@vellumai/assistant 0.12.1-staging.1 → 0.12.1

package/src/runtime/routes/__tests__/dictation-cleanup-guard.test.ts

@@ -1,107 +0,0 @@
-/**
- * The dictation cleanup pass rewrites what the user actually said, so a
- * rewrite the provider cut off at the token cap must never become the
- * payload: the raw transcript is sent instead.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import {
-  computeMaxTokens,
-  resolveCleanedDictation,
-} from "../diagnostics-routes.js";
-
-const SPOKEN =
-  "Hello Quill can you generate a list of 20 open HR coordinator or HR " +
-  "related roles that are remote and pay about 50 to 60 K per year";
-
-describe("resolveCleanedDictation", () => {
-  test("accepts an ordinary cleanup", () => {
-    const cleaned =
-      "Hello Quill, can you generate a list of 20 open HR coordinator or HR " +
-      "related roles that are remote and pay about 50 to 60K per year?";
-    expect(resolveCleanedDictation(SPOKEN, cleaned, "end_turn")).toEqual({
-      text: cleaned,
-      rejected: null,
-    });
-  });
-
-  test("trims surrounding whitespace off an accepted cleanup", () => {
-    const { text } = resolveCleanedDictation(
-      "so um I think we should ship the thing on Tuesday you know",
-      "  I think we should ship the thing on Tuesday.  ",
-      "end_turn",
-    );
-    expect(text).toBe("I think we should ship the thing on Tuesday.");
-  });
-
-  test("rejects a rewrite cut off by max_tokens and keeps the raw words", () => {
-    expect(
-      resolveCleanedDictation(
-        SPOKEN,
-        "Hello Quill, can you create a list",
-        "max_tokens",
-      ),
-    ).toEqual({ text: SPOKEN, rejected: "truncated" });
-  });
-
-  test("rejects a max_tokens rewrite even when it kept most of the words", () => {
-    const nearlyComplete = SPOKEN.slice(0, SPOKEN.length - 4);
-    const { rejected } = resolveCleanedDictation(
-      SPOKEN,
-      nearlyComplete,
-      "max_tokens",
-    );
-    expect(rejected).toBe("truncated");
-  });
-
-  test("rejects the token-cap stop under every provider's name for it", () => {
-    for (const stopReason of ["length", "max_output_tokens", "MAX_TOKENS "]) {
-      expect(
-        resolveCleanedDictation(SPOKEN, "Hello Quill, can you", stopReason)
-          .rejected,
-      ).toBe("truncated");
-    }
-  });
-
-  test("a missing stop reason is not treated as a truncation", () => {
-    const cleaned = "Hello Quill, can you generate a list?";
-    expect(resolveCleanedDictation(SPOKEN, cleaned, undefined)).toEqual({
-      text: cleaned,
-      rejected: null,
-    });
-  });
-
-  test("a much shorter rewrite is the model's call, not a rejection", () => {
-    // The prompt asks for fillers and vague phrasing to go, so a concise
-    // rewrite of a rambling utterance is a correct cleanup.
-    const spoken =
-      "um you know I just kind of wanted to say like thank you so much you know";
-    expect(
-      resolveCleanedDictation(spoken, "Thank you so much.", "end_turn"),
-    ).toEqual({ text: "Thank you so much.", rejected: null });
-  });
-
-  test("an empty rewrite falls back to raw without flagging a rejection", () => {
-    // The model returned nothing usable; there is no rewrite to distrust.
-    expect(resolveCleanedDictation(SPOKEN, "   ", "end_turn")).toEqual({
-      text: SPOKEN,
-      rejected: null,
-    });
-  });
-});
-
-describe("computeMaxTokens", () => {
-  test("budgets room for the transcript, reasoning, and JSON scaffolding", () => {
-    // The tool call carries the whole transcript back in `text`, so the
-    // budget has to clear the input's own token count with room to spare.
-    const estimatedInputTokens = Math.ceil(SPOKEN.length / 3);
-    expect(computeMaxTokens(SPOKEN.length)).toBeGreaterThan(
-      estimatedInputTokens * 2,
-    );
-  });
-
-  test("holds a floor for very short transcripts", () => {
-    expect(computeMaxTokens(5)).toBe(512);
-  });
-});

package/src/runtime/routes/channel-send-routes.ts

@@ -1,85 +0,0 @@
-/**
- * Route handler for a model-directed text send to a channel chat.
- *
- * POST /v1/channels/send: deliver text to a chat on a channel through the
- * channel's transport, recorded after acknowledgement. The
- * messaging tool's channel branch runs the same function in-process; this
- * route is the door for the CLI and scripts, so the two doors share one
- * seam and one record.
- */
-
-import { z } from "zod";
-
-import { CHANNEL_IDS } from "../../channels/types.js";
-import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
-import {
-  ChannelNotAddressableError,
-  ChannelSendFailedError,
-  sendChannelText,
-} from "../channel-send.js";
-import { BadGatewayError, BadRequestError } from "./errors.js";
-import { parseBody } from "./parse-body.js";
-import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
-
-const ProactiveTargetSchema = z.object({
-  kind: z.literal("chat"),
-  chatId: z.string().min(1).describe("Chat id in the channel's own id space"),
-  threadId: z
-    .string()
-    .min(1)
-    .optional()
-    .describe("Thread within the chat, in the channel's own id space"),
-});
-
-const ChannelSendRequestSchema = z.object({
-  channel: z.enum(CHANNEL_IDS).describe("Channel to send on"),
-  target: ProactiveTargetSchema,
-  text: z.string().min(1).describe("Text to send"),
-  renderRichly: z
-    .boolean()
-    .optional()
-    .describe("Ask the channel for its rich rendering, where it has one"),
-});
-
-const ChannelSendResponseSchema = z.object({
-  channel: z.enum(CHANNEL_IDS),
-  chatId: z.string(),
-  threadId: z.string().optional(),
-  messageIds: z.array(z.string()),
-  lastMessageId: z.string(),
-  recordedIn: z.string().optional(),
-});
-
-async function handleChannelSend({ body }: RouteHandlerArgs) {
-  const request = parseBody(ChannelSendRequestSchema, body);
-  try {
-    return await sendChannelText(request);
-  } catch (e) {
-    if (e instanceof ChannelNotAddressableError) {
-      throw new BadRequestError(e.message);
-    }
-    if (e instanceof ChannelSendFailedError) {
-      throw new BadGatewayError(e.message);
-    }
-    throw e;
-  }
-}
-
-export const ROUTES: RouteDefinition[] = [
-  {
-    operationId: "channels_send_post",
-    endpoint: "channels/send",
-    method: "POST",
-    policy: {
-      requiredScopes: ["chat.write"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    summary: "Send text to a channel chat",
-    description:
-      "Deliver text to a chat on a channel through the channel's transport, recorded after the channel acknowledges it.",
-    tags: ["channels"],
-    handler: handleChannelSend,
-    requestBody: ChannelSendRequestSchema,
-    responseBody: ChannelSendResponseSchema,
-  },
-];

package/src/runtime/routes/desktop-setup-routes.test.ts

@@ -1,74 +0,0 @@
-import {
-  afterAll,
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  spyOn,
-  test,
-} from "bun:test";
-
-import { setOverridesForTesting } from "../../__tests__/feature-flag-test-helpers.js";
-import { desktopDependencyInstaller } from "../../desktop/desktop-dependencies.js";
-import { ROUTES } from "./desktop-setup-routes.js";
-import { NotFoundError } from "./errors.js";
-
-const originalContainerized = process.env.IS_CONTAINERIZED;
-const status = spyOn(desktopDependencyInstaller, "getStatus");
-const start = spyOn(desktopDependencyInstaller, "start");
-
-afterAll(() => {
-  status.mockRestore();
-  start.mockRestore();
-});
-
-beforeEach(() => {
-  process.env.IS_CONTAINERIZED = "true";
-  status.mockReturnValue({ state: "required" });
-  start.mockReturnValue({ state: "installing", stage: "packages" });
-});
-
-afterEach(() => {
-  if (originalContainerized === undefined) {
-    delete process.env.IS_CONTAINERIZED;
-  } else {
-    process.env.IS_CONTAINERIZED = originalContainerized;
-  }
-  setOverridesForTesting({});
-  status.mockClear();
-  start.mockClear();
-});
-
-describe("desktop setup route feature gate", () => {
-  for (const route of ROUTES) {
-    for (const flag of [false, undefined]) {
-      test(`${route.method} refuses a disabled or missing flag (${flag}) without touching setup`, () => {
-        setOverridesForTesting(
-          flag === undefined ? {} : { "assistant-desktop": flag },
-        );
-        expect(() => route.handler({})).toThrow(NotFoundError);
-        expect(status).not.toHaveBeenCalled();
-        expect(start).not.toHaveBeenCalled();
-      });
-    }
-
-    test(`${route.method} refuses non-containerized assistants even with the flag enabled`, () => {
-      process.env.IS_CONTAINERIZED = "false";
-      setOverridesForTesting({ "assistant-desktop": true });
-      expect(() => route.handler({})).toThrow(NotFoundError);
-      expect(status).not.toHaveBeenCalled();
-      expect(start).not.toHaveBeenCalled();
-    });
-
-    test(`${route.method} serves setup only with the flag enabled in a container`, () => {
-      setOverridesForTesting({ "assistant-desktop": true });
-      expect(route.handler({})).toEqual(
-        route.method === "GET"
-          ? { state: "required" }
-          : { state: "installing", stage: "packages" },
-      );
-      expect(route.method === "GET" ? status : start).toHaveBeenCalledTimes(1);
-      expect(route.method === "GET" ? start : status).not.toHaveBeenCalled();
-    });
-  }
-});

package/src/runtime/routes/desktop-setup-routes.ts

@@ -1,35 +0,0 @@
-import { z } from "zod";
-
-import { getConfig } from "../../config/loader.js";
-import { desktopDependencyInstaller } from "../../desktop/desktop-dependencies.js";
-import { isAssistantDesktopEnabled } from "../../desktop/desktop-feature.js";
-import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
-import { NotFoundError } from "./errors.js";
-import type { RouteDefinition } from "./types.js";
-
-const statusSchema = z.object({
-  state: z.enum(["required", "installing", "ready", "failed", "unsupported"]),
-  stage: z.enum(["packages", "chrome", "checking"]).optional(),
-});
-
-export const ROUTES: RouteDefinition[] = ["GET", "POST"].map((method) => ({
-  operationId:
-    method === "GET" ? "desktop_setup_status" : "desktop_setup_install",
-  endpoint: "desktop/setup",
-  method,
-  policy: { requiredScopes: [], allowedPrincipalTypes: GATEWAY_PRINCIPALS },
-  handler: () => {
-    if (!isAssistantDesktopEnabled(getConfig())) {
-      throw new NotFoundError("Desktop is not available on this assistant");
-    }
-    return method === "GET"
-      ? desktopDependencyInstaller.getStatus()
-      : desktopDependencyInstaller.start();
-  },
-  summary:
-    method === "GET"
-      ? "Get desktop setup status"
-      : "Install desktop components",
-  tags: ["desktop"],
-  responseBody: statusSchema,
-}));

package/src/security/__tests__/ces-http-record-backend.test.ts

@@ -1,137 +0,0 @@
-import { afterEach, describe, expect, spyOn, test } from "bun:test";
-
-import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
-
-import * as envRegistry from "../../config/env-registry.js";
-import {
-  CesHttpRecordBackend,
-  createCesHttpRecordBackendIfConfigured,
-} from "../ces-http-record-backend.js";
-
-const ORIGINAL_URL = process.env.CES_CREDENTIAL_URL;
-const ORIGINAL_TOKEN = process.env.CES_SERVICE_TOKEN;
-
-function restoreCesHttpEnv(): void {
-  if (ORIGINAL_URL === undefined) {
-    delete process.env.CES_CREDENTIAL_URL;
-  } else {
-    process.env.CES_CREDENTIAL_URL = ORIGINAL_URL;
-  }
-  if (ORIGINAL_TOKEN === undefined) {
-    delete process.env.CES_SERVICE_TOKEN;
-  } else {
-    process.env.CES_SERVICE_TOKEN = ORIGINAL_TOKEN;
-  }
-}
-
-function fakeHttpClient(options: {
-  listRecords: () => Promise<{
-    records: Array<{ account: string; record: CredentialRecord }>;
-    unreachable: boolean;
-  }>;
-}) {
-  return {
-    getRecord: async () => ({ record: undefined, unreachable: false }),
-    setRecord: async () => false,
-    deleteRecord: async () => "error" as const,
-    listRecords: options.listRecords,
-    bulkSetRecords: async (records: Array<{ account: string }>) =>
-      records.map((entry) => ({ account: entry.account, ok: false })),
-  };
-}
-
-describe("CES HTTP credential record backend", () => {
-  afterEach(() => {
-    restoreCesHttpEnv();
-  });
-
-  test("factory returns null when the assistant is not containerized", () => {
-    const spy = spyOn(envRegistry, "getIsContainerized").mockReturnValue(false);
-    process.env.CES_CREDENTIAL_URL = "http://ces-container:8090";
-    process.env.CES_SERVICE_TOKEN = "token-123";
-    try {
-      expect(createCesHttpRecordBackendIfConfigured()).toBeNull();
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  test("factory returns null when CES_CREDENTIAL_URL is unset", () => {
-    const spy = spyOn(envRegistry, "getIsContainerized").mockReturnValue(true);
-    delete process.env.CES_CREDENTIAL_URL;
-    process.env.CES_SERVICE_TOKEN = "token-123";
-    try {
-      expect(createCesHttpRecordBackendIfConfigured()).toBeNull();
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  test("factory returns null when CES_SERVICE_TOKEN is unset", () => {
-    const spy = spyOn(envRegistry, "getIsContainerized").mockReturnValue(true);
-    process.env.CES_CREDENTIAL_URL = "http://ces-container:8090";
-    delete process.env.CES_SERVICE_TOKEN;
-    try {
-      expect(createCesHttpRecordBackendIfConfigured()).toBeNull();
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  test("factory returns a backend when containerized with CES HTTP env", () => {
-    const spy = spyOn(envRegistry, "getIsContainerized").mockReturnValue(true);
-    process.env.CES_CREDENTIAL_URL = "http://ces-container:8090";
-    process.env.CES_SERVICE_TOKEN = "token-123";
-    try {
-      const backend = createCesHttpRecordBackendIfConfigured();
-      expect(backend?.name).toBe("ces-http");
-      expect(backend?.isAvailable()).toBe(true);
-    } finally {
-      spy.mockRestore();
-    }
-  });
-
-  test("list returns records when HTTP reports a reachable catalog", async () => {
-    const record: CredentialRecord = {
-      credentialId: "cred-http",
-      service: "github",
-      field: "token",
-      allowedTools: ["bash"],
-      allowedDomains: [],
-      createdAt: 1,
-      updatedAt: 2,
-    };
-    const backend = new CesHttpRecordBackend(
-      fakeHttpClient({
-        listRecords: async () => ({
-          records: [{ account: "github:token", record }],
-          unreachable: false,
-        }),
-      }),
-    );
-
-    const listed = await backend.list();
-    expect(listed).toEqual([{ account: "github:token", record }]);
-  });
-
-  test("list returns an empty catalog when HTTP is reachable and empty", async () => {
-    const backend = new CesHttpRecordBackend(
-      fakeHttpClient({
-        listRecords: async () => ({ records: [], unreachable: false }),
-      }),
-    );
-
-    const listed = await backend.list();
-    expect(listed).toEqual([]);
-  });
-
-  test("list returns null when HTTP reports the vault unreachable", async () => {
-    const backend = new CesHttpRecordBackend(
-      fakeHttpClient({
-        listRecords: async () => ({ records: [], unreachable: true }),
-      }),
-    );
-
-    expect(await backend.list()).toBeNull();
-  });
-});

package/src/security/ces-http-record-backend.ts

@@ -1,120 +0,0 @@
-/**
- * CES HTTP backend for non-secret credential records (identity + policy).
- *
- * Used when the CES RPC socket is down but the CES HTTP sidecar is
- * reachable (containerized deployments with CES_CREDENTIAL_URL).
- */
-
-import {
-  type CesHttpCredentialClient,
-  createCesHttpCredentialClient,
-} from "@vellumai/ces-client/http-credentials";
-import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
-
-import { getIsContainerized } from "../config/env-registry.js";
-import { getLogger } from "../util/logger.js";
-import type { CredentialRecordBackend } from "./ces-rpc-record-backend.js";
-
-const log = getLogger("ces-http-record-backend");
-
-type RecordHttpClient = Pick<
-  CesHttpCredentialClient,
-  | "getRecord"
-  | "setRecord"
-  | "deleteRecord"
-  | "listRecords"
-  | "bulkSetRecords"
->;
-
-function resolveEnvHttpClient(): RecordHttpClient | undefined {
-  const baseUrl = process.env.CES_CREDENTIAL_URL?.trim();
-  const serviceToken = process.env.CES_SERVICE_TOKEN?.trim();
-  if (!baseUrl || !serviceToken) {
-    return undefined;
-  }
-  return createCesHttpCredentialClient({ baseUrl, serviceToken }, log);
-}
-
-export class CesHttpRecordBackend implements CredentialRecordBackend {
-  readonly name = "ces-http";
-
-  constructor(private readonly client?: RecordHttpClient) {}
-
-  private resolveClient(): RecordHttpClient | undefined {
-    return this.client ?? resolveEnvHttpClient();
-  }
-
-  isAvailable(): boolean {
-    return this.resolveClient() !== undefined;
-  }
-
-  async get(account: string): Promise<CredentialRecord | undefined> {
-    const client = this.resolveClient();
-    if (!client) {
-      return undefined;
-    }
-    const result = await client.getRecord(account);
-    return result.record;
-  }
-
-  async set(account: string, record: CredentialRecord): Promise<boolean> {
-    const client = this.resolveClient();
-    if (!client) {
-      return false;
-    }
-    return client.setRecord(account, record);
-  }
-
-  async delete(
-    account: string,
-  ): Promise<"deleted" | "not-found" | "error"> {
-    const client = this.resolveClient();
-    if (!client) {
-      return "error";
-    }
-    return client.deleteRecord(account);
-  }
-
-  async list(): Promise<Array<{
-    account: string;
-    record: CredentialRecord;
-  }> | null> {
-    const client = this.resolveClient();
-    if (!client) {
-      return null;
-    }
-    const result = await client.listRecords();
-    if (result.unreachable) {
-      return null;
-    }
-    return result.records ?? [];
-  }
-
-  async bulkSet(
-    records: Array<{ account: string; record: CredentialRecord }>,
-  ): Promise<Array<{ account: string; ok: boolean }>> {
-    const client = this.resolveClient();
-    if (!client) {
-      return records.map((entry) => ({ account: entry.account, ok: false }));
-    }
-    return client.bulkSetRecords(records);
-  }
-}
-
-/**
- * CES HTTP record backend when the assistant is containerized and the
- * CES HTTP sidecar URL is configured. Returns null otherwise.
- */
-export function createCesHttpRecordBackendIfConfigured(): CredentialRecordBackend | null {
-  if (!getIsContainerized()) {
-    return null;
-  }
-  if (!process.env.CES_CREDENTIAL_URL?.trim()) {
-    return null;
-  }
-  const backend = new CesHttpRecordBackend();
-  if (!backend.isAvailable()) {
-    return null;
-  }
-  return backend;
-}

package/src/skills/__tests__/workspace-skill-md-signature.test.ts

@@ -1,60 +0,0 @@
-import { mkdirSync, mkdtempSync, rmSync, utimesSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, describe, expect, test } from "bun:test";
-
-import { readWorkspaceSkillMdSignature } from "../workspace-skill-md-signature.js";
-
-const ROOT = mkdtempSync(join(tmpdir(), "skill-md-signature-"));
-
-afterEach(() => {
-  rmSync(ROOT, { recursive: true, force: true });
-  mkdirSync(ROOT, { recursive: true });
-});
-
-function writeSkill(id: string, body = "body"): string {
-  const dir = join(ROOT, id);
-  mkdirSync(dir, { recursive: true });
-  const skillMd = join(dir, "SKILL.md");
-  writeFileSync(skillMd, `---\nname: ${id}\ndescription: ${id}\n---\n${body}\n`);
-  return skillMd;
-}
-
-describe("readWorkspaceSkillMdSignature", () => {
-  test("empty or missing skills dir is the empty signature", () => {
-    expect(readWorkspaceSkillMdSignature(join(ROOT, "missing"))).toBe("");
-    mkdirSync(ROOT, { recursive: true });
-    expect(readWorkspaceSkillMdSignature(ROOT)).toBe("");
-  });
-
-  test("includes SKILL.md mtimes and ignores TOOLS.json", () => {
-    const skillMd = writeSkill("alpha");
-    const first = readWorkspaceSkillMdSignature(ROOT);
-    expect(first).toMatch(/^alpha:\d+$/);
-
-    writeFileSync(join(ROOT, "alpha", "TOOLS.json"), '{"version":1,"tools":[]}');
-    expect(readWorkspaceSkillMdSignature(ROOT)).toBe(first);
-
-    const later = new Date(Date.now() + 5_000);
-    utimesSync(skillMd, later, later);
-    expect(readWorkspaceSkillMdSignature(ROOT)).not.toBe(first);
-  });
-
-  test("add and remove skill directories change the signature", () => {
-    writeSkill("alpha");
-    const one = readWorkspaceSkillMdSignature(ROOT);
-    writeSkill("bravo");
-    const two = readWorkspaceSkillMdSignature(ROOT);
-    expect(two).not.toBe(one);
-    expect(two.split("\n")).toHaveLength(2);
-
-    rmSync(join(ROOT, "bravo"), { recursive: true, force: true });
-    expect(readWorkspaceSkillMdSignature(ROOT)).toBe(one);
-  });
-
-  test("directories without SKILL.md are omitted", () => {
-    mkdirSync(join(ROOT, "not-a-skill"), { recursive: true });
-    writeFileSync(join(ROOT, "README.md"), "nope");
-    expect(readWorkspaceSkillMdSignature(ROOT)).toBe("");
-  });
-});

package/src/skills/workspace-skill-md-signature.ts

@@ -1,50 +0,0 @@
-import { existsSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-
-import { getWorkspaceSkillsDir } from "../util/platform.js";
-
-/**
- * Cheap change detector for workspace skill capability cards: the sorted set
- * of immediate skill directories that contain a top-level `SKILL.md`, each
- * paired with that file's mtime. Capability cards are frontmatter fields from
- * `SKILL.md`. Body files, `TOOLS.json`, scripts, and `references/` are not part
- * of this signature.
- *
- * Listing the skills directory (not only statting known paths) is what makes
- * install and delete visible: a new or removed skill directory changes the
- * signature even when no previously known `SKILL.md` mtime moved.
- */
-export function readWorkspaceSkillMdSignature(
-  skillsDir: string = getWorkspaceSkillsDir(),
-): string {
-  if (!existsSync(skillsDir)) {
-    return "";
-  }
-
-  let entries;
-  try {
-    entries = readdirSync(skillsDir, { withFileTypes: true });
-  } catch {
-    return "";
-  }
-
-  const parts: string[] = [];
-  for (const entry of entries) {
-    if (!entry.isDirectory() && !entry.isSymbolicLink()) {
-      continue;
-    }
-    const skillMdPath = join(skillsDir, entry.name, "SKILL.md");
-    try {
-      const st = statSync(skillMdPath);
-      if (!st.isFile()) {
-        continue;
-      }
-      parts.push(`${entry.name}:${Math.trunc(st.mtimeMs)}`);
-    } catch {
-      // No readable SKILL.md: not a catalog skill.
-    }
-  }
-
-  parts.sort();
-  return parts.join("\n");
-}