@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/runtime/routes/__tests__/apps-refresh-route.test.ts

@@ -0,0 +1,205 @@
+/**
+ * Tests for POST apps/:id/refresh (apps_refresh) in the shared route table.
+ *
+ * `mock.module` is process-global in Bun. Stubs delegate to the real
+ * implementations unless this file's tests are running.
+ */
+
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+import type { CompileResult } from "../../../bundler/app-compiler.js";
+
+let mockActive = false;
+beforeAll(() => {
+  mockActive = true;
+});
+afterAll(() => {
+  mockActive = false;
+});
+
+const realCompiler = { ...(await import("../../../bundler/app-compiler.js")) };
+const realNotify = {
+  ...(await import("../../../daemon/app-change-notify.js")),
+};
+
+const compileApp = mock(
+  async (
+    _appDir: Parameters<typeof realCompiler.compileApp>[0],
+  ): Promise<CompileResult> => ({
+    ok: true,
+    errors: [],
+    warnings: [],
+    durationMs: 11,
+  }),
+);
+const notifyAppSurfacesChanged = mock(
+  (..._args: Parameters<typeof realNotify.notifyAppSurfacesChanged>) => {},
+);
+
+mock.module("../../../bundler/app-compiler.js", () => ({
+  ...realCompiler,
+  compileApp: (...args: Parameters<typeof realCompiler.compileApp>) => {
+    if (!mockActive) {
+      return realCompiler.compileApp(...args);
+    }
+    return compileApp(...args);
+  },
+}));
+
+mock.module("../../../daemon/app-change-notify.js", () => ({
+  ...realNotify,
+  notifyAppSurfacesChanged: (
+    ...args: Parameters<typeof realNotify.notifyAppSurfacesChanged>
+  ) => {
+    if (!mockActive) {
+      return realNotify.notifyAppSurfacesChanged(...args);
+    }
+    return notifyAppSurfacesChanged(...args);
+  },
+}));
+
+const { createApp } = await import("../../../apps/app-store.js");
+const { getWorkspacePluginsDir } = await import("../../../util/platform.js");
+const { ROUTES } = await import("../app-management-routes.js");
+
+function findHandler(operationId: string) {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) {
+    throw new Error(`Route ${operationId} not found`);
+  }
+  return route.handler;
+}
+
+const handleRefreshApp = findHandler("apps_refresh");
+
+let workspaceDir: string;
+let previousWorkspaceDir: string | undefined;
+
+beforeEach(() => {
+  previousWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+  workspaceDir = join(
+    tmpdir(),
+    `vellum-apps-refresh-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+  );
+  process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+  compileApp.mockClear();
+  notifyAppSurfacesChanged.mockClear();
+  compileApp.mockResolvedValue({
+    ok: true,
+    errors: [],
+    warnings: [],
+    durationMs: 11,
+  });
+});
+
+afterEach(() => {
+  rmSync(workspaceDir, { recursive: true, force: true });
+  if (previousWorkspaceDir === undefined) {
+    delete process.env.VELLUM_WORKSPACE_DIR;
+  } else {
+    process.env.VELLUM_WORKSPACE_DIR = previousWorkspaceDir;
+  }
+});
+
+describe("apps_refresh route", () => {
+  test("is registered on the shared app-management ROUTES table", () => {
+    expect(typeof handleRefreshApp).toBe("function");
+  });
+
+  test("compiles a workspace app and notifies surfaces", async () => {
+    const created = createApp({
+      name: "Budget",
+      schemaJson: "{}",
+      htmlDefinition: "<h1>Budget</h1>",
+    });
+
+    const result = await handleRefreshApp({
+      pathParams: { id: created.id },
+    });
+
+    expect(compileApp).toHaveBeenCalled();
+    expect(notifyAppSurfacesChanged).toHaveBeenCalledWith(created.id, {
+      fileChange: true,
+    });
+    expect(result).toEqual({
+      ok: true,
+      appId: created.id,
+      name: "Budget",
+      compiled: true,
+      compile_duration_ms: 11,
+    });
+  });
+
+  test("compiles a plugin app in place", async () => {
+    const pluginName = `charts-${Math.random().toString(36).slice(2, 8)}`;
+    const pluginDir = join(getWorkspacePluginsDir(), pluginName);
+    mkdirSync(join(pluginDir, "apps", "viewer"), { recursive: true });
+    writeFileSync(
+      join(pluginDir, "package.json"),
+      JSON.stringify({ name: pluginName, version: "1.0.0" }),
+    );
+    writeFileSync(join(pluginDir, "apps", "viewer", "index.html"), "<h1></h1>");
+    const pluginAppId = `plugins~${pluginName}~viewer`;
+
+    const result = await handleRefreshApp({
+      pathParams: { id: pluginAppId },
+    });
+
+    expect(compileApp).toHaveBeenCalledWith(
+      join(pluginDir, "apps", "viewer"),
+    );
+    expect(notifyAppSurfacesChanged).toHaveBeenCalledWith(pluginAppId, {
+      fileChange: true,
+    });
+    expect(result).toMatchObject({
+      ok: true,
+      appId: pluginAppId,
+      name: "viewer",
+      compiled: true,
+    });
+  });
+
+  test("returns compile errors without throwing", async () => {
+    const created = createApp({
+      name: "Budget",
+      schemaJson: "{}",
+      htmlDefinition: "<h1>Budget</h1>",
+    });
+    compileApp.mockImplementationOnce(async () => ({
+      ok: false,
+      errors: [{ text: "Could not resolve foo" }],
+      warnings: [],
+      durationMs: 4,
+    }));
+
+    const result = await handleRefreshApp({
+      pathParams: { id: created.id },
+    });
+
+    expect(result).toMatchObject({
+      compiled: false,
+      compile_errors: [{ text: "Could not resolve foo" }],
+    });
+    expect(notifyAppSurfacesChanged).toHaveBeenCalled();
+  });
+
+  test("throws not found for an unknown app", async () => {
+    await expect(
+      handleRefreshApp({ pathParams: { id: "missing" } }),
+    ).rejects.toMatchObject({
+      statusCode: 404,
+    });
+  });
+});

package/src/runtime/routes/__tests__/channel-send-routes.test.ts

@@ -0,0 +1,127 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// The route is a thin door over the send function: it validates the body
+// against its declared schema and maps the function's refusals onto route
+// errors, so the CLI and the messaging tool share one seam.
+
+const sendCalls: Array<Record<string, unknown>> = [];
+let sendImpl: (params: Record<string, unknown>) => Promise<unknown> = async (
+  params,
+) => ({
+  channel: params.channel,
+  chatId: "C123",
+  messageIds: ["1700000000.000100"],
+  lastMessageId: "1700000000.000100",
+  recordedIn: "home-1",
+});
+
+class ChannelNotAddressableError extends Error {}
+class ChannelSendFailedError extends Error {}
+
+mock.module("../../channel-send.js", () => ({
+  ChannelNotAddressableError,
+  ChannelSendFailedError,
+  sendChannelText: async (params: Record<string, unknown>) => {
+    sendCalls.push(params);
+    return sendImpl(params);
+  },
+}));
+
+const { ROUTES } = await import("../channel-send-routes.js");
+const { BadGatewayError, BadRequestError } = await import("../errors.js");
+
+const route = ROUTES.find((r) => r.operationId === "channels_send_post")!;
+
+beforeEach(() => {
+  sendCalls.length = 0;
+});
+
+describe("POST channels/send", () => {
+  test("is registered as a chat write for actor principals", () => {
+    expect(route).toBeDefined();
+    expect(route.endpoint).toBe("channels/send");
+    expect(route.method).toBe("POST");
+    expect(route.policy?.requiredScopes).toEqual(["chat.write"]);
+  });
+
+  test("hands a valid body to the send function and returns its result", async () => {
+    const body = {
+      channel: "slack",
+      target: { kind: "chat", chatId: "C123", threadId: "1690000000.000001" },
+      text: "hello",
+      renderRichly: true,
+    };
+    const result = await route.handler({ body });
+    expect(sendCalls).toEqual([body]);
+    expect(result).toMatchObject({
+      channel: "slack",
+      messageIds: ["1700000000.000100"],
+      recordedIn: "home-1",
+    });
+  });
+
+  test("names no sending turn, so a caller cannot claim a send was its own chat's", async () => {
+    await route.handler({
+      body: {
+        channel: "slack",
+        target: { kind: "chat", chatId: "C123" },
+        text: "hello",
+        sender: {
+          conversationId: "conv-A",
+          executionChannel: "slack",
+          requesterChatId: "C123",
+        },
+      },
+    });
+    expect(sendCalls).toHaveLength(1);
+    expect(sendCalls[0]).not.toHaveProperty("sender");
+  });
+
+  test("rejects a malformed body before calling the send function", async () => {
+    await expect(
+      route.handler({
+        body: { channel: "slack", target: { kind: "chat" }, text: "" },
+      }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    await expect(
+      route.handler({
+        body: {
+          channel: "not-a-channel",
+          target: { kind: "chat", chatId: "C1" },
+          text: "hi",
+        },
+      }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(sendCalls).toEqual([]);
+  });
+
+  test("maps the send function's refusals onto route errors", async () => {
+    sendImpl = async () => {
+      throw new ChannelNotAddressableError(
+        'Channel "email" is not addressable',
+      );
+    };
+    await expect(
+      route.handler({
+        body: {
+          channel: "email",
+          target: { kind: "chat", chatId: "x" },
+          text: "hi",
+        },
+      }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+
+    sendImpl = async () => {
+      throw new ChannelSendFailedError("not acknowledged");
+    };
+    await expect(
+      route.handler({
+        body: {
+          channel: "slack",
+          target: { kind: "chat", chatId: "C1" },
+          text: "hi",
+        },
+      }),
+    ).rejects.toBeInstanceOf(BadGatewayError);
+  });
+});

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -51,7 +51,12 @@ mock.module("../../../persistence/embeddings/embedding-backend.js", () => ({
 }));
 
 import { BACKUP_PROFILE_KEYS } from "../../../config/default-profile-names.js";
-import { getConfig, loadRawConfig } from "../../../config/loader.js";
+import {
+  getConfig,
+  loadConfig,
+  loadRawConfig,
+} from "../../../config/loader.js";
+import { AssistantConfigSchema } from "../../../config/schema.js";
 import { LLMConfigBase } from "../../../config/schemas/llm.js";
 import type { ConversationCreateType } from "../../../persistence/conversation-types.js";
 import {
@@ -1940,3 +1945,105 @@ describe("ingress URL writes through the generic config routes", () => {
     expect(ingress.lastTunnel).toEqual(LAST_TUNNEL);
   });
 });
+
+describe("config writes to a per-agent acp entry", () => {
+  const patchRoute = ROUTES.find((r) => r.operationId === "config_patch")!;
+  const setRoute = ROUTES.find((r) => r.operationId === "config_set")!;
+
+  beforeEach(() => {
+    rawConfigFixture = {
+      acp: {
+        agents: {
+          claude: { command: "claude-agent-acp", args: [], model: "opus" },
+        },
+      },
+    };
+    seedRawConfig();
+  });
+
+  function agentEntry(
+    raw: Record<string, unknown>,
+    id = "claude",
+  ): Record<string, unknown> {
+    const acp = raw.acp as Record<string, unknown>;
+    const agents = acp.agents as Record<string, Record<string, unknown>>;
+    return agents[id]!;
+  }
+
+  test("a nulled per-agent model is dropped on both write paths", async () => {
+    await patchRoute.handler({
+      body: { acp: { agents: { claude: { model: null } } } },
+    });
+
+    const patched = agentEntry(loadRawConfig());
+    expect("model" in patched).toBe(false);
+    expect(patched.command).toBe("claude-agent-acp");
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+
+    seedRawConfig();
+    await setRoute.handler({
+      body: { path: "acp.agents.claude.model", value: null },
+    });
+
+    expect("model" in agentEntry(loadRawConfig())).toBe(false);
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.model).toBeUndefined();
+  });
+
+  test("a nulled per-agent command is dropped on both write paths", async () => {
+    await setRoute.handler({
+      body: { path: "acp.agents.claude.command", value: null },
+    });
+
+    expect("command" in agentEntry(loadRawConfig())).toBe(false);
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.command).toBeUndefined();
+
+    seedRawConfig();
+    await patchRoute.handler({
+      body: { acp: { agents: { claude: { command: null } } } },
+    });
+
+    const patched = agentEntry(loadRawConfig());
+    expect("command" in patched).toBe(false);
+    expect(patched.model).toBe("opus");
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.command).toBeUndefined();
+  });
+
+  test("a nulled command on an id with no bundled profile is dropped too", async () => {
+    rawConfigFixture = {
+      acp: { agents: { mine: { command: "my-acp", args: [] } } },
+    };
+    seedRawConfig();
+
+    await setRoute.handler({
+      body: { path: "acp.agents.mine.command", value: null },
+    });
+
+    expect("command" in agentEntry(loadRawConfig(), "mine")).toBe(false);
+    const result = AssistantConfigSchema.safeParse(loadRawConfig());
+    expect(result.success).toBe(false);
+    if (result.success) {
+      return;
+    }
+    expect(result.error.issues.map((issue) => issue.path)).toEqual([
+      ["acp", "agents", "mine", "command"],
+    ]);
+    expect(result.error.issues[0]?.message).toContain("acp.agents.mine");
+  });
+
+  test("a model set on a bare bundled entry survives the next load", async () => {
+    rawConfigFixture = {};
+    seedRawConfig();
+
+    await setRoute.handler({
+      body: { path: "acp.agents.claude.model", value: "sonnet" },
+    });
+
+    const entry = agentEntry(loadRawConfig());
+    expect("command" in entry).toBe(false);
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.model).toBe("sonnet");
+  });
+});

package/src/runtime/routes/__tests__/default-provider-routes.test.ts

@@ -377,7 +377,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).message).toContain("Vellum-managed");
   });
 
-  test("service_account connection → unsupported_auth even with a stored credential", async () => {
+  test("service_account connection with invalid credential → missing_credential", async () => {
     seedConnection({
       name: "gemini-personal",
       provider: "gemini",
@@ -390,7 +390,7 @@ describe("GET config/llm/default-provider", () => {
     setConfig("llm", { defaultProvider: { provider: "gemini" } });
 
     const result = await get();
-    expect(availability(result).status).toBe("unsupported_auth");
+    expect(availability(result).status).toBe("missing_credential");
     expect(availability(result).message).toContain("service-account");
   });
 

package/src/runtime/routes/__tests__/dictation-cleanup-guard.test.ts

@@ -0,0 +1,107 @@
+/**
+ * The dictation cleanup pass rewrites what the user actually said, so a
+ * rewrite the provider cut off at the token cap must never become the
+ * payload: the raw transcript is sent instead.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import {
+  computeMaxTokens,
+  resolveCleanedDictation,
+} from "../diagnostics-routes.js";
+
+const SPOKEN =
+  "Hello Quill can you generate a list of 20 open HR coordinator or HR " +
+  "related roles that are remote and pay about 50 to 60 K per year";
+
+describe("resolveCleanedDictation", () => {
+  test("accepts an ordinary cleanup", () => {
+    const cleaned =
+      "Hello Quill, can you generate a list of 20 open HR coordinator or HR " +
+      "related roles that are remote and pay about 50 to 60K per year?";
+    expect(resolveCleanedDictation(SPOKEN, cleaned, "end_turn")).toEqual({
+      text: cleaned,
+      rejected: null,
+    });
+  });
+
+  test("trims surrounding whitespace off an accepted cleanup", () => {
+    const { text } = resolveCleanedDictation(
+      "so um I think we should ship the thing on Tuesday you know",
+      "  I think we should ship the thing on Tuesday.  ",
+      "end_turn",
+    );
+    expect(text).toBe("I think we should ship the thing on Tuesday.");
+  });
+
+  test("rejects a rewrite cut off by max_tokens and keeps the raw words", () => {
+    expect(
+      resolveCleanedDictation(
+        SPOKEN,
+        "Hello Quill, can you create a list",
+        "max_tokens",
+      ),
+    ).toEqual({ text: SPOKEN, rejected: "truncated" });
+  });
+
+  test("rejects a max_tokens rewrite even when it kept most of the words", () => {
+    const nearlyComplete = SPOKEN.slice(0, SPOKEN.length - 4);
+    const { rejected } = resolveCleanedDictation(
+      SPOKEN,
+      nearlyComplete,
+      "max_tokens",
+    );
+    expect(rejected).toBe("truncated");
+  });
+
+  test("rejects the token-cap stop under every provider's name for it", () => {
+    for (const stopReason of ["length", "max_output_tokens", "MAX_TOKENS "]) {
+      expect(
+        resolveCleanedDictation(SPOKEN, "Hello Quill, can you", stopReason)
+          .rejected,
+      ).toBe("truncated");
+    }
+  });
+
+  test("a missing stop reason is not treated as a truncation", () => {
+    const cleaned = "Hello Quill, can you generate a list?";
+    expect(resolveCleanedDictation(SPOKEN, cleaned, undefined)).toEqual({
+      text: cleaned,
+      rejected: null,
+    });
+  });
+
+  test("a much shorter rewrite is the model's call, not a rejection", () => {
+    // The prompt asks for fillers and vague phrasing to go, so a concise
+    // rewrite of a rambling utterance is a correct cleanup.
+    const spoken =
+      "um you know I just kind of wanted to say like thank you so much you know";
+    expect(
+      resolveCleanedDictation(spoken, "Thank you so much.", "end_turn"),
+    ).toEqual({ text: "Thank you so much.", rejected: null });
+  });
+
+  test("an empty rewrite falls back to raw without flagging a rejection", () => {
+    // The model returned nothing usable; there is no rewrite to distrust.
+    expect(resolveCleanedDictation(SPOKEN, "   ", "end_turn")).toEqual({
+      text: SPOKEN,
+      rejected: null,
+    });
+  });
+});
+
+describe("computeMaxTokens", () => {
+  test("budgets room for the transcript, reasoning, and JSON scaffolding", () => {
+    // The tool call carries the whole transcript back in `text`, so the
+    // budget has to clear the input's own token count with room to spare.
+    const estimatedInputTokens = Math.ceil(SPOKEN.length / 3);
+    expect(computeMaxTokens(SPOKEN.length)).toBeGreaterThan(
+      estimatedInputTokens * 2,
+    );
+  });
+
+  test("holds a floor for very short transcripts", () => {
+    expect(computeMaxTokens(5)).toBe(512);
+  });
+});

package/src/runtime/routes/__tests__/mcp-add-default-risk.test.ts

@@ -1,19 +1,24 @@
 /**
- * `internal_mcp_add` writes only the transport. Policy fields (enabled,
- * risk, tool caps, allow/block lists) are not persisted.
+ * `internal_mcp_add` writes only the transport into workspace mcp.json.
+ * Policy fields (enabled, risk, tool caps, allow/block lists) are not
+ * persisted.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-let raw: Record<string, unknown> = {};
-let saved: Record<string, unknown> | undefined;
+let stored: { servers: Record<string, { transport: Record<string, unknown> }> } =
+  { servers: {} };
+let saved:
+  | { servers: Record<string, { transport: Record<string, unknown> }> }
+  | undefined;
 
-const actualLoader = await import("../../../config/loader.js");
-mock.module("../../../config/loader.js", () => ({
-  ...actualLoader,
-  loadRawConfig: () => raw,
-  saveRawConfig: (next: Record<string, unknown>) => {
+mock.module("../../../mcp/workspace-mcp-config.js", () => ({
+  loadWorkspaceMcpConfig: () => stored,
+  saveWorkspaceMcpConfig: (next: {
+    servers: Record<string, { transport: Record<string, unknown> }>;
+  }) => {
     saved = next;
+    stored = next;
   },
 }));
 
@@ -26,13 +31,12 @@ const { ROUTES } = await import("../mcp-auth-routes.js");
 const addRoute = ROUTES.find((r) => r.operationId === "internal_mcp_add")!;
 
 function addedEntry(): Record<string, unknown> {
-  const mcp = saved?.mcp as { servers: Record<string, unknown> };
-  return mcp.servers["srv"] as Record<string, unknown>;
+  return saved!.servers["srv"] as Record<string, unknown>;
 }
 
 describe("internal_mcp_add persisted shape", () => {
   beforeEach(() => {
-    raw = {};
+    stored = { servers: {} };
     saved = undefined;
   });
 

package/src/runtime/routes/acp-routes.test.ts

@@ -262,6 +262,21 @@ describe("POST /v1/acp/spawn", () => {
     // Guard runs before the approval gate — no prompt is surfaced.
     expect(confirmationRequests).toHaveLength(0);
   });
+
+  test("rejects a non-string model before the approval gate", async () => {
+    const handler = getSpawnHandler();
+    await expect(
+      handler({
+        body: {
+          agent: "claude",
+          task: "do a thing",
+          conversationId: "conv-1",
+          model: 42,
+        },
+      }),
+    ).rejects.toThrow("model must be a string when provided");
+    expect(confirmationRequests).toHaveLength(0);
+  });
 });
 
 // ---------------------------------------------------------------------------