@vellumai/assistant 0.8.3 → 0.8.5

package/src/util/favicon.ts

@@ -0,0 +1,40 @@
+import { isPrivateOrLocalHost } from "../tools/network/url-safety.js";
+
+/** Strip the trailing `:port` from a host string. IPv6 hosts are bracketed
+ *  ("[::1]:8080" → "[::1]"); IPv4/DNS hosts have a single colon ("host:8080" → "host"). */
+function stripPort(host: string): string {
+  if (host.startsWith("[")) {
+    const end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  const lastColon = host.lastIndexOf(":");
+  if (lastColon === -1) return host;
+  return host.slice(0, lastColon);
+}
+
+/** Match any IP literal — IPv4 dotted-quad or IPv6 (bracketed or bare with a colon).
+ *  We reject every IP from the favicon path because we don't reverse-lookup hosts,
+ *  so a raw IP — public or private — would expose the literal to Google when the
+ *  client renders the icon. DNS names are fine; only literals are rejected. */
+function isIPLiteral(host: string): boolean {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.startsWith("[") || host.includes(":")) return true;
+  return false;
+}
+
+/** Deterministic favicon URL for a host using Google's s2 service.
+ *  Returns undefined for empty/malformed hosts, raw IP literals, and any host
+ *  isPrivateOrLocalHost flags. Callers omit the field on undefined so we never
+ *  leak internal hostnames or arbitrary IPs to Google when clients render the
+ *  icon. */
+export function faviconUrlForDomain(domain: string): string | undefined {
+  const trimmed = domain.trim().toLowerCase();
+  if (!trimmed || trimmed.includes("/") || trimmed.includes(" ")) {
+    return undefined;
+  }
+  const hostOnly = stripPort(trimmed);
+  if (!hostOnly || isIPLiteral(hostOnly) || isPrivateOrLocalHost(hostOnly)) {
+    return undefined;
+  }
+  return `https://www.google.com/s2/favicons?domain=${encodeURIComponent(hostOnly)}&sz=64`;
+}

package/src/util/logger.ts

@@ -17,7 +17,7 @@ import {
   getIsContainerized,
 } from "../config/env-registry.js";
 import { logSerializers } from "./log-redact.js";
-import { getLogPath } from "./platform.js";
+import { getLogsDir } from "./platform.js";
 import { createSentryLogStream } from "./sentry-log-stream.js";
 
 /** Common pino-pretty options that inline [module] into the message prefix. */
@@ -87,7 +87,7 @@ function resolveLogDir(config: LogFileConfig): string | undefined {
       if (getIsContainerized()) {
         // Config has a host-specific path that can't be created inside the
         // container (e.g. /Users/…). Fall back to the default log directory.
-        const fallback = join(getLogPath(), "..");
+        const fallback = getLogsDir();
         console.warn(
           `[logger] Configured logFile.dir "${config.dir}" cannot be created ` +
             `in container (${(err as Error).message}). Falling back to "${fallback}".`,
@@ -210,7 +210,8 @@ function getRootLogger(): pino.Logger {
     }
 
     try {
-      const logPath = getLogPath();
+      const logDir = getLogsDir();
+      const logPath = logFilePathForDate(logDir, new Date());
       // Use sync: true so the fd is opened immediately. This prevents
       // "sonic boom is not ready yet" errors when commander calls
       // process.exit(0) for --help/--version before the async fd is ready.
@@ -247,6 +248,10 @@ function getRootLogger(): pino.Logger {
           fileStream,
         );
       }
+
+      // Register state so ensureCurrentDate() rebuilds across UTC midnight.
+      activeLogFileConfig = { dir: logDir, retentionDays: 0 };
+      activeLogDate = formatDate(new Date());
     } catch {
       rootLogger = pino(
         {
@@ -274,16 +279,20 @@ export function truncateForLog(value: string, maxLen = 500): string {
 /**
  * Returns a lazy logger that only initializes pino when a log method is called.
  * This avoids "sonic boom is not ready yet" errors when the process exits
- * quickly (e.g. `assistant --help`).
+ * quickly (e.g. `assistant --help`). The child is rebuilt whenever the
+ * underlying root logger changes (e.g. day rollover, late initLogger()).
  */
 export function getLogger(name: string): pino.Logger {
+  let cachedRoot: pino.Logger | null = null;
   let child: pino.Logger | null = null;
   const handler: ProxyHandler<pino.Logger> = {
     get(_target, prop, receiver) {
-      if (!child) {
-        child = getRootLogger().child({ module: name });
+      const root = getRootLogger();
+      if (root !== cachedRoot) {
+        cachedRoot = root;
+        child = root.child({ module: name });
       }
-      const val = Reflect.get(child, prop, receiver);
+      const val = Reflect.get(child!, prop, receiver);
       if (typeof val === "function") {
         return val.bind(child);
       }

package/src/util/platform.ts

@@ -103,10 +103,6 @@ export function getSandboxWorkingDir(): string {
   return getWorkspaceDir();
 }
 
-export function getInterfacesDir(): string {
-  return join(getDataDir(), "interfaces");
-}
-
 /**
  * Returns the sounds directory (~/.vellum/workspace/data/sounds).
  * Custom sound files and sound configuration live here.
@@ -162,8 +158,13 @@ export function getDbPath(): string {
   return join(getDataDir(), "db", "assistant.db");
 }
 
-export function getLogPath(): string {
-  return join(getDataDir(), "logs", "vellum.log");
+/**
+ * Returns the directory where logs live: `<dataDir>/logs/`. Files rotate
+ * daily (`assistant-YYYY-MM-DD.log`), so callers ask for the directory and
+ * let the logger own the filename.
+ */
+export function getLogsDir(): string {
+  return join(getDataDir(), "logs");
 }
 
 export function getHistoryPath(): string {
@@ -413,7 +414,6 @@ export function ensureDataDir(): void {
     join(wsData, "memory", "knowledge"),
     join(wsData, "apps"),
     join(wsData, "attachments"),
-    join(wsData, "interfaces"),
     join(wsData, "sounds"),
   ];
   for (const dir of dirs) {

package/src/util/sqlite3-runtime.ts

@@ -0,0 +1,65 @@
+/**
+ * Shared helper for locating a `sqlite3` CLI binary on the host.
+ *
+ * Used by `memory/db-async-query.ts` so slow statements (`VACUUM`,
+ * `PRAGMA optimize`, large bulk deletes) can be shelled out to a
+ * subprocess and run without blocking the daemon's main event loop.
+ *
+ * Resolution order (matches the spirit of `bun-runtime.ts#findBun()`):
+ *   1. Common system install locations
+ *   2. `Bun.which("sqlite3")` (PATH lookup)
+ *
+ * Unlike `bun-runtime.ts`, this module does **not** download `sqlite3`
+ * when missing. The async path is opt-out (callers fall back to the
+ * synchronous in-process `bun:sqlite` connection); if a user wants the
+ * non-blocking behavior they install one package.
+ *
+ * On platform (k8s assistant container) `sqlite3` is installed in the
+ * Dockerfile, so the primary path is always available there. On macOS
+ * `sqlite3` ships with the OS. On most Linux distros it's available via
+ * the system package manager.
+ */
+
+import { existsSync } from "node:fs";
+
+let cachedSqlite3Path: string | undefined | null;
+
+/**
+ * Synchronous lookup for a usable `sqlite3` CLI binary.
+ * Returns the path if found, `undefined` otherwise. Result is cached
+ * per-process so the filesystem checks only happen once.
+ */
+export function findSqlite3(): string | undefined {
+  if (cachedSqlite3Path !== undefined) {
+    return cachedSqlite3Path ?? undefined;
+  }
+
+  // 1. Common install locations. We check these before `Bun.which` so we
+  //    pick a deterministic, predictable binary even when PATH is
+  //    unusual (e.g. a daemon launched with a stripped env).
+  for (const p of [
+    "/usr/bin/sqlite3",
+    "/usr/local/bin/sqlite3",
+    "/opt/homebrew/bin/sqlite3",
+  ]) {
+    if (existsSync(p)) {
+      cachedSqlite3Path = p;
+      return p;
+    }
+  }
+
+  // 2. PATH lookup.
+  const which = Bun.which("sqlite3");
+  if (which) {
+    cachedSqlite3Path = which;
+    return which;
+  }
+
+  cachedSqlite3Path = null;
+  return undefined;
+}
+
+/** Reset the cached lookup. Test-only. */
+export function _resetSqlite3Cache(): void {
+  cachedSqlite3Path = undefined;
+}

package/src/workspace/git-service.ts

@@ -1,5 +1,12 @@
 import { execFile, spawnSync } from "node:child_process";
-import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { join } from "node:path";
 import { promisify } from "node:util";
 
@@ -70,6 +77,41 @@ const WORKSPACE_GITIGNORE_RULES = [
   "session-token",
 ];
 
+const NULL_GIT_OID = "0000000000000000000000000000000000000000";
+
+const WORKSPACE_BRANCH_GUARD_HOOK = `#!/bin/sh
+set -eu
+
+state="\${1:-}"
+if [ "$state" != "prepared" ]; then
+  exit 0
+fi
+
+while read -r _old_oid new_oid refname; do
+  case "$refname" in
+    refs/heads/main)
+      ;;
+    refs/heads/*)
+      if [ "$new_oid" = "${NULL_GIT_OID}" ]; then
+        continue
+      fi
+
+      cat >&2 <<MSG
+Blocked: assistant workspace git branches are disabled.
+
+Use the workspace main branch for assistant state. Create task branches only in
+external product repositories or dedicated worktrees.
+
+Rejected ref update: $refname
+MSG
+      exit 1
+      ;;
+  esac
+done
+
+exit 0
+`;
+
 /** Properties added by Node's child_process errors. */
 interface ExecError extends Error {
   killed?: boolean;
@@ -426,7 +468,9 @@ export class WorkspaceGitService {
                 // These calls are OUTSIDE the rev-parse try/catch so that
                 // normalization errors are not misclassified as "no commits".
                 this.ensureGitignoreRulesLocked();
+                this.ensureBranchGuardHookLocked();
                 await this.ensureCommitIdentityLocked();
+                await this.ensureBranchGuardConfigLocked();
                 await this.ensureOnMainLocked();
                 this.initialized = true;
                 this.recordInitSuccess();
@@ -444,7 +488,9 @@ export class WorkspaceGitService {
           // in the corruption-recovery path we fall through here after
           // removing .git, so branch enforcement is still useful.
           this.ensureGitignoreRulesLocked();
+          this.ensureBranchGuardHookLocked();
           await this.ensureCommitIdentityLocked();
+          await this.ensureBranchGuardConfigLocked();
           await this.ensureOnMainLocked();
 
           // Create initial commit synchronously within the lock to prevent
@@ -452,9 +498,14 @@ export class WorkspaceGitService {
           // initial commit could run concurrently and consume edits meant
           // for the first user-requested commit.
           const status = await this.getStatusInternal();
-          const hasExistingFiles =
-            status.untracked.length > 1 || // More than just .gitignore
-            status.untracked.some((f) => f !== ".gitignore");
+          const autoCreatedInitFiles = new Set([
+            ".gitignore",
+            ".githooks/",
+            ".githooks/reference-transaction",
+          ]);
+          const hasExistingFiles = status.untracked.some(
+            (f) => !autoCreatedInitFiles.has(f),
+          );
 
           await this.execGit(["add", "-A"]);
 
@@ -766,6 +817,26 @@ export class WorkspaceGitService {
     await this.execGit(["config", "user.email", gitEmail]);
   }
 
+  /**
+   * Ensure workspace branch guard hook is present.
+   * Must be called with the mutex lock held.
+   */
+  private ensureBranchGuardHookLocked(): void {
+    const hooksDir = join(this.workspaceDir, ".githooks");
+    const hookPath = join(hooksDir, "reference-transaction");
+    mkdirSync(hooksDir, { recursive: true });
+    writeFileSync(hookPath, WORKSPACE_BRANCH_GUARD_HOOK, "utf-8");
+    chmodSync(hookPath, 0o755);
+  }
+
+  /**
+   * Ensure workspace git uses the branch guard hook path.
+   * Must be called with the mutex lock held.
+   */
+  private async ensureBranchGuardConfigLocked(): Promise<void> {
+    await this.execGit(["config", "core.hooksPath", ".githooks"]);
+  }
+
   /**
    * Ensure the workspace repo is on the `main` branch.
    * If on a different branch or in detached HEAD state, switches to main

package/src/workspace/migrations/086-revert-stale-gemini-mis-rewrites.ts

@@ -140,6 +140,7 @@ const GEMINI_CATALOG_MODELS = new Set<string>([
   "gemini-3.1-pro-preview-customtools",
   "gemini-3-flash-preview",
   "gemini-3.1-flash-lite-preview",
+  "gemini-3.1-flash-lite",
   "gemini-2.5-flash",
   "gemini-2.5-flash-lite",
   "gemini-2.5-pro",

package/src/workspace/migrations/088-deprecate-background-conversation-override.ts

@@ -0,0 +1,103 @@
+/**
+ * Workspace migration 088: Deprecate stale
+ * `prompts/system/08-background-conversation.md` overrides.
+ *
+ * PR #31210 moved the background-conversation guidance out of the bundled
+ * system prompt and into a per-turn user-message injector. As a side effect:
+ *
+ *   - Workspace overrides that gated on `{{#isBackgroundConversation}}` now
+ *     evaluate the gate as false (the key is no longer passed to the system
+ *     prompt context) and silently stop rendering in background turns.
+ *   - Plain-text overrides without a gate would now render unconditionally
+ *     in ALL conversations — the opposite of intended behavior.
+ *
+ * Either failure mode is silent. To prevent it, this migration renames any
+ * existing `prompts/system/08-background-conversation.md` to
+ * `08-background-conversation.md.deprecated` so the section-discovery walker
+ * (which only picks up `.md` files) stops loading it, while preserving the
+ * user's customized text on disk for manual review.
+ *
+ * Idempotent: re-runs after `08-background-conversation.md` has already been
+ * renamed are no-ops. If both files exist (a user re-created the override
+ * after a prior partial run), the bundled section is gone — drop the `.md`
+ * and keep the previously-preserved `.deprecated` copy.
+ */
+
+import { existsSync, renameSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger(
+  "workspace-migration-088-deprecate-background-conversation-override",
+);
+
+const OVERRIDE_FILENAME = "08-background-conversation.md";
+const DEPRECATED_FILENAME = "08-background-conversation.md.deprecated";
+
+export const deprecateBackgroundConversationOverrideMigration: WorkspaceMigration =
+  {
+    id: "088-deprecate-background-conversation-override",
+    description:
+      "Rename stale prompts/system/08-background-conversation.md overrides to .deprecated so they stop rendering after the section moved to a per-turn injector",
+    retryFailedCheckpoint: true,
+
+    run(workspaceDir: string): void {
+      const promptDir = join(workspaceDir, "prompts", "system");
+      const overridePath = join(promptDir, OVERRIDE_FILENAME);
+      const deprecatedPath = join(promptDir, DEPRECATED_FILENAME);
+
+      if (!existsSync(overridePath)) return;
+
+      if (existsSync(deprecatedPath)) {
+        try {
+          unlinkSync(overridePath);
+          log.info(
+            { path: overridePath, preserved: deprecatedPath },
+            "Removed re-created background-conversation override; preserved copy already exists",
+          );
+        } catch (err) {
+          log.warn(
+            { err, path: overridePath },
+            "Failed to remove background-conversation override",
+          );
+          throw err;
+        }
+        return;
+      }
+
+      try {
+        renameSync(overridePath, deprecatedPath);
+        log.info(
+          { from: overridePath, to: deprecatedPath },
+          "Renamed stale background-conversation override to .deprecated",
+        );
+      } catch (err) {
+        log.warn(
+          { err, from: overridePath, to: deprecatedPath },
+          "Failed to rename background-conversation override",
+        );
+        throw err;
+      }
+    },
+
+    down(workspaceDir: string): void {
+      const promptDir = join(workspaceDir, "prompts", "system");
+      const overridePath = join(promptDir, OVERRIDE_FILENAME);
+      const deprecatedPath = join(promptDir, DEPRECATED_FILENAME);
+
+      if (!existsSync(deprecatedPath)) return;
+      if (existsSync(overridePath)) return;
+
+      try {
+        renameSync(deprecatedPath, overridePath);
+      } catch (err) {
+        log.warn(
+          { err, from: deprecatedPath, to: overridePath },
+          "Failed to restore background-conversation override",
+        );
+        throw err;
+      }
+    },
+  };

package/src/workspace/migrations/089-move-memory-tree-out-of-v3.ts

@@ -0,0 +1,86 @@
+import * as fs from "node:fs";
+import { dirname, join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-089-move-memory-tree-out-of-v3");
+
+function isNotFoundError(err: unknown): boolean {
+  return (
+    typeof err === "object" &&
+    err !== null &&
+    "code" in err &&
+    err.code === "ENOENT"
+  );
+}
+
+/**
+ * Move `<workspace>/memory/<fromRel>` to `<workspace>/memory/<toRel>` when the
+ * source exists and the destination does not. Idempotent: a missing source is a
+ * no-op (already migrated, or never created), and an existing destination is
+ * left untouched (we never clobber). Both directions go through here so `run`
+ * and `down` share the same safety checks.
+ */
+function moveMemorySubdir(
+  workspaceDir: string,
+  fromRel: string,
+  toRel: string,
+): void {
+  const memoryDir = join(workspaceDir, "memory");
+  const src = join(memoryDir, fromRel);
+  const dest = join(memoryDir, toRel);
+  try {
+    if (!fs.existsSync(src)) return;
+    if (fs.existsSync(dest)) {
+      log.warn(
+        { src, dest },
+        "Both source and destination tree dirs exist; leaving in place for manual resolution",
+      );
+      return;
+    }
+    fs.mkdirSync(dirname(dest), { recursive: true });
+    fs.renameSync(src, dest);
+    log.info({ src, dest }, "Moved memory tree directory");
+  } catch (err) {
+    if (isNotFoundError(err)) return;
+    log.warn({ err, src, dest }, "Failed to move memory tree directory");
+    throw err;
+  }
+}
+
+/** Remove `<workspace>/memory/v3` if it is now an empty wrapper (the tree was
+ *  its only child). Best-effort — a non-empty or missing dir is left alone. */
+function removeEmptyV3Wrapper(workspaceDir: string): void {
+  const v3Dir = join(workspaceDir, "memory", "v3");
+  try {
+    if (fs.existsSync(v3Dir) && fs.readdirSync(v3Dir).length === 0) {
+      fs.rmdirSync(v3Dir);
+    }
+  } catch {
+    // Non-fatal: leaving an empty memory/v3 wrapper is harmless.
+  }
+}
+
+/**
+ * Relocate the v3 memory tree from `memory/v3/tree` to `memory/tree`.
+ *
+ * The tree is a DAG overlay over the flat `memory/concepts/` pages and is now a
+ * top-level sibling of `concepts/` (matching the storage design), no longer
+ * nested under a `v3/` wrapper. `getTreeDir` reads `memory/tree` after this
+ * change, so any pre-existing hand-authored tree must move with it.
+ */
+export const moveMemoryTreeOutOfV3Migration: WorkspaceMigration = {
+  id: "089-move-memory-tree-out-of-v3",
+  description: "Relocate the v3 memory tree from memory/v3/tree to memory/tree",
+  retryFailedCheckpoint: true,
+
+  run(workspaceDir: string): void {
+    moveMemorySubdir(workspaceDir, join("v3", "tree"), "tree");
+    removeEmptyV3Wrapper(workspaceDir);
+  },
+
+  down(workspaceDir: string): void {
+    moveMemorySubdir(workspaceDir, "tree", join("v3", "tree"));
+  },
+};

package/src/workspace/migrations/registry.ts

@@ -85,6 +85,8 @@ import { removeLegacySkillsIndexMigration } from "./084-remove-legacy-skills-ind
 import { memoryV2Bm25BReembedDisabledV2PagesMigration } from "./085-memory-v2-bm25-b-reembed-disabled-v2-pages.js";
 import { revertStaleGeminiMisRewritesMigration } from "./086-revert-stale-gemini-mis-rewrites.js";
 import { memoryRouterBalancedProfileMigration } from "./087-memory-router-balanced-profile.js";
+import { deprecateBackgroundConversationOverrideMigration } from "./088-deprecate-background-conversation-override.js";
+import { moveMemoryTreeOutOfV3Migration } from "./089-move-memory-tree-out-of-v3.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -181,4 +183,6 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   memoryV2Bm25BReembedDisabledV2PagesMigration,
   revertStaleGeminiMisRewritesMigration,
   memoryRouterBalancedProfileMigration,
+  deprecateBackgroundConversationOverrideMigration,
+  moveMemoryTreeOutOfV3Migration,
 ];