@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/src/util/worker-compute.ts

@@ -0,0 +1,83 @@
+/**
+ * ONNX Runtime thread tuning for the local ML worker subprocesses (embed,
+ * rerank).
+ *
+ * ONNX Runtime sizes its intra-op thread pool from the machine's physical core
+ * count when nothing says otherwise. An unhinted worker therefore takes every
+ * core for the duration of an inference batch. On a developer laptop that pins
+ * the machine and spins the fans; in a container it oversubscribes a CPU quota
+ * the scheduler then throttles.
+ *
+ * The work is background indexing the user neither initiated nor can see, so
+ * it should not preempt foreground work. Capping the pool trades batch latency
+ * for leaving the rest of the system responsive, the same trade as spawning
+ * these workers with `--smol`.
+ *
+ * Unlike the memory hint in worker-memory.ts, this is a hard cap: ONNX will
+ * not exceed the configured thread count.
+ */
+
+import { getContainerCpuCores } from "./cgroup-cpu.js";
+
+/**
+ * Environment variable carrying the computed cap to the worker script. The
+ * worker is a standalone bun process that reads this and passes it to ONNX as
+ * `session_options.intraOpNumThreads`.
+ */
+export const ONNX_INTRA_OP_THREADS_ENV = "VELLUM_ONNX_INTRA_OP_THREADS";
+
+/**
+ * Fraction of available cores one ML worker's intra-op pool may use. The
+ * machine is shared with the daemon, the gateway, tool subprocesses, and
+ * (because embed and rerank are separate processes) potentially a second ML
+ * worker, so one of them gets a quarter.
+ */
+const WORKER_CPU_FRACTION = 0.25;
+
+/**
+ * Lower clamp. ONNX treats a non-positive thread count as "pick for me", which
+ * is the unbounded default this module exists to prevent, so the floor is 1.
+ */
+export const WORKER_MIN_INTRA_OP_THREADS = 1;
+
+/**
+ * Upper clamp. Intra-op scaling for models this size flattens well before this
+ * point; past it, extra threads add synchronization overhead and heat without
+ * shortening the batch.
+ */
+export const WORKER_MAX_INTRA_OP_THREADS = 4;
+
+/**
+ * Intra-op thread cap for an ML worker, derived from the container CPU limit
+ * (the visible core count when no container limit applies, e.g. local dev),
+ * clamped to [{@link WORKER_MIN_INTRA_OP_THREADS}, {@link WORKER_MAX_INTRA_OP_THREADS}].
+ *
+ * A zero or negative core count means detection failed entirely; fall back to
+ * the floor rather than handing ONNX a value it would read as "unbounded".
+ */
+export function computeWorkerIntraOpThreads(cores: number): number {
+  if (!Number.isFinite(cores) || cores <= 0) {
+    return WORKER_MIN_INTRA_OP_THREADS;
+  }
+  const target = Math.floor(cores * WORKER_CPU_FRACTION);
+  return Math.min(
+    WORKER_MAX_INTRA_OP_THREADS,
+    Math.max(WORKER_MIN_INTRA_OP_THREADS, target),
+  );
+}
+
+/**
+ * Environment additions for spawning an ONNX worker: the intra-op thread cap.
+ * An operator-provided value in the parent environment wins over the computed
+ * one, matching how `workerMemoryEnv` treats `BUN_JSC_forceRAMSize`.
+ *
+ * Returns only the compute keys, so spread this over `workerMemoryEnv()`,
+ * which carries the full parent environment.
+ */
+export function workerComputeEnv(): Record<string, string> {
+  return {
+    [ONNX_INTRA_OP_THREADS_ENV]:
+      process.env[ONNX_INTRA_OP_THREADS_ENV] ??
+      String(computeWorkerIntraOpThreads(getContainerCpuCores())),
+  };
+}

package/src/workspace/byok-default-profile-ensure.ts

@@ -7,10 +7,7 @@ import {
   resolveDefaultProfileForProvider,
   USER_PROFILE_TEMPLATES,
 } from "../config/default-profile-catalog.js";
-import {
-  DEFAULT_PROFILE_KEYS,
-  type DefaultProfileKey,
-} from "../config/default-profile-names.js";
+import type { DefaultProfileKey } from "../config/default-profile-names.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import { invalidateConfigCache } from "../config/loader.js";
 import {
@@ -65,6 +62,19 @@ const log = getLogger("byok-default-profile-ensure");
 // Idempotent and write-avoidant: the file is rewritten only when at least one
 // stub or copy was removed.
 
+/**
+ * The default keys BYOK hatching writes to disk. `latency-optimized` is absent
+ * by construction: no install carries a hatch stub or a
+ * `custom-latency-optimized` copy for it, and listing it here would make
+ * `uniformCopyProvider` demand a copy that cannot exist and convert nothing.
+ */
+const HATCH_ERA_PROFILE_KEYS = [
+  "balanced",
+  "quality-optimized",
+  "cost-optimized",
+] as const satisfies readonly DefaultProfileKey[];
+type HatchEraProfileKey = (typeof HATCH_ERA_PROFILE_KEYS)[number];
+
 /**
  * The exact stub shapes BYOK hatching left on each default key: thin (only
  * the workspace-owned overlay fields), `source: "managed"`, the frozen
@@ -82,7 +92,7 @@ const log = getLogger("byok-default-profile-ensure");
  * alone.
  */
 const STUB_ONLY_KEYS = new Set(["source", "status", "label", "thinking"]);
-const HATCH_STUB_LABELS: Record<DefaultProfileKey, string> = {
+const HATCH_STUB_LABELS: Record<HatchEraProfileKey, string> = {
   balanced: "Balanced (Managed)",
   "quality-optimized": "Quality (Managed)",
   "cost-optimized": "Speed (Managed)",
@@ -100,7 +110,7 @@ const HATCH_STUB_LABELS: Record<DefaultProfileKey, string> = {
 const REPAIR_WRITTEN_THINKING = { enabled: true, streamThinking: true };
 
 function isHatchStub(
-  key: DefaultProfileKey,
+  key: HatchEraProfileKey,
   entry: Record<string, unknown>,
 ): boolean {
   return (
@@ -142,7 +152,7 @@ const IGNORED_COMPARISON_KEYS = new Set(["label", "status", "model"]);
  * field still matches the template.
  */
 const HISTORICAL_INTENT_MODELS: Record<
-  DefaultProfileKey,
+  HatchEraProfileKey,
   Partial<Record<string, readonly string[]>>
 > = {
   balanced: {
@@ -231,7 +241,7 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
 
   // Deleting a hatch stub makes the default key resolve active from the
   // default provider's catalog column (and drops the stub's suffixed label).
-  for (const key of DEFAULT_PROFILE_KEYS) {
+  for (const key of HATCH_ERA_PROFILE_KEYS) {
     const entry = readObject(profiles[key]);
     if (entry === null || !isHatchStub(key, entry)) {
       continue;
@@ -260,8 +270,8 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
       : null;
 
   const retired = new Map<string, string>();
-  const carriedDisables = new Set<DefaultProfileKey>();
-  for (const key of DEFAULT_PROFILE_KEYS) {
+  const carriedDisables = new Set<HatchEraProfileKey>();
+  for (const key of HATCH_ERA_PROFILE_KEYS) {
     const name = `custom-${key}`;
     const entry = readObject(profiles[name]);
     if (
@@ -318,7 +328,7 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
 
 function isKnownUneditedBody(
   entry: Record<string, unknown>,
-  key: DefaultProfileKey,
+  key: HatchEraProfileKey,
   convertibleProvider: LLMProvider | null,
   completionBase: LLMConfigBase | undefined,
 ): boolean {
@@ -374,7 +384,7 @@ function isKnownUneditedBody(
  */
 function uniformCopyProvider(profiles: Record<string, unknown>): string | null {
   let provider: string | null = null;
-  for (const key of DEFAULT_PROFILE_KEYS) {
+  for (const key of HATCH_ERA_PROFILE_KEYS) {
     const entry = readObject(profiles[`custom-${key}`]);
     if (entry === null) {
       return null;
@@ -415,7 +425,7 @@ function uniformCopyProvider(profiles: Record<string, unknown>): string | null {
  */
 function hatchBodyVariants(
   known: Record<string, unknown>,
-  key: DefaultProfileKey,
+  key: HatchEraProfileKey,
   copyProvider: string,
 ): Record<string, unknown>[] {
   let variants = [known];
@@ -460,7 +470,7 @@ function withCompletionBaked(
  */
 function userOverlayState(
   entry: Record<string, unknown>,
-  key: DefaultProfileKey,
+  key: HatchEraProfileKey,
 ): Record<string, unknown> | null {
   const overlay: Record<string, unknown> = {};
   const templateLabel = USER_PROFILE_TEMPLATES[`custom-${key}`]?.label;
@@ -566,7 +576,7 @@ function repairProfileSelections(
   llm: Record<string, unknown>,
   profiles: Record<string, unknown>,
   defaultProvider: DefaultProviderConfig,
-  carriedDisables: ReadonlySet<DefaultProfileKey>,
+  carriedDisables: ReadonlySet<HatchEraProfileKey>,
 ): void {
   const effectiveEntry = (name: string): ProfileEntry | undefined =>
     resolveDefaultProfileForProvider(

package/src/workspace/git-service.ts

@@ -915,6 +915,15 @@ export class WorkspaceGitService {
     );
   }
 
+  /**
+   * Whether background history compaction is enabled for this workspace.
+   * Gates only the scheduler — {@link compactHistoryNow} stays callable so
+   * operators can compact manually while automatic runs are off.
+   */
+  private isHistoryCompactionEnabled(): boolean {
+    return getConfig().workspaceGit?.historyCompaction?.enabled ?? true;
+  }
+
   /**
    * Working-tree size check for a repo-relative path. Uses lstat so a
    * symlink is measured by the link itself, not its target. Missing or
@@ -1003,10 +1012,21 @@ export class WorkspaceGitService {
    * history is still within retention, the attempt reschedules itself for
    * when the oldest commit ages past the cutoff. Best-effort like the
    * untrack sweeps: failures are logged and never affect commits.
+   *
+   * Gated by workspaceGit.historyCompaction.enabled, checked both here and
+   * when the timer fires (config hot-reloads, so a pending timer must honor
+   * a flip to disabled).
    */
   private scheduleHistoryCompaction(
     delayMs = HISTORY_COMPACTION_INITIAL_DELAY_MS,
   ): void {
+    if (!this.isHistoryCompactionEnabled()) {
+      log.debug(
+        { workspaceDir: this.workspaceDir },
+        "Background history compaction disabled by config; not scheduling",
+      );
+      return;
+    }
     const dueAtMs = Date.now() + delayMs;
     if (this.historyCompactionTimer) {
       if (dueAtMs >= this.historyCompactionDueAtMs) {
@@ -1020,6 +1040,14 @@ export class WorkspaceGitService {
     }
     const timer = setTimeout(() => {
       void (async () => {
+        if (!this.isHistoryCompactionEnabled()) {
+          log.debug(
+            { workspaceDir: this.workspaceDir },
+            "Background history compaction disabled by config; skipping scheduled run",
+          );
+          this.historyCompactionTimer = null;
+          return;
+        }
         let retryAfterMs: number | undefined;
         try {
           const result = await this.compactHistoryNow();
@@ -1044,14 +1072,19 @@ export class WorkspaceGitService {
 
   /**
    * Rewrite workspace history so blobs over workspaceGit.maxFileSizeBytes
-   * stop occupying .git. Commits older than HISTORY_RETENTION_DAYS are
+   * stop occupying .git. Commits older than the retention window
+   * (HISTORY_RETENTION_DAYS unless `retentionDays` overrides it) are
    * squashed into a single base commit whose tree is scrubbed of oversized
    * entries; younger commits are replayed verbatim (trees, messages,
    * authors, and dates preserved); reflogs are then expired and unreachable
-   * objects pruned. Runs only when the object store contains an oversized
-   * blob that is actionable — unreachable, or reachable at a non-exempt
-   * path (see SIZE_GUARD_EXEMPT_PATTERNS) — so the steady state is a cheap
-   * detection scan and exempt canonical state never triggers rewrites.
+   * objects pruned. By default runs only when the object store contains an
+   * oversized blob that is actionable — unreachable, or reachable at a
+   * non-exempt path (see SIZE_GUARD_EXEMPT_PATTERNS) — so the steady state
+   * is a cheap detection scan and exempt canonical state never triggers
+   * rewrites. With `force`, the squash runs unconditionally whenever any
+   * commit is older than the cutoff — the manual path for reclaiming bulk
+   * history (including old versions of exempt canonical state referenced
+   * only by squashed commits).
    *
    * Oversized blobs still referenced by replayed recent commits survive
    * until those commits age past retention — the result carries
@@ -1061,7 +1094,12 @@ export class WorkspaceGitService {
    * Git notes attached to rewritten commits are orphaned; enrichment only
    * targets commits created after the rewrite, so this is cosmetic.
    */
-  async compactHistoryNow(): Promise<{
+  async compactHistoryNow(options?: {
+    /** Squash aged history even when no oversized blob is actionable. */
+    force?: boolean;
+    /** Retention window override in days for this run. */
+    retentionDays?: number;
+  }): Promise<{
     rewrote: boolean;
     squashedCommits: number;
     keptCommits: number;
@@ -1069,7 +1107,7 @@ export class WorkspaceGitService {
     retryAfterMs?: number;
   }> {
     await this.ensureInitialized();
-    return this.mutex.withLock(() => this.compactHistoryLocked());
+    return this.mutex.withLock(() => this.compactHistoryLocked(options));
   }
 
   /**
@@ -1180,7 +1218,10 @@ export class WorkspaceGitService {
     return remaining.size > 0 ? "prunable" : "none";
   }
 
-  private async compactHistoryLocked(): Promise<{
+  private async compactHistoryLocked(options?: {
+    force?: boolean;
+    retentionDays?: number;
+  }): Promise<{
     rewrote: boolean;
     squashedCommits: number;
     keptCommits: number;
@@ -1188,11 +1229,13 @@ export class WorkspaceGitService {
   }> {
     const noop = { rewrote: false, squashedCommits: 0, keptCommits: 0 };
     const limit = this.maxFileSizeBytes();
+    const force = options?.force === true;
+    const retentionDays = options?.retentionDays ?? HISTORY_RETENTION_DAYS;
 
     // Any oversized blobs at all? Bounds the cost of every boot where there
-    // is nothing to do.
+    // is nothing to do. Forced runs squash regardless.
     const oversizedOids = await this.collectOversizedBlobOidsLocked(limit);
-    if (oversizedOids.size === 0) {
+    if (oversizedOids.size === 0 && !force) {
       return noop;
     }
 
@@ -1236,31 +1279,39 @@ export class WorkspaceGitService {
       return noop;
     }
 
-    const verdict = await this.classifyOversizedBlobsLocked(oversizedOids);
-    if (verdict === "none") {
-      // Exempt canonical state or ref-retained only — nothing to reclaim.
-      return { ...noop, keptCommits: commits.length };
-    }
-    if (verdict === "prunable") {
-      // Only unreachable blobs (e.g. an external add that stageAllLocked
-      // reset) — prune reclaims them without rewriting any history.
-      await this.expireReflogsAndPruneLocked();
-      log.info(
-        { workspaceDir: this.workspaceDir },
-        "Pruned unreachable oversized blobs from workspace git",
-      );
-      return { ...noop, keptCommits: commits.length };
+    // Forced runs skip classification: they squash whenever aged history
+    // exists, so the reachable/exempt distinction does not short-circuit.
+    if (!force) {
+      const verdict = await this.classifyOversizedBlobsLocked(oversizedOids);
+      if (verdict === "none") {
+        // Exempt canonical state or ref-retained only — nothing to reclaim.
+        return { ...noop, keptCommits: commits.length };
+      }
+      if (verdict === "prunable") {
+        // Only unreachable blobs (e.g. an external add that stageAllLocked
+        // reset) — prune reclaims them without rewriting any history.
+        await this.expireReflogsAndPruneLocked();
+        log.info(
+          { workspaceDir: this.workspaceDir },
+          "Pruned unreachable oversized blobs from workspace git",
+        );
+        return { ...noop, keptCommits: commits.length };
+      }
     }
 
     // Squash a PREFIX of the chain so replay order stays consistent even if
     // commit timestamps are not monotonic.
-    const cutoffSec =
-      Math.floor(Date.now() / 1000) - HISTORY_RETENTION_DAYS * 86400;
+    const cutoffSec = Math.floor(Date.now() / 1000) - retentionDays * 86400;
     let splitIdx = commits.findIndex((c) => c.committedAtSec >= cutoffSec);
     if (splitIdx === -1) {
       splitIdx = commits.length;
     }
     if (splitIdx === 0) {
+      if (oversizedOids.size === 0) {
+        // Forced run, but every commit is inside retention and there is
+        // nothing to reclaim — no rewrite.
+        return { ...noop, keptCommits: commits.length };
+      }
       // Main holds the blobs, but only in commits still within retention.
       // A mixed case can also carry unreachable blobs — prune those now,
       // and re-check in case they were all that remained actionable.
@@ -1279,7 +1330,7 @@ export class WorkspaceGitService {
       // bloat until restart.
       const oldestCommittedAtSec = commits[0]?.committedAtSec ?? cutoffSec;
       const oldestAgesOutMs =
-        (oldestCommittedAtSec + HISTORY_RETENTION_DAYS * 86400) * 1000 -
+        (oldestCommittedAtSec + retentionDays * 86400) * 1000 -
         Date.now() +
         60_000;
       const retryAfterMs = Math.max(
@@ -1358,9 +1409,7 @@ export class WorkspaceGitService {
       const oldestKeptSec =
         kept[0]?.committedAtSec ?? Math.floor(Date.now() / 1000);
       retryAfterMs = Math.max(
-        (oldestKeptSec + HISTORY_RETENTION_DAYS * 86400) * 1000 -
-          Date.now() +
-          60_000,
+        (oldestKeptSec + retentionDays * 86400) * 1000 - Date.now() + 60_000,
         HISTORY_COMPACTION_MIN_RETRY_MS,
       );
     }

package/src/workspace/migrations/137-repair-retired-fireworks-minimax-model-id.ts

@@ -0,0 +1,131 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair the retired Fireworks MiniMax M2.5 model ID in workspace LLM config.
+ *
+ * Fireworks no longer serves `accounts/fireworks/models/minimax-m2p5`, so
+ * chat/completions calls fail with a 404 "Model not found, inaccessible,
+ * and/or not deployed". The ID was never an intent default — it was only
+ * reachable by picking it — but a config that picked it still pins it in
+ * `llm.default`, `llm.callSites.*`, and `llm.profiles.*`.
+ *
+ * Repair those leaves only on an exact match, replacing with
+ * `accounts/fireworks/models/minimax-m2p7`: the nearest live MiniMax entry
+ * (same 196K window, same 25K output cap, same per-token pricing), so the
+ * repaired pin keeps the model family the user chose. Deliberately not
+ * `minimax-m3`, which is the current Fireworks balanced-intent model —
+ * rewriting a hand-edited `custom-*` profile onto the template's model
+ * would make it read as unedited to `ensureByokDefaultProfiles`.
+ *
+ * Provider guard: the retired ID belongs to the `fireworks` provider and
+ * also appears in managed profiles stamped `provider: "vellum"` (which
+ * route Fireworks-account model IDs through the managed proxy). A fragment
+ * is repaired when its `provider` is `"fireworks"`, `"vellum"`, or absent;
+ * an explicit other provider (e.g. an `openai-compatible` endpoint serving
+ * a model by the same name) is left untouched.
+ */
+export const repairRetiredFireworksMinimaxModelIdMigration: WorkspaceMigration =
+  {
+    id: "137-repair-retired-fireworks-minimax-model-id",
+    description:
+      "Repair retired Fireworks accounts/fireworks/models/minimax-m2p5 model ID in workspace LLM config",
+    run(workspaceDir: string): void {
+      const configPath = join(workspaceDir, "config.json");
+      if (!existsSync(configPath)) {
+        return;
+      }
+
+      // Read outside the parse catch: a transient filesystem error (EIO,
+      // EACCES) must reach the runner so the migration retries, while
+      // malformed JSON is a permanent state this migration cannot repair.
+      const rawText = readFileSync(configPath, "utf-8");
+
+      let config: Record<string, unknown>;
+      try {
+        const raw = JSON.parse(rawText);
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+          return;
+        }
+        config = raw as Record<string, unknown>;
+      } catch {
+        return;
+      }
+
+      const llm = readObject(config.llm);
+      if (llm === null) {
+        return;
+      }
+
+      let changed = false;
+
+      changed = repairFragment(readObject(llm.default)) || changed;
+
+      const callSites = readObject(llm.callSites);
+      if (callSites !== null) {
+        for (const rawConfig of Object.values(callSites)) {
+          changed = repairFragment(readObject(rawConfig)) || changed;
+        }
+      }
+
+      const profiles = readObject(llm.profiles);
+      if (profiles !== null) {
+        for (const rawProfile of Object.values(profiles)) {
+          changed = repairFragment(readObject(rawProfile)) || changed;
+        }
+      }
+
+      if (!changed) {
+        return;
+      }
+
+      // Write-then-rename so an interrupted write cannot leave config.json
+      // truncated: a torn in-place write would parse as invalid JSON on the
+      // retry, which the catch above treats as "nothing to do", letting the
+      // runner checkpoint the migration as completed against a corrupt file.
+      const tmpPath = `${configPath}.migration-137.tmp`;
+      writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+      renameSync(tmpPath, configPath);
+    },
+    // The exact-match rewrite is idempotent, so a transient failure (full
+    // disk, I/O error) is safe to retry on later startups.
+    retryFailedCheckpoint: true,
+    down(_workspaceDir: string): void {
+      // Forward-only: reintroducing the retired model ID would break
+      // Fireworks calls.
+    },
+  };
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const RETIRED_MODEL_ID = "accounts/fireworks/models/minimax-m2p5";
+const REPLACEMENT_MODEL_ID = "accounts/fireworks/models/minimax-m2p7";
+const REPAIRABLE_PROVIDERS = new Set(["fireworks", "vellum"]);
+
+function repairFragment(fragment: Record<string, unknown> | null): boolean {
+  if (fragment === null) {
+    return false;
+  }
+  if (fragment.model !== RETIRED_MODEL_ID) {
+    return false;
+  }
+  if (
+    fragment.provider !== undefined &&
+    !REPAIRABLE_PROVIDERS.has(fragment.provider as string)
+  ) {
+    return false;
+  }
+  fragment.model = REPLACEMENT_MODEL_ID;
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}