@vellumai/assistant 0.12.3 → 0.12.4-staging.2

package/src/runtime/sync/worker-daemon-notify.ts

@@ -31,6 +31,14 @@ export const NOTIFY_CONVERSATION_PERSISTED_IPC_METHOD =
 export const NOTIFY_DOCUMENTS_CHANGED_IPC_METHOD =
   "notify_documents_changed_externally";
 
+/**
+ * IPC method the daemon exposes for the conversation-list hand-off. Shared by
+ * the worker caller and the daemon route registration so the wire name cannot
+ * drift.
+ */
+export const NOTIFY_CONVERSATION_LIST_CHANGED_IPC_METHOD =
+  "notify_conversation_list_changed_externally";
+
 /**
  * IPC method the daemon exposes for the activation-progress hand-off. Shared
  * by the worker caller and the daemon route registration so the wire name
@@ -79,6 +87,42 @@ export async function notifyDaemonConversationPersisted(
   }
 }
 
+/**
+ * Ask the daemon to republish a conversation-list-and-metadata invalidation.
+ *
+ * A worker turn can change which rows the sidebar should hold, not just what
+ * one row contains: clearing `archived_at` on a Done conversation the turn
+ * woke is the case that matters. The list tag has to reach real subscribers
+ * for the conversation to reappear, and the worker's own hub has none.
+ *
+ * Best-effort by design, like the other hand-offs: an unreachable daemon is
+ * logged at debug and swallowed, and the client picks the change up on its
+ * next list fetch.
+ */
+export async function notifyDaemonConversationListChanged(
+  reason: string,
+  conversationIds: string[],
+): Promise<void> {
+  try {
+    const result = await cliIpcCall(
+      NOTIFY_CONVERSATION_LIST_CHANGED_IPC_METHOD,
+      { body: { reason, conversationIds } },
+      { timeoutMs: NOTIFY_TIMEOUT_MS },
+    );
+    if (!result.ok) {
+      log.debug(
+        { reason, conversationIds, error: result.error },
+        "daemon conversation-list-changed notify was not acknowledged",
+      );
+    }
+  } catch (err) {
+    log.debug(
+      { err, reason, conversationIds },
+      "daemon conversation-list-changed notify failed",
+    );
+  }
+}
+
 /**
  * Ask the daemon to republish the documents-list invalidation.
  *

package/src/runtime/verification-outbound-actions.ts

@@ -278,7 +278,7 @@ async function startOutboundTelegram(
       success: false,
       error: "already_bound",
       message:
-        "A guardian is already bound for this channel. Set rebind: true to replace.",
+        "A guardian is already bound for this channel. To verify a different account, revoke the existing binding first. Set rebind: true only to verify the same account again.",
       channel,
     };
   }
@@ -820,7 +820,7 @@ async function startOutboundTextChannel(
       success: false,
       error: "already_bound",
       message:
-        "A guardian is already bound for this channel. Set rebind: true to replace.",
+        "A guardian is already bound for this channel. To verify a different account, revoke the existing binding first. Set rebind: true only to verify the same account again.",
       channel,
     };
   }

package/src/tools/ask-question/ask-question-tool.test.ts

@@ -200,6 +200,44 @@ describe("AskQuestionTool.execute", () => {
     expect(result.isError).toBe(false);
   });
 
+  test("says so when the user answered in the chat instead of the card", async () => {
+    const q2 = {
+      question: "Preferred time?",
+      options: [
+        { id: "morning", label: "Morning" },
+        { id: "afternoon", label: "Afternoon" },
+      ],
+    };
+    setNextResult({
+      entries: [
+        {
+          questionId: "q1",
+          decision: "free_text",
+          text: "banana, after lunch",
+        },
+        { questionId: "q2", decision: "skipped" },
+      ],
+      overall: "completed",
+      answeredInChat: true,
+    });
+
+    const result = await askQuestionTool.execute(
+      { questions: [singleQ, q2] },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    const lines = String(result.content).split("\n");
+    // The model is told where the answer came from, then reads the batch: the
+    // typed text on the first question, the rest unanswered, so it can map the
+    // reply onto them itself.
+    expect(lines[0]).toContain("replied in the chat");
+    expect(lines.slice(1)).toEqual([
+      `Question "${singleQ.question}" → Free text: banana, after lunch`,
+      `Question "${q2.question}" → Skipped`,
+    ]);
+  });
+
   test("formats skipped result", async () => {
     setNextResult(singleCompleted({ decision: "skipped" }));
     const result = await askQuestionTool.execute(validInput, makeContext());

package/src/tools/ask-question/ask-question-tool.ts

@@ -243,6 +243,15 @@ export function toAnsweredQuestion(
   };
 }
 
+/**
+ * Model-facing note prepended when the user answered by typing in the chat
+ * instead of using the card. The text lands as free text on the first
+ * question and every other question reads as skipped, so the model is told
+ * plainly what happened and left to map the reply onto the batch itself.
+ */
+const CHAT_REPLY_PREAMBLE =
+  "The user replied in the chat instead of using the question card, so their message is recorded as free text on the first question below and the remaining questions are unanswered. Read their reply as the answer to whichever questions it covers, and ask again only for what it genuinely leaves open.";
+
 // ── Tool ────────────────────────────────────────────────────────────
 
 /**
@@ -389,7 +398,9 @@ export const askQuestionTool = {
 
     switch (result.overall) {
       case "completed": {
-        let content = lines.join("\n");
+        let content = result.answeredInChat
+          ? [CHAT_REPLY_PREAMBLE, ...lines].join("\n")
+          : lines.join("\n");
         if (desktopHelp) {
           const entry = result.entries[0];
           if (entry?.decision === "free_text") {

package/src/tools/workflows/manage-workflows.ts

@@ -15,7 +15,7 @@
 
 import { z } from "zod";
 
-import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getConversationProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { loadConfig } from "../../config/loader.js";
 import { callerOwnsWorkflowRun } from "../../workflows/capabilities.js";
 import type { WorkflowRun } from "../../workflows/journal-store.js";
@@ -199,7 +199,9 @@ export async function executeManageWorkflows(
       // workspace-wide active profile. Read-only — leaves use this to pick a
       // valid `profile` for `run_workflow` (an unknown profile throws).
       const { llm } = loadConfig();
-      const profiles = getUserSelectableProfilesForProvider(
+      // A workflow leaf runs chat turns, so this is the conversation view,
+      // which leaves out the managed Jev profile.
+      const profiles = getConversationProfilesForProvider(
         llm?.profiles,
         llm?.defaultProvider ?? null,
       );

package/src/util/worker-pipe.test.ts

@@ -0,0 +1,100 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { writeWorkerLine } from "./worker-pipe.js";
+
+/** Comfortably larger than any OS pipe buffer, so the write cannot complete. */
+const OVERSIZED_LINE = "x".repeat(4 * 1024 * 1024);
+
+const spawned: { kill(signal?: NodeJS.Signals): void }[] = [];
+
+afterEach(() => {
+  for (const proc of spawned.splice(0)) {
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+      /* already gone */
+    }
+  }
+});
+
+/** A live child that never reads stdin, the way a worker busy in ONNX does not. */
+function spawnBusyWorker() {
+  const proc = Bun.spawn({
+    cmd: [process.execPath, "-e", "setTimeout(() => {}, 60_000)"],
+    windowsHide: true,
+    stdin: "pipe",
+    stdout: "ignore",
+    stderr: "ignore",
+  });
+  spawned.push(proc);
+  return proc;
+}
+
+describe("writeWorkerLine", () => {
+  /**
+   * The production failure: the payload outruns the pipe buffer, Bun returns a
+   * pending promise, and the worker dies before draining it. Unobserved, that
+   * rejection is an `unhandledRejection`, which `bun test` reports as a failure
+   * of this test.
+   */
+  test("reports a write still pending when the worker dies", async () => {
+    const proc = spawnBusyWorker();
+    const failure = Promise.withResolvers<unknown>();
+
+    writeWorkerLine(proc.stdin, OVERSIZED_LINE, failure.resolve);
+    proc.kill("SIGKILL");
+
+    const err = await failure.promise;
+    expect(err).toBeInstanceOf(Error);
+    expect((err as NodeJS.ErrnoException).code).toBe("EPIPE");
+  });
+
+  test("reports a synchronous throw", () => {
+    const failures: unknown[] = [];
+    const epipe = Object.assign(new Error("EPIPE: broken pipe, write"), {
+      code: "EPIPE",
+    });
+    const stdin = {
+      write() {
+        throw epipe;
+      },
+      flush: () => 0,
+    };
+
+    writeWorkerLine(stdin, "line", (err) => failures.push(err));
+
+    expect(failures).toEqual([epipe]);
+  });
+
+  /** `write` and `flush` both report the same broken pipe. */
+  test("reports one failure when write and flush both reject", async () => {
+    const failures: unknown[] = [];
+    const epipe = new Error("EPIPE: broken pipe, send");
+    const stdin = {
+      write: () => Promise.reject(epipe),
+      flush: () => Promise.reject(epipe),
+    };
+
+    writeWorkerLine(stdin, "line", (err) => failures.push(err));
+    await Bun.sleep(0);
+
+    expect(failures).toEqual([epipe]);
+  });
+
+  test("stays silent when the line is delivered", async () => {
+    const failures: unknown[] = [];
+    const proc = Bun.spawn({
+      cmd: [process.execPath, "-e", "process.stdin.on('data', () => {})"],
+      windowsHide: true,
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "ignore",
+    });
+    spawned.push(proc);
+
+    writeWorkerLine(proc.stdin, "hello", (err) => failures.push(err));
+    await Bun.sleep(50);
+
+    expect(failures).toEqual([]);
+  });
+});

package/src/util/worker-pipe.ts

@@ -0,0 +1,44 @@
+import type { FileSink } from "bun";
+
+/**
+ * Write one line to a worker subprocess's stdin, reporting a broken pipe to
+ * `onFailure` however Bun surfaces it.
+ *
+ * `FileSink.write` and `FileSink.flush` return `number | Promise<number>`.
+ * While the pipe has room they complete synchronously. Once a payload outruns
+ * the pipe buffer, which is what happens when the worker is busy and not
+ * draining stdin, they return a pending promise instead, and that promise
+ * rejects with EPIPE if the worker dies before the write completes. A
+ * `try/catch` sees only the synchronous half: the rejection escapes it, reaches
+ * the process's `unhandledRejection` handler, and in the daemon that handler
+ * shuts the whole process down.
+ *
+ * `onFailure` runs at most once per call, even though `write` and `flush` can
+ * each report the same broken pipe.
+ */
+export function writeWorkerLine(
+  stdin: Pick<FileSink, "write" | "flush">,
+  line: string,
+  onFailure: (err: unknown) => void,
+): void {
+  let failed = false;
+  const fail = (err: unknown): void => {
+    if (failed) {
+      return;
+    }
+    failed = true;
+    onFailure(err);
+  };
+  const observe = (result: number | Promise<number>): void => {
+    if (result instanceof Promise) {
+      result.catch(fail);
+    }
+  };
+
+  try {
+    observe(stdin.write(line + "\n"));
+    observe(stdin.flush());
+  } catch (err) {
+    fail(err);
+  }
+}

package/src/workspace/migrations/159-rename-colliding-jev-profile-name.ts

@@ -0,0 +1,344 @@
+/**
+ * Workspace migration `159-rename-colliding-jev-profile-name`.
+ *
+ * `jev-managed` became a reserved code-owned profile name (the managed Jev
+ * profile). From this release on, that name resolves to the code body no
+ * matter what `llm.profiles` holds, and the schema rejects it as
+ * `activeProfile` or `advisorProfile`, so a user-created profile that
+ * happens to carry the name would be silently replaced in the effective
+ * catalog and its selections stranded.
+ *
+ * This migration runs before the reservation can take effect (workspace
+ * migrations run ahead of the first config load and the profile seeder) and
+ * gives such a profile a fresh key, rewriting every reference to it so the
+ * user keeps both the profile and its wiring:
+ *
+ *   - `llm.profiles` key (insertion order preserved)
+ *   - `llm.activeProfile`, `llm.advisorProfile`
+ *   - `llm.profileOrder` entries
+ *   - `llm.callSites.<site>.profile` pins
+ *   - `llm.profiles.<key>.mix[].profile` arms
+ *   - `llm.profiles.<key>.fallbackProfile` targets
+ *   - `conversations.inference_profile` and `cron_jobs.inference_profile`
+ *     rows
+ *
+ * The new key is `jev-managed-custom`, suffixed `-custom-2`, `-custom-3`,
+ * ... when that is taken. Candidates are checked against every existing
+ * profile key AND every reserved code-defined name, so a rename never lands
+ * on another name the catalog owns.
+ *
+ * Only a workspace-owned profile is renamed. An entry whose `source` is
+ * `managed` is a thin stub for the code-owned profile, and a non-object
+ * value under the key is not a profile at all; both are left alone.
+ *
+ * The DB rewrite is not best effort: a pin the rewrite abandons would route
+ * through the managed Jev profile instead of the user's own, so a database
+ * that exists but cannot be written is retried with a short backoff and a
+ * failure that outlives the retries throws; `retryFailedCheckpoint` re-runs
+ * the whole migration on the next boot. The DB rewrite runs before the
+ * config write, so a throw leaves config.json holding the old key.
+ *
+ * Idempotent: after a successful run no workspace-owned profile carries the
+ * reserved name, so a re-run finds nothing to rename and writes nothing.
+ */
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger(
+  "workspace-migration-159-rename-colliding-jev-profile-name",
+);
+
+/**
+ * The newly reserved key this migration clears. Frozen snapshot as of
+ * 2026-09-22 (migrations are self-contained).
+ */
+const RESERVED_KEYS = ["jev-managed"];
+
+/**
+ * Every code-defined profile name as of 2026-09-22: the default keys, the
+ * backups, the flag-gated `os-beta`, and the Jev profile. A renamed profile
+ * must not land on any of them, or the rename would just move the collision.
+ */
+const RESERVED_PROFILE_NAMES = new Set<string>([
+  "balanced",
+  "quality-optimized",
+  "cost-optimized",
+  "latency-optimized",
+  "balanced-backup",
+  "quality-optimized-backup",
+  "cost-optimized-backup",
+  "latency-optimized-backup",
+  "os-beta",
+  ...RESERVED_KEYS,
+]);
+
+const RENAME_SUFFIX = "-custom";
+
+/** Total attempts at the pin rewrite, the first one included. */
+const DB_ATTEMPTS = 4;
+
+/** First backoff step; each further wait doubles it (50, 100, 200 ms). */
+const DB_RETRY_BASE_DELAY_MS = 50;
+
+export const renameCollidingJevProfileNameMigration: WorkspaceMigration = {
+  id: "159-rename-colliding-jev-profile-name",
+  description:
+    "Rename a user profile colliding with the reserved managed Jev profile key and rewrite its references",
+  // The failure this migration can hit is a database it cannot write, and
+  // both halves of the run are idempotent, so a failed checkpoint is worth
+  // re-running: the config still holds the old keys, the mapping rebuilds
+  // from them, and the pin rewrite matches on the old name.
+  retryFailedCheckpoint: true,
+
+  async run(workspaceDir: string): Promise<void> {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!isPlainObject(parsed)) {
+        return;
+      }
+      config = parsed;
+    } catch {
+      return;
+    }
+
+    const llm = asObject(config.llm);
+    const profiles = llm === null ? null : asObject(llm.profiles);
+    if (llm === null || profiles === null) {
+      return;
+    }
+
+    const renames = planRenames(profiles);
+    if (renames.size === 0) {
+      return;
+    }
+
+    // The DB rewrite runs first so an interrupted or failed migration re-runs
+    // with the config still holding the old keys, i.e. with the mapping
+    // intact. A rewrite that cannot be completed throws out of here, which
+    // stops the config rename below rather than stranding the pins.
+    await rewriteDbReferences(workspaceDir, renames);
+
+    llm.profiles = renameProfileKeys(profiles, renames);
+    rewriteConfigReferences(llm, renames);
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    log.info(
+      { renames: Object.fromEntries(renames) },
+      "Renamed a user profile colliding with the reserved managed Jev profile key",
+    );
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: the reserved names cannot be handed back.
+  },
+};
+
+/**
+ * Old key -> new key for a workspace-owned profile sitting on the reserved
+ * name. Deterministic: each assigned name is reserved against later
+ * candidates, so the same config always produces the same mapping.
+ */
+function planRenames(profiles: Record<string, unknown>): Map<string, string> {
+  const renames = new Map<string, string>();
+  const taken = new Set<string>([
+    ...Object.keys(profiles),
+    ...RESERVED_PROFILE_NAMES,
+  ]);
+
+  for (const key of RESERVED_KEYS) {
+    if (!(key in profiles)) {
+      continue;
+    }
+    const entry = asObject(profiles[key]);
+    if (entry === null) {
+      log.warn(
+        { profile: key },
+        "Left a non-object value under the reserved Jev profile key; it is not a profile to preserve",
+      );
+      continue;
+    }
+    if (entry.source === "managed") {
+      // A managed stub is the workspace's overlay slot for the code-owned
+      // profile, not a user profile; renaming it would manufacture a phantom
+      // user profile.
+      continue;
+    }
+    let candidate = `${key}${RENAME_SUFFIX}`;
+    let counter = 2;
+    while (taken.has(candidate)) {
+      candidate = `${key}${RENAME_SUFFIX}-${counter}`;
+      counter += 1;
+    }
+    taken.add(candidate);
+    renames.set(key, candidate);
+  }
+
+  return renames;
+}
+
+/** Rebuild the profiles record with the renamed keys, preserving order. */
+function renameProfileKeys(
+  profiles: Record<string, unknown>,
+  renames: Map<string, string>,
+): Record<string, unknown> {
+  const renamed: Record<string, unknown> = {};
+  for (const [name, value] of Object.entries(profiles)) {
+    renamed[renames.get(name) ?? name] = value;
+  }
+  return renamed;
+}
+
+/** Point every config reference at the renamed key. */
+function rewriteConfigReferences(
+  llm: Record<string, unknown>,
+  renames: Map<string, string>,
+): void {
+  for (const field of ["activeProfile", "advisorProfile"]) {
+    const current = llm[field];
+    if (typeof current === "string" && renames.has(current)) {
+      llm[field] = renames.get(current);
+    }
+  }
+
+  if (Array.isArray(llm.profileOrder)) {
+    llm.profileOrder = (llm.profileOrder as unknown[]).map((name) =>
+      typeof name === "string" ? (renames.get(name) ?? name) : name,
+    );
+  }
+
+  const callSites = asObject(llm.callSites);
+  if (callSites !== null) {
+    for (const value of Object.values(callSites)) {
+      const site = asObject(value);
+      if (
+        site !== null &&
+        typeof site.profile === "string" &&
+        renames.has(site.profile)
+      ) {
+        site.profile = renames.get(site.profile);
+      }
+    }
+  }
+
+  const profiles = asObject(llm.profiles);
+  if (profiles === null) {
+    return;
+  }
+  for (const value of Object.values(profiles)) {
+    const entry = asObject(value);
+    if (entry === null) {
+      continue;
+    }
+    if (
+      typeof entry.fallbackProfile === "string" &&
+      renames.has(entry.fallbackProfile)
+    ) {
+      entry.fallbackProfile = renames.get(entry.fallbackProfile);
+    }
+    if (!Array.isArray(entry.mix)) {
+      continue;
+    }
+    for (const armValue of entry.mix as unknown[]) {
+      const arm = asObject(armValue);
+      if (
+        arm !== null &&
+        typeof arm.profile === "string" &&
+        renames.has(arm.profile)
+      ) {
+        arm.profile = renames.get(arm.profile);
+      }
+    }
+  }
+}
+
+/**
+ * Repoint the profile pins stored outside config.json: the sticky
+ * per-conversation profile and the per-schedule profile.
+ *
+ * Retried as a whole rather than per statement: opening the database, reading
+ * `sqlite_master` and running the updates all fail the same way under write
+ * contention (`SQLITE_BUSY` from a second connection), and every step is
+ * idempotent, so re-running the block is the simplest recovery that cannot
+ * double-apply. A failure that outlives the attempts throws, which fails the
+ * migration for `retryFailedCheckpoint` to pick up on the next boot.
+ */
+async function rewriteDbReferences(
+  workspaceDir: string,
+  renames: Map<string, string>,
+): Promise<void> {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    // No database yet, so there are no pins that could be stranded.
+    return;
+  }
+  await withDbRetry(() => {
+    const db = new Database(dbPath);
+    try {
+      for (const table of ["conversations", "cron_jobs"]) {
+        const present = db
+          .query(
+            `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`,
+          )
+          .get(table);
+        if (!present) {
+          // A workspace whose schema does not carry this table holds no pins
+          // in it. Nothing to rewrite, and nothing to fail over.
+          log.info({ table }, "No profile pin table to repoint");
+          continue;
+        }
+        for (const [from, to] of renames) {
+          db.query(
+            `UPDATE ${table} SET inference_profile = ? WHERE inference_profile = ?`,
+          ).run(to, from);
+        }
+      }
+    } finally {
+      db.close();
+    }
+  });
+}
+
+/**
+ * Run the pin rewrite, retrying a transient database failure with a short
+ * doubling backoff. Rethrows once the attempts are spent so the caller stops
+ * before the config rename.
+ */
+async function withDbRetry(attempt: () => void): Promise<void> {
+  for (let index = 0; ; index += 1) {
+    try {
+      attempt();
+      return;
+    } catch (err) {
+      if (index >= DB_ATTEMPTS - 1) {
+        throw new Error(
+          `Could not repoint conversation and schedule profile pins after ${DB_ATTEMPTS} attempts; leaving the config unrenamed so the next boot retries`,
+          { cause: err },
+        );
+      }
+      log.warn(
+        { err, attempt: index },
+        "Could not repoint profile pins; retrying",
+      );
+      await Bun.sleep(DB_RETRY_BASE_DELAY_MS * 2 ** index);
+    }
+  }
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function asObject(value: unknown): Record<string, unknown> | null {
+  return isPlainObject(value) ? value : null;
+}

package/src/workspace/migrations/registry.ts

@@ -155,6 +155,7 @@ import { repairRetiredCodexGpt54ModelIdsMigration } from "./154-repair-retired-c
 import { moveFrontModelConfigToVoiceMigration } from "./155-move-front-model-config-to-voice.js";
 import { extractWorkspaceMcpJsonMigration } from "./156-extract-workspace-mcp-json.js";
 import { addDesktopFilesLauncherMigration } from "./157-add-desktop-files-launcher.js";
+import { renameCollidingJevProfileNameMigration } from "./159-rename-colliding-jev-profile-name.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -325,4 +326,5 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   moveFrontModelConfigToVoiceMigration,
   extractWorkspaceMcpJsonMigration,
   addDesktopFilesLauncherMigration,
+  renameCollidingJevProfileNameMigration,
 ];