@vellumai/assistant 0.6.2 → 0.6.4

package/src/runtime/routes/__tests__/user-route-dispatcher.test.ts

@@ -14,12 +14,38 @@ mock.module("../../../util/logger.js", () => ({
 }));
 
 import { getWorkspaceRoutesDir } from "../../../util/platform.js";
+import { AssistantEventHub } from "../../assistant-event-hub.js";
+import type { UserRouteContext } from "../user-route-dispatcher.js";
 import { UserRouteDispatcher } from "../user-route-dispatcher.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
+/** Build a minimal UserRouteContext for tests. */
+function makeContext(
+  overrides?: Partial<UserRouteContext>,
+): UserRouteContext {
+  return {
+    assistantEventHub: new AssistantEventHub(),
+    assistantId: "test-assistant",
+    ...overrides,
+  };
+}
+
+/** Create a dispatcher with a stub context and optional overrides. */
+function makeDispatcher(
+  options?: Partial<{
+    handlerTimeoutMs: number;
+    context: UserRouteContext;
+  }>,
+): UserRouteDispatcher {
+  return new UserRouteDispatcher({
+    context: options?.context ?? makeContext(),
+    ...options,
+  });
+}
+
 function makeRequest(
   method: string,
   path = "http://localhost/v1/x/test",
@@ -60,7 +86,7 @@ afterEach(() => {
 
 describe("path traversal", () => {
   test("rejects paths containing '..'", async () => {
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("../etc/passwd", makeRequest("GET"));
     expect(res.status).toBe(400);
     const body = await readErrorBody(res);
@@ -69,7 +95,7 @@ describe("path traversal", () => {
   });
 
   test("rejects embedded '..' segments", async () => {
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch(
       "foo/../../etc/passwd",
       makeRequest("GET"),
@@ -84,7 +110,7 @@ describe("path traversal", () => {
 
 describe("missing handler", () => {
   test("returns 404 when no handler file exists", async () => {
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("nonexistent", makeRequest("GET"));
     expect(res.status).toBe(404);
     const body = await readErrorBody(res);
@@ -106,7 +132,7 @@ describe("successful dispatch", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("hello", makeRequest("GET"));
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -121,7 +147,7 @@ describe("successful dispatch", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("submit", makeRequest("POST"));
     expect(res.status).toBe(201);
     const body = await res.json();
@@ -136,7 +162,7 @@ describe("successful dispatch", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("legacy", makeRequest("GET"));
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -157,7 +183,7 @@ describe("index file convention", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("my-app", makeRequest("GET"));
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -172,7 +198,7 @@ describe("index file convention", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("fallback-app", makeRequest("GET"));
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -193,7 +219,7 @@ describe("index file convention", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("dual", makeRequest("GET"));
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -214,7 +240,7 @@ describe("method not allowed", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("get-only", makeRequest("POST"));
     expect(res.status).toBe(405);
     expect(res.headers.get("Allow")).toBe("GET");
@@ -228,7 +254,7 @@ describe("method not allowed", () => {
        export function DELETE(request) { return new Response("ok"); }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("multi", makeRequest("PUT"));
     expect(res.status).toBe(405);
     const allow = res.headers.get("Allow");
@@ -252,7 +278,7 @@ describe("handler timeout", () => {
     );
 
     // Use a very short timeout for testing
-    const dispatcher = new UserRouteDispatcher({ handlerTimeoutMs: 50 });
+    const dispatcher = makeDispatcher({ handlerTimeoutMs: 50 });
     const res = await dispatcher.dispatch("slow", makeRequest("GET"));
     expect(res.status).toBe(504);
     const body = await readErrorBody(res);
@@ -274,7 +300,7 @@ describe("handler errors", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("throws", makeRequest("GET"));
     expect(res.status).toBe(500);
     const body = await readErrorBody(res);
@@ -290,7 +316,7 @@ describe("handler errors", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("rejects", makeRequest("GET"));
     expect(res.status).toBe(500);
     const body = await readErrorBody(res);
@@ -311,7 +337,7 @@ describe("mtime cache", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
 
     // First request — version 1
     const res1 = await dispatcher.dispatch("mutable", makeRequest("GET"));
@@ -349,7 +375,7 @@ describe("subdirectory routing", () => {
       }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("api/v1/status", makeRequest("GET"));
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -371,8 +397,113 @@ describe("description metadata", () => {
        }`,
     );
 
-    const dispatcher = new UserRouteDispatcher();
+    const dispatcher = makeDispatcher();
     const res = await dispatcher.dispatch("with-meta", makeRequest("GET"));
     expect(res.status).toBe(200);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Context injection
+// ---------------------------------------------------------------------------
+
+describe("context injection", () => {
+  test("passes UserRouteContext as second argument to handler", async () => {
+    writeHandler(
+      "ctx-echo.ts",
+      `export function GET(request, context) {
+        return Response.json({
+          hasHub: typeof context.assistantEventHub?.publish === "function",
+          assistantId: context.assistantId,
+        });
+      }`,
+    );
+
+    const ctx = makeContext({ assistantId: "custom-id" });
+    const dispatcher = makeDispatcher({ context: ctx });
+    const res = await dispatcher.dispatch("ctx-echo", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.hasHub).toBe(true);
+    expect(body.assistantId).toBe("custom-id");
+  });
+
+  test("handler can publish events through injected hub", async () => {
+    writeHandler(
+      "ctx-publish.ts",
+      `export async function POST(request, context) {
+        const body = await request.json();
+        await context.assistantEventHub.publish({
+          id: "test-event-1",
+          assistantId: context.assistantId,
+          conversationId: body.conversationId,
+          emittedAt: new Date().toISOString(),
+          message: { type: "open_conversation", conversationId: body.conversationId },
+        });
+        return Response.json({ published: true });
+      }`,
+    );
+
+    const hub = new AssistantEventHub();
+    const received: unknown[] = [];
+    hub.subscribe(
+      { assistantId: "test-assistant" },
+      (event) => { received.push(event); },
+    );
+
+    const ctx = makeContext({ assistantEventHub: hub });
+    const dispatcher = makeDispatcher({ context: ctx });
+    const req = new Request("http://localhost/v1/x/ctx-publish", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ conversationId: "conv-123" }),
+    });
+    const res = await dispatcher.dispatch("ctx-publish", req);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.published).toBe(true);
+    expect(received).toHaveLength(1);
+    expect((received[0] as { conversationId: string }).conversationId).toBe(
+      "conv-123",
+    );
+  });
+
+  test("legacy handlers that ignore context still work", async () => {
+    writeHandler(
+      "no-ctx.ts",
+      `export function GET(request) {
+        return Response.json({ legacy: true });
+      }`,
+    );
+
+    const dispatcher = makeDispatcher();
+    const res = await dispatcher.dispatch("no-ctx", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.legacy).toBe(true);
+  });
+
+  test("context is frozen — mutations throw in strict mode", async () => {
+    writeHandler(
+      "ctx-mutate.ts",
+      `export function GET(request, context) {
+        let threw = false;
+        try {
+          context.assistantId = "hacked";
+        } catch {
+          threw = true;
+        }
+        return Response.json({ threw, assistantId: context.assistantId });
+      }`,
+    );
+
+    const ctx = makeContext({ assistantId: "original" });
+    const dispatcher = makeDispatcher({ context: ctx });
+    const res = await dispatcher.dispatch("ctx-mutate", makeRequest("GET"));
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    // Object.freeze makes property assignment throw in strict mode (ESM)
+    // and silently fail in sloppy mode — either way the value is unchanged.
+    expect(body.assistantId).toBe("original");
+  });
+});

package/src/runtime/routes/app-management-routes.ts

@@ -23,6 +23,7 @@ import { z } from "zod";
 import { packageApp } from "../../bundler/app-bundler.js";
 import { compileApp } from "../../bundler/app-compiler.js";
 import { scanBundle } from "../../bundler/bundle-scanner.js";
+import type { SignatureJson } from "../../bundler/bundle-signer.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
 import { defaultGallery } from "../../gallery/default-gallery.js";
@@ -39,11 +40,11 @@ import {
   getApp,
   getAppDirPath,
   getAppPreview,
-  inlineDistAssets,
   isMultifileApp,
   listApps,
   queryAppRecords,
   resolveAppDir,
+  resolveEffectiveAppHtml,
   updateApp,
   updateAppRecord,
 } from "../../memory/app-store.js";
@@ -583,16 +584,15 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
               return httpError("BAD_REQUEST", "payload is not valid JSON", 400);
             }
 
-            const signatureJson: import("../../bundler/bundle-signer.js").SignatureJson =
-              {
-                algorithm: "ed25519",
-                signer: {
-                  key_id: body.keyId,
-                  display_name: "HTTP Signer",
-                },
-                content_hashes: contentHashes,
-                signature: body.signature,
-              };
+            const signatureJson: SignatureJson = {
+              algorithm: "ed25519",
+              signer: {
+                key_id: body.keyId,
+                display_name: "HTTP Signer",
+              },
+              content_hashes: contentHashes,
+              signature: body.signature,
+            };
             return Response.json({ signed: true, signatureJson });
           }
 
@@ -738,8 +738,6 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
             return httpError("NOT_FOUND", `App not found: ${appId}`, 404);
           }
 
-          let html = app.htmlDefinition;
-
           if (isMultifileApp(app)) {
             const appDir = getAppDirPath(appId);
             const distIndex = join(appDir, "dist", "index.html");
@@ -752,12 +750,8 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
                 );
               }
             }
-            if (existsSync(distIndex)) {
-              html = inlineDistAssets(appDir, readFileSync(distIndex, "utf-8"));
-            } else {
-              html = `<p>App compilation failed. Edit a source file to trigger a rebuild.</p>`;
-            }
           }
+          const html = resolveEffectiveAppHtml(app);
 
           const { dirName } = resolveAppDir(app.id);
           return Response.json({

package/src/runtime/routes/approval-routes.ts

@@ -13,6 +13,11 @@ import { z } from "zod";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import { addRule } from "../../permissions/trust-store.js";
 import type { UserDecision } from "../../permissions/types.js";
+import {
+  isConversationHostAccessDecision,
+  isConversationHostAccessEnablePrompt,
+  isPermissionControlsV2Enabled,
+} from "../../permissions/v2-consent-policy.js";
 import { getTool } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
 import { requireBoundGuardian } from "../auth/require-bound-guardian.js";
@@ -23,6 +28,39 @@ import * as pendingInteractions from "../pending-interactions.js";
 
 const log = getLogger("approval-routes");
 
+function canonicalizeV2ConfirmDecision(params: {
+  decision: string;
+  interaction: NonNullable<ReturnType<typeof pendingInteractions.get>>;
+}): UserDecision | null {
+  const { decision, interaction } = params;
+  if (decision === "allow" || decision === "deny") {
+    return decision;
+  }
+
+  const details = interaction.confirmationDetails;
+  if (!details || isConversationHostAccessEnablePrompt(details)) {
+    return null;
+  }
+
+  if (
+    (decision === "allow_10m" || decision === "allow_conversation") &&
+    details.temporaryOptionsAvailable?.includes(decision)
+  ) {
+    return "allow";
+  }
+
+  if (
+    (decision === "always_allow" ||
+      decision === "always_allow_high_risk" ||
+      decision === "always_deny") &&
+    details.persistentDecisionsAllowed
+  ) {
+    return decision === "always_deny" ? "deny" : "allow";
+  }
+
+  return null;
+}
+
 /**
  * POST /v1/confirm — resolve a pending confirmation by requestId.
  * Requires AuthContext with guardian-bound actor.
@@ -47,6 +85,25 @@ export async function handleConfirm(
     return httpError("BAD_REQUEST", "requestId is required", 400);
   }
 
+  const peeked = pendingInteractions.get(requestId);
+  if (!peeked) {
+    log.warn(
+      { requestId, decision },
+      "Confirmation POST for unknown requestId (already consumed or never registered)",
+    );
+    return httpError(
+      "NOT_FOUND",
+      "No pending interaction found for this requestId",
+      404,
+    );
+  }
+
+  const v2Enabled = isPermissionControlsV2Enabled();
+  const effectiveDecision = v2Enabled
+    ? typeof decision === "string"
+      ? canonicalizeV2ConfirmDecision({ decision, interaction: peeked })
+      : null
+    : decision;
   const validConfirmDecisions = [
     "allow",
     "allow_10m",
@@ -57,28 +114,37 @@ export async function handleConfirm(
     "always_allow_high_risk",
   ];
   if (
-    typeof decision !== "string" ||
-    !validConfirmDecisions.includes(decision)
+    (v2Enabled && effectiveDecision == null) ||
+    (!v2Enabled &&
+      (typeof decision !== "string" ||
+        !validConfirmDecisions.includes(decision)))
   ) {
     return httpError(
       "BAD_REQUEST",
-      `decision must be one of: ${validConfirmDecisions.join(", ")}`,
+      v2Enabled
+        ? "decision must resolve to allow or deny under permission-controls-v2"
+        : `decision must be one of: ${validConfirmDecisions.join(", ")}`,
       400,
     );
   }
 
-  // Peek first (non-destructive) so validation failures don't consume the
-  // pending interaction — the client can retry with corrected values.
-  const peeked = pendingInteractions.get(requestId);
-  if (!peeked) {
-    log.warn(
-      { requestId, decision },
-      "Confirmation POST for unknown requestId (already consumed or never registered)",
+  if (
+    peeked.confirmationDetails &&
+    isConversationHostAccessEnablePrompt(peeked.confirmationDetails) &&
+    !isConversationHostAccessDecision(effectiveDecision as UserDecision)
+  ) {
+    return httpError(
+      "FORBIDDEN",
+      "Conversation host-access prompts only accept allow or deny",
+      403,
     );
+  }
+
+  if (v2Enabled && (selectedPattern || selectedScope)) {
     return httpError(
-      "NOT_FOUND",
-      "No pending interaction found for this requestId",
-      404,
+      "FORBIDDEN",
+      "Scoped or persistent approval selections are not supported under permission-controls-v2",
+      403,
     );
   }
 
@@ -138,7 +204,7 @@ export async function handleConfirm(
   log.info(
     {
       requestId,
-      decision,
+      decision: effectiveDecision,
       toolName: interaction.confirmationDetails?.toolName,
       conversationId: interaction.conversationId,
     },
@@ -147,13 +213,13 @@ export async function handleConfirm(
 
   // ACP permissions: resolve directly without a Conversation object.
   if (interaction.directResolve) {
-    interaction.directResolve(decision as UserDecision);
+    interaction.directResolve(effectiveDecision as UserDecision);
     return Response.json({ accepted: true });
   }
 
   interaction.conversation!.handleConfirmationResponse(
     requestId,
-    decision as UserDecision,
+    effectiveDecision as UserDecision,
     selectedPattern,
     selectedScope,
     undefined,
@@ -233,6 +299,14 @@ export async function handleTrustRule(
   const authError = requireBoundGuardian(authContext);
   if (authError) return authError;
 
+  if (isPermissionControlsV2Enabled()) {
+    return httpError(
+      "FORBIDDEN",
+      "Persistent trust rules are not supported under permission-controls-v2",
+      403,
+    );
+  }
+
   const body = (await req.json()) as {
     requestId?: string;
     pattern?: string;

package/src/runtime/routes/attachment-routes.test.ts

@@ -1,6 +1,7 @@
 import {
   mkdirSync,
   mkdtempSync,
+  realpathSync,
   rmSync,
   symlinkSync,
   writeFileSync,
@@ -9,10 +10,15 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
 
-const testWorkspaceDir = mkdtempSync(
-  join(tmpdir(), "attachment-routes-workspace-"),
+// realpathSync resolves the macOS /var → /private/var symlink so the paths
+// match what resolveAllowedFileBackedAttachmentPath returns (it canonicalizes
+// via realpathSync internally).
+const testWorkspaceDir = realpathSync(
+  mkdtempSync(join(tmpdir(), "attachment-routes-workspace-")),
+);
+const testHomeDir = realpathSync(
+  mkdtempSync(join(tmpdir(), "attachment-routes-home-")),
 );
-const testHomeDir = mkdtempSync(join(tmpdir(), "attachment-routes-home-"));
 
 const attachmentsDir = join(testWorkspaceDir, "data", "attachments");
 const conversationsDir = join(testWorkspaceDir, "conversations");