@vellumai/assistant 0.12.1-dev.202609141913.5e16607 → 0.12.1-staging.2

package/src/plugins/defaults/memory/memory-retrospective-cursor-backfill.ts

@@ -1,126 +0,0 @@
-// ---------------------------------------------------------------------------
-// Memory retrospective: cursor timestamp backfill.
-// ---------------------------------------------------------------------------
-//
-// State rows written before `last_processed_created_at` existed carry an
-// id-only cursor, which stops bounding reads the moment its row is deleted
-// (see `memory-retrospective-state.ts`). This pass copies `createdAt` from
-// each such row's message while the message still exists. Rows whose message
-// is already gone stay NULL: nothing remains to recover, and they are counted
-// so the stall is visible in the log. Runs detached at daemon init (ahead of
-// any client regenerating a reply) and again at memory-worker startup;
-// idempotent, keyset-paginated by conversation id, and yielding between pages.
-
-import { and, asc, eq, gt, isNull, ne } from "drizzle-orm";
-
-import { messageCreatedAtByIds } from "../../../persistence/message-reads.js";
-import { memoryRetrospectiveState } from "../../../persistence/schema/index.js";
-import { withSqliteRetry } from "./host-utils.js";
-import { getLogger } from "./logging.js";
-import { memoryDbOrNull } from "./memory-db.js";
-import { ensureRetrospectiveCursorColumn } from "./memory-retrospective-state.js";
-
-const log = getLogger("memory-retrospective-cursor-backfill");
-
-const DEFAULT_PAGE_SIZE = 500;
-
-export interface CursorBackfillResult {
-  /** Rows with a cursor id but no timestamp. */
-  scanned: number;
-  /** Rows whose message still exists and received its `createdAt`. */
-  backfilled: number;
-  /** Rows whose cursor message no longer exists; left NULL. */
-  unrecoverable: number;
-}
-
-/**
- * Fill `last_processed_created_at` on every state row that has a cursor id
- * but no timestamp. Best-effort: a missing memory connection or column is a
- * no-op, and a row the job rewrites mid-pass is skipped by the update's
- * `IS NULL` guard rather than stomped. Pages by conversation id so a large
- * backlog never materializes at once or holds the event loop.
- */
-export async function backfillRetrospectiveCursorTimestamps(opts?: {
-  pageSize?: number;
-}): Promise<CursorBackfillResult> {
-  const pageSize = opts?.pageSize ?? DEFAULT_PAGE_SIZE;
-  const result: CursorBackfillResult = {
-    scanned: 0,
-    backfilled: 0,
-    unrecoverable: 0,
-  };
-  const context = "backfillRetrospectiveCursorTimestamps";
-  const mdb = memoryDbOrNull(context);
-  if (!mdb || !ensureRetrospectiveCursorColumn(context)) {
-    return result;
-  }
-
-  let afterConversationId = "";
-  for (;;) {
-    const page = mdb
-      .select({
-        conversationId: memoryRetrospectiveState.conversationId,
-        messageId: memoryRetrospectiveState.lastProcessedMessageId,
-      })
-      .from(memoryRetrospectiveState)
-      .where(
-        and(
-          isNull(memoryRetrospectiveState.lastProcessedCreatedAt),
-          ne(memoryRetrospectiveState.lastProcessedMessageId, ""),
-          gt(memoryRetrospectiveState.conversationId, afterConversationId),
-        ),
-      )
-      .orderBy(asc(memoryRetrospectiveState.conversationId))
-      .limit(pageSize)
-      .all();
-    if (page.length === 0) {
-      break;
-    }
-    afterConversationId = page[page.length - 1]!.conversationId;
-    result.scanned += page.length;
-
-    const createdAtById = messageCreatedAtByIds(
-      page.map((row) => row.messageId),
-    );
-    const recoverable = page.flatMap((row) => {
-      const createdAt = createdAtById.get(row.messageId);
-      return createdAt === undefined ? [] : [{ ...row, createdAt }];
-    });
-    result.unrecoverable += page.length - recoverable.length;
-
-    if (recoverable.length > 0) {
-      await withSqliteRetry(
-        () => {
-          mdb.transaction((tx) => {
-            for (const row of recoverable) {
-              tx.update(memoryRetrospectiveState)
-                .set({ lastProcessedCreatedAt: row.createdAt })
-                .where(
-                  and(
-                    eq(
-                      memoryRetrospectiveState.conversationId,
-                      row.conversationId,
-                    ),
-                    eq(
-                      memoryRetrospectiveState.lastProcessedMessageId,
-                      row.messageId,
-                    ),
-                    isNull(memoryRetrospectiveState.lastProcessedCreatedAt),
-                  ),
-                )
-                .run();
-            }
-          });
-        },
-        { op: context, context: { afterConversationId } },
-      );
-      result.backfilled += recoverable.length;
-    }
-    await Bun.sleep(0);
-  }
-
-  if (result.backfilled > 0 || result.unrecoverable > 0) {
-    log.info(result, "Retrospective cursor timestamps backfilled");
-  }
-  return result;
-}

package/src/plugins/defaults/memory/memory-retrospective-cursor-preserve.ts

@@ -1,79 +0,0 @@
-// ---------------------------------------------------------------------------
-// Memory retrospective: keep the cursor's timestamp when its row is deleted.
-// ---------------------------------------------------------------------------
-//
-// The cursor normally sits on the latest assistant reply, and the retry route
-// deletes exactly that row when the user regenerates it. A cursor written
-// before the timestamp column existed carries only the id, so once the row is
-// gone nothing can place it. The `message-deleted` hook delivers each deleted
-// row's `(createdAt, id)` here: when the conversation's cursor is among the
-// rows and has no timestamp yet, the row's `createdAt` is recorded. The
-// timestamps travel in the call, so the write does not need the rows to
-// still exist.
-
-import { and, eq, isNull } from "drizzle-orm";
-
-import { memoryRetrospectiveState } from "../../../persistence/schema/index.js";
-import { withSqliteRetry } from "./host-utils.js";
-import { getLogger } from "./logging.js";
-import { memoryDbOrNull } from "./memory-db.js";
-import { ensureRetrospectiveCursorColumn } from "./memory-retrospective-state.js";
-
-const log = getLogger("memory-retrospective-cursor-preserve");
-
-/**
- * Record `createdAt` on the conversation's retrospective cursor when it points
- * at one of `rows` and has no timestamp yet. Best-effort: an unavailable
- * memory connection or column is a no-op, and a cursor the job has moved
- * since the caller read it is skipped by the `IS NULL` guard.
- */
-export async function preserveRetrospectiveCursorTimestamps(
-  conversationId: string,
-  rows: ReadonlyArray<{ id: string; createdAt: number }>,
-): Promise<void> {
-  if (rows.length === 0) {
-    return;
-  }
-  const context = "preserveRetrospectiveCursorTimestamps";
-  try {
-    const mdb = memoryDbOrNull(context);
-    if (!mdb || !ensureRetrospectiveCursorColumn(context)) {
-      return;
-    }
-    const state = mdb
-      .select({
-        messageId: memoryRetrospectiveState.lastProcessedMessageId,
-        createdAt: memoryRetrospectiveState.lastProcessedCreatedAt,
-      })
-      .from(memoryRetrospectiveState)
-      .where(eq(memoryRetrospectiveState.conversationId, conversationId))
-      .get();
-    if (!state || state.createdAt !== null) {
-      return;
-    }
-    const row = rows.find((candidate) => candidate.id === state.messageId);
-    if (!row) {
-      return;
-    }
-    await withSqliteRetry(
-      () =>
-        mdb
-          .update(memoryRetrospectiveState)
-          .set({ lastProcessedCreatedAt: row.createdAt })
-          .where(
-            and(
-              eq(memoryRetrospectiveState.conversationId, conversationId),
-              eq(memoryRetrospectiveState.lastProcessedMessageId, row.id),
-              isNull(memoryRetrospectiveState.lastProcessedCreatedAt),
-            ),
-          )
-          .run(),
-      { op: context, context: { conversationId } },
-    );
-  } catch (err) {
-    log.warn(
-      { err, conversationId },
-      "could not preserve the retrospective cursor timestamp before its row was deleted",
-    );
-  }
-}

package/src/plugins/defaults/memory/memory-retrospective-cursor.ts

@@ -1,28 +0,0 @@
-// ---------------------------------------------------------------------------
-// Memory retrospective: the cursor a state row hands to the messages-after
-// reads.
-// ---------------------------------------------------------------------------
-
-import type { MessageCursor } from "../../../persistence/message-cursor.js";
-
-/**
- * The `(createdAt, id)` cursor a retrospective state row carries, or null
- * when nothing has been processed yet (no row, or the `""` sentinel left by
- * failure-only attempts). The timestamp lets the reads keep their bound after
- * the cursor's row is deleted, which is what a regenerated reply does to the
- * latest assistant message the cursor usually sits on.
- */
-export function retrospectiveCursor(
-  state: {
-    lastProcessedMessageId: string;
-    lastProcessedCreatedAt?: number | null;
-  } | null,
-): MessageCursor | null {
-  if (!state || state.lastProcessedMessageId === "") {
-    return null;
-  }
-  return {
-    id: state.lastProcessedMessageId,
-    createdAt: state.lastProcessedCreatedAt ?? null,
-  };
-}

package/src/plugins/defaults/memory/skill-md-mtime-poll.ts

@@ -1,9 +0,0 @@
-/**
- * Plugin-local re-export of the workspace SKILL.md mtime poll so hook files
- * under `hooks/` do not grow a new escaping specifier. The daemon module is
- * already a memory-plugin baseline import from `startup.ts` / `worker.ts`.
- */
-export {
-  startWorkspaceSkillMdMtimePoll,
-  stopWorkspaceSkillMdMtimePoll,
-} from "../../../daemon/skill-memory-refresh.js";

package/src/providers/gemini-thought-signature.test.ts

@@ -1,63 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-import {
-  GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
-  isGemini3Model,
-  unsignedThoughtSignatureFallback,
-} from "./gemini-thought-signature.js";
-
-describe("isGemini3Model", () => {
-  test("matches native Gemini 3 ids", () => {
-    expect(isGemini3Model("gemini-3.7-flash")).toBe(true);
-    expect(isGemini3Model("models/gemini-3.1-pro-preview")).toBe(true);
-  });
-
-  test("matches OpenAI-compatible catalog prefixes", () => {
-    expect(isGemini3Model("google/gemini-3.7-flash")).toBe(true);
-  });
-
-  test("does not match Gemini 2.5 or unrelated ids", () => {
-    expect(isGemini3Model("gemini-2.5-flash")).toBe(false);
-    expect(isGemini3Model("gpt-5.2")).toBe(false);
-  });
-});
-
-describe("unsignedThoughtSignatureFallback", () => {
-  test("stamps the dummy on the first unsigned Gemini 3 call", () => {
-    expect(
-      unsignedThoughtSignatureFallback([undefined, undefined], {
-        model: "gemini-3.7-flash",
-      }),
-    ).toEqual({
-      index: 0,
-      signature: GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
-    });
-  });
-
-  test("does not stamp when any call already has a signature", () => {
-    expect(
-      unsignedThoughtSignatureFallback(["signed-thought-1", undefined], {
-        model: "gemini-3.7-flash",
-      }),
-    ).toBeUndefined();
-  });
-
-  test("does not stamp for non-Gemini-3 models when a model id is provided", () => {
-    expect(
-      unsignedThoughtSignatureFallback([undefined], { model: "gpt-5.2" }),
-    ).toBeUndefined();
-  });
-
-  test("stamps unsigned calls when no model gate is supplied", () => {
-    expect(unsignedThoughtSignatureFallback([undefined])).toEqual({
-      index: 0,
-      signature: GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
-    });
-  });
-
-  test("does not stamp an empty function-call list", () => {
-    expect(
-      unsignedThoughtSignatureFallback([], { model: "gemini-3.7-flash" }),
-    ).toBeUndefined();
-  });
-});

package/src/providers/gemini-thought-signature.ts

@@ -1,44 +0,0 @@
-/**
- * Gemini 3.x requires a thought signature on the first function-call part of
- * each step. When history has no captured signature (unsigned tool_use from an
- * earlier provider, or a client-injected call), Google documents these dummy
- * values to skip validation.
- */
-export const GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE =
-  "context_engineering_is_the_way_to_go";
-
-/**
- * True for Gemini 3.x model ids, including the native `models/` prefix and
- * OpenAI-compatible catalog prefixes such as `google/gemini-3.7-flash`.
- */
-export function isGemini3Model(model: string): boolean {
-  if (model.startsWith("gemini-3") || model.startsWith("models/gemini-3")) {
-    return true;
-  }
-  return /\/gemini-3/.test(model);
-}
-
-/**
- * Decide whether unsigned function-call history should receive Google's
- * documented dummy thought signature. Returns the first call's index when
- * every call is unsigned. Pass `model` to restrict this to Gemini 3.x;
- * omit it for retry backfills that already observed a thought-signature 4xx.
- */
-export function unsignedThoughtSignatureFallback(
-  signatures: ReadonlyArray<string | undefined | null>,
-  options?: { model?: string },
-): { index: 0; signature: string } | undefined {
-  if (options?.model !== undefined && !isGemini3Model(options.model)) {
-    return undefined;
-  }
-  if (signatures.length === 0) {
-    return undefined;
-  }
-  if (signatures.some((signature) => Boolean(signature))) {
-    return undefined;
-  }
-  return {
-    index: 0,
-    signature: GEMINI_3_UNSIGNED_TOOL_CALL_THOUGHT_SIGNATURE,
-  };
-}

package/src/providers/inference/service-account-token.ts

@@ -1,248 +0,0 @@
-/**
- * Token acquisition for Google service-account credentials (Vertex AI).
- *
- * Reads the service-account JSON from the vault, signs a short-lived JWT
- * with RS256, and exchanges it for a bearer access token at the token_uri
- * embedded in the key file. Caches the resulting token and its expiry as a
- * single JSON blob in the vault so the write is treated as one unit.
- *
- * A per-credential mutex prevents concurrent callers for the same credential
- * from racing to refresh. Callers for different credentials are independent.
- */
-
-import { createSign } from "node:crypto";
-
-import {
-  getSecureKeyAsync as _realGetKey,
-  setSecureKeyAsync as _realSetKey,
-} from "../../security/secure-keys.js";
-import { getLogger } from "../../util/logger.js";
-
-// Mutable references — swapped in tests via _injectVaultAccessors so tests
-// never need mock.module (which contaminates the entire bun worker process).
-let _getKey: typeof _realGetKey = _realGetKey;
-let _setKey: typeof _realSetKey = _realSetKey;
-
-const log = getLogger("service-account-token");
-
-/** Refresh 5 minutes before expiry to avoid using a nearly-expired token. */
-const REFRESH_MARGIN_SECONDS = 300;
-
-/** Google Cloud Platform scope required for Vertex AI inference. */
-const GCP_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
-
-export interface ServiceAccountKey {
-  client_email: string;
-  private_key: string;
-  token_uri: string;
-}
-
-export type ServiceAccountTokenResult =
-  | { ok: true; token: string }
-  | { ok: false; reason: "not_found" | "invalid_config" | "exchange_failed" };
-
-/**
- * Parse and validate a service-account JSON string.
- * Returns the key object when valid, or null when the JSON is missing, invalid,
- * or lacks required fields (client_email, private_key, token_uri).
- */
-export function parseServiceAccountKey(json: string): ServiceAccountKey | null {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object") {
-    return null;
-  }
-  const key = parsed as Record<string, unknown>;
-  if (
-    typeof key["client_email"] !== "string" ||
-    !key["client_email"] ||
-    typeof key["private_key"] !== "string" ||
-    !key["private_key"] ||
-    typeof key["token_uri"] !== "string" ||
-    !key["token_uri"]
-  ) {
-    return null;
-  }
-  // All required fields validated as non-empty strings above.
-  return parsed as ServiceAccountKey;
-}
-
-/** Per-credential in-flight mutex. Prevents concurrent exchange races per account. */
-const exchangesInFlight = new Map<string, Promise<ServiceAccountTokenResult>>();
-
-/**
- * Return a valid bearer access token for a Google service account, fetching
- * and caching one if the stored token is absent or about to expire.
- *
- * @param credential - Vault key under which the service-account JSON is stored
- *   (e.g. `"credential/my-vertex-ai"`). The derived token is cached as a JSON
- *   blob at `<credential>/token_cache`.
- */
-export async function getValidServiceAccountToken(
-  credential: string,
-): Promise<ServiceAccountTokenResult> {
-  const cacheKey = `${credential}/token_cache`;
-  const cached = await _getKey(cacheKey);
-  if (cached) {
-    try {
-      const blob = JSON.parse(cached) as {
-        access_token?: string;
-        expires_at?: number;
-      };
-      if (blob.access_token) {
-        if (!blob.expires_at) {
-          return { ok: true, token: blob.access_token };
-        }
-        const now = Date.now() / 1000;
-        if (now < blob.expires_at - REFRESH_MARGIN_SECONDS) {
-          return { ok: true, token: blob.access_token };
-        }
-      }
-    } catch {
-      // Corrupted cache entry — fall through to re-exchange.
-    }
-  }
-
-  const inFlight = exchangesInFlight.get(credential);
-  if (inFlight) {
-    return await inFlight;
-  }
-
-  const promise = doExchange(credential, cacheKey);
-  exchangesInFlight.set(credential, promise);
-  try {
-    return await promise;
-  } finally {
-    exchangesInFlight.delete(credential);
-  }
-}
-
-async function doExchange(
-  credential: string,
-  cacheKey: string,
-): Promise<ServiceAccountTokenResult> {
-  const keyJson = await _getKey(credential);
-  if (!keyJson) {
-    return { ok: false, reason: "not_found" };
-  }
-
-  const key = parseServiceAccountKey(keyJson);
-  if (!key) {
-    log.error(
-      { credential },
-      "Service account credential is not valid JSON or missing required fields",
-    );
-    return { ok: false, reason: "invalid_config" };
-  }
-
-  const jwt = buildJwt(key.client_email, key.private_key, key.token_uri);
-
-  let accessToken: string;
-  let expiresIn: number;
-  try {
-    const resp = await fetch(key.token_uri, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-        assertion: jwt,
-      }).toString(),
-    });
-
-    if (!resp.ok) {
-      const body = await resp.text();
-      log.error(
-        { status: resp.status, body, credential },
-        "Service account token exchange failed",
-      );
-      return { ok: false, reason: "exchange_failed" };
-    }
-
-    const data = (await resp.json()) as {
-      access_token?: string;
-      expires_in?: number;
-    };
-
-    if (!data.access_token) {
-      log.error({ credential }, "Token exchange response missing access_token");
-      return { ok: false, reason: "exchange_failed" };
-    }
-
-    accessToken = data.access_token;
-    expiresIn = data.expires_in ?? 3600;
-  } catch (err) {
-    log.error({ err, credential }, "Service account token exchange threw");
-    return { ok: false, reason: "exchange_failed" };
-  }
-
-  const newExpiresAt = Math.floor(Date.now() / 1000 + expiresIn);
-  const ok = await _setKey(
-    cacheKey,
-    JSON.stringify({ access_token: accessToken, expires_at: newExpiresAt }),
-  );
-  if (!ok) {
-    log.warn(
-      { credential },
-      "Failed to cache service account token — token still valid for this request",
-    );
-  } else {
-    log.info({ credential }, "Service account token exchanged and cached");
-  }
-  return { ok: true, token: accessToken };
-}
-
-function buildJwt(
-  clientEmail: string,
-  privateKey: string,
-  tokenUri: string,
-): string {
-  const now = Math.floor(Date.now() / 1000);
-  const header = Buffer.from(
-    JSON.stringify({ alg: "RS256", typ: "JWT" }),
-  ).toString("base64url");
-  const payload = Buffer.from(
-    JSON.stringify({
-      iss: clientEmail,
-      scope: GCP_SCOPE,
-      aud: tokenUri,
-      exp: now + 3600,
-      iat: now,
-    }),
-  ).toString("base64url");
-
-  const signingInput = `${header}.${payload}`;
-  const sign = createSign("SHA256");
-  sign.update(signingInput);
-  sign.end();
-  const signature = sign.sign(privateKey, "base64url");
-
-  return `${signingInput}.${signature}`;
-}
-
-// ---------------------------------------------------------------------------
-// Test helpers
-// ---------------------------------------------------------------------------
-
-/** @internal Test-only: reset all in-flight exchange mutexes. */
-export function _resetServiceAccountMutex(): void {
-  exchangesInFlight.clear();
-}
-
-/** @internal Test-only: swap vault accessors so tests never need mock.module. */
-export function _injectVaultAccessors(
-  get: typeof _realGetKey,
-  set: typeof _realSetKey,
-): void {
-  _getKey = get;
-  _setKey = set;
-}
-
-/** @internal Test-only: restore real vault accessors. */
-export function _resetVaultAccessors(): void {
-  _getKey = _realGetKey;
-  _setKey = _realSetKey;
-}