@vellumai/assistant 0.6.4 → 0.6.5

package/src/types/tar-stream.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Minimal ambient types for `tar-stream` v3, which ships no type definitions.
+ *
+ * We only declare the surface used by `runtime/migrations/vbundle-tar-stream.ts`
+ * (the `extract()` factory and its `"entry"` event shape). If additional usage
+ * is needed later, extend this file rather than adding `@types/tar-stream` —
+ * the DT types target v2 and do not match v3's streamx-based extractor.
+ */
+declare module "tar-stream" {
+  import type { Readable, Writable } from "node:stream";
+
+  export interface TarHeader {
+    name: string;
+    size: number;
+    type:
+      | "file"
+      | "link"
+      | "symlink"
+      | "character-device"
+      | "block-device"
+      | "directory"
+      | "fifo"
+      | "contiguous-file"
+      | "pax-header"
+      | "pax-global-header"
+      | "gnu-long-path"
+      | "gnu-long-link-path"
+      | "other"
+      | string;
+    linkname?: string | null;
+    mode?: number;
+    uid?: number;
+    gid?: number;
+    mtime?: Date;
+    pax?: Record<string, string> | null;
+  }
+
+  export interface ExtractOptions {
+    filenameEncoding?: string;
+    allowUnknownFormat?: boolean;
+  }
+
+  export type EntryCallback = (err?: Error | null) => void;
+
+  export interface Extract extends Writable {
+    on(
+      event: "entry",
+      listener: (
+        header: TarHeader,
+        stream: Readable,
+        next: EntryCallback,
+      ) => void,
+    ): this;
+    on(event: "finish", listener: () => void): this;
+    on(event: "error", listener: (err: Error) => void): this;
+    on(event: "close", listener: () => void): this;
+    on(event: string, listener: (...args: unknown[]) => void): this;
+    destroy(err?: Error): void;
+  }
+
+  export function extract(opts?: ExtractOptions): Extract;
+
+  // `pack` exists but is unused by the runtime migrations code; declare it
+  // permissively so importers that reach for it still type-check.
+  export function pack(opts?: unknown): Writable;
+}

package/src/util/json.ts

@@ -8,3 +8,20 @@ export function parseJsonSafe<T = unknown>(text: string): T | null {
     return null;
   }
 }
+
+/** Tolerant JSON parse that returns `{}` for invalid or non-object payloads. */
+export function safeParseRecord(raw: string): Record<string, unknown> {
+  try {
+    const parsed = JSON.parse(raw);
+    if (
+      parsed === null ||
+      typeof parsed !== "object" ||
+      Array.isArray(parsed)
+    ) {
+      return {};
+    }
+    return parsed as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}

package/src/util/platform.ts

@@ -324,8 +324,8 @@ export function getWorkspaceDir(): string {
  * so paths stay concise and portable across machines.
  *
  * Examples:
- *   /Users/sidd/.vellum/workspace → ~/.vellum/workspace
- *   /data/.vellum/workspace       → /data/.vellum/workspace
+ *   /Users/alice/.vellum/workspace → ~/.vellum/workspace
+ *   /data/.vellum/workspace        → /data/.vellum/workspace
  */
 export function getWorkspaceDirDisplay(): string {
   const abs = getWorkspaceDir();

package/src/util/pricing.ts

@@ -43,9 +43,9 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
     "o4-mini": { inputPer1M: 1.1, outputPer1M: 4.4 },
   },
   gemini: {
-    "gemini-3-flash": { inputPer1M: 0.5, outputPer1M: 3 },
-    "gemini-2.5-pro": { inputPer1M: 1.25, outputPer1M: 10 },
     "gemini-2.5-flash": { inputPer1M: 0.15, outputPer1M: 0.6 },
+    "gemini-2.5-flash-lite": { inputPer1M: 0.02, outputPer1M: 0.1 },
+    "gemini-2.5-pro": { inputPer1M: 1.25, outputPer1M: 10 },
     "gemini-2.0-flash": { inputPer1M: 0.1, outputPer1M: 0.4 },
   },
   fireworks: {
@@ -67,15 +67,25 @@ function isAnthropicModelId(model: string): boolean {
 
 /**
  * Normalize an OpenRouter-style Anthropic model ID for lookup against the
- * Anthropic catalog: strip the `anthropic/` prefix and convert OpenRouter's
+ * Anthropic catalog: strip the `anthropic/` prefix, convert OpenRouter's
  * dot-separated version tokens (`claude-opus-4.6`) to the dash form Anthropic
- * uses natively (`claude-opus-4-6`).
+ * uses natively (`claude-opus-4-6`), and swap OpenRouter's version-first
+ * response form (`claude-4-7-opus-20260416`) into Anthropic's model-first
+ * catalog form (`claude-opus-4-7-20260416`) so the prefix match succeeds.
  */
 function normalizeAnthropicModelId(model: string): string {
   const bare = model.startsWith("anthropic/")
     ? model.slice("anthropic/".length)
     : model;
-  return bare.replace(/\./g, "-");
+  const dashed = bare.replace(/\./g, "-");
+  const versionFirst = dashed.match(
+    /^claude-(\d+(?:-\d+)*)-(opus|sonnet|haiku)(-.+)?$/,
+  );
+  if (versionFirst) {
+    const [, version, family, suffix] = versionFirst;
+    return `claude-${family}-${version}${suffix ?? ""}`;
+  }
+  return dashed;
 }
 
 /**

package/src/watcher/engine.ts

@@ -180,7 +180,7 @@ export async function runWatchersOnce(
         // Do NOT call provider.cleanup() here — auto-disable is reversible.
         // If the watcher is re-enabled later, it must diff against the same
         // baseline to avoid missing events that occurred while disabled.
-        // Cleanup is only correct on true deletion (see tools/watcher/delete.ts).
+        // Cleanup is only correct on true deletion (see watcher delete IPC route).
         log.warn(
           { watcherId: watcher.id, name: watcher.name },
           "Watcher disabled by circuit breaker",

package/src/watcher/providers/google-calendar.ts

@@ -6,15 +6,9 @@
  * Falls back to listing recent upcoming events if the syncToken has expired (410 Gone).
  */
 
-import {
-  CalendarApiError,
-  listEvents,
-} from "../../config/bundled-skills/google-calendar/calendar-client.js";
-import type { CalendarEvent } from "../../config/bundled-skills/google-calendar/types.js";
 import type { OAuthConnection } from "../../oauth/connection.js";
 import { resolveOAuthConnection } from "../../oauth/connection-resolver.js";
-
-const GOOGLE_CALENDAR_BASE_URL = "https://www.googleapis.com/calendar/v3";
+import { wrapUntrustedContent } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
 import type {
   FetchResult,
@@ -22,6 +16,133 @@ import type {
   WatcherProvider,
 } from "../provider-types.js";
 
+const GOOGLE_CALENDAR_BASE_URL = "https://www.googleapis.com/calendar/v3";
+
+// ---------------------------------------------------------------------------
+// Local types & helpers used by the watcher provider
+// ---------------------------------------------------------------------------
+
+/** Event time - either a dateTime with timezone or a date for all-day events. */
+interface EventDateTime {
+  dateTime?: string;
+  date?: string;
+  timeZone?: string;
+}
+
+/** Calendar event attendee. */
+interface EventAttendee {
+  email: string;
+  displayName?: string;
+  responseStatus?: "needsAction" | "declined" | "tentative" | "accepted";
+  self?: boolean;
+  organizer?: boolean;
+  optional?: boolean;
+}
+
+/** Calendar event organizer. */
+interface EventOrganizer {
+  email?: string;
+  displayName?: string;
+  self?: boolean;
+}
+
+/** A single Google Calendar event. */
+interface CalendarEvent {
+  id: string;
+  status?: "confirmed" | "tentative" | "cancelled";
+  summary?: string;
+  description?: string;
+  location?: string;
+  start?: EventDateTime;
+  end?: EventDateTime;
+  attendees?: EventAttendee[];
+  organizer?: EventOrganizer;
+  htmlLink?: string;
+  created?: string;
+  updated?: string;
+}
+
+/** Events list response. */
+interface CalendarEventsListResponse {
+  items?: CalendarEvent[];
+  nextPageToken?: string;
+  nextSyncToken?: string;
+}
+
+class CalendarApiError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly statusText: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = "CalendarApiError";
+  }
+}
+
+/** List events from a calendar. */
+async function listEvents(
+  connection: OAuthConnection,
+  calendarId = "primary",
+  options?: {
+    timeMin?: string;
+    timeMax?: string;
+    maxResults?: number;
+    query?: string;
+    singleEvents?: boolean;
+    orderBy?: "startTime" | "updated";
+    pageToken?: string;
+    syncToken?: string;
+  },
+): Promise<CalendarEventsListResponse> {
+  const query: Record<string, string> = {};
+
+  if (options?.timeMin) query.timeMin = options.timeMin;
+  if (options?.timeMax) query.timeMax = options.timeMax;
+  query.maxResults = String(options?.maxResults ?? 25);
+  if (options?.query) query.q = options.query;
+
+  // Default to expanding recurring events into instances
+  const singleEvents = options?.singleEvents ?? true;
+  query.singleEvents = String(singleEvents);
+
+  if (singleEvents && options?.orderBy) {
+    query.orderBy = options.orderBy;
+  } else if (singleEvents) {
+    query.orderBy = "startTime";
+  }
+
+  if (options?.pageToken) query.pageToken = options.pageToken;
+  if (options?.syncToken) query.syncToken = options.syncToken;
+
+  const resp = await connection.request({
+    method: "GET",
+    path: `/calendars/${encodeURIComponent(calendarId)}/events`,
+    query,
+    baseUrl: GOOGLE_CALENDAR_BASE_URL,
+    headers: {
+      "Content-Type": "application/json",
+    },
+  });
+
+  if (resp.status < 200 || resp.status >= 300) {
+    const bodyStr =
+      typeof resp.body === "string"
+        ? resp.body
+        : JSON.stringify(resp.body ?? "");
+    throw new CalendarApiError(
+      resp.status,
+      "",
+      `Calendar API ${resp.status}: ${bodyStr}`,
+    );
+  }
+
+  if (resp.status === 204 || resp.body === undefined) {
+    return undefined as unknown as CalendarEventsListResponse;
+  }
+  return resp.body as CalendarEventsListResponse;
+}
+
 const log = getLogger("watcher:google-calendar");
 
 /** The credential service — calendar shares OAuth tokens with Gmail. */
@@ -44,7 +165,12 @@ function eventToItem(event: CalendarEvent, eventType: string): WatcherItem {
       start,
       end,
       location: event.location ?? "",
-      description: event.description ?? "",
+      description: event.description
+        ? wrapUntrustedContent(event.description, {
+            source: "calendar",
+            maxChars: 5000,
+          })
+        : "",
       status: event.status ?? "confirmed",
       organizer: event.organizer?.email ?? "",
       attendees:

package/src/watcher/providers/outlook-calendar.ts

@@ -8,8 +8,6 @@
  * token has expired (410 Gone).
  */
 
-import { OutlookCalendarApiError } from "../../config/bundled-skills/outlook-calendar/calendar-client.js";
-import type { OutlookCalendarEvent } from "../../config/bundled-skills/outlook-calendar/types.js";
 import type { OAuthConnection } from "../../oauth/connection.js";
 import { resolveOAuthConnection } from "../../oauth/connection-resolver.js";
 import { getLogger } from "../../util/logger.js";
@@ -19,6 +17,48 @@ import type {
   WatcherProvider,
 } from "../provider-types.js";
 
+// ---------------------------------------------------------------------------
+// Local types & helpers used by the watcher provider
+// ---------------------------------------------------------------------------
+
+/** Microsoft Graph date+time pair. timeZone may be omitted when dateTime carries an offset. */
+interface OutlookDateTimeZone {
+  dateTime: string;
+  timeZone?: string;
+}
+
+/** A single calendar event from Microsoft Graph (subset used by watcher). */
+interface OutlookCalendarEvent {
+  id: string;
+  subject?: string;
+  bodyPreview?: string;
+  start?: OutlookDateTimeZone;
+  end?: OutlookDateTimeZone;
+  location?: { displayName?: string };
+  attendees?: Array<{
+    emailAddress: { address: string };
+    status?: { response: string };
+  }>;
+  organizer?: { emailAddress: { address: string; name?: string } };
+  isAllDay?: boolean;
+  isCancelled?: boolean;
+  showAs?: string;
+  webLink?: string;
+  createdDateTime?: string;
+  lastModifiedDateTime?: string;
+}
+
+class OutlookCalendarApiError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly statusText: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = "OutlookCalendarApiError";
+  }
+}
+
 const CREDENTIAL_SERVICE = "outlook";
 const log = getLogger("watcher:outlook-calendar");
 

package/src/workspace/git-service.ts

@@ -939,6 +939,10 @@ export class WorkspaceGitService {
   /**
    * Write a git note to a specific commit.
    * Uses the 'vellum' notes ref to avoid conflicts with default notes.
+   *
+   * Retries once on `index.lock` errors — `git notes add` briefly holds
+   * a ref lock that can collide with concurrent git operations (e.g. a
+   * heartbeat commit racing with fire-and-forget enrichment).
    */
   async writeNote(
     commitHash: string,
@@ -946,10 +950,25 @@ export class WorkspaceGitService {
     signal?: AbortSignal,
   ): Promise<void> {
     await this.mutex.withLock(async () => {
-      await this.execGit(
-        ["notes", "--ref=vellum", "add", "-f", "-m", noteContent, commitHash],
-        { signal },
-      );
+      const args = [
+        "notes",
+        "--ref=vellum",
+        "add",
+        "-f",
+        "-m",
+        noteContent,
+        commitHash,
+      ];
+      try {
+        await this.execGit(args, { signal });
+      } catch (err) {
+        const msg = (err as Error).message ?? "";
+        if (!msg.includes("index.lock") && !msg.includes("Unable to create")) {
+          throw err;
+        }
+        await new Promise((r) => setTimeout(r, 50));
+        await this.execGit(args, { signal });
+      }
     });
   }