@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/util/__tests__/worker-process-command.test.ts

@@ -1,6 +1,12 @@
 import { describe, expect, test } from "bun:test";
 
-import { resolveWorkerCommand } from "../worker-process.js";
+import {
+  classifyOrphanAfterWait,
+  decideWorkerSlot,
+  resolveWorkerCommand,
+  workerKindSignature,
+  type WorkerProcessStatus,
+} from "../worker-process.js";
 
 const entry = new URL("file:///source/monitoring/worker.ts");
 
@@ -35,3 +41,242 @@ describe("resolveWorkerCommand", () => {
     ).toEqual(["bun", "--smol", "run", "/source/monitoring/worker.ts"]);
   });
 });
+
+describe("workerKindSignature", () => {
+  const schedule = new URL(
+    "file:////app/runtime/0.11.7/src/schedule/worker.ts",
+  );
+  const source = {
+    platform: "darwin" as const,
+    execPath: "/runtime/bun",
+    executableExists: () => false,
+  };
+
+  test("is the same for a worker of this kind from any install", () => {
+    const previous = new URL(
+      "file:////app/runtime/0.10.11/src/schedule/worker.ts",
+    );
+    expect(workerKindSignature(schedule, "schedule", source)).toEqual(
+      workerKindSignature(previous, "schedule", source),
+    );
+  });
+
+  test("distinguishes one worker kind from another", () => {
+    const monitoring = new URL(
+      "file:////app/runtime/0.11.7/src/monitoring/worker.ts",
+    );
+    expect(workerKindSignature(schedule, "schedule", source)).not.toEqual(
+      workerKindSignature(monitoring, "monitoring", source),
+    );
+  });
+
+  // The signature only guards against signalling a recycled PID, so it has to
+  // be specific enough that an unrelated program running its own worker.ts
+  // never matches.
+  const matches = (command: string, signature: readonly string[]): boolean =>
+    signature.every((part) => command.includes(part));
+
+  test("does not match an unrelated program running some other worker.ts", () => {
+    const signature = workerKindSignature(schedule, "schedule", source);
+    expect(matches("bun run /home/dev/side-project/worker.ts", signature)).toBe(
+      false,
+    );
+    expect(matches("node /srv/queue/src/jobs/worker.ts", signature)).toBe(
+      false,
+    );
+  });
+
+  test("matches the same worker from a previous install", () => {
+    const signature = workerKindSignature(schedule, "schedule", source);
+    expect(
+      matches(
+        "bun --smol run /app/runtime/0.10.11/src/schedule/worker.ts",
+        signature,
+      ),
+    ).toBe(true);
+  });
+
+  const packaged = {
+    platform: "win32" as const,
+    execPath: "/runtime/vellum-daemon.exe",
+    executableExists: () => true,
+  };
+
+  // Every packaged worker runs one executable and is told apart by the
+  // subcommand, so the executable alone must not identify a worker: one
+  // worker's slot would otherwise reclaim another's process.
+  test("distinguishes packaged worker kinds sharing one executable", () => {
+    const scheduleSig = workerKindSignature(schedule, "schedule", packaged);
+    expect(matches('"C:/App/vellum-worker.exe" schedule', scheduleSig)).toBe(
+      true,
+    );
+    expect(matches('"C:/App/vellum-worker.exe" monitoring', scheduleSig)).toBe(
+      false,
+    );
+  });
+
+  test("matches a packaged worker from a previous install", () => {
+    const scheduleSig = workerKindSignature(schedule, "schedule", packaged);
+    expect(matches('"C:/Prev/vellum-worker.exe" schedule', scheduleSig)).toBe(
+      true,
+    );
+  });
+});
+
+// Every branch that can reach a kill. `reclaim` is the only decision that
+// signals a process, so each test below is really asking: could this input
+// have killed something it should not have?
+describe("decideWorkerSlot", () => {
+  const DAEMON = 900;
+  const WORKER = 4242;
+  const signature = ["src/schedule/worker.ts"];
+  const running = { status: "running" as const, pid: WORKER };
+  const ours = `bun --smol run /app/runtime/0.11.7/src/schedule/worker.ts`;
+  const previous = `bun --smol run /app/runtime/0.10.11/src/schedule/worker.ts`;
+  const alive = () => true;
+  const dead = () => false;
+
+  const decide = (
+    row: { pid: number; ppid: number; command: string } | null,
+    isOwnerAlive = alive,
+    pid1OwnsWorkers = false,
+    status: WorkerProcessStatus = running,
+  ) =>
+    decideWorkerSlot(
+      status,
+      row,
+      signature,
+      DAEMON,
+      isOwnerAlive,
+      pid1OwnsWorkers,
+    );
+
+  test("spawns when the PID file names nothing running", () => {
+    expect(decide(null, alive, false, { status: "not_running" })).toEqual({
+      action: "spawn",
+    });
+  });
+
+  test("adopts this daemon's own worker", () => {
+    expect(decide({ pid: WORKER, ppid: DAEMON, command: ours })).toEqual({
+      action: "adopt",
+      pid: WORKER,
+    });
+  });
+
+  test("reclaims a worker reparented to init after its daemon died", () => {
+    expect(decide({ pid: WORKER, ppid: 1, command: previous })).toEqual({
+      action: "reclaim",
+      pid: WORKER,
+    });
+  });
+
+  test("reclaims a worker whose owner is gone", () => {
+    expect(decide({ pid: WORKER, ppid: 777, command: previous }, dead)).toEqual(
+      {
+        action: "reclaim",
+        pid: WORKER,
+      },
+    );
+  });
+
+  // `isOwnerAlive` is "is the owner a daemon", not "does that PID exist". These
+  // workers have exactly one legitimate owner, so a recycled owner PID must not
+  // keep a stranded worker looking owned.
+  test("adopts a worker a live daemon owns", () => {
+    expect(decide({ pid: WORKER, ppid: 777, command: ours }, alive)).toEqual({
+      action: "adopt",
+      pid: WORKER,
+    });
+  });
+
+  test("reclaims a worker whose owner PID was recycled to a non-daemon", () => {
+    const ownerIsNotADaemon = () => false;
+    expect(
+      decide({ pid: WORKER, ppid: 777, command: previous }, ownerIsNotADaemon),
+    ).toEqual({ action: "reclaim", pid: WORKER });
+  });
+
+  // In a container the daemon is PID 1, so a worker parented to 1 is a live
+  // sibling's, not an orphan.
+  test("adopts a PID-1 child when PID 1 is the daemon", () => {
+    expect(
+      decide({ pid: WORKER, ppid: 1, command: ours }, alive, true),
+    ).toEqual({ action: "adopt", pid: WORKER });
+  });
+
+  // The cases below are the ones that must never reach a kill.
+  test("never signals an unrelated process on a recycled PID", () => {
+    expect(
+      decide({ pid: WORKER, ppid: 1, command: "/usr/bin/postgres -D /data" }),
+    ).toEqual({ action: "adopt", pid: WORKER });
+  });
+
+  test("never signals another project's worker.ts on a recycled PID", () => {
+    expect(
+      decide({
+        pid: WORKER,
+        ppid: 1,
+        command: "bun run /home/dev/side-project/worker.ts",
+      }),
+    ).toEqual({ action: "adopt", pid: WORKER });
+  });
+
+  test("never signals a different worker kind holding this slot", () => {
+    expect(
+      decide({
+        pid: WORKER,
+        ppid: 1,
+        command: "bun --smol run /app/runtime/0.10.11/src/monitoring/worker.ts",
+      }),
+    ).toEqual({ action: "adopt", pid: WORKER });
+  });
+
+  test("never signals when the process table could not be read", () => {
+    expect(decide(null)).toEqual({ action: "adopt", pid: WORKER });
+  });
+});
+
+// Escalation happens after an awaited SIGTERM grace, so the PID alone cannot
+// carry identity across it: the orphan may exit mid-wait and the OS may hand
+// its PID to a stranger, or the process table may simply fail to answer.
+// Only a positive re-match escalates, and only a proven "gone" releases the
+// slot; a live PID whose identity cannot be read resolves to reuse, because
+// releasing it would spawn a second worker next to a live one.
+describe("classifyOrphanAfterWait", () => {
+  const signature = ["src/schedule/worker.ts"];
+  const ours = "bun --smol run /app/runtime/0.10.11/src/schedule/worker.ts";
+
+  test("dead PID: gone, slot may be released", () => {
+    expect(classifyOrphanAfterWait(false, null, signature)).toBe("gone");
+    expect(classifyOrphanAfterWait(false, ours, signature)).toBe("gone");
+  });
+
+  test("still this worker: escalation proceeds", () => {
+    expect(classifyOrphanAfterWait(true, ours, signature)).toBe("orphan");
+  });
+
+  test("PID reused by a stranger: orphan exited, never SIGKILL", () => {
+    expect(
+      classifyOrphanAfterWait(true, "/usr/bin/postgres -D /data", signature),
+    ).toBe("gone");
+  });
+
+  test("PID reused by a different worker kind: never SIGKILL", () => {
+    expect(
+      classifyOrphanAfterWait(
+        true,
+        "bun --smol run /app/runtime/0.10.11/src/monitoring/worker.ts",
+        signature,
+      ),
+    ).toBe("gone");
+  });
+
+  // The fail-safe vex pinned: a live PID with an unreadable command line is
+  // neither killable nor releasable.
+  test("alive but command unreadable: identity-unreadable, reuse the slot", () => {
+    expect(classifyOrphanAfterWait(true, null, signature)).toBe(
+      "identity-unreadable",
+    );
+  });
+});

package/src/util/bun-runtime.ts

@@ -22,7 +22,7 @@ import { arch, homedir, platform } from "node:os";
 import { basename, join } from "node:path";
 
 import { getLogger } from "./logger.js";
-import { getBinDir } from "./platform.js";
+import { getBinDir, isWindows } from "./platform.js";
 
 const log = getLogger("bun-runtime");
 
@@ -81,19 +81,31 @@ export function findBun(): string | undefined {
     return process.execPath;
   }
 
+  const exe = isWindows() ? "bun.exe" : "bun";
+
   // 2. Previously downloaded copy
-  const downloaded = join(getBinDir(), "bun");
+  const downloaded = join(getBinDir(), exe);
   if (existsSync(downloaded)) {
     return downloaded;
   }
 
   // 3. Common install locations
   const home = homedir();
-  for (const p of [
-    join(home, ".bun", "bin", "bun"),
-    "/opt/homebrew/bin/bun",
-    "/usr/local/bin/bun",
-  ]) {
+  const candidates = isWindows()
+    ? [
+        join(home, ".bun", "bin", exe),
+        join(
+          process.env.LOCALAPPDATA ?? join(home, "AppData", "Local"),
+          "bun",
+          exe,
+        ),
+      ]
+    : [
+        join(home, ".bun", "bin", exe),
+        "/opt/homebrew/bin/bun",
+        "/usr/local/bin/bun",
+      ];
+  for (const p of candidates) {
     if (existsSync(p)) {
       return p;
     }
@@ -108,13 +120,20 @@ export function findBun(): string | undefined {
   return undefined;
 }
 
+/** Escape a string for a PowerShell single-quoted literal. */
+function psQuote(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
 /**
  * Download a pinned bun release into the given directory.
  * Returns the absolute path to the downloaded binary.
  */
 async function downloadBun(installDir: string): Promise<string> {
-  const os = platform();
-  const cpu = arch() === "arm64" ? "aarch64" : arch();
+  const win = isWindows();
+  const os = win ? "windows" : platform();
+  // Bun ships no Windows ARM64 build; the x64 one runs under emulation.
+  const cpu = win ? "x64" : arch() === "arm64" ? "aarch64" : arch();
   const target = `${os}-${cpu}`;
   const url = `https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-${target}.zip`;
 
@@ -135,9 +154,18 @@ async function downloadBun(installDir: string): Promise<string> {
 
   try {
     const proc = Bun.spawn({
-      cmd: ["unzip", "-o", tmpZip, "-d", installDir],
+      cmd: win
+        ? [
+            "powershell.exe",
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            `Expand-Archive -LiteralPath '${psQuote(tmpZip)}' -DestinationPath '${psQuote(installDir)}' -Force`,
+          ]
+        : ["unzip", "-o", tmpZip, "-d", installDir],
       stdout: "ignore",
       stderr: "pipe",
+      windowsHide: true,
     });
     await proc.exited;
     if (proc.exitCode !== 0) {
@@ -146,8 +174,9 @@ async function downloadBun(installDir: string): Promise<string> {
     }
 
     // Move binary from bun-{target}/bun to installDir/bun
-    const extractedBun = join(installDir, `bun-${target}`, "bun");
-    const finalPath = join(installDir, "bun");
+    const exe = win ? "bun.exe" : "bun";
+    const extractedBun = join(installDir, `bun-${target}`, exe);
+    const finalPath = join(installDir, exe);
     if (existsSync(extractedBun)) {
       // Remove old binary first to avoid "Text file busy" on some systems
       if (existsSync(finalPath)) {
@@ -164,7 +193,9 @@ async function downloadBun(installDir: string): Promise<string> {
       );
     }
 
-    chmodSync(finalPath, 0o755);
+    if (!win) {
+      chmodSync(finalPath, 0o755);
+    }
 
     log.info({ path: finalPath }, "Bun binary downloaded successfully");
     return finalPath;

package/src/util/bundled-asset.ts

@@ -1,6 +1,14 @@
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 
+export function isBunVirtualPath(value: string): boolean {
+  const normalized = value.replaceAll("\\", "/");
+  return (
+    normalized.startsWith("/$bunfs/") ||
+    /^[a-z]:\/~bun(?:\/|$)/i.test(normalized)
+  );
+}
+
 /**
  * Resolve the path to a bundled asset directory, handling compiled Bun binaries
  * where `import.meta.dirname` points to the `/$bunfs/` virtual filesystem and
@@ -22,7 +30,7 @@ export function resolveBundledDir(
   relativePath: string,
   bundleName: string,
 ): string {
-  if (callerDir.startsWith("/$bunfs/")) {
+  if (isBunVirtualPath(callerDir)) {
     const execDir = dirname(process.execPath);
     // macOS .app bundle: binary in Contents/MacOS/, resources in Contents/Resources/
     const resourcesPath = join(execDir, "..", "Resources", bundleName);

package/src/util/disk-usage.ts

@@ -30,6 +30,7 @@ async function getDirectorySizeBytes(paths: string[]): Promise<number | null> {
     }
     const { stdout } = await execFileAsync("du", ["-sb", ...existing], {
       timeout: 30_000,
+      windowsHide: true,
     });
     let total = 0;
     for (const line of stdout.trim().split("\n")) {

package/src/util/file-use.ts

@@ -48,7 +48,10 @@ type ExecFileRunner = (
 ) => Promise<ExecFileResult>;
 
 const runExecFile: ExecFileRunner = async (command, args, options) => {
-  const { stdout } = await execFileAsync(command, args, options);
+  const { stdout } = await execFileAsync(command, args, {
+    ...options,
+    windowsHide: true,
+  });
   return { stdout };
 };
 

package/src/util/guardian-form-timeouts.ts

@@ -0,0 +1,50 @@
+/**
+ * Timings for the forms the guardian fills in their app, shared by the CLI
+ * that waits and the registry that holds the form open.
+ *
+ * One budget split across a socket and a timer, so the numbers live together
+ * and the caller's wait is derived from the deadlines rather than written down
+ * beside them. The invariant: the caller outlasts the form. A caller that
+ * gives up first reports a failure while the write it was waiting on goes on
+ * to commit.
+ *
+ * Under `util/` because the CLI hoists it: constants and one pure function,
+ * with no daemon runtime graph behind it (`cli/no-daemon-internals`).
+ */
+
+/** Default time a form stays open for an answer (5 min). */
+export const GUARDIAN_FORM_DEFAULT_TIMEOUT_MS = 300_000;
+
+/**
+ * Ceiling on a caller-supplied wait (1 hour), so a bad value cannot park a
+ * pending form indefinitely.
+ */
+export const GUARDIAN_FORM_MAX_TIMEOUT_MS = 3_600_000;
+
+/**
+ * How long a claimed form is held while its write settles (3 min).
+ *
+ * A claim means somebody answered, so the open-for-answers deadline stops
+ * governing and this one takes over. It covers the gateway's whole write
+ * rather than one call of it: its IPC calls bound at 30s each and a delete
+ * makes three in sequence (mirror probe, mirror delete, then the resolve
+ * back).
+ */
+export const GUARDIAN_FORM_SETTLE_MS = 180_000;
+
+/** Slack on top of the deadlines, so the socket is never the first to give up. */
+const GUARDIAN_FORM_TRANSPORT_BUFFER_MS = 10_000;
+
+/**
+ * How long a caller waits on a form that stays open for `timeoutMs`.
+ *
+ * Covers the answer window plus the settle window, since an answer landing at
+ * the deadline starts the settle window from there. A caller that gives up
+ * first reports a failure while the write proceeds, which for a delete means a
+ * contact removed against a command that reported nothing happened.
+ */
+export function guardianFormCallBudgetMs(timeoutMs: number): number {
+  return (
+    timeoutMs + GUARDIAN_FORM_SETTLE_MS + GUARDIAN_FORM_TRANSPORT_BUFFER_MS
+  );
+}

package/src/util/image-conversion.ts

@@ -260,6 +260,7 @@ async function runSips(
       stdout: "ignore",
       stderr: "ignore",
       timeout: 15_000,
+      windowsHide: true,
     });
     await proc.exited;
     if (proc.exitCode !== 0) {

package/src/util/oauth-request-body.test.ts

@@ -2,7 +2,9 @@ import { describe, expect, test } from "bun:test";
 
 import {
   findContentTypeHeader,
+  isBinaryOAuthContentType,
   isJsonContentType,
+  parseRequestBodyBytes,
   parseRequestBodyData,
 } from "./oauth-request-body.js";
 
@@ -72,3 +74,60 @@ describe("parseRequestBodyData", () => {
     expect(parseRequestBodyData('"hello"', undefined)).toBe('"hello"');
   });
 });
+
+describe("isBinaryOAuthContentType", () => {
+  test("recognizes PDF, octet-stream, and image types", () => {
+    expect(isBinaryOAuthContentType("application/pdf")).toBe(true);
+    expect(isBinaryOAuthContentType("application/octet-stream")).toBe(true);
+    expect(isBinaryOAuthContentType("image/png; charset=binary")).toBe(true);
+  });
+
+  test("rejects JSON, multipart, and form types", () => {
+    expect(isBinaryOAuthContentType("application/json")).toBe(false);
+    expect(isBinaryOAuthContentType("multipart/related; boundary=b")).toBe(
+      false,
+    );
+    expect(isBinaryOAuthContentType("application/x-www-form-urlencoded")).toBe(
+      false,
+    );
+    expect(isBinaryOAuthContentType(undefined)).toBe(false);
+  });
+});
+
+describe("parseRequestBodyBytes", () => {
+  const png = Buffer.from([
+    0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff, 0xfe,
+  ]);
+
+  test("keeps invalid UTF-8 as a Buffer", () => {
+    const parsed = parseRequestBodyBytes(png, "multipart/related; boundary=b");
+    expect(Buffer.isBuffer(parsed)).toBe(true);
+    expect(Buffer.from(parsed as Uint8Array).equals(png)).toBe(true);
+  });
+
+  test("keeps a PDF Content-Type as a Buffer even when the bytes are ASCII", () => {
+    const asciiPdf = Buffer.from("%PDF-1.4 simple", "ascii");
+    const parsed = parseRequestBodyBytes(asciiPdf, "application/pdf");
+    expect(Buffer.isBuffer(parsed)).toBe(true);
+    expect(Buffer.from(parsed as Uint8Array).equals(asciiPdf)).toBe(true);
+  });
+
+  test("keeps valid UTF-8 multipart as the exact string", () => {
+    const multipart = "--b\r\nContent-Type: text/csv\r\n\r\na,b\r\n--b--\r\n";
+    expect(
+      parseRequestBodyBytes(
+        Buffer.from(multipart, "utf-8"),
+        "multipart/related; boundary=b",
+      ),
+    ).toBe(multipart);
+  });
+
+  test("parses UTF-8 JSON into an object", () => {
+    expect(
+      parseRequestBodyBytes(
+        Buffer.from('{"name":"Sheet"}', "utf-8"),
+        "application/json",
+      ),
+    ).toEqual({ name: "Sheet" });
+  });
+});

package/src/util/oauth-request-body.ts

@@ -1,13 +1,23 @@
 /**
  * Shared helpers for deciding how an outbound OAuth request body is encoded.
  *
- * A body is either structured (an object or array, serialized as JSON) or
- * raw (a string forwarded to the provider byte-for-byte). The Content-Type
- * the caller supplied decides which one a string body is: multipart, XML,
- * form-encoded, and CSV payloads must survive intact, while JSON text is
- * already in its wire form and must not be re-encoded.
+ * A body is structured (an object or array, serialized as JSON), raw text
+ * (a string forwarded to the provider as UTF-8), or raw bytes (a Buffer
+ * forwarded to the provider byte-for-byte). The Content-Type the caller
+ * supplied decides which one a string body is: multipart, XML, form-encoded,
+ * and CSV payloads must survive intact, while JSON text is already in its
+ * wire form and must not be re-encoded. Files that are not valid UTF-8, or
+ * that carry a binary Content-Type, stay as bytes.
  */
 
+const BINARY_MEDIA_TYPES = new Set([
+  "application/octet-stream",
+  "application/pdf",
+  "application/zip",
+  "application/gzip",
+  "application/x-gzip",
+]);
+
 /** True when a Content-Type header names a JSON media type. */
 export function isJsonContentType(
   contentType: string | undefined | null,
@@ -58,3 +68,44 @@ export function parseRequestBodyData(
   // body once unquoted, so the original quoted text is kept as the wire form.
   return typeof parsed === "string" ? raw : parsed;
 }
+
+/** True when a Content-Type names a binary media type (PDF, image, zip). */
+export function isBinaryOAuthContentType(
+  contentType: string | undefined | null,
+): boolean {
+  if (!contentType) {
+    return false;
+  }
+  const mediaType = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+  if (
+    mediaType.startsWith("image/") ||
+    mediaType.startsWith("audio/") ||
+    mediaType.startsWith("video/")
+  ) {
+    return true;
+  }
+  return BINARY_MEDIA_TYPES.has(mediaType);
+}
+
+/**
+ * Decide how file or stdin bytes reach the provider.
+ *
+ * Binary Content-Types and payloads that are not valid UTF-8 stay as a
+ * Buffer so the original bytes survive the JSON proxy envelope. Valid UTF-8
+ * follows {@link parseRequestBodyData}.
+ */
+export function parseRequestBodyBytes(
+  raw: Uint8Array,
+  contentType: string | undefined,
+): unknown {
+  if (isBinaryOAuthContentType(contentType)) {
+    return Buffer.from(raw);
+  }
+  let utf8: string;
+  try {
+    utf8 = new TextDecoder("utf-8", { fatal: true }).decode(raw);
+  } catch {
+    return Buffer.from(raw);
+  }
+  return parseRequestBodyData(utf8, contentType);
+}