@vellumai/assistant 0.6.2 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -23,44 +23,43 @@
     "test": "bash scripts/test.sh",
     "test:coverage": "COVERAGE=true bash scripts/test.sh",
     "test:stable": "EXCLUDE_EXPERIMENTAL=true bash scripts/test.sh",
-    "test:bench": "find src/__tests__ -maxdepth 1 -type f -name '*.benchmark.test.ts' -print0 | xargs -0 -P 1 -I {} bun test {}",
+    "test:bench": "find src -type f -name '*.benchmark.test.ts' -print0 | xargs -0 -P 1 -I {} bun test {}",
     "test:filesystem-tools": "bash scripts/test-filesystem-tools.sh",
     "postinstall": "cd .. && (git config core.hooksPath || git config core.hooksPath .githooks 2>/dev/null || true) && ([ -f meta/feature-flags/sync-bundled-copies.ts ] && bun run meta/feature-flags/sync-bundled-copies.ts 2>/dev/null || true)",
     "prepack": "node ../scripts/prepack-bundled-deps.mjs"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "^0.16.1",
-    "@anthropic-ai/sdk": "^0.78.0",
-    "@google/genai": "^1.40.0",
-    "@modelcontextprotocol/sdk": "^1.15.1",
-    "@qdrant/js-client-rest": "^1.16.2",
-    "@resvg/resvg-js": "^2.6.2",
-    "@sentry/node": "^10.38.0",
+    "@agentclientprotocol/sdk": "0.16.1",
+    "@anthropic-ai/sdk": "0.78.0",
+    "@google/genai": "1.45.0",
+    "@modelcontextprotocol/sdk": "1.27.1",
+    "@qdrant/js-client-rest": "1.17.0",
+    "@resvg/resvg-js": "2.6.2",
+    "@sentry/node": "10.43.0",
     "@vellumai/ces-contracts": "file:../packages/ces-contracts",
     "@vellumai/credential-storage": "file:../packages/credential-storage",
     "@vellumai/egress-proxy": "file:../packages/egress-proxy",
-    "agentmail": "^0.1.0",
-    "archiver": "^7.0.1",
-    "commander": "^13.1.0",
-    "croner": "^10.0.1",
-    "dotenv": "^17.3.1",
-    "drizzle-orm": "^0.38.4",
-    "jszip": "^3.10.1",
-    "minimatch": "^10.2.4",
-    "openai": "^6.18.0",
-    "pino": "^9.6.0",
-    "pino-pretty": "^13.1.3",
-    "playwright": "^1.58.2",
-    "postgres": "^3.4.8",
-    "qrcode": "^1.5.4",
-    "react": "^19.2.4",
-    "rrule": "^2.8.1",
-    "tldts": "^7.0.23",
+    "archiver": "7.0.1",
+    "commander": "13.1.0",
+    "croner": "10.0.1",
+    "dotenv": "17.3.1",
+    "drizzle-orm": "0.45.2",
+    "jszip": "3.10.1",
+    "marked": "18.0.0",
+    "minimatch": "10.2.4",
+    "openai": "6.29.0",
+    "pino": "9.14.0",
+    "pino-pretty": "13.1.3",
+    "playwright": "1.58.2",
+    "postgres": "3.4.8",
+    "qrcode": "1.5.4",
+    "rrule": "2.8.1",
+    "tldts": "7.0.25",
     "tree-sitter-bash": "0.25.1",
-    "uuid": "^11.1.0",
+    "uuid": "11.1.0",
     "web-tree-sitter": "0.26.5",
-    "yaml": "^2.7.1",
-    "zod": "^4.3.6"
+    "yaml": "2.8.2",
+    "zod": "4.3.6"
   },
   "engines": {
     "node": ">=20.12.0"
@@ -75,18 +74,17 @@
     "path-to-regexp": "^8.4.0"
   },
   "devDependencies": {
-    "@types/archiver": "^7.0.0",
-    "@types/bun": "^1.2.4",
-    "@types/node": "^25.2.2",
-    "@types/react": "^19.2.14",
-    "@types/uuid": "^10.0.0",
-    "drizzle-kit": "^0.30.4",
-    "eslint": "^10.0.0",
-    "eslint-plugin-simple-import-sort": "^12.1.1",
-    "fast-check": "^4.5.3",
-    "knip": "^5.83.1",
-    "prettier": "^3.8.1",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.54.0"
+    "@types/archiver": "7.0.0",
+    "@types/bun": "1.3.10",
+    "@types/node": "25.5.0",
+    "@types/uuid": "10.0.0",
+    "drizzle-kit": "0.30.6",
+    "eslint": "10.0.3",
+    "eslint-plugin-simple-import-sort": "12.1.1",
+    "fast-check": "4.6.0",
+    "knip": "5.86.0",
+    "prettier": "3.8.1",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.57.0"
   }
 }

package/scripts/generate-openapi.ts

@@ -212,8 +212,6 @@ async function collectRoutesFromModules(): Promise<RouteEntry[]> {
  * here if openapi.yaml is also stale. Plan items B2/C2 address this gap.
  */
 const INLINE_ROUTES: RouteEntry[] = [
-  { endpoint: "browser-relay/status", method: "GET" },
-  { endpoint: "browser-relay/command", method: "POST" },
   { endpoint: "conversations", method: "GET" },
   { endpoint: "conversations/seen", method: "POST" },
   { endpoint: "conversations/unread", method: "POST" },

package/scripts/test.sh

@@ -18,6 +18,19 @@ set -uo pipefail
 EXCLUDE_EXPERIMENTAL="${EXCLUDE_EXPERIMENTAL:-false}"
 WORKERS="${TEST_WORKERS:-$(sysctl -n hw.logicalcpu 2>/dev/null || nproc 2>/dev/null || echo 8)}"
 COVERAGE="${COVERAGE:-false}"
+
+# Ensure the bundled feature-flag-registry.json exists before running tests.
+# The canonical copy lives at meta/feature-flags/feature-flag-registry.json and
+# is synced into assistant/src/ and gateway/src/ by sync-bundled-copies.ts.
+# CI runs this as a dedicated step; locally, postinstall handles it — but when
+# node_modules is symlinked (e.g. worktrees) postinstall never fires, so the
+# bundled copy can be missing and feature-flag-registry-bundled.test.ts fails.
+# Running the sync here is idempotent and cheap (two file copies).
+repo_root_sync="$(cd .. && pwd)"
+if [[ -f "${repo_root_sync}/meta/feature-flags/sync-bundled-copies.ts" ]]; then
+  (cd "${repo_root_sync}" && bun run meta/feature-flags/sync-bundled-copies.ts >/dev/null 2>&1 || true)
+fi
+unset repo_root_sync
 # Per-test timeout (seconds). Kills bun processes that pass but don't exit due to open handles.
 PER_TEST_TIMEOUT="${PER_TEST_TIMEOUT:-120}"
 # Longest-first scheduling: provide a durations file from a previous run to sort
@@ -30,11 +43,28 @@ EXPERIMENTAL_FILES=(
   "memory-regressions.experimental.test.ts"
 )
 
+# Tests that exist in the tree but are known-broken when run.  They were
+# invisible to the previous `src/__tests__ -maxdepth 1` glob, so drift against
+# the surrounding code went uncaught.  They are excluded unconditionally until
+# triage lands a fix for each.  Each entry should get a follow-up issue before
+# being removed from this list.
+#
+# Entries must be repo-relative paths (e.g.
+# `src/cli/commands/platform/__tests__/connect.test.ts`) — matching by
+# `basename` would silently exclude every copy of ambiguous names like
+# `connect.test.ts` or `status.test.ts`, since those recur under multiple
+# `src/cli/commands/*/__tests__/` directories.
+#
+# To triage an entry: run `bun test <path>` from `assistant/` and fix the
+# underlying code or tests until the file is green, then remove it here.
+KNOWN_BROKEN_FILES=(
+)
+
 # Collect test files, filtering experimental if needed
 test_files=()
 while IFS= read -r test_file; do
+  base_name="$(basename "${test_file}")"
   if [[ "${EXCLUDE_EXPERIMENTAL}" == "true" ]]; then
-    base_name="$(basename "${test_file}")"
     skip=0
     for ef in "${EXPERIMENTAL_FILES[@]}"; do
       if [[ "${base_name}" == "${ef}" ]]; then
@@ -47,15 +77,32 @@ while IFS= read -r test_file; do
     fi
   fi
   # Always exclude benchmark files — run them with `bun run test:bench` instead
-  if [[ "$(basename "${test_file}")" == *.benchmark.test.ts ]]; then
+  if [[ "${base_name}" == *.benchmark.test.ts ]]; then
+    continue
+  fi
+  # Always exclude known-broken files (see comment above the list).
+  # Compare against the full repo-relative path — matching by basename would
+  # silently drop every copy of ambiguous filenames.
+  # The `${arr[@]+...}` guard keeps `set -u` happy when the list is empty
+  # (bash 3.2 on macOS treats `"${empty[@]}"` as unbound).
+  skip_broken=0
+  for bf in ${KNOWN_BROKEN_FILES[@]+"${KNOWN_BROKEN_FILES[@]}"}; do
+    if [[ "${test_file}" == "${bf}" ]]; then
+      skip_broken=1
+      break
+    fi
+  done
+  if [[ ${skip_broken} -eq 1 ]]; then
     continue
   fi
 
   test_files+=("${test_file}")
-done < <(find src/__tests__ -maxdepth 1 -type f -name '*.test.ts' | sort)
+done < <(
+  find src -type f -name '*.test.ts' | sort
+)
 
 if [[ ${#test_files[@]} -eq 0 ]]; then
-  echo "No test files found under src/__tests__"
+  echo "No test files found under src"
   exit 1
 fi
 
@@ -64,32 +111,38 @@ fi
 # piling up at the end and becoming long poles.
 if [[ -n "${TEST_DURATIONS_FILE}" && -f "${TEST_DURATIONS_FILE}" ]]; then
   sorted_files=()
-  # Build lookup: basename -> duration_ms
+  # Build lookup: repo-relative path -> duration_ms.
+  # Keying by basename would collide on ambiguous names (e.g. `connect.test.ts`
+  # exists under several `src/cli/commands/*/__tests__/` directories) and
+  # mis-schedule them, so stick with the full path that `find` produces.
   declare -A dur_map
-  while IFS=$'\t' read -r ms name; do
-    dur_map["${name}"]="${ms}"
+  while IFS=$'\t' read -r ms path; do
+    [[ -z "${path}" ]] && continue
+    dur_map["${path}"]="${ms}"
   done < "${TEST_DURATIONS_FILE}"
 
   # Partition into known (with durations) and unknown
   known=()
   unknown=()
   for f in "${test_files[@]}"; do
-    base="$(basename "${f}")"
-    if [[ -n "${dur_map["${base}"]:-}" ]]; then
-      known+=("${dur_map["${base}"]}"$'\t'"${f}")
+    if [[ -n "${dur_map["${f}"]:-}" ]]; then
+      known+=("${dur_map["${f}"]}"$'\t'"${f}")
     else
       unknown+=("${f}")
     fi
   done
 
-  # Sort known by duration descending
-  while IFS= read -r line; do
-    sorted_files+=("${line#*$'\t'}")
-  done < <(printf '%s\n' "${known[@]}" | sort -t$'\t' -k1 -rn)
+  # Sort known by duration descending. Guard with `${arr[@]+...}` so bash 3.2
+  # under `set -u` doesn't trip when either partition is empty.
+  if [[ ${#known[@]} -gt 0 ]]; then
+    while IFS= read -r line; do
+      sorted_files+=("${line#*$'\t'}")
+    done < <(printf '%s\n' "${known[@]}" | sort -t$'\t' -k1 -rn)
+  fi
 
   # Append unknown files at the end
-  sorted_files+=("${unknown[@]}")
-  test_files=("${sorted_files[@]}")
+  sorted_files+=(${unknown[@]+"${unknown[@]}"})
+  test_files=(${sorted_files[@]+"${sorted_files[@]}"})
   echo "Sorted tests longest-first using ${TEST_DURATIONS_FILE} (${#known[@]} known, ${#unknown[@]} new)"
 fi
 
@@ -154,8 +207,10 @@ printf '%s\n' "${test_files[@]}" | xargs -P "${WORKERS}" -I {} bash -c '
 
   base="$(basename "${test_file}")"
 
-  # Record duration for longest-first scheduling in future runs
-  echo -e "${elapsed}\t${base}" >> "${results_dir}/durations"
+  # Record duration for longest-first scheduling in future runs.
+  # Write the repo-relative path (not the basename) so the lookup in future
+  # runs disambiguates files that share a basename across directories.
+  echo -e "${elapsed}\t${test_file}" >> "${results_dir}/durations"
 
   if [[ -n "${timeout_cmd}" && ( ${exit_code} -eq 124 || ${exit_code} -eq 137 ) ]]; then
     # timeout killed the process — check if all tests actually passed.

package/src/__tests__/acp-session.test.ts

@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { VellumAcpClientHandler } from "../acp/client-handler.js";
 import { AcpSessionManager } from "../acp/session-manager.js";
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 
@@ -15,6 +16,7 @@ describe("VellumAcpClientHandler", () => {
   let handler: VellumAcpClientHandler;
 
   beforeEach(() => {
+    _setOverridesForTesting({});
     sent = [];
     sendToVellum = (msg) => sent.push(msg);
     handler = new VellumAcpClientHandler(
@@ -229,6 +231,47 @@ describe("VellumAcpClientHandler", () => {
       expect(msg.riskLevel).toBe("medium");
     });
 
+    test("suppresses ACP confirmation UI under v2 and chooses the allow option", async () => {
+      _setOverridesForTesting({ "permission-controls-v2": true });
+
+      const result = await handler.requestPermission({
+        toolCall: {
+          title: "Read file",
+          kind: "read",
+          rawInput: "/tmp/example.txt",
+        },
+        options: [
+          { optionId: "allow", name: "Allow", kind: "allow_once" },
+          { optionId: "deny", name: "Deny", kind: "reject_once" },
+        ],
+      } as any);
+
+      expect(result).toEqual({
+        outcome: { outcome: "selected", optionId: "allow" },
+      });
+      expect(sent).toHaveLength(0);
+      expect(handler.pendingRequestIds.size).toBe(0);
+    });
+
+    test("suppresses ACP confirmation UI under v2 and cancels when no allow option exists", async () => {
+      _setOverridesForTesting({ "permission-controls-v2": true });
+
+      const result = await handler.requestPermission({
+        toolCall: {
+          title: "Read file",
+          kind: "read",
+          rawInput: "/tmp/example.txt",
+        },
+        options: [{ optionId: "deny", name: "Deny", kind: "reject_once" }],
+      } as any);
+
+      expect(result).toEqual({
+        outcome: { outcome: "cancelled" },
+      });
+      expect(sent).toHaveLength(0);
+      expect(handler.pendingRequestIds.size).toBe(0);
+    });
+
     test("ACP registration survives sendToVellum overwrite (makeEventSender race)", async () => {
       // Simulate makeEventSender: when sendToVellum is called with a
       // confirmation_request, it overwrites the pendingInteractions entry

package/src/__tests__/agent-image-optimize.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "bun:test";
+
+import { shouldRescaleImage } from "../agent/image-optimize.js";
+
+describe("shouldRescaleImage", () => {
+  it("rescales when any side exceeds the max dimension, regardless of file size", () => {
+    // Regression: a sparse screenshot can be tiny in bytes but 3000+ px wide,
+    // which Anthropic rejects in many-image requests with a 2000 px cap.
+    expect(shouldRescaleImage({ width: 3000, height: 900 }, 50_000)).toBe(true);
+    expect(shouldRescaleImage({ width: 900, height: 3000 }, 50_000)).toBe(true);
+  });
+
+  it("skips rescale when dimensions are known and within limits", () => {
+    expect(shouldRescaleImage({ width: 1200, height: 800 }, 50_000)).toBe(
+      false,
+    );
+    // Even a large file is fine as long as dimensions are within limits —
+    // Anthropic's constraint is per-side pixels, not bytes.
+    expect(shouldRescaleImage({ width: 1568, height: 1568 }, 5_000_000)).toBe(
+      false,
+    );
+  });
+
+  it("falls back to file size when dimensions are unparseable", () => {
+    expect(shouldRescaleImage(null, 50_000)).toBe(false);
+    expect(shouldRescaleImage(null, 5_000_000)).toBe(true);
+  });
+});

package/src/__tests__/agent-loop.test.ts

@@ -1708,4 +1708,127 @@ describe("AgentLoop", () => {
     // Turn 4 should NOT have the nudge (exceeded limit)
     expect(hasRetryNudge(4)).toBe(false);
   });
+
+  // Empty response retry — model returns no text and no tool_use after tool results
+  test("retries once when model returns empty response after tool results", async () => {
+    const emptyResponse: ProviderResponse = {
+      content: [],
+      model: "mock-model",
+      usage: { inputTokens: 10, outputTokens: 0 },
+      stopReason: "end_turn",
+    };
+
+    const { provider, calls } = createMockProvider([
+      toolUseResponse("t1", "read_file", { path: "/a.txt" }),
+      emptyResponse, // First response after tool result: empty
+      textResponse("Here is what I found in the file."), // Retry response: has text
+    ]);
+
+    const toolExecutor = async () => ({
+      content: "file contents here",
+      isError: false,
+    });
+
+    const loop = new AgentLoop(
+      provider,
+      "system",
+      {},
+      dummyTools,
+      toolExecutor,
+    );
+    const events: AgentEvent[] = [];
+    const history = await loop.run([userMessage], collectEvents(events));
+
+    // Provider should be called 3 times: initial, empty response, retry
+    expect(calls).toHaveLength(3);
+
+    // The retry call should include the nudge message
+    const retryMessages = calls[2].messages;
+    const lastMsg = retryMessages[retryMessages.length - 1];
+    expect(lastMsg.role).toBe("user");
+    expect(
+      lastMsg.content.some(
+        (b) =>
+          b.type === "text" &&
+          "text" in b &&
+          (b as { text: string }).text.includes("previous response was empty"),
+      ),
+    ).toBe(true);
+
+    // Final history should have the successful text response
+    const lastAssistant = [...history]
+      .reverse()
+      .find((m) => m.role === "assistant");
+    expect(lastAssistant).toBeDefined();
+    expect(lastAssistant!.content).toEqual([
+      { type: "text", text: "Here is what I found in the file." },
+    ]);
+
+    // message_complete emitted for tool_use response + retry text response (not the empty one)
+    const messageCompletes = events.filter((e) => e.type === "message_complete");
+    expect(messageCompletes).toHaveLength(2);
+  });
+
+  test("gives up after max empty response retries", async () => {
+    const emptyResponse: ProviderResponse = {
+      content: [],
+      model: "mock-model",
+      usage: { inputTokens: 10, outputTokens: 0 },
+      stopReason: "end_turn",
+    };
+
+    const { provider, calls } = createMockProvider([
+      toolUseResponse("t1", "read_file", { path: "/a.txt" }),
+      emptyResponse, // First response after tool result: empty
+      emptyResponse, // Retry also empty — should give up
+    ]);
+
+    const toolExecutor = async () => ({
+      content: "file contents here",
+      isError: false,
+    });
+
+    const loop = new AgentLoop(
+      provider,
+      "system",
+      {},
+      dummyTools,
+      toolExecutor,
+    );
+    const events: AgentEvent[] = [];
+    const history = await loop.run([userMessage], collectEvents(events));
+
+    // Provider called 3 times: initial, empty, retry (also empty)
+    expect(calls).toHaveLength(3);
+
+    // message_complete: tool_use response + final empty response (retry exhausted)
+    const messageCompletes = events.filter((e) => e.type === "message_complete");
+    expect(messageCompletes).toHaveLength(2);
+
+    // The last assistant message in history is the empty one
+    const lastAssistant = [...history]
+      .reverse()
+      .find((m) => m.role === "assistant");
+    expect(lastAssistant).toBeDefined();
+    expect(lastAssistant!.content).toEqual([]);
+  });
+
+  test("does not retry empty response on first turn (no prior tool use)", async () => {
+    const emptyResponse: ProviderResponse = {
+      content: [],
+      model: "mock-model",
+      usage: { inputTokens: 10, outputTokens: 0 },
+      stopReason: "end_turn",
+    };
+
+    const { provider, calls } = createMockProvider([emptyResponse]);
+
+    const loop = new AgentLoop(provider, "system");
+    const events: AgentEvent[] = [];
+    const history = await loop.run([userMessage], collectEvents(events));
+
+    // Should NOT retry — this is the first turn with no tool use history
+    expect(calls).toHaveLength(1);
+    expect(history).toHaveLength(2); // user + empty assistant
+  });
 });