@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/workspace/git-service.ts

@@ -60,6 +60,7 @@ function cleanGitEnv(workspaceDir: string): Record<string, string> {
  * These are written to .gitignore on init and appended to existing .gitignore files.
  */
 const WORKSPACE_GITIGNORE_RULES = [
+  // Runtime state directories
   "data/db/",
   "data/qdrant/",
   "data/monitoring/",
@@ -69,21 +70,75 @@ const WORKSPACE_GITIGNORE_RULES = [
   "data/apps/*/records/",
   "data/apps/*/dist/",
   "data/apps/*.preview",
-  "plugins/*/node_modules/",
+  // Runtime-managed installs and caches — large and restorable
+  "/embedding-models/",
+  "/external/",
+  "/bin/",
+  "/plugins-data/",
+  "node_modules/",
+  "__pycache__/",
+  ".venv/",
+  // Logs and process state
   "logs/",
   "*.log",
+  "*.jsonl",
   "*.sock",
   "*.pid",
-  "*.sqlite",
-  "*.sqlite-journal",
-  "*.sqlite-wal",
-  "*.sqlite-shm",
-  "*.db",
-  "*.db-journal",
-  "*.db-wal",
-  "*.db-shm",
-  "vellum.pid",
+  "daemon-startup.lock",
   "session-token",
+  // Databases (covers sidecar -journal/-wal/-shm files)
+  "*.sqlite*",
+  "*.db",
+  "*.db-*",
+  // OS junk
+  ".DS_Store",
+  // Archives and disk images
+  "*.zip",
+  "*.tar",
+  "*.gz",
+  "*.tgz",
+  "*.bz2",
+  "*.xz",
+  "*.7z",
+  "*.rar",
+  "*.dmg",
+  "*.iso",
+  // Images (svg is text-based and stays tracked)
+  "*.png",
+  "*.jpg",
+  "*.jpeg",
+  "*.gif",
+  "*.webp",
+  "*.heic",
+  "*.bmp",
+  "*.tiff",
+  // Audio and video
+  "*.mp3",
+  "*.wav",
+  "*.m4a",
+  "*.flac",
+  "*.ogg",
+  "*.mp4",
+  "*.mov",
+  "*.avi",
+  "*.mkv",
+  "*.webm",
+  // Documents and model weights
+  "*.pdf",
+  "*.gguf",
+  "*.onnx",
+  "*.safetensors",
+  "*.pt",
+  "*.pth",
+  // Canonical user state re-included despite the extension rules above.
+  // Must stay after the extension rules: last matching pattern wins.
+  // (Not a broad !data/apps/** — that would also re-include dist/.)
+  // conversations/ holds the messages.jsonl disk view that DB recovery
+  // rebuilds from, so it survives the *.jsonl rule.
+  "!data/avatar/**",
+  "!data/sounds/**",
+  "!data/apps/*/icon.png",
+  "!conversations/**",
 ];
 
 const NULL_GIT_OID = "0000000000000000000000000000000000000000";
@@ -434,11 +489,15 @@ export class WorkspaceGitService {
                 // created before these helpers existed, or by external tools.
                 // These calls are OUTSIDE the rev-parse try/catch so that
                 // normalization errors are not misclassified as "no commits".
-                this.ensureGitignoreRulesLocked();
                 this.ensureBranchGuardHookLocked();
                 await this.ensureCommitIdentityLocked();
                 await this.ensureBranchGuardConfigLocked();
                 await this.ensureOnMainLocked();
+                // After the main switch: ensureOnMainLocked can discard
+                // local changes, which would wipe appended gitignore rules
+                // and staged deletions alike.
+                this.ensureGitignoreRulesLocked();
+                await this.untrackIgnoredFilesLocked();
                 this.initialized = true;
                 this.recordInitSuccess();
                 return;
@@ -450,15 +509,20 @@ export class WorkspaceGitService {
           // Initialize new git repository
           await this.execGit(["init", "-b", "main"]);
 
-          // Run normalization (gitignore + identity + branch enforcement).
+          // Run normalization (identity + branch enforcement + gitignore).
           // For fresh `git init -b main` the branch is already main, but
           // in the corruption-recovery path we fall through here after
           // removing .git, so branch enforcement is still useful.
-          this.ensureGitignoreRulesLocked();
           this.ensureBranchGuardHookLocked();
           await this.ensureCommitIdentityLocked();
           await this.ensureBranchGuardConfigLocked();
           await this.ensureOnMainLocked();
+          // After the main switch (see above). A partial init (`.git`
+          // exists, no commit) can carry staged now-ignored paths from an
+          // interrupted `git add -A`; untracking must precede the initial
+          // commit.
+          this.ensureGitignoreRulesLocked();
+          await this.untrackIgnoredFilesLocked();
 
           // Create initial commit synchronously within the lock to prevent
           // races with the first commitChanges() call. Without this, the
@@ -766,18 +830,38 @@ export class WorkspaceGitService {
         }
       }
 
+      // Exact line matching: a substring check would let an existing rule like
+      // "plugins/*/node_modules/" mask the broader "node_modules/" rule.
+      const existingLines = new Set(
+        content.split("\n").map((line) => line.trim()),
+      );
       const missingRules = WORKSPACE_GITIGNORE_RULES.filter(
-        (rule) => !content.includes(rule),
+        (rule) => !existingLines.has(rule),
       );
       if (hadLegacyDataRule || missingRules.length > 0) {
         let updated = content;
         if (missingRules.length > 0) {
+          // Negation rules must trail every Vellum rule (last matching
+          // pattern wins), so pull existing ones out and re-append them
+          // after the additions instead of leaving them mid-file.
+          const negationRules = WORKSPACE_GITIGNORE_RULES.filter((rule) =>
+            rule.startsWith("!"),
+          );
+          const negationSet = new Set(negationRules);
+          updated = updated
+            .split("\n")
+            .filter((line) => !negationSet.has(line.trim()))
+            .join("\n");
           if (!updated.endsWith("\n")) {
             updated += "\n";
           }
+          const additions = [
+            ...missingRules.filter((rule) => !rule.startsWith("!")),
+            ...negationRules,
+          ];
           updated +=
             "# Vellum runtime state (auto-added)\n" +
-            missingRules.join("\n") +
+            additions.join("\n") +
             "\n";
         }
         writeFileSync(gitignorePath, updated, "utf-8");
@@ -791,6 +875,67 @@ export class WorkspaceGitService {
     }
   }
 
+  /**
+   * Drop tracked files matched by the Vellum-managed ignore rules from the
+   * index (working tree untouched). Ignore rules only affect untracked
+   * paths, so committed runtime state (e.g. embedding-models/) stays in the
+   * index — and churns every commit — until explicitly removed here. The
+   * staged deletions ride along with the next commit. Best-effort: failures
+   * are logged, never block init. Must be called with the mutex lock held.
+   *
+   * Deliberately matches against the Vellum-managed rules only — not the
+   * workspace .gitignore (which may carry user-authored rules whose matches
+   * are force-added on purpose) and not --exclude-standard (the user's
+   * global/local exclude files). The rules are passed via a temp file under
+   * .git so gitignore semantics, including negation order, are preserved.
+   */
+  private async untrackIgnoredFilesLocked(): Promise<void> {
+    const rulesPath = join(this.workspaceDir, ".git", "vellum-untrack-rules");
+    try {
+      writeFileSync(
+        rulesPath,
+        WORKSPACE_GITIGNORE_RULES.join("\n") + "\n",
+        "utf-8",
+      );
+      const { stdout } = await this.execGitStreaming([
+        "ls-files",
+        "-z",
+        "--cached",
+        "--ignored",
+        `--exclude-from=${rulesPath}`,
+      ]);
+      const files = stdout.split("\0").filter(Boolean);
+      if (files.length === 0) {
+        return;
+      }
+      // Chunked to stay under OS argv limits on bloated workspaces.
+      const chunkSize = 200;
+      for (let i = 0; i < files.length; i += chunkSize) {
+        await this.execGit([
+          "rm",
+          "--cached",
+          "-r",
+          "-q",
+          "--ignore-unmatch",
+          "--",
+          ...files.slice(i, i + chunkSize),
+        ]);
+      }
+      log.info(
+        { fileCount: files.length },
+        "Untracked newly ignored files from workspace index",
+      );
+    } catch (err) {
+      log.warn({ err }, "Failed to untrack newly ignored files");
+    } finally {
+      try {
+        unlinkSync(rulesPath);
+      } catch {
+        // Never created, or already gone.
+      }
+    }
+  }
+
   /**
    * Ensure local git identity is configured for automated commits.
    * Idempotent: git config set is a no-op if the value is already correct.

package/src/workspace/migrations/028-recover-conversations-from-disk-view.ts

@@ -207,7 +207,6 @@ export const recoverConversationsFromDiskViewMigration: WorkspaceMigration = {
               conversationType: meta.type ?? "standard",
               originChannel: meta.channel ?? null,
               source: "user",
-              memoryScopeId: "default",
               isAutoTitle: 1,
               totalInputTokens: 0,
               totalOutputTokens: 0,

package/src/workspace/migrations/097-enable-adaptive-thinking-managed-profiles.ts

@@ -25,7 +25,7 @@ import type { WorkspaceMigration } from "./types.js";
 //   - Resolve to a non-Anthropic provider (adaptive thinking is
 //     Anthropic-specific). Effective provider is the profile's explicit
 //     `provider`; otherwise the provider implied by a known Claude `model`
-//     (mirroring the resolver's withImpliedProviderForKnownModel); otherwise
+//     (mirroring the resolver's withImpliedProviders); otherwise
 //     llm.default.provider — with a completely absent llm.default.provider
 //     treated as Anthropic, matching migration 052's own `?? "anthropic"`
 //     default. This keeps the legacy non-Anthropic empty `{}` shells seeded by

package/src/workspace/migrations/126-strip-managed-profile-bodies.ts

@@ -0,0 +1,92 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Default profile CONTENT is code-owned (`config/default-profile-catalog.ts`)
+// and resolves through the effective profile view whether or not
+// `llm.profiles` carries an entry. The daemon no longer seeds default bodies
+// into workspace config, so this migration strips the previously seeded
+// managed entries down to thin stubs holding only the workspace-owned
+// overlay fields (`source`, plus `label`/`status`/`topP` by key-presence —
+// the exact whitelist the effective view reads off a managed-source entry).
+//
+// A same-named entry the user explicitly owns (a non-managed `source` tag)
+// is left fully intact — user profiles shadow the code defaults by design.
+// A SOURCE-LESS entry under a default name is claimed and thinned too: it is
+// legacy seeder/migration output (migration 052 seeds source-less bodies,
+// and on fresh workspaces it runs in the same pass as this migration; the
+// old boot seeder claimed and rewrote such entries on every boot), never a
+// deliberate user shadow. Rollback to a pre-catalog build is safe: its
+// seeder reconciles full template bodies back onto the stubs on first boot.
+
+const DEFAULT_PROFILE_NAMES = [
+  "balanced",
+  "quality-optimized",
+  "cost-optimized",
+  "os-beta",
+];
+
+const WORKSPACE_OWNED_FIELDS = ["label", "status", "topP"];
+
+export const stripManagedProfileBodiesMigration: WorkspaceMigration = {
+  id: "126-strip-managed-profile-bodies",
+  description:
+    "Strip seeded managed default-profile bodies down to thin workspace-owned stubs (content is code-owned)",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) return;
+    const profiles = readObject(llm.profiles);
+    if (profiles === null) return;
+
+    let changed = false;
+    for (const name of DEFAULT_PROFILE_NAMES) {
+      const entry = readObject(profiles[name]);
+      if (entry === null) continue;
+      if (entry.source !== undefined && entry.source !== "managed") continue;
+
+      const stub: Record<string, unknown> = { source: "managed" };
+      for (const field of WORKSPACE_OWNED_FIELDS) {
+        if (field in entry) {
+          stub[field] = entry[field];
+        }
+      }
+
+      const entryKeys = Object.keys(entry).sort();
+      const stubKeys = Object.keys(stub).sort();
+      const alreadyThin =
+        entryKeys.length === stubKeys.length &&
+        entryKeys.every((key, i) => key === stubKeys[i]);
+      if (alreadyThin) continue;
+
+      profiles[name] = stub;
+      changed = true;
+    }
+
+    if (changed) {
+      writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    }
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only. A pre-catalog build's seeder reconciles full template
+    // bodies back onto the stubs on its first boot.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}

package/src/workspace/migrations/127-backfill-default-provider.ts

@@ -0,0 +1,176 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Backfill `llm.defaultProvider` for installs that never ran the hatch flow
+// (which sets it directly) from deterministic, synchronously-readable
+// signals: `IS_PLATFORM`, a legacy `llm.default.provider`, or a personal
+// `custom-*` profile's provider.
+//
+// Platform installs resolve to "vellum" before the legacy field is
+// consulted: a pre-field platform config commonly carries
+// `llm.default.provider: "anthropic"` as a schema-default echo rather than
+// a routing choice, and backfilling it would permanently pin the install to
+// a personal connection (the ensure pass never overwrites an existing
+// value). This mirrors the hatch precedence, where platform outranks the
+// BYOK provider signal.
+//
+// The same schema-default echo affects the off-platform legacy read:
+// `LLMConfigBase.provider` defaults to "anthropic" and the first-launch
+// seed persists it, so a bare "anthropic" is ambiguous. Disambiguating it
+// requires an async vault read that this sync migration cannot perform, so
+// the entire resolution is deferred to the ensure pass (which checks the
+// vault before profiles). The migration must not fall through to profiles
+// on its own in this case — that would preempt the vault check and pin a
+// real-BYOK user to the profile's provider.
+//
+// The remaining login-dependent fallback requires an async secure-vault
+// read that a sync migration cannot perform, so that step lives in the
+// post-boot ensure pass instead (workspace/default-provider-ensure.ts,
+// which also re-applies these same sync signals — see that module's header
+// for the full split rationale). When no signal matches here, this
+// migration writes nothing rather than guessing the login fallback.
+//
+// Frozen copy: migration modules are self-contained snapshots and must not
+// import from config modules (workspace/migrations/AGENTS.md); this list
+// mirrors config/default-profile-names.ts's DEFAULT_PROFILE_PROVIDERS.
+const DEFAULT_PROFILE_PROVIDERS = [
+  "anthropic",
+  "openai",
+  "gemini",
+  "fireworks",
+  "openrouter",
+  "vellum",
+] as const;
+
+const CUSTOM_PROFILE_ORDER = [
+  "custom-balanced",
+  "custom-quality-optimized",
+  "custom-cost-optimized",
+] as const;
+
+export const backfillDefaultProviderMigration: WorkspaceMigration = {
+  id: "127-backfill-default-provider",
+  description: "Backfill llm.defaultProvider from existing config signals",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+    // Validity check, not shape check: LLMSchema's `.catch(undefined)` drops
+    // an invalid persisted object at parse, so no reader ever saw it —
+    // overwriting one is repair. Mirrors DefaultProviderSchema (frozen, like
+    // the provider list above); extra keys stay valid because zod strips
+    // unknown object keys at parse.
+    if (isValidDefaultProvider(llm.defaultProvider)) {
+      return;
+    }
+
+    const provider = isPlatform() ? "vellum" : resolveProviderSignal(llm);
+    if (provider === undefined) {
+      return;
+    }
+
+    llm.defaultProvider = { provider };
+    config.llm = llm;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function isValidDefaultProvider(value: unknown): boolean {
+  const obj = readObject(value);
+  if (obj === null) {
+    return false;
+  }
+  if (
+    typeof obj.provider !== "string" ||
+    !isDefaultProfileProvider(obj.provider)
+  ) {
+    return false;
+  }
+  const connectionName = obj.connectionName;
+  return (
+    connectionName === undefined ||
+    (typeof connectionName === "string" && connectionName.length > 0)
+  );
+}
+
+// Frozen copy of config/env-registry.ts's IS_PLATFORM read — migration
+// modules must not import from config modules (workspace/migrations/AGENTS.md).
+function isPlatform(): boolean {
+  return process.env.IS_PLATFORM === "true" || process.env.IS_PLATFORM === "1";
+}
+
+function resolveProviderSignal(
+  llm: Record<string, unknown>,
+): string | undefined {
+  const legacyProvider = readObject(llm.default)?.provider;
+  if (typeof legacyProvider === "string") {
+    // A bare "anthropic" is the schema default (`LLMConfigBase.provider`)
+    // that the first-launch seed persists, so it is ambiguous: it may be a
+    // real BYOK choice or an echo with no user intent. Disambiguating
+    // requires an async vault read this sync migration can't perform, so
+    // defer the entire resolution to the ensure pass (which checks the
+    // vault before profiles). Falling through to profiles here would
+    // preempt the vault check and pin a real-BYOK user to the profile's
+    // provider. Other providers can't be schema echoes.
+    if (legacyProvider === "anthropic") {
+      return undefined;
+    }
+    if (isDefaultProfileProvider(legacyProvider)) {
+      return legacyProvider;
+    }
+  }
+
+  const profiles = readObject(llm.profiles);
+  if (profiles === null) {
+    return undefined;
+  }
+
+  for (const name of CUSTOM_PROFILE_ORDER) {
+    const entry = readObject(profiles[name]);
+    if (entry === null) {
+      continue;
+    }
+    const provider = entry.provider;
+    if (typeof provider !== "string") {
+      continue;
+    }
+    return isDefaultProfileProvider(provider) ? provider : undefined;
+  }
+
+  return undefined;
+}
+
+function isDefaultProfileProvider(
+  value: string,
+): value is (typeof DEFAULT_PROFILE_PROVIDERS)[number] {
+  return (DEFAULT_PROFILE_PROVIDERS as readonly string[]).includes(value);
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/128-repair-stale-openrouter-grok-model-ids.ts

@@ -0,0 +1,112 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair stale OpenRouter xAI model IDs in workspace LLM config.
+ *
+ * OpenRouter no longer serves `x-ai/grok-4.20-beta` (graduated to
+ * `x-ai/grok-4.20`) or `x-ai/grok-4` (retired; `x-ai/grok-4.5` is the current
+ * flagship), and both IDs are gone from the provider catalog, so requests
+ * pinning them fail with a model-not-found error. Repair known LLM config
+ * leaves where clients write model IDs — `llm.default`, `llm.callSites.*`,
+ * and `llm.profiles.*` — only on an exact stale match, and only when the
+ * fragment's provider is OpenRouter.
+ *
+ * Provider guard: both stale IDs were catalog entries owned solely by the
+ * `openrouter` provider, so the resolver's catalog-implied-provider stamping
+ * resolved every provider-less fragment carrying them to OpenRouter. A
+ * fragment is therefore repaired when its `provider` is `"openrouter"` or
+ * absent; an explicit non-OpenRouter provider (e.g. an `openai-compatible`
+ * endpoint serving a model by the same name) is left untouched.
+ */
+export const repairStaleOpenrouterGrokModelIdsMigration: WorkspaceMigration = {
+  id: "128-repair-stale-openrouter-grok-model-ids",
+  description:
+    "Repair stale OpenRouter x-ai/grok-4.20-beta and x-ai/grok-4 model IDs in workspace LLM config",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default)) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed = repairFragment(readObject(rawConfig)) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile)) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the stale model IDs would break OpenRouter
+    // calls.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers — self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const REPLACEMENTS: Record<string, string> = {
+  "x-ai/grok-4.20-beta": "x-ai/grok-4.20",
+  "x-ai/grok-4": "x-ai/grok-4.5",
+};
+
+function repairFragment(fragment: Record<string, unknown> | null): boolean {
+  if (fragment === null) {
+    return false;
+  }
+  if (typeof fragment.model !== "string") {
+    return false;
+  }
+  const replacement = REPLACEMENTS[fragment.model];
+  if (replacement === undefined) {
+    return false;
+  }
+  if (fragment.provider !== undefined && fragment.provider !== "openrouter") {
+    return false;
+  }
+  fragment.model = replacement;
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}