@vellumai/assistant 0.11.1-staging.1 → 0.11.1-staging.2

package/openapi.yaml

@@ -20459,7 +20459,9 @@ paths:
     delete:
       operationId: messages_queued_by_id_delete
       summary: Delete a queued message
-      description: Remove a pending message from the conversation queue before it is processed.
+      description:
+        Remove a pending message from the conversation queue before it is processed. Broadcasts
+        `message_queued_deleted` so every client can close out the pending row.
       tags:
         - messages
       parameters:
@@ -20477,6 +20479,10 @@ paths:
       responses:
         "200":
           description: Successful response
+        "403":
+          description: The queued message was enqueued by a different actor principal.
+        "404":
+          description: Conversation or queued message not found.
   /v1/messages/queued/{id}/steer:
     post:
       operationId: messages_queued_by_id_steer_post

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.1-staging.1",
+  "version": "0.11.1-staging.2",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/agent-loop-override-profile.test.ts

@@ -276,21 +276,28 @@ import { VELLUM_MANAGED_CONNECTION_NAME } from "../providers/vellum-model-routin
 // Connection-aware resolver path: satisfy
 // `tryResolveProviderForConnectionName` lookups so resolveDefaultProvider
 // returns a usable provider for any connection name the winning profile
-// references. The managed connection must carry the provider the catalog
-// `balanced` default declares (fireworks) or resolution rejects the row as a
-// provider mismatch; other names behave as personal anthropic connections.
+// references. The managed connection must be the platform-auth sentinel row:
+// a managed profile routing through anything else resolves to the platform
+// instead. Other names behave as personal anthropic connections.
 mock.module("../providers/inference/connections.js", () => ({
-  getConnection: (_db: unknown, name: string) => ({
-    id: 1,
-    name,
-    provider:
-      name === VELLUM_MANAGED_CONNECTION_NAME ? "fireworks" : "anthropic",
-    auth_strategy: "user_managed_credential",
-    credential_alias: null,
-    metadata_json: null,
-    created_at: new Date().toISOString(),
-    updated_at: new Date().toISOString(),
-  }),
+  getConnection: (_db: unknown, name: string) =>
+    name === VELLUM_MANAGED_CONNECTION_NAME
+      ? {
+          id: 1,
+          name,
+          provider: "vellum",
+          auth: { type: "platform" },
+        }
+      : {
+          id: 1,
+          name,
+          provider: "anthropic",
+          auth_strategy: "user_managed_credential",
+          credential_alias: null,
+          metadata_json: null,
+          created_at: new Date().toISOString(),
+          updated_at: new Date().toISOString(),
+        },
 }));
 
 /**

package/src/__tests__/config-callsite-patch-merge.test.ts

@@ -0,0 +1,92 @@
+/**
+ * Pins the `deepMergeOverwrite` behaviour that the Action Overrides editor
+ * depends on when it builds an `llm.callSites` patch (LUM-2949).
+ *
+ * A persisted call-site entry may carry tuning the web editor renders no
+ * control for (`effort`, `thinking`, `maxTokens`, ...). The editor decides
+ * per entry whether to send the picker triple, send `null`, or omit the key
+ * entirely, and each of those choices is only correct because of how this
+ * merge treats it. Asserting on the patch body alone would not catch a
+ * change here, so the contract is pinned where it lives.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { deepMergeOverwrite } from "../config/loader.js";
+
+type Raw = Record<string, unknown>;
+
+function callSites(entries: Raw): Raw {
+  return { llm: { callSites: entries } };
+}
+
+function mergedCallSites(before: Raw, patch: Raw): Raw {
+  const raw = callSites(before);
+  deepMergeOverwrite(raw, callSites(patch));
+  return (raw.llm as Raw).callSites as Raw;
+}
+
+const TUNED = {
+  profile: "latency-optimized",
+  effort: "low",
+  thinking: { enabled: false },
+};
+
+describe("llm.callSites patch merge", () => {
+  test("an omitted key keeps its persisted value", () => {
+    // What the editor sends for an active row: the picker triple only.
+    const after = mergedCallSites(
+      { voiceFrontDoor: TUNED },
+      { voiceFrontDoor: { profile: "balanced", provider: null, model: null } },
+    );
+    expect(after.voiceFrontDoor).toEqual({
+      profile: "balanced",
+      effort: "low",
+      thinking: { enabled: false },
+    });
+  });
+
+  test("a null on an absent key is a no-op, not a write", () => {
+    const after = mergedCallSites(
+      { voiceFrontDoor: TUNED },
+      { heartbeatAgent: null },
+    );
+    expect(after).toEqual({ voiceFrontDoor: TUNED });
+  });
+
+  test("a null deletes the whole entry, tuning included", () => {
+    // Why the editor must not send `null` for a row the user left alone:
+    // an entry holding only tuning would be erased.
+    const after = mergedCallSites(
+      { tuningOnly: { effort: "low", thinking: { enabled: false } } },
+      { tuningOnly: null },
+    );
+    expect("tuningOnly" in after).toBe(false);
+  });
+
+  test("omitting a tuning-only entry leaves it untouched", () => {
+    const before = {
+      tuningOnly: { effort: "low", thinking: { enabled: false } },
+    };
+    const after = mergedCallSites(before, {
+      heartbeatAgent: { profile: "balanced", provider: null, model: null },
+    });
+    expect(after.tuningOnly).toEqual({
+      effort: "low",
+      thinking: { enabled: false },
+    });
+  });
+
+  test("an explicit null clears a scalar that is present", () => {
+    // The picker triple relies on this to drop a stale provider/model pin.
+    const after = mergedCallSites(
+      { pinned: { provider: "anthropic", model: "claude-fable-5" } },
+      { pinned: { profile: "balanced", provider: null, model: null } },
+    );
+    expect(after.pinned).toEqual({
+      profile: "balanced",
+      provider: null,
+      model: null,
+    });
+  });
+});

package/src/__tests__/drain-requeue-on-contention.test.ts

@@ -19,12 +19,17 @@ import {
 interface FakeEvent {
   type: string;
   message?: string;
+  conversationId?: string;
+  requestId?: string;
+  position?: number;
+  clientMessageId?: string;
 }
 
 function makeQueued(
   content: string,
   requestId: string,
   events: FakeEvent[],
+  extra?: Partial<QueuedMessage>,
 ): QueuedMessage {
   return {
     content,
@@ -34,6 +39,7 @@ function makeQueued(
       events.push(event);
     },
     sentAt: Date.now(),
+    ...extra,
   } as unknown as QueuedMessage;
 }
 
@@ -200,3 +206,121 @@ describe("drainQueue under processing-lock contention", () => {
     ).toBe(1);
   });
 });
+
+/**
+ * The corrective `message_requeued` event.
+ *
+ * A drain announces `message_dequeued` before the steps that can send the
+ * message back, so a client that cleared its pending indicator on that
+ * announcement needs to be told the message is queued again. The rule is
+ * announcement-scoped: a requeue that happens before the announcement owes
+ * clients nothing, because they never stopped showing the row as queued.
+ */
+describe("message_requeued corrective event", () => {
+  test("a busy persist tells the sender its announced message is queued again", async () => {
+    const events: FakeEvent[] = [];
+    const { conversation, queue } = makeFakeConversation({
+      persistError: new Error(CONVERSATION_BUSY_MESSAGE),
+    });
+    queue.push(
+      makeQueued("hello there", "r1", events, {
+        clientMessageId: "nonce-1",
+      }),
+    );
+    queue.push(makeQueued("and another", "r2", events));
+
+    await drainQueue(conversation as never);
+
+    expect(events.map((event) => event.type)).toEqual([
+      "message_dequeued",
+      "message_requeued",
+    ]);
+    expect(events[1]).toEqual({
+      type: "message_requeued",
+      conversationId: "conv-drain-requeue",
+      requestId: "r1",
+      // Back at the head, so 1 of the 2 visible queued items.
+      position: 1,
+      clientMessageId: "nonce-1",
+    });
+  });
+
+  test("a requeue before the dequeue announcement stays silent", async () => {
+    const events: FakeEvent[] = [];
+    const { conversation, queue } = makeFakeConversation({ processing: true });
+    queue.push(makeQueued("hello there", "r1", events));
+
+    await drainQueue(conversation as never);
+
+    // The early lock check requeues before announcing anything, so a
+    // corrective event here would contradict what the client is showing.
+    expect(events).toEqual([]);
+    expect(queue.length).toBe(1);
+  });
+
+  test("only the batch member whose dequeue was announced is corrected", async () => {
+    const headEvents: FakeEvent[] = [];
+    const tailEvents: FakeEvent[] = [];
+    const { conversation, queue } = makeFakeConversation({
+      persistError: new Error(CONVERSATION_BUSY_MESSAGE),
+    });
+    queue.push(makeQueued("hello there", "r1", headEvents));
+    queue.push(makeQueued("and another", "r2", tailEvents));
+
+    await drainQueue(conversation as never);
+
+    // The batch drain announces per member as it walks the batch, and the
+    // head's busy persist ends the walk before the tail is announced.
+    expect(headEvents.map((event) => event.type)).toEqual([
+      "message_dequeued",
+      "message_requeued",
+    ]);
+    expect(tailEvents).toEqual([]);
+    expect(queue.peek(0)?.requestId).toBe("r1");
+    expect(queue.peek(1)?.requestId).toBe("r2");
+  });
+
+  test("a hidden send is announced but never corrected", async () => {
+    const events: FakeEvent[] = [];
+    const { conversation, queue } = makeFakeConversation({
+      persistError: new Error(CONVERSATION_BUSY_MESSAGE),
+    });
+    queue.push(
+      makeQueued("wizard closed", "r1", events, {
+        metadata: { hidden: true },
+      }),
+    );
+
+    await drainQueue(conversation as never);
+
+    // Hidden sends get no queued ack and render no client row, so there is
+    // nothing for a corrective event to restore.
+    expect(events.some((event) => event.type === "message_requeued")).toBe(
+      false,
+    );
+    expect(queue.peek(0)?.requestId).toBe("r1");
+  });
+
+  test("a second contention round corrects the message again", async () => {
+    const events: FakeEvent[] = [];
+    const { conversation, queue } = makeFakeConversation({
+      persistErrors: [
+        new Error(CONVERSATION_BUSY_MESSAGE),
+        new Error(CONVERSATION_BUSY_MESSAGE),
+      ],
+    });
+    queue.push(makeQueued("hello there", "r1", events));
+
+    await drainQueue(conversation as never);
+    await drainQueue(conversation as never);
+
+    // Each round re-announces the dequeue, so each round owes its own
+    // correction: the flag settles per announcement, not once per message.
+    expect(events.map((event) => event.type)).toEqual([
+      "message_dequeued",
+      "message_requeued",
+      "message_dequeued",
+      "message_requeued",
+    ]);
+  });
+});

package/src/__tests__/queued-message-delete-contract.test.ts

@@ -0,0 +1,339 @@
+/**
+ * Contract and authorization for deleting a queued message.
+ *
+ * Two things this pins:
+ *
+ * 1. **Terminal event.** A queued row that is cancelled never runs, so no
+ *    `message_dequeued` is ever coming for it. `message_queued_deleted` is the
+ *    only signal that closes it out, and it must reach the message's event
+ *    sink (the hub, for HTTP sends) rather than only the caller that issued
+ *    the DELETE.
+ * 2. **Scoping.** The removal is scoped both ways: to the named conversation's
+ *    own queue, and to the actor principal that enqueued the message. Every
+ *    subscriber sees every `message_queued` ack, so requestIds are not secrets
+ *    and cannot stand in for authorization. The caller identity is normalized
+ *    exactly as the send path normalizes it before recording
+ *    `sourceActorPrincipalId`, or the two disagree and a legitimate cancel is
+ *    refused.
+ */
+import { afterEach, describe, expect, test } from "bun:test";
+
+import type { AssistantEvent } from "../api/index.js";
+import {
+  MessageQueue,
+  type QueuedMessage,
+} from "../daemon/conversation-queue-manager.js";
+import {
+  deleteConversation,
+  setConversation,
+} from "../daemon/conversation-registry.js";
+import { ROUTES } from "../runtime/routes/conversation-query-routes.js";
+
+const deleteRoute = ROUTES.find(
+  (route) => route.operationId === "messages_queued_delete",
+)!;
+
+const registered: string[] = [];
+
+interface QueuedFixture {
+  requestId: string;
+  clientMessageId?: string;
+  sourceActorPrincipalId?: string;
+  metadata?: Record<string, unknown>;
+}
+
+/**
+ * Register a live conversation holding `items`, and return the events its
+ * queued messages publish. The delete path reads the in-memory registry and
+ * touches no persistence, so a queue-only stand-in exercises the real code.
+ */
+function seedConversation(
+  conversationId: string,
+  items: QueuedFixture[],
+): { events: AssistantEvent[]; queue: MessageQueue } {
+  const events: AssistantEvent[] = [];
+  const queue = new MessageQueue();
+  for (const item of items) {
+    queue.push({
+      content: `content for ${item.requestId}`,
+      attachments: [],
+      requestId: item.requestId,
+      onEvent: (event: AssistantEvent) => {
+        events.push(event);
+      },
+      sentAt: Date.now(),
+      clientMessageId: item.clientMessageId,
+      sourceActorPrincipalId: item.sourceActorPrincipalId,
+      metadata: item.metadata,
+    } as QueuedMessage);
+  }
+  const conversation = {
+    conversationId,
+    queue,
+    removeQueuedMessage: (requestId: string) =>
+      queue.removeByRequestId(requestId) !== undefined,
+  };
+  setConversation(conversationId, conversation as never);
+  registered.push(conversationId);
+  return { events, queue };
+}
+
+function dispatchDelete(args: {
+  conversationId: string;
+  requestId: string;
+  actorPrincipalId?: string;
+}) {
+  return Promise.resolve(
+    deleteRoute.handler({
+      pathParams: { id: args.requestId },
+      queryParams: { conversationId: args.conversationId },
+      headers:
+        args.actorPrincipalId !== undefined
+          ? { "x-vellum-actor-principal-id": args.actorPrincipalId }
+          : {},
+    }),
+  );
+}
+
+afterEach(() => {
+  for (const conversationId of registered.splice(0)) {
+    deleteConversation(conversationId);
+  }
+  delete process.env.DISABLE_HTTP_AUTH;
+});
+
+describe("queued message delete: terminal event", () => {
+  test("a deleted queued message publishes message_queued_deleted with its nonce", async () => {
+    const { events, queue } = seedConversation("conv-delete-1", [
+      { requestId: "r1", clientMessageId: "nonce-1" },
+      { requestId: "r2" },
+    ]);
+
+    expect(
+      await dispatchDelete({
+        conversationId: "conv-delete-1",
+        requestId: "r1",
+      }),
+    ).toEqual({ ok: true, conversationId: "conv-delete-1", requestId: "r1" });
+
+    expect(events).toEqual([
+      {
+        type: "message_queued_deleted",
+        conversationId: "conv-delete-1",
+        requestId: "r1",
+        clientMessageId: "nonce-1",
+      },
+    ]);
+    // Only the named message left the queue.
+    expect(queue.length).toBe(1);
+    expect(queue.peek(0)?.requestId).toBe("r2");
+  });
+
+  test("the nonce is omitted when the sender minted none", async () => {
+    const { events } = seedConversation("conv-delete-2", [{ requestId: "r1" }]);
+
+    await dispatchDelete({ conversationId: "conv-delete-2", requestId: "r1" });
+
+    expect(events).toEqual([
+      {
+        type: "message_queued_deleted",
+        conversationId: "conv-delete-2",
+        requestId: "r1",
+      },
+    ]);
+  });
+
+  test("a hidden send is removed without publishing a terminal event", async () => {
+    const { events, queue } = seedConversation("conv-delete-3", [
+      { requestId: "r1", metadata: { hidden: true } },
+    ]);
+
+    await dispatchDelete({ conversationId: "conv-delete-3", requestId: "r1" });
+
+    // Hidden sends never got a queued ack and render no client row, so there
+    // is nothing to close out.
+    expect(events).toEqual([]);
+    expect(queue.length).toBe(0);
+  });
+
+  test("a delete that finds nothing publishes nothing", async () => {
+    const { events, queue } = seedConversation("conv-delete-4", [
+      { requestId: "r1" },
+    ]);
+
+    await expect(
+      dispatchDelete({
+        conversationId: "conv-delete-4",
+        requestId: "r-absent",
+      }),
+    ).rejects.toThrow("Queued message not found");
+    expect(events).toEqual([]);
+    expect(queue.length).toBe(1);
+  });
+});
+
+describe("queued message delete: conversation scoping", () => {
+  test("a requestId from another conversation does not delete across the boundary", async () => {
+    const owner = seedConversation("conv-scope-owner", [{ requestId: "r1" }]);
+    const bystander = seedConversation("conv-scope-bystander", [
+      { requestId: "r2" },
+    ]);
+
+    await expect(
+      dispatchDelete({
+        conversationId: "conv-scope-bystander",
+        requestId: "r1",
+      }),
+    ).rejects.toThrow("Queued message not found");
+
+    expect(owner.queue.length).toBe(1);
+    expect(bystander.queue.length).toBe(1);
+    expect(owner.events).toEqual([]);
+    expect(bystander.events).toEqual([]);
+  });
+
+  test("an unknown conversation is reported as such, not as a missing message", async () => {
+    await expect(
+      dispatchDelete({ conversationId: "conv-absent", requestId: "r1" }),
+    ).rejects.toThrow("Conversation not found");
+  });
+
+  test("conversationId is required", async () => {
+    await expect(
+      Promise.resolve(deleteRoute.handler({ pathParams: { id: "r1" } })),
+    ).rejects.toThrow("Missing required parameter: conversationId");
+  });
+});
+
+describe("queued message delete: actor scoping", () => {
+  test("a different actor principal cannot cancel someone else's queued message", async () => {
+    const { events, queue } = seedConversation("conv-actor-1", [
+      { requestId: "r1", sourceActorPrincipalId: "actor-owner" },
+    ]);
+
+    await expect(
+      dispatchDelete({
+        conversationId: "conv-actor-1",
+        requestId: "r1",
+        actorPrincipalId: "actor-bystander",
+      }),
+    ).rejects.toThrow("sent by a different user");
+
+    // Left intact, and no terminal event went out: the row is still pending.
+    expect(queue.length).toBe(1);
+    expect(events).toEqual([]);
+  });
+
+  test("the enqueuing actor principal can cancel its own queued message", async () => {
+    const { events, queue } = seedConversation("conv-actor-2", [
+      { requestId: "r1", sourceActorPrincipalId: "actor-owner" },
+    ]);
+
+    await dispatchDelete({
+      conversationId: "conv-actor-2",
+      requestId: "r1",
+      actorPrincipalId: "actor-owner",
+    });
+
+    expect(queue.length).toBe(0);
+    expect(events.map((event) => event.type)).toEqual([
+      "message_queued_deleted",
+    ]);
+  });
+
+  test("a caller with no actor principal is the guardian by construction", async () => {
+    const { queue } = seedConversation("conv-actor-3", [
+      { requestId: "r1", sourceActorPrincipalId: "actor-owner" },
+    ]);
+
+    // Local/IPC and service principals carry no actorPrincipalId; the CLI
+    // must keep being able to cancel a queued message.
+    await dispatchDelete({ conversationId: "conv-actor-3", requestId: "r1" });
+
+    expect(queue.length).toBe(0);
+  });
+
+  test("a daemon-internal enqueue with no recorded requester stays cancellable", async () => {
+    const { queue } = seedConversation("conv-actor-4", [{ requestId: "r1" }]);
+
+    // Agent wakes, subagent notifications and surface actions have no
+    // enqueuing actor to compare against.
+    await dispatchDelete({
+      conversationId: "conv-actor-4",
+      requestId: "r1",
+      actorPrincipalId: "actor-bystander",
+    });
+
+    expect(queue.length).toBe(0);
+  });
+});
+
+describe("queued message delete: caller identity normalization", () => {
+  test("a padded principal still matches the recorded requester", async () => {
+    const { queue } = seedConversation("conv-normalize-1", [
+      { requestId: "r1", sourceActorPrincipalId: "actor-owner" },
+    ]);
+
+    // Sibling handlers in this layer all trim the header; without that the
+    // padded value is a distinct id and the owner's own cancel 403s.
+    await dispatchDelete({
+      conversationId: "conv-normalize-1",
+      requestId: "r1",
+      actorPrincipalId: "  actor-owner  ",
+    });
+
+    expect(queue.length).toBe(0);
+  });
+
+  test("a whitespace-only principal is treated as absent, not as an id", async () => {
+    const { queue } = seedConversation("conv-normalize-2", [
+      { requestId: "r1", sourceActorPrincipalId: "actor-owner" },
+    ]);
+
+    await dispatchDelete({
+      conversationId: "conv-normalize-2",
+      requestId: "r1",
+      actorPrincipalId: "   ",
+    });
+
+    expect(queue.length).toBe(0);
+  });
+
+  test("the dev-bypass principal does not 403 against a resolved guardian id", async () => {
+    // Under DISABLE_HTTP_AUTH the send path stores the REAL local guardian
+    // principal (`resolveActorPrincipalIdForLocalGuardian` translates the
+    // synthetic `dev-bypass` before enqueue), so a delete that compared the
+    // raw header would never match and every local-dev cancel would 403.
+    process.env.DISABLE_HTTP_AUTH = "true";
+    const { queue } = seedConversation("conv-dev-bypass", [
+      { requestId: "r1", sourceActorPrincipalId: "guardian-principal-abc" },
+    ]);
+
+    await dispatchDelete({
+      conversationId: "conv-dev-bypass",
+      requestId: "r1",
+      actorPrincipalId: "dev-bypass",
+    });
+
+    expect(queue.length).toBe(0);
+  });
+
+  test("a real principal is untouched by the dev-bypass translation", async () => {
+    process.env.DISABLE_HTTP_AUTH = "true";
+    const { queue } = seedConversation("conv-dev-bypass-real", [
+      { requestId: "r1", sourceActorPrincipalId: "actor-owner" },
+    ]);
+
+    // Only the literal `dev-bypass` principal is translated, so auth-disabled
+    // mode is not itself an authorization bypass.
+    await expect(
+      dispatchDelete({
+        conversationId: "conv-dev-bypass-real",
+        requestId: "r1",
+        actorPrincipalId: "actor-bystander",
+      }),
+    ).rejects.toThrow("sent by a different user");
+
+    expect(queue.length).toBe(1);
+  });
+});