vellum 0.0.16 → 0.2.0

package/src/daemon/session-attachments.ts

@@ -0,0 +1,173 @@
+import type { ContentBlock } from '../providers/types.js';
+import type { UserMessageAttachment } from './ipc-protocol.js';
+import { check, classifyRisk, generateAllowlistOptions, generateScopeOptions } from '../permissions/checker.js';
+import { addRule } from '../permissions/trust-store.js';
+import type { PermissionPrompter } from '../permissions/prompter.js';
+import { uploadAttachment, linkAttachmentToMessage, AttachmentUploadError } from '../memory/attachments-store.js';
+import {
+  resolveDirectives,
+  contentBlocksToDrafts,
+  deduplicateDrafts,
+  validateDrafts,
+  type DirectiveRequest,
+  type AssistantAttachmentDraft,
+  type ApproveHostRead,
+} from './assistant-attachments.js';
+import { getLogger } from '../util/logger.js';
+
+const log = getLogger('session-attachments');
+
+/**
+ * Approve reading a host file for assistant attachment resolution.
+ * Checks the permission store and prompts the user if needed.
+ */
+export async function approveHostAttachmentRead(
+  filePath: string,
+  workingDir: string,
+  prompter: PermissionPrompter,
+  conversationId: string,
+  hasNoClient: boolean,
+): Promise<boolean> {
+  const toolName = 'host_file_read';
+  const input = { path: filePath };
+  const decision = await check(toolName, input, workingDir);
+
+  if (decision.decision === 'allow') {
+    return true;
+  }
+  if (decision.decision === 'deny') {
+    return false;
+  }
+
+  // HTTP-created sessions use a no-op sendToClient — prompting would
+  // block for the full permission timeout before auto-denying.
+  if (hasNoClient) {
+    log.info({ filePath }, 'Denying host attachment read: no interactive client connected');
+    return false;
+  }
+
+  const response = await prompter.prompt(
+    toolName,
+    input,
+    await classifyRisk(toolName, input, workingDir),
+    generateAllowlistOptions(toolName, input),
+    generateScopeOptions(workingDir, toolName),
+    undefined,
+    undefined,
+    conversationId,
+    'host',
+  );
+
+  if ((response.decision === 'always_allow' || response.decision === 'always_allow_high_risk') && response.selectedPattern && response.selectedScope) {
+    addRule(toolName, response.selectedPattern, response.selectedScope, 'allow', 100,
+      response.decision === 'always_allow_high_risk' ? { allowHighRisk: true } : undefined);
+  }
+  if (response.decision === 'always_deny' && response.selectedPattern && response.selectedScope) {
+    addRule(toolName, response.selectedPattern, response.selectedScope, 'deny');
+  }
+
+  return response.decision === 'allow' || response.decision === 'always_allow' || response.decision === 'always_allow_high_risk';
+}
+
+export function formatAttachmentWarnings(warnings: string[]): string | null {
+  if (warnings.length === 0) return null;
+  const lines = warnings.map((warning) => `Attachment warning: ${warning}`);
+  return `\n\n${lines.join('\n')}`;
+}
+
+export interface AttachmentResolutionResult {
+  assistantAttachments: AssistantAttachmentDraft[];
+  emittedAttachments: UserMessageAttachment[];
+  directiveWarnings: string[];
+}
+
+/**
+ * Resolve accumulated directives and tool content blocks into assistant
+ * attachments. Persists attachments and links them to the assistant message.
+ */
+export async function resolveAssistantAttachments(
+  accumulatedDirectives: DirectiveRequest[],
+  accumulatedToolContentBlocks: ContentBlock[],
+  directiveWarnings: string[],
+  workingDir: string,
+  approveHostRead: ApproveHostRead,
+  lastAssistantMessageId: string | undefined,
+  assistantScope: string,
+): Promise<AttachmentResolutionResult> {
+  let assistantAttachments: AssistantAttachmentDraft[] = [];
+  const emittedAttachments: UserMessageAttachment[] = [];
+
+  log.info(
+    { directiveCount: accumulatedDirectives.length, toolBlockCount: accumulatedToolContentBlocks.length, workingDir },
+    'Resolving assistant attachments',
+  );
+
+  if (accumulatedDirectives.length > 0 || accumulatedToolContentBlocks.length > 0) {
+    const directiveDrafts = accumulatedDirectives.length > 0
+      ? await resolveDirectives(accumulatedDirectives, workingDir, approveHostRead)
+      : { drafts: [], warnings: [] };
+    directiveWarnings.push(...directiveDrafts.warnings);
+
+    if (directiveDrafts.warnings.length > 0) {
+      log.warn({ warnings: directiveDrafts.warnings }, 'Directive resolution warnings');
+    }
+    log.info(
+      { resolvedDrafts: directiveDrafts.drafts.length, directives: accumulatedDirectives.map(d => ({ source: d.source, path: d.path, filename: d.filename, mimeType: d.mimeType })) },
+      'Directive resolution complete',
+    );
+
+    const toolDrafts = contentBlocksToDrafts(accumulatedToolContentBlocks);
+
+    const merged = deduplicateDrafts([...directiveDrafts.drafts, ...toolDrafts]);
+    const validated = validateDrafts(merged);
+    directiveWarnings.push(...validated.warnings);
+    assistantAttachments = validated.accepted;
+
+    log.info(
+      { merged: merged.length, accepted: validated.accepted.length, validationWarnings: validated.warnings },
+      'Attachment validation complete',
+    );
+  } else {
+    log.info('No directives or tool content blocks to resolve');
+  }
+
+  // Persist resolved attachments and link to the last assistant message
+  if (assistantAttachments.length > 0 && lastAssistantMessageId) {
+    for (let i = 0; i < assistantAttachments.length; i++) {
+      const draft = assistantAttachments[i];
+      let stored;
+      try {
+        stored = uploadAttachment(
+          assistantScope,
+          draft.filename,
+          draft.mimeType,
+          draft.dataBase64,
+        );
+      } catch (err) {
+        if (err instanceof AttachmentUploadError) {
+          log.warn({ filename: draft.filename, error: err.message }, 'Skipping attachment upload');
+          directiveWarnings.push(`Attachment ${draft.filename} skipped: ${err.message}`);
+          continue;
+        }
+        throw err;
+      }
+      linkAttachmentToMessage(lastAssistantMessageId, stored.id, i);
+      emittedAttachments.push({
+        id: stored.id,
+        filename: draft.filename,
+        mimeType: draft.mimeType,
+        data: draft.dataBase64,
+      });
+    }
+  } else if (assistantAttachments.length > 0) {
+    for (const draft of assistantAttachments) {
+      emittedAttachments.push({
+        filename: draft.filename,
+        mimeType: draft.mimeType,
+        data: draft.dataBase64,
+      });
+    }
+  }
+
+  return { assistantAttachments, emittedAttachments, directiveWarnings };
+}

package/src/daemon/session-conflict-gate.ts

@@ -0,0 +1,219 @@
+/**
+ * Conflict-gate logic extracted from Session.
+ *
+ * Decides whether to ask the user about a pending memory conflict (relevant gate),
+ * inject a soft instruction (irrelevant gate), or skip entirely.
+ */
+
+import {
+  applyConflictResolution,
+  listPendingConflictDetails,
+  markConflictAsked,
+} from '../memory/conflict-store.js';
+import type { PendingConflictDetail } from '../memory/conflict-store.js';
+import { resolveConflictClarification } from '../memory/clarification-resolver.js';
+
+export interface ConflictGateDecision {
+  question: string;
+  relevant: boolean;
+}
+
+export class ConflictGate {
+  private turnCounter = 0;
+  private lastAskedTurn = new Map<string, number>();
+
+  async evaluate(
+    userMessage: string,
+    conflictConfig: {
+      enabled: boolean;
+      gateMode: string;
+      relevanceThreshold: number;
+      reaskCooldownTurns: number;
+      resolverLlmTimeoutMs: number;
+    },
+    scopeId = 'default',
+  ): Promise<ConflictGateDecision | null> {
+    if (!conflictConfig.enabled || conflictConfig.gateMode !== 'soft') return null;
+
+    this.turnCounter += 1;
+    const threshold = conflictConfig.relevanceThreshold;
+    const cooldownTurns = Math.max(1, conflictConfig.reaskCooldownTurns);
+    const pendingBeforeResolve = listPendingConflictDetails(scopeId, 50);
+    const candidatesBeforeResolve = pendingBeforeResolve.filter((conflict) => {
+      const relevance = computeConflictRelevance(userMessage, conflict);
+      if (relevance >= threshold) return true;
+      // Only try to resolve recently-asked conflicts when the user message
+      // looks like a short clarification reply (e.g. "keep the new one"),
+      // not a full unrelated question that happens to contain cue words.
+      return this.wasRecentlyAsked(conflict.id, cooldownTurns)
+        && looksLikeClarificationReply(userMessage);
+    });
+    await this.resolvePendingConflicts(
+      userMessage,
+      conflictConfig.resolverLlmTimeoutMs,
+      candidatesBeforeResolve,
+    );
+
+    const pending = listPendingConflictDetails(scopeId, 50);
+    if (pending.length === 0) return null;
+
+    const scored = pending.map((conflict) => ({
+      conflict,
+      relevance: computeConflictRelevance(userMessage, conflict),
+    }));
+    const relevant = scored.filter((entry) => entry.relevance >= threshold);
+    const irrelevant = scored.filter((entry) => entry.relevance < threshold);
+    const ordered = [...relevant, ...irrelevant];
+
+    const askable = ordered.find((entry) => this.shouldAsk(entry.conflict.id, cooldownTurns));
+    if (!askable) return null;
+
+    this.lastAskedTurn.set(askable.conflict.id, this.turnCounter);
+    markConflictAsked(askable.conflict.id);
+    return {
+      question: askable.conflict.clarificationQuestion ?? buildFallbackConflictQuestion(askable.conflict),
+      relevant: askable.relevance >= threshold,
+    };
+  }
+
+  private async resolvePendingConflicts(
+    userMessage: string,
+    resolverTimeoutMs: number,
+    pendingConflicts: PendingConflictDetail[],
+  ): Promise<void> {
+    for (const conflict of pendingConflicts) {
+      const resolution = await resolveConflictClarification(
+        {
+          existingStatement: conflict.existingStatement,
+          candidateStatement: conflict.candidateStatement,
+          userMessage,
+        },
+        { timeoutMs: resolverTimeoutMs },
+      );
+      if (resolution.resolution === 'still_unclear') continue;
+
+      applyConflictResolution({
+        conflictId: conflict.id,
+        resolution: resolution.resolution,
+        mergedStatement: resolution.resolution === 'merge' ? resolution.resolvedStatement : null,
+        resolutionNote: resolution.explanation,
+      });
+    }
+  }
+
+  private shouldAsk(conflictId: string, cooldownTurns: number): boolean {
+    const lastAsked = this.lastAskedTurn.get(conflictId);
+    if (lastAsked === undefined) return true;
+    return this.turnCounter - lastAsked >= cooldownTurns;
+  }
+
+  private wasRecentlyAsked(conflictId: string, cooldownTurns: number): boolean {
+    const lastAsked = this.lastAskedTurn.get(conflictId);
+    if (lastAsked === undefined) return false;
+    return this.turnCounter - lastAsked <= cooldownTurns;
+  }
+}
+
+export function buildFallbackConflictQuestion(conflict: PendingConflictDetail): string {
+  return [
+    'I have two conflicting notes and need your confirmation.',
+    `A) ${conflict.existingStatement}`,
+    `B) ${conflict.candidateStatement}`,
+    'Which one should I keep?',
+  ].join('\n');
+}
+
+export function computeConflictRelevance(
+  userMessage: string,
+  conflict: Pick<PendingConflictDetail, 'existingStatement' | 'candidateStatement'>,
+): number {
+  const queryTokens = tokenizeForConflictRelevance(userMessage);
+  if (queryTokens.size === 0) return 0;
+  const existingTokens = tokenizeForConflictRelevance(conflict.existingStatement);
+  const candidateTokens = tokenizeForConflictRelevance(conflict.candidateStatement);
+  return Math.max(
+    overlapRatio(queryTokens, existingTokens),
+    overlapRatio(queryTokens, candidateTokens),
+  );
+}
+
+function tokenizeForConflictRelevance(input: string): Set<string> {
+  const tokens = input
+    .toLowerCase()
+    .split(/[^a-z0-9]+/g)
+    .map((token) => token.trim())
+    .filter((token) => token.length >= 4);
+  return new Set(tokens);
+}
+
+function overlapRatio(left: Set<string>, right: Set<string>): number {
+  if (left.size === 0 || right.size === 0) return 0;
+  let overlap = 0;
+  for (const token of left) {
+    if (right.has(token)) overlap += 1;
+  }
+  return overlap / Math.max(left.size, right.size);
+}
+
+// Action verbs that signal the user is making a deliberate choice.
+const ACTION_CUES = new Set([
+  'keep', 'use', 'prefer', 'go', 'pick', 'choose', 'take', 'want', 'select',
+]);
+
+// Directional/merge cue words mirrored from clarification-resolver.ts heuristics.
+const DIRECTIONAL_CUES = new Set([
+  'existing', 'old', 'previous', 'first', 'earlier', 'original',
+  'candidate', 'new', 'latest', 'second', 'updated', 'instead', 'replace',
+  'both', 'merge', 'combine', 'together', 'either', 'mix',
+  'option', 'former', 'latter',
+]);
+
+const MAX_REPLY_WORD_COUNT = 12;
+
+// Direction-only matches (no action verb) must be very short to avoid
+// false positives from unrelated statements that happen to contain
+// common words like "new", "old", "option", etc.
+const MAX_DIRECTION_ONLY_WORD_COUNT = 4;
+
+// Messages starting with a question word are unlikely to be clarification
+// replies even when they lack a trailing question mark.
+const QUESTION_WORD_PREFIXES = new Set([
+  'what', 'how', 'why', 'where', 'when', 'which', 'who', 'whom', 'whose',
+]);
+
+/**
+ * Determines whether a user message looks like a deliberate reply to a
+ * recently asked conflict clarification (e.g. "keep the new one", "both",
+ * "option B", "new one"). Requires at least one action or directional cue,
+ * and the message must be short. Questions and longer statements are excluded
+ * to prevent accidental resolution from unrelated messages.
+ *
+ * When only directional cues are present (no action verb), the message must
+ * be very short (<= 4 words) to avoid false positives from unrelated messages
+ * like "What's new in Bun" or "try the old approach".
+ */
+export function looksLikeClarificationReply(userMessage: string): boolean {
+  const trimmed = userMessage.trim();
+  if (trimmed.endsWith('?')) return false;
+
+  const words = trimmed.toLowerCase().split(/\s+/).filter(Boolean);
+  if (words.length === 0 || words.length > MAX_REPLY_WORD_COUNT) return false;
+
+  const normalized = words.map((w) => w.replace(/[^a-z]/g, ''));
+
+  // Reject messages that start with a question word (even without '?').
+  // Match exact question words or contractions (e.g. "what's", "where's"),
+  // but not words that merely share a prefix (e.g. "whichever", "however").
+  const firstWord = words[0];
+  const firstNorm = normalized[0];
+  for (const qw of QUESTION_WORD_PREFIXES) {
+    if (firstNorm === qw || (firstWord.startsWith(qw) && "'\u2018\u2019".includes(firstWord[qw.length]))) return false;
+  }
+
+  const hasAction = normalized.some((w) => ACTION_CUES.has(w));
+  const hasDirection = normalized.some((w) => DIRECTIONAL_CUES.has(w));
+
+  if (hasAction) return true;
+  if (hasDirection) return words.length <= MAX_DIRECTION_ONLY_WORD_COUNT;
+  return false;
+}

package/src/daemon/session-dynamic-profile.ts

@@ -0,0 +1,63 @@
+/**
+ * Dynamic-profile injection and stripping helpers extracted from Session.
+ *
+ * These are pure functions with no state — they wrap profile text into user
+ * messages at runtime and strip it back out before persistence.
+ */
+
+import type { Message } from '../providers/types.js';
+
+export function injectDynamicProfileIntoUserMessage(message: Message, profileText: string): Message {
+  const trimmedProfile = profileText.trim();
+  if (trimmedProfile.length === 0) return message;
+  const block = [
+    '<dynamic-profile-context>',
+    trimmedProfile,
+    '</dynamic-profile-context>',
+  ].join('\n');
+  return {
+    ...message,
+    content: [
+      ...message.content,
+      { type: 'text', text: `\n\n${block}` },
+    ],
+  };
+}
+
+export function stripDynamicProfileMessages(messages: Message[], profileText: string): Message[] {
+  const trimmedProfile = profileText.trim();
+  if (trimmedProfile.length === 0) return messages;
+  const injectedBlock = `\n\n<dynamic-profile-context>\n${trimmedProfile}\n</dynamic-profile-context>`;
+  // Find the last user message that actually contains the injected profile block.
+  // We can't just target the last user message by role — tool_result messages also
+  // have role 'user', so after tool use the last user message won't be the one
+  // we injected the profile into.
+  let lastUserIdx = -1;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    if (messages[i].role === 'user' && messages[i].content.some(
+      (b) => b.type === 'text' && b.text.includes(injectedBlock),
+    )) { lastUserIdx = i; break; }
+  }
+  if (lastUserIdx === -1) return messages;
+  const message = messages[lastUserIdx];
+  let changed = false;
+  const nextContent = message.content.map((block) => {
+    if (block.type !== 'text') return block;
+    const nextText = block.text.split(injectedBlock).join('');
+    if (nextText === block.text) return block;
+    changed = true;
+    const stripped = nextText.replace(/\n{3,}/g, '\n\n').trimEnd();
+    return stripped.length > 0 ? { ...block, text: stripped } : null;
+  }).filter((block): block is NonNullable<typeof block> => block !== null);
+  if (!changed) return messages;
+  // If stripping removed all content blocks, drop the message entirely
+  // to avoid sending an empty content array to the provider.
+  if (nextContent.length === 0) {
+    return [...messages.slice(0, lastUserIdx), ...messages.slice(lastUserIdx + 1)];
+  }
+  return [
+    ...messages.slice(0, lastUserIdx),
+    { ...message, content: nextContent },
+    ...messages.slice(lastUserIdx + 1),
+  ];
+}