@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/workspace/git-service.ts

@@ -1,4 +1,4 @@
-import { execFile, spawnSync } from "node:child_process";
+import { execFile, spawn, spawnSync } from "node:child_process";
 import {
   chmodSync,
   existsSync,
@@ -62,6 +62,7 @@ function cleanGitEnv(workspaceDir: string): Record<string, string> {
 const WORKSPACE_GITIGNORE_RULES = [
   "data/db/",
   "data/qdrant/",
+  "plugins/*/node_modules/",
   "logs/",
   "*.log",
   "*.sock",
@@ -607,7 +608,25 @@ export class WorkspaceGitService {
           };
         }
 
-        const status = await this.getStatusInternal();
+        // A status read can fail transiently (e.g. an oversized working tree
+        // or a momentary git error). Treat that as "no commit this tick"
+        // rather than a hard failure: returning didRunGit=false leaves the
+        // circuit breaker untouched so auto-commit/heartbeat keeps running
+        // instead of tripping dead until restart.
+        let status: GitStatus;
+        try {
+          status = await this.getStatusInternal();
+        } catch (statusErr) {
+          log.warn(
+            { err: statusErr, workspaceDir: this.workspaceDir },
+            "Skipping commit cycle: git status read failed",
+          );
+          return {
+            committed: false,
+            status: emptyStatus,
+            didRunGit: false as const,
+          };
+        }
         if (status.clean) {
           return { committed: false, status, didRunGit: true as const };
         }
@@ -681,7 +700,9 @@ export class WorkspaceGitService {
    * Internal status implementation (must be called with lock held).
    */
   private async getStatusInternal(): Promise<GitStatus> {
-    const { stdout } = await this.execGit(["status", "--porcelain"]);
+    // Streamed via spawn (not execFile) so an oversized status from a bloated
+    // working tree cannot exceed Node's default 1 MB maxBuffer and fail.
+    const { stdout } = await this.execGitStreaming(["status", "--porcelain"]);
 
     const staged: string[] = [];
     const modified: string[] = [];
@@ -877,35 +898,129 @@ export class WorkspaceGitService {
       });
       return { stdout, stderr };
     } catch (err) {
-      // Enhance error with git command details, preserving properties
-      // needed to distinguish transient failures from corruption.
-      const gitErr = err as Error & {
-        stdout?: string;
-        stderr?: string;
-        code?: string;
-        killed?: boolean;
-        signal?: string;
-      };
-      const isPermissionError =
-        gitErr.code === "EACCES" ||
-        gitErr.stderr?.includes("Permission denied");
-      const prefix = isPermissionError
-        ? "Git permission error"
-        : "Git command failed";
-      const enhanced = new Error(
-        `${prefix}: git ${args.join(" ")}\n` +
-          `Error: ${gitErr.message}\n` +
-          `Stderr: ${gitErr.stderr || ""}`,
-      );
-      // Preserve properties so callers can detect timeouts, permission
-      // errors, and missing-binary failures without parsing the message.
-      (enhanced as ExecError).killed = gitErr.killed;
-      (enhanced as ExecError).signal = gitErr.signal;
-      (enhanced as ExecError).code = gitErr.code;
-      throw enhanced;
+      const gitErr = err as ExecError & { stdout?: string; stderr?: string };
+      throw this.enhanceGitError(args, {
+        message: gitErr.message,
+        stderr: gitErr.stderr,
+        code: gitErr.code,
+        killed: gitErr.killed,
+        signal: gitErr.signal,
+      });
     }
   }
 
+  /**
+   * Execute a git command, streaming stdout/stderr into buffers via `spawn`.
+   *
+   * Unlike {@link execGit} (which uses `execFile` with Node's 1 MB default
+   * `maxBuffer`), this has no fixed output ceiling — so commands whose output
+   * scales with working-tree size (`git status --porcelain` over a bloated
+   * workspace) cannot fail with `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`. Used for
+   * read paths where output is unbounded; errors are enhanced identically to
+   * {@link execGit} so callers can still distinguish timeouts and permissions.
+   */
+  private execGitStreaming(
+    args: string[],
+    options?: { signal?: AbortSignal },
+  ): Promise<{ stdout: string; stderr: string }> {
+    const config = getConfig();
+    const timeoutMs = config.workspaceGit?.interactiveGitTimeoutMs ?? 10_000;
+    return new Promise((resolve, reject) => {
+      const child = spawn("git", args, {
+        cwd: this.workspaceDir,
+        env: cleanGitEnv(this.workspaceDir),
+        signal: options?.signal,
+      });
+
+      const stdoutChunks: Buffer[] = [];
+      const stderrChunks: Buffer[] = [];
+      let timedOut = false;
+      let settled = false;
+
+      const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGTERM");
+      }, timeoutMs);
+
+      child.stdout?.on("data", (chunk: Buffer) => stdoutChunks.push(chunk));
+      child.stderr?.on("data", (chunk: Buffer) => stderrChunks.push(chunk));
+
+      child.on("error", (err: ExecError) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        reject(
+          this.enhanceGitError(args, {
+            message: err.message,
+            stderr: Buffer.concat(stderrChunks).toString("utf-8"),
+            code: err.code,
+            killed: err.killed,
+            signal: err.signal,
+          }),
+        );
+      });
+
+      child.on(
+        "close",
+        (code: number | null, signal: NodeJS.Signals | null) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
+          const stderr = Buffer.concat(stderrChunks).toString("utf-8");
+
+          if (code === 0 && !timedOut) {
+            resolve({ stdout, stderr });
+            return;
+          }
+
+          reject(
+            this.enhanceGitError(args, {
+              message: timedOut
+                ? `git ${args.join(" ")} timed out after ${timeoutMs}ms`
+                : `git ${args.join(" ")} exited with code ${code}`,
+              stderr,
+              code: timedOut ? undefined : (code ?? undefined),
+              killed: timedOut,
+              signal: signal ?? (timedOut ? "SIGTERM" : undefined),
+            }),
+          );
+        },
+      );
+    });
+  }
+
+  /**
+   * Build a descriptive Error for a failed git command, preserving the
+   * properties callers use to distinguish transient failures (timeouts,
+   * permissions, missing binary) from genuine corruption.
+   */
+  private enhanceGitError(
+    args: string[],
+    raw: {
+      message: string;
+      stderr?: string;
+      code?: string | number;
+      killed?: boolean;
+      signal?: string;
+    },
+  ): ExecError {
+    const isPermissionError =
+      raw.code === "EACCES" || raw.stderr?.includes("Permission denied");
+    const prefix = isPermissionError
+      ? "Git permission error"
+      : "Git command failed";
+    const enhanced = new Error(
+      `${prefix}: git ${args.join(" ")}\n` +
+        `Error: ${raw.message}\n` +
+        `Stderr: ${raw.stderr || ""}`,
+    ) as ExecError;
+    enhanced.killed = raw.killed;
+    enhanced.signal = raw.signal;
+    enhanced.code = raw.code;
+    return enhanced;
+  }
+
   /**
    * Build commit args that disable all git hook execution.
    *

package/src/workspace/migrations/109-swap-quality-profile-to-glm-5p2.ts

@@ -0,0 +1,121 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Bring an existing workspace's managed inference config in line with the
+// current code templates: the managed `quality-optimized` profile runs GLM 5.2
+// (Fireworks), and the default advisor points at the managed `frontier` (Opus)
+// profile.
+//
+// A migration is needed even though the seeder reconciles managed-profile
+// content from the templates on every boot, because the seeder only consults a
+// template when it reseeds that profile. Off-platform installs reseed every
+// boot, but a platform workspace keeps the profile it was hatched with (the
+// seeder skips overlay-supplied profiles, and the overlay is consumed once). A
+// platform workspace whose `quality-optimized` profile resolves to Opus
+// therefore relies on this migration to move it to GLM 5.2.
+//
+// Scope: only the managed `quality-optimized` profile is rewritten — the
+// user-owned `custom-quality-optimized` copy is theirs to manage, and an
+// explicitly user-owned `quality-optimized` is left alone. A profile matches
+// only when its model is an Opus id (the OpenRouter-prefixed id included);
+// absent `source` on this canonical name means legacy managed (migration 052
+// seeds it source-less), so it counts as ours.
+//
+// The managed `frontier` profile is materialized by the boot seeder (it is a
+// managed template), so this migration only points the default advisor at it,
+// and only when the workspace still carries the seeded `quality-optimized`
+// default and no user-owned `frontier` profile exists.
+
+const OPUS_48_MODEL_IDS = new Set([
+  "claude-opus-4-8",
+  "anthropic/claude-opus-4.8",
+]);
+
+const GLM_52_MODEL = "accounts/fireworks/models/glm-5p2";
+
+export const swapQualityProfileToGlm52Migration: WorkspaceMigration = {
+  id: "109-swap-quality-profile-to-glm-5p2",
+  description:
+    "Set the managed quality-optimized profile to GLM 5.2 and point the default advisor at frontier",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) return;
+
+    let changed = false;
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      const profile = readObject(profiles["quality-optimized"]);
+      // Only the managed profile is ours to migrate. `quality-optimized` is a
+      // canonical name reserved since migration 052, which seeded it source-less,
+      // so absent `source` means legacy managed — treat it as ours. Only an
+      // explicit `source: "user"` (a profile the user took ownership of) is left
+      // untouched. Matching by Opus model id also covers the OpenRouter id.
+      if (
+        profile !== null &&
+        profile.source !== "user" &&
+        typeof profile.model === "string" &&
+        OPUS_48_MODEL_IDS.has(profile.model)
+      ) {
+        profile.model = GLM_52_MODEL;
+        profile.provider = "fireworks";
+        profile.provider_connection = "fireworks-managed";
+        // Leave `advisorEnabled` untouched: a persisted `false` is ambiguous —
+        // it can be a seeded default or a deliberate per-profile opt-out — so
+        // deleting it could silently re-enable the advisor against the user's
+        // intent. Preserving the stored value keeps an explicit opt-out intact.
+        profiles["quality-optimized"] = profile;
+        llm.profiles = profiles;
+        changed = true;
+      }
+    }
+
+    // Move the default advisor pointer to the new strongest managed profile.
+    // Only the seeded default (`quality-optimized`) is rewritten; a workspace
+    // that picked its own advisor profile keeps it. Skip the rewrite when a
+    // user already owns a profile named `frontier`: the seeder leaves that
+    // user profile in place rather than materializing the managed Opus one, so
+    // pointing the advisor at it would consult an arbitrary user model. Leaving
+    // the advisor on `quality-optimized` (now managed GLM 5.2) is the safe
+    // fallback in that collision case. Any `frontier` present at migration time
+    // is user-owned (the managed one is materialized later, at seed time);
+    // treat anything not explicitly `source: "managed"` as theirs, since the
+    // settings UI saves custom profiles without a `source`.
+    const existingFrontier = readObject(profiles?.frontier);
+    const frontierIsUserOwned =
+      existingFrontier !== null && existingFrontier.source !== "managed";
+    if (llm.advisorProfile === "quality-optimized" && !frontierIsUserOwned) {
+      llm.advisorProfile = "frontier";
+      changed = true;
+    }
+
+    if (changed) {
+      config.llm = llm;
+      writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    }
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/110-flip-balanced-profile-to-together.ts

@@ -0,0 +1,82 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Move the managed `balanced` profile from Fireworks MiniMax M3 to Together AI.
+//
+// Together serves MiniMax M3 with correct forced-`tool_choice` and object-typed
+// tool-arg handling; the Fireworks copy collapses object args to `{}`. The boot
+// seeder reconciles managed-profile content from the templates, but only when
+// it reseeds a profile: off-platform installs reseed every boot, while a
+// platform workspace keeps the profile it was hatched with (the seeder skips
+// overlay-supplied profiles, and the overlay is consumed once). A platform
+// workspace whose `balanced` profile still resolves to Fireworks MiniMax M3
+// therefore relies on this migration to move it to Together.
+//
+// Scope: only the managed `balanced` profile still on the Fireworks MiniMax M3
+// default is rewritten. A user-owned `balanced` (`source: "user"`) or one whose
+// model the user changed is left alone. Migration 052 seeds `balanced`
+// source-less, so absent `source` means legacy managed — treat it as ours. The
+// profile key stays `balanced`, so persisted `inference_profile` pins on
+// conversations/schedules keep resolving and need no rewrite.
+
+const OLD_MODEL = "accounts/fireworks/models/minimax-m3";
+const NEW_MODEL = "MiniMaxAI/MiniMax-M3";
+
+export const flipBalancedProfileToTogetherMigration: WorkspaceMigration = {
+  id: "110-flip-balanced-profile-to-together",
+  description:
+    "Move the managed balanced profile from Fireworks to Together AI (MiniMax M3)",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) return;
+
+    const profiles = readObject(llm.profiles);
+    if (profiles === null) return;
+
+    const profile = readObject(profiles["balanced"]);
+    // Only the managed profile still on the Fireworks MiniMax M3 default is
+    // ours to migrate. `balanced` is seeded source-less by migration 052, so
+    // absent `source` means legacy managed; only an explicit `source: "user"`
+    // is left untouched. Matching on the old model id leaves a user-retargeted
+    // profile alone and makes the migration idempotent.
+    if (
+      profile === null ||
+      profile.source === "user" ||
+      profile.model !== OLD_MODEL
+    ) {
+      return;
+    }
+
+    profile.model = NEW_MODEL;
+    profile.provider = "together";
+    profile.provider_connection = "together-managed";
+    profiles["balanced"] = profile;
+    llm.profiles = profiles;
+    config.llm = llm;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/registry.ts

@@ -106,6 +106,8 @@ import { enableMemoryV3LiveForNewWorkspacesMigration } from "./105-enable-memory
 import { dropCollectUsageDataMigration } from "./106-drop-collect-usage-data.js";
 import { dropSendDiagnosticsMigration } from "./107-drop-send-diagnostics.js";
 import { dropBalancedEconomyProfileMigration } from "./108-drop-balanced-economy-profile.js";
+import { swapQualityProfileToGlm52Migration } from "./109-swap-quality-profile-to-glm-5p2.js";
+import { flipBalancedProfileToTogetherMigration } from "./110-flip-balanced-profile-to-together.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -223,4 +225,6 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   dropCollectUsageDataMigration,
   dropSendDiagnosticsMigration,
   dropBalancedEconomyProfileMigration,
+  swapQualityProfileToGlm52Migration,
+  flipBalancedProfileToTogetherMigration,
 ];

package/src/workspace/migrations/runner.ts

@@ -75,10 +75,21 @@ function saveCheckpoints(
   renameSync(tmpPath, path);
 }
 
+/** Counts from a single {@link runWorkspaceMigrations} sweep, for the caller to
+ *  fold into its own startup log. `failed` covers both migrations that threw
+ *  this run and pre-existing non-retryable `failed` checkpoints — kept separate
+ *  from `skipped` so the summary surfaces them instead of masking them as
+ *  "already applied". */
+export type WorkspaceMigrationSummary = {
+  applied: number;
+  skipped: number;
+  failed: number;
+};
+
 export async function runWorkspaceMigrations(
   workspaceDir: string,
   migrations: WorkspaceMigration[],
-): Promise<void> {
+): Promise<WorkspaceMigrationSummary> {
   const migrationsById = new Map<string, WorkspaceMigration>();
   for (const m of migrations) {
     if (migrationsById.has(m.id)) {
@@ -119,8 +130,23 @@ export async function runWorkspaceMigrations(
     }
   }
 
+  log.info(`Running workspace migrations (${migrations.length} registered)`);
+
+  let appliedCount = 0;
+  let skippedCount = 0;
+  let failedCount = 0;
+
   for (const migration of migrations) {
-    if (checkpoints.applied[migration.id]) {
+    const existing = checkpoints.applied[migration.id];
+    if (existing) {
+      // A non-retryable failed checkpoint left over from a prior run still
+      // satisfies this guard; count it as failed rather than skipped so the
+      // summary keeps surfacing it.
+      if (existing.status === "failed") {
+        failedCount++;
+      } else {
+        skippedCount++;
+      }
       continue;
     }
 
@@ -147,6 +173,7 @@ export async function runWorkspaceMigrations(
         status: "failed",
       };
       saveCheckpoints(workspaceDir, checkpoints);
+      failedCount++;
       continue;
     }
 
@@ -156,6 +183,7 @@ export async function runWorkspaceMigrations(
       status: "completed",
     };
     saveCheckpoints(workspaceDir, checkpoints);
+    appliedCount++;
   }
 
   // First-boot sweep finished cleanly — clear the flag so future runs (and
@@ -166,6 +194,8 @@ export async function runWorkspaceMigrations(
     checkpoints.isNewWorkspace = false;
     saveCheckpoints(workspaceDir, checkpoints);
   }
+
+  return { applied: appliedCount, skipped: skippedCount, failed: failedCount };
 }
 
 /**