@vellumai/assistant 0.8.2 → 0.8.4

package/src/util/favicon.ts

@@ -0,0 +1,40 @@
+import { isPrivateOrLocalHost } from "../tools/network/url-safety.js";
+
+/** Strip the trailing `:port` from a host string. IPv6 hosts are bracketed
+ *  ("[::1]:8080" → "[::1]"); IPv4/DNS hosts have a single colon ("host:8080" → "host"). */
+function stripPort(host: string): string {
+  if (host.startsWith("[")) {
+    const end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  const lastColon = host.lastIndexOf(":");
+  if (lastColon === -1) return host;
+  return host.slice(0, lastColon);
+}
+
+/** Match any IP literal — IPv4 dotted-quad or IPv6 (bracketed or bare with a colon).
+ *  We reject every IP from the favicon path because we don't reverse-lookup hosts,
+ *  so a raw IP — public or private — would expose the literal to Google when the
+ *  client renders the icon. DNS names are fine; only literals are rejected. */
+function isIPLiteral(host: string): boolean {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.startsWith("[") || host.includes(":")) return true;
+  return false;
+}
+
+/** Deterministic favicon URL for a host using Google's s2 service.
+ *  Returns undefined for empty/malformed hosts, raw IP literals, and any host
+ *  isPrivateOrLocalHost flags. Callers omit the field on undefined so we never
+ *  leak internal hostnames or arbitrary IPs to Google when clients render the
+ *  icon. */
+export function faviconUrlForDomain(domain: string): string | undefined {
+  const trimmed = domain.trim().toLowerCase();
+  if (!trimmed || trimmed.includes("/") || trimmed.includes(" ")) {
+    return undefined;
+  }
+  const hostOnly = stripPort(trimmed);
+  if (!hostOnly || isIPLiteral(hostOnly) || isPrivateOrLocalHost(hostOnly)) {
+    return undefined;
+  }
+  return `https://www.google.com/s2/favicons?domain=${encodeURIComponent(hostOnly)}&sz=64`;
+}

package/src/util/platform.ts

@@ -103,10 +103,6 @@ export function getSandboxWorkingDir(): string {
   return getWorkspaceDir();
 }
 
-export function getInterfacesDir(): string {
-  return join(getDataDir(), "interfaces");
-}
-
 /**
  * Returns the sounds directory (~/.vellum/workspace/data/sounds).
  * Custom sound files and sound configuration live here.
@@ -413,7 +409,6 @@ export function ensureDataDir(): void {
     join(wsData, "memory", "knowledge"),
     join(wsData, "apps"),
     join(wsData, "attachments"),
-    join(wsData, "interfaces"),
     join(wsData, "sounds"),
   ];
   for (const dir of dirs) {

package/src/workspace/git-service.ts

@@ -1,5 +1,12 @@
 import { execFile, spawnSync } from "node:child_process";
-import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { join } from "node:path";
 import { promisify } from "node:util";
 
@@ -70,6 +77,41 @@ const WORKSPACE_GITIGNORE_RULES = [
   "session-token",
 ];
 
+const NULL_GIT_OID = "0000000000000000000000000000000000000000";
+
+const WORKSPACE_BRANCH_GUARD_HOOK = `#!/bin/sh
+set -eu
+
+state="\${1:-}"
+if [ "$state" != "prepared" ]; then
+  exit 0
+fi
+
+while read -r _old_oid new_oid refname; do
+  case "$refname" in
+    refs/heads/main)
+      ;;
+    refs/heads/*)
+      if [ "$new_oid" = "${NULL_GIT_OID}" ]; then
+        continue
+      fi
+
+      cat >&2 <<MSG
+Blocked: assistant workspace git branches are disabled.
+
+Use the workspace main branch for assistant state. Create task branches only in
+external product repositories or dedicated worktrees.
+
+Rejected ref update: $refname
+MSG
+      exit 1
+      ;;
+  esac
+done
+
+exit 0
+`;
+
 /** Properties added by Node's child_process errors. */
 interface ExecError extends Error {
   killed?: boolean;
@@ -426,7 +468,9 @@ export class WorkspaceGitService {
                 // These calls are OUTSIDE the rev-parse try/catch so that
                 // normalization errors are not misclassified as "no commits".
                 this.ensureGitignoreRulesLocked();
+                this.ensureBranchGuardHookLocked();
                 await this.ensureCommitIdentityLocked();
+                await this.ensureBranchGuardConfigLocked();
                 await this.ensureOnMainLocked();
                 this.initialized = true;
                 this.recordInitSuccess();
@@ -444,7 +488,9 @@ export class WorkspaceGitService {
           // in the corruption-recovery path we fall through here after
           // removing .git, so branch enforcement is still useful.
           this.ensureGitignoreRulesLocked();
+          this.ensureBranchGuardHookLocked();
           await this.ensureCommitIdentityLocked();
+          await this.ensureBranchGuardConfigLocked();
           await this.ensureOnMainLocked();
 
           // Create initial commit synchronously within the lock to prevent
@@ -452,9 +498,14 @@ export class WorkspaceGitService {
           // initial commit could run concurrently and consume edits meant
           // for the first user-requested commit.
           const status = await this.getStatusInternal();
-          const hasExistingFiles =
-            status.untracked.length > 1 || // More than just .gitignore
-            status.untracked.some((f) => f !== ".gitignore");
+          const autoCreatedInitFiles = new Set([
+            ".gitignore",
+            ".githooks/",
+            ".githooks/reference-transaction",
+          ]);
+          const hasExistingFiles = status.untracked.some(
+            (f) => !autoCreatedInitFiles.has(f),
+          );
 
           await this.execGit(["add", "-A"]);
 
@@ -766,6 +817,26 @@ export class WorkspaceGitService {
     await this.execGit(["config", "user.email", gitEmail]);
   }
 
+  /**
+   * Ensure workspace branch guard hook is present.
+   * Must be called with the mutex lock held.
+   */
+  private ensureBranchGuardHookLocked(): void {
+    const hooksDir = join(this.workspaceDir, ".githooks");
+    const hookPath = join(hooksDir, "reference-transaction");
+    mkdirSync(hooksDir, { recursive: true });
+    writeFileSync(hookPath, WORKSPACE_BRANCH_GUARD_HOOK, "utf-8");
+    chmodSync(hookPath, 0o755);
+  }
+
+  /**
+   * Ensure workspace git uses the branch guard hook path.
+   * Must be called with the mutex lock held.
+   */
+  private async ensureBranchGuardConfigLocked(): Promise<void> {
+    await this.execGit(["config", "core.hooksPath", ".githooks"]);
+  }
+
   /**
    * Ensure the workspace repo is on the `main` branch.
    * If on a different branch or in detached HEAD state, switches to main

package/src/workspace/migrations/087-memory-router-balanced-profile.ts

@@ -0,0 +1,91 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Upgrade callSites.memoryRouter from the 077-seeded
+// {model: "claude-sonnet-4-6", contextWindow: {maxInputTokens: 1_000_000}}
+// shape to {profile: "balanced"} so the router rides the workspace's active
+// inference profile (with thinking enabled, higher effort, etc.) instead of a
+// bare model pin.
+//
+// Two skip conditions guard against runtime regressions:
+//
+//   1. BYOK / non-Anthropic workspaces. `balanced` resolves to the managed
+//      Anthropic connection (see seedInferenceProfiles), which off-platform
+//      installs explicitly disable. Forcing `balanced` there would make
+//      getConfiguredProvider("memoryRouter") return null and silently
+//      disable memory injection. Detect this by inspecting llm.default.provider
+//      — same heuristic migration 077 used to gate its seed.
+//
+//   2. User-customized memoryRouter config. If the existing entry isn't the
+//      exact 077-seeded shape (and isn't already {profile: "balanced"}), the
+//      user — or a platform overlay — chose those values deliberately. Match
+//      077's pattern of preserving any prior config.
+export const memoryRouterBalancedProfileMigration: WorkspaceMigration = {
+  id: "087-memory-router-balanced-profile",
+  description:
+    "Set callSites.memoryRouter to { profile: 'balanced' }, dropping the seeded model and contextWindow override",
+  run(workspaceDir: string): void {
+    if (process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH) return;
+
+    const configPath = join(workspaceDir, "config.json");
+    const configExisted = existsSync(configPath);
+
+    let config: Record<string, unknown> = {};
+    if (configExisted) {
+      try {
+        const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+        config = raw as Record<string, unknown>;
+      } catch {
+        return;
+      }
+    }
+
+    const llm = readObject(config.llm) ?? {};
+
+    const explicitProvider = readString(readObject(llm.default)?.provider);
+    if (explicitProvider !== undefined && explicitProvider !== "anthropic") {
+      return;
+    }
+
+    const callSites = readObject(llm.callSites) ?? {};
+    const existing = readObject(callSites.memoryRouter);
+
+    if (existing !== null && !isSeededBy077(existing)) {
+      return;
+    }
+
+    callSites.memoryRouter = { profile: "balanced" };
+    llm.callSites = callSites;
+    config.llm = llm;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+// True when the entry looks exactly like what migration 077 wrote: a model pin
+// of claude-sonnet-4-6 plus the 1M-token context window, and nothing else.
+function isSeededBy077(entry: Record<string, unknown>): boolean {
+  const keys = Object.keys(entry);
+  if (keys.length !== 2) return false;
+  if (entry.model !== "claude-sonnet-4-6") return false;
+  const contextWindow = readObject(entry.contextWindow);
+  if (contextWindow === null) return false;
+  const cwKeys = Object.keys(contextWindow);
+  return cwKeys.length === 1 && contextWindow.maxInputTokens === 1_000_000;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}

package/src/workspace/migrations/088-deprecate-background-conversation-override.ts

@@ -0,0 +1,103 @@
+/**
+ * Workspace migration 088: Deprecate stale
+ * `prompts/system/08-background-conversation.md` overrides.
+ *
+ * PR #31210 moved the background-conversation guidance out of the bundled
+ * system prompt and into a per-turn user-message injector. As a side effect:
+ *
+ *   - Workspace overrides that gated on `{{#isBackgroundConversation}}` now
+ *     evaluate the gate as false (the key is no longer passed to the system
+ *     prompt context) and silently stop rendering in background turns.
+ *   - Plain-text overrides without a gate would now render unconditionally
+ *     in ALL conversations — the opposite of intended behavior.
+ *
+ * Either failure mode is silent. To prevent it, this migration renames any
+ * existing `prompts/system/08-background-conversation.md` to
+ * `08-background-conversation.md.deprecated` so the section-discovery walker
+ * (which only picks up `.md` files) stops loading it, while preserving the
+ * user's customized text on disk for manual review.
+ *
+ * Idempotent: re-runs after `08-background-conversation.md` has already been
+ * renamed are no-ops. If both files exist (a user re-created the override
+ * after a prior partial run), the bundled section is gone — drop the `.md`
+ * and keep the previously-preserved `.deprecated` copy.
+ */
+
+import { existsSync, renameSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger(
+  "workspace-migration-088-deprecate-background-conversation-override",
+);
+
+const OVERRIDE_FILENAME = "08-background-conversation.md";
+const DEPRECATED_FILENAME = "08-background-conversation.md.deprecated";
+
+export const deprecateBackgroundConversationOverrideMigration: WorkspaceMigration =
+  {
+    id: "088-deprecate-background-conversation-override",
+    description:
+      "Rename stale prompts/system/08-background-conversation.md overrides to .deprecated so they stop rendering after the section moved to a per-turn injector",
+    retryFailedCheckpoint: true,
+
+    run(workspaceDir: string): void {
+      const promptDir = join(workspaceDir, "prompts", "system");
+      const overridePath = join(promptDir, OVERRIDE_FILENAME);
+      const deprecatedPath = join(promptDir, DEPRECATED_FILENAME);
+
+      if (!existsSync(overridePath)) return;
+
+      if (existsSync(deprecatedPath)) {
+        try {
+          unlinkSync(overridePath);
+          log.info(
+            { path: overridePath, preserved: deprecatedPath },
+            "Removed re-created background-conversation override; preserved copy already exists",
+          );
+        } catch (err) {
+          log.warn(
+            { err, path: overridePath },
+            "Failed to remove background-conversation override",
+          );
+          throw err;
+        }
+        return;
+      }
+
+      try {
+        renameSync(overridePath, deprecatedPath);
+        log.info(
+          { from: overridePath, to: deprecatedPath },
+          "Renamed stale background-conversation override to .deprecated",
+        );
+      } catch (err) {
+        log.warn(
+          { err, from: overridePath, to: deprecatedPath },
+          "Failed to rename background-conversation override",
+        );
+        throw err;
+      }
+    },
+
+    down(workspaceDir: string): void {
+      const promptDir = join(workspaceDir, "prompts", "system");
+      const overridePath = join(promptDir, OVERRIDE_FILENAME);
+      const deprecatedPath = join(promptDir, DEPRECATED_FILENAME);
+
+      if (!existsSync(deprecatedPath)) return;
+      if (existsSync(overridePath)) return;
+
+      try {
+        renameSync(deprecatedPath, overridePath);
+      } catch (err) {
+        log.warn(
+          { err, from: deprecatedPath, to: overridePath },
+          "Failed to restore background-conversation override",
+        );
+        throw err;
+      }
+    },
+  };

package/src/workspace/migrations/registry.ts

@@ -84,6 +84,8 @@ import { systemPromptPrefixToFileMigration } from "./083-system-prompt-prefix-to
 import { removeLegacySkillsIndexMigration } from "./084-remove-legacy-skills-index.js";
 import { memoryV2Bm25BReembedDisabledV2PagesMigration } from "./085-memory-v2-bm25-b-reembed-disabled-v2-pages.js";
 import { revertStaleGeminiMisRewritesMigration } from "./086-revert-stale-gemini-mis-rewrites.js";
+import { memoryRouterBalancedProfileMigration } from "./087-memory-router-balanced-profile.js";
+import { deprecateBackgroundConversationOverrideMigration } from "./088-deprecate-background-conversation-override.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -179,4 +181,6 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   removeLegacySkillsIndexMigration,
   memoryV2Bm25BReembedDisabledV2PagesMigration,
   revertStaleGeminiMisRewritesMigration,
+  memoryRouterBalancedProfileMigration,
+  deprecateBackgroundConversationOverrideMigration,
 ];