@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/util/process-tree.ts

@@ -9,11 +9,11 @@
  * process that is actually parented to it.
  */
 
-import { execFile } from "node:child_process";
-import { readdirSync, readFileSync } from "node:fs";
-import { promisify } from "node:util";
-
-const execFileAsync = promisify(execFile);
+import {
+  listProcessTableAsync,
+  type ProcessTableRow,
+  readRawProcessCommand,
+} from "./process-table.js";
 
 /**
  * Whether a process runs plugin-owned code or is the daemon itself / one of its
@@ -52,6 +52,12 @@ export interface ProcTreeNode {
   children: ProcTreeNode[];
 }
 
+interface ProcessTreeBuilder {
+  build: (pid: number) => ProcTreeNode;
+  byPid: Map<number, ProcInfo>;
+  visited: Set<number>;
+}
+
 /** Interpreters whose script argument is more descriptive than argv[0]. */
 const RUNTIMES = new Set([
   "bun",
@@ -64,7 +70,14 @@ const RUNTIMES = new Set([
   "env",
 ]);
 
-const basename = (p: string): string => p.split("/").pop() || p;
+const basename = (p: string): string => p.split(/[\\/]/).pop() || p;
+
+function splitCommand(command: string): string[] {
+  return Array.from(
+    command.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g),
+    (match) => match[1] ?? match[2] ?? match[3],
+  );
+}
 
 /** Script extensions whose path we summarize as `<parent>-<file>`. */
 const SCRIPT_EXT_RE = /\.(ts|js|mjs|cjs|py)$/;
@@ -76,7 +89,7 @@ const SCRIPT_EXT_RE = /\.(ts|js|mjs|cjs|py)$/;
  * filename when the script sits at the filesystem root.
  */
 function scriptName(scriptPath: string): string {
-  const parts = scriptPath.split("/").filter(Boolean);
+  const parts = scriptPath.split(/[\\/]/).filter(Boolean);
   const file = parts[parts.length - 1].replace(SCRIPT_EXT_RE, "");
   const parent = parts.length >= 2 ? parts[parts.length - 2] : "";
   return parent ? `${parent}-${file}` : file;
@@ -93,13 +106,14 @@ function scriptName(scriptPath: string): string {
  * (`/…/vellum-qdrant`) keep their bare executable name.
  */
 export function deriveName(command: string): string {
-  const tokens = command.trim().split(/\s+/).filter(Boolean);
+  const tokens = splitCommand(command.trim());
   if (tokens.length === 0) {
     return "(unknown)";
   }
 
   const argv0 = basename(tokens[0]);
-  if (RUNTIMES.has(argv0)) {
+  const runtimeName = argv0.replace(/\.exe$/i, "").toLowerCase();
+  if (RUNTIMES.has(runtimeName)) {
     const args = tokens.slice(1);
     const script = args.find((t) => SCRIPT_EXT_RE.test(t));
     if (script) {
@@ -109,7 +123,7 @@ export function deriveName(command: string): string {
     // "what was run" rather than an opaque `bun`. Flags are dropped as noise.
     const meaningful = args.filter((t) => !t.startsWith("-"));
     if (meaningful.length > 0) {
-      return `${argv0} ${meaningful.join(" ")}`;
+      return `${runtimeName} ${meaningful.join(" ")}`;
     }
   }
   return argv0;
@@ -126,12 +140,8 @@ export function deriveName(command: string): string {
  * {@link deriveName} descriptor.
  */
 export function readProcessCommand(pid: number): string | null {
-  try {
-    const raw = readFileSync(`/proc/${pid}/cmdline`, "utf8");
-    return deriveName(raw.split("\0").filter(Boolean).join(" "));
-  } catch {
-    return null;
-  }
+  const command = readRawProcessCommand(pid);
+  return command == null ? null : deriveName(command);
 }
 
 /**
@@ -143,7 +153,8 @@ export function readProcessCommand(pid: number): string | null {
  * (`.../plugins/defaults/<name>/`). The `plugins-data/` state directory is
  * deliberately not matched — the slash after `plugins` excludes it.
  */
-const PLUGIN_PATH_RE = /(?:^|\/)plugins\/([^/\s]+)(?:\/([^/\s]+))?/;
+const PLUGIN_PATH_RE =
+  /(?:^|[\\/])plugins[\\/]([^\\/\s]+)(?:[\\/]([^\\/\s]+))?/;
 
 /**
  * Classify whether a raw command line belongs to plugin-owned code, and if so
@@ -169,122 +180,23 @@ export function deriveOrigin(command: string): ProcessOrigin {
   return `plugin:${name}`;
 }
 
-/**
- * Parse a `/proc/<pid>/stat` line into its leading fields. `comm` (the
- * executable name) may itself contain spaces and parentheses, so the fixed
- * fields are read relative to the final `)` rather than by naive splitting.
- * Returns null if the line is malformed.
- */
-function parseProcStat(content: string): { comm: string; ppid: number } | null {
-  const lparen = content.indexOf("(");
-  const rparen = content.lastIndexOf(")");
-  if (lparen === -1 || rparen === -1 || rparen < lparen) {
-    return null;
-  }
-  const comm = content.slice(lparen + 1, rparen);
-  // After ")" come: " <state> <ppid> …" — split the remainder on spaces.
-  const rest = content.slice(rparen + 2).split(" ");
-  const ppid = Number(rest[1]);
-  if (!Number.isInteger(ppid)) {
-    return null;
-  }
-  return { comm, ppid };
-}
-
-/** Read the live process table from Linux `/proc`. Throws if `/proc` is absent. */
-function listProcessesFromProc(): ProcInfo[] {
-  const entries = readdirSync("/proc");
-  const procs: ProcInfo[] = [];
-  for (const entry of entries) {
-    const pid = Number(entry);
-    if (!Number.isInteger(pid) || pid <= 0) {
-      continue;
-    }
-
-    let ppid: number;
-    let comm: string;
-    try {
-      const parsed = parseProcStat(readFileSync(`/proc/${pid}/stat`, "utf8"));
-      if (!parsed) {
-        continue;
-      }
-      ({ ppid, comm } = parsed);
-    } catch {
-      // Process exited between readdir and read — skip.
-      continue;
-    }
-
-    // `/proc/<pid>/cmdline` is NUL-delimited and empty for kernel threads.
-    // Redact the raw command line via deriveName to strip secrets (tokens,
-    // API keys, database URLs) that are commonly passed as process arguments.
-    // The raw command line is read here but never stored — only the derived
-    // safe descriptor is kept.
-    let command = comm;
-    // Origin is derived from the raw command path (which carries the plugin
-    // directory), so it is classified before deriveName redacts the path away.
-    let origin: ProcessOrigin = "workspace";
-    try {
-      const raw = readFileSync(`/proc/${pid}/cmdline`, "utf8");
-      const joined = raw.split("\0").filter(Boolean).join(" ");
-      if (joined) {
-        command = deriveName(joined);
-        origin = deriveOrigin(joined);
-      }
-    } catch {
-      // Fall back to comm.
-    }
-
-    procs.push({ pid, ppid, command, origin });
-  }
-  return procs;
-}
-
-/** Read the live process table via the `ps` command (macOS / no `/proc`). */
-async function listProcessesFromPs(): Promise<ProcInfo[]> {
-  const { stdout } = await execFileAsync(
-    "ps",
-    ["-A", "-o", "pid=,ppid=,command="],
-    { maxBuffer: 8 * 1024 * 1024 },
-  );
-
-  const procs: ProcInfo[] = [];
-  for (const line of stdout.split("\n")) {
-    const m = line.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);
-    if (!m) {
-      continue;
-    }
-    const raw = m[3].trim();
-    procs.push({
-      pid: Number(m[1]),
-      ppid: Number(m[2]),
-      command: deriveName(raw),
-      origin: deriveOrigin(raw),
-    });
-  }
-  return procs;
-}
-
 /**
  * Enumerate the live process table as `(pid, ppid, command)` rows. Prefers
- * Linux `/proc`; falls back to `ps` when `/proc` is unavailable (e.g. macOS).
+ * Linux `/proc`, uses `ps` on macOS, and queries Win32_Process on Windows.
  */
-export async function listProcesses(): Promise<ProcInfo[]> {
-  try {
-    return listProcessesFromProc();
-  } catch {
-    return listProcessesFromPs();
-  }
+export async function listProcesses(
+  rows?: ProcessTableRow[],
+): Promise<ProcInfo[]> {
+  const processRows = rows ?? (await listProcessTableAsync());
+  return processRows.map(({ pid, ppid, command }) => ({
+    pid,
+    ppid,
+    command: deriveName(command),
+    origin: deriveOrigin(command),
+  }));
 }
 
-/**
- * Build the process subtree rooted at `rootPid` from a flat process list.
- * Children are ordered by PID. Self-references and already-visited PIDs are
- * skipped so a malformed table cannot produce an infinite tree.
- */
-export function buildProcessTree(
-  procs: ProcInfo[],
-  rootPid: number,
-): ProcTreeNode {
+function createProcessTreeBuilder(procs: ProcInfo[]): ProcessTreeBuilder {
   const byPid = new Map<number, ProcInfo>();
   const childrenOf = new Map<number, number[]>();
   for (const p of procs) {
@@ -316,5 +228,49 @@ export function buildProcessTree(
     };
   };
 
-  return build(rootPid);
+  return { build, byPid, visited };
+}
+
+/**
+ * Build the process subtree rooted at `rootPid` from a flat process list.
+ * Children are ordered by PID. Self-references and already-visited PIDs are
+ * skipped so a malformed table cannot produce an infinite tree.
+ */
+export function buildProcessTree(
+  procs: ProcInfo[],
+  rootPid: number,
+): ProcTreeNode {
+  return createProcessTreeBuilder(procs).build(rootPid);
+}
+
+/** Build a synthetic system root containing every enumerated process once. */
+export function buildSystemProcessTree(procs: ProcInfo[]): ProcTreeNode {
+  const { build, byPid, visited } = createProcessTreeBuilder(procs);
+  const children: ProcTreeNode[] = [];
+  const orderedProcesses = [...byPid.values()].sort((a, b) => a.pid - b.pid);
+
+  for (const processInfo of orderedProcesses) {
+    if (
+      processInfo.ppid !== processInfo.pid &&
+      !byPid.has(processInfo.ppid) &&
+      !visited.has(processInfo.pid)
+    ) {
+      children.push(build(processInfo.pid));
+    }
+  }
+
+  // Malformed process tables can contain parent cycles with no natural root.
+  for (const processInfo of orderedProcesses) {
+    if (!visited.has(processInfo.pid)) {
+      children.push(build(processInfo.pid));
+    }
+  }
+
+  return {
+    pid: 0,
+    name: "system",
+    command: "",
+    origin: "workspace",
+    children,
+  };
 }

package/src/util/provider-error-patterns.ts

@@ -25,6 +25,26 @@ export function isVisionNotSupportedError(message: string): boolean {
   return VISION_NOT_SUPPORTED_PATTERNS.some((re) => re.test(message));
 }
 
+// Provider prose from server-side chat-template renderers that failed to
+// serialize the request into the model's prompt format. Emitted by
+// vLLM/Jinja-style template engines behind OpenAI-compatible endpoints, e.g.
+// Together serving MiniMax M3: "Failed to apply chat template: invalid
+// operation: object is not callable (in chat:22)".
+export const CHAT_TEMPLATE_FAILURE_PATTERNS = [
+  /appl\w* (?:the )?chat[ _-]?template/i,
+  /chat[ _-]?template (?:error|render)/i,
+];
+
+/**
+ * Whether a provider error message indicates the endpoint's server-side chat
+ * template failed to render the request. These endpoints typically only
+ * handle plain-string message content, so structured shapes (content-parts
+ * arrays, tool payloads) are what trip the renderer.
+ */
+export function isChatTemplateFailureError(message: string): boolean {
+  return CHAT_TEMPLATE_FAILURE_PATTERNS.some((re) => re.test(message));
+}
+
 // Vendor-neutral (OpenRouter/Anthropic-style) credit-exhaustion prose. Also
 // covers per-key spend caps: OpenRouter returns 403 "Key limit exceeded" when a
 // key's configured credit limit is reached — a billing/budget condition that

package/src/util/spawn.ts

@@ -2,6 +2,8 @@
  * Shared spawn-with-timeout helper used by media-processing and transcribe tools.
  */
 
+import { delimiter } from "node:path";
+
 /** Full video preprocessing: mpdecimate analysis, frame extraction, palette analysis. Longest operation. */
 export const FFMPEG_PREPROCESS_TIMEOUT_MS = 600_000;
 
@@ -29,9 +31,14 @@ export function spawnWithTimeout(
       stderr: "pipe",
       env: {
         ...process.env,
-        PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin"]
+        PATH: [
+          process.env.PATH,
+          ...(process.platform === "darwin"
+            ? ["/opt/homebrew/bin", "/usr/local/bin"]
+            : []),
+        ]
           .filter(Boolean)
-          .join(":"),
+          .join(delimiter),
       },
     });
     const timer = setTimeout(() => {

package/src/watch/__tests__/watch-retro.test.ts

@@ -247,6 +247,51 @@ describe("watch retrospective", () => {
     );
   });
 
+  test("puts the report last in the turn, after the skill it hands off to", async () => {
+    const summary = recordSession(["renaming the export"]);
+    const { calls, dispatch } = recordingDispatch();
+
+    await runWatchRetro(summary, { dispatch });
+
+    const { prompt } = calls[0]!;
+    // The report is what the user is shown when a session ends, so it has to
+    // be the turn's last prose. A client renders the final text block as the
+    // response and folds everything before it into collapsed intermediate
+    // work, so a `skill_load` issued after the report demotes the report to
+    // an "Earlier activity" row the user has to unfold to read.
+    expect(prompt).toContain("Load the `skill-management` skill first");
+    expect(
+      prompt.indexOf("Load the `skill-management` skill first"),
+    ).toBeLessThan(prompt.indexOf("What I need from you"));
+    expect(prompt).toContain("That report is the last thing you do this turn");
+    // A sign-off is another text block after the report, which puts the report
+    // back on the wrong side of the same rule, so it is refused by name.
+    expect(prompt).toContain("no sign-off");
+    expect(prompt).toContain("no further tool call");
+  });
+
+  test("writes the report even when the skill it hands off to will not load", async () => {
+    const summary = recordSession(["filing the receipt"]);
+    const { calls, dispatch } = recordingDispatch();
+
+    await runWatchRetro(summary, { dispatch });
+
+    const { prompt } = calls[0]!;
+    // `skill-management` is a selector, and a managed or workspace skill of the
+    // same id replaces the bundled one in the catalog. Putting the load ahead
+    // of the report is what lets a shadow, or the refusal a clientless wake
+    // gives an inline-command load, land before the user has been told
+    // anything. Neither may become the retro: the session is recorded and the
+    // account of it is what the user is owed.
+    expect(prompt).toContain(
+      "Write the report below whether or not that load succeeds",
+    );
+    expect(prompt).toContain("do not report on the load and do not retry it");
+    // The failure is still named, so a missing handoff does not read as a
+    // report that simply chose not to ask about authoring.
+    expect(prompt).toContain("could not open the skill-authoring flow");
+  });
+
   test("authors nothing until the user has confirmed", async () => {
     const summary = recordSession(["exporting the sheet"]);
     const { calls, dispatch } = recordingDispatch();
@@ -605,7 +650,9 @@ describe("watch retrospective", () => {
     expect(payload).toBeGreaterThan(opened);
     expect(payload).toBeLessThan(closed);
     // The retrospective's own instructions sit outside it.
-    expect(prompt.indexOf("Write back to the user")).toBeGreaterThan(closed);
+    expect(
+      prompt.indexOf("Load the `skill-management` skill first"),
+    ).toBeGreaterThan(closed);
 
     // One real envelope, so nothing in the recording can pass for a second.
     expect(prompt.match(/<external_content/g)).toHaveLength(1);

package/src/watch/watch-retro.ts

@@ -76,16 +76,58 @@ const WATCH_RETRO_WAKE_SOURCE = "watch-retro";
  * gap between those two is the whole risk of turning a demonstration into a
  * skill. `skill-management` will not scaffold until that step is settled
  * either, so an unasked one stalls the flow it was meant to feed.
+ *
+ * **The skill loads before the report is written, and nothing follows the
+ * report.** This is about where the report lands on screen, not about the
+ * order the work happens in. A client renders an assistant turn as its final
+ * prose plus the intermediate work that led there, and the web transcript
+ * collapses that intermediate half into an "Earlier activity" disclosure that
+ * a settled turn shows closed (`finalResponseGroupIndex` in
+ * `transcript-message-body.tsx`). Everything before the turn's last non-empty
+ * text block is intermediate by that rule, including prose. Writing the report
+ * first and loading the skill after it puts a `skill_load` and whatever the
+ * model says once the skill is in hand *after* the report, which demotes the
+ * report to intermediate work and hides it behind a collapsed row next to the
+ * reasoning rows. The user presses stop on a session and is shown a folded-up
+ * link where the account of it should be.
+ *
+ * So the load comes first and the report is last. `skill-management` opens on
+ * "Ask before doing anything", so a turn that loads it and then asks is
+ * following it rather than jumping the flow, and the report is the alignment
+ * its first step calls for. The instruction that nothing follows the report is
+ * as load-bearing as the ordering: one trailing line of sign-off is another
+ * text block after it, and the report is intermediate again.
+ *
+ * **The report does not depend on the load succeeding.** `skill-management` is
+ * a selector, not a fixed definition: `loadSkillCatalog` lets a managed or
+ * workspace skill of the same id replace the bundled one, and
+ * `resolveSkillSelector` hands back whichever entry won. So the load can come
+ * back as someone else's skill, or as a refusal, and putting it ahead of the
+ * report is what makes either one land before the user has been told anything.
+ * A refusal is the likelier of the two here: this wake is `clientless`, and an
+ * inline-command load with no human present is denied outright
+ * (`permissions/checker.ts`, `isDynamicSkillLoadInvocation`). The bundled skill
+ * carries no such expansions, so the ordinary path is unaffected, but a shadow
+ * that carries them is denied on arrival.
+ *
+ * Neither outcome is allowed to become the retro. The session was recorded, the
+ * timeline is already in this prompt, and the account of it is the one thing the
+ * user is owed for having pressed stop; a permission error where that account
+ * should be is the same empty thread the `surfaceConversation` guard exists to
+ * prevent, just with prose in it. So the instructions write the report either
+ * way and say the handoff did not happen, rather than reporting on the load.
  */
-const RETRO_INSTRUCTIONS = `Write back to the user in two sections, in this order, both as level-2 headings.
+const RETRO_INSTRUCTIONS = `Load the \`skill-management\` skill first, before you write anything, and follow it. Do not author or scaffold a skill until the four points that step names are settled: the report below is the alignment its first step calls for.
+
+Write the report below whether or not that load succeeds. If it fails, is refused, or comes back as something other than the skill-management flow, do not report on the load and do not retry it: write the report, and end it with one line saying you could not open the skill-authoring flow, so the user knows the handoff is the part that did not happen.
+
+Then write back to the user in two sections, in this order, both as level-2 headings. That report is the last thing you do this turn, and nothing follows it: no sign-off, no note about what you loaded, no further tool call. Their answers come back as an ordinary reply and the flow picks up from there.
 
 First, "What I need from you". The questions you cannot answer from the recording, numbered, most consequential first. Each one concrete enough to answer in a sentence, and each one about something you are genuinely guessing at: a value you could not read, a choice whose rule you could not infer, a step you only saw the result of. Always ask what they would say to start this task, in their own words, because the recording cannot tell you that. Ask about the done condition if it is unclear. Always confirm any destructive or irreversible step, even one the recording showed plainly: watching someone do a thing once is not agreement to have it done again unattended, and this is the one place the rule below does not apply. Otherwise do not ask them to confirm something the recording already showed you.
 
 Second, "What I saw". Open with one sentence naming the task and what it is for, on its own and not as a list item. Then the steps in order beneath it, one line each and concrete enough to follow, carrying no purpose of their own. This is the record your questions sit on top of, so state it rather than asking about it.
 
-Open on the first heading. No preamble, no announcing what you are about to do, no narrating which skills you are loading.
-
-Then load the \`skill-management\` skill and follow it, treating the answers to your questions as the alignment its first step calls for. Do not author or scaffold a skill until the four points that step names are settled. Correct your reading against whatever they tell you. If they decide this is not worth keeping, say so and stop.`;
+Open on the first heading. No preamble, no announcing what you are about to do, no narrating which skills you are loading. Correct your reading against whatever they tell you. If they decide this is not worth keeping, say so and stop.`;
 
 /**
  * Told to the model whenever the render was bounded, naming the bound that

package/src/workspace/git-service.ts

@@ -12,6 +12,7 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 
 import { getConfig } from "../config/loader.js";
+import { isFileUnheld } from "../util/file-use.js";
 import { getLogger } from "../util/logger.js";
 import { Mutex } from "../util/mutex.js";
 import { PromiseGuard } from "../util/promise-guard.js";
@@ -419,20 +420,9 @@ export class WorkspaceGitService {
       return;
     }
 
-    try {
-      // lsof exits non-zero when no process holds the file, which rejects the
-      // promise and falls through to removal below.
-      const { stdout } = await execFileAsync("lsof", ["-t", lockPath], {
-        timeout: 3000,
-      });
-      if (stdout.length > 0) {
-        log.debug("index.lock held by an active process, skipping removal");
-        return;
-      }
-    } catch {
-      // lsof unavailable or errored — fall through to remove.
-      // On platforms without lsof this degrades to unconditional removal,
-      // which is the same as the previous behavior.
+    if (!(await isFileUnheld(lockPath))) {
+      log.debug("Could not prove index.lock is stale, skipping removal");
+      return;
     }
 
     try {