@vellumai/assistant 0.10.6-staging.1 → 0.10.6

package/src/runtime/routes/__tests__/inference-provider-connection-routes.test.ts

@@ -560,11 +560,7 @@ describe("PATCH with label", () => {
 // ── Managed-connection write protection ──────────────────────────────────────
 
 describe("Managed connection write protection", () => {
-  const MANAGED_NAMES = [
-    "anthropic-managed",
-    "openai-managed",
-    "gemini-managed",
-  ] as const;
+  const MANAGED_NAMES = ["vellum"] as const;
 
   describe("DELETE", () => {
     for (const name of MANAGED_NAMES) {
@@ -590,21 +586,21 @@ describe("Managed connection write protection", () => {
       // Even though a profile references the managed connection, the error
       // should be the managed-protection 400, not the references-409.
       seedConnection({
-        name: "anthropic-managed",
+        name: "vellum",
         provider: "anthropic",
         auth: { type: "platform" },
       });
       fakeConfig = {
         llm: {
           profiles: {
-            balanced: { provider_connection: "anthropic-managed" },
+            balanced: { provider_connection: "vellum" },
           },
         },
       };
 
       const err = await call(
         findHandler("inference_provider_connections_delete"),
-        { pathParams: { name: "anthropic-managed" } },
+        { pathParams: { name: "vellum" } },
       ).catch((e: unknown) => e);
 
       expect(err).toBeInstanceOf(BadRequestError);
@@ -656,7 +652,7 @@ describe("Managed connection write protection", () => {
 
     test("allows PATCH with auth still set to platform (no-op auth change)", async () => {
       seedConnection({
-        name: "anthropic-managed",
+        name: "vellum",
         provider: "anthropic",
         auth: { type: "platform" },
       });
@@ -664,7 +660,7 @@ describe("Managed connection write protection", () => {
       const result = (await call(
         findHandler("inference_provider_connections_update"),
         {
-          pathParams: { name: "anthropic-managed" },
+          pathParams: { name: "vellum" },
           body: {
             auth: { type: "platform" },
             label: "Vellum-managed Anthropic",
@@ -678,7 +674,7 @@ describe("Managed connection write protection", () => {
   describe("PATCH label (allowed)", () => {
     test("allows relabeling a managed connection", async () => {
       seedConnection({
-        name: "openai-managed",
+        name: "vellum",
         provider: "openai",
         auth: { type: "platform" },
       });
@@ -686,7 +682,7 @@ describe("Managed connection write protection", () => {
       const result = (await call(
         findHandler("inference_provider_connections_update"),
         {
-          pathParams: { name: "openai-managed" },
+          pathParams: { name: "vellum" },
           body: { auth: { type: "platform" }, label: "Custom Label" },
         },
       )) as { label: string | null };
@@ -698,11 +694,7 @@ describe("Managed connection write protection", () => {
 // ── isManaged response flag ───────────────────────────────────────────────────
 
 describe("isManaged flag on connection responses", () => {
-  const MANAGED_NAMES = [
-    "anthropic-managed",
-    "openai-managed",
-    "gemini-managed",
-  ] as const;
+  const MANAGED_NAMES = ["vellum"] as const;
 
   describe("GET list", () => {
     test("returns isManaged: true for canonical names and false for user-created rows", async () => {
@@ -727,24 +719,69 @@ describe("isManaged flag on connection responses", () => {
       const byName = Object.fromEntries(
         result.connections.map((c) => [c.name, c.isManaged]),
       );
-      expect(byName["anthropic-managed"]).toBe(true);
-      expect(byName["openai-managed"]).toBe(true);
-      expect(byName["gemini-managed"]).toBe(true);
+      expect(byName["vellum"]).toBe(true);
       expect(byName["my-custom-anthropic"]).toBe(false);
     });
+
+    test("hides orphaned legacy *-managed rows from the list", async () => {
+      // Existing installs (and fresh installs via migration 243) may still
+      // carry the pre-consolidation rows until a follow-up migration deletes
+      // them; they must not surface in the UI alongside `vellum`.
+      for (const name of [
+        "anthropic-managed",
+        "openai-managed",
+        "gemini-managed",
+        "fireworks-managed",
+        "together-managed",
+      ]) {
+        seedConnection({
+          name,
+          provider: name.replace("-managed", ""),
+          auth: { type: "platform" },
+        });
+      }
+      seedConnection({
+        name: "vellum",
+        provider: "vellum",
+        auth: { type: "platform" },
+      });
+      seedConnection({
+        name: "my-openai",
+        provider: "openai",
+        auth: { type: "api_key", credential: "ref/k" },
+      });
+
+      const result = (await call(
+        findHandler("inference_provider_connections_list"),
+        {},
+      )) as { connections: Array<{ name: string }> };
+      const names = result.connections.map((c) => c.name);
+
+      expect(names).toContain("vellum");
+      expect(names).toContain("my-openai");
+      for (const legacy of [
+        "anthropic-managed",
+        "openai-managed",
+        "gemini-managed",
+        "fireworks-managed",
+        "together-managed",
+      ]) {
+        expect(names).not.toContain(legacy);
+      }
+    });
   });
 
   describe("GET single", () => {
     test("returns isManaged: true for a managed name", async () => {
       seedConnection({
-        name: "anthropic-managed",
+        name: "vellum",
         provider: "anthropic",
         auth: { type: "platform" },
       });
 
       const result = (await call(
         findHandler("inference_provider_connections_get"),
-        { pathParams: { name: "anthropic-managed" } },
+        { pathParams: { name: "vellum" } },
       )) as { name: string; isManaged: boolean };
 
       expect(result.isManaged).toBe(true);
@@ -786,7 +823,7 @@ describe("isManaged flag on connection responses", () => {
   describe("PATCH update", () => {
     test("returns isManaged: true after relabeling a managed connection", async () => {
       seedConnection({
-        name: "anthropic-managed",
+        name: "vellum",
         provider: "anthropic",
         auth: { type: "platform" },
       });
@@ -794,7 +831,7 @@ describe("isManaged flag on connection responses", () => {
       const result = (await call(
         findHandler("inference_provider_connections_update"),
         {
-          pathParams: { name: "anthropic-managed" },
+          pathParams: { name: "vellum" },
           body: { auth: { type: "platform" }, label: "Vellum Anthropic" },
         },
       )) as { name: string; isManaged: boolean };

package/src/runtime/routes/conversation-query-routes.ts

@@ -84,11 +84,15 @@ import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/v2
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
 import {
   createConnection,
+  getConnection,
+  LEGACY_MANAGED_CONNECTION_NAMES,
   listConnections,
   PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
+  VELLUM_MANAGED_CONNECTION_NAME,
 } from "../../providers/inference/connections.js";
 import { PROVIDER_CATALOG } from "../../providers/model-catalog.js";
 import { initializeProviders } from "../../providers/registry.js";
+import { MANAGED_ROUTABLE_PROVIDERS } from "../../providers/vellum-model-routing.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { validateAllowlistFile } from "../../security/secret-allowlist.js";
 import {
@@ -1296,9 +1300,22 @@ async function handleReplaceInferenceProfile({
   if (!isManaged && fragment.provider && !fragment.provider_connection) {
     const provider = fragment.provider as string;
     const db = getDb();
-    const [active] = listConnections(db, { provider });
+    // Exclude the orphaned legacy `*-managed` rows: they may still linger in
+    // provider_connections on upgraded workspaces (hidden from the list route
+    // until a follow-up migration deletes them). Auto-binding to one would keep
+    // the profile stale and break it once those rows are removed.
+    const [active] = listConnections(db, { provider }).filter(
+      (c) => !LEGACY_MANAGED_CONNECTION_NAMES.has(c.name),
+    );
     if (active) {
       fragment.provider_connection = active.name;
+    } else if (
+      MANAGED_ROUTABLE_PROVIDERS.has(provider) &&
+      getConnection(db, VELLUM_MANAGED_CONNECTION_NAME)
+    ) {
+      // Managed-routable providers are served by the single Vellum-managed
+      // connection; prefer it over lazily creating a personal connection.
+      fragment.provider_connection = VELLUM_MANAGED_CONNECTION_NAME;
     } else if (!PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)) {
       const connectionName = `${provider}-personal`;
       const isKeyless = provider === "ollama";

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -46,7 +46,7 @@ import type {
   MessageProcessor,
   SlackInboundMessageMetadata,
 } from "../../http-types.js";
-import { hasDeliverableAssistantText } from "../../slack-no-response.js";
+import { hasDeliverableAssistantText } from "../../no-response.js";
 import { createSlackReplySession } from "../../slack-reply-session.js";
 import type { TaskProgressData } from "../../slack-task-progress.js";
 import {

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -25,6 +25,7 @@ import {
   createConnection,
   deleteConnection,
   getConnection,
+  LEGACY_MANAGED_CONNECTION_NAMES,
   listConnections,
   MANAGED_CONNECTION_NAMES,
   PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
@@ -162,7 +163,7 @@ function handleListConnections({ queryParams = {} }: RouteHandlerArgs) {
   const connections = listConnections(
     getDb(),
     provider ? { provider } : undefined,
-  );
+  ).filter((c) => !LEGACY_MANAGED_CONNECTION_NAMES.has(c.name));
   return { connections };
 }
 
@@ -461,7 +462,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Update a provider connection",
     description:
-      "Update an existing connection. Cannot rename or change the provider. For managed connections (anthropic-managed, openai-managed, gemini-managed) the auth is locked to platform; label remains editable.",
+      "Update an existing connection. Cannot rename or change the provider. For the Vellum-managed connection (vellum) the auth is locked to platform; label remains editable.",
     tags: ["inference"],
     pathParams: [{ name: "name", description: "Connection name" }],
     requestBody: z.object({
@@ -490,7 +491,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Delete a provider connection",
     description:
-      "Delete a provider connection. Fails with 400 for managed connections (anthropic-managed, openai-managed, gemini-managed) which are re-seeded on boot. Fails with 409 if any profile or call-site references the connection.",
+      "Delete a provider connection. Fails with 400 for the Vellum-managed connection (vellum) which is re-seeded on boot. Fails with 409 if any profile or call-site references the connection.",
     tags: ["inference"],
     pathParams: [{ name: "name", description: "Connection name" }],
     responseBody: z.object({ ok: z.literal(true) }),

package/src/runtime/routes/platform-routes.ts

@@ -1,7 +1,7 @@
 /**
  * Platform route handlers for the shared HTTP/IPC route table.
  *
- * Serves five operations:
+ * Serves six operations:
  *   - platform_status (GET platform/status): aggregates platform context,
  *     credentials, assistant ID, webhook secret, and Velay tunnel status.
  *   - platform_connect (POST platform/connect): checks existing credentials
@@ -12,6 +12,8 @@
  *     registers a callback route with the platform gateway.
  *   - platform_callback_routes_list (GET platform/callback-routes): lists
  *     registered callback routes for this assistant.
+ *   - platform_credits (GET platform/credits): fetches the org's remaining
+ *     credit balance from the platform billing summary.
  */
 
 import { z } from "zod";
@@ -118,6 +120,16 @@ type CallbackRoutesListResponse = z.infer<
   typeof CallbackRoutesListResponseSchema
 >;
 
+const PlatformCreditsResponseSchema = z.object({
+  remaining: z.number(),
+  settled: z.number(),
+  pending: z.number(),
+  unit: z.literal("USD"),
+  stale: z.boolean(),
+  as_of: z.string(),
+});
+type PlatformCreditsResponse = z.infer<typeof PlatformCreditsResponseSchema>;
+
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -352,6 +364,60 @@ async function handleCallbackRoutesList(
   return { routes };
 }
 
+async function handlePlatformCredits(
+  _args: RouteHandlerArgs,
+): Promise<PlatformCreditsResponse> {
+  const context = await resolvePlatformCallbackRegistrationContext();
+
+  if (!context.platformBaseUrl || !context.authHeader) {
+    throw new UnprocessableEntityError(
+      "Platform credentials not available — run 'assistant platform connect' or set VELLUM_PLATFORM_URL",
+    );
+  }
+
+  const url = `${context.platformBaseUrl}/v1/organizations/billing/summary/`;
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Authorization: context.authHeader,
+        Accept: "application/json",
+      },
+      signal: AbortSignal.timeout(10_000),
+    });
+  } catch (err) {
+    throw new InternalError(
+      `Failed to fetch credit balance: ${(err as Error).message}`,
+    );
+  }
+
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new InternalError(
+      `Failed to fetch credit balance (HTTP ${response.status}): ${detail}`,
+    );
+  }
+
+  const summary = (await response.json()) as {
+    settled_balance_usd: string;
+    pending_compute_usd: string;
+    effective_balance_usd: string;
+    is_degraded: boolean;
+  };
+
+  return {
+    remaining: Number(summary.effective_balance_usd),
+    settled: Number(summary.settled_balance_usd),
+    pending: Number(summary.pending_compute_usd),
+    unit: "USD",
+    stale: summary.is_degraded,
+    // as_of is response receipt time; add a server as_of field if the billing
+    // summary endpoint ever returns one.
+    as_of: new Date().toISOString(),
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -433,4 +499,19 @@ export const ROUTES: RouteDefinition[] = [
     handler: handleCallbackRoutesList,
     responseBody: CallbackRoutesListResponseSchema,
   },
+  {
+    operationId: "platform_credits",
+    endpoint: "platform/credits",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Get the organization's remaining credit balance",
+    description:
+      "Fetches the org's settled, pending, and effective (remaining) credit balance in USD from the platform billing summary.",
+    tags: ["platform"],
+    handler: handlePlatformCredits,
+    responseBody: PlatformCreditsResponseSchema,
+  },
 ];

package/src/runtime/slack-reply-session.ts

@@ -18,7 +18,7 @@ import { deliverChannelReply } from "./gateway-client.js";
 import {
   hasDeliverableAssistantText,
   NO_RESPONSE_INLINE_RE,
-} from "./slack-no-response.js";
+} from "./no-response.js";
 import type { TaskProgressData } from "./slack-task-progress.js";
 import {
   getTaskProgressDataFromSurfaceData,

package/src/workspace/migrations/125-repoint-managed-connections-to-vellum.ts

@@ -0,0 +1,99 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { WorkspaceMigration } from "./types.js";
+
+// Repoint every `provider_connection` that referenced a per-provider
+// `*-managed` connection onto the single provider-agnostic `vellum`
+// connection.
+//
+// The five managed connections (anthropic/openai/gemini/fireworks/together)
+// are collapsed into one `vellum` row and are no longer seeded (a follow-up
+// migration deletes the orphaned rows), so any config still pointing at them
+// would fail to resolve. Managed profiles also self-heal via the boot-time
+// template reconcile, but `llm.default`, per-call-site overrides, and
+// user-owned copies are rewritten here.
+//
+// Only the connection reference changes — each entry keeps its `provider` and
+// `model`, which is how the `vellum` connection recovers the upstream at
+// dispatch time. Names are hardcoded: this is a frozen historical snapshot.
+
+const LEGACY_MANAGED_CONNECTIONS = new Set([
+  "anthropic-managed",
+  "openai-managed",
+  "gemini-managed",
+  "fireworks-managed",
+  "together-managed",
+]);
+
+const VELLUM_CONNECTION = "vellum";
+
+export const repointManagedConnectionsToVellumMigration: WorkspaceMigration = {
+  id: "125-repoint-managed-connections-to-vellum",
+  description:
+    "Repoint provider_connection from the per-provider *-managed connections to the single vellum connection",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) return;
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) return;
+
+    let changed = false;
+
+    // llm.default
+    if (repointEntry(readObject(llm.default))) changed = true;
+
+    // llm.profiles.* (managed and user-owned alike — a repointed reference is
+    // correct regardless of who owns the profile)
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const key of Object.keys(profiles)) {
+        if (repointEntry(readObject(profiles[key]))) changed = true;
+      }
+    }
+
+    // llm.callSites.*
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const key of Object.keys(callSites)) {
+        if (repointEntry(readObject(callSites[key]))) changed = true;
+      }
+    }
+
+    if (changed) {
+      config.llm = llm;
+      writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    }
+  },
+  down(_workspaceDir: string): void {
+    // Forward-only.
+  },
+};
+
+/** Rewrite a single entry's provider_connection in place. Returns true if changed. */
+function repointEntry(entry: Record<string, unknown> | null): boolean {
+  if (entry === null) return false;
+  const current = entry.provider_connection;
+  if (typeof current !== "string" || !LEGACY_MANAGED_CONNECTIONS.has(current)) {
+    return false;
+  }
+  entry.provider_connection = VELLUM_CONNECTION;
+  return true;
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/registry.ts

@@ -122,6 +122,7 @@ import { seedDefaultUserGuardrailsMigration } from "./121-seed-default-user-guar
 import { relocateDefaultUserBoundaryMigration } from "./122-relocate-default-user-boundary.js";
 import { swapQualityProfileToFableMigration } from "./123-swap-quality-profile-to-fable.js";
 import { correctDefaultUserBoundaryCommentsMigration } from "./124-correct-default-user-boundary-comments.js";
+import { repointManagedConnectionsToVellumMigration } from "./125-repoint-managed-connections-to-vellum.js";
 import { migrateToWorkspaceVolumeMigration } from "./migrate-to-workspace-volume.js";
 import type { WorkspaceMigration } from "./types.js";
 
@@ -255,4 +256,5 @@ export const WORKSPACE_MIGRATIONS: WorkspaceMigration[] = [
   relocateDefaultUserBoundaryMigration,
   swapQualityProfileToFableMigration,
   correctDefaultUserBoundaryCommentsMigration,
+  repointManagedConnectionsToVellumMigration,
 ];