vellum 0.2.14 → 0.3.2

package/src/hooks/runner.ts

@@ -1,123 +0,0 @@
-import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { basename, extname, join } from 'node:path';
-import { homedir } from 'node:os';
-import { getRootDir, getWorkspaceDir } from '../util/platform.js';
-import { getHookSettings } from './config.js';
-import type { DiscoveredHook, HookEventData } from './types.js';
-
-/**
- * Resolve a usable bun runtime path. When the daemon runs under plain bun
- * (dev mode), `process.execPath` is the bun CLI and works directly.  When the
- * daemon is a `bun build --compile` binary, `process.execPath` points to the
- * compiled binary itself -- spawning it with `['run', script]` would re-launch
- * the daemon.  In that case we locate bun via PATH or at `~/.bun/bin/bun`.
- */
-function resolveBunPath(): string {
-  const execBasename = basename(process.execPath);
-  if (execBasename === 'bun' || execBasename === 'bun.exe') {
-    return process.execPath;
-  }
-
-  // Compiled-binary mode -- find a standalone bun runtime.
-  const found = Bun.which('bun');
-  if (found) return found;
-
-  const fallback = join(homedir(), '.bun', 'bin', 'bun');
-  if (existsSync(fallback)) return fallback;
-
-  throw new Error(
-    'Cannot find a bun runtime to execute .ts hooks. ' +
-    'Install bun (https://bun.sh) or ensure it is on your PATH.',
-  );
-}
-
-function getSpawnArgs(scriptPath: string): { command: string; args: string[] } {
-  const ext = extname(scriptPath);
-  if (ext === '.ts') {
-    return { command: resolveBunPath(), args: ['run', scriptPath] };
-  }
-  return { command: scriptPath, args: [] };
-}
-
-export interface HookRunResult {
-  exitCode: number | null;
-  stdout: string;
-  stderr: string;
-}
-
-export async function runHookScript(
-  hook: DiscoveredHook,
-  eventData: HookEventData,
-  options?: { timeoutMs?: number },
-): Promise<HookRunResult> {
-  const timeoutMs = options?.timeoutMs ?? 5000;
-
-  return new Promise<HookRunResult>((resolve) => {
-    let spawnResult: { command: string; args: string[] };
-    try {
-      spawnResult = getSpawnArgs(hook.scriptPath);
-    } catch (err) {
-      resolve({ exitCode: null, stdout: '', stderr: (err as Error).message });
-      return;
-    }
-    const { command, args } = spawnResult;
-    const child = spawn(command, args, {
-      cwd: hook.dir,
-      env: {
-        ...process.env,
-        VELLUM_HOOK_EVENT: eventData.event,
-        VELLUM_HOOK_NAME: hook.name,
-        VELLUM_ROOT_DIR: getRootDir(),
-        VELLUM_WORKSPACE_DIR: getWorkspaceDir(),
-        VELLUM_HOOK_SETTINGS: JSON.stringify(getHookSettings(hook.name, hook.manifest)),
-      },
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-
-    let stdout = '';
-    let stderr = '';
-    let settled = false;
-
-    child.stdout.on('data', (chunk: Buffer) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on('data', (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      child.kill('SIGTERM');
-      // Give the process a short grace period to exit after SIGTERM, then SIGKILL
-      const killTimer = setTimeout(() => {
-        child.kill('SIGKILL');
-      }, 2000);
-      child.once('close', () => {
-        clearTimeout(killTimer);
-        resolve({ exitCode: null, stdout, stderr: stderr + '\nHook timed out' });
-      });
-    }, timeoutMs);
-
-    child.on('close', (code) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ exitCode: code, stdout, stderr });
-    });
-
-    child.on('error', (err) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ exitCode: null, stdout, stderr: stderr + '\n' + err.message });
-    });
-
-    // Suppress unhandled EPIPE errors if the child exits before we finish writing
-    child.stdin.on('error', () => {});
-    // Write event data to stdin and close
-    child.stdin.write(JSON.stringify(eventData));
-    child.stdin.end();
-  });
-}

package/src/hooks/templates.ts

@@ -1,52 +0,0 @@
-import { existsSync, readdirSync, readFileSync, cpSync, chmodSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import type { Dirent } from 'node:fs';
-import { getHooksDir } from '../util/platform.js';
-import { ensureHookInConfig } from './config.js';
-import { getLogger } from '../util/logger.js';
-
-const log = getLogger('hooks-templates');
-
-/**
- * Install bundled hook templates into the user's hooks directory.
- * Templates are copied from `assistant/hook-templates/` to `~/.vellum/workspace/hooks/`.
- * - Never overwrites existing hooks (user modifications are preserved).
- * - Newly installed hooks are disabled by default.
- */
-export function installTemplates(): void {
-  const templatesDir = join(import.meta.dirname ?? __dirname, '../../hook-templates');
-  if (!existsSync(templatesDir)) return;
-
-  const hooksDir = getHooksDir();
-  const entries = readdirSync(templatesDir, { withFileTypes: true }) as Dirent[];
-
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-
-    const targetDir = join(hooksDir, entry.name);
-    if (existsSync(targetDir)) continue; // Never overwrite user hooks
-
-    try {
-      // Copy template directory
-      cpSync(join(templatesDir, entry.name), targetDir, { recursive: true });
-
-      // Make script executable
-      const manifestPath = join(targetDir, 'hook.json');
-      if (existsSync(manifestPath)) {
-        const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
-        if (manifest.script) {
-          chmodSync(join(targetDir, manifest.script), 0o755);
-        }
-      }
-
-      // Add to config (disabled by default)
-      ensureHookInConfig(entry.name, { enabled: false });
-
-      log.info({ hook: entry.name }, 'Installed hook template (disabled by default)');
-    } catch (err) {
-      // Clean up partially-copied directory so the next restart can retry
-      try { rmSync(targetDir, { recursive: true, force: true }); } catch (e) { log.debug({ err: e }, 'Cleanup of partial hook template directory failed'); }
-      log.warn({ err, hook: entry.name }, 'Failed to install hook template');
-    }
-  }
-}

package/src/hooks/types.ts

@@ -1,72 +0,0 @@
-export type HookEventName =
-  // Daemon lifecycle
-  | 'daemon-start'
-  | 'daemon-stop'
-  // Session lifecycle
-  | 'session-start'
-  | 'session-end'
-  // LLM call lifecycle
-  | 'pre-llm-call'
-  | 'post-llm-call'
-  // Tool execution lifecycle
-  | 'pre-tool-execute'
-  | 'post-tool-execute'
-  // Permission lifecycle
-  | 'permission-request'
-  | 'permission-resolve'
-  // Message lifecycle
-  | 'pre-message'
-  | 'post-message'
-  // Error
-  | 'on-error';
-
-export interface HookSettingsSchemaEntry {
-  type: string;
-  default?: unknown;
-  description?: string;
-}
-
-export interface HookManifest {
-  name: string;
-  description?: string;
-  version?: string;
-  events: HookEventName[];
-  script: string;
-  /** When true, non-zero exit from this hook cancels pre-* actions. Default false. */
-  blocking?: boolean;
-  /** Schema for per-hook settings with defaults and descriptions. */
-  settingsSchema?: Record<string, HookSettingsSchemaEntry>;
-}
-
-export interface HookConfigEntry {
-  enabled: boolean;
-  /** Per-hook user settings that override manifest defaults. */
-  settings?: Record<string, unknown>;
-}
-
-export interface HookConfig {
-  version: number;
-  hooks: Record<string, HookConfigEntry>;
-}
-
-export interface DiscoveredHook {
-  name: string;
-  /** Absolute path to hook directory */
-  dir: string;
-  manifest: HookManifest;
-  /** Absolute path to the script */
-  scriptPath: string;
-  enabled: boolean;
-}
-
-export interface HookEventData {
-  event: HookEventName;
-  [key: string]: unknown;
-}
-
-export interface HookTriggerResult {
-  /** True if a blocking hook rejected the action (non-zero exit). */
-  blocked: boolean;
-  /** Name of the hook that blocked, if any. */
-  blockedBy?: string;
-}

package/src/inbound/public-ingress-urls.ts

@@ -1,123 +0,0 @@
-/**
- * Centralized URL builders for all public-facing ingress endpoints.
- *
- * ## Source-of-truth precedence
- *
- * The canonical public base URL is resolved through a two-level chain:
- *
- *   1. **User Settings** (`config.ingress.publicBaseUrl`) — set via the
- *      Settings UI or `config set ingress.publicBaseUrl`. This is the
- *      primary source of truth. When the assistant spawns or restarts
- *      the gateway, this value is forwarded as the `INGRESS_PUBLIC_BASE_URL`
- *      environment variable so both processes agree on the same URL.
- *
- *   2. **Environment variable** (`INGRESS_PUBLIC_BASE_URL`) — serves as a
- *      fallback for operational use (e.g. direct gateway-only deployments
- *      without the assistant, or CI overrides). When the assistant is
- *      managing the gateway, the env var is set automatically from (1).
- *
- * This chain ensures that:
- *   - The assistant's outbound callback URLs (Twilio webhooks, OAuth
- *     redirect URIs, etc.) match the gateway's inbound signature
- *     reconstruction URL.
- *   - Changing the URL in Settings immediately updates outbound callback
- *     registration, while the gateway can validate inbound Twilio signatures
- *     using forwarded public URL headers from tunnels/proxies.
- *
- * All public-facing ingress URL construction is centralized here.
- */
-
-export interface IngressConfig {
-  ingress?: { enabled?: boolean; publicBaseUrl?: string };
-}
-
-/**
- * Trim whitespace and strip trailing slashes from a URL string.
- */
-function normalizeUrl(url: string): string {
-  return url.trim().replace(/\/+$/, '');
-}
-
-/**
- * Resolve the canonical public base URL using the precedence chain
- * documented at the top of this module.
- *
- * When `ingress.enabled` is explicitly `false`, the public ingress is
- * considered disabled regardless of whether a URL is configured. This
- * allows the user to toggle ingress off without clearing the URL value.
- *
- * Throws if no source provides a non-empty value or if ingress is disabled.
- */
-export function getPublicBaseUrl(config: IngressConfig): string {
-  if (config.ingress?.enabled === false) {
-    throw new Error(
-      'Public ingress is disabled. Enable it in Settings to use public-facing webhooks.',
-    );
-  }
-
-  const ingressValue = config.ingress?.publicBaseUrl;
-  if (ingressValue) {
-    const normalized = normalizeUrl(ingressValue);
-    if (normalized) return normalized;
-  }
-
-  const ingressEnvValue = process.env.INGRESS_PUBLIC_BASE_URL;
-  if (ingressEnvValue) {
-    const normalized = normalizeUrl(ingressEnvValue);
-    if (normalized) return normalized;
-  }
-
-  throw new Error(
-    'No public base URL configured. Set ingress.publicBaseUrl in config or INGRESS_PUBLIC_BASE_URL env var.',
-  );
-}
-
-/**
- * Build the Twilio voice webhook URL for a given call session.
- */
-export function getTwilioVoiceWebhookUrl(config: IngressConfig, callSessionId: string): string {
-  const base = getPublicBaseUrl(config);
-  return `${base}/webhooks/twilio/voice?callSessionId=${callSessionId}`;
-}
-
-/**
- * Build the Twilio status callback URL.
- */
-export function getTwilioStatusCallbackUrl(config: IngressConfig): string {
-  const base = getPublicBaseUrl(config);
-  return `${base}/webhooks/twilio/status`;
-}
-
-/**
- * Build the Twilio connect-action callback URL.
- */
-export function getTwilioConnectActionUrl(config: IngressConfig): string {
-  const base = getPublicBaseUrl(config);
-  return `${base}/webhooks/twilio/connect-action`;
-}
-
-/**
- * Build the Twilio ConversationRelay WebSocket URL.
- * Converts http:// → ws:// and https:// → wss://.
- */
-export function getTwilioRelayUrl(config: IngressConfig): string {
-  const base = getPublicBaseUrl(config);
-  const wsBase = base.replace(/^http(s?)/, 'ws$1');
-  return `${wsBase}/webhooks/twilio/relay`;
-}
-
-/**
- * Build the OAuth callback URL.
- */
-export function getOAuthCallbackUrl(config: IngressConfig): string {
-  const base = getPublicBaseUrl(config);
-  return `${base}/webhooks/oauth/callback`;
-}
-
-/**
- * Build the Telegram webhook URL.
- */
-export function getTelegramWebhookUrl(config: IngressConfig): string {
-  const base = getPublicBaseUrl(config);
-  return `${base}/webhooks/telegram`;
-}

package/src/index.ts

@@ -1,75 +0,0 @@
-#!/usr/bin/env bun
-
-import { Command } from 'commander';
-import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
-import { spawn } from 'node:child_process';
-
-const require = createRequire(import.meta.url);
-const { version } = require('../package.json') as { version: string };
-
-import {
-  registerDefaultAction,
-  registerDaemonCommand,
-  registerDevCommand,
-  registerSessionsCommand,
-  registerAuditCommand,
-  registerDoctorCommand,
-  registerCompletionsCommand,
-} from './cli/core-commands.js';
-import {
-  registerConfigCommand,
-  registerKeysCommand,
-  registerTrustCommand,
-  registerMemoryCommand,
-} from './cli/config-commands.js';
-import { registerHooksCommand } from './hooks/cli.js';
-import { registerEmailCommand } from './cli/email.js';
-import { registerContactsCommand } from './cli/contacts.js';
-import { registerAutonomyCommand } from './cli/autonomy.js';
-import { registerDoordashCommand } from './cli/doordash.js';
-import { registerTwitterCommand } from './cli/twitter.js';
-import { registerMapCommand } from './cli/map.js';
-
-const program = new Command();
-
-program
-  .name('vellum')
-  .description('Local AI assistant')
-  .version(version);
-
-registerDefaultAction(program);
-registerDaemonCommand(program);
-registerDevCommand(program);
-registerSessionsCommand(program);
-registerConfigCommand(program);
-registerKeysCommand(program);
-registerTrustCommand(program);
-registerMemoryCommand(program);
-registerAuditCommand(program);
-registerDoctorCommand(program);
-registerHooksCommand(program);
-registerEmailCommand(program);
-registerContactsCommand(program);
-registerAutonomyCommand(program);
-registerDoordashCommand(program);
-registerCompletionsCommand(program);
-
-registerTwitterCommand(program);
-registerMapCommand(program);
-
-const knownCommands = new Set(program.commands.map(cmd => cmd.name()));
-const firstArg = process.argv[2];
-
-if (firstArg && !firstArg.startsWith('-') && !knownCommands.has(firstArg)) {
-  const cliPkgPath = require.resolve('@vellumai/cli/package.json');
-  const cliEntry = join(dirname(cliPkgPath), 'src', 'index.ts');
-  const child = spawn('bun', ['run', cliEntry, ...process.argv.slice(2)], {
-    stdio: 'inherit',
-  });
-  child.on('exit', (code) => {
-    process.exit(code ?? 1);
-  });
-} else {
-  program.parse();
-}

package/src/instrument.ts

@@ -1,60 +0,0 @@
-import * as Sentry from "@sentry/node";
-import { APP_VERSION } from "./version.js";
-
-/** Patterns that match sensitive data in Sentry event values. */
-const PII_PATTERNS = [
-  /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
-  /\b(?:\d{4}[- ]){3}\d{1,7}\b|\b\d{13,19}\b/g,
-  /\b\d{3}-\d{2}-\d{4}\b/g,
-];
-
-function redactString(value: string): string {
-  let result = value;
-  for (const pattern of PII_PATTERNS) {
-    pattern.lastIndex = 0;
-    result = result.replace(pattern, "[REDACTED]");
-  }
-  return result;
-}
-
-function redactObject(obj: unknown): unknown {
-  if (typeof obj === "string") return redactString(obj);
-  if (Array.isArray(obj)) return obj.map(redactObject);
-  if (obj !== null && typeof obj === "object") {
-    const out: Record<string, unknown> = {};
-    for (const [key, val] of Object.entries(obj)) {
-      out[key] = redactObject(val);
-    }
-    return out;
-  }
-  return obj;
-}
-
-/** Call after dotenv has loaded so process.env.SENTRY_DSN is available. */
-export function initSentry(): void {
-  Sentry.init({
-    dsn: process.env.SENTRY_DSN,
-    release: `vellum-assistant@${APP_VERSION}`,
-    environment: APP_VERSION === "0.0.0-dev" ? "development" : "production",
-    sendDefaultPii: false,
-    beforeSend(event) {
-      if (event.exception?.values) {
-        event.exception.values = event.exception.values.map((ex) => ({
-          ...ex,
-          value: ex.value ? redactString(ex.value) : ex.value,
-        }));
-      }
-      if (event.breadcrumbs) {
-        event.breadcrumbs = event.breadcrumbs.map((bc) => ({
-          ...bc,
-          message: bc.message ? redactString(bc.message) : bc.message,
-          data: bc.data ? (redactObject(bc.data) as Record<string, unknown>) : bc.data,
-        }));
-      }
-      if (event.extra) {
-        event.extra = redactObject(event.extra) as Record<string, unknown>;
-      }
-      return event;
-    },
-  });
-}

package/src/logfire.ts

@@ -1,99 +0,0 @@
-import type { Provider, ProviderResponse, SendMessageOptions, Message, ToolDefinition } from './providers/types.js';
-import { APP_VERSION } from './version.js';
-import { getLogger } from './util/logger.js';
-
-const log = getLogger('logfire');
-
-type LogfireModule = typeof import('@pydantic/logfire-node');
-
-const LOGFIRE_ENABLED: boolean =
-  APP_VERSION === '0.0.0-dev' &&
-  !!process.env.LOGFIRE_TOKEN &&
-  process.env.VELLUM_ENABLE_MONITORING === '1';
-
-let logfireInstance: LogfireModule | null = null;
-
-/**
- * Initialize Logfire for LLM observability.
- * Dynamically imports @pydantic/logfire-node only when enabled.
- * Non-fatal on failure (logs warning and continues).
- */
-export async function initLogfire(): Promise<void> {
-  if (!LOGFIRE_ENABLED) return;
-
-  try {
-    const logfire = await import('@pydantic/logfire-node');
-    logfire.configure({
-      token: process.env.LOGFIRE_TOKEN,
-      serviceName: 'vellum-assistant',
-      serviceVersion: APP_VERSION,
-    });
-    logfireInstance = logfire;
-    log.info('Logfire initialized');
-  } catch (err) {
-    log.warn({ err }, 'Failed to initialize Logfire — LLM observability disabled');
-  }
-}
-
-/**
- * Wraps a provider with Logfire tracing spans.
- * When LOGFIRE_ENABLED is false, returns the provider as-is (no wrapper allocated).
- */
-export function wrapWithLogfire(provider: Provider): Provider {
-  if (!LOGFIRE_ENABLED) return provider;
-  return new LogfireProvider(provider);
-}
-
-/**
- * Wrapper provider that instruments each sendMessage call with a Logfire span.
- * When Logfire is not initialized, acts as a pure pass-through with zero overhead.
- */
-class LogfireProvider implements Provider {
-  public readonly name: string;
-
-  constructor(private readonly inner: Provider) {
-    this.name = inner.name;
-  }
-
-  async sendMessage(
-    messages: Message[],
-    tools?: ToolDefinition[],
-    systemPrompt?: string,
-    options?: SendMessageOptions,
-  ): Promise<ProviderResponse> {
-    if (!logfireInstance) {
-      return this.inner.sendMessage(messages, tools, systemPrompt, options);
-    }
-
-    const start = Date.now();
-
-    return logfireInstance.span(`llm.${this.name}`, { 'llm.provider': this.name, 'llm.message_count': messages.length, 'llm.tool_count': tools?.length ?? 0 }, {}, async (span) => {
-      try {
-        const response = await this.inner.sendMessage(messages, tools, systemPrompt, options);
-        const durationMs = Date.now() - start;
-
-        span.setAttributes({
-          'llm.model': response.model,
-          'llm.stop_reason': response.stopReason,
-          'llm.usage.input_tokens': response.usage.inputTokens,
-          'llm.usage.output_tokens': response.usage.outputTokens,
-          'llm.usage.cache_creation_input_tokens': response.usage.cacheCreationInputTokens ?? 0,
-          'llm.usage.cache_read_input_tokens': response.usage.cacheReadInputTokens ?? 0,
-          'llm.duration_ms': durationMs,
-          'llm.success': true,
-        });
-
-        return response;
-      } catch (error) {
-        const durationMs = Date.now() - start;
-        span.setAttributes({
-          'llm.duration_ms': durationMs,
-          'llm.success': false,
-          'llm.error.type': error instanceof Error ? error.constructor.name : 'Unknown',
-          'llm.error.message': error instanceof Error ? error.message : String(error),
-        });
-        throw error;
-      }
-    });
-  }
-}