@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/messaging/providers/whatsapp/api.ts

@@ -10,6 +10,7 @@
 import { credentialKey } from "../../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../../security/secure-keys.js";
 import { getLogger } from "../../../util/logger.js";
+import { retryableCall } from "../retry-policy.js";
 
 const log = getLogger("whatsapp-api");
 
@@ -46,124 +47,36 @@ interface WhatsAppApiErrorResponse {
   error?: WhatsAppApiErrorDetail;
 }
 
-function isRetryable(status: number): boolean {
-  return status === 429 || status >= 500;
-}
-
 function isAuthError(status: number): boolean {
   return status === 401 || status === 403;
 }
 
-function computeDelay(
-  attempt: number,
-  initialBackoffMs: number,
-  retryAfterHeader: string | null,
-): number {
-  if (retryAfterHeader) {
-    const seconds = Number(retryAfterHeader);
-    if (Number.isFinite(seconds) && seconds > 0) {
-      return Math.min(seconds * 1000, 2_147_483_647);
-    }
-    const targetTime = new Date(retryAfterHeader).getTime();
-    if (Number.isFinite(targetTime)) {
-      const delayMs = targetTime - Date.now();
-      if (delayMs > 0) {
-        return Math.min(delayMs, 2_147_483_647);
-      }
-    }
-  }
-  const exponential = initialBackoffMs * Math.pow(2, attempt - 1);
-  const jitter = Math.random() * exponential * 0.5;
-  return exponential + jitter;
-}
-
-async function retryableFetch<T>(
+function whatsappCall<T>(
   operation: string,
   doFetch: () => Promise<Response>,
 ): Promise<T> {
-  let lastError: Error | null = null;
-  let lastRetryAfter: string | null = null;
-
-  for (let attempt = 0; attempt <= DEFAULT_MAX_RETRIES; attempt++) {
-    if (attempt > 0) {
-      const delay = computeDelay(
-        attempt,
-        DEFAULT_INITIAL_BACKOFF_MS,
-        lastRetryAfter,
-      );
-      log.debug({ attempt, delay, operation }, "Retrying WhatsApp API call");
-      await new Promise((r) => setTimeout(r, delay));
-    }
-
-    lastRetryAfter = null;
-
-    let response: Response;
-    try {
-      response = await doFetch();
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      lastError = new Error(`WhatsApp ${operation} request failed: ${message}`);
-      log.warn(
-        { error: message, attempt, operation },
-        "WhatsApp API fetch failed",
-      );
-      continue;
-    }
-
-    if (!isRetryable(response.status) && !response.ok) {
-      const body = await response.text().catch(() => "");
-      let errorMessage: string | undefined;
+  return retryableCall<T>({
+    provider: "WhatsApp",
+    operation,
+    maxRetries: DEFAULT_MAX_RETRIES,
+    initialBackoffMs: DEFAULT_INITIAL_BACKOFF_MS,
+    log,
+    doFetch,
+    detailFrom: (body) => {
       try {
-        const data = JSON.parse(body) as WhatsAppApiErrorResponse;
-        errorMessage = data.error?.message;
+        return (JSON.parse(body) as WhatsAppApiErrorResponse).error?.message;
       } catch {
-        // not JSON
-      }
-      const message = errorMessage
-        ? `WhatsApp ${operation} failed: ${errorMessage}`
-        : body
-          ? `WhatsApp ${operation} failed with status ${response.status}: ${body}`
-          : `WhatsApp ${operation} failed with status ${response.status}`;
-
-      if (isAuthError(response.status)) {
-        throw new Error(message);
+        return undefined;
       }
-      throw new WhatsAppNonRetryableError(message);
-    }
-
-    if (isRetryable(response.status)) {
-      lastRetryAfter = response.headers.get("retry-after");
-      const body = await response.text().catch(() => "");
-      let errorMessage: string | undefined;
-      try {
-        const data = JSON.parse(body) as WhatsAppApiErrorResponse;
-        errorMessage = data.error?.message;
-      } catch {
-        // not JSON
-      }
-      lastError = new Error(
-        errorMessage
-          ? `WhatsApp ${operation} failed: ${errorMessage}`
-          : body
-            ? `WhatsApp ${operation} failed with status ${response.status}: ${body}`
-            : `WhatsApp ${operation} failed with status ${response.status}`,
-      );
-      log.warn(
-        {
-          status: response.status,
-          attempt,
-          operation,
-          retryAfter: lastRetryAfter,
-        },
-        "WhatsApp API returned retryable error",
-      );
-      continue;
-    }
-
-    return (await response.json()) as T;
-  }
-
-  throw lastError ?? new Error(`WhatsApp ${operation} failed after retries`);
+    },
+    // An auth failure is the operator's to fix, not a delivery fault, so it
+    // surfaces as a plain Error rather than the channel's retryable type.
+    nonRetryableError: ({ status, message }) =>
+      isAuthError(status)
+        ? new Error(message)
+        : new WhatsAppNonRetryableError(message),
+    decode: (body) => JSON.parse(body) as T,
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -202,7 +115,7 @@ export async function sendWhatsAppTextMessage(
 ): Promise<WhatsAppSendMessageResult> {
   const { phoneNumberId, accessToken } = await resolveCredentials();
 
-  return retryableFetch<WhatsAppSendMessageResult>("sendMessage", () =>
+  return whatsappCall<WhatsAppSendMessageResult>("sendMessage", () =>
     fetch(`${WHATSAPP_API_BASE}/${phoneNumberId}/messages`, {
       method: "POST",
       headers: {
@@ -232,7 +145,7 @@ export async function uploadWhatsAppMedia(
 ): Promise<WhatsAppMediaUploadResult> {
   const { phoneNumberId, accessToken } = await resolveCredentials();
 
-  return retryableFetch<WhatsAppMediaUploadResult>("uploadMedia", () => {
+  return whatsappCall<WhatsAppMediaUploadResult>("uploadMedia", () => {
     const form = new FormData();
     form.set("messaging_product", "whatsapp");
     form.set("file", blob, filename);
@@ -268,7 +181,7 @@ export async function sendWhatsAppMediaMessage(
     mediaPayload.filename = filename;
   }
 
-  return retryableFetch<WhatsAppSendMessageResult>("sendMediaMessage", () =>
+  return whatsappCall<WhatsAppSendMessageResult>("sendMediaMessage", () =>
     fetch(`${WHATSAPP_API_BASE}/${phoneNumberId}/messages`, {
       method: "POST",
       headers: {
@@ -294,32 +207,30 @@ export async function sendWhatsAppInteractiveMessage(
 ): Promise<WhatsAppSendMessageResult> {
   const { phoneNumberId, accessToken } = await resolveCredentials();
 
-  return retryableFetch<WhatsAppSendMessageResult>(
-    "sendInteractiveMessage",
-    () =>
-      fetch(`${WHATSAPP_API_BASE}/${phoneNumberId}/messages`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${accessToken}`,
-        },
-        body: JSON.stringify({
-          messaging_product: "whatsapp",
-          recipient_type: "individual",
-          to,
-          type: "interactive",
-          interactive: {
-            type: "button",
-            body: { text: bodyText },
-            action: {
-              buttons: buttons.map((b) => ({
-                type: "reply",
-                reply: { id: b.id, title: b.title },
-              })),
-            },
+  return whatsappCall<WhatsAppSendMessageResult>("sendInteractiveMessage", () =>
+    fetch(`${WHATSAPP_API_BASE}/${phoneNumberId}/messages`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${accessToken}`,
+      },
+      body: JSON.stringify({
+        messaging_product: "whatsapp",
+        recipient_type: "individual",
+        to,
+        type: "interactive",
+        interactive: {
+          type: "button",
+          body: { text: bodyText },
+          action: {
+            buttons: buttons.map((b) => ({
+              type: "reply",
+              reply: { id: b.id, title: b.title },
+            })),
           },
-        }),
-        signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        },
       }),
+      signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+    }),
   );
 }

package/src/monitoring/__tests__/db-integrity-sample.test.ts

@@ -7,6 +7,7 @@
 import { closeSync, mkdtempSync, openSync, rmSync, writeSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { Database } from "bun:sqlite";
 import {
   afterEach,
@@ -99,7 +100,9 @@ test("boundErrors caps by UTF-8 bytes without splitting code points", () => {
 test("subprocess entry prints the JSON verdict", () => {
   seedDb(false);
   corruptDb();
-  const entry = new URL("../db-integrity-check.ts", import.meta.url).pathname;
+  const entry = fileURLToPath(
+    new URL("../db-integrity-check.ts", import.meta.url),
+  );
   const proc = Bun.spawnSync({ cmd: ["bun", "run", entry, dbPath] });
   expect(proc.exitCode).toBe(0);
   const result = JSON.parse(

package/src/monitoring/__tests__/plugin-auto-update.test.ts

@@ -0,0 +1,332 @@
+/**
+ * Tests for the unattended plugin upgrade sweep, driven one pass at a time
+ * (no timers) against a temp workspace: a real `config.json`, real plugin
+ * directories, and a real on-disk sweep stamp. Only the two network-bound
+ * seams are mocked — the marketplace drift check and the daemon IPC call.
+ *
+ * The contract under test:
+ *   - a `manual` workspace (the default) never asks the daemon for anything;
+ *   - an `auto` workspace sweeps at most once per `checkIntervalMs`, and the
+ *     stamp survives restarts;
+ *   - only plugins that can actually move reach the daemon — up-to-date and
+ *     disabled installs cost it nothing;
+ *   - one plugin's refusal does not stop the sweep, an unreachable daemon
+ *     abandons it without stamping (so it retries), and a timed-out upgrade
+ *     abandons it *with* a stamp (so the retry cannot race the handler that
+ *     is still running);
+ *   - the configured strategy is what the daemon is asked for.
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  rmSync,
+  utimesSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const ROOT = join(
+  tmpdir(),
+  `plugin-auto-update-test-${process.pid}-${Date.now()}`,
+);
+const PLUGINS_DIR = join(ROOT, "plugins");
+const MONITORING_DIR = join(ROOT, "data", "monitoring");
+const STAMP = join(MONITORING_DIR, "plugin-auto-update-last-run-at");
+const CONFIG_PATH = join(ROOT, "config.json");
+
+process.env.VELLUM_WORKSPACE_DIR = ROOT;
+mkdirSync(MONITORING_DIR, { recursive: true });
+mkdirSync(PLUGINS_DIR, { recursive: true });
+
+afterAll(() => {
+  rmSync(ROOT, { recursive: true, force: true });
+});
+
+// ── Mocked seams: the marketplace drift check and the daemon call ───────────
+//
+// `mock.module` replaces the module for the whole test process, so each
+// factory spreads the real module and overrides only the one export this
+// file drives. Replacing either wholesale would strip the other exports out
+// from under any test file running alongside this one.
+
+/** Drift status `inspectPlugin` reports per plugin name. */
+let inspectStatus = new Map<string, string>();
+let inspectThrowsFor = new Set<string>();
+
+type UpgradeReply = {
+  ok: boolean;
+  result?: { outcome?: string; toCommit?: string };
+  error?: string;
+  statusCode?: number;
+  timedOut?: boolean;
+};
+let upgradeReply: (name: string) => UpgradeReply = () => ({
+  ok: true,
+  result: { outcome: "upgraded", toCommit: "abc1234" },
+});
+const upgradeCalls: Array<{ name: string; strategy: unknown }> = [];
+
+const realInspect = await import("../../cli/lib/inspect-plugin.js");
+const realIpcClient = await import("../../ipc/cli-client.js");
+
+mock.module("../../cli/lib/inspect-plugin.js", () => ({
+  ...realInspect,
+  inspectPlugin: async ({ name }: { name: string }) => {
+    if (inspectThrowsFor.has(name)) {
+      throw new Error("marketplace unreachable");
+    }
+    return { name, status: inspectStatus.get(name) ?? "up-to-date" };
+  },
+}));
+
+mock.module("../../ipc/cli-client.js", () => ({
+  ...realIpcClient,
+  cliIpcCall: async (
+    _method: string,
+    params: { pathParams: { name: string }; body: { strategy: unknown } },
+  ) => {
+    upgradeCalls.push({
+      name: params.pathParams.name,
+      strategy: params.body.strategy,
+    });
+    return upgradeReply(params.pathParams.name);
+  },
+}));
+
+const { invalidateConfigCache } = await import("../../config/loader.js");
+const { runPluginAutoUpdateSweepIfDue } =
+  await import("../plugin-auto-update.js");
+
+// ── Workspace fixtures ──────────────────────────────────────────────────────
+
+function writeConfig(pluginUpdates: Record<string, unknown>): void {
+  writeFileSync(CONFIG_PATH, JSON.stringify({ pluginUpdates }, null, 2));
+  invalidateConfigCache();
+}
+
+/** Materialize an installed plugin and declare what inspect says about it. */
+function installPlugin(
+  name: string,
+  opts: { status?: string; disabled?: boolean } = {},
+): void {
+  const dir = join(PLUGINS_DIR, name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify({ name, version: "1.0.0" }),
+  );
+  if (opts.disabled) {
+    writeFileSync(join(dir, ".disabled"), "");
+  }
+  inspectStatus.set(name, opts.status ?? "update-available");
+}
+
+/** Backdate the stamp so the sweep is (or is not) due again. */
+function stampAgedBy(ms: number): void {
+  writeFileSync(STAMP, "");
+  const when = new Date(Date.now() - ms);
+  utimesSync(STAMP, when, when);
+}
+
+beforeEach(() => {
+  inspectStatus = new Map();
+  inspectThrowsFor = new Set();
+  upgradeReply = () => ({
+    ok: true,
+    result: { outcome: "upgraded", toCommit: "abc1234" },
+  });
+  upgradeCalls.length = 0;
+  rmSync(STAMP, { force: true });
+  rmSync(PLUGINS_DIR, { recursive: true, force: true });
+  mkdirSync(PLUGINS_DIR, { recursive: true });
+  writeConfig({});
+});
+
+describe("plugin auto-update sweep", () => {
+  test("defaults to manual: nothing is upgraded and nothing is stamped", async () => {
+    installPlugin("alpha");
+    const result = await runPluginAutoUpdateSweepIfDue();
+    expect(result.skipped).toBe("manual");
+    expect(upgradeCalls).toEqual([]);
+    expect(existsSync(STAMP)).toBe(false);
+  });
+
+  test("auto mode upgrades every candidate with the configured strategy", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha", { status: "update-available" });
+    installPlugin("beta", { status: "unknown-provenance" });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.skipped).toBeNull();
+    expect(result.upgraded).toEqual(["alpha", "beta"]);
+    expect(upgradeCalls).toEqual([
+      { name: "alpha", strategy: "theirs" },
+      { name: "beta", strategy: "theirs" },
+    ]);
+  });
+
+  test("a non-default strategy is what the daemon is asked for", async () => {
+    writeConfig({ mode: "auto", strategy: "overwrite" });
+    installPlugin("alpha");
+
+    await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls).toEqual([{ name: "alpha", strategy: "overwrite" }]);
+  });
+
+  test("up-to-date plugins never reach the daemon", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha", { status: "up-to-date" });
+    installPlugin("beta", { status: "update-available" });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls).toEqual([{ name: "beta", strategy: "theirs" }]);
+    expect(result.upgraded).toEqual(["beta"]);
+  });
+
+  test("a plugin whose drift cannot be resolved is skipped, not attempted", async () => {
+    writeConfig({ mode: "auto" });
+    // The catalog was unreachable for one, and the inspect call itself blew
+    // up for the other; an upgrade would hit the same failure.
+    installPlugin("alpha", { status: "remote-unavailable" });
+    installPlugin("gamma", { status: "update-available" });
+    inspectThrowsFor = new Set(["gamma"]);
+    installPlugin("beta", { status: "update-available" });
+
+    await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["beta"]);
+  });
+
+  test("a disabled plugin is left alone", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    installPlugin("beta", { disabled: true });
+
+    await runPluginAutoUpdateSweepIfDue();
+
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["alpha"]);
+  });
+
+  test("an up-to-date daemon verdict counts as unchanged, not upgraded", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    upgradeReply = () => ({
+      ok: true,
+      result: { outcome: "already-up-to-date" },
+    });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.upgraded).toEqual([]);
+    expect(result.unchanged).toEqual(["alpha"]);
+  });
+
+  test("a sweep inside the interval is skipped", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    stampAgedBy(60_000);
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.skipped).toBe("not-due");
+    expect(upgradeCalls).toEqual([]);
+  });
+
+  test("a sweep past the interval runs again", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    stampAgedBy(3_600_001);
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.skipped).toBeNull();
+    expect(upgradeCalls.length).toBe(1);
+  });
+
+  test("a shortened interval is honored", async () => {
+    writeConfig({ mode: "auto", checkIntervalMs: 300_000 });
+    installPlugin("alpha");
+    stampAgedBy(400_000);
+
+    expect((await runPluginAutoUpdateSweepIfDue()).skipped).toBeNull();
+  });
+
+  test("one plugin's refusal does not stop the rest, and the sweep stamps", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    installPlugin("beta");
+    upgradeReply = (name) =>
+      name === "alpha"
+        ? { ok: false, statusCode: 409, error: "not upgradable" }
+        : { ok: true, result: { outcome: "upgraded" } };
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.failed).toEqual(["alpha"]);
+    expect(result.upgraded).toEqual(["beta"]);
+    expect(result.daemonUnreachable).toBe(false);
+    // Stamped: the next attempt is an interval away.
+    expect(await runPluginAutoUpdateSweepIfDue()).toMatchObject({
+      skipped: "not-due",
+    });
+  });
+
+  test("an unreachable daemon abandons the sweep and stays due", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    installPlugin("beta");
+    upgradeReply = () => ({ ok: false, error: "connect ENOENT" });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.daemonUnreachable).toBe(true);
+    // Abandoned after the first plugin — the rest would fail identically.
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["alpha"]);
+
+    // Unstamped, so the next poll retries immediately.
+    upgradeCalls.length = 0;
+    upgradeReply = () => ({ ok: true, result: { outcome: "upgraded" } });
+    const retry = await runPluginAutoUpdateSweepIfDue();
+    expect(retry.skipped).toBeNull();
+    expect(retry.upgraded).toEqual(["alpha", "beta"]);
+  });
+
+  test("a timed-out upgrade stamps, so the retry cannot race the daemon handler", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha");
+    installPlugin("beta");
+    upgradeReply = (name) =>
+      name === "alpha"
+        ? { ok: false, error: "Request timed out", timedOut: true }
+        : { ok: true, result: { outcome: "upgraded" } };
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.failed).toEqual(["alpha"]);
+    // The daemon may still be swapping `alpha`; nothing is queued behind it.
+    expect(upgradeCalls.map((c) => c.name)).toEqual(["alpha"]);
+    expect(result.daemonUnreachable).toBe(false);
+    expect(await runPluginAutoUpdateSweepIfDue()).toMatchObject({
+      skipped: "not-due",
+    });
+  });
+
+  test("a workspace with nothing to move stamps instead of re-inspecting every minute", async () => {
+    writeConfig({ mode: "auto" });
+    installPlugin("alpha", { status: "up-to-date" });
+
+    const result = await runPluginAutoUpdateSweepIfDue();
+
+    expect(result.skipped).toBe("no-candidates");
+    expect(upgradeCalls).toEqual([]);
+    expect(await runPluginAutoUpdateSweepIfDue()).toMatchObject({
+      skipped: "not-due",
+    });
+  });
+});

package/src/monitoring/db-integrity-sample.ts

@@ -17,6 +17,7 @@
 
 import { existsSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import { getRawShareAnalytics } from "../platform/consent-cache.js";
 import { recordWatchdogEvent } from "../telemetry/watchdog-events-store.js";
@@ -59,7 +60,11 @@ let activeChild: ReturnType<typeof Bun.spawn> | null = null;
 async function runCheckSubprocess(
   dbPath: string,
 ): Promise<IntegritySampleResult | null> {
-  const entry = new URL("./db-integrity-check.ts", import.meta.url).pathname;
+  // `fileURLToPath`, not `.pathname`: the latter percent-encodes, and an
+  // install path with a space in it would not resolve. See worker-process.ts.
+  const entry = fileURLToPath(
+    new URL("./db-integrity-check.ts", import.meta.url),
+  );
   const child = Bun.spawn({
     cmd: ["bun", "--smol", "run", entry, dbPath],
     stdio: ["ignore", "pipe", "ignore"],