@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/cli/commands/oauth/request.test.ts

@@ -182,6 +182,43 @@ describe("oauth request body encoding", () => {
     );
   });
 
+  test("reads a binary @file as a Buffer without UTF-8 replacement", async () => {
+    const filePath = join(tempDir, "upload.bin");
+    writeFileSync(filePath, PNG_MAGIC);
+
+    const parsed = readBodyData(`@${filePath}`, {
+      "Content-Type": "application/octet-stream",
+    });
+    expect(Buffer.isBuffer(parsed)).toBe(true);
+    expect(Buffer.from(parsed as Uint8Array).equals(PNG_MAGIC)).toBe(true);
+  });
+
+  test("forwards a binary @file to the route handler as a Buffer", async () => {
+    const filePath = join(tempDir, "report.pdf");
+    writeFileSync(filePath, PNG_MAGIC);
+
+    const { exitCode } = await runRequestCommand([
+      "--provider",
+      "google",
+      "-s",
+      "-X",
+      "POST",
+      "-H",
+      "Content-Type: application/pdf",
+      "-d",
+      `@${filePath}`,
+      "https://www.googleapis.com/upload/drive/v3/files?uploadType=media",
+    ]);
+
+    expect(exitCode).toBe(0);
+    expect(handleRequestCalls).toHaveLength(1);
+    const call = handleRequestCalls[0] as { body: { parsed_data: unknown } };
+    expect(Buffer.isBuffer(call.body.parsed_data)).toBe(true);
+    expect(
+      Buffer.from(call.body.parsed_data as Uint8Array).equals(PNG_MAGIC),
+    ).toBe(true);
+  });
+
   test("forwards a multipart body to the route handler as a string", async () => {
     const { exitCode } = await runRequestCommand([
       "--provider",

package/src/cli/commands/oauth/request.ts

@@ -5,9 +5,10 @@ import type { Command } from "commander";
 import { exitFromIpcResult } from "../../../ipc/cli-client.js";
 import {
   findContentTypeHeader,
+  parseRequestBodyBytes,
   parseRequestBodyData,
 } from "../../../util/oauth-request-body.js";
-import { readStdinSync } from "../../../util/read-stdin.js";
+import { readStdinBytesSync } from "../../../util/read-stdin.js";
 import { subcommand } from "../../lib/cli-command-help.js";
 import { shouldOutputJson, writeOutput } from "../../output.js";
 
@@ -49,8 +50,8 @@ function parseHeader(raw: string): [string, string] {
  *
  * A non-JSON `Content-Type` keeps the payload as the exact string the caller
  * gave, so multipart, XML, and form-encoded bodies reach the provider
- * unchanged. Files are read as UTF-8 text, so a body that is not valid UTF-8
- * (a raw image, an archive) cannot travel through this flag.
+ * unchanged. Files and stdin are read as raw bytes: valid UTF-8 stays text
+ * (or JSON), and anything else travels as a Buffer.
  */
 export function readBodyData(
   data: string,
@@ -59,12 +60,12 @@ export function readBodyData(
   const contentType = findContentTypeHeader(headers);
 
   if (data === "@-") {
-    return parseRequestBodyData(readStdinSync(), contentType);
+    return parseRequestBodyBytes(readStdinBytesSync(), contentType);
   }
 
   if (data.startsWith("@")) {
     const filePath = data.slice(1);
-    return parseRequestBodyData(readFileSync(filePath, "utf-8"), contentType);
+    return parseRequestBodyBytes(readFileSync(filePath), contentType);
   }
 
   return parseRequestBodyData(data, contentType);
@@ -90,7 +91,7 @@ export function registerRequestCommand(oauth: Command): void {
     )
     .option(
       "-d, --data <data>",
-      "Request body: inline JSON, @filename, or @- for stdin. Sent raw when Content-Type is not JSON",
+      "Request body: inline JSON, @filename, or @- for stdin. Sent raw when Content-Type is not JSON. Files keep their original bytes, including binary",
     )
     .option("-G, --get", "Force GET; body data becomes query params")
     .option("-I, --head", "Send a HEAD request")

package/src/cli/lib/bundled-marketplace.json

@@ -219,7 +219,7 @@
       "source": {
         "source": "github",
         "repo": "vellum-ai/imessage",
-        "ref": "069a8375e2a6ed069550866114a653218864bc91"
+        "ref": "01701eb1be4074f99371af90fc4340fdd1674efb"
       },
       "description": "iMessage and SMS channel for the Vellum assistant, backed by a Photon line.",
       "category": "productivity",

package/src/cli/lib/install-from-github.ts

@@ -36,7 +36,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
+import { delimiter, dirname, join, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 
 import {
@@ -46,7 +46,12 @@ import {
   stripPreservedUserState,
 } from "../../plugins/plugin-tree-walk.js";
 import { ensureBun } from "../../util/bun-runtime.js";
-import { getWorkspacePluginsDir } from "../../util/platform.js";
+import {
+  addToPathEnv,
+  getExtraToolPathDirs,
+  getWorkspacePluginsDir,
+  isWindows,
+} from "../../util/platform.js";
 import type { FetchLike } from "./fetch-like.js";
 import {
   type DependencyInstaller,
@@ -1254,23 +1259,23 @@ export const defaultPostinstallRunner: PostinstallRunner = async ({
     timeout: POSTINSTALL_TIMEOUT_MS,
     maxBuffer: 16 * 1024 * 1024,
     env: pluginPostinstallEnv(bun),
+    windowsHide: true,
   });
 };
 
 function pluginPostinstallEnv(bun: string): NodeJS.ProcessEnv {
+  const systemDirs = isWindows()
+    ? [process.env.SystemRoot ?? "C:\\Windows"]
+    : [...getExtraToolPathDirs(), "/usr/bin", "/bin"];
   const env: NodeJS.ProcessEnv = {
-    PATH: [
-      dirname(bun),
-      "/opt/homebrew/bin",
-      "/usr/local/bin",
-      "/usr/bin",
-      "/bin",
-    ]
-      .filter(Boolean)
-      .join(":"),
+    PATH: [dirname(bun), ...systemDirs].join(delimiter),
   };
-  if (process.env.HOME) {
-    env.HOME = process.env.HOME;
+  for (const key of isWindows()
+    ? ["USERPROFILE", "APPDATA", "LOCALAPPDATA", "TEMP", "SystemRoot"]
+    : ["HOME"]) {
+    if (process.env[key]) {
+      env[key] = process.env[key];
+    }
   }
   return env;
 }
@@ -1373,6 +1378,7 @@ export const defaultGitRunner: GitRunner = async (args, opts) => {
     timeout: GIT_TIMEOUT_MS,
     maxBuffer: 64 * 1024 * 1024,
     env: pluginGitEnv(),
+    windowsHide: true,
   });
   return { stdout };
 };
@@ -1385,12 +1391,7 @@ function pluginGitEnv(): NodeJS.ProcessEnv {
     }
   }
   env.GIT_TERMINAL_PROMPT = "0";
-  const extraPaths = ["/opt/homebrew/bin", "/usr/local/bin"];
-  const current = (env.PATH ?? "").split(":").filter(Boolean);
-  const missing = extraPaths.filter((p) => !current.includes(p));
-  if (missing.length > 0) {
-    env.PATH = [...current, ...missing].join(":");
-  }
+  addToPathEnv(env, getExtraToolPathDirs(), "back");
   return env;
 }
 

package/src/cli/lib/install-plugin-dependencies.ts

@@ -59,6 +59,7 @@ import { promisify } from "node:util";
 
 import { ensureBun } from "../../util/bun-runtime.js";
 import { getLogger } from "../../util/logger.js";
+import { addToPathEnv } from "../../util/platform.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -318,6 +319,7 @@ export const defaultDependencyInstaller: DependencyInstaller = async ({
     timeout: DEPENDENCY_INSTALL_TIMEOUT_MS,
     maxBuffer: 32 * 1024 * 1024,
     env: dependencyInstallEnv(bun),
+    windowsHide: true,
   });
 };
 
@@ -331,10 +333,6 @@ export const defaultDependencyInstaller: DependencyInstaller = async ({
  */
 function dependencyInstallEnv(bun: string): NodeJS.ProcessEnv {
   const env: NodeJS.ProcessEnv = { ...process.env };
-  const bunDir = dirname(bun);
-  const current = (env.PATH ?? "").split(":").filter(Boolean);
-  if (!current.includes(bunDir)) {
-    env.PATH = [bunDir, ...current].join(":");
-  }
+  addToPathEnv(env, [dirname(bun)]);
   return env;
 }

package/src/cli/lib/merge-plugin-tree.ts

@@ -205,6 +205,7 @@ async function threeWayMergeFile(
         encoding: "buffer",
         timeout: MERGE_TIMEOUT_MS,
         maxBuffer: 64 * 1024 * 1024,
+        windowsHide: true,
       });
       return { content: stdout, conflicted: false, binaryConflicted: false };
     } catch (err) {

package/src/cli/lib/publish-plugin.ts

@@ -199,7 +199,10 @@ export function validatePluginForPublish(dir: string): PublishValidation {
 // ---------------------------------------------------------------------------
 
 async function runGit(dir: string, args: string[]): Promise<string> {
-  const { stdout } = await execFileAsync("git", args, { cwd: dir });
+  const { stdout } = await execFileAsync("git", args, {
+    cwd: dir,
+    windowsHide: true,
+  });
   return stdout.trim();
 }
 

package/src/config/__tests__/balanced-model-experiment.test.ts

@@ -24,15 +24,16 @@ import {
   type ProfileEntry,
 } from "../schemas/llm.js";
 
-// The `experiment-balanced-model-2026-08-06` arm repoints the model the managed
+// The `experiment-balanced-model-2026-08-31` arm repoints the model the managed
 // Balanced profile resolves to. Both the runtime resolver and the client-facing
 // profile listing go through `defaultProfileBodyForProvider`, so both are
 // exercised here: a disagreement between them shows the user one model beside a
 // profile that runs another.
 
 const FLAG = BALANCED_MODEL_EXPERIMENT_FLAG_KEY;
-const SHIPPED_MODEL = "accounts/fireworks/models/glm-5p2";
-const GLM_MODEL = SHIPPED_MODEL;
+const SHIPPED_MODEL = "accounts/fireworks/models/glm-5p3-flash";
+const GLM_53_MODEL = "accounts/fireworks/models/glm-5p3";
+const GLM_52_MODEL = "accounts/fireworks/models/glm-5p2";
 
 function setArm(value: boolean | string): void {
   setOverridesForTesting({ [FLAG]: value });
@@ -57,22 +58,22 @@ afterEach(() => {
 });
 
 describe("balanced-model experiment arms", () => {
-  test("terra repoints mainAgent at gpt-5.6-terra on the managed connection", () => {
-    setArm("terra");
+  test("glm-5p3 repoints mainAgent at GLM 5.3 on the managed connection", () => {
+    setArm("glm-5p3");
     const resolved = resolveCallSiteConfig(
       "mainAgent",
       llmWithActiveBalanced(),
     );
-    expect(resolved.model).toBe("gpt-5.6-terra");
+    expect(resolved.model).toBe(GLM_53_MODEL);
     expect(resolved.provider).toBe("vellum");
-    expect(getManagedUpstream("gpt-5.6-terra")).toBe("openai");
+    expect(getManagedUpstream(GLM_53_MODEL)).toBe("fireworks");
 
     const entry = resolveDefaultProfileForProvider(
       undefined,
       "balanced",
       managed,
     );
-    expect(entry?.model).toBe("gpt-5.6-terra");
+    expect(entry?.model).toBe(GLM_53_MODEL);
     expect(entry?.provider).toBe("vellum");
     // Routing-identity providers derive their connection per request.
     expect(entry?.provider_connection).toBeUndefined();
@@ -85,12 +86,12 @@ describe("balanced-model experiment arms", () => {
       "mainAgent",
       llmWithActiveBalanced(),
     );
-    expect(resolved.model).toBe(GLM_MODEL);
+    expect(resolved.model).toBe(GLM_52_MODEL);
     expect(resolved.provider).toBe("vellum");
 
-    const upstream = getManagedUpstream(GLM_MODEL);
+    const upstream = getManagedUpstream(GLM_52_MODEL);
     expect(upstream).toBe("fireworks");
-    const cap = catalogMaxOutputTokens(upstream as string, GLM_MODEL);
+    const cap = catalogMaxOutputTokens(upstream as string, GLM_52_MODEL);
     expect(cap).toBeDefined();
     expect(resolved.maxTokens).toBeLessThanOrEqual(cap as number);
     // The shipped token budget stands.
@@ -99,19 +100,26 @@ describe("balanced-model experiment arms", () => {
     );
   });
 
+  test("the glm-5p3-flash arm names the shipped pin", () => {
+    setArm("glm-5p3-flash");
+    expect(
+      resolveDefaultProfileForProvider(undefined, "balanced", managed)?.model,
+    ).toBe(SHIPPED_MODEL);
+  });
+
   test("an arm changes only the model of the managed balanced body", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     const entry = resolveDefaultProfileForProvider(
       undefined,
       "balanced",
       managed,
     );
     const shipped = CODE_DEFAULT_PROFILE_ENTRIES.balanced;
-    expect(entry).toEqual({ ...shipped, model: "gpt-5.6-terra" });
+    expect(entry).toEqual({ ...shipped, model: GLM_52_MODEL });
   });
 
   test("the other default profiles are untouched by an arm", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     for (const key of [
       "quality-optimized",
       "cost-optimized",
@@ -124,7 +132,7 @@ describe("balanced-model experiment arms", () => {
   });
 
   test("every pinned arm model is managed-routable and in its upstream catalog", () => {
-    for (const model of ["gpt-5.6-terra", GLM_MODEL]) {
+    for (const model of [SHIPPED_MODEL, GLM_53_MODEL, GLM_52_MODEL]) {
       const upstream = getManagedUpstream(model);
       expect(upstream).not.toBeNull();
       expect(isModelInCatalog(upstream as string, model)).toBe(true);
@@ -136,7 +144,10 @@ describe("balanced-model experiment fallbacks", () => {
   const shippedCases: [string, () => void][] = [
     ["the flag is unset", () => clearCachedOverrides()],
     ["no override is present", () => setOverridesForTesting({})],
+    // Arms of the retired 2026-08-06 experiment are no longer pinned, so a
+    // stale value cannot strand an install on a model this test no longer runs.
     ["the arm is control", () => setArm("control")],
+    ["the arm is terra", () => setArm("terra")],
     ["the arm is an unknown string", () => setArm("gpt-9-does-not-exist")],
     ["the arm is the empty string", () => setArm("")],
     ["the value is boolean true", () => setArm(true)],
@@ -162,11 +173,11 @@ describe("balanced-model experiment fallbacks", () => {
     });
   }
 
-  test("the shipped catalog body is the control arm", () => {
+  test("the shipped catalog body is the glm-5p3-flash arm", () => {
     expect(CODE_DEFAULT_PROFILE_ENTRIES.balanced.model).toBe(SHIPPED_MODEL);
   });
 
-  test("the registry default is control, which the override-only flag read assumes", () => {
+  test("the registry default names the shipped pin, which the override-only flag read assumes", () => {
     const registryPath = join(
       import.meta.dirname,
       "..",
@@ -188,14 +199,35 @@ describe("balanced-model experiment fallbacks", () => {
     const flag = registry.flags.find((entry) => entry.key === FLAG);
     expect(flag).toBeDefined();
     expect(flag?.scope).toBe("assistant");
-    expect(flag?.defaultEnabled).toBe("control");
-    expect(flag?.values).toEqual(["control", "terra", "glm-5p2"]);
+    expect(flag?.defaultEnabled).toBe("glm-5p3-flash");
+    expect(flag?.values).toEqual(["glm-5p3-flash", "glm-5p3", "glm-5p2"]);
+  });
+
+  test("the retired experiment's flag is gone from the registry", () => {
+    const registryPath = join(
+      import.meta.dirname,
+      "..",
+      "..",
+      "..",
+      "..",
+      "meta",
+      "feature-flags",
+      "feature-flag-registry.json",
+    );
+    const registry = JSON.parse(readFileSync(registryPath, "utf-8")) as {
+      flags: { key: string }[];
+    };
+    expect(
+      registry.flags.some(
+        (entry) => entry.key === "experiment-balanced-model-2026-08-06",
+      ),
+    ).toBe(false);
   });
 });
 
 describe("balanced-model experiment boundaries", () => {
   test("a user-owned balanced shadow wins over the arm", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     const profiles: Record<string, ProfileEntry> = {
       balanced: { source: "user", provider: "openai", model: "gpt-5.5" },
     };
@@ -209,7 +241,7 @@ describe("balanced-model experiment boundaries", () => {
   });
 
   test("a managed-source stub still resolves to the arm's body", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     const profiles: Record<string, ProfileEntry> = {
       balanced: { source: "managed", label: "My Balanced" },
     };
@@ -218,12 +250,12 @@ describe("balanced-model experiment boundaries", () => {
       "balanced",
       managed,
     );
-    expect(entry?.model).toBe("gpt-5.6-terra");
+    expect(entry?.model).toBe(GLM_52_MODEL);
     expect(entry?.label).toBe("My Balanced");
   });
 
   test("the chatgpt and BYOK columns stay out of the experiment", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     for (const provider of ["anthropic", "openai", "chatgpt"] as const) {
       const armed = resolveDefaultProfileForProvider(undefined, "balanced", {
         provider,
@@ -234,37 +266,37 @@ describe("balanced-model experiment boundaries", () => {
       });
       expect(armed).toEqual(shipped as ProfileEntry);
       expect(armed?.provider).toBe(provider);
-      setArm("terra");
+      setArm("glm-5p2");
     }
   });
 
   test("an install with no defaultProvider still picks up the arm", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     expect(
       resolveDefaultProfileForProvider(undefined, "balanced", null)?.model,
-    ).toBe("gpt-5.6-terra");
+    ).toBe(GLM_52_MODEL);
   });
 });
 
 describe("client-facing profile listing", () => {
   test("reports the arm's model so the UI matches what runs", () => {
-    setArm("terra");
+    setArm("glm-5p2");
     const profiles = getEffectiveProfilesForProvider(undefined, managed);
-    expect(profiles.balanced?.model).toBe("gpt-5.6-terra");
+    expect(profiles.balanced?.model).toBe(GLM_52_MODEL);
     expect(profiles["quality-optimized"]?.model).toBe(
       CODE_DEFAULT_PROFILE_ENTRIES["quality-optimized"].model,
     );
   });
 
-  test("reports the shipped model on the control arm", () => {
-    setArm("control");
+  test("reports the shipped model on an arm this build does not know", () => {
+    setArm("terra");
     expect(
       getEffectiveProfilesForProvider(undefined, managed).balanced?.model,
     ).toBe(SHIPPED_MODEL);
   });
 
   test("agrees with the runtime resolver on every arm", () => {
-    for (const arm of ["control", "terra", "glm-5p2", "nonsense"]) {
+    for (const arm of ["glm-5p3-flash", "glm-5p3", "glm-5p2", "nonsense"]) {
       setArm(arm);
       const listed = getEffectiveProfilesForProvider(undefined, managed)
         .balanced?.model;

package/src/config/__tests__/default-profile-catalog.test.ts

@@ -59,9 +59,9 @@ describe("getEffectiveProfiles", () => {
     }
   });
 
-  test("the managed Balanced profile routes GLM 5.2 through Fireworks", () => {
+  test("the managed Balanced profile routes GLM 5.3 Flash through Fireworks", () => {
     const balanced = CODE_DEFAULT_PROFILE_ENTRIES.balanced;
-    expect(balanced.model).toBe("accounts/fireworks/models/glm-5p2");
+    expect(balanced.model).toBe("accounts/fireworks/models/glm-5p3-flash");
     expect(resolveRoutingIdentity(balanced.provider, balanced.model)).toEqual({
       connectionName: "vellum",
       expectedProvider: "fireworks",

package/src/config/balanced-model-experiment.ts

@@ -1,33 +1,39 @@
 /**
  * Flag read for the managed Balanced profile's model A/B test.
  *
- * `experiment-balanced-model-2026-08-06` is a multivariate LaunchDarkly flag
+ * `experiment-balanced-model-2026-08-31` is a multivariate LaunchDarkly flag
  * whose arm repoints the model the managed (`vellum`) implementation of the
  * `balanced` default profile resolves to. The arm to model pins live beside
  * the profile bodies in `default-profile-catalog.ts`, which validates their
  * managed routability at load time; this module owns only the flag read.
  *
+ * A flag key per experiment, rather than new variations on the previous one,
+ * is what keeps a readout honest: the activation cohort query keys a user on
+ * their first-ever assignment for a flag, so every user the 2026-08-06 test
+ * already stamped would stay pinned to that arm forever and never enter a new
+ * arm on the same key.
+ *
  * The read goes straight to the override cache rather than through
  * `assistant-feature-flags.ts`. `feature-flag-cache.ts` is a stdlib-only leaf,
  * so the profile catalog stays free of the pino logger and the gateway IPC
  * client that resolver would pull into its import graph, and the registry
- * declares `defaultEnabled: "control"` for this flag, which is the same
- * shipped body an absent override already resolves to. That equivalence is
- * pinned by `__tests__/balanced-model-experiment.test.ts` so it cannot drift.
+ * declares `defaultEnabled: "glm-5p3-flash"` for this flag, which pins the same
+ * model the shipped body an absent override resolves to already carries. That
+ * equivalence is pinned by `__tests__/balanced-model-experiment.test.ts` so it
+ * cannot drift.
  */
 
 import { getCachedOverrides } from "./feature-flag-cache.js";
 
 export const BALANCED_MODEL_EXPERIMENT_FLAG_KEY =
-  "experiment-balanced-model-2026-08-06";
+  "experiment-balanced-model-2026-08-31";
 
 /**
  * The experiment arm in force, or `undefined` when the flag resolves to
  * anything that is not an arm name: unset, a boolean, or the empty string.
- * `control` and any arm this build does not know are returned as-is and miss
- * the pin table, which is what keeps a stale or malformed LaunchDarkly value
- * on the shipped model rather than stranding an install on one that does not
- * exist.
+ * Any arm this build does not know is returned as-is and misses the pin table,
+ * which is what keeps a stale or malformed LaunchDarkly value on the shipped
+ * model rather than stranding an install on one that does not exist.
  */
 export function getBalancedModelExperimentArm(): string | undefined {
   const value = getCachedOverrides()?.[BALANCED_MODEL_EXPERIMENT_FLAG_KEY];