@mycadet/assistant 0.12.9 → 0.12.10

package/src/telemetry/watchdog-direct-emit.ts

@@ -1,104 +0,0 @@
-/**
- * Direct (unbuffered) emit of a single `watchdog` telemetry event.
- *
- * The usual watchdog path persists to the SQLite `telemetry_events` outbox and
- * lets {@link ./usage-telemetry-reporter} batch and upload it later. That
- * durable buffer is the right default — it survives restarts and dedupes on
- * `daemon_event_id`. But it is the wrong tool for a check that fires *because*
- * SQLite is unusable: recording a corruption event into SQLite can hit the very
- * damage it is reporting, and the store's `recordWatchdogEvent` drags the whole
- * `db-connection` graph in behind it.
- *
- * This helper POSTs the event straight to the cloud ingest instead. It is
- * best-effort: opt-out, missing credentials (early boot, before the CES
- * handshake), platform-disabled, and HTTP failures all no-op. No retry — a lost
- * event is acceptable for a rare, high-signal check. Deduped downstream on
- * `daemon_event_id` like every other telemetry event.
- */
-
-import { v4 as uuid } from "uuid";
-
-import { CadetCloudClient } from "../cloud/client.js";
-import { getRawShareAnalytics } from "../cloud/consent-cache.js";
-import { areCloudFeaturesEnabled } from "../cloud/feature-gate.js";
-import { getCloudOrganizationId, getCloudUserId } from "../config/env.js";
-import { getDeviceId } from "../util/device-id.js";
-import { getLogger } from "../util/logger.js";
-import { APP_VERSION } from "../version.js";
-import { validateWireEvents } from "./telemetry-wire-validation.js";
-import type { WatchdogTelemetryEvent } from "./types.js";
-
-const log = getLogger("watchdog-direct-emit");
-
-/** Platform telemetry ingest endpoint (same one the batched reporter POSTs to). */
-const TELEMETRY_INGEST_PATH = "/v1/telemetry/ingest/";
-
-/**
- * POST one `watchdog` event directly to the cloud, bypassing the SQLite
- * buffer. Honors a confirmed `share_analytics` opt-out and the
- * platform-features gate. An unknown consent state emits: this path reports
- * SQLite corruption and has no outbox to defer into, and platform ingest
- * re-gates on consent authoritatively server-side. Never throws — the caller
- * is on a query hot path.
- */
-export async function emitWatchdogEventDirect(
-  checkName: string,
-  detail: Record<string, unknown> | null,
-  value: number | null = null,
-): Promise<void> {
-  try {
-    // Drop only on a confirmed opt-out; unknown emits (no buffer to defer
-    // into, and platform ingest re-gates on consent server-side).
-    if (getRawShareAnalytics() === false) {
-      return;
-    }
-    if (!areCloudFeaturesEnabled()) {
-      return;
-    }
-
-    // Authenticated-only. Null before the CES handshake resolves credentials;
-    // the event is simply dropped (no durable backlog to retry from).
-    const client = await CadetCloudClient.create();
-    if (!client) {
-      return;
-    }
-
-    const event: WatchdogTelemetryEvent = {
-      type: "watchdog",
-      daemon_event_id: uuid(),
-      recorded_at: Date.now(),
-      check_name: checkName,
-      value,
-      detail,
-      assistant_version: APP_VERSION,
-    };
-
-    // Pre-flush wire validation — observability only: warns when the server
-    // would silently drop the event; the POST proceeds unchanged.
-    validateWireEvents([event], log);
-
-    const organizationId = getCloudOrganizationId() || undefined;
-    const userId = getCloudUserId() || undefined;
-    const resp = await client.fetch(TELEMETRY_INGEST_PATH, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        device_id: getDeviceId(),
-        assistant_version: APP_VERSION,
-        ...(organizationId ? { organization_id: organizationId } : {}),
-        ...(userId ? { user_id: userId } : {}),
-        events: [event],
-      }),
-    });
-    // Consume the body to release the connection, mirroring the reporter.
-    await resp.text();
-    if (!resp.ok) {
-      log.warn(
-        { status: resp.status, checkName },
-        "Direct watchdog telemetry POST failed (non-fatal)",
-      );
-    }
-  } catch (err) {
-    log.warn({ err, checkName }, "Direct watchdog telemetry emit failed");
-  }
-}

package/src/telemetry/watchdog-events-store.ts

@@ -1,31 +0,0 @@
-import { recordTelemetryEvent } from "./telemetry-events-outbox.js";
-
-/**
- * Input for one `watchdog` telemetry event. Metadata only — never conversation
- * content. `value` and `detail` are optional; omitting both yields the minimal
- * event (check_name only). `detail` is an open JSON bag carried verbatim in
- * the event payload.
- */
-export interface WatchdogEventRecord {
-  checkName: string;
-  /** Measured magnitude (block ms, idle ms, ...). Null when the check carries no scalar. */
-  value?: number | null;
-  /** Open JSON bag for extra fields (reason codes, secondary numbers, ...). */
-  detail?: Record<string, unknown> | null;
-}
-
-/**
- * Record a `watchdog` telemetry event for a watchdog check firing, enqueued
- * on the `telemetry_events` outbox. Consent gating and degraded-mode behavior
- * are `recordTelemetryEvent`'s, as is the return value: the queued outbox
- * row, or null when the event was dropped (opt-out) or could not be stored.
- */
-export function recordWatchdogEvent(
-  record: WatchdogEventRecord,
-): { id: string; createdAt: number } | null {
-  return recordTelemetryEvent("watchdog", {
-    check_name: record.checkName,
-    value: record.value ?? null,
-    detail: record.detail ?? null,
-  });
-}

package/src/tools/ui-surface/channel-variants.ts

@@ -1,52 +0,0 @@
-/**
- * Conversation-stable wire projections of the UI surface tool definitions.
- *
- * `ui_show`, `ui_update`, and `ui_dismiss` keep one definition across every
- * channel and across live vs clientless turns. Channel renderers enforce the
- * surfaces they can display at execution. Clientless calls persist surface
- * content for the next capable client that opens the conversation.
- *
- * `activation_moment` is the remaining schema projection. It applies only to
- * activation-rail conversations, whose marker is written before the first
- * tool resolution, so the extra property is stable for that conversation's
- * lifetime. It must not vary by channel or turn presence.
- */
-
-import type { ToolDefinition } from "../../providers/types.js";
-import { ACTIVATION_MOMENT_PARAMS } from "../../telemetry/activation-funnel.js";
-
-const ACTIVATION_MOMENT_PROPERTY = {
-  type: "string",
-  enum: ACTIVATION_MOMENT_PARAMS,
-  description:
-    "Activation-rail telemetry tag. Set this when this surface IS one of the activation funnel moments; the milestone is recorded automatically when the user commits the surface. Omit for all non-activation surfaces.",
-};
-
-/**
- * Add the optional `activation_moment` param to ui_show's schema. Applied
- * only for activation-rail conversations (`isActivationSession`). The rail
- * bootstrap prompt instructs the tagging, and the daemon's emit path reads
- * the tag from tool input independently of this schema.
- */
-export function injectActivationMomentParam(
-  definitions: ToolDefinition[],
-): ToolDefinition[] {
-  return definitions.map((def) => {
-    if (def.name !== "ui_show") {
-      return def;
-    }
-    const schema = def.input_schema as {
-      properties?: Record<string, unknown>;
-    };
-    return {
-      ...def,
-      input_schema: {
-        ...schema,
-        properties: {
-          ...schema.properties,
-          activation_moment: ACTIVATION_MOMENT_PROPERTY,
-        },
-      },
-    };
-  });
-}

package/src/watcher/__tests__/telemetry.test.ts

@@ -1,178 +0,0 @@
-/**
- * Tests for watcher usage telemetry.
- *
- * Strategy: stub the checkpoint store, lifecycle-event store, and
- * watcher store via `mock.module()` so we can drive the inventory
- * throttle and event naming without touching the DB.
- */
-
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-import type { ConsentState } from "../../cloud/consent-cache.js";
-import type { LifecycleEvent } from "../../persistence/lifecycle-events-store.js";
-
-const checkpoints = new Map<string, string>();
-const recordedEvents: string[] = [];
-let fakeEnabledWatchers: Array<{ providerId: string }> = [];
-let shareAnalytics: ConsentState = true;
-const recordAndReturnEvent = (name: string): LifecycleEvent => {
-  recordedEvents.push(name);
-  return { id: "evt-1", eventName: name, createdAt: 0 };
-};
-let recordImpl: (name: string) => LifecycleEvent | null = recordAndReturnEvent;
-
-mock.module("../../persistence/checkpoints.js", () => ({
-  getMemoryCheckpoint: (key: string) => checkpoints.get(key) ?? null,
-  setMemoryCheckpoint: (key: string, value: string) => {
-    checkpoints.set(key, value);
-  },
-}));
-
-mock.module("../../persistence/lifecycle-events-store.js", () => ({
-  recordLifecycleEvent: (name: string) => recordImpl(name),
-}));
-
-mock.module("../../cloud/consent-cache.js", () => ({
-  getRawShareAnalytics: () => shareAnalytics,
-}));
-
-mock.module("../watcher-store.js", () => ({
-  listWatchers: () => fakeEnabledWatchers,
-}));
-
-const {
-  recordWatcherInventoryIfDue,
-  recordWatcherLlmProcessed,
-  WATCHER_INVENTORY_INTERVAL_MS,
-} = await import("../telemetry.js");
-
-const INVENTORY_KEY = "telemetry:watchers:inventory_last_recorded";
-// Realistic epoch base: an absent checkpoint reads as 0, so `now` must be
-// at least one interval past the epoch for the inventory to be due.
-const BASE = 1_700_000_000_000;
-
-beforeEach(() => {
-  checkpoints.clear();
-  recordedEvents.length = 0;
-  fakeEnabledWatchers = [];
-  shareAnalytics = true;
-  recordImpl = recordAndReturnEvent;
-});
-
-describe("recordWatcherInventoryIfDue", () => {
-  test("records one event per enabled watcher when due", () => {
-    fakeEnabledWatchers = [
-      { providerId: "gmail" },
-      { providerId: "linear" },
-      { providerId: "gmail" },
-    ];
-
-    recordWatcherInventoryIfDue(BASE);
-
-    expect(recordedEvents).toEqual([
-      "watcher_enabled:gmail",
-      "watcher_enabled:linear",
-      "watcher_enabled:gmail",
-    ]);
-    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE));
-  });
-
-  test("skips when the last inventory is within the interval", () => {
-    fakeEnabledWatchers = [{ providerId: "gmail" }];
-    checkpoints.set(INVENTORY_KEY, String(BASE));
-
-    recordWatcherInventoryIfDue(BASE + WATCHER_INVENTORY_INTERVAL_MS - 1);
-
-    expect(recordedEvents).toEqual([]);
-    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE));
-  });
-
-  test("records again once the interval has elapsed", () => {
-    fakeEnabledWatchers = [{ providerId: "github" }];
-    checkpoints.set(INVENTORY_KEY, String(BASE));
-
-    recordWatcherInventoryIfDue(BASE + WATCHER_INVENTORY_INTERVAL_MS);
-
-    expect(recordedEvents).toEqual(["watcher_enabled:github"]);
-  });
-
-  test("advances the checkpoint even when no watchers are enabled", () => {
-    recordWatcherInventoryIfDue(BASE + 1);
-
-    expect(recordedEvents).toEqual([]);
-    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 1));
-  });
-
-  test("swallows storage errors and leaves the checkpoint for retry", () => {
-    fakeEnabledWatchers = [{ providerId: "gmail" }];
-    recordImpl = () => {
-      throw new Error("db unavailable");
-    };
-
-    expect(() => recordWatcherInventoryIfDue(BASE + 2)).not.toThrow();
-    // Checkpoint must not advance on failure: the next tick retries
-    // instead of skipping a day of inventory.
-    expect(checkpoints.get(INVENTORY_KEY)).toBeUndefined();
-
-    recordImpl = recordAndReturnEvent;
-    recordWatcherInventoryIfDue(BASE + 3);
-
-    expect(recordedEvents).toEqual(["watcher_enabled:gmail"]);
-    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 3));
-  });
-
-  test("leaves the checkpoint for retry when the telemetry DB is unavailable with consent on", () => {
-    fakeEnabledWatchers = [{ providerId: "gmail" }];
-    // Degraded mode: consent granted but the store reports nothing recorded.
-    recordImpl = () => null;
-
-    recordWatcherInventoryIfDue(BASE + 2);
-    expect(checkpoints.get(INVENTORY_KEY)).toBeUndefined();
-
-    recordImpl = recordAndReturnEvent;
-    recordWatcherInventoryIfDue(BASE + 3);
-
-    expect(recordedEvents).toEqual(["watcher_enabled:gmail"]);
-    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 3));
-  });
-
-  test("advances the checkpoint when consent is a confirmed opt-out", () => {
-    fakeEnabledWatchers = [{ providerId: "gmail" }];
-    shareAnalytics = false;
-    // Confirmed-opt-out skip: the store records nothing and returns null.
-    recordImpl = () => null;
-
-    recordWatcherInventoryIfDue(BASE + 4);
-
-    expect(recordedEvents).toEqual([]);
-    expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 4));
-  });
-
-  test("leaves the checkpoint for retry when the store returns null while consent is unknown", () => {
-    fakeEnabledWatchers = [{ providerId: "gmail" }];
-    shareAnalytics = "unknown";
-    // Unknown consent never drops at record time, so a null here means the
-    // telemetry DB is unavailable — retry, don't skip a day.
-    recordImpl = () => null;
-
-    recordWatcherInventoryIfDue(BASE + 4);
-
-    expect(checkpoints.get(INVENTORY_KEY)).toBeUndefined();
-  });
-});
-
-describe("recordWatcherLlmProcessed", () => {
-  test("embeds provider and conversation id in the event name", () => {
-    recordWatcherLlmProcessed("linear", "conv-123");
-
-    expect(recordedEvents).toEqual(["watcher_llm_processed:linear:conv-123"]);
-  });
-
-  test("swallows storage errors", () => {
-    recordImpl = () => {
-      throw new Error("db unavailable");
-    };
-
-    expect(() => recordWatcherLlmProcessed("gmail", "conv-456")).not.toThrow();
-  });
-});

package/src/watcher/telemetry.ts

@@ -1,93 +0,0 @@
-/**
- * Watcher usage telemetry — lifecycle-event breadcrumbs that let fleet
- * analytics answer "is anyone using watchers, and what do they cost?"
- * ahead of the planned watcher → skills-and-schedules migration.
- *
- * Both event shapes ship through the existing lifecycle-event telemetry
- * pipeline, so they inherit its platform `share_analytics` consent gate and
- * need no wire-contract or platform-side changes:
- *
- * - `watcher_enabled:<providerId>` — one per enabled watcher, at most
- *   once per 24h per daemon. Counts devices that have watchers
- *   configured, including ones whose providers rarely produce events.
- * - `watcher_llm_processed:<providerId>:<conversationId>` — one per
- *   watcher tick that ran an LLM background job. The conversation id is
- *   embedded so analytics can join against `llm_usage` events for exact
- *   cost attribution.
- *
- * Telemetry must never break the polling loop, so every entry point
- * swallows storage errors.
- */
-
-import { getRawShareAnalytics } from "../cloud/consent-cache.js";
-import {
-  getMemoryCheckpoint,
-  setMemoryCheckpoint,
-} from "../persistence/checkpoints.js";
-import { recordLifecycleEvent } from "../persistence/lifecycle-events-store.js";
-import { getLogger } from "../util/logger.js";
-import { listWatchers } from "./watcher-store.js";
-
-const log = getLogger("watcher-telemetry");
-
-const INVENTORY_CHECKPOINT_KEY = "telemetry:watchers:inventory_last_recorded";
-export const WATCHER_INVENTORY_INTERVAL_MS = 24 * 60 * 60 * 1000;
-
-let warnedInventoryDbUnavailable = false;
-
-/**
- * Record one `watcher_enabled:<providerId>` lifecycle event per enabled
- * watcher, at most once per 24h. Called from every watcher tick; the
- * checkpoint advances only after the events are recorded, so a transient
- * storage failure (a throw, or a degraded-mode `null` while consent is not
- * a confirmed opt-out) retries on the next tick instead of skipping a day.
- * A confirmed-opt-out `null` is a deliberate skip and still advances. Retries
- * can duplicate events for watchers recorded before the failure point —
- * an acceptable overcount for best-effort telemetry, where losing a full
- * day's inventory would not be.
- */
-export function recordWatcherInventoryIfDue(now: number): void {
-  try {
-    const last = Number(getMemoryCheckpoint(INVENTORY_CHECKPOINT_KEY) ?? "0");
-    if (now - last < WATCHER_INVENTORY_INTERVAL_MS) {
-      return;
-    }
-    for (const watcher of listWatchers({ enabledOnly: true })) {
-      const recorded = recordLifecycleEvent(
-        `watcher_enabled:${watcher.providerId}`,
-      );
-      if (recorded === null && getRawShareAnalytics() !== false) {
-        if (!warnedInventoryDbUnavailable) {
-          warnedInventoryDbUnavailable = true;
-          log.warn(
-            "Telemetry DB unavailable; watcher inventory retries next tick",
-          );
-        }
-        return;
-      }
-    }
-    warnedInventoryDbUnavailable = false;
-    setMemoryCheckpoint(INVENTORY_CHECKPOINT_KEY, String(now));
-  } catch (err) {
-    log.warn({ err }, "Failed to record watcher inventory telemetry");
-  }
-}
-
-/**
- * Record a `watcher_llm_processed:<providerId>:<conversationId>`
- * lifecycle event for a watcher tick that bootstrapped an LLM background
- * job. Recorded whenever a conversation was created — even if the job
- * later failed — because tokens may already have been spent.
- */
-export function recordWatcherLlmProcessed(
-  providerId: string,
-  conversationId: string,
-): void {
-  try {
-    recordLifecycleEvent(
-      `watcher_llm_processed:${providerId}:${conversationId}`,
-    );
-  } catch (err) {
-    log.warn({ err }, "Failed to record watcher LLM-processed telemetry");
-  }
-}

package/src/workspace/migrations/097-enable-adaptive-thinking-managed-profiles.ts

@@ -1,165 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-import type { WorkspaceMigration } from "./types.js";
-
-// Enable adaptive thinking on the cloud "balanced" and "quality-optimized"
-// profiles for existing platform instances.
-//
-// The assistant-side seed defaults (MANAGED_PROFILE_TEMPLATES in
-// seed-inference-profiles.ts) already ship thinking: { enabled: true,
-// streamThinking: true } for both profiles, which normalizes to
-// { type: "adaptive" } on the wire. Off-platform (BYOK) instances pick this
-// up on every boot because the seeder overwrites cloud profiles. On-platform
-// instances preserve existing profiles (the cloud overlay is authoritative),
-// so instances that were hatched before thinking was enabled in the templates
-// are stuck with thinking disabled or absent.
-//
-// This migration patches the on-disk config for both profiles, adding
-// thinking: { enabled: true, streamThinking: true } where it's missing or
-// explicitly disabled. It skips profiles that:
-//   - Don't exist (no profile to patch)
-//   - Already have thinking enabled (idempotent)
-//   - Are source: "user" (user-created profiles are untouched)
-//   - Have a non-managed, non-absent source (unknown origin)
-//   - Resolve to a non-Anthropic provider (adaptive thinking is
-//     Anthropic-specific). Effective provider is the profile's explicit
-//     `provider`; otherwise the provider implied by a known Claude `model`
-//     (mirroring the resolver's withImpliedProviders); otherwise
-//     llm.default.provider — with a completely absent llm.default.provider
-//     treated as Anthropic, matching migration 052's own `?? "anthropic"`
-//     default. This keeps the legacy non-Anthropic empty `{}` shells seeded by
-//     migration 052 off the repair while still patching profiles that pin a
-//     known Claude model under a non-Anthropic default.
-//
-// Note: the live startup path re-runs the same repair after the cloud
-// overlay merge — see assistant/src/workspace/adaptive-thinking-repair.ts.
-// This file keeps its own frozen copy of the logic because migration modules
-// are self-contained snapshots and must never be imported by other code.
-
-const ADAPTIVE_THINKING = { enabled: true, streamThinking: true } as const;
-const TARGET_PROFILES = ["balanced", "quality-optimized"] as const;
-
-export const enableAdaptiveThinkingCloudProfilesMigration: WorkspaceMigration =
-  {
-    id: "097-enable-adaptive-thinking-managed-profiles",
-    description:
-      "Enable adaptive thinking on managed balanced and quality-optimized profiles",
-    run(workspaceDir: string): void {
-      const configPath = join(workspaceDir, "config.json");
-      if (!existsSync(configPath)) {
-        return;
-      }
-
-      let config: Record<string, unknown>;
-      try {
-        const raw = JSON.parse(readFileSync(configPath, "utf-8"));
-        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-          return;
-        }
-        config = raw as Record<string, unknown>;
-      } catch {
-        return;
-      }
-
-      const llm = readObject(config.llm);
-      if (llm === null) {
-        return;
-      }
-
-      const profiles = readObject(llm.profiles);
-      if (profiles === null) {
-        return;
-      }
-
-      // Profiles without an explicit provider and without a model-implied
-      // provider inherit llm.default.provider at resolution time; an absent
-      // llm.default.provider resolves to Anthropic.
-      const defaultBlock = readObject(llm.default);
-      const defaultProvider =
-        typeof defaultBlock?.provider === "string"
-          ? defaultBlock.provider
-          : "anthropic";
-
-      let changed = false;
-
-      for (const name of TARGET_PROFILES) {
-        const profile = readObject(profiles[name]);
-        if (profile === null) {
-          continue;
-        }
-
-        // Only patch managed Anthropic profiles.
-        // Legacy profiles created before the `source` metadata field was
-        // introduced have source=undefined. Treat these as managed when the
-        // profile name is one of the canonical managed names (which
-        // TARGET_PROFILES already guarantees) and the effective provider is
-        // Anthropic. Effective provider is the explicit `provider`, else the
-        // provider implied by a known Claude `model`, else the inherited
-        // llm.default.provider. Explicit `source: "user"` profiles are always
-        // skipped.
-        if (profile.source === "user") {
-          continue;
-        }
-        if (profile.source !== undefined && profile.source !== "managed") {
-          continue;
-        }
-        const effectiveProvider = resolveEffectiveProvider(
-          profile,
-          defaultProvider,
-        );
-        if (effectiveProvider !== "anthropic") {
-          continue;
-        }
-
-        // Skip if thinking is already enabled.
-        const thinking = readObject(profile.thinking);
-        if (thinking !== null && thinking.enabled === true) {
-          continue;
-        }
-
-        profile.thinking = { ...ADAPTIVE_THINKING };
-        profiles[name] = profile;
-        changed = true;
-      }
-
-      if (changed) {
-        llm.profiles = profiles;
-        config.llm = llm;
-        writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-      }
-    },
-    down(_workspaceDir: string): void {
-      // Forward-only.
-    },
-  };
-
-// Inline, conservative mirror of the resolver's catalog-based provider
-// implication. Migration modules are frozen, self-contained snapshots and must
-// not import the live model catalog. Anthropic's catalog model ids are bare
-// `claude-*` ids (the slash-prefixed `anthropic/claude-*` ids belong to
-// OpenRouter), so a profile pinning a `claude-*` model with no slash counts as
-// Anthropic.
-function resolveEffectiveProvider(
-  profile: Record<string, unknown>,
-  defaultProvider: string,
-): string {
-  if (typeof profile.provider === "string") {
-    return profile.provider;
-  }
-  if (
-    typeof profile.model === "string" &&
-    profile.model.startsWith("claude-") &&
-    !profile.model.includes("/")
-  ) {
-    return "anthropic";
-  }
-  return defaultProvider;
-}
-
-function readObject(value: unknown): Record<string, unknown> | null {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  return value as Record<string, unknown>;
-}