@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/util/image-conversion.ts

@@ -13,7 +13,6 @@
  * conversions of the same image (or daemon restarts) skip the sips call.
  */
 
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   closeSync,
@@ -101,10 +100,10 @@ export interface ConvertToJpegOptions {
   quality?: number;
 }
 
-function runSips(
+async function runSips(
   inputBytes: Uint8Array,
   options: ConvertToJpegOptions,
-): Buffer | null {
+): Promise<Buffer | null> {
   const stamp = `${Date.now()}-${uuid().slice(0, 8)}`;
   const srcPath = join(tmpdir(), `vellum-img-opt-${stamp}-src`);
   const outPath = join(tmpdir(), `vellum-img-opt-${stamp}-out.jpg`);
@@ -133,7 +132,15 @@ function runSips(
       "--out",
       outPath,
     );
-    execFileSync("sips", args, { stdio: "pipe", timeout: 15_000 });
+    const proc = Bun.spawn(["sips", ...args], {
+      stdout: "ignore",
+      stderr: "ignore",
+      timeout: 15_000,
+    });
+    await proc.exited;
+    if (proc.exitCode !== 0) {
+      return null;
+    }
     return readFileSync(outPath) as Buffer;
   } catch {
     return null;
@@ -155,10 +162,10 @@ function runSips(
  * Convert an image to JPEG, optionally downscaling. Returns null when
  * conversion is unavailable (non-macOS) or fails; callers keep the original.
  */
-export function convertImageToJpeg(
+export async function convertImageToJpeg(
   bytes: Uint8Array,
   options: ConvertToJpegOptions = {},
-): Buffer | null {
+): Promise<Buffer | null> {
   const hash = createHash("sha256").update(bytes).digest("hex").slice(0, 16);
   // Options qualify the key so full-resolution storage conversions and
   // resized transport conversions of the same source never collide.
@@ -173,7 +180,7 @@ export function convertImageToJpeg(
     return cached;
   }
 
-  const converted = runSips(bytes, options);
+  const converted = await runSips(bytes, options);
   if (!converted) {
     return null;
   }
@@ -346,12 +353,12 @@ export interface NormalizedImageBytes {
  * {@link jpegFilenameFor} when `converted` is true — a MIME-only correction
  * sets `converted: false` and keeps the filename.
  */
-export function normalizeImageBytes(
+export async function normalizeImageBytes(
   mimeType: string,
   bytes: Uint8Array,
-): NormalizedImageBytes {
+): Promise<NormalizedImageBytes> {
   if (isHeifImage(bytes)) {
-    const converted = convertImageToJpeg(bytes, {
+    const converted = await convertImageToJpeg(bytes, {
       quality: STORAGE_JPEG_QUALITY,
     });
     if (!converted) {
@@ -376,14 +383,14 @@ export interface NormalizedImageBase64 {
  * Base64 variant of {@link normalizeImageBytes}. Sniffs the decoded head
  * first so non-HEIF payloads skip the full decode.
  */
-export function normalizeImageBase64(
+export async function normalizeImageBase64(
   mimeType: string,
   dataBase64: string,
-): NormalizedImageBase64 {
+): Promise<NormalizedImageBase64> {
   // 16 base64 chars decode to the 12 bytes the ftyp/signature sniffs need.
   const head = Buffer.from(dataBase64.slice(0, 16), "base64");
   if (isHeifImage(head)) {
-    const normalized = normalizeImageBytes(
+    const normalized = await normalizeImageBytes(
       mimeType,
       Buffer.from(dataBase64, "base64"),
     );

package/src/util/schedule-source-key.ts

@@ -0,0 +1,23 @@
+/**
+ * Plugin-declared schedules record their provenance in the `source_key`
+ * column as `plugin:<pluginName>/<scheduleName>`. The format is minted by
+ * `pluginScheduleSourceKey` in schedule/plugin-schedule-declarations.ts;
+ * this leaf parser lets display surfaces (CLI tables, tool output) derive
+ * the owning plugin without importing the daemon's schedule modules.
+ */
+
+const PLUGIN_SOURCE_KEY_RE = /^plugin:([^/]+)\//;
+
+/**
+ * Display attribution for a schedule row: the owning plugin's name, the raw
+ * key when it does not match the format so provenance is never silently
+ * dropped, or null when the row is imperative.
+ */
+export function describeScheduleSource(
+  sourceKey: string | null | undefined,
+): string | null {
+  if (!sourceKey) {
+    return null;
+  }
+  return PLUGIN_SOURCE_KEY_RE.exec(sourceKey)?.[1] ?? sourceKey;
+}

package/src/util/worker-process.ts

@@ -17,6 +17,7 @@ import {
   unlinkSync,
 } from "node:fs";
 import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import { getCurrentLogFilePath } from "./logger.js";
 import { workerMemoryEnv } from "./worker-memory.js";
@@ -209,8 +210,13 @@ export async function spawnWorkerProcess(args: {
 
   // Workers are latency-insensitive, so run them in bun's small-heap mode
   // with a RAM-size hint sized to the container — see worker-memory.ts.
+  //
+  // `fileURLToPath`, not `.pathname`: a URL's pathname is percent-encoded, so
+  // an install path containing a space (every macOS desktop install lives
+  // under "Application Support") would reach bun as "Application%20Support"
+  // and the entry would not be found.
   const child = Bun.spawn({
-    cmd: ["bun", "--smol", "run", args.entry.pathname],
+    cmd: ["bun", "--smol", "run", fileURLToPath(args.entry)],
     env: workerMemoryEnv(),
     stdio: ["ignore", "ignore", stderrFd],
     detached,

package/src/workspace/git-service.ts

@@ -1,4 +1,4 @@
-import { execFile, spawn, spawnSync } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import {
   chmodSync,
   existsSync,
@@ -413,18 +413,19 @@ export class WorkspaceGitService {
    * open, we leave it alone. If no process holds it, it's stale (crashed
    * process) and safe to remove.
    */
-  private cleanStaleLockFile(): void {
+  private async cleanStaleLockFile(): Promise<void> {
     const lockPath = join(this.workspaceDir, ".git", "index.lock");
     if (!existsSync(lockPath)) {
       return;
     }
 
     try {
-      const result = spawnSync("lsof", ["-t", lockPath], {
+      // lsof exits non-zero when no process holds the file, which rejects the
+      // promise and falls through to removal below.
+      const { stdout } = await execFileAsync("lsof", ["-t", lockPath], {
         timeout: 3000,
-        stdio: ["ignore", "pipe", "ignore"],
       });
-      if (result.status === 0 && result.stdout?.length > 0) {
+      if (stdout.length > 0) {
         log.debug("index.lock held by an active process, skipping removal");
         return;
       }
@@ -490,7 +491,7 @@ export class WorkspaceGitService {
 
           // Clean up stale lock files before any git operations.
           if (existsSync(gitDir)) {
-            this.cleanStaleLockFile();
+            await this.cleanStaleLockFile();
           }
 
           if (existsSync(gitDir)) {
@@ -657,7 +658,7 @@ export class WorkspaceGitService {
     await this.ensureInitialized();
 
     await this.mutex.withLock(async () => {
-      this.cleanStaleLockFile();
+      await this.cleanStaleLockFile();
 
       // Stage all changes (minus oversized files)
       await this.stageAllLocked();
@@ -734,7 +735,7 @@ export class WorkspaceGitService {
 
     try {
       const result = await this.mutex.withLock(async () => {
-        this.cleanStaleLockFile();
+        await this.cleanStaleLockFile();
 
         // Re-check breaker under lock: a queued call that started before the
         // breaker opened should not proceed with expensive git work now that
@@ -1991,6 +1992,29 @@ export class WorkspaceGitService {
     return this.execGit(args);
   }
 
+  /**
+   * Run a read-only git command WITHOUT initializing the repository.
+   *
+   * `runReadOnlyGit` is read-only in the sense that its git command does not
+   * write, but it still awaits `ensureInitialized()`, which will create the
+   * repository, write `.gitignore` and the hooks directory, make the initial
+   * commit, and schedule a history compaction when the workspace is not yet a
+   * repo. That makes it unusable from an HTTP GET, which
+   * `src/runtime/AGENTS.md` requires to be side-effect-free.
+   *
+   * This variant skips initialization entirely and throws when the workspace
+   * is not a repository, so a caller that merely wants to *observe* history
+   * can degrade instead of bringing a repo into existence.
+   */
+  async runReadOnlyGitWithoutInit(
+    args: string[],
+  ): Promise<{ stdout: string; stderr: string }> {
+    if (!existsSync(join(this.workspaceDir, ".git"))) {
+      throw new Error("Workspace is not a git repository");
+    }
+    return this.execGit(args);
+  }
+
   /**
    * Run a sequence of git commands atomically under the workspace mutex.
    * Use this for write operations that need serialization with other
@@ -2003,7 +2027,7 @@ export class WorkspaceGitService {
   ): Promise<void> {
     await this.ensureInitialized();
     await this.mutex.withLock(async () => {
-      this.cleanStaleLockFile();
+      await this.cleanStaleLockFile();
       await fn((args) => {
         // Intercept commit commands to enforce hook hardening.
         if (args[0] === "commit") {

package/src/workspace/migrations/140-repair-seed-pinned-memory-v3-live.ts

@@ -0,0 +1,260 @@
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import type { MigrationRunContext, WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair assistants stuck on `memory.v3.live = false` by the first-launch
+ * seed race fixed in #39847: the seed used to persist the schema default
+ * (`false`) ~200ms before migration 105 ran, and 105's `"live" in v3Config`
+ * guard then bailed: a brand-new workspace that should have come up on
+ * memory-v3 ran v2 forever, with no signal to the user. 105 is checkpointed
+ * as applied and never re-runs, so nothing self-heals the stamped value.
+ *
+ * The same stamp lands on an EXISTING v3 assistant whose config.json is
+ * quarantined (corrupt JSON → renamed to `config.json.corrupt-<ts>.json`)
+ * and reseeded: the reseed silently demotes it to v2.
+ *
+ * Flips `live` to `true` only when the `false` on disk is attributable to
+ * the seed, never over a deliberate opt-out:
+ *
+ * - Quarantine carry-forward: the newest quarantined config next to
+ *   config.json says `live: true`, meaning the assistant WAS on v3 before the
+ *   reseed, so the current `false` is the seed's stamp.
+ * - Seed-race repair: the workspace was created during the migration-105 era
+ *   (105 completed in the first-boot sweep, i.e. at effectively the same
+ *   time as the workspace's earliest checkpoint), the archived hatch-time
+ *   overlay (`default-config.json`) records no `live: false` opt-out, AND
+ *   memory-v3 never ran (no `memory_v3_selections` rows in either database,
+ *   including the mid-drain `__relocating` staging name). A deliberate
+ *   opt-out on such a workspace requires flipping v3 off before its first
+ *   selection is logged; a workspace that DID run v3 and now reads `false`
+ *   is treated as an opt-out and left alone.
+ *
+ * Everything else is skipped: `live` absent means a pre-105 assistant on the
+ * deliberate manual-upgrade path (tier movement stays user-initiated), while
+ * new workspaces are migration 105's job, where a post-#39847 hatch-time
+ * `memory.v3.live=false` override merges after migrations and must win.
+ */
+
+const MIGRATION_105_ID = "105-enable-memory-v3-live-for-new-workspaces";
+
+/** How close migration 105's checkpoint must be to the workspace's earliest
+ *  checkpoint to count as "completed in the first-boot sweep". The sweep
+ *  itself takes seconds; the margin absorbs a crash-restart mid-sweep. */
+const FIRST_BOOT_SWEEP_TOLERANCE_MS = 60 * 60 * 1000;
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** `memory.v3.live` from a parsed config-shaped value, or undefined. */
+function readMemoryV3Live(config: unknown): unknown {
+  if (!isPlainObject(config)) {
+    return undefined;
+  }
+  const memory = config.memory;
+  if (!isPlainObject(memory)) {
+    return undefined;
+  }
+  const v3 = memory.v3;
+  if (!isPlainObject(v3)) {
+    return undefined;
+  }
+  return v3.live;
+}
+
+/**
+ * Whether the newest quarantined config (`config.json.corrupt-*.json`)
+ * carried `memory.v3.live: true`. Quarantine filenames embed a
+ * filesystem-safe ISO timestamp, so a lexicographic sort is chronological.
+ * A quarantined file is usually truncated JSON; every config writer
+ * serializes via `JSON.stringify(config, null, 2)` and `memory.v3.live` is
+ * the only config key named `"live"`, so when parsing fails a literal
+ * `"live": true` match is unambiguous.
+ */
+function quarantinedConfigSaidLiveTrue(workspaceDir: string): boolean {
+  try {
+    const entries = readdirSync(workspaceDir)
+      .filter(
+        (name) =>
+          name.startsWith("config.json.corrupt-") && name.endsWith(".json"),
+      )
+      .sort();
+    const newest = entries[entries.length - 1];
+    if (!newest) {
+      return false;
+    }
+    const raw = readFileSync(join(workspaceDir, newest), "utf-8");
+    try {
+      return readMemoryV3Live(JSON.parse(raw)) === true;
+    } catch {
+      return /"live"\s*:\s*true/.test(raw);
+    }
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether migration 105 completed in this workspace's first-boot sweep,
+ * i.e. the workspace was CREATED in the era where 105 should have flipped it
+ * to v3. On an older workspace 105 arrives in an upgrade sweep long after
+ * the earliest checkpoint, so the gap exceeds the tolerance.
+ */
+function wasCreatedInMigration105Era(workspaceDir: string): boolean {
+  try {
+    const raw = readFileSync(
+      join(workspaceDir, "data", ".workspace-migrations.json"),
+      "utf-8",
+    );
+    const parsed: unknown = JSON.parse(raw);
+    if (!isPlainObject(parsed) || !isPlainObject(parsed.applied)) {
+      return false;
+    }
+    let earliest = Number.POSITIVE_INFINITY;
+    let applied105 = Number.NaN;
+    for (const [id, entry] of Object.entries(parsed.applied)) {
+      if (!isPlainObject(entry) || typeof entry.appliedAt !== "string") {
+        continue;
+      }
+      const at = Date.parse(entry.appliedAt);
+      if (!Number.isFinite(at)) {
+        continue;
+      }
+      earliest = Math.min(earliest, at);
+      if (id === MIGRATION_105_ID) {
+        applied105 = at;
+      }
+    }
+    return (
+      Number.isFinite(applied105) &&
+      Number.isFinite(earliest) &&
+      applied105 - earliest < FIRST_BOOT_SWEEP_TOLERANCE_MS
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether a hatch-time default workspace overlay recorded a deliberate
+ * memory-v3 opt-out. `mergeDefaultWorkspaceConfig()` archives the consumed
+ * overlay to `default-config.json` next to config.json; an overlay carrying
+ * `memory.v3.live: false` merged AFTER workspace migrations, so the
+ * persisted `false` is the user's hatch-time choice, not the seed's stamp,
+ * even though the workspace otherwise fingerprints as a seed-race victim
+ * (born in the 105 era, no v3 selection rows).
+ */
+function hatchOverlayOptedOut(workspaceDir: string): boolean {
+  try {
+    const raw = readFileSync(
+      join(workspaceDir, "default-config.json"),
+      "utf-8",
+    );
+    return readMemoryV3Live(JSON.parse(raw)) === false;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether memory-v3 ever ran a selection on this workspace. The
+ * `memory_v3_selections` table lives in `assistant-memory.db` after DB
+ * migration 338 and in `assistant.db` before it; both are checked, along
+ * with the `__relocating` staging name the relocation renames the source to
+ * mid-drain (a crash there leaves the rows only under the staging name). A
+ * database file that exists but cannot be read counts as "may have run v3"
+ * so an unreadable database never causes an opt-out to be overridden.
+ */
+function memoryV3EverRan(workspaceDir: string): boolean {
+  const tables = ["memory_v3_selections", "memory_v3_selections__relocating"];
+  for (const file of ["assistant-memory.db", "assistant.db"]) {
+    const dbPath = join(workspaceDir, "data", "db", file);
+    if (!existsSync(dbPath)) {
+      continue;
+    }
+    let db: Database | null = null;
+    try {
+      db = new Database(dbPath, { readonly: true });
+      for (const table of tables) {
+        const exists = db
+          .query(
+            `SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`,
+          )
+          .get(table);
+        if (!exists) {
+          continue;
+        }
+        const row = db.query(`SELECT 1 FROM "${table}" LIMIT 1`).get();
+        if (row) {
+          return true;
+        }
+      }
+    } catch {
+      return true;
+    } finally {
+      db?.close();
+    }
+  }
+  return false;
+}
+
+export const repairSeedPinnedMemoryV3LiveMigration: WorkspaceMigration = {
+  id: "140-repair-seed-pinned-memory-v3-live",
+  description:
+    "Re-flip memory.v3.live=true for assistants the pre-#39847 first-launch seed pinned to false (seed-race and quarantine-reseed victims), leaving deliberate opt-outs alone",
+
+  run(workspaceDir: string, ctx?: MigrationRunContext): void {
+    // New workspaces are migration 105's job, and a post-#39847 hatch-time
+    // memory.v3.live=false override (merged after migrations) must win.
+    if (ctx?.isNewWorkspace) {
+      return;
+    }
+
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+    let config: Record<string, unknown>;
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!isPlainObject(parsed)) {
+        return;
+      }
+      config = parsed;
+    } catch {
+      return;
+    }
+
+    // Only a persisted explicit `false` is repairable: `true` is healthy and
+    // an absent leaf is a pre-105 assistant on the manual-upgrade path.
+    if (readMemoryV3Live(config) !== false) {
+      return;
+    }
+
+    if (!quarantinedConfigSaidLiveTrue(workspaceDir)) {
+      if (!wasCreatedInMigration105Era(workspaceDir)) {
+        return;
+      }
+      if (hatchOverlayOptedOut(workspaceDir)) {
+        return;
+      }
+      if (memoryV3EverRan(workspaceDir)) {
+        return;
+      }
+    }
+
+    // Narrow-write: only the one leaf changes; the shape was validated above.
+    const memory = config.memory as Record<string, unknown>;
+    const v3 = memory.v3 as Record<string, unknown>;
+    v3.live = true;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: cannot distinguish this repair from a user's explicit
+    // choice after the fact (mirrors migration 105).
+  },
+};

package/src/workspace/migrations/141-stt-english-default-to-multilingual.ts

@@ -0,0 +1,111 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Put existing assistants on code-switching by writing
+ * `services.stt.language: "multi"` on Deepgram and the managed relay,
+ * covering both an accepted English default and a language that was never
+ * set at all.
+ *
+ * Normally rewriting a value the user set would be off limits. It is safe
+ * here because of when the field appeared: `services.stt.language` did not
+ * exist before the language picker shipped (#39546, released 2026-07-31), and
+ * on these two providers that picker never offered English and Multilingual
+ * as peers. The only English row was the default row, labelled "English
+ * (default)". So an `"en"` on Deepgram or the managed relay records "I
+ * accepted the default", not "I want English rather than code-switching", and
+ * the default it accepted has since changed.
+ *
+ * Scoped deliberately:
+ *
+ *   - Only `"en"` and absent. Any other language is a real choice from a list
+ *     where it was the only way to get that language.
+ *   - Only Deepgram and the managed relay (`mode: "managed"` routes there
+ *     while `provider` holds the bring-your-own restore value). xAI has
+ *     offered an explicit English row since the picker shipped, so an `"en"`
+ *     there is deliberate, and code-switching is a Deepgram mode its adapter
+ *     drops anyway.
+ *
+ * Idempotent: an assistant already on `"multi"` (or anything else) is left
+ * alone, so re-running changes nothing.
+ */
+const MULTILINGUAL = "multi";
+const ENGLISH = "en";
+const MULTI_DEFAULT_PROVIDERS = new Set(["deepgram", "vellum"]);
+
+export const sttEnglishDefaultToMultilingualMigration: WorkspaceMigration = {
+  id: "141-stt-english-default-to-multilingual",
+  description:
+    "Move services.stt.language from the accepted English default to multilingual on Deepgram and managed speech",
+  run(workspaceDir: string): void {
+    if (process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH) {
+      return;
+    }
+
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown> = {};
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const services = readObject(config.services);
+    if (services === null) {
+      return;
+    }
+    const stt = readObject(services.stt);
+    if (stt === null) {
+      return;
+    }
+    // Two states move, and only these two. An accepted English default, and
+    // an absent language.
+    //
+    // Absent has to be handled here rather than left to the schema default,
+    // because the config route serves the RAW config: the parsed default
+    // never reaches the web, so the settings UI would keep reading an absent
+    // language as English while live transcription used multilingual. Writing
+    // it makes the two agree.
+    const language = stt.language;
+    if (language !== ENGLISH && language !== undefined) {
+      return;
+    }
+
+    // A legacy managed-mode config routes to the relay while `provider` still
+    // holds the bring-your-own value it would restore, so mode wins.
+    const provider =
+      stt.mode === "managed"
+        ? "vellum"
+        : typeof stt.provider === "string"
+          ? stt.provider
+          : "deepgram";
+    if (!MULTI_DEFAULT_PROVIDERS.has(provider)) {
+      return;
+    }
+
+    stt.language = MULTILINGUAL;
+    services.stt = stt;
+    config.services = services;
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}