@vellumai/assistant 0.8.3 → 0.8.5

package/src/prompts/sections.ts

@@ -93,7 +93,10 @@ function collectSectionIds(workspaceDir: string): string[] {
         if (name.endsWith(".md")) ids.add(name.slice(0, -".md".length));
       }
     } catch (err) {
-      log.warn({ err, workspaceDir }, "Failed to list workspace system prompt dir");
+      log.warn(
+        { err, workspaceDir },
+        "Failed to list workspace system prompt dir",
+      );
     }
   }
   return [...ids].sort();
@@ -102,10 +105,12 @@ function collectSectionIds(workspaceDir: string): string[] {
 interface ResolvedSection {
   enabled: string | boolean | undefined;
   body: string;
+  transform?: BundledSection["transform"];
 }
 
 function resolveSection(
   id: string,
+  ctx: SectionRenderContext,
   workspaceDir: string,
 ): ResolvedSection | null {
   const workspacePath = join(workspaceDir, `${id}.md`);
@@ -114,12 +119,20 @@ function resolveSection(
     try {
       raw = readFileSync(workspacePath, "utf-8");
     } catch (err) {
-      log.warn({ err, workspacePath }, "Failed to read workspace section override");
+      log.warn(
+        { err, workspacePath },
+        "Failed to read workspace section override",
+      );
       return null;
     }
     const parsed = parseFrontmatterFields(raw);
     const fields = parsed?.fields ?? {};
     const body = parsed?.body ?? raw;
+    // Workspace override skips the bundled transform: when the user has
+    // written their own `prompts/system/<id>.md` they've taken full
+    // control of the body shape, and re-running the bundled transform
+    // (e.g. unmodified-template detection on IDENTITY.md) would
+    // misclassify their override.
     return { enabled: fields["enabled"] as string | boolean | undefined, body };
   }
   const bundled = BUNDLED_SYSTEM_SECTIONS.find((s) => s.id === id);
@@ -127,25 +140,58 @@ function resolveSection(
 
   // A bundled section may delegate its body to a workspace file outside
   // the section override directory (e.g. `SOUL.md` at the workspace
-  // root).  Read it now; missing/empty files yield "", which
-  // `renderSection` then gates off via its empty-body check.
+  // root).  `workspacePath` may be a single path or an array of paths
+  // tried in order — the first one whose file exists and has non-empty
+  // content wins.  Each entry may reference `{{ctx-key}}` variables
+  // (e.g. `users/{{userSlug}}.md`) that are interpolated against the
+  // render context before resolution.  Missing/empty files yield "",
+  // which `renderSection` then gates off via its empty-body check (or
+  // via the section's `transform`, if set).
   if (bundled.workspacePath) {
-    const filePath = getWorkspacePromptPath(bundled.workspacePath);
+    const paths = Array.isArray(bundled.workspacePath)
+      ? bundled.workspacePath
+      : [bundled.workspacePath];
     let body = "";
-    if (existsSync(filePath)) {
+    for (const pathTemplate of paths) {
+      const interpolated = interpolateWorkspacePath(pathTemplate, ctx);
+      const filePath = getWorkspacePromptPath(interpolated);
+      if (!existsSync(filePath)) continue;
       try {
-        body = readFileSync(filePath, "utf-8");
+        const content = readFileSync(filePath, "utf-8");
+        if (content.trim().length > 0) {
+          body = content;
+          break;
+        }
       } catch (err) {
-        log.warn(
-          { err, filePath, id },
-          "Failed to read section workspacePath",
-        );
+        log.warn({ err, filePath, id }, "Failed to read section workspacePath");
       }
     }
-    return { enabled: bundled.enabled, body };
+    return { enabled: bundled.enabled, body, transform: bundled.transform };
   }
 
-  return { enabled: bundled.enabled, body: bundled.body };
+  return {
+    enabled: bundled.enabled,
+    body: bundled.body,
+    transform: bundled.transform,
+  };
+}
+
+/**
+ * Interpolate `{{key}}` references in a workspace-path template against
+ * `ctx`. Section / inverted-section tags are not supported in paths —
+ * only flat variable substitution. Unresolved keys stay literal so a
+ * typo surfaces as a missing file rather than silently rendering an
+ * unrelated section.
+ */
+function interpolateWorkspacePath(
+  template: string,
+  ctx: SectionRenderContext,
+): string {
+  return template.replace(VARIABLE, (match, key: string) => {
+    const value = ctx[key];
+    if (value === undefined || value === null) return match;
+    return String(value);
+  });
 }
 
 function renderSection(
@@ -153,12 +199,19 @@ function renderSection(
   ctx: SectionRenderContext,
   workspaceDir: string,
 ): string | null {
-  const section = resolveSection(id, workspaceDir);
+  const section = resolveSection(id, ctx, workspaceDir);
   if (section === null) return null;
 
   if (!isEnabled(section.enabled, ctx)) return null;
 
-  const stripped = stripCommentLines(section.body).trim();
+  let body = section.body;
+  if (section.transform) {
+    const transformed = section.transform(body, ctx);
+    if (transformed === null) return null;
+    body = transformed;
+  }
+
+  const stripped = stripCommentLines(body).trim();
   if (stripped.length === 0) return null;
   return interpolateVariables(stripped, ctx);
 }
@@ -190,10 +243,7 @@ const IDENT_REGEX = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
  * typo on a `{{key}}` substitution surfaces at the warn log rather than
  * inlining the string `"undefined"`).
  */
-function interpolateVariables(
-  body: string,
-  ctx: SectionRenderContext,
-): string {
+function interpolateVariables(body: string, ctx: SectionRenderContext): string {
   // Collapse standalone tag lines so multiline section templates render
   // without phantom blank lines from the layout markers.
   const collapsed = body.replace(STANDALONE_TAG_LINE, "$1");

package/src/prompts/system-prompt.ts

@@ -4,12 +4,13 @@ import {
   mkdirSync,
   readdirSync,
   readFileSync,
+  writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
-import { getCachedManagedConnections } from "../credential-execution/managed-catalog.js";
-import { listConnections } from "../oauth/oauth-store.js";
+import type { ChannelCapabilities } from "../daemon/conversation-runtime-assembly.js";
+import type { TrustContext } from "../daemon/trust-context.js";
 import type { OnboardingContext } from "../types/onboarding-context.js";
 import { resolveBundledDir } from "../util/bundled-asset.js";
 import { getLogger } from "../util/logger.js";
@@ -20,25 +21,28 @@ import {
 } from "../util/platform.js";
 import { stripCommentLines } from "../util/strip-comment-lines.js";
 import { cleanupBootstrapFiles } from "./bootstrap-cleanup.js";
-import { SYSTEM_PROMPT_CACHE_BOUNDARY } from "./cache-boundary.js";
-import { normalizeOnboardingContext } from "./normalize-onboarding.js";
+import {
+  resolveGuardianPersona,
+  resolveUserSlug,
+} from "./persona-resolver.js";
 import { renderWorkspaceSections } from "./sections.js";
+import { isTemplateContent } from "./template-detection.js";
 
-export { SYSTEM_PROMPT_CACHE_BOUNDARY };
+export { isTemplateContent };
 
-const BOOTSTRAP_VOICE_BLOCKS: Record<string, string> = {
-  grounded:
-    "## Voice\nCalm, direct, precise. No filler. Lead with the thing, explain if needed. Opinions stated plainly.",
-  warm: "## Voice\nFriendly and easy. Match their energy quickly. Warmth comes through in word choice, not in announcements. Warmth comes through in how you engage, not in hedging about yourself. Never say you're new, running on instinct, or still figuring yourself out.",
-  energetic:
-    "## Voice\nFast and generative. Lean into momentum. Enthusiasm is in the pace, not the exclamations.",
-  poetic:
-    "## Voice\nThoughtful and unhurried. Notice things. Word choice matters. Don't rush to close — sometimes the observation is the value.",
+/**
+ * Maps onboarding cohort identifiers to their cohort-specific bootstrap
+ * template filenames.  When a cohort key is present in OnboardingContext,
+ * `maybeReseedBootstrapForCohort` swaps the generic BOOTSTRAP.md with the
+ * cohort-specific variant — but only if the workspace file is still pristine.
+ */
+const COHORT_BOOTSTRAP_TEMPLATES: Record<string, string> = {
+  "content-automation": "BOOTSTRAP-CONTENT-AUTOMATION.md",
 };
 
 const log = getLogger("system-prompt");
 
-const PROMPT_FILES = ["SOUL.md", "IDENTITY.md"] as const;
+const PROMPT_FILES = ["IDENTITY.md", "SOUL.md"] as const;
 
 function hasPopulatedUsersDir(): boolean {
   try {
@@ -210,224 +214,118 @@ export function ensurePromptFiles(): void {
 }
 
 /**
- * Build the system prompt from ~/.vellum prompt files.
- *
- * Composition:
- *   1. Base prompt: IDENTITY.md + SOUL.md (guaranteed to exist after ensurePromptFiles)
- *   2. Append the resolved user persona from users/<slug>.md (via options.userPersona)
- *   3. If BOOTSTRAP.md exists, append first-run ritual instructions
+ * One-shot swap: if the workspace BOOTSTRAP.md is still the unmodified generic
+ * template AND a cohort-specific template exists, overwrite the workspace file
+ * with the cohort variant.  No-op when BOOTSTRAP.md has been deleted, modified,
+ * or the cohort has no mapped template.
  */
+export function maybeReseedBootstrapForCohort(cohort: string): void {
+  const templateFileName = COHORT_BOOTSTRAP_TEMPLATES[cohort];
+  if (!templateFileName) return;
+
+  const bootstrapPath = getWorkspacePromptPath("BOOTSTRAP.md");
+  if (!existsSync(bootstrapPath)) return;
+
+  const currentContent = readPromptFile(bootstrapPath);
+  // Compare against the GENERIC "BOOTSTRAP.md" template, not the cohort-
+  // specific one.  After the swap, the workspace content no longer matches
+  // the generic template, so this guard returns false on subsequent calls —
+  // making the swap idempotent.  Do NOT change the comparison target to the
+  // cohort template filename; that would re-swap on every prompt build.
+  if (!isTemplateContent(currentContent, "BOOTSTRAP.md")) return;
+
+  const templatesDir = resolveBundledDir(
+    import.meta.dirname ?? __dirname,
+    "templates",
+    "templates",
+  );
+  const cohortTemplatePath = join(templatesDir, templateFileName);
+  if (!existsSync(cohortTemplatePath)) {
+    log.warn(
+      { cohort, templateFileName },
+      "Cohort bootstrap template not found, keeping generic BOOTSTRAP.md",
+    );
+    return;
+  }
+
+  try {
+    const cohortContent = readFileSync(cohortTemplatePath, "utf-8");
+    writeFileSync(bootstrapPath, cohortContent, "utf-8");
+    log.info(
+      { cohort, templateFileName },
+      "Replaced generic BOOTSTRAP.md with cohort-specific template",
+    );
+  } catch (err) {
+    log.warn(
+      { err, cohort, templateFileName },
+      "Failed to reseed BOOTSTRAP.md for cohort",
+    );
+  }
+}
+
 export interface BuildSystemPromptOptions {
   hasNoClient?: boolean;
   excludeBootstrap?: boolean;
   excludeCustomPrefix?: boolean;
-  userPersona?: string | null;
-  channelPersona?: string | null;
-  userSlug?: string | null;
+  trustContext?: TrustContext;
+  channelCapabilities?: ChannelCapabilities;
   onboardingContext?: OnboardingContext;
 }
 
 /**
- * Sentinel that separates the static instruction prefix (stable across turns)
- * from the dynamic workspace suffix (changes when workspace files are edited).
- *
- * The Anthropic provider splits on this marker to create two system-prompt
- * cache blocks so that static instructions stay cached even when workspace
- * files change between turns.
+ * Build the system prompt by rendering `BUNDLED_SYSTEM_SECTIONS` (with
+ * workspace overrides per section).  Per-section behaviour lives in
+ * `system-sections.ts`; the renderer in `sections.ts` handles
+ * frontmatter `enabled:` predicates, `{{variable}}` interpolation,
+ * file-backed bodies, and runtime-computed transforms.
  */
 export function buildSystemPrompt(options?: BuildSystemPromptOptions): string {
+  // One-shot cohort swap: if the user has a cohort and BOOTSTRAP.md is still
+  // the generic template, replace it with the cohort-specific variant before
+  // the prompt reads the file.
+  if (options?.onboardingContext?.cohort) {
+    maybeReseedBootstrapForCohort(options.onboardingContext.cohort);
+  }
+
+  // Slugs used by the persona sections (`10-user-persona`,
+  // `11-channel-persona`) and the BOOTSTRAP block.  `userSlug` is the
+  // raw slug derived from the caller's trust context (falling back to
+  // the guardian's contact, then to "default" when nothing resolves);
+  // `users/<slug>.md → users/default.md` fallback lives in the
+  // section's `workspacePath` array.  `channelSlug` is the channel
+  // identifier from `channelCapabilities`, defaulting to "vellum".
+  const userSlug = resolveUserSlug(options?.trustContext) ?? "default";
+  const channelSlug = options?.channelCapabilities?.channel ?? "vellum";
+
   // Section render context.  Workspace section frontmatter `enabled:`
-  // predicates and `{{key}}` / `{{#flag}}...{{/flag}}` body interpolation
-  // both resolve against this map, so anything the renderer needs to see
-  // (runtime gates, paths) must be lifted onto `ctx` rather than branched
-  // on at the call site.  Mustache section tags `{{#flag}}` / `{{^flag}}`
-  // coerce `ctx[flag]` to boolean via `Boolean(...)`, so options that are
-  // undefined (caller didn't pass them) behave identically to false — no
-  // explicit normalization needed; `...options` is enough.
+  // predicates, `{{key}}` / `{{#flag}}...{{/flag}}` body interpolation,
+  // and `{{key}}` paths inside `workspacePath` all resolve against this
+  // map, so anything the renderer needs to see (runtime gates, slugs,
+  // paths) must be lifted onto `ctx` rather than branched on at the
+  // call site.  Mustache section tags `{{#flag}}` / `{{^flag}}` coerce
+  // `ctx[flag]` to boolean via `Boolean(...)`, so options that are
+  // undefined (caller didn't pass them) behave identically to false —
+  // no explicit normalization needed; `...options` is enough.
   const ctx = {
     ...options,
     isContainerized: getIsContainerized(),
     workspaceDir: getWorkspaceDir(),
+    userSlug,
+    channelSlug,
   };
 
-  // Single array.  Everything pushed before `dynamicStart` lands in the
-  // static (cached) prefix; everything after lands in the dynamic suffix.
-  // The two halves are joined around `SYSTEM_PROMPT_CACHE_BOUNDARY` so the
-  // Anthropic provider can key its prompt cache on the prefix.
-  const systemParts: string[] = [...renderWorkspaceSections(ctx)];
-  const dynamicStart = systemParts.length;
-
-  // SOUL.md is rendered by the `09-soul` workspace-backed section
-  // (see templates/system-sections.ts) — no inline read needed here.
-  const identityPath = getWorkspacePromptPath("IDENTITY.md");
-  const bootstrapPath = getWorkspacePromptPath("BOOTSTRAP.md");
-
-  const identity = readPromptFile(identityPath);
-  const bootstrap = readPromptFile(bootstrapPath);
-
-  const includeBootstrap = !!bootstrap && !options?.excludeBootstrap;
-
-  // Template prompt files contain placeholder fields and meta-instructions
-  // meant for the assistant to fill in during onboarding.  When included
-  // verbatim in the system prompt, the model can leak internal details and
-  // narrate its own setup process instead of following the BOOTSTRAP.md
-  // ritual.  Detect unmodified templates by comparing against the bundled
-  // source and skip them — SOUL.md provides sufficient personality defaults
-  // until onboarding completes.
-  const identityIsTemplate = isTemplateContent(identity, "IDENTITY.md");
-
-  if (identity && (!identityIsTemplate || includeBootstrap)) {
-    if (identityIsTemplate) {
-      // During bootstrap the model needs to see the template structure
-      // so it can produce a valid file_write with the right fields.
-      systemParts.push(identity);
-    } else {
-      // Strip placeholder lines (e.g. "- **Name:** _(not yet chosen)_") so
-      // the model doesn't treat unresolved fields as prompts to ask the user.
-      const cleanedIdentity = identity
-        .split("\n")
-        .filter((line) => !/_\(not yet (?:chosen|established)\)_/.test(line))
-        .join("\n");
-      if (cleanedIdentity.trim()) {
-        systemParts.push(cleanedIdentity);
-      }
-    }
-  }
-  if (options?.userPersona) systemParts.push(options.userPersona);
-  if (options?.channelPersona) systemParts.push(options.channelPersona);
-  if (includeBootstrap) {
-    const userSlug = options?.userSlug ?? "default";
-    const bootstrapWithSlug = bootstrap.replaceAll(
-      "{{USER_PERSONA_FILE}}",
-      `${userSlug}.md`,
-    );
-    let bootstrapContent = bootstrapWithSlug;
-    const voiceBlock = options?.onboardingContext?.tone
-      ? BOOTSTRAP_VOICE_BLOCKS[options.onboardingContext.tone]
-      : undefined;
-    if (voiceBlock) {
-      bootstrapContent = voiceBlock + "\n\n" + bootstrapContent;
-    }
-    systemParts.push(
-      "# First-Run Ritual\n\n" +
-        "BOOTSTRAP.md is present — this is your first conversation. Follow its instructions.\n\n" +
-        bootstrapContent,
-    );
-
-    if (options?.onboardingContext) {
-      const n = normalizeOnboardingContext(options.onboardingContext);
-      const lines: string[] = [
-        "## First-Run User Context",
-        "",
-        "The user completed setup before this conversation.",
-        "",
-        "Known context:",
-      ];
-      if (n.preferredName) lines.push(`- Name: ${n.preferredName}`);
-      if (n.commonWork.length)
-        lines.push(`- Common work: ${n.commonWork.join("; ")}`);
-      if (n.dailyTools.length)
-        lines.push(`- Daily tools: ${n.dailyTools.join(", ")}`);
-      if (n.assistantName)
-        lines.push(`- Chosen assistant name: ${n.assistantName}`);
-      if (n.tone) lines.push(`- Preferred initial voice: ${n.tone}`);
-      if (n.googleConnected && n.googleServices?.length) {
-        lines.push(
-          `- Google connected: yes (${n.googleServices.join(", ")} access granted)`,
-        );
-      }
-      lines.push(
-        "",
-        "Apply this context quietly. Do not recap it as a list unless the user asks.",
-      );
-      systemParts.push(lines.join("\n"));
-    }
-  }
-  // Configuration section removed — workspace files are self-describing,
-  // tool routing lives in tool descriptions.
-  // External Communications Identity removed — guidance lives in messaging
-  // and phone-calls skill SKILL.md files.
-  const integrationSection = buildIntegrationSection();
-  if (integrationSection) systemParts.push(integrationSection);
-
-  // Journal entries are extracted into graph nodes by the memory pipeline.
-  // Journal files remain writable on disk.
-
-  return (
-    systemParts.slice(0, dynamicStart).join("\n\n") +
-    SYSTEM_PROMPT_CACHE_BOUNDARY +
-    systemParts.slice(dynamicStart).join("\n\n")
-  );
-}
-
-function buildIntegrationSection(): string {
-  const entries: { provider: string; accountInfo?: string | null }[] = [];
-
-  // Local (BYO) connections from the SQLite store.
-  try {
-    const local = listConnections().filter((c) => c.status === "active");
-    entries.push(...local);
-  } catch {
-    // DB not available — skip local connections
-  }
-
-  // Platform-managed connections from the in-memory cache (populated at
-  // daemon startup and refreshed periodically).
-  const managed = getCachedManagedConnections();
-  for (const mc of managed) {
-    // Provider-level dedup is intentional: this section is a summary of
-    // connected services for the system prompt, not an exhaustive account
-    // list. Multiple accounts for the same provider (e.g. two Google
-    // accounts) collapse into a single line to keep the prompt compact.
-    if (!entries.some((e) => e.provider === mc.provider)) {
-      entries.push(mc);
-    }
-  }
-
-  if (entries.length === 0) return "";
-
-  const lines = ["# Connected Services", ""];
-  for (const conn of entries) {
-    const state = conn.accountInfo
-      ? `Connected (${conn.accountInfo})`
-      : "Connected";
-    lines.push(`- **${conn.provider}**: ${state}`);
-  }
-
-  return lines.join("\n");
+  // Every system-prompt block flows through the bundled section
+  // pipeline — including runtime-computed entries like
+  // `14-connected-services` whose body is derived from live OAuth
+  // caches.  The whole prompt is treated as a single cached block by
+  // the Anthropic provider; per-provider details live in each
+  // provider's client.
+  return renderWorkspaceSections(ctx).join("\n\n");
 }
 
 // Re-export from shared util so existing importers don't break.
 export { stripCommentLines } from "../util/strip-comment-lines.js";
 
-/**
- * Returns true when the prompt file content is still the unmodified template
- * shipped with the daemon.  Compares the stripped workspace content against
- * the stripped bundled template source so the check stays accurate even if
- * templates are edited in future releases.
- */
-export function isTemplateContent(
-  content: string | null,
-  templateFileName: string,
-): boolean {
-  if (content == null) return false;
-  const templatesDir = resolveBundledDir(
-    import.meta.dirname ?? __dirname,
-    "templates",
-    "templates",
-  );
-  const templatePath = join(templatesDir, templateFileName);
-  if (!existsSync(templatePath)) return false;
-  try {
-    const templateContent = stripCommentLines(
-      readFileSync(templatePath, "utf-8"),
-    );
-    return content === templateContent;
-  } catch {
-    return false;
-  }
-}
-
 export function readPromptFile(path: string): string | null {
   if (!existsSync(path)) return null;
 
@@ -444,14 +342,17 @@ export function readPromptFile(path: string): string | null {
 
 /**
  * Reads the core identity/personality prompt files (SOUL.md, IDENTITY.md)
- * and concatenates whichever exist. Returns null if none are present.
+ * and concatenates whichever exist, plus the guardian's user persona when
+ * one is resolvable. Returns null if none are present.
  *
- * This is useful for injecting identity context into subsystems (e.g. memory
- * extraction) that run outside the main system prompt pipeline.
+ * Used by subsystems (memory extraction, conversation starters,
+ * notification decisions) that run outside the per-turn pipeline and want
+ * the assistant's "view of themselves and their guardian" without a trust
+ * context. The guardian persona fold is what callers used to do manually
+ * by passing `userPersona: resolveGuardianPersona()` — folding it in here
+ * removes the duplicated dance at every call site.
  */
-export function buildCoreIdentityContext(opts?: {
-  userPersona?: string | null;
-}): string | null {
+export function buildCoreIdentityContext(): string | null {
   const parts: string[] = [];
   for (const file of PROMPT_FILES) {
     const content = readPromptFile(getWorkspacePromptPath(file));
@@ -462,6 +363,7 @@ export function buildCoreIdentityContext(opts?: {
     if (file !== "SOUL.md" && isTemplateContent(content, file)) continue;
     parts.push(content);
   }
-  if (opts?.userPersona) parts.push(opts.userPersona);
+  const guardianPersona = resolveGuardianPersona();
+  if (guardianPersona) parts.push(guardianPersona);
   return parts.length > 0 ? parts.join("\n\n") : null;
 }

package/src/prompts/template-detection.ts

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { resolveBundledDir } from "../util/bundled-asset.js";
+import { stripCommentLines } from "../util/strip-comment-lines.js";
+
+/**
+ * Returns true when the prompt file content is still the unmodified template
+ * shipped with the daemon.  Compares the stripped workspace content against
+ * the stripped bundled template source so the check stays accurate even if
+ * templates are edited in future releases.
+ *
+ * Kept in a leaf module so the bundled section registry can depend on it
+ * without forming a cycle through `system-prompt.ts → sections.ts →
+ * templates/system-sections.ts`.
+ */
+export function isTemplateContent(
+  content: string | null,
+  templateFileName: string,
+): boolean {
+  if (content == null) return false;
+  const templatesDir = resolveBundledDir(
+    import.meta.dirname ?? __dirname,
+    "templates",
+    "templates",
+  );
+  const templatePath = join(templatesDir, templateFileName);
+  if (!existsSync(templatePath)) return false;
+  try {
+    const templateContent = stripCommentLines(
+      readFileSync(templatePath, "utf-8"),
+    );
+    return content === templateContent;
+  } catch {
+    return false;
+  }
+}