@vellumai/assistant 0.7.0 → 0.7.1

package/src/workspace/migrations/061-move-backup-key-to-workspace.ts

@@ -0,0 +1,59 @@
+/**
+ * Workspace migration 061: Move backup.key from protected/ to workspace.
+ *
+ * The backup encryption key previously lived at ~/.vellum/protected/backup.key.
+ * This migration copies it to ~/.vellum/workspace/.backup.key so the daemon
+ * no longer depends on the protected directory (owned by the gateway).
+ *
+ * The old file is removed after a successful copy. If the new file already
+ * exists (e.g. from VELLUM_BACKUP_KEY_PATH override or re-run), the old
+ * file is simply cleaned up.
+ */
+
+import { copyFileSync, existsSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+function getRootDir(): string {
+  const base = process.env.BASE_DATA_DIR?.trim() || homedir();
+  return join(base, ".vellum");
+}
+
+export const moveBackupKeyToWorkspaceMigration: WorkspaceMigration = {
+  id: "061-move-backup-key-to-workspace",
+  description: "Move backup.key from protected/ to workspace",
+
+  run(workspaceDir: string): void {
+    const oldPath = join(getRootDir(), "protected", "backup.key");
+    const newPath = join(workspaceDir, ".backup.key");
+    if (!existsSync(oldPath)) return;
+    if (existsSync(newPath)) {
+      try {
+        unlinkSync(oldPath);
+      } catch {}
+      return;
+    }
+    try {
+      copyFileSync(oldPath, newPath);
+      unlinkSync(oldPath);
+    } catch {}
+  },
+
+  down(workspaceDir: string): void {
+    const oldPath = join(getRootDir(), "protected", "backup.key");
+    const newPath = join(workspaceDir, ".backup.key");
+    if (!existsSync(newPath)) return;
+    if (existsSync(oldPath)) {
+      try {
+        unlinkSync(newPath);
+      } catch {}
+      return;
+    }
+    try {
+      copyFileSync(newPath, oldPath);
+      unlinkSync(newPath);
+    } catch {}
+  },
+};

package/src/workspace/migrations/062-drop-memory-v2-edges-json.ts

@@ -0,0 +1,27 @@
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Delete the legacy `memory/edges.json` file from any workspace that ran
+ * migration 060 before the v2 edge model moved to per-page frontmatter.
+ *
+ * Memory v2 now stores each page's outgoing directed edges directly in its
+ * frontmatter `edges:` list — there is no separate index file. Existing
+ * v1-shape edges.json files (undirected canonical 2-tuples) would fail
+ * validation under the new design and are no longer read by anything, so
+ * the safe move is simply to delete the file.
+ */
+export const dropMemoryV2EdgesJsonMigration: WorkspaceMigration = {
+  id: "062-drop-memory-v2-edges-json",
+  description: "Delete legacy memory/edges.json (edges now live per-page)",
+
+  run(workspaceDir: string): void {
+    rmSync(join(workspaceDir, "memory", "edges.json"), { force: true });
+  },
+
+  down(): void {
+    // No reversal — we don't reconstruct a legacy index file.
+  },
+};

package/src/workspace/migrations/063-release-notes-dynamic-model-context.ts

@@ -0,0 +1,70 @@
+import {
+  appendFileSync,
+  existsSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger(
+  "workspace-migration-063-release-notes-dynamic-model-context",
+);
+
+const MIGRATION_ID = "063-release-notes-dynamic-model-context";
+const MARKER = `<!-- release-note-id:${MIGRATION_ID} -->`;
+
+const RELEASE_NOTE = `${MARKER}
+## Model-aware inference profile limits
+
+Inference profiles now show max output tokens as a model-aware slider, so the
+available range follows the selected model instead of accepting invalid values.
+
+You can also configure the context window per profile. New managed profiles
+stay at the conservative 200K context budget by default, and existing profiles
+keep their current effective context budget unless you edit them.
+`;
+
+export const releaseNotesDynamicModelContextMigration: WorkspaceMigration = {
+  id: MIGRATION_ID,
+  description:
+    "Append release notes for dynamic model context settings to UPDATES.md",
+
+  run(workspaceDir: string): void {
+    const updatesPath = join(workspaceDir, "UPDATES.md");
+
+    try {
+      if (existsSync(updatesPath)) {
+        const existing = readFileSync(updatesPath, "utf-8");
+        if (existing.includes(MARKER)) {
+          return;
+        }
+        const needsLeadingNewline = !existing.endsWith("\n\n");
+        const prefix = existing.endsWith("\n") ? "\n" : "\n\n";
+        appendFileSync(
+          updatesPath,
+          needsLeadingNewline ? `${prefix}${RELEASE_NOTE}` : RELEASE_NOTE,
+          "utf-8",
+        );
+      } else {
+        writeFileSync(updatesPath, RELEASE_NOTE, "utf-8");
+      }
+      log.info(
+        { path: updatesPath },
+        "Appended dynamic model context release note",
+      );
+    } catch (err) {
+      log.warn(
+        { err, path: updatesPath },
+        "Failed to append dynamic model context release note to UPDATES.md",
+      );
+    }
+  },
+
+  down(_workspaceDir: string): void {
+    // Forward-only: UPDATES.md is a user-facing bulletin the assistant
+    // processes and deletes on its own.
+  },
+};

package/src/workspace/migrations/064-unwind-main-agent-opus-seed.ts

@@ -0,0 +1,64 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+const SEEDED_MAIN_AGENT_MODEL = "claude-opus-4-7";
+const SEEDED_MAIN_AGENT_MAX_TOKENS = 32000;
+const DEFAULT_MANAGED_PROFILE = "balanced";
+
+export const unwindMainAgentOpusSeedMigration: WorkspaceMigration = {
+  id: "064-unwind-main-agent-opus-seed",
+  description:
+    "Remove seeded mainAgent Opus model override and default activeProfile to balanced",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) return;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites === null) return;
+
+    const mainAgent = readObject(callSites.mainAgent);
+    if (mainAgent === null) return;
+    if ("provider" in mainAgent || "profile" in mainAgent) return;
+    if (mainAgent.model !== SEEDED_MAIN_AGENT_MODEL) return;
+    if (mainAgent.maxTokens !== SEEDED_MAIN_AGENT_MAX_TOKENS) return;
+
+    if (llm.activeProfile === undefined) {
+      llm.activeProfile = DEFAULT_MANAGED_PROFILE;
+    }
+
+    delete mainAgent.model;
+    delete mainAgent.maxTokens;
+
+    if (Object.keys(mainAgent).length === 0) {
+      delete callSites.mainAgent;
+    } else {
+      callSites.mainAgent = mainAgent;
+    }
+
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only: restoring the static call-site override would mask
+    // the user's active inference profile for main assistant conversations.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/registry.ts

@@ -58,6 +58,10 @@ import { repairStaleGeminiModelIdsMigration } from "./057-repair-stale-gemini-mo
 import { releaseNotesAcpSessionsUiMigration } from "./058-release-notes-acp-sessions-ui.js";
 import { movePidToWorkspaceMigration } from "./059-move-pid-to-workspace.js";
 import { memoryV2InitMigration } from "./060-memory-v2-init.js";
+import { moveBackupKeyToWorkspaceMigration } from "./061-move-backup-key-to-workspace.js";
+import { dropMemoryV2EdgesJsonMigration } from "./062-drop-memory-v2-edges-json.js";
+import { releaseNotesDynamicModelContextMigration } from "./063-release-notes-dynamic-model-context.js";
+import { unwindMainAgentOpusSeedMigration } from "./064-unwind-main-agent-opus-seed.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -127,4 +131,8 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   releaseNotesAcpSessionsUiMigration,
   movePidToWorkspaceMigration,
   memoryV2InitMigration,
+  moveBackupKeyToWorkspaceMigration,
+  dropMemoryV2EdgesJsonMigration,
+  releaseNotesDynamicModelContextMigration,
+  unwindMainAgentOpusSeedMigration,
 ];

package/src/workspace/provider-commit-message-generator.ts

@@ -1,7 +1,7 @@
 import { getConfig } from "../config/loader.js";
 import { resolveConfiguredProvider } from "../providers/provider-send-message.js";
 import type { Message } from "../providers/types.js";
-import { getSecureKeyAsync } from "../security/secure-keys.js";
+import { getProviderKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
 import type { CommitContext } from "./commit-message-provider.js";
 import { DefaultCommitMessageProvider } from "./commit-message-provider.js";
@@ -134,7 +134,7 @@ class ProviderCommitMessageGenerator {
       );
       const keyChecks = await Promise.all(
         candidates.map(async (name) => {
-          const value = await getSecureKeyAsync(name);
+          const value = await getProviderKeyAsync(name);
           return typeof value === "string" && value.length > 0;
         }),
       );
@@ -157,7 +157,7 @@ class ProviderCommitMessageGenerator {
 
     // Step 2b: API key preflight for the configured provider (skip keyless).
     if (!KEYLESS_PROVIDERS.has(providerName)) {
-      const providerApiKey = await getSecureKeyAsync(providerName);
+      const providerApiKey = await getProviderKeyAsync(providerName);
       if (!providerApiKey) {
         log.debug(
           {

package/src/__tests__/sandbox-diagnostics.test.ts

@@ -1,138 +0,0 @@
-import * as realChildProcess from "node:child_process";
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
-
-const execSyncMock = mock(
-  (_command: string, _opts?: unknown): unknown => undefined,
-);
-
-mock.module("node:child_process", () => ({
-  ...realChildProcess,
-  execSync: execSyncMock,
-}));
-
-mock.module("../util/logger.js", () => ({
-  getLogger: () => ({
-    error: () => {},
-    warn: () => {},
-    info: () => {},
-    debug: () => {},
-  }),
-}));
-
-const { runSandboxDiagnostics } =
-  await import("../tools/terminal/sandbox-diagnostics.js");
-
-// ---------------------------------------------------------------------------
-// Helper: temporarily override process.platform for a test
-// ---------------------------------------------------------------------------
-const originalPlatform = process.platform;
-
-function setPlatform(platform: string): void {
-  Object.defineProperty(process, "platform", { value: platform });
-}
-
-beforeEach(() => {
-  execSyncMock.mockReset();
-  // Default: all commands succeed.
-  execSyncMock.mockImplementation(() => undefined);
-});
-
-afterEach(() => {
-  // Restore the real platform after every test
-  setPlatform(originalPlatform);
-});
-
-describe("runSandboxDiagnostics — config reporting", () => {
-  test("reports sandbox disabled (sandbox removed)", () => {
-    const result = runSandboxDiagnostics();
-    expect(result.config.enabled).toBe(false);
-  });
-});
-
-describe("runSandboxDiagnostics — active backend reason", () => {
-  test("explains when sandbox is disabled", () => {
-    const result = runSandboxDiagnostics();
-    expect(result.activeBackendReason).toContain("disabled");
-  });
-});
-
-describe("runSandboxDiagnostics — native backend check (macOS)", () => {
-  test("passes when sandbox-exec works on macOS", () => {
-    setPlatform("darwin");
-    const result = runSandboxDiagnostics();
-    const nativeCheck = result.checks.find((c) =>
-      c.label.includes("Native sandbox"),
-    );
-    expect(nativeCheck).toBeDefined();
-    expect(nativeCheck!.ok).toBe(true);
-    expect(nativeCheck!.label).toContain("macOS");
-  });
-
-  test("fails when sandbox-exec does not work on macOS", () => {
-    setPlatform("darwin");
-    execSyncMock.mockImplementation((cmd: string) => {
-      if (typeof cmd === "string" && cmd.includes("sandbox-exec")) {
-        throw new Error("not available");
-      }
-      return "Docker version 24.0.7";
-    });
-    const result = runSandboxDiagnostics();
-    const nativeCheck = result.checks.find((c) =>
-      c.label.includes("Native sandbox"),
-    );
-    expect(nativeCheck).toBeDefined();
-    expect(nativeCheck!.ok).toBe(false);
-  });
-});
-
-describe("runSandboxDiagnostics — native backend check (Linux)", () => {
-  test("passes when bwrap works on Linux", () => {
-    setPlatform("linux");
-    const result = runSandboxDiagnostics();
-    const nativeCheck = result.checks.find((c) =>
-      c.label.includes("Native sandbox"),
-    );
-    expect(nativeCheck).toBeDefined();
-    expect(nativeCheck!.ok).toBe(true);
-    expect(nativeCheck!.label).toContain("Linux");
-  });
-
-  test("fails when bwrap is not available on Linux", () => {
-    setPlatform("linux");
-    execSyncMock.mockImplementation((cmd: string) => {
-      if (typeof cmd === "string" && cmd.includes("bwrap")) {
-        throw new Error("not found");
-      }
-      return "Docker version 24.0.7";
-    });
-    const result = runSandboxDiagnostics();
-    const nativeCheck = result.checks.find((c) =>
-      c.label.includes("Native sandbox"),
-    );
-    expect(nativeCheck).toBeDefined();
-    expect(nativeCheck!.ok).toBe(false);
-    expect(nativeCheck!.detail).toContain("bubblewrap");
-  });
-});
-
-describe("runSandboxDiagnostics — native backend check (unsupported OS)", () => {
-  test("reports unsupported when neither macOS nor Linux", () => {
-    setPlatform("win32");
-    const result = runSandboxDiagnostics();
-    const nativeCheck = result.checks.find((c) =>
-      c.label.includes("Native sandbox"),
-    );
-    expect(nativeCheck).toBeDefined();
-    expect(nativeCheck!.ok).toBe(false);
-    expect(nativeCheck!.detail).toContain("not supported");
-  });
-});
-
-describe("runSandboxDiagnostics — only native checks", () => {
-  test("only includes native backend check", () => {
-    const result = runSandboxDiagnostics();
-    const labels = result.checks.map((c) => c.label);
-    expect(labels).toHaveLength(1);
-    expect(labels[0]).toContain("Native sandbox");
-  });
-});