vellum 0.2.0 → 0.2.2

package/src/__tests__/workspace-heartbeat-service.test.ts

@@ -1,8 +1,10 @@
-import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { describe, test, expect, beforeEach, afterEach, afterAll } from 'bun:test';
 import { mkdirSync, rmSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { execFileSync } from 'node:child_process';
+import type { CommitMessageProvider, CommitContext, CommitMessageResult } from '../workspace/commit-message-provider.js';
+
 import {
   WorkspaceGitService,
   _resetGitServiceRegistry,
@@ -11,6 +13,7 @@ import {
   HeartbeatService,
   _resetHeartbeatState,
 } from '../workspace/heartbeat-service.js';
+import { _resetEnrichmentService, getEnrichmentService } from '../workspace/commit-message-enrichment-service.js';
 
 describe('HeartbeatService', () => {
   let testDir: string;
@@ -30,12 +33,20 @@ describe('HeartbeatService', () => {
     services.set(testDir, service);
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    // Shut down any in-flight enrichment work before removing the test directory
+    try { await getEnrichmentService().shutdown(); } catch { /* ignore */ }
+    _resetEnrichmentService();
     if (existsSync(testDir)) {
       rmSync(testDir, { recursive: true, force: true });
     }
   });
 
+  afterAll(async () => {
+    try { await getEnrichmentService().shutdown(); } catch { /* ignore */ }
+    _resetEnrichmentService();
+  });
+
   describe('heartbeat check with age threshold', () => {
     test('does not commit when workspace is clean', async () => {
       const heartbeat = new HeartbeatService({
@@ -344,4 +355,132 @@ describe('HeartbeatService', () => {
       await heartbeat.stop(); // Idempotent
     });
   });
+
+  describe('custom commit message provider', () => {
+    test('heartbeat commit uses custom provider message', async () => {
+      writeFileSync(join(testDir, 'file.txt'), 'content');
+
+      const customProvider: CommitMessageProvider = {
+        buildImmediateMessage(ctx: CommitContext): CommitMessageResult {
+          return {
+            message: `CUSTOM-HEARTBEAT: ${ctx.changedFiles.length} files via ${ctx.trigger}`,
+            metadata: { customProvider: true, trigger: ctx.trigger },
+          };
+        },
+      };
+
+      let currentTime = 1000000;
+      const heartbeat = new HeartbeatService({
+        ageThresholdMs: 5 * 60 * 1000,
+        fileThreshold: 100,
+        getServices: () => services,
+        now: () => currentTime,
+        commitMessageProvider: customProvider,
+      });
+
+      // First check registers dirty state
+      await heartbeat.check();
+      // Advance time past threshold
+      currentTime += 6 * 60 * 1000;
+      // Second check commits
+      const result = await heartbeat.check();
+      expect(result.committed).toBe(1);
+
+      const commitMsg = execFileSync('git', ['log', '-1', '--pretty=%B'], {
+        cwd: testDir,
+        encoding: 'utf-8',
+      });
+      expect(commitMsg).toContain('CUSTOM-HEARTBEAT:');
+      expect(commitMsg).toContain('via heartbeat');
+      expect(commitMsg).toContain('customProvider: true');
+    });
+
+    test('shutdown commit uses custom provider message', async () => {
+      writeFileSync(join(testDir, 'unsaved.txt'), 'uncommitted content');
+
+      const customProvider: CommitMessageProvider = {
+        buildImmediateMessage(ctx: CommitContext): CommitMessageResult {
+          return {
+            message: `CUSTOM-SHUTDOWN: saving ${ctx.changedFiles.length} files`,
+            metadata: { shutdownProvider: true },
+          };
+        },
+      };
+
+      const heartbeat = new HeartbeatService({
+        getServices: () => services,
+        commitMessageProvider: customProvider,
+      });
+
+      const result = await heartbeat.commitAllPending();
+      expect(result.committed).toBe(1);
+
+      const commitMsg = execFileSync('git', ['log', '-1', '--pretty=%B'], {
+        cwd: testDir,
+        encoding: 'utf-8',
+      });
+      expect(commitMsg).toContain('CUSTOM-SHUTDOWN: saving');
+      expect(commitMsg).toContain('shutdownProvider: true');
+    });
+
+    test('custom provider receives correct context fields for heartbeat trigger', async () => {
+      writeFileSync(join(testDir, 'a.txt'), 'a');
+      writeFileSync(join(testDir, 'b.txt'), 'b');
+
+      let capturedCtx: CommitContext | null = null;
+      const customProvider: CommitMessageProvider = {
+        buildImmediateMessage(ctx: CommitContext): CommitMessageResult {
+          capturedCtx = ctx;
+          return { message: 'capture-context' };
+        },
+      };
+
+      let currentTime = 1000000;
+      const heartbeat = new HeartbeatService({
+        ageThresholdMs: 5 * 60 * 1000,
+        fileThreshold: 100,
+        getServices: () => services,
+        now: () => currentTime,
+        commitMessageProvider: customProvider,
+      });
+
+      // Register dirty state
+      await heartbeat.check();
+      // Advance past threshold
+      currentTime += 6 * 60 * 1000;
+      await heartbeat.check();
+
+      expect(capturedCtx).not.toBeNull();
+      expect(capturedCtx!.trigger).toBe('heartbeat');
+      expect(capturedCtx!.workspaceDir).toBe(testDir);
+      expect(capturedCtx!.changedFiles).toContain('a.txt');
+      expect(capturedCtx!.changedFiles).toContain('b.txt');
+      expect(capturedCtx!.timestampMs).toBe(currentTime);
+      expect(capturedCtx!.reason).toBeDefined();
+    });
+
+    test('custom provider receives correct context fields for shutdown trigger', async () => {
+      writeFileSync(join(testDir, 'shutdown-file.txt'), 'data');
+
+      let capturedCtx: CommitContext | null = null;
+      const customProvider: CommitMessageProvider = {
+        buildImmediateMessage(ctx: CommitContext): CommitMessageResult {
+          capturedCtx = ctx;
+          return { message: 'capture-shutdown-context' };
+        },
+      };
+
+      const heartbeat = new HeartbeatService({
+        getServices: () => services,
+        commitMessageProvider: customProvider,
+      });
+
+      await heartbeat.commitAllPending();
+
+      expect(capturedCtx).not.toBeNull();
+      expect(capturedCtx!.trigger).toBe('shutdown');
+      expect(capturedCtx!.workspaceDir).toBe(testDir);
+      expect(capturedCtx!.changedFiles).toContain('shutdown-file.txt');
+    });
+  });
 });

package/src/agent-heartbeat/agent-heartbeat-service.ts

@@ -0,0 +1,155 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { getLogger } from '../util/logger.js';
+import { getWorkspacePromptPath } from '../util/platform.js';
+import { getConfig } from '../config/loader.js';
+import { createConversation } from '../memory/conversation-store.js';
+import type { AgentHeartbeatAlert } from '../daemon/ipc-contract.js';
+
+const log = getLogger('agent-heartbeat');
+
+const DEFAULT_CHECKLIST = `- Check the current weather and note anything notable
+- Review any recent news headlines worth flagging
+- Look for calendar events or reminders coming up soon`;
+
+export interface AgentHeartbeatDeps {
+  processMessage: (conversationId: string, content: string) => Promise<{ messageId: string }>;
+  alerter: (alert: AgentHeartbeatAlert) => void;
+  /** Override for current hour (0-23), for testing. */
+  getCurrentHour?: () => number;
+}
+
+export class AgentHeartbeatService {
+  private readonly deps: AgentHeartbeatDeps;
+  private timer: ReturnType<typeof setInterval> | null = null;
+  private activeRun: Promise<void> | null = null;
+
+  constructor(deps: AgentHeartbeatDeps) {
+    this.deps = deps;
+  }
+
+  start(): void {
+    const config = getConfig().agentHeartbeat;
+    if (!config.enabled) {
+      log.info('Agent heartbeat disabled by config');
+      return;
+    }
+    if (this.timer) return;
+
+    log.info({ intervalMs: config.intervalMs }, 'Agent heartbeat service started');
+    this.timer = setInterval(() => {
+      this.runOnce().catch((err) => {
+        log.error({ err }, 'Agent heartbeat runOnce failed');
+      });
+    }, config.intervalMs);
+  }
+
+  async stop(): Promise<void> {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (this.activeRun) {
+      let timerId: ReturnType<typeof setTimeout>;
+      const timeout = new Promise<void>((resolve) => { timerId = setTimeout(resolve, 5_000); });
+      await Promise.race([this.activeRun, timeout]);
+      clearTimeout(timerId!);
+    }
+    log.info('Agent heartbeat service stopped');
+  }
+
+  async runOnce(): Promise<void> {
+    const config = getConfig().agentHeartbeat;
+    if (!config.enabled) return;
+
+    // Active hours guard — only applied when both bounds are set.
+    // The schema rejects configs where only one bound is provided.
+    if (config.activeHoursStart != null && config.activeHoursEnd != null) {
+      const hour = this.deps.getCurrentHour?.() ?? new Date().getHours();
+      if (!isWithinActiveHours(hour, config.activeHoursStart, config.activeHoursEnd)) {
+        log.debug({ hour, activeHoursStart: config.activeHoursStart, activeHoursEnd: config.activeHoursEnd }, 'Outside active hours, skipping');
+        return;
+      }
+    }
+
+    // Overlap prevention
+    if (this.activeRun) {
+      log.debug('Previous heartbeat run still active, skipping');
+      return;
+    }
+
+    const run = this.executeRun();
+    this.activeRun = run;
+    try {
+      await run;
+    } finally {
+      this.activeRun = null;
+    }
+  }
+
+  private async executeRun(): Promise<void> {
+    log.info('Running agent heartbeat');
+
+    try {
+      const checklist = this.readChecklist();
+      const prompt = this.buildPrompt(checklist);
+
+      const conversation = createConversation({
+        title: 'Agent Heartbeat',
+        threadType: 'background',
+      });
+
+      await this.deps.processMessage(conversation.id, prompt);
+      log.info({ conversationId: conversation.id }, 'Agent heartbeat completed');
+    } catch (err) {
+      log.error({ err }, 'Agent heartbeat failed');
+      try {
+        this.deps.alerter({
+          type: 'agent_heartbeat_alert',
+          title: 'Agent Heartbeat Failed',
+          body: err instanceof Error ? err.message : String(err),
+        });
+      } catch (alertErr) {
+        log.warn({ alertErr }, 'Failed to broadcast heartbeat alert');
+      }
+    }
+  }
+
+  private readChecklist(): string {
+    const heartbeatPath = getWorkspacePromptPath('HEARTBEAT.md');
+    if (existsSync(heartbeatPath)) {
+      try {
+        return readFileSync(heartbeatPath, 'utf-8');
+      } catch (err) {
+        log.warn({ err, heartbeatPath }, 'Failed to read HEARTBEAT.md, using default checklist');
+      }
+    }
+    return DEFAULT_CHECKLIST;
+  }
+
+  /** @internal Exposed for testing. */
+  buildPrompt(checklist: string): string {
+    return `You are running a periodic heartbeat check. Review the following checklist and take any necessary actions.
+
+<heartbeat-checklist>
+${checklist}
+</heartbeat-checklist>
+
+<heartbeat-disposition>
+After completing your review, end your response with one of:
+- HEARTBEAT_OK — if everything looks good, no action needed
+- HEARTBEAT_ALERT — if you found issues that need attention (describe them before this marker)
+</heartbeat-disposition>`;
+  }
+}
+
+/**
+ * Check if the given hour falls within the active window.
+ * Handles overnight windows (e.g. start=22, end=6).
+ */
+function isWithinActiveHours(hour: number, start: number, end: number): boolean {
+  if (start <= end) {
+    return hour >= start && hour < end;
+  }
+  // Overnight window: e.g. 22-6 means 22,23,0,1,2,3,4,5
+  return hour >= start || hour < end;
+}

package/src/bundler/app-bundler.ts

@@ -25,6 +25,8 @@ const bundlerLog = getLogger('app-bundler');
 import { APP_VERSION } from '../version.js';
 const PACKAGE_VERSION = APP_VERSION;
 
+const SHORT_HASH_LENGTH = 8;
+const HASH_DISPLAY_LENGTH = 12;
 const MAX_BUNDLE_SIZE_BYTES = 25 * 1024 * 1024; // 25 MB
 const ASSET_FETCH_TIMEOUT_MS = 10_000;
 
@@ -35,21 +37,33 @@ interface FetchedAsset {
 
 /**
  * Extract all remote (http/https) URLs from HTML content.
- * Looks in src=, href=, and CSS url() references.
+ * Looks in src=, href= on all elements except <a> tags, and CSS url() references.
  */
 export function extractRemoteUrls(html: string): string[] {
   const urls = new Set<string>();
 
-  // Match src="..." and href="..." attributes (double or single quotes, or unquoted)
-  const attrRe = /\b(?:src|href)\s*=\s*(?:"([^"]*?)"|'([^']*?)'|([^\s>]+))/gi;
+  // Match src="..." attributes on any element
+  const srcRe = /\bsrc\s*=\s*(?:"([^"]*?)"|'([^']*?)'|([^\s>]+))/gi;
   let m: RegExpExecArray | null;
-  while ((m = attrRe.exec(html)) !== null) {
+  while ((m = srcRe.exec(html)) !== null) {
     const url = m[1] ?? m[2] ?? m[3];
     if (url && /^https?:\/\//i.test(url)) {
       urls.add(url);
     }
   }
 
+  // Match href="..." on any element except navigation/resolution tags (not assets).
+  // Captures the tag name and href value so we can skip them.
+  const hrefRe = /<(\w+)\b[^>]*?\bhref\s*=\s*(?:"([^"]*?)"|'([^']*?)'|([^\s>]+))[^>]*?\/?>/gi;
+  while ((m = hrefRe.exec(html)) !== null) {
+    const tagName = m[1];
+    if (['a', 'base', 'area'].includes(tagName.toLowerCase())) continue;
+    const url = m[2] ?? m[3] ?? m[4];
+    if (url && /^https?:\/\//i.test(url)) {
+      urls.add(url);
+    }
+  }
+
   // Match CSS url() references (inline styles and <style> blocks)
   const urlRe = /url\(\s*(?:"([^"]*?)"|'([^']*?)'|([^)"'\s]+))\s*\)/gi;
   while ((m = urlRe.exec(html)) !== null) {
@@ -67,7 +81,7 @@ export function extractRemoteUrls(html: string): string[] {
  * Uses a hash of the URL to avoid collisions, preserving the original extension.
  */
 function assetFilename(url: string): string {
-  const hash = createHash('sha256').update(url).digest('hex').slice(0, 12);
+  const hash = createHash('sha256').update(url).digest('hex').slice(0, HASH_DISPLAY_LENGTH);
   let ext = '';
   try {
     const parsed = new URL(url);
@@ -104,13 +118,17 @@ export async function materializeAssets(
       try {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), ASSET_FETCH_TIMEOUT_MS);
-        const resp = await fetch(url, { signal: controller.signal });
-        clearTimeout(timeout);
-        if (!resp.ok) {
-          bundlerLog.warn({ url, status: resp.status }, 'Failed to fetch asset, keeping original URL');
-          return;
+        let buf: Buffer;
+        try {
+          const resp = await fetch(url, { signal: controller.signal });
+          if (!resp.ok) {
+            bundlerLog.warn({ url, status: resp.status }, 'Failed to fetch asset, keeping original URL');
+            return;
+          }
+          buf = Buffer.from(await resp.arrayBuffer());
+        } finally {
+          clearTimeout(timeout);
         }
-        const buf = Buffer.from(await resp.arrayBuffer());
         const filename = assetFilename(url);
         const archivePath = `assets/${filename}`;
         assets.push({ archivePath, data: buf });
@@ -121,9 +139,12 @@ export async function materializeAssets(
     }),
   );
 
-  // Rewrite URLs in HTML — replace each occurrence of the original URL with the local path
+  // Rewrite URLs in HTML — replace each occurrence of the original URL with the local path.
+  // Sort by length descending so longer URLs are replaced first, preventing prefix collisions
+  // (e.g. "https://cdn/x" replacing part of "https://cdn/x/y.png").
+  const sortedEntries = [...urlMap.entries()].sort((a, b) => b[0].length - a[0].length);
   let rewrittenHtml = html;
-  for (const [originalUrl, localPath] of urlMap) {
+  for (const [originalUrl, localPath] of sortedEntries) {
     // Escape regex special chars in the URL
     const escaped = originalUrl.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     rewrittenHtml = rewrittenHtml.replace(new RegExp(escaped, 'g'), localPath);
@@ -196,7 +217,7 @@ export async function packageApp(
   const allAssets = [...allAssetsMap.values()];
 
   // Create the zip archive
-  const bundleFilename = `${app.name.replace(/[^a-zA-Z0-9_-]/g, '_')}-${randomUUID().slice(0, 8)}.vellumapp`;
+  const bundleFilename = `${app.name.replace(/[^a-zA-Z0-9_-]/g, '_')}-${randomUUID().slice(0, SHORT_HASH_LENGTH)}.vellumapp`;
   const bundlePath = join(tmpdir(), bundleFilename);
 
   await new Promise<void>((resolve, reject) => {

package/src/calls/call-bridge.ts

@@ -0,0 +1,95 @@
+/**
+ * Call-answer bridge: auto-consumes user replies in-thread as answers
+ * to pending call questions, routing them to the live call orchestrator.
+ *
+ * When a call has a pending question and the user sends a normal message
+ * in the conversation thread, this bridge intercepts the message before
+ * the agent loop, forwards the answer to the orchestrator, and returns
+ * `{ handled: true }` so the caller can skip agent processing.
+ */
+
+import { getLogger } from '../util/logger.js';
+import {
+  getActiveCallSessionForConversation,
+  getPendingQuestion,
+  answerPendingQuestion,
+  recordCallEvent,
+  getCallSession,
+} from './call-store.js';
+import { getCallOrchestrator } from './call-state.js';
+import * as conversationStore from '../memory/conversation-store.js';
+
+const log = getLogger('call-bridge');
+
+export interface CallBridgeResult {
+  handled: boolean;
+  reason?: string;
+}
+
+/**
+ * Attempt to route a user message as an answer to a pending call question.
+ *
+ * @param conversationId - The conversation the message belongs to.
+ * @param userText - The user's message text.
+ * @param _userMessageId - The persisted message ID (reserved for future use).
+ * @returns `{ handled: true }` if the answer was consumed by the call system,
+ *          `{ handled: false, reason }` otherwise.
+ */
+export async function tryHandlePendingCallAnswer(
+  conversationId: string,
+  userText: string,
+  _userMessageId?: string,
+): Promise<CallBridgeResult> {
+  // 1. Find an active call for this conversation
+  const callSession = getActiveCallSessionForConversation(conversationId);
+  if (!callSession) {
+    return { handled: false, reason: 'no_active_call' };
+  }
+
+  // 2. Check for a pending question
+  const pendingQuestion = getPendingQuestion(callSession.id);
+  if (!pendingQuestion) {
+    return { handled: false, reason: 'no_pending_question' };
+  }
+
+  // 3. Check that the orchestrator is alive and waiting
+  const orchestrator = getCallOrchestrator(callSession.id);
+  if (!orchestrator) {
+    // The call may have ended between the question being asked and the
+    // user replying. Persist a follow-up message so the user knows.
+    const freshSession = getCallSession(callSession.id);
+    const ended = freshSession && (freshSession.status === 'completed' || freshSession.status === 'failed');
+    if (ended) {
+      conversationStore.addMessage(
+        conversationId,
+        'assistant',
+        JSON.stringify([{
+          type: 'text',
+          text: 'The call ended before your answer could be relayed to the caller.',
+        }]),
+      );
+    }
+    return { handled: false, reason: 'orchestrator_not_found' };
+  }
+
+  if (orchestrator.getState() !== 'waiting_on_user') {
+    return { handled: false, reason: 'orchestrator_not_waiting' };
+  }
+
+  // 4. Route the answer through the orchestrator
+  const accepted = await orchestrator.handleUserAnswer(userText);
+  if (!accepted) {
+    return { handled: false, reason: 'orchestrator_rejected' };
+  }
+
+  // 5. Persist the answered state
+  answerPendingQuestion(pendingQuestion.id, userText);
+  recordCallEvent(callSession.id, 'user_answered', { answer: userText });
+
+  log.info(
+    { conversationId, callSessionId: callSession.id, questionId: pendingQuestion.id },
+    'User reply routed as call answer via bridge',
+  );
+
+  return { handled: true };
+}

package/src/calls/call-constants.ts

@@ -0,0 +1,48 @@
+import { getConfig } from '../config/loader.js';
+
+// Emergency/high-risk numbers that should never be called
+export const DENIED_NUMBERS = new Set([
+  '911', '112', '999', '000', '110', '119',
+]);
+
+/**
+ * Check whether a phone number is a denied emergency number.
+ *
+ * Normalizes E.164 variants by stripping the leading '+' and then checking
+ * whether the resulting digit string exactly matches a denied number or could
+ * be a country-code-prefixed emergency number (e.g. +1911, +44999, +61000).
+ * Country codes are 1–3 digits, so we try every valid split.
+ */
+export function isDeniedNumber(phoneNumber: string): boolean {
+  // Strip leading '+' to get a digits-only string
+  const digits = phoneNumber.startsWith('+') ? phoneNumber.slice(1) : phoneNumber;
+
+  // Exact match (covers bare short codes like "911", "112")
+  if (DENIED_NUMBERS.has(digits)) return true;
+
+  // Try splitting off 1-, 2-, or 3-digit country codes and check if the
+  // remainder is a denied number. This catches patterns like +1911, +44999.
+  for (let ccLen = 1; ccLen <= 3; ccLen++) {
+    if (digits.length > ccLen) {
+      const remainder = digits.slice(ccLen);
+      if (DENIED_NUMBERS.has(remainder)) return true;
+    }
+  }
+
+  return false;
+}
+
+// Call limits — backed by config with hardcoded fallbacks
+export function getMaxCallDurationMs(): number {
+  return getConfig().calls.maxDurationSeconds * 1000;
+}
+
+export function getUserConsultationTimeoutMs(): number {
+  return getConfig().calls.userConsultTimeoutSeconds * 1000;
+}
+
+export const SILENCE_TIMEOUT_MS = 30 * 1000; // 30 seconds
+
+// Legacy named exports for backward compatibility (use functions above for config-backed values)
+export const MAX_CALL_DURATION_MS = 3600 * 1000; // fallback default; prefer getMaxCallDurationMs()
+export const USER_CONSULTATION_TIMEOUT_MS = 120 * 1000; // fallback default; prefer getUserConsultationTimeoutMs()