@vellumai/assistant 0.5.0 → 0.5.2

package/src/__tests__/conversation-fork-route.test.ts

@@ -0,0 +1,386 @@
+import { mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const testDir = realpathSync(
+  mkdtempSync(join(tmpdir(), "conversation-fork-route-test-")),
+);
+
+mock.module("../util/platform.js", () => ({
+  getRootDir: () => join(testDir, ".vellum"),
+  getDataDir: () => join(testDir, ".vellum", "workspace", "data"),
+  getWorkspaceDir: () => join(testDir, ".vellum", "workspace"),
+  getConversationsDir: () =>
+    join(testDir, ".vellum", "workspace", "conversations"),
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
+  ensureDataDir: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/env.js", () => ({
+  isHttpAuthDisabled: () => false,
+  hasUngatedHttpAuthDisabled: () => false,
+  getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
+  getGatewayPort: () => 7830,
+  getRuntimeHttpPort: () => 7821,
+  getRuntimeHttpHost: () => "127.0.0.1",
+  getRuntimeGatewayOriginSecret: () => undefined,
+  getIngressPublicBaseUrl: () => undefined,
+  setIngressPublicBaseUrl: () => {},
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+    model: "test",
+    provider: "test",
+    memory: { enabled: false },
+    rateLimit: { maxRequestsPerMinute: 0 },
+    secretDetection: { enabled: false },
+    contextWindow: { maxInputTokens: 200000 },
+    services: {
+      inference: {
+        mode: "your-own",
+        provider: "anthropic",
+        model: "claude-opus-4-6",
+      },
+      "image-generation": {
+        mode: "your-own",
+        provider: "gemini",
+        model: "gemini-3.1-flash-image-preview",
+      },
+      "web-search": { mode: "your-own", provider: "inference-provider-native" },
+    },
+  }),
+}));
+
+import {
+  addMessage,
+  createConversation,
+  PRIVATE_CONVERSATION_FORK_ERROR,
+} from "../memory/conversation-crud.js";
+import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getPolicy } from "../runtime/auth/route-policy.js";
+import { mintToken } from "../runtime/auth/token-service.js";
+import { RuntimeHttpServer } from "../runtime/http-server.js";
+
+initializeDb();
+
+const CHAT_WRITE_JWT = mintToken({
+  aud: "vellum-daemon",
+  sub: "actor:self:fork-route-test",
+  scope_profile: "actor_client_v1",
+  policy_epoch: 1,
+  ttlSeconds: 3600,
+});
+
+const READ_ONLY_JWT = mintToken({
+  aud: "vellum-daemon",
+  sub: "actor:self:fork-route-read-only",
+  scope_profile: "ui_page_v1",
+  policy_epoch: 1,
+  ttlSeconds: 3600,
+});
+
+const AUTH_HEADERS = { Authorization: `Bearer ${CHAT_WRITE_JWT}` };
+const READ_ONLY_HEADERS = { Authorization: `Bearer ${READ_ONLY_JWT}` };
+
+type ConversationSummary = {
+  id: string;
+  title: string;
+  createdAt: number;
+  updatedAt: number;
+  conversationType: string;
+  source: string;
+  forkParent?: {
+    conversationId: string;
+    messageId: string;
+    title: string;
+  };
+};
+
+describe("POST /v1/conversations/fork", () => {
+  let server: RuntimeHttpServer | null = null;
+
+  beforeEach(async () => {
+    await server?.stop();
+    server = null;
+    clearTables();
+  });
+
+  afterAll(async () => {
+    await server?.stop();
+    resetDb();
+    try {
+      rmSync(testDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  });
+
+  test("returns the same conversation summary shape as GET /v1/conversations/:id", async () => {
+    const source = createConversation("Roadmap draft");
+    await addMessage(source.id, "user", "Message 1", undefined, {
+      skipIndexing: true,
+    });
+    const branchPoint = await addMessage(
+      source.id,
+      "assistant",
+      "Message 2",
+      undefined,
+      { skipIndexing: true },
+    );
+    await addMessage(source.id, "user", "Message 3", undefined, {
+      skipIndexing: true,
+    });
+
+    await startServer();
+
+    const forkResponse = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({
+        conversationId: source.id,
+        throughMessageId: branchPoint.id,
+      }),
+    });
+
+    expect(forkResponse.status).toBe(200);
+    const forkBody = (await forkResponse.json()) as {
+      conversation: ConversationSummary;
+    };
+
+    expect(forkBody.conversation).toMatchObject({
+      title: "Roadmap draft (Fork)",
+      conversationType: "standard",
+      source: "user",
+      forkParent: {
+        conversationId: source.id,
+        messageId: branchPoint.id,
+        title: "Roadmap draft",
+      },
+    });
+
+    const detailResponse = await fetch(
+      url(`/conversations/${forkBody.conversation.id}`),
+      { headers: AUTH_HEADERS },
+    );
+    expect(detailResponse.status).toBe(200);
+    const detailBody = (await detailResponse.json()) as {
+      conversation: ConversationSummary;
+    };
+
+    expect(forkBody).toEqual(detailBody);
+  });
+
+  test("rejects empty source conversations", async () => {
+    const source = createConversation("Empty source");
+
+    await startServer();
+
+    const response = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationId: source.id }),
+    });
+
+    expect(response.status).toBe(404);
+    expect(await response.json()).toEqual({
+      error: {
+        code: "NOT_FOUND",
+        message: `Conversation ${source.id} has no persisted messages to fork`,
+      },
+    });
+  });
+
+  test("returns NOT_FOUND when the source conversation does not exist", async () => {
+    await startServer();
+
+    const response = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationId: "missing-conversation" }),
+    });
+
+    expect(response.status).toBe(404);
+    expect(await response.json()).toEqual({
+      error: {
+        code: "NOT_FOUND",
+        message: "Conversation missing-conversation not found",
+      },
+    });
+  });
+
+  test("does not expose private parents in detail reads", async () => {
+    const parent = createConversation({
+      title: "Private parent",
+      conversationType: "private",
+    });
+    const parentMessage = await addMessage(
+      parent.id,
+      "assistant",
+      "Private parent message",
+      undefined,
+      { skipIndexing: true },
+    );
+    const child = createConversation("Child conversation");
+    getDb().run(
+      `UPDATE conversations
+       SET fork_parent_conversation_id = '${parent.id}',
+           fork_parent_message_id = '${parentMessage.id}'
+       WHERE id = '${child.id}'`,
+    );
+
+    await startServer();
+
+    const response = await fetch(url(`/conversations/${child.id}`), {
+      headers: AUTH_HEADERS,
+    });
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as {
+      conversation: ConversationSummary;
+    };
+    expect(body.conversation).not.toHaveProperty("forkParent");
+  });
+
+  test("rejects private source conversations", async () => {
+    const source = createConversation({
+      title: "Private source",
+      conversationType: "private",
+    });
+
+    await startServer();
+
+    const response = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationId: source.id }),
+    });
+
+    expect(response.status).toBe(403);
+    expect(await response.json()).toEqual({
+      error: {
+        code: "FORBIDDEN",
+        message: PRIVATE_CONVERSATION_FORK_ERROR,
+      },
+    });
+  });
+
+  test("rejects nonexistent and cross-conversation branch point message IDs", async () => {
+    const source = createConversation("Source");
+    await addMessage(source.id, "user", "Source message", undefined, {
+      skipIndexing: true,
+    });
+    const otherConversation = createConversation("Other");
+    const otherMessage = await addMessage(
+      otherConversation.id,
+      "assistant",
+      "Other message",
+      undefined,
+      { skipIndexing: true },
+    );
+
+    await startServer();
+
+    const missingMessageResponse = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({
+        conversationId: source.id,
+        throughMessageId: "missing-message-id",
+      }),
+    });
+
+    expect(missingMessageResponse.status).toBe(404);
+    expect(await missingMessageResponse.json()).toEqual({
+      error: {
+        code: "NOT_FOUND",
+        message: `Message missing-message-id does not belong to conversation ${source.id}`,
+      },
+    });
+
+    const crossConversationResponse = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({
+        conversationId: source.id,
+        throughMessageId: otherMessage.id,
+      }),
+    });
+
+    expect(crossConversationResponse.status).toBe(404);
+    expect(await crossConversationResponse.json()).toEqual({
+      error: {
+        code: "NOT_FOUND",
+        message: `Message ${otherMessage.id} does not belong to conversation ${source.id}`,
+      },
+    });
+  });
+
+  test("requires chat.write scope", async () => {
+    const source = createConversation("Auth gated");
+
+    await startServer();
+
+    const response = await fetch(url("/conversations/fork"), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...READ_ONLY_HEADERS },
+      body: JSON.stringify({ conversationId: source.id }),
+    });
+
+    expect(getPolicy("conversations/fork")).toEqual({
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ["actor", "svc_gateway", "svc_daemon", "local"],
+    });
+    expect(response.status).toBe(403);
+    expect(await response.json()).toEqual({
+      error: {
+        code: "FORBIDDEN",
+        message: "Missing required scope: chat.write",
+      },
+    });
+  });
+
+  async function startServer(): Promise<void> {
+    server = new RuntimeHttpServer({
+      port: 0,
+      bearerToken: "test-bearer-token",
+      conversationManagementDeps: {
+        switchConversation: async () => null,
+        renameConversation: () => false,
+        clearAllConversations: () => 0,
+        cancelGeneration: () => false,
+        destroyConversation: () => {},
+        undoLastMessage: async () => null,
+        regenerateResponse: async () => null,
+      },
+    });
+    await server.start();
+  }
+
+  function clearTables(): void {
+    const db = getDb();
+    db.run("DELETE FROM conversation_assistant_attention_state");
+    db.run("DELETE FROM external_conversation_bindings");
+    db.run("DELETE FROM conversation_keys");
+    db.run("DELETE FROM messages");
+    db.run("DELETE FROM conversations");
+  }
+
+  function url(pathname: string): string {
+    if (!server) throw new Error("server not started");
+    return `http://127.0.0.1:${server.actualPort}/v1${pathname}`;
+  }
+});

package/src/__tests__/conversation-history-web-search.test.ts

@@ -821,7 +821,7 @@ describe("web_search_tool_result structural guard", () => {
       if (
         !insideHelperSignature &&
         helperBraceDepth === 0 &&
-        /function isToolResult(Block|Content)\b/.test(line)
+        /function isToolResult\w*\b/.test(line)
       ) {
         // The opening `{` may be on this line or a subsequent line (multi-line
         // signatures). Check if there are braces on this line to determine

package/src/__tests__/conversation-key-store-disk-view.test.ts

@@ -0,0 +1,130 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { eq } from "drizzle-orm";
+
+const testDir = realpathSync(
+  mkdtempSync(join(tmpdir(), "conversation-key-store-disk-view-")),
+);
+const workspaceDir = join(testDir, "workspace");
+const conversationsDir = join(workspaceDir, "conversations");
+mkdirSync(conversationsDir, { recursive: true });
+
+mock.module("../util/platform.js", () => ({
+  getRootDir: () => testDir,
+  getDataDir: () => join(testDir, "data"),
+  getWorkspaceDir: () => workspaceDir,
+  getConversationsDir: () => conversationsDir,
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
+  ensureDataDir: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+    model: "test",
+    provider: "test",
+    memory: { enabled: false },
+    rateLimit: { maxRequestsPerMinute: 0 },
+    secretDetection: { enabled: false },
+    contextWindow: { maxInputTokens: 200000 },
+    services: {
+      inference: {
+        mode: "your-own",
+        provider: "anthropic",
+        model: "claude-opus-4-6",
+      },
+      "image-generation": {
+        mode: "your-own",
+        provider: "gemini",
+        model: "gemini-3.1-flash-image-preview",
+      },
+      "web-search": { mode: "your-own", provider: "inference-provider-native" },
+    },
+  }),
+}));
+
+import { getOrCreateConversation } from "../memory/conversation-key-store.js";
+import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { conversationKeys, conversations } from "../memory/schema.js";
+
+initializeDb();
+
+beforeEach(() => {
+  const db = getDb();
+  db.delete(conversationKeys).run();
+  db.delete(conversations).run();
+
+  rmSync(conversationsDir, { recursive: true, force: true });
+  mkdirSync(conversationsDir, { recursive: true });
+});
+
+afterAll(() => {
+  resetDb();
+  try {
+    rmSync(testDir, { recursive: true, force: true });
+  } catch {
+    /* best effort */
+  }
+});
+
+describe("conversation-key-store disk view", () => {
+  test("creates disk-view directory on first key use and reuses it on second call", () => {
+    const first = getOrCreateConversation("client-key");
+    expect(first.created).toBe(true);
+
+    const db = getDb();
+    const conversation = db
+      .select({ id: conversations.id, createdAt: conversations.createdAt })
+      .from(conversations)
+      .where(eq(conversations.id, first.conversationId))
+      .get();
+    expect(conversation).not.toBeUndefined();
+
+    const expectedDirName = `${new Date(conversation!.createdAt).toISOString().replace(/:/g, "-")}_${first.conversationId}`;
+    const metaPath = join(conversationsDir, expectedDirName, "meta.json");
+    expect(existsSync(metaPath)).toBe(true);
+
+    const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
+    expect(meta.id).toBe(first.conversationId);
+    expect(meta.title).toBe("Generating title...");
+    expect(meta.type).toBe("standard");
+    expect(meta.channel).toBeNull();
+    expect(readdirSync(conversationsDir)).toEqual([expectedDirName]);
+
+    const second = getOrCreateConversation("client-key");
+    expect(second.created).toBe(false);
+    expect(second.conversationId).toBe(first.conversationId);
+
+    const conversationRows = db
+      .select({ id: conversations.id })
+      .from(conversations)
+      .all();
+    const keyRows = db.select({ id: conversationKeys.id }).from(conversationKeys).all();
+    expect(conversationRows).toHaveLength(1);
+    expect(keyRows).toHaveLength(1);
+    expect(readdirSync(conversationsDir)).toEqual([expectedDirName]);
+  });
+});

package/src/__tests__/conversation-media-retry.test.ts

@@ -65,9 +65,15 @@ describe("stripMediaPayloadsForRetry", () => {
     // Media retry should keep images in the latest user message and strip older ones.
     const messages: Message[] = [
       createContextSummaryMessage("Summary"),
-      makeUserMessage({ type: "text", text: "older kept turn" }, makeImageBlock("AAAA")),
+      makeUserMessage(
+        { type: "text", text: "older kept turn" },
+        makeImageBlock("AAAA"),
+      ),
       makeAssistantMessage({ type: "text", text: "response" }),
-      makeUserMessage({ type: "text", text: "latest kept turn" }, makeImageBlock("BBBB")),
+      makeUserMessage(
+        { type: "text", text: "latest kept turn" },
+        makeImageBlock("BBBB"),
+      ),
     ];
 
     const result = stripMediaPayloadsForRetry(messages);

package/src/__tests__/conversation-queue.test.ts

@@ -36,6 +36,8 @@ mock.module("../util/logger.js", () => ({
 
 mock.module("../util/platform.js", () => ({
   getDataDir: () => "/tmp",
+  getWorkspaceDir: () => "/tmp/workspace",
+  getConversationsDir: () => "/tmp/workspace/conversations",
 }));
 
 mock.module("../memory/guardian-action-store.js", () => ({
@@ -156,14 +158,43 @@ mock.module("../memory/conversation-queries.js", () => ({
 }));
 
 let linkAttachmentShouldThrow = false;
+let mockAttachmentIdCounter = 0;
 
 mock.module("../memory/attachments-store.js", () => ({
+  AttachmentUploadError: class AttachmentUploadError extends Error {},
   uploadAttachment: () => ({ id: `att-${Date.now()}` }),
   linkAttachmentToMessage: () => {
     if (linkAttachmentShouldThrow) {
       throw new Error("Simulated linkAttachmentToMessage failure");
     }
   },
+  attachInlineAttachmentToMessage: (
+    _messageId: string,
+    _position: number,
+    filename: string,
+    mimeType: string,
+    dataBase64: string,
+  ) => {
+    if (linkAttachmentShouldThrow) {
+      throw new Error("Simulated linkAttachmentToMessage failure");
+    }
+
+    return {
+      id: `att-inline-${++mockAttachmentIdCounter}`,
+      originalFilename: filename,
+      mimeType,
+      sizeBytes: Buffer.from(dataBase64, "base64").byteLength,
+      kind: mimeType.startsWith("image/")
+        ? "image"
+        : mimeType.startsWith("video/")
+          ? "video"
+          : "file",
+      thumbnailBase64: null,
+      createdAt: Date.now(),
+    };
+  },
+  getFilePathForAttachment: () => null,
+  setAttachmentThumbnail: () => {},
 }));
 
 mock.module("../memory/retriever.js", () => ({
@@ -1419,14 +1450,18 @@ describe("Conversation host attachment directives", () => {
         ),
       ).toBe(true);
 
+      // Attachment warnings are surfaced on the completion payload instead of
+      // being emitted as late assistant_text_delta events.
       const warningDelta = events.find(
         (e) =>
           e.type === "assistant_text_delta" &&
           e.text.includes("Attachment warning:"),
       );
-      expect(warningDelta).toBeDefined();
+      expect(warningDelta).toBeUndefined();
       const completion = events.find((e) => e.type === "message_complete");
       expect(completion).toBeDefined();
+      expect((completion as { attachmentWarnings?: string[] }).attachmentWarnings)
+        .toEqual(expect.arrayContaining([expect.stringContaining("access denied by user")]));
     } finally {
       rmSync(hostPath, { force: true });
     }