@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -51,7 +51,12 @@ mock.module("../../../persistence/embeddings/embedding-backend.js", () => ({
 }));
 
 import { BACKUP_PROFILE_KEYS } from "../../../config/default-profile-names.js";
-import { getConfig, loadRawConfig } from "../../../config/loader.js";
+import {
+  getConfig,
+  loadConfig,
+  loadRawConfig,
+} from "../../../config/loader.js";
+import { AssistantConfigSchema } from "../../../config/schema.js";
 import { LLMConfigBase } from "../../../config/schemas/llm.js";
 import type { ConversationCreateType } from "../../../persistence/conversation-types.js";
 import {
@@ -1940,3 +1945,105 @@ describe("ingress URL writes through the generic config routes", () => {
     expect(ingress.lastTunnel).toEqual(LAST_TUNNEL);
   });
 });
+
+describe("config writes to a per-agent acp entry", () => {
+  const patchRoute = ROUTES.find((r) => r.operationId === "config_patch")!;
+  const setRoute = ROUTES.find((r) => r.operationId === "config_set")!;
+
+  beforeEach(() => {
+    rawConfigFixture = {
+      acp: {
+        agents: {
+          claude: { command: "claude-agent-acp", args: [], model: "opus" },
+        },
+      },
+    };
+    seedRawConfig();
+  });
+
+  function agentEntry(
+    raw: Record<string, unknown>,
+    id = "claude",
+  ): Record<string, unknown> {
+    const acp = raw.acp as Record<string, unknown>;
+    const agents = acp.agents as Record<string, Record<string, unknown>>;
+    return agents[id]!;
+  }
+
+  test("a nulled per-agent model is dropped on both write paths", async () => {
+    await patchRoute.handler({
+      body: { acp: { agents: { claude: { model: null } } } },
+    });
+
+    const patched = agentEntry(loadRawConfig());
+    expect("model" in patched).toBe(false);
+    expect(patched.command).toBe("claude-agent-acp");
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+
+    seedRawConfig();
+    await setRoute.handler({
+      body: { path: "acp.agents.claude.model", value: null },
+    });
+
+    expect("model" in agentEntry(loadRawConfig())).toBe(false);
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.model).toBeUndefined();
+  });
+
+  test("a nulled per-agent command is dropped on both write paths", async () => {
+    await setRoute.handler({
+      body: { path: "acp.agents.claude.command", value: null },
+    });
+
+    expect("command" in agentEntry(loadRawConfig())).toBe(false);
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.command).toBeUndefined();
+
+    seedRawConfig();
+    await patchRoute.handler({
+      body: { acp: { agents: { claude: { command: null } } } },
+    });
+
+    const patched = agentEntry(loadRawConfig());
+    expect("command" in patched).toBe(false);
+    expect(patched.model).toBe("opus");
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.command).toBeUndefined();
+  });
+
+  test("a nulled command on an id with no bundled profile is dropped too", async () => {
+    rawConfigFixture = {
+      acp: { agents: { mine: { command: "my-acp", args: [] } } },
+    };
+    seedRawConfig();
+
+    await setRoute.handler({
+      body: { path: "acp.agents.mine.command", value: null },
+    });
+
+    expect("command" in agentEntry(loadRawConfig(), "mine")).toBe(false);
+    const result = AssistantConfigSchema.safeParse(loadRawConfig());
+    expect(result.success).toBe(false);
+    if (result.success) {
+      return;
+    }
+    expect(result.error.issues.map((issue) => issue.path)).toEqual([
+      ["acp", "agents", "mine", "command"],
+    ]);
+    expect(result.error.issues[0]?.message).toContain("acp.agents.mine");
+  });
+
+  test("a model set on a bare bundled entry survives the next load", async () => {
+    rawConfigFixture = {};
+    seedRawConfig();
+
+    await setRoute.handler({
+      body: { path: "acp.agents.claude.model", value: "sonnet" },
+    });
+
+    const entry = agentEntry(loadRawConfig());
+    expect("command" in entry).toBe(false);
+    expect(AssistantConfigSchema.safeParse(loadRawConfig()).success).toBe(true);
+    expect(loadConfig().acp.agents.claude?.model).toBe("sonnet");
+  });
+});

package/src/runtime/routes/__tests__/default-provider-routes.test.ts

@@ -377,7 +377,7 @@ describe("GET config/llm/default-provider", () => {
     expect(availability(result).message).toContain("Vellum-managed");
   });
 
-  test("service_account connection → unsupported_auth even with a stored credential", async () => {
+  test("service_account connection with invalid credential → missing_credential", async () => {
     seedConnection({
       name: "gemini-personal",
       provider: "gemini",
@@ -390,7 +390,7 @@ describe("GET config/llm/default-provider", () => {
     setConfig("llm", { defaultProvider: { provider: "gemini" } });
 
     const result = await get();
-    expect(availability(result).status).toBe("unsupported_auth");
+    expect(availability(result).status).toBe("missing_credential");
     expect(availability(result).message).toContain("service-account");
   });
 

package/src/runtime/routes/__tests__/dictation-cleanup-guard.test.ts

@@ -0,0 +1,107 @@
+/**
+ * The dictation cleanup pass rewrites what the user actually said, so a
+ * rewrite the provider cut off at the token cap must never become the
+ * payload: the raw transcript is sent instead.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import {
+  computeMaxTokens,
+  resolveCleanedDictation,
+} from "../diagnostics-routes.js";
+
+const SPOKEN =
+  "Hello Quill can you generate a list of 20 open HR coordinator or HR " +
+  "related roles that are remote and pay about 50 to 60 K per year";
+
+describe("resolveCleanedDictation", () => {
+  test("accepts an ordinary cleanup", () => {
+    const cleaned =
+      "Hello Quill, can you generate a list of 20 open HR coordinator or HR " +
+      "related roles that are remote and pay about 50 to 60K per year?";
+    expect(resolveCleanedDictation(SPOKEN, cleaned, "end_turn")).toEqual({
+      text: cleaned,
+      rejected: null,
+    });
+  });
+
+  test("trims surrounding whitespace off an accepted cleanup", () => {
+    const { text } = resolveCleanedDictation(
+      "so um I think we should ship the thing on Tuesday you know",
+      "  I think we should ship the thing on Tuesday.  ",
+      "end_turn",
+    );
+    expect(text).toBe("I think we should ship the thing on Tuesday.");
+  });
+
+  test("rejects a rewrite cut off by max_tokens and keeps the raw words", () => {
+    expect(
+      resolveCleanedDictation(
+        SPOKEN,
+        "Hello Quill, can you create a list",
+        "max_tokens",
+      ),
+    ).toEqual({ text: SPOKEN, rejected: "truncated" });
+  });
+
+  test("rejects a max_tokens rewrite even when it kept most of the words", () => {
+    const nearlyComplete = SPOKEN.slice(0, SPOKEN.length - 4);
+    const { rejected } = resolveCleanedDictation(
+      SPOKEN,
+      nearlyComplete,
+      "max_tokens",
+    );
+    expect(rejected).toBe("truncated");
+  });
+
+  test("rejects the token-cap stop under every provider's name for it", () => {
+    for (const stopReason of ["length", "max_output_tokens", "MAX_TOKENS "]) {
+      expect(
+        resolveCleanedDictation(SPOKEN, "Hello Quill, can you", stopReason)
+          .rejected,
+      ).toBe("truncated");
+    }
+  });
+
+  test("a missing stop reason is not treated as a truncation", () => {
+    const cleaned = "Hello Quill, can you generate a list?";
+    expect(resolveCleanedDictation(SPOKEN, cleaned, undefined)).toEqual({
+      text: cleaned,
+      rejected: null,
+    });
+  });
+
+  test("a much shorter rewrite is the model's call, not a rejection", () => {
+    // The prompt asks for fillers and vague phrasing to go, so a concise
+    // rewrite of a rambling utterance is a correct cleanup.
+    const spoken =
+      "um you know I just kind of wanted to say like thank you so much you know";
+    expect(
+      resolveCleanedDictation(spoken, "Thank you so much.", "end_turn"),
+    ).toEqual({ text: "Thank you so much.", rejected: null });
+  });
+
+  test("an empty rewrite falls back to raw without flagging a rejection", () => {
+    // The model returned nothing usable; there is no rewrite to distrust.
+    expect(resolveCleanedDictation(SPOKEN, "   ", "end_turn")).toEqual({
+      text: SPOKEN,
+      rejected: null,
+    });
+  });
+});
+
+describe("computeMaxTokens", () => {
+  test("budgets room for the transcript, reasoning, and JSON scaffolding", () => {
+    // The tool call carries the whole transcript back in `text`, so the
+    // budget has to clear the input's own token count with room to spare.
+    const estimatedInputTokens = Math.ceil(SPOKEN.length / 3);
+    expect(computeMaxTokens(SPOKEN.length)).toBeGreaterThan(
+      estimatedInputTokens * 2,
+    );
+  });
+
+  test("holds a floor for very short transcripts", () => {
+    expect(computeMaxTokens(5)).toBe(512);
+  });
+});

package/src/runtime/routes/__tests__/mcp-add-default-risk.test.ts

@@ -1,19 +1,24 @@
 /**
- * `internal_mcp_add` writes only the transport. Policy fields (enabled,
- * risk, tool caps, allow/block lists) are not persisted.
+ * `internal_mcp_add` writes only the transport into workspace mcp.json.
+ * Policy fields (enabled, risk, tool caps, allow/block lists) are not
+ * persisted.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-let raw: Record<string, unknown> = {};
-let saved: Record<string, unknown> | undefined;
+let stored: { servers: Record<string, { transport: Record<string, unknown> }> } =
+  { servers: {} };
+let saved:
+  | { servers: Record<string, { transport: Record<string, unknown> }> }
+  | undefined;
 
-const actualLoader = await import("../../../config/loader.js");
-mock.module("../../../config/loader.js", () => ({
-  ...actualLoader,
-  loadRawConfig: () => raw,
-  saveRawConfig: (next: Record<string, unknown>) => {
+mock.module("../../../mcp/workspace-mcp-config.js", () => ({
+  loadWorkspaceMcpConfig: () => stored,
+  saveWorkspaceMcpConfig: (next: {
+    servers: Record<string, { transport: Record<string, unknown> }>;
+  }) => {
     saved = next;
+    stored = next;
   },
 }));
 
@@ -26,13 +31,12 @@ const { ROUTES } = await import("../mcp-auth-routes.js");
 const addRoute = ROUTES.find((r) => r.operationId === "internal_mcp_add")!;
 
 function addedEntry(): Record<string, unknown> {
-  const mcp = saved?.mcp as { servers: Record<string, unknown> };
-  return mcp.servers["srv"] as Record<string, unknown>;
+  return saved!.servers["srv"] as Record<string, unknown>;
 }
 
 describe("internal_mcp_add persisted shape", () => {
   beforeEach(() => {
-    raw = {};
+    stored = { servers: {} };
     saved = undefined;
   });
 

package/src/runtime/routes/acp-claude-auth-routes.ts

@@ -18,7 +18,7 @@
  *   has landed.
  * POST /v1/acp/claude/auth/exchange — complete a manual/cloud flow: accept the
  *   pasted `code#state` (or a raw code + state), exchange it, and store the
- *   Claude OAuth token.
+ *   Claude OAuth token set (access token plus any refresh token and expiry).
  *
  * `handleStartAuth` picks loopback vs. manual: a containerized host, or a client
  * that sets `preferManual` because its browser can't reach the daemon's
@@ -126,7 +126,11 @@ async function handleStartLocalAuth(): Promise<StartResponse> {
   // can react. Runs in the background — the web client opens `authorize_url`.
   void flow.completion
     .then(async (result) => {
-      await storeAcpClaudeToken(result.tokens.accessToken);
+      await storeAcpClaudeToken({
+        accessToken: result.tokens.accessToken,
+        refreshToken: result.tokens.refreshToken,
+        expiresIn: result.tokens.expiresIn,
+      });
       pendingFlows.mark(flow.state, "connected");
       log.info("ACP Claude local OAuth flow connected");
     })
@@ -216,7 +220,11 @@ async function handleExchange(args: RouteHandlerArgs): Promise<{ ok: true }> {
       pending.codeVerifier,
       state,
     );
-    await storeAcpClaudeToken(result.tokens.accessToken);
+    await storeAcpClaudeToken({
+      accessToken: result.tokens.accessToken,
+      refreshToken: result.tokens.refreshToken,
+      expiresIn: result.tokens.expiresIn,
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     pendingFlows.mark(state, "error", { error: message });

package/src/runtime/routes/acp-routes.test.ts

@@ -262,6 +262,21 @@ describe("POST /v1/acp/spawn", () => {
     // Guard runs before the approval gate — no prompt is surfaced.
     expect(confirmationRequests).toHaveLength(0);
   });
+
+  test("rejects a non-string model before the approval gate", async () => {
+    const handler = getSpawnHandler();
+    await expect(
+      handler({
+        body: {
+          agent: "claude",
+          task: "do a thing",
+          conversationId: "conv-1",
+          model: 42,
+        },
+      }),
+    ).rejects.toThrow("model must be a string when provided");
+    expect(confirmationRequests).toHaveLength(0);
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/acp-routes.ts

@@ -24,8 +24,11 @@ import {
   AcpResumeError,
   AcpSessionNotFoundError,
 } from "../../acp/session-manager.js";
-import type { AcpSessionState } from "../../acp/types.js";
-import type { AssistantEvent } from "../../api/index.js";
+import { type AcpSessionState, isLiveAcpStatus } from "../../acp/types.js";
+import {
+  AcpSessionModelUpdateEventSchema,
+  type AssistantEvent,
+} from "../../api/index.js";
 import { getConfig } from "../../config/loader.js";
 import { createGuardianRequestForConfirmation } from "../../permissions/confirmation-guardian-request.js";
 import type { UserDecision } from "../../permissions/types.js";
@@ -53,6 +56,10 @@ const log = getLogger("acp-routes");
 const DEFAULT_SESSION_LIMIT = 50;
 const MAX_SESSION_LIMIT = 500;
 
+/** The option shape the `acp_session_model_update` event already publishes. */
+const acpModelOptionsSchema =
+  AcpSessionModelUpdateEventSchema.shape.availableModels;
+
 const sessionEntrySchema = z.object({
   id: z.string(),
   agentId: z.string(),
@@ -68,6 +75,15 @@ const sessionEntrySchema = z.object({
   /** Credential failure that ended the run, when one did. Drives the inline
    *  Connect card on reopen; cleared when a replacement token is stored. */
   authErrorCode: z.string().optional(),
+  /** Model a live session is running on. Absent for history rows, which have
+   *  no live process to ask. */
+  model: z.string().optional(),
+  /** Models a live session could run on. Absent for history rows. */
+  availableModels: acpModelOptionsSchema.optional(),
+  /** Scopes live model revisions to one assistant process. */
+  modelRevisionEpoch: z.string().uuid().optional(),
+  /** Orders live model state within `modelRevisionEpoch`. */
+  modelRevision: z.number().int().nonnegative().optional(),
   usedTokens: z.number().optional(),
   contextSize: z.number().optional(),
   costAmount: z.number().optional(),
@@ -214,17 +230,26 @@ async function spawnSession({ body, abortSignal }: RouteHandlerArgs) {
   const task = body?.task as string | undefined;
   const conversationId = body?.conversationId as string | undefined;
   const cwd = (body?.cwd as string | undefined) ?? process.cwd();
+  const model = body?.model ?? undefined;
 
   if (!agent || !task || !conversationId) {
     throw new BadRequestError("agent, task, and conversationId are required");
   }
+  if (model !== undefined && typeof model !== "string") {
+    throw new BadRequestError("model must be a string when provided");
+  }
 
   // High-risk approval gate. Block BEFORE any side effects — resolution can
   // trigger a `bun` global install (auto-install.ts) and `manager.spawn`
   // launches the host subprocess — so an unapproved request mutates nothing.
   const decision = await awaitRouteApproval({
     toolName: "acp_spawn",
-    input: { agent, task, cwd },
+    input: {
+      agent,
+      task,
+      cwd,
+      ...(model !== undefined ? { model } : {}),
+    },
     conversationId,
     signal: abortSignal,
   });
@@ -262,17 +287,33 @@ async function spawnSession({ body, abortSignal }: RouteHandlerArgs) {
   );
 
   const manager = getAcpSessionManager();
-  const { acpSessionId, protocolSessionId } = await manager.spawn(
+  const {
+    acpSessionId,
+    protocolSessionId,
+    requestedModel,
+    effectiveModel,
+    modelWarning,
+  } = await manager.spawn(
     agent,
     agentConfig,
     task,
     cwd,
     conversationId,
     broadcastMessage,
+    { model },
   );
 
   log.info({ acpSessionId, protocolSessionId, agent }, "ACP spawn succeeded");
-  return { acpSessionId, protocolSessionId, agent };
+  // A refused model is a warning, not a failed spawn: the session is live on
+  // the agent's own model.
+  return {
+    acpSessionId,
+    protocolSessionId,
+    agent,
+    requestedModel: requestedModel ?? null,
+    effectiveModel: effectiveModel ?? null,
+    ...(modelWarning ? { modelWarning } : {}),
+  };
 }
 
 async function steerSession({ pathParams, body }: RouteHandlerArgs) {
@@ -588,10 +629,7 @@ function deleteSession({ pathParams }: RouteHandlerArgs) {
 
   try {
     const state = manager.getStatus(id);
-    if (
-      !Array.isArray(state) &&
-      (state.status === "running" || state.status === "initializing")
-    ) {
+    if (!Array.isArray(state) && isLiveAcpStatus(state.status)) {
       throw new ConflictError(
         `ACP session "${id}" is still ${state.status}. Cancel or close it before deleting.`,
       );
@@ -640,11 +678,32 @@ export const ROUTES: RouteDefinition[] = [
       task: z.string().describe("Task description"),
       conversationId: z.string(),
       cwd: z.string().describe("Working directory").optional(),
+      model: z
+        .string()
+        .optional()
+        .describe("Optional model id or alias to request for the session."),
     }),
     responseBody: z.object({
       acpSessionId: z.string(),
       protocolSessionId: z.string(),
       agent: z.string(),
+      requestedModel: z
+        .string()
+        .nullable()
+        .describe("The model explicitly requested for this spawn, if any."),
+      effectiveModel: z
+        .string()
+        .nullable()
+        .describe(
+          "The top-level session model reported by the ACP adapter, if any.",
+        ),
+      modelWarning: z
+        .string()
+        .optional()
+        .describe(
+          "Why the requested model was not applied. The session is running " +
+            "on the agent's own model.",
+        ),
     }),
   },
   {
@@ -852,6 +911,10 @@ function listMergedSessions(opts: { limit: number; conversationId?: string }): {
       parentToolUseId: s.parentToolUseId,
       authErrorCode: s.authErrorCode,
       authErrorCredential: s.authErrorCredential,
+      model: s.model,
+      availableModels: s.availableModels,
+      modelRevisionEpoch: s.modelRevisionEpoch,
+      modelRevision: s.modelRevision,
       usedTokens: s.latestUsage?.usedTokens,
       contextSize: s.latestUsage?.contextSize,
       costAmount: s.latestUsage?.costAmount,

package/src/runtime/routes/app-management-routes.ts

@@ -51,6 +51,7 @@ import { compileApp, runCompile } from "../../bundler/app-compiler.js";
 import { scanBundle } from "../../bundler/bundle-scanner.js";
 import type { SignatureJson } from "../../bundler/bundle-signer.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
+import { notifyAppSurfacesChanged } from "../../daemon/app-change-notify.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
 import { computeContentId } from "../../util/content-id.js";
 import { getLogger } from "../../util/logger.js";
@@ -128,6 +129,17 @@ const appListItemSchema = z.object({
 
 type AppListItem = z.infer<typeof appListItemSchema>;
 
+const compileDiagnosticSchema = z.object({
+  text: z.string(),
+  location: z
+    .object({
+      file: z.string(),
+      line: z.number(),
+      column: z.number(),
+    })
+    .optional(),
+});
+
 /**
  * The pin route's body. `RouteDefinition.requestBody` is a codegen signal and
  * does not validate, so the handler parses against this too; declaring it once
@@ -169,7 +181,7 @@ function workspaceAppItem(a: AppDefinition): AppListItem {
     description: a.description,
     icon: a.icon,
     createdAt: a.createdAt,
-    updatedAt: a.updatedAt,
+    updatedAt: appContentUpdatedAt(getAppDirPath(a.id), a.updatedAt),
     version: a.version ?? "1.0.0",
     contentId: computeContentId(a.name),
     origin: "workspace",
@@ -191,13 +203,28 @@ function pluginAppItem(app: EnumeratedApp): AppListItem {
     id: app.id,
     name: app.name,
     createdAt: mtime,
-    updatedAt: mtime,
+    updatedAt: appContentUpdatedAt(app.sourcePath, mtime),
     version: "1.0.0",
     contentId: computeContentId(app.name),
     origin: `plugin:${pluginName}`,
   };
 }
 
+/** The newest persisted metadata or compiled-output revision for an app. */
+function appContentUpdatedAt(
+  sourcePath: string,
+  metadataUpdatedAt: number,
+): number {
+  try {
+    return Math.max(
+      metadataUpdatedAt,
+      statSync(join(sourcePath, "dist")).mtimeMs,
+    );
+  } catch {
+    return metadataUpdatedAt;
+  }
+}
+
 function getAppDataResult(
   method: string,
   appId: string,
@@ -896,6 +923,44 @@ async function handleOpenApp({ pathParams }: RouteHandlerArgs) {
   return { ...result, html };
 }
 
+/**
+ * Compile an app's source into dist/ and refresh open surfaces.
+ * Runs in the assistant process so open surfaces, client broadcasts, and
+ * published-app redeploy see the new build. Workspace and plugin apps both
+ * compile in place so local plugin edits can be rebuilt without waiting for
+ * the plugin source watcher.
+ */
+async function handleRefreshApp({ pathParams }: RouteHandlerArgs) {
+  const appId = pathParams?.id;
+  if (!appId) {
+    throw new BadRequestError("App id is required.");
+  }
+
+  const source = resolveAppSource(appId);
+  if (!source) {
+    throw new NotFoundError(
+      `App "${appId}" not found. Run 'assistant apps list' to see available apps.`,
+    );
+  }
+
+  const compileResult = await compileApp(source.sourceDir);
+  notifyAppSurfacesChanged(source.id, { fileChange: true });
+
+  return {
+    ok: true as const,
+    appId: source.id,
+    name: source.name,
+    compiled: compileResult.ok,
+    compile_duration_ms: compileResult.durationMs,
+    ...(compileResult.ok
+      ? {}
+      : {
+          compile_errors: compileResult.errors,
+          compile_warnings: compileResult.warnings,
+        }),
+  };
+}
+
 /**
  * Reject a mutation targeting a plugin-bundled app. Plugin apps are owned by
  * their plugin and are read-only over this surface — their source is not
@@ -1253,6 +1318,29 @@ export const ROUTES: RouteDefinition[] = [
       origin: z.string(),
     }),
   },
+  {
+    operationId: "apps_refresh",
+    endpoint: "apps/:id/refresh",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: handleRefreshApp,
+    summary: "Compile an app",
+    description:
+      "Compile workspace or plugin app source into dist/ and refresh open surfaces.",
+    tags: ["apps"],
+    responseBody: z.object({
+      ok: z.literal(true),
+      appId: z.string(),
+      name: z.string(),
+      compiled: z.boolean(),
+      compile_duration_ms: z.number(),
+      compile_errors: z.array(compileDiagnosticSchema).optional(),
+      compile_warnings: z.array(compileDiagnosticSchema).optional(),
+    }),
+  },
   {
     operationId: "apps_delete",
     endpoint: "apps/:id/delete",

package/src/runtime/routes/app-routes.ts

@@ -92,7 +92,7 @@ function serveCompiledApp(
     );
     const body = isLegacySingleFileDir(appDir)
       ? UNSUPPORTED_LEGACY_APP_HTML
-      : `<p>App has not been compiled yet. Edit a source file to trigger a build.</p>`;
+      : `<p>App has not been compiled yet. Run <code>assistant apps refresh</code> to build.</p>`;
     return (
       `<!DOCTYPE html><html><head><title>${escapedName}</title></head>` +
       `<body>${body}</body></html>`