@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/runtime/routes/__tests__/user-route-dispatcher.test.ts

@@ -1,5 +1,5 @@
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
@@ -574,4 +574,65 @@ describe("plugin routes", () => {
     );
     expect(other.status).toBe(404);
   });
+
+  test("a new route export is not bound to a stale helper after upgrade", async () => {
+    // Reproduces the browser plugin 500: `/frame` loaded `src/http.ts`
+    // first, then an upgrade added `requireNumber` to http.ts and a new
+    // `/input` that imports it. Cache-busting only the entry file rebound
+    // input.ts to the cached http.ts, which had no such export.
+    const plugin = "stale-helper";
+    const helperPath = join(getWorkspacePluginsDir(), plugin, "src", "http.ts");
+    mkdirSync(dirname(helperPath), { recursive: true });
+    writeFileSync(
+      helperPath,
+      `export function label() { return "v1"; }\n`,
+    );
+    writePluginHandler(
+      plugin,
+      "frame.ts",
+      `import { label } from "../src/http.js";
+       export function GET() { return Response.json({ label: label() }); }`,
+    );
+    writePluginHandler(
+      plugin,
+      "input.ts",
+      `import { label } from "../src/http.js";
+       export function POST() { return Response.json({ label: label() }); }`,
+    );
+
+    const dispatcher = makeDispatcher();
+    const frame1 = await dispatcher.dispatch(
+      `plugins/${plugin}/frame`,
+      makeRequest("GET"),
+    );
+    expect(frame1.status).toBe(200);
+    expect((await frame1.json()).label).toBe("v1");
+
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    writeFileSync(
+      helperPath,
+      `export function label() { return "v2"; }
+       export function extra() { return true; }\n`,
+    );
+    writePluginHandler(
+      plugin,
+      "input.ts",
+      `import { extra } from "../src/http.js";
+       export function POST() { return Response.json({ extra: extra() }); }`,
+    );
+
+    const input = await dispatcher.dispatch(
+      `plugins/${plugin}/input`,
+      makeRequest("POST"),
+    );
+    expect(input.status).toBe(200);
+    expect((await input.json()).extra).toBe(true);
+
+    const frame2 = await dispatcher.dispatch(
+      `plugins/${plugin}/frame`,
+      makeRequest("GET"),
+    );
+    expect(frame2.status).toBe(200);
+    expect((await frame2.json()).label).toBe("v2");
+  });
 });

package/src/runtime/routes/channel-availability-routes.ts

@@ -4,11 +4,11 @@
  * GET /v1/channels/available — return the channels this assistant can
  * surface to clients (Contacts / GuardianChannels views, etc.) along with
  * their display metadata (label, subtitle, icon, verification capability,
- * setup-message copy). Today this is a fixed base list plus `email` when
- * an inbox is registered; eventually the list will be driven by
- * plugins/skills the assistant has loaded. Clients should treat the
- * response as authoritative and stop carrying their own per-channel
- * switches.
+ * setup-message copy). A fixed base list, plus `email` when an inbox is
+ * registered, plus the channels installed plugins bring by declaring
+ * ingress. One list, because a plugin channel is a channel; each row's
+ * `source` says who contributes it. Clients should treat the response as
+ * authoritative and stop carrying their own per-channel switches.
  *
  * Distinct from `/v1/channels/readiness` (which answers "is this channel
  * configured and working?"). Availability answers "could this channel be
@@ -18,8 +18,9 @@
 import { z } from "zod";
 
 import { isA2AEnabled } from "../../a2a/feature-gate.js";
+import { discoverPluginChannels } from "../../channels/plugin-channel-declarations.js";
 import {
-  CHANNEL_IDS,
+  type AvailableChannel,
   CHANNEL_METADATA,
   type ChannelId,
   type ChannelInfo,
@@ -73,7 +74,7 @@ async function hasRegisteredInbox(): Promise<boolean> {
 
 async function handleGetChannelAvailability(
   _args: RouteHandlerArgs,
-): Promise<{ channels: ChannelInfo[] }> {
+): Promise<{ channels: AvailableChannel[] }> {
   const ids: ChannelId[] = [...BASE_AVAILABLE_CHANNELS];
   if (await hasRegisteredInbox()) {
     ids.push("email");
@@ -86,14 +87,26 @@ async function handleGetChannelAvailability(
   // contains channels that BASE_AVAILABLE_CHANNELS / the email branch
   // explicitly chose, so the lookup is always defined — filter to satisfy
   // the type system without a non-null assertion.
-  const channels = ids
+  const builtIn: AvailableChannel[] = ids
     .map((id) => CHANNEL_METADATA[id])
-    .filter((info): info is ChannelInfo => info !== undefined);
-  return { channels };
+    .filter((info): info is ChannelInfo => info !== undefined)
+    .map((info) => ({ ...info, source: "default" as const }));
+  // One list, because a plugin channel is a channel: what differs is who
+  // contributes it, which is what `source` says. Built-ins lead, so a client
+  // rendering in order gets a stable list that plugin installs append to.
+  return { channels: [...builtIn, ...(await discoverPluginChannels())] };
 }
 
 const channelInfoSchema = z.object({
-  id: z.enum(CHANNEL_IDS),
+  // A string rather than the channel enum: a plugin channel's id is its
+  // plugin name, and `source` is what says which kind a row is.
+  id: z.string(),
+  source: z
+    .string()
+    .describe(
+      "`default` for a channel the assistant ships, `plugin:<name>` for one " +
+        "an installed plugin brings",
+    ),
   label: z.string(),
   subtitle: z.string(),
   icon: z.string(),
@@ -117,14 +130,19 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "Return the channels this assistant can surface to clients, with " +
       "display metadata (label, icon, verification capability, setup " +
-      "copy). Today this is a fixed base list plus `email` when an inbox " +
-      "is registered; will become plugin/skill-driven in future.",
+      "copy). A fixed base list plus `email` when an inbox is registered, " +
+      "plus the channels installed plugins bring by declaring ingress " +
+      "routes. Each carries a `source` saying which of those it is.",
     tags: ["channels"],
     handler: handleGetChannelAvailability,
     responseBody: z.object({
       channels: z
         .array(channelInfoSchema)
-        .describe("Available channels in display order"),
+        .describe(
+          "Available channels in display order: the ones the assistant " +
+            "ships, then the ones installed plugins bring by declaring " +
+            "ingress routes. `source` distinguishes them.",
+        ),
     }),
   },
 ];

package/src/runtime/routes/channel-route-shared.ts

@@ -2,7 +2,6 @@
  * Shared types, constants, and utilities used across channel route modules.
  */
 import type { ChannelId } from "../../channels/types.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import {
   type ApprovalAction,
   type ApprovalDecisionResult,
@@ -10,11 +9,6 @@ import {
   isApprovalAction,
 } from "../channel-approval-types.js";
 
-/** Canonicalize assistantId for channel ingress paths. */
-export function canonicalChannelAssistantId(_assistantId: string): string {
-  return DAEMON_INTERNAL_ASSISTANT_ID;
-}
-
 // ---------------------------------------------------------------------------
 // Actor role
 // ---------------------------------------------------------------------------

package/src/runtime/routes/chatgpt-subscription-auth-routes.ts

@@ -159,13 +159,13 @@ async function handleExchange(args: RouteHandlerArgs) {
 
   const existing = getConnection(db, CONNECTION_NAME);
   if (existing) {
-    // Stamp the provider with the auth: this row is the subscription
-    // connection by name, and dispatch derives auth from the provider for
-    // managed rows, so a claiming row with e.g. provider "vellum" would
-    // otherwise strand the fresh token behind derived platform auth.
+    // Stamp the provider with the auth: this row IS the subscription route
+    // (auth modality = provider identity), and dispatch derives the openai
+    // upstream from the identity per-request. Stamping also heals a
+    // claiming row whose provider would otherwise misroute the fresh token.
     const updateResult = updateConnection(db, CONNECTION_NAME, {
       auth: authInput,
-      provider: "openai",
+      provider: "chatgpt",
     });
     if (!updateResult.ok) {
       log.error(
@@ -177,7 +177,7 @@ async function handleExchange(args: RouteHandlerArgs) {
   } else {
     const createResult = createConnection(db, {
       name: CONNECTION_NAME,
-      provider: "openai",
+      provider: "chatgpt",
       auth: authInput,
     });
     if (!createResult.ok) {

package/src/runtime/routes/conversation-list-routes.ts

@@ -3,6 +3,7 @@
  *
  * GET    /v1/conversations              — paginated conversation list
  * GET    /v1/conversations/unread-count - count of unseen foreground conversations
+ * GET    /v1/conversations/sections     - per-section totals for the sidebar index
  * POST   /v1/conversations/seen         — record a seen signal (single)
  * POST   /v1/conversations/seen/bulk    — record seen signals (batch)
  * POST   /v1/conversations/unread       — mark a conversation unread
@@ -29,6 +30,7 @@ import { resolveConversationId } from "../../persistence/conversation-key-store.
 import {
   type ConversationListFilter,
   countConversations,
+  countConversationSections,
   countUnreadConversations,
   listConversations,
   listPinnedConversations,
@@ -155,6 +157,42 @@ const unreadConversationCountResponseSchema = z.object({
   count: z.number(),
 });
 
+const sectionCountFields = {
+  total: z.number(),
+  unread: z.number(),
+};
+
+/**
+ * One renderable sidebar section. Discriminated by `kind` so clients get a
+ * typed union: group sections carry their metadata inline (one consistent
+ * snapshot, no join against `GET /v1/groups` that could disagree with it),
+ * channel sections carry only the id (labels are client-side i18n), and
+ * `chats` is the ungrouped-native bucket. In a view without channel sections
+ * the Chats card holds every ungrouped row: the buckets are disjoint, so
+ * that reading is `chats` plus the sum of `channel` entries.
+ */
+const conversationSectionSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("pinned"), ...sectionCountFields }),
+  z.object({
+    kind: z.literal("group"),
+    groupId: z.string(),
+    name: z.string(),
+    icon: z.string().nullable(),
+    sortPosition: z.number(),
+    ...sectionCountFields,
+  }),
+  z.object({
+    kind: z.literal("channel"),
+    channelId: z.string(),
+    ...sectionCountFields,
+  }),
+  z.object({ kind: z.literal("chats"), ...sectionCountFields }),
+]);
+
+const conversationSectionsResponseSchema = z.object({
+  sections: z.array(conversationSectionSchema),
+});
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -292,6 +330,64 @@ function handleGetUnreadConversationCount() {
   return { count: countUnreadConversations() };
 }
 
+/**
+ * One row per non-empty sidebar section, no conversation rows. What this
+ * exists to answer without a list drain: which sections render at all,
+ * and what their rail badges say.
+ *
+ * A count row whose `group_id` names no existing non-system group is
+ * skipped rather than surfaced: those rows are unreachable as a section
+ * (the sidebar builds group sections from the groups table), and a
+ * dangling id is a transient state around group deletion, not a section.
+ */
+function handleGetConversationSections() {
+  const counts = countConversationSections();
+  const groupsById = new Map(listGroups().map((g) => [g.id, g]));
+  const sections: Array<z.infer<typeof conversationSectionSchema>> = [];
+
+  for (const row of counts.groups) {
+    if (row.groupId === "system:pinned") {
+      sections.push({ kind: "pinned", total: row.total, unread: row.unread });
+      continue;
+    }
+    const meta = groupsById.get(row.groupId);
+    if (!meta || meta.isSystemGroup) {
+      continue;
+    }
+    sections.push({
+      kind: "group",
+      groupId: row.groupId,
+      name: meta.name,
+      icon: meta.icon,
+      sortPosition: meta.sortPosition,
+      total: row.total,
+      unread: row.unread,
+    });
+  }
+
+  for (const row of counts.channels) {
+    if (row.channel === "vellum") {
+      sections.push({ kind: "chats", total: row.total, unread: row.unread });
+      continue;
+    }
+    sections.push({
+      kind: "channel",
+      channelId: row.channel,
+      total: row.total,
+      unread: row.unread,
+    });
+  }
+
+  /* Every other section exists only when it has rows; Chats is the leftover
+     bucket and renders regardless, so its counts are part of the contract
+     even at zero. */
+  if (!sections.some((s) => s.kind === "chats")) {
+    sections.push({ kind: "chats", total: 0, unread: 0 });
+  }
+
+  return { sections };
+}
+
 function handleRecordSeen({ body = {}, headers }: RouteHandlerArgs) {
   const rawConversationId = body.conversationId as string | undefined;
   if (!rawConversationId) {
@@ -482,7 +578,7 @@ export const ROUTES: RouteDefinition[] = [
         type: "string",
         required: false,
         description:
-          'Filter to a single group, so each sidebar section can load independently of the paginated list. Pass "system:all" for conversations in no group, "system:pinned" for the Pinned section, or a custom group id. A group-scoped request is ordered by the user\'s arrangement (display order, then recency) and never has pinned rows appended to it. Omit to span every group.',
+          'Filter to a single group, so each sidebar section can load independently of the paginated list. Pass "system:all" for conversations in no group, "system:pinned" for the Pinned section, or a custom group id. A group-scoped request is recency-ordered like every list read (COALESCE(last_message_at, updated_at) descending) and never has pinned rows appended to it. Omit to span every group.',
       },
     ],
     responseBody: listConversationsResponseSchema,
@@ -503,6 +599,21 @@ export const ROUTES: RouteDefinition[] = [
     responseBody: unreadConversationCountResponseSchema,
     handler: handleGetUnreadConversationCount,
   },
+  {
+    operationId: "getConversationSections",
+    endpoint: "conversations/sections",
+    method: "GET",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Sidebar section index",
+    description:
+      "One row per renderable sidebar section (Pinned, each non-empty custom group, each origin channel with unassigned conversations, Chats) with total and unread counts and no conversation rows. Lets a client know which sections exist, and what their badges say, without fetching any conversation list. Totals follow the standard listing visibility; unread applies the same rules as GET /v1/conversations/unread-count scoped to the section. Chats is always present, even at zero: it is the leftover bucket and renders regardless.",
+    tags: ["conversations"],
+    responseBody: conversationSectionsResponseSchema,
+    handler: handleGetConversationSections,
+  },
   {
     operationId: "recordConversationSeen",
     endpoint: "conversations/seen",

package/src/runtime/routes/conversation-query-routes.ts

@@ -41,7 +41,10 @@ import {
   withSuppressedConfigDiskWrites,
   withSuppressedConfigDiskWritesSync,
 } from "../../config/loader.js";
-import { completeCustomProfile } from "../../config/profile-materialization.js";
+import {
+  completeCustomProfile,
+  mergePreservingUnknownKeys,
+} from "../../config/profile-materialization.js";
 import { AssistantConfigSchema } from "../../config/schema.js";
 import { getSchemaAtPath } from "../../config/schema-utils.js";
 import {
@@ -50,6 +53,7 @@ import {
   LLMConfigFragment,
   ProfileEntry,
   routingIdentityModelIssue,
+  unknownLlmProviderIssue,
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
@@ -96,6 +100,7 @@ import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
 import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/v2/activation-log-store.js";
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
+import { writableProfileProviderIssue } from "../../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
 import {
@@ -1252,30 +1257,6 @@ function assertInvariantProfilesPreserved(
   }
 }
 
-/**
- * `{...raw, ...completed}` recursively: completed (schema-known) values win,
- * raw keys the schema stripped survive at every depth.
- */
-function mergePreservingUnknownKeys(
-  raw: Record<string, unknown>,
-  completed: Record<string, unknown>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw, ...completed };
-  for (const [key, value] of Object.entries(completed)) {
-    const rawValue = raw[key];
-    if (
-      readPlainObject(value) !== undefined &&
-      readPlainObject(rawValue) !== undefined
-    ) {
-      out[key] = mergePreservingUnknownKeys(
-        rawValue as Record<string, unknown>,
-        value as Record<string, unknown>,
-      );
-    }
-  }
-  return out;
-}
-
 /**
  * Custom profiles persist as complete overrides: any user-source, non-mix
  * profile entry this write creates or changes is completed against the
@@ -1343,7 +1324,9 @@ function completeChangedCustomProfiles(
  * would let the pair reach disk and be stripped on the next read — a silent
  * no-op where the user expects a saved override.
  */
-function assertRoutableIdentityEntries(raw: Record<string, unknown>): void {
+function collectProviderEntries(
+  raw: Record<string, unknown>,
+): [string, { provider?: unknown; model?: unknown }][] {
   const llm = raw.llm as
     | {
         default?: { provider?: unknown; model?: unknown } | null;
@@ -1371,10 +1354,40 @@ function assertRoutableIdentityEntries(raw: Record<string, unknown>): void {
       }
     }
   }
+  return entries;
+}
+
+function assertRoutableIdentityEntries(
+  preWrite: Record<string, unknown>,
+  raw: Record<string, unknown>,
+): void {
+  const entries = collectProviderEntries(raw);
+  const priorProviders = new Map(
+    collectProviderEntries(preWrite).flatMap(([label, entry]) =>
+      typeof entry.provider === "string" ? [[label, entry.provider]] : [],
+    ),
+  );
   for (const [label, entry] of entries) {
     if (typeof entry.provider !== "string") {
       continue;
     }
+    // The provider schema is an open string (a stored value outside the
+    // known set parses instead of stripping its profile), so write-time
+    // membership is enforced here and at the profiles route. Scoped to
+    // providers this write introduces or changes: a stored value outside
+    // the known set is readable and dispatchable by design, and
+    // re-validating it on every write would make all later settings saves
+    // fail with no in-product repair path. Profiles accept entry names;
+    // call-site fragments and the legacy default blob stay vendor-only
+    // (overrides become model-only with the entries demolition).
+    if (entry.provider !== priorProviders.get(label)) {
+      const providerIssue = label.startsWith("llm.profiles.")
+        ? writableProfileProviderIssue(entry.provider)
+        : unknownLlmProviderIssue(entry.provider);
+      if (providerIssue) {
+        throw new BadRequestError(`${providerIssue} (${label})`);
+      }
+    }
     const issue = routingIdentityModelIssue(
       entry.provider,
       typeof entry.model === "string" ? entry.model : undefined,
@@ -1396,7 +1409,7 @@ export async function commitConfigWrite(
   const preWrite = loadRawConfig();
   completeChangedCustomProfiles(preWrite, raw);
   assertInvariantProfilesPreserved(preWrite, raw);
-  assertRoutableIdentityEntries(raw);
+  assertRoutableIdentityEntries(preWrite, raw);
 
   // Suppress the file-watcher callback for the duration of the debounce
   // window. Without this, the ConfigWatcher detects the config.json write

package/src/runtime/routes/credential-prompt-routes.ts

@@ -55,14 +55,11 @@ const CredentialPromptParams = z.object({
  *
  * The prompt blocks until the user answers, so by the time a caller reads the
  * result the secure input is already gone from the UI. A bare `ok: true` reads
- * as "the prompt opened successfully", which leads a model to follow up with
- * "the prompt is open, paste your value there" — pointing the user at a surface
- * that has already closed. The user, having just submitted, re-answers a prompt
- * that never reappears, and the flow loops. State the close explicitly so the
- * only available reading is the correct one.
+ * as "the prompt opened successfully", which invites a follow-up telling the
+ * user to paste into a surface that has already closed. Stating the close
+ * leaves only the correct reading.
  */
-const PROMPT_CLOSED_NOTICE =
-  "The secure prompt has closed — do not ask the user to enter this value again.";
+const PROMPT_CLOSED_NOTICE = "The secure prompt has closed.";
 
 export type CredentialPromptResult = {
   ok: boolean;

package/src/runtime/routes/default-provider-routes.ts

@@ -25,6 +25,7 @@ import {
   DEFAULT_PROVIDER_CHOICES,
   DefaultProviderSchema,
 } from "../../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import {
   computeConnectionAvailability,
   CONNECTION_AVAILABILITY_STATUSES,
@@ -93,6 +94,20 @@ async function handlePutDefaultProvider({
       )}; "connectionName" is optional and must be a non-empty string.`,
     );
   }
+  // Routing identities dispatch through their canonical row regardless of
+  // any stored pin (`resolveRoutingIdentity`), so a noncanonical
+  // connectionName would be judged by availability and the deletion guards
+  // while inference uses a different row. Reject it here rather than
+  // persisting a pin that status and dispatch disagree about.
+  const { provider, connectionName } = result.data;
+  if (connectionName != null && ROUTING_IDENTITY_PROVIDERS.has(provider)) {
+    const canonical = resolveDefaultConnectionName({ provider });
+    if (connectionName !== canonical) {
+      throw new BadRequestError(
+        `Provider "${provider}" always dispatches through its canonical connection "${canonical}". Omit "connectionName" or pass "${canonical}".`,
+      );
+    }
+  }
   setDefaultProvider(result.data);
   return handleGetDefaultProvider();
 }