@vellumai/assistant 0.10.3 → 0.10.4-staging.1

package/src/workspace/migrations/031-drop-user-md.ts

@@ -8,16 +8,8 @@ import {
   writeFileSync,
 } from "node:fs";
 import { basename, join } from "node:path";
+import { Database } from "bun:sqlite";
 
-import { eq } from "drizzle-orm";
-
-import {
-  findGuardianForChannel,
-  generateUserFileSlug,
-  listGuardianChannels,
-} from "../../contacts/contact-store.js";
-import { getDb } from "../../memory/db-connection.js";
-import { contacts } from "../../memory/schema/contacts.js";
 import { getLogger } from "../../util/logger.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -25,11 +17,11 @@ const log = getLogger("workspace-migration-031-drop-user-md");
 
 // ── Inlined helpers ───────────────────────────────────────────────
 //
-// Per AGENTS.md, migrations should minimize cross-module imports so
-// they remain stable as code around them evolves. The helpers below
-// are duplicated inline (rather than imported from
-// `util/strip-comment-lines.js` and `prompts/system-prompt.js`) so
-// this migration does not regress if those modules change later.
+// AGENTS.md requires each migration to be self-contained: it may import
+// only `./types.js`, `./utils.js`, the logger, and runtime built-ins.
+// The helpers below (including the guardian DB read and the userFile
+// slug) are inlined so this migration does not regress if the modules
+// they originate from change later.
 
 /**
  * Strip lines starting with `_` (comment convention for prompt .md files)
@@ -123,13 +115,59 @@ function isValidSlug(slug: string): boolean {
   return basename(slug) === slug && slug !== "." && slug !== "..";
 }
 
+/**
+ * Strip LIKE metacharacters so the prefix match runs literally. SQLite has
+ * no default LIKE escape character, so strip rather than escape. Inlined
+ * from `contacts/contact-store.ts`.
+ */
+function escapeLike(value: string): string {
+  return value.replace(/%/g, "").replace(/_/g, "");
+}
+
+/** Pure slug transform applied to a display name. */
+function computeUserFileBaseSlug(displayName: string): string {
+  return (
+    displayName
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .slice(0, 100) || "user"
+  );
+}
+
+/**
+ * Generate a collision-free `users/<slug>.md` filename for a display name,
+ * inlined verbatim from `contacts/contact-store.ts` to keep this migration
+ * self-contained. Produces "alice.md", "alice-2.md", etc.
+ */
+function generateUserFileSlug(db: Database, displayName: string): string {
+  const slug = computeUserFileBaseSlug(displayName);
+
+  const rows = db
+    .query<{ user_file: string | null }, [string]>(
+      `SELECT user_file FROM contacts WHERE user_file LIKE ?`,
+    )
+    .all(`${escapeLike(slug)}%`);
+
+  const taken = new Set(rows.map((r) => r.user_file?.toLowerCase()));
+
+  const base = `${slug}.md`;
+  if (!taken.has(base)) return base;
+
+  for (let i = 2; ; i++) {
+    const candidate = `${slug}-${i}.md`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+
 /**
  * Delete the legacy `USER.md` at the workspace root after migrating
  * any customized content into `users/<slug>.md`.
  *
- * Handles four relevant states:
- *   1. Fresh install, no guardian → no-op (nothing to migrate yet;
- *      `USER.md` is no longer seeded post PR 11).
+ * Handles these relevant states:
+ *   1. No local guardian → preserve a customized `USER.md` (the local
+ *      mirror can be stale, so a customized profile may still belong to a
+ *      real guardian); delete only the unmodified template/empty file.
  *   2. Pre-017 customized `USER.md`, guardian has no `userFile` →
  *      backfill the slug, copy `USER.md` → `users/<slug>.md`, delete `USER.md`.
  *   3. Post-017 state where `users/<slug>.md` already has content →
@@ -137,6 +175,12 @@ function isValidSlug(slug: string): boolean {
  *   4. Missing `users/<slug>.md` after guardian is resolved → seed a bare
  *      `GUARDIAN_PERSONA_TEMPLATE` scaffold so downstream readers have a file.
  */
+interface GuardianRow {
+  id: string;
+  display_name: string;
+  user_file: string | null;
+}
+
 export const dropUserMdMigration: WorkspaceMigration = {
   id: "031-drop-user-md",
   description:
@@ -145,163 +189,203 @@ export const dropUserMdMigration: WorkspaceMigration = {
   run(workspaceDir: string): void {
     const userMdPath = join(workspaceDir, "USER.md");
 
-    // Resolve the guardian contact. Prefer the vellum-channel binding
-    // (the canonical local/native guardian); fall back to whichever
-    // guardian has the most recently verified active channel.
-    let guardian: { id: string; displayName: string; userFile: string | null };
+    const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+    if (!existsSync(dbPath)) return; // DB not created yet — defer cleanup.
+
+    let db: Database;
     try {
-      const vellumGuardian = findGuardianForChannel("vellum");
-      if (vellumGuardian) {
-        guardian = {
-          id: vellumGuardian.contact.id,
-          displayName: vellumGuardian.contact.displayName,
-          userFile: vellumGuardian.contact.userFile ?? null,
-        };
-      } else {
-        const anyGuardian = listGuardianChannels();
-        if (!anyGuardian) {
-          // Fresh install or pre-onboarding. If a stale USER.md somehow
-          // remains on disk (e.g. leftover from an older build), best-
-          // effort remove it so future first runs are clean.
-          if (existsSync(userMdPath)) {
-            try {
-              unlinkSync(userMdPath);
-              log.info(
-                { path: userMdPath },
-                "Deleted stale pre-onboarding USER.md with no guardian",
-              );
-            } catch (err) {
-              log.warn(
-                { err, path: userMdPath },
-                "Failed to delete pre-onboarding USER.md; leaving in place",
-              );
-            }
-          }
-          return;
-        }
-        guardian = {
-          id: anyGuardian.contact.id,
-          displayName: anyGuardian.contact.displayName,
-          userFile: anyGuardian.contact.userFile ?? null,
-        };
-      }
+      db = new Database(dbPath);
     } catch (err) {
-      // DB not ready or query failed — leave USER.md alone. The next
-      // startup after DB init will try again.
-      log.warn(
-        { err },
-        "Failed to resolve guardian contact; deferring USER.md cleanup",
-      );
+      log.warn({ err }, "Cannot open assistant DB; deferring USER.md cleanup");
       return;
     }
 
-    // Backfill a userFile slug on the guardian contact if one isn't set.
-    if (!guardian.userFile) {
+    try {
+      // Resolve the guardian contact from the local DB. Prefer the
+      // vellum-channel binding (the canonical native guardian); fall back to
+      // whichever guardian has the most recently verified active channel.
+      let guardianRow: GuardianRow | null;
       try {
-        const slug = generateUserFileSlug(guardian.displayName);
-        const db = getDb();
-        db.update(contacts)
-          .set({ userFile: slug })
-          .where(eq(contacts.id, guardian.id))
-          .run();
-        guardian.userFile = slug;
-        log.info(
-          { contactId: guardian.id, slug },
-          "Backfilled missing guardian.userFile",
-        );
+        guardianRow =
+          db
+            .query<GuardianRow, []>(
+              `SELECT c.id AS id, c.display_name AS display_name, c.user_file AS user_file
+                 FROM contacts c JOIN contact_channels cc ON cc.contact_id = c.id
+                WHERE c.role = 'guardian' AND cc.status = 'active'
+                ORDER BY (cc.type = 'vellum') DESC, cc.verified_at DESC
+                LIMIT 1`,
+            )
+            .get() ?? null;
       } catch (err) {
+        // DB not ready or query failed — leave USER.md alone. The next
+        // startup after DB init tries again.
         log.warn(
-          { err, contactId: guardian.id },
-          "Failed to backfill guardian.userFile; deferring USER.md cleanup",
+          { err },
+          "Failed to resolve guardian contact; deferring USER.md cleanup",
         );
         return;
       }
-    }
 
-    const userFile = guardian.userFile;
-    if (!userFile || !isValidSlug(userFile)) {
-      log.warn(
-        { userFile },
-        "Guardian userFile is missing or not a safe basename; deferring USER.md cleanup",
-      );
-      return;
-    }
+      if (!guardianRow) {
+        // No local guardian. The mirror can be stale (the gateway mirrors
+        // best-effort), so a customized USER.md may still belong to a real
+        // guardian — preserve it. Only delete the unmodified template/empty
+        // stale file.
+        if (existsSync(userMdPath)) {
+          let isStaleTemplate = false;
+          try {
+            isStaleTemplate =
+              !statSync(userMdPath).isFile() ||
+              isLegacyTemplateContent(readFileSync(userMdPath, "utf-8"));
+          } catch (err) {
+            log.warn(
+              { err, path: userMdPath },
+              "Cannot read USER.md with no guardian; leaving in place",
+            );
+            return;
+          }
+
+          if (!isStaleTemplate) {
+            log.info(
+              { path: userMdPath },
+              "Preserving customized USER.md with no local guardian",
+            );
+            return;
+          }
 
-    const usersDir = join(workspaceDir, "users");
-    mkdirSync(usersDir, { recursive: true });
+          try {
+            unlinkSync(userMdPath);
+            log.info(
+              { path: userMdPath },
+              "Deleting stale template USER.md with no guardian",
+            );
+          } catch (err) {
+            log.warn(
+              { err, path: userMdPath },
+              "Failed to delete stale USER.md; leaving in place",
+            );
+          }
+        }
+        return;
+      }
 
-    const destPath = join(usersDir, userFile);
+      const guardian = {
+        id: guardianRow.id,
+        displayName: guardianRow.display_name,
+        userFile: guardianRow.user_file ?? null,
+      };
 
-    // Read USER.md if it exists and classify its content.
-    let userMdRaw: string | null = null;
-    let userMdIsCustomized = false;
-    if (existsSync(userMdPath)) {
-      try {
-        // Guard against USER.md being a directory (hostile state).
-        if (statSync(userMdPath).isFile()) {
-          userMdRaw = readFileSync(userMdPath, "utf-8");
-          userMdIsCustomized = !isLegacyTemplateContent(userMdRaw);
+      // Backfill a userFile slug on the guardian contact if one isn't set.
+      if (!guardian.userFile) {
+        try {
+          const slug = generateUserFileSlug(db, guardian.displayName);
+          db.run("UPDATE contacts SET user_file = ? WHERE id = ?", [
+            slug,
+            guardian.id,
+          ]);
+          guardian.userFile = slug;
+          log.info(
+            { contactId: guardian.id, slug },
+            "Backfilled missing guardian.userFile",
+          );
+        } catch (err) {
+          log.warn(
+            { err, contactId: guardian.id },
+            "Failed to backfill guardian.userFile; deferring USER.md cleanup",
+          );
+          return;
         }
-      } catch (err) {
-        log.warn(
-          { err, path: userMdPath },
-          "Failed to read USER.md; treating as unreadable",
-        );
       }
-    }
 
-    // Copy customized USER.md content into users/<slug>.md when the
-    // destination is missing or effectively empty. Post-017 installs
-    // that already populated users/<slug>.md are left untouched.
-    if (
-      userMdIsCustomized &&
-      userMdRaw !== null &&
-      destFileIsMissingOrEmpty(destPath)
-    ) {
-      try {
-        copyFileSync(userMdPath, destPath);
-        log.info(
-          { src: userMdPath, dest: destPath },
-          "Copied customized USER.md content into users/<slug>.md",
-        );
-      } catch (err) {
+      const userFile = guardian.userFile;
+      if (!userFile || !isValidSlug(userFile)) {
         log.warn(
-          { err, src: userMdPath, dest: destPath },
-          "Failed to copy USER.md; deferring USER.md cleanup",
+          { userFile },
+          "Guardian userFile is missing or not a safe basename; deferring USER.md cleanup",
         );
         return;
       }
-    }
 
-    // Seed the guardian persona scaffold when the destination file
-    // still doesn't exist (e.g. no USER.md and no post-017 content).
-    // This keeps parity with `ensureGuardianPersonaFile` for new
-    // installs so downstream readers always find a file.
-    if (!existsSync(destPath)) {
-      try {
-        writeFileSync(destPath, GUARDIAN_PERSONA_TEMPLATE, "utf-8");
-        log.info(
-          { dest: destPath },
-          "Seeded guardian persona scaffold at users/<slug>.md",
-        );
-      } catch (err) {
-        log.warn(
-          { err, dest: destPath },
-          "Failed to seed guardian persona scaffold; continuing with USER.md deletion",
-        );
+      const usersDir = join(workspaceDir, "users");
+      mkdirSync(usersDir, { recursive: true });
+
+      const destPath = join(usersDir, userFile);
+
+      // Read USER.md if it exists and classify its content.
+      let userMdRaw: string | null = null;
+      let userMdIsCustomized = false;
+      if (existsSync(userMdPath)) {
+        try {
+          // Guard against USER.md being a directory (hostile state).
+          if (statSync(userMdPath).isFile()) {
+            userMdRaw = readFileSync(userMdPath, "utf-8");
+            userMdIsCustomized = !isLegacyTemplateContent(userMdRaw);
+          }
+        } catch (err) {
+          log.warn(
+            { err, path: userMdPath },
+            "Failed to read USER.md; treating as unreadable",
+          );
+        }
       }
-    }
 
-    // Finally, delete the legacy USER.md if it still exists. Template
-    // or customized, it has no remaining consumer now that PR 11
-    // dropped the seed/fallback read path.
-    if (existsSync(userMdPath)) {
-      try {
-        unlinkSync(userMdPath);
-        log.info({ path: userMdPath }, "Deleted legacy workspace USER.md");
-      } catch (err) {
-        log.warn({ err, path: userMdPath }, "Failed to delete legacy USER.md");
+      // Copy customized USER.md content into users/<slug>.md when the
+      // destination is missing or effectively empty. Post-017 installs
+      // that already populated users/<slug>.md are left untouched.
+      if (
+        userMdIsCustomized &&
+        userMdRaw !== null &&
+        destFileIsMissingOrEmpty(destPath)
+      ) {
+        try {
+          copyFileSync(userMdPath, destPath);
+          log.info(
+            { src: userMdPath, dest: destPath },
+            "Copied customized USER.md content into users/<slug>.md",
+          );
+        } catch (err) {
+          log.warn(
+            { err, src: userMdPath, dest: destPath },
+            "Failed to copy USER.md; deferring USER.md cleanup",
+          );
+          return;
+        }
+      }
+
+      // Seed the guardian persona scaffold when the destination file
+      // still doesn't exist (e.g. no USER.md and no post-017 content).
+      // This keeps parity with `ensureGuardianPersonaFile` for new
+      // installs so downstream readers always find a file.
+      if (!existsSync(destPath)) {
+        try {
+          writeFileSync(destPath, GUARDIAN_PERSONA_TEMPLATE, "utf-8");
+          log.info(
+            { dest: destPath },
+            "Seeded guardian persona scaffold at users/<slug>.md",
+          );
+        } catch (err) {
+          log.warn(
+            { err, dest: destPath },
+            "Failed to seed guardian persona scaffold; continuing with USER.md deletion",
+          );
+        }
+      }
+
+      // Finally, delete the legacy USER.md if it still exists — template or
+      // customized, it has no remaining consumer.
+      if (existsSync(userMdPath)) {
+        try {
+          unlinkSync(userMdPath);
+          log.info({ path: userMdPath }, "Deleted legacy workspace USER.md");
+        } catch (err) {
+          log.warn(
+            { err, path: userMdPath },
+            "Failed to delete legacy USER.md",
+          );
+        }
       }
+    } finally {
+      db.close();
     }
   },
 

package/src/workspace/migrations/112-remove-advisor-callsite-override.ts

@@ -0,0 +1,64 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Strip a persisted `llm.callSites.advisor` entry from existing config files.
+ *
+ * `advisor` is not a valid `LLMCallSiteEnum` key, so a saved
+ * `llm.callSites.advisor.profile` is rejected on parse by the
+ * `z.partialRecord(LLMCallSiteEnum, ...)` schema. The loader recovers (logs
+ * `Invalid config at "llm.callSites.advisor"...`, deletes the key, re-parses),
+ * so it is not a crash — but the warning is logged on every boot, and because
+ * `GET /config` serves the raw file the web "Overrides" badge keeps counting
+ * the invalid key with no reset path.
+ *
+ * This migration strips the key once. The now-empty `llm.callSites` object is
+ * pruned if `advisor` was its only key (the schema defaults `callSites` to
+ * `{}`, so an absent key is equivalent to an empty map). Other call-site keys
+ * and the unrelated top-level `llm.advisorProfile` selection are left intact.
+ *
+ * No-op for configs that never had the key. Idempotent.
+ */
+export const removeAdvisorCallsiteOverrideMigration: WorkspaceMigration = {
+  id: "112-remove-advisor-callsite-override",
+  description:
+    "Remove the stale advisor entry from llm.callSites (advisor call site removed)",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = config.llm;
+    if (!llm || typeof llm !== "object" || Array.isArray(llm)) return;
+
+    const callSites = (llm as Record<string, unknown>).callSites;
+    if (!callSites || typeof callSites !== "object" || Array.isArray(callSites))
+      return;
+
+    const sites = callSites as Record<string, unknown>;
+    if (!("advisor" in sites)) return;
+
+    delete sites.advisor;
+
+    // Prune the now-empty callSites map; an absent key is equivalent to the
+    // schema's `{}` default.
+    if (Object.keys(sites).length === 0) {
+      delete (llm as Record<string, unknown>).callSites;
+    }
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only — the advisor call site no longer exists.
+  },
+};

package/src/workspace/migrations/registry.ts

@@ -109,6 +109,7 @@ import { dropBalancedEconomyProfileMigration } from "./108-drop-balanced-economy
 import { swapQualityProfileToGlm52Migration } from "./109-swap-quality-profile-to-glm-5p2.js";
 import { flipBalancedProfileToTogetherMigration } from "./110-flip-balanced-profile-to-together.js";
 import { pruneSeededCallsiteDefaultsMigration } from "./111-prune-seeded-callsite-defaults.js";
+import { removeAdvisorCallsiteOverrideMigration } from "./112-remove-advisor-callsite-override.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -229,4 +230,5 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   swapQualityProfileToGlm52Migration,
   flipBalancedProfileToTogetherMigration,
   pruneSeededCallsiteDefaultsMigration,
+  removeAdvisorCallsiteOverrideMigration,
 ];

package/src/plugins/defaults/advisor/__tests__/advisor-gate.test.ts

@@ -1,56 +0,0 @@
-import { describe, expect, mock, test } from "bun:test";
-
-// Drive the gate off a controllable llm config + a stubbed default-profile
-// resolver, so we can assert the default-on semantics precisely.
-let mockLlm: {
-  profiles: Record<string, { advisorEnabled?: boolean | null }>;
-  activeProfile?: string;
-} = { profiles: {} };
-
-mock.module("../../../../config/loader.js", () => ({
-  getConfig: () => ({ llm: mockLlm }),
-}));
-mock.module("../../../../config/llm-resolver.js", () => ({
-  resolveDefaultProfileKey: () => "balanced",
-}));
-
-const { advisorEnabledForProfile } = await import("../advisor-gate.js");
-
-describe("advisorEnabledForProfile", () => {
-  test("default-on when the profile omits the flag", () => {
-    mockLlm = { profiles: { p: {} }, activeProfile: "p" };
-    expect(advisorEnabledForProfile("p")).toBe(true);
-  });
-
-  test("default-on when the flag is null", () => {
-    mockLlm = { profiles: { p: { advisorEnabled: null } }, activeProfile: "p" };
-    expect(advisorEnabledForProfile("p")).toBe(true);
-  });
-
-  test("disabled only on an explicit false", () => {
-    mockLlm = {
-      profiles: { p: { advisorEnabled: false } },
-      activeProfile: "p",
-    };
-    expect(advisorEnabledForProfile("p")).toBe(false);
-  });
-
-  test("enabled on an explicit true", () => {
-    mockLlm = { profiles: { p: { advisorEnabled: true } }, activeProfile: "p" };
-    expect(advisorEnabledForProfile("p")).toBe(true);
-  });
-
-  test("falls back to the active profile when modelProfile is null", () => {
-    mockLlm = {
-      profiles: { a: { advisorEnabled: false } },
-      activeProfile: "a",
-    };
-    expect(advisorEnabledForProfile(null)).toBe(false);
-  });
-
-  test("falls back to the call-site default profile when neither is set", () => {
-    // resolveDefaultProfileKey is stubbed to "balanced".
-    mockLlm = { profiles: { balanced: { advisorEnabled: false } } };
-    expect(advisorEnabledForProfile(null)).toBe(false);
-  });
-});

package/src/plugins/defaults/advisor/__tests__/advisor-state-store.test.ts

@@ -1,43 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-
-import type { Message } from "../../../../providers/types.js";
-import {
-  getCapture,
-  recordMessages,
-  recordSystemPrompt,
-  resetAdvisorStateForTests,
-  seedCapture,
-} from "../advisor-state-store.js";
-
-const userMsg = (t: string): Message => ({
-  role: "user",
-  content: [{ type: "text", text: t }],
-});
-
-afterEach(() => {
-  resetAdvisorStateForTests();
-});
-
-describe("advisor state store", () => {
-  test("records system prompt and messages independently per conversation", () => {
-    recordSystemPrompt("c1", "system A");
-    recordMessages("c1", [userMsg("hello")]);
-    recordSystemPrompt("c2", "system B");
-
-    expect(getCapture("c1")?.systemPrompt).toBe("system A");
-    expect(getCapture("c1")?.messages).toEqual([userMsg("hello")]);
-    expect(getCapture("c2")?.systemPrompt).toBe("system B");
-    expect(getCapture("c2")?.messages).toEqual([]);
-  });
-
-  test("seedCapture snapshots (copies) the array", () => {
-    const live: Message[] = [userMsg("one")];
-    seedCapture("c1", live);
-    live.push(userMsg("two"));
-    expect(getCapture("c1")?.messages).toEqual([userMsg("one")]);
-  });
-
-  test("getCapture returns undefined for an unseen conversation", () => {
-    expect(getCapture("nope")).toBeUndefined();
-  });
-});