@vellumai/assistant 0.6.0 → 0.6.2

package/src/runtime/routes/__tests__/user-route-dispatcher.test.ts

@@ -0,0 +1,378 @@
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mocks
+// ---------------------------------------------------------------------------
+
+mock.module("../../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import { getWorkspaceRoutesDir } from "../../../util/platform.js";
+import { UserRouteDispatcher } from "../user-route-dispatcher.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeRequest(
+  method: string,
+  path = "http://localhost/v1/x/test",
+): Request {
+  return new Request(path, { method });
+}
+
+function writeHandler(relativePath: string, content: string): string {
+  const routesDir = getWorkspaceRoutesDir();
+  const fullPath = join(routesDir, relativePath);
+  const dir = fullPath.substring(0, fullPath.lastIndexOf("/"));
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(fullPath, content);
+  return fullPath;
+}
+
+async function readErrorBody(
+  response: Response,
+): Promise<{ error: { code: string; message: string } }> {
+  return response.json();
+}
+
+// ---------------------------------------------------------------------------
+// Setup / teardown
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  mkdirSync(getWorkspaceRoutesDir(), { recursive: true });
+});
+
+afterEach(() => {
+  rmSync(getWorkspaceRoutesDir(), { recursive: true, force: true });
+});
+
+// ---------------------------------------------------------------------------
+// Path traversal
+// ---------------------------------------------------------------------------
+
+describe("path traversal", () => {
+  test("rejects paths containing '..'", async () => {
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("../etc/passwd", makeRequest("GET"));
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("Path traversal");
+  });
+
+  test("rejects embedded '..' segments", async () => {
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch(
+      "foo/../../etc/passwd",
+      makeRequest("GET"),
+    );
+    expect(res.status).toBe(400);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 404 — missing handler
+// ---------------------------------------------------------------------------
+
+describe("missing handler", () => {
+  test("returns 404 when no handler file exists", async () => {
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("nonexistent", makeRequest("GET"));
+    expect(res.status).toBe(404);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("NOT_FOUND");
+    expect(body.error.message).toContain("/x/nonexistent");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Successful dispatch
+// ---------------------------------------------------------------------------
+
+describe("successful dispatch", () => {
+  test("dispatches GET to handler exporting GET function", async () => {
+    writeHandler(
+      "hello.ts",
+      `export function GET(request) {
+        return Response.json({ greeting: "hello" });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("hello", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.greeting).toBe("hello");
+  });
+
+  test("dispatches POST to handler exporting POST function", async () => {
+    writeHandler(
+      "submit.ts",
+      `export async function POST(request) {
+        return Response.json({ received: true }, { status: 201 });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("submit", makeRequest("POST"));
+    expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(body.received).toBe(true);
+  });
+
+  test("dispatches to .js handler files", async () => {
+    writeHandler(
+      "legacy.js",
+      `export function GET(request) {
+        return Response.json({ format: "js" });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("legacy", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.format).toBe("js");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Index file convention
+// ---------------------------------------------------------------------------
+
+describe("index file convention", () => {
+  test("resolves directory to index.ts", async () => {
+    writeHandler(
+      "my-app/index.ts",
+      `export function GET(request) {
+        return Response.json({ index: true });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("my-app", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.index).toBe(true);
+  });
+
+  test("resolves directory to index.js when no index.ts", async () => {
+    writeHandler(
+      "fallback-app/index.js",
+      `export function GET(request) {
+        return Response.json({ index: "js" });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("fallback-app", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.index).toBe("js");
+  });
+
+  test("prefers direct file over index file", async () => {
+    writeHandler(
+      "dual.ts",
+      `export function GET(request) {
+        return Response.json({ source: "direct" });
+      }`,
+    );
+    writeHandler(
+      "dual/index.ts",
+      `export function GET(request) {
+        return Response.json({ source: "index" });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("dual", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.source).toBe("direct");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 405 — method not allowed
+// ---------------------------------------------------------------------------
+
+describe("method not allowed", () => {
+  test("returns 405 with Allow header when method not exported", async () => {
+    writeHandler(
+      "get-only.ts",
+      `export function GET(request) {
+        return Response.json({ ok: true });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("get-only", makeRequest("POST"));
+    expect(res.status).toBe(405);
+    expect(res.headers.get("Allow")).toBe("GET");
+  });
+
+  test("lists multiple allowed methods in Allow header", async () => {
+    writeHandler(
+      "multi.ts",
+      `export function GET(request) { return new Response("ok"); }
+       export function POST(request) { return new Response("ok"); }
+       export function DELETE(request) { return new Response("ok"); }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("multi", makeRequest("PUT"));
+    expect(res.status).toBe(405);
+    const allow = res.headers.get("Allow");
+    expect(allow).toContain("GET");
+    expect(allow).toContain("POST");
+    expect(allow).toContain("DELETE");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Handler timeout
+// ---------------------------------------------------------------------------
+
+describe("handler timeout", () => {
+  test("returns 504 when handler exceeds timeout", async () => {
+    writeHandler(
+      "slow.ts",
+      `export function GET(request) {
+        return new Promise(() => {});
+      }`,
+    );
+
+    // Use a very short timeout for testing
+    const dispatcher = new UserRouteDispatcher({ handlerTimeoutMs: 50 });
+    const res = await dispatcher.dispatch("slow", makeRequest("GET"));
+    expect(res.status).toBe(504);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("SERVICE_UNAVAILABLE");
+    expect(body.error.message).toContain("timed out");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Handler errors
+// ---------------------------------------------------------------------------
+
+describe("handler errors", () => {
+  test("returns 500 when handler throws synchronously", async () => {
+    writeHandler(
+      "throws.ts",
+      `export function GET(request) {
+        throw new Error("boom");
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("throws", makeRequest("GET"));
+    expect(res.status).toBe(500);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("INTERNAL_ERROR");
+    expect(body.error.message).toBe("boom");
+  });
+
+  test("returns 500 when handler rejects", async () => {
+    writeHandler(
+      "rejects.ts",
+      `export async function GET(request) {
+        throw new Error("async boom");
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("rejects", makeRequest("GET"));
+    expect(res.status).toBe(500);
+    const body = await readErrorBody(res);
+    expect(body.error.message).toBe("async boom");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Mtime-based cache invalidation
+// ---------------------------------------------------------------------------
+
+describe("mtime cache", () => {
+  test("serves updated content after file modification", async () => {
+    const filePath = writeHandler(
+      "mutable.ts",
+      `export function GET(request) {
+        return Response.json({ version: 1 });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+
+    // First request — version 1
+    const res1 = await dispatcher.dispatch("mutable", makeRequest("GET"));
+    expect(res1.status).toBe(200);
+    const body1 = await res1.json();
+    expect(body1.version).toBe(1);
+
+    // Wait briefly to ensure mtime changes, then rewrite
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    writeFileSync(
+      filePath,
+      `export function GET(request) {
+        return Response.json({ version: 2 });
+      }`,
+    );
+
+    // Second request — should pick up version 2
+    const res2 = await dispatcher.dispatch("mutable", makeRequest("GET"));
+    expect(res2.status).toBe(200);
+    const body2 = await res2.json();
+    expect(body2.version).toBe(2);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Subdirectory routing
+// ---------------------------------------------------------------------------
+
+describe("subdirectory routing", () => {
+  test("dispatches to nested handler files", async () => {
+    writeHandler(
+      "api/v1/status.ts",
+      `export function GET(request) {
+        return Response.json({ nested: true });
+      }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("api/v1/status", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.nested).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Description metadata
+// ---------------------------------------------------------------------------
+
+describe("description metadata", () => {
+  test("ignores non-handler exports without affecting dispatch", async () => {
+    writeHandler(
+      "with-meta.ts",
+      `export const description = "A test handler";
+       export function GET(request) {
+         return Response.json({ ok: true });
+       }`,
+    );
+
+    const dispatcher = new UserRouteDispatcher();
+    const res = await dispatcher.dispatch("with-meta", makeRequest("GET"));
+    expect(res.status).toBe(200);
+  });
+});

package/src/runtime/routes/app-management-routes.ts

@@ -24,6 +24,7 @@ import { packageApp } from "../../bundler/app-bundler.js";
 import { compileApp } from "../../bundler/app-compiler.js";
 import { scanBundle } from "../../bundler/bundle-scanner.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
+import { compareSemver } from "../../daemon/handlers/shared.js";
 import { defaultGallery } from "../../gallery/default-gallery.js";
 import {
   getAppDiff,
@@ -68,17 +69,6 @@ function getSharedAppsDir(): string {
   );
 }
 
-/** Compare two semver strings. Returns negative if a < b, 0 if equal, positive if a > b. */
-function compareSemver(a: string, b: string): number {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
-  for (let i = 0; i < 3; i++) {
-    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (diff !== 0) return diff;
-  }
-  return 0;
-}
-
 // ---------------------------------------------------------------------------
 // Extracted business logic
 // ---------------------------------------------------------------------------

package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts

@@ -5,6 +5,7 @@
  */
 import { applyGuardianDecision } from "../../../approvals/guardian-decision-primitive.js";
 import type { ChannelId } from "../../../channels/types.js";
+import { findContactChannel } from "../../../contacts/contact-store.js";
 import {
   getAllPendingApprovalsByGuardianChat,
   getApprovalRequestById,
@@ -804,6 +805,25 @@ async function handleAccessRequestApproval(
     return { handled: true, type: "stale_ignored" };
   }
 
+  // Resolve display names from the contacts database for enriched payloads
+  const requesterContactResult = approval.requesterExternalUserId
+    ? findContactChannel({
+        channelType: approval.channel,
+        externalUserId: approval.requesterExternalUserId,
+      })
+    : null;
+  const requesterDisplayName =
+    requesterContactResult?.contact.displayName ?? null;
+
+  const decidedByContactResult = decidedByExternalUserId
+    ? findContactChannel({
+        channelType: approval.channel,
+        externalUserId: decidedByExternalUserId,
+      })
+    : null;
+  const decidedByDisplayName =
+    decidedByContactResult?.contact.displayName ?? null;
+
   if (decisionResult.type === "denied") {
     await notifyRequesterOfDenial({
       replyCallbackUrl,
@@ -821,6 +841,8 @@ async function handleAccessRequestApproval(
       requesterExternalUserId: approval.requesterExternalUserId,
       requesterChatId: approval.requesterChatId,
       decidedByExternalUserId,
+      requesterDisplayName,
+      decidedByDisplayName,
       decision: "denied" as const,
     };
 
@@ -952,6 +974,8 @@ async function handleAccessRequestApproval(
         requesterExternalUserId: approval.requesterExternalUserId,
         requesterChatId: approval.requesterChatId,
         decidedByExternalUserId,
+        requesterDisplayName,
+        decidedByDisplayName,
         decision: "approved",
       },
       dedupeKey: `trusted-contact:guardian-decision:${approval.id}`,
@@ -977,6 +1001,8 @@ async function handleAccessRequestApproval(
         sourceChannel: approval.channel as NotificationSourceChannel,
         requesterExternalUserId: approval.requesterExternalUserId,
         requesterChatId: approval.requesterChatId,
+        requesterDisplayName,
+        decidedByDisplayName,
         verificationSessionId: decisionResult.verificationSessionId,
       },
       dedupeKey: `trusted-contact:verification-sent:${decisionResult.verificationSessionId}`,

package/src/runtime/routes/archive-utils.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared tar.gz archive creation utilities used by
+ * log export and profiler export routes.
+ */
+
+import { spawnSync } from "node:child_process";
+
+/** Maximum compressed archive size (50 MB). */
+export const MAX_ARCHIVE_BYTES = 50 * 1024 * 1024;
+
+/**
+ * Attempts to create a tar.gz archive of `staging` into a Buffer.
+ * Returns the Buffer on success, or `undefined` if the archive exceeds
+ * the size limit or tar otherwise fails.
+ */
+export function createTarGz(
+  staging: string,
+  maxBytes: number = MAX_ARCHIVE_BYTES,
+): ArrayBuffer | undefined {
+  const proc = spawnSync("tar", ["czf", "-", "-C", staging, "."], {
+    maxBuffer: maxBytes,
+    timeout: 30_000,
+  });
+  if (proc.status !== 0) return undefined;
+  const buf = Buffer.isBuffer(proc.stdout)
+    ? proc.stdout
+    : Buffer.from(proc.stdout);
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}

package/src/runtime/routes/avatar-routes.ts

@@ -1,5 +1,3 @@
-import { join } from "node:path";
-
 import { z } from "zod";
 
 import { getCharacterComponents } from "../../avatar/character-components.js";
@@ -8,7 +6,7 @@ import {
   writeTraitsAndRenderAvatar,
 } from "../../avatar/traits-png-sync.js";
 import { getLogger } from "../../util/logger.js";
-import { getWorkspaceDir } from "../../util/platform.js";
+import { getAvatarImagePath } from "../../util/platform.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
@@ -18,12 +16,7 @@ import type { RouteDefinition } from "../http-router.js";
 const log = getLogger("avatar-routes");
 
 function publishAvatarUpdated(): void {
-  const avatarPath = join(
-    getWorkspaceDir(),
-    "data",
-    "avatar",
-    "avatar-image.png",
-  );
+  const avatarPath = getAvatarImagePath();
   assistantEventHub
     .publish(
       buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, {

package/src/runtime/routes/btw-routes.ts

@@ -17,6 +17,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { z } from "zod";
 
 import { getConfig } from "../../config/loader.js";
+import { readNowScratchpad } from "../../daemon/conversation-runtime-assembly.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import {
   resolveChannelPersona,
@@ -136,6 +137,18 @@ async function handleBtw(
     }
   }
 
+  // ----- Greeting context enrichment -----
+  // Inject NOW.md scratchpad so the model has contextual awareness (mood,
+  // current activity) and produces varied, relevant greetings instead of
+  // the same deterministic output each time.
+  let effectiveContent = trimmedContent;
+  if (conversationKey === GREETING_KEY) {
+    const now = readNowScratchpad();
+    if (now) {
+      effectiveContent = `${trimmedContent}\n\n<context>\n${now}\n</context>`;
+    }
+  }
+
   // Look up an existing conversation — never create one.  BTW is ephemeral
   // (the file header promises "No messages are persisted"), so we must not
   // call getOrCreateConversation which would insert a DB row.  When no
@@ -158,7 +171,7 @@ async function handleBtw(
           const userPersona = resolveGuardianPersona();
           const channelPersona = resolveChannelPersona(undefined);
           const result = await runBtwSidechain({
-            content: trimmedContent,
+            content: effectiveContent,
             conversation,
             signal: req.signal,
             userPersona,