@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/workspace/git-porcelain.ts

@@ -0,0 +1,66 @@
+/**
+ * NUL-terminated `git status --porcelain -z` parsing.
+ *
+ * Status reporting and batched staging share this parser so rename/copy
+ * origin paths cannot drift between the two readers.
+ */
+
+export interface PorcelainEntry {
+  /** Two-character XY status from porcelain v1. */
+  status: string;
+  /** Path git reports for this record (the destination for rename/copy). */
+  path: string;
+  /** Pre-rename/copy path. Present when the record is a rename or copy. */
+  origin?: string;
+}
+
+/**
+ * Parse NUL-terminated `git status --porcelain -z` output into status/path
+ * records. NUL termination is required so paths with special characters
+ * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
+ *
+ * A rename/copy record is followed by a bare origin-path entry, captured on
+ * {@link PorcelainEntry.origin}.
+ */
+export function parsePorcelainZ(stdout: string): PorcelainEntry[] {
+  const entries = stdout.split("\0");
+  const parsed: PorcelainEntry[] = [];
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i] ?? "";
+    if (entry.length < 4) {
+      continue;
+    }
+    const status = entry.substring(0, 2);
+    const path = entry.substring(3);
+    if (status[0] === "R" || status[0] === "C") {
+      i++;
+      const origin = entries[i];
+      if (origin && origin.length > 0) {
+        parsed.push({ status, path, origin });
+        continue;
+      }
+    }
+    parsed.push({ status, path });
+  }
+  return parsed;
+}
+
+/**
+ * Every path git status knows about, including rename/copy origins.
+ * Origins still need to be staged so a deletion is not left behind when a
+ * rename is split across add batches.
+ */
+export function collectDirtyPathsFromPorcelain(stdout: string): string[] {
+  const paths: string[] = [];
+  const seen = new Set<string>();
+  for (const entry of parsePorcelainZ(stdout)) {
+    for (const path of [entry.path, entry.origin]) {
+      if (!path || seen.has(path)) {
+        continue;
+      }
+      seen.add(path);
+      paths.push(path);
+    }
+  }
+  return paths;
+}

package/src/workspace/git-service.ts

@@ -17,6 +17,10 @@ import { getLogger } from "../util/logger.js";
 import { Mutex } from "../util/mutex.js";
 import { addToPathEnv, getExtraToolPathDirs } from "../util/platform.js";
 import { PromiseGuard } from "../util/promise-guard.js";
+import {
+  collectDirtyPathsFromPorcelain,
+  parsePorcelainZ,
+} from "./git-porcelain.js";
 
 const execFileAsync = promisify(execFile);
 const log = getLogger("workspace-git");
@@ -51,7 +55,7 @@ function cleanGitEnv(workspaceDir: string): Record<string, string> {
  * Patterns excluded from workspace git tracking.
  * These are written to .gitignore on init and appended to existing .gitignore files.
  */
-const WORKSPACE_GITIGNORE_RULES = [
+export const WORKSPACE_GITIGNORE_RULES = [
   // Runtime state directories
   "data/db/",
   "data/qdrant/",
@@ -226,59 +230,6 @@ done
 exit 0
 `;
 
-/**
- * Parse NUL-terminated `git status --porcelain -z` output into status/path
- * pairs. NUL termination is required so paths with special characters
- * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
- * A rename/copy record is followed by a bare origin-path entry, which is
- * skipped.
- */
-function parsePorcelainZ(
-  stdout: string,
-): Array<{ status: string; path: string }> {
-  const entries = stdout.split("\0");
-  const parsed: Array<{ status: string; path: string }> = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    parsed.push({ status, path: entry.substring(3) });
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-    }
-  }
-  return parsed;
-}
-
-/**
- * Every path git status knows about, including rename/copy origins.
- * Origins are skipped by {@link parsePorcelainZ} (they have no status
- * prefix) but still need to be staged so a deletion is not left behind
- * when a rename is split across add batches.
- */
-function collectDirtyPathsFromPorcelain(stdout: string): string[] {
-  const entries = stdout.split("\0");
-  const paths: string[] = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    paths.push(entry.substring(3));
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-      const origin = entries[i];
-      if (origin && origin.length > 0) {
-        paths.push(origin);
-      }
-    }
-  }
-  return paths;
-}
-
 /** Properties added by Node's child_process errors. */
 interface ExecError extends Error {
   killed?: boolean;
@@ -433,7 +384,7 @@ export class WorkspaceGitService {
    *
    * This method is always called inside the mutex, so no git operation from
    * our code can be concurrently holding the lock. However, an external git
-   * process (user running `git add`, IDE tooling, etc.) could legitimately
+   * git process (user running `git add`, IDE tooling, etc.) could legitimately
    * hold the lock. We use `lsof` to check — if any process has the file
    * open, we leave it alone. If no process holds it, it's stale (crashed
    * process) and safe to remove.

package/src/workspace/migrations/154-repair-retired-codex-gpt-5-4-model-ids.ts

@@ -0,0 +1,258 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair `gpt-5.4` and `gpt-5.4-mini` pins on fragments that dispatch
+ * through the ChatGPT subscription.
+ *
+ * OpenAI serves neither model under ChatGPT sign-in: the Codex endpoint
+ * rejects them with HTTP 400 ("not supported when using Codex with a
+ * ChatGPT account"), so both are out of `CODEX_SUBSCRIPTION_MODEL_IDS`.
+ * API-key access is unaffected, so a fragment on any other route keeps
+ * its model.
+ *
+ * Two stored shapes dispatch through the subscription. The `chatgpt`
+ * routing identity fails `LLMSchema.superRefine` once the allowlist drops
+ * the model, and the loader's per-section salvage then resets the whole
+ * `llm` section, losing every profile and call-site tuning: this is the
+ * repair that prevents data loss. A profile bound to the subscription row
+ * (row kind `chatgpt`, or an `oauth_subscription` auth on the
+ * pre-DB-migration-366 row shape) bypasses the auto-resolution compat
+ * gate and 400s on every request; the row is named by the legacy
+ * `provider_connection` binding when present (dispatch honors it first,
+ * and the name is only ever a row name), otherwise by an entry-name
+ * `provider`. Both shapes are swept in `llm.default`, `llm.callSites.*`,
+ * and `llm.profiles.*`; call-site fragments carry no binding (the schema
+ * strips a raw `provider_connection`), so only their declared provider
+ * counts.
+ *
+ * A providerless call-site pin is deliberately left alone. It overlays
+ * whichever profile wins the site for a turn: on an API-key or managed
+ * winner it still serves the model, and on a subscription winner the
+ * request already fails upstream and keeps failing, with no config loss
+ * either way. Rewriting such pins would change API-key users' model and
+ * price to cover a winner that may never be selected.
+ *
+ * Replacements: `gpt-5.4` becomes `gpt-5.5` (its successor) and
+ * `gpt-5.4-mini` becomes `gpt-5.6-luna` (the subscription's Balanced model;
+ * on the subscription every model bills the same).
+ */
+export const repairRetiredCodexGpt54ModelIdsMigration: WorkspaceMigration = {
+  id: "154-repair-retired-codex-gpt-5-4-model-ids",
+  description:
+    "Repair gpt-5.4 and gpt-5.4-mini pins on ChatGPT-subscription LLM fragments in workspace config",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    // Read outside the parse catch: a transient filesystem error (EIO,
+    // EACCES) must reach the runner so the migration retries, while
+    // malformed JSON is a permanent state this migration cannot repair.
+    const rawText = readFileSync(configPath, "utf-8");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(rawText);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    // Entry rows load lazily: only a stale fragment naming a row needs
+    // them. An unreadable DB then fails the run (retried next boot) rather
+    // than checkpointing a pass that skips entry-bound profiles.
+    let rows: Map<string, boolean> | null | undefined;
+    const isSubscriptionRow = (name: unknown): boolean => {
+      if (typeof name !== "string" || name.length === 0) {
+        return false;
+      }
+      if (rows === undefined) {
+        rows = readConnectionRows(workspaceDir);
+      }
+      if (rows === null) {
+        throw new Error(
+          "provider_connections is not readable; retrying the model-ID repair on the next run",
+        );
+      }
+      return rows.get(name) === true;
+    };
+    // A `provider` value: the identity dispatches to the subscription, a
+    // known vendor never does, and any other value is an entry name.
+    const isSubscriptionProvider = (provider: unknown): boolean =>
+      provider === CHATGPT_IDENTITY ||
+      (typeof provider === "string" &&
+        !KNOWN_PROVIDERS.has(provider) &&
+        isSubscriptionRow(provider));
+    // The binding is authoritative when present, since dispatch honors it
+    // ahead of the declared provider; the identity is repaired regardless
+    // (the schema rejects the pair whatever the binding).
+    const isBound = (fragment: Record<string, unknown>): boolean => {
+      if (fragment.provider === CHATGPT_IDENTITY) {
+        return true;
+      }
+      const binding = fragment.provider_connection;
+      return typeof binding === "string" && binding.length > 0
+        ? isSubscriptionRow(binding)
+        : isSubscriptionProvider(fragment.provider);
+    };
+    const isProviderBound = (fragment: Record<string, unknown>): boolean =>
+      isSubscriptionProvider(fragment.provider);
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default), isBound) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed =
+          repairFragment(readObject(rawConfig), isProviderBound) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile), isBound) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    // Write-then-rename so an interrupted write cannot leave config.json
+    // truncated: a torn in-place write would parse as invalid JSON on the
+    // retry, which the catch above treats as "nothing to do", letting the
+    // runner checkpoint the migration as completed against a corrupt file.
+    const tmpPath = `${configPath}.migration-154.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+  },
+  // The exact-match rewrite is idempotent, so a transient failure (full
+  // disk, I/O error) is safe to retry on later startups.
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the retired model IDs would fail schema
+    // validation once the allowlist no longer carries them.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const CHATGPT_IDENTITY = "chatgpt";
+
+// Frozen snapshot of `KNOWN_LLM_PROVIDERS`: the vendor and identity values
+// that dispatch without a connection row, so none of them is an entry name.
+const KNOWN_PROVIDERS = new Set([
+  "anthropic",
+  "openai",
+  "gemini",
+  "ollama",
+  "fireworks",
+  "openrouter",
+  "vercel-ai-gateway",
+  "openai-compatible",
+  "minimax",
+  "atlascloud",
+  "together",
+  "litellm",
+  "opencode",
+  "baseten",
+  "poolside",
+  "vellum",
+  "chatgpt",
+]);
+
+const REPLACEMENTS: ReadonlyMap<string, string> = new Map([
+  ["gpt-5.4", "gpt-5.5"],
+  ["gpt-5.4-mini", "gpt-5.6-luna"],
+]);
+
+function repairFragment(
+  fragment: Record<string, unknown> | null,
+  isSubscriptionRouted: (fragment: Record<string, unknown>) => boolean,
+): boolean {
+  if (fragment === null || typeof fragment.model !== "string") {
+    return false;
+  }
+  const replacement = REPLACEMENTS.get(fragment.model);
+  if (replacement === undefined) {
+    return false;
+  }
+  if (!isSubscriptionRouted(fragment)) {
+    return false;
+  }
+  fragment.model = replacement;
+  return true;
+}
+
+/**
+ * `provider_connections` row name to whether the row dispatches to the
+ * ChatGPT subscription, or null when the DB or table is not readable. The
+ * caller fails the run on null: entry-name providers must be judged against
+ * real rows, never guessed. An absent DB file is a real state (no rows, so
+ * every entry name is dangling).
+ */
+function readConnectionRows(workspaceDir: string): Map<string, boolean> | null {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    return new Map();
+  }
+  let db: Database;
+  try {
+    db = new Database(dbPath, { readonly: true });
+  } catch {
+    return null;
+  }
+  try {
+    const rows = db
+      .query(`SELECT name, provider, auth FROM provider_connections`)
+      .all() as Array<{ name: string; provider: string; auth: string }>;
+    return new Map(
+      rows.map((row) => [
+        row.name,
+        row.provider === CHATGPT_IDENTITY || isSubscriptionAuth(row.auth),
+      ]),
+    );
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+function isSubscriptionAuth(auth: string): boolean {
+  try {
+    const parsed: unknown = JSON.parse(auth);
+    return (
+      parsed !== null &&
+      typeof parsed === "object" &&
+      (parsed as { type?: unknown }).type === "oauth_subscription"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/155-move-front-model-config-to-voice.ts

@@ -0,0 +1,78 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-155");
+
+/**
+ * Move `liveVoice.frontModel` to `voice.frontModel` in `config.json`.
+ *
+ * The front-door tuning (endpointing budgets and progress narration cadence)
+ * is read by phone calls as well as live voice, so it lives under a
+ * transport-agnostic key. A `voice.frontModel` already present wins field by
+ * field; the `liveVoice` block is removed either way so raw-config saves do
+ * not write it back.
+ */
+export const moveFrontModelConfigToVoiceMigration: WorkspaceMigration = {
+  id: "155-move-front-model-config-to-voice",
+  description: "Move liveVoice.frontModel to voice.frontModel in config.json",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const liveVoice = readObject(config.liveVoice);
+    if (liveVoice === null || !Object.hasOwn(liveVoice, "frontModel")) {
+      return;
+    }
+    const legacy = readObject(liveVoice.frontModel);
+    delete liveVoice.frontModel;
+
+    if (legacy !== null) {
+      const voice = readObject(config.voice) ?? {};
+      const current = readObject(voice.frontModel) ?? {};
+      const legacyProgress = readObject(legacy.progress) ?? {};
+      const currentProgress = readObject(current.progress) ?? {};
+      const merged: Record<string, unknown> = { ...legacy, ...current };
+      if (
+        Object.keys(legacyProgress).length > 0 ||
+        Object.keys(currentProgress).length > 0
+      ) {
+        merged.progress = { ...legacyProgress, ...currentProgress };
+      }
+      voice.frontModel = merged;
+      config.voice = voice;
+    }
+
+    const tmpPath = `${configPath}.migration-155.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+    log.info("Moved liveVoice.frontModel to voice.frontModel in config.json");
+  },
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: the schema reads voice.frontModel and strips unknown
+    // liveVoice keys, so a block moved back is dropped on the next load.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/156-extract-workspace-mcp-json.ts

@@ -0,0 +1,214 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const WORKSPACE_MCP_FILENAME = "mcp.json";
+
+// Inlined Agent Plugins 1.0.0 schema URL so this migration stays
+// self-contained if the production constant later changes or moves.
+const AGENT_PLUGINS_MCP_SCHEMA_URL =
+  "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
+
+const log = getLogger("workspace-migration-156");
+
+/**
+ * Move user-owned MCP servers from `config.json` into a spec-pure
+ * `/workspace/mcp.json`. Presence of a server is what starts it. Headers
+ * that were still on a transport are copied onto the spec entry so the
+ * credential-store migration can lift them on the next MCP reload.
+ */
+export const extractWorkspaceMcpJsonMigration: WorkspaceMigration = {
+  id: "156-extract-workspace-mcp-json",
+  description:
+    "Extract workspace MCP servers from config.json into a spec-pure mcp.json",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    const config = readJsonObject(configPath);
+    if (config === null) {
+      return;
+    }
+
+    if (!Object.hasOwn(config, "mcp")) {
+      return;
+    }
+
+    const extracted = extractSpecServers(config.mcp);
+    const mcpPath = join(workspaceDir, WORKSPACE_MCP_FILENAME);
+    const existing = readExistingMcpServers(mcpPath);
+    const merged: Record<string, unknown> = {
+      ...extracted,
+      ...existing.servers,
+    };
+
+    if (Object.keys(merged).length > 0 || existing.present) {
+      const document = {
+        $schema: existing.schema ?? AGENT_PLUGINS_MCP_SCHEMA_URL,
+        mcpServers: merged,
+      };
+      atomicWrite(mcpPath, document);
+    }
+
+    delete config.mcp;
+    atomicWrite(configPath, config);
+    log.info("Extracted workspace MCP servers into mcp.json");
+  },
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: mcp.json is the store. Putting servers back under
+    // config.json would just be extracted again on the next load.
+  },
+};
+
+function extractSpecServers(mcp: unknown): Record<string, unknown> {
+  const block = readObject(mcp);
+  if (block === null) {
+    return {};
+  }
+
+  const servers: Record<string, unknown> = {};
+  const rawServers = block.servers;
+  if (Array.isArray(rawServers)) {
+    for (const entry of rawServers) {
+      const object = readObject(entry);
+      if (object === null) {
+        continue;
+      }
+      const name = object.name;
+      if (typeof name !== "string" || name.trim().length === 0) {
+        continue;
+      }
+      const spec = toSpecServer(object);
+      if (spec !== null) {
+        servers[name] = spec;
+      }
+    }
+    return servers;
+  }
+
+  const serverMap = readObject(rawServers);
+  if (serverMap === null) {
+    return {};
+  }
+  for (const [id, entry] of Object.entries(serverMap)) {
+    if (id.trim().length === 0) {
+      continue;
+    }
+    const object = readObject(entry);
+    if (object === null) {
+      continue;
+    }
+    const spec = toSpecServer(object);
+    if (spec !== null) {
+      servers[id] = spec;
+    }
+  }
+  return servers;
+}
+
+function toSpecServer(entry: Record<string, unknown>): Record<string, unknown> | null {
+  const transport = readObject(entry.transport);
+  if (transport === null) {
+    return null;
+  }
+  const type = transport.type;
+  if (type === "stdio") {
+    if (typeof transport.command !== "string" || transport.command.length === 0) {
+      return null;
+    }
+    const spec: Record<string, unknown> = {
+      type: "stdio",
+      command: transport.command,
+    };
+    if (
+      Array.isArray(transport.args) &&
+      transport.args.length > 0 &&
+      transport.args.every((arg) => typeof arg === "string")
+    ) {
+      spec.args = transport.args;
+    }
+    const env = readStringRecord(transport.env);
+    if (env !== null) {
+      spec.env = env;
+    }
+    return spec;
+  }
+  if (type === "sse" || type === "streamable-http" || type === "http") {
+    if (typeof transport.url !== "string" || transport.url.length === 0) {
+      return null;
+    }
+    const spec: Record<string, unknown> = {
+      type: type === "http" ? "streamable-http" : type,
+      url: transport.url,
+    };
+    const headers = readStringRecord(transport.headers);
+    if (headers !== null) {
+      spec.headers = headers;
+    }
+    return spec;
+  }
+  return null;
+}
+
+function readExistingMcpServers(path: string): {
+  present: boolean;
+  schema?: string;
+  servers: Record<string, unknown>;
+} {
+  if (!existsSync(path)) {
+    return { present: false, servers: {} };
+  }
+  const document = readJsonObject(path);
+  if (document === null) {
+    return { present: true, servers: {} };
+  }
+  const servers = readObject(document.mcpServers);
+  return {
+    present: true,
+    schema:
+      typeof document.$schema === "string" ? document.$schema : undefined,
+    servers: servers ?? {},
+  };
+}
+
+function readJsonObject(path: string): Record<string, unknown> | null {
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    return readObject(raw);
+  } catch {
+    return null;
+  }
+}
+
+function atomicWrite(path: string, value: unknown): void {
+  const tmpPath = `${path}.migration-156.tmp`;
+  writeFileSync(tmpPath, JSON.stringify(value, null, 2) + "\n");
+  renameSync(tmpPath, path);
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}
+
+function readStringRecord(value: unknown): Record<string, string> | null {
+  const object = readObject(value);
+  if (object === null) {
+    return null;
+  }
+  const result: Record<string, string> = {};
+  for (const [key, entry] of Object.entries(object)) {
+    if (typeof entry !== "string") {
+      return null;
+    }
+    result[key] = entry;
+  }
+  return Object.keys(result).length > 0 ? result : null;
+}