@vellumai/assistant 0.12.1-dev.202609141913.5e16607 → 0.12.1-staging.2

package/src/tools/acp/status.test.ts

@@ -1,94 +0,0 @@
-/**
- * Tests for the `acp_status` tool's projection of session state.
- *
- * The state the manager tracks feeds three surfaces with different budgets:
- * the HTTP route, the SSE picker, and this tool, whose output is spent on
- * LLM context. Only the fields an agent can act on belong here.
- */
-
-import { describe, expect, mock, test } from "bun:test";
-
-import type { AcpSessionState } from "../../acp/types.js";
-import type { ToolContext } from "../types.js";
-
-const RUNNING_STATE: AcpSessionState = {
-  id: "acp-1",
-  agentId: "claude",
-  acpSessionId: "proto-1",
-  parentConversationId: "conv-1",
-  status: "running",
-  startedAt: 1234,
-  task: "refactor the parser",
-  model: "claude-opus-4-5",
-  availableModels: [
-    { value: "sonnet", label: "Sonnet" },
-    { value: "opus", label: "Opus", description: "Most capable" },
-  ],
-};
-
-let statusResult: AcpSessionState | AcpSessionState[] = RUNNING_STATE;
-
-const realAcpModule = await import("../../acp/index.js");
-mock.module("../../acp/index.js", () => ({
-  ...realAcpModule,
-  getAcpSessionManager: () => ({ getStatus: () => statusResult }),
-}));
-
-const { executeAcpStatus } = await import("./status.js");
-
-const context = {
-  conversationId: "conv-1",
-  workingDir: "/tmp",
-} as unknown as ToolContext;
-
-describe("executeAcpStatus", () => {
-  test("a single session reports its model but not the picker", async () => {
-    statusResult = RUNNING_STATE;
-
-    const result = await executeAcpStatus({ acp_session_id: "acp-1" }, context);
-
-    expect(result.isError).toBe(false);
-    const payload = JSON.parse(result.content);
-    expect(payload).toEqual({
-      id: "acp-1",
-      agentId: "claude",
-      acpSessionId: "proto-1",
-      parentConversationId: "conv-1",
-      status: "running",
-      startedAt: 1234,
-      task: "refactor the parser",
-      model: "claude-opus-4-5",
-    });
-    expect(result.content).not.toContain("Most capable");
-  });
-
-  test("the listing drops the picker from every entry", async () => {
-    statusResult = [
-      RUNNING_STATE,
-      { ...RUNNING_STATE, id: "acp-2", model: "sonnet" },
-    ];
-
-    const result = await executeAcpStatus({}, context);
-
-    const payload = JSON.parse(result.content) as Array<
-      Record<string, unknown>
-    >;
-    expect(payload).toHaveLength(2);
-    expect(payload.map((entry) => entry.model)).toEqual([
-      "claude-opus-4-5",
-      "sonnet",
-    ]);
-    for (const entry of payload) {
-      expect(entry).not.toHaveProperty("availableModels");
-    }
-  });
-
-  test("an empty listing says so rather than rendering an empty array", async () => {
-    statusResult = [];
-
-    const result = await executeAcpStatus({}, context);
-
-    expect(result.content).toBe("No ACP sessions found.");
-    expect(result.isError).toBe(false);
-  });
-});

package/src/tools/terminal/__tests__/sanitized-bash.test.ts

@@ -1,57 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-
-import { runSanitizedBash } from "../sanitized-bash.js";
-
-describe("runSanitizedBash", () => {
-  const priorToken = process.env.CES_SERVICE_TOKEN;
-  const priorSocket = process.env.CES_LOCAL_SOCKET;
-
-  afterEach(() => {
-    if (priorToken == null) {
-      delete process.env.CES_SERVICE_TOKEN;
-    } else {
-      process.env.CES_SERVICE_TOKEN = priorToken;
-    }
-    if (priorSocket == null) {
-      delete process.env.CES_LOCAL_SOCKET;
-    } else {
-      process.env.CES_LOCAL_SOCKET = priorSocket;
-    }
-  });
-
-  test("runs a command and returns stdout", async () => {
-    const result = await runSanitizedBash("echo hello", 5_000);
-    expect(result.error).toBeUndefined();
-    expect(result.timedOut).toBe(false);
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout.trim()).toBe("hello");
-  });
-
-  test("forwards CES_SERVICE_TOKEN to the child", async () => {
-    process.env.CES_SERVICE_TOKEN = "vault-bearer";
-    const result = await runSanitizedBash("printenv CES_SERVICE_TOKEN", 5_000);
-    expect(result.error).toBeUndefined();
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout.trim()).toBe("vault-bearer");
-  });
-
-  test("forwards CES_LOCAL_SOCKET to the child", async () => {
-    process.env.CES_LOCAL_SOCKET = "/tmp/ces.sock";
-    const result = await runSanitizedBash("printenv CES_LOCAL_SOCKET", 5_000);
-    expect(result.error).toBeUndefined();
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout.trim()).toBe("/tmp/ces.sock");
-  });
-
-  test("times out a hung command", async () => {
-    const result = await runSanitizedBash("sleep 5", 200);
-    expect(result.error).toBeUndefined();
-    expect(result.timedOut).toBe(true);
-  });
-
-  test("rejects an empty command", async () => {
-    const result = await runSanitizedBash("");
-    expect(result.error).toBe("command is required");
-    expect(result.exitCode).toBeNull();
-  });
-});

package/src/tools/terminal/sanitized-bash.ts

@@ -1,105 +0,0 @@
-/**
- * Spawn a shell command with the same sanitized environment the bash tool
- * forwards to tool-call subprocesses.
- *
- * Used by `assistant bash` so a CLI invocation sees the same allowlisted
- * env, workspace cwd, and platform shell as a bash tool call, without
- * round-tripping through the assistant HTTP or IPC API.
- */
-
-import { spawn } from "node:child_process";
-
-import {
-  buildShellInvocation,
-  terminateProcessTree,
-} from "../../util/host-process.js";
-import { getWorkspaceDir } from "../../util/platform.js";
-import { buildSanitizedEnv } from "./safe-env.js";
-
-export const DEFAULT_SANITIZED_BASH_TIMEOUT_MS = 30_000;
-
-export interface SanitizedBashResult {
-  stdout: string;
-  stderr: string;
-  exitCode: number | null;
-  timedOut: boolean;
-  error?: string;
-}
-
-export function runSanitizedBash(
-  command: string,
-  timeoutMs: number = DEFAULT_SANITIZED_BASH_TIMEOUT_MS,
-): Promise<SanitizedBashResult> {
-  if (!command) {
-    return Promise.resolve({
-      stdout: "",
-      stderr: "",
-      exitCode: null,
-      timedOut: false,
-      error: "command is required",
-    });
-  }
-
-  const effectiveTimeout =
-    typeof timeoutMs === "number" && timeoutMs > 0
-      ? timeoutMs
-      : DEFAULT_SANITIZED_BASH_TIMEOUT_MS;
-
-  return new Promise<SanitizedBashResult>((resolve) => {
-    const stdoutChunks: Buffer[] = [];
-    const stderrChunks: Buffer[] = [];
-    let timedOut = false;
-    let settled = false;
-
-    const finish = (result: SanitizedBashResult) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      resolve(result);
-    };
-
-    const wrapped = buildShellInvocation(command);
-    const child = spawn(wrapped.command, wrapped.args, {
-      cwd: getWorkspaceDir(),
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: true,
-      env: buildSanitizedEnv(),
-      windowsHide: true,
-    });
-
-    const timer = setTimeout(() => {
-      timedOut = true;
-      terminateProcessTree(child);
-    }, effectiveTimeout);
-
-    child.stdout.on("data", (data: Buffer) => {
-      stdoutChunks.push(data);
-    });
-
-    child.stderr.on("data", (data: Buffer) => {
-      stderrChunks.push(data);
-    });
-
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      finish({
-        stdout: Buffer.concat(stdoutChunks).toString(),
-        stderr: Buffer.concat(stderrChunks).toString(),
-        exitCode: code,
-        timedOut,
-      });
-    });
-
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      finish({
-        stdout: "",
-        stderr: "",
-        exitCode: null,
-        timedOut: false,
-        error: err.message,
-      });
-    });
-  });
-}

package/src/util/ca-bundle.ts

@@ -1,13 +0,0 @@
-import { readFile, writeFile } from "node:fs/promises";
-
-export async function writeCombinedCABundle(
-  systemBundlePath: string,
-  extraCAPath: string,
-  outputPath: string,
-): Promise<void> {
-  const [systemCAs, extraCAs] = await Promise.all([
-    readFile(systemBundlePath, "utf-8"),
-    readFile(extraCAPath, "utf-8"),
-  ]);
-  await writeFile(outputPath, `${systemCAs}\n${extraCAs}`, { mode: 0o644 });
-}

package/src/workspace/git-porcelain.ts

@@ -1,66 +0,0 @@
-/**
- * NUL-terminated `git status --porcelain -z` parsing.
- *
- * Status reporting and batched staging share this parser so rename/copy
- * origin paths cannot drift between the two readers.
- */
-
-export interface PorcelainEntry {
-  /** Two-character XY status from porcelain v1. */
-  status: string;
-  /** Path git reports for this record (the destination for rename/copy). */
-  path: string;
-  /** Pre-rename/copy path. Present when the record is a rename or copy. */
-  origin?: string;
-}
-
-/**
- * Parse NUL-terminated `git status --porcelain -z` output into status/path
- * records. NUL termination is required so paths with special characters
- * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
- *
- * A rename/copy record is followed by a bare origin-path entry, captured on
- * {@link PorcelainEntry.origin}.
- */
-export function parsePorcelainZ(stdout: string): PorcelainEntry[] {
-  const entries = stdout.split("\0");
-  const parsed: PorcelainEntry[] = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    const path = entry.substring(3);
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-      const origin = entries[i];
-      if (origin && origin.length > 0) {
-        parsed.push({ status, path, origin });
-        continue;
-      }
-    }
-    parsed.push({ status, path });
-  }
-  return parsed;
-}
-
-/**
- * Every path git status knows about, including rename/copy origins.
- * Origins still need to be staged so a deletion is not left behind when a
- * rename is split across add batches.
- */
-export function collectDirtyPathsFromPorcelain(stdout: string): string[] {
-  const paths: string[] = [];
-  const seen = new Set<string>();
-  for (const entry of parsePorcelainZ(stdout)) {
-    for (const path of [entry.path, entry.origin]) {
-      if (!path || seen.has(path)) {
-        continue;
-      }
-      seen.add(path);
-      paths.push(path);
-    }
-  }
-  return paths;
-}

package/src/workspace/migrations/154-repair-retired-codex-gpt-5-4-model-ids.ts

@@ -1,258 +0,0 @@
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { Database } from "bun:sqlite";
-
-import type { WorkspaceMigration } from "./types.js";
-
-/**
- * Repair `gpt-5.4` and `gpt-5.4-mini` pins on fragments that dispatch
- * through the ChatGPT subscription.
- *
- * OpenAI serves neither model under ChatGPT sign-in: the Codex endpoint
- * rejects them with HTTP 400 ("not supported when using Codex with a
- * ChatGPT account"), so both are out of `CODEX_SUBSCRIPTION_MODEL_IDS`.
- * API-key access is unaffected, so a fragment on any other route keeps
- * its model.
- *
- * Two stored shapes dispatch through the subscription. The `chatgpt`
- * routing identity fails `LLMSchema.superRefine` once the allowlist drops
- * the model, and the loader's per-section salvage then resets the whole
- * `llm` section, losing every profile and call-site tuning: this is the
- * repair that prevents data loss. A profile bound to the subscription row
- * (row kind `chatgpt`, or an `oauth_subscription` auth on the
- * pre-DB-migration-366 row shape) bypasses the auto-resolution compat
- * gate and 400s on every request; the row is named by the legacy
- * `provider_connection` binding when present (dispatch honors it first,
- * and the name is only ever a row name), otherwise by an entry-name
- * `provider`. Both shapes are swept in `llm.default`, `llm.callSites.*`,
- * and `llm.profiles.*`; call-site fragments carry no binding (the schema
- * strips a raw `provider_connection`), so only their declared provider
- * counts.
- *
- * A providerless call-site pin is deliberately left alone. It overlays
- * whichever profile wins the site for a turn: on an API-key or managed
- * winner it still serves the model, and on a subscription winner the
- * request already fails upstream and keeps failing, with no config loss
- * either way. Rewriting such pins would change API-key users' model and
- * price to cover a winner that may never be selected.
- *
- * Replacements: `gpt-5.4` becomes `gpt-5.5` (its successor) and
- * `gpt-5.4-mini` becomes `gpt-5.6-luna` (the subscription's Balanced model;
- * on the subscription every model bills the same).
- */
-export const repairRetiredCodexGpt54ModelIdsMigration: WorkspaceMigration = {
-  id: "154-repair-retired-codex-gpt-5-4-model-ids",
-  description:
-    "Repair gpt-5.4 and gpt-5.4-mini pins on ChatGPT-subscription LLM fragments in workspace config",
-  run(workspaceDir: string): void {
-    const configPath = join(workspaceDir, "config.json");
-    if (!existsSync(configPath)) {
-      return;
-    }
-
-    // Read outside the parse catch: a transient filesystem error (EIO,
-    // EACCES) must reach the runner so the migration retries, while
-    // malformed JSON is a permanent state this migration cannot repair.
-    const rawText = readFileSync(configPath, "utf-8");
-
-    let config: Record<string, unknown>;
-    try {
-      const raw = JSON.parse(rawText);
-      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        return;
-      }
-      config = raw as Record<string, unknown>;
-    } catch {
-      return;
-    }
-
-    const llm = readObject(config.llm);
-    if (llm === null) {
-      return;
-    }
-
-    // Entry rows load lazily: only a stale fragment naming a row needs
-    // them. An unreadable DB then fails the run (retried next boot) rather
-    // than checkpointing a pass that skips entry-bound profiles.
-    let rows: Map<string, boolean> | null | undefined;
-    const isSubscriptionRow = (name: unknown): boolean => {
-      if (typeof name !== "string" || name.length === 0) {
-        return false;
-      }
-      if (rows === undefined) {
-        rows = readConnectionRows(workspaceDir);
-      }
-      if (rows === null) {
-        throw new Error(
-          "provider_connections is not readable; retrying the model-ID repair on the next run",
-        );
-      }
-      return rows.get(name) === true;
-    };
-    // A `provider` value: the identity dispatches to the subscription, a
-    // known vendor never does, and any other value is an entry name.
-    const isSubscriptionProvider = (provider: unknown): boolean =>
-      provider === CHATGPT_IDENTITY ||
-      (typeof provider === "string" &&
-        !KNOWN_PROVIDERS.has(provider) &&
-        isSubscriptionRow(provider));
-    // The binding is authoritative when present, since dispatch honors it
-    // ahead of the declared provider; the identity is repaired regardless
-    // (the schema rejects the pair whatever the binding).
-    const isBound = (fragment: Record<string, unknown>): boolean => {
-      if (fragment.provider === CHATGPT_IDENTITY) {
-        return true;
-      }
-      const binding = fragment.provider_connection;
-      return typeof binding === "string" && binding.length > 0
-        ? isSubscriptionRow(binding)
-        : isSubscriptionProvider(fragment.provider);
-    };
-    const isProviderBound = (fragment: Record<string, unknown>): boolean =>
-      isSubscriptionProvider(fragment.provider);
-
-    let changed = false;
-
-    changed = repairFragment(readObject(llm.default), isBound) || changed;
-
-    const callSites = readObject(llm.callSites);
-    if (callSites !== null) {
-      for (const rawConfig of Object.values(callSites)) {
-        changed =
-          repairFragment(readObject(rawConfig), isProviderBound) || changed;
-      }
-    }
-
-    const profiles = readObject(llm.profiles);
-    if (profiles !== null) {
-      for (const rawProfile of Object.values(profiles)) {
-        changed = repairFragment(readObject(rawProfile), isBound) || changed;
-      }
-    }
-
-    if (!changed) {
-      return;
-    }
-
-    // Write-then-rename so an interrupted write cannot leave config.json
-    // truncated: a torn in-place write would parse as invalid JSON on the
-    // retry, which the catch above treats as "nothing to do", letting the
-    // runner checkpoint the migration as completed against a corrupt file.
-    const tmpPath = `${configPath}.migration-154.tmp`;
-    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
-    renameSync(tmpPath, configPath);
-  },
-  // The exact-match rewrite is idempotent, so a transient failure (full
-  // disk, I/O error) is safe to retry on later startups.
-  retryFailedCheckpoint: true,
-  down(_workspaceDir: string): void {
-    // Forward-only: reintroducing the retired model IDs would fail schema
-    // validation once the allowlist no longer carries them.
-  },
-};
-
-// ---------------------------------------------------------------------------
-// Helpers: self-contained per workspace migrations AGENTS.md
-// ---------------------------------------------------------------------------
-
-const CHATGPT_IDENTITY = "chatgpt";
-
-// Frozen snapshot of `KNOWN_LLM_PROVIDERS`: the vendor and identity values
-// that dispatch without a connection row, so none of them is an entry name.
-const KNOWN_PROVIDERS = new Set([
-  "anthropic",
-  "openai",
-  "gemini",
-  "ollama",
-  "fireworks",
-  "openrouter",
-  "vercel-ai-gateway",
-  "openai-compatible",
-  "minimax",
-  "atlascloud",
-  "together",
-  "litellm",
-  "opencode",
-  "baseten",
-  "poolside",
-  "vellum",
-  "chatgpt",
-]);
-
-const REPLACEMENTS: ReadonlyMap<string, string> = new Map([
-  ["gpt-5.4", "gpt-5.5"],
-  ["gpt-5.4-mini", "gpt-5.6-luna"],
-]);
-
-function repairFragment(
-  fragment: Record<string, unknown> | null,
-  isSubscriptionRouted: (fragment: Record<string, unknown>) => boolean,
-): boolean {
-  if (fragment === null || typeof fragment.model !== "string") {
-    return false;
-  }
-  const replacement = REPLACEMENTS.get(fragment.model);
-  if (replacement === undefined) {
-    return false;
-  }
-  if (!isSubscriptionRouted(fragment)) {
-    return false;
-  }
-  fragment.model = replacement;
-  return true;
-}
-
-/**
- * `provider_connections` row name to whether the row dispatches to the
- * ChatGPT subscription, or null when the DB or table is not readable. The
- * caller fails the run on null: entry-name providers must be judged against
- * real rows, never guessed. An absent DB file is a real state (no rows, so
- * every entry name is dangling).
- */
-function readConnectionRows(workspaceDir: string): Map<string, boolean> | null {
-  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
-  if (!existsSync(dbPath)) {
-    return new Map();
-  }
-  let db: Database;
-  try {
-    db = new Database(dbPath, { readonly: true });
-  } catch {
-    return null;
-  }
-  try {
-    const rows = db
-      .query(`SELECT name, provider, auth FROM provider_connections`)
-      .all() as Array<{ name: string; provider: string; auth: string }>;
-    return new Map(
-      rows.map((row) => [
-        row.name,
-        row.provider === CHATGPT_IDENTITY || isSubscriptionAuth(row.auth),
-      ]),
-    );
-  } catch {
-    return null;
-  } finally {
-    db.close();
-  }
-}
-
-function isSubscriptionAuth(auth: string): boolean {
-  try {
-    const parsed: unknown = JSON.parse(auth);
-    return (
-      parsed !== null &&
-      typeof parsed === "object" &&
-      (parsed as { type?: unknown }).type === "oauth_subscription"
-    );
-  } catch {
-    return false;
-  }
-}
-
-function readObject(value: unknown): Record<string, unknown> | null {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  return value as Record<string, unknown>;
-}

package/src/workspace/migrations/155-move-front-model-config-to-voice.ts

@@ -1,78 +0,0 @@
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { getLogger } from "../../util/logger.js";
-import type { WorkspaceMigration } from "./types.js";
-
-const log = getLogger("workspace-migration-155");
-
-/**
- * Move `liveVoice.frontModel` to `voice.frontModel` in `config.json`.
- *
- * The front-door tuning (endpointing budgets and progress narration cadence)
- * is read by phone calls as well as live voice, so it lives under a
- * transport-agnostic key. A `voice.frontModel` already present wins field by
- * field; the `liveVoice` block is removed either way so raw-config saves do
- * not write it back.
- */
-export const moveFrontModelConfigToVoiceMigration: WorkspaceMigration = {
-  id: "155-move-front-model-config-to-voice",
-  description: "Move liveVoice.frontModel to voice.frontModel in config.json",
-  run(workspaceDir: string): void {
-    const configPath = join(workspaceDir, "config.json");
-    if (!existsSync(configPath)) {
-      return;
-    }
-
-    let config: Record<string, unknown>;
-    try {
-      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
-      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        return;
-      }
-      config = raw as Record<string, unknown>;
-    } catch {
-      return;
-    }
-
-    const liveVoice = readObject(config.liveVoice);
-    if (liveVoice === null || !Object.hasOwn(liveVoice, "frontModel")) {
-      return;
-    }
-    const legacy = readObject(liveVoice.frontModel);
-    delete liveVoice.frontModel;
-
-    if (legacy !== null) {
-      const voice = readObject(config.voice) ?? {};
-      const current = readObject(voice.frontModel) ?? {};
-      const legacyProgress = readObject(legacy.progress) ?? {};
-      const currentProgress = readObject(current.progress) ?? {};
-      const merged: Record<string, unknown> = { ...legacy, ...current };
-      if (
-        Object.keys(legacyProgress).length > 0 ||
-        Object.keys(currentProgress).length > 0
-      ) {
-        merged.progress = { ...legacyProgress, ...currentProgress };
-      }
-      voice.frontModel = merged;
-      config.voice = voice;
-    }
-
-    const tmpPath = `${configPath}.migration-155.tmp`;
-    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
-    renameSync(tmpPath, configPath);
-    log.info("Moved liveVoice.frontModel to voice.frontModel in config.json");
-  },
-  retryFailedCheckpoint: true,
-  down(_workspaceDir: string): void {
-    // Forward-only: the schema reads voice.frontModel and strips unknown
-    // liveVoice keys, so a block moved back is dropped on the next load.
-  },
-};
-
-function readObject(value: unknown): Record<string, unknown> | null {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  return value as Record<string, unknown>;
-}