@vellumai/assistant 0.8.11 → 0.8.12-staging.2

package/src/bundler/app-bundler.ts

@@ -6,12 +6,11 @@
  */
 
 import { createHash } from "node:crypto";
-import { createWriteStream, existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { readFile, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import archiver from "archiver";
 import JSZip from "jszip";
 
 import { getApp, getAppDirPath, isMultifileApp } from "../memory/app-store.js";
@@ -37,6 +36,14 @@ export interface BundleResult {
   iconImageBase64?: string;
 }
 
+function generateZipBuffer(zip: JSZip): Promise<Buffer> {
+  return zip.generateAsync({
+    type: "nodebuffer",
+    compression: "DEFLATE",
+    compressionOptions: { level: 9 },
+  });
+}
+
 function isDefaultMainScaffold(source: string): boolean {
   const normalized = source.replace(/\s+/g, " ").trim();
   return (
@@ -177,54 +184,31 @@ export async function packageApp(
   const bundleFilename = `${safeName}-${uniqueSuffix}.vellum`;
   const bundlePath = join(tmpdir(), bundleFilename);
 
-  await new Promise<void>((resolve, reject) => {
-    const output = createWriteStream(bundlePath);
-    const archive = archiver("zip", { zlib: { level: 9 } });
-
-    output.on("close", () => resolve());
-    output.on("error", (err: Error) => reject(err));
-    archive.on("error", (err: Error) => reject(err));
-    archive.on("warning", (err: Error) => {
-      // Only reject on fatal warnings
-      if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
-        reject(err);
-      }
-    });
-
-    archive.pipe(output);
+  const zip = new JSZip();
 
-    // Add manifest.json at root level
-    archive.append(serializeManifest(manifest), { name: "manifest.json" });
+  // Add manifest.json at root level
+  zip.file("manifest.json", serializeManifest(manifest));
 
-    // Add compiled dist/ files
-    for (const file of compiledFiles) {
-      archive.append(file.data, { name: file.name });
-    }
+  // Add compiled dist/ files
+  for (const file of compiledFiles) {
+    zip.file(file.name, file.data);
+  }
 
-    // Include app icon if one was generated
-    const iconPath = join(getAppDirPath(appId), "icon.png");
-    if (existsSync(iconPath)) {
-      archive.append(readFileSync(iconPath), { name: "icon.png" });
-    }
+  // Include app icon if one was generated
+  const iconPath = join(appDir, "icon.png");
+  if (existsSync(iconPath)) {
+    zip.file("icon.png", readFileSync(iconPath));
+  }
 
-    archive.finalize();
-  });
+  await writeFile(bundlePath, await generateZipBuffer(zip));
 
   // Sign the bundle if a signing callback is provided
   if (requestSignature) {
     try {
       const signatureJson = await signBundle(bundlePath, requestSignature);
 
-      // Re-open the zip and add signature.json
-      const zipBuffer = await readFile(bundlePath);
-      const zip = await JSZip.loadAsync(zipBuffer);
       zip.file("signature.json", JSON.stringify(signatureJson, null, 2));
-      const signedBuffer = await zip.generateAsync({
-        type: "nodebuffer",
-        compression: "DEFLATE",
-        compressionOptions: { level: 9 },
-      });
-      await writeFile(bundlePath, signedBuffer);
+      await writeFile(bundlePath, await generateZipBuffer(zip));
 
       bundlerLog.info({ appId }, "Bundle signed successfully");
     } catch (err) {
@@ -250,9 +234,8 @@ export async function packageApp(
 
   // Read icon for inclusion in the response
   let iconImageBase64: string | undefined;
-  const iconFilePath = join(getAppDirPath(appId), "icon.png");
-  if (existsSync(iconFilePath)) {
-    iconImageBase64 = readFileSync(iconFilePath).toString("base64");
+  if (existsSync(iconPath)) {
+    iconImageBase64 = readFileSync(iconPath).toString("base64");
   }
 
   return { bundlePath, manifest, iconImageBase64 };

package/src/bundler/app-compiler.ts

@@ -454,6 +454,14 @@ async function runCompile(appDir: string): Promise<CompileResult> {
   if (existsSync(htmlSrc)) {
     let html = await readFile(htmlSrc, "utf-8");
 
+    // Strip source-file script tags (e.g. <script src="/src/main.tsx">) that
+    // models often write in Vite style; browsers cannot load raw TSX/TS/JSX.
+    // The compiled main.js tag is injected below instead.
+    html = html.replace(
+      /<script\b[^>]*\bsrc=["'][^"']*\.(?:tsx|ts|jsx)["'][^>]*>\s*<\/script>\s*/gi,
+      "",
+    );
+
     // Check if CSS output was produced
     const distFiles = await readdir(distDir);
     const hasCss = distFiles.some((f) => f.endsWith(".css"));

package/src/calls/call-controller.ts

@@ -1312,7 +1312,7 @@ export class CallController {
 
       // Mark the linked guardian action request as timed out and
       // send expiry notices to guardian destinations. Deliveries
-      // must be captured before markTimedOutWithReason changes
+      // must be captured before expiring the request changes
       // their status.
       const pendingActionRequest = getPendingCanonicalRequestByCallSessionId(
         this.callSessionId,

package/src/cli/commands/plugins.ts

@@ -10,6 +10,11 @@
 import type { Command } from "commander";
 
 import { confirmPrompt } from "../lib/confirm-prompt.js";
+import {
+  inspectPlugin,
+  type PluginInspection,
+  PluginInspectNotFoundError,
+} from "../lib/inspect-plugin.js";
 import {
   DEFAULT_PLUGIN_REF,
   installPlugin,
@@ -18,6 +23,7 @@ import {
   PluginNotFoundError,
 } from "../lib/install-from-github.js";
 import { listInstalledPlugins } from "../lib/list-installed-plugins.js";
+import type { FingerprintComparison } from "../lib/plugin-fingerprint.js";
 import { registerCommand } from "../lib/register-command.js";
 import {
   InvalidSearchPatternError,
@@ -27,6 +33,11 @@ import {
   PluginNotInstalledError,
   uninstallPlugin,
 } from "../lib/uninstall-plugin.js";
+import {
+  PluginNotUpgradableError,
+  type PluginUpgradeResult,
+  upgradePlugin,
+} from "../lib/upgrade-plugin.js";
 import { getCliLogger } from "../logger.js";
 
 const log = getCliLogger("plugins");
@@ -41,15 +52,19 @@ export function registerPluginsCommand(program: Command): void {
         "after",
         `
 Examples:
-  $ assistant plugins install simple-memory
-  $ assistant plugins install simple-memory --force
-  $ assistant plugins install simple-memory --ref my-feature-branch
+  $ assistant plugins install example
+  $ assistant plugins install example --force
+  $ assistant plugins install example --ref my-feature-branch
   $ assistant plugins list
   $ assistant plugins list --json
-  $ assistant plugins search memory
-  $ assistant plugins search "^simple"
-  $ assistant plugins search memory --json
-  $ assistant plugins uninstall simple-memory`,
+  $ assistant plugins inspect example
+  $ assistant plugins inspect example --json
+  $ assistant plugins upgrade example
+  $ assistant plugins upgrade example --dry-run
+  $ assistant plugins search example
+  $ assistant plugins search "^example"
+  $ assistant plugins search example --json
+  $ assistant plugins uninstall example`,
       );
 
       plugins
@@ -147,6 +162,55 @@ Examples:
           );
         });
 
+      plugins
+        .command("inspect <name>")
+        .description(
+          "Show a plugin's local install metadata and the marketplace pin, and whether an update is available",
+        )
+        .option("--json", "Emit machine-readable JSON instead of a summary")
+        .action(async (name: string, opts: { json?: boolean }) => {
+          try {
+            const inspection = await inspectPlugin(
+              { name },
+              { fetch: globalThis.fetch.bind(globalThis) },
+            );
+
+            if (opts.json) {
+              process.stdout.write(JSON.stringify(inspection, null, 2) + "\n");
+              return;
+            }
+
+            // Logged after the JSON early-return: the CLI logger writes
+            // info to stdout, which would otherwise corrupt --json output.
+            log.info(
+              {
+                name: inspection.name,
+                installed: inspection.installed,
+                status: inspection.status,
+              },
+              "plugin inspect",
+            );
+
+            for (const line of formatInspection(inspection)) {
+              console.log(line);
+            }
+          } catch (err) {
+            if (err instanceof PluginInspectNotFoundError) {
+              console.error(err.message);
+              process.exitCode = 1;
+              return;
+            }
+            if (err instanceof InvalidPluginNameError) {
+              console.error(err.message);
+              process.exitCode = 1;
+              return;
+            }
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Plugin inspect failed: ${message}`);
+            process.exitCode = 1;
+          }
+        });
+
       plugins
         .command("search <query>")
         .description(
@@ -160,9 +224,13 @@ Examples:
               { fetch: globalThis.fetch.bind(globalThis) },
             );
 
-            // Log on every success path — JSON output, empty results, and
-            // populated tables alike — so observability doesn't depend on
-            // which formatting branch the caller landed in.
+            if (opts.json) {
+              process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+              return;
+            }
+
+            // Logged after the JSON early-return: the CLI logger writes info
+            // to stdout, which would otherwise corrupt --json output.
             log.info(
               {
                 query: result.query,
@@ -172,11 +240,6 @@ Examples:
               "external plugin search",
             );
 
-            if (opts.json) {
-              process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-              return;
-            }
-
             if (result.matches.length === 0) {
               console.log(`No plugins matched "${result.query}".`);
               return;
@@ -253,6 +316,176 @@ Examples:
             process.exitCode = 1;
           }
         });
+
+      plugins
+        .command("upgrade <name>")
+        .description(
+          "Upgrade an installed plugin to the marketplace's current pin",
+        )
+        .option(
+          "--dry-run",
+          "Show what would change without modifying the install",
+        )
+        .option("--json", "Emit machine-readable JSON instead of a summary")
+        .action(
+          async (name: string, opts: { dryRun?: boolean; json?: boolean }) => {
+            try {
+              const result = await upgradePlugin(
+                { name, dryRun: opts.dryRun },
+                { fetch: globalThis.fetch.bind(globalThis) },
+              );
+
+              if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+              }
+
+              // Logged after the JSON early-return: the CLI logger writes
+              // info to stdout, which would otherwise corrupt --json output.
+              log.info(
+                {
+                  name: result.name,
+                  outcome: result.outcome,
+                  from: result.fromCommit,
+                  to: result.toCommit,
+                },
+                "plugin upgrade",
+              );
+
+              for (const line of formatUpgrade(result)) {
+                console.log(line);
+              }
+            } catch (err) {
+              if (
+                err instanceof PluginNotInstalledError ||
+                err instanceof PluginNotUpgradableError ||
+                err instanceof InvalidPluginNameError
+              ) {
+                console.error(err.message);
+                process.exitCode = 1;
+                return;
+              }
+              const message = err instanceof Error ? err.message : String(err);
+              console.error(`Plugin upgrade failed: ${message}`);
+              process.exitCode = 1;
+            }
+          },
+        );
     },
   });
 }
+
+/** Abbreviate a commit SHA for display; passes through non-SHA / null values. */
+function shortSha(sha: string | null): string {
+  return sha ? sha.slice(0, 7) : "—";
+}
+
+/** Human-readable status line for an inspection result. */
+function statusLine(inspection: PluginInspection): string {
+  const { status, local, remote } = inspection;
+  switch (status) {
+    case "up-to-date":
+      return "up to date";
+    case "update-available":
+      return `update available  (${shortSha(local?.commit ?? null)} → ${shortSha(
+        remote?.commit ?? null,
+      )})`;
+    case "not-installed":
+      return "not installed";
+    case "not-in-marketplace":
+      return "installed (not in marketplace)";
+    case "unknown-provenance":
+      return "unknown — reinstall to record provenance";
+    case "remote-unavailable":
+      return "installed (marketplace unavailable)";
+  }
+}
+
+/**
+ * Summarize local edits relative to the install-time fingerprint. Reports
+ * "unknown" when no baseline was recorded (an older or manually-copied
+ * install), "none" when the on-disk tree matches, or a per-category count.
+ */
+function localEditsLine(changes: FingerprintComparison | null): string {
+  if (!changes)
+    return "unknown (no recorded baseline; reinstall to record one)";
+  if (changes.clean) return "none";
+  const parts = [
+    `${changes.modified.length} modified`,
+    `${changes.added.length} added`,
+    `${changes.removed.length} removed`,
+  ];
+  return parts.join(", ");
+}
+
+/** Render an inspection as aligned, human-readable summary lines. */
+function formatInspection(inspection: PluginInspection): string[] {
+  const { name, local, remote, remoteError } = inspection;
+  const lines: string[] = [`${name}  plugin`];
+  const row = (label: string, value: string) =>
+    lines.push(`  ${label.padEnd(11)} ${value}`);
+
+  row("status", statusLine(inspection));
+
+  if (local) {
+    const installedAt = local.installedAt
+      ? `  (${local.installedAt.slice(0, 10)})`
+      : "";
+    row("installed", `${shortSha(local.commit)}${installedAt}`);
+    row("local edits", localEditsLine(local.localChanges));
+  }
+
+  if (remote) {
+    const where = remote.path ? `${remote.repo}/${remote.path}` : remote.repo;
+    row(
+      "remote pin",
+      `${shortSha(remote.commit)}  (${where}, ${remote.marketplaceRef})`,
+    );
+  } else if (remoteError) {
+    row("remote", `unavailable — ${remoteError}`);
+  }
+
+  const version = local?.version ?? null;
+  if (version) row("version", version);
+
+  const license = remote?.license ?? null;
+  const homepage = remote?.homepage ?? null;
+  if (license && homepage) row("license", `${license}   homepage  ${homepage}`);
+  else if (license) row("license", license);
+  else if (homepage) row("homepage", homepage);
+
+  const description = remote?.description ?? local?.description ?? null;
+  if (description) row("description", description);
+
+  for (const issue of local?.issues ?? []) row("issue", issue);
+
+  return lines;
+}
+
+/** Render an upgrade result as human-readable summary lines. */
+function formatUpgrade(result: PluginUpgradeResult): string[] {
+  const { name, fromCommit, toCommit } = result;
+  const move = `${shortSha(fromCommit)} → ${shortSha(toCommit)}`;
+  const provenanceNote = result.provenanceWasUnknown
+    ? " (previous install had no recorded provenance)"
+    : "";
+
+  switch (result.outcome) {
+    case "already-up-to-date":
+      return [`"${name}" is already up to date (${shortSha(toCommit)}).`];
+    case "would-upgrade":
+      return [
+        `"${name}" would upgrade ${move}${provenanceNote} (dry run; no changes made).`,
+      ];
+    case "upgraded": {
+      const count =
+        result.fileCount === null
+          ? ""
+          : ` (${result.fileCount} file${result.fileCount === 1 ? "" : "s"})`;
+      return [
+        `Upgraded "${name}" ${move}${count}${provenanceNote} → ${result.target}`,
+        "Restart the assistant to pick up the upgrade.",
+      ];
+    }
+  }
+}