@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/persistence/conversation-title-service.ts

@@ -8,6 +8,7 @@
  */
 
 import { SEND_USER_MESSAGE_DELIVERED_ACK } from "../config/send-user-message-constants.js";
+import { MESSAGE_KEYS } from "../i18n/index.js";
 import {
   requestShortLabel,
   type ShortLabelTool,
@@ -24,8 +25,11 @@ import {
   type MessageRow,
   updateConversationTitle,
 } from "./conversation-crud.js";
+import { isReplaceableTitle } from "./conversation-title-placeholders.js";
 import { projectPersistedAssistantContent } from "./user-facing-content.js";
 
+export { isReplaceableTitle } from "./conversation-title-placeholders.js";
+
 const log = getLogger("conversation-title-service");
 
 // ── Types ────────────────────────────────────────────────────────────
@@ -65,8 +69,8 @@ export interface TitleContext {
 
 // ── Placeholder / loading state ──────────────────────────────────────
 
-export const GENERATING_TITLE = "Generating title...";
-const UNTITLED_FALLBACK = "Untitled Conversation";
+export const GENERATING_TITLE = MESSAGE_KEYS.CONVERSATION_TITLE_GENERATING;
+const UNTITLED_FALLBACK = MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED;
 
 // ── `conversations.isAutoTitle` values ───────────────────────────────
 //
@@ -83,28 +87,6 @@ export const AUTO_TITLE_LLM = 1;
  */
 export const AUTO_TITLE_DETERMINISTIC = 2;
 
-// ── Replaceability check ─────────────────────────────────────────────
-
-const REPLACEABLE_PATTERNS = [
-  /^Runtime:\s/,
-  /^New Conversation$/,
-  /^Untitled$/,
-  /^Untitled Conversation$/,
-  /^Generating title\.\.\.$/,
-];
-
-/**
- * Check whether a title is a system-generated placeholder that can be
- * safely overwritten by auto-generated titles. Returns `false` for
- * user-provided custom titles.
- */
-export function isReplaceableTitle(title: string | null): boolean {
-  if (title == null || title.trim() === "") {
-    return true;
-  }
-  return REPLACEABLE_PATTERNS.some((pattern) => pattern.test(title));
-}
-
 /**
  * Whether auto-generation may overwrite the conversation's current title.
  * True for placeholder/system titles and for deterministic bootstrap titles
@@ -255,7 +237,7 @@ function settleForDeterministicTitle(
  * conversation creation (e.g. 5 new chats in quick succession) fires N
  * concurrent requests that can hit provider rate limits or contend for
  * API capacity, causing later calls to time out and fall back to
- * "Untitled Conversation".
+ * the untitled catalog key.
  *
  * A serial queue ensures at most one title-generation LLM call is
  * in-flight at a time. Each call is lightweight (~1–3 s for a ≤5-word
@@ -289,7 +271,7 @@ export function queueGenerateConversationTitle(
       // Replace loading placeholder with a retryable fallback.
       try {
         const conversation = getConversation(params.conversationId);
-        if (conversation && conversation.title === GENERATING_TITLE) {
+        if (conversation && isReplaceableTitle(conversation.title)) {
           const fallback =
             deriveFallbackTitle(params.context) ?? UNTITLED_FALLBACK;
           updateConversationTitle(
@@ -424,6 +406,7 @@ function buildTitleSystemPrompt(): string {
     "- Think: what would make a scannable sidebar label?",
     "- Do NOT echo back what the user asked you to do",
     "- Do NOT respond to the conversation content",
+    "- Write the title in the same language as the conversation content",
     "- Do NOT assess feasibility or comment on capabilities",
     "- If input is sparse or references external context, extract a topic from the words that ARE present (e.g. 'so about that t-shirt...' → 'T-Shirt Discussion'). Never describe the absence, emptiness, or insufficiency of context — titles like 'Missing Context', 'Unclear Request', 'No Topic' are forbidden",
   ].join("\n");

package/src/persistence/embeddings/qdrant-manager.ts

@@ -33,6 +33,116 @@ const SHUTDOWN_GRACE_MS = 5_000;
 const STDOUT_CAPTURE_LIMIT = 16_384;
 const STDERR_CAPTURE_LIMIT = 4_096;
 
+/**
+ * Which step of a local start failed. `install` covers the download, checksum
+ * and extraction of the binary; `spawn` the OS refusing to run it; `exited`
+ * the process dying before `/readyz` answered; `not_ready` the readiness
+ * deadline passing with the process still alive (or, in external mode, the
+ * remote instance never answering).
+ */
+export type QdrantStartFailureKind =
+  | "install"
+  | "spawn"
+  | "exited"
+  | "not_ready";
+
+/**
+ * A failed `QdrantManager.start()`. The message keeps the captured output for
+ * the log line; the fields carry the same facts in a form a reporter can use
+ * without parsing that message.
+ */
+export class QdrantStartError extends Error {
+  constructor(
+    message: string,
+    readonly kind: QdrantStartFailureKind,
+    readonly exitCode: number | null,
+    readonly stdout: string,
+    readonly stderr: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+    this.name = "QdrantStartError";
+  }
+}
+
+/**
+ * Budget for the `panic` string {@link describeQdrantStartFailure} emits, in
+ * the bytes the telemetry server counts: JSON with every code unit above 0x7E
+ * escaped as `\uXXXX` (see `jsonByteLength` in `telemetry-wire.generated.ts`).
+ * A quarter of `WATCHDOG_DETAIL_MAX_JSON_BYTES`, leaving the other fields and
+ * the event envelope far from the limit that silently drops the event.
+ */
+const PANIC_REPORT_MAX_JSON_BYTES = 1_024;
+
+/**
+ * Longest prefix of `text` whose server-side JSON size fits `maxBytes`. Each
+ * UTF-16 code unit above 0x7E costs six bytes (astral characters two units,
+ * so twelve); quotes, backslashes and control characters cost what
+ * `JSON.stringify` escapes them to. Counting characters instead would let a
+ * non-ASCII reason overshoot the budget six-fold.
+ */
+function truncateToJsonBytes(text: string, maxBytes: number): string {
+  let bytes = 0;
+  for (let i = 0; i < text.length; i++) {
+    const unit = text.charCodeAt(i);
+    bytes += unit > 0x7e ? 6 : JSON.stringify(text[i]).length - 2;
+    if (bytes > maxBytes) {
+      return text.slice(0, i);
+    }
+  }
+  return text;
+}
+
+/** Qdrant's panic hook logs `Panic occurred <location>: <reason>` on stdout. */
+const PANIC_MARKER = "Panic occurred";
+
+/**
+ * Reduce a start failure to the metadata a `watchdog` telemetry event may
+ * carry: the failing step, the exit code, and Qdrant's own one-line reason.
+ *
+ * The reason is engine output, never conversation content, so it is in the
+ * same class as the SQLite `integrity_check` strings `db-integrity-sample.ts`
+ * already reports. The one thing in it that is not pure engine text is the
+ * absolute data directory, which is swapped for a placeholder. The panic hook
+ * prints the reason after the backtrace, so it is everything from the last
+ * marker on; when Qdrant died without panicking (a port collision logs a plain
+ * error) the last stdout line is the best available explanation. Capped by
+ * the server's own byte measure well inside the detail budget. Anything that is not a
+ * {@link QdrantStartError} reports as `unknown`, so a new throw site can never
+ * silently drop the event.
+ */
+export function describeQdrantStartFailure(
+  err: unknown,
+  dataDir: string = getDataDir(),
+): {
+  kind: QdrantStartFailureKind | "unknown";
+  exit_code: number | null;
+  panic: string | null;
+} {
+  if (!(err instanceof QdrantStartError)) {
+    return { kind: "unknown", exit_code: null, panic: null };
+  }
+  const stdout = err.stdout.trim();
+  let reason: string | null = null;
+  if (stdout) {
+    const marker = stdout.lastIndexOf(PANIC_MARKER);
+    reason =
+      marker >= 0
+        ? stdout.slice(marker)
+        : (stdout
+            .split("\n")
+            .filter((line) => line.trim())
+            .at(-1) ?? null);
+  }
+  if (reason) {
+    reason = truncateToJsonBytes(
+      reason.split(dataDir).join("<data>"),
+      PANIC_REPORT_MAX_JSON_BYTES,
+    );
+  }
+  return { kind: err.kind, exit_code: err.exitCode, panic: reason };
+}
+
 export function resolveQdrantReleaseAsset(
   os: NodeJS.Platform,
   cpu: string,
@@ -144,7 +254,11 @@ export class QdrantManager {
 
     const binaryPath = this.getBinaryPath();
     if (!existsSync(binaryPath)) {
-      await this.installBinary(binaryPath);
+      try {
+        await this.installBinary(binaryPath);
+      } catch (err) {
+        throw this.startError(err, "install");
+      }
     }
 
     const spawnPath = this.ensureVellumSymlink(binaryPath);
@@ -154,21 +268,26 @@ export class QdrantManager {
       "Starting Qdrant",
     );
 
-    const proc = Bun.spawn({
-      cmd: [spawnPath],
-      windowsHide: true,
-      env: {
-        ...process.env,
-        QDRANT__SERVICE__HOST: this.host,
-        QDRANT__SERVICE__HTTP_PORT: String(this.port),
-        QDRANT__SERVICE__GRPC_PORT: "0", // disable gRPC
-        QDRANT__TELEMETRY_DISABLED: "true",
-        QDRANT__STORAGE__STORAGE_PATH: this.storagePath,
-        QDRANT__LOG_LEVEL: "WARN",
-      },
-      stdout: "pipe",
-      stderr: "pipe",
-    });
+    let proc: Subprocess<"ignore", "pipe", "pipe">;
+    try {
+      proc = Bun.spawn({
+        cmd: [spawnPath],
+        windowsHide: true,
+        env: {
+          ...process.env,
+          QDRANT__SERVICE__HOST: this.host,
+          QDRANT__SERVICE__HTTP_PORT: String(this.port),
+          QDRANT__SERVICE__GRPC_PORT: "0", // disable gRPC
+          QDRANT__TELEMETRY_DISABLED: "true",
+          QDRANT__STORAGE__STORAGE_PATH: this.storagePath,
+          QDRANT__LOG_LEVEL: "WARN",
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+    } catch (err) {
+      throw this.startError(err, "spawn");
+    }
     this.process = proc;
     this.drainOutputFrom(proc.stdout, proc.stderr);
 
@@ -311,6 +430,24 @@ export class QdrantManager {
     );
   }
 
+  /**
+   * Wrap a failure from a start step in a {@link QdrantStartError}. Errors the
+   * manager already classified pass through untouched.
+   */
+  private startError(err: unknown, kind: QdrantStartFailureKind): Error {
+    if (err instanceof QdrantStartError) {
+      return err;
+    }
+    return new QdrantStartError(
+      err instanceof Error ? err.message : String(err),
+      kind,
+      null,
+      this.stdoutBuffer,
+      this.stderrBuffer,
+      { cause: err },
+    );
+  }
+
   private async waitForReady(): Promise<void> {
     const start = Date.now();
     // Build a single exited-promise once so each race reuses the same handle.
@@ -327,9 +464,13 @@ export class QdrantManager {
 
     const throwOnExit = async (code: number): Promise<never> => {
       await this.outputDrained;
-      throw new Error(
+      throw new QdrantStartError(
         `Qdrant process exited with code ${code} before becoming ready` +
           this.formatCapturedOutput(),
+        "exited",
+        code,
+        this.stdoutBuffer,
+        this.stderrBuffer,
       );
     };
 
@@ -363,9 +504,13 @@ export class QdrantManager {
         await throwOnExit(sleepOutcome.code);
       }
     }
-    throw new Error(
+    throw new QdrantStartError(
       `Qdrant did not become ready within ${this.readyzTimeoutMs}ms at ${this.url}` +
         this.formatCapturedOutput(),
+      "not_ready",
+      null,
+      this.stdoutBuffer,
+      this.stderrBuffer,
     );
   }
 

package/src/persistence/llm-request-log-sink-clickhouse.ts

@@ -30,6 +30,7 @@
  * can never abort a turn.
  */
 import { getConfigReadOnly } from "../config/loader.js";
+import { resolvePlatformAssistantIdOrNull } from "../config/platform-identity.js";
 import type { LlmRequestLogsClickHouseConfig } from "../config/schemas/llm-request-logs.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
@@ -71,7 +72,7 @@ export interface ClickHouseLlmRequestLogSinkDeps {
   resolveUrl?: () => Promise<string | null>;
   /** Override the credential read for `clickhouse:password`. */
   resolvePassword?: () => Promise<string | null>;
-  /** Override the credential read for `vellum:platform_assistant_id`. */
+  /** Override the in-memory platform assistant id. */
   resolveAssistantId?: () => Promise<string | null>;
   /** Override fetch for testing. */
   fetchImpl?: ClickHouseSinkFetch;
@@ -98,8 +99,7 @@ export class ClickHouseLlmRequestLogSink implements LlmRequestLogWriter {
       deps.resolvePassword ??
       (() => readCredentialOrNull("clickhouse", "password"));
     this.resolveAssistantId =
-      deps.resolveAssistantId ??
-      (() => readCredentialOrNull("vellum", "platform_assistant_id"));
+      deps.resolveAssistantId ?? resolvePlatformAssistantIdOrNull;
     this.fetchImpl = deps.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
 

package/src/persistence/llm-request-log-source-clickhouse.ts

@@ -15,6 +15,7 @@
  * than the local source. Acceptable for the "internal use while we
  * finetune prompts" use case; revisit when mirror updates are added.
  */
+import { resolvePlatformAssistantIdOrNull } from "../config/platform-identity.js";
 import type { LlmRequestLogsClickHouseConfig } from "../config/schemas/llm-request-logs.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
@@ -104,7 +105,7 @@ export interface ClickHouseLlmRequestLogSourceDeps {
   resolveUrl?: () => Promise<string | null>;
   /** Override the credential read for `clickhouse:password`. */
   resolvePassword?: () => Promise<string | null>;
-  /** Override the credential read for `vellum:platform_assistant_id`. */
+  /** Override the in-memory platform assistant id. */
   resolveAssistantId?: () => Promise<string | null>;
   /** Override the turn-id resolver (default: `getAssistantMessageIdsInTurn`). */
   resolveTurnMessageIds?: (messageId: string) => string[];
@@ -138,8 +139,7 @@ export class ClickHouseLlmRequestLogSource implements LlmRequestLogSource {
       deps.resolvePassword ??
       (() => readCredentialOrNull("clickhouse", "password"));
     this.resolveAssistantId =
-      deps.resolveAssistantId ??
-      (() => readCredentialOrNull("vellum", "platform_assistant_id"));
+      deps.resolveAssistantId ?? resolvePlatformAssistantIdOrNull;
     this.resolveTurnMessageIds =
       deps.resolveTurnMessageIds ?? getAssistantMessageIdsInTurn;
     this.resolveMessage = deps.resolveMessage ?? getMessageById;

package/src/persistence/message-cursor.ts

@@ -0,0 +1,78 @@
+// ---------------------------------------------------------------------------
+// Message cursors: the "(createdAt, id) after which" reference behind the
+// messages-after reads, resilient to the referenced row being deleted.
+// ---------------------------------------------------------------------------
+//
+// A bare message id bounds a read only while its row exists. A regenerated
+// reply (the conversation retry route discards the latest assistant turn) or a
+// retried turn deletes the row, and a caller holding just the id can no longer
+// say where it sat. A `MessageCursor` carries the row's `createdAt` alongside
+// its id, so the `(createdAt, id)` bound is reconstructible from the cursor
+// alone. The live row stays authoritative whenever it exists.
+
+import { eq } from "drizzle-orm";
+
+import type { LineageBound } from "./conversation-lineage.js";
+import { getDb } from "./db-connection.js";
+import { messages } from "./schema/index.js";
+
+export { messagesAfterBoundFilter } from "./conversation-lineage.js";
+
+/**
+ * A `(createdAt, id)` message reference. `createdAt` is null when the holder
+ * never recorded it; such a cursor bounds a read only while its row exists.
+ */
+export interface MessageCursor {
+  readonly id: string;
+  readonly createdAt: number | null;
+}
+
+/**
+ * Accepted "after" references: a message id, a {@link MessageCursor}, or
+ * null. `null`, `""`, and a cursor whose id is `""` all mean "no lower bound".
+ */
+export type MessagesAfterRef = string | MessageCursor | null;
+
+/** Where a messages-after read starts. */
+export type MessagesAfterBound =
+  /** No lower bound: every row the conversation owns. */
+  | { kind: "all" }
+  /** Rows strictly after `bound` in `(createdAt, id)` order. */
+  | { kind: "after"; bound: LineageBound }
+  /**
+   * The referenced row is gone and the reference carried no timestamp, so
+   * the read has no defensible starting point. Readers return nothing.
+   */
+  | { kind: "vanished" };
+
+/** The `(createdAt, id)` bound of a single message, or null when it is gone. */
+export function loadMessageBound(messageId: string): LineageBound | null {
+  const row = getDb()
+    .select({ createdAt: messages.createdAt, id: messages.id })
+    .from(messages)
+    .where(eq(messages.id, messageId))
+    .get();
+  return row ?? null;
+}
+
+/**
+ * Resolve an "after" reference to the bound a read filters on. A live row
+ * wins; a cursor whose row is gone falls back to the `createdAt` it carries,
+ * paired with its id so same-millisecond neighbours keep their order.
+ */
+export function resolveMessagesAfterBound(
+  after: MessagesAfterRef,
+): MessagesAfterBound {
+  const id = typeof after === "string" ? after : (after?.id ?? "");
+  if (id === "") {
+    return { kind: "all" };
+  }
+  const live = loadMessageBound(id);
+  if (live) {
+    return { kind: "after", bound: live };
+  }
+  if (typeof after === "object" && after !== null && after.createdAt !== null) {
+    return { kind: "after", bound: { createdAt: after.createdAt, id } };
+  }
+  return { kind: "vanished" };
+}

package/src/persistence/message-reads.ts

@@ -190,6 +190,36 @@ export function existingMessageIds(
   );
 }
 
+/**
+ * `createdAt` of each of `messageIds` that exists as a row, keyed by id, in
+ * any state.
+ *
+ * Any-state deliberately: a row's `createdAt` is fixed at insert, so its
+ * completeness does not change the answer, and the callers (retrospective
+ * cursor bookkeeping) hold ids taken from rows they have already reviewed.
+ * An empty input returns an empty map without querying.
+ */
+export function messageCreatedAtByIds(
+  messageIds: readonly string[],
+  opts?: { db?: MessageReadHandle },
+): Map<string, number> {
+  const db = opts?.db ?? getDb();
+  const result = new Map<string, number>();
+  // Chunked so a whole-conversation id list stays under SQLite's bound
+  // parameter limit.
+  for (let offset = 0; offset < messageIds.length; offset += 500) {
+    const rows = db
+      .select({ id: messages.id, createdAt: messages.createdAt })
+      .from(messages)
+      .where(inArray(messages.id, messageIds.slice(offset, offset + 500)))
+      .all();
+    for (const row of rows) {
+      result.set(row.id, row.createdAt);
+    }
+  }
+  return result;
+}
+
 /**
  * The conversation that owns `messageId`, in any state, or null when the
  * message does not exist.

package/src/persistence/migrations/157-invite-contact-id.ts

@@ -1,4 +1,5 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+import { tableExists } from "./schema-introspection.js";
 
 /**
  * Add a required contact_id column to assistant_ingress_invites.
@@ -10,8 +11,16 @@ import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
  *  1. Add the column as nullable.
  *  2. Delete legacy rows that have no contact binding (NULL).
  *  3. Rebuild the table to enforce NOT NULL (SQLite cannot ALTER COLUMN).
+ *
+ * The rebuild copies whichever session-id column is live:
+ * `source_conversation_id` (after migrateRenameCreatedBySessionIdColumns)
+ * or `created_by_session_id`.
  */
 export function migrateInviteContactId(database: DrizzleDb): void {
+  if (!tableExists(database, "assistant_ingress_invites")) {
+    return;
+  }
+
   const raw = getSqliteFrom(database);
 
   const cols = (
@@ -20,25 +29,28 @@ export function migrateInviteContactId(database: DrizzleDb): void {
       notnull: number;
     }>
   ).map((c) => ({ name: c.name, notnull: c.notnull }));
+  const colNames = new Set(cols.map((c) => c.name));
 
   const col = cols.find((c) => c.name === "contact_id");
 
-  // Step 1: Add the column as nullable
   if (!col) {
     raw.exec(
       /*sql*/ `ALTER TABLE assistant_ingress_invites ADD COLUMN contact_id TEXT`,
     );
   }
 
-  // Step 2: Delete legacy rows with no contact binding
   raw.exec(
     /*sql*/ `DELETE FROM assistant_ingress_invites WHERE contact_id IS NULL OR contact_id = ''`,
   );
 
-  // Step 3: Rebuild the table with NOT NULL on contact_id
   if (col && col.notnull === 1) {
     return;
-  } // already NOT NULL
+  }
+
+  const sessionCol = colNames.has("source_conversation_id")
+    ? "source_conversation_id"
+    : "created_by_session_id";
+  const sessionSelect = colNames.has(sessionCol) ? sessionCol : "NULL";
 
   raw.exec("PRAGMA foreign_keys = OFF");
   try {
@@ -49,7 +61,7 @@ export function migrateInviteContactId(database: DrizzleDb): void {
           id TEXT PRIMARY KEY,
           source_channel TEXT NOT NULL,
           token_hash TEXT NOT NULL,
-          created_by_session_id TEXT,
+          ${sessionCol} TEXT,
           note TEXT,
           max_uses INTEGER NOT NULL DEFAULT 1 CHECK (max_uses > 0),
           use_count INTEGER NOT NULL DEFAULT 0 CHECK (use_count >= 0),
@@ -70,7 +82,7 @@ export function migrateInviteContactId(database: DrizzleDb): void {
         );
 
         INSERT INTO assistant_ingress_invites_new
-        SELECT id, source_channel, token_hash, created_by_session_id, note,
+        SELECT id, source_channel, token_hash, ${sessionSelect}, note,
                max_uses, use_count, expires_at, status,
                redeemed_by_external_user_id, redeemed_by_external_chat_id,
                redeemed_at, expected_external_user_id, voice_code_hash,