@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/usage/attribution.ts

@@ -1,6 +1,4 @@
-import { getEffectiveProfiles } from "../config/default-profile-catalog.js";
 import {
-  isOverrideOrDefaultResolutionEnabled,
   resolveCallSiteConfig,
   selectWinningProfile,
 } from "../config/llm-resolver.js";
@@ -87,11 +85,17 @@ export function toAttributionColumns(
  * values are capped so later forwarding cannot create unbounded headers.
  */
 export function sanitizeUsageMetadataValue(value: unknown): string | null {
-  if (typeof value !== "string") return null;
+  if (typeof value !== "string") {
+    return null;
+  }
 
   const trimmed = value.trim();
-  if (trimmed.length === 0) return null;
-  if (containsControlCharacter(trimmed)) return null;
+  if (trimmed.length === 0) {
+    return null;
+  }
+  if (containsControlCharacter(trimmed)) {
+    return null;
+  }
 
   return safeStringSlice(trimmed, 0, MAX_METADATA_VALUE_LENGTH);
 }
@@ -140,19 +144,15 @@ export function resolveUsageAttribution(
   const callSiteProfile = normalizeProfileId(
     llm.callSites?.[callSite]?.profile,
   );
-  // Under override-or-default semantics the resolver's own winner selection
-  // is the single source of truth for which profile applied — attribution
-  // must never re-derive precedence and drift from dispatch.
-  const profile = isOverrideOrDefaultResolutionEnabled()
-    ? appliedProfileFromWinnerSelection(callSite, llm, overrideProfile, input)
-    : resolveAppliedProfile({
-        callSite,
-        profiles: getEffectiveProfiles(llm.profiles),
-        activeProfile,
-        overrideProfile,
-        forceOverrideProfile: input.forceOverrideProfile === true,
-        callSiteProfile,
-      });
+  // The resolver's own winner selection is the single source of truth for which
+  // profile applied — attribution must never re-derive precedence and drift
+  // from dispatch.
+  const profile = appliedProfileFromWinnerSelection(
+    callSite,
+    llm,
+    overrideProfile,
+    input,
+  );
 
   return {
     callSite,
@@ -194,100 +194,6 @@ function appliedProfileFromWinnerSelection(
   };
 }
 
-function resolveAppliedProfile(input: {
-  callSite: LLMCallSite;
-  profiles: Record<string, unknown>;
-  activeProfile: string | null;
-  overrideProfile: string | null;
-  forceOverrideProfile: boolean;
-  callSiteProfile: string | null;
-}): Pick<UsageAttributionSnapshot, "appliedProfile" | "profileSource"> {
-  if (input.callSite === "mainAgent") {
-    if (
-      input.overrideProfile != null &&
-      input.profiles[input.overrideProfile] != null
-    ) {
-      return {
-        appliedProfile: input.overrideProfile,
-        profileSource: "conversation",
-      };
-    }
-
-    if (
-      input.activeProfile != null &&
-      input.profiles[input.activeProfile] != null
-    ) {
-      return {
-        appliedProfile: input.activeProfile,
-        profileSource: "active",
-      };
-    }
-
-    if (
-      input.callSiteProfile != null &&
-      input.profiles[input.callSiteProfile] != null
-    ) {
-      return {
-        appliedProfile: input.callSiteProfile,
-        profileSource: "call_site",
-      };
-    }
-
-    return {
-      appliedProfile: null,
-      profileSource: "default",
-    };
-  }
-
-  // Forced override floats above the call-site profile (the resolver's
-  // `forceOverrideProfile` escape hatch), so it wins attribution too.
-  if (
-    input.forceOverrideProfile &&
-    input.overrideProfile != null &&
-    input.profiles[input.overrideProfile] != null
-  ) {
-    return {
-      appliedProfile: input.overrideProfile,
-      profileSource: "conversation",
-    };
-  }
-
-  if (
-    input.callSiteProfile != null &&
-    input.profiles[input.callSiteProfile] != null
-  ) {
-    return {
-      appliedProfile: input.callSiteProfile,
-      profileSource: "call_site",
-    };
-  }
-
-  if (
-    input.overrideProfile != null &&
-    input.profiles[input.overrideProfile] != null
-  ) {
-    return {
-      appliedProfile: input.overrideProfile,
-      profileSource: "conversation",
-    };
-  }
-
-  if (
-    input.activeProfile != null &&
-    input.profiles[input.activeProfile] != null
-  ) {
-    return {
-      appliedProfile: input.activeProfile,
-      profileSource: "active",
-    };
-  }
-
-  return {
-    appliedProfile: null,
-    profileSource: "default",
-  };
-}
-
 function normalizeProfileId(value: string | null | undefined): string | null {
   return value ?? null;
 }

package/src/{config/bundled-skills/messaging/tools/gmail-mime-helpers.ts → util/mime-type.ts}

@@ -1,5 +1,8 @@
 /**
- * Shared MIME type guessing for Gmail attachment support.
+ * Best-effort MIME type inference from a file path's extension.
+ *
+ * Used to label outbound attachments (Gmail/Outlook multipart parts, native
+ * email attachments) when the source is a local file with no declared type.
  */
 
 import { extname } from "node:path";

package/src/util/provider-error-patterns.ts

@@ -14,8 +14,14 @@ export const VISION_NOT_SUPPORTED_PATTERNS = [
   /multi-?modal.*not.*support/i,
 ];
 
-// Vendor-neutral (OpenRouter/Anthropic-style) credit-exhaustion prose.
+// Vendor-neutral (OpenRouter/Anthropic-style) credit-exhaustion prose. Also
+// covers per-key spend caps: OpenRouter returns 403 "Key limit exceeded" when a
+// key's configured credit limit is reached — a billing/budget condition that
+// routes to the billing classification alongside other credit exhaustion. The
+// phrase is anchored on the contiguous "key limit" so it cannot swallow
+// rate-limit prose ("rate limit exceeded") or generic invalid-key text.
 export const INSUFFICIENT_CREDITS_PATTERNS = [
   /credit balance is too low/i,
   /insufficient.*credits?/i,
+  /key limit (?:has been )?(?:exceeded|reached)/i,
 ];

package/src/util/worker-process.ts

@@ -273,3 +273,108 @@ export function stopWorkerProcess(pidPath: string): WorkerProcessStatus {
   }
   return current;
 }
+
+// ---------------------------------------------------------------------------
+// Liveness supervisor
+// ---------------------------------------------------------------------------
+
+/**
+ * A liveness supervisor that probes a worker process and respawns it when it
+ * has died, subject to exponential backoff and a suppression hook. Detects
+ * process *death* (via the PID-file probe) — not a worker that is alive but
+ * wedged.
+ */
+export interface WorkerSupervisor {
+  /** Probe liveness; respawn if dead (subject to backoff/suppression). Never throws. */
+  ensureAlive(now?: number): Promise<void>;
+  /**
+   * Stop supervising: no further respawns, and a respawn already in flight is
+   * killed via {@link WorkerSupervisorOptions.killChild} when it resolves.
+   */
+  dispose(): void;
+}
+
+export interface WorkerSupervisorOptions {
+  label: string;
+  probe: () => WorkerProcessStatus;
+  respawn: () => Promise<{ pid: number; alreadyRunning: boolean }>;
+  /**
+   * Kill a child respawned after {@link WorkerSupervisor.dispose} was called
+   * (closes the shutdown race where a respawn was already in flight).
+   */
+  killChild?: (pid: number) => void;
+  /**
+   * When it returns true, `ensureAlive` skips respawning — e.g. an operator
+   * administratively stopped the worker and the watchdog must not undo that.
+   */
+  isSuppressed?: () => boolean;
+  /** Fired after a respawn actually started a new process (not `alreadyRunning`). */
+  onRespawn?: (pid: number) => void;
+  /** Fires once when consecutiveFailures first reaches the threshold. */
+  onPersistentFailure?: (consecutiveFailures: number, err: unknown) => void;
+  minBackoffMs?: number; // default 15_000 (one tick)
+  maxBackoffMs?: number; // default 300_000 (5 min)
+  persistentFailureThreshold?: number; // default 3
+}
+
+export function createWorkerSupervisor(
+  opts: WorkerSupervisorOptions,
+): WorkerSupervisor {
+  let consecutiveFailures = 0;
+  let nextAttemptAt = 0;
+  let inFlight = false;
+  let stopping = false;
+  const minBackoff = opts.minBackoffMs ?? 15_000;
+  const maxBackoff = opts.maxBackoffMs ?? 300_000;
+  const threshold = opts.persistentFailureThreshold ?? 3;
+
+  return {
+    async ensureAlive(now = Date.now()): Promise<void> {
+      if (stopping || inFlight) {
+        return;
+      }
+      // Operator stop wins over the watchdog — never respawn while suppressed.
+      if (opts.isSuppressed?.()) {
+        return;
+      }
+      if (opts.probe().status === "running") {
+        consecutiveFailures = 0;
+        nextAttemptAt = 0;
+        return;
+      }
+      if (now < nextAttemptAt) {
+        return; // in a backoff window after a failed respawn
+      }
+      inFlight = true;
+      try {
+        const { pid, alreadyRunning } = await opts.respawn();
+        consecutiveFailures = 0;
+        nextAttemptAt = 0;
+        if (stopping) {
+          // Disposed mid-respawn: kill the child we just created so it is not
+          // orphaned past shutdown.
+          opts.killChild?.(pid);
+          return;
+        }
+        if (!alreadyRunning) {
+          opts.onRespawn?.(pid);
+        }
+      } catch (err) {
+        consecutiveFailures += 1;
+        const backoff = Math.min(
+          maxBackoff,
+          minBackoff * 2 ** (consecutiveFailures - 1),
+        );
+        nextAttemptAt = now + backoff;
+        if (consecutiveFailures === threshold) {
+          opts.onPersistentFailure?.(consecutiveFailures, err);
+        }
+      } finally {
+        inFlight = false;
+      }
+    },
+    dispose(): void {
+      stopping = true;
+    },
+  };
+}

package/src/watcher/__tests__/telemetry.test.ts

@@ -9,11 +9,12 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { LifecycleEvent } from "../../persistence/lifecycle-events-store.js";
+import type { ConsentState } from "../../platform/consent-cache.js";
 
 const checkpoints = new Map<string, string>();
 const recordedEvents: string[] = [];
 let fakeEnabledWatchers: Array<{ providerId: string }> = [];
-let shareAnalytics = true;
+let shareAnalytics: ConsentState = true;
 const recordAndReturnEvent = (name: string): LifecycleEvent => {
   recordedEvents.push(name);
   return { id: "evt-1", eventName: name, createdAt: 0 };
@@ -32,7 +33,7 @@ mock.module("../../persistence/lifecycle-events-store.js", () => ({
 }));
 
 mock.module("../../platform/consent-cache.js", () => ({
-  getCachedShareAnalytics: () => shareAnalytics,
+  getRawShareAnalytics: () => shareAnalytics,
 }));
 
 mock.module("../watcher-store.js", () => ({
@@ -135,10 +136,10 @@ describe("recordWatcherInventoryIfDue", () => {
     expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 3));
   });
 
-  test("advances the checkpoint when consent is off", () => {
+  test("advances the checkpoint when consent is a confirmed opt-out", () => {
     fakeEnabledWatchers = [{ providerId: "gmail" }];
     shareAnalytics = false;
-    // Consent-off skip: the store records nothing and returns null.
+    // Confirmed-opt-out skip: the store records nothing and returns null.
     recordImpl = () => null;
 
     recordWatcherInventoryIfDue(BASE + 4);
@@ -146,6 +147,18 @@ describe("recordWatcherInventoryIfDue", () => {
     expect(recordedEvents).toEqual([]);
     expect(checkpoints.get(INVENTORY_KEY)).toBe(String(BASE + 4));
   });
+
+  test("leaves the checkpoint for retry when the store returns null while consent is unknown", () => {
+    fakeEnabledWatchers = [{ providerId: "gmail" }];
+    shareAnalytics = "unknown";
+    // Unknown consent never drops at record time, so a null here means the
+    // telemetry DB is unavailable — retry, don't skip a day.
+    recordImpl = () => null;
+
+    recordWatcherInventoryIfDue(BASE + 4);
+
+    expect(checkpoints.get(INVENTORY_KEY)).toBeUndefined();
+  });
 });
 
 describe("recordWatcherLlmProcessed", () => {

package/src/watcher/telemetry.ts

@@ -24,7 +24,7 @@ import {
   setMemoryCheckpoint,
 } from "../persistence/checkpoints.js";
 import { recordLifecycleEvent } from "../persistence/lifecycle-events-store.js";
-import { getCachedShareAnalytics } from "../platform/consent-cache.js";
+import { getRawShareAnalytics } from "../platform/consent-cache.js";
 import { getLogger } from "../util/logger.js";
 import { listWatchers } from "./watcher-store.js";
 
@@ -39,9 +39,9 @@ let warnedInventoryDbUnavailable = false;
  * Record one `watcher_enabled:<providerId>` lifecycle event per enabled
  * watcher, at most once per 24h. Called from every watcher tick; the
  * checkpoint advances only after the events are recorded, so a transient
- * storage failure (a throw, or a degraded-mode `null` while analytics
- * consent is granted) retries on the next tick instead of skipping a day.
- * A consent-off `null` is a deliberate skip and still advances. Retries
+ * storage failure (a throw, or a degraded-mode `null` while consent is not
+ * a confirmed opt-out) retries on the next tick instead of skipping a day.
+ * A confirmed-opt-out `null` is a deliberate skip and still advances. Retries
  * can duplicate events for watchers recorded before the failure point —
  * an acceptable overcount for best-effort telemetry, where losing a full
  * day's inventory would not be.
@@ -54,7 +54,7 @@ export function recordWatcherInventoryIfDue(now: number): void {
       const recorded = recordLifecycleEvent(
         `watcher_enabled:${watcher.providerId}`,
       );
-      if (recorded === null && getCachedShareAnalytics()) {
+      if (recorded === null && getRawShareAnalytics() !== false) {
         if (!warnedInventoryDbUnavailable) {
           warnedInventoryDbUnavailable = true;
           log.warn(

package/src/workspace/migrations/131-drop-web-fetch-mode.ts

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Strip the now-removed `services.web-fetch.mode` field from existing
+ * `config.json` files. Web fetch has no managed proxy, so the field never
+ * governed anything — provider is the only axis — and the schema no longer
+ * recognizes it.
+ *
+ * Purely tidying: the schema strips unknown keys, so a lingering `mode` is
+ * inert at runtime. This exists so upgraded configs on disk match the schema
+ * rather than carrying a dead key indefinitely.
+ *
+ * Idempotent: re-running when `mode` is already absent is a no-op.
+ */
+export const dropWebFetchModeMigration: WorkspaceMigration = {
+  id: "131-drop-web-fetch-mode",
+  description:
+    "Strip services.web-fetch.mode from config.json (mode field removed from schema)",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const services = config.services;
+    if (
+      services === null ||
+      typeof services !== "object" ||
+      Array.isArray(services)
+    )
+      return;
+
+    const webFetch = (services as Record<string, unknown>)["web-fetch"];
+    if (
+      webFetch === null ||
+      typeof webFetch !== "object" ||
+      Array.isArray(webFetch)
+    )
+      return;
+
+    const webFetchObj = webFetch as Record<string, unknown>;
+    if (!("mode" in webFetchObj)) return;
+
+    delete webFetchObj.mode;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only: re-adding mode would reintroduce a field the schema no
+    // longer recognizes.
+  },
+};

package/src/workspace/migrations/registry.ts

@@ -127,6 +127,7 @@ import { stripManagedProfileBodiesMigration } from "./126-strip-managed-profile-
 import { backfillDefaultProviderMigration } from "./127-backfill-default-provider.js";
 import { repairStaleOpenrouterGrokModelIdsMigration } from "./128-repair-stale-openrouter-grok-model-ids.js";
 import { removeAnalyzeConversationConfigMigration } from "./129-remove-analyze-conversation-config.js";
+import { dropWebFetchModeMigration } from "./131-drop-web-fetch-mode.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -265,4 +266,5 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   backfillDefaultProviderMigration,
   repairStaleOpenrouterGrokModelIdsMigration,
   removeAnalyzeConversationConfigMigration,
+  dropWebFetchModeMigration,
 ];

package/src/workspace/provider-commit-message-generator.ts

@@ -67,7 +67,9 @@ class ProviderCommitMessageGenerator {
   private isBreakerOpen(): boolean {
     const config = getConfig();
     const { openAfterFailures } = config.workspaceGit.commitMessageLLM.breaker;
-    if (this.consecutiveFailures < openAfterFailures) return false;
+    if (this.consecutiveFailures < openAfterFailures) {
+      return false;
+    }
     return Date.now() < this.nextAllowedAttemptMs;
   }
 
@@ -122,7 +124,7 @@ class ProviderCommitMessageGenerator {
 
     // Step 2: Resolve configured provider via the commit-message call site,
     // so model + maxTokens + temperature come from `llm.callSites.commitMessage`
-    // (with `llm.default` as the fallback). Operational fields (`enabled`,
+    // (with the shipped call-site default as the fallback). Operational fields (`enabled`,
     // `timeoutMs`, `breaker`, `maxFilesInPrompt`, `maxDiffBytes`,
     // `minRemainingTurnBudgetMs`) remain on `workspaceGit.commitMessageLLM`
     // and are read above. If nothing is resolvable, differentiate likely
@@ -241,8 +243,8 @@ class ProviderCommitMessageGenerator {
           signal: ac.signal,
           config: {
             // `callSite` lets the provider resolve model, max_tokens, and
-            // temperature from `llm.callSites.commitMessage` (with
-            // `llm.default` as the fallback). Operational fields
+            // temperature from `llm.callSites.commitMessage` (with the
+            // shipped call-site default as the fallback). Operational fields
             // (`enabled`, `timeoutMs`, `breaker`, `maxFilesInPrompt`,
             // `maxDiffBytes`, `minRemainingTurnBudgetMs`) remain on
             // `workspaceGit.commitMessageLLM` and are read above.

package/src/__tests__/app-open-proxy.test.ts

@@ -1,67 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-import type { ProxyResolver } from "../tools/apps/executors.js";
-import { openAppViaSurface } from "../tools/apps/open-proxy.js";
-
-describe("openAppViaSurface", () => {
-  test("returns proxy result content on success", async () => {
-    const resolver: ProxyResolver = async (_name, _input) => ({
-      content: "opened-surface-123",
-      isError: false,
-    });
-
-    const result = await openAppViaSurface("app-1", resolver);
-    expect(result).toBe("opened-surface-123");
-  });
-
-  test("passes app_id and extraInput to the resolver", async () => {
-    let capturedName: string | undefined;
-    let capturedInput: Record<string, unknown> | undefined;
-
-    const resolver: ProxyResolver = async (name, input) => {
-      capturedName = name;
-      capturedInput = input;
-      return { content: "ok", isError: false };
-    };
-
-    await openAppViaSurface("my-app", resolver, {
-      preview: { title: "Hello" },
-    });
-
-    expect(capturedName).toBe("app_open");
-    expect(capturedInput).toEqual({
-      app_id: "my-app",
-      preview: { title: "Hello" },
-    });
-  });
-
-  test("returns informational message when resolver is undefined", async () => {
-    const result = await openAppViaSurface("app-1", undefined);
-    expect(result).toBe(
-      "App created but could not be opened (no connected client). Use app_open to open it manually.",
-    );
-  });
-
-  test("returns fallback text when resolver throws", async () => {
-    const resolver: ProxyResolver = async () => {
-      throw new Error("connection lost");
-    };
-
-    const result = await openAppViaSurface("app-1", resolver);
-    expect(result).toBe(
-      "Failed to auto-open app. Use app_open to open it manually.",
-    );
-  });
-
-  test("omits extraInput fields when not provided", async () => {
-    let capturedInput: Record<string, unknown> | undefined;
-
-    const resolver: ProxyResolver = async (_name, input) => {
-      capturedInput = input;
-      return { content: "ok", isError: false };
-    };
-
-    await openAppViaSurface("app-2", resolver);
-    expect(capturedInput).toEqual({ app_id: "app-2" });
-  });
-});