@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/__tests__/usage-routes.test.ts

@@ -9,6 +9,7 @@ import {
 } from "../persistence/llm-usage-store.js";
 import { BadRequestError } from "../runtime/routes/errors.js";
 import { ROUTES } from "../runtime/routes/usage-routes.js";
+import { getScheduleUsageSummaries } from "../schedule/schedule-usage-store.js";
 
 await initializeDb();
 
@@ -286,6 +287,26 @@ describe("usage routes", () => {
       expect(total).toBeCloseTo(0.04);
     });
 
+    test("includes delegated usage stamped with the run id from another conversation", () => {
+      // A subagent spawned by the scheduled turn runs as its own child
+      // conversation, so its usage rows carry the firing's stamp but a
+      // conversation_id the run record never names.
+      recordCostAt("conv-parent", "delegating-turn", 10_500, 0.1, "run-sub-1");
+      recordCostAt("conv-child", "subagent-turn", 10_600, 0.25, "run-sub-1");
+      // Unstamped usage from the child conversation belongs to nobody: the
+      // window fallback only matches the run's own conversation.
+      recordCostAt("conv-child", "unrelated-child-turn", 10_700, 0.9);
+
+      const total = getUsageCostForRun({
+        cronRunId: "run-sub-1",
+        conversationId: "conv-parent",
+        from: 10_000,
+        to: 11_000,
+      });
+
+      expect(total).toBeCloseTo(0.35);
+    });
+
     test("excludes rows stamped for a different run that overlap this run's window", () => {
       // A different firing's stamped row shares the conversation + window; it
       // must not count here — only the unstamped legacy row does.
@@ -303,6 +324,47 @@ describe("usage routes", () => {
     });
   });
 
+  describe("getScheduleUsageSummaries", () => {
+    test("attributes delegated usage from another conversation to the schedule", () => {
+      insertScheduleJob("schedule-delegating", "Nightly research");
+      insertScheduleRun({
+        id: "run-delegating-1",
+        scheduleId: "schedule-delegating",
+        conversationId: "conv-parent",
+        startedAt: 10_000,
+        finishedAt: 11_000,
+      });
+
+      recordCostAt(
+        "conv-parent",
+        "delegating-turn",
+        10_500,
+        0.1,
+        "run-delegating-1",
+      );
+      // The subagent's own conversation, stamped with the firing that spawned
+      // it: without the stamp this spend is invisible to the schedule.
+      recordCostAt(
+        "conv-child",
+        "subagent-turn",
+        10_600,
+        0.25,
+        "run-delegating-1",
+      );
+      recordCostAt("conv-child", "unrelated-child-turn", 10_700, 0.9);
+
+      const summaries = getScheduleUsageSummaries({ from: 0, to: 20_000 });
+      const summary = summaries.find(
+        (s) => s.scheduleId === "schedule-delegating",
+      );
+
+      expect(summary).toBeDefined();
+      expect(summary!.runCount).toBe(1);
+      expect(summary!.eventCount).toBe(2);
+      expect(summary!.totalEstimatedCostUsd).toBeCloseTo(0.35);
+    });
+  });
+
   // -- query parsing / validation --
 
   describe("query parameter validation", () => {

package/src/__tests__/verification-outbound-delivery.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Every outbound verification start and resend delivers its message, once,
+ * from inside the shared action.
+ *
+ * The failure this guards is silent. A channel that mints a session and never
+ * sends looks identical to a healthy one from the outside: the call succeeds,
+ * a session exists, and the user simply never receives a code. Nothing errors
+ * and nothing logs, so the only way to catch it is to assert the delivery
+ * itself rather than the shape of the returned object.
+ *
+ * A result must also carry no message for a caller to send on its behalf. A
+ * channel whose message leaves in the return value instead of over its
+ * transport is one whose delivery depends on every caller remembering to
+ * dispatch it.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import "./test-preload.js";
+
+// Every mock below spreads the real module before overriding. Replacing a
+// module wholesale drops every export the test did not think to list, and the
+// failure surfaces as an unrelated import crash in whichever module happens to
+// need one of them.
+const realEnv = await import("../config/env.js");
+mock.module("../config/env.js", () => ({
+  ...realEnv,
+  isHttpAuthDisabled: () => true,
+  getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
+}));
+
+/** Every delivery attempt, whichever transport it went out on. */
+const deliveries: Array<{ transport: string; to: string; text: string }> = [];
+
+const realSlackSend = await import("../messaging/providers/slack/send.js");
+mock.module("../messaging/providers/slack/send.js", () => ({
+  ...realSlackSend,
+  sendSlackReply: async (chatId: string, text: string) => {
+    deliveries.push({ transport: "slack", to: chatId, text });
+    return {};
+  },
+}));
+
+const realTelegramSend =
+  await import("../messaging/providers/telegram-bot/send.js");
+mock.module("../messaging/providers/telegram-bot/send.js", () => ({
+  ...realTelegramSend,
+  sendTelegramReply: async (chatId: string, text: string) => {
+    deliveries.push({ transport: "telegram", to: chatId, text });
+    return {};
+  },
+}));
+
+const realDiscordApi = await import("../messaging/providers/discord/api.js");
+mock.module("../messaging/providers/discord/api.js", () => ({
+  ...realDiscordApi,
+  openDiscordDmChannel: async (recipientUserId: string) =>
+    `dm-for-${recipientUserId}`,
+}));
+
+const realDiscordSend = await import("../messaging/providers/discord/send.js");
+mock.module("../messaging/providers/discord/send.js", () => ({
+  ...realDiscordSend,
+  sendDiscordReply: async (target: { channelId: string }, text: string) => {
+    deliveries.push({ transport: "discord", to: target.channelId, text });
+    return {};
+  },
+}));
+
+const sessions = await import("./helpers/verification-sessions-ipc-sim.js");
+mock.module("../channels/gateway-verification-sessions.js", () => sessions);
+
+const realVerificationService =
+  await import("../runtime/channel-verification-service.js");
+mock.module("../runtime/channel-verification-service.js", () => ({
+  ...realVerificationService,
+  isGuardianBoundForChannel: async () => false,
+  getGuardianBinding: async () => null,
+}));
+
+const { startOutbound, resendOutbound } =
+  await import("../runtime/verification-outbound-actions.js");
+
+/**
+ * A destination shaped the way each channel's own addresses are.
+ *
+ * Email is absent: its transport goes through the platform client, which is a
+ * heavier boundary than this file's concern. It reaches delivery through the
+ * same shared path as the two spec-driven channels here, so that path is
+ * covered.
+ */
+const DESTINATIONS: Array<{ channel: string; destination: string }> = [
+  { channel: "slack", destination: "U0123456789" },
+  { channel: "discord", destination: "900000000000000042" },
+  { channel: "telegram", destination: "123456789" },
+];
+
+beforeEach(() => {
+  deliveries.length = 0;
+  // Sessions persist in the sim, and `findActiveSession` returns the latest
+  // for a channel, so without this a test would resend against the previous
+  // test's session.
+  sessions.resetVerificationSessionsSim();
+});
+
+describe("startOutbound delivers from inside the action", () => {
+  for (const { channel, destination } of DESTINATIONS) {
+    test(`${channel} sends exactly one message`, async () => {
+      const result = await startOutbound({
+        channel: channel as never,
+        destination,
+      });
+
+      expect(result.success).toBe(true);
+      const sent = deliveries.filter((d) => d.transport === channel);
+      expect(sent).toHaveLength(1);
+      expect(sent[0].text.length).toBeGreaterThan(0);
+    });
+  }
+
+  test("resend delivers too, on every channel that starts", async () => {
+    // Start and resend run the same mint-and-send, so this is coverage of that
+    // shared path from its second entry point rather than of resend as a
+    // feature.
+    for (const { channel, destination } of DESTINATIONS) {
+      sessions.resetVerificationSessionsSim();
+      const start = await startOutbound({
+        channel: channel as never,
+        destination,
+      });
+      expect(start.verificationSessionId).toBeDefined();
+
+      // A start stamps a 15-second resend cooldown. That cooldown is its own
+      // behaviour; clearing it here is what lets this reach the delivery.
+      sessions.updateSessionDelivery(
+        start.verificationSessionId!,
+        Date.now(),
+        1,
+        null,
+      );
+      deliveries.length = 0;
+
+      const result = await resendOutbound({ channel: channel as never });
+      expect(result.success).toBe(true);
+      expect(deliveries.filter((d) => d.transport === channel)).toHaveLength(1);
+    }
+  });
+
+  test("no channel returns a payload for the caller to send instead", async () => {
+    // A `_pending*` field means some channel is minting a session whose
+    // message it never sends, which no per-channel delivery assertion above
+    // would catch on its own: that channel simply would not appear.
+    for (const { channel, destination } of DESTINATIONS) {
+      const result = await startOutbound({
+        channel: channel as never,
+        destination,
+      });
+      for (const key of Object.keys(result)) {
+        expect(key.startsWith("_pending")).toBe(false);
+      }
+    }
+  });
+
+  test("a Discord code is addressed to the opened DM, not the user id", async () => {
+    // The user snowflake has to be resolved to a channel before the send, and
+    // both are bare digits, so an unresolved delivery does not fail loudly.
+    await startOutbound({
+      channel: "discord" as never,
+      destination: "900000000000000042",
+    });
+
+    const sent = deliveries.filter((d) => d.transport === "discord");
+    expect(sent).toHaveLength(1);
+    expect(sent[0].to).toBe("dm-for-900000000000000042");
+  });
+});

package/src/__tests__/visible-app-context.test.ts

@@ -13,7 +13,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { createApp, deleteApp, getAppDirPath } from "../apps/app-store.js";
+import { createApp, deleteApp } from "../apps/app-store.js";
 import {
   clearConversations,
   setConversation,
@@ -56,7 +56,7 @@ afterEach(() => {
 });
 
 describe("buildVisibleAppContext", () => {
-  test("resolves the app's name, readable slug, and source directory", () => {
+  test("resolves the app's name and readable slug, without a host path", () => {
     // A workspace app id is an opaque UUID; the slug is the handle a human
     // (or the model) recognizes, so both have to come back.
     const app = createApp({
@@ -69,10 +69,27 @@ describe("buildVisibleAppContext", () => {
       appId: app.id,
       name: "Grocery List",
       slug: "grocery-list",
-      sourceDir: getAppDirPath(app.id),
     });
   });
 
+  test("carries no resolved directory, only derivable handles", () => {
+    // Only derivable handles ship: a workspace app's directory is the
+    // workspace `Root:` joined with the app-builder skill's
+    // `data/apps/<slug>/` layout, so no value here may be an absolute path.
+    const app = createApp({
+      name: "Grocery List",
+      schemaJson: "{}",
+      htmlDefinition: "<h1>Hello</h1>",
+    });
+
+    const context = buildVisibleAppContext(app.id);
+
+    expect(context).not.toBeNull();
+    for (const value of Object.values(context ?? {})) {
+      expect(value.startsWith("/")).toBe(false);
+    }
+  });
+
   test("returns null when no app is in view", () => {
     expect(buildVisibleAppContext(undefined)).toBeNull();
     expect(buildVisibleAppContext("")).toBeNull();
@@ -109,7 +126,6 @@ describe("buildVisibleAppContext", () => {
       appId: "plugins~acme~acme-dashboard",
       name: "acme-dashboard",
       slug: "acme-dashboard",
-      sourceDir: join(pluginDir, "apps", "acme-dashboard"),
       pluginName: "acme",
     });
   });

package/src/__tests__/web-search-history.test.ts

@@ -328,4 +328,100 @@ describe("stripHistoricalWebSearchResults", () => {
     const afterTypes = messages[0].content.map((b) => b.type);
     expect(afterTypes).toEqual(beforeTypes);
   });
+
+  test("drops the server_tool_use of a cross-message pair from a deferred execution", () => {
+    // Deferred execution places the web_search_tool_result at the head of the
+    // assistant message after the client tool round-trip. Both sides of the
+    // pair must go together, or the leftover server_tool_use reads as an
+    // orphan and gets a synthetic error result downstream.
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: "Check both" }] },
+      {
+        role: "assistant",
+        content: [
+          { type: "text", text: "On it" },
+          { type: "tool_use", id: "tu_read", name: "file_read", input: {} },
+          {
+            type: "server_tool_use",
+            id: "stu_deferred",
+            name: "web_search",
+            input: { query: "deferred query" },
+          },
+        ],
+      },
+      {
+        role: "user",
+        content: [
+          { type: "tool_result", tool_use_id: "tu_read", content: "file" },
+        ],
+      },
+      {
+        role: "assistant",
+        content: [
+          {
+            type: "web_search_tool_result",
+            tool_use_id: "stu_deferred",
+            content: [
+              {
+                type: "web_search_result",
+                url: "https://example.com",
+                title: "Deferred",
+                encrypted_content: "tok",
+              },
+            ],
+          },
+          { type: "text", text: "Found it." },
+        ],
+      },
+    ];
+
+    const { messages: result, stats } =
+      stripHistoricalWebSearchResults(messages);
+
+    // The use in the earlier assistant message is dropped with its result
+    expect(result[1].content.map((b) => b.type)).toEqual(["text", "tool_use"]);
+    const summarized = result[3].content[0];
+    expect(summarized.type).toBe("text");
+    expect((summarized as { text: string }).text).toContain("deferred query");
+    expect((summarized as { text: string }).text).toContain(
+      "https://example.com",
+    );
+    expect(stats.serverToolUsesDropped).toBe(1);
+    expect(stats.blocksStripped).toBe(1);
+    expect(stats.messagesModified).toBe(2);
+  });
+
+  test("leaves a pending server_tool_use with no result anywhere untouched", () => {
+    // A resultless use at the tail is a deferred search the provider executes
+    // on this request; stripping it would cancel the search.
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: "Check both" }] },
+      {
+        role: "assistant",
+        content: [
+          { type: "tool_use", id: "tu_read", name: "file_read", input: {} },
+          {
+            type: "server_tool_use",
+            id: "stu_pending",
+            name: "web_search",
+            input: { query: "pending" },
+          },
+        ],
+      },
+      {
+        role: "user",
+        content: [
+          { type: "tool_result", tool_use_id: "tu_read", content: "file" },
+        ],
+      },
+    ];
+
+    const { messages: result, stats } =
+      stripHistoricalWebSearchResults(messages);
+
+    expect(result).toEqual(messages);
+    expect(stats.serverToolUsesDropped).toBe(0);
+    expect(stats.blocksStripped).toBe(0);
+    expect(stats.messagesModified).toBe(0);
+  });
 });

package/src/__tests__/workspace-migration-139-clear-renamed-cost-profile-label.test.ts

@@ -51,15 +51,15 @@ afterEach(() => {
 });
 
 describe("139-clear-renamed-cost-profile-label migration", () => {
-  test("has correct migration id and is registered last", () => {
+  test("has correct migration id and is registered", () => {
     expect(clearRenamedCostProfileLabelMigration.id).toBe(
       "139-clear-renamed-cost-profile-label",
     );
-    // getLastWorkspaceMigrationId() reports the final entry as the registry
-    // ceiling, so the highest id must stay last.
-    expect(WORKSPACE_MIGRATIONS[WORKSPACE_MIGRATIONS.length - 1]?.id).toBe(
-      "139-clear-renamed-cost-profile-label",
-    );
+    expect(
+      WORKSPACE_MIGRATIONS.some(
+        (migration) => migration.id === "139-clear-renamed-cost-profile-label",
+      ),
+    ).toBe(true);
   });
 
   test("clears the seeded label so the code catalog label applies", () => {