicate by (type, address) case-insensitively — keeps the best row.
+ *  2. Deduplicate by (type, external_user_id) case-insensitively — ensures
+ *     at most one row per external identity.
+ *  3. Remove cross-column collision blockers — rows with NULL external_user_id
+ *     whose address equals another row's external_user_id.
+ */
+export function migrateContactChannelsUniqueExtUser(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  // Step 1: Deduplicate historical case collisions. After this, the existing
+  // case-sensitive UNIQUE(type, address) constraint remains valid because
+  // only one row per case-insensitive group survives.
+  const addressDedupResult = raw.run(/*sql*/ `
+    DELETE FROM contact_channels
+    WHERE id NOT IN (
+      SELECT id FROM (
+        SELECT id,
+               ROW_NUMBER() OVER (
+                 PARTITION BY type, address COLLATE NOCASE
+                 ORDER BY
+                   CASE status
+                     WHEN 'blocked' THEN 0
+                     WHEN 'revoked' THEN 1
+                     WHEN 'active' THEN 2
+                     WHEN 'unverified' THEN 3
+                     ELSE 4
+                   END,
+                   updated_at DESC
+               ) AS rn
+        FROM contact_channels
+      )
+      WHERE rn = 1
+    )
+  `);
+
+  if (addressDedupResult.changes > 0) {
+    log.info(
+      { rowsDeleted: addressDedupResult.changes },
+      "Deduplicated contact_channels by (type, address) case-insensitive",
+    );
+  }
+
+  // Step 2: Deduplicate by (type, external_user_id) so that a future
+  // normalization (SET address = external_user_id) cannot produce collisions.
+  // Two rows with different addresses but the same external_user_id would
+  // both get the same address after normalization.
+  const extIdDedupResult = raw.run(/*sql*/ `
+    DELETE FROM contact_channels
+    WHERE external_user_id IS NOT NULL
+      AND id NOT IN (
+        SELECT id FROM (
+          SELECT id,
+                 ROW_NUMBER() OVER (
+                   PARTITION BY type, external_user_id COLLATE NOCASE
+                   ORDER BY
+                     CASE status
+                       WHEN 'blocked' THEN 0
+                       WHEN 'revoked' THEN 1
+                       WHEN 'active' THEN 2
+                       WHEN 'unverified' THEN 3
+                       ELSE 4
+                     END,
+                     updated_at DESC
+                 ) AS rn
+          FROM contact_channels
+          WHERE external_user_id IS NOT NULL
+        )
+        WHERE rn = 1
+      )
+  `);
+
+  if (extIdDedupResult.changes > 0) {
+    log.info(
+      { rowsDeleted: extIdDedupResult.changes },
+      "Deduplicated contact_channels by (type, external_user_id)",
+    );
+  }
+
+  // Step 3: Remove rows that would block future normalization due to
+  // cross-column collisions. A row with NULL external_user_id whose address
+  // equals another row's external_user_id would prevent that row's
+  // normalization in a later migration.
+  const crossColResult = raw.run(/*sql*/ `
+    DELETE FROM contact_channels
+    WHERE external_user_id IS NULL
+      AND id IN (
+        SELECT blocker.id
+        FROM contact_channels AS blocker
+        INNER JOIN contact_channels AS normalizer
+          ON normalizer.type = blocker.type
+          AND normalizer.external_user_id = blocker.address COLLATE NOCASE
+          AND normalizer.address != normalizer.external_user_id
+          AND normalizer.external_user_id IS NOT NULL
+          AND normalizer.id != blocker.id
+      )
+  `);
+
+  if (crossColResult.changes > 0) {
+    log.info(
+      { rowsDeleted: crossColResult.changes },
+      "Removed cross-column collision blockers",
+    );
+  }
+}

package/src/memory/migrations/290-schedule-capabilities.test.ts

@@ -0,0 +1,77 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import * as schema from "../schema.js";
+import { migrateScheduleCapabilities } from "./290-schedule-capabilities.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  // Pre-290 shape: no capabilities_json column (trimmed to the columns the
+  // migration and assertions touch).
+  sqlite.exec(/*sql*/ `
+    CREATE TABLE cron_jobs (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      message TEXT NOT NULL,
+      next_run_at INTEGER NOT NULL,
+      created_by TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+  return { sqlite, db: drizzle(sqlite, { schema }) };
+}
+
+function columnNames(sqlite: Database): string[] {
+  return (
+    sqlite.query("PRAGMA table_info(cron_jobs)").all() as Array<{
+      name: string;
+    }>
+  ).map((c) => c.name);
+}
+
+describe("migration 290: cron_jobs capabilities_json", () => {
+  test("adds a nullable capabilities_json column", () => {
+    const { sqlite, db } = createTestDb();
+    expect(columnNames(sqlite)).not.toContain("capabilities_json");
+
+    migrateScheduleCapabilities(db);
+
+    const column = (
+      sqlite.query("PRAGMA table_info(cron_jobs)").all() as Array<{
+        name: string;
+        notnull: number;
+      }>
+    ).find((c) => c.name === "capabilities_json");
+    expect(column).toBeDefined();
+    expect(column?.notnull).toBe(0);
+  });
+
+  test("existing rows read back with capabilities_json null", () => {
+    const { sqlite, db } = createTestDb();
+    sqlite.exec(/*sql*/ `
+      INSERT INTO cron_jobs (id, name, message, next_run_at, created_by, created_at, updated_at)
+      VALUES ('job-1', 'Daily digest', 'write the digest', 1000, 'agent', 1000, 1000)
+    `);
+
+    migrateScheduleCapabilities(db);
+
+    const row = sqlite
+      .query("SELECT capabilities_json FROM cron_jobs WHERE id = 'job-1'")
+      .get() as { capabilities_json: string | null };
+    expect(row.capabilities_json).toBeNull();
+  });
+
+  test("is idempotent — re-run is a no-op", () => {
+    const { sqlite, db } = createTestDb();
+
+    migrateScheduleCapabilities(db);
+    expect(() => migrateScheduleCapabilities(db)).not.toThrow();
+
+    expect(
+      columnNames(sqlite).filter((name) => name === "capabilities_json"),
+    ).toHaveLength(1);
+  });
+});

package/src/memory/migrations/290-schedule-capabilities.ts

@@ -0,0 +1,25 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Add a nullable `capabilities_json TEXT` column to `cron_jobs`.
+ *
+ * Persists the capability manifest a scheduled workflow run should execute
+ * under. `NULL` (all pre-existing rows) means no persisted manifest — runs
+ * fall back to the hardcoded read-only manifest.
+ *
+ * Idempotent — the PRAGMA guard makes re-running a no-op once the column
+ * exists.
+ */
+export function migrateScheduleCapabilities(database: DrizzleDb): void {
+  const raw = getSqliteFrom(database);
+
+  const columns = raw.query(`PRAGMA table_info(cron_jobs)`).all() as Array<{
+    name: string;
+  }>;
+  const columnNames = new Set(columns.map((c) => c.name));
+
+  if (!columnNames.has("capabilities_json")) {
+    raw.exec(`ALTER TABLE cron_jobs ADD COLUMN capabilities_json TEXT`);
+  }
+}

package/src/memory/migrations/__tests__/281-memory-retrospective-remembered-log.test.ts

@@ -0,0 +1,96 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateMemoryRetrospectiveState } from "../245-memory-retrospective-state.js";
+import { migrateMemoryRetrospectiveRememberedLog } from "../281-memory-retrospective-remembered-log.js";
+
+interface ColumnRow {
+  name: string;
+  type: string;
+  notnull: number;
+  dflt_value: string | null;
+  pk: number;
+}
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec("PRAGMA foreign_keys = ON");
+  // `withCrashRecovery` (used by the migrations) reads/writes a
+  // `memory_checkpoints` table. Seed a minimal version so the migrations'
+  // structural setup can be exercised without booting the entire
+  // db-init pipeline.
+  sqlite.exec(`
+    CREATE TABLE memory_checkpoints (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+  // The state table FK references `conversations(id)`. Minimal stand-in.
+  sqlite.exec(`
+    CREATE TABLE conversations (
+      id TEXT PRIMARY KEY,
+      created_at INTEGER NOT NULL
+    )
+  `);
+  return drizzle(sqlite, { schema });
+}
+
+describe("migration 281 — memory_retrospective_state.remembered_log", () => {
+  test("adds a nullable remembered_log TEXT column", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+
+    migrateMemoryRetrospectiveState(db);
+    migrateMemoryRetrospectiveRememberedLog(db);
+
+    const cols = raw
+      .query(`PRAGMA table_info(memory_retrospective_state)`)
+      .all() as ColumnRow[];
+    const col = cols.find((c) => c.name === "remembered_log");
+
+    expect(col).toBeDefined();
+    expect(col!.type).toBe("TEXT");
+    expect(col!.notnull).toBe(0);
+    expect(col!.pk).toBe(0);
+  });
+
+  test("is idempotent — running twice does not throw or duplicate the column", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+
+    migrateMemoryRetrospectiveState(db);
+    migrateMemoryRetrospectiveRememberedLog(db);
+    expect(() => migrateMemoryRetrospectiveRememberedLog(db)).not.toThrow();
+
+    const cols = raw
+      .query(`PRAGMA table_info(memory_retrospective_state)`)
+      .all() as ColumnRow[];
+    expect(cols.filter((c) => c.name === "remembered_log")).toHaveLength(1);
+  });
+
+  test("pre-existing rows get NULL for the new column", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+
+    migrateMemoryRetrospectiveState(db);
+    raw.exec(`INSERT INTO conversations (id, created_at) VALUES ('c1', 0)`);
+    raw.exec(
+      `INSERT INTO memory_retrospective_state (conversation_id, last_processed_message_id, last_run_at) VALUES ('c1', 'm1', 1000)`,
+    );
+
+    migrateMemoryRetrospectiveRememberedLog(db);
+
+    const row = raw
+      .query(
+        `SELECT remembered_log FROM memory_retrospective_state WHERE conversation_id = 'c1'`,
+      )
+      .get() as { remembered_log: string | null };
+    expect(row.remembered_log).toBeNull();
+  });
+});