@vellumai/assistant 0.8.1 → 0.8.2

package/src/util/errors.ts

@@ -151,14 +151,31 @@ export class ConfigError extends AssistantError {
 }
 
 export class ProviderNotConfiguredError extends ConfigError {
+  /**
+   * Optional name of the `provider_connections` row whose credential was
+   * missing. Surfaced through `ConversationErrorMessage.connectionName` so
+   * the macOS chat banner can render "API key required for connection
+   * <name>" instead of a generic message.
+   */
+  public readonly connectionName?: string;
+  /**
+   * Optional name of the resolved profile in play when this error was
+   * thrown. Forwarded to the wire `ConversationErrorMessage.profileName`
+   * for the same banner-attribution purpose as `connectionName`.
+   */
+  public readonly profileName?: string;
+
   constructor(
     public readonly requestedProvider: string,
     public readonly registeredProviders: string[],
+    attribution?: { connectionName?: string; profileName?: string },
   ) {
     super(
       `No providers available. Requested: "${requestedProvider}". Registered: ${registeredProviders.join(", ") || "none"}`,
     );
     this.name = "ProviderNotConfiguredError";
+    this.connectionName = attribution?.connectionName;
+    this.profileName = attribution?.profileName;
   }
 }
 

package/src/util/platform.ts

@@ -268,6 +268,16 @@ export function getWorkspaceHooksDir(): string {
   return join(getWorkspaceDir(), "hooks");
 }
 
+/**
+ * Returns `<workspaceDir>/plugins` — the directory scanned by the user plugin
+ * loader at daemon startup. Writes here are security-sensitive: any
+ * `register.{ts,js}` will be dynamic-imported on next restart, so the file
+ * risk classifier escalates writes under this path to High.
+ */
+export function getWorkspacePluginsDir(): string {
+  return join(getWorkspaceDir(), "plugins");
+}
+
 /** Returns $VELLUM_WORKSPACE_DIR/routes — user-defined HTTP route handlers. */
 export function getWorkspaceRoutesDir(): string {
   return join(getWorkspaceDir(), "routes");

package/src/watcher/__tests__/engine.test.ts

@@ -250,6 +250,28 @@ describe("runWatchersOnce — Phase 2 runBackgroundJob integration", () => {
     expect(dispositionCalls[0].reason).toBe("model exploded");
   });
 
+  test("on bootstrap failure (conversationId: ''): does not overwrite prior conversation id", async () => {
+    fakeWatchers = [makeWatcher()];
+    fakePending = [makeEvent()];
+    // bootstrap failure shape from runBackgroundJob — empty conversationId
+    // signals that conversation creation failed before assignment.
+    runJobImpl = async () => ({
+      conversationId: "",
+      ok: false,
+      error: new Error("bootstrap exploded"),
+      errorKind: "exception",
+    });
+
+    await runWatchersOnce(() => {});
+
+    // Critical: we must NOT have called setWatcherConversationId with "",
+    // which would clobber a valid prior conversation id in the DB.
+    expect(setConvCalls).toEqual([]);
+    // Failure path still updates event dispositions.
+    expect(dispositionCalls).toHaveLength(1);
+    expect(dispositionCalls[0].disposition).toBe("error");
+  });
+
   test("skips runBackgroundJob entirely when no pending events", async () => {
     fakeWatchers = [makeWatcher()];
     fakePending = [];

package/src/watcher/engine.ts

@@ -263,8 +263,12 @@ export async function runWatchersOnce(
     });
 
     // Persist the per-tick conversation id so downstream surfaces (UI,
-    // store reads) can link back to the most recent watcher run.
-    setWatcherConversationId(watcher.id, result.conversationId);
+    // store reads) can link back to the most recent watcher run. Skip
+    // persistence when the runner failed before bootstrap (conversationId
+    // is empty) — otherwise we'd overwrite a valid prior id with "".
+    if (result.conversationId !== "") {
+      setWatcherConversationId(watcher.id, result.conversationId);
+    }
 
     if (result.ok) {
       // Mark events as silent by default. The LLM is expected to use

package/src/workspace/migrations/057-repair-stale-gemini-model-ids.ts

@@ -35,8 +35,15 @@ export const repairStaleGeminiModelIdsMigration: WorkspaceMigration = {
 
     const defaultBlock = readObject(llm.default);
     const defaultProvider = readProvider(defaultBlock);
-
-    if (defaultBlock !== null && isGeminiBlock(defaultBlock, defaultProvider)) {
+    const profiles = readObject(llm.profiles);
+    const activeProfileName =
+      typeof llm.activeProfile === "string" ? llm.activeProfile : undefined;
+    const activeProfileProvider =
+      profiles !== null && activeProfileName !== undefined
+        ? inferProvider(readObject(profiles[activeProfileName]))
+        : undefined;
+
+    if (defaultBlock !== null && isGeminiProvider(defaultProvider)) {
       changed = repairModel(defaultBlock, DEFAULT_REPLACEMENT_MODEL) || changed;
     }
 
@@ -45,7 +52,14 @@ export const repairStaleGeminiModelIdsMigration: WorkspaceMigration = {
       for (const [site, rawConfig] of Object.entries(callSites)) {
         const callSiteConfig = readObject(rawConfig);
         if (callSiteConfig === null) continue;
-        if (!isGeminiBlock(callSiteConfig, defaultProvider)) continue;
+        const effective = resolveCallSiteEffectiveProvider({
+          callSite: site,
+          callSiteConfig,
+          profiles,
+          activeProfileProvider,
+          defaultProvider,
+        });
+        if (!isGeminiProvider(effective)) continue;
         const replacement = LATENCY_CALL_SITES.has(site)
           ? LATENCY_REPLACEMENT_MODEL
           : DEFAULT_REPLACEMENT_MODEL;
@@ -53,12 +67,12 @@ export const repairStaleGeminiModelIdsMigration: WorkspaceMigration = {
       }
     }
 
-    const profiles = readObject(llm.profiles);
     if (profiles !== null) {
       for (const rawProfile of Object.values(profiles)) {
         const profile = readObject(rawProfile);
         if (profile === null) continue;
-        if (!isGeminiBlock(profile, defaultProvider)) continue;
+        const effective = inferProvider(profile) ?? defaultProvider;
+        if (!isGeminiProvider(effective)) continue;
         changed = repairModel(profile, DEFAULT_REPLACEMENT_MODEL) || changed;
       }
     }
@@ -109,14 +123,65 @@ function readProvider(
   return typeof block.provider === "string" ? block.provider : undefined;
 }
 
-// A block targets Gemini if it explicitly sets provider="gemini", or if it has
-// no provider field and the default block resolves to Gemini. An explicit
-// non-Gemini provider blocks the rewrite.
-function isGeminiBlock(
-  block: Record<string, unknown>,
-  defaultProvider: string | undefined,
-): boolean {
-  const local = readProvider(block);
-  const effective = local ?? defaultProvider;
-  return effective === undefined || effective === "gemini";
+// Mirrors `resolveCallSiteConfig`'s catalog-based inference: a fragment with
+// no explicit `provider` but a Gemini-catalog `model` resolves to "gemini" at
+// that layer. The stale model is the only catalog entry the migration cares
+// about, so the check stays self-contained.
+function inferProvider(
+  block: Record<string, unknown> | null,
+): string | undefined {
+  if (block === null) return undefined;
+  const explicit = readProvider(block);
+  if (explicit !== undefined) return explicit;
+  if (block.model === STALE_MODEL) return "gemini";
+  return undefined;
+}
+
+function isGeminiProvider(provider: string | undefined): boolean {
+  return provider === undefined || provider === "gemini";
+}
+
+// Walks the call-site provider resolution chain the same way
+// `resolveCallSiteConfig` does: for `mainAgent`, `activeProfile` overrides the
+// static `callSites.mainAgent` block, while for every other call site the
+// call-site block (and its referenced profile) wins over `activeProfile`.
+// Returns the highest-precedence inferred provider, falling back to `default`.
+function resolveCallSiteEffectiveProvider(args: {
+  callSite: string;
+  callSiteConfig: Record<string, unknown>;
+  profiles: Record<string, unknown> | null;
+  activeProfileProvider: string | undefined;
+  defaultProvider: string | undefined;
+}): string | undefined {
+  const {
+    callSite,
+    callSiteConfig,
+    profiles,
+    activeProfileProvider,
+    defaultProvider,
+  } = args;
+  const siteProvider = inferProvider(callSiteConfig);
+  const siteProfileName =
+    typeof callSiteConfig.profile === "string"
+      ? callSiteConfig.profile
+      : undefined;
+  const siteProfileProvider =
+    profiles !== null && siteProfileName !== undefined
+      ? inferProvider(readObject(profiles[siteProfileName]))
+      : undefined;
+
+  if (callSite === "mainAgent") {
+    return (
+      activeProfileProvider ??
+      siteProvider ??
+      siteProfileProvider ??
+      defaultProvider
+    );
+  }
+  return (
+    siteProvider ??
+    siteProfileProvider ??
+    activeProfileProvider ??
+    defaultProvider
+  );
 }

package/src/workspace/migrations/072-seed-reply-suggestion-callsite.ts

@@ -14,12 +14,20 @@ import type { WorkspaceMigration } from "./types.js";
  * high-effort / extended-thinking default, every turn would kick off an
  * expensive reasoning call and reject the assistant prefill.
  *
+ * Carry-forward: when `replySuggestion` is absent but the workspace has a
+ * customized `conversationStarters` entry (the call site this one was split
+ * out of), clone that entry into `replySuggestion` so users who previously
+ * tuned the combined call site keep their override. Only fall back to the
+ * fixed Haiku defaults when no `conversationStarters` override exists.
+ *
  * Mirrors `046-seed-conversation-starters-callsite`:
  *   - Skip entirely when `VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH` is set
  *     (platform overlay owns call-site seeds).
- *   - Skip when the resolved provider is not Anthropic or OpenRouter (the
- *     seeded model IDs are Anthropic-shaped, so mixing with another
- *     provider would guarantee invalid-model errors).
+ *   - In the fallback default path, skip when the resolved provider is not
+ *     Anthropic or OpenRouter (the seeded model IDs are Anthropic-shaped, so
+ *     mixing with another provider would guarantee invalid-model errors).
+ *     The carry-forward path is provider-agnostic since the cloned config
+ *     already reflects the user's explicit choice.
  *   - No-op when `llm.callSites.replySuggestion` is already set.
  *
  * Idempotent, append-only — existing entries are untouched.
@@ -46,29 +54,34 @@ export const seedReplySuggestionCallsiteMigration: WorkspaceMigration = {
     }
 
     const llm = readObject(config.llm) ?? {};
-    const defaultBlock = readObject(llm.default);
-
-    const explicitProvider = readString(defaultBlock?.provider);
-    if (
-      explicitProvider !== undefined &&
-      explicitProvider !== "anthropic" &&
-      explicitProvider !== "openrouter"
-    ) {
-      return;
-    }
-    const provider = explicitProvider ?? "anthropic";
-    const fastModel = resolveLatencyModel(provider);
-    if (fastModel === undefined) return;
-
     const callSites = readObject(llm.callSites) ?? {};
     if (readObject(callSites.replySuggestion) !== null) return;
 
-    callSites.replySuggestion = {
-      model: fastModel,
-      effort: "low",
-      thinking: { enabled: false },
-    };
+    const conversationStarters = readObject(callSites.conversationStarters);
+    let seed: Record<string, unknown>;
+    if (conversationStarters !== null) {
+      seed = { ...conversationStarters };
+    } else {
+      const defaultBlock = readObject(llm.default);
+      const explicitProvider = readString(defaultBlock?.provider);
+      if (
+        explicitProvider !== undefined &&
+        explicitProvider !== "anthropic" &&
+        explicitProvider !== "openrouter"
+      ) {
+        return;
+      }
+      const provider = explicitProvider ?? "anthropic";
+      const fastModel = resolveLatencyModel(provider);
+      if (fastModel === undefined) return;
+      seed = {
+        model: fastModel,
+        effort: "low",
+        thinking: { enabled: false },
+      };
+    }
 
+    callSites.replySuggestion = seed;
     llm.callSites = callSites;
     config.llm = llm;
     writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");

package/src/workspace/migrations/073-repair-recall-callsite-empty-profile.ts

@@ -57,7 +57,9 @@ export const repairRecallCallsiteEmptyProfileMigration: WorkspaceMigration = {
     if (cheapModel === undefined) return;
 
     delete recall.profile;
-    recall.model = cheapModel;
+    if (readString(recall.model) === undefined) {
+      recall.model = cheapModel;
+    }
     callSites.recall = recall;
     llm.callSites = callSites;
     config.llm = llm;

package/src/workspace/migrations/083-system-prompt-prefix-to-file.ts

@@ -0,0 +1,191 @@
+/**
+ * Workspace migration 083: Move config.systemPromptPrefix to a workspace file.
+ *
+ * The custom system prompt prefix used to live as a top-level config field
+ * (`config.json` → `systemPromptPrefix`).  Editable system-prompt sections
+ * now live under `<workspace>/prompts/system/<id>.md`.  This migration
+ * carries any existing config value over to `00-prefix.md` and strips the
+ * key from `config.json`.
+ *
+ * Behavior:
+ *   - config has non-empty string + 00-prefix.md body is empty → write the
+ *     prefix into the file body, preserving the bundled frontmatter
+ *   - config has non-empty string + 00-prefix.md body already has content →
+ *     leave the file alone (user authorship wins).  Just strip the config key
+ *   - config has null / missing field / whitespace-only string → no-op for
+ *     the file; strip the key
+ *
+ * On filesystem write failure we **throw**.  The runner marks the migration
+ * as `"failed"` so the operator can see it in checkpoints; we explicitly do
+ * not silently mark it complete.  Note the config key is only deleted on a
+ * successful path, so the user's prefix is preserved in `config.json` until
+ * the next attempt.
+ *
+ * Per workspace-migration AGENTS.md, all helpers are inlined.
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-083-system-prompt-prefix-to-file");
+
+/**
+ * Default frontmatter used when the bundled 00-prefix.md is somehow missing
+ * (e.g. running a development build where seeding hasn't happened yet).  In
+ * the normal startup order, `ensurePromptFiles()` runs before this migration,
+ * so the file already exists with the canonical bundled frontmatter.
+ */
+const FALLBACK_PREFIX_FRONTMATTER = [
+  "---",
+  'enabled: "!excludeCustomPrefix"',
+  "---",
+  "",
+].join("\n");
+
+/** Matches a `---`-delimited frontmatter block at the start of a file. */
+const FRONTMATTER_REGEX = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/;
+
+export const systemPromptPrefixToFileMigration: WorkspaceMigration = {
+  id: "083-system-prompt-prefix-to-file",
+  description:
+    "Move config.systemPromptPrefix to <workspace>/prompts/system/00-prefix.md",
+
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let raw: string;
+    try {
+      raw = readFileSync(configPath, "utf-8");
+    } catch (err) {
+      log.warn({ err, configPath }, "Failed to read config.json, skipping");
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (
+        parsed === null ||
+        typeof parsed !== "object" ||
+        Array.isArray(parsed)
+      ) {
+        log.warn({ configPath }, "config.json is not a JSON object, skipping");
+        return;
+      }
+      config = parsed as Record<string, unknown>;
+    } catch (err) {
+      log.warn({ err, configPath }, "Failed to parse config.json, skipping");
+      return;
+    }
+
+    if (!Object.prototype.hasOwnProperty.call(config, "systemPromptPrefix")) {
+      // Already migrated (or never set). Nothing to do.
+      return;
+    }
+
+    const value = config.systemPromptPrefix;
+    const trimmed = typeof value === "string" ? value.trim() : "";
+
+    const sysDir = join(workspaceDir, "prompts", "system");
+    const prefixFile = join(sysDir, "00-prefix.md");
+
+    if (trimmed.length > 0) {
+      // Read the existing file (if any) so we can preserve frontmatter and
+      // avoid clobbering user-authored content.
+      let existingFrontmatter = FALLBACK_PREFIX_FRONTMATTER;
+      let existingBody = "";
+      if (existsSync(prefixFile)) {
+        const existingRaw = readFileSync(prefixFile, "utf-8");
+        const fmMatch = existingRaw.match(FRONTMATTER_REGEX);
+        if (fmMatch) {
+          existingFrontmatter = fmMatch[0];
+          existingBody = existingRaw.slice(fmMatch[0].length).trim();
+        } else {
+          existingBody = existingRaw.trim();
+        }
+      }
+
+      if (existingBody.length > 0) {
+        // User already authored content here.  Leave the file alone, but
+        // continue on to strip the now-superseded config key.
+        log.info(
+          { prefixFile },
+          "00-prefix.md already has user content; keeping it, dropping config key only",
+        );
+      } else {
+        mkdirSync(sysDir, { recursive: true });
+        writeFileSync(
+          prefixFile,
+          existingFrontmatter + trimmed + "\n",
+          "utf-8",
+        );
+        log.info({ prefixFile }, "Wrote system prompt prefix to file");
+      }
+    }
+
+    // Strip the field from config.json regardless of whether we wrote a body
+    // — the field is removed from the schema either way.
+    delete config.systemPromptPrefix;
+    writeJsonAtomic(configPath, config);
+  },
+
+  down(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    const prefixFile = join(workspaceDir, "prompts", "system", "00-prefix.md");
+
+    if (!existsSync(configPath) || !existsSync(prefixFile)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (
+        parsed === null ||
+        typeof parsed !== "object" ||
+        Array.isArray(parsed)
+      )
+        return;
+      config = parsed as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    let body = "";
+    try {
+      const raw = readFileSync(prefixFile, "utf-8");
+      const stripped = raw.replace(FRONTMATTER_REGEX, "").trim();
+      // Strip `_` comment lines too — same convention as runtime renderer.
+      body = stripped
+        .split("\n")
+        .filter((line) => !line.trimStart().startsWith("_"))
+        .join("\n")
+        .trim();
+    } catch {
+      return;
+    }
+
+    config.systemPromptPrefix = body.length > 0 ? body : null;
+    writeJsonAtomic(configPath, config);
+  },
+};
+
+/**
+ * Atomic JSON write: write to temp file alongside the target, then rename.
+ * Throws on failure so callers can propagate to the migration runner (which
+ * marks the migration `"failed"`).  Inlined per workspace-migration
+ * self-containment rule.
+ */
+function writeJsonAtomic(path: string, data: unknown): void {
+  const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+  writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  renameSync(tmp, path);
+}